@corenel/cli 0.4.0 → 0.4.2

package/dist/cli.js

@@ -1177,8 +1177,8 @@ var require_stringifyString = __commonJS({
             case "u":
               {
                 str += json.slice(start, i);
-                const code = json.substr(i + 2, 4);
-                switch (code) {
+                const code2 = json.substr(i + 2, 4);
+                switch (code2) {
                   case "0000":
                     str += "\\0";
                     break;
@@ -1204,8 +1204,8 @@ var require_stringifyString = __commonJS({
                     str += "\\P";
                     break;
                   default:
-                    if (code.substr(0, 2) === "00")
-                      str += "\\x" + code.substr(2);
+                    if (code2.substr(0, 2) === "00")
+                      str += "\\x" + code2.substr(2);
                     else
                       str += json.substr(i, 6);
                 }
@@ -3704,22 +3704,22 @@ var require_errors = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/errors.js"(exports) {
     "use strict";
     var YAMLError = class extends Error {
-      constructor(name, pos, code, message) {
+      constructor(name, pos, code2, message) {
         super();
         this.name = name;
-        this.code = code;
+        this.code = code2;
         this.message = message;
         this.pos = pos;
       }
     };
     var YAMLParseError = class extends YAMLError {
-      constructor(pos, code, message) {
-        super("YAMLParseError", pos, code, message);
+      constructor(pos, code2, message) {
+        super("YAMLParseError", pos, code2, message);
       }
     };
     var YAMLWarning = class extends YAMLError {
-      constructor(pos, code, message) {
-        super("YAMLWarning", pos, code, message);
+      constructor(pos, code2, message) {
+        super("YAMLWarning", pos, code2, message);
       }
     };
     var prettifyError = (src, lc) => (error) => {
@@ -4625,7 +4625,7 @@ var require_resolve_flow_scalar = __commonJS({
       const { offset, type, source, end } = scalar;
       let _type;
       let value;
-      const _onError = (rel, code, msg) => onError(offset + rel, code, msg);
+      const _onError = (rel, code2, msg) => onError(offset + rel, code2, msg);
       switch (type) {
         case "scalar":
           _type = Scalar.Scalar.PLAIN;
@@ -4820,9 +4820,9 @@ var require_resolve_flow_scalar = __commonJS({
     function parseCharCode(source, offset, length, onError) {
       const cc = source.substr(offset, length);
       const ok = cc.length === length && /^[0-9a-fA-F]+$/.test(cc);
-      const code = ok ? parseInt(cc, 16) : NaN;
+      const code2 = ok ? parseInt(cc, 16) : NaN;
       try {
-        return String.fromCodePoint(code);
+        return String.fromCodePoint(code2);
       } catch {
         const raw = source.substr(offset - 2, length + 2);
         onError(offset - 2, "BAD_DQ_ESCAPE", `Invalid escape sequence ${raw}`);
@@ -5144,12 +5144,12 @@ var require_composer = __commonJS({
         this.prelude = [];
         this.errors = [];
         this.warnings = [];
-        this.onError = (source, code, message, warning) => {
+        this.onError = (source, code2, message, warning) => {
           const pos = getErrorPos(source);
           if (warning)
-            this.warnings.push(new errors.YAMLWarning(pos, code, message));
+            this.warnings.push(new errors.YAMLWarning(pos, code2, message));
           else
-            this.errors.push(new errors.YAMLParseError(pos, code, message));
+            this.errors.push(new errors.YAMLParseError(pos, code2, message));
         };
         this.directives = new directives.Directives({ version: options.version || "1.2" });
         this.options = options;
@@ -5311,12 +5311,12 @@ var require_cst_scalar = __commonJS({
     var stringifyString = require_stringifyString();
     function resolveAsScalar(token, strict = true, onError) {
       if (token) {
-        const _onError = (pos, code, message) => {
+        const _onError = (pos, code2, message) => {
           const offset = typeof pos === "number" ? pos : Array.isArray(pos) ? pos[0] : pos.offset;
           if (onError)
-            onError(offset, code, message);
+            onError(offset, code2, message);
           else
-            throw new errors.YAMLParseError([offset, offset + 1], code, message);
+            throw new errors.YAMLParseError([offset, offset + 1], code2, message);
         };
         switch (token.type) {
           case "scalar":
@@ -6897,14 +6897,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs3 = this.flowScalar(this.type);
+              const fs4 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs3, sep: [] });
+                map.items.push({ start, key: fs4, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs3);
+                this.stack.push(fs4);
               } else {
-                Object.assign(it, { key: fs3, sep: [] });
+                Object.assign(it, { key: fs4, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7032,13 +7032,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs3 = this.flowScalar(this.type);
+              const fs4 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs3, sep: [] });
+                fc.items.push({ start: [], key: fs4, sep: [] });
               else if (it.sep)
-                this.stack.push(fs3);
+                this.stack.push(fs4);
               else
-                Object.assign(it, { key: fs3, sep: [] });
+                Object.assign(it, { key: fs4, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -12241,11 +12241,11 @@ var require_compiler = __commonJS({
       _proto._popBuffer = function _popBuffer() {
         this.buffer = this.bufferStack.pop();
       };
-      _proto._emit = function _emit(code) {
-        this.codebuf.push(code);
+      _proto._emit = function _emit(code2) {
+        this.codebuf.push(code2);
       };
-      _proto._emitLine = function _emitLine(code) {
-        this._emit(code + "\n");
+      _proto._emitLine = function _emitLine(code2) {
+        this._emit(code2 + "\n");
       };
       _proto._emitLines = function _emitLines() {
         var _this = this;
@@ -13704,7 +13704,7 @@ var require_node_loaders = __commonJS({
       };
       return _setPrototypeOf(o, p);
     }
-    var fs3 = __require("fs");
+    var fs4 = __require("fs");
     var path = __require("path");
     var Loader2 = require_loader();
     var _require = require_precompiled_loader();
@@ -13733,7 +13733,7 @@ var require_node_loaders = __commonJS({
           } catch (e) {
             throw new Error("watch requires chokidar to be installed");
           }
-          var paths = _this.searchPaths.filter(fs3.existsSync);
+          var paths = _this.searchPaths.filter(fs4.existsSync);
           var watcher = chokidar.watch(paths);
           watcher.on("all", function(event, fullname) {
             fullname = path.resolve(fullname);
@@ -13754,7 +13754,7 @@ var require_node_loaders = __commonJS({
         for (var i = 0; i < paths.length; i++) {
           var basePath = path.resolve(paths[i]);
           var p = path.resolve(paths[i], name);
-          if (p.indexOf(basePath) === 0 && fs3.existsSync(p)) {
