@fleox-agent-crm/agentcrm 0.3.0 → 0.3.2

package/dist/agent/agentcrm.mjs

@@ -5,8 +5,8 @@ import { dirname as __acrmDirname } from "node:path";
 const require2 = __acrmRequire(import.meta.url);
 const __filename = __acrmPath(import.meta.url);
 const __dirname = __acrmDirname(__filename);
-import { parseArgs } from "node:util";
-import { existsSync, readFileSync, statSync, mkdirSync, writeFileSync, chmodSync, renameSync, openSync, writeSync, closeSync, unlinkSync, mkdtempSync, readdirSync, createReadStream } from "node:fs";
+import { format, parseArgs } from "node:util";
+import { existsSync, readFileSync, statSync, mkdirSync, writeFileSync, chmodSync, renameSync, openSync, writeSync, closeSync, unlinkSync, mkdtempSync, rmSync, readdirSync, createReadStream } from "node:fs";
 import { join, resolve, dirname, basename, extname, sep, normalize, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes, timingSafeEqual } from "node:crypto";
@@ -54,6 +54,13 @@ class CliError extends Error {
     this.exitCode = exitCode;
   }
 }
+function routeConsoleToStderr(target = console, write = (t) => void process.stderr.write(t)) {
+  const toStderr = (...args) => write(`${format(...args)}
+`);
+  target.log = toStderr;
+  target.info = toStderr;
+  target.debug = toStderr;
+}
 function createIo(json) {
   return {
     json,
@@ -68,10 +75,20 @@ function printResult(io, data, human) {
 const OPS_HINTS = {
   forbidden: "The CRM user the CLI acts as lacks this permission (see `site show` → user, `users list`). Ask an admin, or re-register the site with an admin user (`site add … --user <email>`).",
   notFound: "Check the id (list commands print them: `records list --object …`, `objects list`, `views list`…).",
-  validation: "Fix the input: `objects get <object>` lists field ids, types and select options.",
+  validation: "Fix the input and retry (`agentcrm help <command>` lists the options; for record fields, `objects get <object>` lists field ids, types and select options).",
   conflict: "Something with the same key already exists — list it first, then update instead of creating.",
   invalid: "Check the arguments with `agentcrm help <command>`."
 };
+function dependencyHint(details) {
+  const ids = (key) => Array.isArray(details?.[key]) ? details[key].map(String) : [];
+  const blockers = ids("blockers");
+  if (blockers.length) return `Blocked by: ${blockers.join(", ")}. Re-run with --cascade (AI tools: "cascade": true) to change ${blockers.length > 1 ? "them" : "it"} too — show the user the plan's \`changed\` list first.`;
+  const dependents = ids("dependents");
+  if (dependents.length) return `Disable or uninstall ${dependents.join(", ")} first (\`ext disable <id>\` / \`ext uninstall <id>\`), or pass --force to \`ext uninstall\`.`;
+  const missing = ids("missing");
+  if (missing.length) return `Install the missing module(s) first: ${missing.join(", ")} (\`ext install <zip>\`).`;
+  return null;
+}
 function knownError(error) {
   if (!(error instanceof Error)) return null;
   if (error.name === "PassphraseError") {
@@ -84,7 +101,8 @@ function knownError(error) {
   }
   if (error.name === "OpsError") {
     const code = error.code ?? "invalid";
-    return new CliError(code, error.message, OPS_HINTS[code], code === "validation" || code === "invalid" ? 2 : 1);
+    const details = error.details;
+    return new CliError(code, error.message, code === "conflict" && dependencyHint(details) || OPS_HINTS[code], code === "validation" || code === "invalid" ? 2 : 1);
   }
   if (error.name === "FieldValidationError") {
     return new CliError("validation", error.message, OPS_HINTS.validation, 2);
@@ -120,10 +138,11 @@ const output = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
   knownError,
   printError,
   printResult,
+  routeConsoleToStderr,
   toCliError
 }, Symbol.toStringTag, { value: "Module" }));
 const name = "@fleox-agent-crm/agentcrm";
-const version = "0.3.0";
+const version = "0.3.2";
 const type = "module";
 const description = "The static CRM your AI agent can run: a Twenty / HubSpot-style CRM that runs entirely in the browser or headless through the agentcrm CLI, with data on storage you own.";
 const license = "SEE LICENSE IN LICENSE";
@@ -505,8 +524,8 @@ function tmpFolder() {
   return tmpBase;
 }
 async function nodeImportBundle() {
-  await import("./chunks/runtime-DHo7ZEEO.mjs");
-  const { createNodeImportBundle } = await import("./chunks/nodeImport-BPCt5uMu.mjs");
+  await import("./chunks/runtime-C0Xf0Axi.mjs");
+  const { createNodeImportBundle } = await import("./chunks/nodeImport-ylfRDvqt.mjs");
   return createNodeImportBundle({ runtimeDir: runtimeDir(), tmpDir: tmpFolder() });
 }
 function hasEnabledExtensions(store) {
@@ -520,15 +539,9 @@ async function loadSessionExtensions(store, opts = {}) {
     if (!loadedAny && !opts.force && !hasEnabledExtensions(store)) return null;
     try {
       const importBundle = await nodeImportBundle();
-      const { syncExtensions } = await import("./chunks/loader-C9nm3iwx.mjs");
+      const { syncExtensions } = await import("./chunks/loader-MPD9iAvh.mjs");
       loadedAny = true;
-      const original = console.error;
-      console.error = () => void 0;
-      try {
-        return await syncExtensions(store, { importBundle });
-      } finally {
-        console.error = original;
-      }
+      return await syncExtensions(store, { importBundle, onError: () => void 0 });
     } catch (err) {
       return { loaded: [], unloaded: [], failed: [{ id: "*", error: err.message }], skipped: [] };
     }
@@ -540,7 +553,7 @@ async function loadSessionExtensions(store, opts = {}) {
     sync,
     async close() {
       if (!loadedAny) return;
-      (await import("./chunks/registry-Ceexawxl.mjs")).deactivateAllExtensions();
+      (await import("./chunks/registry-COfJrSmg.mjs")).deactivateAllExtensions();
     }
   };
 }
@@ -595,7 +608,7 @@ async function openStore(runtime, opts) {
   }
   if (runtime.backend === "journal") {
     if (!opts.dataTarget) throw new CliError("internal", "journal store without a data location");
-    const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+    const { buildConnector } = await import("./chunks/hosting-Dnn1k3cV.mjs");
     const { createJournalStore } = await import("./chunks/index-B-4W0-P4.mjs");
     const { publicSettings, secrets } = rc.splitSecretSettings(opts.dataTarget.settings);
     rc.setConnectorSecrets(runtime, secrets);
@@ -612,7 +625,11 @@ async function openStore(runtime, opts) {
     const token = String(opts.secrets?.token ?? "");
     if (token) rc.setGitToken(runtime.git, token);
   }
-  const { createDataStore } = await import("./chunks/index-CRkw3_iF.mjs");
+  if (runtime.backend === "firebase" && opts.account && typeof opts.secrets?.email === "string") {
+    const { prepareFirebaseSession: prepareFirebaseSession2 } = await Promise.resolve().then(() => firebaseSession);
+    await prepareFirebaseSession2(opts.account, runtime.firebase, opts.secrets.email);
+  }
+  const { createDataStore } = await import("./chunks/index-rut-KC39.mjs");
   return createDataStore(runtime, { secrets: opts.secrets ?? {}, passphrase: opts.passphrase ?? null, clientId: cliClientId() });
 }
 function siteSecrets(site) {
@@ -626,7 +643,7 @@ function siteSecrets(site) {
         `Store it (\`agentcrm credentials set ${site.runtime.backend === "firebase" ? "firebase" : site.runtime.git.provider}:<name>\`), then \`agentcrm site credentials ${site.alias} --data-credential <account>\`.`
       );
     }
-    return { secrets: requireCredential(site.credentials.data).values, passphrase };
+    return { secrets: requireCredential(site.credentials.data).values, passphrase, account: site.credentials.data };
   }
   return { passphrase };
 }
@@ -663,7 +680,7 @@ async function openSession(alias, opts = {}) {
     const [{ createOpsContext }, { createPluginRegistry, plugins: defaultPlugins }, { installAutomations }] = await Promise.all([
       import("./chunks/context-CxFfqS4D.mjs"),
       import("./chunks/pluginRegistry-DyHtlkcr.mjs"),
-      import("./chunks/automations-BWrvLqP6.mjs")
+      import("./chunks/automations-DwWruxmu.mjs")
     ]);
     const own = createPluginRegistry((hook, err) => process.stderr.write(`[agentcrm] ${hook} handler failed: ${String(err?.message ?? err)}
 `));
@@ -690,14 +707,14 @@ async function openSession(alias, opts = {}) {
       })();
       if (target) {
         const { setStorageConfigSource, registerStorageConnector } = await import("./chunks/registry-DijAKZ24.mjs").then((n) => n.r);
-        const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+        const { buildConnector } = await import("./chunks/hosting-Dnn1k3cV.mjs");
         if (target.connectorId === "local-folder") registerStorageConnector({ id: "local-folder", create: (s) => buildConnector({ connectorId: "local-folder", settings: s }) });
         setStorageConfigSource(async () => target);
       }
     }
     {
-      const forms = await import("./chunks/forms-BKU5F9WF.mjs");
-      const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+      const forms = await import("./chunks/forms-BfuWaQjA.mjs");
+      const { buildConnector } = await import("./chunks/hosting-Dnn1k3cV.mjs");
       forms.setInboxSourceResolver((_ctx, form) => {
         if (form.inbox.kind !== "s3") return null;
         const settings = form.inbox.settings ?? {};
@@ -768,6 +785,12 @@ const session = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePrope
   openStore,
   withSession
