flatbread-cli 0.2.0 → 0.3.1

package/dist/flatbread.mjs

@@ -7,10 +7,10 @@ var __export = (target, all) => {
 
 // src/index.ts
 import { spawn as spawn3 } from "node:child_process";
-import fs21 from "node:fs";
-import os7 from "node:os";
-import path20 from "node:path";
-import { fileURLToPath } from "node:url";
+import fs22 from "node:fs";
+import os8 from "node:os";
+import path21 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../../node_modules/zod/v3/external.js
 var external_exports = {};
@@ -490,8 +490,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path21, errorMaps, issueData } = params;
-  const fullPath = [...path21, ...issueData.path || []];
+  const { data, path: path22, errorMaps, issueData } = params;
+  const fullPath = [...path22, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -607,11 +607,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path21, key) {
+  constructor(parent, value, path22, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path21;
+    this._path = path22;
     this._key = key;
   }
   get path() {
@@ -4384,8 +4384,8 @@ function firstLine(text2) {
 function labelOf(step, cwd) {
   const tool = step.tool;
   if (tool === void 0) return step.type;
-  const path21 = firstString(tool.input, FILE_PATH_KEYS);
-  if (path21 !== void 0) return `${tool.name} ${repoRelative(path21, cwd)}`;
+  const path22 = firstString(tool.input, FILE_PATH_KEYS);
+  if (path22 !== void 0) return `${tool.name} ${repoRelative(path22, cwd)}`;
   const other = firstString(tool.input, TARGET_KEYS);
   if (other !== void 0) return cut(`${tool.name}: ${repoRelative(firstLine(other), cwd)}`, BRIEF_LIMITS.quote);
   return tool.name;
@@ -4633,9 +4633,9 @@ function runDiagnostics(trace) {
       searches.set(key, found);
     }
   }
-  for (const [path21, entries] of reads) {
+  for (const [path22, entries] of reads) {
     const hit = densest(entries, WASTE_RULES.repeatedRead.times, WASTE_RULES.repeatedRead.windowMinutes * 6e4);
-    if (hit) waste.push({ kind: "repeated-read", path: path21, steps: hit, windowMinutes: WASTE_RULES.repeatedRead.windowMinutes });
+    if (hit) waste.push({ kind: "repeated-read", path: path22, steps: hit, windowMinutes: WASTE_RULES.repeatedRead.windowMinutes });
   }
   for (const { label, entries } of searches.values()) {
     const hit = densest(entries, WASTE_RULES.repeatedSearch.times, WASTE_RULES.repeatedSearch.windowMinutes * 6e4);
@@ -4713,19 +4713,19 @@ function filesOf(steps, cwd) {
   const patches = [];
   steps.forEach((step, index) => {
     if (!isSuccessfulEdit(step) || step.tool === void 0) return;
-    const path21 = repoRelative(firstString(step.tool.input, FILE_PATH_KEYS), cwd);
-    const file = files.get(path21) ?? { path: path21 };
+    const path22 = repoRelative(firstString(step.tool.input, FILE_PATH_KEYS), cwd);
+    const file = files.get(path22) ?? { path: path22 };
     if (step.diff !== void 0) {
       const counted = countPatch(step.diff.patch);
       file.added = (file.added ?? 0) + counted.added;
       file.removed = (file.removed ?? 0) + counted.removed;
-      patches.push({ path: path21, patch: repoRelative(step.diff.patch, cwd), step: step.stepNumber });
+      patches.push({ path: path22, patch: repoRelative(step.diff.patch, cwd), step: step.stepNumber });
     }
     const result = resultOf(steps, index);
     if (step.tool.name.toLowerCase() === "write" && result !== void 0 && /^File created successfully\b/.test(result.trim())) {
       file.created = true;
     }
-    files.set(path21, file);
+    files.set(path22, file);
   });
   return { files: [...files.values()], patches };
 }
@@ -4810,11 +4810,11 @@ var HARNESS_INFO = {
   antigravity: {
     id: "antigravity",
     label: "Google Antigravity",
-    formatLabel: "unknown",
-    confidence: "inferred",
-    implemented: false,
+    formatLabel: "app brain/<id>/.system_generated/logs/transcript.jsonl, or IDE conversations/<id>.pb",
+    confidence: "documented",
+    implemented: true,
     humanTest: "A6",
-    note: "Detector only. The format is unpublished and unseen, so this adapter refuses rather than inventing a timeline."
+    note: "Both stores measured on one machine. The app's transcript is read the way deja-vu reads it: prompts, replies and the planner's tool calls, not tool output. The IDE's .pb is read the way deja-vu reads Windsurf: prompts and replies only."
