@noir-ai/cli 1.13.0-beta.1 → 1.14.0-beta.1

package/dist/index.js

@@ -857,10 +857,11 @@ var init_workspace = __esm({
 // src/commands/daemon.ts
 import { loadProjectInfo as loadProjectInfo2 } from "@noir-ai/core";
 import {
-  clearDaemonRecord,
+  clearProjectDaemonRecord,
   ensureDaemonRunning,
   pidAlive as pidAlive2,
-  readDaemonRecord,
+  readDaemonToken,
+  readProjectDaemonRecord,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
 function formatUptime(sec) {
@@ -910,7 +911,8 @@ async function daemonStart(opts) {
   if (opts.detachChild === true) {
     const child = await ensureDaemonRunning({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     if (child.started) {
       if (opts.json === true) {
@@ -933,7 +935,7 @@ async function daemonStart(opts) {
     return;
   }
   if (opts.detach === true) {
-    const existing = readDaemonRecord();
+    const existing = readProjectDaemonRecord(project.id);
     if (existing && pidAlive2(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
@@ -973,7 +975,8 @@ async function daemonStart(opts) {
   try {
     ensured = await ensureDaemonRunning({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
   } catch (err) {
     ds.fail("Daemon failed to start");
@@ -1016,7 +1019,19 @@ async function daemonStart(opts) {
   log(`Noir daemon already running at ${ensured.url}`, opts);
 }
 async function daemonStop(opts) {
-  const rec = readDaemonRecord();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    if (opts.json === true) {
+      process.stdout.write(
+        `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
+`
+      );
+      return;
+    }
+    info("No Noir daemon is running for this directory (not a Noir project).", opts);
+    return;
+  }
+  const rec = readProjectDaemonRecord(callerProject);
   if (!rec) {
     if (opts.json === true) {
       process.stdout.write(
@@ -1031,9 +1046,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const callerProject = resolveCallerProjectId();
-  const wrongProject = rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject;
-  const healthy = !wrongProject && pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, rec.projectId === void 0 ? void 0 : callerProject);
+  const healthy = pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -1042,7 +1055,7 @@ async function daemonStop(opts) {
       errMsg2 = err instanceof Error ? err.message : String(err);
     }
   }
-  if (!wrongProject) clearDaemonRecord();
+  clearProjectDaemonRecord(callerProject);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({
@@ -1061,26 +1074,22 @@ async function daemonStop(opts) {
   if (signalled) {
     ds.succeed(`Stopped Noir daemon (pid ${rec.pid})`);
   } else {
-    const reason = wrongProject ? "the daemon belongs to another project (left running)" : errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
+    const reason = errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
     ds.warn(`Daemon (pid ${rec.pid}) could not be signalled: ${reason}`);
     info(`Noir daemon (pid ${rec.pid}) could not be signalled: ${reason}`, opts);
   }
 }
 async function daemonStatus(opts) {
-  const rec = readDaemonRecord();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord(callerProject);
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  const callerProject = resolveCallerProjectId();
-  if (rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject) {
-    fail(
-      EXIT.DAEMON_DOWN,
-      "Noir daemon is not running for this project (a daemon for another project is running).",
-      opts
-    );
-  }
   if (!pidAlive2(rec.pid)) {
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
   const hs = spinner("Probing daemon health...", opts).start();
@@ -1098,7 +1107,7 @@ async function daemonStatus(opts) {
   const pidOk = typeof health?.pid === "number" && health.pid === rec.pid;
   if (health?.ok !== true || !pidOk) {
     hs.fail("Daemon not responding");
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(
       EXIT.DAEMON_DOWN,
       health !== null && !pidOk ? "Noir daemon is not running (pid missing/mismatched \u2014 a foreign process holds the recorded port; stale record removed)." : "Noir daemon is not running (port unresponsive; stale record removed).",
@@ -1114,7 +1123,8 @@ async function daemonStatus(opts) {
     startedAt: rec.startedAt,
     uptimeSec,
     // Honest ownership: the detached child writes `mode:'detached'`; anything
-    // else (legacy record, foreground start) reports 'foreground'.
+    // else (a record written before the field existed, foreground start)
+    // reports 'foreground'.
