@openape/apes 1.30.0 → 1.31.0

package/dist/cli.js

@@ -50,7 +50,7 @@ import {
   getAgentChallengeEndpoint,
   getDelegationsEndpoint,
   getGrantsEndpoint
-} from "./chunk-NYJSBFLG.js";
+} from "./chunk-MMBFV5WN.js";
 import {
   AUTH_FILE,
   CONFIG_DIR,
@@ -65,7 +65,7 @@ import {
 } from "./chunk-OBF7IMQ2.js";
 
 // src/cli.ts
-import consola52 from "consola";
+import consola53 from "consola";
 
 // src/ape-shell.ts
 import path from "path";
@@ -98,7 +98,7 @@ function rewriteApeShellArgs(argv, argv0) {
 import { defineCommand as defineCommand64, runMain } from "citty";
 
 // src/commands/auth/login.ts
-import { Buffer as Buffer2 } from "buffer";
+import { Buffer } from "buffer";
 import { execFile } from "child_process";
 import { createServer } from "http";
 import { homedir as homedir2 } from "os";
@@ -308,7 +308,7 @@ async function loginWithPKCE(idp) {
   authUrl.searchParams.set("state", state);
   authUrl.searchParams.set("nonce", nonce);
   authUrl.searchParams.set("scope", "openid email profile offline_access");
-  const code = await new Promise((resolve4, reject) => {
+  const code = await new Promise((resolve5, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
       if (url.pathname === "/callback") {
@@ -325,7 +325,7 @@ async function loginWithPKCE(idp) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<h1>Login successful!</h1><p>You can close this window.</p>");
           server.close();
-          resolve4(authCode);
+          resolve5(authCode);
           return;
         }
         res.writeHead(400);
@@ -381,7 +381,7 @@ async function loginWithPKCE(idp) {
   consola2.success(`Logged in as ${payload.email || payload.sub}`);
 }
 async function loginWithKey(idp, keyPath, agentEmail) {
-  const { readFileSync: readFileSync18 } = await import("fs");
+  const { readFileSync: readFileSync19 } = await import("fs");
   const { sign: sign3 } = await import("crypto");
   const { loadEd25519PrivateKey: loadEd25519PrivateKey2 } = await import("./ssh-key-YBNNG5K5.js");
   const challengeUrl = await getAgentChallengeEndpoint(idp);
@@ -395,9 +395,9 @@ async function loginWithKey(idp, keyPath, agentEmail) {
     throw new CliError(`Challenge failed: ${await challengeResp.text()}`);
   }
   const { challenge } = await challengeResp.json();
-  const keyContent = readFileSync18(keyPath, "utf-8");
+  const keyContent = readFileSync19(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey2(keyContent);
-  const signature = sign3(null, Buffer2.from(challenge), privateKey).toString("base64");
+  const signature = sign3(null, Buffer.from(challenge), privateKey).toString("base64");
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
   const authResp = await fetch(authenticateUrl, {
     method: "POST",
@@ -888,7 +888,7 @@ async function waitForApproval2(grantsUrl, grantId) {
     if (grant.status === "revoked") {
       throw new CliError("Grant revoked.");
     }
-    await new Promise((resolve4) => setTimeout(resolve4, interval));
+    await new Promise((resolve5) => setTimeout(resolve5, interval));
   }
   throw new CliError("Timed out waiting for approval.");
 }
@@ -1981,7 +1981,7 @@ import { defineCommand as defineCommand22 } from "citty";
 import consola19 from "consola";
 
 // src/lib/agent-bootstrap.ts
-import { Buffer as Buffer3 } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import { createPrivateKey, sign } from "crypto";
 import { exchangeWithDelegation } from "@openape/cli-auth";
 var AGENT_NAME_REGEX = /^[a-z][a-z0-9-]{0,23}$/;
@@ -2047,7 +2047,7 @@ function decodeJwtClaims(token) {
     const part = token.split(".")[1];
     if (!part) return null;
     const padded = part + "=".repeat((4 - part.length % 4) % 4);
-    const json = Buffer3.from(padded, "base64").toString("utf8");
+    const json = Buffer2.from(padded, "base64").toString("utf8");
     return JSON.parse(json);
   } catch {
     return null;
@@ -2069,7 +2069,7 @@ async function issueAgentToken(input) {
     throw new Error(`Challenge failed (${challengeResp.status}): ${text}`);
   }
   const { challenge } = await challengeResp.json();
-  const signature = sign(null, Buffer3.from(challenge), privateKey).toString("base64");
+  const signature = sign(null, Buffer2.from(challenge), privateKey).toString("base64");
   const authenticateUrl = await getAgentAuthenticateEndpoint(input.idp);
   const authResp = await fetch(authenticateUrl, {
     method: "POST",
@@ -2102,25 +2102,6 @@ mkdir -p "$HOME_DIR/.claude/hooks"
 cat > "$HOME_DIR/.claude/settings.json" ${shHeredoc(input.claudeSettingsJson)}
 cat > "$HOME_DIR/.claude/hooks/bash-via-ape-shell.sh" ${shHeredoc(input.hookScriptSource)}
 chmod 755 "$HOME_DIR/.claude/hooks/bash-via-ape-shell.sh"
-` : "";
-  const claudeTokenBlock = input.claudeOauthToken ? `
-mkdir -p "$HOME_DIR/.config/openape"
-cat > "$HOME_DIR/.config/openape/claude-token.env" ${shHeredoc(`# Auto-generated by 'apes agents spawn'. chmod 600 \u2014 contains a long-lived
-# Claude Code OAuth token. Rotate by editing this file in place; the
-# .zshenv / .profile source-lines below will pick it up automatically.
-export CLAUDE_CODE_OAUTH_TOKEN=${shQuote(input.claudeOauthToken)}
-`)}
-SOURCE_LINE='[ -f "$HOME/.config/openape/claude-token.env" ] && . "$HOME/.config/openape/claude-token.env"'
-for f in "$HOME_DIR/.zshenv" "$HOME_DIR/.profile"; do
-  touch "$f"
-  if ! grep -qF 'config/openape/claude-token.env' "$f" 2>/dev/null; then
-    {
-      echo ''
-      echo '# OpenApe: load Claude Code OAuth token (added by apes agents spawn)'
-      echo "$SOURCE_LINE"
-    } >> "$f"
-  fi
-done
 ` : "";
   return `#!/bin/bash
 set -euo pipefail
@@ -2163,7 +2144,7 @@ cat > "$HOME_DIR/.ssh/id_ed25519.pub" ${shHeredoc(input.publicKeySshLine)}
 cat > "$HOME_DIR/.config/apes/auth.json" ${shHeredoc(input.authJson)}
 cat > "$HOME_DIR/.config/openape/agent-x25519.key" ${shHeredoc(input.x25519PrivateKey)}
 cat > "$HOME_DIR/.config/openape/agent-x25519.key.pub" ${shHeredoc(input.x25519PublicKey)}
-${claudeBlock}${claudeTokenBlock}
+${claudeBlock}
 # Per-agent task dir that \`apes agents sync\` writes to (XDG-style on
 # Linux; was ~/Library/... on macOS).
 mkdir -p "$HOME_DIR/.openape/agent/tasks"
@@ -2177,9 +2158,6 @@ chmod 644 "$HOME_DIR/.ssh/id_ed25519.pub"
 chmod 600 "$HOME_DIR/.config/apes/auth.json"
 chmod 600 "$HOME_DIR/.config/openape/agent-x25519.key"
 chmod 644 "$HOME_DIR/.config/openape/agent-x25519.key.pub"
-if [ -f "$HOME_DIR/.config/openape/claude-token.env" ]; then
-  chmod 600 "$HOME_DIR/.config/openape/claude-token.env"
-fi
 
 echo "OK $NAME (linux user) uid=$NEW_UID home=$HOME_DIR"
 `;
@@ -2533,9 +2511,9 @@ import { consola as consola21 } from "consola";
 import { taskTools, runApeShell, runCodingTask, buildIssueGet, detectForge, createLlmReviewer, createLlmRiskAssessor, resolveMergePolicy } from "@openape/agent-runtime";
 
 // src/lib/agent-secrets-runtime.ts
-import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync4, watch } from "fs";
+import { existsSync as existsSync5, mkdirSync, readdirSync, readFileSync as readFileSync4, statSync, watch, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join3 } from "path";
+import { dirname, join as join3 } from "path";
 import { openString } from "@openape/core";
 var CONFIG_DIR2 = join3(homedir4(), ".config", "openape");
 var SECRETS_DIR = join3(CONFIG_DIR2, "secrets.d");
@@ -2570,7 +2548,17 @@ function materializeSecrets(opts = {}) {
     if (!name) continue;
     try {
       const box = JSON.parse(readFileSync4(join3(dir, file), "utf8"));
-      env[name] = openString(box, key);
+      const plaintext = openString(box, key);
+      const target = typeof box.materializeTo === "string" ? box.materializeTo : null;
+      if (target) {
+        const blobMtime = statSync(join3(dir, file)).mtimeMs;
+        if (!existsSync5(target) || statSync(target).mtimeMs < blobMtime) {
+          mkdirSync(dirname(target), { recursive: true });
+          writeFileSync3(target, plaintext, { mode: 384 });
+        }
+      } else {
+        env[name] = plaintext;
+      }
       applied.push(name);
     } catch (e) {
       failed.push(file);
@@ -2734,7 +2722,7 @@ import { defineCommand as defineCommand25 } from "citty";
 import consola22 from "consola";
 
 // src/lib/nest-registry.ts
-import { existsSync as existsSync7, mkdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join5 } from "path";
 function resolveRegistryPath() {
@@ -2761,10 +2749,10 @@ function writeNestRegistry(reg) {
   const path2 = resolveRegistryPath();
   const dir = path2.replace(/\/agents\.json$/, "");
   try {
-    mkdirSync(dir, { recursive: true });
+    mkdirSync2(dir, { recursive: true });
   } catch {
   }
-  writeFileSync3(path2, `${JSON.stringify(reg, null, 2)}
+  writeFileSync4(path2, `${JSON.stringify(reg, null, 2)}
 `, { mode: 432 });
 }
 function upsertNestAgent(entry) {
@@ -3348,22 +3336,22 @@ import { defineCommand as defineCommand30 } from "citty";
 import consola26 from "consola";
 
