@noir-ai/cli 1.15.0 → 1.16.0

package/dist/tui/{chunk-5KWETEMF.js → chunk-6AUAIEFG.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_UPDATE_CONFIG,
   buildUpdateNotice,
   runAsyncUpdateCheck
-} from "./chunk-TPNJEN4B.js";
+} from "./chunk-CQU2INJH.js";
 import {
   EXIT,
   NoirCliError,
@@ -10,6 +10,7 @@ import {
   badge,
   c,
   definitionList,
+  displayWidth,
   error,
   fail,
   failAndExit,
@@ -23,31 +24,33 @@ import {
   spinner,
   success,
   table,
+  terminalWidth,
   tip,
+  truncateToWidth,
   useColor,
   warn
-} from "./chunk-KETMM3BA.js";
+} from "./chunk-KVJIPKVE.js";
 
 // src/commands/status.ts
-import { loadProjectInfo as loadProjectInfo14, NOIR_VERSION as NOIR_VERSION5 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo15, NOIR_VERSION as NOIR_VERSION5 } from "@noir-ai/core";
 
 // src/daemon-client.ts
-import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { Client, StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/client";
 import { ContextEngine, createEmbedFn, resolveEmbedderConfig } from "@noir-ai/context";
 import {
-  loadProjectInfo as loadProjectInfo13,
+  loadProjectInfo as loadProjectInfo14,
   NOIR_VERSION as NOIR_VERSION4,
   readWorkspaceMarker as readWorkspaceMarker2,
   workspaceStoreDbPath
 } from "@noir-ai/core";
 import {
   ensureDaemonRunning as ensureDaemonRunning3,
-  pidAlive as pidAlive4,
-  readDaemonToken as readDaemonToken2,
+  pidAlive as pidAlive5,
+  readDaemonToken as readDaemonToken3,
   readProjectDaemonRecord as readProjectDaemonRecord3,
-  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
+  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord3,
   resolveGateConfig,
-  tokenPath
+  tokenPath as tokenPath2
 } from "@noir-ai/daemon";
 import { createMemoryEngine } from "@noir-ai/memory";
 import { openStore } from "@noir-ai/store";
@@ -226,12 +229,12 @@ function renderStatus(data, opts) {
 }
 
 // src/commands/daemon.ts
-import { loadProjectInfo as loadProjectInfo2 } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo3 } from "@noir-ai/core";
 import {
   clearProjectDaemonRecord,
   ensureDaemonRunning,
-  pidAlive as pidAlive2,
-  readDaemonToken,
+  pidAlive as pidAlive3,
+  readDaemonToken as readDaemonToken2,
   readProjectDaemonRecord,
   spawnDetachedDaemon
 } from "@noir-ai/daemon";
@@ -243,7 +246,7 @@ import {
   ensureWorkspaceRegistry,
   isValidWorkspaceName,
   isWorkspaceMember,
-  loadProjectInfo,
+  loadProjectInfo as loadProjectInfo2,
   readWorkspaceMarker,
   readWorkspaceRegistry,
   removeWorkspaceMember,
@@ -254,19 +257,228 @@ import {
 import {
   clearWorkspaceDaemonRecord,
   ensureWorkspaceDaemonRunning,
-  pidAlive,
-  readWorkspaceDaemonRecord,
+  pidAlive as pidAlive2,
+  readWorkspaceDaemonRecord as readWorkspaceDaemonRecord2,
   spawnDetachedWorkspaceDaemon
 } from "@noir-ai/daemon";
 
+// src/workspace-bridge.ts
+import {
+  ReadBuffer,
+  StreamableHTTPClientTransport,
+  serializeMessage
+} from "@modelcontextprotocol/client";
+import { loadProjectInfo } from "@noir-ai/core";
+import { pidAlive, readDaemonToken, readWorkspaceDaemonRecord, tokenPath } from "@noir-ai/daemon";
+var HEALTH_PROBE_TIMEOUT_MS = 1500;
+async function resolveWorkspaceDaemon(name, root) {
+  const record = readWorkspaceDaemonRecord(name);
+  if (record === null) {
+    return { error: `no daemon recorded for workspace ${name}` };
+  }
+  const health = await verifyWorkspaceDaemon(record, name);
+  if (health.kind === "foreign") {
+    return {
+      error: `workspace ${name} is recorded on port ${record.port}, but the daemon answering there serves workspace ${health.workspace}`
+    };
+  }
+  if (health.kind === "silent") {
+    return { error: `record exists but the daemon is not answering (pid ${record.pid})` };
+  }
+  const token = readDaemonToken(name);
+  if (token === null) {
+    return {
+      error: `workspace ${name} daemon is answering but its token is unreadable at ${tokenPath(name)}`
+    };
+  }
+  let callerProjectId;
+  try {
+    callerProjectId = loadProjectInfo(root).id;
+  } catch {
+    return {
+      error: `no project identity in ${root} \u2014 run \`noir init\` before serving a workspace from here`
+    };
+  }
+  return { url: `http://127.0.0.1:${record.port}/mcp?p=${callerProjectId}`, token };
+}
+async function verifyWorkspaceDaemon(record, name) {
+  if (!pidAlive(record.pid)) return { kind: "silent" };
+  return probeHealth(record.port, name, record.pid);
+}
+async function probeHealth(port, name, pid) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/health`, {
+      signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS)
+    });
+    if (!response.ok) return { kind: "silent" };
+    const body = await response.json().catch(() => null);
+    if (body === null) return { kind: "silent" };
+    if (typeof body.workspace === "string" && body.workspace !== name) {
+      return { kind: "foreign", workspace: body.workspace };
+    }
+    if (body.ok !== true || body.pid !== pid) return { kind: "silent" };
+    return { kind: "healthy" };
+  } catch {
+    return { kind: "silent" };
+  }
+}
+async function bridgeStdioToWorkspace(name, root) {
+  const resolved = await resolveWorkspaceDaemon(name, root);
+  if ("error" in resolved) {
+    fail(EXIT.DAEMON_DOWN, resolved.error);
+  }
+  const host = new StdioBridgeTransport(process.stdin, process.stdout);
+  const daemon = new StreamableHTTPClientTransport(new URL(resolved.url), {
+    requestInit: { headers: { Authorization: `Bearer ${resolved.token}` } }
+  });
+  try {
+    await relay(host, daemon);
+  } finally {
+    await daemon.close().catch(() => {
+    });
+    await host.close().catch(() => {
+    });
+  }
+}
+async function relay(host, daemon) {
+  await new Promise((resolve2) => {
+    let settled = false;
+    let closing = false;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      closing = true;
+      resolve2();
+    };
+    const closeDaemon = () => {
+      closing = true;
+      void daemon.close().catch(() => {
+      });
+    };
+    host.onmessage = (message) => {
+      void daemon.send(message).catch(closeDaemon);
+    };
+    host.onclose = () => {
+      closeDaemon();
+      settle();
+    };
+    host.onerror = () => {
+      closeDaemon();
+      settle();
+    };
+    daemon.onmessage = (message) => {
+      void host.send(message).catch(() => {
+      });
+    };
+    daemon.onclose = () => {
+      void host.close().catch(() => {
+      });
+      settle();
+    };
+    daemon.onerror = (error2) => {
+      if (closing) return;
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+    };
+    const failStart = (error2) => {
+      process.stderr.write(
+        `noir: workspace bridge: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+      host.onerror?.(error2);
+      closeDaemon();
+      settle();
+    };
+    void daemon.start().catch(failStart);
+    void host.start().catch(failStart);
+  });
+}
+var StdioBridgeTransport = class {
+  constructor(stdin, stdout) {
+    this.stdin = stdin;
+    this.stdout = stdout;
+  }
+  stdin;
+  stdout;
+  onclose;
+  onerror;
+  onmessage;
+  buffer = new ReadBuffer();
+  started = false;
+  closed = false;
+  async start() {
+    if (this.started) throw new Error("the stdio bridge transport is already started");
+    this.started = true;
+    this.stdin.on("data", this.onData);
+    this.stdin.on("error", this.onStdinFault);
+    this.stdin.on("end", this.onStdinEnd);
+    this.stdout.on("error", this.onStdoutFault);
+  }
+  send(message) {
+    if (this.closed) return Promise.reject(new Error("the stdio bridge transport is closed"));
+    return new Promise((resolve2, reject) => {
+      if (this.stdout.write(serializeMessage(message))) {
+        resolve2();
+        return;
+      }
+      const onDrain = () => {
+        this.stdout.off("error", onWriteError);
+        resolve2();
+      };
+      const onWriteError = (error2) => {
+        this.stdout.off("drain", onDrain);
+        reject(error2);
+      };
+      this.stdout.once("drain", onDrain);
+      this.stdout.once("error", onWriteError);
+    });
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.stdin.off("data", this.onData);
+    this.stdin.off("error", this.onStdinFault);
+    this.stdin.off("end", this.onStdinEnd);
+    this.stdout.off("error", this.onStdoutFault);
+    this.buffer.clear();
+    if (this.stdin.listenerCount("data") === 0) this.stdin.pause();
+    this.onclose?.();
+  }
+  onData = (chunk) => {
+    try {
+      this.buffer.append(chunk);
+      for (; ; ) {
+        const message = this.buffer.readMessage();
+        if (message === null) return;
+        this.onmessage?.(message);
+      }
+    } catch (error2) {
+      this.onerror?.(toError(error2));
+      void this.close();
+    }
+  };
+  /** The host closed its end of the pipe — the session is over. */
+  onStdinEnd = () => {
+    void this.close();
+  };
+  onStdinFault = (error2) => {
+    this.onerror?.(error2);
+    void this.close();
+  };
+  onStdoutFault = (error2) => {
+    this.onerror?.(error2);
+  };
+};
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+
 // src/workspace-mcp.ts
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-import { resolveAdapter } from "@noir-ai/adapters";
+import { mcpConfigPathFor, noirStdioArgs, TRANSPORT_KEYS } from "@noir-ai/adapters";
 import { atomicWriteFile, resolveNoirCommand } from "@noir-ai/core";
-function mcpPathFor(root, host) {
-  return resolveAdapter(host).mcpConfigPath?.({ root }) ?? join(root, ".mcp.json");
-}
 function readJson(path) {
   if (!existsSync(path)) return null;
   return JSON.parse(readFileSync(path, "utf8"));
@@ -300,39 +512,50 @@ function isNoirEmitted(mcpServers) {
   if (typeof noir.command === "string") return true;
   return noir.type === "http";
 }
-function writeWorkspaceHttpEntry(root, host, url, projectId, opts) {
-  const path = mcpPathFor(root, host);
+function noirEntry(mcpServers) {
+  const noir = mcpServers?.noir;
+  if (typeof noir !== "object" || noir === null || Array.isArray(noir)) return {};
+  return noir;
+}
+function writeNoirTransport(root, host, transport, opts) {
+  const path = mcpConfigPathFor(host, root);
   const existing = loadExisting(path, opts);
+  const kept = Object.fromEntries(
+    Object.entries(noirEntry(existing?.mcpServers)).filter(([key]) => !TRANSPORT_KEYS.has(key))
+  );
   const next = {
     ...existing ?? {},
     mcpServers: {
       ...existing?.mcpServers ?? {},
-      noir: { type: "http", url: `${url}?p=${projectId}` }
+      noir: { ...transport, ...kept }
     }
   };
   atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
 `);
 }
+function writeWorkspaceEntry(root, host, name, opts) {
+  writeNoirTransport(
+    root,
+    host,
+    { command: resolveNoirCommand(), args: noirStdioArgs(name) },
+    opts
+  );
+}
 function writeStdioEntry(root, host, opts) {
-  const path = mcpPathFor(root, host);
-  const existing = loadExisting(path, opts);
-  const noir = { command: resolveNoirCommand(), args: ["mcp", "serve", "--stdio"] };
-  const next = { ...existing ?? {}, mcpServers: { ...existing?.mcpServers ?? {}, noir } };
-  atomicWriteFile(path, `${JSON.stringify(next, null, 2)}
-`);
+  writeNoirTransport(root, host, { command: resolveNoirCommand(), args: noirStdioArgs() }, opts);
 }
 
