memgineering 0.25.0 → 0.25.2

package/dist/index.js

@@ -1341,8 +1341,8 @@ var init_exclude = __esm({
       [...ALWAYS_SKIP_DIRS].map((d) => fold(d))
     );
     ALWAYS_SKIP_SEGMENTS_FOLDED = ALWAYS_SKIP_SEGMENTS.map((s) => fold(s));
-    ALWAYS_SKIP_FILE = (basename3) => {
-      const b = fold(basename3);
+    ALWAYS_SKIP_FILE = (basename4) => {
+      const b = fold(basename4);
       return b.startsWith(".env") || b === ".ds_store" || b === ".memgdeny" || b === ".memgallow" || b === ".memgignore";
     };
     EMPTY_IGNORE_SET = { rules: [], unsupported: [] };
@@ -2441,14 +2441,6 @@ var init_planner = __esm({
   }
 });
 
-// ../../packages/memory-engine/src/recall/semantic.ts
-var init_semantic = __esm({
-  "../../packages/memory-engine/src/recall/semantic.ts"() {
-    "use strict";
-    init_markdown_mapping();
-  }
-});
-
 // ../../packages/memory-engine/src/base-templates.ts
 function base(id, title, summary, body) {
   return [
@@ -2556,6 +2548,14 @@ var init_base_templates = __esm({
   }
 });
 
+// ../../packages/memory-engine/src/recall/semantic.ts
+var init_semantic = __esm({
+  "../../packages/memory-engine/src/recall/semantic.ts"() {
+    "use strict";
+    init_base_templates();
+  }
+});
+
 // ../../packages/memory-engine/src/recall/unfilled.ts
 var UNFILLED_FIELDS;
 var init_unfilled = __esm({
@@ -2577,6 +2577,13 @@ var init_unfilled = __esm({
   }
 });
 
+// ../../packages/memory-engine/src/setup-progress.ts
+var init_setup_progress = __esm({
+  "../../packages/memory-engine/src/setup-progress.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/memory-engine/src/recall/query-prefix.ts
 var init_query_prefix = __esm({
   "../../packages/memory-engine/src/recall/query-prefix.ts"() {
@@ -4030,6 +4037,7 @@ function saysNothingNew(entry, input, normalize) {
   if (norm(claim.text) !== norm(previousClaim(entry))) return false;
   if (claim.summary != null && norm(claim.summary) !== norm(entry.memory.summary)) return false;
   if (claim.title != null && norm(claim.title) !== norm(entry.memory.title)) return false;
+  if (claim.binding != null && claim.binding !== (entry.memory.binding === true)) return false;
   const declared = new Set(
     entry.relations.filter((r) => r.type === "contradicts").map((r) => r.to)
   );
@@ -4904,6 +4912,7 @@ var init_src = __esm({
     init_planner();
     init_semantic();
     init_unfilled();
+    init_setup_progress();
     init_query_prefix();
     init_base_templates();
     init_scope_spread();
@@ -5137,7 +5146,7 @@ async function apiRequest(args) {
     if (cause.retryable && attempts < MAX_CONNECT_RETRIES) {
       const backoff = args.backoffMs ?? CONNECT_BACKOFF_MS;
       const wait = backoff[Math.min(attempts, backoff.length - 1)] ?? 0;
-      await new Promise((resolve16) => setTimeout(resolve16, wait));
+      await new Promise((resolve17) => setTimeout(resolve17, wait));
       return apiRequest({ ...args, connectRetries: attempts + 1 });
     }
     throw memgError(
@@ -5161,7 +5170,7 @@ async function apiRequest(args) {
   if (res.status === 429 && (args.retries ?? MAX_RATE_LIMIT_RETRIES) > 0) {
     const wait = retryAfterMs(res.headers.get("retry-after"));
     args.onWait?.(wait);
-    await new Promise((resolve16) => setTimeout(resolve16, wait));
+    await new Promise((resolve17) => setTimeout(resolve17, wait));
     return apiRequest({ ...args, retries: (args.retries ?? MAX_RATE_LIMIT_RETRIES) - 1 });
   }
   const envelope = parsed?.error;
@@ -5348,6 +5357,25 @@ function findBrain(cfg, root) {
   const target = resolve(root);
   return cfg.brain.brains.find((b) => resolve(b.root) === target);
 }
+async function clearSetupFollowUps(onlyPath) {
+  try {
+    const cfg = await loadConfig();
+    const pending = cfg.system.pendingUpload;
+    const dropUpload = pending !== void 0 && (onlyPath === void 0 || resolve(pending.path) === resolve(onlyPath));
+    const dropConnected = onlyPath === void 0 && cfg.system.setupConnected !== void 0;
+    if (!dropUpload && !dropConnected) return;
+    const { pendingUpload, setupConnected, ...rest } = cfg.system;
+    await saveConfig({
+      ...cfg,
+      system: {
+        ...rest,
+        ...dropUpload ? {} : pendingUpload ? { pendingUpload } : {},
+        ...dropConnected ? {} : setupConnected ? { setupConnected } : {}
+      }
+    });
+  } catch {
+  }
+}
 var BrainSchema, ConfigSchema, EMPTY_CONFIG;
 var init_config = __esm({
   "src/lib/config.ts"() {
@@ -5486,7 +5514,38 @@ var init_config = __esm({
          * Absent means "written before this field existed", which is the same
          * answer as "older than this CLI" and wants the same one command.
          */
-        guidanceVersion: z8.string().optional()
+        guidanceVersion: z8.string().optional(),
+        /**
+         * The person's answer to "arm the hooks?", as they gave it — not whether
+         * this machine's tools could take one. A flag-less `setup` reads it back,
+         * so a refresh keeps what they chose instead of setup's default (0.25.2).
+         * Absent on a machine set up before it was recorded.
+         */
+        hook: z8.enum(["on", "off"]).optional().catch(void 0),
+        /**
+         * Notes `setup --web` was asked to upload, not yet sent.
+         *
+         * The detached half of the setup never uploads on its own (security
+         * audit H-3): whoever confirmed the setup decided which account receives
+         * the notes, and that is checked by somebody on THIS machine first. The
+         * next command's notice names the path and the receiving account; a
+         * `push` of that path, or `logout`, clears it.
+         */
+        pendingUpload: z8.object({
+          path: z8.string().min(1),
+          brain: z8.string().nullable(),
+          /** The notice names the brain by id only: its name came from the screen. */
+          brain_id: z8.string().nullable().optional(),
+          account_id: z8.string().min(1),
+          account_email: z8.string().nullable(),
+          at: z8.string().min(1)
+        }).optional().catch(void 0),
+        /**
+         * The account a `setup --web` signed this machine into, when it had no
+         * sign-in before — shown once by the next command, because there was no
+         * earlier account to compare it with (H-3).
+         */
+        setupConnected: z8.object({ account_id: z8.string().min(1), email: z8.string().nullable(), at: z8.string().min(1) }).optional().catch(void 0)
       }).default({ autoUpdate: "on" })
     });
     EMPTY_CONFIG = ConfigSchema.parse({});
@@ -5503,6 +5562,10 @@ async function openCloudBrain(target) {
     apiUrl: target.apiUrl
   };
 }
+function connectorLabel(writtenBy) {
+  const app = writtenBy.replace(/^mcp:/, "").replace(/[^A-Za-z0-9 ._-]/g, "").replace(/\s+/g, " ").trim().slice(0, 32).trim();
+  return app === "" || app.toLowerCase() === "connector" ? "written by a chat connector" : `written by the ${app} connector`;
+}
 function findCloudBrain(brains, named) {
   return brains.find((brain) => brain.id === named) ?? brains.find((brain) => brain.name === named);
 }
@@ -7054,12 +7117,12 @@ var init_deadline = __esm({
 import { spawn } from "child_process";
 async function openBrowser(url) {
   const { file, args } = browserOpener(url);
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let settled = false;
     const finish = (opened) => {
       if (settled) return;
       settled = true;
-      resolve16(opened);
+      resolve17(opened);
     };
     const child = spawn(file, args, { detached: true, stdio: "ignore" });
     child.on("error", () => finish(false));
@@ -7089,7 +7152,7 @@ function loginCommand() {
     "start the sign-in, open the browser, and return immediately \u2014 THE path an agent should use on a user\u2019s behalf; the next command claims the token automatically. Prefer this over the plain form, whose wait for a human click will outlast an agent\u2019s command timeout"
   ).option("--no-browser", "do not try to open a browser \u2014 just print the link").option("--print-url", "print the approval link even when a browser opened").addHelpText(
     "after",
-    "\nAgents: run `login --emit-only`, then SHOW the code in your reply. The\napproval page asks the user to check it against what you showed them,\nand they cannot if you never showed it. Do not ask the user to run a\nlogin command themselves."
+    "\nAgents: run `login --emit-only`, then SHOW the code in your reply. The\napproval page asks the user to type it, and they cannot if you never\nshowed it. Do not ask the user to run a login command themselves."
   ).action(async (opts) => {
     const base2 = apiUrl();
     const already = await currentCredentials(base2);
@@ -7140,7 +7203,11 @@ async function startPairing(base2) {
   const res = await apiRequest({
     method: "POST",
     path: "/v1/auth/device/code",
-    baseUrl: base2
+    baseUrl: base2,
+    // Display text for the approval screen — "requested from memgineering on
+    // darwin" — so a person can tell their own terminal's request from a link
+    // somebody sent them (security audit H-2). Nothing identifying.
+    body: { platform: process.platform, client: `memgineering/${VERSION}` }
   });
   const { device_code, user_code, verification_url, expires_in } = res.body ?? {};
   if (!device_code || !user_code || !verification_url) {
@@ -7171,10 +7238,10 @@ function emit(pending, ctx) {
       browser_opened: ctx.opened,
       api_url: ctx.base,
       waiting: ctx.blocking,
-      next: ctx.blocking ? "Waiting for approval in the browser." : "SHOW user_code to the user in your reply, then run any memgineering command \u2014 the token is claimed automatically once they approve. The approval screen asks THEM to agree to the terms and the privacy policy and to confirm they are 14 or older; you cannot answer that for them, and an account is not created until they do."
