@noir-ai/cli 1.15.0 → 1.16.0

package/dist/bin.js

@@ -414,10 +414,82 @@ var init_daemon_client = __esm({
   }
 });
 
+// src/width.ts
+import stringWidth from "string-width";
+import stripAnsi from "strip-ansi";
+function clusters(s) {
+  return [...segmenter.segment(s)].map(({ segment }) => segment);
+}
+function displayWidth(s) {
+  return stringWidth(s);
+}
+function fitLeading(parts, width) {
+  let used = 0;
+  let count = 0;
+  for (const part of parts) {
+    const w = displayWidth(part);
+    if (used + w > width) {
+      break;
+    }
+    used += w;
+    count++;
+  }
+  return count;
+}
+function truncateToWidth(s, width, ellipsis = "\u2026") {
+  const plain = stripAnsi(s);
+  if (width <= 0) {
+    return "";
+  }
+  if (displayWidth(plain) <= width) {
+    return plain;
+  }
+  const markerParts = clusters(ellipsis);
+  const marker = markerParts.slice(0, fitLeading(markerParts, width)).join("");
+  const budget = width - displayWidth(marker);
+  const parts = clusters(plain);
+  return parts.slice(0, fitLeading(parts, budget)).join("") + marker;
+}
+function truncateMiddle(s, width, ellipsis = "\u2026") {
+  const plain = stripAnsi(s);
+  if (width <= 0) {
+    return "";
+  }
+  if (displayWidth(plain) <= width) {
+    return plain;
+  }
+  const markerParts = clusters(ellipsis);
+  const marker = markerParts.slice(0, fitLeading(markerParts, width)).join("");
+  const remaining = width - displayWidth(marker);
+  const headBudget = Math.ceil(remaining / 2);
+  const tailBudget = remaining - headBudget;
+  const parts = clusters(plain);
+  const headCount = fitLeading(parts, headBudget);
+  const tail = [];
+  let tailUsed = 0;
+  for (const part of parts.slice(headCount).reverse()) {
+    const w = displayWidth(part);
+    if (tailUsed + w > tailBudget) {
+      break;
+    }
+    tail.push(part);
+    tailUsed += w;
+  }
+  return parts.slice(0, headCount).join("") + marker + tail.reverse().join("");
+}
+var segmenter;
+var init_width = __esm({
+  "src/width.ts"() {
+    "use strict";
+    segmenter = new Intl.Segmenter();
+  }
+});
+
 // src/theme.ts
 import pc from "picocolors";
-function badge(state, label = state) {
-  const text = `${BADGE_SYMBOL[state]} ${label}`;
+function badge(state, label = state, maxWidth) {
+  const full = `${BADGE_SYMBOL[state]} ${label}`;
+  const text = maxWidth === void 0 ? full : truncateToWidth(full, maxWidth);
   switch (state) {
     case "ok":
       return c.ok(text);
@@ -438,8 +510,13 @@ function isCiEnv() {
   if (v === void 0 || v === "") return false;
   return v !== "0" && v !== "false";
 }
+function quietMode() {
+  const v = process.env.NOIR_QUIET;
+  return v !== void 0 && v !== "";
+}
 function useColor() {
   if (envFlagSet("NO_COLOR")) return false;
+  if (quietMode()) return false;
   if (process.env.CLICOLOR_FORCE === "1") return true;
   if (isCiEnv()) return false;
   return pc.isColorSupported;
@@ -453,14 +530,17 @@ function terminalWidth() {
     const n = Number(fromEnv);
     if (Number.isInteger(n) && n > 0) return Math.max(n, 20);
   }
-  const cols = process.stdout.columns;
-  if (typeof cols === "number" && cols > 0) return Math.max(cols, 20);
+  const stderrCols = process.stderr.columns;
+  if (typeof stderrCols === "number" && stderrCols > 0) return Math.max(stderrCols, 20);
+  const stdoutCols = process.stdout.columns;
+  if (typeof stdoutCols === "number" && stdoutCols > 0) return Math.max(stdoutCols, 20);
   return 80;
 }
 var FORCE, c, BADGE_SYMBOL;
 var init_theme = __esm({
   "src/theme.ts"() {
     "use strict";
+    init_width();
     FORCE = pc.createColors(true);
     c = {
       /** Green — success / healthy. */
@@ -559,17 +639,18 @@ function table(rows, cols, opts = {}) {
     info("(no rows)", opts);
     return;
   }
+  const widths = computeColWidths(rows, cols);
   const t = new Table({
     head: cols.map((col) => c.bold(c.info(col))),
     // Empty arrays ⇒ cli-table3 applies NO @colors/colors wrap (neither the
     // default red header nor a colored border). All color is ours, via theme.
     style: { head: [], border: [] },
-    colWidths: computeColWidths(rows, cols),
+    colWidths: widths,
     wordWrap: true,
     truncate: "\u2026"
   });
   for (const row of rows) {
-    t.push(cols.map((col) => formatCell(row[col])));
+    t.push(cols.map((col, i) => truncateCell(row[col], (widths[i] ?? 0) - 2)));
   }
   process.stderr.write(`${t.toString()}
 `);
@@ -577,43 +658,71 @@ function table(rows, cols, opts = {}) {
 function computeColWidths(rows, cols) {
   const n = cols.length;
   if (n === 0) return [];
-  const headerLen = cols.map((col) => col.length);
+  const headerLen = cols.map((col) => displayWidth(col));
   const natural = cols.map((col, i) => {
-    let max = Math.max(headerLen[i] ?? col.length, 3);
+    let max = Math.max(headerLen[i] ?? displayWidth(col), MIN_CONTENT_WIDTH);
     for (const row of rows) {
-      const len = formatCell(row[col]).length;
+      const len = displayWidth(formatCell(row[col]));
       if (len > max) max = len;
     }
     return max;
   });
-  const contentBudget = Math.max(n * 4, terminalWidth() - 3 * n - 1);
+  const budget = Math.max(n, terminalWidth() - 3 * n - 1);
   const naturalSum = natural.reduce((a, b) => a + b, 0);
-  if (naturalSum <= contentBudget) {
+  if (naturalSum <= budget) {
     return natural.map((w) => w + 2);
   }
   const content = natural.slice();
   let sum = naturalSum;
-  const floor = headerLen.map((h) => Math.max(h, 3));
-  while (sum > contentBudget) {
+  const floor = headerLen.map((h) => Math.min(Math.max(h, MIN_CONTENT_WIDTH), budget));
+  while (sum > budget) {
     let idx = -1;
     let widest = -1;
     for (let i = 0; i < n; i++) {
       const c2 = content[i] ?? 0;
-      const f = floor[i] ?? 3;
+      const f = floor[i] ?? MIN_CONTENT_WIDTH;
       if (c2 > f && c2 > widest) {
         widest = c2;
         idx = i;
       }
     }
     if (idx === -1) break;
-    const overshoot = sum - contentBudget;
-    const reducible = (content[idx] ?? 0) - (floor[idx] ?? 3);
+    const overshoot = sum - budget;
+    const reducible = (content[idx] ?? 0) - (floor[idx] ?? MIN_CONTENT_WIDTH);
     const cut = Math.min(overshoot, reducible);
     content[idx] = (content[idx] ?? 0) - cut;
     sum -= cut;
   }
+  if (sum > budget) {
+    for (let pass = 0; pass < n && sum > budget; pass++) {
+      let idx = -1;
+      let widest = 0;
+      for (let j = 0; j < n; j++) {
+        const c2 = content[j] ?? 0;
+        if (c2 > 1 && c2 > widest) {
+          widest = c2;
+          idx = j;
+        }
+      }
+      if (idx === -1) break;
+      const cut = Math.min(sum - budget, (content[idx] ?? 1) - 1);
+      content[idx] = (content[idx] ?? 1) - cut;
+      sum -= cut;
+    }
+  }
   return content.map((w) => w + 2);
 }
+function isPathToken(s) {
+  if (!/[\\/]/.test(s)) return false;
+  return /^(\/|\.\/|\.\.\/|~\/|[A-Za-z]:[\\/])/.test(s) || /\.[A-Za-z0-9][A-Za-z0-9_-]*$/.test(s);
+}
+function truncateCell(value, contentWidth) {
+  const s = formatCell(value);
+  if (contentWidth <= 0 || displayWidth(s) <= contentWidth) return s;
+  if (isPathToken(s)) return truncateMiddle(s, contentWidth);
+  if (/\s/.test(s)) return s;
+  return truncateToWidth(s, contentWidth);
+}
 function formatCell(value) {
   if (value === void 0 || value === null) return "";
   if (typeof value === "string") return value;
@@ -624,7 +733,7 @@ function formatCell(value) {
 }
 function definitionList(rows, opts = {}) {
   table(
-    rows.map((r) => ({ Field: r.label, Value: formatCell(r.value) })),
+    rows.map((r) => ({ Field: r.label, Value: r.value })),
     ["Field", "Value"],
     opts
   );
@@ -705,11 +814,12 @@ function handleError(err) {
   }
