bazilion 0.10.0 → 0.12.0

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand25, runCommand, showUsage } from "citty";
+import { defineCommand as defineCommand26, runCommand, showUsage } from "citty";
 
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.10.0",
+  version: "0.12.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -68,6 +68,7 @@ var package_default = {
     "qrcode-terminal": "^0.12.0",
     react: "^19.2.7",
     "react-dom": "^19.2.7",
+    tar: "^7.5.16",
     typebox: "^1.3.0",
     undici: "^8.5.0",
     yaml: "^2.9.0"
@@ -372,12 +373,12 @@ var listCmd = defineCommand({
   async run({ args }) {
     const client = createClient2();
     const q = args.all ? "?includeArchived=true" : "";
-    const list3 = await client.get(`/api/agents${q}`);
-    if (list3.length === 0) {
+    const list5 = await client.get(`/api/agents${q}`);
+    if (list5.length === 0) {
       console.log("(no agents)");
       return;
     }
-    const rows = list3.map(
+    const rows = list5.map(
       (a) => args.long ? [a.id, a.status, a.name, a.profileId] : (
         // Short UUID prefix — all CLI commands accept 4+ char prefixes now.
         [a.id.slice(0, 8), a.status, a.name]
@@ -448,6 +449,74 @@ var deleteCmd = defineCommand({
     console.log(`deleted agent ${args.id}`);
   }
 });
+function bashApprovalModeForTty(inputIsTty, outputIsTty) {
+  return inputIsTty && outputIsTty ? "interactive" : "auto_deny";
+}
+function buildChatRequest(message, attachments, bashApprovalMode) {
+  return {
+    message,
+    bashApprovalMode,
+    ...attachments && attachments.length > 0 ? { attachments } : {}
+  };
+}
+function terminalSafe(value) {
+  let safe = "";
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    const isControl = code <= 9 || code >= 11 && code <= 31 || code >= 127 && code <= 159;
+    safe += isControl ? `\\x${code.toString(16).padStart(2, "0")}` : character;
+  }
+  return safe;
+}
+async function promptForCommandApproval(approval, prompt) {
+  prompt.write("  [shell command approval required]");
+  prompt.write("  command:");
+  for (const line of approval.command.split("\n")) prompt.write(`    ${terminalSafe(line)}`);
+  prompt.write("  risks:");
+  for (const risk of approval.risks) {
+    prompt.write(
+      `    - ${terminalSafe(risk.code)} (${terminalSafe(risk.severity)}): ${terminalSafe(risk.message)}`
+    );
+  }
+  try {
+    const answer = (await prompt.question("  Allow this command once? [y/N] ")).trim().toLowerCase();
+    return answer === "y" || answer === "yes" ? "allow" : "deny";
+  } catch {
+    prompt.write("  [approval input unavailable; denying]");
+    return "deny";
+  }
+}
+async function respondToCommandApproval(client, approval, prompt) {
+  const decision2 = prompt ? await promptForCommandApproval(approval, prompt) : "deny";
+  await client.post(`/api/shell-approvals/${encodeURIComponent(approval.id)}`, { decision: decision2 });
+  return decision2;
+}
+function closeDeltaLine(state) {
+  if (!state.inDeltaStream) return;
+  process.stdout.write("\n");
+  state.inDeltaStream = false;
+}
+function printCommandApprovalStatus(approval) {
+  switch (approval.status) {
+    case "allowed":
+      console.log("  [shell command allowed]");
+      break;
+    case "denied":
+      console.log("  [shell command denied]");
+      break;
+    case "auto_denied":
+      console.log("  [shell command auto-denied: non-interactive turn]");
+      break;
+    case "expired":
+      console.log("  [shell command approval expired]");
+      break;
+    case "cancelled":
+      console.log("  [shell command approval cancelled]");
+      break;
+    case "pending":
+      break;
+  }
+}
 function printEvent(e, state) {
   switch (e.type) {
     case "assistant_delta":
@@ -494,16 +563,32 @@ function printEvent(e, state) {
       break;
   }
 }
-async function streamTurn(client, agentId, message, attachments) {
+async function streamTurn(client, agentId, message, attachments, options = { bashApprovalMode: "auto_deny" }) {
   const state = { inDeltaStream: false };
-  for await (const frame of client.stream("POST", `/api/agents/${agentId}/chat`, {
-    message,
-    ...attachments && attachments.length > 0 ? { attachments } : {}
-  })) {
+  const respondedApprovalIds = /* @__PURE__ */ new Set();
+  for await (const frame of client.stream(
+    "POST",
+    `/api/agents/${agentId}/chat`,
+    buildChatRequest(message, attachments, options.bashApprovalMode)
+  )) {
     if (frame.kind === "event") {
-      if (frame.event.type !== "user_message") printEvent(frame.event, state);
+      const event = frame.event;
+      if (event.type === "command_approval") {
+        closeDeltaLine(state);
+        const approval = event.approval;
+        if (approval.status === "pending") {
+          if (!respondedApprovalIds.has(approval.id)) {
+            respondedApprovalIds.add(approval.id);
+            await respondToCommandApproval(client, approval, options.approvalPrompt);
+          }
+        } else {
+          printCommandApprovalStatus(approval);
+        }
+      } else if (event.type !== "user_message") {
+        printEvent(event, state);
+      }
     } else if (frame.kind === "fatal") {
-      if (state.inDeltaStream) process.stdout.write("\n");
+      closeDeltaLine(state);
       throw new Error(frame.error);
     }
   }
@@ -528,34 +613,78 @@ var chatCmd = defineCommand({
   async run({ args }) {
     const client = createClient2();
     const resolved = await client.get(`/api/agents/${args.id}`);
+    const bashApprovalMode = bashApprovalModeForTty(stdin.isTTY, stdout.isTTY);
     const attachments = [
       ...loadImages(asPaths(args.image)),
       ...loadFiles(asPaths(args.file))
     ];
     if (args.message || attachments.length > 0) {
-      await streamTurn(client, resolved.agent.id, args.message ?? "", attachments);
+      const rl2 = bashApprovalMode === "interactive" ? createInterface({ input: stdin, output: stdout }) : null;
+      try {
+        await streamTurn(client, resolved.agent.id, args.message ?? "", attachments, {
+          bashApprovalMode,
+          ...rl2 ? {
+            approvalPrompt: {
+              question: (question) => rl2.question(question),
+              write: (line) => console.log(line)
+            }
+          } : {}
+        });
+      } finally {
+        rl2?.close();
+      }
       return;
     }
     console.log(`chatting with ${resolved.agent.name} (${resolved.model})`);
     console.log("(type /exit to quit)");
     const rl = createInterface({ input: stdin, output: stdout });
-    rl.setPrompt("> ");
-    rl.prompt();
-    for await (const line of rl) {
-      const trimmed = line.trim();
-      if (trimmed === "/exit" || trimmed === "/quit") break;
-      if (!trimmed) {
+    try {
+      if (bashApprovalMode === "interactive") {
+        while (true) {
+          let line;
+          try {
+            line = await rl.question("> ");
+          } catch {
+            break;
+          }
+          const trimmed = line.trim();
+          if (trimmed === "/exit" || trimmed === "/quit") break;
+          if (!trimmed) continue;
+          try {
+            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
+              bashApprovalMode,
+              approvalPrompt: {
+                question: (question) => rl.question(question),
+                write: (output) => console.log(output)
+              }
+            });
+          } catch (err) {
+            console.error(`error: ${err.message}`);
+          }
+        }
+      } else {
+        rl.setPrompt("> ");
         rl.prompt();
-        continue;
-      }
-      try {
-        await streamTurn(client, resolved.agent.id, trimmed);
-      } catch (err) {
-        console.error(`error: ${err.message}`);
+        for await (const line of rl) {
+          const trimmed = line.trim();
+          if (trimmed === "/exit" || trimmed === "/quit") break;
+          if (!trimmed) {
+            rl.prompt();
+            continue;
+          }
+          try {
+            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
+              bashApprovalMode
+            });
+          } catch (err) {
+            console.error(`error: ${err.message}`);
+          }
+          rl.prompt();
+        }
       }
-      rl.prompt();
+    } finally {
+      rl.close();
     }
-    rl.close();
   }
 });
 var chatResetCmd = defineCommand({
@@ -567,8 +696,8 @@ var chatResetCmd = defineCommand({
   async run({ args }) {
     if (!args.force) {
       process.stdout.write(`reset all chat history for ${args.id}? [y/N] `);
-      const answer = await new Promise((resolve3) => {
-        process.stdin.once("data", (d) => resolve3(String(d).trim().toLowerCase()));
+      const answer = await new Promise((resolve4) => {
+        process.stdin.once("data", (d) => resolve4(String(d).trim().toLowerCase()));
       });
       if (answer !== "y" && answer !== "yes") {
         console.log("aborted");
@@ -716,8 +845,8 @@ var chatCompactCmd = defineCommand({
       process.stdout.write(
         `compact chat history for ${args.id}? head turns become a summary; tail is preserved. [y/N] `
       );
-      const answer = await new Promise((resolve3) => {
-        process.stdin.once("data", (d) => resolve3(String(d).trim().toLowerCase()));
+      const answer = await new Promise((resolve4) => {
+        process.stdin.once("data", (d) => resolve4(String(d).trim().toLowerCase()));
       });
       if (answer !== "y" && answer !== "yes") {
         console.log("aborted");
@@ -856,6 +985,159 @@ var cancelCmd = defineCommand({
     console.log(`cancelled active turn for ${args.id}`);
   }
 });
+var reviewConfigCmd = defineCommand({
+  meta: { name: "review-config", description: "Inspect or configure reviewed learning" },
+  args: {
+    id: { type: "positional", required: true, description: "Agent id or prefix" },
+    enable: { type: "boolean", description: "Enable periodic reviews" },
+    disable: { type: "boolean", description: "Disable periodic reviews" },
+    every: { type: "string", description: "Successful user turns between reviews (1-100)" },
+    model: { type: "string", description: "Review model, or 'agent' to use the Agent model" },
+    reasoning: { type: "string", description: "Review reasoning level" }
+  },
+  async run({ args }) {
+    if (args.enable && args.disable) throw new Error("choose either --enable or --disable");
+    const client = createClient2();
+    const body = {};
+    if (args.enable || args.disable) body.enabled = Boolean(args.enable);
+    if (args.every !== void 0) {
+      const value = Number(args.every);
+      if (!Number.isInteger(value) || value < 1 || value > 100) {
+        throw new Error("--every must be an integer from 1 to 100");
+      }
+      body.everyNTurns = value;
+    }
+    if (args.model !== void 0) body.model = args.model === "agent" ? null : args.model;
+    if (args.reasoning !== void 0) {
+      body.reasoningLevel = args.reasoning;
+    }
+    const hasChanges = Object.keys(body).length > 0;
+    const config = hasChanges ? await client.patch(`/api/agents/${args.id}/review-config`, body) : await client.get(`/api/agents/${args.id}/review-config`);
+    console.log(`review: ${config.enabled ? "enabled" : "disabled"}`);
+    console.log(`cadence: every ${config.everyNTurns} successful user turns`);
+    console.log(`model: ${config.model ?? "agent model"}`);
+    console.log(`reasoning: ${config.reasoningLevel}`);
+    console.log(`turns since last review: ${config.turnsSinceLast}`);
+  }
+});
+var reviewCmd = defineCommand({
+  meta: { name: "review", description: "Enqueue a reviewed-learning pass" },
+  args: { id: { type: "positional", required: true, description: "Agent id or prefix" } },
+  async run({ args }) {
+    const response = await createClient2().post(
+      `/api/agents/${args.id}/reviews`
+    );
+    console.log(`review ${response.review.id} ${response.review.status}`);
+  }
+});
+var reviewsCmd = defineCommand({
+  meta: { name: "reviews", description: "List reviewed-learning history" },
+  args: {
+    id: { type: "positional", required: true, description: "Agent id or prefix" },
+    status: { type: "string", description: "pending|running|retrying|completed|failed|cancelled" }
+  },
+  async run({ args }) {
+    const response = await createClient2().get(
+      `/api/agents/${args.id}/reviews`
+    );
+    const reviews = args.status ? response.reviews.filter((review) => review.status === args.status) : response.reviews;
+    if (reviews.length === 0) return console.log("(no reviews)");
+    for (const line of columnize(
+      reviews.map((review) => [
+        review.id,
+        review.status,
+        review.trigger,
+        `${review.proposalCount} proposal(s)`,
+        new Date(review.createdAt).toISOString()
+      ])
+    )) {
+      console.log(line);
+    }
+  }
+});
+var lessonsCmd = defineCommand({
+  meta: { name: "lessons", description: "List reviewed lesson proposals" },
+  args: {
+    id: { type: "positional", required: true, description: "Agent id or prefix" },
+    status: { type: "string", description: "pending|approved|rejected|revoked" }
+  },
+  async run({ args }) {
+    const status = args.status;
+    const query = status ? `?status=${encodeURIComponent(status)}` : "";
+    const response = await createClient2().get(
+      `/api/agents/${args.id}/lesson-proposals${query}`
+    );
+    if (response.proposals.length === 0) return console.log("(no lesson proposals)");
+    for (const line of columnize(
+      response.proposals.map((proposal) => [
+        proposal.id,
+        proposal.status,
+        proposal.scope,
+        proposal.text
+      ])
+    )) {
+      console.log(line);
+    }
+  }
+});
+async function locateProposal(id) {
+  const client = createClient2();
+  const agents = await client.get("/api/agents?includeArchived=true");
+  for (const agent of agents) {
+    const response = await client.get(
+      `/api/agents/${agent.id}/lesson-proposals`
+    );
+    const proposal = response.proposals.find((item) => item.id === id || item.id.startsWith(id));
+    if (proposal) return { agent, proposal };
+  }
+  throw new Error(`lesson proposal not found: ${id}`);
+}
+function lessonDecisionCmd(decision2) {
+  return defineCommand({
+    meta: { name: decision2, description: `${decision2} a reviewed lesson proposal` },
+    args: {
+      id: { type: "positional", required: true, description: "Proposal id or prefix" },
+      yes: { type: "boolean", description: `Confirm ${decision2}` }
+    },
+    async run({ args }) {
+      if (!args.yes) throw new Error(`${decision2} requires --yes`);
+      const { agent, proposal } = await locateProposal(args.id);
+      const response = await createClient2().post(
+        `/api/agents/${agent.id}/lesson-proposals/${proposal.id}/${decision2}`,
+        { version: proposal.version }
+      );
+      console.log(`${response.proposal.status} ${response.proposal.id}`);
+    }
+  });
+}
+var lessonEditCmd = defineCommand({
+  meta: { name: "edit", description: "Edit a pending reviewed lesson proposal" },
+  args: {
+    id: { type: "positional", required: true, description: "Proposal id or prefix" },
+    text: { type: "string", description: "Replacement lesson text" },
+    scope: { type: "string", description: "private|shared" }
+  },
+  async run({ args }) {
+    if (args.text === void 0 && args.scope === void 0) {
+      throw new Error("lesson edit requires --text or --scope");
+    }
+    const { agent, proposal } = await locateProposal(args.id);
+    const response = await createClient2().patch(
+      `/api/agents/${agent.id}/lesson-proposals/${proposal.id}`,
+      { version: proposal.version, text: args.text, scope: args.scope }
+    );
+    console.log(`updated ${response.proposal.id} v${response.proposal.version}`);
+  }
+});
+var lessonCmd = defineCommand({
+  meta: { name: "lesson", description: "Edit or decide a reviewed lesson proposal" },
+  subCommands: {
+    edit: lessonEditCmd,
+    approve: lessonDecisionCmd("approve"),
+    reject: lessonDecisionCmd("reject"),
+    revoke: lessonDecisionCmd("revoke")
+  }
+});
 var agentCommand = defineCommand({
   meta: { name: "agent", description: "Manage agent instances" },
   subCommands: {
@@ -872,6 +1154,11 @@ var agentCommand = defineCommand({
     "chat-context": chatContextCmd,
     "chat-compact": chatCompactCmd,
     cancel: cancelCmd,
+    "review-config": reviewConfigCmd,
+    review: reviewCmd,
+    reviews: reviewsCmd,
+    lessons: lessonsCmd,
+    lesson: lessonCmd,
     skill: skillCmd,
     move: moveCmd,
     "session-head": sessionHeadCmd
@@ -965,15 +1252,101 @@ var approvalCommand = defineCommand2({
   }
 });
 