 }, Symbol.toStringTag, { value: "Module" }));
+function writeOutFile(path, data) {
+  const abs = resolve(path);
+  mkdirSync(dirname(abs), { recursive: true });
+  writeFileSync(abs, data);
+  return abs;
+}
 function usage(message, hint) {
   throw new CliError("usage", message, hint, 2);
 }
@@ -912,7 +935,7 @@ function readLocalFile(path) {
   return { name: basename(full), bytes: new Uint8Array(readFileSync(full)) };
 }
 async function uploadLocalFiles(ctx, paths, targets2 = []) {
-  const { uploadFile } = await import("./chunks/files-q8Xu5bft.mjs");
+  const { uploadFile } = await import("./chunks/files-D1daDgY0.mjs");
   const { guessMime, imageDimensions } = await import("./chunks/files-CjsPJSR6.mjs");
   const out = [];
   for (const p of paths) {
@@ -960,7 +983,7 @@ const filesCommand = {
     switch (action) {
       case "list":
         return withSession(io, options, {}, async ({ ctx }) => {
-          const { listFiles } = await import("./chunks/files-q8Xu5bft.mjs");
+          const { listFiles } = await import("./chunks/files-D1daDgY0.mjs");
           const target = strOpt(options, "record") ?? strOpt(options, "activity") ?? null;
           const items = listFiles(ctx, target, { includeRelated: boolOpt(options, "related"), kind: strOpt(options, "kind"), search: strOpt(options, "search") });
           const limit = Math.min(1e3, numOpt(options, "limit") ?? 100);
@@ -975,7 +998,7 @@ ${table(r.files, ["id", "name", "mime", "size", "createdAt"])}`);
         if (record && activity) usage("Give --record or --activity, not both.");
         for (const p of args) readLocalFile(p);
         return withSession(io, options, { lock: true }, async ({ ctx }) => {
-          const { attachFile } = await import("./chunks/files-q8Xu5bft.mjs");
+          const { attachFile } = await import("./chunks/files-D1daDgY0.mjs");
           const files2 = await uploadLocalFiles(ctx, args, record ? [record] : []);
           if (activity) for (const f of files2) await attachFile(ctx, f.id, { kind: "activity", id: activity });
           const { requireFile } = await import("./chunks/store-5gqRSKXg.mjs");
@@ -988,17 +1011,17 @@ ${table(r.uploaded, ["id", "name", "size"])}`);
         const out = strOpt(options, "out");
         if (!out) usage("files get needs --out <path>.");
         return withSession(io, options, {}, async ({ ctx }) => {
-          const { getFile, getFileBytes } = await import("./chunks/files-q8Xu5bft.mjs");
+          const { getFile, getFileBytes } = await import("./chunks/files-D1daDgY0.mjs");
           const meta = getFile(ctx, id);
           const bytes = await getFileBytes(ctx, id, { thumb: boolOpt(options, "thumb") });
-          writeFileSync(resolve(out), bytes);
+          writeOutFile(out, bytes);
           return { id, name: meta.name, mime: meta.mime, bytes: bytes.length, path: resolve(out) };
         }, (r) => `Wrote ${r.bytes} bytes (${r.name}) to ${r.path}`);
       }
       case "delete": {
         const id = positional(args, 0, "file id", U$1.delete);
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
-          const { getFile, deleteFile } = await import("./chunks/files-q8Xu5bft.mjs");
+          const { getFile, deleteFile } = await import("./chunks/files-D1daDgY0.mjs");
           const meta = fileOut(getFile(ctx, id));
           if (options.yes !== true) return { needsConfirmation: true, plan: { delete: meta } };
           await deleteFile(ctx, id);
@@ -1006,7 +1029,7 @@ ${table(r.uploaded, ["id", "name", "size"])}`);
         }, (r) => "plan" in r && r.plan ? `Would delete ${r.plan.delete.name} (${r.plan.delete.id}). Re-run with --yes once the user agrees.` : `Deleted ${"deleted" in r ? r.deleted : id} (bytes purged by \`agentcrm compact\`).`);
       }
       case "usage":
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/files-q8Xu5bft.mjs")).fileUsage(ctx));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/files-D1daDgY0.mjs")).fileUsage(ctx));
       default:
         usage(`Unknown files action "${action ?? ""}".`, "Use list, upload, get, delete or usage.");
     }
@@ -1019,7 +1042,7 @@ async function recordImageAction(io, options, args) {
   if (!remove && !path) usage("records image needs an image path (or --remove).");
   const local = remove ? null : readLocalFile(path);
   return withSession(io, options, { lock: true }, async ({ ctx }) => {
-    const { setRecordImage, clearRecordImage } = await import("./chunks/files-q8Xu5bft.mjs");
+    const { setRecordImage, clearRecordImage } = await import("./chunks/files-D1daDgY0.mjs");
     const field = strOpt(options, "field");
     if (!local) {
       const r = await clearRecordImage(ctx, recordId, field);
@@ -1307,7 +1330,7 @@ const recordsCommand = {
         const filters = parseFilters(multiOpt(options, "filter"), FILTER_OPS);
         const sorts = parseSorts(multiOpt(options, "sort"));
         return withSession(io, options, {}, async ({ ctx }) => {
-          const { listRecords } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { listRecords } = await import("./chunks/records-DcHFelq5.mjs");
           const page = listRecords(ctx, objectId, {
             filters,
             sorts,
@@ -1325,7 +1348,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
       case "get": {
         const id = positional(args, 0, "record id", U.get);
         return withSession(io, options, {}, async ({ ctx }) => {
-          const { getRecordDetails } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { getRecordDetails } = await import("./chunks/records-DcHFelq5.mjs");
           const d = getRecordDetails(ctx, id);
           return { ...await recordOut(ctx, d.record), relations: d.relations, related: d.inverse.filter((i) => i.records.length), activityCount: d.activityCount };
         });
@@ -1336,7 +1359,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
         if (!Object.keys(fields).length) usage("records create needs --fields or --set.", `Usage: agentcrm ${U.create}`);
         const owner = strOpt(options, "owner");
         return withSession(io, options, { lock: true }, async ({ ctx }) => {
-          const { createRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { createRecord } = await import("./chunks/records-DcHFelq5.mjs");
           return recordOut(ctx, await createRecord(ctx, objectId, fields, owner ? { ownerId: owner } : {}));
         }, (r) => `Created ${r.object} ${r.id} (${String(r.label)})`);
       }
@@ -1346,7 +1369,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
         const owner = strOpt(options, "owner");
         if (!Object.keys(fields).length && owner === void 0) usage("records update needs --fields, --set or --owner.");
         return withSession(io, options, { lock: true }, async ({ ctx }) => {
-          const { updateRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { updateRecord } = await import("./chunks/records-DcHFelq5.mjs");
           return recordOut(ctx, await updateRecord(ctx, id, fields, owner !== void 0 ? { ownerId: owner || null } : {}));
         }, (r) => `Updated ${r.id} (${String(r.label)})`);
       }
@@ -1354,7 +1377,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
         if (!args.length) usage("records delete needs at least one id.", `Usage: agentcrm ${U.delete}`);
         const hard = boolOpt(options, "hard");
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
-          const { getRecord, deleteRecord, bulkDelete } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { getRecord, deleteRecord, bulkDelete } = await import("./chunks/records-DcHFelq5.mjs");
           const { recordLabel } = await import("./chunks/fields-B0bitgmr.mjs");
           const { objectOf } = await import("./chunks/store-5gqRSKXg.mjs");
           const targets2 = args.map((id) => getRecord(ctx, id, { includeDeleted: true }));
@@ -1367,7 +1390,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
       case "restore": {
         const id = positional(args, 0, "record id", U.restore);
         return withSession(io, options, { lock: true }, async ({ ctx }) => {
-          const { restoreRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { restoreRecord } = await import("./chunks/records-DcHFelq5.mjs");
           return recordOut(ctx, await restoreRecord(ctx, id));
         });
       }
@@ -1375,7 +1398,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
         const query = args.join(" ").trim();
         if (!query) usage("records search needs a query.", `Usage: agentcrm ${U.search}`);
         return withSession(io, options, {}, async ({ ctx }) => {
-          const { searchRecords } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { searchRecords } = await import("./chunks/records-DcHFelq5.mjs");
           return searchRecords(ctx, query, { objects: listOpt(options, "object"), limit: Math.min(100, numOpt(options, "limit") ?? 20) });
         });
       }
@@ -1392,7 +1415,7 @@ ${table(r.records, ["id", "label", "updatedAt"])}`);
         const [primary, ...dups] = args;
         if (!primary || !dups.length) usage("records merge needs <primaryId> <duplicateId>….", `Usage: agentcrm ${U.merge}`);
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
-          const { getRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { getRecord } = await import("./chunks/records-DcHFelq5.mjs");
           const all = [primary, ...dups].map((id) => getRecord(ctx, id));
           const plan = { primary: await recordOut(ctx, all[0]), duplicates: await Promise.all(all.slice(1).map((r) => recordOut(ctx, r))) };
