@yawlabs/mcp 0.60.2 → 0.60.6

package/dist/index.js

@@ -17,7 +17,422 @@ import {
   signIn,
   signOut,
   userConfigDir
-} from "./chunk-C3WU6HAG.js";
+} from "./chunk-I5625HJE.js";
+
+// src/audit-cmd.ts
+import { homedir as homedir3 } from "os";
+
+// src/grades-cache.ts
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/jsonc.ts
+function stripJsoncComments(src) {
+  let out = "";
+  let i = 0;
+  const len = src.length;
+  let inString = false;
+  let stringChar = "";
+  while (i < len) {
+    const c = src[i];
+    if (inString) {
+      out += c;
+      if (c === "\\" && i + 1 < len) {
+        out += src[i + 1];
+        i += 2;
+        continue;
+      }
+      if (c === stringChar) inString = false;
+      i++;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inString = true;
+      stringChar = c;
+      out += c;
+      i++;
+      continue;
+    }
+    const next = src[i + 1];
+    if (c === "/" && next === "/") {
+      while (i < len && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < len && !(src[i] === "*" && src[i + 1] === "/")) {
+        if (src[i] === "\n") out += "\n";
+        i++;
+      }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+function parseJsonc(src) {
+  const debommed = src.charCodeAt(0) === 65279 ? src.slice(1) : src;
+  const stripped = stripJsoncComments(debommed);
+  return JSON.parse(stripped);
+}
+
+// src/grades-cache.ts
+var GRADES_FILENAME = "grades.json";
+var GRADE_LETTERS = /* @__PURE__ */ new Set(["A", "B", "C", "D", "F"]);
+function gradesCachePath(home = homedir()) {
+  return join(home, CONFIG_DIRNAME, GRADES_FILENAME);
+}
+function validateEntry(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+  const e = entry;
+  const grade = typeof e.grade === "string" ? e.grade.toUpperCase() : "";
+  if (!GRADE_LETTERS.has(grade)) return null;
+  const score = typeof e.score === "number" && Number.isFinite(e.score) ? e.score : null;
+  if (score === null) return null;
+  const gradedAt = typeof e.gradedAt === "string" && e.gradedAt.length > 0 ? e.gradedAt : "";
+  if (!gradedAt) return null;
+  return { grade, score, gradedAt };
+}
+async function readGradesCache(home = homedir()) {
+  const path3 = gradesCachePath(home);
+  let raw;
+  try {
+    raw = await readFile(path3, "utf8");
+  } catch {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(raw);
+  } catch (err) {
+    log("warn", "grades.json is not valid JSON; ignoring", {
+      path: path3,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return {};
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  const out = {};
+  for (const [ns, entry] of Object.entries(parsed)) {
+    const validated = validateEntry(entry);
+    if (validated) out[ns] = validated;
+  }
+  return out;
+}
+async function writeGrade(namespace, grade, home = homedir()) {
+  const path3 = gradesCachePath(home);
+  const cache = await readGradesCache(home);
+  cache[namespace] = grade;
+  await atomicWriteFile(path3, `${JSON.stringify(cache, null, 2)}
+`);
+  return path3;
+}
+
+// src/local-bundles.ts
+import { createHash } from "crypto";
+import { existsSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var BUNDLES_FILENAME = "bundles.json";
+var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
+function localBundlesPath(configDir) {
+  return join2(configDir, BUNDLES_FILENAME);
+}
+var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
+function validateEntry2(entry, warnings) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    warnings.push("bundles.json: skipping non-object server entry");
+    return null;
+  }
+  const e = entry;
+  const namespace = typeof e.namespace === "string" ? e.namespace : "";
+  if (!namespace || !NAMESPACE_RE.test(namespace)) {
+    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
+    return null;
+  }
+  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
+  const type = e.type === "remote" ? "remote" : "local";
+  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
+  const command = typeof e.command === "string" ? e.command : void 0;
+  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
+  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
+    Object.entries(e.env).filter(([, v]) => typeof v === "string")
+  ) : void 0;
+  const url = typeof e.url === "string" ? e.url : void 0;
+  const description = typeof e.description === "string" ? e.description : void 0;
+  const isActive = e.isActive !== false;
+  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
+  return {
+    id,
+    name,
+    namespace,
+    type,
+    transport,
+    command,
+    args,
+    env,
+    url,
+    isActive,
+    description
+  };
+}
+async function readBundlesAt(path3, warnings) {
+  let raw;
+  try {
+    raw = await readFile2(path3, "utf8");
+  } catch {
+    return { exists: false, file: null };
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
+    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
+    return { exists: true, file: null };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
+    return { exists: true, file: null };
+  }
+  const obj = parsed;
+  const version = typeof obj.version === "number" ? obj.version : void 0;
+  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
+    warnings.push(
+      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
+    );
+  }
+  const rawServers = obj.servers;
+  if (!Array.isArray(rawServers)) {
+    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
+    return { exists: true, file: null };
+  }
+  return {
+    exists: true,
+    file: { version, servers: rawServers }
+  };
+}
+function hashContent(servers) {
+  const h = createHash("sha256");
+  h.update(JSON.stringify(servers));
+  return `local-${h.digest("hex").slice(0, 16)}`;
+}
+async function loadLocalBundles(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homedir2();
+  const warnings = [];
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
+  const globalPath = localBundlesPath(join2(home, CONFIG_DIRNAME));
+  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
+  let file;
+  let sourcePath;
+  if (projectResult.exists) {
+    file = projectResult.file;
+    sourcePath = projectPath;
+  } else {
+    const globalResult = await readBundlesAt(globalPath, warnings);
+    file = globalResult.file;
+    sourcePath = globalResult.exists ? globalPath : null;
+  }
+  if (!file) {
+    return { config: null, path: sourcePath, warnings };
+  }
+  const servers = [];
+  for (const raw of file.servers) {
+    const validated = validateEntry2(raw, warnings);
+    if (validated) servers.push(validated);
+  }
+  return {
+    config: {
+      servers,
+      configVersion: hashContent(servers)
+    },
+    path: sourcePath,
+    warnings
+  };
+}
+function deriveNamespace(name) {
+  let ns = name.toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (ns.length === 0) return "server";
+  if (!/^[a-z]/.test(ns)) ns = `s${ns}`;
+  if (ns.length > 30) ns = ns.slice(0, 30);
+  return ns;
+}
+async function readRawUserBundles(home) {
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync(path3)) {
+    return { version: CURRENT_BUNDLES_SCHEMA_VERSION, servers: [] };
+  }
+  const warnings = [];
+  const r = await readBundlesAt(path3, warnings);
+  if (!r.file) {
+    const detail = warnings.length > 0 ? ` (${warnings.join("; ")})` : "";
+    throw new Error(`${path3} is malformed${detail}; fix it by hand before adding servers.`);
+  }
+  return { version: r.file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION, servers: r.file.servers };
+}
+async function upsertUserBundle(entry, opts = {}) {
+  const home = opts.home ?? homedir2();
+  const path3 = localBundlesPath(userConfigDir(home));
+  const file = await readRawUserBundles(home);
+  const idx = file.servers.findIndex(
+    (s) => s?.namespace === entry.namespace || entry.name != null && s?.name === entry.name
+  );
+  const replaced = idx >= 0;
+  if (replaced) file.servers[idx] = entry;
+  else file.servers.push(entry);
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, replaced };
+}
+async function removeUserBundle(namespace, opts = {}) {
+  const home = opts.home ?? homedir2();
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync(path3)) return { path: path3, removed: false };
+  const file = await readRawUserBundles(home);
+  const before = file.servers.length;
+  file.servers = file.servers.filter((s) => s?.namespace !== namespace);
+  if (file.servers.length === before) return { path: path3, removed: false };
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, removed: true };
+}
+async function findShadowingProjectBundles(cwd, home = homedir2()) {
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  if (!projectDir) return null;
+  const projectPath = localBundlesPath(projectDir);
+  return existsSync(projectPath) ? projectPath : null;
+}
+
+// src/audit-cmd.ts
+var AUDIT_USAGE = `Usage: yaw-mcp audit <namespace> [--json]
+
+  Run the MCP compliance suite against a server configured in your local
+  bundles.json and cache its A-F grade in ~/.yaw-mcp/grades.json. The cached
+  grade then shows up in \`yaw-mcp servers\` and the Yaw Terminal MCP panel.
+
+  <namespace>   The namespace of a stdio server in bundles.json (see
+                \`yaw-mcp list\`).
+  --json        Emit machine-readable JSON instead of text.
+
+  To grade an arbitrary target (a URL, or a command not in bundles.json),
+  use \`yaw-mcp compliance <target>\` instead.`;
+function parseAuditArgs(argv) {
+  let json = false;
+  let namespace;
+  for (const a of argv) {
+    if (a === "--json") {
+      json = true;
+    } else if (a === "--help" || a === "-h") {
+      return { ok: false, error: AUDIT_USAGE };
+    } else if (a.startsWith("-")) {
+      return { ok: false, error: `yaw-mcp audit: unknown argument "${a}"
+
+${AUDIT_USAGE}` };
+    } else if (namespace === void 0) {
+      namespace = a;
+    } else {
+      return { ok: false, error: `yaw-mcp audit: unexpected extra argument "${a}"
+
+${AUDIT_USAGE}` };
+    }
+  }
+  if (namespace === void 0) {
+    return { ok: false, error: `yaw-mcp audit: missing <namespace>.
+
+${AUDIT_USAGE}` };
+  }
+  return { ok: true, options: { namespace, json } };
+}
+function findServer(servers, namespace) {
+  return servers.find((s) => s.namespace === namespace);
+}
+async function defaultRunner(target) {
+  const { runComplianceSuite } = await import("@yawlabs/mcp-compliance");
+  const report = await runComplianceSuite({
+    type: "stdio",
+    command: target.command,
+    args: target.args,
+    env: target.env
+  });
+  return { grade: report.grade, score: report.score };
+}
+async function runAudit(opts = {}) {
+  const write = opts.out ?? ((s) => process.stdout.write(s));
+  const writeErr = opts.err ?? ((s) => process.stderr.write(s));
+  const lines = [];
+  const print = (s = "") => {
+    lines.push(s);
+    write(`${s}
+`);
+  };
+  const printErr = (s) => {
+    lines.push(s);
+    writeErr(`${s}
+`);
+  };
+  const namespace = opts.namespace;
+  if (!namespace) {
+    printErr("yaw-mcp audit: missing <namespace>.");
+    return { exitCode: 1, lines };
+  }
+  const home = opts.home ?? homedir3();
+  const { config, path: path3 } = await loadLocalBundles({ cwd: opts.cwd, home });
+  const servers = config?.servers ?? [];
+  const server = findServer(servers, namespace);
+  if (!server) {
+    const where = path3 ? ` (${path3})` : "";
+    printErr(
+      `yaw-mcp audit: no server named "${namespace}" in bundles.json${where}. Run \`yaw-mcp list\` to see configured servers.`
+    );
+    return { exitCode: 1, lines };
+  }
+  if (!server.command) {
+    if (server.url) {
+      printErr(
+        `yaw-mcp audit: "${namespace}" is a remote server (${server.url}). Audit grades stdio servers; run \`yaw-mcp compliance ${server.url}\` to grade a remote target.`
+      );
+    } else {
+      printErr(`yaw-mcp audit: "${namespace}" has no command to spawn -- it can't be audited as a stdio server.`);
+    }
+    return { exitCode: 2, lines };
+  }
+  const target = {
+    command: server.command,
+    args: server.args ?? [],
+    env: server.env
+  };
+  if (!opts.json) {
+    print(`Auditing "${namespace}" (${target.command}${target.args.length ? ` ${target.args.join(" ")}` : ""})...`);
+  }
+  const runner = opts.runner ?? defaultRunner;
+  let report;
+  try {
+    report = await runner(target);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log("error", "audit: compliance suite failed", { namespace, error: msg });
+    printErr(`yaw-mcp audit: compliance suite failed for "${namespace}": ${msg}`);
+    return { exitCode: 2, lines };
+  }
+  const gradedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const cachePath = await writeGrade(namespace, { grade: report.grade, score: report.score, gradedAt }, home);
+  if (opts.json) {
+    print(JSON.stringify({ namespace, grade: report.grade, score: report.score, gradedAt, cache: cachePath }, null, 2));
+    return { exitCode: 0, lines };
+  }
+  print(`Grade: ${report.grade} (${report.score.toFixed(1)}%)`);
+  print(`Cached to ${cachePath}`);
+  return { exitCode: 0, lines };
+}
 