   },
   terminal: {
     id: "terminal",
@@ -5096,13 +5096,13 @@ function categorizeTrace(trace) {
     };
   }
   if (paths.length > 0) {
-    if (paths.every((path21) => matchesAny(path21, DOC_PATTERNS))) {
+    if (paths.every((path22) => matchesAny(path22, DOC_PATTERNS))) {
       return { category: "docs", evidence: [`all ${paths.length} touched path(s) are documentation`, ...paths.slice(0, 3)] };
     }
-    if (paths.every((path21) => matchesAny(path21, TEST_PATTERNS))) {
+    if (paths.every((path22) => matchesAny(path22, TEST_PATTERNS))) {
       return { category: "tests", evidence: [`all ${paths.length} touched path(s) are tests`, ...paths.slice(0, 3)] };
     }
-    if (paths.every((path21) => matchesAny(path21, INFRA_PATTERNS))) {
+    if (paths.every((path22) => matchesAny(path22, INFRA_PATTERNS))) {
       return { category: "infra", evidence: [`all ${paths.length} touched path(s) are build/CI/deploy config`, ...paths.slice(0, 3)] };
     }
   }
@@ -6047,50 +6047,417 @@ function buildTrace(input) {
 }
 
 // src/adapters/antigravity.ts
+import crypto from "node:crypto";
 import fs3 from "node:fs";
 import os2 from "node:os";
 import path3 from "node:path";
-function candidateStateDirs(env = process.env) {
-  const home = os2.homedir();
-  const dirs = [];
-  if (process.platform === "win32") {
-    const appData = env.APPDATA ?? path3.join(home, "AppData", "Roaming");
-    dirs.push(path3.join(appData, "Antigravity", "User"));
-    dirs.push(path3.join(appData, "Google", "Antigravity", "User"));
-  } else if (process.platform === "darwin") {
-    dirs.push(path3.join(home, "Library", "Application Support", "Antigravity", "User"));
-    dirs.push(path3.join(home, "Library", "Application Support", "Google", "Antigravity", "User"));
-  } else {
-    dirs.push(path3.join(home, ".config", "Antigravity", "User"));
-    dirs.push(path3.join(home, ".config", "Google", "Antigravity", "User"));
+import { fileURLToPath } from "node:url";
+var ANTIGRAVITY_ADAPTER_VERSION = 2;
+var KEY = Buffer.from("safeCodeiumworldKeYsecretBalloon");
+var NONCE = 12;
+var TAG = 16;
+var CONVERSATION = /[\\/]\.gemini[\\/]antigravity[^\\/]*[\\/]conversations[\\/][^\\/]+\.pb$/i;
+var TRANSCRIPT = /[\\/]\.gemini[\\/]antigravity[^\\/]*[\\/]brain[\\/][^\\/]+[\\/]\.system_generated[\\/]logs[\\/]transcript\.jsonl$/i;
+var PB_VARINT = 0;
+var PB_FIXED64 = 1;
+var PB_BYTES = 2;
+var PB_FIXED32 = 5;
+var Malformed = class extends Error {
+};
+function varint(b, at) {
+  let value = 0n;
+  let shift = 0n;
+  for (let i = at; i < b.length && shift <= 63n; i++) {
+    const byte = b[i];
+    value |= BigInt(byte & 127) << shift;
+    shift += 7n;
+    if ((byte & 128) === 0) return [value, i + 1];
+  }
+  throw new Malformed("malformed protobuf");
+}
+function pbFields(b) {
+  const out = [];
+  let i = 0;
+  while (i < b.length) {
+    const [key, afterKey] = varint(b, i);
+    i = afterKey;
+    const num2 = Number(key >> 3n);
+    const wire = Number(key & 7n);
+    if (num2 === 0) throw new Malformed("malformed protobuf");
+    let value = 0n;
+    let data = Buffer.alloc(0);
+    if (wire === PB_VARINT) {
+      [value, i] = varint(b, i);
+    } else if (wire === PB_FIXED64) {
+      if (i + 8 > b.length) throw new Malformed("malformed protobuf");
+      value = b.readBigUInt64LE(i);
+      i += 8;
+    } else if (wire === PB_FIXED32) {
+      if (i + 4 > b.length) throw new Malformed("malformed protobuf");
+      value = BigInt(b.readUInt32LE(i));
+      i += 4;
+    } else if (wire === PB_BYTES) {
+      const [length, afterLength] = varint(b, i);
+      if (length > BigInt(b.length - afterLength)) throw new Malformed("malformed protobuf");
+      data = b.subarray(afterLength, afterLength + Number(length));
+      i = afterLength + Number(length);
+    } else {
+      throw new Malformed("malformed protobuf");
+    }
+    out.push({ num: num2, wire, value, data });
+  }
+  return out;
+}
+function bytesField(fields, num2) {
+  return fields.find((f) => f.num === num2 && f.wire === PB_BYTES)?.data;
+}
+function pbString(b) {
+  return b === void 0 ? "" : b.toString("utf8").replaceAll("\0", "");
+}
+function pbTimestamp(b) {
+  if (b === void 0) return void 0;
+  let seconds = 0n;
+  let nanos = 0n;
+  for (const f of pbFields(b)) {
+    if (f.wire !== PB_VARINT) continue;
+    if (f.num === 1) seconds = BigInt.asIntN(64, f.value);
+    if (f.num === 2) nanos = BigInt.asIntN(32, f.value);
+  }
+  if (seconds === 0n && nanos === 0n) return void 0;
+  const ms = Number(seconds) * 1e3 + Math.floor(Number(nanos) / 1e6);
+  const date = new Date(ms);
+  return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+function openConversation(b) {
+  if (b.length < NONCE + TAG) return null;
+  try {
+    const decipher = crypto.createDecipheriv("aes-256-gcm", KEY, b.subarray(0, NONCE));
+    decipher.setAuthTag(b.subarray(b.length - TAG));
+    return Buffer.concat([decipher.update(b.subarray(NONCE, b.length - TAG)), decipher.final()]);
+  } catch {
+    return null;
+  }
+}
+function folderPath(uri) {
+  if (!uri.startsWith("file:")) return void 0;
+  try {
+    return fileURLToPath(uri);
+  } catch {
+    try {
+      return decodeURIComponent(new URL(uri).pathname) || void 0;
+    } catch {
+      return void 0;
+    }
+  }
+}
+function workspaceOf(metadata) {
+  if (metadata === void 0) return void 0;
+  for (const f of pbFields(metadata)) {
+    if (f.num !== 1 || f.wire !== PB_BYTES) continue;
+    const folder = folderPath(pbString(bytesField(pbFields(f.data), 1)));