 // src/lib/keygen.ts
-import { Buffer as Buffer4 } from "buffer";
-import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
+import { Buffer as Buffer3 } from "buffer";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { generateKeyPairSync } from "crypto";
 import { homedir as homedir9 } from "os";
-import { dirname, resolve as resolve2 } from "path";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 import { generateX25519KeyPair } from "@openape/core";
 function resolveKeyPath(p) {
   return resolve2(p.replace(/^~/, homedir9()));
 }
 function buildSshEd25519Line(rawPub) {
   const keyTypeStr = "ssh-ed25519";
-  const keyTypeLen = Buffer4.alloc(4);
+  const keyTypeLen = Buffer3.alloc(4);
   keyTypeLen.writeUInt32BE(keyTypeStr.length);
-  const pubKeyLen = Buffer4.alloc(4);
+  const pubKeyLen = Buffer3.alloc(4);
   pubKeyLen.writeUInt32BE(rawPub.length);
-  const blob = Buffer4.concat([keyTypeLen, Buffer4.from(keyTypeStr), pubKeyLen, rawPub]);
+  const blob = Buffer3.concat([keyTypeLen, Buffer3.from(keyTypeStr), pubKeyLen, rawPub]);
   return `ssh-ed25519 ${blob.toString("base64")}`;
 }
 function readPublicKey(keyPath) {
@@ -3374,22 +3362,22 @@ function readPublicKey(keyPath) {
   const keyContent = readFileSync10(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const jwk = privateKey.export({ format: "jwk" });
-  const pubBytes = Buffer4.from(jwk.x, "base64url");
+  const pubBytes = Buffer3.from(jwk.x, "base64url");
   return buildSshEd25519Line(pubBytes);
 }
 function generateAndSaveKey(keyPath) {
   const resolved = resolveKeyPath(keyPath);
-  const dir = dirname(resolved);
+  const dir = dirname2(resolved);
   if (!existsSync11(dir)) {
-    mkdirSync2(dir, { recursive: true });
+    mkdirSync3(dir, { recursive: true });
   }
   const { publicKey, privateKey } = generateKeyPairSync("ed25519");
   const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
-  writeFileSync4(resolved, privatePem, { mode: 384 });
+  writeFileSync5(resolved, privatePem, { mode: 384 });
   const jwk = publicKey.export({ format: "jwk" });
-  const pubBytes = Buffer4.from(jwk.x, "base64url");
+  const pubBytes = Buffer3.from(jwk.x, "base64url");
   const pubKeyStr = buildSshEd25519Line(pubBytes);
-  writeFileSync4(`${resolved}.pub`, `${pubKeyStr}
+  writeFileSync5(`${resolved}.pub`, `${pubKeyStr}
 `, { mode: 420 });
   return pubKeyStr;
 }
@@ -3397,7 +3385,7 @@ function generateKeyPairInMemory() {
   const { publicKey, privateKey } = generateKeyPairSync("ed25519");
   const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
   const jwk = publicKey.export({ format: "jwk" });
-  const pubBytes = Buffer4.from(jwk.x, "base64url");
+  const pubBytes = Buffer3.from(jwk.x, "base64url");
   const enc = generateX25519KeyPair();
   return {
     privatePem,
@@ -3435,14 +3423,6 @@ var spawnAgentCommand = defineCommand30({
       type: "boolean",
       description: "Skip writing ~/.claude/settings.json + the Bash-rewrite hook"
     },
-    "claude-token": {
-      type: "string",
-      description: "Claude Code OAuth token (sk-ant-oat01-\u2026) from `claude setup-token`. Visible to ps \u2014 prefer --claude-token-stdin in scripts."
-    },
-    "claude-token-stdin": {
-      type: "boolean",
-      description: "Read the Claude Code OAuth token from stdin (paranoid form of --claude-token)."
-    },
     "no-bridge": {
       type: "boolean",
       description: "Skip the ape-agent runtime install. Default behaviour installs the runtime so the agent answers chat.openape.ai messages (reads LITELLM_API_KEY/BASE_URL from ~/litellm/.env; override via --bridge-key / --bridge-base-url). Use --no-bridge for headless / CI / IdP-only account provisioning where the agent will not run a chat loop."
@@ -3458,6 +3438,18 @@ var spawnAgentCommand = defineCommand30({
     "bridge-model": {
       type: "string",
       description: "Model the bridge sends in chat-completion requests (default: claude-haiku-4-5). Override when fronting a proxy that doesn't route the default \u2014 e.g. ChatGPT-only proxy needs `gpt-5.4`."
+    },
+    "kind": {
+      type: "string",
+      description: `Agent kind: "user" (default, connects to troop-chat) or "service" (polls an SP backend's task queue and runs each task through the LLM). With "service", --serves is required.`
+    },
+    "serves": {
+      type: "string",
+      description: "For --kind service: base URL of the SP backend this agent serves (e.g. https://zaz.delta-mind.at or http://127.0.0.1:3013). The agent pulls GetNextTask / posts ResolveTask there."
+    },
+    "poll-interval": {
+      type: "string",
+      description: "For --kind service: idle poll interval in ms (default 2000)."
     }
   },
   async run({ args }) {
@@ -3467,6 +3459,13 @@ var spawnAgentCommand = defineCommand30({
         `Invalid agent name "${name}". Must match /^[a-z][a-z0-9-]{0,23}$/ \u2014 lowercase letters, digits and hyphens, 1\u201324 chars, must start with a letter.`
       );
     }
+    if (args.kind != null && args.kind !== "user" && args.kind !== "service")
+      throw new CliError(`Invalid --kind "${String(args.kind)}". Must be "user" or "service".`);
+    const isService = args.kind === "service";
+    const servesUrl = typeof args.serves === "string" ? args.serves.replace(/\/$/, "") : void 0;
+    if (isService && !servesUrl)
+      throw new CliError("--kind service requires --serves <SP base URL> (e.g. https://zaz.delta-mind.at).");
+    const pollMs = typeof args["poll-interval"] === "string" ? Number.parseInt(args["poll-interval"], 10) : void 0;
     const auth = loadAuth();
     if (!auth) {
       throw new CliError("Not authenticated. Run `apes login` first.");
@@ -3511,10 +3510,6 @@ var spawnAgentCommand = defineCommand30({
       ownerEmail: registration.owner
     });
     const includeClaudeHook = !args["no-claude-hook"];
-    const claudeOauthToken = await resolveClaudeToken({
-      flag: typeof args["claude-token"] === "string" ? args["claude-token"] : void 0,
-      fromStdin: !!args["claude-token-stdin"]
-    });
     const withBridge = !args["no-bridge"];
     const script = buildSpawnSetupScript({
       name,
@@ -3526,8 +3521,7 @@ var spawnAgentCommand = defineCommand30({
       x25519PublicKey,
       authJson,
       claudeSettingsJson: includeClaudeHook ? CLAUDE_SETTINGS_JSON : null,
-      hookScriptSource: includeClaudeHook ? BASH_VIA_APE_SHELL_HOOK_SOURCE : null,
-      claudeOauthToken
+      hookScriptSource: includeClaudeHook ? BASH_VIA_APE_SHELL_HOOK_SOURCE : null
     });
     consola26.start("Running privileged setup\u2026");
     if (process.getuid?.() !== 0) {
@@ -3542,7 +3536,11 @@ var spawnAgentCommand = defineCommand30({
         home: homeDir,
         email: registration.email,
         registeredAt: Math.floor(Date.now() / 1e3),
-        bridge: withBridge ? {
+        kind: isService ? "service" : void 0,
+        service: isService && servesUrl ? { spBaseUrl: servesUrl, pollIntervalMs: pollMs != null && Number.isFinite(pollMs) && pollMs > 0 ? pollMs : void 0 } : void 0,
+        // Service agents also carry bridge config — it's the LLM endpoint the
+        // worker forwards to (baseUrl/key/model from --bridge-*).
+        bridge: withBridge || isService ? {
           baseUrl: typeof args["bridge-base-url"] === "string" ? args["bridge-base-url"] : void 0,
           apiKey: typeof args["bridge-key"] === "string" ? args["bridge-key"] : void 0,
           model: typeof args["bridge-model"] === "string" ? args["bridge-model"] : void 0
@@ -3562,44 +3560,93 @@ var spawnAgentCommand = defineCommand30({
     console.log(`  apes run --as ${name} -- claude --session-name ${name} --dangerously-skip-permissions`);
   }
 });
-async function resolveClaudeToken(opts) {
-  if (opts.flag && opts.fromStdin) {
-    throw new CliError("Pass --claude-token OR --claude-token-stdin, not both.");
-  }
-  let raw = null;
-  if (typeof opts.flag === "string") {
-    raw = opts.flag.trim();
-  } else if (opts.fromStdin) {
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-    }
-    raw = Buffer.concat(chunks).toString("utf-8").trim();
-  }
-  if (!raw) return null;
-  if (!raw.startsWith("sk-ant-oat01-")) {
-    throw new CliError(
-      `Claude token doesn't look right (expected sk-ant-oat01-\u2026). Run \`claude setup-token\` and paste the resulting token.`
-    );
-  }
-  return raw;
-}
 
