@zcloak/ai-agent 1.0.23 → 1.0.25

package/dist/verify.js

@@ -17,6 +17,7 @@
 import fs from 'fs';
 import path from 'path';
 import { hashFile, verifyManifestEntries, formatSignEvent, formatSignEvents, } from './utils.js';
+import * as log from './log.js';
 // ========== Help Information ==========
 function showHelp() {
     console.log('zCloak.ai Verification Tool');
@@ -135,7 +136,7 @@ async function cmdVerifyFolder(session, folderPath) {
         }
     }
     if (!allPassed) {
-        console.error('\nLocal verification failed! Some files may have been modified.');
+        log.error('Local verification failed! Some files may have been modified.');
         process.exit(1);
     }
     console.log('\nLocal verification passed!');
@@ -194,7 +195,7 @@ export async function run(session) {
         }
     }
     catch (err) {
-        console.error(`Operation failed: ${err instanceof Error ? err.message : String(err)}`);
+        log.error(`Operation failed: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
 }

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,yCAAyC;AACzC,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAmB;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAE5C,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAExD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAE1C,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAE/D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,gDAAgD;AAEhD,6BAA6B;AAC7B,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAA2B;IAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,mCAAmC;AACnC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,QAA4B;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,wBAAwB;IACxB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4CAA4C;AAC5C,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,UAA8B;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,qBAAqB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC;YAClD,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,oCAAoC;AACpC,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,SAA6B;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAEnE,mCAAmC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,0DAA0D;AAE1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,SAAS;gBACZ,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR;gBACE,QAAQ,EAAE,CAAC;gBACX,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,yCAAyC;AACzC,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAmB;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAE5C,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAExD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAE1C,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAE/D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,gDAAgD;AAEhD,6BAA6B;AAC7B,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAA2B;IAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,mCAAmC;AACnC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,QAA4B;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,wBAAwB;IACxB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4CAA4C;AAC5C,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,UAA8B;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,qBAAqB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC;YAClD,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,oCAAoC;AACpC,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,SAA6B;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAEnE,mCAAmC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,0DAA0D;AAE1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,SAAS;gBACZ,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR;gBACE,QAAQ,EAAE,CAAC;gBACX,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/vetkey.d.ts

@@ -11,7 +11,7 @@
  *   decrypt         Decrypt Kind5 PrivatePost by event ID
  *   encrypt-only    Encrypt locally without canister sign
  *   pubkey          Get IBE public key from canister
- *   serve           Start daemon (UDS or stdio mode)
+ *   serve           Start daemon (Unix Domain Socket)
  *   stop            Stop a running daemon
  *   status          Query daemon status
  *   grant           Grant Kind5 decryption access to another user
@@ -31,24 +31,27 @@ import type { Session } from './session.js';
  * @param session - CLI session with parsed args and canister access
  */
 export declare function run(session: Session): Promise<void>;
+/** Key names for the two standard daemons that should always be kept alive */
+export declare const STANDARD_DAEMON_KEY_NAMES: readonly ["default", "Mail"];
 /**
- * Background daemon health check — fire-and-forget.
+ * Stop ALL running daemons by scanning the runtime directory for .sock files.
  *
- * Called by cli.ts after Session creation to keep both standard daemons
- * ("default" and "Mail") alive. If a daemon is dead, spawns it in the
- * background WITHOUT waiting for it to be ready (non-blocking).
- *
- * Prerequisites:
- *   - The PEM file must exist (user has already created an identity)
- *   - If PEM doesn't exist, silently skips (no identity = no daemon possible)
+ * This covers all daemons regardless of principal or key name (standard,
+ * custom, or any --identity), ensuring no stale daemon survives a CLI upgrade.
+ * Errors are silently ignored (best-effort shutdown).
+ */
+export declare function stopAllDaemons(): Promise<void>;
+/**
+ * Spawn a daemon process in the background for the given key name.
