@mtreeai/msapling-cli 2.3.6-beta.5 → 2.3.6-beta.7

package/dist/index.js

@@ -272,7 +272,11 @@ var init_src = __esm({
         try {
           const parts = token.split(".");
           if (parts.length !== 3) return null;
-          const payload = JSON.parse(atob(parts[1]));
+          let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+          const padLen = (4 - b64.length % 4) % 4;
+          b64 += "=".repeat(padLen);
+          const decoded = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("binary");
+          const payload = JSON.parse(decoded);
           return payload;
         } catch {
           return null;
@@ -374,8 +378,9 @@ var init_src = __esm({
        */
       async chatOnce(prompt, model, chatId) {
         let acc = "";
-        for await (const chunk of this.streamChat({ prompt, model, chat_id: chatId })) {
-          if (chunk.content) acc += chunk.content;
+        for await (const chunk of this.streamChat({ content: prompt, model, chat_id: chatId ?? "" })) {
+          if (chunk.delta) acc += chunk.delta;
+          else if (chunk.content) acc += chunk.content;
         }
         return acc;
       }
@@ -455,6 +460,33 @@ var init_src = __esm({
         });
         return data.hash;
       }
+      async getActiveTasks() {
+        return this.request("/api/task-monitor/active");
+      }
+      /**
+       * Wakeup Management (LAB-CHAT-PARITY-04)
+       */
+      async listWakeups(params = {}) {
+        const queryParams = new URLSearchParams(params);
+        return this.request(`/api/wakeups/?${queryParams.toString()}`);
+      }
+      async createWakeup(data) {
+        return this.request("/api/wakeups/", {
+          method: "POST",
+          body: JSON.stringify(data)
+        });
+      }
+      async cancelWakeup(id) {
+        await this.request(`/api/wakeups/${id}`, {
+          method: "DELETE"
+        });
+      }
+      /**
+       * Orchestration & Fleet Status
+       */
+      async getFleetStatus() {
+        return this.request("/api/orchestration/status");
+      }
       async proposeEdit(params) {
         return await this.request("/api/mdrive/ram/blocks/propose", {
           method: "POST",
@@ -462,6 +494,9 @@ var init_src = __esm({
         });
       }
       async *streamChat(params) {
+        if (!params.frame_id) {
+          params = { ...params, frame_id: "earth_surface" };
+        }
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
@@ -487,22 +522,34 @@ var init_src = __esm({
           if (!response.body) throw new Error("No response body");
           const reader = response.body.getReader();
           const decoder = new TextDecoder();
+          let pending = "";
+          const yieldLine = function* (raw) {
+            const line = raw.replace(/\r$/, "").trim();
+            if (!line) return;
+            try {
+              yield JSON.parse(line);
+            } catch {
+              if (line.startsWith("{")) {
+                console.warn(`[Stream] Dropped malformed JSON: ${line}`);
+              }
+            }
+          };
           while (true) {
             const { done, value } = await reader.read();
             if (done) break;
-            const chunk = decoder.decode(value, { stream: true });
-            const lines = chunk.split("\n").filter((l) => l.trim());
-            for (const line of lines) {
-              try {
-                const data = JSON.parse(line);
-                yield data;
-              } catch (e) {
-                if (line.startsWith("{")) {
-                  console.warn(`[Stream] Dropped partial JSON: ${line}`);
-                }
-              }
+            pending += decoder.decode(value, { stream: true });
+            let nlIdx;
+            while ((nlIdx = pending.indexOf("\n")) !== -1) {
+              const raw = pending.slice(0, nlIdx);
+              pending = pending.slice(nlIdx + 1);
+              yield* yieldLine(raw);
             }
           }
+          pending += decoder.decode();
+          if (pending.length > 0) {
+            yield* yieldLine(pending);
+            pending = "";
+          }
         } catch (e) {
           if (e.name === "AbortError") {
             throw new MSaplingError("Request timed out after 30s.", 408, "timeout");
@@ -3493,18 +3540,18 @@ async function copyDir(src, dst) {
 async function backupFile(absPath) {
   try {
     const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
-    const { homedir: homedir16 } = await import("os");
-    const { join: join29 } = await import("path");
+    const { homedir: homedir17 } = await import("os");
+    const { join: join31 } = await import("path");
     const filename = absPath.split(/[\\/]/).pop() ?? "file";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const suffix = randomBytes5(4).toString("hex");
-    const backupPath = join29(
-      homedir16(),
+    const backupPath = join31(
+      homedir17(),
       ".msapling",
       "backups",
       `${filename}.backup-${stamp}-${suffix}.bak`
     );
-    await mkdir9(join29(homedir16(), ".msapling", "backups"), { recursive: true });
+    await mkdir9(join31(homedir17(), ".msapling", "backups"), { recursive: true });
     const content = await readFile23(absPath, "utf8");
     await writeFile12(backupPath, content, "utf8");
     return backupPath;
@@ -3732,13 +3779,13 @@ var init_DeleteFileTool = __esm({
         if (isFile) {
           try {
             const { readFile: readFile23, writeFile: writeFile12, mkdir: mkdir9 } = await import("fs/promises");
-            const { homedir: homedir16 } = await import("os");
+            const { homedir: homedir17 } = await import("os");
             const existingContent = await readFile23(abs, "utf8");
             const filename = abs.split(/[\\/]/).pop() ?? "file";
             const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
             const suffix = randomBytes6(4).toString("hex");
-            const backupPath = join11(homedir16(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
-            await mkdir9(join11(homedir16(), ".msapling", "backups"), { recursive: true });
+            const backupPath = join11(homedir17(), ".msapling", "backups", `${filename}.backup-${stamp}-${suffix}.bak`);
+            await mkdir9(join11(homedir17(), ".msapling", "backups"), { recursive: true });
             await writeFile12(backupPath, existingContent, "utf8");
             backedUpTo = backupPath;
           } catch {
@@ -3960,12 +4007,81 @@ var init_Sandbox = __esm({
         }
         return { status: "safe", hash };
       }
-      getRestrictedEnv() {
-        const safeKeys = ["PATH", "LANG", "LC_ALL", "NODE_ENV", "BUN_ENV"];
+      /**
+       * CLI-AUDIT-AUTO-44: curate PATH for sandboxed subprocesses.
+       *
+       * Previously `getRestrictedEnv` forwarded `process.env.PATH` verbatim. That
+       * means any directory injected onto the user's PATH (npm-global, ~/.local/bin,
+       * a malicious package's postinstall step adding /tmp/evil) inherits straight
+       * into every sandboxed tool spawn. Containment is then trivially defeated:
+       * "git" might resolve to /tmp/evil/git.
+       *
+       * Strategy:
+       *   - Default to a small allowlist of canonical system dirs (matches POSIX
+       *     `/etc/login.defs` style + common Windows system roots).
+       *   - Filter the caller's PATH against the allowlist, preserving order so
+       *     that legitimate /usr/local/bin/git still wins over /usr/bin/git.
+       *   - Drop world-writable / home-relative entries (`/tmp`, `~`, `.`, ``).
+       *   - Caller can override with an explicit `pathOverride` argument (e.g.
+       *     boot-time validation, tests).
+       */
+      static SAFE_PATH_ENTRIES = /* @__PURE__ */ new Set([
+        // POSIX
+        "/usr/local/sbin",
+        "/usr/local/bin",
+        "/usr/sbin",
+        "/usr/bin",
+        "/sbin",
+        "/bin",
+        // macOS extras
+        "/opt/homebrew/bin",
+        "/opt/homebrew/sbin",
+        "/opt/local/bin",
+        // Windows
+        "C:\\Windows\\System32",
+        "C:\\Windows",
+        "C:\\Windows\\System32\\Wbem",
+        "C:\\Windows\\System32\\WindowsPowerShell\\v1.0"
+      ]);
+      /**
+       * Decide whether a single PATH entry is acceptable inside the sandbox.
+       * Exposed (static) for unit testing.
+       */
+      static isSafePathEntry(entry) {
+        if (!entry) return false;
+        const e = entry.trim();
+        if (!e) return false;
+        if (e === "." || e === "..") return false;
+        if (e.startsWith("~")) return false;
+        if (e.startsWith("/tmp") || e.startsWith("/var/tmp")) return false;
+        if (process.platform === "win32") {
+          const lower = e.toLowerCase();
+          for (const safe of _Sandbox.SAFE_PATH_ENTRIES) {
+            if (safe.toLowerCase() === lower) return true;
+          }
+          return false;
+        }
+        return _Sandbox.SAFE_PATH_ENTRIES.has(e);
+      }
+      /**
+       * Build a curated PATH from the host environment, retaining only entries that
+       * pass `isSafePathEntry`. Order is preserved. If nothing matches, fall back
+       * to a minimal platform default so subprocess spawn never sees an empty PATH.