+    if (folder !== void 0) return folder;
+  }
+  return void 0;
+}
+function tally(counts, key) {
+  counts.set(key, (counts.get(key) ?? 0) + 1);
+}
+function decodeTrajectory2(plain) {
+  const events = [];
+  const unread = /* @__PURE__ */ new Map();
+  let sessionId;
+  let cwd;
+  let steps = 0;
+  let clock;
+  for (const f of pbFields(plain)) {
+    if (f.wire === PB_BYTES && f.num === 6) {
+      sessionId = pbString(f.data) || sessionId;
+      continue;
+    }
+    if (f.wire === PB_BYTES && f.num === 7) {
+      cwd ??= workspaceOf(f.data);
+      clock ??= pbTimestamp(bytesField(pbFields(f.data), 2));
+      continue;
+    }
+    if (f.wire !== PB_BYTES || f.num !== 2) {
+      tally(unread, `trajectory field ${f.num}`);
+      continue;
+    }
+    steps++;
+    const step = pbFields(f.data);
+    const metadata = bytesField(step, 5);
+    const metaFields = metadata === void 0 ? [] : pbFields(metadata);
+    clock = pbTimestamp(bytesField(metaFields, 1)) ?? clock;
+    const completed = pbTimestamp(bytesField(metaFields, 8));
+    for (const s of step) {
+      if (s.num !== 5 && s.num !== 19 && s.num !== 20) tally(unread, `step field ${s.num}`);
+    }
+    const input = bytesField(step, 19);
+    if (input !== void 0) {
+      const fields = pbFields(input);
+      const text2 = pbString(bytesField(fields, 2)).trim() || pbString(bytesField(fields, 1)).trim();
+      if (text2) events.push({ kind: "prompt", ...clock ? { timestamp: clock } : {}, text: text2 });
+    }
+    const planner = bytesField(step, 20);
+    if (planner !== void 0) {
+      const fields = pbFields(planner);
+      const text2 = pbString(bytesField(fields, 1)).trim() || pbString(bytesField(fields, 8)).trim();
+      if (bytesField(fields, 3) !== void 0) tally(unread, "planner thinking");
+      const at = completed ?? clock;
+      if (text2) events.push({ kind: "text", ...at ? { timestamp: at } : {}, text: text2 });
+    }
+  }
+  if (cwd !== void 0 || sessionId !== void 0) {
+    events.unshift({ kind: "meta", ...sessionId ? { sessionId } : {}, ...cwd ? { cwd } : {} });
+  }
+  return { events, ...sessionId ? { sessionId } : {}, steps, unread };
+}
+function homeOf(env) {
+  return (process.platform === "win32" ? env.USERPROFILE : env.HOME) || os2.homedir();
+}
+var USER_BLOCKS = [/<ADDITIONAL_METADATA>[\s\S]*?<\/ADDITIONAL_METADATA>/g, /<USER_SETTINGS_CHANGE>[\s\S]*?<\/USER_SETTINGS_CHANGE>/g];
+var ARTIFACT_COMMENT = /^Comments on artifact URI:.*$|^The user has (?:approved|rejected) this document\.$/gm;
+var REQUEST_TAG = /[ \t]*\n?\s*<\/?USER_REQUEST>\s*/g;
+function cleanUserContent(text2) {
+  let out = text2;
+  for (const block of USER_BLOCKS) out = out.replace(block, "");
+  out = out.replace(ARTIFACT_COMMENT, "");
+  return out.replace(REQUEST_TAG, "\n").trim();
+}
+function decodeArg(value) {
+  if (typeof value !== "string" || !value.startsWith('"')) return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeTranscript(text2) {
+  const events = [];
+  const unread = /* @__PURE__ */ new Map();
+  let cwd;
+  let steps = 0;
+  let line = 0;
+  for (const raw of text2.replace(/\r\n/g, "\n").split("\n")) {
+    line++;
+    if (raw.trim() === "") continue;
+    let record;
+    try {
+      record = JSON.parse(raw);
+    } catch {
+      tally(unread, "malformed line");
+      continue;
+    }
+    if (!isRecord(record)) {
+      tally(unread, "malformed line");
+      continue;
+    }
+    steps++;
+    const source = typeof record["source"] === "string" ? record["source"] : "";
+    const type = typeof record["type"] === "string" ? record["type"] : "";
+    const content = typeof record["content"] === "string" ? record["content"] : "";
+    const created = typeof record["created_at"] === "string" && !Number.isNaN(Date.parse(record["created_at"])) ? record["created_at"] : void 0;
+    const at = created ? { timestamp: created } : {};
+    if (source === "USER_EXPLICIT") {
+      const prompt2 = cleanUserContent(content);
+      if (prompt2) events.push({ kind: "prompt", ...at, text: prompt2 });
+      continue;
+    }
+    if (source !== "MODEL") {
+      tally(unread, type ? `${source || "no"} source, type ${type}` : `${source || "no"} source`);
+      continue;
+    }
+    if (type !== "" && type !== "PLANNER_RESPONSE") {
+      tally(unread, `tool step ${type}`);
+      continue;
+    }
+    if (content.trim()) events.push({ kind: "text", ...at, text: content.trim() });
+    const calls = Array.isArray(record["tool_calls"]) ? record["tool_calls"] : [];
+    calls.forEach((call, k) => {
+      if (!isRecord(call) || typeof call["name"] !== "string") return;
+      const args = {};
+      if (isRecord(call["args"])) for (const [key, value] of Object.entries(call["args"])) args[key] = decodeArg(value);
+      if (cwd === void 0 && call["name"] === "run_command" && typeof args["Cwd"] === "string" && args["Cwd"]) cwd = args["Cwd"];
+      const step = typeof record["step_index"] === "number" ? record["step_index"] : `line${line}`;
+      events.push({ kind: "tool_call", ...at, id: `${step}.${k}`, name: call["name"], input: args });
+    });
   }
-  return dirs;
+  if (cwd !== void 0) events.unshift({ kind: "meta", cwd });
+  return { events, steps, unread };
+}
+function transcriptId(file) {
+  return path3.basename(path3.dirname(path3.dirname(path3.dirname(file))));
+}
+function listConversations(env = process.env) {
+  const gemini = path3.join(homeOf(env), ".gemini");
+  let roots;
+  try {
