@lifeaitools/clauth 1.30.3 → 1.30.4

package/cli/commands/serve.js

@@ -14,7 +14,7 @@ import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
 import * as api from "../api.js";
 import chalk from "chalk";
 import ora from "ora";
-import { execSync as execSyncTop } from "child_process";
+import { execFileSync, execSync as execSyncTop } from "child_process";
 import Conf from "conf";
 import { getConfOptions } from "../conf-path.js";
 import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises";
@@ -22,9 +22,9 @@ import fg from "fast-glob";
 import { rgPath } from "@vscode/ripgrep";
 import { createStudioDebugRuntime } from "../studio-debug.js";
 import { writeCredentialWithRecovery } from "../recovery.js";
+import { writeEnrollmentScript } from "../enrollment-script.js";
 import * as fsGit from "../lib/fs-git.js";
 import * as webdavService from "../webdav-service.js";
-import { handleFsTool } from "./serve/tools/fs.js";
 import {
   getWatchdogStatuses,
   readWatchdogEvents,
@@ -137,98 +137,6 @@ END $$;`,
 
 const CURRENT_SCHEMA_VERSION = 6;
 
-function shellSingleQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "''")}'`;
-}
-
-function enrollmentScriptName(label) {
-  const slug = String(label || "new-computer")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40) || "new-computer";
-  return `clauth-enroll-${slug}.ps1`;
-}
-
-function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label }) {
-  const appDir = os.platform() === "win32"
-    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
-    : path.join(os.homedir(), ".config", "clauth");
-  fs.mkdirSync(appDir, { recursive: true });
-  const scriptPath = path.join(appDir, enrollmentScriptName(label));
-  const script = [
-    "$ErrorActionPreference = 'Stop'",
-    "",
-    "# Check prerequisites",
-    "if (-not (Get-Command node -ErrorAction SilentlyContinue)) {",
-    "  Write-Host '\\nERROR: Node.js is not installed.' -ForegroundColor Red",
-    "  Write-Host 'Install Node.js 22+ from https://nodejs.org then re-run this script.' -ForegroundColor Yellow",
-    "  Read-Host 'Press Enter to exit'",
-    "  exit 1",
-    "}",
-    "if (-not (Get-Command npm -ErrorAction SilentlyContinue)) {",
-    "  Write-Host '\\nERROR: npm is not on PATH.' -ForegroundColor Red",
-    "  Write-Host 'Reinstall Node.js from https://nodejs.org (ensure npm is included).' -ForegroundColor Yellow",
-    "  Read-Host 'Press Enter to exit'",
-    "  exit 1",
-    "}",
-    "",
-    "$label = $env:COMPUTERNAME",
-    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
-    "",
-    "Write-Host '\\n=== clauth enrollment ===' -ForegroundColor Cyan",
-    "Write-Host \"Machine: $label\"",
-    "",
-    "Write-Host '\\n[1/3] Installing clauth...' -ForegroundColor Cyan",
-    "try {",
-    "  npm install -g @lifeaitools/clauth@latest",
-    "  if ($LASTEXITCODE -ne 0) { throw 'npm install failed' }",
-    "} catch {",
-    "  Write-Host \"\\nERROR: Failed to install clauth: $_\" -ForegroundColor Red",
-    "  Write-Host 'Check your network connection and npm access.' -ForegroundColor Yellow",
-    "  Read-Host 'Press Enter to exit'",
-    "  exit 1",
-    "}",
-    "",
-    "Write-Host '\\n[2/3] Enrolling this computer...' -ForegroundColor Cyan",
-    "Write-Host 'You will be asked to set a vault password for this machine.' -ForegroundColor Yellow",
-    "try {",
-    "  " + [
-      "clauth setup",
-      `--supabase-url ${shellSingleQuote(supabaseUrl)}`,
-      `--anon-key ${shellSingleQuote(anonKey)}`,
-      `--enrollment-code ${shellSingleQuote(enrollmentCode)}`,
-      "--label \"$label\"",
-    ].join(" "),
-    "  if ($LASTEXITCODE -ne 0) { throw 'clauth setup failed' }",
-    "} catch {",
-    "  Write-Host \"\\nERROR: Enrollment failed: $_\" -ForegroundColor Red",
-    "  Write-Host 'The enrollment code may have expired. Generate a new one from the dashboard.' -ForegroundColor Yellow",
-    "  Read-Host 'Press Enter to exit'",
-    "  exit 1",
-    "}",
-    "",
-    "Write-Host '\\n[3/3] Installing auto-start service...' -ForegroundColor Cyan",
-    "try {",
-    "  clauth serve install",
-    "} catch {",
-    "  Write-Host \"WARNING: Auto-start setup failed: $_\" -ForegroundColor Yellow",
-    "  Write-Host 'clauth is enrolled but will need to be started manually.' -ForegroundColor Yellow",
-    "}",
-    "",
-    "Write-Host '\\n=== clauth enrollment complete ===' -ForegroundColor Green",
-    "Write-Host 'Run: clauth test   to verify the connection'",
-    "Write-Host 'Run: clauth status  to see all services'",
-    "Read-Host '\\nPress Enter to exit'",
-    "",
-    "# Self-delete",
-    "$self = $PSCommandPath",
-    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; Remove-Item -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
-  ].join("\r\n");
-  fs.writeFileSync(scriptPath, `${script}\r\n`, "utf8");
-  return scriptPath;
-}
-
 // ── Key Rotation Config ─────────────────────────────────────────
 // Per-service rotation capabilities. "auto" services can be rotated programmatically.
 // "manual" services require dashboard/UI action. "none" means static keys.
@@ -978,7 +886,8 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
       </div>
     </div>
     <div style="display:flex;gap:8px;margin-top:8px">
-      <button class="btn-chpw-save" onclick="enrollMachine()">Generate Script</button>
+      <button class="btn-chpw-save" onclick="enrollMachine('windows')">Windows Script</button>
+      <button class="btn-chpw-save" onclick="enrollMachine('linux')">Linux Script</button>
       <button class="btn-cancel" onclick="toggleEnrollPanel()">Cancel</button>
     </div>
     <div id="enroll-msg" class="add-msg"></div>
@@ -2440,7 +2349,7 @@ function toggleEnrollPanel() {
   document.getElementById("enroll-result").style.display = "none";
 }
 
-async function enrollMachine() {
+async function enrollMachine(target) {
   const label = document.getElementById("enroll-label").value.trim() || "new-computer";
   const ttl = (Number(document.getElementById("enroll-ttl").value) || 1) * 60;
   const msg = document.getElementById("enroll-msg");
@@ -2451,7 +2360,7 @@ async function enrollMachine() {
     const r = await fetch(BASE + "/enroll-machine", {
       method: "POST",
       headers: writeHeaders({ "Content-Type": "application/json" }),
-      body: JSON.stringify({ label, ttl_minutes: Number(ttl) })
+      body: JSON.stringify({ label, ttl_minutes: Number(ttl), target })
     }).then(r => r.json());
     if (r.locked) { showLockScreen(); return; }
     if (r.error) throw new Error(r.error);
@@ -7490,6 +7399,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
       const label = (body.label || "new-computer").trim();
       const ttlMinutes = Number(body.ttl_minutes) || 60;
+      const target = body.target === "linux" ? "linux" : "windows";
 