           if (options.yes !== true) return { needsConfirmation: true, plan };
@@ -1424,13 +1447,13 @@ const pipelinesCommand = {
         io,
         options,
         {},
-        async ({ ctx }) => (await import("./chunks/pipelines-DCdRBNBV.mjs")).listPipelines(ctx, strOpt(options, "object")),
+        async ({ ctx }) => (await import("./chunks/pipelines-BAKpPk1w.mjs")).listPipelines(ctx, strOpt(options, "object")),
         (ps) => ps.map((p) => `${p.id} (${p.name}, ${p.object}): ${p.stages.map((s) => `${s.label} ${Math.round(s.probability * (s.probability <= 1 ? 100 : 1))}%`).join(" → ")}`).join("\n")
       );
     }
     if (action === "move") {
       if (!id || !stage.length) usage("pipelines move needs <recordId> <stage>.");
-      return withSession(io, options, { lock: true }, async ({ ctx }) => recordOut(ctx, await (await import("./chunks/pipelines-DCdRBNBV.mjs")).moveStage(ctx, id, stage.join(" "), { lostReason: strOpt(options, "lost-reason") })));
+      return withSession(io, options, { lock: true }, async ({ ctx }) => recordOut(ctx, await (await import("./chunks/pipelines-BAKpPk1w.mjs")).moveStage(ctx, id, stage.join(" "), { lostReason: strOpt(options, "lost-reason") })));
     }
     usage(`Unknown pipelines action "${action}".`, "Use list or move.");
   }
@@ -1462,7 +1485,7 @@ const viewsCommand = {
     const [action = "list", id] = positionals;
     switch (action) {
       case "list":
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/views-fO_BM5U_.mjs")).listViews(ctx, strOpt(options, "object")), (vs) => table(vs, ["id", "object", "name", "type", "shared"]));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/views-DH1n9Lrt.mjs")).listViews(ctx, strOpt(options, "object")), (vs) => table(vs, ["id", "object", "name", "type", "shared"]));
       case "create": {
         const type2 = strOpt(options, "type") ?? "table";
         if (type2 !== "table" && type2 !== "kanban") usage("--type must be table or kanban.");
@@ -1477,12 +1500,12 @@ const viewsCommand = {
           ...strOpt(options, "pipeline") ? { pipelineId: strOpt(options, "pipeline") } : {},
           shared: boolOpt(options, "shared")
         };
-        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/views-fO_BM5U_.mjs")).createView(ctx, input));
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/views-DH1n9Lrt.mjs")).createView(ctx, input));
       }
       case "delete":
         if (!id) usage("views delete needs a view id.");
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
-          const { getView, deleteView } = await import("./chunks/views-fO_BM5U_.mjs");
+          const { getView, deleteView } = await import("./chunks/views-DH1n9Lrt.mjs");
           const v = getView(ctx, id);
           if (options.yes !== true) return { needsConfirmation: true, plan: { delete: { id: v.id, name: v.name, object: v.object, shared: v.shared } } };
           return deleteView(ctx, id);
@@ -1545,11 +1568,11 @@ const settingsCommand = {
   options: [SITE_OPTION, AS_OPTION, { name: "set", type: "string", description: "key=value (repeatable), e.g. --set staleDealDays=21 --set defaultCurrency=EUR.", multiple: true }, { name: "data", type: "string", description: "JSON object of settings, or @file." }],
   async run({ io, options, positionals }) {
     const [action = "get"] = positionals;
-    if (action === "get") return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/settings-BtvR_jdm.mjs")).getSettings(ctx));
+    if (action === "get") return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/settings-Di8nzNEL.mjs")).getSettings(ctx));
     if (action === "set") {
       const patch = fieldsInput(options, "data");
       if (!Object.keys(patch).length) usage("settings set needs --set key=value or --data.");
-      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/settings-BtvR_jdm.mjs")).updateSettings(ctx, patch));
+      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/settings-Di8nzNEL.mjs")).updateSettings(ctx, patch));
     }
     usage(`Unknown settings action "${action}".`, "Use get or set.");
   }
@@ -1651,6 +1674,57 @@ function copyToClipboard(text) {
   }
   throw new CliError("no-clipboard", "No clipboard tool found (pbcopy, clip, wl-copy, xclip or xsel).", "Install one, or read the value from ~/.agentcrm/credentials.json yourself.");
 }
+function sessionFile(account) {
+  return homePath("sessions", `${account.replace(/[^a-z0-9._-]+/gi, "_")}.json`);
+}
+function forgetFirebaseSession(account) {
+  const f = sessionFile(account);
+  if (existsSync(f)) rmSync(f, { force: true });
+}
+function filePersistence(account, email) {
+  const file2 = sessionFile(account);
+  const saved = readJsonFile(file2, null);
+  const items = saved && saved.email === email ? { ...saved.items } : {};
+  const flush = () => {
+    if (Object.keys(items).length) writeJsonFile(file2, { email, items }, 384);
+    else forgetFirebaseSession(account);
+  };
+  return class FileSessionPersistence {
+    static type = "LOCAL";
+    type = "LOCAL";
+    async _isAvailable() {
+      return true;
+    }
+    async _set(key, value) {
+      items[key] = value;
+      flush();
+    }
+    async _get(key) {
+      return items[key] ?? null;
+    }
+    async _remove(key) {
+      delete items[key];
+      flush();
+    }
+    _addListener() {
+    }
+    _removeListener() {
+    }
+  };
+}
+async function prepareFirebaseSession(account, options, email) {
+  const { getFirebaseApp } = await import("./chunks/sdk-CYgNyuoK.mjs");
+  const { initializeAuth } = await import("./chunks/index-Dio0aBWA.mjs").then((n) => n.x);
+  try {
+    initializeAuth(getFirebaseApp(options), { persistence: filePersistence(account, email.trim().toLowerCase()) });
+  } catch {
+  }
+}
+const firebaseSession = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  forgetFirebaseSession,
+  prepareFirebaseSession
+}, Symbol.toStringTag, { value: "Module" }));
 const credentialsCommand = {
   name: "credentials",
   usage: "credentials <set|list|remove|copy|verify|types> [<type>:<name>] [--from-env VAR[,VAR]] [--from-gh] [--from-aws-profile <name>] [--generate]",
@@ -1691,6 +1765,7 @@ const credentialsCommand = {
     const spec = CREDENTIAL_TYPES[type2];
     if (action === "remove") {
       const removed = removeCredential(account);
+      forgetFirebaseSession(account);
       printResult(io, { account, removed }, () => removed ? `Removed ${account}.` : `${account} was not stored.`);
       return;
     }
@@ -1705,7 +1780,7 @@ const credentialsCommand = {
         return;
       }
       if (!process.stdin.isTTY) {
-        throw new CliError("needs-terminal", "verify reads the value the USER pastes in their own terminal.", `Ask the user to run it themselves (in Claude Code: \`! npx -y @fleox-agent-crm/agentcrm credentials verify ${account}\`).`);
+        throw new CliError("needs-terminal", "verify reads the value the USER pastes in their own terminal.", `Ask the user to run it themselves (in Claude Code: \`! npx -y ${PACKAGE_NAME}@${readVersionInfo().version} credentials verify ${account}\`).`);
       }
       try {
         copyToClipboard("");
@@ -1740,6 +1815,7 @@ const credentialsCommand = {
       for (const field of spec.fields) values[field] = await promptHidden(`${field}: `);
     }
     const saved = setCredential(account, values);
+    forgetFirebaseSession(account);
     printResult(io, { account, type: type2, fields: Object.keys(saved.values) }, () => `Stored ${account} (${Object.keys(saved.values).join(", ")}).`);
   }
 };
@@ -1765,6 +1841,18 @@ function parseJsonValue(raw, name2) {
     usage(`--${name2} is not valid JSON: ${err.message}`, `Example: --${name2} '{"targets":{"owner":50000}}' or --${name2} @config.json`);
   }
 }
+const MODULE_CONFIG_HINT = "Module configuration is JSON (≤ 256 KB) readable by every CRM user: no secrets (apiKey, token, secret, password…). Module ids: `agentcrm modules list`.";
+async function withHint(hint, p) {
+  try {
+    return await p;
+  } catch (err) {
+    const e = err;
+    if (e?.name === "OpsError" && (e.code === "validation" || e.code === "notFound" || e.code === "invalid")) {
+      throw new CliError(e.code, e.message, hint, e.code === "notFound" ? 1 : 2);
+    }
+    throw err;
+  }
+}
 const modulesCommand = {
   name: "modules",
   usage: "modules <list|get|enable|disable|config> …",
@@ -1782,13 +1870,13 @@ const modulesCommand = {
     const apply = options.yes === true;
     switch (action) {
       case "list":
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-CqdVQVJb.mjs")).listModules(ctx), (rows) => table(
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-clWdE-K2.mjs")).listModules(ctx), (rows) => table(
           rows.map((m) => ({ ...m, enabled: m.enabled ? "yes" : "no", required: m.required ? "yes" : "", dependsOn: m.dependsOn.join(",") })),
           ["id", "name", "category", "source", "enabled", "required", "dependsOn"]
         ));
       case "get": {
         const id = positional(positionals, 1, "module id", "modules get <id>");
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-CqdVQVJb.mjs")).getModule(ctx, id));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-clWdE-K2.mjs")).getModule(ctx, id));
       }
       case "enable":
       case "disable": {
@@ -1796,7 +1884,7 @@ const modulesCommand = {
         const enabled = action === "enable";
         const cascade = boolOpt(options, "cascade");
         return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-          const { setModuleEnabled } = await import("./chunks/modules-CqdVQVJb.mjs");
