chron-mcp 0.1.18 → 0.1.20

package/.claude-plugin/plugin.json

@@ -1,10 +1,9 @@
 {
   "name": "chron",
   "description": "Audit-grade timestamped logs for every AI conversation — stored locally, owned by you.",
-  "version": "0.1.12",
+  "version": "0.1.20",
   "author": {
-    "name": "Nivaya",
-    "email": "ksrinivas07530@gmail.com"
+    "name": "Nivaya"
   },
   "homepage": "https://github.com/sirinivask/chron",
   "repository": "https://github.com/sirinivask/chron",

package/dist/cli/index.js

@@ -1184,7 +1184,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       sql2.raw = raw;
-      function join4(chunks, separator) {
+      function join6(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) {
@@ -1194,7 +1194,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      sql2.join = join4;
+      sql2.join = join6;
       function identifier(value) {
         return new Name(value);
       }
@@ -2806,7 +2806,7 @@ var require_filesystem = __commonJS({
     "use strict";
     var fs = require("fs");
     var LDD_PATH = "/usr/bin/ldd";
-    var readFileSync2 = (path) => fs.readFileSync(path, "utf-8");
+    var readFileSync3 = (path) => fs.readFileSync(path, "utf-8");
     var readFile = (path) => new Promise((resolve, reject) => {
       fs.readFile(path, "utf-8", (err, data) => {
         if (err) {
@@ -2818,7 +2818,7 @@ var require_filesystem = __commonJS({
     });
     module2.exports = {
       LDD_PATH,
-      readFileSync: readFileSync2,
+      readFileSync: readFileSync3,
       readFile
     };
   }
@@ -2830,7 +2830,7 @@ var require_detect_libc = __commonJS({
     "use strict";
     var childProcess = require("child_process");
     var { isLinux, getReport } = require_process();
-    var { LDD_PATH, readFile, readFileSync: readFileSync2 } = require_filesystem();
+    var { LDD_PATH, readFile, readFileSync: readFileSync3 } = require_filesystem();
     var cachedFamilyFilesystem;
     var cachedVersionFilesystem;
     var command2 = "getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true";
@@ -2911,7 +2911,7 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyFilesystem = null;
       try {
-        const lddContent = readFileSync2(LDD_PATH);
+        const lddContent = readFileSync3(LDD_PATH);
         cachedFamilyFilesystem = getFamilyFromLddContent(lddContent);
       } catch (e) {
       }
@@ -2968,7 +2968,7 @@ var require_detect_libc = __commonJS({
       }
       cachedVersionFilesystem = null;
       try {
-        const lddContent = readFileSync2(LDD_PATH);
+        const lddContent = readFileSync3(LDD_PATH);
         const versionMatch = lddContent.match(RE_GLIBC_VERSION);
         if (versionMatch) {
           cachedVersionFilesystem = versionMatch[1];
@@ -6162,7 +6162,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash2 } = require("crypto");
+    var { randomBytes, createHash: createHash4 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -6842,7 +6842,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -7229,7 +7229,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash2 } = require("crypto");
+    var { createHash: createHash4 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -7538,7 +7538,7 @@ var require_websocket_server = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -14252,7 +14252,7 @@ var init_select2 = __esm({
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table))
             this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join4) => join4.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins?.some((join6) => join6.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (!this.isPartialSelect) {
@@ -15141,7 +15141,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return (table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join4) => join4.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins.some((join6) => join6.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (typeof on === "function") {
@@ -16539,7 +16539,11 @@ var init_schema = __esm({
       title: text("title").notNull().unique(),
       ai_tool: text("ai_tool"),
       created_at: text("created_at").notNull(),
-      updated_at: text("updated_at").notNull()
+      updated_at: text("updated_at").notNull(),
+      parent_session_id: text("parent_session_id"),
+      external_ref: text("external_ref"),
+      public_key: text("public_key"),
+      signature: text("signature")
     });
     messages = sqliteTable("messages", {
       id: text("id").primaryKey(),
@@ -16548,7 +16552,9 @@ var init_schema = __esm({
       content: text("content").notNull(),
       created_at: text("created_at").notNull(),
       prev_hash: text("prev_hash"),
-      content_hash: text("content_hash")
+      content_hash: text("content_hash"),
+      // NULL = pre-migration row (treated as 'message'); set for all new rows
+      event_type: text("event_type")
     });
     secrets_detected = sqliteTable("secrets_detected", {
       id: text("id").primaryKey(),
@@ -16579,14 +16585,31 @@ async function initDb(dbPath2) {
   for (const sql2 of CREATE_SQL) {
     await client.execute(sql2);
   }
-  const tableInfo = await client.execute("PRAGMA table_info(messages)");
-  const columns = tableInfo.rows.map((r) => r[1]);
-  if (!columns.includes("prev_hash")) {
+  const msgInfo = await client.execute("PRAGMA table_info(messages)");
+  const msgCols = msgInfo.rows.map((r) => r[1]);
+  if (!msgCols.includes("prev_hash")) {
     await client.execute("ALTER TABLE messages ADD COLUMN prev_hash TEXT");
   }
-  if (!columns.includes("content_hash")) {
+  if (!msgCols.includes("content_hash")) {
     await client.execute("ALTER TABLE messages ADD COLUMN content_hash TEXT");
   }
+  if (!msgCols.includes("event_type")) {
+    await client.execute("ALTER TABLE messages ADD COLUMN event_type TEXT");
+  }
+  const sessInfo = await client.execute("PRAGMA table_info(sessions)");
+  const sessCols = sessInfo.rows.map((r) => r[1]);
+  if (!sessCols.includes("parent_session_id")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN parent_session_id TEXT");
+  }
+  if (!sessCols.includes("external_ref")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN external_ref TEXT");
+  }
+  if (!sessCols.includes("public_key")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN public_key TEXT");
+  }
+  if (!sessCols.includes("signature")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN signature TEXT");
+  }
   return drizzle(client, { schema: schema_exports });
 }
 var import_os, import_fs, import_path, CREATE_SQL;
@@ -16605,7 +16628,11 @@ var init_db2 = __esm({
     title TEXT NOT NULL UNIQUE,
     ai_tool TEXT,
     created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
+    updated_at TEXT NOT NULL,
+    parent_session_id TEXT,
+    external_ref TEXT,
+    public_key TEXT,
+    signature TEXT
   )`,
       `CREATE TABLE IF NOT EXISTS messages (
     id TEXT PRIMARY KEY,
@@ -16615,6 +16642,7 @@ var init_db2 = __esm({
     created_at TEXT NOT NULL,
     prev_hash TEXT,
     content_hash TEXT,
+    event_type TEXT,
     FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE
   )`,
       `CREATE TABLE IF NOT EXISTS secrets_detected (
@@ -16806,14 +16834,14 @@ async function queryIntegrity(db) {
       unchained++;
       continue;
     }
-    let ok = true;
+    let ok2 = true;
     for (let i = 1; i < chained.length; i++) {
       if (chained[i].prev_hash !== chained[i - 1].content_hash) {
-        ok = false;
+        ok2 = false;
         break;
       }
     }
-    if (ok)
+    if (ok2)
       intact++;
     else {
       broken++;
@@ -17401,7 +17429,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "chron-mcp",
-      version: "0.1.18",
+      version: "0.1.20",
       mcpName: "io.github.sirinivask/chron",
       description: "Audit-grade timestamped logs for every AI conversation",
       repository: {
@@ -17560,7 +17588,7 @@ ${DIM4}Sending test event...${RESET5} `);
       }
     }]
   }]);
-  let ok = false;
+  let ok2 = false;
   let statusCode = 0;
   try {
     const res = await fetch(url, {
@@ -17572,7 +17600,7 @@ ${DIM4}Sending test event...${RESET5} `);
       body: testPayload
     });
     statusCode = res.status;
-    ok = res.ok;
+    ok2 = res.ok;
   } catch (e) {
     process.stdout.write(`${RED}failed${RESET5}
 `);
@@ -17581,7 +17609,7 @@ ${DIM4}Sending test event...${RESET5} `);
 `);
     process.exit(1);
   }
-  if (!ok) {
+  if (!ok2) {
     process.stdout.write(`${RED}failed (HTTP ${statusCode})${RESET5}
 `);
     process.stderr.write(`  ${RED}Check your URL and token, then try again.${RESET5}
@@ -18100,6 +18128,254 @@ var init_summary = __esm({
   }
 });
 
