@noir-ai/cli 1.13.0 → 1.14.0

package/dist/tui/{chunk-KMLSJRYV.js → chunk-6LO4LXEH.js}

@@ -28,13 +28,13 @@ import {
 } from "./chunk-ESZTOQEC.js";
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo13, NOIR_VERSION as NOIR_VERSION5 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo14, NOIR_VERSION as NOIR_VERSION5 } from "@noir-ai/core";
 
 // src/daemon-client.ts
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { ContextEngine, createEmbedFn, resolveEmbedderConfig } from "@noir-ai/context";
 import {
-  loadProjectInfo as loadProjectInfo12,
+  loadProjectInfo as loadProjectInfo13,
   NOIR_VERSION as NOIR_VERSION4,
   readWorkspaceMarker as readWorkspaceMarker2,
   workspaceStoreDbPath
@@ -42,9 +42,11 @@ import {
 import {
   ensureDaemonRunning as ensureDaemonRunning3,
   pidAlive as pidAlive4,
-  readDaemonRecord as readDaemonRecord3,
+  readDaemonToken as readDaemonToken2,
+  readProjectDaemonRecord as readProjectDaemonRecord3,
   readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
-  resolveGateConfig
+  resolveGateConfig,
+  tokenPath
 } from "@noir-ai/daemon";
 import { createMemoryEngine } from "@noir-ai/memory";
 import { openStore } from "@noir-ai/store";
@@ -225,10 +227,11 @@ function renderStatus(data, opts) {
 // src/commands/daemon.ts
 import { loadProjectInfo as loadProjectInfo2 } from "@noir-ai/core";
 import {
-  clearDaemonRecord,
+  clearProjectDaemonRecord,
   ensureDaemonRunning,
   pidAlive as pidAlive2,
-  readDaemonRecord,
+  readDaemonToken,
+  readProjectDaemonRecord,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
 
@@ -584,7 +587,8 @@ async function daemonStart(opts) {
   if (opts.detachChild === true) {
     const child = await ensureDaemonRunning({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     if (child.started) {
       if (opts.json === true) {
@@ -607,7 +611,7 @@ async function daemonStart(opts) {
     return;
   }
   if (opts.detach === true) {
-    const existing = readDaemonRecord();
+    const existing = readProjectDaemonRecord(project.id);
     if (existing && pidAlive2(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
@@ -647,7 +651,8 @@ async function daemonStart(opts) {
   try {
     ensured = await ensureDaemonRunning({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
   } catch (err) {
     ds.fail("Daemon failed to start");
@@ -690,7 +695,19 @@ async function daemonStart(opts) {
   log(`Noir daemon already running at ${ensured.url}`, opts);
 }
 async function daemonStop(opts) {
-  const rec = readDaemonRecord();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    if (opts.json === true) {
+      process.stdout.write(
+        `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
+`
+      );
+      return;
+    }
+    info("No Noir daemon is running for this directory (not a Noir project).", opts);
+    return;
+  }
+  const rec = readProjectDaemonRecord(callerProject);
   if (!rec) {
     if (opts.json === true) {
       process.stdout.write(
@@ -705,9 +722,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const callerProject = resolveCallerProjectId();
-  const wrongProject = rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject;
-  const healthy = !wrongProject && pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, rec.projectId === void 0 ? void 0 : callerProject);
+  const healthy = pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -716,7 +731,7 @@ async function daemonStop(opts) {
       errMsg2 = err instanceof Error ? err.message : String(err);
     }
   }
-  if (!wrongProject) clearDaemonRecord();
+  clearProjectDaemonRecord(callerProject);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({
@@ -735,26 +750,22 @@ async function daemonStop(opts) {
   if (signalled) {
     ds.succeed(`Stopped Noir daemon (pid ${rec.pid})`);
   } else {
-    const reason = wrongProject ? "the daemon belongs to another project (left running)" : errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
+    const reason = errMsg2 !== void 0 ? errMsg2 : "the recorded pid did not answer as our daemon (stale record cleared)";
     ds.warn(`Daemon (pid ${rec.pid}) could not be signalled: ${reason}`);
     info(`Noir daemon (pid ${rec.pid}) could not be signalled: ${reason}`, opts);
   }
 }
 async function daemonStatus(opts) {
-  const rec = readDaemonRecord();
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord(callerProject);
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  const callerProject = resolveCallerProjectId();
-  if (rec.projectId !== void 0 && callerProject !== void 0 && rec.projectId !== callerProject) {
-    fail(
-      EXIT.DAEMON_DOWN,
-      "Noir daemon is not running for this project (a daemon for another project is running).",
-      opts
-    );
-  }
   if (!pidAlive2(rec.pid)) {
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
   const hs = spinner("Probing daemon health...", opts).start();
@@ -772,7 +783,7 @@ async function daemonStatus(opts) {
   const pidOk = typeof health?.pid === "number" && health.pid === rec.pid;
   if (health?.ok !== true || !pidOk) {
     hs.fail("Daemon not responding");
-    clearDaemonRecord();
+    clearProjectDaemonRecord(callerProject);
     fail(
       EXIT.DAEMON_DOWN,
       health !== null && !pidOk ? "Noir daemon is not running (pid missing/mismatched \u2014 a foreign process holds the recorded port; stale record removed)." : "Noir daemon is not running (port unresponsive; stale record removed).",
@@ -788,7 +799,8 @@ async function daemonStatus(opts) {
     startedAt: rec.startedAt,
     uptimeSec,
     // Honest ownership: the detached child writes `mode:'detached'`; anything
-    // else (legacy record, foreground start) reports 'foreground'.