+          const { setModuleEnabled } = await import("./chunks/modules-clWdE-K2.mjs");
           if (apply) return setModuleEnabled(ctx, id, enabled, { cascade });
           const { result } = await dryRun(ctx, (copy) => setModuleEnabled(copy, id, enabled, { cascade }));
           return { needsConfirmation: true, plan: result };
@@ -1806,20 +1894,20 @@ Nothing changed — re-run with --yes once the user agrees.` : r.changed.length
       case "config": {
         const sub = positionals[1];
         const id = positional(positionals, 2, "module id", "modules config <get|set> <id>");
-        if (sub === "get") return withSession(io, options, {}, async ({ ctx }) => ({ id, config: (await import("./chunks/modules-CqdVQVJb.mjs")).getModuleConfig(ctx, id) ?? null }));
+        if (sub === "get") return withSession(io, options, {}, async ({ ctx }) => ({ id, config: (await import("./chunks/modules-clWdE-K2.mjs")).getModuleConfig(ctx, id) ?? null }));
         if (sub !== "set") usage(`Unknown modules config action "${sub ?? ""}".`, "Use modules config get <id> or modules config set <id> --value <json>.");
         const clear = boolOpt(options, "clear");
         const raw = strOpt(options, "value");
         if (!clear && raw === void 0) usage("modules config set needs --value <json|@file|-> (or --clear).");
         const value = clear ? null : parseJsonValue(raw, "value");
-        return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-          const mod = await import("./chunks/modules-CqdVQVJb.mjs");
+        return withHint(MODULE_CONFIG_HINT, withSession(io, options, { lock: apply }, async ({ ctx }) => {
+          const mod = await import("./chunks/modules-clWdE-K2.mjs");
           mod.getModule(ctx, id);
           const before = mod.getModuleConfig(ctx, id) ?? null;
           if (apply) return { id, config: await mod.setModuleConfig(ctx, id, value) ?? null, before };
           const { result } = await dryRun(ctx, (copy) => mod.setModuleConfig(copy, id, value));
           return { needsConfirmation: true, plan: { id, before, after: result ?? null } };
-        });
+        }));
       }
       default:
         usage(`Unknown modules action "${action}".`, "Use list, get, enable, disable or config.");
@@ -1845,14 +1933,27 @@ function imageDataUrl(file2) {
 function view(a, full) {
   if (full) return { ...a };
   const { logo, favicon, customCss, ...rest } = a;
-  const kb2 = (s) => Math.round((s.length - s.indexOf(",") - 1) * 3 / 4 / 1024);
+  const image = (s) => `${s.slice(5, s.indexOf(";"))}, ${formatSize(Math.floor((s.length - s.indexOf(",") - 1) * 3 / 4))}, #${shortHash(s)}`;
   return {
     ...rest,
-    logo: logo ? `${logo.slice(5, logo.indexOf(";"))}, ${kb2(logo)} KB` : null,
-    favicon: favicon ? `${favicon.slice(5, favicon.indexOf(";"))}, ${kb2(favicon)} KB` : null,
-    customCss: customCss ? `${new TextEncoder().encode(customCss).length} bytes` : null
+    logo: logo ? image(logo) : null,
+    favicon: favicon ? image(favicon) : null,
+    customCss: customCss ? `${new TextEncoder().encode(customCss).length} bytes, #${shortHash(customCss)}` : null
   };
 }
+function formatSize(n) {
+  return n < 1024 ? `${n} B` : `${(n / 1024).toFixed(1)} KB`;
+}
+function shortHash(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16).padStart(8, "0");
+}
+const APPEARANCE_HINT = "Allowed values: `agentcrm help appearance`; presets and installed themes: `agentcrm appearance presets`.";
+const withAppearanceHint = (p) => withHint(APPEARANCE_HINT, p);
 function diff(before, after) {
   const out = {};
   for (const k of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
@@ -1918,8 +2019,8 @@ const appearanceCommand = {
     const [action = "get"] = positionals;
     const apply = options.yes === true;
     const full = boolOpt(options, "full");
-    const appearance = () => import("./chunks/appearance-BaShelzt.mjs");
-    const change = (describe, op) => withSession(io, options, { lock: apply }, async ({ ctx }) => {
+    const appearance = () => import("./chunks/appearance-BloHbiLA.mjs");
+    const change = (describe, op) => withAppearanceHint(withSession(io, options, { lock: apply }, async ({ ctx }) => {
       const before = view((await appearance()).getAppearance(ctx), full);
       if (apply) {
         const after = view(await op(ctx), full);
@@ -1931,7 +2032,7 @@ const appearanceCommand = {
       const changes = r.plan ? r.plan.changes : r.changes ?? {};
       const lines = Object.entries(changes).map(([k, c]) => `  ${k}: ${JSON.stringify(c.from)} → ${JSON.stringify(c.to)}`);
       return [`${r.plan ? "Would apply" : "Applied"}: ${describe}`, ...lines.length ? lines : ["  (no visible change)"], ...r.plan ? ["Nothing changed — re-run with --yes once the user agrees."] : []].join("\n");
-    });
+    }));
     switch (action) {
       case "get":
         return withSession(io, options, {}, async ({ ctx }) => {
@@ -1986,7 +2087,7 @@ async function scaffold({ io, options, positionals }) {
   if (existsSync(dir) && readdirSync(dir).length > 0 && !boolOpt(options, "force")) {
     throw new CliError("dir-not-empty", `${dir} already exists and is not empty.`, "Pick another --dir (or --force to write into it).", 2);
   }
-  const { scaffoldExtension } = await import("./chunks/extScaffold-DqxI7R1e.mjs");
+  const { scaffoldExtension } = await import("./chunks/extScaffold-Aqyjf1nr.mjs");
   const res = scaffoldExtension({ kind, id, dir, name: strOpt(options, "name"), description: strOpt(options, "description"), author: strOpt(options, "author") });
   printResult(io, res, () => [`Created ${kind} "${id}" in ${dir}:`, ...res.files.map((f) => `  ${f}`), "", "Next:", ...res.next.map((n) => `  ${n}`)].join("\n"));
 }
@@ -1994,8 +2095,8 @@ async function check({ io, options, positionals }) {
   const target = positionals[1] ?? ".";
   const kind = strOpt(options, "kind");
   if (kind && kind !== "module" && kind !== "theme") usage("--kind is module or theme.");
-  const { readRawPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
-  const { checkExtension } = await import("./chunks/extCheck--7lmVvl7.mjs");
+  const { readRawPackage } = await import("./chunks/extPackage-DuZ6GZhp.mjs");
+  const { checkExtension } = await import("./chunks/extCheck-GgHG1dYB.mjs");
   const raw = await readRawPackage(target);
   const report = await checkExtension(raw, { kind, callTools: !boolOpt(options, "no-call") });
   printResult(io, report, () => {
@@ -2024,10 +2125,10 @@ async function check({ io, options, positionals }) {
 }
 async function pack({ io, options, positionals }) {
   const target = positionals[1] ?? ".";
-  const { readPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
+  const { readPackage } = await import("./chunks/extPackage-DuZ6GZhp.mjs");
   const { raw, pkg: pkg2 } = await readPackage(target);
   if (raw.sourceType === "zip") usage("ext pack takes a project or an unpacked folder, not a .zip.");
-  const { packExtension } = await import("./chunks/package-DWbn3t2R.mjs");
+  const { packExtension } = await import("./chunks/package-B7mI6HGi.mjs");
   const bytes = await packExtension(pkg2);
   const out = resolve(strOpt(options, "out") ?? join(raw.source, `${pkg2.manifest.id}-${pkg2.manifest.version}.zip`));
   mkdirSync(dirname(out), { recursive: true });
@@ -2037,12 +2138,23 @@ async function pack({ io, options, positionals }) {
 }
 async function install({ io, options, positionals }) {
   const target = positional(positionals, 1, "ZIP or folder", "ext install <zip|dir> [--site <alias>] [--yes]");
-  const { readPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
+  const { readPackage } = await import("./chunks/extPackage-DuZ6GZhp.mjs");
   const { pkg: pkg2, raw } = await readPackage(target);
   const apply = options.yes === true;
   const disabled = boolOpt(options, "disabled");
+  if (!boolOpt(options, "force")) {
+    const { checkExtension } = await import("./chunks/extCheck-GgHG1dYB.mjs");
+    const report = await checkExtension(raw, { callTools: false });
+    if (!report.valid) {
+      throw new CliError(
+        "invalid-package",
+        `The extension doesn't pass the check: ${report.errors.map((e) => e.message).join(" ")}`,
+        `Nothing was installed. Run \`agentcrm ext check ${target}\` for the full report (--force installs it anyway).`
+      );
+    }
+  }
   return withSession(io, options, { lock: apply }, async (s) => {
-    const ext = await import("./chunks/extensions-BP1k60md.mjs");
+    const ext = await import("./chunks/extensions-Bp72uZ9a.mjs");
     const existing = s.store.get("extensions", pkg2.manifest.id);
     const m = pkg2.manifest;
     const plan = {
@@ -2067,7 +2179,7 @@ async function install({ io, options, positionals }) {
     }
     const result = await ext.installExtension(s.ctx, pkg2, disabled ? { enabled: false } : {});
     const report = await s.extensions.sync();
-    const { getLoadedExtension } = await import("./chunks/registry-Ceexawxl.mjs");
+    const { getLoadedExtension } = await import("./chunks/registry-COfJrSmg.mjs");
     const loaded = getLoadedExtension(m.id);
     const failure = report?.failed.find((f) => f.id === m.id || f.id === "*");
     if (failure && !loaded) return { ...result, author: m.author ?? null, load: { status: "error", error: failure.error } };
@@ -2078,7 +2190,7 @@ async function install({ io, options, positionals }) {
     ...r.plan.warnings.map((w) => `  note: ${w}`),
     `  ${r.plan.warning}`,
     "Nothing changed — re-run with --yes once the user agrees."