+// src/commands/attention.ts
+import { defineCommand as defineCommand3 } from "citty";
+var list2 = defineCommand3({
+  meta: { name: "list", description: "List operator attention items" },
+  args: {
+    state: { type: "string", default: "open" },
+    kind: { type: "string" },
+    json: { type: "boolean" }
+  },
+  async run({ args }) {
+    const query = new URLSearchParams({ state: args.state, limit: "200" });
+    if (args.kind) query.set("kind", args.kind);
+    const body = await createClient2().get(`/api/attention?${query}`);
+    if (args.json) return console.log(JSON.stringify(body, null, 2));
+    if (!body.items.length) console.log("(nothing needs attention)");
+    else
+      for (const line of columnize([
+        ["severity", "kind", "context", "when", "key"],
+        ...body.items.map((item) => [
+          item.severity,
+          item.kind,
+          context(item),
+          new Date(item.occurredAt).toISOString(),
+          item.key
+        ])
+      ]))
+        console.log(line);
+    for (const source of body.degraded)
+      console.error(`warning: ${source.kind} unavailable: ${source.error}`);
+  }
+});
+var summary = defineCommand3({
+  meta: { name: "summary", description: "Summarize open attention items" },
+  args: { json: { type: "boolean" } },
+  async run({ args }) {
+    const body = await createClient2().get("/api/attention/summary");
+    if (args.json) console.log(JSON.stringify(body, null, 2));
+    else
+      console.log(
+        `${body.openTotal} open \xB7 ${body.bySeverity.action_required} action required \xB7 ${body.bySeverity.error} errors \xB7 ${body.bySeverity.warning} warnings`
+      );
+  }
+});
+function mutation(name) {
+  return defineCommand3({
+    meta: { name, description: `${name} one informational attention item` },
+    args: {
+      key: { type: "positional", required: true },
+      yes: { type: "boolean", description: "Required confirmation" },
+      json: { type: "boolean" }
+    },
+    async run({ args }) {
+      if (!args.yes) throw new Error(`refusing mutation: pass --yes to ${name}`);
+      const path = `/api/attention/${encodeURIComponent(args.key)}/${name === "acknowledge" ? "acknowledge" : "acknowledgement"}`;
+      const body = name === "acknowledge" ? await createClient2().post(path) : await createClient2().del(path);
+      if (args.json) console.log(JSON.stringify(body, null, 2));
+      else console.log(`${body.item.key}: ${body.item.acknowledgedAt ? "acknowledged" : "open"}`);
+    }
+  });
+}
+var acknowledgeAll = defineCommand3({
+  meta: { name: "acknowledge-all", description: "Acknowledge all open informational items" },
+  args: { yes: { type: "boolean" }, json: { type: "boolean" } },
+  async run({ args }) {
+    if (!args.yes) throw new Error("refusing mutation: pass --yes to acknowledge-all");
+    const body = await createClient2().post(
+      "/api/attention/acknowledge-all"
+    );
+    if (args.json) console.log(JSON.stringify(body, null, 2));
+    else console.log(`acknowledged ${body.acknowledged} informational item(s)`);
+  }
+});
+function context(item) {
+  return [item.agentName, item.teamName].filter(Boolean).join(" / ") || "system";
+}
+var attentionCommand = defineCommand3({
+  meta: { name: "attention", description: "Inspect the operator attention center" },
+  subCommands: {
+    list: list2,
+    summary,
+    acknowledge: mutation("acknowledge"),
+    unacknowledge: mutation("unacknowledge"),
+    "acknowledge-all": acknowledgeAll
+  }
+});
+
 // src/commands/auth.ts
 import { loginOpenAICodex } from "@earendil-works/pi-ai/oauth";
-import { defineCommand as defineCommand3 } from "citty";
+import { defineCommand as defineCommand4 } from "citty";
 function formatExpiry(ms) {
   if (!ms) return "(unknown)";
   const d = new Date(ms);
   return d.toISOString().replace(/\.\d+Z$/, "Z");
 }
-var openaiLoginCmd = defineCommand3({
+var openaiLoginCmd = defineCommand4({
   meta: {
     name: "login",
     description: "Connect your ChatGPT account via OAuth (browser sign-in)"
@@ -990,8 +1363,8 @@ var openaiLoginCmd = defineCommand3({
       },
       onPrompt: async (prompt) => {
         process.stdout.write(`${prompt.message}: `);
-        return new Promise((resolve3) => {
-          process.stdin.once("data", (d) => resolve3(String(d).trim()));
+        return new Promise((resolve4) => {
+          process.stdin.once("data", (d) => resolve4(String(d).trim()));
         });
       },
       onProgress: (msg) => {
@@ -1015,7 +1388,7 @@ var openaiLoginCmd = defineCommand3({
     console.log("  bazilion provider models-set openai-codex gpt-5.3-codex-spark");
   }
 });
-var openaiLogoutCmd = defineCommand3({
+var openaiLogoutCmd = defineCommand4({
   meta: {
     name: "logout",
     description: "Forget the stored ChatGPT OAuth credentials"
@@ -1026,7 +1399,7 @@ var openaiLogoutCmd = defineCommand3({
     console.log("disconnected ChatGPT OAuth credentials");
   }
 });
-var openaiStatusCmd = defineCommand3({
+var openaiStatusCmd = defineCommand4({
   meta: {
     name: "status",
     description: "Show ChatGPT OAuth connection status"
@@ -1043,7 +1416,7 @@ var openaiStatusCmd = defineCommand3({
     console.log(`access token expires: ${formatExpiry(status.expiresAt)}`);
   }
 });
-var openaiCmd = defineCommand3({
+var openaiCmd = defineCommand4({
   meta: {
     name: "openai",
     description: "Manage ChatGPT (OAuth) authentication"
@@ -1054,7 +1427,7 @@ var openaiCmd = defineCommand3({
     status: openaiStatusCmd
   }
 });
-var authCommand = defineCommand3({
+var authCommand = defineCommand4({
   meta: {
     name: "auth",
     description: "OAuth-based provider authentication (ChatGPT account, etc.)"
@@ -1065,13 +1438,448 @@ var authCommand = defineCommand3({
 });
 