+      next: ctx.blocking ? "Waiting for approval in the browser." : "SHOW user_code to the user in your reply \u2014 the approval screen asks them to type it \u2014 then run any memgineering command; the token is claimed automatically once they approve. The approval screen also asks THEM to agree to the terms and the privacy policy and to confirm they are 14 or older; you cannot answer that for them, and an account is not created until they do."
     },
     human: () => {
-      printHuman("Show this code to whoever is signing in:\n");
+      printHuman("Show this code to whoever is signing in \u2014 the approval page asks them to type it:\n");
       printHuman(`  ${c.bold().yellow(oneLine(pending.user_code, WIDTH.handle))}
 `);
       if (ctx.opened) {
@@ -7267,9 +7334,10 @@ var init_login = __esm({
     init_open_browser();
     init_pending_login();
     init_ui();
+    init_version();
     BLOCKING_TIMEOUT_MS = 10 * 60 * 1e3;
-    sleep = (ms) => new Promise((resolve16) => {
-      setTimeout(resolve16, ms).unref?.();
+    sleep = (ms) => new Promise((resolve17) => {
+      setTimeout(resolve17, ms).unref?.();
     });
   }
 });
@@ -7380,6 +7448,7 @@ If your notes are in one of those, that rule is why \u2014 nothing here can see
       }
     }
     const repointed = await pointConfigAt(destination);
+    await clearSetupFollowUps(local.root);
     printDual({
       json: {
         from: local.root,
@@ -7810,13 +7879,208 @@ var init_setup_signin = __esm({
   }
 });
 
+// src/lib/next-step.ts
+import { mkdir as mkdir15, readFile as readFile24, writeFile as writeFile13 } from "fs/promises";
+import { join as join23 } from "path";
+function isSetUp(cfg) {
+  return Object.keys(cfg.system.installed).length > 0;
+}
+function connectedMarker(at) {
+  return join23(brandHome(), `setup-connected-shown-${at.replace(/[^0-9A-Za-z]/g, "")}`);
+}
+async function connectedNoticeShown(at) {
+  return readFile24(connectedMarker(at), "utf8").then(
+    () => true,
+    () => false
+  );
+}
+async function markConnectedNoticeShown(at) {
+  try {
+    await mkdir15(brandHome(), { recursive: true });
+    await writeFile13(connectedMarker(at), `${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+  } catch {
+  }
+}
+async function claimFullSetupNotice() {
+  const marker = join23(brandHome(), "setup-notice-shown");
+  try {
+    await readFile24(marker, "utf8");
+    return false;
+  } catch {
+  }
+  try {
+    await mkdir15(brandHome(), { recursive: true });
+    await writeFile13(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+  } catch {
+  }
+  return true;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function confirmUploadNotice(p) {
+  const who = p.account_email ?? "the account `setup --web` connected";
+  const brain = p.brain_id && UUID.test(p.brain_id) ? ` --brain ${p.brain_id}` : "";
+  return `## Notes are waiting to be uploaded \u2014 after a check.
+
+\`memgineering setup --web\` chose to upload \`${p.path}\` to a brain on **${who}**.
+This machine has not sent them: an upload decided on the setup screen waits
+until somebody here has seen which account would receive the notes.
+
+If that is your user's account, this uploads them:
+
+\`\`\`bash
+memgineering push --vault ${shellQuote(p.path)}${brain}
+\`\`\`
+
+If it is not, \`memgineering logout\` disconnects this machine from that account
+and nothing is uploaded. If you are not sure which it is, ask them.`;
+}
+function setupConnectedNotice(c2) {
+  const who = c2.email ?? "an account with no email on record";
+  return `## This machine is signed in as **${who}**.
+
+\`memgineering setup --web\` connected it to that account. If that is not your user's account,
+\`memgineering logout\` disconnects it, and nothing they write reaches that brain.`;
+}
+function nextStepFor(cfg, signedIn = false, seen = {}) {
+  if (cfg.system.pendingUpload) {
+    return { id: "confirm_upload", markdown: confirmUploadNotice(cfg.system.pendingUpload) };
+  }
+  if (cfg.system.setupConnected && !seen.connected) {
+    return { id: "setup_connected", markdown: setupConnectedNotice(cfg.system.setupConnected) };
+  }
+  if (signedIn && cfg.brain.cloud === void 0) {
+    return { id: "point_at_a_brain", markdown: POINT_AT_A_BRAIN };
+  }
+  if (isSetUp(cfg) && cfg.system.guidanceVersion !== VERSION) {
+    return { id: "refresh_guidance", markdown: REFRESH_GUIDANCE };
+  }
+  if (cfg.brain.cloud !== void 0 && cfg.brain.cloud.api_url === apiUrl()) return null;
+  if (!isSetUp(cfg)) return { id: "finish_setup", markdown: FINISH_SETUP };
+  if (cfg.brain.brains.length === 0 && cfg.brain.cloud === void 0) {
+    return { id: "connect_a_brain", markdown: CONNECT_A_BRAIN };
+  }
+  return null;
+}
+async function currentNextStep() {
+  try {
+    const stored = await readCredentials().catch(() => null);
+    const cfg = await loadConfig();
+    const connected = cfg.system.setupConnected ? await connectedNoticeShown(cfg.system.setupConnected.at) : false;
+    return nextStepFor(cfg, stored !== null && stored.api_url === apiUrl(), { connected });
+  } catch {
+    return null;
+  }
+}
+var FINISH_SETUP, SETUP_NUDGE, REFRESH_GUIDANCE, CONNECT_A_BRAIN, POINT_AT_A_BRAIN, UUID;
+var init_next_step = __esm({
+  "src/lib/next-step.ts"() {
+    "use strict";
+    init_brand();
+    init_api_client();
+    init_credentials();
+    init_config();
+    init_version();
+    FINISH_SETUP = `## memgineering is installed, but not set up yet.
+
+Nothing is connected: there is no brain to read, and the agent tools on this
+machine have no memgineering guidance yet. Setup is one command:
+
+\`\`\`bash
+memgineering setup --web
+\`\`\`
+
+It does NOT wait for them. It returns in a few seconds \u2014 measured \u2014 and leaves
+a setup screen open in their browser at memgineering.com, where they choose
+everything: signing in, where the memory lives, which notes. Nothing is
+installed until they finish there, and this machine picks it up on its own.
+
+If they have not already asked you to set it up, ask them first \u2014 it opens a
+browser window on their computer. Once you run it, tell them in their language
+that the setup screen is open. It prints a short code first: show it to them,
+because the screen asks them to compare it.
+
+No browser on this machine (a server, a container, a sandbox)? Run
+\`memgineering setup --web --print-url\` and give them the link to open on the
+computer they are actually sitting at.
+
+\`setup --agent\` answers every one of those questions on their behalf, and
+\`--no-login\` answers the biggest one \u2014 no account, so the memory cannot follow
+them to another machine. Use it only when they have said they would rather you
+decided, or when this machine cannot reach a browser and \`--print-url\` is no
+use to them either.
+
+Setup's output then says how to connect their brain \u2014 create one, pick one, or
+move existing notes up.
+
+The \`memgineering-setup\` skill covers what comes after.`;
+    SETUP_NUDGE = "memgineering is installed, but not set up yet. `memgineering setup --web` opens a setup screen in their browser and does NOT wait for them \u2014 ask them first unless they asked you to set it up.\nThe full notes: run `memgineering` on its own.";
+    REFRESH_GUIDANCE = `## The guidance in your agent tools is older than this memgineering.
+
+The hub and skills this CLI installs into your tool's home were written by an
+earlier release. One command rewrites them:
+
+\`\`\`bash
+memgineering setup
+\`\`\`
+
+It does not change which brain this machine reads, or any note. Two things it
+does change, both worth knowing before it runs:
+
+- A setup-owned file your user edited is overwritten; setup names it afterwards.
+- Run with no flags where there is no terminal (an agent's shell), it keeps the
+  auto-update and hook choices recorded on this machine, and installs into
+  every agent tool it finds \u2014 \`--tools\` naming every tool they use keeps it to
+  those (a tool left out keeps its old guidance, and this notice stops
+  appearing anyway). On a machine not signed in, it starts a sign-in and prints
+  a code; \`--no-login\` declines that for a machine they keep local.
+
+If you are not sure what they chose, ask them. If you run it,
+mention it to your user in one line: it is upkeep for a tool they already set
+up, and they should not have to discover it later.
+
+Guidance files are read at the start of a session, so what changes today
+arrives in the next one.`;
+    CONNECT_A_BRAIN = `## memgineering is set up, and no brain is connected.
+
+A brain is a folder of markdown notes. Until one is connected there is nothing
+to recall and nowhere to remember. Which folder is your user's choice; the
+command is one you can run for them:
+
+\`\`\`bash
+memgineering link <their-notes-folder>   # they already keep notes
+memgineering init <path>                 # they do not \u2014 creates one, laid out
+\`\`\`
+
+\`link\` reports what would be stored before anything is indexed. An existing
+folder needs no index and no frontmatter of its own \u2014 plain markdown is a brain.
+
+Then run \`memgineering onboard\`: it prints what to ask so the brain knows whose
+it is. A brain whose \`01_BASE/\` is still template text answers almost nothing.
+
+Read \`memgineering-setup\` for accounts and which of their tools this reaches.
+
+Synced instead? \`memgineering login\`, then \`memgineering create <name>\`.`;
+    POINT_AT_A_BRAIN = `## Signed in, and this machine reads no brain yet.
+
+\`memgineering brains\` lists what is on the account.