+          if (p.indexOf(basePath) === 0 && fs4.existsSync(p)) {
             fullpath = p;
             break;
           }
@@ -13764,7 +13764,7 @@ var require_node_loaders = __commonJS({
         }
         this.pathsToNames[fullpath] = name;
         var source = {
-          src: fs3.readFileSync(fullpath, "utf-8"),
+          src: fs4.readFileSync(fullpath, "utf-8"),
           path: fullpath,
           noCache: this.noCache
         };
@@ -13816,7 +13816,7 @@ var require_node_loaders = __commonJS({
         }
         this.pathsToNames[fullpath] = name;
         var source = {
-          src: fs3.readFileSync(fullpath, "utf-8"),
+          src: fs4.readFileSync(fullpath, "utf-8"),
           path: fullpath,
           noCache: this.noCache
         };
@@ -14573,7 +14573,7 @@ var require_precompile_global = __commonJS({
 var require_precompile = __commonJS({
   "../../node_modules/.pnpm/nunjucks@3.2.4/node_modules/nunjucks/src/precompile.js"(exports, module) {
     "use strict";
-    var fs3 = __require("fs");
+    var fs4 = __require("fs");
     var path = __require("path");
     var _require = require_lib();
     var _prettifyError = _require._prettifyError;
@@ -14606,14 +14606,14 @@ var require_precompile = __commonJS({
       if (opts.isString) {
         return precompileString(input, opts);
       }
-      var pathStats = fs3.existsSync(input) && fs3.statSync(input);
+      var pathStats = fs4.existsSync(input) && fs4.statSync(input);
       var precompiled = [];
       var templates = [];
       function addTemplates(dir) {
-        fs3.readdirSync(dir).forEach(function(file) {
+        fs4.readdirSync(dir).forEach(function(file) {
           var filepath = path.join(dir, file);
           var subpath = filepath.substr(path.join(input, "/").length);
-          var stat = fs3.statSync(filepath);
+          var stat = fs4.statSync(filepath);
           if (stat && stat.isDirectory()) {
             subpath += "/";
             if (!match(subpath, opts.exclude)) {
@@ -14625,13 +14625,13 @@ var require_precompile = __commonJS({
         });
       }
       if (pathStats.isFile()) {
-        precompiled.push(_precompile(fs3.readFileSync(input, "utf-8"), opts.name || input, env));
+        precompiled.push(_precompile(fs4.readFileSync(input, "utf-8"), opts.name || input, env));
       } else if (pathStats.isDirectory()) {
         addTemplates(input);
         for (var i = 0; i < templates.length; i++) {
           var name = templates[i].replace(path.join(input, "/"), "");
           try {
-            precompiled.push(_precompile(fs3.readFileSync(templates[i], "utf-8"), name, env));
+            precompiled.push(_precompile(fs4.readFileSync(templates[i], "utf-8"), name, env));
           } catch (e) {
             if (opts.force) {
               console.error(e);
@@ -15707,8 +15707,8 @@ var require_validation = __commonJS({
       0
       // 112 - 127
     ];
-    function isValidStatusCode(code) {
-      return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006 || code >= 3e3 && code <= 4999;
+    function isValidStatusCode(code2) {
+      return code2 >= 1e3 && code2 <= 1014 && code2 !== 1004 && code2 !== 1005 && code2 !== 1006 || code2 >= 3e3 && code2 <= 4999;
     }
     function _isValidUTF8(buf) {
       const len = buf.length;
@@ -16321,11 +16321,11 @@ var require_receiver = __commonJS({
             this.emit("conclude", 1005, EMPTY_BUFFER);
             this.end();
           } else {
-            const code = data.readUInt16BE(0);
-            if (!isValidStatusCode(code)) {
+            const code2 = data.readUInt16BE(0);
+            if (!isValidStatusCode(code2)) {
               const error = this.createError(
                 RangeError,
-                `invalid status code ${code}`,
+                `invalid status code ${code2}`,
                 true,
                 1002,
                 "WS_ERR_INVALID_CLOSE_CODE"
@@ -16350,7 +16350,7 @@ var require_receiver = __commonJS({
               return;
             }
             this._loop = false;
-            this.emit("conclude", code, buf);
+            this.emit("conclude", code2, buf);
             this.end();
           }
           this._state = GET_INFO;
@@ -16540,22 +16540,22 @@ var require_sender = __commonJS({
        * @param {Function} [cb] Callback
        * @public
        */
-      close(code, data, mask, cb) {
+      close(code2, data, mask, cb) {
         let buf;
-        if (code === void 0) {
+        if (code2 === void 0) {
           buf = EMPTY_BUFFER;
-        } else if (typeof code !== "number" || !isValidStatusCode(code)) {
+        } else if (typeof code2 !== "number" || !isValidStatusCode(code2)) {
           throw new TypeError("First argument must be a valid error code number");
         } else if (data === void 0 || !data.length) {
           buf = Buffer.allocUnsafe(2);
-          buf.writeUInt16BE(code, 0);
+          buf.writeUInt16BE(code2, 0);
         } else {
           const length = Buffer.byteLength(data);
           if (length > 123) {
             throw new RangeError("The message must not be greater than 123 bytes");
           }
           buf = Buffer.allocUnsafe(2 + length);
-          buf.writeUInt16BE(code, 0);
+          buf.writeUInt16BE(code2, 0);
           if (typeof data === "string") {
             buf.write(data, 2);
           } else if (isUint8Array(data)) {
@@ -17050,9 +17050,9 @@ var require_event_target = __commonJS({
             callListener(handler, this, event);
           };
         } else if (type === "close") {
-          wrapper = function onClose(code, message) {
+          wrapper = function onClose(code2, message) {
             const event = new CloseEvent("close", {
-              code,
+              code: code2,
               reason: message.toString(),
               wasClean: this._closeFrameReceived && this._closeFrameSent
             });
@@ -17136,23 +17136,23 @@ var require_extension = __commonJS({
       let extensionName;
       let paramName;
       let start = -1;
-      let code = -1;
+      let code2 = -1;
       let end = -1;
       let i = 0;
       for (; i < header.length; i++) {
-        code = header.charCodeAt(i);
+        code2 = header.charCodeAt(i);
         if (extensionName === void 0) {
-          if (end === -1 && tokenChars[code] === 1) {
+          if (end === -1 && tokenChars[code2] === 1) {
             if (start === -1) start = i;
-          } else if (i !== 0 && (code === 32 || code === 9)) {
+          } else if (i !== 0 && (code2 === 32 || code2 === 9)) {
             if (end === -1 && start !== -1) end = i;
-          } else if (code === 59 || code === 44) {
+          } else if (code2 === 59 || code2 === 44) {
             if (start === -1) {
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
             if (end === -1) end = i;
             const name = header.slice(start, end);
-            if (code === 44) {
+            if (code2 === 44) {
               push(offers, name, params);
               params = /* @__PURE__ */ Object.create(null);
             } else {
@@ -17163,23 +17163,23 @@ var require_extension = __commonJS({
             throw new SyntaxError(`Unexpected character at index ${i}`);
