@noir-ai/cli 1.15.0 → 1.16.0

package/dist/index.js

@@ -14,10 +14,82 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/width.ts
+import stringWidth from "string-width";
+import stripAnsi from "strip-ansi";
+function clusters(s) {
+  return [...segmenter.segment(s)].map(({ segment }) => segment);
+}
+function displayWidth(s) {
+  return stringWidth(s);
+}
+function fitLeading(parts, width) {
+  let used = 0;
+  let count = 0;
+  for (const part of parts) {
+    const w = displayWidth(part);
+    if (used + w > width) {
+      break;
+    }
+    used += w;
+    count++;
+  }
+  return count;
+}
+function truncateToWidth(s, width, ellipsis = "\u2026") {
+  const plain = stripAnsi(s);
+  if (width <= 0) {
+    return "";
+  }
+  if (displayWidth(plain) <= width) {
+    return plain;
+  }
+  const markerParts = clusters(ellipsis);
+  const marker = markerParts.slice(0, fitLeading(markerParts, width)).join("");
+  const budget = width - displayWidth(marker);
+  const parts = clusters(plain);
+  return parts.slice(0, fitLeading(parts, budget)).join("") + marker;
+}
+function truncateMiddle(s, width, ellipsis = "\u2026") {
+  const plain = stripAnsi(s);
+  if (width <= 0) {
+    return "";
+  }
+  if (displayWidth(plain) <= width) {
+    return plain;
+  }
+  const markerParts = clusters(ellipsis);
+  const marker = markerParts.slice(0, fitLeading(markerParts, width)).join("");
+  const remaining = width - displayWidth(marker);
+  const headBudget = Math.ceil(remaining / 2);
+  const tailBudget = remaining - headBudget;
+  const parts = clusters(plain);
+  const headCount = fitLeading(parts, headBudget);
+  const tail = [];
+  let tailUsed = 0;
+  for (const part of parts.slice(headCount).reverse()) {
+    const w = displayWidth(part);
+    if (tailUsed + w > tailBudget) {
+      break;
+    }
+    tail.push(part);
+    tailUsed += w;
+  }
+  return parts.slice(0, headCount).join("") + marker + tail.reverse().join("");
+}
+var segmenter;
+var init_width = __esm({
+  "src/width.ts"() {
+    "use strict";
+    segmenter = new Intl.Segmenter();
+  }
+});
+
 // src/theme.ts
 import pc from "picocolors";
-function badge(state, label = state) {
-  const text = `${BADGE_SYMBOL[state]} ${label}`;
+function badge(state, label = state, maxWidth) {
+  const full = `${BADGE_SYMBOL[state]} ${label}`;
+  const text = maxWidth === void 0 ? full : truncateToWidth(full, maxWidth);
   switch (state) {
     case "ok":
       return c.ok(text);
@@ -38,8 +110,13 @@ function isCiEnv() {
   if (v === void 0 || v === "") return false;
   return v !== "0" && v !== "false";
 }
+function quietMode() {
+  const v = process.env.NOIR_QUIET;
+  return v !== void 0 && v !== "";
+}
 function useColor() {
   if (envFlagSet("NO_COLOR")) return false;
+  if (quietMode()) return false;
   if (process.env.CLICOLOR_FORCE === "1") return true;
   if (isCiEnv()) return false;
   return pc.isColorSupported;
@@ -53,14 +130,17 @@ function terminalWidth() {
     const n = Number(fromEnv);
     if (Number.isInteger(n) && n > 0) return Math.max(n, 20);
   }
-  const cols = process.stdout.columns;
-  if (typeof cols === "number" && cols > 0) return Math.max(cols, 20);
+  const stderrCols = process.stderr.columns;
+  if (typeof stderrCols === "number" && stderrCols > 0) return Math.max(stderrCols, 20);
+  const stdoutCols = process.stdout.columns;
+  if (typeof stdoutCols === "number" && stdoutCols > 0) return Math.max(stdoutCols, 20);
   return 80;
 }
 var FORCE, c, BADGE_SYMBOL;
 var init_theme = __esm({
   "src/theme.ts"() {
     "use strict";
+    init_width();
     FORCE = pc.createColors(true);
     c = {
       /** Green — success / healthy. */
@@ -159,17 +239,18 @@ function table(rows, cols, opts = {}) {
     info("(no rows)", opts);
     return;
   }
+  const widths = computeColWidths(rows, cols);
   const t = new Table({
     head: cols.map((col) => c.bold(c.info(col))),
     // Empty arrays ⇒ cli-table3 applies NO @colors/colors wrap (neither the
     // default red header nor a colored border). All color is ours, via theme.
     style: { head: [], border: [] },
-    colWidths: computeColWidths(rows, cols),
+    colWidths: widths,
     wordWrap: true,
     truncate: "\u2026"
   });
   for (const row of rows) {
-    t.push(cols.map((col) => formatCell(row[col])));
+    t.push(cols.map((col, i) => truncateCell(row[col], (widths[i] ?? 0) - 2)));
   }
   process.stderr.write(`${t.toString()}
 `);
@@ -177,43 +258,71 @@ function table(rows, cols, opts = {}) {
 function computeColWidths(rows, cols) {
   const n = cols.length;
   if (n === 0) return [];
-  const headerLen = cols.map((col) => col.length);
+  const headerLen = cols.map((col) => displayWidth(col));
   const natural = cols.map((col, i) => {
-    let max = Math.max(headerLen[i] ?? col.length, 3);
+    let max = Math.max(headerLen[i] ?? displayWidth(col), MIN_CONTENT_WIDTH);
     for (const row of rows) {
-      const len = formatCell(row[col]).length;
+      const len = displayWidth(formatCell(row[col]));
       if (len > max) max = len;
     }
     return max;
   });
-  const contentBudget = Math.max(n * 4, terminalWidth() - 3 * n - 1);
+  const budget = Math.max(n, terminalWidth() - 3 * n - 1);
   const naturalSum = natural.reduce((a, b) => a + b, 0);
-  if (naturalSum <= contentBudget) {
+  if (naturalSum <= budget) {
     return natural.map((w) => w + 2);
   }
   const content = natural.slice();
   let sum = naturalSum;
-  const floor = headerLen.map((h) => Math.max(h, 3));
-  while (sum > contentBudget) {
+  const floor = headerLen.map((h) => Math.min(Math.max(h, MIN_CONTENT_WIDTH), budget));
+  while (sum > budget) {
     let idx = -1;
     let widest = -1;
     for (let i = 0; i < n; i++) {
       const c2 = content[i] ?? 0;
-      const f = floor[i] ?? 3;
+      const f = floor[i] ?? MIN_CONTENT_WIDTH;
       if (c2 > f && c2 > widest) {
         widest = c2;
         idx = i;
       }
     }
     if (idx === -1) break;
-    const overshoot = sum - contentBudget;
-    const reducible = (content[idx] ?? 0) - (floor[idx] ?? 3);
+    const overshoot = sum - budget;
+    const reducible = (content[idx] ?? 0) - (floor[idx] ?? MIN_CONTENT_WIDTH);
     const cut = Math.min(overshoot, reducible);
     content[idx] = (content[idx] ?? 0) - cut;
     sum -= cut;
   }
+  if (sum > budget) {
+    for (let pass = 0; pass < n && sum > budget; pass++) {
+      let idx = -1;
+      let widest = 0;
+      for (let j = 0; j < n; j++) {
+        const c2 = content[j] ?? 0;
+        if (c2 > 1 && c2 > widest) {
+          widest = c2;
+          idx = j;
+        }
+      }
+      if (idx === -1) break;
+      const cut = Math.min(sum - budget, (content[idx] ?? 1) - 1);
+      content[idx] = (content[idx] ?? 1) - cut;
+      sum -= cut;
+    }
+  }
   return content.map((w) => w + 2);
 }
+function isPathToken(s) {
+  if (!/[\\/]/.test(s)) return false;
+  return /^(\/|\.\/|\.\.\/|~\/|[A-Za-z]:[\\/])/.test(s) || /\.[A-Za-z0-9][A-Za-z0-9_-]*$/.test(s);
+}
+function truncateCell(value, contentWidth) {
+  const s = formatCell(value);
+  if (contentWidth <= 0 || displayWidth(s) <= contentWidth) return s;
+  if (isPathToken(s)) return truncateMiddle(s, contentWidth);
+  if (/\s/.test(s)) return s;
+  return truncateToWidth(s, contentWidth);
+}
 function formatCell(value) {
   if (value === void 0 || value === null) return "";
   if (typeof value === "string") return value;
@@ -224,7 +333,7 @@ function formatCell(value) {
 }
 function definitionList(rows, opts = {}) {
   table(
-    rows.map((r) => ({ Field: r.label, Value: formatCell(r.value) })),
+    rows.map((r) => ({ Field: r.label, Value: r.value })),
     ["Field", "Value"],
     opts
   );
@@ -305,11 +414,12 @@ function handleError(err) {
   }
   process.exitCode = inferExitCode(err);
 }
-var EXIT, NoirCliError, NOIR_ERROR_CODE, NoopSpinner, OraSpinner, EXIT_FLUSH_MS;
+var EXIT, NoirCliError, NOIR_ERROR_CODE, MIN_CONTENT_WIDTH, NoopSpinner, OraSpinner, EXIT_FLUSH_MS;
 var init_output = __esm({
   "src/output.ts"() {
     "use strict";
     init_theme();
+    init_width();
     EXIT = {
       OK: 0,
       ERROR: 1,
@@ -327,6 +437,7 @@ var init_output = __esm({
       }
     };
     NOIR_ERROR_CODE = "noir.error";
+    MIN_CONTENT_WIDTH = 3;
     NoopSpinner = class {
       text = "";
       start(_text) {
@@ -561,14 +672,230 @@ var init_context = __esm({
   }
 });
 
