@corenel/cli 0.7.0 → 0.9.0

package/README.md

@@ -1,68 +1,77 @@
-# @corenel/cli
-
-The Corenel CLI — runs the host-agnostic agent harness in Node, in-process (no
-transport). Early/beta: the headless proof the kernel runs outside the browser.
-
-```bash
-npx @corenel/cli
-```
-
-Requires Node 22+. Bring your provider key via the environment.
-
-Running `corenel` with no command opens an interactive agent in the current
-directory. On a terminal it opens the full terminal face; when output is piped,
-under `TERM=dumb`, in CI, or with `--no-tui`, it falls back to a plain
-line-by-line loop. `--tui` demands the full face and fails rather than falling
-back. `--resume` reopens the last conversation.
-
-Assistant replies render as markdown. More verbs (`run` / `ask` / `chat` /
-`login`, and `start --sidecar`) are in progress.
-
-## Releasing
-
-`@corenel/term` (the terminal face) is a real runtime dependency, not bundled
-into `dist/main.js` -- see the note at the top of `build.mjs`. (`dist/cli.js`,
-the bin, is only a Node >=22 check that then imports `main.js`.) `@corenel/term`'s
-own dist is bundled but keeps `@corenel/harness` and `@corenel/protocol`
-EXTERNAL (see `packages/term/build.mjs`) -- both the CLI and term import the
-harness directly, and they must resolve to the SAME installed copy, or the
-`llm-execution` feature guard and `--debug` logging silently apply to the
-wrong module instance. That makes all four packages real runtime dependencies
-of each other, and publish order matters:
-
-    pnpm --filter @corenel/protocol build && pnpm --filter @corenel/protocol publish
-    pnpm --filter @corenel/harness  build && pnpm --filter @corenel/harness  publish
-    pnpm --filter @corenel/term     build && pnpm --filter @corenel/term     publish
-    pnpm --filter @corenel/cli      build && pnpm --filter @corenel/cli      publish
-
-Publishing any package against an unpublished dependency yields one that
-cannot install at all, so `npx @corenel/cli` fails before any verb runs.
-
-Publish with **pnpm, never npm**: this CLI depends on `@corenel/term` as
-`workspace:*`, and pnpm rewrites the `workspace:` protocol to a real version at
-pack/publish time while npm ships it verbatim -- an `npm publish` from this
-workspace produces a manifest whose install fails with
-`EUNSUPPORTEDPROTOCOL / Unsupported URL Type "workspace:"`, which is the very
-breakage this section exists to prevent.
-
-**All four versions must be bumped and published together, in the order
-above, every release -- even one that only touches a single package.** pnpm
-rewrites every `workspace:*` dependency to the EXACT current version of that
-dependency at pack time. All four packages are pinned to the same harness
-version today, so a normal `npm install` of `@corenel/cli` resolves to one
-harness copy. Bump `@corenel/harness` and publish a new `@corenel/term`
-without also republishing `@corenel/cli`, and the tree that installs
-`@corenel/cli` gets the OLD harness version nested under it (frozen into the
-manifest `@corenel/cli` published against) plus the NEW harness version
-hoisted at the top level for `@corenel/term` -- two separate harness module
-instances again, silently. That is exactly the bug this section's ordering
-exists to prevent (see `harnessSingleInstance.test.ts` in this package's
-`test/`): `registerGuard()`/`setAgentLogging()` calls made through one
-instance configure a module the other never reads, so the `llm-execution`
-feature gate silently stops running and `--debug` logging can't be turned
-off. Every test in this repo stays green when that happens, because the
-in-repo workspace is symlinked (one instance by construction) and the
-build-output regression test only exercises that same symlinked layout --
-neither one can see a real, version-skewed `npm install`.
-
-Licensed under Elastic-2.0.
+# @corenel/cli
+
+The Corenel CLI — runs the host-agnostic agent harness in Node, in-process (no
+transport). Early/beta: the headless proof the kernel runs outside the browser.
+
+```bash
+npx @corenel/cli
+```
+
+Requires Node 22+. Bring your provider key via the environment.
+
+Running `corenel` with no command opens an interactive agent in the current
+directory. On a terminal it opens the full terminal face; when output is piped,
+under `TERM=dumb`, in CI, or with `--no-tui`, it falls back to a plain
+line-by-line loop. `--tui` demands the full face and fails rather than falling
+back. `--resume` reopens the last conversation.
+
+Assistant replies render as markdown. More verbs (`run` / `ask` / `chat` /
+`login`, and `start --sidecar`) are in progress.
+
+The API base is `--base`, then `CORENEL_API_BASE`, then the base recorded at
+`corenel login`, then `https://api.corenel.ai/api`. Run from source
+(`tsx src/cli.ts`), that last default becomes the local API
+(`http://localhost:3010/api`) instead; `corenel auth` and `corenel doctor`
+say so, and a `login` from source records the local base on its credential.
+`--base` and `CORENEL_API_BASE` turn that off, and a recorded login base wins over
+it; to move a credential between production and the local API, run
+`corenel logout` before `corenel login`.
+
+## Releasing
+
+`@corenel/term` (the terminal face) is a real runtime dependency, not bundled
+into `dist/main.js` -- see the note at the top of `build.mjs`. (`dist/cli.js`,
+the bin, is only a Node >=22 check that then imports `main.js`.) `@corenel/term`'s
+own dist is bundled but keeps `@corenel/harness` and `@corenel/protocol`
+EXTERNAL (see `packages/term/build.mjs`) -- both the CLI and term import the
+harness directly, and they must resolve to the SAME installed copy, or the
+`llm-execution` feature guard and `--debug` logging silently apply to the
+wrong module instance. That makes all four packages real runtime dependencies
+of each other, and publish order matters:
+
+    pnpm --filter @corenel/protocol build && pnpm --filter @corenel/protocol publish
+    pnpm --filter @corenel/harness  build && pnpm --filter @corenel/harness  publish
+    pnpm --filter @corenel/term     build && pnpm --filter @corenel/term     publish
+    pnpm --filter @corenel/cli      build && pnpm --filter @corenel/cli      publish
+
+Publishing any package against an unpublished dependency yields one that
+cannot install at all, so `npx @corenel/cli` fails before any verb runs.
+
+Publish with **pnpm, never npm**: this CLI depends on `@corenel/term` as
+`workspace:*`, and pnpm rewrites the `workspace:` protocol to a real version at
+pack/publish time while npm ships it verbatim -- an `npm publish` from this
+workspace produces a manifest whose install fails with
+`EUNSUPPORTEDPROTOCOL / Unsupported URL Type "workspace:"`, which is the very
+breakage this section exists to prevent.
+
+**All four versions must be bumped and published together, in the order
+above, every release -- even one that only touches a single package.** pnpm
+rewrites every `workspace:*` dependency to the EXACT current version of that
+dependency at pack time. All four packages are pinned to the same harness
+version today, so a normal `npm install` of `@corenel/cli` resolves to one
+harness copy. Bump `@corenel/harness` and publish a new `@corenel/term`
+without also republishing `@corenel/cli`, and the tree that installs
+`@corenel/cli` gets the OLD harness version nested under it (frozen into the
+manifest `@corenel/cli` published against) plus the NEW harness version
+hoisted at the top level for `@corenel/term` -- two separate harness module
+instances again, silently. That is exactly the bug this section's ordering
+exists to prevent (see `harnessSingleInstance.test.ts` in this package's
+`test/`): `registerGuard()`/`setAgentLogging()` calls made through one
+instance configure a module the other never reads, so the `llm-execution`
+feature gate silently stops running and `--debug` logging can't be turned
+off. Every test in this repo stays green when that happens, because the
+in-repo workspace is symlinked (one instance by construction) and the
+build-output regression test only exercises that same symlinked layout --
+neither one can see a real, version-skewed `npm install`.
+
+Licensed under Elastic-2.0.

