@noir-ai/cli 1.13.0-beta.1 → 1.14.0-beta.1

package/dist/bin.js

@@ -26,9 +26,11 @@ import {
 import {
   ensureDaemonRunning,
   pidAlive,
-  readDaemonRecord,
+  readDaemonToken,
+  readProjectDaemonRecord,
   readWorkspaceDaemonRecord,
-  resolveGateConfig
+  resolveGateConfig,
+  tokenPath
 } from "@noir-ai/daemon";
 import { createMemoryEngine } from "@noir-ai/memory";
 import { openStore } from "@noir-ai/store";
@@ -49,7 +51,18 @@ function failDaemonDown(opts, cause) {
   fail(EXIT.DAEMON_DOWN, DAEMON_DOWN_HINT, opts);
 }
 async function probeDaemon(opts = {}) {
-  const rec = readDaemonRecord();
+  const expectedProject = opts.project?.id ?? (() => {
+    try {
+      return loadProjectInfo(process.cwd()).id;
+    } catch {
+      return void 0;
+    }
+  })();
+  if (expectedProject === void 0) {
+    if (opts.verbose) process.stderr.write("noir: daemon probe: no project (uninitialized)\n");
+    return { running: false };
+  }
+  const rec = readProjectDaemonRecord(expectedProject);
   if (!rec) {
     if (opts.verbose) process.stderr.write("noir: daemon probe: no daemon record\n");
     return { running: false };
@@ -70,19 +83,10 @@ async function probeDaemon(opts = {}) {
     }
     const body = await res.json().catch(() => null);
     const pidOk = typeof body?.pid === "number" && body.pid === rec.pid;
-    const expectedProject = opts.project?.id ?? (() => {
-      try {
-        return loadProjectInfo(process.cwd()).id;
-      } catch {
-        return void 0;
-      }
-    })();
-    const projectOk = expectedProject === void 0 || body?.projectId !== void 0 && body.projectId === expectedProject;
-    if (body?.ok !== true || !pidOk || !projectOk) {
+    if (body?.ok !== true || !pidOk) {
       if (opts.verbose)
         process.stderr.write(
-          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : !projectOk ? `noir: daemon probe: daemon serves a different project (${body?.projectId ?? "unknown"}); using in-process fallback
-` : "noir: daemon probe: /health body not ok\n"
+          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : "noir: daemon probe: /health body not ok\n"
         );
       return { running: false };
     }
@@ -107,20 +111,107 @@ async function resolveDaemon(opts) {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
   const idleTimeoutSec = opts.idleTimeoutSec ?? project.config.daemon.idleTimeoutSec;
+  const preferred = project.config.daemon.port;
+  if (preferred !== void 0 && preferred !== 0) {
+    const direct = `http://127.0.0.1:${preferred}/mcp`;
+    const probe = newClient();
+    let probeTimer;
+    try {
+      await Promise.race([
+        probe.connect(httpTransport(direct, project.id)),
+        new Promise((_, reject) => {
+          probeTimer = setTimeout(
+            () => reject(new Error(`no response within ${PROBE_TIMEOUT_MS}ms`)),
+            PROBE_TIMEOUT_MS
+          );
+        })
+      ]);
+      return { client: probe, stop: async () => {
+      } };
+    } catch (err) {
+      if (opts.verbose) {
+        process.stderr.write(
+          `noir: no daemon at the configured port ${preferred} (${describeCause(err)})
+`
+        );
+      }
+      await probe.close().catch(() => {
+      });
+    } finally {
+      if (probeTimer !== void 0) clearTimeout(probeTimer);
+    }
+  }
+  let url;
+  let stop;
   try {
-    const ensured = await ensureDaemonRunning({ project, idleTimeoutSec });
-    return { url: ensured.url, stop: ensured.stop };
+    const ensured = await ensureDaemonRunning({
+      project,
+      idleTimeoutSec,
+      ...preferred !== void 0 ? { port: preferred } : {}
+    });
+    url = ensured.url;
+    stop = ensured.stop;
   } catch (err) {
     failDaemonDown(opts, err);
   }
+  const client = newClient();
+  try {
+    await connectClient(client, url, opts, project.id);
+  } catch (err) {
+    await client.close().catch(() => {
+    });
+    await stop().catch(() => {
+    });
+    throw err;
+  }
+  return { client, stop };
+}
+function httpTransport(url, scopeKey) {
+  const token = scopeKey === null ? null : readDaemonToken(scopeKey);
+  return new StreamableHTTPClientTransport(
+    new URL(url),
+    // Verified present: StreamableHTTPClientTransportOptions.requestInit?: RequestInit
+    token ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {}
+  );
+}
+function callerScopeKey(opts) {
+  try {
+    return (opts.project ?? loadProjectInfo(process.cwd())).id;
+  } catch {
+    return null;
+  }
+}
+function newClient() {
+  return new Client(
+    { name: "noir-cli", version: NOIR_VERSION },
+    { versionNegotiation: { mode: "auto" } }
+  );
+}
+async function connectRaw(client, url, scopeKey) {
+  await client.connect(httpTransport(url, scopeKey));