+// src/workspace-bridge.ts
+import {
+  ReadBuffer,
+  StreamableHTTPClientTransport,
+  serializeMessage
+} from "@modelcontextprotocol/client";
+import { loadProjectInfo } from "@noir-ai/core";
+import { pidAlive, readDaemonToken, readWorkspaceDaemonRecord, tokenPath } from "@noir-ai/daemon";
+async function resolveWorkspaceDaemon(name, root) {
+  const record = readWorkspaceDaemonRecord(name);
+  if (record === null) {
+    return { error: `no daemon recorded for workspace ${name}` };
+  }
+  const health = await verifyWorkspaceDaemon(record, name);
+  if (health.kind === "foreign") {
+    return {
+      error: `workspace ${name} is recorded on port ${record.port}, but the daemon answering there serves workspace ${health.workspace}`
+    };
+  }
+  if (health.kind === "silent") {
+    return { error: `record exists but the daemon is not answering (pid ${record.pid})` };
+  }
+  const token = readDaemonToken(name);
+  if (token === null) {
+    return {
+      error: `workspace ${name} daemon is answering but its token is unreadable at ${tokenPath(name)}`
+    };
+  }
+  let callerProjectId;
+  try {
+    callerProjectId = loadProjectInfo(root).id;
+  } catch {
+    return {
+      error: `no project identity in ${root} \u2014 run \`noir init\` before serving a workspace from here`
+    };
+  }
+  return { url: `http://127.0.0.1:${record.port}/mcp?p=${callerProjectId}`, token };
+}
+async function verifyWorkspaceDaemon(record, name) {
+  if (!pidAlive(record.pid)) return { kind: "silent" };
+  return probeHealth(record.port, name, record.pid);
+}
+async function probeHealth(port, name, pid) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/health`, {
+      signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS)
+    });
+    if (!response.ok) return { kind: "silent" };
+    const body = await response.json().catch(() => null);
+    if (body === null) return { kind: "silent" };
+    if (typeof body.workspace === "string" && body.workspace !== name) {
+      return { kind: "foreign", workspace: body.workspace };
+    }
+    if (body.ok !== true || body.pid !== pid) return { kind: "silent" };
+    return { kind: "healthy" };
+  } catch {
+    return { kind: "silent" };
+  }
+}
+async function bridgeStdioToWorkspace(name, root) {
+  const resolved = await resolveWorkspaceDaemon(name, root);
+  if ("error" in resolved) {
+    fail(EXIT.DAEMON_DOWN, resolved.error);
+  }
+  const host = new StdioBridgeTransport(process.stdin, process.stdout);
+  const daemon = new StreamableHTTPClientTransport(new URL(resolved.url), {
+    requestInit: { headers: { Authorization: `Bearer ${resolved.token}` } }
+  });
+  try {
+    await relay(host, daemon);
+  } finally {
+    await daemon.close().catch(() => {
+    });
+    await host.close().catch(() => {
+    });
+  }
+}
+async function relay(host, daemon) {
+  await new Promise((resolve3) => {
+    let settled = false;
+    let closing = false;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      closing = true;
+      resolve3();
+    };
+    const closeDaemon = () => {
+      closing = true;
+      void daemon.close().catch(() => {
+      });
+    };
+    host.onmessage = (message) => {
+      void daemon.send(message).catch(closeDaemon);
+    };
+    host.onclose = () => {
+      closeDaemon();
+      settle();
+    };
+    host.onerror = () => {
+      closeDaemon();
+      settle();
+    };
+    daemon.onmessage = (message) => {
+      void host.send(message).catch(() => {
+      });
+    };
+    daemon.onclose = () => {
+      void host.close().catch(() => {
+      });
+      settle();
+    };
+    daemon.onerror = (error2) => {
+      if (closing) return;
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+    };
+    const failStart = (error2) => {
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+      host.onerror?.(error2);
+      closeDaemon();
+      settle();
+    };
+    void daemon.start().catch(failStart);
+    void host.start().catch(failStart);
+  });
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+var HEALTH_PROBE_TIMEOUT_MS, StdioBridgeTransport;
+var init_workspace_bridge = __esm({
+  "src/workspace-bridge.ts"() {
+    "use strict";
+    init_output();
+    HEALTH_PROBE_TIMEOUT_MS = 1500;
+    StdioBridgeTransport = class {
+      constructor(stdin, stdout) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+      }
+      stdin;
+      stdout;
+      onclose;
+      onerror;
+      onmessage;
+      buffer = new ReadBuffer();
+      started = false;
+      closed = false;
+      async start() {
+        if (this.started) throw new Error("the stdio bridge transport is already started");
+        this.started = true;
+        this.stdin.on("data", this.onData);
+        this.stdin.on("error", this.onStdinFault);
+        this.stdin.on("end", this.onStdinEnd);
+        this.stdout.on("error", this.onStdoutFault);
+      }
+      send(message) {
+        if (this.closed) return Promise.reject(new Error("the stdio bridge transport is closed"));
+        return new Promise((resolve3, reject) => {
+          if (this.stdout.write(serializeMessage(message))) {
+            resolve3();
+            return;
+          }
+          const onDrain = () => {
+            this.stdout.off("error", onWriteError);
+            resolve3();
+          };
+          const onWriteError = (error2) => {
+            this.stdout.off("drain", onDrain);
+            reject(error2);
+          };
+          this.stdout.once("drain", onDrain);
+          this.stdout.once("error", onWriteError);
+        });
+      }
+      async close() {
+        if (this.closed) return;
+        this.closed = true;
+        this.stdin.off("data", this.onData);
+        this.stdin.off("error", this.onStdinFault);
+        this.stdin.off("end", this.onStdinEnd);
+        this.stdout.off("error", this.onStdoutFault);
+        this.buffer.clear();
+        if (this.stdin.listenerCount("data") === 0) this.stdin.pause();
+        this.onclose?.();
+      }
+      onData = (chunk) => {
+        try {
+          this.buffer.append(chunk);
+          for (; ; ) {
+            const message = this.buffer.readMessage();
+            if (message === null) return;
+            this.onmessage?.(message);
+          }
+        } catch (error2) {
+          this.onerror?.(toError(error2));
+          void this.close();
+        }
+      };
+      /** The host closed its end of the pipe — the session is over. */
+      onStdinEnd = () => {
+        void this.close();
+      };
+      onStdinFault = (error2) => {
+        this.onerror?.(error2);
+        void this.close();
+      };
+      onStdoutFault = (error2) => {
+        this.onerror?.(error2);
+      };
+    };
+  }
+});
+
 // src/workspace-mcp.ts
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-import { resolveAdapter } from "@noir-ai/adapters";
+import { mcpConfigPathFor, noirStdioArgs, TRANSPORT_KEYS } from "@noir-ai/adapters";
 import { atomicWriteFile, resolveNoirCommand } from "@noir-ai/core";
-function mcpPathFor(root, host) {
-  return resolveAdapter(host).mcpConfigPath?.({ root }) ?? join(root, ".mcp.json");
-}
 function readJson(path) {
   if (!existsSync(path)) return null;
   return JSON.parse(readFileSync(path, "utf8"));
@@ -602,26 +929,37 @@ function isNoirEmitted(mcpServers) {
   if (typeof noir.command === "string") return true;
   return noir.type === "http";
 }
-function writeWorkspaceHttpEntry(root, host, url, projectId, opts) {
-  const path = mcpPathFor(root, host);
+function noirEntry(mcpServers) {
+  const noir = mcpServers?.noir;
+  if (typeof noir !== "object" || noir === null || Array.isArray(noir)) return {};
+  return noir;
+}
+function writeNoirTransport(root, host, transport, opts) {
+  const path = mcpConfigPathFor(host, root);
   const existing = loadExisting(path, opts);
+  const kept = Object.fromEntries(
+    Object.entries(noirEntry(existing?.mcpServers)).filter(([key]) => !TRANSPORT_KEYS.has(key))
+  );
   const next = {
     ...existing ?? {},
     mcpServers: {
       ...existing?.mcpServers ?? {},
-      noir: { type: "http", url: `${url}?p=${projectId}` }
+      noir: { ...transport, ...kept }
     }
   };
   atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
 `);
 }
+function writeWorkspaceEntry(root, host, name, opts) {
+  writeNoirTransport(
+    root,
+    host,
+    { command: resolveNoirCommand(), args: noirStdioArgs(name) },
+    opts
+  );
+}
 function writeStdioEntry(root, host, opts) {
-  const path = mcpPathFor(root, host);
-  const existing = loadExisting(path, opts);
-  const noir = { command: resolveNoirCommand(), args: ["mcp", "serve", "--stdio"] };
-  const next = { ...existing ?? {}, mcpServers: { ...existing?.mcpServers ?? {}, noir } };
-  atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
-`);
+  writeNoirTransport(root, host, { command: resolveNoirCommand(), args: noirStdioArgs() }, opts);
 }
 var init_workspace_mcp = __esm({
   "src/workspace-mcp.ts"() {
@@ -637,7 +975,7 @@ import {
   ensureWorkspaceRegistry,
   isValidWorkspaceName,
   isWorkspaceMember,
-  loadProjectInfo,
+  loadProjectInfo as loadProjectInfo2,
   readWorkspaceMarker,
   readWorkspaceRegistry,
   removeWorkspaceMember,
@@ -648,20 +986,20 @@ import {
 import {
   clearWorkspaceDaemonRecord,
   ensureWorkspaceDaemonRunning,
-  pidAlive,
-  readWorkspaceDaemonRecord,
+  pidAlive as pidAlive2,
+  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
   spawnDetachedWorkspaceDaemon
 } from "@noir-ai/daemon";
 function loadProjectOrFail(opts) {
   try {
-    return loadProjectInfo(process.cwd());
+    return loadProjectInfo2(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
 }
-function finishJoin(project, name, url, opts) {
+function finishJoin(project, name, opts) {
   writeWorkspaceMarker(project.root, name);
-  writeWorkspaceHttpEntry(project.root, project.config.host, url, project.id, opts);
+  writeWorkspaceEntry(project.root, project.config.host, name, opts);
 }
 async function daemonStartWorkspace(opts) {
   const project = loadProjectOrFail(opts);
@@ -694,7 +1032,7 @@ async function daemonStartWorkspace(opts) {
   }
   if (opts.detach === true) {
     const spawned = await spawnDetachedWorkspaceDaemon({ name: opts.name, project });
-    finishJoin(project, opts.name, `http://127.0.0.1:${spawned.port}/mcp`, opts);
+    finishJoin(project, opts.name, opts);
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { mode: "detached", pid: spawned.pid, port: spawned.port } })}
@@ -713,7 +1051,7 @@ async function daemonStartWorkspace(opts) {
     project,
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { url: ensured.url, port: ensured.port, reused: !ensured.started } })}
@@ -743,7 +1081,7 @@ async function daemonJoin(opts) {
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
   upsertWorkspaceMember(reg, { projectId: project.id, root: project.root, joinedAt: Date.now() });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { joined: true, url: ensured.url, port: ensured.port } })}
@@ -760,19 +1098,20 @@ async function workspaceList(opts) {
   } catch {
     names = [];
   }
-  const rows = names.map((n) => {
-    const reg = readWorkspaceRegistry(n);
-    return {
-      name: n,
-      members: reg?.members.length ?? 0,
-      // A record file whose pid is dead (daemon killed without cleanup) must not
-      // read as "running" — mirror the pidAlive liveness `workspace status` uses.
-      running: (() => {
-        const rec = readWorkspaceDaemonRecord(n);
-        return rec !== null && pidAlive(rec.pid);
-      })()
-    };
-  });
+  const rows = await Promise.all(
+    names.map(async (n) => {
+      const reg = readWorkspaceRegistry(n);
+      const rec = readWorkspaceDaemonRecord2(n);
+      const health = rec === null ? null : await verifyWorkspaceDaemon(rec, n);
+      const running = health?.kind === "healthy";
+      return {
+        name: n,
+        members: reg?.members.length ?? 0,
+        running,
+        ...rec !== null && !running ? { stale: true } : {}
+      };
+    })
+  );
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: { workspaces: rows } })}
 `);
@@ -783,7 +1122,8 @@ async function workspaceList(opts) {
     return;
   }
   for (const r of rows) {
-    log(`${r.name} \u2014 ${r.members} member(s)${r.running ? ", running" : ""}`, opts);
+    const state = r.running ? ", running" : r.stale ? ", not running (stale record)" : "";
+    log(`${r.name} \u2014 ${r.members} member(s)${state}`, opts);
   }
 }
 async function workspaceStatus(opts) {
@@ -795,23 +1135,23 @@ async function workspaceStatus(opts) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
   const reg = readWorkspaceRegistry(name);
-  const rec = readWorkspaceDaemonRecord(name);
-  const running = rec !== null && pidAlive(rec.pid);
+  const rec = readWorkspaceDaemonRecord2(name);
+  const health = rec === null ? null : await verifyWorkspaceDaemon(rec, name);
+  const running = health?.kind === "healthy";
   const data = {
     name,
     members: reg?.members.map((m) => m.projectId) ?? [],
     running,
-    ...rec ? { pid: rec.pid, port: rec.port } : {}
+    ...rec ? { pid: rec.pid, port: rec.port } : {},
+    ...rec !== null && !running ? { stale: true } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data })}
 `);
     return;
   }
-  log(
-    `workspace ${name}: ${running ? `running (pid ${rec?.pid}, port ${rec?.port})` : "not running"}`,
-    opts
-  );
+  const state = running ? `running (pid ${rec?.pid}, port ${rec?.port})` : rec !== null ? `not running (stale record for pid ${rec.pid})` : "not running";
+  log(`workspace ${name}: ${state}`, opts);
   for (const m of data.members) log(`  member: ${m}`, opts);
 }
 async function workspaceLeave(opts) {
@@ -841,8 +1181,8 @@ async function workspaceStop(opts) {
   if (!isValidWorkspaceName(name)) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
-  const rec = readWorkspaceDaemonRecord(name);
-  if (rec === null || !pidAlive(rec.pid)) {
+  const rec = readWorkspaceDaemonRecord2(name);
+  if (rec === null || !pidAlive2(rec.pid)) {
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
@@ -853,6 +1193,10 @@ async function workspaceStop(opts) {
     info("workspace daemon is not running.", opts);
     return;
   }
+  const health = await verifyWorkspaceDaemon(rec, name);
+  if (health.kind !== "healthy") {
+    fail(EXIT.ERROR, stopRefusal(name, rec, health), opts);
+  }
   try {
     process.kill(rec.pid, "SIGTERM");
   } catch {
@@ -867,21 +1211,28 @@ async function workspaceStop(opts) {
   }
   info(`stopped workspace daemon (pid ${rec.pid}).`, opts);
 }
+function stopRefusal(name, rec, health) {
+  if (health.kind === "foreign") {
+    return `refusing to stop workspace ${name}: the daemon answering on port ${rec.port} serves workspace ${health.workspace}, so the recorded pid ${rec.pid} is not this workspace's daemon.`;
+  }
+  return `refusing to stop workspace ${name}: the process recorded for it (pid ${rec.pid}) does not answer /health as this workspace, so it may be an unrelated process.`;
+}
 var init_workspace = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
     init_output();
+    init_workspace_bridge();
     init_workspace_mcp();
   }
 });
 
