@spacebar_ai/moldclaw-core 2026.3.41 → 2026.3.44

package/dist/config-cli-Y0uXHbOw.js

@@ -0,0 +1,678 @@
+import "./redact-fatrROh9.js";
+import "./errors-DOJWZqNo.js";
+import "./unhandled-rejections-CTvNvnT0.js";
+import "./logger-BFfIIIKH.js";
+import { _ as resolveStateDir, n as DEFAULT_GATEWAY_PORT, o as resolveConfigPath, t as CONFIG_PATH } from "./paths-D6AgsMTU.js";
+import "./tmp-moldclaw-dir-DWF-d8qD.js";
+import { r as theme } from "./theme-BSXzMzAA.js";
+import { n as info, t as danger, u as success } from "./globals-DESrFYmC.js";
+import { n as defaultRuntime } from "./runtime-_tQz41uA.js";
+import "./ansi-BPhP6LBZ.js";
+import "./subsystem-CPmDTJ2P.js";
+import "./boolean-B6zcAynR.js";
+import "./env-D42cffog.js";
+import "./warning-filter-B1UOeM0G.js";
+import { S as shortenHomePath } from "./utils-C7ykRPCQ.js";
+import { t as formatDocsLink } from "./links-BcahUP5U.js";
+import "./setup-binary-CcAv8NXz.js";
+import "./auth-profiles-smABVXzp.js";
+import "./model-selection-bBBxfXdb.js";
+import "./agent-scope-lZlwP1At.js";
+import { i as isBlockedObjectKey } from "./account-id-BuyZMNja.js";
+import "./boundary-file-read-tPYh_8fH.js";
+import "./logger-BGzLUitz.js";
+import "./exec-CvEtXqTZ.js";
+import "./workspace-DJ_S272u.js";
+import { f as readConfigFileSnapshot, y as writeConfigFile } from "./io-BaBxjB1v.js";
+import "./host-env-security-DQ2i_W12.js";
+import "./safe-text-Cnulee_z.js";
+import "./version-T8nMYUnU.js";
+import "./env-substitution-68cyvF5h.js";
+import "./config-state-h5jUoHya.js";
+import "./network-mode-BtWXzwYn.js";
+import "./registry-C1pRrsQl.js";
+import "./manifest-registry-CS_p1OBQ.js";
+import "./ip-C4YAIpr4.js";
+import "./zod-schema.core-DvwgNmpd.js";
+import "./config-CwBv71QC.js";
+import "./audit-fs-CMb-YUHX.js";
+import "./resolve-PSlwZjg3.js";
+import "./provider-web-search-CcUC9ktE.js";
+import "./text-runtime-Cfq-Uyx0.js";
+import "./workspace-dirs-CGeIPpGN.js";
+import "./config-BwkGZjD5.js";
+import { t as formatCliCommand } from "./command-format-C_z0Ru-7.js";
+import "./tailnet-fFTz5Twr.js";
+import "./net-K181nxTH.js";
+import "./credentials-D-5Pb-aZ.js";
+import "./routes-CcJNnwTF.js";
+import "./frontmatter-Cgg0ICvh.js";
+import "./env-overrides-DBQl3LRc.js";
+import "./path-alias-guards-BtSO7sk7.js";
+import "./skills-DE_MXFSN.js";
+import "./ports-Ca74cFb2.js";
+import "./ports-lsof-CoiADo0p.js";
+import "./ssh-tunnel-DsY-9yao.js";
+import "./image-ops-Ck_D_vpe.js";
+import "./fs-safe-CRXFoBmh.js";
+import "./mime-DGFQe4XX.js";
+import "./server-middleware-Djfoa1s0.js";
+import "./message-channel-DFE4FuE_.js";
+import "./resolve-route-DdX-HBVt.js";
+import "./internal-hooks-83AcmxP3.js";
+import "./lazy-runtime-BoGB4usD.js";
+import "./config-schema-BNU4GQh_.js";
+import "./method-scopes-B2ZKSsxQ.js";
+import "./session-cost-usage-DWgQk6XT.js";
+import "./paths-ApLcu1Uu.js";
+import "./routing-DQ-fpTaA.js";
+import "./send-B1pX9_Oc.js";
+import "./node-resolve-BYC2FbO2.js";
+import "./provider-stream-Chz_EFw3.js";
+import "./identity-file-Diub2a0t.js";
+import { q as OLLAMA_DEFAULT_BASE_URL } from "./provider-models-xnyxy6mO.js";
+import "./secret-file-p1IhQzwJ.js";
+import "./logging-Dy7UYzIN.js";
+import "./runtime-env-BlEtPF6b.js";
+import "./registry-BFMbkmgR.js";
+import "./provider-onboard-B9ionepI.js";
+import "./model-definitions-Cyyzm6Kr.js";
+import "./usage-Czgwvg0h.js";
+import "./device-identity-IG5DngWM.js";
+import "./auth-Ch3Rchm4.js";
+import "./subscription-DaA1urx-.js";
+import "./diagnostic-DTPopFvh.js";