 // src/commands/agents/sync.ts
-import { chownSync, existsSync as existsSync12, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync11, rmSync as rmSync2, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { chownSync, existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync12, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { defineCommand as defineCommand31 } from "citty";
+import consola28 from "consola";
+
+// src/lib/recipe-checkout.ts
+import { execFileSync as execFileSync7 } from "child_process";
+import { cpSync, existsSync as existsSync12, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join8, resolve as resolve3, sep } from "path";
 import consola27 from "consola";
-var AUTH_PATH3 = join8(homedir10(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR2 = join8(homedir10(), ".openape", "agent", "tasks");
+var MARKER_FILE = ".recipe-ref";
+var GITHUB_PREFIX = "github.com/";
+function ensureRecipeCheckout(recipeRef, recipeDir, exec2 = execFileSync7) {
+  const at = recipeRef.lastIndexOf("@");
+  if (at <= 0) {
+    consola27.warn(`recipe: malformed recipeRef "${recipeRef}" (expected <owner>/<name>[/<subdir>]@<ref>) \u2014 skipping checkout`);
+    return;
+  }
+  const spec = recipeRef.slice(0, at);
+  const ref = recipeRef.slice(at + 1);
+  const slug = spec.startsWith(GITHUB_PREFIX) ? spec.slice(GITHUB_PREFIX.length) : spec;
+  if (!slug || !ref) {
+    consola27.warn(`recipe: malformed recipeRef "${recipeRef}" (empty slug or ref) \u2014 skipping checkout`);
+    return;
+  }
+  const segments = slug.split("/").filter(Boolean);
+  if (segments.length < 2) {
+    consola27.warn(`recipe: malformed recipeRef "${recipeRef}" (expected <owner>/<name>[/<subdir>]@<ref>) \u2014 skipping checkout`);
+    return;
+  }
+  if (segments.some((s) => s === "." || s === ".." || s.includes("\\"))) {
+    consola27.warn(`recipe: unsafe path segment in recipeRef "${recipeRef}" \u2014 skipping checkout`);
+    return;
+  }
+  const repoSlug = segments.slice(0, 2).join("/");
+  const subdir = segments.slice(2).join("/");
+  const markerPath = join8(recipeDir, MARKER_FILE);
+  if (existsSync12(markerPath)) {
+    try {
+      if (readFileSync11(markerPath, "utf8") === recipeRef) return;
+    } catch {
+    }
+  }
+  const cloneUrl = `https://github.com/${repoSlug}`;
+  const staging = subdir ? `${recipeDir}.checkout` : recipeDir;
+  try {
+    rmSync2(recipeDir, { recursive: true, force: true });
+    if (subdir)
+      rmSync2(staging, { recursive: true, force: true });
+    exec2("git", ["clone", "--depth", "1", "--branch", ref, cloneUrl, staging]);
+    if (subdir) {
+      const src = join8(staging, subdir);
+      if (!resolve3(src).startsWith(resolve3(staging) + sep)) {
+        consola27.warn(`recipe: subdirectory "${subdir}" escapes the checkout dir \u2014 skipping`);
+        rmSync2(staging, { recursive: true, force: true });
+        return;
+      }
+      if (!existsSync12(src)) {
+        consola27.warn(`recipe: subdirectory "${subdir}" not found in ${repoSlug}@${ref} \u2014 skipping checkout`);
+        rmSync2(staging, { recursive: true, force: true });
+        return;
+      }
+      cpSync(src, recipeDir, { recursive: true });
+      rmSync2(staging, { recursive: true, force: true });
+    }
+    writeFileSync6(markerPath, recipeRef);
+    consola27.info(`recipe: checked out ${slug}@${ref} \u2192 ${recipeDir}`);
+  } catch (err) {
+    consola27.warn(`recipe: checkout of ${slug}@${ref} failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    if (subdir)
+      rmSync2(staging, { recursive: true, force: true });
+  }
+}
+
+// src/commands/agents/sync.ts
+var AUTH_PATH3 = join9(homedir10(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR2 = join9(homedir10(), ".openape", "agent", "tasks");
 function readAuthJson() {
-  if (!existsSync12(AUTH_PATH3)) {
+  if (!existsSync13(AUTH_PATH3)) {
     throw new CliError(
       `No agent auth found at ${AUTH_PATH3}. Run \`apes agents spawn <name>\` to provision an agent first.`
     );
   }
-  const raw = readFileSync11(AUTH_PATH3, "utf8");
+  const raw = readFileSync12(AUTH_PATH3, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -3648,7 +3695,7 @@ var syncAgentCommand = defineCommand31({
     if (!auth.owner_email) {
       throw new CliError(`${AUTH_PATH3} is missing owner_email \u2014 re-run \`apes agents spawn\` to update.`);
     }
-    consola27.start(`Syncing ${agentName} (${host}, hostId ${hostId.slice(0, 8)}\u2026) with ${troopUrl}`);
+    consola28.start(`Syncing ${agentName} (${host}, hostId ${hostId.slice(0, 8)}\u2026) with ${troopUrl}`);
     const pubkeyX25519 = readAgentEncryptionPublicKey() ?? void 0;
     const sync = await client.sync({
       hostname: host,
@@ -3656,17 +3703,17 @@ var syncAgentCommand = defineCommand31({
       ownerEmail: auth.owner_email,
       ...pubkeyX25519 ? { pubkeyX25519 } : {}
     });
-    consola27.info(sync.first_sync ? "\u2713 first sync \u2014 agent registered" : "\u2713 presence updated");
-    if (!pubkeyX25519) consola27.warn("No X25519 public key found on disk \u2014 sealed capability secrets cannot be bound until the agent is re-spawned.");
-    const { system_prompt: systemPrompt, tools, skills, tasks } = await client.listTasks();
-    consola27.info(`Pulled ${tasks.length} task${tasks.length === 1 ? "" : "s"}`);
-    consola27.info(`Tools enabled: ${tools.length === 0 ? "(none)" : tools.join(", ")}`);
-    consola27.info(`Skills: ${skills.length === 0 ? "(none)" : skills.map((s) => s.name).join(", ")}`);
+    consola28.info(sync.first_sync ? "\u2713 first sync \u2014 agent registered" : "\u2713 presence updated");
+    if (!pubkeyX25519) consola28.warn("No X25519 public key found on disk \u2014 sealed capability secrets cannot be bound until the agent is re-spawned.");
+    const { system_prompt: systemPrompt, tools, skills, tasks, recipe_ref: recipeRef } = await client.listTasks();
+    consola28.info(`Pulled ${tasks.length} task${tasks.length === 1 ? "" : "s"}`);
+    consola28.info(`Tools enabled: ${tools.length === 0 ? "(none)" : tools.join(", ")}`);
+    consola28.info(`Skills: ${skills.length === 0 ? "(none)" : skills.map((s) => s.name).join(", ")}`);
     let agentUid = null;
     let agentGid = null;
     if (process.geteuid?.() === 0) {
       try {
-        const homeStat = statSync(homedir10());
+        const homeStat = statSync2(homedir10());
         agentUid = homeStat.uid;
         agentGid = homeStat.gid;
       } catch {
@@ -3680,50 +3727,51 @@ var syncAgentCommand = defineCommand31({
         }
       }
     }
-    const agentDir = join8(homedir10(), ".openape", "agent");
-    mkdirSync3(agentDir, { recursive: true });
-    chownToAgent(join8(homedir10(), ".openape"));
+    const agentDir = join9(homedir10(), ".openape", "agent");
+    mkdirSync4(agentDir, { recursive: true });
+    chownToAgent(join9(homedir10(), ".openape"));
     chownToAgent(agentDir);
-    const agentJsonPath = join8(agentDir, "agent.json");
-    writeFileSync5(
+    const agentJsonPath = join9(agentDir, "agent.json");
+    writeFileSync7(
       agentJsonPath,
-      `${JSON.stringify({ systemPrompt, tools }, null, 2)}
+      `${JSON.stringify({ systemPrompt, tools, ...recipeRef ? { recipeRef } : {} }, null, 2)}
 `,
       { mode: 384 }
     );
     chownToAgent(agentJsonPath);
-    mkdirSync3(TASK_CACHE_DIR2, { recursive: true });
+    if (recipeRef) ensureRecipeCheckout(recipeRef, join9(homedir10(), "recipe"));
+    mkdirSync4(TASK_CACHE_DIR2, { recursive: true });
     chownToAgent(TASK_CACHE_DIR2);
     for (const task of tasks) {
-      const path2 = join8(TASK_CACHE_DIR2, `${task.taskId}.json`);
-      writeFileSync5(path2, `${JSON.stringify(task, null, 2)}
+      const path2 = join9(TASK_CACHE_DIR2, `${task.taskId}.json`);
+      writeFileSync7(path2, `${JSON.stringify(task, null, 2)}
 `, { mode: 384 });
       chownToAgent(path2);
     }
-    const skillsDir = join8(agentDir, "skills");
-    mkdirSync3(skillsDir, { recursive: true });
+    const skillsDir = join9(agentDir, "skills");
+    mkdirSync4(skillsDir, { recursive: true });
     chownToAgent(skillsDir);
     const incomingNames = new Set(skills.map((s) => s.name));
     try {
       for (const entry of readdirSync2(skillsDir)) {
         if (incomingNames.has(entry)) continue;
         try {
-          rmSync2(join8(skillsDir, entry), { recursive: true, force: true });
+          rmSync3(join9(skillsDir, entry), { recursive: true, force: true });
         } catch {
         }
       }
     } catch {
     }
     for (const skill of skills) {
-      const skillDir = join8(skillsDir, skill.name);
-      mkdirSync3(skillDir, { recursive: true });
+      const skillDir = join9(skillsDir, skill.name);
+      mkdirSync4(skillDir, { recursive: true });
       chownToAgent(skillDir);
-      const skillPath = join8(skillDir, "SKILL.md");
-      writeFileSync5(skillPath, skill.body.endsWith("\n") ? skill.body : `${skill.body}
+      const skillPath = join9(skillDir, "SKILL.md");
+      writeFileSync7(skillPath, skill.body.endsWith("\n") ? skill.body : `${skill.body}
 `, { mode: 384 });
       chownToAgent(skillPath);
     }
-    consola27.success("Sync complete.");
+    consola28.success("Sync complete.");
   }
 });
 
@@ -3751,19 +3799,19 @@ var agentsCommand = defineCommand32({
 import { defineCommand as defineCommand40 } from "citty";
 
 // src/commands/nest/authorize.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
-import { join as join10 } from "path";
+import { execFileSync as execFileSync8 } from "child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join11 } from "path";
 import { defineCommand as defineCommand34 } from "citty";
-import consola29 from "consola";
+import consola30 from "consola";
 
 // src/commands/nest/enroll.ts
 import { hostname as hostname4, homedir as homedir11 } from "os";
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, chmodSync } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8, chmodSync } from "fs";
+import { join as join10 } from "path";
 import { defineCommand as defineCommand33 } from "citty";
-import consola28 from "consola";
-var NEST_DATA_DIR = join9(homedir11(), ".openape", "nest");
+import consola29 from "consola";
+var NEST_DATA_DIR = join10(homedir11(), ".openape", "nest");
 function nestAgentName() {
   const raw = hostname4().toLowerCase();
   const head = raw.split(".")[0] ?? raw;
@@ -3796,25 +3844,25 @@ var enrollNestCommand = defineCommand33({
       throw new CliError("Run `apes login <email>` first \u2014 nest enroll attaches the new identity to your owner account.");
     }
     const name = args.name || nestAgentName();
-    const authPath = join9(NEST_DATA_DIR, ".config", "apes", "auth.json");
-    if (existsSync13(authPath) && !args.force) {
+    const authPath = join10(NEST_DATA_DIR, ".config", "apes", "auth.json");
+    if (existsSync14(authPath) && !args.force) {
       throw new CliError(`Nest already enrolled at ${authPath}. Pass --force to re-enroll.`);
     }
-    const sshDir = join9(NEST_DATA_DIR, ".ssh");
-    const configDir = join9(NEST_DATA_DIR, ".config", "apes");
-    mkdirSync4(sshDir, { recursive: true });
-    mkdirSync4(configDir, { recursive: true });
-    consola28.start(`Generating keypair for ${name}\u2026`);
+    const sshDir = join10(NEST_DATA_DIR, ".ssh");
+    const configDir = join10(NEST_DATA_DIR, ".config", "apes");
+    mkdirSync5(sshDir, { recursive: true });
+    mkdirSync5(configDir, { recursive: true });
+    consola29.start(`Generating keypair for ${name}\u2026`);
     const { privatePem, publicSshLine } = generateKeyPairInMemory();
-    writeFileSync6(join9(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
+    writeFileSync8(join10(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
 `, { mode: 384 });
-    writeFileSync6(join9(sshDir, "id_ed25519.pub"), `${publicSshLine}
+    writeFileSync8(join10(sshDir, "id_ed25519.pub"), `${publicSshLine}
 `, { mode: 420 });
     chmodSync(sshDir, 448);
-    consola28.start(`Registering nest at ${idp}\u2026`);
+    consola29.start(`Registering nest at ${idp}\u2026`);
     const registration = await registerAgentAtIdp({ name, publicKey: publicSshLine, idp });
-    consola28.success(`Registered as ${registration.email}`);
-    consola28.start("Issuing nest access token\u2026");
+    consola29.success(`Registered as ${registration.email}`);
+    consola29.start("Issuing nest access token\u2026");
     const { token, expiresIn } = await issueAgentToken({
       idp,
       agentEmail: registration.email,
@@ -3825,16 +3873,16 @@ var enrollNestCommand = defineCommand33({
       accessToken: token,
       email: registration.email,
       expiresAt: Math.floor(Date.now() / 1e3) + expiresIn,
-      keyPath: join9(sshDir, "id_ed25519"),
+      keyPath: join10(sshDir, "id_ed25519"),
       ownerEmail: ownerAuth.email
     });
-    writeFileSync6(authPath, authJson, { mode: 384 });
+    writeFileSync8(authPath, authJson, { mode: 384 });
     chmodSync(configDir, 448);
-    consola28.success(`Nest enrolled \u2014 auth.json at ${authPath}`);
-    consola28.info("");
-    consola28.info("Next: configure the YOLO-policy so the nest can spawn/destroy without prompts:");
-    consola28.info("");
-    consola28.info("  apes nest authorize");
+    consola29.success(`Nest enrolled \u2014 auth.json at ${authPath}`);
+    consola29.info("");
+    consola29.info("Next: configure the YOLO-policy so the nest can spawn/destroy without prompts:");
+    consola29.info("");
+    consola29.info("  apes nest authorize");
   }
 });
 
@@ -3897,14 +3945,14 @@ var authorizeNestCommand = defineCommand34({
     }
   },
   async run({ args }) {
-    const nestAuthPath = join10(NEST_DATA_DIR, ".config", "apes", "auth.json");
-    if (!existsSync14(nestAuthPath)) {
+    const nestAuthPath = join11(NEST_DATA_DIR, ".config", "apes", "auth.json");
+    if (!existsSync15(nestAuthPath)) {
       throw new CliError("Nest not enrolled. Run `apes nest enroll` first.");
     }
-    const nestAuth = JSON.parse(readFileSync12(nestAuthPath, "utf8"));
+    const nestAuth = JSON.parse(readFileSync13(nestAuthPath, "utf8"));
     if (!nestAuth.email) throw new CliError(`${nestAuthPath} has no email`);
     const allow = args.allow ?? DEFAULT_ALLOW_PATTERNS.join(",");
-    consola29.info(`Configuring YOLO-policy on ${nestAuth.email} via \`apes yolo set\`\u2026`);
+    consola30.info(`Configuring YOLO-policy on ${nestAuth.email} via \`apes yolo set\`\u2026`);
     const cmdArgs = [
       "yolo",
       "set",
@@ -3918,19 +3966,19 @@ var authorizeNestCommand = defineCommand34({
       cmdArgs.push("--expires-in", args["expires-in"]);
     }
     try {
-      execFileSync7("apes", cmdArgs, { stdio: "inherit" });
+      execFileSync8("apes", cmdArgs, { stdio: "inherit" });
     } catch (err) {
       throw new CliError(err instanceof Error ? err.message : String(err));
     }
-    consola29.success("Nest-driven agent lifecycle is now zero-prompt.");
-    consola29.info("Test: apes agents spawn <name> via the nest API \u2192 no DDISA prompt.");
+    consola30.success("Nest-driven agent lifecycle is now zero-prompt.");
+    consola30.info("Test: apes agents spawn <name> via the nest API \u2192 no DDISA prompt.");
   }
 });
 