+\`memgineering use --brain <name>\` points this machine at one.
+\`memgineering create <name>\` makes one and points here, when the account has none yet.
+`;
+    UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  }
+});
+
 // src/lib/provenance.ts
-import { execFile } from "child_process";
+import { execFile, spawn as spawn2 } from "child_process";
 import { realpath as realpath3 } from "fs/promises";
-import { dirname as dirname8, join as join23, resolve as resolve14 } from "path";
+import { dirname as dirname8, join as join24, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { promisify } from "util";
-async function detectProvenance(selfPath) {
+async function detectProvenance(selfPath, opts = {}) {
   const entry = selfPath ?? fileURLToPath2(import.meta.url);
   const selfDir = await realpath3(dirname8(entry)).catch(() => dirname8(entry));
   if (/[\\/]_npx[\\/]|[\\/]\.npm[\\/]_cacache[\\/]/.test(selfDir)) {
@@ -7828,9 +8092,11 @@ async function detectProvenance(selfPath) {
       reason: "this is a one-off npx run, not an installed copy"
     };
   }
-  for (const manager of MANAGERS) {
-    const prefix = await prefixOf(manager.bin, manager.prefixArgs);
-    if (prefix === null) continue;
+  const deadline = opts.deadlineMs;
+  const answers = deadline === void 0 ? null : await probeAllWithin(MANAGERS.map((m) => [m.bin, m.prefixArgs]), deadline);
+  for (const [i, manager] of MANAGERS.entries()) {
+    const prefix = answers === null ? await prefixOf(manager.bin, manager.prefixArgs) : answers.prefixes[i];
+    if (prefix === null || prefix === void 0) continue;
     if (isInside2(selfDir, manager.moduleRoot(prefix))) {
       return {
         kind: manager.kind,
@@ -7841,6 +8107,15 @@ async function detectProvenance(selfPath) {
       };
     }
   }
+  if (answers?.timedOut === true) {
+    return {
+      kind: "undetermined",
+      selfDir,
+      prefix: null,
+      command: "npm i -g memgineering@latest",
+      reason: "the package managers did not answer in time to tell which one installed this copy"
+    };
+  }
   const local = selfDir.includes(`${"node_modules"}`);
   return {
     kind: local ? "local" : "unknown",
@@ -7853,6 +8128,62 @@ async function detectProvenance(selfPath) {
 function canSelfUpdate(p) {
   return p.kind === "npm" || p.kind === "pnpm" || p.kind === "bun";
 }
+async function probeAllWithin(probes, deadlineMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deadlineMs);
+  timer.unref();
+  try {
+    const prefixes = await Promise.all(
+      probes.map(([bin, args]) => probeOnce(bin, args, controller.signal))
+    );
+    return { prefixes, timedOut: controller.signal.aborted };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function probeOnce(bin, args, signal) {
+  return new Promise((settle) => {
+    let child;
+    try {
+      child = spawn2(bin, args, { detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      settle(null);
+      return;
+    }
+    let out = "";
+    let done = false;
+    const finish = (value) => {
+      if (done) return;
+      done = true;
+      signal.removeEventListener("abort", stop);
+      settle(value);
+    };
+    function stop() {
+      try {
+        if (process.platform === "win32" || child.pid === void 0) child.kill("SIGKILL");
+        else process.kill(-child.pid, "SIGKILL");
+      } catch {
+      }
+      child.stdout?.destroy();
+      child.unref();
+      finish(null);
+    }
+    child.stdout?.on("data", (chunk) => {
+      out += chunk.toString("utf8");
+    });
+    child.on("error", () => finish(null));
+    child.on("close", (code) => {
+      const value = out.trim();
+      if (code !== 0 || value === "") {
+        finish(null);
+        return;
+      }
+      void realpath3(value).catch(() => value).then(finish);
+    });
+    if (signal.aborted) stop();
+    else signal.addEventListener("abort", stop, { once: true });
+  });
+}
 async function prefixOf(bin, args) {
   try {
     const { stdout } = await run(bin, args, { timeout: 5e3 });
@@ -7874,7 +8205,7 @@ async function unreachableByName(selfPath) {
   const p = await detectProvenance(entry);
   return p.kind === "local" || p.kind === "npx" ? p.reason : null;
 }
-var run, MANAGERS;
+var run, MANAGERS, BACKGROUND_PROBE_DEADLINE_MS;
 var init_provenance = __esm({
   "src/lib/provenance.ts"() {
     "use strict";
@@ -7884,7 +8215,7 @@ var init_provenance = __esm({
         kind: "npm",
         bin: "npm",
         prefixArgs: ["prefix", "-g"],
-        moduleRoot: (prefix) => process.platform === "win32" ? join23(prefix, "node_modules") : join23(prefix, "lib", "node_modules"),
+        moduleRoot: (prefix) => process.platform === "win32" ? join24(prefix, "node_modules") : join24(prefix, "lib", "node_modules"),
         install: "npm i -g memgineering@latest"
       },
       {
@@ -7903,6 +8234,7 @@ var init_provenance = __esm({
         install: "bun add -g memgineering"
       }
     ];
+    BACKGROUND_PROBE_DEADLINE_MS = 1500;
   }
 });
 
@@ -7911,28 +8243,36 @@ var setup_cloud_exports = {};
 __export(setup_cloud_exports, {
   SETUP_CHILD_ENV: () => SETUP_CHILD_ENV,
   applyAnswers: () => applyAnswers,
+  insideFolder: () => insideFolder,
+  newBrainRoot: () => newBrainRoot,
   readChildToken: () => readChildToken,
   runSetupCloud: () => runSetupCloud,
   runSetupCloudChild: () => runSetupCloudChild,
   waitAndApply: () => waitAndApply
 });
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
+import { realpathSync as realpathSync2 } from "fs";
 import { readdir as readdir7, stat as stat6 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { join as join24 } from "path";
-async function report2(setupToken, state, detail) {
+import { basename as basename3, dirname as dirname9, join as join25, resolve as resolve15, sep as sep4 } from "path";
+async function report2(setupToken, state, detail, code) {
   try {
     await apiRequest({
       method: "POST",
       path: "/v1/setup/session/report",
-      body: { setup_token: setupToken, state, ...detail === void 0 ? {} : { detail } }
+      body: {
+        setup_token: setupToken,
+        state,
+        ...detail === void 0 ? {} : { detail },
+        ...code === void 0 ? {} : { code }
+      }
     });
   } catch {
   }
 }
 async function folderCandidates() {
   const home = homedir5();
-  const roots = ["Documents", "notes", "Notes", "Obsidian", "vault"].map((d) => join24(home, d));
+  const roots = ["Documents", "notes", "Notes", "Obsidian", "vault"].map((d) => join25(home, d));
   const found = [];
   const countNotes = async (dir) => {
     let count = 0;
@@ -7941,7 +8281,7 @@ async function folderCandidates() {
       if (entry.name.startsWith(".")) continue;
       if (entry.isFile() && /\.(md|markdown)$/i.test(entry.name)) count += 1;
       else if (entry.isDirectory()) {
-        const inner = await readdir7(join24(dir, entry.name)).catch(() => []);
+        const inner = await readdir7(join25(dir, entry.name)).catch(() => []);
         count += inner.filter((n) => /\.(md|markdown)$/i.test(n)).length;
       }
       if (count > 999) break;
@@ -7963,7 +8303,7 @@ function toolsFromAnswers(answers, detected) {
   const picked = TOOLS.filter((t) => wanted.has(t.id));
   return picked.length > 0 ? picked : [...detected];
 }
-async function applyAnswers(setupToken, claim, detected) {
+async function applyAnswers(setupToken, claim, detected, guards = { candidates: [], confirmUpload: null }) {
   const answers = claim.answers;
   if (!answers) {
     throw memgError(
@@ -7972,29 +8312,53 @@ async function applyAnswers(setupToken, claim, detected) {
       "Nothing was installed. Run `memgineering setup --web` again; if it repeats, the brain server is answering in a shape this version does not understand."
     );
   }
+  const localRoot = checkLocalPath(answers, guards.candidates);
+  let account = null;
   if (typeof claim.token === "string" && claim.token !== "") {
+    account = claim.account ?? await whoIs(claim.token);
+    const before = await readCredentials();
+    const firstSignIn = before === null || before.api_url !== apiUrl();
+    if (!firstSignIn && (account === null || before.account_id !== account.id)) {
+      throw memgError(
+        "conflict",
+        "this machine is signed in to a different account, so the setup changed nothing",
+        `Signed in here: ${before.display_name ?? before.account_id}. The setup screen was confirmed by: ${account?.email ?? account?.display_name ?? "an unknown account"}. If that second account is yours and you want to switch, run \`memgineering logout\` and then \`memgineering setup --web\` again; if you did not confirm it, someone else did \u2014 nothing was changed.`
+      );
+    }
     const registry = registryFromClaim(claim.registry);
-    const me = await apiRequest({
-      method: "GET",
-      path: "/v1/me",
-      token: claim.token
-    }).catch(() => null);
     const credentials = {
       api_url: apiUrl(),
       token: claim.token,
-      account_id: me?.body?.account?.id ?? "",
-      display_name: me?.body?.account?.display_name ?? null,
+      account_id: account?.id ?? "",
+      display_name: account?.display_name ?? null,
       signed_in_at: (/* @__PURE__ */ new Date()).toISOString(),
       ...registry !== void 0 ? { registry } : {}
     };
     await saveCredentials(credentials);
+    if (firstSignIn && account !== null) {
+      const cfg = await loadConfig();
+      await saveConfig({
+        ...cfg,
+        system: {
+          ...cfg.system,
+          setupConnected: {
+            account_id: account.id,
+            email: account.email,
+            at: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        }
+      });
+    }
   }
-  await report2(setupToken, "applying", "\uC124\uC815\uC744 \uC4F0\uB294 \uC911\uC774\uC5D0\uC694.");
+  await report2(setupToken, "applying", "\uC124\uC815\uC744 \uC4F0\uB294 \uC911\uC774\uC5D0\uC694.", "writing_config");
   const choice = {
     tools: toolsFromAnswers(answers, detected),
     autoUpdate: answers.auto_update ? "on" : "off",
     errorTelemetry: answers.error_telemetry === null ? "undecided" : answers.error_telemetry ? "on" : "off",
-    hook: answers.hook
+    hook: answers.hook,
+    // The screen always shows the hook switch, so this is the person's answer,
+    // and a later flag-less refresh keeps it only if it is recorded as one.