+    // else (a record written before the field existed, foreground start)
+    // reports 'foreground'.
     mode: rec.mode ?? MODE
   };
   if (opts.json === true) {
@@ -801,6 +813,42 @@ async function daemonStatus(opts) {
     opts
   );
 }
+async function daemonToken(opts) {
+  const callerProject = resolveCallerProjectId();
+  if (callerProject === void 0) {
+    fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (not a Noir project).", opts);
+  }
+  const rec = readProjectDaemonRecord(callerProject);
+  if (!rec) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (no daemon record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (!pidAlive2(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
+      opts
+    );
+  }
+  const token = readDaemonToken(callerProject);
+  if (token === null) {
+    fail(
+      EXIT.DAEMON_DOWN,
+      "Noir daemon is not running (the record has no token beside it \u2014 restart it with `noir daemon start`).",
+      opts
+    );
+  }
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify({ ok: true, data: { token } })}
+`);
+    return;
+  }
+  process.stdout.write(`${token}
+`);
+}
 async function daemonRestart(opts) {
   await daemonStop({ ...opts, json: false, quiet: true });
   await daemonStart(opts);
@@ -815,6 +863,7 @@ import { resolveAdapter as resolveAdapter2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod,
   latestVersionFromCache,
+  loadNoirEnv,
   loadProjectInfo as loadProjectInfo3,
   NOIR_VERSION,
   paths,
@@ -822,7 +871,7 @@ import {
   readUpdateCache
 } from "@noir-ai/core";
 import { CURRENT_SCAFFOLD_VERSION, readScaffoldVersion } from "@noir-ai/create";
-import { pidAlive as pidAlive3, readDaemonRecord as readDaemonRecord2 } from "@noir-ai/daemon";
+import { pidAlive as pidAlive3, readProjectDaemonRecord as readProjectDaemonRecord2 } from "@noir-ai/daemon";
 import { resolveModelConfig } from "@noir-ai/model";
 async function probeOnnx() {
   try {
@@ -886,8 +935,16 @@ function checkConfig(root) {
     };
   }
 }
-async function checkDaemon(checks) {
-  const rec = readDaemonRecord2();
+async function checkDaemon(checks, project) {
+  if (project === void 0) {
+    checks.push({
+      name: "daemon",
+      status: "warn",
+      detail: "skipped \u2014 project not initialized"
+    });
+    return;
+  }
+  const rec = readProjectDaemonRecord2(project.id);
   if (!rec) {
     checks.push({
       name: "daemon",
@@ -979,7 +1036,8 @@ async function checkStore(checks, project, root) {
     }
   }
 }
-function checkNoirEnv(checks, root) {
+var ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
+function checkNoirEnv(checks, root, loaded) {
   const path = join2(paths.noirDir(root), ".env");
   let st;
   try {
@@ -987,6 +1045,14 @@ function checkNoirEnv(checks, root) {
   } catch {
     return;
   }
+  if (loaded.warnings.some((w) => w.startsWith(ENV_REFUSAL_PREFIX))) {
+    checks.push({
+      name: "noir-env",
+      status: "warn",
+      detail: `${path} is tracked by git \u2014 refused, so NONE of its keys are in effect. Fix: add \`.noir/.env\` to .gitignore and run \`git rm --cached .noir/.env\`.`
+    });
+    return;
+  }
   const mode = st.mode & 511;
   const tooOpen = (st.mode & 63) !== 0;
   checks.push(
@@ -996,6 +1062,10 @@ function checkNoirEnv(checks, root) {
       detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
     } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
   );
+  for (const [key, source] of Object.entries(loaded.sources)) {
+    if (source !== "file") continue;
+    checks.push({ name: `noir-env:${key}`, status: "ok", detail: "from .noir/.env" });
+  }
 }
 function checkEmbedder(checks, project, vecOk) {
   if (!project) {
@@ -1027,7 +1097,7 @@ function checkEmbedder(checks, project, vecOk) {
     detail: `${kind}/${model} (${emb.dim}-dim) \xB7 vec backend available`
   });
 }
-function checkProvider(checks, project) {
+function checkProvider(checks, project, sources) {
   if (!project) {
     checks.push({ name: "provider", status: "warn", detail: "skipped \u2014 not initialized" });
     return;
@@ -1047,7 +1117,8 @@ function checkProvider(checks, project) {
   for (const name of names) {
     const p = resolved.providers[name];
     if (!p) continue;
-    const key = p.hasKey ? "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
+    const fromFile = p.apiKeyEnv !== void 0 && sources[p.apiKeyEnv] === "file";
+    const key = p.hasKey ? fromFile ? "key present (from .noir/.env)" : "key present" : p.apiKeyEnv ? `missing ${p.apiKeyEnv}` : "anonymous";