 // src/commands/workspace.ts
 function loadProjectOrFail(opts) {
   try {
-    return loadProjectInfo(process.cwd());
+    return loadProjectInfo2(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
 }
-function finishJoin(project, name, url, opts) {
+function finishJoin(project, name, opts) {
   writeWorkspaceMarker(project.root, name);
-  writeWorkspaceHttpEntry(project.root, project.config.host, url, project.id, opts);
+  writeWorkspaceEntry(project.root, project.config.host, name, opts);
 }
 async function daemonStartWorkspace(opts) {
   const project = loadProjectOrFail(opts);
@@ -365,7 +588,7 @@ async function daemonStartWorkspace(opts) {
   }
   if (opts.detach === true) {
     const spawned = await spawnDetachedWorkspaceDaemon({ name: opts.name, project });
-    finishJoin(project, opts.name, `http://127.0.0.1:${spawned.port}/mcp`, opts);
+    finishJoin(project, opts.name, opts);
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { mode: "detached", pid: spawned.pid, port: spawned.port } })}
@@ -384,7 +607,7 @@ async function daemonStartWorkspace(opts) {
     project,
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { url: ensured.url, port: ensured.port, reused: !ensured.started } })}
@@ -414,7 +637,7 @@ async function daemonJoin(opts) {
     idleTimeoutSec: project.config.workspace.idleTimeoutSec
   });
   upsertWorkspaceMember(reg, { projectId: project.id, root: project.root, joinedAt: Date.now() });
-  finishJoin(project, opts.name, ensured.url, opts);
+  finishJoin(project, opts.name, opts);
   if (opts.json === true) {
     process.stdout.write(
       `${JSON.stringify({ ok: true, data: { joined: true, url: ensured.url, port: ensured.port } })}
@@ -431,19 +654,20 @@ async function workspaceList(opts) {
   } catch {
     names = [];
   }
-  const rows = names.map((n) => {
-    const reg = readWorkspaceRegistry(n);
-    return {
-      name: n,
-      members: reg?.members.length ?? 0,
-      // A record file whose pid is dead (daemon killed without cleanup) must not
-      // read as "running" — mirror the pidAlive liveness `workspace status` uses.
-      running: (() => {
-        const rec = readWorkspaceDaemonRecord(n);
-        return rec !== null && pidAlive(rec.pid);
-      })()
-    };
-  });
+  const rows = await Promise.all(
+    names.map(async (n) => {
+      const reg = readWorkspaceRegistry(n);
+      const rec = readWorkspaceDaemonRecord2(n);
+      const health = rec === null ? null : await verifyWorkspaceDaemon(rec, n);
+      const running = health?.kind === "healthy";
+      return {
+        name: n,
+        members: reg?.members.length ?? 0,
+        running,
+        ...rec !== null && !running ? { stale: true } : {}
+      };
+    })
+  );
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: { workspaces: rows } })}
 `);
@@ -454,7 +678,8 @@ async function workspaceList(opts) {
     return;
   }
   for (const r of rows) {
-    log(`${r.name} \u2014 ${r.members} member(s)${r.running ? ", running" : ""}`, opts);
+    const state = r.running ? ", running" : r.stale ? ", not running (stale record)" : "";
+    log(`${r.name} \u2014 ${r.members} member(s)${state}`, opts);
   }
 }
 async function workspaceStatus(opts) {
@@ -466,23 +691,23 @@ async function workspaceStatus(opts) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
   const reg = readWorkspaceRegistry(name);
-  const rec = readWorkspaceDaemonRecord(name);
-  const running = rec !== null && pidAlive(rec.pid);
+  const rec = readWorkspaceDaemonRecord2(name);
+  const health = rec === null ? null : await verifyWorkspaceDaemon(rec, name);
+  const running = health?.kind === "healthy";
   const data = {
     name,
     members: reg?.members.map((m) => m.projectId) ?? [],
     running,
-    ...rec ? { pid: rec.pid, port: rec.port } : {}
+    ...rec ? { pid: rec.pid, port: rec.port } : {},
+    ...rec !== null && !running ? { stale: true } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data })}
 `);
     return;
   }
-  log(
-    `workspace ${name}: ${running ? `running (pid ${rec?.pid}, port ${rec?.port})` : "not running"}`,
-    opts
-  );
+  const state = running ? `running (pid ${rec?.pid}, port ${rec?.port})` : rec !== null ? `not running (stale record for pid ${rec.pid})` : "not running";
+  log(`workspace ${name}: ${state}`, opts);
   for (const m of data.members) log(`  member: ${m}`, opts);
 }
 async function workspaceLeave(opts) {
@@ -512,8 +737,8 @@ async function workspaceStop(opts) {
   if (!isValidWorkspaceName(name)) {
     fail(EXIT.USAGE, `invalid workspace name ${JSON.stringify(name)}.`, opts);
   }
-  const rec = readWorkspaceDaemonRecord(name);
-  if (rec === null || !pidAlive(rec.pid)) {
+  const rec = readWorkspaceDaemonRecord2(name);
+  if (rec === null || !pidAlive2(rec.pid)) {
     if (opts.json === true) {
       process.stdout.write(
         `${JSON.stringify({ ok: true, data: { running: false, stopped: false } })}
@@ -524,6 +749,10 @@ async function workspaceStop(opts) {
     info("workspace daemon is not running.", opts);
     return;
   }
+  const health = await verifyWorkspaceDaemon(rec, name);
+  if (health.kind !== "healthy") {
+    fail(EXIT.ERROR, stopRefusal(name, rec, health), opts);
+  }
   try {
     process.kill(rec.pid, "SIGTERM");
   } catch {
@@ -538,6 +767,12 @@ async function workspaceStop(opts) {
   }
   info(`stopped workspace daemon (pid ${rec.pid}).`, opts);
 }
+function stopRefusal(name, rec, health) {
+  if (health.kind === "foreign") {
+    return `refusing to stop workspace ${name}: the daemon answering on port ${rec.port} serves workspace ${health.workspace}, so the recorded pid ${rec.pid} is not this workspace's daemon.`;
+  }
+  return `refusing to stop workspace ${name}: the process recorded for it (pid ${rec.pid}) does not answer /health as this workspace, so it may be an unrelated process.`;
+}
 
