token-harness 0.1.16 → 0.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-harness",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Quota-aware efficiency layer for Claude Code and Codex subscription limits.",
   "license": "Apache-2.0",
   "type": "module",

package/sbom.json

@@ -1,14 +1,14 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:aeb90d5b-b157-a969-ef00-e4d3853a0ef7",
+  "serialNumber": "urn:uuid:acbec121-baa9-de33-8ab5-e5e88efbd50e",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "bom-ref": "token-harness",
       "name": "token-harness",
-      "version": "0.1.16",
+      "version": "0.1.17",
       "description": "Quota-aware efficiency layer for Claude Code and Codex subscription limits.",
       "licenses": [
         {
@@ -20,7 +20,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aeb90d5bb157a969ef00e4d3853a0ef75dbb909cbf43d2085d1bc50aeb184a82"
+          "content": "acbec121baa9de338ab5e5e88efbd50e5c4b3f0a1f2c6f7171f80dd05b12f312"
         }
       ]
     },

package/token-harness.mjs

@@ -6535,12 +6535,33 @@ var init_install = __esm({
           version3 === null ? packageName : `${packageName}==${version3}`
         ],
         verified: true
+      },
+      uv: {
+        executable: "uv",
+        // Headroom uses uv's isolated tool installer. Token Harness invokes an existing uv only;
+        // it never bootstraps uv, Python, or administrator prerequisites.
+        args: (packageName, version3) => [
+          "tool",
+          "install",
+          "--force",
+          version3 === null ? packageName : `${packageName}==${version3}`
+        ],
+        verified: true
       }
     };
     UNINSTALL_COMMANDS = {
+      npm: {
+        executable: "npm",
+        args: (packageName) => ["uninstall", "--global", packageName]
+      },
       pipx: {
         executable: "pipx",
         args: (packageName) => ["uninstall", packageName]
+      },
+      uv: {
+        executable: "uv",
+        // Extras are install-time selectors; uv tool uninstall expects the distribution name.
+        args: (packageName) => ["tool", "uninstall", packageName.replace(/\[.*\]$/, "")]
       }
     };
     QUERY_COMMANDS = {
@@ -6633,17 +6654,35 @@ var init_install = __esm({
       },
       npm: {
         executable: "npm",
-        args: (packageName) => ["ls", "-g", packageName, "--depth=0"],
+        // Listing the global root as JSON proves both presence and absence without depending on
+        // localized human output or npm's exit behavior for a package-name filter.
+        args: () => ["ls", "--global", "--depth=0", "--json"],
         parse: (stdout, packageName) => {
-          const pattern = new RegExp(`(?:^|[^@\\w.-])${packageName}@(\\d[^\\s]*)`);
-          const match = pattern.exec(stdout);
-          const candidate = match?.[1] ?? null;
-          if (candidate === null || parseSemanticVersion(candidate) === null) {
+          let parsed;
+          try {
+            parsed = JSON.parse(stdout);
+          } catch {
+            return { status: "unknown", version: null };
+          }
+          if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return { status: "unknown", version: null };
+          }
+          const dependencies = parsed["dependencies"];
+          if (dependencies === void 0)
+            return { status: "absent", version: null };
+          if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies)) {
+            return { status: "unknown", version: null };
+          }
+          const dependency = dependencies[packageName];
+          if (dependency === void 0)
+            return { status: "absent", version: null };
+          const candidate = typeof dependency === "string" ? dependency : typeof dependency === "object" && dependency !== null && !Array.isArray(dependency) ? dependency["version"] : null;
+          if (typeof candidate !== "string" || parseSemanticVersion(candidate) === null) {
             return { status: "unknown", version: null };
           }
           return { status: "captured", version: candidate };
         },
-        verified: false
+        verified: true
       },
       pnpm: {
         executable: "pnpm",
@@ -6698,16 +6737,20 @@ var init_install = __esm({
         executable: "uv",
         args: () => ["tool", "list"],
         parse: (stdout, packageName) => {
-          const pattern = new RegExp(`^${packageName}\\s+v?(\\S+)`, "m");
-          const match = pattern.exec(stdout);
-          if (match === null)
-            return { status: "absent", version: null };
-          const candidate = match[1] ?? "";
-          if (parseSemanticVersion(candidate) === null)
-            return { status: "unknown", version: null };
-          return { status: "captured", version: candidate };
+          const distribution = packageName.replace(/\[.*\]$/, "");
+          for (const line of stdout.split(/\r?\n/)) {
+            const fields = line.trim().split(/\s+/);
+            if (fields[0] !== distribution)
+              continue;
+            const candidate = (fields[1] ?? "").replace(/^v/i, "");
+            if (parseSemanticVersion(candidate) === null) {
+              return { status: "unknown", version: null };
+            }
+            return { status: "captured", version: candidate };
+          }
+          return { status: "absent", version: null };
         },
-        verified: false
+        verified: true
       },
       pipx: {
         executable: "pipx",
@@ -8892,7 +8935,7 @@ var init_snapshots = __esm({
        * calling a constructor directly.
        */
       static create(input) {
-        if (input.fs.isInside(input.backupRoot, input.projectRoot)) {
+        if (input.projectRoot !== null && input.fs.isInside(input.backupRoot, input.projectRoot)) {
           return {
             ok: false,
             diagnostics: [
@@ -9387,7 +9430,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.16";
+    TOOL_VERSION = "0.1.17";
   }
 });
 
@@ -11189,6 +11232,10 @@ var init_environment = __esm({
       "HOMEPATH",
       "LOCALAPPDATA",
       "NUMBER_OF_PROCESSORS",
+      // npm global installs must stay in the same prefix the parent process is using. This value is
+      // a filesystem location, not a credential; dropping it can update a different global npm tree
+      // while PATH continues to resolve the old executable.
+      "NPM_CONFIG_PREFIX",
       "PATH",
       "PATHEXT",
       "PROCESSOR_ARCHITECTURE",
@@ -11214,6 +11261,10 @@ var init_environment = __esm({
       "LC_ALL",
       "LC_CTYPE",
       "LOGNAME",
+      // npm documents config environment variables with the lowercase npm_config_ prefix on POSIX.
+      // Keep both common spellings because POSIX environment names are case-sensitive.