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
@@ -7498,7 +7408,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         const localConfig = new Conf(getConfOptions());
         const supabaseUrl = localConfig.get("supabase_url") || process.env.CLAUTH_SUPABASE_URL || "";
         const anonKey = localConfig.get("supabase_anon_key") || process.env.CLAUTH_SUPABASE_ANON_KEY || "";
-        const scriptPath = writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode: result.enrollment_code, label });
+        const scriptPath = writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode: result.enrollment_code, label, target });
         return ok(res, {
           ok: true,
           enrollment_code: result.enrollment_code,
@@ -7566,7 +7476,8 @@ async function actionStart(opts) {
 
   const isStaged = !!opts.staged || process.env.__CLAUTH_STAGED === "1";
   const port     = isStaged ? STAGED_PORT : parseInt(opts.port || String(LIVE_PORT), 10);
-  let password = opts.pw || null;
+  let password = opts.pw || (opts.pwEnv ? process.env.CLAUTH_BOOT_PASSWORD : null);
+  if (opts.pwEnv) delete process.env.CLAUTH_BOOT_PASSWORD;
   let fromBootKey = !!opts.fromBootKey;
 
   // Auto-unlock: if no --pw flag, try to decrypt boot.key (DPAPI on Windows, openssl on Linux)
@@ -7718,10 +7629,12 @@ async function actionStart(opts) {
   const __filename = fileURLToPath(import.meta.url);
   const cliEntry = join(dirname(__filename), "..", "index.js");
 
-  // Build args: node index.js serve start --port N [--pw PW] [--services S]
+  // Build args without the password: long-lived service wrappers keep it out of ps output.
   const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
+  const childEnv = { ...process.env, __CLAUTH_DAEMON: "1", ...(isStaged ? { __CLAUTH_STAGED: "1" } : {}) };
   if (password) {
-    childArgs.push("--pw", password);
+    childArgs.push("--pw-env");
+    childEnv.CLAUTH_BOOT_PASSWORD = password;
     if (fromBootKey) childArgs.push("--from-boot-key");
   }
   if (opts.services) childArgs.push("--services", opts.services);
@@ -7732,7 +7645,7 @@ async function actionStart(opts) {
   const child = spawn(process.execPath, childArgs, {
     detached: true,
     stdio: ["ignore", out, out],
-    env: { ...process.env, __CLAUTH_DAEMON: "1", ...(isStaged ? { __CLAUTH_STAGED: "1" } : {}) },
+    env: childEnv,
     windowsHide: true,
   });
   child.unref();
@@ -9816,6 +9729,160 @@ async function searchServices({ password, machineHash, token, timestamp, query,
   return { query, count: matches.length, matches };
 }
 
+// ── Filesystem service config — loaded from clauth vault ──
+let _fsMountsCache = null;
+let _fsMountsCacheTime = 0;
+const FS_CACHE_TTL = 60000; // 1 minute
+
+async function getFileserverMounts(vault) {
+  if (!vault.password) return { error: "Vault is locked — unlock first" };
+  const now = Date.now();
+  if (_fsMountsCache && now - _fsMountsCacheTime < FS_CACHE_TTL) return { mounts: _fsMountsCache };
+
+  try {
+    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+    const result = await api.status(vault.password, vault.machineHash, token, timestamp);
+    if (result.error) return { error: result.error };
+    const mounts = [];
+    for (const s of (result.services || [])) {
+      if (s.key_type === "fileserver" && s.enabled) {
+        try {
+          const { token: t2, timestamp: ts2 } = deriveToken(vault.password, vault.machineHash);
+          const secret = await api.retrieve(vault.password, vault.machineHash, t2, ts2, s.name);
+          if (secret.value) {
+            const config = JSON.parse(secret.value);
+            mounts.push({ name: s.name, path: config.path, access: config.access || "r" });
+          }
+        } catch {}
+      }
+    }
+    _fsMountsCache = mounts;
+    _fsMountsCacheTime = now;
+    return { mounts };
+  } catch (err) {
+    return { error: `Mount lookup failed: ${err.message}` };
+  }
+}
+
+async function resolveInMount(requestedPath, mountName, vault) {
+  const { mounts, error } = await getFileserverMounts(vault);
+  if (error) return { error };
+  if (!mounts || mounts.length === 0) return { error: "No fileserver services configured. Add one with key_type='fileserver' and value: {\"path\": \"C:/Dev/regen-root\", \"access\": \"rwdg\"}  (access flags: r=read w=write d=delete g=git)" };
+  const mount = mountName ? mounts.find(m => m.name === mountName) : mounts[0];
+  if (!mount) return { error: `Mount '${mountName}' not found. Available: ${mounts.map(m => m.name).join(", ")}` };
+  if (!mount.path) return { error: `Fileserver '${mount.name}' has no path configured` };
+  const resolved = path.resolve(mount.path, requestedPath);
+  const normalized = path.normalize(resolved);
+  const relative = path.relative(path.normalize(mount.path), normalized);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    return { error: `Path escapes mount: ${requestedPath}` };
+  }
+  return { resolved: normalized, mount };
+}
+
+function checkAccess(mount, flag) {
+  return mount.access.includes(flag);
+}
+
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+async function atomicWriteText(filePath, content) {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  const tempPath = path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.tmp-${process.pid}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`
+  );
+  await writeFile(tempPath, content, "utf8");
+  await rename(tempPath, filePath);
+}
+
+async function fileInfo(filePath, requestedPath) {
+  const s = await stat(filePath);
+  const info = {
+    path: requestedPath,
+    type: s.isDirectory() ? "dir" : "file",
+    size: s.size,
+    modified: s.mtime.toISOString(),
+  };
+  if (s.isFile()) {
+    const content = await readFile(filePath);
+    info.sha256 = sha256Hex(content);
+  }
+  return info;
+}
+
+const FS_UPLOAD_SESSIONS = new Map();
+const FS_UPLOAD_TTL_MS = 30 * 60 * 1000;
+const FS_MAX_CHUNKS = 500;
+const FS_MAX_CHUNK_BYTES = 128 * 1024;
+const FS_MAX_INGEST_BYTES = 25 * 1024 * 1024;
+const FS_GIT_IMPORT_ALLOWED_PREFIXES = [
+  "docs/",
+  ".rdc/plans/",
+  ".rdc/guides/",
+  ".claude/context/",
+  ".claude/rules/",
+  ".rdc/relay/from-claude-ai/",
+];
+
+function cleanupFsUploadSessions() {
+  const cutoff = Date.now() - FS_UPLOAD_TTL_MS;
+  for (const [id, session] of FS_UPLOAD_SESSIONS) {
+    if (session.updatedAt < cutoff) FS_UPLOAD_SESSIONS.delete(id);
+  }
+}
+
+function runGit(cwd, args, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: opts.maxBuffer || 10 * 1024 * 1024,
+  });
+  if (res.status !== 0) {
+    const detail = (res.stderr || res.stdout || "").trim();
+    throw new Error(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return (res.stdout || "").trim();
+}
+
+function runGitRaw(cwd, args, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "buffer",
+    windowsHide: true,
+    maxBuffer: opts.maxBuffer || 10 * 1024 * 1024,
+  });
+  if (res.status !== 0) {
+    const detail = Buffer.concat([res.stderr || Buffer.alloc(0), res.stdout || Buffer.alloc(0)]).toString("utf8").trim();
+    throw new Error(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return res.stdout || Buffer.alloc(0);
+}
+
+// Read a single credential value from the vault inside an MCP handler.
+// (The git operations themselves live in ../lib/fs-git.js — pure + testable.)
+async function vaultRetrieveValue(vault, service) {
+  if (!vault.password) return { error: "locked" };
+  if (vault.whitelist && !vault.whitelist.includes(service.toLowerCase())) return { error: "not_in_whitelist" };
+  const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+  return api.retrieve(vault.password, vault.machineHash, token, timestamp, service);
+}
+
+function normalizeRepoPath(p) {
+  if (!p || typeof p !== "string") return null;
+  const normalized = p.replace(/\\/g, "/").replace(/^\/+/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  if (parts.length === 0 || parts.includes("..") || path.isAbsolute(p)) return null;
+  return parts.join("/");
+}
+
+function isAllowedGitImportPath(p, allowedPrefixes = FS_GIT_IMPORT_ALLOWED_PREFIXES) {
+  return allowedPrefixes.some((prefix) => p === prefix.replace(/\/$/, "") || p.startsWith(prefix));
+}
+
 const MCP_TOOLS = [
   {
     name: "clauth_ping",
@@ -10853,14 +10920,6 @@ async function handleMcpTool(vault, name, args) {
     return mcpError("MCP write tools are disabled by default. Launch clauth with CLAUTH_MCP_WRITE=1 for an explicit write-capable session.");
   };
 
