mason-context 0.18.0 → 0.19.0

package/dist/mason-mcp.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -61,19 +62,19 @@ var init_git_read = __esm({
 import path from "path";
 function splitCommands(line) {
   const parts = [];
-  let quote = "", start = 0;
+  let quote2 = "", start = 0;
   for (let i = 0; i < line.length; i++) {
     const char = line[i];
     if (char === "\\") {
       i++;
       continue;
     }
-    if (quote) {
-      if (char === quote) quote = "";
+    if (quote2) {
+      if (char === quote2) quote2 = "";
       continue;
     }
     if (char === "'" || char === '"') {
-      quote = char;
+      quote2 = char;
       continue;
     }
     if (char === ";" || line.slice(i, i + 2) === "&&") {
@@ -2134,6 +2135,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content2) {
+  const text2 = content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -2160,6 +2165,19 @@ async function checkDepsChanged(ctx) {
         reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
       });
     }
+    let content2 = doc.content;
+    if (doc.dirty) {
+      try {
+        content2 = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
+    }
+    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2205,6 +2223,7 @@ var init_deps_changed = __esm({
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -3567,7 +3586,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -3758,7 +3777,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [5, engineVersion, head, shallow, replacements, docContents];
+  const common = [6, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3818,7 +3837,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.18.0" : "development";
+    engineVersion = true ? "0.19.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3828,18 +3847,49 @@ var init_evidence = __esm({
 // src/setup/model.ts
 var model_exports = {};
 __export(model_exports, {
+  INACTIVE_HOSTS_PATH: () => INACTIVE_HOSTS_PATH,
   SETUP_PATH: () => SETUP_PATH,
+  effectiveSetup: () => effectiveSetup,
+  inactiveHostsSchema: () => inactiveHostsSchema,
   loadSetup: () => loadSetup,
   loadSetupReceipt: () => loadSetupReceipt,
   setupHostSchema: () => setupHostSchema,
   setupSchema: () => setupSchema
 });
 import { z as z9 } from "zod";
+import fs14 from "fs/promises";
+import path22 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
+async function effectiveSetup(root) {
+  const local = await loadSetup(root);
+  if (local) return { root, setup: local };
+  const common = await fs14.realpath(path22.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const own = await fs14.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  if (common === own) return { root, setup: null };
+  const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
+  const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
+  if (!candidate || primary.includes("bare")) return { root, setup: null };
+  let inheritedRoot;
+  try {
+    inheritedRoot = await fs14.realpath((await git3(candidate, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
+    throw error;
+  }
+  const inheritedCommon = await fs14.realpath(path22.resolve(
+    inheritedRoot,
+    (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
+  ));
+  if (inheritedCommon !== common) throw new Error("Linked worktree setup does not belong to the same Git repository.");
+  const setup = await loadSetup(inheritedRoot);
+  const inactive = await readStoreJson(root, INACTIVE_HOSTS_PATH);
+  if (inactive && setup) for (const host of inactiveHostsSchema.parse(inactive).hosts) delete setup.hosts[host];
+  return { root: inheritedRoot, setup };
+}
 async function loadSetupReceipt(root, directory, host) {
   const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
   if (raw === null) return null;
@@ -3847,10 +3897,11 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, INACTIVE_HOSTS_PATH, inactiveHostsSchema, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
+    init_evidence();
     init_storage();
     setupHostSchema = z9.object({
       configuredVersion: z9.string(),
@@ -3864,6 +3915,8 @@ var init_model = __esm({
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
+    INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
+    inactiveHostsSchema = z9.object({ version: z9.literal(1), hosts: z9.array(z9.enum(["claude", "codex"])) });
     receiptSchema = z9.object({
       version: z9.literal(1),
       host: z9.enum(["codex", "claude"]),
@@ -3880,7 +3933,7 @@ var init_model = __esm({
 // src/setup/launcher.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs14 from "fs/promises";
+import fs15 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
 }
@@ -3910,7 +3963,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.18.0" : "development";
+    executingVersion = () => true ? "0.19.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4035,8 +4088,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs17 from "fs/promises";
-import path25 from "path";
+import fs18 from "fs/promises";
+import path26 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4065,14 +4118,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs17.unlink(file2);
+    await fs18.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
+  const temporary = path26.join(path26.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
   try {
-    const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs17.open(temporary, "wx", mode);
+    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs18.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -4080,10 +4133,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs17.rename(temporary, file);
+    await fs18.rename(temporary, file);
     return true;
   } finally {
-    await fs17.rm(temporary, { force: true });
+    await fs18.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4105,7 +4158,7 @@ __export(execution_exports, {
   recordExecution: () => recordExecution
 });
 import os2 from "os";
-import fs18 from "fs/promises";
+import fs19 from "fs/promises";
 import { randomUUID as randomUUID4 } from "crypto";
 import { z as z12 } from "zod";
 function parseExecution(raw) {
@@ -4233,7 +4286,7 @@ async function recordExecution(root, directory, event, run) {
       throw Object.assign(new Error(failure.message, { cause: error }), { failure });
     }
   } finally {
-    await fs18.rm(await storePath(root, owner), { force: true }).catch(() => {
+    await fs19.rm(await storePath(root, owner), { force: true }).catch(() => {
     });
   }
 }
@@ -4317,13 +4370,17 @@ async function observeReadOnlyTool(dir, event) {
 }
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
+  const onlyReview = report.status === "incomplete" && !report.diagnostics.length && !report.counts.unresolved && !report.counts.unverified && report.counts["review-required"] > 0;
   return [
-    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
-    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    onlyReview ? `Mason: ${report.counts["review-required"]} advisor${report.counts["review-required"] === 1 ? "y" : "ies"} awaiting review; no unresolved issues.` : `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => {
+      const detail = f.current ? f.current.message : f.status === "review-required" ? `${f.original.type}: current check no longer reports ${f.original.type === "deps-changed" ? "this condition" : "the original finding"}; historical evidence awaits assessment.` : `Original evidence: ${f.original.message}. ${f.reason}`;
+      return `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(detail)}`;
+    }),
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -4547,7 +4604,7 @@ async function automate(dir, event) {
         if (event.event === "after_tool" && event.mutating) {
           session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
-            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
           }
           if (event.toolId) delete session.pending[event.toolId];
@@ -4656,8 +4713,8 @@ var init_runtime = __esm({
 });
 
 // src/automation/hook-root.ts
-import fs19 from "fs/promises";
-import path26 from "path";
+import fs20 from "fs/promises";
+import path27 from "path";
 var init_hook_root = __esm({
   "src/automation/hook-root.ts"() {
     "use strict";
@@ -5500,10 +5557,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path27 from "path";
+import path28 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
+  const relative = path28.isAbsolute(file) ? path28.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5600,7 +5657,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path28.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5721,8 +5778,8 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs20 from "fs/promises";
-import path28 from "path";
+import fs21 from "fs/promises";
+import path29 from "path";
 import { execFile as execFile7 } from "child_process";
 import { promisify as promisify7 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5751,7 +5808,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path28.resolve(rootDir);
+  const resolvedRoot = path29.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5801,7 +5858,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs20.access(path28.join(resolvedRoot, relPath));
+        await fs21.access(path29.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5936,7 +5993,7 @@ var init_onboarding = __esm({
 });
 
 // src/impact/references.ts
-import path29 from "path";
+import path30 from "path";
 function templateEnd(content2, start) {
   let i = start + 1, interpolation = 0;
   while (i < content2.length) {
@@ -5958,10 +6015,10 @@ function templateEnd(content2, start) {
         continue;
       }
       if (c === '"' || c === "'") {
-        const quote = c;
+        const quote2 = c;
         for (i++; i < content2.length; i++) {
           if (content2[i] === "\\") i++;
-          else if (content2[i] === quote) {
+          else if (content2[i] === quote2) {
             i++;
             break;
           }
@@ -6062,10 +6119,10 @@ function jvmImports(content2) {
 }
 function resolveImport(file, specifier, available) {
   if (!specifier.startsWith("./") && !specifier.startsWith("../")) return null;
-  const relative = path29.posix.normalize(path29.posix.join(path29.posix.dirname(file), specifier));
+  const relative = path30.posix.normalize(path30.posix.join(path30.posix.dirname(file), specifier));
   if (relative.startsWith("../")) return null;
   if (available.has(relative)) return relative;
-  const ext = path29.posix.extname(relative);
+  const ext = path30.posix.extname(relative);
   const replacements = { ".js": [".ts", ".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
   const candidates = ext ? (replacements[ext] ?? []).map((e) => relative.slice(0, -ext.length) + e) : jsExtensions.flatMap((e) => [relative + e, relative + "/index" + e]);
   const found = candidates.filter((f) => available.has(f));
@@ -6074,23 +6131,23 @@ function resolveImport(file, specifier, available) {
 function mentionsPath(content2, target) {
   return new RegExp(`(?<![\\w./\\\\-])(?:\\./)?${escape(target)}(?![\\w./\\\\-])`).test(content2);
 }
-function createReferenceMatcher(targets, available, targetContents = /* @__PURE__ */ new Map()) {
+function createReferenceMatcher(targets2, available, targetContents = /* @__PURE__ */ new Map()) {
   const counts = /* @__PURE__ */ new Map();
   for (const file of available) {
-    const name = path29.posix.basename(file, path29.posix.extname(file));
+    const name = path30.posix.basename(file, path30.posix.extname(file));
     counts.set(name, (counts.get(name) ?? 0) + 1);
   }
   const jvmTargets = new Map([...targetContents].filter(([file]) => /\.(?:kt|kts|java)$/.test(file)).map(([file, content2]) => [file, declaredSymbols(content2)]));
   return (source) => {
-    if (targets.includes(source.path)) return [];
-    const resolved = new Set(jsExtensions.includes(path29.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
+    if (targets2.includes(source.path)) return [];
+    const resolved = new Set(jsExtensions.includes(path30.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
     if (/\.(?:kt|kts|java)$/.test(source.path)) {
       const imported = jvmImports(source.content);
       for (const [target, symbols] of jvmTargets) if (symbols.some((symbol) => imported.some((name) => name === symbol || name.startsWith(symbol + ".")))) resolved.add(target);
     }
     const groups = /* @__PURE__ */ new Map();
     const add = (evidence, match) => groups.set(evidence, [...groups.get(evidence) ?? [], match]);
-    for (const target of targets) {
+    for (const target of targets2) {
       if (resolved.has(target)) {
         add("resolved-import", target);
         continue;
@@ -6099,7 +6156,7 @@ function createReferenceMatcher(targets, available, targetContents = /* @__PURE_
         add("explicit-path", target);
         continue;
       }
-      const ext = path29.posix.extname(target), name = path29.posix.basename(target, ext);
+      const ext = path30.posix.extname(target), name = path30.posix.basename(target, ext);
       if (!/\.(?:[cm]?[jt]sx?|py|kt|java|go|rs|swift|rb|cs|cpp|c|h|hpp|dart|php)$/.test(ext) || name.startsWith(".") || name.length < 3 || genericNames.has(name.toLowerCase()) || counts.get(name) !== 1) continue;
       if (word(name).test(source.content)) {
         add("name-candidate", name);
@@ -6128,11 +6185,11 @@ var impact_exports = {};
 __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
-import path30 from "path";
+import path31 from "path";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify8 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
-  const resolvedRoot = path30.resolve(rootDir);
+  const resolvedRoot = path31.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
   const [cochange, references, tests] = await Promise.all([
     getCochangeFiles(resolvedRoot, resolvedTargets),
@@ -6146,10 +6203,10 @@ async function analyzeImpact(rootDir, targetFiles) {
     tests
   };
 }
-async function resolveTargetFiles(rootDir, targets) {
+async function resolveTargetFiles(rootDir, targets2) {
   const resolved = [];
   const access = await createFileAccess(rootDir);
-  for (const target of targets) {
+  for (const target of targets2) {
     if (target.includes("/")) {
       const normalized = normalizeRepoPath(target);
       if (normalized) resolved.push(normalized);
@@ -6246,9 +6303,9 @@ async function getRelatedTests(rootDir, targetFiles) {
