@cerefox/memory 1.20.0 → 1.22.0

package/dist/bin/cerefox.js

@@ -5318,7 +5318,7 @@ var init_cli_core = __esm(() => {
 });
 
 // src/meta.ts
-var PKG_VERSION = "1.20.0";
+var PKG_VERSION = "1.22.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -5405,7 +5405,7 @@ function loadEnv(opts = {}) {
   for (const [k, v] of Object.entries(parseDotenv(content))) {
     if (k === "CEREFOX_CONFIG_DIR")
       continue;
-    if (env2[k] === undefined || configDirNamed) {
+    if (env2[k] === undefined || configDirNamed || k === "CEREFOX_PROG_NAME") {
       env2[k] = v;
       count++;
     }
@@ -23699,17 +23699,28 @@ var init_db_client = __esm(() => {
   });
 });
 
+// src/cli/util/prog-name.ts
+function progName() {
+  const name = (process.env.CEREFOX_PROG_NAME ?? "").trim();
+  if (name)
+    return name;
+  const dir = (process.env.CEREFOX_CONFIG_DIR ?? "").trim();
+  if (!dir)
+    return "cerefox";
+  return /^[A-Za-z0-9_\/.~+,:@%=-]+$/.test(dir) ? `CEREFOX_CONFIG_DIR=${dir} cerefox` : `CEREFOX_CONFIG_DIR='${dir.replace(/'/g, `'\\''`)}' cerefox`;
+}
+
 // src/cli/util/client.ts
 function getClient() {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
-    throw systemError("CEREFOX_SUPABASE_URL and CEREFOX_SUPABASE_KEY must be set in your .env file.", "Run `cerefox init` to create a config, or see docs/guides/setup-supabase.md.");
+    throw systemError("CEREFOX_SUPABASE_URL and CEREFOX_SUPABASE_KEY must be set in your .env file.", `Run \`${progName()} init\` to create a config, or see docs/guides/setup-supabase.md.`);
   }
   try {
     return createClient2(settings);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw systemError(`Failed to initialize Supabase client: ${msg}`, "Run `cerefox doctor` to verify your credentials.");
+    throw systemError(`Failed to initialize Supabase client: ${msg}`, `Run \`${progName()} doctor\` to verify your credentials.`);
   }
 }
 var init_client = __esm(() => {
@@ -23727,8 +23738,20 @@ function auditDocLabel(docTitle, documentId, operation) {
     return docTitle;
   if (documentId)
     return documentId.slice(0, 8) + "…";
+  if (operation === "config-change")
+    return "(setting)";
+  if (operation?.startsWith("project-"))
+    return "(project)";
   return isStoreLevelAuditOp(operation) ? "(store)" : "(deleted)";
 }
+function storeChangeSummary(operation, description) {
+  if (!isStoreLevelAuditOp(operation))
+    return null;
+  const d = (description ?? "").trim();
+  if (!d)
+    return null;
+  return operation === "config-change" ? d.replace(/^config:\s*/, "") : d;
+}
 function metadataChangeSummary(before, after) {
   if (before == null && after == null)
     return null;
@@ -26658,6 +26681,7 @@ function apiAuth(keys = () => process.env.CEREFOX_API_KEY ?? "") {
         if (!guard.allow)
           return c.json({ detail: guard.message }, 403);
       }
+      c.set("cerefoxAuthReason", decision.reason);
       return next();
     }
     return c.json({ detail: decision.message }, 401, {
@@ -26768,7 +26792,7 @@ async function isResponding(host, port, timeoutMs = 1500) {
 }
 function assertUnix() {
   if (process.platform === "win32") {
-    throw new Error("Daemon mode (`cerefox web start/stop/status`) is not supported on Windows yet. " + "Run `cerefox web` in the foreground, or set up a Windows service manually.");
+    throw new Error(`Daemon mode (\`${progName()} web start/stop/status\`) is not supported on Windows yet. ` + `Run \`${progName()} web\` in the foreground, or set up a Windows service manually.`);
   }
 }
 async function startDaemon(opts) {
@@ -26834,7 +26858,8 @@ async function stopDaemon() {
 }
 function restartCommand(host, port) {
   const flags = `${host === "127.0.0.1" ? "" : ` --host ${host}`}${port === 8000 ? "" : ` --port ${port}`}`;
-  return `cerefox web stop && cerefox web start${flags}`;
+  const p = progName();
+  return `${p} web stop && ${p} web start${flags}`;
 }
 async function statusDaemon() {
   const info = readPidFile();
@@ -26918,7 +26943,7 @@ function startPeriodicRefresh() {
   if (updateCheckDisabled())
     return;
   refreshLatest();
-  const timer = setInterval(() => void refreshLatest(), CACHE_TTL_MS);
+  const timer = setInterval(() => void refreshLatest(), REFRESH_TICK_MS);
   timer.unref?.();
 }
 function newerRelease(latest, installed = PKG_VERSION) {
@@ -26946,19 +26971,21 @@ function takeCliNotice(opts = {}) {
   writeCache({ ...cached, notifiedAt: now.toISOString() }, path);
   return `Cerefox ${newer} is available (you have ${opts.installed ?? PKG_VERSION}). Run \`${upgradeCommand()}\`.`;
 }
-var LATEST_URL = "https://registry.npmjs.org/@cerefox%2Fmemory/latest", DAY_MS, CACHE_TTL_MS, NOTIFY_INTERVAL_MS, releaseNotesUrl = (version) => `https://github.com/fstamatelopoulos/cerefox/releases/tag/v${version}`;
+var LATEST_URL = "https://registry.npmjs.org/@cerefox%2Fmemory/latest", DAY_MS, HOUR_MS, CACHE_TTL_MS, REFRESH_TICK_MS, NOTIFY_INTERVAL_MS, releaseNotesUrl = (version) => `https://github.com/fstamatelopoulos/cerefox/releases/tag/v${version}`;
 var init_update_check = __esm(() => {
   init_compatibility();
   init_meta();
   init_auth();
   init_daemon();
   DAY_MS = 24 * 60 * 60 * 1000;
-  CACHE_TTL_MS = DAY_MS;
+  HOUR_MS = 60 * 60 * 1000;
+  CACHE_TTL_MS = HOUR_MS;
+  REFRESH_TICK_MS = 15 * 60 * 1000;
   NOTIFY_INTERVAL_MS = DAY_MS;
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.20.0", CEREFOX_VERSION = "1.20.0", EF_LAST_CHANGED = "1.19.0";
+var EF_VERSION = "1.22.0", CEREFOX_VERSION = "1.22.0", EF_LAST_CHANGED = "1.22.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/embeddings/onnx-embedder.ts
@@ -63952,7 +63979,7 @@ async function warnIfSchemaVersionMismatch(supabase) {
     if (!bundled)
       return;
     if (compareSemver(deployed, bundled) < 0) {
-      process.stderr.write(`[cerefox-mcp] ⚠  schema version mismatch: this client bundles v${bundled} but the deployed schema is v${deployed}. Run \`cerefox server deploy\` to update it. Tools may behave unexpectedly until then.
+      process.stderr.write(`[cerefox-mcp] ⚠  schema version mismatch: this client bundles v${bundled} but the deployed schema is v${deployed}. Run \`${progName()} server deploy\` to update it. Tools may behave unexpectedly until then.
