arcane-cli 1.18.0 → 1.19.0

package/dist/index.js

@@ -7639,7 +7639,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 
 // src/commands/doctor.ts
 import { access as access4, readdir as readdir11, readFile as readFile19, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
-import { join as join22, dirname as dirname11, resolve as resolve7 } from "path";
+import { join as join24, dirname as dirname12, resolve as resolve7 } from "path";
 
 // src/config/incidents.ts
 var INCIDENT_QUEUE = [
@@ -8086,1266 +8086,1817 @@ async function scanGovernancePlaceholders(governanceDir) {
   return { status: "scanned", runtimeTokens, activeDocs, templateDocs, findings };
 }
 
-// src/commands/doctor.ts
-function isRecord7(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function checkNodeVersion() {
-  const name = "Node.js version";
-  const raw = process.version;
-  const major = parseInt(raw.replace(/^v/, "").split(".")[0] ?? "0", 10);
-  if (major >= 18) {
-    return { name, passed: true, message: `${raw} (>=18 required)` };
+// src/modules/presence/client.ts
+import { request } from "http";
+
+// src/modules/presence/store.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join23, relative as relative2 } from "path";
+
+// src/modules/session-store.ts
+import { execFileSync } from "child_process";
+import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { userInfo } from "os";
+import { dirname as dirname11, join as join22 } from "path";
+
+// src/modules/credential-store.ts
+import { createHash as createHash4, randomBytes } from "crypto";
+var CHUNK_SIZE = 1e3;
+var MAX_CHUNKS = 64;
+var INDEX_NAME = "session/index";
+var CHUNK_PREFIX = "session/";
+var INDEX_VERSION = 1;
+var KeychainUnavailableError = class extends Error {
+  constructor(operation, cause) {
+    super(`The OS keychain is not available (${operation} failed).`);
+    this.name = "KeychainUnavailableError";
+    this.cause = cause;
   }
-  return {
-    name,
-    passed: false,
-    message: `${raw} \u2014 Node.js 18 or later is required`
-  };
+};
+function sha256Hex(value) {
+  return createHash4("sha256").update(value, "utf8").digest("hex");
 }
-async function checkVSCodeExtension(id, label2, homeDir = resolveHomeDir()) {
-  const name = `VS Code extension: ${label2}`;
-  const flavours = [
-    { dir: join22(homeDir, ".vscode", "extensions"), bin: "code" },
-    { dir: join22(homeDir, ".vscode-insiders", "extensions"), bin: "code-insiders" }
-  ];
-  let installBin = null;
-  for (const flavour of flavours) {
-    let entries;
-    try {
-      entries = await readdir11(flavour.dir);
-    } catch {
-      continue;
-    }
-    installBin ??= flavour.bin;
-    const prefix = id.toLowerCase() + "-";
-    const found = entries.some(
-      (e) => e.toLowerCase() === id.toLowerCase() || e.toLowerCase().startsWith(prefix)
-    );
-    if (found) {
-      return { name, passed: true, message: `${id} is installed` };
+function chunkName(gen, n) {
+  return `${CHUNK_PREFIX}${gen}/${n}`;
+}
+function splitSecret(secret, size = CHUNK_SIZE) {
+  const chunks = [];
+  let start = 0;
+  while (start < secret.length) {
+    let end = Math.min(start + size, secret.length);
+    if (end < secret.length) {
+      const last = secret.charCodeAt(end - 1);
+      if (last >= 55296 && last <= 56319) end -= 1;
     }
+    chunks.push(secret.slice(start, end));
+    start = end;
   }
-  return {
-    name,
-    passed: false,
-    message: `${id} not found. Install via: ${installBin ?? "code"} --install-extension ${id}`,
-    blocking: false
-  };
+  return chunks;
 }
-async function checkArcaneManifest(targetDir) {
-  const name = "Arcane manifest (.arcane.json)";
-  const manifestPath2 = join22(targetDir, ".arcane.json");
+function parseIndex(raw) {
+  let parsed;
   try {
-    await access4(manifestPath2);
+    parsed = JSON.parse(raw);
   } catch {
-    const selfHostedManifestPath = join22(targetDir, "src", "assets", ".arcane.json");
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  if (o["v"] !== INDEX_VERSION || typeof o["gen"] !== "string" || !/^[0-9a-f]{16}$/.test(o["gen"]) || typeof o["count"] !== "number" || !Number.isInteger(o["count"]) || o["count"] < 1 || o["count"] > MAX_CHUNKS || typeof o["sha256"] !== "string" || !/^[0-9a-f]{64}$/.test(o["sha256"])) {
+    return null;
+  }
+  return { v: o["v"], gen: o["gen"], count: o["count"], sha256: o["sha256"] };
+}
+var ChunkedSecretStore = class {
+  constructor(backend) {
+    this.backend = backend;
+  }
+  backend;
+  guard(operation, fn) {
     try {
-      const raw = await readFile19(selfHostedManifestPath, "utf8");
-      const manifest = JSON.parse(raw);
-      if (isRecord7(manifest) && manifest["selfHosted"] === true && manifest["tracking_mode"] === "internal") {
-        return {
-          name,
-          passed: true,
-          message: "self-hosted source tree \u2014 committed source manifest is authoritative"
-        };
-      }
-    } catch {
+      return fn();
+    } catch (error2) {
+      throw new KeychainUnavailableError(operation, error2);
     }
-    return {
-      name,
-      passed: false,
-      message: "No .arcane.json found. Run `spell init` to initialize Arcane in this project.",
-      blocking: false
-    };
   }
-  try {
-    const raw = await readFile19(manifestPath2, "utf8");
-    const manifest = JSON.parse(raw);
-    if (!isRecord7(manifest) || typeof manifest["version"] !== "string" || !manifest["version"] || !Array.isArray(manifest["components"])) {
-      return {
-        name,
-        passed: false,
-        message: ".arcane.json is present but missing required fields (version, components). Re-run `spell init`."
-      };
+  /** Reads the stored secret. Never throws for bad data; throws only when the keychain itself fails. */
+  load() {
+    const raw = this.guard("read", () => this.backend.get(INDEX_NAME));
+    if (raw === null) return { state: "signed-out" };
+    const index = parseIndex(raw);
+    if (index === null) return { state: "corrupt", reason: "the index entry is not valid" };
+    const parts = [];
+    for (let n = 0; n < index.count; n += 1) {
+      const part = this.guard("read", () => this.backend.get(chunkName(index.gen, n)));
+      if (part === null) return { state: "corrupt", reason: `chunk ${n} of ${index.count} is missing` };
+      parts.push(part);
     }
-    return {
-      name,
-      passed: true,
-      message: `v${manifest["version"]} \u2014 ${manifest["components"].length} component(s) installed`
-    };
-  } catch {
-    return {
-      name,
-      passed: false,
-      message: ".arcane.json is present but contains invalid JSON. Re-run `spell init`."
-    };
+    const secret = parts.join("");
+    if (sha256Hex(secret) !== index.sha256) {
+      return { state: "corrupt", reason: "the stored pieces do not match their checksum" };
+    }
+    return { state: "ok", secret };
   }
-}
-async function checkPullRebase(targetDir) {
-  const name = "Git pull.rebase (rebase-and-fast-forward mandate)";
-  try {
-    const { stdout } = await runGit(targetDir, ["config", "--type=bool", "--get", "pull.rebase"]);
-    const value = stdout.trim();
-    if (value === "true") {
-      return { name, passed: true, message: "pull.rebase=true" };
+  /**
+   * Replaces the stored secret. The previous session stays readable until the
+   * new index is written; a failure before that leaves it untouched.
+   */
+  save(secret) {
+    if (secret.length === 0) throw new Error("Refusing to store an empty secret.");
+    const gen = randomBytes(8).toString("hex");
+    const chunks = splitSecret(secret);
+    if (chunks.length > MAX_CHUNKS) {
+      throw new Error(`Refusing to store a secret longer than ${MAX_CHUNKS * CHUNK_SIZE} characters.`);
+    }
+    chunks.forEach((chunk, n) => {
+      this.guard("write", () => this.backend.set(chunkName(gen, n), chunk));
+    });
+    const index = { v: INDEX_VERSION, gen, count: chunks.length, sha256: sha256Hex(secret) };
+    this.guard("write", () => this.backend.set(INDEX_NAME, JSON.stringify(index)));
+    try {
+      this.sweep(gen);
+    } catch {
     }
-    return {
-      name,
-      passed: false,
-      message: `pull.rebase resolves to "${value}", not "true" -- a bare \`git pull\` will create merge commits, contradicting git-conventions.md's rebase-and-fast-forward mandate. Run: git config --local pull.rebase true`,
-      blocking: false
-    };
-  } catch {
-    return {
-      name,
-      passed: false,
-      message: "pull.rebase is unset, not a recognized boolean, or this isn't a Git repository -- effective behavior may not be rebase-and-fast-forward, and Git for Windows defaults this to false when unset. Run: git config --local pull.rebase true",
-      blocking: false
-    };
   }
-}
-function checkIncidentReleaseGate() {
-  const result = evaluateIncidentGate(INCIDENT_QUEUE);
-  if (result.blocked) {
-    return {
-      name: "Incident release gate (ARC-024)",
-      passed: false,
-      message: result.blockers.join("; ")
-    };
+  /** Deletes everything this store wrote, strays included. Succeeds when nothing is stored. */
+  clear() {
+    this.guard("delete", () => this.backend.delete(INDEX_NAME));
+    this.sweep(null);
   }
-  const accepted = result.acceptedRisks.length > 0 ? `; ${result.acceptedRisks.length} explicitly deferred` : "";
+  /** Removes every chunk that does not belong to `keepGen` (all chunks when it is null). */
+  sweep(keepGen) {
+    const names = this.guard("list", () => this.backend.list());
+    for (const name of names) {
+      if (name === INDEX_NAME || !name.startsWith(CHUNK_PREFIX)) continue;
+      if (keepGen !== null && name.startsWith(`${CHUNK_PREFIX}${keepGen}/`)) continue;
+      this.guard("delete", () => this.backend.delete(name));
+    }
+  }
+};
+
+// src/modules/keychain-backend.ts
+import { createRequire as createRequire2 } from "module";
+var KEYCHAIN_SERVICE = "arcane-cli";
+function createKeychainBackend(service = KEYCHAIN_SERVICE) {
+  let loaded = null;
+  const keyring = () => {
+    loaded ??= createRequire2(import.meta.url)("@napi-rs/keyring");
+    return loaded;
+  };
+  const entry = (name) => new (keyring()).Entry(service, name);
   return {
-    name: "Incident release gate (ARC-024)",
-    passed: true,
-    message: `${result.checked} incidents classified${accepted}`
+    get: (name) => entry(name).getPassword() ?? null,
+    set: (name, value) => {
+      entry(name).setPassword(value);
+    },
+    delete: (name) => {
+      entry(name).deletePassword();
+    },
+    list: () => keyring().findCredentials(service).map((credential) => credential.account)
   };
 }
-async function checkSecrets(targetDir) {
-  const name = "Secrets scan (ARC-037)";
-  const excludePrefixes = await resolveSecretsScanExcludePrefixes(targetDir);
-  const findings = await scanRepository(targetDir, SECRETS_RULES, void 0, excludePrefixes);
-  if (findings.length === 0) {
-    return { name, passed: true, message: "no credential-shaped patterns found" };
+
+// src/modules/session-store.ts
+var INSECURE_SESSION_FILE_NAME = "session-insecure.json";
+var SessionClearError = class extends Error {
+  constructor(keychainError, removed) {
+    super(keychainError.message);
+    this.keychainError = keychainError;
+    this.removed = removed;
+    this.name = "SessionClearError";
+    this.cause = keychainError;
   }
-  const summary = findings.map((f) => `${f.file}:${f.line} [${f.rule}]`).join("; ");
-  return {
-    name,
-    passed: false,
-    message: `${findings.length} credential-shaped pattern(s) found: ${summary}`
-  };
+  keychainError;
+  removed;
+};
+function isIsoDate(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value));
 }
-var SESSION_CONTINUITY_FILES = [
-  "TODO.md",
-  "DECISIONS.md",
-  "ai-context/system-prompt-context.md",
-  "journal/.gitkeep"
-];
-async function checkSessionContinuity(targetDir) {
-  const results = [];
-  for (const file of SESSION_CONTINUITY_FILES) {
-    const name = `Session file: ${file}`;
-    const filePath = join22(targetDir, file);
-    try {
-      await access4(filePath);
-      results.push({ name, passed: true, message: "present" });
-    } catch {
-      results.push({
-        name,
-        passed: false,
-        message: `Missing. Required for spell-close-session. Run \`spell doctor --fix\` to create it.`,
-        blocking: false
-      });
-    }
+function parseSessionRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
   }
-  return results;
-}
-async function fixSessionContinuity(targetDir, assetsDir) {
-  const created = [];
-  for (const file of SESSION_CONTINUITY_FILES) {
-    const destPath = join22(targetDir, file);
-    try {
-      await access4(destPath);
-    } catch {
-      const escape = findLinkedEscape(targetDir, dirname11(file));
-      if (escape !== null) {
-        console.log(
-          `    ! Not created: ${file} \u2014 it is under "${escape.link}", a link to "${escape.resolvesTo}" outside "${resolve7(targetDir)}".`
-        );
-        continue;
-      }
-      const fileEscape = findLinkedFileEscape(targetDir, file);
-      if (fileEscape !== null) {
-        console.log(
-          `    ! Not created: ${file} \u2014 it is a link to "${fileEscape.resolvesTo}" outside "${resolve7(targetDir)}".`
-        );
-        continue;
-      }
-      const srcPath = join22(assetsDir, file);
-      await mkdir7(dirname11(destPath), { recursive: true });
-      await fsCopyFile(srcPath, destPath);
-      created.push(file);
-    }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  if (o["v"] !== 1 || o["environment"] !== "production" && o["environment"] !== "development" || typeof o["sub"] !== "string" || o["sub"] === "" || !(typeof o["email"] === "string" || o["email"] === null) || typeof o["refreshToken"] !== "string" || o["refreshToken"] === "" || !isIsoDate(o["obtainedAt"]) || !isIsoDate(o["expiresAt"])) {
+    return null;
   }
-  return created;
+  return {
+    v: 1,
+    environment: o["environment"],
+    sub: o["sub"],
+    email: o["email"],
+    refreshToken: o["refreshToken"],
+    obtainedAt: o["obtainedAt"],
+    expiresAt: o["expiresAt"]
+  };
 }
-async function checkUserTier(homeDir = resolveHomeDir(), cliVersion) {
-  const name = "User tier (ARC-045)";
-  const storeRoot = userTierRoot(homeDir);
-  let manifest;
-  try {
-    manifest = await readManifest(storeRoot);
-  } catch (err) {
-    if (err instanceof ManifestNotFoundError) {
-      return {
-        name,
-        passed: true,
-        blocking: false,
-        message: "no user tier installed (optional \u2014 `spell init --user` shares every spell across the repositories on this machine)"
-      };
-    }
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: `could not read ${storeRoot}/.arcane.json (${err instanceof Error ? err.message : String(err)}) \u2014 remove it and re-run \`spell init --user\``
-    };
+var FileSecretBackend = class {
+  constructor(filePath, restrict = restrictToCurrentUser) {
+    this.filePath = filePath;
+    this.restrict = restrict;
   }
-  try {
-    if (typeof manifest.version !== "string" || manifest.version.length === 0) {
-      return {
-        name,
-        passed: false,
-        blocking: false,
-        message: `${storeRoot}/.arcane.json has no version field \u2014 remove the store and re-run \`spell init --user\``
-      };
+  filePath;
+  restrict;
+  exists() {
+    return existsSync2(this.filePath);
+  }
+  read() {
+    if (!existsSync2(this.filePath)) return {};
+    const parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error("the session file is not an object");
     }
-    const majorMinor = (v) => v.split(".").slice(0, 2).join(".");
-    const problems = [];
-    if (cliVersion !== void 0 && majorMinor(manifest.version) !== majorMinor(cliVersion)) {
-      problems.push(`installed at v${manifest.version}, this CLI is v${cliVersion}`);
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
     }
-    const health = await inspectUserTierFanout(homeDir, manifest.fanout);
-    if (health.missing.length > 0) {
-      problems.push(`${health.missing.length} of ${health.total} client file(s) missing`);
+    return out;
+  }
+  write(entries) {
+    if (Object.keys(entries).length === 0) {
+      rmSync(this.filePath, { force: true });
+      return;
     }
-    if (problems.length > 0) {
-      return {
-        name,
-        passed: false,
-        blocking: false,
-        message: `${problems.join("; ")} \u2014 run \`spell update --user\` (regenerates missing files; never overwrites edited ones)`
-      };
+    mkdirSync(dirname11(this.filePath), { recursive: true });
+    const tmp = `${this.filePath}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(entries), { encoding: "utf8", mode: 384 });
+    try {
+      this.restrict(tmp);
+    } catch (error2) {
+      rmSync(tmp, { force: true });
+      throw new Error(
+        "Could not restrict the session file to your account, so it was not written.",
+        { cause: error2 }
+      );
     }
-    const customized = health.customized.length > 0 ? `, ${health.customized.length} customized` : "";
-    return {
-      name,
-      passed: true,
-      blocking: false,
-      message: `v${manifest.version} at ${storeRoot} \u2014 ${health.total} client file(s) in place${customized}`
-    };
-  } catch (err) {
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: `could not inspect the user tier at ${storeRoot} (${err instanceof Error ? err.message : String(err)}) \u2014 run \`spell update --user\`; if that fails too, remove the store and re-run \`spell init --user\``
-    };
-  }
-}
-async function checkPushPolicy(targetDir) {
-  const name = "Push policy (EF-09)";
-  let manifest;
-  try {
-    manifest = await readManifest(targetDir);
-  } catch {
-    return { name, passed: true, message: "not initialized \u2014 nothing to check" };
-  }
-  const policy = manifest.push_policy ?? "open";
-  if (policy === "open") {
-    return { name, passed: true, message: "open \u2014 pushes allowed" };
+    renameSync(tmp, this.filePath);
   }
-  if (policy === "guarded") {
-    const targets = await pushTargets(targetDir);
-    const where = targets.length === 0 ? "none configured" : targets.map(({ remote, urls }) => `${remote} \u2192 ${urls.length > 0 ? urls.join(", ") : "unknown"}`).join("; ");
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: `guarded \u2014 no technical control installed. Push targets: ${where}. Confirm those are the remotes you intend before pushing.`
-    };
+  get(name) {
+    return this.read()[name] ?? null;
   }
-  const hookActive = await isHookEnforced(targetDir);
-  const remotes = await listRemotes(targetDir);
-  const open = await undisabledRemotes(targetDir);
-  if (hookActive && open.length === 0) {
-    if (remotes.length === 0) {
-      return {
-        name,
-        passed: false,
-        blocking: false,
-        message: "blocked \u2014 pre-push hook in place, but no remote is configured, so no push URL is disabled. If a remote is added later, run `spell doctor` again: a --no-verify push to it would succeed until the URL is disabled too."
-      };
-    }
-    return {
-      name,
-      passed: true,
-      message: `blocked \u2014 pre-push hook in place and push URL disabled for ${remotes.join(", ")}`
-    };
+  set(name, value) {
+    const entries = this.read();
+    entries[name] = value;
+    this.write(entries);
   }
-  const missing = [
-    hookActive ? null : "pre-push hook (config or hook file absent)",
-    open.length > 0 ? `push URL still live for: ${open.join(", ")}` : null
-  ].filter(Boolean);
-  return {
-    name,
-    passed: false,
-    blocking: false,
-    // ARC-049 decision 3: name the command that closes the gap.
