memgineering 0.25.3 → 0.26.0

package/dist/index.js

@@ -1325,8 +1325,8 @@ var init_exclude = __esm({
       [...ALWAYS_SKIP_DIRS].map((d) => fold(d))
     );
     ALWAYS_SKIP_SEGMENTS_FOLDED = ALWAYS_SKIP_SEGMENTS.map((s) => fold(s));
-    ALWAYS_SKIP_FILE = (basename4) => {
-      const b = fold(basename4);
+    ALWAYS_SKIP_FILE = (basename5) => {
+      const b = fold(basename5);
       return b.startsWith(".env") || b === ".ds_store" || b === ".memgdeny" || b === ".memgallow" || b === ".memgignore";
     };
     EMPTY_IGNORE_SET = { rules: [], unsupported: [] };
@@ -5541,6 +5541,13 @@ var init_config = __esm({
          * Absent on a machine set up before it was recorded.
          */
         hook: z8.enum(["on", "off"]).optional().catch(void 0),
+        /**
+         * Which "left your hooks alone" notices the automatic hook refresh has
+         * already given, as `<file>:<reason>` — so a symlinked or unparseable
+         * settings file is mentioned once, not at the start of every session
+         * (lib/hook-refresh.ts, `refreshNotice`).
+         */
+        hookNoticesTold: z8.array(z8.string()).optional().catch(void 0),
         /**
          * Notes `setup --web` was asked to upload, not yet sent.
          *
@@ -6733,7 +6740,7 @@ var init_cloud_pointer = __esm({
 
 // src/commands/link.ts
 import { readFile as readFile18 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { Command as Command13 } from "commander";
 import prompts2 from "prompts";
 function sameBasename(all, entry) {
@@ -6937,7 +6944,7 @@ async function recordLink(adapter, observationsDir) {
 }
 async function refuseSilentRules(path, denied, excluded, unsupported) {
   const denyEntries = (await LocalFileReadAdapter.readDenyFile(path, ".memgdeny")).entries;
-  const rawDenyLines = await readFile18(join17(path, ".memgdeny"), "utf8").then(
+  const rawDenyLines = await readFile18(join18(path, ".memgdeny"), "utf8").then(
     (t) => t.split("\n").map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"))
   ).catch(() => []);
   const asWritten = (folded) => rawDenyLines.find(
@@ -7565,6 +7572,228 @@ var init_push = __esm({
   }
 });
 
+// src/lib/guard-shell.ts
+function guardHookCommand() {
+  return `/bin/sh -c '${GUARD_SHELL_SCRIPT}'`;
+}
+var GUARD_SHELL_SCRIPT;
+var init_guard_shell = __esm({
+  "src/lib/guard-shell.ts"() {
+    "use strict";
+    GUARD_SHELL_SCRIPT = [
+      'h="${MEMGINEERING_HOME-$HOME/.memgineering}"',
+      'f="$h/guard/fast"',
+      'c="$h/config.json"',
+      'k="$h/credentials.json"',
+      "g() { memgineering guard; exit 0; }",
+      '[ -f "$c" ] && [ -f "$k" ] && [ -d "$f" ] || g',
+      "p=$(cat)",
+      'go() { printf "%s\\n" "$p" | g; exit 0; }',
+      '[ -n "$p" ] || exit 0',
+      'q=\\"',
+      'case "$p" in */memory/* | *"$q"memory/* | *"\\\\/memory\\\\/"* | *"$q"memory\\\\/*) go ;; esac',
+      'w=${p%%"$q"*}',
+      'r=${p#"$w"}',
+      'case "$r" in "$q"session_id"$q"*) ;; *) go ;; esac',
+      'r=${r#"$q"session_id"$q"}',
+      "w=${r%%[![:space:]]*}",
+      'r=${r#"$w"}',
+      'case "$r" in :*) ;; *) go ;; esac',
+      "r=${r#:}",
+      "w=${r%%[![:space:]]*}",
+      'r=${r#"$w"}',
+      'case "$r" in "$q"*) ;; *) go ;; esac',
+      'r=${r#"$q"}',
+      's=${r%%"$q"*}',
+      'case "$s" in "" | *[!A-Za-z0-9-]*) go ;; esac',
+      'm=""',
+      'if [ -f "$f/$s" ]; then m="$f/$s"; else',
+      '  n=""',
+      '  for e in "$f/$s".empty.*; do',
+      '    [ -f "$e" ] || continue',
+      "    t=${e##*.}",
+      '    case "$t" in "" | *[!0-9]*) continue ;; esac',
+      '    [ -n "$n" ] || n=$(date +%s)',
+      '    if [ "$t" -gt "$n" ]; then m="$e"; break; fi',
+      "  done",
+      '  [ -n "$m" ] || go',
+      '  [ "$f/.rules-changed" -nt "$m" ] && go',
+      "fi",
+      '[ "$c" -nt "$m" ] && go',
+      '[ "$k" -nt "$m" ] && go',
+      "exit 0"
+    ].join("\n");
+  }
+});
+
+// src/lib/hook-refresh.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { chmod, lstat as lstat5, readdir as readdir8, readFile as readFile24, stat as stat7, unlink as unlink5, writeFile as writeFile14 } from "fs/promises";
+import { basename as basename3, dirname as dirname8, join as join24 } from "path";
+function moveShippedCommands(parsed, moves) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const settings = parsed;
+  const hooks = settings["hooks"];
+  if (hooks === void 0) return { next: settings, changed: 0 };
+  if (hooks === null || typeof hooks !== "object" || Array.isArray(hooks)) return null;
+  let changed = 0;
+  const nextHooks = { ...hooks };
+  for (const move of moves) {
+    const groups = nextHooks[move.event];
+    if (!Array.isArray(groups)) continue;
+    nextHooks[move.event] = groups.map((group) => {
+      const entries = group?.hooks;
+      if (!Array.isArray(entries)) return group;
+      let touched = false;
+      const nextEntries = entries.map((entry) => {
+        const command = entry?.command;
+        if (typeof command !== "string" || command === move.to || !move.from.includes(command)) {
+          return entry;
+        }
+        touched = true;
+        changed += 1;
+        return { ...entry, command: move.to };
+      });
+      return touched ? { ...group, hooks: nextEntries } : group;
+    });
+  }
+  return { next: changed === 0 ? settings : { ...settings, hooks: nextHooks }, changed };
+}
+async function lockHolder() {
+  try {
+    const [info, token] = await Promise.all([stat7(lockPath2()), readFile24(lockPath2(), "utf8")]);
+    return { token, ageMs: Date.now() - info.mtimeMs };
+  } catch {
+    return null;
+  }
+}
+async function unlinkIfStill(token) {
+  const now = await readFile24(lockPath2(), "utf8").catch(() => null);
+  if (now === token) await unlink5(lockPath2()).catch(() => void 0);
+}
+async function takeOver(dead) {
+  try {
+    await writeFile14(takeoverPath(), "", { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      const age = await stat7(takeoverPath()).then(
+        (info) => Date.now() - info.mtimeMs,
+        () => null
+      );
+      if (age !== null && age > STALE_LOCK_MS) await unlink5(takeoverPath()).catch(() => void 0);
+    }
+    return false;
+  }
+  try {
+    const held = await lockHolder();
+    if (held !== null && held.token === dead && held.ageMs > STALE_LOCK_MS) {
+      await unlink5(lockPath2()).catch(() => void 0);
+    }
+    return true;
+  } finally {
+    await unlink5(takeoverPath()).catch(() => void 0);
+  }
+}
+async function withHookFileLock(fn, waitMs = 0) {
+  const token = `${process.pid}-${randomUUID4()}`;
+  const deadline = Date.now() + waitMs;
+  for (let vanished = 0; ; ) {
+    try {
+      await writeFile14(lockPath2(), token, { flag: "wx", mode: 384 });
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") return null;
+    }
+    const held = await lockHolder();
+    if (held === null) {
+      vanished += 1;
+      if (vanished > 20) return null;
+      continue;
+    }
+    if (held.ageMs > STALE_LOCK_MS && await takeOver(held.token)) continue;
+    if (Date.now() >= deadline) return null;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  try {
+    return await fn();
+  } finally {
+    await unlinkIfStill(token);
+  }
+}
+async function clearStaleTemps(path) {
+  const dir = dirname8(path);
+  const prefix = `${basename3(path)}.`;
+  const names = await readdir8(dir).catch(() => []);
+  await Promise.all(
+    names.filter((n) => n.startsWith(prefix) && /\.\d+\.tmp$/.test(n)).map(async (n) => {
+      const age = await stat7(join24(dir, n)).then((s) => Date.now() - s.mtimeMs).catch(() => 0);
+      if (age > STALE_LOCK_MS) await unlink5(join24(dir, n)).catch(() => void 0);
+    })
+  );
+}
+async function readSettings(path) {
+  const raw = await readFile24(path, "utf8").catch(() => null);
+  if (raw === null) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function refreshHookFile(path, moves) {
+  const info = await lstat5(path).catch(() => null);
+  if (info === null) return "missing";
+  if (info.isSymbolicLink()) return "symlink";
+  await clearStaleTemps(path);
+  const first = moveShippedCommands(await readSettings(path), moves);
+  if (first === null) return "refused";
+  if (first.changed === 0) return "unchanged";
+  const outcome = await withHookFileLock(async () => {
+    const again = moveShippedCommands(await readSettings(path), moves);
+    if (again === null) return "refused";
+    if (again.changed === 0) return "unchanged";
+    await writeThenRename(path, `${JSON.stringify(again.next, null, 2)}
+`);
+    await chmod(path, info.mode & 4095).catch(() => void 0);
+    return "changed";
+  });
+  return outcome ?? "busy";
+}
+function refreshNotice(report3, told) {
+  const lines2 = [];
+  if (report3.changed.length > 0) {
+    lines2.push(
+      `memgineering brought its own hooks up to this version in ${report3.changed.join(", ")} \u2014 the before-edit check now answers an already-served session without starting node.`
+    );
+    if (report3.changed.some((p) => /[/\\]\.codex[/\\]hooks\.json$/.test(p))) {
+      lines2.push(
+        "Codex will ask to review the changed hook the next time it starts: trust it (press `t`) \u2014 until then neither memgineering hook runs in Codex."
+      );
+    }
+  }
+  const nowTold = [...told];
+  for (const skip of report3.skipped) {
+    const key2 = `${skip.path}:${skip.why}`;
+    if (nowTold.includes(key2)) continue;
+    nowTold.push(key2);
+    lines2.push(
+      skip.why === "symlink" ? `memgineering left its hooks in ${skip.path} as they are: the file is a link, and rewriting it would replace the link. \`memgineering setup\` updates them when you want it to.` : `memgineering left its hooks in ${skip.path} as they are: the file does not parse as JSON. Fix it, then \`memgineering setup\` updates them.`
+    );
+  }
+  return { text: lines2.length === 0 ? null : lines2.join("\n"), told: nowTold };
+}
+var STALE_LOCK_MS, lockPath2, takeoverPath;
+var init_hook_refresh = __esm({
+  "src/lib/hook-refresh.ts"() {
+    "use strict";
+    init_atomic();
+    init_brand();
+    STALE_LOCK_MS = 3e4;
+    lockPath2 = () => join24(brandHome(), "hook-files.lock");
+    takeoverPath = () => `${lockPath2()}.takeover`;
+  }
+});
+
 // src/commands/setup-brain.ts
 function migration(localBrains) {
   return ` They also keep ${localBrains} brain(s) in folders on this machine. Offer moving those notes to the account instead of starting empty: \`memgineering push --brain <name>\` uploads a folder into a hosted brain and points here (nothing local is deleted), then \`memgineering reindex\` makes the moved notes searchable by meaning. The memgineering-setup skill has the migration steps.`;
@@ -7899,38 +8128,38 @@ var init_setup_signin = __esm({
 });
 
