@holdyourvoice/hyv 2.8.7 → 2.8.9

package/dist/index.js

@@ -973,7 +973,7 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path23 = require("node:path");
+    var path24 = require("node:path");
     var fs25 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -1916,10 +1916,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path23.resolve(baseDir, baseName);
+          const localBin = path24.resolve(baseDir, baseName);
           if (fs25.existsSync(localBin))
             return localBin;
-          if (sourceExt.includes(path23.extname(baseName)))
+          if (sourceExt.includes(path24.extname(baseName)))
             return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs25.existsSync(`${localBin}${ext}`)
@@ -1939,17 +1939,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path23.resolve(
-            path23.dirname(resolvedScriptPath),
+          executableDir = path24.resolve(
+            path24.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path23.basename(
+            const legacyName = path24.basename(
               this._scriptPath,
-              path23.extname(this._scriptPath)
+              path24.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1960,7 +1960,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path23.extname(executableFile));
+        launchWithNode = sourceExt.includes(path24.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2817,7 +2817,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path23.basename(filename, path23.extname(filename));
+        this._name = path24.basename(filename, path24.extname(filename));
         return this;
       }
       /**
@@ -2831,10 +2831,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path24) {
-        if (path24 === void 0)
+      executableDir(path25) {
+        if (path25 === void 0)
           return this._executableDir;
-        this._executableDir = path24;
+        this._executableDir = path25;
         return this;
       }
       /**
@@ -3934,15 +3934,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path23 = [graph[toModel].parent, toModel];
+      const path24 = [graph[toModel].parent, toModel];
       let fn = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path23.unshift(graph[cur].parent);
+        path24.unshift(graph[cur].parent);
         fn = link(conversions[graph[cur].parent][cur], fn);
         cur = graph[cur].parent;
       }
-      fn.conversion = path23;
+      fn.conversion = path24;
       return fn;
     }
     module2.exports = function(fromModel) {
@@ -4381,14 +4381,14 @@ var require_templates = __commonJS({
       }
       return results;
     }
-    function buildStyle(chalk31, styles) {
+    function buildStyle(chalk32, styles) {
       const enabled = {};
       for (const layer of styles) {
         for (const style of layer.styles) {
           enabled[style[0]] = layer.inverse ? null : style.slice(1);
         }
       }
-      let current = chalk31;
+      let current = chalk32;
       for (const [styleName, styles2] of Object.entries(enabled)) {
         if (!Array.isArray(styles2)) {
           continue;
@@ -4400,7 +4400,7 @@ var require_templates = __commonJS({
       }
       return current;
     }
-    module2.exports = (chalk31, temporary) => {
+    module2.exports = (chalk32, temporary) => {
       const styles = [];
       const chunks = [];
       let chunk = [];
@@ -4410,13 +4410,13 @@ var require_templates = __commonJS({
         } else if (style) {
           const string = chunk.join("");
           chunk = [];
-          chunks.push(styles.length === 0 ? string : buildStyle(chalk31, styles)(string));
+          chunks.push(styles.length === 0 ? string : buildStyle(chalk32, styles)(string));
           styles.push({ inverse, styles: parseStyle(style) });
         } else if (close) {
           if (styles.length === 0) {
             throw new Error("Found extraneous } in Chalk template literal");
           }
-          chunks.push(buildStyle(chalk31, styles)(chunk.join("")));
+          chunks.push(buildStyle(chalk32, styles)(chunk.join("")));
           chunk = [];
           styles.pop();
         } else {
@@ -4464,16 +4464,16 @@ var require_source = __commonJS({
       }
     };
     var chalkFactory = (options) => {
-      const chalk32 = {};
-      applyOptions(chalk32, options);
-      chalk32.template = (...arguments_) => chalkTag(chalk32.template, ...arguments_);
-      Object.setPrototypeOf(chalk32, Chalk.prototype);
-      Object.setPrototypeOf(chalk32.template, chalk32);
-      chalk32.template.constructor = () => {
+      const chalk33 = {};
+      applyOptions(chalk33, options);
+      chalk33.template = (...arguments_) => chalkTag(chalk33.template, ...arguments_);
+      Object.setPrototypeOf(chalk33, Chalk.prototype);
+      Object.setPrototypeOf(chalk33.template, chalk33);
+      chalk33.template.constructor = () => {
         throw new Error("`chalk.constructor()` is deprecated. Use `new chalk.Instance()` instead.");
       };
-      chalk32.template.Instance = ChalkClass;
-      return chalk32.template;
+      chalk33.template.Instance = ChalkClass;
+      return chalk33.template;
     };
     function Chalk(options) {
       return chalkFactory(options);
@@ -4584,7 +4584,7 @@ var require_source = __commonJS({
       return openAll + string + closeAll;
     };
     var template;
-    var chalkTag = (chalk32, ...strings) => {
+    var chalkTag = (chalk33, ...strings) => {
       const [firstString] = strings;
       if (!isArray(firstString) || !isArray(firstString.raw)) {
         return strings.join(" ");
@@ -4600,26 +4600,109 @@ var require_source = __commonJS({
       if (template === void 0) {
         template = require_templates();
       }
-      return template(chalk32, parts.join(""));
+      return template(chalk33, parts.join(""));
     };
     Object.defineProperties(Chalk.prototype, styles);
-    var chalk31 = Chalk();
-    chalk31.supportsColor = stdoutColor;
-    chalk31.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
-    chalk31.stderr.supportsColor = stderrColor;
-    module2.exports = chalk31;
+    var chalk32 = Chalk();
+    chalk32.supportsColor = stdoutColor;
+    chalk32.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
+    chalk32.stderr.supportsColor = stderrColor;
+    module2.exports = chalk32;
   }
 });
 
 // src/lib/config.ts
+function validateApiBase(raw) {
+  const trimmed = raw.replace(/\/$/, "");
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid HYV_API_URL: ${raw}`);
+  }
+  if (!ALLOWED_API_HOSTS.has(parsed.hostname)) {
+    throw new Error(`HYV_API_URL host not allowed: ${parsed.hostname}`);
+  }
+  if (parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.protocol !== "https:") {
+    throw new Error("HYV_API_URL must use https://");
+  }
+  return trimmed;
+}
+function cliApiUrl(apiPath) {
+  const p = apiPath.startsWith("/") ? apiPath : `/${apiPath}`;
+  return `${API_BASE}${p}`;
+}
+function assertSafeOpenUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error("Only https:// URLs can be opened");
+  }
+  if (!ALLOWED_API_HOSTS.has(parsed.hostname)) {
+    throw new Error(`URL host not allowed: ${parsed.hostname}`);
+  }
+  return url;
+}
+function assertSafeProfileName(name) {
+  const normalized = String(name || "").trim();
+  if (!normalized)
+    throw new Error("Profile name is required");
+  if (/[/\\]|\.\.|\u0000/.test(normalized)) {
+    throw new Error("Invalid profile name: use letters, numbers, hyphens, and underscores only");
+  }
+  if (!PROFILE_NAME_RE.test(normalized)) {
+    throw new Error("Invalid profile name: use letters, numbers, hyphens, and underscores only");
+  }
+  return normalized;
+}
+function profilePathForName(name) {
+  const safe = assertSafeProfileName(name);
+  ensureHyvDir();
+  const profilePath = path.resolve(PROFILES_DIR, `${safe}.md`);
+  const profilesRoot = path.resolve(PROFILES_DIR) + path.sep;
+  if (!profilePath.startsWith(profilesRoot)) {
+    throw new Error("Invalid profile name");
+  }
+  return profilePath;
+}
 function ensureHyvDir() {
   const dirs = [HYV_DIR, PROFILES_DIR, CACHE_DIR, QUEUE_DIR];
   for (const dir of dirs) {
     if (!fs.existsSync(dir)) {
       fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    } else {
+      try {
+        fs.chmodSync(dir, 448);
+      } catch {
+      }
     }
   }
 }
+function appendSecureLine(filePath, line, dir) {
+  if (dir) {
+    if (!fs.existsSync(dir))
+      fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    else {
+      try {
+        fs.chmodSync(dir, 448);
+      } catch {
+      }
+    }
+  }
+  if (!fs.existsSync(filePath)) {
+    fs.writeFileSync(filePath, line, { mode: 384 });
+    return;
+  }
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+  fs.appendFileSync(filePath, line);
+}
 function isInitialized() {
   return fs.existsSync(AUTH_FILE);
 }
@@ -4673,18 +4756,19 @@ function listCachedProfiles() {
   }
 }
 function readCachedProfile(name) {
-  const profilePath = path.join(PROFILES_DIR, `${name}.md`);
+  const profilePath = profilePathForName(name);
   try {
     if (!fs.existsSync(profilePath))
       return null;
     return fs.readFileSync(profilePath, "utf-8");
-  } catch {
+  } catch (err) {
+    if (err.message?.includes("Invalid profile name"))
+      throw err;
     return null;
   }
 }
 function writeCachedProfile(name, content) {
-  ensureHyvDir();
-  const profilePath = path.join(PROFILES_DIR, `${name}.md`);
+  const profilePath = profilePathForName(name);
   fs.writeFileSync(profilePath, content, { mode: 384 });
 }
 function getQueuedSignals() {
@@ -4704,7 +4788,7 @@ function queueSignal(signal) {
   ensureHyvDir();
   const id = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
   const filePath = path.join(QUEUE_DIR, `${id}.json`);
-  fs.writeFileSync(filePath, JSON.stringify(signal, null, 2));
+  fs.writeFileSync(filePath, JSON.stringify(signal, null, 2), { mode: 384 });
 }
 function saveLastEditSession(session) {
   ensureHyvDir();
@@ -4720,7 +4804,7 @@ function readLastEditSession() {
     return null;
   }
 }
-var fs, path, os, HYV_DIR, AUTH_FILE, CONFIG_FILE, PROFILES_DIR, CACHE_DIR, QUEUE_DIR, LAST_SESSION_FILE, API_BASE;
+var fs, path, os, HYV_DIR, AUTH_FILE, CONFIG_FILE, PROFILES_DIR, CACHE_DIR, QUEUE_DIR, LAST_SESSION_FILE, ALLOWED_API_HOSTS, API_BASE, PROFILE_NAME_RE;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
@@ -4734,7 +4818,15 @@ var init_config = __esm({
     CACHE_DIR = path.join(HYV_DIR, "cache");
     QUEUE_DIR = path.join(HYV_DIR, "queue");
     LAST_SESSION_FILE = path.join(HYV_DIR, "last-session.json");
-    API_BASE = process.env.HYV_API_URL || "https://holdyourvoice.com";
+    ALLOWED_API_HOSTS = /* @__PURE__ */ new Set([
+      "holdyourvoice.com",
+      "www.holdyourvoice.com",
+      "staging.holdyourvoice.com",
+      "localhost",
+      "127.0.0.1"
+    ]);
+    API_BASE = validateApiBase(process.env.HYV_API_URL || "https://holdyourvoice.com");
+    PROFILE_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
   }
 });
 
@@ -4825,13 +4917,13 @@ var require_define_lazy_prop = __commonJS({
 // node_modules/open/index.js
 var require_open = __commonJS({
   "node_modules/open/index.js"(exports2, module2) {
-    var path23 = require("path");
+    var path24 = require("path");
     var childProcess = require("child_process");
     var { promises: fs25, constants: fsConstants } = require("fs");
     var isWsl = require_is_wsl();
     var isDocker = require_is_docker();
     var defineLazyProperty = require_define_lazy_prop();
-    var localXdgOpenPath = path23.join(__dirname, "xdg-open");
+    var localXdgOpenPath = path24.join(__dirname, "xdg-open");
     var { platform, arch } = process;
     var hasContainerEnv = () => {
       try {
@@ -4988,14 +5080,14 @@ var require_open = __commonJS({
       }
       const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
       if (options.wait) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve14, reject) => {
           subprocess.once("error", reject);
           subprocess.once("close", (exitCode) => {
             if (!options.allowNonzeroExitCode && exitCode > 0) {
               reject(new Error(`Exited with code ${exitCode}`));
               return;
             }
-            resolve12(subprocess);
+            resolve14(subprocess);
           });
         });
       }
@@ -5077,6 +5169,108 @@ var require_open = __commonJS({
   }
 });
 