 `);
     }
   } catch {}
@@ -66357,7 +66384,7 @@ end
 complete -c ${prog} -f -a '(__${fn}_complete)'
 `;
 }
-function progName() {
+function progName2() {
   return buildProgram().name();
 }
 function fnId(prog) {
@@ -66365,7 +66392,7 @@ function fnId(prog) {
 }
 function scriptFor(shell) {
   const nodes = collectNodes();
-  const prog = progName();
+  const prog = progName2();
   const fn = fnId(prog);
   switch (shell) {
     case "bash":
@@ -66397,7 +66424,7 @@ async function installMode(options) {
     throw userError(`Unsupported --shell "${shell}". Use bash, zsh, or fish.`);
   }
   const home = homedir3();
-  const prog = progName();
+  const prog = progName2();
   const rcBegin = rcBeginFor(prog);
   const rcEnd = rcEndFor(prog);
   const scriptPath = join3(home, `.${prog}-completion.${shell}`);
@@ -66445,7 +66472,7 @@ async function action2(target, options) {
   println(scriptFor(target));
   if (process.stdout.isTTY) {
     eprintln(c.dim(`
-# Tip: \`cerefox completion install\` writes this + wires your shell rc automatically.`));
+# Tip: \`${progName()} completion install\` writes this + wires your shell rc automatically.`));
   }
 }
 function registerCompletion(program) {
@@ -66655,7 +66682,7 @@ function action4(options) {
     });
     return;
   }
-  println(c.bold("Runtime config keys (stored in cerefox_config; read with `cerefox config get <key>`):"));
+  println(c.bold(`Runtime config keys (stored in cerefox_config; read with \`${progName()} config get <key>\`):`));
   let group = null;
   for (const spec of CONFIG_CATALOG) {
     if (spec.group !== group) {
@@ -68052,7 +68079,7 @@ function delegatedWrite(writer, opts) {
   if (result.error) {
     const err = result.error;
     if (err.code === "ENOENT") {
-      throw new Error(`${writer.label}: \`${cmd}\` not found on PATH. ` + `Install ${writer.label} (https://docs.claude.com/en/docs/claude-code) ` + `and re-run \`cerefox configure-agent --tool ${writer.id}\`.`);
+      throw new Error(`${writer.label}: \`${cmd}\` not found on PATH. ` + `Install ${writer.label} (https://docs.claude.com/en/docs/claude-code) ` + `and re-run \`${progName()} configure-agent --tool ${writer.id}\`.`);
     }
     throw new Error(`${writer.label}: failed to spawn \`${cmd}\`: ${err.message}`);
   }
@@ -68169,18 +68196,18 @@ async function action7(documentId, options) {
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e);
     if (isMissingFunctionError(message, "cerefox_delete_document")) {
-      throw systemError(options.reason ? `This server is behind: \`--reason\` needs schema 0.12.0 or newer. ` + `Run \`cerefox server deploy\` and retry, or retry without --reason.` : `The delete did not run: the server has no matching cerefox_delete_document ` + `(mid-deploy window, or an old schema). Run \`cerefox server deploy\` and retry.`);
+      throw systemError(options.reason ? `This server is behind: \`--reason\` needs schema 0.12.0 or newer. ` + `Run \`${progName()} server deploy\` and retry, or retry without --reason.` : `The delete did not run: the server has no matching cerefox_delete_document ` + `(mid-deploy window, or an old schema). Run \`${progName()} server deploy\` and retry.`);
     }
     throw e;
   }
   if (result === null) {
     const { data: check, error: checkError } = await client.raw.from("cerefox_documents").select("deleted_at").eq("id", documentId).maybeSingle();
     if (checkError) {
-      warn(`Delete submitted, but the follow-up verification read failed (${checkError.message}). ` + `Confirm with: cerefox document get ${documentId}`);
+      warn(`Delete submitted, but the follow-up verification read failed (${checkError.message}). ` + `Confirm with: ${progName()} document get ${documentId}`);
       return;
     }
     if (!check?.deleted_at) {
-      throw systemError(`The delete did not take effect — the server has no matching ` + `cerefox_delete_document (mid-deploy window, or an old schema). ` + `Run \`cerefox server deploy\` and retry.`);
+      throw systemError(`The delete did not take effect — the server has no matching ` + `cerefox_delete_document (mid-deploy window, or an old schema). ` + `Run \`${progName()} server deploy\` and retry.`);
     }
   }
   if (result?.already_deleted) {
@@ -68203,7 +68230,7 @@ function registerDeleteDoc(program) {
 init_cli_core();
 init__utils();
 init_client();
-var SERVER_BEHIND = "The sweep did not run: this server has no cerefox_find_dead_links (needs schema 0.12.2). " + "Run `cerefox server deploy`, then retry.";
+var serverBehind = () => "The sweep did not run: this server has no cerefox_find_dead_links (needs schema 0.12.2). " + `Run \`${progName()} server deploy\`, then retry.`;
 async function action8(options) {
   const client = getClient();
   let rows;
@@ -68212,12 +68239,12 @@ async function action8(options) {
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e);
     if (isMissingFunctionError(message, "cerefox_find_dead_links")) {
-      throw systemError(SERVER_BEHIND);
+      throw systemError(serverBehind());
     }
     throw e;
   }
   if (rows === null)
-    throw systemError(SERVER_BEHIND);
+    throw systemError(serverBehind());
   if (options.json) {
     printJson(rows);
     return;
@@ -68479,10 +68506,16 @@ async function applyRpcs(opts) {
   }
 }
 
+// src/cli/util/npx-env.ts
+function nestedNpxEnv(env = process.env) {
+  const { npm_config_package: _leaked, ...rest } = env;
+  return rest;
+}
+
 // src/cli/commands/deploy-server.ts
 function commandSucceeds(cmd, args) {
   try {
-    const r = spawnSync2(cmd, args, { encoding: "utf8", timeout: 15000 });
+    const r = spawnSync2(cmd, args, { encoding: "utf8", timeout: 15000, env: nestedNpxEnv() });
     return r.status === 0;
   } catch {
     return false;
@@ -68568,7 +68601,8 @@ async function action10(options) {
   ${c.red("✗")} ${ch.label}`);
       eprintln(c.dim(`    → ${ch.remediation}`));
     }
-    eprintln("\nFix the above and re-run `cerefox server deploy` (it's idempotent).");
+    eprintln(`
+Fix the above and re-run \`${progName()} server deploy\` (it's idempotent).`);
     process.exit(1);
   }
   println(c.green(`
@@ -68689,7 +68723,8 @@ Proceed with deployment to Supabase?`, true);
         encoding: "utf8",
         stdio: ["inherit", "pipe", "pipe"],
         cwd: workdir,
-        timeout: 120000
+        timeout: 120000,
+        env: nestedNpxEnv()
       });
       if (r.stdout)
         process.stdout.write(r.stdout);
@@ -68717,9 +68752,9 @@ ${r.stderr ?? ""}`);
         eprintln(c.dim("     published yet, and bundling fails."));
         eprintln(c.dim("     Your deployed functions were NOT changed — the previous version is"));
         eprintln(c.dim("     still serving, so nothing is down."));
-        eprintln(c.cyan("   → Wait a few minutes, then re-run: cerefox server deploy --functions-only"));
+        eprintln(c.cyan(`   → Wait a few minutes, then re-run: ${progName()} server deploy --functions-only`));
       } else {
-        eprintln(c.dim("   Re-run `cerefox server deploy --functions-only` after fixing the cause."));
+        eprintln(c.dim(`   Re-run \`${progName()} server deploy --functions-only\` after fixing the cause.`));
       }
       process.exit(1);
     }
@@ -68738,15 +68773,16 @@ ${r.stderr ?? ""}`);
       println(c.cyan(`
    ℹ  The primitive Edge Functions now require the Cerefox access token.
