@goondocks/myco 0.17.1 → 0.18.0

package/dist/{main-6DGPZXRF.js → main-6PY3ITQ5.js}

@@ -3,6 +3,9 @@ import {
   DaemonLogger,
   LEVEL_ORDER
 } from "./chunk-MVBCON4D.js";
+import {
+  withTaskConfig
+} from "./chunk-GFR542SM.js";
 import {
   EMBEDDABLE_TABLES,
   EMBEDDABLE_TEXT_COLUMNS,
@@ -12,7 +15,16 @@ import {
   getEmbeddingQueueDepth,
   getUnembedded,
   markEmbedded
-} from "./chunk-KOTFMGL5.js";
+} from "./chunk-DLFDBKEV.js";
+import {
+  loadSecrets,
+  readSecrets,
+  writeSecret
+} from "./chunk-RJMXDUMA.js";
+import {
+  Anthropic,
+  createEmbeddingProvider
+} from "./chunk-KWTOCJLB.js";
 import {
   buildTaskInstruction,
   closeOpenBatches,
@@ -38,6 +50,7 @@ import {
   getRun,
   getSkillRecord,
   getSkillRecordByName,
+  hasConfiguredProvider,
   incrementActivityCount,
   incrementSkillUsageCount,
   insertBatchStateless,
@@ -59,71 +72,57 @@ import {
   setResponseSummary,
   updateCandidate,
   updateNotificationStatus
-} from "./chunk-YTOD6L6N.js";
+} from "./chunk-JDI4DPWD.js";
 import {
   fullTextSearch,
   hydrateSearchResults
-} from "./chunk-GBYLHPML.js";
-import {
-  cleanupStagedSkill,
-  listStaleStagingDirs
-} from "./chunk-U5EW2VIQ.js";
-import {
-  withTaskConfig
-} from "./chunk-SODRR3HE.js";
-import {
-  getMachineId
-} from "./chunk-ENWBFX7F.js";
-import {
-  createEmbeddingProvider
-} from "./chunk-QQ7CXA7Q.js";
+} from "./chunk-NZI7WBZI.js";
 import {
   copyTaskToUser,
   deleteUserTask,
   loadAllTasks,
   validateTaskName,
   writeUserTask
-} from "./chunk-ZUSTCXHT.js";
+} from "./chunk-RAV5YMRU.js";
 import {
   AgentTaskSchema,
   registerAgent,
   resolveDefinitionsDir,
   taskFromParsed
-} from "./chunk-VQQ57UPG.js";
+} from "./chunk-NI23QCHB.js";
 import {
   listTurnsByRun
 } from "./chunk-QLCD77AN.js";
 import {
-  checkLocalProvider
-} from "./chunk-CPL76CYD.js";
+  cleanupStagedSkill,
+  listStaleStagingDirs
+} from "./chunk-U5EW2VIQ.js";
+import {
+  getMachineId
+} from "./chunk-ENWBFX7F.js";
 import {
   EventBuffer,
   cleanStaleBuffers,
   listBufferSessionIds
 } from "./chunk-V7XG6V6C.js";
 import "./chunk-IB76KGBY.js";
-import "./chunk-U3SSOSIR.js";
-import "./chunk-Y7QCKCEJ.js";
-import "./chunk-KGL5QSDN.js";
-import "./chunk-XQHL4GMO.js";
+import "./chunk-55QEICRO.js";
 import "./chunk-SAKJMNSR.js";
+import "./chunk-WYOE4IAX.js";
 import {
-  loadSecrets,
-  readSecrets,
-  writeSecret
-} from "./chunk-RJMXDUMA.js";
-import "./chunk-VVGZL2HX.js";
+  checkLocalProvider
+} from "./chunk-75AZFBFW.js";
 import {
   LmStudioBackend,
   OllamaBackend
-} from "./chunk-DKSQMH5X.js";
+} from "./chunk-CML4MCYF.js";
 import {
   countSpores,
   getSpore,
   insertSpore,
   listSpores,
   updateSporeStatus
-} from "./chunk-UDBCAFXS.js";
+} from "./chunk-7OYXB2NM.js";
 import {
   closeSession,
   countSessions,
@@ -134,7 +133,7 @@ import {
   listSessions,
   updateSession,
   upsertSession
-} from "./chunk-VGVRBSLC.js";
+} from "./chunk-U7GJTVSX.js";
 import {
   backfillUnsynced,
   countDeadLettered,
@@ -150,13 +149,13 @@ import {
   pruneOld,
   retryDeadLettered,
   syncRow
-} from "./chunk-KKEMVH6D.js";
+} from "./chunk-O3TRN3RC.js";
 import {
   EMBEDDING_DIMENSIONS,
   REST_SETTABLE_STATUSES,
   SCHEMA_VERSION,
   createSchema
-} from "./chunk-OGNEW5CN.js";
+} from "./chunk-OW433Q4C.js";
 import {
   CONFIG_FILENAME,
   MycoConfigSchema,
@@ -165,7 +164,7 @@ import {
   updateBackupConfig,
   updateConfig,
   updateTeamConfig
-} from "./chunk-FEX6ALLH.js";
+} from "./chunk-2V7HR7HB.js";
 import {
   closeDatabase,
   getDatabase,
@@ -174,13 +173,13 @@ import {
 } from "./chunk-MYX5NCRH.js";
 import {
   resolveCliEntryPath
-} from "./chunk-N6JNOSBQ.js";
+} from "./chunk-BUIR3JWM.js";
 import {
   getPluginVersion
-} from "./chunk-LA7NDX3J.js";
+} from "./chunk-EO2RQW4S.js";
 import {
   loadManifests
-} from "./chunk-EBIYONNZ.js";
+} from "./chunk-FABWUX5G.js";
 import {
   findPackageRoot
 } from "./chunk-LPUQPDC2.js";
@@ -214,6 +213,7 @@ import {
   PROMPT_PREVIEW_CHARS,
   PROMPT_VECTOR_OVER_FETCH,
   RELEASE_CHANNELS,
+  RESTART_REASON_FILENAME,
   RESTART_RESPONSE_FLUSH_MS,
   SEARCH_RESULTS_DEFAULT_LIMIT,
   SEARCH_SIMILARITY_THRESHOLD,
@@ -229,12 +229,13 @@ import {
   UPDATE_CONFIG_PATH,
   UPDATE_ERROR_PATH,
   UPDATE_SCRIPT_DELAY_SECONDS,
+  UPDATE_STAMP_FILENAME,
   USER_AGENT_ID,
   USER_AGENT_NAME,
   USER_TASK_SOURCE,
   epochSeconds,
   estimateTokens
-} from "./chunk-6SDC6V3N.js";
+} from "./chunk-CKJAWZQE.js";
 import {
   LOG_KINDS,
   kindToComponent
@@ -1602,10 +1603,32 @@ async function handleRestart(deps, body) {
 var import_yaml = __toESM(require_dist(), 1);
 import fs8 from "fs";
 import path9 from "path";
+import { execFileSync } from "child_process";
 import semver from "semver";
 var REGISTRY_FETCH_TIMEOUT_MS = 1e4;
+var devBuildCliEntry = null;
+function setDevBuildCliEntry(cliEntry) {
+  devBuildCliEntry = cliEntry;
+}
+function resolveMycoBinary() {
+  return devBuildCliEntry ?? "myco";
+}
 function isUpdateExempt() {
-  return Boolean(process.env.MYCO_CMD);
+  return devBuildCliEntry !== null;
+}
+function detectDevBuild(globalPrefix, cliEntry, realpath) {
+  if (!globalPrefix) return null;
+  if (!cliEntry) return null;
+  try {
+    const resolvedEntry = realpath(cliEntry);
+    const resolvedPrefix = realpath(globalPrefix);
+    if (resolvedEntry.startsWith(resolvedPrefix + path9.sep) || resolvedEntry === resolvedPrefix) {
+      return null;
+    }
+    return cliEntry;
+  } catch {
+    return null;
+  }
 }
 function defaultUpdateConfig() {
   return {
@@ -1676,6 +1699,25 @@ function buildCheckResult(currentVersion, cache, config, error) {
     error
   };
 }
+function resolveGlobalPrefix() {
+  return execFileSync("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 5e3 }).trim();
+}
+function getInstalledVersion(globalPrefix) {
+  try {
+    const pkgPath = path9.join(
+      globalPrefix,
+      "lib",
+      "node_modules",
+      NPM_PACKAGE_NAME,
+      "package.json"
+    );
+    const raw = fs8.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return pkg.version ?? null;
+  } catch {
+    return null;
+  }
+}
 async function checkForUpdate(currentVersion) {
   const config = readUpdateConfig();
   const existingCache = readCachedCheck();
@@ -1737,17 +1779,18 @@ import os6 from "os";
 import path10 from "path";
 import { spawn as spawn2 } from "child_process";
 function generateUpdateScript(params) {
-  const { targetVersion, projectRoot, vaultDir } = params;
+  const { targetVersion, projectRoot, vaultDir, mycoBinary } = params;
   const packageSpec = `${NPM_PACKAGE_NAME}@${targetVersion}`;
   const quotedProjectRoot = JSON.stringify(projectRoot);
   const quotedVaultDir = JSON.stringify(vaultDir);
+  const quotedMycoBinary = JSON.stringify(mycoBinary);
   const quotedErrorPath = JSON.stringify(UPDATE_ERROR_PATH);
   const errorJson = JSON.stringify(
     JSON.stringify({ error: `npm install failed for ${packageSpec}` })
   );
   return `#!/bin/sh
 set -e
-MYCO="\${MYCO_CMD:-myco}"
+MYCO=${quotedMycoBinary}
 