 // src/commands/daemon.ts
-import { loadProjectInfo as loadProjectInfo2 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
 import {
   clearProjectDaemonRecord,
   ensureDaemonRunning,
-  pidAlive as pidAlive2,
-  readDaemonToken,
+  pidAlive as pidAlive3,
+  readDaemonToken as readDaemonToken2,
   readProjectDaemonRecord,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
@@ -893,7 +1244,7 @@ function formatUptime(sec) {
 }
 function resolveCallerProjectId() {
   try {
-    return loadProjectInfo2(process.cwd()).id;
+    return loadProjectInfo3(process.cwd()).id;
   } catch {
     return void 0;
   }
@@ -925,7 +1276,7 @@ async function daemonStart(opts) {
   }
   let project;
   try {
-    project = loadProjectInfo2(process.cwd());
+    project = loadProjectInfo3(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -957,7 +1308,7 @@ async function daemonStart(opts) {
   }
   if (opts.detach === true) {
     const existing = readProjectDaemonRecord(project.id);
-    if (existing && pidAlive2(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
+    if (existing && pidAlive3(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
           `${JSON.stringify({ ok: true, data: { mode: "detached", reused: true } })}
@@ -1067,7 +1418,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const healthy = pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
+  const healthy = pidAlive3(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -1109,7 +1460,7 @@ async function daemonStatus(opts) {
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  if (!pidAlive2(rec.pid)) {
+  if (!pidAlive3(rec.pid)) {
     clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
@@ -1171,14 +1522,14 @@ async function daemonToken(opts) {
       opts
     );
   }
-  if (!pidAlive2(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+  if (!pidAlive3(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
     fail(
       EXIT.DAEMON_DOWN,
       "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
       opts
     );
   }
-  const token = readDaemonToken(callerProject);
+  const token = readDaemonToken2(callerProject);
   if (token === null) {
     fail(
       EXIT.DAEMON_DOWN,
@@ -1210,18 +1561,18 @@ var init_daemon = __esm({
 });
 