package/dist/main.js

@@ -390,6 +390,19 @@ var init_fileService = __esm({
         await this.assertReal(a);
         await writeFileAtomic(a, bytes, { shownPath: path });
       }
+      /** O_APPEND, NOT atomic-rename: the point is that another process appending
+       * to the same file at the same moment lands too, and a rename would replace
+       * whatever it wrote. Same confinement as write. */
+      async append(path, content) {
+        const a = await this.writeTarget(path);
+        await fs2.mkdir(dirname2(a), { recursive: true });
+        await this.assertReal(a);
+        try {
+          await fs2.appendFile(a, content, "utf8");
+        } catch (e) {
+          throw diskFullError(path, e) ?? e;
+        }
+      }
       async create(path, content = "") {
         const a = await this.writeTarget(path);
         await fs2.mkdir(dirname2(a), { recursive: true });
@@ -7878,7 +7891,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse2(src, reviver, options) {
+    function parse3(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7919,7 +7932,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse2;
+    exports.parse = parse3;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument;
     exports.stringify = stringify2;
@@ -8445,7 +8458,7 @@ var require_parse = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/parse.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = (version2, options, throwErrors = false) => {
+    var parse3 = (version2, options, throwErrors = false) => {
       if (version2 instanceof SemVer) {
         return version2;
       }
@@ -8458,7 +8471,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module.exports = parse2;
+    module.exports = parse3;
   }
 });
 
@@ -8466,9 +8479,9 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/valid.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var valid = (version2, options) => {
-      const v = parse2(version2, options);
+      const v = parse3(version2, options);
       return v ? v.version : null;
     };
     module.exports = valid;
@@ -8479,9 +8492,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var clean = (version2, options) => {
-      const s = parse2(version2.trim().replace(/^[=v]+/, ""), options);
+      const s = parse3(version2.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module.exports = clean;
@@ -8516,10 +8529,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/diff.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var diff = (version1, version2) => {
-      const v1 = parse2(version1, null, true);
-      const v2 = parse2(version2, null, true);
+      const v1 = parse3(version1, null, true);
+      const v2 = parse3(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -8590,9 +8603,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/prerelease.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var prerelease = (version2, options) => {
-      const parsed = parse2(version2, options);
+      const parsed = parse3(version2, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module.exports = prerelease;
@@ -8778,7 +8791,7 @@ var require_coerce = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/coerce.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var { safeRe: re, t } = require_re();
     var coerce = (version2, options) => {
       if (version2 instanceof SemVer) {
@@ -8813,7 +8826,7 @@ var require_coerce = __commonJS({
       const patch = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse2(`${major}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse3(`${major}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module.exports = coerce;
   }
@@ -8823,7 +8836,7 @@ var require_coerce = __commonJS({
 var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var constants2 = require_constants();
     var SemVer = require_semver();
     var truncate2 = (version2, truncation, options) => {
@@ -8835,7 +8848,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version2, options) => {
       const versionStringToParse = version2 instanceof SemVer ? version2.version : version2;
-      return parse2(versionStringToParse, options);
+      return parse3(versionStringToParse, options);
     };
     var doTruncation = (version2, truncation) => {
       if (isPrerelease(truncation)) {
@@ -9877,7 +9890,7 @@ var require_semver2 = __commonJS({
     var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -9916,7 +9929,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module.exports = {
-      parse: parse2,
+      parse: parse3,
       valid,
       clean,
       inc,
@@ -12303,7 +12316,7 @@ var require_parser2 = __commonJS({
         }
         return buf;
       };
-      _proto.parse = function parse2() {
+      _proto.parse = function parse3() {
         return new nodes.NodeList(0, 0, this.parseNodes());
       };
       _proto.parseAsRoot = function parseAsRoot() {
@@ -12312,7 +12325,7 @@ var require_parser2 = __commonJS({
       return Parser2;
     }(Obj);
     module.exports = {
-      parse: function parse2(src, extensions, opts) {
+      parse: function parse3(src, extensions, opts) {
         var p = new Parser(lexer.lex(src, opts));
         if (extensions !== void 0) {
           p.extensions = extensions;
@@ -13894,7 +13907,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str, res);
     }
     _exports.indent = indent;
-    function join13(arr, del, attr) {
+    function join14(arr, del, attr) {
       del = del || "";
       if (attr) {
         arr = lib.map(arr, function(v) {
@@ -13903,7 +13916,7 @@ var require_filters = __commonJS({
       }
       return arr.join(del);
     }
-    _exports.join = join13;
+    _exports.join = join14;
     function last(arr) {
       return arr[arr.length - 1];
     }
@@ -15246,8 +15259,8 @@ var require_precompile = __commonJS({
         fs6.readdirSync(dir).forEach(function(file) {
           var filepath = path.join(dir, file);
           var subpath = filepath.substr(path.join(input, "/").length);
-          var stat = fs6.statSync(filepath);
-          if (stat && stat.isDirectory()) {
+          var stat2 = fs6.statSync(filepath);
+          if (stat2 && stat2.isDirectory()) {
             subpath += "/";
             if (!match(subpath, opts.exclude)) {
               addTemplates(filepath);
@@ -16426,8 +16439,8 @@ ${yamlContent}` : yamlContent;
         if (resolvedInheritsRef.startsWith("./") || resolvedInheritsRef.startsWith("../") || resolvedInheritsRef.startsWith("/") || !resolvedInheritsRef.startsWith("@") && isPrompdFile(resolvedInheritsRef)) {
           const sourceDir = context.fileSystem.dirname(context.sourceFile);
           const parentPath = context.fileSystem.resolve(sourceDir, resolvedInheritsRef);
-          const fileExists = await context.fileSystem.exists(parentPath);
-          if (!fileExists) {
+          const fileExists2 = await context.fileSystem.exists(parentPath);
+          if (!fileExists2) {
             const location = context.findLocation(/inherits:/);
             context.addDiagnostic({
               message: `Inherited file not found: "${resolvedInheritsRef}" (resolved to: ${parentPath})`,
@@ -16454,8 +16467,8 @@ ${yamlContent}` : yamlContent;
               }
               const packagePath = await this.resolvePackage(context, packageRef);
               const fullFilePath = resolvePackageFile(packagePath, filePathInPackage);
-              const fileExists = await context.fileSystem.exists(fullFilePath);
-              if (!fileExists) {
+              const fileExists2 = await context.fileSystem.exists(fullFilePath);
+              if (!fileExists2) {
                 const location = context.findLocation(/inherits:/);
                 context.addDiagnostic({
                   message: `Inherited file not found in package: "${filePathInPackage}" (package: ${packageRef})`,
@@ -21103,7 +21116,7 @@ var require_extension = __commonJS({
       if (dest[name] === void 0) dest[name] = [elem];
       else dest[name].push(elem);
     }
-    function parse2(header) {
+    function parse3(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -21243,7 +21256,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse: parse2 };
+    module.exports = { format, parse: parse3 };
   }
 });
 
