@mtreeai/msapling-cli 2.3.6-beta.3 → 2.3.6-beta.4

package/dist/index.js

@@ -657,6 +657,7 @@ import { resolve as resolve2, normalize as normalize2, relative as relative2, is
 import { writeFile, readFile as readFile2, mkdir } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
+import { randomBytes } from "crypto";
 var MAX_CONTENT_BYTES, WriteFileTool;
 var init_WriteFileTool = __esm({
   "../core/src/tools/WriteFileTool.ts"() {
@@ -732,7 +733,9 @@ var init_WriteFileTool = __esm({
           if (existsSync2(resolvedTarget)) {
             const existingContent = await readFile2(resolvedTarget, "utf8");
             const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
-            const backupPath = join2(homedir(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
+            const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const suffix = randomBytes(4).toString("hex");
+            const backupPath = join2(homedir(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
             await mkdir(join2(homedir(), ".msapling", "backups"), { recursive: true });
             await writeFile(backupPath, existingContent, "utf8");
             backedUpTo = backupPath;
@@ -1028,7 +1031,7 @@ var init_RunCommandTool = __esm({
           this.activeCommands++;
           return;
         }
-        return new Promise((resolve17) => this.queue.push(resolve17));
+        return new Promise((resolve18) => this.queue.push(resolve18));
       }
       static releaseLock() {
         if (this.queue.length > 0) {
@@ -1107,9 +1110,9 @@ var init_RunCommandTool = __esm({
           const chunks = { stdout: [], stderr: [] };
           proc.stdout?.on("data", (chunk) => chunks.stdout.push(chunk));
           proc.stderr?.on("data", (chunk) => chunks.stderr.push(chunk));
-          const exitCode = await new Promise((resolve17) => {
-            proc.on("exit", (code) => resolve17(code ?? 1));
-            proc.on("error", () => resolve17(1));
+          const exitCode = await new Promise((resolve18) => {
+            proc.on("exit", (code) => resolve18(code ?? 1));
+            proc.on("error", () => resolve18(1));
           });
           const stdout = Buffer.concat(chunks.stdout).toString("utf-8");
           const stderr = Buffer.concat(chunks.stderr).toString("utf-8");
@@ -1220,9 +1223,9 @@ var init_src2 = __esm({
           const messages = this.parser.parse(value);
           for (const msg of messages) {
             if (msg.id !== void 0 && this.pendingRequests.has(Number(msg.id))) {
-              const resolve17 = this.pendingRequests.get(Number(msg.id));
-              if (resolve17) {
-                resolve17(msg.result || msg.error);
+              const resolve18 = this.pendingRequests.get(Number(msg.id));
+              if (resolve18) {
+                resolve18(msg.result || msg.error);
                 this.pendingRequests.delete(Number(msg.id));
               }
             }
@@ -1237,8 +1240,8 @@ var init_src2 = __esm({
         const message = `Content-Length: ${Buffer.byteLength(content, "utf8")}\r
 \r
 ${content}`;
-        return new Promise((resolve17) => {
-          this.pendingRequests.set(id, resolve17);
+        return new Promise((resolve18) => {
+          this.pendingRequests.set(id, resolve18);
           this.process.stdin.write(message);
           this.process.stdin.flush();
         });
@@ -1370,9 +1373,9 @@ var init_SubShellTool = __esm({
               }
               throw e;
             }
-            await new Promise((resolve17) => {
-              proc.on("exit", () => resolve17());
-              proc.on("error", () => resolve17());
+            await new Promise((resolve18) => {
+              proc.on("exit", () => resolve18());
+              proc.on("error", () => resolve18());
             });
             return { content: `Successfully launched separate window for ${args2.worker_id}` };
           }
@@ -1455,13 +1458,13 @@ async function findRg() {
   const candidates = ["rg", "C:\\Program Files\\ripgrep\\rg.exe"];
   for (const bin of candidates) {
     try {
-      const exited = await new Promise((resolve17) => {
+      const exited = await new Promise((resolve18) => {
         try {
           const p = spawn4(bin, ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
-          p.on("error", () => resolve17(null));
-          p.on("exit", (code) => resolve17(code));
+          p.on("error", () => resolve18(null));
+          p.on("exit", (code) => resolve18(code));
         } catch {
-          resolve17(null);
+          resolve18(null);
         }
       });
       if (exited === 0) return bin;
@@ -1471,7 +1474,7 @@ async function findRg() {
   return null;
 }
 function runRg(bin, args2) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const p = spawn4(bin, args2, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1482,10 +1485,10 @@ function runRg(bin, args2) {
       stderr += d.toString("utf8");
     });
     p.on("error", (e) => {
-      resolve17({ stdout, stderr: stderr + (e?.message ?? ""), exitCode: -1 });
+      resolve18({ stdout, stderr: stderr + (e?.message ?? ""), exitCode: -1 });
     });
     p.on("exit", (code) => {
-      resolve17({ stdout, stderr, exitCode: code });
+      resolve18({ stdout, stderr, exitCode: code });
     });
   });
 }
@@ -2037,6 +2040,7 @@ import { resolve as resolve6, normalize as normalize5, relative as relative6, is
 import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir2 } from "os";
+import { randomBytes as randomBytes2 } from "crypto";
 var PatchFileTool;
 var init_PatchFileTool = __esm({
   "../core/src/tools/PatchFileTool.ts"() {
@@ -2143,7 +2147,9 @@ File preview (first 200 chars): ${JSON.stringify(preview)}`,
         let backedUpTo = null;
         try {
           const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
-          const backupPath = join6(homedir2(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes2(4).toString("hex");
+          const backupPath = join6(homedir2(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
           await mkdir2(join6(homedir2(), ".msapling", "backups"), { recursive: true });
           await writeFile2(backupPath, originalContent, "utf8");
           backedUpTo = backupPath;
@@ -2734,12 +2740,12 @@ Command: ${command}`,
         proc.stdout?.on("data", (chunk) => chunks.stdout.push(chunk));
         proc.stderr?.on("data", (chunk) => chunks.stderr.push(chunk));
         const timeoutPromise = new Promise(
-          (resolve17) => setTimeout(() => resolve17("timeout"), timeoutMs)
+          (resolve18) => setTimeout(() => resolve18("timeout"), timeoutMs)
         );
         const processPromise = (async () => {
-          const exitCode2 = await new Promise((resolve17) => {
-            proc.on("exit", (code) => resolve17(code ?? 1));
-            proc.on("error", () => resolve17(1));
+          const exitCode2 = await new Promise((resolve18) => {
+            proc.on("exit", (code) => resolve18(code ?? 1));
+            proc.on("error", () => resolve18(1));
           });
           const stdout2 = Buffer.concat(chunks.stdout).toString("utf-8");
           const stderr2 = Buffer.concat(chunks.stderr).toString("utf-8");
@@ -3003,6 +3009,7 @@ import { resolve as resolve9, normalize as normalize8, relative as relative9, is
 import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
 import { homedir as homedir3 } from "os";
+import { randomBytes as randomBytes3 } from "crypto";
 function normaliseSource(source) {
   if (source === "") return [];
   const lines = source.split("\n");
@@ -3179,11 +3186,13 @@ var init_NotebookEditTool = __esm({
         let backedUpTo = null;
         try {
           const filename = absPath.split(/[\\/]/).pop() ?? "notebook.ipynb";
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes3(4).toString("hex");
           const backupPath = join8(
             homedir3(),
             ".msapling",
             "backups",
-            `${filename}.${Date.now()}.bak`
+            `${filename}.backup-${stamp}-${suffix}.bak`
           );
           await mkdir3(join8(homedir3(), ".msapling", "backups"), { recursive: true });
           await writeFile3(backupPath, rawJson, "utf8");
@@ -3246,7 +3255,7 @@ var init_NotebookEditTool = __esm({
 File: ${absPath}`;
         if (backedUpTo) {
           summary += `
-Pre-edit content backed up to: ${backedUpTo}`;
+Backup: ${backedUpTo}`;
         }
         return { content: summary };
       }
@@ -3259,6 +3268,7 @@ import { resolve as resolve10, normalize as normalize9, relative as relative10,
 import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
 import { existsSync as existsSync8 } from "fs";
 import { homedir as homedir4 } from "os";
+import { randomBytes as randomBytes4 } from "crypto";
 var MAX_EDITS, MultiEditFileTool;
 var init_MultiEditFileTool = __esm({
   "../core/src/tools/MultiEditFileTool.ts"() {
@@ -3419,11 +3429,13 @@ No changes were written (atomic: all-or-nothing).`,
         let backedUpTo = null;
         try {
           const filename = resolvedTarget.split(/[\\/]/).pop() ?? "file";
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const suffix = randomBytes4(4).toString("hex");
           const backupPath = join9(
             homedir4(),
             ".msapling",
             "backups",
-            `${filename}.${Date.now()}.bak`
+            `${filename}.backup-${stamp}-${suffix}.bak`
           );
           await mkdir4(join9(homedir4(), ".msapling", "backups"), { recursive: true });
           await writeFile4(backupPath, originalContent, "utf8");
@@ -3456,6 +3468,7 @@ Pre-edit content backed up to: ${backedUpTo}`;
 import { resolve as resolve11, normalize as normalize10, relative as relative11, isAbsolute as isAbsolute11, dirname } from "path";
 import { rename, mkdir as mkdir5, copyFile, rm, stat as stat2, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync9, statSync as statSync3 } from "fs";
+import { randomBytes as randomBytes5 } from "crypto";
 function containedPath(p, root) {
   const abs = isAbsolute11(p) ? normalize10(p) : resolve11(root, p.trim());
   const rel = relative11(root, abs);
@@ -3480,16 +3493,18 @@ async function copyDir(src, dst) {
 async function backupFile(absPath) {
   try {
     const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
-    const { homedir: homedir15 } = await import("os");
-    const { join: join27 } = await import("path");
+    const { homedir: homedir16 } = await import("os");
+    const { join: join29 } = await import("path");
     const filename = absPath.split(/[\\/]/).pop() ?? "file";
-    const backupPath = join27(
-      homedir15(),
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const suffix = randomBytes5(4).toString("hex");
+    const backupPath = join29(
+      homedir16(),
       ".msapling",
       "backups",
-      `${filename}.${Date.now()}.bak`
+      `${filename}.backup-${stamp}-${suffix}.bak`
     );
-    await mkdir9(join27(homedir15(), ".msapling", "backups"), { recursive: true });
+    await mkdir9(join29(homedir16(), ".msapling", "backups"), { recursive: true });
     const content = await readFile23(absPath, "utf8");
     await writeFile12(backupPath, content, "utf8");
     return backupPath;
@@ -3641,8 +3656,9 @@ Overwritten destination backed up to: ${backedUpTo}`;
 });
 
