mason-context 0.17.4 → 0.19.0

package/dist/mason.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -305,18 +306,34 @@ var init_storage = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/utils/store-lock.ts
 import fs3 from "fs/promises";
 import os from "os";
-import { z } from "zod";
-function parseState(raw) {
+async function lockDiagnostic(file) {
+  let reason2;
   try {
-    return stateSchema.parse(raw);
+    const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+    if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
+      reason2 = "Lock owner data is incomplete or malformed.";
+    } else if (owner.host !== os.hostname()) {
+      reason2 = "The lock belongs to another host; its process cannot be checked locally.";
+    } else {
+      try {
+        process.kill(owner.pid, 0);
+        reason2 = `Local owner PID ${owner.pid} is still running.`;
+      } catch (error) {
+        reason2 = error.code === "ESRCH" ? `Local owner PID ${owner.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.pid} could not be checked.`;
+      }
+    }
   } catch (error) {
-    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+    reason2 = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
+  }
+  if (await fs3.lstat(file + ".reclaim").then(() => true, () => false)) {
+    reason2 += " A recovery guard also needs inspection: " + file + ".reclaim.";
   }
+  return reason2 + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
 }
-async function withLock(root, directory, run, waitMs = 5e3) {
+async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason store") {
   const file = await storePath(root, directory + "/lock", true);
   const deadline = Date.now() + waitMs;
   let handle;
@@ -359,7 +376,7 @@ async function withLock(root, directory, run, waitMs = 5e3) {
         }
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      if (Date.now() >= deadline) throw new Error(label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file));
       await new Promise((resolve) => setTimeout(resolve, 40));
     }
   }
@@ -370,11 +387,30 @@ async function withLock(root, directory, run, waitMs = 5e3) {
     await fs3.unlink(file);
   }
 }
+var init_store_lock = __esm({
+  "src/utils/store-lock.ts"() {
+    "use strict";
+    init_storage();
+  }
+});
+
+// src/automation/store.ts
+import { z } from "zod";
+function parseState(raw) {
+  try {
+    return stateSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+  }
+}
+function withLock(root, directory, run, waitMs = 5e3) {
+  return withStoreLock(root, directory, run, waitMs, "Automation");
+}
 var hostSchema, events, stateSchema;
 var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
-    init_storage();
+    init_store_lock();
     hostSchema = z.enum(["claude", "codex"]);
     events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
     stateSchema = z.object({
@@ -1204,6 +1240,14 @@ var init_scope = __esm({
   }
 });
 
+// src/snapshot/lock.ts
+var init_lock = __esm({
+  "src/snapshot/lock.ts"() {
+    "use strict";
+    init_store_lock();
+  }
+});
+
 // src/test-map.ts
 import path9 from "path";
 async function buildTestMap(dir) {
@@ -1313,6 +1357,7 @@ var init_snapshot = __esm({
     init_files();
     init_files();
     init_storage();
+    init_lock();
     init_paths();
     init_test_map();
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
@@ -1320,6 +1365,7 @@ var init_snapshot = __esm({
       refreshedHash: z2.string().optional(),
       verifiedAt: z2.string().optional(),
       verifiedHash: z2.string().optional(),
+      verificationToken: z2.string().optional(),
       verificationFailed: z2.boolean().optional(),
       verificationNote: z2.string().optional()
     };
@@ -1942,6 +1988,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content2) {
+  const text2 = content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -1968,6 +2018,19 @@ async function checkDepsChanged(ctx) {
         reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
       });
     }
+    let content2 = doc.content;
+    if (doc.dirty) {
+      try {
+        content2 = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
+    }
+    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2013,6 +2076,7 @@ var init_deps_changed = __esm({
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -2908,7 +2972,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -3086,7 +3150,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [5, engineVersion, head, shallow, replacements, docContents];
+  const common = [6, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3146,7 +3210,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.17.4" : "development";
+    engineVersion = true ? "0.19.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3360,13 +3424,17 @@ async function observeReadOnlyTool(dir, event) {
 }
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
+  const onlyReview = report.status === "incomplete" && !report.diagnostics.length && !report.counts.unresolved && !report.counts.unverified && report.counts["review-required"] > 0;
   return [
-    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
-    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    onlyReview ? `Mason: ${report.counts["review-required"]} advisor${report.counts["review-required"] === 1 ? "y" : "ies"} awaiting review; no unresolved issues.` : `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => {
+      const detail = f.current ? f.current.message : f.status === "review-required" ? `${f.original.type}: current check no longer reports ${f.original.type === "deps-changed" ? "this condition" : "the original finding"}; historical evidence awaits assessment.` : `Original evidence: ${f.original.message}. ${f.reason}`;
+      return `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(detail)}`;
+    }),
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -3590,7 +3658,7 @@ async function automate(dir, event) {
         if (event.event === "after_tool" && event.mutating) {
           session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
-            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
           }
           if (event.toolId) delete session.pending[event.toolId];
@@ -3733,11 +3801,39 @@ var init_hook_root = __esm({
 
 // src/setup/model.ts
 import { z as z11 } from "zod";
+import fs16 from "fs/promises";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
+async function effectiveSetup(root) {
+  const local = await loadSetup(root);
+  if (local) return { root, setup: local };
+  const common = await fs16.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const own = await fs16.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  if (common === own) return { root, setup: null };
+  const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
+  const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
+  if (!candidate || primary.includes("bare")) return { root, setup: null };
+  let inheritedRoot;
+  try {
+    inheritedRoot = await fs16.realpath((await git3(candidate, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
+    throw error;
+  }
+  const inheritedCommon = await fs16.realpath(path23.resolve(
+    inheritedRoot,
+    (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
+  ));
+  if (inheritedCommon !== common) throw new Error("Linked worktree setup does not belong to the same Git repository.");
+  const setup = await loadSetup(inheritedRoot);
+  const inactive = await readStoreJson(root, INACTIVE_HOSTS_PATH);
+  if (inactive && setup) for (const host of inactiveHostsSchema.parse(inactive).hosts) delete setup.hosts[host];
+  return { root: inheritedRoot, setup };
+}
 async function loadSetupReceipt(root, directory, host) {
   const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
   if (raw === null) return null;
@@ -3745,10 +3841,11 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, INACTIVE_HOSTS_PATH, inactiveHostsSchema, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
+    init_evidence();
     init_storage();
     setupHostSchema = z11.object({
       configuredVersion: z11.string(),
@@ -3762,6 +3859,8 @@ var init_model = __esm({
