mason-context 0.14.2 → 0.16.0

package/dist/mason-auto.js

@@ -2521,7 +2521,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     exec7 = promisify8(execFile8);
-    engineVersion = true ? "0.14.2" : "development";
+    engineVersion = true ? "0.16.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
@@ -2813,9 +2813,9 @@ async function automationStatus(dir) {
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
   const latest = state.latest ? await readStoreJson(ws.root, state.latest) : null;
-  const hosts = {};
+  const hosts2 = {};
   for (const session of Object.values(state.sessions)) {
-    const host = hosts[session.host] ??= { sessions: 0, observedEvents: [] };
+    const host = hosts2[session.host] ??= { sessions: 0, observedEvents: [] };
     host.sessions++;
     host.observedEvents = [.../* @__PURE__ */ new Set([...host.observedEvents, ...Object.keys(session.events)])];
   }
@@ -2828,7 +2828,7 @@ async function automationStatus(dir) {
     baselinePaths: state.baselines.map((b) => b.path),
     reportPath: state.latest,
     verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
-    hosts,
+    hosts: hosts2,
     execution,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
@@ -2852,7 +2852,7 @@ var init_runtime = __esm({
 // src/setup/model.ts
 import { z as z7 } from "zod";
 async function loadSetup(root) {
-  const raw = await readStoreJson(root, ".mason/setup.json");
+  const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
@@ -2863,28 +2863,23 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    runtimeSchema = z7.object({
-      id: z7.string().regex(/^[a-f0-9]{24}$/),
-      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/)),
-      bundle: z7.object({ target: z7.string(), manifestHash: z7.string().regex(/^[a-f0-9]{64}$/) }).optional()
-    });
     setupHostSchema = z7.object({
-      runtime: runtimeSchema,
+      configuredVersion: z7.string(),
       revision: z7.string().uuid(),
       fingerprint: z7.string(),
       mcpFingerprint: z7.string(),
       instructions: z7.array(z7.string())
     });
-    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
+    SETUP_PATH = ".mason/local/setup.json";
     receiptSchema = z7.object({
       version: z7.literal(1),
       host: z7.enum(["codex", "claude"]),
@@ -2898,6 +2893,39 @@ var init_model = __esm({
   }
 });
 
+// src/setup/launcher.ts
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+function globalCommand(args, platform = process.platform) {
+  return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
+}
+async function installedCommand() {
+  const invocation = globalCommand(["internal-integration-version"]);
+  try {
+    const { stdout } = await promisify9(execFile9)(
+      invocation.command,
+      invocation.args,
+      { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
+    );
+    const result = JSON.parse(stdout);
+    if (result.protocol !== 1 || typeof result.version !== "string") throw new Error("Unsupported Mason integration protocol.");
+    return { available: true, version: result.version, message: null };
+  } catch {
+    return { available: false, version: null, message: "An up-to-date mason command is not available on this process's PATH. Install or upgrade Mason, then reopen your terminal or desktop assistant and rerun mason setup." };
+  }
+}
+var executingVersion, mcpCommand, hookCommand;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    init_evidence();
+    init_model();
+    executingVersion = () => true ? "0.16.0" : "development";
+    mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
+    hookCommand = (host) => `mason --setup-host ${host} auto`;
+  }
+});
+
 // src/setup/observations.ts
 var observations_exports = {};
 __export(observations_exports, {
@@ -2907,14 +2935,14 @@ __export(observations_exports, {
 });
 import fs13 from "fs/promises";
 import { z as z8 } from "zod";
-function observationPath(directory, host, revision) {
-  return `${directory}/activation/${host}-${revision}.json`;
+function observationPath(directory, host, revision, version = executingVersion()) {
+  return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
-async function readObservation(root, directory, host, revision) {
-  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+async function readObservation(root, directory, host, revision, version = executingVersion()) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision, version));
   if (raw === null) return null;
   const record = observationSchema.parse(raw);
-  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  if (record.root !== root || record.host !== host || record.revision !== revision || record.masonVersion !== version) throw new Error("Activation receipt belongs to another installation.");
   return record;
 }
 async function observeActivation(dir, event, options = {}) {
@@ -2931,6 +2959,7 @@ async function observeActivation(dir, event, options = {}) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
         version: 1,
+        masonVersion: executingVersion(),
         root: ws.root,
         revision,
         host,
@@ -2969,8 +2998,10 @@ var init_observations = __esm({
     init_store();
     init_storage();
     init_model();
+    init_launcher();
     observationSchema = z8.object({
       version: z8.literal(1),
+      masonVersion: z8.string(),
       root: z8.string(),
       revision: z8.string(),
       host: z8.enum(["codex", "claude"]),
@@ -3060,106 +3091,157 @@ var init_adapters = __esm({
   }
 });
 
-// src/automation/install.ts
-var install_exports = {};
-__export(install_exports, {
-  automationConfigSchema: () => automationConfigSchema,
-  configPath: () => configPath,
-  installAutomation: () => installAutomation,
-  installedAutomation: () => installedAutomation,
-  planAutomationInstall: () => planAutomationInstall
+// src/setup/files.ts
+var files_exports = {};
+__export(files_exports, {
+  applyEdit: () => applyEdit,
+  managedBlock: () => managedBlock,
+  readText: () => readText
 });
-import { z as z10 } from "zod";
-async function installAutomation(dir, host, command) {
-  const ws = await workspace(dir);
-  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
+import fs14 from "fs/promises";
+import path18 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
 }
-async function planAutomationInstall(root, host, command) {
-  const file = configPath(host);
-  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
-  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
-  const desired = hookConfig(host, command);
-  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
-  const previous = record.hosts[host]?.command;
-  const hooks = existing.hooks ?? {};
-  for (const event of HOOK_EVENTS) {
-    hooks[event] = (hooks[event] ?? []).map((group) => ({
-      ...group,
-      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
-    })).filter((group) => group.hooks.length);
-    hooks[event].push(...desired.hooks[event]);
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
   }
-  record.hosts[host] = { command: newCommand };
-  return { file, config: { ...existing, hooks }, record, newCommand };
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
 }
-async function installLocked(root, host, command) {
-  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command);
-  await writeStoreJson(root, file, config);
-  await writeStoreJson(root, ".mason/automation.json", record);
-  return {
-    version: 1,
-    host,
-    configPath: file,
-    status: "configured",
-    command: newCommand,
-    events: HOOK_EVENTS,
-    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
-    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
-  };
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Integration input changed during update: " + edit.path + ". Rerun the requested command to resume.");
+  if (edit.after === null) {
+    const file2 = await storePath(root, edit.path);
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
+    await fs14.unlink(file2);
+    return true;
+  }
+  const file = await storePath(root, edit.path, true);
+  const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs14.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs14.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
+    await fs14.rename(temporary, file);
+    return true;
+  } finally {
+    await fs14.rm(temporary, { force: true });
+  }
 }
-async function installedAutomation(dir) {
-  const ws = await workspace(dir);