@@ -21277,7 +21290,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format, parse: parse2 } = require_extension();
+    var { format, parse: parse3 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -21954,7 +21967,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse2(secWebSocketExtensions);
+            extensions = parse3(secWebSocketExtensions);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
@@ -22246,7 +22259,7 @@ var require_subprotocol = __commonJS({
   "../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function parse2(header) {
+    function parse3(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -22282,7 +22295,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module.exports = { parse: parse2 };
+    module.exports = { parse: parse3 };
   }
 });
 
@@ -22691,7 +22704,7 @@ var require_websocket_server = __commonJS({
 init_tools_node();
 import { runAgent as runAgent2 } from "@corenel/harness/core/loop";
 import { createChatClient as createChatClient2, setGatewayBase as setGatewayBase2 } from "@corenel/harness/providers/gateway";
-import { resolveContextWindow as resolveContextWindow2, resolveContextWindowWithHydration } from "@corenel/harness/providers/contextWindow";
+import { resolveContextWindow as resolveContextWindow3, resolveContextWindowWithHydration } from "@corenel/harness/providers/contextWindow";
 import { basename as basename5 } from "node:path";
 import { randomUUID } from "node:crypto";
 import { allTools as allTools3 } from "@corenel/harness/tools/builtins";
@@ -22708,9 +22721,9 @@ function configWorkspaceRoot(base) {
 
 // src/cli.ts
 import { FileRecallStore, UNATTACHED_SESSION } from "@corenel/harness/sessions/fileRecallStore";
-import { makeCheckpointStore } from "@corenel/harness/sessions/checkpointStore";
+import { makeSessionFoldStorage } from "@corenel/harness/sessions/foldStorage";
 import { makeSummarizer } from "@corenel/harness/core/summarize";
-import { stateDirName as stateDirName7, sessionsRoot } from "@corenel/protocol";
+import { stateDirName as stateDirName7, sessionsRoot, isSourceRun } from "@corenel/protocol";
 import { PermissionService as PermissionService6 } from "@corenel/harness/guardrail/permission-service";
 
 // src/nodeContext.ts
@@ -24865,7 +24878,7 @@ async function deviceLogin(opts) {
       );
     }
   };
-  const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent" });
+  const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent pair" });
   if (!dc.device_code) throw new Error("device authorization failed");
   (opts.open ?? defaultOpen)(dc.verification_uri, dc.user_code);
   let interval = opts.pollMs ?? Math.max(MIN_POLL_MS, (dc.interval ?? 5) * 1e3);
@@ -24905,6 +24918,7 @@ import { createChatClient, setGatewayBase } from "@corenel/harness/providers/gat
 // src/apiBase.ts
 init_tools_node();
 import { DEFAULT_API_BASE as DEFAULT_API_BASE2 } from "@corenel/protocol";
+import { DEV_PROFILE } from "@corenel/protocol";
 var InvalidApiBaseError = class extends Error {
   constructor(value, why) {
     super(`invalid API base ${JSON.stringify(value)} -- ${why}`);
@@ -24913,17 +24927,39 @@ var InvalidApiBaseError = class extends Error {
     this.name = "InvalidApiBaseError";
   }
 };
-function isLoopback(hostname) {
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+function isLoopback(hostname2) {
+  const h = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
   return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
 }
 var warnedCleartext = false;
+var sourceRunDefault = false;
+function setSourceRun(sourceRun) {
+  sourceRunDefault = sourceRun;
+}
+function applySourceRunDevBase(resolved, sourceRun) {
+  if (!sourceRun || resolved.source !== "default") return resolved;
+  return { base: DEV_PROFILE.apiBase, source: "dev-profile" };
+}
+function cliDevRelayBases(resolved, sourceRun = sourceRunDefault) {
+  if (resolved.source === "dev-profile") return [resolved.base];
+  if (sourceRun && resolved.source === "credential" && resolved.base.replace(/\/+$/, "") === DEV_PROFILE.apiBase) return [resolved.base];
+  return [];
+}
+function apiBaseNote(source) {
+  return source === "dev-profile" ? "dev profile: running from source" : void 0;
+}
 async function apiBase(explicit, opts = {}) {
-  const resolved = await resolveApiBase({
-    explicit,
-    env: opts.env ?? process.env,
-    ...opts.stateDir ? { stateDir: opts.stateDir } : {}
-  });
+  return (await resolveCliApiBase(explicit, opts)).base;
+}
+async function resolveCliApiBase(explicit, opts = {}) {
+  const resolved = applySourceRunDevBase(
+    await resolveApiBase({
+      explicit,
+      env: opts.env ?? process.env,
+      ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+    }),
+    opts.sourceRun ?? sourceRunDefault
+  );
   const value = resolved.base;
   let url;
   try {
@@ -24941,7 +24977,7 @@ async function apiBase(explicit, opts = {}) {
 `
     );
   }
-  return value;
+  return resolved;
 }
 
