mason-context 0.17.0 → 0.17.1

package/dist/mason.js

@@ -844,7 +844,7 @@ async function readAuditInput(root, file) {
     if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
     return value;
   } catch (error) {
-    if (error.code === "ENOENT") return null;
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
     throw error;
   }
 }
@@ -1094,15 +1094,17 @@ function pathClaimScope(doc, claim) {
   };
 }
 async function pathExists(root, file) {
-  const absolute = await auditInputPath(root, file);
   try {
-    await fs6.access(absolute);
+    await fs6.access(await auditInputPath(root, file));
     return true;
   } catch (error) {
-    if (error.code === "ENOENT") return false;
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return false;
     throw error;
   }
 }
+function gitMetadataPath(file) {
+  return file.split("/").includes(".git");
+}
 function optionalMasonPath(file) {
   return file.split("/").includes(".mason");
 }
@@ -1341,6 +1343,14 @@ async function checkDeletedReferences(ctx) {
         continue;
       }
       if (scope.candidates.some(optionalMasonPath)) continue;
+      if (scope.candidates.some(gitMetadataPath)) {
+        result.skipped.push({
+          check: "deleted-reference",
+          doc: doc.path,
+          reason: `Reference ${claim.path} names Git metadata, whose layout varies between checkouts; it was not verified as a repository file.`
+        });
+        continue;
+      }
       if ((await Promise.all(scope.candidates.map((file) => pathExists(ctx.root, file)))).some(Boolean)) continue;
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
@@ -2860,14 +2870,6 @@ var init_repair = __esm({
 });
 
 // src/automation/evidence.ts
-var evidence_exports = {};
-__export(evidence_exports, {
-  checkCache: () => checkCache,
-  git: () => git3,
-  hash: () => hash,
-  readInputs: () => readInputs,
-  workspace: () => workspace
-});
 import fs13 from "fs/promises";
 import path20 from "path";
 import { createHash as createHash3 } from "crypto";
@@ -2913,6 +2915,7 @@ async function readInputs(root) {
     docContents.push([file, text2]);
     for (const claim of text2 ? extractClaims(text2).paths : []) {
       const scope = pathClaimScope(file, claim);
+      if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
         claims.push([candidate, await pathExists(root, candidate), await pathExists(root, path20.posix.dirname(candidate))]);
@@ -2993,7 +2996,7 @@ var init_evidence = __esm({
     init_storage();
     init_advisory_review();
     exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.0" : "development";
+    engineVersion = true ? "0.17.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3514,6 +3517,39 @@ var init_runtime = __esm({
   }
 });
 
+// src/automation/hook-root.ts
+import fs15 from "fs/promises";
+import path21 from "path";
+async function repositoryRoot(dir) {
+  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  try {
+    return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (error.code === "ENOENT" || /not a git repository/.test(String(error.stderr))) return null;
+    throw error;
+  }
+}
+async function resolveHookRoot(host, cwd, options = {}) {
+  const current = await repositoryRoot(cwd);
+  if (current) return current;
+  const projectDir = options.projectDir ?? (host === "claude" ? process.env.CLAUDE_PROJECT_DIR : void 0);
+  const projectRoot = projectDir ? await repositoryRoot(projectDir) : null;
+  if (projectDir && !projectRoot) throw new Error("Hook input is outside Git and the host project is no longer a Git repository. Restore its history before running mason check.");
+  const launchRoot = await repositoryRoot(options.launchCwd ?? process.cwd());
+  const roots = [...new Set([launchRoot, projectRoot].filter((root) => root !== null))];
+  if (!roots.length) throw new Error("Hook input is outside a Git repository and no project root is available. Return to the project and run mason check.");
+  if (roots.length > 1) throw new Error("Hook input is outside a Git repository and project roots disagree. Return to the intended checkout and run mason check; verification was not established.");
+  const worktrees = (await git3(roots[0], "worktree", "list", "--porcelain", "-z")).split("\0").filter((field) => field.startsWith("worktree "));
+  if (worktrees.length !== 1) throw new Error("Hook input is outside a Git repository with multiple worktrees. Return to the intended worktree and run mason check; the active checkout is unknown.");
+  return roots[0];
+}
+var init_hook_root = __esm({
+  "src/automation/hook-root.ts"() {
+    "use strict";
+    init_evidence();
+  }
+});
+
 // src/setup/model.ts
 import { z as z11 } from "zod";
 async function loadSetup(root) {
@@ -3564,13 +3600,14 @@ __export(launcher_exports, {
   executingVersion: () => executingVersion,
   globalCommand: () => globalCommand,
   hookCommand: () => hookCommand,
+  inactiveSetupMessage: () => inactiveSetupMessage,
   installedCommand: () => installedCommand,
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify10 } from "util";
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
 }
@@ -3590,24 +3627,30 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs15.realpath((await git3(process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const root = await fs16.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
   const entry = (await loadSetup(root))?.hosts[host];
+  process.env.MASON_SETUP_ROOT = root;