  *
- * All errors are silently swallowed — this is a best-effort health check
- * and must never block or fail the main command.
+ * The child process is fully detached (survives parent exit) with stderr
+ * redirected to a log file under ~/.config/zcloak/run/.
  *
- * @param pemPath   - Path to the identity PEM file
- * @param principal - The principal ID derived from the PEM
+ * @param pemPath - Path to the identity PEM file
+ * @param keyName - Daemon key name (e.g. "default", "Mail")
+ * @returns The child process PID (or undefined if spawn failed)
  */
-export declare function ensureDaemonsBackground(pemPath: string, principal: string): void;
+export declare function startDaemonBackground(pemPath: string, keyName: string): number | undefined;
 /** Tag entry in a Kind17 envelope: ["to", principal], ["payload_type", "text"], etc. */
 export type EnvelopeTag = [string, ...string[]];
 /**
@@ -70,7 +73,7 @@ export interface Kind17Envelope {
     created_at: number;
     /** Tags carrying recipient and optional metadata */
     tags: EnvelopeTag[];
-    /** Encrypted content: base64 IBE ciphertext (string for single recipient) */
+    /** Encrypted content: JSON string per zmail-skill spec {"v":1,"type":"text"|"file","ct":"<base64>"} */
     content: string;
     /** BIP-340 Schnorr signature over the envelope ID */
     sig: string;

package/dist/vetkey.js

@@ -11,7 +11,7 @@
  *   decrypt         Decrypt Kind5 PrivatePost by event ID
  *   encrypt-only    Encrypt locally without canister sign
  *   pubkey          Get IBE public key from canister
- *   serve           Start daemon (UDS or stdio mode)
+ *   serve           Start daemon (Unix Domain Socket)
  *   stop            Stop a running daemon
  *   status          Query daemon status
  *   grant           Grant Kind5 decryption access to another user
@@ -23,11 +23,11 @@
  *
  * Usage: zcloak-ai vetkey <sub-command> [options]
  */
-import { readFileSync, statSync, writeFileSync, existsSync, mkdirSync, openSync, closeSync } from 'fs';
+import { readFileSync, readdirSync, statSync, writeFileSync, existsSync, mkdirSync, openSync, closeSync, unlinkSync } from 'fs';
 import { basename, dirname } from 'path';
 import { createConnection } from 'net';
 import { spawn } from 'child_process';
-import { homedir } from 'os';
+import { daemonLogPath } from './paths.js';
 import { join } from 'path';
 import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
@@ -37,12 +37,13 @@ import { schnorr } from '@noble/curves/secp256k1';
 import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
 import * as cryptoOps from './crypto.js';
 import { KeyStore } from './key-store.js';
-import { runDaemonUds, runDaemonStdio } from './serve.js';
-import { findRunningDaemon, isDaemonAlive, socketPath } from './daemon.js';
+import { runDaemonUds } from './serve.js';
+import { isDaemonAlive, socketPath, runtimeDir } from './daemon.js';
 import { canisterCallError } from './error.js';
+import * as log from './log.js';
 /**
  * Absolute path to cli.js (the CLI entry script).
- * Used by spawnDaemonBackground() to spawn daemon child processes via
+ * Used by startDaemonBackground() to spawn daemon child processes via
  * `process.execPath` (the current Node binary) + this script path, so that
  * daemon spawning works regardless of how the CLI was invoked (global install,
  * npx, node dist/cli.js, etc.).