 }
-async function connectClient(client, url, opts) {
+async function connectClient(client, url, opts, scopeKey) {
   try {
-    await client.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connectRaw(client, url, scopeKey);
   } catch (err) {
     failDaemonDown(opts, err);
   }
 }
+function failWorkspaceConnect(opts, routing, cause) {
+  const text = String(cause).toLowerCase();
+  if (text.includes("401") || text.includes("unauthorized")) {
+    if (opts.verbose) {
+      process.stderr.write(`noir: daemon transport detail: ${describeCause(cause)}
+`);
+    }
+    fail(
+      EXIT.DAEMON_DOWN,
+      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
+      opts
+    );
+  }
+  failDaemonDown(opts, cause);
+}
 async function callToolParse(client, opts, name, args) {
   const result = await client.callTool({ name, arguments: args }).catch((err) => failDaemonDown(opts, err));
   const block = result.content?.[0];
@@ -151,21 +242,12 @@ function buildCaller(client, opts) {
   };
 }
 async function withDaemon(opts, fn) {
-  const { url, stop } = await resolveDaemon(opts);
-  let client;
+  const { client, stop } = await resolveDaemon(opts);
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION },
-      { versionNegotiation: { mode: "auto" } }
-    );
-    const connected = client;
-    await connectClient(connected, url, opts);
-    return await fn(buildCaller(connected, opts));
+    return await fn(buildCaller(client, opts));
   } finally {
-    if (client) {
-      await client.close().catch(() => {
-      });
-    }
+    await client.close().catch(() => {
+    });
     await stop().catch(() => {
     });
   }
@@ -176,12 +258,9 @@ async function withRunningDaemon(opts, fn, probe) {
   const url = `http://127.0.0.1:${p.port}/mcp`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connected.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connected.connect(httpTransport(url, callerScopeKey(opts)));
     return await fn(buildCaller(connected, opts));
   } catch {
     return null;
@@ -279,12 +358,11 @@ async function withWorkspaceDaemon(opts, routing, fn) {
   const url = `http://127.0.0.1:${probe.port}/mcp?p=${routing.projectId}`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connectClient(connected, url, opts);
+    await connectRaw(connected, url, routing.name).catch(
+      (err) => failWorkspaceConnect(opts, routing, err)
+    );
     return await fn(buildCaller(connected, opts));
   } finally {
     if (client) {
@@ -1179,10 +1257,11 @@ var init_workspace = __esm({
 // src/commands/daemon.ts
 import { loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
 import {
-  clearDaemonRecord,
+  clearProjectDaemonRecord,
   ensureDaemonRunning as ensureDaemonRunning2,
   pidAlive as pidAlive3,
-  readDaemonRecord as readDaemonRecord2,
+  readDaemonToken as readDaemonToken2,
+  readProjectDaemonRecord as readProjectDaemonRecord2,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
 function formatUptime(sec) {
@@ -1232,7 +1311,8 @@ async function daemonStart(opts) {
   if (opts.detachChild === true) {
     const child = await ensureDaemonRunning2({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     if (child.started) {
       if (opts.json === true) {
@@ -1255,7 +1335,7 @@ async function daemonStart(opts) {
     return;
   }
   if (opts.detach === true) {
-    const existing = readDaemonRecord2();
+    const existing = readProjectDaemonRecord2(project.id);
     if (existing && pidAlive3(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
@@ -1295,7 +1375,8 @@ async function daemonStart(opts) {
   try {
     ensured = await ensureDaemonRunning2({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
   } catch (err) {
     ds.fail("Daemon failed to start");
@@ -1338,7 +1419,19 @@ async function daemonStart(opts) {
   log(`Noir daemon already running at ${ensured.url}`, opts);
 }
 async function daemonStop(opts) {
-  const rec = readDaemonRecord2();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    if (opts.json === true) {
+      process.stdout.write(
+        `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
+`
+      );
+      return;
+    }
+    info("No Noir daemon is running for this directory (not a Noir project).", opts);
+    return;
+  }
+  const rec = readProjectDaemonRecord2(callerProject);
   if (!rec) {
     if (opts.json === true) {
       process.stdout.write(
@@ -1353,9 +1446,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const callerProject = resolveCallerProjectId();
-  const wrongProject = rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject;
-  const healthy = !wrongProject && pidAlive3(rec.pid) && await isHealthy(rec.port, rec.pid, rec.projectId === void 0 ? void 0 : callerProject);