+    hookAnswer: answers.hook ? "on" : "off"
   };
   await applySetup(choice, false);
   const parts = [];
@@ -8005,7 +8369,7 @@ async function applyAnswers(setupToken, claim, detected) {
       await recordLink(target.adapter, DEFAULT_OBSERVATIONS_DIR);
       parts.push(`linked ${answers.local_path}`);
     } else {
-      const made = await createBrain(answers.local_path, "default");
+      const made = await createBrain(localRoot ?? answers.local_path, "default");
       parts.push(`created ${made.root}`);
     }
   }
@@ -8015,16 +8379,82 @@ async function applyAnswers(setupToken, claim, detected) {
     parts.push(`pointed at ${claim.brain.name}`);
   }
   if (answers.location === "cloud" && answers.upload_path) {
-    await report2(setupToken, "applying", "\uB178\uD2B8\uB97C \uC62C\uB9AC\uB294 \uC911\uC774\uC5D0\uC694.");
-    const { pushCommand: pushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
-    await pushCommand2().parseAsync(
-      ["--vault", answers.upload_path, ...claim.brain?.name ? ["--brain", claim.brain.name] : []],
-      { from: "user" }
-    );
-    parts.push(`uploaded ${answers.upload_path}`);
+    const path = answers.upload_path;
+    if (!guards.candidates.includes(path)) {
+      parts.push(`not uploaded: ${path} was not one of the folders this machine offered`);
+    } else {
+      const email = account?.email ?? null;
+      const yes = guards.confirmUpload ? await guards.confirmUpload({ path, email }) : null;
+      if (yes === true) {
+        await report2(setupToken, "applying", "\uB178\uD2B8\uB97C \uC62C\uB9AC\uB294 \uC911\uC774\uC5D0\uC694.", "uploading");
+        const { pushCommand: pushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
+        await pushCommand2().parseAsync(
+          ["--vault", path, ...claim.brain?.id ? ["--brain", claim.brain.id] : []],
+          { from: "user" }
+        );
+        parts.push(`uploaded ${path}`);
+      } else if (yes === null && account !== null) {
+        const cfg = await loadConfig();
+        await saveConfig({
+          ...cfg,
+          system: {
+            ...cfg.system,
+            pendingUpload: {
+              path,
+              brain: claim.brain?.name ?? null,
+              brain_id: claim.brain?.id ?? null,
+              account_id: account.id,
+              account_email: email,
+              at: (/* @__PURE__ */ new Date()).toISOString()
+            }
+          }
+        });
+        await report2(
+          setupToken,
+          "applying",
+          "\uB178\uD2B8 \uC62C\uB9AC\uAE30\uB294 \uC774 \uCEF4\uD4E8\uD130\uC5D0\uC11C \uD655\uC778\uD55C \uB4A4\uC5D0 \uC2DC\uC791\uB3FC\uC694.",
+          "upload_waits_for_check"
+        );
+        parts.push(`upload of ${path} waits for a check on this machine`);
+      } else {
+        parts.push(`not uploaded: ${path}`);
+      }
+    }
   }
+  if (account?.email) parts.push(`signed in as ${account.email}`);
   return { summary: parts.join(" \xB7 ") };
 }
+async function whoIs(token) {
+  const me = await apiRequest({ method: "GET", path: "/v1/me", token }).catch(() => null);
+  const a = me?.body?.account;
+  return a?.id ? { id: a.id, email: a.email ?? null, display_name: a.display_name ?? null } : null;
+}
+function checkLocalPath(answers, candidates) {
+  if (answers.location !== "local" || !answers.local_path) return null;
+  const path = answers.local_path;
+  if (answers.local_mode === "link") {
+    if (!candidates.includes(path)) {
+      throw memgError(
+        "invalid_input",
+        "the folder the setup screen chose to link was not one this machine offered",
+        "Nothing was changed. To use an existing folder, run `memgineering link <folder>` here."
+      );
+    }
+    return null;
+  }
+  return newBrainRoot(path);
+}
+function newBrainRoot(path, home = homedir5()) {
+  const root = path === "~" ? home : path.startsWith("~/") ? resolve15(home, path.slice(2)) : resolve15(home, path);
+  if (!insideFolder(root, home)) {
+    throw memgError(
+      "invalid_input",
+      "the setup screen chose a place outside the home folder for the new brain",
+      `Nothing was changed. Run \`memgineering init <folder>\` here to make a brain somewhere under ${home}.`
+    );
+  }
+  return root;
+}
 async function pollOnce(setupToken) {
   const res = await apiRequest({
     method: "POST",
@@ -8036,6 +8466,7 @@ async function pollOnce(setupToken) {
 }
 async function waitAndApply(setupToken, opts) {
   let sentFolders = false;
+  let offered = [];
   for (; ; ) {
     if (Date.now() > opts.deadline) return "expired";
     let answer = null;
@@ -8049,12 +8480,16 @@ async function waitAndApply(setupToken, opts) {
     if (answer) {
       await report2(setupToken, "applying");
       try {
-        const done = await applyAnswers(setupToken, answer, opts.detected);
-        await report2(setupToken, "done", "\uC124\uCE58\uB97C \uB9C8\uCCE4\uC5B4\uC694.");
+        const done = await applyAnswers(setupToken, answer, opts.detected, {
+          candidates: offered,
+          confirmUpload: opts.confirmUpload ?? null
+        });
+        await report2(setupToken, "done", "\uC124\uCE58\uB97C \uB9C8\uCCE4\uC5B4\uC694.", "done");
         return done;
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        await report2(setupToken, "failed", message.slice(0, 400));
+        const code = err.code === "conflict" ? "different_account" : "failed";
+        await report2(setupToken, "failed", message.slice(0, 400), code);
         throw err;
       }
     }
@@ -8066,8 +8501,9 @@ async function waitAndApply(setupToken, opts) {
       }).catch(() => null);
       if (state?.body?.folders_requested === true) {
         sentFolders = true;
-        opts.onProgress?.("\uD3F4\uB354\uB97C \uCC3E\uC544\uBCF4\uB294 \uC911\u2026");
+        opts.onProgress?.("Looking for note folders on this machine\u2026");
         const candidates = await folderCandidates();
+        offered = candidates.map((c2) => c2.path);
         await apiRequest({
           method: "POST",
           path: "/v1/setup/session/folders",
@@ -8076,7 +8512,7 @@ async function waitAndApply(setupToken, opts) {
         });
       }
     }
-    await new Promise((resolve16) => setTimeout(resolve16, opts.intervalMs));
+    await new Promise((resolve17) => setTimeout(resolve17, opts.intervalMs));
   }
 }
 async function startSession(detected) {
@@ -8096,7 +8532,7 @@ async function startSession(detected) {
   return body;
 }
 function detachChild(setupToken) {
-  const child = spawn2(process.execPath, [process.argv[1] ?? "", "setup", "--web"], {
+  const child = spawn3(process.execPath, [process.argv[1] ?? "", "setup", "--web"], {
     detached: true,
     stdio: ["pipe", "ignore", "ignore"],
     env: { ...process.env, [SETUP_CHILD_ENV]: "1" }
@@ -8115,26 +8551,30 @@ async function runSetupCloud(opts) {
   const session = await startSession(opts.detected);
   const intervalMs = Math.max(1, session.interval ?? 5) * 1e3;
   printHuman(`
-  \uC124\uCE58 \uCF54\uB4DC: ${c.bold(session.user_code)}
+  Setup code: ${c.bold(session.user_code)}
 `);
   const opened = opts.printUrl ? false : await openBrowser(session.setup_url);
   const foreground = opts.wait || process.stdout.isTTY === true && process.stderr.isTTY === true;
   printDual({
     json: {
       user_code: session.user_code,
-      setup_url: session.setup_url,
+      // The link drives the setup screen — it carries the browser key (H-3).
+      // Once a browser has it, nobody else needs it, so it is not printed.
+      ...opened ? {
+        hint: "The setup screen was opened in the browser. If none appeared, run `memgineering setup --web --print-url` and open the printed link yourself."
+      } : { setup_url: session.setup_url },
       opened,
       waiting: foreground
     },
     human: () => {
-      if (opened) printHuman("\uBE0C\uB77C\uC6B0\uC800\uC5D0 \uC124\uCE58 \uD654\uBA74\uC744 \uC5F4\uC5C8\uC5B4\uC694.");
+      if (opened) printHuman("Opened the setup screen in the browser.");
       else {
-        printHuman("\uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC774 \uC8FC\uC18C\uB97C \uC5F4\uC5B4 \uC124\uCE58\uB97C \uB9C8\uCCD0 \uC8FC\uC138\uC694:\n");
+        printHuman("Open this link in a browser to finish the setup:\n");
         printHuman(`  ${session.setup_url}`);
       }
       printHuman(
         c.gray(
-          foreground ? "\n  \uD654\uBA74\uC5D0\uC11C \uB9C8\uCE58\uBA74 \uC5EC\uAE30\uC11C \uC774\uC5B4\uC11C \uC124\uCE58\uD560\uAC8C\uC694. \uAE30\uB2E4\uB9AC\uB294 \uAC78 \uBA48\uCD94\uB824\uBA74 Ctrl-C." : "\n  \uD654\uBA74\uC5D0\uC11C \uB9C8\uCE58\uBA74 \uC774 \uCEF4\uD4E8\uD130\uC5D0 \uC790\uB3D9\uC73C\uB85C \uC124\uCE58\uB3FC\uC694. \uCC3D\uC744 \uB2EB\uC544\uB3C4 \uAD1C\uCC2E\uC544\uC694."