 // src/bundles.ts
 var CURATED_BUNDLES = [
@@ -93,65 +508,13 @@ function topPartialBundles(installedNamespaces, limit) {
 }
 
 // src/config-loader.ts
-import { readFile, stat as stat2 } from "fs/promises";
-import { homedir } from "os";
-import { join as join2, resolve } from "path";
-
-// src/jsonc.ts
-function stripJsoncComments(src) {
-  let out = "";
-  let i = 0;
-  const len = src.length;
-  let inString = false;
-  let stringChar = "";
-  while (i < len) {
-    const c = src[i];
-    if (inString) {
-      out += c;
-      if (c === "\\" && i + 1 < len) {
-        out += src[i + 1];
-        i += 2;
-        continue;
-      }
-      if (c === stringChar) inString = false;
-      i++;
-      continue;
-    }
-    if (c === '"' || c === "'") {
-      inString = true;
-      stringChar = c;
-      out += c;
-      i++;
-      continue;
-    }
-    const next = src[i + 1];
-    if (c === "/" && next === "/") {
-      while (i < len && src[i] !== "\n") i++;
-      continue;
-    }
-    if (c === "/" && next === "*") {
-      i += 2;
-      while (i < len && !(src[i] === "*" && src[i + 1] === "/")) {
-        if (src[i] === "\n") out += "\n";
-        i++;
-      }
-      i += 2;
-      continue;
-    }
-    out += c;
-    i++;
-  }
-  return out;
-}
-function parseJsonc(src) {
-  const debommed = src.charCodeAt(0) === 65279 ? src.slice(1) : src;
-  const stripped = stripJsoncComments(debommed);
-  return JSON.parse(stripped);
-}
+import { readFile as readFile3, stat as stat2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join4, resolve } from "path";
 
 // src/migrate.ts
 import { mkdir, rename, stat } from "fs/promises";
-import { dirname, join } from "path";
+import { dirname, join as join3 } from "path";
 var LEGACY_GLOBAL_FILENAME = ".yaw-mcp.json";
 var LEGACY_PROJECT_FILENAME = ".yaw-mcp.json";
 var LEGACY_LOCAL_FILENAME = ".yaw-mcp.local.json";
@@ -195,17 +558,17 @@ async function migrateFile(legacy, target, scope) {
 }
 async function migrateLegacyConfigPaths(opts) {
   const { cwd, home } = opts;
-  const legacyGlobal = join(home, LEGACY_GLOBAL_FILENAME);
-  const newGlobal = join(userConfigDir(home), NEW_CONFIG_FILENAME);
+  const legacyGlobal = join3(home, LEGACY_GLOBAL_FILENAME);
+  const newGlobal = join3(userConfigDir(home), NEW_CONFIG_FILENAME);
   await migrateFile(legacyGlobal, newGlobal, "global");
   const legacyProjectRoot = await findLegacyProjectRoot(cwd, home);
   if (legacyProjectRoot) {
-    const newDir = join(legacyProjectRoot, CONFIG_DIRNAME);
-    const legacyLocal = join(legacyProjectRoot, LEGACY_LOCAL_FILENAME);
-    const newLocal = join(newDir, NEW_LOCAL_FILENAME);
+    const newDir = join3(legacyProjectRoot, CONFIG_DIRNAME);
+    const legacyLocal = join3(legacyProjectRoot, LEGACY_LOCAL_FILENAME);
+    const newLocal = join3(newDir, NEW_LOCAL_FILENAME);
     await migrateFile(legacyLocal, newLocal, "local");
-    const legacyProject = join(legacyProjectRoot, LEGACY_PROJECT_FILENAME);
-    const newProject = join(newDir, NEW_CONFIG_FILENAME);
+    const legacyProject = join3(legacyProjectRoot, LEGACY_PROJECT_FILENAME);
+    const newProject = join3(newDir, NEW_CONFIG_FILENAME);
     await migrateFile(legacyProject, newProject, "project");
   }
 }
@@ -216,8 +579,8 @@ async function findLegacyProjectRoot(cwd, home) {
   let prev = "";
   while (dir !== prev) {
     if (dir === homeResolved) return null;
-    const legacyProject = join(dir, LEGACY_PROJECT_FILENAME);
-    const legacyLocal = join(dir, LEGACY_LOCAL_FILENAME);
+    const legacyProject = join3(dir, LEGACY_PROJECT_FILENAME);
+    const legacyLocal = join3(dir, LEGACY_LOCAL_FILENAME);
     if (await exists(legacyProject) || await exists(legacyLocal)) return dir;
     prev = dir;
     dir = dirname5(dir);
@@ -233,7 +596,7 @@ var DEFAULT_API_BASE = "https://yaw.sh/mcp";
 async function readConfigAt(path3, scope, warnings) {
   let raw;
   try {
-    raw = await readFile(path3, "utf8");
+    raw = await readFile3(path3, "utf8");
   } catch {
     return null;
   }
@@ -304,7 +667,7 @@ function unionBlocked(files) {
 }
 async function loadYawMcpConfig(opts = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
-  const home = resolve(opts.home ?? homedir());
+  const home = resolve(opts.home ?? homedir4());
   const env = opts.env ?? process.env;
   const warnings = [];
   const loadedFiles = [];
@@ -316,9 +679,9 @@ async function loadYawMcpConfig(opts = {}) {
     return null;
   });
   const globalDir = userConfigDir(home);
-  const localPath = projectConfigDir ? join2(projectConfigDir, LOCAL_CONFIG_FILENAME) : null;
-  const projectPath = projectConfigDir ? join2(projectConfigDir, CONFIG_FILENAME) : null;
-  const globalPath = join2(globalDir, CONFIG_FILENAME);
+  const localPath = projectConfigDir ? join4(projectConfigDir, LOCAL_CONFIG_FILENAME) : null;
+  const projectPath = projectConfigDir ? join4(projectConfigDir, CONFIG_FILENAME) : null;
+  const globalPath = join4(globalDir, CONFIG_FILENAME);
   const local = localPath ? await readConfigAt(localPath, "local", warnings) : null;
   if (local) loadedFiles.push(local);
   const projectIsGlobal = projectConfigDir !== null && projectConfigDir === globalDir;
@@ -995,10 +1358,10 @@ Publish failed: ${err?.message ?? String(err)}
 }
 