+  const healthy = pidAlive3(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -1364,7 +1455,7 @@ async function daemonStop(opts) {
       errMsg2 = err instanceof Error ? err.message : String(err);
     }
   }
-  if (!wrongProject) clearDaemonRecord();
+  clearProjectDaemonRecord(callerProject);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({
@@ -1383,26 +1474,22 @@ async function daemonStop(opts) {
   if (signalled) {
     ds.succeed(`Stopped Noir daemon (pid ${rec.pid})`);
   } else {
-    const reason = wrongProject ? "the daemon belongs to another project (left running)" : errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
+    const reason = errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
     ds.warn(`Daemon (pid ${rec.pid}) could not be signalled: ${reason}`);
     info(`Noir daemon (pid ${rec.pid}) could not be signalled: ${reason}`, opts);
   }
 }
 async function daemonStatus(opts) {
-  const rec = readDaemonRecord2();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord2(callerProject);
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  const callerProject = resolveCallerProjectId();
-  if (rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject) {
-    fail(
-      EXIT.DAEMON_DOWN,
-      "Noir daemon is not running for this project (a daemon for another project is running).",
-      opts
-    );
-  }
   if (!pidAlive3(rec.pid)) {
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
   const hs = spinner("Probing daemon health...", opts).start();
@@ -1420,7 +1507,7 @@ async function daemonStatus(opts) {
   const pidOk = typeof health?.pid === "number" && health.pid === rec.pid;
   if (health?.ok !== true || !pidOk) {
     hs.fail("Daemon not responding");
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(
       EXIT.DAEMON_DOWN,
       health !== null && !pidOk ? "Noir daemon is not running (pid missing/mismatched \u2014 a foreign process holds the recorded port; stale record removed)." : "Noir daemon is not running (port unresponsive; stale record removed).",
@@ -1436,7 +1523,8 @@ async function daemonStatus(opts) {
     startedAt: rec.startedAt,
     uptimeSec,
     // Honest ownership: the detached child writes `mode:'detached'`; anything
-    // else (legacy record, foreground start) reports 'foreground'.
+    // else (a record written before the field existed, foreground start)
+    // reports 'foreground'.
     mode: rec.mode ?? MODE
   };
   if (opts.json === true) {
@@ -1449,6 +1537,42 @@ async function daemonStatus(opts) {
     opts
   );
 }
+async function daemonToken(opts) {
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord2(callerProject);
+  if (!rec) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (no daemon record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (!pidAlive3(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  const token = readDaemonToken2(callerProject);
+  if (token === null) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (the record has no token beside it \u2014 restart it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify({ ok: true, data: { token } })}
+`);
+    return;
+  }
+  process.stdout.write(`${token}
+`);
+}
 async function daemonRestart(opts) {
   await daemonStop({ ...opts, json: false, quiet: true });
   await daemonStart(opts);
@@ -1473,6 +1597,7 @@ import { resolveAdapter as resolveAdapter2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod,
   latestVersionFromCache,
+  loadNoirEnv,
   loadProjectInfo as loadProjectInfo4,
   NOIR_VERSION as NOIR_VERSION2,
   paths,
@@ -1480,7 +1605,7 @@ import {
   readUpdateCache
 } from "@noir-ai/core";
 import { CURRENT_SCAFFOLD_VERSION, readScaffoldVersion } from "@noir-ai/create";
-import { pidAlive as pidAlive4, readDaemonRecord as readDaemonRecord3 } from "@noir-ai/daemon";
+import { pidAlive as pidAlive4, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
 import { resolveModelConfig } from "@noir-ai/model";
 async function probeOnnx() {
   try {
@@ -1544,8 +1669,16 @@ function checkConfig(root) {
     };
   }
 }
-async function checkDaemon(checks) {
-  const rec = readDaemonRecord3();
+async function checkDaemon(checks, project) {
+  if (project === void 0) {
+    checks.push({
+      name: "daemon",
+      status: "warn",
+      detail: "skipped \u2014 project not initialized"
+    });
+    return;
+  }
+  const rec = readProjectDaemonRecord3(project.id);
   if (!rec) {
     checks.push({
       name: "daemon",
@@ -1637,7 +1770,7 @@ async function checkStore(checks, project, root) {
     }
   }
 }
-function checkNoirEnv(checks, root) {
+function checkNoirEnv(checks, root, loaded) {
   const path = join2(paths.noirDir(root), ".env");