+          foreground ? "\n  When the screen is done, the install continues here. Ctrl-C stops waiting." : "\n  When the screen is done, this machine installs on its own. This window can be closed."
         )
       );
     }
@@ -8143,14 +8583,16 @@ async function runSetupCloud(opts) {
     detachChild(session.setup_token);
     return;
   }
+  const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true && !isJsonMode();
   const outcome = await waitAndApply(session.setup_token, {
     intervalMs,
     deadline: Date.now() + CHILD_LIFETIME_MS,
     detected: opts.detected,
-    onProgress: (line) => printHuman(c.gray(`  ${line}`))
+    onProgress: (line) => printHuman(c.gray(`  ${line}`)),
+    confirmUpload: interactive ? askBeforeUpload : null
   });
   if (outcome === "expired") {
-    const line = "\uC124\uCE58 \uD654\uBA74\uC774 \uB9CC\uB8CC\uB410\uC5B4\uC694. \uC544\uBB34\uAC83\uB3C4 \uBC14\uB00C\uC9C0 \uC54A\uC558\uC5B4\uC694 \u2014 `memgineering setup --web`\uC744 \uB2E4\uC2DC \uC2E4\uD589\uD558\uBA74 \uC0C8 \uD654\uBA74\uC774 \uC5F4\uB824\uC694.";
+    const line = "The setup screen expired and nothing was changed. `memgineering setup --web` opens a new one.";
     if (isJsonMode()) notice(JSON.stringify({ setup_web: "expired" }));
     else printHuman(c.gray(`
 ${line}`));
@@ -8158,14 +8600,49 @@ ${line}`));
   }
   if (isJsonMode()) notice(JSON.stringify({ setup_web: "applied" }));
   else {
-    printHuman(c.green("\n\uC124\uCE58\uB97C \uB9C8\uCCE4\uC5B4\uC694."));
+    printHuman(c.green("\nSetup finished."));
     printHuman(
       c.gray(
-        "  \uC9C0\uAE08 \uBC14\uB85C \uC4F8 \uC218 \uC788\uC5B4\uC694 \u2014 recall\uB3C4 remember\uB3C4 \uB429\uB2C8\uB2E4.\n  \uC0C8\uB85C \uC124\uCE58\uB41C \uC548\uB0B4\uBB38\uC740 \uB2E4\uC74C \uB300\uD654\uBD80\uD130 \uD568\uAED8 \uC2E4\uB824\uC694."
+        "  recall and remember work now.\n  The newly installed guidance is read from the next conversation on."
       )
     );
   }
 }
+function insideFolder(target, folder) {
+  const real = (p) => {
+    try {
+      return realpathSync2(p);
+    } catch {
+      return p;
+    }
+  };
+  const root = real(resolve15(folder));
+  let existing = resolve15(target);
+  const rest = [];
+  for (; ; ) {
+    try {
+      realpathSync2(existing);
+      break;
+    } catch {
+      const parent = dirname9(existing);
+      if (parent === existing) break;
+      rest.unshift(basename3(existing));
+      existing = parent;
+    }
+  }
+  const landed = resolve15(real(existing), ...rest);
+  return landed === root || landed.startsWith(root + sep4);
+}
+async function askBeforeUpload(q) {
+  const { default: prompts6 } = await import("prompts");
+  const { yes } = await prompts6({
+    type: "confirm",
+    name: "yes",
+    message: `Upload the notes in ${q.path} to the brain on ${q.email ?? "this account"}?`,
+    initial: false
+  });
+  return yes === true;
+}
 async function runSetupCloudChild(detected) {
   const setupToken = await readChildToken();
   if (setupToken === "") return;
@@ -8182,6 +8659,7 @@ var init_setup_cloud = __esm({
     "use strict";
     init_api_client();
     init_errors();
+    init_config();
     init_credentials();
     init_open_browser();
     init_ui();
@@ -8195,8 +8673,8 @@ var init_setup_cloud = __esm({
 
 // src/commands/setup.ts
 import { createHash as createHash9 } from "crypto";
-import { access as access2, mkdir as mkdir15, readFile as readFile24 } from "fs/promises";
-import { dirname as dirname9, join as join25 } from "path";
+import { access as access2, mkdir as mkdir16, readFile as readFile25 } from "fs/promises";
+import { dirname as dirname10, join as join26 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command as Command40 } from "commander";
 import prompts5 from "prompts";
@@ -8221,10 +8699,11 @@ function setupCommand() {
     "after",
     [
       "",
-      "Chat apps with no shell \u2014 ChatGPT, Claude.ai, Claude Desktop, Cowork \u2014 need no",
-      `setup: add ${HOSTED_CONNECTOR_URL} as a custom connector in the app and`,
-      "sign in. It reads and writes the brain on your account (not a folder on this",
-      "machine)."
+      "Chat apps with no shell need no setup. They read and write the brain on your",
+      `account (not a folder on this machine) at ${HOSTED_CONNECTOR_URL}:`,
+      "  ChatGPT: Settings \u2192 Developer mode \u2192 add an MCP server with that URL, sign in.",
+      "  Claude.ai, Claude Desktop, Cowork: Customize \u2192 Connectors \u2192 Add custom",
+      "  connector with that URL, sign in."
     ].join("\n")
   ).action(async (opts) => {
     const detected = await detectTools();
@@ -8259,16 +8738,18 @@ function setupCommand() {
       dryRun: opts.dryRun === true
     });
     const mode = await resolveMode(opts);
-    const choice = mode.kind === "human" ? await askHuman(detected, opts) : fromFlags(detected, opts);
+    const recorded = mode.kind === "human" ? {} : await recordedChoices(detected);
+    const choice = mode.kind === "human" ? await askHuman(detected, opts) : fromFlags(detected, opts, recorded);
     const defaultsTaken = !mode.chosen ? [
-      ...opts.autoUpdate === void 0 ? ["auto-update: on"] : [],
+      // Only what nobody chose, here or on an earlier run.
+      ...opts.autoUpdate === void 0 && recorded.autoUpdate === void 0 ? ["auto-update: on"] : [],
       // Every callback this flag arms, named — on Claude Code and Codex
       // that is two (note summaries at session start, the user's own
       // rules before an edit), and saying only the first would be
       // reporting half of what was decided on their behalf. On Grok it
       // is one, at the end of a turn, and naming the other two there
       // reported callbacks that were never installed.
-      ...opts.hook === void 0 && choice?.hook ? hooksFor(choice.tools).map((h) => `${h.what}: on`) : []
+      ...opts.hook === void 0 && recorded.hook === void 0 && choice?.hook ? hooksFor(choice.tools).map((h) => `${h.what}: on`) : []
     ] : [];
     if (choice === null) {
       printHuman(c.yellow("Cancelled \u2014 nothing was changed."));
@@ -8534,6 +9015,7 @@ async function applySetup(choice, dryRun) {
       system: {
         ...cfg.system,
         autoUpdate: choice.autoUpdate,
+        ...choice.hookAnswer === void 0 ? {} : { hook: choice.hookAnswer },
         installed,
         // Stamped whether or not anything was rewritten. A run that finds every
         // file already current is exactly the run that must clear the notice —
@@ -8559,7 +9041,7 @@ async function applySetup(choice, dryRun) {
   }
   async function write2() {
     for (const tool of choice.tools) {
-      const hubPath = join25(agentHome(), tool.hubFile);
+      const hubPath = join26(agentHome(), tool.hubFile);
       const written = await injectBlock(
         hubPath,
         hub + tailFor(tool, choice.hook),
@@ -8574,8 +9056,8 @@ async function applySetup(choice, dryRun) {
       });
       if (!dryRun && written.after !== null) mark(hubPath, written.after);
       for (const skill of BRAND.subSkills) {
-        const content = await loadAsset(join25(skill, "SKILL.md"));
-        const path = join25(agentHome(), tool.skillsDir, skill, "SKILL.md");
+        const content = await loadAsset(join26(skill, "SKILL.md"));
+        const path = join26(agentHome(), tool.skillsDir, skill, "SKILL.md");
         const out = await writeIfDifferent(path, content, dryRun);
         results.push({
           tool: tool.label,
@@ -8648,6 +9130,23 @@ function globalInstallHint(reason, hooks) {
   return `${hooks ? "The hooks and the guide call" : "The guide tells your agent to run"} \`memgineering\` by name, and ${reason} \u2014
 so nothing reaches it until a global install exists: \`npm i -g memgineering\`. Nothing needs re-running after that.`;
 }
+async function recordedChoices(detected) {
+  const cfg = await loadConfig();
+  if (!isSetUp(cfg)) return {};
+  const hook = cfg.system.hook ?? await hooksArmed(detected);
+  return { autoUpdate: cfg.system.autoUpdate, ...hook === void 0 ? {} : { hook } };
+}
+async function hooksArmed(tools) {
+  const capable = tools.filter((t) => t.hooks && t.hooksFile);
+  if (capable.length === 0) return void 0;
+  for (const tool of capable) {
+    const raw = await readFile25(join26(agentHome(), ...(tool.hooksFile ?? "").split("/")), "utf8").catch(
+      () => ""
+    );
+    if (hooksFor([tool]).some((spec) => raw.includes(spec.signature))) return "on";
+  }
+  return "off";
+}
 async function resolveMode(opts) {
   if (opts.agent) return { kind: "agent", chosen: true };
   if (opts.human) {
@@ -8681,11 +9180,11 @@ async function detectTools() {
   const home = agentHome();
   const found = [];
   for (const tool of TOOLS) {
-    if (await exists2(join25(home, tool.dir))) found.push(tool);
+    if (await exists2(join26(home, tool.dir))) found.push(tool);
   }
   return found;
 }
-function fromFlags(detected, opts) {
+function fromFlags(detected, opts, recorded = {}) {
   const tools = opts.tools ? opts.tools.split(",").map((t) => t.trim().toLowerCase()).map((id) => {
     const tool = detected.find((t) => t.id === id);
     if (tool) return tool;
@@ -8704,14 +9203,16 @@ function fromFlags(detected, opts) {
       `${known.label} creates ~/${known.dir} the first time it runs. If it is installed, open it once, then run setup again. ${detectedList}`
     );
   }) : detected;
+  const hookAnswer = parseChoice(opts.hook, recorded.hook ?? "on", "--hook");
   return {
     tools,
-    autoUpdate: parseChoice(opts.autoUpdate, "on", "--auto-update"),
+    autoUpdate: parseChoice(opts.autoUpdate, recorded.autoUpdate ?? "on", "--auto-update"),
     errorTelemetry: opts.errorTelemetry === void 0 ? "undecided" : parseChoice(opts.errorTelemetry, "off", "--error-telemetry"),
     // Only Claude Code can run something at session start. For the others the
     // skill tells the agent to call resurface itself, which is why asking for
     // a hook there is not an error — it simply has nowhere to go.