 // src/lib/next-step.ts
-import { mkdir as mkdir15, readFile as readFile24, writeFile as writeFile13 } from "fs/promises";
-import { join as join23 } from "path";
+import { mkdir as mkdir16, readFile as readFile25, writeFile as writeFile15 } from "fs/promises";
+import { join as join25 } from "path";
 function isSetUp(cfg) {
   return Object.keys(cfg.system.installed).length > 0;
 }
 function connectedMarker(at) {
-  return join23(brandHome(), `setup-connected-shown-${at.replace(/[^0-9A-Za-z]/g, "")}`);
+  return join25(brandHome(), `setup-connected-shown-${at.replace(/[^0-9A-Za-z]/g, "")}`);
 }
 async function connectedNoticeShown(at) {
-  return readFile24(connectedMarker(at), "utf8").then(
+  return readFile25(connectedMarker(at), "utf8").then(
     () => true,
     () => false
   );
 }
 async function markConnectedNoticeShown(at) {
   try {
-    await mkdir15(brandHome(), { recursive: true });
-    await writeFile13(connectedMarker(at), `${(/* @__PURE__ */ new Date()).toISOString()}
+    await mkdir16(brandHome(), { recursive: true });
+    await writeFile15(connectedMarker(at), `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
   } catch {
   }
 }
 async function claimFullSetupNotice() {
-  const marker = join23(brandHome(), "setup-notice-shown");
+  const marker = join25(brandHome(), "setup-notice-shown");
   try {
-    await readFile24(marker, "utf8");
+    await readFile25(marker, "utf8");
     return false;
   } catch {
   }
   try {
-    await mkdir15(brandHome(), { recursive: true });
-    await writeFile13(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
+    await mkdir16(brandHome(), { recursive: true });
+    await writeFile15(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
   } catch {
   }
@@ -8096,12 +8325,12 @@ Synced instead? \`memgineering login\`, then \`memgineering create <name>\`.`;
 // src/lib/provenance.ts
 import { execFile, spawn as spawn2 } from "child_process";
 import { realpath as realpath3 } from "fs/promises";
-import { dirname as dirname8, join as join24, resolve as resolve14 } from "path";
+import { dirname as dirname9, join as join26, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { promisify } from "util";
 async function detectProvenance(selfPath, opts = {}) {
   const entry = selfPath ?? fileURLToPath2(import.meta.url);
-  const selfDir = await realpath3(dirname8(entry)).catch(() => dirname8(entry));
+  const selfDir = await realpath3(dirname9(entry)).catch(() => dirname9(entry));
   if (/[\\/]_npx[\\/]|[\\/]\.npm[\\/]_cacache[\\/]/.test(selfDir)) {
     return {
       kind: "npx",
@@ -8219,7 +8448,7 @@ function isInside2(child, parent) {
 }
 async function unreachableByName(selfPath) {
   const entry = selfPath ?? fileURLToPath2(import.meta.url);
-  const selfDir = await realpath3(dirname8(entry)).catch(() => dirname8(entry));
+  const selfDir = await realpath3(dirname9(entry)).catch(() => dirname9(entry));
   if (!/[\\/](node_modules|_npx|_cacache)[\\/]/.test(`${selfDir}/`)) return null;
   const p = await detectProvenance(entry);
   return p.kind === "local" || p.kind === "npx" ? p.reason : null;
@@ -8234,7 +8463,7 @@ var init_provenance = __esm({
         kind: "npm",
         bin: "npm",
         prefixArgs: ["prefix", "-g"],
-        moduleRoot: (prefix) => process.platform === "win32" ? join24(prefix, "node_modules") : join24(prefix, "lib", "node_modules"),
+        moduleRoot: (prefix) => process.platform === "win32" ? join26(prefix, "node_modules") : join26(prefix, "lib", "node_modules"),
         install: "npm i -g memgineering@latest"
       },
       {
@@ -8271,9 +8500,9 @@ __export(setup_cloud_exports, {
 });
 import { spawn as spawn3 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { readdir as readdir7, stat as stat6 } from "fs/promises";
+import { readdir as readdir9, stat as stat8 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { basename as basename3, dirname as dirname9, join as join25, resolve as resolve15, sep as sep4 } from "path";
+import { basename as basename4, dirname as dirname10, join as join27, resolve as resolve15, sep as sep4 } from "path";
 async function report2(setupToken, state, detail, code) {
   try {
     await apiRequest({
@@ -8291,16 +8520,16 @@ async function report2(setupToken, state, detail, code) {
 }
 async function folderCandidates() {
   const home = homedir5();
-  const roots = ["Documents", "notes", "Notes", "Obsidian", "vault"].map((d) => join25(home, d));
+  const roots = ["Documents", "notes", "Notes", "Obsidian", "vault"].map((d) => join27(home, d));
   const found = [];
   const countNotes = async (dir) => {
     let count = 0;
-    const entries = await readdir7(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await readdir9(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
       if (entry.isFile() && /\.(md|markdown)$/i.test(entry.name)) count += 1;
       else if (entry.isDirectory()) {
-        const inner = await readdir7(join25(dir, entry.name)).catch(() => []);
+        const inner = await readdir9(join27(dir, entry.name)).catch(() => []);
         count += inner.filter((n) => /\.(md|markdown)$/i.test(n)).length;
       }
       if (count > 999) break;
@@ -8308,7 +8537,7 @@ async function folderCandidates() {
     return count;
   };
   for (const root of roots) {
-    const info = await stat6(root).catch(() => null);
+    const info = await stat8(root).catch(() => null);
     if (!info?.isDirectory()) continue;
     const notes = await countNotes(root);
     if (notes > 0) found.push({ path: root, note_count: notes });
@@ -8643,9 +8872,9 @@ function insideFolder(target, folder) {
       realpathSync2(existing);
       break;
     } catch {
-      const parent = dirname9(existing);
+      const parent = dirname10(existing);
       if (parent === existing) break;
-      rest.unshift(basename3(existing));
+      rest.unshift(basename4(existing));
       existing = parent;
     }
   }
@@ -8692,14 +8921,14 @@ var init_setup_cloud = __esm({
 