 // src/commands/nest/destroy.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { defineCommand as defineCommand35 } from "citty";
-import consola30 from "consola";
+import consola31 from "consola";
 var destroyNestCommand = defineCommand35({
   meta: {
     name: "destroy",
@@ -3942,8 +3990,8 @@ var destroyNestCommand = defineCommand35({
   async run({ args }) {
     const name = String(args.name);
     try {
-      execFileSync8("apes", ["run", "--as", "root", "--wait", "--", "apes", "agents", "destroy", name, "--force"], { stdio: "inherit" });
-      consola30.success(`Nest will tear down ${name}'s pm2 process on its next reconcile (\u22642s).`);
+      execFileSync9("apes", ["run", "--as", "root", "--wait", "--", "apes", "agents", "destroy", name, "--force"], { stdio: "inherit" });
+      consola31.success(`Nest will tear down ${name}'s pm2 process on its next reconcile (\u22642s).`);
     } catch (err) {
       const status = err.status ?? 1;
       throw new CliExit(status);
@@ -3952,11 +4000,11 @@ var destroyNestCommand = defineCommand35({
 });
 
 // src/commands/nest/install.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname2, join as join11 } from "path";
+import { dirname as dirname3, join as join12 } from "path";
 import { defineCommand as defineCommand36 } from "citty";
-import consola31 from "consola";
+import consola32 from "consola";
 
 // src/commands/nest/apes-agents-adapter.ts
 var APES_AGENTS_ADAPTER_TOML = `schema = "openape-shapes/v1"
@@ -4022,41 +4070,41 @@ resource_chain = ["agents:name={name}", "allowlist:email={peer_email}"]
 
 // src/commands/nest/install.ts
 function installAdapter2() {
-  const target = join11(homedir12(), ".openape", "shapes", "adapters", "apes-agents.toml");
-  mkdirSync5(dirname2(target), { recursive: true });
+  const target = join12(homedir12(), ".openape", "shapes", "adapters", "apes-agents.toml");
+  mkdirSync6(dirname3(target), { recursive: true });
   let existing = "";
   try {
-    existing = readFileSync13(target, "utf8");
+    existing = readFileSync14(target, "utf8");
   } catch {
   }
   if (existing === APES_AGENTS_ADAPTER_TOML) return false;
-  writeFileSync7(target, APES_AGENTS_ADAPTER_TOML, { mode: 420 });
-  consola31.success(`Wrote shapes adapter ${target}`);
+  writeFileSync9(target, APES_AGENTS_ADAPTER_TOML, { mode: 420 });
+  consola32.success(`Wrote shapes adapter ${target}`);
   return true;
 }
 function writeBridgeModelDefault(model) {
-  for (const envDir of [join11(homedir12(), "litellm"), join11(NEST_DATA_DIR, "litellm")]) {
-    const envFile = join11(envDir, ".env");
-    mkdirSync5(envDir, { recursive: true });
+  for (const envDir of [join12(homedir12(), "litellm"), join12(NEST_DATA_DIR, "litellm")]) {
+    const envFile = join12(envDir, ".env");
+    mkdirSync6(envDir, { recursive: true });
     let lines = [];
-    if (existsSync15(envFile)) {
-      lines = readFileSync13(envFile, "utf8").split("\n").filter((l) => !l.startsWith("APE_CHAT_BRIDGE_MODEL="));
+    if (existsSync16(envFile)) {
+      lines = readFileSync14(envFile, "utf8").split("\n").filter((l) => !l.startsWith("APE_CHAT_BRIDGE_MODEL="));
     }
     lines.push(`APE_CHAT_BRIDGE_MODEL=${model}`);
     while (lines.length > 0 && lines.at(-1).trim() === "") lines.pop();
-    writeFileSync7(envFile, `${lines.join("\n")}
+    writeFileSync9(envFile, `${lines.join("\n")}
 `, { mode: 384 });
   }
 }
 function findBinary(name) {
   for (const dir of [
-    join11(homedir12(), ".bun", "bin"),
+    join12(homedir12(), ".bun", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin"
   ]) {
-    const p = join11(dir, name);
-    if (existsSync15(p)) return p;
+    const p = join12(dir, name);
+    if (existsSync16(p)) return p;
   }
   throw new Error(`could not locate ${name} on PATH; install it first`);
 }
@@ -4083,16 +4131,16 @@ var installNestCommand = defineCommand36({
     }
     const nestBin = findBinary("openape-nest");
     const apesBin = findBinary("apes");
-    consola31.info(`Installing nest supervisor`);
-    consola31.info(`  nest binary: ${nestBin}`);
-    consola31.info(`  apes binary: ${apesBin}`);
-    consola31.info(`  HTTP port:   ${port}`);
+    consola32.info(`Installing nest supervisor`);
+    consola32.info(`  nest binary: ${nestBin}`);
+    consola32.info(`  apes binary: ${apesBin}`);
+    consola32.info(`  HTTP port:   ${port}`);
     if (typeof args["bridge-model"] === "string" && args["bridge-model"]) {
       writeBridgeModelDefault(args["bridge-model"]);
-      consola31.success(`Default bridge model set to ${args["bridge-model"]} (in ~/litellm/.env)`);
+      consola32.success(`Default bridge model set to ${args["bridge-model"]} (in ~/litellm/.env)`);
     }
     installAdapter2();
-    mkdirSync5(NEST_DATA_DIR, { recursive: true });
+    mkdirSync6(NEST_DATA_DIR, { recursive: true });
     await getHostPlatform().installNestSupervisor({
       nestBin,
       apesBin,
@@ -4100,20 +4148,20 @@ var installNestCommand = defineCommand36({
       nestHome: NEST_DATA_DIR,
       port
     });
-    consola31.success(`Nest daemon bootstrapped \u2014 http://127.0.0.1:${port}`);
-    consola31.info("");
-    consola31.info("Next steps for zero-prompt spawn \u2014 both one-time:");
-    consola31.info("");
-    consola31.info("  1. apes nest enroll       # register nest as DDISA agent (creates own auth.json)");
-    consola31.info("  2. apes nest authorize    # set YOLO-policy on the nest agent");
-    consola31.info("");
-    consola31.info("After that, every `POST http://127.0.0.1:9091/agents` runs without DDISA prompts.");
+    consola32.success(`Nest daemon bootstrapped \u2014 http://127.0.0.1:${port}`);
+    consola32.info("");
+    consola32.info("Next steps for zero-prompt spawn \u2014 both one-time:");
+    consola32.info("");
+    consola32.info("  1. apes nest enroll       # register nest as DDISA agent (creates own auth.json)");
+    consola32.info("  2. apes nest authorize    # set YOLO-policy on the nest agent");
+    consola32.info("");
+    consola32.info("After that, every `POST http://127.0.0.1:9091/agents` runs without DDISA prompts.");
   }
 });
 
 // src/commands/nest/list.ts
 import { defineCommand as defineCommand37 } from "citty";
-import consola32 from "consola";
+import consola33 from "consola";
 var listNestCommand = defineCommand37({
   meta: {
     name: "list",
@@ -4129,21 +4177,21 @@ var listNestCommand = defineCommand37({
       return;
     }
     if (reg.agents.length === 0) {
-      consola32.info("(no agents registered with this nest)");
+      consola33.info("(no agents registered with this nest)");
       return;
     }
-    consola32.info(`${reg.agents.length} agent(s) registered with this nest:`);
+    consola33.info(`${reg.agents.length} agent(s) registered with this nest:`);
     for (const a of reg.agents) {
       const bridge = a.bridge ? " bridge=on" : "";
-      consola32.info(`  ${a.name.padEnd(16)} uid=${String(a.uid).padEnd(5)} home=${a.home}${bridge}`);
+      consola33.info(`  ${a.name.padEnd(16)} uid=${String(a.uid).padEnd(5)} home=${a.home}${bridge}`);
     }
   }
 });
 
 // src/commands/nest/spawn.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync10 } from "child_process";
 import { defineCommand as defineCommand38 } from "citty";
-import consola33 from "consola";
+import consola34 from "consola";
 var spawnNestCommand = defineCommand38({
   meta: {
     name: "spawn",
@@ -4174,8 +4222,8 @@ var spawnNestCommand = defineCommand38({
     if (typeof args["bridge-base-url"] === "string") apesArgs.push("--bridge-base-url", args["bridge-base-url"]);
     if (typeof args["bridge-model"] === "string") apesArgs.push("--bridge-model", args["bridge-model"]);
     try {
-      execFileSync9("apes", apesArgs, { stdio: "inherit" });
-      consola33.success(`Nest will pick up ${name} on its next reconcile (\u22642s).`);
+      execFileSync10("apes", apesArgs, { stdio: "inherit" });
+      consola34.success(`Nest will pick up ${name} on its next reconcile (\u22642s).`);
     } catch (err) {
       const status = err.status ?? 1;
       throw new CliExit(status);
@@ -4185,7 +4233,7 @@ var spawnNestCommand = defineCommand38({
 
 // src/commands/nest/uninstall.ts
 import { defineCommand as defineCommand39 } from "citty";
-import consola34 from "consola";
+import consola35 from "consola";
 var uninstallNestCommand = defineCommand39({
   meta: {
     name: "uninstall",
@@ -4193,8 +4241,8 @@ var uninstallNestCommand = defineCommand39({
   },
   async run() {
     await getHostPlatform().uninstallNestSupervisor();
-    consola34.success("Nest daemon stopped + supervisor unit removed");
-    consola34.info("Registry at ~/.openape/nest/agents.json kept \u2014 re-run `apes nest install` to resume supervision.");
+    consola35.success("Nest daemon stopped + supervisor unit removed");
+    consola35.info("Registry at ~/.openape/nest/agents.json kept \u2014 re-run `apes nest install` to resume supervision.");
   }
 });
 
@@ -4220,7 +4268,7 @@ import { defineCommand as defineCommand44 } from "citty";
 
 // src/commands/yolo/clear.ts
 import { defineCommand as defineCommand41 } from "citty";
-import consola35 from "consola";
+import consola36 from "consola";
 var yoloClearCommand = defineCommand41({
   meta: {
     name: "clear",
@@ -4250,13 +4298,13 @@ var yoloClearCommand = defineCommand41({
       const text = await res.text().catch(() => "");
       throw new CliError(`DELETE /yolo-policy failed (${res.status}): ${text}`);
     }
-    consola35.success(`YOLO-policy cleared on ${email}`);
+    consola36.success(`YOLO-policy cleared on ${email}`);
   }
 });
 