 // src/commands/backup.ts
-import { spawn } from "child_process";
-import { createWriteStream, existsSync as existsSync2, mkdirSync, readdirSync, rmSync } from "fs";
-import { resolve } from "path";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  copyFileSync,
+  createWriteStream,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  openSync as openSync2,
+  readdirSync,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  rmSync as rmSync2
+} from "fs";
+import { tmpdir } from "os";
+import { basename as basename3, dirname as dirname2, isAbsolute, parse, posix, relative, resolve as resolve2 } from "path";
+import { DatabaseSync } from "node:sqlite";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
-import { defineCommand as defineCommand4 } from "citty";
-var createCmd = defineCommand4({
+import { defineCommand as defineCommand5 } from "citty";
+import { extract, list as list3 } from "tar";
+
+// src/backup-schema.ts
+import { createHash } from "crypto";
+var CANONICAL_MIGRATION = "0001_init";
+var CANONICAL_SCHEMA_HASH = "7c0867f97bd6a7d9c8a89f43f6ae7e5259c3976d40cd81a2061c43c30b7590a1";
+var CANONICAL_OBJECTS = [
+  ["index", "agent_triggers_agent"],
+  ["index", "agent_triggers_enabled"],
+  ["index", "agent_loop_break_events_agent_time"],
+  ["index", "agent_loop_break_events_team_time"],
+  ["index", "agent_lesson_proposals_agent_status_time"],
+  ["index", "agent_lesson_proposals_review"],
+  ["index", "agent_reviews_agent_time"],
+  ["index", "agent_reviews_claimable"],
+  ["index", "agent_reviews_one_open_per_agent"],
+  ["index", "communication_approval_events_attempt"],
+  ["index", "communication_approvals_queue"],
+  ["index", "communication_approvals_teams"],
+  ["index", "idx_agents_telegram_topic_id"],
+  ["index", "idx_provider_models_provider"],
+  ["index", "messages_policy_delivery_queue"],
+  ["index", "messages_causal_chain"],
+  ["index", "messages_to_unread"],
+  ["index", "team_policy_baseline_owner"],
+  ["index", "team_policy_blocks_team_time"],
+  ["index", "team_template_active_position"],
+  ["index", "trigger_dispatches_claimable"],
+  ["index", "trigger_dispatches_trigger_time"],
+  ["index", "web_tokens_active"],
+  ["table", "agent_skills"],
+  ["table", "agent_loop_break_events"],
+  ["table", "agent_lesson_proposals"],
+  ["table", "agent_reviews"],
+  ["table", "agent_triggers"],
+  ["table", "agents"],
+  ["table", "attention_acknowledgements"],
+  ["table", "communication_approval_events"],
+  ["table", "communication_approval_message_grants"],
+  ["table", "communication_approvals"],
+  ["table", "config"],
+  ["table", "mcp_servers"],
+  ["table", "messages"],
+  ["table", "profile_communication_defaults"],
+  ["table", "profile_default_skills"],
+  ["table", "profiles"],
+  ["table", "provider_models"],
+  ["table", "provider_state"],
+  ["table", "schema_migrations"],
+  ["table", "secrets"],
+  ["table", "skill_meta"],
+  ["table", "source_slot_bindings"],
+  ["table", "team_agent_state"],
+  ["table", "team_policies"],
+  ["table", "team_policy_block_events"],
+  ["table", "team_policy_edges"],
+  ["table", "team_template_edges"],
+  ["table", "team_template_revision_edges"],
+  ["table", "team_template_revision_slots"],
+  ["table", "team_template_revisions"],
+  ["table", "team_template_slots"],
+  ["table", "team_templates"],
+  ["table", "teams"],
+  ["table", "telegram_allowed_users"],
+  ["table", "template_instantiations"],
+  ["table", "trigger_dispatches"],
+  ["table", "web_tokens"],
+  ["trigger", "create_team_policy"],
+  ["trigger", "prevent_detached_team_policy_delete"],
+  ["trigger", "validate_source_binding_insert"],
+  ["trigger", "validate_team_agent_state_insert"],
+  ["trigger", "validate_team_policy_baseline_update"],
+  ["trigger", "validate_team_policy_edge_insert"],
+  ["trigger", "validate_team_template_edge_insert"]
+];
+function normalizeSql(sql) {
+  return sql.replace(/\s+/g, " ").trim();
+}
+function assertCanonicalBackupSchema(db) {
+  const migrations = db.prepare("SELECT version FROM schema_migrations ORDER BY version").all();
+  if (migrations.length !== 1 || migrations[0]?.version !== CANONICAL_MIGRATION) {
+    throw new Error(
+      `schema_migrations must contain exactly ${CANONICAL_MIGRATION}; found ` + (migrations.map((row) => row.version).join(", ") || "none")
+    );
+  }
+  const rows = db.prepare(
+    `SELECT type, name, tbl_name, sql
+       FROM sqlite_schema
+       WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%'`
+  ).all();
+  const byKey = new Map(rows.map((row) => [`${row.type}\0${row.name}`, row]));
+  const canonicalKeys = new Set(CANONICAL_OBJECTS.map(([type, name]) => `${type}\0${name}`));
+  for (const row of rows) {
+    if (!canonicalKeys.has(`${row.type}\0${row.name}`)) {
+      throw new Error(`unexpected schema ${row.type} is not canonical: ${row.name}`);
+    }
+  }
+  const canonicalRows = [];
+  for (const [type, name] of CANONICAL_OBJECTS) {
+    const row = byKey.get(`${type}\0${name}`);
+    if (!row) throw new Error(`required canonical schema ${type} is missing: ${name}`);
+    canonicalRows.push(row);
+  }
+  const payload = canonicalRows.map((row) => [row.type, row.name, row.tbl_name, normalizeSql(row.sql)].join("\0")).join("\n");
+  const actualHash = createHash("sha256").update(payload).digest("hex");
+  if (actualHash !== CANONICAL_SCHEMA_HASH) {
+    throw new Error(
+      "canonical schema fingerprint does not match this Bazilion release; restore a backup created from the current clean-install schema"
+    );
+  }
+}
+
+// src/daemon-liveness.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmodSync,
+  closeSync,
+  fstatSync,
+  fsyncSync,
+  ftruncateSync,
+  futimesSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync3,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeSync
+} from "fs";
+import { basename as basename2, dirname, join as join2, resolve } from "path";
+var DAEMON_LIVENESS_FILENAME = "daemon-runtime.json";
+var STALE_AFTER_MS = 6e4;
+var PROBE_TIMEOUT_MS = 750;
+function canonicalHomeIdentity(home) {
+  const absolute = resolve(home);
+  try {
+    return realpathSync.native(absolute);
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") throw error;
+    const parent = dirname(absolute);
+    if (parent === absolute) throw error;
+    return join2(canonicalHomeIdentity(parent), basename2(absolute));
+  }
+}
+function daemonLivenessPath(home) {
+  const canonicalHome = canonicalHomeIdentity(home);
+  const identity = createHash2("sha256").update(canonicalHome).digest("hex").slice(0, 24);
+  return join2(dirname(canonicalHome), `.bazilion-runtime-${identity}.json`);
+}
+function errorCode(error) {
+  return error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function parseRecord(raw) {
+  try {
+    const value = JSON.parse(raw);
+    if (value.version !== 1 || typeof value.instanceId !== "string" || !value.instanceId || !Number.isSafeInteger(value.pid) || (value.pid ?? 0) <= 0 || !["daemon", "restore"].includes(value.owner ?? "") || ![
+      "starting",
+      "listening",
+      "restoring",
+      "swapping",
+      "installed",
+      "recovery-required"
+    ].includes(value.state ?? "") || !Number.isFinite(value.startedAt)) {
+      return null;
+    }
+    if (value.owner === "daemon" && !["starting", "listening"].includes(value.state ?? "") || value.owner === "restore" && !["restoring", "swapping", "installed", "recovery-required"].includes(value.state ?? "")) {
+      return null;
+    }
+    if (value.owner === "restore" && ["swapping", "recovery-required"].includes(value.state ?? "") && (typeof value.recoveryPath !== "string" || !value.recoveryPath || typeof value.hadPrevious !== "boolean")) {
+      return null;
+    }
+    if (value.owner === "daemon" && value.state === "listening" && (typeof value.host !== "string" || !value.host || !Number.isSafeInteger(value.port) || (value.port ?? 0) < 1 || (value.port ?? 0) > 65535)) {
+      return null;
+    }
+    return value;
+  } catch {
+    return null;
+  }
+}
+function readRecord(path) {
+  try {
+    const stat = lstatSync(path);
+    const raw = stat.isFile() ? readFileSync3(path, "utf8") : "";
+    return { raw, stat, record: stat.isFile() ? parseRecord(raw) : null };
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return null;
+    throw error;
+  }
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCode(error) !== "ESRCH";
+  }
+}
+function endpointFor(record) {
+  if (record.state !== "listening" || !record.host || !record.port) return null;
+  const normalized = record.host.toLowerCase();
+  if (normalized === "0.0.0.0") return `http://127.0.0.1:${record.port}`;
+  if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") {
+    return `http://[::1]:${record.port}`;
+  }
+  if (normalized === "localhost" || normalized === "127.0.0.1") {
+    return `http://${normalized}:${record.port}`;
+  }
+  if (normalized === "::1" || normalized === "[::1]") {
+    return `http://[::1]:${record.port}`;
+  }
+  return null;
+}
+async function endpointHasOwner(endpoint3, instanceId) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  try {
+    const response = await fetch(new URL("/api/health", endpoint3), {
+      signal: controller.signal
+    });
+    return response.headers.get("x-bazilion-daemon-instance") === instanceId;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function sameFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function writeRecord(fd, record) {
+  const body = `${JSON.stringify(record, null, 2)}
+`;
+  ftruncateSync(fd, 0);
+  writeSync(fd, body, 0, "utf8");
+  fsyncSync(fd);
+}
+function fsyncParentDirectory(path) {
+  let directoryFd = null;
+  try {
+    directoryFd = openSync(dirname(path), "r");
+    fsyncSync(directoryFd);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  } finally {
+    if (directoryFd !== null) closeSync(directoryFd);
+  }
+}
+function reclaimRecord(path, existing) {
+  const identity = createHash2("sha256").update(existing.record?.instanceId ?? existing.raw).update(`\0${existing.stat.dev}\0${existing.stat.ino}`).digest("hex").slice(0, 24);
+  const claim = `${path}.reclaim-${identity}`;
+  try {
+    mkdirSync(claim, { mode: 448 });
+  } catch (error) {
+    if (errorCode(error) !== "EEXIST") throw error;
+    return null;
+  }
+  const current = readRecord(path);
+  if (!current || !sameFile(current.stat, existing.stat) || current.raw !== existing.raw) {
+    return null;
+  }
+  try {
+    renameSync(path, join2(claim, "stale-record.json"));
+    return claim;
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return null;
+    throw error;
+  }
+}
+async function acquireHomeRestoreLock(home) {
+  const targetHome = resolve(home);
+  mkdirSync(dirname(targetHome), { recursive: true });
+  const path = daemonLivenessPath(targetHome);
+  mkdirSync(dirname(path), { recursive: true });
+  const instanceId = randomUUID();
+  let fd = null;
+  let reclaimClaim = null;
+  for (let attempt = 0; attempt < 8 && fd === null; attempt++) {
+    try {
+      fd = openSync(path, "wx", 384);
+      break;
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    const existing = readRecord(path);
+    if (!existing) continue;
+    const endpoint3 = existing.record ? endpointFor(existing.record) : null;
+    if (endpoint3 && existing.record && await endpointHasOwner(endpoint3, existing.record.instanceId)) {
+      throw new Error(
+        `bazilion daemon is running at ${endpoint3} for ${targetHome} \u2014 stop it before restoring`
+      );
+    }
+    if (!existing.record) {
+      throw new Error(
+        `the daemon ownership record for ${targetHome} is invalid; verify no daemon is running before removing it manually`
+      );
+    }
+    const livePid = pidIsAlive(existing.record.pid);
+    if (existing.record.owner === "restore" && ["swapping", "recovery-required"].includes(existing.record.state)) {
+      if (livePid) {
+        throw new Error(
+          `bazilion restore process ${existing.record.pid} is ${existing.record.state} ${targetHome} \u2014 wait for it to finish`
+        );
+      }
+      const phase = existing.record.state.replace("-", " ");
+      throw new Error(
+        `Bazilion restore ${phase} for ${targetHome}; recovery data is at ${existing.record.recoveryPath}. Recover the previous home, then remove ${path} manually.`
+      );
+    }
+    if (livePid) {
+      const ageMs = Math.max(0, Date.now() - existing.stat.mtimeMs);
+      const staleDetail = ageMs > STALE_AFTER_MS ? " (its heartbeat is stale)" : "";
+      const owner = existing.record.owner === "daemon" ? "daemon" : "restore";
+      throw new Error(
+        `bazilion ${owner} process ${existing.record.pid} owns ${targetHome}${staleDetail} \u2014 stop it before restoring`
+      );
+    }
+    const claim = reclaimRecord(path, existing);
+    if (claim) {
+      reclaimClaim = claim;
+      console.warn(`removed stale Bazilion daemon ownership record for ${targetHome}`);
+    }
+  }
+  if (fd === null) {
+    throw new Error(
+      `could not safely acquire exclusive restore ownership for ${targetHome}; try again`
+    );
+  }
+  const ownedStat = fstatSync(fd);
+  const record = {
+    version: 1,
+    instanceId,
+    pid: process.pid,
+    owner: "restore",
+    state: "restoring",
+    startedAt: Date.now()
+  };
+  try {
+    writeRecord(fd, record);
+    fsyncParentDirectory(path);
+    if (reclaimClaim) rmSync(reclaimClaim, { recursive: true, force: true });
+    try {
+      chmodSync(path, 384);
+    } catch {
+    }
+  } catch (error) {
+    closeSync(fd);
+    fd = null;
+    try {
+      if (sameFile(lstatSync(path), ownedStat)) rmSync(path, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+  let released = false;
+  const stillOwnsPath = () => {
+    try {
+      return sameFile(lstatSync(path), ownedStat);
+    } catch {
+      return false;
+    }
+  };
+  const heartbeat = setInterval(() => {
+    if (released) return;
+    if (!stillOwnsPath()) {
+      console.error("restore ownership was lost; exiting to protect the Bazilion database");
+      process.exit(1);
+    }
+    try {
+      const now = /* @__PURE__ */ new Date();
+      futimesSync(fd, now, now);
+    } catch (error) {
+      console.error(
+        "restore ownership heartbeat failed:",
+        error instanceof Error ? error.message : error
+      );
+      process.exit(1);
+    }
+  }, 2e3);
+  heartbeat.unref();
+  return {
+    path,
+    markSwapping(recoveryPath, hadPrevious) {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "swapping";
+      record.recoveryPath = resolve(recoveryPath);
+      record.hadPrevious = hadPrevious;
+      writeRecord(fd, record);
+      fsyncParentDirectory(path);
+    },
+    markInstalled() {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "installed";
+      delete record.recoveryPath;
+      delete record.hadPrevious;
+      writeRecord(fd, record);
+    },
+    markRecoveryRequired(recoveryPath, hadPrevious) {
+      if (released || !stillOwnsPath()) throw new Error("restore ownership was lost");
+      record.state = "recovery-required";
+      record.recoveryPath = resolve(recoveryPath);
+      record.hadPrevious = hadPrevious;
+      writeRecord(fd, record);
+    },
+    release() {
+      if (released) return;
+      released = true;
+      clearInterval(heartbeat);
+      const ownsPath = stillOwnsPath();
+      const retainForRecovery = ["swapping", "recovery-required"].includes(record.state);
+      closeSync(fd);
+      fd = null;
+      if (ownsPath && !retainForRecovery) rmSync(path, { force: true });
+    }
+  };
+}
+
+// src/commands/backup.ts
+var createCmd = defineCommand5({
   meta: { name: "create", description: "Download a tar.gz backup of ~/.bazilion from the server" },
   args: {
     output: {
@@ -1083,7 +1891,14 @@ var createCmd = defineCommand4({
   async run({ args }) {
     const cfg = loadClientConfig();
     const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const outAbs = resolve(args.output ?? `bazilion-backup-${date}.tar.gz`);
+    const outAbs = resolve2(args.output ?? `bazilion-backup-${date}.tar.gz`);
+    const configuredHome = resolve2(resolveCliPaths().home);
+    const outputFromHome = relative(configuredHome, outAbs);
+    if (!outputFromHome || !outputFromHome.startsWith("..") && !isAbsolute(outputFromHome)) {
+      throw new Error(
+        `backup output must be outside BAZILION_HOME (${configuredHome}) to avoid nesting backups`
+      );
+    }
     console.log(`downloading backup \u2192 ${outAbs}`);
     const res = await fetch(`${cfg.serverUrl}/api/backup`, {
       headers: { authorization: `Bearer ${cfg.token}`, origin: cfg.serverUrl }
@@ -1097,22 +1912,463 @@ var createCmd = defineCommand4({
       }
       throw new Error(`backup failed: ${err}`);
     }
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(outAbs));
+    const downloadDir = mkdtempSync(resolve2(tmpdir(), "bazilion-download-"));
+    const partial = resolve2(downloadDir, "backup.tar.gz");
+    try {
+      await pipeline(
+        Readable.fromWeb(res.body),
+        createWriteStream(partial, { flags: "wx", mode: 384 })
+      );
+      await validateArchive(partial);
+      try {
+        renameSync2(partial, outAbs);
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EXDEV") throw error;
+        const installPartial = resolve2(
+          dirname2(outAbs),
+          `.${basename3(outAbs)}.${randomUUID2()}.installing`
+        );
+        try {
+          copyFileSync(partial, installPartial);
+          chmodSync2(installPartial, 384);
+          renameSync2(installPartial, outAbs);
+        } finally {
+          rmSync2(installPartial, { force: true });
+        }
+      }
+    } finally {
+      rmSync2(downloadDir, { recursive: true, force: true });
+    }
     console.log("done");
   }
 });
-async function probeServerRunning(port) {
+async function probeServerRunning(serverUrl) {
   try {
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), 500);
-    const res = await fetch(`http://127.0.0.1:${port}/login`, { signal: ctrl.signal });
-    clearTimeout(timer);
-    return res.status >= 200 && res.status < 600;
+    try {
+      const res = await fetch(new URL("/api/health", serverUrl), { signal: ctrl.signal });
+      return res.status >= 200 && res.status < 600;
+    } finally {
+      clearTimeout(timer);
+    }
   } catch {
     return false;
   }
 }
-var restoreCmd = defineCommand4({
+function loopbackServerUrl(raw) {
+  if (!raw) return null;
+  try {
+    const url = new URL(raw);
+    if (!["http:", "https:"].includes(url.protocol)) return null;
+    const hostname = url.hostname.toLowerCase();
+    if (!["127.0.0.1", "localhost", "[::1]", "::1"].includes(hostname)) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function configuredLoopbackUrls() {
+  const urls = /* @__PURE__ */ new Set(["http://127.0.0.1:4321"]);
+  const envUrl = loopbackServerUrl(process.env.BAZILION_SERVER);
+  if (envUrl) urls.add(envUrl);
+  try {
+    const clientUrl = loopbackServerUrl(loadClientConfig().serverUrl);
+    if (clientUrl) urls.add(clientUrl);
+  } catch {
+  }
+  return [...urls];
+}
+var EXTRACTABLE_ENTRY_TYPES = /* @__PURE__ */ new Set([
+  "File",
+  "OldFile",
+  "Directory",
+  "SymbolicLink"
+]);
+function normalizeArchivePath(rawPath) {
+  if (!rawPath || rawPath.includes("\0")) throw new Error("backup contains an invalid empty path");
+  if (rawPath.includes("\\")) {