+import "./message-hook-mappers-CeiHXgSQ.js";
+import "./json-store--7cBPxTG.js";
+import "./call-gdDAt07d.js";
+import "./multimodal-BJBBn_4F.js";
+import "./memory-search-tTD5o_rU.js";
+import "./query-expansion-D_Mm5Hhi.js";
+import "./search-manager-BS5Db0A6.js";
+import "./core-BwKq3krw.js";
+import { a as normalizeConfigIssues, n as formatConfigIssueLines } from "./issue-format-B0SI57Es.js";
+import "./logging-CdisccbY.js";
+import "./note-dOl5kPAy.js";
+import "./state-paths-DsMoTg25.js";
+import "./config-value-DT3-5958.js";
+import "./command-secret-targets-BFF4x_RB.js";
+import "./brave-w4Fo8WZ3.js";
+import "./provider-usage-kxemdMp2.js";
+import "./perplexity-CXwMDD3u.js";
+import "./restart-stale-pids-CPF1_61W.js";
+import "./delivery-queue-BOf5wYIc.js";
+import "./pairing-token-bu1e6z6X.js";
+import "./accounts-J2OhhhQi.js";
+import "./process-runtime-D27SftX_.js";
+import "./audit-CpfSjvyo.js";
+import "./cli-runtime-DTCHPjCi.js";
+import "./cli-utils-BCuSS4l6.js";
+import "./help-format-BFzPm_8V.js";
+import "./progress-Cwq59vgZ.js";
+import "./gateway-runtime-CBm3CCoA.js";
+import { t as redactConfigObject } from "./redact-snapshot-DD8A4tdd.js";
+import fs from "node:fs";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import os from "node:os";
+import JSON5 from "json5";
+import fs$1 from "node:fs/promises";
+import crypto from "node:crypto";
+//#region src/cli/config-cli.ts
+const OLLAMA_API_KEY_PATH = [
+	"models",
+	"providers",
+	"ollama",
+	"apiKey"
+];
+const OLLAMA_PROVIDER_PATH = [
+	"models",
+	"providers",
+	"ollama"
+];
+function isIndexSegment(raw) {
+	return /^[0-9]+$/.test(raw);
+}
+function parsePath(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return [];
+	const parts = [];
+	let current = "";
+	let i = 0;
+	while (i < trimmed.length) {
+		const ch = trimmed[i];
+		if (ch === "\\") {
+			const next = trimmed[i + 1];
+			if (next) current += next;
+			i += 2;
+			continue;
+		}
+		if (ch === ".") {
+			if (current) parts.push(current);
+			current = "";
+			i += 1;
+			continue;
+		}
+		if (ch === "[") {
+			if (current) parts.push(current);
+			current = "";
+			const close = trimmed.indexOf("]", i);
+			if (close === -1) throw new Error(`Invalid path (missing "]"): ${raw}`);
+			const inside = trimmed.slice(i + 1, close).trim();
+			if (!inside) throw new Error(`Invalid path (empty "[]"): ${raw}`);
+			parts.push(inside);
+			i = close + 1;
+			continue;
+		}
+		current += ch;
+		i += 1;
+	}
+	if (current) parts.push(current);
+	return parts.map((part) => part.trim()).filter(Boolean);
+}
+function parseValue(raw, opts) {
+	const trimmed = raw.trim();
+	if (opts.strictJson) try {
+		return JSON5.parse(trimmed);
+	} catch (err) {
+		throw new Error(`Failed to parse JSON5 value: ${String(err)}`, { cause: err });
+	}
+	try {
+		return JSON5.parse(trimmed);
+	} catch {
+		return raw;
+	}
+}
+function hasOwnPathKey(value, key) {
+	return Object.prototype.hasOwnProperty.call(value, key);
+}
+function formatDoctorHint(message) {
+	return `Run \`${formatCliCommand("moldclaw doctor")}\` ${message}`;
+}
+function validatePathSegments(path) {
+	for (const segment of path) if (!isIndexSegment(segment) && isBlockedObjectKey(segment)) throw new Error(`Invalid path segment: ${segment}`);
+}
+function getAtPath(root, path) {
+	let current = root;
+	for (const segment of path) {
+		if (!current || typeof current !== "object") return { found: false };
+		if (Array.isArray(current)) {
+			if (!isIndexSegment(segment)) return { found: false };
+			const index = Number.parseInt(segment, 10);