 ` + `      If CEREFOX_ACCESS_TOKENS is unset they reject ALL callers (fail closed) —
-` + "      GPT Actions, remote HTTP, and `cerefox doctor`. Generate it now:\n" + `        cerefox token generate
+` + `      GPT Actions, remote HTTP, and \`${progName()} doctor\`. Generate it now:
+` + `        ${progName()} token generate
 ` + `      (or manually: supabase secrets set CEREFOX_ACCESS_TOKENS=<token> --project-ref ${ref})
 ` + "      Migration + client cutover: docs/specs/ef-auth-migration-design.md §6."));
     }
   }
   println(c.green(`
 ✓ Server deploy complete.`));
-  println(c.dim("Verify with: cerefox doctor"));
-  println(c.dim("Refresh the bundled guides: cerefox guides ingest"));
+  println(c.dim(`Verify with: ${progName()} doctor`));
+  println(c.dim(`Refresh the bundled guides: ${progName()} guides ingest`));
 }
 function efDeployArgs(ef, workdir, projectRef) {
   const args = ["--yes", "supabase", "functions", "deploy", ef, "--use-api", "--workdir", workdir];
@@ -68797,7 +68833,7 @@ async function action11(documentId, options) {
   if (!doc)
     throw notFound(`Document ${documentId} not found.`);
   if (doc.deleted_at) {
-    throw userError(`Document ${documentId} is soft-deleted — restore it first (cerefox document restore).`);
+    throw userError(`Document ${documentId} is soft-deleted — restore it first (${progName()} document restore).`);
   }
   const metaTouched = sets.length > 0 || unsets.length > 0;
   const newTitle = hasTitle ? options.title.trim() : doc.title;
@@ -68824,7 +68860,7 @@ async function action11(documentId, options) {
     });
     if (metaErr) {
       if (metaErr.message?.includes("CEREFOX_BAD_METADATA")) {
-        throw userError(`Document ${documentId} has non-object metadata; a patch cannot repair it. ` + `Repair it first with: cerefox document set-metadata ${documentId} --replace --json '<the intended object>'`);
+        throw userError(`Document ${documentId} has non-object metadata; a patch cannot repair it. ` + `Repair it first with: ${progName()} document set-metadata ${documentId} --replace --json '<the intended object>'`);
       }
       throw systemError(`Metadata update failed: ${metaErr.message}`);
     }
@@ -68843,7 +68879,7 @@ async function action11(documentId, options) {
   }
   println(c.green(`✓ Edited "${newTitle}" (id: ${documentId}).`));
   if (titleChanged) {
-    println(c.dim("  Title changed: FTS refreshed; semantic embeddings update on next `cerefox server reindex`."));
+    println(c.dim(`  Title changed: FTS refreshed; semantic embeddings update on next \`${progName()} server reindex\`.`));
   }
 }
 function collect(value, prev) {
@@ -68884,21 +68920,21 @@ async function action12(documentId, options) {
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e);
     if (isMissingFunctionError(message, "cerefox_restore_document")) {
-      throw systemError(options.reason ? `This server is behind: \`--reason\` needs schema 0.12.0 or newer. ` + `Run \`cerefox server deploy\` and retry, or retry without --reason.` : `The restore did not run: the server has no matching cerefox_restore_document ` + `(mid-deploy window, or an old schema). Run \`cerefox server deploy\` and retry.`);
+      throw systemError(options.reason ? `This server is behind: \`--reason\` needs schema 0.12.0 or newer. ` + `Run \`${progName()} server deploy\` and retry, or retry without --reason.` : `The restore did not run: the server has no matching cerefox_restore_document ` + `(mid-deploy window, or an old schema). Run \`${progName()} server deploy\` and retry.`);
     }
     throw e;
   }
   if (result === null) {
     const { data: check, error: checkError } = await client.raw.from("cerefox_documents").select("deleted_at").eq("id", documentId).maybeSingle();
     if (checkError) {
-      warn(`Restore submitted, but the follow-up verification read failed (${checkError.message}). ` + `Confirm with: cerefox document get ${documentId}`);
+      warn(`Restore submitted, but the follow-up verification read failed (${checkError.message}). ` + `Confirm with: ${progName()} document get ${documentId}`);
       return;
     }
     if (!check) {
       throw systemError(`Document ${documentId} no longer exists — it may have been purged concurrently. Nothing was restored.`);
     }
     if (check.deleted_at) {
-      throw systemError(`The restore did not take effect — the server has no matching ` + `cerefox_restore_document (mid-deploy window, or an old schema). ` + `Run \`cerefox server deploy\` and retry.`);
+      throw systemError(`The restore did not take effect — the server has no matching ` + `cerefox_restore_document (mid-deploy window, or an old schema). ` + `Run \`${progName()} server deploy\` and retry.`);
     }
   }
   if (result && result.restored === false) {
@@ -68979,15 +69015,15 @@ async function action13(documentId, options) {
     if (/not found/i.test(msg))
       throw notFound(`Document ${documentId} not found (or is deleted).`);
     if (msg.includes("CEREFOX_METADATA_CONFLICT")) {
-      throw userError(`The metadata of ${documentId} changed since you read it. Re-read it ` + `(cerefox document get ${documentId} --outline), reapply your change, and retry ` + `with the new --expected-metadata-revision.`);
+      throw userError(`The metadata of ${documentId} changed since you read it. Re-read it ` + `(${progName()} document get ${documentId} --outline), reapply your change, and retry ` + `with the new --expected-metadata-revision.`);
     }
     if (msg.includes("CEREFOX_METADATA_TOKEN_REQUIRED")) {
-      throw userError(`--replace discards every key you do not list, so it needs --expected-metadata-revision ` + `(from cerefox document get ${documentId} --outline) or --last-write-wins.`);
+      throw userError(`--replace discards every key you do not list, so it needs --expected-metadata-revision ` + `(from ${progName()} document get ${documentId} --outline) or --last-write-wins.`);
     }
     throw systemError(`Could not set metadata: ${msg}`);
   }
   if (!rows || rows.length === 0) {
-    throw systemError("cerefox_set_document_metadata returned no data.", "Verify the RPC is deployed: `cerefox server deploy`.");
+    throw systemError("cerefox_set_document_metadata returned no data.", `Verify the RPC is deployed: \`${progName()} server deploy\`.`);
   }
   const row = rows[0];
   if (options.jsonOut) {
@@ -69060,7 +69096,7 @@ function openInBrowser(path) {
 function resolveDoc(topic) {
   const doc = readBundledDoc(topic);
   if (!doc) {
-    throw notFound(`No bundled guide named "${topic}".`, "Run `cerefox guides list` to see available topics.");
+    throw notFound(`No bundled guide named "${topic}".`, `Run \`${progName()} guides list\` to see available topics.`);
   }
   return doc;
 }
@@ -69074,7 +69110,7 @@ function listAction() {
   println("");
   printTable(docs.map((d) => ({ topic: d.topic, size_kb: Math.round(d.size / 1024) + " KB" })));
   println("");
-  println(c.dim("Open with `cerefox guides open <topic>` (browser) or `cerefox guides show <topic>` (stdout)."));
+  println(c.dim(`Open with \`${progName()} guides open <topic>\` (browser) or \`${progName()} guides show <topic>\` (stdout).`));
 }
 function openAction(topic) {
   const doc = resolveDoc(topic);
@@ -69197,8 +69233,8 @@ async function setArchived(versionId, archived, options) {
   println(c.green(`✓ Version ${data.version_number} (${versionId}) ${op}d.`));
 }
 function registerVersionArchive(parent) {
-  parent.command("archive").description("Archive a document version (protect it from version cleanup).").argument("<version-id>", "UUID of the version (from `cerefox version list`).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action((versionId, options) => setArchived(versionId, true, options));
-  parent.command("unarchive").description("Unarchive a document version (allow version cleanup again).").argument("<version-id>", "UUID of the version (from `cerefox version list`).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action((versionId, options) => setArchived(versionId, false, options));
+  parent.command("archive").description("Archive a document version (protect it from version cleanup).").argument("<version-id>", `UUID of the version (from \`${progName()} document version list\`).`).option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action((versionId, options) => setArchived(versionId, true, options));
+  parent.command("unarchive").description("Unarchive a document version (allow version cleanup again).").argument("<version-id>", `UUID of the version (from \`${progName()} document version list\`).`).option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action((versionId, options) => setArchived(versionId, false, options));
 }
 
 // ../../node_modules/.bun/ora@9.4.1/node_modules/ora/index.js
@@ -72680,7 +72716,7 @@ function checkConfig() {
       name: "config",
       status: "error",
       detail: `Could not resolve config dir: ${err instanceof Error ? err.message : String(err)}`,
-      hint: "Run `cerefox init` to bootstrap."
