@dev.sail.money/sailor 1.2.0-74 → 1.2.0-76

package/packages/cli/dist/index.cjs

@@ -966,8 +966,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path9 = require("node:path");
-    var fs10 = require("node:fs");
+    var path11 = require("node:path");
+    var fs12 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1899,11 +1899,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path9.resolve(baseDir, baseName);
-          if (fs10.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path9.extname(baseName))) return void 0;
+          const localBin = path11.resolve(baseDir, baseName);
+          if (fs12.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path11.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs10.existsSync(`${localBin}${ext}`)
+            (ext) => fs12.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1915,21 +1915,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs10.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs12.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path9.resolve(
-            path9.dirname(resolvedScriptPath),
+          executableDir = path11.resolve(
+            path11.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path9.basename(
+            const legacyName = path11.basename(
               this._scriptPath,
-              path9.extname(this._scriptPath)
+              path11.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1940,7 +1940,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path9.extname(executableFile));
+        launchWithNode = sourceExt.includes(path11.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2780,7 +2780,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path9.basename(filename, path9.extname(filename));
+        this._name = path11.basename(filename, path11.extname(filename));
         return this;
       }
       /**
@@ -2794,9 +2794,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path10) {
-        if (path10 === void 0) return this._executableDir;
-        this._executableDir = path10;
+      executableDir(path12) {
+        if (path12 === void 0) return this._executableDir;
+        this._executableDir = path12;
         return this;
       }
       /**
@@ -30772,9 +30772,9 @@ var init_defineKzg = __esm({
 });
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/kzg/setupKzg.js
-function setupKzg(parameters, path9) {
+function setupKzg(parameters, path11) {
   try {
-    parameters.loadTrustedSetup(path9);
+    parameters.loadTrustedSetup(path11);
   } catch (e) {
     const error = e;
     if (!error.message.includes("trusted setup is already loaded"))
@@ -35190,8 +35190,8 @@ var require_websocket_server2 = __commonJS({
 });
 
 // src/index.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path17 = require("node:path");
 
 // ../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
@@ -37123,14 +37123,14 @@ var HDKey = class _HDKey {
     }
     this.pubHash = hash160(this.pubKey);
   }
-  derive(path9) {
-    if (!/^[mM]'?/.test(path9)) {
+  derive(path11) {
+    if (!/^[mM]'?/.test(path11)) {
       throw new Error('Path must start with "m" or "M"');
     }
-    if (/^[mM]'?$/.test(path9)) {
+    if (/^[mM]'?$/.test(path11)) {
       return this;
     }
-    const parts = path9.replace(/^[mM]'?\//, "").split("/");
+    const parts = path11.replace(/^[mM]'?\//, "").split("/");
     let child = this;
     for (const c of parts) {
       const m = /^(\d+)('?)$/.exec(c);
@@ -37462,8 +37462,8 @@ function privateKeyToAccount(privateKey, options = {}) {
 }
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/accounts/hdKeyToAccount.js
-function hdKeyToAccount(hdKey_, { accountIndex = 0, addressIndex = 0, changeIndex = 0, path: path9, ...options } = {}) {
-  const hdKey = hdKey_.derive(path9 || `m/44'/60'/${accountIndex}'/${changeIndex}/${addressIndex}`);
+function hdKeyToAccount(hdKey_, { accountIndex = 0, addressIndex = 0, changeIndex = 0, path: path11, ...options } = {}) {
+  const hdKey = hdKey_.derive(path11 || `m/44'/60'/${accountIndex}'/${changeIndex}/${addressIndex}`);
   const account2 = privateKeyToAccount(toHex(hdKey.privateKey), options);
   return {
     ...account2,
@@ -37564,8 +37564,8 @@ var LocalKeyring = class _LocalKeyring {
     return _LocalKeyring.fromPrivateKey(`0x${pkBytes.toString("hex")}`);
   }
   /** Loads a keyring from an encrypted JSON keystore file on disk. */
-  static async fromKeystoreFile(path9, password) {
-    const keystore = JSON.parse((0, import_node_fs.readFileSync)(path9, "utf-8"));
+  static async fromKeystoreFile(path11, password) {
+    const keystore = JSON.parse((0, import_node_fs.readFileSync)(path11, "utf-8"));
     return _LocalKeyring.fromKeystore(keystore, password);
   }
   /** Signs a raw 32-byte hash. Returns a 65-byte ECDSA signature. */
@@ -38686,9 +38686,13 @@ var SigningServer = class {
       http2.once("error", rej);
     });
     this.httpServer = http2;
-    if (this.advertise) this.writeRuntimeState();
+    if (this.advertise) {
+      reapStaleRuntimeState(this.projectRoot);
+      this.writeRuntimeState();
+    }
     process.once("SIGINT", () => this.stop());
     process.once("SIGTERM", () => this.stop());
+    process.once("exit", () => this.stop());
   }
   stop() {
     for (const [id, entry] of this.pending) {
@@ -38833,6 +38837,28 @@ var SigningServer = class {
   sailFile(...segments) {
     return (0, import_node_path4.join)(this.projectRoot, ".sail", ...segments);
   }
+  /**
+   * Persist the active chain into config.json. The onboarding stage machine keys
+   * off config.json.chainId; leaving it null after SMA creation misclassifies the
+   * stage on resume. Best-effort — never blocks the account save on a config write.
+   */
+  syncConfigChainId(chainId) {
+    if (chainId == null) return;
+    try {
+      const path11 = this.sailFile("config.json");
+      let config = {};
+      try {
+        config = JSON.parse((0, import_node_fs5.readFileSync)(path11, "utf-8"));
+      } catch {
+      }
+      if (Number(config.chainId) === Number(chainId)) return;
+      config.chainId = Number(chainId);
+      (0, import_node_fs5.mkdirSync)(this.sailFile(), { recursive: true });
+      (0, import_node_fs5.writeFileSync)(path11, `${JSON.stringify(config, null, 2)}
+`);
+    } catch {
+    }
+  }
   /** Stream a JSON file back, or a fallback body when it is missing/invalid. */
   sendJsonFile(res, filePath, fallback2) {
     try {
@@ -38875,6 +38901,7 @@ var SigningServer = class {
       (0, import_node_fs5.mkdirSync)(baseSailDir, { recursive: true });
       (0, import_node_fs5.writeFileSync)(this.sailFile("account.json"), `${JSON.stringify(record, null, 2)}
 `);
+      this.syncConfigChainId(chainId);
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
     }).catch((err) => {
@@ -39123,6 +39150,14 @@ var SigningServer = class {
     }
   }
   writeRuntimeState() {
+    const path11 = (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE);
+    if ((0, import_node_fs5.existsSync)(path11)) {
+      try {
+        const existing = JSON.parse((0, import_node_fs5.readFileSync)(path11, "utf8"));
+        if (existing.pid != null && existing.pid !== process.pid && pidAlive(existing.pid)) return;
+      } catch {
+      }
+    }
     if (!(0, import_node_fs5.existsSync)(this.runtimeDir)) (0, import_node_fs5.mkdirSync)(this.runtimeDir, { recursive: true });
     (0, import_node_fs5.writeFileSync)(
       (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE),
@@ -39141,13 +39176,35 @@ var SigningServer = class {
     );
   }
   removeRuntimeState() {
-    const path9 = (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE);
+    const path11 = (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE);
     try {
-      if ((0, import_node_fs5.existsSync)(path9)) (0, import_node_fs5.unlinkSync)(path9);
+      if (!(0, import_node_fs5.existsSync)(path11)) return;
+      const state = JSON.parse((0, import_node_fs5.readFileSync)(path11, "utf8"));
+      if (state.pid != null && state.pid !== process.pid) return;
+      (0, import_node_fs5.unlinkSync)(path11);
     } catch {
     }
   }
 };
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function reapStaleRuntimeState(projectRoot = process.cwd()) {
+  const path11 = (0, import_node_path4.join)(projectRoot, RUNTIME_SUBDIR, SERVER_STATE_FILE);
+  try {
+    if (!(0, import_node_fs5.existsSync)(path11)) return;
+    const state = JSON.parse((0, import_node_fs5.readFileSync)(path11, "utf8"));
+    if (state.pid != null && state.pid !== process.pid && !pidAlive(state.pid)) {
+      (0, import_node_fs5.unlinkSync)(path11);
+    }
+  } catch {
+  }
+}
 async function findAvailablePort(startPort) {
   return new Promise((res) => {
     const probe = (0, import_node_net.createServer)();
@@ -39256,9 +39313,10 @@ async function discoverDaemon(projectRoot = process.cwd()) {
   return await client.ping() ? client : null;
 }
 async function createSigningChannel(projectRoot = process.cwd()) {
+  reapStaleRuntimeState(projectRoot);
   const daemon = await discoverDaemon(projectRoot);
   if (daemon) return daemon;
-  return new SigningServer({ projectRoot, advertise: false });
+  return new SigningServer({ projectRoot, advertise: true });
 }
 