 // src/runAgent.ts
@@ -25257,7 +25293,9 @@ function helpText(version2) {
     "  --model <id>       model for this turn (default gpt-4o-mini)",
     "  --base <url>       API base (default https://api.corenel.ai/api, or CORENEL_API_BASE)",
     "  --policy <name|path>  a builtin policy name (e.g. read-only) or a policy YAML file;",
-    "                     default is a project/user policy.yaml if one exists, else standard",
+    "                     default is the per-project policy (policies/ws-<id>.yaml in your home",
+    "                     state dir), else the user policy.yaml there, else standard. A",
+    "                     policy.yaml inside the project folder is ignored.",
     "  --allow-mutations  allow write/shell/other mutating tools (run/run-agent refuse them",
     "                     outright without this; interactively it skips the per-command",
     "                     prompt instead). --allow-shell still works as an alias.",
@@ -25342,23 +25380,27 @@ async function authState(resolve4 = (env2) => resolveNodeCredential({ env: env2
   const source = r.source === "env" ? "env" : "file";
   return { source, path: r.path ?? authTokenPath(), hint: hintOf(r.token) };
 }
-function describeAuth(s, base) {
+function describeAuth(s, base, source) {
+  const note = source ? apiBaseNote(source) : void 0;
+  const apiLine = `  api    ${base}${note ? `  (${note})` : ""}`;
   if (s.source === "none") {
     return [
       "Not signed in.",
       `  Run \`corenel login\`, or set CORENEL_TOKEN=<token>.`,
-      `  Token would be stored at ${s.path}`
-    ].join("\n");
+      `  Token would be stored at ${s.path}`,
+      note ? apiLine : null
+    ].filter(Boolean).join("\n");
   }
   return [
     `Signed in (${s.source === "env" ? "CORENEL_TOKEN environment variable" : s.path}).`,
     `  token  ${s.hint}`,
-    `  api    ${base}`,
+    apiLine,
     s.source === "env" ? "  NOTE: the environment wins over any stored token, so `corenel logout` will not change this." : null
   ].filter(Boolean).join("\n");
 }
 async function runAuth(out = (s) => process.stdout.write(s)) {
-  out(`${describeAuth(await authState(), await apiBase())}
+  const { base, source } = await resolveCliApiBase();
+  out(`${describeAuth(await authState(), base, source)}
 `);
 }
 async function runLogout(out = (s) => process.stdout.write(s)) {
@@ -25417,6 +25459,7 @@ var KNOWN_KEYS = [
   "addUnder",
   "cloneUnder",
   "allowLan",
+  "behindTlsProxy",
   "allowOrigins",
   "tlsCert",
   "tlsKey",
@@ -25438,7 +25481,7 @@ var KNOWN_KEYS = [
   "mcpServers",
   "mcpAllow",
   "identityIssuer",
-  "identity",
+  "org",
   "push",
   "audit",
   "sendTelemetry",
@@ -25707,17 +25750,19 @@ async function checkSidecarEnv(base, env, stateDir = corenelDir()) {
     return { name: "sidecar", status: "fail", detail: `${base}  (env: ${env}) -- ${e instanceof Error ? e.message : String(e)}` };
   }
 }
+function apiCheck(resolved) {
+  const note = apiBaseNote(resolved.source);
+  const detail = note ? `${resolved.base}  (${note}; installed default is ${DEFAULT_API_BASE2})` : resolved.base === DEFAULT_API_BASE2 ? resolved.base : `${resolved.base}  (overridden; default is ${DEFAULT_API_BASE2})`;
+  return { name: "api", status: "ok", detail };
+}
 async function collectChecks(f = fetch, modelId = DEFAULT_MODEL, env) {
-  const base = await apiBase();
+  const resolvedBase = await resolveCliApiBase();
+  const base = resolvedBase.base;
   const checks = [
     { name: "binary", status: "ok", detail: selfPath() },
     { name: "version", status: "ok", detail: `@corenel/cli ${version()}` },
     { name: "node", status: "ok", detail: process.version },
-    {
-      name: "api",
-      status: "ok",
-      detail: base === DEFAULT_API_BASE2 ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE2})`
-    }
+    apiCheck(resolvedBase)
   ];
   try {
     const u = new URL(base);
@@ -25765,7 +25810,7 @@ import { createInterface } from "node:readline";
 import { PermissionService as PermissionService4 } from "@corenel/harness/guardrail/permission-service";
 import { STANDARD_POLICY as STANDARD_POLICY2 } from "@corenel/harness/guardrail/builtins";
 import { approvalsHooks } from "@corenel/harness/approvals";
-import { TermSession, parseSuggestionChoice, suggestionKeys, suggestionLine, suggestionOutcome } from "@corenel/term/session";
+import { TermSession, startupResumeOptions, parseSuggestionChoice, suggestionKeys, suggestionLine, suggestionOutcome } from "@corenel/term/session";
 import { describeToolCall, formatOrd } from "@corenel/term/describe";
 import { buildWritePreview } from "@corenel/term/writePreview";
 import { formatEndingChange } from "@corenel/term/diff";
@@ -25923,10 +25968,10 @@ async function runRepl(deps) {
     }
   });
   if (deps.resume) {
-    await session.resume(deps.resume.id);
+    await session.resume(deps.resume.id, startupResumeOptions(deps.resume));
     const restored = session.getSnapshot();
     if (restored.session) {
-      writeLine(`  resumed ${restored.session.id} - ${restored.committed.length} messages
+      writeLine(`  resumed ${restored.session.id} - ${restored.committed.filter((i) => i.kind !== "note").length} messages
 `);
     }
   }
@@ -26213,6 +26258,44 @@ ${rules(r.workspace)}`);
 import { approvalsHooks as approvalsHooks2 } from "@corenel/harness/approvals";
 import { createSessionPersistence } from "@corenel/term/persist";
 
+// src/resumeModel.ts
+import { estimateFill, COMPACT_AT_FILL } from "@corenel/harness/core/compactHistory";
+import { resolveContextWindow as resolveContextWindow2 } from "@corenel/harness/providers/contextWindow";
+var DEFAULT_MODEL2 = "gpt-4o-mini";
+function resumeModel(flagModel, stored, fallback) {
+  return flagModel || stored || fallback;
+}
+async function storedModelOf(resume, persistence) {
+  if (!resume) return void 0;
+  const loaded = await persistence.load(resume.id);
+  if (!loaded) return void 0;
+  return { id: loaded.id, messages: loaded.messages, ...loaded.model ? { model: loaded.model } : {} };
+}
+async function resolveSessionModel(input) {
+  const { argv, persistence, fallback, isKnownModel } = input;
+  const windowOf = input.contextWindow ?? ((m) => resolveContextWindow2(m).window);
+  const flagModel = hasValueFlag(argv, "model") ? flag(argv, "model", "") || void 0 : void 0;
+  const resume = resumeFlag(argv);
+  let chat;
+  try {
+    chat = await storedModelOf(resume, persistence);
+  } catch {
+    const model = flagModel ?? fallback;
+    return { model, notice: `could not read this chat's model, so it will run on ${model}.` };
+  }
+  const stored = chat?.model;
+  if (flagModel) {
+    if (!chat || !stored || stored === flagModel) return { model: flagModel };
+    const folds = estimateFill(chat.messages, windowOf(flagModel)) >= COMPACT_AT_FILL;
+    const notice = `chat ${chat.id} was on ${stored}; continuing on ${flagModel} (this changes the chat's model)` + (folds ? ", and older history will be folded to fit." : ".");
+    return { model: flagModel, notice };
+  }
+  if (stored && isKnownModel && !isKnownModel(stored)) {
+    return { model: fallback, notice: `this chat used ${stored}, which is not available. It will run on ${fallback}.` };
+  }
+  return { model: resumeModel(void 0, stored, fallback) };
+}
+
 // src/shellTool.ts
 import { spawn as spawn3 } from "node:child_process";
 var MAX_OUTPUT = 3e4;
@@ -26323,7 +26406,7 @@ import { procTools } from "@corenel/harness/tools/procs";
 