 // src/commands/setup.ts
 import { createHash as createHash9 } from "crypto";
-import { access as access2, mkdir as mkdir16, readFile as readFile25 } from "fs/promises";
-import { dirname as dirname10, join as join26 } from "path";
+import { access as access2, mkdir as mkdir17, readFile as readFile26 } from "fs/promises";
+import { dirname as dirname11, join as join28 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { Command as Command40 } from "commander";
+import { Command as Command38 } from "commander";
 import prompts5 from "prompts";
 import { homedir as homedir6 } from "os";
 function setupCommand() {
-  return new Command40("setup").description("install into your agents, and point at a brain (--dry-run to only report)").option("--agent", "non-interactive: take every answer from flags").option("--human", "interactive: choose from a list").option("--web", "open a screen in the browser and answer it there").option("--print-url", "with --web: print the URL instead of opening a browser").option(
+  return new Command38("setup").description("install into your agents, and point at a brain (--dry-run to only report)").option("--agent", "non-interactive: take every answer from flags").option("--human", "interactive: choose from a list").option("--web", "open a screen in the browser and answer it there").option("--print-url", "with --web: print the URL instead of opening a browser").option(
     "--wait",
     "with --web: block until the screen is finished, even with nobody watching the terminal"
   ).option(
@@ -9060,7 +9289,7 @@ async function applySetup(choice, dryRun) {
   }
   async function write2() {
     for (const tool of choice.tools) {
-      const hubPath = join26(agentHome(), tool.hubFile);
+      const hubPath = join28(agentHome(), tool.hubFile);
       const written = await injectBlock(
         hubPath,
         hub + tailFor(tool, choice.hook),
@@ -9075,8 +9304,8 @@ async function applySetup(choice, dryRun) {
       });
       if (!dryRun && written.after !== null) mark(hubPath, written.after);
       for (const skill of BRAND.subSkills) {
-        const content = await loadAsset(join26(skill, "SKILL.md"));
-        const path = join26(agentHome(), tool.skillsDir, skill, "SKILL.md");
+        const content = await loadAsset(join28(skill, "SKILL.md"));
+        const path = join28(agentHome(), tool.skillsDir, skill, "SKILL.md");
         const out = await writeIfDifferent(path, content, dryRun);
         results.push({
           tool: tool.label,
@@ -9092,7 +9321,14 @@ async function applySetup(choice, dryRun) {
         results.push({
           tool: tool.label,
           what: hook.what,
-          result: choice.hook ? await installHook(hook, tool, dryRun) : await removeHook(hook, tool, dryRun)
+          // Under the lock every writer of these files takes, so a session
+          // starting meanwhile cannot refresh the same file under this write.
+          // A lock nobody gives up within five seconds is a crashed holder or
+          // a stuck one; the write goes ahead rather than leaving setup hung.
+          result: await (async () => {
+            const write3 = () => choice.hook ? installHook(hook, tool, dryRun) : removeHook(hook, tool, dryRun);
+            return await withHookFileLock(write3, 5e3) ?? write3();
+          })()
         });
       }
     }
@@ -9159,7 +9395,7 @@ async function hooksArmed(tools) {
   const capable = tools.filter((t) => t.hooks && t.hooksFile);
   if (capable.length === 0) return void 0;
   for (const tool of capable) {
-    const raw = await readFile25(join26(agentHome(), ...(tool.hooksFile ?? "").split("/")), "utf8").catch(
+    const raw = await readFile26(join28(agentHome(), ...(tool.hooksFile ?? "").split("/")), "utf8").catch(
       () => ""
     );
     if (hooksFor([tool]).some((spec) => raw.includes(spec.signature))) return "on";
@@ -9199,7 +9435,7 @@ async function detectTools() {
   const home = agentHome();
   const found = [];
   for (const tool of TOOLS) {
-    if (await exists2(join26(home, tool.dir))) found.push(tool);
+    if (await exists2(join28(home, tool.dir))) found.push(tool);
   }
   return found;
 }
@@ -9299,10 +9535,10 @@ async function injectBlock(filePath, content, dryRun, weWroteThis) {
   const block = `${BRAND.hubMarkerStart}
 ${content.trimEnd()}
 ${BRAND.hubMarkerEnd}`;
-  const existing = await readFile25(filePath, "utf8").catch(() => null);
+  const existing = await readFile26(filePath, "utf8").catch(() => null);
   if (existing === null) {
     if (!dryRun) {
-      await mkdir16(dirname10(filePath), { recursive: true });
+      await mkdir17(dirname11(filePath), { recursive: true });
       await writeThenRename(filePath, `${block}
 `);
     }
@@ -9342,23 +9578,56 @@ function looksLikeOurGuide(text) {
   return text.includes("memgineering recall") && text.includes("memgineering remember");
 }
 async function writeIfDifferent(filePath, content, dryRun) {
-  const existing = await readFile25(filePath, "utf8").catch(() => null);
+  const existing = await readFile26(filePath, "utf8").catch(() => null);
   const after = fingerprint(content);
   if (existing === content) return { outcome: "unchanged", before: existing, after };
   if (!dryRun) {
-    await mkdir16(dirname10(filePath), { recursive: true });
+    await mkdir17(dirname11(filePath), { recursive: true });
     await writeThenRename(filePath, content);
   }
   return { outcome: existing === null ? "injected" : "updated", before: existing, after };
 }
+function guardCommandFor(platform2) {
+  return platform2 === "win32" ? "memgineering guard || true" : guardHookCommand();
+}
+async function refreshOwnHookCommands() {
+  const moves = HOOKS.filter((h) => h.event !== "Stop").map((h) => ({
+    event: h.event,
+    from: SHIPPED_HOOK_COMMANDS[h.event],
+    to: h.command
+  }));
+  const changed = [];
+  const skipped = [];
+  for (const tool of TOOLS.filter((t) => t.hooks && t.hooksFile && DEFAULT_HOOK_TOOLS.includes(t.id))) {
+    const path = join28(agentHome(), ...(tool.hooksFile ?? "").split("/"));
+    const outcome = await refreshHookFile(path, moves);
+    if (outcome === "changed") changed.push(path);
+    else if (outcome === "symlink" || outcome === "refused") skipped.push({ path, why: outcome });
+  }
+  return { changed, skipped };
+}
+async function refreshOwnHooksAndTell(say) {
+  try {
+    const report3 = await refreshOwnHookCommands();
+    if (report3.changed.length === 0 && report3.skipped.length === 0) return;
+    const cfg = await loadConfig();
+    const told = cfg.system.hookNoticesTold ?? [];
+    const { text, told: nowTold } = refreshNotice(report3, told);
+    if (nowTold.length !== told.length) {
+      await saveConfig({ ...cfg, system: { ...cfg.system, hookNoticesTold: nowTold } });
+    }
+    if (text !== null) say(text);
+  } catch {
+  }
+}
 function hooksFor(tools) {
   return HOOKS.filter(
     (h) => tools.some((t) => t.hooks && (h.tools ?? DEFAULT_HOOK_TOOLS).includes(t.id))
   );
 }
 async function installHook(spec, tool, dryRun) {
-  const settingsPath = join26(agentHome(), ...(tool.hooksFile ?? "").split("/"));
-  const raw = await readFile25(settingsPath, "utf8").catch(() => null);
+  const settingsPath = join28(agentHome(), ...(tool.hooksFile ?? "").split("/"));
+  const raw = await readFile26(settingsPath, "utf8").catch(() => null);
   let settings = {};
   if (raw !== null) {
     try {
@@ -9400,15 +9669,15 @@ async function installHook(spec, tool, dryRun) {
   }
   const next = { ...settings, hooks: { ...hooks, [spec.event]: existingGroups } };
   if (!dryRun) {
-    await mkdir16(dirname10(settingsPath), { recursive: true });
+    await mkdir17(dirname11(settingsPath), { recursive: true });
     await writeThenRename(settingsPath, `${JSON.stringify(next, null, 2)}
 `);
   }
   return raw === null ? "injected" : "updated";
 }
 async function removeHook(spec, tool, dryRun) {
-  const settingsPath = join26(agentHome(), ...(tool.hooksFile ?? "").split("/"));
-  const raw = await readFile25(settingsPath, "utf8").catch(() => null);
+  const settingsPath = join28(agentHome(), ...(tool.hooksFile ?? "").split("/"));
+  const raw = await readFile26(settingsPath, "utf8").catch(() => null);
   if (raw === null) return "unchanged";
   let parsed;
   try {
@@ -9432,7 +9701,7 @@ async function removeHook(spec, tool, dryRun) {
   return "removed";
 }
 async function loadAsset(relPath) {
-  const raw = await readFile25(join26(await assetRoot(), relPath), "utf8");
+  const raw = await readFile26(join28(await assetRoot(), relPath), "utf8");
   if (relPath === BRAND.hubFileName && raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 4);
     if (end !== -1) return raw.slice(end + 4).trimStart();
@@ -9440,14 +9709,14 @@ async function loadAsset(relPath) {
   return raw;
 }
 async function assetRoot() {
-  const here = dirname10(fileURLToPath3(import.meta.url));
-  const bundled = join26(here, "..", "assets");
-  if (await exists2(join26(bundled, BRAND.hubFileName))) return bundled;
+  const here = dirname11(fileURLToPath3(import.meta.url));
+  const bundled = join28(here, "..", "assets");
+  if (await exists2(join28(bundled, BRAND.hubFileName))) return bundled;
   let dir = here;
   for (; ; ) {
-    const candidate = join26(dir, "packages", "skills");
-    if (await exists2(join26(candidate, BRAND.hubFileName))) return candidate;
-    const parent = dirname10(dir);
+    const candidate = join28(dir, "packages", "skills");
+    if (await exists2(join28(candidate, BRAND.hubFileName))) return candidate;
+    const parent = dirname11(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -9465,13 +9734,15 @@ async function exists2(path) {
     return false;
   }
 }
-var TOOLS, HOSTED_CONNECTOR_URL, SUPPORTED_LIST, REFUSAL_HINT, DUPLICATE_HINT, HOOK_TIMEOUT_S, DEFAULT_HOOK_TOOLS, HOOK_WHAT, HOOKS;
+var TOOLS, HOSTED_CONNECTOR_URL, SUPPORTED_LIST, REFUSAL_HINT, DUPLICATE_HINT, HOOK_TIMEOUT_S, DEFAULT_HOOK_TOOLS, HOOK_WHAT, HOOKS, SHIPPED_HOOK_COMMANDS;
 var init_setup = __esm({
   "src/commands/setup.ts"() {
     "use strict";
     init_atomic();
     init_brand();
     init_deadline();
+    init_guard_shell();
+    init_hook_refresh();
     init_errors();
     init_setup_brain();
     init_setup_signin();
@@ -9599,7 +9870,7 @@ For a guide: put ${BRAND.hubMarkerStart} and ${BRAND.hubMarkerEnd} back around t
           // here would mean a session that reads and answers never hears a rule.
           codex: "apply_patch|Bash"
         },
-        command: "memgineering guard || true",
+        command: guardCommandFor(process.platform),
         signature: "memgineering guard"
       },
       {
@@ -9625,6 +9896,13 @@ For a guide: put ${BRAND.hubMarkerStart} and ${BRAND.hubMarkerEnd} back around t
         tools: ["grok"]
       }
     ];
+    SHIPPED_HOOK_COMMANDS = {
+      SessionStart: [
+        "memgineering resurface --limit 5 || true",
+        `memgineering resurface --limit 5 --deadline ${HOOK_DEADLINE_MS} || true`
+      ],
+      PreToolUse: ["memgineering guard || true"]
+    };
   }
 });
 