-    hook: parseChoice(opts.hook, "on", "--hook") === "on" && tools.some((t) => t.hooks)
+    hook: hookAnswer === "on" && tools.some((t) => t.hooks),
+    hookAnswer
   };
 }
 function parseChoice(value, fallback, flag2) {
@@ -8770,17 +9271,19 @@ async function askHuman(detected, opts) {
     autoUpdate: answers.autoUpdate === false ? "off" : parseChoice(opts.autoUpdate, "on", "--auto-update"),
     // An aborted prompt is not an answer — undecided, never a silent yes.
     errorTelemetry: answers.errorTelemetry === void 0 ? "undecided" : answers.errorTelemetry ? "on" : "off",
-    hook: answers.hook !== false
+    hook: answers.hook !== false,
+    // Only a question that was put is an answer to record.
+    ...answers.hook === void 0 ? {} : { hookAnswer: answers.hook ? "on" : "off" }
   };
 }
 async function injectBlock(filePath, content, dryRun, weWroteThis) {
   const block = `${BRAND.hubMarkerStart}
 ${content.trimEnd()}
 ${BRAND.hubMarkerEnd}`;
-  const existing = await readFile24(filePath, "utf8").catch(() => null);
+  const existing = await readFile25(filePath, "utf8").catch(() => null);
   if (existing === null) {
     if (!dryRun) {
-      await mkdir15(dirname9(filePath), { recursive: true });
+      await mkdir16(dirname10(filePath), { recursive: true });
       await writeThenRename(filePath, `${block}
 `);
     }
@@ -8820,11 +9323,11 @@ function looksLikeOurGuide(text) {
   return text.includes("memgineering recall") && text.includes("memgineering remember");
 }
 async function writeIfDifferent(filePath, content, dryRun) {
-  const existing = await readFile24(filePath, "utf8").catch(() => null);
+  const existing = await readFile25(filePath, "utf8").catch(() => null);
   const after = fingerprint(content);
   if (existing === content) return { outcome: "unchanged", before: existing, after };
   if (!dryRun) {
-    await mkdir15(dirname9(filePath), { recursive: true });
+    await mkdir16(dirname10(filePath), { recursive: true });
     await writeThenRename(filePath, content);
   }
   return { outcome: existing === null ? "injected" : "updated", before: existing, after };
@@ -8835,8 +9338,8 @@ function hooksFor(tools) {
   );
 }
 async function installHook(spec, tool, dryRun) {
-  const settingsPath = join25(agentHome(), ...(tool.hooksFile ?? "").split("/"));
-  const raw = await readFile24(settingsPath, "utf8").catch(() => null);
+  const settingsPath = join26(agentHome(), ...(tool.hooksFile ?? "").split("/"));
+  const raw = await readFile25(settingsPath, "utf8").catch(() => null);
   let settings = {};
   if (raw !== null) {
     try {
@@ -8878,15 +9381,15 @@ async function installHook(spec, tool, dryRun) {
   }
   const next = { ...settings, hooks: { ...hooks, [spec.event]: existingGroups } };
   if (!dryRun) {
-    await mkdir15(dirname9(settingsPath), { recursive: true });
+    await mkdir16(dirname10(settingsPath), { recursive: true });
     await writeThenRename(settingsPath, `${JSON.stringify(next, null, 2)}
 `);
   }
   return raw === null ? "injected" : "updated";
 }
 async function removeHook(spec, tool, dryRun) {
-  const settingsPath = join25(agentHome(), ...(tool.hooksFile ?? "").split("/"));
-  const raw = await readFile24(settingsPath, "utf8").catch(() => null);
+  const settingsPath = join26(agentHome(), ...(tool.hooksFile ?? "").split("/"));
+  const raw = await readFile25(settingsPath, "utf8").catch(() => null);
   if (raw === null) return "unchanged";
   let parsed;
   try {
@@ -8910,7 +9413,7 @@ async function removeHook(spec, tool, dryRun) {
   return "removed";
 }
 async function loadAsset(relPath) {
-  const raw = await readFile24(join25(await assetRoot(), relPath), "utf8");
+  const raw = await readFile25(join26(await assetRoot(), relPath), "utf8");
   if (relPath === BRAND.hubFileName && raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 4);
     if (end !== -1) return raw.slice(end + 4).trimStart();
@@ -8918,14 +9421,14 @@ async function loadAsset(relPath) {
   return raw;
 }
 async function assetRoot() {
-  const here = dirname9(fileURLToPath3(import.meta.url));
-  const bundled = join25(here, "..", "assets");
-  if (await exists2(join25(bundled, BRAND.hubFileName))) return bundled;
+  const here = dirname10(fileURLToPath3(import.meta.url));
+  const bundled = join26(here, "..", "assets");
+  if (await exists2(join26(bundled, BRAND.hubFileName))) return bundled;
   let dir = here;
   for (; ; ) {
-    const candidate = join25(dir, "packages", "skills");
-    if (await exists2(join25(candidate, BRAND.hubFileName))) return candidate;
-    const parent = dirname9(dir);
+    const candidate = join26(dir, "packages", "skills");
+    if (await exists2(join26(candidate, BRAND.hubFileName))) return candidate;
+    const parent = dirname10(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -8954,6 +9457,7 @@ var init_setup = __esm({
     init_setup_brain();
     init_setup_signin();
     init_config();
+    init_next_step();
     init_provenance();
     init_ui();
     init_version();
@@ -9312,7 +9816,7 @@ async function reportError(kind, err) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify(payload)
       }),
-      new Promise((resolve16) => setTimeout(resolve16, REPORT_TIMEOUT_MS))
+      new Promise((resolve17) => setTimeout(resolve17, REPORT_TIMEOUT_MS))
     ]);
   } catch {
   }
@@ -11003,7 +11507,7 @@ var KordisClient = class {
               `[kordis] api: ${method} ${url.pathname}${url.search} \u2192 fetch failed, retrying in 150ms (${err.message})`
             );
           }
-          await new Promise((resolve16) => setTimeout(resolve16, 150));
+          await new Promise((resolve17) => setTimeout(resolve17, 150));
           continue;
         }
       }
@@ -12858,12 +13362,12 @@ var BASE_FILES = [
 ];
 var HUB_PATH = "00_HUB/HUB.md";
 var TEMPLATE_SLOTS = 2;
-function capTemplates(cards, isTemplate) {
+function capTemplates(cards, isTemplate, inConflict = () => false) {
   const kept = [];
   const withheld = [];
   let templates = 0;
   for (const card of cards) {
-    if (isTemplate(card) && ++templates > TEMPLATE_SLOTS) withheld.push(card);
+    if (isTemplate(card) && !inConflict(card) && ++templates > TEMPLATE_SLOTS) withheld.push(card);
     else kept.push(card);
   }
   return { kept, withheld };
@@ -14507,11 +15011,11 @@ function lines(text, marker) {
   return text === "" ? [] : text.split("\n").map((l) => `${marker} ${l}`);
 }
 async function readInput(source) {
-  const raw = source === "-" ? await new Promise((resolve16, reject) => {
+  const raw = source === "-" ? await new Promise((resolve17, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (chunk) => buf += chunk);
-    process.stdin.on("end", () => resolve16(buf));
+    process.stdin.on("end", () => resolve17(buf));
     process.stdin.on("error", reject);
   }) : await readFile16(source, "utf8").catch(() => source);
   try {
@@ -17174,8 +17678,14 @@ function groupHostedLines(rules, project) {
   const width = ruleWidthFor(rules.length);
   const line = (r) => {
     const quoted = renderRuleLine(r.text ?? r.summary ?? r.title, width);
-    return r.freshness === "current" || r.freshness === void 0 ? quoted : `${quoted}
-  (${r.freshness === "expired" ? "past its end date" : "superseded"} \u2014 worth checking)`;
+    const labels = [
+      ...r.freshness === "current" || r.freshness === void 0 ? [] : [`(${r.freshness === "expired" ? "past its end date" : "superseded"} \u2014 worth checking)`],
+      // Whose words these are, when a chat app's (security audit M-2). The
+      // person promoted it; the agent is owed knowing where it came from.