+// src/lib/version.ts
+function pkgRoot() {
+  const candidates = [
+    path2.resolve(__dirname, ".."),
+    // dist/ or src/lib/ → cli/
+    path2.resolve(__dirname, "..", "..")
+    // src/lib/ → cli/
+  ];
+  for (const root of candidates) {
+    if (fs2.existsSync(path2.join(root, "package.json")))
+      return root;
+  }
+  return path2.resolve(__dirname, "..");
+}
+function getCliVersion() {
+  try {
+    const pkg = JSON.parse(fs2.readFileSync(path2.join(PKG_ROOT, "package.json"), "utf-8"));
+    return pkg.version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function getRulesVersion() {
+  try {
+    if (fs2.existsSync(RULES_MANIFEST)) {
+      return JSON.parse(fs2.readFileSync(RULES_MANIFEST, "utf-8")).version || "unknown";
+    }
+  } catch {
+  }
+  return "unknown";
+}
+function getEngineLabel() {
+  return `hyv v${getCliVersion()} / rules v${getRulesVersion()}`;
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const da = pa[i] ?? 0;
+    const db = pb[i] ?? 0;
+    if (da > db)
+      return 1;
+    if (da < db)
+      return -1;
+  }
+  return 0;
+}
+function fetchLatestNpmVersion(timeoutMs = 8e3) {
+  return new Promise((resolve14) => {
+    (0, import_child_process.execFile)(
+      "npm",
+      ["view", "@holdyourvoice/hyv", "version"],
+      { timeout: timeoutMs, encoding: "utf-8" },
+      (err, stdout) => {
+        if (err || !stdout?.trim())
+          resolve14(null);
+        else
+          resolve14(stdout.trim());
+      }
+    );
+  });
+}
+var fs2, path2, import_child_process, PKG_ROOT, RULES_MANIFEST;
+var init_version = __esm({
+  "src/lib/version.ts"() {
+    "use strict";
+    fs2 = __toESM(require("fs"));
+    path2 = __toESM(require("path"));
+    import_child_process = require("child_process");
+    PKG_ROOT = pkgRoot();
+    RULES_MANIFEST = path2.join(PKG_ROOT, "assets", "detection-rules.json");
+  }
+});
+
+// src/lib/auth-refresh.ts
+function tokenExpiresAtMs(expiresAt) {
+  if (!expiresAt)
+    return null;
+  const ms = new Date(expiresAt).getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+function shouldRefreshToken(expiresAt, now = Date.now()) {
+  const expiresMs = tokenExpiresAtMs(expiresAt);
+  if (expiresMs === null)
+    return false;
+  return expiresMs <= now + REFRESH_LEAD_MS;
+}
+function isTokenExpired(expiresAt, now = Date.now()) {
+  const expiresMs = tokenExpiresAtMs(expiresAt);
+  if (expiresMs === null)
+    return false;
+  return expiresMs < now;
+}
+var REFRESH_LEAD_MS;
+var init_auth_refresh = __esm({
+  "src/lib/auth-refresh.ts"() {
+    "use strict";
+    REFRESH_LEAD_MS = 5 * 60 * 1e3;
+  }
+});
+
 // src/lib/auth.ts
 var auth_exports = {};
 __export(auth_exports, {
@@ -5084,10 +5278,20 @@ __export(auth_exports, {
   authenticateWithLicense: () => authenticateWithLicense,
   authenticatedRequest: () => authenticatedRequest,
   checkSession: () => checkSession,
-  refreshToken: () => refreshToken
+  getValidToken: () => getValidToken,
+  refreshToken: () => refreshToken,
+  verifyOAuthState: () => verifyOAuthState
 });
+function verifyOAuthState(received, expected) {
+  if (!received || !expected || received !== expected) {
+    throw new Error("OAuth state mismatch \u2014 possible CSRF attempt");
+  }
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 function request(url, options = {}) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve14, reject) => {
     const urlObj = new URL(url);
     const isHttps = urlObj.protocol === "https:";
     const client = isHttps ? https : http;
@@ -5098,7 +5302,7 @@ function request(url, options = {}) {
       method: options.method || "GET",
       headers: {
         "Content-Type": "application/json",
-        "User-Agent": "hyv-cli/2.3.1",
+        "User-Agent": `hyv-cli/${getCliVersion()}`,
         ...options.headers
       },
       timeout: options.timeout || 3e4
@@ -5108,9 +5312,9 @@ function request(url, options = {}) {
       res.on("data", (chunk) => data += chunk);
       res.on("end", () => {
         try {
-          resolve12({ status: res.statusCode || 0, data: JSON.parse(data) });
+          resolve14({ status: res.statusCode || 0, data: JSON.parse(data) });
         } catch {
-          resolve12({ status: res.statusCode || 0, data });
+          resolve14({ status: res.statusCode || 0, data });
         }
       });
     });
@@ -5125,8 +5329,21 @@ function request(url, options = {}) {
     req.end();
   });
 }
+async function getValidToken() {
+  const auth = readAuth();
+  if (!auth?.token)
+    return null;
+  if (shouldRefreshToken(auth.expires_at)) {
+    const ok = await refreshToken(auth.token);
+    if (ok)
+      return getToken();
+    if (isTokenExpired(auth.expires_at))
+      return null;
+  }
+  return auth.token;
+}
 async function authenticatedRequest(url, options = {}) {
-  const token = getToken();
+  const token = await getValidToken();
   if (!token) {
     throw new Error("Not authenticated. Run `hyv init` first.");
   }
@@ -5155,9 +5372,9 @@ async function authenticateWithLicense(licenseKey) {
 }
 async function authenticateWithBrowser() {
   const server = http.createServer();
-  const port = await new Promise((resolve12) => {
+  const port = await new Promise((resolve14) => {
     server.listen(0, "127.0.0.1", () => {
-      resolve12(server.address().port);
+      resolve14(server.address().port);
     });
   });
   const redirectUri = `http://127.0.0.1:${port}/callback`;
@@ -5169,10 +5386,14 @@ async function authenticateWithBrowser() {
     server.close();
     throw new Error("Failed to start authentication flow");
   }
-  const { auth_url } = response.data;
+  const { auth_url, state: expectedState } = response.data;
+  if (!expectedState) {
+    server.close();
+    throw new Error("Authentication server did not return OAuth state");
+  }
   console.log(import_chalk.default.cyan("\nOpening browser for authentication..."));
-  await (0, import_open.default)(auth_url);
-  const authData = await new Promise((resolve12, reject) => {
+  await (0, import_open.default)(assertSafeOpenUrl(auth_url));
+  const authData = await new Promise((resolve14, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new Error("Authentication timeout. Please try again."));
@@ -5190,6 +5411,16 @@ async function authenticateWithBrowser() {
           reject(new Error("Invalid callback parameters"));
           return;
         }
+        try {
+          verifyOAuthState(state, expectedState);
+        } catch (stateErr) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<h1>Authentication failed</h1><p>Invalid OAuth state.</p>");
+          clearTimeout(timeout);
+          server.close();
+          reject(stateErr);
+          return;
+        }
         try {
           const callbackResponse = await request(`${API_BASE}/cli/auth/callback`, {
             method: "POST",
@@ -5210,10 +5441,10 @@ async function authenticateWithBrowser() {
           `);
           clearTimeout(timeout);
           server.close();
-          resolve12(data);
+          resolve14(data);
         } catch (error) {
           res.writeHead(500, { "Content-Type": "text/html" });
-          res.end(`<h1>Authentication failed</h1><p>${error.message}</p>`);
+          res.end(`<h1>Authentication failed</h1><p>${escapeHtml(error.message)}</p>`);
           clearTimeout(timeout);
           server.close();
           reject(error);
@@ -5227,8 +5458,8 @@ async function authenticateWithBrowser() {
   writeAuth(authData);
   return authData;
 }
-async function refreshToken() {
-  const token = getToken();
+async function refreshToken(tokenOverride) {
+  const token = tokenOverride || readAuth()?.token;
   if (!token)
     return false;
   try {
@@ -5254,7 +5485,7 @@ async function refreshToken() {
   }
 }
 async function checkSession() {
-  const token = getToken();
+  const token = await getValidToken();
   if (!token)
     return { valid: false };
   try {
@@ -5280,6 +5511,8 @@ var init_auth = __esm({
     import_chalk = __toESM(require_source());
     import_open = __toESM(require_open());
     init_config();
+    init_version();
+    init_auth_refresh();
   }
 });
 
@@ -5413,25 +5646,23 @@ function recordEvent(event, meta) {
   if (!isTelemetryEnabled())
     return;
   try {
-    if (!fs2.existsSync(TELEMETRY_DIR))
-      fs2.mkdirSync(TELEMETRY_DIR, { recursive: true });
-    fs2.appendFileSync(TELEMETRY_FILE, JSON.stringify({
+    appendSecureLine(TELEMETRY_FILE, JSON.stringify({
       event,
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       ...meta
-    }) + "\n");
+    }) + "\n", TELEMETRY_DIR);
   } catch {
   }
 }
-var fs2, path2, os2, TELEMETRY_DIR, TELEMETRY_FILE;
+var path3, os2, TELEMETRY_DIR, TELEMETRY_FILE;
 var init_telemetry = __esm({
   "src/lib/telemetry.ts"() {
     "use strict";
-    fs2 = __toESM(require("fs"));
-    path2 = __toESM(require("path"));
+    path3 = __toESM(require("path"));
     os2 = __toESM(require("os"));
-    TELEMETRY_DIR = path2.join(os2.homedir(), ".hyv", "telemetry");
-    TELEMETRY_FILE = path2.join(TELEMETRY_DIR, "events.jsonl");
+    init_config();
+    TELEMETRY_DIR = path3.join(os2.homedir(), ".hyv", "telemetry");
+    TELEMETRY_FILE = path3.join(TELEMETRY_DIR, "events.jsonl");
   }
 });
 
@@ -5442,11 +5673,11 @@ __export(api_exports, {
   apiPost: () => apiPost,
   requireSubscription: () => requireSubscription
 });
-async function request2(method, path23, body) {
-  const token = getToken();
+async function request2(method, path24, body) {
+  const token = await getValidToken();
   if (!token)
     throw new Error("you're not signed in yet. run: hyv init");
-  const url = `${API_BASE}${path23}`;
+  const url = `${API_BASE}${path24}`;
   const opts = {
     method,
     headers: {
@@ -5471,11 +5702,11 @@ async function request2(method, path23, body) {
   }
   return res.json();
 }
-function apiGet(path23) {
-  return request2("GET", path23);
+function apiGet(path24) {
+  return request2("GET", path24);
 }
-function apiPost(path23, body) {
-  return request2("POST", path23, body);
+function apiPost(path24, body) {
+  return request2("POST", path24, body);
 }
 async function requireSubscription() {
   const { requirePaidFeature: requirePaidFeature2 } = await Promise.resolve().then(() => (init_access(), access_exports));
@@ -5485,6 +5716,7 @@ var init_api = __esm({
   "src/lib/api.ts"() {
     "use strict";
     init_config();
+    init_auth();
   }
 });
 
@@ -5679,7 +5911,7 @@ async function refreshInBackground(slug) {
   }
 }
 function getDiskCachePath(slug) {
-  return path3.join(DISK_CACHE_DIR, `${slug.replace(/[^a-z0-9-]/gi, "_")}.json`);
+  return path4.join(DISK_CACHE_DIR, `${slug.replace(/[^a-z0-9-]/gi, "_")}.json`);
 }
 function loadFromDiskCache(slug) {
   try {
@@ -5718,18 +5950,18 @@ function buildMinimalProfile(slug, body) {
     cadence: {}
   };
 }
-var fs3, path3, os3, CACHE_TTL, memoryCache, DISK_CACHE_DIR;
+var fs3, path4, os3, CACHE_TTL, memoryCache, DISK_CACHE_DIR;
 var init_profile = __esm({
   "src/lib/profile.ts"() {
     "use strict";
     init_api();
     init_config();
     fs3 = __toESM(require("fs"));
-    path3 = __toESM(require("path"));
+    path4 = __toESM(require("path"));
     os3 = __toESM(require("os"));
     CACHE_TTL = 5 * 60 * 1e3;
     memoryCache = /* @__PURE__ */ new Map();
-    DISK_CACHE_DIR = path3.join(os3.homedir(), ".hyv", "cache", "profiles");
+    DISK_CACHE_DIR = path4.join(os3.homedir(), ".hyv", "cache", "profiles");
   }
 });
 
@@ -5744,7 +5976,7 @@ __export(local_profile_exports, {
   loadProfileFromDiskCache: () => loadProfileFromDiskCache
 });
 function cachePathForSlug(slug) {
-  return path4.join(DISK_CACHE_DIR2, `${slug.replace(/[^a-z0-9-]/gi, "_")}.json`);
+  return path5.join(DISK_CACHE_DIR2, `${slug.replace(/[^a-z0-9-]/gi, "_")}.json`);
 }
 function loadProfileFromDiskCache(slug) {
   try {
@@ -5844,17 +6076,17 @@ function hasRichProfile(profile) {
     return false;
   return (profile.never_list?.length || 0) > 0 || (profile.learned_patterns?.length || 0) > 0 || (profile.drift_snapshot?.length || 0) > 0 || (profile.voice_rules?.length || 0) > 0;
 }
-var fs4, path4, os4, DISK_CACHE_DIR2;
+var fs4, path5, os4, DISK_CACHE_DIR2;
 var init_local_profile = __esm({
   "src/lib/local-profile.ts"() {
     "use strict";
     fs4 = __toESM(require("fs"));
-    path4 = __toESM(require("path"));
+    path5 = __toESM(require("path"));
     os4 = __toESM(require("os"));
     init_config();
     init_config();
     init_profile();
-    DISK_CACHE_DIR2 = path4.join(os4.homedir(), ".hyv", "cache", "profiles");
+    DISK_CACHE_DIR2 = path5.join(os4.homedir(), ".hyv", "cache", "profiles");
   }
 });
 
@@ -5946,19 +6178,19 @@ var init_profile_parse = __esm({
 function loadSupplementalPatterns() {
   const p = path8.join(CACHE_DIR, "supplemental-rules.json");
   try {
-    if (!fs8.existsSync(p))
+    if (!fs7.existsSync(p))
       return [];
-    const data = JSON.parse(fs8.readFileSync(p, "utf-8"));
+    const data = JSON.parse(fs7.readFileSync(p, "utf-8"));
     return Array.isArray(data.patterns) ? data.patterns : [];
   } catch {
     return [];
   }
 }
-var fs8, path8, BUNDLED_MANIFEST;
+var fs7, path8, BUNDLED_MANIFEST;
 var init_rules_loader = __esm({
   "src/lib/rules-loader.ts"() {
     "use strict";
-    fs8 = __toESM(require("fs"));
+    fs7 = __toESM(require("fs"));
     path8 = __toESM(require("path"));
     init_config();
     BUNDLED_MANIFEST = path8.resolve(__dirname, "..", "..", "assets", "detection-rules.json");
@@ -7047,7 +7279,7 @@ function runPipeline(text, profile, applyFixes = false) {
 }
 function readText(source) {
   const fs25 = require("fs");
-  const path23 = require("path");
+  const path24 = require("path");
   if (source === "-") {
     if (process.stdin.isTTY) {
       console.error("No input provided. Pipe content or specify a file.");
@@ -7055,7 +7287,7 @@ function readText(source) {
     }
     return { text: fs25.readFileSync(0, "utf-8"), path: "stdin" };
   }
-  const resolved = path23.resolve(source);
+  const resolved = path24.resolve(source);
   if (!fs25.existsSync(resolved)) {
     console.error(`File not found: ${resolved}`);
     process.exit(1);
@@ -10561,7 +10793,7 @@ var {
 } = import_index.default;
 
 // src/index.ts
-var import_chalk30 = __toESM(require_source());
+var import_chalk31 = __toESM(require_source());
 
 // src/commands/init.ts
 var import_chalk4 = __toESM(require_source());
@@ -10733,79 +10965,11 @@ init_config();
 init_auth();
 init_access();
 init_local_profile();
-
-// src/lib/version.ts
-var fs5 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
-var import_child_process = require("child_process");
-function pkgRoot() {
-  const candidates = [
-    path5.resolve(__dirname, ".."),
-    // dist/ or src/lib/ → cli/
-    path5.resolve(__dirname, "..", "..")
-    // src/lib/ → cli/
-  ];
-  for (const root of candidates) {
-    if (fs5.existsSync(path5.join(root, "package.json")))
-      return root;
-  }
-  return path5.resolve(__dirname, "..");
-}
-var PKG_ROOT = pkgRoot();
-var RULES_MANIFEST = path5.join(PKG_ROOT, "assets", "detection-rules.json");
-function getCliVersion() {
-  try {
-    const pkg = JSON.parse(fs5.readFileSync(path5.join(PKG_ROOT, "package.json"), "utf-8"));
-    return pkg.version || "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function getRulesVersion() {
-  try {
-    if (fs5.existsSync(RULES_MANIFEST)) {
-      return JSON.parse(fs5.readFileSync(RULES_MANIFEST, "utf-8")).version || "unknown";
-    }
-  } catch {
-  }
-  return "unknown";
-}
-function getEngineLabel() {
-  return `hyv v${getCliVersion()} / rules v${getRulesVersion()}`;
-}
-function compareSemver(a, b) {
-  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
-  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
-  const len = Math.max(pa.length, pb.length);
-  for (let i = 0; i < len; i++) {
-    const da = pa[i] ?? 0;
-    const db = pb[i] ?? 0;
-    if (da > db)
-      return 1;
-    if (da < db)
-      return -1;
-  }
-  return 0;
-}
-function fetchLatestNpmVersion(timeoutMs = 8e3) {
-  return new Promise((resolve12) => {
-    (0, import_child_process.execFile)(
-      "npm",
-      ["view", "@holdyourvoice/hyv", "version"],
-      { timeout: timeoutMs, encoding: "utf-8" },
-      (err, stdout) => {
-        if (err || !stdout?.trim())
-          resolve12(null);
-        else
-          resolve12(stdout.trim());
-      }
-    );
-  });
-}
+init_version();
 