 // src/commands/yolo/set.ts
 import { defineCommand as defineCommand42 } from "citty";
-import consola36 from "consola";
+import consola37 from "consola";
 var VALID_MODES = ["allow-list", "deny-list"];
 var yoloSetCommand = defineCommand42({
   meta: {
@@ -4306,12 +4354,12 @@ var yoloSetCommand = defineCommand42({
     const denyPatterns = parseList(args.deny);
     const denyRiskThreshold = args["deny-risk"] ?? null;
     const expiresAt = parseExpiresIn(args["expires-in"]);
-    consola36.info(`Setting YOLO-policy on ${email}`);
-    consola36.info(`  mode:           ${mode}`);
-    if (allowPatterns.length) consola36.info(`  allow_patterns: ${allowPatterns.join(", ")}`);
-    if (denyPatterns.length) consola36.info(`  deny_patterns:  ${denyPatterns.join(", ")}`);
-    if (denyRiskThreshold) consola36.info(`  deny_risk:      ${denyRiskThreshold}`);
-    if (expiresAt) consola36.info(`  expires_at:     ${new Date(expiresAt * 1e3).toISOString()}`);
+    consola37.info(`Setting YOLO-policy on ${email}`);
+    consola37.info(`  mode:           ${mode}`);
+    if (allowPatterns.length) consola37.info(`  allow_patterns: ${allowPatterns.join(", ")}`);
+    if (denyPatterns.length) consola37.info(`  deny_patterns:  ${denyPatterns.join(", ")}`);
+    if (denyRiskThreshold) consola37.info(`  deny_risk:      ${denyRiskThreshold}`);
+    if (expiresAt) consola37.info(`  expires_at:     ${new Date(expiresAt * 1e3).toISOString()}`);
     const url = `${idp}/api/users/${encodeURIComponent(email)}/yolo-policy`;
     const res = await fetch(url, {
       method: "PUT",
@@ -4331,7 +4379,7 @@ var yoloSetCommand = defineCommand42({
       const text = await res.text().catch(() => "");
       throw new CliError(`PUT /yolo-policy failed (${res.status}): ${text}`);
     }
-    consola36.success(`YOLO-policy applied to ${email}`);
+    consola37.success(`YOLO-policy applied to ${email}`);
   }
 });
 function parseList(s) {
@@ -4350,7 +4398,7 @@ function parseExpiresIn(s) {
 
 // src/commands/yolo/show.ts
 import { defineCommand as defineCommand43 } from "citty";
-import consola37 from "consola";
+import consola38 from "consola";
 var yoloShowCommand = defineCommand43({
   meta: {
     name: "show",
@@ -4388,12 +4436,12 @@ var yoloShowCommand = defineCommand43({
       console.log(JSON.stringify(policy, null, 2));
       return;
     }
-    consola37.info(`YOLO-policy for ${email}`);
-    consola37.info(`  mode:           ${policy.mode}`);
-    consola37.info(`  allow_patterns: ${policy.allowPatterns.length ? policy.allowPatterns.join(", ") : "(none)"}`);
-    consola37.info(`  deny_patterns:  ${policy.denyPatterns.length ? policy.denyPatterns.join(", ") : "(none)"}`);
-    consola37.info(`  deny_risk:      ${policy.denyRiskThreshold ?? "(none)"}`);
-    consola37.info(`  expires_at:     ${policy.expiresAt ? new Date(policy.expiresAt * 1e3).toISOString() : "(never)"}`);
+    consola38.info(`YOLO-policy for ${email}`);
+    consola38.info(`  mode:           ${policy.mode}`);
+    consola38.info(`  allow_patterns: ${policy.allowPatterns.length ? policy.allowPatterns.join(", ") : "(none)"}`);
+    consola38.info(`  deny_patterns:  ${policy.denyPatterns.length ? policy.denyPatterns.join(", ") : "(none)"}`);
+    consola38.info(`  deny_risk:      ${policy.denyRiskThreshold ?? "(none)"}`);
+    consola38.info(`  expires_at:     ${policy.expiresAt ? new Date(policy.expiresAt * 1e3).toISOString() : "(never)"}`);
   }
 });
 
@@ -4412,7 +4460,7 @@ var yoloCommand = defineCommand44({
 
 // src/commands/adapter/index.ts
 import { defineCommand as defineCommand45 } from "citty";
-import consola38 from "consola";
+import consola39 from "consola";
 var adapterCommand = defineCommand45({
   meta: {
     name: "adapter",
@@ -4450,7 +4498,7 @@ var adapterCommand = defineCommand45({
 `);
             return;
           }
-          consola38.info(`Registry: ${index2.adapters.length} adapters (${index2.generated_at})`);
+          consola39.info(`Registry: ${index2.adapters.length} adapters (${index2.generated_at})`);
           for (const a of index2.adapters) {
             const installed = isInstalled(a.id, false) ? " [installed]" : "";
             console.log(`  ${a.id.padEnd(12)} ${a.name.padEnd(24)} ${a.category}${installed}`);
@@ -4472,7 +4520,7 @@ var adapterCommand = defineCommand45({
           return;
         }
         if (local.length === 0) {
-          consola38.info("No adapters installed. Use `apes adapter list --remote` to see available adapters.");
+          consola39.info("No adapters installed. Use `apes adapter list --remote` to see available adapters.");
           return;
         }
         for (const a of local) {
@@ -4509,20 +4557,20 @@ var adapterCommand = defineCommand45({
         for (const id of ids) {
           const entry = findAdapter(index, id);
           if (!entry) {
-            consola38.error(`Adapter "${id}" not found in registry. Use \`apes adapter search ${id}\` to search.`);
+            consola39.error(`Adapter "${id}" not found in registry. Use \`apes adapter search ${id}\` to search.`);
             continue;
           }
           const conflicts = findConflictingAdapters(entry.executable, id);
           if (conflicts.length > 0) {
             for (const c of conflicts) {
-              consola38.warn(`Conflicting adapter found: ${c.path} (id: ${c.adapterId}, executable: ${c.executable})`);
-              consola38.warn(`  Remove it with: apes adapter remove ${c.adapterId}`);
+              consola39.warn(`Conflicting adapter found: ${c.path} (id: ${c.adapterId}, executable: ${c.executable})`);
+              consola39.warn(`  Remove it with: apes adapter remove ${c.adapterId}`);
             }
           }
           const result = await installAdapter(entry, { local });
           const verb = result.updated ? "Updated" : "Installed";
-          consola38.success(`${verb} ${result.id} \u2192 ${result.path}`);
-          consola38.info(`Digest: ${result.digest}`);
+          consola39.success(`${verb} ${result.id} \u2192 ${result.path}`);
+          consola39.info(`Digest: ${result.digest}`);
         }
       }
     }),
@@ -4549,9 +4597,9 @@ var adapterCommand = defineCommand45({
         let failed = false;
         for (const id of ids) {
           if (removeAdapter(id, local)) {
-            consola38.success(`Removed adapter: ${id}`);
+            consola39.success(`Removed adapter: ${id}`);
           } else {
-            consola38.error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
+            consola39.error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
             failed = true;
           }
         }
@@ -4633,7 +4681,7 @@ var adapterCommand = defineCommand45({
           return;
         }
         if (results.length === 0) {
-          consola38.info(`No adapters matching "${query}"`);
+          consola39.info(`No adapters matching "${query}"`);
           return;
         }
         for (const a of results) {
@@ -4668,29 +4716,29 @@ var adapterCommand = defineCommand45({
         const targetId = args.id ? String(args.id) : void 0;
         const targets = targetId ? [targetId] : index.adapters.map((a) => a.id).filter((id) => isInstalled(id, false));
         if (targets.length === 0) {
-          consola38.info("No adapters installed to update.");
+          consola39.info("No adapters installed to update.");
           return;
         }
         for (const id of targets) {
           const entry = findAdapter(index, id);
           if (!entry) {
-            consola38.warn(`${id}: not found in registry, skipping`);
+            consola39.warn(`${id}: not found in registry, skipping`);
             continue;
           }
           const localDigest = getInstalledDigest(id, false);
           if (localDigest === entry.digest) {
-            consola38.info(`${id}: already up to date`);
+            consola39.info(`${id}: already up to date`);
             continue;
           }
           if (localDigest && !args.yes) {
-            consola38.warn(`${id}: digest will change \u2014 existing grants for this adapter will be invalidated`);
-            consola38.info(`  Old: ${localDigest}`);
-            consola38.info(`  New: ${entry.digest}`);
-            consola38.info("  Use --yes to confirm");
+            consola39.warn(`${id}: digest will change \u2014 existing grants for this adapter will be invalidated`);
+            consola39.info(`  Old: ${localDigest}`);
+            consola39.info(`  New: ${entry.digest}`);
+            consola39.info("  Use --yes to confirm");
             continue;
           }
           const result = await installAdapter(entry);
-          consola38.success(`Updated ${result.id} \u2192 ${result.path}`);
+          consola39.success(`Updated ${result.id} \u2192 ${result.path}`);
         }
       }
     }),
@@ -4727,7 +4775,7 @@ var adapterCommand = defineCommand45({
         if (!localDigest)
           throw new Error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
         if (localDigest === entry.digest) {
-          consola38.success(`${id}: digest matches registry`);
+          consola39.success(`${id}: digest matches registry`);
         } else {
           console.log(`  Local:    ${localDigest}`);
           console.log(`  Registry: ${entry.digest}`);
@@ -4739,11 +4787,11 @@ var adapterCommand = defineCommand45({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync10 } from "child_process";
+import { execFileSync as execFileSync11 } from "child_process";
 import { hostname as hostname5 } from "os";
 import { basename } from "path";
 import { defineCommand as defineCommand46 } from "citty";
-import consola39 from "consola";
+import consola40 from "consola";
 function resolveRunAsTarget(runAs) {
   if (!runAs) return runAs;
   if (!AGENT_NAME_REGEX.test(runAs)) return runAs;
@@ -4799,7 +4847,7 @@ function printPendingGrantInfo(grant, idp) {
   const statusCmd = `apes grants status ${grant.id}`;
   const executeCmd = `apes grants run ${grant.id}`;
   if (mode === "human") {
-    consola39.success(`Grant ${grant.id} created \u2014 awaiting your approval`);
+    consola40.success(`Grant ${grant.id} created \u2014 awaiting your approval`);
     console.log(`  Approve in browser:  ${approveUrl}`);
     console.log(`  Check status:        ${statusCmd}`);
     console.log(`  Run after approval:  ${executeCmd}`);
@@ -4809,7 +4857,7 @@ function printPendingGrantInfo(grant, idp) {
     return;
   }
   const maxMin = getPollMaxMinutes();
-  consola39.success(`Grant ${grant.id} created (pending approval)`);
+  consola40.success(`Grant ${grant.id} created (pending approval)`);
   console.log(`  Approve:   ${approveUrl}`);
   console.log(`  Status:    ${statusCmd} [--json]`);
   console.log(`  Execute:   ${executeCmd} --wait`);
@@ -4937,7 +4985,7 @@ async function runShellMode(command, args) {
     }
   } catch {
   }
-  consola39.info(`Requesting ape-shell session grant on ${targetHost}`);
+  consola40.info(`Requesting ape-shell session grant on ${targetHost}`);
   const grant = await apiFetch(grantsUrl, {
     method: "POST",
     body: {
@@ -4957,8 +5005,8 @@ async function runShellMode(command, args) {
     host: targetHost
   });
   if (shouldWaitForGrant(args)) {
-    consola39.info(`Grant requested: ${grant.id}`);
-    consola39.info("Waiting for approval...");
+    consola40.info(`Grant requested: ${grant.id}`);
+    consola40.info("Waiting for approval...");
     const maxWait = 3e5;
     const interval = 3e3;
     const start = Date.now();
@@ -4989,13 +5037,13 @@ async function tryAdapterModeFromShell(command, idp, args) {
   try {
     resolved = await resolveCommand(loaded, [normalizedExecutable, ...parsed.argv]);
   } catch (err) {
-    consola39.debug(`ape-shell: adapter resolve failed for "${parsed.raw}":`, err);
+    consola40.debug(`ape-shell: adapter resolve failed for "${parsed.raw}":`, err);
     return false;
   }
   try {
     const existingGrantId = await findExistingGrant(resolved, idp);
     if (existingGrantId) {
-      consola39.info(`Reusing grant ${existingGrantId} for: ${resolved.detail.display}`);
+      consola40.info(`Reusing grant ${existingGrantId} for: ${resolved.detail.display}`);
       const token = await fetchGrantToken(idp, existingGrantId);
       await verifyAndExecute(token, resolved, existingGrantId);
       return true;
@@ -5003,7 +5051,7 @@ async function tryAdapterModeFromShell(command, idp, args) {
   } catch {
   }
   const approval = args.approval ?? "once";
-  consola39.info(`Requesting grant for: ${resolved.detail.display}`);
+  consola40.info(`Requesting grant for: ${resolved.detail.display}`);
   const grant = await createShapesGrant(resolved, {
     idp,
     approval,
@@ -5011,8 +5059,8 @@ async function tryAdapterModeFromShell(command, idp, args) {
   });
   if (grant.similar_grants?.similar_grants?.length) {
     const n = grant.similar_grants.similar_grants.length;
-    consola39.info("");
-    consola39.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
+    consola40.info("");
+    consola40.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
   }
   notifyGrantPending({
     grantId: grant.id,
@@ -5022,8 +5070,8 @@ async function tryAdapterModeFromShell(command, idp, args) {
     host: args.host || hostname5()
   });
   if (shouldWaitForGrant(args)) {
-    consola39.info(`Grant requested: ${grant.id}`);
-    consola39.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+    consola40.info(`Grant requested: ${grant.id}`);
+    consola40.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
     const status = await waitForGrantStatus(idp, grant.id);
     if (status !== "approved")
       throw new CliError(`Grant ${status}`);
@@ -5039,7 +5087,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync10(command[0], command.slice(1), {
+    execFileSync11(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -5097,7 +5145,7 @@ async function runAdapterMode(command, rawArgs, args) {
   try {
     const existingGrantId = await findExistingGrant(resolved, idp);
     if (existingGrantId) {
-      consola39.info(`Reusing existing grant: ${existingGrantId}`);
+      consola40.info(`Reusing existing grant: ${existingGrantId}`);
       const token = await fetchGrantToken(idp, existingGrantId);
       await verifyAndExecute(token, resolved, existingGrantId);
       return;
@@ -5111,17 +5159,17 @@ async function runAdapterMode(command, rawArgs, args) {
   });
   if (grant.similar_grants?.similar_grants?.length) {
     const n = grant.similar_grants.similar_grants.length;
-    consola39.info("");
-    consola39.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
+    consola40.info("");
+    consola40.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
     if (grant.similar_grants.widened_details?.length) {
       const wider = grant.similar_grants.widened_details.map((d) => d.permission).join(", ");
-      consola39.info(`  Broader scope: ${wider}`);
+      consola40.info(`  Broader scope: ${wider}`);
     }
-    consola39.info("");
+    consola40.info("");
   }
   if (shouldWaitForGrant(args)) {
-    consola39.info(`Grant requested: ${grant.id}`);
-    consola39.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+    consola40.info(`Grant requested: ${grant.id}`);
+    consola40.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
     const status = await waitForGrantStatus(idp, grant.id);
     if (status !== "approved")
       throw new Error(`Grant ${status}`);
@@ -5154,7 +5202,7 @@ async function runAudienceMode(audience, action, args, commandArgv) {
     const { authz_jwt: authz_jwt2 } = await apiFetch(`${grantsUrl}/${reusableId}/token`, { method: "POST" });
     return executeWithGrantToken({ audience, command, args, token: authz_jwt2 });
   }
-  consola39.info(`Requesting ${audience} grant on ${targetHost}: ${command.join(" ")}`);
+  consola40.info(`Requesting ${audience} grant on ${targetHost}: ${command.join(" ")}`);
   const grant = await apiFetch(grantsUrl, {
     method: "POST",
     body: {
@@ -5171,9 +5219,9 @@ async function runAudienceMode(audience, action, args, commandArgv) {
     printPendingGrantInfo(grant, idp);
     throw new CliExit(getAsyncExitCode());
   }
-  consola39.success(`Grant requested: ${grant.id}`);
-  consola39.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
-  consola39.info("Waiting for approval...");
+  consola40.success(`Grant requested: ${grant.id}`);
+  consola40.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+  consola40.info("Waiting for approval...");
   const maxWait = 15 * 60 * 1e3;
   const interval = 3e3;
   const start = Date.now();
@@ -5181,7 +5229,7 @@ async function runAudienceMode(audience, action, args, commandArgv) {
   while (Date.now() - start < maxWait) {
     const status = await apiFetch(`${grantsUrl}/${grant.id}`);
     if (status.status === "approved") {
-      consola39.success("Grant approved!");
+      consola40.success("Grant approved!");
       approved = true;
       break;
     }
@@ -5196,7 +5244,7 @@ async function runAudienceMode(audience, action, args, commandArgv) {
       `Grant approval timed out after ${minutes} min (still pending). Check your DDISA inbox at ${idp}/grant-approval?grant_id=${grant.id} \u2014 if approved later, re-run the same \`apes run\` command and it will reuse the grant.`
     );
   }
-  consola39.info("Fetching grant token...");
+  consola40.info("Fetching grant token...");
   const { authz_jwt } = await apiFetch(`${grantsUrl}/${grant.id}/token`, {
     method: "POST"
   });
@@ -5205,10 +5253,10 @@ async function runAudienceMode(audience, action, args, commandArgv) {
 function executeWithGrantToken(opts) {
   const { audience, command, args, token } = opts;
   if (audience === "escapes") {
-    consola39.info(`Executing: ${command.join(" ")}`);
+    consola40.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync10(args["escapes-path"] || "escapes", ["--grant", token, "--", ...command], {
+      execFileSync11(args["escapes-path"] || "escapes", ["--grant", token, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -5244,11 +5292,11 @@ async function findReusableAudienceGrant(opts) {
 