+// src/utils/signing.ts
+function keysDir() {
+  return (0, import_path4.join)((0, import_os5.homedir)(), ".chron", "keys");
+}
+function privKeyPath(sessionId) {
+  return (0, import_path4.join)(keysDir(), `${sessionId}.key`);
+}
+function sessionDigest(sessionId, finalContentHash, messageCount, firstCreatedAt) {
+  const input = `${sessionId}|${finalContentHash}|${messageCount}|${firstCreatedAt}`;
+  return (0, import_crypto2.createHash)("sha256").update(input).digest();
+}
+function signSession(sessionId, finalContentHash, messageCount, firstCreatedAt) {
+  const privPath = privKeyPath(sessionId);
+  if (!(0, import_fs4.existsSync)(privPath)) {
+    throw new Error(`Private key not found: ${privPath}`);
+  }
+  const privateKey = (0, import_fs4.readFileSync)(privPath, "utf8");
+  const digest = sessionDigest(sessionId, finalContentHash, messageCount, firstCreatedAt);
+  const sig = (0, import_crypto2.sign)(null, digest, privateKey);
+  return sig.toString("base64");
+}
+function verifySignature(publicKeyPem, signatureB64, sessionId, finalContentHash, messageCount, firstCreatedAt) {
+  try {
+    const digest = sessionDigest(sessionId, finalContentHash, messageCount, firstCreatedAt);
+    const sigBuf = Buffer.from(signatureB64, "base64");
+    return (0, import_crypto2.verify)(null, digest, publicKeyPem, sigBuf);
+  } catch {
+    return false;
+  }
+}
+var import_crypto2, import_fs4, import_path4, import_os5;
+var init_signing = __esm({
+  "src/utils/signing.ts"() {
+    "use strict";
+    import_crypto2 = require("crypto");
+    import_fs4 = require("fs");
+    import_path4 = require("path");
+    import_os5 = require("os");
+  }
+});
+
+// src/cli/sign.ts
+var sign_exports = {};
+__export(sign_exports, {
+  runSign: () => runSign
+});
+async function runSign(args2) {
+  const prefix = args2[0];
+  if (!prefix) {
+    process.stderr.write("Usage: chron sign <session-id-prefix>\n");
+    process.exit(1);
+  }
+  const db = await initDb();
+  const allSessions = await db.select().from(sessions);
+  const session = allSessions.find((s) => s.id.startsWith(prefix));
+  if (!session) {
+    process.stderr.write(`Session not found: ${prefix}
+`);
+    process.exit(1);
+  }
+  if (!session.public_key) {
+    process.stderr.write(`Session ${session.id.slice(0, 8)} has no public key \u2014 was it created before v0.1.19?
+`);
+    process.exit(1);
+  }
+  if (!(0, import_fs6.existsSync)(privKeyPath(session.id))) {
+    process.stderr.write(`Private key not found: ${privKeyPath(session.id)}
+`);
+    process.stderr.write("The key is stored on the machine where the session was created.\n");
+    process.exit(1);
+  }
+  const [countRow] = await db.select({
+    count: sql`count(*)`,
+    first_created_at: sql`min(${messages.created_at})`
+  }).from(messages).where(eq(messages.session_id, session.id));
+  const messageCount = countRow?.count ?? 0;
+  const firstCreatedAt = countRow?.first_created_at ?? "";
+  if (messageCount === 0) {
+    process.stderr.write("Session has no messages \u2014 nothing to sign.\n");
+    process.exit(1);
+  }
+  const lastMsg = await db.select({ content_hash: messages.content_hash }).from(messages).where(eq(messages.session_id, session.id)).orderBy(asc(sql`rowid`)).limit(1e3);
+  const finalContentHash = lastMsg[lastMsg.length - 1]?.content_hash ?? "";
+  if (!finalContentHash) {
+    process.stderr.write("Session has no hash chain \u2014 cannot sign.\n");
+    process.exit(1);
+  }
+  const signature = signSession(session.id, finalContentHash, messageCount, firstCreatedAt);
+  await db.update(sessions).set({ signature }).where(eq(sessions.id, session.id));
+  const sigData = {
+    chron_signature: "v1",
+    session_id: session.id,
+    session_title: session.title,
+    public_key_pem: session.public_key,
+    message_count: messageCount,
+    first_message_at: firstCreatedAt,
+    final_content_hash: finalContentHash,
+    signature,
+    signed_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const sigFile = (0, import_path5.join)(process.cwd(), `${session.id.slice(0, 8)}.chron.sig`);
+  (0, import_fs5.writeFileSync)(sigFile, JSON.stringify(sigData, null, 2));
+  process.stdout.write(`Signed session ${session.id.slice(0, 8)}
+`);
+  process.stdout.write(`  messages : ${messageCount}
+`);
+  process.stdout.write(`  final hash: ${finalContentHash.slice(0, 16)}\u2026
+`);
+  process.stdout.write(`  sig file : ${sigFile}
+`);
+}
+var import_fs5, import_path5, import_fs6;
+var init_sign = __esm({
+  "src/cli/sign.ts"() {
+    "use strict";
+    init_drizzle_orm();
+    import_fs5 = require("fs");
+    import_path5 = require("path");
+    init_db2();
+    init_schema();