 // src/sidecarConnect.ts
 import { stateDirName as stateDirName5 } from "@corenel/protocol";
-import { SidecarHost } from "@corenel/harness/sidecar/host";
+import { SidecarHost, isSidecarKeyMismatch, isSidecarAccountRefusal } from "@corenel/harness/sidecar/host";
 
 // ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -26486,12 +26569,209 @@ function hostBackedProcs(host, seed = []) {
   };
 }
 
+// src/sidecarDevice.ts
+init_tools_node();
+import { join as join10 } from "node:path";
+import { asEcPublicJwk, generatePrivateJwk, signerFromPrivateJwk } from "@corenel/harness/sidecar/deviceKeys";
+function cliDevicesPath(base) {
+  return join10(corenelDir(base), "cli", "sidecar-devices.json");
+}
+var B64 = /^[A-Za-z0-9_-]{1,64}$/;
+var B43 = /^[A-Za-z0-9_-]{43}$/;
+function isCliDevice(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  const k = r.privateJwk;
+  return typeof r.id === "string" && B64.test(r.id) && typeof r.sidecarJkt === "string" && B43.test(r.sidecarJkt) && typeof k === "object" && k !== null && !!asEcPublicJwk({ kty: k.kty, crv: k.crv, x: k.x, y: k.y }) && typeof k.d === "string" && B43.test(k.d);
+}
+function parse2(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const r = raw;
+  if (typeof r !== "object" || r === null || r.version !== 1) return null;
+  if (typeof r.devices !== "object" || r.devices === null || Array.isArray(r.devices)) return null;
+  const devices = /* @__PURE__ */ Object.create(null);
+  for (const [url, d] of Object.entries(r.devices)) {
+    if (!isCliDevice(d)) return null;
+    const k = d.privateJwk;
+    devices[url] = { id: d.id, sidecarJkt: d.sidecarJkt, privateJwk: { kty: k.kty, crv: k.crv, x: k.x, y: k.y, d: k.d } };
+  }
+  return { version: 1, devices };
+}
+function cliDeviceStore(path = cliDevicesPath()) {
+  const file = fileTextStore(path);
+  const dir = join10(path, "..");
+  const load = async () => {
+    const text = await file.read();
+    return text === null ? { version: 1, devices: /* @__PURE__ */ Object.create(null) } : parse2(text);
+  };
+  const change = async (edit) => {
+    const f = await load();
+    if (!f) throw new Error(`${path} is not a file this CLI understands. Remove it to pair again.`);
+    edit(f);
+    await ensurePrivateDir(dir);
+    await file.write(`${JSON.stringify(f, null, 2)}
+`);
+  };
+  return {
+    async get(url) {
+      try {
+        const f = await load();
+        return f && Object.prototype.hasOwnProperty.call(f.devices, url) ? f.devices[url] : void 0;
+      } catch {
+        return void 0;
+      }
+    },
+    set: (url, device) => change((f) => {
+      f.devices[url] = device;
+    }),
+    forget: (url) => change((f) => {
+      delete f.devices[url];
+    })
+  };
+}
+async function sidecarCredential(url, env, store) {
+  const kept = await store.get(url);
+  const enroll = env.CORENEL_SIDECAR_CODE || void 0;
+  if (!kept && !enroll) return null;
+  const privateJwk = kept?.privateJwk ?? await generatePrivateJwk();
+  return {
+    ...enroll ? { enroll } : {},
+    ...kept ? { device: { id: kept.id, sidecarJkt: kept.sidecarJkt } } : {},
+    deviceKey: await signerFromPrivateJwk(privateJwk),
+    privateJwk
+  };
+}
+
+// src/sidecarIdentity.ts
+function cliIdentity(o) {
+  const fetchImpl = o.fetchImpl ?? fetch;
+  const timeoutMs = o.timeoutMs ?? 8e3;
+  let last = null;
+  return {
+    problem: () => last,
+    answer: async ({ nonce, sidecarId, jkt, orgId }) => {
+      last = null;
+      let token;
+      try {
+        token = await o.token();
+      } catch {
+        token = null;
+      }
+      if (!token) {
+        last = "this CLI is not signed in, and the sidecar only admits a verified account. Run `corenel login` (or set CORENEL_TOKEN), then try again.";
+        return null;
+      }
+      try {
+        const base = (await o.base()).replace(/\/+$/, "");
+        const res = await fetchImpl(`${base}/v1/pairing-assertions`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+          body: JSON.stringify({ aud: sidecarId, nonce, jkt, ...orgId ? { org_id: orgId } : {} }),
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (res.status === 403) {
+          let code3;
+          try {
+            code3 = (await res.json())?.code;
+          } catch {
+            code3 = void 0;
+          }
+          if (code3 === "CLI_SCOPE") {
+            last = "this CLI sign-in is not allowed to connect to sidecars. Run `corenel login` again and allow sidecar access when you approve it.";
+            return null;
+          }
+          if (orgId) {
+            last = `your account is not a member of the organization this sidecar admits (${orgId}).`;
+            return null;
+          }
+        }
+        if (res.status === 401) {
+          last = "the API refused this CLI sign-in. Run `corenel login` again, then try again.";
+          return null;
+        }
+        if (!res.ok) {
+          last = `could not get a pairing assertion from ${base} (HTTP ${res.status}).`;
+          return null;
+        }
+        const body = await res.json();
+        const assertion = body?.assertion;
+        if (typeof assertion !== "string" || !assertion) {
+          last = `${base} answered without a pairing assertion.`;
+          return null;
+        }
+        return assertion;
+      } catch (e) {
+        last = `could not reach the API for a pairing assertion (${e instanceof Error ? e.message : String(e)}).`;
+        return null;
+      }
+    }
+  };
+}
+
 // src/sidecarConnect.ts
+init_tools_node();
+import { hostname } from "node:os";
 var CONNECT_TIMEOUT_MS = 3e3;
-async function connectSidecarProcs(env = process.env) {
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+function cliDeviceName(host = hostname) {
+  let h = "";
+  try {
+    h = host().trim();
+  } catch {
+    h = "";
+  }
+  return h ? `CLI on ${h}` : "CLI";
+}
+function defaultCliIdentity(env) {
+  return cliIdentity({ base: () => apiBase(void 0, { env }), token: () => nodeAuthToken().getToken() });
+}
+async function reportHandshakeFailure(e, url, usedDevice, store, identity2, fallback) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (isSidecarKeyMismatch(e)) {
+    process.stderr.write(`corenel: sidecar connection at ${url} failed to complete: ${msg} -- ${fallback}
+`);
+    process.stderr.write(mismatchNote(url));
+    return;
+  }
+  if (isSidecarAccountRefusal(e)) {
+    const problem = identity2.problem() ?? "the sidecar verified this account and did not admit it (not its owner, or not a member of its organization, or a device another member paired).";
+    process.stderr.write(`corenel: the sidecar at ${url} did not accept this CLI: ${problem} -- ${fallback}
+`);
+    return;
+  }
+  process.stderr.write(`corenel: sidecar connection at ${url} failed to complete: ${msg} -- ${fallback}
+`);
+  if (usedDevice && /denied/.test(msg)) await store.forget(url).catch(() => void 0);
+}
+async function credentialOptions(url, env, store) {
+  const cred = await sidecarCredential(url, env, store);
+  if (!cred) return null;
+  const { privateJwk, ...host } = cred;
+  return {
+    ...host,
+    usedDevice: !!cred.device,
+    onDeviceIssued: (device) => {
+      store.set(url, { ...device, privateJwk }).catch((e) => {
+        process.stderr.write(`corenel: paired, but could not keep the device key: ${e instanceof Error ? e.message : String(e)}
+`);
+      });
+    }
+  };
+}
+function mismatchNote(url) {
+  return `corenel: the sidecar at ${url} is not the sidecar this CLI paired with (its key does not match the pinned fingerprint). Check the address. If that sidecar was reinstalled, pair again with a fresh code (CORENEL_SIDECAR_CODE from \`corenel-sidecar pair\`).
+`;
+}
+async function connectSidecarProcs(env = process.env, store = cliDeviceStore(), identity2 = defaultCliIdentity(env)) {
   const url = env.CORENEL_SIDECAR_URL;
-  const token = env.CORENEL_SIDECAR_TOKEN;
-  if (!url || !token) return null;
+  if (!url) return null;
+  const cred = await credentialOptions(url, env, store);
+  if (!cred) return null;
   const ac = new AbortController();
   const timer = setTimeout(() => ac.abort(), CONNECT_TIMEOUT_MS);
   let channel;
@@ -26506,24 +26786,23 @@ async function connectSidecarProcs(env = process.env) {
   } finally {
     clearTimeout(timer);
   }
+  const { usedDevice, ...credential } = cred;
   const host = new SidecarHost({
     channel,
-    token,
+    ...credential,
     stateDir: stateDirName5(),
     clientId: `corenel-cli-${process.pid}`,
-    clientName: "corenel-cli",
+    clientName: cliDeviceName(),
+    onIdentityChallenge: identity2.answer,
     providers: {},
     registerTool: () => {
     }
   });
   try {
-    await host.connect(CONNECT_TIMEOUT_MS);
+    await host.connect(HANDSHAKE_TIMEOUT_MS);
   } catch (e) {
-    process.stderr.write(
-      `corenel: sidecar connection at ${url} failed to complete: ${e instanceof Error ? e.message : String(e)} -- continuing without proc_start/proc_stop/proc_list.
-`
-    );
     host.disconnect("handshake failed");
+    await reportHandshakeFailure(e, url, usedDevice, store, identity2, "continuing without proc_start/proc_stop/proc_list.");
     return null;
   }
   if (!host.supportsProcs()) {
@@ -26533,10 +26812,11 @@ async function connectSidecarProcs(env = process.env) {
   const seed = await host.procList().catch(() => []);
   return { procs: hostBackedProcs(host, seed), disconnect: () => host.disconnect() };
 }
-async function connectMcpAdmin(env = process.env) {
+async function connectMcpAdmin(env = process.env, store = cliDeviceStore(), identity2 = defaultCliIdentity(env)) {
   const url = env.CORENEL_SIDECAR_URL;
-  const token = env.CORENEL_SIDECAR_TOKEN;
-  if (!url || !token) return null;
+  if (!url) return null;
+  const cred = await credentialOptions(url, env, store);
+  if (!cred) return null;
   const ac = new AbortController();
   const timer = setTimeout(() => ac.abort(), CONNECT_TIMEOUT_MS);
   let channel;
@@ -26551,24 +26831,23 @@ async function connectMcpAdmin(env = process.env) {
   } finally {
     clearTimeout(timer);
   }
+  const { usedDevice, ...credential } = cred;
   const host = new SidecarHost({
     channel,
-    token,
+    ...credential,
     stateDir: stateDirName5(),
     clientId: `corenel-cli-${process.pid}`,
-    clientName: "corenel-cli",
+    clientName: cliDeviceName(),
+    onIdentityChallenge: identity2.answer,
     providers: {},
     registerTool: () => {
     }
   });
   try {
-    await host.connect(CONNECT_TIMEOUT_MS);
+    await host.connect(HANDSHAKE_TIMEOUT_MS);
   } catch (e) {
-    process.stderr.write(
-      `corenel: sidecar connection at ${url} failed to complete: ${e instanceof Error ? e.message : String(e)} -- writing MCP config locally instead.
-`
-    );
     host.disconnect("handshake failed");
+    await reportHandshakeFailure(e, url, usedDevice, store, identity2, "writing MCP config locally instead.");
     return null;
   }
   if (!host.supportsMcpAdmin()) {
@@ -26821,9 +27100,9 @@ async function resolveStrategyPrompt(files, id) {
 }
 