+       */
+      static curatePath(rawPath) {
+        const sep3 = process.platform === "win32" ? ";" : ":";
+        const entries = (rawPath ?? "").split(sep3);
+        const kept = entries.filter((e) => _Sandbox.isSafePathEntry(e));
+        if (kept.length > 0) return kept.join(sep3);
+        return process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
+      }
+      getRestrictedEnv(pathOverride) {
+        const safeKeys = ["LANG", "LC_ALL", "NODE_ENV", "BUN_ENV"];
         const filteredEnv = {};
         for (const key of safeKeys) {
           if (process.env[key]) filteredEnv[key] = process.env[key];
         }
+        filteredEnv["PATH"] = pathOverride ?? _Sandbox.curatePath(process.env.PATH);
         filteredEnv["MSAPLING_SANDBOX"] = "true";
         return filteredEnv;
       }
@@ -4389,6 +4505,35 @@ ${blocker.stderr || "(empty)"}`,
             };
           }
         }
+        if (args2.path) {
+          const check = this.sandbox.isPathSafe(args2.path);
+          if (!check.safe) {
+            await this.voice.speak(`Security block detected`, "urgent");
+            const staleKey = `${toolName}:${(args2.path || "").trim()}`;
+            if (this.trustStore?.has(staleKey)) {
+              this.trustStore.delete(staleKey).catch(() => {
+              });
+            }
+            return { content: `Security Block: ${check.reason}`, isError: true };
+          }
+        }
+        if (toolName === "run_command" || toolName === "bash_command") {
+          if (!args2.command) {
+            return { content: `Error: ${toolName} requires a command argument`, isError: true };
+          }
+          const analysis = this.sandbox.analyzeCommand(args2.command);
+          if (analysis.status === "blocked") {
+            const staleCmdKey = toolName === "bash_command" ? `bash_command:${(args2.command || "").trim().replace(/\s+/g, " ")}${args2.cwd ? `:cwd=${args2.cwd}` : ""}` : `run_command:${(args2.command || "").trim()}`;
+            if (this.trustStore?.has(staleCmdKey)) {
+              this.trustStore.delete(staleCmdKey).catch(() => {
+              });
+            }
+            return { content: `Security Block: ${analysis.reason}`, isError: true };
+          }
+          if (analysis.status === "dangerous" && this.mode !== "bypassPermissions") {
+            return { content: `Dangerous Command Blocked: ${analysis.reason}. Use manual approval or trust hash ${analysis.hash}.`, isError: true };
+          }
+        }
         if (this.needsApproval(toolName) && this.approvalCallback) {
           let cmdKey = "";
           if (toolName === "run_command") {
@@ -4400,9 +4545,6 @@ ${blocker.stderr || "(empty)"}`,
           } else {
             cmdKey = `${toolName}:${(args2.path || args2.instruction || "").trim()}`;
           }
-          if ((toolName === "run_command" || toolName === "bash_command") && !args2.command) {
-            return { content: `Error: ${toolName} requires a command argument`, isError: true };
-          }
           const alreadyTrusted = this.trustStore ? this.trustStore.has(cmdKey) : this.sessionTrust.has(cmdKey);
           if (!alreadyTrusted) {
             const decision = await this.approvalCallback({
@@ -4449,22 +4591,6 @@ ${blocker.stderr || "(empty)"}`,
 Please approve the diff in the UI to sync this change locally.`
           };
         }
-        if (args2.path) {
-          const check = this.sandbox.isPathSafe(args2.path);
-          if (!check.safe) {
-            await this.voice.speak(`Security block detected`, "urgent");
-            return { content: `Security Block: ${check.reason}`, isError: true };
-          }
-        }
-        if (toolName === "run_command" || toolName === "bash_command") {
-          const analysis = this.sandbox.analyzeCommand(args2.command);
-          if (analysis.status === "blocked") {
-            return { content: `Security Block: ${analysis.reason}`, isError: true };
-          }
-          if (analysis.status === "dangerous" && this.mode !== "bypassPermissions") {
-            return { content: `Dangerous Command Blocked: ${analysis.reason}. Use manual approval or trust hash ${analysis.hash}.`, isError: true };
-          }
-        }
         const result = await tool.execute(args2, projectRoot);
         if (this.hooks) {
           this.hooks.fire({
@@ -5011,9 +5137,9 @@ var init_Mutex = __esm({
 
 // ../core/src/TrustStore.ts
 import { join as join13 } from "path";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir6, platform as platform2 } from "os";
 import { existsSync as existsSync11, mkdirSync } from "fs";
-import { readFile as readFile10, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile5, chmod } from "fs/promises";
 var USER_SETTINGS_PATH, TrustStore;
 var init_TrustStore = __esm({
   "../core/src/TrustStore.ts"() {
@@ -5053,6 +5179,12 @@ var init_TrustStore = __esm({
         const dir = join13(homedir6(), ".msapling");
         if (!existsSync11(dir)) mkdirSync(dir, { recursive: true });
         await writeFile5(this.settingsPath, JSON.stringify(settings, null, 2), "utf8");
+        if (platform2() !== "win32") {
+          try {
+            await chmod(this.settingsPath, 384);
+          } catch {
+          }
+        }
       }
       // ── Public API ─────────────────────────────────────────────────────────────
       /**
@@ -5130,7 +5262,7 @@ var require_polyfills = __commonJS({
     var constants = __require("constants");
     var origCwd = process.cwd;
     var cwd = null;
-    var platform3 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+    var platform4 = process.env.GRACEFUL_FS_PLATFORM || process.platform;
     process.cwd = function() {
       if (!cwd)
         cwd = origCwd.call(process);
@@ -5189,7 +5321,7 @@ var require_polyfills = __commonJS({
         fs3.lchownSync = function() {
         };
       }
-      if (platform3 === "win32") {
+      if (platform4 === "win32") {
         fs3.rename = typeof fs3.rename !== "function" ? fs3.rename : (function(fs$rename) {
           function rename2(from, to, cb) {
             var start = Date.now();
@@ -5656,8 +5788,8 @@ var require_graceful_fs = __commonJS({
       }
       var fs$appendFile = fs4.appendFile;
       if (fs$appendFile)
-        fs4.appendFile = appendFile;
-      function appendFile(path2, data, options, cb) {
+        fs4.appendFile = appendFile2;
+      function appendFile2(path2, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$appendFile(path2, data, options, cb);
@@ -6730,7 +6862,7 @@ var init_keytar = __esm({
 
 // node-file:<repo>\node_modules\.bun\keytar@7.9.0\node_modules\keytar\build\Release\keytar.node
 var require_keytar = __commonJS({
-  "node-file:D:\\Projects\\MSapling_CLI\\node_modules\\.bun\\keytar@7.9.0\\node_modules\\keytar\\build\\Release\\keytar.node"(exports, module) {
+  "node-file:F:\\MForest\\projects\\MSapling_CLI\\node_modules\\.bun\\keytar@7.9.0\\node_modules\\keytar\\build\\Release\\keytar.node"(exports, module) {
     "use strict";
     init_esm_shims();
     init_keytar();
@@ -6784,9 +6916,12 @@ var require_keytar2 = __commonJS({
 // ../core/src/Storage.ts
 import { join as join14 } from "path";
 import { homedir as homedir7 } from "os";
-import { chmodSync, existsSync as existsSync12, renameSync, unlinkSync } from "fs";
-import { mkdir as mkdir6, writeFile as writeFile6, readFile as readFile11 } from "fs/promises";
-import { randomBytes as randomBytes7 } from "crypto";
+import { chmodSync, existsSync as existsSync12, renameSync, unlinkSync, writeFileSync } from "fs";
+import { mkdir as mkdir6, writeFile as writeFile6, readFile as readFile11, appendFile } from "fs/promises";
+import { randomBytes as randomBytes7, createHash as createHash3 } from "crypto";
+function hashLine(line) {
+  return createHash3("sha256").update(line, "utf8").digest("hex");
+}
 var lockfile, keytar, StorageManager;
 var init_Storage = __esm({
   "../core/src/Storage.ts"() {
@@ -6819,7 +6954,18 @@ var init_Storage = __esm({
       async ensureDirs() {
         try {
           await mkdir6(this.baseDir, { recursive: true });
-          const subdirs = ["history", "backups", "cache", "vault"];
+          const subdirs = [
+            "history",
+            "backups",
+            "cache",
+            // CLI-ARCH-CONTENT-HASH-VAULT-01: content-addressed vault layout
+            "vault",
+            "vault/objects",
+            "vault/refs",
+            // CLI-ARCH-RECIPE-AT-HASH-URI-01: recipe hash cache
+            "cache/recipes",
+            "cache/recipes/objects"
+          ];
           for (const sub of subdirs) {
             const path2 = join14(this.baseDir, sub);
             await mkdir6(path2, { recursive: true });
@@ -6895,6 +7041,230 @@ var init_Storage = __esm({
           console.warn(`Failed to delete token file: ${e}`);
         }
       }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-CONTENT-HASH-VAULT-01 — content-addressed vault helpers
+      //
+      // Every vault value is a content-addressed blob stored under
+      //   ~/.msapling/vault/objects/<sha256-hex>
+      // A human-readable ref file under
+      //   ~/.msapling/vault/refs/<label>
+      // holds the sha256-hex of the current value.
+      //
+      // Updating a value: write new object → atomically rewrite ref.
+      // Old objects are GC'd separately (retention window TBD — see roadmap).
+      // The keytar account name stores the sha256-hex so the plaintext label
+      // remains opaque on disk (label → hash is in keytar; hash → blob is on disk).
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Write a value into the content-addressed object store and atomically
+       * update the named ref. Returns the sha256 hex of the stored object.
+       *
+       * WAL-PATTERN: write to objects/<hash> (idempotent — same content = same
+       * path), then rename refs/<label>.tmp → refs/<label>.