     mode: rec.mode ?? MODE
   };
   if (opts.json === true) {
@@ -1127,6 +1137,42 @@ async function daemonStatus(opts) {
     opts
   );
 }
+async function daemonToken(opts) {
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord(callerProject);
+  if (!rec) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (no daemon record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (!pidAlive2(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  const token = readDaemonToken(callerProject);
+  if (token === null) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (the record has no token beside it \u2014 restart it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify({ ok: true, data: { token } })}
+`);
+    return;
+  }
+  process.stdout.write(`${token}
+`);
+}
 async function daemonRestart(opts) {
   await daemonStop({ ...opts, json: false, quiet: true });
   await daemonStart(opts);
@@ -1142,6 +1188,100 @@ var init_daemon = __esm({
   }
 });
 
+// src/commands/env.ts
+import { loadNoirEnv, loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
+import { resolveModelConfig } from "@noir-ai/model";
+function captureAmbientEnv(env2 = process.env) {
+  ambientBaseline = { ...env2 };
+}
+function redactShape(value) {
+  if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
+  return `${value.slice(0, 3)}\u2026(${value.length})`;
+}
+function configApiKeyEnvNames(root) {
+  try {
+    const project = loadProjectInfo3(root);
+    const names = /* @__PURE__ */ new Set();
+    for (const provider of Object.values(resolveModelConfig(project.config.model).providers)) {
+      if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
+        names.add(provider.apiKeyEnv);
+      }
+    }
+    return [...names];
+  } catch {
+    return [];
+  }
+}
+function resolveEnv(root, ambientEnv) {
+  const { overlay, warnings, sources } = loadNoirEnv(root, ambientEnv);
+  const curated = new Set(CURATED_AMBIENT_KEYS);
+  for (const name of configApiKeyEnvNames(root)) curated.add(name);
+  const candidates = new Set(Object.keys(sources));
+  for (const key of curated) {
+    if (ambientEnv[key] !== void 0) candidates.add(key);
+  }
+  const vars = [];
+  const shapes = {};
+  for (const key of [...candidates].sort()) {
+    const source = sources[key] ?? "env";
+    if (source === "env" && !curated.has(key)) continue;
+    const value = source === "file" ? overlay[key] ?? "" : ambientEnv[key] ?? "";
+    const shadowed = source === "file" && ambientEnv[key] !== void 0 && ambientEnv[key] !== value;
+    vars.push({
+      key,
+      source,
+      ...shadowed ? { shadowed: true } : {},
+      valueLength: value.length
+    });
+    shapes[key] = redactShape(value);
+  }
+  return { vars, warnings, shapes };
+}
+function describeSource(row) {
+  if (row.source !== "file") return "environment";
+  return row.shadowed === true ? ".noir/.env (shadows environment)" : ".noir/.env";
+}
+async function env(opts = {}) {
+  const report = resolveEnv(process.cwd(), ambientBaseline ?? process.env);
+  if (opts.json === true) {
+    json({ ok: true, data: { vars: report.vars, warnings: report.warnings } });
+    return;
+  }
+  if (report.vars.length === 0) {
+    info(
+      "nothing to report \u2014 .noir/.env defines no keys in effect and no Noir-relevant environment variable is set",
+      opts
+    );
+    return;
+  }
+  table(
+    report.vars.map((row) => ({
+      KEY: row.key,
+      SOURCE: describeSource(row),
+      VALUE: report.shapes[row.key] ?? ""
+    })),
+    ["KEY", "SOURCE", "VALUE"],
+    opts
+  );
+}
+var CURATED_AMBIENT_KEYS, ambientBaseline, SHORT_VALUE_MAX;
+var init_env = __esm({
+  "src/commands/env.ts"() {
+    "use strict";
+    init_output();
+    CURATED_AMBIENT_KEYS = [
+      "CLICKUP_API_TOKEN",
+      "OPENAI_API_KEY",
+      "VOYAGE_API_KEY",
+      "COHERE_API_KEY",
+      "OLLAMA_BASE_URL",
+      "ANTHROPIC_API_KEY",
+      "NOIR_PROFILE"
+    ];
+    SHORT_VALUE_MAX = 8;
+  }
+});
+
 // src/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
@@ -1156,7 +1296,7 @@ import {
   detectActiveMethod,
   detectInstallMethods,
   ensureShimExecutable,
-  loadProjectInfo as loadProjectInfo3,
+  loadProjectInfo as loadProjectInfo4,
   MANAGED_NODE_VERSION,
   NOIR_VERSION,
   noirHome,
@@ -1295,7 +1435,7 @@ async function install(opts = {}) {
   const installedRecord = readInstallRecord();
   let minVersion = "1.6.0";
   try {
-    minVersion = loadProjectInfo3(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo4(process.cwd()).config.update.minVersion;
   } catch {
   }
   const plan = buildMigrationPlan({
@@ -1372,7 +1512,7 @@ import {
   detectActiveMethod as detectActiveMethod2,
   ensureShimExecutable as ensureShimExecutable2,
   fetchLatestVersion,
-  loadProjectInfo as loadProjectInfo4,
+  loadProjectInfo as loadProjectInfo5,
   readInstallRecord as readInstallRecord2,
   readUpdateCache,
   runManagerCmd as runManagerCmd2,
@@ -1452,7 +1592,7 @@ async function update(opts = {}) {
   fetchSpin.succeed(`Latest: ${latest}`);
   let minVersion = DEFAULT_UPDATE_CONFIG.minVersion;
   try {
-    minVersion = loadProjectInfo4(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo5(process.cwd()).config.update.minVersion;
   } catch {
   }
   const target = buildUpdateTarget({
@@ -1602,7 +1742,7 @@ var init_update = __esm({
 });
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo5, NOIR_VERSION as NOIR_VERSION2 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo6, NOIR_VERSION as NOIR_VERSION2 } from "@noir-ai/core";
 async function tryTool(caller, name, args) {
   try {
     return await caller.callTool(name, args);