-  ].join("\n") : `${r.mode === "upgrade" ? `Upgraded ${r.previousVersion} → ` : "Installed "}${r.id} ${r.version} (${r.enabled ? "enabled" : "disabled"}; load: ${r.load.status}${"error" in r.load ? ` — ${r.load.error}` : ""})${r.warnings.length ? `
+  ].join("\n") : `${r.mode === "upgrade" ? `Upgraded ${r.id} ${r.previousVersion} → ${r.version}` : `Installed ${r.id} ${r.version}`} (${r.enabled ? "enabled" : "disabled"}; load: ${r.load.status}${"error" in r.load ? ` — ${r.load.error}` : ""})${r.warnings.length ? `
   ${r.warnings.join("\n  ")}` : ""}`);
 }
 const extCommand = {
@@ -2089,7 +2201,7 @@ const extCommand = {
     { name: "new", usage: "ext new <module|theme> <id> [--dir <path>] [--name <name>] [--description <text>] [--author <name>] [--force]", summary: "Scaffold a standalone extension project (package.json, vite.config.ts, tsconfig + runtime typings, src/index.tsx, README).", writes: true },
     { name: "check", usage: "ext check [<dir|zip>] [--kind module|theme] [--no-call]", summary: "Validate manifest, ids, apiVersion, sizes, imports; load the bundle in a throw-away CRM and report routes, nav, slots, AI tools, automation actions, theme values." },
     { name: "pack", usage: "ext pack [<dir>] [--out <file.zip>]", summary: "ZIP manifest.json + bundle.js (+ style.css) for Settings → Modules → Install or `ext install`.", writes: true },
-    { name: "install", usage: "ext install <zip|dir> [--site <alias>] [--disabled] [--yes]", summary: "Install or upgrade an extension on a CRM. Prints the plan (id, version, author, upgrade, size) unless --yes.", writes: true, destructive: true },
+    { name: "install", usage: "ext install <zip|dir> [--site <alias>] [--disabled] [--force] [--yes]", summary: "Install or upgrade an extension on a CRM. The bundle is first loaded in a throw-away CRM (like ext check; --force skips it). Prints the plan (id, version, author, upgrade, size) unless --yes.", writes: true, destructive: true },
     { name: "list", usage: "ext list [--kind module|theme]", summary: "Installed extensions with version, enabled state and load status in this process." },
     { name: "enable", usage: "ext enable <id> [--cascade] [--yes]", summary: "Enable an installed extension (plan unless --yes).", writes: true },
     { name: "disable", usage: "ext disable <id> [--cascade] [--yes]", summary: "Disable it without uninstalling (plan unless --yes).", writes: true },
@@ -2104,7 +2216,7 @@ const extCommand = {
     { name: "name", type: "string", description: "new: display name." },
     { name: "description", type: "string", description: "new: one-sentence description." },
     { name: "author", type: "string", description: "new: author shown in the install plan and Settings → Modules." },
-    { name: "force", type: "boolean", description: "new: write into a non-empty folder. uninstall: even if enabled modules depend on it." },
+    { name: "force", type: "boolean", description: "new: write into a non-empty folder. install: skip the trial load (ext check). uninstall: even if enabled modules depend on it." },
     { name: "kind", type: "string", description: "check: expected kind. list: only modules or themes." },
     { name: "no-call", type: "boolean", description: "check: don't smoke-call the AI tools on the demo data." },
     { name: "out", type: "string", description: "pack / export: ZIP path (default: <dir>/<id>-<version>.zip, ./<id>-<version>.zip)." },
@@ -2128,8 +2240,8 @@ const extCommand = {
         const kind = strOpt(options, "kind");
         if (kind && kind !== "module" && kind !== "theme") usage("--kind is module or theme.");
         return withSession(io, options, {}, async (s) => {
-          const { listExtensions } = await import("./chunks/extensions-BP1k60md.mjs");
-          const { getLoadedExtension } = await import("./chunks/registry-Ceexawxl.mjs");
+          const { listExtensions } = await import("./chunks/extensions-Bp72uZ9a.mjs");
+          const { getLoadedExtension } = await import("./chunks/registry-COfJrSmg.mjs");
           return listExtensions(s.ctx, kind ? { kind } : {}).map((e) => ({ ...e, load: s.extensions.safeMode ? "skipped" : getLoadedExtension(e.id)?.status ?? (e.enabled ? "not loaded" : "disabled"), ...getLoadedExtension(e.id)?.error ? { loadError: getLoadedExtension(e.id)?.error } : {} }));
         }, (rows) => table(rows.map((r) => ({ ...r, enabled: r.enabled ? "yes" : "no" })), ["id", "kind", "name", "version", "enabled", "load", "author"]));
       }
@@ -2139,15 +2251,15 @@ const extCommand = {
         const enabled = action === "enable";
         const cascade = boolOpt(options, "cascade");
         return withSession(io, options, { lock: apply }, async (s) => {
-          const ext = await import("./chunks/extensions-BP1k60md.mjs");
+          const ext = await import("./chunks/extensions-Bp72uZ9a.mjs");
           const before = ext.getExtension(s.ctx, id);
           if (!apply) {
             const { result } = await dryRun(s.ctx, async (copy) => {
               await ext.setExtensionEnabled(copy, id, enabled, { cascade });
-              return (await import("./chunks/modules-CqdVQVJb.mjs")).moduleStates(copy.store);
+              return (await import("./chunks/modules-clWdE-K2.mjs")).moduleStates(copy.store);
             });
             const now = new Map(result.map((m) => [m.id, m.enabled]));
-            const changed = (await import("./chunks/modules-CqdVQVJb.mjs")).moduleStates(s.store).filter((m) => now.has(m.id) && now.get(m.id) !== m.enabled).map((m) => ({ id: m.id, enabled: now.get(m.id) }));
+            const changed = (await import("./chunks/modules-clWdE-K2.mjs")).moduleStates(s.store).filter((m) => now.has(m.id) && now.get(m.id) !== m.enabled).map((m) => ({ id: m.id, enabled: now.get(m.id) }));
             if (before.kind === "theme" && before.enabled !== enabled) changed.push({ id, enabled });
             return { needsConfirmation: true, plan: { id, kind: before.kind, from: before.enabled, to: enabled, changed } };
           }
@@ -2161,7 +2273,7 @@ Nothing changed — re-run with --yes once the user agrees.` : `${r.id} is now $
         const id = positional(positionals, 1, "extension id", "ext uninstall <id> [--yes]");
         const force = boolOpt(options, "force");
         return withSession(io, options, { lock: apply }, async (s) => {
-          const ext = await import("./chunks/extensions-BP1k60md.mjs");
+          const ext = await import("./chunks/extensions-Bp72uZ9a.mjs");
           const summary = ext.getExtension(s.ctx, id);
           if (!apply) {
             await dryRun(s.ctx, (copy) => ext.uninstallExtension(copy, id, { force }));
@@ -2176,8 +2288,8 @@ Nothing changed — re-run with --yes once the user agrees.` : `Uninstalled ${r.
       case "export": {
         const id = positional(positionals, 1, "extension id", "ext export <id> [--out <file.zip>]");
         return withSession(io, options, {}, async (s) => {
-          const { getExtensionPackage } = await import("./chunks/extensions-BP1k60md.mjs");
-          const { packExtension } = await import("./chunks/package-DWbn3t2R.mjs");
+          const { getExtensionPackage } = await import("./chunks/extensions-Bp72uZ9a.mjs");
+          const { packExtension } = await import("./chunks/package-B7mI6HGi.mjs");
           const pkg2 = getExtensionPackage(s.ctx, id);
           const bytes = await packExtension(pkg2);
           const out = resolve(strOpt(options, "out") ?? `${id}-${pkg2.manifest.version}.zip`);
@@ -2191,9 +2303,6 @@ Nothing changed — re-run with --yes once the user agrees.` : `Uninstalled ${r.
     }
   }
 };
-function printPlan(io, plan) {
-  printResult(io, plan, () => `Would restore ${String(plan.plan.restore)} (${String(plan.plan.mode)}). Re-run with --yes once the user agrees.`);
-}
 function mappingOpt(options) {
   const raw = typeof options.map === "string" ? readTextValue(options.map, "map").trim() : void 0;
   if (!raw) return void 0;
@@ -2242,10 +2351,22 @@ const importCommand = {
       if (!existsSync2(path)) usage(`${path} does not exist.`);
       const bytes = new Uint8Array(readFileSync2(path));
       if (options.yes !== true) {
-        printPlan(io, { needsConfirmation: true, plan: { restore: resolve(path), bytes: bytes.length, mode: options.replace === true ? "replace" : "merge" } });
-        return;
+        return withSession(
+          io,
+          options,
+          {},
+          async ({ ctx }) => {
+            const plan = await (await import("./chunks/backup-W3CjgkAJ.mjs")).planBackupZip(ctx, bytes, { mode: options.replace === true ? "replace" : "merge" });
+            return { needsConfirmation: true, plan: { restore: resolve(path), bytes: bytes.length, ...plan } };
+          },
+          (r) => [
+            `Would restore ${r.plan.restore} (${r.plan.mode}): ${r.plan.added} new, ${r.plan.overwritten} overwritten, ${r.plan.deleted} deleted document(s), ${r.plan.files} file(s).`,
+            ...r.plan.warnings.map((w) => `Warning: ${w}`),
+            "Re-run with --yes once the user agrees."
+          ].join("\n")
+        );
       }
-      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/backup-ClSmxmFZ.mjs")).importBackupZip(ctx, bytes, { mode: options.replace === true ? "replace" : "merge" }), (r) => `Restored ${r.written} document(s) and ${r.files} file(s)`);
+      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/backup-W3CjgkAJ.mjs")).importBackupZip(ctx, bytes, { mode: options.replace === true ? "replace" : "merge" }), (r) => `Restored ${r.written} document(s) and ${r.files} file(s)`);
     }
     if (kind !== "csv") usage('Only "import csv" and "import zip" are supported.', "Usage: agentcrm import csv <file> --object <id>");
     const source = positional(positionals, 1, "CSV file (or -)", "import csv <file|-> --object <id>");
@@ -2256,7 +2377,7 @@ const importCommand = {
     const apply = options.yes === true && options["dry-run"] !== true;
     const shown = numOpt(options, "rows") ?? 100;
     return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-      const { importCsv } = await import("./chunks/importCsv-DmE_sBch.mjs");