+    roots = fs3.readdirSync(gemini).filter((name) => /^antigravity/i.test(name));
+  } catch {
+    return [];
+  }
+  const statFile = (file) => {
+    try {
+      const stat = fs3.statSync(file);
+      return stat.isFile() ? stat : null;
+    } catch {
+      return null;
+    }
+  };
+  const readNames = (dir) => {
+    try {
+      return fs3.readdirSync(dir);
+    } catch {
+      return [];
+    }
+  };
+  const pb = /* @__PURE__ */ new Map();
+  const transcripts = /* @__PURE__ */ new Map();
+  for (const root of roots) {
+    const conversations = path3.join(gemini, root, "conversations");
+    for (const name of readNames(conversations)) {
+      if (!name.toLowerCase().endsWith(".pb")) continue;
+      const file = path3.join(conversations, name);
+      const stat = statFile(file);
+      if (stat === null) continue;
+      const id = name.slice(0, -".pb".length).toLowerCase();
+      const kept = pb.get(id);
+      if (kept === void 0 || stat.size > kept.size) pb.set(id, { file, mtime: stat.mtimeMs, size: stat.size });
+    }
+    const brain = path3.join(gemini, root, "brain");
+    for (const name of readNames(brain)) {
+      const file = path3.join(brain, name, ".system_generated", "logs", "transcript.jsonl");
+      const stat = statFile(file);
+      if (stat === null) continue;
+      const id = name.toLowerCase();
+      const kept = transcripts.get(id);
+      if (kept === void 0 || stat.size > kept.size) transcripts.set(id, { file, mtime: stat.mtimeMs, size: stat.size });
+    }
+  }
+  for (const id of transcripts.keys()) pb.delete(id);
+  return [...pb.values(), ...transcripts.values()].sort((a, b) => b.mtime - a.mtime).map((entry) => entry.file);
+}
+var REFUSAL_TEST = "A6";
+async function readTranscript(file) {
+  const trajectory = decodeTranscript(await fs3.promises.readFile(file, "utf8"));
+  const id = transcriptId(file);
+  const said = trajectory.events.filter((e) => e.kind === "prompt" || e.kind === "text").length;
+  if (said === 0) {
+    return {
+      refused: true,
+      reason: `${id}'s transcript has ${trajectory.steps} record(s) and no prompt or reply this reader knows.`,
+      humanTest: REFUSAL_TEST
+    };
+  }
+  return {
+    events: trajectory.events,
+    capabilities: { tokens: "unavailable", filesChanged: "unavailable" },
+    sessionId: id,
+    unreadFields: [...trajectory.unread].sort((a, b) => b[1] - a[1]).map(([field, count]) => `${field} x${count}`),
+    notes: [
+      `${trajectory.steps} record(s), ${said} prompt/reply event(s)`,
+      "tool steps' bodies and checkpoints are not read; tool calls come from the planner's tool_calls",
+      "CONFIDENCE: documented (deja-vu's transcript reader, measured on app 2.24.0). See HUMAN-TESTS.md A6."
+    ]
+  };
 }
 var antigravityAdapter = {
   id: "antigravity",
-  version: 0,
+  version: ANTIGRAVITY_ADAPTER_VERSION,
   async detect(input) {
-    void input;
-    return { score: 0, reason: "Antigravity's log format is unknown; this adapter cannot claim a file" };
+    if (CONVERSATION.test(input.path)) {
+      return { score: 85, reason: "a conversations/<id>.pb under ~/.gemini/antigravity" };
+    }
+    if (TRANSCRIPT.test(input.path)) {
+      return { score: 85, reason: "a brain/<id>/.system_generated/logs/transcript.jsonl under ~/.gemini/antigravity" };
+    }
+    return { score: 0, reason: "not an Antigravity conversations/<id>.pb or brain transcript" };
   },
   async read(input) {
-    void input;
+    if (input.path.toLowerCase().endsWith(".jsonl")) return readTranscript(input.path);
+    const plain = openConversation(await fs3.promises.readFile(input.path));
+    if (plain === null) {
+      return {
+        refused: true,
+        reason: `${path3.basename(input.path)} did not authenticate with the key Antigravity IDE 1.23.2 uses. A newer build may have changed the envelope; report its version via HUMAN-TESTS.md A6.`,
+        humanTest: REFUSAL_TEST
+      };
+    }
+    let trajectory;
+    try {
+      trajectory = decodeTrajectory2(plain);
+    } catch (error) {
+      if (!(error instanceof Malformed)) throw error;
+      return {
+        refused: true,
+        reason: `${path3.basename(input.path)} authenticated but is not the trajectory protobuf this reader knows.`,
+        humanTest: REFUSAL_TEST
+      };
+    }
+    const said = trajectory.events.filter((e) => e.kind === "prompt" || e.kind === "text").length;
+    if (said === 0) {
+      return {
+        refused: true,
+        reason: `${path3.basename(input.path)} has ${trajectory.steps} step(s) and no prompt or reply in the fields this reader knows.`,
+        humanTest: REFUSAL_TEST
+      };
+    }
+    const unreadFields = [...trajectory.unread].sort((a, b) => b[1] - a[1]).map(([field, count]) => `${field} x${count}`);
     return {
-      refused: true,
-      reason: "Antigravity's session format has never been observed. Writing a parser from no information would produce a plausible but fictional timeline. Send a sample session (see HUMAN-TESTS.md A6).",
-      humanTest: "A6"
+      events: trajectory.events,
+      capabilities: { tokens: "unavailable", filesChanged: "unavailable" },
+      sessionId: trajectory.sessionId ?? path3.basename(input.path, ".pb"),
+      unreadFields,
+      notes: [
+        `${trajectory.steps} step(s), ${said} prompt/reply event(s)`,
+        "tool calls, thinking and edits are not read: their step fields are undocumented",
+        "CONFIDENCE: documented (Windsurf's schema, measured on IDE 1.23.2). See HUMAN-TESTS.md A6."