@@ -1723,7 +1863,7 @@ function renderHuman(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo5(process.cwd());
+    project = loadProjectInfo6(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -1753,7 +1893,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo5(process.cwd());
+        const info2 = loadProjectInfo6(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -1782,7 +1922,7 @@ var init_status = __esm({
 // src/commands/task.ts
 import { spawnSync } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo6, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo7, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -1795,7 +1935,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo6(process.cwd());
+    const project = loadProjectInfo7(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -2118,7 +2258,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo6(process.cwd());
+    project = loadProjectInfo7(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2330,7 +2470,7 @@ import {
   hostLaunchDirective,
   resolveAdapter as resolveAdapter2
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo7, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo8, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 function heading(name, id) {
   return `# Noir handoff \u2014 ${name} (${id})`;
 }
@@ -2469,7 +2609,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo7(process.cwd());
+    project = loadProjectInfo8(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2833,14 +2973,14 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod3,
   latestVersionFromCache,
-  loadProjectInfo as loadProjectInfo8,
+  loadProjectInfo as loadProjectInfo9,
   NOIR_VERSION as NOIR_VERSION3,
   readInstallRecord as readInstallRecord3,
   readUpdateCache as readUpdateCache2
 } from "@noir-ai/core";
 function tryProject() {
   try {
-    const info2 = loadProjectInfo8(process.cwd());
+    const info2 = loadProjectInfo9(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -3003,7 +3143,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo8(process.cwd());
+        const info2 = loadProjectInfo9(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -3066,12 +3206,12 @@ var init_home = __esm({
 
 // src/commands/memory.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { loadProjectInfo as loadProjectInfo9 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo9(process.cwd()) };
+    return { routing, project: loadProjectInfo10(process.cwd()) };
   } catch {
     return null;
   }
@@ -3463,9 +3603,9 @@ async function memoryConsolidate(opts) {
     }
     return;
   }
-  const env = res;
-  const reason = (typeof env.reason === "string" ? env.reason : void 0) ?? (typeof env.error === "string" ? env.error : void 0) ?? "unknown";
-  const logged = env.logged === true || env.degraded === true;
+  const env2 = res;
+  const reason = (typeof env2.reason === "string" ? env2.reason : void 0) ?? (typeof env2.error === "string" ? env2.error : void 0) ?? "unknown";
+  const logged = env2.logged === true || env2.degraded === true;
   const suffix = logged ? " (logged)" : "";
   fail(EXIT.ERROR, `memory consolidate did not run: ${reason}${suffix}`, opts);
 }
@@ -3585,10 +3725,10 @@ var init_release = __esm({
 import { spawn } from "child_process";
 import { basename } from "path";
 function isEligibleForShellFallback(name, opts = {}) {
-  const { env = process.env, platform = process.platform } = opts;
+  const { env: env2 = process.env, platform = process.platform } = opts;
   if (platform === "win32") return false;
   if (name.length === 0 || name.includes("/") || !NAME_RE.test(name)) return false;
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   if (!shell || shell.length === 0) return false;
   return SUPPORTED_SHELLS.has(basename(shell).toLowerCase());
 }
@@ -3651,9 +3791,9 @@ function probeCommand(name, shell, opts) {
   });
 }
 async function resolveCommandViaShell(name, opts = {}) {
-  const { env = process.env } = opts;
+  const { env: env2 = process.env } = opts;
   if (!isEligibleForShellFallback(name, opts)) return { kind: "unsupported" };
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   const cached = pathCache.get(`${shell}:${name}`);
   if (cached) return { kind: "path", path: cached, shell };
   const probe = await probeCommand(name, shell, opts);
@@ -3954,24 +4094,24 @@ var init_orchestrator = __esm({
 });
 
 // src/run-profiles.ts
-import { loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo10(root).config;
+    return loadProjectInfo11(root).config;
   } catch {
     return null;
   }
 }
-function expandEnvVars(value, env) {
+function expandEnvVars(value, env2) {
   return value.replace(
     /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,
-    (match, name) => env[name] !== void 0 ? env[name] : match
+    (match, name) => env2[name] !== void 0 ? env2[name] : match
   );
 }
-function resolveRunProfile(requested, config, env) {
+function resolveRunProfile(requested, config, env2) {
   const profiles = config.run?.profiles ?? {};
   const names = Object.keys(profiles);
-  const name = requested ?? env.NOIR_PROFILE ?? config.run?.defaultProfile;
+  const name = requested ?? env2.NOIR_PROFILE ?? config.run?.defaultProfile;
   if (name === void 0 || name.length === 0) {
     return { ok: true, profile: {} };
   }
@@ -3986,7 +4126,7 @@ function resolveRunProfile(requested, config, env) {
   const envExpanded = {};
   if (profile.env) {
     for (const [k, v] of Object.entries(profile.env)) {
-      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env);
+      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env2);
     }
   }
   return {
@@ -4010,10 +4150,24 @@ var init_run_profiles = __esm({
 });
 