@@ -115,11 +116,6 @@ function showHelp() {
     console.log('  encrypt-only    Encrypt locally without canister sign');
     console.log('  pubkey          Get IBE public key from canister');
     console.log('');
-    console.log('Daemon Commands (AES-256-GCM):');
-    console.log('  serve           Start encryption daemon');
-    console.log('  stop            Stop a running daemon');
-    console.log('  status          Query daemon status');
-    console.log('');
     console.log('Kind5 Access Control:');
     console.log('  grant           Grant decryption access to another user');
     console.log('  revoke          Revoke an access grant');
@@ -135,8 +131,7 @@ function showHelp() {
     console.log('  --file=<path>           File to encrypt');
     console.log('  --event-id=<id>         Event ID for decryption');
     console.log('  --output=<path>         Output file path');
-    console.log('  --key-name=<name>       Daemon key name (default: "default")');
-    console.log('  --stdio                 Use stdin/stdout mode for daemon');
+    // --key-name is an internal daemon option, not shown to users
     console.log('  --public-key=<hex>      IBE public key for offline encryption');
     console.log('  --ibe-identity=<id>     IBE identity for offline encryption');
     console.log('  --tags=<json>           Tags as JSON array');
@@ -146,6 +141,7 @@ function showHelp() {
     console.log('  --duration=<dur>        Grant duration: 30d, 1y, permanent (for grant)');
     console.log('  --grant-id=<id>         Grant ID (for revoke)');
     console.log('  --to=<AI-ID|principal>  Recipient AI-ID or principal (for send-msg)');
+    console.log('  --reply=<msg_id>        Reply to a parent message (for send-msg)');
     console.log('  --data=<json>           Encrypted message JSON envelope (for recv-msg)');
     console.log('  --no-zmail              Skip auto-POST to zMail (send-msg only)');
     console.log('  --zmail-url=<url>       Override zMail server URL');
@@ -394,19 +390,22 @@ async function cmdGetPubkey(session) {
     }
 }
 /**
- * serve: Start daemon in UDS or stdio mode.
+ * serve: Start daemon over Unix Domain Socket.
  *
  * Creates its own long-lived actor for the daemon lifecycle,
  * using the Session's identity for authentication.
  */
 async function cmdServe(session) {
     const args = session.args;
+    // --stdio mode has been removed; reject explicitly so old callers fail fast
+    if (args['stdio']) {
+        throw new Error("--stdio mode is no longer supported. The daemon now uses Unix Domain Socket (UDS) exclusively.");
+    }
     const rawKeyName = args['key-name'];
-    // Guard against boolean flag (e.g. --key-name --stdio parses --key-name as true)
+    // Guard against boolean flag (e.g. --key-name without value parses as true)
     if (rawKeyName === true)
         throw new Error("--key-name requires a value (e.g. --key-name=mykey)");
     const keyName = rawKeyName || 'default';
-    const stdio = !!args['stdio'];
     // Validate key_name
     if (keyName.includes(":"))
         throw new Error("key_name must not contain ':' (reserved as separator)");
@@ -418,15 +417,10 @@ async function cmdServe(session) {
         throw new Error(`derivation_id exceeds 256 bytes (${derivationId.length}); use a shorter key_name`);
     }
     // Derive AES-256 key from VetKey via the sign actor
-    console.error(`Deriving AES-256 key from VetKey (derivation_id: ${derivationId})...`);
+    log.info(`Deriving AES-256 key from VetKey (derivation_id: ${derivationId})...`);
     const keyStore = await KeyStore.deriveFromActor(actor, derivationId);
-    console.error("Key derived successfully. Starting JSON-RPC daemon...");
-    if (stdio) {
-        await runDaemonStdio(keyStore, principal, derivationId);
-    }
-    else {
-        await runDaemonUds(keyStore, principal, derivationId);
-    }
+    log.info("Key derived successfully. Starting JSON-RPC daemon...");
+    await runDaemonUds(keyStore, principal, derivationId);
 }
 /**
  * stop: Send shutdown to a running daemon.