+			if (!Number.isFinite(index) || index < 0 || index >= current.length) return { found: false };
+			current = current[index];
+			continue;
+		}
+		const record = current;
+		if (!hasOwnPathKey(record, segment)) return { found: false };
+		current = record[segment];
+	}
+	return {
+		found: true,
+		value: current
+	};
+}
+function setAtPath(root, path, value) {
+	let current = root;
+	for (let i = 0; i < path.length - 1; i += 1) {
+		const segment = path[i];
+		const next = path[i + 1];
+		const nextIsIndex = Boolean(next && isIndexSegment(next));
+		if (Array.isArray(current)) {
+			if (!isIndexSegment(segment)) throw new Error(`Expected numeric index for array segment "${segment}"`);
+			const index = Number.parseInt(segment, 10);
+			const existing = current[index];
+			if (!existing || typeof existing !== "object") current[index] = nextIsIndex ? [] : {};
+			current = current[index];
+			continue;
+		}
+		if (!current || typeof current !== "object") throw new Error(`Cannot traverse into "${segment}" (not an object)`);
+		const record = current;
+		const existing = hasOwnPathKey(record, segment) ? record[segment] : void 0;
+		if (!existing || typeof existing !== "object") record[segment] = nextIsIndex ? [] : {};
+		current = record[segment];
+	}
+	const last = path[path.length - 1];
+	if (Array.isArray(current)) {
+		if (!isIndexSegment(last)) throw new Error(`Expected numeric index for array segment "${last}"`);
+		const index = Number.parseInt(last, 10);
+		current[index] = value;
+		return;
+	}
+	if (!current || typeof current !== "object") throw new Error(`Cannot set "${last}" (parent is not an object)`);
+	current[last] = value;
+}
+function unsetAtPath(root, path) {
+	let current = root;
+	for (let i = 0; i < path.length - 1; i += 1) {
+		const segment = path[i];
+		if (!current || typeof current !== "object") return false;
+		if (Array.isArray(current)) {
+			if (!isIndexSegment(segment)) return false;
+			const index = Number.parseInt(segment, 10);
+			if (!Number.isFinite(index) || index < 0 || index >= current.length) return false;
+			current = current[index];
+			continue;
+		}
+		const record = current;
+		if (!hasOwnPathKey(record, segment)) return false;
+		current = record[segment];
+	}
+	const last = path[path.length - 1];
+	if (Array.isArray(current)) {
+		if (!isIndexSegment(last)) return false;
+		const index = Number.parseInt(last, 10);
+		if (!Number.isFinite(index) || index < 0 || index >= current.length) return false;
+		current.splice(index, 1);
+		return true;
+	}
+	if (!current || typeof current !== "object") return false;
+	const record = current;
+	if (!hasOwnPathKey(record, last)) return false;
+	delete record[last];
+	return true;
+}
+async function loadValidConfig(runtime = defaultRuntime) {
+	const snapshot = await readConfigFileSnapshot();
+	if (snapshot.valid) return snapshot;
+	runtime.error(`Config invalid at ${shortenHomePath(snapshot.path)}.`);
+	for (const line of formatConfigIssueLines(snapshot.issues, "-", { normalizeRoot: true })) runtime.error(line);
+	runtime.error(formatDoctorHint("to repair, then retry."));
+	runtime.exit(1);
+	return snapshot;
+}
+function parseRequiredPath(path) {
+	const parsedPath = parsePath(path);
+	if (parsedPath.length === 0) throw new Error("Path is empty.");
+	validatePathSegments(parsedPath);
+	return parsedPath;
+}
+function pathEquals(path, expected) {
+	return path.length === expected.length && path.every((segment, index) => segment === expected[index]);
+}
+function ensureValidOllamaProviderForApiKeySet(root, path) {