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
+    INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
+    inactiveHostsSchema = z11.object({ version: z11.literal(1), hosts: z11.array(z11.enum(["claude", "codex"])) });
     receiptSchema = z11.object({
       version: z11.literal(1),
       host: z11.enum(["codex", "claude"]),
@@ -3788,7 +3887,7 @@ __export(launcher_exports, {
 });
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
 }
@@ -3808,8 +3907,8 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs16.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
-  const entry = (await loadSetup(root))?.hosts[host];
+  const root = await fs17.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const entry = (await effectiveSetup(root)).setup?.hosts[host];
   process.env.MASON_SETUP_ROOT = root;
   process.env.MASON_SETUP_HOST = host;
   delete process.env.MASON_SETUP_REVISION;
@@ -3831,7 +3930,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.4" : "development";
+    executingVersion = () => true ? "0.19.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3844,7 +3943,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs17 from "fs/promises";
+import fs18 from "fs/promises";
 import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -3861,15 +3960,15 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
     if (!revision) {
-      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+      if ((await effectiveSetup(process.env.MASON_SETUP_ROOT)).setup?.hosts[host]) {
         return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
       }
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs17.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs17.realpath(process.env.MASON_SETUP_ROOT)) return null;
-    const setup = await loadSetup(ws.root);
+    const ws = capturedDirectory ? { root: await fs18.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs18.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
     await withLock(ws.root, directory, async () => {
@@ -4046,8 +4145,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs18 from "fs/promises";
-import path23 from "path";
+import fs19 from "fs/promises";
+import path24 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4076,14 +4175,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs18.unlink(file2);
+    await fs19.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path24.join(path24.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs18.open(temporary, "wx", mode);
+    const mode = await fs19.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs19.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -4091,10 +4190,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs18.rename(temporary, file);
+    await fs19.rename(temporary, file);
     return true;
   } finally {
-    await fs18.rm(temporary, { force: true });
+    await fs19.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4200,7 +4299,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
 - Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
-- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, and failed verification means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
@@ -4502,6 +4601,8 @@ __export(teardown_exports, {
   teardownProject: () => teardownProject
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import fs20 from "fs/promises";
+import path25 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
 import fg6 from "fast-glob";
 import { z as z18 } from "zod";
@@ -4523,6 +4624,11 @@ async function planTeardown(root, selected) {
   const ownership = ownershipBefore === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(ownershipBefore));
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
+  const linked = (await workspace(root)).gitDir !== await fs20.realpath(
+    path25.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  );
+  const inactiveBefore = linked && !setup ? await read(INACTIVE_HOSTS_PATH) : null;
+  const inactive = inactiveBefore === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(inactiveBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
   const commands2 = (host) => new Set([
@@ -4666,7 +4772,16 @@ async function planTeardown(root, selected) {
         delete ownership.files[configPath(host)];
       }
       if (!remainingHost) for (const file of DOC_CANDIDATES) delete ownership.files[file];
-      if (setupBefore !== null) cleanup.push({ path: SETUP_PATH, before: setupBefore, after: Object.keys(setup.hosts).length ? json(setup) : null });
+      if (setupBefore !== null) cleanup.push({
+        path: SETUP_PATH,
+        before: setupBefore,
+        after: linked || Object.keys(setup.hosts).length ? json(setup) : null
+      });
+      else if (linked) cleanup.push({
+        path: INACTIVE_HOSTS_PATH,
+        before: inactiveBefore,
+        after: json({ version: 1, hosts: [.../* @__PURE__ */ new Set([...inactive.hosts, ...selected])].sort() })
+      });
       if (automationBefore !== null) cleanup.push({ path: AUTOMATION_PATH, before: automationBefore, after: Object.keys(automation.hosts).length ? json(automation) : null });
       if (ownershipBefore !== null) cleanup.push({ path: OWNERSHIP_PATH, before: ownershipBefore, after: Object.keys(ownership.files).length ? json(ownership) : null });
       edits.push(...cleanup);
@@ -5107,10 +5222,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path24 from "path";
+import path26 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
+  const relative = path26.isAbsolute(file) ? path26.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5207,7 +5322,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path26.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5328,8 +5443,8 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs19 from "fs/promises";
-import path25 from "path";
+import fs21 from "fs/promises";
+import path27 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5358,7 +5473,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path25.resolve(rootDir);
+  const resolvedRoot = path27.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5408,7 +5523,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path25.join(resolvedRoot, relPath));
+        await fs21.access(path27.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5551,8 +5666,9 @@ __export(status_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
-  const setup = await loadSetup(ws.root);
-  if (!setup) {
+  const activation = await effectiveSetup(ws.root);
+  const setup = activation.setup;
+  if (!setup || !Object.keys(setup.hosts).length) {
     const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
       host,
       receipt: await loadSetupReceipt(ws.root, ws.directory, host)
@@ -5586,7 +5702,7 @@ async function setupStatus(dir) {
     ]));
     const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
-    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
@@ -5618,6 +5734,7 @@ async function setupStatus(dir) {
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
     hosts: hosts2,
+    activationRoot: activation.root,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -5625,6 +5742,9 @@ async function setupStatus(dir) {
 }
 function summarizeActivation(status) {
   const lines = ["Mason setup: " + status.status + "."];
+  if (status.activationRoot && status.activationRoot !== status.root) {
+    lines.push("Activation inherited from " + status.activationRoot + "; evidence belongs to this worktree.");
+  }
   for (const [host, state] of Object.entries(status.hosts)) {
     lines.push(
       `${host}: ${state.status}`,
@@ -5786,66 +5906,19 @@ var init_setup = __esm({
   }
 });
 
-// src/distribution/bundle.ts
-import fs20 from "fs/promises";
-import path26 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z23 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs20.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path26.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
-    }
-  }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
-  }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs20.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
-}