+       */
+      async writeVaultRef(label, value) {
+        await this._ready;
+        const hash = createHash3("sha256").update(value, "utf8").digest("hex");
+        const objectPath = join14(this.baseDir, "vault", "objects", hash);
+        const refPath = join14(this.baseDir, "vault", "refs", label);
+        const refTmp = `${refPath}.tmp`;
+        await writeFile6(objectPath, value, "utf8");
+        if (process.platform !== "win32") {
+          chmodSync(objectPath, 384);
+        }
+        await writeFile6(refTmp, hash, "utf8");
+        renameSync(refTmp, refPath);
+        return hash;
+      }
+      /**
+       * Read a vault value by label. Returns null if the ref or its object is
+       * missing (bootstrap / first-run case).
+       */
+      async readVaultRef(label) {
+        await this._ready;
+        const refPath = join14(this.baseDir, "vault", "refs", label);
+        if (!existsSync12(refPath)) return null;
+        const hash = (await readFile11(refPath, "utf8")).trim();
+        const objectPath = join14(this.baseDir, "vault", "objects", hash);
+        if (!existsSync12(objectPath)) return null;
+        return readFile11(objectPath, "utf8");
+      }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-RECIPE-AT-HASH-URI-01 — recipe hash registry helpers
+      //
+      // On first load of a recipe file, its content is sha256-hashed and the
+      // mapping { name → hash } is stored in
+      //   ~/.msapling/cache/recipes/index.json
+      // The immutable blob is written to
+      //   ~/.msapling/cache/recipes/objects/<sha256>
+      //
+      // Invocations reference recipes as `recipe@<sha256>` URIs. The /recipe
+      // command resolves a bare name through the index and logs the hash for
+      // traceability.
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Register a recipe file in the local hash index. Idempotent — if the
+       * content hash already exists the call is a no-op (returns existing hash).
+       * Returns the sha256 hex for use in log messages / URI construction.
+       */
+      async registerRecipe(name, content) {
+        await this._ready;
+        const hash = createHash3("sha256").update(content, "utf8").digest("hex");
+        const objectPath = join14(this.baseDir, "cache", "recipes", "objects", hash);
+        const indexPath = join14(this.baseDir, "cache", "recipes", "index.json");
+        const indexTmp = `${indexPath}.tmp`;
+        if (!existsSync12(objectPath)) {
+          await writeFile6(objectPath, content, "utf8");
+        }
+        let index = {};
+        if (existsSync12(indexPath)) {
+          try {
+            index = JSON.parse(await readFile11(indexPath, "utf8"));
+          } catch {
+            index = {};
+          }
+        }
+        index[name] = hash;
+        await writeFile6(indexTmp, JSON.stringify(index, null, 2), "utf8");
+        renameSync(indexTmp, indexPath);
+        return hash;
+      }
+      /**
+       * Resolve a recipe name or `recipe@<hash>` URI to its cached content.
+       * Returns { hash, content } or null if not found in the local cache.
+       */
+      async resolveRecipe(nameOrRef) {
+        await this._ready;
+        const indexPath = join14(this.baseDir, "cache", "recipes", "index.json");
+        const atIdx = nameOrRef.indexOf("@");
+        if (atIdx !== -1) {
+          const hash2 = nameOrRef.slice(atIdx + 1);
+          const objectPath2 = join14(this.baseDir, "cache", "recipes", "objects", hash2);
+          if (!existsSync12(objectPath2)) return null;
+          return { hash: hash2, content: await readFile11(objectPath2, "utf8") };
+        }
+        if (!existsSync12(indexPath)) return null;
+        let index;
+        try {
+          index = JSON.parse(await readFile11(indexPath, "utf8"));
+        } catch {
+          return null;
+        }
+        const hash = index[nameOrRef];
+        if (!hash) return null;
+        const objectPath = join14(this.baseDir, "cache", "recipes", "objects", hash);
+        if (!existsSync12(objectPath)) return null;
+        return { hash, content: await readFile11(objectPath, "utf8") };
+      }
+      // ─────────────────────────────────────────────────────────────────────────
+      // CLI-ARCH-HASH-CHAIN-HISTORY-01 — append-only NDJSON history with hash chain
+      //
+      // Shell history is stored as an append-only NDJSON file
+      //   ~/.msapling/history/shell_history.jsonl
+      // Each entry carries a `prev_hash` field so tampering is detectable.
+      // `msapling --verify-history` re-hashes the chain and reports breaks.
+      // ─────────────────────────────────────────────────────────────────────────
+      /**
+       * Append a single command to the hash-chain history.
+       * Uses lockfile + in-process mutex as a critical section around:
+       *   1. Load last entry to compute prev_hash
+       *   2. Build + serialize new entry
+       *   3. Append to shell_history.jsonl
+       *
+       * WAL-PATTERN note: append-only log uses appendFile, not rename — the
+       * lockfile is the write-serialisation primitive here.
+       */
+      async appendHistoryEntry(content) {
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.jsonl");
+        return this.historyMutex.run(async () => {
+          let release2 = null;
+          try {
+            if (!existsSync12(path2)) {
+              await writeFile6(path2, "", "utf8");
+            }
+            release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+            let prevHash = null;
+            let seq = 1;
+            if (existsSync12(path2)) {
+              const raw = (await readFile11(path2, "utf8")).trimEnd();
+              if (raw.length > 0) {
+                const lines = raw.split("\n");
+                const lastLine = lines[lines.length - 1];
+                try {
+                  const last = JSON.parse(lastLine);
+                  seq = last.seq + 1;
+                  prevHash = hashLine(lastLine);
+                } catch {
+                }
+              }
+            }
+            const entry = {
+              seq,
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              content,
+              prev_hash: prevHash
+            };
+            const line = JSON.stringify(entry);
+            await appendFile(path2, line + "\n", "utf8");
+            return entry;
+          } finally {
+            if (release2) {
+              try {
+                await lockfile.unlock(path2, { skipStale: true });
+              } catch {
+              }
+            }
+          }
+        });
+      }
+      /**
+       * Load all history entries from shell_history.jsonl.
+       * Skips malformed lines (logs a warning for each).
+       *
+       * // TODO: implement tail-read for large history files to avoid loading entire file into memory
+       */
+      async loadHistoryEntries() {
+        await this._ready;
+        const path2 = join14(this.baseDir, "history", "shell_history.jsonl");
+        if (!existsSync12(path2)) return [];
+        const raw = await readFile11(path2, "utf8");
+        const entries = [];
+        for (const line of raw.split("\n")) {
+          if (!line.trim()) continue;
+          try {
+            entries.push(JSON.parse(line));
+          } catch {
+            console.warn(`[history] Skipped malformed NDJSON line: ${line.slice(0, 80)}`);
+          }
+        }
+        return entries;
+      }
+      /**
+       * Verify the hash chain of shell_history.jsonl.
+       * Returns { ok: true } if intact, or { ok: false, breaks: [...] } listing
+       * each break as { seq, expected, actual }.
+       *
+       * Used by `msapling --verify-history`.
+       */
+      async verifyHistory() {
+        const entries = await this.loadHistoryEntries();
+        const breaks = [];
+        let prevLine = null;
+        for (const entry of entries) {
+          if (prevLine !== null) {
+            const expected = hashLine(prevLine);
+            const actual = entry.prev_hash ?? "";
+            if (expected !== actual) {
+              breaks.push({ seq: entry.seq, expected, actual });
+            }
+          } else if (entry.prev_hash !== null) {
+            breaks.push({ seq: entry.seq, expected: "null", actual: entry.prev_hash });
+          }
+          prevLine = JSON.stringify(entry);
+        }
+        return breaks.length === 0 ? { ok: true } : { ok: false, breaks };
+      }
       /**
        * SYNC-01: Serialised history write with file-based locking.
        * Uses proper-lockfile to coordinate writes across multiple terminal instances
@@ -6905,10 +7275,12 @@ var init_Storage = __esm({
        * 2. Partial writes don't corrupt the JSON (atomic rename)
        */
       async saveHistory(history) {
+        await this._ready;
         const path2 = join14(this.baseDir, "history", "shell_history.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          if (!existsSync12(path2)) writeFileSync(path2, "[]", "utf8");
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           await this.historyMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(history, null, 2);
@@ -6940,16 +7312,38 @@ var init_Storage = __esm({
        * SYNC-01: Serialised history read with file-based locking.
        * Reads are gated behind the file lock so a read that overlaps with an
        * in-progress write from another process always sees a complete, valid JSON.
+       *
+       * // TODO: implement tail-read for large history files to avoid loading entire file into memory
        */
       async loadHistory() {
+        await this._ready;
         const path2 = join14(this.baseDir, "history", "shell_history.json");
+        if (!existsSync12(path2)) return [];
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           return this.historyMutex.run(async () => {
             if (existsSync12(path2)) {
               const text = await readFile11(path2, "utf8");
-              return JSON.parse(text);
+              try {
+                return JSON.parse(text);
+              } catch (parseErr) {
+                const filename = path2.split("/").pop() || "shell_history.json";
+                const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+                const suffix = randomBytes7(4).toString("hex");
+                const corruptBackupPath = join14(
+                  this.baseDir,
+                  "history",
+                  `${filename}.corrupt.${stamp}-${suffix}.bak`
+                );
+                try {
+                  renameSync(path2, corruptBackupPath);
+                  console.warn(`History file was corrupt; backed up to ${corruptBackupPath}`);
+                } catch (backupErr) {
+                  console.error(`Failed to backup corrupt history file: ${backupErr}`);
+                }
+                return [];
+              }
             }
             return [];
           });
@@ -6965,12 +7359,14 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions write with file-based locking.