   const testFiles = await (await createFileAccess(rootDir)).list(testPatterns);
   const results = [];
   for (const target of targetFiles) {
-    const targetBaseName = path30.basename(target).replace(/\.[^.]+$/, "");
+    const targetBaseName = path31.basename(target).replace(/\.[^.]+$/, "");
     for (const testFile of testFiles) {
-      const testBaseName = path30.basename(testFile).replace(/\.[^.]+$/, "");
+      const testBaseName = path31.basename(testFile).replace(/\.[^.]+$/, "");
       const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
       if (sourceName === targetBaseName) {
         results.push({
@@ -6276,26 +6333,26 @@ var assemble_exports = {};
 __export(assemble_exports, {
   assembleContext: () => assembleContext
 });
-import path31 from "path";
-import fs21 from "fs/promises";
+import path32 from "path";
+import fs22 from "fs/promises";
 async function collectImpact(root, candidates) {
-  const targets = /* @__PURE__ */ new Set();
+  const targets2 = /* @__PURE__ */ new Set();
   let sourceFiles;
   for (const candidate of sanitizeRepoPaths(candidates)) {
-    const stat = await fs21.stat(path31.join(root, candidate)).catch(() => null);
+    const stat = await fs22.stat(path32.join(root, candidate)).catch(() => null);
     if (stat?.isDirectory()) {
       sourceFiles ??= await (await createFileAccess(root)).list();
       for (const file of sourceFiles) {
-        if (anchorMatches(candidate, file)) targets.add(file);
-        if (targets.size >= MAX_IMPACT_TARGETS) break;
+        if (anchorMatches(candidate, file)) targets2.add(file);
+        if (targets2.size >= MAX_IMPACT_TARGETS) break;
       }
     } else {
-      targets.add(candidate);
+      targets2.add(candidate);
     }
-    if (targets.size >= MAX_IMPACT_TARGETS) break;
+    if (targets2.size >= MAX_IMPACT_TARGETS) break;
   }
-  if (!targets.size) return { impact: null, relatedTests: [] };
-  const result = await analyzeImpact(root, [...targets]);
+  if (!targets2.size) return { impact: null, relatedTests: [] };
+  const result = await analyzeImpact(root, [...targets2]);
   const referenceCandidatesOmitted = result.references.filter((r) => r.evidence === "name-candidate").length;
   return {
     impact: {
@@ -6308,7 +6365,7 @@ async function collectImpact(root, candidates) {
   };
 }
 async function assembleContext(rootDir, task, files) {
-  const resolvedRoot = path31.resolve(rootDir);
+  const resolvedRoot = path32.resolve(rootDir);
   const mapState = await inspectSnapshot(resolvedRoot);
   const snapshot = mapState.snapshot;
   const store = await loadDecisionStore(resolvedRoot);
@@ -6504,7 +6561,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs22 from "fs/promises";
+import fs23 from "fs/promises";
 import { z as z23 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -6521,15 +6578,15 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
     if (!revision) {
-      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+      if ((await effectiveSetup(process.env.MASON_SETUP_ROOT)).setup?.hosts[host]) {
         return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
       }
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs22.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs22.realpath(process.env.MASON_SETUP_ROOT)) return null;
-    const setup = await loadSetup(ws.root);
+    const ws = capturedDirectory ? { root: await fs23.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs23.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
     await withLock(ws.root, directory, async () => {
@@ -6603,8 +6660,9 @@ __export(status_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
-  const setup = await loadSetup(ws.root);
-  if (!setup) {
+  const activation = await effectiveSetup(ws.root);
+  const setup = activation.setup;
+  if (!setup || !Object.keys(setup.hosts).length) {
     const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
       host,
       receipt: await loadSetupReceipt(ws.root, ws.directory, host)
@@ -6638,7 +6696,7 @@ async function setupStatus(dir) {
     ]));
     const hooks = isDeepStrictEqual2(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
-    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
@@ -6670,6 +6728,7 @@ async function setupStatus(dir) {
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
     hosts,
+    activationRoot: activation.root,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -6677,6 +6736,9 @@ async function setupStatus(dir) {
 }
 function summarizeActivation(status) {
   const lines = ["Mason setup: " + status.status + "."];
+  if (status.activationRoot && status.activationRoot !== status.root) {
+    lines.push("Activation inherited from " + status.activationRoot + "; evidence belongs to this worktree.");
+  }
   for (const [host, state] of Object.entries(status.hosts)) {
     lines.push(
       `${host}: ${state.status}`,
@@ -6846,8 +6908,8 @@ __export(client_exports, {
 function createConfluenceClient(config, fetchFn = fetch) {
   const baseUrl = config.baseUrl.replace(/\/+$/, "");
   const auth = "Basic " + Buffer.from(`${config.email}:${config.apiToken}`).toString("base64");
-  async function call(method, path35, body) {
-    const res = await fetchFn(`${baseUrl}${path35}`, {
+  async function call(method, path42, body) {
+    const res = await fetchFn(`${baseUrl}${path42}`, {
       method,
       headers: {
         Authorization: auth,
@@ -6859,7 +6921,7 @@ function createConfluenceClient(config, fetchFn = fetch) {
     if (!res.ok) {
       const text2 = await res.text();
       throw new Error(
-        `Confluence ${method} ${path35} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
+        `Confluence ${method} ${path42} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
       );
     }
     if (res.status === 204) return null;
@@ -6960,28 +7022,28 @@ __export(config_exports2, {
   saveConfluenceConfig: () => saveConfluenceConfig,
   validateProvider: () => validateProvider
 });
-import fs23 from "fs/promises";
-import path32 from "path";
+import fs24 from "fs/promises";
+import path33 from "path";
 import os3 from "os";
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
 function configDir() {
-  return path32.join(os3.homedir(), ".mason");
+  return path33.join(os3.homedir(), ".mason");
 }
 function configFile() {
-  return path32.join(configDir(), "config.json");
+  return path33.join(configDir(), "config.json");
 }
 async function loadConfig() {
   try {
-    const raw = await fs23.readFile(configFile(), "utf-8");
+    const raw = await fs24.readFile(configFile(), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 async function saveConfig(config) {
-  await fs23.mkdir(configDir(), { recursive: true });
-  await fs23.writeFile(configFile(), JSON.stringify(config, null, 2), "utf-8");
+  await fs24.mkdir(configDir(), { recursive: true });
+  await fs24.writeFile(configFile(), JSON.stringify(config, null, 2), "utf-8");
 }
 function getDefaultModel(provider) {
   return DEFAULT_MODELS[provider];
@@ -7141,21 +7203,21 @@ var init_renderer = __esm({
 });
 
 // src/confluence/diff.ts
-import fs24 from "fs/promises";
-import path33 from "path";
+import fs25 from "fs/promises";
+import path34 from "path";
 import { createHash as createHash6 } from "crypto";