@@ -439,21 +433,60 @@ async function cmdStop(session) {
     const jsonOutput = !!args['json'];
     const principal = session.getPrincipal();
     const derivationId = `${principal}:${keyName}`;
-    const sockPath = findRunningDaemon(derivationId);
-    // Connect to socket and send shutdown
-    const response = await sendRpcToSocket(sockPath, {
-        id: 1,
-        method: "shutdown",
-    });
-    if (jsonOutput) {
-        console.log(JSON.stringify(response));
+    const sockPath = socketPath(derivationId);
+    // Try to stop via socket if:
+    //   1. isDaemonAlive() says yes (PID + socket both present), OR
+    //   2. PID file is missing/corrupt but socket file still exists — the daemon
+    //      process may be alive with an orphaned socket. Attempt a shutdown via
+    //      the socket so we don't leave an unmanageable orphan process.
+    const alive = isDaemonAlive(derivationId);
+    const socketExists = existsSync(sockPath);
+    if (!alive && !socketExists) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ status: "not_running", key_name: keyName }));
+        }
+        else {
+            console.log(`Daemon '${keyName}' is not running. Nothing to stop.`);
+        }
+        return;
     }
-    else {
-        console.log("Daemon stopped successfully.");
+    try {
+        const response = await sendRpcToSocket(sockPath, {
+            id: 1,
+            method: "shutdown",
+        });
+        if (jsonOutput) {
+            console.log(JSON.stringify(response));
+        }
+        else {
+            console.log("Daemon stopped successfully.");
+        }
+    }
+    catch (e) {
+        // Socket file exists but connection failed — stale socket, clean it up
+        if (socketExists && !alive) {
+            safeUnlinkPath(sockPath);
+            if (jsonOutput) {
+                console.log(JSON.stringify({ status: "not_running", key_name: keyName, note: "cleaned up stale socket" }));
+            }
+            else {
+                console.log(`Daemon '${keyName}' is not running (cleaned up stale socket).`);
+            }
+        }
+        else {
+            throw e;
+        }
     }
 }
 /**
- * status: Query a running daemon.
+ * status: Query daemon status.
+ *
+ * For standard daemons (default, Mail): auto-starts if not running, so users
+ * never need to manually launch a daemon before querying its status.
+ *
+ * For custom key names: only reports the current state — does NOT auto-start,
+ * since custom daemons require explicit `vetkey serve` to start. This keeps
+ * `status` side-effect-free for non-standard daemons.
  */
 async function cmdStatus(session) {
     const args = session.args;
@@ -461,9 +494,27 @@ async function cmdStatus(session) {
         throw new Error("--key-name requires a value (e.g. --key-name=mykey)");
     const keyName = args['key-name'] || 'default';
     const jsonOutput = !!args['json'];
-    const principal = session.getPrincipal();
-    const derivationId = `${principal}:${keyName}`;
-    const sockPath = findRunningDaemon(derivationId);
+    const isStandard = STANDARD_DAEMON_KEY_NAMES.includes(keyName);
+    let sockPath;
+    if (isStandard) {
+        // Standard daemon: auto-start if needed
+        sockPath = await ensureDaemon(session, keyName);
+    }
+    else {
+        // Custom daemon: report-only, no auto-start
+        const principal = session.getPrincipal();
+        const derivationId = `${principal}:${keyName}`;
+        if (!isDaemonAlive(derivationId)) {
+            if (jsonOutput) {
+                console.log(JSON.stringify({ status: "not_running", key_name: keyName }));
+            }
+            else {
+                console.log(`Daemon '${keyName}' is not running. Use 'zcloak-ai vetkey serve --key-name=${keyName}' to start it.`);
+            }
+            return;
+        }
+        sockPath = socketPath(derivationId);
+    }
     // Connect to socket and send status
     const response = await sendRpcToSocket(sockPath, {
         id: 1,
@@ -480,13 +531,10 @@ async function cmdStatus(session) {
             console.log(`  Derivation ID: ${result.derivation_id}`);
             console.log(`  Principal:     ${result.principal}`);
             console.log(`  Started At:    ${result.started_at}`);
-            console.log(`  Mode:          ${result.mode}`);
-            if (result.socket_path) {
-                console.log(`  Socket:        ${result.socket_path}`);
-            }
+            console.log(`  Socket:        ${result.socket_path}`);
         }
         else if (response.error) {
-            console.error(`Error: ${response.error}`);
+            log.error(`Error: ${response.error}`);
         }
     }
 }
@@ -498,20 +546,48 @@ const DAEMON_READY_TIMEOUT_MS = 30000;
 /** Polling interval when waiting for daemon socket to appear (ms) */
 const DAEMON_POLL_INTERVAL_MS = 500;
 /** Key names for the two standard daemons that should always be kept alive */
-const STANDARD_DAEMON_KEY_NAMES = ['default', 'Mail'];
+export const STANDARD_DAEMON_KEY_NAMES = ['default', 'Mail'];
+/**
+ * Stop ALL running daemons by scanning the runtime directory for .sock files.