 # Wait for daemon to exit cleanly
 sleep ${UPDATE_SCRIPT_DELAY_SECONDS}
@@ -1770,12 +1813,9 @@ fi
 rm -f "$0"
 `;
 }
-function spawnUpdateScript(params) {
-  fs9.mkdirSync(MYCO_GLOBAL_DIR, { recursive: true });
-  const scriptName = `myco-update-${Date.now()}.sh`;
-  const scriptPath = path10.join(os6.tmpdir(), scriptName);
-  const script = generateUpdateScript(params);
-  fs9.writeFileSync(scriptPath, script, { encoding: "utf-8", mode: 493 });
+function spawnDetachedScript(namePrefix, content) {
+  const scriptPath = path10.join(os6.tmpdir(), `${namePrefix}-${Date.now()}.sh`);
+  fs9.writeFileSync(scriptPath, content, { encoding: "utf-8", mode: 493 });
   const child = spawn2("/bin/sh", [scriptPath], {
     detached: true,
     stdio: "ignore"
@@ -1783,17 +1823,94 @@ function spawnUpdateScript(params) {
   child.unref();
   return scriptPath;
 }
+function spawnUpdateScript(params) {
+  fs9.mkdirSync(MYCO_GLOBAL_DIR, { recursive: true });
+  return spawnDetachedScript("myco-update", generateUpdateScript(params));
+}
+function generateRestartScript(params) {
+  const { projectRoot, vaultDir, runLocalUpdate, fromVersion, toVersion, mycoBinary } = params;
+  const quotedProjectRoot = JSON.stringify(projectRoot);
+  const quotedVaultDir = JSON.stringify(vaultDir);
+  const quotedMycoBinary = JSON.stringify(mycoBinary);
+  const reasonFile = JSON.stringify(path10.join(vaultDir, RESTART_REASON_FILENAME));
+  const reasonJson = JSON.stringify(JSON.stringify({
+    reason: "version_sync",
+    from_version: fromVersion,
+    to_version: toVersion,
+    local_update_ran: runLocalUpdate
+  }));
+  const updateBlock = runLocalUpdate ? `
+# Run local project update (hooks, symbionts, gitignore)
+"$MYCO" update --project ${quotedProjectRoot} || true` : "";
+  return `#!/bin/sh
+set -e
+MYCO=${quotedMycoBinary}
+
+# Wait for daemon to exit cleanly
+sleep ${UPDATE_SCRIPT_DELAY_SECONDS}
+${updateBlock}
+
+# Write restart reason for the new daemon to pick up
+echo ${reasonJson} > ${reasonFile}
+
+# Restart daemon
+"$MYCO" daemon --vault ${quotedVaultDir} &
+
+# Clean up this script
+rm -f "$0"
+`;
+}
+function spawnRestartScript(params) {
+  return spawnDetachedScript("myco-restart", generateRestartScript(params));
+}
 
 // src/daemon/api/update.ts
+import semver2 from "semver";
+import fs10 from "fs";
+import path11 from "path";
 var ChannelBodySchema = external_exports.object({
   channel: external_exports.enum(RELEASE_CHANNELS)
 });
 function createUpdateHandlers(deps) {
-  const { vaultDir, projectRoot, currentVersion, scheduleShutdown } = deps;
+  const { vaultDir, projectRoot, currentVersion, scheduleShutdown, globalPrefix } = deps;
+  let restartInitiated = false;
+  function isStampCurrent() {
+    try {
+      const stampPath = path11.join(vaultDir, UPDATE_STAMP_FILENAME);
+      const stamp = fs10.readFileSync(stampPath, "utf-8").trim();
+      return stamp === currentVersion;
+    } catch {
+      return false;
+    }
+  }
   async function handleUpdateStatus(_req) {
     if (isUpdateExempt()) {
       return { body: { exempt: true, running_version: currentVersion } };
     }
+    if (globalPrefix && !restartInitiated) {
+      const installedVersion = getInstalledVersion(globalPrefix);
+      if (installedVersion && semver2.valid(installedVersion) && semver2.valid(currentVersion) && semver2.gt(installedVersion, currentVersion)) {
+        restartInitiated = true;
+        const runLocalUpdate = !isStampCurrent();
+        spawnRestartScript({
+          projectRoot,
+          vaultDir,
+          runLocalUpdate,
+          fromVersion: currentVersion,
+          toVersion: installedVersion,
+          mycoBinary: resolveMycoBinary()
+        });
+        scheduleShutdown();
+        return {
+          body: {
+            restarting: true,
+            reason: "version_sync",
+            running_version: currentVersion,
+            installed_version: installedVersion
+          }
+        };
+      }
+    }
     const config = readUpdateConfig();
     const cache = readCachedCheck();
     if (isCacheStale(cache, config.check_interval_hours)) {
@@ -1837,7 +1954,12 @@ function createUpdateHandlers(deps) {
     if (!status || !status.update_available) {
       return { status: 400, body: { error: "no_update_available" } };
     }
-    spawnUpdateScript({ targetVersion: status.latest_version, projectRoot, vaultDir });
+    spawnUpdateScript({
+      targetVersion: status.latest_version,
+      projectRoot,
+      vaultDir,
+      mycoBinary: resolveMycoBinary()
+    });
     scheduleShutdown();
     return { body: { status: "applying", version: status.latest_version } };
   }
@@ -1878,8 +2000,8 @@ function createUpdateHandlers(deps) {
 }
 