 // src/lib/queue-sync.ts
 var import_chalk6 = __toESM(require_source());
-var fs6 = __toESM(require("fs"));
+var fs5 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 init_config();
 init_auth();
@@ -10815,34 +10979,34 @@ async function flushQueuedSignals() {
     return { sent: 0, failed: 0 };
   let sent = 0;
   let failed = 0;
-  if (!fs6.existsSync(QUEUE_DIR))
+  if (!fs5.existsSync(QUEUE_DIR))
     return { sent: 0, failed: 0 };
-  const files = fs6.readdirSync(QUEUE_DIR).filter((f) => f.endsWith(".json"));
+  const files = fs5.readdirSync(QUEUE_DIR).filter((f) => f.endsWith(".json"));
   for (const file of files) {
     const filePath = path6.join(QUEUE_DIR, file);
     try {
-      const signal = JSON.parse(fs6.readFileSync(filePath, "utf-8"));
+      const signal = JSON.parse(fs5.readFileSync(filePath, "utf-8"));
       let ok = false;
       if (signal.type === "reinforce") {
-        const res = await authenticatedRequest("https://holdyourvoice.com/cli/learning/reinforce", {
+        const res = await authenticatedRequest(cliApiUrl("/cli/learning/reinforce"), {
           method: "POST",
           body: {
             profile_id: signal.profile,
-            original_text: signal.report?.session?.original_path,
-            accepted_text: signal.report?.session?.accepted_path,
+            original_text: signal.original_text ?? signal.report?.original_text,
+            accepted_text: signal.accepted_text ?? signal.report?.accepted_text,
             signal_report: signal.report
           }
         });
         ok = res.status === 200;
       } else if (signal.type === "add_instruction") {
-        const res = await authenticatedRequest("https://holdyourvoice.com/cli/learning/add", {
+        const res = await authenticatedRequest(cliApiUrl("/cli/learning/add"), {
           method: "POST",
           body: { profile_id: signal.profile, instruction: signal.instruction }
         });
         ok = res.status === 200;
       }
       if (ok) {
-        fs6.unlinkSync(filePath);
+        fs5.unlinkSync(filePath);
         sent++;
       } else {
         failed++;
@@ -10971,7 +11135,7 @@ async function printEvolutionSummary(slug) {
     return;
   try {
     const res = await authenticatedRequest(
-      `https://holdyourvoice.com/cli/profiles/${encodeURIComponent(slug)}/evolution`,
+      cliApiUrl(`/cli/profiles/${encodeURIComponent(slug)}/evolution`),
       { method: "GET" }
     );
     if (res.status !== 200 || !res.data)
@@ -10999,7 +11163,7 @@ init_config();
 init_auth();
 init_access();
 init_profile();
-var fs7 = __toESM(require("fs"));
+var fs6 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 function registerSyncCommand(program3) {
   program3.command("sync").description("Sync profiles and rules from server").option("--force", "Force re-download even if cache is fresh").action(async (options) => {
@@ -11007,7 +11171,7 @@ function registerSyncCommand(program3) {
       await requirePaidFeature("profiles");
       console.log(import_chalk8.default.cyan("Syncing profiles and rules..."));
       const response = await authenticatedRequest(
-        "https://holdyourvoice.com/cli/sync",
+        cliApiUrl("/cli/sync"),
         { method: "GET" }
       );
       if (response.status !== 200) {
@@ -11023,12 +11187,12 @@ function registerSyncCommand(program3) {
         profileCount++;
       }
       const rulesPath = path7.join(CACHE_DIR, "rules.md");
-      fs7.writeFileSync(rulesPath, data.rules, { mode: 384 });
+      fs6.writeFileSync(rulesPath, data.rules, { mode: 384 });
       const promptPath = path7.join(CACHE_DIR, "prompt-template.md");
-      fs7.writeFileSync(promptPath, data.prompt_template, { mode: 384 });
+      fs6.writeFileSync(promptPath, data.prompt_template, { mode: 384 });
       if (data.detection_rules) {
         const rulesJson = path7.join(CACHE_DIR, "detection-rules.json");
-        fs7.writeFileSync(rulesJson, JSON.stringify(data.detection_rules, null, 2), { mode: 384 });
+        fs6.writeFileSync(rulesJson, JSON.stringify(data.detection_rules, null, 2), { mode: 384 });
       }
       for (const profile of data.profiles) {
         try {
@@ -11044,7 +11208,7 @@ function registerSyncCommand(program3) {
         console.log(import_chalk8.default.yellow(`  ! ${queueResult.failed} queued signal(s) could not send`));
       }
       const metaPath = path7.join(CACHE_DIR, "sync-meta.json");
-      fs7.writeFileSync(metaPath, JSON.stringify({
+      fs6.writeFileSync(metaPath, JSON.stringify({
         synced_at: data.synced_at,
         profile_count: profileCount,
         plan: data.plan
@@ -11120,7 +11284,7 @@ async function showProfileHistory(slug) {
     return;
   }
   try {
-    const res = await authenticatedRequest2(`https://holdyourvoice.com/cli/profiles/${encodeURIComponent(slug)}/evolution`, { method: "GET" });
+    const res = await authenticatedRequest2(cliApiUrl(`/cli/profiles/${encodeURIComponent(slug)}/evolution`), { method: "GET" });
     if (res.status !== 200) {
       console.log(import_chalk8.default.red("Could not load profile history."));
       return;
@@ -11149,12 +11313,12 @@ Profile evolution: ${slug}
 
 // src/commands/rewrite.ts
 var import_chalk9 = __toESM(require_source());
-var fs10 = __toESM(require("fs"));
+var fs9 = __toESM(require("fs"));
 var path10 = __toESM(require("path"));
 init_pipeline();
 
 // src/lib/prompt.ts
-var fs9 = __toESM(require("fs"));
+var fs8 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
 init_config();
 init_signals();
@@ -11162,8 +11326,8 @@ init_profile_parse();
 function loadPromptTemplate() {
   const templatePath = path9.join(CACHE_DIR, "prompt-template.md");
   try {
-    if (fs9.existsSync(templatePath)) {
-      return fs9.readFileSync(templatePath, "utf-8");
+    if (fs8.existsSync(templatePath)) {
+      return fs8.readFileSync(templatePath, "utf-8");
     }
   } catch {
   }
@@ -11229,10 +11393,10 @@ function loadProfile(name) {
     }
   }
   try {
-    if (!fs9.existsSync(PROFILES_DIR)) {
+    if (!fs8.existsSync(PROFILES_DIR)) {
       return null;
     }
-    const profiles = fs9.readdirSync(PROFILES_DIR).filter((f) => f.endsWith(".md"));
+    const profiles = fs8.readdirSync(PROFILES_DIR).filter((f) => f.endsWith(".md"));
     if (profiles.length > 0) {
       const defaultProfile = profiles[0].replace(".md", "");
       const content = readCachedProfile(defaultProfile);
@@ -11364,7 +11528,7 @@ Draft: ${draftPath}`));
       }
       if (options.output) {
         const outputPath = path10.resolve(options.output);
-        fs10.writeFileSync(outputPath, promptResult.prompt);
+        fs9.writeFileSync(outputPath, promptResult.prompt);
         console.log(import_chalk9.default.green(`
 \u2713 Prompt written to ${outputPath}`));
       } else {
@@ -11384,7 +11548,7 @@ Draft: ${draftPath}`));
 
 // src/commands/learning.ts
 var import_chalk10 = __toESM(require_source());
-var fs11 = __toESM(require("fs"));
+var fs10 = __toESM(require("fs"));
 var path11 = __toESM(require("path"));
 
 // src/lib/patterns.ts
@@ -11889,16 +12053,16 @@ function registerLearningCommands(program3) {
         }
         origPath = path11.resolve(original);
         editPath = path11.resolve(edited);
-        if (!fs11.existsSync(origPath)) {
+        if (!fs10.existsSync(origPath)) {
           console.error(import_chalk10.default.red(`Original file not found: ${origPath}`));
           process.exit(1);
         }
-        if (!fs11.existsSync(editPath)) {
+        if (!fs10.existsSync(editPath)) {
           console.error(import_chalk10.default.red(`Edited file not found: ${editPath}`));
           process.exit(1);
         }
-        origText = fs11.readFileSync(origPath, "utf-8");
-        editText = fs11.readFileSync(editPath, "utf-8");
+        origText = fs10.readFileSync(origPath, "utf-8");
+        editText = fs10.readFileSync(editPath, "utf-8");
         saveLastEditSession({
           original_path: origPath,
           edited_path: editPath,
@@ -11914,6 +12078,8 @@ function registerLearningCommands(program3) {
         queueSignal({
           type: "reinforce",
           profile: options.profile,
+          original_text: origText,
+          accepted_text: editText,
           report,
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         });
@@ -11927,6 +12093,8 @@ ${err.message}`));
           queueSignal({
             type: "reinforce",
             profile: options.profile,
+            original_text: origText,
+            accepted_text: editText,
             report,
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           });
@@ -11939,6 +12107,8 @@ ${err.message}`));
           queueSignal({
             type: "reinforce",
             profile: options.profile,
+            original_text: origText,
+            accepted_text: editText,
             report,
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           });
@@ -11946,7 +12116,7 @@ ${err.message}`));
         }
         console.log(import_chalk10.default.cyan("\nSending to server..."));
         const response = await authenticatedRequest(
-          "https://holdyourvoice.com/cli/learning/reinforce",
+          cliApiUrl("/cli/learning/reinforce"),
           {
             method: "POST",
             body: {
@@ -11968,6 +12138,8 @@ ${err.message}`));
           queueSignal({
             type: "reinforce",
             profile: options.profile,
+            original_text: origText,
+            accepted_text: editText,
             report,
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           });
@@ -11994,7 +12166,7 @@ ${err.message}`));
       }
       console.log(import_chalk10.default.cyan("Adding instruction..."));
       const response = await authenticatedRequest(
-        "https://holdyourvoice.com/cli/learning/add",
+        cliApiUrl("/cli/learning/add"),
         {
           method: "POST",
           body: {
@@ -12057,7 +12229,7 @@ function printProfileImpact(impact, data) {
 
 // src/commands/onboarding.ts
 var import_chalk11 = __toESM(require_source());
-var fs12 = __toESM(require("fs"));
+var fs11 = __toESM(require("fs"));
 var path12 = __toESM(require("path"));
 init_config();
 init_auth();
@@ -12133,6 +12305,7 @@ function extractStats(samples) {
 function registerOnboardingCommands(program3) {
   program3.command("new").description("Create a new voice profile").argument("<name>", "Profile name").option("--from-samples <dir>", "Create from writing samples").option("--from-llm", "Generate extraction prompt for LLM").action(async (name, options) => {
     try {
+      assertSafeProfileName(name);
       const token = getToken();
       if (options.fromSamples) {
         await createFromSamples(name, options.fromSamples, token);
@@ -12147,6 +12320,7 @@ Error: ${error.message}`));
       process.exit(1);
     }
   });
+  registerImportCommand(program3);
 }
 async function flashcardOnboarding(name, token) {
   const { printWelcome: printWelcome2 } = await Promise.resolve().then(() => (init_welcome(), welcome_exports));
@@ -12170,7 +12344,7 @@ Industry: ${industry}
   if (token) {
     console.log(import_chalk11.default.cyan("\nGenerating profile on server..."));
     const response = await authenticatedRequest(
-      "https://holdyourvoice.com/cli/profiles/new",
+      cliApiUrl("/cli/profiles/new"),
       {
         method: "POST",
         body: {
@@ -12207,20 +12381,20 @@ Industry: ${industry}
 }
 async function createFromSamples(name, sampleDir, token) {
   const dirPath = path12.resolve(sampleDir);
-  if (!fs12.existsSync(dirPath)) {
+  if (!fs11.existsSync(dirPath)) {
     throw new Error(`Directory not found: ${dirPath}`);
   }
   console.log(import_chalk11.default.bold(`
 Creating voice profile: ${name}`));
   console.log(import_chalk11.default.dim(`Reading samples from: ${dirPath}
 `));
-  const files = fs12.readdirSync(dirPath).filter((f) => f.endsWith(".md") || f.endsWith(".txt")).map((f) => path12.join(dirPath, f));
+  const files = fs11.readdirSync(dirPath).filter((f) => f.endsWith(".md") || f.endsWith(".txt")).map((f) => path12.join(dirPath, f));
   if (files.length === 0) {
     throw new Error("No .md or .txt files found in directory");
   }
   const samples = [];
   for (const file of files) {
-    const text = fs12.readFileSync(file, "utf-8");
+    const text = fs11.readFileSync(file, "utf-8");
     if (text.trim().length > 0) {
       samples.push({ path: file, text });
       console.log(import_chalk11.default.dim(`  \u2022 ${path12.basename(file)} (${words(text).length} words)`));
@@ -12240,7 +12414,7 @@ Stats extracted:`));
   if (token) {
     console.log(import_chalk11.default.cyan("\nGenerating profile on server..."));
     const response = await authenticatedRequest(
-      "https://holdyourvoice.com/cli/profiles/new",
+      cliApiUrl("/cli/profiles/new"),
       {
         method: "POST",
         body: {
@@ -12290,17 +12464,37 @@ hyv import ${name} <file.md>
 Or paste the profile content and I'll save it.`;
   console.log(prompt);
 }
+function registerImportCommand(program3) {
+  program3.command("import").description("Import a voice profile from file").argument("<name>", "Profile name").argument("<file>", "Profile markdown file").action(async (name, file) => {
+    try {
+      assertSafeProfileName(name);
+      const filePath = path12.resolve(file);
+      if (!fs11.existsSync(filePath)) {
+        console.error(import_chalk11.default.red(`File not found: ${filePath}`));
+        process.exit(1);
+      }
+      const content = fs11.readFileSync(filePath, "utf-8");
+      ensureHyvDir();
+      writeCachedProfile(name, content);
+      console.log(import_chalk11.default.green(`
+\u2713 Profile imported: ${name}`));
+    } catch (error) {
+      console.error(import_chalk11.default.red(`Error: ${error.message}`));
+      process.exit(1);
+    }
+  });
+}
 function askQuestion(question) {
-  return new Promise((resolve12) => {
-    const readline = require("readline");
-    const rl = readline.createInterface({
+  return new Promise((resolve14) => {
+    const readline2 = require("readline");
+    const rl = readline2.createInterface({
       input: process.stdin,
       output: process.stdout
     });
     rl.question(import_chalk11.default.cyan(`  ${question}
   > `), (answer) => {
       rl.close();
-      resolve12(answer.trim());
+      resolve14(answer.trim());
     });
   });
 }
@@ -12404,7 +12598,7 @@ Error: ${error.message}`));
 async function showPlan() {
   console.log(import_chalk12.default.bold("\nSubscription Plan\n"));
   const response = await authenticatedRequest(
-    "https://holdyourvoice.com/cli/heartbeat",
+    cliApiUrl("/cli/heartbeat"),
     { method: "GET" }
   );
   if (response.status !== 200) {
@@ -12448,7 +12642,7 @@ async function showPlan() {
 async function upgradePlan() {
   console.log(import_chalk12.default.cyan("\nOpening checkout...\n"));
   const response = await authenticatedRequest(
-    "https://holdyourvoice.com/cli/subscribe",
+    cliApiUrl("/cli/subscribe"),
     {
       method: "POST",
       body: { plan: "individual" }
@@ -12459,7 +12653,7 @@ async function upgradePlan() {
     const checkoutUrl = data.checkout_url;
     if (checkoutUrl) {
       console.log(import_chalk12.default.dim("Opening browser..."));
-      await (0, import_open2.default)(checkoutUrl);
+      await (0, import_open2.default)(assertSafeOpenUrl(checkoutUrl));
       console.log(import_chalk12.default.green("\n\u2713 Checkout opened in browser"));
       console.log(import_chalk12.default.dim("Complete the checkout to activate your plan."));
     } else {
@@ -12473,7 +12667,7 @@ async function upgradePlan() {
 async function openBillingPortal() {
   console.log(import_chalk12.default.cyan("\nOpening billing portal...\n"));
   const response = await authenticatedRequest(
-    "https://holdyourvoice.com/cli/subscribe/manage",
+    cliApiUrl("/cli/subscribe/manage"),
     { method: "POST" }
   );
   if (response.status === 200) {
@@ -12481,7 +12675,7 @@ async function openBillingPortal() {
     const portalUrl = data.portal_url;
     if (portalUrl) {
       console.log(import_chalk12.default.dim("Opening browser..."));
-      await (0, import_open2.default)(portalUrl);
+      await (0, import_open2.default)(assertSafeOpenUrl(portalUrl));
       console.log(import_chalk12.default.green("\n\u2713 Billing portal opened"));
     } else {
       console.log(import_chalk12.default.yellow("No portal URL received."));
@@ -12663,7 +12857,7 @@ async function runHybridAnalysis(text, profile, opts = {}) {
 