@@ -14072,6 +14350,69 @@ init_errors();
 init_index_build();
 init_cloud_brain();
 init_vault();
+
+// src/lib/guard-fast.ts
+init_brand();
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir11, readdir as readdir6, rename as rename4, stat as stat3, unlink as unlink3, utimes, writeFile as writeFile9 } from "fs/promises";
+import { join as join17 } from "path";
+var fastDir = () => join17(brandHome(), "guard", "fast");
+var EMPTY_TTL_S = 120;
+var SESSION_ID = /^[A-Za-z0-9-]{1,128}$/;
+var EMPTY_MARK = /^(.+)\.empty\.(\d+)$/;
+var RULES_CHANGED = ".rules-changed";
+var TMP_PREFIX = ".tmp-";
+async function place(name, asOfMs) {
+  await mkdir11(fastDir(), { recursive: true, mode: 448 });
+  const tmp = join17(fastDir(), `${TMP_PREFIX}${process.pid}-${randomUUID2()}`);
+  try {
+    await writeFile9(tmp, "", { mode: 384 });
+    const dated = (asOfMs - 1e3) / 1e3;
+    await utimes(tmp, dated, dated);
+    await rename4(tmp, join17(fastDir(), name));
+  } catch (err) {
+    await unlink3(tmp).catch(() => void 0);
+    throw err;
+  }
+}
+async function markServed(sessionId, asOfMs) {
+  if (!SESSION_ID.test(sessionId)) return;
+  await place(sessionId, asOfMs).catch(() => void 0);
+}
+async function markEmpty(sessionId, asOfMs) {
+  if (!SESSION_ID.test(sessionId)) return;
+  const until = Math.floor(asOfMs / 1e3) + EMPTY_TTL_S;
+  await place(`${sessionId}.empty.${until}`, asOfMs).catch(() => void 0);
+  await unlink3(join17(fastDir(), sessionId)).catch(() => void 0);
+}
+async function forgetEmptyChecks() {
+  await mkdir11(fastDir(), { recursive: true, mode: 448 }).then(() => writeFile9(join17(fastDir(), RULES_CHANGED), "", { mode: 384 })).catch(() => void 0);
+  const names = await readdir6(fastDir()).catch(() => []);
+  await Promise.all(
+    names.filter((name) => EMPTY_MARK.test(name)).map((name) => unlink3(join17(fastDir(), name)).catch(() => void 0))
+  );
+}
+var SERVED_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var TMP_TTL_MS = 60 * 1e3;
+async function pruneFast(nowMs = Date.now()) {
+  const names = await readdir6(fastDir()).catch(() => []);
+  const nowS = Math.floor(nowMs / 1e3);
+  await Promise.all(
+    names.map(async (name) => {
+      const path = join17(fastDir(), name);
+      const empty = EMPTY_MARK.exec(name);
+      if (empty) {
+        if (Number(empty[2]) <= nowS) await unlink3(path).catch(() => void 0);
+        return;
+      }
+      const info = await stat3(path).catch(() => null);
+      const ttl = name.startsWith(TMP_PREFIX) ? TMP_TTL_MS : SERVED_TTL_MS;
+      if (info && nowMs - info.mtimeMs > ttl) await unlink3(path).catch(() => void 0);
+    })
+  );
+}
+
+// src/commands/remember.ts
 init_ui();
 function rememberCommand() {
   const said = { scope: false, noScope: false };
@@ -14145,6 +14486,7 @@ function rememberCommand() {
         const kindLanded = kind === void 0 || written.kind === kind;
         const boundaryLanded = neverStore.length === 0 || Array.isArray(written.never_store) && neverStore.every((term) => written.never_store?.includes(term) === true);
         const overrideLanded = opts.overrideBoundary === void 0 || "boundary_override" in written;
+        if (binding) await forgetEmptyChecks();
         printDual({
           json: {
             id: written.id,
@@ -14779,6 +15121,7 @@ async function reviseHosted(where, ref, opts, added) {
       }
     }
   }
+  if (opts.rule === true) await forgetEmptyChecks();
   printDual({
     json: {
       brain: where.name,
@@ -16522,7 +16865,7 @@ async function deleteCloudBrain(args) {
 
