@mtreeai/msapling-cli 2.3.6-beta.1 → 2.3.6-beta.11

package/dist/index.js

@@ -79,6 +79,11 @@ var init_src = __esm({
     MSaplingClient = class {
       apiUrl;
       token;
+      // CLI-AUTH-CSRF-01: simple cookie jar so we can implement the backend's
+      // double-submit CSRF pattern (msapling_csrftoken cookie ↔ X-CSRF-Token header).
+      // Without this, every authenticated POST/PATCH/DELETE returns 403
+      // CSRF_COOKIE_MISSING even with a valid Bearer token.
+      cookies = /* @__PURE__ */ new Map();
       constructor(options = {}) {
         this.apiUrl = (options.apiUrl || "https://api.msapling.com").replace(/\/$/, "");
         this.token = options.token || null;
@@ -89,12 +94,38 @@ var init_src = __esm({
       getApiUrl() {
         return this.apiUrl;
       }
+      serializeCookies() {
+        return Array.from(this.cookies.entries()).map(([k, v]) => `${k}=${v}`).join("; ");
+      }
+      updateCookiesFromResponse(response) {
+        const setCookieArr = response.headers.getSetCookie?.() ?? [];
+        for (const line of setCookieArr) {
+          const firstSemi = line.indexOf(";");
+          const pair = firstSemi >= 0 ? line.slice(0, firstSemi) : line;
+          const eq = pair.indexOf("=");
+          if (eq <= 0) continue;
+          const name = pair.slice(0, eq).trim();
+          const value = pair.slice(eq + 1).trim();
+          if (!name || !value) continue;
+          this.cookies.set(name, value);
+        }
+      }
       async request(path2, options = {}) {
         const headers = new Headers(options.headers);
         if (this.token) {
           headers.set("Authorization", `Bearer ${this.token}`);
         }
-        headers.set("Content-Type", "application/json");
+        if (!headers.has("Content-Type")) {
+          headers.set("Content-Type", "application/json");
+        }
+        if (this.cookies.size > 0) {
+          headers.set("Cookie", this.serializeCookies());
+        }
+        const method = (options.method || "GET").toUpperCase();
+        if (method !== "GET" && method !== "HEAD") {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          if (csrf) headers.set("X-CSRF-Token", csrf);
+        }
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
@@ -106,6 +137,7 @@ var init_src = __esm({
             keepalive: true
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (!response.ok) {
             let detail = "Unknown error";
             let code = "unknown";
@@ -272,7 +304,11 @@ var init_src = __esm({
         try {
           const parts = token.split(".");
           if (parts.length !== 3) return null;
-          const payload = JSON.parse(atob(parts[1]));
+          let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+          const padLen = (4 - b64.length % 4) % 4;
+          b64 += "=".repeat(padLen);
+          const decoded = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("binary");
+          const payload = JSON.parse(decoded);
           return payload;
         } catch {
           return null;
@@ -280,8 +316,19 @@ var init_src = __esm({
       }
       /**
        * Login with email and password.
-       * Returns access_token on success, or indicates TOTP is required.
-       * On 401: throws MSaplingError with code 'invalid_credentials'
+       *
+       * The JWT `mfa` claim is the *session* MFA state ("has this session completed
+       * TOTP yet"), not "TOTP is required". Treating `mfa:false` as TOTP-required
+       * was wrong: it blocked every user without 2FA enabled, including all
+       * guest/free accounts and the live backend which doesn't enforce TOTP yet.
+       *
+       * New contract: accept the token as fully usable. If the backend enforces
+       * MFA on a subsequent protected endpoint, that endpoint will reply with
+       * `mfa_required` and the caller can step up via verifyLoginTotp(). Until
+       * the backend exposes an explicit `mfa_required` field on the login
+       * response, we don't pre-emptively branch.
+       *
+       * On 401: throws MSaplingError with code 'invalid_credentials'.
        */
       async loginEmailPassword(email, password) {
         const params = new URLSearchParams();
@@ -299,12 +346,9 @@ var init_src = __esm({
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
-            const payload = this.decodeJwtPayload(data.access_token);
-            if (payload && payload.mfa === false) {
-              return { kind: "totp_required", partialToken: data.access_token };
-            }
             return { kind: "success", token: data.access_token };
           }
           if (response.status === 401) {
@@ -326,6 +370,42 @@ var init_src = __esm({
           clearTimeout(timeout);
         }
       }
+      /**
+       * Sign in as a guest. Backend issues a guest-scoped JWT with limited tier
+       * capabilities. No prior credentials required.
+       */
+      async loginGuest() {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 3e4);
+        try {
+          const response = await fetch(`${this.apiUrl}/auth/guest`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: "{}",
+            signal: controller.signal
+          });
+          clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
+          if (response.ok) {
+            const data = await response.json();
+            return { kind: "success", token: data.access_token };
+          }
+          let detail = "Guest login failed";
+          try {
+            const err = await response.json();
+            detail = err.detail || detail;
+          } catch (e) {
+          }
+          throw new MSaplingError(detail, response.status, "guest_login_failed");
+        } catch (e) {
+          if (e.name === "AbortError") {
+            throw new MSaplingError("Request timed out after 30s.", 408, "timeout");
+          }
+          throw e;
+        } finally {
+          clearTimeout(timeout);
+        }
+      }
       /**
        * Verify TOTP code during login.
        * Requires a partial token from a prior /auth/login call when MFA is enabled.
@@ -335,16 +415,21 @@ var init_src = __esm({
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
-          const response = await fetch(`${this.apiUrl}/auth/login-verify`, {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          const verifyHeaders = {
+            "Authorization": `Bearer ${this.token}`,
+            "Content-Type": "application/json"
+          };
+          if (this.cookies.size > 0) verifyHeaders["Cookie"] = this.serializeCookies();
+          if (csrf) verifyHeaders["X-CSRF-Token"] = csrf;
+          const response = await fetch(`${this.apiUrl}/api/mfa/login-verify`, {
             method: "POST",
-            headers: {
-              "Authorization": `Bearer ${this.token}`,
-              "Content-Type": "application/json"
-            },
+            headers: verifyHeaders,
             body: JSON.stringify({ code }),
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
             return { kind: "success", token: data.access_token };
@@ -374,8 +459,9 @@ var init_src = __esm({
        */
       async chatOnce(prompt, model, chatId) {
         let acc = "";
-        for await (const chunk of this.streamChat({ prompt, model, chat_id: chatId })) {
-          if (chunk.content) acc += chunk.content;
+        for await (const chunk of this.streamChat({ content: prompt, model, chat_id: chatId ?? "" })) {
+          if (chunk.delta) acc += chunk.delta;
+          else if (chunk.content) acc += chunk.content;
         }
         return acc;
       }
@@ -455,6 +541,33 @@ var init_src = __esm({
         });
         return data.hash;
       }
+      async getActiveTasks() {
+        return this.request("/api/task-monitor/active");
+      }
+      /**
+       * Wakeup Management (LAB-CHAT-PARITY-04)
+       */
+      async listWakeups(params = {}) {
+        const queryParams = new URLSearchParams(params);
+        return this.request(`/api/wakeups/?${queryParams.toString()}`);
+      }
+      async createWakeup(data) {
+        return this.request("/api/wakeups/", {
+          method: "POST",
+          body: JSON.stringify(data)
+        });
+      }
+      async cancelWakeup(id) {
+        await this.request(`/api/wakeups/${id}`, {
+          method: "DELETE"
+        });
+      }
+      /**
+       * Orchestration & Fleet Status
+       */
+      async getFleetStatus() {
+        return this.request("/api/orchestration/status");
+      }
       async proposeEdit(params) {
         return await this.request("/api/mdrive/ram/blocks/propose", {
           method: "POST",
@@ -462,6 +575,9 @@ var init_src = __esm({
         });
       }
       async *streamChat(params) {
+        if (!params.frame_id) {
+          params = { ...params, frame_id: "earth_surface" };
+        }
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
@@ -487,22 +603,34 @@ var init_src = __esm({
           if (!response.body) throw new Error("No response body");
           const reader = response.body.getReader();
           const decoder = new TextDecoder();
+          let pending = "";
+          const yieldLine = function* (raw) {
+            const line = raw.replace(/\r$/, "").trim();
+            if (!line) return;
+            try {
+              yield JSON.parse(line);
+            } catch {
+              if (line.startsWith("{")) {
+                console.warn(`[Stream] Dropped malformed JSON: ${line}`);
+              }
+            }
+          };
           while (true) {
             const { done, value } = await reader.read();
             if (done) break;
-            const chunk = decoder.decode(value, { stream: true });
-            const lines = chunk.split("\n").filter((l) => l.trim());
-            for (const line of lines) {
-              try {
-                const data = JSON.parse(line);
-                yield data;
-              } catch (e) {
-                if (line.startsWith("{")) {
-                  console.warn(`[Stream] Dropped partial JSON: ${line}`);
-                }
-              }
+            pending += decoder.decode(value, { stream: true });
+            let nlIdx;
+            while ((nlIdx = pending.indexOf("\n")) !== -1) {
+              const raw = pending.slice(0, nlIdx);
+              pending = pending.slice(nlIdx + 1);
+              yield* yieldLine(raw);
             }
           }
+          pending += decoder.decode();
+          if (pending.length > 0) {
+            yield* yieldLine(pending);
+            pending = "";
+          }
         } catch (e) {
           if (e.name === "AbortError") {
             throw new MSaplingError("Request timed out after 30s.", 408, "timeout");
@@ -657,6 +785,7 @@ import { resolve as resolve2, normalize as normalize2, relative as relative2, is
 import { writeFile, readFile as readFile2, mkdir } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
+import { randomBytes } from "crypto";
 var MAX_CONTENT_BYTES, WriteFileTool;
 var init_WriteFileTool = __esm({
   "../core/src/tools/WriteFileTool.ts"() {
@@ -732,7 +861,9 @@ var init_WriteFileTool = __esm({
           if (existsSync2(resolvedTarget)) {
             const existingContent = await readFile2(resolvedTarget, "utf8");
             const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
-            const backupPath = join2(homedir(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
+            const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const suffix = randomBytes(4).toString("hex");
+            const backupPath = join2(homedir(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
             await mkdir(join2(homedir(), ".msapling", "backups"), { recursive: true });
             await writeFile(backupPath, existingContent, "utf8");
             backedUpTo = backupPath;
@@ -1028,7 +1159,7 @@ var init_RunCommandTool = __esm({
           this.activeCommands++;
           return;
         }
-        return new Promise((resolve17) => this.queue.push(resolve17));
+        return new Promise((resolve18) => this.queue.push(resolve18));
       }
       static releaseLock() {
         if (this.queue.length > 0) {
@@ -1107,9 +1238,9 @@ var init_RunCommandTool = __esm({
           const chunks = { stdout: [], stderr: [] };
           proc.stdout?.on("data", (chunk) => chunks.stdout.push(chunk));
           proc.stderr?.on("data", (chunk) => chunks.stderr.push(chunk));
-          const exitCode = await new Promise((resolve17) => {
-            proc.on("exit", (code) => resolve17(code ?? 1));
-            proc.on("error", () => resolve17(1));
+          const exitCode = await new Promise((resolve18) => {
+            proc.on("exit", (code) => resolve18(code ?? 1));
+            proc.on("error", () => resolve18(1));
           });
           const stdout = Buffer.concat(chunks.stdout).toString("utf-8");
           const stderr = Buffer.concat(chunks.stderr).toString("utf-8");
@@ -1220,9 +1351,9 @@ var init_src2 = __esm({
           const messages = this.parser.parse(value);
           for (const msg of messages) {
             if (msg.id !== void 0 && this.pendingRequests.has(Number(msg.id))) {
-              const resolve17 = this.pendingRequests.get(Number(msg.id));
-              if (resolve17) {
-                resolve17(msg.result || msg.error);
+              const resolve18 = this.pendingRequests.get(Number(msg.id));
+              if (resolve18) {
+                resolve18(msg.result || msg.error);
                 this.pendingRequests.delete(Number(msg.id));
               }
             }
@@ -1237,8 +1368,8 @@ var init_src2 = __esm({
         const message = `Content-Length: ${Buffer.byteLength(content, "utf8")}\r
 \r
 ${content}`;
-        return new Promise((resolve17) => {
-          this.pendingRequests.set(id, resolve17);
+        return new Promise((resolve18) => {
+          this.pendingRequests.set(id, resolve18);
           this.process.stdin.write(message);
           this.process.stdin.flush();
         });
@@ -1370,9 +1501,9 @@ var init_SubShellTool = __esm({
               }
               throw e;
             }
-            await new Promise((resolve17) => {
-              proc.on("exit", () => resolve17());
-              proc.on("error", () => resolve17());
+            await new Promise((resolve18) => {
+              proc.on("exit", () => resolve18());
+              proc.on("error", () => resolve18());
             });
             return { content: `Successfully launched separate window for ${args2.worker_id}` };
           }
@@ -1455,13 +1586,13 @@ async function findRg() {
   const candidates = ["rg", "C:\\Program Files\\ripgrep\\rg.exe"];
   for (const bin of candidates) {
     try {
-      const exited = await new Promise((resolve17) => {
+      const exited = await new Promise((resolve18) => {
         try {
           const p = spawn4(bin, ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
-          p.on("error", () => resolve17(null));
-          p.on("exit", (code) => resolve17(code));
+          p.on("error", () => resolve18(null));
+          p.on("exit", (code) => resolve18(code));
         } catch {
-          resolve17(null);
+          resolve18(null);
         }
       });
       if (exited === 0) return bin;
@@ -1471,7 +1602,7 @@ async function findRg() {
   return null;
 }
 function runRg(bin, args2) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const p = spawn4(bin, args2, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1482,10 +1613,10 @@ function runRg(bin, args2) {
       stderr += d.toString("utf8");
     });
     p.on("error", (e) => {
-      resolve17({ stdout, stderr: stderr + (e?.message ?? ""), exitCode: -1 });
+      resolve18({ stdout, stderr: stderr + (e?.message ?? ""), exitCode: -1 });
     });
     p.on("exit", (code) => {
-      resolve17({ stdout, stderr, exitCode: code });
+      resolve18({ stdout, stderr, exitCode: code });
     });
   });
 }
@@ -2037,6 +2168,7 @@ import { resolve as resolve6, normalize as normalize5, relative as relative6, is
 import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir2 } from "os";
+import { randomBytes as randomBytes2 } from "crypto";
 var PatchFileTool;
 var init_PatchFileTool = __esm({
   "../core/src/tools/PatchFileTool.ts"() {
@@ -2143,7 +2275,9 @@ File preview (first 200 chars): ${JSON.stringify(preview)}`,
         let backedUpTo = null;
         try {
           const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
-          const backupPath = join6(homedir2(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes2(4).toString("hex");
+          const backupPath = join6(homedir2(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
           await mkdir2(join6(homedir2(), ".msapling", "backups"), { recursive: true });
           await writeFile2(backupPath, originalContent, "utf8");
           backedUpTo = backupPath;
@@ -2734,12 +2868,12 @@ Command: ${command}`,
         proc.stdout?.on("data", (chunk) => chunks.stdout.push(chunk));
         proc.stderr?.on("data", (chunk) => chunks.stderr.push(chunk));
         const timeoutPromise = new Promise(
-          (resolve17) => setTimeout(() => resolve17("timeout"), timeoutMs)
+          (resolve18) => setTimeout(() => resolve18("timeout"), timeoutMs)
         );
         const processPromise = (async () => {
-          const exitCode2 = await new Promise((resolve17) => {
-            proc.on("exit", (code) => resolve17(code ?? 1));
-            proc.on("error", () => resolve17(1));
+          const exitCode2 = await new Promise((resolve18) => {
+            proc.on("exit", (code) => resolve18(code ?? 1));
+            proc.on("error", () => resolve18(1));
           });
           const stdout2 = Buffer.concat(chunks.stdout).toString("utf-8");
           const stderr2 = Buffer.concat(chunks.stderr).toString("utf-8");
@@ -3003,6 +3137,7 @@ import { resolve as resolve9, normalize as normalize8, relative as relative9, is
 import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
 import { homedir as homedir3 } from "os";
+import { randomBytes as randomBytes3 } from "crypto";
 function normaliseSource(source) {
   if (source === "") return [];
   const lines = source.split("\n");
@@ -3179,11 +3314,13 @@ var init_NotebookEditTool = __esm({
         let backedUpTo = null;
         try {
           const filename = absPath.split(/[\\/]/).pop() ?? "notebook.ipynb";
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes3(4).toString("hex");
           const backupPath = join8(
             homedir3(),
             ".msapling",
             "backups",
-            `${filename}.${Date.now()}.bak`
+            `${filename}.backup-${stamp}-${suffix}.bak`
           );
           await mkdir3(join8(homedir3(), ".msapling", "backups"), { recursive: true });
           await writeFile3(backupPath, rawJson, "utf8");
@@ -3246,7 +3383,7 @@ var init_NotebookEditTool = __esm({
 File: ${absPath}`;
         if (backedUpTo) {
           summary += `
-Pre-edit content backed up to: ${backedUpTo}`;
+Backup: ${backedUpTo}`;
         }
         return { content: summary };
       }
@@ -3259,6 +3396,7 @@ import { resolve as resolve10, normalize as normalize9, relative as relative10,
 import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
 import { existsSync as existsSync8 } from "fs";
 import { homedir as homedir4 } from "os";
+import { randomBytes as randomBytes4 } from "crypto";
 var MAX_EDITS, MultiEditFileTool;
 var init_MultiEditFileTool = __esm({
   "../core/src/tools/MultiEditFileTool.ts"() {
@@ -3419,11 +3557,13 @@ No changes were written (atomic: all-or-nothing).`,
         let backedUpTo = null;
         try {
           const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes4(4).toString("hex");
           const backupPath = join9(
             homedir4(),
             ".msapling",
             "backups",
-            `${filename}.${Date.now()}.bak`
+            `${filename}.backup-${stamp}-${suffix}.bak`
           );
           await mkdir4(join9(homedir4(), ".msapling", "backups"), { recursive: true });
           await writeFile4(backupPath, originalContent, "utf8");
@@ -3456,6 +3596,7 @@ Pre-edit content backed up to: ${backedUpTo}`;
 import { resolve as resolve11, normalize as normalize10, relative as relative11, isAbsolute as isAbsolute11, dirname } from "path";
 import { rename, mkdir as mkdir5, copyFile, rm, stat as stat2, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync9, statSync as statSync3 } from "fs";
+import { randomBytes as randomBytes5 } from "crypto";
 function containedPath(p, root) {
   const abs = isAbsolute11(p) ? normalize10(p) : resolve11(root, p.trim());
   const rel = relative11(root, abs);
@@ -3479,17 +3620,19 @@ async function copyDir(src, dst) {
 }
 async function backupFile(absPath) {
   try {
-    const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir10 } = await import("fs/promises");
-    const { homedir: homedir15 } = await import("os");
-    const { join: join27 } = await import("path");
+    const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
+    const { homedir: homedir17 } = await import("os");
+    const { join: join31 } = await import("path");
     const filename = absPath.split(/[\\/]/).pop() ?? "file";
-    const backupPath = join27(
-      homedir15(),
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const suffix = randomBytes5(4).toString("hex");
+    const backupPath = join31(
+      homedir17(),
       ".msapling",
       "backups",
-      `${filename}.${Date.now()}.bak`
+      `${filename}.backup-${stamp}-${suffix}.bak`
     );
-    await mkdir10(join27(homedir15(), ".msapling", "backups"), { recursive: true });
+    await mkdir9(join31(homedir17(), ".msapling", "backups"), { recursive: true });
     const content = await readFile23(absPath, "utf8");
     await writeFile12(backupPath, content, "utf8");
     return backupPath;
@@ -3641,8 +3784,9 @@ Overwritten destination backed up to: ${backedUpTo}`;
 });
 