 // src/daemon/backup.ts
-import fs10 from "fs";
-import path11 from "path";
+import fs11 from "fs";
+import path12 from "path";
 var BACKUP_TABLES = [
   "sessions",
   "prompt_batches",
@@ -1894,6 +2016,7 @@ var BACKUP_TABLES = [
   "team_members"
 ];
 var BACKUP_EXTENSION = ".sql";
+var BACKUP_FILENAME_PATTERN = /^[A-Za-z0-9_-]+\.sql$/;
 var BACKUP_HEADER_TEMPLATE = "-- Myco backup";
 function escapeSql(value) {
   return value.replace(/'/g, "''");
@@ -1905,7 +2028,7 @@ function toSqlLiteral(value) {
   return `'${escapeSql(String(value))}'`;
 }
 function createBackup(db, backupDir, machineId) {
-  fs10.mkdirSync(backupDir, { recursive: true });
+  fs11.mkdirSync(backupDir, { recursive: true });
   const lines = [];
   const timestamp = epochSeconds();
   lines.push(`${BACKUP_HEADER_TEMPLATE}: machine_id=${machineId}, created_at=${timestamp}`);
@@ -1923,22 +2046,22 @@ function createBackup(db, backupDir, machineId) {
     }
     lines.push("");
   }
-  const filePath = path11.join(backupDir, `${machineId}${BACKUP_EXTENSION}`);
-  fs10.writeFileSync(filePath, lines.join("\n"), "utf-8");
+  const filePath = path12.join(backupDir, `${machineId}${BACKUP_EXTENSION}`);
+  fs11.writeFileSync(filePath, lines.join("\n"), "utf-8");
   return filePath;
 }
 function listBackups(backupDir) {
   let entries;
   try {
-    entries = fs10.readdirSync(backupDir);
+    entries = fs11.readdirSync(backupDir);
   } catch {
     return [];
   }
   const backups = [];
   for (const entry of entries) {
-    if (!entry.endsWith(BACKUP_EXTENSION)) continue;
-    const filePath = path11.join(backupDir, entry);
-    const stat = fs10.statSync(filePath);
+    if (!BACKUP_FILENAME_PATTERN.test(entry)) continue;
+    const filePath = path12.join(backupDir, entry);
+    const stat = fs11.statSync(filePath);
     backups.push({
       machine_id: entry.slice(0, -BACKUP_EXTENSION.length),
       file_name: entry,
@@ -1950,7 +2073,7 @@ function listBackups(backupDir) {
 }
 var INSERT_REGEX = /^INSERT OR IGNORE INTO (\w+)\s+\(([^)]+)\)\s+VALUES\s+\((.+)\);$/;
 function parseBackupFile(backupPath) {
-  const content = fs10.readFileSync(backupPath, "utf-8");
+  const content = fs11.readFileSync(backupPath, "utf-8");
   const inserts = [];
   for (const line of content.split("\n")) {
     const match = INSERT_REGEX.exec(line);
@@ -2034,7 +2157,7 @@ function restoreBackup(db, backupPath) {
 }
 
 // src/daemon/api/backup.ts
-import path12 from "path";
+import path13 from "path";
 function createBackupHandlers(deps) {
   async function handleCreateBackup(_req) {
     const filePath = createBackup(deps.db, deps.backupDir, deps.machineId);
@@ -2093,7 +2216,7 @@ function createBackupConfigHandlers(deps) {
   const { vaultDir } = deps;
   async function handleGetBackupConfig() {
     const cfg = loadConfig(vaultDir);
-    return { body: { dir: cfg.backup.dir ?? null, default_dir: path12.resolve(vaultDir, "backups") } };
+    return { body: { dir: cfg.backup.dir ?? null, default_dir: path13.resolve(vaultDir, "backups") } };
   }
   async function handlePutBackupConfig(req) {
     const { dir } = req.body;
@@ -2104,12 +2227,14 @@ function createBackupConfigHandlers(deps) {
 }
 
 // src/daemon/team-sync.ts
-var TeamSyncClient = class {
+var TeamSyncClient = class _TeamSyncClient {
   workerUrl;
   apiKey;
   machineId;
   syncProtocolVersion;
   fetchFn;
+  mcpToken = null;
+  mcpTokenHash = null;
   constructor(options) {
     this.workerUrl = options.workerUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
@@ -2117,6 +2242,14 @@ var TeamSyncClient = class {
     this.syncProtocolVersion = options.syncProtocolVersion;
     this.fetchFn = options.fetch ?? globalThis.fetch;
   }
+  // Must match getMcpTokenHash() in src/worker/src/mcp/auth.ts
+  static hashToken(token) {
+    let hash = 0;
+    for (let i = 0; i < token.length; i++) {
+      hash = (hash << 5) - hash + token.charCodeAt(i) | 0;
+    }
+    return Math.abs(hash).toString(16).padStart(8, "0").slice(0, 8);
+  }
   /**
    * Register this machine with the team worker.
    */
@@ -2126,7 +2259,12 @@ var TeamSyncClient = class {
       machine_id: this.machineId,
       sync_protocol_version: this.syncProtocolVersion
     });
-    return res;
+    const response = res;
+    if (response.mcp_token) {
+      this.mcpToken = response.mcp_token;
+      this.mcpTokenHash = _TeamSyncClient.hashToken(response.mcp_token);
+    }
+    return response;
   }
   /**
    * Push a batch of outbox records to the team worker.
@@ -2192,7 +2330,14 @@ var TeamSyncClient = class {
       if (!res.ok) {
         throw new Error(`Health check failed: ${res.status} ${res.statusText}`);
       }
-      return await res.json();
+      const data = await res.json();
+      if (data.mcp_token_hash && data.mcp_token_hash !== this.mcpTokenHash) {
+        try {
+          await this.connect({ machine_id: this.machineId });
+        } catch {
+        }
+      }
+      return data;
     } finally {
       clearTimeout(timer);
     }
@@ -2205,6 +2350,22 @@ var TeamSyncClient = class {
     return res;
   }
   // ---------------------------------------------------------------------------
+  // MCP token accessors
+  // ---------------------------------------------------------------------------
+  getMcpToken() {
+    return this.mcpToken;
+  }
+  getMcpEndpoint() {
+    if (!this.mcpToken) return null;
+    return `${this.workerUrl}/mcp`;
+  }
+  async rotateMcpToken() {
+    const result = await this.request("POST", "/mcp/rotate");
+    this.mcpToken = result.token;
+    this.mcpTokenHash = _TeamSyncClient.hashToken(result.token);
+    return result.token;
+  }
+  // ---------------------------------------------------------------------------
   // Internal
   // ---------------------------------------------------------------------------
   headers() {
@@ -2213,15 +2374,15 @@ var TeamSyncClient = class {
       "Content-Type": "application/json"
     };
   }
-  async request(method, path21, body) {
-    const res = await this.fetchFn(`${this.workerUrl}${path21}`, {
+  async request(method, path22, body) {
+    const res = await this.fetchFn(`${this.workerUrl}${path22}`, {
       method,
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      throw new Error(`Team sync request ${method} ${path21} failed: ${res.status} ${text}`);
+      throw new Error(`Team sync request ${method} ${path22} failed: ${res.status} ${text}`);
     }
     return res.json();
   }
@@ -2229,7 +2390,7 @@ var TeamSyncClient = class {
 