+    throw new Error(`backup contains a non-portable path: ${JSON.stringify(rawPath)}`);
+  }
+  if (rawPath.startsWith("/") || /^[A-Za-z]:/.test(rawPath)) {
+    throw new Error(`backup contains an absolute path: ${JSON.stringify(rawPath)}`);
+  }
+  const segments = [];
+  for (const segment of rawPath.split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") {
+      throw new Error(`backup path escapes the restore directory: ${JSON.stringify(rawPath)}`);
+    }
+    segments.push(segment);
+  }
+  return segments.join("/");
+}
+function validateArchiveSymbolicLink(path, rawTarget) {
+  if (!rawTarget || rawTarget.includes("\0")) {
+    throw new Error(`backup contains an invalid symbolic link target: ${path}`);
+  }
+  const segments = path.split("/");
+  const isTeamSlot = segments.length === 2 && segments[0] === "teams" && /^[a-z0-9][a-z0-9-]*$/.test(segments[1] ?? "");
+  const portableTarget = rawTarget.replaceAll("\\", "/");
+  const absoluteOnAnyPlatform = isAbsolute(rawTarget) || posix.isAbsolute(portableTarget) || /^[A-Za-z]:\//.test(portableTarget);
+  if (absoluteOnAnyPlatform) {
+    if (!isTeamSlot) {
+      throw new Error(`backup absolute symbolic links are only allowed for Team slots: ${path}`);
+    }
+    if (!isAbsolute(rawTarget)) {
+      throw new Error(`backup contains an invalid Team link target: ${path}`);
+    }
+    return;
+  }
+  if (isTeamSlot) {
+    throw new Error(`backup contains an invalid Team link target: ${path}`);
+  }
+  if (/^[A-Za-z]:/.test(portableTarget)) {
+    throw new Error(`backup contains a non-portable symbolic link target: ${path}`);
+  }
+  const target = posix.normalize(posix.join(posix.dirname(path), portableTarget));
+  if (target === ".." || target.startsWith("../") || posix.isAbsolute(target)) {
+    throw new Error(`backup symbolic link target escapes the restore directory: ${path}`);
+  }
+}
+async function validateArchive(file) {
+  const entries = [];
+  await list3({
+    file,
+    strict: true,
+    onentry(entry2) {
+      if (entry2.meta) return;
+      const path = normalizeArchivePath(entry2.path);
+      if (!path) return;
+      if (!EXTRACTABLE_ENTRY_TYPES.has(entry2.type)) {
+        throw new Error(`backup contains unsupported ${entry2.type} entry: ${path}`);
+      }
+      if (entry2.type === "SymbolicLink") {
+        validateArchiveSymbolicLink(path, entry2.linkpath);
+      }
+      entries.push({ path, type: entry2.type, linkpath: entry2.linkpath });
+    }
+  });
+  const byPath = /* @__PURE__ */ new Map();
+  for (const entry2 of entries) {
+    if (byPath.has(entry2.path)) throw new Error(`backup contains a duplicate path: ${entry2.path}`);
+    byPath.set(entry2.path, entry2);
+  }
+  const symlinks = new Set(
+    entries.filter((entry2) => entry2.type === "SymbolicLink").map((entry2) => entry2.path)
+  );
+  for (const entry2 of entries) {
+    const segments = entry2.path.split("/");
+    for (let i = 1; i < segments.length; i++) {
+      const ancestor = segments.slice(0, i).join("/");
+      if (symlinks.has(ancestor)) {
+        throw new Error(`backup entry traverses symbolic link ${ancestor}: ${entry2.path}`);
+      }
+      const ancestorEntry = byPath.get(ancestor);
+      if (ancestorEntry && ancestorEntry.type !== "Directory") {
+        throw new Error(`backup entry traverses non-directory ${ancestor}: ${entry2.path}`);
+      }
+    }
+  }
+  for (const required of ["bazilion.db", "auth.json"]) {
+    const entry2 = byPath.get(required);
+    if (!entry2 || entry2.type !== "File" && entry2.type !== "OldFile") {
+      throw new Error(`backup is missing required regular file: ${required}`);
+    }
+  }
+  for (const transient of [
+    "bazilion.db-wal",
+    "bazilion.db-shm",
+    "bazilion.db-journal",
+    DAEMON_LIVENESS_FILENAME
+  ]) {
+    if (byPath.has(transient)) {
+      throw new Error(`backup contains unsafe transient SQLite file: ${transient}`);
+    }
+  }
+  return entries;
+}
+function validateAuthFile(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup auth.json is invalid: ${detail}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || !("token" in parsed) || typeof parsed.token !== "string" || !parsed.token.trim()) {
+    throw new Error("backup auth.json is invalid: token is missing");
+  }
+  return parsed.token;
+}
+function validateDatabase(path, authToken) {
+  let db = null;
+  try {
+    db = new DatabaseSync(path, { readOnly: true });
+    const integrity = db.prepare("PRAGMA integrity_check").all();
+    if (integrity.length !== 1 || integrity[0]?.integrity_check !== "ok") {
+      const detail = integrity.map((row) => row.integrity_check).join("; ") || "no result";
+      throw new Error(`integrity_check failed: ${detail}`);
+    }
+    const foreignKeyErrors = db.prepare("PRAGMA foreign_key_check").all();
+    if (foreignKeyErrors.length > 0) {
+      throw new Error(`foreign_key_check failed with ${foreignKeyErrors.length} violation(s)`);
+    }
+    assertCanonicalBackupSchema(db);
+    const tokenHash = createHash3("sha256").update(authToken).digest("hex");
+    const activeBootstrap = db.prepare(
+      `SELECT 1 FROM web_tokens
+         WHERE token_hash = ? AND label = 'bootstrap' AND revoked_at IS NULL
+         LIMIT 1`
+    ).get(tokenHash);
+    if (!activeBootstrap) {
+      throw new Error("auth.json token does not match an active web_tokens row");
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("backup database is invalid:")) {
+      throw error;
+    }
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup database is invalid: ${detail}`);
+  } finally {
+    db?.close();
+  }
+}
+var SLUG_ID = /^[a-z0-9][a-z0-9-]*$/;
+var AGENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function validateEntityId(id, pattern, entity) {
+  if (typeof id !== "string" || !pattern.test(id)) {
+    throw new Error(`${entity} has an invalid canonical id: ${JSON.stringify(id)}`);
+  }
+  return id;
+}
+function containedChildDirectory(root, id, rowLabel) {
+  const child = resolve2(root, id);
+  const fromRoot = relative(root, child);
+  if (!fromRoot || fromRoot.startsWith("..") || isAbsolute(fromRoot)) {
+    throw new Error(`${rowLabel} directory escapes its canonical root: ${JSON.stringify(id)}`);
+  }
+  return child;
+}
+function requireExtractedDirectory(path, rowLabel) {
+  try {
+    if (lstatSync2(path).isDirectory()) return;
+  } catch {
+  }
+  throw new Error(`${rowLabel} is missing its canonical directory in the backup`);
+}
+function requireExtractedTeamSlot(path, rowLabel) {
+  try {
+    const entry2 = lstatSync2(path);
+    if (entry2.isDirectory() || entry2.isSymbolicLink()) return;
+  } catch {
+  }
+  throw new Error(`${rowLabel} is missing its canonical Team slot in the backup`);
+}
+function rebaseRestoredHomeDirectories(database, payload, targetHome) {
+  let db = null;
+  try {
+    db = new DatabaseSync(database);
+    db.exec("PRAGMA foreign_keys = ON");
+    const profiles = db.prepare("SELECT id FROM profiles ORDER BY id").all();
+    const agents = db.prepare("SELECT id FROM agents ORDER BY id").all();
+    const teams = db.prepare("SELECT id FROM teams ORDER BY id").all();
+    const rewrites = [];
+    for (const [table, rows, idPattern] of [
+      ["profiles", profiles, SLUG_ID],
+      ["agents", agents, AGENT_ID]
+    ]) {
+      const collection = table;
+      const stagedRoot = resolve2(payload, collection);
+      const targetRoot = resolve2(targetHome, collection);
+      for (const row of rows) {
+        const id = validateEntityId(row.id, idPattern, `${table} row`);
+        const rowLabel = `${table} row ${JSON.stringify(id)}`;
+        const stagedDir = containedChildDirectory(stagedRoot, id, rowLabel);
+        requireExtractedDirectory(stagedDir, rowLabel);
+        rewrites.push({
+          table,
+          id,
+          dir: containedChildDirectory(targetRoot, id, rowLabel)
+        });
+      }
+    }
+    const stagedTeamsRoot = resolve2(payload, "teams");
+    for (const row of teams) {
+      const id = validateEntityId(row.id, SLUG_ID, "teams row");
+      const rowLabel = `teams row ${JSON.stringify(id)}`;
+      requireExtractedTeamSlot(containedChildDirectory(stagedTeamsRoot, id, rowLabel), rowLabel);
+    }
+    db.exec("PRAGMA journal_mode = DELETE");
+    db.exec("PRAGMA synchronous = FULL");
+    let transactionOpen = false;
+    try {
+      db.exec("BEGIN IMMEDIATE");
+      transactionOpen = true;
+      const updateProfile = db.prepare("UPDATE profiles SET dir = ? WHERE id = ?");
+      const updateAgent = db.prepare("UPDATE agents SET dir = ? WHERE id = ?");
+      for (const rewrite of rewrites) {
+        const result = rewrite.table === "profiles" ? updateProfile.run(rewrite.dir, rewrite.id) : updateAgent.run(rewrite.dir, rewrite.id);
+        if (result.changes !== 1) {
+          throw new Error(`could not rebase ${rewrite.table} row ${JSON.stringify(rewrite.id)}`);
+        }
+      }
+      const readProfile = db.prepare("SELECT dir FROM profiles WHERE id = ?");
+      const readAgent = db.prepare("SELECT dir FROM agents WHERE id = ?");
+      for (const rewrite of rewrites) {
+        const row = rewrite.table === "profiles" ? readProfile.get(rewrite.id) : readAgent.get(rewrite.id);
+        if (row?.dir !== rewrite.dir) {
+          throw new Error(
+            `could not verify rebased ${rewrite.table} row ${JSON.stringify(rewrite.id)}`
+          );
+        }
+      }
+      db.exec("COMMIT");
+      transactionOpen = false;
+    } catch (error) {
+      if (transactionOpen) db.exec("ROLLBACK");
+      throw error;
+    }
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`backup database is invalid: ${detail}`);
+  } finally {
+    db?.close();
+  }
+  for (const suffix of ["-wal", "-shm", "-journal"]) {
+    if (existsSync2(`${database}${suffix}`)) {
+      throw new Error(`backup database is invalid: path rebasing left transient ${suffix} state`);
+    }
+  }
+}
+function removeRebuildableQmdIndexes(payload) {
+  const teamsDir = resolve2(payload, "teams");
+  if (!existsSync2(teamsDir) || !lstatSync2(teamsDir).isDirectory()) return;
+  for (const team of readdirSync(teamsDir, { withFileTypes: true })) {
+    if (!team.isDirectory() || team.isSymbolicLink()) continue;
+    const memoryDir = resolve2(teamsDir, team.name, "memory");
+    if (!existsSync2(memoryDir) || !lstatSync2(memoryDir).isDirectory()) continue;
+    for (const entry2 of readdirSync(memoryDir, { withFileTypes: true })) {
+      if (entry2.isFile() && entry2.name.startsWith(".qmd-index.sqlite")) {
+        rmSync2(resolve2(memoryDir, entry2.name), { force: true });
+      }
+    }
+  }
+}
+function installValidatedPayload(payload, targetHome, staging, lifecycle, operations = { rename: renameSync2 }) {
+  const previous = resolve2(staging, "previous-home");
+  const hadPrevious = existsSync2(targetHome);
+  const targetParent = dirname2(targetHome);
+  const syncDirectory = operations.fsyncDirectory ?? fsyncDirectory;
+  const recoveryError = (message, recoveryPath, cause) => {
+    let markerError;
+    try {
+      lifecycle?.markRecoveryRequired(recoveryPath, hadPrevious);
+    } catch (error) {
+      markerError = error;
+    }
+    const causeDetail = cause instanceof Error ? cause.message : String(cause);
+    const markerDetail = markerError ? `; recovery marker update failed: ${markerError instanceof Error ? markerError.message : markerError}` : "";
+    return new RestoreRecoveryRequiredError(
+      `${message} (${causeDetail}); recovery data is at ${recoveryPath}${markerDetail}`,
+      recoveryPath
+    );
+  };
+  lifecycle?.markSwapping(previous, hadPrevious);
+  if (hadPrevious) {
+    try {
+      operations.rename(targetHome, previous);
+    } catch (moveError) {
+      lifecycle?.markInstalled();
+      throw moveError;
+    }
+    try {
+      syncDirectory(targetParent);
+      operations.afterPreviousMoved?.();
+    } catch (postMoveError) {
+      throw recoveryError(
+        "the previous home moved but the swap could not continue safely",
+        previous,
+        postMoveError
+      );
+    }
+  }
+  try {
+    operations.rename(payload, targetHome);
+  } catch (installError) {
+    if (hadPrevious) {
+      try {
+        operations.rename(previous, targetHome);
+      } catch (rollbackError) {
+        const installDetail = installError instanceof Error ? installError.message : String(installError);
+        throw recoveryError(
+          `restore install failed (${installDetail}) and rollback failed`,
+          previous,
+          rollbackError
+        );
+      }
+      try {
+        syncDirectory(targetParent);
+      } catch (rollbackSyncError) {
+        throw recoveryError(
+          "the previous home was restored but its directory entry could not be made durable",
+          targetHome,
+          rollbackSyncError
+        );
+      }
+      try {
+        lifecycle?.markInstalled();
+      } catch (phaseError) {
+        throw recoveryError(
+          "the previous home was restored but could not be marked safe",
+          targetHome,
+          phaseError
+        );
+      }
+    } else {
+      lifecycle?.markInstalled();
+    }
+    throw installError;
+  }
+  try {
+    syncDirectory(targetParent);
+  } catch (installSyncError) {
+    throw recoveryError(
+      "the restored home was installed but its directory entry could not be made durable",
+      hadPrevious ? previous : targetHome,
+      installSyncError
+    );
+  }
+  try {
+    lifecycle?.markInstalled();
+  } catch (phaseError) {
+    throw recoveryError(
+      "the restored home was installed but could not be marked safe",
+      hadPrevious ? previous : targetHome,
+      phaseError
+    );
+  }
+}
+var RestoreRecoveryRequiredError = class extends Error {
+  recoveryPath;
+  constructor(message, recoveryPath) {
+    super(message);
+    this.name = "RestoreRecoveryRequiredError";
+    this.recoveryPath = recoveryPath;
+  }
+};
+function fsyncDirectory(path) {
+  let fd = null;
+  try {
+    fd = openSync2(path, "r");
+    fsyncSync2(fd);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  } finally {
+    if (fd !== null) closeSync2(fd);
+  }
+}
+var restoreCmd = defineCommand5({
   meta: {
     name: "restore",
     description: "Extract a backup tar.gz into ~/.bazilion (offline; server must be stopped)"
@@ -1130,42 +2386,96 @@ var restoreCmd = defineCommand4({
     }
   },
   async run({ args }) {
-    const file = resolve(args.file);
+    const file = resolve2(args.file);
     if (!existsSync2(file)) throw new Error(`backup file not found: ${file}`);
     const paths = resolveCliPaths(args.home);
-    const targetHome = paths.home;
-    const defaultHome = !args.home && !process.env.BAZILION_HOME;
-    if (defaultHome && !args.force && await probeServerRunning(4321)) {
-      throw new Error(
-        "bazilion server appears to be running on :4321 \u2014 stop it first (DB corruption risk), or pass --force to override."
-      );
+    const targetHome = resolve2(paths.home);
+    if (targetHome === parse(targetHome).root) {
+      throw new Error(`refusing to restore over filesystem root: ${targetHome}`);
     }
-    if (existsSync2(targetHome)) {
-      const entries = readdirSync(targetHome);
-      if (entries.length > 0) {
-        if (!args.force) {
+    const targetParent = dirname2(targetHome);
+    mkdirSync2(targetParent, { recursive: true });
+    const restoreLock = await acquireHomeRestoreLock(targetHome);
+    try {
+      const targetsConfiguredHome = targetHome === resolve2(resolveCliPaths().home);
+      if (targetsConfiguredHome) {
+        for (const serverUrl of configuredLoopbackUrls()) {
+          if (await probeServerRunning(serverUrl)) {
+            throw new Error(
+              `bazilion server appears to be running at ${serverUrl} \u2014 stop it before restoring.`
+            );
+          }
+        }
+      }
+      if (existsSync2(targetHome)) {
+        if (!lstatSync2(targetHome).isDirectory()) {
+          throw new Error(`${targetHome} exists and is not a directory`);
+        }
+        const entries = readdirSync(targetHome);
+        if (entries.length > 0 && !args.force) {
           throw new Error(
             `${targetHome} is not empty. Pass --force to overwrite (destroys existing data).`
           );
         }
-        rmSync(targetHome, { recursive: true, force: true });
       }
+      const staging = mkdtempSync(resolve2(targetParent, ".bazilion-restore-"));
+      const stagedArchive = resolve2(staging, "backup.tar.gz");
+      const payload = resolve2(staging, "payload");
+      let preserveStaging = false;
+      try {
+        copyFileSync(file, stagedArchive);
+        await validateArchive(stagedArchive);
+        mkdirSync2(payload);
+        await extract({
+          file: stagedArchive,
+          cwd: payload,
+          strict: true,
+          preserveOwner: false,
+          // The private copy has already passed complete entry-path and link
+          // validation above. Preserve paths here so an intentionally absolute
+          // external linked-Team target is not stripped into a different,
+          // payload-relative path by npm-tar.
+          preservePaths: true
+        });
+        const database = resolve2(payload, "bazilion.db");
+        const authFile = resolve2(payload, "auth.json");
+        if (!lstatSync2(database).isFile() || !lstatSync2(authFile).isFile()) {
+          throw new Error("backup required files did not extract as regular files");
+        }
+        const authToken = validateAuthFile(authFile);
+        validateDatabase(database, authToken);
+        rebaseRestoredHomeDirectories(database, payload, targetHome);
+        validateDatabase(database, authToken);
+        removeRebuildableQmdIndexes(payload);
+        console.log(`installing validated backup ${file} \u2192 ${targetHome}`);
+        try {
+          installValidatedPayload(payload, targetHome, staging, restoreLock);
+        } catch (error) {
+          if (error instanceof RestoreRecoveryRequiredError) {
+            preserveStaging = true;
+          }
+          throw error;
+        }
+      } finally {
+        if (!preserveStaging) {
+          try {
+            rmSync2(staging, { recursive: true, force: true });
+          } catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            console.warn(
+              `warning: could not remove restore staging directory ${staging}: ${detail}`
+            );
+          }
+        }
+      }
+    } finally {
+      restoreLock.release();
     }
-    mkdirSync(targetHome, { recursive: true });
-    console.log(`extracting ${file} \u2192 ${targetHome}`);
-    await new Promise((res, rej) => {
-      const proc = spawn("tar", ["-xzf", file, "-C", targetHome], { stdio: "inherit" });
-      proc.on("error", rej);
-      proc.on("exit", (code) => {
-        if (code === 0) res();
-        else rej(new Error(`tar exited with code ${code}`));
-      });
-    });
     console.log(`restored to ${targetHome}`);
     console.log("start the server with: bazilion serve  (migrations apply automatically)");
   }
 });
-var backupCommand = defineCommand4({
+var backupCommand = defineCommand5({
   meta: { name: "backup", description: "Create or restore a ~/.bazilion tar.gz backup" },
   subCommands: {
     create: createCmd,
@@ -1179,7 +2489,7 @@ var backupCommand = defineCommand4({
 });
 