+       * R20-CLI-2: Typed with PermissionState from Sandbox.ts.
        */
       async savePermissions(permissions) {
         const path2 = join14(this.baseDir, "vault", "permissions.json");
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          if (!existsSync12(path2)) writeFileSync(path2, "{}", "utf8");
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           await this.permissionsMutex.run(async () => {
             const tmpPath = `${path2}.tmp`;
             const content = JSON.stringify(permissions, null, 2);
@@ -7000,16 +7396,36 @@ var init_Storage = __esm({
       }
       /**
        * SYNC-01: Serialised permissions read with file-based locking.
+       * R20-CLI-2: Typed with PermissionState from Sandbox.ts.
        */
       async loadPermissions() {
         const path2 = join14(this.baseDir, "vault", "permissions.json");
+        if (!existsSync12(path2)) return { trustedCommands: [], trustedPaths: [] };
         let release2;
         try {
-          release2 = await lockfile.lock(path2, { retries: 5, retryWait: 50 });
+          release2 = await lockfile.lock(path2, { realpath: false, retries: 5, retryWait: 50 });
           return this.permissionsMutex.run(async () => {
             if (existsSync12(path2)) {
               const text = await readFile11(path2, "utf8");
-              return JSON.parse(text);
+              try {
+                return JSON.parse(text);
+              } catch (parseErr) {
+                const filename = path2.split("/").pop() || "permissions.json";
+                const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+                const suffix = randomBytes7(4).toString("hex");
+                const corruptBackupPath = join14(
+                  this.baseDir,
+                  "vault",
+                  `${filename}.corrupt.${stamp}-${suffix}.bak`
+                );
+                try {
+                  renameSync(path2, corruptBackupPath);
+                  console.warn(`Permissions file was corrupt; backed up to ${corruptBackupPath}`);
+                } catch (backupErr) {
+                  console.error(`Failed to backup corrupt permissions file: ${backupErr}`);
+                }
+                return { trustedCommands: [], trustedPaths: [] };
+              }
             }
             return { trustedCommands: [], trustedPaths: [] };
           });
@@ -7051,6 +7467,7 @@ import { join as join15 } from "path";
 import { existsSync as existsSync13 } from "fs";
 import * as fs from "fs";
 import { readFile as readFile12 } from "fs/promises";
+import { randomBytes as randomBytes8 } from "crypto";
 function ensureConfigDir(p) {
   try {
     fs.mkdirSync(p, { recursive: true, mode: 448 });
@@ -7058,7 +7475,9 @@ function ensureConfigDir(p) {
     if (e.code === "EEXIST" || e.code === "ENOTDIR") {
       const stat5 = fs.statSync(p);
       if (!stat5.isDirectory()) {
-        fs.renameSync(p, `${p}.broken-${Date.now()}`);
+        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const suffix = randomBytes8(4).toString("hex");
+        fs.renameSync(p, `${p}.broken-${stamp}-${suffix}`);
         fs.mkdirSync(p, { recursive: true, mode: 448 });
       }
     } else {
@@ -7508,26 +7927,31 @@ function isEmailAddress(str) {
 function isTokenLike(str) {
   return str.length >= 20 && /^[A-Za-z0-9_\-\.]+$/.test(str);
 }
+function setRawModeGuarded(stdin, mode) {
+  try {
+    if (typeof stdin.setRawMode === "function") {
+      stdin.setRawMode(mode);
+    }
+  } catch (e) {
+  }
+}
 async function promptPassword(prompt) {
   return new Promise((resolve18) => {
     const stdin = process.stdin;
     const stdout = process.stdout;
     stdout.write(prompt);
-    const wasRaw = stdin.isRaw;
-    try {
-      stdin.setRawMode(true);
-    } catch (e) {
-    }
+    const wasRaw = stdin.isRaw ?? false;
+    setRawModeGuarded(stdin, true);
     let password = "";
     const onData = (chunk) => {
       const char = chunk.toString();
       if (char === "\n" || char === "\r") {
-        stdin.setRawMode(wasRaw);
+        setRawModeGuarded(stdin, wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
         resolve18(password);
       } else if (char === "") {
-        stdin.setRawMode(wasRaw);
+        setRawModeGuarded(stdin, wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
         resolve18("");
@@ -7545,11 +7969,8 @@ async function promptTotp(prompt) {
     const stdin = process.stdin;
     const stdout = process.stdout;
     stdout.write(prompt);
-    const wasRaw = stdin.isRaw;
-    try {
-      stdin.setRawMode(true);
-    } catch (e) {
-    }
+    const wasRaw = stdin.isRaw ?? false;
+    setRawModeGuarded(stdin, true);
     let code = "";
     const onData = (chunk) => {
       const char = chunk.toString();
@@ -7559,7 +7980,7 @@ async function promptTotp(prompt) {
         stdout.write("\n");
         resolve18(code);
       } else if (char === "") {
-        stdin.setRawMode(wasRaw);
+        setRawModeGuarded(stdin, wasRaw);
         stdin.removeListener("data", onData);
         stdout.write("\n");
         resolve18("");
@@ -7647,7 +8068,7 @@ async function loginWithGithubDevice(context) {
     `Open ${verification_uri} in your browser and enter code: ${user_code}
 (Waiting for authorization \u2014 expires in ${expires_in}s)`
   );
-  const pollMs = (interval + 1) * 1e3;
+  let pollMs = (interval + 1) * 1e3;
   const deadline = Date.now() + expires_in * 1e3;
   let githubToken = null;
   while (Date.now() < deadline) {
@@ -7674,6 +8095,7 @@ async function loginWithGithubDevice(context) {
     }
     if (tokenData.error === "authorization_pending") continue;
     if (tokenData.error === "slow_down") {
+      pollMs += 5e3;
       await new Promise((resolve18) => setTimeout(resolve18, 5e3));
       continue;
     }
@@ -7714,7 +8136,7 @@ var init_login = __esm({
     init_esm_shims();
     GITHUB_CLIENT_ID = "Ov23liOA9yKFLUEEVY3G";
     GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-    GITHUB_TOKEN_URL = "https://github.com/oauth/access_token";
+    GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
     loginCommand = {
       name: "login",
       args: "[email|github|token]",
@@ -8547,6 +8969,7 @@ var init_recipe = __esm({
   "src/commands/recipe.ts"() {
     "use strict";
     init_esm_shims();
+    init_src3();
     RECIPE_DIRS = [".msapling/recipes", ".claude/recipes", ".gemini/recipes"];
     NAME_SUFFIXES = ["", "-workflow"];
     FILE_EXTS = [".yaml", ".yml"];
@@ -8580,14 +9003,21 @@ var init_recipe = __esm({
           context.addMessage("system", `Usage: /recipe ${name} <prompt>  (the prompt fills $SELECTION / $PROMPT in step templates)`);
           return;
         }
+        let text;
         let recipe;
         try {
-          const text = await readFile16(path2, "utf8");
+          text = await readFile16(path2, "utf8");
           recipe = parseYaml(text);
         } catch (e) {
           context.addMessage("error", `Failed to load ${path2}: ${e.message}`);
           return;
         }
+        try {
+          const storage = new StorageManager();
+          const hash = await storage.registerRecipe(name, text);
+          context.addMessage("system", `[recipe] Resolved ${name} \u2192 recipe@${hash.slice(0, 12)}\u2026`);
+        } catch {
+        }
         const steps = recipe.steps ?? [];
         if (steps.length === 0) {
           context.addMessage("system", `Recipe '${name}' has no steps.`);
@@ -9721,6 +10151,207 @@ var init_todo = __esm({
   }
 });
 
+// src/commands/outputStyle.ts
+import { homedir as homedir15 } from "os";
+import { join as join27, basename, extname as extname3 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+function stylesDir() {
+  return join27(homedir15(), ".msapling", "output-styles");
+}
+function activeFile() {
+  return join27(stylesDir(), ".active");
+}
+function parseStyleFile(text) {
+  const fm = text.match(/^---\s*\n([\s\S]*?)\n---\s*\n?/);
+  if (!fm) {
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const desc = line.replace(/^#\s+/, "").trim();
+      return { description: desc || "(user style)", body: text.trim() };
+    }
+    return { description: "(user style)", body: text.trim() };
+  }
+  const meta = fm[1];
+  const body = text.slice(fm[0].length).trim();
+  const descMatch = meta.match(/^description:\s*(.+)$/m);
+  const description = descMatch ? descMatch[1].trim().replace(/^['"]|['"]$/g, "") : "(user style)";
+  return { description, body };
+}
+function listUserStyles() {
+  const dir = stylesDir();
+  if (!existsSync24(dir)) return [];