+  process.env.MASON_SETUP_HOST = host;
+  delete process.env.MASON_SETUP_REVISION;
   if (!entry) {
     if (options.allowInactive) return false;
     throw new Error(`Mason is not configured locally for ${host}. Run mason setup --host ${host} in this checkout.`);
   }
-  process.env.MASON_SETUP_ROOT = root;
-  process.env.MASON_SETUP_HOST = host;
   process.env.MASON_SETUP_REVISION = entry.revision;
   return true;
 }
+function inactiveSetupMessage() {
+  const host = process.env.MASON_SETUP_HOST;
+  if (!process.env.MASON_SETUP_ROOT || process.env.MASON_SETUP_REVISION || host !== "claude" && host !== "codex") return null;
+  return `Mason MCP is available, but automatic hooks are inactive in ${process.env.MASON_SETUP_ROOT}. Run mason setup --host ${host} in that checkout, review the host configuration, then restart the assistant. Setup has not been performed automatically.`;
+}
 var executingVersion, mcpCommand, hookCommand;
 var init_launcher = __esm({
   "src/setup/launcher.ts"() {
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.0" : "development";
+    executingVersion = () => true ? "0.17.1" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3620,7 +3663,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -3634,11 +3677,17 @@ async function readObservation(root, directory, host, revision, version = execut
 }
 async function observeActivation(dir, event, options = {}) {
   const host = process.env.MASON_SETUP_HOST, revision = process.env.MASON_SETUP_REVISION;
-  if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
+  if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
+    if (!revision) {
+      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+        return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
+      }
+      return inactiveSetupMessage();
+    }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs16.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs16.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const ws = capturedDirectory ? { root: await fs17.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs17.realpath(process.env.MASON_SETUP_ROOT)) return null;
     const setup = await loadSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
@@ -3719,7 +3768,7 @@ function normalizeHook(host, raw) {
     stopHookActive: input.stop_hook_active || input.permission_mode === "plan"
   } };
 }
-async function runAutomationHook(host, stdin) {
+async function runAutomationHook(host, stdin, options = {}) {
   let name = "";
   let hook;
   try {
@@ -3733,6 +3782,11 @@ async function runAutomationHook(host, stdin) {
     const input = normalizeHook(host, raw);
     hook = input;
     name = input.name;
+    if (options.managed) {
+      input.cwd = await resolveHookRoot(host, input.cwd);
+      const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
+      if (!await prepareLaunch2(host, { dir: input.cwd, allowInactive: true })) return null;
+    }
     if (["before_tool", "after_tool"].includes(input.event.event) && input.readOnly) {
       const observed = await observeReadOnlyTool(input.cwd, input.event);
       const { observeActivation: observeActivation3 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
@@ -3765,6 +3819,9 @@ function managedHookCommand(host, platform = process.platform) {
 function knownManagedHookCommands(host) {
   return [managedHookCommand(host, "linux"), managedHookCommand(host, "win32"), `mason --setup-host ${host} auto hook --host ${host}`];
 }
+function compatibleManagedHookCommands(host, platform = process.platform) {
+  return [managedHookCommand(host, platform), `mason --setup-host ${host} auto hook --host ${host}`];
+}
 function hookConfig(host, command2 = "npx --no-install --package mason-context mason-auto") {
   const handler = { type: "command", command: command2 === `mason --setup-host ${host} auto` ? managedHookCommand(host) : command2 + " hook --host " + host, timeout: 30 };
   return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
@@ -3779,6 +3836,7 @@ var init_adapters = __esm({
     init_execution();
     init_runtime();
     init_store();
+    init_hook_root();
     inputSchema = z13.object({
       cwd: z13.string().min(1),
       session_id: z13.string().min(1).max(500),
@@ -3807,8 +3865,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs17 from "fs/promises";
-import path21 from "path";
+import fs18 from "fs/promises";
+import path22 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -3837,14 +3895,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs17.unlink(file2);
+    await fs18.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path21.join(path21.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path22.join(path22.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs17.open(temporary, "wx", mode);
+    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs18.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -3852,10 +3910,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs17.rename(temporary, file);
+    await fs18.rename(temporary, file);
     return true;
   } finally {
-    await fs17.rm(temporary, { force: true });
+    await fs18.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4024,29 +4082,6 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
-// src/utils/git.ts
-var git_exports = {};
-__export(git_exports, {
-  isGitRepo: () => isGitRepo
-});
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