+      hint: `Run \`${progName()} init\` to bootstrap.`
     };
   }
   if (!existsSync12(envPath)) {
@@ -72696,7 +72732,7 @@ function checkConfig() {
       name: "config",
       status: "error",
       detail: `No config file at ${envPath}`,
-      hint: "Run `cerefox init` to create one."
+      hint: `Run \`${progName()} init\` to create one.`
     };
   }
   let modeDetail = "";
@@ -72774,7 +72810,7 @@ async function checkRetiredEnvVars() {
       hint: "Safe to delete those lines; nothing reads them."
     };
   }
-  const moves = pending.map((v) => `cerefox config set ${v.configKey} ${(process.env[v.name] ?? "").trim()}`).join(`
+  const moves = pending.map((v) => `${progName()} config set ${v.configKey} ${(process.env[v.name] ?? "").trim()}`).join(`
       `);
   const prunedWasDisabled = pending.some((v) => v.configKey.startsWith("version_"));
   return {
@@ -72788,6 +72824,17 @@ async function checkRetiredEnvVars() {
     Then delete those lines from your .env — nothing reads them.`
   };
 }
+function dataApiHint(status, body, key) {
+  if (status !== 401)
+    return "Verify CEREFOX_SUPABASE_URL.";
+  if (key.trim().startsWith("cfx_lak_")) {
+    if (/PGRST30\d|JWT/.test(body)) {
+      return "This Cerefox Local container is older than 1.22.0 and cannot accept an API key here. " + "Upgrade the container image to 1.22.0 or later.";
+    }
+    return "The server does not accept this API key. Check CEREFOX_SUPABASE_KEY against the server's key.";
+  }
+  return "Verify CEREFOX_SUPABASE_KEY (use the service-role / sb_secret key).";
+}
 async function checkSupabase() {
   let settings;
   try {
@@ -72797,7 +72844,7 @@ async function checkSupabase() {
       name: "supabase",
       status: "error",
       detail: `Could not load settings: ${err instanceof Error ? err.message : String(err)}`,
-      hint: "Run `cerefox init`."
+      hint: `Run \`${progName()} init\`.`
     };
   }
   if (!settings.supabaseUrl || !settings.supabaseKey) {
@@ -72805,7 +72852,7 @@ async function checkSupabase() {
       name: "supabase",
       status: "error",
       detail: "CEREFOX_SUPABASE_URL or CEREFOX_SUPABASE_KEY is not set.",
-      hint: "Run `cerefox init` to bootstrap."
+      hint: `Run \`${progName()} init\` to bootstrap.`
     };
   }
   try {
@@ -72817,11 +72864,12 @@ async function checkSupabase() {
       }
     });
     if (!resp.ok) {
+      const body = await resp.text().catch(() => "");
       return {
         name: "supabase",
         status: "error",
         detail: `Data API returned ${resp.status} ${resp.statusText}`,
-        hint: resp.status === 401 ? "Verify CEREFOX_SUPABASE_KEY (use the service-role / sb_secret key)." : "Verify CEREFOX_SUPABASE_URL."
+        hint: dataApiHint(resp.status, body, settings.supabaseKey)
       };
     }
     return {
@@ -72853,7 +72901,7 @@ async function checkOpenAI() {
       name: "openai",
       status: "warn",
       detail: "No OPENAI_API_KEY / CEREFOX_OPENAI_API_KEY set.",
-      hint: "Required for `cerefox search` (semantic mode) and ingest. Set in your .env."
+      hint: `Required for \`${progName()} search\` (semantic mode) and ingest. Set in your .env.`
     };
   }
   try {
@@ -72984,7 +73032,7 @@ async function checkReviewWorkflow() {
       name,
       status: "warn",
       detail: "review_workflow_enabled is not set — treated as OFF until the schema is updated",
-      hint: "Run `cerefox server deploy --schema-only` (v1.13.0+) to seed it."
+      hint: `Run \`${progName()} server deploy --schema-only\` (v1.13.0+) to seed it.`
     };
   }
   const on = raw.trim().toLowerCase() === "true";
@@ -72992,7 +73040,7 @@ async function checkReviewWorkflow() {
     name,
     status: "ok",
     detail: on ? "ON — agent writes land pending_review; review_status is shown everywhere" : "OFF — review_status is hidden everywhere (still recorded from author_type)",
-    hint: on ? undefined : "Turn it on with `cerefox config set review_workflow_enabled true`."
+    hint: on ? undefined : `Turn it on with \`${progName()} config set review_workflow_enabled true\`.`
   };
 }
 async function checkTrashAutoPurge() {
@@ -73031,7 +73079,7 @@ async function checkTrashAutoPurge() {
       name,
       status: "ok",
       detail: "off — the trash is only emptied by hand",
-      hint: "Opt in with `cerefox config set trash_auto_purge_enabled true` (period: trash_retention_days)."
+      hint: `Opt in with \`${progName()} config set trash_auto_purge_enabled true\` (period: trash_retention_days).`
     };
   }
   return {
@@ -73066,7 +73114,7 @@ async function checkEmbedderMismatch() {
             name: EMBEDDER_CHECK_NAME,
             status: "warn",
             detail: `configured "${active}", but the model is not downloaded yet; the first search or write will fetch it (~130 MB).`,
-            hint: "Fetch it now with `cerefox embedder-warmup` (Cerefox Local: `cerefox-local embedder-warmup`); it resumes if the connection drops."
+            hint: `Fetch it now with \`${progName()} embedder-warmup\`${progName() === "cerefox" ? " (Cerefox Local: `cerefox-local embedder-warmup`)" : ""}; it resumes if the connection drops.`
           };
         }
       }
@@ -73080,7 +73128,7 @@ async function checkEmbedderMismatch() {
       name: EMBEDDER_CHECK_NAME,
       status: "warn",
       detail: `configured "${active}" but existing chunks were embedded with ${stale.map((r) => `"${r}"`).join(", ")} — semantic search across them is broken.`,
-      hint: "Run `cerefox server reindex` to re-embed everything with the configured embedder."
+      hint: `Run \`${progName()} server reindex\` to re-embed everything with the configured embedder.`
     };
   } catch (err) {
     return {
@@ -73188,7 +73236,7 @@ async function checkContentFormat() {
       name: CONTENT_FORMAT_CHECK_NAME,
       status: "skipped",
       detail: `${legacy} of ${total} document(s) use the legacy reconstruction format (format 1).`,
-      hint: "Harmless — they auto-convert on next edit. To convert them all now: `cerefox server migrate-format` (re-embeds, so try `--dry-run` first). To read what chunk formats are: `cerefox guides show content-format`."
+      hint: `Harmless — they auto-convert on next edit. To convert them all now: \`${progName()} server migrate-format\` (re-embeds, so try \`--dry-run\` first). To read what chunk formats are: \`${progName()} guides show content-format\`.`
     };
   }
 }
@@ -73221,7 +73269,7 @@ async function checkMetadataHealth() {
     name: METADATA_HEALTH_CHECK_NAME,
     status: "skipped",
     detail: `${probe.rows.length} document(s) hold non-object metadata: ${sample}${probe.rows.length > 3 ? ", …" : ""}.`,
-    hint: "Writes that would merge onto these rows are refused (#212). Repair each with `cerefox document set-metadata <id> --replace --json '<the intended object>'`."