-    message: `declared "blocked" but not enforced \u2014 ${missing.join("; ")}. The manifest claims a protection this repository does not have. Run \`spell block-push\` to install the controls.`
-  };
-}
-async function checkGovernancePlaceholders(targetDir) {
-  const name = "Governance placeholders (ARC-051)";
-  let scan;
-  try {
-    scan = await scanGovernancePlaceholders(join22(targetDir, ".arcane", "governance"));
-  } catch (err) {
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: `could not scan .arcane/governance (${err instanceof Error ? err.message : String(err)})`
-    };
+  delete(name) {
+    const entries = this.read();
+    if (!(name in entries)) return;
+    delete entries[name];
+    this.write(entries);
   }
-  if (scan.status === "skipped") {
-    return { name, passed: true, blocking: false, skipped: true, message: `skipped \u2014 ${scan.reason}` };
+  list() {
+    return Object.keys(this.read());
   }
-  if (scan.findings.length === 0) {
-    return {
-      name,
-      passed: true,
-      blocking: false,
-      message: `${scan.activeDocs.length} active doc(s) scanned, no unknown placeholders`
-    };
-  }
-  const listed = scan.findings.map(({ file, tokens }) => `.arcane/governance/${file}: ${tokens.join(", ")}`);
-  return {
-    name,
-    passed: false,
-    blocking: false,
-    message: `unknown placeholder(s) in status: active doc(s) \u2014 ${listed.join("; ")}. Fill each one in; or, if an agent resolves it at use time, add it to the runtime-placeholders list in .arcane/governance/${PLACEHOLDER_STANDARD_FILE}; or, if the document is meant to be filled in by hand, mark it \`status: template\`.`
-  };
-}
-var UNOWNED_EXAMPLE_SCOPE = "@example/";
-var RETIRED_SCAFFOLD_PLACEHOLDER = "<your-mcp-server-package>";
-async function checkComponentRequires(targetDir) {
-  const name = "Component prerequisites";
-  let manifest;
-  try {
-    manifest = await readManifest(targetDir);
-  } catch {
-    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no readable .arcane.json" };
-  }
-  if (manifest.scope === "user") {
-    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 the user tier holds spells only" };
-  }
-  if (!Array.isArray(manifest.components)) {
-    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 .arcane.json lists no components" };
-  }
-  const missing = findMissingRequires(manifest.components, manifest.profile);
-  if (missing.length === 0) {
-    return { name, passed: true, blocking: false, message: "every installed component's prerequisites are installed" };
+  /** Removes the file itself, strays and all. */
+  remove() {
+    rmSync(this.filePath, { force: true });
   }
+};
+function restrictToCurrentUser(filePath) {
+  if (process.platform !== "win32") return;
+  const account = userInfo().username;
+  execFileSync("icacls", [filePath, "/inheritance:r", "/grant:r", `${account}:F`], {
+    stdio: "ignore",
+    windowsHide: true
+  });
+}
+function insecureSessionFilePath(homeDir) {
+  return join22(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
+}
+function createSessionStorage(options = {}) {
+  const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
+  const fileBackend = options.fileBackend ?? new FileSecretBackend(insecureSessionFilePath());
+  const file = new ChunkedSecretStore(fileBackend);
+  const interpret = (result, source) => {
+    if (result.state === "signed-out") return null;
+    if (result.state === "corrupt") return { state: "corrupt", source, reason: result.reason };
+    const record = parseSessionRecord(result.secret);
+    if (record === null) return { state: "corrupt", source, reason: "the stored session is not valid" };
+    return { state: "ok", source, record };
+  };
   return {
-    name,
-    passed: false,
-    blocking: false,
-    message: missing.map(({ name: required, requiredBy }) => `${requiredBy.join(", ")} cites ${required}, which is not installed \u2014 ${getComponent(required).initOnly ? "" : "`spell update` installs it, or "}\`spell add ${required}\``).join("; ")
+    load() {
+      let keychainError;
+      try {
+        const fromKeychain = interpret(keychain.load(), "keychain");
+        if (fromKeychain) return fromKeychain;
+      } catch (error2) {
+        if (!(error2 instanceof KeychainUnavailableError)) throw error2;
+        keychainError = error2;
+      }
+      if (fileBackend.exists()) {
+        const fromFile = interpret(file.load(), "file");
+        if (fromFile) return fromFile;
+      }
+      return keychainError ? { state: "signed-out", keychainError } : { state: "signed-out" };
+    },
+    save(record, { insecure }) {
+      const serialized = JSON.stringify(record);
+      if (insecure) {
+        file.save(serialized);
+        try {
+          keychain.clear();
+        } catch {
+        }
+        return;
+      }
+      keychain.save(serialized);
+      fileBackend.remove();
+    },
+    clear() {
+      const removed = [];
+      let keychainError;
+      try {
+        const hadKeychainSession = keychain.load().state !== "signed-out";
+        keychain.clear();
+        if (hadKeychainSession) removed.push("keychain");
+      } catch (error2) {
+        keychainError = error2;
+      }
+      if (fileBackend.exists()) {
+        fileBackend.remove();
+        removed.push("file");
+      }
+      if (keychainError instanceof KeychainUnavailableError) {
+        throw new SessionClearError(keychainError, removed);
+      }
+      if (keychainError) throw keychainError;
+      return { removed };
+    }
   };
 }
-async function checkNewlyAvailableComponents(targetDir) {
-  const name = "Newly available components";
-  let manifest;
-  try {
-    manifest = await readManifest(targetDir);
-  } catch {
-    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no readable .arcane.json" };
-  }
-  if (manifest.scope === "user" || !Array.isArray(manifest.components)) {
-    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no repository install to compare" };
-  }
-  const installed = manifest.components.flatMap(
-    (c) => (LEGACY_COMPONENT_MIGRATIONS[c.name] ?? [c.name]).map((n) => ({ ...c, name: n }))
-  );
-  const prerequisites = findMissingRequires(manifest.components, manifest.profile).map((m) => m.name);
-  const fresh = (await findNewlyAvailable(targetDir, manifest.profile, installed, effectiveSpellScope(manifest))).filter((c) => !prerequisites.includes(c.name));
-  if (fresh.length === 0) {
-    return { name, passed: true, blocking: false, message: "the profile has nothing this install lacks" };
+
+// src/modules/presence/types.ts
+var PRESENCE_CONTRACT = "v0";
+var DEFAULT_PORT = 27226;
+var PRESENCE_ENV = { port: "ARCANE_PRESENCE_PORT", token: "ARCANE_PRESENCE_TOKEN" };
+var LOOPBACK_HOST = "127.0.0.1";
+var MAX_BODY_BYTES = 65536;
+var MAX_LINE_CHARS = 256;
+var MAX_NEEDS_YOU = 20;
+var MAX_SUBSCRIBERS = 32;
+var MAX_SUBSCRIBER_BUFFER_BYTES = 1048576;
+var MAX_CONNECTIONS = 128;
+var MAX_SESSIONS = 256;
+var MAX_ALIASES = 32;
+var CONNECTIONS_CHECK_MS = 1e3;
+var HEADERS_TIMEOUT_MS = 5e3;
+var REQUEST_TIMEOUT_MS = 1e4;
+var STALE_AFTER_MS = 9e4;
+var EXPIRE_AFTER_MS = 864e5;
+var KEEPALIVE_MS = 15e3;
+var SWEEP_MS = 5e3;
+var HARNESSES = ["claude-code", "copilot", "codex", "openclaw", "cron", "other"];
+var REPORT_STATUSES = ["working", "waiting", "blocked", "idle"];
+var ALIAS_CONTEXTS = ["openclaw", "slug"];
+var SESSION_EVENTS = [
+  "session.started",
+  "session.updated",
+  "session.needs_you",
+  "session.stale",
+  "session.resumed",
+  "session.ended",
+  "session.expired"
+];
+var HELLO_EVENT = "server.hello";
+function presenceCapabilities() {
+  return { observe: true, actions: [] };
+}
+function nullAgentBlock() {
+  return { ref: null, slug: null, name: null, origin: null, definition_revision: null, aliases: [] };
+}
+
+// src/modules/presence/store.ts
+var PRESENCE_DIR_NAME = "presence";
+var STORE_FILES = { token: "token", serverInfo: "server.json" };
+var PresenceStoreError = class extends Error {
+};
+function home(options) {
+  return options.home ?? resolveHomeDir();
+}
+function presenceDir(options = {}) {
+  return join23(userTierRoot(home(options)), PRESENCE_DIR_NAME);
+}
+function tokenPath(options = {}) {
+  return join23(presenceDir(options), STORE_FILES.token);
+}
+function serverInfoPath(options = {}) {
+  return join23(presenceDir(options), STORE_FILES.serverInfo);
+}
+function ensureStore(options = {}) {
+  const root = userTierRoot(home(options));
+  const dir = presenceDir(options);
+  mkdirSync2(root, { recursive: true });
+  const realRoot = resolveRealPath(root);
+  if (relative2(realRoot, resolveRealPath(dir)) !== PRESENCE_DIR_NAME) {
+    throw new PresenceStoreError(`Refusing to use ${dir}: it resolves outside ${root}.`);
   }
-  const offerable = fresh.filter((c) => !getComponent(c.name).initOnly).map((c) => c.name);
-  const byHand = fresh.filter((c) => getComponent(c.name).initOnly).map((c) => c.name);
-  const parts = [];
-  if (offerable.length > 0) {
-    parts.push(`${offerable.join(", ")} \u2014 \`spell update --add-new\` installs ${offerable.length === 1 ? "it" : "them"}`);
+  if (relative2(realRoot, resolveRealPath(tokenPath(options))) !== join23(PRESENCE_DIR_NAME, STORE_FILES.token)) {
+    throw new PresenceStoreError(`Refusing to use ${tokenPath(options)}: it resolves outside ${dir}.`);
   }
-  if (byHand.length > 0) {
-    parts.push(`${byHand.join(", ")} \u2014 initOnly, so only ${byHand.map((n) => `\`spell add ${n}\``).join(", ")}`);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  return dir;
+}
+function writeRestricted(target, content, options) {
+  const restrict = options.restrict ?? restrictToCurrentUser;
+  const tmp = `${target}.${process.pid}.tmp`;
+  writeFileSync2(tmp, content, { encoding: "utf8", mode: 384 });
+  try {
+    restrict(tmp);
+  } catch (error2) {
+    rmSync2(tmp, { force: true });
+    throw new PresenceStoreError(`Could not restrict ${target} to your account, so it was not written.`, { cause: error2 });
   }
-  return { name, passed: false, blocking: false, message: `newly available for your profile, not installed: ${parts.join("; ")}` };
+  renameSync2(tmp, target);
+  chmodSync(target, 384);
 }
-async function checkMcpConfig(targetDir) {
-  const name = "MCP config (per-server timeout, I12)";
-  const filePath = join22(targetDir, ".mcp.json");
+function generateToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function readTokenFile(options) {
   let raw;
   try {
-    raw = await readFile19(filePath, "utf8");
+    raw = readFileSync3(tokenPath(options), "utf8");
   } catch {
-    return { name, passed: true, blocking: false, message: "no .mcp.json \u2014 nothing to check" };
+    return null;
   }
-  let rawParsed;
+  const token = raw.replace(/[\r\n]+$/, "").trim();
+  return token.length > 0 ? token : null;
+}
+function ensureToken(options = {}) {
+  ensureStore(options);
+  const existing = options.rotate === true ? null : readTokenFile(options);
+  if (existing !== null) {
+    chmodSync(tokenPath(options), 384);
+    (options.restrict ?? restrictToCurrentUser)(tokenPath(options));
+    return existing;
+  }
+  const token = generateToken();
+  writeRestricted(tokenPath(options), `${token}
+`, options);
+  return token;
+}
+function readToken(options = {}) {
+  const fromEnv = (options.env ?? process.env)[PRESENCE_ENV.token];
+  if (fromEnv !== void 0 && fromEnv.replace(/[\r\n]+$/, "") !== "") return fromEnv.replace(/[\r\n]+$/, "");
+  return readTokenFile(options);
+}
+function writeServerInfo(info, options = {}) {
+  ensureStore(options);
+  writeRestricted(serverInfoPath(options), `${JSON.stringify(info, null, 2)}
+`, options);
+}
+function readServerInfo(options = {}) {
+  let parsed;
   try {
-    rawParsed = JSON.parse(raw);
+    parsed = JSON.parse(readFileSync3(serverInfoPath(options), "utf8"));
   } catch {
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: ".mcp.json exists but contains invalid JSON"
-    };
-  }
-  if (!isRecord7(rawParsed)) {
-    return {
-      name,
-      passed: false,
-      blocking: false,
-      message: ".mcp.json exists but is not a JSON object"
-    };
-  }
-  const parsed = rawParsed;
-  const servers = parsed.mcpServers ?? {};
-  const serverNames = Object.keys(servers);
-  if (serverNames.length === 0) {
-    return { name, passed: true, blocking: false, message: "no MCP servers configured" };
-  }
-  const exampleHits = [];
-  const placeholderHits = [];
-  for (const n of serverNames) {
-    const args = servers[n]?.args;
-    if (!Array.isArray(args)) continue;
-    for (const a of args) {
-      if (typeof a !== "string") continue;
-      if (a.startsWith(UNOWNED_EXAMPLE_SCOPE)) exampleHits.push(`${n} (${a})`);
-      if (a === RETIRED_SCAFFOLD_PLACEHOLDER) placeholderHits.push(n);
-    }
+    return null;
   }
-  if (exampleHits.length > 0) {
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  const generator = o["generator"];
+  const valid = typeof o["url"] === "string" && Number.isInteger(o["pid"]) && o["pid"] > 0 && Number.isInteger(o["port"]) && o["port"] >= 1 && o["port"] <= 65535 && typeof o["started_at"] === "string" && typeof generator === "object" && generator !== null && generator["name"] === "arcane-cli" && typeof generator["version"] === "string";
+  if (!valid) return null;
+  return {
+    url: o["url"],
+    pid: o["pid"],
+    port: o["port"],
+    started_at: o["started_at"],
+    generator: { name: "arcane-cli", version: generator["version"] }
+  };
+}
+function removeServerInfo(options = {}) {
+  rmSync2(serverInfoPath(options), { force: true });
+}
+function storeExists(options = {}) {
+  return existsSync3(presenceDir(options));
+}
+
+// src/modules/presence/client.ts
+var CONNECT_TIMEOUT_MS = 1e3;
+var RESPONSE_TIMEOUT_MS = 1500;
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveEndpoint(options = {}) {
+  const info = readServerInfo(options);
+  if (info === null || !pidAlive(info.pid)) return null;
+  const token = readToken({ ...options, env: options.env ?? process.env });
+  if (token === null) return null;
+  return { info, token };
+}
+function errorFields(body) {
+  const e = body?.error;
+  return { code: typeof e?.code === "string" ? e.code : null, field: typeof e?.field === "string" ? e.field : null };
+}
+function send(port, token, method, path5, body, options = {}) {
+  const connectTimeout = options.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
+  const responseTimeout = options.responseTimeoutMs ?? RESPONSE_TIMEOUT_MS;
+  const payload = body === void 0 ? void 0 : JSON.stringify(body);
+  return new Promise((resolve10) => {
+    let settled = false;
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(connectTimer);
+      clearTimeout(responseTimer);
+      resolve10(result);
+    };
+    const headers = { Authorization: `Bearer ${token}`, Accept: "application/json" };
+    if (payload !== void 0) {
+      headers["Content-Type"] = "application/json";
+      headers["Content-Length"] = Buffer.byteLength(payload);
+    }
+    const req = request({ host: LOOPBACK_HOST, port, method, path: path5, headers, agent: false }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("error", () => done({ kind: "unreachable" }));
+      res.on("end", () => {
+        const status = res.statusCode ?? 0;
+        const text2 = Buffer.concat(chunks).toString("utf8");
+        let parsed = null;
+        try {
+          parsed = text2.length > 0 ? JSON.parse(text2) : null;
+        } catch {
+          parsed = null;
+        }
+        if (status >= 200 && status < 300 && parsed !== null) done({ kind: "ok", status, body: parsed });
+        else if (status === 401 || status === 400 || status === 404 || status === 413) done({ kind: "refused", status, ...errorFields(parsed) });
+        else done({ kind: "unreachable" });
+      });
+    });
+    const connectTimer = setTimeout(() => {
+      req.destroy();
+      done({ kind: "unreachable" });
+    }, connectTimeout);
+    const responseTimer = setTimeout(() => {
+      req.destroy();
+      done({ kind: "unreachable" });
+    }, connectTimeout + responseTimeout);
+    req.on("socket", (socket) => {
+      socket.once("connect", () => clearTimeout(connectTimer));
+    });
+    req.on("error", () => done({ kind: "unreachable" }));
+    if (payload !== void 0) req.write(payload);
+    req.end();
+  });
+}
+async function callPresence(method, path5, body, options = {}) {
+  const endpoint = resolveEndpoint(options);
+  if (endpoint === null) return { kind: "not-configured" };
+  return send(endpoint.info.port, endpoint.token, method, path5, body, options);
+}
+function openEventFeed(callbacks, options = {}) {
+  const endpoint = resolveEndpoint(options);
+  if (endpoint === null) return Promise.resolve(null);
+  const deadline = (options.connectTimeoutMs ?? CONNECT_TIMEOUT_MS) + (options.responseTimeoutMs ?? RESPONSE_TIMEOUT_MS);
+  return new Promise((resolve10) => {
+    let opened = false;
+    let settled = false;
+    let closedHere = false;
+    let closeReported = false;
+    const settle = (feed2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (feed2 === null) req.destroy();
+      resolve10(feed2);
+    };
+    const ended = () => {
+      if (!opened) {
+        settle(null);
+        return;
+      }
+      if (closedHere || closeReported) return;
+      closeReported = true;
+      callbacks.onClose();
+    };
+    const feed = {
+      close() {
+        closedHere = true;
+        req.destroy();
+      }
+    };
+    const req = request(
+      {
+        host: LOOPBACK_HOST,
+        port: endpoint.info.port,
+        method: "GET",
+        path: "/v0/events",
+        headers: { Authorization: `Bearer ${endpoint.token}`, Accept: "text/event-stream" },
+        agent: false
+      },
+      (res) => {
+        if (res.statusCode !== 200) {
+          res.resume();
+          settle(null);
+          return;
+        }
+        res.setEncoding("utf8");
+        let buffer = "";
+        res.on("data", (chunk) => {
+          buffer += chunk.replace(/\r\n?/g, "\n");
+          let at;
+          while ((at = buffer.indexOf("\n\n")) >= 0) {
+            const block = buffer.slice(0, at);
+            buffer = buffer.slice(at + 2);
+            const name = /^event: ?(.*)$/m.exec(block)?.[1];
+            const data = /^data: ?(.*)$/m.exec(block)?.[1];
+            if (name === void 0 || data === void 0) continue;
+            let parsed;
+            try {
+              parsed = JSON.parse(data);
+            } catch {
+              continue;
+            }
+            if (!opened) {
+              if (name !== "server.hello") {
+                settle(null);
+                return;
+              }
+              opened = true;
+              settle(feed);
+              continue;
+            }
+            if (!closedHere) callbacks.onEvent(name, parsed);
+          }
+        });
+        res.on("end", ended);
+        res.on("close", ended);
+        res.on("error", ended);
+      }
+    );
+    const timer = setTimeout(() => settle(null), deadline);
+    req.on("error", ended);
+    req.end();
+  });
+}
+
+// src/commands/doctor.ts
+import { statSync } from "fs";
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkNodeVersion() {
+  const name = "Node.js version";
+  const raw = process.version;
+  const major = parseInt(raw.replace(/^v/, "").split(".")[0] ?? "0", 10);
+  if (major >= 18) {
+    return { name, passed: true, message: `${raw} (>=18 required)` };
+  }
+  return {
+    name,
+    passed: false,
+    message: `${raw} \u2014 Node.js 18 or later is required`
+  };
+}
+async function checkArcaneManifest(targetDir) {
+  const name = "Arcane manifest (.arcane.json)";
+  const manifestPath2 = join24(targetDir, ".arcane.json");
+  try {
+    await access4(manifestPath2);
+  } catch {
+    const selfHostedManifestPath = join24(targetDir, "src", "assets", ".arcane.json");
+    try {
+      const raw = await readFile19(selfHostedManifestPath, "utf8");
+      const manifest = JSON.parse(raw);
+      if (isRecord7(manifest) && manifest["selfHosted"] === true && manifest["tracking_mode"] === "internal") {
+        return {
+          name,
+          passed: true,
+          message: "self-hosted source tree \u2014 committed source manifest is authoritative"
+        };
+      }
+    } catch {
+    }
     return {
       name,
       passed: false,
-      blocking: false,
-      message: `.mcp.json runs a package under the ${UNOWNED_EXAMPLE_SCOPE} scope nobody here owns: ${exampleHits.join(", ")}. The old \`spell init\` scaffold shipped it as a placeholder, and \`npx -y\` would run whoever publishes it. Replace the entry with your own MCP server package, or remove it; the file is yours, so doctor does not edit it`
+      message: "No .arcane.json found. Run `spell init` to initialize Arcane in this project.",
+      blocking: false
     };
   }
-  if (placeholderHits.length > 0) {
+  try {
+    const raw = await readFile19(manifestPath2, "utf8");
+    const manifest = JSON.parse(raw);
+    if (!isRecord7(manifest) || typeof manifest["version"] !== "string" || !manifest["version"] || !Array.isArray(manifest["components"])) {
+      return {
+        name,
+        passed: false,
+        message: ".arcane.json is present but missing required fields (version, components). Re-run `spell init`."
+      };
+    }
     return {
       name,
-      passed: false,
-      blocking: false,
-      message: `.mcp.json still holds the placeholder server from the retired mcp-config-template scaffold: ${placeholderHits.join(", ")} (${RETIRED_SCAFFOLD_PLACEHOLDER}). Clients load this file as live MCP config, so the placeholder fails on every session start. Delete the file if you run no MCP servers, or replace the entry with a real server package; the file is yours, so doctor does not edit it. An untouched scaffold is removed by \`spell update --prune\``
+      passed: true,
+      message: `v${manifest["version"]} \u2014 ${manifest["components"].length} component(s) installed`
     };
-  }
-  const missingTimeout = serverNames.filter((n) => typeof servers[n]?.timeout !== "number");
-  if (missingTimeout.length > 0) {
+  } catch {
     return {
       name,
       passed: false,
-      blocking: false,
-      message: `server(s) missing a "timeout": ${missingTimeout.join(", ")} \u2014 add "timeout": 30000 (milliseconds; Claude Code ignores a value below 1000) to each entry under mcpServers, so a stuck tool call ends after 30 s instead of running to the client's own idle limit (as long as 30 minutes)`
+      message: ".arcane.json is present but contains invalid JSON. Re-run `spell init`."