 // ../core/src/tools/DeleteFileTool.ts
-import { resolve as resolve12, normalize as normalize11, relative as relative12, isAbsolute as isAbsolute12, join as join10 } from "path";
+import { resolve as resolve12, normalize as normalize11, relative as relative12, isAbsolute as isAbsolute12, join as join11 } from "path";
 import { rm as rm2, stat as stat3 } from "fs/promises";
+import { randomBytes as randomBytes6 } from "crypto";
 var DeleteFileTool;
 var init_DeleteFileTool = __esm({
   "../core/src/tools/DeleteFileTool.ts"() {
@@ -3716,11 +3732,13 @@ var init_DeleteFileTool = __esm({
         if (isFile) {
           try {
             const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
-            const { homedir: homedir15 } = await import("os");
+            const { homedir: homedir16 } = await import("os");
             const existingContent = await readFile23(abs, "utf8");
             const filename = abs.split(/[\\/]/).pop() ?? "file";
-            const backupPath = join10(homedir15(), ".msapling", "backups", `${filename}.${Date.now()}.bak`);
-            await mkdir9(join10(homedir15(), ".msapling", "backups"), { recursive: true });
+            const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const suffix = randomBytes6(4).toString("hex");
+            const backupPath = join11(homedir16(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
+            await mkdir9(join11(homedir16(), ".msapling", "backups"), { recursive: true });
             await writeFile12(backupPath, existingContent, "utf8");
             backedUpTo = backupPath;
           } catch {
@@ -3744,7 +3762,7 @@ var init_DeleteFileTool = __esm({
         let summary = `Deleted ${kind}: ${abs}`;
         if (backedUpTo) {
           summary += `
-Content backed up to: ${backedUpTo}`;
+Backup: ${backedUpTo}`;
         }
         return { content: summary };
       }
@@ -3991,10 +4009,10 @@ var init_Voice = __esm({
     `;
         try {
           if (process.platform === "win32") {
-            await new Promise((resolve17, reject) => {
+            await new Promise((resolve18, reject) => {
               try {
                 const proc = spawn6("powershell", ["-Command", psCommand]);
-                proc.on("exit", () => resolve17());
+                proc.on("exit", () => resolve18());
                 proc.on("error", reject);
               } catch (e) {
                 reject(e);
@@ -4108,7 +4126,7 @@ function matches(entry, ctx) {
 async function runOne(entry, ctx) {
   const timeoutMs = entry.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   const command = entry.command;
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const isWindows = process.platform === "win32";
     const child = spawn7(isWindows ? "cmd.exe" : "sh", isWindows ? ["/c", command] : ["-c", command], {
       cwd: ctx.cwd ?? process.cwd(),
@@ -4123,7 +4141,7 @@ async function runOne(entry, ctx) {
       settled = true;
       clearTimeout(killer);
       const blocked = !!entry.blocking && (exitCode === null || exitCode !== 0);
-      resolve17({ command, exitCode, stdout, stderr, timedOut, blocked });
+      resolve18({ command, exitCode, stdout, stderr, timedOut, blocked });
     };
     const killer = setTimeout(() => {
       timedOut = true;
@@ -4519,7 +4537,7 @@ var init_Safety = __esm({
 
 // ../core/src/ProjectConfig.ts
 import { homedir as homedir5 } from "os";
-import { join as join11, dirname as dirname2, parse as parsePath } from "path";
+import { join as join12, dirname as dirname2, parse as parsePath } from "path";
 import { existsSync as existsSync10 } from "fs";
 import { readFile as readFile9 } from "fs/promises";
 async function readIfExists(path2) {
@@ -4533,7 +4551,7 @@ async function readIfExists(path2) {
 }
 async function findInDir(dir) {
   for (const filename of FILENAMES) {
-    const path2 = join11(dir, filename);
+    const path2 = join12(dir, filename);
     const content = await readIfExists(path2);
     if (content !== null) {
       return { path: path2, filename, content };
@@ -4558,7 +4576,7 @@ async function findProjectConfig(start) {
 async function findUserConfig() {
   const home = homedir5();
   if (!home) return null;
-  const userDir = join11(home, ".msapling");
+  const userDir = join12(home, ".msapling");
   return findInDir(userDir);
 }
 function buildCombined(user, project) {
@@ -4968,8 +4986,8 @@ var init_Mutex = __esm({
        */
       acquire() {
         let release2;
-        const next = new Promise((resolve17) => {
-          release2 = resolve17;
+        const next = new Promise((resolve18) => {
+          release2 = resolve18;
         });
         const entry = this._queue.then(() => release2);
         this._queue = this._queue.then(() => next);
@@ -4992,7 +5010,7 @@ var init_Mutex = __esm({
 });
 