 // src/commands/account.ts
@@ -40121,15 +40179,20 @@ async function resolvePermissionForBatch(params) {
 }
 
 // src/commands/doctor.ts
-var LOW_GAS_THRESHOLD_WEI = 500000000000000n;
-async function nativeBalance(pc, address) {
+var LOW_GAS_THRESHOLD_L1_WEI = 5000000000000000n;
+var LOW_GAS_THRESHOLD_L2_WEI = 200000000000000n;
+var L1_GAS_CHAINS = /* @__PURE__ */ new Set([1, 11155111]);
+function lowGasThresholdWei(chainId) {
+  return L1_GAS_CHAINS.has(chainId) ? LOW_GAS_THRESHOLD_L1_WEI : LOW_GAS_THRESHOLD_L2_WEI;
+}
+async function nativeBalance(pc, address, chainId) {
   const wei = await pc.getBalance({ address });
   return {
     address,
     wei: wei.toString(),
     eth: formatEther(wei),
     funded: wei > 0n,
-    low: wei > 0n && wei < LOW_GAS_THRESHOLD_WEI
+    low: wei > 0n && wei < lowGasThresholdWei(chainId)
   };
 }
 function keystoreAddress(role, safe) {
@@ -40208,8 +40271,8 @@ async function doctor(options = {}) {
   let ownerBal = null;
   let managerBal = null;
   try {
-    if (ownerAddr) ownerBal = await nativeBalance(pc, ownerAddr);
-    if (managerAddr) managerBal = await nativeBalance(pc, managerAddr);
+    if (ownerAddr) ownerBal = await nativeBalance(pc, ownerAddr, chainId);
+    if (managerAddr) managerBal = await nativeBalance(pc, managerAddr, chainId);
   } catch {
   }
   if (options.json) {
@@ -40390,8 +40453,8 @@ Probe is heuristic: an unknown selector (${PROBE_SELECTOR}) to a neutral target
 }
 
 // src/commands/init.ts
-var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_fs9 = __toESM(require("node:fs"), 1);
+var import_node_path8 = __toESM(require("node:path"), 1);
 
 // src/lib/foundry.ts
 var import_node_fs7 = require("node:fs");
@@ -40557,11 +40620,13 @@ function scaffoldFoundryWorkspace(root) {
   writeIfMissing((0, import_node_path6.join)(root, "mandates", "BoundedCallPermission.sol"), EXAMPLE_MANDATE_SOL);
   writeIfMissing((0, import_node_path6.join)(root, "mandates", "README.md"), MANDATES_README);
 }
-function writeIfMissing(path9, content) {
-  if (!(0, import_node_fs7.existsSync)(path9)) (0, import_node_fs7.writeFileSync)(path9, content, "utf8");
+function writeIfMissing(path11, content) {
+  if (!(0, import_node_fs7.existsSync)(path11)) (0, import_node_fs7.writeFileSync)(path11, content, "utf8");
 }
 
-// src/commands/init.ts
+// src/lib/template.ts
+var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path7 = __toESM(require("node:path"), 1);
 var TEMPLATE_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -40584,6 +40649,26 @@ function copyDirSync(src, dest) {
     }
   }
 }
+function writeIfMissing2(file, content) {
+  if (!import_node_fs8.default.existsSync(file)) import_node_fs8.default.writeFileSync(file, content, "utf-8");
+}
+function copyDirSyncIfMissing(src, dest, added = [], base2 = dest) {
+  import_node_fs8.default.mkdirSync(dest, { recursive: true });
+  for (const entry of import_node_fs8.default.readdirSync(src, { withFileTypes: true })) {
+    if (TEMPLATE_COPY_EXCLUDES.has(entry.name)) continue;
+    const srcPath = import_node_path7.default.join(src, entry.name);
+    const destName = entry.name.startsWith("_") ? `.${entry.name.slice(1)}` : entry.name;
+    const destPath = import_node_path7.default.join(dest, destName);
+    if (entry.isDirectory()) {
+      copyDirSyncIfMissing(srcPath, destPath, added, base2);
+    } else if (!import_node_fs8.default.existsSync(destPath)) {
+      import_node_fs8.default.copyFileSync(srcPath, destPath);
+      added.push(import_node_path7.default.relative(base2, destPath));
+    }
+  }
+}
+
+// src/commands/init.ts
 var SAIL_WORKSPACE_README = `# Sailor Project Workspace
 