 // src/commands/history.ts
 var import_chalk14 = __toESM(require_source());
-var fs13 = __toESM(require("fs"));
+var fs12 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
 init_config();
 var HISTORY_DIR = path13.join(HYV_DIR, "history");
@@ -12671,17 +12865,15 @@ var HISTORY_FILE = path13.join(HISTORY_DIR, "scans.jsonl");
 function logScan(entry) {
   try {
     ensureHyvDir();
-    if (!fs13.existsSync(HISTORY_DIR))
-      fs13.mkdirSync(HISTORY_DIR, { recursive: true });
-    fs13.appendFileSync(HISTORY_FILE, JSON.stringify(entry) + "\n");
+    appendSecureLine(HISTORY_FILE, JSON.stringify(entry) + "\n", HISTORY_DIR);
   } catch {
   }
 }
 function readHistory() {
   try {
-    if (!fs13.existsSync(HISTORY_FILE))
+    if (!fs12.existsSync(HISTORY_FILE))
       return [];
-    const lines = fs13.readFileSync(HISTORY_FILE, "utf-8").trim().split("\n").filter(Boolean);
+    const lines = fs12.readFileSync(HISTORY_FILE, "utf-8").trim().split("\n").filter(Boolean);
     return lines.map((l) => JSON.parse(l));
   } catch {
     return [];
@@ -12713,8 +12905,8 @@ function registerHistoryCommand(program3) {
   program3.command("history").description("Show past scan scores and track improvement").option("--limit <n>", "Number of entries to show", "20").option("--file <path>", "Filter by file path").option("--since <date>", "Show entries since (e.g., 7d, 1m, 2024-01-01)").option("--chart", "Show ASCII sparkline chart").option("--clear", "Clear history").option("--format <type>", "Output format (text, json)", "text").action(async (options) => {
     try {
       if (options.clear) {
-        if (fs13.existsSync(HISTORY_FILE)) {
-          fs13.unlinkSync(HISTORY_FILE);
+        if (fs12.existsSync(HISTORY_FILE)) {
+          fs12.unlinkSync(HISTORY_FILE);
         }
         console.log(import_chalk14.default.green("\n\u2713 History cleared"));
         return;
@@ -12869,7 +13061,7 @@ hyv scan ${filePath}`));
         hasProfile: !!profile
       });
       if (options.failOnHit && signals.length > 0) {
-        process.exit(1);
+        process.exit(2);
       }
     } catch (error) {
       console.error(import_chalk15.default.red(`Error: ${error.message}`));
@@ -12881,14 +13073,141 @@ hyv scan ${filePath}`));
 // src/commands/doctor.ts
 var import_chalk16 = __toESM(require_source());
 var fs14 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var path15 = __toESM(require("path"));
 var os5 = __toESM(require("os"));
 init_config();
 init_auth();
 init_access();
 init_local_profile();
+init_version();
+
+// src/lib/mcp-stdio-test.ts
+var import_child_process2 = require("child_process");
+
+// src/lib/cli-entry.ts
+var fs13 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
+function resolveCliEntry() {
+  const candidates = [
+    path14.resolve(process.argv[1] || ""),
+    path14.resolve(__dirname, "index.js"),
+    path14.resolve(__dirname, "..", "dist", "index.js")
+  ];
+  return candidates.find((p) => p && fs13.existsSync(p)) || null;
+}
+function mcpServerCommand() {
+  const entry = resolveCliEntry();
+  if (entry) {
+    return { command: process.execPath, args: [entry, "mcp"] };
+  }
+  return { command: "hyv", args: ["mcp"] };
+}
+function mcpServerSnippet() {
+  const { command, args: args2 } = mcpServerCommand();
+  return JSON.stringify({ command, args: args2 }, null, 2);
+}
+
+// src/lib/mcp-stdio-test.ts
+async function testMcpStdioSubprocess() {
+  const entry = resolveCliEntry();
+  if (!entry)
+    return { ok: false };
+  return new Promise((resolve14) => {
+    const child = (0, import_child_process2.spawn)(process.execPath, [entry, "mcp"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, HYV_POSTINSTALL_QUIET: "1" }
+    });
+    let buffer = "";
+    let settled = false;
+    const finish = (ok, toolCount) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      try {
+        child.kill();
+      } catch {
+      }
+      resolve14({ ok, toolCount });
+    };
+    const timeout = setTimeout(() => finish(false), 1e4);
+    const handleLine = (line) => {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("{"))
+        return;
+      try {
+        const msg = JSON.parse(trimmed);
+        if (msg.id === 2 && Array.isArray(msg.result?.tools) && msg.result.tools.length > 0) {
+          finish(true, msg.result.tools.length);
+        }
+      } catch {
+      }
+    };
+    child.stdout.on("data", (chunk) => {
+      buffer += chunk.toString();
+      const lines = buffer.split("\n");
+      buffer = lines.pop() || "";
+      for (const line of lines)
+        handleLine(line);
+    });
+    child.on("error", () => finish(false));
+    child.on("exit", () => {
+      if (!settled) {
+        handleLine(buffer);
+        finish(buffer.includes("hyv_scan"));
+      }
+    });
+    setTimeout(() => {
+      const send2 = (payload) => {
+        child.stdin.write(`${JSON.stringify(payload)}
+`);
+      };
+      send2({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2024-11-05",
+          capabilities: {},
+          clientInfo: { name: "hyv-self-test", version: "1.0" }
+        }
+      });
+      send2({ jsonrpc: "2.0", method: "notifications/initialized" });
+      send2({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
+    }, 500);
+  });
+}
+
+// src/commands/doctor.ts
 var HOME = os5.homedir();
 var IS_WIN = process.platform === "win32";
+function claudeDesktopDir() {
+  if (IS_WIN)
+    return path15.join(HOME, "AppData", "Roaming", "Claude");
+  if (process.platform === "linux")
+    return path15.join(HOME, ".config", "Claude");
+  return path15.join(HOME, "Library", "Application Support", "Claude");
+}
+function isOwnerOnlyFile(filePath) {
+  try {
+    if (!fs14.existsSync(filePath))
+      return true;
+    const mode = fs14.statSync(filePath).mode & 511;
+    return (mode & 63) === 0;
+  } catch {
+    return false;
+  }
+}
+function readMcpHyv(configFile) {
+  try {
+    if (!fs14.existsSync(configFile))
+      return false;
+    const cfg = JSON.parse(fs14.readFileSync(configFile, "utf-8"));
+    return Boolean(cfg.mcpServers?.hyv);
+  } catch {
+    return false;
+  }
+}
 function registerDoctorCommand(program3) {
   program3.command("doctor").description("Diagnose CLI health: engine, cache, auth, agents").option("--fix-agents", "Re-run agent config copy (idempotent)").action(async (opts) => {
     console.log(import_chalk16.default.bold("\nhold your voice \u2014 doctor\n"));
@@ -12915,12 +13234,12 @@ function registerDoctorCommand(program3) {
       console.log(import_chalk16.default.green("  \u2713 .hyv directory exists"));
     } else {
       console.log(import_chalk16.default.yellow("  ! .hyv directory missing \u2014 creating..."));
-      fs14.mkdirSync(HYV_DIR, { recursive: true });
+      fs14.mkdirSync(HYV_DIR, { recursive: true, mode: 448 });
       fixed++;
     }
     console.log(import_chalk16.default.dim("checking cache..."));
     const diskProfiles = listDiskCachedProfiles();
-    const syncMeta = path14.join(CACHE_DIR, "sync-meta.json");
+    const syncMeta = path15.join(CACHE_DIR, "sync-meta.json");
     if (diskProfiles.length > 0 || fs14.existsSync(syncMeta)) {
       console.log(import_chalk16.default.green(`  \u2713 profile cache (${diskProfiles.length} full profile(s))`));
       if (fs14.existsSync(syncMeta)) {
@@ -12933,6 +13252,26 @@ function registerDoctorCommand(program3) {
     } else {
       console.log(import_chalk16.default.dim("  - no full profile cache (free local engine still works)"));
     }
+    console.log(import_chalk16.default.dim("checking file permissions..."));
+    if (fs14.existsSync(HYV_DIR)) {
+      const hyvMode = fs14.statSync(HYV_DIR).mode & 511;
+      if ((hyvMode & 63) === 0) {
+        console.log(import_chalk16.default.green("  \u2713 .hyv directory permissions"));
+      } else {
+        console.log(import_chalk16.default.yellow("  ! .hyv directory is world/group accessible"));
+        console.log(import_chalk16.default.dim("    run: chmod 700 ~/.hyv"));
+        issues++;
+      }
+    }
+    if (fs14.existsSync(AUTH_FILE)) {
+      if (isOwnerOnlyFile(AUTH_FILE)) {
+        console.log(import_chalk16.default.green("  \u2713 auth.json permissions"));
+      } else {
+        console.log(import_chalk16.default.yellow("  ! auth.json is world/group readable"));
+        console.log(import_chalk16.default.dim("    run: chmod 600 ~/.hyv/auth.json"));
+        issues++;
+      }
+    }
     console.log(import_chalk16.default.dim("checking authentication..."));
     if (isInitialized()) {
       const auth = readAuth();
@@ -12957,7 +13296,7 @@ function registerDoctorCommand(program3) {
       console.log(import_chalk16.default.dim("    run: hyv init for profiles + learning"));
     }
     console.log(import_chalk16.default.dim("checking voice profile..."));
-    const voiceMd = path14.join(HYV_DIR, "voice.md");
+    const voiceMd = path15.join(HYV_DIR, "voice.md");
     const hasVoiceMd = fs14.existsSync(voiceMd) && fs14.readFileSync(voiceMd, "utf-8").trim().length > 50;
     const profileFiles = fs14.existsSync(PROFILES_DIR) ? fs14.readdirSync(PROFILES_DIR).filter((f) => f.endsWith(".md") && f !== "voice.md") : [];
     if (hasVoiceMd || profileFiles.length > 0 || diskProfiles.length > 0) {
@@ -12972,15 +13311,24 @@ function registerDoctorCommand(program3) {
       console.log(import_chalk16.default.dim("    run: hyv new <name> or hyv init"));
     }
     console.log(import_chalk16.default.dim("checking agent configurations..."));
-    const cwd = process.cwd();
-    const agents = [
-      { name: "claude desktop", file: path14.join(IS_WIN ? path14.join(HOME, "AppData", "Roaming", "Claude") : path14.join(HOME, "Library", "Application Support", "Claude"), "claude_desktop_config.json") },
-      { name: "claude code", file: path14.join(HOME, ".claude", "commands", "hyv.md") },
-      { name: "cursor", file: path14.join(HOME, ".cursor", "rules", "hyv.md") },
-      { name: "codex (project)", file: path14.join(cwd, ".codex", "instructions.md") }
+    const cursorLegacyRule = path15.join(HOME, ".cursor", "rules", "hyv.md");
+    const cursorRule = path15.join(HOME, ".cursor", "rules", "hyv.mdc");
+    if (fs14.existsSync(cursorLegacyRule) && fs14.existsSync(cursorRule)) {
+      console.log(import_chalk16.default.yellow("  ! stale cursor rule ~/.cursor/rules/hyv.md (use hyv.mdc)"));
+      console.log(import_chalk16.default.dim("    run: rm ~/.cursor/rules/hyv.md  (or hyv doctor --fix-agents)"));
+      issues++;
+    }
+    const agentChecks = [
+      { name: "claude desktop mcp", ok: readMcpHyv(path15.join(claudeDesktopDir(), "claude_desktop_config.json")) },
+      { name: "cursor mcp", ok: readMcpHyv(path15.join(HOME, ".cursor", "mcp.json")) },
+      { name: "cursor rule", ok: fs14.existsSync(cursorRule) },
+      { name: "claude code command", ok: fs14.existsSync(path15.join(HOME, ".claude", "commands", "hyv.md")) },
+      { name: "claude code skill", ok: fs14.existsSync(path15.join(HOME, ".claude", "skills", "hold-your-voice", "SKILL.md")) },
+      { name: "codex agents", ok: fs14.existsSync(path15.join(HOME, ".codex", "AGENTS.md")) && fs14.readFileSync(path15.join(HOME, ".codex", "AGENTS.md"), "utf-8").includes("hyv") },
+      { name: "command code skill", ok: fs14.existsSync(path15.join(HOME, ".commandcode", "skills", "hyv", "SKILL.md")) }
     ];
-    for (const agent of agents) {
-      if (fs14.existsSync(agent.file)) {
+    for (const agent of agentChecks) {
+      if (agent.ok) {
         console.log(import_chalk16.default.green(`  \u2713 ${agent.name}`));
       } else {
         console.log(import_chalk16.default.dim(`  - ${agent.name} not configured`));
@@ -12988,35 +13336,45 @@ function registerDoctorCommand(program3) {
     }
     if (opts.fixAgents) {
       try {
-        const postinstall = path14.resolve(__dirname, "..", "..", "scripts", "postinstall.js");
-        if (fs14.existsSync(postinstall)) {
-          require(postinstall);
-          console.log(import_chalk16.default.green("  \u2713 re-ran postinstall agent setup"));
-          fixed++;
-        }
-      } catch {
-        console.log(import_chalk16.default.yellow("  ! could not re-run postinstall"));
+        const pkgDir = path15.resolve(__dirname, "..");
+        const { setupAgents } = require(path15.join(pkgDir, "scripts", "postinstall-lib.js"));
+        const result = setupAgents({ pkgDir, quiet: true });
+        console.log(import_chalk16.default.green(`  \u2713 re-ran agent setup (${result.configured.join(", ") || "no changes"})`));
+        if (result.warnings.length) {
+          console.log(import_chalk16.default.yellow(`    notes: ${result.warnings.join("; ")}`));
+        }
+        fixed++;
+      } catch (err) {
+        console.log(import_chalk16.default.yellow(`  ! could not re-run agent setup: ${err.message}`));
       }
     }
     console.log(import_chalk16.default.dim("checking mcp server..."));
-    const claudeConfigFile = path14.join(
-      IS_WIN ? path14.join(HOME, "AppData", "Roaming", "Claude") : path14.join(HOME, "Library", "Application Support", "Claude"),
-      "claude_desktop_config.json"
-    );
-    if (fs14.existsSync(claudeConfigFile)) {
-      try {
-        const cfg = JSON.parse(fs14.readFileSync(claudeConfigFile, "utf-8"));
-        if (cfg.mcpServers?.hyv) {
-          console.log(import_chalk16.default.green("  \u2713 mcp configured for claude desktop"));
-        } else {
-          console.log(import_chalk16.default.yellow("  ! mcp not configured \u2014 run: hyv init"));
-          issues++;
-        }
-      } catch {
-        console.log(import_chalk16.default.yellow("  ! could not read claude desktop config"));
-      }
+    const claudeMcp = readMcpHyv(path15.join(claudeDesktopDir(), "claude_desktop_config.json"));
+    const cursorMcp = readMcpHyv(path15.join(HOME, ".cursor", "mcp.json"));
+    if (claudeMcp || cursorMcp) {
+      if (claudeMcp)
+        console.log(import_chalk16.default.green("  \u2713 mcp configured for claude desktop"));
+      if (cursorMcp)
+        console.log(import_chalk16.default.green("  \u2713 mcp configured for cursor"));
     } else {
-      console.log(import_chalk16.default.dim("  - claude desktop not found"));
+      console.log(import_chalk16.default.yellow("  ! mcp not configured \u2014 run: hyv doctor --fix-agents or hyv mcp --setup"));
+      issues++;
+    }
+    try {
+      const stdio = await testMcpStdioSubprocess();
+      if (stdio.ok && (stdio.toolCount || 0) >= 10) {
+        console.log(import_chalk16.default.green(`  \u2713 mcp stdio subprocess healthy (${stdio.toolCount} tools)`));
+      } else if (stdio.ok) {
+        console.log(import_chalk16.default.yellow(`  ! mcp stdio ok but only ${stdio.toolCount || 0} tools`));
+        issues++;
+      } else {
+        console.log(import_chalk16.default.red("  \u2717 mcp stdio subprocess failed"));
+        console.log(import_chalk16.default.dim("    run: hyv mcp --test"));
+        issues++;
+      }
+    } catch (err) {
+      console.log(import_chalk16.default.red(`  \u2717 mcp stdio probe failed: ${err.message}`));
+      issues++;
     }
     console.log("");
     if (issues === 0 && fixed === 0) {
@@ -13065,7 +13423,7 @@ function registerRenameCommand(program3) {
         return;
       }
       const response = await authenticatedRequest(
-        "https://holdyourvoice.com/cli/profiles/rename",
+        cliApiUrl("/cli/profiles/rename"),
         {
           method: "POST",
           body: {
@@ -13094,15 +13452,51 @@ error: ${error.message}
 }
 