   let st;
   try {
@@ -1645,6 +1778,14 @@ function checkNoirEnv(checks, root) {
   } catch {
     return;
   }
+  if (loaded.warnings.some((w) => w.startsWith(ENV_REFUSAL_PREFIX))) {
+    checks.push({
+      name: "noir-env",
+      status: "warn",
+      detail: `${path} is tracked by git \u2014 refused, so NONE of its keys are in effect. Fix: add \`.noir/.env\` to .gitignore and run \`git rm --cached .noir/.env\`.`
+    });
+    return;
+  }
   const mode = st.mode & 511;
   const tooOpen = (st.mode & 63) !== 0;
   checks.push(
@@ -1654,6 +1795,10 @@ function checkNoirEnv(checks, root) {
       detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
     } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
   );
+  for (const [key, source] of Object.entries(loaded.sources)) {
+    if (source !== "file") continue;
+    checks.push({ name: `noir-env:${key}`, status: "ok", detail: "from .noir/.env" });
+  }
 }
 function checkEmbedder(checks, project, vecOk) {
   if (!project) {
@@ -1685,7 +1830,7 @@ function checkEmbedder(checks, project, vecOk) {
     detail: `${kind}/${model} (${emb.dim}-dim) \xB7 vec backend available`
   });
 }
-function checkProvider(checks, project) {
+function checkProvider(checks, project, sources) {
   if (!project) {
     checks.push({ name: "provider", status: "warn", detail: "skipped \u2014 not initialized" });
     return;
@@ -1705,7 +1850,8 @@ function checkProvider(checks, project) {
   for (const name of names) {
     const p = resolved.providers[name];
     if (!p) continue;
-    const key = p.hasKey ? "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
+    const fromFile = p.apiKeyEnv !== void 0 && sources[p.apiKeyEnv] === "file";
+    const key = p.hasKey ? fromFile ? "key present (from .noir/.env)" : "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
     if (!p.hasKey && p.apiKeyEnv) missing = true;
     parts.push(`${name}/${p.model ?? "?"} (${key})`);
   }
@@ -2068,12 +2214,13 @@ async function doctor(opts = {}) {
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
-  await checkDaemon(checks);
+  await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
   checkEmbedder(checks, project, vecOk);
-  checkProvider(checks, project);
-  checkNoirEnv(checks, root);
+  const noirEnv = loadNoirEnv(root);
+  checkProvider(checks, project, noirEnv.sources);
+  checkNoirEnv(checks, root, noirEnv);
   const scaffold4 = checkScaffoldVersion(checks, root);
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
@@ -2116,17 +2263,112 @@ async function doctor(opts = {}) {
     );
   }
 }
-var SEMVER_ISH;
+var ENV_REFUSAL_PREFIX, SEMVER_ISH;
 var init_doctor = __esm({
   "src/commands/doctor.ts"() {
     "use strict";
     init_daemon_client();
     init_output();
     init_theme();
+    ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
     SEMVER_ISH = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
   }
 });
 
+// src/commands/env.ts
+import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo5 } from "@noir-ai/core";
+import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
+function captureAmbientEnv(env2 = process.env) {
+  ambientBaseline = { ...env2 };
+}
+function redactShape(value) {
+  if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
+  return `${value.slice(0, 3)}\u2026(${value.length})`;
+}
+function configApiKeyEnvNames(root) {
+  try {
+    const project = loadProjectInfo5(root);
+    const names = /* @__PURE__ */ new Set();
+    for (const provider of Object.values(resolveModelConfig2(project.config.model).providers)) {
+      if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
+        names.add(provider.apiKeyEnv);
+      }
+    }
+    return [...names];
+  } catch {
+    return [];
+  }
+}
+function resolveEnv(root, ambientEnv) {
+  const { overlay, warnings, sources } = loadNoirEnv2(root, ambientEnv);
+  const curated = new Set(CURATED_AMBIENT_KEYS);
+  for (const name of configApiKeyEnvNames(root)) curated.add(name);
+  const candidates = new Set(Object.keys(sources));
+  for (const key of curated) {
+    if (ambientEnv[key] !== void 0) candidates.add(key);
+  }
+  const vars = [];
+  const shapes = {};
+  for (const key of [...candidates].sort()) {
+    const source = sources[key] ?? "env";
+    if (source === "env" && !curated.has(key)) continue;
+    const value = source === "file" ? overlay[key] ?? "" : ambientEnv[key] ?? "";
+    const shadowed = source === "file" && ambientEnv[key] !== void 0 && ambientEnv[key] !== value;
+    vars.push({
+      key,
+      source,
+      ...shadowed ? { shadowed: true } : {},
+      valueLength: value.length
+    });
+    shapes[key] = redactShape(value);
+  }
+  return { vars, warnings, shapes };
+}