     if (!p.hasKey && p.apiKeyEnv) missing = true;
     parts.push(`${name}/${p.model ?? "?"} (${key})`);
   }
@@ -1411,12 +1482,13 @@ async function doctor(opts = {}) {
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
-  await checkDaemon(checks);
+  await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
   checkEmbedder(checks, project, vecOk);
-  checkProvider(checks, project);
-  checkNoirEnv(checks, root);
+  const noirEnv = loadNoirEnv(root);
+  checkProvider(checks, project, noirEnv.sources);
+  checkNoirEnv(checks, root, noirEnv);
   const scaffold2 = checkScaffoldVersion(checks, root);
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
@@ -1460,6 +1532,94 @@ async function doctor(opts = {}) {
   }
 }
 
+// src/commands/env.ts
+import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo4 } from "@noir-ai/core";
+import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
+var CURATED_AMBIENT_KEYS = [
+  "CLICKUP_API_TOKEN",
+  "OPENAI_API_KEY",
+  "VOYAGE_API_KEY",
+  "COHERE_API_KEY",
+  "OLLAMA_BASE_URL",
+  "ANTHROPIC_API_KEY",
+  "NOIR_PROFILE"
+];
+var ambientBaseline;
+function captureAmbientEnv(env2 = process.env) {
+  ambientBaseline = { ...env2 };
+}
+var SHORT_VALUE_MAX = 8;
+function redactShape(value) {
+  if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
+  return `${value.slice(0, 3)}\u2026(${value.length})`;
+}
+function configApiKeyEnvNames(root) {
+  try {
+    const project = loadProjectInfo4(root);
+    const names = /* @__PURE__ */ new Set();
+    for (const provider of Object.values(resolveModelConfig2(project.config.model).providers)) {
+      if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
+        names.add(provider.apiKeyEnv);
+      }
+    }
+    return [...names];
+  } catch {
+    return [];
+  }
+}
+function resolveEnv(root, ambientEnv) {
+  const { overlay, warnings, sources } = loadNoirEnv2(root, ambientEnv);
+  const curated = new Set(CURATED_AMBIENT_KEYS);
+  for (const name of configApiKeyEnvNames(root)) curated.add(name);
+  const candidates = new Set(Object.keys(sources));
+  for (const key of curated) {
+    if (ambientEnv[key] !== void 0) candidates.add(key);
+  }
+  const vars = [];
+  const shapes = {};
+  for (const key of [...candidates].sort()) {
+    const source = sources[key] ?? "env";
+    if (source === "env" && !curated.has(key)) continue;
+    const value = source === "file" ? overlay[key] ?? "" : ambientEnv[key] ?? "";
+    const shadowed = source === "file" && ambientEnv[key] !== void 0 && ambientEnv[key] !== value;
+    vars.push({
+      key,
+      source,
+      ...shadowed ? { shadowed: true } : {},
+      valueLength: value.length
+    });
+    shapes[key] = redactShape(value);
+  }
+  return { vars, warnings, shapes };
+}
+function describeSource(row) {
+  if (row.source !== "file") return "environment";
+  return row.shadowed === true ? ".noir/.env (shadows environment)" : ".noir/.env";
+}
+async function env(opts = {}) {
+  const report = resolveEnv(process.cwd(), ambientBaseline ?? process.env);
+  if (opts.json === true) {
+    json({ ok: true, data: { vars: report.vars, warnings: report.warnings } });
+    return;
+  }
+  if (report.vars.length === 0) {
+    info(
+      "nothing to report \u2014 .noir/.env defines no keys in effect and no Noir-relevant environment variable is set",
+      opts
+    );
+    return;
+  }
+  table(
+    report.vars.map((row) => ({
+      KEY: row.key,
+      SOURCE: describeSource(row),
+      VALUE: report.shapes[row.key] ?? ""
+    })),
+    ["KEY", "SOURCE", "VALUE"],
+    opts
+  );
+}
+
 // src/commands/handoff.ts
 import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
 import { join as join3 } from "path";
@@ -1468,12 +1628,12 @@ import {
   hostLaunchDirective,
   resolveAdapter as resolveAdapter3
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo5, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo6, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 
 // src/commands/task.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo4, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo5, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -1497,7 +1657,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo4(process.cwd());
+    const project = loadProjectInfo5(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -1821,7 +1981,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo4(process.cwd());
+    project = loadProjectInfo5(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2144,7 +2304,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo5(process.cwd());