 // src/daemon/api/team-connect.ts
 function createTeamHandlers(deps) {
-  const { vaultDir, machineId } = deps;
+  const { vaultDir, machineId, logger } = deps;
   async function handleConnect(req) {
     const { url, api_key } = req.body;
     if (!url || !api_key) {
@@ -2314,7 +2475,9 @@ function createTeamHandlers(deps) {
         deployed_worker_version: config.team.deployed_worker_version ?? null,
         worker_update_available: config.team.enabled ? config.team.deployed_worker_version !== getPluginVersion() : false,
         schema_version: SCHEMA_VERSION,
-        sync_protocol_version: SYNC_PROTOCOL_VERSION
+        sync_protocol_version: SYNC_PROTOCOL_VERSION,
+        mcp_token: client?.getMcpToken() ?? null,
+        mcp_endpoint: client?.getMcpEndpoint() ?? null
       }
     };
   }
@@ -2327,11 +2490,17 @@ function createTeamHandlers(deps) {
     return { body: { retried: count } };
   }
   async function handleUpgradeWorker(_req) {
-    const { upgradeWorker } = await import("./team-WHZW6IFU.js");
+    const { upgradeWorker } = await import("./team-2ZFGTSIN.js");
+    logger.info("team-sync.upgrade.start", "Starting worker upgrade");
     const result = upgradeWorker(vaultDir);
     if (!result.success) {
+      logger.error("team-sync.upgrade.failed", "Worker upgrade failed", { error: result.error });
       return { status: 500, body: { error: result.error } };
     }
+    logger.info("team-sync.upgrade.complete", "Worker upgrade complete", {
+      worker_url: result.worker_url,
+      version: result.version
+    });
     if (result.worker_url && deps.getTeamClient()) {
       const secrets = readSecrets(vaultDir);
       const apiKey = secrets[TEAM_API_KEY_SECRET];
@@ -2346,7 +2515,28 @@ function createTeamHandlers(deps) {
     }
     return { body: result };
   }
-  return { handleConnect, handleDisconnect, handleStatus, handleBackfill, handleRetryFailed, handleUpgradeWorker };
+  async function handleRotateMcpToken(_req) {
+    const client = deps.getTeamClient();
+    if (!client) {
+      return {
+        status: 400,
+        body: { error: "Team sync not connected" }
+      };
+    }
+    try {
+      const token = await client.rotateMcpToken();
+      logger.info("team-sync.mcp-token.rotated", "MCP access token rotated");
+      return { body: { token } };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      logger.error("team-sync.mcp-token.rotate-failed", "MCP token rotation failed", { error: message });
+      return {
+        status: 500,
+        body: { error: message }
+      };
+    }
+  }
+  return { handleConnect, handleDisconnect, handleStatus, handleBackfill, handleRetryFailed, handleUpgradeWorker, handleRotateMcpToken };
 }
 
 // src/daemon/api/session-lifecycle.ts
@@ -2426,8 +2616,8 @@ function createSessionLifecycleHandlers(deps) {
 }
 
 // src/daemon/api/skills.ts
-import fs11 from "fs";
-import path13 from "path";
+import fs12 from "fs";
+import path14 from "path";
 
 // src/db/queries/skill-usage.ts
 var USAGE_COLUMNS = [
@@ -2594,15 +2784,15 @@ function createSkillRecordDeleteHandler(deps) {
     if (result.body?.deleted) {
       const record = result.body;
       if (record.name) {
-        const projectRoot = path13.resolve(vaultDir, "..");
-        const skillDir = path13.resolve(projectRoot, ".agents", "skills", record.name);
+        const projectRoot = path14.resolve(vaultDir, "..");
+        const skillDir = path14.resolve(projectRoot, ".agents", "skills", record.name);
         try {
-          fs11.rmSync(skillDir, { recursive: true, force: true });
+          fs12.rmSync(skillDir, { recursive: true, force: true });
         } catch (err) {
           logger.warn(LOG_KINDS.PROCESSOR_BATCH, "Failed to remove skill directory", { name: record.name, error: String(err) });
         }
         try {
-          const { syncSkillSymlinks } = await import("./installer-45ZLP2RP.js");
+          const { syncSkillSymlinks } = await import("./installer-BWJED3ED.js");
           syncSkillSymlinks(projectRoot, record.name, { remove: true });
         } catch (err) {
           logger.warn(LOG_KINDS.PROCESSOR_BATCH, "Failed to remove skill symlinks", { name: record.name, error: String(err) });
@@ -2802,8 +2992,8 @@ async function handleGetProgress(tracker, token) {
 // src/daemon/api/models.ts
 var MODEL_LIST_TIMEOUT_MS = 5e3;
 var ANTHROPIC_MODELS = [
-  "claude-opus-4-6",
   "claude-sonnet-4-6",
+  "claude-opus-4-6",
   "claude-haiku-4-5-20251001"
 ];
 var EMBEDDING_PATTERNS = [
@@ -2855,12 +3045,12 @@ async function handleGetModels(req) {
 
 // src/daemon/api/stats.ts
 import { createHash as createHash2 } from "crypto";
-import fs12 from "fs";
-import path14 from "path";
+import fs13 from "fs";
+import path15 from "path";
 function computeConfigHash(vaultDir) {
   try {
-    const configPath = path14.join(vaultDir, CONFIG_FILENAME);
-    const raw = fs12.readFileSync(configPath, "utf-8");
+    const configPath = path15.join(vaultDir, CONFIG_FILENAME);
+    const raw = fs13.readFileSync(configPath, "utf-8");
     return createHash2("md5").update(raw).digest("hex");
   } catch {
     return "";
@@ -4772,17 +4962,17 @@ var SqliteRecordSource = class {
 };
 
 // src/daemon/database/manager.ts
-import fs14 from "fs";
+import fs15 from "fs";
 
 // src/db/queries/database.ts
-import fs13 from "fs";
+import fs14 from "fs";
 function pragmaScalar(name) {
   const db = getDatabase();
   return db.pragma(name, { simple: true });
 }
 function safeFileSize(filePath) {
   try {
-    return fs13.statSync(filePath).size;
+    return fs14.statSync(filePath).size;
   } catch (err) {
     if (err.code === "ENOENT") return 0;
     throw err;
@@ -5054,7 +5244,7 @@ var DatabaseMaintenanceManager = class {
   }
   async vacuum() {
     const size_before = this.fileSize();
-    const stats = await fs14.promises.statfs(this.vaultDir);
+    const stats = await fs15.promises.statfs(this.vaultDir);
     const free_bytes = Number(stats.bavail) * Number(stats.bsize);
     const required_bytes = size_before * VACUUM_FREE_SPACE_MULTIPLIER;
     if (free_bytes < required_bytes) {
@@ -5102,7 +5292,7 @@ var DatabaseMaintenanceManager = class {
   }
   fileSize() {
     try {
-      return fs14.statSync(this.dbPath).size;
+      return fs15.statSync(this.dbPath).size;
     } catch {
       return 0;
     }
@@ -5144,6 +5334,13 @@ function registerBuiltinDomains() {
       { id: "mycelium.spore.created", label: "New spore extracted", defaultMode: "summary", defaultLevel: "info" }
     ]
   });
+  register({
+    domain: "daemon",
+    label: "Daemon",
+    types: [
+      { id: "daemon.version_sync", label: "Version sync restart", defaultMode: "banner", defaultLevel: "info" }
+    ]
+  });
 }
 