+      "NPM_CONFIG_PREFIX",
+      "npm_config_prefix",
       "PATH",
       "SHELL",
       "TMPDIR",
@@ -16778,6 +16829,25 @@ function skillArtifacts(context, harness, capabilities = null) {
     digest
   }));
 }
+function skillInstallContainmentBoundary(context, harness, capabilities, protectedPaths) {
+  const install = SKILLS_INSTALL[harness];
+  if (install === void 0)
+    return [...protectedPaths];
+  const prefix = `${install.directory}/skills/`;
+  const relativeArtifacts = capabilities === null ? [] : publishedSkillArtifactDigests(capabilities, harness).map(([path]) => path);
+  const fallbackArtifacts = Object.keys(SKILL_ARTIFACT_DIGESTS).map((path) => `${install.directory}/skills/${path}`);
+  const contract = relativeArtifacts.length > 0 ? relativeArtifacts : capabilities !== null && requiresRuntimeSkillDigests(capabilities) ? [] : fallbackArtifacts;
+  const skillRoots = /* @__PURE__ */ new Set();
+  for (const relative of contract) {
+    if (!relative.startsWith(prefix))
+      continue;
+    const first = relative.slice(prefix.length).split("/")[0];
+    if (first) {
+      skillRoots.add(context.fs.join(context.projectRoot, install.directory, "skills", first));
+    }
+  }
+  return [...skillRoots, ...protectedPaths];
+}
 async function harnessTrimSkillsConfigured(context, harness, capabilities) {
   const artifacts = skillArtifacts(context, harness, capabilities);
   if (artifacts.length === 0)
@@ -16866,6 +16936,11 @@ async function plan(context, request) {
     const expectedArtifacts = skillArtifacts(context, harness, currentCapabilities);
     if (expectedArtifacts.length === 0)
       continue;
+    const protectedPaths = [
+      context.fs.join(context.projectRoot, install.directory, install.hook),
+      context.fs.join(context.projectRoot, install.instructions)
+    ];
+    const containmentBoundary = skillInstallContainmentBoundary(context, harness, currentCapabilities, protectedPaths);
     actions.push({
       kind: "delegated-provider-install",
       id: `harnesstrim-${harness}-skills-${digestText(context.projectRoot).slice(7, 15)}`,
@@ -16886,13 +16961,10 @@ async function plan(context, request) {
       explanation: `Install HarnessTrim ${harness} skills without a hook or reduce-pipe instruction`,
       executable: "harnesstrim",
       args: ["install", harness, context.projectRoot, "--apply", ...install.args],
-      containmentBoundary: review.containmentBoundary.map((path) => context.fs.join(context.projectRoot, path)),
+      containmentBoundary,
       expectedArtifacts,
       // The two files each installer reports skipping. Named here because they must not appear.
-      protectedPaths: [
-        context.fs.join(context.projectRoot, install.directory, install.hook),
-        context.fs.join(context.projectRoot, install.instructions)
-      ],
+      protectedPaths,
       rollbackStrategy: "restore-snapshot",
       snapshotSizeCapBytes: 1048576,
       upstreamUninstallAvailable: review.upstreamUninstallAvailable
@@ -16917,7 +16989,7 @@ var init_harnesstrim = __esm({
     CODEX2 = harnessId("codex");
     PI2 = harnessId("pi");
     SKILLS_UPSTREAM = "0.0.7";
-    RUNTIME_SKILL_DIGESTS_MINIMUM = "0.3.0";
+    RUNTIME_SKILL_DIGESTS_MINIMUM = "0.2.0";
     SKILL_ARTIFACT_DIGESTS = {
       "compact-handoff/SKILL.md": "sha256:0efbf35581c559359e755b204778b64a289dab4d20dadc1cba3d5b5c995b5f01",
       "debug-log-slim/SKILL.md": "sha256:17f5ccc34d29d7aba083444e0e4d87fd3d49916ebcb4e6544caf8c89f13f0045",
@@ -18224,6 +18296,29 @@ function prerequisiteDiagnostic(harness, detail2) {
     remediation: `Install or update GitNexus to ${GITNEXUS_REVIEWED_MCP_VERSION} or newer with the MCP command, then refresh Token Harness`
   });
 }
+function gitnexusInstallAction() {
+  return {
+    kind: "package-manager-install",
+    id: `gitnexus:install:${GITNEXUS_REVIEWED_MCP_VERSION}`,
+    riskClass: "delegated",
+    requiresNetwork: true,
+    requiresElevation: false,
+    affectedPaths: [],
+    affectedProcesses: ["npm"],
+    preconditions: [
+      "npm remains runnable",
+      `the reviewed GitNexus ${GITNEXUS_REVIEWED_MCP_VERSION} package remains installable`
+    ],
+    postconditions: [
+      `GitNexus ${GITNEXUS_REVIEWED_MCP_VERSION} is installed and exposes the mcp command`
+    ],
+    rollbackData: "package-inventory",
+    explanation: `Install the reviewed GitNexus ${GITNEXUS_REVIEWED_MCP_VERSION} CLI through npm`,
+    packageManager: "npm",
+    packageName: "gitnexus",
+    version: GITNEXUS_REVIEWED_MCP_VERSION
+  };
+}
 async function planGitNexusManagedMcpActivation(context, harness) {
   if (harness !== "claude") {
     return {
@@ -18242,13 +18337,39 @@ async function planGitNexusManagedMcpActivation(context, harness) {
     };
   }
   const observation = await observeGitNexusManagedRuntime(context);
+  const installActions = [];
   if (!observation.ready) {
-    return {
-      harness,
-      target: null,
-      actions: [],
-      diagnostics: [prerequisiteDiagnostic(harness, observation.detail)]
-    };
+    if (!observation.absent) {
+      return {
+        harness,
+        target: null,
+        actions: [],
+        diagnostics: [prerequisiteDiagnostic(harness, observation.detail)]
+      };
+    }
+    const npm = await context.runner.run({
+      executable: "npm",
+      args: ["--version"],
+      cwd: context.projectRoot,
+      timeoutMs: 2e4
+    });
+    if (npm.failure !== null || npm.exitCode !== 0) {
+      return {
+        harness,
+        target: null,
+        actions: [],
+        diagnostics: [
+          diagnostic({
+            severity: "warning",
+            code: "gitnexus-npm-unavailable",
+            subject: harness,
+            message: "GitNexus is absent and npm is not available in this terminal",
+            remediation: "Make npm available on PATH, then refresh Token Harness. Token Harness will not bootstrap Node.js or administrator prerequisites."