 This folder is the local workspace for one Sailor agent deployment.
@@ -40598,15 +40683,12 @@ This folder is the local workspace for one Sailor agent deployment.
 AI coding agents should read the project's \`AGENTS.md\` and this folder's \`config.json\`
 before changing strategy code or running commands that touch funds.
 `;
-function writeIfMissing2(file, content) {
-  if (!import_node_fs8.default.existsSync(file)) import_node_fs8.default.writeFileSync(file, content, "utf-8");
-}
 var CANONICAL_PKG = "@sail.money/sailor";
 var DEV_PKG = "@dev.sail.money/sailor";
 function cliPackageInfo() {
   try {
     const pkg = JSON.parse(
-      import_node_fs8.default.readFileSync(import_node_path7.default.join(packageRoot(), "package.json"), "utf-8")
+      import_node_fs9.default.readFileSync(import_node_path8.default.join(packageRoot(), "package.json"), "utf-8")
     );
     return {
       name: pkg.name ?? CANONICAL_PKG,
@@ -40622,12 +40704,12 @@ function scaffoldProjectWorkspace(dest, name, options) {
     if (!Number.isInteger(n) || n <= 0) throw new Error(`Invalid chain id: "${options.chain}"`);
     return n;
   })() : null;
-  const sailDir2 = import_node_path7.default.join(dest, ".sail");
-  import_node_fs8.default.mkdirSync(import_node_path7.default.join(sailDir2, "keys"), { recursive: true });
-  import_node_fs8.default.mkdirSync(import_node_path7.default.join(sailDir2, "runtime"), { recursive: true });
-  import_node_fs8.default.mkdirSync(import_node_path7.default.join(sailDir2, "state"), { recursive: true });
-  import_node_fs8.default.writeFileSync(
-    import_node_path7.default.join(sailDir2, "config.json"),
+  const sailDir2 = import_node_path8.default.join(dest, ".sail");
+  import_node_fs9.default.mkdirSync(import_node_path8.default.join(sailDir2, "keys"), { recursive: true });
+  import_node_fs9.default.mkdirSync(import_node_path8.default.join(sailDir2, "runtime"), { recursive: true });
+  import_node_fs9.default.mkdirSync(import_node_path8.default.join(sailDir2, "state"), { recursive: true });
+  import_node_fs9.default.writeFileSync(
+    import_node_path8.default.join(sailDir2, "config.json"),
     `${JSON.stringify(
       {
         version: 1,
@@ -40647,12 +40729,12 @@ function scaffoldProjectWorkspace(dest, name, options) {
 `,
     "utf-8"
   );
-  writeIfMissing2(import_node_path7.default.join(sailDir2, "README.md"), SAIL_WORKSPACE_README);
+  writeIfMissing2(import_node_path8.default.join(sailDir2, "README.md"), SAIL_WORKSPACE_README);
   const chainEntries = Object.values(chains);
   const perChainVarLines = chainEntries.map((c) => `# ${c.rpcEnvVar}=https://your-${c.name.toLowerCase().replace(/\s+/g, "-")}-endpoint`).join("\n");
   const chainIdExample = chainId != null ? `CHAIN_ID=${chainId}` : `# CHAIN_ID=8453   # set after choosing your chain in Stage 1`;
-  import_node_fs8.default.writeFileSync(
-    import_node_path7.default.join(dest, ".env.example"),
+  import_node_fs9.default.writeFileSync(
+    import_node_path8.default.join(dest, ".env.example"),
     `# Sailor agent environment
 #
 # RPC configuration \u2014 two patterns, pick one:
@@ -40677,8 +40759,8 @@ ${perChainVarLines}
     const val = isActive && options.rpcUrl ? options.rpcUrl : `https://your-${c.name.toLowerCase().replace(/\s+/g, "-")}-endpoint`;
     return isActive && options.rpcUrl ? `${c.rpcEnvVar}=${val}` : `# ${c.rpcEnvVar}=${val}`;
   }).join("\n");
-  import_node_fs8.default.writeFileSync(
-    import_node_path7.default.join(sailDir2, ".env.local"),
+  import_node_fs9.default.writeFileSync(
+    import_node_path8.default.join(sailDir2, ".env.local"),
     `# Real values \u2014 never commit this file.
 #
 # Option A: single active chain (simplest)
@@ -40696,16 +40778,16 @@ ${allChainVarLines}
 }
 async function initCommand(dir, options = {}) {
   const inPlace = !dir || dir === ".";
-  const dest = inPlace ? process.cwd() : import_node_path7.default.resolve(process.cwd(), dir);
-  const name = import_node_path7.default.basename(dest);
-  const templatesDir = import_node_path7.default.join(packageRoot(), "templates");
+  const dest = inPlace ? process.cwd() : import_node_path8.default.resolve(process.cwd(), dir);
+  const name = import_node_path8.default.basename(dest);
+  const templatesDir = import_node_path8.default.join(packageRoot(), "templates");
   const templateName = options.template ?? "default";
   if (/[/\\.]/.test(templateName) || templateName.includes("..")) {
     throw new Error(`Invalid template name: "${templateName}"`);
   }
-  const templateSrc = import_node_path7.default.join(templatesDir, templateName);
-  const availableTemplates = () => import_node_fs8.default.existsSync(templatesDir) ? import_node_fs8.default.readdirSync(templatesDir).filter((e) => import_node_fs8.default.existsSync(import_node_path7.default.join(templatesDir, e, "package.json"))).join(", ") || "none" : "none";
-  if (!import_node_fs8.default.existsSync(templateSrc) || !import_node_fs8.default.existsSync(import_node_path7.default.join(templateSrc, "package.json"))) {
+  const templateSrc = import_node_path8.default.join(templatesDir, templateName);
+  const availableTemplates = () => import_node_fs9.default.existsSync(templatesDir) ? import_node_fs9.default.readdirSync(templatesDir).filter((e) => import_node_fs9.default.existsSync(import_node_path8.default.join(templatesDir, e, "package.json"))).join(", ") || "none" : "none";
+  if (!import_node_fs9.default.existsSync(templateSrc) || !import_node_fs9.default.existsSync(import_node_path8.default.join(templateSrc, "package.json"))) {
     const available = availableTemplates();
     const hint = available === "none" ? `
 No templates found under ${templatesDir}.
@@ -40715,49 +40797,49 @@ run from the repo root.` : ` Available: ${available}`;
     throw new Error(`Template "${templateName}" not found.${hint}`);
   }
   const cwd = process.cwd();
-  if (!inPlace && !dest.startsWith(cwd + import_node_path7.default.sep) && dest !== cwd) {
+  if (!inPlace && !dest.startsWith(cwd + import_node_path8.default.sep) && dest !== cwd) {
     throw new Error(`Directory must be inside the current working directory`);
   }
-  if (!inPlace && import_node_fs8.default.existsSync(dest)) {
+  if (!inPlace && import_node_fs9.default.existsSync(dest)) {
     throw new Error(`Directory already exists: ${dest}`);
   }
-  if (inPlace && import_node_fs8.default.existsSync(import_node_path7.default.join(dest, ".sail", "config.json"))) {
-    throw new Error(`Already initialized \u2014 .sail/config.json exists`);
+  if (inPlace && import_node_fs9.default.existsSync(import_node_path8.default.join(dest, ".sail", "config.json"))) {
+    throw new Error("This project is already initialized. Run `sailor update` to re-sync template files.");
   }
   copyDirSync(templateSrc, dest);
   const pkgRoot = packageRoot();
-  const examplesPermSrc = import_node_path7.default.join(pkgRoot, "examples", "permissions");
-  if (import_node_fs8.default.existsSync(examplesPermSrc)) {
-    copyDirSync(examplesPermSrc, import_node_path7.default.join(dest, "examples", "permissions"));
-  }
-  const customMandateSrc = import_node_path7.default.join(pkgRoot, "examples", "custom-mandate");
-  if (import_node_fs8.default.existsSync(customMandateSrc)) {
-    copyDirSync(customMandateSrc, import_node_path7.default.join(dest, "examples", "custom-mandate"));
-  }
-  const permModelSrc = import_node_path7.default.join(pkgRoot, "docs", "PERMISSION_MODEL.md");
-  if (import_node_fs8.default.existsSync(permModelSrc)) {
-    import_node_fs8.default.mkdirSync(import_node_path7.default.join(dest, "docs"), { recursive: true });
-    writeIfMissing2(import_node_path7.default.join(dest, "docs", "PERMISSION_MODEL.md"), import_node_fs8.default.readFileSync(permModelSrc, "utf-8"));
-  }
-  const pkgPath = import_node_path7.default.join(dest, "package.json");
-  if (import_node_fs8.default.existsSync(pkgPath)) {
-    const pkg = JSON.parse(import_node_fs8.default.readFileSync(pkgPath, "utf-8"));
+  const examplesPermSrc = import_node_path8.default.join(pkgRoot, "examples", "permissions");
+  if (import_node_fs9.default.existsSync(examplesPermSrc)) {
+    copyDirSync(examplesPermSrc, import_node_path8.default.join(dest, "examples", "permissions"));
+  }
+  const customMandateSrc = import_node_path8.default.join(pkgRoot, "examples", "custom-mandate");
+  if (import_node_fs9.default.existsSync(customMandateSrc)) {
+    copyDirSync(customMandateSrc, import_node_path8.default.join(dest, "examples", "custom-mandate"));
+  }
+  const permModelSrc = import_node_path8.default.join(pkgRoot, "docs", "PERMISSION_MODEL.md");
+  if (import_node_fs9.default.existsSync(permModelSrc)) {
+    import_node_fs9.default.mkdirSync(import_node_path8.default.join(dest, "docs"), { recursive: true });
+    writeIfMissing2(import_node_path8.default.join(dest, "docs", "PERMISSION_MODEL.md"), import_node_fs9.default.readFileSync(permModelSrc, "utf-8"));
+  }
+  const pkgPath = import_node_path8.default.join(dest, "package.json");
+  if (import_node_fs9.default.existsSync(pkgPath)) {
+    const pkg = JSON.parse(import_node_fs9.default.readFileSync(pkgPath, "utf-8"));
     pkg.name = name;
     const devDeps = pkg.devDependencies ?? {};
     const { name: cliName, version: cliVer } = cliPackageInfo();
     devDeps[CANONICAL_PKG] = cliName === DEV_PKG ? `npm:${DEV_PKG}@^${cliVer}` : `^${cliVer}`;
     pkg.devDependencies = devDeps;
-    import_node_fs8.default.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+    import_node_fs9.default.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
   }
-  const tsconfigPath = import_node_path7.default.join(dest, "tsconfig.json");
-  if (import_node_fs8.default.existsSync(tsconfigPath)) {
-    const tsconfig = JSON.parse(import_node_fs8.default.readFileSync(tsconfigPath, "utf-8"));
+  const tsconfigPath = import_node_path8.default.join(dest, "tsconfig.json");
+  if (import_node_fs9.default.existsSync(tsconfigPath)) {
+    const tsconfig = JSON.parse(import_node_fs9.default.readFileSync(tsconfigPath, "utf-8"));
     const co = tsconfig.compilerOptions;
     if (co && "paths" in co) {
       delete co.paths;
       delete co.baseUrl;
-      import_node_fs8.default.writeFileSync(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+      import_node_fs9.default.writeFileSync(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
 `);
     }
   }
@@ -40783,21 +40865,21 @@ function chainLabel(chainId) {
 }
 function detectState(dest) {
   try {
-    const configRaw = import_node_fs8.default.readFileSync(import_node_path7.default.join(dest, ".sail", "config.json"), "utf-8");
+    const configRaw = import_node_fs9.default.readFileSync(import_node_path8.default.join(dest, ".sail", "config.json"), "utf-8");
     const config = JSON.parse(configRaw);
-    const projectName = config.name ?? import_node_path7.default.basename(dest);
-    const accountPath = import_node_path7.default.join(dest, ".sail", "account.json");
-    if (!import_node_fs8.default.existsSync(accountPath)) {
+    const projectName = config.name ?? import_node_path8.default.basename(dest);
+    const accountPath = import_node_path8.default.join(dest, ".sail", "account.json");
+    if (!import_node_fs9.default.existsSync(accountPath)) {
       return { kind: "B", projectName, chain: chainLabel(config.chainId ?? 0) };
     }
-    const accountRaw = import_node_fs8.default.readFileSync(accountPath, "utf-8");
+    const accountRaw = import_node_fs9.default.readFileSync(accountPath, "utf-8");
     const account2 = JSON.parse(accountRaw);
     const sma = account2.safe ?? "";
     const chain2 = chainLabel(account2.chainId ?? config.chainId ?? 0);
     let permissionCount = 0;
     try {
-      const mandatesRaw = import_node_fs8.default.readFileSync(
-        import_node_path7.default.join(dest, ".sail", "state", "mandates.json"),
+      const mandatesRaw = import_node_fs9.default.readFileSync(
+        import_node_path8.default.join(dest, ".sail", "state", "mandates.json"),
         "utf-8"
       );
       const mandates = JSON.parse(mandatesRaw);
@@ -40878,9 +40960,79 @@ Created ${name}/`);
   ].join("\n"));
 }
 