     };
   }
-  return {
-    name,
-    passed: true,
-    blocking: false,
-    message: `${serverNames.length} server(s) configured, all with a timeout set`
-  };
-}
-function isDelegation(value) {
-  return isRecord7(value) && typeof value["id"] === "string" && typeof value["status"] === "string" && typeof value["scope"] === "string" && Array.isArray(value["excludedActions"]);
-}
-function isDelegationsFile(value) {
-  return isRecord7(value) && Array.isArray(value["delegations"]) && value["delegations"].every(isDelegation);
 }
-async function checkDelegations(targetDir) {
-  const name = "Standing delegations (T13)";
-  const filePath = join22(targetDir, ".arcane", "delegations.json");
-  let raw;
-  try {
-    raw = await readFile19(filePath, "utf8");
-  } catch {
-    return { name, passed: true, blocking: false, message: "no delegations recorded" };
-  }
-  let rawParsed;
+async function checkPullRebase(targetDir) {
+  const name = "Git pull.rebase (rebase-and-fast-forward mandate)";
   try {
-    rawParsed = JSON.parse(raw);
-  } catch {
+    const { stdout } = await runGit(targetDir, ["config", "--type=bool", "--get", "pull.rebase"]);
+    const value = stdout.trim();
+    if (value === "true") {
+      return { name, passed: true, message: "pull.rebase=true" };
+    }
     return {
       name,
       passed: false,
-      blocking: false,
-      message: `.arcane/delegations.json exists but contains invalid JSON`
+      message: `pull.rebase resolves to "${value}", not "true" -- a bare \`git pull\` will create merge commits, contradicting git-conventions.md's rebase-and-fast-forward mandate. Run: git config --local pull.rebase true`,
+      blocking: false
     };
-  }
-  if (!isDelegationsFile(rawParsed)) {
+  } catch {
     return {
       name,
       passed: false,
-      blocking: false,
-      message: `.arcane/delegations.json exists but is not a valid delegations file (expected a "delegations" array of well-formed entries)`
+      message: "pull.rebase is unset, not a recognized boolean, or this isn't a Git repository -- effective behavior may not be rebase-and-fast-forward, and Git for Windows defaults this to false when unset. Run: git config --local pull.rebase true",
+      blocking: false
     };
   }
-  const parsed = rawParsed;
-  const active = parsed.delegations.filter((d) => d.status === "active");
-  if (active.length === 0) {
-    return { name, passed: true, blocking: false, message: "no active delegations" };
+}
+function checkIncidentReleaseGate() {
+  const result = evaluateIncidentGate(INCIDENT_QUEUE);
+  if (result.blocked) {
+    return {
+      name: "Incident release gate (ARC-024)",
+      passed: false,
+      message: result.blockers.join("; ")
+    };
   }
-  const summary = active.map((d) => `${d.id} (scope: ${d.scope}; excludes: ${d.excludedActions.length} action(s))`).join("; ");
+  const accepted = result.acceptedRisks.length > 0 ? `; ${result.acceptedRisks.length} explicitly deferred` : "";
   return {
-    name,
+    name: "Incident release gate (ARC-024)",
     passed: true,
-    blocking: false,
-    message: `${active.length} active: ${summary}`
+    message: `${result.checked} incidents classified${accepted}`
   };
 }
-async function checkPlatformBranchPolicy(targetDir) {
-  const name = "Platform branch/merge policy (T11)";
-  const targets = await pushTargets(targetDir);
-  const origin = targets.find((t) => t.remote === "origin") ?? targets[0];
-  const url = origin?.urls[0];
-  if (!url) {
-    return { name, passed: true, message: "no remote configured \u2014 nothing to check", blocking: false };
-  }
-  const github = parseGitHubRemote(url);
-  if (github) {
-    const rulesets = await fetchGitHubRulesets(github.owner, github.repo);
-    if (rulesets === null) {
-      return {
+async function checkSecrets(targetDir) {
+  const name = "Secrets scan (ARC-037)";
+  const excludePrefixes = await resolveSecretsScanExcludePrefixes(targetDir);
+  const findings = await scanRepository(targetDir, SECRETS_RULES, void 0, excludePrefixes);
+  if (findings.length === 0) {
+    return { name, passed: true, message: "no credential-shaped patterns found" };
+  }
+  const summary = findings.map((f) => `${f.file}:${f.line} [${f.rule}]`).join("; ");
+  return {
+    name,
+    passed: false,
+    message: `${findings.length} credential-shaped pattern(s) found: ${summary}`
+  };
+}
+var SESSION_CONTINUITY_FILES = [
+  "TODO.md",
+  "DECISIONS.md",
+  "ai-context/system-prompt-context.md",
+  "journal/.gitkeep"
+];
+async function checkSessionContinuity(targetDir) {
+  const results = [];
+  for (const file of SESSION_CONTINUITY_FILES) {
+    const name = `Session file: ${file}`;
+    const filePath = join24(targetDir, file);
+    try {
+      await access4(filePath);
+      results.push({ name, passed: true, message: "present" });
+    } catch {
+      results.push({
         name,
         passed: false,
+        message: `Missing. Required for spell-close-session. Run \`spell doctor --fix\` to create it.`,
+        blocking: false
+      });
+    }
+  }
+  return results;
+}
+async function fixSessionContinuity(targetDir, assetsDir) {
+  const created = [];
+  for (const file of SESSION_CONTINUITY_FILES) {
+    const destPath = join24(targetDir, file);
+    try {
+      await access4(destPath);
+    } catch {
+      const escape = findLinkedEscape(targetDir, dirname12(file));
+      if (escape !== null) {
+        console.log(
+          `    ! Not created: ${file} \u2014 it is under "${escape.link}", a link to "${escape.resolvesTo}" outside "${resolve7(targetDir)}".`
+        );
+        continue;
+      }
+      const fileEscape = findLinkedFileEscape(targetDir, file);
+      if (fileEscape !== null) {
+        console.log(
+          `    ! Not created: ${file} \u2014 it is a link to "${fileEscape.resolvesTo}" outside "${resolve7(targetDir)}".`
+        );
+        continue;
+      }
+      const srcPath = join24(assetsDir, file);
+      await mkdir7(dirname12(destPath), { recursive: true });
+      await fsCopyFile(srcPath, destPath);
+      created.push(file);
+    }
+  }
+  return created;
+}
+async function checkUserTier(homeDir = resolveHomeDir(), cliVersion) {
+  const name = "User tier (ARC-045)";
+  const storeRoot = userTierRoot(homeDir);
+  let manifest;
+  try {
+    manifest = await readManifest(storeRoot);
+  } catch (err) {
+    if (err instanceof ManifestNotFoundError) {
+      return {
+        name,
+        passed: true,
         blocking: false,
-        message: `could not query GitHub Rulesets for ${github.owner}/${github.repo} \u2014 is \`gh\` installed and authenticated? Verify manually: gh api repos/${github.owner}/${github.repo}/rulesets`
+        message: "no user tier installed (optional \u2014 `spell init --user` shares every spell across the repositories on this machine)"
       };
     }
-    const result = evaluateGitHubMergePolicy(rulesets);
-    return { name, passed: result.passed, blocking: false, message: result.message };
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `could not read ${storeRoot}/.arcane.json (${err instanceof Error ? err.message : String(err)}) \u2014 remove it and re-run \`spell init --user\``
+    };
   }
-  const ado = parseAdoRemote2(url);
-  if (ado) {
-    const policies = await fetchAdoMergeTypePolicies(ado.org, ado.project, ado.repo, "main");
-    if (policies === null) {
+  try {
+    if (typeof manifest.version !== "string" || manifest.version.length === 0) {
       return {
         name,
         passed: false,
         blocking: false,
-        message: `could not query the Azure DevOps "Limit merge types" branch policy for ${ado.org}/${ado.project}/${ado.repo} \u2014 is \`az\` installed and authenticated? Verify manually in the ADO web UI under Branch Policies.`
+        message: `${storeRoot}/.arcane.json has no version field \u2014 remove the store and re-run \`spell init --user\``
       };
     }
-    const result = evaluateAdoMergePolicy(policies);
-    return { name, passed: result.passed, blocking: false, message: result.message };
+    const majorMinor = (v) => v.split(".").slice(0, 2).join(".");
+    const problems = [];
+    if (cliVersion !== void 0 && majorMinor(manifest.version) !== majorMinor(cliVersion)) {
+      problems.push(`installed at v${manifest.version}, this CLI is v${cliVersion}`);
+    }
+    const health = await inspectUserTierFanout(homeDir, manifest.fanout);
+    if (health.missing.length > 0) {
+      problems.push(`${health.missing.length} of ${health.total} client file(s) missing`);
+    }
+    if (problems.length > 0) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: `${problems.join("; ")} \u2014 run \`spell update --user\` (regenerates missing files; never overwrites edited ones)`
+      };
+    }
+    const customized = health.customized.length > 0 ? `, ${health.customized.length} customized` : "";
+    return {
+      name,
+      passed: true,
+      blocking: false,
+      message: `v${manifest.version} at ${storeRoot} \u2014 ${health.total} client file(s) in place${customized}`
+    };
+  } catch (err) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `could not inspect the user tier at ${storeRoot} (${err instanceof Error ? err.message : String(err)}) \u2014 run \`spell update --user\`; if that fails too, remove the store and re-run \`spell init --user\``
+    };
   }
-  return {
-    name,
-    passed: true,
-    blocking: false,
-    message: "remote is neither GitHub nor Azure DevOps \u2014 platform policy verification not available for this provider"
-  };
 }
-async function checkManagedFileModes(targetDir) {
-  const name = "Managed files are regular files (#357)";
-  let manifest;
-  try {
-    manifest = await readManifest(targetDir);
-  } catch {
-    return { name, passed: true, skipped: true, message: "no .arcane.json \u2014 nothing to check" };
-  }
-  try {
-    await runGit(targetDir, ["rev-parse", "--git-dir"]);
-  } catch {
-    return { name, passed: true, skipped: true, message: "not a git repository \u2014 the index cannot be read" };
+async function checkPresenceService(options = {}) {
+  const name = "Presence service (ARC-060)";
+  if (!storeExists(options)) {
+    return { name, passed: true, blocking: false, message: "no presence channel on this machine (optional \u2014 `spell presence serve` starts one)" };
   }
-  const managed = [...new Set(manifest.components.flatMap((c) => c.files))];
-  const linkTracked = await listSymlinkTrackedPaths(targetDir);
-  const asLinks = managed.filter((file) => linkTracked.has(file));
-  const pathBodies = [];
-  for (const file of managed) {
-    if (!isClientShimPath(file) || asLinks.includes(file)) continue;
-    let body;
+  const alive = options.pidAlive ?? pidAlive;
+  const problems = [];
+  if ((options.platform ?? process.platform) !== "win32") {
     try {
-      body = await readFile19(join22(targetDir, file), "utf-8");
+      const mode = statSync(tokenPath(options)).mode & 511;
+      if ((mode & 63) !== 0) {
+        problems.push(`the token file ${tokenPath(options)} has mode ${mode.toString(8).padStart(4, "0")}; run \`chmod 600\` on it, or restart \`spell presence serve\`, which re-sets it`);
+      }
     } catch {
-      continue;
     }
-    if (looksLikeBarePath(body)) pathBodies.push(file);
   }
-  if (asLinks.length === 0 && pathBodies.length === 0) {
-    return { name, passed: true, message: `${managed.length} managed path(s), all regular files` };
+  const warn = (state) => ({ name, passed: false, blocking: false, message: [state, ...problems].join("; ") });
+  let recorded;
+  try {
+    statSync(serverInfoPath(options));
+    recorded = true;
+  } catch {
+    recorded = false;
   }
-  const parts = [];
-  if (asLinks.length > 0) {
-    parts.push(`${asLinks.length} tracked as a symlink (mode 120000): ${asLinks.join(", ")}`);
+  if (!recorded) {
+    return problems.length > 0 ? warn("not running") : { name, passed: true, blocking: false, message: `not running (store at ${presenceDir(options)})` };
   }
-  if (pathBodies.length > 0) {
-    parts.push(`${pathBodies.length} client shim(s) whose body is only a path: ${pathBodies.join(", ")}`);
+  const info = readServerInfo(options);
+  if (info === null) return warn(`${serverInfoPath(options)} is not a record this CLI wrote; remove it if no service is running`);
+  if (!alive(info.pid)) {
+    return warn(`stale: ${serverInfoPath(options)} names pid ${info.pid}, which is not running \u2014 \`spell doctor --fix\` removes the file (the token stays)`);
   }
-  return {
-    name,
-    passed: false,
-    message: parts.join("; ") + " \u2014 clients silently skip or empty these spells. Run `spell update` (it rewrites them as regular files and stages the typechange), then commit."
-  };
+  const health = await callPresence("GET", "/v0/health", void 0, { ...options, env: options.env ?? process.env });
+  if (health.kind === "ok") {
+    const body = health.body;
+    const version = typeof body.generator?.version === "string" ? `v${body.generator.version}` : "unknown version";
+    const sessions = typeof body.sessions === "number" ? `, ${body.sessions} session(s)` : "";
+    if (problems.length > 0) return warn(`reachable at ${info.url}`);
+    return { name, passed: true, blocking: false, message: `reachable at ${info.url} (pid ${info.pid}, ${version}${sessions})` };
+  }
+  if (health.kind === "refused" && health.status === 401) {
+    return warn(`the service at ${info.url} refused this machine's token (rotated, or ARCANE_PRESENCE_TOKEN is set to another value)`);
+  }
+  return warn(`not reachable: ${info.url} (pid ${info.pid} is running but does not answer)`);
 }
-async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
-  const name = "Spell scope (ARC-045)";
+function fixPresenceService(options = {}) {
+  const info = readServerInfo(options);
+  if (info === null || (options.pidAlive ?? pidAlive)(info.pid)) return null;
+  removeServerInfo(options);
+  return serverInfoPath(options);
+}
+async function checkPushPolicy(targetDir) {
+  const name = "Push policy (EF-09)";
   let manifest;
   try {
     manifest = await readManifest(targetDir);
   } catch {
-    return { name, passed: true, blocking: false, message: "no .arcane.json \u2014 nothing to check" };
+    return { name, passed: true, message: "not initialized \u2014 nothing to check" };
   }
-  if (effectiveSpellScope(manifest) === "repo") {
+  const policy = manifest.push_policy ?? "open";
+  if (policy === "open") {
+    return { name, passed: true, message: "open \u2014 pushes allowed" };
+  }
+  if (policy === "guarded") {
+    const targets = await pushTargets(targetDir);
+    const where = targets.length === 0 ? "none configured" : targets.map(({ remote, urls }) => `${remote} \u2192 ${urls.length > 0 ? urls.join(", ") : "unknown"}`).join("; ");
     return {
       name,
-      passed: true,
+      passed: false,
       blocking: false,
-      message: "repo \u2014 this repository carries its own spells (the default)"
+      message: `guarded \u2014 no technical control installed. Push targets: ${where}. Confirm those are the remotes you intend before pushing.`
     };
   }
-  const storeRoot = userTierRoot(homeDir);
-  let store;
-  try {
-    store = await readManifest(storeRoot);
-  } catch (err) {
+  const hookActive = await isHookEnforced(targetDir);
+  const remotes = await listRemotes(targetDir);
+  const open = await undisabledRemotes(targetDir);
+  if (hookActive && open.length === 0) {
+    if (remotes.length === 0) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: "blocked \u2014 pre-push hook in place, but no remote is configured, so no push URL is disabled. If a remote is added later, run `spell doctor` again: a --no-verify push to it would succeed until the URL is disabled too."
+      };
+    }
     return {
       name,
-      passed: false,
-      message: `this repository takes its spells from the user tier (spell_scope: "user"), but ${storeRoot} ${err instanceof ManifestNotFoundError ? "is not installed" : `could not be read (${err instanceof Error ? err.message : String(err)})`} \u2014 no client can reach a spell here. Run \`spell init --user\`, or set spell_scope back to "repo" and run \`spell update\`.`
+      passed: true,
+      message: `blocked \u2014 pre-push hook in place and push URL disabled for ${remotes.join(", ")}`
     };
   }
-  let spellCount = 0;
-  let probed = false;
-  const probe2 = "spell-status.md";
+  const missing = [
+    hookActive ? null : "pre-push hook (config or hook file absent)",
+    open.length > 0 ? `push URL still live for: ${open.join(", ")}` : null
+  ].filter(Boolean);
+  return {
+    name,
+    passed: false,
+    blocking: false,
+    // ARC-049 decision 3: name the command that closes the gap.
+    message: `declared "blocked" but not enforced \u2014 ${missing.join("; ")}. The manifest claims a protection this repository does not have. Run \`spell block-push\` to install the controls.`
+  };
+}
+async function checkGovernancePlaceholders(targetDir) {
+  const name = "Governance placeholders (ARC-051)";
+  let scan;
   try {
-    const entries = await readdir11(join22(storeRoot, USER_TIER_SPELLS_DIR));
-    const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
-    spellCount = spells.length;
-    probed = spells.includes(probe2);
-  } catch {
-  }
-  if (spellCount === 0 || !probed) {
+    scan = await scanGovernancePlaceholders(join24(targetDir, ".arcane", "governance"));
+  } catch (err) {
     return {
       name,
       passed: false,
-      message: `the user tier at ${storeRoot} holds ${spellCount} spell(s)${spellCount > 0 && !probed ? ` and not ${probe2}` : ""} \u2014 this repository expects it to supply every spell. Run \`spell update --user\`.`
+      blocking: false,
+      message: `could not scan .arcane/governance (${err instanceof Error ? err.message : String(err)})`
     };
   }
-  const majorMinor = (v) => v.split(".").slice(0, 2).join(".");
-  if (typeof manifest.version === "string" && majorMinor(store.version) !== majorMinor(manifest.version)) {
+  if (scan.status === "skipped") {
+    return { name, passed: true, blocking: false, skipped: true, message: `skipped \u2014 ${scan.reason}` };
+  }
+  if (scan.findings.length === 0) {
     return {
       name,
-      passed: false,
+      passed: true,
       blocking: false,
-      message: `this repository is at v${manifest.version} but the user tier it uses is at v${store.version} \u2014 run \`spell update --user\` (and \`spell update\` here) to bring them together.`
-    };
-  }
-  const repoExpectsAgents = await rosterExists(targetDir);
-  if (repoExpectsAgents && !await rosterExists(storeRoot, "user")) {
-    return {
-      name,
-      passed: false,
-      message: `this repository has an agent roster and takes its client files from the user tier, but ${storeRoot} has no roster of its own \u2014 no agent mode can reach a client here. Run \`spell agents init --user\`, or set spell_scope back to "repo" and run \`spell agents sync\`.`
+      message: `${scan.activeDocs.length} active doc(s) scanned, no unknown placeholders`
     };
   }
+  const listed = scan.findings.map(({ file, tokens }) => `.arcane/governance/${file}: ${tokens.join(", ")}`);
   return {
     name,
-    passed: true,
+    passed: false,
     blocking: false,
-    message: `user \u2014 ${spellCount} spell(s) from ${storeRoot} (v${store.version}), ${probe2} present${repoExpectsAgents ? ", agent roster present in the tier" : ""}`
+    message: `unknown placeholder(s) in status: active doc(s) \u2014 ${listed.join("; ")}. Fill each one in; or, if an agent resolves it at use time, add it to the runtime-placeholders list in .arcane/governance/${PLACEHOLDER_STANDARD_FILE}; or, if the document is meant to be filled in by hand, mark it \`status: template\`.`
   };
 }
-async function runDoctor(targetDir, options = {}, assetsDir) {
-  console.log("\nspell doctor \u2014 checking your Arcane environment\n");
-  if (options.leaks) {
-    const result = await checkSecrets(targetDir);
-    const icon = result.passed ? "\u2713" : "\u2717";
-    console.log(`  ${icon} [${result.passed ? "pass" : "FAIL"}] ${result.name}`);
-    if (!result.passed) {
-      console.log(`         ${result.message}`);
-      console.log("\n  One or more checks failed. Fix the issues above before proceeding.\n");
-      process.exitCode = 1;
-    } else {
-      console.log("\n  All checks passed. Your environment is ready.\n");
-    }
-    return;
+var UNOWNED_EXAMPLE_SCOPE = "@example/";
+var RETIRED_SCAFFOLD_PLACEHOLDER = "<your-mcp-server-package>";
+async function checkComponentRequires(targetDir) {
+  const name = "Component prerequisites";
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no readable .arcane.json" };
   }
-  const results = await Promise.all([
-    checkNodeVersion(),
-    checkVSCodeExtension("GitHub.copilot-chat", "GitHub Copilot (Chat)", resolveHomeDir()),
-    checkArcaneManifest(targetDir),
-    Promise.resolve(checkIncidentReleaseGate()),
-    checkPullRebase(targetDir),
-    checkPushPolicy(targetDir),
-    checkPlatformBranchPolicy(targetDir),
-    checkDelegations(targetDir),
-    checkMcpConfig(targetDir),
-    checkUserTier(resolveHomeDir(), options.packageVersion),
-    checkSpellScope(targetDir),
-    checkManagedFileModes(targetDir),
-    checkGovernancePlaceholders(targetDir),
-    checkComponentRequires(targetDir),
-    checkNewlyAvailableComponents(targetDir)
-  ]);
-  const sessionResults = await checkSessionContinuity(targetDir);
-  results.push(...sessionResults);
-  let allPassed = true;
-  for (const result of results) {
-    const skipped = result.passed && result.skipped === true;
-    const icon = skipped ? "\u2013" : result.passed ? "\u2713" : result.blocking === false ? "\u26A0" : "\u2717";
-    const label2 = skipped ? "skip" : result.passed ? "pass" : result.blocking === false ? "warn" : "FAIL";
-    console.log(`  ${icon} [${label2}] ${result.name}`);
-    if (!result.passed || skipped) {
-      console.log(`         ${result.message}`);
-    }
-    if (!result.passed && result.blocking !== false) {
-      allPassed = false;
-    }
+  if (manifest.scope === "user") {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 the user tier holds spells only" };
   }
-  console.log();
-  if (allPassed) {
-    console.log("  All checks passed. Your environment is ready.\n");
-  } else {
-    console.log("  One or more checks failed. Fix the issues above before proceeding.\n");
-    process.exitCode = 1;
+  if (!Array.isArray(manifest.components)) {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 .arcane.json lists no components" };
   }
-  const hasMissingSession = sessionResults.some((r) => !r.passed);
-  if (options.fix && hasMissingSession && assetsDir) {
-    console.log("  \u{1F527} Fixing missing session continuity files...\n");
-    const created = await fixSessionContinuity(targetDir, assetsDir);
-    for (const file of created) {
-      console.log(`    \u2713 Created: ${file}`);
-    }
-    const stillMissing = (await checkSessionContinuity(targetDir)).filter((r) => !r.passed).length;
-    if (stillMissing > 0) {
-      console.log(
-        `
-  ${created.length} file(s) created; ${stillMissing} still missing (named above). Repo is not close-session-ready yet.