-async function isGitRepo(dir) {
-  try {
-    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var exec8;
-var init_git2 = __esm({
-  "src/utils/git.ts"() {
-    "use strict";
-    exec8 = promisify11(execFile11);
-  }
-});
-
 // src/setup/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -4091,7 +4126,7 @@ async function instructionEdits(root, host) {
 function managedMcp(previous, host) {
   const options = previous === void 0 ? {} : object.parse(previous);
   for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host) };
+  return { ...options, ...host === "claude" ? { type: "stdio" } : {}, ...mcpCommand(host) };
 }
 async function mcpEdit(root, host) {
   const file = mcpPath(host), before = await readText(root, file);
@@ -4128,17 +4163,9 @@ async function hookEdits(root, host) {
 }
 async function ancillaryEdits(root) {
   const ignore = await readText(root, ".gitignore");
-  const { git: git4 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
-  let parentIgnored = false;
-  try {
-    if (await isGitRepo2(root)) parentIgnored = !!(await git4(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
   const rules = [
-    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/",
+    "/.mason/*",
     "!/.mason/decisions/",
     "!/.mason/decisions/**",
     "!/.mason/reviews/",
@@ -4156,13 +4183,14 @@ async function inspectHostConfig(root, host, plannedMcp) {
   const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
   const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
   const expected = hookConfig(host, hookCommand(host));
+  const compatible = compatibleManagedHookCommands(host);
   const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
   return {
     mcp,
     mcpDisabled: mcp?.enabled === false,
     hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
       event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => compatible.includes(handler.command ?? "")).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
     ])),
     disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
   };
@@ -4352,8 +4380,12 @@ async function planTeardown(root, selected) {
         if (host === "codex" && BLOCKS[2].some((marker) => before.includes(marker))) throw new Error("The marked Mason MCP entry was removed or renamed; inspect the retained block manually.");
         return;
       }
-      const expected = ownership.files[mcpFile]?.mcpHash ?? hash(mcpCommand(host));
-      if (hash(servers.mason) !== expected) throw new Error("The Mason MCP entry was edited or its ownership is uncertain; retained for manual cleanup.");
+      const ownedHash = ownership.files[mcpFile]?.mcpHash;
+      const expected = ownedHash ? [ownedHash] : [
+        hash(mcpCommand(host)),
+        ...host === "claude" ? [hash({ type: "stdio", ...mcpCommand(host) })] : []
+      ];
+      if (!expected.includes(hash(servers.mason))) throw new Error("The Mason MCP entry was edited or its ownership is uncertain; retained for manual cleanup.");
       delete servers.mason;
       const desired = { ...config, [key]: servers };
       if (!Object.keys(servers).length) delete desired[key];
@@ -4520,13 +4552,13 @@ var init_teardown = __esm({
 });
 
 // src/review/cochange.ts
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec9(
+    const { stdout } = await exec8(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4582,11 +4614,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec9 = promisify12(execFile12);
+    exec8 = promisify11(execFile11);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -4894,10 +4926,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path22 from "path";
+import path23 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path22.isAbsolute(file) ? path22.relative(root, file) : file;
+  const relative = path23.isAbsolute(file) ? path23.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -4994,7 +5026,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path22.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path23.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5115,13 +5147,13 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs18 from "fs/promises";
-import path23 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
+import fs19 from "fs/promises";
+import path24 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec10("git", ["merge-base", base, head], {
+    const { stdout } = await exec9("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5132,7 +5164,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5145,7 +5177,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path23.resolve(rootDir);
+  const resolvedRoot = path24.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5195,7 +5227,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs18.access(path23.join(resolvedRoot, relPath));
+        await fs19.access(path24.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5228,7 +5260,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec10, MAX_ANALYZED_FILES;
+var exec9, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5240,7 +5272,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec10 = promisify13(execFile13);
+    exec9 = promisify12(execFile12);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -5362,7 +5394,16 @@ async function setupStatus(dir) {
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
     const config = await inspectHostConfig(ws.root, host, void 0);