 // src/commands/run.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
 import { SUPPORTED_HOSTS } from "@noir-ai/adapters";
-import { parseConfig } from "@noir-ai/core";
+import { loadNoirEnv as loadNoirEnv2, NOIR_DIR as NOIR_DIR2, parseConfig } from "@noir-ai/core";
+function credentialNote(env2, sources) {
+  const named = CREDENTIAL_ENV_VARS.filter((name) => {
+    const value = env2[name];
+    return value !== void 0 && value.length > 0;
+  }).map(
+    (name) => `${name} (from ${sources[name] === "file" ? `${NOIR_DIR2}/.env` : "the environment"})`
+  );
+  if (named.length === 0) return "";
+  const one = named.length === 1;
+  const subject = one ? `${named[0]} is set` : `${named.join(", ")} are set`;
+  const pronoun = one ? "it" : "them";
+  const verb = one ? "overrides" : "override";
+  return ` Note: ${subject} \u2014 ${pronoun} ${verb} the logged-in account in \`-p\` mode; unset ${pronoun} in the named source (or fix the value) if you meant to use your subscription.`;
+}
 function formatUsage(u) {
   const cost = u.totalCostUsd > 0 ? ` $${u.totalCostUsd.toFixed(2)}` : "";
   const turns = u.numTurns > 0 ? ` \xB7 ${u.numTurns} turns` : "";
@@ -4037,13 +4191,21 @@ async function run(prompt, opts) {
     const usage = selectors.length > 0 ? `noir run ${selectors.join(" ")} <prompt>` : "noir run <prompt>";
     fail(EXIT.USAGE, `a prompt is required: \`${usage}\``, opts);
   }
-  const config = loadRunConfig(process.cwd()) ?? parseConfig({});
+  const root = process.cwd();
+  const envSources = loadNoirEnv2(root).sources;
+  const config = loadRunConfig(root) ?? parseConfig({});
   const resolved = resolveRunProfile(opts.profile, config, process.env);
   if (!resolved.ok) fail(EXIT.USAGE, resolved.message, opts);
   const profile = resolved.profile;
   const customBinary = opts.command ?? profile.binary;
   const extraArgs = profile.args;
-  const env = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  const env2 = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  if (!existsSync2(join4(root, NOIR_DIR2, ".env"))) {
+    log(
+      `This project has no ${NOIR_DIR2}/.env \u2014 that is where Noir reads project credentials and run config from. Run \`noir init\` to scaffold one (\`noir run\` works without it).`,
+      opts
+    );
+  }
   const transcriptLines = [];
   let result;
   try {
@@ -4052,7 +4214,7 @@ async function run(prompt, opts) {
       prompt,
       customBinary,
       extraArgs,
-      env,
+      env: env2,
       onLine: (line) => transcriptLines.push(line),
       onEvent: (event) => streamEvent(event, opts)
     });
@@ -4073,9 +4235,7 @@ async function run(prompt, opts) {
     let message = `host '${binary}' failed (exit ${result.exitCode}): ${reason}`;
     if (isAuth) {
       message += ` Open a terminal and run \`${binary} /login\` (interactive-only \u2014 it cannot run inside \`noir run\`), then retry.`;
-      if (process.env.ANTHROPIC_API_KEY) {
-        message += ` Note: ANTHROPIC_API_KEY is set in your environment \u2014 it overrides the logged-in account in \`-p\` mode; unset it (or fix the key) if you meant to use your subscription.`;
-      }
+      message += credentialNote(env2 ?? process.env, envSources);
     }
     message += ` If you use another profile, pass \`--command <binary>\` or define a run profile under run.profiles. transcript: ${transcript}`;
     fail(EXIT.ERROR, message, opts);
@@ -4115,18 +4275,24 @@ function writeTranscript(host, lines) {
   }
   return file;
 }
+var CREDENTIAL_ENV_VARS;
 var init_run = __esm({
   "src/commands/run.ts"() {
     "use strict";
     init_orchestrator();
     init_output();
     init_run_profiles();
+    CREDENTIAL_ENV_VARS = [
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "ANTHROPIC_BASE_URL"
+    ];
   }
 });
 
 // src/commands/skills.ts
 import { resolveAdapter as resolveAdapter3 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -4194,7 +4360,7 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo11(root);
+    project = loadProjectInfo12(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -4720,7 +4886,7 @@ var init_dedup_write = __esm({
 
 // src/init.ts
 import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir2 } from "@noir-ai/skills";
 async function init(root, opts) {
@@ -4749,7 +4915,7 @@ async function init(root, opts) {
   await emitHostSkills(root, host, conflictOpts, interactive);
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo12(root);
+    projectInfo = loadProjectInfo13(root);
   } catch {
     projectInfo = void 0;
   }
@@ -4768,7 +4934,10 @@ function reportPlannedWrites(res) {
   log("Dry run \u2014 no files were written.");
   if (res.written.length > 0) {
     log("Planned writes:");
-    for (const p of res.written) log(`  ${p}`);
+    for (const p of res.written) {
+      const mode = res.fileModes?.[p];
+      log(mode === void 0 ? `  ${p}` : `  ${p} (mode ${mode.toString(8).padStart(3, "0")})`);
+    }
   }
   if (res.skipped.length > 0) {
     log("Would leave as-is (already present):");
@@ -4836,11 +5005,11 @@ var init_init = __esm({
 });
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning2, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo13(process.cwd());
+  const project = loadProjectInfo14(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -4848,10 +5017,11 @@ async function serve(opts) {
   try {
     const { url } = await ensureDaemonRunning2({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     process.stderr.write(
-      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.)
+      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.) Add the daemon's bearer token via the host MCP headersHelper (run \`noir daemon token\`).