+      const { importCsv } = await import("./chunks/importCsv-LVmMTaWU.mjs");
       const report = await importCsv(ctx, {
         object: objectId,
         csv,
@@ -2305,16 +2426,16 @@ const exportCommand = {
       const file2 = strOpt(options, "out");
       if (!file2) usage("export zip needs --out <file.zip>.");
       return withSession(io, options, {}, async ({ ctx }) => {
-        const { exportBackupZip } = await import("./chunks/backup-ClSmxmFZ.mjs");
+        const { exportBackupZip } = await import("./chunks/backup-W3CjgkAJ.mjs");
         const { zip, report } = await exportBackupZip(ctx, { includeFiles: options["no-files"] !== true });
-        writeFileSync(resolve(file2), zip);
+        writeOutFile(file2, zip);
         return { file: resolve(file2), zipBytes: zip.length, files: report.files, missing: report.missing, fileBytes: report.bytes };
       }, (r) => `Wrote ${r.zipBytes} bytes (${r.files} file(s)${r.missing.length ? `, ${r.missing.length} missing` : ""}) to ${r.file}`);
     }
     const out = strOpt(options, "out");
     const deliver = (text, extra) => {
       if (out) {
-        writeFileSync(resolve(out), text);
+        writeOutFile(out, text);
         return { file: resolve(out), bytes: Buffer.byteLength(text), ...extra };
       }
       return { ...extra, content: text };
@@ -2324,7 +2445,7 @@ const exportCommand = {
       const filters = parseFilters(multiOpt(options, "filter"), FILTER_OPS);
       const sorts = parseSorts(multiOpt(options, "sort"));
       return withSession(io, options, {}, async ({ ctx }) => {
-        const { exportCsv } = await import("./chunks/exportCsv-B5hRvkNm.mjs");
+        const { exportCsv } = await import("./chunks/exportCsv-C6e6XEmB.mjs");
         const csv = exportCsv(ctx, objectId, {
           viewId: strOpt(options, "view"),
           filters,
@@ -2333,12 +2454,14 @@ const exportCommand = {
           values: boolOpt(options, "raw") ? "raw" : "labels",
           includeDeleted: boolOpt(options, "deleted")
         });
-        return deliver(csv, { object: objectId, rows: Math.max(0, csv.split(/\r?\n/).filter(Boolean).length - 1) });
+        const { default: Papa } = await import("./chunks/papaparse-Df7i1dHr.mjs").then((n) => n.p);
+        const rows = Math.max(0, Papa.parse(csv, { skipEmptyLines: true }).data.length - 1);
+        return deliver(csv, { object: objectId, rows });
       }, (r) => "content" in r ? String(r.content) : `Wrote ${String(r.rows)} row(s) to ${String(r.file)}`);
     }
     if (kind === "json") {
       return withSession(io, options, {}, async ({ ctx }) => {
-        const { exportJson } = await import("./chunks/exportCsv-B5hRvkNm.mjs");
+        const { exportJson } = await import("./chunks/exportCsv-C6e6XEmB.mjs");
         const data = exportJson(ctx, { collections: listOpt(options, "collections") });
         const text = JSON.stringify(data, null, 2);
         if (out) return deliver(text, {});
@@ -2374,6 +2497,7 @@ const reportCommand = {
   async run({ io, options, positionals }) {
     const name2 = positional(positionals, 0, "report name", "report <name>");
     const internal = REPORT_ALIASES[name2] ?? name2;
+    if (!Object.values(REPORT_ALIASES).includes(internal)) usage(`Unknown report "${name2}".`, `Reports: ${Object.keys(REPORT_ALIASES).join(", ")}.`);
     const params = {
       ...jsonObjectOpt(options, "params") ?? {},
       ...numOpt(options, "months") !== void 0 ? { months: numOpt(options, "months") } : {},
@@ -2381,7 +2505,7 @@ const reportCommand = {
       ...strOpt(options, "pipeline") ? { pipelineId: strOpt(options, "pipeline") } : {},
       ...strOpt(options, "owner") ? { ownerId: strOpt(options, "owner") } : {}
     };
-    return withSession(io, options, {}, async ({ ctx }) => ({ report: name2, data: (await import("./chunks/reports-BB59N6ke.mjs")).runReport(ctx, internal, params) }));
+    return withSession(io, options, {}, async ({ ctx }) => ({ report: name2, data: (await import("./chunks/reports-BACHGccj.mjs")).runReport(ctx, internal, params) }));
   }
 };
 const statsCommand = {
@@ -2391,7 +2515,7 @@ const statsCommand = {
   options: [SITE_OPTION, AS_OPTION],
   async run({ io, options }) {
     return withSession(io, options, {}, async ({ ctx, store }) => {
-      const stats = (await import("./chunks/stats-CfeJssSS.mjs")).getStats(ctx);
+      const stats = (await import("./chunks/stats-BfuLWhVV.mjs")).getStats(ctx);
       const journal = store.stats;
       return { ...stats, ...journal ? { journal: await journal.call(store) } : {} };
     }, (s) => [`backend: ${s.backend}`, ...s.objects.map((o) => `  ${o.label}: ${o.count}${o.deleted ? ` (+${o.deleted} deleted)` : ""}`), `open tasks: ${s.openTasks} (${s.overdueTasks} overdue)`, `users: ${s.users}`].join("\n"));
@@ -2405,7 +2529,7 @@ const compactCommand = {
   async run({ io, options }) {
     const apply = options.yes === true;
     return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-      const { compactData } = await import("./chunks/compact-CsFPaAAq.mjs");
+      const { compactData } = await import("./chunks/compact-BGHI92tm.mjs");
       const report = await compactData(ctx, { olderThanDays: numOpt(options, "older-than"), keepRuns: numOpt(options, "keep-runs"), dryRun: !apply });
       return apply ? report : { needsConfirmation: true, plan: report };
     }, (r) => "plan" in r ? `Would purge ${r.plan.purgedRecords.length} record(s), ${r.plan.purgedActivities} activit(ies), ${r.plan.purgedRuns} run(s), ${r.plan.purgedFiles} file(s). Re-run with --yes once the user agrees.` : `Purged ${r.purgedRecords.length} record(s), ${r.purgedFiles} file(s); storage compacted: ${r.storageCompacted}`);
@@ -2426,19 +2550,19 @@ const automationsCommand = {
     const [action = "list", id] = positionals;
     switch (action) {
       case "list":
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/automations-BWrvLqP6.mjs")).listAutomations(ctx).map((a) => ({ id: a.id, name: a.name, enabled: a.enabled, object: a.object, trigger: a.trigger, actions: a.actions.map((x) => x.type), lastRunAt: a.lastRunAt ? new Date(a.lastRunAt).toISOString() : null })), (rows) => table(rows, ["id", "name", "enabled", "object", "lastRunAt"]));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/automations-DwWruxmu.mjs")).listAutomations(ctx).map((a) => ({ id: a.id, name: a.name, enabled: a.enabled, object: a.object, trigger: a.trigger, actions: a.actions.map((x) => x.type), lastRunAt: a.lastRunAt ? new Date(a.lastRunAt).toISOString() : null })), (rows) => table(rows, ["id", "name", "enabled", "object", "lastRunAt"]));
       case "enable":
       case "disable": {
         if (!id) usage(`automations ${action} needs an id.`);
         return withSession(io, options, { lock: true }, async ({ ctx }) => {
-          const mod = await import("./chunks/automations-BWrvLqP6.mjs");
+          const mod = await import("./chunks/automations-DwWruxmu.mjs");
           return mod.setAutomationEnabled(ctx, id, action === "enable");
         });
       }
       case "run": {
         const apply = options.yes === true;
         return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-          const { runScheduled } = await import("./chunks/automations-BWrvLqP6.mjs");
+          const { runScheduled } = await import("./chunks/automations-DwWruxmu.mjs");
           const report = await runScheduled(ctx, { dryRun: !apply, automationId: strOpt(options, "id"), force: boolOpt(options, "force") });
           return apply ? report : { needsConfirmation: true, ...report };
         }, (r) => `${"needsConfirmation" in r ? "DRY RUN — " : ""}ran ${r.ran}, skipped ${r.skipped}, errors ${r.errors}`);
@@ -2462,16 +2586,16 @@ const formsCommand = {
     const [action = "list", id] = positionals;
     switch (action) {
       case "list":
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/forms-BKU5F9WF.mjs")).listForms(ctx), (fs) => table(fs, ["id", "name", "object", "publishedPath"]));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/forms-BfuWaQjA.mjs")).listForms(ctx), (fs) => table(fs, ["id", "name", "object", "publishedPath"]));
       case "publish": {
         if (!id) usage("forms publish needs a form id.");
         return withSession(io, options, { lock: options.yes === true }, async (s) => {
-          const forms = await import("./chunks/forms-BKU5F9WF.mjs");
+          const forms = await import("./chunks/forms-BfuWaQjA.mjs");
           const built = await forms.buildFormHtml(s.ctx, id);
           const target = s.hostingTarget();
           if (!target) usage(`${s.site.alias} has no hosting to publish the form to.`);
           if (options.yes !== true) return { needsConfirmation: true, plan: { form: id, path: built.path, hosting: s.site.hosting?.type, bytes: built.html.length } };
-          const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+          const { buildConnector } = await import("./chunks/hosting-Dnn1k3cV.mjs");
           const connector = buildConnector(target);
           const siteUrl = typeof s.site.hosting?.settings.siteUrl === "string" ? s.site.hosting.settings.siteUrl.replace(/\/+$/, "") : "";
           return forms.publishForm(s.ctx, id, { put: (input) => connector.put(input), publicUrl: async (path) => siteUrl ? `${siteUrl}/${path}` : connector.publicUrl(path) });
@@ -2480,7 +2604,7 @@ const formsCommand = {
       case "ingest": {
         const apply = options.yes === true;
         return withSession(io, options, { lock: apply }, async ({ ctx }) => {
-          const { ingestInbox } = await import("./chunks/forms-BKU5F9WF.mjs");
+          const { ingestInbox } = await import("./chunks/forms-BfuWaQjA.mjs");
           const report = await ingestInbox(ctx, strOpt(options, "form"), { dryRun: !apply, limit: numOpt(options, "limit") });
           return apply ? report : { needsConfirmation: true, ...report };
         }, (r) => `${"needsConfirmation" in r ? "DRY RUN — " : ""}processed ${r.processed}: ${r.created} created, ${r.updated} updated, ${r.failed} failed`);
@@ -2549,6 +2673,31 @@ async function fetchHostedAdmin(adminUrl, fetchImpl = fetch) {