 function hashDescription(description) {
   return createHash6("sha256").update(description, "utf8").digest("hex");
 }
 function syncStateDir(rootDir) {
-  return path33.join(rootDir, ".mason");
+  return path34.join(rootDir, ".mason");
 }
 function syncStatePath(rootDir) {
-  return path33.join(syncStateDir(rootDir), "confluence-sync.json");
+  return path34.join(syncStateDir(rootDir), "confluence-sync.json");
 }
 async function loadSyncState(rootDir) {
   try {
-    const raw = await fs24.readFile(syncStatePath(rootDir), "utf-8");
+    const raw = await fs25.readFile(syncStatePath(rootDir), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 2) return null;
     return parsed;
@@ -7164,8 +7226,8 @@ async function loadSyncState(rootDir) {
   }
 }
 async function saveSyncState(rootDir, state) {
-  await fs24.mkdir(syncStateDir(rootDir), { recursive: true });
-  await fs24.writeFile(
+  await fs25.mkdir(syncStateDir(rootDir), { recursive: true });
+  await fs25.writeFile(
     syncStatePath(rootDir),
     JSON.stringify(state, null, 2),
     "utf-8"
@@ -7723,8 +7785,8 @@ import { z as z24 } from "zod";
 // src/mcp/tools.ts
 init_repair();
 init_advisory_review();
-import fs25 from "fs/promises";
-import path34 from "path";
+import fs26 from "fs/promises";
+import path35 from "path";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify11 } from "util";
 
@@ -7733,11 +7795,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path23 from "path";
+import path24 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path22 from "path";
+import path23 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/audit/cli.ts
@@ -7834,7 +7896,7 @@ import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
 // src/analyzers/base.ts
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 import fg6 from "fast-glob";
 var BaseAnalyzer = class {
   async findFiles(patterns, root) {
@@ -7845,7 +7907,7 @@ var BaseAnalyzer = class {
     });
   }
   async readFile(filePath) {
-    return fs15.readFile(filePath, "utf-8");
+    return fs16.readFile(filePath, "utf-8");
   }
   createFinding(partial) {
     return {
@@ -8050,7 +8112,7 @@ async function isGitRepo(dir) {
 
 // src/mcp/sampler.ts
 init_files();
-import path24 from "path";
+import path25 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 var exec2 = promisify4(execFile4);
@@ -8158,8 +8220,8 @@ async function sampleFiles(rootDir, maxFiles = 25) {
   const projectConfig = access.config;
   for (const filePath of projectConfig.alwaysInclude ?? []) {
     if (selected.size >= maxFiles) break;
-    const resolvedPath = path24.resolve(rootDir, filePath);
-    if (!resolvedPath.startsWith(path24.resolve(rootDir))) continue;
+    const resolvedPath = path25.resolve(rootDir, filePath);
+    if (!resolvedPath.startsWith(path25.resolve(rootDir))) continue;
     selected.set(filePath, "always-include (project config)");
   }
   let configCount = 0;
@@ -8225,7 +8287,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
       if (!line) continue;
       if (line.includes("node_modules") || line.includes("/build/") || line.includes(".gradle") || line.includes("/generated/"))
         continue;
-      const ext = path24.extname(line).slice(1);
+      const ext = path25.extname(line).slice(1);
       if (!SOURCE_EXTENSIONS.includes(ext)) continue;
       fileCounts.set(line, (fileCounts.get(line) ?? 0) + 1);
     }
@@ -8580,7 +8642,7 @@ ${JSON.stringify({ partials }, null, 2)}`;
 init_lock();
 init_storage();
 init_snapshot();
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { z as z11 } from "zod";
 var DIRECTORY = ".mason/partial-snapshots";
 var partialSchema = z11.object({
@@ -8598,7 +8660,7 @@ async function savePartial(rootDir, partial) {
 async function loadAllPartials(rootDir) {
   let entries;
   try {
-    entries = await fs16.readdir(await storePath(rootDir, DIRECTORY));
+    entries = await fs17.readdir(await storePath(rootDir, DIRECTORY));
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -8621,11 +8683,11 @@ async function loadScope(rootDir) {
 }
 async function clearScope(rootDir) {
   await withSnapshotWrite(rootDir, async () => {
-    await fs16.rm(await storePath(rootDir, `${DIRECTORY}/scope.json`), { force: true });
+    await fs17.rm(await storePath(rootDir, `${DIRECTORY}/scope.json`), { force: true });
   });
 }
 async function clearAllPartials(rootDir) {
-  await fs16.rm(await storePath(rootDir, DIRECTORY), { recursive: true, force: true });
+  await fs17.rm(await storePath(rootDir, DIRECTORY), { recursive: true, force: true });
 }
 function batchIdFor(offset) {
   return `batch-${String(offset).padStart(6, "0")}`;
@@ -8642,7 +8704,7 @@ async function buildContext(dir) {
   };
 }
 async function analyzeProject(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const context = await buildContext(rootDir);
   const results = await runAll(context);
   const projectSnapshot = await detectProjectSnapshot(rootDir);
@@ -8697,7 +8759,7 @@ async function detectProjectSnapshot(rootDir) {
   const present = [];
   for (const file of buildFiles) {
     try {
-      await fs25.access(path34.join(rootDir, file));
+      await fs26.access(path35.join(rootDir, file));
       present.push(file);
     } catch {
     }
@@ -8739,7 +8801,7 @@ async function detectProjectSnapshot(rootDir) {
   const sourceFiles = await access.list();
   const fileCounts = {};
   for (const file of sourceFiles) {
-    const ext = path34.extname(file).slice(1);
+    const ext = path35.extname(file).slice(1);
     fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
   }
   return {
@@ -8750,7 +8812,7 @@ async function detectProjectSnapshot(rootDir) {
   };
 }
 async function getCodeSamples(dir, count4 = 15) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const samples = await sampleFiles(rootDir, count4);
   const output = {
     note: "These are previews (first ~60 lines). Read the file directly with your own tools to see it in full.",
@@ -8793,7 +8855,7 @@ async function unmappedContextResponse(rootDir) {
   });
 }
 async function getProjectStructure(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const allFiles = await (await createFileAccess(rootDir)).list("**/*");
   const dirInfo = /* @__PURE__ */ new Map();
   for (const file of allFiles) {
@@ -8805,7 +8867,7 @@ async function getProjectStructure(dir) {
       }
       const info = dirInfo.get(dirPath);
       info.fileCount++;
-      const ext = path34.extname(file).slice(1);
+      const ext = path35.extname(file).slice(1);
       if (ext) {
         info.extensions.set(ext, (info.extensions.get(ext) ?? 0) + 1);
       }
@@ -8850,7 +8912,7 @@ async function buildChangedFilePreviews(rootDir, changedFiles) {
   return previews2;
 }
 async function getSnapshot(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return unmappedContextResponse(rootDir);
@@ -8951,7 +9013,7 @@ function driftHint(report) {
   return "Read the changed files under staleFeatures/staleFlows, update those entries (fold unmappedFiles into the right features), and call save_snapshot with only the affected entries \u2014 unchanged entries are preserved. Drop ghostFiles from any entries that reference them, and delete features/flows that no longer exist via save_snapshot's removeFeatures/removeFlows.";