 // src/commands/env.ts
-import { loadNoirEnv, loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
+import { loadNoirEnv, loadProjectInfo as loadProjectInfo4 } from "@noir-ai/core";
 import { resolveModelConfig } from "@noir-ai/model";
 function captureAmbientEnv(env2 = process.env) {
   ambientBaseline = { ...env2 };
 }
 function redactShape(value) {
   if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
-  return `${value.slice(0, 3)}\u2026(${value.length})`;
+  return `${truncateToWidth(value, 3, "")}\u2026(${value.length})`;
 }
 function configApiKeyEnvNames(root) {
   try {
-    const project = loadProjectInfo3(root);
+    const project = loadProjectInfo4(root);
     const names = /* @__PURE__ */ new Set();
     for (const provider of Object.values(resolveModelConfig(project.config.model).providers)) {
       if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
@@ -1290,6 +1641,7 @@ var init_env = __esm({
   "src/commands/env.ts"() {
     "use strict";
     init_output();
+    init_width();
     CURATED_AMBIENT_KEYS = [
       "CLICKUP_API_TOKEN",
       "OPENAI_API_KEY",
@@ -1314,13 +1666,13 @@ __export(install_exports, {
   installManagedNode: () => installManagedNode
 });
 import { chmodSync, mkdirSync } from "fs";
-import { join as join2 } from "path";
+import { join } from "path";
 import {
   atomicWriteFile as atomicWriteFile2,
   detectActiveMethod,
   detectInstallMethods,
   ensureShimExecutable,
-  loadProjectInfo as loadProjectInfo4,
+  loadProjectInfo as loadProjectInfo5,
   MANAGED_NODE_VERSION,
   NOIR_VERSION,
   noirHome,
@@ -1366,8 +1718,8 @@ function buildMigrationPlan(opts) {
 async function installManagedNode(opts) {
   const spec = opts.version ?? opts.channel ?? "latest";
   const home2 = noirHome();
-  const cliDir = join2(home2, "cli");
-  const binDir = join2(home2, "bin");
+  const cliDir = join(home2, "cli");
+  const binDir = join(home2, "bin");
   mkdirSync(cliDir, { recursive: true });
   mkdirSync(binDir, { recursive: true });
   let runtime;
@@ -1393,9 +1745,9 @@ async function installManagedNode(opts) {
   if (code !== 0) {
     return { ok: false, version: null, error: `npm install failed: ${stderr.slice(0, 300)}` };
   }
-  const shim = join2(binDir, "noir");
+  const shim = join(binDir, "noir");
   const shimBody = `#!/usr/bin/env bash
-"${nodeBin}" "${join2(cliDir, "lib", "node_modules", "@noir-ai", "cli", "dist", "bin.js")}" "$@"
+"${nodeBin}" "${join(cliDir, "lib", "node_modules", "@noir-ai", "cli", "dist", "bin.js")}" "$@"
 `;
   atomicWriteFile2(shim, shimBody);
   chmodSync(shim, 493);
@@ -1403,7 +1755,7 @@ async function installManagedNode(opts) {
   const ver = await runManagerCmd(
     [
       nodeBin,
-      join2(cliDir, "lib", "node_modules", "@noir-ai", "cli", "dist", "bin.js"),
+      join(cliDir, "lib", "node_modules", "@noir-ai", "cli", "dist", "bin.js"),
       "--version"
     ],
     { env: opts.env, timeoutMs: 3e4 }
@@ -1459,7 +1811,7 @@ async function install(opts = {}) {
   const installedRecord = readInstallRecord();
   let minVersion = "1.6.0";
   try {
-    minVersion = loadProjectInfo4(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo5(process.cwd()).config.update.minVersion;
   } catch {
   }
   const plan = buildMigrationPlan({
@@ -1536,7 +1888,7 @@ import {
   detectActiveMethod as detectActiveMethod2,
   ensureShimExecutable as ensureShimExecutable2,
   fetchLatestVersion,
-  loadProjectInfo as loadProjectInfo5,
+  loadProjectInfo as loadProjectInfo6,
   readInstallRecord as readInstallRecord2,
   readUpdateCache,
   runManagerCmd as runManagerCmd2,
@@ -1616,7 +1968,7 @@ async function update(opts = {}) {
   fetchSpin.succeed(`Latest: ${latest}`);
   let minVersion = DEFAULT_UPDATE_CONFIG.minVersion;
   try {
-    minVersion = loadProjectInfo5(process.cwd()).config.update.minVersion;
+    minVersion = loadProjectInfo6(process.cwd()).config.update.minVersion;
   } catch {
   }
   const target = buildUpdateTarget({
@@ -1766,7 +2118,7 @@ var init_update = __esm({
 });
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo6, NOIR_VERSION as NOIR_VERSION2 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo7, NOIR_VERSION as NOIR_VERSION2 } from "@noir-ai/core";
 async function tryTool(caller, name, args) {
   try {
     return await caller.callTool(name, args);
@@ -1887,7 +2239,7 @@ function renderHuman(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo6(process.cwd());
+    project = loadProjectInfo7(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -1917,7 +2269,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo6(process.cwd());
+        const info2 = loadProjectInfo7(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -1946,7 +2298,7 @@ var init_status = __esm({
 // src/commands/task.ts
 import { spawnSync } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo7, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo8, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -1959,7 +2311,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo7(process.cwd());
+    const project = loadProjectInfo8(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -2282,7 +2634,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo7(process.cwd());
+    project = loadProjectInfo8(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2388,7 +2740,7 @@ async function taskResearch(opts) {
     return;
   }
   renderStatusRow(s, opts);
-  info("research findings are recorded via `noir task research record` (list + record)", opts);
+  info("this is a status view; record findings with `noir task research-record`", opts);
 }
 async function taskResearchRecord(opts) {
   const TYPES = ["assumption", "discovery", "decision", "grounding-fact"];
@@ -2412,10 +2764,7 @@ async function taskResearchRecord(opts) {
 `);
     return;
   }
-  success(
-    `research recorded \u2192 ${opts.type}: ${opts.text.slice(0, 80)}${opts.text.length > 80 ? "\u2026" : ""}`,
-    opts
-  );
+  success(`research recorded \u2192 ${opts.type}: ${truncateToWidth(opts.text, 80)}`, opts);
 }
 async function taskDecompose(opts) {
   const cap = opts.capability.trim();
@@ -2471,6 +2820,7 @@ var init_task = __esm({
     init_daemon_client();
     init_output();
     init_theme();
+    init_width();
     PHASE_SKILL = {
       // Skill curation: intake+clarify merged into brainstorming;
       // execute → executing-plans; verify → verifying; document → wrap.
@@ -2488,13 +2838,13 @@ var init_task = __esm({
 
 // src/commands/handoff.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 import {
   defaultHandoffBlock,
   hostLaunchDirective,
-  resolveAdapter as resolveAdapter2
+  resolveAdapter
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo8, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo9, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 function heading(name, id) {
   return `# Noir handoff \u2014 ${name} (${id})`;
 }
@@ -2590,7 +2940,7 @@ function toHostPayload(p) {
 }
 function resolveDirective(root, p) {
   const ctx = { root };
-  const adapter = resolveAdapter2(p.host);
+  const adapter = resolveAdapter(p.host);
   const hostPayload = toHostPayload(p);
   if (typeof adapter.emitHandoff === "function") {
     return adapter.emitHandoff(ctx, hostPayload);
@@ -2633,7 +2983,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo8(process.cwd());
+    project = loadProjectInfo9(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2665,7 +3015,7 @@ async function handoff(opts) {
   if (opts.write === true) {
     const md = renderMarkdown(full);
     const path = handoffFilePath(project.root, task?.taskId, project.id);
-    mkdirSync2(join3(project.root, NOIR_DIR, "handoff"), { recursive: true });
+    mkdirSync2(join2(project.root, NOIR_DIR, "handoff"), { recursive: true });
     writeFileSync2(path, md, "utf8");
     info(`handoff written to ${path}`, opts);
   }
@@ -2693,7 +3043,7 @@ import gradient from "gradient-string";
 function renderBanner(opts = {}) {
   const width = opts.width ?? process.stdout.columns ?? 80;
   const colorOn = opts.color !== false && useColor();
-  if (width < 50) {
+  if (width < BLOCK_MIN_WIDTH) {
     return colorOn ? `${c.accent("\u25C6")} noir` : "\u25C6 noir";
   }
   const block = NOIR_BLOCK.join("\n");
@@ -2709,11 +3059,12 @@ function shouldShowBanner(opts) {
   if (v !== void 0 && v !== "") return false;
   return true;
 }
-var NOIR_BLOCK, NOIR_GRADIENT, NOIR_TAGLINE;
+var NOIR_BLOCK, NOIR_GRADIENT, NOIR_TAGLINE, BLOCK_WIDTH, BLOCK_MIN_WIDTH;
 var init_banner = __esm({
   "src/banner.ts"() {
     "use strict";
     init_theme();
+    init_width();
     NOIR_BLOCK = [
       "\u2588\u2588\u2588\u2557   \u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
       "\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557",
@@ -2724,6 +3075,8 @@ var init_banner = __esm({
     ];
     NOIR_GRADIENT = gradient("#2c5282", "#3b82f6", "#7dd3fc");
     NOIR_TAGLINE = "discipline, context, and memory layer for agentic CLIs";
+    BLOCK_WIDTH = NOIR_BLOCK.reduce((max, line) => Math.max(max, displayWidth(line)), 0);
+    BLOCK_MIN_WIDTH = BLOCK_WIDTH + 17;
   }
 });
 
@@ -3023,14 +3376,14 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod3,
   latestVersionFromCache,
-  loadProjectInfo as loadProjectInfo9,
+  loadProjectInfo as loadProjectInfo10,
   NOIR_VERSION as NOIR_VERSION3,
   readInstallRecord as readInstallRecord3,
   readUpdateCache as readUpdateCache2
 } from "@noir-ai/core";
 function tryProject() {
   try {
-    const info2 = loadProjectInfo9(process.cwd());
+    const info2 = loadProjectInfo10(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -3193,7 +3546,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo9(process.cwd());
+        const info2 = loadProjectInfo10(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -3256,12 +3609,12 @@ var init_home = __esm({
 
 // src/commands/memory.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo10(process.cwd()) };
+    return { routing, project: loadProjectInfo11(process.cwd()) };
   } catch {
     return null;
   }
@@ -3674,7 +4027,7 @@ function describe(step, who) {
   const m = {
     preflight: "check clean tree, on develop, HEAD pushed, gate green, no version collision",
     bump: "run bump-version.mjs + update CHANGELOG + roadmap docs",
-    gate: "re-run the full gate (lint/build/typecheck/test/docs:validate)",
+    gate: "re-run the full six-step gate (lint/build/typecheck/test/docs:validate/hygiene:gate)",
     commit: "commit chore(release) + push develop",
     "ci-develop": "wait for CI on develop \u2192 green",
     "beta-tag": "pnpm release:tag \u2192 beta tag + push",
@@ -3719,11 +4072,14 @@ async function release(opts) {
     });
     success(`bump: \u2713 version ${version}`, opts);
     info(`[3/13] gate: ${describe("gate", "noir")}`, opts);
-    execSync("pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate", {
-      encoding: "utf8",
-      stdio: "inherit"
-    });
-    success("gate: \u2713 full gate green", opts);
+    execSync(
+      "pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate && pnpm hygiene:gate",
+      {
+        encoding: "utf8",
+        stdio: "inherit"
+      }
+    );
+    success("gate: \u2713 all six gates green", opts);
     info(`[4/13] commit/push: ${describe("commit", "noir")}`, opts);
     spawnSync2("git", ["add", "-A"], { encoding: "utf8", stdio: "inherit" });
     spawnSync2("git", ["commit", "-m", `chore(release): v${version} + docs sync`], {
@@ -4583,10 +4939,10 @@ var init_run_interrupt = __esm({
 });
 