 // src/commands/fix.ts
-var import_chalk18 = __toESM(require_source());
-var fs15 = __toESM(require("fs"));
-var path15 = __toESM(require("path"));
+var import_chalk19 = __toESM(require_source());
 init_pipeline();
 init_local_profile();
 init_access();
 init_config();
+
+// src/lib/destructive-write.ts
+var fs15 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
+var readline = __toESM(require("readline"));
+var import_chalk18 = __toESM(require_source());
+async function confirmDestructiveWrite(options) {
+  if (options.yes)
+    return true;
+  const label = options.target ? `${options.action} (${options.target})` : options.action;
+  if (!process.stdin.isTTY) {
+    console.error(import_chalk18.default.red("\nRefusing destructive write without confirmation (non-interactive)."));
+    console.error(import_chalk18.default.dim("  Re-run with --yes to create .bak backups and proceed.\n"));
+    return false;
+  }
+  const question = `
+${label}
+A .bak backup will be created. Proceed? [y/N] `;
+  const answer = await new Promise((resolve14) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (value) => {
+      rl.close();
+      resolve14(value.trim().toLowerCase());
+    });
+  });
+  return answer === "y" || answer === "yes";
+}
+function writeInPlaceWithBackup(filePath, content) {
+  const backupPath = filePath + ".bak";
+  fs15.copyFileSync(filePath, backupPath);
+  fs15.writeFileSync(filePath, content);
+  return backupPath;
+}
+function backupBasename(filePath) {
+  return path16.basename(filePath) + ".bak";
+}
+
+// src/commands/fix.ts
 function registerFixCommand(program3) {
-  program3.command("fix").description("Apply auto-fixes (word swaps, connector removals) without an LLM").argument("<file>", "File to fix (or - for stdin)").option("--dry-run", "Show changes without writing").option("-i, --in-place", "Write fixes back to the file").option("--profile <name>", "Voice profile for never-list checks").option("--ignore <rules>", "Comma-separated rule IDs to skip").option("--format <type>", "Output format (text or json)", "text").action(async (file, options) => {
+  program3.command("fix").description("Apply auto-fixes (word swaps, connector removals) without an LLM").argument("<file>", "File to fix (or - for stdin)").option("--dry-run", "Show changes without writing").option("-i, --in-place", "Write fixes back to the file").option("-y, --yes", "Confirm in-place write without prompting (creates .bak backup)").option("--profile <name>", "Voice profile for never-list checks").option("--ignore <rules>", "Comma-separated rule IDs to skip").option("--format <type>", "Output format (text or json)", "text").action(async (file, options) => {
     try {
       const profile = await loadProfileForCommand(options.profile);
       const { text, path: filePath } = readText(file);
@@ -13111,9 +13505,9 @@ function registerFixCommand(program3) {
         if (options.format === "json") {
           console.log(JSON.stringify({ file: filePath, autoFixes: 0, llmIssues: result.stats.needsLLM, changes: [] }));
         } else {
-          console.log(import_chalk18.default.green("\n\u2713 No auto-fixable issues found."));
+          console.log(import_chalk19.default.green("\n\u2713 No auto-fixable issues found."));
           if (result.stats.needsLLM > 0) {
-            console.log(import_chalk18.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite \u2014 run: hyv rewrite ${file}`));
+            console.log(import_chalk19.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite \u2014 run: hyv rewrite ${file}`));
           }
         }
         return;
@@ -13127,24 +13521,30 @@ function registerFixCommand(program3) {
           fixed: options.dryRun ? void 0 : result.fixed
         }, null, 2));
       } else {
-        console.log(import_chalk18.default.dim(`
+        console.log(import_chalk19.default.dim(`
 hyv fix ${filePath}
 `));
         for (const change of result.changes) {
-          console.log(import_chalk18.default.dim(`  Line ${change.line}: `) + import_chalk18.default.red(change.before) + import_chalk18.default.dim(" \u2192 ") + import_chalk18.default.green(change.after));
+          console.log(import_chalk19.default.dim(`  Line ${change.line}: `) + import_chalk19.default.red(change.before) + import_chalk19.default.dim(" \u2192 ") + import_chalk19.default.green(change.after));
         }
-        console.log(import_chalk18.default.green(`
+        console.log(import_chalk19.default.green(`
   \u2713 ${result.changes.length} auto-fix${result.changes.length === 1 ? "" : "es"} applied`));
         if (result.stats.needsLLM > 0) {
-          console.log(import_chalk18.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite \u2014 run: hyv rewrite ${file}`));
+          console.log(import_chalk19.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite \u2014 run: hyv rewrite ${file}`));
         }
       }
       if (!options.dryRun) {
         if (options.inPlace && filePath !== "stdin") {
-          const backupPath = filePath + ".bak";
-          fs15.copyFileSync(filePath, backupPath);
-          fs15.writeFileSync(filePath, result.fixed);
-          console.log(import_chalk18.default.dim(`  Written to ${filePath} (backup: ${path15.basename(backupPath)})`));
+          const confirmed = await confirmDestructiveWrite({
+            yes: options.yes,
+            action: "Apply auto-fixes in-place",
+            target: filePath
+          });
+          if (!confirmed) {
+            process.exit(1);
+          }
+          const backupPath = writeInPlaceWithBackup(filePath, result.fixed);
+          console.log(import_chalk19.default.dim(`  Written to ${filePath} (backup: ${backupBasename(filePath)})`));
           saveLastEditSession({
             original_path: filePath,
             edited_path: filePath,
@@ -13152,7 +13552,7 @@ hyv fix ${filePath}
             edited_text: result.fixed,
             profile: options.profile
           });
-          console.log(import_chalk18.default.dim("  Tip: hyv reinforce --last to teach your profile from this edit"));
+          console.log(import_chalk19.default.dim("  Tip: hyv reinforce --last to teach your profile from this edit"));
         } else if (filePath === "stdin" || !options.inPlace) {
           process.stdout.write("\n" + result.fixed + "\n");
           if (filePath !== "stdin") {
@@ -13168,14 +13568,14 @@ hyv fix ${filePath}
       }
       await maybeShowLimitedModeHint(!!profile);
     } catch (error) {
-      console.error(import_chalk18.default.red(`Error: ${error.message}`));
+      console.error(import_chalk19.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/check.ts
-var import_chalk19 = __toESM(require_source());
+var import_chalk20 = __toESM(require_source());
 init_pipeline();
 init_local_profile();
 init_access();
@@ -13187,18 +13587,18 @@ function registerCheckCommand(program3) {
       if (text === "-") {
         const fs26 = require("fs");
         if (process.stdin.isTTY) {
-          console.error(import_chalk19.default.red("No input provided. Pipe content or pass text as argument."));
+          console.error(import_chalk20.default.red("No input provided. Pipe content or pass text as argument."));
           process.exit(1);
         }
         inputText = fs26.readFileSync(0, "utf-8");
       }
       if (!inputText.trim()) {
-        console.error(import_chalk19.default.red("No text provided."));
+        console.error(import_chalk20.default.red("No text provided."));
         process.exit(1);
       }
       const fs25 = require("fs");
       if (text !== "-" && fs25.existsSync(text)) {
-        console.log(import_chalk19.default.yellow(`"${text}" looks like a file. Did you mean: hyv scan ${text}`));
+        console.log(import_chalk20.default.yellow(`"${text}" looks like a file. Did you mean: hyv scan ${text}`));
         process.exit(1);
       }
       const result = runPipeline(inputText, profile, false);
@@ -13222,30 +13622,30 @@ function registerCheckCommand(program3) {
         }, null, 2));
       } else {
         if (result.stats.totalSignals === 0) {
-          console.log(import_chalk19.default.green("\n\u2713 Clean \u2014 no AI patterns found."));
-          console.log(import_chalk19.default.dim(`  score: ${result.score}/100`));
+          console.log(import_chalk20.default.green("\n\u2713 Clean \u2014 no AI patterns found."));
+          console.log(import_chalk20.default.dim(`  score: ${result.score}/100`));
         } else {
           console.log("");
           printGroupedSignals(result.signalMap.signals.slice(0, 15), profile);
           if (result.signalMap.signals.length > 15) {
-            console.log(import_chalk19.default.dim(`  ... and ${result.signalMap.signals.length - 15} more`));
+            console.log(import_chalk20.default.dim(`  ... and ${result.signalMap.signals.length - 15} more`));
           }
-          console.log(import_chalk19.default.yellow(`
+          console.log(import_chalk20.default.yellow(`
   ${result.stats.totalSignals} issues (${result.stats.red} red, ${result.stats.yellow} yellow)`));
-          console.log(import_chalk19.default.dim(`  score: ${result.score}/100`));
+          console.log(import_chalk20.default.dim(`  score: ${result.score}/100`));
         }
         await maybeShowLimitedModeHint(!!profile);
       }
       process.exit(result.stats.totalSignals > 0 ? 1 : 0);
     } catch (error) {
-      console.error(import_chalk19.default.red(`Error: ${error.message}`));
+      console.error(import_chalk20.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/score.ts
-var import_chalk20 = __toESM(require_source());
+var import_chalk21 = __toESM(require_source());
 init_pipeline();
 init_local_profile();
 function registerScoreCommand(program3) {
@@ -13270,14 +13670,14 @@ function registerScoreCommand(program3) {
         process.exit(1);
       }
     } catch (error) {
-      console.error(import_chalk20.default.red(`Error: ${error.message}`));
+      console.error(import_chalk21.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/diff.ts
-var import_chalk21 = __toESM(require_source());
+var import_chalk22 = __toESM(require_source());
 init_pipeline();
 init_local_profile();
 function registerDiffCommand(program3) {
@@ -13287,9 +13687,9 @@ function registerDiffCommand(program3) {
       const { text, path: filePath } = readText(file);
       const result = runPipeline(text, profile, true);
       if (result.changes.length === 0) {
-        console.log(import_chalk21.default.green("\n\u2713 No auto-fixable changes."));
+        console.log(import_chalk22.default.green("\n\u2713 No auto-fixable changes."));
         if (result.stats.needsLLM > 0) {
-          console.log(import_chalk21.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite`));
+          console.log(import_chalk22.default.dim(`  ${result.stats.needsLLM} issues need LLM rewrite`));
         }
         return;
       }
@@ -13304,42 +13704,42 @@ function registerDiffCommand(program3) {
       const originalLines = text.split("\n");
       const fixedLines = result.fixed.split("\n");
       const contextN = parseInt(options.context, 10);
-      console.log(import_chalk21.default.dim(`--- ${filePath}`));
-      console.log(import_chalk21.default.dim(`+++ ${filePath} (fixed)`));
+      console.log(import_chalk22.default.dim(`--- ${filePath}`));
+      console.log(import_chalk22.default.dim(`+++ ${filePath} (fixed)`));
       for (const change of result.changes) {
         const lineIdx = change.line - 1;
         const start = Math.max(0, lineIdx - contextN);
         const end = Math.min(originalLines.length, lineIdx + contextN + 1);
-        console.log(import_chalk21.default.dim(`@@ -${start + 1},${end - start} +${start + 1},${end - start} @@`));
+        console.log(import_chalk22.default.dim(`@@ -${start + 1},${end - start} +${start + 1},${end - start} @@`));
         for (let i = start; i < end; i++) {
           if (i === lineIdx) {
-            console.log(import_chalk21.default.red(`-${originalLines[i]}`));
-            console.log(import_chalk21.default.green(`+${fixedLines[i]}`));
+            console.log(import_chalk22.default.red(`-${originalLines[i]}`));
+            console.log(import_chalk22.default.green(`+${fixedLines[i]}`));
           } else {
-            console.log(import_chalk21.default.dim(` ${originalLines[i]}`));
+            console.log(import_chalk22.default.dim(` ${originalLines[i]}`));
           }
         }
       }
-      console.log(import_chalk21.default.green(`
+      console.log(import_chalk22.default.green(`
   ${result.changes.length} auto-fix${result.changes.length === 1 ? "" : "es"} available`));
-      console.log(import_chalk21.default.dim(`  run: hyv fix ${file} -i  to apply`));
+      console.log(import_chalk22.default.dim(`  run: hyv fix ${file} -i  to apply`));
       if (options.apply && filePath !== "stdin") {
         const fs25 = require("fs");
-        const path23 = require("path");
+        const path24 = require("path");
         const backupPath = filePath + ".bak";
         fs25.copyFileSync(filePath, backupPath);
         fs25.writeFileSync(filePath, result.fixed);
-        console.log(import_chalk21.default.green(`  \u2713 Applied. Backup: ${path23.basename(backupPath)}`));
+        console.log(import_chalk22.default.green(`  \u2713 Applied. Backup: ${path24.basename(backupPath)}`));
       }
     } catch (error) {
-      console.error(import_chalk21.default.red(`Error: ${error.message}`));
+      console.error(import_chalk22.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/rules.ts
-var import_chalk22 = __toESM(require_source());
+var import_chalk23 = __toESM(require_source());
 init_config();
 var RULE_CATALOG = [
   // AI Overused Words
@@ -13433,7 +13833,7 @@ function registerRulesCommand(program3) {
         for (const id of ids)
           disabledRules.delete(id);
         writeConfig({ ...config, disabled_rules: [...disabledRules] });
-        console.log(import_chalk22.default.green(`
+        console.log(import_chalk23.default.green(`
 \u2713 Enabled: ${ids.join(", ")}`));
         return;
       }
@@ -13442,13 +13842,13 @@ function registerRulesCommand(program3) {
         for (const id of ids)
           disabledRules.add(id);
         writeConfig({ ...config, disabled_rules: [...disabledRules] });
-        console.log(import_chalk22.default.green(`
+        console.log(import_chalk23.default.green(`
 \u2713 Disabled: ${ids.join(", ")}`));
         return;
       }
       if (options.reset) {
         writeConfig({ ...config, disabled_rules: [] });
-        console.log(import_chalk22.default.green("\n\u2713 All rules reset to default (enabled)"));
+        console.log(import_chalk23.default.green("\n\u2713 All rules reset to default (enabled)"));
         return;
       }
       let rules = [...RULE_CATALOG];
@@ -13476,40 +13876,40 @@ function registerRulesCommand(program3) {
       }
       console.log("");
       for (const [cat, catRules] of categories) {
-        console.log(import_chalk22.default.bold(`  ${cat} rules (${catRules.length})
+        console.log(import_chalk23.default.bold(`  ${cat} rules (${catRules.length})
 `));
-        console.log(import_chalk22.default.dim("  ID                      Sev   AutoFix  Status"));
-        console.log(import_chalk22.default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        console.log(import_chalk23.default.dim("  ID                      Sev   AutoFix  Status"));
+        console.log(import_chalk23.default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
         for (const rule of catRules) {
-          const sev = rule.severity === "red" ? import_chalk22.default.red("red") : import_chalk22.default.yellow("yel");
-          const fix = rule.autoFixable ? import_chalk22.default.green("  \u2713") : import_chalk22.default.dim("  \u2717");
-          const enabled2 = disabledRules.has(rule.id) ? import_chalk22.default.red("  \u2717 disabled") : import_chalk22.default.green("  \u2713 enabled");
+          const sev = rule.severity === "red" ? import_chalk23.default.red("red") : import_chalk23.default.yellow("yel");
+          const fix = rule.autoFixable ? import_chalk23.default.green("  \u2713") : import_chalk23.default.dim("  \u2717");
+          const enabled2 = disabledRules.has(rule.id) ? import_chalk23.default.red("  \u2717 disabled") : import_chalk23.default.green("  \u2713 enabled");
           const id = rule.id.padEnd(24);
-          console.log(`  ${import_chalk22.default.dim(id)} ${sev} ${fix}  ${enabled2}`);
+          console.log(`  ${import_chalk23.default.dim(id)} ${sev} ${fix}  ${enabled2}`);
         }
         console.log("");
       }
       const enabled = rules.filter((r) => !disabledRules.has(r.id)).length;
       const disabled = rules.length - enabled;
-      console.log(import_chalk22.default.dim(`  ${rules.length} rules, ${enabled} enabled, ${disabled} disabled`));
-      console.log(import_chalk22.default.dim(`  toggle: hyv rules --disable <id>`));
-      console.log(import_chalk22.default.dim(`  reset:  hyv rules --reset