+	if (!pathEquals(path, OLLAMA_API_KEY_PATH)) return;
+	if (getAtPath(root, OLLAMA_PROVIDER_PATH).found) return;
+	setAtPath(root, OLLAMA_PROVIDER_PATH, {
+		baseUrl: OLLAMA_DEFAULT_BASE_URL,
+		api: "ollama",
+		models: []
+	});
+}
+async function runConfigGet(opts) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	try {
+		const redacted = redactConfigObject((await loadValidConfig(runtime)).config);
+		if (!opts.path) {
+			runtime.log(JSON.stringify(redacted, null, 2));
+			return;
+		}
+		const res = getAtPath(redacted, parseRequiredPath(opts.path));
+		if (!res.found) {
+			runtime.error(danger(`Config path not found: ${opts.path}`));
+			runtime.exit(1);
+			return;
+		}
+		if (opts.json) {
+			runtime.log(JSON.stringify(res.value ?? null, null, 2));
+			return;
+		}
+		if (typeof res.value === "string" || typeof res.value === "number" || typeof res.value === "boolean") {
+			runtime.log(String(res.value));
+			return;
+		}
+		runtime.log(JSON.stringify(res.value ?? null, null, 2));
+	} catch (err) {
+		runtime.error(danger(String(err)));
+		runtime.exit(1);
+	}
+}
+async function runConfigUnset(opts) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	try {
+		const parsedPath = parseRequiredPath(opts.path);
+		const snapshot = await loadValidConfig(runtime);
+		const next = structuredClone(snapshot.resolved);
+		if (!unsetAtPath(next, parsedPath)) {
+			runtime.error(danger(`Config path not found: ${opts.path}`));
+			runtime.exit(1);
+			return;
+		}
+		await writeConfigFile(next, { unsetPaths: [parsedPath] });
+		runtime.log(info(`Removed ${opts.path}. Restart the gateway to apply.`));
+	} catch (err) {
+		runtime.error(danger(String(err)));
+		runtime.exit(1);
+	}
+}
+async function runConfigFile(opts) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	try {
+		const snapshot = await readConfigFileSnapshot();
+		runtime.log(shortenHomePath(snapshot.path));
+	} catch (err) {
+		runtime.error(danger(String(err)));
+		runtime.exit(1);
+	}
+}
+async function runConfigValidate(opts = {}) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	let outputPath = CONFIG_PATH ?? "moldclaw.json";
+	try {
+		const snapshot = await readConfigFileSnapshot();
+		outputPath = snapshot.path;
+		const shortPath = shortenHomePath(outputPath);
+		if (!snapshot.exists) {
+			if (opts.json) runtime.log(JSON.stringify({
+				valid: false,
+				path: outputPath,
+				error: "file not found"
+			}));
+			else runtime.error(danger(`Config file not found: ${shortPath}`));
+			runtime.exit(1);
+			return;
+		}
+		if (!snapshot.valid) {
+			const issues = normalizeConfigIssues(snapshot.issues);
+			if (opts.json) runtime.log(JSON.stringify({
+				valid: false,
+				path: outputPath,
+				issues
+			}, null, 2));
+			else {
+				runtime.error(danger(`Config invalid at ${shortPath}:`));
+				for (const line of formatConfigIssueLines(issues, danger("×"), { normalizeRoot: true })) runtime.error(`  ${line}`);
+				runtime.error("");
+				runtime.error(formatDoctorHint("to repair, or fix the keys above manually."));
+			}
+			runtime.exit(1);
+			return;
+		}
+		if (opts.json) runtime.log(JSON.stringify({
+			valid: true,
+			path: outputPath
+		}));
+		else runtime.log(success(`Config valid: ${shortPath}`));
+	} catch (err) {
+		if (opts.json) runtime.log(JSON.stringify({
+			valid: false,
+			path: outputPath,
+			error: String(err)
+		}));
+		else runtime.error(danger(`Config validation error: ${String(err)}`));
+		runtime.exit(1);
+	}
+}