-  // fs_* tools are extracted to serve/tools/fs.js
-  if (name.startsWith("fs_")) {
-    const fsCtx = { vault, mcpResult, mcpError, deriveToken, api, webdavService, fsGit };
-    const fsResult = await handleFsTool(name, args, fsCtx);
-    if (fsResult !== null) return fsResult;
-    return mcpError(`Unknown tool: ${name}`);
-  }
-
   switch (name) {
     case "clauth_ping": {
       return mcpResult(
@@ -11323,6 +11382,603 @@ async function handleMcpTool(vault, name, args) {
 
     // ── Filesystem tools ──────────────────────────────────────
 
+    case "fs_read": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const content = await readFile(r.resolved, "utf8");
+        const lines = content.split("\n");
+        const offset = args.offset || 0;
+        const limit = args.limit || 500;
+        const slice = lines.slice(offset, offset + limit);
+        const numbered = slice.map((line, i) => `${offset + i + 1}\t${line}`).join("\n");
+        const header = `${r.resolved} (${lines.length} lines${offset > 0 ? `, showing ${offset + 1}-${Math.min(offset + limit, lines.length)}` : ""})`;
+        return mcpResult(`${header}\n${numbered}`);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`File not found: ${args.path}`);
+        return mcpError(`Read failed: ${err.message}`);
+      }
+    }
+
+    case "fs_write": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        await atomicWriteText(r.resolved, args.content);
+        return mcpResult(`Written: ${args.path} (${Buffer.byteLength(args.content)} bytes)`);
+      } catch (err) {
+        return mcpError(`Write failed: ${err.message}`);
+      }
+    }
+
+    case "fs_stat": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        return mcpResult(JSON.stringify(await fileInfo(r.resolved, args.path), null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Not found: ${args.path}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+    }
+
+    case "fs_append": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        try {
+          const current = await readFile(r.resolved);
+          if (args.expected_sha256 && sha256Hex(current) !== args.expected_sha256) {
+            return mcpError("Append rejected: current file hash does not match expected_sha256");
+          }
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+          if (args.expected_sha256) return mcpError("Append rejected: file does not exist for expected_sha256 guard");
+        }
+        await mkdir(path.dirname(r.resolved), { recursive: true });
+        await appendFile(r.resolved, args.content, "utf8");
+        const info = await fileInfo(r.resolved, args.path);
+        return mcpResult(JSON.stringify({ appended_bytes: Buffer.byteLength(args.content), ...info }, null, 2));
+      } catch (err) {
+        return mcpError(`Append failed: ${err.message}`);
+      }
+    }
+
+    case "fs_write_chunk": {
+      cleanupFsUploadSessions();
+      const { upload_id, chunk_index, total_chunks, content } = args;
+      const index = Number(chunk_index);
+      const total = Number(total_chunks);
+      if (!Number.isInteger(index) || !Number.isInteger(total) || index < 0 || total < 1 || index >= total) {
+        return mcpError("Invalid chunk_index/total_chunks");
+      }
+      if (total > FS_MAX_CHUNKS) return mcpError(`Too many chunks: max ${FS_MAX_CHUNKS}`);
+      if (Buffer.byteLength(content, "utf8") > FS_MAX_CHUNK_BYTES) {
+        return mcpError(`Chunk too large: max ${FS_MAX_CHUNK_BYTES} bytes`);
+      }
+
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      const key = `${r.mount.name}:${args.path}:${upload_id}`;
+      let session = FS_UPLOAD_SESSIONS.get(key);
+      if (!session) {
+        session = { path: args.path, resolved: r.resolved, total, chunks: new Map(), expectedSha256: args.expected_sha256 || null, updatedAt: Date.now() };
+        FS_UPLOAD_SESSIONS.set(key, session);
+      }
+      if (session.total !== total || session.path !== args.path || session.resolved !== r.resolved) {
+        return mcpError("Upload id collision: path or total_chunks differs from existing session");
+      }
+      if (args.expected_sha256 && session.expectedSha256 && args.expected_sha256 !== session.expectedSha256) {
+        return mcpError("Upload id collision: expected_sha256 differs from existing session");
+      }
+
+      session.chunks.set(index, content);
+      session.updatedAt = Date.now();
+
+      if (session.chunks.size < total) {
+        return mcpResult(JSON.stringify({ upload_id, status: "staged", received_chunks: session.chunks.size, total_chunks: total }, null, 2));
+      }
+
+      const assembled = Array.from({ length: total }, (_, i) => session.chunks.get(i)).join("");
+      const actualSha = sha256Hex(assembled);
+      if (session.expectedSha256 && actualSha !== session.expectedSha256) {
+        FS_UPLOAD_SESSIONS.delete(key);
+        return mcpError(`Final SHA-256 mismatch: expected ${session.expectedSha256}, got ${actualSha}`);
+      }
+
+      try {
+        await atomicWriteText(r.resolved, assembled);
+        FS_UPLOAD_SESSIONS.delete(key);
+        return mcpResult(JSON.stringify({ upload_id, status: "written", path: args.path, bytes: Buffer.byteLength(assembled), sha256: actualSha }, null, 2));
+      } catch (err) {
+        return mcpError(`Chunked write failed: ${err.message}`);
+      }
+    }
+
+    case "fs_ingest_url": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      let url;
+      try {
+        url = new URL(args.url);
+      } catch {
+        return mcpError("Invalid URL");
+      }
+      if (!["http:", "https:"].includes(url.protocol)) return mcpError("Only http(s) URLs are supported");
+
+      const maxBytes = Math.min(Number(args.max_bytes || 5 * 1024 * 1024), FS_MAX_INGEST_BYTES);
+      try {
+        const response = await fetch(url, { redirect: "follow" });
+        if (!response.ok) return mcpError(`Fetch failed: HTTP ${response.status}`);
+        const length = Number(response.headers.get("content-length") || 0);
+        if (length && length > maxBytes) return mcpError(`Fetch rejected: content-length ${length} exceeds max_bytes ${maxBytes}`);
+
+        const reader = response.body?.getReader();
+        if (!reader) return mcpError("Fetch failed: response body is not readable");
+
+        let received = 0;
+        const chunks = [];
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          received += value.byteLength;
+          if (received > maxBytes) return mcpError(`Fetch rejected: response exceeds max_bytes ${maxBytes}`);
+          chunks.push(Buffer.from(value));
+        }
+
+        const content = Buffer.concat(chunks).toString("utf8");
+        const actualSha = sha256Hex(content);
+        if (args.expected_sha256 && actualSha !== args.expected_sha256) {
+          return mcpError(`Fetched SHA-256 mismatch: expected ${args.expected_sha256}, got ${actualSha}`);
+        }
+        await atomicWriteText(r.resolved, content);
+        return mcpResult(JSON.stringify({ status: "written", path: args.path, bytes: Buffer.byteLength(content), sha256: actualSha, source: url.href }, null, 2));
+      } catch (err) {
+        return mcpError(`Ingest failed: ${err.message}`);
+      }
+    }
+
+    case "fs_import_git_files": {
+      if (!Array.isArray(args.paths) || args.paths.length === 0) return mcpError("paths must be a non-empty array");
+      if (args.paths.length > 25) return mcpError("Too many paths: max 25 per import");
+
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+
+      const repoRoot = r.resolved;
+      const remote = args.remote || "origin";
+      const mode = args.mode || "new_only";
+      const doCommit = args.commit === true;
+      const allowedPrefixes = Array.isArray(args.allowed_prefixes) && args.allowed_prefixes.length > 0
+        ? args.allowed_prefixes.map((p) => normalizeRepoPath(p.endsWith("/") ? p : `${p}/`)).filter(Boolean)