+          })
+        ]
+      };
+    }
+    installActions.push(gitnexusInstallAction());
   }
   const target = claudeTarget(context);
   if (!context.fs.isInside(target, context.paths.home)) {
@@ -18366,7 +18487,7 @@ async function planGitNexusManagedMcpActivation(context, harness) {
     ],
     createIfMissing: true
   };
-  return { harness, target, actions: [action], diagnostics: [] };
+  return { harness, target, actions: [...installActions, action], diagnostics: [] };
 }
 function planGitNexusManagedMcpRemoval(context, ownership) {
   const harness = "claude";
@@ -19179,7 +19300,22 @@ async function mcptoonDetection(context) {
         configuredHarnesses.push(harness);
     }
   }
-  const warnings = !observation.absent && !observation.ready ? [warning("mcptoon-provider-capability-unavailable", "mcptoon", observation.detail)] : [];
+  const pipx = observation.absent ? await context.runner.run({
+    executable: "pipx",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  }) : null;
+  const canInstall = observation.absent && pipx !== null && pipx.failure === null && pipx.exitCode === 0;
+  const warnings = observation.absent && !canInstall ? [
+    diagnostic({
+      severity: "warning",
+      code: "mcptoon-pipx-unavailable",
+      subject: "mcptoon",
+      message: "mcptoon is not installed and pipx is not available in this terminal",
+      remediation: "Install pipx or make it available on PATH, then refresh. Token Harness will use it to install the reviewed mcptoon build."
+    })
+  ] : !observation.absent && !observation.ready ? [warning("mcptoon-provider-capability-unavailable", "mcptoon", observation.detail)] : [];
   return {
     providerId: MCPTOON,
     state: observation.absent ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
@@ -19191,7 +19327,7 @@ async function mcptoonDetection(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.ready ? [CLAUDE5, CODEX3] : [],
+    assignableHarnesses: observation.ready || canInstall ? [CLAUDE5, CODEX3] : [],
     evidence: [],
     warnings
   };
@@ -19200,7 +19336,22 @@ async function gitnexusDetection(context) {
   const observation = await observeGitNexusManagedRuntime(context);
   const verification = observation.ready ? await verifyGitNexusManagedMcpActivation(context, CLAUDE5) : null;
   const configuredHarnesses = verification?.state === "verified" ? [CLAUDE5] : [];
-  const warnings = !observation.absent && !observation.ready ? [warning("gitnexus-provider-capability-unavailable", "gitnexus", observation.detail)] : [];
+  const npm = observation.absent ? await context.runner.run({
+    executable: "npm",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  }) : null;
+  const canInstall = observation.absent && npm !== null && npm.failure === null && npm.exitCode === 0;
+  const warnings = observation.absent && !canInstall ? [
+    diagnostic({
+      severity: "warning",
+      code: "gitnexus-npm-unavailable",
+      subject: "gitnexus",
+      message: "GitNexus is not installed and npm is not available in this terminal",
+      remediation: "Make npm available on PATH, then refresh. Token Harness can install the reviewed GitNexus build after explicit approval."
+    })
+  ] : !observation.absent && !observation.ready ? [warning("gitnexus-provider-capability-unavailable", "gitnexus", observation.detail)] : [];
   return {
     providerId: GITNEXUS,
     state: observation.absent ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
@@ -19212,7 +19363,7 @@ async function gitnexusDetection(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.ready ? [CLAUDE5] : [],
+    assignableHarnesses: observation.ready || canInstall ? [CLAUDE5] : [],
     evidence: [],
     warnings
   };
@@ -19544,6 +19695,30 @@ async function headroomManagedMcpRuntime(context) {
     detail: `Headroom ${observation.version} exposes the local MCP server required by the managed integration`
   };
 }
+function headroomInstallAction() {
+  return {
+    kind: "package-manager-install",
+    id: `headroom:install:${HEADROOM_REVIEWED_MCP_VERSION}`,
+    riskClass: "delegated",
+    requiresNetwork: true,
+    requiresElevation: false,
+    affectedPaths: [],
+    affectedProcesses: ["uv"],
+    preconditions: [
+      "uv remains runnable",
+      `the reviewed Headroom ${HEADROOM_REVIEWED_MCP_VERSION} MCP package remains installable`
+    ],
+    postconditions: [
+      `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} is installed with the MCP extra`,
+      "headroom mcp serve --help succeeds"
+    ],
+    rollbackData: "package-inventory",
+    explanation: `Install reviewed Headroom ${HEADROOM_REVIEWED_MCP_VERSION} with its MCP extra through uv`,
+    packageManager: "uv",
+    packageName: "headroom-ai[mcp]",
+    version: HEADROOM_REVIEWED_MCP_VERSION
+  };
+}
 function prerequisite(harness, detail2) {
   return {
     harness,
@@ -19841,9 +20016,24 @@ async function planHeadroomManagedMcpActivation(context, harness) {
     };
   }
   const cli = await headroomManagedMcpRuntime(context);
-  if (!cli.ok)
-    return prerequisite(harness, cli.detail);
-  return harness === "claude" ? planClaude(context, harness) : planCodex(context, harness);
+  const installActions = [];
+  if (!cli.ok) {
+    const observation = await observeHeadroomCandidate(context);
+    if (observation.state !== "absent")
+      return prerequisite(harness, cli.detail);
+    const uv = await context.runner.run({
+      executable: "uv",
+      args: ["--version"],
+      cwd: context.projectRoot,
+      timeoutMs: 2e4
+    });
+    if (uv.failure !== null || uv.exitCode !== 0) {
+      return prerequisite(harness, "Headroom is absent and uv is not available in this terminal. Install uv or make it available on PATH; Token Harness will not bootstrap Python or uv itself.");
+    }
+    installActions.push(headroomInstallAction());
+  }
+  const activation = harness === "claude" ? await planClaude(context, harness) : await planCodex(context, harness);
+  return { ...activation, actions: [...installActions, ...activation.actions] };
 }
 function headroomOwnedArtifact(context, harness) {
   if (harness === "claude") {
@@ -19972,10 +20162,17 @@ async function detect8(context) {
         configuredHarnesses.push(harness);
     }
   }
+  const uv = observation.state === "absent" ? await context.runner.run({
+    executable: "uv",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  }) : null;
+  const canInstall = observation.state === "absent" && uv !== null && uv.failure === null && uv.exitCode === 0;
   const warnings = [];
-  if (observation.state === "absent")
+  if (observation.state === "absent" && !canInstall)
     warnings.push(manualInstallWarning());
-  else if (!runtime.ok) {
+  else if (!runtime.ok && observation.state !== "absent") {
     warnings.push(diagnostic({