+      ...r.written_by === void 0 ? [] : [`(${connectorLabel(r.written_by)})`]
+    ];
+    return labels.length === 0 ? quoted : `${quoted}
+  ${labels.join(" ")}`;
   };
   const globals = rules.filter((r) => r.lane === "global");
   const scoped = rules.filter((r) => r.lane === "project");
@@ -17896,6 +18406,7 @@ init_login();
 init_errors();
 init_api_client();
 init_credentials();
+init_config();
 init_pending_login();
 init_ui();
 import { Command as Command22 } from "commander";
@@ -17907,6 +18418,7 @@ function logoutCommand() {
     const base2 = apiUrl();
     const credentials = await readCredentials();
     await clearPendingLogin();
+    await clearSetupFollowUps();
     if (!credentials) {
       printDual({
         json: { signed_out: true, was_signed_in: false, api_url: base2 },
@@ -22008,7 +22520,8 @@ function recallCommand() {
           })
         );
         isScaffolding = (card) => scaffolding.has(byId.get(card.id)?.path ?? "");
-        const capped2 = capTemplates(local.memory_cards, isScaffolding);
+        const sides = new Set(local.conflicts.flatMap((conflict) => conflict.between));
+        const capped2 = capTemplates(local.memory_cards, isScaffolding, (card) => sides.has(card.id));
         templatesWithheld = capped2.withheld.length;
         result = { ...local, memory_cards: capped2.kept };
         entries = built.entries;
@@ -22203,7 +22716,7 @@ ${unsearchedLocal.map(
           if (templatesWithheld > 0) {
             printHuman(
               c.gray(
-                `  ${templatesWithheld} more untouched template${templatesWithheld === 1 ? "" : "s"} matched and ${templatesWithheld === 1 ? "is" : "are"} not shown \u2014 at most ${TEMPLATE_SLOTS} per answer.
+                `  ${templatesWithheld} more untouched template${templatesWithheld === 1 ? "" : "s"} matched and ${templatesWithheld === 1 ? "is" : "are"} not shown \u2014 at most ${TEMPLATE_SLOTS} per answer, plus any that is one side of a conflict.
 `
               )
             );
@@ -22716,7 +23229,7 @@ function rulesCommand() {
             const lane = rule.lane === "project" ? oneLine(project2 ?? "this project", WIDTH.title) : "global";
             printHuman(
               c.gray(
-                `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`${rule.lane ? `  \xB7  ${lane}` : ""}`
+                `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`${rule.lane ? `  \xB7  ${lane}` : ""}${rule.written_by === void 0 ? "" : `  \xB7  ${connectorLabel(rule.written_by)}`}`
               )
             );
           }
@@ -22735,7 +23248,7 @@ ${shownOf - rules2.length} more not shown.`));
               printHuman(`- ${oneLine(rule.summary ?? rule.title, WIDTH.text)}`);
               printHuman(
                 c.gray(
-                  `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`  \xB7  ${oneLine(rule.scope ?? "", WIDTH.title)}`
+                  `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`  \xB7  ${oneLine(rule.scope ?? "", WIDTH.title)}${rule.written_by === void 0 ? "" : `  \xB7  ${connectorLabel(rule.written_by)}`}`
                 )
               );
             }
@@ -22834,151 +23347,14 @@ init_setup();
 init_brand();
 init_version();
 init_config();
-import { spawn as spawn3 } from "child_process";
+init_next_step();
+init_provenance();
+import { spawn as spawn4 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdir as mkdir18, open, readFile as readFile27, stat as stat7, unlink as unlink4 } from "fs/promises";
+import { mkdir as mkdir18, open, readFile as readFile27, rename as rename4, rm as rm8, stat as stat7, unlink as unlink4, writeFile as writeFile15 } from "fs/promises";
 import { join as join28 } from "path";
 import { Command as Command41 } from "commander";
 
-// src/lib/next-step.ts
-init_brand();
-init_api_client();
-init_credentials();
-init_config();
-init_version();
-import { mkdir as mkdir16, readFile as readFile25, writeFile as writeFile13 } from "fs/promises";
-import { join as join26 } from "path";
-function isSetUp(cfg) {
-  return Object.keys(cfg.system.installed).length > 0;
-}
-var FINISH_SETUP = `## memgineering is installed, but not set up yet.
-
-Nothing is connected: there is no brain to read, and the agent tools on this
-machine have no memgineering guidance yet. Setup is one command:
-
-\`\`\`bash
-memgineering setup --web
-\`\`\`
-
-It does NOT wait for them. It returns in a few seconds \u2014 measured \u2014 and leaves
-a setup screen open in their browser at memgineering.com, where they choose
-everything: signing in, where the memory lives, which notes. Nothing is
-installed until they finish there, and this machine picks it up on its own.
-
-If they have not already asked you to set it up, ask them first \u2014 it opens a
-browser window on their computer. Once you run it, tell them in their language
-that the setup screen is open. It prints a short code first: show it to them,
-because the screen asks them to compare it.
-
-No browser on this machine (a server, a container, a sandbox)? Run
-\`memgineering setup --web --print-url\` and give them the link to open on the
-computer they are actually sitting at.
-
-\`setup --agent\` answers every one of those questions on their behalf, and
-\`--no-login\` answers the biggest one \u2014 no account, so the memory cannot follow
-them to another machine. Use it only when they have said they would rather you
-decided, or when this machine cannot reach a browser and \`--print-url\` is no
-use to them either.
-
-Setup's output then says how to connect their brain \u2014 create one, pick one, or
-move existing notes up.
-
-The \`memgineering-setup\` skill covers what comes after.`;
-var SETUP_NUDGE = "memgineering is installed, but not set up yet. `memgineering setup --web` opens a setup screen in their browser and does NOT wait for them \u2014 ask them first unless they asked you to set it up.\nThe full notes: run `memgineering` on its own.";
-async function claimFullSetupNotice() {
-  const marker = join26(brandHome(), "setup-notice-shown");
-  try {
-    await readFile25(marker, "utf8");
-    return false;
-  } catch {
-  }
-  try {
-    await mkdir16(brandHome(), { recursive: true });
-    await writeFile13(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
-`);
-  } catch {
-  }
-  return true;
-}
-var REFRESH_GUIDANCE = `## The guidance in your agent tools is older than this memgineering.
-
-The hub and skills this CLI installs into your tool's home were written by an
-earlier release. One command rewrites them:
-
-\`\`\`bash
-memgineering setup
-\`\`\`
-
-It does not change which brain this machine reads, or any note. Two things it
-does change, both worth knowing before it runs:
-
-- A setup-owned file your user edited is overwritten; setup names it afterwards.
-- Run with no flags where there is no terminal (an agent's shell), it applies
-  setup's defaults over whatever they chose before: auto-update on, its hooks
-  on, every agent tool it finds \u2014 and on a machine not signed in, it starts a
-  sign-in and prints a code. To keep what they chose, pass it:
-  \`--auto-update off\`, \`--hook off\`, \`--no-login\` for a machine they keep
-  local, and \`--tools\` naming every tool they use (a tool left out keeps its
-  old guidance, and this notice stops appearing anyway).
-
-If you are not sure what they chose, ask them. If you run it,
-mention it to your user in one line: it is upkeep for a tool they already set
-up, and they should not have to discover it later.
-
-Guidance files are read at the start of a session, so what changes today
-arrives in the next one.`;
-var CONNECT_A_BRAIN = `## memgineering is set up, and no brain is connected.
-
-A brain is a folder of markdown notes. Until one is connected there is nothing
-to recall and nowhere to remember. Which folder is your user's choice; the
-command is one you can run for them:
-
-\`\`\`bash
-memgineering link <their-notes-folder>   # they already keep notes
-memgineering init <path>                 # they do not \u2014 creates one, laid out
-\`\`\`
-
-\`link\` reports what would be stored before anything is indexed. An existing
-folder needs no index and no frontmatter of its own \u2014 plain markdown is a brain.
-
-Then run \`memgineering onboard\`: it prints what to ask so the brain knows whose
-it is. A brain whose \`01_BASE/\` is still template text answers almost nothing.
-
-Read \`memgineering-setup\` for accounts and which of their tools this reaches.
-
-Synced instead? \`memgineering login\`, then \`memgineering create <name>\`.`;
-var POINT_AT_A_BRAIN = `## Signed in, and this machine reads no brain yet.
-
-\`memgineering brains\` lists what is on the account.
-\`memgineering use --brain <name>\` points this machine at one.
-\`memgineering create <name>\` makes one and points here, when the account has none yet.