     const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual3({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
-    const hooks = isDeepStrictEqual3(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
+    const expectedHooks = hookConfig(host, hookCommand(host)).hooks;
+    const currentHooks = isDeepStrictEqual3(config.hooks, expectedHooks);
+    const compatibleHooks = Object.fromEntries(Object.entries(config.hooks).map(([event, groups]) => [
+      event,
+      groups.map((group) => ({ ...group, hooks: group.hooks.map((handler) => ({
+        ...handler,
+        command: expectedHooks.SessionStart[0].hooks[0].command
+      })) }))
+    ]));
+    const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
@@ -5381,11 +5422,12 @@ async function setupStatus(dir) {
       runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
-      hookConfiguration: hooks ? "configured" : "disabled-or-changed",
+      hookConfiguration: hooks ? currentHooks ? "configured" : "compatible" : "disabled-or-changed",
       observedEvents,
       contextCalls: observation?.contextCalls ?? 0,
       verificationStatus: automation.status === "current" ? automation.verificationStatus ?? "unavailable" : "unavailable",
-      pending
+      pending,
+      updates: hooks && !currentHooks ? ["A newer hook template is available. Run mason setup --host " + host + " to update it when convenient; review and commit the configuration changes."] : []
     };
   }
   const statuses = Object.values(hosts2).map((host) => host.status);
@@ -5410,6 +5452,7 @@ function summarizeActivation(status) {
       `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
       ...state.pending.map((message2) => "  Next: " + message2)
     );
+    lines.push(...state.updates.map((message2) => "  Optional: " + message2));
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
   if (status.next) lines.push(status.next);
@@ -5558,16 +5601,16 @@ var init_setup = __esm({
 });
 
 // src/distribution/bundle.ts
-import fs19 from "fs/promises";
-import path24 from "path";
+import fs20 from "fs/promises";
+import path25 from "path";
 import { createHash as createHash4 } from "crypto";
 import { z as z23 } from "zod";
 async function readBundle(root) {
-  const bytes = await fs19.readFile(await storePath(root, "bundle.json"));
+  const bytes = await fs20.readFile(await storePath(root, "bundle.json"));
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path24.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path25.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -5582,7 +5625,7 @@ async function verifyBundle(root, expectedHash) {
   if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
   const files = Object.keys(bundle.manifest.files);
   for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs19.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+    if (sha256(await fs20.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
   }));
   return bundle;
 }
@@ -5605,18 +5648,18 @@ var init_bundle = __esm({
 });
 
 // src/distribution/path.ts
-import fs20 from "fs/promises";
+import fs21 from "fs/promises";
 import os3 from "os";
-import path25 from "path";
-import { execFile as execFile14 } from "child_process";
-import { promisify as promisify14 } from "util";
+import path26 from "path";
+import { execFile as execFile13 } from "child_process";
+import { promisify as promisify13 } from "util";
 import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
 import { z as z24 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path25.posix.isAbsolute(entry) && path25.posix.resolve(entry) === path25.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path26.posix.isAbsolute(entry) && path26.posix.resolve(entry) === path26.posix.resolve(bin));
   const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
 ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
@@ -5634,33 +5677,33 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path25.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path26.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles = [path25.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles = [path25.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles = [path25.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles = [path26.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path26.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path26.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path25.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path26.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs20.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs21.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles = [path25.join(userHome, ".bashrc"), login];
+      profiles = [path26.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles) {
-      const stat = await fs20.lstat(profile).catch((error) => {
+      const stat = await fs21.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs20.realpath(profile) : path25.resolve(profile);
-      const original = await fs20.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs21.realpath(profile) : path26.resolve(profile);
+      const original = await fs21.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -5675,8 +5718,8 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs20.mkdir(path25.dirname(file), { recursive: true });
-      const handle = await fs20.open(file, original === null ? "ax+" : "a+", 384);