+  const out = [];
+  for (const entry of readdirSync3(dir)) {
+    if (extname3(entry).toLowerCase() !== ".md") continue;
+    const full = join27(dir, entry);
+    try {
+      const text = readFileSync(full, "utf8");
+      const { description, body } = parseStyleFile(text);
+      out.push({
+        name: basename(entry, ".md"),
+        description,
+        body,
+        source: "user",
+        path: full
+      });
+    } catch {
+    }
+  }
+  return out;
+}
+function listStyles() {
+  const user = listUserStyles();
+  const userNames = new Set(user.map((s) => s.name));
+  const builtins = BUILTIN_STYLES.filter((s) => !userNames.has(s.name));
+  return [...builtins, ...user];
+}
+function findStyle(name) {
+  return listStyles().find((s) => s.name === name) ?? null;
+}
+function getActiveStyleName() {
+  try {
+    const f = activeFile();
+    if (!existsSync24(f)) return "default";
+    return readFileSync(f, "utf8").trim() || "default";
+  } catch {
+    return "default";
+  }
+}
+function setActiveStyleName(name) {
+  const dir = stylesDir();
+  if (!existsSync24(dir)) mkdirSync5(dir, { recursive: true });
+  writeFileSync2(activeFile(), `${name}
+`, "utf8");
+}
+function getActiveStyle() {
+  const name = getActiveStyleName();
+  return findStyle(name) ?? BUILTIN_STYLES[0];
+}
+function createUserStyle(name, description, body) {
+  if (!/^[a-z0-9][a-z0-9_-]*$/i.test(name)) {
+    throw new Error(`Invalid style name "${name}" \u2014 use letters, digits, _ and - only.`);
+  }
+  const dir = stylesDir();
+  if (!existsSync24(dir)) mkdirSync5(dir, { recursive: true });
+  const target = join27(dir, `${name}.md`);
+  const frontmatter = `---
+description: ${description.replace(/\n/g, " ")}
+---
+
+`;
+  writeFileSync2(target, frontmatter + body.trim() + "\n", "utf8");
+  return target;
+}
+var BUILTIN_STYLES, outputStyleCommand;
+var init_outputStyle = __esm({
+  "src/commands/outputStyle.ts"() {
+    "use strict";
+    init_esm_shims();
+    BUILTIN_STYLES = [
+      {
+        name: "default",
+        description: "Default MSapling behavior \u2014 no extra system prefix.",
+        body: "",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "concise",
+        description: "Terse, code-first answers; minimal prose.",
+        body: "You are MSapling in concise mode. Keep every response as short as possible.\nPrefer code blocks, bullet lists, and direct answers. Skip preamble, recap,\nand offers to elaborate unless explicitly asked.",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "explanatory",
+        description: "Walk through reasoning and trade-offs before the answer.",
+        body: "You are MSapling in explanatory mode. Briefly walk through your reasoning,\npoint out trade-offs, and cite the relevant file or doc before giving the\nfinal answer. Aim for 2\u20133 short paragraphs, then a clear conclusion.",
+        source: "builtin",
+        path: null
+      },
+      {
+        name: "learning",
+        description: "Teach-by-doing: explain concepts, ask checkpoint questions.",
+        body: "You are MSapling in learning mode. Assume the user is new to the topic.\nExplain key concepts in plain language, surface common pitfalls, and end\nwith a one-sentence comprehension check the user can answer or skip.",
+        source: "builtin",
+        path: null
+      }
+    ];
+    outputStyleCommand = {
+      name: "output-style",
+      aliases: ["style"],
+      args: "[list|use <name>|new <name> <description>]",
+      description: "List, switch, or create assistant output styles",
+      category: "model",
+      handler: (args2, context) => {
+        const sub = (args2[0] ?? "list").toLowerCase();
+        if (sub === "list" || sub === "ls") {
+          const styles = listStyles();
+          const active = getActiveStyleName();
+          context.addMessage("system", "Output Styles:");
+          for (const s of styles) {
+            const marker = s.name === active ? "*" : " ";
+            const tag = s.source === "builtin" ? "[builtin]" : "[user]";
+            context.addMessage("system", `  ${marker} ${s.name.padEnd(14)} ${tag} ${s.description}`);
+          }
+          context.addMessage("system", `Active: ${active}`);
+          return;
+        }
+        if (sub === "use") {
+          const name = args2[1];
+          if (!name) {
+            context.addMessage("error", "Usage: /output-style use <name>");
+            return;
+          }
+          const style = findStyle(name);
+          if (!style) {
+            context.addMessage("error", `Unknown style: ${name}. Try /output-style list.`);
+            return;
+          }
+          setActiveStyleName(name);
+          context.addMessage("system", `Active output style: ${name} \u2014 ${style.description}`);
+          return;
+        }
+        if (sub === "new" || sub === "create") {
+          const name = args2[1];
+          const description = args2.slice(2).join(" ");
+          if (!name) {
+            context.addMessage("error", "Usage: /output-style new <name> <description>");
+            return;
+          }
+          try {
+            const path2 = createUserStyle(name, description || `User style: ${name}`, "");
+            context.addMessage(
+              "system",
+              `Created ${path2} \u2014 edit the file to define the system prompt body, then /output-style use ${name}`
+            );
+          } catch (e) {
+            context.addMessage("error", e.message ?? String(e));
+          }
+          return;
+        }
+        if (sub === "show") {
+          const style = getActiveStyle();
+          context.addMessage("system", `Active style: ${style.name} (${style.source})`);
+          context.addMessage("system", `Description: ${style.description}`);
+          if (style.body) {
+            context.addMessage("system", "\u2500\u2500\u2500 body \u2500\u2500\u2500");
+            context.addMessage("system", style.body);
+          } else {
+            context.addMessage("system", "(no system-prompt body \u2014 default behavior)");
+          }
+          return;
+        }
+        context.addMessage(
+          "error",
+          `Unknown subcommand: ${sub}. Try /output-style list|use|new|show`
+        );
+      }
+    };
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -9767,6 +10398,7 @@ var init_commands = __esm({
     init_plan();
     init_note();
     init_todo();
+    init_outputStyle();
     commands = [
       loginCommand,
       unlockCommand,
@@ -9798,7 +10430,52 @@ var init_commands = __esm({
       shortcutsCommand,
       planCommand,
       noteCommand,
-      todoCommand
+      todoCommand,
+      outputStyleCommand
+    ];
+  }
+});
+
+// src/runtime/doctorRedact.ts
+function redactSecrets(text) {
+  let out = text;
+  for (const [re, replacement] of PATTERNS) {
+    out = out.replace(re, replacement);
+  }
+  return out;
+}
+var PATTERNS;
+var init_doctorRedact = __esm({
+  "src/runtime/doctorRedact.ts"() {
+    "use strict";
+    init_esm_shims();
+    PATTERNS = [
+      // Legacy key=value pairs (from original doctor.ts redactSecrets).
+      [/token[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "token=***"],
+      [/password[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "password=***"],
+      [/api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "api_key=***"],
+      [/secret[=:]\s*['"]?[a-zA-Z0-9_.-]+['"]?/gi, "secret=***"],
+      [/MSAPLING_TOKEN=.*/gi, "MSAPLING_TOKEN=***"],
+      [/MSAPLING_API_KEY=.*/gi, "MSAPLING_API_KEY=***"],
+      // Bearer tokens (case-insensitive).
+      [/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer ***"],
+      // GitHub PATs — keep the prefix so the credential class is identifiable.
+      [/\bghp_[A-Za-z0-9]{20,}/g, "ghp_***"],
+      [/\bghs_[A-Za-z0-9]{20,}/g, "ghs_***"],
+      [/\bgho_[A-Za-z0-9]{20,}/g, "gho_***"],
+      [/\bghu_[A-Za-z0-9]{20,}/g, "ghu_***"],
+      [/\bghr_[A-Za-z0-9]{20,}/g, "ghr_***"],
+      [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "github_pat_***"],
+      // AWS access key IDs.
+      [/\bAKIA[0-9A-Z]{16}\b/g, "AKIA***"],
+      [/\bASIA[0-9A-Z]{16}\b/g, "ASIA***"],
+      // Slack tokens (xoxa/xoxb/xoxp/xoxr/xoxs/xoxe-...).
+      [/\bxox[abpres]-[A-Za-z0-9-]{10,}/gi, "xox-***"],
+      // Anthropic + OpenAI style. Anthropic first to preserve "sk-ant-" prefix.
+      [/\bsk-ant-[A-Za-z0-9_-]{20,}/g, "sk-ant-***"],
+      [/\bsk-[A-Za-z0-9_-]{20,}/g, "sk-***"],
+      // JWT-ish payload: three base64url segments separated by dots, header starts eyJ.
