arcane-cli 1.17.2 → 1.18.0

package/dist/index.js

@@ -4,9 +4,13 @@ const require = __createRequire(import.meta.url);
 
 // src/index.ts
 import { Command } from "commander";
-import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname14, join as join29 } from "path";
+import { dirname as dirname15, join as join31 } from "path";
+
+// src/package-info.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var packageJson = require2("../package.json");
 
 // src/commands/init.ts
 import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
@@ -148,21 +152,21 @@ function runGit(cwd, args, options = {}) {
         windowsHide: true,
         encoding: "utf8"
       },
-      (error, stdout, stderr) => {
-        if (error) {
-          if (error.killed) {
+      (error2, stdout, stderr) => {
+        if (error2) {
+          if (error2.killed) {
             reject(
               new GitTimeoutError(
                 // NOTE: embeds the raw args, including any secrets a future
                 // network-class caller might pass (e.g. a credentialed
                 // clone URL). No current caller does; redact before one does.
                 `git ${args.join(" ")} timed out after ${timeoutMs}ms (class: ${commandClass})`,
-                { cause: error }
+                { cause: error2 }
               )
             );
             return;
           }
-          reject(error);
+          reject(error2);
           return;
         }
         resolve10({ stdout, stderr });
@@ -223,8 +227,8 @@ async function correctUnbornMasterDefault(cwd) {
   try {
     await runGit(cwd, ["symbolic-ref", "-q", "refs/heads/main"]);
     return { corrected: false, to: "main", blockedReason: "target-unreadable" };
-  } catch (error) {
-    if (error.code !== 1) {
+  } catch (error2) {
+    if (error2.code !== 1) {
       return { corrected: false, to: "main", blockedReason: "target-unreadable" };
     }
   }
@@ -659,8 +663,8 @@ function isValidTodoDoneBook(value) {
   if (value !== value.trim() || value.includes(":")) return false;
   const normalized = path2.posix.normalize(value.replace(/\\/g, "/"));
   const segments = normalized.split("/");
-  const basename5 = segments[segments.length - 1] ?? "";
-  return /^[^/]+\.md$/i.test(basename5) && !/^\.md$/i.test(basename5) && !segments.slice(0, -1).some((segment) => segment.startsWith(".") && segment !== ".") && !TODO_DONE_BOOK_RESERVED.has(basename5.toLowerCase());
+  const basename6 = segments[segments.length - 1] ?? "";
+  return /^[^/]+\.md$/i.test(basename6) && !/^\.md$/i.test(basename6) && !segments.slice(0, -1).some((segment) => segment.startsWith(".") && segment !== ".") && !TODO_DONE_BOOK_RESERVED.has(basename6.toLowerCase());
 }
 function manifestPath(targetDir) {
   return path2.join(targetDir, MANIFEST_FILE);
@@ -1483,13 +1487,13 @@ function isClientShimPath(path5) {
 }
 var FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
 function parsePromptFrontmatter(content) {
-  const match = content.match(FRONTMATTER_PATTERN);
-  if (!match) {
+  const match2 = content.match(FRONTMATTER_PATTERN);
+  if (!match2) {
     throw new MissingFrontmatterError(
       "Prompt file has no YAML frontmatter block (expected a leading --- ... --- block)."
     );
   }
-  const raw = parseYaml(match[1]);
+  const raw = parseYaml(match2[1]);
   const name = raw?.["name"];
   const description = raw?.["description"];
   if (typeof name !== "string" || name.trim() === "") {
@@ -1902,7 +1906,7 @@ function scale(hex, f) {
 }
 function lockupLines(f = 1) {
   const g = f >= 1 ? arcaneGradient : gradient(STOPS.map((c) => scale(c, f)));
-  return WORDMARK.map((line) => INDENT + g(line));
+  return WORDMARK.map((line2) => INDENT + g(line2));
 }
 function printFooter(version) {
   const taglineText = `  ${TAGLINE} \xB7 agent-native SDLC \xB7 v${version}`;
@@ -1937,7 +1941,7 @@ async function printWelcome(version, cwd) {
   if (isAnimatable()) {
     const draw = (lines, redraw) => {
       if (redraw) process.stdout.write(`\x1B[${lines.length}A`);
-      for (const line of lines) process.stdout.write(`\r\x1B[2K${line}
+      for (const line2 of lines) process.stdout.write(`\r\x1B[2K${line2}
 `);
     };
     const fade = [0.1, 0.22, 0.36, 0.52, 0.68, 0.84, 1];
@@ -1951,7 +1955,7 @@ async function printWelcome(version, cwd) {
       await sleep(140);
     }
   } else {
-    for (const line of lockupLines()) console.log(line);
+    for (const line2 of lockupLines()) console.log(line2);
   }
   printFooter(version);
   console.log();
@@ -3000,8 +3004,8 @@ async function performAgentSync(targetDir, assetsDir, roster, options) {
       dryRun: options.dryRun,
       fallbackDir: assetsDir
     });
-    for (const line of describeFanoutOutcomes(fanout.outcomes, options.dryRun)) {
-      console.log(`  ${line}`);
+    for (const line2 of describeFanoutOutcomes(fanout.outcomes, options.dryRun)) {
+      console.log(`  ${line2}`);
     }
     if (!options.dryRun) {
       await writeManifest(targetDir, { ...manifest, fanout: fanout.record }, { followLinks: true });
@@ -3312,7 +3316,7 @@ async function detectAdoContext(targetDir) {
   } catch {
     return false;
   }
-  return stdout.split("\n").map((line) => line.slice(line.indexOf(" ") + 1)).some((url) => url.trim() !== "" && isAdoRemoteUrl(url));
+  return stdout.split("\n").map((line2) => line2.slice(line2.indexOf(" ") + 1)).some((url) => url.trim() !== "" && isAdoRemoteUrl(url));
 }
 
 // src/modules/hub.ts
@@ -3546,19 +3550,19 @@ function resolveManifestFlags(flags, current, manifestPath2) {
   if (flags.contentSensitivity !== void 0) requested.content_sensitivity = flags.contentSensitivity;
   if (flags.subjectRoot !== void 0) requested.subject_root = flags.subjectRoot;
   if (flags.pushPolicy !== void 0) requested.push_policy = flags.pushPolicy;
-  const invalid = (error) => {
-    const allowed = error.field === "role" ? ["hub", "consumer"] : MANIFEST_ENUM_VALUES[error.field];
+  const invalid = (error2) => {
+    const allowed = error2.field === "role" ? ["hub", "consumer"] : MANIFEST_ENUM_VALUES[error2.field];
     const hint = allowed ? ` Valid values: ${allowed.join(", ")}.` : "";
-    return new ManifestFlagError(`Invalid ${FLAG_NAMES[error.field] ?? error.field}: ${error.message}${hint}`);
+    return new ManifestFlagError(`Invalid ${FLAG_NAMES[error2.field] ?? error2.field}: ${error2.message}${hint}`);
   };
   if (requested.role !== void 0 && requested.role !== "hub" && requested.role !== "consumer") {
     throw invalid(new ManifestInvalidFieldError(manifestPath2, "role", requested.role));
   }
   try {
     validateManifestFields(requested, manifestPath2);
-  } catch (error) {
-    if (error instanceof ManifestInvalidFieldError) throw invalid(error);
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof ManifestInvalidFieldError) throw invalid(error2);
+    throw error2;
   }
   if (requested.external_provider !== void 0 && requested.tracking_mode !== "external") {
     throw new ManifestFlagError("--external-provider applies only together with --tracking-mode external.");
@@ -3659,8 +3663,8 @@ async function readHooksPath(cwd) {
   try {
     const { stdout } = await runGit(cwd, ["config", "--show-scope", "--get", "core.hooksPath"]);
     raw = stdout.trim();
-  } catch (error) {
-    if (error.code !== 1) {
+  } catch (error2) {
+    if (error2.code !== 1) {
       return { value: "", scope: "unknown", unreadable: true };
     }
     return void 0;
@@ -3886,7 +3890,7 @@ async function pushTargets(cwd) {
       const { stdout } = await runGit(cwd, ["remote", "get-url", "--push", "--all", remote]);
       targets.push({
         remote,
-        urls: stdout.split("\n").map((line) => line.trim()).filter(Boolean)
+        urls: stdout.split("\n").map((line2) => line2.trim()).filter(Boolean)
       });
     } catch {
       targets.push({ remote, urls: [] });
@@ -3900,7 +3904,7 @@ function originalPushUrlKey(remote) {
 async function readLocalAll(cwd, key) {
   try {
     const { stdout } = await runGit(cwd, ["config", "--local", "--get-all", key]);
-    return stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+    return stdout.split("\n").map((line2) => line2.trim()).filter(Boolean);
   } catch {
     return [];
   }
@@ -3912,10 +3916,10 @@ async function readScopedAll(cwd, key) {
   } catch {
     return [];
   }
-  return stdout.split("\n").filter((line) => line !== "").map((line) => {
-    const separator = line.indexOf("	");
-    if (separator === -1) return { scope: "unknown", value: line.trim() };
-    return { scope: line.slice(0, separator).trim(), value: line.slice(separator + 1).trim() };
+  return stdout.split("\n").filter((line2) => line2 !== "").map((line2) => {
+    const separator = line2.indexOf("	");
+    if (separator === -1) return { scope: "unknown", value: line2.trim() };
+    return { scope: line2.slice(0, separator).trim(), value: line2.slice(separator + 1).trim() };
   });
 }
 async function effectivePushUrls(cwd, remote) {
@@ -3927,8 +3931,8 @@ async function disablePushUrls(cwd) {
   for (const remote of await listRemotes(cwd)) {
     try {
       results.push(await disableOneRemote(cwd, remote));
-    } catch (error) {
-      results.push({ remote, status: "failed", reason: describeError(error) });
+    } catch (error2) {
+      results.push({ remote, status: "failed", reason: describeError(error2) });
     }
   }
   return results;
@@ -4003,8 +4007,8 @@ async function restorePushUrls(cwd) {
   for (const remote of await listRemotes(cwd)) {
     try {
       results.push(await restoreOneRemote(cwd, remote));
-    } catch (error) {
-      results.push({ remote, status: "failed", reason: describeError(error) });
+    } catch (error2) {
+      results.push({ remote, status: "failed", reason: describeError(error2) });
     }
   }
   return results;
@@ -4044,8 +4048,8 @@ async function restoreOneRemote(cwd, remote) {
 async function unsetIgnoringMissing(cwd, key) {
   try {
     await runGit(cwd, ["config", "--local", "--unset-all", key]);
-  } catch (error) {
-    if (error.code !== 5) throw error;
+  } catch (error2) {
+    if (error2.code !== 5) throw error2;
   }
 }
 async function hadNoPushUrl(cwd, remote) {
@@ -4073,8 +4077,8 @@ async function readLegacyRecord(cwd, remote) {
   }
   return { status: "usable", values };
 }
-function describeError(error) {
-  const message = error instanceof Error ? error.message : String(error);
+function describeError(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
   return message.split("\n")[0].trim();
 }
 function hookInForce(outcome) {
@@ -4082,8 +4086,8 @@ function hookInForce(outcome) {
 }
 async function applyBlockedPushControls(cwd, options = {}) {
   const messages = [];
-  const say = (level, text) => {
-    const message = { level, text };
+  const say = (level, text2) => {
+    const message = { level, text: text2 };
     messages.push(message);
     options.emit?.(message);
   };
@@ -4373,7 +4377,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   }
   const escapes = findLinkedEscapes(targetDir, plannedFiles);
   if (escapes.length > 0) {
-    for (const line of describeLinkedEscapes(targetDir, escapes)) console.error(line);
+    for (const line2 of describeLinkedEscapes(targetDir, escapes)) console.error(line2);
     console.error(
       "  \u2717 Init refused: nothing was installed. Arcane writes managed files only inside its target directory: replace each link named above with a directory, then run `spell init` again."
     );
@@ -4562,7 +4566,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   const flagLine = options.profile ? manifestFlagLine(manifest) : void 0;
   if (flagLine) {
     printInfo("Some setup questions were left unanswered. Answer them without a prompt with:");
-    for (const line of flagLine) printInfo(`  ${line}`);
+    for (const line2 of flagLine) printInfo(`  ${line2}`);
   }
   if (push_policy === "blocked" || push_policy === "guarded") {
     try {
@@ -4754,9 +4758,9 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
   };
   await writeManifest(storeRoot, manifest, { followLinks: true });
   printStep(`\u2728 ${fileCount} Spells installed to ${storeRoot}/spells/`);
-  for (const line of describeFanoutOutcomes(fanout.outcomes)) {
-    if (line.startsWith("!")) printWarning(line.slice(2));
-    else printStep(`\u{1F517} ${line}`);
+  for (const line2 of describeFanoutOutcomes(fanout.outcomes)) {
+    if (line2.startsWith("!")) printWarning(line2.slice(2));
+    else printStep(`\u{1F517} ${line2}`);
   }
   printSuccess(
     `Initialized the user tier \u2014 ${fileCount} spells, ${Object.keys(fanout.record).length} client files recorded`
@@ -4764,7 +4768,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
   console.log();
   printSection("\u{1F9ED} Clients");
   console.log();
-  for (const line of VSCODE_USER_TIER_NOTE) printInfo(line);
+  for (const line2 of VSCODE_USER_TIER_NOTE) printInfo(line2);
   printInfo(CLAUDE_PRECEDENCE_NOTE);
   console.log();
   printSection("\u{1F680} Next steps");
@@ -5045,11 +5049,11 @@ function computeLcsDiff(base, other) {
 }
 function arraysEqual(a, b) {
   if (a.length !== b.length) return false;
-  return a.every((line, idx) => line === b[idx]);
+  return a.every((line2, idx) => line2 === b[idx]);
 }
 var MAX_LINES_FOR_LCS = 4e3;
-function splitLines(text) {
-  return text.split("\n");
+function splitLines(text2) {
+  return text2.split("\n");
 }
 function merge3(base, ours, theirs) {
   const baseLines = splitLines(base);
@@ -5344,9 +5348,9 @@ async function missingTierWarning(scope, spellScope, homeDir) {
 function reportFlagPatch(flagPatch, before, after, dryRun) {
   console.log(`
 ${dryRun ? "[dry-run] Would record" : "Recorded"} from flags:`);
-  for (const line of describeFlagPatch(flagPatch)) console.log(`    ${line}`);
+  for (const line2 of describeFlagPatch(flagPatch)) console.log(`    ${line2}`);
   if (!dryRun && after.push_policy !== before.push_policy) {
-    for (const line of pushPolicyNotice(after.push_policy)) console.log(line);
+    for (const line2 of pushPolicyNotice(after.push_policy)) console.log(line2);
   }
 }
 function defaultScopePatch(options, manifest) {
@@ -5619,7 +5623,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   const homeDir = dirname7(targetDir);
   const tierGate = await missingTierWarning(scope, spellScope);
   if (tierGate.length > 0) {
-    for (const line of tierGate) console.error(line);
+    for (const line2 of tierGate) console.error(line2);
     console.error(
       "  \u2717 Update refused: nothing was written. Install the tier or change spell_scope, then run `spell update` again."
     );
@@ -5662,7 +5666,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   const linkedEscapes = followDirectoryLinks || manifest.components.length === 0 ? [] : findLinkedEscapes(targetDir, await plannedUpdateWrites(manifest.components, scope, spellScope, assetsDir));
   const refusedForLinks = () => {
     if (linkedEscapes.length === 0) return false;
-    for (const line of describeLinkedEscapes(targetDir, linkedEscapes)) console.error(line);
+    for (const line2 of describeLinkedEscapes(targetDir, linkedEscapes)) console.error(line2);
     console.error(
       "  \u2717 Update refused: nothing was written. Arcane writes and deletes managed files only inside its target directory: replace each link named above with a directory, then run `spell update` again."