 // ../core/src/tools/DeleteFileTool.ts
-import { resolve as resolve12, normalize as normalize11, relative as relative12, isAbsolute as isAbsolute12, join as join10 } from "path";
+import { resolve as resolve12, normalize as normalize11, relative as relative12, isAbsolute as isAbsolute12, join as join11 } from "path";
 import { rm as rm2, stat as stat3 } from "fs/promises";
+import { randomBytes as randomBytes6 } from "crypto";
 var DeleteFileTool;
 var init_DeleteFileTool = __esm({
   "../core/src/tools/DeleteFileTool.ts"() {
@@ -3715,12 +3859,14 @@ var init_DeleteFileTool = __esm({
         let backedUpTo = null;
         if (isFile) {
           try {
-            const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir10 } = await import("fs/promises");
-            const { homedir: homedir15 } = await import("os");
+            const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
+            const { homedir: homedir17 } = await import("os");
             const existingContent = await readFile23(abs, "utf8");
             const filename = abs.split(/[\\/]/).pop() ?? "file";
-            const backupPath = join10(homedir15(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
-            await mkdir10(join10(homedir15(), ".msapling", "backups"), { recursive: true });
+            const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const suffix = randomBytes6(4).toString("hex");
+            const backupPath = join11(homedir17(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
+            await mkdir9(join11(homedir17(), ".msapling", "backups"), { recursive: true });
             await writeFile12(backupPath, existingContent, "utf8");
             backedUpTo = backupPath;
           } catch {
@@ -3744,7 +3890,7 @@ var init_DeleteFileTool = __esm({
         let summary = `Deleted ${kind}: ${abs}`;
         if (backedUpTo) {
           summary += `
-Content backed up to: ${backedUpTo}`;
+Backup: ${backedUpTo}`;
         }
         return { content: summary };
       }
@@ -3942,12 +4088,81 @@ var init_Sandbox = __esm({
         }
         return { status: "safe", hash };
       }
-      getRestrictedEnv() {
-        const safeKeys = ["PATH", "LANG", "LC_ALL", "NODE_ENV", "BUN_ENV"];
+      /**
+       * CLI-AUDIT-AUTO-44: curate PATH for sandboxed subprocesses.
+       *
+       * Previously `getRestrictedEnv` forwarded `process.env.PATH` verbatim. That
+       * means any directory injected onto the user's PATH (npm-global, ~/.local/bin,
+       * a malicious package's postinstall step adding /tmp/evil) inherits straight
+       * into every sandboxed tool spawn. Containment is then trivially defeated:
+       * "git" might resolve to /tmp/evil/git.
+       *
+       * Strategy:
+       *   - Default to a small allowlist of canonical system dirs (matches POSIX
+       *     `/etc/login.defs` style + common Windows system roots).
+       *   - Filter the caller's PATH against the allowlist, preserving order so
+       *     that legitimate /usr/local/bin/git still wins over /usr/bin/git.
+       *   - Drop world-writable / home-relative entries (`/tmp`, `~`, `.`, ``).
+       *   - Caller can override with an explicit `pathOverride` argument (e.g.
+       *     boot-time validation, tests).
+       */
+      static SAFE_PATH_ENTRIES = /* @__PURE__ */ new Set([
+        // POSIX
+        "/usr/local/sbin",
+        "/usr/local/bin",
+        "/usr/sbin",
+        "/usr/bin",
+        "/sbin",
+        "/bin",
+        // macOS extras
+        "/opt/homebrew/bin",
+        "/opt/homebrew/sbin",
+        "/opt/local/bin",
+        // Windows
+        "C:\\Windows\\System32",
+        "C:\\Windows",
+        "C:\\Windows\\System32\\Wbem",
+        "C:\\Windows\\System32\\WindowsPowerShell\\v1.0"
+      ]);
+      /**
+       * Decide whether a single PATH entry is acceptable inside the sandbox.
+       * Exposed (static) for unit testing.
+       */
+      static isSafePathEntry(entry) {
+        if (!entry) return false;
+        const e = entry.trim();
+        if (!e) return false;
+        if (e === "." || e === "..") return false;
+        if (e.startsWith("~")) return false;
+        if (e.startsWith("/tmp") || e.startsWith("/var/tmp")) return false;
+        if (process.platform === "win32") {
+          const lower = e.toLowerCase();
+          for (const safe of _Sandbox.SAFE_PATH_ENTRIES) {
+            if (safe.toLowerCase() === lower) return true;
+          }
+          return false;
+        }
+        return _Sandbox.SAFE_PATH_ENTRIES.has(e);
+      }
+      /**
+       * Build a curated PATH from the host environment, retaining only entries that
+       * pass `isSafePathEntry`. Order is preserved. If nothing matches, fall back
+       * to a minimal platform default so subprocess spawn never sees an empty PATH.
+       */
+      static curatePath(rawPath) {
+        const sep3 = process.platform === "win32" ? ";" : ":";
+        const entries = (rawPath ?? "").split(sep3);
+        const kept = entries.filter((e) => _Sandbox.isSafePathEntry(e));
+        if (kept.length > 0) return kept.join(sep3);
+        return process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
+      }
+      getRestrictedEnv(pathOverride) {
+        const safeKeys = ["LANG", "LC_ALL", "NODE_ENV", "BUN_ENV"];
         const filteredEnv = {};
         for (const key of safeKeys) {
           if (process.env[key]) filteredEnv[key] = process.env[key];
         }
+        filteredEnv["PATH"] = pathOverride ?? _Sandbox.curatePath(process.env.PATH);
         filteredEnv["MSAPLING_SANDBOX"] = "true";
         return filteredEnv;
       }
@@ -3991,10 +4206,10 @@ var init_Voice = __esm({
     `;
         try {
           if (process.platform === "win32") {
-            await new Promise((resolve17, reject) => {
+            await new Promise((resolve18, reject) => {
               try {
                 const proc = spawn6("powershell", ["-Command", psCommand]);
-                proc.on("exit", () => resolve17());
+                proc.on("exit", () => resolve18());
                 proc.on("error", reject);
               } catch (e) {
                 reject(e);
@@ -4108,7 +4323,7 @@ function matches(entry, ctx) {
 async function runOne(entry, ctx) {
   const timeoutMs = entry.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   const command = entry.command;
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const isWindows = process.platform === "win32";
     const child = spawn7(isWindows ? "cmd.exe" : "sh", isWindows ? ["/c", command] : ["-c", command], {
       cwd: ctx.cwd ?? process.cwd(),
@@ -4123,7 +4338,7 @@ async function runOne(entry, ctx) {
       settled = true;
       clearTimeout(killer);
       const blocked = !!entry.blocking && (exitCode === null || exitCode !== 0);
-      resolve17({ command, exitCode, stdout, stderr, timedOut, blocked });
+      resolve18({ command, exitCode, stdout, stderr, timedOut, blocked });
     };
     const killer = setTimeout(() => {
       timedOut = true;
@@ -4371,6 +4586,35 @@ ${blocker.stderr || "(empty)"}`,
             };
           }
         }
+        if (args2.path) {
+          const check = this.sandbox.isPathSafe(args2.path);
+          if (!check.safe) {
+            await this.voice.speak(`Security block detected`, "urgent");
+            const staleKey = `${toolName}:${(args2.path || "").trim()}`;
+            if (this.trustStore?.has(staleKey)) {
+              this.trustStore.delete(staleKey).catch(() => {
+              });
+            }
+            return { content: `Security Block: ${check.reason}`, isError: true };
+          }
+        }
+        if (toolName === "run_command" || toolName === "bash_command") {
+          if (!args2.command) {
+            return { content: `Error: ${toolName} requires a command argument`, isError: true };
+          }
+          const analysis = this.sandbox.analyzeCommand(args2.command);
+          if (analysis.status === "blocked") {
+            const staleCmdKey = toolName === "bash_command" ? `bash_command:${(args2.command || "").trim().replace(/\s+/g, " ")}${args2.cwd ? `:cwd=${args2.cwd}` : ""}` : `run_command:${(args2.command || "").trim()}`;
+            if (this.trustStore?.has(staleCmdKey)) {
+              this.trustStore.delete(staleCmdKey).catch(() => {
+              });
+            }
+            return { content: `Security Block: ${analysis.reason}`, isError: true };
+          }
+          if (analysis.status === "dangerous" && this.mode !== "bypassPermissions") {
+            return { content: `Dangerous Command Blocked: ${analysis.reason}. Use manual approval or trust hash ${analysis.hash}.`, isError: true };
+          }
+        }
         if (this.needsApproval(toolName) && this.approvalCallback) {
           let cmdKey = "";
           if (toolName === "run_command") {
@@ -4382,9 +4626,6 @@ ${blocker.stderr || "(empty)"}`,
           } else {
             cmdKey = `${toolName}:${(args2.path || args2.instruction || "").trim()}`;
           }
-          if ((toolName === "run_command" || toolName === "bash_command") && !args2.command) {
-            return { content: `Error: ${toolName} requires a command argument`, isError: true };
-          }
           const alreadyTrusted = this.trustStore ? this.trustStore.has(cmdKey) : this.sessionTrust.has(cmdKey);
           if (!alreadyTrusted) {
             const decision = await this.approvalCallback({
@@ -4431,22 +4672,6 @@ ${blocker.stderr || "(empty)"}`,
 Please approve the diff in the UI to sync this change locally.`
           };
         }
-        if (args2.path) {
-          const check = this.sandbox.isPathSafe(args2.path);
-          if (!check.safe) {
-            await this.voice.speak(`Security block detected`, "urgent");
-            return { content: `Security Block: ${check.reason}`, isError: true };
-          }
-        }
-        if (toolName === "run_command" || toolName === "bash_command") {
-          const analysis = this.sandbox.analyzeCommand(args2.command);
-          if (analysis.status === "blocked") {
-            return { content: `Security Block: ${analysis.reason}`, isError: true };
-          }
-          if (analysis.status === "dangerous" && this.mode !== "bypassPermissions") {
-            return { content: `Dangerous Command Blocked: ${analysis.reason}. Use manual approval or trust hash ${analysis.hash}.`, isError: true };
-          }
-        }
         const result = await tool.execute(args2, projectRoot);
         if (this.hooks) {
           this.hooks.fire({
@@ -4519,7 +4744,7 @@ var init_Safety = __esm({
 
 // ../core/src/ProjectConfig.ts
 import { homedir as homedir5 } from "os";
-import { join as join11, dirname as dirname2, parse as parsePath } from "path";
+import { join as join12, dirname as dirname2, parse as parsePath } from "path";
 import { existsSync as existsSync10 } from "fs";
 import { readFile as readFile9 } from "fs/promises";
 async function readIfExists(path2) {
@@ -4533,7 +4758,7 @@ async function readIfExists(path2) {
 }
 async function findInDir(dir) {
   for (const filename of FILENAMES) {
-    const path2 = join11(dir, filename);
+    const path2 = join12(dir, filename);
     const content = await readIfExists(path2);
     if (content !== null) {
       return { path: path2, filename, content };
@@ -4558,7 +4783,7 @@ async function findProjectConfig(start) {
 async function findUserConfig() {
   const home = homedir5();
   if (!home) return null;
-  const userDir = join11(home, ".msapling");
+  const userDir = join12(home, ".msapling");
   return findInDir(userDir);
 }
 function buildCombined(user, project) {
@@ -4968,8 +5193,8 @@ var init_Mutex = __esm({
        */
       acquire() {
         let release2;
-        const next = new Promise((resolve17) => {
-          release2 = resolve17;
+        const next = new Promise((resolve18) => {
+          release2 = resolve18;
         });
         const entry = this._queue.then(() => release2);
         this._queue = this._queue.then(() => next);
@@ -4992,17 +5217,17 @@ var init_Mutex = __esm({
 });
 