+        : FS_GIT_IMPORT_ALLOWED_PREFIXES;
+
+      try {
+        const topLevel = path.normalize(runGit(repoRoot, ["rev-parse", "--show-toplevel"]));
+        if (topLevel.toLowerCase() !== path.normalize(repoRoot).toLowerCase()) {
+          return mcpError(`Mount root is not the git repo root: ${repoRoot} (repo root: ${topLevel})`);
+        }
+
+        const normalizedPaths = [];
+        for (const rawPath of args.paths) {
+          const normalized = normalizeRepoPath(rawPath);
+          if (!normalized) return mcpError(`Invalid repo path: ${rawPath}`);
+          if (!isAllowedGitImportPath(normalized, allowedPrefixes)) return mcpError(`Path not allowed for git import: ${normalized}`);
+          normalizedPaths.push(normalized);
+        }
+
+        if (mode === "new_only") {
+          for (const rel of normalizedPaths) {
+            const localPath = path.join(repoRoot, rel);
+            try {
+              await stat(localPath);
+              return mcpError(`Import refused: local path already exists in new_only mode: ${rel}`);
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+            }
+          }
+        }
+
+        if (doCommit) {
+          const staged = runGit(repoRoot, ["diff", "--cached", "--name-only"]);
+          if (staged) return mcpError(`Import refused: index already has staged files:\n${staged}`);
+          if (!args.message || !args.message.trim()) return mcpError("message is required when commit=true");
+        }
+
+        runGit(repoRoot, ["fetch", "--no-tags", remote, args.ref]);
+        const sourceCommit = runGit(repoRoot, ["rev-parse", "FETCH_HEAD"]);
+
+        for (const rel of normalizedPaths) {
+          runGit(repoRoot, ["cat-file", "-e", `${sourceCommit}:${rel}`]);
+        }
+
+        runGit(repoRoot, ["restore", `--source=${sourceCommit}`, "--", ...normalizedPaths]);
+
+        const imported = [];
+        for (const rel of normalizedPaths) {
+          const localPath = path.join(repoRoot, rel);
+          const info = await fileInfo(localPath, rel);
+          const sourceBlob = runGit(repoRoot, ["rev-parse", `${sourceCommit}:${rel}`]);
+          const sourceSize = Number(runGitRaw(repoRoot, ["cat-file", "-s", `${sourceCommit}:${rel}`]).toString("utf8").trim());
+          imported.push({ ...info, source_blob: sourceBlob, source_size: sourceSize });
+        }
+
+        let localCommit = null;
+        if (doCommit) {
+          runGit(repoRoot, ["add", "--", ...normalizedPaths]);
+          const body = [
+            args.message.trim(),
+            "",
+            "Imported from Claude.ai GitHub upload.",
+            "",
+            `Source remote: ${remote}`,
+            `Source ref: ${args.ref}`,
+            `Source commit: ${sourceCommit}`,
+            "",
+            "Paths:",
+            ...normalizedPaths.map((p) => `- ${p}`),
+          ].join("\n");
+          runGit(repoRoot, ["commit", "-m", body]);
+          localCommit = runGit(repoRoot, ["rev-parse", "HEAD"]);
+        }
+
+        return mcpResult(JSON.stringify({
+          status: "ok",
+          mode,
+          committed: doCommit,
+          source_commit: sourceCommit,
+          local_commit: localCommit,
+          imported,
+        }, null, 2));
+      } catch (err) {
+        return mcpError(`Git import failed: ${err.message}`);
+      }
+    }
+
+    case "fs_list": {
+      const dirPath = args.path || ".";
+      const r = await resolveInMount(dirPath, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const entries = await readdir(r.resolved, { withFileTypes: true });
+        const results = [];
+        for (const entry of entries) {
+          try {
+            const s = await stat(path.join(r.resolved, entry.name));
+            results.push({
+              name: entry.name,
+              type: entry.isDirectory() ? "dir" : "file",
+              size: s.size,
+              modified: s.mtime.toISOString(),
+            });
+          } catch {
+            results.push({ name: entry.name, type: entry.isDirectory() ? "dir" : "file" });
+          }
+        }
+        return mcpResult(JSON.stringify(results, null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Directory not found: ${dirPath}`);
+        return mcpError(`List failed: ${err.message}`);
+      }
+    }
+
+    case "fs_grep": {
+      const searchPath = args.path || ".";
+      const r = await resolveInMount(searchPath, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+
+      const maxResults = args.max_results || 50;
+      const rgArgs = [
+        "--no-heading", "--line-number", "--color", "never",
+        "--max-count", String(maxResults),
+      ];
+      if (args.context) rgArgs.push("-C", String(args.context));
+      if (args.glob) rgArgs.push("--glob", args.glob);
+      rgArgs.push(args.pattern, r.resolved);
+
+      return new Promise((resolve) => {
+        let output = "";
+        let killed = false;
+        const proc = spawnProc(rgPath, rgArgs, { timeout: 15000, windowsHide: true });
+
+        proc.stdout.on("data", (chunk) => {
+          output += chunk.toString();
+          if (output.length > 65536) { // 64KB cap
+            killed = true;
+            proc.kill();
+          }
+        });
+        proc.stderr.on("data", () => {}); // ignore stderr
+
+        proc.on("close", (code) => {
+          if (killed) {
+            resolve(mcpResult(output.slice(0, 65536) + "\n... (output truncated at 64KB)"));
+          } else if (code === 1) {
+            resolve(mcpResult("No matches found"));
+          } else if (output) {
+            // Make paths relative to mount
+            const mountNorm = r.mount.path.replace(/\\/g, "/");
+            const cleaned = output.replace(new RegExp(mountNorm.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + "/?", "g"), "");
+            resolve(mcpResult(cleaned));
+          } else {
+            resolve(mcpResult("No matches found"));
+          }
+        });
+
+        proc.on("error", (err) => {
+          resolve(mcpError(`Grep failed: ${err.message}`));
+        });
+      });
+    }
+
+    case "fs_glob": {
+      const basePath = args.path || ".";
+      const r = await resolveInMount(basePath, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied on this mount");
+      try {
+        const matches = await fg(args.pattern, {
+          cwd: r.resolved,
+          dot: false,
+          onlyFiles: true,
+          ignore: ["**/node_modules/**", "**/.git/**"],
+        });
+        if (matches.length === 0) return mcpResult("No files matched");
+        return mcpResult(matches.sort().join("\n"));
+      } catch (err) {
+        return mcpError(`Glob failed: ${err.message}`);
+      }
+    }
+
+    case "fs_delete": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "d")) return mcpError("Delete access denied on this mount");
+      try {
+        const s = await stat(r.resolved);
+        await rm(r.resolved, { recursive: s.isDirectory() });
+        return mcpResult(`Deleted: ${args.path}`);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Not found: ${args.path}`);
+        return mcpError(`Delete failed: ${err.message}`);
+      }
+    }
+
+    case "fs_mkdir": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        await mkdir(r.resolved, { recursive: true });
+        return mcpResult(`Created: ${args.path}`);
+      } catch (err) {
+        return mcpError(`Mkdir failed: ${err.message}`);
+      }
+    }
+
+    case "fs_edit": {
+      if (typeof args.old_string !== "string" || typeof args.new_string !== "string") {
+        return mcpError("old_string and new_string must be strings");
+      }
+      if (args.old_string === args.new_string) {
+        return mcpError("old_string and new_string must differ");
+      }
+      if (args.old_string.length === 0) {
+        return mcpError("old_string must not be empty");
+      }
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied on this mount");