   process.exitCode = inferExitCode(err);
 }
-var EXIT, NoirCliError, NOIR_ERROR_CODE, NoopSpinner, OraSpinner, EXIT_FLUSH_MS;
+var EXIT, NoirCliError, NOIR_ERROR_CODE, MIN_CONTENT_WIDTH, NoopSpinner, OraSpinner, EXIT_FLUSH_MS;
 var init_output = __esm({
   "src/output.ts"() {
     "use strict";
     init_theme();
+    init_width();
     EXIT = {
       OK: 0,
       ERROR: 1,
@@ -727,6 +837,7 @@ var init_output = __esm({
       }
     };
     NOIR_ERROR_CODE = "noir.error";
+    MIN_CONTENT_WIDTH = 3;
     NoopSpinner = class {
       text = "";
       start(_text) {
@@ -961,14 +1072,230 @@ var init_context = __esm({
   }
 });
 
+// src/workspace-bridge.ts
+import {
+  ReadBuffer,
+  StreamableHTTPClientTransport as StreamableHTTPClientTransport2,
+  serializeMessage
+} from "@modelcontextprotocol/client";
+import { loadProjectInfo as loadProjectInfo2 } from "@noir-ai/core";
+import { pidAlive as pidAlive2, readDaemonToken as readDaemonToken2, readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2, tokenPath as tokenPath2 } from "@noir-ai/daemon";
+async function resolveWorkspaceDaemon(name, root) {
+  const record = readWorkspaceDaemonRecord2(name);
+  if (record === null) {
+    return { error: `no daemon recorded for workspace ${name}` };
+  }
+  const health = await verifyWorkspaceDaemon(record, name);
+  if (health.kind === "foreign") {
+    return {
+      error: `workspace ${name} is recorded on port ${record.port}, but the daemon answering there serves workspace ${health.workspace}`
+    };
+  }
+  if (health.kind === "silent") {
+    return { error: `record exists but the daemon is not answering (pid ${record.pid})` };
+  }
+  const token = readDaemonToken2(name);
+  if (token === null) {
+    return {
+      error: `workspace ${name} daemon is answering but its token is unreadable at ${tokenPath2(name)}`
+    };
+  }
+  let callerProjectId;
+  try {
+    callerProjectId = loadProjectInfo2(root).id;
+  } catch {
+    return {
+      error: `no project identity in ${root} \u2014 run \`noir init\` before serving a workspace from here`
+    };
+  }
+  return { url: `http://127.0.0.1:${record.port}/mcp?p=${callerProjectId}`, token };
+}
+async function verifyWorkspaceDaemon(record, name) {
+  if (!pidAlive2(record.pid)) return { kind: "silent" };
+  return probeHealth(record.port, name, record.pid);
+}
+async function probeHealth(port, name, pid) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/health`, {
+      signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS)
+    });
+    if (!response.ok) return { kind: "silent" };
+    const body = await response.json().catch(() => null);
+    if (body === null) return { kind: "silent" };
+    if (typeof body.workspace === "string" && body.workspace !== name) {
+      return { kind: "foreign", workspace: body.workspace };
+    }
+    if (body.ok !== true || body.pid !== pid) return { kind: "silent" };
+    return { kind: "healthy" };
+  } catch {
+    return { kind: "silent" };
+  }
+}
+async function bridgeStdioToWorkspace(name, root) {
+  const resolved = await resolveWorkspaceDaemon(name, root);
+  if ("error" in resolved) {
+    fail(EXIT.DAEMON_DOWN, resolved.error);
+  }
+  const host = new StdioBridgeTransport(process.stdin, process.stdout);
+  const daemon = new StreamableHTTPClientTransport2(new URL(resolved.url), {
+    requestInit: { headers: { Authorization: `Bearer ${resolved.token}` } }
+  });
+  try {
+    await relay(host, daemon);
+  } finally {
+    await daemon.close().catch(() => {
+    });
+    await host.close().catch(() => {
+    });
+  }
+}
+async function relay(host, daemon) {
+  await new Promise((resolve3) => {
+    let settled = false;
+    let closing = false;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      closing = true;
+      resolve3();
+    };
+    const closeDaemon = () => {
+      closing = true;
+      void daemon.close().catch(() => {
+      });
+    };
+    host.onmessage = (message) => {
+      void daemon.send(message).catch(closeDaemon);
+    };
+    host.onclose = () => {
+      closeDaemon();
+      settle();
+    };
+    host.onerror = () => {
+      closeDaemon();
+      settle();
+    };
+    daemon.onmessage = (message) => {
+      void host.send(message).catch(() => {
+      });
+    };
+    daemon.onclose = () => {
+      void host.close().catch(() => {
+      });
+      settle();
+    };
+    daemon.onerror = (error2) => {
+      if (closing) return;
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+    };
+    const failStart = (error2) => {
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+      host.onerror?.(error2);
+      closeDaemon();
+      settle();
+    };
+    void daemon.start().catch(failStart);
+    void host.start().catch(failStart);
+  });
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+var HEALTH_PROBE_TIMEOUT_MS, StdioBridgeTransport;
+var init_workspace_bridge = __esm({
+  "src/workspace-bridge.ts"() {
+    "use strict";
+    init_output();
+    HEALTH_PROBE_TIMEOUT_MS = 1500;
+    StdioBridgeTransport = class {
+      constructor(stdin, stdout) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+      }
+      stdin;
+      stdout;
+      onclose;
+      onerror;
+      onmessage;
+      buffer = new ReadBuffer();
+      started = false;
+      closed = false;
+      async start() {
+        if (this.started) throw new Error("the stdio bridge transport is already started");
+        this.started = true;
+        this.stdin.on("data", this.onData);
+        this.stdin.on("error", this.onStdinFault);
+        this.stdin.on("end", this.onStdinEnd);
+        this.stdout.on("error", this.onStdoutFault);
+      }
+      send(message) {
+        if (this.closed) return Promise.reject(new Error("the stdio bridge transport is closed"));
+        return new Promise((resolve3, reject) => {
+          if (this.stdout.write(serializeMessage(message))) {
+            resolve3();
+            return;
+          }
+          const onDrain = () => {
+            this.stdout.off("error", onWriteError);
+            resolve3();
+          };
+          const onWriteError = (error2) => {
+            this.stdout.off("drain", onDrain);
+            reject(error2);
+          };
+          this.stdout.once("drain", onDrain);
+          this.stdout.once("error", onWriteError);
+        });
+      }
+      async close() {
+        if (this.closed) return;
+        this.closed = true;
+        this.stdin.off("data", this.onData);
+        this.stdin.off("error", this.onStdinFault);
+        this.stdin.off("end", this.onStdinEnd);
+        this.stdout.off("error", this.onStdoutFault);
+        this.buffer.clear();
+        if (this.stdin.listenerCount("data") === 0) this.stdin.pause();
+        this.onclose?.();
+      }
+      onData = (chunk) => {
+        try {
+          this.buffer.append(chunk);
+          for (; ; ) {
+            const message = this.buffer.readMessage();
+            if (message === null) return;
+            this.onmessage?.(message);
+          }
+        } catch (error2) {
+          this.onerror?.(toError(error2));
+          void this.close();
+        }
+      };
+      /** The host closed its end of the pipe — the session is over. */
+      onStdinEnd = () => {
+        void this.close();
+      };
+      onStdinFault = (error2) => {
+        this.onerror?.(error2);
+        void this.close();
+      };
+      onStdoutFault = (error2) => {
+        this.onerror?.(error2);
+      };
+    };
+  }
+});
+
 // src/workspace-mcp.ts
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-import { resolveAdapter } from "@noir-ai/adapters";
+import { mcpConfigPathFor, noirStdioArgs, TRANSPORT_KEYS } from "@noir-ai/adapters";
 import { atomicWriteFile, resolveNoirCommand } from "@noir-ai/core";