 // src/run-profiles.ts
-import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
+import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo11(root).config;
+    return loadProjectInfo12(root).config;
   } catch {
     return null;
   }
@@ -4670,6 +5026,8 @@ var init_run_status = __esm({
   "src/run-status.ts"() {
     "use strict";
     init_orchestrator();
+    init_theme();
+    init_width();
     HOST_STDERR_TAIL_LINES = 20;
     RunStatusLine = class {
       host;
@@ -4752,6 +5110,7 @@ var init_run_status = __esm({
         if (this.animated && this.sharesCursor && this.onRow) {
           this.write("\n");
           this.onRow = false;
+          this.rendered = "";
         }
         this.stdoutAtRowStart = chunk.endsWith("\n");
       }
@@ -4782,19 +5141,45 @@ var init_run_status = __esm({
           return;
         }
         if (!this.onRow || !this.cursorFree()) return;
-        this.write("\r\x1B[K");
+        this.write(this.erase(this.rendered));
         this.rendered = "";
         this.onRow = false;
       }
       /** Rewrite the current row in place, skipping no-op rewrites and unsafe moments. */
       draw() {
         if (!this.animated || !this.cursorFree()) return;
-        const text = this.render();
+        const text = truncateToWidth(this.render(), terminalWidth());
         if (text === this.rendered) return;
-        this.write(`\r\x1B[K${text}`);
+        this.write(`${this.erase(this.rendered)}${text}`);
         this.rendered = text;
         this.onRow = true;
       }
+      /**
+       * The escape sequence that clears the status text currently on screen and
+       * leaves the cursor at the start of the row it began on — where the next
+       * render writes. An empty `previous` still clears the row, so a line that has
+       * drawn nothing yet starts from a known-blank one.
+       *
+       * The extent is measured against the terminal width as it is NOW, not as it
+       * was when the text was drawn. Nothing this line writes wraps, but text that
+       * fitted a wider terminal does not stop existing when the window narrows: the
+       * terminal folds it onto rows below, and clearing only the row the cursor
+       * ends on would leave the rest above as residue. So the sequence walks back
+       * up over every row the text occupies. That folding is the behaviour of the
+       * common terminals (iTerm2, Terminal.app, GNOME Terminal and recent xterm);
+       * one that clips the row instead has no continuation to clear.
+       *
+       * The caller must have forgotten the text once its row was abandoned —
+       * `rendered` is only meaningful while `onRow` is true.
+       */
+      erase(previous) {
+        const rows = Math.max(1, Math.ceil(displayWidth(previous) / terminalWidth()));
+        let sequence = "\r\x1B[K";
+        for (let row = 1; row < rows; row++) {
+          sequence += "\x1B[1A\r\x1B[K";
+        }
+        return sequence;
+      }
       /**
        * Whether the cursor is at the start of a row nobody else is using. On stdout
        * that is not this terminal there is no shared cursor to disturb; when it is,
@@ -4832,7 +5217,7 @@ var init_run_status = __esm({
 
 // src/commands/run.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 import { SUPPORTED_HOSTS } from "@noir-ai/adapters";
 import { isDeniedEnvKey as isDeniedEnvKey2, loadNoirEnv as loadNoirEnv2, NOIR_DIR as NOIR_DIR2, parseConfig, paths } from "@noir-ai/core";
 function credentialNote(env2, sources) {
@@ -4892,7 +5277,7 @@ async function runOnce(prompt, opts, resumeSessionId) {
   const customBinary = opts.command ?? profile.binary;
   const extraArgs = resumeSessionId === void 0 ? profile.args : [...profile.args ?? [], "--resume", resumeSessionId];
   const env2 = profile.env ? mergeEnv(process.env, profile.env) : void 0;
-  if (!existsSync2(join4(root, NOIR_DIR2, ".env"))) {
+  if (!existsSync2(join3(root, NOIR_DIR2, ".env"))) {
     log(
       `This project has no ${NOIR_DIR2}/.env \u2014 that is where Noir reads project credentials and run config from. Run \`noir init\` to scaffold one (\`noir run\` works without it).`,
       opts
@@ -5055,7 +5440,7 @@ function safeTranscript(host, lines) {
 function writeTranscript(host, lines, root = process.cwd()) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const dir = paths.transcriptsDir(root);
-  const file = join4(dir, `${host}-${ts}.jsonl`);
+  const file = join3(dir, `${host}-${ts}.jsonl`);
   try {
     mkdirSync3(dir, { recursive: true, mode: 448 });
     writeFileSync4(file, `${lines.join("\n")}${lines.length > 0 ? "\n" : ""}`, { mode: 384 });
@@ -5192,7 +5577,7 @@ var init_conflict = __esm({
 
 // src/dedup-write.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 import { sha256Hex as sha256Hex2, sha256Hex12 } from "@noir-ai/core";
 async function checkWritePathDedup(root, res, opts) {
   const result = { found: [], conflicts: [] };
@@ -5203,7 +5588,7 @@ async function checkWritePathDedup(root, res, opts) {
   if (embed === void 0) return result;
   const cachedEmbed = makeCachedEmbed(cache, embed);
   for (const proposedRel of writtenHostFiles) {
-    const proposedAbs = join5(root, proposedRel);
+    const proposedAbs = join4(root, proposedRel);
     let proposedText;
     try {
       proposedText = readFileSync3(proposedAbs, "utf8");
@@ -5250,7 +5635,7 @@ async function checkWritePathDedup(root, res, opts) {
 `
       );
     }
-    const matchedText = safeRead(join5(root, matchedRel));
+    const matchedText = safeRead(join4(root, matchedRel));
     result.conflicts.push({
       path: proposedRel,
       mode: "artifact",
@@ -5334,21 +5719,21 @@ async function promptDedupAction(root, proposedRel, matchedRel, proposedText, si
   if (clack.isCancel(choice)) return "preserve";
   if (choice === "skip") {
     try {
-      rmSync(join5(root, proposedRel), { force: true });
+      rmSync(join4(root, proposedRel), { force: true });
     } catch {
     }
     return "preserve";
   } else if (choice === "replace") {
     try {
-      writeFileSync5(join5(root, matchedRel), proposedText, "utf8");
+      writeFileSync5(join4(root, matchedRel), proposedText, "utf8");
     } catch {
     }
     return "replace";
   } else if (choice === "mirror") {
     try {
-      const existing = readFileSync3(join5(root, matchedRel), "utf8");
+      const existing = readFileSync3(join4(root, matchedRel), "utf8");
       writeFileSync5(
-        join5(root, matchedRel),
+        join4(root, matchedRel),
         `${existing}
 
 <!-- mirrored from ${proposedRel} -->
@@ -5366,7 +5751,7 @@ function emptyCache() {
   return { version: DEDUP_CACHE_VERSION, model: "", entries: {} };
 }
 function cachePath(root) {
-  return join5(root, ".noir", "dedup-cache.json");
+  return join4(root, ".noir", "dedup-cache.json");
 }
 function loadCache(root) {
   try {
@@ -5385,7 +5770,7 @@ function loadCache(root) {
 }
 function saveCache(root, cache) {
   try {
-    mkdirSync4(join5(root, ".noir"), { recursive: true });
+    mkdirSync4(join4(root, ".noir"), { recursive: true });
     writeFileSync5(cachePath(root), JSON.stringify(cache), "utf8");
   } catch {
   }
@@ -5441,8 +5826,8 @@ var init_dedup_write = __esm({
 
 // src/init.ts
 import { existsSync as existsSync3 } from "fs";
-import { resolveAdapter as resolveAdapter3 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo12, paths as paths2 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter2 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo13, paths as paths2 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import {
   emitSkillsToDir
@@ -5469,13 +5854,14 @@ async function init(root, opts) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.noop) return res;
   const skillSummary = await emitHostSkills(root, host, conflictOpts, interactive);
   res.skillConflicts = skillSummary?.conflicts ?? [];
   res.preservedSkills = skillSummary?.preserved ?? [];
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo12(root);
+    projectInfo = loadProjectInfo13(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5506,7 +5892,7 @@ function resolveInitHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
   if (!existsSync3(paths2.config(root))) return "claude";
   try {
-    return loadProjectInfo12(root).config.host;
+    return loadProjectInfo13(root).config.host;
   } catch {
     process.stderr.write(
       `Could not read the configured host from ${paths2.config(root)}; using 'claude'.
@@ -5537,8 +5923,13 @@ function reportPlannedWrites(res) {
     for (const p of res.identical) log(`  ${p}`);
   }
 }
+function reportEnvHeal(res) {
+  if (res.envMode === "healed") {
+    process.stderr.write("Tightened .noir/.env to 0600 (it was readable by group or others).\n");
+  }
+}
 async function emitHostSkills(root, host, conflictOpts, interactive) {
-  const adapter = resolveAdapter3(host);
+  const adapter = resolveAdapter2(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -5602,8 +5993,8 @@ var init_init = __esm({
 });
 