+      [/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g, "***jwt***"]
     ];
   }
 });
@@ -9808,15 +10485,12 @@ var doctor_exports = {};
 __export(doctor_exports, {
   runDoctor: () => runDoctor
 });
-import { homedir as homedir15, platform as platform2 } from "os";
-import { join as join27 } from "path";
-import { existsSync as existsSync25, statSync as statSync6, accessSync } from "fs";
+import { homedir as homedir16, platform as platform3 } from "os";
+import { join as join28 } from "path";
+import { existsSync as existsSync26, statSync as statSync6, accessSync } from "fs";
 import { readdir as readdir3 } from "fs/promises";
 import { exec } from "child_process";
 import { promisify } from "util";
-function redactSecrets(text) {
-  return text.replace(/token[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "token=***").replace(/password[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "password=***").replace(/api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "api_key=***").replace(/secret[=:]\s*['"]?[a-zA-Z0-9_-]+['"]?/gi, "secret=***").replace(/MSAPLING_TOKEN=.*/gi, "MSAPLING_TOKEN=***").replace(/MSAPLING_API_KEY=.*/gi, "MSAPLING_API_KEY=***");
-}
 async function checkNodeVersion() {
   const version = process.version;
   const match = version.match(/v(\d+)/);
@@ -9836,8 +10510,8 @@ async function checkNodeVersion() {
   };
 }
 async function checkConfigDir() {
-  const configDir = join27(homedir15(), ".msapling");
-  if (!existsSync25(configDir)) {
+  const configDir = join28(homedir16(), ".msapling");
+  if (!existsSync26(configDir)) {
     return {
       name: "Config directory",
       status: "WARN",
@@ -9854,7 +10528,7 @@ async function checkConfigDir() {
       remediation: `rm "${configDir}" && mkdir -p "${configDir}"`
     };
   }
-  if (platform2() !== "win32") {
+  if (platform3() !== "win32") {
     const mode = stats.mode & 511;
     const safe = (mode & 63) === 0;
     if (!safe) {
@@ -9900,15 +10574,15 @@ async function checkKeytar() {
 }
 async function checkPathConflicts() {
   const pathEnv = process.env.PATH || "";
-  const paths = pathEnv.split(platform2() === "win32" ? ";" : ":");
+  const paths = pathEnv.split(platform3() === "win32" ? ";" : ":");
   const conflicts = [];
   for (const dir of paths) {
-    if (!dir || !existsSync25(dir)) continue;
+    if (!dir || !existsSync26(dir)) continue;
     try {
       const files = await readdir3(dir);
       for (const file of files) {
         if (file === "msapling" || file === "msapling.exe" || file === "msapling.py") {
-          const fullPath = join27(dir, file);
+          const fullPath = join28(dir, file);
           conflicts.push(fullPath);
         }
       }
@@ -10008,11 +10682,11 @@ async function checkTokenValidity() {
   }
 }
 async function checkOsSpecific() {
-  if (platform2() === "win32") {
+  if (platform3() === "win32") {
     try {
-      const configDir = join27(homedir15(), ".msapling");
+      const configDir = join28(homedir16(), ".msapling");
       const longPath = "A".repeat(260);
-      const testPath = join27(configDir, longPath);
+      const testPath = join28(configDir, longPath);
       try {
         accessSync(configDir);
       } catch {
@@ -10037,14 +10711,14 @@ async function checkOsSpecific() {
       };
     }
   }
-  if (platform2() === "darwin") {
+  if (platform3() === "darwin") {
     return {
       name: "OS-specific (macOS)",
       status: "PASS",
       message: "macOS detected"
     };
   }
-  if (platform2() === "linux") {
+  if (platform3() === "linux") {
     try {
       await import("keytar");
       return {
@@ -10064,7 +10738,7 @@ async function checkOsSpecific() {
   return {
     name: "OS-specific",
     status: "PASS",
-    message: `${platform2()} detected`
+    message: `${platform3()} detected`
   };
 }
 function formatCheckResult(result, maxLabelWidth) {
@@ -10128,14 +10802,22 @@ async function runDoctor(debug = false) {
     output.push(...dumpEnv(true));
     output.push("");
   }
-  console.log(output.join("\n"));
-  process.exit(failCount > 0 ? 1 : 0);
+  const rendered = output.join("\n");
+  console.log(rendered);
+  return {
+    exitCode: failCount > 0 ? 1 : 0,
+    checks,
+    failCount,
+    warnCount,
+    rendered
+  };
 }
 var execAsync;
 var init_doctor2 = __esm({
   "src/runtime/doctor.ts"() {
     "use strict";
     init_esm_shims();
+    init_doctorRedact();
     execAsync = promisify(exec);
   }
 });
@@ -11286,7 +11968,7 @@ async function mergeToolRegistries(localTools, client) {
       return Array.from(merged.values());
     }
     for (const backendTool of registry.tools) {
-      const tier = backendTool.tier_required === "free" || backendTool.tier_required === "pro" ? backendTool.tier_required : "free";
+      const tier = backendTool.tier_required === "free" || backendTool.tier_required === "pro" || backendTool.tier_required === "lifetime" || backendTool.tier_required === "enterprise" ? backendTool.tier_required : "enterprise";
       if (!merged.has(backendTool.name)) {
         merged.set(backendTool.name, {
           name: backendTool.name,
@@ -11665,8 +12347,8 @@ __export(server_exports, {
   runStdio: () => runStdio,
   runStdioWithRegistry: () => runStdioWithRegistry
 });
-import { readdirSync as readdirSync3, readFileSync, statSync as statSync7 } from "fs";
-import { join as join28, relative as relative14, resolve as resolve17 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync2, statSync as statSync7 } from "fs";
+import { join as join29, relative as relative14, resolve as resolve17 } from "path";
 function asResult2(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -11679,14 +12361,14 @@ function buildFileTree(root, maxFiles) {
     const dir = queue.shift();
     let entries;
     try {
-      entries = readdirSync3(dir);
+      entries = readdirSync4(dir);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (out.length >= maxFiles) break;
       if (SKIP_DIRS2.has(name)) continue;
-      const full = join28(dir, name);
+      const full = join29(dir, name);
       let s;
       try {
         s = statSync7(full);
@@ -11710,7 +12392,7 @@ function readFilesAsContext(root, files, maxKB) {
   for (const f of files) {
     let body;
     try {
-      body = readFileSync(f, "utf8");
+      body = readFileSync2(f, "utf8");
     } catch {
       continue;
     }
@@ -11724,11 +12406,37 @@ ${body}
   }
   return parts.join("\n\n");
 }
+function installDrainHandlers(server) {
+  const abort = new AbortController();
+  let drainStarted = false;
+  const onSignal = (sig) => {
+    if (drainStarted) return;
+    drainStarted = true;
+    process.stderr.write(`[mcp-server] received ${sig}, starting graceful drain
+`);
+    server.drain().then((forcedResponses) => {
+      for (const resp of forcedResponses) {
+        try {
+          process.stdout.write(JSON.stringify(resp) + "\n");
+        } catch {
+        }
+      }
+      process.stderr.write("[mcp-server] drain complete, exiting\n");
+      abort.abort();
+      process.exit(0);
+    });
+  };
+  process.on("SIGTERM", () => onSignal("SIGTERM"));
+  process.on("SIGINT", () => onSignal("SIGINT"));
+  return abort;
+}
 async function runStdio(client) {
   const server = new MCPServer(client);
+  const abort = installDrainHandlers(server);
   let buffer = "";
   const decoder = new TextDecoder();
   for await (const chunk of process.stdin) {
+    if (abort.signal.aborted) break;
     buffer += decoder.decode(chunk, { stream: true });
     let idx;
     while ((idx = buffer.indexOf("\n")) !== -1) {
@@ -11748,9 +12456,11 @@ async function runStdio(client) {
 }
 async function runStdioWithRegistry(client, registryClient) {
   const server = new MCPServer(client, registryClient || client);
+  const abort = installDrainHandlers(server);
   let buffer = "";
   const decoder = new TextDecoder();
   for await (const chunk of process.stdin) {
+    if (abort.signal.aborted) break;
     buffer += decoder.decode(chunk, { stream: true });
     let idx;
     while ((idx = buffer.indexOf("\n")) !== -1) {
@@ -11768,7 +12478,7 @@ async function runStdioWithRegistry(client, registryClient) {
     }
   }
 }
-var TOOLS, PROTOCOL_VERSION2, PRO_TIERS2, TIER_CACHE_TTL_MS, SAFE_PATH_RE, MCPServer;
+var AP4_MAX_BLOB_BYTES, TOOLS, PROTOCOL_VERSION2, PRO_TIERS2, TIER_CACHE_TTL_MS, DRAIN_TIMEOUT_MS, SAFE_PATH_RE, MCPServer;
 var init_server = __esm({
   "../core/src/mcp/server.ts"() {
     "use strict";
@@ -11777,6 +12487,7 @@ var init_server = __esm({
     init_libesm();
     init_registry_merger();
     init_local_tools();
+    AP4_MAX_BLOB_BYTES = 4 * 1024;
     TOOLS = [
       {
         name: "msapling_chat",
@@ -11895,11 +12606,57 @@ var init_server = __esm({
         tier: "free",
         inputSchema: { type: "object", properties: {} }
       },
+      {
+        name: "msapling_list_wakeups",
+        description: "[Pro] List pending AI wake-ups/scheduled tasks for your account.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          properties: {
+            status: { type: "string", enum: ["pending", "fired", "cancelled", "expired"], description: "Filter by status" },
+            session_id: { type: "string", description: "Filter by chat session ID" }
+          }
+        }
+      },
+      {
+        name: "msapling_schedule_wakeup",
+        description: "[Pro] Schedule a future AI task or follow-up wakeup.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          required: ["delay_seconds", "reason"],
+          properties: {
+            delay_seconds: { type: "number", description: "Delay in seconds from now" },
+            reason: { type: "string", description: "Short description of what the AI should do" },
+            prompt: { type: "string", description: "Specific prompt to process when the wakeup fires" },
+            session_id: { type: "string", description: "Associate with an existing chat session" }
+          }
+        }
+      },
+      {
+        name: "msapling_cancel_wakeup",
+        description: "[Pro] Cancel a pending AI wakeup.",
+        tier: "pro",
+        inputSchema: {
+          type: "object",
+          required: ["id"],
+          properties: {
+            id: { type: "string", description: "The wakeup UUID to cancel" }
+          }
+        }
+      },
+      {
+        name: "msapling_fleet_status",
+        description: "[Pro] View status of your remote agent fleet and active tasks.",
+        tier: "pro",
+        inputSchema: { type: "object", properties: {} }
+      },
       ...LOCAL_TOOLS
     ];
     PROTOCOL_VERSION2 = "2024-11-05";
     PRO_TIERS2 = /* @__PURE__ */ new Set(["pro", "monthly", "lifetime", "enterprise", "admin", "superadmin"]);
     TIER_CACHE_TTL_MS = 6e4;
+    DRAIN_TIMEOUT_MS = 5e3;
     SAFE_PATH_RE = /^[A-Za-z0-9_./\-\\: ]+$/;
     MCPServer = class {
       constructor(client, backendClient) {
@@ -11910,6 +12667,83 @@ var init_server = __esm({
       backendClient;
       tierCache = null;
       registryCache = null;
+      /**
+       * CLIENT-CLI-16: When true, the server is shutting down. New tool calls
+       * are rejected with a JSON-RPC error; only in-flight calls are allowed
+       * to finish.