 }
 async function checkDrift(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const report = await computeDrift(rootDir);
   if (!report) {
     return JSON.stringify({
@@ -8982,7 +9044,7 @@ async function checkDrift(dir) {
   return JSON.stringify({ exists: true, ...report, verification, hint });
 }
 async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_SIZE, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const scoped = files !== void 0 && files.length > 0;
   const scopeFiles = scoped ? sanitizePaths(rootDir, files) : void 0;
   const batch = await prepareSnapshotBatch(dir, offset, batchSize, scopeFiles);
@@ -9029,7 +9091,7 @@ async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_
   );
 }
 async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   for (const feat of Object.values(features)) {
     feat.files = sanitizePaths(rootDir, feat.files);
     if (feat.tests) feat.tests = sanitizePaths(rootDir, feat.tests);
@@ -9058,7 +9120,7 @@ async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
   );
 }
 async function reduceSnapshot(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const partials = await loadAllPartials(rootDir);
   if (partials.length === 0) {
     return JSON.stringify(
@@ -9120,7 +9182,7 @@ async function reduceSnapshot(dir) {
   );
 }
 async function fullAnalysis(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const [analysis, structure, samples, testMap, snapshot] = await Promise.all([
     analyzeProject(dir),
     getProjectStructure(dir),
@@ -9149,7 +9211,7 @@ function sanitizePaths(rootDir, files) {
   return sanitizeRepoPaths(files);
 }
 async function saveSnapshotData(dir, features, flows, removeFeatures = [], removeFlows = []) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   return updateSnapshot(rootDir, async (previous) => {
     const gitHash = await getCurrentGitHash(rootDir);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -9229,14 +9291,14 @@ async function saveSnapshotData(dir, features, flows, removeFeatures = [], remov
   });
 }
 async function getImpact(dir, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const { analyzeImpact: analyzeImpact2 } = await Promise.resolve().then(() => (init_impact(), impact_exports));
   const result = await analyzeImpact2(rootDir, files);
   return JSON.stringify(result, null, 2);
 }
 var VERIFY_DEFAULT_SAMPLE = 5;
 async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({
@@ -9289,7 +9351,7 @@ async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
   });
 }
 async function saveVerification(dir, verdicts) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   return updateSnapshot(rootDir, async (snapshot) => {
     if (!snapshot) {
       return { snapshot: null, result: JSON.stringify({ exists: false, stamped: [], hint: "No concept map exists. Build it and run verify_snapshot before recording verdicts." }) };
@@ -9363,16 +9425,16 @@ async function saveVerification(dir, verdicts) {
   });
 }
 async function saveDecision(dir, input) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const { upsertDecision: upsertDecision2 } = await Promise.resolve().then(() => (init_decisions(), decisions_exports));
   const result = await upsertDecision2(rootDir, input);
   return JSON.stringify(result);
 }
 async function reviewDecision2(dir, input) {
-  return JSON.stringify(await reviewDecision(path34.resolve(dir), input));
+  return JSON.stringify(await reviewDecision(path35.resolve(dir), input));
 }
 async function getContext(dir, task, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const { assembleContext: assembleContext2 } = await Promise.resolve().then(() => (init_assemble(), assemble_exports));
   const bundle = await assembleContext2(rootDir, task, files);
   return JSON.stringify(bundle);
@@ -9421,7 +9483,7 @@ async function masonInit(dir, options = {}) {
     return JSON.stringify(await setupProject2(dir, options), null, 2);
   }
   if (options.host) throw new Error("host applies only to mode: setup.");
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const marker = await loadProjectMarker(rootDir);
   const { loadSetup: loadSetup2 } = await Promise.resolve().then(() => (init_model(), model_exports));
   const setup = await loadSetup2(rootDir);
@@ -9441,7 +9503,7 @@ async function masonInit(dir, options = {}) {
   );
 }
 async function masonCompleteInit(dir, options = {}) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const existing = await loadProjectMarker(rootDir);
   const features = await loadProjectFeatures(rootDir);
   const marker = {
@@ -9550,7 +9612,7 @@ async function masonSetConfluence(input) {
   );
 }
 async function exportToConfluenceTool(dir, overrides) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path35.resolve(dir);
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
   const { exportToConfluence: exportToConfluence2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
   const config = await loadConfig2();
@@ -9589,7 +9651,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.18.0"
+      version: "0.19.0"
     },
     {
       instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, stale or unknown map verification needs a fresh review, recorded failed verdicts need correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'
@@ -9970,14 +10032,592 @@ function createMcpServer() {
   );
   return server;
 }
-async function startMcpServer() {
+async function startMcpServer(onClose) {
   const server = createMcpServer();
+  if (onClose) server.server.onclose = onClose;
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
 
+// src/distribution/updates.ts
+init_store();
+init_storage();
+import fs33 from "fs/promises";
+import path41 from "path";
+import { spawn as spawn3 } from "child_process";
+import { randomUUID as randomUUID11 } from "crypto";
+import { z as z30 } from "zod";
+
+// src/distribution/state.ts
+init_storage();
+import os5 from "os";
+import path37 from "path";
+import { fileURLToPath } from "url";
+import fs28 from "fs/promises";
+import { z as z26 } from "zod";
+
+// src/distribution/path.ts
+import fs27 from "fs/promises";
+import os4 from "os";
+import path36 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
+import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+import { z as z25 } from "zod";
+var execute2 = promisify12(execFile12);
+var pathChangeSchema = z25.discriminatedUnion("kind", [
+  z25.object({ kind: z25.literal("profile"), file: z25.string(), block: z25.string(), created: z25.boolean() }),
+  z25.object({ kind: z25.literal("windows"), entry: z25.string(), created: z25.boolean() })
+]);
+var quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+async function configurePath(bin, previous, save, options = {}) {
+  const env = options.env ?? process.env, platform = options.platform ?? process.platform;
+  const changes = [...previous];
+  const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path36.posix.isAbsolute(entry) && path36.posix.resolve(entry) === path36.posix.resolve(bin));
+  const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
+  const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
+  const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
+${alreadyOnPath ? "" : `Add ${bin} to your PATH.