           }
         } else if (paramName === void 0) {
-          if (end === -1 && tokenChars[code] === 1) {
+          if (end === -1 && tokenChars[code2] === 1) {
             if (start === -1) start = i;
-          } else if (code === 32 || code === 9) {
+          } else if (code2 === 32 || code2 === 9) {
             if (end === -1 && start !== -1) end = i;
-          } else if (code === 59 || code === 44) {
+          } else if (code2 === 59 || code2 === 44) {
             if (start === -1) {
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
             if (end === -1) end = i;
             push(params, header.slice(start, end), true);
-            if (code === 44) {
+            if (code2 === 44) {
               push(offers, extensionName, params);
               params = /* @__PURE__ */ Object.create(null);
               extensionName = void 0;
             }
             start = end = -1;
-          } else if (code === 61 && start !== -1 && end === -1) {
+          } else if (code2 === 61 && start !== -1 && end === -1) {
             paramName = header.slice(start, i);
             start = end = -1;
           } else {
@@ -17187,30 +17187,30 @@ var require_extension = __commonJS({
           }
         } else {
           if (isEscaping) {
-            if (tokenChars[code] !== 1) {
+            if (tokenChars[code2] !== 1) {
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
             if (start === -1) start = i;
             else if (!mustUnescape) mustUnescape = true;
             isEscaping = false;
           } else if (inQuotes) {
-            if (tokenChars[code] === 1) {
+            if (tokenChars[code2] === 1) {
               if (start === -1) start = i;
-            } else if (code === 34 && start !== -1) {
+            } else if (code2 === 34 && start !== -1) {
               inQuotes = false;
               end = i;
-            } else if (code === 92) {
+            } else if (code2 === 92) {
               isEscaping = true;
             } else {
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
-          } else if (code === 34 && header.charCodeAt(i - 1) === 61) {
+          } else if (code2 === 34 && header.charCodeAt(i - 1) === 61) {
             inQuotes = true;
-          } else if (end === -1 && tokenChars[code] === 1) {
+          } else if (end === -1 && tokenChars[code2] === 1) {
             if (start === -1) start = i;
-          } else if (start !== -1 && (code === 32 || code === 9)) {
+          } else if (start !== -1 && (code2 === 32 || code2 === 9)) {
             if (end === -1) end = i;
-          } else if (code === 59 || code === 44) {
+          } else if (code2 === 59 || code2 === 44) {
             if (start === -1) {
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
@@ -17221,7 +17221,7 @@ var require_extension = __commonJS({
               mustUnescape = false;
             }
             push(params, paramName, value);
-            if (code === 44) {
+            if (code2 === 44) {
               push(offers, extensionName, params);
               params = /* @__PURE__ */ Object.create(null);
               extensionName = void 0;
@@ -17233,7 +17233,7 @@ var require_extension = __commonJS({
           }
         }
       }
-      if (start === -1 || inQuotes || code === 32 || code === 9) {
+      if (start === -1 || inQuotes || code2 === 32 || code2 === 9) {
         throw new SyntaxError("Unexpected end of input");
       }
       if (end === -1) end = i;
@@ -17524,7 +17524,7 @@ var require_websocket = __commonJS({
        *     closing
        * @public
        */
-      close(code, data) {
+      close(code2, data) {
         if (this.readyState === _WebSocket.CLOSED) return;
         if (this.readyState === _WebSocket.CONNECTING) {
           const msg = "WebSocket was closed before the connection was established";
@@ -17538,7 +17538,7 @@ var require_websocket = __commonJS({
           return;
         }
         this._readyState = _WebSocket.CLOSING;
-        this._sender.close(code, data, !this._isServer, (err) => {
+        this._sender.close(code2, data, !this._isServer, (err) => {
           if (err) return;
           this._closeFrameSent = true;
           if (this._closeFrameReceived || this._receiver._writableState.errorEmitted) {
@@ -18061,16 +18061,16 @@ var require_websocket = __commonJS({
         process.nextTick(cb, err);
       }
     }
-    function receiverOnConclude(code, reason) {
+    function receiverOnConclude(code2, reason) {
       const websocket = this[kWebSocket];
       websocket._closeFrameReceived = true;
       websocket._closeMessage = reason;
-      websocket._closeCode = code;
+      websocket._closeCode = code2;
       if (websocket._socket[kWebSocket] === void 0) return;
       websocket._socket.removeListener("data", socketOnData);
       process.nextTick(resume, websocket._socket);
-      if (code === 1005) websocket.close();
-      else websocket.close(code, reason);
+      if (code2 === 1005) websocket.close();
+      else websocket.close(code2, reason);
     }
     function receiverOnDrain() {
       const websocket = this[kWebSocket];
@@ -18276,12 +18276,12 @@ var require_subprotocol = __commonJS({
       let end = -1;
       let i = 0;
       for (i; i < header.length; i++) {
-        const code = header.charCodeAt(i);
-        if (end === -1 && tokenChars[code] === 1) {
+        const code2 = header.charCodeAt(i);
+        if (end === -1 && tokenChars[code2] === 1) {
           if (start === -1) start = i;
-        } else if (i !== 0 && (code === 32 || code === 9)) {
+        } else if (i !== 0 && (code2 === 32 || code2 === 9)) {
           if (end === -1 && start !== -1) end = i;
-        } else if (code === 44) {
+        } else if (code2 === 44) {
           if (start === -1) {
             throw new SyntaxError(`Unexpected character at index ${i}`);
           }
@@ -18583,9 +18583,9 @@ var require_websocket_server = __commonJS({
             req
           };
           if (this.options.verifyClient.length === 2) {
-            this.options.verifyClient(info, (verified, code, message, headers) => {
+            this.options.verifyClient(info, (verified, code2, message, headers) => {
               if (!verified) {
-                return abortHandshake(socket, code || 401, message, headers);
+                return abortHandshake(socket, code2 || 401, message, headers);
               }
               this.completeUpgrade(
                 extensions,
@@ -18685,8 +18685,8 @@ var require_websocket_server = __commonJS({
     function socketOnError() {
       this.destroy();
     }
-    function abortHandshake(socket, code, message, headers) {
-      message = message || http.STATUS_CODES[code];
+    function abortHandshake(socket, code2, message, headers) {
+      message = message || http.STATUS_CODES[code2];
       headers = {
         Connection: "close",
         "Content-Type": "text/html",
@@ -18695,17 +18695,17 @@ var require_websocket_server = __commonJS({
       };
       socket.once("finish", socket.destroy);
       socket.end(
-        `HTTP/1.1 ${code} ${http.STATUS_CODES[code]}\r
+        `HTTP/1.1 ${code2} ${http.STATUS_CODES[code2]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
