mindgraph-mcp 0.17.0 → 0.18.0

package/dist/cli.js

@@ -65,8 +65,8 @@ var init_dist = __esm({
         this.retryBackoffMs = config.retryBackoffMs ?? 1e3;
       }
       // ---- HTTP helpers ----
-      async request(method, path6, body) {
-        const url = `${this.baseUrl}${path6}`;
+      async request(method, path7, body) {
+        const url = `${this.baseUrl}${path7}`;
         const requestId = createRequestId();
         const init = {
           method,
@@ -91,7 +91,7 @@ var init_dist = __esm({
               parsed = text2;
             }
             const err5 = new MindGraphError(
-              `${method} ${path6} failed: ${res.status}`,
+              `${method} ${path7} failed: ${res.status}`,
               res.status,
               parsed
             );
@@ -109,17 +109,17 @@ var init_dist = __esm({
         }
         throw lastError;
       }
-      get(path6) {
-        return this.request("GET", path6);
+      get(path7) {
+        return this.request("GET", path7);
       }
-      post(path6, body) {
-        return this.request("POST", path6, body);
+      post(path7, body) {
+        return this.request("POST", path7, body);
       }
-      patch(path6, body) {
-        return this.request("PATCH", path6, body);
+      patch(path7, body) {
+        return this.request("PATCH", path7, body);
       }
-      del(path6) {
-        return this.request("DELETE", path6);
+      del(path7) {
+        return this.request("DELETE", path7);
       }
       // ---- Health ----
       async health() {
@@ -971,6 +971,14 @@ var init_hook_env = __esm({
 });
 
 // src/codegraph.ts
+function invocationCwd(args) {
+  const context = args.invocation_context;
+  if (context && typeof context === "object" && !Array.isArray(context)) {
+    const cwd = context.cwd;
+    if (typeof cwd === "string" && cwd) return cwd;
+  }
+  return process.cwd();
+}
 function unavailabilityCaveats(reason, message) {
   const caveats = [message || "codegraph status failed"];
   if (reason === "absent") {
@@ -980,14 +988,14 @@ function unavailabilityCaveats(reason, message) {
   }
   return caveats;
 }
-function normalizePath(path6) {
-  return path6.replaceAll("\\", "/").replace(/^\.\//, "");
+function normalizePath(path7) {
+  return path7.replaceAll("\\", "/").replace(/^\.\//, "");
 }
 function normalizeSignature(signature) {
   return signature.replace(/\s+/g, " ").trim();
 }
-function languageFromPath(path6) {
-  const extension = (0, import_node_path2.extname)(path6).toLowerCase();
+function languageFromPath(path7) {
+  const extension = (0, import_node_path2.extname)(path7).toLowerCase();
   return {
     ".c": "c",
     ".cc": "cpp",
@@ -1150,7 +1158,7 @@ function codeRefIdentityKey(ref) {
     }
   };
 }
-var import_node_child_process, import_node_fs2, import_promises, import_node_os2, import_node_path2, import_node_crypto2, DEFAULT_TIMEOUT_MS, DEFAULT_STATUS_TTL_MS, MAX_OUTPUT_BYTES, CodegraphAdapter;
+var import_node_child_process, import_node_fs2, import_promises, import_node_os2, import_node_path2, import_node_crypto2, UnknownRepositoryError, DEFAULT_TIMEOUT_MS, DEFAULT_STATUS_TTL_MS, MAX_OUTPUT_BYTES, CodegraphAdapter;
 var init_codegraph = __esm({
   "src/codegraph.ts"() {
     "use strict";
@@ -1160,6 +1168,16 @@ var init_codegraph = __esm({
     import_node_os2 = require("os");
     import_node_path2 = require("path");
     import_node_crypto2 = require("crypto");
+    UnknownRepositoryError = class extends Error {
+      constructor(repo) {
+        super(
+          `unknown repository "${repo}": not declared in .mindgraph/workspace.json, not the current repository, and no such path exists`
+        );
+        this.repo = repo;
+        this.name = "UnknownRepositoryError";
+      }
+      repo;
+    };
     DEFAULT_TIMEOUT_MS = 5e3;
     DEFAULT_STATUS_TTL_MS = 6e4;
     MAX_OUTPUT_BYTES = 5 * 1024 * 1024;
@@ -1195,7 +1213,26 @@ var init_codegraph = __esm({
             selected.spaceUid
           ) : selected;
         }
-        const requestedRoot = repo || this.env.MINDGRAPH_REPO_ROOT || this.cwd;
+        if (repo) {
+          const requestedPath = await (0, import_promises.realpath)((0, import_node_path2.resolve)(this.cwd, repo)).catch(
+            () => (0, import_node_path2.resolve)(this.cwd, repo)
+          );
+          if (!(0, import_node_fs2.existsSync)(requestedPath)) {
+            const current = await this.currentRepository(fallbackSpaceUid);
+            if (current.repoId === repo) return current;
+            throw new UnknownRepositoryError(repo);
+          }
+          const repoRoot = await this.gitRoot(requestedPath) ?? requestedPath;
+          return this.resolveRepositoryIdentity(
+            repoRoot,
+            this.env.MINDGRAPH_REPO_ID,
+            this.env.MINDGRAPH_CODE_SPACE_UID || fallbackSpaceUid
+          );
+        }
+        return this.currentRepository(fallbackSpaceUid);
+      }
+      async currentRepository(fallbackSpaceUid) {
+        const requestedRoot = this.env.MINDGRAPH_REPO_ROOT || this.cwd;
         const requestedPath = await (0, import_promises.realpath)((0, import_node_path2.resolve)(this.cwd, requestedRoot)).catch(
           () => (0, import_node_path2.resolve)(this.cwd, requestedRoot)
         );
@@ -1285,6 +1322,14 @@ var init_codegraph = __esm({
         ).catch(() => "");
         return raw.trim() ? (0, import_node_path2.resolve)(start, raw.trim()) : void 0;
       }
+      /** Why the workspace map yielded no repositories — for callers that were
+       * explicitly asked to fan out and would otherwise return silently empty. */
+      workspaceDiagnostic() {
+        if (!this.workspaceFile || !(0, import_node_fs2.existsSync)(this.workspaceFile)) {
+          return "no .mindgraph/workspace.json was found between the working directory and the filesystem root";
+        }
+        return `${this.workspaceFile} is malformed or declares no repositories`;
+      }
       async availability(repository) {
         const cached = this.statusCache.get(repository.repoRoot);
         if (cached && cached.expiresAt > this.now()) return cached.availability;
@@ -1698,13 +1743,13 @@ var init_error_detail = __esm({
 });
 
 // src/code-tool.ts
-async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
+async function handleCodeTool(client2, args, adapter = new CodegraphAdapter({ cwd: invocationCwd(args) })) {
   const codeClient = client2;
   const action = args.action;
   const refs = Array.isArray(args.code_refs) ? args.code_refs : [];
   const anchorUids = Array.isArray(args.anchor_uids) ? args.anchor_uids : [];
   const agentId = typeof args.agent_id === "string" ? args.agent_id : "mcp";
-  const fallbackSpaceUid = typeof args.repo_space_uid === "string" ? args.repo_space_uid : `space:agent:${agentId}`;
+  const fallbackSpaceUid = typeof args.repo_space_uid === "string" ? args.repo_space_uid : void 0;
   const options = {
     repo: typeof args.repo === "string" ? args.repo : void 0,
     fallbackSpaceUid
@@ -1828,6 +1873,7 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
         const targetUid = typeof args.task_uid === "string" ? args.task_uid : typeof args.execution_uid === "string" ? args.execution_uid : void 0;
         let graphContext;