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
-    "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z23.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z23.object({
-      format: z23.literal(1),
-      version: z23.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z23.enum(targets),
-      nodeVersion: z23.string(),
-      files: z23.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
-  }
-});
-
 // src/distribution/path.ts
-import fs21 from "fs/promises";
+import fs22 from "fs/promises";
 import os3 from "os";
-import path27 from "path";
+import path28 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
-import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
-import { z as z24 } from "zod";
+import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
+import { z as z23 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path27.posix.isAbsolute(entry) && path27.posix.resolve(entry) === path27.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path28.posix.isAbsolute(entry) && path28.posix.resolve(entry) === path28.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -5865,33 +5938,33 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path27.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path28.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path27.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path27.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path27.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path28.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path28.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path28.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path27.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path28.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs21.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs22.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles2 = [path27.join(userHome, ".bashrc"), login];
+      profiles2 = [path28.join(userHome, ".bashrc"), login];
     }
-    const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    const marker = `# >>> mason PATH ${createHash4("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
-      const stat = await fs21.lstat(profile).catch((error) => {
+      const stat = await fs22.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs21.realpath(profile) : path27.resolve(profile);
-      const original = await fs21.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs22.realpath(profile) : path28.resolve(profile);
+      const original = await fs22.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -5906,8 +5979,8 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs21.mkdir(path27.dirname(file), { recursive: true });
-      const handle = await fs21.open(file, original === null ? "ax+" : "a+", 384);
+      await fs22.mkdir(path28.dirname(file), { recursive: true });
+      const handle = await fs22.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -5931,13 +6004,13 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs21.lstat(change.file).catch((error) => {
+      const stat = await fs22.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs21.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs22.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
@@ -5947,7 +6020,7 @@ async function removePath(changes) {
       const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs21.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs22.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -5956,11 +6029,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs21.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs21.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs21.rename(temporary, change.file);
+        const current = await fs22.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs22.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs22.rename(temporary, change.file);
       } finally {
-        await fs21.rm(temporary, { force: true });
+        await fs22.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -6002,12 +6075,12 @@ var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
     execute2 = promisify5(execFile5);
-    pathChangeSchema = z24.discriminatedUnion("kind", [
-      z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
-      z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
+    pathChangeSchema = z23.discriminatedUnion("kind", [
+      z23.object({ kind: z23.literal("profile"), file: z23.string(), block: z23.string(), created: z23.boolean() }),
+      z23.object({ kind: z23.literal("windows"), entry: z23.string(), created: z23.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path27.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path28.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -6016,65 +6089,346 @@ var init_path = __esm({
   }
 });
 
+// src/distribution/state.ts
+var state_exports = {};
+__export(state_exports, {
+  automaticUpdatesAllowed: () => automaticUpdatesAllowed,
+  currentInstallation: () => currentInstallation,
+  defaultHome: () => defaultHome,
+  newerStableVersion: () => newerStableVersion,
+  readInstallation: () => readInstallation,
+  recordSchema: () => recordSchema3,
+  releaseVersion: () => releaseVersion,
+  standaloneLocation: () => standaloneLocation,
+  updatePolicySchema: () => updatePolicySchema
+});
+import os4 from "os";
+import path29 from "path";
+import { fileURLToPath } from "url";
+import fs23 from "fs/promises";
+import { z as z24 } from "zod";
+async function readInstallation(home) {
+  const raw = await readStoreJson(home, "install.json");
+  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const record = recordSchema3.parse(raw);
+  if (record.home !== await fs23.realpath(home)) throw new Error("Invalid standalone installation receipt.");
+  return record;
+}
+function standaloneLocation() {
+  const bundle = path29.resolve(path29.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path29.dirname(path29.dirname(bundle));
+  if (path29.dirname(bundle) !== path29.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path29.basename(bundle))) {
+    return null;
+  }
+  return { home, bundle };
+}
+async function currentInstallation() {
+  const location2 = standaloneLocation();
+  if (!location2) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const { home, bundle } = location2;
+  const record = await readInstallation(home);
+  return { home, bundle, record };
+}
+function automaticUpdatesAllowed(record, env = process.env) {
+  return record.updates?.enabled === true && !record.updates.pinnedVersion && !record.updates.mirror && !env.CI && env.MASON_NO_AUTO_UPDATE !== "1" && !env.MASON_RELEASE_BASE && !env.MASON_VERSION;
+}
+function newerStableVersion(candidate, installed) {
+  if (!/^\d+\.\d+\.\d+$/.test(candidate)) return false;
+  const a = candidate.split(".").map(BigInt), b = installed.split("-")[0].split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return installed.includes("-");
+}
+var releaseVersion, bundleId, updatePolicySchema, recordSchema3, defaultHome;
+var init_state = __esm({
+  "src/distribution/state.ts"() {
+    "use strict";
+    init_storage();
+    init_path();
+    releaseVersion = z24.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+    bundleId = z24.string().regex(/^[a-f0-9]{24}$/);
+    updatePolicySchema = z24.object({
+      enabled: z24.boolean(),
+      revision: z24.string(),
+      pinnedVersion: releaseVersion.optional(),
+      mirror: z24.string().optional()
+    });
+    recordSchema3 = z24.object({
+      format: z24.literal(1),
+      home: z24.string(),
+      bin: z24.string(),
+      current: bundleId,
+      version: releaseVersion,
+      launchers: z24.record(z24.string()),
+      previousLaunchers: z24.record(z24.string()).optional(),
+      pathChanges: z24.array(pathChangeSchema).optional(),
+      updates: updatePolicySchema.optional(),
+      previous: z24.object({ id: bundleId, version: releaseVersion }).optional(),
+      pending: z24.object({ id: bundleId, version: releaseVersion, policyRevision: z24.string() }).optional()
+    });