     );
@@ -5698,7 +5702,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     registryChanges.missingRequires = missingRequires.filter((m) => !installing.has(m.name)).map((m) => ({ ...m, leftAloneReason: installPlan.leftAlone.find((l) => l.name === m.name)?.reason }));
   }
   const printRegistryChanges = () => {
-    for (const line of formatRegistryChanges(registryChanges)) console.log(line);
+    for (const line2 of formatRegistryChanges(registryChanges)) console.log(line2);
   };
   const applyInstalls = async () => {
     const declined = installPlan.leftAlone.filter((l) => l.kind === "new");
@@ -5706,14 +5710,14 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     console.log(options.dryRun ? "\n[dry-run] Components this update would install (ARC-052):" : "\nComponents installed by this update (ARC-052):");
     for (const l of declined) console.log(`  ! Not installed: ${l.name} \u2014 ${l.reason}`);
     if (options.dryRun) {
-      for (const line of describeInstallPlan(installPlan)) console.log(line);
+      for (const line2 of describeInstallPlan(installPlan)) console.log(line2);
       return [];
     }
     const { installed, lines } = await executeUpdateInstalls(installPlan, targetDir, packageVersion, {
       linkTracked,
       conversions
     });
-    for (const line of lines) console.log(line);
+    for (const line2 of lines) console.log(line2);
     return installed;
   };
   let sameVersionRestore = false;
@@ -5740,7 +5744,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           dryRun: options.dryRun,
           fallbackDir: assetsDir
         });
-        for (const line of describeFanoutOutcomes(fanout.outcomes, options.dryRun)) console.log(`  ${line}`);
+        for (const line2 of describeFanoutOutcomes(fanout.outcomes, options.dryRun)) console.log(`  ${line2}`);
         const scopePatch = defaultScopePatch(options, manifest);
         if (!options.dryRun && (JSON.stringify(fanout.record) !== JSON.stringify(manifest.fanout ?? {}) || scopePatch !== void 0)) {
           await writeManifest(targetDir, { ...manifest, ...scopePatch, fanout: fanout.record }, { followLinks: scope === "user" });
@@ -6044,7 +6048,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
     });
     const lines = describeFanoutOutcomes(fanout.outcomes, options.dryRun);
     if (lines.length > 0) console.log();
-    for (const line of lines) console.log(`  ${line}`);
+    for (const line2 of lines) console.log(`  ${line2}`);
     fanoutRecord = fanout.record;
   }
   if (options.dryRun) {
@@ -6069,7 +6073,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
       console.log(
         `  ! Skipped ${pending.length} manifest question${pending.length === 1 ? "" : "s"} (${pending.map((r) => r.field).join(", ")}) \u2014 no interactive terminal. Run \`spell update\` from a terminal, or answer by flags:`
       );
-      for (const line of manifestFlagLine(answered) ?? []) console.log(`      ${line}`);
+      for (const line2 of manifestFlagLine(answered) ?? []) console.log(`      ${line2}`);
     }
   }
   const updated = {
@@ -6089,7 +6093,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
   if (Object.keys(flagPatch).length > 0) {
     reportFlagPatch(flagPatch, manifest, updated, false);
   } else if (updated.push_policy !== manifest.push_policy) {
-    for (const line of pushPolicyNotice(updated.push_policy)) console.log(line);
+    for (const line2 of pushPolicyNotice(updated.push_policy)) console.log(line2);
   }
   if (conflictedFiles.length > 0) {
     console.log(
@@ -6117,14 +6121,11 @@ import { dirname as dirname9 } from "path";
 import { readFile as readFile10, writeFile as writeFile10, mkdir as mkdir6 } from "fs/promises";
 import { dirname as dirname8, join as join12 } from "path";
 import { homedir as homedir3 } from "os";
-import { createRequire } from "module";
-var require2 = createRequire(import.meta.url);
 function getFeedUrl() {
-  const pkg2 = require2("../../package.json");
-  const url = pkg2.publishConfig?.registry;
+  const url = packageJson.publishConfig?.registry;
   if (!url) {
     throw new Error(
-      "publishConfig.registry is not set in package.json. Cannot resolve npm feed URL."
+      "publishConfig.registry is not set in package.json, so the npm feed URL cannot be resolved"
     );
   }
   return url;
@@ -6219,14 +6220,15 @@ async function collectVersions(manifest, packageVersion, options) {
   let lookup = null;
   if (options.online) {
     let feedUrl = options.feedUrl ?? "";
+    let feedError = "";
     if (feedUrl === "") {
       try {
         feedUrl = getFeedUrl();
-      } catch {
-        feedUrl = "";
+      } catch (error2) {
+        feedError = `Feed URL unavailable: ${error2 instanceof Error ? error2.message : String(error2)}`;
       }
     }
-    lookup = feedUrl ? await checkForUpdate(packageVersion, feedUrl, options.cachePath) : { current: packageVersion, latest: null, updateAvailable: false, error: "Feed URL unavailable" };
+    lookup = feedUrl ? await checkForUpdate(packageVersion, feedUrl, options.cachePath) : { current: packageVersion, latest: null, updateAvailable: false, error: feedError };
     if (lookup.latest === null) {
       warnings.push(
         `versions.latest: the npm lookup gave no answer${lookup.error ? ` (${lookup.error})` : ""}; latest and drift.cli_behind_latest are null`
@@ -6358,7 +6360,7 @@ async function runStatus(targetDir, packageVersion, options = {}) {
     }
   }
   console.log("");
-  const latestStr = versionResult.error ? "unable to check" : versions.latest ?? versions.files;
+  const latestStr = versions.latest ?? "unable to check";
   let footer = `  Installed: ${versions.cli}  Latest: ${latestStr}`;
   if (versionResult.updateAvailable) {
     footer += "  (spell update available)";
@@ -6386,7 +6388,7 @@ async function runStatus(targetDir, packageVersion, options = {}) {
   }
   if (scope === "user") {
     console.log("");
-    for (const line of VSCODE_USER_TIER_NOTE) console.log(`  ${line}`);
+    for (const line2 of VSCODE_USER_TIER_NOTE) console.log(`  ${line2}`);
     console.log(`  ${CLAUDE_PRECEDENCE_NOTE}`);
   }
 }
@@ -6406,9 +6408,9 @@ async function collectAgents(targetDir, options = {}) {
   let resolved;
   try {
     resolved = await resolveRoster(targetDir, "repo", options.homeDir);
-  } catch (error) {
-    if (error instanceof AgentRosterNotFoundError) return { agents: null, warnings: [] };
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof AgentRosterNotFoundError) return { agents: null, warnings: [] };
+    throw error2;
   }
   const origin = resolved.fromUserTier ? "user" : "repo";
   const warnings = [];
@@ -6455,18 +6457,18 @@ function titleAfterId(rest) {
   return rest.replace(/^\s*[—–:-]+\s*/u, "").trim();
 }
 function parseDecisions(content) {
-  const text = content.replace(/\r\n?/g, "\n");
+  const text2 = content.replace(/\r\n?/g, "\n");
   const positions = [];
-  let match;
+  let match2;
   HEADING.lastIndex = 0;
-  while ((match = HEADING.exec(text)) !== null) {
-    positions.push({ id: `${match[1]}-${match[2]}`, heading: `${match[1]}-${match[2]}${match[3]}`, index: match.index });
+  while ((match2 = HEADING.exec(text2)) !== null) {
+    positions.push({ id: `${match2[1]}-${match2[2]}`, heading: `${match2[1]}-${match2[2]}${match2[3]}`, index: match2.index });
   }
   const entries = [];
   const warnings = [];
   positions.forEach(({ id, heading, index }, i) => {
-    const end = i + 1 < positions.length ? positions[i + 1].index : text.length;
-    const section = text.slice(index, end);
+    const end = i + 1 < positions.length ? positions[i + 1].index : text2.length;
+    const section = text2.slice(index, end);
     const dateMatch = /^\*\*Date:\*\*\s*(\d{4}-\d{2}-\d{2})/m.exec(section);
     const statusMatch = /^\*\*Status:\*\*\s*(\S+)/m.exec(section);
     if (!dateMatch && !statusMatch) {
@@ -6495,11 +6497,11 @@ async function collectDecisions(root) {
   let content;
   try {
     content = await readFile12(join14(root, "DECISIONS.md"), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return { decisions: null, warnings: [] };
+  } catch (error2) {
+    if (error2.code === "ENOENT") return { decisions: null, warnings: [] };
     return {
       decisions: null,
-      warnings: [`indexes.decisions: DECISIONS.md could not be read (${error instanceof Error ? error.message : String(error)})`]
+      warnings: [`indexes.decisions: DECISIONS.md could not be read (${error2 instanceof Error ? error2.message : String(error2)})`]
     };
   }
   const { entries, warnings } = parseDecisions(content);
@@ -6513,12 +6515,12 @@ async function collectDecisions(root) {
 var ITEM = /^\s*- \[( |x|X)\] (.*)$/;
 var HEADING2 = /^#{1,6}\s+(.+?)\s*#*\s*$/;
 var TEXT_LIMIT = 200;
-function normalizeItemText(text) {
-  return text.replace(/\s+/g, " ").trim();
+function normalizeItemText(text2) {
+  return text2.replace(/\s+/g, " ").trim();
 }
-function itemLocator(section, text) {
+function itemLocator(section, text2) {
   const slug = section === null ? "" : headingAnchor(section);
-  const hash = createHash3("sha256").update(normalizeItemText(text), "utf8").digest("hex").slice(0, 12);
+  const hash = createHash3("sha256").update(normalizeItemText(text2), "utf8").digest("hex").slice(0, 12);
   return `${slug === "" ? "root" : slug}/${hash}`;
 }
 function parseBook(content) {
@@ -6526,22 +6528,22 @@ function parseBook(content) {
   let section = null;
   let open = 0;
   let done = 0;
-  for (const line of content.split(/\r?\n/)) {
-    const heading = HEADING2.exec(line);
+  for (const line2 of content.split(/\r?\n/)) {
+    const heading = HEADING2.exec(line2);
     if (heading) {
       section = heading[1];
       continue;
     }
-    const item = ITEM.exec(line);
+    const item = ITEM.exec(line2);
     if (!item) continue;
     const checked = item[1] !== " ";
-    const text = item[2].trim();
+    const text2 = item[2].trim();
     if (checked) done++;
     else open++;
     items.push({
-      text: text.length > TEXT_LIMIT ? text.slice(0, TEXT_LIMIT) : text,
+      text: text2.length > TEXT_LIMIT ? text2.slice(0, TEXT_LIMIT) : text2,
       section,
-      locator: itemLocator(section, text),
+      locator: itemLocator(section, text2),
       checked
     });
   }
@@ -6551,11 +6553,11 @@ async function collectBook(root, fileName) {
   let content;
   try {
     content = await readFile13(join15(root, fileName), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return { book: null, warnings: [] };
+  } catch (error2) {
+    if (error2.code === "ENOENT") return { book: null, warnings: [] };
     return {
       book: null,
-      warnings: [`indexes: ${fileName} could not be read (${error instanceof Error ? error.message : String(error)})`]
+      warnings: [`indexes: ${fileName} could not be read (${error2 instanceof Error ? error2.message : String(error2)})`]
     };
   }
   return { book: parseBook(content), warnings: [] };
@@ -6606,16 +6608,16 @@ function featureTracking(frontmatter) {
   };
 }
 function parsePrd(content, displayPath) {
-  const text = content.replace(/\r\n?/g, "\n");
-  const heading = H1.exec(text);
+  const text2 = content.replace(/\r\n?/g, "\n");
+  const heading = H1.exec(text2);
   const empty = { title: heading ? heading[1] : null, status: null, implementation_status: null, tracking: null };
-  const match = FRONTMATTER.exec(text);
-  if (!match) return { fields: empty, warning: `features: ${displayPath} has no frontmatter` };
+  const match2 = FRONTMATTER.exec(text2);
+  if (!match2) return { fields: empty, warning: `features: ${displayPath} has no frontmatter` };
   let parsed;
   try {
-    parsed = parse2(match[1]);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message.split("\n")[0] : String(error);
+    parsed = parse2(match2[1]);
+  } catch (error2) {
+    const reason = error2 instanceof Error ? error2.message.split("\n")[0] : String(error2);
     return { fields: empty, warning: `features: ${displayPath} has malformed frontmatter (${reason})` };
   }
   if (!isRecord3(parsed)) return { fields: empty, warning: `features: ${displayPath} has frontmatter that is not a map` };
@@ -6635,11 +6637,11 @@ async function collectFeatures(root) {
   try {
     const entries = await readdir7(dir, { withFileTypes: true });
     slugs = entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
-  } catch (error) {
-    if (error.code === "ENOENT") return { features: null, warnings: [] };
+  } catch (error2) {
+    if (error2.code === "ENOENT") return { features: null, warnings: [] };
     return {
       features: null,
-      warnings: [`features: ${FEATURES_DIR}/ could not be read (${error instanceof Error ? error.message : String(error)})`]
+      warnings: [`features: ${FEATURES_DIR}/ could not be read (${error2 instanceof Error ? error2.message : String(error2)})`]
     };
   }
   const warnings = [];
@@ -6649,9 +6651,9 @@ async function collectFeatures(root) {
     let content;
     try {
       content = await readFile14(join16(dir, slug, PRD_FILE), "utf8");
-    } catch (error) {
-      if (error.code === "ENOENT") continue;
-      warnings.push(`features: ${path5} could not be read (${error instanceof Error ? error.message : String(error)})`);
+    } catch (error2) {
+      if (error2.code === "ENOENT") continue;
+      warnings.push(`features: ${path5} could not be read (${error2 instanceof Error ? error2.message : String(error2)})`);
       continue;
     }
     const { fields, warning } = parsePrd(content, path5);
@@ -6815,10 +6817,10 @@ function serializeState(doc) {
 `;
 }
 function toPosixRelative(root, target) {
-  const relative4 = path4.relative(root, target);
-  if (relative4 === "") return ".";
-  if (path4.isAbsolute(relative4)) return relative4.replace(/\\/g, "/");
-  return relative4.split(path4.sep).join("/");
+  const relative5 = path4.relative(root, target);
+  if (relative5 === "") return ".";
+  if (path4.isAbsolute(relative5)) return relative5.replace(/\\/g, "/");
+  return relative5.split(path4.sep).join("/");
 }
 
 // src/modules/state/git.ts
@@ -6840,10 +6842,10 @@ function stripUserinfo(url) {
 function parseWorktreeList(porcelain, root) {
   const worktrees = [];
   for (const block of porcelain.replace(/\r\n/g, "\n").split(/\n\n+/)) {
-    const lines = block.split("\n").filter((line) => line.length > 0);
-    const pathLine = lines.find((line) => line.startsWith("worktree "));
+    const lines = block.split("\n").filter((line2) => line2.length > 0);
+    const pathLine = lines.find((line2) => line2.startsWith("worktree "));
     if (!pathLine) continue;
-    const branchLine = lines.find((line) => line.startsWith("branch "));
+    const branchLine = lines.find((line2) => line2.startsWith("branch "));
     const branch = branchLine ? branchLine.slice("branch ".length).replace(/^refs\/heads\//, "") : null;
     const absolute = resolveRealPath(pathLine.slice("worktree ".length));
     worktrees.push({ path: toPosixRelative(root, absolute), branch });