 // src/daemon/api/notifications.ts
@@ -5406,13 +5603,16 @@ async function handleUpdateTaskConfig(req, vaultDir) {
 }
 
 // src/daemon/api/providers.ts
+var ANTHROPIC_MODELS_TIMEOUT_MS = 5e3;
+var ANTHROPIC_MODELS_CACHE_TTL_MS = 10 * 60 * 1e3;
+var anthropicModelsCache = null;
 var HTTP_OK2 = 200;
 var HTTP_BAD_REQUEST2 = 400;
 async function handleGetProviders() {
   const results = await Promise.allSettled([
+    detectAnthropic(),
     detectLocalProviderInfo("ollama", OllamaBackend.DEFAULT_BASE_URL),
-    detectLocalProviderInfo("lmstudio", LmStudioBackend.DEFAULT_BASE_URL),
-    detectCloud()
+    detectLocalProviderInfo("lmstudio", LmStudioBackend.DEFAULT_BASE_URL)
   ]);
   const providers = results.map(
     (r) => r.status === "fulfilled" ? r.value : { type: "unknown", available: false, models: [] }
@@ -5422,10 +5622,10 @@ async function handleGetProviders() {
 async function handleTestProvider(req) {
   const body = req.body;
   const type = body?.type;
-  if (!type || !["cloud", "ollama", "lmstudio"].includes(type)) {
+  if (!type || !["anthropic", "ollama", "lmstudio"].includes(type)) {
     return {
       status: HTTP_BAD_REQUEST2,
-      body: { error: "type is required and must be one of: cloud, ollama, lmstudio" }
+      body: { error: "type is required and must be one of: anthropic, ollama, lmstudio" }
     };
   }
   const baseUrl = body?.baseUrl;
@@ -5437,7 +5637,7 @@ async function handleTestProvider(req) {
     } else if (type === "lmstudio") {
       result = await testLocalProvider(new LmStudioBackend({ base_url: baseUrl }), "LM Studio", LmStudioBackend.DEFAULT_BASE_URL, baseUrl);
     } else {
-      result = testCloud();
+      result = testAnthropic();
     }
   } catch (err) {
     result = { ok: false, error: String(err) };
@@ -5449,11 +5649,30 @@ async function handleTestProvider(req) {
 }
 async function detectLocalProviderInfo(type, defaultBaseUrl) {
   const status = await checkLocalProvider(type);
-  const models = status.models.filter((m) => !/-ctx\d+/.test(m));
+  const variantFiltered = status.models.filter((m) => !/-ctx\d+/.test(m));
+  const models = filterLlmModels(variantFiltered);
   return { type, available: status.available, baseUrl: defaultBaseUrl, models };
 }
-async function detectCloud() {
-  return { type: "cloud", available: true, models: ANTHROPIC_MODELS };
+async function detectAnthropic() {
+  const now = Date.now();
+  if (anthropicModelsCache && now - anthropicModelsCache.ts < ANTHROPIC_MODELS_CACHE_TTL_MS) {
+    return { type: "anthropic", available: true, models: anthropicModelsCache.models };
+  }
+  let models = ANTHROPIC_MODELS;
+  try {
+    const client = new Anthropic();
+    const response = await client.models.list(
+      { limit: 50 },
+      { timeout: ANTHROPIC_MODELS_TIMEOUT_MS }
+    );
+    const liveModels = response.data.map((m) => m.id).filter((id) => id.startsWith("claude-"));
+    if (liveModels.length > 0) {
+      models = liveModels;
+    }
+  } catch {
+  }
+  anthropicModelsCache = { ts: now, models };
+  return { type: "anthropic", available: true, models };
 }
 async function testLocalProvider(backend, label, defaultBaseUrl, baseUrl) {
   const available = await backend.isAvailable();
@@ -5462,7 +5681,7 @@ async function testLocalProvider(backend, label, defaultBaseUrl, baseUrl) {
   }
   return { ok: true };
 }
-function testCloud() {
+function testAnthropic() {
   return { ok: true };
 }
 
@@ -5523,7 +5742,7 @@ async function registerScheduledTasks(powerManager, deps) {
     logger.info(LOG_KINDS.AGENT_RUN, "Scheduled agent tasks disabled globally (agent.scheduled_tasks_enabled: false)");
     return;
   }
-  const { loadAllTasks: loadAllTasks2 } = await import("./registry-SPKP2WLI.js");
+  const { loadAllTasks: loadAllTasks2 } = await import("./registry-O2NZLO3V.js");
   const allTasks = Array.from(loadAllTasks2(definitionsDir, vaultDir).values());
   const initialLastRuns = {};
   try {
@@ -5545,7 +5764,7 @@ async function registerScheduledTasks(powerManager, deps) {
       else runningTasks.delete(name);
     },
     runTask: async (taskName) => {
-      const { runAgent } = await import("./executor-YOKYS7OT.js");
+      const { runAgent } = await import("./executor-NSPRTH4M.js");
       const taskConfig = config.agent.tasks?.[taskName];
       const built = buildTaskInstruction(taskName, taskConfig?.params);
       if (isInstructionRequiredTask(taskName) && !built) {
@@ -5714,7 +5933,7 @@ function createMcpProxyHandlers(deps) {
       name: USER_AGENT_NAME,
       created_at: now
     });
-    const { insertResolutionEvent } = await import("./resolution-events-CLDXZF67.js");
+    const { insertResolutionEvent } = await import("./resolution-events-XWYLLDRK.js");
     const resolutionId = `res-${randomBytes(RESOLUTION_ID_RANDOM_BYTES).toString("hex")}`;
     insertResolutionEvent({
       id: resolutionId,
@@ -5806,12 +6025,21 @@ function createAgentRunHandlers(deps) {
   const { vaultDir, embeddingManager, logger } = deps;
   async function handleRun(req) {
     const { task, instruction: rawInstruction, agentId } = AgentRunBody.parse(req.body);
+    const mycoConfig = loadConfig(vaultDir);
+    if (!hasConfiguredProvider(mycoConfig, task)) {
+      return {
+        status: 400,
+        body: {
+          ok: false,
+          error: "No agent provider configured. Configure one in Settings."
+        }
+      };
+    }
     let instruction = rawInstruction;
     let runContext;
     if (task && !instruction) {
       let built;
       try {
-        const mycoConfig = loadConfig(vaultDir);
         const taskParams = mycoConfig.agent.tasks?.[task]?.params;
         built = buildTaskInstruction(task, taskParams);
       } catch {
@@ -5830,7 +6058,7 @@ function createAgentRunHandlers(deps) {
         };
       }
     }
-    const { runAgent } = await import("./executor-YOKYS7OT.js");
+    const { runAgent } = await import("./executor-NSPRTH4M.js");
     const resultPromise = runAgent(vaultDir, {
       task,
       instruction,
@@ -5899,8 +6127,8 @@ function createAgentRunHandlers(deps) {
 }
 