 // src/commands/daemon.ts
 var MODE = "foreground";
@@ -549,7 +784,7 @@ function formatUptime(sec) {
 }
 function resolveCallerProjectId() {
   try {
-    return loadProjectInfo2(process.cwd()).id;
+    return loadProjectInfo3(process.cwd()).id;
   } catch {
     return void 0;
   }
@@ -581,7 +816,7 @@ async function daemonStart(opts) {
   }
   let project;
   try {
-    project = loadProjectInfo2(process.cwd());
+    project = loadProjectInfo3(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -613,7 +848,7 @@ async function daemonStart(opts) {
   }
   if (opts.detach === true) {
     const existing = readProjectDaemonRecord(project.id);
-    if (existing && pidAlive2(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
+    if (existing && pidAlive3(existing.pid) && await isHealthy(existing.port, existing.pid, project.id)) {
       if (opts.json === true) {
         process.stdout.write(
           `${JSON.stringify({ ok: true, data: { mode: "detached", reused: true } })}
@@ -723,7 +958,7 @@ async function daemonStop(opts) {
   const ds = spinner(`Stopping daemon (pid ${rec.pid})...`, opts).start();
   let signalled = false;
   let errMsg2;
-  const healthy = pidAlive2(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
+  const healthy = pidAlive3(rec.pid) && await isHealthy(rec.port, rec.pid, callerProject);
   if (healthy) {
     try {
       process.kill(rec.pid, "SIGTERM");
@@ -765,7 +1000,7 @@ async function daemonStatus(opts) {
   if (!rec) {
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (start with `noir daemon start`).", opts);
   }
-  if (!pidAlive2(rec.pid)) {
+  if (!pidAlive3(rec.pid)) {
     clearProjectDaemonRecord(callerProject);
     fail(EXIT.DAEMON_DOWN, "Noir daemon is not running (stale record removed).", opts);
   }
@@ -827,14 +1062,14 @@ async function daemonToken(opts) {
       opts
     );
   }
-  if (!pidAlive2(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
+  if (!pidAlive3(rec.pid) || !await isHealthy(rec.port, rec.pid, callerProject)) {
     fail(
       EXIT.DAEMON_DOWN,
       "Noir daemon is not running (stale record \u2014 start it with `noir daemon start`).",
       opts
     );
   }
-  const token = readDaemonToken(callerProject);
+  const token = readDaemonToken2(callerProject);
   if (token === null) {
     fail(
       EXIT.DAEMON_DOWN,
@@ -857,15 +1092,17 @@ async function daemonRestart(opts) {
 