@@ -6853,12 +6855,12 @@ function parseWorktreeList(porcelain, root) {
 async function probe(read) {
   try {
     return { ok: true, value: await read() };
-  } catch (error) {
-    return { ok: false, error };
+  } catch (error2) {
+    return { ok: false, error: error2 };
   }
 }
-function describe(error) {
-  return error instanceof Error ? error.message : String(error);
+function describe(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
 }
 async function collectGit(cwd, root, options = {}) {
   const git = options.runGit ?? runGit;
@@ -6949,8 +6951,8 @@ async function collectGit(cwd, root, options = {}) {
     warnings
   };
 }
-function isTimeout(error) {
-  return error instanceof Error && error.name === "GitTimeoutError";
+function isTimeout(error2) {
+  return error2 instanceof Error && error2.name === "GitTimeoutError";
 }
 
 // src/modules/state/journal.ts
@@ -6959,13 +6961,13 @@ import { join as join17 } from "path";
 var JOURNAL_DIR = "journal";
 var ENTRY_NAME = /^(\d{4}-\d{2}-\d{2})-(.+)\.md$/;
 function journalTitle(content) {
-  const text = content.replace(/\r\n?/g, "\n");
-  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text);
+  const text2 = content.replace(/\r\n?/g, "\n");
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text2);
   if (frontmatter) {
     const title = /^title:\s*(.+)$/m.exec(frontmatter[1]);
     if (title) return title[1].trim().replace(/^(["'])(.*)\1$/, "$2");
   }
-  const heading = /^# (.+?)\s*$/m.exec(text);
+  const heading = /^# (.+?)\s*$/m.exec(text2);
   return heading ? heading[1].trim() : null;
 }
 async function collectJournal(root) {
@@ -6974,29 +6976,29 @@ async function collectJournal(root) {
   try {
     const entries = await readdir8(dir, { withFileTypes: true });
     names = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
-  } catch (error) {
-    if (error.code === "ENOENT") return { journal: null, warnings: [] };
+  } catch (error2) {
+    if (error2.code === "ENOENT") return { journal: null, warnings: [] };
     return {
       journal: null,
-      warnings: [`indexes.journal: ${JOURNAL_DIR}/ could not be read (${error instanceof Error ? error.message : String(error)})`]
+      warnings: [`indexes.journal: ${JOURNAL_DIR}/ could not be read (${error2 instanceof Error ? error2.message : String(error2)})`]
     };
   }
   const warnings = [];
   const journal = [];
   for (const name of names) {
-    const match = ENTRY_NAME.exec(name);
-    if (!match) {
+    const match2 = ENTRY_NAME.exec(name);
+    if (!match2) {
       warnings.push(`indexes.journal: ${JOURNAL_DIR}/${name} does not match YYYY-MM-DD-<slug>.md and was skipped`);
       continue;
     }
     let title = null;
     try {
       title = journalTitle(await readFile15(join17(dir, name), "utf8"));
-    } catch (error) {
-      warnings.push(`indexes.journal: ${JOURNAL_DIR}/${name} could not be read (${error instanceof Error ? error.message : String(error)})`);
+    } catch (error2) {
+      warnings.push(`indexes.journal: ${JOURNAL_DIR}/${name} could not be read (${error2 instanceof Error ? error2.message : String(error2)})`);
     }
     if (title === null) warnings.push(`indexes.journal: ${JOURNAL_DIR}/${name} has no title: frontmatter or # heading`);
-    journal.push({ date: match[1], slug: match[2], title, path: `${JOURNAL_DIR}/${name}` });
+    journal.push({ date: match2[1], slug: match2[2], title, path: `${JOURNAL_DIR}/${name}` });
   }
   journal.sort((a, b) => a.date < b.date ? -1 : a.date > b.date ? 1 : a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0);
   return { journal, warnings };
@@ -7019,9 +7021,9 @@ function execFileWithTimeout(file, args, timeoutMs, options = {}) {
         encoding: "utf8",
         ...options.env ? { env: { ...process.env, ...options.env } } : {}
       },
-      (error, stdout, stderr) => {
-        if (error) {
-          reject(error);
+      (error2, stdout, stderr) => {
+        if (error2) {
+          reject(error2);
           return;
         }
         resolve10({ stdout, stderr });
@@ -7071,14 +7073,14 @@ function parseAdoRemote(url) {
   if (ssh) return { org: ssh[1], project: decodeURIComponent(ssh[2]), repo: decodeURIComponent(ssh[3]) };
   return null;
 }
-function describe2(error) {
-  if (error instanceof Error) {
-    const code = error.code;
+function describe2(error2) {
+  if (error2 instanceof Error) {
+    const code = error2.code;
     if (code === "ENOENT") return "the CLI is not installed";
-    if (error.killed) return `timed out after ${EXTERNAL_CLI_TIMEOUT_MS}ms`;
-    return error.message.split("\n")[0];
+    if (error2.killed) return `timed out after ${EXTERNAL_CLI_TIMEOUT_MS}ms`;
+    return error2.message.split("\n")[0];
   }
-  return String(error);
+  return String(error2);
 }
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -7087,8 +7089,8 @@ async function lookupGitHub(branch, exec) {
   let stdout;
   try {
     ({ stdout } = await exec("gh", ["pr", "list", "--head", branch, "--state", "open", "--json", "number,url,state"], EXTERNAL_CLI_TIMEOUT_MS));
-  } catch (error) {
-    return { pull_request: null, warnings: [`git.pull_request: gh pr list failed (${describe2(error)})`] };
+  } catch (error2) {
+    return { pull_request: null, warnings: [`git.pull_request: gh pr list failed (${describe2(error2)})`] };
   }
   let parsed;
   try {
@@ -7135,8 +7137,8 @@ async function lookupAdo(branch, remoteUrl, exec, launch) {
       EXTERNAL_CLI_TIMEOUT_MS,
       launch.env ? { env: launch.env } : {}
     ));
-  } catch (error) {
-    return { pull_request: null, warnings: [`git.pull_request: az repos pr list failed (${describe2(error)})`] };
+  } catch (error2) {
+    return { pull_request: null, warnings: [`git.pull_request: az repos pr list failed (${describe2(error2)})`] };
   }
   let parsed;
   try {
@@ -7243,17 +7245,17 @@ async function collectRegistry(root, manifest, options) {
   let content;
   try {
     content = await readFile16(join18(root, businessRoot, "registry.json"), "utf8");
-  } catch (error) {
-    const reason = error.code === "ENOENT" ? "is missing" : `could not be read (${error instanceof Error ? error.message : String(error)})`;
+  } catch (error2) {
+    const reason = error2.code === "ENOENT" ? "is missing" : `could not be read (${error2 instanceof Error ? error2.message : String(error2)})`;
     return { registry: null, warnings: [`registry: this repository is a hub but ${relativePath} ${reason}`] };
   }
   let raw;
   try {
     raw = JSON.parse(content);
-  } catch (error) {
+  } catch (error2) {
     return {
       registry: null,
-      warnings: [`registry: ${relativePath} is not valid JSON (${error instanceof Error ? error.message : String(error)})`]
+      warnings: [`registry: ${relativePath} is not valid JSON (${error2 instanceof Error ? error2.message : String(error2)})`]
     };
   }
   return { registry: parseRegistry(raw, options), warnings: [] };
@@ -7268,9 +7270,9 @@ async function guarded(section, warnings, run, fallback) {
     const result = await run();
     warnings.push(...result.warnings);
     return result.value;
-  } catch (error) {
-    if (error instanceof AgentConfigValidationError) throw error;
-    warnings.push(`${section}: collector failed (${error instanceof Error ? error.message : String(error)}); the section is null`);
+  } catch (error2) {
+    if (error2 instanceof AgentConfigValidationError) throw error2;
+    warnings.push(`${section}: collector failed (${error2 instanceof Error ? error2.message : String(error2)}); the section is null`);
     return fallback;
   }
 }
@@ -7403,9 +7405,9 @@ async function collectState(cwd, packageVersion, options) {
 
 // src/commands/state.ts
 var USAGE_POINTER = "spell state prints one JSON document to stdout: run `spell state --json` (spell status is the human view).";
-function writeStdout(text) {
+function writeStdout(text2) {
   return new Promise((resolve10, reject) => {
-    process.stdout.write(text, (error) => error ? reject(error) : resolve10());
+    process.stdout.write(text2, (error2) => error2 ? reject(error2) : resolve10());
   });
 }
 async function runState(targetDir, packageVersion, options = {}, deps = {}) {
@@ -7415,28 +7417,28 @@ async function runState(targetDir, packageVersion, options = {}, deps = {}) {
     return;
   }
   const collect = deps.collect ?? collectState;
-  let text;
+  let text2;
   try {
     const doc = await collect(targetDir, packageVersion, {
       online: options.online === true,
       includeLocalPaths: options.includeLocalPaths === true
     });
-    text = serializeState(doc);
-  } catch (error) {
-    if (error instanceof ManifestNotFoundError) {
+    text2 = serializeState(doc);
+  } catch (error2) {
+    if (error2 instanceof ManifestNotFoundError) {
       console.error('Not initialized. Run "spell init" first.');
-    } else if (error instanceof AgentConfigValidationError) {
-      console.error(error.message);
+    } else if (error2 instanceof AgentConfigValidationError) {
+      console.error(error2.message);
     } else {
-      console.error(`spell state: ${error instanceof Error ? error.message : String(error)}`);
+      console.error(`spell state: ${error2 instanceof Error ? error2.message : String(error2)}`);
     }
     process.exitCode = 1;
     return;
   }
   try {
-    await (deps.write ?? writeStdout)(text);
-  } catch (error) {
-    console.error(`spell state: stdout is not writable (${error instanceof Error ? error.message : String(error)})`);
+    await (deps.write ?? writeStdout)(text2);
+  } catch (error2) {
+    console.error(`spell state: stdout is not writable (${error2 instanceof Error ? error2.message : String(error2)})`);
     process.exitCode = 1;
   }
 }
@@ -7588,7 +7590,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
       previous: manifest.fanout,
       dryRun: true
     });
-    for (const line of describeFanoutOutcomes(preview.outcomes, true)) console.log(line);
+    for (const line2 of describeFanoutOutcomes(preview.outcomes, true)) console.log(line2);
     console.log(`[dry-run] Would remove: ${storeRoot}/.arcane.json`);
     console.log(
       `
@@ -7626,7 +7628,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
   await rm5(join19(storeRoot, "agents.yaml"), { force: true });
   await removeDirectoryIfEmpty(join19(storeRoot, USER_TIER_SPELLS_DIR));
   await removeDirectoryIfEmpty(storeRoot);
-  for (const line of describeFanoutOutcomes(fanout.outcomes)) console.log(`  ${line}`);
+  for (const line2 of describeFanoutOutcomes(fanout.outcomes)) console.log(`  ${line2}`);
   const pruned = fanout.outcomes.filter((o) => o.status === "pruned").length;
   const kept = fanout.outcomes.filter((o) => o.status === "kept-edited").length;
   console.log(
@@ -7929,9 +7931,9 @@ async function fetchAdoMergeTypePolicies(org, project, repoName, branch, launch
   }
 }
 function parseGitHubRemote(url) {
-  const match = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?\/?$/.exec(url);
-  if (!match) return null;
-  const [, owner, repo] = match;
+  const match2 = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?\/?$/.exec(url);
+  if (!match2) return null;
+  const [, owner, repo] = match2;
   if (!owner || !repo) return null;
   return { owner, repo };
 }
@@ -7946,9 +7948,9 @@ function decodeAdoSegment(raw) {
   return decoded;
 }
 function parseAdoRemote2(url) {
-  const match = /dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/?]+)/.exec(url) ?? /([^./]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/?]+)/.exec(url);
-  if (!match) return null;
-  const [, rawOrg, rawProject, rawRepo] = match;
+  const match2 = /dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/?]+)/.exec(url) ?? /([^./]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/?]+)/.exec(url);
+  if (!match2) return null;
+  const [, rawOrg, rawProject, rawRepo] = match2;
   if (!rawOrg || !rawProject || !rawRepo) return null;
   const org = decodeAdoSegment(rawOrg);
   const project = decodeAdoSegment(rawProject);
@@ -7975,28 +7977,28 @@ function stripFrontmatter(content) {
   const block = FRONTMATTER_PATTERN2.exec(content);
   return block ? content.slice(block[0].length) : content;
 }
-function stripFencedCode(text) {
+function stripFencedCode(text2) {
   const kept = [];
   let fence = null;
-  for (const line of text.split(/\r?\n/)) {
+  for (const line2 of text2.split(/\r?\n/)) {
     if (fence) {
-      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line);
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line2);
       if (close && close[1][0] === fence.char && close[1].length >= fence.length) fence = null;
       kept.push("");
       continue;
     }
-    const open = /^ {0,3}(`{3,}|~{3,})/.exec(line);
-    if (open && !(open[1][0] === "`" && line.slice(open[0].length).includes("`"))) {
+    const open = /^ {0,3}(`{3,}|~{3,})/.exec(line2);
+    if (open && !(open[1][0] === "`" && line2.slice(open[0].length).includes("`"))) {
       fence = { char: open[1][0], length: open[1].length };
       kept.push("");
       continue;
     }
-    kept.push(line);
+    kept.push(line2);
   }
   return kept.join("\n");
 }
-function stripInlineCode(text) {
-  return text.split(/\n[ \t]*\n/).map((paragraph) => {
+function stripInlineCode(text2) {
+  return text2.split(/\n[ \t]*\n/).map((paragraph) => {
     let out = "";
     let i = 0;
     while (i < paragraph.length) {
@@ -8037,7 +8039,7 @@ function stripInlineCode(text) {
 function findPlaceholderTokens(content) {
   const prose = stripInlineCode(stripFencedCode(stripFrontmatter(content)));
   const seen = /* @__PURE__ */ new Set();
-  for (const match of prose.matchAll(PLACEHOLDER_PATTERN)) seen.add(`{${match[1]}}`);
+  for (const match2 of prose.matchAll(PLACEHOLDER_PATTERN)) seen.add(`{${match2[1]}}`);
   return [...seen];
 }
 function parseRuntimePlaceholders(standardContent) {
@@ -8046,8 +8048,8 @@ function parseRuntimePlaceholders(standardContent) {
   if (start === -1 || end === -1 || end < start) return null;
   const region = standardContent.slice(start + RUNTIME_PLACEHOLDERS_START.length, end);
   const tokens = /* @__PURE__ */ new Set();
-  for (const match of region.matchAll(/^[ \t]*[-*][ \t]+`(\{[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*\})`/gm)) {
-    tokens.add(match[1]);
+  for (const match2 of region.matchAll(/^[ \t]*[-*][ \t]+`(\{[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*\})`/gm)) {
+    tokens.add(match2[1]);
   }
   return tokens;
 }
@@ -8984,9 +8986,9 @@ function parseTermsFileContent(raw) {
 async function readTermsFile(filePath) {
   try {
     return parseTermsFileContent(await readFile21(filePath, "utf8"));
-  } catch (error) {
+  } catch (error2) {
     console.warn(
-      `\u26A0 arcane: could not read --terms-file "${filePath}": ${error.message}`
+      `\u26A0 arcane: could not read --terms-file "${filePath}": ${error2.message}`
     );
     return [];
   }
@@ -9249,8 +9251,8 @@ var ChunkedSecretStore = class {
   guard(operation, fn) {
     try {
       return fn();