+    init_signing();
+    import_fs6 = require("fs");
+  }
+});
+
+// src/utils/hash.ts
+function computeContentHash(sessionId, role, content, createdAt, prevHash, eventType) {
+  const base = `${sessionId}|${role}|${content}|${createdAt}|${prevHash ?? ""}`;
+  const input = eventType != null ? `${base}|${eventType}` : base;
+  return (0, import_crypto3.createHash)("sha256").update(input).digest("hex");
+}
+var import_crypto3;
+var init_hash = __esm({
+  "src/utils/hash.ts"() {
+    "use strict";
+    import_crypto3 = require("crypto");
+  }
+});
+
+// src/cli/verify.ts
+var verify_exports = {};
+__export(verify_exports, {
+  runVerify: () => runVerify
+});
+function ok(msg) {
+  process.stdout.write(`  ${GREEN3}\u2713${RESET7} ${msg}
+`);
+}
+function fail(msg) {
+  process.stdout.write(`  ${RED3}\u2717${RESET7} ${msg}
+`);
+}
+function warn(msg) {
+  process.stdout.write(`  ${YELLOW5}!${RESET7} ${msg}
+`);
+}
+async function runVerify(args2) {
+  const prefix = args2[0];
+  if (!prefix) {
+    process.stderr.write("Usage: chron verify <session-id-prefix>\n");
+    process.exit(1);
+  }
+  const db = await initDb();
+  const allSessions = await db.select().from(sessions);
+  const session = allSessions.find((s) => s.id.startsWith(prefix));
+  if (!session) {
+    process.stderr.write(`Session not found: ${prefix}
+`);
+    process.exit(1);
+  }
+  process.stdout.write(`
+${BOLD7}Verifying session ${session.id.slice(0, 8)}${RESET7} \u2014 ${session.title}
+
+`);
+  const rows = await db.select().from(messages).where(eq(messages.session_id, session.id)).orderBy(asc(messages.created_at), asc(sql`rowid`));
+  process.stdout.write(`${BOLD7}Hash chain${RESET7} (${rows.length} messages)
+`);
+  const chained = rows.filter((r) => r.content_hash !== null);
+  let chainOk = true;
+  if (chained.length === 0) {
+    warn("No chained messages \u2014 session pre-dates hash chaining");
+  } else {
+    for (let i = 0; i < chained.length; i++) {
+      const row = chained[i];
+      const expectedPrev = i === 0 ? null : chained[i - 1].content_hash;
+      if (row.prev_hash !== expectedPrev) {
+        fail(`Row ${i + 1} (${row.id.slice(0, 8)}): prev_hash mismatch \u2014 chain broken`);
+        chainOk = false;
+        break;
+      }
+      const expected = computeContentHash(row.session_id, row.role, row.content, row.created_at, row.prev_hash, row.event_type ?? void 0);
+      if (row.content_hash !== expected) {
+        fail(`Row ${i + 1} (${row.id.slice(0, 8)}): content_hash mismatch \u2014 row tampered`);
+        chainOk = false;
+        break;
+      }
+    }
+    if (chainOk)
+      ok(`All ${chained.length} hashes valid`);
+  }
+  process.stdout.write(`
+${BOLD7}Signature${RESET7}
+`);
+  if (!session.public_key) {
+    warn("No public key \u2014 session was created before signing support (v0.1.19)");
+  } else if (!session.signature) {
+    warn("Not yet signed \u2014 run: chron sign " + session.id.slice(0, 8));
+  } else {
+    const finalHash = chained[chained.length - 1]?.content_hash ?? "";
+    const firstCreatedAt = rows[0]?.created_at ?? "";
+    const sigValid = verifySignature(
+      session.public_key,
+      session.signature,
+      session.id,
+      finalHash,
+      rows.length,
+      firstCreatedAt
+    );
+    if (sigValid) {
+      ok("Ed25519 signature valid");
+      process.stdout.write(`  ${DIM6}public key: ${session.public_key.split("\n")[1]?.slice(0, 40)}\u2026${RESET7}
+`);
+    } else {
+      fail("Ed25519 signature INVALID \u2014 session data may have been altered after signing");
+    }
+  }
+  process.stdout.write("\n");
+  const allOk = chainOk && (session.signature ? true : true);
+  process.exit(allOk ? 0 : 1);
+}
+var RESET7, BOLD7, GREEN3, RED3, DIM6, YELLOW5;
+var init_verify = __esm({
+  "src/cli/verify.ts"() {
+    "use strict";
+    init_drizzle_orm();
+    init_db2();
+    init_schema();
+    init_hash();
+    init_signing();
+    RESET7 = "\x1B[0m";
+    BOLD7 = "\x1B[1m";
+    GREEN3 = "\x1B[32m";
+    RED3 = "\x1B[31m";
+    DIM6 = "\x1B[2m";
+    YELLOW5 = "\x1B[33m";
+  }
+});
+
 // src/cli/index.ts
 var [, , command, ...args] = process.argv;
 async function main() {
@@ -18139,6 +18415,16 @@ async function main() {
       await runSummary2(args);
       break;
     }
+    case "sign": {
+      const { runSign: runSign2 } = await Promise.resolve().then(() => (init_sign(), sign_exports));
+      await runSign2(args);
+      break;
+    }
+    case "verify": {
+      const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
+      await runVerify2(args);
+      break;
+    }
     default: {
       const name = command ? `Unknown command: ${command}
 