 `
     );
   } catch (err) {
@@ -4875,7 +5045,7 @@ __export(create_exports, {
 });
 import { resolve } from "path";
 import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
 import { scaffold as scaffold2 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir3 } from "@noir-ai/skills";
 async function create(dir, opts) {
@@ -4926,7 +5096,7 @@ async function create(dir, opts) {
   }
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo14(root);
+    projectInfo = loadProjectInfo15(root);
   } catch {
     projectInfo = void 0;
   }
@@ -4952,9 +5122,9 @@ var sync_exports = {};
 __export(sync_exports, {
   sync: () => sync
 });
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo15, paths } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo16, paths } from "@noir-ai/core";
 import { scaffold as scaffold3 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir4 } from "@noir-ai/skills";
 async function sync(root, opts = {}) {
@@ -4963,7 +5133,7 @@ async function sync(root, opts = {}) {
   const conflictOpts = buildConflictOpts({ force: opts.force, interactive });
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo15(root);
+    projectInfo = loadProjectInfo16(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5021,9 +5191,9 @@ async function sync(root, opts = {}) {
 }
 function resolveSyncHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
-  if (!existsSync2(paths.config(root))) return "claude";
+  if (!existsSync3(paths.config(root))) return "claude";
   try {
-    return loadProjectInfo15(root).config.host;
+    return loadProjectInfo16(root).config.host;
   } catch {
     return "claude";
   }
@@ -5140,6 +5310,7 @@ function createProgram() {
         );
       }
     }
+    if (actionCmd.name() === "env") captureAmbientEnv();
     applyNoirEnv2(process.cwd());
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
@@ -5282,6 +5453,9 @@ function createProgram() {
   daemonGrp.command("status").description("report daemon pid/uptime/mode (exit 4 if not running)").action(async (...args) => {
     await daemonStatus(toCliOptions(trailingCmd(args).optsWithGlobals()));
   });
+  daemonGrp.command("token").description("print the daemon bearer token to stdout (for a host headersHelper)").action(async (...args) => {
+    await daemonToken(toCliOptions(trailingCmd(args).optsWithGlobals()));
+  });
   daemonGrp.command("restart").description("stop then start the daemon").option("--detach", "run the daemon in the background and exit").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
@@ -5291,8 +5465,19 @@ function createProgram() {
     });
   });
   daemonGrp.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart|token");
   });
+  daemonGrp.addHelpText(
+    "after",
+    [
+      "",
+      "Shared workspaces (two repos, one product \u2014 e.g. backend + frontend):",
+      "  noir daemon start --workspace <name> --detach   found a workspace from this repo",
+      "  noir daemon join <name>                         join it from the other repo",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   const workspaceGrp = program2.command("workspace").description("shared cross-repo workspaces");
   workspaceGrp.command("list").description("list workspaces on this machine").action(async (...args) => {
     await workspaceList(toCliOptions(trailingCmd(args).optsWithGlobals()));
@@ -5321,6 +5506,17 @@ function createProgram() {
       ...name !== void 0 ? { name } : {}
     });
   });
+  workspaceGrp.addHelpText(
+    "after",
+    [
+      "",
+      "This group only inspects and leaves workspaces. To CREATE or JOIN one:",
+      "  noir daemon start --workspace <name> --detach   found it (from the first repo)",
+      "  noir daemon join <name>                         join it (from the second repo)",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   workspaceGrp.action(() => {
     throw new NoirCliError(EXIT.USAGE, "Usage: noir workspace list|status|leave|stop");
   });
@@ -5335,6 +5531,9 @@ function createProgram() {
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
   });
+  program2.command("env").description("which configuration is in effect and where each value comes from").action(async (...args) => {
+    await env(toCliOptions(actionGlobals(args)));
+  });
   const contextGrp = program2.command("context").description("context engine");
   contextGrp.command("search").description("hybrid search over the indexed context").argument("<query>", "search query").option("--limit <n>", "max results", "10").action(async (...args) => {
     const cmd = trailingCmd(args);
@@ -5720,6 +5919,7 @@ var init_bin = __esm({
     init_context();
     init_daemon();
     init_doctor();
+    init_env();
     init_handoff();
     init_home();
     init_memory();
@@ -5769,7 +5969,7 @@ var init_bin = __esm({
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { ContextEngine, createEmbedFn, resolveEmbedderConfig } from "@noir-ai/context";
 import {
-  loadProjectInfo as loadProjectInfo16,
+  loadProjectInfo as loadProjectInfo17,
   NOIR_VERSION as NOIR_VERSION5,
   readWorkspaceMarker as readWorkspaceMarker2,
   workspaceStoreDbPath
@@ -5777,9 +5977,11 @@ import {
 import {
   ensureDaemonRunning as ensureDaemonRunning3,
   pidAlive as pidAlive3,
-  readDaemonRecord as readDaemonRecord2,
+  readDaemonToken as readDaemonToken2,
+  readProjectDaemonRecord as readProjectDaemonRecord2,
   readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