 // src/doctor-cmd.ts
-import { existsSync as existsSync3, readFileSync, statSync } from "fs";
-import { readFile as readFile5 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync4, readFileSync, statSync } from "fs";
+import { readFile as readFile7 } from "fs/promises";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 
 // src/analytics.ts
 import { request as request3 } from "undici";
@@ -1305,8 +1668,8 @@ function formatShadowLine(server) {
 }
 
 // src/install-targets.ts
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 var CURRENT_OS = process.platform === "darwin" ? "macos" : process.platform === "win32" ? "windows" : "linux";
 var INSTALL_TARGETS = [
   {
@@ -1387,8 +1750,8 @@ var INSTALL_TARGETS = [
   }
 ];
 function resolveInstallPath(opts) {
-  const home = opts.home ?? homedir2();
-  const appData = opts.appData ?? process.env.APPDATA ?? join3(home, "AppData", "Roaming");
+  const home = opts.home ?? homedir5();
+  const appData = opts.appData ?? process.env.APPDATA ?? join5(home, "AppData", "Roaming");
   const { clientId, scope, os, projectDir, claudeConfigDir } = opts;
   const target = INSTALL_TARGETS.find((t) => t.clientId === clientId);
   if (!target) throw new Error(`Unknown client: ${clientId}`);
@@ -1415,25 +1778,25 @@ function pathFor(client, scope, os, base) {
   if (client === "claude-code") {
     if (scope === "user") {
       if (claudeConfigDir) {
-        const absolute = join3(claudeConfigDir, ".claude.json");
+        const absolute = join5(claudeConfigDir, ".claude.json");
         return { absolute, display: absolute, containerPath: ["mcpServers"] };
       }
       const display = os === "windows" ? "%USERPROFILE%\\.claude.json" : "~/.claude.json";
-      return { absolute: join3(home, ".claude.json"), display, containerPath: ["mcpServers"] };
+      return { absolute: join5(home, ".claude.json"), display, containerPath: ["mcpServers"] };
     }
     if (scope === "project") {
       return {
-        absolute: join3(projectDir, ".mcp.json"),
+        absolute: join5(projectDir, ".mcp.json"),
         display: joinPath("<project folder>", ".mcp.json"),
         containerPath: ["mcpServers"]
       };
     }
     if (claudeConfigDir) {
-      const absolute = join3(claudeConfigDir, ".claude.json");
+      const absolute = join5(claudeConfigDir, ".claude.json");
       return { absolute, display: absolute, containerPath: ["projects", projectDir, "mcpServers"] };
     }
     return {
-      absolute: join3(home, ".claude.json"),
+      absolute: join5(home, ".claude.json"),
       display: os === "windows" ? "%USERPROFILE%\\.claude.json" : "~/.claude.json",
       containerPath: ["projects", projectDir, "mcpServers"]
     };
@@ -1441,14 +1804,14 @@ function pathFor(client, scope, os, base) {
   if (client === "claude-desktop") {
     if (os === "macos") {
       return {
-        absolute: join3(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+        absolute: join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
         display: "~/Library/Application Support/Claude/claude_desktop_config.json",
         containerPath: ["mcpServers"]
       };
     }
     if (os === "windows") {
       return {
-        absolute: join3(appData, "Claude", "claude_desktop_config.json"),
+        absolute: join5(appData, "Claude", "claude_desktop_config.json"),
         display: "%APPDATA%\\Claude\\claude_desktop_config.json",
         containerPath: ["mcpServers"]
       };
@@ -1458,17 +1821,17 @@ function pathFor(client, scope, os, base) {
   if (client === "cursor") {
     if (scope === "user") {
       const display = os === "windows" ? "%USERPROFILE%\\.cursor\\mcp.json" : "~/.cursor/mcp.json";
-      return { absolute: join3(home, ".cursor", "mcp.json"), display, containerPath: ["mcpServers"] };
+      return { absolute: join5(home, ".cursor", "mcp.json"), display, containerPath: ["mcpServers"] };
     }
     return {
-      absolute: join3(projectDir, ".cursor", "mcp.json"),
+      absolute: join5(projectDir, ".cursor", "mcp.json"),
       display: joinPath("<project folder>", ".cursor", "mcp.json"),
       containerPath: ["mcpServers"]
     };
   }
   if (client === "vscode") {
     return {
-      absolute: join3(projectDir, ".vscode", "mcp.json"),
+      absolute: join5(projectDir, ".vscode", "mcp.json"),
       display: joinPath("<project folder>", ".vscode", "mcp.json"),
       containerPath: ["servers"]
     };
@@ -1501,14 +1864,14 @@ var CLAUDE_CODE_ALLOW_PATTERN = "mcp__mcp__*";
 function resolveClaudeCodeSettingsPath(scope, opts) {
   const { home, projectDir, claudeConfigDir } = opts;
   const cfgDir = claudeConfigDir && claudeConfigDir.length > 0 ? claudeConfigDir : null;
-  if (scope === "user") return cfgDir ? join3(cfgDir, "settings.json") : join3(home, ".claude", "settings.json");
-  if (scope === "project" && projectDir) return join3(projectDir, ".claude", "settings.json");
-  if (scope === "local" && projectDir) return join3(projectDir, ".claude", "settings.local.json");
+  if (scope === "user") return cfgDir ? join5(cfgDir, "settings.json") : join5(home, ".claude", "settings.json");
+  if (scope === "project" && projectDir) return join5(projectDir, ".claude", "settings.json");
+  if (scope === "local" && projectDir) return join5(projectDir, ".claude", "settings.local.json");
   return null;
 }
 
 // src/persistence.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import path from "path";
 var STATE_SCHEMA_VERSION = 1;
 var STATE_FILENAME = "state.json";
@@ -1520,7 +1883,7 @@ function emptyState() {
 }
 async function loadState(filePath = statePath()) {
   try {
-    const raw = await readFile2(filePath, "utf8");
+    const raw = await readFile4(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return emptyState();
     if (parsed.version !== STATE_SCHEMA_VERSION) return emptyState();
@@ -1630,11 +1993,11 @@ async function reportTools(serverId, tools) {
 }
 