+function describeSource(row) {
+  if (row.source !== "file") return "environment";
+  return row.shadowed === true ? ".noir/.env (shadows environment)" : ".noir/.env";
+}
+async function env(opts = {}) {
+  const report = resolveEnv(process.cwd(), ambientBaseline ?? process.env);
+  if (opts.json === true) {
+    json({ ok: true, data: { vars: report.vars, warnings: report.warnings } });
+    return;
+  }
+  if (report.vars.length === 0) {
+    info(
+      "nothing to report \u2014 .noir/.env defines no keys in effect and no Noir-relevant environment variable is set",
+      opts
+    );
+    return;
+  }
+  table(
+    report.vars.map((row) => ({
+      KEY: row.key,
+      SOURCE: describeSource(row),
+      VALUE: report.shapes[row.key] ?? ""
+    })),
+    ["KEY", "SOURCE", "VALUE"],
+    opts
+  );
+}
+var CURATED_AMBIENT_KEYS, ambientBaseline, SHORT_VALUE_MAX;
+var init_env = __esm({
+  "src/commands/env.ts"() {
+    "use strict";
+    init_output();
+    CURATED_AMBIENT_KEYS = [
+      "CLICKUP_API_TOKEN",
+      "OPENAI_API_KEY",
+      "VOYAGE_API_KEY",
+      "COHERE_API_KEY",
+      "OLLAMA_BASE_URL",
+      "ANTHROPIC_API_KEY",
+      "NOIR_PROFILE"
+    ];
+    SHORT_VALUE_MAX = 8;
+  }
+});
+
 // src/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
@@ -2141,7 +2383,7 @@ import {
   detectActiveMethod as detectActiveMethod2,
   detectInstallMethods,
   ensureShimExecutable,
-  loadProjectInfo as loadProjectInfo5,
+  loadProjectInfo as loadProjectInfo6,
   MANAGED_NODE_VERSION,
   NOIR_VERSION as NOIR_VERSION3,
   noirHome,
@@ -2280,7 +2522,7 @@ async function install(opts = {}) {
   const installedRecord = readInstallRecord2();
   let minVersion = "1.6.0";
   try {
-    minVersion = loadProjectInfo5(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo6(process.cwd()).config.update.minVersion;
   } catch {
   }
   const plan = buildMigrationPlan({
@@ -2357,7 +2599,7 @@ import {
   detectActiveMethod as detectActiveMethod3,
   ensureShimExecutable as ensureShimExecutable2,
   fetchLatestVersion,
-  loadProjectInfo as loadProjectInfo6,
+  loadProjectInfo as loadProjectInfo7,
   readInstallRecord as readInstallRecord3,
   readUpdateCache as readUpdateCache2,
   runManagerCmd as runManagerCmd2,
@@ -2437,7 +2679,7 @@ async function update(opts = {}) {
   fetchSpin.succeed(`Latest: ${latest}`);
   let minVersion = DEFAULT_UPDATE_CONFIG.minVersion;
   try {
-    minVersion = loadProjectInfo6(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo7(process.cwd()).config.update.minVersion;
   } catch {
   }
   const target = buildUpdateTarget({
@@ -2587,7 +2829,7 @@ var init_update = __esm({
 });
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo7, NOIR_VERSION as NOIR_VERSION4 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo8, NOIR_VERSION as NOIR_VERSION4 } from "@noir-ai/core";
 async function tryTool(caller, name, args) {
   try {
     return await caller.callTool(name, args);
@@ -2708,7 +2950,7 @@ function renderHuman2(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo7(process.cwd());
+    project = loadProjectInfo8(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2738,7 +2980,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo7(process.cwd());
+        const info2 = loadProjectInfo8(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -2767,7 +3009,7 @@ var init_status = __esm({
 // src/commands/task.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo8, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo9, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -2780,7 +3022,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo8(process.cwd());
+    const project = loadProjectInfo9(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -3103,7 +3345,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo8(process.cwd());
+    project = loadProjectInfo9(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3315,7 +3557,7 @@ import {
   hostLaunchDirective,
   resolveAdapter as resolveAdapter3
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo9, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo10, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 function heading(name, id) {
   return `# Noir handoff \u2014 ${name} (${id})`;
 }
@@ -3454,7 +3696,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo9(process.cwd());
+    project = loadProjectInfo10(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3818,14 +4060,14 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod4,
   latestVersionFromCache as latestVersionFromCache2,
-  loadProjectInfo as loadProjectInfo10,
+  loadProjectInfo as loadProjectInfo11,
   NOIR_VERSION as NOIR_VERSION5,
   readInstallRecord as readInstallRecord4,
   readUpdateCache as readUpdateCache3