 // ../core/src/TrustStore.ts
-import { join as join12 } from "path";
-import { homedir as homedir6 } from "os";
+import { join as join13 } from "path";
+import { homedir as homedir6, platform as platform2 } from "os";
 import { existsSync as existsSync11, mkdirSync } from "fs";
-import { readFile as readFile10, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile5, chmod } from "fs/promises";
 var USER_SETTINGS_PATH, TrustStore;
 var init_TrustStore = __esm({
   "../core/src/TrustStore.ts"() {
     "use strict";
     init_esm_shims();
     init_Mutex();
-    USER_SETTINGS_PATH = join12(homedir6(), ".msapling", "settings.json");
+    USER_SETTINGS_PATH = join13(homedir6(), ".msapling", "settings.json");
     TrustStore = class {
       /** Current in-memory set of trusted `tool:command` keys. */
       trusted = /* @__PURE__ */ new Set();
@@ -5032,9 +5257,15 @@ var init_TrustStore = __esm({
        * updating `trustedCommands`.
        */
       async writeSettings(settings) {
-        const dir = join12(homedir6(), ".msapling");
+        const dir = join13(homedir6(), ".msapling");
         if (!existsSync11(dir)) mkdirSync(dir, { recursive: true });
         await writeFile5(this.settingsPath, JSON.stringify(settings, null, 2), "utf8");
+        if (platform2() !== "win32") {
+          try {
+            await chmod(this.settingsPath, 384);
+          } catch {
+          }
+        }
       }
       // ── Public API ─────────────────────────────────────────────────────────────
       /**
@@ -5112,7 +5343,7 @@ var require_polyfills = __commonJS({
     var constants = __require("constants");
     var origCwd = process.cwd;
     var cwd = null;
-    var platform2 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+    var platform4 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
     process.cwd = function() {
       if (!cwd)
         cwd = origCwd.call(process);
@@ -5132,54 +5363,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs) {
+    function patch(fs3) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs);
-      }
-      if (!fs.lutimes) {
-        patchLutimes(fs);
-      }
-      fs.chown = chownFix(fs.chown);
-      fs.fchown = chownFix(fs.fchown);
-      fs.lchown = chownFix(fs.lchown);
-      fs.chmod = chmodFix(fs.chmod);
-      fs.fchmod = chmodFix(fs.fchmod);
-      fs.lchmod = chmodFix(fs.lchmod);
-      fs.chownSync = chownFixSync(fs.chownSync);
-      fs.fchownSync = chownFixSync(fs.fchownSync);
-      fs.lchownSync = chownFixSync(fs.lchownSync);
-      fs.chmodSync = chmodFixSync(fs.chmodSync);
-      fs.fchmodSync = chmodFixSync(fs.fchmodSync);
-      fs.lchmodSync = chmodFixSync(fs.lchmodSync);
-      fs.stat = statFix(fs.stat);
-      fs.fstat = statFix(fs.fstat);
-      fs.lstat = statFix(fs.lstat);
-      fs.statSync = statFixSync(fs.statSync);
-      fs.fstatSync = statFixSync(fs.fstatSync);
-      fs.lstatSync = statFixSync(fs.lstatSync);
-      if (fs.chmod && !fs.lchmod) {
-        fs.lchmod = function(path2, mode, cb) {
+        patchLchmod(fs3);
+      }
+      if (!fs3.lutimes) {
+        patchLutimes(fs3);
+      }
+      fs3.chown = chownFix(fs3.chown);
+      fs3.fchown = chownFix(fs3.fchown);
+      fs3.lchown = chownFix(fs3.lchown);
+      fs3.chmod = chmodFix(fs3.chmod);
+      fs3.fchmod = chmodFix(fs3.fchmod);
+      fs3.lchmod = chmodFix(fs3.lchmod);
+      fs3.chownSync = chownFixSync(fs3.chownSync);
+      fs3.fchownSync = chownFixSync(fs3.fchownSync);
+      fs3.lchownSync = chownFixSync(fs3.lchownSync);
+      fs3.chmodSync = chmodFixSync(fs3.chmodSync);
+      fs3.fchmodSync = chmodFixSync(fs3.fchmodSync);
+      fs3.lchmodSync = chmodFixSync(fs3.lchmodSync);
+      fs3.stat = statFix(fs3.stat);
+      fs3.fstat = statFix(fs3.fstat);
+      fs3.lstat = statFix(fs3.lstat);
+      fs3.statSync = statFixSync(fs3.statSync);
+      fs3.fstatSync = statFixSync(fs3.fstatSync);
+      fs3.lstatSync = statFixSync(fs3.lstatSync);
+      if (fs3.chmod && !fs3.lchmod) {
+        fs3.lchmod = function(path2, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs.lchmodSync = function() {
+        fs3.lchmodSync = function() {
         };
       }
-      if (fs.chown && !fs.lchown) {
-        fs.lchown = function(path2, uid, gid, cb) {
+      if (fs3.chown && !fs3.lchown) {
+        fs3.lchown = function(path2, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs.lchownSync = function() {
+        fs3.lchownSync = function() {
         };
       }
-      if (platform2 === "win32") {
-        fs.rename = typeof fs.rename !== "function" ? fs.rename : (function(fs$rename) {
+      if (platform4 === "win32") {
+        fs3.rename = typeof fs3.rename !== "function" ? fs3.rename : (function(fs$rename) {
           function rename2(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs.stat(to, function(stater, st) {
+                  fs3.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -5195,9 +5426,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
           return rename2;
-        })(fs.rename);
+        })(fs3.rename);
       }
-      fs.read = typeof fs.read !== "function" ? fs.read : (function(fs$read) {
+      fs3.read = typeof fs3.read !== "function" ? fs3.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -5205,22 +5436,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs.read);
-      fs.readSync = typeof fs.readSync !== "function" ? fs.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs3.read);
+      fs3.readSync = typeof fs3.readSync !== "function" ? fs3.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs3, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -5230,10 +5461,10 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs.readSync);
-      function patchLchmod(fs2) {
-        fs2.lchmod = function(path2, mode, callback) {
-          fs2.open(
+      })(fs3.readSync);
+      function patchLchmod(fs4) {
+        fs4.lchmod = function(path2, mode, callback) {
+          fs4.open(
             path2,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
@@ -5242,80 +5473,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs2.fchmod(fd, mode, function(err2) {
-                fs2.close(fd, function(err22) {
+              fs4.fchmod(fd, mode, function(err2) {
+                fs4.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs2.lchmodSync = function(path2, mode) {
-          var fd = fs2.openSync(path2, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs4.lchmodSync = function(path2, mode) {
+          var fd = fs4.openSync(path2, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs2.fchmodSync(fd, mode);
+            ret = fs4.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs2.closeSync(fd);
+                fs4.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs2.closeSync(fd);
+              fs4.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs2) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs2.futimes) {
-          fs2.lutimes = function(path2, at, mt, cb) {
-            fs2.open(path2, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs4) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs4.futimes) {
+          fs4.lutimes = function(path2, at, mt, cb) {
+            fs4.open(path2, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs2.futimes(fd, at, mt, function(er2) {
-                fs2.close(fd, function(er22) {
+              fs4.futimes(fd, at, mt, function(er2) {
+                fs4.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs2.lutimesSync = function(path2, at, mt) {
-            var fd = fs2.openSync(path2, constants.O_SYMLINK);
+          fs4.lutimesSync = function(path2, at, mt) {
+            var fd = fs4.openSync(path2, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs2.futimesSync(fd, at, mt);
+              ret = fs4.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs2.closeSync(fd);
+                  fs4.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs2.closeSync(fd);
+                fs4.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs2.futimes) {
-          fs2.lutimes = function(_a, _b, _c, cb) {
+        } else if (fs4.futimes) {
+          fs4.lutimes = function(_a, _b, _c, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs2.lutimesSync = function() {
+          fs4.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs, target, mode, function(er) {
+          return orig.call(fs3, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -5325,7 +5556,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs, target, mode);
+            return orig.call(fs3, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -5334,7 +5565,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs, target, uid, gid, function(er) {
+          return orig.call(fs3, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -5344,7 +5575,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs, target, uid, gid);
+            return orig.call(fs3, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -5364,13 +5595,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs, target, options, callback) : orig.call(fs, target, callback);
+          return options ? orig.call(fs3, target, options, callback) : orig.call(fs3, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs, target, options) : orig.call(fs, target);
+          var stats = options ? orig.call(fs3, target, options) : orig.call(fs3, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -5401,7 +5632,7 @@ var require_legacy_streams = __commonJS({
     init_esm_shims();
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs) {
+    function legacy(fs3) {
       return {
         ReadStream,
         WriteStream
@@ -5444,7 +5675,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs3.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self.emit("error", err);
             self.readable = false;
@@ -5483,7 +5714,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs.open;
+          this._open = fs3.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -5521,7 +5752,7 @@ var require_graceful_fs = __commonJS({
   "../../node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs = __require("fs");
+    var fs3 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -5553,12 +5784,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs[gracefulQueue]) {
+    if (!fs3[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs, queue);
-      fs.close = (function(fs$close) {
+      publishQueue(fs3, queue);
+      fs3.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs, fd, function(err) {
+          return fs$close.call(fs3, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -5570,40 +5801,40 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs.close);
-      fs.closeSync = (function(fs$closeSync) {
+      })(fs3.close);
+      fs3.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs, arguments);
+          fs$closeSync.apply(fs3, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs.closeSync);
+      })(fs3.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug(fs[gracefulQueue]);
-          __require("assert").equal(fs[gracefulQueue].length, 0);
+          debug(fs3[gracefulQueue]);
+          __require("assert").equal(fs3[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs.__patched) {
-      module.exports = patch(fs);
-      fs.__patched = true;
-    }
-    function patch(fs2) {
-      polyfills(fs2);
-      fs2.gracefulify = patch;
-      fs2.createReadStream = createReadStream;
-      fs2.createWriteStream = createWriteStream;
-      var fs$readFile = fs2.readFile;
-      fs2.readFile = readFile23;
+      publishQueue(global, fs3[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs3));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs3.__patched) {
+      module.exports = patch(fs3);
+      fs3.__patched = true;
+    }
+    function patch(fs4) {
+      polyfills(fs4);
+      fs4.gracefulify = patch;
+      fs4.createReadStream = createReadStream;
+      fs4.createWriteStream = createWriteStream;
+      var fs$readFile = fs4.readFile;
+      fs4.readFile = readFile23;
       function readFile23(path2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -5619,8 +5850,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs2.writeFile;
-      fs2.writeFile = writeFile12;
+      var fs$writeFile = fs4.writeFile;
+      fs4.writeFile = writeFile12;
       function writeFile12(path2, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -5636,10 +5867,10 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs2.appendFile;
+      var fs$appendFile = fs4.appendFile;
       if (fs$appendFile)
-        fs2.appendFile = appendFile;
-      function appendFile(path2, data, options, cb) {
+        fs4.appendFile = appendFile2;
+      function appendFile2(path2, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$appendFile(path2, data, options, cb);
@@ -5654,9 +5885,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs2.copyFile;
+      var fs$copyFile = fs4.copyFile;
       if (fs$copyFile)
-        fs2.copyFile = copyFile2;
+        fs4.copyFile = copyFile2;
       function copyFile2(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -5674,10 +5905,10 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs2.readdir;
-      fs2.readdir = readdir4;
+      var fs$readdir = fs4.readdir;
+      fs4.readdir = readdir5;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir4(path2, options, cb) {
+      function readdir5(path2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path3, options2, cb2, startTime) {
@@ -5716,21 +5947,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs2);
+        var legStreams = legacy(fs4);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs2.ReadStream;
+      var fs$ReadStream = fs4.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs2.WriteStream;
+      var fs$WriteStream = fs4.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs2, "ReadStream", {
+      Object.defineProperty(fs4, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -5740,7 +5971,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs2, "WriteStream", {
+      Object.defineProperty(fs4, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -5751,7 +5982,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs2, "FileReadStream", {
+      Object.defineProperty(fs4, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -5762,7 +5993,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs2, "FileWriteStream", {
+      Object.defineProperty(fs4, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -5811,13 +6042,13 @@ var require_graceful_fs = __commonJS({
         });
       }
       function createReadStream(path2, options) {
-        return new fs2.ReadStream(path2, options);
+        return new fs4.ReadStream(path2, options);
       }
       function createWriteStream(path2, options) {
-        return new fs2.WriteStream(path2, options);
+        return new fs4.WriteStream(path2, options);
       }
-      var fs$open = fs2.open;
-      fs2.open = open;
+      var fs$open = fs4.open;
+      fs4.open = open;
       function open(path2, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
@@ -5833,20 +6064,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs2;
+      return fs4;
     }
     function enqueue(elem) {
       debug("ENQUEUE", elem[0].name, elem[1]);
-      fs[gracefulQueue].push(elem);
+      fs3[gracefulQueue].push(elem);
       retry();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs[gracefulQueue].length; ++i) {
-        if (fs[gracefulQueue][i].length > 2) {
-          fs[gracefulQueue][i][3] = now;
-          fs[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs3[gracefulQueue].length; ++i) {
+        if (fs3[gracefulQueue][i].length > 2) {
+          fs3[gracefulQueue][i][3] = now;
+          fs3[gracefulQueue][i][4] = now;
         }
       }
       retry();
@@ -5854,9 +6085,9 @@ var require_graceful_fs = __commonJS({
     function retry() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs[gracefulQueue].length === 0)
+      if (fs3[gracefulQueue].length === 0)
         return;
-      var elem = fs[gracefulQueue].shift();
+      var elem = fs3[gracefulQueue].shift();
       var fn = elem[0];
       var args2 = elem[1];
       var err = elem[2];
@@ -5878,7 +6109,7 @@ var require_graceful_fs = __commonJS({
           debug("RETRY", fn.name, args2);
           fn.apply(null, args2.concat([startTime]));
         } else {
-          fs[gracefulQueue].push(elem);
+          fs3[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -6324,10 +6555,10 @@ var require_mtime_precision = __commonJS({
     "use strict";
     init_esm_shims();
     var cacheSymbol = /* @__PURE__ */ Symbol();
-    function probe(file, fs, callback) {
-      const cachedPrecision = fs[cacheSymbol];
+    function probe(file, fs3, callback) {
+      const cachedPrecision = fs3[cacheSymbol];
       if (cachedPrecision) {
-        return fs.stat(file, (err, stat5) => {
+        return fs3.stat(file, (err, stat5) => {
           if (err) {
             return callback(err);
           }
@@ -6335,16 +6566,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs.utimes(file, mtime, mtime, (err) => {
+      fs3.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs.stat(file, (err2, stat5) => {
+        fs3.stat(file, (err2, stat5) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat5.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs, cacheSymbol, { value: precision });
+          Object.defineProperty(fs3, cacheSymbol, { value: precision });
           callback(null, stat5.mtime, precision);
         });
       });
@@ -6367,7 +6598,7 @@ var require_lockfile = __commonJS({
     "use strict";
     init_esm_shims();
     var path2 = __require("path");
-    var fs = require_graceful_fs();
+    var fs3 = require_graceful_fs();
     var retry = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -6498,7 +6729,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs,
+        fs: fs3,
         onCompromised: (err) => {
           throw err;
         },
@@ -6542,7 +6773,7 @@ var require_lockfile = __commonJS({
     }
     function unlock2(file, options, callback) {
       options = {
-        fs,
+        fs: fs3,
         realpath: true,
         ...options
       };
@@ -6564,7 +6795,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs,
+        fs: fs3,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -6604,16 +6835,16 @@ var require_adapter = __commonJS({
   "../../node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs = require_graceful_fs();
-    function createSyncFs(fs2) {
+    var fs3 = require_graceful_fs();
+    function createSyncFs(fs4) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs2 };
+      const newFs = { ...fs4 };
       methods.forEach((method) => {
         newFs[method] = (...args2) => {
           const callback = args2.pop();
           let ret;
           try {
-            ret = fs2[`${method}Sync`](...args2);
+            ret = fs4[`${method}Sync`](...args2);
           } catch (err) {
             return callback(err);
           }
@@ -6623,12 +6854,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args2) => new Promise((resolve17, reject) => {
+      return (...args2) => new Promise((resolve18, reject) => {
         args2.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve17(result);
+            resolve18(result);
           }
         });
         method(...args2);
@@ -6651,7 +6882,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs);
+      options.fs = createSyncFs(options.fs || fs3);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -6712,7 +6943,7 @@ var init_keytar = __esm({
 
 // node-file:<repo>\node_modules\.bun\keytar@7.9.0\node_modules\keytar\build\Release\keytar.node
 var require_keytar = __commonJS({
-  "node-file:D:\\Projects\\MSapling_CLI\\node_modules\\.bun\\keytar@7.9.0\\node_modules\\keytar\\build\\Release\\keytar.node"(exports, module) {
+  "node-file:F:\\MForest\\projects\\MSapling_CLI\\node_modules\\.bun\\keytar@7.9.0\\node_modules\\keytar\\build\\Release\\keytar.node"(exports, module) {
     "use strict";
     init_esm_shims();
     init_keytar();
@@ -6764,10 +6995,14 @@ var require_keytar2 = __commonJS({
 });
 