       severity: "warning",
       code: "headroom-provider-capability-unavailable",
@@ -19998,7 +20195,7 @@ async function detect8(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: runtime.ok ? [CLAUDE7, CODEX4] : [],
+    assignableHarnesses: runtime.ok || canInstall ? [CLAUDE7, CODEX4] : [],
     evidence: [],
     warnings
   };
@@ -21449,6 +21646,33 @@ var init_candidate_campaign_surface = __esm({
   }
 });
 
+// apps/cli/dist/src/commands/snapshot-safety.js
+async function repositoryRootForBackupSafety(context) {
+  const adapters = context.adapters;
+  if (adapters === null)
+    return context.projectRoot;
+  const fs = adapters.fs;
+  let current = context.projectRoot;
+  while (true) {
+    for (const marker of [".git", ".hg", ".svn"]) {
+      if (await fs.stat(fs.join(current, marker)) !== null)
+        return current;
+    }
+    if (context.home !== null && fs.isInside(current, context.home) && fs.isInside(context.home, current)) {
+      return null;
+    }
+    const parent = fs.dirname(current);
+    if (parent === current)
+      return null;
+    current = parent;
+  }
+}
+var init_snapshot_safety = __esm({
+  "apps/cli/dist/src/commands/snapshot-safety.js"() {
+    "use strict";
+  }
+});
+
 // apps/cli/dist/src/commands/gitnexus-candidate-lifecycle.js
 function emptyReport(outcome2, requestedStateVerified = false) {
   return {
@@ -21510,7 +21734,7 @@ function selectorProblem(context, command) {
   }
   return null;
 }
-function stores(context, id) {
+async function stores(context, id) {
   if (context.adapters === null || context.stateRoot === null)
     return null;
   const fs = context.adapters.fs;
@@ -21518,7 +21742,7 @@ function stores(context, id) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: id,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!creation.ok)
@@ -21711,7 +21935,7 @@ async function runGitNexusCandidateApply(context) {
     return finish("apply", EXIT_CODES["confirmation-required"], emptyReport("confirmation-required"), diagnostics);
   }
   const id = transactionId("gitnexus-activate-claude", context);
-  const built = stores(context, id);
+  const built = await stores(context, id);
   if (built === null || !("snapshots" in built)) {
     diagnostics.push(...built?.failure ?? []);
     return finish("apply", EXIT_CODES["unsupported-environment"], emptyReport("rejected"), diagnostics);
@@ -21817,7 +22041,7 @@ async function runGitNexusCandidateUninstall(context) {
     return finish("uninstall", EXIT_CODES["confirmation-required"], emptyReport("confirmation-required"), diagnostics);
   }
   const id = transactionId("gitnexus-deactivate-claude", context);
-  const built = stores(context, id);
+  const built = await stores(context, id);
   if (built === null || !("snapshots" in built)) {
     diagnostics.push(...built?.failure ?? []);
     return finish("uninstall", EXIT_CODES["unsupported-environment"], emptyReport("rejected"), diagnostics);
@@ -21857,6 +22081,7 @@ var init_gitnexus_candidate_lifecycle = __esm({
     init_src3();
     init_src();
     init_candidate_campaign_surface();
+    init_snapshot_safety();
     ACTIVATION_ACTION_ID = "gitnexus:claude:mcp-server";
     REMOVAL_ACTION_ID = "gitnexus:claude:mcp-server:remove";
     REVIEWED_VALUE_DIGEST = jsonValueDigest(GITNEXUS_MCP_SERVER);
@@ -21934,7 +22159,7 @@ function selectorProblem2(context, command) {
   }
   return null;
 }
-function stores2(context, transactionId2) {
+async function stores2(context, transactionId2) {
   if (context.adapters === null || context.stateRoot === null)
     return null;
   const fs = context.adapters.fs;
@@ -21942,7 +22167,7 @@ function stores2(context, transactionId2) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: transactionId2,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!creation.ok)
@@ -22033,7 +22258,7 @@ async function runCandidateApply(context) {
     return finish2("apply", EXIT_CODES["confirmation-required"], emptyReport2("confirmation-required"), diagnostics);
   }
   const transactionId2 = candidateTransactionId(`mcptoon-activate-${harness}`, context);
-  const built = stores2(context, transactionId2);
+  const built = await stores2(context, transactionId2);
   if (built === null || !("snapshots" in built)) {
     diagnostics.push(...built?.failure ?? []);
     return finish2("apply", EXIT_CODES["unsupported-environment"], emptyReport2("rejected"), diagnostics);
@@ -22178,7 +22403,7 @@ async function runCandidateUninstall(context) {
     return finish2("uninstall", EXIT_CODES["confirmation-required"], emptyReport2("confirmation-required"), diagnostics);
   }
   const transactionId2 = candidateTransactionId(`mcptoon-deactivate-${harness}`, context);
-  const built = stores2(context, transactionId2);
+  const built = await stores2(context, transactionId2);
   if (built === null || !("snapshots" in built)) {
     diagnostics.push(...built?.failure ?? []);
     return finish2("uninstall", EXIT_CODES["unsupported-environment"], emptyReport2("rejected"), diagnostics);
@@ -22223,6 +22448,7 @@ var init_mcptoon_candidate_lifecycle = __esm({
     init_src3();
     init_src();
     init_candidate_campaign_surface();
+    init_snapshot_safety();
   }
 });
 
@@ -24539,6 +24765,73 @@ var init_plan2 = __esm({
 });
 
 // apps/cli/dist/src/commands/apply.js
+async function verifyManagedIntegrationPostconditions(context, integrations) {
+  if (integrations.length === 0)
+    return [];
+  if (context.adapters === null) {
+    return [
+      diagnostic({
+        severity: "error",
+        code: "managed-setup-postcondition-unavailable",
+        message: "The managed integration could not be re-observed because platform adapters are unavailable",
+        remediation: "Refresh the current setup before retrying"
+      })
+    ];
+  }
+  const detectionContext = {
+    fs: context.adapters.fs,
+    runner: context.adapters.runner,
+    facts: context.platform,
+    paths: context.adapters.paths,
+    projectRoot: context.projectRoot
+  };
+  const harnessConfigs = (await Promise.all(listHarnessAdapters().map(async (adapter) => (await adapter.inspect(detectionContext)).summaries))).flat();
+  const providerContext4 = {
+    ...detectionContext,
+    harnessConfigs,
+    now: context.now,
+    localDatabase: context.adapters.localDatabase,
+    projectIdFor: context.adapters.projectIdFor
+  };
+  const adapters = new Map(listProviderAdapters().map((adapter) => [adapter.manifest.id, adapter]));
+  const diagnostics = [];
+  for (const integration of integrations) {
+    const adapter = adapters.get(integration.providerId);
+    if (adapter === void 0) {
+      diagnostics.push(diagnostic({
+        severity: "error",
+        code: "managed-setup-postcondition-unavailable",
+        subject: integration.providerId,
+        message: `The provider adapter disappeared before ${integration.harnessId} setup could be verified`,