+ *
+ * This covers all daemons regardless of principal or key name (standard,
+ * custom, or any --identity), ensuring no stale daemon survives a CLI upgrade.
+ * Errors are silently ignored (best-effort shutdown).
+ */
+export async function stopAllDaemons() {
+    const dir = runtimeDir();
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return; // Runtime directory doesn't exist — no daemons running
+    }
+    const sockFiles = entries.filter(e => e.endsWith('.sock'));
+    for (const sockFile of sockFiles) {
+        const sock = join(dir, sockFile);
+        try {
+            await sendRpcToSocket(sock, { id: 1, method: "shutdown" });
+            log.info(`Daemon stopped (${sockFile}) before upgrade.`);
+        }
+        catch {
+            // Best-effort — daemon may already be gone or socket is stale
+        }
+    }
+}
 /**
  * Spawn a daemon process in the background for the given key name.
  *
  * The child process is fully detached (survives parent exit) with stderr
- * redirected to a log file under ~/.vetkey-tool/.
+ * redirected to a log file under ~/.config/zcloak/run/.
  *
  * @param pemPath - Path to the identity PEM file
  * @param keyName - Daemon key name (e.g. "default", "Mail")
  * @returns The child process PID (or undefined if spawn failed)
  */
-function spawnDaemonBackground(pemPath, keyName) {
-    const logDir = join(homedir(), '.vetkey-tool');
-    const logPath = join(logDir, `${keyName.toLowerCase()}-daemon.log`);
+export function startDaemonBackground(pemPath, keyName) {
+    const logPath = daemonLogPath(keyName);
+    const logDir = dirname(logPath);
     try {
         mkdirSync(logDir, { recursive: true });
     }
@@ -568,59 +644,33 @@ async function ensureDaemon(session, keyName) {
     if (isDaemonAlive(derivationId)) {
         return socketPath(derivationId);
     }
-    console.error(`[zcloak-ai] ${keyName} daemon is not running. Starting it automatically...`);
-    const pid = spawnDaemonBackground(session.getPemPath(), keyName);
-    console.error(`[zcloak-ai] ${keyName} daemon spawned (PID: ${pid ?? 'unknown'}). Waiting for ready...`);
+    log.info(`${keyName} daemon is not running. Starting it automatically...`);
+    const pid = startDaemonBackground(session.getPemPath(), keyName);
+    log.info(`${keyName} daemon spawned (PID: ${pid ?? 'unknown'}). Waiting for ready...`);
     // Poll for the socket file to appear (daemon writes PID + creates socket on ready)
     const sock = socketPath(derivationId);
-    const logPath = join(homedir(), '.vetkey-tool', `${keyName.toLowerCase()}-daemon.log`);
+    const logPath = daemonLogPath(keyName);
     const deadline = Date.now() + DAEMON_READY_TIMEOUT_MS;
     while (Date.now() < deadline) {
         await new Promise((resolve) => setTimeout(resolve, DAEMON_POLL_INTERVAL_MS));
         if (isDaemonAlive(derivationId) && existsSync(sock)) {
-            console.error(`[zcloak-ai] ${keyName} daemon is ready. Socket: ${sock}`);
+            log.info(`${keyName} daemon is ready. Socket: ${sock}`);
             return sock;
         }
     }
     throw new Error(`${keyName} daemon failed to start within ${DAEMON_READY_TIMEOUT_MS / 1000}s. ` +
         `Check the log at ${logPath} for details.`);
 }
-/**
- * Background daemon health check — fire-and-forget.