 // ../core/src/Storage.ts
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { homedir as homedir7 } from "os";
-import { chmodSync, existsSync as existsSync12, renameSync, unlinkSync } from "fs";
-import { mkdir as mkdir6, writeFile as writeFile6, readFile as readFile11 } from "fs/promises";
+import { chmodSync, existsSync as existsSync12, renameSync, unlinkSync, writeFileSync } from "fs";
+import { mkdir as mkdir6, writeFile as writeFile6, readFile as readFile11, appendFile } from "fs/promises";
+import { randomBytes as randomBytes7, createHash as createHash3 } from "crypto";
+function hashLine(line) {
+  return createHash3("sha256").update(line, "utf8").digest("hex");
+}
 var lockfile, keytar, StorageManager;
 var init_Storage = __esm({
   "../core/src/Storage.ts"() {
@@ -6794,15 +7029,26 @@ var init_Storage = __esm({
        */
       _ready;
       constructor() {
-        this.baseDir = join13(homedir7(), ".msapling");
+        this.baseDir = join14(homedir7(), ".msapling");
         this._ready = this.ensureDirs();
       }
       async ensureDirs() {
         try {
           await mkdir6(this.baseDir, { recursive: true });
-          const subdirs = ["history", "backups", "cache", "vault"];
+          const subdirs = [
+            "history",
+            "backups",
+            "cache",
+            // CLI-ARCH-CONTENT-HASH-VAULT-01: content-addressed vault layout
+            "vault",
+            "vault/objects",
+            "vault/refs",
+            // CLI-ARCH-RECIPE-AT-HASH-URI-01: recipe hash cache
+            "cache/recipes",
+            "cache/recipes/objects"
+          ];
           for (const sub of subdirs) {
-            const path2 = join13(this.baseDir, sub);
+            const path2 = join14(this.baseDir, sub);
             await mkdir6(path2, { recursive: true });
           }
           if (process.platform !== "win32") {
@@ -6820,7 +7066,7 @@ var init_Storage = __esm({
         await this._ready;
         const KEYCHAIN_SERVICE = "msapling-cli";
         const KEYCHAIN_ACCOUNT = "auth_token";
-        const filePath = join13(this.baseDir, "vault", "token");
+        const filePath = join14(this.baseDir, "vault", "token");
         try {
           await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, token);
           try {
@@ -6840,7 +7086,7 @@ var init_Storage = __esm({
       async loadToken() {
         const KEYCHAIN_SERVICE = "msapling-cli";
         const KEYCHAIN_ACCOUNT = "auth_token";
-        const filePath = join13(this.baseDir, "vault", "token");
+        const filePath = join14(this.baseDir, "vault", "token");
         try {
           const keychainToken = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
           if (keychainToken) {
@@ -6861,7 +7107,7 @@ var init_Storage = __esm({
       async clearToken() {
         const KEYCHAIN_SERVICE = "msapling-cli";
         const KEYCHAIN_ACCOUNT = "auth_token";
-        const filePath = join13(this.baseDir, "vault", "token");
+        const filePath = join14(this.baseDir, "vault", "token");
         try {
           await keytar.deletePassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
         } catch (e) {
@@ -6869,13 +7115,237 @@ var init_Storage = __esm({
         }
         try {
           if (existsSync12(filePath)) {
-            const fs = await import("fs/promises");
-            await fs.unlink(filePath);
+            const fs3 = await import("fs/promises");
+            await fs3.unlink(filePath);
           }
         } catch (e) {
           console.warn(`Failed to delete token file: ${e}`);
         }
       }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-CONTENT-HASH-VAULT-01 — content-addressed vault helpers
+      //
+      // Every vault value is a content-addressed blob stored under
+      //   ~/.msapling/vault/objects/<sha256-hex>
+      // A human-readable ref file under
+      //   ~/.msapling/vault/refs/<label>
+      // holds the sha256-hex of the current value.
+      //
+      // Updating a value: write new object → atomically rewrite ref.
+      // Old objects are GC'd separately (retention window TBD — see roadmap).
+      // The keytar account name stores the sha256-hex so the plaintext label
+      // remains opaque on disk (label → hash is in keytar; hash → blob is on disk).
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Write a value into the content-addressed object store and atomically
+       * update the named ref. Returns the sha256 hex of the stored object.
+       *
+       * WAL-PATTERN: write to objects/<hash> (idempotent — same content = same
+       * path), then rename refs/<label>.tmp → refs/<label>.
+       */
+      async writeVaultRef(label, value) {
+        await this._ready;
+        const hash = createHash3("sha256").update(value, "utf8").digest("hex");
+        const objectPath = join14(this.baseDir, "vault", "objects", hash);
+        const refPath = join14(this.baseDir, "vault", "refs", label);
+        const refTmp = `${refPath}.tmp`;
+        await writeFile6(objectPath, value, "utf8");
+        if (process.platform !== "win32") {
+          chmodSync(objectPath, 384);
+        }
+        await writeFile6(refTmp, hash, "utf8");
+        renameSync(refTmp, refPath);
+        return hash;
+      }
+      /**
+       * Read a vault value by label. Returns null if the ref or its object is
+       * missing (bootstrap / first-run case).
+       */
+      async readVaultRef(label) {
+        await this._ready;
+        const refPath = join14(this.baseDir, "vault", "refs", label);
+        if (!existsSync12(refPath)) return null;
+        const hash = (await readFile11(refPath, "utf8")).trim();
+        const objectPath = join14(this.baseDir, "vault", "objects", hash);
+        if (!existsSync12(objectPath)) return null;
+        return readFile11(objectPath, "utf8");
+      }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-RECIPE-AT-HASH-URI-01 — recipe hash registry helpers
+      //
+      // On first load of a recipe file, its content is sha256-hashed and the
+      // mapping { name → hash } is stored in
+      //   ~/.msapling/cache/recipes/index.json
+      // The immutable blob is written to
+      //   ~/.msapling/cache/recipes/objects/<sha256>
+      //
+      // Invocations reference recipes as `recipe@<sha256>` URIs. The /recipe
+      // command resolves a bare name through the index and logs the hash for
+      // traceability.
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Register a recipe file in the local hash index. Idempotent — if the
+       * content hash already exists the call is a no-op (returns existing hash).
+       * Returns the sha256 hex for use in log messages / URI construction.
+       */
+      async registerRecipe(name, content) {
+        await this._ready;
+        const hash = createHash3("sha256").update(content, "utf8").digest("hex");
+        const objectPath = join14(this.baseDir, "cache", "recipes", "objects", hash);
+        const indexPath = join14(this.baseDir, "cache", "recipes", "index.json");
+        const indexTmp = `${indexPath}.tmp`;
+        if (!existsSync12(objectPath)) {
+          await writeFile6(objectPath, content, "utf8");
+        }
+        let index = {};
+        if (existsSync12(indexPath)) {
+          try {
+            index = JSON.parse(await readFile11(indexPath, "utf8"));
+          } catch {
+            index = {};
+          }
+        }
+        index[name] = hash;
+        await writeFile6(indexTmp, JSON.stringify(index, null, 2), "utf8");
+        renameSync(indexTmp, indexPath);
+        return hash;
+      }
+      /**
+       * Resolve a recipe name or `recipe@<hash>` URI to its cached content.
+       * Returns { hash, content } or null if not found in the local cache.
+       */
+      async resolveRecipe(nameOrRef) {
+        await this._ready;
+        const indexPath = join14(this.baseDir, "cache", "recipes", "index.json");
+        const atIdx = nameOrRef.indexOf("@");
+        if (atIdx !== -1) {
+          const hash2 = nameOrRef.slice(atIdx + 1);
+          const objectPath2 = join14(this.baseDir, "cache", "recipes", "objects", hash2);
+          if (!existsSync12(objectPath2)) return null;
+          return { hash: hash2, content: await readFile11(objectPath2, "utf8") };
+        }
+        if (!existsSync12(indexPath)) return null;
+        let index;
+        try {
+          index = JSON.parse(await readFile11(indexPath, "utf8"));
+        } catch {
+          return null;
+        }
+        const hash = index[nameOrRef];
+        if (!hash) return null;
+        const objectPath = join14(this.baseDir, "cache", "recipes", "objects", hash);
+        if (!existsSync12(objectPath)) return null;
+        return { hash, content: await readFile11(objectPath, "utf8") };
+      }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-HASH-CHAIN-HISTORY-01 — append-only NDJSON history with hash chain
+      //
+      // Shell history is stored as an append-only NDJSON file
+      //   ~/.msapling/history/shell_history.jsonl
+      // Each entry carries a `prev_hash` field so tampering is detectable.
+      // `msapling --verify-history` re-hashes the chain and reports breaks.
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Append a single command to the hash-chain history.
+       * Uses lockfile + in-process mutex as a critical section around:
+       *   1. Load last entry to compute prev_hash
+       *   2. Build + serialize new entry
+       *   3. Append to shell_history.jsonl
+       *
+       * WAL-PATTERN note: append-only log uses appendFile, not rename — the
+       * lockfile is the write-serialisation primitive here.
+       */
+      async appendHistoryEntry(content) {
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.jsonl");
+        return this.historyMutex.run(async () => {
+          let release2 = null;
+          try {
+            if (!existsSync12(path2)) {
+              await writeFile6(path2, "", "utf8");
+            }
+            release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+            let prevHash = null;
+            let seq = 1;
+            if (existsSync12(path2)) {
+              const raw = (await readFile11(path2, "utf8")).trimEnd();
+              if (raw.length > 0) {
+                const lines = raw.split("\n");
+                const lastLine = lines[lines.length - 1];
+                try {
+                  const last = JSON.parse(lastLine);
+                  seq = last.seq + 1;
+                  prevHash = hashLine(lastLine);
+                } catch {
+                }
+              }
+            }
+            const entry = {
+              seq,
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              content,
+              prev_hash: prevHash
+            };
+            const line = JSON.stringify(entry);
+            await appendFile(path2, line + "\n", "utf8");
+            return entry;
+          } finally {
+            if (release2) {
+              try {
+                await lockfile.unlock(path2, { skipStale: true });
+              } catch {
+              }
+            }
+          }
+        });
+      }
+      /**
+       * Load all history entries from shell_history.jsonl.
+       * Skips malformed lines (logs a warning for each).
+       *
+       * // TODO: implement tail-read for large history files to avoid loading entire file into memory
+       */
+      async loadHistoryEntries() {
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.jsonl");
+        if (!existsSync12(path2)) return [];
+        const raw = await readFile11(path2, "utf8");
+        const entries = [];
+        for (const line of raw.split("\n")) {
+          if (!line.trim()) continue;
+          try {
+            entries.push(JSON.parse(line));
+          } catch {
+            console.warn(`[history] Skipped malformed NDJSON line: ${line.slice(0, 80)}`);
+          }
+        }
+        return entries;
+      }
+      /**
+       * Verify the hash chain of shell_history.jsonl.
+       * Returns { ok: true } if intact, or { ok: false, breaks: [...] } listing
+       * each break as { seq, expected, actual }.
+       *
+       * Used by `msapling --verify-history`.
+       */
+      async verifyHistory() {
+        const entries = await this.loadHistoryEntries();
+        const breaks = [];
+        let prevLine = null;
+        for (const entry of entries) {
+          if (prevLine !== null) {
+            const expected = hashLine(prevLine);
+            const actual = entry.prev_hash ?? "";
+            if (expected !== actual) {
+              breaks.push({ seq: entry.seq, expected, actual });
+            }
+          } else if (entry.prev_hash !== null) {
+            breaks.push({ seq: entry.seq, expected: "null", actual: entry.prev_hash });
+          }
+          prevLine = JSON.stringify(entry);
+        }
+        return breaks.length === 0 ? { ok: true } : { ok: false, breaks };
+      }
       /**
        * SYNC-01: Serialised history write with file-based locking.
        * Uses proper-lockfile to coordinate writes across multiple terminal instances
@@ -6886,10 +7356,12 @@ var init_Storage = __esm({
        * 2. Partial writes don't corrupt the JSON (atomic rename)
        */
       async saveHistory(history) {
-        const path2 = join13(this.baseDir, "history", "shell_history.json");
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          if (!existsSync12(path2)) writeFileSync(path2, "[]", "utf8");
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           await this.historyMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(history, null, 2);
@@ -6899,8 +7371,8 @@ var init_Storage = __esm({
             } catch (e) {
               try {
                 if (existsSync12(tmpPath)) {
-                  const fs = await import("fs/promises");
-                  await fs.unlink(tmpPath);
+                  const fs3 = await import("fs/promises");
+                  await fs3.unlink(tmpPath);
                 }
               } catch {
               }
@@ -6921,16 +7393,38 @@ var init_Storage = __esm({
        * SYNC-01: Serialised history read with file-based locking.
        * Reads are gated behind the file lock so a read that overlaps with an
        * in-progress write from another process always sees a complete, valid JSON.
+       *
+       * // TODO: implement tail-read for large history files to avoid loading entire file into memory
        */
       async loadHistory() {
-        const path2 = join13(this.baseDir, "history", "shell_history.json");
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.json");
+        if (!existsSync12(path2)) return [];
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           return this.historyMutex.run(async () => {
             if (existsSync12(path2)) {
               const text = await readFile11(path2, "utf8");
-              return JSON.parse(text);
+              try {
+                return JSON.parse(text);
+              } catch (parseErr) {
+                const filename = path2.split("/").pop() || "shell_history.json";
+                const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+                const suffix = randomBytes7(4).toString("hex");
+                const corruptBackupPath = join14(
+                  this.baseDir,
+                  "history",
+                  `${filename}.corrupt.${stamp}-${suffix}.bak`
+                );
+                try {
+                  renameSync(path2, corruptBackupPath);
+                  console.warn(`History file was corrupt; backed up to ${corruptBackupPath}`);
+                } catch (backupErr) {
+                  console.error(`Failed to backup corrupt history file: ${backupErr}`);
+                }
+                return [];
+              }
             }
             return [];
           });
@@ -6946,12 +7440,14 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions write with file-based locking.
+       * R20-CLI-2: Typed with PermissionState from Sandbox.ts.
        */
       async savePermissions(permissions) {
-        const path2 = join13(this.baseDir, "vault", "permissions.json");
+        const path2 = join14(this.baseDir, "vault", "permissions.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          if (!existsSync12(path2)) writeFileSync(path2, "{}", "utf8");
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           await this.permissionsMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(permissions, null, 2);
@@ -6961,8 +7457,8 @@ var init_Storage = __esm({
             } catch (e) {
               try {
                 if (existsSync12(tmpPath)) {
-                  const fs = await import("fs/promises");
-                  await fs.unlink(tmpPath);
+                  const fs3 = await import("fs/promises");
+                  await fs3.unlink(tmpPath);
                 }
               } catch {
               }
@@ -6981,16 +7477,36 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions read with file-based locking.
+       * R20-CLI-2: Typed with PermissionState from Sandbox.ts.
        */
       async loadPermissions() {
-        const path2 = join13(this.baseDir, "vault", "permissions.json");
+        const path2 = join14(this.baseDir, "vault", "permissions.json");
+        if (!existsSync12(path2)) return { trustedCommands: [], trustedPaths: [] };
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           return this.permissionsMutex.run(async () => {
             if (existsSync12(path2)) {
               const text = await readFile11(path2, "utf8");
-              return JSON.parse(text);
+              try {
+                return JSON.parse(text);
+              } catch (parseErr) {
+                const filename = path2.split("/").pop() || "permissions.json";
+                const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+                const suffix = randomBytes7(4).toString("hex");
+                const corruptBackupPath = join14(
+                  this.baseDir,
+                  "vault",
+                  `${filename}.corrupt.${stamp}-${suffix}.bak`
+                );
+                try {
+                  renameSync(path2, corruptBackupPath);
+                  console.warn(`Permissions file was corrupt; backed up to ${corruptBackupPath}`);
+                } catch (backupErr) {
+                  console.error(`Failed to backup corrupt permissions file: ${backupErr}`);
+                }
+                return { trustedCommands: [], trustedPaths: [] };
+              }
             }
             return { trustedCommands: [], trustedPaths: [] };
           });
@@ -7008,11 +7524,14 @@ var init_Storage = __esm({
        * Backup a file before AI edit.
        * CLI-R11-STORAGE-03: backup artifacts are written with restrictive 0600
        * permissions so restored content is not readable by other OS users.
+       * CLI-ARCH-NO-EPOCH-IN-KEYS-FU-01: uses ISO timestamp + random suffix
+       * instead of epoch milliseconds for better traceability and collision avoidance.
        */
       async backup(filePath, content) {
         const filename = filePath.split("/").pop() || "file";
-        const timestamp = Date.now();
-        const backupPath = join13(this.baseDir, "backups", `${filename}.${timestamp}.bak`);
+        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const suffix = randomBytes7(4).toString("hex");
+        const backupPath = join14(this.baseDir, "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
         await writeFile6(backupPath, content, "utf8");
         if (process.platform !== "win32") {
           chmodSync(backupPath, 384);
@@ -7025,9 +7544,28 @@ var init_Storage = __esm({
 
 // ../core/src/Settings.ts
 import { homedir as homedir8 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { existsSync as existsSync13 } from "fs";
+import * as fs from "fs";
 import { readFile as readFile12 } from "fs/promises";
+import { randomBytes as randomBytes8 } from "crypto";
+function ensureConfigDir(p) {
+  try {
+    fs.mkdirSync(p, { recursive: true, mode: 448 });
+  } catch (e) {
+    if (e.code === "EEXIST" || e.code === "ENOTDIR") {
+      const stat5 = fs.statSync(p);
+      if (!stat5.isDirectory()) {
+        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const suffix = randomBytes8(4).toString("hex");
+        fs.renameSync(p, `${p}.broken-${stamp}-${suffix}`);
+        fs.mkdirSync(p, { recursive: true, mode: 448 });
+      }
+    } else {
+      throw e;
+    }
+  }
+}
 async function readJson(path2) {
   try {
     if (!existsSync13(path2)) return null;
@@ -7085,8 +7623,8 @@ function mergeSettings(base, override) {
 }
 async function loadSettings(cwd = process.cwd(), env = process.env, warn) {
   const sources = [];
-  const userPath = join14(homedir8() || ".", ".msapling", "settings.json");
-  const projectPath = join14(cwd, ".msapling", "settings.json");
+  const userPath = join15(homedir8() || ".", ".msapling", "settings.json");
+  const projectPath = join15(cwd, ".msapling", "settings.json");
   const [user, project] = await Promise.all([readJson(userPath), readJson(projectPath)]);
   if (user) sources.push(userPath);
   if (project) sources.push(projectPath);
@@ -7249,7 +7787,7 @@ var init_client = __esm({
         if (!this.proc) throw new MCPClientError(`MCP server "${this.name}" not started`);
         const id = this.nextId++;
         const frame = { jsonrpc: "2.0", id, method, params };
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve18, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(new MCPClientError(`MCP request ${method} timed out after ${timeoutMs}ms`));
@@ -7257,7 +7795,7 @@ var init_client = __esm({
           this.pending.set(id, {
             resolve: (v) => {
               clearTimeout(timer);
-              resolve17(v);
+              resolve18(v);
             },
             reject: (e) => {
               clearTimeout(timer);
@@ -7284,7 +7822,7 @@ var init_client = __esm({
         if (!this.proc?.stdout) return;
         const stdout = this.proc.stdout;
         const decoder = new TextDecoder();
-        return new Promise((resolve17) => {
+        return new Promise((resolve18) => {
           stdout.on("data", (chunk) => {
             this.buffer += decoder.decode(chunk, { stream: true });
             let idx;
@@ -7295,8 +7833,8 @@ var init_client = __esm({
               this.handleFrame(line);
             }
           });
-          stdout.on("end", () => resolve17());
-          stdout.on("error", () => resolve17());
+          stdout.on("end", () => resolve18());
+          stdout.on("error", () => resolve18());
         });
       }
       handleFrame(line) {
@@ -7383,7 +7921,7 @@ var init_Swarm = __esm({
        * Execute a parallel swarm with shadow auditing and optional sub-shell popups.
        */
       async execute(tasks, projectRoot) {
-        const promises = tasks.map(async (task) => {
+        const promises2 = tasks.map(async (task) => {
           const audit = await this.shadow.verifyAction(task.prompt, `Swarm Task: ${task.name}`);
           if (!audit.approved) {
             return { taskId: task.id, workerId: "none", response: "", status: "blocked", auditNote: audit.reasoning };
@@ -7405,7 +7943,7 @@ var init_Swarm = __esm({
             return { taskId: task.id, workerId: task.id, response: e.message, status: "failed" };
           }
         });
-        return Promise.all(promises);
+        return Promise.all(promises2);
       }
       /**
        * SYNTHESIS: Use a high-reasoning model to merge the safe swarm results.
@@ -7470,29 +8008,34 @@ function isEmailAddress(str) {
 function isTokenLike(str) {
   return str.length >= 20 && /^[A-Za-z0-9_\-\.]+$/.test(str);
 }
+function setRawModeGuarded(stdin, mode) {
+  try {
+    if (typeof stdin.setRawMode === "function") {
+      stdin.setRawMode(mode);
+    }
+  } catch (e) {
+  }
+}
 async function promptPassword(prompt) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const stdin = process.stdin;
     const stdout = process.stdout;
     stdout.write(prompt);
-    const wasRaw = stdin.isRaw;
-    try {
-      stdin.setRawMode(true);
-    } catch (e) {
-    }
+    const wasRaw = stdin.isRaw ?? false;
+    setRawModeGuarded(stdin, true);
     let password = "";
     const onData = (chunk) => {
       const char = chunk.toString();
       if (char === "\n" || char === "\r") {
-        stdin.setRawMode(wasRaw);
+        setRawModeGuarded(stdin, wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17(password);
+        resolve18(password);
       } else if (char === "") {
-        stdin.setRawMode(wasRaw);
+        setRawModeGuarded(stdin, wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17("");
+        resolve18("");
       } else if (char === "\x7F" || char === "\b") {
         password = password.slice(0, -1);
       } else if (char >= " " && char <= "~") {
@@ -7502,40 +8045,6 @@ async function promptPassword(prompt) {
     stdin.on("data", onData);
   });
 }
-async function promptTotp(prompt) {
-  return new Promise((resolve17) => {
-    const stdin = process.stdin;
-    const stdout = process.stdout;
-    stdout.write(prompt);
-    const wasRaw = stdin.isRaw;
-    try {
-      stdin.setRawMode(true);
-    } catch (e) {
-    }
-    let code = "";
-    const onData = (chunk) => {
-      const char = chunk.toString();
-      if (char === "\n" || char === "\r") {
-        stdin.setRawMode(wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve17(code);
-      } else if (char === "") {
-        stdin.setRawMode(wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve17("");
-      } else if (char === "\x7F" || char === "\b") {
-        code = code.slice(0, -1);
-      } else if (/^\d$/.test(char)) {
-        if (code.length < 6) {
-          code += char;
-        }
-      }
-    };
-    stdin.on("data", onData);
-  });
-}
 async function loginWithEmailPassword(email, context) {
   context.addMessage("system", `Logging in as ${email}...`);
   let password = "";
@@ -7552,40 +8061,26 @@ async function loginWithEmailPassword(email, context) {
   try {
     const result = await context.client.loginEmailPassword(email, password);
     password = "";
-    if (result.kind === "totp_required") {
-      context.addMessage("system", "Two-factor authentication required.");
-      let totpCode = "";
-      try {
-        totpCode = await promptTotp("Enter your 6-digit code: ");
-      } catch (err) {
-        context.addMessage("error", `TOTP prompt failed: ${err}`);
-        return;
-      }
-      if (!totpCode || totpCode.length !== 6) {
-        context.addMessage("error", "Invalid TOTP code (must be 6 digits).");
-        return;
-      }
-      context.client.setToken(result.partialToken);
-      try {
-        const totpResult = await context.client.verifyLoginTotp(totpCode);
-        await context.storage.saveToken(totpResult.token);
-        context.client.setToken(totpResult.token);
-        await context.refreshOverview();
-        context.addMessage("system", `Logged in as ${email} (2FA verified).`);
-      } catch (err) {
-        context.client.setToken(null);
-        context.addMessage("error", `TOTP verification failed: ${err}`);
-      }
-    } else if (result.kind === "success") {
-      await context.storage.saveToken(result.token);
-      context.client.setToken(result.token);
-      await context.refreshOverview();
-      context.addMessage("system", `Logged in as ${email}.`);
-    }
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", `Logged in as ${email}.`);
   } catch (err) {
     context.addMessage("error", `Login failed: ${err}`);
   }
 }
+async function loginAsGuest(context) {
+  context.addMessage("system", "Signing in as guest...");
+  try {
+    const result = await context.client.loginGuest();
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", "Signed in as guest (limited tier).");
+  } catch (err) {
+    context.addMessage("error", `Guest login failed: ${err}`);
+  }
+}
 async function loginWithGithubDevice(context) {
   context.addMessage("system", "Starting GitHub device flow...");
   let deviceResp;
@@ -7609,11 +8104,11 @@ async function loginWithGithubDevice(context) {
     `Open ${verification_uri} in your browser and enter code: ${user_code}
 (Waiting for authorization \u2014 expires in ${expires_in}s)`
   );
-  const pollMs = (interval + 1) * 1e3;
+  let pollMs = (interval + 1) * 1e3;
   const deadline = Date.now() + expires_in * 1e3;
   let githubToken = null;
   while (Date.now() < deadline) {
-    await new Promise((resolve17) => setTimeout(resolve17, pollMs));
+    await new Promise((resolve18) => setTimeout(resolve18, pollMs));
     let tokenResp;
     try {
       tokenResp = await fetch(GITHUB_TOKEN_URL, {
@@ -7636,7 +8131,8 @@ async function loginWithGithubDevice(context) {
     }
     if (tokenData.error === "authorization_pending") continue;
     if (tokenData.error === "slow_down") {
-      await new Promise((resolve17) => setTimeout(resolve17, 5e3));
+      pollMs += 5e3;
+      await new Promise((resolve18) => setTimeout(resolve18, 5e3));
       continue;
     }
     context.addMessage("system", `GitHub auth error: ${tokenData.error_description || tokenData.error}`);
@@ -7676,11 +8172,11 @@ var init_login = __esm({
     init_esm_shims();
     GITHUB_CLIENT_ID = "Ov23liOA9yKFLUEEVY3G";
     GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-    GITHUB_TOKEN_URL = "https://github.com/oauth/access_token";
+    GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
     loginCommand = {
       name: "login",
-      args: "[email|github|token]",
-      description: "Authenticate: /login your@email.com | /login github | /login <token>",
+      args: "[email|github|guest|token]",
+      description: "Authenticate: /login your@email.com | /login github | /login guest | /login <token>",
       category: "auth",
       handler: async (args2, context) => {
         const arg = args2[0];
@@ -7690,12 +8186,15 @@ var init_login = __esm({
             `Usage:
   /login your@email.com    Sign in with email + password
   /login github            GitHub device flow
+  /login guest             Anonymous guest session (limited tier)
   /login <token>           Paste an API token from msapling.com \u2192 Settings \u2192 API Keys`
           );
           return;
         }
         if (arg === "github") {
           await loginWithGithubDevice(context);
+        } else if (arg === "guest") {
+          await loginAsGuest(context);
         } else if (isEmailAddress(arg)) {
           await loginWithEmailPassword(arg, context);
         } else if (isTokenLike(arg)) {
@@ -7706,7 +8205,7 @@ var init_login = __esm({
         } else {
           context.addMessage(
             "error",
-            `Unrecognized argument: "${arg}". Expected email, 'github', or token string.`
+            `Unrecognized argument: "${arg}". Expected email, 'github', 'guest', or token string.`
           );
         }
       }
@@ -7745,7 +8244,7 @@ var init_unlock = __esm({
 