 // ../core/src/TrustStore.ts
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { homedir as homedir6 } from "os";
 import { existsSync as existsSync11, mkdirSync } from "fs";
 import { readFile as readFile10, writeFile as writeFile5 } from "fs/promises";
@@ -5002,7 +5020,7 @@ var init_TrustStore = __esm({
     "use strict";
     init_esm_shims();
     init_Mutex();
-    USER_SETTINGS_PATH = join12(homedir6(), ".msapling", "settings.json");
+    USER_SETTINGS_PATH = join13(homedir6(), ".msapling", "settings.json");
     TrustStore = class {
       /** Current in-memory set of trusted `tool:command` keys. */
       trusted = /* @__PURE__ */ new Set();
@@ -5032,7 +5050,7 @@ var init_TrustStore = __esm({
        * updating `trustedCommands`.
        */
       async writeSettings(settings) {
-        const dir = join12(homedir6(), ".msapling");
+        const dir = join13(homedir6(), ".msapling");
         if (!existsSync11(dir)) mkdirSync(dir, { recursive: true });
         await writeFile5(this.settingsPath, JSON.stringify(settings, null, 2), "utf8");
       }
@@ -5112,7 +5130,7 @@ var require_polyfills = __commonJS({
     var constants = __require("constants");
     var origCwd = process.cwd;
     var cwd = null;
-    var platform2 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+    var platform3 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
     process.cwd = function() {
       if (!cwd)
         cwd = origCwd.call(process);
@@ -5132,54 +5150,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs2) {
+    function patch(fs3) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs2);
-      }
-      if (!fs2.lutimes) {
-        patchLutimes(fs2);
-      }
-      fs2.chown = chownFix(fs2.chown);
-      fs2.fchown = chownFix(fs2.fchown);
-      fs2.lchown = chownFix(fs2.lchown);
-      fs2.chmod = chmodFix(fs2.chmod);
-      fs2.fchmod = chmodFix(fs2.fchmod);
-      fs2.lchmod = chmodFix(fs2.lchmod);
-      fs2.chownSync = chownFixSync(fs2.chownSync);
-      fs2.fchownSync = chownFixSync(fs2.fchownSync);
-      fs2.lchownSync = chownFixSync(fs2.lchownSync);
-      fs2.chmodSync = chmodFixSync(fs2.chmodSync);
-      fs2.fchmodSync = chmodFixSync(fs2.fchmodSync);
-      fs2.lchmodSync = chmodFixSync(fs2.lchmodSync);
-      fs2.stat = statFix(fs2.stat);
-      fs2.fstat = statFix(fs2.fstat);
-      fs2.lstat = statFix(fs2.lstat);
-      fs2.statSync = statFixSync(fs2.statSync);
-      fs2.fstatSync = statFixSync(fs2.fstatSync);
-      fs2.lstatSync = statFixSync(fs2.lstatSync);
-      if (fs2.chmod && !fs2.lchmod) {
-        fs2.lchmod = function(path2, mode, cb) {
+        patchLchmod(fs3);
+      }
+      if (!fs3.lutimes) {
+        patchLutimes(fs3);
+      }
+      fs3.chown = chownFix(fs3.chown);
+      fs3.fchown = chownFix(fs3.fchown);
+      fs3.lchown = chownFix(fs3.lchown);
+      fs3.chmod = chmodFix(fs3.chmod);
+      fs3.fchmod = chmodFix(fs3.fchmod);
+      fs3.lchmod = chmodFix(fs3.lchmod);
+      fs3.chownSync = chownFixSync(fs3.chownSync);
+      fs3.fchownSync = chownFixSync(fs3.fchownSync);
+      fs3.lchownSync = chownFixSync(fs3.lchownSync);
+      fs3.chmodSync = chmodFixSync(fs3.chmodSync);
+      fs3.fchmodSync = chmodFixSync(fs3.fchmodSync);
+      fs3.lchmodSync = chmodFixSync(fs3.lchmodSync);
+      fs3.stat = statFix(fs3.stat);
+      fs3.fstat = statFix(fs3.fstat);
+      fs3.lstat = statFix(fs3.lstat);
+      fs3.statSync = statFixSync(fs3.statSync);
+      fs3.fstatSync = statFixSync(fs3.fstatSync);
+      fs3.lstatSync = statFixSync(fs3.lstatSync);
+      if (fs3.chmod && !fs3.lchmod) {
+        fs3.lchmod = function(path2, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs2.lchmodSync = function() {
+        fs3.lchmodSync = function() {
         };
       }
-      if (fs2.chown && !fs2.lchown) {
-        fs2.lchown = function(path2, uid, gid, cb) {
+      if (fs3.chown && !fs3.lchown) {
+        fs3.lchown = function(path2, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs2.lchownSync = function() {
+        fs3.lchownSync = function() {
         };
       }
-      if (platform2 === "win32") {
-        fs2.rename = typeof fs2.rename !== "function" ? fs2.rename : (function(fs$rename) {
+      if (platform3 === "win32") {
+        fs3.rename = typeof fs3.rename !== "function" ? fs3.rename : (function(fs$rename) {
           function rename2(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs2.stat(to, function(stater, st) {
+                  fs3.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -5195,9 +5213,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
           return rename2;
-        })(fs2.rename);
+        })(fs3.rename);
       }
-      fs2.read = typeof fs2.read !== "function" ? fs2.read : (function(fs$read) {
+      fs3.read = typeof fs3.read !== "function" ? fs3.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -5205,22 +5223,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs2, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs2, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs2.read);
-      fs2.readSync = typeof fs2.readSync !== "function" ? fs2.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs3.read);
+      fs3.readSync = typeof fs3.readSync !== "function" ? fs3.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs2, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs3, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -5230,10 +5248,10 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs2.readSync);
-      function patchLchmod(fs3) {
-        fs3.lchmod = function(path2, mode, callback) {
-          fs3.open(
+      })(fs3.readSync);
+      function patchLchmod(fs4) {
+        fs4.lchmod = function(path2, mode, callback) {
+          fs4.open(
             path2,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
@@ -5242,80 +5260,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs3.fchmod(fd, mode, function(err2) {
-                fs3.close(fd, function(err22) {
+              fs4.fchmod(fd, mode, function(err2) {
+                fs4.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs3.lchmodSync = function(path2, mode) {
-          var fd = fs3.openSync(path2, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs4.lchmodSync = function(path2, mode) {
+          var fd = fs4.openSync(path2, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs3.fchmodSync(fd, mode);
+            ret = fs4.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs3.closeSync(fd);
+                fs4.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs3.closeSync(fd);
+              fs4.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs3) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs3.futimes) {
-          fs3.lutimes = function(path2, at, mt, cb) {
-            fs3.open(path2, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs4) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs4.futimes) {
+          fs4.lutimes = function(path2, at, mt, cb) {
+            fs4.open(path2, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs3.futimes(fd, at, mt, function(er2) {
-                fs3.close(fd, function(er22) {
+              fs4.futimes(fd, at, mt, function(er2) {
+                fs4.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs3.lutimesSync = function(path2, at, mt) {
-            var fd = fs3.openSync(path2, constants.O_SYMLINK);
+          fs4.lutimesSync = function(path2, at, mt) {
+            var fd = fs4.openSync(path2, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs3.futimesSync(fd, at, mt);
+              ret = fs4.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs3.closeSync(fd);
+                  fs4.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs3.closeSync(fd);
+                fs4.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs3.futimes) {
-          fs3.lutimes = function(_a, _b, _c, cb) {
+        } else if (fs4.futimes) {
+          fs4.lutimes = function(_a, _b, _c, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs3.lutimesSync = function() {
+          fs4.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs2, target, mode, function(er) {
+          return orig.call(fs3, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -5325,7 +5343,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs2, target, mode);
+            return orig.call(fs3, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -5334,7 +5352,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs2, target, uid, gid, function(er) {
+          return orig.call(fs3, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -5344,7 +5362,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs2, target, uid, gid);
+            return orig.call(fs3, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -5364,13 +5382,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs2, target, options, callback) : orig.call(fs2, target, callback);
+          return options ? orig.call(fs3, target, options, callback) : orig.call(fs3, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs2, target, options) : orig.call(fs2, target);
+          var stats = options ? orig.call(fs3, target, options) : orig.call(fs3, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -5401,7 +5419,7 @@ var require_legacy_streams = __commonJS({
     init_esm_shims();
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs2) {
+    function legacy(fs3) {
       return {
         ReadStream,
         WriteStream
@@ -5444,7 +5462,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs2.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs3.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self.emit("error", err);
             self.readable = false;
@@ -5483,7 +5501,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs2.open;
+          this._open = fs3.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -5521,7 +5539,7 @@ var require_graceful_fs = __commonJS({
   "../../node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs2 = __require("fs");
+    var fs3 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -5553,12 +5571,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs2[gracefulQueue]) {
+    if (!fs3[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs2, queue);
-      fs2.close = (function(fs$close) {
+      publishQueue(fs3, queue);
+      fs3.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs2, fd, function(err) {
+          return fs$close.call(fs3, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -5570,40 +5588,40 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs2.close);
-      fs2.closeSync = (function(fs$closeSync) {
+      })(fs3.close);
+      fs3.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs2, arguments);
+          fs$closeSync.apply(fs3, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs2.closeSync);
+      })(fs3.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug(fs2[gracefulQueue]);
-          __require("assert").equal(fs2[gracefulQueue].length, 0);
+          debug(fs3[gracefulQueue]);
+          __require("assert").equal(fs3[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs2[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs2));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs2.__patched) {
-      module.exports = patch(fs2);
-      fs2.__patched = true;
-    }
-    function patch(fs3) {
-      polyfills(fs3);
-      fs3.gracefulify = patch;
-      fs3.createReadStream = createReadStream;
-      fs3.createWriteStream = createWriteStream;
-      var fs$readFile = fs3.readFile;
-      fs3.readFile = readFile23;
+      publishQueue(global, fs3[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs3));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs3.__patched) {
+      module.exports = patch(fs3);
+      fs3.__patched = true;
+    }
+    function patch(fs4) {
+      polyfills(fs4);
+      fs4.gracefulify = patch;
+      fs4.createReadStream = createReadStream;
+      fs4.createWriteStream = createWriteStream;
+      var fs$readFile = fs4.readFile;
+      fs4.readFile = readFile23;
       function readFile23(path2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -5619,8 +5637,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs3.writeFile;
-      fs3.writeFile = writeFile12;
+      var fs$writeFile = fs4.writeFile;
+      fs4.writeFile = writeFile12;
       function writeFile12(path2, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -5636,9 +5654,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs3.appendFile;
+      var fs$appendFile = fs4.appendFile;
       if (fs$appendFile)
-        fs3.appendFile = appendFile;
+        fs4.appendFile = appendFile;
       function appendFile(path2, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -5654,9 +5672,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs3.copyFile;
+      var fs$copyFile = fs4.copyFile;
       if (fs$copyFile)
-        fs3.copyFile = copyFile2;
+        fs4.copyFile = copyFile2;
       function copyFile2(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -5674,10 +5692,10 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs3.readdir;
-      fs3.readdir = readdir4;
+      var fs$readdir = fs4.readdir;
+      fs4.readdir = readdir5;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir4(path2, options, cb) {
+      function readdir5(path2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path3, options2, cb2, startTime) {
@@ -5716,21 +5734,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs3);
+        var legStreams = legacy(fs4);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs3.ReadStream;
+      var fs$ReadStream = fs4.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs3.WriteStream;
+      var fs$WriteStream = fs4.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs3, "ReadStream", {
+      Object.defineProperty(fs4, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -5740,7 +5758,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs3, "WriteStream", {
+      Object.defineProperty(fs4, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -5751,7 +5769,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs3, "FileReadStream", {
+      Object.defineProperty(fs4, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -5762,7 +5780,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs3, "FileWriteStream", {
+      Object.defineProperty(fs4, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -5811,13 +5829,13 @@ var require_graceful_fs = __commonJS({
         });
       }
       function createReadStream(path2, options) {
-        return new fs3.ReadStream(path2, options);
+        return new fs4.ReadStream(path2, options);
       }
       function createWriteStream(path2, options) {
-        return new fs3.WriteStream(path2, options);
+        return new fs4.WriteStream(path2, options);
       }
-      var fs$open = fs3.open;
-      fs3.open = open;
+      var fs$open = fs4.open;
+      fs4.open = open;
       function open(path2, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
@@ -5833,20 +5851,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs3;
+      return fs4;
     }
     function enqueue(elem) {
       debug("ENQUEUE", elem[0].name, elem[1]);
-      fs2[gracefulQueue].push(elem);
+      fs3[gracefulQueue].push(elem);
       retry();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs2[gracefulQueue].length; ++i) {
-        if (fs2[gracefulQueue][i].length > 2) {
-          fs2[gracefulQueue][i][3] = now;
-          fs2[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs3[gracefulQueue].length; ++i) {
+        if (fs3[gracefulQueue][i].length > 2) {
+          fs3[gracefulQueue][i][3] = now;
+          fs3[gracefulQueue][i][4] = now;
         }
       }
       retry();
@@ -5854,9 +5872,9 @@ var require_graceful_fs = __commonJS({
     function retry() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs2[gracefulQueue].length === 0)
+      if (fs3[gracefulQueue].length === 0)
         return;
-      var elem = fs2[gracefulQueue].shift();
+      var elem = fs3[gracefulQueue].shift();
       var fn = elem[0];
       var args2 = elem[1];
       var err = elem[2];
@@ -5878,7 +5896,7 @@ var require_graceful_fs = __commonJS({
           debug("RETRY", fn.name, args2);
           fn.apply(null, args2.concat([startTime]));
         } else {
-          fs2[gracefulQueue].push(elem);
+          fs3[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -6324,10 +6342,10 @@ var require_mtime_precision = __commonJS({
     "use strict";
     init_esm_shims();
     var cacheSymbol = /* @__PURE__ */ Symbol();
-    function probe(file, fs2, callback) {
-      const cachedPrecision = fs2[cacheSymbol];
+    function probe(file, fs3, callback) {
+      const cachedPrecision = fs3[cacheSymbol];
       if (cachedPrecision) {
-        return fs2.stat(file, (err, stat5) => {
+        return fs3.stat(file, (err, stat5) => {
           if (err) {
             return callback(err);
           }
@@ -6335,16 +6353,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs2.utimes(file, mtime, mtime, (err) => {
+      fs3.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs2.stat(file, (err2, stat5) => {
+        fs3.stat(file, (err2, stat5) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat5.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs2, cacheSymbol, { value: precision });
+          Object.defineProperty(fs3, cacheSymbol, { value: precision });
           callback(null, stat5.mtime, precision);
         });
       });
@@ -6367,7 +6385,7 @@ var require_lockfile = __commonJS({
     "use strict";
     init_esm_shims();
     var path2 = __require("path");
-    var fs2 = require_graceful_fs();
+    var fs3 = require_graceful_fs();
     var retry = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -6498,7 +6516,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs2,
+        fs: fs3,
         onCompromised: (err) => {
           throw err;
         },
@@ -6542,7 +6560,7 @@ var require_lockfile = __commonJS({
     }
     function unlock2(file, options, callback) {
       options = {
-        fs: fs2,
+        fs: fs3,
         realpath: true,
         ...options
       };
@@ -6564,7 +6582,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs2,
+        fs: fs3,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -6604,16 +6622,16 @@ var require_adapter = __commonJS({
   "../../node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs2 = require_graceful_fs();
-    function createSyncFs(fs3) {
+    var fs3 = require_graceful_fs();
+    function createSyncFs(fs4) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs3 };
+      const newFs = { ...fs4 };
       methods.forEach((method) => {
         newFs[method] = (...args2) => {
           const callback = args2.pop();
           let ret;
           try {
-            ret = fs3[`${method}Sync`](...args2);
+            ret = fs4[`${method}Sync`](...args2);
           } catch (err) {
             return callback(err);
           }
@@ -6623,12 +6641,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args2) => new Promise((resolve17, reject) => {
+      return (...args2) => new Promise((resolve18, reject) => {
         args2.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve17(result);
+            resolve18(result);
           }
         });
         method(...args2);
@@ -6651,7 +6669,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs2);
+      options.fs = createSyncFs(options.fs || fs3);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -6763,142 +6781,12 @@ var require_keytar2 = __commonJS({
   }
 });
 