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path29.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path29.join(os4.homedir(), ".local/share/mason"));
+  }
+});
+
+// src/distribution/bundle.ts
+import fs24 from "fs/promises";
+import path30 from "path";
+import { createHash as createHash5 } from "crypto";
+import { z as z25 } from "zod";
+async function readBundle(root) {
+  const bytes = await fs24.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path30.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs24.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+var targets, digest2, bundleSchema, sha256;
+var init_bundle = __esm({
+  "src/distribution/bundle.ts"() {
+    "use strict";
+    init_storage();
+    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+    digest2 = z25.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z25.object({
+      format: z25.literal(1),
+      version: z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z25.enum(targets),
+      nodeVersion: z25.string(),
+      files: z25.record(digest2)
+    }).strict();
+    sha256 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
+  }
+});
+
+// src/distribution/runtime.ts
+import fs25 from "fs/promises";
+import { unlinkSync } from "fs";
+import os5 from "os";
+import path31 from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import { z as z26 } from "zod";
+async function pruneUnusedVersions(home) {
+  const versions = await storePath(home, "versions");
+  const candidates = [];
+  const initial = await readInstallation(home);
+  const initialKeep = /* @__PURE__ */ new Set([initial.current, initial.previous?.id, initial.pending?.id]);
+  for (const name of await fs25.readdir(versions)) {
+    const retired = /^\.retired-([a-f0-9]{24})-[a-f0-9-]+$/.exec(name);
+    const id = retired?.[1] ?? name;
+    if (!/^[a-f0-9]{24}$/.test(id) || initialKeep.has(id)) continue;
+    try {
+      const directory = await storePath(home, `versions/${name}`);
+      await fs25.access(await storePath(directory, "app/dist/mason-runtime.js"));
+      const bundle = await verifyBundle(directory);
+      if (bundle.manifestHash.slice(0, 24) === id && bundle.manifest.files["app/dist/mason-runtime.js"])
+        candidates.push({ id, directory, retired: !!retired });
+    } catch {
+    }
+  }
+  if (!candidates.length) return;
+  const garbage = [];
+  await withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    const keep = /* @__PURE__ */ new Set([record.current, record.previous?.id, record.pending?.id]);
+    const directory = await storePath(home, "runtimes");
+    const leases = await fs25.readdir(directory).catch((error) => {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    });
+    for (const name of leases) {
+      if (!/^[a-f0-9-]+\.json$/.test(name)) return;
+      try {
+        const raw = await readStoreJson(home, `runtimes/${name}`);
+        if (raw === null) continue;
+        const lease = leaseSchema.parse(raw);
+        if (lease.host !== os5.hostname()) return;
+        try {
+          process.kill(lease.pid, 0);
+          keep.add(lease.bundle);
+        } catch (error) {
+          if (error.code !== "ESRCH") return;
+          await fs25.rm(await storePath(home, `runtimes/${name}`), { force: true });
+        }
+      } catch {
+        return;
+      }
+    }
+    for (const candidate of candidates) {
+      if (keep.has(candidate.id)) continue;
+      try {
+        const retired = candidate.retired ? candidate.directory : await storePath(home, `versions/.retired-${candidate.id}-${randomUUID8()}`);
+        if (!candidate.retired) await fs25.rename(candidate.directory, retired);
+        garbage.push(retired);
+      } catch {
+      }
+    }
+  });
+  for (const directory of garbage) await fs25.rm(directory, { recursive: true }).catch(() => {
+  });
+}
+var leaseSchema;
+var init_runtime2 = __esm({
+  "src/distribution/runtime.ts"() {
+    "use strict";
+    init_store();
+    init_storage();
+    init_state();
+    init_bundle();
+    leaseSchema = z26.object({ pid: z26.number().int().positive(), host: z26.string(), bundle: z26.string().regex(/^[a-f0-9]{24}$/) });
+  }
+});
+
+// src/distribution/sessions.ts
+import fs26 from "fs/promises";
+import os6 from "os";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z27 } from "zod";
+async function hasRunningMcp(home) {
+  const directory = await storePath(home, "sessions");
+  const files = await fs26.readdir(directory).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  for (const name of files) {
+    if (!/^[a-f0-9-]+\.json$/.test(name)) return true;
+    const relative = "sessions/" + name;
+    try {
+      const raw = await readStoreJson(home, relative);
+      if (raw === null) continue;
+      const lease = leaseSchema2.parse(raw);
+      if (lease.host !== os6.hostname()) return true;
+      try {
+        process.kill(lease.pid, 0);
+        return true;
+      } catch (error) {
+        if (error.code !== "ESRCH") return true;
+      }
+      await fs26.rm(await storePath(home, relative), { force: true });
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+async function registerMcp(home) {
+  const name = `sessions/${randomUUID9()}.json`;
+  await writeStoreJson(home, name, { pid: process.pid, host: os6.hostname() });
+  return async () => {
+    await fs26.rm(await storePath(home, name), { force: true }).catch(() => {
+    });
+  };
+}
+var leaseSchema2;
+var init_sessions = __esm({
+  "src/distribution/sessions.ts"() {
+    "use strict";
+    init_storage();
+    leaseSchema2 = z27.object({ pid: z27.number().int().positive(), host: z27.string() });
+  }
+});
+
 // src/distribution/install.ts
 var install_exports2 = {};
 __export(install_exports2, {
   WINDOWS_BATCH_LAUNCHER: () => WINDOWS_BATCH_LAUNCHER,
   defaultHome: () => defaultHome,
   installStandalone: () => installStandalone,
+  prepareStandaloneMcp: () => prepareStandaloneMcp,
+  rollbackStandalone: () => rollbackStandalone,
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs22 from "fs/promises";
-import os4 from "os";
-import path28 from "path";
-import { fileURLToPath } from "url";
-import { spawn } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
-import { z as z25 } from "zod";
+import fs27 from "fs/promises";
+import os7 from "os";
+import path32 from "path";
+import { execFile as execFile6, spawn } from "child_process";
+import { promisify as promisify6 } from "util";
+import { randomUUID as randomUUID10 } from "crypto";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID8();
+  const temp = file + ".tmp-" + randomUUID10();
   try {
-    await fs22.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs22.rename(temp, file);
+    await fs27.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs27.rename(temp, file);
   } finally {
-    await fs22.rm(temp, { force: true });
+    await fs27.rm(temp, { force: true });
   }
 }
-async function installStandalone(source, progress2) {
+async function installStandalone(source, progress2, options = {}) {
   progress2?.step("Checking installation files and location");
   const bundle = await verifyBundle(source);
-  const selectedHome = path28.resolve(defaultHome());
-  await fs22.mkdir(selectedHome, { recursive: true });
-  const home = await fs22.realpath(selectedHome);
-  const selectedBin = path28.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path28.join(home, "bin") : path28.join(os4.homedir(), ".local/bin")));
-  return withLock(home, ".install-lock", async () => {
-    const raw = await readStoreJson(home, "install.json");
-    const previous = raw === null ? null : recordSchema3.parse(raw);
-    if (!previous) for (const file of await fs22.readdir(home)) {
-      if (file === ".install-lock") continue;
-      const directory = path28.join(home, file);
-      const stat = await fs22.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs22.readdir(directory)).length) {
-        throw new Error("Mason installation directory is not empty and has no ownership receipt.");
-      }
-    }
-    await fs22.mkdir(selectedBin, { recursive: true });
-    const bin = await fs22.realpath(selectedBin);
-    if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
-    const id = bundle.manifestHash.slice(0, 24);