 // src/commands/doctor.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { existsSync as existsSync2, readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 import { dirname, join as join2, relative } from "path";
 import { fileURLToPath } from "url";
-import { resolveAdapter as resolveAdapter2 } from "@noir-ai/adapters";
+import { mcpConfigPathFor as mcpConfigPathFor2, resolveAdapter } from "@noir-ai/adapters";
 import {
   detectActiveMethod,
+  ensureOwnerOnly,
+  ensureOwnerOnlyDir,
   latestVersionFromCache,
   loadNoirEnv,
-  loadProjectInfo as loadProjectInfo3,
+  loadProjectInfo as loadProjectInfo4,
   NOIR_VERSION,
   paths,
   readInstallRecord,
@@ -878,8 +1115,167 @@ import {
   readScaffoldVersion,
   render
 } from "@noir-ai/create";
-import { pidAlive as pidAlive3, readProjectDaemonRecord as readProjectDaemonRecord2 } from "@noir-ai/daemon";
+import { pidAlive as pidAlive4, readProjectDaemonRecord as readProjectDaemonRecord2 } from "@noir-ai/daemon";
 import { resolveModelConfig } from "@noir-ai/model";
+
+// src/hygiene-scan.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { join } from "path";
+import { checkHygiene } from "@noir-ai/skills";
+var HYGIENE_FINDING_CAP = 5;
+var HYGIENE_MAX_FILE_BYTES = 512 * 1024;
+var HYGIENE_MAX_FILES = 2e3;
+var HYGIENE_CODE_EXTENSIONS = /\.(?:ts|tsx|js|jsx|mjs|cjs|sh)$/i;
+var HYGIENE_MARKDOWN_EXTENSIONS = /\.(?:md|mdx)$/i;
+var HYGIENE_SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
+var HYGIENE_EXCLUDED_DIRS = /* @__PURE__ */ new Set(["docs/internal", "docs/decisions", "docs/roadmap"]);
+var HYGIENE_EXCLUDED_FILES = /* @__PURE__ */ new Set(["CHANGELOG.md"]);
+function readDirEntries(dir) {
+  try {
+    return readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function isDirectory(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function hygieneKindOf(path) {
+  if (HYGIENE_MARKDOWN_EXTENSIONS.test(path)) return "markdown";
+  if (HYGIENE_CODE_EXTENSIONS.test(path)) return "code";
+  return null;
+}
+function hasScannableLayout(root) {
+  if (isDirectory(join(root, "docs")) || isDirectory(join(root, "scripts"))) return true;
+  for (const entry of readDirEntries(join(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    if (isDirectory(join(root, "packages", entry.name, "src"))) return true;
+    if (isDirectory(join(root, "packages", entry.name, "test"))) return true;
+  }
+  return false;
+}
+function addHygieneFile(rel, walk) {
+  const name = rel.slice(rel.lastIndexOf("/") + 1);
+  if (name.startsWith(".") || HYGIENE_EXCLUDED_FILES.has(name)) return;
+  const kind = hygieneKindOf(rel);
+  if (kind === null) return;
+  if (walk.files.length >= HYGIENE_MAX_FILES) {
+    walk.truncated = true;
+    return;
+  }
+  walk.files.push({ path: rel, kind });
+}
+function walkScannable(root, relDir, skip, walk) {
+  if (walk.truncated) return;
+  for (const entry of readDirEntries(join(root, relDir))) {
+    if (walk.truncated) return;
+    const rel = `${relDir}/${entry.name}`;
+    if (entry.isDirectory()) {
+      if (HYGIENE_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".") || skip.has(rel)) {
+        continue;
+      }
+      walkScannable(root, rel, skip, walk);
+    } else if (entry.isFile()) {
+      addHygieneFile(rel, walk);
+    }
+  }
+}
+var NO_SKIP_DIRS = /* @__PURE__ */ new Set();
+function collectHygieneFiles(root) {
+  const walk = { files: [], truncated: false };
+  for (const entry of readDirEntries(root)) {
+    if (entry.isFile()) addHygieneFile(entry.name, walk);
+  }
+  walkScannable(root, "docs", HYGIENE_EXCLUDED_DIRS, walk);
+  walkScannable(root, ".claude/skills", NO_SKIP_DIRS, walk);
+  for (const entry of readDirEntries(join(root, "packages"))) {
+    if (!entry.isDirectory()) continue;
+    walkScannable(root, `packages/${entry.name}/src`, NO_SKIP_DIRS, walk);
+    walkScannable(root, `packages/${entry.name}/test`, NO_SKIP_DIRS, walk);
+  }
+  walkScannable(root, "scripts", NO_SKIP_DIRS, walk);
+  walk.files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return walk;
+}
+function hygieneOmissions(result) {
+  const notes = [];
+  if (result.skipped > 0) {
+    notes.push(
+      `${result.skipped} file${result.skipped === 1 ? "" : "s"} over ${HYGIENE_MAX_FILE_BYTES / 1024} KiB skipped`
+    );
+  }
+  if (result.truncated) notes.push(`stopped at ${HYGIENE_MAX_FILES} files`);
+  return notes.length > 0 ? ` (${notes.join("; ")})` : "";
+}
+function hygieneCounts(result) {
+  const omitted = hygieneOmissions(result);
+  if (result.scanned === 0) {
+    return `nothing to scan (no packages/*/src, packages/*/test, scripts/ or documents found)${omitted}`;
+  }
+  if (result.findings.length === 0) {
+    return `clean \u2014 ${result.scanned} file${result.scanned === 1 ? "" : "s"} scanned${omitted}`;
+  }
+  const files = new Set(result.findings.map((f) => f.path)).size;
+  return `${result.fail} fail, ${result.warn} warn in ${files} file${files === 1 ? "" : "s"}${omitted}`;
+}
+function hygieneDetail(result) {
+  const counts = hygieneCounts(result);
+  if (result.scanned === 0 || result.findings.length === 0) return counts;
+  const named = result.findings.slice(0, HYGIENE_FINDING_CAP);
+  const hidden = result.findings.length - named.length;
+  const where = named.map((f) => `${f.path}:${f.line} ${f.id}`).join("; ");
+  return `${counts} \u2014 ${where}${hidden > 0 ? ` (+${hidden} more)` : ""}`;
+}
+function scanOutputHygiene(root) {
+  const empty = {
+    scanned: 0,
+    skipped: 0,
+    truncated: false,
+    findings: [],
+    fail: 0,
+    warn: 0
+  };
+  if (!hasScannableLayout(root)) return empty;
+  const walk = collectHygieneFiles(root);
+  const findings = [];
+  let scanned = 0;
+  let skipped = 0;
+  for (const file of walk.files) {
+    const abs = join(root, file.path);
+    try {
+      if (statSync(abs).size > HYGIENE_MAX_FILE_BYTES) {
+        skipped++;
+        continue;
+      }
+      const text = readFileSync2(abs, "utf8");
+      scanned++;
+      for (const found of checkHygiene(text, file.kind)) {
+        findings.push({ path: file.path, line: found.line, id: found.id, tier: found.tier });
+      }
+    } catch {
+    }
+  }
+  findings.sort((a, b) => {
+    if (a.tier !== b.tier) return a.tier === "fail" ? -1 : 1;
+    if (a.path !== b.path) return a.path < b.path ? -1 : 1;
+    return a.line - b.line;
+  });
+  const fail2 = findings.filter((f) => f.tier === "fail").length;
+  return {
+    scanned,
+    skipped,
+    truncated: walk.truncated,
+    findings,
+    fail: fail2,
+    warn: findings.length - fail2
+  };
+}
+
+// src/commands/doctor.ts
 async function probeOnnx() {
   try {
     const spec = "onnxruntime-node";
@@ -894,7 +1290,7 @@ function describeOnnx(o) {
   if (/Cannot find (module|package)/i.test(o.reason)) {
     return "not resolvable from CLI probe (best-effort)";
   }
-  const r = o.reason.length > 60 ? `${o.reason.slice(0, 59)}\u2026` : o.reason;
+  const r = truncateToWidth(o.reason, 60);
   return `probe failed: ${r}`;
 }
 function fmtUptime(sec) {
@@ -926,7 +1322,7 @@ function checkConfig(root) {
     };
   }
   try {
-    const project = loadProjectInfo3(root);
+    const project = loadProjectInfo4(root);
     return {
       project,
       result: {
@@ -960,7 +1356,7 @@ async function checkDaemon(checks, project) {
     });
     return;
   }
-  if (!pidAlive3(rec.pid)) {
+  if (!pidAlive4(rec.pid)) {
     checks.push({
       name: "daemon",
       status: "warn",
@@ -1044,11 +1440,21 @@ async function checkStore(checks, project, root) {
   }
 }
 var ENV_REFUSAL_PREFIX = ".noir/.env: refusing to load";
+function envModeCause(st) {
+  return st.ctimeMs > st.mtimeMs ? "changed" : "legacy";
+}
+function octalMode(mode) {
+  return mode.toString(8).padStart(4, "0");
+}
+function describeEnvMode(cause, mode) {
+  const lead = `is ${octalMode(mode)} \u2014 accessible to other accounts; run \`noir sync\` (or \`chmod 600 .noir/.env\`) to make it owner-only.`;
+  return cause === "legacy" ? `${lead} Nothing has changed its mode since the file was written, so the file predates the owner-only contract (an older Noir seeded it, a clone delivered it, it was created by hand, or it was saved by a tool that replaces the file) \u2014 this is not a change you made.` : `${lead} Its mode was changed after the file was written (a \`chmod\`, a \`chown\`, or a restore that re-applied metadata), so no older Noir left it this way.`;
+}
 function checkNoirEnv(checks, root, loaded) {
   const path = join2(paths.noirDir(root), ".env");
   let st;
   try {
-    st = statSync(path);
+    st = statSync2(path);
   } catch {
     return;
   }
@@ -1066,8 +1472,8 @@ function checkNoirEnv(checks, root, loaded) {
     tooOpen ? {
       name: "noir-env",
       status: "warn",
-      detail: `${path} is ${mode.toString(8)} \u2014 readable by others; run chmod 600`
-    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${mode.toString(8)})` }
+      detail: `${path} ${describeEnvMode(envModeCause(st), mode)}`
+    } : { name: "noir-env", status: "ok", detail: `${path} permissions ok (${octalMode(mode)})` }
   );
   for (const [key, source] of Object.entries(loaded.sources)) {
     if (source !== "file") continue;
@@ -1167,7 +1573,7 @@ function checkSeedDrift(checks, root) {
   const seedPath = join2(root, ".noir", ".env.example");
   let bytes;
   try {
-    bytes = readFileSync2(seedPath, "utf8");
+    bytes = readFileSync3(seedPath, "utf8");
   } catch {
     return;
   }
@@ -1185,6 +1591,14 @@ function checkRulesMdBudget(checks, root, project) {
     checks.push({ name: "rules budget", status: "warn", detail: "skipped \u2014 not initialized" });
     return null;
   }
+  if (project.config.rules.enabled === false) {
+    checks.push({
+      name: "rules budget",
+      status: "ok",
+      detail: "disabled \u2014 rules.enabled is false in .noir/config.yml (RULES.md is not measured)"
+    });
+    return null;
+  }
   const rulesPath = paths.rulesMd(root);
   if (!existsSync2(rulesPath)) {
     checks.push({
@@ -1196,7 +1610,7 @@ function checkRulesMdBudget(checks, root, project) {
   }
   let content;
   try {
-    content = readFileSync2(rulesPath, "utf8");
+    content = readFileSync3(rulesPath, "utf8");
   } catch (e) {
     checks.push({
       name: "rules budget",
@@ -1240,7 +1654,7 @@ function checkHostArtifacts(checks, root, project) {
     return null;
   }
   const host = project.config.host;
-  const adapter = resolveAdapter2(host);
+  const adapter = resolveAdapter(host);
   const ectx = { root };
   const expected = [];
   const emitsAgentsMd = host === "agents-md" || host === "cursor" || host === "opencode";
@@ -1249,7 +1663,7 @@ function checkHostArtifacts(checks, root, project) {
   }
   if (host === "claude") expected.push("CLAUDE.md");
   else if (host === "gemini") expected.push("GEMINI.md");
-  expected.push(relOr(adapter.mcpConfigPath?.(ectx) ?? ".mcp.json", root));
+  expected.push(relOr(mcpConfigPathFor2(host, root), root));
   const missing = expected.filter((p) => !existsSync2(joinRoot(root, p)));
   const status2 = missing.length === 0 ? "ok" : "warn";
   const detail = missing.length === 0 ? `host=${host} \xB7 all ${expected.length} primary artifacts present` : `host=${host} \xB7 missing ${missing.join(", ")} (run \`noir sync\` to restore)`;
@@ -1276,6 +1690,15 @@ function checkNestedNoir(checks, root) {
   });
   return { detected, paths: found };
 }
+function checkOutputHygiene(checks, root) {
+  const result = scanOutputHygiene(root);
+  checks.push({
+    name: "output hygiene",
+    status: result.fail > 0 ? "fail" : result.warn > 0 ? "warn" : "ok",
+    detail: hygieneDetail(result)
+  });
+  return result;
+}
 function collectDedupCandidates(root) {
   const rels = ["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".noir/rules/RULES.md"];
   const out = [];
@@ -1284,7 +1707,7 @@ function collectDedupCandidates(root) {
     if (!existsSync2(abs)) continue;
     let text;
     try {
-      text = readFileSync2(abs, "utf8");
+      text = readFileSync3(abs, "utf8");
     } catch {
       continue;
     }
@@ -1344,7 +1767,7 @@ function resolveWorkspacePackagesDir() {
     const pkgPath = join2(here, "package.json");
     if (existsSync2(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
         if (pkg.name === "@noir-ai/cli") {
           const packagesDir = dirname(here);
           if (existsSync2(join2(dirname(packagesDir), "pnpm-workspace.yaml"))) {
@@ -1393,7 +1816,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
   }
   let entries = [];
   try {
-    entries = readdirSync2(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync3(packagesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (e) {
     checks.push({
       name: "publish",
@@ -1410,7 +1833,7 @@ function checkPublish(checks, packagesDir, opts = {}) {
     if (!existsSync2(pkgPath)) continue;
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     } catch (e) {
       issues.push(`${name}/package.json: unparseable (${msg(e)})`);
       checked++;
@@ -1489,6 +1912,17 @@ function renderHuman(payload, opts) {
     ["Check", "Status", "Detail"],
     opts
   );
+  if (payload.fixes) {
+    const healed = payload.fixes.filter((f) => f.outcome === "healed");
+    if (healed.length > 0) {
+      log(
+        `fixed ${healed.length} permission${healed.length === 1 ? "" : "s"}: ${healed.map((f) => f.path).join(", ")}`,
+        opts
+      );
+    } else {
+      log("nothing to fix \u2014 permissions already owner-only", opts);
+    }
+  }
   const { ok, warn: warnN, fail: fail2 } = payload.summary;
   if (fail2 > 0) {
     error(
@@ -1501,12 +1935,24 @@ function renderHuman(payload, opts) {
     success(`all ${ok} check${ok === 1 ? "" : "s"} passed`, opts);
   }
 }
+function fixOwnerOnlyPermissions(root, project) {
+  const fixes = [
+    { path: ".noir/.env", outcome: ensureOwnerOnly(join2(paths.noirDir(root), ".env")) }
+  ];
+  if (project) {
+    const dbRel = `.noir/store/${project.id}.db`;
+    fixes.push({ path: dbRel, outcome: ensureOwnerOnly(join2(root, dbRel)) });
+    fixes.push({ path: ".noir/store", outcome: ensureOwnerOnlyDir(paths.storeDir(root)) });
+  }
+  return fixes;
+}
 async function doctor(opts = {}) {
   const root = process.cwd();
   const checks = [];
   await checkRuntime(checks);
   const { project, result: configResult } = checkConfig(root);
   checks.push(configResult);
+  const fixes = opts.fix === true ? fixOwnerOnlyPermissions(root, project) : void 0;
   await checkDaemon(checks, project);
   const { vecOk } = await checkNativeDeps(checks);
   await checkStore(checks, project, root);
@@ -1519,6 +1965,7 @@ async function doctor(opts = {}) {
   const rules = checkRulesMdBudget(checks, root, project);
   const host = checkHostArtifacts(checks, root, project);
   checkNestedNoir(checks, root);
+  checkOutputHygiene(checks, root);
   if (opts.dedup === true) {
     await checkSemanticDupDoctor(checks, root, project);
   }
@@ -1542,7 +1989,8 @@ async function doctor(opts = {}) {
       method: installCheck.method,
       installedVersion: installCheck.installedVersion,
       latestKnown: installCheck.latestKnown
-    }
+    },
+    ...fixes ? { fixes } : {}
   };
   if (opts.json === true) {
     process.stdout.write(`${JSON.stringify({ ok: true, data: payload })}
@@ -1559,7 +2007,7 @@ async function doctor(opts = {}) {
 }
 
