@cerefox/memory 1.17.3 → 1.18.0

package/dist/bin/cerefox.js

@@ -5318,7 +5318,7 @@ var init_cli_core = __esm(() => {
 });
 
 // src/meta.ts
-var PKG_VERSION = "1.17.3";
+var PKG_VERSION = "1.18.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -26229,10 +26229,6 @@ var init_bundled_docs = __esm(() => {
   PACKAGE_ROOT = findPackageRoot();
 });
 
-// ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.17.3", CEREFOX_VERSION = "1.17.3", EF_LAST_CHANGED = "1.17.3";
-var init_ef_meta = () => {};
-
 // ../../_shared/compatibility/index.ts
 function compareSemver(a, b) {
   const split = (v) => {
@@ -26366,6 +26362,425 @@ var init_compatibility = __esm(() => {
   };
 });
 
+// ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/conninfo.mjs
+var getConnInfo = (c) => {
+  const bindings = c.env.server ? c.env.server : c.env;
+  const address = bindings.incoming.socket.remoteAddress;
+  const port = bindings.incoming.socket.remotePort;
+  const family = bindings.incoming.socket.remoteFamily;
+  return { remote: {
+    address,
+    port,
+    addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : undefined
+  } };
+};
+var init_conninfo = () => {};
+
+// ../../_shared/mcp-auth/index.ts
+function constantTimeEqual(a, b) {
+  const ab = new TextEncoder().encode(a);
+  const bb = new TextEncoder().encode(b);
+  const len = Math.max(ab.length, bb.length);
+  let diff = ab.length ^ bb.length;
+  for (let i = 0;i < len; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// ../../_shared/ef-auth/index.ts
+function parseAccessTokens(raw) {
+  if (!raw)
+    return [];
+  return raw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+}
+function checkAccessToken(authorizationHeader, config) {
+  if (!authorizationHeader || !authorizationHeader.startsWith(BEARER_PREFIX)) {
+    return { ok: false, reason: "no_token" };
+  }
+  const token = authorizationHeader.slice(BEARER_PREFIX.length).trim();
+  if (!token)
+    return { ok: false, reason: "no_token" };
+  if (config.tokens.length === 0) {
+    return {
+      ok: false,
+      reason: "no_tokens_configured",
+      detail: "CEREFOX_ACCESS_TOKENS is unset/empty; refusing to accept-all"
+    };
+  }
+  let matched = false;
+  for (const accepted of config.tokens) {
+    if (constantTimeEqual(token, accepted))
+      matched = true;
+  }
+  return matched ? { ok: true } : { ok: false, reason: "bad_token" };
+}
+var BEARER_PREFIX = "Bearer ";
+var init_ef_auth = () => {};
+
+// src/web/auth.ts
+import { existsSync as existsSync9 } from "node:fs";
+function isContainerised() {
+  try {
+    return existsSync9("/.dockerenv");
+  } catch {
+    return false;
+  }
+}
+function containerGateWarning(env = process.env) {
+  const hasKey = (env.CEREFOX_API_KEY ?? "").trim() !== "";
+  const requireAll = (env.CEREFOX_API_REQUIRE_KEY ?? "") === "1";
+  if (!hasKey || requireAll || !isContainerised())
+    return null;
+  return `
+⚠  CEREFOX_API_KEY is set inside a container without CEREFOX_API_REQUIRE_KEY=1.
+` + `   Docker rewrites the source address of every published-port request, so the
+` + `   loopback exemption cannot match and EVERY caller will get a 401 — including
+` + `   the web UI. In a container the gate must be all-or-nothing:
+` + `     • publishing on 127.0.0.1 → leave CEREFOX_API_KEY unset (the bind is the boundary)
+` + `     • publishing wider        → also set CEREFOX_API_REQUIRE_KEY=1
+`;
+}
+function isLoopbackAddress(address) {
+  if (!address)
+    return false;
+  return LOOPBACK_ADDRESSES.has(address.trim().toLowerCase());
+}
+function decideAuth(input) {
+  const keys = input.configuredKeys.trim();
+  if (!keys)
+    return { allow: true, reason: "disabled" };
+  const local = isLoopbackAddress(input.remoteAddress);
+  if (local && !input.requireKeyEverywhere) {
+    return { allow: true, reason: "loopback" };
+  }
+  const result = checkAccessToken(input.authorization, {
+    tokens: parseAccessTokens(keys)
+  });
+  if (result.ok)
+    return { allow: true, reason: "valid_key" };
+  if (result.reason === "no_token") {
+    return {
+      allow: false,
+      reason: "no_key",
+      message: local ? "This server requires an API key on every request (CEREFOX_API_REQUIRE_KEY is set). " + "Send it as `Authorization: Bearer <key>`." : "This request did not come from the local machine, so it needs the server's API key " + "as `Authorization: Bearer <key>`. Print it with `cerefox api-key show` " + "(or `cerefox-local api-key` for a container install)."
+    };
+  }
+  return {
+    allow: false,
+    reason: "bad_key",
+    message: "The API key presented is not valid for this server."
+  };
+}
+function apiAuth() {
+  return async (c, next) => {
+    const decision = decideAuth({
+      remoteAddress: remoteAddressOf(c),
+      authorization: c.req.header("Authorization") ?? null,
+      configuredKeys: process.env.CEREFOX_API_KEY ?? "",
+      requireKeyEverywhere: (process.env.CEREFOX_API_REQUIRE_KEY ?? "") === "1"
+    });
+    if (decision.allow)
+      return next();
+    return c.json({ detail: decision.message }, 401, {
+      "WWW-Authenticate": 'Bearer realm="cerefox"'
+    });
+  };
+}
+function remoteAddressOf(c) {
+  try {
+    return getConnInfo(c).remote.address;
+  } catch {
+    return;
+  }
+}
+var API_KEY_PREFIX = "cfx_lak_", LOOPBACK_ADDRESSES;
+var init_auth = __esm(() => {
+  init_conninfo();
+  init_ef_auth();
+  LOOPBACK_ADDRESSES = new Set([
+    "127.0.0.1",
+    "::1",
+    "::ffff:127.0.0.1"
+  ]);
+});
+
+// src/web/daemon.ts
+import { spawn } from "node:child_process";
+import {
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync3,
+  openSync,
+  readFileSync as readFileSync8,
+  rmSync,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join8 } from "node:path";
+function resolveStateDir(override = process.env.CEREFOX_CONFIG_DIR, home = homedir5()) {
+  override = (override ?? "").trim();
+  if (!override)
+    return join8(home, ".cerefox");
+  return override === "~" || override.startsWith("~/") ? join8(home, override.slice(2)) : override;
+}
+function ensureStateDir() {
+  if (!existsSync10(STATE_DIR))
+    mkdirSync3(STATE_DIR, { recursive: true });
+}
+function readPidFile() {
+  if (!existsSync10(PID_FILE))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync8(PID_FILE, "utf8"));
+    if (typeof parsed.pid !== "number")
+      return null;
+    return {
+      pid: parsed.pid,
+      port: typeof parsed.port === "number" ? parsed.port : 8000,
+      host: typeof parsed.host === "string" ? parsed.host : "127.0.0.1",
+      startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : "unknown"
+    };
+  } catch {
+    return null;
+  }
+}
+function writePidFile(info) {
+  ensureStateDir();
+  writeFileSync4(PID_FILE, JSON.stringify(info, null, 2) + `
+`, "utf8");
+}
+function removePidFile() {
+  rmSync(PID_FILE, { force: true });
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function probeVersion(host, port, timeoutMs = 1500) {
+  const probeHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+  try {
+    const ctrl = new AbortController;
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+      const resp = await fetch(`http://${probeHost}:${port}/api/v1/version`, {
+        signal: ctrl.signal
+      });
+      if (!resp.ok)
+        return { responding: false, version: null };
+      const body = await resp.json().catch(() => null);
+      return {
+        responding: true,
+        version: typeof body?.version === "string" ? body.version : null
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return { responding: false, version: null };
+  }
+}
+async function isResponding(host, port, timeoutMs = 1500) {
+  return (await probeVersion(host, port, timeoutMs)).responding;
+}
+function assertUnix() {
+  if (process.platform === "win32") {
+    throw new Error("Daemon mode (`cerefox web start/stop/status`) is not supported on Windows yet. " + "Run `cerefox web` in the foreground, or set up a Windows service manually.");
+  }
+}
+async function startDaemon(opts) {
+  assertUnix();
+  ensureStateDir();
+  const existing = readPidFile();
+  if (existing && isProcessAlive(existing.pid)) {
+    return existing.port === opts.port ? { kind: "already-running", info: existing } : { kind: "port-conflict", info: existing };
+  }
+  if (existing)
+    removePidFile();
+  const logFd = openSync(LOG_FILE, "a");
+  const child = spawn(opts.runtime, [opts.scriptPath, "web", "--host", opts.host, "--port", String(opts.port)], { detached: true, stdio: ["ignore", logFd, logFd] });
+  child.unref();
+  if (typeof child.pid !== "number") {
+    throw new Error("Failed to spawn the web server process (no pid).");
+  }
+  writePidFile({
+    pid: child.pid,
+    port: opts.port,
+    host: opts.host,
+    startedAt: new Date().toISOString()
+  });
+  let responding = false;
+  for (let i = 0;i < 20; i++) {
+    if (!isProcessAlive(child.pid))
+      break;
+    if (await isResponding(opts.host, opts.port)) {
+      responding = true;
+      break;
+    }
+    await sleep2(250);
+  }
+  return { kind: "started", pid: child.pid, responding };
+}
+async function stopDaemon() {
+  assertUnix();
+  const info = readPidFile();
+  if (!info || !isProcessAlive(info.pid)) {
+    removePidFile();
+    return { kind: "not-running" };
+  }
+  try {
+    process.kill(info.pid, "SIGTERM");
+  } catch {}
+  let forced = false;
+  let alive = true;
+  for (let i = 0;i < 12; i++) {
+    await sleep2(250);
+    if (!isProcessAlive(info.pid)) {
+      alive = false;
+      break;
+    }
+  }
+  if (alive) {