+// src/commands/update.ts
+var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_path9 = __toESM(require("node:path"), 1);
+var UPDATE_PATHS = [
+  ".agents",
+  // all sail-* skills
+  ".cursor",
+  // cursor IDE rules
+  ".env.example"
+  // documents env vars; not meant to be edited directly
+];
+var STALE_PATHS = [
+  ".agents/skills/sail-ci"
+  // renamed to sail-automation
+];
+async function updateCommand() {
+  const dest = process.cwd();
+  if (!import_node_fs10.default.existsSync(import_node_path9.default.join(dest, ".sail", "config.json"))) {
+    throw new Error("Not a sailor project \u2014 .sail/config.json not found. Run `sailor init` first.");
+  }
+  const templateSrc = import_node_path9.default.join(packageRoot(), "templates", "default");
+  if (!import_node_fs10.default.existsSync(templateSrc)) {
+    throw new Error(`Template directory not found at ${templateSrc}`);
+  }
+  const removed = [];
+  for (const p of STALE_PATHS) {
+    const target = import_node_path9.default.join(dest, p);
+    if (import_node_fs10.default.existsSync(target)) {
+      import_node_fs10.default.rmSync(target, { recursive: true, force: true });
+      removed.push(p);
+    }
+  }
+  const updated = [];
+  for (const p of UPDATE_PATHS) {
+    const src = import_node_path9.default.join(templateSrc, p);
+    const dst = import_node_path9.default.join(dest, p);
+    if (!import_node_fs10.default.existsSync(src)) continue;
+    const stat = import_node_fs10.default.statSync(src);
+    if (stat.isDirectory()) {
+      copyDirSync(src, dst);
+    } else {
+      import_node_fs10.default.mkdirSync(import_node_path9.default.dirname(dst), { recursive: true });
+      import_node_fs10.default.copyFileSync(src, dst);
+    }
+    updated.push(p);
+  }
+  const added = [];
+  copyDirSyncIfMissing(templateSrc, dest, added);
+  if (removed.length === 0 && updated.length === 0 && added.length === 0) {
+    console.log("Nothing to update.");
+    return;
+  }
+  if (removed.length > 0) {
+    console.log(`
+Removed stale files:`);
+    for (const p of removed) console.log(`  ${p}`);
+  }
+  if (updated.length > 0) {
+    console.log(`
+Updated from template:`);
+    for (const p of updated) console.log(`  ${p}`);
+  }
+  if (added.length > 0) {
+    console.log(`
+Added (new in template):`);
+    for (const p of added) console.log(`  ${p}`);
+  }
+  console.log();
+}
+
 // src/commands/keys.ts
-var import_node_fs9 = __toESM(require("node:fs"), 1);
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 async function keysGenerate() {
   const roleInput = await prompt("Which key? (agent wallet / mandate signer)", "agent wallet");
   const role = normalizeRole(roleInput);
@@ -40933,15 +41085,15 @@ async function keysExportCi() {
       'No agent wallet keystore found.\nComplete Stage 1 (browser UI) to generate your agent wallet, or run\n"sailor keys generate" and choose "agent wallet" to create one manually.'
     );
   }
-  const dest = import_node_path8.default.resolve(process.cwd(), "ci-keystore.json");
-  import_node_fs9.default.copyFileSync(src, dest);
+  const dest = import_node_path10.default.resolve(process.cwd(), "ci-keystore.json");
+  import_node_fs11.default.copyFileSync(src, dest);
   console.log(`\u2713 Keystore copied to ci-keystore.json`);
   console.log(`  Source: ${src}`);
-  const gitignorePath = import_node_path8.default.resolve(process.cwd(), ".gitignore");
-  if (import_node_fs9.default.existsSync(gitignorePath)) {
-    const content = import_node_fs9.default.readFileSync(gitignorePath, "utf-8");
+  const gitignorePath = import_node_path10.default.resolve(process.cwd(), ".gitignore");
+  if (import_node_fs11.default.existsSync(gitignorePath)) {
+    const content = import_node_fs11.default.readFileSync(gitignorePath, "utf-8");
     if (!content.includes("ci-keystore.json")) {
-      import_node_fs9.default.appendFileSync(
+      import_node_fs11.default.appendFileSync(
         gitignorePath,
         "\n# CI keystore \u2014 encrypted agent wallet, safe to commit\n!ci-keystore.json\n"
       );
@@ -40979,8 +41131,8 @@ async function keysShow() {
 
 // src/commands/mandate-contracts.ts
 var import_node_child_process = require("node:child_process");
-var import_node_fs10 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_path11 = require("node:path");
 init_esm2();
 