@@ -18154,6 +18440,8 @@ Commands:
   settings        View current configuration
   connect         Connect to a SIEM integration (crowdstrike, sentinel, splunk)
   summary         Structured summary of a session (timeline, mutations, secrets)
+  sign            Sign a session with its Ed25519 key \u2014 produces a .chron.sig file
+  verify          Verify a session's hash chain and Ed25519 signature
 
 Options (history):
   --limit=<n>     Max sessions to show (default: 20)
@@ -18164,7 +18452,7 @@ Options (report):
   --format=soc2     Generate SOC 2 HTML evidence package
   --output=<file>   Output file for --format=soc2 (default: soc2-report.html)
 
-Options (export / secrets):
+Options (export / secrets / sign / verify):
   <id-prefix>     Scope to a single session
 `
       );

package/dist/index.js

@@ -6890,7 +6890,7 @@ var require_filesystem = __commonJS({
     "use strict";
     var fs = require("fs");
     var LDD_PATH = "/usr/bin/ldd";
-    var readFileSync3 = (path) => fs.readFileSync(path, "utf-8");
+    var readFileSync4 = (path) => fs.readFileSync(path, "utf-8");
     var readFile = (path) => new Promise((resolve, reject) => {
       fs.readFile(path, "utf-8", (err, data) => {
         if (err) {
@@ -6902,7 +6902,7 @@ var require_filesystem = __commonJS({
     });
     module2.exports = {
       LDD_PATH,
-      readFileSync: readFileSync3,
+      readFileSync: readFileSync4,
       readFile
     };
   }
@@ -6914,7 +6914,7 @@ var require_detect_libc = __commonJS({
     "use strict";
     var childProcess = require("child_process");
     var { isLinux, getReport } = require_process();
-    var { LDD_PATH, readFile, readFileSync: readFileSync3 } = require_filesystem();
+    var { LDD_PATH, readFile, readFileSync: readFileSync4 } = require_filesystem();
     var cachedFamilyFilesystem;
     var cachedVersionFilesystem;
     var command = "getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true";
@@ -6995,7 +6995,7 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyFilesystem = null;
       try {
-        const lddContent = readFileSync3(LDD_PATH);
+        const lddContent = readFileSync4(LDD_PATH);
         cachedFamilyFilesystem = getFamilyFromLddContent(lddContent);
       } catch (e) {
       }
@@ -7052,7 +7052,7 @@ var require_detect_libc = __commonJS({
       }
       cachedVersionFilesystem = null;
       try {
-        const lddContent = readFileSync3(LDD_PATH);
+        const lddContent = readFileSync4(LDD_PATH);
         const versionMatch = lddContent.match(RE_GLIBC_VERSION);
         if (versionMatch) {
           cachedVersionFilesystem = versionMatch[1];
@@ -10246,7 +10246,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash3 } = require("crypto");
+    var { randomBytes, createHash: createHash4 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL3 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -10926,7 +10926,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -11313,7 +11313,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash3 } = require("crypto");
+    var { createHash: createHash4 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -11622,7 +11622,7 @@ var require_websocket_server = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -17521,7 +17521,7 @@ var init_sql2 = __esm({
         return new SQL([new StringChunk(str)]);
       }
       sql2.raw = raw;
-      function join5(chunks, separator) {
+      function join6(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) {
@@ -17531,7 +17531,7 @@ var init_sql2 = __esm({
         }
         return new SQL(result);
       }
-      sql2.join = join5;
+      sql2.join = join6;
       function identifier(value) {
         return new Name(value);
       }
@@ -20462,7 +20462,7 @@ var init_select2 = __esm({
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table))
             this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join5) => join5.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins?.some((join6) => join6.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (!this.isPartialSelect) {
@@ -21351,7 +21351,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return (table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join5) => join5.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins.some((join6) => join6.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (typeof on === "function") {
@@ -22749,7 +22749,11 @@ var init_schema = __esm({
       title: text("title").notNull().unique(),
       ai_tool: text("ai_tool"),
       created_at: text("created_at").notNull(),
-      updated_at: text("updated_at").notNull()
+      updated_at: text("updated_at").notNull(),
+      parent_session_id: text("parent_session_id"),
+      external_ref: text("external_ref"),
+      public_key: text("public_key"),
+      signature: text("signature")
     });
     messages = sqliteTable("messages", {
       id: text("id").primaryKey(),
@@ -22758,7 +22762,9 @@ var init_schema = __esm({
       content: text("content").notNull(),
       created_at: text("created_at").notNull(),
       prev_hash: text("prev_hash"),
-      content_hash: text("content_hash")
+      content_hash: text("content_hash"),
+      // NULL = pre-migration row (treated as 'message'); set for all new rows
+      event_type: text("event_type")
     });
     secrets_detected = sqliteTable("secrets_detected", {
       id: text("id").primaryKey(),
@@ -22789,14 +22795,31 @@ async function initDb(dbPath) {
   for (const sql2 of CREATE_SQL) {
     await client.execute(sql2);
   }
-  const tableInfo = await client.execute("PRAGMA table_info(messages)");
-  const columns = tableInfo.rows.map((r) => r[1]);
-  if (!columns.includes("prev_hash")) {
+  const msgInfo = await client.execute("PRAGMA table_info(messages)");
+  const msgCols = msgInfo.rows.map((r) => r[1]);
+  if (!msgCols.includes("prev_hash")) {
     await client.execute("ALTER TABLE messages ADD COLUMN prev_hash TEXT");
   }
-  if (!columns.includes("content_hash")) {
+  if (!msgCols.includes("content_hash")) {
     await client.execute("ALTER TABLE messages ADD COLUMN content_hash TEXT");
   }
+  if (!msgCols.includes("event_type")) {
+    await client.execute("ALTER TABLE messages ADD COLUMN event_type TEXT");
+  }
+  const sessInfo = await client.execute("PRAGMA table_info(sessions)");
+  const sessCols = sessInfo.rows.map((r) => r[1]);
+  if (!sessCols.includes("parent_session_id")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN parent_session_id TEXT");
+  }
+  if (!sessCols.includes("external_ref")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN external_ref TEXT");
+  }
+  if (!sessCols.includes("public_key")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN public_key TEXT");
+  }
+  if (!sessCols.includes("signature")) {
+    await client.execute("ALTER TABLE sessions ADD COLUMN signature TEXT");
+  }
   return drizzle(client, { schema: schema_exports });
 }
 var import_os, import_fs, import_path, CREATE_SQL;
@@ -22815,7 +22838,11 @@ var init_db2 = __esm({
     title TEXT NOT NULL UNIQUE,
     ai_tool TEXT,
     created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
+    updated_at TEXT NOT NULL,
+    parent_session_id TEXT,
+    external_ref TEXT,
+    public_key TEXT,
+    signature TEXT
   )`,
       `CREATE TABLE IF NOT EXISTS messages (
     id TEXT PRIMARY KEY,
@@ -22825,6 +22852,7 @@ var init_db2 = __esm({
     created_at TEXT NOT NULL,
     prev_hash TEXT,
     content_hash TEXT,
+    event_type TEXT,
     FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE
   )`,
       `CREATE TABLE IF NOT EXISTS secrets_detected (
@@ -38446,7 +38474,7 @@ var init_time = __esm({
 var version4;
 var init_package = __esm({
   "package.json"() {
-    version4 = "0.1.18";
+    version4 = "0.1.20";
   }
 });
 