+    try {
+      process.kill(info.pid, "SIGKILL");
+      forced = true;
+    } catch {}
+  }
+  removePidFile();
+  return { kind: "stopped", pid: info.pid, forced };
+}
+function restartCommand(host, port) {
+  const flags = `${host === "127.0.0.1" ? "" : ` --host ${host}`}${port === 8000 ? "" : ` --port ${port}`}`;
+  return `cerefox web stop && cerefox web start${flags}`;
+}
+async function statusDaemon() {
+  const info = readPidFile();
+  if (!info)
+    return { kind: "stopped" };
+  if (!isProcessAlive(info.pid))
+    return { kind: "stale", info };
+  const { responding, version } = await probeVersion(info.host, info.port);
+  return { kind: "running", info, responding, version };
+}
+var STATE_DIR, PID_FILE, LOG_FILE, daemonPaths, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+var init_daemon = __esm(() => {
+  STATE_DIR = resolveStateDir();
+  PID_FILE = join8(STATE_DIR, "web.pid");
+  LOG_FILE = join8(STATE_DIR, "web.log");
+  daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
+});
+
+// src/update-check.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, join as join9 } from "node:path";
+function updateCheckDisabled(env = process.env) {
+  const on = (v) => {
+    const t = (v ?? "").trim().toLowerCase();
+    return t !== "" && t !== "0" && t !== "false";
+  };
+  return on(env.CEREFOX_NO_UPDATE_CHECK) || on(env.NO_UPDATE_NOTIFIER) || on(env.CI);
+}
+function cachePath() {
+  return join9(resolveStateDir(), "update-check.json");
+}
+function readCache(path = cachePath()) {
+  try {
+    const parsed = JSON.parse(readFileSync9(path, "utf8"));
+    if (typeof parsed.latest !== "string" || typeof parsed.checkedAt !== "string")
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeCache(cache, path = cachePath()) {
+  try {
+    mkdirSync4(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(cache, null, 2) + `
+`);
+  } catch {}
+}
+async function fetchLatestVersion({ timeoutMs = 3000, fetchImpl = fetch } = {}) {
+  const resp = await fetchImpl(LATEST_URL, { signal: AbortSignal.timeout(timeoutMs) });
+  if (!resp.ok)
+    throw new Error(`npm registry answered ${resp.status} ${resp.statusText}`);
+  const body = await resp.json();
+  if (typeof body.version !== "string" || body.version === "") {
+    throw new Error("npm registry response has no version field");
+  }
+  return body.version;
+}
+function recordLatest(latest, path = cachePath(), now = new Date) {
+  const prev = readCache(path);
+  writeCache({ ...prev, latest, checkedAt: now.toISOString() }, path);
+}
+async function refreshLatest(opts = {}) {
+  if (updateCheckDisabled(opts.env))
+    return null;
+  const path = opts.path ?? cachePath();
+  const now = opts.now ?? new Date;
+  const cached = readCache(path);
+  const age = cached ? now.getTime() - Date.parse(cached.checkedAt) : Infinity;
+  if (cached && !opts.force && age >= 0 && age < CACHE_TTL_MS)
+    return cached.latest;
+  try {
+    const latest = await fetchLatestVersion({ fetchImpl: opts.fetchImpl });
+    recordLatest(latest, path, now);
+    return latest;
+  } catch {
+    return cached?.latest ?? null;
+  }
+}
+function startPeriodicRefresh() {
+  if (updateCheckDisabled())
+    return;
+  refreshLatest();
+  const timer = setInterval(() => void refreshLatest(), CACHE_TTL_MS);
+  timer.unref?.();
+}
+function newerRelease(latest, installed = PKG_VERSION) {
+  if (!latest)
+    return null;
+  return compareSemver(latest, installed) > 0 ? latest : null;
+}
+function upgradeCommand() {
+  return isContainerised() ? "cerefox-local upgrade" : "cerefox self-update";
+}
+function takeCliNotice(opts = {}) {
+  if (updateCheckDisabled(opts.env))
+    return null;
+  const path = opts.path ?? cachePath();
+  const now = opts.now ?? new Date;
+  const cached = readCache(path);
+  const newer = newerRelease(cached?.latest, opts.installed);
+  if (!cached || !newer)
+    return null;
+  if (cached.notifiedAt) {
+    const since = now.getTime() - Date.parse(cached.notifiedAt);
+    if (since >= 0 && since < NOTIFY_INTERVAL_MS)
+      return null;
+  }
+  writeCache({ ...cached, notifiedAt: now.toISOString() }, path);
+  return `Cerefox ${newer} is available (you have ${opts.installed ?? PKG_VERSION}). Run \`${upgradeCommand()}\`.`;
+}
+var LATEST_URL = "https://registry.npmjs.org/@cerefox%2Fmemory/latest", DAY_MS, CACHE_TTL_MS, NOTIFY_INTERVAL_MS, releaseNotesUrl = (version) => `https://github.com/fstamatelopoulos/cerefox/releases/tag/v${version}`;
+var init_update_check = __esm(() => {
+  init_compatibility();
+  init_meta();
+  init_auth();
+  init_daemon();
+  DAY_MS = 24 * 60 * 60 * 1000;
+  CACHE_TTL_MS = DAY_MS;
+  NOTIFY_INTERVAL_MS = DAY_MS;
+});
+
+// ../../_shared/ef-meta/index.ts
+var EF_VERSION = "1.18.0", CEREFOX_VERSION = "1.18.0", EF_LAST_CHANGED = "1.17.3";
+var init_ef_meta = () => {};
+
 // ../../_shared/embeddings/onnx-embedder.ts
 var exports_onnx_embedder = {};
 __export(exports_onnx_embedder, {
@@ -26382,9 +26797,9 @@ __export(exports_onnx_embedder, {
   onnxEmbed: () => onnxEmbed,
   warmup: () => warmup
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, renameSync, statSync as statSync2, writeFileSync as writeFileSync5, appendFileSync } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, renameSync, statSync as statSync2, writeFileSync as writeFileSync6, appendFileSync } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname5, join as join10 } from "node:path";
 function nomicPrefix(role) {
   return role === "query" ? "search_query: " : "search_document: ";
 }
@@ -26421,17 +26836,17 @@ async function downloadModelFiles(remoteHost, onProgress, onDone, opts = {}) {
   const dir = getCacheDir();
   const base = remoteHost.endsWith("/") ? remoteHost : `${remoteHost}/`;
   for (const rel of MODEL_REPO_FILES) {
-    const dest = join9(dir, ONNX_MODEL_ID, rel);
-    if (existsSync10(dest))
+    const dest = join10(dir, ONNX_MODEL_ID, rel);
+    if (existsSync11(dest))
       continue;
-    mkdirSync4(dirname4(dest), { recursive: true });
+    mkdirSync5(dirname5(dest), { recursive: true });
     const part = `${dest}.part`;
     const url = `${base}${ONNX_MODEL_ID}/resolve/main/${rel}`;
     let failures = 0;
     let lastError = "";
     let total = 0;
     for (;; ) {
-      const have = existsSync10(part) ? statSync2(part).size : 0;
+      const have = existsSync11(part) ? statSync2(part).size : 0;
       if (total > 0 && have >= total)
         break;
       try {
@@ -26445,12 +26860,12 @@ async function downloadModelFiles(remoteHost, onProgress, onDone, opts = {}) {
           if (declared > 0 && bytes.byteLength !== declared) {
             throw new Error(`got ${bytes.byteLength} bytes, expected ${declared}`);
           }
-          writeFileSync5(part, bytes);
+          writeFileSync6(part, bytes);
           total = bytes.byteLength;
         } else {
           total = got.total;
           if (have > total) {
-            writeFileSync5(part, new Uint8Array(0));
+            writeFileSync6(part, new Uint8Array(0));
             continue;
           }
           appendFileSync(part, got.bytes);
@@ -26473,13 +26888,13 @@ async function downloadModelFiles(remoteHost, onProgress, onDone, opts = {}) {
   }
 }
 function isModelCached(dir = getCacheDir()) {
-  return MODEL_FILES.every((f) => existsSync10(join9(dir, f)));
+  return MODEL_FILES.every((f) => existsSync11(join10(dir, f)));
 }
 function getCacheDir() {
   const env = globalThis.process?.env ?? {};
   if (env.CEREFOX_MODELS_DIR)
     return env.CEREFOX_MODELS_DIR;
-  return join9(homedir6(), ".cerefox", "models");
+  return join10(homedir6(), ".cerefox", "models");
 }
 async function loadTransformers() {
   if (transformersModule)
@@ -26488,8 +26903,8 @@ async function loadTransformers() {
   process.env.ORT_DISABLE_TELEMETRY ??= "1";
   transformersModule = await import(spec);
   const dir = getCacheDir();
-  if (!existsSync10(dir))
-    mkdirSync4(dir, { recursive: true });
+  if (!existsSync11(dir))
+    mkdirSync5(dir, { recursive: true });
   transformersModule.env.cacheDir = dir;
   transformersModule.env.allowLocalModels = true;
   transformersModule.env.allowRemoteModels = true;
@@ -26654,7 +27069,7 @@ var init_onnx_embedder = __esm(() => {
     "tokenizer_config.json",
     `onnx/model_quantized.onnx`
   ];
-  MODEL_FILES = MODEL_REPO_FILES.map((f) => join9(ONNX_MODEL_ID, f));
+  MODEL_FILES = MODEL_REPO_FILES.map((f) => join10(ONNX_MODEL_ID, f));
   EmbedderDownloadError = class EmbedderDownloadError extends Error {
     status = 503;
     constructor(detail) {
@@ -50797,7 +51212,7 @@ function resetFeatureFlagCache() {
 }
 async function readBoolFlag(supabase, key) {
   const hit = cache.get(key);
-  if (hit && Date.now() - hit.at < CACHE_TTL_MS)
+  if (hit && Date.now() - hit.at < CACHE_TTL_MS2)
     return hit.value;
   try {
     const { data, error } = await supabase.rpc("cerefox_get_config", { p_key: key });
@@ -50819,7 +51234,7 @@ async function reviewWorkflowEnabled(supabase) {
 function disabledToolMessage(name) {
   return `${name} is part of the document-relations feature, which is off by default. ` + `Enable it with: cerefox config set relations_enabled true ` + `(deployment-wide; every access path picks it up).`;
 }
-var RELATION_TOOL_NAMES, CACHE_TTL_MS = 15000, cache;
+var RELATION_TOOL_NAMES, CACHE_TTL_MS2 = 15000, cache;
 var init_feature_flags = __esm(() => {
   RELATION_TOOL_NAMES = new Set([
     "cerefox_set_relation",
@@ -53584,7 +53999,7 @@ var require_cli_progress = __commonJS(function(exports, module) {
 });
 