-    function abortHandshakeOrEmitwsClientError(server, req, socket, code, message, headers) {
+    function abortHandshakeOrEmitwsClientError(server, req, socket, code2, message, headers) {
       if (server.listenerCount("wsClientError")) {
         const err = new Error(message);
         Error.captureStackTrace(err, abortHandshakeOrEmitwsClientError);
         server.emit("wsClientError", err, socket, req);
       } else {
-        abortHandshake(socket, code, message, headers);
+        abortHandshake(socket, code2, message, headers);
       }
     }
   }
@@ -18715,7 +18715,6 @@ var require_websocket_server = __commonJS({
 import { runAgent as runAgent2 } from "@corenel/harness/core/loop";
 import { createChatClient as createChatClient2, setGatewayBase as setGatewayBase2 } from "@corenel/harness/providers/gateway";
 import { resolveContextWindow as resolveContextWindow2 } from "@corenel/harness/providers/contextWindow";
-import { join as join6 } from "node:path";
 import { allTools as allTools3 } from "@corenel/harness/tools/builtins";
 import { registerGuard as registerGuard2 } from "@corenel/harness/guards";
 import { setPromptHost } from "@corenel/harness/prompts/host";
@@ -18833,7 +18832,7 @@ var NodeFileService = class {
           out.push({ name: e.name, path, kind: "directory", children: await walk(absChild) });
         } else {
           const st = await fs.stat(absChild).catch(() => null);
-          out.push({ name: e.name, path, kind: "file", size: st?.size, ext: extOf(e.name) });
+          out.push({ name: e.name, path, kind: "file", size: st?.size, mtime: st?.mtimeMs, ext: extOf(e.name) });
         }
       }
       return out;
@@ -18846,7 +18845,7 @@ var NodeFileService = class {
   async stat(path) {
     try {
       const st = await fs.stat(this.abs(path));
-      return { path: normalizeFilePath(path), kind: st.isDirectory() ? "directory" : "file", size: st.size, ext: extOf(path) };
+      return { path: normalizeFilePath(path), kind: st.isDirectory() ? "directory" : "file", size: st.size, mtime: st.mtimeMs, ext: extOf(path) };
     } catch {
       return null;
     }
@@ -18911,41 +18910,152 @@ var NodeFileService = class {
 import { promises as fs2 } from "node:fs";
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
-import { stateDirName } from "@corenel/protocol";
-function corenelDir() {
-  return join2(homedir(), stateDirName());
+import { stateDirName, DEFAULT_API_BASE } from "@corenel/protocol";
+function corenelDir(base = homedir()) {
+  return join2(base, stateDirName());
+}
+function sidecarDir(base = homedir()) {
+  return join2(corenelDir(base), "sidecar");
+}
+function authTokenPath(base = homedir()) {
+  return join2(corenelDir(base), "token");
 }
-function authTokenPath() {
-  return join2(corenelDir(), "token");
+function credentialDir(stateDir) {
+  return stateDir ?? corenelDir();
 }
-async function writeAuthToken(token) {
-  await fs2.mkdir(corenelDir(), { recursive: true, mode: 448 });
-  await fs2.writeFile(authTokenPath(), token.trim() + "\n", { mode: 384 });
+function tokenFilePath(stateDir) {
+  return join2(credentialDir(stateDir), "token");
+}
+function credentialFilePath(stateDir) {
+  return join2(credentialDir(stateDir), "auth.json");
+}
+var TOKEN_ENV = "CORENEL_TOKEN";
+var API_BASE_ENV = "CORENEL_API_BASE";
+async function writeAuthToken(token, stateDir) {
+  const dir = credentialDir(stateDir);
+  const path = tokenFilePath(stateDir);
+  await fs2.mkdir(dir, { recursive: true, mode: 448 });
+  await fs2.writeFile(path, token.trim() + "\n", { mode: 384 });
+  try {
+    await fs2.chmod(path, 384);
+  } catch {
+  }
   try {
-    await fs2.chmod(authTokenPath(), 384);
+    await fs2.chmod(dir, 448);
   } catch {
   }
+}
+async function writeLoginCredential(token, opts = {}) {
+  const cred = {
+    accessToken: token.trim(),
+    ...opts.account ? { account: opts.account } : {},
+    ...opts.apiBase ? { apiBase: opts.apiBase } : {}
+  };
+  const path = credentialFilePath(opts.stateDir);
+  await fs2.mkdir(credentialDir(opts.stateDir), { recursive: true, mode: 448 });
+  await fs2.writeFile(path, `${JSON.stringify(cred, null, 2)}
+`, { mode: 384 });
   try {
-    await fs2.chmod(corenelDir(), 448);
+    await fs2.chmod(path, 384);
   } catch {
   }
+  await writeAuthToken(cred.accessToken, opts.stateDir);
 }
-async function readAuthToken() {
+async function readAuthToken(stateDir) {
   try {
-    const t = (await fs2.readFile(authTokenPath(), "utf8")).trim();
+    const t = (await fs2.readFile(tokenFilePath(stateDir), "utf8")).trim();
     return t || null;
   } catch {
     return null;
   }
 }
-async function clearAuthToken() {
+async function clearAuthToken(stateDir) {
   try {
-    await fs2.rm(authTokenPath(), { force: true });
+    await fs2.rm(tokenFilePath(stateDir), { force: true });
   } catch {
   }
 }
-function nodeAuthToken() {
-  return { getToken: async () => await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null };
+async function readCredentialFile(stateDir) {
+  let raw;
+  try {
+    raw = await fs2.readFile(credentialFilePath(stateDir), "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const c = parsed;
+    if (typeof c.accessToken !== "string" || !c.accessToken) return null;
+    return {
+      accessToken: c.accessToken,
+      ...typeof c.refreshToken === "string" ? { refreshToken: c.refreshToken } : {},
+      ...typeof c.expiresAt === "number" ? { expiresAt: c.expiresAt } : {},
+      ...typeof c.account === "string" ? { account: c.account } : {},
+      ...typeof c.apiBase === "string" && c.apiBase ? { apiBase: c.apiBase } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+async function clearAllCredentials(stateDir) {
+  await clearAuthToken(stateDir);
+  try {
+    await fs2.rm(credentialFilePath(stateDir), { force: true });
+  } catch {
+  }
+}
+async function resolveNodeCredential(opts = {}) {
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? Date.now;
+  const stateDir = opts.stateDir;
+  const fromEnv = env[TOKEN_ENV]?.trim();
+  if (fromEnv) return { token: fromEnv, source: "env" };
+  const cred = await readCredentialFile(stateDir);
+  const fileToken = await readAuthToken(stateDir);
+  if (fileToken) {
+    const same = cred && cred.accessToken === fileToken ? cred : null;
+    return withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same, now);
+  }
+  if (cred) {
+    return withExpiry(
+      { token: cred.accessToken, source: "credential-file", path: credentialFilePath(stateDir) },
+      cred,
+      now
+    );
+  }
+  return { token: null, source: "none" };
+}
+function withExpiry(base, cred, now) {
+  if (!cred) return base;
+  const expired = typeof cred.expiresAt === "number" && cred.expiresAt <= now();
+  return {
+    ...base,
+    ...typeof cred.expiresAt === "number" ? { expiresAt: cred.expiresAt } : {},
+    ...expired ? { expired: true } : {},
+    ...cred.account ? { account: cred.account } : {},
+    ...cred.apiBase ? { apiBase: cred.apiBase } : {}
+  };
+}
+async function resolveApiBase(opts = {}) {
+  const explicit = opts.explicit?.trim();
+  if (explicit) return { base: explicit, source: "explicit" };
+  const fromEnv = (opts.env ?? process.env)[API_BASE_ENV]?.trim();