 // src/try-cmd.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile4, readdir, unlink } from "fs/promises";
-import { homedir as homedir4, hostname, userInfo } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync3 } from "fs";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile6, readdir, unlink } from "fs/promises";
+import { homedir as homedir7, hostname, userInfo } from "os";
+import { join as join7, resolve as resolve3 } from "path";
 import { request as request5 } from "undici";
 
 // src/catalog.ts
@@ -1733,10 +2096,10 @@ async function resolveCatalogSlug(slug, opts = {}) {
 }
 
 // src/install-cmd.ts
-import { existsSync } from "fs";
-import { chmod, readFile as readFile3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { chmod, readFile as readFile5 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { join as join6, resolve as resolve2 } from "path";
 import { createInterface } from "readline/promises";
 var USAGE = "Usage: yaw-mcp install <claude-code|claude-desktop|cursor|vscode> [--scope user|project|local]\n                       [--token <mcp_pat_\u2026>] [--project-dir <path>] [--os macos|linux|windows]\n                       [--force | --skip] [--dry-run] [--no-yaw-mcp-config]\n       yaw-mcp install --list                       (detect clients; no writes)\n       yaw-mcp install --all  [--token <mcp_pat_\u2026>] (install into every detected client)";
 async function runInstall(opts) {
@@ -1821,10 +2184,10 @@ ${USAGE}`);
   let existing = {};
   let existingHasEntry = false;
   let legacyEntry = null;
-  if (existsSync(resolved.absolute)) {
+  if (existsSync2(resolved.absolute)) {
     let raw;
     try {
-      raw = await readFile3(resolved.absolute, "utf8");
+      raw = await readFile5(resolved.absolute, "utf8");
     } catch (e) {
       err(`yaw-mcp install: cannot read ${resolved.absolute}: ${e.message}`);
       return { written: [], wouldWrite: [], messages, exitCode: 1 };
@@ -1881,8 +2244,8 @@ ${USAGE}`);
   const clientJson = `${JSON.stringify(merged, null, 2)}
 `;
   const writeYawMcpConfig = !opts.skipYawMcpConfig && token5 !== null;
-  const home = opts.home ?? homedir3();
-  const yawMcpConfigPath = join4(home, CONFIG_DIRNAME, CONFIG_FILENAME);
+  const home = opts.home ?? homedir6();
+  const yawMcpConfigPath = join6(home, CONFIG_DIRNAME, CONFIG_FILENAME);
   const yawMcpConfigComposed = writeYawMcpConfig ? await composeYawMcpConfig(yawMcpConfigPath, token5) : { json: "" };
   if ("backupPath" in yawMcpConfigComposed && yawMcpConfigComposed.backupPath) {
     log2(
@@ -1972,9 +2335,9 @@ async function prepareClaudeCodeSettingsPatch(opts) {
   });
   if (!path3) return null;
   let existing = {};
-  if (existsSync(path3)) {
+  if (existsSync2(path3)) {
     try {
-      const raw = await readFile3(path3, "utf8");
+      const raw = await readFile5(path3, "utf8");
       if (raw.trim().length > 0) {
         const parsed = parseJsonc(raw);
         if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -2079,10 +2442,10 @@ function removeFromClientConfig(existing, containerPath, entryName) {
 async function composeYawMcpConfig(path3, token5) {
   let existing = {};
   let backupPath;
-  if (existsSync(path3)) {
+  if (existsSync2(path3)) {
     let raw = "";
     try {
-      raw = await readFile3(path3, "utf8");
+      raw = await readFile5(path3, "utf8");
     } catch {
       raw = "";
     }
@@ -2193,7 +2556,7 @@ ${USAGE}` };
   return { ok: true, options: opts };
 }
 async function runInstallList(opts, log2) {
-  const home = opts.home ?? homedir3();
+  const home = opts.home ?? homedir6();
   const cwd = opts.cwd ?? process.cwd();
   const os = opts.os ?? CURRENT_OS;
   const probes = await probeClientsAsync({ home, os, cwd, claudeConfigDir: opts.claudeConfigDir });
@@ -2440,17 +2803,17 @@ function parseDurationMs(s) {
   const factor = unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
   return n * factor;
 }
-function trialsDir(home = homedir4()) {
-  return join5(home, CONFIG_DIRNAME, TRIALS_DIRNAME);
+function trialsDir(home = homedir7()) {
+  return join7(home, CONFIG_DIRNAME, TRIALS_DIRNAME);
 }
-function trialMarkerPath(slug, home = homedir4()) {
-  return join5(trialsDir(home), `${slug}.json`);
+function trialMarkerPath(slug, home = homedir7()) {
+  return join7(trialsDir(home), `${slug}.json`);
 }
-function anonIdPath(home = homedir4()) {
-  return join5(trialsDir(home), ANON_FILENAME);
+function anonIdPath(home = homedir7()) {
+  return join7(trialsDir(home), ANON_FILENAME);
 }
 function computeAnonId() {
-  const h = createHash("sha256");
+  const h = createHash2("sha256");
   h.update(hostname());
   try {
     h.update(userInfo().username);
@@ -2458,11 +2821,11 @@ function computeAnonId() {
   }
   return h.digest("hex").slice(0, 16);
 }
-async function loadOrCreateAnonId(home = homedir4()) {
+async function loadOrCreateAnonId(home = homedir7()) {
   const path3 = anonIdPath(home);
-  if (existsSync2(path3)) {
+  if (existsSync3(path3)) {
     try {
-      const raw = (await readFile4(path3, "utf8")).trim();
+      const raw = (await readFile6(path3, "utf8")).trim();
       if (/^[0-9a-f]{16}$/.test(raw)) return raw;
     } catch {
     }
@@ -2542,7 +2905,7 @@ async function runTry(opts) {
     return { exitCode: 2, written: [] };
   }
   const env = opts.env ?? process.env;
-  const home = opts.home ?? homedir4();
+  const home = opts.home ?? homedir7();
   const cwd = opts.cwd ?? process.cwd();
   const os = opts.os ?? CURRENT_OS;
   const now = opts.now ? opts.now() : Date.now();
@@ -2609,9 +2972,9 @@ async function runTry(opts) {
     createdAt: now
   };
   let existing = {};
-  if (existsSync2(resolved.absolute)) {
+  if (existsSync3(resolved.absolute)) {
     try {
-      const raw = await readFile4(resolved.absolute, "utf8");
+      const raw = await readFile6(resolved.absolute, "utf8");
       if (raw.trim().length > 0) {
         const parsed = parseJsonc(raw);
         if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -2683,16 +3046,16 @@ async function runTryCleanup(opts) {
     return { exitCode: 2, written: [] };
   }
   const env = opts.env ?? process.env;
-  const home = opts.home ?? homedir4();
+  const home = opts.home ?? homedir7();
   const baseUrl = opts.baseUrl ?? env.YAW_MCP_BASE_URL ?? DEFAULT_BASE_URL;
   const markerPath = trialMarkerPath(slug, home);
-  if (!existsSync2(markerPath)) {
+  if (!existsSync3(markerPath)) {
     print(`yaw-mcp try-cleanup: no trial marker for "${slug}" (nothing to do).`);
     return { exitCode: 0, written: [] };
   }
   let marker;
   try {
-    const raw = await readFile4(markerPath, "utf8");
+    const raw = await readFile6(markerPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || typeof parsed.entryName !== "string") {
       throw new Error("marker is missing required fields");
@@ -2702,9 +3065,9 @@ async function runTryCleanup(opts) {
     printErr(`yaw-mcp try-cleanup: marker at ${markerPath} is unreadable (${e.message}).`);
     return { exitCode: 1, written: [] };
   }
-  if (existsSync2(marker.clientPath)) {
+  if (existsSync3(marker.clientPath)) {
     try {
-      const raw = await readFile4(marker.clientPath, "utf8");
+      const raw = await readFile6(marker.clientPath, "utf8");
       if (raw.trim().length > 0) {
         const parsed = parseJsonc(raw);
         if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -2746,11 +3109,11 @@ function formatTtl(ms) {
   return `${Math.round(clamped / 864e5)}d`;
 }
 async function scanTrials(opts = {}) {
-  const home = opts.home ?? homedir4();
+  const home = opts.home ?? homedir7();
   const now = opts.now ? opts.now() : Date.now();
   const dir = trialsDir(home);
   const result = { live: [], expired: [], malformed: [] };
-  if (!existsSync2(dir)) return result;
+  if (!existsSync3(dir)) return result;
   let entries;
   try {
     entries = await readdir(dir);
@@ -2759,9 +3122,9 @@ async function scanTrials(opts = {}) {
   }
   for (const filename of entries) {
     if (!filename.endsWith(".json")) continue;
-    const path3 = join5(dir, filename);
+    const path3 = join7(dir, filename);
     try {
-      const raw = await readFile4(path3, "utf8");
+      const raw = await readFile6(path3, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object" || typeof parsed.slug !== "string" || typeof parsed.expiresAt !== "number" || typeof parsed.clientPath !== "string" || !Array.isArray(parsed.containerPath) || typeof parsed.entryName !== "string") {
         result.malformed.push(path3);
@@ -2779,7 +3142,7 @@ async function scanTrials(opts = {}) {
   return result;
 }
 async function gcExpiredTrials(opts) {
-  const home = opts.home ?? homedir4();
+  const home = opts.home ?? homedir7();
   const env = opts.env ?? process.env;
   const baseUrl = opts.baseUrl ?? env.YAW_MCP_BASE_URL ?? DEFAULT_BASE_URL;
   const postEvent = opts.postEvent ?? defaultPostEvent;
@@ -2790,8 +3153,8 @@ async function gcExpiredTrials(opts) {
   let failed = 0;
   for (const { marker } of scan.expired) {
     try {
-      if (existsSync2(marker.clientPath)) {
-        const raw = await readFile4(marker.clientPath, "utf8");
+      if (existsSync3(marker.clientPath)) {
+        const raw = await readFile6(marker.clientPath, "utf8");
         if (raw.trim().length > 0) {
           const parsed = parseJsonc(raw);
           if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -2820,6 +3183,8 @@ async function gcExpiredTrials(opts) {
 