 // src/cli/commands/sync-self-docs.ts
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { basename as basename4, extname as extname5 } from "node:path";
 async function runSyncSelfDocs(options = {}) {
   const project = options.project ?? "_cerefox-self-docs";
@@ -53611,7 +54026,7 @@ async function runSyncSelfDocs(options = {}) {
   const authorType = resolveAuthorType("agent");
   const outcomes = [];
   for (const doc of docs) {
-    const content = readFileSync13(doc.path, "utf8");
+    const content = readFileSync14(doc.path, "utf8");
     const m = content.match(/^#\s+(.+)$/m);
     const title = m ? m[1].trim() : basename4(doc.path, extname5(doc.path));
     try {
@@ -53694,7 +54109,7 @@ var init_v4_mini = __esm(() => {
   init_external2();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -53770,7 +54185,7 @@ var init_v4 = __esm(() => {
   init_classic();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25", SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task", JSONRPC_VERSION = "2.0", AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success, JSONRPCNotificationSchema, isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success, JSONRPCResultResponseSchema, isJSONRPCResultResponse = (value) => JSONRPCResultResponseSchema.safeParse(value).success, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse = (value) => JSONRPCErrorResponseSchema.safeParse(value).success, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError;
 var init_types3 = __esm(() => {
   init_v4();
@@ -54598,7 +55013,7 @@ var init_types3 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -54816,7 +55231,7 @@ var init_esm = __esm(() => {
   init_zodToJsonSchema();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function getMethodLiteral(schema) {
   const shape = getObjectShape(schema);
   const methodSchema = shape?.method;
@@ -54841,7 +55256,7 @@ var init_zod_json_schema_compat = __esm(() => {
   init_esm();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 class Protocol {
   constructor(_options) {
     this._options = _options;
@@ -54877,6 +55292,9 @@ class Protocol {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -54907,12 +55325,12 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -54949,7 +55367,7 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -55072,6 +55490,19 @@ class Protocol {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== undefined) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === undefined) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -55081,7 +55512,10 @@ class Protocol {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error) => this._onerror(new Error(`Failed to send an error response: ${error}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -55132,7 +55566,10 @@ class Protocol {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -55167,7 +55604,7 @@ class Protocol {
           ...error["data"] !== undefined && { data: error["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -55555,7 +55992,7 @@ class Protocol {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   async _clearTaskQueue(taskId, sessionId) {
     if (this._taskMessageQueue) {
@@ -55574,10 +56011,10 @@ class Protocol {
       }
     }
   }
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1000;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -62573,7 +63010,7 @@ var require_dist3 = __commonJS(function(exports, module) {
   exports.default = formatsPlugin;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 function createDefaultAjvInstance() {
   const ajv = new import_ajv.default({
     strict: false,
@@ -62616,7 +63053,7 @@ var init_ajv_provider = __esm(() => {
   import_ajv_formats = __toESM(require_dist3(), 1);
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -62697,7 +63134,7 @@ var init_server = __esm(() => {
   init_types3();
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -62732,7 +63169,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server;
 var init_server2 = __esm(() => {
   init_protocol();
@@ -63064,7 +63501,7 @@ var init_server2 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 class ReadBuffer {
   constructor(options) {
     this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
@@ -63107,7 +63544,7 @@ var init_stdio = __esm(() => {
   STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
-// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.30.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.bun/@modelcontextprotocol+sdk@1.32.1/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process10 from "node:process";
 
 class StdioServerTransport {
@@ -63185,6 +63622,7 @@ function buildServer() {
     auth: { persistSession: false, autoRefreshToken: false }
   });
   warnIfSchemaVersionMismatch(supabase);
+  Promise.resolve().then(() => (init_update_check(), {})).then((m) => refreshLatest()).catch(() => {});
   const ctx = {
     accessPath: "local-mcp",
     openaiApiKey: settings.openaiApiKey || undefined
@@ -63230,7 +63668,7 @@ async function warnIfSchemaVersionMismatch(supabase) {
     if (!bundled)
       return;
     if (compareSemver(deployed, bundled) < 0) {
-      process.stderr.write(`[cerefox-mcp] ⚠  schema version mismatch: this client bundles v${bundled} ` + `but the deployed schema is v${deployed}. Run \`cerefox server deploy\` ` + `to update it. Tools may behave unexpectedly until then.
+      process.stderr.write(`[cerefox-mcp] ⚠  schema version mismatch: this client bundles v${bundled} but the deployed schema is v${deployed}. Run \`cerefox server deploy\` to update it. Tools may behave unexpectedly until then.
 `);
     }
   } catch {}
@@ -71859,182 +72297,16 @@ init_cli_core();
 