 // src/lib/mandates.ts
@@ -41624,6 +41776,18 @@ Mandate command failed: ${msg}`), {
   });
   process.exit(1);
 }
+function announceSigningUrl(json) {
+  const url = signingPageUrl(void 0, projectPort(process.cwd()));
+  if (json) {
+    process.stdout.write(`${JSON.stringify({ status: "waiting_for_signature", url })}
+`);
+  } else {
+    console.log(`
+\u2192 Open the Sailor dashboard to approve signing requests:
+  ${url}
+`);
+  }
+}
 function publicClientFor(project) {
   return createPublicClient({
     chain: getChainById(project.chainId),
@@ -41664,9 +41828,9 @@ async function runDeploy(project, channel, options) {
   const { abi: abi2, bytecode, contractName, artifactPath } = resolveArtifact(options);
   let argsJson;
   if (options.argsFile) {
-    const argsFilePath = (0, import_node_path9.resolve)(options.argsFile);
+    const argsFilePath = (0, import_node_path11.resolve)(options.argsFile);
     try {
-      argsJson = (0, import_node_fs10.readFileSync)(argsFilePath, "utf8").trim();
+      argsJson = (0, import_node_fs12.readFileSync)(argsFilePath, "utf8").trim();
     } catch {
       throw new Error(`Cannot read --args-file: ${argsFilePath}`);
     }
@@ -41677,15 +41841,8 @@ async function runDeploy(project, channel, options) {
   const deployData = encodeDeployData({ abi: abi2, bytecode, args });
   const chainId = project.chainId;
   const publicClient = publicClientFor(project);
-  say(() => {
-    console.log(
-      `
-\u2192 Open the Sailor dashboard to approve signing requests:
-  ${signingPageUrl(channel, projectPort(process.cwd()))}
-`
-    );
-    console.log(`Pushing deploy request for "${contractName}"\u2026`);
-  });
+  announceSigningUrl(json);
+  say(() => console.log(`Pushing deploy request for "${contractName}"\u2026`));
   const response = await channel.requestSignature({
     type: "transaction",
     kind: "deploy-mandate",
@@ -41835,6 +41992,15 @@ function parseAddressList(csv, flag) {
 }
 async function mandateDeployClone(options) {
   const project = requireProject();
+  const templateMap = project.deployment.standaloneTemplates ?? {};
+  if (Object.keys(templateMap).length === 0) {
+    fail(
+      new Error(
+        `deploy-clone is unavailable on chain ${project.chainId}: no clone templates are deployed against this kernel (${project.deployment.kernel}) yet. Deploy your permission directly with \`sailor mandate deploy\` instead.`
+      ),
+      options.json
+    );
+  }
   const channel = await createSigningChannel(process.cwd());
   try {
     await channel.start();
@@ -41911,11 +42077,8 @@ ${spec.label} clone (${options.template})`);
     console.log(`  predicted clone: ${clone}`);
     console.log(`  SMA:             ${sma}`);
     for (const d of spec.describe(initParams)) console.log(`  ${d.label}: ${d.value}`);
-    console.log(`
-\u2192 Open the Sailor dashboard to approve signing requests:
-  ${signingPageUrl(channel, projectPort(process.cwd()))}
-`);
   });
+  announceSigningUrl(json);
   const nonce = await publicClient.readContract({
     address: project.contracts.kernel,
     abi: SailKernelAbi,
@@ -42073,14 +42236,7 @@ async function runAttach(project, channel, options) {
   const mandateAddress = getAddress(rawAddress);
   const label = options.label ?? tracked?.name ?? "mandate";
   const publicClient = publicClientFor(project);
-  if (!json) {
-    console.log(
-      `
-\u2192 Open the Sailor dashboard to approve signing requests:
-  ${signingPageUrl(channel, projectPort(process.cwd()))}
-`
-    );
-  }
+  announceSigningUrl(json);
   const txHash = await attachToSma(
     project,
     channel,
@@ -42157,13 +42313,8 @@ async function runRevoke(project, channel, options) {
     console.log(`
 Revoking ${targets.length} permission(s) from ${sma}:`);
     for (const p of targets) console.log(`  ${nameFor(p) ?? p}  ${p}`);
-    console.log(
-      `
-\u2192 Open the Sailor dashboard to approve signing requests:
-  ${signingPageUrl(channel, projectPort(process.cwd()))}
-`
-    );
   });
+  announceSigningUrl(json);
   const response = await channel.requestSignature({
     type: "typed-data",
     kind: "revoke-permissions",
@@ -42340,21 +42491,27 @@ function mandateTemplates(options) {
     { chainId, community }
   );
 }
-function mandateContractsList() {
+function mandateContractsList(options = {}) {
   const store = new MandateStore();
   const mandates = store.list();
-  if (mandates.length === 0) {
-    console.log('No permission contracts deployed yet. Use "sailor mandate deploy".');
-    return;
-  }
-  for (const m of mandates) {
-    console.log(m.name, `(chain ${m.chainId})`);
-    console.log("  Address: ", m.address);
-    console.log("  Deployed:", m.deployedAt);
-    if (m.attachments?.length) {
-      console.log("  Registered on:", m.attachments.map((a) => a.sma).join(", "));
-    }
-  }
+  emit(
+    !!options.json,
+    () => {
+      if (mandates.length === 0) {
+        console.log('No permission contracts deployed yet. Use "sailor mandate deploy".');
+        return;
+      }
+      for (const m of mandates) {
+        console.log(m.name, `(chain ${m.chainId})`);
+        console.log("  Address: ", m.address);
+        console.log("  Deployed:", m.deployedAt);
+        if (m.attachments?.length) {
+          console.log("  Registered on:", m.attachments.map((a) => a.sma).join(", "));
+        }
+      }
+    },
+    { status: "ok", mandates }
+  );
 }
 function mandateUpdate(options) {
   const { address, name, sourcePath, artifactPath, json } = options;
@@ -42376,11 +42533,11 @@ function resolveArtifact(options) {
   let contractName = options.contract ?? options.name ?? "";
   if (!artifactPath) {
     if (!options.contract) throw new Error("Provide --artifact <path> or --contract <name>");
-    artifactPath = (0, import_node_path9.join)(options.out, `${options.contract}.sol`, `${options.contract}.json`);
+    artifactPath = (0, import_node_path11.join)(options.out, `${options.contract}.sol`, `${options.contract}.json`);
   }
-  const resolved = (0, import_node_path9.resolve)(artifactPath);
-  const projectRoot = (0, import_node_path9.resolve)(process.cwd());
-  if (!resolved.startsWith(projectRoot + import_node_path9.sep) && resolved !== projectRoot) {
+  const resolved = (0, import_node_path11.resolve)(artifactPath);
+  const projectRoot = (0, import_node_path11.resolve)(process.cwd());
+  if (!resolved.startsWith(projectRoot + import_node_path11.sep) && resolved !== projectRoot) {
     throw new Error(
       `Artifact path must be inside the project directory.
 Resolved: ${resolved}`
@@ -42388,14 +42545,14 @@ Resolved: ${resolved}`
   }
   artifactPath = resolved;
   if (options.build) runForgeBuild();
-  if (!(0, import_node_fs10.existsSync)(artifactPath)) {
+  if (!(0, import_node_fs12.existsSync)(artifactPath)) {
     ensureForgeHint();
     throw new Error(
       `Artifact not found: ${artifactPath}
 Compile your mandate first (e.g. \`forge build\`), or pass --build.`
     );
   }
-  const artifact = JSON.parse((0, import_node_fs10.readFileSync)(artifactPath, "utf8"));
+  const artifact = JSON.parse((0, import_node_fs12.readFileSync)(artifactPath, "utf8"));
   const abi2 = artifact.abi;
   const bytecodeRaw = artifact.bytecode?.object ?? artifact.bytecode;
   if (!bytecodeRaw || typeof bytecodeRaw !== "string") {
@@ -42478,13 +42635,13 @@ function runForgeBuild() {
 init_esm2();
 
 // src/lib/permission-explainer.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path12 = require("node:path");
 function explainPermission(name, sourcePath) {
-  const resolved = sourcePath ?? (0, import_node_path10.join)(process.cwd(), "mandates", `${name}.sol`);
+  const resolved = sourcePath ?? (0, import_node_path12.join)(process.cwd(), "mandates", `${name}.sol`);
   let src;
   try {
-    src = (0, import_node_fs11.readFileSync)(resolved, "utf8");
+    src = (0, import_node_fs13.readFileSync)(resolved, "utf8");
   } catch {
     return null;
   }
@@ -42691,7 +42848,6 @@ ${unregistered.length} permission(s) are not yet registered on this SMA. Initiat
     safe: account2.safe,
     chainId,
     signedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    signature: "",
     registeredOnChain: true,
     // Only include permissions that are currently active on-chain.
     permissions: activePermissions.map((p) => ({ template: p.label, params: {} }))
@@ -42707,7 +42863,7 @@ ${unregistered.length} permission(s) are not yet registered on this SMA. Initiat
 }
 
 // src/commands/mandate-simulate.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 init_esm2();
 function parseExpect(raw, where) {
   if (raw === void 0) return void 0;
@@ -42723,7 +42879,7 @@ function resolveSampleCalls(options) {
   if (options.calls) {
     let raw;
     try {
-      raw = JSON.parse((0, import_node_fs12.readFileSync)(options.calls, "utf8"));
+      raw = JSON.parse((0, import_node_fs14.readFileSync)(options.calls, "utf8"));
     } catch (err) {
       throw new Error(`Could not read --calls file "${options.calls}": ${err.message}`);
     }
@@ -42939,7 +43095,7 @@ async function mandateSimulate(options) {
 }
 
 // src/commands/rotate-signer.ts
-var import_node_fs13 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 init_esm2();
 var PENDING_REATTACH_FILE = ["state", "pending-reattach.json"];
 async function rotateSigner(options) {
@@ -43327,7 +43483,7 @@ ensure the agent that signs dispatches holds this key.`
   const keystore = await keyring.exportKeystore(password);
   writeJsonFile(target, keystore, 384);
   const perManagerPath = managerKeystorePath(keyring.address);
-  (0, import_node_fs13.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs15.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   writeJsonFile(perManagerPath, keystore, 384);
   say(
     () => console.log(
@@ -43339,7 +43495,7 @@ ensure the agent that signs dispatches holds this key.`
 function promoteManagerKeystore(newManager, say) {
   const stored = readJsonFile(managerKeystorePath(newManager));
   if (!stored) return;
-  (0, import_node_fs13.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs15.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   const activeTarget = keyPath("manager");
   const displaced = readJsonFile(activeTarget);
   if (displaced?.address) {
@@ -43391,7 +43547,7 @@ function writePending(pending) {
 }
 function clearPending() {
   try {
-    (0, import_node_fs13.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
+    (0, import_node_fs15.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
   } catch {
   }
 }
@@ -43490,30 +43646,30 @@ function ownerShow(options) {
 }
 
 // src/commands/run.ts
-var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url = require("node:url");
 init_esm2();
 