- *
- * Called by cli.ts after Session creation to keep both standard daemons
- * ("default" and "Mail") alive. If a daemon is dead, spawns it in the
- * background WITHOUT waiting for it to be ready (non-blocking).
- *
- * Prerequisites:
- *   - The PEM file must exist (user has already created an identity)
- *   - If PEM doesn't exist, silently skips (no identity = no daemon possible)
- *
- * All errors are silently swallowed — this is a best-effort health check
- * and must never block or fail the main command.
- *
- * @param pemPath   - Path to the identity PEM file
- * @param principal - The principal ID derived from the PEM
- */
-export function ensureDaemonsBackground(pemPath, principal) {
-    for (const keyName of STANDARD_DAEMON_KEY_NAMES) {
-        const derivationId = `${principal}:${keyName}`;
-        try {
-            if (!isDaemonAlive(derivationId)) {
-                const pid = spawnDaemonBackground(pemPath, keyName);
-                if (pid) {
-                    console.error(`[zcloak-ai] ${keyName} daemon was not running — auto-started (PID: ${pid})`);
-                }
-            }
-        }
-        catch {
-            // Silently ignore — daemon health check must never block the main command
-        }
-    }
-}
 // ============================================================================
 // Helper Functions
 // ============================================================================
+/** Safely delete a file, ignoring errors if it doesn't exist */
+function safeUnlinkPath(filePath) {
+    try {
+        unlinkSync(filePath);
+    }
+    catch { /* ignore */ }
+}
 /**
  * Generate default output path for encrypted files.
  * - If an input file was provided, appends ".enc" suffix (e.g. "data.txt" → "data.txt.enc")
@@ -1022,7 +1072,7 @@ export function schnorrPubkeyFromSpki(spkiHex) {
  *
  * @param session  - CLI session (provides identity for Schnorr signing)
  * @param tags     - Envelope tags (must include at least one ["to", ...])
- * @param content  - Encrypted content string (base64 IBE ciphertext)
+ * @param content  - Encrypted content JSON string: {"v":1,"type":"text"|"file","ct":"<base64>"}
  * @returns Signed Kind17Envelope ready for JSON serialization
  */
 function buildSignedEnvelope(session, tags, content) {
@@ -1052,6 +1102,7 @@ function buildSignedEnvelope(session, tags, content) {
  *   --to=<AI-ID or principal>   (required) Recipient identifier
  *   --text=<content>            Text message to encrypt
  *   --file=<path>               File to encrypt
+ *   --reply=<msg_id>            Parent message ID (for reply threads)
  *   --json                      Output in JSON format (default: true for send-msg)
  */
 async function cmdSendMsg(session) {
@@ -1062,6 +1113,13 @@ async function cmdSendMsg(session) {
     const to = rawTo;
     const text = args['text'];
     const file = args['file'];
+    const rawReply = args['reply'];
+    if (rawReply === true)
+        throw new Error('--reply requires a message ID value');
+    if (typeof rawReply === 'string' && rawReply.length === 0) {
+        throw new Error('--reply requires a non-empty message ID');
+    }
+    const replyMsgId = rawReply;
     if (!to) {
         throw new Error('--to=<AI-ID or principal> is required');
     }
@@ -1100,6 +1158,10 @@ async function cmdSendMsg(session) {
     // IBE-encrypt the plaintext for the recipient's Mail identity
     const ciphertext = cryptoOps.ibeEncrypt(dpkBytes, ibeIdentity, plaintext);
     const contentBase64 = Buffer.from(ciphertext).toString('base64');
+    // Wrap ciphertext in the standardized message composition format per zmail-skill spec.