 // src/upgrade-cmd.ts
 import { spawn as spawn2 } from "child_process";
+import { realpathSync } from "fs";
+var BINARY_DOWNLOAD_URL = "https://github.com/YawLabs/mcp/releases/latest";
 var UPGRADE_USAGE = `Usage: yaw-mcp upgrade [--run] [--json]
 
   Show (or execute) the command to upgrade @yawlabs/mcp to the latest version.
@@ -2860,6 +3225,52 @@ function localInstallRoot(argvPath) {
   const idx = argvPath.replace(/\\/g, "/").indexOf("/node_modules/");
   return idx > 0 ? argvPath.slice(0, idx) : null;
 }
+async function defaultNpmPrefix() {
+  if (process.env.VITEST) return null;
+  return new Promise((resolve5) => {
+    const child = spawn2("npm", ["prefix", "-g"], {
+      shell: process.platform === "win32",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let out = "";
+    const timer = setTimeout(() => {
+      child.kill();
+      resolve5(null);
+    }, 3e3);
+    child.stdout?.on("data", (d) => {
+      out += String(d);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve5(code === 0 && out.trim() ? out.trim() : null);
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      resolve5(null);
+    });
+  });
+}
+function comparablePath(p) {
+  let real = p;
+  try {
+    real = realpathSync(p);
+  } catch {
+  }
+  const normalized = real.replace(/\\/g, "/");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+async function refineInstallMethod(method, argvPath, npmPrefix = defaultNpmPrefix) {
+  if (method !== "local-node-modules" && method !== "unknown") return method;
+  if (!argvPath) return method;
+  const prefix = await npmPrefix();
+  if (!prefix) return method;
+  const entry = comparablePath(argvPath);
+  const pfx = comparablePath(prefix);
+  if (entry.startsWith(`${pfx}/node_modules/`) || entry.startsWith(`${pfx}/lib/node_modules/`)) {
+    return "global-npm";
+  }
+  return method;
+}
 function buildUpgradePlan(input) {
   const { current, latest, method } = input;
   const stale = latest !== null && current !== "dev" && compareSemverLocal(current, latest) < 0;
@@ -2886,6 +3297,9 @@ function buildUpgradePlan(input) {
     case "dev-checkout":
       command = "git pull && npm run build";
       break;
+    case "binary":
+      command = null;
+      break;
     default:
       command = "npm install -g @yawlabs/mcp@latest";
       break;
@@ -2931,6 +3345,17 @@ async function defaultSpawn(cmd, args, cwd) {
     child.on("error", () => resolve5(1));
   });
 }
+async function detectSea() {
+  if (process.env.ELECTRON_RUN_AS_NODE) return false;
+  const exe = process.execPath.replace(/\\/g, "/").split("/").pop()?.toLowerCase() ?? "";
+  if (exe === "node" || exe === "node.exe") return false;
+  try {
+    const sea = await import("sea");
+    return typeof sea.isSea === "function" && sea.isSea() === true;
+  } catch {
+    return false;
+  }
+}
 async function runUpgrade(opts = {}) {
   const write = opts.out ?? ((s) => process.stdout.write(s));
   const writeErr = opts.err ?? ((s) => process.stderr.write(s));
@@ -2948,7 +3373,8 @@ async function runUpgrade(opts = {}) {
   const fetcher = opts.fetchLatest ?? defaultFetchLatest;
   const current = opts.currentVersion ?? readCurrentVersion();
   const argvPath = opts.argvPath ?? process.argv[1];
-  const method = detectInstallMethod(argvPath);
+  const sea = opts.isSea ? opts.isSea() : await detectSea();
+  const method = sea ? "binary" : await refineInstallMethod(detectInstallMethod(argvPath), argvPath, opts.npmPrefix);
   let latest;
   try {
     latest = await fetcher();
@@ -2968,6 +3394,9 @@ async function runUpgrade(opts = {}) {
       print(`  ${plan.command}`);
     } else if (method === "bundled-app") {
       print("This copy of yaw-mcp ships inside Yaw Terminal and updates with the app \u2014 nothing to run.");
+    } else if (method === "binary") {
+      print("yaw-mcp is a standalone binary \u2014 download the latest build and replace");
+      print(`this executable: ${BINARY_DOWNLOAD_URL}`);
     } else {
       print("Your install uses `npx -y` \u2014 just restart the MCP client when you're back online.");
     }
@@ -2991,6 +3420,13 @@ async function runUpgrade(opts = {}) {
     print("there is nothing to run here. Update Yaw Terminal to get the new version.");
     return { exitCode: 0, lines };
   }
+  if (method === "binary") {
+    print("yaw-mcp is running as a standalone binary \u2014 there's no package manager");
+    print("to upgrade it. Download the latest build and replace this executable:");
+    print("");
+    print(`  ${BINARY_DOWNLOAD_URL}`);
+    return { exitCode: opts.run ? 2 : 1, lines };
+  }
   if (!plan.command) {
     print("No upgrade command available for this install method.");
     return { exitCode: 0, lines };
@@ -3033,7 +3469,7 @@ async function runUpgrade(opts = {}) {
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.60.2" : "dev";
+  return true ? "0.60.6" : "dev";
 }
 