 // src/commands/curation.ts
 init_src();
-import { stat as stat3 } from "fs/promises";
+import { stat as stat4 } from "fs/promises";
 import { resolve as resolve8 } from "path";
 import { Command as Command14 } from "commander";
 
@@ -16838,7 +17181,7 @@ async function mustMatchAFile(root, adapter, path) {
   const wanted = path.normalize("NFC").replace(/^\/+/, "");
   const absolute = resolve8(root, wanted);
   if (isInside(absolute, root)) {
-    const found = await stat3(absolute).catch(() => null);
+    const found = await stat4(absolute).catch(() => null);
     if (found?.isFile()) return wanted;
   }
   const hits = sameBasename(await adapter.list(""), path);
@@ -17412,8 +17755,8 @@ function ago(iso, now) {
 init_brand();
 init_config();
 import { createHash as createHash7 } from "crypto";
-import { mkdir as mkdir11, readdir as readdir6, stat as stat4, unlink as unlink3, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join18, resolve as resolve9 } from "path";
+import { mkdir as mkdir12, readdir as readdir7, stat as stat5, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join19, resolve as resolve9 } from "path";
 import { Command as Command17 } from "commander";
 
 // src/lib/rules.ts
@@ -17484,6 +17827,7 @@ function renderRuleGroups(rules, project) {
 init_src();
 init_deadline();
 init_cloud_brain();
+init_vault();
 function guardCommand() {
   return new Command17("guard").description("hook entry \u2014 show the user\u2019s rules before the first edit of a session").option("--context-dir <path>", "where the work is happening, when stdin does not say").option("--at <event>", "pre-tool-use | stop", "pre-tool-use").action(async (opts) => {
     try {
@@ -17548,22 +17892,35 @@ async function runStopGuard(payload, contextDirFlag) {
   });
 }
 async function claimRules(sessionId, contextDir) {
+  const asOf = Date.now();
   const where = await resolveTarget({}).catch(() => null);
   if (where?.kind === "cloud") {
-    if (!await claimSession(sessionId, where.brainId)) return null;
+    if (!await claimSession(sessionId, where.brainId)) {
+      if (await claimExists(sessionId, where.brainId)) await markServed(sessionId, asOf);
+      return null;
+    }
     const hosted = await hostedRuleLines(where, contextDir).catch(() => null);
     if (hosted !== null) {
-      if (hosted.lines.length > 0) return { lines: hosted.lines, total: hosted.total };
+      if (hosted.lines.length > 0) {
+        await markServed(sessionId, asOf);
+        return { lines: hosted.lines, total: hosted.total };
+      }
       await releaseSession(sessionId, where.brainId);
+      await markEmpty(sessionId, asOf);
       return null;
     }
     await releaseSession(sessionId, where.brainId);
   }
+  const named = await resolveBrain(void 0, contextDir).catch(() => null);
+  if (named === null) return null;
+  const root = named.brain.root;
+  if (!await claimSession(sessionId, root)) return null;
   const collected = await collectRules(void 0, contextDir).catch(() => null);
-  if (collected === null) return null;
+  if (collected === null || collected.rules.length === 0) {
+    await releaseSession(sessionId, root);
+    return null;
+  }
   const { brainRoot, rules, total } = collected;
-  if (rules.length === 0) return null;
-  if (!await claimSession(sessionId, brainRoot)) return null;
   await recordEvent(brainRoot, {
     verb: "guard",
     contextDir,
@@ -17619,7 +17976,7 @@ async function readPayload() {
     return null;
   }
 }
-var guardDir = () => join18(brandHome(), "guard");
+var guardDir = () => join19(brandHome(), "guard");
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
@@ -17640,7 +17997,7 @@ async function misdeliveryNotice(toolName, filePath, sessionId) {
   return 'This file is this harness\u2019s own memory \u2014 no other tool the user works with will ever read it. Durable facts about the user belong in their brain, which every tool shares: memgineering remember "<the fact>" --reason "<why>" (add --rule if they stated a standing rule). Write it there instead, or in addition.';
 }
 function markerFor(sessionId, brain) {
-  return join18(
+  return join19(
     guardDir(),
     `${createHash7("sha256").update(`${sessionId}\0${brain}`).digest("hex").slice(0, 32)}`
   );
@@ -17648,8 +18005,8 @@ function markerFor(sessionId, brain) {
 async function claimSession(sessionId, brain) {
   const marker = markerFor(sessionId, brain);
   try {
-    await mkdir11(guardDir(), { recursive: true, mode: 448 });
-    await writeFile9(marker, "", { flag: "wx", mode: 384 });
+    await mkdir12(guardDir(), { recursive: true, mode: 448 });
+    await writeFile10(marker, "", { flag: "wx", mode: 384 });
   } catch {
     return false;
   }
@@ -17657,19 +18014,23 @@ async function claimSession(sessionId, brain) {
   return true;
 }
 async function releaseSession(sessionId, brain) {
-  await unlink3(markerFor(sessionId, brain)).catch(() => void 0);
+  await unlink4(markerFor(sessionId, brain)).catch(() => void 0);
+}
+async function claimExists(sessionId, brain) {
+  return stat5(markerFor(sessionId, brain)).then(() => true).catch(() => false);
 }
 var MARKER_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 async function pruneOldMarkers() {
   try {
     const dir = guardDir();
     const now = Date.now();
-    for (const name of await readdir6(dir)) {
-      const path = join18(dir, name);
+    for (const name of await readdir7(dir)) {
+      const path = join19(dir, name);
       if (!isAbsolute3(path)) continue;
-      const info = await stat4(path).catch(() => null);
-      if (info && now - info.mtimeMs > MARKER_TTL_MS) await unlink3(path).catch(() => void 0);
+      const info = await stat5(path).catch(() => null);
+      if (info && now - info.mtimeMs > MARKER_TTL_MS) await unlink4(path).catch(() => void 0);
     }
+    await pruneFast(now);
   } catch {
   }
 }
@@ -18687,8 +19048,8 @@ init_api_client();
 init_config();
 init_cloud_brain();
 init_ui();
-import { mkdir as mkdir12, readFile as readFile20, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join19, resolve as resolve11, sep as sep2 } from "path";
+import { mkdir as mkdir13, readFile as readFile20, writeFile as writeFile11 } from "fs/promises";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join20, resolve as resolve11, sep as sep2 } from "path";
 import { Command as Command24 } from "commander";
 function pullCommand() {
   return new Command24("pull").description("download your hosted brain to a folder on this machine").argument("[destination]", "folder to write into (created if missing)").option("--brain <name>", "which hosted brain to download").option("--dry-run", "say what would be written and write nothing").action(async (destination, opts) => {
@@ -18756,8 +19117,8 @@ function pullCommand() {
           already.push(note.path);
           continue;
         }
-        await mkdir12(dirname6(file), { recursive: true });
-        await writeFile10(file, note.content ?? "", "utf8");
+        await mkdir13(dirname6(file), { recursive: true });
+        await writeFile11(file, note.content ?? "", "utf8");
         written.push(note.path);
         if (note.excluded === true) excluded.push(note.path);
       }
@@ -18871,7 +19232,7 @@ function safeJoin(root, relative3) {
       "Nothing was written for it. This should not happen \u2014 please report it."
     );
   }
-  const full = resolve11(join19(root, relative3));
+  const full = resolve11(join20(root, relative3));
   if (full !== root && !full.startsWith(root + sep2)) {
     throw memgError(
       "server_refused",
@@ -19793,9 +20154,9 @@ init_errors();
 init_credentials();
 