-  const raw = await readStoreJson(ws.root, ".mason/automation.json");
-  if (raw === null) return {};
-  const record = recordSchema.parse(raw);
-  const result = {};
-  for (const host of ["claude", "codex"]) {
-    const expected = record.hosts[host];
-    if (!expected) continue;
-    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
-    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
-    result[host] = {
-      configPath: configPath(host),
-      configuredEvents,
-      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
-      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+  }
+});
+
+// src/setup/ownership.ts
+var ownership_exports = {};
+__export(ownership_exports, {
+  BLOCKS: () => BLOCKS,
+  OWNERSHIP_PATH: () => OWNERSHIP_PATH,
+  blockSpan: () => blockSpan,
+  completedHookOwnership: () => completedHookOwnership,
+  ownershipEdit: () => ownershipEdit,
+  ownershipSchema: () => ownershipSchema
+});
+import { z as z10 } from "zod";
+import { parse } from "smol-toml";
+function blockSpan(text2, start, end) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (!starts && !ends) return null;
+  const from = text2.indexOf(start), to = text2.indexOf(end) + end.length;
+  if (starts !== 1 || ends !== 1 || to <= from) throw new Error("Ambiguous Mason markers; inspect the marked block manually.");
+  return { from, to, text: text2.slice(from, to) };
+}
+async function ownershipEdit(root, edits, hookCommands = {}) {
+  const before = await readText(root, OWNERSHIP_PATH);
+  const record = before === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(before));
+  for (const edit of edits) {
+    const previous = record.files[edit.path];
+    const entry = {
+      created: edit.before === null || (previous?.created ?? false),
+      initialHash: edit.before === null || previous?.initialHash === hash(edit.before) ? hash(edit.after) : previous?.initialHash ?? hash(edit.after),
+      blocks: Object.fromEntries(BLOCKS.flatMap(([start, end]) => {
+        const block = blockSpan(edit.after, start, end);
+        return block ? [[start, hash(block.text)]] : [];
+      }))
+    };
+    const mcp = edit.path === ".codex/config.toml" ? parse(edit.after).mcp_servers?.mason : edit.path === ".mcp.json" ? JSON.parse(edit.after).mcpServers?.mason : void 0;
+    const hooks = edit.path === ".codex/hooks.json" || edit.path === ".claude/settings.json" ? JSON.parse(edit.after).hooks : void 0;
+    record.files[edit.path] = {
+      ...entry,
+      ...mcp === void 0 ? {} : { mcpHash: hash(mcp) },
+      ...hookCommands[edit.path] ? { hookCommands: [.../* @__PURE__ */ new Set([...previous?.hookCommands ?? [], hookCommands[edit.path]])] } : {},
+      ...hooks === void 0 ? {} : { hooks: Object.fromEntries(Object.entries(hooks).map(([event, groups]) => [event, groups.flatMap((group) => group.hooks.map(hash))])) }
     };
   }
-  return result;
+  return { path: OWNERSHIP_PATH, before, after: JSON.stringify(record, null, 2) + "\n" };
 }
-var groupSchema, automationConfigSchema, recordSchema, configPath;
-var init_install = __esm({
-  "src/automation/install.ts"() {
+async function completedHookOwnership(root, file, command) {
+  const before = await readText(root, OWNERSHIP_PATH);
+  const record = ownershipSchema.parse(JSON.parse(before ?? "null"));
+  record.files[file].hookCommands = [command];
+  return { path: OWNERSHIP_PATH, before, after: JSON.stringify(record, null, 2) + "\n" };
+}
+var OWNERSHIP_PATH, BLOCKS, fileSchema, ownershipSchema;
+var init_ownership = __esm({
+  "src/setup/ownership.ts"() {
     "use strict";
-    init_storage();
     init_evidence();
-    init_adapters();
-    init_store();
-    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
-    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+    init_files2();
+    OWNERSHIP_PATH = ".mason/local/integration.json";
+    BLOCKS = [
+      ["<!-- mason:start -->", "<!-- mason:end -->"],
+      ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
+      ["# mason:mcp:start", "# mason:mcp:end"]
+    ];
+    fileSchema = z10.object({
+      created: z10.boolean(),
+      initialHash: z10.string(),
+      blocks: z10.record(z10.string()),
+      mcpHash: z10.string().optional(),
+      hookCommands: z10.array(z10.string()).optional(),
+      hooks: z10.record(z10.array(z10.string())).optional()
+    });
+    ownershipSchema = z10.object({ version: z10.literal(1), files: z10.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
 import { z as z11 } from "zod";
-async function loadProjectMarker(rootDir) {
-  const raw = await readStoreJson(rootDir, ".mason/project.json");
-  return raw === null ? null : markerSchema.parse(raw);
-}
-async function saveProjectMarker(rootDir, marker) {
-  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
-}
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
+    init_files2();
     markerSchema = z11.object({
       version: z11.literal(1),
       initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+      features: z11.object({ confluence: z11.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3181,7 +3263,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 Inspect source for what the retrieved context does not answer.
 <!-- mason:end -->`;
     ASSISTANT_SETUP = `UNIFIED SETUP
-When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
 If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
 
 The managed project guidance is:
@@ -3189,7 +3271,7 @@ ${CLAUDE_MD_SECTION}`;
     QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
-2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
 3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
@@ -3231,14 +3313,506 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
+// src/utils/git.ts
+var git_exports = {};
+__export(git_exports, {
+  isGitRepo: () => isGitRepo
+});
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function isGitRepo(dir) {
+  try {
+    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var exec8;
+var init_git2 = __esm({
+  "src/utils/git.ts"() {
+    "use strict";
+    exec8 = promisify10(execFile10);
+  }
+});
+
+// src/setup/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ancillaryEdits: () => ancillaryEdits,
+  hookEdits: () => hookEdits,
+  inspectHostConfig: () => inspectHostConfig,
+  instructionEdits: () => instructionEdits,
+  mcpEdit: () => mcpEdit,
+  mcpPath: () => mcpPath
+});
+import { isDeepStrictEqual } from "util";
+import { parse as parse2, stringify } from "smol-toml";
+import { z as z12 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
+    }
+  }
+  return edits;
+}
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse2(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse2(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: AUTOMATION_PATH, before: await readText(root, AUTOMATION_PATH), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
+  let parentIgnored = false;
+  try {
+    if (await isGitRepo2(root)) parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [
+    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/decisions/",
+    "!/.mason/decisions/**",
+    "!/.mason/config.json",
+    "!/.mason/snapshot.json",
+    "/.mason/local/",
+    "/.mason/reports/"
+  ].join("\n");
+  return [{ path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) }];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse2(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z12.record(z12.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/automation/install.ts
+var install_exports = {};
+__export(install_exports, {
+  AUTOMATION_PATH: () => AUTOMATION_PATH,
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall,
+  recordSchema: () => recordSchema
+});
+import { z as z13 } from "zod";
+async function installationRecord(root) {
+  return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
+}
+async function installAutomation(dir, host, command) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/setup-lock", () => installLocked(ws.root, host, command));
+}
+async function planAutomationInstall(root, host, command) {
+  const file = configPath(host);
+  const before = await readText(root, file);
+  const existing = automationConfigSchema.parse(JSON.parse(before ?? "{}"));
+  const record = await installationRecord(root);
+  const desired = hookConfig(host, command);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const ownershipText = await readText(root, OWNERSHIP_PATH);