 // src/commands/skills.ts
-import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter3 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -5621,13 +6012,6 @@ function toRow(s, kind = "builtin") {
   const category = s.frontmatter.metadata?.category?.trim() || categoryOf(s.name);
   return { name: s.name, category, description, kind, status: status2 };
 }
-function truncate(text, max) {
-  if (text.length <= max) return text;
-  const slice = text.slice(0, Math.max(0, max - 1));
-  const boundary = slice.lastIndexOf(" ");
-  const head = boundary > 0 ? slice.slice(0, boundary) : slice;
-  return `${head.trimEnd()}\u2026`;
-}
 async function skillsList(opts) {
   let builtins;
   let integrations;
@@ -5661,7 +6045,9 @@ async function skillsList(opts) {
       Kind: r.kind,
       Category: r.category,
       Status: r.status,
-      Description: truncate(r.description, 80)
+      // Display-only cut for the dense table cell; the `--json` payload always
+      // carries the description whole (search snippets must never be truncated).
+      Description: truncateToWidth(r.description, 80)
     })),
     ["Skill", "Kind", "Category", "Status", "Description"],
     opts
@@ -5671,11 +6057,11 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo13(root);
+    project = loadProjectInfo14(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
-  const adapter = resolveAdapter4(project.config.host);
+  const adapter = resolveAdapter3(project.config.host);
   if (!adapter.skillsDir) {
     const data2 = {
       emitted: [],
@@ -5737,7 +6123,7 @@ async function skillsLint(opts) {
     );
   }
   const errored = skills.filter((s) => s.errors.length > 0);
-  const warned = skills.filter((s) => s.warnings.length > 0 && s.errors.length === 0);
+  const warned = skills.filter((s) => s.warnings.length > 0);
   const data = { count: skills.length, errored: errored.length, skills };
   if (errored.length > 0) {
     const message = `skills lint: ${errored.length} skill${errored.length === 1 ? "" : "s"} failed validation`;
@@ -5815,6 +6201,7 @@ var init_skills = __esm({
     "use strict";
     init_init();
     init_output();
+    init_width();
     CATEGORY = {
       "noir-brainstorming": "discovery",
       "noir-sync": "discovery",
@@ -5841,17 +6228,22 @@ var init_skills = __esm({
       "noir-backend": "domain",
       "noir-doctor": "meta",
       "noir-writing-skills": "meta",
-      "noir-rules": "meta"
+      "noir-rules": "meta",
+      "noir-code-hygiene": "meta"
     };
   }
 });
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo14 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning2, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo14(process.cwd());
+  if (opts.workspace !== void 0) {
+    await bridgeStdioToWorkspace(opts.workspace, process.cwd());
+    return;
+  }
+  const project = loadProjectInfo15(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -5877,6 +6269,7 @@ async function serve(opts) {
 var init_serve = __esm({
   "src/serve.ts"() {
     "use strict";
+    init_workspace_bridge();
   }
 });
 
@@ -5886,8 +6279,8 @@ __export(create_exports, {
   create: () => create
 });
 import { resolve as resolve2 } from "path";
-import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo15 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo16 } from "@noir-ai/core";
 import { scaffold as scaffold2 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir3 } from "@noir-ai/skills";
 async function create(dir, opts) {
@@ -5911,9 +6304,10 @@ async function create(dir, opts) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.noop) return res;
   const host = res.host;
-  const adapter = resolveAdapter5(host);
+  const adapter = resolveAdapter4(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -5941,7 +6335,7 @@ async function create(dir, opts) {
   }
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo15(root);
+    projectInfo = loadProjectInfo16(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5968,8 +6362,8 @@ __export(sync_exports, {
   sync: () => sync
 });
 import { existsSync as existsSync4 } from "fs";
-import { resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo16, paths as paths3 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo17, paths as paths3 } from "@noir-ai/core";
 import { scaffold as scaffold3 } from "@noir-ai/create";
 import { emitSkillsToDir as emitSkillsToDir4 } from "@noir-ai/skills";
 async function sync(root, opts = {}) {
@@ -5978,7 +6372,7 @@ async function sync(root, opts = {}) {
   const conflictOpts = buildConflictOpts({ force: opts.force, interactive });
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo16(root);
+    projectInfo = loadProjectInfo17(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5997,10 +6391,11 @@ async function sync(root, opts = {}) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.written.length === 0 && res.identical.length > 0) {
     process.stderr.write("Nothing to sync (Noir-managed files are up to date).\n");
   }
-  const adapter = resolveAdapter6(host);
+  const adapter = resolveAdapter5(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -6041,7 +6436,7 @@ function resolveSyncHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
   if (!existsSync4(paths3.config(root))) return "claude";
   try {
-    return loadProjectInfo16(root).config.host;
+    return loadProjectInfo17(root).config.host;
   } catch {
     return "claude";
   }
@@ -6163,6 +6558,8 @@ function createProgram() {
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
     else delete process.env.NOIR_NON_INTERACTIVE;
+    if (opts.quiet === true) process.env.NOIR_QUIET = "1";
+    else delete process.env.NOIR_QUIET;
     emitDeprecationHintsFor(actionCmd, toCliOptions(opts));
   });
   program2.command("init").description("scaffold Noir in the current project (.noir/, .mcp.json, CLAUDE.md, skills)").option("--transport <transport>", "stdio | streamable-http (default: stdio)", "stdio").option("--url <url>", "streamable-http daemon URL (localhost only)").option(
@@ -6268,11 +6665,17 @@ function createProgram() {
     }
   );
   const mcpCmd = program2.command("mcp").description("MCP server control");
-  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").action(async (opts) => {
-    await serve({ stdio: opts.stdio === true });
+  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").option(
+    "--workspace <name>",
+    "serve a shared workspace over stdio, bridging to that workspace daemon"
+  ).action(async (opts) => {
+    await serve({
+      stdio: opts.stdio === true,
+      ...typeof opts.workspace === "string" ? { workspace: opts.workspace } : {}
+    });
   });
   mcpCmd.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio]");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio] [--workspace <name>]");
   });
   const daemonGrp = program2.command("daemon").description("control the Noir daemon");
   daemonGrp.command("start").description("start the Noir daemon (foreground, or background with --detach)").option("--detach", "run the daemon in the background and exit").option("--workspace <name>", "start a shared cross-repo workspace daemon instead").option("--force", "overwrite a non-Noir .mcp.json entry (--workspace only)").addOption(
@@ -6373,10 +6776,16 @@ function createProgram() {
   program2.command("doctor").description("environment + project health").option(
     "--dedup",
     "scan host-context + .noir/ docs for semantic near-duplicates (loads the local embedder)"
-  ).action(async (...args) => {
+  ).option("--fix", "re-assert owner-only permissions on .noir/.env and the store DB + directory").action(async (...args) => {
     const g = actionGlobals(args);
-    const dedup = trailingCmd(args).opts().dedup === true;
-    await doctor({ ...toCliOptions(g), ...dedup ? { dedup: true } : {} });
+    const opts = trailingCmd(args).opts();
+    const dedup = opts.dedup === true;
+    const fix = opts.fix === true;
+    await doctor({
+      ...toCliOptions(g),
+      ...dedup ? { dedup: true } : {},
+      ...fix ? { fix: true } : {}
+    });
   });
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
@@ -6569,7 +6978,7 @@ function createProgram() {
       ...check === void 0 || check.length === 0 ? {} : { check }
     });
   });
-  taskGrp.command("research").description("list research findings for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
+  taskGrp.command("research").description("show research status for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
     const first = args[0];
@@ -6816,22 +7225,22 @@ var init_bin = __esm({
 });
 