 } from "@noir-ai/core";
 function tryProject() {
   try {
-    const info2 = loadProjectInfo10(process.cwd());
+    const info2 = loadProjectInfo11(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -3988,7 +4230,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo10(process.cwd());
+        const info2 = loadProjectInfo11(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -4051,12 +4293,12 @@ var init_home = __esm({
 
 // src/commands/memory.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo11(process.cwd()) };
+    return { routing, project: loadProjectInfo12(process.cwd()) };
   } catch {
     return null;
   }
@@ -4448,9 +4690,9 @@ async function memoryConsolidate(opts) {
     }
     return;
   }
-  const env = res;
-  const reason = (typeof env.reason === "string" ? env.reason : void 0) ?? (typeof env.error === "string" ? env.error : void 0) ?? "unknown";
-  const logged = env.logged === true || env.degraded === true;
+  const env2 = res;
+  const reason = (typeof env2.reason === "string" ? env2.reason : void 0) ?? (typeof env2.error === "string" ? env2.error : void 0) ?? "unknown";
+  const logged = env2.logged === true || env2.degraded === true;
   const suffix = logged ? " (logged)" : "";
   fail(EXIT.ERROR, `memory consolidate did not run: ${reason}${suffix}`, opts);
 }
@@ -4570,10 +4812,10 @@ var init_release = __esm({
 import { spawn } from "child_process";
 import { basename } from "path";
 function isEligibleForShellFallback(name, opts = {}) {
-  const { env = process.env, platform = process.platform } = opts;
+  const { env: env2 = process.env, platform = process.platform } = opts;
   if (platform === "win32") return false;
   if (name.length === 0 || name.includes("/") || !NAME_RE.test(name)) return false;
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   if (!shell || shell.length === 0) return false;
   return SUPPORTED_SHELLS.has(basename(shell).toLowerCase());
 }
@@ -4636,9 +4878,9 @@ function probeCommand(name, shell, opts) {
   });
 }
 async function resolveCommandViaShell(name, opts = {}) {
-  const { env = process.env } = opts;
+  const { env: env2 = process.env } = opts;
   if (!isEligibleForShellFallback(name, opts)) return { kind: "unsupported" };
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   const cached = pathCache.get(`${shell}:${name}`);
   if (cached) return { kind: "path", path: cached, shell };
   const probe = await probeCommand(name, shell, opts);
@@ -4939,24 +5181,24 @@ var init_orchestrator = __esm({
 });
 
 // src/run-profiles.ts
-import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo12(root).config;
+    return loadProjectInfo13(root).config;
   } catch {
     return null;
   }
 }
-function expandEnvVars(value, env) {
+function expandEnvVars(value, env2) {
   return value.replace(
     /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,
-    (match, name) => env[name] !== void 0 ? env[name] : match
+    (match, name) => env2[name] !== void 0 ? env2[name] : match
   );
 }
-function resolveRunProfile(requested, config, env) {
+function resolveRunProfile(requested, config, env2) {
   const profiles = config.run?.profiles ?? {};
   const names = Object.keys(profiles);
-  const name = requested ?? env.NOIR_PROFILE ?? config.run?.defaultProfile;
+  const name = requested ?? env2.NOIR_PROFILE ?? config.run?.defaultProfile;
   if (name === void 0 || name.length === 0) {
     return { ok: true, profile: {} };
   }
@@ -4971,7 +5213,7 @@ function resolveRunProfile(requested, config, env) {
   const envExpanded = {};
   if (profile.env) {
     for (const [k, v] of Object.entries(profile.env)) {
-      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env);
+      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env2);
     }
   }
   return {
@@ -4995,10 +5237,24 @@ var init_run_profiles = __esm({
 });
 
 // src/commands/run.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join5 } from "path";
 import { SUPPORTED_HOSTS } from "@noir-ai/adapters";
-import { parseConfig } from "@noir-ai/core";
+import { loadNoirEnv as loadNoirEnv3, NOIR_DIR as NOIR_DIR2, parseConfig } from "@noir-ai/core";
+function credentialNote(env2, sources) {
+  const named = CREDENTIAL_ENV_VARS.filter((name) => {
+    const value = env2[name];
+    return value !== void 0 && value.length > 0;
+  }).map(
+    (name) => `${name} (from ${sources[name] === "file" ? `${NOIR_DIR2}/.env` : "the environment"})`
+  );
+  if (named.length === 0) return "";
+  const one = named.length === 1;
+  const subject = one ? `${named[0]} is set` : `${named.join(", ")} are set`;
+  const pronoun = one ? "it" : "them";
+  const verb = one ? "overrides" : "override";