 // src/daemon/api/attachments.ts
-import fs15 from "fs";
-import path15 from "path";
+import fs16 from "fs";
+import path16 from "path";
 var ATTACHMENT_MEDIA_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -5920,14 +6148,14 @@ function createAttachmentHandler(deps) {
       const contentType2 = att.media_type ?? "application/octet-stream";
       return { status: 200, headers: { "Content-Type": contentType2 }, body: att.data };
     }
-    const filePath = path15.join(vaultDir, "attachments", filename);
+    const filePath = path16.join(vaultDir, "attachments", filename);
     let diskData;
     try {
-      diskData = fs15.readFileSync(filePath);
+      diskData = fs16.readFileSync(filePath);
     } catch {
       return { status: 404, body: { error: "not_found" } };
     }
-    const ext = path15.extname(filename).slice(1).toLowerCase();
+    const ext = path16.extname(filename).slice(1).toLowerCase();
     const contentType = ATTACHMENT_MEDIA_TYPES[ext] ?? "application/octet-stream";
     return { status: 200, headers: { "Content-Type": contentType }, body: diskData };
   }
@@ -5935,19 +6163,19 @@ function createAttachmentHandler(deps) {
 }
 
 // src/daemon/log-reconcile.ts
-import fs16 from "fs";
-import path16 from "path";
+import fs17 from "fs";
+import path17 from "path";
 function reconcileLogBuffer(logDir, sinceTimestamp) {
   let replayed = 0;
   const files = [];
   for (let i = 3; i >= 1; i--) {
-    const rotated = path16.join(logDir, `daemon.${i}.log`);
-    if (fs16.existsSync(rotated)) files.push(rotated);
+    const rotated = path17.join(logDir, `daemon.${i}.log`);
+    if (fs17.existsSync(rotated)) files.push(rotated);
   }
-  const current = path16.join(logDir, "daemon.log");
-  if (fs16.existsSync(current)) files.push(current);
+  const current = path17.join(logDir, "daemon.log");
+  if (fs17.existsSync(current)) files.push(current);
   for (const file of files) {
-    const content = fs16.readFileSync(file, "utf-8");
+    const content = fs17.readFileSync(file, "utf-8");
     for (const line of content.split("\n")) {
       if (!line.trim()) continue;
       try {
@@ -6226,8 +6454,8 @@ function registerPowerJobs(powerManager, deps) {
 }
 
 // src/daemon/reconciliation.ts
-import fs17 from "fs";
-import path17 from "path";
+import fs18 from "fs";
+import path18 from "path";
 
 // src/daemon/event-handlers.ts
 var TOOL_INPUT_STORE_LIMIT = 4e3;
@@ -6396,10 +6624,10 @@ function createReconciler({ bufferDir, logger }) {
   function reconcileSession(sessionId) {
     if (reconciledSessions.has(sessionId)) return;
     reconciledSessions.add(sessionId);
-    const bufferPath = path17.join(bufferDir, `${sessionId}.jsonl`);
+    const bufferPath = path18.join(bufferDir, `${sessionId}.jsonl`);
     let content;
     try {
-      content = fs17.readFileSync(bufferPath, "utf-8").trim();
+      content = fs18.readFileSync(bufferPath, "utf-8").trim();
     } catch {
       return;
     }
@@ -6468,7 +6696,7 @@ function createReconciler({ bufferDir, logger }) {
 }
 
 // src/daemon/stop-processing.ts
-import fs18 from "fs";
+import fs19 from "fs";
 
 // src/daemon/capture-images.ts
 var SESSION_SHORT_LEN = 6;
@@ -6574,14 +6802,14 @@ function createStopProcessor(deps) {
   const StopBody = external_exports.object({
     session_id: external_exports.string(),
     user: external_exports.string().optional(),
-    transcript_path: external_exports.string().optional(),
-    last_assistant_message: external_exports.string().optional()
+    transcript_path: external_exports.string().nullish(),
+    last_assistant_message: external_exports.string().nullish()
   });
   async function triggerTitleSummary(sessionId) {
     if (config.agent.summary_batch_interval <= 0) return;
     if (config.agent.event_tasks_enabled === false) return;
     try {
-      const { runAgent } = await import("./executor-YOKYS7OT.js");
+      const { runAgent } = await import("./executor-NSPRTH4M.js");
       runAgent(vaultDir, {
         task: "title-summary",
         instruction: `Process session ${sessionId} only`,
@@ -6671,7 +6899,7 @@ function createStopProcessor(deps) {
         let transcriptText = null;
         if (hookTranscriptPath) {
           try {
-            transcriptText = fs18.readFileSync(hookTranscriptPath, "utf-8");
+            transcriptText = fs19.readFileSync(hookTranscriptPath, "utf-8");
           } catch {
           }
         }
@@ -6736,11 +6964,18 @@ function createStopProcessor(deps) {
   }
   const handleStopRoute = async (req) => {
     const { session_id: sessionId, user, transcript_path: hookTranscriptPath, last_assistant_message: lastAssistantMessage } = StopBody.parse(req.body);
-    if (!registry.getSession(sessionId)) {
+    const existingSessionMeta = registry.getSession(sessionId);
+    if (!hookTranscriptPath && !existingSessionMeta) {
+      logger.info(LOG_KINDS.HOOKS_STOP, "Stop ignored \u2014 ephemeral sub-invocation", {
+        session_id: sessionId
+      });
+      return { body: { ok: true, ignored: "ephemeral-sub-invocation" } };
+    }
+    if (!existingSessionMeta) {
       registry.register(sessionId, { started_at: (/* @__PURE__ */ new Date()).toISOString() });
       logger.debug(LOG_KINDS.LIFECYCLE_AUTO_REGISTER, "Auto-registered session from stop event", { session_id: sessionId });
     }
-    const sessionMeta = registry.getSession(sessionId);
+    const sessionMeta = existingSessionMeta ?? registry.getSession(sessionId);
     logger.info(LOG_KINDS.HOOKS_STOP, "Stop received", {
       session_id: sessionId,
       has_transcript_path: !!hookTranscriptPath,
@@ -6751,7 +6986,9 @@ function createStopProcessor(deps) {
       transcript_path: hookTranscriptPath ?? null,
       last_message_preview: lastAssistantMessage?.slice(0, LOG_MESSAGE_PREVIEW_CHARS) ?? null
     });
-    const run = () => processStopEvent(sessionId, user, sessionMeta, hookTranscriptPath, lastAssistantMessage).catch((err) => {
+    const normalizedTranscriptPath = hookTranscriptPath ?? void 0;
+    const normalizedAssistantMessage = lastAssistantMessage ?? void 0;
+    const run = () => processStopEvent(sessionId, user, sessionMeta, normalizedTranscriptPath, normalizedAssistantMessage).catch((err) => {
       logger.error(LOG_KINDS.PROCESSOR_SESSION, "Stop processing failed", { session_id: sessionId, error: err.message });
     });
     const prev = activeStopProcessing ?? Promise.resolve();
@@ -6771,13 +7008,13 @@ function createStopProcessor(deps) {
 }
 