-    } catch (error) {
-      throw new KeychainUnavailableError(operation, error);
+    } catch (error2) {
+      throw new KeychainUnavailableError(operation, error2);
     }
   }
   /** Reads the stored secret. Never throws for bad data; throws only when the keychain itself fails. */
@@ -9360,9 +9362,9 @@ function resultPagePath(kind) {
   return join24("sign-in", `sign-in-callback-${kind}.html`);
 }
 function styleHashes(html) {
-  return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match) => {
-    const text = match[1].replace(/\r\n?/g, "\n");
-    return `'sha256-${createHash5("sha256").update(text, "utf8").digest("base64")}'`;
+  return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match2) => {
+    const text2 = match2[1].replace(/\r\n?/g, "\n");
+    return `'sha256-${createHash5("sha256").update(text2, "utf8").digest("base64")}'`;
   });
 }
 function resultPageHeaders(html) {
@@ -9446,8 +9448,8 @@ async function loadIdentityConfiguration(environment, options = {}) {
     const response = await fetchImpl(environment.discoveryUrl, { redirect: "manual" });
     if (!response.ok) throw new Error(`discovery returned HTTP ${response.status}`);
     metadata = await response.json();
-  } catch (error) {
-    throw new IdentityUnreachableError(environment.signInHost, error);
+  } catch (error2) {
+    throw new IdentityUnreachableError(environment.signInHost, error2);
   }
   if (typeof metadata.issuer !== "string" || !metadata.token_endpoint || !metadata.authorization_endpoint) {
     throw new IdentityUnreachableError(environment.signInHost, new Error("discovery document incomplete"));
@@ -9572,8 +9574,8 @@ async function browserLogin(config, options) {
         const result = toTokenResult(response);
         await options.onValidated?.(result);
         redirectToResult({ kind: "success", result });
-      }).catch((error) => {
-        redirectToResult({ kind: "failure", error });
+      }).catch((error2) => {
+        redirectToResult({ kind: "failure", error: error2 });
       });
     });
     timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
@@ -9605,7 +9607,7 @@ function openInDefaultBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
   return new Promise((resolve10) => {
     try {
-      const child = execFile3(command, args, { windowsHide: true }, (error) => resolve10(!error));
+      const child = execFile3(command, args, { windowsHide: true }, (error2) => resolve10(!error2));
       child.on("error", () => resolve10(false));
     } catch {
       resolve10(false);
@@ -9711,11 +9713,11 @@ var FileSecretBackend = class {
     writeFileSync(tmp, JSON.stringify(entries), { encoding: "utf8", mode: 384 });
     try {
       this.restrict(tmp);
-    } catch (error) {
+    } catch (error2) {
       rmSync(tmp, { force: true });
       throw new Error(
         "Could not restrict the session file to your account, so it was not written.",
-        { cause: error }
+        { cause: error2 }
       );
     }
     renameSync(tmp, this.filePath);
@@ -9770,9 +9772,9 @@ function createSessionStorage(options = {}) {
       try {
         const fromKeychain = interpret(keychain.load(), "keychain");
         if (fromKeychain) return fromKeychain;
-      } catch (error) {
-        if (!(error instanceof KeychainUnavailableError)) throw error;
-        keychainError = error;
+      } catch (error2) {
+        if (!(error2 instanceof KeychainUnavailableError)) throw error2;
+        keychainError = error2;
       }
       if (fileBackend.exists()) {
         const fromFile = interpret(file.load(), "file");
@@ -9800,8 +9802,8 @@ function createSessionStorage(options = {}) {
         const hadKeychainSession = keychain.load().state !== "signed-out";
         keychain.clear();
         if (hadKeychainSession) removed.push("keychain");
-      } catch (error) {
-        keychainError = error;
+      } catch (error2) {
+        keychainError = error2;
       }
       if (fileBackend.exists()) {
         fileBackend.remove();
@@ -9831,8 +9833,8 @@ function defaultLoginDeps(assetsDir) {
 }
 var INSECURE_STORAGE_WARNING = "Insecure storage: the session is kept in a file protected only by your account's file permissions, not in the OS keychain. Run `spell logout` to remove it.";
 var MISSING_RESULT_PAGES_WARNING = "This arcane-cli install is missing its sign-in result pages (assets/sign-in/), so the browser will show a plain page. Reinstall the package to restore them.";
-function safeErrorText(error) {
-  const message = error instanceof Error ? error.message : String(error);
+function safeErrorText(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
   return message.split("\n")[0].replace(/([?&](?:code|state|id_token|access_token|refresh_token)=)[^&\s]+/gi, "$1[redacted]");
 }
 function toSessionRecord(result, environment) {
@@ -9854,13 +9856,13 @@ async function runLogin(options, deps) {
   let environment;
   try {
     environment = deps.environment();
-  } catch (error) {
-    if (error instanceof UnknownEnvironmentError) {
-      console.error(error.message);
+  } catch (error2) {
+    if (error2 instanceof UnknownEnvironmentError) {
+      console.error(error2.message);
       process.exit(1);
       return;
     }
-    throw error;
+    throw error2;
   }
   if (!options.deviceCode && !deps.isInteractive()) {
     console.error(
@@ -9872,9 +9874,9 @@ async function runLogin(options, deps) {
   let config;
   try {
     config = await deps.loadConfiguration(environment);
-  } catch (error) {
+  } catch (error2) {
     console.error(
-      error instanceof IdentityUnreachableError ? `${error.message} Check your network connection and try again.` : `Could not prepare the sign-in: ${safeErrorText(error)}`
+      error2 instanceof IdentityUnreachableError ? `${error2.message} Check your network connection and try again.` : `Could not prepare the sign-in: ${safeErrorText(error2)}`
     );
     process.exit(1);
     return;
@@ -9910,15 +9912,15 @@ async function runLogin(options, deps) {
       });
       if (!record) throw new Error("The browser sign-in ended without storing a session.");
     }
-  } catch (error) {
-    if (error instanceof KeychainUnavailableError) {
+  } catch (error2) {
+    if (error2 instanceof KeychainUnavailableError) {
       console.error(
-        `${error.message} Nothing was stored. If this machine has no keychain, run \`spell login --insecure-storage\` to keep the session in a file instead (protected only by your account's file permissions).`
+        `${error2.message} Nothing was stored. If this machine has no keychain, run \`spell login --insecure-storage\` to keep the session in a file instead (protected only by your account's file permissions).`
       );
-    } else if (error instanceof LoginTimeoutError || error instanceof LoginDeniedError) {
-      console.error(`${error.message} Nothing was changed.`);
+    } else if (error2 instanceof LoginTimeoutError || error2 instanceof LoginDeniedError) {
+      console.error(`${error2.message} Nothing was changed.`);
     } else {
-      console.error(`The sign-in did not complete: ${safeErrorText(error)}. Nothing was changed.`);
+      console.error(`The sign-in did not complete: ${safeErrorText(error2)}. Nothing was changed.`);
     }
     process.exit(1);
     return;
@@ -9933,21 +9935,21 @@ function runLogout(storage = createSessionStorage()) {
   let removed;
   try {
     removed = storage.clear().removed;
-  } catch (error) {
-    if (error instanceof SessionClearError) {
-      const fileResult = error.removed.includes("file") ? "The insecure session file was removed. " : "";
+  } catch (error2) {
+    if (error2 instanceof SessionClearError) {
+      const fileResult = error2.removed.includes("file") ? "The insecure session file was removed. " : "";
       console.error(
-        `${fileResult}${error.keychainError.message} Any session in the OS keychain could not be verified or removed.`
+        `${fileResult}${error2.keychainError.message} Any session in the OS keychain could not be verified or removed.`
       );
       process.exit(1);
       return;
     }
-    if (error instanceof KeychainUnavailableError) {
-      console.error(`${error.message} The session could not be removed from it.`);
+    if (error2 instanceof KeychainUnavailableError) {
+      console.error(`${error2.message} The session could not be removed from it.`);
       process.exit(1);
       return;
     }
-    throw error;
+    throw error2;
   }
   if (removed.length === 0) {
     printSuccess("Nothing was stored; you were already signed out.");
@@ -9971,13 +9973,13 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
   let loaded;
   try {
     loaded = deps.storage.load();
-  } catch (error) {
-    if (error instanceof KeychainUnavailableError) {
-      console.error(`${error.message} Cannot tell whether you are signed in.`);
+  } catch (error2) {
+    if (error2 instanceof KeychainUnavailableError) {
+      console.error(`${error2.message} Cannot tell whether you are signed in.`);
       process.exit(1);
       return;
     }
-    throw error;
+    throw error2;
   }
   if (loaded.state === "signed-out") {
     console.error("Not signed in. Run `spell login`.");
@@ -10009,9 +10011,9 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
     const fresh = await deps.refreshSession(config, record.refreshToken, SIGN_IN_SCOPES);
     deps.storage.save(toSessionRecord(fresh, environment), { insecure: source === "file" });
     printSuccess(`Verified with the identity service at ${environment.signInHost}; the session is active.`);
-  } catch (error) {
+  } catch (error2) {
     console.error(
-      `The identity service did not accept the session (${safeErrorText(error)}). Run \`spell login\` again.`
+      `The identity service did not accept the session (${safeErrorText(error2)}). Run \`spell login\` again.`
     );
     process.exit(1);
   }
@@ -10031,11 +10033,11 @@ import { join as join26 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
-  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
-  if (!match) return {};
+  const match2 = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
+  if (!match2) return {};
   const fields = {};
-  for (const line of match[1].split(/\r?\n/)) {
-    const kv = /^([a-zA-Z][\w-]*):\s*(.*)$/.exec(line);
+  for (const line2 of match2[1].split(/\r?\n/)) {
+    const kv = /^([a-zA-Z][\w-]*):\s*(.*)$/.exec(line2);
     if (kv) fields[kv[1]] = kv[2].trim();
   }
   return fields;
@@ -10103,7 +10105,7 @@ function parseEpics(content) {
 }
 function extractSection(content, headingPrefix) {
   const lines = content.split(/\r?\n/);
-  const startIndex = lines.findIndex((line) => line.startsWith(headingPrefix));
+  const startIndex = lines.findIndex((line2) => line2.startsWith(headingPrefix));
   if (startIndex === -1) return null;
   let endIndex = lines.length;
   for (let i = startIndex + 1; i < lines.length; i += 1) {
@@ -10125,11 +10127,11 @@ function parseParkedSection(content) {
     }));
   }
   return unwrapBullets(body).flatMap((bullet) => {
-    const match = /^\*\*(.+?)\*\*(.*?)\s*—\s*(.+)$/.exec(bullet);
-    if (!match) return [];
-    const tail = match[2].replace(/\([^)]*\)/g, "").replace(/\s+/g, " ").trim();
-    const title = tail ? `${match[1].trim()} ${tail}` : match[1].trim();
-    return [{ title: stripMarkdown(title), reason: stripMarkdown(match[3].trim()) }];
+    const match2 = /^\*\*(.+?)\*\*(.*?)\s*—\s*(.+)$/.exec(bullet);
+    if (!match2) return [];
+    const tail = match2[2].replace(/\([^)]*\)/g, "").replace(/\s+/g, " ").trim();
+    const title = tail ? `${match2[1].trim()} ${tail}` : match2[1].trim();
+    return [{ title: stripMarkdown(title), reason: stripMarkdown(match2[3].trim()) }];
   });
 }
 function unwrapBullets(body) {
@@ -10139,12 +10141,12 @@ function unwrapBullets(body) {
     if (current) bullets.push(current.join(" ").replace(/\s+/g, " ").trim());
     current = null;
   };
-  for (const line of body.split(/\r?\n/)) {
-    if (/^- /.test(line)) {
+  for (const line2 of body.split(/\r?\n/)) {
+    if (/^- /.test(line2)) {
       flush();
-      current = [line.slice(2).trim()];
+      current = [line2.slice(2).trim()];
     } else if (current !== null) {
-      if (/^\s+\S/.test(line)) current.push(line.trim());
+      if (/^\s+\S/.test(line2)) current.push(line2.trim());
       else flush();
     }
   }
@@ -10162,8 +10164,8 @@ function computeCoverageOutcome(content) {
   const dispositioned = total - parkedCount;
   return `${total} of ${total} items dispositioned \u2014 ${dispositioned} routed to an epic, ${parkedCount} parked`;
 }
-function stripMarkdown(text) {
-  return text.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
+function stripMarkdown(text2) {
+  return text2.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
 }
 
 // src/modules/show-report/queue-parser.ts
@@ -10209,8 +10211,8 @@ function parseVerificationLedgerSection(content, programNameWords) {
   }
   return rows;
 }
-function stripMarkdown2(text) {
-  return text.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
+function stripMarkdown2(text2) {
+  return text2.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
 }
 
 // src/modules/show-report/sources.ts
@@ -10248,8 +10250,8 @@ async function getCloseCommit(cwd, completedDate, generatedOutputs = []) {
   }
   const log = await runGitTextOrNull(cwd, ["log", "--format=%H%x09%cs", "HEAD", ...excludeOutputs(generatedOutputs)]);
   if (log === null || log === "") return null;
-  for (const line of log.split("\n")) {
-    const [sha, landed] = line.split("	");
+  for (const line2 of log.split("\n")) {
+    const [sha, landed] = line2.split("	");
     if (sha && landed && landed <= completedDate) return sha;
   }
   return null;
@@ -10346,9 +10348,9 @@ function buildNeedsYou(queueEntries) {
     return entry;
   });
 }
-function truncateAtWord(text, limit) {
-  if (text.length <= limit) return text;
-  const window = text.slice(0, limit - 1);
+function truncateAtWord(text2, limit) {
+  if (text2.length <= limit) return text2;
+  const window = text2.slice(0, limit - 1);
   const lastSpace = window.lastIndexOf(" ");
   const head = lastSpace > 0 ? window.slice(0, lastSpace) : window;
   return `${head.replace(/[\s,;:.—-]+$/, "")}\u2026`;
@@ -10474,11 +10476,11 @@ var CATEGORY_ORDER = [
   "docs",
   "platform"
 ];
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+function escapeHtml(text2) {
+  return text2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function inlineMarkupToHtml(text) {
-  const escaped = escapeHtml(text);
+function inlineMarkupToHtml(text2) {
+  const escaped = escapeHtml(text2);
   const withLinks = escaped.replace(
     /\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g,
     '<a href="$2">$1</a>'
@@ -10550,12 +10552,12 @@ function applyReportTheme(html, theme) {
   if (!radioTagPattern(theme).test(html)) return { html, applied: false };
   let result = html;
   for (const id of REPORT_THEMES) {
-    const match = radioTagPattern(id).exec(result);