 // src/commands/completion.ts
-import { defineCommand as defineCommand5 } from "citty";
+import { defineCommand as defineCommand6 } from "citty";
 async function walk(cmd, path, out) {
   const subsRaw = cmd.subCommands ?? {};
   const subNames = Object.keys(subsRaw);
@@ -1284,7 +2594,7 @@ function fishScript(flat) {
 `;
 }
 function completionCommand(main2) {
-  return defineCommand5({
+  return defineCommand6({
     meta: {
       name: "completion",
       description: "Print a shell completion script (bash, zsh, or fish)"
@@ -1309,13 +2619,13 @@ function completionCommand(main2) {
 }
 
 // src/commands/config.ts
-import { defineCommand as defineCommand6 } from "citty";
+import { defineCommand as defineCommand7 } from "citty";
 function displayValue(f) {
   if (!f.set) return "(unset)";
   if (f.kind === "secret") return f.preview ?? "(set)";
   return f.value ?? "(set)";
 }
-var listCmd2 = defineCommand6({
+var listCmd2 = defineCommand7({
   meta: {
     name: "list",
     description: "List every configurable field (credentials + URLs) across all services"
@@ -1338,7 +2648,7 @@ var listCmd2 = defineCommand6({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var setCmd = defineCommand6({
+var setCmd = defineCommand7({
   meta: {
     name: "set",
     description: "Set a configurable field (auto-routes to secrets or plaintext store)"
@@ -1365,7 +2675,7 @@ var setCmd = defineCommand6({
     console.log(`${state.envVar} (${state.kind}): ${displayValue(state)}`);
   }
 });
-var rmCmd = defineCommand6({
+var rmCmd = defineCommand7({
   meta: { name: "rm", description: "Remove a configurable field value" },
   args: {
     envVar: { type: "positional", required: true, description: "Env var name to clear" }
@@ -1376,7 +2686,7 @@ var rmCmd = defineCommand6({
     console.log(`removed ${args.envVar}`);
   }
 });
-var configCommand = defineCommand6({
+var configCommand = defineCommand7({
   meta: {
     name: "config",
     description: "Manage service configuration \u2014 credentials (encrypted) and URLs/IDs (plaintext), unified under one CLI"
@@ -1389,19 +2699,19 @@ var configCommand = defineCommand6({
 });
 
 // src/commands/dashboard.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { connect } from "net";
-import { join as join2 } from "path";
-import { defineCommand as defineCommand7 } from "citty";
-var bundledDaemonEntry = join2(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry = join2(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+import { join as join3 } from "path";
+import { defineCommand as defineCommand8 } from "citty";
+var bundledDaemonEntry = join3(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry = join3(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry = existsSync3(bundledDaemonEntry) ? bundledDaemonEntry : sourceDaemonEntry;
-var bundledWebServerEntry = join2(import.meta.dirname, "web-server.js");
-var sourceWebServerEntry = join2(import.meta.dirname, "..", "web-server.ts");
+var bundledWebServerEntry = join3(import.meta.dirname, "web-server.js");
+var sourceWebServerEntry = join3(import.meta.dirname, "..", "web-server.ts");
 var webServerEntry = existsSync3(bundledWebServerEntry) ? bundledWebServerEntry : sourceWebServerEntry;
-var bundledWebDist = join2(import.meta.dirname, "web");
-var sourceWebDist = join2(import.meta.dirname, "..", "..", "..", "web", "dist");
+var bundledWebDist = join3(import.meta.dirname, "web");
+var sourceWebDist = join3(import.meta.dirname, "..", "..", "..", "web", "dist");
 var webDist = existsSync3(bundledWebDist) ? bundledWebDist : sourceWebDist;
 function nodeArgs(entry2) {
   return entry2.endsWith(".ts") ? ["--import", "tsx/esm", entry2] : [entry2];
@@ -1420,12 +2730,12 @@ function probeHost(host) {
   return host;
 }
 function isTcpPortOpen(host, port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const socket = connect({ host: probeHost(host), port: Number(port) });
     const done = (open) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve3(open);
+      resolve4(open);
     };
     socket.setTimeout(600);
     socket.once("connect", () => done(true));
@@ -1475,19 +2785,19 @@ function openBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : process.env.BROWSER || "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-  const proc = spawn2(cmd, args, { detached: true, stdio: "ignore" });
+  const proc = spawn(cmd, args, { detached: true, stdio: "ignore" });
   proc.unref();
 }
 function spawnProcess(label, entry2, env) {
   if (!existsSync3(entry2)) {
     throw new Error(`${label} entry not found at ${entry2}`);
   }
-  return spawn2(process.execPath, nodeArgs(entry2), {
+  return spawn(process.execPath, nodeArgs(entry2), {
     env,
     stdio: "inherit"
   });
 }
-var dashboardCommand = defineCommand7({
+var dashboardCommand = defineCommand8({
   meta: {
     name: "dashboard",
     description: "Start the bazilion daemon and bundled web UI"
@@ -1564,7 +2874,7 @@ var dashboardCommand = defineCommand7({
             `web UI port ${webPort} is already in use. Re-run with --port <free-port>.`
           );
         }
-        if (!existsSync3(join2(webDist, "server", "server.js"))) {
+        if (!existsSync3(join3(webDist, "server", "server.js"))) {
           throw new Error(
             `bazilion web UI bundle not found at ${webDist}. Run "pnpm --filter @bazilion/web build" from a source checkout, or reinstall the published package.`
           );
@@ -1591,13 +2901,13 @@ var dashboardCommand = defineCommand7({
     if (children.length === 0) return;
     process.on("SIGINT", terminateChildren);
     process.on("SIGTERM", terminateChildren);
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       let remaining = children.length;
       for (const child of children) {
         child.on("close", (code) => {
           remaining--;
           if (!signalled && code && code !== 0) process.exitCode = code;
-          if (remaining === 0) resolve3();
+          if (remaining === 0) resolve4();
         });
       }
     });
@@ -1606,8 +2916,8 @@ var dashboardCommand = defineCommand7({
 });
 
 // src/commands/doctor.ts
-import { defineCommand as defineCommand8 } from "citty";
-var doctorCommand = defineCommand8({
+import { defineCommand as defineCommand9 } from "citty";
+var doctorCommand = defineCommand9({
   meta: { name: "doctor", description: "Diagnose your bazilion install" },
   async run() {
     const client = createClient2();
@@ -1688,6 +2998,36 @@ var doctorCommand = defineCommand8({
       `  ${r.scheduler.enabled ? "\u2713" : "-"} scheduler${r.scheduler.enabled ? ` (tick ${r.scheduler.tickMs}ms)` : " (BAZILION_SCHEDULER=off)"}`
     );
     console.log();
+    console.log("agent shell security");
+    if (!r.shellSecurity.ok) {
+      check("valid shell-security configuration", false, r.shellSecurity.error);
+    } else {
+      if (r.shellSecurity.approvalMode === "dangerous") {
+        console.log("  - dangerous-command approval enabled");
+        console.log(
+          "    web and TTY CLI turns can allow once; background and non-TTY turns auto-deny"
+        );
+      } else {
+        console.log("  - dangerous-command approval off");
+        console.log("    set BAZILION_BASH_APPROVAL=dangerous to opt in");
+      }
+      if (r.shellSecurity.sandboxMode === "docker") {
+        console.log(`  - Docker sandbox configured (${r.shellSecurity.sandboxImage})`);
+        console.log(
+          "    workspace-only writable mount \xB7 bounded inputs/skills/memory read-only \xB7 network disabled"
+        );
+        console.log("    host coding tools hidden");
+        console.log(
+          "    policy syntax is valid; Docker and image availability are checked on execution"
+        );
+        console.log("    commands fail closed if either is unavailable");
+      } else {
+        console.log("  - sandbox off (agent shell and coding tools run on the host)");
+        console.log("    approval is a host-execution tripwire, not a filesystem sandbox");
+        console.log("    set BAZILION_BASH_SANDBOX=docker to opt in");
+      }
+    }
+    console.log();
     console.log("operational counts");
     console.log(`  ${r.triggers.active} active trigger(s), ${r.triggers.disabled} disabled`);
     console.log(`  ${r.tokens.active} active web token(s)`);
@@ -1719,7 +3059,7 @@ var doctorCommand = defineCommand8({
 });
 