+async function runConfigInit(opts = {}) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	const port = opts.port ?? 28789;
+	const bind = opts.bind ?? "127.0.0.1";
+	try {
+		const stateDir = resolveStateDir();
+		const configPath = resolveConfigPath();
+		const shortPath = shortenHomePath(configPath);
+		if (fs.existsSync(configPath) && !opts.force) {
+			if (opts.json) runtime.log(JSON.stringify({
+				success: false,
+				error: "config already exists",
+				path: configPath,
+				hint: "use --force to overwrite"
+			}));
+			else {
+				runtime.error(danger(`Config already exists at ${shortPath}`));
+				runtime.error(info("Use --force to overwrite existing config."));
+			}
+			runtime.exit(1);
+			return;
+		}
+		if (!fs.existsSync(stateDir)) fs.mkdirSync(stateDir, {
+			recursive: true,
+			mode: 448
+		});
+		const gatewayToken = crypto.randomBytes(32).toString("base64url");
+		const bindMode = bind === "127.0.0.1" ? "loopback" : bind === "0.0.0.0" ? "lan" : "custom";
+		await writeConfigFile({ gateway: {
+			port,
+			bind: bindMode,
+			...bindMode === "custom" ? { customBindHost: bind } : {},
+			auth: {
+				mode: "token",
+				token: gatewayToken
+			}
+		} });
+		if (process.platform !== "win32") try {
+			fs.chmodSync(configPath, 384);
+		} catch {}
+		if (opts.json) runtime.log(JSON.stringify({
+			success: true,
+			path: configPath,
+			gatewayToken,
+			port,
+			bind
+		}));
+		else {
+			runtime.log(success(`Config initialized at ${shortPath}`));
+			runtime.log(info(`Gateway port: ${port}`));
+			runtime.log(info(`Gateway bind: ${bind}`));
+			runtime.log(info(`Gateway token: ${gatewayToken}`));
+			runtime.log("");
+			runtime.log(theme.muted("Start the gateway with: moldclaw gateway run"));
+		}
+	} catch (err) {
+		if (opts.json) runtime.log(JSON.stringify({
+			success: false,
+			error: String(err)
+		}));
+		else runtime.error(danger(`Config init failed: ${String(err)}`));
+		runtime.exit(1);
+	}
+}
+function registerConfigCli(program) {
+	const cmd = program.command("config").description("Non-interactive config helpers (get/set/unset/file/validate). Run without subcommand for guided setup.").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/config", "docs.moldclaw.ai/cli/config")}\n`).option("--section <section>", "Configuration sections for guided setup (repeatable). Use with no subcommand.", (value, previous) => [...previous, value], []).action(async (opts) => {
+		const { configureCommandFromSectionsArg } = await import("./configure-BJ3Wrs5b.js");
+		await configureCommandFromSectionsArg(opts.section, defaultRuntime);
+	});
+	cmd.command("get").description("Get a config value by dot path (omit path for entire config)").argument("[path]", "Config path (dot or bracket notation), omit for full config").option("--json", "Output JSON", false).action(async (path, opts) => {
+		await runConfigGet({
+			path,
+			json: Boolean(opts.json)
+		});
+	});
+	cmd.command("set").description("Set a config value by dot path").argument("<path>", "Config path (dot or bracket notation)").argument("<value>", "Value (JSON5 or raw string)").option("--strict-json", "Strict JSON5 parsing (error instead of raw string fallback)", false).option("--json", "Legacy alias for --strict-json", false).action(async (path, value, opts) => {
+		try {
+			const parsedPath = parseRequiredPath(path);
+			const parsedValue = parseValue(value, { strictJson: Boolean(opts.strictJson || opts.json) });
+			const snapshot = await loadValidConfig();
+			const next = structuredClone(snapshot.resolved);
+			ensureValidOllamaProviderForApiKeySet(next, parsedPath);