-function mcpPathFor(root, host) {
-  return resolveAdapter(host).mcpConfigPath?.({ root }) ?? join(root, ".mcp.json");
-}
 function readJson(path) {
   if (!existsSync(path)) return null;
   return JSON.parse(readFileSync(path, "utf8"));
@@ -1002,26 +1329,37 @@ function isNoirEmitted(mcpServers) {
   if (typeof noir.command === "string") return true;
   return noir.type === "http";
 }
-function writeWorkspaceHttpEntry(root, host, url, projectId, opts) {
-  const path = mcpPathFor(root, host);
+function noirEntry(mcpServers) {
+  const noir = mcpServers?.noir;
+  if (typeof noir !== "object" || noir === null || Array.isArray(noir)) return {};
+  return noir;
+}
+function writeNoirTransport(root, host, transport, opts) {
+  const path = mcpConfigPathFor(host, root);
   const existing = loadExisting(path, opts);
+  const kept = Object.fromEntries(
+    Object.entries(noirEntry(existing?.mcpServers)).filter(([key]) => !TRANSPORT_KEYS.has(key))
+  );
   const next = {
     ...existing ?? {},
     mcpServers: {
       ...existing?.mcpServers ?? {},
-      noir: { type: "http", url: `${url}?p=${projectId}` }
+      noir: { ...transport, ...kept }
     }
   };
   atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
 `);
 }
+function writeWorkspaceEntry(root, host, name, opts) {
+  writeNoirTransport(
+    root,
+    host,
+    { command: resolveNoirCommand(), args: noirStdioArgs(name) },
+    opts
+  );
+}
 function writeStdioEntry(root, host, opts) {
-  const path = mcpPathFor(root, host);
-  const existing = loadExisting(path, opts);
-  const noir = { command: resolveNoirCommand(), args: ["mcp", "serve", "--stdio"] };
-  const next = { ...existing ?? {}, mcpServers: { ...existing?.mcpServers ?? {}, noir } };
-  atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
-`);
+  writeNoirTransport(root, host, { command: resolveNoirCommand(), args: noirStdioArgs() }, opts);
 }
 var init_workspace_mcp = __esm({
   "src/workspace-mcp.ts"() {
@@ -1037,7 +1375,7 @@ import {
   ensureWorkspaceRegistry,
   isValidWorkspaceName,
   isWorkspaceMember,
-  loadProjectInfo as loadProjectInfo2,
+  loadProjectInfo as loadProjectInfo3,
   readWorkspaceMarker as readWorkspaceMarker2,
   readWorkspaceRegistry,
   removeWorkspaceMember,
@@ -1048,20 +1386,20 @@ import {
 import {
   clearWorkspaceDaemonRecord,
   ensureWorkspaceDaemonRunning,
-  pidAlive as pidAlive2,
-  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
+  pidAlive as pidAlive3,
+  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord3,
   spawnDetachedWorkspaceDaemon
 } from "@noir-ai/daemon";
 function loadProjectOrFail(opts) {
   try {
-    return loadProjectInfo2(process.cwd());
+    return loadProjectInfo3(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
 }
-function finishJoin(project, name, url, opts) {
+function finishJoin(project, name, opts) {
   writeWorkspaceMarker(project.root, name);
-  writeWorkspaceHttpEntry(project.root, project.config.host, url, project.id, opts);
+  writeWorkspaceEntry(project.root, project.config.host, name, opts);
 }
 async function daemonStartWorkspace(opts) {
   const project = loadProjectOrFail(opts);
@@ -1094,7 +1432,7 @@ async function daemonStartWorkspace(opts) {
   }
   if (opts.detach === true) {
     const spawned = await spawnDetachedWorkspaceDaemon({ name: opts.name, project });
-    finishJoin(project, opts.name, `http://127.0.0.1:${spawned.port}/mcp`, opts);
+    finishJoin(project, opts.name, opts);
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { mode: "detached", pid: spawned.pid, port: spawned.port } })}
@@ -1113,7 +1451,7 @@ async function daemonStartWorkspace(opts) {
     project,
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { url: ensured.url, port: ensured.port, reused: !ensured.started } })}
@@ -1143,7 +1481,7 @@ async function daemonJoin(opts) {
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
   upsertWorkspaceMember(reg, { projectId: project.id, root: project.root, joinedAt: Date.now() });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { joined: true, url: ensured.url, port: ensured.port } })}
@@ -1160,19 +1498,20 @@ async function workspaceList(opts) {
   } catch {
     names = [];
   }
-  const rows = names.map((n) => {
-    const reg = readWorkspaceRegistry(n);
-    return {
-      name: n,
-      members: reg?.members.length ?? 0,
-      // A record file whose pid is dead (daemon killed without cleanup) must not
-      // read as "running" — mirror the pidAlive liveness `workspace status` uses.
-      running: (() => {
-        const rec = readWorkspaceDaemonRecord2(n);
-        return rec !== null && pidAlive2(rec.pid);
-      })()
-    };
-  });
+  const rows = await Promise.all(
+    names.map(async (n) => {
+      const reg = readWorkspaceRegistry(n);
+      const rec = readWorkspaceDaemonRecord3(n);
+      const health = rec === null ? null : await verifyWorkspaceDaemon(rec, n);
+      const running = health?.kind === "healthy";
+      return {
+        name: n,
+        members: reg?.members.length ?? 0,
+        running,
+        ...rec !== null && !running ? { stale: true } : {}
+      };
+    })
+  );
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: { workspaces: rows } })}
 `);
@@ -1183,7 +1522,8 @@ async function workspaceList(opts) {
     return;
   }
   for (const r of rows) {
-    log(`${r.name} \u2014 ${r.members} member(s)${r.running ? ", running" : ""}`, opts);
+    const state = r.running ? ", running" : r.stale ? ", not running (stale record)" : "";
+    log(`${r.name} \u2014 ${r.members} member(s)${state}`, opts);
   }
 }
 async function workspaceStatus(opts) {
@@ -1195,23 +1535,23 @@ async function workspaceStatus(opts) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
   const reg = readWorkspaceRegistry(name);
-  const rec = readWorkspaceDaemonRecord2(name);
-  const running = rec !== null && pidAlive2(rec.pid);
+  const rec = readWorkspaceDaemonRecord3(name);
+  const health = rec === null ? null : await verifyWorkspaceDaemon(rec, name);
+  const running = health?.kind === "healthy";
   const data = {
     name,
     members: reg?.members.map((m) => m.projectId) ?? [],
     running,
-    ...rec ? { pid: rec.pid, port: rec.port } : {}
+    ...rec ? { pid: rec.pid, port: rec.port } : {},
+    ...rec !== null && !running ? { stale: true } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data })}
 `);
     return;
   }
-  log(
-    `workspace ${name}: ${running ? `running (pid ${rec?.pid}, port ${rec?.port})` : "not running"}`,
-    opts
-  );
+  const state = running ? `running (pid ${rec?.pid}, port ${rec?.port})` : rec !== null ? `not running (stale record for pid ${rec.pid})` : "not running";
+  log(`workspace ${name}: ${state}`, opts);
   for (const m of data.members) log(`  member: ${m}`, opts);
 }
 async function workspaceLeave(opts) {
@@ -1241,8 +1581,8 @@ async function workspaceStop(opts) {
   if (!isValidWorkspaceName(name)) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
-  const rec = readWorkspaceDaemonRecord2(name);
-  if (rec === null || !pidAlive2(rec.pid)) {
+  const rec = readWorkspaceDaemonRecord3(name);
+  if (rec === null || !pidAlive3(rec.pid)) {
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
@@ -1253,6 +1593,10 @@ async function workspaceStop(opts) {
     info("workspace daemon is not running.", opts);
     return;
   }
+  const health = await verifyWorkspaceDaemon(rec, name);
+  if (health.kind !== "healthy") {
+    fail(EXIT.ERROR, stopRefusal(name, rec, health), opts);
+  }
   try {
     process.kill(rec.pid, "SIGTERM");
   } catch {
@@ -1267,21 +1611,28 @@ async function workspaceStop(opts) {
   }
   info(`stopped workspace daemon (pid ${rec.pid}).`, opts);
 }
+function stopRefusal(name, rec, health) {