-    if (!match) continue;
-    const original = match[0];
+    const match2 = radioTagPattern(id).exec(result);
+    if (!match2) continue;
+    const original = match2[0];
     const replaced = id === theme ? withChecked(original) : withoutChecked(original);
     if (replaced !== original) {
-      result = result.slice(0, match.index) + replaced + result.slice(match.index + original.length);
+      result = result.slice(0, match2.index) + replaced + result.slice(match2.index + original.length);
     }
   }
   return { html: result, applied: true };
@@ -10598,9 +10600,9 @@ async function discoverPrograms(rootDir) {
   let entries;
   try {
     entries = (await readdir13(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
-  } catch (error) {
-    if (error.code === "ENOENT") return { programs: [], skipped: [] };
-    throw error;
+  } catch (error2) {
+    if (error2.code === "ENOENT") return { programs: [], skipped: [] };
+    throw error2;
   }
   const programs = [];
   const skipped = [];
@@ -10622,9 +10624,9 @@ function normalizeLineEndings2(content) {
 async function readOptionalFile(path5) {
   try {
     return await readFile24(path5, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
+  } catch (error2) {
+    if (error2.code === "ENOENT") return null;
+    throw error2;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
@@ -10755,11 +10757,1400 @@ async function runReport(targetDir, options = {}, assetsDir) {
   for (const path5 of result.repaired) console.log(`  ${path5}`);
 }
 
+// src/modules/agent-ref.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var REF_TYPES = ["agent", "template", "session"];
+var UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var ANY_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function createUuidV7Generator(options = {}) {
+  const now = options.now ?? Date.now;
+  const random = options.random ?? ((n) => randomBytes2(n));
+  let lastMs = -1;
+  let counter = 0;
+  return () => {
+    let ms = Math.floor(now());
+    const bytes = random(10);
+    if (ms > lastMs) {
+      counter = (bytes[0] << 8 | bytes[1]) & 2047;
+    } else {
+      ms = lastMs;
+      counter += 1;
+      if (counter > 4095) {
+        ms += 1;
+        counter = (bytes[0] << 8 | bytes[1]) & 2047;
+      }
+    }
+    lastMs = ms;
+    const out = new Uint8Array(16);
+    let t = ms;
+    for (let i = 5; i >= 0; i -= 1) {
+      out[i] = t % 256;
+      t = Math.floor(t / 256);
+    }
+    out[6] = 112 | counter >> 8 & 15;
+    out[7] = counter & 255;
+    out[8] = 128 | bytes[2] & 63;
+    for (let i = 9; i < 16; i += 1) out[i] = bytes[i - 6];
+    const hex = Array.from(out, (b) => b.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+  };
+}
+var defaultUuidV7 = createUuidV7Generator();
+function uuidv7() {
+  return defaultUuidV7();
+}
+function mintRef(type, generate = uuidv7) {
+  if (!REF_TYPES.includes(type)) {
+    throw new Error(`"${String(type)}" is not a registered reference type`);
+  }
+  return `arcane:${type}:${generate()}`;
+}
+function mintSessionRef() {
+  return mintRef("session");
+}
+function parseRef(text2, expected) {
+  if (typeof text2 !== "string") return { ok: false, reason: "a reference must be a string" };
+  if (text2.length === 0) return { ok: false, reason: "a reference must not be empty" };
+  if (text2 !== text2.trim()) return { ok: false, reason: "a reference must not carry surrounding whitespace" };
+  if (text2 !== text2.toLowerCase()) return { ok: false, reason: "a reference must be lowercase" };
+  const parts = text2.split(":");
+  if (parts.length !== 3 || parts[0] !== "arcane") {
+    return { ok: false, reason: 'a reference must have the form "arcane:<type>:<uuid>"' };
+  }
+  const type = parts[1];
+  const uuid = parts[2];
+  if (!REF_TYPES.includes(type)) {
+    return { ok: false, reason: `"${type}" is not a registered reference type` };
+  }
+  if (uuid.startsWith("{") || uuid.endsWith("}")) {
+    return { ok: false, reason: "a reference's uuid must not be braced" };
+  }
+  if (!ANY_UUID.test(uuid)) return { ok: false, reason: "a reference's uuid must be in canonical hex form" };
+  if (!UUID_V7.test(uuid)) return { ok: false, reason: "a reference's uuid must be a version 7 UUID" };
+  if (expected !== void 0 && type !== expected) {
+    return { ok: false, reason: `expected a ${expected} reference, got one of type ${type}` };
+  }
+  return { ok: true, type, uuid };
+}
+
+// src/modules/presence/client.ts
+import { request } from "http";
+
+// src/modules/presence/store.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join29, relative as relative4 } from "path";
+
+// src/modules/presence/types.ts
+var PRESENCE_CONTRACT = "v0";
+var DEFAULT_PORT = 27226;
+var PRESENCE_ENV = { port: "ARCANE_PRESENCE_PORT", token: "ARCANE_PRESENCE_TOKEN" };
+var LOOPBACK_HOST = "127.0.0.1";
+var MAX_BODY_BYTES = 65536;
+var MAX_LINE_CHARS = 256;
+var MAX_NEEDS_YOU = 20;
+var MAX_SUBSCRIBERS = 32;
+var MAX_SUBSCRIBER_BUFFER_BYTES = 1048576;
+var MAX_CONNECTIONS = 128;
+var MAX_SESSIONS = 256;
+var MAX_ALIASES = 32;
+var CONNECTIONS_CHECK_MS = 1e3;
+var HEADERS_TIMEOUT_MS = 5e3;
+var REQUEST_TIMEOUT_MS = 1e4;
+var STALE_AFTER_MS = 9e4;
+var EXPIRE_AFTER_MS = 864e5;
+var KEEPALIVE_MS = 15e3;
+var SWEEP_MS = 5e3;
+var HARNESSES = ["claude-code", "copilot", "codex", "openclaw", "cron", "other"];
+var REPORT_STATUSES = ["working", "waiting", "blocked", "idle"];
+var ALIAS_CONTEXTS = ["openclaw", "slug"];
+var HELLO_EVENT = "server.hello";
+function presenceCapabilities() {
+  return { observe: true, actions: [] };
+}
+function nullAgentBlock() {
+  return { ref: null, slug: null, name: null, origin: null, definition_revision: null, aliases: [] };
+}
+
+// src/modules/presence/store.ts
+var PRESENCE_DIR_NAME = "presence";
+var STORE_FILES = { token: "token", serverInfo: "server.json" };
+var PresenceStoreError = class extends Error {
+};
+function home(options) {
+  return options.home ?? resolveHomeDir();
+}
+function presenceDir(options = {}) {
+  return join29(userTierRoot(home(options)), PRESENCE_DIR_NAME);
+}
+function tokenPath(options = {}) {
+  return join29(presenceDir(options), STORE_FILES.token);
+}
+function serverInfoPath(options = {}) {
+  return join29(presenceDir(options), STORE_FILES.serverInfo);
+}
+function ensureStore(options = {}) {
+  const root = userTierRoot(home(options));
+  const dir = presenceDir(options);
+  mkdirSync2(root, { recursive: true });
+  const realRoot = resolveRealPath(root);
+  if (relative4(realRoot, resolveRealPath(dir)) !== PRESENCE_DIR_NAME) {
+    throw new PresenceStoreError(`Refusing to use ${dir}: it resolves outside ${root}.`);
+  }
+  if (relative4(realRoot, resolveRealPath(tokenPath(options))) !== join29(PRESENCE_DIR_NAME, STORE_FILES.token)) {
+    throw new PresenceStoreError(`Refusing to use ${tokenPath(options)}: it resolves outside ${dir}.`);
+  }
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  return dir;
+}
+function writeRestricted(target, content, options) {
+  const restrict = options.restrict ?? restrictToCurrentUser;
+  const tmp = `${target}.${process.pid}.tmp`;
+  writeFileSync2(tmp, content, { encoding: "utf8", mode: 384 });
+  try {
+    restrict(tmp);
+  } catch (error2) {
+    rmSync2(tmp, { force: true });
+    throw new PresenceStoreError(`Could not restrict ${target} to your account, so it was not written.`, { cause: error2 });
+  }
+  renameSync2(tmp, target);
+  chmodSync(target, 384);
+}
+function generateToken() {
+  return randomBytes3(32).toString("base64url");
+}
+function readTokenFile(options) {
+  let raw;
+  try {
+    raw = readFileSync3(tokenPath(options), "utf8");
+  } catch {
+    return null;
+  }
+  const token = raw.replace(/[\r\n]+$/, "").trim();
+  return token.length > 0 ? token : null;
+}
+function ensureToken(options = {}) {
+  ensureStore(options);
+  const existing = options.rotate === true ? null : readTokenFile(options);
+  if (existing !== null) {
+    chmodSync(tokenPath(options), 384);
+    (options.restrict ?? restrictToCurrentUser)(tokenPath(options));
+    return existing;
+  }
+  const token = generateToken();
+  writeRestricted(tokenPath(options), `${token}
+`, options);
+  return token;
+}
+function readToken(options = {}) {
+  const fromEnv = (options.env ?? process.env)[PRESENCE_ENV.token];
+  if (fromEnv !== void 0 && fromEnv.replace(/[\r\n]+$/, "") !== "") return fromEnv.replace(/[\r\n]+$/, "");
+  return readTokenFile(options);
+}
+function writeServerInfo(info, options = {}) {
+  ensureStore(options);
+  writeRestricted(serverInfoPath(options), `${JSON.stringify(info, null, 2)}
+`, options);
+}
+function readServerInfo(options = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(serverInfoPath(options), "utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  const generator = o["generator"];
+  const valid = typeof o["url"] === "string" && Number.isInteger(o["pid"]) && o["pid"] > 0 && Number.isInteger(o["port"]) && o["port"] >= 1 && o["port"] <= 65535 && typeof o["started_at"] === "string" && typeof generator === "object" && generator !== null && generator["name"] === "arcane-cli" && typeof generator["version"] === "string";
+  if (!valid) return null;
+  return {
+    url: o["url"],
+    pid: o["pid"],
+    port: o["port"],
+    started_at: o["started_at"],
+    generator: { name: "arcane-cli", version: generator["version"] }
+  };
+}
+function removeServerInfo(options = {}) {
+  rmSync2(serverInfoPath(options), { force: true });
+}
+
+// src/modules/presence/client.ts
+var CONNECT_TIMEOUT_MS = 1e3;
+var RESPONSE_TIMEOUT_MS = 1500;
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveEndpoint(options = {}) {
+  const info = readServerInfo(options);
+  if (info === null || !pidAlive(info.pid)) return null;
+  const token = readToken({ ...options, env: options.env ?? process.env });
+  if (token === null) return null;
+  return { info, token };
+}
+function errorFields(body) {
+  const e = body?.error;
+  return { code: typeof e?.code === "string" ? e.code : null, field: typeof e?.field === "string" ? e.field : null };
+}
+function send(port, token, method, path5, body, options = {}) {
+  const connectTimeout = options.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
+  const responseTimeout = options.responseTimeoutMs ?? RESPONSE_TIMEOUT_MS;
+  const payload = body === void 0 ? void 0 : JSON.stringify(body);
+  return new Promise((resolve10) => {
+    let settled = false;
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(connectTimer);
+      clearTimeout(responseTimer);
+      resolve10(result);
+    };
+    const headers = { Authorization: `Bearer ${token}`, Accept: "application/json" };
+    if (payload !== void 0) {
+      headers["Content-Type"] = "application/json";
+      headers["Content-Length"] = Buffer.byteLength(payload);
+    }
+    const req = request({ host: LOOPBACK_HOST, port, method, path: path5, headers, agent: false }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("error", () => done({ kind: "unreachable" }));
+      res.on("end", () => {
+        const status = res.statusCode ?? 0;
+        const text2 = Buffer.concat(chunks).toString("utf8");
+        let parsed = null;
+        try {
+          parsed = text2.length > 0 ? JSON.parse(text2) : null;
+        } catch {
+          parsed = null;
+        }
+        if (status >= 200 && status < 300 && parsed !== null) done({ kind: "ok", status, body: parsed });
+        else if (status === 401 || status === 400 || status === 404 || status === 413) done({ kind: "refused", status, ...errorFields(parsed) });
+        else done({ kind: "unreachable" });
+      });
+    });
+    const connectTimer = setTimeout(() => {
+      req.destroy();
+      done({ kind: "unreachable" });
+    }, connectTimeout);
+    const responseTimer = setTimeout(() => {
+      req.destroy();
+      done({ kind: "unreachable" });
+    }, connectTimeout + responseTimeout);
+    req.on("socket", (socket) => {
+      socket.once("connect", () => clearTimeout(connectTimer));
+    });
+    req.on("error", () => done({ kind: "unreachable" }));
+    if (payload !== void 0) req.write(payload);
+    req.end();
+  });
+}
+async function callPresence(method, path5, body, options = {}) {
+  const endpoint = resolveEndpoint(options);
+  if (endpoint === null) return { kind: "not-configured" };
+  return send(endpoint.info.port, endpoint.token, method, path5, body, options);
+}
+
+// src/modules/presence/mcp.ts
+import { createInterface } from "readline";
+
+// src/modules/presence/reporter.ts
+import { basename as basename5, dirname as dirname14 } from "path";
+
+// src/modules/presence/agent.ts
+async function v2Profiles(targetDir, homeDir) {
+  try {
+    const { agents } = await collectAgents(targetDir, homeDir === void 0 ? {} : { homeDir });
+    if (agents === null) return [];
+    return agents.entries.map((e) => ({
+      ref: null,
+      slug: e.id,
+      name: e.name,
+      origin: e.origin,
+      definition_revision: e.definition_revision,
+      aliases: [],
+      definition: e.definition
+    }));
+  } catch {
+    return [];
+  }
+}
+function matchAgent(profiles, value) {
+  const bySlug = profiles.filter((p) => p.slug === value);
+  if (bySlug.length === 1) return bySlug[0] ?? null;
+  if (bySlug.length > 1) return null;
+  const byAlias = profiles.filter((p) => p.aliases.some((a) => a.value === value));
+  return byAlias.length === 1 ? byAlias[0] ?? null : null;
+}
+function defaultAgent(profiles) {
+  const orchestrators = profiles.filter((p) => p.definition === "orchestrator");
+  return orchestrators.length === 1 ? orchestrators[0] ?? null : null;
+}
+function toAgentBlock(profile) {
+  if (profile === null) return nullAgentBlock();
+  return {
+    ref: profile.ref,
+    slug: profile.slug,
+    name: profile.name,
+    origin: profile.origin,
+    definition_revision: profile.definition_revision,
+    aliases: profile.aliases.map((a) => ({ value: a.value, context: a.context }))
+  };
+}
+async function resolveSessionAgent(targetDir, agentFlag, deps = {}) {
+  const provider = deps.profiles ?? ((dir) => v2Profiles(dir, deps.homeDir));
+  let profiles;
+  try {
+    profiles = await provider(targetDir);
+  } catch {
+    return nullAgentBlock();
+  }
+  return toAgentBlock(agentFlag === void 0 ? defaultAgent(profiles) : matchAgent(profiles, agentFlag));
+}
+
+// src/modules/presence/harness.ts
+var HARNESS_TABLE = [
+  // Observed 2026-11-05 in Claude Code 2.1.81 (desktop app 4.16336.0) on macOS; progress.txt, PS-10.
+  { harness: "claude-code", variable: "CLAUDECODE", value: "1" },
+  // Observed 2026-11-05 in Codex 0.166.0-alpha.5.1, both the ChatGPT desktop app and `codex exec`; progress.txt.
+  { harness: "codex", variable: "CODEX_CI", value: "1" },
+  // Observed 2026-11-05 in Copilot agent mode in VS Code 1.143.1; progress.txt.
+  { harness: "copilot", variable: "COPILOT_AGENT", value: "1" },
+  // Observed 2026-11-05 in the GitHub Copilot desktop app 1.1.34; progress.txt.