 // src/daemon-client.ts
-import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { Client, StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/client";
 import { ContextEngine, createEmbedFn, resolveEmbedderConfig } from "@noir-ai/context";
 import {
-  loadProjectInfo as loadProjectInfo17,
+  loadProjectInfo as loadProjectInfo18,
   NOIR_VERSION as NOIR_VERSION5,
   readWorkspaceMarker as readWorkspaceMarker2,
   workspaceStoreDbPath
 } from "@noir-ai/core";
 import {
   ensureDaemonRunning as ensureDaemonRunning3,
-  pidAlive as pidAlive3,
-  readDaemonToken as readDaemonToken2,
+  pidAlive as pidAlive4,
+  readDaemonToken as readDaemonToken3,
   readProjectDaemonRecord as readProjectDaemonRecord2,
-  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
+  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord3,
   resolveGateConfig,
-  tokenPath
+  tokenPath as tokenPath2
 } from "@noir-ai/daemon";
 import { createMemoryEngine } from "@noir-ai/memory";
 import { openStore } from "@noir-ai/store";
@@ -6854,7 +7263,7 @@ function failDaemonDown(opts, cause) {
 async function probeDaemon(opts = {}) {
   const expectedProject = opts.project?.id ?? (() => {
     try {
-      return loadProjectInfo17(process.cwd()).id;
+      return loadProjectInfo18(process.cwd()).id;
     } catch {
       return void 0;
     }
@@ -6868,7 +7277,7 @@ async function probeDaemon(opts = {}) {
     if (opts.verbose) process.stderr.write("noir: daemon probe: no daemon record\n");
     return { running: false };
   }
-  if (!pidAlive3(rec.pid)) {
+  if (!pidAlive4(rec.pid)) {
     if (opts.verbose) process.stderr.write(`noir: daemon probe: pid ${rec.pid} not alive
 `);
     return { running: false };
@@ -6907,7 +7316,7 @@ async function probeDaemon(opts = {}) {
 async function resolveDaemon(opts) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo17(process.cwd());
+    project = opts.project ?? loadProjectInfo18(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -6968,8 +7377,8 @@ async function resolveDaemon(opts) {
   return { client, stop };
 }
 function httpTransport(url, scopeKey) {
-  const token = scopeKey === null ? null : readDaemonToken2(scopeKey);
-  return new StreamableHTTPClientTransport(
+  const token = scopeKey === null ? null : readDaemonToken3(scopeKey);
+  return new StreamableHTTPClientTransport2(
     new URL(url),
     // Verified present: StreamableHTTPClientTransportOptions.requestInit?: RequestInit
     token ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {}
@@ -6977,7 +7386,7 @@ function httpTransport(url, scopeKey) {
 }
 function callerScopeKey(opts) {
   try {
-    return (opts.project ?? loadProjectInfo17(process.cwd())).id;
+    return (opts.project ?? loadProjectInfo18(process.cwd())).id;
   } catch {
     return null;
   }
@@ -7007,7 +7416,7 @@ function failWorkspaceConnect(opts, routing, cause) {
     }
     fail(
       EXIT.DAEMON_DOWN,
-      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
+      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath2(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
       opts
     );
   }
@@ -7078,7 +7487,7 @@ async function callDaemonTool(opts, name, args = {}) {
 async function withInProcessRead(opts, fn) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo17(process.cwd());
+    project = opts.project ?? loadProjectInfo18(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -7125,14 +7534,14 @@ function workspaceRoutingTarget(root) {
   const name = readWorkspaceMarker2(root);
   if (name === null) return null;
   try {
-    return { name, projectId: loadProjectInfo17(root).id };
+    return { name, projectId: loadProjectInfo18(root).id };
   } catch {
     return null;
   }
 }
 async function probeWorkspaceDaemon(routing) {
-  const rec = readWorkspaceDaemonRecord2(routing.name);
-  if (rec === null || !pidAlive3(rec.pid)) return { running: false };
+  const rec = readWorkspaceDaemonRecord3(routing.name);
+  if (rec === null || !pidAlive4(rec.pid)) return { running: false };
   try {
     const res = await fetch(`http://127.0.0.1:${rec.port}/health`, {
       signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
@@ -7215,17 +7624,182 @@ var init_daemon_client = __esm({
   }
 });
 