 // src/daemon/event-dispatch.ts
-import fs19 from "fs";
-import path19 from "path";
+import fs20 from "fs";
+import path20 from "path";
 
 // src/daemon/plan-capture.ts
 import { createHash as createHash4 } from "crypto";
 import os7 from "os";
-import path18 from "path";
+import path19 from "path";
 var FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
@@ -6790,11 +7027,11 @@ var FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
 var HEADING_REGEX = /^#\s+(.+)$/m;
 var PLAN_ID_HASH_LENGTH = 16;
 function isInPlanDirectory(filePath, watchDirs, projectRoot) {
-  const abs = path18.isAbsolute(filePath) ? filePath : path18.resolve(projectRoot, filePath);
+  const abs = path19.isAbsolute(filePath) ? filePath : path19.resolve(projectRoot, filePath);
   return watchDirs.some((dir) => {
-    const expanded = dir.startsWith("~/") ? path18.join(os7.homedir(), dir.slice(2)) : dir;
-    const absDir = path18.isAbsolute(expanded) ? expanded : path18.resolve(projectRoot, expanded);
-    const prefix = absDir.endsWith(path18.sep) ? absDir : absDir + path18.sep;
+    const expanded = dir.startsWith("~/") ? path19.join(os7.homedir(), dir.slice(2)) : dir;
+    const absDir = path19.isAbsolute(expanded) ? expanded : path19.resolve(projectRoot, expanded);
+    const prefix = absDir.endsWith(path19.sep) ? absDir : absDir + path19.sep;
     return abs === absDir || abs.startsWith(prefix);
   });
 }
@@ -6804,7 +7041,7 @@ function isPlanWriteEvent(toolName, toolInput, config) {
   if (typeof filePath !== "string") return null;
   if (!isInPlanDirectory(filePath, config.watchDirs, config.projectRoot)) return null;
   if (config.extensions?.length) {
-    const ext = path18.extname(filePath).toLowerCase();
+    const ext = path19.extname(filePath).toLowerCase();
     if (!config.extensions.includes(ext)) return null;
   }
   return filePath;
@@ -6818,7 +7055,7 @@ function capturePlan(input) {
   const now = Math.floor(Date.now() / 1e3);
   const contentHash = createHash4(CONTENT_HASH_ALGORITHM).update(input.content).digest("hex");
   const id = createHash4("md5").update(input.sourcePath).digest("hex").slice(0, PLAN_ID_HASH_LENGTH);
-  const title = parsePlanTitle(input.content, path18.basename(input.sourcePath));
+  const title = parsePlanTitle(input.content, path19.basename(input.sourcePath));
   return upsertPlan({
     id,
     title,
@@ -6872,7 +7109,7 @@ function createEventDispatcher(deps) {
       reconcileSession(event.session_id);
     }
     if (!sessionBuffers.has(event.session_id)) {
-      const bufferDir = path19.join(vaultDir, "buffer");
+      const bufferDir = path20.join(vaultDir, "buffer");
       sessionBuffers.set(event.session_id, new EventBuffer(bufferDir, event.session_id));
     }
     sessionBuffers.get(event.session_id).append(event);
@@ -6926,10 +7163,10 @@ function createEventDispatcher(deps) {
       );
       if (planFilePath) {
         const captureSessionId = event.session_id;
-        fs19.promises.readFile(planFilePath, "utf-8").then((planContent) => {
+        fs20.promises.readFile(planFilePath, "utf-8").then((planContent) => {
           const latestBatch = getLatestBatch(captureSessionId);
           capturePlan({
-            sourcePath: path19.relative(projectRoot, planFilePath),
+            sourcePath: path20.relative(projectRoot, planFilePath),
             content: planContent,
             sessionId: captureSessionId,
             promptBatchId: latestBatch?.id ?? null
@@ -7071,14 +7308,14 @@ function createEventDispatcher(deps) {
 }
 