 // src/commands/proxy.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { homedir as homedir13 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { defineCommand as defineCommand47 } from "citty";
-import consola40 from "consola";
+import consola41 from "consola";
 
 // src/proxy/config.ts
 function buildDefaultProxyConfigToml(opts) {
@@ -5282,10 +5330,10 @@ note = "VPC-internal hostname suffix"
 
 // src/proxy/local-proxy.ts
 import { spawn } from "child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
 import { createRequire } from "module";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname3, join as join12, resolve as resolve3 } from "path";
+import { dirname as dirname4, join as join13, resolve as resolve4 } from "path";
 var require2 = createRequire(import.meta.url);
 function findProxyBin() {
   const pkgPath = require2.resolve("@openape/proxy/package.json");
@@ -5294,12 +5342,12 @@ function findProxyBin() {
   if (!binRel) {
     throw new Error("@openape/proxy is missing the openape-proxy bin entry");
   }
-  return resolve3(dirname3(pkgPath), binRel);
+  return resolve4(dirname4(pkgPath), binRel);
 }
 async function startEphemeralProxy(configToml) {
-  const tmpDir = mkdtempSync2(join12(tmpdir2(), "openape-proxy-"));
-  const configPath = join12(tmpDir, "config.toml");
-  writeFileSync8(configPath, configToml, { mode: 384 });
+  const tmpDir = mkdtempSync2(join13(tmpdir2(), "openape-proxy-"));
+  const configPath = join13(tmpDir, "config.toml");
+  writeFileSync10(configPath, configToml, { mode: 384 });
   const binPath = findProxyBin();
   const child = spawn(process.execPath, [binPath, "-c", configPath], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -5307,7 +5355,7 @@ async function startEphemeralProxy(configToml) {
   });
   const cleanupTmp = () => {
     try {
-      rmSync3(tmpDir, { recursive: true, force: true });
+      rmSync4(tmpDir, { recursive: true, force: true });
     } catch {
     }
   };
@@ -5381,9 +5429,9 @@ function waitForListenLine(child) {
 }
 
 // src/proxy/trust-bundle.ts
-import { existsSync as existsSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var CANDIDATES = [
   "/etc/ssl/cert.pem",
   // macOS
@@ -5396,18 +5444,18 @@ var CANDIDATES = [
 ];
 function detectSystemCaPath() {
   for (const p of CANDIDATES) {
-    if (existsSync16(p)) return p;
+    if (existsSync17(p)) return p;
   }
   throw new Error(
     `Could not locate a system CA bundle. Tried: ${CANDIDATES.join(", ")}. Set NODE_EXTRA_CA_CERTS yourself or pass --allow-no-system-ca.`
   );
 }
 function buildTrustBundle(opts) {
-  const dir = mkdtempSync3(join13(tmpdir3(), "openape-trust-"));
-  const path2 = join13(dir, "bundle.pem");
-  const sys = readFileSync14(opts.systemCaPath, "utf-8");
-  const local = readFileSync14(opts.localCaPath, "utf-8");
-  writeFileSync9(path2, `${sys.trimEnd()}
+  const dir = mkdtempSync3(join14(tmpdir3(), "openape-trust-"));
+  const path2 = join14(dir, "bundle.pem");
+  const sys = readFileSync15(opts.systemCaPath, "utf-8");
+  const local = readFileSync15(opts.localCaPath, "utf-8");
+  writeFileSync11(path2, `${sys.trimEnd()}
 ${local.trimEnd()}
 `, { mode: 384 });
   return {
@@ -5436,7 +5484,7 @@ function resolveProxyConfigOptions() {
       77
     );
   }
-  consola40.info(`[apes proxy] IdP-mediated mode \u2014 agent=${auth.email}, idp=${auth.idp}`);
+  consola41.info(`[apes proxy] IdP-mediated mode \u2014 agent=${auth.email}, idp=${auth.idp}`);
   return { agentEmail: auth.email, idpUrl: auth.idp, mediated: true };
 }
 var proxyCommand = defineCommand47({
@@ -5463,9 +5511,9 @@ var proxyCommand = defineCommand47({
     let close = null;
     if (reuseHostPort) {
       proxyUrl = `http://${reuseHostPort}`;
-      consola40.info(`[apes proxy] using long-running daemon at ${proxyUrl}`);
-      const localCaPath = join14(homedir13(), ".openape", "proxy", "ca.crt");
-      if (!existsSync17(localCaPath)) {
+      consola41.info(`[apes proxy] using long-running daemon at ${proxyUrl}`);
+      const localCaPath = join15(homedir13(), ".openape", "proxy", "ca.crt");
+      if (!existsSync18(localCaPath)) {
         throw new CliError(
           `OPENAPE_PROXY is set but no local CA found at ${localCaPath}. Start the daemon (sudo -u <agent> apes proxy --global < secrets.toml) first.`
         );
@@ -5474,15 +5522,15 @@ var proxyCommand = defineCommand47({
         systemCaPath: detectSystemCaPath(),
         localCaPath
       });
-      consola40.debug(`[apes proxy] trust bundle: ${bundle.path}`);
+      consola41.debug(`[apes proxy] trust bundle: ${bundle.path}`);
     } else if (reuseUrl) {
       proxyUrl = reuseUrl;
-      consola40.info(`[apes proxy] reusing existing proxy at ${proxyUrl}`);
+      consola41.info(`[apes proxy] reusing existing proxy at ${proxyUrl}`);
     } else {
       const ephemeral = await startEphemeralProxy(buildDefaultProxyConfigToml(resolveProxyConfigOptions()));
       proxyUrl = ephemeral.url;
       close = ephemeral.close;
-      consola40.info(`[apes proxy] started ephemeral proxy at ${proxyUrl}`);
+      consola41.info(`[apes proxy] started ephemeral proxy at ${proxyUrl}`);
     }
     const noProxy = process.env.NO_PROXY ?? process.env.no_proxy ?? "127.0.0.1,localhost";
     const childEnv = {
@@ -5523,7 +5571,7 @@ var proxyCommand = defineCommand47({
           else resolveExit(code ?? 0);
         });
         child.once("error", (err) => {
-          consola40.error(`[apes proxy] failed to spawn '${wrapped[0]}':`, err.message);
+          consola41.error(`[apes proxy] failed to spawn '${wrapped[0]}':`, err.message);
           resolveExit(127);
         });
       });
@@ -5580,7 +5628,7 @@ var explainCommand = defineCommand48({
 