-`
-      );
-    } else if (created.length > 0) {
-      console.log(`
-  ${created.length} file(s) created. Repo is now close-session-ready.
-`);
-    } else {
-      console.log("    No files needed creation (all present).\n");
-    }
-  } else if (hasMissingSession && !options.fix) {
-    console.log("  \u{1F4A1} Run `spell doctor --fix` to create missing session files.\n");
+  const missing = findMissingRequires(manifest.components, manifest.profile);
+  if (missing.length === 0) {
+    return { name, passed: true, blocking: false, message: "every installed component's prerequisites are installed" };
   }
+  return {
+    name,
+    passed: false,
+    blocking: false,
+    message: missing.map(({ name: required, requiredBy }) => `${requiredBy.join(", ")} cites ${required}, which is not installed \u2014 ${getComponent(required).initOnly ? "" : "`spell update` installs it, or "}\`spell add ${required}\``).join("; ")
+  };
 }
-
-// src/commands/ward.ts
-import { readFile as readFile21 } from "fs/promises";
-
-// src/modules/ward.ts
-import { readdir as readdir12, readFile as readFile20 } from "fs/promises";
-import { join as join23, relative as relative2 } from "path";
-async function scanFileAllRules(absolutePath, displayPath, rules) {
-  const findings = [];
-  let content;
+async function checkNewlyAvailableComponents(targetDir) {
+  const name = "Newly available components";
+  let manifest;
   try {
-    content = await readFile20(absolutePath, "utf8");
+    manifest = await readManifest(targetDir);
   } catch {
-    return findings;
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no readable .arcane.json" };
   }
-  const lines = content.split("\n");
-  for (let index = 0; index < lines.length; index++) {
-    const searchable = lines[index].replace(/\{[A-Z][A-Z0-9_]*\}/g, "");
-    for (const rule of rules) {
-      if (rule.pattern.test(searchable)) {
-        findings.push({ file: displayPath, line: index + 1, rule: rule.label });
-      }
-    }
+  if (manifest.scope === "user" || !Array.isArray(manifest.components)) {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no repository install to compare" };
   }
-  return findings;
-}
-var VENDOR_IDENTIFIER_PROTECTION_LIST = [
-  "claude",
-  "gpt-4",
-  "gpt-3.5",
-  "gemini",
-  "llama",
-  "mistral",
-  "copilot",
-  "anthropic",
-  "openai"
-];
-var GREP_PROOF_EXTENSIONS = [".gif", ".png", ".jpg", ".jpeg", ".mp4", ".mov", ".mp3", ".wav"];
-var WARD_TEXT_EXTENSIONS = [
-  ".md",
-  ".ts",
-  ".tsx",
-  ".js",
-  ".jsx",
-  ".json",
-  ".yml",
-  ".yaml",
-  ".txt",
-  ".mdx"
-];
-function applyExclusions(findings, fileLines, exclusions) {
-  if (exclusions.length === 0) return findings;
-  return findings.filter((finding) => {
-    const applicable = exclusions.filter((e) => e.rule === finding.rule);
-    if (applicable.length === 0) return true;
-    const lines = fileLines.get(finding.file);
-    const lineText = lines?.[finding.line - 1] ?? "";
-    return !applicable.some((e) => lineText.includes(e.context));
-  });
+  const installed = manifest.components.flatMap(
+    (c) => (LEGACY_COMPONENT_MIGRATIONS[c.name] ?? [c.name]).map((n) => ({ ...c, name: n }))
+  );
+  const prerequisites = findMissingRequires(manifest.components, manifest.profile).map((m) => m.name);
+  const fresh = (await findNewlyAvailable(targetDir, manifest.profile, installed, effectiveSpellScope(manifest))).filter((c) => !prerequisites.includes(c.name));
+  if (fresh.length === 0) {
+    return { name, passed: true, blocking: false, message: "the profile has nothing this install lacks" };
+  }
+  const offerable = fresh.filter((c) => !getComponent(c.name).initOnly).map((c) => c.name);
+  const byHand = fresh.filter((c) => getComponent(c.name).initOnly).map((c) => c.name);
+  const parts = [];
+  if (offerable.length > 0) {
+    parts.push(`${offerable.join(", ")} \u2014 \`spell update --add-new\` installs ${offerable.length === 1 ? "it" : "them"}`);
+  }
+  if (byHand.length > 0) {
+    parts.push(`${byHand.join(", ")} \u2014 initOnly, so only ${byHand.map((n) => `\`spell add ${n}\``).join(", ")}`);
+  }
+  return { name, passed: false, blocking: false, message: `newly available for your profile, not installed: ${parts.join("; ")}` };
 }
-async function scanFilenames(root, rules, repoRoot = root) {
-  const findings = [];
-  let entries;
+async function checkMcpConfig(targetDir) {
+  const name = "MCP config (per-server timeout, I12)";
+  const filePath = join24(targetDir, ".mcp.json");
+  let raw;
   try {
-    entries = await readdir12(root, { withFileTypes: true });
+    raw = await readFile19(filePath, "utf8");
   } catch {
-    return findings;
+    return { name, passed: true, blocking: false, message: "no .mcp.json \u2014 nothing to check" };
   }
-  for (const entry of entries) {
-    const absolutePath = join23(root, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_DIRECTORIES.has(entry.name)) continue;
-      findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
-      continue;
-    }
-    const displayPath = relative2(repoRoot, absolutePath).replace(/\\/g, "/");
-    for (const rule of rules) {
-      if (rule.pattern.test(entry.name)) {
-        findings.push({ file: displayPath, line: 0, rule: rule.label });
-        break;
-      }
-    }
+  let rawParsed;
+  try {
+    rawParsed = JSON.parse(raw);
+  } catch {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: ".mcp.json exists but contains invalid JSON"
+    };
   }
-  return findings;
-}
-async function flagGrepProofMedia(root, repoRoot = root) {
-  const files = await collectScannableFiles(root, repoRoot, GREP_PROOF_EXTENSIONS);
-  return files.map(([, displayPath]) => ({
-    file: displayPath,
-    reason: "binary media format -- text extraction is unreliable; review manually for embedded identifiers"
-  }));
-}
-async function runWard(repoRoot, options = {}) {
-  const userTerms = options.terms ?? [];
-  const exclusions = options.exclusions ?? [];
-  const extensions = [...WARD_TEXT_EXTENSIONS, ...options.binaryExtensions ?? []];
-  const userRules = createDenylistRules(userTerms, "ward-term");
-  const vendorRules = createDenylistRules([...VENDOR_IDENTIFIER_PROTECTION_LIST], "ward-vendor");
-  const allRules = [...userRules, ...vendorRules];
-  const contentFiles = await collectScannableFiles(repoRoot, repoRoot, extensions);
-  const fileLines = /* @__PURE__ */ new Map();
-  const contentFindings = [];
-  for (const [absolutePath, displayPath] of contentFiles) {
-    const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
-    if (findings2.length > 0) {
-      try {
-        fileLines.set(displayPath, (await readFile20(absolutePath, "utf8")).split("\n"));
-      } catch {
-      }
-    }
-    contentFindings.push(...findings2);
+  if (!isRecord7(rawParsed)) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: ".mcp.json exists but is not a JSON object"
+    };
   }
-  const filenameFindings = await scanFilenames(repoRoot, allRules);
-  const combined = [...contentFindings, ...filenameFindings];
-  const excluded = applyExclusions(combined, fileLines, exclusions);
-  const vendorLabels = new Set(vendorRules.map((r) => r.label));
-  const findings = excluded.map((f) => ({
-    ...f,
-    category: vendorLabels.has(f.rule) ? "protected-vendor-identifier" : "leak"
-  }));
-  const mediaFlags = await flagGrepProofMedia(repoRoot);
-  return { findings, mediaFlags };
+  const parsed = rawParsed;
+  const servers = parsed.mcpServers ?? {};
+  const serverNames = Object.keys(servers);
+  if (serverNames.length === 0) {
+    return { name, passed: true, blocking: false, message: "no MCP servers configured" };
+  }
+  const exampleHits = [];
+  const placeholderHits = [];
+  for (const n of serverNames) {
+    const args = servers[n]?.args;
+    if (!Array.isArray(args)) continue;
+    for (const a of args) {
+      if (typeof a !== "string") continue;
+      if (a.startsWith(UNOWNED_EXAMPLE_SCOPE)) exampleHits.push(`${n} (${a})`);
+      if (a === RETIRED_SCAFFOLD_PLACEHOLDER) placeholderHits.push(n);
+    }
+  }
+  if (exampleHits.length > 0) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `.mcp.json runs a package under the ${UNOWNED_EXAMPLE_SCOPE} scope nobody here owns: ${exampleHits.join(", ")}. The old \`spell init\` scaffold shipped it as a placeholder, and \`npx -y\` would run whoever publishes it. Replace the entry with your own MCP server package, or remove it; the file is yours, so doctor does not edit it`
+    };
+  }
+  if (placeholderHits.length > 0) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `.mcp.json still holds the placeholder server from the retired mcp-config-template scaffold: ${placeholderHits.join(", ")} (${RETIRED_SCAFFOLD_PLACEHOLDER}). Clients load this file as live MCP config, so the placeholder fails on every session start. Delete the file if you run no MCP servers, or replace the entry with a real server package; the file is yours, so doctor does not edit it. An untouched scaffold is removed by \`spell update --prune\``
+    };
+  }
+  const missingTimeout = serverNames.filter((n) => typeof servers[n]?.timeout !== "number");
+  if (missingTimeout.length > 0) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `server(s) missing a "timeout": ${missingTimeout.join(", ")} \u2014 add "timeout": 30000 (milliseconds; Claude Code ignores a value below 1000) to each entry under mcpServers, so a stuck tool call ends after 30 s instead of running to the client's own idle limit (as long as 30 minutes)`
+    };
+  }
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: `${serverNames.length} server(s) configured, all with a timeout set`
+  };
 }
-
-// src/commands/ward.ts
-function parseTerms(raw) {
-  if (!raw) return [];
-  return raw.split(",").map((t) => t.trim()).filter(Boolean);
+function isDelegation(value) {
+  return isRecord7(value) && typeof value["id"] === "string" && typeof value["status"] === "string" && typeof value["scope"] === "string" && Array.isArray(value["excludedActions"]);
 }
-function parseTermsFileContent(raw) {
-  return raw.split(/[,\r\n]+/).map((t) => t.trim()).filter(Boolean);
+function isDelegationsFile(value) {
+  return isRecord7(value) && Array.isArray(value["delegations"]) && value["delegations"].every(isDelegation);
 }
-async function readTermsFile(filePath) {
+async function checkDelegations(targetDir) {
+  const name = "Standing delegations (T13)";
+  const filePath = join24(targetDir, ".arcane", "delegations.json");
+  let raw;
   try {
-    return parseTermsFileContent(await readFile21(filePath, "utf8"));
-  } catch (error2) {
-    console.warn(
-      `\u26A0 arcane: could not read --terms-file "${filePath}": ${error2.message}`
-    );
-    return [];
+    raw = await readFile19(filePath, "utf8");
+  } catch {
+    return { name, passed: true, blocking: false, message: "no delegations recorded" };
   }
-}
-async function runWardCli(targetDir, options = {}, exclusions = []) {
-  const terms = [
-    ...parseTerms(options.terms),
-    ...options.termsFile ? await readTermsFile(options.termsFile) : []
-  ];
-  const report = await runWard(targetDir, { terms, exclusions });
-  console.log("\nspell ward \u2014 scanning for leaked identifiers\n");
-  const leaks = report.findings.filter((f) => f.category === "leak");
-  const protectedHits = report.findings.filter((f) => f.category === "protected-vendor-identifier");
-  if (leaks.length === 0 && protectedHits.length === 0) {
-    console.log("  \u2713 No denylisted terms found.");
+  let rawParsed;
+  try {
+    rawParsed = JSON.parse(raw);
+  } catch {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `.arcane/delegations.json exists but contains invalid JSON`
+    };
   }
-  for (const finding of leaks) {
-    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
-    console.log(`  \u2717 [leak] ${where} \u2014 rule: ${finding.rule}`);
+  if (!isDelegationsFile(rawParsed)) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `.arcane/delegations.json exists but is not a valid delegations file (expected a "delegations" array of well-formed entries)`
+    };
   }
-  for (const finding of protectedHits) {
-    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
-    console.log(
-      `  \u26A0 [protected-vendor-identifier] ${where} \u2014 rule: ${finding.rule} \u2014 verify before any automated rename touches this line`
-    );
+  const parsed = rawParsed;
+  const active = parsed.delegations.filter((d) => d.status === "active");
+  if (active.length === 0) {
+    return { name, passed: true, blocking: false, message: "no active delegations" };
   }
-  if (report.mediaFlags.length > 0) {
-    console.log("\n  Grep-proof media flagged for manual review:");
-    for (const flag of report.mediaFlags) {
-      console.log(`    ? ${flag.file} \u2014 ${flag.reason}`);
-    }
+  const summary = active.map((d) => `${d.id} (scope: ${d.scope}; excludes: ${d.excludedActions.length} action(s))`).join("; ");
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: `${active.length} active: ${summary}`
+  };
+}
+async function checkPlatformBranchPolicy(targetDir) {
+  const name = "Platform branch/merge policy (T11)";
+  const targets = await pushTargets(targetDir);
+  const origin = targets.find((t) => t.remote === "origin") ?? targets[0];
+  const url = origin?.urls[0];
+  if (!url) {
+    return { name, passed: true, message: "no remote configured \u2014 nothing to check", blocking: false };
   }
-  console.log();
-  if (options.gate && leaks.length > 0) {
-    console.log(`  ${leaks.length} leak(s) found. Failing (--gate mode).
-`);
-    process.exitCode = 1;
-    return;
+  const github = parseGitHubRemote(url);
+  if (github) {
+    const rulesets = await fetchGitHubRulesets(github.owner, github.repo);
+    if (rulesets === null) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: `could not query GitHub Rulesets for ${github.owner}/${github.repo} \u2014 is \`gh\` installed and authenticated? Verify manually: gh api repos/${github.owner}/${github.repo}/rulesets`
+      };
+    }
+    const result = evaluateGitHubMergePolicy(rulesets);
+    return { name, passed: result.passed, blocking: false, message: result.message };
   }
-  if (leaks.length > 0) {
-    console.log(`  ${leaks.length} leak(s) found. Run with --gate to fail CI on this.
-`);
+  const ado = parseAdoRemote2(url);
+  if (ado) {
+    const policies = await fetchAdoMergeTypePolicies(ado.org, ado.project, ado.repo, "main");
+    if (policies === null) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: `could not query the Azure DevOps "Limit merge types" branch policy for ${ado.org}/${ado.project}/${ado.repo} \u2014 is \`az\` installed and authenticated? Verify manually in the ADO web UI under Branch Policies.`
+      };
+    }
+    const result = evaluateAdoMergePolicy(policies);
+    return { name, passed: result.passed, blocking: false, message: result.message };
   }
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: "remote is neither GitHub nor Azure DevOps \u2014 platform policy verification not available for this provider"
+  };
 }
-
-// src/commands/unblock-push.ts
-import { basename as basename3, resolve as resolve8 } from "path";
-import { input as input4 } from "@inquirer/prompts";
-async function runUnblockPush(targetDir) {
+async function checkManagedFileModes(targetDir) {
+  const name = "Managed files are regular files (#357)";
   let manifest;
   try {
     manifest = await readManifest(targetDir);
-  } catch (err) {
-    if (err instanceof ManifestNotFoundError) {
-      console.error('Not initialized. Run "spell init" first.');
-      process.exit(1);
-      return;
-    }
-    throw err;
+  } catch {
+    return { name, passed: true, skipped: true, message: "no .arcane.json \u2014 nothing to check" };
   }
-  const policy = manifest.push_policy ?? "open";
-  const stillInForce = await isHookEnforced(targetDir) || (await blockedRemotes(targetDir)).length > 0;
-  if (policy === "open" && !stillInForce) {
-    printInfo("This repository is not push-blocked \u2014 nothing to undo.");
-    return;
+  try {
+    await runGit(targetDir, ["rev-parse", "--git-dir"]);
+  } catch {
+    return { name, passed: true, skipped: true, message: "not a git repository \u2014 the index cannot be read" };
   }
-  if (policy === "open") {
-    printWarning(
-      "The manifest says push_policy: open, but this repository still has Arcane's push block in force \u2014 most likely a previous unblock only partly succeeded. Continuing so it can be finished."
-    );
+  const managed = [...new Set(manifest.components.flatMap((c) => c.files))];
+  const linkTracked = await listSymlinkTrackedPaths(targetDir);
+  const asLinks = managed.filter((file) => linkTracked.has(file));
+  const pathBodies = [];
+  for (const file of managed) {
+    if (!isClientShimPath(file) || asLinks.includes(file)) continue;
+    let body;
+    try {
+      body = await readFile19(join24(targetDir, file), "utf-8");
+    } catch {
+      continue;
+    }
+    if (looksLikeBarePath(body)) pathBodies.push(file);
   }
-  if (!process.stdin.isTTY) {
-    console.error(
-      "spell unblock-push must be run from an interactive terminal.\nLifting a push block is a deliberate decision, so it cannot be scripted, piped, or run in CI."
-    );
-    process.exit(1);
-    return;
+  if (asLinks.length === 0 && pathBodies.length === 0) {
+    return { name, passed: true, message: `${managed.length} managed path(s), all regular files` };
   }
-  const repoName = basename3(resolve8(targetDir));
-  if (repoName === "") {
-    console.error(
-      "Could not determine a repository name to confirm against (is this repository at a filesystem root?). Refusing to unblock."
-    );
-    process.exit(1);
-    return;
+  const parts = [];
+  if (asLinks.length > 0) {
+    parts.push(`${asLinks.length} tracked as a symlink (mode 120000): ${asLinks.join(", ")}`);
   }
-  printWarning(`This repository's push_policy is "${policy}".`);
-  printInfo(
-    "Unblocking restores the ability to push this repository's full history to its remote. Deleting a file later does not undo a push: the content stays in history, in any clone already made, and in the remote's own backups."
-  );
-  console.log();
-  const typed = await input4({
-    message: `Type the repository name to confirm (${repoName}):`
-  });
-  if (typed.trim() !== repoName) {
-    console.error(`
-Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
-    process.exit(1);
-    return;
+  if (pathBodies.length > 0) {
+    parts.push(`${pathBodies.length} client shim(s) whose body is only a path: ${pathBodies.join(", ")}`);
   }
-  await removePrePushHook(targetDir);
-  const results = await restorePushUrls(targetDir);
-  const restored = results.filter((r) => r.status === "restored").map((r) => r.remote);
-  const failed = results.filter((r) => r.status === "failed");
-  const stillBlocked = await blockedRemotes(targetDir);
-  const updated = {
-    ...manifest,
-    push_policy: "open",
-    push_policy_unblocked_at: (/* @__PURE__ */ new Date()).toISOString()
+  return {
+    name,
+    passed: false,
+    message: parts.join("; ") + " \u2014 clients silently skip or empty these spells. Run `spell update` (it rewrites them as regular files and stages the typechange), then commit."
   };
-  await writeManifest(targetDir, updated);
-  const hookStillOn = await isHookEnforced(targetDir);
-  const fullyLifted = failed.length === 0 && stillBlocked.length === 0 && !hookStillOn;
-  if (fullyLifted) {
-    printSuccess(`Push unblocked for "${repoName}".`);
-  } else {
-    printWarning(
-      `Push only PARTIALLY unblocked for "${repoName}". The manifest now says open; the repository is not fully open yet. Details below.`
-    );
-  }
-  if (restored.length > 0) {
-    printInfo(`Restored push URL for: ${restored.join(", ")}.`);
-  }
-  if (hookStillOn) {
-    printWarning(
-      "The pre-push hook is still in force. Arcane did not remove it because `core.hooksPath` is not one it owns, could not be read, or names a directory that a link takes outside this repository. Check `git config --show-scope --get core.hooksPath`."