-    const destination = await storePath(home, "versions/" + id);
-    const launchers = process.platform === "win32" ? {
-      "mason.cmd": WINDOWS_BATCH_LAUNCHER,
-      "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
+  const selectedHome = path32.resolve(defaultHome());
+  if (!options.stageOnly) await fs27.mkdir(selectedHome, { recursive: true });
+  const home = await fs27.realpath(selectedHome);
+  if (options.stageOnly) {
+    assertUpdatePolicy(await readInstallation(home), bundle.manifest.version, options.policyRevision);
+    const destination = await storePath(home, "versions/" + bundle.manifestHash.slice(0, 24));
+    await copyBundle(home, source, destination, bundle);
+    const { stdout } = await promisify6(execFile6)(
+      path32.join(destination, process.platform === "win32" ? "node.exe" : "node"),
+      [path32.join(destination, "app/dist/mason.js"), "--version"],
+      { timeout: 3e4, windowsHide: true, env: { ...process.env, MASON_NO_AUTO_UPDATE: "1" } }
+    );
+    if (stdout.trim() !== bundle.manifest.version) throw new Error("Downloaded Mason failed its version health check.");
+  }
+  return withLock(home, ".install-lock", () => installLocked2(home, source, bundle, progress2, options));
+}
+function assertUpdatePolicy(record, version, revision) {
+  if (!record || !automaticUpdatesAllowed(record, { ...process.env, MASON_VERSION: "" }) || record.updates?.revision !== revision || !newerStableVersion(version, record.version)) {
+    throw new Error("Update policy or installed version changed; download was not activated.");
+  }
+}
+async function installLocked2(home, source, bundle, progress2, options, alreadyStaged = false) {
+  const raw = await readStoreJson(home, "install.json");
+  const previous = raw === null ? null : recordSchema3.parse(raw);
+  if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
+  if (!previous) for (const file of await fs27.readdir(home)) {
+    if (file === ".install-lock") continue;
+    const directory = path32.join(home, file);
+    const stat = await fs27.lstat(directory);
+    if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs27.readdir(directory)).length) {
+      throw new Error("Mason installation directory is not empty and has no ownership receipt.");
+    }
+  }
+  const selectedBin = path32.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path32.join(home, "bin") : path32.join(os7.homedir(), ".local/bin")));
+  await fs27.mkdir(selectedBin, { recursive: true });
+  const bin = await fs27.realpath(selectedBin);
+  if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
+  const id = bundle.manifestHash.slice(0, 24);
+  const destination = await storePath(home, "versions/" + id);
+  if (options.stageOnly) {
+    const receipt2 = { ...previous, pending: { id, version: bundle.manifest.version, policyRevision: options.policyRevision } };
+    await writeStoreJson(home, "install.json", receipt2);
+    return { home, bin, version: bundle.manifest.version, previousVersion: previous.version, path: { message: "Update staged for a future MCP launch." } };
+  }
+  const launchers = process.platform === "win32" ? {
+    "mason.cmd": WINDOWS_BATCH_LAUNCHER,
+    "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
 $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path28.join(destination, "node.exe"))} ${psQuote(path28.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path32.join(destination, "node.exe"))} ${psQuote(path32.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path28.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path32.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -6082,70 +6436,146 @@ try {
 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 }
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
-    } : { mason: `#!/bin/sh
-exec ${shQuote(path28.join(destination, "node"))} ${shQuote(path28.join(destination, "app/dist/mason.js"))} "$@"
+  } : { mason: `#!/bin/sh
+exec ${shQuote(path32.join(destination, "node"))} ${shQuote(path32.join(destination, "app/dist/mason.js"))} "$@"
 ` };
-    for (const [name, content2] of Object.entries(launchers)) {
-      const file = await storePath(bin, name);
-      const old = await fs22.readFile(file, "utf8").catch((error) => {
-        if (error.code === "ENOENT") return null;
-        throw error;
-      });
-      if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  for (const [name, content2] of Object.entries(launchers)) {
+    const file = await storePath(bin, name);
+    const old = await fs27.readFile(file, "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  }
+  const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+  const checkRetired = async (name, expected) => {
+    if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+    const actual = await fs27.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+  };
+  for (const [name, expected] of retired) await checkRetired(name, expected);
+  progress2?.step(`Installing Mason ${bundle.manifest.version}`);
+  const updates = options.preservePolicy && previous?.updates ? { ...previous.updates } : {
+    ...previous?.updates ?? { enabled: !previous && !process.env.CI && process.env.MASON_NO_AUTO_UPDATE !== "1" },
+    revision: randomUUID10(),
+    pinnedVersion: process.env.MASON_VERSION?.replace(/^v/, "") || void 0,
+    mirror: process.env.MASON_RELEASE_BASE || previous?.updates?.mirror
+  };
+  if (options.rollback) {
+    updates.pinnedVersion = bundle.manifest.version;
+    updates.revision = randomUUID10();
+  }
+  const receipt = {
+    format: 1,
+    home,
+    bin,
+    current: id,
+    version: bundle.manifest.version,
+    launchers,
+    pathChanges: previous?.pathChanges ?? [],
+    updates,
+    previous: previous && previous.current !== id ? { id: previous.current, version: previous.version } : previous?.previous
+  };
+  await writeStoreJson(home, "install.json", previous ? { ...previous, previousLaunchers: launchers } : receipt);
+  try {
+    if (!alreadyStaged) await copyBundle(home, source, destination, bundle);
+    for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+    for (const [name, expected] of retired) {
+      await checkRetired(name, expected);
+      await fs27.rm(await storePath(bin, name), { force: true });
     }
-    const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
-    const checkRetired = async (name, expected) => {
-      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs22.readFile(await storePath(bin, name), "utf8").catch((error) => {
-        if (error.code === "ENOENT") return null;
-        throw error;
-      });
-      if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
-    };
-    for (const [name, expected] of retired) await checkRetired(name, expected);
-    progress2?.step(`Installing Mason ${bundle.manifest.version}`);
-    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
-    await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs22.mkdir(stage);
+    await writeStoreJson(home, "install.json", receipt);
+  } catch (error) {
+    if (previous) {
+      for (const [name, content2] of Object.entries(previous.launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      await writeStoreJson(home, "install.json", previous);
+    }
+    throw error;
+  }
+  if (options.preservePolicy) return { home, bin, version: receipt.version, previousVersion: previous?.version, path: { message: "Installation selected." } };
+  progress2?.step("Checking terminal command availability");
+  const pathResult = await configurePath(bin, receipt.pathChanges ?? [], async (changes) => {
+    receipt.pathChanges = changes;
+    await writeStoreJson(home, "install.json", receipt);
+  });
+  return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+}
+async function copyBundle(home, source, destination, bundle) {
+  const exists = await fs27.lstat(destination).then(() => true, (error) => {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  });
+  if (exists) {
+    await verifyBundle(destination, bundle.manifestHash);
+    return;
+  }
+  const stage = await storePath(home, "versions/.install-" + randomUUID10(), true);