 // src/commands/config/get.ts
 import { defineCommand as defineCommand49 } from "citty";
-import consola41 from "consola";
+import consola42 from "consola";
 var configGetCommand = defineCommand49({
   meta: {
     name: "get",
@@ -5601,7 +5649,7 @@ var configGetCommand = defineCommand49({
         if (idp)
           console.log(idp);
         else
-          consola41.info("No IdP configured.");
+          consola42.info("No IdP configured.");
         break;
       }
       case "email": {
@@ -5609,7 +5657,7 @@ var configGetCommand = defineCommand49({
         if (auth?.email)
           console.log(auth.email);
         else
-          consola41.info("Not logged in.");
+          consola42.info("Not logged in.");
         break;
       }
       default: {
@@ -5622,7 +5670,7 @@ var configGetCommand = defineCommand49({
           if (sectionObj && field in sectionObj) {
             console.log(sectionObj[field]);
           } else {
-            consola41.info(`Key "${key}" not set.`);
+            consola42.info(`Key "${key}" not set.`);
           }
         } else {
           throw new CliError(`Unknown key: "${key}". Use: idp, email, defaults.idp, defaults.approval, agent.key, agent.email`);
@@ -5634,7 +5682,7 @@ var configGetCommand = defineCommand49({
 
 // src/commands/config/set.ts
 import { defineCommand as defineCommand50 } from "citty";
-import consola42 from "consola";
+import consola43 from "consola";
 var configSetCommand = defineCommand50({
   meta: {
     name: "set",
@@ -5671,7 +5719,7 @@ var configSetCommand = defineCommand50({
       throw new CliError(`Unknown section: "${section}". Use: defaults, agent`);
     }
     saveConfig(config);
-    consola42.success(`Set ${key} = ${value}`);
+    consola43.success(`Set ${key} = ${value}`);
   }
 });
 
@@ -5807,42 +5855,42 @@ var mcpCommand = defineCommand52({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-X4HHOCKV.js");
+    const { startMcpServer } = await import("./server-MDXOGP2U.js");
     await startMcpServer(transport, port);
   }
 });
 
 // src/commands/init/index.ts
-import { existsSync as existsSync18, copyFileSync, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync19, copyFileSync, writeFileSync as writeFileSync12 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync11 } from "child_process";
-import { join as join15 } from "path";
+import { execFileSync as execFileSync12 } from "child_process";
+import { join as join16 } from "path";
 import { defineCommand as defineCommand53 } from "citty";
-import consola43 from "consola";
+import consola44 from "consola";
 var DEFAULT_IDP_URL = "https://id.openape.at";
 async function downloadTemplate(repo, targetDir) {
   const { downloadTemplate: gigetDownload } = await import("giget");
   await gigetDownload(`gh:${repo}`, { dir: targetDir, force: false });
 }
 function installDeps(dir) {
-  const hasLockFile = (name) => existsSync18(join15(dir, name));
+  const hasLockFile = (name) => existsSync19(join16(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync11("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync11("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync11("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
-  const result = await consola43.prompt(message, { type: "select", options: choices });
+  const result = await consola44.prompt(message, { type: "select", options: choices });
   if (typeof result === "symbol") {
     throw new CliExit(0);
   }
   return result;
 }
 async function promptText(message, defaultValue) {
-  const result = await consola43.prompt(message, { type: "text", default: defaultValue, placeholder: defaultValue });
+  const result = await consola44.prompt(message, { type: "text", default: defaultValue, placeholder: defaultValue });
   if (typeof result === "symbol") {
     throw new CliExit(0);
   }
@@ -5890,23 +5938,23 @@ var initCommand = defineCommand53({
 });
 async function initSP(targetDir) {
   const dir = targetDir || "my-app";
-  if (existsSync18(join15(dir, "package.json"))) {
+  if (existsSync19(join16(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
-  consola43.start("Scaffolding SP starter...");
+  consola44.start("Scaffolding SP starter...");
   await downloadTemplate("openape-ai/openape-sp-starter", dir);
-  consola43.success("Scaffolded from openape-sp-starter");
-  consola43.start("Installing dependencies...");
+  consola44.success("Scaffolded from openape-sp-starter");
+  consola44.start("Installing dependencies...");
   installDeps(dir);
-  consola43.success("Dependencies installed");
-  const envExample = join15(dir, ".env.example");
-  const envFile = join15(dir, ".env");
-  if (existsSync18(envExample) && !existsSync18(envFile)) {
+  consola44.success("Dependencies installed");
+  const envExample = join16(dir, ".env.example");
+  const envFile = join16(dir, ".env");
+  if (existsSync19(envExample) && !existsSync19(envFile)) {
     copyFileSync(envExample, envFile);
-    consola43.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
+    consola44.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
   }
   console.log("");
-  consola43.box([
+  consola44.box([
     `cd ${dir}`,
     "npm run dev",
     "",
@@ -5915,7 +5963,7 @@ async function initSP(targetDir) {
 }
 async function initIdP(targetDir) {
   const dir = targetDir || "my-idp";
-  if (existsSync18(join15(dir, "package.json"))) {
+  if (existsSync19(join16(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
   const domain = await promptText("Domain for the IdP", "localhost");
@@ -5925,15 +5973,15 @@ async function initIdP(targetDir) {
     "s3 (S3-compatible)"
   ]);
   const adminEmail = await promptText("Admin email");
-  consola43.start("Scaffolding IdP starter...");
+  consola44.start("Scaffolding IdP starter...");
   await downloadTemplate("openape-ai/openape-idp-starter", dir);
-  consola43.success("Scaffolded from openape-idp-starter");
-  consola43.start("Installing dependencies...");
+  consola44.success("Scaffolded from openape-idp-starter");
+  consola44.start("Installing dependencies...");
   installDeps(dir);
-  consola43.success("Dependencies installed");
+  consola44.success("Dependencies installed");
   const sessionSecret = randomBytes(32).toString("hex");
   const managementToken = randomBytes(32).toString("hex");
-  consola43.success("Secrets generated");
+  consola44.success("Secrets generated");
   const isLocalhost = domain === "localhost";
   const origin = isLocalhost ? "http://localhost:3000" : `https://${domain}`;
   const envContent = [
@@ -5947,11 +5995,11 @@ async function initIdP(targetDir) {
     `NUXT_OPENAPE_RP_ID=${domain}`,
     `NUXT_OPENAPE_RP_ORIGIN=${origin}`
   ].join("\n");
-  writeFileSync10(join15(dir, ".env"), `${envContent}
+  writeFileSync12(join16(dir, ".env"), `${envContent}
 `, { mode: 384 });
-  consola43.success(".env created");
+  consola44.success(".env created");
   console.log("");
-  consola43.box([
+  consola44.box([
     `cd ${dir}`,
     "npm run dev",
     "",
@@ -5967,12 +6015,12 @@ async function initIdP(targetDir) {
 }
 
 // src/commands/enroll.ts
-import { Buffer as Buffer5 } from "buffer";
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
+import { Buffer as Buffer4 } from "buffer";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { sign as sign2 } from "crypto";
 import { defineCommand as defineCommand54 } from "citty";
-import consola44 from "consola";
+import consola45 from "consola";
 var DEFAULT_IDP_URL2 = "https://id.openape.at";
 var DEFAULT_KEY_PATH = "~/.ssh/id_ed25519";
 var POLL_INTERVAL = 3e3;
@@ -5984,7 +6032,7 @@ function openBrowser2(url) {
 }
 async function pollForEnrollment(idp, agentEmail, keyPath) {
   const resolvedKey = resolveKeyPath(keyPath);
-  const keyContent = readFileSync15(resolvedKey, "utf-8");
+  const keyContent = readFileSync16(resolvedKey, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const challengeUrl = await getAgentChallengeEndpoint(idp);
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -5998,7 +6046,7 @@ async function pollForEnrollment(idp, agentEmail, keyPath) {
       });
       if (challengeResp.ok) {
         const { challenge } = await challengeResp.json();
-        const signature = sign2(null, Buffer5.from(challenge), privateKey).toString("base64");
+        const signature = sign2(null, Buffer4.from(challenge), privateKey).toString("base64");
         const authResp = await fetch(authenticateUrl, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
@@ -6011,7 +6059,7 @@ async function pollForEnrollment(idp, agentEmail, keyPath) {
       }
     } catch {
     }
-    await new Promise((resolve4) => setTimeout(resolve4, POLL_INTERVAL));
+    await new Promise((resolve5) => setTimeout(resolve5, POLL_INTERVAL));
   }
   throw new Error("Enrollment timed out. Please check the browser and try again.");
 }
@@ -6035,38 +6083,38 @@ var enrollCommand = defineCommand54({
     }
   },
   async run({ args }) {
-    const idp = args.idp || await consola44.prompt("IdP URL", { type: "text", default: DEFAULT_IDP_URL2, placeholder: DEFAULT_IDP_URL2 }).then((r) => {
+    const idp = args.idp || await consola45.prompt("IdP URL", { type: "text", default: DEFAULT_IDP_URL2, placeholder: DEFAULT_IDP_URL2 }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     }) || DEFAULT_IDP_URL2;
-    const agentName = args.name || await consola44.prompt("Agent name", { type: "text", placeholder: "deploy-bot" }).then((r) => {
+    const agentName = args.name || await consola45.prompt("Agent name", { type: "text", placeholder: "deploy-bot" }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     });
     if (!agentName) {
       throw new CliError("Agent name is required.");
     }
-    const keyPath = args.key || await consola44.prompt("Ed25519 key", { type: "text", default: DEFAULT_KEY_PATH, placeholder: DEFAULT_KEY_PATH }).then((r) => {
+    const keyPath = args.key || await consola45.prompt("Ed25519 key", { type: "text", default: DEFAULT_KEY_PATH, placeholder: DEFAULT_KEY_PATH }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     }) || DEFAULT_KEY_PATH;
     const resolvedKey = resolveKeyPath(keyPath);
     let publicKey;
-    if (existsSync19(resolvedKey)) {
+    if (existsSync20(resolvedKey)) {
       publicKey = readPublicKey(resolvedKey);
-      consola44.success(`Using existing key ${keyPath}`);
+      consola45.success(`Using existing key ${keyPath}`);
     } else {
-      consola44.start(`Generating Ed25519 key pair at ${keyPath}...`);
+      consola45.start(`Generating Ed25519 key pair at ${keyPath}...`);
       publicKey = generateAndSaveKey(keyPath);
-      consola44.success(`Key pair generated at ${keyPath}`);
+      consola45.success(`Key pair generated at ${keyPath}`);
     }
     const encodedKey = encodeURIComponent(publicKey);
     const enrollUrl = `${idp}/enroll?name=${encodeURIComponent(agentName)}&key=${encodedKey}`;
-    consola44.info("Opening browser for enrollment...");
-    consola44.info(`\u2192 ${idp}/enroll`);
+    consola45.info("Opening browser for enrollment...");
+    consola45.info(`\u2192 ${idp}/enroll`);
     openBrowser2(enrollUrl);
     console.log("");
-    const agentEmail = await consola44.prompt(
+    const agentEmail = await consola45.prompt(
       "Agent email (shown in browser after enrollment)",
       { type: "text", placeholder: `agent+${agentName}@...` }
     ).then((r) => {
@@ -6076,7 +6124,7 @@ var enrollCommand = defineCommand54({
     if (!agentEmail) {
       throw new CliError("Agent email is required to verify enrollment.");
     }
-    consola44.start("Verifying enrollment...");
+    consola45.start("Verifying enrollment...");
     const { token, expiresIn } = await pollForEnrollment(idp, agentEmail, keyPath);
     saveAuth({
       idp,
@@ -6088,17 +6136,17 @@ var enrollCommand = defineCommand54({
     config.defaults = { ...config.defaults, idp };
     config.agent = { key: keyPath, email: agentEmail };
     saveConfig(config);
-    consola44.success(`Agent enrolled as ${agentEmail}`);
-    consola44.success("Config saved to ~/.config/apes/");
+    consola45.success(`Agent enrolled as ${agentEmail}`);
+    consola45.success("Config saved to ~/.config/apes/");
     console.log("");
-    consola44.info("Verify with: apes whoami");
+    consola45.info("Verify with: apes whoami");
   }
 });
 