+  if (health.kind === "foreign") {
+    return `refusing to stop workspace ${name}: the daemon answering on port ${rec.port} serves workspace ${health.workspace}, so the recorded pid ${rec.pid} is not this workspace's daemon.`;
+  }
+  return `refusing to stop workspace ${name}: the process recorded for it (pid ${rec.pid}) does not answer /health as this workspace, so it may be an unrelated process.`;
+}
 var init_workspace = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
     init_output();
+    init_workspace_bridge();
     init_workspace_mcp();
   }
 });
 
 // src/commands/daemon.ts
-import { loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo4 } from "@noir-ai/core";
 import {
   clearProjectDaemonRecord,
   ensureDaemonRunning as ensureDaemonRunning2,
-  pidAlive as pidAlive3,
-  readDaemonToken as readDaemonToken2,
+  pidAlive as pidAlive4,
+  readDaemonToken as readDaemonToken3,
   readProjectDaemonRecord as readProjectDaemonRecord2,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
@@ -1293,7 +1644,7 @@ function formatUptime(sec) {
 }
 function resolveCallerProjectId() {
   try {
-    return loadProjectInfo3(process.cwd()).id;
+    return loadProjectInfo4(process.cwd()).id;
   } catch {
     return void 0;
   }
@@ -1325,7 +1676,7 @@ async function daemonStart(opts) {
   }
   let project;
   try {
-    project = loadProjectInfo3(process.cwd());
+    project = loadProjectInfo4(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -1357,7 +1708,7 @@ async function daemonStart(opts) {
   }
   if (opts.detach === true) {
     const existing = readProjectDaemonRecord2(project.id);
-    if (existing && pidAlive3(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
+    if (existing && pidAlive4(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
           `${JSON.stringify({ ok: true, data: { mode: "detached", reused: true } })}
@@ -1467,7 +1818,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const healthy = pidAlive3(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
+  const healthy = pidAlive4(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -1509,7 +1860,7 @@ async function daemonStatus(opts) {
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  if (!pidAlive3(rec.pid)) {
+  if (!pidAlive4(rec.pid)) {
     clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
@@ -1571,14 +1922,14 @@ async function daemonToken(opts) {
       opts
     );
   }
-  if (!pidAlive3(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+  if (!pidAlive4(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
     fail(
       EXIT.DAEMON_DOWN,
       "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
       opts
     );
   }
-  const token = readDaemonToken2(callerProject);
+  const token = readDaemonToken3(callerProject);
   if (token === null) {
     fail(
       EXIT.DAEMON_DOWN,
@@ -1609,17 +1960,182 @@ var init_daemon = __esm({
   }
 });
 
+// src/hygiene-scan.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { join } from "path";
+import { checkHygiene } from "@noir-ai/skills";
+function readDirEntries(dir) {
+  try {
+    return readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function isDirectory(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function hygieneKindOf(path) {
+  if (HYGIENE_MARKDOWN_EXTENSIONS.test(path)) return "markdown";
+  if (HYGIENE_CODE_EXTENSIONS.test(path)) return "code";
+  return null;
+}
+function hasScannableLayout(root) {
+  if (isDirectory(join(root, "docs")) || isDirectory(join(root, "scripts"))) return true;
+  for (const entry of readDirEntries(join(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    if (isDirectory(join(root, "packages", entry.name, "src"))) return true;
+    if (isDirectory(join(root, "packages", entry.name, "test"))) return true;
+  }
+  return false;
+}
+function addHygieneFile(rel, walk) {
+  const name = rel.slice(rel.lastIndexOf("/") + 1);
+  if (name.startsWith(".") || HYGIENE_EXCLUDED_FILES.has(name)) return;
+  const kind = hygieneKindOf(rel);
+  if (kind === null) return;
+  if (walk.files.length >= HYGIENE_MAX_FILES) {
+    walk.truncated = true;
+    return;
+  }
+  walk.files.push({ path: rel, kind });
+}
+function walkScannable(root, relDir, skip, walk) {
+  if (walk.truncated) return;
+  for (const entry of readDirEntries(join(root, relDir))) {
+    if (walk.truncated) return;
+    const rel = `${relDir}/${entry.name}`;
+    if (entry.isDirectory()) {
+      if (HYGIENE_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".") || skip.has(rel)) {
+        continue;
+      }
+      walkScannable(root, rel, skip, walk);
+    } else if (entry.isFile()) {
+      addHygieneFile(rel, walk);
+    }
+  }
+}
+function collectHygieneFiles(root) {
+  const walk = { files: [], truncated: false };
+  for (const entry of readDirEntries(root)) {
+    if (entry.isFile()) addHygieneFile(entry.name, walk);
+  }
+  walkScannable(root, "docs", HYGIENE_EXCLUDED_DIRS, walk);
+  walkScannable(root, ".claude/skills", NO_SKIP_DIRS, walk);
+  for (const entry of readDirEntries(join(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    walkScannable(root, `packages/${entry.name}/src`, NO_SKIP_DIRS, walk);
+    walkScannable(root, `packages/${entry.name}/test`, NO_SKIP_DIRS, walk);
+  }
+  walkScannable(root, "scripts", NO_SKIP_DIRS, walk);
+  walk.files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return walk;
+}
+function hygieneOmissions(result) {
+  const notes = [];
+  if (result.skipped > 0) {
+    notes.push(
+      `${result.skipped} file${result.skipped === 1 ? "" : "s"} over ${HYGIENE_MAX_FILE_BYTES / 1024} KiB skipped`
+    );
+  }
+  if (result.truncated) notes.push(`stopped at ${HYGIENE_MAX_FILES} files`);
+  return notes.length > 0 ? ` (${notes.join("; ")})` : "";
+}
+function hygieneCounts(result) {
+  const omitted = hygieneOmissions(result);
+  if (result.scanned === 0) {
+    return `nothing to scan (no packages/*/src, packages/*/test, scripts/ or documents found)${omitted}`;
+  }
+  if (result.findings.length === 0) {
+    return `clean \u2014 ${result.scanned} file${result.scanned === 1 ? "" : "s"} scanned${omitted}`;
+  }
+  const files = new Set(result.findings.map((f) => f.path)).size;
+  return `${result.fail} fail, ${result.warn} warn in ${files} file${files === 1 ? "" : "s"}${omitted}`;
+}
+function hygieneDetail(result) {
+  const counts = hygieneCounts(result);
+  if (result.scanned === 0 || result.findings.length === 0) return counts;
+  const named = result.findings.slice(0, HYGIENE_FINDING_CAP);
+  const hidden = result.findings.length - named.length;
+  const where = named.map((f) => `${f.path}:${f.line} ${f.id}`).join("; ");
+  return `${counts} \u2014 ${where}${hidden > 0 ? ` (+${hidden} more)` : ""}`;
+}
+function scanOutputHygiene(root) {
+  const empty = {
+    scanned: 0,
+    skipped: 0,
+    truncated: false,
+    findings: [],
+    fail: 0,
+    warn: 0
+  };
+  if (!hasScannableLayout(root)) return empty;
+  const walk = collectHygieneFiles(root);
+  const findings = [];
+  let scanned = 0;
+  let skipped = 0;
+  for (const file of walk.files) {
+    const abs = join(root, file.path);
+    try {
+      if (statSync(abs).size > HYGIENE_MAX_FILE_BYTES) {
+        skipped++;
+        continue;
+      }
+      const text = readFileSync2(abs, "utf8");
+      scanned++;
+      for (const found of checkHygiene(text, file.kind)) {
+        findings.push({ path: file.path, line: found.line, id: found.id, tier: found.tier });
+      }
+    } catch {
+    }
+  }
+  findings.sort((a, b) => {
+    if (a.tier !== b.tier) return a.tier === "fail" ? -1 : 1;
+    if (a.path !== b.path) return a.path < b.path ? -1 : 1;
+    return a.line - b.line;
+  });