+  if (fromEnv) return { base: fromEnv, source: "env" };
+  const cred = await resolveNodeCredential({
+    env: {},
+    ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+  });
+  if (cred.apiBase) return { base: cred.apiBase, source: "credential" };
+  return { base: DEFAULT_API_BASE, source: "default" };
+}
+function maskToken(token) {
+  const t = token.trim();
+  if (t.length <= 8) return "****";
+  return `${t.slice(0, 4)}\u2026${t.slice(-2)} (${t.length} chars)`;
+}
+function nodeAuthToken(stateDir) {
+  return { getToken: async () => (await resolveNodeCredential(stateDir ? { stateDir } : {})).token };
 }
 
 // ../../node_modules/.pnpm/@prompd+core@0.5.0-beta.10/node_modules/@prompd/core/dist/index.js
@@ -20703,12 +20813,12 @@ var TemplateProcessingStage = class {
    */
   async loadPackageResource(context, packagePath, resourcePath, prefix) {
     try {
-      const fs3 = context.fileSystem;
+      const fs4 = context.fileSystem;
       const possibleExtensions = ["", ".prmd", ".md", ".txt"];
       for (const ext of possibleExtensions) {
         const filePath = resolvePackageFile(packagePath, resourcePath + ext);
-        if (await fs3.exists(filePath)) {
-          const contentData = await fs3.readFile(filePath);
+        if (await fs4.exists(filePath)) {
+          const contentData = await fs4.readFile(filePath);
           if (isPrompdFile(filePath)) {
             const parser2 = new PrompdParser();
             try {
@@ -20742,16 +20852,16 @@ var TemplateProcessingStage = class {
       return content;
     }
     try {
-      const fs3 = context.fileSystem;
+      const fs4 = context.fileSystem;
       const parser2 = new PrompdParser();
       let parentFile = null;
-      if (isPrompdFile(parentPath) && await fs3.exists(parentPath)) {
+      if (isPrompdFile(parentPath) && await fs4.exists(parentPath)) {
         parentFile = parentPath;
-      } else if (await fs3.exists(parentPath) && await fs3.isDirectory(parentPath)) {
-        const files = (await fs3.readdir(parentPath)).filter((f) => isPrompdFile(f));
+      } else if (await fs4.exists(parentPath) && await fs4.isDirectory(parentPath)) {
+        const files = (await fs4.readdir(parentPath)).filter((f) => isPrompdFile(f));
         if (files.length > 0) {
           const mainFile = files.find((f) => f === "main.prmd" || f === "main.md");
-          parentFile = fs3.join(parentPath, mainFile || files[0]);
+          parentFile = fs4.join(parentPath, mainFile || files[0]);
         }
       }
       if (!parentFile) {
@@ -20765,14 +20875,14 @@ var TemplateProcessingStage = class {
         });
         return content;
       }
-      const parentFileContent = await fs3.readFile(parentFile);
+      const parentFileContent = await fs4.readFile(parentFile);
       const parentData = parser2.parseContent(parentFileContent);
-      await this.validateParentFileReferences(context, parentData.metadata, fs3, parentFile);
+      await this.validateParentFileReferences(context, parentData.metadata, fs4, parentFile);
       if (context.hasErrors()) {
         return content;
       }
       if (parentData.content) {
-        const parentDir = fs3.dirname(parentFile);
+        const parentDir = fs4.dirname(parentFile);
         parentData.content = this.resolveIncludePaths(parentData.content, parentDir);
       }
       const overrides = context.metadata?.override || {};
@@ -21323,10 +21433,10 @@ ${content}` : parentData.content;
    * Called during inheritance processing because AssetExtractionStage only runs on
    * the child file's metadata — the parent is only parsed, never fully compiled.
    */
-  async validateParentFileReferences(context, metadata, fs3, parentFile) {
+  async validateParentFileReferences(context, metadata, fs4, parentFile) {
     if (!metadata) return;
     const metadataAsRecord = metadata;
-    const parentDir = fs3.dirname(parentFile);
+    const parentDir = fs4.dirname(parentFile);
     const fileFields = ["system", "task", "user", "assistant", "response", "output", "context"];
     for (const field of fileFields) {
       const fieldValue = metadataAsRecord[field];
@@ -21334,8 +21444,8 @@ ${content}` : parentData.content;
       const refs = Array.isArray(fieldValue) ? fieldValue.filter((v) => typeof v === "string") : typeof fieldValue === "string" ? [fieldValue] : [];
       for (const ref of refs) {
         if (!ref.startsWith("./") && !ref.startsWith("../")) continue;
-        const resolvedPath = fs3.resolve(parentDir, ref);
-        const exists = await Promise.resolve(fs3.exists(resolvedPath));
+        const resolvedPath = fs4.resolve(parentDir, ref);
+        const exists = await Promise.resolve(fs4.exists(resolvedPath));
         if (!exists) {
           const location = context.findLocation(/inherits:/);
           context.addDiagnostic({
@@ -21922,15 +22032,20 @@ async function preload(svc) {
 }
 async function compile(src, values, fileSystem, mainPath) {
   const mp = mainPath || "/main.prmd";
-  const fs3 = fileSystem || new MemoryFileSystem({ [mp]: src });
-  const ctx = await compiler.compileWithContext(mp, { parameters: values || {}, fileSystem: fs3, outputFormat: "markdown" });
+  const fs4 = fileSystem || new MemoryFileSystem({ [mp]: src });
+  const ctx = await compiler.compileWithContext(mp, { parameters: values || {}, fileSystem: fs4, outputFormat: "markdown" });
   const compiled = ctx.compiledResult;
   const output = typeof compiled === "string" ? compiled : compiled ? new TextDecoder().decode(compiled) : "";
   return { output };
 }
-function nodePromptHost(workspace) {
+function nodePromptHost(workspace, project) {
   return {
     workspace,
+    /* The user's PROJECT files, when the caller has them, so skills installed
+     * into `.prompd/skills/` are visible. Omitted rather than faked when there
+     * is none: a CLI invoked outside a project genuinely has no installed
+     * skills, and saying so beats inventing an empty directory. */
+    ...project ? { projectWorkspace: () => project } : {},
     seed: async (defaults) => {
       for (const [p, content] of Object.entries(defaults)) {
         if (!await workspace.stat(p)) await workspace.write(p, content);
@@ -21949,9 +22064,99 @@ function nodePromptHost(workspace) {
   };
 }
 
+// ../tools-node/migrateHome.ts
+import { promises as fs3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3, dirname as dirname2 } from "node:path";
+var SIDECAR_FILES = [
+  "daemon.id",
+  "daemon.token",
+  "hosts.json",
+  "sidecar.crt",
+  "sidecar.key",
+  "sidecar.sans.json"
+];
+var SIDECAR_DIRS = ["hosts"];
+async function isDir(p) {
+  return fs3.stat(p).then((s) => s.isDirectory()).catch(() => false);
+}
+async function present(p) {
+  return fs3.stat(p).then(() => true).catch(() => false);
+}
+function code(e) {
+  return e?.code;
+}
+async function moveEntry(from, to, report) {
+  if (!await present(from)) return;
+  if (await present(to)) {
+    report.skipped.push({ path: to, reason: "destination already exists" });
+    return;
+  }
+  await fs3.mkdir(dirname2(to), { recursive: true });
+  try {
+    await fs3.rename(from, to);
+    report.moved.push(to);
+  } catch (e) {
+    const c = code(e);
+    if (c === "EEXIST" || c === "ENOTEMPTY") {