+  return ` Note: ${subject} \u2014 ${pronoun} ${verb} the logged-in account in \`-p\` mode; unset ${pronoun} in the named source (or fix the value) if you meant to use your subscription.`;
+}
 function formatUsage(u) {
   const cost = u.totalCostUsd > 0 ? ` $${u.totalCostUsd.toFixed(2)}` : "";
   const turns = u.numTurns > 0 ? ` \xB7 ${u.numTurns} turns` : "";
@@ -5022,13 +5278,21 @@ async function run(prompt, opts) {
     const usage = selectors.length > 0 ? `noir run ${selectors.join(" ")} <prompt>` : "noir run <prompt>";
     fail(EXIT.USAGE, `a prompt is required: \`${usage}\``, opts);
   }
-  const config = loadRunConfig(process.cwd()) ?? parseConfig({});
+  const root = process.cwd();
+  const envSources = loadNoirEnv3(root).sources;
+  const config = loadRunConfig(root) ?? parseConfig({});
   const resolved = resolveRunProfile(opts.profile, config, process.env);
   if (!resolved.ok) fail(EXIT.USAGE, resolved.message, opts);
   const profile = resolved.profile;
   const customBinary = opts.command ?? profile.binary;
   const extraArgs = profile.args;
-  const env = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  const env2 = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  if (!existsSync3(join5(root, NOIR_DIR2, ".env"))) {
+    log(
+      `This project has no ${NOIR_DIR2}/.env \u2014 that is where Noir reads project credentials and run config from. Run \`noir init\` to scaffold one (\`noir run\` works without it).`,
+      opts
+    );
+  }
   const transcriptLines = [];
   let result;
   try {
@@ -5037,7 +5301,7 @@ async function run(prompt, opts) {
       prompt,
       customBinary,
       extraArgs,
-      env,
+      env: env2,
       onLine: (line) => transcriptLines.push(line),
       onEvent: (event) => streamEvent(event, opts)
     });
@@ -5058,9 +5322,7 @@ async function run(prompt, opts) {
     let message = `host '${binary}' failed (exit ${result.exitCode}): ${reason}`;
     if (isAuth) {
       message += ` Open a terminal and run \`${binary} /login\` (interactive-only \u2014 it cannot run inside \`noir run\`), then retry.`;
-      if (process.env.ANTHROPIC_API_KEY) {
-        message += ` Note: ANTHROPIC_API_KEY is set in your environment \u2014 it overrides the logged-in account in \`-p\` mode; unset it (or fix the key) if you meant to use your subscription.`;
-      }
+      message += credentialNote(env2 ?? process.env, envSources);
     }
     message += ` If you use another profile, pass \`--command <binary>\` or define a run profile under run.profiles. transcript: ${transcript}`;
     fail(EXIT.ERROR, message, opts);
@@ -5100,18 +5362,24 @@ function writeTranscript(host, lines) {
   }
   return file;
 }
+var CREDENTIAL_ENV_VARS;
 var init_run = __esm({
   "src/commands/run.ts"() {
     "use strict";
     init_orchestrator();
     init_output();
     init_run_profiles();
+    CREDENTIAL_ENV_VARS = [
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "ANTHROPIC_BASE_URL"
+    ];
   }
 });
 
 // src/commands/skills.ts
 import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -5179,7 +5447,7 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo13(root);
+    project = loadProjectInfo14(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -5705,7 +5973,7 @@ var init_dedup_write = __esm({
 
 // src/init.ts
 import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir2 } from "@noir-ai/skills";
 async function init(root, opts) {
@@ -5734,7 +6002,7 @@ async function init(root, opts) {
   await emitHostSkills(root, host, conflictOpts, interactive);
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo14(root);
+    projectInfo = loadProjectInfo15(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5753,7 +6021,10 @@ function reportPlannedWrites(res) {
   log("Dry run \u2014 no files were written.");
   if (res.written.length > 0) {
     log("Planned writes:");
-    for (const p of res.written) log(`  ${p}`);
+    for (const p of res.written) {
+      const mode = res.fileModes?.[p];
+      log(mode === void 0 ? `  ${p}` : `  ${p} (mode ${mode.toString(8).padStart(3, "0")})`);
+    }
   }
   if (res.skipped.length > 0) {
     log("Would leave as-is (already present):");
@@ -5821,11 +6092,11 @@ var init_init = __esm({
 });
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo16 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning3, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo15(process.cwd());
+  const project = loadProjectInfo16(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -5833,10 +6104,11 @@ async function serve(opts) {
   try {
     const { url } = await ensureDaemonRunning3({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     process.stderr.write(
-      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.)