+  const fail2 = findings.filter((f) => f.tier === "fail").length;
+  return {
+    scanned,
+    skipped,
+    truncated: walk.truncated,
+    findings,
+    fail: fail2,
+    warn: findings.length - fail2
+  };
+}
+var HYGIENE_FINDING_CAP, HYGIENE_MAX_FILE_BYTES, HYGIENE_MAX_FILES, HYGIENE_CODE_EXTENSIONS, HYGIENE_MARKDOWN_EXTENSIONS, HYGIENE_SKIP_DIRS, HYGIENE_EXCLUDED_DIRS, HYGIENE_EXCLUDED_FILES, NO_SKIP_DIRS;
+var init_hygiene_scan = __esm({
+  "src/hygiene-scan.ts"() {
+    "use strict";
+    HYGIENE_FINDING_CAP = 5;
+    HYGIENE_MAX_FILE_BYTES = 512 * 1024;
+    HYGIENE_MAX_FILES = 2e3;
+    HYGIENE_CODE_EXTENSIONS = /\.(?:ts|tsx|js|jsx|mjs|cjs|sh)$/i;
+    HYGIENE_MARKDOWN_EXTENSIONS = /\.(?:md|mdx)$/i;
+    HYGIENE_SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
+    HYGIENE_EXCLUDED_DIRS = /* @__PURE__ */ new Set(["docs/internal", "docs/decisions", "docs/roadmap"]);
+    HYGIENE_EXCLUDED_FILES = /* @__PURE__ */ new Set(["CHANGELOG.md"]);
+    NO_SKIP_DIRS = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/commands/doctor.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { existsSync as existsSync2, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 import { dirname, join as join2, relative } from "path";
 import { fileURLToPath } from "url";
-import { resolveAdapter as resolveAdapter2 } from "@noir-ai/adapters";
+import { mcpConfigPathFor as mcpConfigPathFor2, resolveAdapter } from "@noir-ai/adapters";
 import {
   detectActiveMethod,
+  ensureOwnerOnly,
+  ensureOwnerOnlyDir,
   latestVersionFromCache,
   loadNoirEnv,
-  loadProjectInfo as loadProjectInfo4,
+  loadProjectInfo as loadProjectInfo5,
   NOIR_VERSION as NOIR_VERSION2,
   paths,
   readInstallRecord,
@@ -1632,7 +2148,7 @@ import {
   readScaffoldVersion,
   render
 } from "@noir-ai/create";
-import { pidAlive as pidAlive4, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
+import { pidAlive as pidAlive5, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
 import { resolveModelConfig } from "@noir-ai/model";
 async function probeOnnx() {
   try {
@@ -1648,7 +2164,7 @@ function describeOnnx(o) {
   if (/Cannot find (module|package)/i.test(o.reason)) {
     return "not resolvable from CLI probe (best-effort)";
   }
-  const r = o.reason.length > 60 ? `${o.reason.slice(0, 59)}\u2026` : o.reason;
+  const r = truncateToWidth(o.reason, 60);
   return `probe failed: ${r}`;
 }
 function fmtUptime(sec) {
@@ -1680,7 +2196,7 @@ function checkConfig(root) {
     };
   }
   try {
-    const project = loadProjectInfo4(root);
+    const project = loadProjectInfo5(root);
     return {
       project,
       result: {
@@ -1714,7 +2230,7 @@ async function checkDaemon(checks, project) {
     });
     return;
   }
-  if (!pidAlive4(rec.pid)) {
+  if (!pidAlive5(rec.pid)) {
     checks.push({
       name: "daemon",
       status: "warn",
@@ -1797,11 +2313,21 @@ async function checkStore(checks, project, root) {
     }
   }
 }
+function envModeCause(st) {
+  return st.ctimeMs > st.mtimeMs ? "changed" : "legacy";
+}
+function octalMode(mode) {
+  return mode.toString(8).padStart(4, "0");
+}
+function describeEnvMode(cause, mode) {
+  const lead = `is ${octalMode(mode)} \u2014 accessible to other accounts; run \`noir sync\` (or \`chmod 600 .noir/.env\`) to make it owner-only.`;
+  return cause === "legacy" ? `${lead} Nothing has changed its mode since the file was written, so the file predates the owner-only contract (an older Noir seeded it, a clone delivered it, it was created by hand, or it was saved by a tool that replaces the file) \u2014 this is not a change you made.` : `${lead} Its mode was changed after the file was written (a \`chmod\`, a \`chown\`, or a restore that re-applied metadata), so no older Noir left it this way.`;
+}
 function checkNoirEnv(checks, root, loaded) {
   const path = join2(paths.noirDir(root), ".env");
   let st;
   try {
-    st = statSync(path);
+    st = statSync2(path);
   } catch {
     return;
   }
@@ -1819,8 +2345,8 @@ function checkNoirEnv(checks, root, loaded) {
     tooOpen ? {
       name: "noir-env",
       status: "warn",
-      detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
-    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
+      detail: `${path} ${describeEnvMode(envModeCause(st), mode)}`
+    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${octalMode(mode)})` }
   );
   for (const [key, source] of Object.entries(loaded.sources)) {
     if (source !== "file") continue;
@@ -1920,7 +2446,7 @@ function checkSeedDrift(checks, root) {
   const seedPath = join2(root, ".noir", ".env.example");
   let bytes;
   try {
-    bytes = readFileSync2(seedPath, "utf8");
+    bytes = readFileSync3(seedPath, "utf8");
   } catch {
     return;
   }
@@ -1938,6 +2464,14 @@ function checkRulesMdBudget(checks, root, project) {
     checks.push({ name: "rules budget", status: "warn", detail: "skipped \u2014 not initialized" });
     return null;
   }
+  if (project.config.rules.enabled === false) {
+    checks.push({
+      name: "rules budget",
+      status: "ok",
+      detail: "disabled \u2014 rules.enabled is false in .noir/config.yml (RULES.md is not measured)"
+    });
+    return null;
+  }
   const rulesPath = paths.rulesMd(root);
   if (!existsSync2(rulesPath)) {
     checks.push({
@@ -1949,7 +2483,7 @@ function checkRulesMdBudget(checks, root, project) {
   }
   let content;
   try {
-    content = readFileSync2(rulesPath, "utf8");
+    content = readFileSync3(rulesPath, "utf8");
   } catch (e) {
     checks.push({
       name: "rules budget",
@@ -1993,7 +2527,7 @@ function checkHostArtifacts(checks, root, project) {
     return null;
   }
   const host = project.config.host;
-  const adapter = resolveAdapter2(host);
+  const adapter = resolveAdapter(host);
   const ectx = { root };
   const expected = [];
   const emitsAgentsMd = host === "agents-md" || host === "cursor" || host === "opencode";
@@ -2002,7 +2536,7 @@ function checkHostArtifacts(checks, root, project) {
   }
   if (host === "claude") expected.push("CLAUDE.md");
   else if (host === "gemini") expected.push("GEMINI.md");
-  expected.push(relOr(adapter.mcpConfigPath?.(ectx) ?? ".mcp.json", root));
+  expected.push(relOr(mcpConfigPathFor2(host, root), root));
   const missing = expected.filter((p) => !existsSync2(joinRoot(root, p)));
   const status2 = missing.length === 0 ? "ok" : "warn";
   const detail = missing.length === 0 ? `host=${host} \xB7 all ${expected.length} primary artifacts present` : `host=${host} \xB7 missing ${missing.join(", ")} (run \`noir sync\` to restore)`;
@@ -2029,6 +2563,15 @@ function checkNestedNoir(checks, root) {
   });
   return { detected, paths: found };
 }
+function checkOutputHygiene(checks, root) {
+  const result = scanOutputHygiene(root);
+  checks.push({
+    name: "output hygiene",
+    status: result.fail > 0 ? "fail" : result.warn > 0 ? "warn" : "ok",
+    detail: hygieneDetail(result)
+  });
+  return result;
+}
 function collectDedupCandidates(root) {
   const rels = ["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".noir/rules/RULES.md"];
   const out = [];
@@ -2037,7 +2580,7 @@ function collectDedupCandidates(root) {
     if (!existsSync2(abs)) continue;
     let text;
     try {
-      text = readFileSync2(abs, "utf8");
+      text = readFileSync3(abs, "utf8");
     } catch {
       continue;
     }
@@ -2097,7 +2640,7 @@ function resolveWorkspacePackagesDir() {
     const pkgPath = join2(here, "package.json");
     if (existsSync2(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
         if (pkg.name === "@noir-ai/cli") {
           const packagesDir = dirname(here);
           if (existsSync2(join2(dirname(packagesDir), "pnpm-workspace.yaml"))) {
@@ -2145,7 +2688,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
