mason-context 0.17.0 → 0.17.1

package/dist/mason-auto.js

@@ -844,7 +844,7 @@ async function readAuditInput(root, file) {
     if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
     return value;
   } catch (error) {
-    if (error.code === "ENOENT") return null;
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
     throw error;
   }
 }
@@ -1094,15 +1094,17 @@ function pathClaimScope(doc, claim) {
   };
 }
 async function pathExists(root, file) {
-  const absolute = await auditInputPath(root, file);
   try {
-    await fs6.access(absolute);
+    await fs6.access(await auditInputPath(root, file));
     return true;
   } catch (error) {
-    if (error.code === "ENOENT") return false;
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return false;
     throw error;
   }
 }
+function gitMetadataPath(file) {
+  return file.split("/").includes(".git");
+}
 function optionalMasonPath(file) {
   return file.split("/").includes(".mason");
 }
@@ -1341,6 +1343,14 @@ async function checkDeletedReferences(ctx) {
         continue;
       }
       if (scope.candidates.some(optionalMasonPath)) continue;
+      if (scope.candidates.some(gitMetadataPath)) {
+        result.skipped.push({
+          check: "deleted-reference",
+          doc: doc.path,
+          reason: `Reference ${claim.path} names Git metadata, whose layout varies between checkouts; it was not verified as a repository file.`
+        });
+        continue;
+      }
       if ((await Promise.all(scope.candidates.map((file) => pathExists(ctx.root, file)))).some(Boolean)) continue;
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
@@ -2860,14 +2870,6 @@ var init_repair = __esm({
 });
 
 // src/automation/evidence.ts
-var evidence_exports = {};
-__export(evidence_exports, {
-  checkCache: () => checkCache,
-  git: () => git3,
-  hash: () => hash,
-  readInputs: () => readInputs,
-  workspace: () => workspace
-});
 import fs13 from "fs/promises";
 import path20 from "path";
 import { createHash as createHash3 } from "crypto";
@@ -2913,6 +2915,7 @@ async function readInputs(root) {
     docContents.push([file, text2]);
     for (const claim of text2 ? extractClaims(text2).paths : []) {
       const scope = pathClaimScope(file, claim);
+      if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
         claims.push([candidate, await pathExists(root, candidate), await pathExists(root, path20.posix.dirname(candidate))]);
@@ -2993,7 +2996,7 @@ var init_evidence = __esm({
     init_storage();
     init_advisory_review();
     exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.0" : "development";
+    engineVersion = true ? "0.17.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3514,6 +3517,39 @@ var init_runtime = __esm({
   }
 });
 
+// src/automation/hook-root.ts
+import fs15 from "fs/promises";
+import path21 from "path";
+async function repositoryRoot(dir) {
+  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  try {
+    return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (error.code === "ENOENT" || /not a git repository/.test(String(error.stderr))) return null;
+    throw error;
+  }
+}
+async function resolveHookRoot(host, cwd, options = {}) {
+  const current = await repositoryRoot(cwd);
+  if (current) return current;
+  const projectDir = options.projectDir ?? (host === "claude" ? process.env.CLAUDE_PROJECT_DIR : void 0);
+  const projectRoot = projectDir ? await repositoryRoot(projectDir) : null;
+  if (projectDir && !projectRoot) throw new Error("Hook input is outside Git and the host project is no longer a Git repository. Restore its history before running mason check.");
+  const launchRoot = await repositoryRoot(options.launchCwd ?? process.cwd());
+  const roots = [...new Set([launchRoot, projectRoot].filter((root) => root !== null))];
+  if (!roots.length) throw new Error("Hook input is outside a Git repository and no project root is available. Return to the project and run mason check.");
+  if (roots.length > 1) throw new Error("Hook input is outside a Git repository and project roots disagree. Return to the intended checkout and run mason check; verification was not established.");
+  const worktrees = (await git3(roots[0], "worktree", "list", "--porcelain", "-z")).split("\0").filter((field) => field.startsWith("worktree "));
+  if (worktrees.length !== 1) throw new Error("Hook input is outside a Git repository with multiple worktrees. Return to the intended worktree and run mason check; the active checkout is unknown.");
+  return roots[0];
+}
+var init_hook_root = __esm({
+  "src/automation/hook-root.ts"() {
+    "use strict";
+    init_evidence();
+  }
+});
+
 // src/setup/model.ts
 import { z as z11 } from "zod";
 async function loadSetup(root) {
@@ -3559,9 +3595,19 @@ var init_model = __esm({
 });
 
 // src/setup/launcher.ts
+var launcher_exports = {};