+`}${setupHint}` });
+  if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
+  if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
+  try {
+    if (platform === "win32") {
+      const current = await windowsPath("read");
+      if (!hasWindowsEntry(current.value, bin)) {
+        if (!changes.some((c) => c.kind === "windows" && c.entry === bin)) {
+          changes.push({ kind: "windows", entry: bin, created: current.value === null });
+          await save(changes);
+        }
+        await windowsPath("add", bin, current);
+      }
+      return { status: "configured", changes, message: message2 };
+    }
+    const shell = path36.basename(env.SHELL ?? os4.userInfo().shell ?? "");
+    const userHome = options.userHome ?? os4.homedir();
+    let profiles2;
+    if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
+    if (env.MASON_PROFILE) profiles2 = [path36.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path36.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path36.join(userHome, ".profile")];
+    else {
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path36.join(userHome, name));
+      let login = candidates[2];
+      for (const file of candidates) if (await fs27.lstat(file).then(() => true, (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      })) {
+        login = file;
+        break;
+      }
+      profiles2 = [path36.join(userHome, ".bashrc"), login];
+    }
+    const marker = `# >>> mason PATH ${createHash7("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    for (const profile of profiles2) {
+      const stat = await fs27.lstat(profile).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path36.resolve(profile);
+      const original = await fs27.readFile(file).catch((error) => {
+        if (error.code === "ENOENT" && !stat) return null;
+        throw error;
+      });
+      if (original && !Buffer.from(original.toString("utf8")).equals(original)) return manual(`Shell profile is not UTF-8: ${profile}.`);
+      const text2 = original?.toString("utf8") ?? "";
+      const owned = changes.find((c) => c.kind === "profile" && c.file === file);
+      if (owned && text2.includes(owned.block)) continue;
+      if (text2.includes(marker) || owned && text2.includes("# <<< mason PATH")) return manual(`Mason's PATH block was edited; retained ${profile}.`);
+      const newline = text2.includes("\r\n") ? "\r\n" : "\n";
+      const block = owned?.block ?? ("\n" + marker + '\ncase ":${PATH-}:" in\n  *:' + quote(bin) + ":*) ;;\n  *) export PATH=" + quote(bin) + ':"${PATH-}" ;;\nesac\n# <<< mason PATH <<<\n').replaceAll("\n", newline);
+      if (!owned) {
+        changes.push({ kind: "profile", file, block, created: original === null });
+        await save(changes);
+      }
+      await fs27.mkdir(path36.dirname(file), { recursive: true });
+      const handle = await fs27.open(file, original === null ? "ax+" : "a+", 384);
+      try {
+        if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
+        await handle.writeFile(block);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+    }
+    return { status: "configured", changes, message: message2 };
+  } catch (error) {
+    return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+var normalizeWindowsEntry = (value) => path36.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+var hasWindowsEntry = (value, entry, env = process.env) => {
+  const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
+  const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
+  return (value ?? "").split(";").some((part) => normalizeWindowsEntry(expand(part)) === normalizeWindowsEntry(entry));
+};
+async function windowsPath(action, entry = "", expected, removeEmpty = false) {
+  const payload = Buffer.from(JSON.stringify({ action, entry, expected, removeEmpty })).toString("base64");
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+$p = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}')) | ConvertFrom-Json
+$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+try {
+  $value = $key.GetValue('Path', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+  $kind = if ($null -eq $value) { $null } else { $key.GetValueKind('Path').ToString() }
+  if ($null -ne $kind -and $kind -notin @('String','ExpandString')) { throw 'User PATH is not a string.' }
+  if ($p.action -eq 'read') { @{ value = $value; kind = $kind } | ConvertTo-Json -Compress; exit 0 }
+  if ($p.expected -and ($value -cne $p.expected.value -or $kind -cne $p.expected.kind)) { throw 'User PATH changed concurrently; retry the operation.' }
+  $parts = if ($null -eq $value -or $value -eq '') { @() } else { @($value.Split(';')) }
+  if ($p.action -eq 'add') { $next = (@($p.entry) + $parts) -join ';' }
+  else { $next = (@($parts | Where-Object { $_ -cne $p.entry })) -join ';' }
+  if ($next -cne $value) {
+    $writeKind = if ($kind) { [Microsoft.Win32.RegistryValueKind]$kind } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
+    if ($p.action -eq 'remove' -and $p.removeEmpty -and $next -eq '') { $key.DeleteValue('Path', $false) }
+    else { $key.SetValue('Path', $next, $writeKind) }
+    Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class MasonEnvironment { [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern IntPtr SendMessageTimeout(IntPtr h, uint m, UIntPtr w, string l, uint f, uint t, out UIntPtr r); }'
+    $result = [UIntPtr]::Zero
+    [void][MasonEnvironment]::SendMessageTimeout([IntPtr]0xffff, 0x1a, [UIntPtr]::Zero, 'Environment', 2, 1000, [ref]$result)
+  }
+  @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
+} finally { $key.Dispose() }
+`;
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
+}
+
+// src/distribution/state.ts
+var releaseVersion = z26.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+var bundleId = z26.string().regex(/^[a-f0-9]{24}$/);
+var updatePolicySchema = z26.object({
+  enabled: z26.boolean(),
+  revision: z26.string(),
+  pinnedVersion: releaseVersion.optional(),
+  mirror: z26.string().optional()
+});
+var recordSchema3 = z26.object({
+  format: z26.literal(1),
+  home: z26.string(),
+  bin: z26.string(),
+  current: bundleId,
+  version: releaseVersion,
+  launchers: z26.record(z26.string()),
+  previousLaunchers: z26.record(z26.string()).optional(),
+  pathChanges: z26.array(pathChangeSchema).optional(),
+  updates: updatePolicySchema.optional(),
+  previous: z26.object({ id: bundleId, version: releaseVersion }).optional(),
+  pending: z26.object({ id: bundleId, version: releaseVersion, policyRevision: z26.string() }).optional()
+});
+async function readInstallation(home) {
+  const raw = await readStoreJson(home, "install.json");
+  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const record = recordSchema3.parse(raw);
+  if (record.home !== await fs28.realpath(home)) throw new Error("Invalid standalone installation receipt.");
+  return record;
+}
+function standaloneLocation() {
+  const bundle = path37.resolve(path37.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path37.dirname(path37.dirname(bundle));
+  if (path37.dirname(bundle) !== path37.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path37.basename(bundle))) {
+    return null;
+  }
+  return { home, bundle };
+}
+async function currentInstallation() {
+  const location2 = standaloneLocation();
+  if (!location2) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const { home, bundle } = location2;
+  const record = await readInstallation(home);