 // src/commands/env.ts
-import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo4 } from "@noir-ai/core";
+import { loadNoirEnv as loadNoirEnv2, loadProjectInfo as loadProjectInfo5 } from "@noir-ai/core";
 import { resolveModelConfig as resolveModelConfig2 } from "@noir-ai/model";
 var CURATED_AMBIENT_KEYS = [
   "CLICKUP_API_TOKEN",
@@ -1580,11 +2028,11 @@ function captureAmbientEnv(env2 = process.env) {
 var SHORT_VALUE_MAX = 8;
 function redactShape(value) {
   if (value.length <= SHORT_VALUE_MAX) return `\u2026(${value.length})`;
-  return `${value.slice(0, 3)}\u2026(${value.length})`;
+  return `${truncateToWidth(value, 3, "")}\u2026(${value.length})`;
 }
 function configApiKeyEnvNames(root) {
   try {
-    const project = loadProjectInfo4(root);
+    const project = loadProjectInfo5(root);
     const names = /* @__PURE__ */ new Set();
     for (const provider of Object.values(resolveModelConfig2(project.config.model).providers)) {
       if (provider.apiKeyEnv !== void 0 && provider.apiKeyEnv.length > 0) {
@@ -1655,14 +2103,14 @@ import { join as join3 } from "path";
 import {
   defaultHandoffBlock,
   hostLaunchDirective,
-  resolveAdapter as resolveAdapter3
+  resolveAdapter as resolveAdapter2
 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo6, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo7, NOIR_DIR, resolveArtifactPath } from "@noir-ai/core";
 