+  const pending = ownershipText === null ? [] : ownershipSchema.parse(JSON.parse(ownershipText)).files[file]?.hookCommands ?? [];
+  const owned = /* @__PURE__ */ new Set([previous, ...pending, newCommand]);
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && owned.has(handler.command)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  return { file, before, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command) {
+  const { file, before, config, record, newCommand } = await planAutomationInstall(root, host, command);
+  const { ancillaryEdits: ancillaryEdits2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { applyEdit: applyEdit2 } = await Promise.resolve().then(() => (init_files2(), files_exports));
+  const { ownershipEdit: ownershipEdit2, completedHookOwnership: completedHookOwnership2 } = await Promise.resolve().then(() => (init_ownership(), ownership_exports));
+  const edit = { path: file, before, after: JSON.stringify(config, null, 2) + "\n" };
+  const ancillary = await ancillaryEdits2(root);
+  await applyEdit2(root, await ownershipEdit2(root, [edit], { [file]: newCommand }));
+  for (const edit2 of ancillary) await applyEdit2(root, edit2);
+  await applyEdit2(root, edit);
+  await writeStoreJson(root, AUTOMATION_PATH, record);
+  await applyEdit2(root, await completedHookOwnership2(root, file, newCommand));
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const record = await installationRecord(ws.root);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+var groupSchema, automationConfigSchema, recordSchema, AUTOMATION_PATH, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    init_files2();
+    init_ownership();
+    groupSchema = z13.object({ hooks: z13.array(z13.object({ type: z13.string(), command: z13.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z13.object({ hooks: z13.record(z13.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z13.object({ version: z13.literal(1), hosts: z13.record(z13.object({ command: z13.string() })) });
+    AUTOMATION_PATH = ".mason/local/automation.json";
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/setup/teardown.ts
+var teardown_exports = {};
+__export(teardown_exports, {
+  summarizeTeardown: () => summarizeTeardown,
+  teardownProject: () => teardownProject
+});
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { parse as parse3, stringify as stringify2 } from "smol-toml";
+import fg5 from "fast-glob";
+import { z as z14 } from "zod";
+async function planTeardown(root, selected) {
+  const edits = [], diagnostics = [];
+  const inputs = /* @__PURE__ */ new Map();
+  const read = async (file) => {
+    if (!inputs.has(file)) inputs.set(file, await readText(root, file));
+    return inputs.get(file);
+  };
+  const attempt = async (file, action) => {
+    try {
+      await action();
+    } catch (error) {
+      diagnostics.push({ path: file, message: error instanceof Error ? error.message : String(error) });
+    }
+  };
+  const ownershipBefore = await read(OWNERSHIP_PATH);
+  const ownership = ownershipBefore === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(ownershipBefore));
+  const setupBefore = await read(SETUP_PATH);
+  const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
+  const automationBefore = await read(AUTOMATION_PATH);
+  const automation = automationBefore === null ? null : recordSchema.parse(JSON.parse(automationBefore));
+  const commands = (host) => new Set([
+    automation?.hosts[host]?.command,
+    ...ownership.files[configPath(host)]?.hookCommands ?? [],
+    hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command,
+    hookConfig(host).hooks.SessionStart[0].hooks[0].command
+  ].filter((command) => !!command));
+  const possibleHook = (command, host) => commands(host).has(command) || /\bmason(?:-auto|-hook)?\b/.test(command);
+  const add = (file, before, after, empty) => {
+    edits.push({ path: file, before, after: ownership.files[file]?.created && (empty || ownership.files[file].initialHash === hash(before)) ? null : after });
+  };
+  let remainingHost = hosts.some((host) => !selected.includes(host) && (setup?.hosts[host] || automation?.hosts[host] || ownership.files[mcpPath(host)] || ownership.files[configPath(host)]));
+  for (const host of hosts.filter((host2) => !selected.includes(host2))) {
+    await attempt(mcpPath(host), async () => {
+      const text2 = await read(mcpPath(host));
+      const config = host === "codex" ? parse3(text2 ?? "") : object2.parse(JSON.parse(text2 ?? "{}"));
+      const servers = object2.parse((host === "codex" ? config.mcp_servers : config.mcpServers) ?? {});
+      remainingHost ||= servers.mason !== void 0;
+    });
+    await attempt(configPath(host), async () => {
+      const config = automationConfigSchema.parse(JSON.parse(await read(configPath(host)) ?? "{}"));
+      remainingHost ||= Object.values(config.hooks ?? {}).some((groups) => groups.some((group) => group.hooks.some((handler) => handler.command && possibleHook(handler.command, host))));
+    });
+  }
+  for (const host of selected) {
+    const mcpFile = mcpPath(host);
+    await attempt(mcpFile, async () => {
+      const before = await read(mcpFile);
+      if (before === null) return;
+      const config = host === "codex" ? parse3(before) : object2.parse(JSON.parse(before));
+      const key = host === "codex" ? "mcp_servers" : "mcpServers";
+      const servers = object2.parse(config[key] ?? {});
+      if (servers.mason === void 0) {
+        if (host === "codex" && BLOCKS[2].some((marker) => before.includes(marker))) throw new Error("The marked Mason MCP entry was removed or renamed; inspect the retained block manually.");
+        return;
+      }
+      const expected = ownership.files[mcpFile]?.mcpHash ?? hash(mcpCommand(host));
+      if (hash(servers.mason) !== expected) throw new Error("The Mason MCP entry was edited or its ownership is uncertain; retained for manual cleanup.");
+      delete servers.mason;
+      const desired = { ...config, [key]: servers };
+      if (!Object.keys(servers).length) delete desired[key];
+      if (host === "claude") {
+        add(mcpFile, before, json(desired), !Object.keys(desired).length);
+        return;
+      }
+      const [start, end] = BLOCKS[2], block = blockSpan(before, start, end);
+      if (!block) throw new Error("Mason MCP markers are missing; retained for manual cleanup.");
+      const expectedBlock = ownership.files[mcpFile]?.blocks[start];
+      const canonicalBlock = managedBlock("", start, end, stringify2({ mcp_servers: { mason: mcpCommand(host) } }).trimEnd()).trimEnd();
+      if (expectedBlock ? hash(block.text) !== expectedBlock : block.text.replace(/\r\n/g, "\n") !== canonicalBlock) {
+        throw new Error("The Mason MCP block was edited; retained for manual cleanup.");
+      }
+      const after = before.slice(0, block.from) + before.slice(block.to).replace(/^\r?\n/, "");
+      const parsed = parse3(after);
+      if (!Object.keys(servers).length && parsed[key] !== void 0) desired[key] = {};
+      if (!isDeepStrictEqual2(parsed, desired)) throw new Error("Removing the marked block would change other TOML settings; retained for manual cleanup.");
+      add(mcpFile, before, after, !after.trim());
+    });
+    const hookFile = configPath(host);
+    await attempt(hookFile, async () => {
+      const before = await read(hookFile);
+      if (before === null) return;
+      const config = automationConfigSchema.parse(JSON.parse(before));
+      let changed = false;
+      for (const [event, groups] of Object.entries(config.hooks ?? {})) {
+        const known = ownership.files[hookFile]?.hooks?.[event];
+        const handlers = groups.flatMap((group) => group.hooks);
+        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
+          diagnostics.push({ path: hookFile, message: "A recorded Mason hook is missing beside a new or edited handler (" + event + "); inspect ownership manually." });
+        }
+        const kept = groups.flatMap((group) => {
+          const handlers2 = group.hooks.filter((handler) => {
+            if (handler.type === "command" && handler.command && commands(host).has(handler.command)) {
+              changed = true;
+              return false;
+            }
+            if (handler.command && possibleHook(handler.command, host)) diagnostics.push({
+              path: hookFile,
+              message: "An unrecognized Mason hook was retained for manual cleanup (" + event + ")."