+      try {
+        const current = await readFile(r.resolved, "utf8");
+        if (args.expected_sha256 && sha256Hex(current) !== args.expected_sha256) {
+          return mcpError("Edit rejected: current file hash does not match expected_sha256");
+        }
+        const parts = current.split(args.old_string);
+        const occurrences = parts.length - 1;
+        if (occurrences === 0) {
+          return mcpError(`Edit failed: old_string not found in ${args.path}`);
+        }
+        if (occurrences > 1 && !args.replace_all) {
+          return mcpError(`Edit failed: old_string is not unique (${occurrences} matches in ${args.path}). Set replace_all=true to replace all, or provide more surrounding context.`);
+        }
+        const updated = args.replace_all
+          ? parts.join(args.new_string)
+          : current.replace(args.old_string, args.new_string);
+        await atomicWriteText(r.resolved, updated);
+        const info = await fileInfo(r.resolved, args.path);
+        return mcpResult(JSON.stringify({ replacements: args.replace_all ? occurrences : 1, ...info }, null, 2));
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`File not found: ${args.path}`);
+        return mcpError(`Edit failed: ${err.message}`);
+      }
+    }
+
+    case "fs_move": {
+      const src = await resolveInMount(args.from, args.mount, vault);
+      if (src.error) return mcpError(src.error);
+      const dst = await resolveInMount(args.to, args.mount, vault);
+      if (dst.error) return mcpError(dst.error);
+      if (!checkAccess(src.mount, "w") || !checkAccess(src.mount, "d")) {
+        return mcpError("Move requires write+delete access on this mount");
+      }
+      try {
+        await stat(src.resolved);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Source not found: ${args.from}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+      let dstExists = false;
+      try {
+        await stat(dst.resolved);
+        dstExists = true;
+      } catch (err) {
+        if (err.code !== "ENOENT") return mcpError(`Stat failed: ${err.message}`);
+      }
+      if (dstExists && !args.overwrite) {
+        return mcpError(`Move refused: destination already exists: ${args.to} (use overwrite=true)`);
+      }
+      try {
+        await mkdir(path.dirname(dst.resolved), { recursive: true });
+        if (dstExists && args.overwrite) {
+          const dstStat = await stat(dst.resolved);
+          await rm(dst.resolved, { recursive: dstStat.isDirectory(), force: true });
+        }
+        try {
+          await rename(src.resolved, dst.resolved);
+        } catch (err) {
+          if (err.code === "EXDEV") {
+            await cp(src.resolved, dst.resolved, { recursive: true, errorOnExist: false, force: true });
+            const srcStat = await stat(src.resolved);
+            await rm(src.resolved, { recursive: srcStat.isDirectory(), force: true });
+          } else {
+            throw err;
+          }
+        }
+        return mcpResult(JSON.stringify({ status: "moved", from: args.from, to: args.to }, null, 2));
+      } catch (err) {
+        return mcpError(`Move failed: ${err.message}`);
+      }
+    }
+
+    case "fs_copy": {
+      const src = await resolveInMount(args.from, args.mount, vault);
+      if (src.error) return mcpError(src.error);
+      const dst = await resolveInMount(args.to, args.mount, vault);
+      if (dst.error) return mcpError(dst.error);
+      if (!checkAccess(src.mount, "r")) return mcpError("Read access denied on this mount");
+      if (!checkAccess(src.mount, "w")) return mcpError("Write access denied on this mount");
+      let srcStat;
+      try {
+        srcStat = await stat(src.resolved);
+      } catch (err) {
+        if (err.code === "ENOENT") return mcpError(`Source not found: ${args.from}`);
+        return mcpError(`Stat failed: ${err.message}`);
+      }
+      let dstExists = false;
+      try {
+        await stat(dst.resolved);
+        dstExists = true;
+      } catch (err) {
+        if (err.code !== "ENOENT") return mcpError(`Stat failed: ${err.message}`);
+      }
+      if (dstExists && !args.overwrite) {
+        return mcpError(`Copy refused: destination already exists: ${args.to} (use overwrite=true)`);
+      }
+      try {
+        await mkdir(path.dirname(dst.resolved), { recursive: true });
+        await cp(src.resolved, dst.resolved, {
+          recursive: true,
+          errorOnExist: false,
+          force: !!args.overwrite,
+        });
+        return mcpResult(JSON.stringify({
+          status: "copied",
+          from: args.from,
+          to: args.to,
+          type: srcStat.isDirectory() ? "dir" : "file",
+        }, null, 2));
+      } catch (err) {
+        return mcpError(`Copy failed: ${err.message}`);
+      }
+    }
+
+    case "fs_mounts": {
+      const { mounts, error } = await getFileserverMounts(vault);
+      if (error) return mcpError(error);
+      if (!mounts || mounts.length === 0) return mcpResult("No fileserver mounts configured. Create one:\n1. Use clauth dashboard or clauth_enable to add a service with key_type='fileserver'\n2. Set the secret value to JSON: {\"path\": \"C:/Dev/regen-root\", \"access\": \"rwdg\"}  (add 'g' to allow the git verbs: fs_commit, fs_use_branch, fs_repo_status)");
+      // Decode the access string so callers know what's possible BEFORE trying —
+      // notably `git` (the git verbs require it; absent = explain how to enable).
+      const decorated = mounts.map((m) => {
+        const a = String(m.access || "");
+        return { ...m, can: { read: a.includes("r"), write: a.includes("w"), delete: a.includes("d"), git: a.includes("g") } };
+      });
+      return mcpResult(JSON.stringify(decorated, null, 2));
+    }
+
+    case "fs_repo_status": {
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.repoStatus(r.resolved);
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Status failed: ${err.message}`);
+      }
+    }
+
+    case "fs_use_branch": {
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.useBranch(r.resolved, args.branch, args.create === true);
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Branch switch failed: ${err.message}`);
+      }
+    }
+
+    case "fs_commit": {
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      const push = args.push !== false;
+      const dryRun = args.dry_run === true;
+      // Fetch the push token from the vault up front (commit happens first, so
+      // a missing token still preserves the local commit). Skipped on dry-run.
+      let token = null, tokenError = null;
+      if (push && !dryRun) {
+        const sec = await vaultRetrieveValue(vault, "github");
+        if (sec.error || !sec.value) tokenError = `could not read the 'github' token (${sec.error || "empty"})`;
+        else token = sec.value;
+      }
+      try {
+        const { result, error } = await fsGit.commit(r.resolved, {
+          message: args.message,
+          paths: args.paths,
+          push,
+          dryRun,
+          expectedHead: args.expected_head,
+          remote: args.remote,
+          token,
+          tokenError,
+          authorName: args.author_name,
+          authorEmail: args.author_email,
+        });
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Commit failed: ${err.message}`);
+      }
+    }
+
+    case "fs_diff": {
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "g")) return mcpError("Git access denied on this mount. Add 'g' to the mount's access string (e.g. 'rwdg') to enable the git verbs.");
+      try {
+        const { result, error } = await fsGit.diff(r.resolved, { paths: args.paths, ref: args.ref, staged: args.staged === true });
+        if (error) return mcpError(error);
+        return mcpResult(JSON.stringify(result, null, 2));
+      } catch (err) {
+        return mcpError(`Diff failed: ${err.message}`);
+      }
+    }
 