@@ -38690,18 +38718,71 @@ var init_relay = __esm({
   }
 });
 
+// src/utils/signing.ts
+function keysDir() {
+  return (0, import_path3.join)((0, import_os3.homedir)(), ".chron", "keys");
+}
+function privKeyPath(sessionId) {
+  return (0, import_path3.join)(keysDir(), `${sessionId}.key`);
+}
+function pubKeyPath(sessionId) {
+  return (0, import_path3.join)(keysDir(), `${sessionId}.pub`);
+}
+function generateSessionKeypair(sessionId) {
+  const { privateKey, publicKey } = (0, import_crypto4.generateKeyPairSync)("ed25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" }
+  });
+  const dir = keysDir();
+  (0, import_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_fs3.writeFileSync)(privKeyPath(sessionId), privateKey, { mode: 384 });
+  (0, import_fs3.writeFileSync)(pubKeyPath(sessionId), publicKey);
+  return publicKey;
+}
+function sessionDigest(sessionId, finalContentHash, messageCount, firstCreatedAt) {
+  const input = `${sessionId}|${finalContentHash}|${messageCount}|${firstCreatedAt}`;
+  return (0, import_crypto4.createHash)("sha256").update(input).digest();
+}
+function verifySignature(publicKeyPem, signatureB64, sessionId, finalContentHash, messageCount, firstCreatedAt) {
+  try {
+    const digest = sessionDigest(sessionId, finalContentHash, messageCount, firstCreatedAt);
+    const sigBuf = Buffer.from(signatureB64, "base64");
+    return (0, import_crypto4.verify)(null, digest, publicKeyPem, sigBuf);
+  } catch {
+    return false;
+  }
+}
+var import_crypto4, import_fs3, import_path3, import_os3;
+var init_signing = __esm({
+  "src/utils/signing.ts"() {
+    "use strict";
+    import_crypto4 = require("crypto");
+    import_fs3 = require("fs");
+    import_path3 = require("path");
+    import_os3 = require("os");
+  }
+});
+
 // src/tools/sessions.ts
 function startSession(db) {
   return async (args) => {
     const id = v4_default();
     const now = localISOString();
     try {
+      let publicKey = null;
+      try {
+        publicKey = generateSessionKeypair(id);
+      } catch {
+      }
       await db.insert(sessions).values({
         id,
         title: args.title,
         ai_tool: args.ai_tool ?? null,
         created_at: now,
-        updated_at: now
+        updated_at: now,
+        parent_session_id: args.parent_session_id ?? null,
+        external_ref: args.external_ref ?? null,
+        public_key: publicKey
       });
       emitEvent({ event_type: "session_started", timestamp: now, session: { id_prefix: id.slice(0, 8), ai_tool: args.ai_tool ?? null } });
       return {
@@ -38736,12 +38817,20 @@ function initSession(db) {
     let created;
     let ai_tool;
     try {
+      let publicKey = null;
+      try {
+        publicKey = generateSessionKeypair(id);
+      } catch {
+      }
       await db.insert(sessions).values({
         id,
         title: args.title,
         ai_tool: args.ai_tool ?? null,
         created_at: now,
-        updated_at: now
+        updated_at: now,
+        parent_session_id: args.parent_session_id ?? null,
+        external_ref: args.external_ref ?? null,
+        public_key: publicKey
       });
       session_id = id;
       created = true;
@@ -38842,18 +38931,21 @@ var init_sessions = __esm({
     init_schema();
     init_time();
     init_relay();
+    init_signing();
   }
 });
 
 // src/utils/hash.ts
-function computeContentHash(sessionId, role, content, createdAt, prevHash) {
-  return (0, import_crypto4.createHash)("sha256").update(`${sessionId}|${role}|${content}|${createdAt}|${prevHash ?? ""}`).digest("hex");
+function computeContentHash(sessionId, role, content, createdAt, prevHash, eventType) {
+  const base = `${sessionId}|${role}|${content}|${createdAt}|${prevHash ?? ""}`;
+  const input = eventType != null ? `${base}|${eventType}` : base;
+  return (0, import_crypto5.createHash)("sha256").update(input).digest("hex");
 }
-var import_crypto4;
+var import_crypto5;
 var init_hash = __esm({
   "src/utils/hash.ts"() {
     "use strict";
-    import_crypto4 = require("crypto");
+    import_crypto5 = require("crypto");
   }
 });
 