 // src/commands/inbox.ts
-import { defineCommand as defineCommand9 } from "citty";
+import { defineCommand as defineCommand10 } from "citty";
 function decodeText(payload) {
   try {
     const obj = JSON.parse(payload);
@@ -1735,7 +3075,7 @@ function messageRow(m) {
   const preview = text2.length > 60 ? `${text2.slice(0, 60)}\u2026` : text2;
   return [m.id, state, when, `from:${m.fromAgentId.slice(0, 8)}`, `"${preview}"`];
 }
-var listCmd3 = defineCommand9({
+var listCmd3 = defineCommand10({
   meta: { name: "list", description: "List messages in an agent inbox" },
   args: {
     agent: { type: "positional", required: true, description: "Recipient agent id" },
@@ -1754,7 +3094,7 @@ var listCmd3 = defineCommand9({
     for (const line of columnize(messages.map(messageRow))) console.log(line);
   }
 });
-var showCmd2 = defineCommand9({
+var showCmd2 = defineCommand10({
   meta: { name: "show", description: "Show a single message in full" },
   args: {
     id: { type: "positional", required: true, description: "Message id" }
@@ -1774,7 +3114,7 @@ var showCmd2 = defineCommand9({
     console.log(decodeText(m.payload));
   }
 });
-var readCmd = defineCommand9({
+var readCmd = defineCommand10({
   meta: { name: "read", description: "Mark a message as read" },
   args: {
     id: { type: "positional", required: true, description: "Message id" }
@@ -1785,18 +3125,47 @@ var readCmd = defineCommand9({
     console.log(`marked read: ${args.id}`);
   }
 });
-var inboxCommand = defineCommand9({
+var loopBreaksCmd = defineCommand10({
+  meta: { name: "loop-breaks", description: "List stopped agent-message chains" },
+  args: {
+    agent: { type: "positional", required: true, description: "Agent id" },
+    limit: { type: "string", description: "Maximum events to show (default 25)" }
+  },
+  async run({ args }) {
+    const client = createClient2();
+    const limit = args.limit ? `?limit=${encodeURIComponent(args.limit)}` : "";
+    const { events } = await client.get(
+      `/api/agents/${args.agent}/loop-breaks${limit}`
+    );
+    if (events.length === 0) {
+      console.log("(no agent-message chains stopped)");
+      return;
+    }
+    for (const line of columnize(
+      events.map((event) => [
+        new Date(event.createdAt).toISOString(),
+        `chain:${event.causalChainId.slice(0, 8)}`,
+        `${event.fromAgentId.slice(0, 8)}\u2192${event.toAgentId.slice(0, 8)}`,
+        `hop:${event.attemptedHop}/${event.maxHops}`,
+        event.reason
+      ])
+    ))
+      console.log(line);
+  }
+});
+var inboxCommand = defineCommand10({
   meta: { name: "inbox", description: "Inspect agent inboxes" },
   subCommands: {
     list: listCmd3,
     show: showCmd2,
-    read: readCmd
+    read: readCmd,
+    "loop-breaks": loopBreaksCmd
   }
 });
 
 // src/commands/login.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { defineCommand as defineCommand10 } from "citty";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { defineCommand as defineCommand11 } from "citty";
 function normalizeServer(raw) {
   let url;
   try {
@@ -1816,7 +3185,7 @@ async function verifyToken(server, token) {
   if (res.status === 401) throw new Error("server rejected token (401)");
   if (!res.ok) throw new Error(`server returned ${res.status} from /api/health`);
 }
-var loginCommand = defineCommand10({
+var loginCommand = defineCommand11({
   meta: {
     name: "login",
     description: "Save a remote bazilion server + token pair to auth.json"
@@ -1834,7 +3203,7 @@ var loginCommand = defineCommand10({
         `${paths.authFile} not found. Start the daemon with "bazilion serve" first \u2014 login stores the remote there.`
       );
     }
-    const auth = JSON.parse(readFileSync3(paths.authFile, "utf8"));
+    const auth = JSON.parse(readFileSync5(paths.authFile, "utf8"));
     if (args.clear) {
       if (!auth.remote) {
         console.log("no remote stored \u2014 nothing to clear");
@@ -1864,7 +3233,7 @@ var loginCommand = defineCommand10({
 });
 
 // src/commands/mcp.ts
-import { defineCommand as defineCommand11 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 function serverRow(s) {
   const where = s.transport === "stdio" ? `${s.command} ${s.args.join(" ")}`.trim() : s.url ?? "";
   return [
@@ -1876,7 +3245,7 @@ function serverRow(s) {
     where
   ];
 }
-var addCmd = defineCommand11({
+var addCmd = defineCommand12({
   meta: { name: "add", description: "Register an MCP server" },
   args: {
     name: { type: "positional", required: true, description: "Unique name ([a-zA-Z0-9_])" },
@@ -1903,7 +3272,7 @@ var addCmd = defineCommand11({
     console.log(`${server.id}	${server.name}	${server.transport}`);
   }
 });
-var listCmd4 = defineCommand11({
+var listCmd4 = defineCommand12({
   meta: { name: "list", description: "List MCP servers" },
   async run() {
     const client = createClient2();
@@ -1915,7 +3284,7 @@ var listCmd4 = defineCommand11({
     for (const line of columnize(servers.map(serverRow))) console.log(line);
   }
 });
-var showCmd3 = defineCommand11({
+var showCmd3 = defineCommand12({
   meta: { name: "show", description: "Show one MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -1924,7 +3293,7 @@ var showCmd3 = defineCommand11({
     console.log(JSON.stringify(server, null, 2));
   }
 });
-var rmCmd2 = defineCommand11({
+var rmCmd2 = defineCommand12({
   meta: { name: "rm", description: "Delete an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -1933,7 +3302,7 @@ var rmCmd2 = defineCommand11({
     console.log(`removed MCP server ${args.id}`);
   }
 });
-var enableCmd = defineCommand11({
+var enableCmd = defineCommand12({
   meta: { name: "enable", description: "Enable an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -1942,7 +3311,7 @@ var enableCmd = defineCommand11({
     console.log(`enabled MCP server ${args.id}`);
   }
 });
-var disableCmd = defineCommand11({
+var disableCmd = defineCommand12({
   meta: { name: "disable", description: "Disable an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -1951,7 +3320,7 @@ var disableCmd = defineCommand11({
     console.log(`disabled MCP server ${args.id}`);
   }
 });
-var testCmd = defineCommand11({
+var testCmd = defineCommand12({
   meta: { name: "test", description: "Connect to a server and list its tools" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -1969,7 +3338,7 @@ var testCmd = defineCommand11({
     for (const t of tools) console.log(`  ${t.name}	${t.description}`);
   }
 });
-var mcpCommand = defineCommand11({
+var mcpCommand = defineCommand12({
   meta: { name: "mcp", description: "Manage MCP servers" },
   subCommands: {
     add: addCmd,
@@ -1983,11 +3352,11 @@ var mcpCommand = defineCommand11({
 });
 
 // src/commands/memory.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 function encodeKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
-var writeCmd = defineCommand12({
+var writeCmd = defineCommand13({
   meta: { name: "write", description: "Write an entry into a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -2003,7 +3372,7 @@ var writeCmd = defineCommand12({
     console.log(`wrote ${entry2.key} (${entry2.content.length} bytes)`);
   }
 });
-var readCmd2 = defineCommand12({
+var readCmd2 = defineCommand13({
   meta: { name: "read", description: "Read an entry from a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -2017,7 +3386,7 @@ var readCmd2 = defineCommand12({
     console.log(entry2.content);
   }
 });
-var searchCmd = defineCommand12({
+var searchCmd = defineCommand13({
   meta: { name: "search", description: "Search a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -2038,7 +3407,7 @@ var searchCmd = defineCommand12({
     }
   }
 });
-var listCmd5 = defineCommand12({
+var listCmd5 = defineCommand13({
   meta: { name: "list", description: "List all entries in a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" }
@@ -2055,7 +3424,7 @@ var listCmd5 = defineCommand12({
     }
   }
 });
-var rmCmd3 = defineCommand12({
+var rmCmd3 = defineCommand13({
   meta: { name: "rm", description: "Remove an entry from a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -2067,7 +3436,7 @@ var rmCmd3 = defineCommand12({
     console.log(`removed ${args.key}`);
   }
 });
-var memoryCommand = defineCommand12({
+var memoryCommand = defineCommand13({
   meta: {
     name: "memory",
     description: "Manage a team's shared memory (BM25-indexed markdown notes)"
@@ -2082,11 +3451,11 @@ var memoryCommand = defineCommand12({
 });
 
 // src/commands/profile.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
 
 // ../../packages/api-types/src/index.ts
 var PROFILE_FILES = [
@@ -2099,7 +3468,7 @@ var PROFILE_FILES = [
 ];
 
 // src/commands/profile.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 function splitCsv(v) {
   if (!v) return void 0;
   const out = v.split(",").map((s) => s.trim()).filter(Boolean);
@@ -2110,7 +3479,7 @@ function parseSkillsMode(v) {
   if (v === "all" || v === "selected") return v;
   throw new Error(`--skills-mode must be 'all' or 'selected', got '${v}'`);
 }
-var createCmd2 = defineCommand13({
+var createCmd2 = defineCommand14({
   meta: { name: "create", description: "Create a new profile" },
   args: {
     id: { type: "positional", required: true, description: "Profile slug" },
@@ -2155,7 +3524,7 @@ var createCmd2 = defineCommand13({
   },
   async run({ args }) {
     const skillsMode = parseSkillsMode(args["skills-mode"]);
-    const readTemplate = (path) => path ? readFileSync4(path, "utf8") : void 0;
+    const readTemplate = (path) => path ? readFileSync6(path, "utf8") : void 0;
     const body = {
       id: args.id,
       name: args.name,
@@ -2173,20 +3542,20 @@ var createCmd2 = defineCommand13({
     console.log(`created profile ${profile.id} at ${profile.dir}`);
   }
 });
-var listCmd6 = defineCommand13({
+var listCmd6 = defineCommand14({
   meta: { name: "list", description: "List profiles" },
   async run() {
     const client = createClient2();
-    const list3 = await client.get("/api/profiles");
-    if (list3.length === 0) {
+    const list5 = await client.get("/api/profiles");
+    if (list5.length === 0) {
       console.log("(no profiles)");
       return;
     }
-    const rows = list3.map((p) => [p.id, p.defaultModel, p.name]);
+    const rows = list5.map((p) => [p.id, p.defaultModel, p.name]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var showCmd4 = defineCommand13({
+var showCmd4 = defineCommand14({
   meta: { name: "show", description: "Show profile details" },
   args: {
     id: { type: "positional", required: true }
@@ -2211,7 +3580,7 @@ var showCmd4 = defineCommand13({
     }
   }
 });
-var editCmd2 = defineCommand13({
+var editCmd2 = defineCommand14({
   meta: { name: "edit", description: "Open a profile file in $EDITOR" },
   args: {
     id: { type: "positional", required: true },
@@ -2230,17 +3599,17 @@ var editCmd2 = defineCommand13({
     const { content } = await client.get(
       `/api/profiles/${args.id}/files/${file}`
     );
-    const tmpPath = join3(tmpdir(), `bazilion-${args.id}-${file}-${randomBytes(4).toString("hex")}`);
+    const tmpPath = join4(tmpdir2(), `bazilion-${args.id}-${file}-${randomBytes(4).toString("hex")}`);
     writeFileSync3(tmpPath, content);
     try {
       const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
-      const code = await new Promise((resolve3, reject) => {
-        const child = spawn3(editor, [tmpPath], { stdio: "inherit" });
+      const code = await new Promise((resolve4, reject) => {
+        const child = spawn2(editor, [tmpPath], { stdio: "inherit" });
         child.on("error", reject);
-        child.on("close", (c) => resolve3(c ?? 0));
+        child.on("close", (c) => resolve4(c ?? 0));
       });
       if (code !== 0) throw new Error(`editor exited with code ${code}`);
-      const updated = readFileSync4(tmpPath, "utf8");
+      const updated = readFileSync6(tmpPath, "utf8");
       if (updated === content) {
         console.log("(no changes)");
         return;
@@ -2250,13 +3619,13 @@ var editCmd2 = defineCommand13({
       console.log(`saved ${file}`);
     } finally {
       try {
-        rmSync2(tmpPath, { force: true });
+        rmSync3(tmpPath, { force: true });
       } catch {
       }
     }
   }
 });
-var updateCmd = defineCommand13({
+var updateCmd = defineCommand14({
   meta: {
     name: "update",
     description: "Update profile settings (name, model, skills-mode, skills)"
@@ -2290,7 +3659,7 @@ var updateCmd = defineCommand13({
     console.log(`updated profile ${profile.id}`);
   }
 });
-var deleteCmd2 = defineCommand13({
+var deleteCmd2 = defineCommand14({
   meta: { name: "delete", description: "Permanently delete a profile and its files" },
   args: {
     id: { type: "positional", required: true }
@@ -2301,7 +3670,7 @@ var deleteCmd2 = defineCommand13({
     console.log(`deleted profile ${args.id}`);
   }
 });
-var profileCommand = defineCommand13({
+var profileCommand = defineCommand14({
   meta: { name: "profile", description: "Manage profiles" },
   subCommands: {
     create: createCmd2,
@@ -2314,8 +3683,8 @@ var profileCommand = defineCommand13({
 });
 
 // src/commands/provider.ts
-import { defineCommand as defineCommand14 } from "citty";
-var listCmd7 = defineCommand14({
+import { defineCommand as defineCommand15 } from "citty";
+var listCmd7 = defineCommand15({
   meta: {
     name: "list",
     description: "List all providers with enabled/disabled state and curated model counts"
@@ -2341,7 +3710,7 @@ var listCmd7 = defineCommand14({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var modelsCmd = defineCommand14({
+var modelsCmd = defineCommand15({
   meta: {
     name: "models",
     description: "Show curated + catalog + live models for one provider"
@@ -2373,7 +3742,7 @@ var modelsCmd = defineCommand14({
     }
   }
 });
-var modelsSetCmd = defineCommand14({
+var modelsSetCmd = defineCommand15({
   meta: {
     name: "models-set",
     description: "Replace the curated model list for a provider (comma-separated)"
@@ -2398,7 +3767,7 @@ var modelsSetCmd = defineCommand14({
     for (const m of saved.models) console.log(`  ${m}`);
   }
 });
-var enableCmd2 = defineCommand14({
+var enableCmd2 = defineCommand15({
   meta: { name: "enable", description: "Toggle a provider on so agents can use it" },
   args: {
     name: { type: "positional", required: true, description: "Provider id (e.g. anthropic)" }
@@ -2412,7 +3781,7 @@ var enableCmd2 = defineCommand14({
     console.log(`${res.name}: enabled`);
   }
 });
-var disableCmd2 = defineCommand14({
+var disableCmd2 = defineCommand15({
   meta: {
     name: "disable",
     description: "Toggle a provider off \u2014 agents will refuse its model strings"
@@ -2429,7 +3798,7 @@ var disableCmd2 = defineCommand14({
     console.log(`${res.name}: disabled`);
   }
 });
-var testCmd2 = defineCommand14({
+var testCmd2 = defineCommand15({
   meta: { name: "test", description: "Send a single chat to a model and print the reply" },
   args: {
     model: {
@@ -2450,7 +3819,7 @@ var testCmd2 = defineCommand14({
     }
   }
 });
-var providerCommand = defineCommand14({
+var providerCommand = defineCommand15({
   meta: { name: "provider", description: "Manage and test LLM providers" },
   subCommands: {
     list: listCmd7,
@@ -2463,8 +3832,8 @@ var providerCommand = defineCommand14({
 });
 