+    project = loadProjectInfo6(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2193,7 +2353,7 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod2,
   latestVersionFromCache as latestVersionFromCache2,
-  loadProjectInfo as loadProjectInfo6,
+  loadProjectInfo as loadProjectInfo7,
   NOIR_VERSION as NOIR_VERSION2,
   readInstallRecord as readInstallRecord2,
   readUpdateCache as readUpdateCache2
@@ -2487,7 +2647,7 @@ async function resolveSections(commands) {
 // src/commands/home.ts
 function tryProject() {
   try {
-    const info2 = loadProjectInfo6(process.cwd());
+    const info2 = loadProjectInfo7(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -2651,7 +2811,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo6(process.cwd());
+        const info2 = loadProjectInfo7(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -2701,12 +2861,12 @@ ${COMMANDS_HINT}
 
 // src/commands/memory.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { loadProjectInfo as loadProjectInfo7 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo8 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo7(process.cwd()) };
+    return { routing, project: loadProjectInfo8(process.cwd()) };
   } catch {
     return null;
   }
@@ -3098,9 +3258,9 @@ async function memoryConsolidate(opts) {
     }
     return;
   }
-  const env = res;
-  const reason = (typeof env.reason === "string" ? env.reason : void 0) ?? (typeof env.error === "string" ? env.error : void 0) ?? "unknown";
-  const logged = env.logged === true || env.degraded === true;
+  const env2 = res;
+  const reason = (typeof env2.reason === "string" ? env2.reason : void 0) ?? (typeof env2.error === "string" ? env2.error : void 0) ?? "unknown";
+  const logged = env2.logged === true || env2.degraded === true;
   const suffix = logged ? " (logged)" : "";
   fail(EXIT.ERROR, `memory consolidate did not run: ${reason}${suffix}`, opts);
 }
@@ -3202,10 +3362,10 @@ async function release(opts) {
 }
 
 // src/commands/run.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
 import { SUPPORTED_HOSTS } from "@noir-ai/adapters";
-import { parseConfig } from "@noir-ai/core";
+import { loadNoirEnv as loadNoirEnv3, NOIR_DIR as NOIR_DIR2, parseConfig } from "@noir-ai/core";
 
 // src/orchestrator.ts
 import { spawn as spawn2 } from "child_process";
@@ -3219,10 +3379,10 @@ var PROBE_TIMEOUT_MS2 = 3e3;
 var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
 var SUPPORTED_SHELLS = /* @__PURE__ */ new Set(["zsh", "bash", "fish"]);
 function isEligibleForShellFallback(name, opts = {}) {
-  const { env = process.env, platform = process.platform } = opts;
+  const { env: env2 = process.env, platform = process.platform } = opts;
   if (platform === "win32") return false;
   if (name.length === 0 || name.includes("/") || !NAME_RE.test(name)) return false;
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   if (!shell || shell.length === 0) return false;
   return SUPPORTED_SHELLS.has(basename(shell).toLowerCase());
 }
@@ -3296,9 +3456,9 @@ function probeCommand(name, shell, opts) {
 }
 var pathCache = /* @__PURE__ */ new Map();
 async function resolveCommandViaShell(name, opts = {}) {
-  const { env = process.env } = opts;
+  const { env: env2 = process.env } = opts;
   if (!isEligibleForShellFallback(name, opts)) return { kind: "unsupported" };
-  const shell = env.SHELL;
+  const shell = env2.SHELL;
   const cached = pathCache.get(`${shell}:${name}`);
   if (cached) return { kind: "path", path: cached, shell };
   const probe = await probeCommand(name, shell, opts);
@@ -3569,24 +3729,24 @@ async function shellFallback(binary, args, opts, resolve, reject, originalErr) {
 }
 
 // src/run-profiles.ts
-import { loadProjectInfo as loadProjectInfo8 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo9 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo8(root).config;
+    return loadProjectInfo9(root).config;
   } catch {
     return null;
   }
 }
-function expandEnvVars(value, env) {
+function expandEnvVars(value, env2) {
   return value.replace(
     /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,
-    (match, name) => env[name] !== void 0 ? env[name] : match
+    (match, name) => env2[name] !== void 0 ? env2[name] : match
   );
 }
-function resolveRunProfile(requested, config, env) {
+function resolveRunProfile(requested, config, env2) {
   const profiles = config.run?.profiles ?? {};
   const names = Object.keys(profiles);
-  const name = requested ?? env.NOIR_PROFILE ?? config.run?.defaultProfile;