+      console.log(import_chalk23.default.dim(`  ${rules.length} rules, ${enabled} enabled, ${disabled} disabled`));
+      console.log(import_chalk23.default.dim(`  toggle: hyv rules --disable <id>`));
+      console.log(import_chalk23.default.dim(`  reset:  hyv rules --reset
 `));
     } catch (error) {
-      console.error(import_chalk22.default.red(`Error: ${error.message}`));
+      console.error(import_chalk23.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/batch.ts
-var import_chalk23 = __toESM(require_source());
+var import_chalk24 = __toESM(require_source());
 var fs16 = __toESM(require("fs"));
-var path16 = __toESM(require("path"));
+var path17 = __toESM(require("path"));
 init_pipeline();
 init_local_profile();
 function registerBatchCommand(program3) {
-  program3.command("batch").description("Scan or fix multiple files matching a glob").argument("<pattern>", 'Glob pattern (e.g., "posts/**/*.md")').option("--fix", "Apply auto-fixes (default: scan only)").option("-i, --in-place", "Write fixes back to files").option("--threshold <n>", "Fail if any file score < threshold").option("--fail-on-hit", "Exit non-zero if any file has issues").option("--sort <field>", "Sort by: issues, score, name", "issues").option("--format <type>", "Output format (text, json, csv)", "text").option("--profile <name>", "Voice profile").option("--ignore <patterns>", "Comma-separated glob ignores").action(async (pattern, options) => {
+  program3.command("batch").description("Scan or fix multiple files matching a glob").argument("<pattern>", 'Glob pattern (e.g., "posts/**/*.md")').option("--fix", "Apply auto-fixes (default: scan only)").option("-i, --in-place", "Write fixes back to files").option("-y, --yes", "Confirm destructive in-place fixes without prompting").option("--threshold <n>", "Fail if any file score < threshold").option("--fail-on-hit", "Exit with code 2 if any file has issues").option("--sort <field>", "Sort by: issues, score, name", "issues").option("--format <type>", "Output format (text, json, csv)", "text").option("--profile <name>", "Voice profile").option("--ignore <patterns>", "Comma-separated glob ignores").action(async (pattern, options) => {
     try {
       const profile = await loadProfileForCommand(options.profile);
       const glob = require_index_min();
@@ -13518,18 +13918,27 @@ function registerBatchCommand(program3) {
         nodir: true
       });
       if (files.length === 0) {
-        console.log(import_chalk23.default.yellow(`
+        console.log(import_chalk24.default.yellow(`
 No files matching: ${pattern}`));
         return;
       }
+      if (options.fix && options.inPlace) {
+        const confirmed = await confirmDestructiveWrite({
+          yes: options.yes,
+          action: `Apply auto-fixes in-place to ${files.length} file(s)`,
+          target: pattern
+        });
+        if (!confirmed)
+          process.exit(1);
+      }
       if (options.format === "text") {
-        console.log(import_chalk23.default.dim(`
+        console.log(import_chalk24.default.dim(`
   scanning ${files.length} file${files.length === 1 ? "" : "s"}...
 `));
       }
       const results = [];
       for (const file of files) {
-        const absPath = path16.resolve(file);
+        const absPath = path17.resolve(file);
         if (!fs16.existsSync(absPath))
           continue;
         const text = fs16.readFileSync(absPath, "utf-8");
@@ -13543,9 +13952,7 @@ No files matching: ${pattern}`));
           autoFixes: result.changes.length
         });
         if (options.fix && options.inPlace && result.changes.length > 0) {
-          const backupPath = absPath + ".bak";
-          fs16.copyFileSync(absPath, backupPath);
-          fs16.writeFileSync(absPath, result.fixed);
+          writeInPlaceWithBackup(absPath, result.fixed);
         }
       }
       if (options.sort === "score") {
@@ -13564,98 +13971,110 @@ No files matching: ${pattern}`));
         }
       } else {
         for (const r of results) {
-          const icon = r.issues > 0 ? import_chalk23.default.red("\u25CF") : import_chalk23.default.green("\u25CB");
-          const score = r.score < 60 ? import_chalk23.default.red(r.score) : r.score < 80 ? import_chalk23.default.yellow(r.score) : import_chalk23.default.green(r.score);
-          const issueStr = r.issues > 0 ? import_chalk23.default.red(`${r.issues} issues`) : import_chalk23.default.green("clean");
+          const icon = r.issues > 0 ? import_chalk24.default.red("\u25CF") : import_chalk24.default.green("\u25CB");
+          const score = r.score < 60 ? import_chalk24.default.red(r.score) : r.score < 80 ? import_chalk24.default.yellow(r.score) : import_chalk24.default.green(r.score);
+          const issueStr = r.issues > 0 ? import_chalk24.default.red(`${r.issues} issues`) : import_chalk24.default.green("clean");
           console.log(`  ${icon} ${r.file.padEnd(40)} ${issueStr.padEnd(20)} score: ${score}`);
         }
         const withIssues = results.filter((r) => r.issues > 0).length;
         const totalIssues = results.reduce((sum, r) => sum + r.issues, 0);
         const worst = results.reduce((min, r) => r.score < min.score ? r : min, results[0]);
-        console.log(import_chalk23.default.dim(`
+        console.log(import_chalk24.default.dim(`
   \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`));
-        console.log(import_chalk23.default.dim(`  ${results.length} files, ${withIssues} with issues, ${totalIssues} total issues`));
+        console.log(import_chalk24.default.dim(`  ${results.length} files, ${withIssues} with issues, ${totalIssues} total issues`));
         if (withIssues > 0) {
-          console.log(import_chalk23.default.dim(`  worst: ${worst.file} (${worst.score}/100)`));
+          console.log(import_chalk24.default.dim(`  worst: ${worst.file} (${worst.score}/100)`));
         }
         if (options.fix && options.inPlace) {
           const fixed = results.filter((r) => r.autoFixes > 0);
-          console.log(import_chalk23.default.green(`
+          console.log(import_chalk24.default.green(`
   \u2713 ${fixed.reduce((sum, r) => sum + r.autoFixes, 0)} auto-fixes applied across ${fixed.length} files`));
         }
       }
       const threshold = options.threshold ? parseInt(options.threshold, 10) : 0;
-      const hasFailures = results.some(
-        (r) => options.failOnHit && r.issues > 0 || threshold > 0 && r.score < threshold
-      );
-      if (hasFailures)
+      const failOnHit = results.some((r) => options.failOnHit && r.issues > 0);
+      const belowThreshold = results.some((r) => threshold > 0 && r.score < threshold);
+      if (failOnHit)
+        process.exit(2);
+      if (belowThreshold)
         process.exit(1);
     } catch (error) {
-      console.error(import_chalk23.default.red(`Error: ${error.message}`));
+      console.error(import_chalk24.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/watch.ts
-var import_chalk24 = __toESM(require_source());
+var import_chalk25 = __toESM(require_source());
 var fs17 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
+var path18 = __toESM(require("path"));
 init_pipeline();
 init_local_profile();
 function registerWatchCommand(program3) {
-  program3.command("watch").description("Watch a file and re-scan on every save").argument("<file>", "File to watch").option("--command <cmd>", "What to run on change: scan, score, fix", "scan").option("--debounce <ms>", "Delay after save before scanning", "300").option("--notify", "OS notification when issues found").option("--profile <name>", "Voice profile").action(async (file, options) => {
+  program3.command("watch").description("Watch a file and re-scan on every save").argument("<file>", "File to watch").option("--command <cmd>", "What to run on change: scan, score, fix", "scan").option("--debounce <ms>", "Delay after save before scanning", "300").option("--notify", "OS notification when issues found").option("-y, --yes", "Confirm destructive auto-fix writes without prompting").option("--profile <name>", "Voice profile").action(async (file, options) => {
     try {
       const profile = await loadProfileForCommand(options.profile);
-      const absPath = path17.resolve(file);
+      const absPath = path18.resolve(file);
       if (!fs17.existsSync(absPath)) {
-        console.error(import_chalk24.default.red(`File not found: ${absPath}`));
+        console.error(import_chalk25.default.red(`File not found: ${absPath}`));
         process.exit(1);
       }
-      console.log(import_chalk24.default.dim(`
+      if (options.command === "fix") {
+        const confirmed = await confirmDestructiveWrite({
+          yes: options.yes,
+          action: "Auto-fix on every save",
+          target: absPath
+        });
+        if (!confirmed)
+          process.exit(1);
+      }
+      console.log(import_chalk25.default.dim(`
 watching ${absPath}`));
-      console.log(import_chalk24.default.dim(`command: ${options.command}  debounce: ${options.debounce}ms`));
-      console.log(import_chalk24.default.dim("ctrl+c to stop\n"));
+      console.log(import_chalk25.default.dim(`command: ${options.command}  debounce: ${options.debounce}ms`));
+      console.log(import_chalk25.default.dim("ctrl+c to stop\n"));
       let debounceTimer = null;
       const debounceMs = parseInt(options.debounce, 10);
       let scanCount = 0;
       let lastScore = 0;
+      let ignoreWatchUntil = 0;
       const runScan = () => {
         const text = fs17.readFileSync(absPath, "utf-8");
         const result = runPipeline(text, profile, options.command === "fix");
         scanCount++;
         const now = (/* @__PURE__ */ new Date()).toLocaleTimeString("en-US", { hour12: false });
-        console.log(import_chalk24.default.dim(`[${now}] saved \u2014 ${options.command}ing...`));
+        console.log(import_chalk25.default.dim(`[${now}] saved \u2014 ${options.command}ing...`));
         if (options.command === "score") {
           const score = result.score;
-          const color = score < 60 ? import_chalk24.default.red : score < 80 ? import_chalk24.default.yellow : import_chalk24.default.green;
+          const color = score < 60 ? import_chalk25.default.red : score < 80 ? import_chalk25.default.yellow : import_chalk25.default.green;
           console.log(`  ${color(score + "/100")}`);
           if (lastScore > 0 && score !== lastScore) {
             const delta = score - lastScore;
-            console.log(import_chalk24.default.dim(`  ${delta > 0 ? "\u2191" : "\u2193"} ${Math.abs(delta)} from last scan`));
+            console.log(import_chalk25.default.dim(`  ${delta > 0 ? "\u2191" : "\u2193"} ${Math.abs(delta)} from last scan`));
           }
           lastScore = score;
         } else if (options.command === "fix") {
           if (result.changes.length > 0) {
             for (const change of result.changes) {
-              console.log(import_chalk24.default.dim(`  Line ${change.line}: `) + import_chalk24.default.red(change.before) + import_chalk24.default.dim(" \u2192 ") + import_chalk24.default.green(change.after));
+              console.log(import_chalk25.default.dim(`  Line ${change.line}: `) + import_chalk25.default.red(change.before) + import_chalk25.default.dim(" \u2192 ") + import_chalk25.default.green(change.after));
             }
-            fs17.writeFileSync(absPath, result.fixed);
-            console.log(import_chalk24.default.green(`  \u2713 ${result.changes.length} auto-fixes applied`));
+            ignoreWatchUntil = Date.now() + debounceMs + 200;
+            writeInPlaceWithBackup(absPath, result.fixed);
+            console.log(import_chalk25.default.green(`  \u2713 ${result.changes.length} auto-fixes applied`));
           } else {
-            console.log(import_chalk24.default.green("  \u2713 no auto-fixable issues"));
+            console.log(import_chalk25.default.green("  \u2713 no auto-fixable issues"));
           }
         } else {
           if (result.stats.totalSignals === 0) {
-            console.log(import_chalk24.default.green(`  \u2713 clean \u2014 score: ${result.score}/100`));
+            console.log(import_chalk25.default.green(`  \u2713 clean \u2014 score: ${result.score}/100`));
           } else {
-            console.log(import_chalk24.default.yellow(`  ${result.stats.totalSignals} issues (${result.stats.red} red, ${result.stats.yellow} yellow)  score: ${result.score}/100`));
+            console.log(import_chalk25.default.yellow(`  ${result.stats.totalSignals} issues (${result.stats.red} red, ${result.stats.yellow} yellow)  score: ${result.score}/100`));
             for (const signal of result.signalMap.signals.slice(0, 3)) {
-              const sev = signal.severity === "red" ? import_chalk24.default.red("\u25CF") : import_chalk24.default.yellow("\u25CB");
+              const sev = signal.severity === "red" ? import_chalk25.default.red("\u25CF") : import_chalk25.default.yellow("\u25CB");
               console.log(`  ${sev} line ${signal.line}: ${signal.id} \u2014 ${signal.suggestion}`);
             }
             if (result.signalMap.signals.length > 3) {
-              console.log(import_chalk24.default.dim(`  ... and ${result.signalMap.signals.length - 3} more`));
+              console.log(import_chalk25.default.dim(`  ... and ${result.signalMap.signals.length - 3} more`));
             }
           }
         }
@@ -13665,26 +14084,28 @@ watching ${absPath}`));
       fs17.watch(absPath, (eventType) => {
         if (eventType !== "change")
           return;
+        if (Date.now() < ignoreWatchUntil)
+          return;
         if (debounceTimer)
           clearTimeout(debounceTimer);
         debounceTimer = setTimeout(runScan, debounceMs);
       });
       process.on("SIGINT", () => {
-        console.log(import_chalk24.default.dim(`
+        console.log(import_chalk25.default.dim(`
   ${scanCount} scans completed. exiting.`));
         process.exit(0);
       });
       await new Promise(() => {
       });
     } catch (error) {
-      console.error(import_chalk24.default.red(`Error: ${error.message}`));
+      console.error(import_chalk25.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/demo.ts
-var import_chalk25 = __toESM(require_source());
+var import_chalk26 = __toESM(require_source());
 var fs18 = __toESM(require("fs"));
 var SAMPLES = {
   linkedin: {
@@ -13775,46 +14196,46 @@ function registerDemoCommand(program3) {
       const style = options.clean ? "clean" : options.style;
       const sample = SAMPLES[style];
       if (!sample) {
-        console.error(import_chalk25.default.red(`Unknown style: ${options.style}. Valid: ${Object.keys(SAMPLES).filter((k) => k !== "clean").join(", ")}`));
+        console.error(import_chalk26.default.red(`Unknown style: ${options.style}. Valid: ${Object.keys(SAMPLES).filter((k) => k !== "clean").join(", ")}`));
         process.exit(1);
       }
       if (options.output) {
         const outputPath = require("path").resolve(options.output);
         fs18.writeFileSync(outputPath, sample.text);
-        console.log(import_chalk25.default.green(`
+        console.log(import_chalk26.default.green(`
 \u2713 Sample written to ${outputPath}`));
         if (sample.patterns.length > 0) {
-          console.log(import_chalk25.default.dim(`  Contains ${sample.patterns.length} AI patterns: ${sample.patterns.slice(0, 5).join(", ")}...`));
+          console.log(import_chalk26.default.dim(`  Contains ${sample.patterns.length} AI patterns: ${sample.patterns.slice(0, 5).join(", ")}...`));
         }
-        console.log(import_chalk25.default.dim(`
+        console.log(import_chalk26.default.dim(`
   Scan it:  hyv scan ${options.output}`));
-        console.log(import_chalk25.default.dim(`  Fix it:   hyv fix ${options.output}`));
+        console.log(import_chalk26.default.dim(`  Fix it:   hyv fix ${options.output}`));
       } else {
-        console.log(import_chalk25.default.bold(`
+        console.log(import_chalk26.default.bold(`
   \u2500\u2500\u2500 sample (${style}) \u2500\u2500\u2500
 `));
         console.log(sample.text);
-        console.log(import_chalk25.default.dim(`
+        console.log(import_chalk26.default.dim(`
   \u2500\u2500\u2500 end \u2500\u2500\u2500`));
         if (sample.patterns.length > 0) {
-          console.log(import_chalk25.default.dim(`
+          console.log(import_chalk26.default.dim(`
   ${sample.patterns.length} AI patterns embedded: ${sample.patterns.slice(0, 8).join(", ")}...`));
         }
-        console.log(import_chalk25.default.dim(`
+        console.log(import_chalk26.default.dim(`
   Save to file: hyv demo --output demo.md`));
-        console.log(import_chalk25.default.dim(`  Scan it:      hyv scan demo.md`));
-        console.log(import_chalk25.default.dim(`  Fix it:       hyv fix demo.md
+        console.log(import_chalk26.default.dim(`  Scan it:      hyv scan demo.md`));
+        console.log(import_chalk26.default.dim(`  Fix it:       hyv fix demo.md
 `));
       }
     } catch (error) {
-      console.error(import_chalk25.default.red(`Error: ${error.message}`));
+      console.error(import_chalk26.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
 }
 