-// ../core/src/Settings.ts
-import { homedir as homedir7 } from "os";
-import { join as join13 } from "path";
-import { existsSync as existsSync12 } from "fs";
-import * as fs from "fs";
-import { readFile as readFile11 } from "fs/promises";
-function ensureConfigDir(p) {
-  try {
-    fs.mkdirSync(p, { recursive: true, mode: 448 });
-  } catch (e) {
-    if (e.code === "EEXIST" || e.code === "ENOTDIR") {
-      const stat5 = fs.statSync(p);
-      if (!stat5.isDirectory()) {
-        fs.renameSync(p, `${p}.broken-${Date.now()}`);
-        fs.mkdirSync(p, { recursive: true, mode: 448 });
-      }
-    } else {
-      throw e;
-    }
-  }
-}
-async function readJson(path2) {
-  try {
-    if (!existsSync12(path2)) return null;
-    const text = await readFile11(path2, "utf8");
-    if (!text.trim()) return null;
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
-}
-function fromEnv(env) {
-  const out = {};
-  for (const [envKey, settingKey] of Object.entries(ENV_MAP)) {
-    const raw = env[envKey];
-    if (raw === void 0) continue;
-    if (settingKey === "maxTokens") {
-      const n = Number.parseInt(raw, 10);
-      if (Number.isFinite(n)) out.maxTokens = n;
-    } else if (settingKey === "temperature") {
-      const n = Number.parseFloat(raw);
-      if (Number.isFinite(n)) out.temperature = n;
-    } else if (settingKey === "ollamaEnabled" || settingKey === "telemetryEnabled") {
-      out[settingKey] = raw === "true" || raw === "1";
-    } else if (settingKey === "defaultMode") {
-      const v = raw;
-      if (["default", "plan", "acceptEdits", "bypassPermissions"].includes(v)) {
-        out.defaultMode = v;
-      }
-    } else {
-      out[settingKey] = raw;
-    }
-  }
-  return out;
-}
-function mergeSettings(base, override) {
-  const out = { ...base, ...override };
-  if (override.mcpServers) {
-    out.mcpServers = { ...base.mcpServers, ...override.mcpServers };
-  }
-  if (override.hooks) {
-    out.hooks = { ...base.hooks, ...override.hooks };
-  }
-  if (override.trustedCommands) {
-    const seen = /* @__PURE__ */ new Set();
-    const merged = [];
-    for (const c of [...base.trustedCommands, ...override.trustedCommands]) {
-      if (!seen.has(c)) {
-        seen.add(c);
-        merged.push(c);
-      }
-    }
-    out.trustedCommands = merged;
-  }
-  return out;
-}
-async function loadSettings(cwd = process.cwd(), env = process.env, warn) {
-  const sources = [];
-  const userPath = join13(homedir7() || ".", ".msapling", "settings.json");
-  const projectPath = join13(cwd, ".msapling", "settings.json");
-  const [user, project] = await Promise.all([readJson(userPath), readJson(projectPath)]);
-  if (user) sources.push(userPath);
-  if (project) sources.push(projectPath);
-  let settings = DEFAULT_SETTINGS;
-  if (user) settings = mergeSettings(settings, user);
-  if (project) settings = mergeSettings(settings, project);
-  settings = mergeSettings(settings, fromEnv(env));
-  if (settings.temperature < 0 || settings.temperature > 2) {
-    warn?.(`Settings: temperature out of range (${settings.temperature}); clamping to 0.7`);
-    settings = { ...settings, temperature: 0.7 };
-  }
-  if (settings.maxTokens <= 0) {
-    warn?.(`Settings: maxTokens must be positive; resetting to ${DEFAULT_SETTINGS.maxTokens}`);
-    settings = { ...settings, maxTokens: DEFAULT_SETTINGS.maxTokens };
-  }
-  return { settings, sources };
-}
-var DEFAULT_SETTINGS, ENV_MAP;
-var init_Settings = __esm({
-  "../core/src/Settings.ts"() {
-    "use strict";
-    init_esm_shims();
-    DEFAULT_SETTINGS = {
-      apiUrl: "https://api.msapling.com",
-      defaultModel: "google/gemini-2.0-flash-001",
-      defaultMode: "default",
-      theme: "diamond",
-      maxTokens: 4096,
-      temperature: 0.7,
-      ollamaEnabled: true,
-      ollamaBaseUrl: "http://127.0.0.1:11434",
-      telemetryEnabled: true,
-      mcpServers: {},
-      hooks: {},
-      trustedCommands: [],
-      shellEscapeEnabled: true
-    };
-    ENV_MAP = {
-      MSAPLING_API_URL: "apiUrl",
-      MSAPLING_DEFAULT_MODEL: "defaultModel",
-      MSAPLING_DEFAULT_MODE: "defaultMode",
-      MSAPLING_THEME: "theme",
-      MSAPLING_MAX_TOKENS: "maxTokens",
-      MSAPLING_TEMPERATURE: "temperature",
-      MSAPLING_OLLAMA_ENABLED: "ollamaEnabled",
-      MSAPLING_OLLAMA_BASE_URL: "ollamaBaseUrl",
-      MSAPLING_TELEMETRY_ENABLED: "telemetryEnabled"
-    };
-  }
-});
-
 // ../core/src/Storage.ts
 import { join as join14 } from "path";
-import { homedir as homedir8 } from "os";
-import { chmodSync, existsSync as existsSync13, renameSync as renameSync2, unlinkSync } from "fs";
-import { writeFile as writeFile6, readFile as readFile12 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { chmodSync, existsSync as existsSync12, renameSync, unlinkSync } from "fs";
+import { mkdir as mkdir6, writeFile as writeFile6, readFile as readFile11 } from "fs/promises";
+import { randomBytes as randomBytes7 } from "crypto";
 var lockfile, keytar, StorageManager;
 var init_Storage = __esm({
   "../core/src/Storage.ts"() {
@@ -6907,7 +6795,6 @@ var init_Storage = __esm({
     init_Mutex();
     lockfile = __toESM(require_proper_lockfile(), 1);
     keytar = __toESM(require_keytar2(), 1);
-    init_Settings();
     StorageManager = class {
       baseDir;
       /**
@@ -6926,16 +6813,16 @@ var init_Storage = __esm({
        */
       _ready;
       constructor() {
-        this.baseDir = join14(homedir8(), ".msapling");
+        this.baseDir = join14(homedir7(), ".msapling");
         this._ready = this.ensureDirs();
       }
       async ensureDirs() {
         try {
-          ensureConfigDir(this.baseDir);
-          const subdirs = ["history", "backups", "cache", "vault", "mcp"];
+          await mkdir6(this.baseDir, { recursive: true });
+          const subdirs = ["history", "backups", "cache", "vault"];
           for (const sub of subdirs) {
             const path2 = join14(this.baseDir, sub);
-            ensureConfigDir(path2);
+            await mkdir6(path2, { recursive: true });
           }
           if (process.platform !== "win32") {
             chmodSync(this.baseDir, 448);
@@ -6956,7 +6843,7 @@ var init_Storage = __esm({
         try {
           await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, token);
           try {
-            if (existsSync13(filePath)) {
+            if (existsSync12(filePath)) {
               unlinkSync(filePath);
             }
           } catch {
@@ -6981,8 +6868,8 @@ var init_Storage = __esm({
         } catch (e) {
           console.debug(`Keychain unavailable (${e instanceof Error ? e.message : String(e)}), falling back to file storage`);
         }
-        if (existsSync13(filePath)) {
-          const text = await readFile12(filePath, "utf8");
+        if (existsSync12(filePath)) {
+          const text = await readFile11(filePath, "utf8");
           return text.trim();
         }
         return null;
@@ -7000,9 +6887,9 @@ var init_Storage = __esm({
           console.debug(`Keychain unavailable for deletion (${e instanceof Error ? e.message : String(e)})`);
         }
         try {
-          if (existsSync13(filePath)) {
-            const fs2 = await import("fs/promises");
-            await fs2.unlink(filePath);
+          if (existsSync12(filePath)) {
+            const fs3 = await import("fs/promises");
+            await fs3.unlink(filePath);
           }
         } catch (e) {
           console.warn(`Failed to delete token file: ${e}`);
@@ -7016,26 +6903,23 @@ var init_Storage = __esm({
        * This ensures:
        * 1. Only one process writes at a time (file lock)
        * 2. Partial writes don't corrupt the JSON (atomic rename)
-       *
-       * CLI-LSTAT-HISTORY-01: Pass realpath:false so lockfile never calls lstat on a
-       * path that may not exist yet (first run before any history has been written).
        */
       async saveHistory(history) {
         const path2 = join14(this.baseDir, "history", "shell_history.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50, realpath: false });
+          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
           await this.historyMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(history, null, 2);
             await writeFile6(tmpPath, content, "utf8");
             try {
-              renameSync2(tmpPath, path2);
+              renameSync(tmpPath, path2);
             } catch (e) {
               try {
-                if (existsSync13(tmpPath)) {
-                  const fs2 = await import("fs/promises");
-                  await fs2.unlink(tmpPath);
+                if (existsSync12(tmpPath)) {
+                  const fs3 = await import("fs/promises");
+                  await fs3.unlink(tmpPath);
                 }
               } catch {
               }
@@ -7045,7 +6929,7 @@ var init_Storage = __esm({
         } finally {
           if (release2) {
             try {
-              await lockfile.unlock(path2, { skipStale: true, realpath: false });
+              await lockfile.unlock(path2, { skipStale: true });
             } catch (e) {
               console.warn(`Failed to unlock history file: ${e}`);
             }
@@ -7056,41 +6940,23 @@ var init_Storage = __esm({
        * SYNC-01: Serialised history read with file-based locking.
        * Reads are gated behind the file lock so a read that overlaps with an
        * in-progress write from another process always sees a complete, valid JSON.
-       *
-       * CLI-LSTAT-HISTORY-01: Short-circuit before locking when the file is absent
-       * so lockfile never calls lstat/realpath on a nonexistent path (ENOENT crash
-       * on fresh install).  Corrupt JSON is caught, backed up, and treated as empty
-       * rather than propagating a parse error.
        */
       async loadHistory() {
         const path2 = join14(this.baseDir, "history", "shell_history.json");
-        if (!existsSync13(path2)) {
-          return [];
-        }
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50, realpath: false });
-          return await this.historyMutex.run(async () => {
-            if (!existsSync13(path2)) {
-              return [];
-            }
-            const text = await readFile12(path2, "utf8");
-            try {
+          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          return this.historyMutex.run(async () => {
+            if (existsSync12(path2)) {
+              const text = await readFile11(path2, "utf8");
               return JSON.parse(text);
-            } catch {
-              console.warn("[msapling] shell_history.json is corrupt; resetting to empty history.");
-              const backupPath = `${path2}.corrupt.${Date.now()}.bak`;
-              try {
-                renameSync2(path2, backupPath);
-              } catch {
-              }
-              return [];
             }
+            return [];
           });
         } finally {
           if (release2) {
             try {
-              await lockfile.unlock(path2, { skipStale: true, realpath: false });
+              await lockfile.unlock(path2, { skipStale: true });
             } catch (e) {
               console.warn(`Failed to unlock history file: ${e}`);
             }
@@ -7099,24 +6965,23 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions write with file-based locking.
-       * CLI-LSTAT-HISTORY-01: realpath:false prevents ENOENT lstat on first run.
        */
       async savePermissions(permissions) {
         const path2 = join14(this.baseDir, "vault", "permissions.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50, realpath: false });
+          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
           await this.permissionsMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(permissions, null, 2);
             await writeFile6(tmpPath, content, "utf8");
             try {
-              renameSync2(tmpPath, path2);
+              renameSync(tmpPath, path2);
             } catch (e) {
               try {
-                if (existsSync13(tmpPath)) {
-                  const fs2 = await import("fs/promises");
-                  await fs2.unlink(tmpPath);
+                if (existsSync12(tmpPath)) {
+                  const fs3 = await import("fs/promises");
+                  await fs3.unlink(tmpPath);
                 }
               } catch {
               }
@@ -7126,7 +6991,7 @@ var init_Storage = __esm({
         } finally {
           if (release2) {
             try {
-              await lockfile.unlock(path2, { skipStale: true, realpath: false });
+              await lockfile.unlock(path2, { skipStale: true });
             } catch (e) {
               console.warn(`Failed to unlock permissions file: ${e}`);
             }
@@ -7135,28 +7000,23 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions read with file-based locking.
-       * CLI-LSTAT-HISTORY-01: Short-circuit on missing file; realpath:false avoids
-       * lstat on a path that may not exist yet on a fresh install.
        */
       async loadPermissions() {
         const path2 = join14(this.baseDir, "vault", "permissions.json");
-        if (!existsSync13(path2)) {
-          return { trustedCommands: [], trustedPaths: [] };
-        }
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50, realpath: false });
-          return await this.permissionsMutex.run(async () => {
-            if (!existsSync13(path2)) {
-              return { trustedCommands: [], trustedPaths: [] };
+          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          return this.permissionsMutex.run(async () => {
+            if (existsSync12(path2)) {
+              const text = await readFile11(path2, "utf8");
+              return JSON.parse(text);
             }
-            const text = await readFile12(path2, "utf8");
-            return JSON.parse(text);
+            return { trustedCommands: [], trustedPaths: [] };
           });
         } finally {
           if (release2) {
             try {
-              await lockfile.unlock(path2, { skipStale: true, realpath: false });
+              await lockfile.unlock(path2, { skipStale: true });
             } catch (e) {
               console.warn(`Failed to unlock permissions file: ${e}`);
             }
@@ -7167,11 +7027,14 @@ var init_Storage = __esm({
        * Backup a file before AI edit.
        * CLI-R11-STORAGE-03: backup artifacts are written with restrictive 0600
        * permissions so restored content is not readable by other OS users.
+       * CLI-ARCH-NO-EPOCH-IN-KEYS-FU-01: uses ISO timestamp + random suffix
+       * instead of epoch milliseconds for better traceability and collision avoidance.
        */
       async backup(filePath, content) {
         const filename = filePath.split("/").pop() || "file";
-        const timestamp = Date.now();
-        const backupPath = join14(this.baseDir, "backups", `${filename}.${timestamp}.bak`);
+        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const suffix = randomBytes7(4).toString("hex");
+        const backupPath = join14(this.baseDir, "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
         await writeFile6(backupPath, content, "utf8");
         if (process.platform !== "win32") {
           chmodSync(backupPath, 384);
@@ -7182,6 +7045,137 @@ var init_Storage = __esm({
   }
 });
 