+    // Shape: {"v":1,"type":"text"|"file","ct":"<base64-ciphertext>"}
+    // The outer Kind17 envelope carries routing metadata; only the body is encrypted.
+    const content = JSON.stringify({ v: 1, type: payloadType, ct: contentBase64 });
     // Build tags: recipient + metadata
     const tags = [
         ['to', recipientPrincipal],
@@ -1109,8 +1171,12 @@ async function cmdSendMsg(session) {
     if (filename) {
         tags.push(['filename', filename]);
     }
+    // Include reply tag when responding to an existing message
+    if (replyMsgId) {
+        tags.push(['reply', replyMsgId]);
+    }
     // Build and sign the Kind17 envelope
-    const envelope = buildSignedEnvelope(session, tags, contentBase64);
+    const envelope = buildSignedEnvelope(session, tags, content);
     // Output the envelope as JSON (always JSON for machine consumption)
     console.log(JSON.stringify(envelope));
     // Auto-POST to zMail if not explicitly disabled with --no-zmail.
@@ -1126,10 +1192,10 @@ async function cmdSendMsg(session) {
                     : (await import('./config.js')).default.zmail_url;
             const { postEnvelopeToZmail } = await import('./zmail.js');
             const result = await postEnvelopeToZmail(zmailUrl, envelope);
-            console.error(`zMail: delivered (msg_id=${result.msg_id}, to=${result.delivered_to})`);
+            log.info(`zMail: delivered (msg_id=${result.msg_id}, to=${result.delivered_to})`);
         }
         catch (err) {
-            console.error(`zMail: delivery failed — ${err instanceof Error ? err.message : String(err)}`);
+            log.error(`zMail: delivery failed — ${err instanceof Error ? err.message : String(err)}`);
         }
     }
 }
@@ -1175,6 +1241,31 @@ async function cmdRecvMsg(session) {
     // Verify envelope integrity and sender authentication.
     // Returns true only if full Schnorr signature + principal binding was verified.
     const verifiedSender = verifyKind17Signature(envelope);
+    // Extract the IBE ciphertext from the content field.
+    // Content follows the zmail-skill message composition spec:
+    // {"v":1,"type":"text"|"file","ct":"<base64-ciphertext>"}
+    let ciphertextBase64;
+    try {
+        const parsed = JSON.parse(envelope.content);
+        if (!parsed || typeof parsed !== 'object' || parsed.v !== 1 || typeof parsed.ct !== 'string') {
+            throw new Error('Invalid message composition format: missing v=1 or ct field');
+        }
+        // Validate type field exists and matches one of the allowed payload types
+        if (parsed.type !== 'text' && parsed.type !== 'file') {
+            throw new Error(`Invalid message composition format: type must be "text" or "file", got "${String(parsed.type)}"`);
+        }
+        // Verify consistency between the composition type and the envelope payload_type tag
+        if (parsed.type !== payloadType) {
+            throw new Error(`Message composition type "${parsed.type}" does not match envelope payload_type tag "${payloadType}"`);
+        }
+        ciphertextBase64 = parsed.ct;
+    }
+    catch (e) {
+        if (e instanceof SyntaxError) {
+            throw new Error('Invalid message composition format: content is not valid JSON');
+        }
+        throw e;
+    }
     // Ensure Mail daemon is running (auto-start if needed, wait for ready), then decrypt
     const sockPath = await ensureDaemon(session, 'Mail');
     const response = await sendRpcToSocket(sockPath, {
@@ -1182,7 +1273,7 @@ async function cmdRecvMsg(session) {
         method: 'ibe-decrypt',
         params: {
             ibe_identity: ibeId,
-            ciphertext_base64: envelope.content,
+            ciphertext_base64: ciphertextBase64,
         },
     });
     if (response.error) {