+      report.skipped.push({ path: to, reason: "moved concurrently" });
+      return;
+    }
+    if (c === "ENOENT") {
+      report.skipped.push({ path: to, reason: "moved concurrently" });
+      return;
+    }
+    if (c === "EXDEV") {
+      await fs3.cp(from, to, { recursive: true });
+      await fs3.rm(from, { recursive: true, force: true });
+      report.moved.push(to);
+      return;
+    }
+    throw e;
+  }
+}
+async function mergeDir(from, to, report) {
+  const entries = await fs3.readdir(from, { withFileTypes: true }).catch(() => []);
+  for (const e of entries) {
+    const src = join3(from, e.name);
+    const dst = join3(to, e.name);
+    if (e.isDirectory() && await isDir(dst)) await mergeDir(src, dst, report);
+    else await moveEntry(src, dst, report);
+  }
+  await fs3.rmdir(from).catch(() => {
+  });
+}
+async function migrateHomeLayout(base = homedir2()) {
+  const report = { moved: [], skipped: [] };
+  const home = corenelDir(base);
+  if (!await present(home)) return report;
+  const config = join3(home, "config");
+  if (await isDir(config)) await mergeDir(config, home, report);
+  const side = sidecarDir(base);
+  for (const name of SIDECAR_FILES) {
+    await moveEntry(join3(home, name), join3(side, name), report);
+  }
+  for (const name of SIDECAR_DIRS) {
+    const src = join3(home, name);
+    if (!await isDir(src)) continue;
+    const dst = join3(side, name);
+    if (await isDir(dst)) await mergeDir(src, dst, report);
+    else await moveEntry(src, dst, report);
+  }
+  if (report.moved.length) await fs3.chmod(home, 448).catch(() => {
+  });
+  return report;
+}
+
+// src/configRoot.ts
+function configWorkspaceRoot(base) {
+  return corenelDir(base);
+}
+
 // src/cli.ts
 import { FileRecallStore, UNATTACHED_SESSION } from "@corenel/harness/sessions/fileRecallStore";
-import { PermissionService as PermissionService3 } from "@corenel/harness/guardrail/permission-service";
+import { stateDirName as stateDirName6 } from "@corenel/protocol";
+import { PermissionService as PermissionService4 } from "@corenel/harness/guardrail/permission-service";
 
 // src/nodeContext.ts
 import { ROOT_NODE_ID } from "@corenel/protocol";
@@ -22047,10 +22252,10 @@ function tokenGuard(getToken) {
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var MIN_POLL_MS = 1e3;
 var DEFAULT_LIFETIME_S = 900;
-function defaultOpen(uri, code) {
+function defaultOpen(uri, code2) {
   process.stdout.write(`
   To authorize, open:  ${uri}
-  and enter the code:  ${code}
+  and enter the code:  ${code2}
 
   Waiting for authorization\u2026
 `);
@@ -22112,7 +22317,7 @@ import { runAgent } from "@corenel/harness/core/loop";
 import { createChatClient, setGatewayBase } from "@corenel/harness/providers/gateway";
 
 // src/apiBase.ts
-var DEFAULT_API_BASE = "https://api.corenel.ai/api";
+import { DEFAULT_API_BASE as DEFAULT_API_BASE2 } from "@corenel/protocol";
 var InvalidApiBaseError = class extends Error {
   constructor(value, why) {
     super(`invalid API base ${JSON.stringify(value)} -- ${why}`);
@@ -22126,8 +22331,13 @@ function isLoopback(hostname) {
   return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
 }
 var warnedCleartext = false;
-function apiBase(explicit) {
-  const value = explicit || process.env.CORENEL_API_BASE || DEFAULT_API_BASE;
+async function apiBase(explicit, opts = {}) {
+  const resolved = await resolveApiBase({
+    explicit,
+    env: opts.env ?? process.env,
+    ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+  });
+  const value = resolved.base;
   let url;
   try {
     url = new URL(value);
@@ -22293,6 +22503,14 @@ function parseCanCall(meta) {
   if (!Array.isArray(raw)) return [];
   return raw.filter((x) => typeof x === "string" && isValidAgentName(x));
 }
+function parseWorkRoots(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const out = {};
+  for (const [id, dir] of Object.entries(raw)) {
+    if (typeof dir === "string" && dir) out[id] = dir;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function parseSettings(text) {
   try {
     const raw = JSON.parse(text);
@@ -22300,7 +22518,13 @@ function parseSettings(text) {
       const o = raw;
       return {
         model: typeof o.model === "string" ? o.model : void 0,
-        temperature: typeof o.temperature === "number" ? o.temperature : void 0
+        temperature: typeof o.temperature === "number" ? o.temperature : void 0,
+        /* Carried through as-is. Validation belongs to the daemon, which is the
+         * only side that knows its own approved roots -- checking here would be
+         * checking against the wrong list, on the wrong machine. Non-string
+         * values are dropped per entry rather than failing the whole file: one
+         * bad key must not cost an agent every other machine's setting. */
+        workRoots: parseWorkRoots(o.workRoots)
       };
     }
   } catch {
@@ -22343,7 +22567,7 @@ async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
 import { saveCustomPolicy } from "@corenel/harness/guardrail";
 import { allTools } from "@corenel/harness/tools/builtins";
 import { makeCallAgentTool } from "@corenel/harness/tools/callAgent";
-function buildSystemExtra(def) {
+function buildSystemExtra(def, memoryLocation) {
   const parts = [];
   if (def.jobTitle?.trim()) parts.push(`--- Role ---
 ${def.jobTitle.trim()}`);
@@ -22353,12 +22577,57 @@ ${def.soul.trim()}`);
 ${def.persona.trim()}`);
   if (def.instructions.trim()) parts.push(`--- Instructions ---
 ${def.instructions.trim()}`);
+  const location = memoryLocation ?? "memory/";
+  const dir = location.replace(/\/+$/, "");
+  const index = `${dir}/MEMORY.md`;
+  parts.push(
+    `--- Memory ---
+You keep durable notes in your own memory folder, \`${dir}/\`, one Markdown file per note, alongside \`${index}\`, an index you maintain for yourself.
+Read \`${index}\` at the start of a run to recall what you already know, and call recall_memory to look up one note by name. If you can call save_memory, use it for what is worth knowing on a later run, and keep \`${index}\` current as you do. If a file tool you have takes a \`root\` argument, you can pass \`${dir}/\` as \`root\` to read and edit those files directly.`
+  );
+  const selfDirection = selfDirectionBlock(def);
+  if (selfDirection) parts.push(selfDirection);
   return parts.join("\n\n");
 }
+function selfDirectionBlock(def) {
+  const trigger = def.triggers?.find((t) => t.type === "self-directed");
+  if (!trigger) return null;
+  const raw = trigger.config?.fallbackMs;
+  const fallbackMs = typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : null;
+  const consequence = fallbackMs == null ? "If this run ends without that call, nothing will wake it again and your work stops here until someone starts you by hand." : `If this run ends without that call you will be woken anyway, about ${Math.round(fallbackMs / 6e4)} minutes from now -- but that is a backstop for a run that could not schedule itself, not a substitute for choosing when you should next run.`;
+  return `--- Self-direction ---
+You run on your own schedule. You will not run again unless you call \`schedule_self\` with the time you should next wake, before this run ends.