+            });
+            return true;
+          });
+          return handlers2.length === group.hooks.length ? [group] : handlers2.length ? [{ ...group, hooks: handlers2 }] : [];
+        });
+        if (kept.length || !groups.length) config.hooks[event] = kept;
+        else delete config.hooks[event];
+      }
+      if (!changed) return;
+      if (!Object.keys(config.hooks ?? {}).length) delete config.hooks;
+      add(hookFile, before, json(config), !Object.keys(config).length);
+    });
+  }
+  const instructionEditStart = edits.length;
+  if (!remainingHost && !diagnostics.length) for (const file of DOC_CANDIDATES) await attempt(file, async () => {
+    const before = await read(file);
+    if (before === null) return;
+    let after = before;
+    for (const [start, end] of BLOCKS.slice(0, 2)) {
+      const block = blockSpan(after, start, end);
+      if (!block) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n@" + (file.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      const canonical = [CLAUDE_MD_SECTION, managedBlock("", start, end, pointer).trimEnd()];
+      const expected = ownership.files[file]?.blocks[start];
+      if (expected ? hash(block.text) !== expected : !canonical.includes(block.text.replace(/\r\n/g, "\n"))) {
+        throw new Error("The Mason instruction block was edited or is unrecognized; retained for manual cleanup.");
+      }
+      after = after.slice(0, block.from) + after.slice(block.to).replace(/^\r?\n/, "");
+    }
+    if (after !== before) add(file, before, after, !after.trim());
+  });
+  if (diagnostics.length) edits.splice(instructionEditStart);
+  if (!diagnostics.length) {
+    const cleanup = [];
+    const receiptFiles = await fg5(
+      selected.map((host) => ".mason/reports/automation/*/setup-" + host + ".json"),
+      { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false }
+    );
+    if (receiptFiles.length > 1e3) throw new Error("Too many setup receipts; inspect local setup history before teardown.");
+    for (const file of receiptFiles.sort()) await attempt(file, async () => {
+      const host = file.endsWith("setup-codex.json") ? "codex" : "claude";
+      await loadSetupReceipt(root, file.slice(0, file.lastIndexOf("/")), host);
+      cleanup.push({ path: file, before: await read(file), after: null });
+    });
+    if (!remainingHost) await attempt(".mason/local/project.json", async () => {
+      const before = await read(".mason/local/project.json");
+      if (before === null) return;
+      z14.object({ version: z14.literal(1), initializedAt: z14.string() }).strict().parse(JSON.parse(before));
+      cleanup.push({ path: ".mason/local/project.json", before, after: null });
+    });
+    if (!diagnostics.length) {
+      for (const host of selected) {
+        if (setup) delete setup.hosts[host];
+        if (automation) delete automation.hosts[host];
+        delete ownership.files[mcpPath(host)];
+        delete ownership.files[configPath(host)];
+      }
+      if (!remainingHost) for (const file of DOC_CANDIDATES) delete ownership.files[file];
+      if (setupBefore !== null) cleanup.push({ path: SETUP_PATH, before: setupBefore, after: Object.keys(setup.hosts).length ? json(setup) : null });
+      if (automationBefore !== null) cleanup.push({ path: AUTOMATION_PATH, before: automationBefore, after: Object.keys(automation.hosts).length ? json(automation) : null });
+      if (ownershipBefore !== null) cleanup.push({ path: OWNERSHIP_PATH, before: ownershipBefore, after: Object.keys(ownership.files).length ? json(ownership) : null });
+      edits.push(...cleanup);
+    }
+  }
+  return { edits: edits.filter((edit) => edit.before !== edit.after), diagnostics, remainingHost, inputs };
+}
+async function teardownProject(dir, options = {}) {
+  const { root } = await workspace(dir);
+  const selected = options.host ? [options.host] : [...hosts];
+  const run = async (apply) => {
+    const plan = await planTeardown(root, selected);
+    if (apply) {
+      for (const [file, before] of plan.inputs) if (await readText(root, file) !== before) throw new Error("Input changed during teardown: " + file + ". Rerun teardown.");
+      for (const edit of plan.edits) await applyEdit(root, edit);
+    }
+    return {
+      version: 1,
+      action: "teardown",
+      status: plan.diagnostics.length ? "incomplete" : "complete",
+      root,
+      hosts: selected,
+      dryRun: !!options.dryRun,
+      changes: plan.edits.map((edit) => ({ path: edit.path, action: edit.after === null ? "delete" : "update" })),
+      diagnostics: plan.diagnostics,
+      sharedInstructionsRetained: plan.remainingHost || !!plan.diagnostics.length,
+      next: plan.diagnostics.length ? "Inspect the retained entries, remove or correct them, then rerun teardown." : "Restart running assistants to unload the project integration. Run mason setup --host codex or --host claude to reconnect."
+    };
+  };
+  const preview = await run(false);
+  if (options.dryRun || !preview.changes.length) return preview;
+  return withLock(root, ".mason/reports/setup-lock", () => run(true));
+}
+function summarizeTeardown(result) {
+  return [
+    `Mason teardown${result.dryRun ? " preview" : ""}: ${result.status}.`,
+    ...result.changes.map((change) => `  ${result.dryRun ? "Would " : ""}${change.action}: ${change.path}`),
+    ...result.diagnostics.map((item) => `  Retained ${item.path}: ${item.message}`),
+    ...!result.changes.length ? ["No changes."] : [],
+    "Shared knowledge, repair evidence, ignore rules and the installed Mason command are retained.",
+    ...result.sharedInstructionsRetained ? ["Shared instruction cleanup is deferred while another host or incomplete removal needs inspection."] : [],
+    ...result.dryRun ? ["Preview only; no files were changed."] : [result.next]
+  ].join("\n");
+}
+var hosts, object2, json;
+var init_teardown = __esm({
+  "src/setup/teardown.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_install();
+    init_adapters();
+    init_docs();
+    init_init();
+    init_files2();
+    init_config();
+    init_launcher();
+    init_model();
+    init_ownership();
+    hosts = ["codex", "claude"];
+    object2 = z14.record(z14.unknown());
+    json = (value) => JSON.stringify(value, null, 2) + "\n";
+  }
+});
+
 // src/review/cochange.ts
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
+    const { stdout } = await exec9(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -3294,11 +3868,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify9(execFile9);
+    exec9 = promisify11(execFile11);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3353,7 +3927,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z12 } from "zod";
+import { z as z15 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -3402,24 +3976,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z12.number().int().nonnegative();
-    schema = z12.object({
-      success: z12.boolean(),
+    count2 = z15.number().int().nonnegative();
+    schema = z15.object({
+      success: z15.boolean(),
       numTotalTests: count2,
       numPassedTests: count2,
       numFailedTests: count2,
       numPendingTests: count2,
       numTodoTests: count2,
       numFailedTestSuites: count2,
-      testResults: z12.array(z12.object({
-        name: z12.string().min(1),
-        status: z12.enum(["passed", "failed"]),
-        message: z12.string().optional(),
-        assertionResults: z12.array(z12.object({
-          fullName: z12.string(),
-          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z12.array(z12.string()).nullable().optional(),
-          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+      testResults: z15.array(z15.object({
+        name: z15.string().min(1),
+        status: z15.enum(["passed", "failed"]),
+        message: z15.string().optional(),
+        assertionResults: z15.array(z15.object({
+          fullName: z15.string(),
+          status: z15.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z15.array(z15.string()).nullable().optional(),
+          location: z15.object({ line: count2, column: count2 }).nullable().optional()
         }))
       }))
     });
@@ -3427,7 +4001,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -3518,29 +4092,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z13.number().int().nonnegative();
-    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
-    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
-    level = z13.enum(["error", "warning", "note", "none"]);
-    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z13.object({
-      version: z13.literal("2.1.0"),
-      runs: z13.array(z13.object({
-        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
-        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