+__export(launcher_exports, {
+  executingVersion: () => executingVersion,
+  globalCommand: () => globalCommand,
+  hookCommand: () => hookCommand,
+  inactiveSetupMessage: () => inactiveSetupMessage,
+  installedCommand: () => installedCommand,
+  mcpCommand: () => mcpCommand,
+  prepareLaunch: () => prepareLaunch
+});
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify10 } from "util";
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
 }
@@ -3580,13 +3626,31 @@ async function installedCommand() {
     return { available: false, version: null, message: "An up-to-date mason command is not available on this process's PATH. Install or upgrade Mason, then reopen your terminal or desktop assistant and rerun mason setup." };
   }
 }
+async function prepareLaunch(host, options = {}) {
+  const root = await fs16.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const entry = (await loadSetup(root))?.hosts[host];
+  process.env.MASON_SETUP_ROOT = root;
+  process.env.MASON_SETUP_HOST = host;
+  delete process.env.MASON_SETUP_REVISION;
+  if (!entry) {
+    if (options.allowInactive) return false;
+    throw new Error(`Mason is not configured locally for ${host}. Run mason setup --host ${host} in this checkout.`);
+  }
+  process.env.MASON_SETUP_REVISION = entry.revision;
+  return true;
+}
+function inactiveSetupMessage() {
+  const host = process.env.MASON_SETUP_HOST;
+  if (!process.env.MASON_SETUP_ROOT || process.env.MASON_SETUP_REVISION || host !== "claude" && host !== "codex") return null;
+  return `Mason MCP is available, but automatic hooks are inactive in ${process.env.MASON_SETUP_ROOT}. Run mason setup --host ${host} in that checkout, review the host configuration, then restart the assistant. Setup has not been performed automatically.`;
+}
 var executingVersion, mcpCommand, hookCommand;
 var init_launcher = __esm({
   "src/setup/launcher.ts"() {
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.0" : "development";
+    executingVersion = () => true ? "0.17.1" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3599,7 +3663,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -3613,11 +3677,17 @@ async function readObservation(root, directory, host, revision, version = execut
 }
 async function observeActivation(dir, event, options = {}) {
   const host = process.env.MASON_SETUP_HOST, revision = process.env.MASON_SETUP_REVISION;
-  if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
+  if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
+    if (!revision) {
+      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+        return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
+      }
+      return inactiveSetupMessage();
+    }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs16.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs16.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const ws = capturedDirectory ? { root: await fs17.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs17.realpath(process.env.MASON_SETUP_ROOT)) return null;
     const setup = await loadSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
@@ -3698,7 +3768,7 @@ function normalizeHook(host, raw) {
     stopHookActive: input2.stop_hook_active || input2.permission_mode === "plan"
   } };
 }
-async function runAutomationHook(host, stdin) {
+async function runAutomationHook(host, stdin, options = {}) {
   let name = "";
   let hook;
   try {
@@ -3712,6 +3782,11 @@ async function runAutomationHook(host, stdin) {
     const input2 = normalizeHook(host, raw);
     hook = input2;
     name = input2.name;
+    if (options.managed) {
+      input2.cwd = await resolveHookRoot(host, input2.cwd);
+      const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
+      if (!await prepareLaunch2(host, { dir: input2.cwd, allowInactive: true })) return null;
+    }
     if (["before_tool", "after_tool"].includes(input2.event.event) && input2.readOnly) {
       const observed = await observeReadOnlyTool(input2.cwd, input2.event);
       const { observeActivation: observeActivation3 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
@@ -3744,6 +3819,9 @@ function managedHookCommand(host, platform = process.platform) {
 function knownManagedHookCommands(host) {
   return [managedHookCommand(host, "linux"), managedHookCommand(host, "win32"), `mason --setup-host ${host} auto hook --host ${host}`];
 }
+function compatibleManagedHookCommands(host, platform = process.platform) {
+  return [managedHookCommand(host, platform), `mason --setup-host ${host} auto hook --host ${host}`];
+}
 function hookConfig(host, command = "npx --no-install --package mason-context mason-auto") {
   const handler = { type: "command", command: command === `mason --setup-host ${host} auto` ? managedHookCommand(host) : command + " hook --host " + host, timeout: 30 };