-    );
-  }
-  if (failed.length > 0) {
-    printWarning(
-      `Could not restore the push URL for: ${failed.map((r) => `${r.remote} (${r.reason ?? "unknown error"})`).join("; ")}.`
-    );
-  }
-  if (stillBlocked.length > 0) {
-    printWarning(
-      `These remotes still have a blocked push URL and no recorded original: ${stillBlocked.join(", ")}. Set them yourself with \`git remote set-url --push <name> <url>\` \u2014 until then, pushing to them will fail even though the manifest now says open.`
-    );
-  }
-  printInfo(
-    "Recorded in .arcane.json as push_policy: open, with the time it was lifted. Commit that change so the repository's actual posture stays visible to everyone."
-  );
 }
-
-// src/commands/block-push.ts
-async function runBlockPush(targetDir) {
+async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
+  const name = "Spell scope (ARC-045)";
   let manifest;
   try {
     manifest = await readManifest(targetDir);
+  } catch {
+    return { name, passed: true, blocking: false, message: "no .arcane.json \u2014 nothing to check" };
+  }
+  if (effectiveSpellScope(manifest) === "repo") {
+    return {
+      name,
+      passed: true,
+      blocking: false,
+      message: "repo \u2014 this repository carries its own spells (the default)"
+    };
+  }
+  const storeRoot = userTierRoot(homeDir);
+  let store;
+  try {
+    store = await readManifest(storeRoot);
   } catch (err) {
-    if (err instanceof ManifestNotFoundError) {
-      console.error('Not initialized. Run "spell init" first.');
-      process.exit(1);
-      return;
-    }
-    throw err;
+    return {
+      name,
+      passed: false,
+      message: `this repository takes its spells from the user tier (spell_scope: "user"), but ${storeRoot} ${err instanceof ManifestNotFoundError ? "is not installed" : `could not be read (${err instanceof Error ? err.message : String(err)})`} \u2014 no client can reach a spell here. Run \`spell init --user\`, or set spell_scope back to "repo" and run \`spell update\`.`
+    };
   }
-  if (manifest.scope === "user") {
-    console.error(
-      "spell block-push applies to a repository, not the user tier: push_policy describes a repository."
-    );
-    process.exit(1);
-    return;
+  let spellCount = 0;
+  let probed = false;
+  const probe2 = "spell-status.md";
+  try {
+    const entries = await readdir11(join24(storeRoot, USER_TIER_SPELLS_DIR));
+    const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
+    spellCount = spells.length;
+    probed = spells.includes(probe2);
+  } catch {
   }
-  if ((await inspectGitRepository(targetDir)).status === "not-repository") {
-    console.error("spell block-push needs a Git repository: there is nothing here to block.");
-    process.exit(1);
-    return;
+  if (spellCount === 0 || !probed) {
+    return {
+      name,
+      passed: false,
+      message: `the user tier at ${storeRoot} holds ${spellCount} spell(s)${spellCount > 0 && !probed ? ` and not ${probe2}` : ""} \u2014 this repository expects it to supply every spell. Run \`spell update --user\`.`
+    };
   }
-  const recorded = manifest.push_policy ?? "open";
-  const alreadyEnforced = recorded === "blocked" && await isHookEnforced(targetDir) && (await undisabledRemotes(targetDir)).length === 0;
-  if (alreadyEnforced) {
-    printSuccess("Push is already blocked and enforced here. Nothing changed.");
-    if ((await listRemotes(targetDir)).length === 0) {
-      printWarning(
-        "No remote is configured, so only the pre-push hook is active. Re-run `spell block-push` after adding a remote to disable its push URL too."
-      );
+  const majorMinor = (v) => v.split(".").slice(0, 2).join(".");
+  if (typeof manifest.version === "string" && majorMinor(store.version) !== majorMinor(manifest.version)) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `this repository is at v${manifest.version} but the user tier it uses is at v${store.version} \u2014 run \`spell update --user\` (and \`spell update\` here) to bring them together.`
+    };
+  }
+  const repoExpectsAgents = await rosterExists(targetDir);
+  if (repoExpectsAgents && !await rosterExists(storeRoot, "user")) {
+    return {
+      name,
+      passed: false,
+      message: `this repository has an agent roster and takes its client files from the user tier, but ${storeRoot} has no roster of its own \u2014 no agent mode can reach a client here. Run \`spell agents init --user\`, or set spell_scope back to "repo" and run \`spell agents sync\`.`
+    };
+  }
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: `user \u2014 ${spellCount} spell(s) from ${storeRoot} (v${store.version}), ${probe2} present${repoExpectsAgents ? ", agent roster present in the tier" : ""}`
+  };
+}
+async function runDoctor(targetDir, options = {}, assetsDir) {
+  console.log("\nspell doctor \u2014 checking your Arcane environment\n");
+  if (options.leaks) {
+    const result = await checkSecrets(targetDir);
+    const icon = result.passed ? "\u2713" : "\u2717";
+    console.log(`  ${icon} [${result.passed ? "pass" : "FAIL"}] ${result.name}`);
+    if (!result.passed) {
+      console.log(`         ${result.message}`);
+      console.log("\n  One or more checks failed. Fix the issues above before proceeding.\n");
+      process.exitCode = 1;
+    } else {
+      console.log("\n  All checks passed. Your environment is ready.\n");
     }
-    printInfo("Run `spell unblock-push` from a terminal to undo this.");
     return;
   }
-  const outcome = await applyBlockedPushControls(targetDir, {
-    stopOnHookRefusal: true,
-    emit: (m) => m.level === "warning" ? printWarning(m.text) : printInfo(m.text)
-  });
-  const failedRemotes = outcome.urls.filter((u) => u.status === "failed");
-  if (!hookInForce(outcome.hook) || failedRemotes.length > 0) {
-    printWarning(
-      outcome.stoppedAtHook ? "Nothing was changed. Resolve the refusal above and re-run `spell block-push`." : "Push is NOT fully blocked: the remotes named above can still be pushed to. Fix them and re-run `spell block-push`."
-    );
-    if (recorded !== "blocked") {
-      printInfo(
-        `The manifest still records push_policy: "${recorded}" \u2014 it is not changed to "blocked" until both controls are in force.`
-      );
+  const results = await Promise.all([
+    checkNodeVersion(),
+    checkArcaneManifest(targetDir),
+    Promise.resolve(checkIncidentReleaseGate()),
+    checkPullRebase(targetDir),
+    checkPushPolicy(targetDir),
+    checkPlatformBranchPolicy(targetDir),
+    checkDelegations(targetDir),
+    checkMcpConfig(targetDir),
+    checkUserTier(resolveHomeDir(), options.packageVersion),
+    checkSpellScope(targetDir),
+    checkManagedFileModes(targetDir),
+    checkGovernancePlaceholders(targetDir),
+    checkComponentRequires(targetDir),
+    checkNewlyAvailableComponents(targetDir),
+    checkPresenceService()
+  ]);
+  const sessionResults = await checkSessionContinuity(targetDir);
+  results.push(...sessionResults);
+  let allPassed = true;
+  for (const result of results) {
+    const skipped = result.passed && result.skipped === true;
+    const icon = skipped ? "\u2013" : result.passed ? "\u2713" : result.blocking === false ? "\u26A0" : "\u2717";
+    const label2 = skipped ? "skip" : result.passed ? "pass" : result.blocking === false ? "warn" : "FAIL";
+    console.log(`  ${icon} [${label2}] ${result.name}`);
+    if (!result.passed || skipped) {
+      console.log(`         ${result.message}`);
+    }
+    if (!result.passed && result.blocking !== false) {
+      allPassed = false;
     }
-    process.exit(1);
-    return;
   }
-  if (recorded !== "blocked") {
-    await writeManifest(targetDir, { ...manifest, push_policy: "blocked" });
-    printSuccess(`Push blocked. Recorded push_policy: "blocked" (was "${recorded}") in .arcane.json.`);
-    printInfo("Commit that change so the repository's posture stays visible to everyone.");
+  console.log();
+  if (allPassed) {
+    console.log("  All checks passed. Your environment is ready.\n");
   } else {
-    printSuccess('Push blocked. The manifest already recorded push_policy: "blocked"; it is now enforced.');
+    console.log("  One or more checks failed. Fix the issues above before proceeding.\n");
+    process.exitCode = 1;
+  }
+  const hasMissingSession = sessionResults.some((r) => !r.passed);
+  if (options.fix && hasMissingSession && assetsDir) {
+    console.log("  \u{1F527} Fixing missing session continuity files...\n");
+    const created = await fixSessionContinuity(targetDir, assetsDir);
+    for (const file of created) {
+      console.log(`    \u2713 Created: ${file}`);
+    }
+    const stillMissing = (await checkSessionContinuity(targetDir)).filter((r) => !r.passed).length;
+    if (stillMissing > 0) {
+      console.log(
+        `
+  ${created.length} file(s) created; ${stillMissing} still missing (named above). Repo is not close-session-ready yet.
+`
+      );
+    } else if (created.length > 0) {
+      console.log(`
+  ${created.length} file(s) created. Repo is now close-session-ready.
+`);
+    } else {
+      console.log("    No files needed creation (all present).\n");
+    }
+  } else if (hasMissingSession && !options.fix) {
+    console.log("  \u{1F4A1} Run `spell doctor --fix` to create missing session files.\n");
+  }
+  if (options.fix) {
+    const removed = fixPresenceService();
+    if (removed !== null) console.log(`  \u{1F527} Removed the stale presence record ${removed} (the token stays).
+`);
   }
 }
 
-// src/modules/credential-store.ts
-import { createHash as createHash4, randomBytes } from "crypto";
-var CHUNK_SIZE = 1e3;
-var MAX_CHUNKS = 64;
-var INDEX_NAME = "session/index";
-var CHUNK_PREFIX = "session/";
-var INDEX_VERSION = 1;
-var KeychainUnavailableError = class extends Error {
-  constructor(operation, cause) {
-    super(`The OS keychain is not available (${operation} failed).`);
-    this.name = "KeychainUnavailableError";
-    this.cause = cause;
+// src/commands/ward.ts
+import { readFile as readFile21 } from "fs/promises";
+
+// src/modules/ward.ts
+import { readdir as readdir12, readFile as readFile20 } from "fs/promises";
+import { join as join25, relative as relative3 } from "path";
+async function scanFileAllRules(absolutePath, displayPath, rules) {
+  const findings = [];
+  let content;
+  try {
+    content = await readFile20(absolutePath, "utf8");
+  } catch {
+    return findings;
   }
-};
-function sha256Hex(value) {
-  return createHash4("sha256").update(value, "utf8").digest("hex");
-}
-function chunkName(gen, n) {
-  return `${CHUNK_PREFIX}${gen}/${n}`;
+  const lines = content.split("\n");
+  for (let index = 0; index < lines.length; index++) {
+    const searchable = lines[index].replace(/\{[A-Z][A-Z0-9_]*\}/g, "");
+    for (const rule of rules) {
+      if (rule.pattern.test(searchable)) {
+        findings.push({ file: displayPath, line: index + 1, rule: rule.label });
+      }
+    }
+  }
+  return findings;
 }
-function splitSecret(secret, size = CHUNK_SIZE) {
-  const chunks = [];
-  let start = 0;
-  while (start < secret.length) {
-    let end = Math.min(start + size, secret.length);
-    if (end < secret.length) {
-      const last = secret.charCodeAt(end - 1);
-      if (last >= 55296 && last <= 56319) end -= 1;
-    }
-    chunks.push(secret.slice(start, end));
-    start = end;
-  }
-  return chunks;
+var VENDOR_IDENTIFIER_PROTECTION_LIST = [
+  "claude",
+  "gpt-4",
+  "gpt-3.5",
+  "gemini",
+  "llama",
+  "mistral",
+  "copilot",
+  "anthropic",
+  "openai"
+];
+var GREP_PROOF_EXTENSIONS = [".gif", ".png", ".jpg", ".jpeg", ".mp4", ".mov", ".mp3", ".wav"];
+var WARD_TEXT_EXTENSIONS = [
+  ".md",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".json",
+  ".yml",
+  ".yaml",
+  ".txt",
+  ".mdx"
+];
+function applyExclusions(findings, fileLines, exclusions) {
+  if (exclusions.length === 0) return findings;
+  return findings.filter((finding) => {
+    const applicable = exclusions.filter((e) => e.rule === finding.rule);
+    if (applicable.length === 0) return true;
+    const lines = fileLines.get(finding.file);
+    const lineText = lines?.[finding.line - 1] ?? "";
+    return !applicable.some((e) => lineText.includes(e.context));
+  });
 }
-function parseIndex(raw) {
-  let parsed;
+async function scanFilenames(root, rules, repoRoot = root) {
+  const findings = [];
+  let entries;
   try {
-    parsed = JSON.parse(raw);
+    entries = await readdir12(root, { withFileTypes: true });
   } catch {
-    return null;
+    return findings;
   }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const o = parsed;
-  if (o["v"] !== INDEX_VERSION || typeof o["gen"] !== "string" || !/^[0-9a-f]{16}$/.test(o["gen"]) || typeof o["count"] !== "number" || !Number.isInteger(o["count"]) || o["count"] < 1 || o["count"] > MAX_CHUNKS || typeof o["sha256"] !== "string" || !/^[0-9a-f]{64}$/.test(o["sha256"])) {
-    return null;
+  for (const entry of entries) {
+    const absolutePath = join25(root, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRECTORIES.has(entry.name)) continue;
+      findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
+      continue;
+    }
+    const displayPath = relative3(repoRoot, absolutePath).replace(/\\/g, "/");
+    for (const rule of rules) {
+      if (rule.pattern.test(entry.name)) {
+        findings.push({ file: displayPath, line: 0, rule: rule.label });
+        break;
+      }
+    }
   }
-  return { v: o["v"], gen: o["gen"], count: o["count"], sha256: o["sha256"] };
+  return findings;
 }
-var ChunkedSecretStore = class {
-  constructor(backend) {
-    this.backend = backend;
-  }
-  backend;
-  guard(operation, fn) {
-    try {
-      return fn();
-    } catch (error2) {
-      throw new KeychainUnavailableError(operation, error2);
+async function flagGrepProofMedia(root, repoRoot = root) {
+  const files = await collectScannableFiles(root, repoRoot, GREP_PROOF_EXTENSIONS);
+  return files.map(([, displayPath]) => ({
+    file: displayPath,
+    reason: "binary media format -- text extraction is unreliable; review manually for embedded identifiers"
+  }));
+}
+async function runWard(repoRoot, options = {}) {
+  const userTerms = options.terms ?? [];
+  const exclusions = options.exclusions ?? [];
+  const extensions = [...WARD_TEXT_EXTENSIONS, ...options.binaryExtensions ?? []];
+  const userRules = createDenylistRules(userTerms, "ward-term");
+  const vendorRules = createDenylistRules([...VENDOR_IDENTIFIER_PROTECTION_LIST], "ward-vendor");
+  const allRules = [...userRules, ...vendorRules];
+  const contentFiles = await collectScannableFiles(repoRoot, repoRoot, extensions);
+  const fileLines = /* @__PURE__ */ new Map();
+  const contentFindings = [];
+  for (const [absolutePath, displayPath] of contentFiles) {
+    const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
+    if (findings2.length > 0) {
+      try {
+        fileLines.set(displayPath, (await readFile20(absolutePath, "utf8")).split("\n"));
+      } catch {
+      }
     }
+    contentFindings.push(...findings2);
   }
-  /** Reads the stored secret. Never throws for bad data; throws only when the keychain itself fails. */
-  load() {
-    const raw = this.guard("read", () => this.backend.get(INDEX_NAME));
-    if (raw === null) return { state: "signed-out" };
-    const index = parseIndex(raw);
-    if (index === null) return { state: "corrupt", reason: "the index entry is not valid" };
-    const parts = [];
-    for (let n = 0; n < index.count; n += 1) {
-      const part = this.guard("read", () => this.backend.get(chunkName(index.gen, n)));
-      if (part === null) return { state: "corrupt", reason: `chunk ${n} of ${index.count} is missing` };
-      parts.push(part);
-    }
-    const secret = parts.join("");
-    if (sha256Hex(secret) !== index.sha256) {
-      return { state: "corrupt", reason: "the stored pieces do not match their checksum" };
-    }
-    return { state: "ok", secret };
+  const filenameFindings = await scanFilenames(repoRoot, allRules);
+  const combined = [...contentFindings, ...filenameFindings];
+  const excluded = applyExclusions(combined, fileLines, exclusions);
+  const vendorLabels = new Set(vendorRules.map((r) => r.label));
+  const findings = excluded.map((f) => ({
+    ...f,
+    category: vendorLabels.has(f.rule) ? "protected-vendor-identifier" : "leak"
+  }));
+  const mediaFlags = await flagGrepProofMedia(repoRoot);
+  return { findings, mediaFlags };
+}
+
+// src/commands/ward.ts
+function parseTerms(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((t) => t.trim()).filter(Boolean);
+}
+function parseTermsFileContent(raw) {
+  return raw.split(/[,\r\n]+/).map((t) => t.trim()).filter(Boolean);
+}
+async function readTermsFile(filePath) {
+  try {
+    return parseTermsFileContent(await readFile21(filePath, "utf8"));
+  } catch (error2) {
+    console.warn(
+      `\u26A0 arcane: could not read --terms-file "${filePath}": ${error2.message}`
+    );
+    return [];
   }
-  /**
-   * Replaces the stored secret. The previous session stays readable until the
-   * new index is written; a failure before that leaves it untouched.
-   */
-  save(secret) {
-    if (secret.length === 0) throw new Error("Refusing to store an empty secret.");
-    const gen = randomBytes(8).toString("hex");
-    const chunks = splitSecret(secret);
-    if (chunks.length > MAX_CHUNKS) {
-      throw new Error(`Refusing to store a secret longer than ${MAX_CHUNKS * CHUNK_SIZE} characters.`);
-    }
-    chunks.forEach((chunk, n) => {
-      this.guard("write", () => this.backend.set(chunkName(gen, n), chunk));
-    });
-    const index = { v: INDEX_VERSION, gen, count: chunks.length, sha256: sha256Hex(secret) };
-    this.guard("write", () => this.backend.set(INDEX_NAME, JSON.stringify(index)));
-    try {
-      this.sweep(gen);
-    } catch {
-    }
+}
+async function runWardCli(targetDir, options = {}, exclusions = []) {
+  const terms = [
+    ...parseTerms(options.terms),
+    ...options.termsFile ? await readTermsFile(options.termsFile) : []
+  ];
+  const report = await runWard(targetDir, { terms, exclusions });
+  console.log("\nspell ward \u2014 scanning for leaked identifiers\n");
+  const leaks = report.findings.filter((f) => f.category === "leak");
+  const protectedHits = report.findings.filter((f) => f.category === "protected-vendor-identifier");
+  if (leaks.length === 0 && protectedHits.length === 0) {
+    console.log("  \u2713 No denylisted terms found.");
   }
-  /** Deletes everything this store wrote, strays included. Succeeds when nothing is stored. */
-  clear() {
-    this.guard("delete", () => this.backend.delete(INDEX_NAME));
-    this.sweep(null);
+  for (const finding of leaks) {
+    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
+    console.log(`  \u2717 [leak] ${where} \u2014 rule: ${finding.rule}`);
   }
-  /** Removes every chunk that does not belong to `keepGen` (all chunks when it is null). */
-  sweep(keepGen) {
-    const names = this.guard("list", () => this.backend.list());
-    for (const name of names) {
-      if (name === INDEX_NAME || !name.startsWith(CHUNK_PREFIX)) continue;
-      if (keepGen !== null && name.startsWith(`${CHUNK_PREFIX}${keepGen}/`)) continue;
-      this.guard("delete", () => this.backend.delete(name));
+  for (const finding of protectedHits) {
+    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
+    console.log(
+      `  \u26A0 [protected-vendor-identifier] ${where} \u2014 rule: ${finding.rule} \u2014 verify before any automated rename touches this line`
+    );
+  }
+  if (report.mediaFlags.length > 0) {
+    console.log("\n  Grep-proof media flagged for manual review:");
+    for (const flag of report.mediaFlags) {
+      console.log(`    ? ${flag.file} \u2014 ${flag.reason}`);
     }
   }
-};
-
-// src/modules/identity-config.ts
-function defineIdentityEnvironment(config) {
-  return {
-    ...config,
-    discoveryUrl: `https://${config.signInHost}/${config.tenantId}/v2.0/.well-known/openid-configuration`
-  };
-}
-var IDENTITY_ENVIRONMENTS = {
-  production: defineIdentityEnvironment({
-    environment: "production",
-    tenantId: "9f8edbfb-291c-4c4a-b9cc-8820a04f8973",
-    signInHost: "arcaneai.ciamlogin.com",
-    clientId: "7cd8f05d-9979-4458-8ca2-47c67748c41f"
-  }),
-  development: defineIdentityEnvironment({
-    environment: "development",
-    tenantId: "b365de0e-3026-4afe-bf5b-556fccb4ffcf",
-    signInHost: "arcaneaidev.ciamlogin.com",
-    clientId: "651be720-83cc-452b-8346-abf20713ad12"
-  })
-};
-var SIGN_IN_SCOPES = ["openid", "profile", "email", "offline_access"];
-var ENVIRONMENT_VARIABLE = "ARCANE_ENVIRONMENT";
-var UnknownEnvironmentError = class extends Error {
-  constructor(value) {
-    super(
-      `${ENVIRONMENT_VARIABLE}=${JSON.stringify(value)} is not an environment. Use "production" (the default) or "development".`
-    );
-    this.name = "UnknownEnvironmentError";
+  console.log();
+  if (options.gate && leaks.length > 0) {
+    console.log(`  ${leaks.length} leak(s) found. Failing (--gate mode).