 // src/cli/util/checks.ts
 init_meta();
+init_update_check();
 init_ef_meta();
 init_config();
 init_config();
 init_compatibility();
 init_server_assets();
-import { existsSync as existsSync11, readFileSync as readFileSync9, realpathSync, statSync as statSync3 } from "node:fs";
+init_daemon();
+import { existsSync as existsSync12, readFileSync as readFileSync10, realpathSync, statSync as statSync3 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join10 } from "node:path";
-
-// src/web/daemon.ts
-import { spawn } from "node:child_process";
-import {
-  existsSync as existsSync9,
-  mkdirSync as mkdirSync3,
-  openSync,
-  readFileSync as readFileSync8,
-  rmSync,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { join as join8 } from "node:path";
-function resolveStateDir(override = process.env.CEREFOX_CONFIG_DIR, home = homedir5()) {
-  override = (override ?? "").trim();
-  if (!override)
-    return join8(home, ".cerefox");
-  return override === "~" || override.startsWith("~/") ? join8(home, override.slice(2)) : override;
-}
-var STATE_DIR = resolveStateDir();
-var PID_FILE = join8(STATE_DIR, "web.pid");
-var LOG_FILE = join8(STATE_DIR, "web.log");
-var daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
-function ensureStateDir() {
-  if (!existsSync9(STATE_DIR))
-    mkdirSync3(STATE_DIR, { recursive: true });
-}
-function readPidFile() {
-  if (!existsSync9(PID_FILE))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync8(PID_FILE, "utf8"));
-    if (typeof parsed.pid !== "number")
-      return null;
-    return {
-      pid: parsed.pid,
-      port: typeof parsed.port === "number" ? parsed.port : 8000,
-      host: typeof parsed.host === "string" ? parsed.host : "127.0.0.1",
-      startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : "unknown"
-    };
-  } catch {
-    return null;
-  }
-}
-function writePidFile(info) {
-  ensureStateDir();
-  writeFileSync4(PID_FILE, JSON.stringify(info, null, 2) + `
-`, "utf8");
-}
-function removePidFile() {
-  rmSync(PID_FILE, { force: true });
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-async function probeVersion(host, port, timeoutMs = 1500) {
-  const probeHost = host === "0.0.0.0" ? "127.0.0.1" : host;
-  try {
-    const ctrl = new AbortController;
-    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
-    try {
-      const resp = await fetch(`http://${probeHost}:${port}/api/v1/version`, {
-        signal: ctrl.signal
-      });
-      if (!resp.ok)
-        return { responding: false, version: null };
-      const body = await resp.json().catch(() => null);
-      return {
-        responding: true,
-        version: typeof body?.version === "string" ? body.version : null
-      };
-    } finally {
-      clearTimeout(timer);
-    }
-  } catch {
-    return { responding: false, version: null };
-  }
-}
-async function isResponding(host, port, timeoutMs = 1500) {
-  return (await probeVersion(host, port, timeoutMs)).responding;
-}
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
-function assertUnix() {
-  if (process.platform === "win32") {
-    throw new Error("Daemon mode (`cerefox web start/stop/status`) is not supported on Windows yet. " + "Run `cerefox web` in the foreground, or set up a Windows service manually.");
-  }
-}
-async function startDaemon(opts) {
-  assertUnix();
-  ensureStateDir();
-  const existing = readPidFile();
-  if (existing && isProcessAlive(existing.pid)) {
-    return existing.port === opts.port ? { kind: "already-running", info: existing } : { kind: "port-conflict", info: existing };
-  }
-  if (existing)
-    removePidFile();
-  const logFd = openSync(LOG_FILE, "a");
-  const child = spawn(opts.runtime, [opts.scriptPath, "web", "--host", opts.host, "--port", String(opts.port)], { detached: true, stdio: ["ignore", logFd, logFd] });
-  child.unref();
-  if (typeof child.pid !== "number") {
-    throw new Error("Failed to spawn the web server process (no pid).");
-  }
-  writePidFile({
-    pid: child.pid,
-    port: opts.port,
-    host: opts.host,
-    startedAt: new Date().toISOString()
-  });
-  let responding = false;
-  for (let i = 0;i < 20; i++) {
-    if (!isProcessAlive(child.pid))
-      break;
-    if (await isResponding(opts.host, opts.port)) {
-      responding = true;
-      break;
-    }
-    await sleep2(250);
-  }
-  return { kind: "started", pid: child.pid, responding };
-}
-async function stopDaemon() {
-  assertUnix();
-  const info = readPidFile();
-  if (!info || !isProcessAlive(info.pid)) {
-    removePidFile();
-    return { kind: "not-running" };
-  }
-  try {
-    process.kill(info.pid, "SIGTERM");
-  } catch {}
-  let forced = false;
-  let alive = true;
-  for (let i = 0;i < 12; i++) {
-    await sleep2(250);
-    if (!isProcessAlive(info.pid)) {
-      alive = false;
-      break;
-    }
-  }
-  if (alive) {
-    try {
-      process.kill(info.pid, "SIGKILL");
-      forced = true;
-    } catch {}
-  }
-  removePidFile();
-  return { kind: "stopped", pid: info.pid, forced };
-}
-function restartCommand(host, port) {
-  const flags = `${host === "127.0.0.1" ? "" : ` --host ${host}`}${port === 8000 ? "" : ` --port ${port}`}`;
-  return `cerefox web stop && cerefox web start${flags}`;
-}
-async function statusDaemon() {
-  const info = readPidFile();
-  if (!info)
-    return { kind: "stopped" };
-  if (!isProcessAlive(info.pid))
-    return { kind: "stale", info };
-  const { responding, version } = await probeVersion(info.host, info.port);
-  return { kind: "running", info, responding, version };
-}
-
-// src/cli/util/checks.ts
+import { join as join11 } from "node:path";
 function checkBinary() {
   return {
     name: "binary",
@@ -72074,6 +72346,28 @@ function checkVersion() {
     detail: `cerefox v${PKG_VERSION}`
   };
 }
+async function checkUpdates() {
+  const name = "updates";
+  if (updateCheckDisabled()) {
+    return { name, status: "skipped", detail: "update check is off (CEREFOX_NO_UPDATE_CHECK, NO_UPDATE_NOTIFIER or CI)" };
+  }
+  let latest;
+  try {
+    latest = await fetchLatestVersion();
+    recordLatest(latest);
+  } catch {
+    return { name, status: "skipped", detail: "could not reach the npm registry to check for a newer release" };
+  }
+  const newer = newerRelease(latest);
+  if (!newer)
+    return { name, status: "ok", detail: `up to date (latest release: v${latest})` };
+  return {
+    name,
+    status: "skipped",
+    detail: `v${newer} is available (installed: v${PKG_VERSION})`,
+    hint: `Run \`${upgradeCommand()}\`. Release notes: ${releaseNotesUrl(newer)}`
+  };
+}
 function checkConfig() {
   let envPath;
   try {
@@ -72086,7 +72380,7 @@ function checkConfig() {
       hint: "Run `cerefox init` to bootstrap."
     };
   }
-  if (!existsSync11(envPath)) {
+  if (!existsSync12(envPath)) {
     const settings = loadSettings();
     if (settings.supabaseUrl && settings.supabaseKey) {
       return {
@@ -72514,6 +72808,47 @@ async function probeRpcJson(settings, fn) {
     return { kind: "error", detail: err instanceof Error ? err.message : String(err) };
   }
 }
+var CHUNK_COUNT_WARN_AT = 1e5;
+function classifyChunkCount(count) {
+  const n = count.toLocaleString("en-US");
+  if (count <= CHUNK_COUNT_WARN_AT) {
+    return { name: "chunks", status: "ok", detail: `${n} current chunk(s)` };
+  }
+  return {
+    name: "chunks",
+    status: "warn",
+    detail: `${n} current chunks: past ${CHUNK_COUNT_WARN_AT.toLocaleString("en-US")}, search's exact vector scan may slow down`,
+    hint: "Search still returns correct results; it may just take longer. Large-store support (a tuned vector index) is tracked in https://github.com/fstamatelopoulos/cerefox/issues/328; comment there with your chunk count."
+  };
+}
+async function checkChunkCount() {
+  const settings = loadSettings();
+  if (!settings.supabaseUrl || !settings.supabaseKey) {
+    return { name: "chunks", status: "skipped", detail: "Supabase config missing; skipped." };
+  }
+  try {
+    const url = `${settings.supabaseUrl.replace(/\/$/, "")}/rest/v1/cerefox_chunks?select=id&version_id=is.null`;
+    const resp = await fetch(url, {
+      method: "HEAD",
+      headers: {
+        apikey: settings.supabaseKey,
+        Authorization: `Bearer ${settings.supabaseKey}`,
+        Prefer: "count=exact"
+      }
+    });
+    const total = Number((resp.headers.get("content-range") ?? "").split("/")[1]);
+    if (!resp.ok || !Number.isFinite(total)) {
+      return { name: "chunks", status: "skipped", detail: `chunk count unavailable (HTTP ${resp.status})` };
+    }
+    return classifyChunkCount(total);
+  } catch (err) {
+    return {
+      name: "chunks",
+      status: "skipped",
+      detail: `chunk count unavailable (${err instanceof Error ? err.message : String(err)})`
+    };
+  }
+}
 var CONTENT_FORMAT_CHECK_NAME = "content format";
 async function checkContentFormat() {
   const settings = loadSettings();
@@ -72587,10 +72922,10 @@ async function checkMetadataHealth() {
   };
 }
 function hasCerefoxInJsonFile(path) {
-  if (!existsSync11(path))
+  if (!existsSync12(path))
     return false;
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf8"));
     const mcpServers = parsed.mcpServers;
     return Boolean(mcpServers && typeof mcpServers === "object" && "cerefox" in mcpServers);
   } catch {
@@ -72647,9 +72982,9 @@ async function checkWebDaemon() {
 }
 function checkMcpConfigs() {
   const home = homedir7();
-  const claudeCodeUser = join10(home, ".claude.json");
-  const claudeCodeProj = join10(process.cwd(), ".mcp.json");
-  const claudeDesktop = process.platform === "darwin" ? join10(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join10(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join10(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeCodeUser = join11(home, ".claude.json");
+  const claudeCodeProj = join11(process.cwd(), ".mcp.json");
+  const claudeDesktop = process.platform === "darwin" ? join11(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join11(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join11(home, ".config", "Claude", "claude_desktop_config.json");
   const found = [];
   if (hasCerefoxInJsonFile(claudeCodeUser))
     found.push("Claude Code (user)");
@@ -72673,8 +73008,8 @@ function checkMcpConfigs() {
 }
 function checkLegacyShadowEnv(opts = {}) {
   const activeEnv = resolveEnvFile(opts);
-  const cwdEnv = join10(opts.cwd ?? process.cwd(), ".env");
-  if (!existsSync11(activeEnv) || !existsSync11(cwdEnv))
+  const cwdEnv = join11(opts.cwd ?? process.cwd(), ".env");
+  if (!existsSync12(activeEnv) || !existsSync12(cwdEnv))
     return null;
   try {
     if (realpathSync(activeEnv) === realpathSync(cwdEnv))
@@ -72836,6 +73171,7 @@ async function runAllChecks(opts = {}) {
     { name: "binary", phase: "Locating binary", run: () => checkBinary() },
     { name: "runtime", phase: "Inspecting runtime", run: () => checkRuntime() },
     { name: "version", phase: "Reading package version", run: () => checkVersion() },
+    { name: "updates", phase: "Checking npm for a newer release", run: () => checkUpdates() },
     { name: "config", phase: "Resolving config", run: () => checkConfig() },
     { name: "legacy env", phase: "Checking legacy env shadowing", run: () => checkLegacyShadowEnv() },
     { name: "retired env", phase: "Checking retired env vars", run: () => checkRetiredEnvVars() },
@@ -72845,6 +73181,7 @@ async function runAllChecks(opts = {}) {
     { name: "review workflow", phase: "Reading review workflow flag", run: () => checkReviewWorkflow() },
     { name: "trash auto-purge", phase: "Reading trash auto-purge settings", run: () => checkTrashAutoPurge() },
     { name: "embedder", phase: "Checking embedder consistency", run: () => checkEmbedderMismatch() },
+    { name: "chunks", phase: "Counting current chunks", run: () => checkChunkCount() },
     { name: "content format", phase: "Checking chunk reconstruction format", run: () => checkContentFormat() },
     { name: "metadata health", phase: "Checking metadata well-formedness", run: () => checkMetadataHealth() },
     { name: "edge functions", phase: "Probing Edge Function versions", run: () => checkEdgeFunctionsCompat() },
@@ -73246,11 +73583,11 @@ init_dist4();
 init_escape_heuristic();
 init_cli_core();
 init_config();
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import { basename as basename2, extname as extname3 } from "node:path";
 