+			setAtPath(next, parsedPath, parsedValue);
+			await writeConfigFile(next);
+			defaultRuntime.log(info(`Updated ${path}. Restart the gateway to apply.`));
+		} catch (err) {
+			defaultRuntime.error(danger(String(err)));
+			defaultRuntime.exit(1);
+		}
+	});
+	cmd.command("unset").description("Remove a config value by dot path").argument("<path>", "Config path (dot or bracket notation)").action(async (path) => {
+		await runConfigUnset({ path });
+	});
+	cmd.command("file").description("Print the active config file path").action(async () => {
+		await runConfigFile({});
+	});
+	cmd.command("validate").description("Validate the current config against the schema without starting the gateway").option("--json", "Output validation result as JSON", false).action(async (opts) => {
+		await runConfigValidate({ json: Boolean(opts.json) });
+	});
+	cmd.command("init").description("Initialize a new config file with gateway settings").option("--port <port>", `Gateway port (default: ${DEFAULT_GATEWAY_PORT})`, String(DEFAULT_GATEWAY_PORT)).option("--bind <bind>", "Gateway bind address (default: 127.0.0.1)", "127.0.0.1").option("--force", "Overwrite existing config", false).option("--json", "Output result as JSON", false).action(async (opts) => {
+		const port = Number.parseInt(opts.port, 10);
+		if (!Number.isFinite(port) || port < 1 || port > 65535) {
+			defaultRuntime.error(danger(`Invalid port: ${opts.port}`));
+			defaultRuntime.exit(1);
+			return;
+		}
+		await runConfigInit({
+			port,
+			bind: opts.bind,
+			force: Boolean(opts.force),
+			json: Boolean(opts.json)
+		});
+	});
+	cmd.command("fix-permissions").description("Fix file permissions for ~/.moldclaw/ (dirs: 0700, files: 0600)").option("--dry-run", "Show what would be changed without making changes", false).option("--json", "Output result as JSON", false).action(async (opts) => {
+		await runConfigFixPermissions({
+			dryRun: Boolean(opts.dryRun),
+			json: Boolean(opts.json)
+		});
+	});
+}
+async function fixUnixPermissions(stateDir, dryRun) {
+	const result = {
+		success: true,
+		platform: "unix",
+		stateDir,
+		changes: [],
+		errors: []
+	};
+	const DIR_MODE = 448;
+	const FILE_MODE = 384;
+	async function processPath(itemPath) {
+		try {
+			const stat = await fs$1.stat(itemPath);
+			const isDir = stat.isDirectory();
+			const currentMode = stat.mode & 511;
+			const targetMode = isDir ? DIR_MODE : FILE_MODE;
+			if (currentMode === targetMode) {
+				result.changes.push({
+					path: itemPath,
+					type: isDir ? "directory" : "file",
+					oldMode: currentMode.toString(8).padStart(3, "0"),
+					action: "already-correct"
+				});
+				return;
+			}
+			if (dryRun) result.changes.push({
+				path: itemPath,
+				type: isDir ? "directory" : "file",
+				oldMode: currentMode.toString(8).padStart(3, "0"),
+				newMode: targetMode.toString(8).padStart(3, "0"),
+				action: "skipped"
+			});
+			else {
+				await fs$1.chmod(itemPath, targetMode);
+				result.changes.push({
+					path: itemPath,
+					type: isDir ? "directory" : "file",
+					oldMode: currentMode.toString(8).padStart(3, "0"),
+					newMode: targetMode.toString(8).padStart(3, "0"),
+					action: "fixed"
+				});
+			}
+			if (isDir) {
+				const entries = await fs$1.readdir(itemPath, { withFileTypes: true });
+				for (const entry of entries) await processPath(path.join(itemPath, entry.name));
+			}
+		} catch (err) {
+			result.errors.push(`${itemPath}: ${String(err)}`);
+			result.success = false;
+		}
+	}
+	await processPath(stateDir);