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (leaks.length > 0) {
+    console.log(`  ${leaks.length} leak(s) found. Run with --gate to fail CI on this.
+`);
   }
-};
-function resolveIdentityEnvironment(env = process.env) {
-  const raw = (env[ENVIRONMENT_VARIABLE] ?? "").trim().toLowerCase();
-  if (raw === "" || raw === "prod" || raw === "production") return IDENTITY_ENVIRONMENTS.production;
-  if (raw === "dev" || raw === "development") return IDENTITY_ENVIRONMENTS.development;
-  throw new UnknownEnvironmentError(env[ENVIRONMENT_VARIABLE] ?? "");
+}
+
+// src/commands/unblock-push.ts
+import { basename as basename3, resolve as resolve8 } from "path";
+import { input as input4 } from "@inquirer/prompts";
+async function runUnblockPush(targetDir) {
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch (err) {
+    if (err instanceof ManifestNotFoundError) {
+      console.error('Not initialized. Run "spell init" first.');
+      process.exit(1);
+      return;
+    }
+    throw err;
+  }
+  const policy = manifest.push_policy ?? "open";
+  const stillInForce = await isHookEnforced(targetDir) || (await blockedRemotes(targetDir)).length > 0;
+  if (policy === "open" && !stillInForce) {
+    printInfo("This repository is not push-blocked \u2014 nothing to undo.");
+    return;
+  }
+  if (policy === "open") {
+    printWarning(
+      "The manifest says push_policy: open, but this repository still has Arcane's push block in force \u2014 most likely a previous unblock only partly succeeded. Continuing so it can be finished."
+    );
+  }
+  if (!process.stdin.isTTY) {
+    console.error(
+      "spell unblock-push must be run from an interactive terminal.\nLifting a push block is a deliberate decision, so it cannot be scripted, piped, or run in CI."
+    );
+    process.exit(1);
+    return;
+  }
+  const repoName = basename3(resolve8(targetDir));
+  if (repoName === "") {
+    console.error(
+      "Could not determine a repository name to confirm against (is this repository at a filesystem root?). Refusing to unblock."
+    );
+    process.exit(1);
+    return;
+  }
+  printWarning(`This repository's push_policy is "${policy}".`);
+  printInfo(
+    "Unblocking restores the ability to push this repository's full history to its remote. Deleting a file later does not undo a push: the content stays in history, in any clone already made, and in the remote's own backups."
+  );
+  console.log();
+  const typed = await input4({
+    message: `Type the repository name to confirm (${repoName}):`
+  });
+  if (typed.trim() !== repoName) {
+    console.error(`
+Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
+    process.exit(1);
+    return;
+  }
+  await removePrePushHook(targetDir);
+  const results = await restorePushUrls(targetDir);
+  const restored = results.filter((r) => r.status === "restored").map((r) => r.remote);
+  const failed = results.filter((r) => r.status === "failed");
+  const stillBlocked = await blockedRemotes(targetDir);
+  const updated = {
+    ...manifest,
+    push_policy: "open",
+    push_policy_unblocked_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeManifest(targetDir, updated);
+  const hookStillOn = await isHookEnforced(targetDir);
+  const fullyLifted = failed.length === 0 && stillBlocked.length === 0 && !hookStillOn;
+  if (fullyLifted) {
+    printSuccess(`Push unblocked for "${repoName}".`);
+  } else {
+    printWarning(
+      `Push only PARTIALLY unblocked for "${repoName}". The manifest now says open; the repository is not fully open yet. Details below.`
+    );
+  }
+  if (restored.length > 0) {
+    printInfo(`Restored push URL for: ${restored.join(", ")}.`);
+  }
+  if (hookStillOn) {
+    printWarning(
+      "The pre-push hook is still in force. Arcane did not remove it because `core.hooksPath` is not one it owns, could not be read, or names a directory that a link takes outside this repository. Check `git config --show-scope --get core.hooksPath`."
+    );
+  }
+  if (failed.length > 0) {
+    printWarning(
+      `Could not restore the push URL for: ${failed.map((r) => `${r.remote} (${r.reason ?? "unknown error"})`).join("; ")}.`
+    );
+  }
+  if (stillBlocked.length > 0) {
+    printWarning(
+      `These remotes still have a blocked push URL and no recorded original: ${stillBlocked.join(", ")}. Set them yourself with \`git remote set-url --push <name> <url>\` \u2014 until then, pushing to them will fail even though the manifest now says open.`
+    );
+  }
+  printInfo(
+    "Recorded in .arcane.json as push_policy: open, with the time it was lifted. Commit that change so the repository's actual posture stays visible to everyone."
+  );
+}
+
+// src/commands/block-push.ts
+async function runBlockPush(targetDir) {
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch (err) {
+    if (err instanceof ManifestNotFoundError) {
+      console.error('Not initialized. Run "spell init" first.');
+      process.exit(1);
+      return;
+    }
+    throw err;
+  }
+  if (manifest.scope === "user") {
+    console.error(
+      "spell block-push applies to a repository, not the user tier: push_policy describes a repository."
+    );
+    process.exit(1);
+    return;
+  }
+  if ((await inspectGitRepository(targetDir)).status === "not-repository") {
+    console.error("spell block-push needs a Git repository: there is nothing here to block.");
+    process.exit(1);
+    return;
+  }
+  const recorded = manifest.push_policy ?? "open";
+  const alreadyEnforced = recorded === "blocked" && await isHookEnforced(targetDir) && (await undisabledRemotes(targetDir)).length === 0;
+  if (alreadyEnforced) {
+    printSuccess("Push is already blocked and enforced here. Nothing changed.");
+    if ((await listRemotes(targetDir)).length === 0) {
+      printWarning(
+        "No remote is configured, so only the pre-push hook is active. Re-run `spell block-push` after adding a remote to disable its push URL too."
+      );
+    }
+    printInfo("Run `spell unblock-push` from a terminal to undo this.");
+    return;
+  }
+  const outcome = await applyBlockedPushControls(targetDir, {
+    stopOnHookRefusal: true,
+    emit: (m) => m.level === "warning" ? printWarning(m.text) : printInfo(m.text)
+  });
+  const failedRemotes = outcome.urls.filter((u) => u.status === "failed");
+  if (!hookInForce(outcome.hook) || failedRemotes.length > 0) {
+    printWarning(
+      outcome.stoppedAtHook ? "Nothing was changed. Resolve the refusal above and re-run `spell block-push`." : "Push is NOT fully blocked: the remotes named above can still be pushed to. Fix them and re-run `spell block-push`."
+    );
+    if (recorded !== "blocked") {
+      printInfo(
+        `The manifest still records push_policy: "${recorded}" \u2014 it is not changed to "blocked" until both controls are in force.`
+      );
+    }
+    process.exit(1);
+    return;
+  }
+  if (recorded !== "blocked") {
+    await writeManifest(targetDir, { ...manifest, push_policy: "blocked" });
+    printSuccess(`Push blocked. Recorded push_policy: "blocked" (was "${recorded}") in .arcane.json.`);
+    printInfo("Commit that change so the repository's posture stays visible to everyone.");
+  } else {
+    printSuccess('Push blocked. The manifest already recorded push_policy: "blocked"; it is now enforced.');
+  }
+}
+
+// src/modules/identity-config.ts
+function defineIdentityEnvironment(config) {
+  return {
+    ...config,
+    discoveryUrl: `https://${config.signInHost}/${config.tenantId}/v2.0/.well-known/openid-configuration`
+  };
+}
+var IDENTITY_ENVIRONMENTS = {
+  production: defineIdentityEnvironment({
+    environment: "production",
+    tenantId: "9f8edbfb-291c-4c4a-b9cc-8820a04f8973",
+    signInHost: "arcaneai.ciamlogin.com",
+    clientId: "7cd8f05d-9979-4458-8ca2-47c67748c41f"
+  }),
+  development: defineIdentityEnvironment({
+    environment: "development",
+    tenantId: "b365de0e-3026-4afe-bf5b-556fccb4ffcf",
+    signInHost: "arcaneaidev.ciamlogin.com",
+    clientId: "651be720-83cc-452b-8346-abf20713ad12"
+  })
+};
+var SIGN_IN_SCOPES = ["openid", "profile", "email", "offline_access"];
+var ENVIRONMENT_VARIABLE = "ARCANE_ENVIRONMENT";
+var UnknownEnvironmentError = class extends Error {
+  constructor(value) {
+    super(
+      `${ENVIRONMENT_VARIABLE}=${JSON.stringify(value)} is not an environment. Use "production" (the default) or "development".`
+    );
+    this.name = "UnknownEnvironmentError";
+  }
+};
+function resolveIdentityEnvironment(env = process.env) {
+  const raw = (env[ENVIRONMENT_VARIABLE] ?? "").trim().toLowerCase();
+  if (raw === "" || raw === "prod" || raw === "production") return IDENTITY_ENVIRONMENTS.production;
+  if (raw === "dev" || raw === "development") return IDENTITY_ENVIRONMENTS.development;
+  throw new UnknownEnvironmentError(env[ENVIRONMENT_VARIABLE] ?? "");
 }
 
 // src/modules/oidc.ts
@@ -9356,10 +9907,10 @@ import * as client from "openid-client";
 // src/modules/result-pages.ts
 import { createHash as createHash5 } from "crypto";
 import { readFile as readFile22 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 var RESULT_KINDS = ["success", "denied", "failure"];
 function resultPagePath(kind) {
-  return join24("sign-in", `sign-in-callback-${kind}.html`);
+  return join26("sign-in", `sign-in-callback-${kind}.html`);
 }
 function styleHashes(html) {
   return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match2) => {
@@ -9393,429 +9944,226 @@ function plainPage(heading, next) {
     [
       '<!doctype html><html lang="en"><meta charset="utf-8">',
       '<meta name="viewport" content="width=device-width, initial-scale=1">',
-      `<title>${heading} \u2014 Arcane</title>`,
-      "<style>:root{color-scheme:light dark}body{font-family:system-ui,sans-serif;margin:3rem;line-height:1.5}</style>",
-      `<body><h1>${heading}</h1><p>${next}</p></body></html>`
-    ].join("")
-  );
-}
-var PLAIN_RESULT_PAGES = {
-  success: plainPage("Signed in to Arcane", "Return to your terminal. Your browser can be closed now."),
-  denied: plainPage("Sign-in was not completed", "Return to your terminal to try again. No new session was stored."),
-  failure: plainPage("Could not finish sign-in", "Return to your terminal for details. No new session was stored.")
-};
-async function loadResultPages(assetsDir) {
-  try {
-    const [success, denied, failure] = await Promise.all(
-      RESULT_KINDS.map(async (kind) => resultPage(await readFile22(join24(assetsDir, resultPagePath(kind)), "utf8")))
-    );
-    return { success, denied, failure };
-  } catch {
-    return null;
-  }
-}
-
-// src/modules/oidc.ts
-var IdentityUnreachableError = class extends Error {
-  constructor(host, cause) {
-    super(`Could not reach the identity service at ${host}.`);
-    this.name = "IdentityUnreachableError";
-    this.cause = cause;
-  }
-};
-var LoginTimeoutError = class extends Error {
-  constructor() {
-    super("Timed out waiting for the sign-in to finish in the browser.");
-    this.name = "LoginTimeoutError";
-  }
-};
-var LoginBrowserUnavailableError = class extends Error {
-  constructor() {
-    super("No browser could be opened. Run `spell login --device-code` and finish signing in on another device.");
-    this.name = "LoginBrowserUnavailableError";
-  }
-};
-var LoginDeniedError = class extends Error {
-  constructor(code) {
-    super(`The identity service refused the sign-in (${code}).`);
-    this.name = "LoginDeniedError";
-  }
-};
-async function loadIdentityConfiguration(environment, options = {}) {
-  const fetchImpl = options.fetch ?? fetch;
-  let metadata;
-  try {
-    const response = await fetchImpl(environment.discoveryUrl, { redirect: "manual" });
-    if (!response.ok) throw new Error(`discovery returned HTTP ${response.status}`);
-    metadata = await response.json();
-  } catch (error2) {
-    throw new IdentityUnreachableError(environment.signInHost, error2);
-  }
-  if (typeof metadata.issuer !== "string" || !metadata.token_endpoint || !metadata.authorization_endpoint) {
-    throw new IdentityUnreachableError(environment.signInHost, new Error("discovery document incomplete"));
-  }
-  const config = new client.Configuration(metadata, environment.clientId, void 0, client.None());
-  if (options.fetch) config[client.customFetch] = options.fetch;
-  if (options.allowInsecureHttp) client.allowInsecureRequests(config);
-  return config;
-}
-function toTokenResult(tokens, previousRefreshToken) {
-  const claims = tokens.claims();
-  if (!claims?.sub) throw new Error("The identity service returned no account identifier.");
-  const refreshToken = tokens.refresh_token ?? previousRefreshToken;
-  if (!refreshToken) {
-    throw new Error("The identity service returned no refresh token; nothing can be stored.");
-  }
-  const now = /* @__PURE__ */ new Date();
-  const seconds = tokens.expiresIn() ?? 0;
-  const email = typeof claims["email"] === "string" ? claims["email"] : typeof claims["preferred_username"] === "string" ? claims["preferred_username"] : null;
-  return {
-    refreshToken,
-    sub: claims.sub,
-    email,
-    obtainedAt: now,
-    expiresAt: new Date(now.getTime() + seconds * 1e3)
-  };
-}
-var resultPath = (kind) => `/result/${kind}`;
-var RESULT_PATHS = new Set(RESULT_KINDS.map(resultPath));
-async function browserLogin(config, options) {
-  const codeVerifier = client.randomPKCECodeVerifier();
-  const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
-  const state = client.randomState();
-  const nonce = client.randomNonce();
-  const server = createServer();
-  await new Promise((resolve10, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve10());
-  });
-  const address = server.address();
-  if (address === null || typeof address === "string") {
-    server.close();
-    throw new Error("Could not open a loopback port for the sign-in.");
-  }
-  const redirectUri = new URL(`http://127.0.0.1:${address.port}`).href;
-  const authorizationUrl = client.buildAuthorizationUrl(config, {
-    redirect_uri: redirectUri,
-    scope: options.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state,
-    nonce
-  });
-  const pages = options.pages ?? PLAIN_RESULT_PAGES;
-  const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
-  let timer;
-  let callbackConsumed = false;
-  let browserResult;
-  const close = () => {
-    if (timer) clearTimeout(timer);
-    server.closeAllConnections?.();
-    server.close();
-  };
-  const tokens = new Promise((resolve10, reject) => {
-    server.on("request", (req, res) => {
-      const url = new URL(req.url ?? "/", redirectUri);
-      if (RESULT_PATHS.has(url.pathname)) {
-        if (!browserResult || url.pathname !== resultPath(browserResult.kind) || url.search !== "") {
-          res.writeHead(404).end();
-          return;
-        }
-        const served = browserResult;
-        const page = pages[served.kind];
-        const settle = () => {
-          if (served.kind === "success") resolve10(served.result);
-          else reject(served.error);
-        };
-        res.once("finish", settle).once("close", settle);
-        res.writeHead(200, page.headers).end(page.html);
-        return;
-      }
-      if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
-        res.writeHead(404).end();
-        return;
-      }
-      if (callbackConsumed) {
-        res.writeHead(409, { "cache-control": "no-store" }).end();
-        return;
-      }
-      if (url.searchParams.get("state") !== state) {
-        res.writeHead(400, pages.failure.headers).end(pages.failure.html);
-        return;
-      }
-      callbackConsumed = true;
-      const redirectToResult = (result) => {
-        browserResult = result;
-        res.writeHead(303, {
-          "cache-control": "no-store",
-          location: resultPath(result.kind),
-          "referrer-policy": "no-referrer"
-        }).end();
-        if (result.kind === "success") {
-          if (timer) clearTimeout(timer);
-          timer = setTimeout(() => resolve10(result.result), Math.min(timeoutMs, 5e3));
-        }
-      };
-      const errorCode = url.searchParams.get("error");
-      if (errorCode) {
-        const code = errorCode.replace(/[^a-z_]/gi, "");
-        redirectToResult({
-          kind: code === "access_denied" ? "denied" : "failure",
-          error: new LoginDeniedError(code)
-        });
-        return;
-      }
-      client.authorizationCodeGrant(config, url, {
-        pkceCodeVerifier: codeVerifier,
-        expectedState: state,
-        expectedNonce: nonce,
-        idTokenExpected: true
-      }).then(async (response) => {
-        const result = toTokenResult(response);
-        await options.onValidated?.(result);
-        redirectToResult({ kind: "success", result });
-      }).catch((error2) => {
-        redirectToResult({ kind: "failure", error: error2 });
-      });
-    });
-    timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
-  });
-  tokens.catch(() => {
-  });
-  try {
-    const opened = await options.openUrl(authorizationUrl.href);
-    if (!opened) {
-      options.onCannotOpen?.();
-      throw new LoginBrowserUnavailableError();
-    }
-    return await tokens;
-  } finally {
-    close();
-  }
-}
-async function deviceLogin(config, options) {
-  const handle = await client.initiateDeviceAuthorization(config, { scope: options.scopes.join(" ") });
-  options.prompt(handle.verification_uri, handle.user_code, handle.expires_in);
-  const response = await client.pollDeviceAuthorizationGrant(config, handle);
-  return toTokenResult(response);
-}
-async function refreshSession(config, refreshToken, scopes) {
-  const response = await client.refreshTokenGrant(config, refreshToken, { scope: scopes.join(" ") });
-  return toTokenResult(response, refreshToken);
-}
-function openInDefaultBrowser(url) {
-  const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  return new Promise((resolve10) => {
-    try {
-      const child = execFile3(command, args, { windowsHide: true }, (error2) => resolve10(!error2));
-      child.on("error", () => resolve10(false));
-    } catch {
-      resolve10(false);
-    }
-  });
-}
-
-// src/modules/session-store.ts
-import { execFileSync } from "child_process";
-import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
-import { userInfo } from "os";
-import { dirname as dirname12, join as join25 } from "path";
-
-// src/modules/keychain-backend.ts
-import { createRequire as createRequire2 } from "module";
-var KEYCHAIN_SERVICE = "arcane-cli";
-function createKeychainBackend(service = KEYCHAIN_SERVICE) {
-  let loaded = null;
-  const keyring = () => {
-    loaded ??= createRequire2(import.meta.url)("@napi-rs/keyring");
-    return loaded;
-  };
-  const entry = (name) => new (keyring()).Entry(service, name);
-  return {
-    get: (name) => entry(name).getPassword() ?? null,
-    set: (name, value) => {
-      entry(name).setPassword(value);
-    },
-    delete: (name) => {
-      entry(name).deletePassword();
-    },
-    list: () => keyring().findCredentials(service).map((credential) => credential.account)
-  };
-}
-
-// src/modules/session-store.ts
-var INSECURE_SESSION_FILE_NAME = "session-insecure.json";
-var SessionClearError = class extends Error {
-  constructor(keychainError, removed) {
-    super(keychainError.message);
-    this.keychainError = keychainError;
-    this.removed = removed;
-    this.name = "SessionClearError";
-    this.cause = keychainError;
-  }
-  keychainError;
-  removed;
-};
-function isIsoDate(value) {
-  return typeof value === "string" && !Number.isNaN(Date.parse(value));
+      `<title>${heading} \u2014 Arcane</title>`,
+      "<style>:root{color-scheme:light dark}body{font-family:system-ui,sans-serif;margin:3rem;line-height:1.5}</style>",
+      `<body><h1>${heading}</h1><p>${next}</p></body></html>`
+    ].join("")
+  );
 }
-function parseSessionRecord(raw) {
-  let parsed;
+var PLAIN_RESULT_PAGES = {
+  success: plainPage("Signed in to Arcane", "Return to your terminal. Your browser can be closed now."),
+  denied: plainPage("Sign-in was not completed", "Return to your terminal to try again. No new session was stored."),
+  failure: plainPage("Could not finish sign-in", "Return to your terminal for details. No new session was stored.")