+  { harness: "copilot", variable: "COPILOT_CLI", value: "1" }
+];
+function detectHarness(env) {
+  for (const row of HARNESS_TABLE) if (env[row.variable] === row.value) return row.harness;
+  return "other";
+}
+
+// src/modules/presence/reporter.ts
+var NEEDS_YOU_SEPARATOR = " \u2014 ";
+function parseNeedsYou(line2) {
+  const at = line2.indexOf(NEEDS_YOU_SEPARATOR);
+  if (at < 0) return { action: line2, reason: null };
+  return { action: line2.slice(0, at), reason: line2.slice(at + NEEDS_YOU_SEPARATOR.length) };
+}
+async function quiet(fn) {
+  try {
+    return await fn();
+  } catch {
+    return null;
+  }
+}
+async function locateCheckout(cwd, deps = {}) {
+  const git = deps.runGit ?? runGit;
+  const out = await quiet(() => git(cwd, ["rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir"]));
+  const lines = out?.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean) ?? [];
+  if (lines.length !== 3) return null;
+  const [top, gitDir, commonDir] = lines;
+  return { checkout: resolveRealPath(top), gitDir: resolveRealPath(gitDir), commonDir: resolveRealPath(commonDir) };
+}
+async function locate(cwd, deps) {
+  const found = await locateCheckout(cwd, deps);
+  if (found === null) return null;
+  const git = deps.runGit ?? runGit;
+  const readManifest2 = deps.readManifest ?? readManifest;
+  const [manifest, symbolic, remote] = await Promise.all([
+    quiet(() => readManifest2(found.checkout)),
+    quiet(() => git(found.checkout, ["symbolic-ref", "--short", "-q", "HEAD"])),
+    quiet(() => git(found.checkout, ["remote", "get-url", "origin"]))
+  ]);
+  if (manifest === null) return null;
+  let branch = symbolic?.stdout.trim() || null;
+  if (branch === null) branch = (await quiet(() => git(found.checkout, ["rev-parse", "--short", "HEAD"])))?.stdout.trim() || null;
+  const root = basename5(found.commonDir) === ".git" ? dirname14(found.commonDir) : found.checkout;
+  const url = remote?.stdout.trim() ?? "";
+  return {
+    repository: { root, name: basename5(root), remote: url === "" ? null : { provider: remoteProvider(url), url: stripUserinfo(url) } },
+    checkout: { path: found.checkout, branch, linked_worktree: found.gitDir !== found.commonDir }
+  };
+}
+function refusedLine(verb, result) {
+  const detail = [result.code, result.field].filter((v) => v !== null).join(" ");
+  return `spell presence ${verb}: the presence service refused it (HTTP ${result.status}${detail === "" ? "" : `, ${detail}`}).`;
+}
+async function sendReport(cwd, flags, deps = {}) {
+  const endpoint = resolveEndpoint(deps);
+  if (endpoint === null) return { kind: "silent" };
+  const located = await locate(cwd, deps);
+  if (located === null) return { kind: "silent" };
+  const env = deps.env ?? process.env;
+  const resolveAgent = deps.resolveAgent ?? ((dir, flag) => resolveSessionAgent(dir, flag));
+  const agent2 = await quiet(() => resolveAgent(located.checkout.path, flags.agent)) ?? nullAgentBlock();
+  const harness = flags.harness ?? (deps.detectHarness ?? detectHarness)(env);
+  const body = {
+    status: flags.status,
+    harness,
+    agent: agent2,
+    repository: located.repository,
+    checkout: located.checkout,
+    needs_you: (flags.needsYou ?? []).map(parseNeedsYou)
+  };
+  if (flags.spell !== void 0) body["spell"] = flags.spell;
+  if (flags.task !== void 0) body["task"] = flags.task;
+  if (flags.message !== void 0) body["message"] = flags.message === "" ? null : flags.message;
+  const result = await send(endpoint.info.port, endpoint.token, "POST", "/v0/sessions/report", body, deps);
+  if (result.kind === "ok") return { kind: "sent", record: result.body };
+  if (result.kind === "refused") return { kind: "refused", line: refusedLine("report", result) };
+  return { kind: "silent" };
+}
+async function sendEnd(cwd, deps = {}) {
+  const endpoint = resolveEndpoint(deps);
+  if (endpoint === null) return { kind: "silent" };
+  const found = await locateCheckout(cwd, deps);
+  if (found === null) return { kind: "silent" };
+  const result = await send(endpoint.info.port, endpoint.token, "POST", "/v0/sessions/end", { checkout: { path: found.checkout } }, deps);
+  if (result.kind === "ok") return { kind: "sent", record: result.body };
+  if (result.kind === "refused" && result.status !== 404) return { kind: "refused", line: refusedLine("end", result) };
+  return { kind: "silent" };
+}
+
+// src/modules/presence/mcp.ts
+var MODERN_VERSIONS = ["2026-07-28"];
+var LEGACY_VERSIONS = ["2025-11-25", "2025-06-18", "2024-11-05"];
+var SUPPORTED_VERSIONS = [...MODERN_VERSIONS, ...LEGACY_VERSIONS];
+var SERVER_NAME = "arcane-presence";
+var NOT_CONFIGURED_TEXT = "no presence channel is configured on this machine";
+var VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
+var SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
+var SESSIONS_URI = "arcane://presence/sessions";
+var CAPABILITIES_URI = "arcane://presence/capabilities";
+var SERVER_CAPABILITIES = { tools: {}, resources: {} };
+var LINE = { type: "string", maxLength: 256 };
+var PRESENCE_TOOLS = [
+  {
+    name: "presence_report",
+    title: "Report presence",
+    description: "Report this session to the local presence service (the same as `spell presence report`). Observation only: it changes what a dashboard shows, nothing else. Answers that no channel is configured when no service runs.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      required: ["status"],
+      properties: {
+        status: { type: "string", enum: [...REPORT_STATUSES] },
+        task: { ...LINE, description: "What the session is doing, in one line." },
+        spell: { ...LINE, description: "The spell running, e.g. spell-implement." },
+        message: { ...LINE, description: "A free one-line note; an empty string clears it." },
+        needs_you: { type: "array", maxItems: 20, items: { type: "string" }, description: "Lines of a Needs you block, '<action> \u2014 <reason>'." },
+        agent: { type: "string", description: "The roster agent (a slug or an alias); default: the orchestrator." },
+        harness: { type: "string", enum: [...HARNESSES] },
+        cwd: { type: "string", description: "The checkout to report for; default: the server's working directory." }
+      }
+    }
+  },
+  {
+    name: "presence_end",
+    title: "End presence",
+    description: "End this checkout's session on the local presence service (the same as `spell presence end`).",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: { cwd: { type: "string", description: "The checkout; default: the server's working directory." } }
+    }
+  }
+];
+var PRESENCE_RESOURCES = [
+  { uri: SESSIONS_URI, name: "presence-sessions", title: "Presence sessions", description: "The GET /v0/sessions document: every active and stale session.", mimeType: "application/json" },
+  { uri: CAPABILITIES_URI, name: "presence-capabilities", title: "Presence capabilities", description: "The capability descriptor: observation only, no actions.", mimeType: "application/json" }
+];
+var RpcError = class extends Error {
+  constructor(code, message, data) {
+    super(message);
+    this.code = code;
+    this.data = data;
+  }
+  code;
+  data;
+};
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function text(value, isError = false) {
+  return { content: [{ type: "text", text: value }], isError };
+}
+function stringArg(args, key) {
+  const v = args[key];
+  if (v === void 0) return void 0;
+  if (typeof v !== "string") throw new RpcError(-32602, `${key} must be a string`);
+  return v;
+}
+function serveMcp(options) {
+  const deps = options.deps ?? {};
+  const cwd = options.cwd ?? process.cwd();
+  const log = options.log ?? ((line2) => process.stderr.write(`${line2}
+`));
+  const write = (message) => {
+    options.output.write(`${JSON.stringify(message)}
+`);
+  };
+  const reply = (id, result) => write({ jsonrpc: "2.0", id, result });
+  const fail = (id, error2) => write({ jsonrpc: "2.0", id, error: error2 });
+  const report = async (args) => {
+    const status = stringArg(args, "status");
+    if (status === void 0) return text("status is required: one of working, waiting, blocked, idle.", true);
+    const needs = args["needs_you"];
+    if (needs !== void 0 && (!Array.isArray(needs) || needs.some((n) => typeof n !== "string"))) {
+      return text("needs_you must be a list of strings.", true);
+    }
+    const flags = { status };
+    for (const key of ["task", "spell", "message", "agent", "harness"]) {
+      const v = stringArg(args, key);
+      if (v !== void 0) flags[key] = v;
+    }
+    if (Array.isArray(needs)) flags.needsYou = needs;
+    if (resolveEndpoint(deps) === null) return text(NOT_CONFIGURED_TEXT);
+    const where = stringArg(args, "cwd") ?? cwd;
+    const outcome = await sendReport(where, flags, deps);
+    if (outcome.kind === "refused") return text(outcome.line, true);
+    if (outcome.kind === "silent") return text(`Nothing was reported: ${where} is not inside an Arcane repository, or the service did not answer.`);
+    const record = outcome.record;
+    return { ...text(`Reported ${record.status} for ${record.session}.`), structuredContent: record };
+  };
+  const end = async (args) => {
+    if (resolveEndpoint(deps) === null) return text(NOT_CONFIGURED_TEXT);
+    const where = stringArg(args, "cwd") ?? cwd;
+    const outcome = await sendEnd(where, deps);
+    if (outcome.kind === "refused") return text(outcome.line, true);
+    if (outcome.kind === "silent") return text(`No session was open for ${where}.`);
+    return { ...text(`Ended ${outcome.record.session}.`), structuredContent: outcome.record };
+  };
+  const read = async (uri) => {
+    const resource = PRESENCE_RESOURCES.find((r) => r.uri === uri);
+    if (resource === void 0) throw new RpcError(-32602, "Resource not found", { uri });
+    const result = await callPresence("GET", resource.uri === SESSIONS_URI ? "/v0/sessions" : "/v0/health", void 0, deps);
+    if (result.kind !== "ok") return { contents: [{ uri: resource.uri, mimeType: "text/plain", text: NOT_CONFIGURED_TEXT }] };
+    const body = resource.uri === SESSIONS_URI ? result.body : result.body.capabilities;
+    return { contents: [{ uri: resource.uri, mimeType: "application/json", text: JSON.stringify(body) }] };
+  };
+  const handle = async (method, params) => {
+    switch (method) {
+      case "ping":
+        return {};
+      case "tools/list":
+        return { tools: PRESENCE_TOOLS };
+      case "tools/call": {
+        const name = params["name"];
+        const args = isObject(params["arguments"]) ? params["arguments"] : {};
+        try {
+          if (name === "presence_report") return await report(args);
+          if (name === "presence_end") return await end(args);
+        } catch (error2) {
+          if (error2 instanceof RpcError && error2.code === -32602) return text(error2.message, true);
+          throw error2;
+        }
+        throw new RpcError(-32602, `Unknown tool: ${String(name)}`);
+      }
+      case "resources/list":
+        return { resources: PRESENCE_RESOURCES };
+      case "resources/read":
+        return read(params["uri"]);
+      default:
+        throw new RpcError(-32601, `Method not found: ${method}`);
+    }
+  };
+  const dispatch = async (raw) => {
+    let message;
+    try {
+      message = JSON.parse(raw);
+    } catch {
+      fail(null, { code: -32700, message: "Parse error" });
+      return;
+    }
+    if (!isObject(message) || message["jsonrpc"] !== "2.0" || typeof message["method"] !== "string") {
+      const id2 = isObject(message) && (typeof message["id"] === "string" || typeof message["id"] === "number") ? message["id"] : null;
+      fail(id2, { code: -32600, message: "Invalid Request" });
+      return;
+    }
+    const method = message["method"];
+    const hasId = "id" in message;
+    const rawId = message["id"];
+    if (hasId && rawId !== null && typeof rawId !== "string" && typeof rawId !== "number") {
+      fail(null, { code: -32600, message: "Invalid Request" });
+      return;
+    }
+    const id = rawId ?? null;
+    const params = isObject(message["params"]) ? message["params"] : {};
+    if (!hasId) return;
+    try {
+      if (method === "initialize") {
+        const requested2 = params["protocolVersion"];
+        const protocolVersion = typeof requested2 === "string" && LEGACY_VERSIONS.includes(requested2) ? requested2 : LEGACY_VERSIONS[0];
+        reply(id, { protocolVersion, capabilities: SERVER_CAPABILITIES, serverInfo: { name: SERVER_NAME, version: options.version } });
+        return;
+      }
+      const meta = isObject(params["_meta"]) ? params["_meta"] : {};
+      const requested = meta[VERSION_KEY];
+      const modern = typeof requested === "string" && MODERN_VERSIONS.includes(requested);
+      if (requested !== void 0 && (typeof requested !== "string" || !SUPPORTED_VERSIONS.includes(requested))) {
+        fail(id, { code: -32022, message: "Unsupported protocol version", data: { supported: SUPPORTED_VERSIONS, requested } });
+        return;
+      }
+      if (method === "server/discover") {
+        reply(id, { resultType: "complete", supportedVersions: SUPPORTED_VERSIONS, capabilities: SERVER_CAPABILITIES, _meta: { [SERVER_INFO_KEY]: { name: SERVER_NAME, version: options.version } } });
+        return;
+      }
+      const result = await handle(method, params);
+      reply(id, modern ? { resultType: "complete", ...result } : result);
+    } catch (error2) {
+      if (error2 instanceof RpcError) {
+        fail(id, error2.data === void 0 ? { code: error2.code, message: error2.message } : { code: error2.code, message: error2.message, data: error2.data });
+      } else {
+        log(`spell presence mcp: internal error on ${method}`);
+        fail(id, { code: -32603, message: "Internal error" });
+      }
+    }
+  };
+  return new Promise((resolve10) => {
+    const lines = createInterface({ input: options.input, crlfDelay: Infinity });
+    let chain = Promise.resolve();
+    lines.on("line", (line2) => {
+      if (line2.trim() === "") return;
+      chain = chain.then(() => dispatch(line2));
+    });
+    lines.on("close", () => {
+      void chain.then(() => resolve10());
+    });
+  });
+}
+
+// src/modules/presence/log.ts
+var EVENT = /^[a-z]+(\.[a-z_]+)*$/;
+var SESSION = /^arcane:session:[0-9a-f-]{36}$/;
+var STATUS = /^[a-z]+$/;
+var sink = (line2) => {
+  process.stderr.write(`${line2}
+`);
+};
+function logEvent(event, session, status) {
+  const e = EVENT.test(event) ? event : "-";
+  const s = session !== null && SESSION.test(session) ? session : "-";
+  const st = status !== null && STATUS.test(status) ? status : "-";
+  sink(`${(/* @__PURE__ */ new Date()).toISOString()} presence ${e} ${s} ${st}`);
+}
+
+// src/modules/presence/server.ts
+import { createServer as createServer2 } from "http";
+
+// src/modules/presence/auth.ts
+import { createHash as createHash6, timingSafeEqual } from "crypto";
+var BEARER = /^Bearer ([^\s]+)$/;
+function digest(value) {
+  return createHash6("sha256").update(value, "utf8").digest();
+}
+function checkBearer(header, token) {
+  if (typeof header !== "string" || token.length === 0) return false;
+  const match2 = BEARER.exec(header);
+  if (match2 === null) return false;
+  return timingSafeEqual(digest(match2[1]), digest(token));
+}
+
+// src/modules/presence/validate.ts
+var Refusal = class extends Error {
+  constructor(code, field, message) {
+    super(message);
+    this.code = code;
+    this.field = field;
+  }
+  code;
+  field;
+};
+var AGENT_REF = /^arcane:agent:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var REVISION = /^sha256:[0-9a-f]{64}$/;
+var CONTROL = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029]", "g");
+function oneLine(value) {
+  const flat = value.replace(CONTROL, " ");
+  const points = Array.from(flat);
+  return points.length > MAX_LINE_CHARS ? points.slice(0, MAX_LINE_CHARS).join("") : flat;
+}
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function closed(value, field, required, optional = []) {
+  if (!isObject2(value)) throw new Refusal("invalid_field", field, `${field ?? "the body"} must be an object`);
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new Refusal("unknown_field", join30(field, key), `${join30(field, key)} is not a field of this contract`);