+// src/hygiene-scan.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import { join as join5 } from "path";
+import { checkHygiene } from "@noir-ai/skills";
+function readDirEntries(dir) {
+  try {
+    return readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function isDirectory(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function hygieneKindOf(path) {
+  if (HYGIENE_MARKDOWN_EXTENSIONS.test(path)) return "markdown";
+  if (HYGIENE_CODE_EXTENSIONS.test(path)) return "code";
+  return null;
+}
+function hasScannableLayout(root) {
+  if (isDirectory(join5(root, "docs")) || isDirectory(join5(root, "scripts"))) return true;
+  for (const entry of readDirEntries(join5(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    if (isDirectory(join5(root, "packages", entry.name, "src"))) return true;
+    if (isDirectory(join5(root, "packages", entry.name, "test"))) return true;
+  }
+  return false;
+}
+function addHygieneFile(rel, walk) {
+  const name = rel.slice(rel.lastIndexOf("/") + 1);
+  if (name.startsWith(".") || HYGIENE_EXCLUDED_FILES.has(name)) return;
+  const kind = hygieneKindOf(rel);
+  if (kind === null) return;
+  if (walk.files.length >= HYGIENE_MAX_FILES) {
+    walk.truncated = true;
+    return;
+  }
+  walk.files.push({ path: rel, kind });
+}
+function walkScannable(root, relDir, skip, walk) {
+  if (walk.truncated) return;
+  for (const entry of readDirEntries(join5(root, relDir))) {
+    if (walk.truncated) return;
+    const rel = `${relDir}/${entry.name}`;
+    if (entry.isDirectory()) {
+      if (HYGIENE_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".") || skip.has(rel)) {
+        continue;
+      }
+      walkScannable(root, rel, skip, walk);
+    } else if (entry.isFile()) {
+      addHygieneFile(rel, walk);
+    }
+  }
+}
+function collectHygieneFiles(root) {
+  const walk = { files: [], truncated: false };
+  for (const entry of readDirEntries(root)) {
+    if (entry.isFile()) addHygieneFile(entry.name, walk);
+  }
+  walkScannable(root, "docs", HYGIENE_EXCLUDED_DIRS, walk);
+  walkScannable(root, ".claude/skills", NO_SKIP_DIRS, walk);
+  for (const entry of readDirEntries(join5(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    walkScannable(root, `packages/${entry.name}/src`, NO_SKIP_DIRS, walk);
+    walkScannable(root, `packages/${entry.name}/test`, NO_SKIP_DIRS, walk);
+  }
+  walkScannable(root, "scripts", NO_SKIP_DIRS, walk);
+  walk.files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return walk;
+}
+function hygieneOmissions(result) {
+  const notes = [];
+  if (result.skipped > 0) {
+    notes.push(
+      `${result.skipped} file${result.skipped === 1 ? "" : "s"} over ${HYGIENE_MAX_FILE_BYTES / 1024} KiB skipped`
+    );
+  }
+  if (result.truncated) notes.push(`stopped at ${HYGIENE_MAX_FILES} files`);
+  return notes.length > 0 ? ` (${notes.join("; ")})` : "";
+}
+function hygieneCounts(result) {
+  const omitted = hygieneOmissions(result);
+  if (result.scanned === 0) {
+    return `nothing to scan (no packages/*/src, packages/*/test, scripts/ or documents found)${omitted}`;
+  }
+  if (result.findings.length === 0) {
+    return `clean \u2014 ${result.scanned} file${result.scanned === 1 ? "" : "s"} scanned${omitted}`;
+  }
+  const files = new Set(result.findings.map((f) => f.path)).size;
+  return `${result.fail} fail, ${result.warn} warn in ${files} file${files === 1 ? "" : "s"}${omitted}`;
+}
+function hygieneDetail(result) {
+  const counts = hygieneCounts(result);
+  if (result.scanned === 0 || result.findings.length === 0) return counts;
+  const named = result.findings.slice(0, HYGIENE_FINDING_CAP);
+  const hidden = result.findings.length - named.length;
+  const where = named.map((f) => `${f.path}:${f.line} ${f.id}`).join("; ");
+  return `${counts} \u2014 ${where}${hidden > 0 ? ` (+${hidden} more)` : ""}`;
+}
+function scanOutputHygiene(root) {
+  const empty = {
+    scanned: 0,
+    skipped: 0,
+    truncated: false,
+    findings: [],
+    fail: 0,
+    warn: 0
+  };
+  if (!hasScannableLayout(root)) return empty;
+  const walk = collectHygieneFiles(root);
+  const findings = [];
+  let scanned = 0;
+  let skipped = 0;
+  for (const file of walk.files) {
+    const abs = join5(root, file.path);
+    try {
+      if (statSync(abs).size > HYGIENE_MAX_FILE_BYTES) {
+        skipped++;
+        continue;
+      }
+      const text = readFileSync4(abs, "utf8");
+      scanned++;
+      for (const found of checkHygiene(text, file.kind)) {
+        findings.push({ path: file.path, line: found.line, id: found.id, tier: found.tier });
+      }
+    } catch {
+    }
+  }
+  findings.sort((a, b) => {
+    if (a.tier !== b.tier) return a.tier === "fail" ? -1 : 1;
+    if (a.path !== b.path) return a.path < b.path ? -1 : 1;
+    return a.line - b.line;
+  });
+  const fail2 = findings.filter((f) => f.tier === "fail").length;
+  return {
+    scanned,
+    skipped,
+    truncated: walk.truncated,
+    findings,
+    fail: fail2,
+    warn: findings.length - fail2
+  };
+}
+var HYGIENE_FINDING_CAP, HYGIENE_MAX_FILE_BYTES, HYGIENE_MAX_FILES, HYGIENE_CODE_EXTENSIONS, HYGIENE_MARKDOWN_EXTENSIONS, HYGIENE_SKIP_DIRS, HYGIENE_EXCLUDED_DIRS, HYGIENE_EXCLUDED_FILES, NO_SKIP_DIRS;
+var init_hygiene_scan = __esm({
+  "src/hygiene-scan.ts"() {
+    "use strict";
+    HYGIENE_FINDING_CAP = 5;
+    HYGIENE_MAX_FILE_BYTES = 512 * 1024;
+    HYGIENE_MAX_FILES = 2e3;
+    HYGIENE_CODE_EXTENSIONS = /\.(?:ts|tsx|js|jsx|mjs|cjs|sh)$/i;
+    HYGIENE_MARKDOWN_EXTENSIONS = /\.(?:md|mdx)$/i;
+    HYGIENE_SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
+    HYGIENE_EXCLUDED_DIRS = /* @__PURE__ */ new Set(["docs/internal", "docs/decisions", "docs/roadmap"]);
+    HYGIENE_EXCLUDED_FILES = /* @__PURE__ */ new Set(["CHANGELOG.md"]);
+    NO_SKIP_DIRS = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/commands/doctor.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 import { dirname, join as join6, relative } from "path";
 import { fileURLToPath } from "url";
-import { resolveAdapter as resolveAdapter7 } from "@noir-ai/adapters";
+import { mcpConfigPathFor as mcpConfigPathFor2, resolveAdapter as resolveAdapter6 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod4,
+  ensureOwnerOnly,
+  ensureOwnerOnlyDir,
   latestVersionFromCache as latestVersionFromCache2,
   loadNoirEnv as loadNoirEnv3,
-  loadProjectInfo as loadProjectInfo18,
+  loadProjectInfo as loadProjectInfo19,
   NOIR_VERSION as NOIR_VERSION6,
   paths as paths4,
   readInstallRecord as readInstallRecord4,
@@ -7238,7 +7812,7 @@ import {
   readScaffoldVersion,
   render
 } from "@noir-ai/create";
-import { pidAlive as pidAlive4, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
+import { pidAlive as pidAlive5, readProjectDaemonRecord as readProjectDaemonRecord3 } from "@noir-ai/daemon";
 import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
 async function probeOnnx() {
   try {
@@ -7254,7 +7828,7 @@ function describeOnnx(o) {
   if (/Cannot find (module|package)/i.test(o.reason)) {
     return "not resolvable from CLI probe (best-effort)";
   }
-  const r = o.reason.length > 60 ? `${o.reason.slice(0, 59)}\u2026` : o.reason;
+  const r = truncateToWidth(o.reason, 60);
   return `probe failed: ${r}`;
 }
 function fmtUptime(sec) {
@@ -7286,7 +7860,7 @@ function checkConfig(root) {
     };
   }
   try {
-    const project = loadProjectInfo18(root);
+    const project = loadProjectInfo19(root);
     return {
       project,
       result: {
@@ -7320,7 +7894,7 @@ async function checkDaemon(checks, project) {
     });
     return;
   }
-  if (!pidAlive4(rec.pid)) {
+  if (!pidAlive5(rec.pid)) {
     checks.push({
       name: "daemon",
       status: "warn",
@@ -7403,11 +7977,21 @@ async function checkStore(checks, project, root) {
     }
   }
 }
+function envModeCause(st) {
+  return st.ctimeMs > st.mtimeMs ? "changed" : "legacy";
+}
+function octalMode(mode) {
+  return mode.toString(8).padStart(4, "0");
+}
+function describeEnvMode(cause, mode) {
+  const lead = `is ${octalMode(mode)} \u2014 accessible to other accounts; run \`noir sync\` (or \`chmod 600 .noir/.env\`) to make it owner-only.`;
+  return cause === "legacy" ? `${lead} Nothing has changed its mode since the file was written, so the file predates the owner-only contract (an older Noir seeded it, a clone delivered it, it was created by hand, or it was saved by a tool that replaces the file) \u2014 this is not a change you made.` : `${lead} Its mode was changed after the file was written (a \`chmod\`, a \`chown\`, or a restore that re-applied metadata), so no older Noir left it this way.`;
+}
 function checkNoirEnv(checks, root, loaded) {
   const path = join6(paths4.noirDir(root), ".env");
   let st;
   try {
-    st = statSync(path);
+    st = statSync2(path);
   } catch {
     return;
   }
@@ -7425,8 +8009,8 @@ function checkNoirEnv(checks, root, loaded) {
     tooOpen ? {
       name: "noir-env",
       status: "warn",
-      detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
-    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
+      detail: `${path} ${describeEnvMode(envModeCause(st), mode)}`
+    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${octalMode(mode)})` }
   );
   for (const [key, source] of Object.entries(loaded.sources)) {
     if (source !== "file") continue;
@@ -7526,7 +8110,7 @@ function checkSeedDrift(checks, root) {
   const seedPath = join6(root, ".noir", ".env.example");
   let bytes;
   try {
-    bytes = readFileSync4(seedPath, "utf8");
+    bytes = readFileSync5(seedPath, "utf8");
   } catch {
     return;
   }
@@ -7544,6 +8128,14 @@ function checkRulesMdBudget(checks, root, project) {
     checks.push({ name: "rules budget", status: "warn", detail: "skipped \u2014 not initialized" });
     return null;
   }
+  if (project.config.rules.enabled === false) {
+    checks.push({
+      name: "rules budget",
+      status: "ok",
+      detail: "disabled \u2014 rules.enabled is false in .noir/config.yml (RULES.md is not measured)"
+    });
+    return null;
+  }
   const rulesPath = paths4.rulesMd(root);
   if (!existsSync5(rulesPath)) {
     checks.push({
@@ -7555,7 +8147,7 @@ function checkRulesMdBudget(checks, root, project) {
   }
   let content;
   try {
-    content = readFileSync4(rulesPath, "utf8");
+    content = readFileSync5(rulesPath, "utf8");
   } catch (e) {
     checks.push({
       name: "rules budget",
@@ -7599,7 +8191,7 @@ function checkHostArtifacts(checks, root, project) {
     return null;
   }
   const host = project.config.host;
-  const adapter = resolveAdapter7(host);
+  const adapter = resolveAdapter6(host);
   const ectx = { root };
   const expected = [];
   const emitsAgentsMd = host === "agents-md" || host === "cursor" || host === "opencode";
@@ -7608,7 +8200,7 @@ function checkHostArtifacts(checks, root, project) {
   }
   if (host === "claude") expected.push("CLAUDE.md");
   else if (host === "gemini") expected.push("GEMINI.md");
-  expected.push(relOr(adapter.mcpConfigPath?.(ectx) ?? ".mcp.json", root));
+  expected.push(relOr(mcpConfigPathFor2(host, root), root));
   const missing = expected.filter((p) => !existsSync5(joinRoot(root, p)));
   const status2 = missing.length === 0 ? "ok" : "warn";
   const detail = missing.length === 0 ? `host=${host} \xB7 all ${expected.length} primary artifacts present` : `host=${host} \xB7 missing ${missing.join(", ")} (run \`noir sync\` to restore)`;
@@ -7635,6 +8227,15 @@ function checkNestedNoir(checks, root) {
   });
   return { detected, paths: found };
 }
+function checkOutputHygiene(checks, root) {
+  const result = scanOutputHygiene(root);
+  checks.push({
+    name: "output hygiene",
+    status: result.fail > 0 ? "fail" : result.warn > 0 ? "warn" : "ok",
+    detail: hygieneDetail(result)
+  });
+  return result;
+}
 function collectDedupCandidates(root) {
   const rels = ["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".noir/rules/RULES.md"];
   const out = [];
@@ -7643,7 +8244,7 @@ function collectDedupCandidates(root) {
     if (!existsSync5(abs)) continue;
     let text;
     try {
-      text = readFileSync4(abs, "utf8");
+      text = readFileSync5(abs, "utf8");
     } catch {
       continue;
     }
@@ -7703,7 +8304,7 @@ function resolveWorkspacePackagesDir() {
     const pkgPath = join6(here, "package.json");
     if (existsSync5(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
         if (pkg.name === "@noir-ai/cli") {
           const packagesDir = dirname(here);
           if (existsSync5(join6(dirname(packagesDir), "pnpm-workspace.yaml"))) {
@@ -7751,7 +8352,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
   }
   let entries = [];
   try {
-    entries = readdirSync2(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync3(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (e) {
     checks.push({
       name: "publish",
@@ -7768,7 +8369,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
     if (!existsSync5(pkgPath)) continue;
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     } catch (e) {
       issues.push(`${name}/package.json: unparseable (${msg(e)})`);
       checked++;
@@ -7847,6 +8448,17 @@ function renderHuman2(payload, opts) {
     ["Check", "Status", "Detail"],
     opts
   );
+  if (payload.fixes) {
+    const healed = payload.fixes.filter((f) => f.outcome === "healed");
+    if (healed.length > 0) {
+      log(
+        `fixed ${healed.length} permission${healed.length === 1 ? "" : "s"}: ${healed.map((f) => f.path).join(", ")}`,
+        opts
+      );
+    } else {
+      log("nothing to fix \u2014 permissions already owner-only", opts);
+    }
+  }
   const { ok, warn: warnN, fail: fail2 } = payload.summary;
   if (fail2 > 0) {
     error(
@@ -7859,12 +8471,24 @@ function renderHuman2(payload, opts) {
     success(`all ${ok} check${ok === 1 ? "" : "s"} passed`, opts);
   }
 }
+function fixOwnerOnlyPermissions(root, project) {
+  const fixes = [
+    { path: ".noir/.env", outcome: ensureOwnerOnly(join6(paths4.noirDir(root), ".env")) }
+  ];
+  if (project) {
+    const dbRel = `.noir/store/${project.id}.db`;
+    fixes.push({ path: dbRel, outcome: ensureOwnerOnly(join6(root, dbRel)) });
+    fixes.push({ path: ".noir/store", outcome: ensureOwnerOnlyDir(paths4.storeDir(root)) });
+  }
+  return fixes;
+}
 async function doctor(opts = {}) {
   const root = process.cwd();
   const checks = [];
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
+  const fixes = opts.fix === true ? fixOwnerOnlyPermissions(root, project) : void 0;
   await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
@@ -7877,6 +8501,7 @@ async function doctor(opts = {}) {
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
   checkNestedNoir(checks, root);
+  checkOutputHygiene(checks, root);
   if (opts.dedup === true) {
     await checkSemanticDupDoctor(checks, root, project);
   }
@@ -7900,7 +8525,8 @@ async function doctor(opts = {}) {
       method: installCheck.method,
       installedVersion: installCheck.installedVersion,
       latestKnown: installCheck.latestKnown
-    }
+    },
+    ...fixes ? { fixes } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: payload })}
@@ -7920,17 +8546,17 @@ var init_doctor = __esm({
   "src/commands/doctor.ts"() {
     "use strict";
     init_daemon_client();
+    init_hygiene_scan();
     init_output();
     init_theme();
+    init_width();
     ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
     SEMVER_ISH = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
   }
 });
 
-// src/doctor.ts
-init_doctor();
-
 // src/index.ts
+init_doctor();
 init_init();
 init_serve();
 export {