+       */
+      _isDraining = false;
+      /**
+       * CLIENT-CLI-16: Set of in-flight tool call IDs. Used during draining to
+       * wait for completion before closing the transport. Capped at
+       * MAX_INFLIGHT_TOOLS.
+       */
+      _inflightCalls = /* @__PURE__ */ new Map();
+      /**
+       * CLIENT-CLI-16: Resolved when all in-flight calls complete during drain,
+       * or when the drain timeout fires.
+       */
+      _drainResolve = null;
+      /** CLIENT-CLI-16: Whether the server is currently draining. */
+      get isDraining() {
+        return this._isDraining;
+      }
+      /**
+       * CLIENT-CLI-16: Enter draining mode. Returns a promise that resolves when
+       * all in-flight calls complete or DRAIN_TIMEOUT_MS elapses, whichever
+       * comes first.
+       *
+       * After the promise resolves, any remaining in-flight calls have been
+       * forcefully closed with error responses (written to stdout by the caller).
+       */
+      async drain() {
+        this._isDraining = true;
+        const inflight = this._inflightCalls.size;
+        process.stderr.write(
+          `[mcp-server] draining: ${inflight} in-flight tool call(s)
+`
+        );
+        if (inflight === 0) {
+          return [];
+        }
+        const forcedResponses = await new Promise((resolve18) => {
+          this._drainResolve = () => resolve18([]);
+          setTimeout(() => {
+            this._drainResolve = null;
+            const remaining = Array.from(this._inflightCalls.values());
+            if (remaining.length === 0) {
+              resolve18([]);
+              return;
+            }
+            process.stderr.write(
+              `[mcp-server] drain timeout: force-closing ${remaining.length} call(s)
+`
+            );
+            const errorResponses = remaining.map((call) => ({
+              jsonrpc: "2.0",
+              id: call.id,
+              error: {
+                code: -32e3,
+                message: `Server shutdown: tool call "${call.name}" timed out after ${DRAIN_TIMEOUT_MS}ms`
+              }
+            }));
+            this._inflightCalls.clear();
+            resolve18(errorResponses);
+          }, DRAIN_TIMEOUT_MS);
+        });
+        return forcedResponses;
+      }
+      /**
+       * CLIENT-CLI-16: Called when an in-flight tool call completes during drain.
+       * If all calls are done, resolves the drain promise.
+       */
+      _completeInflight(id) {
+        this._inflightCalls.delete(id);
+        if (this._isDraining && this._inflightCalls.size === 0 && this._drainResolve) {
+          this._drainResolve();
+          this._drainResolve = null;
+        }
+      }
       /**
        * Fetch the caller's tier (Pro vs free) and cache it briefly. We avoid a
        * `me()` call per `tools/list` because Claude Code calls tools/list often
@@ -11941,6 +12775,25 @@ var init_server = __esm({
       invalidateTierCache() {
         this.tierCache = null;
       }
+      /**
+       * CLI-R12-20260507-TIER-02: Map tier name to numeric level for comparison.
+       * Higher level = more restrictive/expensive.
+       * free (1) < pro (5) < lifetime (10) < enterprise (100)
+       */
+      tierLevel(tier) {
+        switch (String(tier).toLowerCase()) {
+          case "free":
+            return 1;
+          case "pro":
+            return 5;
+          case "lifetime":
+            return 10;
+          case "enterprise":
+            return 100;
+          default:
+            return 100;
+        }
+      }
       /**
        * Fetch and cache the merged tool registry (local + backend).
        * Called on first tools/list request. Cached for session lifetime.
@@ -11978,30 +12831,62 @@ var init_server = __esm({
               return { jsonrpc: "2.0", id, result: { tools: wireFormat } };
             }
             case "tools/call": {
+              if (this._isDraining) {
+                return {
+                  jsonrpc: "2.0",
+                  id,
+                  error: {
+                    code: -32e3,
+                    message: "Server shutting down: not accepting new tool calls"
+                  }
+                };
+              }
               const name = req.params?.name;
               const args2 = req.params?.arguments ?? {};
-              const localTool = TOOLS.find((t) => t.name === name);
-              if (localTool) {
-                try {
-                  const result = await this.callTool(name, args2);
-                  return { jsonrpc: "2.0", id, result };
-                } catch (e) {
-                  const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
-                  return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+              this._inflightCalls.set(id, {
+                id,
+                name: name ?? "unknown",
+                startedAt: Date.now(),
+                resolve: () => {
                 }
-              }
-              const merged = await this.getMergedRegistry();
-              const backendTool = merged.find((t) => t.name === name && t.runs_on === "backend");
-              if (backendTool) {
-                try {
-                  const result = await this.invokeBackendTool(name, args2);
-                  return { jsonrpc: "2.0", id, result };
-                } catch (e) {
-                  const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
-                  return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+              });
+              try {
+                const localTool = TOOLS.find((t) => t.name === name);
+                if (localTool) {
+                  try {
+                    const result = await this.callTool(name, args2);
+                    const resp = { jsonrpc: "2.0", id, result };
+                    return resp;
+                  } catch (e) {
+                    const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
+                    return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+                  }
+                }
+                const merged = await this.getMergedRegistry();
+                const backendTool = merged.find((t) => t.name === name && t.runs_on === "backend");
+                if (backendTool) {
+                  const isPro = await this.getIsProCached();
+                  const toolTierLevel = this.tierLevel(backendTool.tier);
+                  const userTierLevel = isPro ? 5 : 1;
+                  if (toolTierLevel > userTierLevel) {
+                    return {
+                      jsonrpc: "2.0",
+                      id,
+                      result: asResult2(`Access denied: tool "${name}" requires ${backendTool.tier} tier`, true)
+                    };
+                  }
+                  try {
+                    const result = await this.invokeBackendTool(name, args2);
+                    return { jsonrpc: "2.0", id, result };
+                  } catch (e) {
+                    const msg = e instanceof MSaplingError ? `[backend ${e.status ?? "?"} ${e.code ?? ""}] ${e.message}` : e?.message ?? "tool call failed";
+                    return { jsonrpc: "2.0", id, result: asResult2(msg, true) };
+                  }
                 }
+                return { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown tool: ${name}` } };
+              } finally {
+                this._completeInflight(id);
               }
-              return { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown tool: ${name}` } };
             }
             case "shutdown":
               return { jsonrpc: "2.0", id, result: {} };
@@ -12052,12 +12937,30 @@ ${r.response ?? ""}`;
             return asResult2(text);
           }
           case "msapling_diff": {
+            const oldContent = String(args2.old_content ?? "");
+            const newContent = String(args2.new_content ?? "");
+            const oldBytes = Buffer.byteLength(oldContent, "utf8");
+            const newBytes = Buffer.byteLength(newContent, "utf8");
+            if (oldBytes > AP4_MAX_BLOB_BYTES || newBytes > AP4_MAX_BLOB_BYTES) {
+              return asResult2(
+                `AP-4: Blobs exceed 4 KB (old=${oldBytes}B, new=${newBytes}B). Use the backend endpoint: POST /api/projects/:id/diff`,
+                true
+              );
+            }
             const filename = String(args2.filename ?? "file");
-            const patch = createPatch(filename, String(args2.old_content ?? ""), String(args2.new_content ?? ""), "", "");
+            const patch = createPatch(filename, oldContent, newContent, "", "");
             return asResult2(patch);
           }
           case "msapling_apply_diff": {
-            const applied = applyPatch(String(args2.original_content ?? ""), String(args2.diff_text ?? ""));
+            const originalContent = String(args2.original_content ?? "");
+            const originalBytes = Buffer.byteLength(originalContent, "utf8");
+            if (originalBytes > AP4_MAX_BLOB_BYTES) {
+              return asResult2(
+                `AP-4: Blob exceeds 4 KB (${originalBytes}B). Use the backend endpoint: POST /api/projects/:id/apply`,
+                true
+              );
+            }
+            const applied = applyPatch(originalContent, String(args2.diff_text ?? ""));
             if (applied === false) {
               return asResult2("Diff did not apply cleanly (hunks rejected).", true);
             }
@@ -12154,6 +13057,36 @@ ${text}`);
             return asResult2(`Available models (${models.length} total, showing first 30):
 ${lines.join("\n")}`);
           }