+${consequence}
+So decide, before you finish, whether there is more to do and when it should happen.`;
+}
+
+// ../crew/memory.ts
+import { flattenFiles as flattenFiles4 } from "@corenel/protocol";
+import { parseFact, renderFact, slugify, uniqueSlug, FACT_INDEX } from "@corenel/harness/core/factFile";
+
+// ../crew/room/store.ts
+import { flattenFiles as flattenFiles5 } from "@corenel/protocol";
+import { encodeLine, foldSession } from "@corenel/harness/sessions/jsonl";
+import { FINDINGS_FILE, encodeFindingLine, foldFindings } from "@corenel/harness/rooms/findings";
+
+// ../crew/room/prompt.ts
+import { MAX_ROOM_FINDINGS, renderFindings } from "@corenel/harness/rooms/findings";
+
+// ../crew/room/turn.ts
+import { readRoomOutcome } from "@corenel/harness/tools/roomTools";
+
+// ../crew/room/turnRuntime.ts
+import { PermissionService } from "@corenel/harness/guardrail";
+import { BudgetMeter, mergeSignals } from "@corenel/harness/core/budget";
+import { makeRoomTools, ROOM_TOOL_NAMES } from "@corenel/harness/tools/roomTools";
+
+// ../crew/room/engine.ts
+import { describeParticipants, resolveAddressee } from "@corenel/harness/tools/roomTools";
+import { planFindingEdit, planFindingEdits } from "@corenel/harness/rooms/findings";
 
 // src/runAgent.ts
 import { stateDirName as stateDirName3 } from "@corenel/protocol";
-import { PermissionService } from "@corenel/harness/guardrail/permission-service";
+import { PermissionService as PermissionService2 } from "@corenel/harness/guardrail/permission-service";
 import { STANDARD_POLICY } from "@corenel/harness/guardrail/builtins";
 import { toolAddress } from "@corenel/harness/tools/namespaces";
 
@@ -22397,7 +22666,7 @@ async function runCrewAgentCli(opts) {
     opts.warn(`agent "${opts.agent}" is disabled; enable it before running`);
     return 2;
   }
-  setGatewayBase(apiBase(opts.base));
+  setGatewayBase(await apiBase(opts.base));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     opts.warn("not signed in: set CORENEL_TOKEN, or run `corenel login` on this machine");
@@ -22432,7 +22701,7 @@ ${extra}` : base;
   if (operatorUnattended === "park" && !unattendedAllow) {
     opts.warn(`corenel: policy "${effectivePolicy.name}" asks to park an unattended action, but run-agent cannot wait -- refusing.`);
   }
-  const permission = new PermissionService({
+  const permission = new PermissionService2({
     policy: effectivePolicy,
     ceiling: mutatingCeiling(tools, "ask"),
     ...unattendedAllow ? { prompt: { ask: async () => "allow" } } : {}
@@ -22467,7 +22736,7 @@ ${extra}` : base;
 import { spawn } from "node:child_process";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/extensions.ts
@@ -22535,12 +22804,12 @@ function findExtensionEntry(pkg, entry, look = {}) {
     if (exists(direct)) return direct;
   } catch {
   }
-  let dir = look.fromDir ?? dirname2(fileURLToPath(import.meta.url));
+  let dir = look.fromDir ?? dirname3(fileURLToPath(import.meta.url));
   const parts = [...pkg.split("/"), ...entry.split("/")];
   for (let up = 0; up < 8; up++) {
-    const candidate = join3(dir, "node_modules", ...parts);
+    const candidate = join4(dir, "node_modules", ...parts);
     if (exists(candidate)) return candidate;
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -22548,7 +22817,7 @@ function findExtensionEntry(pkg, entry, look = {}) {
 }
 function versionAt(entry, read = readFileSyncUtf8) {
   try {
-    const parsed = JSON.parse(read(join3(dirname2(dirname2(entry)), "package.json")));
+    const parsed = JSON.parse(read(join4(dirname3(dirname3(entry)), "package.json")));
     const v = parsed.version;
     return typeof v === "string" ? v : "?";
   } catch {
@@ -22592,8 +22861,8 @@ async function runExtension(ext, rest, look = {}) {
   try {
     return await new Promise((resolve2, reject) => {
       child.on("error", reject);
-      child.on("exit", (code, signal) => {
-        resolve2(code ?? (signal === "SIGINT" ? 130 : signal ? 143 : 1));
+      child.on("exit", (code2, signal) => {
+        resolve2(code2 ?? (signal === "SIGINT" ? 130 : signal ? 143 : 1));
       });
     });
   } finally {
@@ -22674,7 +22943,7 @@ function helpText(version2) {
 // src/version.ts
 import { createRequire as createRequire2 } from "node:module";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function selfPath() {
   try {
@@ -22684,15 +22953,15 @@ function selfPath() {
   }
 }
 function version(read = (p) => readFileSync2(p, "utf8")) {
-  let dir = dirname3(selfPath());
+  let dir = dirname4(selfPath());
   for (let up = 0; up < 4; up++) {
     try {
-      const parsed = JSON.parse(read(join4(dir, "package.json")));
+      const parsed = JSON.parse(read(join5(dir, "package.json")));
       const v = parsed;
       if (v.name === "@corenel/cli" && typeof v.version === "string") return v.version;
     } catch {
     }
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -22708,16 +22977,13 @@ function version(read = (p) => readFileSync2(p, "utf8")) {
 
 // src/auth.ts
 function hintOf(token) {
-  const t = token.trim();
-  if (t.length <= 8) return "****";
-  return `${t.slice(0, 4)}\u2026${t.slice(-2)} (${t.length} chars)`;
+  return maskToken(token);
 }
-async function authState(read = readAuthToken, env = process.env) {
-  const path = authTokenPath();
-  const stored = await read();
-  if (stored) return { source: "file", path, hint: hintOf(stored) };
-  if (env.CORENEL_TOKEN) return { source: "env", path, hint: hintOf(env.CORENEL_TOKEN) };
-  return { source: "none", path };
+async function authState(resolve2 = (env2) => resolveNodeCredential({ env: env2 }), env = process.env) {
+  const r = await resolve2(env);
+  if (!r.token) return { source: "none", path: authTokenPath() };
+  const source = r.source === "env" ? "env" : "file";
+  return { source, path: r.path ?? authTokenPath(), hint: hintOf(r.token) };
 }
 function describeAuth(s, base) {
   if (s.source === "none") {
@@ -22735,12 +23001,12 @@ function describeAuth(s, base) {
   ].filter(Boolean).join("\n");
 }
 async function runAuth(out = (s) => process.stdout.write(s)) {
-  out(`${describeAuth(await authState(), apiBase())}
+  out(`${describeAuth(await authState(), await apiBase())}
 `);
 }
 async function runLogout(out = (s) => process.stdout.write(s)) {
   const before = await authState();
-  await clearAuthToken();
+  await clearAllCredentials();
   if (before.source === "file") out(`Signed out. Removed ${before.path}
 `);
   else out("Nothing to forget \u2014 no stored token.\n");
@@ -22781,7 +23047,7 @@ async function checkToken(base, token, f = fetch) {
   return { name: "token", status: "ok", detail: `accepted by ${base} (${res.status})` };
 }
 async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
-  const base = apiBase();
+  const base = await apiBase();
   const checks = [
     { name: "binary", status: "ok", detail: selfPath() },
     { name: "version", status: "ok", detail: `@corenel/cli ${version()}` },
@@ -22789,7 +23055,7 @@ async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
     {
       name: "api",
       status: "ok",
-      detail: base === DEFAULT_API_BASE ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE})`
+      detail: base === DEFAULT_API_BASE2 ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE2})`
     }
   ];
   try {
@@ -22806,7 +23072,7 @@ async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
     status: auth.source === "none" ? "warn" : "ok",
     detail: auth.source === "none" ? "no" : `yes, from ${auth.source === "env" ? "CORENEL_TOKEN" : auth.path} (${auth.hint})`
   });
-  checks.push(await checkToken(base, await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null, f));
+  checks.push(await checkToken(base, (await resolveNodeCredential()).token, f));
   const sidecar = findSidecarEntry();
   checks.push({
     name: "sidecar",
@@ -22837,7 +23103,7 @@ ${failed.length} problem${failed.length > 1 ? "s" : ""} above.