-  resolveGateConfig
+  resolveGateConfig,
+  tokenPath
 } from "@noir-ai/daemon";
 import { createMemoryEngine } from "@noir-ai/memory";
 import { openStore } from "@noir-ai/store";
@@ -5800,7 +6002,18 @@ function failDaemonDown(opts, cause) {
   fail(EXIT.DAEMON_DOWN, DAEMON_DOWN_HINT, opts);
 }
 async function probeDaemon(opts = {}) {
-  const rec = readDaemonRecord2();
+  const expectedProject = opts.project?.id ?? (() => {
+    try {
+      return loadProjectInfo17(process.cwd()).id;
+    } catch {
+      return void 0;
+    }
+  })();
+  if (expectedProject === void 0) {
+    if (opts.verbose) process.stderr.write("noir: daemon probe: no project (uninitialized)\n");
+    return { running: false };
+  }
+  const rec = readProjectDaemonRecord2(expectedProject);
   if (!rec) {
     if (opts.verbose) process.stderr.write("noir: daemon probe: no daemon record\n");
     return { running: false };
@@ -5821,19 +6034,10 @@ async function probeDaemon(opts = {}) {
     }
     const body = await res.json().catch(() => null);
     const pidOk = typeof body?.pid === "number" && body.pid === rec.pid;
-    const expectedProject = opts.project?.id ?? (() => {
-      try {
-        return loadProjectInfo16(process.cwd()).id;
-      } catch {
-        return void 0;
-      }
-    })();
-    const projectOk = expectedProject === void 0 || body?.projectId !== void 0 && body.projectId === expectedProject;
-    if (body?.ok !== true || !pidOk || !projectOk) {
+    if (body?.ok !== true || !pidOk) {
       if (opts.verbose)
         process.stderr.write(
-          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : !projectOk ? `noir: daemon probe: daemon serves a different project (${body?.projectId ?? "unknown"}); using in-process fallback
-` : "noir: daemon probe: /health body not ok\n"
+          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : "noir: daemon probe: /health body not ok\n"
         );
       return { running: false };
     }
@@ -5853,25 +6057,112 @@ async function probeDaemon(opts = {}) {
 async function resolveDaemon(opts) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo16(process.cwd());
+    project = opts.project ?? loadProjectInfo17(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
   const idleTimeoutSec = opts.idleTimeoutSec ?? project.config.daemon.idleTimeoutSec;
+  const preferred = project.config.daemon.port;
+  if (preferred !== void 0 && preferred !== 0) {
+    const direct = `http://127.0.0.1:${preferred}/mcp`;
+    const probe = newClient();
+    let probeTimer;
+    try {
+      await Promise.race([
+        probe.connect(httpTransport(direct, project.id)),
+        new Promise((_, reject) => {
+          probeTimer = setTimeout(
+            () => reject(new Error(`no response within ${PROBE_TIMEOUT_MS}ms`)),
+            PROBE_TIMEOUT_MS
+          );
+        })
+      ]);
+      return { client: probe, stop: async () => {
+      } };
+    } catch (err) {
+      if (opts.verbose) {
+        process.stderr.write(
+          `noir: no daemon at the configured port ${preferred} (${describeCause(err)})
+`
+        );
+      }
+      await probe.close().catch(() => {
+      });
+    } finally {
+      if (probeTimer !== void 0) clearTimeout(probeTimer);
+    }
+  }
+  let url;
+  let stop;
   try {
-    const ensured = await ensureDaemonRunning3({ project, idleTimeoutSec });
-    return { url: ensured.url, stop: ensured.stop };
+    const ensured = await ensureDaemonRunning3({
+      project,
+      idleTimeoutSec,
+      ...preferred !== void 0 ? { port: preferred } : {}
+    });
+    url = ensured.url;
+    stop = ensured.stop;
   } catch (err) {
     failDaemonDown(opts, err);
   }
+  const client = newClient();
+  try {
+    await connectClient(client, url, opts, project.id);
+  } catch (err) {
+    await client.close().catch(() => {
+    });
+    await stop().catch(() => {
+    });
+    throw err;
+  }
+  return { client, stop };
 }
-async function connectClient(client, url, opts) {
+function httpTransport(url, scopeKey) {
+  const token = scopeKey === null ? null : readDaemonToken2(scopeKey);
+  return new StreamableHTTPClientTransport(
+    new URL(url),
+    // Verified present: StreamableHTTPClientTransportOptions.requestInit?: RequestInit
+    token ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {}
+  );
+}
+function callerScopeKey(opts) {
+  try {
+    return (opts.project ?? loadProjectInfo17(process.cwd())).id;
+  } catch {
+    return null;
+  }
+}
+function newClient() {
+  return new Client(
+    { name: "noir-cli", version: NOIR_VERSION5 },
+    { versionNegotiation: { mode: "auto" } }
+  );
+}
+async function connectRaw(client, url, scopeKey) {
+  await client.connect(httpTransport(url, scopeKey));
+}
+async function connectClient(client, url, opts, scopeKey) {
   try {
-    await client.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connectRaw(client, url, scopeKey);
   } catch (err) {
     failDaemonDown(opts, err);
   }
 }
+function failWorkspaceConnect(opts, routing, cause) {
+  const text = String(cause).toLowerCase();
+  if (text.includes("401") || text.includes("unauthorized")) {
+    if (opts.verbose) {
+      process.stderr.write(`noir: daemon transport detail: ${describeCause(cause)}
+`);
+    }
+    fail(
+      EXIT.DAEMON_DOWN,
+      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
+      opts
+    );
+  }