-        originalUriBaseIds: z13.record(artifact).optional(),
-        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
-        results: z13.array(z13.object({
-          ruleId: z13.string().optional(),
+    index = z16.number().int().nonnegative();
+    artifact = z16.object({ uri: z16.string().optional(), uriBaseId: z16.string().optional(), index: index.optional() });
+    message = z16.object({ text: z16.string().optional(), markdown: z16.string().optional(), id: z16.string().optional(), arguments: z16.array(z16.string()).optional() });
+    level = z16.enum(["error", "warning", "note", "none"]);
+    location = z16.object({ physicalLocation: z16.object({ artifactLocation: artifact.optional(), region: z16.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z16.object({
+      version: z16.literal("2.1.0"),
+      runs: z16.array(z16.object({
+        tool: z16.object({ driver: z16.object({ name: z16.string().min(1), rules: z16.array(z16.object({ id: z16.string(), defaultConfiguration: z16.object({ level: level.optional() }).optional(), messageStrings: z16.record(message).optional() })).optional(), globalMessageStrings: z16.record(message).optional() }) }),
+        invocations: z16.array(z16.object({ executionSuccessful: z16.boolean(), commandLine: z16.string().optional(), toolExecutionNotifications: z16.array(z16.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z16.array(z16.object({ revisionId: z16.string().optional() })).optional(),
+        originalUriBaseIds: z16.record(artifact).optional(),
+        artifacts: z16.array(z16.object({ location: artifact.optional() })).optional(),
+        results: z16.array(z16.object({
+          ruleId: z16.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z13.array(location).optional(),
-          relatedLocations: z13.array(location).optional()
+          kind: z16.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z16.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z16.array(z16.object({ kind: z16.enum(["inSource", "external"]), status: z16.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z16.array(location).optional(),
+          relatedLocations: z16.array(location).optional()
         })).optional()
       }))
     });
@@ -3548,10 +4122,10 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence.ts
-import path18 from "path";
-import { z as z14 } from "zod";
+import path19 from "path";
+import { z as z17 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -3590,7 +4164,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z17.object({ version: z17.literal(1), checks: z17.array(z17.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -3647,7 +4221,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path19.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -3743,31 +4317,31 @@ var init_evidence2 = __esm({
     init_vitest();
     init_sarif();
     init_types2();
-    checkSchema2 = z14.object({
-      id: z14.string().min(1).max(100),
-      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z14.string().min(1).max(200),
-      command: z14.string().min(1).max(2e3),
-      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z14.boolean().optional(),
-      source: z14.string().max(2e3).optional(),
-      sourceRoot: z14.string().min(1).max(4e3).optional(),
-      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z14.string().min(1).max(2e3).optional(),
-      exitCode: z14.number().int().nullable().optional(),
-      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z17.object({
+      id: z17.string().min(1).max(100),
+      kind: z17.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z17.string().min(1).max(200),
+      command: z17.string().min(1).max(2e3),
+      commit: z17.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z17.boolean().optional(),
+      source: z17.string().max(2e3).optional(),
+      sourceRoot: z17.string().min(1).max(4e3).optional(),
+      status: z17.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z17.string().min(1).max(2e3).optional(),
+      exitCode: z17.number().int().nullable().optional(),
+      report: z17.object({ format: z17.enum(["vitest-json", "sarif"]), path: z17.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs14 from "fs/promises";
-import path19 from "path";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import fs15 from "fs/promises";
+import path20 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec10("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -3778,7 +4352,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -3791,7 +4365,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -3841,7 +4415,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs14.access(path19.join(resolvedRoot, relPath));
+        await fs15.access(path20.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -3874,7 +4448,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec10, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -3886,7 +4460,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify10(execFile10);
+    exec10 = promisify12(execFile12);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -3975,438 +4549,13 @@ var init_onboarding = __esm({
   }
 });
 
-// src/setup/files.ts
-import fs15 from "fs/promises";
-import path20 from "path";
-import { randomUUID as randomUUID5 } from "crypto";
-async function readText(root, file) {
-  try {
-    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
-    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
-    return text2;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function managedBlock(text2, start, end, body) {
-  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
-  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
-    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
-  }
-  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
-  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
-  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
-  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
-}
-async function applyEdit(root, edit) {
-  const current = await readText(root, edit.path);
-  if (current === edit.after) return false;
-  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
-  const file = await storePath(root, edit.path, true);
-  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
-  try {
-    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs15.open(temporary, "wx", mode);
-    try {
-      await handle.writeFile(edit.after, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
-    await fs15.rename(temporary, file);
-    return true;
-  } finally {
-    await fs15.rm(temporary, { force: true });
-  }
-}
-var init_files2 = __esm({
-  "src/setup/files.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-  }
-});
-
-// src/setup/launcher.ts
-var BOOTSTRAP, POWERSHELL_BOOTSTRAP, mcpCommand, hookCommand, SHELL_LAUNCHER, POWERSHELL_LAUNCHER, LAUNCHER;
-var init_launcher = __esm({
-  "src/setup/launcher.ts"() {
-    "use strict";
-    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
-    POWERSHELL_BOOTSTRAP = "& (Join-Path (git rev-parse --show-toplevel) '.mason/run.ps1')";
-    mcpCommand = (host, runtime) => !runtime?.bundle ? { command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] } : process.platform === "win32" ? { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", POWERSHELL_BOOTSTRAP, host, "mcp"] } : { command: "sh", args: ["-c", 'exec sh "$(git rev-parse --show-toplevel)/.mason/run.sh" "$@"', "mason", host, "mcp"] };
-    hookCommand = (host, runtime) => !runtime?.bundle ? `node -e "${BOOTSTRAP}" -- ${host} auto` : process.platform === "win32" ? `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "${POWERSHELL_BOOTSTRAP} ${host} auto"` : `sh "$(git rev-parse --show-toplevel)/.mason/run.sh" ${host} auto`;
-    SHELL_LAUNCHER = `#!/bin/sh
-set -eu
-advisory=0
-if [ "\${2-}" = auto ] && [ "\${3-}" = hook ]; then advisory=1; fi
-fail() {
-  if [ "$advisory" -eq 1 ]; then printf '%s\\n' '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0; fi
-  echo 'Mason runtime unavailable. Rerun mason setup for this checkout.' >&2; exit 2
-}
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) || fail
-case "\${1-}" in codex|claude) ;; *) fail ;; esac
-pointer="$root/.mason/runtime/$1.txt"
-[ -f "$pointer" ] || fail
-runtime=$(cat "$pointer") || fail
-case "$runtime" in ''|*[!0-9a-f]*) fail ;; esac
-[ "\${#runtime}" -eq 24 ] || fail
-[ -x "$root/.mason/runtime/$runtime/node" ] || fail
-if [ "$advisory" -eq 1 ]; then
-  "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@" || fail
-else
-  exec "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@"
-fi
-`;
-    POWERSHELL_LAUNCHER = `# Managed by mason setup; no system Node installation is used.