   }
   let entries = [];
   try {
-    entries = readdirSync2(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync3(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (e) {
     checks.push({
       name: "publish",
@@ -2162,7 +2705,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
     if (!existsSync2(pkgPath)) continue;
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     } catch (e) {
       issues.push(`${name}/package.json: unparseable (${msg(e)})`);
       checked++;
@@ -2241,6 +2784,17 @@ function renderHuman(payload, opts) {
     ["Check", "Status", "Detail"],
     opts
   );
+  if (payload.fixes) {
+    const healed = payload.fixes.filter((f) => f.outcome === "healed");
+    if (healed.length > 0) {
+      log(
+        `fixed ${healed.length} permission${healed.length === 1 ? "" : "s"}: ${healed.map((f) => f.path).join(", ")}`,
+        opts
+      );
+    } else {
+      log("nothing to fix \u2014 permissions already owner-only", opts);
+    }
+  }
   const { ok, warn: warnN, fail: fail2 } = payload.summary;
   if (fail2 > 0) {
     error(
@@ -2253,12 +2807,24 @@ function renderHuman(payload, opts) {
     success(`all ${ok} check${ok === 1 ? "" : "s"} passed`, opts);
   }
 }
+function fixOwnerOnlyPermissions(root, project) {
+  const fixes = [
+    { path: ".noir/.env", outcome: ensureOwnerOnly(join2(paths.noirDir(root), ".env")) }
+  ];
+  if (project) {
+    const dbRel = `.noir/store/${project.id}.db`;
+    fixes.push({ path: dbRel, outcome: ensureOwnerOnly(join2(root, dbRel)) });
+    fixes.push({ path: ".noir/store", outcome: ensureOwnerOnlyDir(paths.storeDir(root)) });
+  }
+  return fixes;
+}
 async function doctor(opts = {}) {
   const root = process.cwd();
   const checks = [];
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
+  const fixes = opts.fix === true ? fixOwnerOnlyPermissions(root, project) : void 0;
   await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
@@ -2271,6 +2837,7 @@ async function doctor(opts = {}) {
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
   checkNestedNoir(checks, root);
+  checkOutputHygiene(checks, root);
   if (opts.dedup === true) {
     await checkSemanticDupDoctor(checks, root, project);
   }
@@ -2294,7 +2861,8 @@ async function doctor(opts = {}) {
       method: installCheck.method,
       installedVersion: installCheck.installedVersion,
       latestKnown: installCheck.latestKnown
-    }
+    },
+    ...fixes ? { fixes } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: payload })}
@@ -2314,26 +2882,28 @@ var init_doctor = __esm({
   "src/commands/doctor.ts"() {
     "use strict";
     init_daemon_client();
+    init_hygiene_scan();
     init_output();
     init_theme();
+    init_width();
     ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
     SEMVER_ISH = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
   }
 });
 
 // src/commands/env.ts
-import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo5 } from "@noir-ai/core";
+import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo6 } from "@noir-ai/core";
 import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
 function captureAmbientEnv(env2 = process.env) {
   ambientBaseline = { ...env2 };
 }
 function redactShape(value) {
   if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
-  return `${value.slice(0, 3)}\u2026(${value.length})`;
+  return `${truncateToWidth(value, 3, "")}\u2026(${value.length})`;
 }
 function configApiKeyEnvNames(root) {
   try {
-    const project = loadProjectInfo5(root);
+    const project = loadProjectInfo6(root);
     const names = /* @__PURE__ */ new Set();
     for (const provider of Object.values(resolveModelConfig2(project.config.model).providers)) {
       if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
@@ -2402,6 +2972,7 @@ var init_env = __esm({
   "src/commands/env.ts"() {
     "use strict";
     init_output();
+    init_width();
     CURATED_AMBIENT_KEYS = [
       "CLICKUP_API_TOKEN",
       "OPENAI_API_KEY",
@@ -2432,7 +3003,7 @@ import {
   detectActiveMethod as detectActiveMethod2,
   detectInstallMethods,
   ensureShimExecutable,
-  loadProjectInfo as loadProjectInfo6,
+  loadProjectInfo as loadProjectInfo7,
   MANAGED_NODE_VERSION,
   NOIR_VERSION as NOIR_VERSION3,
   noirHome,
@@ -2571,7 +3142,7 @@ async function install(opts = {}) {
   const installedRecord = readInstallRecord2();
   let minVersion = "1.6.0";
   try {
-    minVersion = loadProjectInfo6(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo7(process.cwd()).config.update.minVersion;
   } catch {
   }
   const plan = buildMigrationPlan({
@@ -2648,7 +3219,7 @@ import {
   detectActiveMethod as detectActiveMethod3,
   ensureShimExecutable as ensureShimExecutable2,
   fetchLatestVersion,
-  loadProjectInfo as loadProjectInfo7,
+  loadProjectInfo as loadProjectInfo8,
   readInstallRecord as readInstallRecord3,
   readUpdateCache as readUpdateCache2,
   runManagerCmd as runManagerCmd2,
@@ -2728,7 +3299,7 @@ async function update(opts = {}) {
   fetchSpin.succeed(`Latest: ${latest}`);
   let minVersion = DEFAULT_UPDATE_CONFIG.minVersion;
   try {
-    minVersion = loadProjectInfo7(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo8(process.cwd()).config.update.minVersion;
   } catch {
   }
   const target = buildUpdateTarget({
@@ -2878,7 +3449,7 @@ var init_update = __esm({
 });
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo8, NOIR_VERSION as NOIR_VERSION4 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo9, NOIR_VERSION as NOIR_VERSION4 } from "@noir-ai/core";
 async function tryTool(caller, name, args) {
   try {
     return await caller.callTool(name, args);
@@ -2999,7 +3570,7 @@ function renderHuman2(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo8(process.cwd());
+    project = loadProjectInfo9(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3029,7 +3600,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo8(process.cwd());
+        const info2 = loadProjectInfo9(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -3058,7 +3629,7 @@ var init_status = __esm({
 // src/commands/task.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo9, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo10, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -3071,7 +3642,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo9(process.cwd());
+    const project = loadProjectInfo10(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -3394,7 +3965,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo9(process.cwd());
+    project = loadProjectInfo10(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3500,7 +4071,7 @@ async function taskResearch(opts) {
     return;
   }
   renderStatusRow(s, opts);
-  info("research findings are recorded via `noir task research record` (list + record)", opts);
+  info("this is a status view; record findings with `noir task research-record`", opts);
 }
 async function taskResearchRecord(opts) {
   const TYPES = ["assumption", "discovery", "decision", "grounding-fact"];
@@ -3524,10 +4095,7 @@ async function taskResearchRecord(opts) {
 `);
     return;
   }
-  success(
-    `research recorded \u2192 ${opts.type}: ${opts.text.slice(0, 80)}${opts.text.length > 80 ? "\u2026" : ""}`,
-    opts
-  );
+  success(`research recorded \u2192 ${opts.type}: ${truncateToWidth(opts.text, 80)}`, opts);
 }
 async function taskDecompose(opts) {
   const cap = opts.capability.trim();
@@ -3583,6 +4151,7 @@ var init_task = __esm({
     init_daemon_client();
     init_output();
     init_theme();
+    init_width();
     PHASE_SKILL = {
       // Skill curation: intake+clarify merged into brainstorming;
       // execute → executing-plans; verify → verifying; document → wrap.