 // src/ingestion/pipeline.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { basename, extname as extname2, resolve as resolve3 } from "node:path";
 // ../../_shared/ingest/pipeline-helpers.ts
 import { createHash } from "node:crypto";
@@ -73920,7 +74257,7 @@ class IngestionPipeline {
     };
   }
   async ingestFile(path, opts = {}) {
-    const text = await fileToMarkdown(path, readFileSync10(path));
+    const text = await fileToMarkdown(path, readFileSync11(path));
     const absPath = resolve3(path);
     const stem = basename(absPath, extname2(absPath));
     return this.ingestText({
@@ -73951,11 +74288,11 @@ async function readContent(path, paste) {
     return { content, titleFromPath: undefined };
   }
   if (!path) {
-    throw userError("Provide a file path or use --paste.", "Example: cerefox ingest notes.md --title 'My Note'");
+    throw userError("Provide a file path or use --paste.", "Example: cerefox document ingest notes.md --title 'My Note'");
   }
   let content;
   try {
-    content = readFileSync11(path, "utf8");
+    content = readFileSync12(path, "utf8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw userError(`Cannot read ${path}: ${msg}`);
@@ -74065,14 +74402,14 @@ init_cli_core();
 init_mcp_tools();
 init_config();
 init_client();
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 function resolveText(value, what) {
   if (value === undefined)
     throw userError(`${what} is required.`);
   if (value === "-")
-    return readFileSync12(0, "utf8");
+    return readFileSync13(0, "utf8");
   if (value.startsWith("@"))
-    return readFileSync12(value.slice(1), "utf8");
+    return readFileSync13(value.slice(1), "utf8");
   return value;
 }
 function context() {
@@ -74133,7 +74470,7 @@ init_cli_core();
 init_config();
 var import_cli_progress = __toESM(require_cli_progress(), 1);
 import { readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
-import { basename as basename3, extname as extname4, join as join11 } from "node:path";
+import { basename as basename3, extname as extname4, join as join12 } from "node:path";
 function walk(dir, extensions) {
   let entries;
   try {
@@ -74143,7 +74480,7 @@ function walk(dir, extensions) {
   }
   const files = [];
   for (const name of entries) {
-    const full = join11(dir, name);
+    const full = join12(dir, name);
     let stat;
     try {
       stat = statSync4(full);
@@ -74246,20 +74583,20 @@ import { spawnSync as spawnSync4 } from "node:child_process";
 import {
   chmodSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync14,
-  writeFileSync as writeFileSync6
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname5, join as join12 } from "node:path";
+import { dirname as dirname6, join as join13 } from "node:path";
 async function readConfigFile(path) {
-  if (!existsSync12(path)) {
+  if (!existsSync13(path)) {
     throw userError(`--config file not found: ${path}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(path, "utf8"));
+    parsed = JSON.parse(readFileSync15(path, "utf8"));
   } catch (err) {
     throw userError(`--config: invalid JSON in ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -74301,7 +74638,7 @@ function parseDotEnvFile(content) {
   return map;
 }
 function answersFromEnvFile(path) {
-  const parsed = parseDotEnvFile(readFileSync14(path, "utf8"));
+  const parsed = parseDotEnvFile(readFileSync15(path, "utf8"));
   const required = ["CEREFOX_SUPABASE_URL", "CEREFOX_SUPABASE_KEY", "OPENAI_API_KEY"];
   for (const key of required) {
     if (!parsed[key] || parsed[key].trim() === "") {
@@ -74525,7 +74862,7 @@ async function postWriteLifecycle(envPath, options) {
       await Promise.resolve().then(() => init_sync_self_docs());
       await runSyncSelfDocs({});
     } catch (err) {
-      warn(`Self-doc ingest failed: ${err instanceof Error ? err.message : String(err)}. Run \`cerefox sync-self-docs\` manually after init.`);
+      warn(`Self-doc ingest failed: ${err instanceof Error ? err.message : String(err)}. Run \`cerefox guides ingest\` manually after init.`);
     }
     println("");
   }
@@ -74549,15 +74886,15 @@ async function postWriteLifecycle(envPath, options) {
   }
   println("");
   println(c.green("Done. Try:"));
-  println(c.dim("  cerefox doctor              # verify everything"));
-  println(c.dim('  cerefox search "…"          # search the KB'));
-  println(c.dim("  cerefox ingest <file>       # add a doc"));
+  println(c.dim("  cerefox doctor                  # verify everything"));
+  println(c.dim('  cerefox search "…"              # search the KB'));
+  println(c.dim("  cerefox document ingest <file>  # add a doc"));
   println("");
   println(c.dim(`  Config in effect: ${envPath}`));
 }
 function writeAnswersTo(target, answers) {
-  mkdirSync5(dirname5(target), { recursive: true });
-  writeFileSync6(target, buildEnvFile(answers), "utf8");
+  mkdirSync6(dirname6(target), { recursive: true });
+  writeFileSync7(target, buildEnvFile(answers), "utf8");
   if (process.platform !== "win32") {
     try {
       chmodSync(target, 384);
@@ -74567,12 +74904,12 @@ function writeAnswersTo(target, answers) {
   }
 }
 async function action23(options) {
-  const homeEnv = join12(homedir8(), USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join12(process.cwd(), ".env");
+  const homeEnv = join13(homedir8(), USER_STATE_DIR_NAME, ".env");
+  const cwdEnv = join13(process.cwd(), ".env");
   const explicitDir = (process.env.CEREFOX_CONFIG_DIR ?? "").trim();
   if (explicitDir) {
     const target = resolveEnvFile();
-    if (existsSync12(target) && !options.force) {
+    if (existsSync13(target) && !options.force) {
       println(c.yellow(`⚠ Config already exists at ${target}.`));
       const ok = await confirm("Overwrite?", true);
       if (!ok) {
@@ -74594,7 +74931,7 @@ async function action23(options) {
     await postWriteLifecycle(target, options);
     return;
   }
-  if (existsSync12(homeEnv) && !options.force) {
+  if (existsSync13(homeEnv) && !options.force) {
     println(c.yellow(`⚠ Config already exists at ${homeEnv}.`));
     const ok = await confirm("Overwrite?", true);
     if (!ok) {
@@ -74615,12 +74952,12 @@ async function action23(options) {
     await postWriteLifecycle(homeEnv, options);
     return;
   }
-  if (existsSync12(cwdEnv) && !options.force && !options.config) {
+  if (existsSync13(cwdEnv) && !options.force && !options.config) {
     printMigrationMenu(cwdEnv, homeEnv);
     const ch = await promptMigrationChoice();
     println("");
     if (ch === "c") {
-      mkdirSync5(dirname5(homeEnv), { recursive: true });
+      mkdirSync6(dirname6(homeEnv), { recursive: true });
       copyFileSync2(cwdEnv, homeEnv);
       if (process.platform !== "win32") {
         try {
@@ -74693,7 +75030,7 @@ async function action24(options) {
       throw systemError(`Project lookup failed: ${projectError.message}`);
     }
     if (!project) {
-      throw userError(`Project "${options.project}" not found.`, "Run `cerefox list-projects` to see available names.");
+      throw userError(`Project "${options.project}" not found.`, "Run `cerefox project list` to see available names.");
     }
     projectId = project.id;
   }
@@ -75237,35 +75574,35 @@ function registerMigrateFormat(program) {
 // src/cli/commands/restore.ts
 init_cli_core();
 init_client();
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join13, resolve as resolve4 } from "node:path";
+import { join as join14, resolve as resolve4 } from "node:path";
 function expandHome2(path) {
   if (path === "~")
     return homedir9();
   if (path.startsWith("~/"))
-    return join13(homedir9(), path.slice(2));
+    return join14(homedir9(), path.slice(2));
   return path;
 }
 function resolveBackupFile(target) {
   const path = resolve4(expandHome2(target));
-  if (!existsSync13(path)) {
+  if (!existsSync14(path)) {
     throw userError(`Backup path not found: ${target}`);
   }
   const stat = statSync5(path);
   if (stat.isFile())
     return path;
-  const candidates = readdirSync5(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync5(join13(path, n)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const candidates = readdirSync5(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync5(join14(path, n)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   if (candidates.length === 0) {
     throw userError(`No cerefox-*.json files in ${path}`);
   }
-  return join13(path, candidates[0].name);
+  return join14(path, candidates[0].name);
 }
 async function action31(target, options) {
   const file = resolveBackupFile(target);
   let payload;
   try {
-    payload = JSON.parse(readFileSync15(file, "utf8"));
+    payload = JSON.parse(readFileSync16(file, "utf8"));
   } catch (err) {
     throw userError(`Could not parse backup file ${file}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -75595,6 +75932,8 @@ function registerSearch(program) {
 // src/cli/commands/self-update.ts
 init_cli_core();
 init_meta();
+init_update_check();
+init_daemon();
 import { spawnSync as spawnSync5 } from "node:child_process";
 function detectRuntime() {
   const bin = (process.argv[1] ?? "").toLowerCase();
@@ -75625,21 +75964,19 @@ function detectRuntime() {
     description: "npm"
   };
 }
-async function fetchLatestVersion() {
-  const resp = await fetch("https://registry.npmjs.org/@cerefox%2Fmemory/latest");
-  if (!resp.ok) {
-    throw systemError(`Could not query npm registry: ${resp.status} ${resp.statusText}`);
-  }
-  const body = await resp.json();
-  if (!body.version) {
-    throw systemError("npm registry response missing version field.");
+async function fetchLatest() {
+  try {
+    const latest = await fetchLatestVersion({ timeoutMs: 15000 });
+    recordLatest(latest);
+    return latest;
+  } catch (err) {
+    throw systemError(`Could not query the npm registry: ${err instanceof Error ? err.message : String(err)}`);
   }
-  return body.version;
 }
 async function action33(options) {
   let target;
   try {
-    target = options.version ?? await fetchLatestVersion();
+    target = options.version ?? await fetchLatest();
   } catch (err) {
     if (err instanceof Error)
       throw err;
@@ -75647,12 +75984,12 @@ async function action33(options) {
   }
   println(c.dim(`Installed: ${PKG_VERSION}`));
   println(c.dim(`Target:    ${target}`));
-  if (target === PKG_VERSION && !options.version) {
+  if (!options.version && !newerRelease(target)) {
     println(c.green("✓ Already up to date."));
     return;
   }
   if (options.check) {
-    if (target !== PKG_VERSION) {
+    if (newerRelease(target)) {
       println(c.yellow(`Update available: ${PKG_VERSION} → ${target}`));
       println(c.dim("Run `cerefox self-update` to upgrade."));
     }
@@ -75740,8 +76077,8 @@ init_config();
 import { randomBytes } from "node:crypto";
 