 // src/commands/task.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { writeFileSync } from "fs";
-import { loadProjectInfo as loadProjectInfo5, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
+import { loadProjectInfo as loadProjectInfo6, nextArtifactSequence, sha256Hex } from "@noir-ai/core";
 import {
   PHASES,
   TASK_CLASSES,
@@ -1686,7 +2134,7 @@ function skillFor(phase) {
 }
 function writeDoneArtifacts(opts, taskId) {
   try {
-    const project = loadProjectInfo5(process.cwd());
+    const project = loadProjectInfo6(process.cwd());
     const conflict = { conflictPolicy: "preserve", interactive: false };
     writeChangelogStub(project.root, `- ${taskId}: completed (verify gate passed)`, conflict);
     const nextN = nextArtifactSequence(project.root, "adr");
@@ -2010,7 +2458,7 @@ function runCheck(cmd) {
 async function taskVerify(opts) {
   let project;
   try {
-    project = loadProjectInfo5(process.cwd());
+    project = loadProjectInfo6(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2116,7 +2564,7 @@ async function taskResearch(opts) {
     return;
   }
   renderStatusRow(s, opts);
-  info("research findings are recorded via `noir task research record` (list + record)", opts);
+  info("this is a status view; record findings with `noir task research-record`", opts);
 }
 async function taskResearchRecord(opts) {
   const TYPES = ["assumption", "discovery", "decision", "grounding-fact"];
@@ -2140,10 +2588,7 @@ async function taskResearchRecord(opts) {
 `);
     return;
   }
-  success(
-    `research recorded \u2192 ${opts.type}: ${opts.text.slice(0, 80)}${opts.text.length > 80 ? "\u2026" : ""}`,
-    opts
-  );
+  success(`research recorded \u2192 ${opts.type}: ${truncateToWidth(opts.text, 80)}`, opts);
 }
 async function taskDecompose(opts) {
   const cap = opts.capability.trim();
@@ -2290,7 +2735,7 @@ function toHostPayload(p) {
 }
 function resolveDirective(root, p) {
   const ctx = { root };
-  const adapter = resolveAdapter3(p.host);
+  const adapter = resolveAdapter2(p.host);
   const hostPayload = toHostPayload(p);
   if (typeof adapter.emitHandoff === "function") {
     return adapter.emitHandoff(ctx, hostPayload);
@@ -2333,7 +2778,7 @@ async function probeOnly(opts) {
 async function handoff(opts) {
   let project;
   try {
-    project = loadProjectInfo6(process.cwd());
+    project = loadProjectInfo7(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -2382,7 +2827,7 @@ import { hostLaunchDirective as hostLaunchDirective2 } from "@noir-ai/adapters";
 import {
   detectActiveMethod as detectActiveMethod2,
   latestVersionFromCache as latestVersionFromCache2,
-  loadProjectInfo as loadProjectInfo7,
+  loadProjectInfo as loadProjectInfo8,
   NOIR_VERSION as NOIR_VERSION2,
   readInstallRecord as readInstallRecord2,
   readUpdateCache as readUpdateCache2
@@ -2400,10 +2845,12 @@ var NOIR_BLOCK = [
 ];
 var NOIR_GRADIENT = gradient("#2c5282", "#3b82f6", "#7dd3fc");
 var NOIR_TAGLINE = "discipline, context, and memory layer for agentic CLIs";
+var BLOCK_WIDTH = NOIR_BLOCK.reduce((max, line) => Math.max(max, displayWidth(line)), 0);
+var BLOCK_MIN_WIDTH = BLOCK_WIDTH + 17;
 function renderBanner(opts = {}) {
   const width = opts.width ?? process.stdout.columns ?? 80;
   const colorOn = opts.color !== false && useColor();
-  if (width < 50) {
+  if (width < BLOCK_MIN_WIDTH) {
     return colorOn ? `${c.accent("\u25C6")} noir` : "\u25C6 noir";
   }
   const block = NOIR_BLOCK.join("\n");
@@ -2710,7 +3157,7 @@ async function resolveSections(commands) {
 // src/commands/home.ts
 function tryProject() {
   try {
-    const info2 = loadProjectInfo7(process.cwd());
+    const info2 = loadProjectInfo8(process.cwd());
     return { id: info2.id, name: info2.name, host: info2.config.host };
   } catch {
     return null;
@@ -2874,7 +3321,7 @@ async function runMenu(opts, deps) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo7(process.cwd());
+        const info2 = loadProjectInfo8(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -2923,13 +3370,13 @@ ${COMMANDS_HINT}
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { loadProjectInfo as loadProjectInfo8 } from "@noir-ai/core";
+import { readFileSync as readFileSync4 } from "fs";
+import { loadProjectInfo as loadProjectInfo9 } from "@noir-ai/core";
 function resolveWorkspace() {
   const routing = workspaceRoutingTarget(process.cwd());
   if (routing === null) return null;
   try {
-    return { routing, project: loadProjectInfo8(process.cwd()) };
+    return { routing, project: loadProjectInfo9(process.cwd()) };
   } catch {
     return null;
   }
@@ -3141,14 +3588,14 @@ async function resolveCaptureContent(opts) {
   if (typeof opts.content === "string" && opts.content.length > 0) return opts.content;
   if (typeof opts.file === "string" && opts.file.length > 0) {
     try {
-      return readFileSync3(opts.file, "utf8");
+      return readFileSync4(opts.file, "utf8");
     } catch {
       fail(EXIT.USAGE, `memory capture could not read --file ${opts.file}`, opts);
     }
   }
   if (!process.stdin.isTTY) {
     try {
-      return readFileSync3(0, "utf8");
+      return readFileSync4(0, "utf8");
     } catch {
       fail(
         EXIT.USAGE,
@@ -3334,7 +3781,7 @@ function describe(step, who) {
   const m = {
     preflight: "check clean tree, on develop, HEAD pushed, gate green, no version collision",
     bump: "run bump-version.mjs + update CHANGELOG + roadmap docs",
-    gate: "re-run the full gate (lint/build/typecheck/test/docs:validate)",
+    gate: "re-run the full six-step gate (lint/build/typecheck/test/docs:validate/hygiene:gate)",
     commit: "commit chore(release) + push develop",
     "ci-develop": "wait for CI on develop \u2192 green",
     "beta-tag": "pnpm release:tag \u2192 beta tag + push",
@@ -3394,11 +3841,14 @@ async function release(opts) {
     });
     success(`bump: \u2713 version ${version}`, opts);
     info(`[3/13] gate: ${describe("gate", "noir")}`, opts);
-    execSync("pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate", {
-      encoding: "utf8",
-      stdio: "inherit"
-    });
-    success("gate: \u2713 full gate green", opts);
+    execSync(
+      "pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm docs:validate && pnpm hygiene:gate",
+      {
+        encoding: "utf8",
+        stdio: "inherit"
+      }
+    );
+    success("gate: \u2713 all six gates green", opts);
     info(`[4/13] commit/push: ${describe("commit", "noir")}`, opts);
     spawnSync3("git", ["add", "-A"], { encoding: "utf8", stdio: "inherit" });
     spawnSync3("git", ["commit", "-m", `chore(release): v${version} + docs sync`], {
@@ -4206,10 +4656,10 @@ var RunInterrupt = class {
 };
 
 // src/run-profiles.ts
-import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo9 } from "@noir-ai/core";
+import { isDeniedEnvKey, loadProjectInfo as loadProjectInfo10 } from "@noir-ai/core";
 function loadRunConfig(root) {
   try {
-    return loadProjectInfo9(root).config;
+    return loadProjectInfo10(root).config;
   } catch {
     return null;
   }
@@ -4356,6 +4806,7 @@ var RunStatusLine = class {
     if (this.animated && this.sharesCursor && this.onRow) {
       this.write("\n");
       this.onRow = false;
+      this.rendered = "";
     }
     this.stdoutAtRowStart = chunk.endsWith("\n");
   }
@@ -4386,19 +4837,45 @@ var RunStatusLine = class {
       return;
     }
     if (!this.onRow || !this.cursorFree()) return;
-    this.write("\r\x1B[K");
+    this.write(this.erase(this.rendered));
     this.rendered = "";
     this.onRow = false;
   }
   /** Rewrite the current row in place, skipping no-op rewrites and unsafe moments. */
   draw() {
     if (!this.animated || !this.cursorFree()) return;
-    const text = this.render();
+    const text = truncateToWidth(this.render(), terminalWidth());
     if (text === this.rendered) return;
-    this.write(`\r\x1B[K${text}`);
+    this.write(`${this.erase(this.rendered)}${text}`);
     this.rendered = text;
     this.onRow = true;
   }
+  /**
+   * The escape sequence that clears the status text currently on screen and
+   * leaves the cursor at the start of the row it began on — where the next
+   * render writes. An empty `previous` still clears the row, so a line that has
+   * drawn nothing yet starts from a known-blank one.
+   *
+   * The extent is measured against the terminal width as it is NOW, not as it
+   * was when the text was drawn. Nothing this line writes wraps, but text that
+   * fitted a wider terminal does not stop existing when the window narrows: the
+   * terminal folds it onto rows below, and clearing only the row the cursor
+   * ends on would leave the rest above as residue. So the sequence walks back
+   * up over every row the text occupies. That folding is the behaviour of the
+   * common terminals (iTerm2, Terminal.app, GNOME Terminal and recent xterm);
+   * one that clips the row instead has no continuation to clear.
+   *
+   * The caller must have forgotten the text once its row was abandoned —
+   * `rendered` is only meaningful while `onRow` is true.
+   */
+  erase(previous) {
+    const rows = Math.max(1, Math.ceil(displayWidth(previous) / terminalWidth()));
+    let sequence = "\r\x1B[K";
+    for (let row = 1; row < rows; row++) {
+      sequence += "\x1B[1A\r\x1B[K";
+    }
+    return sequence;
+  }
   /**
    * Whether the cursor is at the start of a row nobody else is using. On stdout
    * that is not this terminal there is no shared cursor to disturb; when it is,
@@ -4678,8 +5155,8 @@ function writeTranscript(host, lines, root = process.cwd()) {
 }
 
 // src/commands/skills.ts
-import { resolveAdapter as resolveAdapter5 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo11 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
 import {
   buildRegistry,
   discoverAll,
@@ -4689,8 +5166,8 @@ import {
 