+};
+async function loadResultPages(assetsDir) {
   try {
-    parsed = JSON.parse(raw);
+    const [success, denied, failure] = await Promise.all(
+      RESULT_KINDS.map(async (kind) => resultPage(await readFile22(join26(assetsDir, resultPagePath(kind)), "utf8")))
+    );
+    return { success, denied, failure };
   } catch {
     return null;
   }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const o = parsed;
-  if (o["v"] !== 1 || o["environment"] !== "production" && o["environment"] !== "development" || typeof o["sub"] !== "string" || o["sub"] === "" || !(typeof o["email"] === "string" || o["email"] === null) || typeof o["refreshToken"] !== "string" || o["refreshToken"] === "" || !isIsoDate(o["obtainedAt"]) || !isIsoDate(o["expiresAt"])) {
-    return null;
-  }
-  return {
-    v: 1,
-    environment: o["environment"],
-    sub: o["sub"],
-    email: o["email"],
-    refreshToken: o["refreshToken"],
-    obtainedAt: o["obtainedAt"],
-    expiresAt: o["expiresAt"]
-  };
 }
-var FileSecretBackend = class {
-  constructor(filePath, restrict = restrictToCurrentUser) {
-    this.filePath = filePath;
-    this.restrict = restrict;
-  }
-  filePath;
-  restrict;
-  exists() {
-    return existsSync2(this.filePath);
+
+// src/modules/oidc.ts
+var IdentityUnreachableError = class extends Error {
+  constructor(host, cause) {
+    super(`Could not reach the identity service at ${host}.`);
+    this.name = "IdentityUnreachableError";
+    this.cause = cause;
   }
-  read() {
-    if (!existsSync2(this.filePath)) return {};
-    const parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      throw new Error("the session file is not an object");
-    }
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      if (typeof v === "string") out[k] = v;
-    }
-    return out;
+};
+var LoginTimeoutError = class extends Error {
+  constructor() {
+    super("Timed out waiting for the sign-in to finish in the browser.");
+    this.name = "LoginTimeoutError";
   }
-  write(entries) {
-    if (Object.keys(entries).length === 0) {
-      rmSync(this.filePath, { force: true });
-      return;
-    }
-    mkdirSync(dirname12(this.filePath), { recursive: true });
-    const tmp = `${this.filePath}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(entries), { encoding: "utf8", mode: 384 });
-    try {
-      this.restrict(tmp);
-    } catch (error2) {
-      rmSync(tmp, { force: true });
-      throw new Error(
-        "Could not restrict the session file to your account, so it was not written.",
-        { cause: error2 }
-      );
-    }
-    renameSync(tmp, this.filePath);
+};
+var LoginBrowserUnavailableError = class extends Error {
+  constructor() {
+    super("No browser could be opened. Run `spell login --device-code` and finish signing in on another device.");
+    this.name = "LoginBrowserUnavailableError";
   }
-  get(name) {
-    return this.read()[name] ?? null;
+};
+var LoginDeniedError = class extends Error {
+  constructor(code) {
+    super(`The identity service refused the sign-in (${code}).`);
+    this.name = "LoginDeniedError";
   }
-  set(name, value) {
-    const entries = this.read();
-    entries[name] = value;
-    this.write(entries);
+};
+async function loadIdentityConfiguration(environment, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  let metadata;
+  try {
+    const response = await fetchImpl(environment.discoveryUrl, { redirect: "manual" });
+    if (!response.ok) throw new Error(`discovery returned HTTP ${response.status}`);
+    metadata = await response.json();
+  } catch (error2) {
+    throw new IdentityUnreachableError(environment.signInHost, error2);
   }
-  delete(name) {
-    const entries = this.read();
-    if (!(name in entries)) return;
-    delete entries[name];
-    this.write(entries);
+  if (typeof metadata.issuer !== "string" || !metadata.token_endpoint || !metadata.authorization_endpoint) {
+    throw new IdentityUnreachableError(environment.signInHost, new Error("discovery document incomplete"));
   }
-  list() {
-    return Object.keys(this.read());
+  const config = new client.Configuration(metadata, environment.clientId, void 0, client.None());
+  if (options.fetch) config[client.customFetch] = options.fetch;
+  if (options.allowInsecureHttp) client.allowInsecureRequests(config);
+  return config;
+}
+function toTokenResult(tokens, previousRefreshToken) {
+  const claims = tokens.claims();
+  if (!claims?.sub) throw new Error("The identity service returned no account identifier.");
+  const refreshToken = tokens.refresh_token ?? previousRefreshToken;
+  if (!refreshToken) {
+    throw new Error("The identity service returned no refresh token; nothing can be stored.");
   }
-  /** Removes the file itself, strays and all. */
-  remove() {
-    rmSync(this.filePath, { force: true });
+  const now = /* @__PURE__ */ new Date();
+  const seconds = tokens.expiresIn() ?? 0;
+  const email = typeof claims["email"] === "string" ? claims["email"] : typeof claims["preferred_username"] === "string" ? claims["preferred_username"] : null;
+  return {
+    refreshToken,
+    sub: claims.sub,
+    email,
+    obtainedAt: now,
+    expiresAt: new Date(now.getTime() + seconds * 1e3)
+  };
+}
+var resultPath = (kind) => `/result/${kind}`;
+var RESULT_PATHS = new Set(RESULT_KINDS.map(resultPath));
+async function browserLogin(config, options) {
+  const codeVerifier = client.randomPKCECodeVerifier();
+  const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+  const state = client.randomState();
+  const nonce = client.randomNonce();
+  const server = createServer();
+  await new Promise((resolve10, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve10());
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new Error("Could not open a loopback port for the sign-in.");
   }
-};
-function restrictToCurrentUser(filePath) {
-  if (process.platform !== "win32") return;
-  const account = userInfo().username;
-  execFileSync("icacls", [filePath, "/inheritance:r", "/grant:r", `${account}:F`], {
-    stdio: "ignore",
-    windowsHide: true
+  const redirectUri = new URL(`http://127.0.0.1:${address.port}`).href;
+  const authorizationUrl = client.buildAuthorizationUrl(config, {
+    redirect_uri: redirectUri,
+    scope: options.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    nonce
   });
-}
-function insecureSessionFilePath(homeDir) {
-  return join25(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
-}
-function createSessionStorage(options = {}) {
-  const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
-  const fileBackend = options.fileBackend ?? new FileSecretBackend(insecureSessionFilePath());
-  const file = new ChunkedSecretStore(fileBackend);
-  const interpret = (result, source) => {
-    if (result.state === "signed-out") return null;
-    if (result.state === "corrupt") return { state: "corrupt", source, reason: result.reason };
-    const record = parseSessionRecord(result.secret);
-    if (record === null) return { state: "corrupt", source, reason: "the stored session is not valid" };
-    return { state: "ok", source, record };
+  const pages = options.pages ?? PLAIN_RESULT_PAGES;
+  const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
+  let timer;
+  let callbackConsumed = false;
+  let browserResult;
+  const close = () => {
+    if (timer) clearTimeout(timer);
+    server.closeAllConnections?.();
+    server.close();
   };
-  return {
-    load() {
-      let keychainError;
-      try {
-        const fromKeychain = interpret(keychain.load(), "keychain");
-        if (fromKeychain) return fromKeychain;
-      } catch (error2) {
-        if (!(error2 instanceof KeychainUnavailableError)) throw error2;
-        keychainError = error2;
-      }
-      if (fileBackend.exists()) {
-        const fromFile = interpret(file.load(), "file");
-        if (fromFile) return fromFile;
-      }
-      return keychainError ? { state: "signed-out", keychainError } : { state: "signed-out" };
-    },
-    save(record, { insecure }) {
-      const serialized = JSON.stringify(record);
-      if (insecure) {
-        file.save(serialized);
-        try {
-          keychain.clear();
-        } catch {
+  const tokens = new Promise((resolve10, reject) => {
+    server.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", redirectUri);
+      if (RESULT_PATHS.has(url.pathname)) {
+        if (!browserResult || url.pathname !== resultPath(browserResult.kind) || url.search !== "") {
+          res.writeHead(404).end();
+          return;
         }
+        const served = browserResult;
+        const page = pages[served.kind];
+        const settle = () => {
+          if (served.kind === "success") resolve10(served.result);
+          else reject(served.error);
+        };
+        res.once("finish", settle).once("close", settle);
+        res.writeHead(200, page.headers).end(page.html);
         return;
       }
-      keychain.save(serialized);
-      fileBackend.remove();
-    },
-    clear() {
-      const removed = [];
-      let keychainError;
-      try {
-        const hadKeychainSession = keychain.load().state !== "signed-out";
-        keychain.clear();
-        if (hadKeychainSession) removed.push("keychain");
-      } catch (error2) {
-        keychainError = error2;
+      if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
+        res.writeHead(404).end();
+        return;
       }
-      if (fileBackend.exists()) {
-        fileBackend.remove();
-        removed.push("file");
+      if (callbackConsumed) {
+        res.writeHead(409, { "cache-control": "no-store" }).end();
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.writeHead(400, pages.failure.headers).end(pages.failure.html);
+        return;
       }
-      if (keychainError instanceof KeychainUnavailableError) {
-        throw new SessionClearError(keychainError, removed);
+      callbackConsumed = true;
+      const redirectToResult = (result) => {
+        browserResult = result;
+        res.writeHead(303, {
+          "cache-control": "no-store",
+          location: resultPath(result.kind),
+          "referrer-policy": "no-referrer"
+        }).end();
+        if (result.kind === "success") {
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => resolve10(result.result), Math.min(timeoutMs, 5e3));
+        }
+      };
+      const errorCode = url.searchParams.get("error");
+      if (errorCode) {
+        const code = errorCode.replace(/[^a-z_]/gi, "");
+        redirectToResult({
+          kind: code === "access_denied" ? "denied" : "failure",
+          error: new LoginDeniedError(code)
+        });
+        return;
       }
-      if (keychainError) throw keychainError;
-      return { removed };
+      client.authorizationCodeGrant(config, url, {
+        pkceCodeVerifier: codeVerifier,
+        expectedState: state,
+        expectedNonce: nonce,
+        idTokenExpected: true
+      }).then(async (response) => {
+        const result = toTokenResult(response);
+        await options.onValidated?.(result);
+        redirectToResult({ kind: "success", result });
+      }).catch((error2) => {
+        redirectToResult({ kind: "failure", error: error2 });
+      });
+    });
+    timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
+  });
+  tokens.catch(() => {
+  });
+  try {
+    const opened = await options.openUrl(authorizationUrl.href);
+    if (!opened) {
+      options.onCannotOpen?.();
+      throw new LoginBrowserUnavailableError();
     }
-  };
+    return await tokens;
+  } finally {
+    close();
+  }
+}
+async function deviceLogin(config, options) {
+  const handle = await client.initiateDeviceAuthorization(config, { scope: options.scopes.join(" ") });
+  options.prompt(handle.verification_uri, handle.user_code, handle.expires_in);
+  const response = await client.pollDeviceAuthorizationGrant(config, handle);
+  return toTokenResult(response);
+}
+async function refreshSession(config, refreshToken, scopes) {
+  const response = await client.refreshTokenGrant(config, refreshToken, { scope: scopes.join(" ") });
+  return toTokenResult(response, refreshToken);
+}
+function openInDefaultBrowser(url) {
+  const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  return new Promise((resolve10) => {
+    try {
+      const child = execFile3(command, args, { windowsHide: true }, (error2) => resolve10(!error2));
+      child.on("error", () => resolve10(false));
+    } catch {
+      resolve10(false);
+    }
+  });
 }
 
 // src/commands/login.ts
@@ -10021,15 +10369,15 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
 
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // src/modules/show-report/generate.ts
 import { mkdir as mkdir8, readdir as readdir13, readFile as readFile24, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename4, dirname as dirname13, isAbsolute, join as join27, relative as relative3, resolve as resolve9 } from "path";
+import { basename as basename4, dirname as dirname13, isAbsolute, join as join28, relative as relative4, resolve as resolve9 } from "path";
 
 // src/modules/show-report/model.ts
 import { readFile as readFile23 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -10376,11 +10724,11 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join26(options.rootDir, options.planRelPath);
-  const queueAbsPath = join26(options.rootDir, options.queueRelPath);
+  const planAbsPath = join27(options.rootDir, options.planRelPath);
+  const queueAbsPath = join27(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join26(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join26(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join27(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join27(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
     readFile23(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
@@ -10578,7 +10926,7 @@ function toPosix(path5) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile24(join27(rootDir, planRelPath), "utf8");
+    planContent = await readFile24(join28(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -10590,13 +10938,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join27(dirname13(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join28(dirname13(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join27(rootDir, "docs", "plans");
+  const plansDir = join28(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir13(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -10615,7 +10963,7 @@ async function discoverPrograms(rootDir) {
 }
 async function programFromPlanPath(rootDir, planPath) {
   const planAbs = isAbsolute(planPath) ? planPath : resolve9(rootDir, planPath);
-  const planRelPath = toPosix(relative3(rootDir, planAbs));
+  const planRelPath = toPosix(relative4(rootDir, planAbs));
   return programFromPlan(rootDir, basename4(dirname13(planAbs)), planRelPath);
 }
 function normalizeLineEndings2(content) {
@@ -10630,7 +10978,7 @@ async function readOptionalFile(path5) {
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile24(join27(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile24(join28(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -10662,18 +11010,18 @@ async function runReportGeneration(options) {
     const missing = JSON.parse(generated.json).sections.flatMap((section) => section.rows).filter((row) => row.descriptionState === "unwritten").map((row) => row.id);
     if (missing.length > 0) unwritten.push({ slug: program2.slug, ids: missing });
     const outAbs = options.outDir ? isAbsolute(options.outDir) ? options.outDir : resolve9(options.rootDir, options.outDir) : resolve9(options.rootDir, dirname13(program2.planRelPath));
-    const outRel = toPosix(relative3(options.rootDir, outAbs));
+    const outRel = toPosix(relative4(options.rootDir, outAbs));
     const outputs = [
       [`${outRel}/show-report.json`, generated.json],
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join27(options.rootDir, relPath));
+      const actual = await readOptionalFile(join28(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile11(join27(options.rootDir, relPath), expected, "utf8");
+          await writeFile11(join28(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -10684,7 +11032,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join28(assetsDir, "report", "show-report.template.html");
+  const templatePath = join29(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -10736,325 +11084,101 @@ async function runReport(targetDir, options = {}, assetsDir) {
     templatePath,
     mode: "write",
     programs,
-    outDir: options.out,
-    theme
-  });
-  for (const u of result.unwritten) {
-    console.warn(
-      `\u26A0 arcane: ${u.slug} has ${u.ids.length} epic(s) with no \`**Report:**\` line in PLAN.md -- they render as "unwritten": ${u.ids.join(", ")}.`
-    );
-  }
-  for (const slug of result.themeSkipped) {
-    console.warn(
-      `\u26A0 arcane: ${slug} -- --theme ${theme} requested, but this template has no theme toggle to set (older vendored template?); left unchanged.`
-    );
-  }
-  if (result.repaired.length === 0) {
-    console.log(`Show report: ${programs.length} program(s) already up to date.`);
-    return;
-  }
-  console.log(`Show report: wrote ${result.repaired.length} file(s).`);
-  for (const path5 of result.repaired) console.log(`  ${path5}`);
-}
-
-// src/modules/agent-ref.ts
-import { randomBytes as randomBytes2 } from "crypto";
-var REF_TYPES = ["agent", "template", "session"];
-var UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var ANY_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-function createUuidV7Generator(options = {}) {
-  const now = options.now ?? Date.now;
-  const random = options.random ?? ((n) => randomBytes2(n));
-  let lastMs = -1;
-  let counter = 0;
-  return () => {
-    let ms = Math.floor(now());
-    const bytes = random(10);
-    if (ms > lastMs) {
-      counter = (bytes[0] << 8 | bytes[1]) & 2047;
-    } else {
-      ms = lastMs;
-      counter += 1;
-      if (counter > 4095) {
-        ms += 1;
-        counter = (bytes[0] << 8 | bytes[1]) & 2047;
-      }
-    }
-    lastMs = ms;
-    const out = new Uint8Array(16);
-    let t = ms;
-    for (let i = 5; i >= 0; i -= 1) {
-      out[i] = t % 256;
-      t = Math.floor(t / 256);
-    }
-    out[6] = 112 | counter >> 8 & 15;
-    out[7] = counter & 255;
-    out[8] = 128 | bytes[2] & 63;
-    for (let i = 9; i < 16; i += 1) out[i] = bytes[i - 6];
-    const hex = Array.from(out, (b) => b.toString(16).padStart(2, "0")).join("");
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-  };
-}
-var defaultUuidV7 = createUuidV7Generator();
-function uuidv7() {
-  return defaultUuidV7();
-}
-function mintRef(type, generate = uuidv7) {
-  if (!REF_TYPES.includes(type)) {
-    throw new Error(`"${String(type)}" is not a registered reference type`);
-  }
-  return `arcane:${type}:${generate()}`;
-}
-function mintSessionRef() {
-  return mintRef("session");
-}
-function parseRef(text2, expected) {
-  if (typeof text2 !== "string") return { ok: false, reason: "a reference must be a string" };
-  if (text2.length === 0) return { ok: false, reason: "a reference must not be empty" };
-  if (text2 !== text2.trim()) return { ok: false, reason: "a reference must not carry surrounding whitespace" };
-  if (text2 !== text2.toLowerCase()) return { ok: false, reason: "a reference must be lowercase" };
-  const parts = text2.split(":");
-  if (parts.length !== 3 || parts[0] !== "arcane") {
-    return { ok: false, reason: 'a reference must have the form "arcane:<type>:<uuid>"' };
-  }
-  const type = parts[1];
-  const uuid = parts[2];
-  if (!REF_TYPES.includes(type)) {
-    return { ok: false, reason: `"${type}" is not a registered reference type` };
-  }
-  if (uuid.startsWith("{") || uuid.endsWith("}")) {
-    return { ok: false, reason: "a reference's uuid must not be braced" };
-  }
-  if (!ANY_UUID.test(uuid)) return { ok: false, reason: "a reference's uuid must be in canonical hex form" };
-  if (!UUID_V7.test(uuid)) return { ok: false, reason: "a reference's uuid must be a version 7 UUID" };
-  if (expected !== void 0 && type !== expected) {
-    return { ok: false, reason: `expected a ${expected} reference, got one of type ${type}` };
-  }
-  return { ok: true, type, uuid };
-}
-
-// src/modules/presence/client.ts
-import { request } from "http";
-
-// src/modules/presence/store.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join29, relative as relative4 } from "path";
-
-// src/modules/presence/types.ts
-var PRESENCE_CONTRACT = "v0";
-var DEFAULT_PORT = 27226;
-var PRESENCE_ENV = { port: "ARCANE_PRESENCE_PORT", token: "ARCANE_PRESENCE_TOKEN" };
-var LOOPBACK_HOST = "127.0.0.1";
-var MAX_BODY_BYTES = 65536;
-var MAX_LINE_CHARS = 256;
-var MAX_NEEDS_YOU = 20;
-var MAX_SUBSCRIBERS = 32;
-var MAX_SUBSCRIBER_BUFFER_BYTES = 1048576;
-var MAX_CONNECTIONS = 128;
-var MAX_SESSIONS = 256;
-var MAX_ALIASES = 32;
-var CONNECTIONS_CHECK_MS = 1e3;
-var HEADERS_TIMEOUT_MS = 5e3;
-var REQUEST_TIMEOUT_MS = 1e4;
-var STALE_AFTER_MS = 9e4;
-var EXPIRE_AFTER_MS = 864e5;
-var KEEPALIVE_MS = 15e3;
-var SWEEP_MS = 5e3;
-var HARNESSES = ["claude-code", "copilot", "codex", "openclaw", "cron", "other"];
-var REPORT_STATUSES = ["working", "waiting", "blocked", "idle"];
-var ALIAS_CONTEXTS = ["openclaw", "slug"];
-var HELLO_EVENT = "server.hello";
-function presenceCapabilities() {
-  return { observe: true, actions: [] };
-}
-function nullAgentBlock() {
-  return { ref: null, slug: null, name: null, origin: null, definition_revision: null, aliases: [] };
-}
-
-// src/modules/presence/store.ts
-var PRESENCE_DIR_NAME = "presence";
-var STORE_FILES = { token: "token", serverInfo: "server.json" };
-var PresenceStoreError = class extends Error {
-};
-function home(options) {
-  return options.home ?? resolveHomeDir();
-}
-function presenceDir(options = {}) {
-  return join29(userTierRoot(home(options)), PRESENCE_DIR_NAME);
-}
-function tokenPath(options = {}) {
-  return join29(presenceDir(options), STORE_FILES.token);
-}
-function serverInfoPath(options = {}) {
-  return join29(presenceDir(options), STORE_FILES.serverInfo);
-}
-function ensureStore(options = {}) {
-  const root = userTierRoot(home(options));
-  const dir = presenceDir(options);
-  mkdirSync2(root, { recursive: true });
-  const realRoot = resolveRealPath(root);
-  if (relative4(realRoot, resolveRealPath(dir)) !== PRESENCE_DIR_NAME) {
-    throw new PresenceStoreError(`Refusing to use ${dir}: it resolves outside ${root}.`);