 // src/cli/util/env-file.ts
-import { copyFileSync as copyFileSync3, existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 import { spawnSync as spawnSync6 } from "node:child_process";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -75750,12 +76087,12 @@ function upsertEnvVar(path, key, value, opts = {}) {
   const line = `${key}=${value}`;
   const header = opts.comment ? `# ${opts.comment}
 ` : "";
-  if (!existsSync14(path)) {
-    writeFileSync7(path, `${header}${line}
+  if (!existsSync15(path)) {
+    writeFileSync8(path, `${header}${line}
 `, { mode: 384 });
     return { path, action: "created" };
   }
-  const original = readFileSync16(path, "utf8");
+  const original = readFileSync17(path, "utf8");
   let backupPath;
   if (!opts.noBackup) {
     backupPath = `${path}.pre-cerefox.bak`;
@@ -75776,18 +76113,18 @@ ${header}${line}
 `;
     action = "added";
   }
-  writeFileSync7(path, next);
+  writeFileSync8(path, next);
   return { path, action, backupPath };
 }
 function readEnvVar(path, key) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return null;
-  const m = readFileSync16(path, "utf8").match(new RegExp(`^\\s*${escapeRegExp(key)}=(.*)$`, "m"));
+  const m = readFileSync17(path, "utf8").match(new RegExp(`^\\s*${escapeRegExp(key)}=(.*)$`, "m"));
   return m ? m[1].trim() : null;
 }
 function envGitignoreWarning(path) {
   try {
-    const dir = dirname6(path);
+    const dir = dirname7(path);
     const inTree = spawnSync6("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"], {
       encoding: "utf8"
     });
@@ -75802,146 +76139,8 @@ function envGitignoreWarning(path) {
   }
 }
 