         const graphRefs = [];
+        let unavailableRepositories = [];
         if (targetUid) {
           graphContext = await codeClient.traverse({
             action: "neighborhood",
@@ -1835,9 +1881,13 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
             depth: 2,
             max_nodes: 50
           });
-          graphRefs.push(
-            ...await codeRefsFromGraphContext(codeClient, adapter, graphContext)
+          const fromGraph = await codeRefsFromGraphContext(
+            codeClient,
+            adapter,
+            graphContext
           );
+          graphRefs.push(...fromGraph.refs);
+          unavailableRepositories = fromGraph.unavailable;
         }
         if (refs.length > 0 || anchorUids.length > 0) {
           const target = await resolveSingleTarget(
@@ -1856,7 +1906,8 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
             target_uid: targetUid,
             graph_context: graphContext,
             affected: [],
-            degradation: "no materialized code anchors were attached"
+            degradation: unavailableRepositories.length > 0 ? `attached code anchors reference repositories unavailable here: ${unavailableRepositories.join(", ")}` : "no materialized code anchors were attached",
+            ...unavailableRepositories.length > 0 ? { unavailable_repositories: unavailableRepositories } : {}
           });
         }
         const impacts = await Promise.all(
@@ -1873,13 +1924,17 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
           target_uid: targetUid,
           graph_context: graphContext,
           impacts,
-          materialized: joined
+          materialized: joined,
+          ...unavailableRepositories.length > 0 ? { unavailable_repositories: unavailableRepositories } : {}
         });
       }
       default:
         return err("unknown_action", `unknown mindgraph_code action: ${action}`);
     }
   } catch (cause) {
+    if (cause instanceof UnknownRepositoryError) {
+      return err("unknown_repository", cause.message);
+    }
     return err("code_tool_failed", errorDetail(cause));
   }
 }
@@ -1905,7 +1960,10 @@ async function attachCodeRefsToToolResult(client2, result, args, adapter) {
       code_refs: args.code_refs,
       repo: args.repo,
       repo_space_uid: args.repo_space_uid,
-      agent_id: args.agent_id
+      agent_id: args.agent_id,
+      // Keeps the default adapter anchored to the live session directory
+      // rather than wherever the MCP server process was launched.
+      invocation_context: args.invocation_context
     },
     adapter
   );
@@ -1915,17 +1973,33 @@ async function attachCodeRefsToToolResult(client2, result, args, adapter) {
     const anchorUids = (anchors.anchors ?? []).flatMap(
       (anchor) => anchor.uid ? [anchor.uid] : []
     );
+    const relateFailures = [];
     for (const targetUid of targetUids) {
       for (const anchorUid of anchorUids) {
-        await codeClient.entity({
-          action: "relate",
-          source_uid: targetUid,
-          target_uid: anchorUid,
-          edge_type: args.action === "lesson" ? "ABOUT" : "RELEVANT_TO",
-          agent_id: args.agent_id
-        });
+        try {
+          await codeClient.entity({
+            action: "relate",
+            source_uid: targetUid,
+            target_uid: anchorUid,
+            edge_type: args.action === "lesson" ? "ABOUT" : "RELEVANT_TO",
+            agent_id: args.agent_id
+          });
+        } catch (cause) {
+          relateFailures.push(
+            `${targetUid} -> ${anchorUid}: ${errorDetail(cause)}`
+          );
+        }
       }
     }
+    if (relateFailures.length > 0) {
+      return ok({
+        result: original,
+        code_anchors: {
+          ...anchors,
+          caveat: `anchors written, but ${relateFailures.length} relate edge(s) failed: ${relateFailures.join("; ")}`
+        }
+      });
+    }
   }
   return ok({ result: original, code_anchors: anchors });
 }
@@ -1998,16 +2072,34 @@ async function codeRefFromAnchor(client2, adapter, uid) {
   if (!attributes || typeof attributes !== "object") return void 0;
   const codeRef = attributes.code_ref;
   if (!isStoredCodeRef(codeRef)) return void 0;
-  const repository = await adapter.resolveRepository(codeRef.repoId);
-  return { ...codeRef, repoRoot: repository.repoRoot };
+  try {
+    const repository = await adapter.resolveRepository(codeRef.repoId);
+    return { ref: { ...codeRef, repoRoot: repository.repoRoot } };
+  } catch (cause) {
+    if (cause instanceof UnknownRepositoryError) {
+      return { missingRepo: codeRef.repoId };
+    }
+    throw cause;
+  }
 }
 async function resolveSingleTarget(client2, adapter, refs, anchorUids, options) {
   if (refs.length > 1 || anchorUids.length > 1) {
     return { error: err("ambiguous_target", "expand/affected accepts exactly one code target") };
   }
   if (anchorUids.length === 1) {
-    const ref = await codeRefFromAnchor(client2, adapter, anchorUids[0]);
-    return ref ? { ref } : { error: err("invalid_anchor", "anchor UID does not contain a typed code_ref") };
+    const outcome = await codeRefFromAnchor(client2, adapter, anchorUids[0]);
+    if (!outcome) {
+      return { error: err("invalid_anchor", "anchor UID does not contain a typed code_ref") };
+    }
+    if ("missingRepo" in outcome) {
+      return {
+        error: err(
+          "repository_unavailable",
+          `repository ${outcome.missingRepo} is not checked out here or declared in .mindgraph/workspace.json; expand/affected need its local index`
+        )
+      };
+    }
+    return { ref: outcome.ref };
   }
   if (refs.length !== 1) {
     return { error: err("missing_code_ref", "one code_ref or anchor_uid is required") };
@@ -2046,7 +2138,7 @@ async function joinMaterialized(client2, refs, agentId, limit) {
 async function codeRefsFromGraphContext(client2, adapter, context) {
   const uids = /* @__PURE__ */ new Set();
   collectUids(context, uids);
-  if (uids.size === 0) return [];
+  if (uids.size === 0) return { refs: [], unavailable: [] };
   const nodes = client2.getNodesBatch ? await client2.getNodesBatch([...uids]) : await Promise.all([...uids].map((uid) => client2.getNode(uid).catch(() => void 0)));
   const stored = nodes.flatMap((node) => {
     if (!node) return [];
@@ -2055,12 +2147,21 @@ async function codeRefsFromGraphContext(client2, adapter, context) {
     const codeRef = attributes.code_ref;
     return isStoredCodeRef(codeRef) ? [codeRef] : [];
   });
-  return Promise.all(
-    stored.map(async (ref) => {
+  const refs = [];
+  const unavailable = /* @__PURE__ */ new Set();
+  for (const ref of stored) {
+    try {
       const repository = await adapter.resolveRepository(ref.repoId);
-      return { ...ref, repoRoot: repository.repoRoot };
-    })
-  );
+      refs.push({ ...ref, repoRoot: repository.repoRoot });
+    } catch (cause) {
+      if (cause instanceof UnknownRepositoryError) {
+        unavailable.add(ref.repoId);
+      } else {
+        throw cause;
+      }
+    }
+  }
+  return { refs, unavailable: [...unavailable].sort() };
 }
 function collectUids(value, uids) {
   if (Array.isArray(value)) {
@@ -2136,7 +2237,7 @@ var init_code_tool = __esm({