+  const name = requested ?? env2.NOIR_PROFILE ?? config.run?.defaultProfile;
   if (name === void 0 || name.length === 0) {
     return { ok: true, profile: {} };
   }
@@ -3601,7 +3761,7 @@ function resolveRunProfile(requested, config, env) {
   const envExpanded = {};
   if (profile.env) {
     for (const [k, v] of Object.entries(profile.env)) {
-      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env);
+      envExpanded[k] = v === null ? void 0 : expandEnvVars(v, env2);
     }
   }
   return {
@@ -3620,6 +3780,25 @@ function listProfiles(config) {
 }
 
 // src/commands/run.ts
+var CREDENTIAL_ENV_VARS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL"
+];
+function credentialNote(env2, sources) {
+  const named = CREDENTIAL_ENV_VARS.filter((name) => {
+    const value = env2[name];
+    return value !== void 0 && value.length > 0;
+  }).map(
+    (name) => `${name} (from ${sources[name] === "file" ? `${NOIR_DIR2}/.env` : "the environment"})`
+  );
+  if (named.length === 0) return "";
+  const one = named.length === 1;
+  const subject = one ? `${named[0]} is set` : `${named.join(", ")} are set`;
+  const pronoun = one ? "it" : "them";
+  const verb = one ? "overrides" : "override";
+  return ` Note: ${subject} \u2014 ${pronoun} ${verb} the logged-in account in \`-p\` mode; unset ${pronoun} in the named source (or fix the value) if you meant to use your subscription.`;
+}
 function formatUsage(u) {
   const cost = u.totalCostUsd > 0 ? ` $${u.totalCostUsd.toFixed(2)}` : "";
   const turns = u.numTurns > 0 ? ` \xB7 ${u.numTurns} turns` : "";
@@ -3643,13 +3822,21 @@ async function run(prompt, opts) {
     const usage = selectors.length > 0 ? `noir run ${selectors.join(" ")} <prompt>` : "noir run <prompt>";
     fail(EXIT.USAGE, `a prompt is required: \`${usage}\``, opts);
   }
-  const config = loadRunConfig(process.cwd()) ?? parseConfig({});
+  const root = process.cwd();
+  const envSources = loadNoirEnv3(root).sources;
+  const config = loadRunConfig(root) ?? parseConfig({});
   const resolved = resolveRunProfile(opts.profile, config, process.env);
   if (!resolved.ok) fail(EXIT.USAGE, resolved.message, opts);
   const profile = resolved.profile;
   const customBinary = opts.command ?? profile.binary;
   const extraArgs = profile.args;
-  const env = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  const env2 = profile.env ? mergeEnv(process.env, profile.env) : void 0;
+  if (!existsSync3(join4(root, NOIR_DIR2, ".env"))) {
+    log(
+      `This project has no ${NOIR_DIR2}/.env \u2014 that is where Noir reads project credentials and run config from. Run \`noir init\` to scaffold one (\`noir run\` works without it).`,
+      opts
+    );
+  }
   const transcriptLines = [];
   let result;
   try {
@@ -3658,7 +3845,7 @@ async function run(prompt, opts) {
       prompt,
       customBinary,
       extraArgs,
-      env,
+      env: env2,
       onLine: (line) => transcriptLines.push(line),
       onEvent: (event) => streamEvent(event, opts)
     });
@@ -3679,9 +3866,7 @@ async function run(prompt, opts) {
     let message = `host '${binary}' failed (exit ${result.exitCode}): ${reason}`;
     if (isAuth) {
       message += ` Open a terminal and run \`${binary} /login\` (interactive-only \u2014 it cannot run inside \`noir run\`), then retry.`;
-      if (process.env.ANTHROPIC_API_KEY) {
-        message += ` Note: ANTHROPIC_API_KEY is set in your environment \u2014 it overrides the logged-in account in \`-p\` mode; unset it (or fix the key) if you meant to use your subscription.`;
-      }
+      message += credentialNote(env2 ?? process.env, envSources);
     }
     message += ` If you use another profile, pass \`--command <binary>\` or define a run profile under run.profiles. transcript: ${transcript}`;
     fail(EXIT.ERROR, message, opts);
@@ -3724,7 +3909,7 @@ function writeTranscript(host, lines) {
 
 // src/commands/skills.ts
 import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo9 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -3820,7 +4005,7 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo9(root);
+    project = loadProjectInfo10(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3954,7 +4139,7 @@ async function skillsRegistry(opts) {
 
 // src/init.ts
 import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir2 } from "@noir-ai/skills";
 
@@ -4327,7 +4512,7 @@ async function init(root, opts) {
   await emitHostSkills(root, host, conflictOpts, interactive);
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo10(root);
+    projectInfo = loadProjectInfo11(root);