+      await fs21.mkdir(path26.dirname(file), { recursive: true });
+      const handle = await fs21.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -5700,13 +5743,13 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs20.lstat(change.file).catch((error) => {
+      const stat = await fs21.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs20.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs21.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
@@ -5716,7 +5759,7 @@ async function removePath(changes) {
       const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs20.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs21.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -5725,11 +5768,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs20.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs20.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs20.rename(temporary, change.file);
+        const current = await fs21.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs21.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs21.rename(temporary, change.file);
       } finally {
-        await fs20.rm(temporary, { force: true });
+        await fs21.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5770,13 +5813,13 @@ var execute3, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute3 = promisify14(execFile14);
+    execute3 = promisify13(execFile13);
     pathChangeSchema = z24.discriminatedUnion("kind", [
       z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
       z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path25.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path26.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -5794,9 +5837,9 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs21 from "fs/promises";
+import fs22 from "fs/promises";
 import os4 from "os";
-import path26 from "path";
+import path27 from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
 import { randomUUID as randomUUID8 } from "crypto";
@@ -5804,31 +5847,31 @@ import { z as z25 } from "zod";
 async function replace(file, content2, mode = 384) {
   const temp = file + ".tmp-" + randomUUID8();
   try {
-    await fs21.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs21.rename(temp, file);
+    await fs22.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs22.rename(temp, file);
   } finally {
-    await fs21.rm(temp, { force: true });
+    await fs22.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path26.resolve(defaultHome());
-  await fs21.mkdir(selectedHome, { recursive: true });
-  const home = await fs21.realpath(selectedHome);
-  const selectedBin = path26.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path26.join(home, "bin") : path26.join(os4.homedir(), ".local/bin")));
+  const selectedHome = path27.resolve(defaultHome());
+  await fs22.mkdir(selectedHome, { recursive: true });
+  const home = await fs22.realpath(selectedHome);
+  const selectedBin = path27.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path27.join(home, "bin") : path27.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema3.parse(raw);
-    if (!previous) for (const file of await fs21.readdir(home)) {
+    if (!previous) for (const file of await fs22.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path26.join(home, file);
-      const stat = await fs21.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs21.readdir(directory)).length) {
+      const directory = path27.join(home, file);
+      const stat = await fs22.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs22.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs21.mkdir(selectedBin, { recursive: true });
-    const bin = await fs21.realpath(selectedBin);
+    await fs22.mkdir(selectedBin, { recursive: true });
+    const bin = await fs22.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
@@ -5839,10 +5882,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path26.join(destination, "node.exe"))} ${psQuote(path26.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path27.join(destination, "node.exe"))} ${psQuote(path27.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path26.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path27.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -5851,11 +5894,11 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path26.join(destination, "node"))} ${shQuote(path26.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path27.join(destination, "node"))} ${shQuote(path27.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs21.readFile(file, "utf8").catch((error) => {
+      const old = await fs22.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5864,7 +5907,7 @@ exec ${shQuote(path26.join(destination, "node"))} ${shQuote(path26.join(destinat
     const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
     const checkRetired = async (name, expected) => {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs21.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      const actual = await fs22.readFile(await storePath(bin, name), "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5874,28 +5917,28 @@ exec ${shQuote(path26.join(destination, "node"))} ${shQuote(path26.join(destinat
     const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
     const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs21.mkdir(stage);
+    await fs22.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs21.copyFile(from, to);