+        remediation: "Refresh Token Harness and review a new setup preview"
+      }));
+      continue;
+    }
+    try {
+      const detection = await adapter.detect(providerContext4);
+      if (!detection.configuredHarnesses.some((harness) => harness === integration.harnessId)) {
+        const runtimeProblem = detection.warnings.find((entry) => entry.severity === "error" || entry.severity === "warning");
+        diagnostics.push(diagnostic({
+          severity: "error",
+          code: "managed-setup-postcondition-unmet",
+          subject: integration.providerId,
+          message: `${adapter.manifest.displayName} setup did not become active for ${integration.harnessId} after the approved actions` + (runtimeProblem === void 0 ? "" : `: ${runtimeProblem.message}`),
+          path: detection.executable,
+          remediation: runtimeProblem?.remediation ?? "Check that the newly installed provider executable is on PATH, then review a fresh setup preview"
+        }));
+      }
+    } catch (error) {
+      diagnostics.push(diagnostic({
+        severity: "error",
+        code: "managed-setup-postcondition-unavailable",
+        subject: integration.providerId,
+        message: `The provider could not be re-observed after setup: ${error instanceof Error ? error.message : String(error)}`,
+        remediation: "Refresh and inspect the provider runtime before retrying"
+      }));
+    }
+  }
+  return diagnostics;
+}
 function transactionIdFor(planId, at) {
   const digest = digestText(`${planId} ${at}`);
   return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 13);
@@ -24758,7 +25051,7 @@ async function runApply(context) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: transactionId2,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!creation.ok) {
@@ -24788,7 +25081,8 @@ async function runApply(context) {
     journal,
     // RFC 0004 §Process policy: an installer reaches the machine through the runner or not at all.
     runner: context.adapters.runner,
-    now: context.now
+    now: context.now,
+    verifyPostconditions: async () => verifyManagedIntegrationPostconditions(context, computed.managedIntegrations)
   });
   diagnostics.push(...transaction.diagnostics);
   const report = {
@@ -24823,8 +25117,10 @@ var init_apply = __esm({
   "apps/cli/dist/src/commands/apply.js"() {
     "use strict";
     init_src();
+    init_src3();
     init_candidate_lifecycle();
     init_plan2();
+    init_snapshot_safety();
     PLANS_DIRECTORY = "plans";
   }
 });
@@ -27573,7 +27869,7 @@ function finish4(exitCode, command, data, diagnostics) {
     diagnostics
   });
 }
-function stores3(context, transactionId2) {
+async function stores3(context, transactionId2) {
   if (context.adapters === null || context.stateRoot === null)
     return null;
   const fs = context.adapters.fs;
@@ -27581,7 +27877,7 @@ function stores3(context, transactionId2) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: transactionId2,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!creation.ok)
@@ -27656,7 +27952,7 @@ async function runRollback(context) {
     }));
     return finish4(EXIT_CODES["confirmation-required"], "rollback", empty("confirmation-required"), diagnostics);
   }
-  const built = stores3(context, target.transactionId);
+  const built = await stores3(context, target.transactionId);
   if (built === null || built.store === void 0) {
     diagnostics.push(...built?.failure ?? []);
     return finish4(EXIT_CODES["unsupported-environment"], "rollback", empty("rejected"), diagnostics);
@@ -27784,7 +28080,7 @@ async function runUninstall(context) {
   }
   const fs = context.adapters.fs;
   const transactionId2 = `uninstall-${context.now().replace(/[^0-9]/g, "").slice(0, 14)}`;
-  const built = stores3(context, transactionId2);
+  const built = await stores3(context, transactionId2);
   if (built === null || built.store === void 0) {
     diagnostics.push(...built?.failure ?? []);
     return finish4(EXIT_CODES["unsupported-environment"], "uninstall", empty("rejected"), diagnostics);
@@ -27820,6 +28116,7 @@ var init_rollback = __esm({
     init_src();
     init_candidate_lifecycle();
     init_plan2();
+    init_snapshot_safety();
   }
 });
 
@@ -28430,6 +28727,8 @@ async function runPackageChannelUpdate(context, options = {}) {
     updateTargets.set(action.id, {
       providerId: adapter.manifest.id,
       target: query.version,
+      channel: channel.id,
+      packageName,
       adapter
     });
   }
@@ -28491,7 +28790,7 @@ async function runPackageChannelUpdate(context, options = {}) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: transactionId2,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!creation.ok) {
@@ -28526,13 +28825,27 @@ async function runPackageChannelUpdate(context, options = {}) {
         const expected = parseSemanticVersion(target.target);
         const exactTarget = observed !== null && expected !== null && compareVersions(observed, expected) === 0;
         if (!exactTarget) {
+          const inventory = await queryPackageInventory({
+            channel: target.channel,
+            packageName: target.packageName,
+            runner: adapters.runner,
+            cwd: context.projectRoot
+          });
+          const inventoryDetail = inventory.status === "captured" && inventory.version !== null ? ` The ${target.channel} global inventory reports ${inventory.version}.` : ` The ${target.channel} inventory could not confirm the installed target (status: ${inventory.status}).`;
+          const prefix = target.channel === "npm" ? await adapters.runner.run({
+            executable: "npm",
+            args: ["config", "get", "prefix"],
+            cwd: context.projectRoot,
+            timeoutMs: 2e4
+          }) : null;
+          const prefixDetail = prefix !== null && prefix.failure === null && prefix.exitCode === 0 ? ` npm prefix: ${prefix.stdout.trim() || "(empty)"}.` : "";
           postconditions.push(diagnostic({
             severity: "error",
             code: "provider-update-version-not-observed",
             subject: target.adapter.manifest.id,
-            message: `${target.providerId} update did not become active: requested ${target.target}, but the executable currently resolved on PATH reports ${detection.version ?? "no readable version"}`,
+            message: `${target.providerId} update did not become active: requested ${target.target}, but the executable currently resolved on PATH reports ${detection.version ?? "no readable version"}.` + inventoryDetail + prefixDetail,
             path: detection.executable,
-            remediation: "Review duplicate PATH installations. Token Harness will not report this update as successful while the old executable is still the one being resolved."