+    hint: `Writes that would merge onto these rows are refused (#212). Repair each with \`${progName()} document set-metadata <id> --replace --json '<the intended object>'\`.`
   };
 }
 function hasCerefoxInJsonFile(path) {
@@ -73250,7 +73298,7 @@ async function checkWebDaemon() {
       name: "web server",
       status: "skipped",
       detail: `no daemon running (stale pidfile for process ${status.info.pid}).`,
-      hint: "Clean it up: cerefox web stop"
+      hint: `Clean it up: ${progName()} web stop`
     };
   }
   if (!status.responding) {
@@ -73300,7 +73348,7 @@ function checkMcpConfigs() {
       name: "mcp clients",
       status: isLocalBackend() ? "skipped" : "warn",
       detail: isLocalBackend() ? "checked from inside the container — host MCP configs are not visible here." : "No MCP client configs reference Cerefox.",
-      hint: isLocalBackend() ? "Configure agents on the host with `cerefox-local configure-agent`." : "Run `cerefox configure-agent --tool claude-code` (or `--tool claude-desktop`) to wire up a client."
+      hint: isLocalBackend() ? "Configure agents on the host with `cerefox-local configure-agent`." : `Run \`${progName()} configure-agent --tool claude-code\` (or \`--tool claude-desktop\`) to wire up a client.`
     };
   }
   return {
@@ -73398,7 +73446,7 @@ async function checkEdgeFunctionsCompat() {
       name: "edge functions",
       status: "skipped",
       detail: "No CEREFOX_ACCESS_TOKEN set; EF version check skipped.",
-      hint: "Run `cerefox token generate` to enable client↔server version checks."
+      hint: `Run \`${progName()} token generate\` to enable client↔server version checks.`
     };
   }
   let compat;
@@ -73550,11 +73598,11 @@ async function action17(options) {
     const needsEf = stale("edge functions");
     let remediation = null;
     if (needsSchema && needsEf) {
-      remediation = "This release needs a server update (schema + RPCs + Edge Functions): cerefox server deploy";
+      remediation = `This release needs a server update (schema + RPCs + Edge Functions): ${progName()} server deploy`;
     } else if (needsSchema) {
-      remediation = "This release needs a schema + RPC update: cerefox server deploy --schema-only";
+      remediation = `This release needs a schema + RPC update: ${progName()} server deploy --schema-only`;
     } else if (needsEf) {
-      remediation = "This release needs an Edge Function update: cerefox server deploy --functions-only";
+      remediation = `This release needs an Edge Function update: ${progName()} server deploy --functions-only`;
     }
     if (remediation) {
       println(cErr.yellow("→ " + remediation));
@@ -73642,7 +73690,7 @@ async function action18(options) {
     doc: auditDocLabel(row.doc_title, row.document_id, row.operation).slice(0, 40),
     author: (row.author ?? "") + (row.author_type ? `(${row.author_type})` : ""),
     size_delta: row.size_before !== null && row.size_after !== null ? `${row.size_before} → ${row.size_after}` : "",
-    change: (metadataChangeSummary(row.metadata_before, row.metadata_after) ?? "").slice(0, 60)
+    change: (metadataChangeSummary(row.metadata_before, row.metadata_after) ?? storeChangeSummary(row.operation, row.description) ?? "").slice(0, 60)
   })));
 }
 function registerGetAuditLog(program) {
@@ -74667,7 +74715,7 @@ async function readContent(path, paste) {
     return { content, titleFromPath: undefined };
   }
   if (!path) {
-    throw userError("Provide a file path or use --paste.", "Example: cerefox document ingest notes.md --title 'My Note'");
+    throw userError("Provide a file path or use --paste.", `Example: ${progName()} document ingest notes.md --title 'My Note'`);
   }
   let content;
   try {
@@ -74709,7 +74757,7 @@ async function action20(path, options) {
   }
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
-    throw userError("Supabase credentials not configured — run `cerefox init` first.");
+    throw userError(`Supabase credentials not configured — run \`${progName()} init\` first.`);
   }
   if (!settings.openaiApiKey && resolveEmbedderKind() !== "local") {
     throw userError("OPENAI_API_KEY not set — required for embeddings during ingest.");
@@ -74821,7 +74869,7 @@ async function runTool(toolName, args) {
   }
 }
 function registerDocumentInsert(program) {
-  program.command("insert <document-id>").description("Add text to a document without resending it (purely additive)").requiredOption("-t, --text <text>", "Markdown to insert. Use '-' for stdin or '@path' for a file.").option("-p, --position <position>", "end_of_document | end_of_section | after_heading | before_heading", "end_of_document").option("-a, --anchor-heading <heading>", "Heading line, or a ' > ' path. Required unless end_of_document.").option("--section-part <part>", "own_body | subtree — required when the target section has child sections").requiredOption("-e, --expected-content-hash <hash>", "content_hash you are basing this on (cerefox document get --outline shows it)").addOption(authorOption("write", { short: false })).addOption(requestorAliasOption()).option("--author-type <type>", "user (default for the CLI) or agent, when scripting on an agent's behalf", "user").action(async (documentId, options) => {
+  program.command("insert <document-id>").description("Add text to a document without resending it (purely additive)").requiredOption("-t, --text <text>", "Markdown to insert. Use '-' for stdin or '@path' for a file.").option("-p, --position <position>", "end_of_document | end_of_section | after_heading | before_heading", "end_of_document").option("-a, --anchor-heading <heading>", "Heading line, or a ' > ' path. Required unless end_of_document.").option("--section-part <part>", "own_body | subtree — required when the target section has child sections").requiredOption("-e, --expected-content-hash <hash>", `content_hash you are basing this on (${progName()} document get --outline shows it)`).addOption(authorOption("write", { short: false })).addOption(requestorAliasOption()).option("--author-type <type>", "user (default for the CLI) or agent, when scripting on an agent's behalf", "user").action(async (documentId, options) => {
     await runTool("cerefox_insert", {
       document_id: documentId,
       text: resolveText(options.text, "--text"),
@@ -74902,7 +74950,7 @@ async function action21(dir, options) {
   const metadata = parseJsonObjectArg(options.metadata, "--metadata");
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
-    throw userError("Supabase credentials not configured — run `cerefox init` first.");
+    throw userError(`Supabase credentials not configured — run \`${progName()} init\` first.`);
   }
   if (!settings.openaiApiKey && resolveEmbedderKind() !== "local") {
     throw userError("OPENAI_API_KEY not set — required for embeddings during ingest.");
@@ -75032,7 +75080,7 @@ function answersFromEnvFile(path) {
   const required = ["CEREFOX_SUPABASE_URL", "CEREFOX_SUPABASE_KEY", "OPENAI_API_KEY"];
   for (const key of required) {
     if (!parsed[key] || parsed[key].trim() === "") {
-      throw userError(`Existing .env at ${path} is missing required key "${key}".`, `Fix it manually or run \`cerefox init --force\` to start fresh.`);
+      throw userError(`Existing .env at ${path} is missing required key "${key}".`, `Fix it manually or run \`${progName()} init --force\` to start fresh.`);
     }
   }
   return {
@@ -75077,7 +75125,8 @@ async function promptForAnswers() {
   });
   println("");
   println(c.cyan("▶ Step 4/5 — Direct Postgres connection (optional for npm-installed users)"));
-  println(c.dim("  Only needed for `cerefox server deploy` (schema deploy + migrations).\n" + `  You can skip this and set CEREFOX_DATABASE_URL later — press Enter.
+  println(c.dim(`  Only needed for \`${progName()} server deploy\` (schema deploy + migrations).
+` + `  You can skip this and set CEREFOX_DATABASE_URL later — press Enter.