@@ -39150,32 +39242,37 @@ async function writeDetections(db, session_id, message_id, content) {
 function isFkError(e) {
   return e?.message?.includes("FOREIGN KEY constraint failed") || e?.code === "SQLITE_CONSTRAINT_FOREIGNKEY" || e?.cause?.message?.includes("FOREIGN KEY constraint failed") || e?.cause?.extendedCode === "SQLITE_CONSTRAINT_FOREIGNKEY";
 }
+async function insertMessage(db, session_id, role, content, event_type) {
+  return db.transaction(async (tx) => {
+    const last = await tx.select({ content_hash: messages.content_hash }).from(messages).where(eq(messages.session_id, session_id)).orderBy(desc(messages.created_at), desc(sql`rowid`)).limit(1);
+    const ts = localISOString();
+    const msgId = v4_default();
+    const prevHash = last[0]?.content_hash ?? null;
+    const hash = computeContentHash(session_id, role, content, ts, prevHash, event_type);
+    await tx.insert(messages).values({
+      id: msgId,
+      session_id,
+      role,
+      content,
+      created_at: ts,
+      prev_hash: prevHash,
+      content_hash: hash,
+      event_type
+    });
+    await tx.update(sessions).set({ updated_at: ts }).where(eq(sessions.id, session_id));
+    const [sessionRow] = await tx.select({ ai_tool: sessions.ai_tool }).from(sessions).where(eq(sessions.id, session_id)).limit(1);
+    return { id: msgId, now: ts, contentHash: hash, ai_tool: sessionRow?.ai_tool ?? null };
+  });
+}
 function logMessage(db) {
   return async (args) => {
+    const eventType = args.event_type ?? "message";
     let id;
     let now;
     let contentHash;
     let sessionAiTool;
     try {
-      const result = await db.transaction(async (tx) => {
-        const last = await tx.select({ content_hash: messages.content_hash }).from(messages).where(eq(messages.session_id, args.session_id)).orderBy(desc(messages.created_at), desc(sql`rowid`)).limit(1);
-        const ts = localISOString();
-        const msgId = v4_default();
-        const prevHash = last[0]?.content_hash ?? null;
-        const hash = computeContentHash(args.session_id, args.role, args.content, ts, prevHash);
-        await tx.insert(messages).values({
-          id: msgId,
-          session_id: args.session_id,
-          role: args.role,
-          content: args.content,
-          created_at: ts,
-          prev_hash: prevHash,
-          content_hash: hash
-        });
-        await tx.update(sessions).set({ updated_at: ts }).where(eq(sessions.id, args.session_id));
-        const [sessionRow] = await tx.select({ ai_tool: sessions.ai_tool }).from(sessions).where(eq(sessions.id, args.session_id)).limit(1);
-        return { id: msgId, now: ts, contentHash: hash, ai_tool: sessionRow?.ai_tool ?? null };
-      });
+      const result = await insertMessage(db, args.session_id, args.role, args.content, eventType);
       id = result.id;
       now = result.now;
       contentHash = result.contentHash;
@@ -39187,7 +39284,7 @@ function logMessage(db) {
       throw e;
     }
     emitEvent({ event_type: "message_logged", timestamp: now, session: { id_prefix: args.session_id.slice(0, 8), ai_tool: sessionAiTool }, message: { role: args.role } });
-    if (args.role === "user") {
+    if (args.role === "user" && eventType === "message") {
       setImmediate(() => writeDetections(db, args.session_id, id, args.content).catch(() => void 0));
     }
     return {
@@ -39195,15 +39292,45 @@ function logMessage(db) {
     };
   };
 }
+function logToolCall(db) {
+  return async (args) => {
+    const toolCallId = args.tool_call_id ?? v4_default();
+    const content = JSON.stringify({ tool_name: args.tool_name, input: args.tool_input, tool_call_id: toolCallId });
+    let result;
+    try {
+      result = await insertMessage(db, args.session_id, "assistant", content, "tool_call");
+    } catch (e) {
+      if (isFkError(e)) {
+        return { content: [{ type: "text", text: `Session not found: ${args.session_id}` }], isError: true };
+      }
+      throw e;
+    }
+    return {
+      content: [{ type: "text", text: JSON.stringify({ message_id: result.id, tool_call_id: toolCallId, created_at: result.now, content_hash: result.contentHash }) }]
+    };
+  };
+}
+function logToolResult(db) {
+  return async (args) => {
+    const content = JSON.stringify({ tool_call_id: args.tool_call_id, output: args.output, exit_code: args.exit_code ?? null });
+    let result;
+    try {
+      result = await insertMessage(db, args.session_id, "user", content, "tool_result");
+    } catch (e) {
+      if (isFkError(e)) {
+        return { content: [{ type: "text", text: `Session not found: ${args.session_id}` }], isError: true };
+      }
+      throw e;
+    }
+    return {
+      content: [{ type: "text", text: JSON.stringify({ message_id: result.id, tool_call_id: args.tool_call_id, created_at: result.now, content_hash: result.contentHash }) }]
+    };
+  };
+}
 function logExchange(db) {
   return async (args) => {
-    let userId;
-    let assistantId;
-    let userNow;
-    let assistantNow;
-    let userHash;
-    let assistantHash;
-    let sessionAiTool;
+    let userId, assistantId, userNow, assistantNow;
+    let userHash, assistantHash, sessionAiTool;
     try {
       const result = await db.transaction(async (tx) => {
         const last = await tx.select({ content_hash: messages.content_hash }).from(messages).where(eq(messages.session_id, args.session_id)).orderBy(desc(messages.created_at), desc(sql`rowid`)).limit(1);
@@ -39212,8 +39339,8 @@ function logExchange(db) {
         const aNow = localISOString();
         const aId = v4_default();
         const prevHash = last[0]?.content_hash ?? null;
-        const uHash = computeContentHash(args.session_id, "user", args.user_content, uNow, prevHash);
-        const aHash = computeContentHash(args.session_id, "assistant", args.assistant_content, aNow, uHash);
+        const uHash = computeContentHash(args.session_id, "user", args.user_content, uNow, prevHash, "message");
+        const aHash = computeContentHash(args.session_id, "assistant", args.assistant_content, aNow, uHash, "message");
         await tx.insert(messages).values({
           id: uId,
           session_id: args.session_id,
@@ -39221,7 +39348,8 @@ function logExchange(db) {
           content: args.user_content,
           created_at: uNow,
           prev_hash: prevHash,
-          content_hash: uHash
+          content_hash: uHash,
+          event_type: "message"
         });
         await tx.insert(messages).values({
           id: aId,
@@ -39230,7 +39358,8 @@ function logExchange(db) {
           content: args.assistant_content,
           created_at: aNow,
           prev_hash: uHash,
-          content_hash: aHash
+          content_hash: aHash,
+          event_type: "message"
         });
         await tx.update(sessions).set({ updated_at: aNow }).where(eq(sessions.id, args.session_id));
         const [sessionRow] = await tx.select({ ai_tool: sessions.ai_tool }).from(sessions).where(eq(sessions.id, args.session_id)).limit(1);
@@ -39284,6 +39413,7 @@ var init_messages = __esm({
 // src/tools/verify.ts
 function verifySession(db) {
   return async (args) => {
+    const [sessionRow] = await db.select().from(sessions).where(eq(sessions.id, args.session_id)).limit(1);
     const rows = await db.select().from(messages).where(eq(messages.session_id, args.session_id)).orderBy(asc(messages.created_at), asc(sql`rowid`));
     const chained = rows.filter((r) => r.content_hash !== null);
     if (chained.length === 0) {
@@ -39305,7 +39435,7 @@ function verifySession(db) {
           }]
         };
       }
-      const expected = computeContentHash(row.session_id, row.role, row.content, row.created_at, row.prev_hash);
+      const expected = computeContentHash(row.session_id, row.role, row.content, row.created_at, row.prev_hash, row.event_type ?? void 0);
       if (row.content_hash !== expected) {
         return {
           content: [{
@@ -39315,10 +39445,23 @@ function verifySession(db) {
         };
       }
     }
+    let signature_valid = "unsigned";
+    if (sessionRow?.public_key && sessionRow?.signature) {
+      const finalHash = chained[chained.length - 1]?.content_hash ?? "";
+      const firstCreatedAt = rows[0]?.created_at ?? "";
+      signature_valid = verifySignature(
+        sessionRow.public_key,
+        sessionRow.signature,
+        args.session_id,
+        finalHash,
+        rows.length,
+        firstCreatedAt
+      );
+    }
     return {
       content: [{
         type: "text",
-        text: JSON.stringify({ valid: true, messages: rows.length, chained: chained.length })
+        text: JSON.stringify({ valid: true, messages: rows.length, chained: chained.length, signature_valid })
       }]
     };
   };
@@ -39329,6 +39472,7 @@ var init_verify = __esm({
     init_drizzle_orm();
     init_schema();
     init_hash();
+    init_signing();
   }
 });
 