 // src/lib/process.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
+var import_node_fs16 = __toESM(require("node:fs"), 1);
 function agentPidPath(chainId) {
   return chainId != null ? sailPath(`agent-${chainId}.pid`) : sailPath("agent.pid");
 }
 function writeAgentPid(chainId) {
-  import_node_fs14.default.mkdirSync(sailPath(), { recursive: true });
-  import_node_fs14.default.writeFileSync(agentPidPath(chainId), `${process.pid}
+  import_node_fs16.default.mkdirSync(sailPath(), { recursive: true });
+  import_node_fs16.default.writeFileSync(agentPidPath(chainId), `${process.pid}
 `);
 }
 function clearAgentPid(chainId) {
   try {
-    import_node_fs14.default.rmSync(agentPidPath(chainId));
+    import_node_fs16.default.rmSync(agentPidPath(chainId));
   } catch {
   }
 }
 function readAgentPid(chainId) {
   try {
-    const pid = Number.parseInt(import_node_fs14.default.readFileSync(agentPidPath(chainId), "utf-8").trim(), 10);
+    const pid = Number.parseInt(import_node_fs16.default.readFileSync(agentPidPath(chainId), "utf-8").trim(), 10);
     return Number.isNaN(pid) ? null : pid;
   } catch {
     return null;
@@ -43560,7 +43716,7 @@ var ERC20_READ_ABI = [
 function loadAgentData(filePath) {
   if (!filePath) return {};
   try {
-    const parsed = JSON.parse(import_node_fs15.default.readFileSync(filePath, "utf-8"));
+    const parsed = JSON.parse(import_node_fs17.default.readFileSync(filePath, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -43569,8 +43725,8 @@ function loadAgentData(filePath) {
 async function loadAgent() {
   const candidates = ["src/agent.ts", "src/agent.js", "dist/agent.js", "dist/src/agent.js"];
   for (const rel of candidates) {
-    const abs = import_node_path11.default.join(process.cwd(), rel);
-    if (!import_node_fs15.default.existsSync(abs)) continue;
+    const abs = import_node_path13.default.join(process.cwd(), rel);
+    if (!import_node_fs17.default.existsSync(abs)) continue;
     let mod2;
     if (abs.endsWith(".ts")) {
       const { tsImport } = await import("tsx/esm/api");
@@ -44046,9 +44202,9 @@ async function scan(options) {
 
 // src/commands/service.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs16 = __toESM(require("node:fs"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 function sanitizeName(raw) {
   const s = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   return s || "agent";
@@ -44167,21 +44323,21 @@ function buildWindowsTaskXml(cfg) {
 `;
 }
 function isTccProtected(projectDir, home = import_node_os.default.homedir()) {
-  const rel = import_node_path12.default.relative(home, import_node_path12.default.resolve(projectDir));
-  if (rel.startsWith("..") || import_node_path12.default.isAbsolute(rel)) return false;
-  const top = rel.split(import_node_path12.default.sep)[0];
+  const rel = import_node_path14.default.relative(home, import_node_path14.default.resolve(projectDir));
+  if (rel.startsWith("..") || import_node_path14.default.isAbsolute(rel)) return false;
+  const top = rel.split(import_node_path14.default.sep)[0];
   return ["Desktop", "Documents", "Downloads"].includes(top ?? "");
 }
 function resolveCliEntry() {
   try {
-    return import_node_fs16.default.realpathSync(process.argv[1]);
+    return import_node_fs18.default.realpathSync(process.argv[1]);
   } catch {
-    return import_node_path12.default.resolve(process.argv[1]);
+    return import_node_path14.default.resolve(process.argv[1]);
   }
 }
 function resolveProjectDir(explicit) {
-  const dir = import_node_path12.default.resolve(explicit ?? process.cwd());
-  if (!import_node_fs16.default.existsSync(import_node_path12.default.join(dir, ".sail"))) {
+  const dir = import_node_path14.default.resolve(explicit ?? process.cwd());
+  if (!import_node_fs18.default.existsSync(import_node_path14.default.join(dir, ".sail"))) {
     throw new Error(
       `No .sail/ found in ${dir}.
 Run this from your Sailor project root, or pass --project <path>. (The installer does not search parent directories \u2014 that would risk targeting the wrong project.)`
@@ -44193,7 +44349,7 @@ function passphraseReadiness(projectDir) {
   const account2 = (() => {
     try {
       return JSON.parse(
-        import_node_fs16.default.readFileSync(import_node_path12.default.join(projectDir, ".sail", "account.json"), "utf-8")
+        import_node_fs18.default.readFileSync(import_node_path14.default.join(projectDir, ".sail", "account.json"), "utf-8")
       );
     } catch {
       return null;
@@ -44209,28 +44365,28 @@ function passphraseReadiness(projectDir) {
   } finally {
     process.chdir(prevCwd);
   }
-  const env = parseEnvFile(import_node_path12.default.join(projectDir, ".sail", ".env.local"));
+  const env = parseEnvFile(import_node_path14.default.join(projectDir, ".sail", ".env.local"));
   const passphraseInEnvFile = Boolean(env.SAIL_PASSPHRASE);
   return { keystorePresent, passphraseInEnvFile, ready: keystorePresent && passphraseInEnvFile };
 }
 function buildConfig(opts) {
   const projectDir = resolveProjectDir(opts.project);
   return {
-    projectName: sanitizeName(import_node_path12.default.basename(projectDir)),
+    projectName: sanitizeName(import_node_path14.default.basename(projectDir)),
     projectDir,
     nodePath: process.execPath,
     cliEntry: resolveCliEntry(),
-    logPath: import_node_path12.default.join(projectDir, ".sail", "agent.log"),
+    logPath: import_node_path14.default.join(projectDir, ".sail", "agent.log"),
     interval: opts.interval != null ? Number(opts.interval) : void 0,
     chain: opts.chain != null ? Number(opts.chain) : void 0,
     restartSec: 30
   };
 }
 function plistPath(projectName) {
-  return import_node_path12.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
+  return import_node_path14.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
 }
 function systemdPath(projectName) {
-  return import_node_path12.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
+  return import_node_path14.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
 }
 async function serviceInstall(opts = {}) {
   const cfg = buildConfig(opts);
@@ -44254,12 +44410,12 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
     console.warn(`\u26A0 ${msg}
   Proceeding because --force was given.`);
   }
-  import_node_fs16.default.mkdirSync(import_node_path12.default.dirname(cfg.logPath), { recursive: true });
+  import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(cfg.logPath), { recursive: true });
   if (platform === "darwin") {
     const plist = buildLaunchdPlist(cfg);
     const dest = plistPath(cfg.projectName);
-    import_node_fs16.default.mkdirSync(import_node_path12.default.dirname(dest), { recursive: true });
-    import_node_fs16.default.writeFileSync(dest, plist);
+    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
+    import_node_fs18.default.writeFileSync(dest, plist);
     const uid2 = process.getuid?.() ?? 0;
     try {
       try {
@@ -44278,8 +44434,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   if (platform === "linux") {
     const unit = buildSystemdUnit(cfg);
     const dest = systemdPath(cfg.projectName);
-    import_node_fs16.default.mkdirSync(import_node_path12.default.dirname(dest), { recursive: true });
-    import_node_fs16.default.writeFileSync(dest, unit);
+    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
+    import_node_fs18.default.writeFileSync(dest, unit);
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "enable", "--now", systemdUnitName(cfg.projectName)], {
@@ -44293,8 +44449,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   }
   if (platform === "win32") {
     const xml = buildWindowsTaskXml(cfg);
-    const dest = import_node_path12.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
-    import_node_fs16.default.writeFileSync(dest, xml, "utf-8");
+    const dest = import_node_path14.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
+    import_node_fs18.default.writeFileSync(dest, xml, "utf-8");
     try {
       (0, import_node_child_process2.execFileSync)(
         "schtasks",
@@ -44305,7 +44461,7 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
       throw new Error(`schtasks /Create failed: ${err.message}`);
     } finally {
       try {
-        import_node_fs16.default.rmSync(dest, { force: true });
+        import_node_fs18.default.rmSync(dest, { force: true });
       } catch {
       }
     }
@@ -44331,14 +44487,14 @@ function okInstall(cfg, unit) {
   );
 }
 async function serviceStatus(opts = {}) {
-  const projectName = sanitizeName(import_node_path12.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   let installed = false;
   let running = false;
   let detail = "";
   try {
     if (platform === "darwin") {
-      installed = import_node_fs16.default.existsSync(plistPath(projectName));
+      installed = import_node_fs18.default.existsSync(plistPath(projectName));
       const uid2 = process.getuid?.() ?? 0;
       try {
         detail = (0, import_node_child_process2.execFileSync)("launchctl", ["print", `gui/${uid2}/${launchdLabel(projectName)}`], {
@@ -44350,7 +44506,7 @@ async function serviceStatus(opts = {}) {
       } catch {
       }
     } else if (platform === "linux") {
-      installed = import_node_fs16.default.existsSync(systemdPath(projectName));
+      installed = import_node_fs18.default.existsSync(systemdPath(projectName));
       try {
         detail = (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "is-active", systemdUnitName(projectName)], {
           encoding: "utf-8",
@@ -44386,7 +44542,7 @@ async function serviceStatus(opts = {}) {
   );
 }
 async function serviceStop(opts = {}) {
-  const projectName = sanitizeName(import_node_path12.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -44405,7 +44561,7 @@ async function serviceStop(opts = {}) {
   });
 }
 async function serviceUninstall(opts = {}) {
-  const projectName = sanitizeName(import_node_path12.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -44415,7 +44571,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs16.default.rmSync(plistPath(projectName), { force: true });
+    import_node_fs18.default.rmSync(plistPath(projectName), { force: true });
   } else if (platform === "linux") {
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "disable", "--now", systemdUnitName(projectName)], {
@@ -44423,7 +44579,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs16.default.rmSync(systemdPath(projectName), { force: true });
+    import_node_fs18.default.rmSync(systemdPath(projectName), { force: true });
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
     } catch {
@@ -44441,21 +44597,21 @@ async function serviceUninstall(opts = {}) {
 }
 async function serviceLogs(opts = {}) {
   const projectDir = resolveProjectDir(opts.project);
-  const logPath = import_node_path12.default.join(projectDir, ".sail", "agent.log");
-  if (!import_node_fs16.default.existsSync(logPath)) {
+  const logPath = import_node_path14.default.join(projectDir, ".sail", "agent.log");
+  if (!import_node_fs18.default.existsSync(logPath)) {
     console.log(`No log yet at ${logPath}. The service writes here once it runs.`);
     return;
   }
   if (opts.follow) {
     if (process.platform === "win32") {
-      console.log(import_node_fs16.default.readFileSync(logPath, "utf-8"));
+      console.log(import_node_fs18.default.readFileSync(logPath, "utf-8"));
       console.log("(follow mode is not supported on Windows here \u2014 re-run to refresh)");
       return;
     }
     (0, import_node_child_process2.execFileSync)("tail", ["-f", logPath], { stdio: "inherit" });
     return;
   }
-  const lines = import_node_fs16.default.readFileSync(logPath, "utf-8").split("\n");
+  const lines = import_node_fs18.default.readFileSync(logPath, "utf-8").split("\n");
   console.log(lines.slice(-200).join("\n"));
 }
 