+  failDaemonDown(opts, cause);
+}
 async function callToolParse(client, opts, name, args) {
   const result = await client.callTool({ name, arguments: args }).catch((err) => failDaemonDown(opts, err));
   const block = result.content?.[0];
@@ -5902,21 +6193,12 @@ function buildCaller(client, opts) {
   };
 }
 async function withDaemon(opts, fn) {
-  const { url, stop } = await resolveDaemon(opts);
-  let client;
+  const { client, stop } = await resolveDaemon(opts);
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION5 },
-      { versionNegotiation: { mode: "auto" } }
-    );
-    const connected = client;
-    await connectClient(connected, url, opts);
-    return await fn(buildCaller(connected, opts));
+    return await fn(buildCaller(client, opts));
   } finally {
-    if (client) {
-      await client.close().catch(() => {
-      });
-    }
+    await client.close().catch(() => {
+    });
     await stop().catch(() => {
     });
   }
@@ -5927,12 +6209,9 @@ async function withRunningDaemon(opts, fn, probe) {
   const url = `http://127.0.0.1:${p.port}/mcp`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION5 },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connected.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connected.connect(httpTransport(url, callerScopeKey(opts)));
     return await fn(buildCaller(connected, opts));
   } catch {
     return null;
@@ -5949,7 +6228,7 @@ async function callDaemonTool(opts, name, args = {}) {
 async function withInProcessRead(opts, fn) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo16(process.cwd());
+    project = opts.project ?? loadProjectInfo17(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -5996,7 +6275,7 @@ function workspaceRoutingTarget(root) {
   const name = readWorkspaceMarker2(root);
   if (name === null) return null;
   try {
-    return { name, projectId: loadProjectInfo16(root).id };
+    return { name, projectId: loadProjectInfo17(root).id };
   } catch {
     return null;
   }
@@ -6030,12 +6309,11 @@ async function withWorkspaceDaemon(opts, routing, fn) {
   const url = `http://127.0.0.1:${probe.port}/mcp?p=${routing.projectId}`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION5 },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connectClient(connected, url, opts);
+    await connectRaw(connected, url, routing.name).catch(
+      (err) => failWorkspaceConnect(opts, routing, err)
+    );
     return await fn(buildCaller(connected, opts));
   } finally {
     if (client) {
@@ -6089,22 +6367,23 @@ var init_daemon_client = __esm({
 
 // src/commands/doctor.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
 import { dirname, join as join6, relative } from "path";
 import { fileURLToPath } from "url";
 import { resolveAdapter as resolveAdapter7 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod4,
   latestVersionFromCache as latestVersionFromCache2,
-  loadProjectInfo as loadProjectInfo17,
+  loadNoirEnv as loadNoirEnv3,
+  loadProjectInfo as loadProjectInfo18,
   NOIR_VERSION as NOIR_VERSION6,
   paths as paths2,
   readInstallRecord as readInstallRecord4,
   readUpdateCache as readUpdateCache3
 } from "@noir-ai/core";
 import { CURRENT_SCAFFOLD_VERSION, readScaffoldVersion } from "@noir-ai/create";
-import { pidAlive as pidAlive4, readDaemonRecord as readDaemonRecord3 } from "@noir-ai/daemon";
-import { resolveModelConfig } from "@noir-ai/model";
+import { pidAlive as pidAlive4, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
+import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
 async function probeOnnx() {
   try {
     const spec = "onnxruntime-node";
@@ -6140,7 +6419,7 @@ async function checkRuntime(checks) {
 }
 function checkConfig(root) {
   const configPath = paths2.config(root);
-  if (!existsSync3(configPath)) {
+  if (!existsSync4(configPath)) {
     return {
       project: void 0,
       result: {
@@ -6151,7 +6430,7 @@ function checkConfig(root) {
     };
   }
   try {
-    const project = loadProjectInfo17(root);
+    const project = loadProjectInfo18(root);
     return {
       project,
       result: {
@@ -6167,8 +6446,16 @@ function checkConfig(root) {
     };
   }
 }
-async function checkDaemon(checks) {
-  const rec = readDaemonRecord3();
+async function checkDaemon(checks, project) {
+  if (project === void 0) {
+    checks.push({
+      name: "daemon",
+      status: "warn",
+      detail: "skipped \u2014 project not initialized"
+    });
+    return;
+  }
+  const rec = readProjectDaemonRecord3(project.id);
   if (!rec) {
     checks.push({
       name: "daemon",
@@ -6232,7 +6519,7 @@ async function checkStore(checks, project, root) {
     return;
   }
   const dbPath = paths2.storeDb(root, project.id);
-  if (!existsSync3(dbPath)) {
+  if (!existsSync4(dbPath)) {
     checks.push({
       name: "store",
       status: "warn",
@@ -6260,7 +6547,7 @@ async function checkStore(checks, project, root) {
     }
   }
 }
-function checkNoirEnv(checks, root) {
+function checkNoirEnv(checks, root, loaded) {
   const path = join6(paths2.noirDir(root), ".env");
   let st;
   try {
@@ -6268,6 +6555,14 @@ function checkNoirEnv(checks, root) {
   } catch {
     return;
   }
+  if (loaded.warnings.some((w) => w.startsWith(ENV_REFUSAL_PREFIX))) {
+    checks.push({
+      name: "noir-env",
+      status: "warn",
+      detail: `${path} is tracked by git \u2014 refused, so NONE of its keys are in effect. Fix: add \`.noir/.env\` to .gitignore and run \`git rm --cached .noir/.env\`.`