   } catch {
     projectInfo = void 0;
   }
@@ -4346,7 +4531,10 @@ function reportPlannedWrites(res) {
   log("Dry run \u2014 no files were written.");
   if (res.written.length > 0) {
     log("Planned writes:");
-    for (const p of res.written) log(`  ${p}`);
+    for (const p of res.written) {
+      const mode = res.fileModes?.[p];
+      log(mode === void 0 ? `  ${p}` : `  ${p} (mode ${mode.toString(8).padStart(3, "0")})`);
+    }
   }
   if (res.skipped.length > 0) {
     log("Would leave as-is (already present):");
@@ -4406,11 +4594,11 @@ function assertLocalhostUrl(raw) {
 }
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning2, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo11(process.cwd());
+  const project = loadProjectInfo12(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -4418,10 +4606,11 @@ async function serve(opts) {
   try {
     const { url } = await ensureDaemonRunning2({
       project,
-      idleTimeoutSec: project.config.daemon.idleTimeoutSec
+      idleTimeoutSec: project.config.daemon.idleTimeoutSec,
+      ...project.config.daemon.port !== void 0 ? { port: project.config.daemon.port } : {}
     });
     process.stderr.write(
-      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.)
+      `Noir daemon available at ${url}. (For HTTP clients, use this URL in .mcp.json.) Add the daemon's bearer token via the host MCP headersHelper (run \`noir daemon token\`).
 `
     );
   } catch (err) {
@@ -4534,6 +4723,7 @@ function createProgram() {
         );
       }
     }
+    if (actionCmd.name() === "env") captureAmbientEnv();
     applyNoirEnv2(process.cwd());
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
@@ -4583,7 +4773,7 @@ function createProgram() {
       const force = opts.force === true;
       const host = parseHost(opts.host);
       const dryRun = opts.dryRun === true || opts.preview === true;
-      const { create } = await import("./create-HYFBTBLR.js");
+      const { create } = await import("./create-FD4E626Z.js");
       const result = await create(dir, {
         transport,
         url: opts.url,
@@ -4622,7 +4812,7 @@ function createProgram() {
     ).choices(SUPPORTED_HOSTS2)
   ).action(
     async (opts, cmd) => {
-      const { sync } = await import("./sync-QDOJ7INZ.js");
+      const { sync } = await import("./sync-N633SQSS.js");
       const host = parseHost(opts.host);
       const force = opts.force === true;
       const merge = opts.merge === true;
@@ -4676,6 +4866,9 @@ function createProgram() {
   daemonGrp.command("status").description("report daemon pid/uptime/mode (exit 4 if not running)").action(async (...args) => {
     await daemonStatus(toCliOptions(trailingCmd(args).optsWithGlobals()));
   });
+  daemonGrp.command("token").description("print the daemon bearer token to stdout (for a host headersHelper)").action(async (...args) => {
+    await daemonToken(toCliOptions(trailingCmd(args).optsWithGlobals()));
+  });
   daemonGrp.command("restart").description("stop then start the daemon").option("--detach", "run the daemon in the background and exit").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
@@ -4685,8 +4878,19 @@ function createProgram() {
     });
   });
   daemonGrp.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir daemon start|join|stop|status|restart|token");
   });
+  daemonGrp.addHelpText(
+    "after",
+    [
+      "",
+      "Shared workspaces (two repos, one product \u2014 e.g. backend + frontend):",
+      "  noir daemon start --workspace <name> --detach   found a workspace from this repo",
+      "  noir daemon join <name>                         join it from the other repo",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   const workspaceGrp = program2.command("workspace").description("shared cross-repo workspaces");
   workspaceGrp.command("list").description("list workspaces on this machine").action(async (...args) => {
     await workspaceList(toCliOptions(trailingCmd(args).optsWithGlobals()));
@@ -4715,6 +4919,17 @@ function createProgram() {
       ...name !== void 0 ? { name } : {}
     });
   });
+  workspaceGrp.addHelpText(
+    "after",
+    [
+      "",
+      "This group only inspects and leaves workspaces. To CREATE or JOIN one:",
+      "  noir daemon start --workspace <name> --detach   found it (from the first repo)",
+      "  noir daemon join <name>                         join it (from the second repo)",
+      "",
+      "Guide: docs/how-to/shared-workspaces.md"
+    ].join("\n")
+  );
   workspaceGrp.action(() => {