+// ../core/src/Settings.ts
+import { homedir as homedir8 } from "os";
+import { join as join15 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import * as fs from "fs";
+import { readFile as readFile12 } from "fs/promises";
+function ensureConfigDir(p) {
+  try {
+    fs.mkdirSync(p, { recursive: true, mode: 448 });
+  } catch (e) {
+    if (e.code === "EEXIST" || e.code === "ENOTDIR") {
+      const stat5 = fs.statSync(p);
+      if (!stat5.isDirectory()) {
+        fs.renameSync(p, `${p}.broken-${Date.now()}`);
+        fs.mkdirSync(p, { recursive: true, mode: 448 });
+      }
+    } else {
+      throw e;
+    }
+  }
+}
+async function readJson(path2) {
+  try {
+    if (!existsSync13(path2)) return null;
+    const text = await readFile12(path2, "utf8");
+    if (!text.trim()) return null;
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function fromEnv(env) {
+  const out = {};
+  for (const [envKey, settingKey] of Object.entries(ENV_MAP)) {
+    const raw = env[envKey];
+    if (raw === void 0) continue;
+    if (settingKey === "maxTokens") {
+      const n = Number.parseInt(raw, 10);
+      if (Number.isFinite(n)) out.maxTokens = n;
+    } else if (settingKey === "temperature") {
+      const n = Number.parseFloat(raw);
+      if (Number.isFinite(n)) out.temperature = n;
+    } else if (settingKey === "ollamaEnabled" || settingKey === "telemetryEnabled") {
+      out[settingKey] = raw === "true" || raw === "1";
+    } else if (settingKey === "defaultMode") {
+      const v = raw;
+      if (["default", "plan", "acceptEdits", "bypassPermissions"].includes(v)) {
+        out.defaultMode = v;
+      }
+    } else {
+      out[settingKey] = raw;
+    }
+  }
+  return out;
+}
+function mergeSettings(base, override) {
+  const out = { ...base, ...override };
+  if (override.mcpServers) {
+    out.mcpServers = { ...base.mcpServers, ...override.mcpServers };
+  }
+  if (override.hooks) {
+    out.hooks = { ...base.hooks, ...override.hooks };
+  }
+  if (override.trustedCommands) {
+    const seen = /* @__PURE__ */ new Set();
+    const merged = [];
+    for (const c of [...base.trustedCommands, ...override.trustedCommands]) {
+      if (!seen.has(c)) {
+        seen.add(c);
+        merged.push(c);
+      }
+    }
+    out.trustedCommands = merged;
+  }
+  return out;
+}
+async function loadSettings(cwd = process.cwd(), env = process.env, warn) {
+  const sources = [];
+  const userPath = join15(homedir8() || ".", ".msapling", "settings.json");
+  const projectPath = join15(cwd, ".msapling", "settings.json");
+  const [user, project] = await Promise.all([readJson(userPath), readJson(projectPath)]);
+  if (user) sources.push(userPath);
+  if (project) sources.push(projectPath);
+  let settings = DEFAULT_SETTINGS;
+  if (user) settings = mergeSettings(settings, user);
+  if (project) settings = mergeSettings(settings, project);
+  settings = mergeSettings(settings, fromEnv(env));
+  if (settings.temperature < 0 || settings.temperature > 2) {
+    warn?.(`Settings: temperature out of range (${settings.temperature}); clamping to 0.7`);
+    settings = { ...settings, temperature: 0.7 };
+  }
+  if (settings.maxTokens <= 0) {
+    warn?.(`Settings: maxTokens must be positive; resetting to ${DEFAULT_SETTINGS.maxTokens}`);
+    settings = { ...settings, maxTokens: DEFAULT_SETTINGS.maxTokens };
+  }
+  return { settings, sources };
+}
+var DEFAULT_SETTINGS, ENV_MAP;
+var init_Settings = __esm({
+  "../core/src/Settings.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_SETTINGS = {
+      apiUrl: "https://api.msapling.com",
+      defaultModel: "google/gemini-2.0-flash-001",
+      defaultMode: "default",
+      theme: "diamond",
+      maxTokens: 4096,
+      temperature: 0.7,
+      ollamaEnabled: true,
+      ollamaBaseUrl: "http://127.0.0.1:11434",
+      telemetryEnabled: true,
+      mcpServers: {},
+      hooks: {},
+      trustedCommands: [],
+      shellEscapeEnabled: true
+    };
+    ENV_MAP = {
+      MSAPLING_API_URL: "apiUrl",
+      MSAPLING_DEFAULT_MODEL: "defaultModel",
+      MSAPLING_DEFAULT_MODE: "defaultMode",
+      MSAPLING_THEME: "theme",
+      MSAPLING_MAX_TOKENS: "maxTokens",
+      MSAPLING_TEMPERATURE: "temperature",
+      MSAPLING_OLLAMA_ENABLED: "ollamaEnabled",
+      MSAPLING_OLLAMA_BASE_URL: "ollamaBaseUrl",
+      MSAPLING_TELEMETRY_ENABLED: "telemetryEnabled"
+    };
+  }
+});
+
 // ../core/src/mcp/client.ts
 import { spawn as spawn8 } from "child_process";
 var PROTOCOL_VERSION, CLIENT_INFO, MCPClientError, MCPClient, MCPRegistry;
@@ -7293,7 +7287,7 @@ var init_client = __esm({
         if (!this.proc) throw new MCPClientError(`MCP server "${this.name}" not started`);
         const id = this.nextId++;
         const frame = { jsonrpc: "2.0", id, method, params };
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve18, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(new MCPClientError(`MCP request ${method} timed out after ${timeoutMs}ms`));
@@ -7301,7 +7295,7 @@ var init_client = __esm({
           this.pending.set(id, {
             resolve: (v) => {
               clearTimeout(timer);
-              resolve17(v);
+              resolve18(v);
             },
             reject: (e) => {
               clearTimeout(timer);
@@ -7328,7 +7322,7 @@ var init_client = __esm({
         if (!this.proc?.stdout) return;
         const stdout = this.proc.stdout;
         const decoder = new TextDecoder();
-        return new Promise((resolve17) => {
+        return new Promise((resolve18) => {
           stdout.on("data", (chunk) => {
             this.buffer += decoder.decode(chunk, { stream: true });
             let idx;
@@ -7339,8 +7333,8 @@ var init_client = __esm({
               this.handleFrame(line);
             }
           });
-          stdout.on("end", () => resolve17());
-          stdout.on("error", () => resolve17());
+          stdout.on("end", () => resolve18());
+          stdout.on("error", () => resolve18());
         });
       }
       handleFrame(line) {
@@ -7427,7 +7421,7 @@ var init_Swarm = __esm({
        * Execute a parallel swarm with shadow auditing and optional sub-shell popups.
        */
       async execute(tasks, projectRoot) {
-        const promises = tasks.map(async (task) => {
+        const promises2 = tasks.map(async (task) => {
           const audit = await this.shadow.verifyAction(task.prompt, `Swarm Task: ${task.name}`);
           if (!audit.approved) {
             return { taskId: task.id, workerId: "none", response: "", status: "blocked", auditNote: audit.reasoning };
@@ -7449,7 +7443,7 @@ var init_Swarm = __esm({
             return { taskId: task.id, workerId: task.id, response: e.message, status: "failed" };
           }
         });
-        return Promise.all(promises);
+        return Promise.all(promises2);
       }
       /**
        * SYNTHESIS: Use a high-reasoning model to merge the safe swarm results.
@@ -7515,7 +7509,7 @@ function isTokenLike(str) {
   return str.length >= 20 && /^[A-Za-z0-9_\-\.]+$/.test(str);
 }
 async function promptPassword(prompt) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const stdin = process.stdin;
     const stdout = process.stdout;
     stdout.write(prompt);
@@ -7531,12 +7525,12 @@ async function promptPassword(prompt) {
         stdin.setRawMode(wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17(password);
+        resolve18(password);
       } else if (char === "") {
         stdin.setRawMode(wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17("");
+        resolve18("");
       } else if (char === "\x7F" || char === "\b") {
         password = password.slice(0, -1);
       } else if (char >= " " && char <= "~") {
@@ -7547,7 +7541,7 @@ async function promptPassword(prompt) {
   });
 }
 async function promptTotp(prompt) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const stdin = process.stdin;
     const stdout = process.stdout;
     stdout.write(prompt);
@@ -7563,12 +7557,12 @@ async function promptTotp(prompt) {
         stdin.setRawMode(wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17(code);
+        resolve18(code);
       } else if (char === "") {
         stdin.setRawMode(wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
-        resolve17("");
+        resolve18("");
       } else if (char === "\x7F" || char === "\b") {
         code = code.slice(0, -1);
       } else if (/^\d$/.test(char)) {
@@ -7657,7 +7651,7 @@ async function loginWithGithubDevice(context) {
   const deadline = Date.now() + expires_in * 1e3;
   let githubToken = null;
   while (Date.now() < deadline) {
-    await new Promise((resolve17) => setTimeout(resolve17, pollMs));
+    await new Promise((resolve18) => setTimeout(resolve18, pollMs));
     let tokenResp;
     try {
       tokenResp = await fetch(GITHUB_TOKEN_URL, {
@@ -7680,7 +7674,7 @@ async function loginWithGithubDevice(context) {
     }
     if (tokenData.error === "authorization_pending") continue;
     if (tokenData.error === "slow_down") {
-      await new Promise((resolve17) => setTimeout(resolve17, 5e3));
+      await new Promise((resolve18) => setTimeout(resolve18, 5e3));
       continue;
     }
     context.addMessage("system", `GitHub auth error: ${tokenData.error_description || tokenData.error}`);
@@ -7789,7 +7783,7 @@ var init_unlock = __esm({
 