+            remediation: "Review duplicate PATH installations and the package-manager global prefix. Token Harness will not report this update as successful while the requested runtime is not the one being resolved."
           }));
           continue;
         }
@@ -28604,6 +28917,7 @@ var init_update_base = __esm({
     "use strict";
     init_src();
     init_src3();
+    init_snapshot_safety();
   }
 });
 
@@ -28864,7 +29178,7 @@ async function runUpdate(context) {
     fs,
     backupRoot: fs.join(context.stateRoot, "backups"),
     transactionId: transactionId2,
-    projectRoot: context.projectRoot,
+    projectRoot: await repositoryRootForBackupSafety(context),
     now: context.now
   });
   if (!snapshotCreation.ok) {
@@ -29147,6 +29461,7 @@ var init_update = __esm({
     "use strict";
     init_src();
     init_src2();
+    init_snapshot_safety();
     init_update_base();
     init_rtk_release_update();
   }
@@ -32299,11 +32614,20 @@ function guideSetupTarget(report, harness, provider) {
     };
   }
   if (detection.state === "absent" || detection.state === "available") {
+    if (detection.assignableHarnesses.includes(harnessDetection.harnessId)) {
+      return {
+        providerId: provider,
+        provider: label,
+        state: "actionable",
+        reason: `${label} is not installed yet, but Token Harness has a reviewed automatic install + ${name(harness)} setup path. The exact package and configuration changes are shown before approval.`
+      };
+    }
+    const prerequisite2 = detection.warnings.find((entry) => entry.severity === "warning" || entry.severity === "error");
     return {
       providerId: provider,
       provider: label,
       state: "unavailable",
-      reason: `${label} is not installed in a state Token Harness can configure automatically.`
+      reason: prerequisite2 === void 0 ? `${label} is not installed and no automatic installer prerequisite is available in this terminal.` : `${prerequisite2.message}${prerequisite2.remediation === null ? "" : ` ${prerequisite2.remediation}`}`
     };
   }
   if (detection.state === "broken") {
@@ -32315,11 +32639,12 @@ function guideSetupTarget(report, harness, provider) {
     };
   }
   if (!detection.assignableHarnesses.includes(harnessDetection.harnessId)) {
+    const capability = detection.warnings.find((entry) => entry.severity === "warning" || entry.severity === "error");
     return {
       providerId: provider,
       provider: label,
       state: "not-applicable",
-      reason: `The installed ${label} build does not expose an automatic ${name(harness)} setup surface.`
+      reason: capability === void 0 ? `The installed ${label} build does not expose an automatic ${name(harness)} setup surface.` : `${capability.message}${capability.remediation === null ? "" : ` ${capability.remediation}`}`
     };
   }
   return {
@@ -32364,7 +32689,7 @@ function stackFingerprint(report) {
 function createGuideCall(base) {
   return async (args) => {
     const savings = args[0] === "savings";
-    const updateCheck = args[0] === "update";
+    const updateCheck = args[0] === "update" && !args.includes("--yes");
     const translated = savings ? ["metrics", ...args.slice(1)] : [...args];
     let stdout = "";
     await run({
@@ -32575,7 +32900,7 @@ function describeChange(action, harness) {
     files: action.affectedPaths.length
   };
 }
-var GuideError, NAMES, name, GUIDE_MANAGED_PROVIDERS, RECOMMENDED_SETUP_PROVIDERS, TASKS, PERIODS, STACK_COMPONENTS, ISSUE_COPY, EFFORT_LABELS, SAFETY_RULES, TASK_RULES, READ_STAGES, GuideService;
+var GuideError, NAMES, name, sameGuideVersion, GUIDE_MANAGED_PROVIDERS, RECOMMENDED_SETUP_PROVIDERS, TASKS, PERIODS, STACK_COMPONENTS, ISSUE_COPY, EFFORT_LABELS, SAFETY_RULES, TASK_RULES, READ_STAGES, GuideService;
 var init_guided = __esm({
   "apps/cli/dist/src/guided.js"() {
     "use strict";
@@ -32603,6 +32928,7 @@ var init_guided = __esm({
       headroom: "Headroom"
     };
     name = (id) => NAMES[id] ?? id;
+    sameGuideVersion = (left, right) => left !== null && right !== null && left.replace(/^v/i, "").trim() === right.replace(/^v/i, "").trim();
     GUIDE_MANAGED_PROVIDERS = [
       "rtk",
       "harnesstrim",
@@ -32654,6 +32980,12 @@ var init_guided = __esm({
       "codex-native-policy-shadowed": "A project or profile overrides this Codex setting. That setting belongs to you and will not be replaced.",
       "no-providers-registered": "No optimization provider was selected for this operation.",
       "already-in-desired-state": "The supported integration is already configured. Nothing needs to be changed.",
+      "delegated-install-snapshot-too-large": "The optimizer setup found too much unrelated data inside its rollback boundary. Nothing was changed. Update Token Harness or use a narrower project directory before retrying.",
+      "delegated-install-failed": "The optimizer installer itself did not complete successfully. Nothing was kept from the failed transaction.",
+      "delegated-install-artifact-mismatch": "The optimizer installer completed but did not produce the artifact contract it advertised. The transaction was rolled back.",
+      "delegated-install-protected-path-changed": "The optimizer installer touched a file this setup promised to leave alone. The transaction was rolled back.",
+      "delegated-install-undeclared-write": "The optimizer installer changed a path outside the approved write set. The transaction was rolled back.",
+      "action-precondition-drift": "A file changed after the preview was created. Review a fresh preview before applying anything.",
       "managed-mutation-unsupported": "Automatic setup is unavailable because the installed provider does not expose the required managed surface. Existing integrations are left untouched.",
       "plan-ownership-drift": "The integration changed after the preview. Review a fresh plan; nothing was forced.",
       "plan-version-drift": "An installed version changed after the preview. Review a fresh plan.",
@@ -33210,49 +33542,137 @@ var init_guided = __esm({
             throw new GuideError(409, "This preview expired or was already used. Review a fresh preview.");
           this.approval = null;
           if (approval.operation === "update") {
-            this.record("Installing only the provider updates you approved.", "working");
-            let result6;
+            const approvedUpdates = approval.updateTargets ?? [];
+            if (approvedUpdates.length === 0)
+              throw new GuideError(409, "This update preview contains no concrete provider version. Review it again.");
+            this.record("Re-checking the exact provider versions you approved before installing them.", "working");
+            let fresh;
             try {
-              result6 = await this.call(["update", "--yes"]);
+              fresh = await this.call(["update"]);
             } catch {
               this.invalidateObservedState();
-              const message = "The update stopped before its final result could be read. No automatic retry was made. Refresh and inspect the installed optimizer versions before retrying.";
+              const message = "The update channels could not be re-checked immediately before installation. Nothing was changed. Review a fresh update preview.";
               this.record(message, "attention");
               return {
                 ok: false,
-                title: "Update result needs checking",
+                title: "Update preview changed",
                 messages: [message],
                 appliedPlans: 0
               };
             }
-            if (result6.exitCode !== 0 || result6.data === null) {