   return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
@@ -3758,6 +3836,7 @@ var init_adapters = __esm({
     init_execution();
     init_runtime();
     init_store();
+    init_hook_root();
     inputSchema = z13.object({
       cwd: z13.string().min(1),
       session_id: z13.string().min(1).max(500),
@@ -3786,8 +3865,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs17 from "fs/promises";
-import path21 from "path";
+import fs18 from "fs/promises";
+import path22 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -3816,14 +3895,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs17.unlink(file2);
+    await fs18.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path21.join(path21.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path22.join(path22.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs17.open(temporary, "wx", mode);
+    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs18.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -3831,10 +3910,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs17.rename(temporary, file);
+    await fs18.rename(temporary, file);
     return true;
   } finally {
-    await fs17.rm(temporary, { force: true });
+    await fs18.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4003,29 +4082,6 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
-// src/utils/git.ts
-var git_exports = {};
-__export(git_exports, {
-  isGitRepo: () => isGitRepo
-});
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
-async function isGitRepo(dir) {
-  try {
-    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var exec8;
-var init_git2 = __esm({
-  "src/utils/git.ts"() {
-    "use strict";
-    exec8 = promisify11(execFile11);
-  }
-});
-
 // src/setup/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -4070,7 +4126,7 @@ async function instructionEdits(root, host) {
 function managedMcp(previous, host) {
   const options = previous === void 0 ? {} : object.parse(previous);
   for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host) };
+  return { ...options, ...host === "claude" ? { type: "stdio" } : {}, ...mcpCommand(host) };
 }
 async function mcpEdit(root, host) {
   const file = mcpPath(host), before = await readText(root, file);
@@ -4107,17 +4163,9 @@ async function hookEdits(root, host) {
 }
 async function ancillaryEdits(root) {
   const ignore = await readText(root, ".gitignore");
-  const { git: git4 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
-  let parentIgnored = false;
-  try {
-    if (await isGitRepo2(root)) parentIgnored = !!(await git4(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
   const rules = [
-    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/",
+    "/.mason/*",
     "!/.mason/decisions/",
     "!/.mason/decisions/**",
     "!/.mason/reviews/",
@@ -4135,13 +4183,14 @@ async function inspectHostConfig(root, host, plannedMcp) {
   const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
   const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
   const expected = hookConfig(host, hookCommand(host));
+  const compatible = compatibleManagedHookCommands(host);
   const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
   return {
     mcp,
     mcpDisabled: mcp?.enabled === false,
     hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
       event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => compatible.includes(handler.command ?? "")).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
     ])),
     disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
   };
@@ -4331,8 +4380,12 @@ async function planTeardown(root, selected) {
         if (host === "codex" && BLOCKS[2].some((marker) => before.includes(marker))) throw new Error("The marked Mason MCP entry was removed or renamed; inspect the retained block manually.");
         return;
       }
-      const expected = ownership.files[mcpFile]?.mcpHash ?? hash(mcpCommand(host));
-      if (hash(servers.mason) !== expected) throw new Error("The Mason MCP entry was edited or its ownership is uncertain; retained for manual cleanup.");
+      const ownedHash = ownership.files[mcpFile]?.mcpHash;
+      const expected = ownedHash ? [ownedHash] : [
+        hash(mcpCommand(host)),
+        ...host === "claude" ? [hash({ type: "stdio", ...mcpCommand(host) })] : []
+      ];
+      if (!expected.includes(hash(servers.mason))) throw new Error("The Mason MCP entry was edited or its ownership is uncertain; retained for manual cleanup.");
       delete servers.mason;
       const desired = { ...config, [key]: servers };
       if (!Object.keys(servers).length) delete desired[key];
@@ -4499,13 +4552,13 @@ var init_teardown = __esm({
 });
 
 // src/review/cochange.ts
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec9(