 // src/usage-hints.ts
@@ -3095,7 +3531,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.60.2" : "dev";
+var VERSION = true ? "0.60.6" : "dev";
 async function runDoctor(opts = {}) {
   if (opts.json) return runDoctorJson(opts);
   const lines = [];
@@ -3106,7 +3542,7 @@ async function runDoctor(opts = {}) {
 `);
   };
   const cwd = opts.cwd ?? process.cwd();
-  const home = opts.home ?? homedir5();
+  const home = opts.home ?? homedir8();
   const os = opts.os ?? CURRENT_OS;
   const env = opts.env ?? process.env;
   print(`yaw-mcp doctor \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`);
@@ -3167,7 +3603,7 @@ async function runDoctor(opts = {}) {
   const latest = skipCheck ? null : await fetchLatestVersion(opts.registryFetch);
   const staleHint = latest && VERSION !== "dev" && compareSemver(VERSION, latest) < 0 ? latest : null;
   if (staleHint) {
-    const method = detectInstallMethod(process.argv[1]);
+    const method = await detectSea() ? "binary" : await refineInstallMethod(detectInstallMethod(process.argv[1]), process.argv[1]);
     print("UPGRADE AVAILABLE");
     if (method === "bundled-app") {
       print(`  Running ${VERSION}; npm latest is ${staleHint}. This copy ships inside`);
@@ -3175,6 +3611,10 @@ async function runDoctor(opts = {}) {
     } else if (method === "npx") {
       print(`  Running ${VERSION}; npm latest is ${staleHint}. npx fetches the latest`);
       print("  on each spawn \u2014 restart your MCP client to pick it up.");
+    } else if (method === "binary") {
+      print(`  Running ${VERSION}; npm latest is ${staleHint}. This is a standalone`);
+      print("  binary \u2014 download the latest build and replace the executable:");
+      print(`    ${BINARY_DOWNLOAD_URL}`);
     } else if (method === "global-npm" || method === "pnpm-global" || method === "bun-global" || method === "local-node-modules") {
       print(`  Running ${VERSION}; npm latest is ${staleHint}. To upgrade in place:`);
       print("");
@@ -3208,7 +3648,7 @@ async function runDoctorJson(opts) {
   const lines = [];
   const write = opts.out ?? ((s) => process.stdout.write(s));
   const cwd = opts.cwd ?? process.cwd();
-  const home = opts.home ?? homedir5();
+  const home = opts.home ?? homedir8();
   const os = opts.os ?? CURRENT_OS;
   const env = opts.env ?? process.env;
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -3231,7 +3671,7 @@ async function runDoctorJson(opts) {
   const persistRaw = env.YAW_MCP_DISABLE_PERSISTENCE;
   const persistDisabled = persistRaw !== void 0 && persistRaw !== "" && (persistRaw === "1" || persistRaw.toLowerCase() === "true");
   const state = persistDisabled ? { disabled: true, path: null, savedAt: null, learningEntries: null, packHistoryEntries: null } : await (async () => {
-    const filePath = join6(userConfigDir(home), STATE_FILENAME);
+    const filePath = join8(userConfigDir(home), STATE_FILENAME);
     const persisted = await loadState(filePath);
     const fresh = persisted.savedAt === 0;
     return {
@@ -3244,7 +3684,7 @@ async function runDoctorJson(opts) {
   })();
   const reliability = [];
   if (!persistDisabled) {
-    const filePath = join6(userConfigDir(home), STATE_FILENAME);
+    const filePath = join8(userConfigDir(home), STATE_FILENAME);
     const persisted = await loadState(filePath);
     if (persisted.savedAt !== 0) {
       const entries = Object.entries(persisted.learning).map(([namespace, usage]) => ({ namespace, usage }));
@@ -3329,7 +3769,7 @@ async function renderStateSection(opts) {
     print("");
     return;
   }
-  const filePath = join6(userConfigDir(home), STATE_FILENAME);
+  const filePath = join8(userConfigDir(home), STATE_FILENAME);
   print(`  path:   ${filePath}`);
   const peek = await peekStateFile(filePath);
   if (peek.kind === "malformed") {
@@ -3363,7 +3803,7 @@ async function renderStateSection(opts) {
 async function peekStateFile(filePath) {
   let raw;
   try {
-    raw = await readFile5(filePath, "utf8");
+    raw = await readFile7(filePath, "utf8");
   } catch (err) {
     if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
       return { kind: "missing" };
@@ -3388,7 +3828,7 @@ async function renderReliabilitySection(opts) {
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   const disabled = raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
   if (disabled) return;
-  const filePath = join6(userConfigDir(home), STATE_FILENAME);
+  const filePath = join8(userConfigDir(home), STATE_FILENAME);
   const persisted = await loadState(filePath);
   if (persisted.savedAt === 0) return;
   const entries = Object.entries(persisted.learning).map(([namespace, usage]) => ({ namespace, usage }));
@@ -3494,7 +3934,7 @@ function probeClients(opts) {
       } catch {
         continue;
       }
-      const exists3 = existsSync3(resolved.absolute);
+      const exists3 = existsSync4(resolved.absolute);
       let hasMcpEntry = false;
       let hasLegacyEntry = false;
       let legacyEntryName = null;
@@ -3571,14 +4011,14 @@ async function probeClientsAsync(opts) {
         projectDir: scope.requiresProjectDir ? opts.cwd : void 0,
         claudeConfigDir: opts.claudeConfigDir
       });
-      const exists3 = existsSync3(resolved.absolute);
+      const exists3 = existsSync4(resolved.absolute);
       let hasMcpEntry = false;
       let hasLegacyEntry = false;
       let legacyEntryName = null;
       let malformed = false;
       if (exists3) {
         try {
-          const raw = await readFile5(resolved.absolute, "utf8");
+          const raw = await readFile7(resolved.absolute, "utf8");
           if (raw.trim().length > 0) {
             const parsed = parseJsonc(raw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -3660,9 +4100,9 @@ function scanShellHistoryForShadows(opts) {
 }
 function shellHistorySources(opts) {
   const sources = [];
-  sources.push({ path: join6(opts.home, ".bash_history"), extractCommand: (l) => l.trim() || null });
+  sources.push({ path: join8(opts.home, ".bash_history"), extractCommand: (l) => l.trim() || null });
   sources.push({
-    path: join6(opts.home, ".zsh_history"),
+    path: join8(opts.home, ".zsh_history"),
     // Zsh extended-history lines look like `: 1700000000:0;npm audit`.
     // Strip the metadata prefix so we get just the command.
     extractCommand: (l) => {
@@ -3678,7 +4118,7 @@ function shellHistorySources(opts) {
   const appData = opts.env.APPDATA;
   if (appData) {
     sources.push({
-      path: join6(appData, "Microsoft", "Windows", "PowerShell", "PSReadLine", "ConsoleHost_history.txt"),
+      path: join8(appData, "Microsoft", "Windows", "PowerShell", "PSReadLine", "ConsoleHost_history.txt"),
       extractCommand: (l) => l.trim() || null
     });
   }
@@ -3786,190 +4226,7 @@ function closestNames(query, candidates, limit) {
 }
 
 // src/local-add-cmd.ts
-import { homedir as homedir7 } from "os";
-
-// src/local-bundles.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync4 } from "fs";
-import { readFile as readFile6 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-var BUNDLES_FILENAME = "bundles.json";
-var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
-function localBundlesPath(configDir) {
-  return join7(configDir, BUNDLES_FILENAME);
-}
-var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
-function validateEntry(entry, warnings) {
-  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-    warnings.push("bundles.json: skipping non-object server entry");
-    return null;
-  }
-  const e = entry;
-  const namespace = typeof e.namespace === "string" ? e.namespace : "";
-  if (!namespace || !NAMESPACE_RE.test(namespace)) {
-    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
-    return null;
-  }
-  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
-  const type = e.type === "remote" ? "remote" : "local";
-  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
-  const command = typeof e.command === "string" ? e.command : void 0;
-  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
-  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
-    Object.entries(e.env).filter(([, v]) => typeof v === "string")
-  ) : void 0;
-  const url = typeof e.url === "string" ? e.url : void 0;
-  const description = typeof e.description === "string" ? e.description : void 0;
-  const isActive = e.isActive !== false;
-  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
-  return {
-    id,
-    name,
-    namespace,
-    type,
-    transport,
-    command,
-    args,
-    env,
-    url,
-    isActive,
-    description
-  };
-}
-async function readBundlesAt(path3, warnings) {
-  let raw;
-  try {
-    raw = await readFile6(path3, "utf8");
-  } catch {
-    return { exists: false, file: null };
-  }
-  let parsed;
-  try {
-    parsed = parseJsonc(raw);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
-    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
-    return { exists: true, file: null };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
-    return { exists: true, file: null };
-  }
-  const obj = parsed;
-  const version = typeof obj.version === "number" ? obj.version : void 0;
-  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
-    warnings.push(
-      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
-    );
-  }
-  const rawServers = obj.servers;
-  if (!Array.isArray(rawServers)) {
-    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
-    return { exists: true, file: null };
-  }
-  return {
-    exists: true,
-    file: { version, servers: rawServers }
-  };
-}
-function hashContent(servers) {
-  const h = createHash2("sha256");
-  h.update(JSON.stringify(servers));
-  return `local-${h.digest("hex").slice(0, 16)}`;
-}
-async function loadLocalBundles(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  const home = opts.home ?? homedir6();
-  const warnings = [];
-  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
-  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
-  const globalPath = localBundlesPath(join7(home, CONFIG_DIRNAME));
-  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
-  let file;
-  let sourcePath;
-  if (projectResult.exists) {
-    file = projectResult.file;
-    sourcePath = projectPath;
-  } else {
-    const globalResult = await readBundlesAt(globalPath, warnings);
-    file = globalResult.file;
-    sourcePath = globalResult.exists ? globalPath : null;
-  }
-  if (!file) {
-    return { config: null, path: sourcePath, warnings };
-  }
-  const servers = [];
-  for (const raw of file.servers) {
-    const validated = validateEntry(raw, warnings);
-    if (validated) servers.push(validated);
-  }
-  return {
-    config: {
-      servers,
-      configVersion: hashContent(servers)
-    },
-    path: sourcePath,
-    warnings
-  };
-}
-function deriveNamespace(name) {
-  let ns = name.toLowerCase().replace(/[^a-z0-9]+/g, "");
-  if (ns.length === 0) return "server";
-  if (!/^[a-z]/.test(ns)) ns = `s${ns}`;
-  if (ns.length > 30) ns = ns.slice(0, 30);
-  return ns;
-}
-async function readRawUserBundles(home) {
-  const path3 = localBundlesPath(userConfigDir(home));
-  if (!existsSync4(path3)) {
-    return { version: CURRENT_BUNDLES_SCHEMA_VERSION, servers: [] };
-  }
-  const warnings = [];
-  const r = await readBundlesAt(path3, warnings);
-  if (!r.file) {
-    const detail = warnings.length > 0 ? ` (${warnings.join("; ")})` : "";
-    throw new Error(`${path3} is malformed${detail}; fix it by hand before adding servers.`);
-  }
-  return { version: r.file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION, servers: r.file.servers };
-}
-async function upsertUserBundle(entry, opts = {}) {
-  const home = opts.home ?? homedir6();
-  const path3 = localBundlesPath(userConfigDir(home));
-  const file = await readRawUserBundles(home);
-  const idx = file.servers.findIndex(
-    (s) => s?.namespace === entry.namespace || entry.name != null && s?.name === entry.name
-  );
-  const replaced = idx >= 0;
-  if (replaced) file.servers[idx] = entry;
-  else file.servers.push(entry);
-  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
-  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
-`);
-  return { path: path3, replaced };
-}
-async function removeUserBundle(namespace, opts = {}) {
-  const home = opts.home ?? homedir6();
-  const path3 = localBundlesPath(userConfigDir(home));
-  if (!existsSync4(path3)) return { path: path3, removed: false };
-  const file = await readRawUserBundles(home);
-  const before = file.servers.length;
-  file.servers = file.servers.filter((s) => s?.namespace !== namespace);
-  if (file.servers.length === before) return { path: path3, removed: false };
-  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
-  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
-`);
-  return { path: path3, removed: true };
-}
-async function findShadowingProjectBundles(cwd, home = homedir6()) {
-  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
-  if (!projectDir) return null;
-  const projectPath = localBundlesPath(projectDir);
-  return existsSync4(projectPath) ? projectPath : null;
-}
-
-// src/local-add-cmd.ts
+import { homedir as homedir9 } from "os";
 var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 var ADD_USAGE = `Usage: yaw-mcp add <slug> [flags]
 