 // src/lib/untrusted-fence.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function makeUntrustedSentinel() {
-  return `KORDIS-UNTRUSTED-${randomUUID2()}`;
+  return `KORDIS-UNTRUSTED-${randomUUID3()}`;
 }
 function fenceUntrusted(sentinel, text) {
   const neutralized = text.replace(/KORDIS-UNTRUSTED-/g, "KORDIS-UNTRUSTED\u200B-");
@@ -20291,7 +20652,7 @@ init_errors();
 // src/lib/harness-context.ts
 init_brand();
 import { access, readFile as readFile21 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var PER_FILE_CAP = 16 * 1024;
 var TOTAL_CAP = 48 * 1024;
 var TRUNCATION_RESERVE = 64;
@@ -20336,13 +20697,13 @@ function extractHeadings(content) {
 }
 async function readHarnessContext(cwd = process.cwd(), home = agentHome()) {
   const candidates = [
-    { path: join20(cwd, "CLAUDE.md"), display: "CLAUDE.md", scope: "project" },
-    { path: join20(cwd, "AGENTS.md"), display: "AGENTS.md", scope: "project" },
-    { path: join20(cwd, "GEMINI.md"), display: "GEMINI.md", scope: "project" },
-    { path: join20(cwd, ".claude", "CLAUDE.md"), display: ".claude/CLAUDE.md", scope: "project" },
-    { path: join20(home, ".claude", "CLAUDE.md"), display: "~/.claude/CLAUDE.md", scope: "global" },
-    { path: join20(home, ".codex", "AGENTS.md"), display: "~/.codex/AGENTS.md", scope: "global" },
-    { path: join20(home, ".gemini", "GEMINI.md"), display: "~/.gemini/GEMINI.md", scope: "global" }
+    { path: join21(cwd, "CLAUDE.md"), display: "CLAUDE.md", scope: "project" },
+    { path: join21(cwd, "AGENTS.md"), display: "AGENTS.md", scope: "project" },
+    { path: join21(cwd, "GEMINI.md"), display: "GEMINI.md", scope: "project" },
+    { path: join21(cwd, ".claude", "CLAUDE.md"), display: ".claude/CLAUDE.md", scope: "project" },
+    { path: join21(home, ".claude", "CLAUDE.md"), display: "~/.claude/CLAUDE.md", scope: "global" },
+    { path: join21(home, ".codex", "AGENTS.md"), display: "~/.codex/AGENTS.md", scope: "global" },
+    { path: join21(home, ".gemini", "GEMINI.md"), display: "~/.gemini/GEMINI.md", scope: "global" }
   ];
   const files2 = [];
   let totalBytes = 0;
@@ -20747,8 +21108,8 @@ function parseLimit2(raw) {
 import { Command as Command30 } from "commander";
 import prompts3 from "prompts";
 import { existsSync, lstatSync, realpathSync } from "fs";
-import { mkdir as mkdir14, readFile as readFile23, stat as stat5, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname7, join as join22, resolve as resolve12, sep as sep3 } from "path";
+import { mkdir as mkdir15, readFile as readFile23, stat as stat6, writeFile as writeFile13 } from "fs/promises";
+import { dirname as dirname7, join as join23, resolve as resolve12, sep as sep3 } from "path";
 
 // ../../packages/translators/src/skill/identity.ts
 function buildSkillFile(input, outputPath) {
@@ -21329,17 +21690,17 @@ init_ui();
 