 ` + "  Format: postgresql://postgres.<project-ref>:<pw>@…:5432/postgres?sslmode=require"));
   const databaseUrl = await ask({
     type: "text",
@@ -75222,7 +75271,7 @@ async function maybeOfferServerDeploy() {
     if (yes)
       launchDeployServer();
     else
-      println(c.dim("  Skipped. Run `cerefox server deploy` later (or `cerefox doctor` to recheck)."));
+      println(c.dim(`  Skipped. Run \`${progName()} server deploy\` later (or \`${progName()} doctor\` to recheck).`));
     println("");
     return;
   }
@@ -75233,7 +75282,7 @@ async function maybeOfferServerDeploy() {
     if (yes)
       launchDeployServer();
     else
-      println(c.dim("  Skipped. Run `cerefox server deploy` when ready."));
+      println(c.dim(`  Skipped. Run \`${progName()} server deploy\` when ready.`));
     println("");
     return;
   }
@@ -75252,7 +75301,7 @@ async function postWriteLifecycle(envPath, options) {
       await Promise.resolve().then(() => init_sync_self_docs());
       await runSyncSelfDocs({});
     } catch (err) {
-      warn(`Self-doc ingest failed: ${err instanceof Error ? err.message : String(err)}. Run \`cerefox guides ingest\` manually after init.`);
+      warn(`Self-doc ingest failed: ${err instanceof Error ? err.message : String(err)}. Run \`${progName()} guides ingest\` manually after init.`);
     }
     println("");
   }
@@ -75276,9 +75325,9 @@ async function postWriteLifecycle(envPath, options) {
   }
   println("");
   println(c.green("Done. Try:"));
-  println(c.dim("  cerefox doctor                  # verify everything"));
-  println(c.dim('  cerefox search "…"              # search the KB'));
-  println(c.dim("  cerefox document ingest <file>  # add a doc"));
+  println(c.dim(`  ${progName()} doctor                  # verify everything`));
+  println(c.dim(`  ${progName()} search "…"              # search the KB`));
+  println(c.dim(`  ${progName()} document ingest <file>  # add a doc`));
   println("");
   println(c.dim(`  Config in effect: ${envPath}`));
 }
@@ -75379,7 +75428,7 @@ async function action23(options) {
       println("");
       println(c.green(`✓ Using existing config at ${cwdEnv}`));
       println(c.dim(`  TS reads it via the legacy dev-mode fallback (~/.cerefox/.env not present).`));
-      println(c.dim(`  Run \`cerefox init\` again later to migrate to the new home.`));
+      println(c.dim(`  Run \`${progName()} init\` again later to migrate to the new home.`));
       println("");
       await postWriteLifecycle(cwdEnv, options);
       return;
@@ -75420,7 +75469,7 @@ async function action24(options) {
       throw systemError(`Project lookup failed: ${projectError.message}`);
     }
     if (!project) {
-      throw userError(`Project "${options.project}" not found.`, "Run `cerefox project list` to see available names.");
+      throw userError(`Project "${options.project}" not found.`, `Run \`${progName()} project list\` to see available names.`);
     }
     projectId = project.id;
   }
@@ -75736,7 +75785,7 @@ function warnLargeBulkWrite(opts) {
 async function action29(options) {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
-    throw userError("Supabase credentials not configured — run `cerefox init` first.");
+    throw userError(`Supabase credentials not configured — run \`${progName()} init\` first.`);
   }
   if (!settings.openaiApiKey && resolveEmbedderKind() !== "local") {
     throw userError("OPENAI_API_KEY not set — required for embeddings.");
@@ -76007,7 +76056,7 @@ async function action31(target, options) {
   }
   const trashedInFile = payload.documents.filter((d) => d.deleted_at != null).length;
   if (trashedInFile > 0) {
-    println(c.dim(`  trashed documents in file: ${trashedInFile} — restored as trash ` + "(still deleted; recover with `cerefox document restore`)"));
+    println(c.dim(`  trashed documents in file: ${trashedInFile} — restored as trash ` + `(still deleted; recover with \`${progName()} document restore\`)`));
   }
   println("");
   const client = getClient();
@@ -76126,7 +76175,7 @@ async function action31(target, options) {
   }
 }
 function registerRestore(program) {
-  program.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", "Backup file (or directory; most recent is picked) produced by `cerefox backup`.").option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored. Project memberships are restored from the backup itself (format 2+).").action(action31);
+  program.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", `Backup file (or directory; most recent is picked) produced by \`${progName()} backup\`.`).option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored. Project memberships are restored from the backup itself (format 2+).").action(action31);
 }
 
 // src/cli/commands/search.ts
@@ -76141,13 +76190,13 @@ async function embedQuery(query) {
   const settings = loadSettings();
   const apiKey = settings.openaiApiKey;
   if (!apiKey && resolveEmbedderKind() !== "local") {
-    throw userError("OPENAI_API_KEY (or CEREFOX_OPENAI_API_KEY) is required for search.", "Set the key in your .env, or run `cerefox init` to bootstrap.");
+    throw userError("OPENAI_API_KEY (or CEREFOX_OPENAI_API_KEY) is required for search.", `Set the key in your .env, or run \`${progName()} init\` to bootstrap.`);
   }
   try {
     return await getEmbedding(query, apiKey);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw systemError(`Failed to embed query: ${msg}`, "Run `cerefox doctor` to verify the OpenAI API path.");
+    throw systemError(`Failed to embed query: ${msg}`, `Run \`${progName()} doctor\` to verify the OpenAI API path.`);
   }
 }
 
@@ -76319,7 +76368,7 @@ async function action32(query, options) {
   }
 }
 function registerSearch(program) {
-  program.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: CEREFOX_SEARCH_ALPHA; else 0.7).").option("--min-score <float>", "Minimum cosine similarity threshold (default: the store's min_search_score; else 0.5, or 0.6 on a local-embedder store).").option("--min-term-coverage <float>", "OR-fallback keyword matches must cover at least this fraction of the query's meaningful terms to count as confident hits (default: the store's min_term_coverage; else 0.66; needs schema ≥ 0.9.1).").option("--max-bytes <n>", "Response size budget in bytes (default: CEREFOX_MAX_RESPONSE_BYTES or 200000).").addOption(authorOption("read")).addOption(requestorAliasOption()).option("--json", "Emit machine-readable JSON instead of the default text.").option("--only-metadata", "List matching docs (id, score, chunks, chars, partial/full) WITHOUT their content — like the web UI's collapsed result list. Grab a [id:…] then `cerefox document get <id>`.").action(action32);
+  program.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: CEREFOX_SEARCH_ALPHA; else 0.7).").option("--min-score <float>", "Minimum cosine similarity threshold (default: the store's min_search_score; else 0.5, or 0.6 on a local-embedder store).").option("--min-term-coverage <float>", "OR-fallback keyword matches must cover at least this fraction of the query's meaningful terms to count as confident hits (default: the store's min_term_coverage; else 0.66; needs schema ≥ 0.9.1).").option("--max-bytes <n>", "Response size budget in bytes (default: CEREFOX_MAX_RESPONSE_BYTES or 200000).").addOption(authorOption("read")).addOption(requestorAliasOption()).option("--json", "Emit machine-readable JSON instead of the default text.").option("--only-metadata", `List matching docs (id, score, chunks, chars, partial/full) WITHOUT their content — like the web UI's collapsed result list. Grab a [id:…] then \`${progName()} document get <id>\`.`).action(action32);
 }
 
 // src/cli/commands/self-update.ts
@@ -76384,7 +76433,7 @@ async function action33(options) {
   if (options.check) {
     if (newerRelease(target)) {
       println(c.yellow(`Update available: ${PKG_VERSION} → ${target}`));
-      println(c.dim("Run `cerefox self-update` to upgrade."));
+      println(c.dim(`Run \`${progName()} self-update\` to upgrade.`));