-$ErrorActionPreference = 'Stop'
-$advisory = $args.Count -ge 3 -and $args[1] -eq 'auto' -and $args[2] -eq 'hook'
-try {
-  if ($args.Count -lt 2 -or $args[0] -notin @('codex','claude')) { throw 'Invalid Mason host.' }
-  $runtime = (Get-Content -LiteralPath (Join-Path $PSScriptRoot ('runtime/' + $args[0] + '.txt')) -Raw).Trim()
-  if ($runtime -cnotmatch '^[a-f0-9]{24}$') { throw 'Invalid Mason runtime pointer.' }
-  & (Join-Path $PSScriptRoot ('runtime/' + $runtime + '/node.exe')) (Join-Path $PSScriptRoot 'run.cjs') @args
-  if ($LASTEXITCODE -ne 0) { throw 'Mason runtime failed.' }
-} catch {
-  if ($advisory) { Write-Output '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0 }
-  [Console]::Error.WriteLine($_.Exception.Message); exit 2
-}
-`;
-    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
-const fs = require('node:fs');
-const path = require('node:path');
-const {pathToFileURL} = require('node:url');
-const launchArgs = process.argv.slice(process.argv[1] && path.resolve(process.argv[1]) === __filename ? 2 : 1);
-(async () => {
-  const root = path.dirname(__dirname);
-  const args = launchArgs;
-  const [host, command, ...rest] = args;
-  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
-  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
-  const entry = setup.hosts?.[host];
-  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
-  const base = path.join(__dirname, 'runtime', entry.runtime.id);
-  if (entry.runtime.bundle) {
-    const node = process.platform === 'win32' ? 'node.exe' : 'node';
-    if (fs.realpathSync(process.execPath) !== fs.realpathSync(path.join(base, node))) throw new Error('Mason runtime pointer differs from the configured version. Rerun setup.');
-  }
-  const binary = entry.runtime.bundle ? path.join(base, 'app', 'dist', 'mason-' + command + '.js')
-    : path.join(base, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
-  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
-  process.env.MASON_SETUP_ROOT = root;
-  process.env.MASON_SETUP_HOST = host;
-  process.env.MASON_SETUP_REVISION = entry.revision;
-  process.argv = [process.execPath, binary, ...rest];
-  await import(pathToFileURL(binary).href);
-})().catch(error => {
-  const message = 'Mason setup unavailable: ' + error.message;
-  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
-  else { console.error(message); process.exitCode = 2; }
-});
-`;
-  }
-});
-
-// src/setup/config.ts
-import { isDeepStrictEqual } from "util";
-import { parse, stringify } from "smol-toml";
-import { z as z15 } from "zod";
-async function instructionEdits(root, host) {
-  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
-  const existing = found.find((f) => f.text !== null);
-  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
-  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
-  const edits = [{
-    path: primary.path,
-    before: primary.text,
-    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
-  }];
-  if (primary.path === "AGENTS.md") {
-    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
-    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
-    for (const file of secondary) {
-      const text2 = file.text ?? "";
-      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
-      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
-      if (text2.trim() === imported) continue;
-      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
-      edits.push({
-        path: file.path,
-        before: file.text,
-        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
-      });
-    }
-  }
-  return edits;
-}
-function managedMcp(previous, host, runtime) {
-  const options = previous === void 0 ? {} : object.parse(previous);
-  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host, runtime) };
-}
-async function mcpEdit(root, host, runtime) {
-  const file = mcpPath(host), before = await readText(root, file);
-  if (host === "claude") {
-    const config2 = before === null ? {} : object.parse(JSON.parse(before));
-    const servers2 = object.parse(config2.mcpServers ?? {});
-    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host, runtime) } }, null, 2) + "\n" };
-  }
-  const config = parse(before ?? "");
-  const managed = (before ?? "").includes(TOML_START);
-  const servers = config.mcp_servers;
-  const desired = managedMcp(servers?.mason, host, runtime);
-  let base = before ?? "";
-  if (servers?.mason && !managed) {
-    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
-    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
-    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
-    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
-  }
-  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
-  const parsed = parse(after);
-  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
-  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
-  return { path: file, before, after };
-}
-async function hookEdits(root, host, runtime) {
-  const file = configPath(host), before = await readText(root, file);
-  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
-  const plan = await planAutomationInstall2(root, host, hookCommand(host, runtime));
-  return [
-    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
-    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
-  ];
-}
-async function ancillaryEdits(root) {
-  const ignore = await readText(root, ".gitignore");
-  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  let parentIgnored = false;
-  try {
-    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
-  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "!/.mason/run.sh", "!/.mason/run.ps1", "/.mason/reports/", "/.mason/runtime/"].join("\n");
-  return [
-    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
-    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER },
-    { path: ".mason/run.sh", before: await readText(root, ".mason/run.sh"), after: SHELL_LAUNCHER },
-    { path: ".mason/run.ps1", before: await readText(root, ".mason/run.ps1"), after: POWERSHELL_LAUNCHER }
-  ];
-}
-async function inspectHostConfig(root, host, plannedMcp, runtime) {
-  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
-  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
-  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
-  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
-  const expected = hookConfig(host, hookCommand(host, runtime));
-  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
-  return {
-    mcp,
-    mcpDisabled: mcp?.enabled === false,
-    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
-      event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
-    ])),
-    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
-  };
-}
-var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
-var init_config = __esm({
-  "src/setup/config.ts"() {
-    "use strict";
-    init_init();
-    init_docs();
-    init_adapters();
-    init_install();
-    init_files2();
-    init_launcher();
-    object = z15.record(z15.unknown());
-    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
-    TOML_START = "# mason:mcp:start";
-    TOML_END = "# mason:mcp:end";
-    POINTER_START = "<!-- mason:agents:start -->";
-    POINTER_END = "<!-- mason:agents:end -->";
-  }
-});
-
-// src/distribution/bundle.ts
-import fs16 from "fs/promises";
-import path21 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z16 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
-    }
-  }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
-  }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
-}
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
-    "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z16.object({
-      format: z16.literal(1),
-      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z16.enum(targets),
-      nodeVersion: z16.string(),
-      files: z16.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
-  }
-});
-
-// src/setup/runtime.ts
-import fs17 from "fs/promises";
-import path22 from "path";
-import { fileURLToPath } from "url";
-import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
-async function packageRoot() {
-  let directory = path22.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 8; i++) {
-    try {
-      const pkg = JSON.parse(await fs17.readFile(path22.join(directory, "package.json"), "utf8"));
-      if (pkg.name === "mason-context") return directory;
-    } catch {
-    }
-    directory = path22.dirname(directory);
-  }
-  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
-}
-async function sourceRuntime() {
-  const source = await packageRoot();
-  const pkg = JSON.parse(await fs17.readFile(path22.join(source, "package.json"), "utf8"));
-  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs17.readFile(path22.join(source, file)))])));
-  const bundleRoot = path22.dirname(source);