 // src/init.ts
 import { existsSync as existsSync4 } from "fs";
-import { resolveAdapter as resolveAdapter4 } from "@noir-ai/adapters";
-import { loadProjectInfo as loadProjectInfo10, paths as paths3 } from "@noir-ai/core";
+import { resolveAdapter as resolveAdapter3 } from "@noir-ai/adapters";
+import { loadProjectInfo as loadProjectInfo11, paths as paths3 } from "@noir-ai/core";
 import { scaffold } from "@noir-ai/create";
 import {
   emitSkillsToDir
@@ -4798,7 +5275,7 @@ function labelFor(resolution) {
 }
 
 // src/dedup-write.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
 import { sha256Hex as sha256Hex2, sha256Hex12 } from "@noir-ai/core";
 var HOST_CONTEXT_RELS = /* @__PURE__ */ new Set(["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".noir/rules/RULES.md"]);
@@ -4818,7 +5295,7 @@ async function checkWritePathDedup(root, res, opts) {
     const proposedAbs = join5(root, proposedRel);
     let proposedText;
     try {
-      proposedText = readFileSync4(proposedAbs, "utf8");
+      proposedText = readFileSync5(proposedAbs, "utf8");
     } catch {
       continue;
     }
@@ -4958,7 +5435,7 @@ async function promptDedupAction(root, proposedRel, matchedRel, proposedText, si
     return "replace";
   } else if (choice === "mirror") {
     try {
-      const existing = readFileSync4(join5(root, matchedRel), "utf8");
+      const existing = readFileSync5(join5(root, matchedRel), "utf8");
       writeFileSync5(
         join5(root, matchedRel),
         `${existing}
@@ -4982,7 +5459,7 @@ function cachePath(root) {
 }
 function loadCache(root) {
   try {
-    const raw = readFileSync4(cachePath(root), "utf8");
+    const raw = readFileSync5(cachePath(root), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== DEDUP_CACHE_VERSION) return emptyCache();
     if (typeof parsed.entries !== "object" || parsed.entries === null) return emptyCache();
@@ -5014,7 +5491,7 @@ function makeCachedEmbed(cache, embed) {
 }
 function safeRead(abs) {
   try {
-    return readFileSync4(abs, "utf8");
+    return readFileSync5(abs, "utf8");
   } catch {
     return void 0;
   }
@@ -5061,13 +5538,14 @@ async function init(root, opts) {
     reportPlannedWrites(res);
     return res;
   }
+  reportEnvHeal(res);
   if (res.noop) return res;
   const skillSummary = await emitHostSkills(root, host, conflictOpts, interactive);
   res.skillConflicts = skillSummary?.conflicts ?? [];
   res.preservedSkills = skillSummary?.preserved ?? [];
   let projectInfo;
   try {
-    projectInfo = loadProjectInfo10(root);
+    projectInfo = loadProjectInfo11(root);
   } catch {
     projectInfo = void 0;
   }
@@ -5098,7 +5576,7 @@ function resolveInitHost(root, opts) {
   if (opts.host !== void 0) return opts.host;
   if (!existsSync4(paths3.config(root))) return "claude";
   try {
-    return loadProjectInfo10(root).config.host;
+    return loadProjectInfo11(root).config.host;
   } catch {
     process.stderr.write(
       `Could not read the configured host from ${paths3.config(root)}; using 'claude'.
@@ -5129,8 +5607,13 @@ function reportPlannedWrites(res) {
     for (const p of res.identical) log(`  ${p}`);
   }
 }
+function reportEnvHeal(res) {
+  if (res.envMode === "healed") {
+    process.stderr.write("Tightened .noir/.env to 0600 (it was readable by group or others).\n");
+  }
+}
 async function emitHostSkills(root, host, conflictOpts, interactive) {
-  const adapter = resolveAdapter4(host);
+  const adapter = resolveAdapter3(host);
   const skillsDir = adapter.skillsDir?.({ root });
   if (skillsDir === void 0) {
     process.stderr.write(`host '${host}' has no skill emitter; skipping skills
@@ -5212,7 +5695,8 @@ var CATEGORY = {
   "noir-backend": "domain",
   "noir-doctor": "meta",
   "noir-writing-skills": "meta",
-  "noir-rules": "meta"
+  "noir-rules": "meta",
+  "noir-code-hygiene": "meta"
 };
 function categoryOf(name) {
   const mapped = CATEGORY[name];
@@ -5225,13 +5709,6 @@ function toRow(s, kind = "builtin") {
   const category = s.frontmatter.metadata?.category?.trim() || categoryOf(s.name);
   return { name: s.name, category, description, kind, status: status2 };
 }
-function truncate(text, max) {
-  if (text.length <= max) return text;
-  const slice = text.slice(0, Math.max(0, max - 1));
-  const boundary = slice.lastIndexOf(" ");
-  const head = boundary > 0 ? slice.slice(0, boundary) : slice;
-  return `${head.trimEnd()}\u2026`;
-}
 async function skillsList(opts) {
   let builtins;
   let integrations;
@@ -5265,7 +5742,9 @@ async function skillsList(opts) {
       Kind: r.kind,
       Category: r.category,
       Status: r.status,
-      Description: truncate(r.description, 80)
+      // Display-only cut for the dense table cell; the `--json` payload always
+      // carries the description whole (search snippets must never be truncated).
+      Description: truncateToWidth(r.description, 80)
     })),
     ["Skill", "Kind", "Category", "Status", "Description"],
     opts
@@ -5275,11 +5754,11 @@ async function skillsSync(opts) {
   const root = process.cwd();
   let project;
   try {
-    project = loadProjectInfo11(root);
+    project = loadProjectInfo12(root);
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
-  const adapter = resolveAdapter5(project.config.host);
+  const adapter = resolveAdapter4(project.config.host);
   if (!adapter.skillsDir) {
     const data2 = {
       emitted: [],
@@ -5341,7 +5820,7 @@ async function skillsLint(opts) {
     );
   }
   const errored = skills.filter((s) => s.errors.length > 0);
-  const warned = skills.filter((s) => s.warnings.length > 0 && s.errors.length === 0);
+  const warned = skills.filter((s) => s.warnings.length > 0);
   const data = { count: skills.length, errored: errored.length, skills };
   if (errored.length > 0) {
     const message = `skills lint: ${errored.length} skill${errored.length === 1 ? "" : "s"} failed validation`;
@@ -5415,11 +5894,15 @@ async function skillsRegistry(opts) {
 }
 