     });
     CODE_TOOL = {
       name: "mindgraph_code",
-      description: "Resolve typed code references through the local codegraph index and join them to persistent MindGraph memory/work. anchor creates exact repository/code anchors; recall reads attached graph context; expand reads callers/callees; affected reads impact for a code ref or Task/Execution. Ambiguous refs return candidates without writing.",
+      description: "Resolve typed code references through the local codegraph index and join them to persistent MindGraph memory/work. anchor creates exact repository/code anchors; recall reads attached graph context; expand reads callers/callees; affected reads impact for a code ref or Task/Execution. Ambiguous refs return candidates without writing. Refs with a path route to the repository defining that file (nearest declared root in .mindgraph/workspace.json); bare symbols resolve against the current repository only \u2014 pass path or repo to target a sibling.",
       inputSchema: {
         type: "object",
         properties: {
@@ -2178,7 +2279,7 @@ var init_code_tool = __esm({
           },
           repo_space_uid: {
             type: "string",
-            description: "Writable shared Project/repository Space for new anchors"
+            description: "Writable shared Project/repository Space for new anchors (anchor requires this, a workspace space_uid, or MINDGRAPH_CODE_SPACE_UID)"
           },
           task_uid: { type: "string" },
           execution_uid: { type: "string" },
@@ -2197,6 +2298,276 @@ var init_code_tool = __esm({
   }
 });
 
+// src/hook-installer.ts
+function command(harness) {
+  return `node "$HOME/${RUNNER_RELATIVE}" hook --harness ${harness} --owner mindgraph`;
+}
+function windowsCommand(harness) {
+  return `node "%USERPROFILE%\\.mindgraph\\bin\\mindgraph-hook.cjs" hook --harness ${harness} --owner mindgraph`;
+}
+function installHookRunner(sourceFile, homeDir, version) {
+  const target = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_RELATIVE);
+  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(target), { recursive: true });
+  const temporary = `${target}.${process.pid}.${import_node_crypto4.default.randomUUID()}.tmp`;
+  import_node_fs4.default.copyFileSync(sourceFile, temporary);
+  import_node_fs4.default.renameSync(temporary, target);
+  const versionPath = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_VERSION_RELATIVE);
+  if (version) {
+    import_node_fs4.default.writeFileSync(versionPath, `${version}
+`);
+  } else {
+    import_node_fs4.default.rmSync(versionPath, { force: true });
+  }
+  return target;
+}
+function installedHookRunnerVersion(homeDir) {
+  try {
+    const raw = import_node_fs4.default.readFileSync(
+      import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_VERSION_RELATIVE),
+      "utf8"
+    ).trim();
+    return raw || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseSemver(value) {
+  if (!value) return void 0;
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(value.trim());
+  if (!match) return void 0;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function semverNewer(a, b) {
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] > b[index];
+  }
+  return false;
+}
+function refreshHookRunner(serverVersion, sourceBundle, homeDir) {
+  try {
+    if (process.env.MINDGRAPH_HOOK_AUTOUPDATE === "off") {
+      return { refreshed: false, reason: "disabled" };
+    }
+    const home = homeDir || import_node_os4.default.homedir();
+    if (!import_node_fs4.default.existsSync(import_node_path4.default.join(home, RUNNER_RELATIVE))) {
+      return { refreshed: false, reason: "no_runner" };
+    }
+    if (!import_node_fs4.default.existsSync(sourceBundle)) {
+      return { refreshed: false, reason: "no_source" };
+    }
+    const server2 = parseSemver(serverVersion);
+    if (!server2) return { refreshed: false, reason: "unparseable" };
+    const runnerVersion = installedHookRunnerVersion(home);
+    if (runnerVersion !== void 0) {
+      const pinned = parseSemver(runnerVersion);
+      if (!pinned) {
+        return { refreshed: false, reason: "unparseable", runnerVersion };
+      }
+      if (!semverNewer(server2, pinned)) {
+        return {
+          refreshed: false,
+          reason: runnerVersion === serverVersion ? "current" : "downgrade",
+          runnerVersion
+        };
+      }
+    }
+    installHookRunner(sourceBundle, home, serverVersion);
+    return { refreshed: true, reason: "updated", runnerVersion };
+  } catch {
+    return { refreshed: false, reason: "error" };
+  }
+}
+function refreshOwnedClaudeHooks(projectDir = process.cwd(), homeDir) {
+  const refreshed = [];
+  const scopes = ["user", "project"];
+  for (const scope of scopes) {
+    try {
+      const file = settingsPath("claude-code", scope, projectDir, void 0, homeDir);
+      if (!import_node_fs4.default.existsSync(file)) continue;
+      if (!import_node_fs4.default.readFileSync(file, "utf8").includes(OWNER_MARKER)) continue;
+      installHooks("claude-code", scope, projectDir, void 0, homeDir);
+      refreshed.push(file);
+    } catch {
+    }
+  }
+  return refreshed;
+}
+function versionSkewNote(serverVersion, homeDir) {
+  const runnerVersion = installedHookRunnerVersion(homeDir);
+  if (!runnerVersion || runnerVersion === serverVersion) return void 0;
+  return `NOTE: the installed MindGraph hook runner is v${runnerVersion} but this MCP server is v${serverVersion} \u2014 hook behavior and tool contracts may be out of sync. Tell the user to run: npx -y mindgraph-mcp@latest install-hooks (refreshes the pinned runner).`;
+}
+function settingsPath(harness, scope, projectDir = process.cwd(), codexHomeDir = process.env.CODEX_HOME || import_node_path4.default.join(import_node_os4.default.homedir(), ".codex"), homeDir) {
+  if (harness === "codex") {
+    return scope === "user" ? import_node_path4.default.join(codexHomeDir, "hooks.json") : import_node_path4.default.join(projectDir, ".codex", "hooks.json");
+  }
+  return scope === "user" ? import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), ".claude", "settings.json") : import_node_path4.default.join(projectDir, ".claude", "settings.json");
+}
+function readSettings(file) {
+  if (!import_node_fs4.default.existsSync(file)) return {};
+  return JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
+}
+function ownedHook(harness, timeout, additionalContextLimit) {
+  return {
+    type: "command",
+    command: command(harness),
+    ...harness === "codex" ? { commandWindows: windowsCommand(harness) } : {},
+    timeout,
+    statusMessage: "Syncing MindGraph session context",
+    ...additionalContextLimit === void 0 ? {} : { additionalContextLimit }
+  };
+}
+function desiredEntries(harness) {
+  const common = {
+    SessionStart: [
+      {
+        matcher: harness === "claude-code" ? "startup|resume|clear|compact|fork" : "startup|resume|clear|compact",
+        // B7 live acceptance caught cold SessionStart calls crossing the
+        // inherited 20s edge in both harnesses: the hooks correctly failed
+        // open, but no brief reached the model. The same installed runner
+        // completed in 16.84s once warm. Keep a 30s cold-tenant margin.
+        // The declared Codex context limit must not undercut the brief's own
+        // 9,000-char budget: at 3,000 the harness applied a SECOND, tighter
+        // truncation the renderer knew nothing about.
+        hooks: [
+          ownedHook(
+            harness,
+            30,
+            harness === "codex" ? 1e4 : void 0
+          )
+        ]
+      }
+    ],
+    PreToolUse: [
+      {
+        matcher: "mcp__mindgraph__.*",
+        // Repository resolution over a large multi-repo workspace plus three
+        // git probes can exceed 3s on the first (uncached) call; a killed
+        // PreToolUse means the call goes through untagged.
+        hooks: [ownedHook(harness, 5)]
+      }
+    ],
+    // PostToolUse awaits the lease renewal round-trip, which fires exactly
+    // when the tenant is cold (post-idle reclaim) — 5s killed it mid-claim.
+    PostToolUse: [{ matcher: ".*", hooks: [ownedHook(harness, 10)] }],
+    Stop: [{ hooks: [ownedHook(harness, 5)] }],
+    // SessionEnd makes up to two sequential cloud calls (abandon_iteration +
+    // session close) — the SAME cold-tenant latency SessionStart needs 30s
+    // for. Claude honors the configured budget; Codex clamps SessionEnd to a
+    // 3s platform cap regardless of this value (see codex-hooks.ts wire
+    // map), so the codex adapter instead makes at most ONE call there.
+    SessionEnd: [
+      { hooks: [ownedHook(harness, harness === "codex" ? 3 : 30)] }
+    ]
+  };
+  return harness === "claude-code" ? {
+    ...common,
+    TaskCreated: [{ hooks: [ownedHook(harness, 3)] }],
+    TaskCompleted: [{ hooks: [ownedHook(harness, 3)] }]
+  } : common;
+}
+function hookCommand(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const command2 = value.command;
+  return typeof command2 === "string" ? command2 : void 0;
+}
+function entryHasOwnedHook(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const hooks = value.hooks;
+  return Array.isArray(hooks) && hooks.some((hook) => hookCommand(hook)?.includes(OWNER_MARKER));
+}
+function writeSettings(file, settings) {
+  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.${import_node_crypto4.default.randomUUID()}.tmp`;
+  import_node_fs4.default.writeFileSync(temporary, `${JSON.stringify(settings, null, 2)}
+`, {
+    mode: 384
+  });
+  import_node_fs4.default.renameSync(temporary, file);
+}
+function installHooks(harness, scope, projectDir = process.cwd(), codexHomeDir, homeDir) {
+  const file = settingsPath(harness, scope, projectDir, codexHomeDir, homeDir);
+  const settings = readSettings(file);
+  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
+  let added = 0;
+  let updated = 0;
+  for (const [event, wanted] of Object.entries(desiredEntries(harness))) {
+    const current = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+    const kept = current.filter((entry) => !entryHasOwnedHook(entry));
+    const hadOwned = kept.length !== current.length;
+    for (const entry of wanted) {
+      kept.push(entry);
+      if (hadOwned) updated += 1;
+      else added += 1;
+    }
+    hooks[event] = kept;
+  }
+  settings.hooks = hooks;
+  writeSettings(file, settings);
+  return { path: file, added, updated };
+}
+function uninstallHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
+  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
+  if (!import_node_fs4.default.existsSync(file)) return { path: file, removed: 0 };
+  const settings = readSettings(file);
+  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
+  let removed = 0;
+  for (const [event, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    const retainedEntries = [];
+    for (const rawEntry of value) {
+      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+        retainedEntries.push(rawEntry);
+        continue;
+      }
+      const entry = { ...rawEntry };
+      if (!Array.isArray(entry.hooks)) {
+        retainedEntries.push(entry);
+        continue;
+      }
+      const retainedHooks = entry.hooks.filter((hook) => {
+        const owned = hookCommand(hook)?.includes(OWNER_MARKER) || false;
+        if (owned) removed += 1;
+        return !owned;
+      });
+      if (retainedHooks.length > 0) {
+        entry.hooks = retainedHooks;
+        retainedEntries.push(entry);
+      }
+    }
+    if (retainedEntries.length > 0) hooks[event] = retainedEntries;
+    else delete hooks[event];
+  }
+  settings.hooks = hooks;
+  writeSettings(file, settings);
+  return { path: file, removed };
+}
+function installClaudeHooks(scope, projectDir = process.cwd()) {
+  return installHooks("claude-code", scope, projectDir);
+}
+function uninstallClaudeHooks(scope, projectDir = process.cwd()) {
+  return uninstallHooks("claude-code", scope, projectDir);
+}
+function installCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
+  return installHooks("codex", scope, projectDir, codexHomeDir);
+}
+function uninstallCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
+  return uninstallHooks("codex", scope, projectDir, codexHomeDir);
+}
+var import_node_fs4, import_node_os4, import_node_path4, import_node_crypto4, OWNER_MARKER, RUNNER_RELATIVE, RUNNER_VERSION_RELATIVE;
+var init_hook_installer = __esm({
+  "src/hook-installer.ts"() {
+    "use strict";
+    import_node_fs4 = __toESM(require("fs"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path4 = __toESM(require("path"));
+    import_node_crypto4 = __toESM(require("crypto"));
+    OWNER_MARKER = "--owner mindgraph";
+    RUNNER_RELATIVE = ".mindgraph/bin/mindgraph-hook.cjs";
+    RUNNER_VERSION_RELATIVE = `${RUNNER_RELATIVE}.version`;
+  }
+});
+
 // src/sync-tool.ts
 function safePath(root, candidate) {
   const absolute = import_node_path5.default.resolve(root, candidate);
@@ -2204,14 +2575,29 @@ function safePath(root, candidate) {
   if (relative2.startsWith("..") || import_node_path5.default.isAbsolute(relative2)) {
     throw new Error(`path escapes repository root: ${candidate}`);
   }
+  if (import_node_fs5.default.existsSync(absolute)) {
+    if (!pathContains(realPathOf(root), realPathOf(absolute))) {
+      throw new Error(`path escapes repository root via symlink: ${candidate}`);
+    }
+  }
   return absolute;
 }
-function markdownFiles(target) {
+function realPathOf(target) {
+  try {
+    return import_node_fs5.default.realpathSync(target);
+  } catch {
+    return import_node_path5.default.resolve(target);
+  }
+}
+function markdownFiles(target, realRoot, visited = /* @__PURE__ */ new Set()) {
   if (!import_node_fs5.default.existsSync(target)) return [];
+  const real = realPathOf(target);
+  if (!pathContains(realRoot, real)) return [];
   const stat = import_node_fs5.default.statSync(target);
   if (stat.isFile()) return target.endsWith(".md") ? [target] : [];
-  if (!stat.isDirectory()) return [];
-  return import_node_fs5.default.readdirSync(target, { withFileTypes: true }).flatMap((entry) => markdownFiles(import_node_path5.default.join(target, entry.name)));
+  if (!stat.isDirectory() || visited.has(real)) return [];
+  visited.add(real);
+  return import_node_fs5.default.readdirSync(target, { withFileTypes: true }).flatMap((entry) => markdownFiles(import_node_path5.default.join(target, entry.name), realRoot, visited));
 }
 function fileDescriptor(root, absolute) {
   const content = import_node_fs5.default.readFileSync(absolute, "utf8");
@@ -2226,9 +2612,7 @@ async function handleSyncTool(client2, args) {
   try {
     const action = String(args.action || "");
     const context = args.invocation_context || {};
-    const adapter = new CodegraphAdapter({
-      cwd: context.cwd || process.cwd()
-    });
+    const adapter = new CodegraphAdapter({ cwd: invocationCwd(args) });
     const requestedRepo = typeof args.repo === "string" ? args.repo : typeof args.repo_id === "string" ? args.repo_id : context.repoId;
     const repository = await adapter.resolveRepository(requestedRepo);
     const root = repository.repoRoot;
@@ -2237,6 +2621,12 @@ async function handleSyncTool(client2, args) {
     const remote = client2;
     if (action === "scan") {
       const repositories = args.workspace === true ? await adapter.resolveRepositories() : [repository];
+      if (args.workspace === true && repositories.length === 0) {
+        return err2(
+          "workspace_not_configured",
+          `workspace scan found no declared repositories: ${adapter.workspaceDiagnostic()}`
+        );
+      }
       const requested = Array.isArray(args.paths) && args.paths.length > 0 ? args.paths.map(String) : [".claude/agent-memory", "memory"];
       const scans = [];
       for (const selected of repositories) {
@@ -2293,10 +2683,11 @@ async function handleSyncTool(client2, args) {
   }
 }
 async function scanRepository(remote, repository, requested, provider, agentId) {
+  const realRoot = realPathOf(repository.repoRoot);
   const files = [
     ...new Set(
       requested.flatMap(
-        (candidate) => markdownFiles(safePath(repository.repoRoot, candidate))
+        (candidate) => markdownFiles(safePath(repository.repoRoot, candidate), realRoot)
       )
     )
   ].sort();
@@ -2730,15 +3121,15 @@ function renderTraversal(response) {
   const labelByUid = /* @__PURE__ */ new Map();
   for (const node of nodes) labelByUid.set(str(node.uid), str(node.label) || "?");
   if (paths.length > 0) {
-    const items = paths.map((raw) => obj(raw)).filter((path6) => Boolean(path6)).map((path6, index) => {
-      const uids = Array.isArray(path6.node_uids) ? path6.node_uids.map(String) : [];
-      const labels = Array.isArray(path6.labels) ? path6.labels.map(String) : Array.isArray(path6.nodes) ? path6.nodes.map((hop) => {
+    const items = paths.map((raw) => obj(raw)).filter((path7) => Boolean(path7)).map((path7, index) => {
+      const uids = Array.isArray(path7.node_uids) ? path7.node_uids.map(String) : [];
+      const labels = Array.isArray(path7.labels) ? path7.labels.map(String) : Array.isArray(path7.nodes) ? path7.nodes.map((hop) => {
         const hopNode = obj(hop);
         return str(hopNode?.label) || labelByUid.get(str(hopNode?.uid) || "") || str(hop) || "?";
       }) : [];
       const route = labels.length > 0 ? labels.join(" \u2192 ") : uids.join(" \u2192 ") || "(path)";
-      const cost = num(path6.cost) ?? num(path6.path_cost);
-      const confidence = num(path6.path_confidence);
+      const cost = num(path7.cost) ?? num(path7.path_cost);
+      const confidence = num(path7.path_confidence);
       const meta = [
         cost !== void 0 ? `cost ${cost}` : void 0,
         confidence !== void 0 ? `confidence ${confidence}` : void 0
@@ -5343,7 +5734,7 @@ async function checkMcpGovernance(toolName, args, config) {
   if (!response) {
     return {
       allowed: false,
-      message: `MindGraph governance could not establish permission after ${retryDelays.length + 1} attempts (${lastFailure}). Set MINDGRAPH_GOVERNANCE=off to run this adapter ungoverned.`
+      message: `MindGraph at ${config.baseUrl} is unreachable (${lastFailure}; ${retryDelays.length + 1} attempts). The tool call was NOT evaluated against policy and NOT executed \u2014 this is a connectivity failure, not a governance denial. Check the network and MINDGRAPH_BASE_URL, then retry.`
     };
   }
   if (!response.ok) {
@@ -5587,10 +5978,10 @@ async function main() {
   const transport = new import_stdio.StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `MindGraph MCP server v${"0.17.0"} running on stdio (${BASE_URL})`
+    `MindGraph MCP server v${"0.18.0"} running on stdio (${BASE_URL})`
   );
 }
-var import_server, import_stdio, import_types, API_KEY, BASE_URL, AGENT_ID, ORG_ID, PROFILE, HARNESS, client, INSTRUCTIONS, server, GOVERNANCE_CONFIG, PROMPTS;
+var import_server, import_stdio, import_types, import_node_path6, API_KEY, BASE_URL, AGENT_ID, ORG_ID, PROFILE, HARNESS, client, INSTRUCTIONS, RUNNER_REFRESH, HOOK_SKEW_NOTE, server, GOVERNANCE_CONFIG, PROMPTS;
 var init_src = __esm({
   "src/index.ts"() {
     "use strict";
@@ -5603,6 +5994,8 @@ var init_src = __esm({
     init_generated_tools();
     init_governance();
     init_resources();
+    import_node_path6 = __toESM(require("path"));
+    init_hook_installer();
     API_KEY = process.env.MINDGRAPH_API_KEY;
     BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
     AGENT_ID = process.env.MINDGRAPH_AGENT_ID || loadHookEnv().agentId || stableAgentId();
@@ -5724,10 +6117,42 @@ Capture knowledge when the user shares something worth remembering:
         (line) => !line.includes("mindgraph_code") && !line.includes("`code`") && !line.includes("Typed code anchors")
       ).join("\n");
     }
+    RUNNER_REFRESH = (() => {
+      try {
+        return refreshHookRunner("0.18.0", import_node_path6.default.join(__dirname, "cli.js"));
+      } catch {
+        return void 0;
+      }
+    })();
+    if (RUNNER_REFRESH?.refreshed) {
+      const refreshedSettings = (() => {
+        try {
+          return refreshOwnedClaudeHooks();
+        } catch {
+          return [];
+        }
+      })();
+      console.error(
+        `[mindgraph-mcp] refreshed pinned hook runner ${RUNNER_REFRESH.runnerVersion ? `v${RUNNER_REFRESH.runnerVersion}` : "(pre-sidecar)"} \u2192 v${"0.18.0"}` + (refreshedSettings.length > 0 ? `; refreshed owned hook entries in ${refreshedSettings.join(", ")}` : "")
+      );
+    }
+    HOOK_SKEW_NOTE = (() => {
+      try {
+        return versionSkewNote("0.18.0");
+      } catch {
+        return void 0;
+      }
+    })();
+    if (HOOK_SKEW_NOTE) {
+      INSTRUCTIONS += `
+
+${HOOK_SKEW_NOTE}`;
+      console.error(`[mindgraph-mcp] ${HOOK_SKEW_NOTE}`);
+    }
     server = new import_server.Server(
       {
         name: "mindgraph",
-        version: "0.17.0"
+        version: "0.18.0"
       },
       {
         capabilities: {
@@ -5946,7 +6371,7 @@ ${conversation}`
 
 // src/cli.ts
 var fs5 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var path6 = __toESM(require("path"));
 var os4 = __toESM(require("os"));
 var crypto5 = __toESM(require("crypto"));
 var import_child_process = require("child_process");
@@ -6029,6 +6454,7 @@ var import_node_path3 = __toESM(require("path"));
 var import_node_child_process2 = require("child_process");
 init_codegraph();
 init_code_tool();
+init_error_detail();
 init_hook_env();
 var NOOP = { kind: "noop" };
 function defaultLedger(sessionId, options) {
@@ -6360,6 +6786,51 @@ function isOwnPriorWork(brief, agentId, harness) {
   const owner = string(object(brief?.lease)?.lease_owner_agent_id);
   return owner === agentId || owner === harness;
 }
+function hasMindgraphServer(servers) {
+  if (!servers || typeof servers !== "object") return false;
+  for (const [name, entry] of Object.entries(servers)) {
+    if (name === "mindgraph") return true;
+    const cfg = entry && typeof entry === "object" ? entry : void 0;
+    const text = [
+      String(cfg?.command ?? ""),
+      Array.isArray(cfg?.args) ? cfg.args.join(" ") : "",
+      String(cfg?.url ?? "")
+    ].join(" ");
+    if (text.includes("mindgraph-mcp")) return true;
+  }
+  return false;
+}
+function pathIsWithin(ancestor, descendant) {
+  const base = import_node_path3.default.resolve(ancestor);
+  const target = import_node_path3.default.resolve(descendant);
+  return target === base || target.startsWith(base + import_node_path3.default.sep);
+}
+function claudeMcpRegistrationNote(input, options) {
+  if (options.harness !== "claude-code") return void 0;
+  if (process.env.MINDGRAPH_SKIP_MCP_REGISTRATION_CHECK === "1") return void 0;
+  try {
+    const configPath = options.claudeConfigPath || import_node_path3.default.join(import_node_os3.default.homedir(), ".claude.json");
+    if (!import_node_fs3.default.existsSync(configPath)) return void 0;
+    const config = JSON.parse(import_node_fs3.default.readFileSync(configPath, "utf8"));
+    if (hasMindgraphServer(config.mcpServers)) return void 0;
+    const cwd = import_node_path3.default.resolve(input.cwd || ".");
+    for (const [projectDir, project] of Object.entries(config.projects || {})) {
+      if (!pathIsWithin(projectDir, cwd)) continue;
+      if (hasMindgraphServer(project?.mcpServers)) return void 0;
+    }
+    for (let dir = cwd; ; dir = import_node_path3.default.dirname(dir)) {
+      const candidate = import_node_path3.default.join(dir, ".mcp.json");
+      if (import_node_fs3.default.existsSync(candidate)) {
+        const parsed = JSON.parse(import_node_fs3.default.readFileSync(candidate, "utf8"));
+        if (hasMindgraphServer(parsed.mcpServers)) return void 0;
+      }
+      if (dir === import_node_path3.default.dirname(dir)) break;
+    }
+  } catch {
+    return void 0;
+  }
+  return "NOTE: no MindGraph MCP server appears to be registered for Claude Code, so this brief's continuity actions (claim, checkpoint, capture) have no mcp__mindgraph__* tools to run through and durable memory cannot be written this session. Tell the user to run: npx -y mindgraph-mcp@latest install-code \u2014 then start a new session.";
+}
 async function sessionStart(input, client2, options) {
   const agentId = resolveAgentId(options);
   const harnessLabel = options.harness === "claude-code" ? "Claude Code" : "Codex";
@@ -6449,7 +6920,14 @@ async function sessionStart(input, client2, options) {
     claimFailed: claimFailed && !stillHeld,
     scopeNote
   });
-  const briefHash = import_node_crypto3.default.createHash("sha256").update(briefText).digest("hex");
+  const registrationNote = claudeMcpRegistrationNote(input, options);
+  if (registrationNote) {
+    console.error(`mindgraph-hook: ${registrationNote}`);
+  }
+  const contextText = registrationNote ? `${registrationNote}
+
+${briefText}` : briefText;
+  const briefHash = import_node_crypto3.default.createHash("sha256").update(contextText).digest("hex");
   const shouldInject = withLedger(input.session_id, options, (ledger) => {
     const changed = ledger.lastBriefHash !== briefHash;
     const reinjectCompact = options.reinjectUnchangedCompact && input.source === "compact";
@@ -6482,7 +6960,7 @@ async function sessionStart(input, client2, options) {
     ledger.lastBriefHash = briefHash;
     return changed || reinjectCompact;
   });
-  return shouldInject ? { kind: "context", context: briefText } : NOOP;
+  return shouldInject ? { kind: "context", context: contextText } : NOOP;
 }
 async function preTool(input, options) {
   const original = { ...input.tool_input || {} };
@@ -6589,9 +7067,7 @@ async function postTool(input, client2, options) {
           }
         }
       } else if (aboutLedgerTask) {
-        ledger.taskVersion = number(payload?.current_version) ?? ledger.taskVersion;
-        ledger.leaseEpoch = number(payload?.current_epoch) ?? ledger.leaseEpoch;
-        ledger.leaseExpiresAt = number(payload?.lease_expires_at) ?? ledger.leaseExpiresAt;
+        adoptConflictFence(ledger, payload);
       }
     }
     if (ledger.taskUid && ledger.sessionUid && ledger.taskVersion !== void 0 && ledger.leaseEpoch !== void 0 && ledger.leaseExpiresAt !== void 0 && // Only ledgers whose lease state was written by a claim THIS code made
@@ -6648,19 +7124,35 @@ async function postTool(input, client2, options) {
         })
       );
       withLedger(input.session_id, options, (ledger) => {
-        if (payloadIsError(response)) return void 0;
         if (ledger.taskUid !== active.taskUid) return void 0;
+        if (payloadIsError(response)) {
+          adoptConflictFence(ledger, response);
+          return void 0;
+        }
         ledger.taskVersion = number(response?.task_version) ?? ledger.taskVersion;
         ledger.leaseEpoch = number(response?.lease_epoch) ?? ledger.leaseEpoch;
         ledger.leaseExpiresAt = number(response?.lease_expires_at) ?? ledger.leaseExpiresAt;
         ledger.lastLeaseRenewalAt = nowSeconds;
         return void 0;
       });
-    } catch {
+    } catch (cause) {
+      const conflict = conflictState(cause);
+      if (Object.keys(conflict).length > 0) {
+        withLedger(input.session_id, options, (ledger) => {
+          if (ledger.taskUid !== active.taskUid) return void 0;
+          adoptConflictFence(ledger, conflict);
+          return void 0;
+        });
+      }
     }
   }
   return NOOP;
 }
+function adoptConflictFence(ledger, payload) {
+  ledger.taskVersion = number(payload?.current_version) ?? ledger.taskVersion;
+  ledger.leaseEpoch = number(payload?.current_epoch) ?? ledger.leaseEpoch;
+  ledger.leaseExpiresAt = number(payload?.lease_expires_at) ?? ledger.leaseExpiresAt;
+}
 function payloadIsError(payload) {
   return Boolean(payload && payload.error);
 }
@@ -6813,189 +7305,13 @@ async function runCodexHook(input, client2, options = {}) {
   }
 }
 
-// src/hook-installer.ts
-var import_node_fs4 = __toESM(require("fs"));
-var import_node_os4 = __toESM(require("os"));
-var import_node_path4 = __toESM(require("path"));
-var import_node_crypto4 = __toESM(require("crypto"));
-var OWNER_MARKER = "--owner mindgraph";
-var RUNNER_RELATIVE = ".mindgraph/bin/mindgraph-hook.cjs";
-function command(harness) {
-  return `node "$HOME/${RUNNER_RELATIVE}" hook --harness ${harness} --owner mindgraph`;
-}
-function windowsCommand(harness) {
-  return `node "%USERPROFILE%\\.mindgraph\\bin\\mindgraph-hook.cjs" hook --harness ${harness} --owner mindgraph`;
-}
-function installHookRunner(sourceFile, homeDir) {
-  const target = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_RELATIVE);
-  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(target), { recursive: true });
-  import_node_fs4.default.copyFileSync(sourceFile, target);
-  return target;
-}
-function settingsPath(harness, scope, projectDir = process.cwd(), codexHomeDir = process.env.CODEX_HOME || import_node_path4.default.join(import_node_os4.default.homedir(), ".codex")) {
-  if (harness === "codex") {
-    return scope === "user" ? import_node_path4.default.join(codexHomeDir, "hooks.json") : import_node_path4.default.join(projectDir, ".codex", "hooks.json");
-  }
-  return scope === "user" ? import_node_path4.default.join(import_node_os4.default.homedir(), ".claude", "settings.json") : import_node_path4.default.join(projectDir, ".claude", "settings.json");
-}
-function readSettings(file) {
-  if (!import_node_fs4.default.existsSync(file)) return {};
-  return JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
-}
-function ownedHook(harness, timeout, additionalContextLimit) {
-  return {
-    type: "command",
-    command: command(harness),
-    ...harness === "codex" ? { commandWindows: windowsCommand(harness) } : {},
-    timeout,
-    statusMessage: "Syncing MindGraph session context",
-    ...additionalContextLimit === void 0 ? {} : { additionalContextLimit }
-  };
-}
-function desiredEntries(harness) {
-  const common = {
-    SessionStart: [
-      {
-        matcher: harness === "claude-code" ? "startup|resume|clear|compact|fork" : "startup|resume|clear|compact",
-        // B7 live acceptance caught cold SessionStart calls crossing the
-        // inherited 20s edge in both harnesses: the hooks correctly failed
-        // open, but no brief reached the model. The same installed runner
-        // completed in 16.84s once warm. Keep a 30s cold-tenant margin.
-        // The declared Codex context limit must not undercut the brief's own
-        // 9,000-char budget: at 3,000 the harness applied a SECOND, tighter
-        // truncation the renderer knew nothing about.
-        hooks: [
-          ownedHook(
-            harness,
-            30,
-            harness === "codex" ? 1e4 : void 0
-          )
-        ]
-      }
-    ],
-    PreToolUse: [
-      {
-        matcher: "mcp__mindgraph__.*",
-        // Repository resolution over a large multi-repo workspace plus three
-        // git probes can exceed 3s on the first (uncached) call; a killed
-        // PreToolUse means the call goes through untagged.
-        hooks: [ownedHook(harness, 5)]
-      }
-    ],
-    // PostToolUse awaits the lease renewal round-trip, which fires exactly
-    // when the tenant is cold (post-idle reclaim) — 5s killed it mid-claim.
-    PostToolUse: [{ matcher: ".*", hooks: [ownedHook(harness, 10)] }],
-    Stop: [{ hooks: [ownedHook(harness, 5)] }],
-    // SessionEnd makes up to two sequential cloud calls (abandon_iteration +
-    // session close) — the SAME cold-tenant latency SessionStart needs 30s
-    // for. Claude honors the configured budget; Codex clamps SessionEnd to a
-    // 3s platform cap regardless of this value (see codex-hooks.ts wire
-    // map), so the codex adapter instead makes at most ONE call there.
-    SessionEnd: [
-      { hooks: [ownedHook(harness, harness === "codex" ? 3 : 30)] }
-    ]
-  };
-  return harness === "claude-code" ? {
-    ...common,
-    TaskCreated: [{ hooks: [ownedHook(harness, 3)] }],
-    TaskCompleted: [{ hooks: [ownedHook(harness, 3)] }]
-  } : common;
-}
-function hookCommand(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const command2 = value.command;
-  return typeof command2 === "string" ? command2 : void 0;
-}
-function entryHasOwnedHook(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const hooks = value.hooks;
-  return Array.isArray(hooks) && hooks.some((hook) => hookCommand(hook)?.includes(OWNER_MARKER));
-}
-function writeSettings(file, settings) {
-  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(file), { recursive: true });
-  const temporary = `${file}.${process.pid}.${import_node_crypto4.default.randomUUID()}.tmp`;
-  import_node_fs4.default.writeFileSync(temporary, `${JSON.stringify(settings, null, 2)}
-`, {
-    mode: 384
-  });
-  import_node_fs4.default.renameSync(temporary, file);
-}
-function installHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
-  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
-  const settings = readSettings(file);
-  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
-  let added = 0;
-  let updated = 0;
-  for (const [event, wanted] of Object.entries(desiredEntries(harness))) {
-    const current = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
-    const kept = current.filter((entry) => !entryHasOwnedHook(entry));
-    const hadOwned = kept.length !== current.length;
-    for (const entry of wanted) {
-      kept.push(entry);
-      if (hadOwned) updated += 1;
-      else added += 1;
-    }
-    hooks[event] = kept;
-  }
-  settings.hooks = hooks;
-  writeSettings(file, settings);
-  return { path: file, added, updated };
-}
-function uninstallHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
-  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
-  if (!import_node_fs4.default.existsSync(file)) return { path: file, removed: 0 };
-  const settings = readSettings(file);
-  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
-  let removed = 0;
-  for (const [event, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    const retainedEntries = [];
-    for (const rawEntry of value) {
-      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
-        retainedEntries.push(rawEntry);
-        continue;
-      }
-      const entry = { ...rawEntry };
-      if (!Array.isArray(entry.hooks)) {
-        retainedEntries.push(entry);
-        continue;
-      }
-      const retainedHooks = entry.hooks.filter((hook) => {
-        const owned = hookCommand(hook)?.includes(OWNER_MARKER) || false;
-        if (owned) removed += 1;
-        return !owned;
-      });
-      if (retainedHooks.length > 0) {
-        entry.hooks = retainedHooks;
-        retainedEntries.push(entry);
-      }
-    }
-    if (retainedEntries.length > 0) hooks[event] = retainedEntries;
-    else delete hooks[event];
-  }
-  settings.hooks = hooks;
-  writeSettings(file, settings);
-  return { path: file, removed };
-}
-function installClaudeHooks(scope, projectDir = process.cwd()) {
-  return installHooks("claude-code", scope, projectDir);
-}
-function uninstallClaudeHooks(scope, projectDir = process.cwd()) {
-  return uninstallHooks("claude-code", scope, projectDir);
-}
-function installCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
-  return installHooks("codex", scope, projectDir, codexHomeDir);
-}
-function uninstallCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
-  return uninstallHooks("codex", scope, projectDir, codexHomeDir);
-}
-
 // src/cli.ts
+init_hook_installer();
 function recordHookHealth(harness, error) {
   try {
-    const dir = process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime");
+    const dir = process.env.MINDGRAPH_RUNTIME_DIR || path6.join(os4.homedir(), ".mindgraph", "runtime");
     fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-    const file = path5.join(dir, "hook-health.json");
+    const file = path6.join(dir, "hook-health.json");
     let failures = 0;
     try {
       failures = Number(JSON.parse(fs5.readFileSync(file, "utf8")).consecutiveFailures) || 0;
@@ -7017,8 +7333,8 @@ function recordHookHealth(harness, error) {
 }
 function clearHookHealth(harness) {
   try {
-    const file = path5.join(
-      process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime"),
+    const file = path6.join(
+      process.env.MINDGRAPH_RUNTIME_DIR || path6.join(os4.homedir(), ".mindgraph", "runtime"),
       "hook-health.json"
     );
     if (!fs5.existsSync(file)) return;
@@ -7040,7 +7356,7 @@ function clearHookHealth(harness) {
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
     case "darwin":
-      return path5.join(
+      return path6.join(
         os4.homedir(),
         "Library",
         "Application Support",
@@ -7048,13 +7364,13 @@ function getClaudeDesktopConfigPath() {
         "claude_desktop_config.json"
       );
     case "win32":
-      return path5.join(
-        process.env.APPDATA || path5.join(os4.homedir(), "AppData", "Roaming"),
+      return path6.join(
+        process.env.APPDATA || path6.join(os4.homedir(), "AppData", "Roaming"),
         "Claude",
         "claude_desktop_config.json"
       );
     case "linux":
-      return path5.join(
+      return path6.join(
         os4.homedir(),
         ".config",
         "Claude",
@@ -7070,7 +7386,7 @@ function readJsonFile(filePath) {
   return JSON.parse(content);
 }
 function writeJsonFile(filePath, data) {
-  const dir = path5.dirname(filePath);
+  const dir = path6.dirname(filePath);
   if (!fs5.existsSync(dir)) {
     fs5.mkdirSync(dir, { recursive: true });
   }
@@ -7206,8 +7522,8 @@ function printStatus() {
     `MINDGRAPH_BASE_URL: ${process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud (default)"}`
   );
   try {
-    const healthFile = path5.join(
-      process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime"),
+    const healthFile = path6.join(
+      process.env.MINDGRAPH_RUNTIME_DIR || path6.join(os4.homedir(), ".mindgraph", "runtime"),
       "hook-health.json"
     );
     if (fs5.existsSync(healthFile)) {
@@ -7228,7 +7544,7 @@ function withHooksFlag() {
 }
 function finishCodeInstall(apiKey, baseUrl, withHooks, agentId) {
   if (withHooks) {
-    const runner = installHookRunner(__filename);
+    const runner = installHookRunner(__filename, void 0, "0.18.0");
     console.log(`Installed pinned hook runner at ${runner}`);
     const result = installClaudeHooks("user");
     console.log(
@@ -7458,7 +7774,7 @@ async function main2() {
       if (hookHarness !== "claude-code" && hookHarness !== "codex") {
         throw new Error("--harness must be claude-code or codex");
       }
-      const runner = installHookRunner(__filename);
+      const runner = installHookRunner(__filename, void 0, "0.18.0");
       console.log(`Installed pinned hook runner at ${runner}`);
       const result = hookHarness === "codex" ? installCodexHooks(scope, projectDir) : installClaudeHooks(scope, projectDir);
       console.log(