 // src/lib/lockfile.ts
 init_brand();
-import { copyFile, mkdir as mkdir13, readFile as readFile22, writeFile as writeFile11, constants as fsConstants } from "fs/promises";
+import { copyFile, mkdir as mkdir14, readFile as readFile22, writeFile as writeFile12, constants as fsConstants } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function effectiveRange(entry) {
   return entry.requestedRange ?? `^${entry.version}`;
 }
 function lockfilePath() {
-  return join21(brandHome(), "installed.json");
+  return join22(brandHome(), "installed.json");
 }
 function kordisLockfilePath() {
-  return join21(process.env["KORDIS_HOME"] ?? join21(homedir4(), ".kordis"), "installed.json");
+  return join22(process.env["KORDIS_HOME"] ?? join22(homedir4(), ".kordis"), "installed.json");
 }
 function lockfileDisplayPath() {
   const path = lockfilePath();
@@ -21350,7 +21711,7 @@ async function migrateFromKordis() {
   const source = kordisLockfilePath();
   const destination = lockfilePath();
   try {
-    await mkdir13(brandHome(), { recursive: true });
+    await mkdir14(brandHome(), { recursive: true });
     await copyFile(source, destination, fsConstants.COPYFILE_EXCL);
   } catch {
     return;
@@ -21378,15 +21739,15 @@ async function readLockfile() {
   }
 }
 async function writeLockfile(lf) {
-  await mkdir13(brandHome(), { recursive: true });
-  await writeFile11(lockfilePath(), JSON.stringify(lf, null, 2) + "\n", {
+  await mkdir14(brandHome(), { recursive: true });
+  await writeFile12(lockfilePath(), JSON.stringify(lf, null, 2) + "\n", {
     encoding: "utf8",
     mode: 384
   });
 }
 async function recordInstalled(fullSlug, entry) {
   const home = brandHome();
-  await withFileLock(join21(home, "installed.lock"), home, async () => {
+  await withFileLock(join22(home, "installed.lock"), home, async () => {
     const lf = await readLockfile();
     lf.packages[fullSlug] = entry;
     await writeLockfile(lf);
@@ -21654,7 +22015,7 @@ async function doPullInstall(fullSlug, tool, installRoot, opts = {}) {
   );
   for (const f of translated.files) {
     const abs = safeInstallPath(installRoot, f.path);
-    await mkdir14(dirname7(abs), { recursive: true });
+    await mkdir15(dirname7(abs), { recursive: true });
     await applyEmittedFile(abs, f, fullSlug, notes);
     written.push(abs);
   }
@@ -21810,7 +22171,7 @@ var TOOL_MARKERS = [
 async function detectTool(root) {
   for (const [path, tool] of TOOL_MARKERS) {
     try {
-      await stat5(join22(root, path));
+      await stat6(join23(root, path));
       return tool;
     } catch {
     }
@@ -21826,7 +22187,7 @@ function safeInstallPath(installRoot, relPath) {
       "Nothing was written. The package emits an absolute file path. Tell the author to publish it with relative paths only; if you did not publish it, treat it as an attempt to write outside your project."
     );
   }
-  const abs = join22(installRoot, relPath);
+  const abs = join23(installRoot, relPath);
   const resolvedRoot = resolve12(installRoot);
   const resolvedAbs = resolve12(abs);
   if (resolvedAbs !== resolvedRoot && !resolvedAbs.startsWith(resolvedRoot + sep3)) {
@@ -21880,9 +22241,9 @@ function safeInstallPath(installRoot, relPath) {
 }
 async function writeEmittedFile(abs, content, encoding) {
   if (encoding === "base64") {
-    await writeFile12(abs, Buffer.from(content, "base64"));
+    await writeFile13(abs, Buffer.from(content, "base64"));
   } else {
-    await writeFile12(abs, content, "utf8");
+    await writeFile13(abs, content, "utf8");
   }
 }
 async function applyEmittedFile(abs, f, fullSlug, notes) {
@@ -21903,10 +22264,10 @@ async function applyEmittedFile(abs, f, fullSlug, notes) {
         `merged into ${f.path} \u2014 comments/formatting in the existing file are not preserved`
       );
     }
-    await writeFile12(abs, merged, "utf8");
+    await writeFile13(abs, merged, "utf8");
     return;
   }
-  await writeFile12(abs, mergeFencedFile(existingRaw, fullSlug, f.content), "utf8");
+  await writeFile13(abs, mergeFencedFile(existingRaw, fullSlug, f.content), "utf8");
 }
 
 // src/commands/registry/update.ts
@@ -22957,15 +23318,17 @@ function isScopeSpread(value) {
 }
 
 // src/commands/resurface.ts
+init_setup();
+init_ui();
 init_deadline();
 init_src();
-import { Command as Command38 } from "commander";
+import { Command as Command39 } from "commander";
 init_index_build();
 init_cloud_brain();
 init_vault();
 init_ui();
 function resurfaceCommand() {
-  return new Command38("resurface").description("what is worth having in view right now, without being asked").option("--context-dir <path>", "where the work is happening (default: cwd)").option("--limit <n>", "how many cards", (v) => parseInt(v, 10), 5).option("--vault <path>", "which brain").option("--local", "use the brain on this machine, even when signed in to a hosted one").option(
+  return new Command39("resurface").description("what is worth having in view right now, without being asked").option("--context-dir <path>", "where the work is happening (default: cwd)").option("--limit <n>", "how many cards", (v) => parseInt(v, 10), 5).option("--vault <path>", "which brain").option("--local", "use the brain on this machine, even when signed in to a hosted one").option(
     "--brain <name>",
     "read one existing hosted brain by name or id, without changing the pointer"
   ).option(
@@ -22976,6 +23339,11 @@ function resurfaceCommand() {
     async (opts) => {
       const bounded = (work) => opts.deadline !== void 0 && Number.isFinite(opts.deadline) ? withDeadline(opts.deadline, work) : work();
       await bounded(async () => {
+        await refreshOwnHooksAndTell(
+          (text) => (isJsonMode() ? process.stderr : process.stdout).write(`${text}
+
+`)
+        );
         const contextDir = opts.contextDir ?? process.cwd();
         const where = await resolveTarget({
           ...opts.brain === void 0 ? {} : { brain: opts.brain },
@@ -23187,11 +23555,11 @@ rank by project yet, so that is not one of the signals above.`
 }
 
 // src/commands/rules.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 init_cloud_brain();
 init_ui();
 function rulesCommand() {
-  return new Command39("rules").description("the user\u2019s standing decisions \u2014 what binds you here").option("--vault <path>", "which brain").option("--local", "use the brain on this machine, even when signed in to a hosted one").option(
+  return new Command40("rules").description("the user\u2019s standing decisions \u2014 what binds you here").option("--vault <path>", "which brain").option("--local", "use the brain on this machine, even when signed in to a hosted one").option(
     "--brain <name>",
     "read one existing hosted brain by name or id, without changing the pointer"
   ).action(async (opts) => {
@@ -23358,16 +23726,16 @@ init_next_step();
 init_provenance();
 import { spawn as spawn4 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdir as mkdir18, open, readFile as readFile27, rename as rename4, rm as rm8, stat as stat7, unlink as unlink4, writeFile as writeFile15 } from "fs/promises";
-import { join as join28 } from "path";
+import { mkdir as mkdir19, open, readFile as readFile28, rename as rename5, rm as rm8, stat as stat9, unlink as unlink6, writeFile as writeFile17 } from "fs/promises";
+import { join as join30 } from "path";
 import { Command as Command41 } from "commander";
 