     throw new NoirCliError(EXIT.USAGE, "Usage: noir workspace list|status|leave|stop");
   });
@@ -4729,6 +4944,9 @@ function createProgram() {
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
   });
+  program2.command("env").description("which configuration is in effect and where each value comes from").action(async (...args) => {
+    await env(toCliOptions(actionGlobals(args)));
+  });
   const contextGrp = program2.command("context").description("context engine");
   contextGrp.command("search").description("hybrid search over the indexed context").argument("<query>", "search query").option("--limit <n>", "max results", "10").action(async (...args) => {
     const cmd = trailingCmd(args);
@@ -5154,7 +5372,18 @@ function failDaemonDown(opts, cause) {
   fail(EXIT.DAEMON_DOWN, DAEMON_DOWN_HINT, opts);
 }
 async function probeDaemon(opts = {}) {
-  const rec = readDaemonRecord3();
+  const expectedProject = opts.project?.id ?? (() => {
+    try {
+      return loadProjectInfo13(process.cwd()).id;
+    } catch {
+      return void 0;
+    }
+  })();
+  if (expectedProject === void 0) {
+    if (opts.verbose) process.stderr.write("noir: daemon probe: no project (uninitialized)\n");
+    return { running: false };
+  }
+  const rec = readProjectDaemonRecord3(expectedProject);
   if (!rec) {
     if (opts.verbose) process.stderr.write("noir: daemon probe: no daemon record\n");
     return { running: false };
@@ -5175,19 +5404,10 @@ async function probeDaemon(opts = {}) {
     }
     const body = await res.json().catch(() => null);
     const pidOk = typeof body?.pid === "number" && body.pid === rec.pid;
-    const expectedProject = opts.project?.id ?? (() => {
-      try {
-        return loadProjectInfo12(process.cwd()).id;
-      } catch {
-        return void 0;
-      }
-    })();
-    const projectOk = expectedProject === void 0 || body?.projectId !== void 0 && body.projectId === expectedProject;
-    if (body?.ok !== true || !pidOk || !projectOk) {
+    if (body?.ok !== true || !pidOk) {
       if (opts.verbose)
         process.stderr.write(
-          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : !projectOk ? `noir: daemon probe: daemon serves a different project (${body?.projectId ?? "unknown"}); using in-process fallback
-` : "noir: daemon probe: /health body not ok\n"
+          !pidOk ? "noir: daemon probe: pid missing/mismatched (foreign process on recorded port)\n" : "noir: daemon probe: /health body not ok\n"
         );
       return { running: false };
     }
@@ -5207,25 +5427,112 @@ async function probeDaemon(opts = {}) {
 async function resolveDaemon(opts) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo12(process.cwd());
+    project = opts.project ?? loadProjectInfo13(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
   const idleTimeoutSec = opts.idleTimeoutSec ?? project.config.daemon.idleTimeoutSec;
+  const preferred = project.config.daemon.port;
+  if (preferred !== void 0 && preferred !== 0) {
+    const direct = `http://127.0.0.1:${preferred}/mcp`;
+    const probe = newClient();
+    let probeTimer;
+    try {
+      await Promise.race([
+        probe.connect(httpTransport(direct, project.id)),
+        new Promise((_, reject) => {
+          probeTimer = setTimeout(
+            () => reject(new Error(`no response within ${PROBE_TIMEOUT_MS}ms`)),
+            PROBE_TIMEOUT_MS
+          );
+        })
+      ]);
+      return { client: probe, stop: async () => {
+      } };
+    } catch (err) {
+      if (opts.verbose) {
+        process.stderr.write(
+          `noir: no daemon at the configured port ${preferred} (${describeCause(err)})
+`
+        );
+      }
+      await probe.close().catch(() => {
+      });
+    } finally {
+      if (probeTimer !== void 0) clearTimeout(probeTimer);
+    }
+  }
+  let url;
+  let stop;
   try {
-    const ensured = await ensureDaemonRunning3({ project, idleTimeoutSec });
-    return { url: ensured.url, stop: ensured.stop };
+    const ensured = await ensureDaemonRunning3({
+      project,
+      idleTimeoutSec,
+      ...preferred !== void 0 ? { port: preferred } : {}
+    });
+    url = ensured.url;
+    stop = ensured.stop;
   } catch (err) {
     failDaemonDown(opts, err);
   }
+  const client = newClient();
+  try {
+    await connectClient(client, url, opts, project.id);
+  } catch (err) {
+    await client.close().catch(() => {
+    });
+    await stop().catch(() => {
+    });
+    throw err;
+  }
+  return { client, stop };
+}
+function httpTransport(url, scopeKey) {
+  const token = scopeKey === null ? null : readDaemonToken2(scopeKey);