+      ]
     };
   },
   discover(env) {
-    return candidateStateDirs(env).filter((dir) => fs3.existsSync(dir));
+    return listConversations(env);
   },
-  async describe() {
-    const lines2 = ["Antigravity support is a stub. It detects an install and refuses to parse."];
-    for (const dir of candidateStateDirs()) {
-      lines2.push(`  ${fs3.existsSync(dir) ? "FOUND  " : "absent "} ${dir}`);
+  async describe(input) {
+    const files = input ? [input.path] : listConversations();
+    const lines2 = [`conversations found: ${files.length}`];
+    for (const file of files.slice(0, 8)) lines2.push(`  ${file}`);
+    const target = files[0];
+    if (target === void 0) return lines2;
+    lines2.push("", `inspecting ${target}`);
+    if (target.toLowerCase().endsWith(".jsonl")) {
+      try {
+        const trajectory = decodeTranscript(await fs3.promises.readFile(target, "utf8"));
+        lines2.push(`  records: ${trajectory.steps}, events: ${trajectory.events.filter((e) => e.kind !== "meta").length}`);
+        for (const [field, count] of [...trajectory.unread].sort((a, b) => b[1] - a[1]).slice(0, 15)) {
+          lines2.push(`    ${String(count).padStart(6)}  ${field}`);
+        }
+      } catch (error) {
+        lines2.push(`  unreadable: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      return lines2;
+    }
+    let plain;
+    try {
+      plain = openConversation(await fs3.promises.readFile(target));
+    } catch (error) {
+      lines2.push(`  unreadable: ${error instanceof Error ? error.message : String(error)}`);
+      return lines2;
+    }
+    lines2.push(`  authenticated: ${plain === null ? "no" : "yes"}`);
+    if (plain === null) return lines2;
+    try {
+      const trajectory = decodeTrajectory2(plain);
+      lines2.push(`  steps: ${trajectory.steps}, prompt/reply events: ${trajectory.events.filter((e) => e.kind !== "meta").length}`);
+      for (const [field, count] of [...trajectory.unread].sort((a, b) => b[1] - a[1]).slice(0, 15)) {
+        lines2.push(`    ${String(count).padStart(6)}  ${field}`);
+      }
+    } catch {
+      lines2.push("  not the trajectory protobuf this reader knows");
     }
-    lines2.push("");
-    lines2.push("If one is FOUND, HUMAN-TESTS.md A6 lists exactly what to report back.");
     return lines2;
   }
 };
@@ -8752,7 +9119,7 @@ function withLineage(trace, lineage, prUrl) {
 }
 
 // src/auth.ts
-import crypto from "node:crypto";
+import crypto2 from "node:crypto";
 import fs15 from "node:fs";
 import os6 from "node:os";
 import path14 from "node:path";
@@ -8782,7 +9149,7 @@ function isAuthFailure(value) {
   return typeof value === "object" && value !== null && "ok" in value && value.ok === false;
 }
 function hashSecret(secret) {
-  return crypto.createHash("sha256").update(secret).digest("hex");
+  return crypto2.createHash("sha256").update(secret).digest("hex");
 }
 function apiUrlFrom(env = process.env) {
   const explicit = env["FLATBREAD_API_URL"]?.trim();
@@ -8795,7 +9162,7 @@ async function startCliLogin(options = {}) {
   const apiUrl = options.apiUrl ?? apiUrlFrom(env);
   const base = validateApiUrl(apiUrl);
   if (isAuthFailure(base)) return base;
-  const pollSecret = crypto.randomBytes(32).toString("hex");
+  const pollSecret = crypto2.randomBytes(32).toString("hex");
   const result = await postJson(
     `${base}/api/cli-login/start`,
     { poll_secret_hash: hashSecret(pollSecret) },
@@ -9586,67 +9953,105 @@ function renderMarked(value, matches) {
   return html;
 }
 var STYLE = `
-:root{--bg:#0f1115;--panel:#161a22;--line:#232936;--fg:#e6e9ef;--dim:#8b93a7;--hit:#3a2a12;--hitline:#c8892b;--ok:#2f9e63;--warn:#c85a54;--acc:#5b8def}
+:root{
+--canvas:#fafafa;--bg:#ffffff;--ivory:#fcfbf8;--surface:#f6f7f8;--inset:#f6f7f8;
+--line:rgba(226,232,240,.8);--line-soft:#eff0f2;--line-strong:#b9bec4;
+--fg:#23272c;--fg-2:rgba(35,39,44,.7);--fg-3:rgba(35,39,44,.56);--fg-lift:#2b3138;
+--fail-bg:#f6ece7;--fail-line:#c9755c;--fail-fg:#8a3b2a;
+--ok-bg:#eef1e8;--ok-line:#7f9a7a;--ok-fg:#3f5d43;
+--hold-bg:#f7f1e2;--hold-line:#c9a34a;--hold-fg:#7d601d;
+--intent-line:#d6d1c1;
+--shade:30,41,54;
+--shadow:0 1px 2px rgba(var(--shade),.04),0 10px 26px rgba(var(--shade),.08);
+--radius:10px;--radius-sm:6px;
+--sans:-apple-system,BlinkMacSystemFont,"Segoe UI Variable Text","Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;
+--mono:ui-monospace,"SF Mono",SFMono-Regular,"Cascadia Mono","Segoe UI Mono","Roboto Mono",Menlo,Consolas,"Liberation Mono",monospace
+}
 *{box-sizing:border-box}
-body{margin:0;background:var(--bg);color:var(--fg);font:14px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace}
-header{position:sticky;top:0;z-index:5;background:var(--panel);border-bottom:1px solid var(--line);padding:14px 20px}
-h1{margin:0 0 6px;font-size:16px;font-weight:600;letter-spacing:.01em}
-.meta{color:var(--dim);font-size:12px}
+html,body{margin:0}
+body{background:var(--canvas);color:var(--fg);font:14px/1.55 var(--sans);-webkit-font-smoothing:antialiased}
+code,pre,dd,.mono{font-family:var(--mono)}
+header{background:var(--bg);border-bottom:1px solid var(--line-soft)}
+.hin{max-width:1440px;margin:0 auto;padding:14px 28px 16px}
+.bar{display:flex;align-items:center;gap:10px;margin:0 0 12px}