 // src/commands/register-user.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "fs";
 import { defineCommand as defineCommand55 } from "citty";
-import consola45 from "consola";
+import consola46 from "consola";
 var registerUserCommand = defineCommand55({
   meta: {
     name: "register-user",
@@ -6135,8 +6183,8 @@ var registerUserCommand = defineCommand55({
       throw new CliError("No IdP URL configured. Run `apes login` first.");
     }
     let publicKey = args.key;
-    if (existsSync20(args.key)) {
-      publicKey = readFileSync16(args.key, "utf-8").trim();
+    if (existsSync21(args.key)) {
+      publicKey = readFileSync17(args.key, "utf-8").trim();
     }
     if (!publicKey.startsWith("ssh-ed25519 ")) {
       throw new CliError("Public key must be in ssh-ed25519 format.");
@@ -6154,7 +6202,7 @@ var registerUserCommand = defineCommand55({
         ...userType ? { type: userType } : {}
       }
     });
-    consola45.success(`User registered: ${result.email} (type: ${result.type}, owner: ${result.owner})`);
+    consola46.success(`User registered: ${result.email} (type: ${result.type}, owner: ${result.owner})`);
   }
 });
 
@@ -6163,7 +6211,7 @@ import { defineCommand as defineCommand57 } from "citty";
 
 // src/commands/utils/dig.ts
 import { defineCommand as defineCommand56 } from "citty";
-import consola46 from "consola";
+import consola47 from "consola";
 import { resolveDDISA as resolveDDISA2 } from "@openape/core";
 var digCommand = defineCommand56({
   meta: {
@@ -6238,12 +6286,12 @@ var digCommand = defineCommand56({
     console.log(`  domain: ${domain}`);
     console.log("");
     if (!result.ddisa.found) {
-      consola46.warn(`No DDISA record at _ddisa.${domain}`);
+      consola47.warn(`No DDISA record at _ddisa.${domain}`);
       if (result.hint) console.log(`
 ${result.hint}`);
       throw new CliError(`No DDISA record found for ${domain}`);
     }
-    consola46.success(`_ddisa.${domain} \u2192 ${result.ddisa.idp}`);
+    consola47.success(`_ddisa.${domain} \u2192 ${result.ddisa.idp}`);
     console.log(`  Version:  ${result.ddisa.version || "ddisa1"}`);
     console.log(`  IdP URL:  ${result.ddisa.idp}`);
     if (result.ddisa.mode) console.log(`  Mode:     ${result.ddisa.mode}`);
@@ -6253,13 +6301,13 @@ ${result.hint}`);
       return;
     }
     if (result.idpDiscovery.ok) {
-      consola46.success(`IdP reachable (${result.idpDiscovery.status ?? 200})`);
+      consola47.success(`IdP reachable (${result.idpDiscovery.status ?? 200})`);
       if (result.idpDiscovery.issuer) console.log(`  Issuer:   ${result.idpDiscovery.issuer}`);
       if (result.idpDiscovery.ddisaVersion) console.log(`  DDISA:    v${result.idpDiscovery.ddisaVersion}`);
       if (result.idpDiscovery.authMethods?.length) console.log(`  Auth:     ${result.idpDiscovery.authMethods.join(", ")}`);
       if (result.idpDiscovery.grantTypes?.length) console.log(`  Grants:   ${result.idpDiscovery.grantTypes.join(", ")}`);
     } else {
-      consola46.warn(`IdP discovery failed${result.idpDiscovery.status ? ` (HTTP ${result.idpDiscovery.status})` : ""}`);
+      consola47.warn(`IdP discovery failed${result.idpDiscovery.status ? ` (HTTP ${result.idpDiscovery.status})` : ""}`);
       if (result.hint) console.log(`
 ${result.hint}`);
       throw new CliError(`IdP at ${result.ddisa.idp} not reachable`);
@@ -6283,7 +6331,7 @@ import { defineCommand as defineCommand60 } from "citty";
 
 // src/commands/sessions/list.ts
 import { defineCommand as defineCommand58 } from "citty";
-import consola47 from "consola";
+import consola48 from "consola";
 var sessionsListCommand = defineCommand58({
   meta: {
     name: "list",
@@ -6302,7 +6350,7 @@ var sessionsListCommand = defineCommand58({
       return;
     }
     if (result.data.length === 0) {
-      consola47.info("No active sessions.");
+      consola48.info("No active sessions.");
       return;
     }
     for (const f of result.data) {
@@ -6315,7 +6363,7 @@ var sessionsListCommand = defineCommand58({
 
 // src/commands/sessions/remove.ts
 import { defineCommand as defineCommand59 } from "citty";
-import consola48 from "consola";
+import consola49 from "consola";
 var sessionsRemoveCommand = defineCommand59({
   meta: {
     name: "remove",
@@ -6332,7 +6380,7 @@ var sessionsRemoveCommand = defineCommand59({
     const id = String(args.familyId).trim();
     if (!id) throw new CliError("familyId required");
     await apiFetch(`/api/me/sessions/${encodeURIComponent(id)}`, { method: "DELETE" });
-    consola48.success(`Session ${id} revoked. The device using it will need to \`apes login\` again on its next refresh.`);
+    consola49.success(`Session ${id} revoked. The device using it will need to \`apes login\` again on its next refresh.`);
   }
 });
 
@@ -6350,7 +6398,7 @@ var sessionsCommand = defineCommand60({
 
 // src/commands/dns-check.ts
 import { defineCommand as defineCommand61 } from "citty";
-import consola49 from "consola";
+import consola50 from "consola";
 import { resolveDDISA as resolveDDISA3 } from "@openape/core";
 var dnsCheckCommand = defineCommand61({
   meta: {
@@ -6366,7 +6414,7 @@ var dnsCheckCommand = defineCommand61({
   },
   async run({ args }) {
     const domain = args.domain;
-    consola49.start(`Checking _ddisa.${domain}...`);
+    consola50.start(`Checking _ddisa.${domain}...`);
     try {
       const result = await resolveDDISA3(domain);
       if (!result) {
@@ -6375,7 +6423,7 @@ var dnsCheckCommand = defineCommand61({
         console.log(`  _ddisa.${domain} TXT "v=ddisa1 idp=https://id.${domain}"`);
         throw new CliError(`No DDISA record found for ${domain}`);
       }
-      consola49.success(`_ddisa.${domain} \u2192 ${result.idp}`);
+      consola50.success(`_ddisa.${domain} \u2192 ${result.idp}`);
       console.log("");
       console.log(`  Version:  ${result.version || "ddisa1"}`);
       console.log(`  IdP URL:  ${result.idp}`);
@@ -6384,14 +6432,14 @@ var dnsCheckCommand = defineCommand61({
       if (result.priority !== void 0)
         console.log(`  Priority: ${result.priority}`);
       console.log("");
-      consola49.start(`Verifying IdP at ${result.idp}...`);
+      consola50.start(`Verifying IdP at ${result.idp}...`);
       const discoResp = await fetch(`${result.idp}/.well-known/openid-configuration`);
       if (!discoResp.ok) {
-        consola49.warn(`IdP discovery failed (${discoResp.status}). Is the IdP running at ${result.idp}?`);
+        consola50.warn(`IdP discovery failed (${discoResp.status}). Is the IdP running at ${result.idp}?`);
         return;
       }
       const disco = await discoResp.json();
-      consola49.success(`IdP is reachable`);
+      consola50.success(`IdP is reachable`);
       console.log(`  Issuer:   ${disco.issuer}`);
       console.log(`  DDISA:    v${disco.ddisa_version || "?"}`);
       if (disco.ddisa_auth_methods_supported) {
@@ -6445,7 +6493,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.30.0" : "0.0.0";
+  const version = true ? "1.31.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -6527,7 +6575,7 @@ var healthCommand = defineCommand62({
 
 // src/commands/workflows.ts
 import { defineCommand as defineCommand63 } from "citty";
-import consola50 from "consola";
+import consola51 from "consola";
 
 // src/guides/index.ts
 var guides = [
@@ -6598,7 +6646,7 @@ var workflowsCommand = defineCommand63({
     if (args.id) {
       const guide = guides.find((g) => g.id === String(args.id));
       if (!guide) {
-        consola50.info(`Available: ${guides.map((g) => g.id).join(", ")}`);
+        consola51.info(`Available: ${guides.map((g) => g.id).join(", ")}`);
         throw new CliError(`Guide not found: ${args.id}`);
       }
       if (args.json) {
@@ -6638,26 +6686,26 @@ var workflowsCommand = defineCommand63({
 });
 
 // src/version-check.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync7, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "fs";
 import { homedir as homedir14 } from "os";
-import { join as join16 } from "path";
-import consola51 from "consola";
+import { join as join17 } from "path";
+import consola52 from "consola";
 var PACKAGE_NAME = "@openape/apes";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var CACHE_FILE = join16(homedir14(), ".config", "apes", ".version-check.json");
+var CACHE_FILE = join17(homedir14(), ".config", "apes", ".version-check.json");
 function readCache() {
-  if (!existsSync21(CACHE_FILE)) return null;
+  if (!existsSync22(CACHE_FILE)) return null;
   try {
-    return JSON.parse(readFileSync17(CACHE_FILE, "utf-8"));
+    return JSON.parse(readFileSync18(CACHE_FILE, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(entry) {
   try {
-    const dir = join16(homedir14(), ".config", "apes");
-    if (!existsSync21(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
-    writeFileSync11(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
+    const dir = join17(homedir14(), ".config", "apes");
+    if (!existsSync22(dir)) mkdirSync7(dir, { recursive: true, mode: 448 });
+    writeFileSync13(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
   } catch {
   }
 }
@@ -6686,7 +6734,7 @@ async function fetchLatestVersion() {
 }
 function warnIfBehind(currentVersion, latest) {
   if (compareSemver(currentVersion, latest) < 0) {
-    consola51.warn(
+    consola52.warn(
       `apes ${currentVersion} is behind latest @openape/apes@${latest}. Run \`npm i -g @openape/apes@latest\` to update. (Suppress with APES_NO_UPDATE_CHECK=1.)`
     );
   }
@@ -6718,10 +6766,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.30.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.31.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.30.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.31.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -6736,7 +6784,7 @@ if (shellRewrite) {
     console.log("  --help, -h      Show this help message");
     process.exit(0);
   } else if (shellRewrite.action === "interactive") {
-    const { runInteractiveShell } = await import("./orchestrator-P7QFDBBK.js");
+    const { runInteractiveShell } = await import("./orchestrator-6PZXCE54.js");
     await runInteractiveShell();
     process.exit(0);
   } else {
@@ -6779,7 +6827,7 @@ var configCommand = defineCommand64({
 var main = defineCommand64({
   meta: {
     name: "apes",
-    version: "1.30.0",
+    version: "1.31.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -6831,26 +6879,26 @@ async function maybeRefreshAuth() {
   const { loadAuth: loadAuth2 } = await import("./config-MOB5DJ6H.js");
   if (!loadAuth2()) return;
   try {
-    const { ensureFreshToken } = await import("./http-UPOTOYQV.js");
+    const { ensureFreshToken } = await import("./http-SILH37L7.js");
     await ensureFreshToken();
   } catch {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.30.0").catch(() => {
+await maybeWarnStaleVersion("1.31.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {
     process.exit(err.exitCode);
   }
   if (err instanceof CliError) {
-    consola52.error(err.message);
+    consola53.error(err.message);
     process.exit(err.exitCode);
   }
   if (debug) {
-    consola52.error(err);
+    consola53.error(err);
   } else {
-    consola52.error(err instanceof ApiError ? err.message : err instanceof Error ? err.message : String(err));
+    consola53.error(err instanceof ApiError ? err.message : err instanceof Error ? err.message : String(err));
   }
   process.exit(1);
 });