 // src/commands/doctor.ts
 import { homedir as homedir9 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { existsSync as existsSync14 } from "fs";
 import { readFile as readFile13 } from "fs/promises";
 async function checkApiHealth(client) {
@@ -7772,7 +8271,7 @@ async function checkAuthStatus(client) {
   }
 }
 async function checkSettingsFile() {
-  const settingsPath = join15(homedir9(), ".msapling", "settings.json");
+  const settingsPath = join16(homedir9(), ".msapling", "settings.json");
   try {
     if (!existsSync14(settingsPath)) {
       return { ok: false, message: `Not found: ${settingsPath}` };
@@ -8018,7 +8517,7 @@ var init_clear = __esm({
 
 // src/commands/mode.ts
 import { homedir as homedir10 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { existsSync as existsSync15 } from "fs";
 import { readFile as readFile14, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
 async function persistApprovalMode(mode, ttlMs) {
@@ -8036,7 +8535,7 @@ async function persistApprovalMode(mode, ttlMs) {
       ...ttlMs && { ttlMs }
     };
     existing.approvalMode = entry;
-    const settingsDir = join16(homedir10(), ".msapling");
+    const settingsDir = join17(homedir10(), ".msapling");
     if (!existsSync15(settingsDir)) {
       await mkdir7(settingsDir, { recursive: true });
     }
@@ -8049,7 +8548,7 @@ var init_mode = __esm({
   "src/commands/mode.ts"() {
     "use strict";
     init_esm_shims();
-    SETTINGS_PATH = join16(homedir10(), ".msapling", "settings.json");
+    SETTINGS_PATH = join17(homedir10(), ".msapling", "settings.json");
     modeCommand = {
       name: "mode",
       args: "[default|plan|acceptEdits|bypassPermissions] [...options]",
@@ -8323,7 +8822,7 @@ var init_compact = __esm({
 });
 
 // src/commands/init.ts
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { existsSync as existsSync16 } from "fs";
 import { writeFile as writeFile8 } from "fs/promises";
 var initCommand;
@@ -8338,7 +8837,7 @@ var init_init = __esm({
       handler: async (args2, context) => {
         try {
           const cwd = process.cwd();
-          const path2 = join17(cwd, "MSAPLING.md");
+          const path2 = join18(cwd, "MSAPLING.md");
           if (existsSync16(path2)) {
             context.addMessage("error", "MSAPLING.md already exists in current directory.");
             return;
@@ -8481,12 +8980,12 @@ var init_swarm = __esm({
 import { parse as parseYaml } from "yaml";
 import { existsSync as existsSync18 } from "fs";
 import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function findRecipe(name, cwd) {
   for (const dir of RECIPE_DIRS) {
     for (const suffix of NAME_SUFFIXES) {
       for (const ext of FILE_EXTS) {
-        const p = join18(cwd, dir, `${name}${suffix}${ext}`);
+        const p = join19(cwd, dir, `${name}${suffix}${ext}`);
         if (existsSync18(p)) return p;
       }
     }
@@ -8509,6 +9008,7 @@ var init_recipe = __esm({
   "src/commands/recipe.ts"() {
     "use strict";
     init_esm_shims();
+    init_src3();
     RECIPE_DIRS = [".msapling/recipes", ".claude/recipes", ".gemini/recipes"];
     NAME_SUFFIXES = ["", "-workflow"];
     FILE_EXTS = [".yaml", ".yml"];
@@ -8542,14 +9042,21 @@ var init_recipe = __esm({
           context.addMessage("system", `Usage: /recipe ${name} <prompt>  (the prompt fills $SELECTION / $PROMPT in step templates)`);
           return;
         }
+        let text;
         let recipe;
         try {
-          const text = await readFile16(path2, "utf8");
+          text = await readFile16(path2, "utf8");
           recipe = parseYaml(text);
         } catch (e) {
           context.addMessage("error", `Failed to load ${path2}: ${e.message}`);
           return;
         }
+        try {
+          const storage = new StorageManager();
+          const hash = await storage.registerRecipe(name, text);
+          context.addMessage("system", `[recipe] Resolved ${name} \u2192 recipe@${hash.slice(0, 12)}\u2026`);
+        } catch {
+        }
         const steps = recipe.steps ?? [];
         if (steps.length === 0) {
           context.addMessage("system", `Recipe '${name}' has no steps.`);
@@ -8592,13 +9099,13 @@ ${rendered}` : rendered;
 });
 
 // src/commands/skill.ts
-import { existsSync as existsSync19, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync2, statSync as statSync5 } from "fs";
 import { readFile as readFile17 } from "fs/promises";
-import { join as join19, resolve as resolve14 } from "path";
+import { join as join20, resolve as resolve14 } from "path";
 function findSkillsRoot(cwd) {
   for (const candidate of SKILLS_DIRS) {
     const full = resolve14(cwd, candidate);
-    if (existsSync19(full) && statSync4(full).isDirectory()) return full;
+    if (existsSync19(full) && statSync5(full).isDirectory()) return full;
   }
   return null;
 }
@@ -8611,10 +9118,10 @@ function listAllSkills(root) {
     return out;
   }
   for (const domain of domains) {
-    const dir = join19(root, domain);
+    const dir = join20(root, domain);
     let s;
     try {
-      s = statSync4(dir);
+      s = statSync5(dir);
     } catch {
       continue;
     }
@@ -8627,7 +9134,7 @@ function listAllSkills(root) {
     }
     for (const f of files) {
       if (!f.endsWith(".md")) continue;
-      out.push({ domain, name: f.slice(0, -3), path: join19(dir, f) });
+      out.push({ domain, name: f.slice(0, -3), path: join20(dir, f) });
     }
   }
   return out.sort(
@@ -8717,8 +9224,9 @@ ${prompt}`;
 
 // src/commands/benchmark.ts
 import { homedir as homedir11 } from "os";
-import { join as join20 } from "path";
-import { mkdirSync as mkdirSync3, writeFileSync } from "fs";
+import { join as join21 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import * as fs2 from "fs";
 function parseArgs(args2) {
   let models = null;
   let rounds = 1;
@@ -8833,10 +9341,10 @@ HW at start: ${hw.cores}-core ${hw.platform} | CPU ${hw.cpuPct}% | RAM ${hw.ramP
           `[HW at run time: CPU ${hwAtEnd.cpuPct}% / RAM ${hwAtEnd.ramPct}% | ${hw.ramGiB} GiB RAM, ${hw.cores} cores]`
         );
         try {
-          const dir = join20(homedir11(), ".msapling", "benchmarks");
-          mkdirSync3(dir, { recursive: true });
+          const dir = join21(homedir11(), ".msapling", "benchmarks");
+          mkdirSync4(dir, { recursive: true });
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 16);
-          const file = join20(dir, `${ts}.json`);
+          const file = join21(dir, `${ts}.json`);
           const run = {
             ts: (/* @__PURE__ */ new Date()).toISOString(),
             rounds,
@@ -8846,7 +9354,7 @@ HW at start: ${hw.cores}-core ${hw.platform} | CPU ${hw.cpuPct}% | RAM ${hw.ramP
             hw_end: hwAtEnd,
             results
           };
-          writeFileSync(file, JSON.stringify(run, null, 2));
+          await fs2.promises.writeFile(file, JSON.stringify(run, null, 2));
           context.addMessage("system", `Results saved to ${file}`);
         } catch (e) {
           context.addMessage("system", `Warning: could not save results \u2014 ${e?.message ?? e}`);
@@ -9082,12 +9590,12 @@ var init_theme = __esm({
 });
 
 // src/commands/theme.ts
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { homedir as homedir12 } from "os";
 import { existsSync as existsSync20 } from "fs";
-import { readFile as readFile18, writeFile as writeFile9, mkdir as mkdir8 } from "fs/promises";
+import { readFile as readFile18, writeFile as writeFile9 } from "fs/promises";
 async function persistTheme(storage, themeName) {
-  const settingsPath = join21(homedir12(), ".msapling", "settings.json");
+  const settingsPath = join22(homedir12(), ".msapling", "settings.json");
   let existing = {};
   try {
     if (existsSync20(settingsPath)) {
@@ -9097,7 +9605,7 @@ async function persistTheme(storage, themeName) {
   } catch {
   }
   existing["theme"] = themeName;
-  await mkdir8(join21(homedir12(), ".msapling"), { recursive: true });
+  ensureConfigDir(join22(homedir12(), ".msapling"));
   await writeFile9(settingsPath, JSON.stringify(existing, null, 2), "utf8");
 }
 var VALID_THEMES, themeCommand;
@@ -9106,6 +9614,7 @@ var init_theme2 = __esm({
     "use strict";
     init_esm_shims();
     init_theme();
+    init_src3();
     VALID_THEMES = ["diamond", "onyx", "mono"];
     themeCommand = {
       name: "theme",
@@ -9153,7 +9662,7 @@ Available themes: ${VALID_THEMES.join(", ")}`);
 });
 
 // src/commands/version.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import { existsSync as existsSync21 } from "fs";
 import { readFile as readFile19 } from "fs/promises";
 function row2(label, value) {
@@ -9182,8 +9691,8 @@ var init_version = __esm({
       category: "debug",
       handler: async (_args, context) => {
         const baseDir = typeof __dirname !== "undefined" ? __dirname : process.cwd();
-        const cliPkgPath = join22(baseDir, "..", "..", "package.json");
-        const corePkgPath = join22(baseDir, "..", "..", "..", "core", "package.json");
+        const cliPkgPath = join23(baseDir, "..", "..", "package.json");
+        const corePkgPath = join23(baseDir, "..", "..", "..", "core", "package.json");
         const [cliVersion, coreVersion] = await Promise.all([
           readPackageVersion(cliPkgPath),
           readPackageVersion(corePkgPath)
@@ -9208,13 +9717,13 @@ var init_version = __esm({
 });
 
 // src/commands/feedback.ts
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import { existsSync as existsSync22 } from "fs";
 import { readFile as readFile20 } from "fs/promises";
 async function readCliVersion() {
   try {
     const baseDir = typeof __dirname !== "undefined" ? __dirname : process.cwd();
-    const pkgPath = join23(baseDir, "..", "..", "package.json");
+    const pkgPath = join24(baseDir, "..", "..", "package.json");
     if (!existsSync22(pkgPath)) return "unknown";
     const text = await readFile20(pkgPath, "utf8");
     const json = JSON.parse(text);
@@ -9257,8 +9766,8 @@ var init_feedback = __esm({
 
 // src/commands/export.ts
 import { homedir as homedir13 } from "os";
-import { join as join24 } from "path";
-import { writeFile as writeFile10, mkdir as mkdir9 } from "fs/promises";
+import { join as join25 } from "path";
+import { writeFile as writeFile10, mkdir as mkdir8 } from "fs/promises";
 function formatTimestamp(date) {
   return date.toISOString().replace(/[:.]/g, "-").replace("T", "_").slice(0, 19);
 }
@@ -9307,10 +9816,10 @@ var init_export = __esm({
         let outputPath;
         let content;
         if (arg === "" || arg === "json") {
-          outputPath = join24(homedir13(), `msapling-export-${timestamp}.json`);
+          outputPath = join25(homedir13(), `msapling-export-${timestamp}.json`);
           content = buildJsonExport(history);
         } else if (arg === "markdown" || arg === "md") {
-          outputPath = join24(homedir13(), `msapling-export-${timestamp}.md`);
+          outputPath = join25(homedir13(), `msapling-export-${timestamp}.md`);
           content = buildMarkdownExport(history);
         } else {
           outputPath = arg;
@@ -9322,8 +9831,8 @@ var init_export = __esm({
           }
         }
         try {
-          const dir = join24(outputPath, "..");
-          await mkdir9(dir, { recursive: true });
+          const dir = join25(outputPath, "..");
+          await mkdir8(dir, { recursive: true });
           await writeFile10(outputPath, content, "utf8");
           context.addMessage("system", `Exported to: ${outputPath}`);
         } catch (e) {
@@ -9518,11 +10027,11 @@ var init_plan = __esm({
 
 // src/commands/note.ts
 import { homedir as homedir14 } from "os";
-import { join as join25 } from "path";
-import { mkdirSync as mkdirSync4, existsSync as existsSync23 } from "fs";
+import { join as join26 } from "path";
+import { existsSync as existsSync23 } from "fs";
 import { readFile as readFile21, writeFile as writeFile11 } from "fs/promises";
 function getNotesFilePath() {
-  return join25(homedir14(), ".msapling", "notes.json");
+  return join26(homedir14(), ".msapling", "notes.json");
 }
 async function readNotes(filePath = getNotesFilePath()) {
   try {
@@ -9536,8 +10045,8 @@ async function readNotes(filePath = getNotesFilePath()) {
   }
 }
 async function writeNotes(notes, filePath = getNotesFilePath()) {
-  const dir = join25(homedir14(), ".msapling");
-  mkdirSync4(dir, { recursive: true });
+  const dir = join26(homedir14(), ".msapling");
+  ensureConfigDir(dir);
   await writeFile11(filePath, JSON.stringify(notes, null, 2), "utf8");
 }
 function formatTimestamp2(iso) {
@@ -9681,6 +10190,238 @@ var init_todo = __esm({
   }
 });
 