 // src/daemon/main.ts
-import fs20 from "fs";
+import fs21 from "fs";
 import os8 from "os";
-import path20 from "path";
+import path21 from "path";
 function killStaleDaemon(vaultDir, logger) {
-  const daemonJsonPath = path20.join(vaultDir, "daemon.json");
+  const daemonJsonPath = path21.join(vaultDir, "daemon.json");
   try {
-    if (!fs20.existsSync(daemonJsonPath)) return;
-    const info = JSON.parse(fs20.readFileSync(daemonJsonPath, "utf-8"));
+    if (!fs21.existsSync(daemonJsonPath)) return;
+    const info = JSON.parse(fs21.readFileSync(daemonJsonPath, "utf-8"));
     if (!info.pid) return;
     if (info.pid === process.pid) return;
     try {
@@ -7087,7 +7324,7 @@ function killStaleDaemon(vaultDir, logger) {
       logger.info(LOG_KINDS.DAEMON_START, "Killed stale daemon", { pid: info.pid });
     } catch {
     }
-    fs20.unlinkSync(daemonJsonPath);
+    fs21.unlinkSync(daemonJsonPath);
   } catch {
   }
 }
@@ -7097,7 +7334,7 @@ async function main() {
     process.stderr.write("Usage: mycod --vault <path>\n");
     process.exit(1);
   }
-  const vaultDir = path20.resolve(vaultArg);
+  const vaultDir = path21.resolve(vaultArg);
   loadSecrets(vaultDir);
   const config = loadConfig(vaultDir);
   const manifests = loadManifests();
@@ -7108,7 +7345,7 @@ async function main() {
     projectRoot,
     extensions: config.capture.artifact_extensions
   };
-  const logger = new DaemonLogger(path20.join(vaultDir, "logs"), {
+  const logger = new DaemonLogger(path21.join(vaultDir, "logs"), {
     level: config.daemon.log_level
   });
   if (config.daemon.log_level === "debug") {
@@ -7122,10 +7359,63 @@ async function main() {
   logger.info(LOG_KINDS.CAPTURE_PLAN, "Plan watch directories", { dirs: planWatchConfig.watchDirs });
   const machineId = getMachineId(vaultDir);
   logger.info(LOG_KINDS.DAEMON_START, "Machine ID resolved", { machine_id: machineId });
+  let globalPrefix = null;
+  try {
+    globalPrefix = resolveGlobalPrefix();
+    logger.debug(LOG_KINDS.DAEMON_START, "npm global prefix resolved", { prefix: globalPrefix });
+  } catch (err) {
+    logger.warn(LOG_KINDS.DAEMON_START, "Failed to resolve npm global prefix", {
+      error: err.message
+    });
+  }
+  const devCliEntry = detectDevBuild(
+    globalPrefix,
+    process.argv[1],
+    fs21.realpathSync
+  );
+  if (devCliEntry) {
+    setDevBuildCliEntry(devCliEntry);
+    globalPrefix = null;
+    logger.info(LOG_KINDS.DAEMON_START, "Dev build detected; update checks exempted", {
+      cli_entry: devCliEntry
+    });
+  }
   const db = initDatabase(vaultDbPath(vaultDir));
   createSchema(db, machineId);
   registerBuiltinDomains();
   logger.info(LOG_KINDS.DAEMON_START, "SQLite initialized", { vault: vaultDir });
+  {
+    const reasonPath = path21.join(vaultDir, RESTART_REASON_FILENAME);
+    try {
+      if (fs21.existsSync(reasonPath)) {
+        const raw = JSON.parse(fs21.readFileSync(reasonPath, "utf-8"));
+        fs21.unlinkSync(reasonPath);
+        if (raw.reason === "version_sync" && raw.to_version) {
+          const message = raw.local_update_ran ? "Restarted and updated local project hooks." : "Restarted to pick up the latest version.";
+          notify(vaultDir, {
+            domain: "daemon",
+            type: "daemon.version_sync",
+            title: `Updated to v${raw.to_version}`,
+            message,
+            metadata: {
+              from_version: raw.from_version ?? "unknown",
+              to_version: raw.to_version,
+              local_update_ran: raw.local_update_ran ?? false
+            }
+          });
+          logger.info(LOG_KINDS.DAEMON_START, "Version sync restart detected", {
+            from: raw.from_version,
+            to: raw.to_version,
+            local_update: raw.local_update_ran
+          });
+        }
+      }
+    } catch (err) {
+      logger.warn(LOG_KINDS.DAEMON_START, "Failed to read restart-reason file", {
+        error: err.message
+      });
+    }
+  }
   initTeamContext(config.team.enabled, machineId);
   logger.setPersistFn((entry) => {
     const { timestamp, level, kind, component, message, ...rest } = entry;
@@ -7141,13 +7431,13 @@ async function main() {
   });
   const lastLogTimestamp = getMaxTimestamp();
   if (lastLogTimestamp) {
-    const logDir = path20.join(vaultDir, "logs");
+    const logDir = path21.join(vaultDir, "logs");
     const replayedCount = reconcileLogBuffer(logDir, lastLogTimestamp);
     if (replayedCount > 0) {
       logger.info(LOG_KINDS.DAEMON_RECONCILE, `Replayed ${replayedCount} log entries from buffer`, { replayed: replayedCount });
     }
   }
-  const vectorsDbPath = path20.join(vaultDir, "vectors.db");
+  const vectorsDbPath = path21.join(vaultDir, "vectors.db");
   const vectorStore = new SqliteVecVectorStore(vectorsDbPath);
   const llmProvider = createEmbeddingProvider(config.embedding);
   const embeddingProvider = new EmbeddingProviderAdapter(llmProvider, config.embedding);
@@ -7157,7 +7447,7 @@ async function main() {
   const databaseManager = new DatabaseMaintenanceManager(vaultDbPath(vaultDir), vaultDir, logger);
   let definitionsDir;
   try {
-    const { registerBuiltInAgentsAndTasks, resolveDefinitionsDir: resolveDefinitionsDir2 } = await import("./loader-J56KP27U.js");
+    const { registerBuiltInAgentsAndTasks, resolveDefinitionsDir: resolveDefinitionsDir2 } = await import("./loader-SKKUMT5C.js");
     definitionsDir = resolveDefinitionsDir2();
     await registerBuiltInAgentsAndTasks(definitionsDir, vaultDir);
     logger.info(LOG_KINDS.AGENT_TASK, "Built-in agents and tasks registered");
@@ -7183,10 +7473,10 @@ async function main() {
   }
   let uiDir = null;
   {
-    const root = findPackageRoot(path20.dirname(new URL(import.meta.url).pathname));
+    const root = findPackageRoot(path21.dirname(new URL(import.meta.url).pathname));
     if (root) {
-      const candidate = path20.join(root, "dist", "ui");
-      if (fs20.existsSync(candidate)) uiDir = candidate;
+      const candidate = path21.join(root, "dist", "ui");
+      if (fs21.existsSync(candidate)) uiDir = candidate;
     }
   }
   if (uiDir) {
@@ -7219,7 +7509,7 @@ async function main() {
       (p) => createPerProjectAdapter(p, claudeCodeAdapter.parseTurns)
     )
   });
-  const bufferDir = path20.join(vaultDir, "buffer");
+  const bufferDir = path21.join(vaultDir, "buffer");
   const sessionBuffers = /* @__PURE__ */ new Map();
   const reconciler = createReconciler({ bufferDir, logger });
   reconciler.runStartupReconciliation();
@@ -7305,11 +7595,12 @@ async function main() {
   server.registerRoute("POST", "/api/log", createLogIngestionHandler(logger));
   server.registerRoute("GET", "/api/models", async (req) => handleGetModels(req));
   server.registerRoute("POST", "/api/restart", async (req) => handleRestart({ vaultDir, progressTracker }, req.body));
-  const updateProjectRoot = path20.dirname(vaultDir);
+  const updateProjectRoot = path21.dirname(vaultDir);
   const updateHandlers = createUpdateHandlers({
     vaultDir,
     projectRoot: updateProjectRoot,
     currentVersion: server.version,
+    globalPrefix,
     scheduleShutdown: () => {
       setTimeout(() => {
         process.kill(process.pid, "SIGTERM");
@@ -7369,7 +7660,7 @@ async function main() {
   server.registerRoute("GET", "/api/mcp/sessions", mcpProxy.handleSessions);
   server.registerRoute("GET", "/api/mcp/team", mcpProxy.handleTeam);
   const rawBackupDir = config.backup.dir;
-  const backupDir = rawBackupDir ? path20.resolve(rawBackupDir.startsWith("~/") ? path20.join(os8.homedir(), rawBackupDir.slice(2)) : rawBackupDir) : path20.resolve(vaultDir, "backups");
+  const backupDir = rawBackupDir ? path21.resolve(rawBackupDir.startsWith("~/") ? path21.join(os8.homedir(), rawBackupDir.slice(2)) : rawBackupDir) : path21.resolve(vaultDir, "backups");
   const backupHandlers = createBackupHandlers({ db, backupDir, machineId });
   server.registerRoute("POST", "/api/backup", backupHandlers.handleCreateBackup);
   server.registerRoute("GET", "/api/backups", backupHandlers.handleListBackups);
@@ -7382,6 +7673,7 @@ async function main() {
   const teamHandlers = createTeamHandlers({
     vaultDir,
     machineId,
+    logger,
     getTeamClient: teamSync.getTeamClient,
     setTeamClient: teamSync.setTeamClient
   });
@@ -7391,6 +7683,7 @@ async function main() {
   server.registerRoute("POST", "/api/team/backfill", teamHandlers.handleBackfill);
   server.registerRoute("POST", "/api/team/retry-failed", teamHandlers.handleRetryFailed);
   server.registerRoute("POST", "/api/team/upgrade-worker", teamHandlers.handleUpgradeWorker);
+  server.registerRoute("POST", "/api/team/rotate-mcp-token", teamHandlers.handleRotateMcpToken);
   server.registerRoute("GET", "/api/search", createSearchHandler({ embeddingManager, getTeamClient: teamSync.getTeamClient, machineId }));
   server.registerRoute("GET", "/api/activity", handleGetFeed);
   server.registerRoute("GET", "/api/embedding/status", async () => handleGetEmbeddingStatus(vaultDir));
@@ -7463,4 +7756,4 @@ export {
   handleUserPrompt,
   main
 };
-//# sourceMappingURL=main-6DGPZXRF.js.map
+//# sourceMappingURL=main-6PY3ITQ5.js.map