     case "call_agent": {
       const result = await runCallAgent(args || {});
@@ -11511,6 +12167,271 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(JSON.stringify(result));
     }
 
+    case "fs_exec": {
+      const r = await resolveInMount(args.cwd || ".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      const EXEC_ALLOWLIST = [
+        "git","pnpm","npx","node","python","python3","rclone","bash",
+        "cat","grep","find","wc","sha256sum","date","echo","tsc","eslint",
+        "ping","where","which","ls","dir","head","tail","sort","uniq","diff","curl",
+        "pip","docker","docker-compose","pm2","cloudflared",
+        "ssh-keygen","tar","netstat",
+        "get-filehash","get-content","select-string","test-path",
+        "get-childitem","measure-object","certutil","pwsh",
+        "copy-item","move-item","remove-item","new-item",
+        "rename-item","set-content","add-content","out-file",
+        "convertto-json","convertfrom-json","select-xml",
+        "invoke-webrequest",
+        "format-table","format-list",
+        "sort-object","where-object","group-object",
+        "write-output","out-string",
+        "get-nettcpconnection","get-process","stop-process",
+        "get-service","get-eventlog","get-date",
+        "compress-archive","expand-archive",
+      ];
+      const EXEC_BLOCKED = ["invoke-expression","iex","start-process","set-executionpolicy","reg","regedit","format","shutdown","restart-computer","reboot","mkfs","dd","cmd","del"];
+      const MAX_STDOUT = 102400;
+      if (!Array.isArray(args.command) || args.command.length === 0) return mcpError("command must be a non-empty array");
+      const cmd0 = path.basename(args.command[0]).replace(/\.exe$/i, "").toLowerCase();
+      if (EXEC_BLOCKED.includes(cmd0)) return mcpError(`Blocked command: ${cmd0}`);
+      if (!EXEC_ALLOWLIST.includes(cmd0)) return mcpError(`Command not in allowlist: ${cmd0}. Allowed: ${EXEC_ALLOWLIST.join(", ")}`);
+      if (args.command.includes("--force") && cmd0 === "git" && args.command.includes("push")) return mcpError("Force-push blocked");
+      if (cmd0 === "git" && args.command.includes("push") && (args.command.includes("main") || args.command.includes("master"))) return mcpError("Push to main/master blocked");
+      const timeout = Math.min(Number(args.timeout_seconds || 30), 300) * 1000;
+      const startTime = Date.now();
+      try {
+        const { execFile, exec } = await import("child_process");
+        const result = await new Promise((resolve, reject) => {
+          const execEnv = { ...process.env, ...(args.env || {}) };
+          if (os.platform() === "win32") {
+            const extra = ["C:\\Program Files\\Git\\cmd", "C:\\Program Files\\Git\\bin", "C:\\Program Files\\nodejs", process.env.APPDATA ? process.env.APPDATA + "\\npm" : ""].filter(Boolean).join(";");
+            const pathKey = Object.keys(execEnv).find(k => k.toUpperCase() === "PATH") || "Path";
+            execEnv[pathKey] = extra + ";" + (execEnv[pathKey] || "");
+          }
+          const useShell = args.shell || os.platform() === "win32";
+          const shellBin = os.platform() === "win32" ? "pwsh.exe" : true;
+          const opts = { cwd: r.resolved, timeout, maxBuffer: MAX_STDOUT, windowsHide: true, env: execEnv, shell: useShell ? shellBin : false };
+          const cb = (err, stdout, stderr) => {
+            const duration = Date.now() - startTime;
+            const truncated = (stdout?.length || 0) >= MAX_STDOUT || (stderr?.length || 0) >= MAX_STDOUT;
+            if (err && !err.killed) resolve({ stdout: stdout || "", stderr: stderr || err.message, exit_code: err.code || 1, duration_ms: duration, truncated });
+            else if (err?.killed) resolve({ stdout: stdout || "", stderr: "Process killed (timeout)", exit_code: 137, duration_ms: duration, truncated: true });
+            else resolve({ stdout: stdout || "", stderr: stderr || "", exit_code: 0, duration_ms: duration, truncated });
+          };
+          const psEscape = (s) => "'" + s.replace(/'/g, "''") + "'";
+          if (os.platform() === "win32") {
+            const psCmd = args.shell
+              ? args.command.join(" ")
+              : "& " + args.command.map(psEscape).join(" ");
+            exec(psCmd, opts, cb);
+          } else if (useShell) {
+            exec(args.command.join(" "), opts, cb);
+          } else {
+            execFile(args.command[0], args.command.slice(1), opts, cb);
+          }
+        });
+        const auditLine = JSON.stringify({ ts: new Date().toISOString(), mount: r.mount.name, command: args.command, cwd: args.cwd || ".", exit_code: result.exit_code, duration_ms: result.duration_ms }) + "\n";
+        try { await appendFile(path.join(os.tmpdir(), "fs-exec-audit.jsonl"), auditLine); } catch {}
+        return mcpResult(JSON.stringify(result));
+      } catch (err) {
+        return mcpError(`exec failed: ${err.message}`);
+      }
+    }
+
+    case "fs_hash": {
+      const r = await resolveInMount(".", args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      if (!Array.isArray(args.paths) || args.paths.length === 0) return mcpError("paths must be a non-empty array");
+      if (args.paths.length > 50) return mcpError("Max 50 paths per call");
+      const algo = args.algorithm || "sha256";
+      if (!["sha256", "md5", "sha1"].includes(algo)) return mcpError("algorithm must be sha256, md5, or sha1");
+      const results = [];
+      for (const p of args.paths) {
+        const fp = await resolveInMount(p, args.mount, vault);
+        if (fp.error) { results.push({ path: p, error: fp.error }); continue; }
+        try {
+          const content = await readFile(fp.resolved);
+          const hash = crypto.createHash(algo).update(content).digest("hex");
+          results.push({ path: p, hash, bytes: content.length });
+        } catch (err) {
+          results.push({ path: p, error: err.message });
+        }
+      }
+      return mcpResult(JSON.stringify({ results }));
+    }
+
+    case "fs_cat_lines": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      try {
+        const content = await readFile(r.resolved, "utf8");
+        const allLines = content.split("\n");
+        const start = Math.max(1, Math.floor(args.start_line)) - 1;
+        const end = args.end_line ? Math.min(Math.floor(args.end_line), allLines.length) : allLines.length;
+        const selected = allLines.slice(start, end);
+        return mcpResult(JSON.stringify({ path: args.path, start: start + 1, end, total_lines: allLines.length, content: selected.join("\n") }));
+      } catch (err) {
+        return mcpError(`Read failed: ${err.message}`);
+      }
+    }
+
+    case "fs_grep_json": {
+      const searchPath = args.path || ".";
+      const r = await resolveInMount(searchPath, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      const maxResults = Math.min(Number(args.max_results || 50), 200);
+      const ctx = Math.min(Number(args.context_lines || 0), 10);
+      try {
+        const rgArgs = ["--json", "-e", args.pattern, "--max-count", String(maxResults)];
+        if (ctx > 0) rgArgs.push("-C", String(ctx));
+        if (args.glob) rgArgs.push("-g", args.glob);
+        rgArgs.push(r.resolved);