 // src/policyResolve.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+init_tools_node();
+import { readFile as readFile2, stat } from "node:fs/promises";
+import { join as join11 } from "node:path";
 import { stateDirName as stateDirName6 } from "@corenel/protocol";
 import { BUILTIN_POLICIES, STANDARD_POLICY as STANDARD_POLICY3, policyFromYaml } from "@corenel/harness/guardrail";
 var PolicyResolutionError = class extends Error {
@@ -26871,25 +27150,55 @@ function validateOrThrow(text, path) {
   }
   return result.policy;
 }
+async function projectPolicyPath(cwd, homeBase) {
+  return join11(corenelDir(homeBase), "policies", `ws-${await workspaceApprovalsId(cwd)}.yaml`);
+}
+async function fileExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (e) {
+    return !(isErrnoException(e) && e.code === "ENOENT");
+  }
+}
 async function resolvePolicy(opts) {
-  const { flag: flag2, cwd } = opts;
+  const { flag: flag2, cwd, homeBase } = opts;
+  const warnings = [];
   if (flag2) {
     if (Object.prototype.hasOwnProperty.call(BUILTIN_POLICIES, flag2)) {
-      return { policy: BUILTIN_POLICIES[flag2], source: { kind: "builtin", name: flag2 } };
+      return { policy: BUILTIN_POLICIES[flag2], source: { kind: "builtin", name: flag2 }, warnings };
     }
     const policy = await loadRequiredPolicyFile(
       flag2,
       `corenel: unknown --policy "${flag2}" -- not a builtin (${Object.keys(BUILTIN_POLICIES).join(", ")}) and no file exists at that path.`
     );
-    return { policy, source: { kind: "file", path: flag2 } };
+    return { policy, source: { kind: "file", path: flag2 }, warnings };
+  }
+  const stateDir = corenelDir(homeBase);
+  const projectPath = await projectPolicyPath(cwd, homeBase);
+  const userPath = join11(stateDir, "policy.yaml");
+  if (await insideAnyRoot([cwd], stateDir) !== null) {
+    const present2 = [];
+    if (await fileExists(projectPath)) present2.push(projectPath);
+    if (await fileExists(userPath)) present2.push(userPath);
+    if (present2.length) {
+      throw new PolicyResolutionError(
+        `corenel: not loading ${present2.join(" or ")}: ${stateDir} is inside this folder (${cwd}), where the agent's file tools could have written it. Start corenel from a folder that does not contain it, or pass --policy <name|path> explicitly.`
+      );
+    }
+    return { policy: STANDARD_POLICY3, source: { kind: "default" }, warnings };
+  }
+  const workspacePath = join11(cwd, stateDirName6(), "policy.yaml");
+  if (await fileExists(workspacePath)) {
+    warnings.push(
+      `corenel: ${workspacePath} ignored -- a policy inside the workspace can be written by the agent or arrive in a cloned repo. To use it for this folder, move it to ${projectPath}, or pass --policy ${workspacePath} explicitly.`
+    );
   }
-  const projectPath = join10(cwd, stateDirName6(), "policy.yaml");
   const project = await loadDiscoveredPolicyFile(projectPath);
-  if (project) return { policy: project, source: { kind: "project", path: projectPath } };
-  const userPath = join10(homedir3(), stateDirName6(), "policy.yaml");
+  if (project) return { policy: project, source: { kind: "project", path: projectPath }, warnings };
   const user = await loadDiscoveredPolicyFile(userPath);
-  if (user) return { policy: user, source: { kind: "user", path: userPath } };
-  return { policy: STANDARD_POLICY3, source: { kind: "default" } };
+  if (user) return { policy: user, source: { kind: "user", path: userPath }, warnings };
+  return { policy: STANDARD_POLICY3, source: { kind: "default" }, warnings };
 }
 