 // src/commands/send.ts
-import { defineCommand as defineCommand15 } from "citty";
-var sendCommand = defineCommand15({
+import { defineCommand as defineCommand16 } from "citty";
+var sendCommand = defineCommand16({
   meta: {
     name: "send",
     description: "Send a message from one agent to another"
@@ -2495,14 +3864,14 @@ var sendCommand = defineCommand15({
 });
 
 // src/commands/serve.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { join as join4 } from "path";
-import { defineCommand as defineCommand16 } from "citty";
-var bundledDaemonEntry2 = join4(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry2 = join4(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+import { join as join5 } from "path";
+import { defineCommand as defineCommand17 } from "citty";
+var bundledDaemonEntry2 = join5(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry2 = join5(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry2 = existsSync5(bundledDaemonEntry2) ? bundledDaemonEntry2 : sourceDaemonEntry2;
-var serveCommand = defineCommand16({
+var serveCommand = defineCommand17({
   meta: {
     name: "serve",
     description: "Start the bazilion daemon (HTTP API)"
@@ -2535,7 +3904,7 @@ var serveCommand = defineCommand16({
     console.log(`starting bazilion daemon at http://${host}:${port}`);
     console.log("(web UI runs separately: cd apps/web && pnpm dev)");
     const nodeArgs2 = daemonEntry2.endsWith(".ts") ? ["--import", "tsx/esm", daemonEntry2] : [daemonEntry2];
-    const proc = spawn4("node", nodeArgs2, {
+    const proc = spawn3("node", nodeArgs2, {
       env,
       stdio: "inherit"
     });
@@ -2551,17 +3920,17 @@ var serveCommand = defineCommand16({
       signalled = true;
     });
     process.on("SIGTERM", onSigterm);
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       proc.on("error", (err) => reject(err));
       proc.on("close", (code) => {
         if (signalled) {
           process.exitCode = 0;
-          resolve3();
+          resolve4();
         } else if (code === 0 || code === null) {
-          resolve3();
+          resolve4();
         } else {
           process.exitCode = code;
-          resolve3();
+          resolve4();
         }
       });
     });
@@ -2569,16 +3938,16 @@ var serveCommand = defineCommand16({
 });
 
 // src/commands/skill.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync } from "fs";
-import { basename as basename2, resolve as resolve2 } from "path";
-import { defineCommand as defineCommand17 } from "citty";
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
+import { basename as basename4, resolve as resolve3 } from "path";
+import { defineCommand as defineCommand18 } from "citty";
 function printFindings(findings, prefix = "  ") {
   for (const f of findings) {
     const line = f.line ? ` line ${f.line}` : "";
     console.log(`${prefix}${f.severity}: ${f.code}${line} - ${f.message}`);
   }
 }
-var listCmd8 = defineCommand17({
+var listCmd8 = defineCommand18({
   meta: { name: "list", description: "List installed skills (or those attached to an agent)" },
   args: {
     agent: { type: "string", description: "Filter to skills attached to this agent" }
@@ -2619,7 +3988,7 @@ var listCmd8 = defineCommand17({
     }
   }
 });
-var importCmd = defineCommand17({
+var importCmd = defineCommand18({
   meta: {
     name: "import",
     description: "Import skills from openclaw, a directory, or a local .zip archive"
@@ -2634,13 +4003,13 @@ var importCmd = defineCommand17({
   },
   async run({ args }) {
     const client = createClient2();
-    const absFrom = resolve2(args.from);
+    const absFrom = resolve3(args.from);
     const isLocalZip = args.from.toLowerCase().endsWith(".zip") && existsSync6(absFrom) && statSync(absFrom).isFile();
     let result;
     try {
       if (isLocalZip) {
-        const bytes = readFileSync5(absFrom);
-        const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
+        const bytes = readFileSync7(absFrom);
+        const file = new File([bytes], basename4(absFrom), { type: "application/zip" });
         const fd = new FormData();
         fd.set("file", file);
         if (args.force) fd.set("force", "true");
@@ -2688,7 +4057,7 @@ var importCmd = defineCommand17({
     }
   }
 });
-var rmCmd4 = defineCommand17({
+var rmCmd4 = defineCommand18({
   meta: { name: "rm", description: "Remove an installed skill" },
   args: {
     name: { type: "positional", required: true }
@@ -2699,7 +4068,7 @@ var rmCmd4 = defineCommand17({
     console.log(`removed skill ${args.name}`);
   }
 });
-var skillCommand = defineCommand17({
+var skillCommand = defineCommand18({
   meta: { name: "skill", description: "Manage the skill library" },
   subCommands: {
     list: listCmd8,
@@ -2709,13 +4078,13 @@ var skillCommand = defineCommand17({
 });
 
 // src/commands/team.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { stdin as stdin2 } from "process";
-import { defineCommand as defineCommand19 } from "citty";
+import { defineCommand as defineCommand20 } from "citty";
 
 // src/commands/team-policy.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { defineCommand as defineCommand18 } from "citty";
+import { readFileSync as readFileSync8 } from "fs";
+import { defineCommand as defineCommand19 } from "citty";
 
 // src/team-interchange.ts
 var TEAM_POLICY_INTERCHANGE_VERSION = 1;
@@ -2931,7 +4300,7 @@ function edgeDiff(before, after) {
 // src/commands/team-policy.ts
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync8(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -2963,7 +4332,7 @@ function printPolicy(detail) {
       console.log(line);
   }
 }
-var show2 = defineCommand18({
+var show2 = defineCommand19({
   meta: { name: "show", description: "Show the one effective live policy for a Team" },
   args: {
     team: { type: "positional", required: true },
@@ -2977,7 +4346,7 @@ var show2 = defineCommand18({
     else printPolicy(detail);
   }
 });
-var exportCommand = defineCommand18({
+var exportCommand = defineCommand19({
   meta: { name: "export", description: "Export a revisioned Team policy document" },
   args: { team: { type: "positional", required: true } },
   async run({ args }) {
@@ -3001,7 +4370,7 @@ function printEdgeDiff(current, edges) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand = defineCommand18({
+var importCommand = defineCommand19({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly replace a Team policy"
@@ -3056,7 +4425,7 @@ var importCommand = defineCommand18({
     console.log(`updated Team ${args.team} policy to revision ${updated.teamPolicy.revision}`);
   }
 });
-var diff = defineCommand18({
+var diff = defineCommand19({
   meta: { name: "diff", description: "Compare live policy with its retained baseline source" },
   args: {
     team: { type: "positional", required: true },
@@ -3080,7 +4449,7 @@ var diff = defineCommand18({
     );
   }
 });
-var evaluate = defineCommand18({
+var evaluate = defineCommand19({
   meta: {
     name: "evaluate",
     description: "Evaluate a communication path without sending or recording a block"
@@ -3111,7 +4480,7 @@ var evaluate = defineCommand18({
     );
   }
 });
-var blocks = defineCommand18({
+var blocks = defineCommand19({
   meta: { name: "blocks", description: "List paginated durable communication denials" },
   args: {
     team: { type: "positional", required: true },
@@ -3160,7 +4529,7 @@ var blocks = defineCommand18({
     if (page.nextCursor) console.log(`next cursor: ${page.nextCursor}`);
   }
 });
-var teamPolicyCommand = defineCommand18({
+var teamPolicyCommand = defineCommand19({
   meta: { name: "policy", description: "Inspect and manage the Team-owned live policy" },
   subCommands: {
     show: show2,
@@ -3173,7 +4542,7 @@ var teamPolicyCommand = defineCommand18({
 });
 
 // src/commands/team.ts
-var addCmd2 = defineCommand19({
+var addCmd2 = defineCommand20({
   meta: {
     name: "add",
     description: "Register a team at ~/.bazilion/teams/<slug>/ (use --link to point at an existing tree)"
@@ -3197,20 +4566,20 @@ var addCmd2 = defineCommand19({
     console.log(`registered team ${g.id} at ${g.path}`);
   }
 });
-var listCmd9 = defineCommand19({
+var listCmd9 = defineCommand20({
   meta: { name: "list", description: "List teams" },
   async run() {
     const client = createClient2();
-    const list3 = await client.get("/api/teams");
-    if (list3.length === 0) {
+    const list5 = await client.get("/api/teams");
+    if (list5.length === 0) {
       console.log("(no teams)");
       return;
     }
-    const rows = list3.map((g) => [g.id, g.path]);
+    const rows = list5.map((g) => [g.id, g.path]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var rmCmd5 = defineCommand19({
+var rmCmd5 = defineCommand20({
   meta: { name: "rm", description: "Remove a team registration" },
   args: {
     id: { type: "positional", required: true }
@@ -3231,7 +4600,7 @@ async function readStdin() {
   for await (const chunk of stdin2) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8");
 }
-var userMdShowCmd = defineCommand19({
+var userMdShowCmd = defineCommand20({
   meta: { name: "show", description: "Print the team's USER.md" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3241,7 +4610,7 @@ var userMdShowCmd = defineCommand19({
     if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
   }
 });
-var userMdSetCmd = defineCommand19({
+var userMdSetCmd = defineCommand20({
   meta: {
     name: "set",
     description: "Replace the team's USER.md (from --file, --from-stdin, or inline text)"
@@ -3255,7 +4624,7 @@ var userMdSetCmd = defineCommand19({
   async run({ args }) {
     let content;
     if (args["from-stdin"]) content = await readStdin();
-    else if (args.file) content = readFileSync7(args.file, "utf8");
+    else if (args.file) content = readFileSync9(args.file, "utf8");
     else if (args.text !== void 0) content = args.text;
     else {
       console.error("team user-md set: provide --file, --from-stdin, or --text");
@@ -3267,7 +4636,7 @@ var userMdSetCmd = defineCommand19({
     console.log(`updated USER.md for team ${args.id} (${content.length} bytes)`);
   }
 });
-var userMdClearCmd = defineCommand19({
+var userMdClearCmd = defineCommand20({
   meta: { name: "clear", description: "Clear the team's USER.md to empty" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3277,7 +4646,7 @@ var userMdClearCmd = defineCommand19({
     console.log(`cleared USER.md for team ${args.id}`);
   }
 });
-var userMdCmd = defineCommand19({
+var userMdCmd = defineCommand20({
   meta: { name: "user-md", description: "View or edit a team's USER.md" },
   subCommands: {
     show: userMdShowCmd,
@@ -3285,7 +4654,7 @@ var userMdCmd = defineCommand19({
     clear: userMdClearCmd
   }
 });
-var topicFormatShowCmd = defineCommand19({
+var topicFormatShowCmd = defineCommand20({
   meta: { name: "show", description: "Print the team's Telegram topic-name template" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3294,7 +4663,7 @@ var topicFormatShowCmd = defineCommand19({
     console.log(g.telegramTopicNameFormat ?? "(default naming)");
   }
 });
-var topicFormatSetCmd = defineCommand19({
+var topicFormatSetCmd = defineCommand20({
   meta: {
     name: "set",
     description: "Set the topic-name template. Tokens: {agent.name} {team.name} {team.slug} (must include {agent.name})"
@@ -3314,7 +4683,7 @@ var topicFormatSetCmd = defineCommand19({
     console.log(`set topic-name template for team ${args.id}: ${g.telegramTopicNameFormat}`);
   }
 });
-var topicFormatClearCmd = defineCommand19({
+var topicFormatClearCmd = defineCommand20({
   meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3324,7 +4693,7 @@ var topicFormatClearCmd = defineCommand19({
     console.log(`cleared topic-name template for team ${args.id}`);
   }
 });
-var topicFormatCmd = defineCommand19({
+var topicFormatCmd = defineCommand20({
   meta: {
     name: "topic-format",
     description: "View or edit a team's Telegram forum-topic name template"
@@ -3335,7 +4704,7 @@ var topicFormatCmd = defineCommand19({
     clear: topicFormatClearCmd
   }
 });
-var teamCommand = defineCommand19({
+var teamCommand = defineCommand20({
   meta: { name: "team", description: "Manage teams (collaboration contexts)" },
   subCommands: {
     add: addCmd2,
@@ -3348,11 +4717,11 @@ var teamCommand = defineCommand19({
 });
 
 // src/commands/team-template.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { defineCommand as defineCommand20 } from "citty";
+import { readFileSync as readFileSync10 } from "fs";
+import { defineCommand as defineCommand21 } from "citty";
 function jsonFile(path) {
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -3377,7 +4746,7 @@ function printTeam(detail) {
       console.log(line);
   }
 }
-var list2 = defineCommand20({
+var list4 = defineCommand21({
   meta: { name: "list", description: "List canonical Team templates" },
   args: { json: { type: "boolean", description: "Emit stable JSON" } },
   async run({ args }) {
@@ -3391,7 +4760,7 @@ var list2 = defineCommand20({
       console.log(line);
   }
 });
-var show3 = defineCommand20({
+var show3 = defineCommand21({
   meta: { name: "show", description: "Show a canonical Team template" },
   args: {
     id: { type: "positional", required: true },
@@ -3405,7 +4774,7 @@ var show3 = defineCommand20({
     else printTeam(detail);
   }
 });
-var exportCommand2 = defineCommand20({
+var exportCommand2 = defineCommand21({
   meta: {
     name: "export",
     description: "Export a portable versioned Team-template document to stdout"
@@ -3445,7 +4814,7 @@ function printImportDiff(current, document) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand2 = defineCommand20({
+var importCommand2 = defineCommand21({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly apply a portable Team-template document"
@@ -3526,17 +4895,17 @@ var importCommand2 = defineCommand20({
     );
   }
 });
-var teamTemplateCommand = defineCommand20({
+var teamTemplateCommand = defineCommand21({
   meta: {
     name: "team-template",
     description: "Inspect and exchange canonical Team templates"
   },
-  subCommands: { list: list2, show: show3, export: exportCommand2, import: importCommand2 }
+  subCommands: { list: list4, show: show3, export: exportCommand2, import: importCommand2 }
 });
 