+    const { stdout } = await exec8(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4561,11 +4614,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec9 = promisify12(execFile12);
+    exec8 = promisify11(execFile11);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -4873,10 +4926,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path22 from "path";
+import path23 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path22.isAbsolute(file) ? path22.relative(root, file) : file;
+  const relative = path23.isAbsolute(file) ? path23.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -4973,7 +5026,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path22.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path23.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5094,13 +5147,13 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs18 from "fs/promises";
-import path23 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
+import fs19 from "fs/promises";
+import path24 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec10("git", ["merge-base", base, head], {
+    const { stdout } = await exec9("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5111,7 +5164,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5124,7 +5177,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path23.resolve(rootDir);
+  const resolvedRoot = path24.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5174,7 +5227,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs18.access(path23.join(resolvedRoot, relPath));
+        await fs19.access(path24.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5207,7 +5260,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec10, MAX_ANALYZED_FILES;
+var exec9, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5219,7 +5272,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec10 = promisify13(execFile13);
+    exec9 = promisify12(execFile12);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -5341,7 +5394,16 @@ async function setupStatus(dir) {
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
     const config = await inspectHostConfig(ws.root, host, void 0);
     const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual3({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
-    const hooks = isDeepStrictEqual3(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
+    const expectedHooks = hookConfig(host, hookCommand(host)).hooks;
+    const currentHooks = isDeepStrictEqual3(config.hooks, expectedHooks);
+    const compatibleHooks = Object.fromEntries(Object.entries(config.hooks).map(([event, groups]) => [
+      event,
+      groups.map((group) => ({ ...group, hooks: group.hooks.map((handler) => ({
+        ...handler,
+        command: expectedHooks.SessionStart[0].hooks[0].command
+      })) }))
+    ]));
+    const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
@@ -5360,11 +5422,12 @@ async function setupStatus(dir) {
       runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
-      hookConfiguration: hooks ? "configured" : "disabled-or-changed",
+      hookConfiguration: hooks ? currentHooks ? "configured" : "compatible" : "disabled-or-changed",
       observedEvents,
       contextCalls: observation?.contextCalls ?? 0,
       verificationStatus: automation.status === "current" ? automation.verificationStatus ?? "unavailable" : "unavailable",
-      pending
+      pending,
+      updates: hooks && !currentHooks ? ["A newer hook template is available. Run mason setup --host " + host + " to update it when convenient; review and commit the configuration changes."] : []
     };
   }
   const statuses = Object.values(hosts2).map((host) => host.status);
@@ -5389,6 +5452,7 @@ function summarizeActivation(status) {
       `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
       ...state.pending.map((message2) => "  Next: " + message2)
     );
+    lines.push(...state.updates.map((message2) => "  Optional: " + message2));
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
   if (status.next) lines.push(status.next);
@@ -5594,7 +5658,7 @@ function isHookCommand(argv2) {
 async function runAutomationCli(argv2, stdin = "", io = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
-}) {
+}, options = {}) {
   let action = "";
   try {
     const { values, positionals } = parseCli(argv2);
@@ -5614,7 +5678,9 @@ async function runAutomationCli(argv2, stdin = "", io = {
       return result.status === "complete" ? 0 : 2;
     }
     if (action === "hook") {
-      const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
+      const host = hostSchema.parse(values.host);
+      if (options.managedHost && options.managedHost !== host) throw new Error("Managed hook --host does not match its launcher.");
+      const output = await runAutomationHook(host, stdin, { managed: !!options.managedHost });
       if (output) io.out(JSON.stringify(output));
       return 0;
     }