+.wordmark{display:inline-flex;align-items:center;height:28px;padding:0 12px;border-radius:999px;background:var(--ivory);border:1px solid rgba(var(--shade),.08);box-shadow:inset 0 1px 0 #fff,0 1px 2px rgba(var(--shade),.05);font:600 13.5px/1 var(--mono);letter-spacing:-.01em;font-variant-ligatures:none}
+.crumb{color:var(--fg-3);font-size:12.5px}
+h1{margin:0 0 6px;font-size:20px;line-height:1.3;font-weight:600;letter-spacing:-.01em}
+.meta{color:var(--fg-3);font-size:12.5px;font-variant-numeric:tabular-nums}
 .meta b{color:var(--fg);font-weight:600}
-.wrap{display:grid;grid-template-columns:minmax(0,1fr) 380px;gap:0;align-items:start}
-main{padding:18px 20px 120px;min-width:0}
-aside{position:sticky;top:74px;max-height:calc(100vh - 74px);overflow:auto;border-left:1px solid var(--line);padding:16px;background:var(--panel)}
-.step{border:1px solid var(--line);border-radius:6px;margin:0 0 12px;background:var(--panel)}
-.step>.head{display:flex;gap:10px;align-items:center;padding:8px 12px;border-bottom:1px solid var(--line);font-size:12px;color:var(--dim)}
-.badge{border:1px solid var(--line);border-radius:999px;padding:1px 9px;color:var(--fg);font-size:11px}
-.badge.user_prompt{border-color:#3f6fd8;color:#9dbcff}
-.badge.assistant_text{border-color:#3f8f6f;color:#8fe0bb}
-.badge.assistant_thinking{border-color:#6a5acd;color:#c0b6ff}
-.badge.tool_call{border-color:#b08a2e;color:#ffd98a}
-.badge.tool_result{border-color:#4a5568;color:#c3cbdc}
-.badge.error_recovery{border-color:#c85a54;color:#ff9e99}
-pre{margin:0;padding:10px 12px;white-space:pre-wrap;word-break:break-word;font:inherit}
-.sub{padding:6px 12px;border-top:1px solid var(--line);color:var(--dim);font-size:11px;text-transform:uppercase;letter-spacing:.06em}
-dl{margin:0;padding:2px 12px 10px}
-dt{color:var(--dim);font-size:12px;margin-top:8px}
-dd{margin:2px 0 0;white-space:pre-wrap;word-break:break-word}
-mark.hit{background:var(--hit);color:#ffd98a;border-bottom:1px solid var(--hitline);border-radius:2px;padding:0 2px}
+.meta.path{font-family:var(--mono);font-size:11.5px;margin-top:2px;word-break:break-all}
+.wrap{max-width:1440px;margin:0 auto;padding:20px 28px 120px;display:grid;grid-template-columns:minmax(0,1fr) 360px;gap:24px;align-items:start}
+main{min-width:0}
+aside{position:sticky;top:16px;max-height:calc(100vh - 32px);overflow:auto;background:var(--bg);border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow);padding:18px}
+.step{background:var(--bg);border:1px solid var(--line);border-radius:var(--radius);box-shadow:0 1px 2px rgba(var(--shade),.04);margin:0 0 10px;overflow:hidden}
+.step>.head{display:flex;gap:10px;align-items:baseline;padding:9px 14px 0;font-size:12px;color:var(--fg-3);font-variant-numeric:tabular-nums}
+.badge{font-weight:600;color:var(--fg-2);font-size:12px}
+.step.user_prompt{border-left:3px solid var(--intent-line)}
+.step.error_recovery{border-color:color-mix(in srgb,var(--fail-line) 45%,transparent);border-left:3px solid var(--fail-line)}
+.badge.error_recovery,.sub.err{color:var(--fail-fg)}
+pre{margin:0;padding:8px 14px 12px;white-space:pre-wrap;word-break:break-word;font:12.5px/1.6 var(--mono);color:var(--fg)}
+.step.user_prompt>pre,.step.assistant_text>pre{font:14px/1.6 var(--sans)}
+.sub{padding:8px 14px 0;border-top:1px solid var(--line-soft);color:var(--fg-3);font-size:11px;text-transform:uppercase;letter-spacing:.06em}
+.sub+pre,.sub+dl{background:var(--inset);margin:8px 14px 12px;padding:10px 12px;border-radius:var(--radius-sm)}
+dl{margin:0;padding:4px 14px 12px}
+dt{color:var(--fg-3);font-size:11.5px;margin-top:8px}
+dd{margin:2px 0 0;white-space:pre-wrap;word-break:break-word;font-size:12.5px}
+#trace-meta dd{font-family:var(--sans);font-size:13.5px}
+mark.hit{background:rgba(var(--shade),.08);box-shadow:inset 0 1px 1px rgba(var(--shade),.08);color:var(--fg-2);border-radius:4px;padding:0 4px;font-family:var(--mono);font-size:.9em}
 mark.hit .was{display:none}
-mark.hit.keep{background:transparent;color:inherit;border-bottom:1px dashed var(--warn)}
+mark.hit.keep{background:var(--hold-bg);box-shadow:none;color:var(--fg);border-bottom:1px dashed var(--hold-line);border-radius:2px;font-family:inherit;font-size:inherit}
 mark.hit.keep .tok{display:none}
 mark.hit.keep .was{display:inline}
-aside h2{margin:0 0 4px;font-size:13px}
-aside .note{color:var(--dim);font-size:12px;margin:0 0 12px}
-.row{display:grid;grid-template-columns:16px 58px minmax(0,1fr);gap:8px;align-items:start;padding:7px 8px;border:1px solid var(--line);border-radius:5px;margin-bottom:6px;cursor:pointer}
-.row:hover{border-color:var(--acc)}
-.row input{margin:3px 0 0}
-.state{font-size:11px;letter-spacing:.04em}
-.s-keep{display:none;color:var(--warn)}
-.s-red{color:var(--ok)}
-.row input:checked ~ .state .s-red{display:none}
-.row input:checked ~ .state .s-keep{display:inline}
-.row .rule{font-size:12px}
-.row .prev{color:var(--dim);font-size:11px;word-break:break-all}
-.row .times{color:var(--warn)}
-.keys{color:var(--dim);font-size:11px;margin:0 0 10px}
-.keys b{color:var(--fg);font-weight:600}
-.row .path{color:#5c6474;font-size:10px;word-break:break-all}
-fieldset{border:1px solid var(--line);border-radius:6px;margin:0 0 12px;padding:8px 10px}
-input.title{box-sizing:border-box;width:100%;font:inherit;padding:6px 8px;margin:4px 0 6px;border:1px solid var(--line);border-radius:5px;background:var(--bg);color:var(--fg)}
-input.title:focus{outline:none;border-color:var(--acc)}
-legend{color:var(--dim);font-size:11px;text-transform:uppercase;letter-spacing:.06em}
-label.vis{display:block;padding:3px 0}