-        await fs21.chmod(to, (await fs21.stat(from)).mode & 511);
+        await fs22.copyFile(from, to);
+        await fs22.chmod(to, (await fs22.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists = await fs21.lstat(destination).then(() => true, (error) => {
+      const exists = await fs22.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
       if (exists) await verifyBundle(destination, bundle.manifestHash);
-      else await fs21.rename(stage, destination);
+      else await fs22.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
       for (const [name, expected] of retired) {
         await checkRetired(name, expected);
-        await fs21.rm(await storePath(bin, name), { force: true });
+        await fs22.rm(await storePath(bin, name), { force: true });
       }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs21.rm(stage, { recursive: true, force: true });
+      await fs22.rm(stage, { recursive: true, force: true });
     }
     const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
       receipt.pathChanges = changes;
@@ -5905,12 +5948,12 @@ exec ${shQuote(path26.join(destination, "node"))} ${shQuote(path26.join(destinat
   });
 }
 async function currentInstallation() {
-  const app = path26.dirname(path26.dirname(fileURLToPath(import.meta.url)));
-  const bundle = path26.dirname(app), home = path26.dirname(path26.dirname(bundle));
+  const app = path27.dirname(path27.dirname(fileURLToPath(import.meta.url)));
+  const bundle = path27.dirname(app), home = path27.dirname(path27.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema3.parse(raw);
-  if (record.home !== await fs21.realpath(home) || path26.dirname(bundle) !== path26.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs22.realpath(home) || path27.dirname(bundle) !== path27.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -5918,7 +5961,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path26.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path27.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -5939,7 +5982,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs21.readFile(file, "utf8").catch((error) => {
+      const actual = await fs22.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5947,9 +5990,9 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs21.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs22.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs21.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs22.rm(home, { recursive: true, force: true });
   return home;
 }
 var recordSchema3, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
@@ -5974,7 +6017,7 @@ var init_install2 = __esm({
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path26.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path26.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path27.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path27.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
@@ -6039,7 +6082,7 @@ function isHookCommand(argv) {
 async function runAutomationCli(argv, stdin = "", io = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
-}) {
+}, options = {}) {
   let action = "";
   try {
     const { values, positionals } = parseCli(argv);
@@ -6059,7 +6102,9 @@ async function runAutomationCli(argv, stdin = "", io = {
       return result.status === "complete" ? 0 : 2;
     }
     if (action === "hook") {
-      const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
+      const host = hostSchema.parse(values.host);
+      if (options.managedHost && options.managedHost !== host) throw new Error("Managed hook --host does not match its launcher.");
+      const output = await runAutomationHook(host, stdin, { managed: !!options.managedHost });
       if (output) io.out(JSON.stringify(output));
       return 0;
     }
@@ -6104,7 +6149,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.17.0"}
+var usage = `Mason ${"0.17.1"}
 
 Usage: mason <command> [options]
 
@@ -6124,13 +6169,14 @@ mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
   if (managedLaunch) {
     if (!setupHost || !["codex", "claude"].includes(setupHost) || !["mcp", "auto"].includes(command)) throw new Error("Invalid setup invocation.");
-    const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
-    const active = await prepareLaunch2(setupHost, { allowInactive: command === "auto" && isHookCommand(args) });
-    if (!active) process.exit(0);
+    if (!(command === "auto" && isHookCommand(args))) {
+      const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
+      await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
+    }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.0" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.1" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.17.0");
+  else if (["--version", "-v"].includes(command)) console.log("0.17.1");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
@@ -6153,7 +6199,12 @@ ${installed.path.message}`);
       input += chunk.toString();
       if (Buffer.byteLength(input) > 1024 * 1024) break;
     }
-    process.exitCode = await runAutomationCli(forwarded, input);
+    process.exitCode = await runAutomationCli(
+      forwarded,
+      input,
+      void 0,
+      { managedHost: managedLaunch ? setupHost : void 0 }
+    );
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
     process.argv = [process.execPath, fileURLToPath2(binary), ...args];