 // src/commands/open.ts
-var import_chalk26 = __toESM(require_source());
+var import_chalk27 = __toESM(require_source());
 var PAGES = {
   dashboard: "https://holdyourvoice.com/dashboard",
   profiles: "https://holdyourvoice.com/dashboard",
@@ -13831,12 +14252,12 @@ function registerOpenCommand(program3) {
         return;
       }
       const open3 = (await Promise.resolve().then(() => __toESM(require_open()))).default;
-      console.log(import_chalk26.default.dim(`
+      console.log(import_chalk27.default.dim(`
   Opening ${url}...`));
       await open3(url);
-      console.log(import_chalk26.default.green("  \u2713 Opened in browser\n"));
+      console.log(import_chalk27.default.green("  \u2713 Opened in browser\n"));
     } catch (error) {
-      console.error(import_chalk26.default.red(`Error: ${error.message}`));
+      console.error(import_chalk27.default.red(`Error: ${error.message}`));
       process.exit(1);
     }
   });
@@ -13847,10 +14268,10 @@ init_welcome();
 
 // src/lib/onboarding.ts
 var fs19 = __toESM(require("fs"));
-var path18 = __toESM(require("path"));
+var path19 = __toESM(require("path"));
 var os6 = __toESM(require("os"));
-var hyvDir = path18.join(os6.homedir(), ".hyv");
-var onboardingFile = path18.join(hyvDir, "onboarding-complete.json");
+var hyvDir = path19.join(os6.homedir(), ".hyv");
+var onboardingFile = path19.join(hyvDir, "onboarding-complete.json");
 function hasCompletedOnboarding() {
   try {
     return fs19.existsSync(onboardingFile);
@@ -13869,11 +14290,11 @@ function markOnboardingComplete(version) {
 
 // src/commands/welcome.ts
 var fs20 = __toESM(require("fs"));
-var path19 = __toESM(require("path"));
+var path20 = __toESM(require("path"));
 function registerWelcomeCommand(program3) {
   const pkgVersion3 = (() => {
     try {
-      const pkgPath3 = path19.resolve(__dirname, "..", "..", "package.json");
+      const pkgPath3 = path20.resolve(__dirname, "..", "package.json");
       return JSON.parse(fs20.readFileSync(pkgPath3, "utf-8")).version;
     } catch {
       return "0.0.0";
@@ -13898,7 +14319,7 @@ function getWelcomeText() {
 }
 
 // src/commands/content.ts
-var import_chalk27 = __toESM(require_source());
+var import_chalk28 = __toESM(require_source());
 init_free_paid();
 var TEMPLATES = {
   cursor: {
@@ -13972,59 +14393,60 @@ ${COMMUNITY_URL}`
 function registerContentCommand(program3) {
   program3.command("content").description("Blog outlines, CI snippets, and share templates").argument("[topic]", "cursor | agents | ci | share", "cursor").option("--list", "List available templates").action((topic, opts) => {
     if (opts.list) {
-      console.log(import_chalk27.default.bold("\nhyv content templates\n"));
+      console.log(import_chalk28.default.bold("\nhyv content templates\n"));
       for (const [key, t2] of Object.entries(TEMPLATES)) {
-        console.log(import_chalk27.default.dim(`  ${key}`) + ` \u2014 ${t2.title}`);
+        console.log(import_chalk28.default.dim(`  ${key}`) + ` \u2014 ${t2.title}`);
       }
       console.log("");
       return;
     }
     const t = TEMPLATES[topic] || TEMPLATES.cursor;
-    console.log(import_chalk27.default.bold(`
+    console.log(import_chalk28.default.bold(`
 ${t.title}
 `));
     console.log(t.body);
-    console.log(import_chalk27.default.dim("\nBlog: https://holdyourvoice.com/blog\n"));
+    console.log(import_chalk28.default.dim("\nBlog: https://holdyourvoice.com/blog\n"));
   });
 }
 
 // src/commands/upgrade.ts
-var import_chalk28 = __toESM(require_source());
-var import_child_process2 = require("child_process");
+var import_chalk29 = __toESM(require_source());
+var import_child_process3 = require("child_process");
+init_version();
 function registerUpgradeCommand(program3) {
   program3.command("upgrade").description("Upgrade to the latest @holdyourvoice/hyv").option("--check", "Only check if an update is available").action(async (opts) => {
     const current = getCliVersion();
-    console.log(import_chalk28.default.dim(`
+    console.log(import_chalk29.default.dim(`
 Current: ${getEngineLabel()}
 `));
     let latest = current;
     try {
-      const out = (0, import_child_process2.execSync)("npm view @holdyourvoice/hyv version", { encoding: "utf-8", timeout: 15e3 });
+      const out = (0, import_child_process3.execSync)("npm view @holdyourvoice/hyv version", { encoding: "utf-8", timeout: 15e3 });
       latest = out.trim();
     } catch {
-      console.log(import_chalk28.default.yellow("Could not reach npm registry. Try: npm i -g @holdyourvoice/hyv@latest"));
+      console.log(import_chalk29.default.yellow("Could not reach npm registry. Try: npm i -g @holdyourvoice/hyv@latest"));
       return;
     }
     const cmp = compareSemver(current, latest);
     if (cmp === 0) {
-      console.log(import_chalk28.default.green("\u2713 You are on the latest version."));
+      console.log(import_chalk29.default.green("\u2713 You are on the latest version."));
       return;
     }
     if (cmp > 0) {
-      console.log(import_chalk28.default.green(`\u2713 You are ahead of npm (published: ${latest}).`));
+      console.log(import_chalk29.default.green(`\u2713 You are ahead of npm (published: ${latest}).`));
       return;
     }
-    console.log(import_chalk28.default.cyan(`Update available: ${current} \u2192 ${latest}`));
+    console.log(import_chalk29.default.cyan(`Update available: ${current} \u2192 ${latest}`));
     if (opts.check) {
-      console.log(import_chalk28.default.dim("\nRun: hyv upgrade  or  npm i -g @holdyourvoice/hyv@latest\n"));
+      console.log(import_chalk29.default.dim("\nRun: hyv upgrade  or  npm i -g @holdyourvoice/hyv@latest\n"));
       return;
     }
-    console.log(import_chalk28.default.dim("Installing..."));
+    console.log(import_chalk29.default.dim("Installing..."));
     try {
-      (0, import_child_process2.execSync)("npm i -g @holdyourvoice/hyv@latest", { stdio: "inherit" });
-      console.log(import_chalk28.default.green("\n\u2713 Upgraded successfully. Restart your terminal.\n"));
+      (0, import_child_process3.execSync)("npm i -g @holdyourvoice/hyv@latest", { stdio: "inherit" });
+      console.log(import_chalk29.default.green("\n\u2713 Upgraded successfully. Restart your terminal.\n"));
     } catch {
-      console.log(import_chalk28.default.red("\nUpgrade failed. Run manually: npm i -g @holdyourvoice/hyv@latest\n"));
+      console.log(import_chalk29.default.red("\nUpgrade failed. Run manually: npm i -g @holdyourvoice/hyv@latest\n"));
       process.exit(1);
     }
   });
@@ -14032,7 +14454,7 @@ Current: ${getEngineLabel()}
 
 // src/mcp.ts
 var fs21 = __toESM(require("fs"));
-var path20 = __toESM(require("path"));
+var path21 = __toESM(require("path"));
 var os7 = __toESM(require("os"));
 init_classifier();
 init_autofix();
@@ -14044,9 +14466,29 @@ init_welcome();
 init_config();
 init_telemetry();
 init_access();
-var VOICE_MD = path20.join(os7.homedir(), ".hyv", "voice.md");
+var VOICE_MD = path21.join(os7.homedir(), ".hyv", "voice.md");
 var MAX_RESPONSE_CHARS = 12e4;
-var pkgPath = path20.resolve(__dirname, "..", "package.json");
+var MAX_SCAN_FILE_BYTES = 2 * 1024 * 1024;
+function readScanFile(filePath) {
+  const cwdReal = fs21.realpathSync(process.cwd());
+  const resolved = fs21.realpathSync(path21.resolve(filePath));
+  if (!resolved.startsWith(cwdReal + path21.sep) && resolved !== cwdReal) {
+    throw new Error(`file must be in the current working directory (${cwdReal})`);
+  }
+  const stat = fs21.statSync(resolved);
+  if (stat.size > MAX_SCAN_FILE_BYTES) {
+    throw new Error(`file too large (max ${MAX_SCAN_FILE_BYTES} bytes)`);
+  }
+  return fs21.readFileSync(resolved, "utf-8");
+}
+function toolResultPayload(result) {
+  const isError = result.startsWith("Error:") || result.startsWith("Unknown tool:");
+  return {
+    content: [{ type: "text", text: truncateResponse(result) }],
+    ...isError ? { isError: true } : {}
+  };
+}
+var pkgPath = path21.resolve(__dirname, "..", "package.json");
 var pkgVersion = (() => {
   try {
     return JSON.parse(fs21.readFileSync(pkgPath, "utf-8")).version;
@@ -14054,8 +14496,14 @@ var pkgVersion = (() => {
     return "2.7.1";
   }
 })();
-async function resolveProfile(slug) {
-  return loadProfileForCommand(slug, { allowServerFetch: true });
+async function resolveProfile(slug, allowServerFetch = false) {
+  const profile = await loadProfileForCommand(slug, { allowServerFetch });
+  if (slug && !profile) {
+    const { requirePaidFeature: requirePaidFeature2 } = await Promise.resolve().then(() => (init_access(), access_exports));
+    await requirePaidFeature2("premiumPrompts");
+    return loadProfileForCommand(slug, { allowServerFetch: true });
+  }
+  return profile;
 }
 function jsonRpcOk(id, result) {
   return JSON.stringify({ jsonrpc: "2.0", id, result });
@@ -14116,14 +14564,11 @@ async function toolScan(args2) {
     let scanText2 = text;
     const profile = await resolveProfile(args2.profile);
     if (filePath) {
-      const resolved = path20.resolve(filePath);
-      const cwd = process.cwd();
-      if (!resolved.startsWith(cwd + path20.sep) && resolved !== cwd) {
-        return `Error: file must be in the current working directory (${cwd})`;
+      try {
+        scanText2 = readScanFile(filePath);
+      } catch (err) {
+        return `Error: ${err.message}`;
       }
-      if (!fs21.existsSync(resolved))
-        return `Error: file not found: ${filePath}`;
-      scanText2 = fs21.readFileSync(resolved, "utf-8");
     }
     const result = runPipeline(scanText2, profile, false);
     if (result.stats.totalSignals === 0) {
@@ -14135,13 +14580,19 @@ async function toolScan(args2) {
     const lines = [
       `Score: ${result.score}/100. Found ${result.stats.totalSignals} issues (${result.stats.red} red, ${result.stats.yellow} yellow):`
     ];
+    const shown = /* @__PURE__ */ new Set();
     if (profile && profileIssues.length > 0) {
       lines.push(`Profile-specific (${profileIssues.length}):`);
       for (const s of profileIssues.slice(0, 5)) {
+        const key = `${s.line}:${s.id}`;
+        shown.add(key);
         lines.push(`  line ${s.line}: [${s.severity}] ${s.id} \u2014 ${s.suggestion}`);
       }
     }
     for (const s of result.signalMap.signals.slice(0, 15)) {
+      const key = `${s.line}:${s.id}`;
+      if (shown.has(key))
+        continue;
       lines.push(`line ${s.line}: [${s.severity}] ${s.id} \u2014 ${s.suggestion}`);
     }
     return lines.join("\n");
@@ -14284,7 +14735,7 @@ async function toolAnalyze(args2) {
     return "Error: no text provided";
   try {
     const profile = await resolveProfile(args2.profile);
-    const preferServer = args2.prefer_server !== false;
+    const preferServer = args2.prefer_server === true;
     const result = await runHybridAnalysis(text, profile, {
       preferServer,
       profileSlug: args2.profile || profile?.slug
@@ -14407,7 +14858,7 @@ var TOOLS = [
       properties: {
         text: { type: "string", description: "Text to analyze" },
         profile: { type: "string", description: "Voice profile slug" },
-        prefer_server: { type: "boolean", description: "Use server hybrid engine when paid (default true)" }
+        prefer_server: { type: "boolean", description: "Use server hybrid engine when paid (default false)" }
       },
       required: ["text"]
     }
@@ -14599,9 +15050,12 @@ async function handleRequest(line) {
         mcpLog("error", `tool ${toolName}: ${err.message}`);
         recordEvent("mcp_tool_error", { tool: toolName, error: err.message });
       }
-      send(jsonRpcOk(id, { content: [{ type: "text", text: truncateResponse(result) }] }));
+      send(jsonRpcOk(id, toolResultPayload(result)));
       break;
     }
+    case "ping":
+      send(jsonRpcOk(id, {}));
+      break;
     default:
       if (id !== void 0) {
         send(jsonRpcError(id, -32601, `Method not found: ${method}`));
@@ -14621,16 +15075,17 @@ async function startMcpServer() {
   }
   let buffer = "";
   process.stdin.setEncoding("utf-8");
+  let requestChain = Promise.resolve();
+  const enqueueRequest = (line) => {
+    requestChain = requestChain.then(() => handleRequest(line)).catch((err) => mcpLog("error", err.message));
+  };
   process.stdin.on("data", (chunk) => {
     buffer += chunk;
     const lines = buffer.split("\n");
     buffer = lines.pop() || "";
     for (const line of lines) {
-      if (line.trim()) {
-        handleRequest(line.trim()).catch((err) => {
-          mcpLog("error", err.message);
-        });
-      }
+      if (line.trim())
+        enqueueRequest(line.trim());
     }
   });
   process.stdin.on("end", () => process.exit(0));
@@ -14642,104 +15097,137 @@ async function startMcpServer() {
 }
 