+  await fs27.mkdir(stage);
+  try {
+    for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
+      const from = await storePath(source, file), to = await storePath(stage, file, true);
+      await fs27.copyFile(from, to);
+      await fs27.chmod(to, (await fs27.stat(from)).mode & 511);
+    }
+    await verifyBundle(stage, bundle.manifestHash);
     try {
-      for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
-        const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs22.copyFile(from, to);
-        await fs22.chmod(to, (await fs22.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, bundle.manifestHash);
-      const exists = await fs22.lstat(destination).then(() => true, (error) => {
-        if (error.code === "ENOENT") return false;
+      await fs27.rename(stage, destination);
+    } catch (error) {
+      try {
+        await verifyBundle(destination, bundle.manifestHash);
+      } catch {
         throw error;
-      });
-      if (exists) await verifyBundle(destination, bundle.manifestHash);
-      else await fs22.rename(stage, destination);
-      for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
-      for (const [name, expected] of retired) {
-        await checkRetired(name, expected);
-        await fs22.rm(await storePath(bin, name), { force: true });
       }
-      await writeStoreJson(home, "install.json", receipt);
-    } finally {
-      await fs22.rm(stage, { recursive: true, force: true });
     }
-    progress2?.step("Checking terminal command availability");
-    const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
-      receipt.pathChanges = changes;
-      await writeStoreJson(home, "install.json", receipt);
-    });
-    return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+  } finally {
+    await fs27.rm(stage, { recursive: true, force: true });
+  }
+}
+async function prepareStandaloneMcp(home) {
+  const before = await readInstallation(home), candidate = before.pending;
+  let verified, verificationError;
+  if (candidate && automaticUpdatesAllowed(before) && !await hasRunningMcp(home)) {
+    try {
+      verified = await verifyBundle(await storePath(home, "versions/" + candidate.id));
+      if (verified.manifestHash.slice(0, 24) !== candidate.id || verified.manifest.version !== candidate.version) throw new Error("Staged update changed.");
+    } catch (error) {
+      verificationError = error;
+    }
+  }
+  return withLock(home, ".install-lock", async () => {
+    let record = await readInstallation(home);
+    const pending = record.pending;
+    if (pending && candidate?.id === pending.id && (verified || verificationError) && automaticUpdatesAllowed(record) && pending.policyRevision === record.updates?.revision && newerStableVersion(pending.version, record.version) && !await hasRunningMcp(home)) {
+      try {
+        if (verificationError) throw verificationError;
+        const source = await storePath(home, "versions/" + pending.id);
+        await installLocked2(home, source, verified, void 0, { preservePolicy: true }, true);
+        record = await readInstallation(home);
+      } catch (error) {
+        record = await readInstallation(home);
+        delete record.pending;
+        await writeStoreJson(home, "install.json", record);
+        await writeStoreJson(home, "update-status.json", { lastAttempt: Date.now(), error: String(error) });
+      }
+    }
+    const release = await registerMcp(home);
+    return { bundle: await storePath(home, "versions/" + record.current), release };
   });
 }
-async function currentInstallation() {
-  const app = path28.dirname(path28.dirname(fileURLToPath(import.meta.url)));
-  const bundle = path28.dirname(app), home = path28.dirname(path28.dirname(bundle));
-  const raw = await readStoreJson(home, "install.json");
-  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
-  const record = recordSchema3.parse(raw);
-  if (record.home !== await fs22.realpath(home) || path28.dirname(bundle) !== path28.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
-  return { home, bundle, record };
+async function rollbackStandalone() {
+  const { home } = await currentInstallation();
+  return withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    if (!record.previous) throw new Error("No previous installation is available.");
+    if (await hasRunningMcp(home)) throw new Error("Close running Mason MCP sessions before rolling back.");
+    const source = await storePath(home, "versions/" + record.previous.id);
+    const bundle = await verifyBundle(source);
+    if (bundle.manifestHash.slice(0, 24) !== record.previous.id || bundle.manifest.version !== record.previous.version) throw new Error("Previous installation changed.");
+    return installLocked2(home, source, bundle, void 0, { preservePolicy: true, rollback: true });
+  });
 }
 async function upgradeStandalone(version, progress2) {
   if (version && !/^v?\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(version)) throw new Error("Expected a release version such as 0.14.0.");
@@ -6153,13 +6583,21 @@ async function upgradeStandalone(version, progress2) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path28.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path32.join(bundle, windows ? "install.ps1" : "install.sh");
   progress2?.stop();
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
       windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script],
-      { stdio: "inherit", windowsHide: true, env: { ...process.env, MASON_HOME: home, MASON_BIN_DIR: record.bin, MASON_VERSION: version ?? "" } }
+      { stdio: "inherit", windowsHide: true, env: {
+        ...process.env,
+        MASON_HOME: home,
+        MASON_BIN_DIR: record.bin,
+        MASON_RELEASE_BASE: process.env.MASON_RELEASE_BASE || record.updates?.mirror || "",
+        MASON_VERSION: version ?? "",
+        MASON_UPDATE_POLICY_REVISION: "",
+        MASON_EXPECTED_SHA256: ""
+      } }
     );
     child.on("error", reject);
     child.on("exit", (code) => resolve(code ?? 2));
@@ -6175,7 +6613,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs22.readFile(file, "utf8").catch((error) => {
+      const actual = await fs27.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -6183,12 +6621,12 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs22.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs27.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs22.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs27.rm(home, { recursive: true, force: true });
   return home;
 }
-var recordSchema3, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
+var shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames;
 var init_install2 = __esm({
   "src/distribution/install.ts"() {
     "use strict";
@@ -6196,21 +6634,254 @@ var init_install2 = __esm({
     init_storage();
     init_store();
     init_path();
-    recordSchema3 = z25.object({
-      format: z25.literal(1),
-      home: z25.string(),
-      bin: z25.string(),
-      current: z25.string().regex(/^[a-f0-9]{24}$/),
-      version: z25.string(),
-      launchers: z25.record(z25.string()),
-      previousLaunchers: z25.record(z25.string()).optional(),
-      pathChanges: z25.array(pathChangeSchema).optional()
-    });
+    init_state();
+    init_sessions();
+    init_state();
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path28.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path28.join(os4.homedir(), ".local/share/mason"));
+  }
+});
+
+// src/distribution/updates.ts
+var updates_exports = {};
+__export(updates_exports, {
+  CHECK_INTERVAL_MS: () => CHECK_INTERVAL_MS,
+  RELEASE_AGE_MS: () => RELEASE_AGE_MS,
+  fetchVerifiedRelease: () => fetchVerifiedRelease,
+  runAutomaticUpdate: () => runAutomaticUpdate,
+  scheduleAutomaticUpdate: () => scheduleAutomaticUpdate,
+  startMcpWithUpdates: () => startMcpWithUpdates,
+  updateManifestSchema: () => updateManifestSchema,
+  updateSettings: () => updateSettings,
+  updateStatus: () => updateStatus
+});
+import fs28 from "fs/promises";
+import path33 from "path";
+import { spawn as spawn2 } from "child_process";
+import { randomUUID as randomUUID11 } from "crypto";