 // src/commands/doctor.ts
 import { homedir as homedir9 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { existsSync as existsSync14 } from "fs";
 import { readFile as readFile13 } from "fs/promises";
 async function checkApiHealth(client) {
@@ -7816,7 +7810,7 @@ async function checkAuthStatus(client) {
   }
 }
 async function checkSettingsFile() {
-  const settingsPath = join15(homedir9(), ".msapling", "settings.json");
+  const settingsPath = join16(homedir9(), ".msapling", "settings.json");
   try {
     if (!existsSync14(settingsPath)) {
       return { ok: false, message: `Not found: ${settingsPath}` };
@@ -8062,7 +8056,7 @@ var init_clear = __esm({
 
 // src/commands/mode.ts
 import { homedir as homedir10 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { existsSync as existsSync15 } from "fs";
 import { readFile as readFile14, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
 async function persistApprovalMode(mode, ttlMs) {
@@ -8080,7 +8074,7 @@ async function persistApprovalMode(mode, ttlMs) {
       ...ttlMs && { ttlMs }
     };
     existing.approvalMode = entry;
-    const settingsDir = join16(homedir10(), ".msapling");
+    const settingsDir = join17(homedir10(), ".msapling");
     if (!existsSync15(settingsDir)) {
       await mkdir7(settingsDir, { recursive: true });
     }
@@ -8093,7 +8087,7 @@ var init_mode = __esm({
   "src/commands/mode.ts"() {
     "use strict";
     init_esm_shims();
-    SETTINGS_PATH = join16(homedir10(), ".msapling", "settings.json");
+    SETTINGS_PATH = join17(homedir10(), ".msapling", "settings.json");
     modeCommand = {
       name: "mode",
       args: "[default|plan|acceptEdits|bypassPermissions] [...options]",
@@ -8367,7 +8361,7 @@ var init_compact = __esm({
 });
 
 // src/commands/init.ts
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { existsSync as existsSync16 } from "fs";
 import { writeFile as writeFile8 } from "fs/promises";
 var initCommand;
@@ -8382,7 +8376,7 @@ var init_init = __esm({
       handler: async (args2, context) => {
         try {
           const cwd = process.cwd();
-          const path2 = join17(cwd, "MSAPLING.md");
+          const path2 = join18(cwd, "MSAPLING.md");
           if (existsSync16(path2)) {
             context.addMessage("error", "MSAPLING.md already exists in current directory.");
             return;
@@ -8525,12 +8519,12 @@ var init_swarm = __esm({
 import { parse as parseYaml } from "yaml";
 import { existsSync as existsSync18 } from "fs";
 import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function findRecipe(name, cwd) {
   for (const dir of RECIPE_DIRS) {
     for (const suffix of NAME_SUFFIXES) {
       for (const ext of FILE_EXTS) {
-        const p = join18(cwd, dir, `${name}${suffix}${ext}`);
+        const p = join19(cwd, dir, `${name}${suffix}${ext}`);
         if (existsSync18(p)) return p;
       }
     }
@@ -8638,7 +8632,7 @@ ${rendered}` : rendered;
 // src/commands/skill.ts
 import { existsSync as existsSync19, readdirSync as readdirSync2, statSync as statSync5 } from "fs";
 import { readFile as readFile17 } from "fs/promises";
-import { join as join19, resolve as resolve14 } from "path";
+import { join as join20, resolve as resolve14 } from "path";
 function findSkillsRoot(cwd) {
   for (const candidate of SKILLS_DIRS) {
     const full = resolve14(cwd, candidate);
@@ -8655,7 +8649,7 @@ function listAllSkills(root) {
     return out;
   }
   for (const domain of domains) {
-    const dir = join19(root, domain);
+    const dir = join20(root, domain);
     let s;
     try {
       s = statSync5(dir);
@@ -8671,7 +8665,7 @@ function listAllSkills(root) {
     }
     for (const f of files) {
       if (!f.endsWith(".md")) continue;
-      out.push({ domain, name: f.slice(0, -3), path: join19(dir, f) });
+      out.push({ domain, name: f.slice(0, -3), path: join20(dir, f) });
     }
   }
   return out.sort(
@@ -8761,8 +8755,9 @@ ${prompt}`;
 
 // src/commands/benchmark.ts
 import { homedir as homedir11 } from "os";
-import { join as join20 } from "path";
-import { mkdirSync as mkdirSync4, writeFileSync } from "fs";
+import { join as join21 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import * as fs2 from "fs";
 function parseArgs(args2) {
   let models = null;
   let rounds = 1;
@@ -8877,10 +8872,10 @@ HW at start: ${hw.cores}-core ${hw.platform} | CPU ${hw.cpuPct}% | RAM ${hw.ramP
           `[HW at run time: CPU ${hwAtEnd.cpuPct}% / RAM ${hwAtEnd.ramPct}% | ${hw.ramGiB} GiB RAM, ${hw.cores} cores]`
         );
         try {
-          const dir = join20(homedir11(), ".msapling", "benchmarks");
+          const dir = join21(homedir11(), ".msapling", "benchmarks");
           mkdirSync4(dir, { recursive: true });
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 16);
-          const file = join20(dir, `${ts}.json`);
+          const file = join21(dir, `${ts}.json`);
           const run = {
             ts: (/* @__PURE__ */ new Date()).toISOString(),
             rounds,
@@ -8890,7 +8885,7 @@ HW at start: ${hw.cores}-core ${hw.platform} | CPU ${hw.cpuPct}% | RAM ${hw.ramP
             hw_end: hwAtEnd,
             results
           };
-          writeFileSync(file, JSON.stringify(run, null, 2));
+          await fs2.promises.writeFile(file, JSON.stringify(run, null, 2));
           context.addMessage("system", `Results saved to ${file}`);
         } catch (e) {
           context.addMessage("system", `Warning: could not save results \u2014 ${e?.message ?? e}`);
@@ -9126,12 +9121,12 @@ var init_theme = __esm({
 });
 
 // src/commands/theme.ts
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { homedir as homedir12 } from "os";
 import { existsSync as existsSync20 } from "fs";
 import { readFile as readFile18, writeFile as writeFile9 } from "fs/promises";
 async function persistTheme(storage, themeName) {
-  const settingsPath = join21(homedir12(), ".msapling", "settings.json");
+  const settingsPath = join22(homedir12(), ".msapling", "settings.json");
   let existing = {};
   try {
     if (existsSync20(settingsPath)) {
@@ -9141,7 +9136,7 @@ async function persistTheme(storage, themeName) {
   } catch {
   }
   existing["theme"] = themeName;
-  ensureConfigDir(join21(homedir12(), ".msapling"));
+  ensureConfigDir(join22(homedir12(), ".msapling"));
   await writeFile9(settingsPath, JSON.stringify(existing, null, 2), "utf8");
 }
 var VALID_THEMES, themeCommand;
@@ -9198,7 +9193,7 @@ Available themes: ${VALID_THEMES.join(", ")}`);
 });
 
 // src/commands/version.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import { existsSync as existsSync21 } from "fs";
 import { readFile as readFile19 } from "fs/promises";
 function row2(label, value) {
@@ -9227,8 +9222,8 @@ var init_version = __esm({
       category: "debug",
       handler: async (_args, context) => {
         const baseDir = typeof __dirname !== "undefined" ? __dirname : process.cwd();
-        const cliPkgPath = join22(baseDir, "..", "..", "package.json");
-        const corePkgPath = join22(baseDir, "..", "..", "..", "core", "package.json");
+        const cliPkgPath = join23(baseDir, "..", "..", "package.json");
+        const corePkgPath = join23(baseDir, "..", "..", "..", "core", "package.json");
         const [cliVersion, coreVersion] = await Promise.all([
           readPackageVersion(cliPkgPath),
           readPackageVersion(corePkgPath)
@@ -9253,13 +9248,13 @@ var init_version = __esm({
 });
 
 // src/commands/feedback.ts
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import { existsSync as existsSync22 } from "fs";
 import { readFile as readFile20 } from "fs/promises";
 async function readCliVersion() {
   try {
     const baseDir = typeof __dirname !== "undefined" ? __dirname : process.cwd();
-    const pkgPath = join23(baseDir, "..", "..", "package.json");
+    const pkgPath = join24(baseDir, "..", "..", "package.json");
     if (!existsSync22(pkgPath)) return "unknown";
     const text = await readFile20(pkgPath, "utf8");
     const json = JSON.parse(text);
@@ -9302,7 +9297,7 @@ var init_feedback = __esm({
 
 // src/commands/export.ts
 import { homedir as homedir13 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import { writeFile as writeFile10, mkdir as mkdir8 } from "fs/promises";
 function formatTimestamp(date) {
   return date.toISOString().replace(/[:.]/g, "-").replace("T", "_").slice(0, 19);
@@ -9352,10 +9347,10 @@ var init_export = __esm({
         let outputPath;
         let content;
         if (arg === "" || arg === "json") {
-          outputPath = join24(homedir13(), `msapling-export-${timestamp}.json`);
+          outputPath = join25(homedir13(), `msapling-export-${timestamp}.json`);
           content = buildJsonExport(history);
         } else if (arg === "markdown" || arg === "md") {
-          outputPath = join24(homedir13(), `msapling-export-${timestamp}.md`);
+          outputPath = join25(homedir13(), `msapling-export-${timestamp}.md`);
           content = buildMarkdownExport(history);
         } else {
           outputPath = arg;
@@ -9367,7 +9362,7 @@ var init_export = __esm({
           }
         }
         try {
-          const dir = join24(outputPath, "..");
+          const dir = join25(outputPath, "..");
           await mkdir8(dir, { recursive: true });
           await writeFile10(outputPath, content, "utf8");
           context.addMessage("system", `Exported to: ${outputPath}`);
@@ -9563,11 +9558,11 @@ var init_plan = __esm({
 