+  return { home, bundle, record };
+}
+function automaticUpdatesAllowed(record, env = process.env) {
+  return record.updates?.enabled === true && !record.updates.pinnedVersion && !record.updates.mirror && !env.CI && env.MASON_NO_AUTO_UPDATE !== "1" && !env.MASON_RELEASE_BASE && !env.MASON_VERSION;
+}
+function newerStableVersion(candidate, installed) {
+  if (!/^\d+\.\d+\.\d+$/.test(candidate)) return false;
+  const a = candidate.split(".").map(BigInt), b = installed.split("-")[0].split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return installed.includes("-");
+}
+
+// src/distribution/bundle.ts
+init_storage();
+import fs29 from "fs/promises";
+import path38 from "path";
+import { createHash as createHash8 } from "crypto";
+import { z as z27 } from "zod";
+var targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+var digest2 = z27.string().regex(/^[a-f0-9]{64}$/);
+var bundleSchema = z27.object({
+  format: z27.literal(1),
+  version: z27.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+  target: z27.enum(targets),
+  nodeVersion: z27.string(),
+  files: z27.record(digest2)
+}).strict();
+var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex");
+async function readBundle(root) {
+  const bytes = await fs29.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path38.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs29.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+
+// src/distribution/runtime.ts
+init_store();
+init_storage();
+import fs30 from "fs/promises";
+import { unlinkSync } from "fs";
+import os6 from "os";
+import path39 from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import { z as z28 } from "zod";
+var leaseSchema = z28.object({ pid: z28.number().int().positive(), host: z28.string(), bundle: z28.string().regex(/^[a-f0-9]{24}$/) });
+
+// src/distribution/install.ts
+import fs32 from "fs/promises";
+import os8 from "os";
+import path40 from "path";
+import { execFile as execFile13, spawn as spawn2 } from "child_process";
+import { promisify as promisify13 } from "util";
+import { randomUUID as randomUUID10 } from "crypto";
+init_storage();
+init_store();
+
+// src/distribution/sessions.ts
+init_storage();
+import fs31 from "fs/promises";
+import os7 from "os";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z29 } from "zod";
+var leaseSchema2 = z29.object({ pid: z29.number().int().positive(), host: z29.string() });
+async function hasRunningMcp(home) {
+  const directory = await storePath(home, "sessions");
+  const files = await fs31.readdir(directory).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  for (const name of files) {
+    if (!/^[a-f0-9-]+\.json$/.test(name)) return true;
+    const relative = "sessions/" + name;
+    try {
+      const raw = await readStoreJson(home, relative);
+      if (raw === null) continue;
+      const lease = leaseSchema2.parse(raw);
+      if (lease.host !== os7.hostname()) return true;
+      try {
+        process.kill(lease.pid, 0);
+        return true;
+      } catch (error) {
+        if (error.code !== "ESRCH") return true;
+      }
+      await fs31.rm(await storePath(home, relative), { force: true });
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+async function registerMcp(home) {
+  const name = `sessions/${randomUUID9()}.json`;
+  await writeStoreJson(home, name, { pid: process.pid, host: os7.hostname() });
+  return async () => {
+    await fs31.rm(await storePath(home, name), { force: true }).catch(() => {
+    });
+  };
+}
+
+// src/distribution/install.ts
+var shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+var psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
+var WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
+var launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
+async function replace(file, content2, mode = 384) {
+  const temp = file + ".tmp-" + randomUUID10();
+  try {
+    await fs32.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs32.rename(temp, file);
+  } finally {
+    await fs32.rm(temp, { force: true });
+  }
+}
+function assertUpdatePolicy(record, version, revision) {
+  if (!record || !automaticUpdatesAllowed(record, { ...process.env, MASON_VERSION: "" }) || record.updates?.revision !== revision || !newerStableVersion(version, record.version)) {
+    throw new Error("Update policy or installed version changed; download was not activated.");
+  }
+}
+async function installLocked2(home, source, bundle, progress, options, alreadyStaged = false) {
+  const raw = await readStoreJson(home, "install.json");
+  const previous = raw === null ? null : recordSchema3.parse(raw);
+  if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
+  if (!previous) for (const file of await fs32.readdir(home)) {
+    if (file === ".install-lock") continue;
+    const directory = path40.join(home, file);
+    const stat = await fs32.lstat(directory);
+    if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs32.readdir(directory)).length) {
+      throw new Error("Mason installation directory is not empty and has no ownership receipt.");
+    }
+  }
+  const selectedBin = path40.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path40.join(home, "bin") : path40.join(os8.homedir(), ".local/bin")));
+  await fs32.mkdir(selectedBin, { recursive: true });
+  const bin = await fs32.realpath(selectedBin);
+  if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
+  const id = bundle.manifestHash.slice(0, 24);
+  const destination = await storePath(home, "versions/" + id);
+  if (options.stageOnly) {
+    const receipt2 = { ...previous, pending: { id, version: bundle.manifest.version, policyRevision: options.policyRevision } };
+    await writeStoreJson(home, "install.json", receipt2);
+    return { home, bin, version: bundle.manifest.version, previousVersion: previous.version, path: { message: "Update staged for a future MCP launch." } };
+  }
+  const launchers = process.platform === "win32" ? {
+    "mason.cmd": WINDOWS_BATCH_LAUNCHER,
+    "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
+$previousToken = $env:MASON_UNINSTALL_TOKEN
+$token = [Guid]::NewGuid().ToString()
+$env:MASON_UNINSTALL_TOKEN = $token
+try {
+  & ${psQuote(path40.join(destination, "node.exe"))} ${psQuote(path40.join(destination, "app/dist/mason.js"))} @args
+  $code = $LASTEXITCODE
+  if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
+    if ([IO.File]::ReadAllText(${psQuote(path40.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
+    Write-Output ${psQuote("Removed standalone installation: " + home)}
+  }
+  exit $code
+} catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 }
+finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
+`
+  } : { mason: `#!/bin/sh
+exec ${shQuote(path40.join(destination, "node"))} ${shQuote(path40.join(destination, "app/dist/mason.js"))} "$@"
+` };
+  for (const [name, content2] of Object.entries(launchers)) {
+    const file = await storePath(bin, name);
+    const old = await fs32.readFile(file, "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  }
+  const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+  const checkRetired = async (name, expected) => {
+    if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+    const actual = await fs32.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+  };
+  for (const [name, expected] of retired) await checkRetired(name, expected);
+  progress?.step(`Installing Mason ${bundle.manifest.version}`);
+  const updates = options.preservePolicy && previous?.updates ? { ...previous.updates } : {
+    ...previous?.updates ?? { enabled: !previous && !process.env.CI && process.env.MASON_NO_AUTO_UPDATE !== "1" },
+    revision: randomUUID10(),
+    pinnedVersion: process.env.MASON_VERSION?.replace(/^v/, "") || void 0,
+    mirror: process.env.MASON_RELEASE_BASE || previous?.updates?.mirror
+  };
+  if (options.rollback) {
+    updates.pinnedVersion = bundle.manifest.version;
+    updates.revision = randomUUID10();
+  }
+  const receipt = {
+    format: 1,
+    home,
+    bin,
+    current: id,
+    version: bundle.manifest.version,
+    launchers,
+    pathChanges: previous?.pathChanges ?? [],
+    updates,
+    previous: previous && previous.current !== id ? { id: previous.current, version: previous.version } : previous?.previous
+  };
+  await writeStoreJson(home, "install.json", previous ? { ...previous, previousLaunchers: launchers } : receipt);
+  try {
+    if (!alreadyStaged) await copyBundle(home, source, destination, bundle);
+    for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+    for (const [name, expected] of retired) {
+      await checkRetired(name, expected);
+      await fs32.rm(await storePath(bin, name), { force: true });
+    }
+    await writeStoreJson(home, "install.json", receipt);
+  } catch (error) {
+    if (previous) {
+      for (const [name, content2] of Object.entries(previous.launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      await writeStoreJson(home, "install.json", previous);
+    }
+    throw error;
+  }
+  if (options.preservePolicy) return { home, bin, version: receipt.version, previousVersion: previous?.version, path: { message: "Installation selected." } };
+  progress?.step("Checking terminal command availability");
+  const pathResult = await configurePath(bin, receipt.pathChanges ?? [], async (changes) => {
+    receipt.pathChanges = changes;
+    await writeStoreJson(home, "install.json", receipt);
+  });
+  return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+}
+async function copyBundle(home, source, destination, bundle) {
+  const exists = await fs32.lstat(destination).then(() => true, (error) => {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  });
+  if (exists) {
+    await verifyBundle(destination, bundle.manifestHash);
+    return;
+  }
+  const stage = await storePath(home, "versions/.install-" + randomUUID10(), true);
+  await fs32.mkdir(stage);
+  try {
+    for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
+      const from = await storePath(source, file), to = await storePath(stage, file, true);
+      await fs32.copyFile(from, to);
+      await fs32.chmod(to, (await fs32.stat(from)).mode & 511);
+    }
+    await verifyBundle(stage, bundle.manifestHash);
+    try {
+      await fs32.rename(stage, destination);
+    } catch (error) {
+      try {
+        await verifyBundle(destination, bundle.manifestHash);
+      } catch {
+        throw error;
+      }
+    }
+  } finally {
+    await fs32.rm(stage, { recursive: true, force: true });
+  }
+}
+async function prepareStandaloneMcp(home) {
+  const before = await readInstallation(home), candidate = before.pending;
+  let verified, verificationError;
+  if (candidate && automaticUpdatesAllowed(before) && !await hasRunningMcp(home)) {
+    try {
+      verified = await verifyBundle(await storePath(home, "versions/" + candidate.id));
+      if (verified.manifestHash.slice(0, 24) !== candidate.id || verified.manifest.version !== candidate.version) throw new Error("Staged update changed.");
+    } catch (error) {
+      verificationError = error;
+    }
+  }
+  return withLock(home, ".install-lock", async () => {
+    let record = await readInstallation(home);
+    const pending = record.pending;
+    if (pending && candidate?.id === pending.id && (verified || verificationError) && automaticUpdatesAllowed(record) && pending.policyRevision === record.updates?.revision && newerStableVersion(pending.version, record.version) && !await hasRunningMcp(home)) {
+      try {
+        if (verificationError) throw verificationError;
+        const source = await storePath(home, "versions/" + pending.id);
+        await installLocked2(home, source, verified, void 0, { preservePolicy: true }, true);
+        record = await readInstallation(home);
+      } catch (error) {
+        record = await readInstallation(home);
+        delete record.pending;
+        await writeStoreJson(home, "install.json", record);
+        await writeStoreJson(home, "update-status.json", { lastAttempt: Date.now(), error: String(error) });
+      }
+    }
+    const release = await registerMcp(home);
+    return { bundle: await storePath(home, "versions/" + record.current), release };
+  });
+}
+
+// src/distribution/updates.ts
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
+var releaseListSchema = z30.array(z30.object({ tag_name: z30.string(), draft: z30.boolean(), prerelease: z30.boolean(), published_at: z30.string().nullable() }));
+var updateManifestSchema = z30.object({
+  format: z30.literal(1),
+  version: z30.string().regex(/^\d+\.\d+\.\d+$/),
+  publishedAt: z30.string().datetime(),
+  assets: z30.record(z30.string().regex(/^[a-f0-9]{64}$/))
+}).strict();
+var statusSchema2 = z30.object({ lastAttempt: z30.number(), availableVersion: z30.string().optional(), error: z30.string().optional() });
+async function scheduleAutomaticUpdate() {
+  try {
+    const { home, record } = await currentInstallation();
+    if (!automaticUpdatesAllowed(record)) return;
+    const status = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    const now = Date.now();
+    if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
+    const bundle = await storePath(home, "versions/" + record.current);
+    const child = spawn3(
+      path41.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path41.join(bundle, "app/dist/mason.js"), "internal-update"],
+      { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
+    );
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function startMcpWithUpdates(start) {
+  const current = standaloneLocation();
+  if (!current) {
+    await start();
+    return;
+  }
+  const session = await prepareStandaloneMcp(current.home);
+  if (session.bundle !== current.bundle) {
+    const child = spawn3(
+      path41.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path41.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      { stdio: "inherit", windowsHide: true }
+    );
+    const interrupt = () => {
+      child.kill("SIGINT");
+    }, terminate = () => {
+      child.kill("SIGTERM");
+    };
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    try {
+      process.exitCode = await new Promise((resolve2, reject) => {
+        child.on("error", reject);
+        child.on("exit", (code) => resolve2(code ?? 1));
+      });
+    } finally {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+      await session.release();
+    }
+    return;
+  }
+  const timer = setInterval(() => {
+    void scheduleAutomaticUpdate();
+  }, 60 * 60 * 1e3);
+  timer.unref();
+  const stop = () => {
+    clearInterval(timer);
+    void session?.release();
+  };
+  try {
+    await start(stop);
+    void scheduleAutomaticUpdate();
+  } catch (error) {
+    stop();
+    throw error;
+  }
+}
+
 // bin/mason-mcp.ts
-startMcpServer().catch((err) => {
+startMcpWithUpdates(startMcpServer).catch((err) => {
   process.stderr.write(`Mason MCP server error: ${err}
 `);
   process.exit(1);