+        const raw = execSyncTop(`"${rgPath}" ${rgArgs.map(a => `"${a}"`).join(" ")}`, { encoding: "utf8", timeout: 30000, windowsHide: true, maxBuffer: 1024 * 1024 });
+        const matches = [];
+        for (const line of raw.split("\n").filter(Boolean)) {
+          try {
+            const obj = JSON.parse(line);
+            if (obj.type === "match") {
+              const rel = path.relative(r.resolved, obj.data.path.text).replace(/\\/g, "/");
+              matches.push({ file: rel, line: obj.data.line_number, match: obj.data.lines.text.trimEnd() });
+            }
+          } catch {}
+        }
+        return mcpResult(JSON.stringify({ matches, total_matches: matches.length, truncated: matches.length >= maxResults }));
+      } catch (err) {
+        if (err.status === 1) return mcpResult(JSON.stringify({ matches: [], total_matches: 0, truncated: false }));
+        return mcpError(`grep failed: ${err.message}`);
+      }
+    }
+
+    case "fs_search": {
+      const searchBase = args.path || ".";
+      const r = await resolveInMount(searchBase, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "r")) return mcpError("Read access denied");
+      const maxResults = Math.min(Number(args.max_results || 50), 200);
+      try {
+        const globPattern = args.query || (args.file_types ? `**/*{${args.file_types.join(",")}}` : "**/*");
+        const files = await fg(globPattern, { cwd: r.resolved, absolute: true, stats: true, dot: false, ignore: ["**/node_modules/**", "**/.next/**", "**/.git/**"] });
+        let results = [];
+        for (const f of files) {
+          const st = f.stats || {};
+          const mtime = st.mtime ? new Date(st.mtime) : null;
+          if (args.modified_after && mtime && mtime < new Date(args.modified_after)) continue;
+          if (args.modified_before && mtime && mtime > new Date(args.modified_before)) continue;
+          const rel = path.relative(r.resolved, f.path).replace(/\\/g, "/");
+          const entry = { path: rel, size: st.size || 0, modified: mtime?.toISOString() || null };
+          if (args.content_pattern) {
+            try {
+              const text = await readFile(f.path, "utf8");
+              const match = text.match(new RegExp(args.content_pattern));
+              if (!match) continue;
+              const lineIdx = text.substring(0, match.index).split("\n").length;
+              entry.match_line = lineIdx;
+              entry.match_text = match[0].slice(0, 200);
+            } catch { continue; }
+          }
+          results.push(entry);
+          if (results.length >= maxResults) break;
+        }
+        return mcpResult(JSON.stringify({ results, total: results.length }));
+      } catch (err) {
+        return mcpError(`search failed: ${err.message}`);
+      }
+    }
+
+    case "fs_put": {
+      const r = await resolveInMount(args.path, args.mount, vault);
+      if (r.error) return mcpError(r.error);
+      if (!checkAccess(r.mount, "w")) return mcpError("Write access denied");
+      try {
+        const exists = await stat(r.resolved).then(() => true).catch(() => false);
+        if (exists && !args.overwrite) return mcpError(`File exists: ${args.path} (set overwrite=true)`);
+        const buf = Buffer.from(args.content_base64, "base64");
+        const dir = path.dirname(r.resolved);
+        await mkdir(dir, { recursive: true });
+        await atomicWriteText(r.resolved, buf);
+        const hash = crypto.createHash("sha256").update(buf).digest("hex");
+        return mcpResult(JSON.stringify({ path: args.path, bytes: buf.length, sha256: hash }));
+      } catch (err) {
+        return mcpError(`Put failed: ${err.message}`);
+      }
+    }
+
+    case "fs_dav_setup": {
+      if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
+      const ttl = Math.min(Number(args.ttl_seconds || 14400), 86400);
+
+      const startResult = await webdavService.ensureRunning(() => vault);
+      if (startResult.error) return mcpError(`WebDAV setup failed: ${startResult.error}`);
+
+      const wdStatus = webdavService.getStatus();
+      if (wdStatus.status === "error") {
+        return mcpError(
+          `WebDAV child error: ${wdStatus.error}\n` +
+          `Restarts so far: ${wdStatus.restart_count}. Retry or check clauth logs.`
+        );
+      }
+
+      // Fetch plaintext credential — the sandbox's own rclone obscures it in the script
+      let plainPass = "";
+      try {
+        const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+        const cr = await api.retrieve(vault.password, vault.machineHash, token, timestamp, "webdav-claude");
+        if (cr.value) plainPass = cr.value;
+      } catch {}
+
+      const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
+
+      const setupScript = [
+        "#!/usr/bin/env bash",
+        "# WebDAV setup — generated by fs_dav_setup (clauth)",
+        `# Expires hint: ${expiresAt}`,
+        "set -e",
+        "",
+        "# Configure rclone WebDAV remote via env vars (no config file, no mount, no daemon)",
+        "export RCLONE_CONFIG_DAV_TYPE=webdav",
+        "export RCLONE_CONFIG_DAV_URL=https://dav.regendevcorp.com",
+        "export RCLONE_CONFIG_DAV_VENDOR=rclone",
+        "export RCLONE_CONFIG_DAV_USER=claude",
+        plainPass
+          ? `export RCLONE_CONFIG_DAV_PASS=$(rclone obscure "${plainPass}")`
+          : "# RCLONE_CONFIG_DAV_PASS — no credential found in vault",
+        "",
+        "# Verify connectivity",
+        "rclone lsd dav: --quiet",
+        'echo "DAV ready — use rclone commands directly:"',
+        'echo "  rclone lsd dav:corpus/         # list dirs"',
+        'echo "  rclone cat dav:corpus/file.md   # read file"',
+        'echo "  rclone rcat dav:dev/file.txt <<< content  # write file"',
+        'echo "  rclone copy local/ dav:dev/path/  # upload"',
+        'echo "  rclone cat dav:file | grep pattern  # search"',
+      ].join("\n");
+
+      return mcpResult(JSON.stringify({
+        status:      wdStatus.status,
+        url:         "https://dav.regendevcorp.com",
+        setup_script: setupScript,
+        expires_at:  expiresAt,
+        ttl_seconds: ttl,
+        webdav_user: "claude",
+        started_at:  wdStatus.started_at,
+        mounts: (webdavService.loadConfig().upstreams || []).map(u => ({
+          rclone_path: `dav:${u.name}/`,
+          host_path: u.path,
+          description: u.name === "corpus" ? "Global corpus ($CORPUS_ROOT on host — Google Drive)" : `Local filesystem (${u.path} on host)`,
+        })),
+        deprecated_tools: ["fs_read", "fs_list", "fs_stat", "fs_edit", "fs_mkdir", "fs_use_branch"],
+        deprecated_note: "Use WebDAV (rclone cat/ls/lsd) instead — 37-56x faster. These tools remain as fallback.",
+        exec_enabled: true,
+        exec_allowlist: ["git", "pnpm", "npx", "node", "python3", "rclone", "bash", "cat", "grep", "find", "wc", "sha256sum", "tsc", "eslint"],
+        new_tools: ["fs_exec", "fs_hash", "fs_cat_lines", "fs_grep_json", "fs_search", "fs_put"],
+        note: "Run setup_script once per session to configure rclone env vars. Then use rclone commands: lsd (list), cat (read), rcat (write), copy (upload). Each command is stateless — no mount, no daemon, survives across turns. Use fs_exec for git/build/test commands on the host.",
+      }, null, 2));
+    }
 