+  }
+  for (const key of required) {
+    if (!(key in value)) throw new Refusal("missing_field", join30(field, key), `${join30(field, key)} is required`);
+  }
+  return value;
+}
+function join30(parent, key) {
+  return parent === void 0 ? key : `${parent}.${key}`;
+}
+function nonEmpty(value, field) {
+  if (typeof value !== "string" || value.length === 0) throw new Refusal("invalid_field", field, `${field} must be a non-empty string`);
+  return value;
+}
+function line(value, field, nullable) {
+  if (value === null && nullable) return null;
+  if (typeof value !== "string") throw new Refusal("invalid_field", field, `${field} must be a string${nullable ? " or null" : ""}`);
+  return oneLine(value);
+}
+function nonEmptyLine(value, field) {
+  const out = line(value, field, false);
+  if (out.trim().length === 0) throw new Refusal("invalid_field", field, `${field} must not be empty`);
+  return out;
+}
+function oneOf(value, allowed, field) {
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    throw new Refusal("invalid_field", field, `${field} must be one of ${allowed.join(", ")}`);
+  }
+  return value;
+}
+function agent(value) {
+  const a = closed(value, "agent", ["ref", "slug", "name", "origin", "definition_revision", "aliases"]);
+  if (a["ref"] !== null && (typeof a["ref"] !== "string" || !AGENT_REF.test(a["ref"]))) {
+    throw new Refusal("invalid_field", "agent.ref", "agent.ref must be an arcane:agent: reference or null");
+  }
+  if (a["origin"] !== null && a["origin"] !== "repo" && a["origin"] !== "user") {
+    throw new Refusal("invalid_field", "agent.origin", "agent.origin must be repo, user or null");
+  }
+  if (a["definition_revision"] !== null && (typeof a["definition_revision"] !== "string" || !REVISION.test(a["definition_revision"]))) {
+    throw new Refusal("invalid_field", "agent.definition_revision", "agent.definition_revision must be sha256:<64 hex> or null");
+  }
+  if (!Array.isArray(a["aliases"])) throw new Refusal("invalid_field", "agent.aliases", "agent.aliases must be a list");
+  if (a["aliases"].length > MAX_ALIASES) throw new Refusal("invalid_field", "agent.aliases", `agent.aliases carries at most ${MAX_ALIASES} entries`);
+  const aliases = a["aliases"].map((item, i) => {
+    const field = `agent.aliases.${i}`;
+    const alias = closed(item, field, ["value", "context"]);
+    return { value: nonEmptyLine(alias["value"], `${field}.value`), context: oneOf(alias["context"], ALIAS_CONTEXTS, `${field}.context`) };
+  });
+  return {
+    ref: a["ref"],
+    slug: line(a["slug"], "agent.slug", true),
+    name: line(a["name"], "agent.name", true),
+    origin: a["origin"],
+    definition_revision: a["definition_revision"],
+    aliases
+  };
+}
+function repository(value) {
+  const r = closed(value, "repository", ["root", "name", "remote"]);
+  let remote = null;
+  if (r["remote"] !== null) {
+    const rem = closed(r["remote"], "repository.remote", ["provider", "url"]);
+    if (typeof rem["url"] !== "string") throw new Refusal("invalid_field", "repository.remote.url", "repository.remote.url must be a string");
+    remote = { provider: oneOf(rem["provider"], ["github", "ado", "other"], "repository.remote.provider"), url: rem["url"] };
+  }
+  return { root: nonEmpty(r["root"], "repository.root"), name: nonEmptyLine(r["name"], "repository.name"), remote };
+}
+function checkout(value) {
+  const c = closed(value, "checkout", ["path", "branch", "linked_worktree"]);
+  if (typeof c["linked_worktree"] !== "boolean") {
+    throw new Refusal("invalid_field", "checkout.linked_worktree", "checkout.linked_worktree must be true or false");
+  }
+  return { path: nonEmpty(c["path"], "checkout.path"), branch: line(c["branch"], "checkout.branch", true), linked_worktree: c["linked_worktree"] };
+}
+function needsYou(value) {
+  if (!Array.isArray(value)) throw new Refusal("invalid_field", "needs_you", "needs_you must be a list");
+  if (value.length > MAX_NEEDS_YOU) {
+    throw new Refusal("too_many_lines", "needs_you", `needs_you carries at most ${MAX_NEEDS_YOU} lines; ${value.length} were sent`);
+  }
+  return value.map((item, i) => {
+    const field = `needs_you.${i}`;
+    const n = closed(item, field, ["action", "reason"]);
+    return { action: nonEmptyLine(n["action"], `${field}.action`), reason: line(n["reason"], `${field}.reason`, true) };
+  });
+}
+function refuse(fn) {
+  try {
+    return { ok: true, value: fn() };
+  } catch (error2) {
+    if (error2 instanceof Refusal) {
+      return error2.field === void 0 ? { ok: false, code: error2.code, message: error2.message } : { ok: false, code: error2.code, field: error2.field, message: error2.message };
+    }
+    throw error2;
+  }
+}
+function validateReport(value) {
+  return refuse(() => {
+    const b = closed(value, void 0, ["status", "harness", "agent", "repository", "checkout"], ["spell", "task", "message", "needs_you"]);
+    if (b["status"] === "done") {
+      throw new Refusal("invalid_field", "status", "status done is set by ending a session: use POST /v0/sessions/end (spell presence end)");
+    }
+    const out = {
+      status: oneOf(b["status"], REPORT_STATUSES, "status"),
+      harness: oneOf(b["harness"], HARNESSES, "harness"),
+      agent: agent(b["agent"]),
+      repository: repository(b["repository"]),
+      checkout: checkout(b["checkout"])
+    };
+    for (const key of ["spell", "task", "message"]) {
+      if (key in b) out[key] = line(b[key], key, true);
+    }
+    if ("needs_you" in b) out.needs_you = needsYou(b["needs_you"]);
+    return out;
+  });
+}
+function validateEnd(value) {
+  return refuse(() => {
+    const b = closed(value, void 0, ["checkout"]);
+    const c = closed(b["checkout"], "checkout", ["path"]);
+    return { checkout: { path: nonEmpty(c["path"], "checkout.path") } };
+  });
+}
+
+// src/modules/presence/server.ts
+var PRESENCE_ROUTES = [
+  ["GET", "/v0/health"],
+  ["POST", "/v0/sessions/report"],
+  ["POST", "/v0/sessions/end"],
+  ["GET", "/v0/sessions"],
+  ["GET", "/v0/sessions/{session}"],
+  ["GET", "/v0/events"]
+];
+var JSON_HEADERS = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Cache-Control": "no-store",
+  "X-Content-Type-Options": "nosniff"
+};
+function send2(res, status, body, extra = {}) {
+  const text2 = `${JSON.stringify(body)}
+`;
+  res.writeHead(status, { ...JSON_HEADERS, "Content-Length": Buffer.byteLength(text2), ...extra });
+  res.end(text2);
+}
+function error(res, status, code, message, field, extra = {}) {
+  const body = { error: field === void 0 ? { code, message } : { code, field, message } };
+  send2(res, status, body, extra);
+}
+function unauthorized(res) {
+  res.writeHead(401, { "Content-Length": 0, "WWW-Authenticate": "Bearer", "Cache-Control": "no-store", Connection: "close" });
+  res.end();
+}
+function readBody(req, res) {
+  return new Promise((resolve10) => {
+    const tooLarge = () => {
+      error(res, 413, "too_large", `bodies are limited to ${MAX_BODY_BYTES} bytes`, void 0, { Connection: "close" });
+      req.resume();
+      resolve10(null);
+    };
+    const declared = Number(req.headers["content-length"] ?? "0");
+    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+      tooLarge();
+      return;
+    }
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    req.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        done = true;
+        tooLarge();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (done) return;
+      done = true;
+      resolve10(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", () => {
+      if (done) return;
+      done = true;
+      resolve10(null);
+    });
+  });
+}
+function parseJson(text2) {
+  try {
+    return { ok: true, value: JSON.parse(text2) };
+  } catch {
+    return { ok: false };
+  }
+}
+function match(method, pathname) {
+  const allow = [];
+  for (const route of PRESENCE_ROUTES) {
+    const [m, pattern] = route;
+    let param;
+    let hit = pattern === pathname;
+    if (!hit && pattern.endsWith("/{session}")) {
+      const prefix = pattern.slice(0, -"{session}".length);
+      const rest = pathname.startsWith(prefix) ? pathname.slice(prefix.length) : "";
+      if (rest.length > 0 && !rest.includes("/") && !PRESENCE_ROUTES.some(([, p]) => p === pathname)) {
+        hit = true;
+        try {
+          param = decodeURIComponent(rest);
+        } catch {
+          param = "";
+        }
+      }
+    }
+    if (!hit) continue;
+    if (m === method) return param === void 0 ? { route } : { route, param };
+    allow.push(m);
+  }
+  return allow.length > 0 ? { allow } : null;
+}
+function createPresenceServer(options) {
+  const now = options.now ?? Date.now;
+  const keepaliveMs = options.keepaliveMs ?? KEEPALIVE_MS;
+  const maxSubscribers = options.maxSubscribers ?? MAX_SUBSCRIBERS;
+  const { table } = options;
+  const token = typeof options.token === "function" ? options.token : () => options.token;
+  const feeds = /* @__PURE__ */ new Set();
+  table.listen((e) => logEvent(e.event, e.data.session, e.data.status));
+  const health = () => ({
+    ok: true,
+    generator: options.generator,
+    contract: PRESENCE_CONTRACT,
+    capabilities: presenceCapabilities(),
+    sessions: table.count(),
+    started_at: options.startedAt
+  });
+  const snapshot = () => ({
+    capabilities: presenceCapabilities(),
+    generated_at: new Date(now()).toISOString(),
+    sessions: table.snapshot()
+  });
+  const writeEvent = (res, name, data) => {
+    if (res.writableLength > MAX_SUBSCRIBER_BUFFER_BYTES) {
+      res.destroy();
+      feeds.delete(res);
+      return;
+    }
+    res.write(`event: ${name}
+data: ${JSON.stringify(data)}
+
+`);
+  };
+  table.listen((e) => {
+    for (const feed of feeds) writeEvent(feed, e.event, e.data);
+  });
+  const events = (req, res) => {
+    if (feeds.size >= maxSubscribers) {
+      error(res, 503, "too_many_subscribers", `at most ${maxSubscribers} event feeds are served at once`, void 0, { "Retry-After": "5" });
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-store",
+      "X-Content-Type-Options": "nosniff",
+      Connection: "keep-alive"
+    });
+    feeds.add(res);
+    const hello = { contract: PRESENCE_CONTRACT, capabilities: presenceCapabilities(), sessions: table.snapshot() };
+    res.write(`event: ${HELLO_EVENT}
+data: ${JSON.stringify(hello)}
+
+`);
+    const keepalive = setInterval(() => res.write(": keepalive\n\n"), keepaliveMs);
+    keepalive.unref();
+    const drop = () => {
+      clearInterval(keepalive);
+      feeds.delete(res);
+    };
+    req.on("close", drop);
+    res.on("close", drop);
+  };
+  const handle = async (req, res) => {
+    if (!checkBearer(req.headers.authorization, token())) {
+      unauthorized(res);
+      req.resume();
+      return;
+    }
+    const pathname = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+    const found = match(req.method ?? "GET", pathname);
+    if (found === null) {
+      error(res, 404, "not_found", "no such route");
+      req.resume();
+      return;
+    }
+    if ("allow" in found) {
+      error(res, 405, "method_not_allowed", `use ${found.allow.join(", ")}`, void 0, { Allow: found.allow.join(", ") });
+      req.resume();
+      return;
+    }
+    const path5 = found.route[1];
+    if (path5 === "/v0/health") return send2(res, 200, health());
+    if (path5 === "/v0/sessions") return send2(res, 200, snapshot());
+    if (path5 === "/v0/events") return events(req, res);
+    if (path5 === "/v0/sessions/{session}") {
+      const parsed = parseRef(found.param, "session");
+      const record = parsed.ok ? table.get(found.param ?? "") : null;
+      if (record === null) return error(res, 404, "not_found", "no such session");
+      return send2(res, 200, record);
+    }
+    const text2 = await readBody(req, res);
+    if (text2 === null) return;
+    const json = parseJson(text2);
+    if (!json.ok) return error(res, 400, "invalid_json", "the body is not valid JSON");
+    if (path5 === "/v0/sessions/report") {
+      const result2 = validateReport(json.value);
+      if (!result2.ok) return error(res, 400, result2.code, result2.message, result2.field);
+      const isNew = table.snapshot().every((r) => r.checkout.path !== result2.value.checkout.path);
+      if (isNew && table.count() >= MAX_SESSIONS) {
+        return error(res, 503, "too_many_sessions", `at most ${MAX_SESSIONS} sessions are held at once`, void 0, { "Retry-After": "60" });
+      }
+      const { record, created } = table.report(result2.value);
+      return send2(res, created ? 201 : 200, record);
+    }
+    const result = validateEnd(json.value);
+    if (!result.ok) return error(res, 400, result.code, result.message, result.field);
+    const ended = table.end(result.value.checkout.path);
+    if (ended === null) return error(res, 404, "not_found", "no session reports from that checkout", "checkout.path");
+    return send2(res, 200, ended);
+  };
+  const server = createServer2({ connectionsCheckingInterval: CONNECTIONS_CHECK_MS }, (req, res) => {
+    handle(req, res).catch(() => {
+      if (!res.headersSent) error(res, 500, "internal", "the service could not answer");
+      else res.destroy();
+    });
+  });
+  server.maxConnections = MAX_CONNECTIONS;
+  server.headersTimeout = HEADERS_TIMEOUT_MS;
+  server.requestTimeout = REQUEST_TIMEOUT_MS;
+  return {
+    server,
+    closeFeeds() {
+      for (const feed of feeds) feed.end();
+      feeds.clear();
+    },
+    subscriberCount() {
+      return feeds.size;
+    }
+  };
+}
+
+// src/modules/presence/sessions.ts
+function copy(record) {
+  return structuredClone(record);
+}
+function sameNeedsYou(a, b) {
+  if (a.length !== b.length) return false;
+  return a.every((item, i) => item.action === b[i]?.action && item.reason === b[i]?.reason);
+}
+function byStart(a, b) {
+  if (a.started_at !== b.started_at) return a.started_at < b.started_at ? -1 : 1;
+  if (a.session === b.session) return 0;
+  return a.session < b.session ? -1 : 1;
+}
+function createSessionTable(options) {
+  const now = options.now ?? Date.now;
+  const staleAfterMs = options.staleAfterMs ?? STALE_AFTER_MS;
+  const expireAfterMs = options.expireAfterMs ?? EXPIRE_AFTER_MS;
+  const entries = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  const emit = (name, record) => {
+    const event = { event: name, data: copy(record) };
+    for (const listener of listeners) listener({ event: name, data: copy(record) });
+    return event;
+  };
+  return {
+    report(body) {
+      const ms = now();
+      const at = new Date(ms).toISOString();
+      const key = body.checkout.path;
+      const needsYou2 = (body.needs_you ?? []).map((n) => ({ action: n.action, reason: n.reason }));
+      const existing = entries.get(key);
+      if (existing === void 0) {
+        const record2 = {
+          session: options.mint(),
+          agent: structuredClone(body.agent),
+          harness: body.harness,
+          repository: structuredClone(body.repository),
+          checkout: structuredClone(body.checkout),
+          spell: body.spell ?? null,
+          task: body.task ?? null,
+          message: body.message ?? null,
+          status: body.status,
+          needs_you: needsYou2,
+          started_at: at,
+          reported_at: at,
+          ended_at: null,
+          stale: false
+        };
+        entries.set(key, { record: record2, reportedMs: ms });
+        emit("session.started", record2);
+        return { record: copy(record2), created: true, event: "session.started" };
+      }
+      const record = existing.record;
+      const wasStale = record.stale;
+      const needsChanged = !sameNeedsYou(record.needs_you, needsYou2);
+      record.agent = structuredClone(body.agent);
+      record.harness = body.harness;
+      record.repository = structuredClone(body.repository);
+      record.checkout = structuredClone(body.checkout);
+      if (body.spell !== void 0) record.spell = body.spell;
+      if (body.task !== void 0) record.task = body.task;
+      if (body.message !== void 0) record.message = body.message;
+      record.status = body.status;
+      record.needs_you = needsYou2;
+      record.reported_at = at;