-  }
-  if (relative4(realRoot, resolveRealPath(tokenPath(options))) !== join29(PRESENCE_DIR_NAME, STORE_FILES.token)) {
-    throw new PresenceStoreError(`Refusing to use ${tokenPath(options)}: it resolves outside ${dir}.`);
-  }
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  chmodSync(dir, 448);
-  return dir;
-}
-function writeRestricted(target, content, options) {
-  const restrict = options.restrict ?? restrictToCurrentUser;
-  const tmp = `${target}.${process.pid}.tmp`;
-  writeFileSync2(tmp, content, { encoding: "utf8", mode: 384 });
-  try {
-    restrict(tmp);
-  } catch (error2) {
-    rmSync2(tmp, { force: true });
-    throw new PresenceStoreError(`Could not restrict ${target} to your account, so it was not written.`, { cause: error2 });
-  }
-  renameSync2(tmp, target);
-  chmodSync(target, 384);
-}
-function generateToken() {
-  return randomBytes3(32).toString("base64url");
-}
-function readTokenFile(options) {
-  let raw;
-  try {
-    raw = readFileSync3(tokenPath(options), "utf8");
-  } catch {
-    return null;
+    outDir: options.out,
+    theme
+  });
+  for (const u of result.unwritten) {
+    console.warn(
+      `\u26A0 arcane: ${u.slug} has ${u.ids.length} epic(s) with no \`**Report:**\` line in PLAN.md -- they render as "unwritten": ${u.ids.join(", ")}.`
+    );
   }
-  const token = raw.replace(/[\r\n]+$/, "").trim();
-  return token.length > 0 ? token : null;
-}
-function ensureToken(options = {}) {
-  ensureStore(options);
-  const existing = options.rotate === true ? null : readTokenFile(options);
-  if (existing !== null) {
-    chmodSync(tokenPath(options), 384);
-    (options.restrict ?? restrictToCurrentUser)(tokenPath(options));
-    return existing;
+  for (const slug of result.themeSkipped) {
+    console.warn(
+      `\u26A0 arcane: ${slug} -- --theme ${theme} requested, but this template has no theme toggle to set (older vendored template?); left unchanged.`
+    );
   }
-  const token = generateToken();
-  writeRestricted(tokenPath(options), `${token}
-`, options);
-  return token;
-}
-function readToken(options = {}) {
-  const fromEnv = (options.env ?? process.env)[PRESENCE_ENV.token];
-  if (fromEnv !== void 0 && fromEnv.replace(/[\r\n]+$/, "") !== "") return fromEnv.replace(/[\r\n]+$/, "");
-  return readTokenFile(options);
-}
-function writeServerInfo(info, options = {}) {
-  ensureStore(options);
-  writeRestricted(serverInfoPath(options), `${JSON.stringify(info, null, 2)}
-`, options);
-}
-function readServerInfo(options = {}) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync3(serverInfoPath(options), "utf8"));
-  } catch {
-    return null;
+  if (result.repaired.length === 0) {
+    console.log(`Show report: ${programs.length} program(s) already up to date.`);
+    return;
   }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const o = parsed;
-  const generator = o["generator"];
-  const valid = typeof o["url"] === "string" && Number.isInteger(o["pid"]) && o["pid"] > 0 && Number.isInteger(o["port"]) && o["port"] >= 1 && o["port"] <= 65535 && typeof o["started_at"] === "string" && typeof generator === "object" && generator !== null && generator["name"] === "arcane-cli" && typeof generator["version"] === "string";
-  if (!valid) return null;
-  return {
-    url: o["url"],
-    pid: o["pid"],
-    port: o["port"],
-    started_at: o["started_at"],
-    generator: { name: "arcane-cli", version: generator["version"] }
-  };
-}
-function removeServerInfo(options = {}) {
-  rmSync2(serverInfoPath(options), { force: true });
+  console.log(`Show report: wrote ${result.repaired.length} file(s).`);
+  for (const path5 of result.repaired) console.log(`  ${path5}`);
 }
 
-// src/modules/presence/client.ts
-var CONNECT_TIMEOUT_MS = 1e3;
-var RESPONSE_TIMEOUT_MS = 1500;
-function pidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
+// src/modules/agent-ref.ts
+import { randomBytes as randomBytes3 } from "crypto";
+var REF_TYPES = ["agent", "template", "session"];
+var UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var ANY_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function createUuidV7Generator(options = {}) {
+  const now = options.now ?? Date.now;
+  const random = options.random ?? ((n) => randomBytes3(n));
+  let lastMs = -1;
+  let counter = 0;
+  return () => {
+    let ms = Math.floor(now());
+    const bytes = random(10);
+    if (ms > lastMs) {
+      counter = (bytes[0] << 8 | bytes[1]) & 2047;
+    } else {
+      ms = lastMs;
+      counter += 1;
+      if (counter > 4095) {
+        ms += 1;
+        counter = (bytes[0] << 8 | bytes[1]) & 2047;
+      }
+    }
+    lastMs = ms;
+    const out = new Uint8Array(16);
+    let t = ms;
+    for (let i = 5; i >= 0; i -= 1) {
+      out[i] = t % 256;
+      t = Math.floor(t / 256);
+    }
+    out[6] = 112 | counter >> 8 & 15;
+    out[7] = counter & 255;
+    out[8] = 128 | bytes[2] & 63;
+    for (let i = 9; i < 16; i += 1) out[i] = bytes[i - 6];
+    const hex = Array.from(out, (b) => b.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+  };
 }
-function resolveEndpoint(options = {}) {
-  const info = readServerInfo(options);
-  if (info === null || !pidAlive(info.pid)) return null;
-  const token = readToken({ ...options, env: options.env ?? process.env });
-  if (token === null) return null;
-  return { info, token };
+var defaultUuidV7 = createUuidV7Generator();
+function uuidv7() {
+  return defaultUuidV7();
 }
-function errorFields(body) {
-  const e = body?.error;
-  return { code: typeof e?.code === "string" ? e.code : null, field: typeof e?.field === "string" ? e.field : null };
+function mintRef(type, generate = uuidv7) {
+  if (!REF_TYPES.includes(type)) {
+    throw new Error(`"${String(type)}" is not a registered reference type`);
+  }
+  return `arcane:${type}:${generate()}`;
 }
-function send(port, token, method, path5, body, options = {}) {
-  const connectTimeout = options.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
-  const responseTimeout = options.responseTimeoutMs ?? RESPONSE_TIMEOUT_MS;
-  const payload = body === void 0 ? void 0 : JSON.stringify(body);
-  return new Promise((resolve10) => {
-    let settled = false;
-    const done = (result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(connectTimer);
-      clearTimeout(responseTimer);
-      resolve10(result);
-    };
-    const headers = { Authorization: `Bearer ${token}`, Accept: "application/json" };
-    if (payload !== void 0) {
-      headers["Content-Type"] = "application/json";
-      headers["Content-Length"] = Buffer.byteLength(payload);
-    }
-    const req = request({ host: LOOPBACK_HOST, port, method, path: path5, headers, agent: false }, (res) => {
-      const chunks = [];
-      res.on("data", (c) => chunks.push(c));
-      res.on("error", () => done({ kind: "unreachable" }));
-      res.on("end", () => {
-        const status = res.statusCode ?? 0;
-        const text2 = Buffer.concat(chunks).toString("utf8");
-        let parsed = null;
-        try {
-          parsed = text2.length > 0 ? JSON.parse(text2) : null;
-        } catch {
-          parsed = null;
-        }
-        if (status >= 200 && status < 300 && parsed !== null) done({ kind: "ok", status, body: parsed });
-        else if (status === 401 || status === 400 || status === 404 || status === 413) done({ kind: "refused", status, ...errorFields(parsed) });
-        else done({ kind: "unreachable" });
-      });
-    });
-    const connectTimer = setTimeout(() => {
-      req.destroy();
-      done({ kind: "unreachable" });
-    }, connectTimeout);
-    const responseTimer = setTimeout(() => {
-      req.destroy();
-      done({ kind: "unreachable" });
-    }, connectTimeout + responseTimeout);
-    req.on("socket", (socket) => {
-      socket.once("connect", () => clearTimeout(connectTimer));
-    });
-    req.on("error", () => done({ kind: "unreachable" }));
-    if (payload !== void 0) req.write(payload);
-    req.end();
-  });
+function mintSessionRef() {
+  return mintRef("session");
 }
-async function callPresence(method, path5, body, options = {}) {
-  const endpoint = resolveEndpoint(options);
-  if (endpoint === null) return { kind: "not-configured" };
-  return send(endpoint.info.port, endpoint.token, method, path5, body, options);
+function parseRef(text2, expected) {
+  if (typeof text2 !== "string") return { ok: false, reason: "a reference must be a string" };
+  if (text2.length === 0) return { ok: false, reason: "a reference must not be empty" };
+  if (text2 !== text2.trim()) return { ok: false, reason: "a reference must not carry surrounding whitespace" };
+  if (text2 !== text2.toLowerCase()) return { ok: false, reason: "a reference must be lowercase" };
+  const parts = text2.split(":");
+  if (parts.length !== 3 || parts[0] !== "arcane") {
+    return { ok: false, reason: 'a reference must have the form "arcane:<type>:<uuid>"' };
+  }
+  const type = parts[1];
+  const uuid = parts[2];
+  if (!REF_TYPES.includes(type)) {
+    return { ok: false, reason: `"${type}" is not a registered reference type` };
+  }
+  if (uuid.startsWith("{") || uuid.endsWith("}")) {
+    return { ok: false, reason: "a reference's uuid must not be braced" };
+  }
+  if (!ANY_UUID.test(uuid)) return { ok: false, reason: "a reference's uuid must be in canonical hex form" };
+  if (!UUID_V7.test(uuid)) return { ok: false, reason: "a reference's uuid must be a version 7 UUID" };
+  if (expected !== void 0 && type !== expected) {
+    return { ok: false, reason: `expected a ${expected} reference, got one of type ${type}` };
+  }
+  return { ok: true, type, uuid };
 }
 
 // src/modules/presence/mcp.ts
@@ -11220,9 +11344,11 @@ var SERVER_NAME = "arcane-presence";
 var NOT_CONFIGURED_TEXT = "no presence channel is configured on this machine";
 var VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
 var SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
+var SUBSCRIPTION_KEY = "io.modelcontextprotocol/subscriptionId";
+var FEED_RETRY_MS = 5e3;
 var SESSIONS_URI = "arcane://presence/sessions";
 var CAPABILITIES_URI = "arcane://presence/capabilities";
-var SERVER_CAPABILITIES = { tools: {}, resources: {} };
+var SERVER_CAPABILITIES = { tools: {}, resources: { subscribe: true } };
 var LINE = { type: "string", maxLength: 256 };
 var PRESENCE_TOOLS = [
   {
@@ -11321,9 +11447,132 @@ function serveMcp(options) {
     if (outcome.kind === "silent") return text(`No session was open for ${where}.`);
     return { ...text(`Ended ${outcome.record.session}.`), structuredContent: outcome.record };
   };
-  const read = async (uri) => {
+  const findResource = (uri) => {
     const resource = PRESENCE_RESOURCES.find((r) => r.uri === uri);
     if (resource === void 0) throw new RpcError(-32602, "Resource not found", { uri });
+    return resource;
+  };
+  const legacy = /* @__PURE__ */ new Set();
+  const listens = /* @__PURE__ */ new Map();
+  let pending = 0;
+  let feed = null;
+  let connecting = null;
+  let retry;
+  let down = false;
+  let closed2 = false;
+  const retryMs = options.feedRetryMs ?? FEED_RETRY_MS;
+  const watchesSessions = () => pending > 0 || legacy.has(SESSIONS_URI) || [...listens.values()].some((uris) => uris.includes(SESSIONS_URI));
+  const notifyUpdated = () => {
+    if (legacy.has(SESSIONS_URI)) write({ jsonrpc: "2.0", method: "notifications/resources/updated", params: { uri: SESSIONS_URI } });
+    for (const [id, uris] of listens) {
+      if (uris.includes(SESSIONS_URI)) write({ jsonrpc: "2.0", method: "notifications/resources/updated", params: { _meta: { [SUBSCRIPTION_KEY]: id }, uri: SESSIONS_URI } });
+    }
+  };
+  const releaseFeedIfIdle = () => {
+    if (watchesSessions()) return;
+    feed?.close();
+    feed = null;
+    clearTimeout(retry);
+    retry = void 0;
+    down = false;
+  };
+  const scheduleRetry = () => {
+    if (retry !== void 0 || closed2 || !watchesSessions()) return;
+    retry = setTimeout(() => {
+      retry = void 0;
+      void ensureFeed();
+    }, retryMs);
+    retry.unref();
+  };
+  const ensureFeed = () => {
+    if (closed2 || feed !== null || !watchesSessions()) return Promise.resolve();
+    if (connecting !== null) return connecting;
+    connecting = openEventFeed(
+      {
+        onEvent: (name) => {
+          if (SESSION_EVENTS.includes(name)) notifyUpdated();
+        },
+        onClose: () => {
+          feed = null;
+          if (closed2 || !watchesSessions()) return;
+          down = true;
+          notifyUpdated();
+          scheduleRetry();
+        }
+      },
+      deps
+    ).then((opened) => {
+      connecting = null;
+      if (opened === null) {
+        down = true;
+        scheduleRetry();
+        return;
+      }
+      if (closed2 || !watchesSessions()) {
+        opened.close();
+        return;
+      }
+      feed = opened;
+      if (down) {
+        down = false;
+        notifyUpdated();
+      }
+    });
+    return connecting;
+  };
+  const subscribe = async (uri) => {
+    const resource = findResource(uri);
+    if (resource.uri === SESSIONS_URI) {
+      pending++;
+      await ensureFeed();
+      pending--;
+    }
+    legacy.add(resource.uri);
+    return {};
+  };
+  const unsubscribe = (uri) => {
+    legacy.delete(findResource(uri).uri);
+    releaseFeedIfIdle();
+    return {};
+  };
+  const listen = async (id, params) => {
+    if (listens.has(id)) throw new RpcError(-32602, "A subscription with this id is already open", { id });
+    const filter = isObject(params["notifications"]) ? params["notifications"] : {};
+    const asked = filter["resourceSubscriptions"];
+    if (asked !== void 0 && (!Array.isArray(asked) || asked.some((u) => typeof u !== "string"))) {
+      throw new RpcError(-32602, "notifications.resourceSubscriptions must be a list of URIs");
+    }
+    const honored = Array.isArray(asked) && asked.includes(SESSIONS_URI) ? [SESSIONS_URI] : [];
+    if (honored.length > 0) {
+      pending++;
+      await ensureFeed();
+      pending--;
+    }
+    write({
+      jsonrpc: "2.0",
+      method: "notifications/subscriptions/acknowledged",
+      params: { _meta: { [SUBSCRIPTION_KEY]: id }, notifications: honored.length > 0 ? { resourceSubscriptions: honored } : {} }
+    });
+    listens.set(id, honored);
+  };
+  const cancel = (params) => {
+    const requestId = params["requestId"];
+    if ((typeof requestId === "string" || typeof requestId === "number") && listens.delete(requestId)) releaseFeedIfIdle();
+  };
+  const teardown = () => {
+    closed2 = true;
+    for (const id of listens.keys()) {
+      write({ jsonrpc: "2.0", id, result: { resultType: "complete", _meta: { [SUBSCRIPTION_KEY]: id } } });
+      write({ jsonrpc: "2.0", method: "notifications/cancelled", params: { requestId: id, reason: "The server's input closed." } });
+    }
+    listens.clear();
+    legacy.clear();
+    feed?.close();
+    feed = null;
+    clearTimeout(retry);
+  };
+  const read = async (uri) => {
+    const resource = findResource(uri);
     const result = await callPresence("GET", resource.uri === SESSIONS_URI ? "/v0/sessions" : "/v0/health", void 0, deps);
     if (result.kind !== "ok") return { contents: [{ uri: resource.uri, mimeType: "text/plain", text: NOT_CONFIGURED_TEXT }] };
     const body = resource.uri === SESSIONS_URI ? result.body : result.body.capabilities;
@@ -11351,6 +11600,10 @@ function serveMcp(options) {
         return { resources: PRESENCE_RESOURCES };
       case "resources/read":
         return read(params["uri"]);
+      case "resources/subscribe":
+        return subscribe(params["uri"]);
+      case "resources/unsubscribe":
+        return unsubscribe(params["uri"]);
       default:
         throw new RpcError(-32601, `Method not found: ${method}`);
     }
@@ -11377,7 +11630,10 @@ function serveMcp(options) {
     }
     const id = rawId ?? null;
     const params = isObject(message["params"]) ? message["params"] : {};
-    if (!hasId) return;
+    if (!hasId) {
+      if (method === "notifications/cancelled") cancel(params);
+      return;
+    }
     try {
       if (method === "initialize") {
         const requested2 = params["protocolVersion"];
@@ -11396,6 +11652,13 @@ function serveMcp(options) {
         reply(id, { resultType: "complete", supportedVersions: SUPPORTED_VERSIONS, capabilities: SERVER_CAPABILITIES, _meta: { [SERVER_INFO_KEY]: { name: SERVER_NAME, version: options.version } } });
         return;
       }
+      if (method === "subscriptions/listen") {
+        if (!modern) throw new RpcError(-32601, `Method not found: ${method}`);
+        if (id === null) throw new RpcError(-32600, "subscriptions/listen needs a request id");
+        await listen(id, params);
+        return;
+      }
+      if (modern && (method === "resources/subscribe" || method === "resources/unsubscribe")) throw new RpcError(-32601, `Method not found: ${method}`);
       const result = await handle(method, params);
       reply(id, modern ? { resultType: "complete", ...result } : result);
     } catch (error2) {
@@ -11415,7 +11678,10 @@ function serveMcp(options) {
       chain = chain.then(() => dispatch(line2));
     });
     lines.on("close", () => {
-      void chain.then(() => resolve10());
+      void chain.then(() => {
+        teardown();
+        resolve10();
+      });
     });
   });
 }
@@ -12062,6 +12328,12 @@ function isHealth(body) {
   const b = body;
   return b !== null && typeof b === "object" && b.ok === true && b.contract === "v0" && typeof b.started_at === "string";
 }
+function unavailableLine(info, result) {
+  if (result.kind === "refused" && result.status === 401) {
+    return `The presence service at ${info.url} refused this machine's token (rotated, or ${PRESENCE_ENV.token} is set to another value).`;
+  }
+  return `The presence service recorded at ${info.url} is not reachable.`;
+}
 async function runPresenceStatus(io = consoleIo, store = {}) {
   const info = readServerInfo(store);
   if (info === null) {
@@ -12076,12 +12348,59 @@ async function runPresenceStatus(io = consoleIo, store = {}) {
     io.out(`  sessions: ${result.body.sessions}`);
     return 0;
   }
-  if (result.kind === "refused" && result.status === 401) {
-    io.out(`The presence service at ${info.url} refused this machine's token (rotated, or ${PRESENCE_ENV.token} is set to another value).`);
+  io.out(unavailableLine(info, result));
+  return 1;
+}
+function isSnapshot(body) {
+  const b = body;
+  return b !== null && typeof b === "object" && Array.isArray(b.sessions) && typeof b.generated_at === "string";
+}
+function formatAge(fromIso, now) {
+  const seconds = Math.max(0, Math.floor((now - Date.parse(fromIso)) / 1e3));
+  if (!Number.isFinite(seconds)) return "-";
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
+  if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;
+  return `${Math.floor(seconds / 86400)}d`;
+}
+function renderSessionsTable(sessions, now) {
+  if (sessions.length === 0) return ["No session is reporting."];
+  const header = ["STATUS", "AGENT", "HARNESS", "REPOSITORY", "BRANCH", "AGE", "TASK"];
+  const rows = sessions.map((s) => [
+    s.stale ? "unknown" : s.status,
+    s.agent.slug ?? "-",
+    s.harness,
+    s.repository.name,
+    s.checkout.branch ?? "-",
+    formatAge(s.reported_at, now),
+    s.task ?? "-"
+  ]);
+  const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const line2 = (cells) => cells.map((c, i) => i === cells.length - 1 ? c : c.padEnd(widths[i])).join("  ").trimEnd();
+  const out = [line2(header)];
+  sessions.forEach((s, i) => {
+    out.push(line2(rows[i]));
+    for (const n of s.needs_you) out.push(`  needs you: ${n.reason === null ? n.action : `${n.action} \u2014 ${n.reason}`}`);
+  });
+  return out;
+}
+async function runPresenceSessions(options, io = consoleIo, store = {}, now = Date.now) {
+  const info = readServerInfo(store);
+  if (info === null) {
+    io.out(NOT_CONFIGURED);
     return 1;
   }
-  io.out(`The presence service recorded at ${info.url} is not reachable.`);
-  return 1;
+  const result = await callPresence("GET", "/v0/sessions", void 0, store);
+  if (result.kind !== "ok" || !isSnapshot(result.body)) {
+    io.out(unavailableLine(info, result));
+    return 1;
+  }
+  if (options.json === true) {
+    io.out(JSON.stringify(result.body, null, 2));
+    return 0;
+  }
+  for (const line2 of renderSessionsTable(result.body.sessions, now())) io.out(line2);
+  return 0;
 }
 async function waitForExit(pid, ms) {
   const until = Date.now() + ms;
@@ -12294,7 +12613,7 @@ program.command("logout").description("Sign out on this machine: remove the stor
 program.command("whoami").description("Show who is signed in; exits 1 when signed out").option("--verify", "Also check the session with the identity service").action(async (opts) => {
   await runWhoami({ verify: opts.verify });
 });
-program.command("doctor").description("Check your environment for Arcane prerequisites").option("--fix", "Automatically create missing session continuity files").option("--leaks", "Run only the on-demand secrets/credential scan (ARC-037), skipping the default checks").action(async (opts) => {
+program.command("doctor").description("Check your environment for Arcane prerequisites").option("--fix", "Create missing session continuity files, and remove a presence record whose service is gone").option("--leaks", "Run only the on-demand secrets/credential scan (ARC-037), skipping the default checks").action(async (opts) => {
   await runDoctor(
     process.cwd(),
     { fix: opts.fix, leaks: opts.leaks, packageVersion: packageJson.version },
@@ -12376,6 +12695,9 @@ presenceCommand.command("serve").description("Run the presence service in the fo
 presenceCommand.command("status").description("Say whether a presence service is running and answering this machine's token (exit 0) or not (exit 1)").action(async () => {
   process.exitCode = await runPresenceStatus();
 });
+presenceCommand.command("sessions").description("List the sessions the presence service holds: a table, or the GET /v0/sessions document with --json. Exit 1 when no channel answers").option("--json", "Print the snapshot document as JSON instead of the table").action(async (opts) => {
+  process.exitCode = await runPresenceSessions(opts);
+});
 presenceCommand.command("stop").description("Stop the presence service this machine recorded; exits 0 whether or not one was running").action(async () => {
   process.exitCode = await runPresenceStop();
 });