     }
     return;
   }
@@ -76415,12 +76464,12 @@ async function action33(options) {
   }
   println("");
   println("Next steps:");
-  println("  1. " + c.bold("cerefox server deploy") + "   apply this release's schema/RPC/EF updates");
-  println("  2. " + c.bold("cerefox guides ingest") + "   re-sync the bundled guides into your KB");
+  println("  1. " + c.bold(`${progName()} server deploy`) + "   apply this release's schema/RPC/EF updates");
+  println("  2. " + c.bold(`${progName()} guides ingest`) + "   re-sync the bundled guides into your KB");
   println(c.dim("  (order matters: the new client may require the new schema — run the deploy first)"));
 }
 function registerSelfUpdate(program) {
-  const desc = "Upgrade Cerefox in place. Alias: `cerefox upgrade`.";
+  const desc = `Upgrade Cerefox in place. Alias: \`${progName()} upgrade\`.`;
   const declaration = (cmd) => cmd.description(desc).option("--check", "Print current vs latest; do nothing.").option("--yes", "Non-interactive (skip confirmation).").option("--version <version>", "Pin a specific version (e.g. 0.5.1 or 0.6.0-rc.1).").action(action33);
   declaration(program.command("self-update"));
   declaration(program.command("upgrade"));
@@ -76461,7 +76510,7 @@ async function action34(options) {
   }
 }
 function registerStatus(program) {
-  program.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action34);
+  program.command("status").description(`Quick sanity check (fast subset of \`${progName()} doctor\`).`).option("--json", "Emit machine-readable JSON.").action(action34);
 }
 
 // src/cli/commands/api-key.ts
@@ -76574,7 +76623,7 @@ function generateAction(opts) {
   const envPath = resolveEnvFile();
   const existing = readEnvVar(envPath, ENV_NAME);
   if (existing) {
-    throw userError(`${ENV_NAME} is already set in ${envPath} (${mask(existing)}).`, "Use `cerefox api-key show` to see it, or `cerefox api-key rotate` to replace it. " + "Refusing to overwrite silently: any client already configured with the old key " + "would start getting 401s with no indication why.");
+    throw userError(`${ENV_NAME} is already set in ${envPath} (${mask(existing)}).`, `Use \`${progName()} api-key show\` to see it, or \`${progName()} api-key rotate\` to replace it. ` + "Refusing to overwrite silently: any client already configured with the old key " + "would start getting 401s with no indication why.");
   }
   println(c.bold("Minting a local API key"));
   writeKey(mint(), opts, "write");
@@ -76584,13 +76633,13 @@ function rotateAction(opts) {
   const envPath = resolveEnvFile();
   const existing = readEnvVar(envPath, ENV_NAME);
   if (!existing) {
-    throw userError(`No ${ENV_NAME} in ${envPath} — nothing to rotate.`, "Run `cerefox api-key generate` first.");
+    throw userError(`No ${ENV_NAME} in ${envPath} — nothing to rotate.`, `Run \`${progName()} api-key generate\` first.`);
   }
   println(c.bold("Rotating the local API key"));
   println(c.dim(`   replacing ${mask(existing)}`));
   writeKey(mint(), opts, "replace");
   println(c.yellow(`   The previous key stops working as soon as the server restarts.
-` + "   Update every remote client, then: cerefox web restart"));
+` + `   Update every remote client, then: ${progName()} web restart`));
 }
 function showAction2() {
   const envPath = resolveEnvFile();
@@ -76600,7 +76649,7 @@ function showAction2() {
     println(c.dim(`   none set in ${envPath}`));
     println(c.dim(`   The server is not gated: callers from any interface it is bound to can
 ` + `   reach it without a credential. That is fine while it binds 127.0.0.1.
-` + "   Mint one with: cerefox api-key generate"));
+` + `   Mint one with: ${progName()} api-key generate`));
     containerHint();
     return;
   }
@@ -76647,7 +76696,7 @@ function setSecret(setValue, projectRef, dryRun) {
     println(c.dim(`   (dry-run) npx supabase secrets set ${SECRET_NAME}=${shown}` + (projectRef ? ` --project-ref ${projectRef}` : "")));
     return;
   }
-  const r = spawnSync7("npx", args, { encoding: "utf8", stdio: "inherit" });
+  const r = spawnSync7("npx", args, { encoding: "utf8", stdio: "inherit", env: nestedNpxEnv() });
   if (r.status !== 0) {
     throw userError(`Failed to set the ${SECRET_NAME} Function secret.`, "Install the Supabase CLI and link the project (or pass --project-ref <ref>).");
   }
@@ -76681,7 +76730,7 @@ function printTokenOnce(token) {
   println(c.dim("     • Custom GPT → Configure → Actions → Authentication → API Key (Bearer)"));
   println(c.dim("     • Remote HTTP MCP → the Authorization: Bearer header"));
   println(c.dim("   If the GPT Actions schema changed this release, re-paste it too"));
-  println(c.dim("   (see docs/guides/connect-agents.md). Lose the token → `cerefox token rotate`."));
+  println(c.dim(`   (see docs/guides/connect-agents.md). Lose the token → \`${progName()} token rotate\`.`));
 }
 function generateAction2(opts) {
   const projectRef = opts.projectRef ?? parseProjectRef2(loadSettings().supabaseUrl);
@@ -76698,7 +76747,7 @@ function rotateAction2(opts) {
   const current = readEnvVar(envPath, LOCAL_NAME);
   if (opts.finalize) {
     if (!current) {
-      throw userError(`No ${LOCAL_NAME} in ${envPath} to finalize to.`, "Run `cerefox token generate` or `cerefox token rotate` first.");
+      throw userError(`No ${LOCAL_NAME} in ${envPath} to finalize to.`, `Run \`${progName()} token generate\` or \`${progName()} token rotate\` first.`);
     }
     println(c.bold("Finalizing rotation (dropping the previous token)…"));
     setSecret(current, projectRef, opts.dryRun);
@@ -76715,14 +76764,15 @@ function rotateAction2(opts) {
     printTokenOnce(token);
     println("");
     println(c.yellow(`   Both the new and previous tokens are accepted right now. Update every
-` + "   client to the new token, then run `cerefox token rotate --finalize`\n" + "   to stop accepting the old one."));
+` + `   client to the new token, then run \`${progName()} token rotate --finalize\`
+` + "   to stop accepting the old one."));
   }
 }
 function listAction2() {
   const envPath = resolveEnvFile();
   const local = readEnvVar(envPath, LOCAL_NAME);
   println(c.bold("Cerefox access token"));
-  println(local ? `   local (${LOCAL_NAME} in ${envPath}): ${c.green(mask2(local))}` : c.dim(`   no ${LOCAL_NAME} in ${envPath} — run \`cerefox token generate\``));
+  println(local ? `   local (${LOCAL_NAME} in ${envPath}): ${c.green(mask2(local))}` : c.dim(`   no ${LOCAL_NAME} in ${envPath} — run \`${progName()} token generate\``));
   println(c.dim(`   The server-side accepted set (${SECRET_NAME}) is write-only; list names/digests
 ` + "   with: npx supabase secrets list"));
 }
@@ -81957,6 +82007,14 @@ var STRIP_RESPONSE_HEADERS = [
   "proxy-authenticate",
   "proxy-authorization"
 ];
+function upstreamCredentials(headers, reason, internalJwt) {
+  const jwt = internalJwt.trim();
+  if (reason !== "valid_key" || !jwt)
+    return false;
+  headers.set("authorization", `Bearer ${jwt}`);
+  headers.set("apikey", jwt);
+  return true;
+}
 function registerPostgrestProxy(app) {
   const upstream = (process.env.CEREFOX_POSTGREST_UPSTREAM ?? "").trim().replace(/\/+$/, "");
   if (!upstream)
@@ -81968,6 +82026,7 @@ function registerPostgrestProxy(app) {
     const headers = new Headers(c.req.raw.headers);
     headers.delete("host");
     headers.delete("accept-encoding");
+    upstreamCredentials(headers, c.get("cerefoxAuthReason"), process.env.CEREFOX_SUPABASE_KEY ?? "");
     const method = c.req.method;
     const init = { method, headers };
     if (method !== "GET" && method !== "HEAD") {
@@ -82335,7 +82394,7 @@ async function assertServerCompatible() {
 ` + parts.join(`
 `) + `
 
-Redeploy your server:  cerefox server deploy
+Redeploy your server:  ${progName()} server deploy
 ` + `(or downgrade the client to match the deployed server).`);
 }
 async function buildWebServer(options = {}) {
@@ -82350,7 +82409,7 @@ async function buildWebServer(options = {}) {
 ⚠  Binding ${host} with NO API key configured.