 
 // src/repl.ts
 import { createInterface } from "node:readline";
-import { PermissionService as PermissionService2 } from "@corenel/harness/guardrail/permission-service";
+import { PermissionService as PermissionService3 } from "@corenel/harness/guardrail/permission-service";
 import { STANDARD_POLICY as STANDARD_POLICY2 } from "@corenel/harness/guardrail/builtins";
 import { TermSession } from "@corenel/term/session";
 import { describeToolCall, formatOrd } from "@corenel/term/describe";
@@ -23015,7 +23281,7 @@ async function runRepl(deps) {
     }
   };
   rl.on("SIGINT", onSigint);
-  const permission = new PermissionService2({
+  const permission = new PermissionService3({
     policy: deps.policy ?? STANDARD_POLICY2,
     prompt: {
       ask: async (req) => {
@@ -23139,16 +23405,16 @@ function execute(command, opts) {
       killTree(child);
     };
     opts.signal?.addEventListener("abort", onAbort, { once: true });
-    const finish = (code) => {
+    const finish = (code2) => {
       clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
-      resolve2({ code, stdout, stderr, timedOut });
+      resolve2({ code: code2, stdout, stderr, timedOut });
     };
     child.on("error", (e) => {
       stderr += String(e);
       finish(null);
     });
-    child.on("close", (code) => finish(code));
+    child.on("close", (code2) => finish(code2));
   });
 }
 function shellTool(cwd) {
@@ -23620,8 +23886,8 @@ async function resolveStrategyPrompt(files, id) {
 
 // src/policyResolve.ts
 import { readFile } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
 import { stateDirName as stateDirName5 } from "@corenel/protocol";
 import { BUILTIN_POLICIES, STANDARD_POLICY as STANDARD_POLICY3, policyFromYaml } from "@corenel/harness/guardrail";
 var PolicyResolutionError = class extends Error {
@@ -23681,10 +23947,10 @@ async function resolvePolicy(opts) {
     );
     return { policy, source: { kind: "file", path: flag2 } };
   }
-  const projectPath = join5(cwd, stateDirName5(), "policy.yaml");
+  const projectPath = join6(cwd, stateDirName5(), "policy.yaml");
   const project = await loadDiscoveredPolicyFile(projectPath);
   if (project) return { policy: project, source: { kind: "project", path: projectPath } };
-  const userPath = join5(homedir2(), stateDirName5(), "policy.yaml");
+  const userPath = join6(homedir3(), stateDirName5(), "policy.yaml");
   const user = await loadDiscoveredPolicyFile(userPath);
   if (user) return { policy: user, source: { kind: "user", path: userPath } };
   return { policy: STANDARD_POLICY3, source: { kind: "default" } };
@@ -23693,7 +23959,7 @@ async function resolvePolicy(opts) {
 // src/cli.ts
 var EXIT_POLICY_PARK_REFUSED = 3;
 async function agentSetup(argv) {
-  setGatewayBase2(apiBase(flag(argv, "base", "")));
+  setGatewayBase2(await apiBase(flag(argv, "base", "")));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     process.stderr.write("corenel: not signed in.\n  Run `corenel login`, or set CORENEL_TOKEN=<token> (a gateway bearer token), then try again.\n");
@@ -23703,7 +23969,16 @@ async function agentSetup(argv) {
   const tools = [...allTools3(), shellTool(process.cwd())];
   const sidecarProcs = await connectSidecarProcs();
   if (sidecarProcs) tools.push(...procTools(sidecarProcs.procs, { session: "corenel-cli" }));
-  setPromptHost(nodePromptHost(new NodeFileService(join6(corenelDir(), "config"))));
+  try {
+    const migrated = await migrateHomeLayout();
+    if (migrated.moved.length) {
+      console.error(`layout: moved ${migrated.moved.length} item(s) into the current ~/${stateDirName6()} layout`);
+    }
+    for (const left of migrated.skipped) console.error(`layout: left ${left.path} alone (${left.reason})`);
+  } catch (e) {
+    console.error(`layout: migration skipped (${e instanceof Error ? e.message : String(e)})`);
+  }
+  setPromptHost(nodePromptHost(new NodeFileService(configWorkspaceRoot()), new NodeFileService(process.cwd())));
   const identity = createIdentityState();
   let system = "You are corenel, a concise CLI assistant.";
   try {
@@ -23770,7 +24045,7 @@ async function run(argv) {
       process.exitCode = EXIT_POLICY_PARK_REFUSED;
       return;
     }
-    const permission = new PermissionService3({
+    const permission = new PermissionService4({
       policy,
       ceiling: mutatingCeiling(tools, "ask"),
       ...unattendedAllow ? { prompt: { ask: async () => "allow" } } : {}
@@ -23942,7 +24217,7 @@ async function main() {
           process.exit(2);
         }
         const policyOverride = hasValueFlag(rest, "policy") ? (await resolvePolicy({ flag: flag(rest, "policy", ""), cwd: process.cwd() })).policy : void 0;
-        const code = await runCrewAgentCli({
+        const code2 = await runCrewAgentCli({
           cwd: process.cwd(),
           agent,
           input: flag(rest, "input", ""),
@@ -23958,7 +24233,7 @@ async function main() {
           warn: (line) => process.stderr.write(`corenel: ${line}
 `)
         });
-        process.exitCode = code;
+        process.exitCode = code2;
         break;
       }
       case "sidecar":
@@ -23969,8 +24244,8 @@ async function main() {
         break;
       }
       case "login": {
-        const base = apiBase(flag(rest, "base", ""));
-        await deviceLogin({ base, store: writeAuthToken });
+        const base = await apiBase(flag(rest, "base", ""));
+        await deviceLogin({ base, store: (token) => writeLoginCredential(token, { apiBase: base }) });
         process.stdout.write(`
 Logged in. Token saved to ${authTokenPath()}
 `);