     return { version: null, dataSchema: null, error: "version.json is not valid JSON" };
   }
 }
+function localAdminFolder(hosting) {
+  if (!hosting || hosting.connectorId !== "local-folder") return null;
+  const root = typeof hosting.settings.path === "string" ? hosting.settings.path : "";
+  if (!root) return null;
+  return join(root, hosting.folder ?? "admin");
+}
+function readLocalAdmin(folder) {
+  for (const name2 of ["version.json", "admin-files.json"]) {
+    const file2 = join(folder, name2);
+    if (!existsSync(file2)) continue;
+    try {
+      const m = JSON.parse(readFileSync(file2, "utf8"));
+      return { version: m.version ?? null, dataSchema: m.dataSchema ?? null };
+    } catch {
+      return { version: null, dataSchema: null, error: `${name2} is not valid JSON` };
+    }
+  }
+  return { version: null, dataSchema: null, error: `no version.json in ${folder}` };
+}
+async function siteAdminVersion(site) {
+  if (site.adminUrl) return { ...await fetchHostedAdmin(site.adminUrl), source: "url" };
+  const folder = localAdminFolder(site.hosting);
+  if (folder) return { ...readLocalAdmin(folder), source: "folder" };
+  return { version: null, dataSchema: null, source: "none" };
+}
 function readChangelog() {
   try {
     const data = JSON.parse(readFileSync(join(packageRoot(), "changelog.json"), "utf8"));
@@ -2591,12 +2740,12 @@ const deployAdminCommand = {
     const sites = options.all === true ? listSites().sites.filter((s) => s.hosting) : [resolveSite(strOpt(options, "site"))];
     if (!sites.length) throw new CliError("no-sites", "No registered CRM has a hosting.");
     installBrowserEnv();
-    const { adminOps, applyOps, buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+    const { adminOps, applyOps, buildConnector } = await import("./chunks/hosting-Dnn1k3cV.mjs");
     const { hostingTargetOf: hostingTargetOf2 } = await Promise.resolve().then(() => session);
     const plans = [];
     for (const site of sites) {
       if (!site.hosting) throw new CliError("not-hosted", `${site.alias} has no hosting recorded.`, "Register it with `site add --admin-url …` from a CRM whose admin is hosted, or reinstall with a hosting.");
-      const hosted = site.adminUrl ? await fetchHostedAdmin(site.adminUrl) : { version: null, dataSchema: null };
+      const hosted = await siteAdminVersion(site);
       const plan = {
         alias: site.alias,
         adminUrl: site.adminUrl,
@@ -2695,7 +2844,7 @@ async function runDoctor(site, opts = {}) {
   installBrowserEnv();
   try {
     if (site.runtime.backend === "journal" && site.runtime.journal.connectorId === "git-pages") {
-      const { probeTarget } = await import("./chunks/install-CpHoUFtL.mjs");
+      const { probeTarget } = await import("./chunks/install-BBTA4nMm.mjs");
       const { dataTargetOf: dataTargetOf2 } = await Promise.resolve().then(() => session);
       const probe = await probeTarget(dataTargetOf2(site), { requireSiteUrl: false, requirePrivate: true });
       add(probe.ok ? { id: "data-repo", status: "ok", message: probe.detail } : { id: "data-repo", status: "fail", message: probe.detail, fix: "Make the data repository private and check the token's Contents permission." });
@@ -2712,7 +2861,7 @@ async function runDoctor(site, opts = {}) {
       if (!settingsDoc(store)) missing.push("settings");
       if (!usersOf(store).some((u) => u.role === "admin" && !u.disabled)) missing.push("an active admin user");
       if (missing.length && opts.repair) {
-        const { seedCrm } = await import("./chunks/seed-CugPGYZL.mjs");
+        const { seedCrm } = await import("./chunks/seed-6MRmQQBR.mjs");
         repaired = await seedCrm(session$1.system, { admin: site.user ? { name: site.user.split("@")[0], email: site.user } : void 0 });
         add({ id: "dataset", status: "ok", message: `Repaired: seeded ${missing.join(", ")}.` });
       } else {
@@ -2740,26 +2889,40 @@ async function runDoctor(site, opts = {}) {
     add({ id: "data-access", status: "fail", message: e.message, fix: e.hint });
   }
   const adminUrl = site.adminUrl;
+  const adminFolder = adminUrl ? null : localAdminFolder(site.hosting);
   let origin = null;
-  if (!adminUrl) {
+  if (!adminUrl && !adminFolder) {
     add({ id: "admin", status: "skip", message: "Admin not hosted (use `agentcrm serve`)." });
   } else {
-    origin = new URL(adminUrl).origin;
-    add(
-      adminUrl.startsWith("https://") || /^http:\/\/(localhost|127\.0\.0\.1)/.test(adminUrl) ? { id: "https", status: "ok", message: "Admin served over HTTPS (or localhost)." } : { id: "https", status: "fail", message: `${adminUrl} is plain HTTP: browsers refuse WebCrypto (signing, encryption) there.`, fix: "Serve the admin over HTTPS (CDN / custom domain with TLS, the bucket's https endpoint, GitHub Pages)." }
-    );
-    const index = await fetchText(`${adminUrl}index.html`);
+    if (adminUrl) {
+      origin = new URL(adminUrl).origin;
+      add(
+        adminUrl.startsWith("https://") || /^http:\/\/(localhost|127\.0\.0\.1)/.test(adminUrl) ? { id: "https", status: "ok", message: "Admin served over HTTPS (or localhost)." } : { id: "https", status: "fail", message: `${adminUrl} is plain HTTP: browsers refuse WebCrypto (signing, encryption) there.`, fix: "Serve the admin over HTTPS (CDN / custom domain with TLS, the bucket's https endpoint, GitHub Pages)." }
+      );
+    }
+    const read = async (name2) => {
+      if (adminUrl) {
+        const res = await fetchText(`${adminUrl}${name2}`);
+        return { ok: res.ok, text: res.text, error: res.error ?? (res.ok ? void 0 : `HTTP ${res.status}`) };
+      }
+      const file2 = join(adminFolder, name2);
+      if (!existsSync(file2)) return { ok: false, text: "", error: `${file2} not found` };
+      return { ok: true, text: readFileSync(file2, "utf8") };
+    };
+    const index = await read("index.html");
     if (!index.ok) {
-      add({ id: "admin", status: "fail", message: `Admin page not served (${index.error ?? `HTTP ${index.status}`}).`, fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\` (Pages hosts take a minute after a commit).` });
+      add({ id: "admin", status: "fail", message: `Admin page not ${adminUrl ? "served" : "found"} (${index.error}).`, fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\`${adminUrl ? " (Pages hosts take a minute after a commit)" : ""}.` });
     } else {
-      add({ id: "admin", status: "ok", message: `Admin served at ${adminUrl}.` });
-      const hosted = await fetchHostedAdmin(adminUrl);
+      add(
+        adminUrl ? { id: "admin", status: "ok", message: `Admin served at ${adminUrl}.` } : { id: "admin", status: "ok", message: `Admin in the folder ${adminFolder} (no public URL): open it with \`agentcrm serve --dir ${adminFolder}\`.` }
+      );
+      const hosted = adminUrl ? await fetchHostedAdmin(adminUrl) : readLocalAdmin(adminFolder);
       add(
         !hosted.version ? { id: "admin-version", status: "warn", message: "version.json missing next to the admin.", fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\`.` } : compareVersions(hosted.version, info.version) >= 0 ? { id: "admin-version", status: "ok", message: `Admin ${hosted.version} is up to date.` } : { id: "admin-version", status: "warn", message: `Admin ${hosted.version} is older than ${info.version}.`, fix: `Offer \`agentcrm deploy-admin --site ${site.alias}\`.` }
       );
-      const cfg = await fetchText(`${adminUrl}config.js`);
+      const cfg = await read("config.js");
       try {
-        if (!cfg.ok) throw new Error(cfg.error ?? `HTTP ${cfg.status}`);
+        if (!cfg.ok) throw new Error(cfg.error);
         const runtime = parseConfigJs(cfg.text);
         const secrets = findSecretKeys(runtime);
         if (secrets.length) add({ id: "config-js", status: "fail", message: `config.js publishes secrets: ${secrets.join(", ")}.`, fix: "Revoke those keys NOW, then redeploy the admin (config.js is regenerated without secrets)." });
@@ -2823,7 +2986,7 @@ function readPlan(source) {
   try {
     return JSON.parse(text);
   } catch (err) {
-    throw new CliError("invalid-plan", `The plan is not valid JSON: ${err.message}`, void 0, 2);
+    throw new CliError("invalid-plan", `The plan is not valid JSON: ${err.message}`, "Write the plan as one JSON object (`agentcrm options --json` documents every field).", 2);
   }
 }
 const installCommand = {
@@ -2838,10 +3001,10 @@ const installCommand = {
     const planPath = strOpt(options, "plan");
     if (!planPath) usage("install needs --plan <file|->.", "Run `agentcrm options` for the format.");
     installBrowserEnv();
-    const { resolvePlan } = await import("./chunks/plan-C0TBrU92.mjs");
+    const { resolvePlan } = await import("./chunks/plan-BmTat6-T.mjs");
     const plan = resolvePlan(readPlan(planPath));
     if (getSite(plan.alias)) throw new CliError("site-exists", `A site named "${plan.alias}" is already registered.`, "Use another alias, or `agentcrm site forget` it first.");
-    const { checkPlan, runInstall } = await import("./chunks/install-CpHoUFtL.mjs");
+    const { checkPlan, runInstall } = await import("./chunks/install-BBTA4nMm.mjs");
     io.err("Checking access…");
     const checks = await checkPlan(plan);
     const summary = {
@@ -2861,7 +3024,7 @@ const installCommand = {
       throw new CliError(
         "check-failed",
         [!checks.data.ok && `Data: ${checks.data.detail}`, checks.hosting && !checks.hosting.ok && `Hosting: ${checks.hosting.detail}`].filter(Boolean).join(" — "),
-        "Fix the access (key / token permissions, bucket / repo names, URL, CORS) and retry the dry run."
+        checks.data.existing && !checks.data.ok ? `Reuse it: the user stores its passphrase (\`agentcrm credentials set ${plan.passphraseAccount ?? `passphrase:${plan.alias}`}\` in their own terminal, or --from-env), then add "encryption": { "credential": "${plan.passphraseAccount ?? `passphrase:${plan.alias}`}" } to the plan's data and retry the dry run. Or pick another folder / root for a new CRM.` : "Fix the access (key / token permissions, bucket / repo names, URL, CORS) and retry the dry run."