-  const bundleExists = await fs17.lstat(path22.join(bundleRoot, "bundle.json")).then(() => true, (error) => {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  });
-  if (bundleExists) {
-    const { manifest, manifestHash } = await verifyBundle(bundleRoot);
-    if (manifest.version !== pkg.version) throw new Error("Mason package and bundle versions differ.");
-    return { source, bundleRoot, runtime: runtimeSchema.parse({
-      id: manifestHash.slice(0, 24),
-      version: pkg.version,
-      hashes,
-      bundle: { target: manifest.target, manifestHash }
-    }) };
-  }
-  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
-}
-async function verifyRuntime(root, runtime) {
-  try {
-    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
-    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
-    if (runtime.bundle) {
-      const base2 = await storePath(root, `.mason/runtime/${runtime.id}`);
-      const { manifest } = await verifyBundle(base2, runtime.bundle.manifestHash);
-      if (manifest.version !== runtime.version || manifest.target !== runtime.bundle.target) return false;
-      for (const file of BINARIES) if (manifest.files["app/" + file] !== runtime.hashes[file]) return false;
-      return true;
-    }
-    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
-    const pkg = await readStoreJson(root, base + "package.json");
-    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
-    for (const file of BINARIES) {
-      if (checksum(await fs17.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function installRuntime(root, selected) {
-  const { runtime, source } = selected;
-  if (await verifyRuntime(root, runtime)) return runtime;
-  const relative = `.mason/runtime/${runtime.id}`;
-  const target = await storePath(root, relative, true);
-  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
-  await fs17.mkdir(stage);
-  try {
-    if (runtime.bundle) {
-      if (!selected.bundleRoot) throw new Error("Standalone bundle source is missing.");
-      const { manifest } = await verifyBundle(selected.bundleRoot, runtime.bundle.manifestHash);
-      for (const file of ["bundle.json", ...Object.keys(manifest.files)]) {
-        const from = await storePath(selected.bundleRoot, file);
-        const to = await storePath(stage, file, true);
-        await fs17.copyFile(from, to);
-        await fs17.chmod(to, (await fs17.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, runtime.bundle.manifestHash);
-    } else {
-      const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-      const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
-      const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
-      const filename = packed[0]?.filename;
-      if (typeof filename !== "string" || path22.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
-      await fs17.rename(path22.join(stage, filename), path22.join(stage, "mason.tgz"));
-      await fs17.writeFile(path22.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
-      await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
-      for (const file of BINARIES) {
-        if (checksum(await fs17.readFile(path22.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
-      }
-    }
-    await fs17.writeFile(path22.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
-    try {
-      await fs17.rename(target, target + ".previous-" + randomUUID6());
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    await fs17.rename(stage, target);
-    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
-    return runtime;
-  } finally {
-    await fs17.rm(stage, { recursive: true, force: true });
-  }
-}
-var exec10, checksum, BINARIES;
-var init_runtime2 = __esm({
-  "src/setup/runtime.ts"() {
-    "use strict";
-    init_model();
-    init_storage();
-    init_evidence();
-    init_bundle();
-    exec10 = promisify11(execFile11);
-    checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
-    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
-  }
-});
-
 // src/setup/status.ts
 var status_exports = {};
 __export(status_exports, {
   setupStatus: () => setupStatus,
   summarizeActivation: () => summarizeActivation
 });
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
   const setup = await loadSetup(ws.root);
@@ -4423,35 +4572,33 @@ async function setupStatus(dir) {
       next: pending.length ? "Setup did not finish. Rerun mason-auto setup --host " + pending[0] + " to resume using the retained original evidence." : "Run mason-auto setup --host codex or --host claude."
     };
   }
-  const hosts = {};
-  const commonLauncherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const hosts2 = {};
+  const installed = await installedCommand();
   const automation = await automationStatus(ws.root);
   for (const host of ["codex", "claude"]) {
     const entry = setup.hosts[host];
     if (!entry) continue;
-    const launcherCurrent = commonLauncherCurrent && (!entry.runtime.bundle || await readText(ws.root, ".mason/run.sh") === SHELL_LAUNCHER && await readText(ws.root, ".mason/run.ps1") === POWERSHELL_LAUNCHER && await readText(ws.root, `.mason/runtime/${host}.txt`) === entry.runtime.id + "\n");
     const instructions = await instructionEdits(ws.root, host);
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
-    const installed = await verifyRuntime(ws.root, entry.runtime);
-    const config = await inspectHostConfig(ws.root, host, void 0, entry.runtime);
-    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host, entry.runtime));
-    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host, entry.runtime)).hooks) && !config.disabled;
+    const config = await inspectHostConfig(ws.root, host, void 0);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual3({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual3(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
-    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
     const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
     const pending = [];
-    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!installed.available) pending.push(installed.message);
     if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
     if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
     if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
     if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
-    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
-    hosts[host] = {
+    const healthy = installed.available && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    hosts2[host] = {
       status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
-      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
       hookConfiguration: hooks ? "configured" : "disabled-or-changed",
@@ -4461,13 +4608,13 @@ async function setupStatus(dir) {
       pending
     };
   }
-  const statuses = Object.values(hosts).map((host) => host.status);
+  const statuses = Object.values(hosts2).map((host) => host.status);
   const decisions = await loadDecisionStore(ws.root);
   return {
     version: 1,
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
-    hosts,
+    hosts: hosts2,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -4497,10 +4644,8 @@ var init_status = __esm({
     init_decisions();
     init_adapters();
     init_model();
-    init_runtime2();
     init_config();
     init_launcher();
-    init_files2();
     init_observations();
   }
 });
@@ -4512,7 +4657,7 @@ __export(setup_exports, {
   setupProject: () => setupProject,
   summarizeSetup: () => summarizeSetup
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 async function selectHost(root, explicit) {
   if (explicit) return explicit;
   if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
@@ -4528,28 +4673,29 @@ async function setupProject(dir, options = {}) {
   return withLock(ws.root, ".mason/reports/setup-lock", async () => {
     const existing = await loadSetup(ws.root);
     const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
-    const marker = await loadProjectMarker(ws.root);
-    const selected = await sourceRuntime();
+    const installed = await installedCommand();
+    if (!installed.available) throw new Error(installed.message);
     const instructions = await instructionEdits(ws.root, host);
-    const mcp = await mcpEdit(ws.root, host, selected.runtime);
-    const hooks = await hookEdits(ws.root, host, selected.runtime);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
     const ancillary = await ancillaryEdits(ws.root);
     const edits = [...ancillary, ...instructions, mcp, ...hooks];
-    const setupBefore = await readText(ws.root, ".mason/setup.json");
-    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after, selected.runtime)).mcp);
-    const desiredHooks = hookConfig(host, hookCommand(host, selected.runtime)).hooks;
+    const setupBefore = await readText(ws.root, SETUP_PATH);