 // src/commands/telegram.ts
-import { defineCommand as defineCommand21 } from "citty";
-var setCmd2 = defineCommand21({
+import { defineCommand as defineCommand22 } from "citty";
+var setCmd2 = defineCommand22({
   meta: {
     name: "set",
     description: "Save bot token + supergroup chat ID (paired write)"
@@ -3554,7 +4923,7 @@ var setCmd2 = defineCommand21({
     console.log(`saved \xB7 token ${state.botTokenPreview} \xB7 chat ${state.chatId}`);
   }
 });
-var clearCmd = defineCommand21({
+var clearCmd = defineCommand22({
   meta: {
     name: "clear",
     description: "Remove stored bot token + chat ID"
@@ -3565,7 +4934,7 @@ var clearCmd = defineCommand21({
     console.log("cleared");
   }
 });
-var showCmd5 = defineCommand21({
+var showCmd5 = defineCommand22({
   meta: {
     name: "show",
     description: "Show what credentials are stored (token is masked)"
@@ -3586,7 +4955,7 @@ var showCmd5 = defineCommand21({
     }
   }
 });
-var reconnectCmd = defineCommand21({
+var reconnectCmd = defineCommand22({
   meta: {
     name: "reconnect",
     description: "Apply a pending supergroup chat-id migration + re-activate the bot"
@@ -3597,7 +4966,7 @@ var reconnectCmd = defineCommand21({
     console.log(`reconnected \xB7 chat ${state.chatId}`);
   }
 });
-var configCmd = defineCommand21({
+var configCmd = defineCommand22({
   meta: {
     name: "config",
     description: "Manage Telegram credentials (bot token + chat ID)"
@@ -3608,7 +4977,7 @@ var configCmd = defineCommand21({
     show: showCmd5
   }
 });
-var healthCmd = defineCommand21({
+var healthCmd = defineCommand22({
   meta: {
     name: "health",
     description: "Run the four-step preflight against the Telegram Bot API"
@@ -3642,7 +5011,7 @@ var healthCmd = defineCommand21({
     if (!allOk) process.exitCode = 1;
   }
 });
-var botStatusCmd = defineCommand21({
+var botStatusCmd = defineCommand22({
   meta: {
     name: "status",
     description: "Show polling state of the live bot"
@@ -3667,7 +5036,7 @@ var botStatusCmd = defineCommand21({
     if (!p.running) process.exitCode = 1;
   }
 });
-var botRestartCmd = defineCommand21({
+var botRestartCmd = defineCommand22({
   meta: {
     name: "restart",
     description: "Force-restart the bot (tears down + brings up from current creds)"
@@ -3678,7 +5047,7 @@ var botRestartCmd = defineCommand21({
     console.log("restart requested");
   }
 });
-var botCmd = defineCommand21({
+var botCmd = defineCommand22({
   meta: {
     name: "bot",
     description: "Inspect / control the live polling bot"
@@ -3688,7 +5057,7 @@ var botCmd = defineCommand21({
     restart: botRestartCmd
   }
 });
-var bindCmd = defineCommand21({
+var bindCmd = defineCommand22({
   meta: {
     name: "bind",
     description: "Create a Telegram topic for an agent (manual fallback for /talk)"
@@ -3706,7 +5075,7 @@ var bindCmd = defineCommand21({
     console.log(`  ${result.deepLink}`);
   }
 });
-var unbindCmd = defineCommand21({
+var unbindCmd = defineCommand22({
   meta: {
     name: "unbind",
     description: "Clear an agent's Telegram topic binding (topic stays in Telegram as orphan)"
@@ -3720,7 +5089,7 @@ var unbindCmd = defineCommand21({
     console.log(`unbound agent ${args.agent}`);
   }
 });
-var listBindingsCmd = defineCommand21({
+var listBindingsCmd = defineCommand22({
   meta: {
     name: "list",
     description: "List agents and their Telegram topic bindings"
@@ -3748,7 +5117,7 @@ var listBindingsCmd = defineCommand21({
     }
   }
 });
-var allowCmd = defineCommand21({
+var allowCmd = defineCommand22({
   meta: { name: "allow", description: "Add a Telegram user id to the allowlist" },
   args: {
     userId: { type: "positional", required: true, description: "Numeric Telegram user id" },
@@ -3765,7 +5134,7 @@ var allowCmd = defineCommand21({
     console.log(`allowed ${u.userId} (${u.role})`);
   }
 });
-var denyCmd = defineCommand21({
+var denyCmd = defineCommand22({
   meta: { name: "deny", description: "Remove a Telegram user id from the allowlist" },
   args: { userId: { type: "positional", required: true } },
   async run({ args }) {
@@ -3774,7 +5143,7 @@ var denyCmd = defineCommand21({
     console.log(`removed ${args.userId}`);
   }
 });
-var allowedCmd = defineCommand21({
+var allowedCmd = defineCommand22({
   meta: { name: "allowed", description: "List allowlisted Telegram users" },
   async run() {
     const client = createClient2();
@@ -3789,7 +5158,7 @@ var allowedCmd = defineCommand21({
     }
   }
 });
-var telegramCommand = defineCommand21({
+var telegramCommand = defineCommand22({
   meta: {
     name: "telegram",
     description: "Telegram integration: credentials, health, bot lifecycle, bindings, access"
@@ -3810,7 +5179,7 @@ var telegramCommand = defineCommand21({
 
 // src/commands/token.ts
 import { networkInterfaces } from "os";
-import { defineCommand as defineCommand22 } from "citty";
+import { defineCommand as defineCommand23 } from "citty";
 import qrcode from "qrcode-terminal";
 function tokenRow(t) {
   const last = t.lastUsedAt ? new Date(t.lastUsedAt).toISOString() : "(never)";
@@ -3844,7 +5213,7 @@ function resolveQrServer(override) {
   if (detected.warning) console.warn(`\u26A0 ${detected.warning}`);
   return detected.origin;
 }
-var createCmd3 = defineCommand22({
+var createCmd3 = defineCommand23({
   meta: { name: "create", description: "Mint a new web token (shown once)" },
   args: {
     label: { type: "positional", required: true, description: "Human-readable label" },
@@ -3875,7 +5244,7 @@ var createCmd3 = defineCommand22({
     qrcode.generate(pairUrl, { small: true }, (qr) => console.log(qr));
   }
 });
-var listCmd10 = defineCommand22({
+var listCmd10 = defineCommand23({
   meta: { name: "list", description: "List web tokens" },
   args: {
     all: { type: "boolean", description: "Include revoked tokens" }
@@ -3891,7 +5260,7 @@ var listCmd10 = defineCommand22({
     for (const line of columnize(tokens.map(tokenRow))) console.log(line);
   }
 });
-var showLocalCmd = defineCommand22({
+var showLocalCmd = defineCommand23({
   meta: {
     name: "show-local",
     description: "Print the bootstrap web token stored in ~/.bazilion/auth.json"
@@ -3901,7 +5270,7 @@ var showLocalCmd = defineCommand22({
     console.log(readAuthFile(paths.authFile).token);
   }
 });
-var revokeCmd = defineCommand22({
+var revokeCmd = defineCommand23({
   meta: { name: "revoke", description: "Revoke a web token" },
   args: {
     id: { type: "positional", required: true }
@@ -3912,7 +5281,7 @@ var revokeCmd = defineCommand22({
     console.log(`revoked token ${args.id}`);
   }
 });
-var tokenCommand = defineCommand22({
+var tokenCommand = defineCommand23({
   meta: { name: "token", description: "Manage web tokens for API/CLI clients" },
   subCommands: {
     create: createCmd3,
@@ -3923,8 +5292,8 @@ var tokenCommand = defineCommand22({
 });
 
 // src/commands/trigger.ts
-import { defineCommand as defineCommand23 } from "citty";
-var addCmd3 = defineCommand23({
+import { defineCommand as defineCommand24 } from "citty";
+var addCmd3 = defineCommand24({
   meta: { name: "add", description: "Add an interval / cron trigger to an agent" },
   args: {
     agent: { type: "positional", required: true },
@@ -3972,7 +5341,7 @@ function triggerRow(t) {
   const msgPreview = t.message.length > 60 ? `${t.message.slice(0, 60)}\u2026` : t.message;
   return [t.id, state, spec, `last: ${last}`, `"${msgPreview}"`];
 }
-var listCmd11 = defineCommand23({
+var listCmd11 = defineCommand24({
   meta: { name: "list", description: "List triggers for an agent" },
   args: {
     agent: { type: "positional", required: true }
@@ -3989,7 +5358,7 @@ var listCmd11 = defineCommand23({
     for (const line of columnize(triggers.map(triggerRow))) console.log(line);
   }
 });
-var rmCmd6 = defineCommand23({
+var rmCmd6 = defineCommand24({
   meta: { name: "rm", description: "Delete a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -4000,7 +5369,7 @@ var rmCmd6 = defineCommand23({
     console.log(`removed trigger ${args.id}`);
   }
 });
-var enableCmd3 = defineCommand23({
+var enableCmd3 = defineCommand24({
   meta: { name: "enable", description: "Enable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -4012,7 +5381,7 @@ var enableCmd3 = defineCommand23({
     console.log(`enabled trigger ${args.id}`);
   }
 });
-var disableCmd3 = defineCommand23({
+var disableCmd3 = defineCommand24({
   meta: { name: "disable", description: "Disable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -4024,21 +5393,50 @@ var disableCmd3 = defineCommand23({
     console.log(`disabled trigger ${args.id}`);
   }
 });
-var triggerCommand = defineCommand23({
+var historyCmd = defineCommand24({
+  meta: { name: "history", description: "Show recent dispatches for a trigger" },
+  args: {
+    id: { type: "positional", required: true },
+    limit: { type: "string", description: "Maximum rows (default 20)" }
+  },
+  async run({ args }) {
+    const limit = args.limit ? Number(args.limit) : 20;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      throw new Error("--limit must be an integer from 1 to 100");
+    }
+    const client = createClient2();
+    const { dispatches } = await client.get(
+      `/api/triggers/${args.id}/dispatches?limit=${limit}`
+    );
+    if (dispatches.length === 0) {
+      console.log("(no dispatches)");
+      return;
+    }
+    const rows = dispatches.map((dispatch) => [
+      new Date(dispatch.scheduledAt).toISOString(),
+      dispatch.status,
+      `attempts: ${dispatch.attemptCount}`,
+      dispatch.lastError ?? ""
+    ]);
+    for (const line of columnize(rows)) console.log(line);
+  }
+});
+var triggerCommand = defineCommand24({
   meta: { name: "trigger", description: "Manage scheduled agent triggers" },
   subCommands: {
     add: addCmd3,
     list: listCmd11,
     rm: rmCmd6,
     enable: enableCmd3,
-    disable: disableCmd3
+    disable: disableCmd3,
+    history: historyCmd
   }
 });
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join5 } from "path";
-import { defineCommand as defineCommand24 } from "citty";
+import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync4 } from "fs";
+import { join as join6 } from "path";
+import { defineCommand as defineCommand25 } from "citty";
 function makeLineReader() {
   let buffer = "";
   let ended = false;
@@ -4048,8 +5446,8 @@ function makeLineReader() {
       const nlIdx = buffer.indexOf("\n");
       if (nlIdx === -1) {
         if (ended) {
-          const resolve3 = queue.shift();
-          resolve3?.(buffer);
+          const resolve4 = queue.shift();
+          resolve4?.(buffer);
           buffer = "";
         } else {
           return;
@@ -4057,8 +5455,8 @@ function makeLineReader() {
       } else {
         const line = buffer.slice(0, nlIdx);
         buffer = buffer.slice(nlIdx + 1);
-        const resolve3 = queue.shift();
-        resolve3?.(line);
+        const resolve4 = queue.shift();
+        resolve4?.(line);
       }
     }
   };
@@ -4071,8 +5469,8 @@ function makeLineReader() {
     ended = true;
     tryDeliver();
   });
-  return () => new Promise((resolve3) => {
-    queue.push(resolve3);
+  return () => new Promise((resolve4) => {
+    queue.push(resolve4);
     tryDeliver();
   });
 }
@@ -4083,10 +5481,10 @@ async function askYes(readLine, prompt) {
 }
 function removePath(p) {
   if (!existsSync7(p)) return false;
-  rmSync3(p, { recursive: true, force: true });
+  rmSync4(p, { recursive: true, force: true });
   return true;
 }
-var uninstallCommand = defineCommand24({
+var uninstallCommand = defineCommand25({
   meta: {
     name: "uninstall",
     description: "Wipe bazilion state from ~/.bazilion (or BAZILION_HOME)"
@@ -4104,12 +5502,12 @@ var uninstallCommand = defineCommand24({
   },
   async run({ args }) {
     const paths = resolveCliPaths(args.home);
-    const dbFile = join5(paths.home, "bazilion.db");
-    const profilesDir = join5(paths.home, "profiles");
-    const agentsDir = join5(paths.home, "agents");
-    const teamsDir = join5(paths.home, "teams");
-    const skillsDir = join5(paths.home, "skills");
-    const logsDir = join5(paths.home, "logs");
+    const dbFile = join6(paths.home, "bazilion.db");
+    const profilesDir = join6(paths.home, "profiles");
+    const agentsDir = join6(paths.home, "agents");
+    const teamsDir = join6(paths.home, "teams");
+    const skillsDir = join6(paths.home, "skills");
+    const logsDir = join6(paths.home, "logs");
     if (!existsSync7(paths.home)) {
       console.log(`nothing to remove: ${paths.home} does not exist`);
       return;
@@ -4142,7 +5540,7 @@ var uninstallCommand = defineCommand24({
         if (removePath(p)) console.log(`removed ${p}`);
       }
       if (readdirSync2(paths.home).length === 0) {
-        rmSync3(paths.home, { recursive: true, force: true });
+        rmSync4(paths.home, { recursive: true, force: true });
         console.log(`removed ${paths.home}`);
       } else {
         console.log(`${paths.home} still has unmanaged files; left in place`);
@@ -4157,7 +5555,7 @@ var uninstallCommand = defineCommand24({
 
 // src/index.ts
 var VERSION = package_default.version;
-var main = defineCommand25({
+var main = defineCommand26({
   meta: {
     name: "bazilion",
     version: VERSION,
@@ -4170,6 +5568,7 @@ var main = defineCommand25({
     "team-template": teamTemplateCommand,
     agent: agentCommand,
     approval: approvalCommand,
+    attention: attentionCommand,
     skill: skillCommand,
     memory: memoryCommand,
     mcp: mcpCommand,
@@ -4265,6 +5664,7 @@ function printTopLevelHelp() {
       title: "agents",
       items: [
         ["approval", "Review and decide communication approval attempts"],
+        ["attention", "See everything that needs operator attention"],
         ["agent", "Spawn, list, chat, archive agents"],
         ["memory", "Read/write a team's shared memory"],
         ["send", "Send a message from one agent to another"],