@@ -3604,9 +4173,9 @@ import { join as join4 } from "path";
 import {
   defaultHandoffBlock,
   hostLaunchDirective,
-  resolveAdapter as resolveAdapter3
+  resolveAdapter as resolveAdapter2
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo10, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo11, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 function heading(name, id) {
   return `# Noir handoff \u2014 ${name} (${id})`;
 }
@@ -3702,7 +4271,7 @@ function toHostPayload(p) {
 }
 function resolveDirective(root, p) {
   const ctx = { root };
-  const adapter = resolveAdapter3(p.host);
+  const adapter = resolveAdapter2(p.host);
   const hostPayload = toHostPayload(p);
   if (typeof adapter.emitHandoff === "function") {
     return adapter.emitHandoff(ctx, hostPayload);
@@ -3745,7 +4314,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo10(process.cwd());
+    project = loadProjectInfo11(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -3805,7 +4374,7 @@ import gradient from "gradient-string";
 function renderBanner(opts = {}) {
   const width = opts.width ?? process.stdout.columns ?? 80;
   const colorOn = opts.color !== false && useColor();
-  if (width < 50) {
+  if (width < BLOCK_MIN_WIDTH) {
     return colorOn ? `${c.accent("\u25C6")} noir` : "\u25C6 noir";
   }
   const block = NOIR_BLOCK.join("\n");
@@ -3821,11 +4390,12 @@ function shouldShowBanner(opts) {
   if (v !== void 0 && v !== "") return false;
   return true;
 }
-var NOIR_BLOCK, NOIR_GRADIENT, NOIR_TAGLINE;
+var NOIR_BLOCK, NOIR_GRADIENT, NOIR_TAGLINE, BLOCK_WIDTH, BLOCK_MIN_WIDTH;
 var init_banner = __esm({
   "src/banner.ts"() {
     "use strict";
     init_theme();
+    init_width();
     NOIR_BLOCK = [
       "\u2588\u2588\u2588\u2557   \u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
       "\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557",
@@ -3836,6 +4406,8 @@ var init_banner = __esm({
     ];
     NOIR_GRADIENT = gradient("#2c5282", "#3b82f6", "#7dd3fc");
     NOIR_TAGLINE = "discipline, context, and memory layer for agentic CLIs";
+    BLOCK_WIDTH = NOIR_BLOCK.reduce((max, line) => Math.max(max, displayWidth(line)), 0);
+    BLOCK_MIN_WIDTH = BLOCK_WIDTH + 17;
   }
 });
 
@@ -4135,14 +4707,14 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod4,
   latestVersionFromCache as latestVersionFromCache2,
-  loadProjectInfo as loadProjectInfo11,
+  loadProjectInfo as loadProjectInfo12,
   NOIR_VERSION as NOIR_VERSION5,
   readInstallRecord as readInstallRecord4,
   readUpdateCache as readUpdateCache3
 } from "@noir-ai/core";
 function tryProject() {
   try {
-    const info2 = loadProjectInfo11(process.cwd());
+    const info2 = loadProjectInfo12(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -4305,7 +4877,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo11(process.cwd());
+        const info2 = loadProjectInfo12(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -4367,13 +4939,13 @@ var init_home = __esm({
 });
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
+import { readFileSync as readFileSync4 } from "fs";
+import { loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo12(process.cwd()) };
+    return { routing, project: loadProjectInfo13(process.cwd()) };
   } catch {
     return null;
   }
@@ -4585,14 +5157,14 @@ async function resolveCaptureContent(opts) {
   if (typeof opts.content === "string" && opts.content.length > 0) return opts.content;
   if (typeof opts.file === "string" && opts.file.length > 0) {
     try {
-      return readFileSync3(opts.file, "utf8");
+      return readFileSync4(opts.file, "utf8");
     } catch {
       fail(EXIT.USAGE, `memory capture could not read --file ${opts.file}`, opts);
     }
   }
   if (!process.stdin.isTTY) {
     try {
-      return readFileSync3(0, "utf8");
+      return readFileSync4(0, "utf8");
     } catch {
       fail(
         EXIT.USAGE,
@@ -4786,7 +5358,7 @@ function describe(step, who) {
   const m = {
     preflight: "check clean tree, on develop, HEAD pushed, gate green, no version collision",
     bump: "run bump-version.mjs + update CHANGELOG + roadmap docs",
-    gate: "re-run the full gate (lint/build/typecheck/test/docs:validate)",
+    gate: "re-run the full six-step gate (lint/build/typecheck/test/docs:validate/hygiene:gate)",
     commit: "commit chore(release) + push develop",
     "ci-develop": "wait for CI on develop \u2192 green",
     "beta-tag": "pnpm release:tag \u2192 beta tag + push",
@@ -4831,11 +5403,14 @@ async function release(opts) {
     });
     success(`bump: \u2713 version ${version}`, opts);
     info(`[3/13] gate: ${describe("gate", "noir")}`, opts);
-    execSync("pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate", {
-      encoding: "utf8",
-      stdio: "inherit"
-    });
-    success("gate: \u2713 full gate green", opts);
+    execSync(
+      "pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate && pnpm hygiene:gate",
+      {
+        encoding: "utf8",
+        stdio: "inherit"
+      }
+    );
+    success("gate: \u2713 all six gates green", opts);
     info(`[4/13] commit/push: ${describe("commit", "noir")}`, opts);
     spawnSync3("git", ["add", "-A"], { encoding: "utf8", stdio: "inherit" });
     spawnSync3("git", ["commit", "-m", `chore(release): v${version} + docs sync`], {
@@ -5695,10 +6270,10 @@ var init_run_interrupt = __esm({
 });
 
 // src/run-profiles.ts
-import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
+import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo13(root).config;
+    return loadProjectInfo14(root).config;
   } catch {
     return null;
   }
@@ -5782,6 +6357,8 @@ var init_run_status = __esm({
   "src/run-status.ts"() {
     "use strict";
     init_orchestrator();
+    init_theme();
+    init_width();
     HOST_STDERR_TAIL_LINES = 20;
     RunStatusLine = class {
       host;
@@ -5864,6 +6441,7 @@ var init_run_status = __esm({
         if (this.animated && this.sharesCursor && this.onRow) {
           this.write("\n");
           this.onRow = false;
+          this.rendered = "";
         }
         this.stdoutAtRowStart = chunk.endsWith("\n");
       }
@@ -5894,19 +6472,45 @@ var init_run_status = __esm({
           return;
         }
         if (!this.onRow || !this.cursorFree()) return;
-        this.write("\r\x1B[K");
+        this.write(this.erase(this.rendered));
         this.rendered = "";
         this.onRow = false;
       }
       /** Rewrite the current row in place, skipping no-op rewrites and unsafe moments. */
       draw() {
         if (!this.animated || !this.cursorFree()) return;
-        const text = this.render();
+        const text = truncateToWidth(this.render(), terminalWidth());
         if (text === this.rendered) return;
-        this.write(`\r\x1B[K${text}`);
+        this.write(`${this.erase(this.rendered)}${text}`);
         this.rendered = text;
         this.onRow = true;
       }
+      /**
+       * The escape sequence that clears the status text currently on screen and
+       * leaves the cursor at the start of the row it began on — where the next
+       * render writes. An empty `previous` still clears the row, so a line that has
+       * drawn nothing yet starts from a known-blank one.
+       *
+       * The extent is measured against the terminal width as it is NOW, not as it
+       * was when the text was drawn. Nothing this line writes wraps, but text that
+       * fitted a wider terminal does not stop existing when the window narrows: the
+       * terminal folds it onto rows below, and clearing only the row the cursor
+       * ends on would leave the rest above as residue. So the sequence walks back
+       * up over every row the text occupies. That folding is the behaviour of the
+       * common terminals (iTerm2, Terminal.app, GNOME Terminal and recent xterm);
+       * one that clips the row instead has no continuation to clear.
+       *
+       * The caller must have forgotten the text once its row was abandoned —
+       * `rendered` is only meaningful while `onRow` is true.
+       */
+      erase(previous) {
+        const rows = Math.max(1, Math.ceil(displayWidth(previous) / terminalWidth()));
+        let sequence = "\r\x1B[K";
+        for (let row = 1; row < rows; row++) {
+          sequence += "\x1B[1A\r\x1B[K";
+        }
+        return sequence;
+      }
       /**
        * Whether the cursor is at the start of a row nobody else is using. On stdout
        * that is not this terminal there is no shared cursor to disturb; when it is,
@@ -6303,7 +6907,7 @@ var init_conflict = __esm({
 });
 
 // src/dedup-write.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
 import { join as join6 } from "path";
 import { sha256Hex as sha256Hex2, sha256Hex12 } from "@noir-ai/core";
 async function checkWritePathDedup(root, res, opts) {
@@ -6318,7 +6922,7 @@ async function checkWritePathDedup(root, res, opts) {
     const proposedAbs = join6(root, proposedRel);
     let proposedText;
     try {
-      proposedText = readFileSync4(proposedAbs, "utf8");
+      proposedText = readFileSync5(proposedAbs, "utf8");
     } catch {
       continue;
     }
@@ -6458,7 +7062,7 @@ async function promptDedupAction(root, proposedRel, matchedRel, proposedText, si
     return "replace";
   } else if (choice === "mirror") {
     try {
-      const existing = readFileSync4(join6(root, matchedRel), "utf8");
+      const existing = readFileSync5(join6(root, matchedRel), "utf8");
       writeFileSync5(
         join6(root, matchedRel),
         `${existing}
@@ -6482,7 +7086,7 @@ function cachePath(root) {
 }
 function loadCache(root) {
   try {
-    const raw = readFileSync4(cachePath(root), "utf8");
+    const raw = readFileSync5(cachePath(root), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== DEDUP_CACHE_VERSION) return emptyCache();
     if (typeof parsed.entries !== "object" || parsed.entries === null) return emptyCache();
@@ -6514,7 +7118,7 @@ function makeCachedEmbed(cache, embed) {
 }
 function safeRead(abs) {
   try {
-    return readFileSync4(abs, "utf8");
+    return readFileSync5(abs, "utf8");
   } catch {
     return void 0;
   }
@@ -6553,8 +7157,8 @@ var init_dedup_write = __esm({
 
 // src/init.ts
 import { existsSync as existsSync4 } from "fs";
-import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo14, paths as paths3 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter3 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo15, paths as paths3 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import {
   emitSkillsToDir
@@ -6581,13 +7185,14 @@ async function init(root, opts) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.noop) return res;
   const skillSummary = await emitHostSkills(root, host, conflictOpts, interactive);
   res.skillConflicts = skillSummary?.conflicts ?? [];
   res.preservedSkills = skillSummary?.preserved ?? [];
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo14(root);
+    projectInfo = loadProjectInfo15(root);
   } catch {
     projectInfo = void 0;
   }
@@ -6618,7 +7223,7 @@ function resolveInitHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
   if (!existsSync4(paths3.config(root))) return "claude";
   try {
-    return loadProjectInfo14(root).config.host;
+    return loadProjectInfo15(root).config.host;
   } catch {
     process.stderr.write(
       `Could not read the configured host from ${paths3.config(root)}; using 'claude'.