 // src/serve.ts
-import { applyNoirEnv, loadProjectInfo as loadProjectInfo12 } from "@noir-ai/core";
+import { applyNoirEnv, loadProjectInfo as loadProjectInfo13 } from "@noir-ai/core";
 import { ensureDaemonRunning as ensureDaemonRunning2, startStdioServer } from "@noir-ai/daemon";
 async function serve(opts) {
   applyNoirEnv(process.cwd());
-  const project = loadProjectInfo12(process.cwd());
+  if (opts.workspace !== void 0) {
+    await bridgeStdioToWorkspace(opts.workspace, process.cwd());
+    return;
+  }
+  const project = loadProjectInfo13(process.cwd());
   if (opts.stdio) {
     await startStdioServer({ project, transport: "stdio", daemon: false });
     return;
@@ -5549,6 +6032,8 @@ function createProgram() {
     const nonInteractive = opts.json === true || opts.input === false;
     if (nonInteractive) process.env.NOIR_NON_INTERACTIVE = "1";
     else delete process.env.NOIR_NON_INTERACTIVE;
+    if (opts.quiet === true) process.env.NOIR_QUIET = "1";
+    else delete process.env.NOIR_QUIET;
     emitDeprecationHintsFor(actionCmd, toCliOptions(opts));
   });
   program2.command("init").description("scaffold Noir in the current project (.noir/, .mcp.json, CLAUDE.md, skills)").option("--transport <transport>", "stdio | streamable-http (default: stdio)", "stdio").option("--url <url>", "streamable-http daemon URL (localhost only)").option(
@@ -5596,7 +6081,7 @@ function createProgram() {
       const force = opts.force === true;
       const host = parseHost(opts.host);
       const dryRun = opts.dryRun === true || opts.preview === true;
-      const { create } = await import("./create-6KDIFPUL.js");
+      const { create } = await import("./create-ZZN7XFLG.js");
       const result = await create(dir, {
         transport,
         url: opts.url,
@@ -5635,7 +6120,7 @@ function createProgram() {
     ).choices(SUPPORTED_HOSTS2)
   ).action(
     async (opts, cmd) => {
-      const { sync } = await import("./sync-AII5WCRO.js");
+      const { sync } = await import("./sync-GHEPFPLX.js");
       const host = parseHost(opts.host);
       const force = opts.force === true;
       const merge = opts.merge === true;
@@ -5654,11 +6139,17 @@ function createProgram() {
     }
   );
   const mcpCmd = program2.command("mcp").description("MCP server control");
-  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").action(async (opts) => {
-    await serve({ stdio: opts.stdio === true });
+  mcpCmd.command("serve").description("run the Noir MCP server (stdio, or via the shared daemon)").option("--stdio", "force the stdio transport").option(
+    "--workspace <name>",
+    "serve a shared workspace over stdio, bridging to that workspace daemon"
+  ).action(async (opts) => {
+    await serve({
+      stdio: opts.stdio === true,
+      ...typeof opts.workspace === "string" ? { workspace: opts.workspace } : {}
+    });
   });
   mcpCmd.action(() => {
-    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio]");
+    throw new NoirCliError(EXIT.USAGE, "Usage: noir mcp serve [--stdio] [--workspace <name>]");
   });
   const daemonGrp = program2.command("daemon").description("control the Noir daemon");
   daemonGrp.command("start").description("start the Noir daemon (foreground, or background with --detach)").option("--detach", "run the daemon in the background and exit").option("--workspace <name>", "start a shared cross-repo workspace daemon instead").option("--force", "overwrite a non-Noir .mcp.json entry (--workspace only)").addOption(
@@ -5759,10 +6250,16 @@ function createProgram() {
   program2.command("doctor").description("environment + project health").option(
     "--dedup",
     "scan host-context + .noir/ docs for semantic near-duplicates (loads the local embedder)"
-  ).action(async (...args) => {
+  ).option("--fix", "re-assert owner-only permissions on .noir/.env and the store DB + directory").action(async (...args) => {
     const g = actionGlobals(args);
-    const dedup = trailingCmd(args).opts().dedup === true;
-    await doctor({ ...toCliOptions(g), ...dedup ? { dedup: true } : {} });
+    const opts = trailingCmd(args).opts();
+    const dedup = opts.dedup === true;
+    const fix = opts.fix === true;
+    await doctor({
+      ...toCliOptions(g),
+      ...dedup ? { dedup: true } : {},
+      ...fix ? { fix: true } : {}
+    });
   });
   program2.command("status").description("project + daemon + workflow + store snapshot").action(async (...args) => {
     await status(toStatusOptions(actionGlobals(args)));
@@ -5955,7 +6452,7 @@ function createProgram() {
       ...check === void 0 || check.length === 0 ? {} : { check }
     });
   });
-  taskGrp.command("research").description("list research findings for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
+  taskGrp.command("research").description("show research status for the active (or named) task").argument("[id]", "task id (defaults to active)").action(async (...args) => {
     const cmd = trailingCmd(args);
     const g = cmd.optsWithGlobals();
     const first = args[0];
@@ -6021,7 +6518,7 @@ function createProgram() {
     "dismiss the migration banner for the current version (persists in install.json)"
   ).argument("[spec]", "channel ('latest'|'beta') or exact version (default: latest)").action(
     async (spec, opts, cmd) => {
-      const { install } = await import("./install-KA35ONQP.js");
+      const { install } = await import("./install-R5U2WTAQ.js");
       const cli = cmd.optsWithGlobals();
       await install({
         ...cli,
@@ -6034,7 +6531,7 @@ function createProgram() {
   );
   installCmd.alias("migrate");
   program2.command("update").description("update Noir to the latest version via the active install method").option("--check", "check for a new version without changing anything").argument("[spec]", "channel ('latest'|'beta') or exact version (default: latest)").action(async (spec, opts, cmd) => {
-    const { update } = await import("./update-XGKJ4KBR.js");
+    const { update } = await import("./update-ZFOLOSZ2.js");
     const cli = cmd.optsWithGlobals();
     await update({ ...cli, spec, check: opts.check === true });
   });
@@ -6197,7 +6694,7 @@ function failDaemonDown(opts, cause) {
 async function probeDaemon(opts = {}) {
   const expectedProject = opts.project?.id ?? (() => {
     try {
-      return loadProjectInfo13(process.cwd()).id;
+      return loadProjectInfo14(process.cwd()).id;
     } catch {
       return void 0;
     }
@@ -6211,7 +6708,7 @@ async function probeDaemon(opts = {}) {
     if (opts.verbose) process.stderr.write("noir: daemon probe: no daemon record\n");
     return { running: false };
   }
-  if (!pidAlive4(rec.pid)) {
+  if (!pidAlive5(rec.pid)) {
     if (opts.verbose) process.stderr.write(`noir: daemon probe: pid ${rec.pid} not alive
 `);
     return { running: false };
@@ -6250,7 +6747,7 @@ async function probeDaemon(opts = {}) {
 async function resolveDaemon(opts) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo13(process.cwd());
+    project = opts.project ?? loadProjectInfo14(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -6311,8 +6808,8 @@ async function resolveDaemon(opts) {
   return { client, stop };
 }
 function httpTransport(url, scopeKey) {
-  const token = scopeKey === null ? null : readDaemonToken2(scopeKey);
-  return new StreamableHTTPClientTransport(
+  const token = scopeKey === null ? null : readDaemonToken3(scopeKey);
+  return new StreamableHTTPClientTransport2(
     new URL(url),
     // Verified present: StreamableHTTPClientTransportOptions.requestInit?: RequestInit
     token ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {}
@@ -6320,7 +6817,7 @@ function httpTransport(url, scopeKey) {
 }
 function callerScopeKey(opts) {
   try {
-    return (opts.project ?? loadProjectInfo13(process.cwd())).id;
+    return (opts.project ?? loadProjectInfo14(process.cwd())).id;
   } catch {
     return null;
   }
@@ -6350,7 +6847,7 @@ function failWorkspaceConnect(opts, routing, cause) {
     }
     fail(
       EXIT.DAEMON_DOWN,
-      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
+      `workspace ${JSON.stringify(routing.name)} daemon is running but rejected this client's token (HTTP 401) \u2014 its token file is ${tokenPath2(routing.name)}; make sure it is readable, or restart the workspace daemon with \`noir daemon start --workspace ${routing.name}\` to mint a fresh one.`,
       opts
     );
   }
@@ -6421,7 +6918,7 @@ async function callDaemonTool(opts, name, args = {}) {
 async function withInProcessRead(opts, fn) {
   let project;
   try {
-    project = opts.project ?? loadProjectInfo13(process.cwd());
+    project = opts.project ?? loadProjectInfo14(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -6468,14 +6965,14 @@ function workspaceRoutingTarget(root) {
   const name = readWorkspaceMarker2(root);
   if (name === null) return null;
   try {
-    return { name, projectId: loadProjectInfo13(root).id };
+    return { name, projectId: loadProjectInfo14(root).id };
   } catch {
     return null;
   }
 }
 async function probeWorkspaceDaemon(routing) {
-  const rec = readWorkspaceDaemonRecord2(routing.name);
-  if (rec === null || !pidAlive4(rec.pid)) return { running: false };
+  const rec = readWorkspaceDaemonRecord3(routing.name);
+  if (rec === null || !pidAlive5(rec.pid)) return { running: false };
   try {
     const res = await fetch(`http://127.0.0.1:${rec.port}/health`, {
       signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
@@ -6670,7 +7167,7 @@ function renderHuman2(p, opts) {
 async function gatherStatusPayload(opts) {
   let project;
   try {
-    project = loadProjectInfo14(process.cwd());
+    project = loadProjectInfo15(process.cwd());
   } catch {
     fail(EXIT.ERROR, "Noir is not initialized in this directory. Run `noir init` first.", opts);
   }
@@ -6700,7 +7197,7 @@ async function status(opts) {
     env: process.env,
     configUpdate: (() => {
       try {
-        const info2 = loadProjectInfo14(process.cwd());
+        const info2 = loadProjectInfo15(process.cwd());
         return info2.config.update ?? DEFAULT_UPDATE_CONFIG;
       } catch {
         return DEFAULT_UPDATE_CONFIG;
@@ -6744,8 +7241,9 @@ export {
   buildConflictOpts,
   checkWritePathDedup,
   reportPlannedWrites,
+  reportEnvHeal,
   preservedStaleLine,
   assertTransportUrl,
   buildPaletteCommandsForTui
 };
-//# sourceMappingURL=chunk-5KWETEMF.js.map
+//# sourceMappingURL=chunk-6AUAIEFG.js.map