-              const message = explainGuideIssue(result6.diagnostics, "The optimizer update was not applied. The installed version, update channel or runtime capability state changed after the preview, so nothing was forced.");
+            if (fresh.exitCode !== 0 || fresh.data === null) {
+              const message = explainGuideIssue(fresh.diagnostics, "The update channels changed or could not be re-checked after approval. Nothing was changed; review a fresh update preview.");
+              this.invalidateObservedState();
+              this.record(message, "attention");
+              return {
+                ok: false,
+                title: "Update preview changed",
+                messages: [message],
+                appliedPlans: 0
+              };
+            }
+            const approvedByProvider = new Map(approvedUpdates.map((target) => [String(target.provider), target.version]));
+            const freshUpgradable = fresh.data.providers.filter((row2) => row2.verdict === "upgradable");
+            const unexpected = freshUpgradable.find((row2) => {
+              const approved = approvedByProvider.get(String(row2.providerId)) ?? null;
+              return approved === null || !sameGuideVersion(row2.available, approved);
+            });
+            const unresolved = approvedUpdates.find((target) => {
+              const row2 = fresh.data?.providers.find((candidate) => candidate.providerId === target.provider);
+              return !(row2 !== void 0 && (row2.verdict === "upgradable" && sameGuideVersion(row2.available, target.version) || row2.verdict === "current" && sameGuideVersion(row2.installed, target.version)));
+            });
+            if (unexpected !== void 0 || unresolved !== void 0) {
+              const changed = unexpected !== void 0 ? `${name(unexpected.providerId)} now offers ${unexpected.available ?? "a different version"}.` : `${name(unresolved.provider)} no longer reports the approved target ${unresolved.version}.`;
+              const message = changed + " Nothing was installed because the live update state no longer matches the preview. Review a fresh update preview.";
               this.invalidateObservedState();
               this.record(message, "attention");
               return {
                 ok: false,
-                title: "Optimizer update was not applied",
+                title: "Update preview changed",
                 messages: [message],
                 appliedPlans: 0
               };
             }
-            const applied = result6.data.execution?.results.filter((row2) => row2.status === "applied") ?? [];
+            const pending = approvedUpdates.filter((target) => {
+              const row2 = fresh.data?.providers.find((candidate) => candidate.providerId === target.provider);
+              return row2?.verdict === "upgradable";
+            });
+            let appliedCount = 0;
+            if (pending.length > 0) {
+              this.record("Installing the provider versions from the approved preview.", "working");
+              let result6;
+              try {
+                result6 = await this.call(["update", "--yes"]);
+              } catch {
+                this.invalidateObservedState();
+                const message = "The update stopped before its final result could be read. No automatic retry was made. Refresh and inspect the installed optimizer versions before retrying.";
+                this.record(message, "attention");
+                return {
+                  ok: false,
+                  title: "Update result needs checking",
+                  messages: [message],
+                  appliedPlans: 0
+                };
+              }
+              if (result6.exitCode !== 0 || result6.data === null) {
+                const message = explainGuideIssue(result6.diagnostics, "The optimizer update was not applied. The installed version, update channel or runtime capability state changed after the preview, so nothing was forced.");
+                this.invalidateObservedState();
+                this.record(message, "attention");
+                return {
+                  ok: false,
+                  title: "Optimizer update was not applied",
+                  messages: [message],
+                  appliedPlans: 0
+                };
+              }
+              appliedCount = result6.data.execution?.results.filter((row2) => row2.status === "applied").length ?? 0;
+            }
+            let inventory;
+            try {
+              inventory = await this.call(["doctor"]);
+            } catch {
+              this.invalidateObservedState();
+              const message = "The installer returned, but Token Harness could not re-read the active optimizer runtimes. The update is not being reported as successful. Refresh and inspect the installed versions.";
+              this.record(message, "attention");
+              return {
+                ok: false,
+                title: "Update result needs checking",
+                messages: [message],
+                appliedPlans: appliedCount
+              };
+            }
+            const missing = approvedUpdates.filter((target) => {
+              const detection = inventory.data?.providers.find((candidate) => candidate.providerId === target.provider);
+              return !sameGuideVersion(detection?.version ?? null, target.version);
+            });
+            if (inventory.data === null || missing.length > 0) {
+              const message = missing.length > 0 ? "The approved update target was not observed on the active PATH after installation: " + missing.map((target) => `${name(target.provider)} ${target.version}`).join(", ") + ". This is not being reported as a successful update." : "The active optimizer versions could not be verified after installation. This is not being reported as a successful update.";
+              this.invalidateObservedState();
+              this.record(message, "attention");
+              return {
+                ok: false,
+                title: "Update was not verified",
+                messages: [
+                  message,
+                  "Refresh after correcting PATH or the package installation; no automatic retry was made."
+                ],
+                appliedPlans: appliedCount
+              };
+            }
             this.lastApplied = null;
             this.invalidateObservedState();
-            const messages2 = applied.length > 0 ? [
-              "The optimizer update completed successfully and the active runtime was verified.",
-              "Token Harness re-ran the update transaction safety checks before changing software.",
-              "Choose Refresh to read the installed versions again. Reopen a coding agent if the updated optimizer requires it."
-            ] : [
-              "No optimizer needed an update by the time the approved action ran.",
-              "Nothing was forced. Choose Refresh to read the current versions."
+            const versions = approvedUpdates.map((target) => `${name(target.provider)} ${target.version}`).join(", ");
+            const messages2 = [
+              appliedCount > 0 ? `Installed and verified the approved optimizer version${approvedUpdates.length === 1 ? "" : "s"}: ${versions}.` : `The approved optimizer version${approvedUpdates.length === 1 ? " was" : "s were"} already active when the final check ran: ${versions}.`,
+              "The active runtime was re-read after the operation; success is shown only because it matches the approved target.",
+              "Reopen a coding agent if the updated optimizer requires it."