@@ -39591,7 +39735,9 @@ function createServer(db) {
     {
       title: external_exports.string().describe('Descriptive session title, e.g. "Contract review \u2014 2026-05-08"'),
       ai_tool: external_exports.string().optional().describe('AI tool name: "claude", "cursor", "windsurf", etc.'),
-      limit: external_exports.number().int().positive().optional().describe("Number of recent messages to return (default: 10)")
+      limit: external_exports.number().int().positive().optional().describe("Number of recent messages to return (default: 10)"),
+      parent_session_id: external_exports.string().optional().describe("Parent session ID if this is a subagent session spawned by another session"),
+      external_ref: external_exports.string().optional().describe('External ticket/PR reference, e.g. "jira:ENG-123" or "github:org/repo#456"')
     },
     initSession(db)
   );
@@ -39600,7 +39746,9 @@ function createServer(db) {
     "Create a new audit session or resume an existing one by title. Call this at the start of every conversation.",
     {
       title: external_exports.string().describe('Descriptive session title, e.g. "Contract review \u2014 2026-05-08"'),
-      ai_tool: external_exports.string().optional().describe('AI tool name: "claude", "cursor", "windsurf", etc.')
+      ai_tool: external_exports.string().optional().describe('AI tool name: "claude", "cursor", "windsurf", etc.'),
+      parent_session_id: external_exports.string().optional().describe("Parent session ID if this is a subagent session"),
+      external_ref: external_exports.string().optional().describe('External ticket/PR reference, e.g. "jira:ENG-123"')
     },
     startSession(db)
   );
@@ -39614,6 +39762,28 @@ function createServer(db) {
     },
     logMessage(db)
   );
+  server.tool(
+    "log_tool_call",
+    "Record an AI tool invocation as a first-class audit event (event_type=tool_call). Call immediately before executing a tool. Returns tool_call_id to pass to log_tool_result.",
+    {
+      session_id: external_exports.string().describe("Session ID"),
+      tool_name: external_exports.string().describe('Name of the tool being called (e.g. "Edit", "Bash", "WebFetch")'),
+      tool_input: external_exports.record(external_exports.unknown()).describe("Tool input parameters as an object"),
+      tool_call_id: external_exports.string().optional().describe("Optional ID to link this call to its result. Generated automatically if omitted.")
+    },
+    logToolCall(db)
+  );
+  server.tool(
+    "log_tool_result",
+    "Record the result of a tool call as a first-class audit event (event_type=tool_result). Call immediately after receiving tool output. Links back to log_tool_call via tool_call_id.",
+    {
+      session_id: external_exports.string().describe("Session ID"),
+      tool_call_id: external_exports.string().describe("tool_call_id returned by log_tool_call"),
+      output: external_exports.string().describe("Tool output (stdout, file content, API response, etc.)"),
+      exit_code: external_exports.number().int().optional().describe("Exit code for shell tools (0 = success)")
+    },
+    logToolResult(db)
+  );
   server.tool(
     "log_exchange",
     "Record a user+assistant exchange from historical or batch imports only. Do NOT use for live conversations \u2014 both timestamps are captured at the same instant with no real gap. For live sessions always call log_message twice: once for the user message, once for the assistant response.",
@@ -39706,24 +39876,24 @@ __export(setup_exports, {
   runSetup: () => runSetup
 });
 function configPath(...parts) {
-  return (0, import_path3.join)((0, import_os3.homedir)(), ...parts);
+  return (0, import_path4.join)((0, import_os4.homedir)(), ...parts);
 }
 function readJson(filePath) {
-  if (!(0, import_fs3.existsSync)(filePath))
+  if (!(0, import_fs4.existsSync)(filePath))
     return {};
   try {
-    return JSON.parse((0, import_fs3.readFileSync)(filePath, "utf8"));
+    return JSON.parse((0, import_fs4.readFileSync)(filePath, "utf8"));
   } catch {
     return {};
   }
 }
 function writeJson(filePath, data) {
-  (0, import_fs3.mkdirSync)((0, import_path3.dirname)(filePath), { recursive: true });
-  (0, import_fs3.writeFileSync)(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
+  (0, import_fs4.mkdirSync)((0, import_path4.dirname)(filePath), { recursive: true });
+  (0, import_fs4.writeFileSync)(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function configureTool(name, filePath) {
-  const dir = (0, import_path3.dirname)(filePath);
-  if (!(0, import_fs3.existsSync)(dir) && name !== "Claude Code") {
+  const dir = (0, import_path4.dirname)(filePath);
+  if (!(0, import_fs4.existsSync)(dir) && name !== "Claude Code") {
     return { tool: name, status: "skipped" };
   }
   try {
@@ -39744,7 +39914,7 @@ function configureClaudeCode() {
   try {
     (0, import_child_process.execSync)("claude mcp add chron -- npx -y chron-mcp", { stdio: "pipe" });
   } catch {
-    const result = configureTool("Claude Code", (0, import_path3.join)((0, import_os3.homedir)(), ".claude", "settings.json"));
+    const result = configureTool("Claude Code", (0, import_path4.join)((0, import_os4.homedir)(), ".claude", "settings.json"));
     if (result.status === "error")
       return result;
   }
@@ -39752,13 +39922,13 @@ function configureClaudeCode() {
   return { tool: "Claude Code", status: "added" };
 }
 function installClaudeCodeHook() {