-// src/web/auth.ts
-import { existsSync as existsSync15 } from "node:fs";
-
-// ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/conninfo.mjs
-var getConnInfo = (c) => {
-  const bindings = c.env.server ? c.env.server : c.env;
-  const address = bindings.incoming.socket.remoteAddress;
-  const port = bindings.incoming.socket.remotePort;
-  const family = bindings.incoming.socket.remoteFamily;
-  return { remote: {
-    address,
-    port,
-    addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : undefined
-  } };
-};
-
-// ../../_shared/mcp-auth/index.ts
-function constantTimeEqual(a, b) {
-  const ab = new TextEncoder().encode(a);
-  const bb = new TextEncoder().encode(b);
-  const len = Math.max(ab.length, bb.length);
-  let diff = ab.length ^ bb.length;
-  for (let i = 0;i < len; i++) {
-    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
-  }
-  return diff === 0;
-}
-
-// ../../_shared/ef-auth/index.ts
-function parseAccessTokens(raw) {
-  if (!raw)
-    return [];
-  return raw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-}
-var BEARER_PREFIX = "Bearer ";
-function checkAccessToken(authorizationHeader, config) {
-  if (!authorizationHeader || !authorizationHeader.startsWith(BEARER_PREFIX)) {
-    return { ok: false, reason: "no_token" };
-  }
-  const token = authorizationHeader.slice(BEARER_PREFIX.length).trim();
-  if (!token)
-    return { ok: false, reason: "no_token" };
-  if (config.tokens.length === 0) {
-    return {
-      ok: false,
-      reason: "no_tokens_configured",
-      detail: "CEREFOX_ACCESS_TOKENS is unset/empty; refusing to accept-all"
-    };
-  }
-  let matched = false;
-  for (const accepted of config.tokens) {
-    if (constantTimeEqual(token, accepted))
-      matched = true;
-  }
-  return matched ? { ok: true } : { ok: false, reason: "bad_token" };
-}
-
-// src/web/auth.ts
-var API_KEY_PREFIX = "cfx_lak_";
-var LOOPBACK_ADDRESSES = new Set([
-  "127.0.0.1",
-  "::1",
-  "::ffff:127.0.0.1"
-]);
-function isContainerised() {
-  try {
-    return existsSync15("/.dockerenv");
-  } catch {
-    return false;
-  }
-}
-function containerGateWarning(env = process.env) {
-  const hasKey = (env.CEREFOX_API_KEY ?? "").trim() !== "";
-  const requireAll = (env.CEREFOX_API_REQUIRE_KEY ?? "") === "1";
-  if (!hasKey || requireAll || !isContainerised())
-    return null;
-  return `
-⚠  CEREFOX_API_KEY is set inside a container without CEREFOX_API_REQUIRE_KEY=1.
-` + `   Docker rewrites the source address of every published-port request, so the
-` + `   loopback exemption cannot match and EVERY caller will get a 401 — including
-` + `   the web UI. In a container the gate must be all-or-nothing:
-` + `     • publishing on 127.0.0.1 → leave CEREFOX_API_KEY unset (the bind is the boundary)
-` + `     • publishing wider        → also set CEREFOX_API_REQUIRE_KEY=1
-`;
-}
-function isLoopbackAddress(address) {
-  if (!address)
-    return false;
-  return LOOPBACK_ADDRESSES.has(address.trim().toLowerCase());
-}
-function decideAuth(input) {
-  const keys = input.configuredKeys.trim();
-  if (!keys)
-    return { allow: true, reason: "disabled" };
-  const local = isLoopbackAddress(input.remoteAddress);
-  if (local && !input.requireKeyEverywhere) {
-    return { allow: true, reason: "loopback" };
-  }
-  const result = checkAccessToken(input.authorization, {
-    tokens: parseAccessTokens(keys)
-  });
-  if (result.ok)
-    return { allow: true, reason: "valid_key" };
-  if (result.reason === "no_token") {
-    return {
-      allow: false,
-      reason: "no_key",
-      message: local ? "This server requires an API key on every request (CEREFOX_API_REQUIRE_KEY is set). " + "Send it as `Authorization: Bearer <key>`." : "This request did not come from the local machine, so it needs the server's API key " + "as `Authorization: Bearer <key>`. Print it with `cerefox api-key show` " + "(or `cerefox-local api-key` for a container install)."
-    };
-  }
-  return {
-    allow: false,
-    reason: "bad_key",
-    message: "The API key presented is not valid for this server."
-  };
-}
-function apiAuth() {
-  return async (c, next) => {
-    const decision = decideAuth({
-      remoteAddress: remoteAddressOf(c),
-      authorization: c.req.header("Authorization") ?? null,
-      configuredKeys: process.env.CEREFOX_API_KEY ?? "",
-      requireKeyEverywhere: (process.env.CEREFOX_API_REQUIRE_KEY ?? "") === "1"
-    });
-    if (decision.allow)
-      return next();
-    return c.json({ detail: decision.message }, 401, {
-      "WWW-Authenticate": 'Bearer realm="cerefox"'
-    });
-  };
-}
-function remoteAddressOf(c) {
-  try {
-    return getConnInfo(c).remote.address;
-  } catch {
-    return;
-  }
-}
-
 // src/cli/commands/api-key.ts
+init_auth();
 var ENV_NAME = "CEREFOX_API_KEY";
 function mint() {
   return API_KEY_PREFIX + randomBytes(32).toString("base64url");
@@ -76146,7 +76345,7 @@ init_sync_self_docs();
 
 // src/cli/commands/web.ts
 init_cli_core();
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 
 // ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
 var X_ALREADY_SENT = "x-hono-already-sent";
@@ -77748,7 +77947,7 @@ var baseMimes = _baseMimes;
 
 // ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/serve-static.mjs
 import { createReadStream, existsSync as existsSync16, statSync as statSync6 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -77838,11 +78037,11 @@ var serveStatic = (options = { root: "" }) => {
         await options.onNotFound?.(c.req.path, c);
         return next();
       }
-    let path = join14(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename);
+    let path = join15(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename);
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
       const indexFile = options.index ?? "index.html";
-      path = join14(path, indexFile);
+      path = join15(path, indexFile);
       stats = getStats(path);
     }
     if (!stats) {
@@ -77904,9 +78103,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // src/web/server.ts
+init_auth();
 import { existsSync as existsSync20 } from "node:fs";
-import { readFileSync as readFileSync19, statSync as statSync9 } from "node:fs";
-import { join as join18 } from "node:path";
+import { readFileSync as readFileSync20, statSync as statSync9 } from "node:fs";
+import { join as join19 } from "node:path";
 
 // ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -81165,18 +81365,19 @@ function registerIngestRoutes(app, ctx) {
 // src/web/routes/meta.ts
 init_server_assets();
 init_meta();
+init_update_check();
 import { execFileSync } from "node:child_process";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/web/docs.ts
 import {
   existsSync as existsSync17,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   readdirSync as readdirSync6,
   statSync as statSync7
 } from "node:fs";
-import { basename as basename5, dirname as dirname7, join as join15, resolve as resolve5 } from "node:path";
+import { basename as basename5, dirname as dirname8, join as join16, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var TOP_LEVEL_DOCS = [
   { filename: "README.md", path: "README.md", category: "readme" },
@@ -81192,37 +81393,37 @@ var TOP_LEVEL_DOCS = [
   }
 ];
 function moduleDir2() {
-  return dirname7(fileURLToPath3(import.meta.url));
+  return dirname8(fileURLToPath3(import.meta.url));
 }
 function resolveDocsRoots() {
   const here = moduleDir2();
   const pkgRootCandidates = [
-    join15(here, "..", ".."),
-    join15(here, "..", "..", "..", "..")
+    join16(here, "..", ".."),
+    join16(here, "..", "..", "..", "..")
   ];
   let pkgGuides = null;
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
-    const guides = join15(pkg, "docs", "guides");
+    const guides = join16(pkg, "docs", "guides");
     if (existsSync17(guides) && statSync7(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
     }
   }
-  const repoCandidate = join15(here, "..", "..", "..", "..");
-  const repoGuides = join15(repoCandidate, "docs", "guides");
+  const repoCandidate = join16(here, "..", "..", "..", "..");
+  const repoGuides = join16(repoCandidate, "docs", "guides");
   const repoTopLevel = repoCandidate;
   return {
     pkgGuides,
     pkgTopLevel,
     repoGuides: existsSync17(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync17(join15(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoTopLevel: existsSync17(join16(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
   try {
-    const content = readFileSync17(filePath, "utf8");
+    const content = readFileSync18(filePath, "utf8");
     const match = content.match(/^#\s+(.+?)\s*$/m);
     return match ? match[1] : null;
   } catch {
@@ -81242,7 +81443,7 @@ function listBundledDocs2() {
   const topRoot = pkgTopLevel ?? repoTopLevel;
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
-      const abs = join15(topRoot, t.filename);
+      const abs = join16(topRoot, t.filename);
       if (existsSync17(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
@@ -81252,7 +81453,7 @@ function listBundledDocs2() {
   if (guidesRoot) {
     const names = readdirSync6(guidesRoot).filter((n) => n.endsWith(".md")).sort();
     for (const name of names) {
-      const abs = join15(guidesRoot, name);
+      const abs = join16(guidesRoot, name);
       entries.push(entryForFile(abs, `guides/${name}`, "guide"));
     }
   }
@@ -81272,7 +81473,7 @@ function readDoc(docPath) {
   }
   if (existsSync17(candidate) && statSync7(candidate).isFile()) {
     try {
-      return readFileSync17(candidate, "utf8");
+      return readFileSync18(candidate, "utf8");
     } catch {
       return null;
     }
@@ -81281,22 +81482,22 @@ function readDoc(docPath) {
 }
 function readOpenApiDocument() {
   const here = moduleDir2();
-  const fromSource = here.endsWith(join15("src", "web"));
-  const repoCopy = join15(here, "..", "..", "..", "..", "docs", "api", "openapi.json");
+  const fromSource = here.endsWith(join16("src", "web"));
+  const repoCopy = join16(here, "..", "..", "..", "..", "docs", "api", "openapi.json");
   const candidates = fromSource ? [repoCopy] : [
-    join15(here, "..", "..", "docs", "api", "openapi.json"),
+    join16(here, "..", "..", "docs", "api", "openapi.json"),
     repoCopy
   ];
   for (const p of candidates) {
     if (existsSync17(p))
-      return readFileSync17(p, "utf8");
+      return readFileSync18(p, "utf8");
   }
   return null;
 }
 