@@ -44609,14 +44765,14 @@ async function sessionResume() {
 }
 
 // src/commands/station.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path13 = require("node:path");
-var RUNTIME_SERVER_FILE2 = (0, import_node_path13.join)(".sail", "runtime", "server.json");
+var import_node_fs19 = require("node:fs");
+var import_node_path15 = require("node:path");
+var RUNTIME_SERVER_FILE2 = (0, import_node_path15.join)(".sail", "runtime", "server.json");
 function readState(projectRoot) {
-  const file = (0, import_node_path13.join)(projectRoot, RUNTIME_SERVER_FILE2);
-  if (!(0, import_node_fs17.existsSync)(file)) return null;
+  const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
+  if (!(0, import_node_fs19.existsSync)(file)) return null;
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(file, "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(file, "utf8"));
   } catch {
     return null;
   }
@@ -44688,9 +44844,9 @@ async function stationStop(options) {
   }
   const daemon = await discoverDaemon(projectRoot);
   if (!daemon) {
-    const file = (0, import_node_path13.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs17.existsSync)(file)) (0, import_node_fs17.rmSync)(file);
+      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -44706,9 +44862,9 @@ async function stationStop(options) {
       pid: state.pid
     });
   } catch {
-    const file = (0, import_node_path13.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs17.existsSync)(file)) (0, import_node_fs17.rmSync)(file);
+      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -44763,15 +44919,15 @@ async function status() {
 
 // src/commands/ui.ts
 var import_node_child_process4 = require("node:child_process");
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs20 = __toESM(require("node:fs"), 1);
 var import_node_net2 = __toESM(require("node:net"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
-var UI_STATE_FILE = import_node_path14.default.join(".sail", "runtime", "ui.json");
+var import_node_path16 = __toESM(require("node:path"), 1);
+var UI_STATE_FILE = import_node_path16.default.join(".sail", "runtime", "ui.json");
 function readState2(projectRoot) {
-  const file = import_node_path14.default.join(projectRoot, UI_STATE_FILE);
-  if (!import_node_fs18.default.existsSync(file)) return null;
+  const file = import_node_path16.default.join(projectRoot, UI_STATE_FILE);
+  if (!import_node_fs20.default.existsSync(file)) return null;
   try {
-    return JSON.parse(import_node_fs18.default.readFileSync(file, "utf-8"));
+    return JSON.parse(import_node_fs20.default.readFileSync(file, "utf-8"));
   } catch {
     return null;
   }
@@ -44812,15 +44968,15 @@ function waitForPort(port, timeoutMs) {
 }
 async function uiCommand() {
   const distDir = cliDistDir();
-  const uiDistDir = import_node_path14.default.join(packageRoot(), "packages", "ui", "dist");
-  const serverBundle = import_node_path14.default.resolve(distDir, "server.cjs");
+  const uiDistDir = import_node_path16.default.join(packageRoot(), "packages", "ui", "dist");
+  const serverBundle = import_node_path16.default.resolve(distDir, "server.cjs");
   const projectRoot = process.cwd();
-  const sailDir2 = import_node_path14.default.join(projectRoot, ".sail");
+  const sailDir2 = import_node_path16.default.join(projectRoot, ".sail");
   const port = await findFreePort(projectPort(projectRoot));
-  if (!import_node_fs18.default.existsSync(serverBundle)) {
+  if (!import_node_fs20.default.existsSync(serverBundle)) {
     throw new Error(`Server bundle not found at ${serverBundle}. Re-run the sailor build.`);
   }
-  if (!import_node_fs18.default.existsSync(import_node_path14.default.join(uiDistDir, "index.html"))) {
+  if (!import_node_fs20.default.existsSync(import_node_path16.default.join(uiDistDir, "index.html"))) {
     throw new Error(`UI dist not found at ${uiDistDir}. Re-run the sailor build.`);
   }
   const existing = readState2(projectRoot);
@@ -44828,17 +44984,17 @@ async function uiCommand() {
     console.log(`Sailor UI is already running (pid ${existing.pid}) at http://localhost:${existing.port}`);
     return;
   }
-  const runtimeDir = import_node_path14.default.join(projectRoot, ".sail", "runtime");
-  import_node_fs18.default.mkdirSync(runtimeDir, { recursive: true });
-  const logFile = import_node_path14.default.join(runtimeDir, "ui.log");
-  const logFd = import_node_fs18.default.openSync(logFile, "a");
+  const runtimeDir = import_node_path16.default.join(projectRoot, ".sail", "runtime");
+  import_node_fs20.default.mkdirSync(runtimeDir, { recursive: true });
+  const logFile = import_node_path16.default.join(runtimeDir, "ui.log");
+  const logFd = import_node_fs20.default.openSync(logFile, "a");
   const child = (0, import_node_child_process4.spawn)(process.execPath, [serverBundle], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
     env: { ...process.env, SAIL_DIR: sailDir2, SERVE_DIST: "1", PORT: String(port), SAILOR_UI_DIST: uiDistDir }
   });
   child.unref();
-  import_node_fs18.default.closeSync(logFd);
+  import_node_fs20.default.closeSync(logFd);
   const READY_TIMEOUT_MS = 1e4;
   const deadline = Date.now() + READY_TIMEOUT_MS;
   let ready = false;
@@ -44852,18 +45008,18 @@ async function uiCommand() {
   if (!ready) {
     let tail = "";
     try {
-      tail = import_node_fs18.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
+      tail = import_node_fs20.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
     } catch {
     }
     throw new Error(
       `Sailor UI failed to start within ${READY_TIMEOUT_MS / 1e3}s on port ${port}.` + (tail ? `
 