+	return result;
+}
+async function fixWindowsPermissions(stateDir, dryRun) {
+	const result = {
+		success: true,
+		platform: "windows",
+		stateDir,
+		changes: [],
+		errors: []
+	};
+	try {
+		const username = os.userInfo().username;
+		if (dryRun) result.changes.push({
+			path: stateDir,
+			type: "directory",
+			action: "skipped"
+		});
+		else try {
+			execSync(`icacls "${stateDir}" /inheritance:r /grant:r "${username}:(OI)(CI)F" /T`, { stdio: "pipe" });
+			result.changes.push({
+				path: stateDir,
+				type: "directory",
+				action: "fixed"
+			});
+		} catch (err) {
+			result.errors.push(`Failed to set permissions: ${String(err)}`);
+			result.success = false;
+		}
+	} catch (err) {
+		result.errors.push(`${stateDir}: ${String(err)}`);
+		result.success = false;
+	}
+	return result;
+}
+async function runConfigFixPermissions(opts = {}) {
+	const runtime = opts.runtime ?? defaultRuntime;
+	const dryRun = opts.dryRun ?? false;
+	const stateDir = resolveStateDir();
+	const shortPath = shortenHomePath(stateDir);
+	try {
+		if (!fs.existsSync(stateDir)) {
+			if (opts.json) runtime.log(JSON.stringify({
+				success: false,
+				error: "state directory not found",
+				path: stateDir
+			}));
+			else {
+				runtime.error(danger(`State directory not found: ${shortPath}`));
+				runtime.error(info("Run 'moldclaw setup' first to create the directory."));
+			}
+			runtime.exit(1);
+			return;
+		}
+		const isWindows = process.platform === "win32";
+		const result = isWindows ? await fixWindowsPermissions(stateDir, dryRun) : await fixUnixPermissions(stateDir, dryRun);
+		if (opts.json) {
+			runtime.log(JSON.stringify(result, null, 2));
+			if (!result.success) runtime.exit(1);
+			return;
+		}
+		if (dryRun) {
+			runtime.log(theme.muted("Dry run - no changes made:"));
+			runtime.log("");
+		}
+		const fixedCount = result.changes.filter((c) => c.action === "fixed").length;
+		const skippedCount = result.changes.filter((c) => c.action === "skipped").length;
+		const correctCount = result.changes.filter((c) => c.action === "already-correct").length;
+		if (isWindows) {
+			if (result.success) if (dryRun) runtime.log(info(`Would set owner-only permissions on ${shortPath}`));
+			else runtime.log(success(`Permissions fixed for ${shortPath}`));
+		} else {
+			if (fixedCount > 0 || skippedCount > 0) {
+				for (const change of result.changes) {
+					if (change.action === "already-correct") continue;
+					const actionIcon = change.action === "fixed" ? success("✓") : info("→");
+					const modeChange = change.oldMode && change.newMode ? `${change.oldMode} → ${change.newMode}` : "";
+					runtime.log(`  ${actionIcon} ${shortenHomePath(change.path)} ${theme.muted(modeChange)}`);
+				}
+				runtime.log("");
+			}
+			if (dryRun) runtime.log(info(`Would fix ${skippedCount} items (${correctCount} already correct)`));
+			else if (fixedCount > 0) runtime.log(success(`Fixed ${fixedCount} items (${correctCount} already correct)`));
+			else runtime.log(success(`All permissions correct (${correctCount} items)`));
+		}
+		if (result.errors.length > 0) {
+			runtime.log("");
+			runtime.log(danger("Errors:"));
+			for (const err of result.errors) runtime.error(`  ${danger("×")} ${err}`);
+			runtime.exit(1);
+		}
+	} catch (err) {
+		if (opts.json) runtime.log(JSON.stringify({
+			success: false,
+			error: String(err)
+		}));
+		else runtime.error(danger(`Failed to fix permissions: ${String(err)}`));
+		runtime.exit(1);
+	}
+}
+//#endregion
+export { registerConfigCli, runConfigGet, runConfigUnset };