+          case "msapling_list_wakeups": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_list_wakeups requires a Pro subscription.", true);
+            const data = await this.client.listWakeups(args2);
+            return asResult2(JSON.stringify(data, null, 2));
+          }
+          case "msapling_schedule_wakeup": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_schedule_wakeup requires a Pro subscription.", true);
+            const data = await this.client.createWakeup({
+              delay_seconds: Number(args2.delay_seconds),
+              reason: String(args2.reason ?? ""),
+              prompt: args2.prompt ? String(args2.prompt) : void 0,
+              session_id: args2.session_id ? String(args2.session_id) : void 0
+            });
+            return asResult2(JSON.stringify(data, null, 2));
+          }
+          case "msapling_cancel_wakeup": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_cancel_wakeup requires a Pro subscription.", true);
+            await this.client.cancelWakeup(String(args2.id));
+            return asResult2("Wakeup cancelled");
+          }
+          case "msapling_fleet_status": {
+            const isPro = await this.getIsProCached();
+            if (!isPro) return asResult2("msapling_fleet_status requires a Pro subscription.", true);
+            const status = await this.client.getFleetStatus();
+            const tasks = await this.client.getActiveTasks();
+            return asResult2(JSON.stringify({ status, tasks }, null, 2));
+          }
           // Local MCP tools (filesystem, shell, git)
           case "local_run_command":
           case "local_list_directory":
@@ -12201,7 +13134,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
   /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
     "\u25CF MSapling CLI v",
-    "2.3.6-beta.5"
+    "2.3.6-beta.7"
   ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });
@@ -12717,9 +13650,9 @@ ${prompt}` : prompt;
         for (const mention of fileMentions) {
           const filePath = mention.slice(1);
           try {
-            const { existsSync: existsSync26 } = await import("fs");
+            const { existsSync: existsSync27 } = await import("fs");
             const { readFile: readFile23 } = await import("fs/promises");
-            if (existsSync26(filePath)) {
+            if (existsSync27(filePath)) {
               const content = await readFile23(filePath, "utf8");
               const MAX_LEN = 32768;
               const truncated = content.length > MAX_LEN ? content.slice(0, MAX_LEN) + "\n...[TRUNCATED]" : content;
@@ -12772,7 +13705,66 @@ ${finalCmd}`;
 init_esm_shims();
 init_src3();
 import { readFile as readFile22 } from "fs/promises";
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync25 } from "fs";
+
+// src/state/parseApprovalMode.ts
+init_esm_shims();
+var VALID_MODES = [
+  "default",
+  "plan",
+  "acceptEdits",
+  "bypassPermissions"
+];
+function parseApprovalMode(raw, now) {
+  if (!raw || typeof raw !== "object") {
+    return { kind: "invalid", error: "settings file is not a JSON object" };
+  }
+  const block = raw.approvalMode;
+  if (block === void 0) return { kind: "absent" };
+  if (typeof block === "string") {
+    if (!VALID_MODES.includes(block)) {
+      return { kind: "invalid", error: `unknown approvalMode "${block}"` };
+    }
+    return { kind: "ok", mode: block };
+  }
+  if (typeof block !== "object" || block === null) {
+    return {
+      kind: "invalid",
+      error: `approvalMode must be a string or object, got ${typeof block}`
+    };
+  }
+  const obj = block;
+  const mode = obj.mode;
+  if (typeof mode !== "string" || !VALID_MODES.includes(mode)) {
+    return { kind: "invalid", error: `approvalMode.mode invalid: ${JSON.stringify(mode)}` };
+  }
+  if (obj.ttlMs === void 0 && obj.timestamp === void 0) {
+    return { kind: "ok", mode };
+  }
+  if (typeof obj.ttlMs !== "number" || !Number.isFinite(obj.ttlMs) || obj.ttlMs <= 0) {
+    return {
+      kind: "invalid",
+      error: `approvalMode.ttlMs must be a positive number, got ${JSON.stringify(obj.ttlMs)}`
+    };
+  }
+  if (typeof obj.timestamp !== "number" || !Number.isFinite(obj.timestamp) || obj.timestamp <= 0) {
+    return {
+      kind: "invalid",
+      error: `approvalMode.timestamp must be a positive number, got ${JSON.stringify(obj.timestamp)}`
+    };
+  }
+  if (mode !== "bypassPermissions") {
+    return { kind: "ok", mode };
+  }
+  const age = now - obj.timestamp;
+  if (age > obj.ttlMs) {
+    return { kind: "expired", mode: "default", agedMs: age };
+  }
+  const remainingMs = obj.ttlMs - age;
+  return { kind: "ok", mode: "bypassPermissions", ttl: { remainingMs } };
+}
+
+// src/state/initSession.ts
 async function initSession(ctx) {
   try {
     const { settings } = await loadSettings(
@@ -12786,38 +13778,40 @@ async function initSession(ctx) {
       ctx.setShellEscapeEnabled(settings.shellEscapeEnabled !== false);
     }
     try {
-      const { homedir: homedir16 } = await import("os");
-      const { join: join29 } = await import("path");
-      const userSettingsPath = join29(homedir16(), ".msapling", "settings.json");
-      if (existsSync24(userSettingsPath)) {
+      const { homedir: homedir17 } = await import("os");
+      const { join: join31 } = await import("path");
+      const userSettingsPath = join31(homedir17(), ".msapling", "settings.json");
+      if (existsSync25(userSettingsPath)) {
         const userText = await readFile22(userSettingsPath, "utf8");
-        const userJson = JSON.parse(userText);
-        const validModes = ["default", "plan", "acceptEdits", "bypassPermissions"];
+        let parsed;
+        try {
+          parsed = JSON.parse(userText);
+        } catch (e) {
+          ctx.addMessage("system", `\u26A0 ~/.msapling/settings.json is not valid JSON: ${e.message}. Using default mode.`);
+          parsed = {};
+        }
+        const result = parseApprovalMode(parsed, Date.now());
         let modeToApply = "default";
-        const approvalMode = userJson.approvalMode;
-        if (typeof approvalMode === "object" && approvalMode !== null) {
-          const { mode, timestamp, ttlMs } = approvalMode;
-          if (mode && validModes.includes(mode)) {
-            if (mode === "bypassPermissions" && ttlMs && timestamp) {
-              const now = Date.now();
-              const age = now - timestamp;
-              if (age > ttlMs) {
-                ctx.addMessage("system", "\u26A0 bypassPermissions TTL expired. Reverting to default mode.");
-                modeToApply = "default";
+        switch (result.kind) {
+          case "absent":
+            break;
+          case "invalid":
+            ctx.addMessage("system", `\u26A0 Persisted approvalMode invalid (${result.error}). Reverting to default mode.`);
+            break;
+          case "expired":
+            ctx.addMessage("system", "\u26A0 bypassPermissions TTL expired. Reverting to default mode.");
+            break;
+          case "ok":
+            modeToApply = result.mode;
+            if (result.mode === "bypassPermissions") {
+              if (result.ttl) {
+                const mins = (result.ttl.remainingMs / 1e3 / 60).toFixed(1);
+                ctx.addMessage("system", `\u26A0 bypassPermissions active (expires in ~${mins} min). Use /mode default to re-enable controls.`);
               } else {
-                modeToApply = mode;
-                const remaining = ttlMs - age;
-                ctx.addMessage("system", `\u26A0 bypassPermissions active (expires in ~${(remaining / 1e3 / 60).toFixed(1)} min). Use /mode default to re-enable controls.`);
+                ctx.addMessage("system", "\u26A0 bypassPermissions active (no TTL). Use /mode default to re-enable controls.");
               }
-            } else {
-              modeToApply = mode;
             }
-          }
-        } else if (typeof approvalMode === "string" && validModes.includes(approvalMode)) {
-          modeToApply = approvalMode;
-          if (modeToApply === "bypassPermissions") {
-            ctx.addMessage("system", "\u26A0 bypassPermissions active (no TTL). Use /mode default to re-enable controls.");
-          }
+            break;
         }
         ctx.setMode(modeToApply);
       }
@@ -13083,9 +14077,26 @@ var App = ({ compact: compact2 = false }) => {
 
 // src/runtime/bootstrap.ts
 init_esm_shims();
+import { readFileSync as readFileSync3 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname3, join as join30 } from "path";
+function readCliVersion2() {
+  const here = dirname3(fileURLToPath2(import.meta.url));
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const pkg = JSON.parse(readFileSync3(join30(here, rel), "utf8"));
+      if (pkg.name && pkg.version) {
+        return { name: pkg.name, version: pkg.version };
+      }
+    } catch {
+    }
+  }
+  return { name: "@mtreeai/msapling-cli", version: "unknown" };
+}
+var CLI_PKG = readCliVersion2();
 function handleCliArgs(args2) {
   if (args2.includes("--version") || args2.includes("-v")) {
-    console.log("@msapling/cli 2.3.3");
+    console.log(`${CLI_PKG.name} ${CLI_PKG.version}`);
     process.exit(0);
   }
   if (args2.includes("--help") || args2.includes("-h")) {
@@ -13104,7 +14115,8 @@ function handleCliArgs(args2) {
     (async () => {
       const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor2(), doctor_exports));
       const debug = args2.includes("--debug");
-      await runDoctor2(debug);
+      const result = await runDoctor2(debug);
+      process.exit(result.exitCode);
     })().catch((e) => {
       process.stderr.write(`[msapling-doctor] fatal: ${e?.message ?? e}
 `);