 // src/commands/note.ts
 import { homedir as homedir14 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { existsSync as existsSync23 } from "fs";
 import { readFile as readFile21, writeFile as writeFile11 } from "fs/promises";
 function getNotesFilePath() {
-  return join25(homedir14(), ".msapling", "notes.json");
+  return join26(homedir14(), ".msapling", "notes.json");
 }
 async function readNotes(filePath = getNotesFilePath()) {
   try {
@@ -9581,7 +9576,7 @@ async function readNotes(filePath = getNotesFilePath()) {
   }
 }
 async function writeNotes(notes, filePath = getNotesFilePath()) {
-  const dir = join25(homedir14(), ".msapling");
+  const dir = join26(homedir14(), ".msapling");
   ensureConfigDir(dir);
   await writeFile11(filePath, JSON.stringify(notes, null, 2), "utf8");
 }
@@ -9808,6 +9803,343 @@ var init_commands = __esm({
   }
 });
 
+// src/runtime/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  runDoctor: () => runDoctor
+});
+import { homedir as homedir15, platform as platform2 } from "os";
+import { join as join27 } from "path";
+import { existsSync as existsSync25, statSync as statSync6, accessSync } from "fs";
+import { readdir as readdir3 } from "fs/promises";
+import { exec } from "child_process";
+import { promisify } from "util";
+function redactSecrets(text) {
+  return text.replace(/token[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "token=***").replace(/password[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "password=***").replace(/api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "api_key=***").replace(/secret[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "secret=***").replace(/MSAPLING_TOKEN=.*/gi, "MSAPLING_TOKEN=***").replace(/MSAPLING_API_KEY=.*/gi, "MSAPLING_API_KEY=***");
+}
+async function checkNodeVersion() {
+  const version = process.version;
+  const match = version.match(/v(\d+)/);
+  const major = match ? parseInt(match[1], 10) : 0;
+  if (major >= 18) {
+    return {
+      name: "Node version",
+      status: "PASS",
+      message: `${version} (>=18)`
+    };
+  }
+  return {
+    name: "Node version",
+    status: "FAIL",
+    message: `${version} (requires >=18)`,
+    remediation: `Upgrade Node.js to v18+ from https://nodejs.org/`
+  };
+}
+async function checkConfigDir() {
+  const configDir = join27(homedir15(), ".msapling");
+  if (!existsSync25(configDir)) {
+    return {
+      name: "Config directory",
+      status: "WARN",
+      message: `${configDir} does not exist`,
+      remediation: `mkdir -p "${configDir}" && chmod 700 "${configDir}"`
+    };
+  }
+  const stats = statSync6(configDir);
+  if (!stats.isDirectory()) {
+    return {
+      name: "Config directory",
+      status: "FAIL",
+      message: `${configDir} exists but is not a directory`,
+      remediation: `rm "${configDir}" && mkdir -p "${configDir}"`
+    };
+  }
+  if (platform2() !== "win32") {
+    const mode = stats.mode & 511;
+    const safe = (mode & 63) === 0;
+    if (!safe) {
+      return {
+        name: "Config directory",
+        status: "WARN",
+        message: `${configDir} has overly permissive perms (${(mode & 511).toString(8)})`,
+        remediation: `chmod 700 "${configDir}"`
+      };
+    }
+  }
+  return {
+    name: "Config directory",
+    status: "PASS",
+    message: `${configDir} exists and is readable`
+  };
+}
+async function checkKeytar() {
+  try {
+    const keytar2 = await import("keytar");
+    if (keytar2 && typeof keytar2.getPassword === "function") {
+      return {
+        name: "Keytar native binary",
+        status: "PASS",
+        message: "Keytar loadable and functional"
+      };
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Keytar native binary",
+      status: "WARN",
+      message: `Keytar unavailable: ${msg}`,
+      remediation: `Token will be stored in plaintext. Run 'npm rebuild keytar' or 'bun install --force' to rebuild native bindings.`
+    };
+  }
+  return {
+    name: "Keytar native binary",
+    status: "WARN",
+    message: "Keytar check inconclusive",
+    remediation: `Run 'npm rebuild keytar' or 'bun install --force' to rebuild native bindings.`
+  };
+}
+async function checkPathConflicts() {
+  const pathEnv = process.env.PATH || "";
+  const paths = pathEnv.split(platform2() === "win32" ? ";" : ":");
+  const conflicts = [];
+  for (const dir of paths) {
+    if (!dir || !existsSync25(dir)) continue;
+    try {
+      const files = await readdir3(dir);
+      for (const file of files) {
+        if (file === "msapling" || file === "msapling.exe" || file === "msapling.py") {
+          const fullPath = join27(dir, file);
+          conflicts.push(fullPath);
+        }
+      }
+    } catch {
+    }
+  }
+  if (conflicts.length === 0) {
+    return {
+      name: "PATH conflicts",
+      status: "PASS",
+      message: "No conflicting msapling binaries found"
+    };
+  }
+  if (conflicts.length === 1) {
+    return {
+      name: "PATH conflicts",
+      status: "PASS",
+      message: `Single msapling binary found: ${conflicts[0]}`
+    };
+  }
+  return {
+    name: "PATH conflicts",
+    status: "WARN",
+    message: `Multiple msapling binaries found in PATH`,
+    remediation: `Found: ${conflicts.join(", ")}. Remove stale copies (especially .py or .exe).`
+  };
+}
+async function checkNetworkReach() {
+  const apiUrl = process.env.MSAPLING_API_URL || "https://api.msapling.com";
+  const timeout = 5e3;
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    const response = await fetch(`${apiUrl}/api/health`, {
+      method: "HEAD",
+      signal: controller.signal
+    });
+    clearTimeout(timeoutId);
+    if (response.ok) {
+      return {
+        name: "Network reach",
+        status: "PASS",
+        message: `${apiUrl} reachable`
+      };
+    }
+    return {
+      name: "Network reach",
+      status: "WARN",
+      message: `${apiUrl} returned status ${response.status}`,
+      remediation: `Check your network connection or API server status.`
+    };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Network reach",
+      status: "WARN",
+      message: `Cannot reach ${apiUrl}: ${msg}`,
+      remediation: `Check your network connection and firewall settings.`
+    };
+  }
+}
+async function checkTokenValidity() {
+  try {
+    const keytar2 = await import("keytar");
+    const KEYCHAIN_SERVICE = "msapling-cli";
+    const KEYCHAIN_ACCOUNT = "auth_token";
+    const token = await keytar2.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    if (!token) {
+      return {
+        name: "Token validity",
+        status: "WARN",
+        message: "No token stored in keychain",
+        remediation: `Run 'msapling login' to authenticate.`
+      };
+    }
+    if (typeof token === "string" && token.length > 10) {
+      return {
+        name: "Token validity",
+        status: "PASS",
+        message: `Token loaded (${token.length} chars)`
+      };
+    }
+    return {
+      name: "Token validity",
+      status: "WARN",
+      message: "Token present but appears invalid",
+      remediation: `Run 'msapling login' to re-authenticate.`
+    };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      name: "Token validity",
+      status: "WARN",
+      message: `Cannot check token: ${msg}`,
+      remediation: `Run 'msapling login' to authenticate.`
+    };
+  }
+}
+async function checkOsSpecific() {
+  if (platform2() === "win32") {
+    try {
+      const configDir = join27(homedir15(), ".msapling");
+      const longPath = "A".repeat(260);
+      const testPath = join27(configDir, longPath);
+      try {
+        accessSync(configDir);
+      } catch {
+        return {
+          name: "OS-specific (Windows)",
+          status: "WARN",
+          message: "Cannot verify Windows long-path support",
+          remediation: `Enable LongPathsEnabled in Registry or use 'fsutil 8dot3name set C: 0'.`
+        };
+      }
+      return {
+        name: "OS-specific (Windows)",
+        status: "PASS",
+        message: "Windows long-path support accessible"
+      };
+    } catch (e) {
+      return {
+        name: "OS-specific (Windows)",
+        status: "WARN",
+        message: "Windows long-path check failed",
+        remediation: `Enable LongPathsEnabled in Registry or use 'fsutil 8dot3name set C: 0'.`
+      };
+    }
+  }
+  if (platform2() === "darwin") {
+    return {
+      name: "OS-specific (macOS)",
+      status: "PASS",
+      message: "macOS detected"
+    };
+  }
+  if (platform2() === "linux") {
+    try {
+      await import("keytar");
+      return {
+        name: "OS-specific (Linux)",
+        status: "PASS",
+        message: "libsecret/keytar dependencies available"
+      };
+    } catch (e) {
+      return {
+        name: "OS-specific (Linux)",
+        status: "WARN",
+        message: "libsecret may not be installed",
+        remediation: `Install libsecret: sudo apt-get install libsecret-1-dev (Ubuntu/Debian) or dnf install libsecret-devel (Fedora)`
+      };
+    }
+  }
+  return {
+    name: "OS-specific",
+    status: "PASS",
+    message: `${platform2()} detected`
+  };
+}
+function formatCheckResult(result, maxLabelWidth) {
+  const indicator2 = result.status === "PASS" ? "\u2713" : result.status === "WARN" ? "\u26A0" : "\u2717";
+  const paddedLabel = result.name.padEnd(maxLabelWidth);
+  const statusStr = `[${indicator2} ${result.status}]`.padEnd(10);
+  let output = `  ${paddedLabel} ${statusStr} ${result.message}`;
+  if (result.remediation) {
+    output += `
+    \u2192 ${result.remediation}`;
+  }
+  return output;
+}
+function dumpEnv(debug) {
+  if (!debug) return [];
+  const lines = [];
+  lines.push("");
+  lines.push("\u2500".repeat(60));
+  lines.push("Environment variables:");
+  lines.push("\u2500".repeat(60));
+  const env = { ...process.env };
+  const keys = Object.keys(env).sort();
+  for (const key of keys) {
+    const value = env[key] || "";
+    const redacted = redactSecrets(value);
+    lines.push(`${key}=${redacted}`);
+  }
+  return lines;
+}
+async function runDoctor(debug = false) {
+  const output = [];
+  output.push("");
+  output.push("MSapling Doctor \u2014 Health Check");
+  output.push("\u2500".repeat(60));
+  const checks = [];
+  checks.push(await checkNodeVersion());
+  checks.push(await checkConfigDir());
+  checks.push(await checkKeytar());
+  checks.push(await checkPathConflicts());
+  checks.push(await checkNetworkReach());
+  checks.push(await checkTokenValidity());
+  checks.push(await checkOsSpecific());
+  const maxLabelWidth = Math.max(...checks.map((c) => c.name.length));
+  for (const check of checks) {
+    output.push(formatCheckResult(check, maxLabelWidth));
+  }
+  output.push("");
+  output.push("\u2500".repeat(60));
+  const failCount = checks.filter((c) => c.status === "FAIL").length;
+  const warnCount = checks.filter((c) => c.status === "WARN").length;
+  if (failCount === 0 && warnCount === 0) {
+    output.push("All checks passed! \u2713");
+  } else {
+    const msgs = [];
+    if (failCount > 0) msgs.push(`${failCount} failed`);
+    if (warnCount > 0) msgs.push(`${warnCount} warning(s)`);
+    output.push(`Status: ${msgs.join(", ")}`);
+  }
+  output.push("");
+  if (debug) {
+    output.push(...dumpEnv(true));
+    output.push("");
+  }
+  console.log(output.join("\n"));
+  process.exit(failCount > 0 ? 1 : 0);
+}
+var execAsync;
+var init_doctor2 = __esm({
+  "src/runtime/doctor.ts"() {
+    "use strict";
+    init_esm_shims();
+    execAsync = promisify(exec);
+  }
+});
+
 // ../../node_modules/.bun/diff@9.0.0/node_modules/diff/libesm/diff/base.js
 var Diff;
 var init_base = __esm({
@@ -9894,13 +10226,13 @@ var init_base = __esm({
           editLength++;
         };
         if (callback) {
-          (function exec() {
+          (function exec2() {
             setTimeout(function() {
               if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {
                 return callback(void 0);
               }
               if (!execEditLength()) {
-                exec();
+                exec2();
               }
             }, 0);
           })();
@@ -10984,17 +11316,17 @@ var init_registry_merger = __esm({
 