 ` + `   Every read, write, delete and purge on this server is reachable by
 ` + `   anything that can connect to port ${port}, with no credential.
-` + `   Mint one:  cerefox api-key generate
+` + `   Mint one:  ${progName()} api-key generate
 `);
   }
   const app = buildApp();
@@ -82432,7 +82491,7 @@ function registerWeb(program) {
           break;
         case "port-conflict":
           eprintln(`A Cerefox web daemon is already running on :${outcome.info.port} (pid ${outcome.info.pid}).
-` + `Stop it first (\`cerefox web stop\`) or start on its port.`);
+` + `Stop it first (\`${progName()} web stop\`) or start on its port.`);
           process.exit(1);
           break;
         case "started":
@@ -82440,7 +82499,7 @@ function registerWeb(program) {
             info(`Cerefox web started (pid ${outcome.pid}) on http://${rawOpts.host}:${port}/`);
             println(`  Web UI:  http://${rawOpts.host}:${port}/app/`);
             println(c.dim(`  Logs:    ${daemonPaths.logFile}`));
-            println(c.dim(`  Stop:    cerefox web stop`));
+            println(c.dim(`  Stop:    ${progName()} web stop`));
           } else {
             const refusal = readStartupRefusal();
             if (refusal) {
@@ -82482,7 +82541,7 @@ Full log: ${daemonPaths.logFile}`);
           break;
         case "stale":
           println(c.yellow(`Cerefox web: stale pidfile — process ${status.info.pid} is not running.`));
-          println(c.dim(`  Clean up: cerefox web stop  (removes ${daemonPaths.pidFile})`));
+          println(c.dim(`  Clean up: ${progName()} web stop  (removes ${daemonPaths.pidFile})`));
           break;
         case "running":
           if (status.responding) {
@@ -82534,16 +82593,16 @@ var RENAMED_VERBS = [
 function registerRenameHusks(program) {
   for (const [oldName, newForm] of RENAMED_VERBS) {
     program.command(oldName, { hidden: true }).allowUnknownOption(true).allowExcessArguments(true).argument("[args...]", "(renamed)").action(() => {
-      eprintln(c.yellow(`✗ \`cerefox ${oldName}\` was renamed.`));
-      eprintln(`  Use \`cerefox ${newForm}\` instead (run \`cerefox ${newForm.split(" ")[0]} --help\`).`);
+      eprintln(c.yellow(`✗ \`${progName()} ${oldName}\` was renamed.`));
+      eprintln(`  Use \`${progName()} ${newForm}\` instead (run \`${progName()} ${newForm.split(" ")[0]} --help\`).`);
       process.exit(1);
     });
   }
 }
 function buildProgram() {
-  const progName = process.env.CEREFOX_PROG_NAME || "cerefox";
-  const program = new Command(progName).description("Cerefox — user-owned shared memory for AI agents.").version(PKG_VERSION, "-v, --version", `Print the ${progName} version and exit.`).addOption(new Option("--json", "Emit machine-readable JSON on stdout instead of the default human text. " + "Available on read commands; ignored on commands without a JSON shape.").hideHelp()).showHelpAfterError(`(run \`${progName} --help\` for usage)`).enablePositionalOptions().addHelpText("after", `
-Resource groups (run \`${progName} <group> --help\`):
+  const progName2 = process.env.CEREFOX_PROG_NAME || "cerefox";
+  const program = new Command(progName2).description("Cerefox — user-owned shared memory for AI agents.").version(PKG_VERSION, "-v, --version", `Print the ${progName2} version and exit.`).addOption(new Option("--json", "Emit machine-readable JSON on stdout instead of the default human text. " + "Available on read commands; ignored on commands without a JSON shape.").hideHelp()).showHelpAfterError(`(run \`${progName2} --help\` for usage)`).enablePositionalOptions().addHelpText("after", `
+Resource groups (run \`${progName2} <group> --help\`):
 ` + `  document   get · list · edit · delete · restore · ingest · ingest-dir · version {list·archive·unarchive}
 ` + `  project    list · create · edit · delete
 ` + `  metadata   keys · search
@@ -82566,8 +82625,8 @@ Exit codes:
 ` + `  1  user error         3  not found (document / version / project)
 ` + `
 Learn more:
-` + `  ${progName} guides list                  # bundled docs (offline)
-` + `  ${progName} doctor                       # diagnose your install
+` + `  ${progName2} guides list                  # bundled docs (offline)
+` + `  ${progName2} doctor                       # diagnose your install
 ` + `  https://github.com/fstamatelopoulos/cerefox
 `);
   registerSearch(program);
@@ -82618,8 +82677,8 @@ Learn more:
   moveInto(config, registerConfigGet, "get");
   moveInto(config, registerConfigSet, "set");
   const backup = program.command("backup").description("Backup + restore the knowledge base: create, restore.").action(() => {
-    eprintln(c.yellow("`cerefox backup` needs a subcommand."));
-    eprintln("  Use `cerefox backup create` or `cerefox backup restore`.");
+    eprintln(c.yellow(`\`${progName()} backup\` needs a subcommand.`));
+    eprintln(`  Use \`${progName()} backup create\` or \`${progName()} backup restore\`.`);
     process.exit(1);
   });
   moveInto(backup, registerBackup, "create");
@@ -82656,22 +82715,22 @@ async function bareEntryPoint() {
   if (!configExists) {
     println(c.yellow("⚠ No config detected."));
     println("Next step:");
-    println("  " + c.bold("cerefox init") + "    # interactive first-run setup (~2 min)");
+    println("  " + c.bold(`${progName()} init`) + "    # interactive first-run setup (~2 min)");
     println("");
     println(c.dim("Once configured, try:"));
-    println(c.dim("  cerefox doctor                  # verify your install"));
-    println(c.dim('  cerefox search "…"              # search the KB'));
-    println(c.dim("  cerefox document ingest <file>  # add a doc"));
+    println(c.dim(`  ${progName()} doctor                  # verify your install`));
+    println(c.dim(`  ${progName()} search "…"              # search the KB`));
+    println(c.dim(`  ${progName()} document ingest <file>  # add a doc`));
   } else {
     println(c.green("✓ Config detected. You're good to go."));
     println("");
     println("Common commands:");
-    println(c.dim("  cerefox doctor                  # diagnose your install"));
-    println(c.dim('  cerefox search "…"              # search the KB'));
-    println(c.dim("  cerefox document ingest <file>  # add a doc"));
-    println(c.dim("  cerefox configure-agent         # wire up an MCP client"));
+    println(c.dim(`  ${progName()} doctor                  # diagnose your install`));
+    println(c.dim(`  ${progName()} search "…"              # search the KB`));
+    println(c.dim(`  ${progName()} document ingest <file>  # add a doc`));
+    println(c.dim(`  ${progName()} configure-agent         # wire up an MCP client`));
     println("");
-    println(c.dim("Run `cerefox --help` for the full command list."));
+    println(c.dim(`Run \`${progName()} --help\` for the full command list.`));
   }
 }
 async function main() {