@@ -6649,8 +7254,13 @@ function reportPlannedWrites(res) {
     for (const p of res.identical) log(`  ${p}`);
   }
 }
+function reportEnvHeal(res) {
+  if (res.envMode === "healed") {
+    process.stderr.write("Tightened .noir/.env to 0600 (it was readable by group or others).\n");
+  }
+}
 async function emitHostSkills(root, host, conflictOpts, interactive) {
-  const adapter = resolveAdapter4(host);
+  const adapter = resolveAdapter3(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -6714,8 +7324,8 @@ var init_init = __esm({
 });
 
 // src/commands/skills.ts
-import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo16 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -6733,13 +7343,6 @@ function toRow(s, kind = "builtin") {
   const category = s.frontmatter.metadata?.category?.trim() || categoryOf(s.name);
   return { name: s.name, category, description, kind, status: status2 };
 }
-function truncate(text, max) {
-  if (text.length <= max) return text;
-  const slice = text.slice(0, Math.max(0, max - 1));
-  const boundary = slice.lastIndexOf(" ");
-  const head = boundary > 0 ? slice.slice(0, boundary) : slice;
-  return `${head.trimEnd()}\u2026`;
-}
 async function skillsList(opts) {
   let builtins;
   let integrations;
@@ -6773,7 +7376,9 @@ async function skillsList(opts) {
       Kind: r.kind,
       Category: r.category,
       Status: r.status,
-      Description: truncate(r.description, 80)
+      // Display-only cut for the dense table cell; the `--json` payload always
+      // carries the description whole (search snippets must never be truncated).
+      Description: truncateToWidth(r.description, 80)
     })),
     ["Skill", "Kind", "Category", "Status", "Description"],
     opts
@@ -6783,11 +7388,11 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo15(root);
+    project = loadProjectInfo16(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
-  const adapter = resolveAdapter5(project.config.host);
+  const adapter = resolveAdapter4(project.config.host);
   if (!adapter.skillsDir) {
     const data2 = {
       emitted: [],
@@ -6849,7 +7454,7 @@ async function skillsLint(opts) {
     );
   }
   const errored = skills.filter((s) => s.errors.length > 0);
-  const warned = skills.filter((s) => s.warnings.length > 0 && s.errors.length === 0);
+  const warned = skills.filter((s) => s.warnings.length > 0);
   const data = { count: skills.length, errored: errored.length, skills };
   if (errored.length > 0) {
     const message = `skills lint: ${errored.length} skill${errored.length === 1 ? "" : "s"} failed validation`;
@@ -6927,6 +7532,7 @@ var init_skills = __esm({
     "use strict";
     init_init();
     init_output();
+    init_width();
     CATEGORY = {
       "noir-brainstorming": "discovery",
       "noir-sync": "discovery",
@@ -6953,17 +7559,22 @@ var init_skills = __esm({
       "noir-backend": "domain",
       "noir-doctor": "meta",
       "noir-writing-skills": "meta",
-      "noir-rules": "meta"
+      "noir-rules": "meta",
+      "noir-code-hygiene": "meta"
     };
   }
 });
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo16 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo17 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning3, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo16(process.cwd());
+  if (opts.workspace !== void 0) {
+    await bridgeStdioToWorkspace(opts.workspace, process.cwd());
+    return;
+  }
+  const project = loadProjectInfo17(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -6989,6 +7600,7 @@ async function serve(opts) {
 var init_serve = __esm({
   "src/serve.ts"() {
     "use strict";
+    init_workspace_bridge();
   }
 });
 
@@ -6998,8 +7610,8 @@ __export(create_exports, {
   create: () => create
 });
 import { resolve as resolve2 } from "path";
-import { resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo17 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo18 } from "@noir-ai/core";
 import { scaffold as scaffold2 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir3 } from "@noir-ai/skills";
 async function create(dir, opts) {
@@ -7023,9 +7635,10 @@ async function create(dir, opts) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.noop) return res;
   const host = res.host;
-  const adapter = resolveAdapter6(host);
+  const adapter = resolveAdapter5(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -7053,7 +7666,7 @@ async function create(dir, opts) {
   }
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo17(root);
+    projectInfo = loadProjectInfo18(root);
   } catch {
     projectInfo = void 0;
   }
@@ -7080,8 +7693,8 @@ __export(sync_exports, {
   sync: () => sync
 });
 import { existsSync as existsSync5 } from "fs";
-import { resolveAdapter as resolveAdapter7 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo18, paths as paths4 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo19, paths as paths4 } from "@noir-ai/core";
 import { scaffold as scaffold3 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir4 } from "@noir-ai/skills";
 async function sync(root, opts = {}) {
@@ -7090,7 +7703,7 @@ async function sync(root, opts = {}) {
   const conflictOpts = buildConflictOpts({ force: opts.force, interactive });
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo18(root);
+    projectInfo = loadProjectInfo19(root);
   } catch {
     projectInfo = void 0;
   }
@@ -7109,10 +7722,11 @@ async function sync(root, opts = {}) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.written.length === 0 && res.identical.length > 0) {
     process.stderr.write("Nothing to sync (Noir-managed files are up to date).\n");
   }
-  const adapter = resolveAdapter7(host);
+  const adapter = resolveAdapter6(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -7153,7 +7767,7 @@ function resolveSyncHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
   if (!existsSync5(paths4.config(root))) return "claude";
   try {
-    return loadProjectInfo18(root).config.host;
+    return loadProjectInfo19(root).config.host;
   } catch {
     return "claude";
   }
@@ -7278,6 +7892,8 @@ function createProgram() {
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
     else delete process.env.NOIR_NON_INTERACTIVE;
+    if (opts.quiet === true) process.env.NOIR_QUIET = "1";
+    else delete process.env.NOIR_QUIET;
     emitDeprecationHintsFor(actionCmd, toCliOptions(opts));
   });
   program2.command("init").description("scaffold Noir in the current project (.noir/, .mcp.json, CLAUDE.md, skills)").option("--transport <transport>", "stdio | streamable-http (default: stdio)", "stdio").option("--url <url>", "streamable-http daemon URL (localhost only)").option(
@@ -7383,11 +7999,17 @@ function createProgram() {
     }
   );
   const mcpCmd = program2.command("mcp").description("MCP server control");
-  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").action(async (opts) => {
-    await serve({ stdio: opts.stdio === true });
+  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").option(
+    "--workspace <name>",
+    "serve a shared workspace over stdio, bridging to that workspace daemon"
+  ).action(async (opts) => {
+    await serve({
+      stdio: opts.stdio === true,
+      ...typeof opts.workspace === "string" ? { workspace: opts.workspace } : {}
+    });
   });
   mcpCmd.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio]");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio] [--workspace <name>]");
   });
   const daemonGrp = program2.command("daemon").description("control the Noir daemon");
   daemonGrp.command("start").description("start the Noir daemon (foreground, or background with --detach)").option("--detach", "run the daemon in the background and exit").option("--workspace <name>", "start a shared cross-repo workspace daemon instead").option("--force", "overwrite a non-Noir .mcp.json entry (--workspace only)").addOption(
@@ -7488,10 +8110,16 @@ function createProgram() {
   program2.command("doctor").description("environment + project health").option(
     "--dedup",
     "scan host-context + .noir/ docs for semantic near-duplicates (loads the local embedder)"
-  ).action(async (...args) => {
+  ).option("--fix", "re-assert owner-only permissions on .noir/.env and the store DB + directory").action(async (...args) => {
     const g = actionGlobals(args);
-    const dedup = trailingCmd(args).opts().dedup === true;
-    await doctor({ ...toCliOptions(g), ...dedup ? { dedup: true } : {} });
+    const opts = trailingCmd(args).opts();
+    const dedup = opts.dedup === true;
+    const fix = opts.fix === true;
+    await doctor({
+      ...toCliOptions(g),
+      ...dedup ? { dedup: true } : {},
+      ...fix ? { fix: true } : {}
+    });
   });
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
@@ -7684,7 +8312,7 @@ function createProgram() {
       ...check === void 0 || check.length === 0 ? {} : { check }
     });
   });
-  taskGrp.command("research").description("list research findings for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
+  taskGrp.command("research").description("show research status for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
     const first = args[0];