+import { z as z28 } from "zod";
+async function boundedDownload(url) {
+  const response = await fetch(url, { signal: AbortSignal.timeout(15e3), redirect: "follow" });
+  if (!response.ok || !response.body) throw new Error(`Update metadata request failed (HTTP ${response.status}).`);
+  if (Number(response.headers.get("content-length")) > 1024 * 1024) throw new Error("Update metadata is too large.");
+  const reader = response.body.getReader(), chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > 1024 * 1024) throw new Error("Update metadata is too large.");
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel();
+  }
+  return Buffer.concat(chunks);
+}
+async function fetchVerifiedRelease(home, now = Date.now()) {
+  const releases = releaseListSchema.parse(JSON.parse((await boundedDownload("https://api.github.com/repos/adrianczuczka/mason/releases?per_page=30")).toString("utf8")));
+  const installed = (await readInstallation(home)).version;
+  let selected;
+  for (const release of releases) {
+    const version = release.tag_name.replace(/^v/, "");
+    if (release.tag_name !== "v" + version || release.draft || release.prerelease || !release.published_at || !(now - Date.parse(release.published_at) >= RELEASE_AGE_MS) || !newerStableVersion(version, installed)) continue;
+    if (!selected || newerStableVersion(version, selected)) selected = version;
+  }
+  if (!selected) return null;
+  const bytes = await boundedDownload(`${releaseBase}/download/v${selected}/update.json`);
+  const manifest = updateManifestSchema.parse(JSON.parse(bytes.toString("utf8")));
+  if (manifest.version !== selected) throw new Error("Signed manifest does not match the selected release.");
+  const signature = JSON.parse((await boundedDownload(`${releaseBase}/download/v${manifest.version}/update.sigstore.json`)).toString("utf8"));
+  if (!signature?.messageSignature || signature.dsseEnvelope) throw new Error("Update metadata requires a detached message signature.");
+  const { verify } = await import("sigstore");
+  await verify(signature, bytes, {
+    certificateIdentityURI: `https://github.com/adrianczuczka/mason/.github/workflows/publish.yml@refs/tags/v${manifest.version}`,
+    certificateIssuer: "https://token.actions.githubusercontent.com",
+    tufCachePath: await storePath(home, "sigstore-cache"),
+    timeout: 1e4,
+    retry: 0,
+    ctLogThreshold: 1,
+    tlogThreshold: 1
+  });
+  return manifest;
+}
+async function runInstaller(home, version, digest3, revision) {
+  const record = await readInstallation(home);
+  const bundle = await storePath(home, "versions/" + record.current);
+  await verifyBundle(bundle);
+  const windows = process.platform === "win32", script = path33.join(bundle, windows ? "install.ps1" : "install.sh");
+  await new Promise((resolve, reject) => {
+    const child = spawn2(windows ? "powershell.exe" : "sh", windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script], {
+      cwd: home,
+      windowsHide: true,
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: 10 * 60 * 1e3,
+      env: {
+        ...process.env,
+        MASON_HOME: home,
+        MASON_BIN_DIR: record.bin,
+        MASON_VERSION: version,
+        MASON_RELEASE_BASE: "",
+        MASON_EXPECTED_SHA256: digest3,
+        MASON_UPDATE_POLICY_REVISION: revision
+      }
+    });
+    let diagnostic = "";
+    child.stderr.on("data", (bytes) => {
+      diagnostic = (diagnostic + bytes).slice(-4e3);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`Update download failed (${code}): ${diagnostic.trim()}`)));
+  });
+}
+async function runAutomaticUpdate(home, dependencies = { fetchRelease: fetchVerifiedRelease, install: runInstaller }, now = Date.now()) {
+  await withLock(home, ".update-lock", async () => {
+    const record = await readInstallation(home);
+    if (!automaticUpdatesAllowed(record)) return;
+    const old = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    if (old.success && now - old.data.lastAttempt < CHECK_INTERVAL_MS && old.data.lastAttempt <= now) return;
+    const status = { lastAttempt: now };
+    await writeStoreJson(home, "update-status.json", status);
+    try {
+      await pruneUnusedVersions(home).catch(() => {
+      });
+      const release = await dependencies.fetchRelease(home);
+      if (!release) return;
+      status.availableVersion = release.version;
+      const age = now - Date.parse(release.publishedAt);
+      if (age >= RELEASE_AGE_MS && newerStableVersion(release.version, record.version) && (!record.pending || newerStableVersion(release.version, record.pending.version))) {
+        const asset = `mason-${process.platform}-${process.arch}.${process.platform === "win32" ? "zip" : "tar.gz"}`;
+        const digest3 = release.assets[asset];
+        if (!digest3) throw new Error("Signed release has no archive for this platform.");
+        const fresh = await readInstallation(home);
+        if (automaticUpdatesAllowed(fresh) && fresh.updates?.revision === record.updates.revision && newerStableVersion(release.version, fresh.version)) {
+          await dependencies.install(home, release.version, digest3, record.updates.revision);
+        }
+      }
+    } catch (error) {
+      status.error = error instanceof Error ? error.message : String(error);
+    }
+    if (await fs28.access(path33.join(home, "install.json")).then(() => true, () => false)) await writeStoreJson(home, "update-status.json", status);
+  }, 0);
+}
+async function scheduleAutomaticUpdate() {
+  try {
+    const { home, record } = await currentInstallation();
+    if (!automaticUpdatesAllowed(record)) return;
+    const status = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    const now = Date.now();
+    if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
+    const bundle = await storePath(home, "versions/" + record.current);
+    const child = spawn2(
+      path33.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path33.join(bundle, "app/dist/mason.js"), "internal-update"],
+      { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
+    );
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function updateSettings(home, action) {
+  return withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    const updates = { ...record.updates ?? { enabled: false }, revision: randomUUID11() };
+    if (action === "enable") updates.enabled = true;
+    if (action === "disable") updates.enabled = false;
+    if (action === "pin") updates.pinnedVersion = record.version;
+    if (action === "unpin") delete updates.pinnedVersion;
+    record.updates = updates;
+    delete record.pending;
+    await writeStoreJson(home, "install.json", record);
+    return record;
+  });
+}
+async function updateStatus(home) {
+  const record = await readInstallation(home);
+  const lastCheck = statusSchema2.parse(await readStoreJson(home, "update-status.json") ?? { lastAttempt: 0 });
+  return {
+    version: record.version,
+    enabled: record.updates?.enabled ?? false,
+    effective: automaticUpdatesAllowed(record),
+    pinnedVersion: record.updates?.pinnedVersion ?? null,
+    mirror: record.updates?.mirror ?? null,
+    pendingVersion: record.pending?.version ?? null,
+    lastCheck: lastCheck.lastAttempt ? lastCheck : null
+  };
+}
+async function startMcpWithUpdates(start) {
+  const current = standaloneLocation();
+  if (!current) {
+    await start();
+    return;
+  }
+  const session = await prepareStandaloneMcp(current.home);
+  if (session.bundle !== current.bundle) {
+    const child = spawn2(
+      path33.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path33.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      { stdio: "inherit", windowsHide: true }
+    );
+    const interrupt = () => {
+      child.kill("SIGINT");
+    }, terminate = () => {
+      child.kill("SIGTERM");
+    };
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    try {
+      process.exitCode = await new Promise((resolve, reject) => {
+        child.on("error", reject);
+        child.on("exit", (code) => resolve(code ?? 1));
+      });
+    } finally {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+      await session.release();