 // ../mcp/src/httpClient.ts
@@ -27362,7 +27671,7 @@ function isExpired(cred, nowMs) {
 }
 
 // ../mcp/src/auth.ts
-import { DEFAULT_API_BASE as DEFAULT_API_BASE3 } from "@corenel/protocol";
+import { DEFAULT_API_BASE as DEFAULT_API_BASE4 } from "@corenel/protocol";
 function safeOrigin(url) {
   try {
     return new URL(url).origin;
@@ -27370,24 +27679,30 @@ function safeOrigin(url) {
     return "its URL";
   }
 }
-function isCorenelRelayUrl(url, bases) {
+function isCorenelRelayUrl(url, bases, devApiBases = []) {
   let u;
   try {
     u = new URL(url);
   } catch {
     return false;
   }
-  if (u.protocol !== "https:") return false;
   if (!/\/mcp\/hosted\/[^/]+\/?$/.test(u.pathname)) return false;
-  return bases.some((b) => {
+  const sameOrigin = (b) => {
     try {
       return new URL(b).origin === u.origin;
     } catch {
       return false;
     }
-  });
+  };
+  if (u.protocol === "https:") return [...bases, ...devApiBases].some(sameOrigin);
+  if (u.protocol === "http:" && isLoopbackHost(u.hostname)) return devApiBases.some(sameOrigin);
+  return false;
+}
+function isLoopbackHost(hostname2) {
+  const h = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h === "127.0.0.1" || h === "::1";
 }
-function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null, relayBases = async () => []) {
+function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null, relayBases = async () => [], devApiBases = []) {
   async function doRefresh(cred) {
     if (!cred.refreshToken) {
       throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
@@ -27400,7 +27715,7 @@ function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = asy
   return {
     async headers() {
       const cred = await readMcpCredential(stateDir, server.name);
-      if (server.hosted && !isCorenelRelayUrl(server.url, [DEFAULT_API_BASE3, ...await relayBases()])) {
+      if (server.hosted && !isCorenelRelayUrl(server.url, [DEFAULT_API_BASE4, ...await relayBases()], devApiBases)) {
         throw new Error(`"${server.name}" is marked hosted but ${safeOrigin(server.url)} is not a Corenel relay; refusing to send the account token there.`);
       }
       if (!cred && !server.hosted) {
@@ -27451,10 +27766,17 @@ async function accountTokenFor(stateDir) {
     return null;
   }
 }
+function mcpClientFactory(opts = {}) {
+  const devApiBases = [...opts.devApiBases ?? []];
+  return (stateDir, server) => buildClient(stateDir, server, devApiBases);
+}
 function defaultClientFactory(stateDir, server) {
+  return buildClient(stateDir, server, []);
+}
+function buildClient(stateDir, server, devApiBases) {
   return new McpHttpClient(
     server,
-    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir), () => relayBasesFor(stateDir))
+    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir), () => relayBasesFor(stateDir), devApiBases)
   );
 }
 async function relayBasesFor(stateDir) {
@@ -27747,9 +28069,9 @@ function gatedAgentTools(registry, policy) {
 // ../mcp/src/cache.ts
 import { createHash as createHash2 } from "node:crypto";
 import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, rename as rename2 } from "node:fs/promises";
-import { dirname as dirname8, join as join11 } from "node:path";
+import { dirname as dirname8, join as join12 } from "node:path";
 function toolCachePath(stateDir) {
-  return join11(stateDir, "mcp-tools.json");
+  return join12(stateDir, "mcp-tools.json");
 }
 function credentialFingerprint(cred) {
   if (!cred) return "none";
@@ -27792,11 +28114,11 @@ function cacheEntryFor(cache, server, cred) {
 }
 