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
+    const configuredHook = desiredHooks.SessionStart[0].hooks[0].command;
+    const ownership = await ownershipEdit(ws.root, [...instructions, mcp, hooks[0]], { [hooks[0].path]: configuredHook });
     const fingerprint = hash({
-      runtime: selected.runtime,
-      launcher: LAUNCHER,
+      command: "mason",
       mcp: mcpFingerprint,
       hooks: desiredHooks,
       instructions: instructions.map((edit) => edit.path)
     });
     const previous = existing?.hosts[host];
     const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
-    const revision = !changed && previous ? previous.revision : randomUUID7();
-    const setup = existing ?? { version: 1, hosts: {} };
-    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const revision = !changed && previous ? previous.revision : randomUUID6();
+    const setup = existing ?? { version: 2, hosts: {} };
+    setup.hosts[host] = { configuredVersion: installed.version, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
     const initial = await automate(ws.root, { event: "turn_start" });
     const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
     const receiptPath = ws.directory + "/setup-" + host + ".json";
@@ -4564,20 +4710,13 @@ async function setupProject(dir, options = {}) {
       root: ws.root,
       revision
     });
-    await installRuntime(ws.root, selected);
-    if (selected.runtime.bundle) {
-      const pointer = `.mason/runtime/${host}.txt`;
-      await applyEdit(ws.root, { path: pointer, before: await readText(ws.root, pointer), after: selected.runtime.id + "\n" });
-    }
     const changedFiles = [];
+    if (await applyEdit(ws.root, ownership)) changedFiles.push(ownership.path);
     for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
-    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
-    if (!marker) {
-      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      changedFiles.push(".mason/project.json");
-    }
+    if (await applyEdit(ws.root, { path: SETUP_PATH, before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(SETUP_PATH);
+    if (await applyEdit(ws.root, await completedHookOwnership(ws.root, hooks[0].path, configuredHook)) && !changedFiles.includes(ownership.path)) changedFiles.push(ownership.path);
     const checked = await automate(ws.root, { event: "turn_start" });
-    const configured = await inspectHostConfig(ws.root, host, void 0, selected.runtime);
+    const configured = await inspectHostConfig(ws.root, host, void 0);
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
@@ -4594,7 +4733,7 @@ async function setupProject(dir, options = {}) {
       status: "configured",
       host,
       root: ws.root,
-      runtime: selected.runtime,
+      runtime: { kind: "global", command: "mason", version: installed.version },
       changedFiles,
       initialReportPath,
       findings,
@@ -4608,14 +4747,15 @@ function summarizeSetup(result) {
   const audit = result.findings.audit;
   return [
     `Mason configured for ${result.host}.`,
-    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  MCP server and lifecycle hooks use mason from PATH.",
     "  Project instructions updated; original audit evidence retained.",
-    `  ${result.changedFiles.length} shared files changed.`,
+    `  ${result.changedFiles.length} files changed.`,
     `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
     ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
     `Original evidence: ${result.initialReportPath}`,
     "Activation: " + result.activation.status + ".",
     result.next,
+    "If the assistant cannot find mason, restart the desktop app so it picks up PATH.",
     "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
   ].join("\n");
 }
@@ -4625,7 +4765,6 @@ var init_setup = __esm({
     init_evidence();
     init_store();
     init_runtime();
-    init_init();
     init_onboarding();
     init_storage();
     init_files2();
@@ -4633,8 +4772,8 @@ var init_setup = __esm({
     init_launcher();
     init_adapters();
     init_model();
-    init_runtime2();
     init_status();
+    init_ownership();
   }
 });
 
@@ -4645,9 +4784,23 @@ init_adapters();
 init_install();
 init_store();
 import { parseArgs } from "util";
-var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
+var TEARDOWN_USAGE = `Usage: mason teardown [options]
 
-  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
+Disconnect Mason from this Git project. Defaults to all project hosts.
+
+  --host codex|claude         Disconnect only this host
+  --dir <path>               Project directory (defaults to cwd; subdirectories work)
+  --dry-run                  Preview changes without writing
+  --json                     Machine-readable changes and diagnostics
+
+Keeps shared knowledge, repair evidence, ignore rules and the Mason installation.
+Edited or ambiguous entries are retained for manual cleanup. Restart assistants
+after teardown. Run mason setup --host codex or --host claude to reconnect.
+Exit 0: complete/no-op. Exit 2: cleanup needs attention (also in dry runs).`;
+var USAGE = `Usage: mason-auto <setup|teardown|install|config|status|check|hook> [options]
+
+  setup [--host claude|codex]  Connect MCP, instructions and hooks to mason on PATH; retain the initial audit
+  teardown [--host claude|codex] Disconnect one host or all project hosts; retain knowledge and evidence
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   status                      Read configured hooks and observed runtime events
@@ -4656,9 +4809,11 @@ var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options
 
   --dir <path>                Project directory (defaults to cwd)
   --command <prefix>          Installed executable prefix for install/config
+  --dry-run                   Preview teardown without writing
   --json                      Machine-readable output (status also uses JSON when piped)
 
 check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
+teardown exits 0 for complete/no-op, 2 when cleanup needs attention (also in dry runs).
 Hooks are advisory and exit 0; a failed capture is reported explicitly.
 Local evidence is written under .mason/reports/. No LLM calls or source edits.`;
 var parseCli = (argv2) => parseArgs({ args: argv2, allowPositionals: true, options: {
@@ -4666,7 +4821,8 @@ var parseCli = (argv2) => parseArgs({ args: argv2, allowPositionals: true, optio
   host: { type: "string" },
   command: { type: "string" },
   json: { type: "boolean" },
-  help: { type: "boolean", short: "h" }
+  help: { type: "boolean", short: "h" },
+  "dry-run": { type: "boolean" }
 } });
 function isHookCommand(argv2) {
   try {
@@ -4684,12 +4840,20 @@ async function runAutomationCli(argv2, stdin = "", io = {
   try {
     const { values, positionals } = parseCli(argv2);
     if (values.help || !positionals.length) {
-      io.out(USAGE);
+      io.out(positionals[0] === "teardown" ? TEARDOWN_USAGE : USAGE);
       return 0;
     }
     if (positionals.length !== 1) throw new Error("Expected one command.");
     [action] = positionals;
     const dir = values.dir ?? process.cwd();
+    if (values["dry-run"] !== void 0 && action !== "teardown") throw new Error("--dry-run applies only to teardown.");
+    if (action === "teardown") {
+      if (values.command !== void 0) throw new Error("--command applies only to install/config.");
+      const { teardownProject: teardownProject2, summarizeTeardown: summarizeTeardown2 } = await Promise.resolve().then(() => (init_teardown(), teardown_exports));
+      const result = await teardownProject2(dir, { host: values.host === void 0 ? void 0 : hostSchema.parse(values.host), dryRun: values["dry-run"] });
+      io.out(values.json ? JSON.stringify(result, null, 2) : summarizeTeardown2(result));
+      return result.status === "complete" ? 0 : 2;
+    }
     if (action === "hook") {
       const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
       if (output) io.out(JSON.stringify(output));
@@ -4720,12 +4884,12 @@ async function runAutomationCli(argv2, stdin = "", io = {
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
-    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : action === "teardown" ? "Mason teardown incomplete: " + automationFailure(error).message + ". Inspect the reported input, then rerun teardown; knowledge and repair evidence are retained." : failureMessage(error);
     if (action === "hook" || isHookCommand(argv2)) {
       io.out(JSON.stringify({ systemMessage: message2 }));
       return 0;
     }
-    if (argv2.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
+    if (argv2.includes("--json")) io.out(JSON.stringify({ version: 1, ...["setup", "teardown"].includes(action) ? { action, status: "incomplete", next: "Inspect the reported input, then rerun the same command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
     else io.err(message2);
     return 2;
   }