+// src/commands/outputStyle.ts
+import { homedir as homedir15 } from "os";
+import { join as join27, basename, extname as extname3 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+function stylesDir() {
+  return join27(homedir15(), ".msapling", "output-styles");
+}
+function activeFile() {
+  return join27(stylesDir(), ".active");
+}
+function parseStyleFile(text) {
+  const fm = text.match(/^---\s*\n([\s\S]*?)\n---\s*\n?/);
+  if (!fm) {
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const desc = line.replace(/^#\s+/, "").trim();
+      return { description: desc || "(user style)", body: text.trim() };
+    }
+    return { description: "(user style)", body: text.trim() };
+  }
+  const meta = fm[1];
+  const body = text.slice(fm[0].length).trim();
+  const descMatch = meta.match(/^description:\s*(.+)$/m);
+  const description = descMatch ? descMatch[1].trim().replace(/^['"]|['"]$/g, "") : "(user style)";
+  return { description, body };
+}
+function listUserStyles() {
+  const dir = stylesDir();
+  if (!existsSync24(dir)) return [];
+  const out = [];
+  for (const entry of readdirSync3(dir)) {
+    if (extname3(entry).toLowerCase() !== ".md") continue;
+    const full = join27(dir, entry);
+    try {
+      const text = readFileSync(full, "utf8");
+      const { description, body } = parseStyleFile(text);
+      out.push({
+        name: basename(entry, ".md"),
+        description,
+        body,
+        source: "user",
+        path: full
+      });
+    } catch {
+    }
+  }
+  return out;
+}
+function listStyles() {
+  const user = listUserStyles();
+  const userNames = new Set(user.map((s) => s.name));
+  const builtins = BUILTIN_STYLES.filter((s) => !userNames.has(s.name));
+  return [...builtins, ...user];
+}
+function findStyle(name) {
+  return listStyles().find((s) => s.name === name) ?? null;
+}
+function getActiveStyleName() {
+  try {
+    const f = activeFile();
+    if (!existsSync24(f)) return "default";
+    return readFileSync(f, "utf8").trim() || "default";
+  } catch {
+    return "default";
+  }
+}
+function setActiveStyleName(name) {
+  const dir = stylesDir();
+  if (!existsSync24(dir)) mkdirSync5(dir, { recursive: true });
+  writeFileSync2(activeFile(), `${name}
+`, "utf8");
+}
+function getActiveStyle() {
+  const name = getActiveStyleName();
+  return findStyle(name) ?? BUILTIN_STYLES[0];
+}
+function createUserStyle(name, description, body) {
+  if (!/^[a-z0-9][a-z0-9_-]*$/i.test(name)) {
+    throw new Error(`Invalid style name "${name}" \u2014 use letters, digits, _ and - only.`);
+  }
+  const dir = stylesDir();
+  if (!existsSync24(dir)) mkdirSync5(dir, { recursive: true });
+  const target = join27(dir, `${name}.md`);
+  const frontmatter = `---
+description: ${description.replace(/\n/g, " ")}
+---
+
+`;
+  writeFileSync2(target, frontmatter + body.trim() + "\n", "utf8");
+  return target;
+}
+var BUILTIN_STYLES, outputStyleCommand;
+var init_outputStyle = __esm({
+  "src/commands/outputStyle.ts"() {
+    "use strict";
+    init_esm_shims();
+    BUILTIN_STYLES = [
+      {
+        name: "default",
+        description: "Default MSapling behavior \u2014 no extra system prefix.",
+        body: "",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "concise",
+        description: "Terse, code-first answers; minimal prose.",
+        body: "You are MSapling in concise mode. Keep every response as short as possible.\nPrefer code blocks, bullet lists, and direct answers. Skip preamble, recap,\nand offers to elaborate unless explicitly asked.",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "explanatory",
+        description: "Walk through reasoning and trade-offs before the answer.",
+        body: "You are MSapling in explanatory mode. Briefly walk through your reasoning,\npoint out trade-offs, and cite the relevant file or doc before giving the\nfinal answer. Aim for 2\u20133 short paragraphs, then a clear conclusion.",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "learning",
+        description: "Teach-by-doing: explain concepts, ask checkpoint questions.",
+        body: "You are MSapling in learning mode. Assume the user is new to the topic.\nExplain key concepts in plain language, surface common pitfalls, and end\nwith a one-sentence comprehension check the user can answer or skip.",
+        source: "builtin",
+        path: null
+      }
+    ];
+    outputStyleCommand = {
+      name: "output-style",
+      aliases: ["style"],
+      args: "[list|use <name>|new <name> <description>]",
+      description: "List, switch, or create assistant output styles",
+      category: "model",
+      handler: (args2, context) => {
+        const sub = (args2[0] ?? "list").toLowerCase();
+        if (sub === "list" || sub === "ls") {
+          const styles = listStyles();
+          const active = getActiveStyleName();
+          context.addMessage("system", "Output Styles:");
+          for (const s of styles) {
+            const marker = s.name === active ? "*" : " ";
+            const tag = s.source === "builtin" ? "[builtin]" : "[user]";
+            context.addMessage("system", `  ${marker} ${s.name.padEnd(14)} ${tag} ${s.description}`);
+          }
+          context.addMessage("system", `Active: ${active}`);
+          return;
+        }
+        if (sub === "use") {
+          const name = args2[1];
+          if (!name) {
+            context.addMessage("error", "Usage: /output-style use <name>");
+            return;
+          }
+          const style = findStyle(name);
+          if (!style) {
+            context.addMessage("error", `Unknown style: ${name}. Try /output-style list.`);
+            return;
+          }
+          setActiveStyleName(name);
+          context.addMessage("system", `Active output style: ${name} \u2014 ${style.description}`);
+          return;
+        }
+        if (sub === "new" || sub === "create") {
+          const name = args2[1];
+          const description = args2.slice(2).join(" ");
+          if (!name) {
+            context.addMessage("error", "Usage: /output-style new <name> <description>");
+            return;
+          }
+          try {
+            const path2 = createUserStyle(name, description || `User style: ${name}`, "");
+            context.addMessage(
+              "system",
+              `Created ${path2} \u2014 edit the file to define the system prompt body, then /output-style use ${name}`
+            );
+          } catch (e) {
+            context.addMessage("error", e.message ?? String(e));
+          }
+          return;
+        }
+        if (sub === "show") {
+          const style = getActiveStyle();
+          context.addMessage("system", `Active style: ${style.name} (${style.source})`);
+          context.addMessage("system", `Description: ${style.description}`);
+          if (style.body) {
+            context.addMessage("system", "\u2500\u2500\u2500 body \u2500\u2500\u2500");
+            context.addMessage("system", style.body);
+          } else {
+            context.addMessage("system", "(no system-prompt body \u2014 default behavior)");
+          }
+          return;
+        }
+        context.addMessage(
+          "error",
+          `Unknown subcommand: ${sub}. Try /output-style list|use|new|show`
+        );
+      }
+    };
+  }
+});
+
+// src/commands/totp.ts
+var totpCommand;
+var init_totp = __esm({
+  "src/commands/totp.ts"() {
+    "use strict";
+    init_esm_shims();
+    totpCommand = {
+      name: "totp",
+      args: "<code>",
+      description: "Step up the current session with a 6-digit TOTP code",
+      category: "auth",
+      handler: async (args2, context) => {
+        const code = (args2[0] || "").trim();
+        if (!/^\d{6}$/.test(code)) {
+          context.addMessage("error", "Usage: /totp <6-digit code>");
+          return;
+        }
+        try {
+          const result = await context.client.verifyLoginTotp(code);
+          await context.storage.saveToken(result.token);
+          context.client.setToken(result.token);
+          await context.refreshOverview();
+          context.addMessage("system", "TOTP verified \u2014 session now fully authenticated.");
+        } catch (err) {
+          context.addMessage("error", `TOTP verification failed: ${err}`);
+        }
+      }
+    };
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -9727,6 +10468,8 @@ var init_commands = __esm({
     init_plan();
     init_note();
     init_todo();
+    init_outputStyle();
+    init_totp();
     commands = [
       loginCommand,
       unlockCommand,
@@ -9758,11 +10501,481 @@ var init_commands = __esm({
       shortcutsCommand,
       planCommand,
       noteCommand,
-      todoCommand
+      todoCommand,
+      outputStyleCommand,
+      totpCommand
     ];
   }
 });
 
+// src/runtime/exec.ts
+var exec_exports = {};
+__export(exec_exports, {
+  runExec: () => runExec
+});
+async function runExec(rawInput) {
+  const trimmed = (rawInput || "").trim();
+  if (!trimmed) {
+    process.stderr.write("msapling --exec: empty command\n");
+    return 2;
+  }
+  const parts = trimmed.split(/\s+/);
+  const name = parts[0];
+  const args2 = parts.slice(1);
+  const cmd = findCommand(name);
+  if (!cmd) {
+    process.stderr.write(`msapling --exec: unknown command "${name}"
+`);
+    return 2;
+  }
+  const storage = new StorageManager();
+  const token = await storage.loadToken().catch(() => null);
+  const client = new MSaplingClient({
+    apiUrl: process.env.MSAPLING_API_URL,
+    token: token || void 0
+  });
+  const stdout = process.stdout;
+  let mode = "default";
+  let model = process.env.MSAPLING_MODEL || "google/gemini-2.0-flash-001";
+  let projectId = null;
+  let activeChatId = null;
+  const context = {
+    client,
+    storage,
+    activeChatId,
+    setActiveChatId: (id) => {
+      activeChatId = id;
+    },
+    addMessage: (role, content) => {
+      stdout.write(`[${role}] ${content}
+`);
+    },
+    clearHistory: () => {
+    },
+    setMode: (m) => {
+      mode = m;
+    },
+    getMode: () => mode,
+    setModel: (m) => {
+      model = m;
+    },
+    getModel: () => model,
+    setProjectId: (id) => {
+      projectId = id;
+    },
+    getProjectId: () => projectId,
+    lastCost: 0,
+    sessionCost: 0,
+    refreshOverview: async () => {
+    },
+    exit: () => {
+    }
+  };
+  try {
+    await cmd.handler(args2, context);
+    return 0;
+  } catch (e) {
+    process.stderr.write(`msapling --exec: error: ${e?.message ?? e}
+`);
+    return 1;
+  }
+}
+var init_exec = __esm({
+  "src/runtime/exec.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_src();
+    init_src3();
+    init_commands();
+  }
+});
+
+// src/runtime/doctorRedact.ts
+function redactSecrets(text) {
+  let out = text;
+  for (const [re, replacement] of PATTERNS) {
+    out = out.replace(re, replacement);
+  }
+  return out;
+}
+var PATTERNS;
+var init_doctorRedact = __esm({
+  "src/runtime/doctorRedact.ts"() {
+    "use strict";
+    init_esm_shims();
+    PATTERNS = [
+      // Legacy key=value pairs (from original doctor.ts redactSecrets).
+      [/token[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "token=***"],
+      [/password[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "password=***"],
+      [/api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "api_key=***"],
+      [/secret[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "secret=***"],
+      [/MSAPLING_TOKEN=.*/gi, "MSAPLING_TOKEN=***"],
+      [/MSAPLING_API_KEY=.*/gi, "MSAPLING_API_KEY=***"],
+      // Bearer tokens (case-insensitive).
+      [/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer ***"],
+      // GitHub PATs — keep the prefix so the credential class is identifiable.
+      [/\bghp_[A-Za-z0-9]{20,}/g, "ghp_***"],
+      [/\bghs_[A-Za-z0-9]{20,}/g, "ghs_***"],
+      [/\bgho_[A-Za-z0-9]{20,}/g, "gho_***"],
+      [/\bghu_[A-Za-z0-9]{20,}/g, "ghu_***"],
+      [/\bghr_[A-Za-z0-9]{20,}/g, "ghr_***"],
+      [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "github_pat_***"],
+      // AWS access key IDs.
+      [/\bAKIA[0-9A-Z]{16}\b/g, "AKIA***"],
+      [/\bASIA[0-9A-Z]{16}\b/g, "ASIA***"],
+      // Slack tokens (xoxa/xoxb/xoxp/xoxr/xoxs/xoxe-...).
+      [/\bxox[abpres]-[A-Za-z0-9-]{10,}/gi, "xox-***"],
+      // Anthropic + OpenAI style. Anthropic first to preserve "sk-ant-" prefix.
+      [/\bsk-ant-[A-Za-z0-9_-]{20,}/g, "sk-ant-***"],
+      [/\bsk-[A-Za-z0-9_-]{20,}/g, "sk-***"],
+      // JWT-ish payload: three base64url segments separated by dots, header starts eyJ.
+      [/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g, "***jwt***"]
+    ];
+  }
+});
+
+// src/runtime/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  runDoctor: () => runDoctor
+});
+import { homedir as homedir16, platform as platform3 } from "os";
+import { join as join28 } from "path";
+import { existsSync as existsSync26, statSync as statSync6, accessSync } from "fs";
+import { readdir as readdir3 } from "fs/promises";
+import { exec } from "child_process";
+import { promisify } from "util";
+async function checkNodeVersion() {
+  const version = process.version;
+  const match = version.match(/v(\d+)/);
+  const major = match ? parseInt(match[1], 10) : 0;
+  if (major >= 18) {
+    return {
+      name: "Node version",
+      status: "PASS",
+      message: `${version} (>=18)`
+    };
+  }
+  return {
+    name: "Node version",
+    status: "FAIL",
+    message: `${version} (requires >=18)`,
+    remediation: `Upgrade Node.js to v18+ from https://nodejs.org/`
+  };
+}
+async function checkConfigDir() {
+  const configDir = join28(homedir16(), ".msapling");
+  if (!existsSync26(configDir)) {
+    return {
+      name: "Config directory",
+      status: "WARN",
+      message: `${configDir} does not exist`,
+      remediation: `mkdir -p "${configDir}" && chmod 700 "${configDir}"`
+    };
+  }
+  const stats = statSync6(configDir);
+  if (!stats.isDirectory()) {
+    return {
+      name: "Config directory",
+      status: "FAIL",
+      message: `${configDir} exists but is not a directory`,
+      remediation: `rm "${configDir}" && mkdir -p "${configDir}"`
+    };
+  }
+  if (platform3() !== "win32") {
+    const mode = stats.mode & 511;
+    const safe = (mode & 63) === 0;
+    if (!safe) {
+      return {
+        name: "Config directory",
+        status: "WARN",
+        message: `${configDir} has overly permissive perms (${(mode & 511).toString(8)})`,
+        remediation: `chmod 700 "${configDir}"`
+      };
+    }
+  }
+  return {
+    name: "Config directory",
+    status: "PASS",
+    message: `${configDir} exists and is readable`
+  };
+}
+async function checkKeytar() {
+  try {
+    const keytar2 = await import("keytar");
+    if (keytar2 && typeof keytar2.getPassword === "function") {
+      return {
+        name: "Keytar native binary",
+        status: "PASS",
+        message: "Keytar loadable and functional"
+      };
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Keytar native binary",
+      status: "WARN",
+      message: `Keytar unavailable: ${msg}`,
+      remediation: `Token will be stored in plaintext. Run 'npm rebuild keytar' or 'bun install --force' to rebuild native bindings.`
+    };
+  }
+  return {
+    name: "Keytar native binary",
+    status: "WARN",
+    message: "Keytar check inconclusive",
+    remediation: `Run 'npm rebuild keytar' or 'bun install --force' to rebuild native bindings.`
+  };
+}
+async function checkPathConflicts() {
+  const pathEnv = process.env.PATH || "";
+  const paths = pathEnv.split(platform3() === "win32" ? ";" : ":");
+  const conflicts = [];
+  for (const dir of paths) {
+    if (!dir || !existsSync26(dir)) continue;
+    try {
+      const files = await readdir3(dir);
+      for (const file of files) {
+        if (file === "msapling" || file === "msapling.exe" || file === "msapling.py") {
+          const fullPath = join28(dir, file);
+          conflicts.push(fullPath);
+        }
+      }
+    } catch {
+    }
+  }
+  if (conflicts.length === 0) {
+    return {
+      name: "PATH conflicts",
+      status: "PASS",
+      message: "No conflicting msapling binaries found"
+    };
+  }
+  if (conflicts.length === 1) {
+    return {
+      name: "PATH conflicts",
+      status: "PASS",
+      message: `Single msapling binary found: ${conflicts[0]}`
+    };
+  }
+  return {
+    name: "PATH conflicts",
+    status: "WARN",
+    message: `Multiple msapling binaries found in PATH`,
+    remediation: `Found: ${conflicts.join(", ")}. Remove stale copies (especially .py or .exe).`
+  };
+}
+async function checkNetworkReach() {
+  const apiUrl = process.env.MSAPLING_API_URL || "https://api.msapling.com";
+  const timeout = 5e3;
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    const response = await fetch(`${apiUrl}/api/health`, {
+      method: "HEAD",
+      signal: controller.signal
+    });
+    clearTimeout(timeoutId);
+    if (response.ok) {
+      return {
+        name: "Network reach",
+        status: "PASS",
+        message: `${apiUrl} reachable`
+      };
+    }
+    return {
+      name: "Network reach",
+      status: "WARN",
+      message: `${apiUrl} returned status ${response.status}`,
+      remediation: `Check your network connection or API server status.`
+    };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Network reach",
+      status: "WARN",
+      message: `Cannot reach ${apiUrl}: ${msg}`,
+      remediation: `Check your network connection and firewall settings.`
+    };
+  }
+}
+async function checkTokenValidity() {
+  try {
+    const keytar2 = await import("keytar");
+    const KEYCHAIN_SERVICE = "msapling-cli";
+    const KEYCHAIN_ACCOUNT = "auth_token";
+    const token = await keytar2.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    if (!token) {
+      return {
+        name: "Token validity",
+        status: "WARN",
+        message: "No token stored in keychain",
+        remediation: `Run 'msapling login' to authenticate.`
+      };
+    }
+    if (typeof token === "string" && token.length > 10) {
+      return {
+        name: "Token validity",
+        status: "PASS",
+        message: `Token loaded (${token.length} chars)`
+      };
+    }
+    return {
+      name: "Token validity",
+      status: "WARN",
+      message: "Token present but appears invalid",
+      remediation: `Run 'msapling login' to re-authenticate.`
+    };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Token validity",
+      status: "WARN",
+      message: `Cannot check token: ${msg}`,
+      remediation: `Run 'msapling login' to authenticate.`
+    };
+  }
+}
+async function checkOsSpecific() {
+  if (platform3() === "win32") {
+    try {
+      const configDir = join28(homedir16(), ".msapling");
+      const longPath = "A".repeat(260);
+      const testPath = join28(configDir, longPath);
+      try {
+        accessSync(configDir);
+      } catch {
+        return {
+          name: "OS-specific (Windows)",
+          status: "WARN",
+          message: "Cannot verify Windows long-path support",
+          remediation: `Enable LongPathsEnabled in Registry or use 'fsutil 8dot3name set C: 0'.`
+        };
+      }
+      return {
+        name: "OS-specific (Windows)",
+        status: "PASS",
+        message: "Windows long-path support accessible"
+      };
+    } catch (e) {
+      return {
+        name: "OS-specific (Windows)",
+        status: "WARN",
+        message: "Windows long-path check failed",
+        remediation: `Enable LongPathsEnabled in Registry or use 'fsutil 8dot3name set C: 0'.`
+      };
+    }
+  }
+  if (platform3() === "darwin") {
+    return {
+      name: "OS-specific (macOS)",
+      status: "PASS",
+      message: "macOS detected"
+    };
+  }
+  if (platform3() === "linux") {
+    try {
+      await import("keytar");
+      return {
+        name: "OS-specific (Linux)",
+        status: "PASS",
+        message: "libsecret/keytar dependencies available"
+      };
+    } catch (e) {
+      return {
+        name: "OS-specific (Linux)",
+        status: "WARN",
+        message: "libsecret may not be installed",
+        remediation: `Install libsecret: sudo apt-get install libsecret-1-dev (Ubuntu/Debian) or dnf install libsecret-devel (Fedora)`
+      };
+    }
+  }
+  return {
+    name: "OS-specific",
+    status: "PASS",
+    message: `${platform3()} detected`
+  };
+}
+function formatCheckResult(result, maxLabelWidth) {
+  const indicator2 = result.status === "PASS" ? "\u2713" : result.status === "WARN" ? "\u26A0" : "\u2717";
+  const paddedLabel = result.name.padEnd(maxLabelWidth);
+  const statusStr = `[${indicator2} ${result.status}]`.padEnd(10);
+  let output = `  ${paddedLabel} ${statusStr} ${result.message}`;
+  if (result.remediation) {
+    output += `
+    \u2192 ${result.remediation}`;
+  }
+  return output;
+}
+function dumpEnv(debug) {
+  if (!debug) return [];
+  const lines = [];
+  lines.push("");
+  lines.push("\u2500".repeat(60));
+  lines.push("Environment variables:");
+  lines.push("\u2500".repeat(60));
+  const env = { ...process.env };
+  const keys = Object.keys(env).sort();
+  for (const key of keys) {
+    const value = env[key] || "";
+    const redacted = redactSecrets(value);
+    lines.push(`${key}=${redacted}`);
+  }
+  return lines;
+}
+async function runDoctor(debug = false) {
+  const output = [];
+  output.push("");
+  output.push("MSapling Doctor \u2014 Health Check");
+  output.push("\u2500".repeat(60));
+  const checks = [];
+  checks.push(await checkNodeVersion());
+  checks.push(await checkConfigDir());
+  checks.push(await checkKeytar());
+  checks.push(await checkPathConflicts());
+  checks.push(await checkNetworkReach());
+  checks.push(await checkTokenValidity());
+  checks.push(await checkOsSpecific());
+  const maxLabelWidth = Math.max(...checks.map((c) => c.name.length));
+  for (const check of checks) {
+    output.push(formatCheckResult(check, maxLabelWidth));
+  }
+  output.push("");
+  output.push("\u2500".repeat(60));
+  const failCount = checks.filter((c) => c.status === "FAIL").length;
+  const warnCount = checks.filter((c) => c.status === "WARN").length;
+  if (failCount === 0 && warnCount === 0) {
+    output.push("All checks passed! \u2713");
+  } else {
+    const msgs = [];
+    if (failCount > 0) msgs.push(`${failCount} failed`);
+    if (warnCount > 0) msgs.push(`${warnCount} warning(s)`);
+    output.push(`Status: ${msgs.join(", ")}`);
+  }
+  output.push("");
+  if (debug) {
+    output.push(...dumpEnv(true));
+    output.push("");
+  }
+  const rendered = output.join("\n");
+  console.log(rendered);
+  return {
+    exitCode: failCount > 0 ? 1 : 0,
+    checks,
+    failCount,
+    warnCount,
+    rendered
+  };
+}
+var execAsync;
+var init_doctor2 = __esm({
+  "src/runtime/doctor.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_doctorRedact();
+    execAsync = promisify(exec);
+  }
+});
+
 // ../../node_modules/.bun/diff@9.0.0/node_modules/diff/libesm/diff/base.js
 var Diff;
 var init_base = __esm({
@@ -9849,13 +11062,13 @@ var init_base = __esm({
           editLength++;
         };
         if (callback) {
-          (function exec() {
+          (function exec2() {
             setTimeout(function() {
               if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {
                 return callback(void 0);
               }
               if (!execEditLength()) {
-                exec();
+                exec2();
               }
             }, 0);
           })();
@@ -10909,7 +12122,7 @@ async function mergeToolRegistries(localTools, client) {
       return Array.from(merged.values());
     }
     for (const backendTool of registry.tools) {
-      const tier = backendTool.tier_required === "free" || backendTool.tier_required === "pro" ? backendTool.tier_required : "free";
+      const tier = backendTool.tier_required === "free" || backendTool.tier_required === "pro" || backendTool.tier_required === "lifetime" || backendTool.tier_required === "enterprise" ? backendTool.tier_required : "enterprise";
       if (!merged.has(backendTool.name)) {
         merged.set(backendTool.name, {
           name: backendTool.name,
@@ -10939,17 +12152,17 @@ var init_registry_merger = __esm({
 