     default:
       return mcpError(`Unknown tool: ${name}`);
@@ -11866,16 +12787,10 @@ async function installMacOS(pw, tunnelHostname, execSync) {
   try {
     // Delete existing entry if present (ignore errors)
     try {
-      execSync(
-        `security delete-generic-password -s "${keychainService}" -a "${keychainAccount}"`,
-        { encoding: "utf8", stdio: "pipe" }
-      );
+      execFileSync("security", ["delete-generic-password", "-s", keychainService, "-a", keychainAccount], { encoding: "utf8", stdio: "pipe" });
     } catch {}
 
-    execSync(
-      `security add-generic-password -s "${keychainService}" -a "${keychainAccount}" -w "${pw.replace(/"/g, '\\"')}" -U`,
-      { encoding: "utf8", stdio: "pipe" }
-    );
+    execFileSync("security", ["add-generic-password", "-s", keychainService, "-a", keychainAccount, "-w", pw, "-U"], { encoding: "utf8", stdio: "pipe" });
     spinner.succeed(chalk.green("Password stored in Keychain"));
   } catch (err) {
     spinner.fail(chalk.red(`Keychain storage failed: ${err.message}`));
@@ -11888,7 +12803,7 @@ async function installMacOS(pw, tunnelHostname, execSync) {
 
   // Build shell command that reads from Keychain and starts clauth
   const tunnelArg = tunnelHostname ? ` --tunnel ${tunnelHostname}` : "";
-  const shellCmd = `PW=$(security find-generic-password -s "${keychainService}" -a "${keychainAccount}" -w) && exec "${nodeExe}" "${cliEntry}" serve start -p "$PW"${tunnelArg}`;
+  const shellCmd = `PW=$(security find-generic-password -s "${keychainService}" -a "${keychainAccount}" -w) && export CLAUTH_BOOT_PASSWORD="$PW" && exec "${nodeExe}" "${cliEntry}" serve start --pw-env${tunnelArg}`;
 
   // Create LaunchAgent plist
   const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
@@ -11949,29 +12864,34 @@ async function installLinux(pw, tunnelHostname, execSync) {
   let useSecretTool = false;
   const spinner = ora("Storing password securely...").start();
 
-  try {
-    execSync("which secret-tool", { encoding: "utf8", stdio: "pipe" });
-    execSync(
-      `echo -n "${pw.replace(/"/g, '\\"')}" | secret-tool store --label="clauth daemon password" service clauth account daemon`,
-      { encoding: "utf8", stdio: "pipe" }
-    );
-    useSecretTool = true;
-    spinner.succeed(chalk.green("Password stored via secret-tool (GNOME Keyring)"));
-  } catch {
-    // Fallback: encrypt with openssl and store in file
-    // Uses a key derived from machine-id for basic protection at rest
+  if (pw) {
     try {
-      const machineId = fs.readFileSync("/etc/machine-id", "utf8").trim();
-      const encrypted = execSync(
-        `echo -n "${pw.replace(/"/g, '\\"')}" | openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -pass pass:"${machineId}" -base64`,
-        { encoding: "utf8", stdio: "pipe" }
-      ).trim();
-      fs.writeFileSync(bootKeyPath, encrypted, { mode: 0o600 });
-      spinner.succeed(chalk.green("Password encrypted -> boot.key (openssl fallback)"));
-    } catch (err) {
-      spinner.fail(chalk.red(`Password storage failed: ${err.message}`));
-      process.exit(1);
+      execSync("which secret-tool", { encoding: "utf8", stdio: "pipe" });
+      execFileSync("secret-tool", ["store", "--label=clauth daemon password", "service", "clauth", "account", "daemon"], {
+        input: pw,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      useSecretTool = true;
+      spinner.succeed(chalk.green("Password stored via secret-tool (GNOME Keyring)"));
+    } catch {
+      // Fallback: encrypt with openssl and store in file.
+      try {
+        const machineId = fs.readFileSync("/etc/machine-id", "utf8").trim();
+        const encrypted = execFileSync("openssl", ["enc", "-aes-256-cbc", "-pbkdf2", "-iter", "100000", "-pass", `pass:${machineId}`, "-base64"], {
+          input: pw,
+          encoding: "utf8",
+          stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        fs.writeFileSync(bootKeyPath, encrypted, { mode: 0o600 });
+        spinner.succeed(chalk.green("Password encrypted -> boot.key (openssl fallback)"));
+      } catch (err) {
+        spinner.fail(chalk.red(`Password storage failed: ${err.message}`));
+        process.exit(1);
+      }
     }
+  } else {
+    spinner.succeed(chalk.yellow("No password supplied; daemon will start locked"));
   }
 
   // Find the node executable and cli entry
@@ -11981,13 +12901,18 @@ async function installLinux(pw, tunnelHostname, execSync) {
   // Build the ExecStart command
   const tunnelArg = tunnelHostname ? ` --tunnel ${tunnelHostname}` : "";
   let execStart;
-  if (useSecretTool) {
+  if (!pw) {
+    const wrapperPath = path.join(configDir, "start.sh");
+    fs.writeFileSync(wrapperPath, `#!/bin/sh\nexec "${nodeExe}" "${cliEntry}" serve start${tunnelArg}\n`, { mode: 0o700 });
+    execStart = `/bin/sh ${wrapperPath}`;
+  } else if (useSecretTool) {
     // Create a wrapper script that reads from secret-tool
     const wrapperPath = path.join(configDir, "start.sh");
     const wrapperContent = [
       "#!/bin/sh",
       `PW=$(secret-tool lookup service clauth account daemon)`,
-      `exec "${nodeExe}" "${cliEntry}" serve start -p "$PW"${tunnelArg}`,
+      "export CLAUTH_BOOT_PASSWORD=\"$PW\"",
+      `exec "${nodeExe}" "${cliEntry}" serve start --pw-env${tunnelArg}`,
     ].join("\n");
     fs.writeFileSync(wrapperPath, wrapperContent, { mode: 0o700 });
     execStart = `/bin/sh ${wrapperPath}`;
@@ -11998,7 +12923,8 @@ async function installLinux(pw, tunnelHostname, execSync) {
       "#!/bin/sh",
       `MACHINE_ID=$(cat /etc/machine-id)`,
       `PW=$(openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -pass pass:"$MACHINE_ID" -base64 -d < "${bootKeyPath}")`,
-      `exec "${nodeExe}" "${cliEntry}" serve start -p "$PW"${tunnelArg}`,
+      "export CLAUTH_BOOT_PASSWORD=\"$PW\"",
+      `exec "${nodeExe}" "${cliEntry}" serve start --pw-env${tunnelArg}`,
     ].join("\n");
     fs.writeFileSync(wrapperPath, wrapperContent, { mode: 0o700 });
     execStart = `/bin/sh ${wrapperPath}`;
@@ -12037,7 +12963,7 @@ WantedBy=default.target
 
   console.log(chalk.cyan("\n  Auto-start installed (Linux):\n"));
   console.log(chalk.gray(`  service:   ${serviceFile}`));
-  console.log(chalk.gray(`  password:  ${useSecretTool ? "GNOME Keyring" : bootKeyPath}`));
+  console.log(chalk.gray(`  password:  ${pw ? (useSecretTool ? "GNOME Keyring" : bootKeyPath) : "locked (not persisted)"}`));
   if (tunnelHostname) console.log(chalk.gray(`  tunnel:    ${tunnelHostname}`));
   console.log(chalk.green("\n  Daemon will auto-start on login and restart on crash.\n"));
 }