-  const skillSrc = (0, import_path3.join)(__dirname, "..", "skills", "chron.skill.md");
-  const skillDst = (0, import_path3.join)((0, import_os3.homedir)(), ".chron", "chron.skill.md");
-  if ((0, import_fs3.existsSync)(skillSrc)) {
-    (0, import_fs3.mkdirSync)((0, import_path3.dirname)(skillDst), { recursive: true });
-    (0, import_fs3.copyFileSync)(skillSrc, skillDst);
+  const skillSrc = (0, import_path4.join)(__dirname, "..", "skills", "chron.skill.md");
+  const skillDst = (0, import_path4.join)((0, import_os4.homedir)(), ".chron", "chron.skill.md");
+  if ((0, import_fs4.existsSync)(skillSrc)) {
+    (0, import_fs4.mkdirSync)((0, import_path4.dirname)(skillDst), { recursive: true });
+    (0, import_fs4.copyFileSync)(skillSrc, skillDst);
   }
-  const settingsPath = (0, import_path3.join)((0, import_os3.homedir)(), ".claude", "settings.json");
+  const settingsPath = (0, import_path4.join)((0, import_os4.homedir)(), ".claude", "settings.json");
   const settings = readJson(settingsPath);
   if (!settings.hooks)
     settings.hooks = {};
@@ -39782,13 +39952,13 @@ async function runSetup() {
   }
   return results.filter((r) => r.status !== "skipped");
 }
-var import_fs3, import_os3, import_path3, import_child_process, CHRON_ENTRY, TOOLS;
+var import_fs4, import_os4, import_path4, import_child_process, CHRON_ENTRY, TOOLS;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
-    import_fs3 = require("fs");
-    import_os3 = require("os");
-    import_path3 = require("path");
+    import_fs4 = require("fs");
+    import_os4 = require("os");
+    import_path4 = require("path");
     import_child_process = require("child_process");
     CHRON_ENTRY = {
       command: "npx",
@@ -39797,11 +39967,11 @@ var init_setup = __esm({
     TOOLS = [
       {
         name: "Claude Desktop",
-        path: process.platform === "win32" ? (0, import_path3.join)(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : configPath("Library", "Application Support", "Claude", "claude_desktop_config.json")
+        path: process.platform === "win32" ? (0, import_path4.join)(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : configPath("Library", "Application Support", "Claude", "claude_desktop_config.json")
       },
       {
         name: "Cursor",
-        path: process.platform === "win32" ? (0, import_path3.join)(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "cursor.mcp", "mcp.json") : configPath(".cursor", "mcp.json")
+        path: process.platform === "win32" ? (0, import_path4.join)(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "cursor.mcp", "mcp.json") : configPath(".cursor", "mcp.json")
       },
       {
         name: "Windsurf",
@@ -59989,7 +60159,7 @@ var require_view = __commonJS({
     var dirname3 = path.dirname;
     var basename = path.basename;
     var extname = path.extname;
-    var join5 = path.join;
+    var join6 = path.join;
     var resolve = path.resolve;
     module2.exports = View2;
     function View2(name, options) {
@@ -60037,12 +60207,12 @@ var require_view = __commonJS({
     };
     View2.prototype.resolve = function resolve2(dir, file) {
       var ext = this.ext;
-      var path2 = join5(dir, file);
+      var path2 = join6(dir, file);
       var stat = tryStat(path2);
       if (stat && stat.isFile()) {
         return path2;
       }
-      path2 = join5(dir, basename(file, ext), "index" + ext);
+      path2 = join6(dir, basename(file, ext), "index" + ext);
       stat = tryStat(path2);
       if (stat && stat.isFile()) {
         return path2;
@@ -61109,7 +61279,7 @@ var require_send = __commonJS({
     var Stream2 = require("stream");
     var util2 = require("util");
     var extname = path.extname;
-    var join5 = path.join;
+    var join6 = path.join;
     var normalize = path.normalize;
     var resolve = path.resolve;
     var sep = path.sep;
@@ -61328,7 +61498,7 @@ var require_send = __commonJS({
           return res;
         }
         parts = path2.split(sep);
-        path2 = normalize(join5(root, path2));
+        path2 = normalize(join6(root, path2));
       } else {
         if (UP_PATH_REGEXP.test(path2)) {
           debug('malicious path "%s"', path2);
@@ -61469,7 +61639,7 @@ var require_send = __commonJS({
             return self.onStatError(err);
           return self.error(404);
         }
-        var p = join5(path2, self._index[i]);
+        var p = join6(path2, self._index[i]);
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2)
@@ -68917,8 +69087,8 @@ var StdioServerTransport = class {
 };
 
 // src/index.ts
-var import_os4 = require("os");
-var import_path4 = require("path");
+var import_os5 = require("os");
+var import_path5 = require("path");
 init_db2();
 init_server3();
 init_package();
@@ -68928,7 +69098,7 @@ if (process.argv[2] === "--version" || process.argv[2] === "-v") {
   process.exit(0);
 }
 async function main() {
-  const dbPath = process.env.CHRON_DB_PATH ?? (0, import_path4.join)((0, import_os4.homedir)(), ".chron", "chron.db");
+  const dbPath = process.env.CHRON_DB_PATH ?? (0, import_path5.join)((0, import_os5.homedir)(), ".chron", "chron.db");
   if (process.stdin.isTTY) {
     process.stdout.write(`chron-mcp ${version4}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chron-mcp",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "mcpName": "io.github.sirinivask/chron",
   "description": "Audit-grade timestamped logs for every AI conversation",
   "repository": {