 // src/lib/mcp-setup.ts
-var import_chalk29 = __toESM(require_source());
+var import_chalk30 = __toESM(require_source());
 var fs22 = __toESM(require("fs"));
-var path21 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 var os8 = __toESM(require("os"));
+init_version();
 var HOME2 = os8.homedir();
 var IS_WIN2 = process.platform === "win32";
+function claudeDesktopConfigPath() {
+  if (IS_WIN2)
+    return path22.join(HOME2, "AppData", "Roaming", "Claude", "claude_desktop_config.json");
+  if (process.platform === "linux")
+    return path22.join(HOME2, ".config", "Claude", "claude_desktop_config.json");
+  return path22.join(HOME2, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+}
 function printMcpSetup() {
-  const claudeConfig = IS_WIN2 ? path21.join(HOME2, "AppData", "Roaming", "Claude", "claude_desktop_config.json") : path21.join(HOME2, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-  console.log(import_chalk29.default.bold("\nhold your voice \u2014 mcp setup\n"));
-  console.log(import_chalk29.default.dim(`  ${getEngineLabel()}
+  console.log(import_chalk30.default.bold("\nhold your voice \u2014 mcp setup\n"));
+  console.log(import_chalk30.default.dim(`  ${getEngineLabel()}
 `));
-  console.log(import_chalk29.default.bold("Claude Desktop"));
-  console.log(import_chalk29.default.dim("  Add to claude_desktop_config.json \u2192 mcpServers:"));
-  console.log(import_chalk29.default.cyan('  "hyv": { "command": "hyv", "args": ["mcp"] }'));
-  console.log(import_chalk29.default.dim(`  Config file: ${claudeConfig}
+  console.log(import_chalk30.default.bold("Claude Desktop"));
+  console.log(import_chalk30.default.dim("  Add to claude_desktop_config.json \u2192 mcpServers.hyv:"));
+  console.log(import_chalk30.default.cyan(`  ${mcpServerSnippet().split("\n").join("\n  ")}`));
+  console.log(import_chalk30.default.dim(`  Config: ${claudeDesktopConfigPath()}
 `));
-  console.log(import_chalk29.default.bold("Cursor"));
-  console.log(import_chalk29.default.dim("  Rule file: ~/.cursor/rules/hyv.md"));
-  console.log(import_chalk29.default.dim("  Run: hyv doctor --fix-agents to copy latest instructions\n"));
-  console.log(import_chalk29.default.bold("Claude Code"));
-  console.log(import_chalk29.default.dim("  Command: ~/.claude/commands/hyv.md\n"));
-  console.log(import_chalk29.default.bold("Windsurf / Codex / ChatGPT"));
-  console.log(import_chalk29.default.dim("  hyv doctor --fix-agents copies agent files from the package\n"));
-  console.log(import_chalk29.default.bold("Verify"));
-  console.log(import_chalk29.default.dim("  hyv mcp --test"));
-  console.log(import_chalk29.default.dim("  HYV_TELEMETRY=1 hyv mcp  (optional usage logging to ~/.hyv/telemetry/)\n"));
+  console.log(import_chalk30.default.bold("Cursor"));
+  console.log(import_chalk30.default.dim("  MCP: ~/.cursor/mcp.json \u2192 mcpServers.hyv (same JSON as above)"));
+  console.log(import_chalk30.default.dim("  Rule: ~/.cursor/rules/hyv.mdc (alwaysApply \u2014 auto via postinstall)\n"));
+  console.log(import_chalk30.default.bold("Claude Code"));
+  console.log(import_chalk30.default.dim("  Command: ~/.claude/commands/hyv.md"));
+  console.log(import_chalk30.default.dim("  Skill: ~/.claude/skills/hold-your-voice/SKILL.md\n"));
+  console.log(import_chalk30.default.bold("Windsurf"));
+  console.log(import_chalk30.default.dim("  Rule: ~/.windsurf/rules/hyv.md (trigger: always_on)\n"));
+  console.log(import_chalk30.default.bold("Codex"));
+  console.log(import_chalk30.default.dim("  Instructions: ~/.codex/AGENTS.md (merged on install)\n"));
+  console.log(import_chalk30.default.bold("Command Code"));
+  console.log(import_chalk30.default.dim("  Skill: ~/.commandcode/skills/hyv/SKILL.md\n"));
+  console.log(import_chalk30.default.bold("ChatGPT"));
+  console.log(import_chalk30.default.dim("  hyv mcp --setup-chatgpt\n"));
+  console.log(import_chalk30.default.bold("Auto-configure"));
+  console.log(import_chalk30.default.dim("  hyv doctor --fix-agents"));
+  console.log(import_chalk30.default.dim("  HYV_AUTO_CONFIGURE_AGENTS=0 npm i -g @holdyourvoice/hyv  (skip)\n"));
+  console.log(import_chalk30.default.bold("Verify"));
+  console.log(import_chalk30.default.dim("  hyv mcp --test"));
+  console.log(import_chalk30.default.dim("  HYV_TELEMETRY=1 hyv mcp  (optional usage logging to ~/.hyv/telemetry/)\n"));
 }
 async function runMcpSelfTest() {
-  console.log(import_chalk29.default.bold("\nhold your voice \u2014 mcp self-test\n"));
-  console.log(import_chalk29.default.dim(`  ${getEngineLabel()}
+  console.log(import_chalk30.default.bold("\nhold your voice \u2014 mcp self-test\n"));
+  console.log(import_chalk30.default.dim(`  ${getEngineLabel()}
 `));
   let passed = 0;
   let failed = 0;
   const tools = getMcpToolNames();
   if (tools.length >= 10) {
-    console.log(import_chalk29.default.green(`  \u2713 ${tools.length} MCP tools registered`));
+    console.log(import_chalk30.default.green(`  \u2713 ${tools.length} MCP tools registered`));
     passed++;
   } else {
-    console.log(import_chalk29.default.red(`  \u2717 expected 10+ tools, got ${tools.length}`));
+    console.log(import_chalk30.default.red(`  \u2717 expected 10+ tools, got ${tools.length}`));
     failed++;
   }
-  const required = ["hyv_welcome", "hyv_scan", "hyv_analyze", "hyv_clean", "hyv_validate"];
+  const required = ["hyv_welcome", "hyv_scan", "hyv_analyze", "hyv_clean", "hyv_validate", "hyv_list_free_tools"];
   for (const name of required) {
     if (tools.includes(name)) {
-      console.log(import_chalk29.default.green(`  \u2713 tool: ${name}`));
+      console.log(import_chalk30.default.green(`  \u2713 tool: ${name}`));
       passed++;
     } else {
-      console.log(import_chalk29.default.red(`  \u2717 missing tool: ${name}`));
+      console.log(import_chalk30.default.red(`  \u2717 missing tool: ${name}`));
       failed++;
     }
   }
   try {
     const welcome = await invokeMcpTool("hyv_welcome", {});
     if (welcome.includes("Hold Your Voice") || welcome.includes("hold your voice")) {
-      console.log(import_chalk29.default.green("  \u2713 hyv_welcome responds"));
+      console.log(import_chalk30.default.green("  \u2713 hyv_welcome responds"));
       passed++;
     } else {
-      console.log(import_chalk29.default.red("  \u2717 hyv_welcome unexpected output"));
+      console.log(import_chalk30.default.red("  \u2717 hyv_welcome unexpected output"));
       failed++;
     }
   } catch (e) {
-    console.log(import_chalk29.default.red(`  \u2717 hyv_welcome failed: ${e.message}`));
+    console.log(import_chalk30.default.red(`  \u2717 hyv_welcome failed: ${e.message}`));
     failed++;
   }
   try {
     const demo = await invokeMcpTool("hyv_demo", {});
     if (demo.includes("Score") || demo.includes("issues")) {
-      console.log(import_chalk29.default.green("  \u2713 hyv_demo pipeline works"));
+      console.log(import_chalk30.default.green("  \u2713 hyv_demo pipeline works"));
       passed++;
     } else {
-      console.log(import_chalk29.default.red("  \u2717 hyv_demo unexpected output"));
+      console.log(import_chalk30.default.red("  \u2717 hyv_demo unexpected output"));
       failed++;
     }
   } catch (e) {
-    console.log(import_chalk29.default.red(`  \u2717 hyv_demo failed: ${e.message}`));
+    console.log(import_chalk30.default.red(`  \u2717 hyv_demo failed: ${e.message}`));
     failed++;
   }
-  const voiceMd = path21.join(HOME2, ".hyv", "voice.md");
+  const voiceMd = path22.join(HOME2, ".hyv", "voice.md");
   if (fs22.existsSync(voiceMd)) {
-    console.log(import_chalk29.default.green("  \u2713 voice profile found"));
+    console.log(import_chalk30.default.green("  \u2713 voice profile found"));
     passed++;
   } else {
-    console.log(import_chalk29.default.dim("  - no voice.md (free local engine still works)"));
+    console.log(import_chalk30.default.dim("  - no voice.md (free local engine still works)"));
   }
   if (getDemoText().length > 100) {
-    console.log(import_chalk29.default.green("  \u2713 demo content available"));
+    console.log(import_chalk30.default.green("  \u2713 demo content available"));
     passed++;
   } else {
-    console.log(import_chalk29.default.red("  \u2717 demo content missing"));
+    console.log(import_chalk30.default.red("  \u2717 demo content missing"));
+    failed++;
+  }
+  try {
+    const stdio = await testMcpStdioSubprocess();
+    if (stdio.ok && (stdio.toolCount || 0) >= 10) {
+      console.log(import_chalk30.default.green(`  \u2713 stdio MCP subprocess responds (${stdio.toolCount} tools)`));
+      passed++;
+    } else if (stdio.ok) {
+      console.log(import_chalk30.default.yellow(`  ! stdio MCP subprocess ok but only ${stdio.toolCount || 0} tools`));
+      failed++;
+    } else {
+      console.log(import_chalk30.default.red("  \u2717 stdio MCP subprocess failed"));
+      failed++;
+    }
+  } catch (e) {
+    console.log(import_chalk30.default.red(`  \u2717 stdio MCP subprocess failed: ${e.message}`));
     failed++;
   }
   console.log("");
   if (failed === 0) {
-    console.log(import_chalk29.default.green(`\u2713 all checks passed (${passed})`));
-    console.log(import_chalk29.default.dim("\nStart server: hyv mcp\n"));
+    console.log(import_chalk30.default.green(`\u2713 all checks passed (${passed})`));
+    console.log(import_chalk30.default.dim("\nStart server: hyv mcp\n"));
     return true;
   }
-  console.log(import_chalk29.default.yellow(`! ${failed} check(s) failed, ${passed} passed`));
+  console.log(import_chalk30.default.yellow(`! ${failed} check(s) failed, ${passed} passed`));
   return false;
 }
 
@@ -14869,9 +15357,9 @@ async function exportCommand(format, opts) {
 init_access();
 init_welcome();
 var fs24 = __toESM(require("fs"));
-var path22 = __toESM(require("path"));
+var path23 = __toESM(require("path"));
 var program2 = new Command();
-var pkgPath2 = path22.resolve(__dirname, "..", "package.json");
+var pkgPath2 = path23.resolve(__dirname, "..", "package.json");
 var pkgVersion2 = (() => {
   try {
     return JSON.parse(fs24.readFileSync(pkgPath2, "utf-8")).version;
@@ -14918,15 +15406,15 @@ program2.command("mcp").description("Start MCP server (for Claude Desktop and ot
     return;
   }
   if (opts.setupChatgpt) {
-    console.log(import_chalk30.default.bold("\nhold your voice \u2014 chatgpt setup\n"));
+    console.log(import_chalk31.default.bold("\nhold your voice \u2014 chatgpt setup\n"));
     console.log("To connect HYV to ChatGPT:");
-    console.log(import_chalk30.default.dim("  1. Go to ") + import_chalk30.default.cyan("https://chatgpt.com/#settings/Connectors"));
-    console.log(import_chalk30.default.dim("  2. Add a new connector"));
-    console.log(import_chalk30.default.dim("  3. For local MCP, use: ") + import_chalk30.default.cyan("hyv mcp"));
-    console.log(import_chalk30.default.dim("  4. ChatGPT Desktop supports stdio MCP servers"));
+    console.log(import_chalk31.default.dim("  1. Go to ") + import_chalk31.default.cyan("https://chatgpt.com/#settings/Connectors"));
+    console.log(import_chalk31.default.dim("  2. Add a new connector"));
+    console.log(import_chalk31.default.dim("  3. For local MCP, use: ") + import_chalk31.default.cyan("hyv mcp"));
+    console.log(import_chalk31.default.dim("  4. ChatGPT Desktop supports stdio MCP servers"));
     console.log("");
-    console.log(import_chalk30.default.dim("Note: The remote HTTP MCP endpoint is not yet available."));
-    console.log(import_chalk30.default.dim("Use the local stdio MCP server with Claude Desktop or Claude Code instead."));
+    console.log(import_chalk31.default.dim("Note: The remote HTTP MCP endpoint is not yet available."));
+    console.log(import_chalk31.default.dim("Use the local stdio MCP server with Claude Desktop or Claude Code instead."));
     return;
   }
   startMcpServer();