 // ../core/src/mcp/local_tools.ts
 import { spawn as spawn10 } from "child_process";
-import { readdir as readdir3, stat as stat4, realpath as realpath2 } from "fs/promises";
-import { resolve as resolve15 } from "path";
+import { readdir as readdir4, stat as stat4, realpath as realpath2 } from "fs/promises";
+import { resolve as resolve16 } from "path";
 function asResult(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
 async function runCommand(command, cwd) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let p;
     const timeout = setTimeout(() => {
       if (p) p.kill();
-      resolve17({ stdout: "", stderr: "Command timed out after 30s", exit_code: -1 });
+      resolve18({ stdout: "", stderr: "Command timed out after 30s", exit_code: -1 });
     }, 3e4);
     try {
       p = spawn10("sh", ["-c", command], {
@@ -11012,15 +11344,15 @@ async function runCommand(command, cwd) {
       });
       p.on("error", (e) => {
         clearTimeout(timeout);
-        resolve17({ stdout, stderr: stderr + (e?.message ?? ""), exit_code: -1 });
+        resolve18({ stdout, stderr: stderr + (e?.message ?? ""), exit_code: -1 });
       });
       p.on("exit", (code) => {
         clearTimeout(timeout);
-        resolve17({ stdout, stderr, exit_code: code });
+        resolve18({ stdout, stderr, exit_code: code });
       });
     } catch (e) {
       clearTimeout(timeout);
-      resolve17({
+      resolve18({
         stdout: "",
         stderr: e?.message ?? "Failed to spawn process",
         exit_code: -1
@@ -11030,7 +11362,7 @@ async function runCommand(command, cwd) {
 }
 async function listDirectory(path2, maxEntries = 100) {
   try {
-    const entries = await readdir3(path2, { withFileTypes: true });
+    const entries = await readdir4(path2, { withFileTypes: true });
     const result = [];
     for (const entry of entries.slice(0, maxEntries)) {
       const item = {
@@ -11087,7 +11419,7 @@ async function callLocalTool(name, args2, projectRoot) {
       const command = String(args2.command ?? "");
       let cwd = projectRoot;
       if (args2.cwd) {
-        cwd = resolve15(projectRoot, String(args2.cwd));
+        cwd = resolve16(projectRoot, String(args2.cwd));
         try {
           const resolvedCwd = await realpath2(cwd);
           const resolvedRoot = await realpath2(projectRoot);
@@ -11124,7 +11456,7 @@ ${res.stderr}`
         return asResult("path is required", true);
       }
       try {
-        const resolvedPath = await realpath2(resolve15(projectRoot, pathArg));
+        const resolvedPath = await realpath2(resolve16(projectRoot, pathArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedPath.startsWith(resolvedRoot)) {
           return asResult("Error: path attempts to escape project root", true);
@@ -11143,7 +11475,7 @@ ${res.stderr}`
     }
     case "local_glob": {
       const pattern = String(args2.pattern ?? "");
-      let cwd = args2.cwd ? resolve15(projectRoot, String(args2.cwd)) : projectRoot;
+      let cwd = args2.cwd ? resolve16(projectRoot, String(args2.cwd)) : projectRoot;
       if (!pattern) {
         return asResult("pattern is required", true);
       }
@@ -11172,7 +11504,7 @@ ${res.stderr}`
       }
       if (path2) {
         try {
-          const resolvedPath = await realpath2(resolve15(projectRoot, path2));
+          const resolvedPath = await realpath2(resolve16(projectRoot, path2));
           const resolvedRoot = await realpath2(projectRoot);
           if (!resolvedPath.startsWith(resolvedRoot)) {
             return asResult("Error: path attempts to escape project root", true);
@@ -11192,7 +11524,7 @@ ${res.stderr}`
         return asResult("cwd is required", true);
       }
       try {
-        const resolvedCwd = await realpath2(resolve15(projectRoot, cwdArg));
+        const resolvedCwd = await realpath2(resolve16(projectRoot, cwdArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedCwd.startsWith(resolvedRoot)) {
           return asResult("Error: cwd attempts to escape project root", true);
@@ -11218,7 +11550,7 @@ ${status.porcelain || "(clean)"}`
         return asResult("cwd is required", true);
       }
       try {
-        const resolvedCwd = await realpath2(resolve15(projectRoot, cwdArg));
+        const resolvedCwd = await realpath2(resolve16(projectRoot, cwdArg));
         const resolvedRoot = await realpath2(projectRoot);
         if (!resolvedCwd.startsWith(resolvedRoot)) {
           return asResult("Error: cwd attempts to escape project root", true);
@@ -11333,8 +11665,8 @@ __export(server_exports, {
   runStdio: () => runStdio,
   runStdioWithRegistry: () => runStdioWithRegistry
 });
-import { readdirSync as readdirSync3, readFileSync, statSync as statSync6 } from "fs";
-import { join as join26, relative as relative14, resolve as resolve16 } from "path";
+import { readdirSync as readdirSync3, readFileSync, statSync as statSync7 } from "fs";
+import { join as join28, relative as relative14, resolve as resolve17 } from "path";
 function asResult2(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -11354,10 +11686,10 @@ function buildFileTree(root, maxFiles) {
     for (const name of entries) {
       if (out.length >= maxFiles) break;
       if (SKIP_DIRS2.has(name)) continue;
-      const full = join26(dir, name);
+      const full = join28(dir, name);
       let s;
       try {
-        s = statSync6(full);
+        s = statSync7(full);
       } catch {
         continue;
       }
@@ -11771,7 +12103,7 @@ ${r.response ?? ""}`;
             return asResult2(JSON.stringify(result));
           }
           case "msapling_project_context": {
-            const root = resolve16(String(args2.path ?? "."));
+            const root = resolve17(String(args2.path ?? "."));
             const maxFiles = Number.isFinite(args2.max_files) ? Number(args2.max_files) : 30;
             const maxKB = Number.isFinite(args2.max_file_size_kb) ? Number(args2.max_file_size_kb) : 50;
             const files = buildFileTree(root, maxFiles);
@@ -11867,7 +12199,10 @@ init_esm_shims();
 import { Box, Text } from "ink";
 import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
-  /* @__PURE__ */ jsx(Text, { bold: true, color: "cyan", children: "\u25CF MSapling CLI v2.0.0" }),
+  /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
+    "\u25CF MSapling CLI v",
+    "2.3.6-beta.4"
+  ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });
 
@@ -12353,9 +12688,9 @@ ${prompt}` : prompt;
         if (proc.stderr) proc.stderr.on("data", (chunk) => {
           stderr += chunk.toString();
         });
-        await new Promise((resolve17, reject) => {
+        await new Promise((resolve18, reject) => {
           proc.on("close", (code) => {
-            if (code === 0 || code === null) resolve17();
+            if (code === 0 || code === null) resolve18();
             else reject(new Error(`Process exited with code ${code}`));
           });
           proc.on("error", reject);
@@ -12382,9 +12717,9 @@ ${prompt}` : prompt;
         for (const mention of fileMentions) {
           const filePath = mention.slice(1);
           try {
-            const { existsSync: existsSync25 } = await import("fs");
+            const { existsSync: existsSync26 } = await import("fs");
             const { readFile: readFile23 } = await import("fs/promises");
-            if (existsSync25(filePath)) {
+            if (existsSync26(filePath)) {
               const content = await readFile23(filePath, "utf8");
               const MAX_LEN = 32768;
               const truncated = content.length > MAX_LEN ? content.slice(0, MAX_LEN) + "\n...[TRUNCATED]" : content;
@@ -12451,9 +12786,9 @@ async function initSession(ctx) {
       ctx.setShellEscapeEnabled(settings.shellEscapeEnabled !== false);
     }
     try {
-      const { homedir: homedir15 } = await import("os");
-      const { join: join27 } = await import("path");
-      const userSettingsPath = join27(homedir15(), ".msapling", "settings.json");
+      const { homedir: homedir16 } = await import("os");
+      const { join: join29 } = await import("path");
+      const userSettingsPath = join29(homedir16(), ".msapling", "settings.json");
       if (existsSync24(userSettingsPath)) {
         const userText = await readFile22(userSettingsPath, "utf8");
         const userJson = JSON.parse(userText);
@@ -12545,8 +12880,8 @@ var App = ({ compact: compact2 = false }) => {
   const storage = useRef(new StorageManager()).current;
   const client = useRef(new MSaplingClient()).current;
   const requestApproval = useCallback((request) => {
-    return new Promise((resolve17) => {
-      setPendingApproval({ request, resolve: resolve17 });
+    return new Promise((resolve18) => {
+      setPendingApproval({ request, resolve: resolve18 });
     });
   }, []);
   const agent = useRef(new Agent(client, process.cwd(), requestApproval)).current;
@@ -12758,11 +13093,25 @@ function handleCliArgs(args2) {
     console.log("Usage: msapling                  start interactive REPL");
     console.log("       msapling --compact        start REPL in compact mode (no footer, thin separators)");
     console.log("       msapling mcp serve        run as MCP stdio server (Claude Code / Cursor / Windsurf integration)");
+    console.log("       msapling doctor           run diagnostic health checks");
+    console.log("       msapling doctor --debug   run doctor with full environment dump");
     console.log("       msapling --version        print version and exit");
     console.log("       msapling --help           print this message");
     console.log("Inside the REPL: type /help for slash-command help.");
     process.exit(0);
   }
+  if (args2[0] === "doctor") {
+    (async () => {
+      const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor2(), doctor_exports));
+      const debug = args2.includes("--debug");
+      await runDoctor2(debug);
+    })().catch((e) => {
+      process.stderr.write(`[msapling-doctor] fatal: ${e?.message ?? e}
+`);
+      process.exit(1);
+    });
+    return false;
+  }
   if (args2[0] === "mcp" && args2[1] === "serve") {
     (async () => {
       const { MSaplingClient: MSaplingClient2 } = await Promise.resolve().then(() => (init_src(), src_exports));