 // src/web/routes/meta.ts
 init_compatibility();
-function resolveGitCommitShort(dir = dirname8(fileURLToPath4(import.meta.url))) {
+function resolveGitCommitShort(dir = dirname9(fileURLToPath4(import.meta.url))) {
   const env = process.env.CEREFOX_GIT_COMMIT;
   if (env)
     return env.slice(0, 7);
@@ -81319,7 +81520,13 @@ var VERSION_INFO = {
 function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/version", (c) => {
     const label = (process.env.CEREFOX_ENV_LABEL ?? "").trim();
-    return c.json({ ...VERSION_INFO, env_label: label.length > 0 ? label : null });
+    const latest = updateCheckDisabled() ? null : readCache()?.latest ?? null;
+    return c.json({
+      ...VERSION_INFO,
+      env_label: label.length > 0 ? label : null,
+      latest,
+      update_command: newerRelease(latest) ? upgradeCommand() : null
+    });
   });
   app.get("/api/v1/docs", (c) => c.json(listBundledDocs2()));
   app.get("/api/v1/docs/:path{.+}", (c) => {
@@ -81428,17 +81635,17 @@ function registerPostgrestProxy(app) {
 
 // src/web/routes/preferences.ts
 init_config();
-import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join17 } from "node:path";
 function isTheme(v) {
   return v === "auto" || v === "light" || v === "dark";
 }
 function prefsFile() {
-  return join16(userStateDir(), "web-prefs.json");
+  return join17(userStateDir(), "web-prefs.json");
 }
 function readPrefs() {
   try {
-    const raw = JSON.parse(readFileSync18(prefsFile(), "utf8"));
+    const raw = JSON.parse(readFileSync19(prefsFile(), "utf8"));
     if (isTheme(raw.theme))
       return { theme: raw.theme };
   } catch {}
@@ -81455,8 +81662,8 @@ function registerPreferencesRoutes(app) {
     try {
       const dir = userStateDir();
       if (!existsSync18(dir))
-        mkdirSync6(dir, { recursive: true });
-      writeFileSync8(prefsFile(), `${JSON.stringify(next, null, 2)}
+        mkdirSync7(dir, { recursive: true });
+      writeFileSync9(prefsFile(), `${JSON.stringify(next, null, 2)}
 `);
     } catch (err) {
       return c.json({ detail: err instanceof Error ? err.message : String(err) }, 500);
@@ -81592,20 +81799,20 @@ function registerProjectsRoutes(app, ctx) {
 
 // src/web/static.ts
 import { existsSync as existsSync19, statSync as statSync8 } from "node:fs";
-import { dirname as dirname9, join as join17 } from "node:path";
+import { dirname as dirname10, join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function moduleDir3() {
-  return dirname9(fileURLToPath5(import.meta.url));
+  return dirname10(fileURLToPath5(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync19(dir) && statSync8(dir).isDirectory() && existsSync19(join17(dir, "index.html"));
+  return existsSync19(dir) && statSync8(dir).isDirectory() && existsSync19(join18(dir, "index.html"));
 }
 function resolveSpaDist() {
   const here = moduleDir3();
   const candidates = [
-    join17(here, "..", "frontend"),
-    join17(here, "..", "..", "..", "..", "frontend", "dist"),
-    join17(here, "..", "..", "dist", "frontend")
+    join18(here, "..", "frontend"),
+    join18(here, "..", "..", "..", "..", "frontend", "dist"),
+    join18(here, "..", "..", "dist", "frontend")
   ];
   for (const c of candidates) {
     if (isUsableSpaDir(c))
@@ -81616,8 +81823,8 @@ function resolveSpaDist() {
 function resolveStaticDir() {
   const here = moduleDir3();
   const candidates = [
-    join17(here, "..", "static"),
-    join17(here, "..", "..", "..", "..", "web", "static")
+    join18(here, "..", "static"),
+    join18(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c of candidates) {
     if (existsSync19(c) && statSync8(c).isDirectory())
@@ -81663,6 +81870,7 @@ var ROOT_REDIRECT_HTML = `<!DOCTYPE html>
 
 // src/web/server.ts
 init_meta();
+init_update_check();
 init_ef_meta();
 init_cli_core();
 init_config();
@@ -81716,14 +81924,14 @@ function buildApp(ctx = buildWebContext()) {
       rewriteRequestPath: (path) => path.replace(/^\/app/, "") || "/"
     }));
     app.get("/app/assets/*", (c) => c.text("Not found", 404));
-    const indexPath = join18(spaDist, "index.html");
+    const indexPath = join19(spaDist, "index.html");
     if (existsSync20(indexPath)) {
       let cached = null;
       const readIndex = () => {
         try {
           const { mtimeMs, size } = statSync9(indexPath);
           if (!cached || cached.mtimeMs !== mtimeMs || cached.size !== size) {
-            cached = { mtimeMs, size, html: readFileSync19(indexPath, "utf8") };
+            cached = { mtimeMs, size, html: readFileSync20(indexPath, "utf8") };
           }
         } catch {}
         return cached?.html ?? null;
@@ -81791,6 +81999,7 @@ async function buildWebServer(options = {}) {
   }
   const app = buildApp();
   const server = serve({ fetch: app.fetch, hostname: host, port, overrideGlobalObjects: false });
+  startPeriodicRefresh();
   return {
     host,
     port,
@@ -81801,6 +82010,7 @@ async function buildWebServer(options = {}) {
 }
 
 // src/cli/commands/web.ts
+init_daemon();
 init_meta();
 function parsePort(raw) {
   const port = Number.parseInt(raw, 10);
@@ -81837,7 +82047,7 @@ async function runForeground(host, port, watch) {
 }
 function readStartupRefusal() {
   try {
-    const tail = readFileSync20(daemonPaths.logFile, "utf8").slice(-4000);
+    const tail = readFileSync21(daemonPaths.logFile, "utf8").slice(-4000);
     const idx = tail.lastIndexOf("Refusing to start:");
     if (idx === -1)
       return null;
@@ -82093,17 +82303,17 @@ async function bareEntryPoint() {
     println("  " + c.bold("cerefox init") + "    # interactive first-run setup (~2 min)");
     println("");
     println(c.dim("Once configured, try:"));
-    println(c.dim("  cerefox doctor               # verify your install"));
-    println(c.dim('  cerefox search "…"           # search the KB'));
-    println(c.dim("  cerefox ingest <file>        # add a doc"));
+    println(c.dim("  cerefox doctor                  # verify your install"));
+    println(c.dim('  cerefox search "…"              # search the KB'));
+    println(c.dim("  cerefox document ingest <file>  # add a doc"));
   } else {
     println(c.green("✓ Config detected. You're good to go."));
     println("");
     println("Common commands:");
-    println(c.dim("  cerefox doctor               # diagnose your install"));
-    println(c.dim('  cerefox search "…"           # search the KB'));
-    println(c.dim("  cerefox ingest <file>        # add a doc"));
-    println(c.dim("  cerefox configure-agent      # wire up an MCP client"));
+    println(c.dim("  cerefox doctor                  # diagnose your install"));
+    println(c.dim('  cerefox search "…"              # search the KB'));
+    println(c.dim("  cerefox document ingest <file>  # add a doc"));
+    println(c.dim("  cerefox configure-agent         # wire up an MCP client"));
     println("");
     println(c.dim("Run `cerefox --help` for the full command list."));
   }
@@ -82117,6 +82327,7 @@ async function main() {
   }
   if (process.argv.length === 2) {
     await bareEntryPoint();
+    await printUpdateNotice();
     return;
   }
   const program = buildProgram();
@@ -82127,6 +82338,25 @@ async function main() {
     process.exit(1);
   });
   await program.parseAsync(process.argv);
+  await printUpdateNotice();
+}
+var NO_UPDATE_NOTICE = new Set(["mcp", "completion", "self-update", "upgrade", "doctor"]);
+async function printUpdateNotice() {
+  const args = process.argv.slice(2);
+  if (!process.stderr.isTTY || args.includes("--json"))
+    return;
+  if (args[0] && NO_UPDATE_NOTICE.has(args[0]))
+    return;
+  try {
+    await Promise.resolve().then(() => init_update_check());
+    const line = takeCliNotice();
+    if (line) {
+      await Promise.resolve().then(() => init_cli_core());
+      process.stderr.write(`
+` + cErr.yellow(line) + `
+`);
+    }
+  } catch {}
 }
 main().catch((err) => {
   if (err instanceof CliError) {