+    });
+    return;
+  }
   const mode = st.mode & 511;
   const tooOpen = (st.mode & 63) !== 0;
   checks.push(
@@ -6277,6 +6572,10 @@ function checkNoirEnv(checks, root) {
       detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
     } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
   );
+  for (const [key, source] of Object.entries(loaded.sources)) {
+    if (source !== "file") continue;
+    checks.push({ name: `noir-env:${key}`, status: "ok", detail: "from .noir/.env" });
+  }
 }
 function checkEmbedder(checks, project, vecOk) {
   if (!project) {
@@ -6308,12 +6607,12 @@ function checkEmbedder(checks, project, vecOk) {
     detail: `${kind}/${model} (${emb.dim}-dim) \xB7 vec backend available`
   });
 }
-function checkProvider(checks, project) {
+function checkProvider(checks, project, sources) {
   if (!project) {
     checks.push({ name: "provider", status: "warn", detail: "skipped \u2014 not initialized" });
     return;
   }
-  const resolved = resolveModelConfig(project.config.model);
+  const resolved = resolveModelConfig2(project.config.model);
   const names = Object.keys(resolved.providers);
   if (names.length === 0) {
     checks.push({
@@ -6328,7 +6627,8 @@ function checkProvider(checks, project) {
   for (const name of names) {
     const p = resolved.providers[name];
     if (!p) continue;
-    const key = p.hasKey ? "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
+    const fromFile = p.apiKeyEnv !== void 0 && sources[p.apiKeyEnv] === "file";
+    const key = p.hasKey ? fromFile ? "key present (from .noir/.env)" : "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
     if (!p.hasKey && p.apiKeyEnv) missing = true;
     parts.push(`${name}/${p.model ?? "?"} (${key})`);
   }
@@ -6371,7 +6671,7 @@ function checkRulesMdBudget(checks, root, project) {
     return null;
   }
   const rulesPath = paths2.rulesMd(root);
-  if (!existsSync3(rulesPath)) {
+  if (!existsSync4(rulesPath)) {
     checks.push({
       name: "rules budget",
       status: "ok",
@@ -6435,7 +6735,7 @@ function checkHostArtifacts(checks, root, project) {
   if (host === "claude") expected.push("CLAUDE.md");
   else if (host === "gemini") expected.push("GEMINI.md");
   expected.push(relOr(adapter.mcpConfigPath?.(ectx) ?? ".mcp.json", root));
-  const missing = expected.filter((p) => !existsSync3(joinRoot(root, p)));
+  const missing = expected.filter((p) => !existsSync4(joinRoot(root, p)));
   const status2 = missing.length === 0 ? "ok" : "warn";
   const detail = missing.length === 0 ? `host=${host} \xB7 all ${expected.length} primary artifacts present` : `host=${host} \xB7 missing ${missing.join(", ")} (run \`noir sync\` to restore)`;
   checks.push({ name: "host artifacts", status: status2, detail });
@@ -6452,7 +6752,7 @@ function checkNestedNoir(checks, root) {
     ".noir/.npmignore",
     ".noir/.prettierignore"
   ];
-  const found = candidates.filter((rel) => existsSync3(join6(root, rel)));
+  const found = candidates.filter((rel) => existsSync4(join6(root, rel)));
   const detected = found.length > 0;
   checks.push({
     name: "nested .noir",
@@ -6466,7 +6766,7 @@ function collectDedupCandidates(root) {
   const out = [];
   for (const rel of rels) {
     const abs = join6(root, rel);
-    if (!existsSync3(abs)) continue;
+    if (!existsSync4(abs)) continue;
     let text;
     try {
       text = readFileSync4(abs, "utf8");
@@ -6527,12 +6827,12 @@ function resolveWorkspacePackagesDir() {
   let here = dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
     const pkgPath = join6(here, "package.json");
-    if (existsSync3(pkgPath)) {
+    if (existsSync4(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
         if (pkg.name === "@noir-ai/cli") {
           const packagesDir = dirname(here);
-          if (existsSync3(join6(dirname(packagesDir), "pnpm-workspace.yaml"))) {
+          if (existsSync4(join6(dirname(packagesDir), "pnpm-workspace.yaml"))) {
             return packagesDir;
           }
           return null;
@@ -6591,7 +6891,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
   let cliDir = null;
   for (const name of entries) {
     const pkgPath = join6(packagesDir, name, "package.json");
-    if (!existsSync3(pkgPath)) continue;
+    if (!existsSync4(pkgPath)) continue;
     let pkg;
     try {
       pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
@@ -6691,12 +6991,13 @@ async function doctor(opts = {}) {
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
-  await checkDaemon(checks);
+  await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
   checkEmbedder(checks, project, vecOk);
-  checkProvider(checks, project);
-  checkNoirEnv(checks, root);
+  const noirEnv = loadNoirEnv3(root);
+  checkProvider(checks, project, noirEnv.sources);
+  checkNoirEnv(checks, root, noirEnv);
   const scaffold4 = checkScaffoldVersion(checks, root);
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
@@ -6739,13 +7040,14 @@ async function doctor(opts = {}) {
     );
   }
 }
-var SEMVER_ISH;
+var ENV_REFUSAL_PREFIX, SEMVER_ISH;
 var init_doctor = __esm({
   "src/commands/doctor.ts"() {
     "use strict";
     init_daemon_client();
     init_output();
     init_theme();
+    ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
     SEMVER_ISH = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
   }
 });