 Server output:
-${tail}` : ` See ${import_node_path14.default.relative(projectRoot, logFile)}.`)
+${tail}` : ` See ${import_node_path16.default.relative(projectRoot, logFile)}.`)
     );
   }
-  import_node_fs18.default.writeFileSync(
-    import_node_path14.default.join(projectRoot, UI_STATE_FILE),
+  import_node_fs20.default.writeFileSync(
+    import_node_path16.default.join(projectRoot, UI_STATE_FILE),
     JSON.stringify({ pid: child.pid, port, startedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
   );
   console.log(`Sailor UI started at http://localhost:${port}  (pid ${child.pid})`);
@@ -44874,7 +45030,7 @@ function uiStatus() {
   if (state && isAlive(state.pid)) {
     console.log(`\u25CF running  http://localhost:${state.port}  (pid ${state.pid})`);
   } else {
-    if (state) import_node_fs18.default.rmSync(import_node_path14.default.join(process.cwd(), UI_STATE_FILE), { force: true });
+    if (state) import_node_fs20.default.rmSync(import_node_path16.default.join(process.cwd(), UI_STATE_FILE), { force: true });
     console.log("\u25CB Sailor UI is not running");
   }
 }
@@ -44886,19 +45042,19 @@ function uiStop() {
     return;
   }
   if (!isAlive(state.pid)) {
-    import_node_fs18.default.rmSync(import_node_path14.default.join(projectRoot, UI_STATE_FILE), { force: true });
+    import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
     console.log("Sailor UI is not running (stale state file removed).");
     return;
   }
   process.kill(state.pid, "SIGTERM");
-  import_node_fs18.default.rmSync(import_node_path14.default.join(projectRoot, UI_STATE_FILE), { force: true });
+  import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
   console.log(`Stopped Sailor UI (pid ${state.pid}).`);
 }
 
 // src/index.ts
 function cliVersion() {
   try {
-    const pkg = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path15.join)(packageRoot(), "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path17.join)(packageRoot(), "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -44940,6 +45096,7 @@ program2.command("init [dir]").description("Scaffold a new Sail agent into the c
     }
   }
 );
+program2.command("update").description("Re-sync agent tooling files (skills, AGENTS.md, Dockerfile) from the latest template").action(action(updateCommand));
 var ui = program2.command("ui").description("Manage the local Sailor dashboard");
 ui.command("start").description("Start the dashboard at localhost:3333 (default)").action(action(uiCommand));
 ui.command("stop").description("Stop the running dashboard").action(() => uiStop());
@@ -44965,14 +45122,14 @@ mandate.command("prepare").description("Prepare a mandate draft for review and s
 mandate.command("sign").description("Review and confirm the permissions authorized for your SMA").option("--yes", "Skip the confirmation prompt (for non-interactive / CI use)").action(actionWith(mandateSign));
 mandate.command("deploy").description("Deploy a Foundry-compiled permission contract via the browser signing UI").option("--artifact <path>", "Path to the Foundry artifact JSON (out/<Name>.sol/<Name>.json)").option("--contract <name>", "Contract name; resolves to <out>/<name>.sol/<name>.json").option("--out <dir>", "Foundry output directory", "out").option("--name <label>", "Label to track this permission under (defaults to contract name)").option("--args <json>", `Constructor args as JSON array. Bash: '["0x..","1"]'. PowerShell: '[\\"0x..\\",\\"1\\"]'. Use --args-file to avoid quoting.`).option("--args-file <path>", "Path to a JSON file containing constructor args array (recommended on PowerShell)").option("--build", "Run `forge build` before deploying").option("--attach", "After deploy, register the permission on --sma").option("--sma <address>", "SMA to register on (required with --attach)").option("--json", "Emit machine-readable JSON").action(actionWith(mandateDeploy));
 mandate.command("attach").description("Register an already-deployed permission on an SMA (EIP-712 RegisterPermission)").requiredOption("--address <mandateOrName>", "Permission address, or a name tracked locally").requiredOption("--sma <address>", "SMA to register the permission on").option("--label <label>", "Human-readable label shown in the signing UI").option("--json", "Emit machine-readable JSON").action(actionWith(mandateAttach));
-mandate.command("deploy-clone").description("Deploy + register a standalone clone permission (e.g. boundedApprove) via the signing UI").requiredOption("--template <key>", "Standalone clone template key (e.g. boundedApprove)").requiredOption("--sma <address>", "SMA to deploy the clone for and register it on").option("--tokens <csv>", "Comma-separated allowed token addresses").option("--spenders <csv>", "Comma-separated allowed spender addresses").option("--max <amount>", "Max amount per tx in base units (default: uint256 max)").option("--label <label>", "Human-readable label to track this permission under").option("--json", "Emit machine-readable JSON").action(actionWith(mandateDeployClone));
+mandate.command("deploy-clone").description("[currently unavailable \u2014 no clone templates deployed on any chain; use `mandate deploy`] Deploy + register a standalone clone permission via the signing UI").requiredOption("--template <key>", "Standalone clone template key (e.g. boundedApprove)").requiredOption("--sma <address>", "SMA to deploy the clone for and register it on").option("--tokens <csv>", "Comma-separated allowed token addresses").option("--spenders <csv>", "Comma-separated allowed spender addresses").option("--max <amount>", "Max amount per tx in base units (default: uint256 max)").option("--label <label>", "Human-readable label to track this permission under").option("--json", "Emit machine-readable JSON").action(actionWith(mandateDeployClone));
 mandate.command("revoke").description("Revoke permission(s) from an SMA (EIP-712 RevokePermissions, owner-authorized)").option("--address <permissionOrName>", "Permission address, or a name tracked locally").requiredOption("--sma <address>", "Safe (SMA) to revoke the permission(s) from").option("--all", "Revoke every permission currently registered on the SMA").option("--json", "Output JSON").action(actionWith(mandateRevoke));
 mandate.command("templates").description("Show how to author your own permission contract (and any community-deployed addresses)").option("--json", "Emit machine-readable JSON").action(actionWith(mandateTemplates));
 mandate.command("simulate").description(
   "Probe a permission against sample calls off-chain (eth_call, NO gas) \u2014 prove it accepts the calls you want and rejects the ones you don't, before authorizing on-chain"
 ).requiredOption("--address <permissionOrName>", "Permission to probe (address or tracked name)").option("--sma <address>", "SMA to probe as (ctx.account; defaults to .sail/account.json)").option("--target <address>", "Inline single call: target contract address").option("--calldata <hex>", "Inline single call: 0x-prefixed calldata").option("--value <wei>", "Inline single call: ETH value in wei (default 0)").option("--expect <pass|fail>", "Inline single call: expected outcome (sets non-zero exit on mismatch)").option("--label <text>", "Inline single call: human-readable label").option("--calls <file>", "Batch: JSON array of { target, calldata, value?, expect?, label? }").option("--json", "Emit machine-readable JSON").action(actionWith(mandateSimulate));
 mandate.command("update").description("Update metadata for a tracked permission contract (rename, source path, artifact path)").requiredOption("--address <mandateOrName>", "Permission address or tracked name to update").option("--name <label>", "New tracking label (must be unique within the same chain)").option("--source-path <path>", "Update the relative path to the Solidity source file").option("--artifact-path <path>", "Update the relative path to the Foundry artifact JSON").option("--json", "Emit machine-readable JSON").action(actionWith(mandateUpdate));
-mandate.command("list").description("List permission contracts deployed from this project").action(action(async () => mandateContractsList()));
+mandate.command("list").description("List permission contracts deployed from this project").option("--json", "Emit machine-readable JSON").action(actionWith(mandateContractsList));
 program2.command("onboard").description("Set up an SMA, register a permission, confirm the agent is operational").option("--sma <address>", "Use a specific SMA address instead of prompting").option("--new-sma", "Create a new SMA via SailKernel").option("--salt <n>", "CREATE2 salt for deterministic Safe address (default: 0; use 0 for first SMA, increment for subsequent)").option("--template <kindOrAddress>", "Register this permission contract (kind, label, or address)").option("--skip-mandate", "Skip the permission registration step").option("--json", "Emit machine-readable JSON (implies non-interactive)").action(actionWith(onboard));
 var station = program2.command("station").description("Manage the persistent signing station (browser signing daemon)");
 station.command("start").description("Start the signing station and keep it running (blocks \u2014 run in the background)").option("--json", "Emit machine-readable JSON").action(actionWith(stationStart));