       );
     }
     if (options["dry-run"] === true) {
@@ -2887,6 +3050,8 @@ const installCommand = {
       });
       const nextSteps = [];
       if (plan.adminUrl) nextSteps.push(`Open the admin: ${plan.adminUrl}`);
+      else if (localAdminFolder(plan.hosting)) nextSteps.push(`The admin is in ${localAdminFolder(plan.hosting)} (no public URL): open it with \`agentcrm serve --dir ${localAdminFolder(plan.hosting)}\`, or serve that folder over HTTPS.`);
+      else if (plan.hosting) nextSteps.push(`The admin was uploaded to the ${plan.hosting.type} hosting; its public URL is unknown (add siteUrl to the plan's hosting settings next time).`);
       else nextSteps.push("The admin was not uploaded: run `agentcrm serve` to use it on this computer.");
       if (plan.backend === "journal") {
         nextSteps.push(`Each new browser asks once for the data location keys${plan.passphraseAccount ? " and the passphrase" : ""} (they stay in that browser).`);
@@ -3136,9 +3301,10 @@ const versionCommand = {
   }
 };
 async function siteStatus(site, version2, dataSchema) {
-  const base = { alias: site.alias, adminUrl: site.adminUrl };
-  if (!site.adminUrl) return { ...base, adminVersion: null, state: "not-hosted" };
-  const hosted = await fetchHostedAdmin(site.adminUrl);
+  const folder = site.adminUrl ? null : localAdminFolder(site.hosting);
+  const base = { alias: site.alias, adminUrl: site.adminUrl, ...folder ? { adminFolder: folder } : {} };
+  const hosted = await siteAdminVersion(site);
+  if (hosted.source === "none") return { ...base, adminVersion: null, state: "not-hosted" };
   if (!hosted.version) return { ...base, adminVersion: null, state: "unreachable", error: hosted.error };
   if (hosted.version !== site.adminVersion) putSite({ ...site, adminVersion: hosted.version });
   const cmp = compareVersions(hosted.version, version2);
@@ -3199,7 +3365,7 @@ const optionsCommand = {
       printResult(io, { email: rulesEmail, rules, where: "Firebase console → Firestore Database → Rules → paste → Publish (or `firebase deploy --only firestore:rules`)." }, () => rules);
       return;
     }
-    const { PLAN_EXAMPLE } = await import("./chunks/plan-C0TBrU92.mjs");
+    const { PLAN_EXAMPLE } = await import("./chunks/plan-BmTat6-T.mjs");
     const data = {
       order: ["data backend", "data location", "admin hosting"],
       backends: DATA_BACKENDS,
@@ -3272,13 +3438,13 @@ const objectsCommand = {
     switch (action) {
       case "list":
         return withSession(io, options, {}, async ({ ctx, store }) => {
-          const { listObjects } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { listObjects } = await import("./chunks/schema-C4lSslXv.mjs");
           const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
           return listObjects(ctx).map((o) => ({ id: o.id, labelSingular: o.labelSingular, labelPlural: o.labelPlural, standard: o.standard, labelField: o.labelField, fields: o.fields.length, records: recordsOf(store, o.id).length }));
         }, (rows) => table(rows, ["id", "labelPlural", "fields", "records", "standard"]));
       case "get": {
         const objectId = positional(positionals, 1, "object id", "objects get <id>");
-        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).describeSchema(ctx, objectId));
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/schema-C4lSslXv.mjs")).describeSchema(ctx, objectId)[0]);
       }
       case "create": {
         const data = jsonObjectOpt(options, "data") ?? {};
@@ -3291,7 +3457,7 @@ const objectsCommand = {
           ...strOpt(options, "color") ? { color: strOpt(options, "color") } : {}
         };
         if (!input.labelSingular || !input.labelPlural) usage("objects create needs --singular and --plural (or --data).");
-        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).createObject(ctx, input));
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-C4lSslXv.mjs")).createObject(ctx, input));
       }
       case "update": {
         const objectId = positional(positionals, 1, "object id", "objects update <id> …");
@@ -3303,12 +3469,12 @@ const objectsCommand = {
           ...strOpt(options, "label-field") ? { labelField: strOpt(options, "label-field") } : {}
         };
         if (!Object.keys(patch).length) usage("objects update needs --singular, --plural, --icon, --color or --label-field.");
-        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).updateObject(ctx, objectId, patch));
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-C4lSslXv.mjs")).updateObject(ctx, objectId, patch));
       }
       case "delete": {
         if (!id) usage("objects delete needs an object id.");
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx, store }) => {
-          const { getObject, deleteObject } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { getObject, deleteObject } = await import("./chunks/schema-C4lSslXv.mjs");
           const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
           const o = getObject(ctx, id);
           const plan = { object: o.id, label: o.labelPlural, standard: o.standard, recordsDeleted: recordsOf(store, o.id, { includeDeleted: true }).length };
@@ -3366,7 +3532,7 @@ const fieldsCommand = {
           ...boolOpt(options, "unique") ? { unique: true } : {},
           ...strOpt(options, "description") ? { description: strOpt(options, "description") } : {}
         };
-        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).createField(ctx, objectId, input));
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-C4lSslXv.mjs")).createField(ctx, objectId, input));
       }
       case "update": {
         if (!fieldId) usage("fields update needs a field id.");
@@ -3383,12 +3549,12 @@ const fieldsCommand = {
           ...strOpt(options, "description") !== void 0 ? { description: strOpt(options, "description") } : {}
         };
         if (!Object.keys(patch).length) usage("fields update needs at least one change.");
-        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).updateField(ctx, objectId, fieldId, patch));
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-C4lSslXv.mjs")).updateField(ctx, objectId, fieldId, patch));
       }
       case "delete": {
         if (!fieldId) usage("fields delete needs a field id.");
         return withSession(io, options, { lock: options.yes === true }, async ({ ctx, store }) => {
-          const { getObject, deleteField } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { getObject, deleteField } = await import("./chunks/schema-C4lSslXv.mjs");
           const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
           const field = getObject(ctx, objectId).fields.find((f) => f.id === fieldId);
           if (!field) usage(`No field "${fieldId}" on ${objectId}.`, `\`agentcrm objects get ${objectId}\` lists them.`);
@@ -3695,7 +3861,7 @@ const toolsCommand = {
   async run({ io, options, positionals }) {
     const [action = "list"] = positionals;
     if (action === "list") {
-      const { listAiTools, AI_TOOLS } = await import("./chunks/tools-Bew8lxKx.mjs");
+      const { listAiTools, AI_TOOLS } = await import("./chunks/tools-iSH-yMpl.mjs");
       const builtin = new Set(AI_TOOLS.map((t) => t.name));
       const shape = () => listAiTools().map((t) => ({ name: t.name, description: t.description, mutating: t.mutating, source: builtin.has(t.name) ? "builtin" : "extension", inputSchema: t.inputSchema }));
       const human = (r) => table(r.tools, ["name", "mutating", "source", "description"]);
@@ -3715,7 +3881,7 @@ const toolsCommand = {
     }
     if (action === "call") {
       const name2 = positional(positionals, 1, "tool name", "tools call <name> --input <json>");
-      const { findTool, callTool, listAiTools } = await import("./chunks/tools-Bew8lxKx.mjs");
+      const { findTool, callTool, listAiTools } = await import("./chunks/tools-iSH-yMpl.mjs");
       const input = jsonObjectOpt(options, "input") ?? {};
       const builtin = findTool(name2);
       return withSession(io, options, { lock: builtin ? builtin.mutating : true }, async ({ ctx }) => {
@@ -3737,8 +3903,8 @@ const mcpCommand = {
     const log = (msg) => process.stderr.write(`${msg}
 `);
     for (const w of session2.warnings) log(`[agentcrm mcp] note: ${w}`);
-    const { listAiTools } = await import("./chunks/tools-Bew8lxKx.mjs");
-    const { createMcpServer, serveStdio } = await import("./chunks/server-ISwlDRCN.mjs");
+    const { listAiTools } = await import("./chunks/tools-iSH-yMpl.mjs");
+    const { createMcpServer, serveStdio } = await import("./chunks/server-DC3t8r30.mjs");
     let lastRefresh = Date.now();
     const server = createMcpServer({
       readOnly,
@@ -3761,7 +3927,10 @@ const mcpCommand = {
         async withWrite(fn) {
           const unlock = lockSite(session2.site.alias);
           try {
-            return await fn();
+            const result = await fn();
+            const report = await session2.extensions.sync();
+            for (const f of report?.failed ?? []) log(`[agentcrm mcp] extension ${f.id} failed to load: ${f.error}`);
+            return result;
           } finally {
             unlock();
           }
@@ -3866,7 +4035,11 @@ async function main(argv, io) {
   const json = argv.includes("--json");
   const out = createIo(json);
   try {
-    const [name2 = "help", ...rest] = argv.filter((a) => a !== "--json");
+    const args = argv.filter((a) => a !== "--json");
+    const leading = [];
+    while (args[0] && LEADING_GLOBAL_FLAGS.has(args[0])) leading.push(args.shift());
+    const [name2 = "help", ...rest] = args;
+    rest.push(...leading);
     if (name2 === "--help" || name2 === "-h") return await run("help", rest, out) ?? 0;
     if (name2 === "--version" || name2 === "-v") return await run("version", rest, out) ?? 0;
     return await run(name2, rest, out) ?? 0;
@@ -3874,6 +4047,7 @@ async function main(argv, io) {
     return printError(out, error);
   }
 }
+const LEADING_GLOBAL_FLAGS = new Set(GLOBAL_OPTIONS.filter((o) => o.type === "boolean" && o.name !== "help").map((o) => `--${o.name}`));
 async function run(name2, args, io) {
   const command = findCommand(name2);
   if (!command) {
@@ -3891,13 +4065,21 @@ async function run(name2, args, io) {
     throw new CliError("usage", e.message, `Usage: agentcrm ${command.usage}`, 2);
   }
   if (parsed.values.help && command.name !== "help") return run("help", [command.name], io);
-  return command.run({
-    io,
-    options: parsed.values,
-    positionals: parsed.positionals
-  });
+  try {
+    return await command.run({
+      io,
+      options: parsed.values,
+      positionals: parsed.positionals
+    });
+  } catch (e) {
+    if (e instanceof CliError && !e.hint && e.exitCode === 2) {
+      throw new CliError(e.code, e.message, `Usage: agentcrm ${command.usage} (details: \`agentcrm help ${command.name}\`).`, e.exitCode);
+    }
+    throw e;
+  }
 }
 installBrowserEnv();
+routeConsoleToStderr();
 main(process.argv.slice(2)).then(
   (code) => process.exit(code),
   (err) => {
@@ -3913,15 +4095,16 @@ export {
   LOCATIONS as L,
   PACKAGE_NAME as P,
   USER_ROLES as U,
-  parseAccount as a,
-  requireCredential as b,
-  findLocation as c,
-  findHosting as d,
-  FIELD_TYPES as e,
+  FIELD_TYPES as a,
+  parseAccount as b,
+  requireCredential as c,
+  findLocation as d,
+  findHosting as e,
   findBackend as f,
   getCredential as g,
   openStore as h,
-  distRoot as i,
+  installBrowserEnv as i,
+  distRoot as j,
   nodeImportBundle as n,
   ownPackageRoot as o,
   packageRoot as p,