-`;
-function nextStepFor(cfg, signedIn = false) {
-  if (signedIn && cfg.brain.cloud === void 0) {
-    return { id: "point_at_a_brain", markdown: POINT_AT_A_BRAIN };
-  }
-  if (isSetUp(cfg) && cfg.system.guidanceVersion !== VERSION) {
-    return { id: "refresh_guidance", markdown: REFRESH_GUIDANCE };
-  }
-  if (cfg.brain.cloud !== void 0 && cfg.brain.cloud.api_url === apiUrl()) return null;
-  if (!isSetUp(cfg)) return { id: "finish_setup", markdown: FINISH_SETUP };
-  if (cfg.brain.brains.length === 0 && cfg.brain.cloud === void 0) {
-    return { id: "connect_a_brain", markdown: CONNECT_A_BRAIN };
-  }
-  return null;
-}
-async function currentNextStep() {
-  try {
-    const stored = await readCredentials().catch(() => null);
-    return nextStepFor(await loadConfig(), stored !== null && stored.api_url === apiUrl());
-  } catch {
-    return null;
-  }
-}
-
-// src/commands/update.ts
-init_provenance();
-
 // src/lib/update-check.ts
 init_atomic();
 init_brand();
@@ -23188,6 +23564,18 @@ async function runUpdate(opts, inherited) {
     return;
   }
   const held = await holdUpdateSlot(inherited);
+  if (held === null && await blockedBy() === "stuck") {
+    const lock = join28(brandHome(), RECLAIM_LOCK);
+    const hint = `A previous update did not finish, and clearing what it left is blocked by ${lock}. If no memgineering update is running, delete that folder and run \`memgineering update\` again.`;
+    printDual({
+      json: { ...status, provenance: provenance.kind, updated: false, reason: "update_claim_stuck", hint },
+      human: () => {
+        printHuman(`memgineering ${status.latest} is available, but a previous update's leftover claim could not be cleared.`);
+        printHuman(c.gray(hint));
+      }
+    });
+    return;
+  }
   if (held === null) {
     const started = (await claimOwner())?.split(" ")[0];
     const hint = "Another memgineering update is installing right now. Run `memgineering update` again in a few minutes \u2014 it reports whether that install worked.";
@@ -23243,10 +23631,10 @@ async function backgroundUpdateNotice(deps = {}) {
     const status = await (deps.check ?? checkForUpdate)(VERSION);
     await reportPreviousAttempt();
     if (status.updateAvailable && cfg.system.autoUpdate === "on" && isSetUp(cfg) && !process.env["CI"]) {
-      const provenance = await (deps.provenance ?? detectProvenance)();
+      const provenance = await (deps.provenance ?? (() => detectProvenance(void 0, { deadlineMs: BACKGROUND_PROBE_DEADLINE_MS })))();
       const token = newClaimToken();
       if (canSelfUpdate(provenance) && await claimUpdateSlot(token)) {
-        (deps.startUpdate ?? ((t) => startDetachedUpdate(spawn3, t)))(token);
+        (deps.startUpdate ?? ((t) => startDetachedUpdate(spawn4, t)))(token);
         notice(
           c.gray(
             `memgineering ${status.latest} is available \u2014 installing it in the background (auto-update is on). The next run uses it.`
@@ -23269,7 +23657,7 @@ async function backgroundUpdateNotice(deps = {}) {
   } catch {
   }
 }
-function startDetachedUpdate(spawnImpl = spawn3, token) {
+function startDetachedUpdate(spawnImpl = spawn4, token) {
   const child = spawnImpl(process.execPath, [process.argv[1] ?? "", "update"], {
     detached: true,
     stdio: "ignore",
@@ -23310,7 +23698,7 @@ async function holdUpdateSlot(inherited) {
 }
 var HOOK_VERBS = /* @__PURE__ */ new Set(["guard", "resurface"]);
 var UPDATE_CLAIM_MS = 15 * 6e4;
-async function claimUpdateSlot(token = newClaimToken()) {
+async function claimUpdateSlot(token = newClaimToken(), hooks = {}) {
   const path = join28(brandHome(), "update-running");
   try {
     await mkdir18(brandHome(), { recursive: true });
@@ -23323,17 +23711,86 @@ async function claimUpdateSlot(token = newClaimToken()) {
     if (err?.code !== "EEXIST") return false;
   }
   try {
-    if (Date.now() - (await stat7(path)).mtimeMs >= UPDATE_CLAIM_MS) await unlink4(path);
+    if (Date.now() - (await stat7(path)).mtimeMs >= UPDATE_CLAIM_MS) {
+      await hooks.afterObserve?.();
+      await withReclaimLock(async () => {
+        if (Date.now() - (await stat7(path)).mtimeMs < UPDATE_CLAIM_MS) return;
+        await hooks.afterRecheck?.();
+        await unlink4(path);
+      });
+    }
   } catch {
   }
   return false;
 }
+var RECLAIM_LOCK = "update-running.reclaim";
+var RECLAIM_LOCK_MAX_MS = 10 * 6e4;
+async function withReclaimLock(fn) {
+  const home = brandHome();
+  const lock = join28(home, RECLAIM_LOCK);
+  const staging = join28(home, `${RECLAIM_LOCK}.${process.pid}.${randomBytes2(4).toString("hex")}`);
+  await mkdir18(staging, { recursive: true });
+  await writeFile15(join28(staging, "owner"), `${process.pid} ${Date.now()}
+`);
+  try {
+    await rename4(staging, lock);
+  } catch {
+    await rm8(staging, { recursive: true, force: true }).catch(() => void 0);
+    await breakAbandonedLock(lock);
+    return null;
+  }
+  try {
+    return await fn();
+  } finally {
+    const aside = `${lock}.done.${randomBytes2(4).toString("hex")}`;
+    await rename4(lock, aside).then(() => rm8(aside, { recursive: true, force: true })).catch(() => void 0);
+  }
+}
+async function breakAbandonedLock(lock) {
+  try {
+    const seen = (await readFile27(join28(lock, "owner"), "utf8")).trim();
+    if (!lockAbandoned(seen)) return;
+    const aside = `${lock}.dead.${randomBytes2(4).toString("hex")}`;
+    await rename4(lock, aside);
+    const moved = (await readFile27(join28(aside, "owner"), "utf8").catch(() => "")).trim();
+    if (moved !== seen) {
+      await rename4(aside, lock).catch(() => void 0);
+      return;
+    }
+    await rm8(aside, { recursive: true, force: true });
+  } catch {
+  }
+}
+function lockAbandoned(owner, now = Date.now()) {
+  const [pidText, atText] = owner.split(" ");
+  const pid = Number(pidText);
+  const at = Number(atText);
+  if (!Number.isFinite(at) || now - at > RECLAIM_LOCK_MAX_MS) return true;
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (err) {
+    return err?.code !== "EPERM";
+  }
+}
+async function blockedBy() {
+  try {
+    const old = Date.now() - (await stat7(join28(brandHome(), "update-running"))).mtimeMs >= UPDATE_CLAIM_MS;
+    if (old) {
+      await stat7(join28(brandHome(), RECLAIM_LOCK));
+      return "stuck";
+    }
+  } catch {
+  }
+  return "in_progress";
+}
 async function reportPreviousAttempt() {
   const previous = await readUpdateState();
   if (!previous || previous.ok) return;
   notice(
     c.yellow(`\u26A0 The last update attempt did not complete: ${previous.message}`) + c.gray(
-      "\n  `memgineering update` shows why. `memgineering setup --agent --auto-update off --hook <on|off>` stops\n  these attempts \u2014 name the hook setting you want kept, because `--agent` sets that too."
+      "\n  `memgineering update` shows why. `memgineering setup --agent --auto-update off` stops\n  these attempts; the hooks stay as this machine recorded them."
     )
   );
 }
@@ -23353,7 +23810,7 @@ function reportBelowMinimum(below) {
 
 // src/commands/undo.ts
 init_src();
-import { readFile as readFile28, rm as rm8 } from "fs/promises";
+import { readFile as readFile28, rm as rm9 } from "fs/promises";
 import { join as join29 } from "path";
 import { Command as Command42 } from "commander";
 init_atomic();
@@ -23523,7 +23980,7 @@ async function reverse(brain, op, current) {
         "Nothing to take back. `memgineering log` shows what this brain recorded."
       );
     }
-    await rm8(absolute, { force: true });
+    await rm9(absolute, { force: true });
     return null;
   }
   if (op.verb === "exclude" || op.verb === "unexclude") {
@@ -23663,7 +24120,7 @@ init_api_client();
 init_credentials();
 init_cloud_brain();
 init_config();
-import { isAbsolute as isAbsolute5, relative as relative2, resolve as resolve15 } from "path";
+import { isAbsolute as isAbsolute5, relative as relative2, resolve as resolve16 } from "path";
 import { Command as Command44 } from "commander";
 init_vault();
 init_ui();
@@ -23693,7 +24150,7 @@ function useCommand() {
       await pointAtHosted(opts.brain, opts, brainPath);
       return;
     }
-    const where = await canonicalize(resolve15(opts.here ?? process.cwd()));
+    const where = await canonicalize(resolve16(opts.here ?? process.cwd()));
     if (!brainPath) {
       const pointer = await readPointer(where);
       const resolved = await resolveBrain(void 0, where).catch((err) => err);
@@ -23839,7 +24296,7 @@ ${hint}`));
       });
       return;
     }
-    const root = await canonicalize(resolve15(brainPath));
+    const root = await canonicalize(resolve16(brainPath));
     const cfg = await loadConfig();
     if (!findBrain(cfg, root)) {
       throw memgError(
@@ -23866,7 +24323,7 @@ A pointer to an unlinked folder would fail on every command instead of at this o
       return;
     }
     const value = isInside(root, where) ? relative2(where, root) || "." : root;
-    const file = resolve15(where, BRAND.pointerFileName);
+    const file = resolve16(where, BRAND.pointerFileName);
     await writeThenRename(file, `${value}
 `);
     printDual({
@@ -24056,6 +24513,8 @@ function whoamiCommand() {
 }
 
 // src/program.ts
+init_config();
+init_next_step();
 init_ui();
 init_brand();
 
@@ -24178,6 +24637,10 @@ async function announceNextStep(commandName, reader) {
   const step = await currentNextStep();
   if (step === null) return;
   announced = true;
+  if (step.id === "setup_connected") {
+    const cfg = await loadConfig().catch(() => null);
+    if (cfg?.system.setupConnected) await markConnectedNoticeShown(cfg.system.setupConnected.at);
+  }
   if (step.id === "finish_setup" && reader !== "full") {
     const text = reader === "person" ? SHORT_SETUP_NOTICE : reader === "verb" && await claimFullSetupNotice() ? step.markdown : SETUP_NUDGE;
     process.stderr.write(`
@@ -24242,8 +24705,14 @@ async function run3(argv) {
       process.stderr.isTTY === true ? "person" : cleaned[2] === void 0 ? "full" : "brief"
     );
   }
+  let ran;
+  program.hook("preAction", (_root, action) => {
+    let command = action;
+    while (command.parent && command.parent !== program) command = command.parent;
+    ran = command === program ? void 0 : command.name();
+  });
   await program.parseAsync(cleaned);
-  if (argv[2] !== "update") await backgroundUpdateNotice(argv[2] === void 0 ? {} : { verb: argv[2] });
+  if (ran !== "update") await backgroundUpdateNotice(ran === void 0 ? {} : { verb: ran });
 }
 async function handleError(err) {
   const failure = adaptRegistryError(err) ?? err;