+  return new StreamableHTTPClientTransport(
+    new URL(url),
+    // Verified present: StreamableHTTPClientTransportOptions.requestInit?: RequestInit
+    token ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {}
+  );
+}
+function callerScopeKey(opts) {
+  try {
+    return (opts.project ?? loadProjectInfo13(process.cwd())).id;
+  } catch {
+    return null;
+  }
+}
+function newClient() {
+  return new Client(
+    { name: "noir-cli", version: NOIR_VERSION4 },
+    { versionNegotiation: { mode: "auto" } }
+  );
+}
+async function connectRaw(client, url, scopeKey) {
+  await client.connect(httpTransport(url, scopeKey));
 }
-async function connectClient(client, url, opts) {
+async function connectClient(client, url, opts, scopeKey) {
   try {
-    await client.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connectRaw(client, url, scopeKey);
   } catch (err) {
     failDaemonDown(opts, err);
   }
 }
+function failWorkspaceConnect(opts, routing, cause) {
+  const text = String(cause).toLowerCase();
+  if (text.includes("401") || text.includes("unauthorized")) {
+    if (opts.verbose) {
+      process.stderr.write(`noir: daemon transport detail: ${describeCause(cause)}
+`);
+    }
+    fail(
+      EXIT.DAEMON_DOWN,
+      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
+      opts
+    );
+  }
+  failDaemonDown(opts, cause);
+}
 async function callToolParse(client, opts, name, args) {
   const result = await client.callTool({ name, arguments: args }).catch((err) => failDaemonDown(opts, err));
   const block = result.content?.[0];
@@ -5256,21 +5563,12 @@ function buildCaller(client, opts) {
   };
 }
 async function withDaemon(opts, fn) {
-  const { url, stop } = await resolveDaemon(opts);
-  let client;
+  const { client, stop } = await resolveDaemon(opts);
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION4 },
-      { versionNegotiation: { mode: "auto" } }
-    );
-    const connected = client;
-    await connectClient(connected, url, opts);
-    return await fn(buildCaller(connected, opts));
+    return await fn(buildCaller(client, opts));
   } finally {
-    if (client) {
-      await client.close().catch(() => {
-      });
-    }
+    await client.close().catch(() => {
+    });
     await stop().catch(() => {
     });
   }
@@ -5281,12 +5579,9 @@ async function withRunningDaemon(opts, fn, probe) {
   const url = `http://127.0.0.1:${p.port}/mcp`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION4 },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connected.connect(new StreamableHTTPClientTransport(new URL(url)));
+    await connected.connect(httpTransport(url, callerScopeKey(opts)));
     return await fn(buildCaller(connected, opts));
   } catch {
     return null;
@@ -5303,7 +5598,7 @@ async function callDaemonTool(opts, name, args = {}) {
 async function withInProcessRead(opts, fn) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo12(process.cwd());
+    project = opts.project ?? loadProjectInfo13(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -5350,7 +5645,7 @@ function workspaceRoutingTarget(root) {
   const name = readWorkspaceMarker2(root);
   if (name === null) return null;
   try {
-    return { name, projectId: loadProjectInfo12(root).id };
+    return { name, projectId: loadProjectInfo13(root).id };
   } catch {
     return null;
   }
@@ -5384,12 +5679,11 @@ async function withWorkspaceDaemon(opts, routing, fn) {
   const url = `http://127.0.0.1:${probe.port}/mcp?p=${routing.projectId}`;
   let client;
   try {
-    client = new Client(
-      { name: "noir-cli", version: NOIR_VERSION4 },
-      { versionNegotiation: { mode: "auto" } }
-    );
+    client = newClient();
     const connected = client;
-    await connectClient(connected, url, opts);
+    await connectRaw(connected, url, routing.name).catch(
+      (err) => failWorkspaceConnect(opts, routing, err)
+    );
     return await fn(buildCaller(connected, opts));
   } finally {
     if (client) {
@@ -5553,7 +5847,7 @@ function renderHuman2(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo13(process.cwd());
+    project = loadProjectInfo14(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -5583,7 +5877,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo13(process.cwd());
+        const info2 = loadProjectInfo14(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -5615,4 +5909,4 @@ export {
   assertTransportUrl,
   buildPaletteCommandsForTui
 };
-//# sourceMappingURL=chunk-KMLSJRYV.js.map
+//# sourceMappingURL=chunk-6LO4LXEH.js.map