+      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.) Add the daemon's bearer token via the host MCP headersHelper (run \`noir daemon token\`).
 `
     );
   } catch (err) {
@@ -5860,7 +6132,7 @@ __export(create_exports, {
 });
 import { resolve } from "path";
 import { resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo16 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo17 } from "@noir-ai/core";
 import { scaffold as scaffold2 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir3 } from "@noir-ai/skills";
 async function create(dir, opts) {
@@ -5911,7 +6183,7 @@ async function create(dir, opts) {
   }
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo16(root);
+    projectInfo = loadProjectInfo17(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5937,9 +6209,9 @@ var sync_exports = {};
 __export(sync_exports, {
   sync: () => sync
 });
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { resolveAdapter as resolveAdapter7 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo17, paths as paths2 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo18, paths as paths2 } from "@noir-ai/core";
 import { scaffold as scaffold3 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir4 } from "@noir-ai/skills";
 async function sync(root, opts = {}) {
@@ -5948,7 +6220,7 @@ async function sync(root, opts = {}) {
   const conflictOpts = buildConflictOpts({ force: opts.force, interactive });
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo17(root);
+    projectInfo = loadProjectInfo18(root);
   } catch {
     projectInfo = void 0;
   }
@@ -6006,9 +6278,9 @@ async function sync(root, opts = {}) {
 }
 function resolveSyncHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
-  if (!existsSync3(paths2.config(root))) return "claude";
+  if (!existsSync4(paths2.config(root))) return "claude";
   try {
-    return loadProjectInfo17(root).config.host;
+    return loadProjectInfo18(root).config.host;
   } catch {
     return "claude";
   }
@@ -6128,6 +6400,7 @@ function createProgram() {
         );
       }
     }
+    if (actionCmd.name() === "env") captureAmbientEnv();
     applyNoirEnv2(process.cwd());
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
@@ -6270,6 +6543,9 @@ function createProgram() {
   daemonGrp.command("status").description("report daemon pid/uptime/mode (exit 4 if not running)").action(async (...args) => {
     await daemonStatus(toCliOptions(trailingCmd(args).optsWithGlobals()));
   });
+  daemonGrp.command("token").description("print the daemon bearer token to stdout (for a host headersHelper)").action(async (...args) => {
+    await daemonToken(toCliOptions(trailingCmd(args).optsWithGlobals()));
+  });
   daemonGrp.command("restart").description("stop then start the daemon").option("--detach", "run the daemon in the background and exit").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
@@ -6279,8 +6555,19 @@ function createProgram() {
     });
   });
   daemonGrp.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart|token");
   });
+  daemonGrp.addHelpText(
+    "after",
+    [
+      "",
+      "Shared workspaces (two repos, one product \u2014 e.g. backend + frontend):",
+      "  noir daemon start --workspace <name> --detach   found a workspace from this repo",
+      "  noir daemon join <name>                         join it from the other repo",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   const workspaceGrp = program2.command("workspace").description("shared cross-repo workspaces");
   workspaceGrp.command("list").description("list workspaces on this machine").action(async (...args) => {
     await workspaceList(toCliOptions(trailingCmd(args).optsWithGlobals()));
@@ -6309,6 +6596,17 @@ function createProgram() {
       ...name !== void 0 ? { name } : {}
     });
   });
+  workspaceGrp.addHelpText(
+    "after",
+    [
+      "",
+      "This group only inspects and leaves workspaces. To CREATE or JOIN one:",
+      "  noir daemon start --workspace <name> --detach   found it (from the first repo)",
+      "  noir daemon join <name>                         join it (from the second repo)",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   workspaceGrp.action(() => {
     throw new NoirCliError(EXIT.USAGE, "Usage: noir workspace list|status|leave|stop");
   });
@@ -6323,6 +6621,9 @@ function createProgram() {
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
   });
+  program2.command("env").description("which configuration is in effect and where each value comes from").action(async (...args) => {
+    await env(toCliOptions(actionGlobals(args)));
+  });
   const contextGrp = program2.command("context").description("context engine");
   contextGrp.command("search").description("hybrid search over the indexed context").argument("<query>", "search query").option("--limit <n>", "max results", "10").action(async (...args) => {
     const cmd = trailingCmd(args);
@@ -6707,6 +7008,7 @@ var init_bin = __esm({
     init_context();
     init_daemon();
     init_doctor();
+    init_env();
     init_handoff();
     init_home();
     init_memory();