             ];
-            this.record(applied.length > 0 ? "Optimizer update installed and verified." : "Optimizer update no longer needed.", "success");
+            this.record(appliedCount > 0 ? "Optimizer update installed and verified." : "Approved optimizer version already active and verified.", "success");
             return {
               ok: true,
-              title: applied.length > 0 ? "Optimizer updated" : "Already up to date",
+              title: appliedCount > 0 ? "Optimizer updated" : "Approved version already active",
               messages: messages2,
-              appliedPlans: applied.length
+              appliedPlans: appliedCount
             };
           }
           if (approval.operation === "candidate-apply" || approval.operation === "candidate-uninstall") {
@@ -33451,6 +33871,7 @@ var init_guided = __esm({
           }
           this.updates = { fingerprint, report: updateResult.data };
           const available = updateResult.data.providers.filter((row2) => row2.verdict === "upgradable");
+          const updateTargets = available.flatMap((row2) => row2.available === null ? [] : [{ provider: row2.providerId, version: row2.available }]);
           const blocked = updateResult.data.providers.filter((row2) => row2.verdict === "blocked-unreviewed");
           const messages = [];
           if (available.length > 0) {
@@ -33462,7 +33883,9 @@ var init_guided = __esm({
           if (available.length === 0 && blocked.length === 0)
             messages.push("Your managed optimizers are up to date on their configured channels.");
           let ticket = null;
-          if (available.length > 0) {
+          if (available.length > 0 && updateTargets.length !== available.length) {
+            messages.push("An update channel reported an upgradable optimizer without a concrete target version. No install approval was created.");
+          } else if (updateTargets.length > 0) {
             ticket = this.random();
             const expires = this.now() + 10 * 6e4;
             this.approval = {
@@ -33473,7 +33896,8 @@ var init_guided = __esm({
               provider: null,
               description: "Optimizer updates",
               operation: "update",
-              network: updateResult.data.network.length > 0
+              network: updateResult.data.network.length > 0,
+              updateTargets
             };
             messages.push("Review the versions above, then choose Install updates. Token Harness will re-check the update channels and transaction safety rules before changing software.");
           } else {
@@ -33482,10 +33906,10 @@ var init_guided = __esm({
           const stack = this.stackSnapshot();
           if (this.cached !== null)
             this.cached.value = { ...this.cached.value, stack };
-          this.record(available.length > 0 ? "Optimizer update available. Waiting for your approval." : "Provider update check completed. No update is pending.", "success");
+          this.record(ticket !== null ? "Optimizer update available. Waiting for your approval." : available.length > 0 ? "Provider update check could not produce an exact install target." : "Provider update check completed. No update is pending.", "success");
           return {
             ok: true,
-            title: available.length > 0 ? "Updates available" : "Optimizers up to date",
+            title: ticket !== null ? "Updates available" : available.length > 0 ? "Update check needs attention" : "Optimizers up to date",
             messages,
             appliedPlans: 0,
             stack,
@@ -35942,16 +36366,21 @@ var init_guided_product_client = __esm({
   function componentState(id, component) {
     if (!component || component.detectedState === 'absent') return { label: 'Not installed', cls: '' };
     if (component.health === 'attention') return { label: 'Needs attention', cls: 'warn' };
-    if (component.configured)
+    const targets = activeAgents().map(agent => setupTarget(agent.id, id)).filter(Boolean);
+    const connectedHere = targets.some(target => target.state === 'connected');
+    const actionableHere = targets.some(target => target.state === 'actionable');
+    if (component.installed && actionableHere && connectedHere)
+      return { label: 'Partially connected · setup available', cls: 'warn' };
+    if (component.installed && actionableHere)
+      return { label: 'Installed · setup available', cls: 'warn' };
+    if (connectedHere)
       return {
         label: component.verification === 'verified' ? 'Connected · verified' : 'Connected',
         cls: 'good',
       };
-    const targets = activeAgents().map(agent => setupTarget(agent.id, id)).filter(Boolean);
-    if (component.installed && targets.some(target => target.state === 'actionable'))
-      return { label: 'Installed · setup available', cls: 'warn' };
     if (component.installed && targets.some(target => target.state === 'unavailable'))
       return { label: 'Installed · no automatic setup', cls: '' };
+    if (component.configured) return { label: 'Connected elsewhere', cls: '' };
     if (component.installed) return { label: 'Installed', cls: '' };
     return { label: 'Not installed', cls: '' };
   }
@@ -35978,15 +36407,25 @@ var init_guided_product_client = __esm({
     const actionableFor = providerTargets
       .filter(item => item.target.state === 'actionable')
       .map(item => item.agent.name);
-    const unavailableFor = providerTargets.filter(item => item.target.state === 'unavailable');
-    const configuredFor = component?.configuredHarnesses?.length
-      ? component.configuredHarnesses.map(agentName).join(', ')
-      : actionableFor.length
-        ? 'Setup available for ' + actionableFor.join(', ')
-        : unavailableFor.length
-          ? 'No compatible automatic setup surface detected'
-          : 'Not applicable to the detected coding agents';
-    facts.append(node('span', 'Connection'), node('strong', configuredFor));
+    const unavailableFor = providerTargets
+      .filter(item => item.target.state === 'unavailable')
+      .map(item => item.agent.name);
+    const notApplicableFor = providerTargets
+      .filter(item => item.target.state === 'not-applicable')
+      .map(item => item.agent.name);
+    const connectedFor = component?.configuredHarnesses?.length
+      ? component.configuredHarnesses.map(agentName)
+      : [];
+    if (connectedFor.length)
+      facts.append(node('span', 'Connected to'), node('strong', connectedFor.join(', ')));
+    if (actionableFor.length)
+      facts.append(node('span', 'Setup available'), node('strong', actionableFor.join(', ')));
+    if (unavailableFor.length)
+      facts.append(node('span', 'Automatic setup unavailable'), node('strong', unavailableFor.join(', ')));
+    if (notApplicableFor.length)
+      facts.append(node('span', 'Not applicable'), node('strong', notApplicableFor.join(', ')));
+    if (!connectedFor.length && !actionableFor.length && !unavailableFor.length && !notApplicableFor.length)
+      facts.append(node('span', 'Connection'), node('strong', 'No detected coding agent target'));
     if (component?.update === 'available')
       facts.append(
         node('span', 'Update'),
@@ -36005,7 +36444,8 @@ var init_guided_product_client = __esm({
       card.append(
         messageBox(
           'Why there is no Connect button',
-          unavailableFor[0].target.reason,
+          providerTargets.find(item => item.target.state === 'unavailable')?.target.reason ||
+            'The installed provider does not expose an automatic setup surface for this coding agent.',
         ),
       );