 // src/lib/update-check.ts
 init_atomic();
 init_brand();
 import { execFile as execFile2 } from "child_process";
-import { mkdir as mkdir17, readFile as readFile26, writeFile as writeFile14 } from "fs/promises";
-import { join as join27 } from "path";
+import { mkdir as mkdir18, readFile as readFile27, writeFile as writeFile16 } from "fs/promises";
+import { join as join29 } from "path";
 import { promisify as promisify2 } from "util";
 import semver4 from "semver";
 import { z as z33 } from "zod";
@@ -23448,11 +23816,11 @@ var UpdateStateSchema = z33.object({
   message: z33.string().nullable()
 });
 function statePath() {
-  return join27(brandHome(), "update-state.json");
+  return join29(brandHome(), "update-state.json");
 }
 async function readUpdateState() {
   try {
-    const parsed = UpdateStateSchema.safeParse(JSON.parse(await readFile26(statePath(), "utf8")));
+    const parsed = UpdateStateSchema.safeParse(JSON.parse(await readFile27(statePath(), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -23460,7 +23828,7 @@ async function readUpdateState() {
 }
 async function writeUpdateState(state) {
   try {
-    await mkdir17(brandHome(), { recursive: true });
+    await mkdir18(brandHome(), { recursive: true });
     await writeThenRename(statePath(), `${JSON.stringify(state, null, 2)}
 `);
   } catch {
@@ -23572,7 +23940,7 @@ async function runUpdate(opts, inherited) {
   }
   const held = await holdUpdateSlot(inherited);
   if (held === null && await blockedBy() === "stuck") {
-    const lock = join28(brandHome(), RECLAIM_LOCK);
+    const lock = join30(brandHome(), RECLAIM_LOCK);
     const hint = `A previous update did not finish, and clearing what it left is blocked by ${lock}. If no memgineering update is running, delete that folder and run \`memgineering update\` again.`;
     printDual({
       json: { ...status, provenance: provenance.kind, updated: false, reason: "update_claim_stuck", hint },
@@ -23687,14 +24055,14 @@ function newClaimToken() {
 }
 async function claimOwner() {
   try {
-    return (await readFile27(join28(brandHome(), "update-running"), "utf8")).trim() || null;
+    return (await readFile28(join30(brandHome(), "update-running"), "utf8")).trim() || null;
   } catch {
     return null;
   }
 }
 async function releaseUpdateSlot(token) {
   if (await claimOwner() !== token) return;
-  await unlink4(join28(brandHome(), "update-running")).catch(() => void 0);
+  await unlink6(join30(brandHome(), "update-running")).catch(() => void 0);
 }
 async function holdUpdateSlot(inherited) {
   if (inherited !== void 0 && await claimOwner() === inherited) return inherited;
@@ -23706,9 +24074,9 @@ async function holdUpdateSlot(inherited) {
 var HOOK_VERBS = /* @__PURE__ */ new Set(["guard", "resurface"]);
 var UPDATE_CLAIM_MS = 15 * 6e4;
 async function claimUpdateSlot(token = newClaimToken(), hooks = {}) {
-  const path = join28(brandHome(), "update-running");
+  const path = join30(brandHome(), "update-running");
   try {
-    await mkdir18(brandHome(), { recursive: true });
+    await mkdir19(brandHome(), { recursive: true });
     const handle = await open(path, "wx");
     await handle.writeFile(`${token}
 `);
@@ -23718,12 +24086,12 @@ async function claimUpdateSlot(token = newClaimToken(), hooks = {}) {
     if (err?.code !== "EEXIST") return false;
   }
   try {
-    if (Date.now() - (await stat7(path)).mtimeMs >= UPDATE_CLAIM_MS) {
+    if (Date.now() - (await stat9(path)).mtimeMs >= UPDATE_CLAIM_MS) {
       await hooks.afterObserve?.();
       await withReclaimLock(async () => {
-        if (Date.now() - (await stat7(path)).mtimeMs < UPDATE_CLAIM_MS) return;
+        if (Date.now() - (await stat9(path)).mtimeMs < UPDATE_CLAIM_MS) return;
         await hooks.afterRecheck?.();
-        await unlink4(path);
+        await unlink6(path);
       });
     }
   } catch {
@@ -23734,13 +24102,13 @@ var RECLAIM_LOCK = "update-running.reclaim";
 var RECLAIM_LOCK_MAX_MS = 10 * 6e4;
 async function withReclaimLock(fn) {
   const home = brandHome();
-  const lock = join28(home, RECLAIM_LOCK);
-  const staging = join28(home, `${RECLAIM_LOCK}.${process.pid}.${randomBytes2(4).toString("hex")}`);
-  await mkdir18(staging, { recursive: true });
-  await writeFile15(join28(staging, "owner"), `${process.pid} ${Date.now()}
+  const lock = join30(home, RECLAIM_LOCK);
+  const staging = join30(home, `${RECLAIM_LOCK}.${process.pid}.${randomBytes2(4).toString("hex")}`);
+  await mkdir19(staging, { recursive: true });
+  await writeFile17(join30(staging, "owner"), `${process.pid} ${Date.now()}
 `);
   try {
-    await rename4(staging, lock);
+    await rename5(staging, lock);
   } catch {
     await rm8(staging, { recursive: true, force: true }).catch(() => void 0);
     await breakAbandonedLock(lock);
@@ -23750,18 +24118,18 @@ async function withReclaimLock(fn) {
     return await fn();
   } finally {
     const aside = `${lock}.done.${randomBytes2(4).toString("hex")}`;
-    await rename4(lock, aside).then(() => rm8(aside, { recursive: true, force: true })).catch(() => void 0);
+    await rename5(lock, aside).then(() => rm8(aside, { recursive: true, force: true })).catch(() => void 0);
   }
 }
 async function breakAbandonedLock(lock) {
   try {
-    const seen = (await readFile27(join28(lock, "owner"), "utf8")).trim();
+    const seen = (await readFile28(join30(lock, "owner"), "utf8")).trim();
     if (!lockAbandoned(seen)) return;
     const aside = `${lock}.dead.${randomBytes2(4).toString("hex")}`;
-    await rename4(lock, aside);
-    const moved = (await readFile27(join28(aside, "owner"), "utf8").catch(() => "")).trim();
+    await rename5(lock, aside);
+    const moved = (await readFile28(join30(aside, "owner"), "utf8").catch(() => "")).trim();
     if (moved !== seen) {
-      await rename4(aside, lock).catch(() => void 0);
+      await rename5(aside, lock).catch(() => void 0);
       return;
     }
     await rm8(aside, { recursive: true, force: true });
@@ -23783,9 +24151,9 @@ function lockAbandoned(owner, now = Date.now()) {
 }
 async function blockedBy() {
   try {
-    const old = Date.now() - (await stat7(join28(brandHome(), "update-running"))).mtimeMs >= UPDATE_CLAIM_MS;
+    const old = Date.now() - (await stat9(join30(brandHome(), "update-running"))).mtimeMs >= UPDATE_CLAIM_MS;
     if (old) {
-      await stat7(join28(brandHome(), RECLAIM_LOCK));
+      await stat9(join30(brandHome(), RECLAIM_LOCK));
       return "stuck";
     }
   } catch {
@@ -23817,8 +24185,8 @@ function reportBelowMinimum(below) {
 
 // src/commands/undo.ts
 init_src();
-import { readFile as readFile28, rm as rm9 } from "fs/promises";
-import { join as join29 } from "path";
+import { readFile as readFile29, rm as rm9 } from "fs/promises";
+import { join as join31 } from "path";
 import { Command as Command42 } from "commander";
 init_atomic();
 init_errors();
@@ -23915,8 +24283,8 @@ ${matches.slice(0, 8).map((id) => `  ${id}`).join("\n")}${matches.length > 8 ? "
         );
       }
       const record = await withWriteLock(brain.root, async () => {
-        const absolute = join29(brain.root, target.target);
-        const current = await readFile28(absolute, "utf8").catch(() => null);
+        const absolute = join31(brain.root, target.target);
+        const current = await readFile29(absolute, "utf8").catch(() => null);
         const actualHash = current === null ? null : hashContent(current);
         if (actualHash !== target.hash_after) {
           throw memgError(
@@ -23978,7 +24346,7 @@ function minutesSince(iso) {
   return Math.max(0, Math.floor((Date.now() - at) / 6e4));
 }
 async function reverse(brain, op, current) {
-  const absolute = join29(brain.root, op.target);
+  const absolute = join31(brain.root, op.target);
   if (op.verb === "remember") {
     if (current === null) {
       throw memgError(
@@ -24035,7 +24403,7 @@ async function conflictHint(vaultRoot, op) {
 Read what it says now, then decide what should stay.`;
   const snapshot = await readSnapshot(vaultRoot, op.op_id);
   return snapshot === null ? base2 : `${base2}
-The text from before that change is still on this machine: ${join29(snapshotDir(vaultRoot), `${op.op_id}.txt`)}`;
+The text from before that change is still on this machine: ${join31(snapshotDir(vaultRoot), `${op.op_id}.txt`)}`;
 }
 
 // src/commands/brains.ts
@@ -24720,6 +25088,10 @@ async function run3(argv) {
   });
   await program.parseAsync(cleaned);
   if (ran !== "update") await backgroundUpdateNotice(ran === void 0 ? {} : { verb: ran });
+  if (ran !== void 0 && !["guard", "resurface", "setup"].includes(ran)) {
+    await refreshOwnHooksAndTell((text) => process.stderr.write(`${text}
+`));
+  }
 }
 async function handleError(err) {
   const failure = adaptRegistryError(err) ?? err;