+    }
+    return;
+  }
+  const timer = setInterval(() => {
+    void scheduleAutomaticUpdate();
+  }, 60 * 60 * 1e3);
+  timer.unref();
+  const stop = () => {
+    clearInterval(timer);
+    void session?.release();
+  };
+  try {
+    await start(stop);
+    void scheduleAutomaticUpdate();
+  } catch (error) {
+    stop();
+    throw error;
+  }
+}
+var CHECK_INTERVAL_MS, RELEASE_AGE_MS, releaseBase, releaseListSchema, updateManifestSchema, statusSchema2;
+var init_updates = __esm({
+  "src/distribution/updates.ts"() {
+    "use strict";
+    init_store();
+    init_storage();
+    init_state();
+    init_bundle();
+    init_runtime2();
+    init_install2();
+    CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+    RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
+    releaseBase = "https://github.com/adrianczuczka/mason/releases";
+    releaseListSchema = z28.array(z28.object({ tag_name: z28.string(), draft: z28.boolean(), prerelease: z28.boolean(), published_at: z28.string().nullable() }));
+    updateManifestSchema = z28.object({
+      format: z28.literal(1),
+      version: z28.string().regex(/^\d+\.\d+\.\d+$/),
+      publishedAt: z28.string().datetime(),
+      assets: z28.record(z28.string().regex(/^[a-f0-9]{64}$/))
+    }).strict();
+    statusSchema2 = z28.object({ lastAttempt: z28.number(), availableVersion: z28.string().optional(), error: z28.string().optional() });
   }
 });
 
@@ -6407,7 +7078,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.17.4"}
+var usage = `Mason ${"0.19.0"}
 
 Usage: mason <command> [options]
 
@@ -6420,6 +7091,9 @@ Usage: mason <command> [options]
   drift                      Check an optional architecture map
   mcp                        Run the MCP server (stdio)
   upgrade [version]          Upgrade the standalone user installation
+  updates [status|enable|disable|pin|unpin]
+                             Manage automatic standalone updates
+  rollback                   Restore and pin the previous standalone version
   uninstall                  Remove that installation; retain project data
 
 Use mason <command> --help for options. npm users can keep using mason-auto,
@@ -6433,19 +7107,67 @@ try {
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.4" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.0" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.17.4");
-  else if (command === "internal-install") {
+  else if (["--version", "-v"].includes(command)) console.log("0.19.0");
+  else if (command === "internal-update") {
+    if (args.length) throw new Error("internal-update takes no arguments.");
+    const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
+    const { runAutomaticUpdate: runAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+    await runAutomaticUpdate2((await currentInstallation2()).home);
+  } else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
     const bundleRoot = fileURLToPath2(new URL("../..", import.meta.url));
     progress = createProgress();
-    const installed = await installStandalone2(bundleRoot, progress);
+    const policyRevision = process.env.MASON_UPDATE_POLICY_REVISION;
+    if (policyRevision && !/^[a-f0-9]{64}$/.test(process.env.MASON_EXPECTED_SHA256 ?? "")) throw new Error("Automatic staging requires a verified release checksum.");
+    const installed = await installStandalone2(bundleRoot, progress, { stageOnly: !!policyRevision, policyRevision });
     progress.stop();
     const outcome = installed.previousVersion && installed.previousVersion !== installed.version ? `Updated Mason ${installed.previousVersion} \u2192 ${installed.version}` : `Installed Mason ${installed.version}`;
-    console.log(`${outcome} in ${installed.home}.
-${installed.path.message}`);
+    if (policyRevision) console.log(`Staged Mason ${installed.version}. It will activate at a future MCP launch after existing servers exit.`);
+    else {
+      const { updateStatus: updateStatus2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      const status = await updateStatus2(installed.home);
+      const policy = status.pinnedVersion ? `pinned to ${status.pinnedVersion}` : status.mirror ? "managed by your mirror" : status.enabled ? "enabled" : "disabled";
+      console.log(`${outcome} in ${installed.home}.
+${installed.path.message}
+Automatic updates: ${policy}. Manage with mason updates.`);
+    }
+  } else if (command === "updates") {
+    if (args.includes("--help")) console.log("Usage: mason updates [status|enable|disable|pin|unpin] [--json]. Pin holds the installed version; mason upgrade <version> installs and pins a specific release. Environment and mirror restrictions still apply.");
+    else {
+      const action = args.filter((arg) => arg !== "--json")[0] ?? "status";
+      if (args.filter((arg) => arg !== "--json").length > 1 || !["status", "enable", "disable", "pin", "unpin"].includes(action)) throw new Error("Usage: mason updates [status|enable|disable|pin|unpin] [--json]");
+      const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
+      const { updateSettings: updateSettings2, updateStatus: updateStatus2, scheduleAutomaticUpdate: scheduleAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      const { home } = await currentInstallation2();
+      if (action !== "status") await updateSettings2(home, action);
+      const status = await updateStatus2(home);
+      if (args.includes("--json")) console.log(JSON.stringify(status));
+      else {
+        console.log(`Mason ${status.version}
+Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${status.enabled ? "enabled" : "disabled"}).`);
+        if (status.pinnedVersion) console.log(`Pinned to ${status.pinnedVersion}. Run mason updates unpin to follow stable releases.`);
+        if (status.mirror) console.log("Company mirror installation: automatic public updates are disabled.");
+        if (!status.effective && status.enabled && !status.pinnedVersion && !status.mirror) console.log("Suppressed by CI, MASON_NO_AUTO_UPDATE, MASON_VERSION, or MASON_RELEASE_BASE.");
+        if (status.pendingVersion) console.log(`Downloaded ${status.pendingVersion}; activates on a future MCP launch after existing servers exit.`);
+        if (status.lastCheck) {
+          console.log(`Last check: ${new Date(status.lastCheck.lastAttempt).toISOString()}`);
+          if (status.lastCheck.availableVersion) console.log(`Available stable release: ${status.lastCheck.availableVersion}`);
+          if (status.lastCheck.error) console.log(`Last update problem: ${status.lastCheck.error}`);
+        }
+      }
+      if (action === "enable" || action === "unpin") void scheduleAutomaticUpdate2();
+    }
+  } else if (command === "rollback") {
+    if (args.includes("--help")) console.log("Usage: mason rollback. Close running Mason MCP servers, then restore and pin the previous installed version.");
+    else {
+      if (args.length) throw new Error("rollback takes no arguments.");
+      const { rollbackStandalone: rollbackStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
+      const restored = await rollbackStandalone2();
+      console.log(`Restored Mason ${restored.version} and pinned it. Run mason updates unpin to resume automatic updates.`);
+    }
   } else if (command === "upgrade" || command === "uninstall") {
     if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Configured projects use the upgraded command on their next launch. Restart running assistants." : "Usage: mason uninstall. Removes the standalone user installation; project configuration and knowledge are retained. Run mason teardown in each project first to disconnect its integrations.");
     else {
@@ -6470,6 +7192,10 @@ ${installed.path.message}`);
       void 0,
       { managedHost: managedLaunch ? setupHost : void 0 }
     );
+    if (command === "setup" && process.exitCode === 0 && !args.includes("--help")) {
+      const { scheduleAutomaticUpdate: scheduleAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      void scheduleAutomaticUpdate2();
+    }
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
     process.argv = [process.execPath, fileURLToPath2(binary), ...args];