 // ../core/src/mcp/local_tools.ts
 import { spawn as spawn10 } from "child_process";
-import { readdir as readdir3, stat as stat4, realpath as realpath2 } from "fs/promises";
-import { resolve as resolve15 } from "path";
+import { readdir as readdir4, stat as stat4, realpath as realpath2 } from "fs/promises";
+import { resolve as resolve16 } from "path";
 function asResult(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
 async function runCommand(command, cwd) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let p;
     const timeout = setTimeout(() => {
       if (p) p.kill();
-      resolve17({ stdout: "", stderr: "Command timed out after 30s", exit_code: -1 });
+      resolve18({ stdout: "", stderr: "Command timed out after 30s", exit_code: -1 });
     }, 3e4);
     try {
       p = spawn10("sh", ["-c", command], {
@@ -10967,15 +12180,15 @@ async function runCommand(command, cwd) {
       });
       p.on("error", (e) => {
         clearTimeout(timeout);
-        resolve17({ stdout, stderr: stderr + (e?.message ?? ""), exit_code: -1 });
+        resolve18({ stdout, stderr: stderr + (e?.message ?? ""), exit_code: -1 });
       });
       p.on("exit", (code) => {
         clearTimeout(timeout);
-        resolve17({ stdout, stderr, exit_code: code });
+        resolve18({ stdout, stderr, exit_code: code });
       });
     } catch (e) {
       clearTimeout(timeout);
-      resolve17({
+      resolve18({
         stdout: "",
         stderr: e?.message ?? "Failed to spawn process",
         exit_code: -1
@@ -10985,7 +12198,7 @@ async function runCommand(command, cwd) {
 }
 async function listDirectory(path2, maxEntries = 100) {
   try {
-    const entries = await readdir3(path2, { withFileTypes: true });
+    const entries = await readdir4(path2, { withFileTypes: true });
     const result = [];
     for (const entry of entries.slice(0, maxEntries)) {
       const item = {
@@ -11042,7 +12255,7 @@ async function callLocalTool(name, args2, projectRoot) {
       const command = String(args2.command ?? "");
       let cwd = projectRoot;
       if (args2.cwd) {
-        cwd = resolve15(projectRoot, String(args2.cwd));
+        cwd = resolve16(projectRoot, String(args2.cwd));
         try {
           const resolvedCwd = await realpath2(cwd);
           const resolvedRoot = await realpath2(projectRoot);
@@ -11079,7 +12292,7 @@ ${res.stderr}`
         return asResult("path is required", true);
       }
       try {
-        const resolvedPath = await realpath2(resolve15(projectRoot, pathArg));
+        const resolvedPath = await realpath2(resolve16(projectRoot, pathArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedPath.startsWith(resolvedRoot)) {
           return asResult("Error: path attempts to escape project root", true);
@@ -11098,7 +12311,7 @@ ${res.stderr}`
     }
     case "local_glob": {
       const pattern = String(args2.pattern ?? "");
-      let cwd = args2.cwd ? resolve15(projectRoot, String(args2.cwd)) : projectRoot;
+      let cwd = args2.cwd ? resolve16(projectRoot, String(args2.cwd)) : projectRoot;
       if (!pattern) {
         return asResult("pattern is required", true);
       }
@@ -11127,7 +12340,7 @@ ${res.stderr}`
       }
       if (path2) {
         try {
-          const resolvedPath = await realpath2(resolve15(projectRoot, path2));
+          const resolvedPath = await realpath2(resolve16(projectRoot, path2));
           const resolvedRoot = await realpath2(projectRoot);
           if (!resolvedPath.startsWith(resolvedRoot)) {
             return asResult("Error: path attempts to escape project root", true);
@@ -11147,7 +12360,7 @@ ${res.stderr}`
         return asResult("cwd is required", true);
       }
       try {
-        const resolvedCwd = await realpath2(resolve15(projectRoot, cwdArg));
+        const resolvedCwd = await realpath2(resolve16(projectRoot, cwdArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedCwd.startsWith(resolvedRoot)) {
           return asResult("Error: cwd attempts to escape project root", true);
@@ -11173,7 +12386,7 @@ ${status.porcelain || "(clean)"}`
         return asResult("cwd is required", true);
       }
       try {
-        const resolvedCwd = await realpath2(resolve15(projectRoot, cwdArg));
+        const resolvedCwd = await realpath2(resolve16(projectRoot, cwdArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedCwd.startsWith(resolvedRoot)) {
           return asResult("Error: cwd attempts to escape project root", true);
@@ -11288,8 +12501,8 @@ __export(server_exports, {
   runStdio: () => runStdio,
   runStdioWithRegistry: () => runStdioWithRegistry
 });
-import { readdirSync as readdirSync3, readFileSync, statSync as statSync5 } from "fs";
-import { join as join26, relative as relative14, resolve as resolve16 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync2, statSync as statSync7 } from "fs";
+import { join as join29, relative as relative14, resolve as resolve17 } from "path";
 function asResult2(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -11302,17 +12515,17 @@ function buildFileTree(root, maxFiles) {
     const dir = queue.shift();
     let entries;
     try {
-      entries = readdirSync3(dir);
+      entries = readdirSync4(dir);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (out.length >= maxFiles) break;
       if (SKIP_DIRS2.has(name)) continue;
-      const full = join26(dir, name);
+      const full = join29(dir, name);
       let s;
       try {
-        s = statSync5(full);
+        s = statSync7(full);
       } catch {
         continue;
       }
@@ -11333,7 +12546,7 @@ function readFilesAsContext(root, files, maxKB) {
   for (const f of files) {
     let body;
     try {
-      body = readFileSync(f, "utf8");
+      body = readFileSync2(f, "utf8");
     } catch {
       continue;
     }
@@ -11347,11 +12560,37 @@ ${body}
   }
   return parts.join("\n\n");
 }
+function installDrainHandlers(server) {
+  const abort = new AbortController();
+  let drainStarted = false;
+  const onSignal = (sig) => {
+    if (drainStarted) return;
+    drainStarted = true;
+    process.stderr.write(`[mcp-server] received ${sig}, starting graceful drain
+`);
+    server.drain().then((forcedResponses) => {
+      for (const resp of forcedResponses) {
+        try {
+          process.stdout.write(JSON.stringify(resp) + "\n");
+        } catch {
+        }
+      }
+      process.stderr.write("[mcp-server] drain complete, exiting\n");
+      abort.abort();
+      process.exit(0);
+    });
+  };
+  process.on("SIGTERM", () => onSignal("SIGTERM"));
+  process.on("SIGINT", () => onSignal("SIGINT"));
+  return abort;
+}
 async function runStdio(client) {
   const server = new MCPServer(client);
+  const abort = installDrainHandlers(server);
   let buffer = "";
   const decoder = new TextDecoder();
   for await (const chunk of process.stdin) {
+    if (abort.signal.aborted) break;
     buffer += decoder.decode(chunk, { stream: true });
     let idx;
     while ((idx = buffer.indexOf("\n")) !== -1) {
@@ -11371,9 +12610,11 @@ async function runStdio(client) {
 }
 async function runStdioWithRegistry(client, registryClient) {
   const server = new MCPServer(client, registryClient || client);
+  const abort = installDrainHandlers(server);
   let buffer = "";
   const decoder = new TextDecoder();
   for await (const chunk of process.stdin) {
+    if (abort.signal.aborted) break;
     buffer += decoder.decode(chunk, { stream: true });
     let idx;
     while ((idx = buffer.indexOf("\n")) !== -1) {
@@ -11391,7 +12632,7 @@ async function runStdioWithRegistry(client, registryClient) {
     }
   }
 }
-var TOOLS, PROTOCOL_VERSION2, PRO_TIERS2, TIER_CACHE_TTL_MS, SAFE_PATH_RE, MCPServer;
+var AP4_MAX_BLOB_BYTES, TOOLS, PROTOCOL_VERSION2, PRO_TIERS2, TIER_CACHE_TTL_MS, DRAIN_TIMEOUT_MS, SAFE_PATH_RE, MCPServer;
 var init_server = __esm({
   "../core/src/mcp/server.ts"() {
     "use strict";
@@ -11400,6 +12641,7 @@ var init_server = __esm({
     init_libesm();
     init_registry_merger();
     init_local_tools();
+    AP4_MAX_BLOB_BYTES = 4 * 1024;
     TOOLS = [
       {
         name: "msapling_chat",
@@ -11518,11 +12760,57 @@ var init_server = __esm({
         tier: "free",
         inputSchema: { type: "object", properties: {} }
       },
+      {
+        name: "msapling_list_wakeups",
+        description: "[Pro] List pending AI wake-ups/scheduled tasks for your account.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          properties: {
+            status: { type: "string", enum: ["pending", "fired", "cancelled", "expired"], description: "Filter by status" },
+            session_id: { type: "string", description: "Filter by chat session ID" }
+          }
+        }
+      },
+      {
+        name: "msapling_schedule_wakeup",
+        description: "[Pro] Schedule a future AI task or follow-up wakeup.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          required: ["delay_seconds", "reason"],
+          properties: {
+            delay_seconds: { type: "number", description: "Delay in seconds from now" },
+            reason: { type: "string", description: "Short description of what the AI should do" },
+            prompt: { type: "string", description: "Specific prompt to process when the wakeup fires" },
+            session_id: { type: "string", description: "Associate with an existing chat session" }
+          }
+        }
+      },
+      {
+        name: "msapling_cancel_wakeup",
+        description: "[Pro] Cancel a pending AI wakeup.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          required: ["id"],
+          properties: {
+            id: { type: "string", description: "The wakeup UUID to cancel" }
+          }
+        }
+      },
+      {
+        name: "msapling_fleet_status",
+        description: "[Pro] View status of your remote agent fleet and active tasks.",
+        tier: "pro",
+        inputSchema: { type: "object", properties: {} }
+      },
       ...LOCAL_TOOLS
     ];
     PROTOCOL_VERSION2 = "2024-11-05";
     PRO_TIERS2 = /* @__PURE__ */ new Set(["pro", "monthly", "lifetime", "enterprise", "admin", "superadmin"]);
     TIER_CACHE_TTL_MS = 6e4;
+    DRAIN_TIMEOUT_MS = 5e3;
     SAFE_PATH_RE = /^[A-Za-z0-9_./\-\\: ]+$/;
     MCPServer = class {
       constructor(client, backendClient) {
@@ -11533,6 +12821,83 @@ var init_server = __esm({
       backendClient;
       tierCache = null;
       registryCache = null;
+      /**
+       * CLIENT-CLI-16: When true, the server is shutting down. New tool calls
+       * are rejected with a JSON-RPC error; only in-flight calls are allowed
+       * to finish.
+       */
+      _isDraining = false;
+      /**
+       * CLIENT-CLI-16: Set of in-flight tool call IDs. Used during draining to
+       * wait for completion before closing the transport. Capped at
+       * MAX_INFLIGHT_TOOLS.
+       */
+      _inflightCalls = /* @__PURE__ */ new Map();
+      /**
+       * CLIENT-CLI-16: Resolved when all in-flight calls complete during drain,
+       * or when the drain timeout fires.
+       */
+      _drainResolve = null;
+      /** CLIENT-CLI-16: Whether the server is currently draining. */
+      get isDraining() {
+        return this._isDraining;
+      }
+      /**
+       * CLIENT-CLI-16: Enter draining mode. Returns a promise that resolves when
+       * all in-flight calls complete or DRAIN_TIMEOUT_MS elapses, whichever
+       * comes first.
+       *
+       * After the promise resolves, any remaining in-flight calls have been
+       * forcefully closed with error responses (written to stdout by the caller).
+       */
+      async drain() {
+        this._isDraining = true;
+        const inflight = this._inflightCalls.size;
+        process.stderr.write(
+          `[mcp-server] draining: ${inflight} in-flight tool call(s)
+`
+        );
+        if (inflight === 0) {
+          return [];
+        }
+        const forcedResponses = await new Promise((resolve18) => {
+          this._drainResolve = () => resolve18([]);
+          setTimeout(() => {
+            this._drainResolve = null;
+            const remaining = Array.from(this._inflightCalls.values());
+            if (remaining.length === 0) {
+              resolve18([]);
+              return;
+            }
+            process.stderr.write(
+              `[mcp-server] drain timeout: force-closing ${remaining.length} call(s)
+`
+            );
+            const errorResponses = remaining.map((call) => ({
+              jsonrpc: "2.0",
+              id: call.id,
+              error: {
+                code: -32e3,
+                message: `Server shutdown: tool call "${call.name}" timed out after ${DRAIN_TIMEOUT_MS}ms`
+              }
+            }));
+            this._inflightCalls.clear();
+            resolve18(errorResponses);
+          }, DRAIN_TIMEOUT_MS);
+        });
+        return forcedResponses;
+      }
+      /**
+       * CLIENT-CLI-16: Called when an in-flight tool call completes during drain.
+       * If all calls are done, resolves the drain promise.
+       */
+      _completeInflight(id) {
+        this._inflightCalls.delete(id);
+        if (this._isDraining && this._inflightCalls.size === 0 && this._drainResolve) {
+          this._drainResolve();
+          this._drainResolve = null;
+        }
+      }
       /**
        * Fetch the caller's tier (Pro vs free) and cache it briefly. We avoid a
        * `me()` call per `tools/list` because Claude Code calls tools/list often
@@ -11564,6 +12929,25 @@ var init_server = __esm({
       invalidateTierCache() {
         this.tierCache = null;
       }
+      /**
+       * CLI-R12-20260507-TIER-02: Map tier name to numeric level for comparison.
+       * Higher level = more restrictive/expensive.
+       * free (1) < pro (5) < lifetime (10) < enterprise (100)
+       */
+      tierLevel(tier) {
+        switch (String(tier).toLowerCase()) {
+          case "free":
+            return 1;
+          case "pro":
+            return 5;
+          case "lifetime":
+            return 10;
+          case "enterprise":
+            return 100;
+          default:
+            return 100;
+        }
+      }
       /**
        * Fetch and cache the merged tool registry (local + backend).
        * Called on first tools/list request. Cached for session lifetime.
@@ -11601,30 +12985,62 @@ var init_server = __esm({
               return { jsonrpc: "2.0", id, result: { tools: wireFormat } };
             }
             case "tools/call": {
+              if (this._isDraining) {
+                return {
+                  jsonrpc: "2.0",
+                  id,
+                  error: {
+                    code: -32e3,
+                    message: "Server shutting down: not accepting new tool calls"
+                  }
+                };
+              }
               const name = req.params?.name;
               const args2 = req.params?.arguments ?? {};
-              const localTool = TOOLS.find((t) => t.name === name);
-              if (localTool) {
-                try {
-                  const result = await this.callTool(name, args2);
-                  return { jsonrpc: "2.0", id, result };
-                } catch (e) {
-                  const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
-                  return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+              this._inflightCalls.set(id, {
+                id,
+                name: name ?? "unknown",
+                startedAt: Date.now(),
+                resolve: () => {
                 }
-              }
-              const merged = await this.getMergedRegistry();
-              const backendTool = merged.find((t) => t.name === name && t.runs_on === "backend");
-              if (backendTool) {
-                try {
-                  const result = await this.invokeBackendTool(name, args2);
-                  return { jsonrpc: "2.0", id, result };
-                } catch (e) {
-                  const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
-                  return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+              });
+              try {
+                const localTool = TOOLS.find((t) => t.name === name);
+                if (localTool) {
+                  try {
+                    const result = await this.callTool(name, args2);
+                    const resp = { jsonrpc: "2.0", id, result };
+                    return resp;
+                  } catch (e) {
+                    const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
+                    return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+                  }
+                }
+                const merged = await this.getMergedRegistry();
+                const backendTool = merged.find((t) => t.name === name && t.runs_on === "backend");
+                if (backendTool) {
+                  const isPro = await this.getIsProCached();
+                  const toolTierLevel = this.tierLevel(backendTool.tier);
+                  const userTierLevel = isPro ? 5 : 1;
+                  if (toolTierLevel > userTierLevel) {
+                    return {
+                      jsonrpc: "2.0",
+                      id,
+                      result: asResult2(`Access denied: tool "${name}" requires ${backendTool.tier} tier`, true)
+                    };
+                  }
+                  try {
+                    const result = await this.invokeBackendTool(name, args2);
+                    return { jsonrpc: "2.0", id, result };
+                  } catch (e) {
+                    const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
+                    return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+                  }
                 }
+                return { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown tool: ${name}` } };
+              } finally {
+                this._completeInflight(id);
               }
-              return { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown tool: ${name}` } };
             }
             case "shutdown":
               return { jsonrpc: "2.0", id, result: {} };
@@ -11675,12 +13091,30 @@ ${r.response ?? ""}`;
             return asResult2(text);
           }
           case "msapling_diff": {
+            const oldContent = String(args2.old_content ?? "");
+            const newContent = String(args2.new_content ?? "");
+            const oldBytes = Buffer.byteLength(oldContent, "utf8");
+            const newBytes = Buffer.byteLength(newContent, "utf8");
+            if (oldBytes > AP4_MAX_BLOB_BYTES || newBytes > AP4_MAX_BLOB_BYTES) {
+              return asResult2(
+                `AP-4: Blobs exceed 4 KB (old=${oldBytes}B, new=${newBytes}B). Use the backend endpoint: POST /api/projects/:id/diff`,
+                true
+              );
+            }
             const filename = String(args2.filename ?? "file");
-            const patch = createPatch(filename, String(args2.old_content ?? ""), String(args2.new_content ?? ""), "", "");
+            const patch = createPatch(filename, oldContent, newContent, "", "");
             return asResult2(patch);
           }
           case "msapling_apply_diff": {
-            const applied = applyPatch(String(args2.original_content ?? ""), String(args2.diff_text ?? ""));
+            const originalContent = String(args2.original_content ?? "");
+            const originalBytes = Buffer.byteLength(originalContent, "utf8");
+            if (originalBytes > AP4_MAX_BLOB_BYTES) {
+              return asResult2(
+                `AP-4: Blob exceeds 4 KB (${originalBytes}B). Use the backend endpoint: POST /api/projects/:id/apply`,
+                true
+              );
+            }
+            const applied = applyPatch(originalContent, String(args2.diff_text ?? ""));
             if (applied === false) {
               return asResult2("Diff did not apply cleanly (hunks rejected).", true);
             }
@@ -11726,7 +13160,7 @@ ${r.response ?? ""}`;
             return asResult2(JSON.stringify(result));
           }
           case "msapling_project_context": {
-            const root = resolve16(String(args2.path ?? "."));
+            const root = resolve17(String(args2.path ?? "."));
             const maxFiles = Number.isFinite(args2.max_files) ? Number(args2.max_files) : 30;
             const maxKB = Number.isFinite(args2.max_file_size_kb) ? Number(args2.max_file_size_kb) : 50;
             const files = buildFileTree(root, maxFiles);
@@ -11777,6 +13211,36 @@ ${text}`);
             return asResult2(`Available models (${models.length} total, showing first 30):
 ${lines.join("\n")}`);
           }
+          case "msapling_list_wakeups": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_list_wakeups requires a Pro subscription.", true);
+            const data = await this.client.listWakeups(args2);
+            return asResult2(JSON.stringify(data, null, 2));
+          }
+          case "msapling_schedule_wakeup": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_schedule_wakeup requires a Pro subscription.", true);
+            const data = await this.client.createWakeup({
+              delay_seconds: Number(args2.delay_seconds),
+              reason: String(args2.reason ?? ""),
+              prompt: args2.prompt ? String(args2.prompt) : void 0,
+              session_id: args2.session_id ? String(args2.session_id) : void 0
+            });
+            return asResult2(JSON.stringify(data, null, 2));
+          }
+          case "msapling_cancel_wakeup": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_cancel_wakeup requires a Pro subscription.", true);
+            await this.client.cancelWakeup(String(args2.id));
+            return asResult2("Wakeup cancelled");
+          }
+          case "msapling_fleet_status": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_fleet_status requires a Pro subscription.", true);
+            const status = await this.client.getFleetStatus();
+            const tasks = await this.client.getActiveTasks();
+            return asResult2(JSON.stringify({ status, tasks }, null, 2));
+          }
           // Local MCP tools (filesystem, shell, git)
           case "local_run_command":
           case "local_list_directory":
@@ -11822,7 +13286,10 @@ init_esm_shims();
 import { Box, Text } from "ink";
 import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
-  /* @__PURE__ */ jsx(Text, { bold: true, color: "cyan", children: "\u25CF MSapling CLI v2.0.0" }),
+  /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
+    "\u25CF MSapling CLI v",
+    "2.3.6-beta.11"
+  ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });
 