+      record.stale = false;
+      existing.reportedMs = ms;
+      const event = wasStale ? "session.resumed" : needsChanged ? "session.needs_you" : "session.updated";
+      emit(event, record);
+      return { record: copy(record), created: false, event };
+    },
+    end(checkoutPath) {
+      const existing = entries.get(checkoutPath);
+      if (existing === void 0) return null;
+      entries.delete(checkoutPath);
+      const record = existing.record;
+      record.status = "done";
+      record.ended_at = new Date(now()).toISOString();
+      emit("session.ended", record);
+      return copy(record);
+    },
+    get(session) {
+      for (const { record } of entries.values()) if (record.session === session) return copy(record);
+      return null;
+    },
+    snapshot() {
+      return [...entries.values()].map((e) => copy(e.record)).sort(byStart);
+    },
+    count() {
+      return entries.size;
+    },
+    sweep() {
+      const ms = now();
+      const emitted = [];
+      for (const [key, entry] of [...entries.entries()]) {
+        const silent = ms - entry.reportedMs;
+        if (silent >= expireAfterMs) {
+          entries.delete(key);
+          entry.record.stale = true;
+          emitted.push(emit("session.expired", entry.record));
+        } else if (silent >= staleAfterMs && !entry.record.stale) {
+          entry.record.stale = true;
+          emitted.push(emit("session.stale", entry.record));
+        }
+      }
+      return emitted;
+    },
+    listen(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    }
+  };
+}
+
+// src/commands/presence.ts
+var NOT_CONFIGURED = "No presence channel is configured on this machine.";
+var consoleIo = {
+  out: (line2) => console.log(line2),
+  err: (line2) => console.error(line2)
+};
+function resolvePort(flag, env) {
+  const raw = flag ?? env[PRESENCE_ENV.port] ?? String(DEFAULT_PORT);
+  if (!/^\d+$/.test(raw.trim())) return null;
+  const port = Number(raw.trim());
+  return port >= 0 && port <= 65535 ? port : null;
+}
+var ServeError = class extends Error {
+};
+async function startPresenceService(options, context = {}) {
+  const env = context.env ?? process.env;
+  const store = context.store ?? {};
+  const port = resolvePort(options.port, env);
+  if (port === null) throw new ServeError(`The port must be a whole number from 0 to 65535 (--port or ${PRESENCE_ENV.port}).`);
+  let token = "";
+  const table = createSessionTable({ mint: mintSessionRef });
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const presence = createPresenceServer({
+    token: () => token,
+    table,
+    generator: { name: "arcane-cli", version: context.version ?? packageJson.version },
+    startedAt
+  });
+  const { server } = presence;
+  await new Promise((resolve10, reject) => {
+    const onError = (error2) => {
+      server.off("listening", onListening);
+      reject(
+        error2.code === "EADDRINUSE" ? new ServeError(`Port ${port} is already in use. Is a presence service already running? (spell presence status)`) : new ServeError(`Could not listen on ${LOOPBACK_HOST}:${port}: ${error2.message}`)
+      );
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve10();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, LOOPBACK_HOST);
+  });
+  const closeServer = () => new Promise((resolve10) => {
+    presence.closeFeeds();
+    server.closeAllConnections();
+    server.close(() => resolve10());
+  });
+  const actualPort = server.address().port;
+  const url = `http://${LOOPBACK_HOST}:${actualPort}`;
+  const recorded = readServerInfo(store);
+  if (recorded !== null && recorded.pid !== process.pid && pidAlive(recorded.pid)) {
+    const health = await callPresence("GET", "/v0/health", void 0, { ...store, env });
+    if (health.kind === "ok" || health.kind === "refused" && health.status === 401) {
+      await closeServer();
+      throw new ServeError(`A presence service is already running at ${recorded.url} (pid ${recorded.pid}). Stop it first: spell presence stop`);
+    }
+  }
+  try {
+    token = ensureToken({ ...store, rotate: options.rotate === true });
+    writeServerInfo({ url, pid: process.pid, port: actualPort, started_at: startedAt, generator: { name: "arcane-cli", version: context.version ?? packageJson.version } }, store);
+  } catch (error2) {
+    await closeServer();
+    throw new ServeError(error2 instanceof PresenceStoreError ? error2.message : `Could not write the presence store: ${String(error2)}`);
+  }
+  server.on("error", () => logEvent("server.error", null, null));
+  const sweep = setInterval(() => table.sweep(), SWEEP_MS);
+  sweep.unref();
+  let stopped = false;
+  return {
+    url,
+    port: actualPort,
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(sweep);
+      await closeServer();
+      const recorded2 = readServerInfo(store);
+      if (recorded2 !== null && recorded2.pid === process.pid && recorded2.started_at === startedAt) removeServerInfo(store);
+    }
+  };
+}
+async function runPresenceServe(options, io = consoleIo) {
+  let signalled = false;
+  let onSignal = () => {
+    signalled = true;
+  };
+  const handler = () => onSignal();
+  process.on("SIGINT", handler);
+  process.on("SIGTERM", handler);
+  const detach = () => {
+    process.off("SIGINT", handler);
+    process.off("SIGTERM", handler);
+  };
+  let service;
+  try {
+    service = await startPresenceService(options);
+  } catch (error2) {
+    detach();
+    io.err(error2 instanceof Error ? error2.message : String(error2));
+    process.exitCode = 1;
+    return;
+  }
+  io.out(`Presence service listening on ${service.url} (loopback only). Stop it with Ctrl+C or \`spell presence stop\`.`);
+  await new Promise((resolve10) => {
+    onSignal = () => {
+      detach();
+      void service.stop().then(() => {
+        io.out("Presence service stopped.");
+        resolve10();
+      });
+    };
+    if (signalled) onSignal();
+  });
+  process.exitCode = 0;
+}
+function isHealth(body) {
+  const b = body;
+  return b !== null && typeof b === "object" && b.ok === true && b.contract === "v0" && typeof b.started_at === "string";
+}
+async function runPresenceStatus(io = consoleIo, store = {}) {
+  const info = readServerInfo(store);
+  if (info === null) {
+    io.out(NOT_CONFIGURED);
+    return 1;
+  }
+  const result = await callPresence("GET", "/v0/health", void 0, store);
+  if (result.kind === "ok" && isHealth(result.body)) {
+    io.out(`Presence service: ${info.url}`);
+    io.out(`  pid:      ${info.pid}`);
+    io.out(`  version:  ${result.body.generator.version}`);
+    io.out(`  sessions: ${result.body.sessions}`);
+    return 0;
+  }
+  if (result.kind === "refused" && result.status === 401) {
+    io.out(`The presence service at ${info.url} refused this machine's token (rotated, or ${PRESENCE_ENV.token} is set to another value).`);
+    return 1;
+  }
+  io.out(`The presence service recorded at ${info.url} is not reachable.`);
+  return 1;
+}
+async function waitForExit(pid, ms) {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    if (!pidAlive(pid)) return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return !pidAlive(pid);
+}
+async function runPresenceStop(io = consoleIo, store = {}) {
+  const info = readServerInfo(store);
+  if (info === null) {
+    io.out("No presence service is running.");
+    return 0;
+  }
+  const result = await callPresence("GET", "/v0/health", void 0, store);
+  if (result.kind === "ok" && isHealth(result.body) && result.body.started_at === info.started_at) {
+    try {
+      process.kill(info.pid, "SIGTERM");
+    } catch {
+    }
+    if (!await waitForExit(info.pid, 3e3)) {
+      io.out(`Asked the presence service (pid ${info.pid}) to stop; it is still running after 3 s.`);
+      return 0;
+    }
+    const after = readServerInfo(store);
+    if (after !== null && after.started_at === info.started_at) removeServerInfo(store);
+    io.out(`Stopped the presence service (pid ${info.pid}).`);
+    return 0;
+  }
+  if (result.kind === "refused" && result.status === 401) {
+    io.out(`The presence service at ${info.url} refused this machine's token, so it was not stopped.`);
+    return 0;
+  }
+  if (result.kind === "not-configured" && pidAlive(info.pid)) {
+    io.out(`The presence service recorded at ${info.url} (pid ${info.pid}) is running, but there is no token here to confirm it, so it was not stopped.`);
+    return 0;
+  }
+  removeServerInfo(store);
+  io.out("No presence service was answering; removed its stale record.");
+  return 0;
+}
+var REPORT_DEADLINE_MS = 2e3;
+async function withDeadline(work, ms) {
+  let timer;
+  const deadline = new Promise((resolve10) => {
+    timer = setTimeout(() => resolve10({ outcome: null, timedOut: true }), ms);
+  });
+  const run = await Promise.race([work.then((outcome) => ({ outcome, timedOut: false })).catch(() => ({ outcome: null, timedOut: false })), deadline]);
+  clearTimeout(timer);
+  return run;
+}
+function finish(run, io) {
+  if (run.outcome?.kind === "refused") io.err(run.outcome.line);
+  return run;
+}
+async function runPresenceReport(cwd, flags, io = consoleIo, deps = {}, deadlineMs = REPORT_DEADLINE_MS) {
+  return finish(await withDeadline(sendReport(cwd, flags, deps), deadlineMs), io);
+}
+async function runPresenceEnd(cwd, io = consoleIo, deps = {}, deadlineMs = REPORT_DEADLINE_MS) {
+  return finish(await withDeadline(sendEnd(cwd, deps), deadlineMs), io);
+}
+async function runPresenceMcp() {
+  await serveMcp({ input: process.stdin, output: process.stdout, version: packageJson.version });
+}
+
 // src/index.ts
 import { realpathSync as realpathSync2 } from "fs";
-var require3 = createRequire3(import.meta.url);
-var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join29(dirname14(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join31(dirname15(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -10782,7 +12173,7 @@ function manifestFlagsFrom(opts) {
     subjectRoot: opts.subjectRoot
   };
 }
-program.name("spell").description("Arcane framework CLI \u2014 scaffold and manage governance files").version(pkg.version).action(async () => {
+program.name("spell").description("Arcane framework CLI \u2014 scaffold and manage governance files").version(packageJson.version).action(async () => {
   if (program.args.length > 0) {
     const [attempted] = program.args;
     console.error(`spell: unrecognized command '${attempted}'`);
@@ -10798,7 +12189,7 @@ program.name("spell").description("Arcane framework CLI \u2014 scaffold and mana
     process.exitCode = 1;
     return;
   }
-  await printWelcome(pkg.version, process.cwd());
+  await printWelcome(packageJson.version, process.cwd());
   program.outputHelp();
 });
 withManifestFlags(
@@ -10815,7 +12206,7 @@ withManifestFlags(
       },
       targetDirFor(opts),
       ASSETS_DIR,
-      pkg.version
+      packageJson.version
     );
   }
 );
@@ -10826,7 +12217,7 @@ program.command("add <components...>").description("Add one or more components t
       { force: opts.force, dryRun: opts.dryRun },
       process.cwd(),
       ASSETS_DIR,
-      pkg.version
+      packageJson.version
     );
   }
 );
@@ -10867,11 +12258,11 @@ withManifestFlags(
     },
     targetDirFor(opts),
     ASSETS_DIR,
-    pkg.version
+    packageJson.version
   );
 });
 program.command("status").description("Show installed components and check for updates").option("--user", USER_FLAG_DESCRIPTION).action(async (opts) => {
-  await runStatus(targetDirFor(opts), pkg.version, { user: opts.user });
+  await runStatus(targetDirFor(opts), packageJson.version, { user: opts.user });
 });
 program.command("state").description("Export this repository's Arcane state as one JSON document (schema https://arcaneai.net/schemas/state/v1)").option("--json", "Print the document to stdout (required; `spell status` is the human view)").option(
   "--online",
@@ -10880,7 +12271,7 @@ program.command("state").description("Export this repository's Arcane state as o
   "--include-local-paths",
   "Hub only: add each registered repository's clone path on this machine. Other machines' paths are never exported"
 ).action(async (opts) => {
-  await runState(process.cwd(), pkg.version, opts);
+  await runState(process.cwd(), packageJson.version, opts);
 });
 program.command("uninstall").description("Remove all installed Arcane framework files").option("--yes", "Skip confirmation prompt").option("--dry-run", "Preview what would be removed without deleting files").option("--user", USER_FLAG_DESCRIPTION).action(async (opts) => {
   await runUninstall({ yes: opts.yes, dryRun: opts.dryRun, user: opts.user }, targetDirFor(opts));
@@ -10906,7 +12297,7 @@ program.command("whoami").description("Show who is signed in; exits 1 when signe
 program.command("doctor").description("Check your environment for Arcane prerequisites").option("--fix", "Automatically create missing session continuity files").option("--leaks", "Run only the on-demand secrets/credential scan (ARC-037), skipping the default checks").action(async (opts) => {
   await runDoctor(
     process.cwd(),
-    { fix: opts.fix, leaks: opts.leaks, packageVersion: pkg.version },
+    { fix: opts.fix, leaks: opts.leaks, packageVersion: packageJson.version },
     ASSETS_DIR
   );
 });
@@ -10978,6 +12369,33 @@ agentsCommand.command("list").description("Show the current agent roster with as
   const scope = opts.user ? "user" : "repo";
   await runAgentsList(agentsTargetDir(scope, process.cwd()), scope);
 });
+var presenceCommand = program.command("presence").description("The local presence channel: which session works on what, right now (ARC-060). Loopback only; nothing runs until `serve`");
+presenceCommand.command("serve").description("Run the presence service in the foreground on 127.0.0.1 until Ctrl+C or `spell presence stop`").option("--port <port>", "Port on 127.0.0.1 (default 27226, or ARCANE_PRESENCE_PORT); 0 picks a free one").option("--rotate", "Replace the token in ~/.arcane/presence/token; every subscriber must re-read it").action(async (opts) => {
+  await runPresenceServe(opts);
+});
+presenceCommand.command("status").description("Say whether a presence service is running and answering this machine's token (exit 0) or not (exit 1)").action(async () => {
+  process.exitCode = await runPresenceStatus();
+});
+presenceCommand.command("stop").description("Stop the presence service this machine recorded; exits 0 whether or not one was running").action(async () => {
+  process.exitCode = await runPresenceStop();
+});
+function collectLine(value, previous) {
+  return [...previous, value];
+}
+var exitZero = () => process.exit(0);
+presenceCommand.command("report").description("Report this checkout's session to the presence service. Silent, exit 0, when no channel is configured; never blocks").requiredOption("--status <status>", "working | waiting | blocked | idle").option("--task <line>", "What the session is doing, in one line").option("--spell <id>", "The spell running, e.g. spell-implement").option("--message <line>", "A free one-line note; an empty value clears it").option("--needs-you <line>", "One line of a Needs you block, '<action> \u2014 <reason>'; repeat per line", collectLine, []).option("--agent <slug>", "The roster agent this session reports as (a slug or an alias); default: the orchestrator").option("--harness <id>", "claude-code | copilot | codex | openclaw | cron | other; default: detected, else other").exitOverride(exitZero).action(async (opts) => {
+  const run = await runPresenceReport(process.cwd(), opts);
+  process.exitCode = 0;
+  if (run.timedOut) process.exit(0);
+});
+presenceCommand.command("end").description("End this checkout's session on the presence service. Silent, exit 0, when there is none").exitOverride(exitZero).action(async () => {
+  const run = await runPresenceEnd(process.cwd());
+  process.exitCode = 0;
+  if (run.timedOut) process.exit(0);
+});
+presenceCommand.command("mcp").description("Serve the presence channel as an MCP server over stdio (two tools, two resources). Register it in your own client; Arcane writes no client configuration").action(async () => {
+  await runPresenceMcp();
+});
 if (realpathSync2(process.argv[1]) === fileURLToPath(import.meta.url)) {
   await program.parseAsync(process.argv);
 }