mason-context 0.18.0 → 0.19.1

package/dist/mason.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -95,6 +96,26 @@ var init_git_read = __esm({
   }
 });
 
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
@@ -139,6 +160,27 @@ async function loadProjectConfig(root) {
       }
       config[key] = value[key];
     }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -438,8 +480,190 @@ var init_store = __esm({
   }
 });
 
-// src/audit/commands.ts
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args2, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args2, options]), () => execGit(args2, options));
+}
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/inputs.ts
+import fs4 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs4.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
+  }
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
+// src/audit/commands.ts
+import path6 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote2 = "", start = 0;
@@ -475,7 +699,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path4.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path6.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -486,7 +710,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path4.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path6.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
@@ -516,7 +740,7 @@ var init_commands = __esm({
     COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path4.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path6.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -821,52 +1045,6 @@ var init_claims = __esm({
   }
 });
 
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path5 from "path";
-function withRepositoryInspection(root, run) {
-  return inspections.run({ root: path5.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
-}
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path5.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
-  }
-  return inspection.reads.get(key);
-}
-function inspectionGit(args2, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args2, options]), () => execGit(args2, options));
-}
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path5.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path5.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
-}
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
-    "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
-  }
-});
-
 // src/audit/git.ts
 function parseCommitLine(line) {
   const parts = line.split("	");
@@ -952,136 +1130,26 @@ var init_git = __esm({
   }
 });
 
-// src/audit/inputs.ts
-import fs4 from "fs/promises";
-import * as nativeFs from "fs";
-import path6 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs4.realpath(root);
+// src/audit/docs.ts
+import fs5 from "fs/promises";
+import path7 from "path";
+import fg5 from "fast-glob";
+async function dirtyDocs(resolvedRoot, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
   try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
-    }
-  }
-  return ignored;
-}
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
-    init_inspection();
-    MAX_INPUTS = 1e5;
-  }
-});
-
-// src/audit/docs.ts
-import fs5 from "fs/promises";
-import path7 from "path";
-import fg3 from "fast-glob";
-async function dirtyDocs(resolvedRoot, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  try {
-    const dirty = /* @__PURE__ */ new Set();
-    for (let offset = 0; offset < files.length; offset += 256) {
-      const { stdout } = await execGit(
-        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
-        { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-      );
-      const entries = stdout.split("\0");
-      for (let i = 0; i < entries.length; i++) {
-        if (!entries[i]) continue;
-        const status = entries[i].slice(0, 2);
-        dirty.add(entries[i].slice(3));
-        if (/[RC]/.test(status) && entries[i + 1]) dirty.add(entries[++i]);
-      }
+    const dirty = /* @__PURE__ */ new Set();
+    for (let offset = 0; offset < files.length; offset += 256) {
+      const { stdout } = await execGit(
+        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
+        { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
+      );
+      const entries = stdout.split("\0");
+      for (let i = 0; i < entries.length; i++) {
+        if (!entries[i]) continue;
+        const status = entries[i].slice(0, 2);
+        dirty.add(entries[i].slice(3));
+        if (/[RC]/.test(status) && entries[i + 1]) dirty.add(entries[++i]);
+      }
     }
     return dirty;
   } catch {
@@ -1117,7 +1185,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1147,6 +1215,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path7.posix.basename(file))) return ".";
   const parent = path7.posix.dirname(file);
   return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
@@ -1168,7 +1237,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path7.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1437,22 +1506,6 @@ var init_drift = __esm({
   }
 });
 
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
-  }
-});
-
 // src/audit/checks/deleted-reference.ts
 import path12 from "path";
 async function checkDeletedReferences(ctx) {
@@ -1521,7 +1574,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1583,7 +1636,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1596,7 +1649,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -1931,6 +1984,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content2) {
+  return content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json2 = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json2[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content2) {
+  const matches = [];
+  const lines = dependencyText(content2).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args2) {
   return (await execGit(args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -1987,6 +2121,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content2) {
+  const text2 = content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -2006,12 +2144,17 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
+    let content2 = doc.content;
     if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
+      try {
+        content2 = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
     }
     const range = await commitsTouchingSince(
       ctx.root,
@@ -2036,16 +2179,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content2
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content2)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -2055,9 +2214,11 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -2078,7 +2239,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2262,7 +2423,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2313,9 +2474,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2511,7 +2672,9 @@ var init_findings = __esm({
         kind: z5.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
         manifestCommits: z5.array(commitSchema.extend({ files: z5.array(z5.string()) })),
-        totalCommits: count
+        totalCommits: count,
+        matches: z5.array(z5.object({ dependency: z5.string(), manifest: z5.string(), before: z5.string().nullable(), after: z5.string().nullable(), line: z5.number().int().positive(), excerpt: z5.string() })).optional(),
+        matchingIncomplete: z5.boolean().optional()
       }),
       z5.object({
         kind: z5.literal("decision-anchor"),
@@ -2527,7 +2690,7 @@ var init_findings = __esm({
       type: z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
       confidence: z5.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z5.literal("recheck").optional() });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z5.enum(["recheck", "informational"]).optional() });
     checkResultSchema = z5.object({
       issues: z5.array(issueSchema),
       advisories: z5.array(advisorySchema),
@@ -2545,14 +2708,18 @@ async function readRecord(root, id) {
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason2) {
+  return digest([evidence.scope, evidence.tree, ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason2) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -2563,9 +2730,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason2) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason2);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -2591,7 +2758,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason2);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -2638,7 +2805,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -2648,7 +2815,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -2665,7 +2832,7 @@ async function advisoryReviewInventory(root) {
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
   return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -2691,11 +2858,13 @@ var init_advisory_review = __esm({
       lastScopeCommit: commitSchema2,
       paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
     });
+    dismissalReasonSchema = z6.enum(["no-dependency-claims", "unrelated-manifest-change"]);
     eventSchema2 = z6.object({
       at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200),
+      reviewer: z6.string().trim().min(1).max(200).optional(),
       note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
@@ -2707,13 +2876,14 @@ var init_advisory_review = __esm({
       recordPath: z6.string().optional(),
       reviewer: z6.string().optional(),
       note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
       reviewedHead: z6.string().optional()
     });
     advisoryReviewRequest = z6.object({
       baselinePath: z6.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -2724,12 +2894,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2763,7 +2933,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2775,13 +2945,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -2793,6 +2971,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -2805,7 +2985,7 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -2826,7 +3006,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -2892,8 +3072,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path21.resolve(rootDir);
+  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2939,6 +3119,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -2949,11 +3132,14 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -2977,7 +3163,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -3020,13 +3206,14 @@ var init_repair = __esm({
       docs: z7.array(z7.object({
         path: z7.string().refine((value) => normalizeRepoPath(value) === value),
         scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme"]).optional(),
+        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
         dirty: z7.boolean(),
         lineCount: count2
       })).nonempty(),
       decisionsChecked: z7.boolean(),
       clean: z7.boolean(),
+      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
       issues: z7.array(issueSchema),
       advisories: z7.array(advisorySchema),
       suppressedAdvisories: z7.array(advisorySchema).optional(),
@@ -3052,9 +3239,9 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { createHash as createHash3 } from "crypto";
-import fg5 from "fast-glob";
+import fg7 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args2) {
   return profilePhase("automation.git", async () => (await execGit(args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
@@ -3072,6 +3259,11 @@ async function readInputs(root) {
 }
 async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
+  const auditPolicy = (await loadProjectConfig(root)).audit;
+  const allowed = /* @__PURE__ */ new Map();
+  for (const name of ["deleted-reference", "new-module", "stale-count", "dead-command"]) {
+    allowed.set(name, await includedCheckPaths(root, docPaths, auditPolicy?.exclude?.[name] ?? []));
+  }
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
     docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
@@ -3081,7 +3273,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3100,18 +3292,18 @@ async function collectInputs(root) {
     docContents.push([file, text2]);
     const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
     parsedDocs.push(parsed);
-    for (const claim of parsed.claims.paths) {
+    for (const claim of allowed.get("deleted-reference").has(file) ? parsed.claims.paths : []) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path22.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const combinedDocs = moduleDocumentation(parsedDocs);
-  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
+  const combinedDocs = moduleDocumentation(parsedDocs.filter((doc) => allowed.get("new-module").has(doc.path)));
+  const countClaims = parsedDocs.filter((doc) => allowed.get("stale-count").has(doc.path)).flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -3120,8 +3312,8 @@ async function collectInputs(root) {
   const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
-    commandInputs(root, parsedDocs),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    commandInputs(root, parsedDocs.filter((doc) => allowed.get("dead-command").has(doc.path))),
+    fg7(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
@@ -3131,7 +3323,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [5, engineVersion, head, shallow, replacements, docContents];
+  const common = [7, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3178,6 +3370,8 @@ var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_policy();
+    init_files();
     init_git_read();
     init_profile();
     init_docs();
@@ -3191,7 +3385,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.18.0" : "development";
+    engineVersion = true ? "0.19.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3405,13 +3599,17 @@ async function observeReadOnlyTool(dir, event) {
 }
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
+  const onlyReview = report.status === "incomplete" && !report.diagnostics.length && !report.counts.unresolved && !report.counts.unverified && report.counts["review-required"] > 0;
   return [
-    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
-    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    onlyReview ? `Mason: ${report.counts["review-required"]} advisor${report.counts["review-required"] === 1 ? "y" : "ies"} awaiting review; no unresolved issues.` : `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => {
+      const detail = f.current ? f.current.message : f.status === "review-required" ? `${f.original.type}: current check no longer reports ${f.original.type === "deps-changed" ? "this condition" : "the original finding"}; historical evidence awaits assessment.` : `Original evidence: ${f.original.message}. ${f.reason}`;
+      return `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(detail)}`;
+    }),
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -3635,7 +3833,7 @@ async function automate(dir, event) {
         if (event.event === "after_tool" && event.mutating) {
           session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
-            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
           }
           if (event.toolId) delete session.pending[event.toolId];
@@ -3745,9 +3943,9 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs15 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 async function repositoryRoot(dir) {
-  if (!path22.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path23.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -3778,11 +3976,39 @@ var init_hook_root = __esm({
 
 // src/setup/model.ts
 import { z as z11 } from "zod";
+import fs16 from "fs/promises";
+import path24 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
+async function effectiveSetup(root) {
+  const local = await loadSetup(root);
+  if (local) return { root, setup: local };
+  const common = await fs16.realpath(path24.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const own = await fs16.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  if (common === own) return { root, setup: null };
+  const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
+  const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
+  if (!candidate || primary.includes("bare")) return { root, setup: null };
+  let inheritedRoot;
+  try {
+    inheritedRoot = await fs16.realpath((await git3(candidate, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
+    throw error;
+  }
+  const inheritedCommon = await fs16.realpath(path24.resolve(
+    inheritedRoot,
+    (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
+  ));
+  if (inheritedCommon !== common) throw new Error("Linked worktree setup does not belong to the same Git repository.");
+  const setup = await loadSetup(inheritedRoot);
+  const inactive = await readStoreJson(root, INACTIVE_HOSTS_PATH);
+  if (inactive && setup) for (const host of inactiveHostsSchema.parse(inactive).hosts) delete setup.hosts[host];
+  return { root: inheritedRoot, setup };
+}
 async function loadSetupReceipt(root, directory, host) {
   const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
   if (raw === null) return null;
@@ -3790,10 +4016,11 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, INACTIVE_HOSTS_PATH, inactiveHostsSchema, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
+    init_evidence();
     init_storage();
     setupHostSchema = z11.object({
       configuredVersion: z11.string(),
@@ -3807,6 +4034,8 @@ var init_model = __esm({
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
+    INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
+    inactiveHostsSchema = z11.object({ version: z11.literal(1), hosts: z11.array(z11.enum(["claude", "codex"])) });
     receiptSchema = z11.object({
       version: z11.literal(1),
       host: z11.enum(["codex", "claude"]),
@@ -3833,7 +4062,7 @@ __export(launcher_exports, {
 });
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
 }
@@ -3853,8 +4082,8 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs16.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
-  const entry = (await loadSetup(root))?.hosts[host];
+  const root = await fs17.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const entry = (await effectiveSetup(root)).setup?.hosts[host];
   process.env.MASON_SETUP_ROOT = root;
   process.env.MASON_SETUP_HOST = host;
   delete process.env.MASON_SETUP_REVISION;
@@ -3876,7 +4105,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.18.0" : "development";
+    executingVersion = () => true ? "0.19.1" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3889,7 +4118,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs17 from "fs/promises";
+import fs18 from "fs/promises";
 import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -3906,15 +4135,15 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
     if (!revision) {
-      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+      if ((await effectiveSetup(process.env.MASON_SETUP_ROOT)).setup?.hosts[host]) {
         return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
       }
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs17.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs17.realpath(process.env.MASON_SETUP_ROOT)) return null;
-    const setup = await loadSetup(ws.root);
+    const ws = capturedDirectory ? { root: await fs18.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs18.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
     await withLock(ws.root, directory, async () => {
@@ -4091,8 +4320,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs18 from "fs/promises";
-import path23 from "path";
+import fs19 from "fs/promises";
+import path25 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4121,14 +4350,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs18.unlink(file2);
+    await fs19.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs18.open(temporary, "wx", mode);
+    const mode = await fs19.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs19.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -4136,10 +4365,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs18.rename(temporary, file);
+    await fs19.rename(temporary, file);
     return true;
   } finally {
-    await fs18.rm(temporary, { force: true });
+    await fs19.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4250,9 +4479,11 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
 - When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
+- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
+
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
 Inspect source for what the retrieved context does not answer.
@@ -4547,8 +4778,10 @@ __export(teardown_exports, {
   teardownProject: () => teardownProject
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import fs20 from "fs/promises";
+import path26 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
-import fg6 from "fast-glob";
+import fg8 from "fast-glob";
 import { z as z18 } from "zod";
 async function planTeardown(root, selected) {
   const edits = [], diagnostics = [];
@@ -4568,6 +4801,11 @@ async function planTeardown(root, selected) {
   const ownership = ownershipBefore === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(ownershipBefore));
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
+  const linked = (await workspace(root)).gitDir !== await fs20.realpath(
+    path26.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  );
+  const inactiveBefore = linked && !setup ? await read(INACTIVE_HOSTS_PATH) : null;
+  const inactive = inactiveBefore === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(inactiveBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
   const commands2 = (host) => new Set([
@@ -4687,7 +4925,7 @@ async function planTeardown(root, selected) {
   if (diagnostics.length) edits.splice(instructionEditStart);
   if (!diagnostics.length) {
     const cleanup = [];
-    const receiptFiles = await fg6(
+    const receiptFiles = await fg8(
       selected.map((host) => ".mason/reports/automation/*/setup-" + host + ".json"),
       { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false }
     );
@@ -4711,7 +4949,16 @@ async function planTeardown(root, selected) {
         delete ownership.files[configPath(host)];
       }
       if (!remainingHost) for (const file of DOC_CANDIDATES) delete ownership.files[file];
-      if (setupBefore !== null) cleanup.push({ path: SETUP_PATH, before: setupBefore, after: Object.keys(setup.hosts).length ? json(setup) : null });
+      if (setupBefore !== null) cleanup.push({
+        path: SETUP_PATH,
+        before: setupBefore,
+        after: linked || Object.keys(setup.hosts).length ? json(setup) : null
+      });
+      else if (linked) cleanup.push({
+        path: INACTIVE_HOSTS_PATH,
+        before: inactiveBefore,
+        after: json({ version: 1, hosts: [.../* @__PURE__ */ new Set([...inactive.hosts, ...selected])].sort() })
+      });
       if (automationBefore !== null) cleanup.push({ path: AUTOMATION_PATH, before: automationBefore, after: Object.keys(automation.hosts).length ? json(automation) : null });
       if (ownershipBefore !== null) cleanup.push({ path: OWNERSHIP_PATH, before: ownershipBefore, after: Object.keys(ownership.files).length ? json(ownership) : null });
       edits.push(...cleanup);
@@ -5152,10 +5399,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path24 from "path";
+import path27 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
+  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5252,7 +5499,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5373,8 +5620,8 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs19 from "fs/promises";
-import path25 from "path";
+import fs21 from "fs/promises";
+import path28 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5403,7 +5650,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path25.resolve(rootDir);
+  const resolvedRoot = path28.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5453,7 +5700,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path25.join(resolvedRoot, relPath));
+        await fs21.access(path28.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5596,8 +5843,9 @@ __export(status_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
-  const setup = await loadSetup(ws.root);
-  if (!setup) {
+  const activation = await effectiveSetup(ws.root);
+  const setup = activation.setup;
+  if (!setup || !Object.keys(setup.hosts).length) {
     const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
       host,
       receipt: await loadSetupReceipt(ws.root, ws.directory, host)
@@ -5631,7 +5879,7 @@ async function setupStatus(dir) {
     ]));
     const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
-    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
@@ -5663,6 +5911,7 @@ async function setupStatus(dir) {
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
     hosts: hosts2,
+    activationRoot: activation.root,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -5670,6 +5919,9 @@ async function setupStatus(dir) {
 }
 function summarizeActivation(status) {
   const lines = ["Mason setup: " + status.status + "."];
+  if (status.activationRoot && status.activationRoot !== status.root) {
+    lines.push("Activation inherited from " + status.activationRoot + "; evidence belongs to this worktree.");
+  }
   for (const [host, state] of Object.entries(status.hosts)) {
     lines.push(
       `${host}: ${state.status}`,
@@ -5831,66 +6083,19 @@ var init_setup = __esm({
   }
 });
 
-// src/distribution/bundle.ts
-import fs20 from "fs/promises";
-import path26 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z23 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs20.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path26.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
-    }
-  }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
-  }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs20.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
-}
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
-    "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z23.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z23.object({
-      format: z23.literal(1),
-      version: z23.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z23.enum(targets),
-      nodeVersion: z23.string(),
-      files: z23.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
-  }
-});
-
 // src/distribution/path.ts
-import fs21 from "fs/promises";
+import fs22 from "fs/promises";
 import os3 from "os";
-import path27 from "path";
+import path29 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
-import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
-import { z as z24 } from "zod";
+import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
+import { z as z23 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path27.posix.isAbsolute(entry) && path27.posix.resolve(entry) === path27.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path29.posix.isAbsolute(entry) && path29.posix.resolve(entry) === path29.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -5910,33 +6115,33 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path27.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path29.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path27.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path27.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path27.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path29.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path29.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path29.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path27.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path29.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs21.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs22.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles2 = [path27.join(userHome, ".bashrc"), login];
+      profiles2 = [path29.join(userHome, ".bashrc"), login];
     }
-    const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    const marker = `# >>> mason PATH ${createHash4("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
-      const stat = await fs21.lstat(profile).catch((error) => {
+      const stat = await fs22.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs21.realpath(profile) : path27.resolve(profile);
-      const original = await fs21.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs22.realpath(profile) : path29.resolve(profile);
+      const original = await fs22.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -5951,8 +6156,8 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs21.mkdir(path27.dirname(file), { recursive: true });
-      const handle = await fs21.open(file, original === null ? "ax+" : "a+", 384);
+      await fs22.mkdir(path29.dirname(file), { recursive: true });
+      const handle = await fs22.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -5976,13 +6181,13 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs21.lstat(change.file).catch((error) => {
+      const stat = await fs22.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs21.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs22.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
@@ -5992,7 +6197,7 @@ async function removePath(changes) {
       const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs21.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs22.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -6001,11 +6206,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs21.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs21.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs21.rename(temporary, change.file);
+        const current = await fs22.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs22.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs22.rename(temporary, change.file);
       } finally {
-        await fs21.rm(temporary, { force: true });
+        await fs22.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -6047,12 +6252,12 @@ var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
     execute2 = promisify5(execFile5);
-    pathChangeSchema = z24.discriminatedUnion("kind", [
-      z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
-      z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
+    pathChangeSchema = z23.discriminatedUnion("kind", [
+      z23.object({ kind: z23.literal("profile"), file: z23.string(), block: z23.string(), created: z23.boolean() }),
+      z23.object({ kind: z23.literal("windows"), entry: z23.string(), created: z23.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path27.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path29.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -6061,65 +6266,346 @@ var init_path = __esm({
   }
 });
 
+// src/distribution/state.ts
+var state_exports = {};
+__export(state_exports, {
+  automaticUpdatesAllowed: () => automaticUpdatesAllowed,
+  currentInstallation: () => currentInstallation,
+  defaultHome: () => defaultHome,
+  newerStableVersion: () => newerStableVersion,
+  readInstallation: () => readInstallation,
+  recordSchema: () => recordSchema3,
+  releaseVersion: () => releaseVersion,
+  standaloneLocation: () => standaloneLocation,
+  updatePolicySchema: () => updatePolicySchema
+});
+import os4 from "os";
+import path30 from "path";
+import { fileURLToPath } from "url";
+import fs23 from "fs/promises";
+import { z as z24 } from "zod";
+async function readInstallation(home) {
+  const raw = await readStoreJson(home, "install.json");
+  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const record = recordSchema3.parse(raw);
+  if (record.home !== await fs23.realpath(home)) throw new Error("Invalid standalone installation receipt.");
+  return record;
+}
+function standaloneLocation() {
+  const bundle = path30.resolve(path30.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path30.dirname(path30.dirname(bundle));
+  if (path30.dirname(bundle) !== path30.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path30.basename(bundle))) {
+    return null;
+  }
+  return { home, bundle };
+}
+async function currentInstallation() {
+  const location2 = standaloneLocation();
+  if (!location2) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const { home, bundle } = location2;
+  const record = await readInstallation(home);
+  return { home, bundle, record };
+}
+function automaticUpdatesAllowed(record, env = process.env) {
+  return record.updates?.enabled === true && !record.updates.pinnedVersion && !record.updates.mirror && !env.CI && env.MASON_NO_AUTO_UPDATE !== "1" && !env.MASON_RELEASE_BASE && !env.MASON_VERSION;
+}
+function newerStableVersion(candidate, installed) {
+  if (!/^\d+\.\d+\.\d+$/.test(candidate)) return false;
+  const a = candidate.split(".").map(BigInt), b = installed.split("-")[0].split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return installed.includes("-");
+}
+var releaseVersion, bundleId, updatePolicySchema, recordSchema3, defaultHome;
+var init_state = __esm({
+  "src/distribution/state.ts"() {
+    "use strict";
+    init_storage();
+    init_path();
+    releaseVersion = z24.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+    bundleId = z24.string().regex(/^[a-f0-9]{24}$/);
+    updatePolicySchema = z24.object({
+      enabled: z24.boolean(),
+      revision: z24.string(),
+      pinnedVersion: releaseVersion.optional(),
+      mirror: z24.string().optional()
+    });
+    recordSchema3 = z24.object({
+      format: z24.literal(1),
+      home: z24.string(),
+      bin: z24.string(),
+      current: bundleId,
+      version: releaseVersion,
+      launchers: z24.record(z24.string()),
+      previousLaunchers: z24.record(z24.string()).optional(),
+      pathChanges: z24.array(pathChangeSchema).optional(),
+      updates: updatePolicySchema.optional(),
+      previous: z24.object({ id: bundleId, version: releaseVersion }).optional(),
+      pending: z24.object({ id: bundleId, version: releaseVersion, policyRevision: z24.string() }).optional()
+    });
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path30.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path30.join(os4.homedir(), ".local/share/mason"));
+  }
+});
+
+// src/distribution/bundle.ts
+import fs24 from "fs/promises";
+import path31 from "path";
+import { createHash as createHash5 } from "crypto";
+import { z as z25 } from "zod";
+async function readBundle(root) {
+  const bytes = await fs24.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path31.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs24.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+var targets, digest2, bundleSchema, sha256;
+var init_bundle = __esm({
+  "src/distribution/bundle.ts"() {
+    "use strict";
+    init_storage();
+    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+    digest2 = z25.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z25.object({
+      format: z25.literal(1),
+      version: z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z25.enum(targets),
+      nodeVersion: z25.string(),
+      files: z25.record(digest2)
+    }).strict();
+    sha256 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
+  }
+});
+
+// src/distribution/runtime.ts
+import fs25 from "fs/promises";
+import { unlinkSync } from "fs";
+import os5 from "os";
+import path32 from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import { z as z26 } from "zod";
+async function pruneUnusedVersions(home) {
+  const versions = await storePath(home, "versions");
+  const candidates = [];
+  const initial = await readInstallation(home);
+  const initialKeep = /* @__PURE__ */ new Set([initial.current, initial.previous?.id, initial.pending?.id]);
+  for (const name of await fs25.readdir(versions)) {
+    const retired = /^\.retired-([a-f0-9]{24})-[a-f0-9-]+$/.exec(name);
+    const id = retired?.[1] ?? name;
+    if (!/^[a-f0-9]{24}$/.test(id) || initialKeep.has(id)) continue;
+    try {
+      const directory = await storePath(home, `versions/${name}`);
+      await fs25.access(await storePath(directory, "app/dist/mason-runtime.js"));
+      const bundle = await verifyBundle(directory);
+      if (bundle.manifestHash.slice(0, 24) === id && bundle.manifest.files["app/dist/mason-runtime.js"])
+        candidates.push({ id, directory, retired: !!retired });
+    } catch {
+    }
+  }
+  if (!candidates.length) return;
+  const garbage = [];
+  await withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    const keep = /* @__PURE__ */ new Set([record.current, record.previous?.id, record.pending?.id]);
+    const directory = await storePath(home, "runtimes");
+    const leases = await fs25.readdir(directory).catch((error) => {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    });
+    for (const name of leases) {
+      if (!/^[a-f0-9-]+\.json$/.test(name)) return;
+      try {
+        const raw = await readStoreJson(home, `runtimes/${name}`);
+        if (raw === null) continue;
+        const lease = leaseSchema.parse(raw);
+        if (lease.host !== os5.hostname()) return;
+        try {
+          process.kill(lease.pid, 0);
+          keep.add(lease.bundle);
+        } catch (error) {
+          if (error.code !== "ESRCH") return;
+          await fs25.rm(await storePath(home, `runtimes/${name}`), { force: true });
+        }
+      } catch {
+        return;
+      }
+    }
+    for (const candidate of candidates) {
+      if (keep.has(candidate.id)) continue;
+      try {
+        const retired = candidate.retired ? candidate.directory : await storePath(home, `versions/.retired-${candidate.id}-${randomUUID8()}`);
+        if (!candidate.retired) await fs25.rename(candidate.directory, retired);
+        garbage.push(retired);
+      } catch {
+      }
+    }
+  });
+  for (const directory of garbage) await fs25.rm(directory, { recursive: true }).catch(() => {
+  });
+}
+var leaseSchema;
+var init_runtime2 = __esm({
+  "src/distribution/runtime.ts"() {
+    "use strict";
+    init_store();
+    init_storage();
+    init_state();
+    init_bundle();
+    leaseSchema = z26.object({ pid: z26.number().int().positive(), host: z26.string(), bundle: z26.string().regex(/^[a-f0-9]{24}$/) });
+  }
+});
+
+// src/distribution/sessions.ts
+import fs26 from "fs/promises";
+import os6 from "os";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z27 } from "zod";
+async function hasRunningMcp(home) {
+  const directory = await storePath(home, "sessions");
+  const files = await fs26.readdir(directory).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  for (const name of files) {
+    if (!/^[a-f0-9-]+\.json$/.test(name)) return true;
+    const relative = "sessions/" + name;
+    try {
+      const raw = await readStoreJson(home, relative);
+      if (raw === null) continue;
+      const lease = leaseSchema2.parse(raw);
+      if (lease.host !== os6.hostname()) return true;
+      try {
+        process.kill(lease.pid, 0);
+        return true;
+      } catch (error) {
+        if (error.code !== "ESRCH") return true;
+      }
+      await fs26.rm(await storePath(home, relative), { force: true });
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+async function registerMcp(home) {
+  const name = `sessions/${randomUUID9()}.json`;
+  await writeStoreJson(home, name, { pid: process.pid, host: os6.hostname() });
+  return async () => {
+    await fs26.rm(await storePath(home, name), { force: true }).catch(() => {
+    });
+  };
+}
+var leaseSchema2;
+var init_sessions = __esm({
+  "src/distribution/sessions.ts"() {
+    "use strict";
+    init_storage();
+    leaseSchema2 = z27.object({ pid: z27.number().int().positive(), host: z27.string() });
+  }
+});
+
 // src/distribution/install.ts
 var install_exports2 = {};
 __export(install_exports2, {
   WINDOWS_BATCH_LAUNCHER: () => WINDOWS_BATCH_LAUNCHER,
   defaultHome: () => defaultHome,
   installStandalone: () => installStandalone,
+  prepareStandaloneMcp: () => prepareStandaloneMcp,
+  rollbackStandalone: () => rollbackStandalone,
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs22 from "fs/promises";
-import os4 from "os";
-import path28 from "path";
-import { fileURLToPath } from "url";
-import { spawn } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
-import { z as z25 } from "zod";
+import fs27 from "fs/promises";
+import os7 from "os";
+import path33 from "path";
+import { execFile as execFile6, spawn } from "child_process";
+import { promisify as promisify6 } from "util";
+import { randomUUID as randomUUID10 } from "crypto";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID8();
+  const temp = file + ".tmp-" + randomUUID10();
   try {
-    await fs22.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs22.rename(temp, file);
+    await fs27.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs27.rename(temp, file);
   } finally {
-    await fs22.rm(temp, { force: true });
+    await fs27.rm(temp, { force: true });
   }
 }
-async function installStandalone(source, progress2) {
+async function installStandalone(source, progress2, options = {}) {
   progress2?.step("Checking installation files and location");
   const bundle = await verifyBundle(source);
-  const selectedHome = path28.resolve(defaultHome());
-  await fs22.mkdir(selectedHome, { recursive: true });
-  const home = await fs22.realpath(selectedHome);
-  const selectedBin = path28.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path28.join(home, "bin") : path28.join(os4.homedir(), ".local/bin")));
-  return withLock(home, ".install-lock", async () => {
-    const raw = await readStoreJson(home, "install.json");
-    const previous = raw === null ? null : recordSchema3.parse(raw);
-    if (!previous) for (const file of await fs22.readdir(home)) {
-      if (file === ".install-lock") continue;
-      const directory = path28.join(home, file);
-      const stat = await fs22.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs22.readdir(directory)).length) {
-        throw new Error("Mason installation directory is not empty and has no ownership receipt.");
-      }
-    }
-    await fs22.mkdir(selectedBin, { recursive: true });
-    const bin = await fs22.realpath(selectedBin);
-    if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
-    const id = bundle.manifestHash.slice(0, 24);
-    const destination = await storePath(home, "versions/" + id);
-    const launchers = process.platform === "win32" ? {
-      "mason.cmd": WINDOWS_BATCH_LAUNCHER,
-      "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
+  const selectedHome = path33.resolve(defaultHome());
+  if (!options.stageOnly) await fs27.mkdir(selectedHome, { recursive: true });
+  const home = await fs27.realpath(selectedHome);
+  if (options.stageOnly) {
+    assertUpdatePolicy(await readInstallation(home), bundle.manifest.version, options.policyRevision);
+    const destination = await storePath(home, "versions/" + bundle.manifestHash.slice(0, 24));
+    await copyBundle(home, source, destination, bundle);
+    const { stdout } = await promisify6(execFile6)(
+      path33.join(destination, process.platform === "win32" ? "node.exe" : "node"),
+      [path33.join(destination, "app/dist/mason.js"), "--version"],
+      { timeout: 3e4, windowsHide: true, env: { ...process.env, MASON_NO_AUTO_UPDATE: "1" } }
+    );
+    if (stdout.trim() !== bundle.manifest.version) throw new Error("Downloaded Mason failed its version health check.");
+  }
+  return withLock(home, ".install-lock", () => installLocked2(home, source, bundle, progress2, options));
+}
+function assertUpdatePolicy(record, version, revision) {
+  if (!record || !automaticUpdatesAllowed(record, { ...process.env, MASON_VERSION: "" }) || record.updates?.revision !== revision || !newerStableVersion(version, record.version)) {
+    throw new Error("Update policy or installed version changed; download was not activated.");
+  }
+}
+async function installLocked2(home, source, bundle, progress2, options, alreadyStaged = false) {
+  const raw = await readStoreJson(home, "install.json");
+  const previous = raw === null ? null : recordSchema3.parse(raw);
+  if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
+  if (!previous) for (const file of await fs27.readdir(home)) {
+    if (file === ".install-lock") continue;
+    const directory = path33.join(home, file);
+    const stat = await fs27.lstat(directory);
+    if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs27.readdir(directory)).length) {
+      throw new Error("Mason installation directory is not empty and has no ownership receipt.");
+    }
+  }
+  const selectedBin = path33.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path33.join(home, "bin") : path33.join(os7.homedir(), ".local/bin")));
+  await fs27.mkdir(selectedBin, { recursive: true });
+  const bin = await fs27.realpath(selectedBin);
+  if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
+  const id = bundle.manifestHash.slice(0, 24);
+  const destination = await storePath(home, "versions/" + id);
+  if (options.stageOnly) {
+    const receipt2 = { ...previous, pending: { id, version: bundle.manifest.version, policyRevision: options.policyRevision } };
+    await writeStoreJson(home, "install.json", receipt2);
+    return { home, bin, version: bundle.manifest.version, previousVersion: previous.version, path: { message: "Update staged for a future MCP launch." } };
+  }
+  const launchers = process.platform === "win32" ? {
+    "mason.cmd": WINDOWS_BATCH_LAUNCHER,
+    "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
 $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path28.join(destination, "node.exe"))} ${psQuote(path28.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path33.join(destination, "node.exe"))} ${psQuote(path33.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path28.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path33.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -6127,88 +6613,207 @@ try {
 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 }
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
-    } : { mason: `#!/bin/sh
-exec ${shQuote(path28.join(destination, "node"))} ${shQuote(path28.join(destination, "app/dist/mason.js"))} "$@"
+  } : { mason: `#!/bin/sh
+exec ${shQuote(path33.join(destination, "node"))} ${shQuote(path33.join(destination, "app/dist/mason.js"))} "$@"
 ` };
-    for (const [name, content2] of Object.entries(launchers)) {
-      const file = await storePath(bin, name);
-      const old = await fs22.readFile(file, "utf8").catch((error) => {
-        if (error.code === "ENOENT") return null;
-        throw error;
-      });
-      if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  for (const [name, content2] of Object.entries(launchers)) {
+    const file = await storePath(bin, name);
+    const old = await fs27.readFile(file, "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  }
+  const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+  const checkRetired = async (name, expected) => {
+    if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+    const actual = await fs27.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+  };
+  for (const [name, expected] of retired) await checkRetired(name, expected);
+  progress2?.step(`Installing Mason ${bundle.manifest.version}`);
+  const updates = options.preservePolicy && previous?.updates ? { ...previous.updates } : {
+    ...previous?.updates ?? { enabled: !previous && !process.env.CI && process.env.MASON_NO_AUTO_UPDATE !== "1" },
+    revision: randomUUID10(),
+    pinnedVersion: process.env.MASON_VERSION?.replace(/^v/, "") || void 0,
+    mirror: process.env.MASON_RELEASE_BASE || previous?.updates?.mirror
+  };
+  if (options.rollback) {
+    updates.pinnedVersion = bundle.manifest.version;
+    updates.revision = randomUUID10();
+  }
+  const receipt = {
+    format: 1,
+    home,
+    bin,
+    current: id,
+    version: bundle.manifest.version,
+    launchers,
+    pathChanges: previous?.pathChanges ?? [],
+    updates,
+    previous: previous && previous.current !== id ? { id: previous.current, version: previous.version } : previous?.previous
+  };
+  await writeStoreJson(home, "install.json", previous ? { ...previous, previousLaunchers: launchers } : receipt);
+  try {
+    if (!alreadyStaged) await copyBundle(home, source, destination, bundle);
+    for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+    for (const [name, expected] of retired) {
+      await checkRetired(name, expected);
+      await fs27.rm(await storePath(bin, name), { force: true });
     }
-    const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
-    const checkRetired = async (name, expected) => {
-      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs22.readFile(await storePath(bin, name), "utf8").catch((error) => {
-        if (error.code === "ENOENT") return null;
-        throw error;
-      });
-      if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
-    };
-    for (const [name, expected] of retired) await checkRetired(name, expected);
-    progress2?.step(`Installing Mason ${bundle.manifest.version}`);
-    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
-    await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs22.mkdir(stage);
+    await writeStoreJson(home, "install.json", receipt);
+  } catch (error) {
+    if (previous) {
+      for (const [name, content2] of Object.entries(previous.launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      await writeStoreJson(home, "install.json", previous);
+    }
+    throw error;
+  }
+  if (options.preservePolicy) return { home, bin, version: receipt.version, previousVersion: previous?.version, path: { message: "Installation selected." } };
+  progress2?.step("Checking terminal command availability");
+  const pathResult = await configurePath(bin, receipt.pathChanges ?? [], async (changes) => {
+    receipt.pathChanges = changes;
+    await writeStoreJson(home, "install.json", receipt);
+  });
+  return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+}
+async function copyBundle(home, source, destination, bundle) {
+  const exists = await fs27.lstat(destination).then(() => true, (error) => {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  });
+  if (exists) {
+    await verifyBundle(destination, bundle.manifestHash);
+    return;
+  }
+  const stage = await storePath(home, "versions/.install-" + randomUUID10(), true);
+  await fs27.mkdir(stage);
+  try {
+    for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
+      const from = await storePath(source, file), to = await storePath(stage, file, true);
+      await fs27.copyFile(from, to);
+      await fs27.chmod(to, (await fs27.stat(from)).mode & 511);
+    }
+    await verifyBundle(stage, bundle.manifestHash);
     try {
-      for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
-        const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs22.copyFile(from, to);
-        await fs22.chmod(to, (await fs22.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, bundle.manifestHash);
-      const exists = await fs22.lstat(destination).then(() => true, (error) => {
-        if (error.code === "ENOENT") return false;
+      await fs27.rename(stage, destination);
+    } catch (error) {
+      try {
+        await verifyBundle(destination, bundle.manifestHash);
+      } catch {
         throw error;
-      });
-      if (exists) await verifyBundle(destination, bundle.manifestHash);
-      else await fs22.rename(stage, destination);
-      for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
-      for (const [name, expected] of retired) {
-        await checkRetired(name, expected);
-        await fs22.rm(await storePath(bin, name), { force: true });
       }
-      await writeStoreJson(home, "install.json", receipt);
-    } finally {
-      await fs22.rm(stage, { recursive: true, force: true });
     }
-    progress2?.step("Checking terminal command availability");
-    const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
-      receipt.pathChanges = changes;
-      await writeStoreJson(home, "install.json", receipt);
-    });
-    return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+  } finally {
+    await fs27.rm(stage, { recursive: true, force: true });
+  }
+}
+async function prepareStandaloneMcp(home) {
+  const before = await readInstallation(home), candidate = before.pending;
+  let verified, verificationError;
+  if (candidate && automaticUpdatesAllowed(before) && !await hasRunningMcp(home)) {
+    try {
+      verified = await verifyBundle(await storePath(home, "versions/" + candidate.id));
+      if (verified.manifestHash.slice(0, 24) !== candidate.id || verified.manifest.version !== candidate.version) throw new Error("Staged update changed.");
+    } catch (error) {
+      verificationError = error;
+    }
+  }
+  return withLock(home, ".install-lock", async () => {
+    let record = await readInstallation(home);
+    const pending = record.pending;
+    if (pending && candidate?.id === pending.id && (verified || verificationError) && automaticUpdatesAllowed(record) && pending.policyRevision === record.updates?.revision && newerStableVersion(pending.version, record.version) && !await hasRunningMcp(home)) {
+      try {
+        if (verificationError) throw verificationError;
+        const source = await storePath(home, "versions/" + pending.id);
+        await installLocked2(home, source, verified, void 0, { preservePolicy: true }, true);
+        record = await readInstallation(home);
+      } catch (error) {
+        record = await readInstallation(home);
+        delete record.pending;
+        await writeStoreJson(home, "install.json", record);
+        await writeStoreJson(home, "update-status.json", { lastAttempt: Date.now(), error: String(error) });
+      }
+    }
+    const release = await registerMcp(home);
+    return { bundle: await storePath(home, "versions/" + record.current), release };
   });
 }
-async function currentInstallation() {
-  const app = path28.dirname(path28.dirname(fileURLToPath(import.meta.url)));
-  const bundle = path28.dirname(app), home = path28.dirname(path28.dirname(bundle));
-  const raw = await readStoreJson(home, "install.json");
-  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
-  const record = recordSchema3.parse(raw);
-  if (record.home !== await fs22.realpath(home) || path28.dirname(bundle) !== path28.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
-  return { home, bundle, record };
+async function rollbackStandalone() {
+  const { home } = await currentInstallation();
+  return withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    if (!record.previous) throw new Error("No previous installation is available.");
+    if (await hasRunningMcp(home)) throw new Error("Close running Mason MCP sessions before rolling back.");
+    const source = await storePath(home, "versions/" + record.previous.id);
+    const bundle = await verifyBundle(source);
+    if (bundle.manifestHash.slice(0, 24) !== record.previous.id || bundle.manifest.version !== record.previous.version) throw new Error("Previous installation changed.");
+    return installLocked2(home, source, bundle, void 0, { preservePolicy: true, rollback: true });
+  });
 }
 async function upgradeStandalone(version, progress2) {
   if (version && !/^v?\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(version)) throw new Error("Expected a release version such as 0.14.0.");
   progress2?.step("Checking current installation");
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
+  const mirror = process.env.MASON_RELEASE_BASE || record.updates?.mirror || "";
+  if (mirror && !version) throw new Error("Specify a version when upgrading from a company mirror; no public latest-version lookup was made.");
+  let selected = version?.replace(/^v/, "");
+  if (!selected) {
+    progress2?.step("Checking the latest release");
+    const response = await fetch("https://github.com/adrianczuczka/mason/releases/latest", {
+      method: "HEAD",
+      redirect: "follow",
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (!response.ok) throw new Error(`Latest release request failed (HTTP ${response.status}).`);
+    selected = new URL(response.url).pathname.split("/").pop()?.replace(/^v/, "");
+    if (!selected || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(selected)) throw new Error("Invalid Mason release version.");
+  }
+  const alreadyInstalled = await withLock(home, ".install-lock", async () => {
+    const current = await readInstallation(home);
+    if (current.version !== selected) return false;
+    await verifyBundle(await storePath(home, "versions/" + current.current));
+    current.updates = {
+      ...current.updates ?? { enabled: false },
+      revision: randomUUID10(),
+      pinnedVersion: version ? selected : void 0,
+      mirror: mirror || void 0
+    };
+    delete current.pending;
+    await writeStoreJson(home, "install.json", current);
+    return true;
+  });
+  if (alreadyInstalled) {
+    progress2?.stop();
+    console.log(`Mason ${selected} is already installed.`);
+    return 0;
+  }
   const windows = process.platform === "win32";
-  const script = path28.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path33.join(bundle, windows ? "install.ps1" : "install.sh");
   progress2?.stop();
-  return new Promise((resolve, reject) => {
+  const code = await new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
-      windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script],
-      { stdio: "inherit", windowsHide: true, env: { ...process.env, MASON_HOME: home, MASON_BIN_DIR: record.bin, MASON_VERSION: version ?? "" } }
+      windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script, selected] : [script, selected],
+      { stdio: "inherit", windowsHide: true, env: {
+        ...process.env,
+        MASON_HOME: home,
+        MASON_BIN_DIR: record.bin,
+        MASON_RELEASE_BASE: process.env.MASON_RELEASE_BASE || record.updates?.mirror || "",
+        MASON_VERSION: version ?? "",
+        MASON_UPDATE_POLICY_REVISION: "",
+        MASON_EXPECTED_SHA256: ""
+      } }
     );
     child.on("error", reject);
-    child.on("exit", (code) => resolve(code ?? 2));
+    child.on("exit", (code2) => resolve(code2 ?? 2));
   });
+  if (code === 0) console.log("Restart running assistants to use this installation. Existing project integrations use mason from PATH.");
+  return code;
 }
 async function uninstallStandalone() {
   const { home, record } = await currentInstallation();
@@ -6220,7 +6825,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs22.readFile(file, "utf8").catch((error) => {
+      const actual = await fs27.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -6228,12 +6833,12 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs22.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs27.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs22.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs27.rm(home, { recursive: true, force: true });
   return home;
 }
-var recordSchema3, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
+var shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames;
 var init_install2 = __esm({
   "src/distribution/install.ts"() {
     "use strict";
@@ -6241,21 +6846,254 @@ var init_install2 = __esm({
     init_storage();
     init_store();
     init_path();
-    recordSchema3 = z25.object({
-      format: z25.literal(1),
-      home: z25.string(),
-      bin: z25.string(),
-      current: z25.string().regex(/^[a-f0-9]{24}$/),
-      version: z25.string(),
-      launchers: z25.record(z25.string()),
-      previousLaunchers: z25.record(z25.string()).optional(),
-      pathChanges: z25.array(pathChangeSchema).optional()
-    });
+    init_state();
+    init_sessions();
+    init_state();
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path28.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path28.join(os4.homedir(), ".local/share/mason"));
+  }
+});
+
+// src/distribution/updates.ts
+var updates_exports = {};
+__export(updates_exports, {
+  CHECK_INTERVAL_MS: () => CHECK_INTERVAL_MS,
+  RELEASE_AGE_MS: () => RELEASE_AGE_MS,
+  fetchVerifiedRelease: () => fetchVerifiedRelease,
+  runAutomaticUpdate: () => runAutomaticUpdate,
+  scheduleAutomaticUpdate: () => scheduleAutomaticUpdate,
+  startMcpWithUpdates: () => startMcpWithUpdates,
+  updateManifestSchema: () => updateManifestSchema,
+  updateSettings: () => updateSettings,
+  updateStatus: () => updateStatus
+});
+import fs28 from "fs/promises";
+import path34 from "path";
+import { spawn as spawn2 } from "child_process";
+import { randomUUID as randomUUID11 } from "crypto";
+import { z as z28 } from "zod";
+async function boundedDownload(url) {
+  const response = await fetch(url, { signal: AbortSignal.timeout(15e3), redirect: "follow" });
+  if (!response.ok || !response.body) throw new Error(`Update metadata request failed (HTTP ${response.status}).`);
+  if (Number(response.headers.get("content-length")) > 1024 * 1024) throw new Error("Update metadata is too large.");
+  const reader = response.body.getReader(), chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > 1024 * 1024) throw new Error("Update metadata is too large.");
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel();
+  }
+  return Buffer.concat(chunks);
+}
+async function fetchVerifiedRelease(home, now = Date.now()) {
+  const releases = releaseListSchema.parse(JSON.parse((await boundedDownload("https://api.github.com/repos/adrianczuczka/mason/releases?per_page=30")).toString("utf8")));
+  const installed = (await readInstallation(home)).version;
+  let selected;
+  for (const release of releases) {
+    const version = release.tag_name.replace(/^v/, "");
+    if (release.tag_name !== "v" + version || release.draft || release.prerelease || !release.published_at || !(now - Date.parse(release.published_at) >= RELEASE_AGE_MS) || !newerStableVersion(version, installed)) continue;
+    if (!selected || newerStableVersion(version, selected)) selected = version;
+  }
+  if (!selected) return null;
+  const bytes = await boundedDownload(`${releaseBase}/download/v${selected}/update.json`);
+  const manifest = updateManifestSchema.parse(JSON.parse(bytes.toString("utf8")));
+  if (manifest.version !== selected) throw new Error("Signed manifest does not match the selected release.");
+  const signature = JSON.parse((await boundedDownload(`${releaseBase}/download/v${manifest.version}/update.sigstore.json`)).toString("utf8"));
+  if (!signature?.messageSignature || signature.dsseEnvelope) throw new Error("Update metadata requires a detached message signature.");
+  const { verify } = await import("sigstore");
+  await verify(signature, bytes, {
+    certificateIdentityURI: `https://github.com/adrianczuczka/mason/.github/workflows/publish.yml@refs/tags/v${manifest.version}`,
+    certificateIssuer: "https://token.actions.githubusercontent.com",
+    tufCachePath: await storePath(home, "sigstore-cache"),
+    timeout: 1e4,
+    retry: 0,
+    ctLogThreshold: 1,
+    tlogThreshold: 1
+  });
+  return manifest;
+}
+async function runInstaller(home, version, digest3, revision) {
+  const record = await readInstallation(home);
+  const bundle = await storePath(home, "versions/" + record.current);
+  await verifyBundle(bundle);
+  const windows = process.platform === "win32", script = path34.join(bundle, windows ? "install.ps1" : "install.sh");
+  await new Promise((resolve, reject) => {
+    const child = spawn2(windows ? "powershell.exe" : "sh", windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script], {
+      cwd: home,
+      windowsHide: true,
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: 10 * 60 * 1e3,
+      env: {
+        ...process.env,
+        MASON_HOME: home,
+        MASON_BIN_DIR: record.bin,
+        MASON_VERSION: version,
+        MASON_RELEASE_BASE: "",
+        MASON_EXPECTED_SHA256: digest3,
+        MASON_UPDATE_POLICY_REVISION: revision
+      }
+    });
+    let diagnostic = "";
+    child.stderr.on("data", (bytes) => {
+      diagnostic = (diagnostic + bytes).slice(-4e3);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`Update download failed (${code}): ${diagnostic.trim()}`)));
+  });
+}
+async function runAutomaticUpdate(home, dependencies = { fetchRelease: fetchVerifiedRelease, install: runInstaller }, now = Date.now()) {
+  await withLock(home, ".update-lock", async () => {
+    const record = await readInstallation(home);
+    if (!automaticUpdatesAllowed(record)) return;
+    const old = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    if (old.success && now - old.data.lastAttempt < CHECK_INTERVAL_MS && old.data.lastAttempt <= now) return;
+    const status = { lastAttempt: now };
+    await writeStoreJson(home, "update-status.json", status);
+    try {
+      await pruneUnusedVersions(home).catch(() => {
+      });
+      const release = await dependencies.fetchRelease(home);
+      if (!release) return;
+      status.availableVersion = release.version;
+      const age = now - Date.parse(release.publishedAt);
+      if (age >= RELEASE_AGE_MS && newerStableVersion(release.version, record.version) && (!record.pending || newerStableVersion(release.version, record.pending.version))) {
+        const asset = `mason-${process.platform}-${process.arch}.${process.platform === "win32" ? "zip" : "tar.gz"}`;
+        const digest3 = release.assets[asset];
+        if (!digest3) throw new Error("Signed release has no archive for this platform.");
+        const fresh = await readInstallation(home);
+        if (automaticUpdatesAllowed(fresh) && fresh.updates?.revision === record.updates.revision && newerStableVersion(release.version, fresh.version)) {
+          await dependencies.install(home, release.version, digest3, record.updates.revision);
+        }
+      }
+    } catch (error) {
+      status.error = error instanceof Error ? error.message : String(error);
+    }
+    if (await fs28.access(path34.join(home, "install.json")).then(() => true, () => false)) await writeStoreJson(home, "update-status.json", status);
+  }, 0);
+}
+async function scheduleAutomaticUpdate() {
+  try {
+    const { home, record } = await currentInstallation();
+    if (!automaticUpdatesAllowed(record)) return;
+    const status = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    const now = Date.now();
+    if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
+    const bundle = await storePath(home, "versions/" + record.current);
+    const child = spawn2(
+      path34.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path34.join(bundle, "app/dist/mason.js"), "internal-update"],
+      { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
+    );
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function updateSettings(home, action) {
+  return withLock(home, ".install-lock", async () => {
+    const record = await readInstallation(home);
+    const updates = { ...record.updates ?? { enabled: false }, revision: randomUUID11() };
+    if (action === "enable") updates.enabled = true;
+    if (action === "disable") updates.enabled = false;
+    if (action === "pin") updates.pinnedVersion = record.version;
+    if (action === "unpin") delete updates.pinnedVersion;
+    record.updates = updates;
+    delete record.pending;
+    await writeStoreJson(home, "install.json", record);
+    return record;
+  });
+}
+async function updateStatus(home) {
+  const record = await readInstallation(home);
+  const lastCheck = statusSchema2.parse(await readStoreJson(home, "update-status.json") ?? { lastAttempt: 0 });
+  return {
+    version: record.version,
+    enabled: record.updates?.enabled ?? false,
+    effective: automaticUpdatesAllowed(record),
+    pinnedVersion: record.updates?.pinnedVersion ?? null,
+    mirror: record.updates?.mirror ?? null,
+    pendingVersion: record.pending?.version ?? null,
+    lastCheck: lastCheck.lastAttempt ? lastCheck : null
+  };
+}
+async function startMcpWithUpdates(start) {
+  const current = standaloneLocation();
+  if (!current) {
+    await start();
+    return;
+  }
+  const session = await prepareStandaloneMcp(current.home);
+  if (session.bundle !== current.bundle) {
+    const child = spawn2(
+      path34.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path34.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      { stdio: "inherit", windowsHide: true }
+    );
+    const interrupt = () => {
+      child.kill("SIGINT");
+    }, terminate = () => {
+      child.kill("SIGTERM");
+    };
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    try {
+      process.exitCode = await new Promise((resolve, reject) => {
+        child.on("error", reject);
+        child.on("exit", (code) => resolve(code ?? 1));
+      });
+    } finally {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+      await session.release();
+    }
+    return;
+  }
+  const timer = setInterval(() => {
+    void scheduleAutomaticUpdate();
+  }, 60 * 60 * 1e3);
+  timer.unref();
+  const stop = () => {
+    clearInterval(timer);
+    void session?.release();
+  };
+  try {
+    await start(stop);
+    void scheduleAutomaticUpdate();
+  } catch (error) {
+    stop();
+    throw error;
+  }
+}
+var CHECK_INTERVAL_MS, RELEASE_AGE_MS, releaseBase, releaseListSchema, updateManifestSchema, statusSchema2;
+var init_updates = __esm({
+  "src/distribution/updates.ts"() {
+    "use strict";
+    init_store();
+    init_storage();
+    init_state();
+    init_bundle();
+    init_runtime2();
+    init_install2();
+    CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+    RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
+    releaseBase = "https://github.com/adrianczuczka/mason/releases";
+    releaseListSchema = z28.array(z28.object({ tag_name: z28.string(), draft: z28.boolean(), prerelease: z28.boolean(), published_at: z28.string().nullable() }));
+    updateManifestSchema = z28.object({
+      format: z28.literal(1),
+      version: z28.string().regex(/^\d+\.\d+\.\d+$/),
+      publishedAt: z28.string().datetime(),
+      assets: z28.record(z28.string().regex(/^[a-f0-9]{64}$/))
+    }).strict();
+    statusSchema2 = z28.object({ lastAttempt: z28.number(), availableVersion: z28.string().optional(), error: z28.string().optional() });
   }
 });
 
@@ -6452,7 +7290,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.18.0"}
+var usage = `Mason ${"0.19.1"}
 
 Usage: mason <command> [options]
 
@@ -6465,6 +7303,9 @@ Usage: mason <command> [options]
   drift                      Check an optional architecture map
   mcp                        Run the MCP server (stdio)
   upgrade [version]          Upgrade the standalone user installation
+  updates [status|enable|disable|pin|unpin]
+                             Manage automatic standalone updates
+  rollback                   Restore and pin the previous standalone version
   uninstall                  Remove that installation; retain project data
 
 Use mason <command> --help for options. npm users can keep using mason-auto,
@@ -6478,19 +7319,67 @@ try {
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.18.0" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.1" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.18.0");
-  else if (command === "internal-install") {
+  else if (["--version", "-v"].includes(command)) console.log("0.19.1");
+  else if (command === "internal-update") {
+    if (args.length) throw new Error("internal-update takes no arguments.");
+    const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
+    const { runAutomaticUpdate: runAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+    await runAutomaticUpdate2((await currentInstallation2()).home);
+  } else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
     const bundleRoot = fileURLToPath2(new URL("../..", import.meta.url));
     progress = createProgress();
-    const installed = await installStandalone2(bundleRoot, progress);
+    const policyRevision = process.env.MASON_UPDATE_POLICY_REVISION;
+    if (policyRevision && !/^[a-f0-9]{64}$/.test(process.env.MASON_EXPECTED_SHA256 ?? "")) throw new Error("Automatic staging requires a verified release checksum.");
+    const installed = await installStandalone2(bundleRoot, progress, { stageOnly: !!policyRevision, policyRevision });
     progress.stop();
     const outcome = installed.previousVersion && installed.previousVersion !== installed.version ? `Updated Mason ${installed.previousVersion} \u2192 ${installed.version}` : `Installed Mason ${installed.version}`;
-    console.log(`${outcome} in ${installed.home}.
-${installed.path.message}`);
+    if (policyRevision) console.log(`Staged Mason ${installed.version}. It will activate at a future MCP launch after existing servers exit.`);
+    else {
+      const { updateStatus: updateStatus2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      const status = await updateStatus2(installed.home);
+      const policy = status.pinnedVersion ? `pinned to ${status.pinnedVersion}` : status.mirror ? "managed by your mirror" : status.enabled ? "enabled" : "disabled";
+      console.log(`${outcome} in ${installed.home}.
+${installed.path.message}
+Automatic updates: ${policy}. Manage with mason updates.`);
+    }
+  } else if (command === "updates") {
+    if (args.includes("--help")) console.log("Usage: mason updates [status|enable|disable|pin|unpin] [--json]. Pin holds the installed version; mason upgrade <version> installs and pins a specific release. Environment and mirror restrictions still apply.");
+    else {
+      const action = args.filter((arg) => arg !== "--json")[0] ?? "status";
+      if (args.filter((arg) => arg !== "--json").length > 1 || !["status", "enable", "disable", "pin", "unpin"].includes(action)) throw new Error("Usage: mason updates [status|enable|disable|pin|unpin] [--json]");
+      const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
+      const { updateSettings: updateSettings2, updateStatus: updateStatus2, scheduleAutomaticUpdate: scheduleAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      const { home } = await currentInstallation2();
+      if (action !== "status") await updateSettings2(home, action);
+      const status = await updateStatus2(home);
+      if (args.includes("--json")) console.log(JSON.stringify(status));
+      else {
+        console.log(`Mason ${status.version}
+Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${status.enabled ? "enabled" : "disabled"}).`);
+        if (status.pinnedVersion) console.log(`Pinned to ${status.pinnedVersion}. Run mason updates unpin to follow stable releases.`);
+        if (status.mirror) console.log("Company mirror installation: automatic public updates are disabled.");
+        if (!status.effective && status.enabled && !status.pinnedVersion && !status.mirror) console.log("Suppressed by CI, MASON_NO_AUTO_UPDATE, MASON_VERSION, or MASON_RELEASE_BASE.");
+        if (status.pendingVersion) console.log(`Downloaded ${status.pendingVersion}; activates on a future MCP launch after existing servers exit.`);
+        if (status.lastCheck) {
+          console.log(`Last check: ${new Date(status.lastCheck.lastAttempt).toISOString()}`);
+          if (status.lastCheck.availableVersion) console.log(`Available stable release: ${status.lastCheck.availableVersion}`);
+          if (status.lastCheck.error) console.log(`Last update problem: ${status.lastCheck.error}`);
+        }
+      }
+      if (action === "enable" || action === "unpin") void scheduleAutomaticUpdate2();
+    }
+  } else if (command === "rollback") {
+    if (args.includes("--help")) console.log("Usage: mason rollback. Close running Mason MCP servers, then restore and pin the previous installed version.");
+    else {
+      if (args.length) throw new Error("rollback takes no arguments.");
+      const { rollbackStandalone: rollbackStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
+      const restored = await rollbackStandalone2();
+      console.log(`Restored Mason ${restored.version} and pinned it. Run mason updates unpin to resume automatic updates.`);
+    }
   } else if (command === "upgrade" || command === "uninstall") {
     if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Configured projects use the upgraded command on their next launch. Restart running assistants." : "Usage: mason uninstall. Removes the standalone user installation; project configuration and knowledge are retained. Run mason teardown in each project first to disconnect its integrations.");
     else {
@@ -6499,7 +7388,6 @@ ${installed.path.message}`);
       if (command === "upgrade") {
         progress = createProgress();
         process.exitCode = await upgradeStandalone2(args[0], progress);
-        if (process.exitCode === 0) console.log("Restart running assistants to use this installation. Existing project integrations use mason from PATH.");
       } else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configuration and knowledge were retained. Reinstall Mason to use its integrations.");
     }
   } else if (["setup", "teardown", "status", "check", "auto"].includes(command)) {
@@ -6515,6 +7403,10 @@ ${installed.path.message}`);
       void 0,
       { managedHost: managedLaunch ? setupHost : void 0 }
     );
+    if (command === "setup" && process.exitCode === 0 && !args.includes("--help")) {
+      const { scheduleAutomaticUpdate: scheduleAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
+      void scheduleAutomaticUpdate2();
+    }
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
     process.argv = [process.execPath, fileURLToPath2(binary), ...args];