@@ -4052,7 +4309,7 @@ async function runAdd(opts) {
     return { exitCode: 2, written: [] };
   }
   const env = opts.env ?? process.env;
-  const home = opts.home ?? homedir7();
+  const home = opts.home ?? homedir9();
   const cwd = opts.cwd ?? process.cwd();
   let server;
   try {
@@ -4158,7 +4415,7 @@ async function runRemove(opts) {
     printErr(`yaw-mcp remove: "${opts.target}" isn't a valid slug or namespace.`);
     return { exitCode: 2, written: [] };
   }
-  const home = opts.home ?? homedir7();
+  const home = opts.home ?? homedir9();
   const cwd = opts.cwd ?? process.cwd();
   const derived = deriveNamespace(opts.target);
   const candidates = derived === opts.target ? [opts.target] : [opts.target, derived];
@@ -4216,7 +4473,7 @@ async function runList(opts) {
   const out = opts.out ?? ((s) => process.stdout.write(s));
   const print = (s = "") => out(`${s}
 `);
-  const home = opts.home ?? homedir7();
+  const home = opts.home ?? homedir9();
   const cwd = opts.cwd ?? process.cwd();
   const loaded = await loadLocalBundles({ home, cwd });
   const servers = loaded.config?.servers ?? [];
@@ -4364,8 +4621,8 @@ async function runLogout(opts = {}, io = {
 
 // src/reset-learning-cmd.ts
 import { unlink as unlink2 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join9 } from "path";
 var RESET_LEARNING_USAGE = `Usage: yaw-mcp reset-learning
 
   Delete ~/.yaw-mcp/state.json so cross-session learning starts fresh.
@@ -4387,7 +4644,7 @@ ${RESET_LEARNING_USAGE}`
   return { kind: "ok", options: {} };
 }
 async function runResetLearning(opts = {}) {
-  const home = opts.home ?? homedir8();
+  const home = opts.home ?? homedir10();
   const env = opts.env ?? process.env;
   const write = opts.out ?? ((s) => process.stdout.write(s));
   const writeErr = opts.err ?? ((s) => process.stderr.write(s));
@@ -4402,7 +4659,7 @@ async function runResetLearning(opts = {}) {
     writeErr(`${s}
 `);
   };
-  const filePath = join8(userConfigDir(home), STATE_FILENAME);
+  const filePath = join9(userConfigDir(home), STATE_FILENAME);
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   const disabled = raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
   if (disabled) {
@@ -4437,14 +4694,14 @@ function isFileNotFound2(err) {
 // src/secrets-cmd.ts
 import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir12 } from "os";
 import { dirname as dirname3 } from "path";
 
 // src/secrets-vault.ts
 import { existsSync as existsSync5 } from "fs";
-import { chmod as chmod3, readFile as readFile7 } from "fs/promises";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname2, join as join9 } from "path";
+import { chmod as chmod3, readFile as readFile8 } from "fs/promises";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname2, join as join10 } from "path";
 
 // src/secrets-crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCb } from "crypto";
@@ -4502,8 +4759,8 @@ function decryptEntry(entry, key) {
 // src/secrets-vault.ts
 var SECRETS_FILENAME = "secrets.json";
 var SECRETS_SCHEMA_VERSION = 1;
-function vaultPath(home = homedir9()) {
-  return join9(home, CONFIG_DIRNAME, SECRETS_FILENAME);
+function vaultPath(home = homedir11()) {
+  return join10(home, CONFIG_DIRNAME, SECRETS_FILENAME);
 }
 function emptyVault() {
   return {
@@ -4516,7 +4773,7 @@ async function loadVault(path3) {
   if (!existsSync5(path3)) return null;
   let raw;
   try {
-    raw = await readFile7(path3, "utf8");
+    raw = await readFile8(path3, "utf8");
   } catch (err) {
     log("warn", "Failed to read vault", { path: path3, error: err instanceof Error ? err.message : String(err) });
     return null;
@@ -4776,7 +5033,7 @@ async function runSecrets(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir12();
   const path3 = vaultPath(home);
   if (opts.action === "lock") {
     lock();
@@ -4904,7 +5161,7 @@ async function runSecrets(opts, io = {
 }
 var MCP_SECRETS_RESOURCE = "mcp_secrets";
 async function runSecretsPush(opts, io) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir12();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -4967,7 +5224,7 @@ async function runSecretsPush(opts, io) {
   }
 }
 async function runSecretsPull(opts, io) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir12();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -5022,8 +5279,8 @@ async function runSecretsPull(opts, io) {
 }
 