@@ -12308,9 +13775,9 @@ ${prompt}` : prompt;
         if (proc.stderr) proc.stderr.on("data", (chunk) => {
           stderr += chunk.toString();
         });
-        await new Promise((resolve17, reject) => {
+        await new Promise((resolve18, reject) => {
           proc.on("close", (code) => {
-            if (code === 0 || code === null) resolve17();
+            if (code === 0 || code === null) resolve18();
             else reject(new Error(`Process exited with code ${code}`));
           });
           proc.on("error", reject);
@@ -12337,9 +13804,9 @@ ${prompt}` : prompt;
         for (const mention of fileMentions) {
           const filePath = mention.slice(1);
           try {
-            const { existsSync: existsSync25 } = await import("fs");
+            const { existsSync: existsSync27 } = await import("fs");
             const { readFile: readFile23 } = await import("fs/promises");
-            if (existsSync25(filePath)) {
+            if (existsSync27(filePath)) {
               const content = await readFile23(filePath, "utf8");
               const MAX_LEN = 32768;
               const truncated = content.length > MAX_LEN ? content.slice(0, MAX_LEN) + "\n...[TRUNCATED]" : content;
@@ -12392,7 +13859,66 @@ ${finalCmd}`;
 init_esm_shims();
 init_src3();
 import { readFile as readFile22 } from "fs/promises";
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync25 } from "fs";
+
+// src/state/parseApprovalMode.ts
+init_esm_shims();
+var VALID_MODES = [
+  "default",
+  "plan",
+  "acceptEdits",
+  "bypassPermissions"
+];
+function parseApprovalMode(raw, now) {
+  if (!raw || typeof raw !== "object") {
+    return { kind: "invalid", error: "settings file is not a JSON object" };
+  }
+  const block = raw.approvalMode;
+  if (block === void 0) return { kind: "absent" };
+  if (typeof block === "string") {
+    if (!VALID_MODES.includes(block)) {
+      return { kind: "invalid", error: `unknown approvalMode "${block}"` };
+    }
+    return { kind: "ok", mode: block };
+  }
+  if (typeof block !== "object" || block === null) {
+    return {
+      kind: "invalid",
+      error: `approvalMode must be a string or object, got ${typeof block}`
+    };
+  }
+  const obj = block;
+  const mode = obj.mode;
+  if (typeof mode !== "string" || !VALID_MODES.includes(mode)) {
+    return { kind: "invalid", error: `approvalMode.mode invalid: ${JSON.stringify(mode)}` };
+  }
+  if (obj.ttlMs === void 0 && obj.timestamp === void 0) {
+    return { kind: "ok", mode };
+  }
+  if (typeof obj.ttlMs !== "number" || !Number.isFinite(obj.ttlMs) || obj.ttlMs <= 0) {
+    return {
+      kind: "invalid",
+      error: `approvalMode.ttlMs must be a positive number, got ${JSON.stringify(obj.ttlMs)}`
+    };
+  }
+  if (typeof obj.timestamp !== "number" || !Number.isFinite(obj.timestamp) || obj.timestamp <= 0) {
+    return {
+      kind: "invalid",
+      error: `approvalMode.timestamp must be a positive number, got ${JSON.stringify(obj.timestamp)}`
+    };
+  }
+  if (mode !== "bypassPermissions") {
+    return { kind: "ok", mode };
+  }
+  const age = now - obj.timestamp;
+  if (age > obj.ttlMs) {
+    return { kind: "expired", mode: "default", agedMs: age };
+  }
+  const remainingMs = obj.ttlMs - age;
+  return { kind: "ok", mode: "bypassPermissions", ttl: { remainingMs } };
+}
+
+// src/state/initSession.ts
 async function initSession(ctx) {
   try {
     const { settings } = await loadSettings(
@@ -12406,38 +13932,40 @@ async function initSession(ctx) {
       ctx.setShellEscapeEnabled(settings.shellEscapeEnabled !== false);
     }
     try {
-      const { homedir: homedir15 } = await import("os");
-      const { join: join27 } = await import("path");
-      const userSettingsPath = join27(homedir15(), ".msapling", "settings.json");
-      if (existsSync24(userSettingsPath)) {
+      const { homedir: homedir17 } = await import("os");
+      const { join: join31 } = await import("path");
+      const userSettingsPath = join31(homedir17(), ".msapling", "settings.json");
+      if (existsSync25(userSettingsPath)) {
         const userText = await readFile22(userSettingsPath, "utf8");
-        const userJson = JSON.parse(userText);
-        const validModes = ["default", "plan", "acceptEdits", "bypassPermissions"];
+        let parsed;
+        try {
+          parsed = JSON.parse(userText);
+        } catch (e) {
+          ctx.addMessage("system", `\u26A0 ~/.msapling/settings.json is not valid JSON: ${e.message}. Using default mode.`);
+          parsed = {};
+        }
+        const result = parseApprovalMode(parsed, Date.now());
         let modeToApply = "default";
-        const approvalMode = userJson.approvalMode;
-        if (typeof approvalMode === "object" && approvalMode !== null) {
-          const { mode, timestamp, ttlMs } = approvalMode;
-          if (mode && validModes.includes(mode)) {
-            if (mode === "bypassPermissions" && ttlMs && timestamp) {
-              const now = Date.now();
-              const age = now - timestamp;
-              if (age > ttlMs) {
-                ctx.addMessage("system", "\u26A0 bypassPermissions TTL expired. Reverting to default mode.");
-                modeToApply = "default";
+        switch (result.kind) {
+          case "absent":
+            break;
+          case "invalid":
+            ctx.addMessage("system", `\u26A0 Persisted approvalMode invalid (${result.error}). Reverting to default mode.`);
+            break;
+          case "expired":
+            ctx.addMessage("system", "\u26A0 bypassPermissions TTL expired. Reverting to default mode.");
+            break;
+          case "ok":
+            modeToApply = result.mode;
+            if (result.mode === "bypassPermissions") {
+              if (result.ttl) {
+                const mins = (result.ttl.remainingMs / 1e3 / 60).toFixed(1);
+                ctx.addMessage("system", `\u26A0 bypassPermissions active (expires in ~${mins} min). Use /mode default to re-enable controls.`);
               } else {
-                modeToApply = mode;
-                const remaining = ttlMs - age;
-                ctx.addMessage("system", `\u26A0 bypassPermissions active (expires in ~${(remaining / 1e3 / 60).toFixed(1)} min). Use /mode default to re-enable controls.`);
+                ctx.addMessage("system", "\u26A0 bypassPermissions active (no TTL). Use /mode default to re-enable controls.");
               }
-            } else {
-              modeToApply = mode;
             }
-          }
-        } else if (typeof approvalMode === "string" && validModes.includes(approvalMode)) {
-          modeToApply = approvalMode;
-          if (modeToApply === "bypassPermissions") {
-            ctx.addMessage("system", "\u26A0 bypassPermissions active (no TTL). Use /mode default to re-enable controls.");
-          }
+            break;
         }
         ctx.setMode(modeToApply);
       }
@@ -12500,8 +14028,8 @@ var App = ({ compact: compact2 = false }) => {
   const storage = useRef(new StorageManager()).current;
   const client = useRef(new MSaplingClient()).current;
   const requestApproval = useCallback((request) => {
-    return new Promise((resolve17) => {
-      setPendingApproval({ request, resolve: resolve17 });
+    return new Promise((resolve18) => {
+      setPendingApproval({ request, resolve: resolve18 });
     });
   }, []);
   const agent = useRef(new Agent(client, process.cwd(), requestApproval)).current;
@@ -12703,21 +14231,69 @@ var App = ({ compact: compact2 = false }) => {
 
 // src/runtime/bootstrap.ts
 init_esm_shims();
+import { readFileSync as readFileSync3 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname3, join as join30 } from "path";
+function readCliVersion2() {
+  const here = dirname3(fileURLToPath2(import.meta.url));
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const pkg = JSON.parse(readFileSync3(join30(here, rel), "utf8"));
+      if (pkg.name && pkg.version) {
+        return { name: pkg.name, version: pkg.version };
+      }
+    } catch {
+    }
+  }
+  return { name: "@mtreeai/msapling-cli", version: "unknown" };
+}
+var CLI_PKG = readCliVersion2();
 function handleCliArgs(args2) {
   if (args2.includes("--version") || args2.includes("-v")) {
-    console.log("@msapling/cli 2.3.3");
+    console.log(`${CLI_PKG.name} ${CLI_PKG.version}`);
     process.exit(0);
   }
   if (args2.includes("--help") || args2.includes("-h")) {
     console.log("msapling \u2014 MSapling CLI (React/Ink)");
     console.log("Usage: msapling                  start interactive REPL");
     console.log("       msapling --compact        start REPL in compact mode (no footer, thin separators)");
+    console.log('       msapling --exec "<cmd>"   run one slash command non-interactively and exit');
     console.log("       msapling mcp serve        run as MCP stdio server (Claude Code / Cursor / Windsurf integration)");
+    console.log("       msapling doctor           run diagnostic health checks");
+    console.log("       msapling doctor --debug   run doctor with full environment dump");
     console.log("       msapling --version        print version and exit");
     console.log("       msapling --help           print this message");
     console.log("Inside the REPL: type /help for slash-command help.");
     process.exit(0);
   }
+  const execIdx = args2.findIndex((a) => a === "--exec" || a.startsWith("--exec="));
+  if (execIdx >= 0) {
+    const eqArg = args2[execIdx];
+    const cmdStr = eqArg.startsWith("--exec=") ? eqArg.slice("--exec=".length) : args2[execIdx + 1] ?? "";
+    (async () => {
+      const { runExec: runExec2 } = await Promise.resolve().then(() => (init_exec(), exec_exports));
+      const exitCode = await runExec2(cmdStr);
+      process.exit(exitCode);
+    })().catch((e) => {
+      process.stderr.write(`[msapling-exec] fatal: ${e?.message ?? e}
+`);
+      process.exit(1);
+    });
+    return false;
+  }
+  if (args2[0] === "doctor") {
+    (async () => {
+      const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor2(), doctor_exports));
+      const debug = args2.includes("--debug");
+      const result = await runDoctor2(debug);
+      process.exit(result.exitCode);
+    })().catch((e) => {
+      process.stderr.write(`[msapling-doctor] fatal: ${e?.message ?? e}
+`);
+      process.exit(1);
+    });
+    return false;
+  }
   if (args2[0] === "mcp" && args2[1] === "serve") {
     (async () => {
       const { MSaplingClient: MSaplingClient2 } = await Promise.resolve().then(() => (init_src(), src_exports));