 // src/mcpRegistry.ts
-async function openCliMcp(stateDir, policy) {
+async function openCliMcp(stateDir, policy, opts = {}) {
   try {
     const servers = await readMcpServers(stateDir);
     if (servers.length === 0) return null;
-    const registry = new McpRegistry(stateDir);
+    const registry = new McpRegistry(stateDir, mcpClientFactory({ devApiBases: opts.devApiBases ?? [] }));
     const cache = await readToolCache(stateDir);
     const usable = {};
     for (const s of servers) {
@@ -28189,8 +28511,18 @@ import { lookup as dnsLookup } from "node:dns/promises";
 import { setOutboundResolver } from "@corenel/harness/tools/urlGuard";
 var EXIT_POLICY_PARK_REFUSED = 3;
 var EXIT_BUDGET_EXCEEDED = 4;
-async function agentSetup(argv) {
-  setGatewayBase2(await apiBase(flag(argv, "base", "")));
+function replSessionId(id) {
+  return id === UNATTACHED_SESSION ? null : id;
+}
+function replCompaction(client, model, contextWindow, files, getSessionId) {
+  return {
+    summarize: makeSummarizer(client, model, { contextWindow }),
+    storage: makeSessionFoldStorage({ getFiles: () => files, root: sessionsRoot(), sessionId: getSessionId })
+  };
+}
+async function agentSetup(argv, chosenModel) {
+  const gatewayBase = await resolveCliApiBase(flag(argv, "base", ""));
+  setGatewayBase2(gatewayBase.base);
   const token = await nodeAuthToken().getToken();
   if (!token) {
     process.stderr.write("corenel: not signed in.\n  Run `corenel login`, or set CORENEL_TOKEN=<token> (a gateway bearer token), then try again.\n");
@@ -28232,19 +28564,22 @@ async function agentSetup(argv) {
   let policy;
   let policySource;
   try {
-    ({ policy, source: policySource } = await resolvePolicy({
+    const resolved = await resolvePolicy({
       ...hasValueFlag(argv, "policy") ? { flag: flag(argv, "policy", "") } : {},
       cwd: process.cwd()
-    }));
+    });
+    ({ policy, source: policySource } = resolved);
+    for (const w of resolved.warnings) process.stderr.write(`${w}
+`);
   } catch (e) {
     sidecarProcs?.disconnect();
     throw e;
   }
-  const mcp = await openCliMcp(configWorkspaceRoot(), policy);
+  const mcp = await openCliMcp(configWorkspaceRoot(), policy, { devApiBases: cliDevRelayBases(gatewayBase) });
   if (mcp) tools.push(...mcp.tools);
   return {
     client: createChatClient2({ getToken: async () => token }),
-    model: flag(argv, "model", "gpt-4o-mini"),
+    model: chosenModel ?? flag(argv, "model", DEFAULT_MODEL2),
     system,
     tools,
     identity: identity2,
@@ -28348,10 +28683,10 @@ async function run(argv) {
          * with a real window buys exactly that awareness without turning on
          * rung-1 offload here (this path builds no recall store).
          *
-         * No `onCheckpoint`: a one-shot run has no session to write one beside.
+         * No fold storage: a one-shot run has no session to write one beside.
          * It still compacts — surviving the wall matters more than recording why. */
-        compression: { mode: "off", contextWindow: resolveContextWindow2(model).window },
-        compaction: { summarize: makeSummarizer(client, model) },
+        compression: { mode: "off", contextWindow: resolveContextWindow3(model).window },
+        compaction: { summarize: makeSummarizer(client, model, { contextWindow: resolveContextWindow3(model).window }) },
         // A spawned sub-agent runs under the SAME gate as the parent turn -- never
         // looser, so it can't be used to route around the default-deny above.
         toolCtx: nodeToolCtx(ac.signal, {
@@ -28389,7 +28724,12 @@ async function run(argv) {
   }
 }
 async function interactive(argv) {
-  const { client, model, tools, identity: identity2, policy, policySource, memory, mcp, disconnect } = await agentSetup(argv);
+  const chosen = await resolveSessionModel({
+    argv,
+    persistence: createSessionPersistence(new NodeFileService(process.cwd())),
+    fallback: DEFAULT_MODEL2
+  });
+  const { client, model, tools, identity: identity2, policy, policySource, memory, mcp, disconnect } = await agentSetup(argv, chosen.model);
   try {
     await runInteractive();
   } finally {
@@ -28404,7 +28744,7 @@ async function interactive(argv) {
     const approvalsContext = { runId: randomUUID(), workspace: basename5(cwd) };
     let modelRates = null;
     let priceTable = /* @__PURE__ */ new Map();
-    const resolvedWindow = resolveContextWindow2(model);
+    const resolvedWindow = resolveContextWindow3(model);
     alog("context window", model, resolvedWindow.window, `(${resolvedWindow.source})`);
     const compression = { mode: "balanced", contextWindow: resolvedWindow.window, strategy: "deferred" };
     const priceBase = await apiBase(flag(argv, "base", ""));
@@ -28472,11 +28812,9 @@ async function interactive(argv) {
     const onSessionId = (id) => {
       currentSessionId = id;
     };
-    const compaction = {
-      summarize: makeSummarizer(client, model),
-      onCheckpoint: (body) => makeCheckpointStore(() => files, sessionsRoot()).append(currentSessionId, body)
-    };
-    const resume = resumeFlag(argv);
+    const compaction = replCompaction(client, model, () => compression.contextWindow, files, () => replSessionId(currentSessionId));
+    const resumeBase = resumeFlag(argv);
+    const resume = resumeBase ? { ...resumeBase, ...chosen.notice ? { notice: chosen.notice } : {} } : void 0;
     if (chooseFace(currentFaceEnv(argv)) === "tui") {
       try {
         const { runTui } = await import("@corenel/term/ink");
@@ -28575,6 +28913,7 @@ async function interactive(argv) {
 }
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
+  setSourceRun(isSourceRun(import.meta.url));
   setOutboundResolver(async (h) => (await dnsLookup(h, { all: true, verbatim: true })).map((a) => a.address));
   try {
     setAgentLogging(hasBooleanFlag(process.argv, "debug") || process.env.CORENEL_DEBUG === "1");
@@ -28652,7 +28991,7 @@ Logged in. Token saved to ${authTokenPath()}
         await runLogout();
         break;
       case "doctor": {
-        process.exitCode = await runDoctor(void 0, void 0, flag(rest, "model", "gpt-4o-mini"), resolveDoctorEnv(rest));
+        process.exitCode = await runDoctor(void 0, void 0, flag(rest, "model", DEFAULT_MODEL2), resolveDoctorEnv(rest));
         break;
       }
       case "approvals":
@@ -28725,5 +29064,7 @@ main().catch((e) => {
 export {
   EXIT_BUDGET_EXCEEDED,
   EXIT_POLICY_PARK_REFUSED,
-  buildRunPermission
+  buildRunPermission,
+  replCompaction,
+  replSessionId
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Corenel CLI — runs the harness in node, in-proc, no transport. The headless proof the kernel is host-agnostic. (corenel run/ask/chat/login + start --sidecar to follow.)",
   "bin": {
@@ -9,11 +9,11 @@
   "dependencies": {
     "openai": "^4.77.0",
     "ws": "^8.18.0",
-    "@corenel/config": "0.4.0",
-    "@corenel/harness": "0.11.0",
-    "@corenel/mcp": "0.3.0",
-    "@corenel/protocol": "0.10.0",
-    "@corenel/term": "0.5.0"
+    "@corenel/config": "0.6.1",
+    "@corenel/harness": "0.14.0",
+    "@corenel/mcp": "0.5.0",
+    "@corenel/protocol": "0.13.0",
+    "@corenel/term": "0.8.0"
   },
   "devDependencies": {
     "esbuild": "^0.21.5",
@@ -22,7 +22,7 @@
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
     "@corenel/crew": "0.0.0",
-    "@corenel/tools-node": "0.5.1"
+    "@corenel/tools-node": "0.7.1"
   },
   "publishConfig": {
     "access": "public"