-.warn{color:var(--warn);font-size:11px;margin:4px 0 0}
-.actions{display:flex;gap:8px;margin-top:10px}
-button{font:inherit;padding:9px 14px;border-radius:5px;border:1px solid var(--line);background:#1d2430;color:var(--fg);cursor:pointer}
-button.primary{background:var(--ok);border-color:var(--ok);color:#04140b;font-weight:600}
-button:hover{border-color:var(--acc)}
+aside h2{margin:0 0 4px;font-size:15px;font-weight:600}
+aside .note{color:var(--fg-3);font-size:12.5px;margin:0 0 12px}
+aside .note code{font-size:11.5px;background:var(--inset);padding:1px 4px;border-radius:4px}
 .tools{display:flex;gap:6px;margin:0 0 10px}
-.tools button{padding:4px 8px;font-size:11px}
-.done{max-width:760px;margin:12vh auto;padding:0 20px}
-.done code{display:block;background:var(--panel);border:1px solid var(--line);border-radius:6px;padding:12px;margin:12px 0;word-break:break-all}
-a{color:var(--acc)}
+.keys{color:var(--fg-3);font-size:12px;margin:0 0 14px}
+.keys b{display:inline-block;min-width:18px;padding:0 5px;border:1px solid rgba(var(--shade),.12);border-radius:999px;background:var(--bg);color:var(--fg);font:600 11px/16px var(--mono);text-align:center}
+fieldset{border:0;border-top:1px solid var(--line-soft);margin:0;padding:14px 0 12px}
+legend{float:left;width:100%;padding:0;margin:0 0 6px;color:var(--fg-3);font-size:11px;text-transform:uppercase;letter-spacing:.06em}
+legend+*{clear:left}
+input.title{width:100%;font:inherit;padding:8px 10px;margin:0 0 6px;border:1px solid rgba(var(--shade),.12);border-radius:var(--radius-sm);background:var(--ivory);color:var(--fg);box-shadow:inset 0 1px 0 #fff}
+input.title:focus{outline:none;background:#fff;border-color:var(--fg-3);box-shadow:0 0 0 3px rgba(var(--shade),.05)}
+label.vis{display:flex;align-items:center;gap:8px;padding:3px 0;cursor:pointer}
+input[type=radio],input[type=checkbox]{accent-color:var(--fg);margin:0}
+.warn{color:var(--fail-fg);font-size:12.5px;margin:6px 0 0}
+.actions{display:flex;gap:8px;padding:14px 0 16px;border-top:1px solid var(--line-soft)}
+button{display:inline-flex;align-items:center;font:500 12.5px/1 var(--sans);padding:9px 14px;border-radius:var(--radius-sm);border:1px solid var(--line-strong);background:var(--bg);color:var(--fg);cursor:pointer}
+button:hover{background:var(--surface)}
+button:focus-visible{outline:2px solid var(--fg);outline-offset:1px}
+button.primary{background:var(--fg);border-color:var(--fg);color:#fff}
+button.primary:hover{background:var(--fg-lift);border-color:var(--fg-lift)}
+.tools button{padding:5px 10px;font-size:12px}
+.row{display:grid;grid-template-columns:16px 52px minmax(0,1fr);gap:8px;align-items:start;padding:9px 10px;border:1px solid var(--line);border-radius:var(--radius-sm);margin-bottom:6px;cursor:pointer;background:var(--bg)}
+.row:hover{background:var(--surface)}
+.row:focus-within{border-color:var(--fg-3)}
+.row input{margin:3px 0 0}
+.state{font-size:11.5px;font-weight:600}
+.s-red{color:var(--fg-3)}
+.s-keep{display:none;color:var(--hold-fg)}
+.row input:checked~.state .s-red{display:none}
+.row input:checked~.state .s-keep{display:inline}
+.row:has(input:checked){background:var(--hold-bg);border-color:color-mix(in srgb,var(--hold-line) 50%,transparent)}
+.row .rule{font-size:13px;color:var(--fg)}
+.row .times{font-weight:600}
+.row .prev{color:var(--fg-2);font:11.5px/1.5 var(--mono);word-break:break-all}
+.row .path{color:var(--fg-3);font-size:11px;word-break:break-all}
+.done{max-width:620px;margin:14vh auto;padding:28px 30px;background:var(--bg);border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}
+.done h1{font-size:20px}
+.done .meta{font-size:13.5px;color:var(--fg-2);margin:10px 0 0}
+.done code{display:block;background:var(--inset);border-radius:var(--radius-sm);padding:12px 14px;margin:14px 0;font-size:12.5px;word-break:break-all}
+a{color:var(--fg);text-underline-offset:2px}
+@media (max-width:960px){.wrap{grid-template-columns:minmax(0,1fr);padding:16px}aside{position:static;max-height:none;order:-1}.hin{padding:12px 16px}}
 `;
+var STEP_LABEL = {
+  user_prompt: "prompt",
+  assistant_text: "assistant",
+  assistant_thinking: "thinking",
+  tool_call: "tool call",
+  tool_result: "tool result",
+  error_recovery: "failure"
+};
 var SCRIPT = `
 (function(){
   var boxes = Array.prototype.slice.call(document.querySelectorAll('input[name="keep"]'));
@@ -9753,14 +10158,14 @@ function renderReviewPage(input) {
     const base = `steps[${index}]`;
     const parts = [];
     parts.push(
-      `<div class="head"><span class="badge ${escapeHtml(step.type)}">${escapeHtml(step.type)}</span><span>#${step.stepNumber}</span><span>${escapeHtml(step.timestamp)}</span></div>`
+      `<div class="head"><span class="badge ${escapeHtml(step.type)}">${escapeHtml(STEP_LABEL[step.type] ?? step.type)}</span><span>#${step.stepNumber}</span><span>${escapeHtml(step.timestamp)}</span></div>`
     );
     parts.push(`<pre>${marked(`${base}.content`, step.content)}</pre>`);
     const tool = step.tool;
     if (tool) {
       const inputSlots = slots.filter((slot) => slot.fieldPath.startsWith(`${base}.tool.input`));
       parts.push(
-        `<div class="sub">tool ${escapeHtml(tool.name)}${tool.isError ? " &middot; errored" : ""}</div>`
+        `<div class="sub${tool.isError ? " err" : ""}">tool ${escapeHtml(tool.name)}${tool.isError ? " &middot; errored" : ""}</div>`
       );