 // src/server.ts
-import { readFile as readFile9 } from "fs/promises";
-import { homedir as homedir11 } from "os";
+import { readFile as readFile10 } from "fs/promises";
+import { homedir as homedir13 } from "os";
 import { isAbsolute, relative, resolve as resolve4 } from "path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -5083,22 +5340,31 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.60.2" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.60.6" : "dev");
   if (current === "dev") return;
-  const method = detectInstallMethod(deps.argvPath ?? process.argv[1]);
+  const method = (deps.isSeaImpl ? await deps.isSeaImpl() : await detectSea()) ? "binary" : detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
   if (latest === null) return;
   const plan = buildUpgradePlan({ current, latest, method });
   if (!plan.stale) return;
-  if (method === "global-npm") {
-    log("info", "yaw-mcp is out of date; upgrading the global install in the background", { current, latest });
-    (deps.spawnImpl ?? defaultSpawn2)("npm", ["install", "-g", "@yawlabs/mcp@latest"]);
+  const globalSpec = method === "global-npm" ? { cmd: "npm", args: ["install", "-g", "@yawlabs/mcp@latest"] } : method === "pnpm-global" ? { cmd: "pnpm", args: ["add", "-g", "@yawlabs/mcp@latest"] } : method === "bun-global" ? { cmd: "bun", args: ["add", "-g", "@yawlabs/mcp@latest"] } : null;
+  if (globalSpec) {
+    log("info", "yaw-mcp is out of date; upgrading the global install in the background", {
+      current,
+      latest,
+      tool: globalSpec.cmd
+    });
+    (deps.spawnImpl ?? defaultSpawn2)(globalSpec.cmd, globalSpec.args);
     return;
   }
   if (method === "bundled-app") {
     log("info", "yaw-mcp (bundled with Yaw Terminal) is behind npm; it updates with the app", { current, latest });
     return;
   }
+  if (method === "binary") {
+    log("info", "yaw-mcp (standalone binary) is behind npm; download the latest build to update", { current, latest });
+    return;
+  }
   log("info", "yaw-mcp is out of date; restart your MCP client to pick up the latest version", {
     current,
     latest,
@@ -5458,13 +5724,13 @@ function stepBindingKey(step, index) {
 }
 
 // src/guide.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 var GUIDE_READ_TIMEOUT_MS = 1e3;
 async function readGuide(path3, scope) {
   let raw;
   try {
     raw = await Promise.race([
-      readFile8(path3, "utf8"),
+      readFile9(path3, "utf8"),
       new Promise(
         (_, reject) => setTimeout(() => reject(new Error("guide read timeout")), GUIDE_READ_TIMEOUT_MS)
       )
@@ -6799,12 +7065,12 @@ async function callLegacyRerank(payload) {
   }
 }
 async function readTeamCookie() {
-  const teamSync = await import("./team-sync-4JF5LBRB.js");
+  const teamSync = await import("./team-sync-5356FJP6.js");
   const session = await teamSync.getSession();
   if (!session) return null;
-  const { readFile: readFile11 } = await import("fs/promises");
+  const { readFile: readFile12 } = await import("fs/promises");
   try {
-    const raw = await readFile11(teamSync.sessionStatePath(), "utf8");
+    const raw = await readFile12(teamSync.sessionStatePath(), "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.cookie === "string" && parsed.cookie ? parsed.cookie : null;
   } catch {
@@ -7356,7 +7622,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.60.2" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.60.6" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -7665,7 +7931,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.60.2" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.60.6" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -9196,7 +9462,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
     }
     const ALLOWED_FILENAMES = ["claude_desktop_config.json", "mcp.json", "settings.json", "mcp_config.json"];
     try {
-      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir11(), filepath.slice(2)) : resolve4(filepath);
+      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir13(), filepath.slice(2)) : resolve4(filepath);
       const resolvedBasename = resolved.split(/[/\\]/).pop() || "";
       if (!ALLOWED_FILENAMES.includes(resolvedBasename)) {
         return {
@@ -9213,7 +9479,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
         const rel = relative(base, p);
         return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
       };
-      if (!isUnder(homedir11(), resolved) && !isUnder(process.cwd(), resolved)) {
+      if (!isUnder(homedir13(), resolved) && !isUnder(process.cwd(), resolved)) {
         return {
           content: [
             { type: "text", text: "Import path must be under your home directory or the current working directory." }
@@ -9221,7 +9487,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
           isError: true
         };
       }
-      const raw = await readFile9(resolved, "utf-8");
+      const raw = await readFile10(resolved, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed.mcpServers || typeof parsed.mcpServers !== "object" || Array.isArray(parsed.mcpServers)) {
         return {
@@ -9895,15 +10161,24 @@ async function runServersCommand(opts = {}) {
     ...backend,
     servers: backend.servers.filter((s) => s.namespace.toLowerCase().includes(opts.filter.toLowerCase()))
   } : backend;
+  const gradesReader = opts.gradesReader ?? readGradesCache;
+  const grades = await gradesReader(opts.home).catch(() => ({}));
+  const merged = {
+    ...filtered,
+    servers: filtered.servers.map((s) => {
+      const cached = grades[s.namespace];
+      return cached ? { ...s, complianceGrade: cached.grade } : s;
+    })
+  };
   if (opts.json) {
-    print(JSON.stringify(filtered, null, 2));
+    print(JSON.stringify(merged, null, 2));
     return { exitCode: 0, lines };
   }
   if (opts.filter && filtered.servers.length === 0) {
     print(`No servers match "${opts.filter}". Run \`yaw-mcp servers\` to see the full list.`);
     return { exitCode: 0, lines };
   }
-  renderTable(filtered, print);
+  renderTable(merged, print);
   return { exitCode: 0, lines };
 }
 function renderTable(cfg, print) {
@@ -9947,7 +10222,7 @@ function truncateVersion(v) {
 }
 
 // src/stats-cmd.ts
-import { homedir as homedir12 } from "os";
+import { homedir as homedir14 } from "os";
 var STATS_USAGE = `Usage: yaw-mcp stats [--json] [--limit N] [--days N]
 
   Print a digest of recent AI tool calls recorded against your Yaw
@@ -10062,7 +10337,7 @@ async function runStats(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir12();
+  const home = opts.home ?? homedir14();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
     const msg = "Not signed in. Yaw MCP analytics requires a Yaw Team account.\n  - Yaw Team: $15/seat/mo or $150/seat/yr -- https://yaw.sh/mcp\nSign in with: yaw-mcp login --key <license-key>";
@@ -10120,9 +10395,9 @@ async function runStats(opts, io = {
 
 // src/sync-cmd.ts
 import { existsSync as existsSync7 } from "fs";
-import { mkdir as mkdir4, readFile as readFile10 } from "fs/promises";
-import { homedir as homedir13 } from "os";
-import { dirname as dirname4, join as join10 } from "path";
+import { mkdir as mkdir4, readFile as readFile11 } from "fs/promises";
+import { homedir as homedir15 } from "os";
+import { dirname as dirname4, join as join11 } from "path";
 var SYNC_USAGE = `Usage: yaw-mcp sync <push|pull|status> [--json]
 
   Replicate ~/.yaw-mcp/bundles.json across machines via your Yaw
@@ -10165,12 +10440,12 @@ ${SYNC_USAGE}` };
   return { ok: true, options: opts };
 }
 function bundlesPath(home) {
-  return join10(home, CONFIG_DIRNAME, BUNDLES_FILENAME2);
+  return join11(home, CONFIG_DIRNAME, BUNDLES_FILENAME2);
 }
 async function readLocalBundles(home) {
   const path3 = bundlesPath(home);
   if (!existsSync7(path3)) return { version: 1, servers: [] };
-  const raw = await readFile10(path3, "utf8");
+  const raw = await readFile11(path3, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.servers)) {
     throw new Error(`${path3}: malformed -- expected { servers: [...] }`);
@@ -10207,7 +10482,7 @@ async function runSync(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir13();
+  const home = opts.home ?? homedir15();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
     const msg = "Not signed in. Run `yaw-mcp login --key <license-key>` first.";
@@ -10349,6 +10624,7 @@ function handleSyncError(err, opts, io) {
 // src/index.ts
 var KNOWN_SUBCOMMANDS = [
   "compliance",
+  "audit",
   "install",
   "add",
   "remove",
@@ -10375,6 +10651,14 @@ var KNOWN_SUBCOMMANDS = [
 var subcommand = process.argv[2];
 if (subcommand === "compliance") {
   runComplianceCommand(process.argv.slice(3)).then((code) => process.exit(code));
+} else if (subcommand === "audit") {
+  const parsed = parseAuditArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runAudit(parsed.options).then((r) => process.exit(r.exitCode));
 } else if (subcommand === "install") {
   const parsed = parseInstallArgs(process.argv.slice(3));
   if (!parsed.ok) {
@@ -10589,6 +10873,10 @@ if (subcommand === "compliance") {
     compliance <target>      Run the 88-test compliance suite against an MCP
                              server. --publish posts the report to
                              yaw.sh/mcp and prints the public URL.
+    audit <namespace>        Run the compliance suite against a stdio server
+                             from your bundles.json and cache its A-F grade in
+                             ~/.yaw-mcp/grades.json (shown in \`servers\` + the
+                             Yaw Terminal MCP panel).
     help, --help, -h         Show this help.
     --version, -V            Print yaw-mcp version.
 
@@ -10636,7 +10924,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.60.2" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.60.6" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {