safeword 0.57.0 → 0.58.0

package/dist/{check-IV6KC65F.js → check-6IHMMAS6.js}

@@ -2,16 +2,19 @@ import {
   buildIndexConflictListMessage
 } from "./chunk-ZESHX2BU.js";
 import {
+  fetchRegistryLatestVersion,
   isNewerVersion
-} from "./chunk-FJYRWU2V.js";
+} from "./chunk-LRYWFRPD.js";
 import {
   checkHealth,
   reportHealthSummary
-} from "./chunk-O3QF6QHX.js";
+} from "./chunk-Q7ALQS7T.js";
 import "./chunk-YXNI7W5D.js";
 import "./chunk-XTLCJKGE.js";
-import "./chunk-HGOG5ZLC.js";
-import "./chunk-GS3TBFXU.js";
+import "./chunk-UYTOLZT2.js";
+import {
+  detectPackageManager
+} from "./chunk-GS3TBFXU.js";
 import {
   syncTickets
 } from "./chunk-HTDMZQKA.js";
@@ -30,26 +33,9 @@ import "./chunk-KIZYVSME.js";
 
 // src/commands/check.ts
 import process from "process";
-async function checkLatestVersion(timeout = 3e3) {
-  try {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => {
-      controller.abort();
-    }, timeout);
-    const response = await fetch("https://registry.npmjs.org/safeword/latest", {
-      signal: controller.signal
-    });
-    clearTimeout(timeoutId);
-    if (!response.ok) return void 0;
-    const data = await response.json();
-    return data.version ?? void 0;
-  } catch {
-    return void 0;
-  }
-}
 async function reportUpdateStatus(health) {
   info("\nChecking for updates...");
-  const latestVersion = await checkLatestVersion();
+  const latestVersion = await fetchRegistryLatestVersion();
   if (!latestVersion) {
     warn("Couldn't check for updates (offline?)");
     return;
@@ -63,11 +49,33 @@ async function reportUpdateStatus(health) {
     success("CLI is up to date");
   }
 }
-function reportVersionMismatch(health) {
+function isDigit(char) {
+  return char >= "0" && char <= "9";
+}
+function isPackageVersionSpecChar(char) {
+  return char >= "a" && char <= "z" || char >= "A" && char <= "Z" || isDigit(char) || char === "." || char === "-" || char === "+";
+}
+function isSafePackageVersion(version) {
+  if (version.length === 0 || !version.includes(".")) return false;
+  for (const char of version) {
+    if (!isPackageVersionSpecChar(char)) return false;
+  }
+  return true;
+}
+function reportVersionMismatch(health, cwd) {
   if (!health.projectVersion) return;
   if (isNewerVersion(health.cliVersion, health.projectVersion)) {
     warn(`Project config (v${health.projectVersion}) is newer than CLI (v${health.cliVersion})`);
-    info("Consider upgrading the CLI");
+    if (!isSafePackageVersion(health.projectVersion)) {
+      warn(
+        "Project version is not safe to use in a package install command; inspect .safeword/version."
+      );
+      return;
+    }
+    const pm = detectPackageManager(cwd);
+    const runSafewordUpgrade = pm === "bun" || pm === "yarn" ? `${pm} run safeword upgrade` : `${pm} exec safeword upgrade`;
+    info("Update the project-local CLI first:");
+    info(`${pm} add -D safeword@${health.projectVersion} && ${runSafewordUpgrade}`);
   } else if (isNewerVersion(health.projectVersion, health.cliVersion)) {
     info(`
 Upgrade available for project config`);
@@ -108,7 +116,7 @@ async function check(options) {
   } else {
     await reportUpdateStatus(health);
   }
-  reportVersionMismatch(health);
+  reportVersionMismatch(health, cwd);
   const hasIssues = reportHealthSummary(health);
   if (hasIssues) {
     process.exit(1);
@@ -117,4 +125,4 @@ async function check(options) {
 export {
   check
 };
-//# sourceMappingURL=check-IV6KC65F.js.map
+//# sourceMappingURL=check-6IHMMAS6.js.map

package/dist/check-6IHMMAS6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/check.ts"],"sourcesContent":["/**\n * Check command - Verify project health and configuration\n *\n * The config-health core lives in ../health.ts (shared with the setup/upgrade\n * self-verify, ticket 3293WH). This command adds the standalone-only\n * surfaces: npm update-check, version display, and ticket-index refresh.\n */\n\nimport process from 'node:process';\n\nimport { checkHealth, type HealthStatus, reportHealthSummary } from '../health.js';\nimport { syncTickets } from '../ticket-sync/index.js';\nimport { detectPackageManager } from '../utils/install.js';\nimport { header, info, keyValue, success, warn } from '../utils/output.js';\nimport { buildIndexConflictListMessage } from '../utils/ticket-index-warnings.js';\nimport { fetchRegistryLatestVersion, isNewerVersion } from '../utils/version.js';\n\ninterface CheckOptions {\n  offline?: boolean;\n}\n\n/**\n * Check for CLI updates and report status\n * @param health\n */\nasync function reportUpdateStatus(health: HealthStatus): Promise<void> {\n  info('\\nChecking for updates...');\n  const latestVersion = await fetchRegistryLatestVersion();\n\n  if (!latestVersion) {\n    warn(\"Couldn't check for updates (offline?)\");\n    return;\n  }\n\n  health.latestVersion = latestVersion;\n  health.updateAvailable = isNewerVersion(health.cliVersion, latestVersion);\n\n  if (health.updateAvailable) {\n    warn(`Update available: v${latestVersion}`);\n    info('Run `bunx safeword@latest upgrade` to upgrade');\n  } else {\n    success('CLI is up to date');\n  }\n}\n\nfunction isDigit(char: string): boolean {\n  return char >= '0' && char <= '9';\n}\n\nfunction isPackageVersionSpecChar(char: string): boolean {\n  return (\n    (char >= 'a' && char <= 'z') ||\n    (char >= 'A' && char <= 'Z') ||\n    isDigit(char) ||\n    char === '.' ||\n    char === '-' ||\n    char === '+'\n  );\n}\n\nfunction isSafePackageVersion(version: string): boolean {\n  if (version.length === 0 || !version.includes('.')) return false;\n  for (const char of version) {\n    if (!isPackageVersionSpecChar(char)) return false;\n  }\n  return true;\n}\n\n/**\n * Compare project version vs CLI version and report\n * @param health\n */\nfunction reportVersionMismatch(health: HealthStatus, cwd: string): void {\n  if (!health.projectVersion) return;\n\n  if (isNewerVersion(health.cliVersion, health.projectVersion)) {\n    warn(`Project config (v${health.projectVersion}) is newer than CLI (v${health.cliVersion})`);\n\n    if (!isSafePackageVersion(health.projectVersion)) {\n      warn(\n        'Project version is not safe to use in a package install command; inspect .safeword/version.',\n      );\n      return;\n    }\n\n    const pm = detectPackageManager(cwd);\n    const runSafewordUpgrade =\n      pm === 'bun' || pm === 'yarn' ? `${pm} run safeword upgrade` : `${pm} exec safeword upgrade`;\n    info('Update the project-local CLI first:');\n    info(`${pm} add -D safeword@${health.projectVersion} && ${runSafewordUpgrade}`);\n  } else if (isNewerVersion(health.projectVersion, health.cliVersion)) {\n    info(`\\nUpgrade available for project config`);\n    info(\n      `Run \\`safeword upgrade\\` to update from v${health.projectVersion} to v${health.cliVersion}`,\n    );\n  }\n}\n\n/**\n * Regenerate the ticket discovery index, swallowing any error — index\n * freshness must never block or fail a health check. Reports only when it\n * actually rewrote a file.\n * @param cwd\n */\nfunction regenerateTicketIndex(cwd: string): void {\n  try {\n    const result = syncTickets(cwd);\n    if (result.wrote) {\n      info('Regenerated ticket index (INDEX.md / INDEX-completed.md)');\n    }\n    if (result.indexConflicts.length > 0) {\n      warn(buildIndexConflictListMessage(result.indexConflicts));\n    }\n  } catch (error: unknown) {\n    // Best-effort: index freshness must never fail the health check. Surface\n    // under DEBUG, then return — the deliberate swallow point.\n    if (process.env.DEBUG) {\n      console.error('[check] ticket index regen failed:', error);\n    }\n    return;\n  }\n}\n\n/**\n *\n * @param options\n */\nexport async function check(options: CheckOptions): Promise<void> {\n  const cwd = process.cwd();\n\n  header('Safeword Health Check');\n\n  const health = await checkHealth(cwd);\n\n  // Not configured\n  if (!health.configured) {\n    info('Not configured. Run `safeword setup` to initialize.');\n    return;\n  }\n\n  // Keep the ticket discovery index fresh at this checkpoint (best-effort —\n  // never fail the health check on index regen). Ticket 1GGD28.\n  regenerateTicketIndex(cwd);\n\n  // Show versions\n  keyValue('Safeword CLI', `v${health.cliVersion}`);\n  keyValue('Project config', health.projectVersion ? `v${health.projectVersion}` : 'unknown');\n\n  // Check for updates (unless offline)\n  if (options.offline) {\n    info('\\nSkipped update check (offline mode)');\n  } else {\n    await reportUpdateStatus(health);\n  }\n\n  reportVersionMismatch(health, cwd);\n  const hasIssues = reportHealthSummary(health);\n\n  if (hasIssues) {\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,OAAO,aAAa;AAiBpB,eAAe,mBAAmB,QAAqC;AACrE,OAAK,2BAA2B;AAChC,QAAM,gBAAgB,MAAM,2BAA2B;AAEvD,MAAI,CAAC,eAAe;AAClB,SAAK,uCAAuC;AAC5C;AAAA,EACF;AAEA,SAAO,gBAAgB;AACvB,SAAO,kBAAkB,eAAe,OAAO,YAAY,aAAa;AAExE,MAAI,OAAO,iBAAiB;AAC1B,SAAK,sBAAsB,aAAa,EAAE;AAC1C,SAAK,+CAA+C;AAAA,EACtD,OAAO;AACL,YAAQ,mBAAmB;AAAA,EAC7B;AACF;AAEA,SAAS,QAAQ,MAAuB;AACtC,SAAO,QAAQ,OAAO,QAAQ;AAChC;AAEA,SAAS,yBAAyB,MAAuB;AACvD,SACG,QAAQ,OAAO,QAAQ,OACvB,QAAQ,OAAO,QAAQ,OACxB,QAAQ,IAAI,KACZ,SAAS,OACT,SAAS,OACT,SAAS;AAEb;AAEA,SAAS,qBAAqB,SAA0B;AACtD,MAAI,QAAQ,WAAW,KAAK,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAC3D,aAAW,QAAQ,SAAS;AAC1B,QAAI,CAAC,yBAAyB,IAAI,EAAG,QAAO;AAAA,EAC9C;AACA,SAAO;AACT;AAMA,SAAS,sBAAsB,QAAsB,KAAmB;AACtE,MAAI,CAAC,OAAO,eAAgB;AAE5B,MAAI,eAAe,OAAO,YAAY,OAAO,cAAc,GAAG;AAC5D,SAAK,oBAAoB,OAAO,cAAc,yBAAyB,OAAO,UAAU,GAAG;AAE3F,QAAI,CAAC,qBAAqB,OAAO,cAAc,GAAG;AAChD;AAAA,QACE;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,KAAK,qBAAqB,GAAG;AACnC,UAAM,qBACJ,OAAO,SAAS,OAAO,SAAS,GAAG,EAAE,0BAA0B,GAAG,EAAE;AACtE,SAAK,qCAAqC;AAC1C,SAAK,GAAG,EAAE,oBAAoB,OAAO,cAAc,OAAO,kBAAkB,EAAE;AAAA,EAChF,WAAW,eAAe,OAAO,gBAAgB,OAAO,UAAU,GAAG;AACnE,SAAK;AAAA,qCAAwC;AAC7C;AAAA,MACE,4CAA4C,OAAO,cAAc,QAAQ,OAAO,UAAU;AAAA,IAC5F;AAAA,EACF;AACF;AAQA,SAAS,sBAAsB,KAAmB;AAChD,MAAI;AACF,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,OAAO,OAAO;AAChB,WAAK,0DAA0D;AAAA,IACjE;AACA,QAAI,OAAO,eAAe,SAAS,GAAG;AACpC,WAAK,8BAA8B,OAAO,cAAc,CAAC;AAAA,IAC3D;AAAA,EACF,SAAS,OAAgB;AAGvB,QAAI,QAAQ,IAAI,OAAO;AACrB,cAAQ,MAAM,sCAAsC,KAAK;AAAA,IAC3D;AACA;AAAA,EACF;AACF;AAMA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,IAAI;AAExB,SAAO,uBAAuB;AAE9B,QAAM,SAAS,MAAM,YAAY,GAAG;AAGpC,MAAI,CAAC,OAAO,YAAY;AACtB,SAAK,qDAAqD;AAC1D;AAAA,EACF;AAIA,wBAAsB,GAAG;AAGzB,WAAS,gBAAgB,IAAI,OAAO,UAAU,EAAE;AAChD,WAAS,kBAAkB,OAAO,iBAAiB,IAAI,OAAO,cAAc,KAAK,SAAS;AAG1F,MAAI,QAAQ,SAAS;AACnB,SAAK,uCAAuC;AAAA,EAC9C,OAAO;AACL,UAAM,mBAAmB,MAAM;AAAA,EACjC;AAEA,wBAAsB,QAAQ,GAAG;AACjC,QAAM,YAAY,oBAAoB,MAAM;AAE5C,MAAI,WAAW;AACb,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-D5H7VBXQ.js → chunk-DIJ35ZXH.js}

@@ -3,7 +3,7 @@ import {
   addInstalledPack,
   isGitRepo,
   isPackInstalled
-} from "./chunk-HGOG5ZLC.js";
+} from "./chunk-UYTOLZT2.js";
 import {
   SAFEWORD_PEER_DEPENDENCIES
 } from "./chunk-HSC7TELY.js";
@@ -392,4 +392,4 @@ export {
   getEslintPeerMismatchWarning,
   maybeAutoPatchOrNudge
 };
-//# sourceMappingURL=chunk-D5H7VBXQ.js.map
+//# sourceMappingURL=chunk-DIJ35ZXH.js.map

package/dist/chunk-LRYWFRPD.js

@@ -0,0 +1,46 @@
+// src/utils/version.ts
+function compareVersions(a, b) {
+  const aParts = a.split(".").map(Number);
+  const bParts = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const aValue = aParts[i] ?? 0;
+    const bValue = bParts[i] ?? 0;
+    if (aValue < bValue) return -1;
+    if (aValue > bValue) return 1;
+  }
+  return 0;
+}
+function isNewerVersion(current, latest) {
+  return compareVersions(current, latest) === -1;
+}
+var REGISTRY_TIMEOUT_MS = 3e3;
+var VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+function isComparableVersion(value) {
+  return typeof value === "string" && VERSION_PATTERN.test(value);
+}
+async function fetchRegistryLatestVersion(timeout = REGISTRY_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => {
+    controller.abort();
+  }, timeout);
+  try {
+    const response = await fetch("https://registry.npmjs.org/safeword/latest", {
+      signal: controller.signal
+    });
+    if (!response.ok) return void 0;
+    const data = await response.json();
+    return isComparableVersion(data.version) ? data.version : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
+export {
+  compareVersions,
+  isNewerVersion,
+  isComparableVersion,
+  fetchRegistryLatestVersion
+};
+//# sourceMappingURL=chunk-LRYWFRPD.js.map

package/dist/chunk-LRYWFRPD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/version.ts"],"sourcesContent":["/**\n * Version comparison utilities\n */\n\n/**\n * Compare two semver versions\n * @param a\n * @param b\n * @returns -1 if a < b, 0 if a == b, 1 if a > b\n */\nexport function compareVersions(a: string, b: string): -1 | 0 | 1 {\n  const aParts = a.split('.').map(Number);\n  const bParts = b.split('.').map(Number);\n\n  for (let i = 0; i < 3; i++) {\n    const aValue = aParts[i] ?? 0;\n    const bValue = bParts[i] ?? 0;\n    if (aValue < bValue) return -1;\n    if (aValue > bValue) return 1;\n  }\n\n  return 0;\n}\n\n/**\n * Check if latest version is newer than current\n * @param current\n * @param latest\n */\nexport function isNewerVersion(current: string, latest: string): boolean {\n  return compareVersions(current, latest) === -1;\n}\n\nconst REGISTRY_TIMEOUT_MS = 3000;\nconst VERSION_PATTERN = /^\\d+\\.\\d+\\.\\d+$/;\n\n/**\n * Type guard for a comparable semver string (e.g. `\"1.2.3\"`). Use before\n * passing a registry- or cache-sourced value into {@link compareVersions},\n * which silently produces `NaN` comparisons on malformed input.\n * @param value\n */\nexport function isComparableVersion(value: unknown): value is string {\n  return typeof value === 'string' && VERSION_PATTERN.test(value);\n}\n\n/**\n * Fetch the latest published safeword version from the npm registry.\n * Returns undefined on network error, timeout, non-OK response, or an\n * unparseable/invalid version — callers treat undefined as \"unknown\".\n * @param timeout milliseconds before the request is aborted\n */\nexport async function fetchRegistryLatestVersion(\n  timeout = REGISTRY_TIMEOUT_MS,\n): Promise<string | undefined> {\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => {\n    controller.abort();\n  }, timeout);\n\n  try {\n    const response = await fetch('https://registry.npmjs.org/safeword/latest', {\n      signal: controller.signal,\n    });\n    if (!response.ok) return undefined;\n\n    const data = (await response.json()) as { version?: unknown };\n    return isComparableVersion(data.version) ? data.version : undefined;\n  } catch {\n    return undefined;\n  } finally {\n    clearTimeout(timeoutId);\n  }\n}\n"],"mappings":";AAUO,SAAS,gBAAgB,GAAW,GAAuB;AAChE,QAAM,SAAS,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AACtC,QAAM,SAAS,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AAEtC,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,SAAS,OAAO,CAAC,KAAK;AAC5B,UAAM,SAAS,OAAO,CAAC,KAAK;AAC5B,QAAI,SAAS,OAAQ,QAAO;AAC5B,QAAI,SAAS,OAAQ,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAOO,SAAS,eAAe,SAAiB,QAAyB;AACvE,SAAO,gBAAgB,SAAS,MAAM,MAAM;AAC9C;AAEA,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAQjB,SAAS,oBAAoB,OAAiC;AACnE,SAAO,OAAO,UAAU,YAAY,gBAAgB,KAAK,KAAK;AAChE;AAQA,eAAsB,2BACpB,UAAU,qBACmB;AAC7B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,YAAY,WAAW,MAAM;AACjC,eAAW,MAAM;AAAA,EACnB,GAAG,OAAO;AAEV,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,8CAA8C;AAAA,MACzE,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,oBAAoB,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,iBAAa,SAAS;AAAA,EACxB;AACF;","names":[]}

package/dist/{chunk-O3QF6QHX.js → chunk-Q7ALQS7T.js}

@@ -14,7 +14,7 @@ import {
   createProjectContext,
   getMissingPacks,
   reconcile
-} from "./chunk-HGOG5ZLC.js";
+} from "./chunk-UYTOLZT2.js";
 import {
   findDanglingDependencies,
   findTicketsInCycles,
@@ -723,4 +723,4 @@ export {
   checkHealth,
   reportHealthSummary
 };
-//# sourceMappingURL=chunk-O3QF6QHX.js.map
+//# sourceMappingURL=chunk-Q7ALQS7T.js.map

package/dist/{chunk-HGOG5ZLC.js → chunk-UYTOLZT2.js}

@@ -1038,21 +1038,25 @@ function executeTextPatch(cwd, path, definition) {
     throw new Error(`rerender text patch ${path} must use operation: 'append'`);
   }
   const fullPath = nodePath7.join(cwd, path);
-  let content = readFileSafe(fullPath) ?? "";
+  const original = readFileSafe(fullPath) ?? "";
+  const content = definition.supersedes === void 0 ? original : original.replace(definition.supersedes, "");
   if (content.includes(definition.marker)) {
-    if (definition.rerender && !content.includes(definition.content)) {
-      const stripped = stripRerenderBlock(content, definition);
-      writeFile(fullPath, stripped + definition.content);
-      return;
-    }
-    if (content.includes("\n\n---#")) {
-      const healed = content.replaceAll("\n\n---#", "\n\n---\n\n#");
-      writeFile(fullPath, healed);
-    }
+    healAlreadyPatchedFile(fullPath, original, content, definition);
     return;
   }
-  content = definition.operation === "prepend" ? definition.content + content : content + definition.content;
-  writeFile(fullPath, content);
+  const patched = definition.operation === "prepend" ? definition.content + content : content + definition.content;
+  writeFile(fullPath, patched);
+}
+function healAlreadyPatchedFile(fullPath, original, content, definition) {
+  if (definition.rerender && !content.includes(definition.content)) {
+    writeFile(fullPath, stripRerenderBlock(content, definition) + definition.content);
+    return;
+  }
+  let healed = content;
+  if (healed.includes("\n\n---#")) {
+    healed = healed.replaceAll("\n\n---#", "\n\n---\n\n#");
+  }
+  if (healed !== original) writeFile(fullPath, healed);
 }
 function computeUnpatchedContent(content, definition) {
   let unpatched = removeExactTextPatchContent(content, definition);
@@ -2149,9 +2153,12 @@ ${prettier.configEntry}
 `;
 }
 var CURSOR_HOOKS = {
-  // Observational: injects standing context. Fail-open — a failed inject must not
-  // block the session from starting.
-  sessionStart: [{ command: "bun ./.safeword/hooks/session-safeword-context.ts --agent=cursor" }],
+  // Observational: injects standing context and checks for auto-upgrades.
+  // Fail-open — neither hook may block the session from starting.
+  sessionStart: [
+    { command: "bun ./.safeword/hooks/session-safeword-context.ts --agent=cursor" },
+    { command: "bun ./.safeword/hooks/session-cursor-auto-upgrade.ts" }
+  ],
   // NOTE (F2TKR3): there is deliberately NO beforeSubmitPrompt gate. That hook
   // fires at prompt-send time, where Cursor exposes only the prompt text — no tool
   // name or file path — so it cannot tell "create test-definitions.md" from "write
@@ -2249,13 +2256,22 @@ var SETTINGS_HOOKS = {
       "Bash",
       "Bash(git commit*)",
       `bun ${HOOKS_DIR}/pre-tool-architecture-stage.ts`
-    )
+    ),
+    // Warn (never block) before a checkout/switch to a branch behind its upstream,
+    // so "catch up to main" doesn't silently serve stale content (#366). `if`
+    // scopes the spawn to checkout/switch; the hook re-parses the target.
+    matchedHookWithIf("Bash", "Bash(git checkout*)", `bun ${HOOKS_DIR}/pre-tool-stale-main.ts`),
+    matchedHookWithIf("Bash", "Bash(git switch*)", `bun ${HOOKS_DIR}/pre-tool-stale-main.ts`)
   ],
   PostToolUse: [
     matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/post-tool-lint.ts`),
     matchedHook(`${EDIT_TOOLS}|Bash`, `bun ${HOOKS_DIR}/post-tool-quality.ts`),
     matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/post-tool-bypass-warn.ts`),
-    matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/post-tool-sync-learnings.ts`)
+    matchedHook(EDIT_TOOLS, `bun ${HOOKS_DIR}/post-tool-sync-learnings.ts`),
+    // Stamp the dependency fingerprint after a successful install so the
+    // recommended recovery command clears the readiness block (#380). Fast-exits
+    // on non-install Bash commands.
+    matchedHook("Bash", `bun ${HOOKS_DIR}/post-tool-dependency-readiness.ts`)
   ],
   SessionEnd: [hook(`bun ${HOOKS_DIR}/session-cleanup-quality.ts`)]
 };
@@ -2644,11 +2660,13 @@ var CLAUDE_MD_IMPORT_BLOCK = `@./.safeword/SAFEWORD.md
 function isHookEntry(h) {
   return typeof h === "object" && h !== null && "hooks" in h && Array.isArray(h.hooks);
 }
+function isCursorHookEntry(h) {
+  return typeof h === "object" && h !== null && typeof h.command === "string";
+}
 function isSafewordHook(h) {
+  if (isCursorHookEntry(h)) return h.command.includes(".safeword");
   if (!isHookEntry(h)) return false;
-  return h.hooks.some(
-    (command) => typeof command.command === "string" && command.command.includes(".safeword")
-  );
+  return h.hooks.some((command) => command.command.includes(".safeword"));
 }
 function filterOutSafewordHooks(hooks) {
   return hooks.filter((h) => !isSafewordHook(h));
@@ -2687,6 +2705,16 @@ var CODEX_SESSION_START_HOOK_PATCH = `
 [[hooks.SessionStart]]
 matcher = ""
 
+[[hooks.SessionStart.hooks]]
+type = "command"
+command = 'bun "$(git rev-parse --show-toplevel)/.safeword/hooks/session-codex-start.ts"'
+timeout = 120
+statusMessage = "Checking safeword updates and loading standing instructions"
+`;
+var CODEX_LEGACY_CONTEXT_SESSION_START_HOOK_PATCH = `
+[[hooks.SessionStart]]
+matcher = ""
+
 [[hooks.SessionStart.hooks]]
 type = "command"
 command = 'bun "$(git rev-parse --show-toplevel)/.safeword/hooks/session-safeword-context.ts" --agent=codex'
@@ -2758,6 +2786,7 @@ var CODEX_SKILL_OWNED_FILES = Object.fromEntries(
 );
 var NAMESPACE_TRANSIENT_BASENAMES = [
   "quality-state*.json",
+  "cursor-run-identity.json",
   "failure-counts.json",
   "skill-invocations.log",
   "re-entry.md",
@@ -2970,7 +2999,14 @@ var SAFEWORD_SCHEMA = {
     },
     // Hooks shared library - TypeScript with Bun runtime
     ".safeword/hooks/lib/active-ticket.ts": { template: "hooks/lib/active-ticket.ts" },
+    ".safeword/hooks/lib/architecture-staged-scope.ts": {
+      template: "hooks/lib/architecture-staged-scope.ts"
+    },
+    ".safeword/hooks/lib/branch-staleness.ts": { template: "hooks/lib/branch-staleness.ts" },
     ".safeword/hooks/lib/blocked-on-gate.ts": { template: "hooks/lib/blocked-on-gate.ts" },
+    ".safeword/hooks/lib/cursor-run-identity.ts": {
+      template: "hooks/lib/cursor-run-identity.ts"
+    },
     ".safeword/hooks/lib/git-operation.ts": { template: "hooks/lib/git-operation.ts" },
     ".safeword/hooks/lib/re-entry.ts": { template: "hooks/lib/re-entry.ts" },
     ".safeword/hooks/lib/hierarchy.ts": { template: "hooks/lib/hierarchy.ts" },
@@ -2999,9 +3035,13 @@ var SAFEWORD_SCHEMA = {
     },
     ".safeword/hooks/lib/review-trigger.ts": { template: "hooks/lib/review-trigger.ts" },
     ".safeword/hooks/lib/dogfood.ts": { template: "hooks/lib/dogfood.ts" },
+    ".safeword/hooks/lib/ledger-git.ts": { template: "hooks/lib/ledger-git.ts" },
     ".safeword/hooks/lib/ledger-validation.ts": { template: "hooks/lib/ledger-validation.ts" },
     ".safeword/hooks/lib/scenario-format.ts": { template: "hooks/lib/scenario-format.ts" },
     ".safeword/hooks/lib/test-runner.ts": { template: "hooks/lib/test-runner.ts" },
+    ".safeword/hooks/lib/auto-upgrade.ts": { template: "hooks/lib/auto-upgrade.ts" },
+    ".safeword/hooks/lib/auto-upgrade-lock.ts": { template: "hooks/lib/auto-upgrade-lock.ts" },
+    ".safeword/hooks/lib/safeword-context.ts": { template: "hooks/lib/safeword-context.ts" },
     ".safeword/hooks/lib/update-cache.ts": { template: "hooks/lib/update-cache.ts" },
     ".safeword/hooks/lib/version.ts": { template: "hooks/lib/version.ts" },
     ".safeword/hooks/lib/learning-verification-stamps.ts": {
@@ -3017,6 +3057,12 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/session-safeword-context.ts": {
       template: "hooks/session-safeword-context.ts"
     },
+    ".safeword/hooks/session-codex-start.ts": {
+      template: "hooks/session-codex-start.ts"
+    },
+    ".safeword/hooks/session-cursor-auto-upgrade.ts": {
+      template: "hooks/session-cursor-auto-upgrade.ts"
+    },
     ".safeword/hooks/session-dependency-readiness.ts": {
       template: "hooks/session-dependency-readiness.ts"
     },
@@ -3056,6 +3102,9 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/pre-tool-architecture-stage.ts": {
       template: "hooks/pre-tool-architecture-stage.ts"
     },
+    ".safeword/hooks/pre-tool-stale-main.ts": {
+      template: "hooks/pre-tool-stale-main.ts"
+    },
     ".safeword/hooks/codex/pre-tool-quality.ts": {
       template: "hooks/codex/pre-tool-quality.ts"
     },
@@ -3071,6 +3120,9 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/pre-tool-dependency-readiness.ts": {
       template: "hooks/pre-tool-dependency-readiness.ts"
     },
+    ".safeword/hooks/post-tool-dependency-readiness.ts": {
+      template: "hooks/post-tool-dependency-readiness.ts"
+    },
     ".safeword/hooks/pre-tool-git-bare-fix.sh": {
       template: "hooks/pre-tool-git-bare-fix.sh"
     },
@@ -3113,12 +3165,18 @@ var SAFEWORD_SCHEMA = {
     ".safeword/guides/llm-writing-guide.md": {
       template: "guides/llm-writing-guide.md"
     },
+    ".safeword/guides/llm-evals-guide.md": {
+      template: "guides/llm-evals-guide.md"
+    },
     ".safeword/guides/planning-guide.md": {
       template: "guides/planning-guide.md"
     },
     ".safeword/guides/testing-guide.md": {
       template: "guides/testing-guide.md"
     },
+    ".safeword/guides/verification-lanes-guide.md": {
+      template: "guides/verification-lanes-guide.md"
+    },
     ".safeword/guides/zombie-process-cleanup.md": {
       template: "guides/zombie-process-cleanup.md"
     },
@@ -3419,23 +3477,25 @@ var SAFEWORD_SCHEMA = {
       ],
       removeFileIfEmpty: true,
       merge: (existing) => {
-        const hooks = existing.hooks ?? {};
+        const existingHooks = existing.hooks ?? {};
+        const hooks = { ...existingHooks };
+        for (const [event, newHooks] of Object.entries(CURSOR_HOOKS)) {
+          const eventHooks = hooks[event] ?? [];
+          const nonSafewordHooks = filterOutSafewordHooks(eventHooks);
+          hooks[event] = [...nonSafewordHooks, ...newHooks];
+        }
         return {
           ...existing,
           version: 1,
           // Required by Cursor
-          hooks: {
-            ...hooks,
-            ...CURSOR_HOOKS
-          }
+          hooks
         };
       },
       unmerge: (existing) => {
         const result = { ...existing };
         const existingHooks = existing.hooks ?? {};
-        const safewordHookNames = new Set(Object.keys(CURSOR_HOOKS));
         const hooks = Object.fromEntries(
-          Object.entries(existingHooks).filter(([name]) => !safewordHookNames.has(name))
+          Object.entries(existingHooks).map(([name, eventHooks]) => [name, filterOutSafewordHooks(eventHooks)]).filter(([, eventHooks]) => eventHooks.length > 0)
         );
         if (!assignOrPrune(result, "hooks", hooks)) {
           delete result.version;
@@ -3494,9 +3554,35 @@ ${managedPrettierPaths(ctx).join("\n")}
           "# Safeword Codex project configuration.",
           ".safeword/hooks/codex/pre-tool-quality.ts"
         ],
-        unpatchContent: [CODEX_SESSION_START_HOOK_PATCH, CODEX_PRE_TOOL_QUALITY_HOOK_PATCH],
+        unpatchContent: [
+          CODEX_SESSION_START_HOOK_PATCH,
+          CODEX_LEGACY_CONTEXT_SESSION_START_HOOK_PATCH,
+          CODEX_PRE_TOOL_QUALITY_HOOK_PATCH
+        ],
         removeFileIfContentEquals: [CODEX_CONFIG_SCAFFOLD_WITHOUT_HOOKS]
       },
+      // Migrate existing installs (auto-upgrade-codex follow-up to #433): swap the
+      // legacy context-only SessionStart hook for the auto-upgrade dispatcher.
+      // Codex runs same-event hooks concurrently with no ordering, so this must
+      // REPLACE the legacy hook (appending a second SessionStart hook would
+      // double-emit context) — hence `supersedes`. managedFiles is
+      // create-if-missing, so a fresh install gets the dispatcher from the
+      // template while every EXISTING config is skipped by managedFiles and
+      // migrated here. Idempotent: skips when the dispatcher marker is already
+      // present, and the strip no-ops when the legacy block is absent. Guarded to
+      // safeword scaffolds; a user-modified legacy block won't byte-match and is
+      // preserved. Uninstall cleanup is owned by the primary patch's
+      // unpatchContent above.
+      {
+        operation: "append",
+        content: CODEX_SESSION_START_HOOK_PATCH,
+        marker: ".safeword/hooks/session-codex-start.ts",
+        supersedes: CODEX_LEGACY_CONTEXT_SESSION_START_HOOK_PATCH,
+        applyWhenContentIncludes: [
+          "# Safeword Codex project configuration.",
+          ".safeword/hooks/codex/pre-tool-quality.ts"
+        ]
+      },
       // MCP-server retrofit (#269): add-if-missing parity with .mcp.json /
       // .cursor/mcp.json. Marker is the context7 table header, so an existing
       // (safeword- or user-authored) [mcp_servers.context7] suppresses the
@@ -3846,4 +3932,4 @@ export {
   untrackIgnoredFiles,
   createProjectContext
 };
-//# sourceMappingURL=chunk-HGOG5ZLC.js.map
+//# sourceMappingURL=chunk-UYTOLZT2.js.map