       if (inputSlots.length > 0) {
         parts.push(
@@ -9780,7 +10185,7 @@ function renderReviewPage(input) {
         `<div class="sub">diff ${marked(`${base}.diff.filePath`, diff.filePath)}</div><pre>${marked(`${base}.diff.patch`, diff.patch)}</pre>`
       );
     }
-    return `<section class="step" id="${escapeHtml(base)}">${parts.join("")}</section>`;
+    return `<section class="step ${escapeHtml(step.type)}" id="${escapeHtml(base)}">${parts.join("")}</section>`;
   }).join("");
   const groups = groupMatches(matches);
   const rowsHtml = groups.length === 0 ? `<p class="note">No matches. Nothing will be rewritten.</p>` : groups.map((group) => {
@@ -9794,15 +10199,16 @@ function renderReviewPage(input) {
   const publicWarning = input.publishTo === void 0 ? "Visibility public: this draft records that choice, and the run becomes readable by anyone the moment it is uploaded. Continue?" : `Visibility public: confirming uploads this run to ${input.publishTo} where anyone with the link can read it. Continue?`;
   const destinationHtml = input.publishTo === void 0 ? `<p class="note">Local draft only. Confirm writes ${escapeHtml(input.draftPath ?? "a file in packages/cli/.tmp")} and nothing leaves this machine. The visibility above is stored in the draft. To upload a run, share it with <code>--publish</code> after <code>flatbread login</code>.</p>` : `<p class="warn">Confirm UPLOADS this run to ${escapeHtml(input.publishTo)} with the visibility selected above. Everything you KEEP below is uploaded as written.</p>`;
   const body = `
-<header>
+<header><div class="hin">
+  <div class="bar"><span class="wordmark">flatbread</span><span class="crumb">review before you share</span></div>
   <h1>${marked("title", trace.title)}</h1>
   <div class="meta">
-    <b>${escapeHtml(trace.model)}</b> &middot; ${trace.steps.length} steps &middot; ${toolCalls} tool calls &middot;
-    ${formatCount(trace.stats.filesChanged)} files changed &middot; ${trace.stats.errorCount} errors &middot;
-    ${Math.round(trace.stats.durationSeconds)}s &middot; <b>${matches.length}</b> redaction matches
+    <b>${escapeHtml(trace.model)}</b> &middot; ${plural2(trace.steps.length, "step")} &middot; ${plural2(toolCalls, "tool call")} &middot;
+    ${trace.stats.filesChanged === null ? `${formatCount(null)} files` : plural2(trace.stats.filesChanged, "file")} changed &middot; ${plural2(trace.stats.errorCount, "error")} &middot;
+    ${Math.round(trace.stats.durationSeconds)}s &middot; <b>${matches.length}</b> redaction match${matches.length === 1 ? "" : "es"}
   </div>
-  <div class="meta">${escapeHtml(sessionPath)}</div>
-</header>
+  <div class="meta path">${escapeHtml(sessionPath)}</div>
+</div></header>
 <form id="review" method="post" action="/confirm">
 <div class="wrap">
   <main>${metaHtml}${stepsHtml}</main>
@@ -9835,13 +10241,14 @@ function renderReviewPage(input) {
 <script>var PUBLIC_WARNING=${JSON.stringify(publicWarning)};${SCRIPT}</script>`;
   return page(`Flatbread review - ${trace.title}`, body);
 }
-function renderDonePage(message, outputPath, publishTo) {
+function renderDonePage(message, outputPath, publishTo, keepsRun = false) {
   const network = publishTo === void 0 ? `<p class="meta">Nothing was uploaded. This file is on your machine only.</p>` : `<p class="meta">Uploading this run to ${escapeHtml(publishTo)} now. Your terminal says whether it arrived, and prints its link.</p>`;
   return page(
     "Flatbread - share draft written",
     `<div class="done"><h1>${escapeHtml(message)}</h1>
      <code>${escapeHtml(outputPath)}</code>
      ${network}
+     ${keepsRun ? `<p class="meta">That file holds only your latest share, and the next one replaces it. This run is also kept under its own ID, printed in your terminal: <code>flatbread pull &lt;id&gt;</code> prints it again, and <code>flatbread search --local</code> lists every run you have shared.</p>` : ""}
      <p class="meta"><strong>Go back to your terminal now.</strong> The manage token for this
      run is printed there, once, at the very bottom. It is the only way to open the run
      while it is private, and only its hash is stored, so nothing can print it again.</p>
@@ -9882,12 +10289,11 @@ function parseDecisionBody(body) {
   };
 }
 async function listenOnFirstFreePort(server, ports) {
-  for (const port of ports) {
+  for (const port of [...ports, 0]) {
     const ok = await new Promise((resolve) => {
-      const onError = (error) => {
+      const onError = () => {
         server.removeListener("listening", onListening);
-        if (error.code === "EADDRINUSE" || error.code === "EACCES") resolve(false);
-        else resolve(false);
+        resolve(false);
       };
       const onListening = () => {
         server.removeListener("error", onError);
@@ -9966,7 +10372,7 @@ async function startReviewServer(options) {
             ...changed ? { title } : {}
           };
           const message = options.onConfirm ? await options.onConfirm(confirmed) : "";
-          send(200, renderDonePage("Share draft written", message, options.publishTo));
+          send(200, renderDonePage("Share draft written", message, options.publishTo, options.keepsRun === true));
           finish(confirmed);
         } catch (error) {
           send(500, page("Flatbread - error", `<div class="done"><h1>Could not write the share draft</h1><code>${escapeHtml(error instanceof Error ? error.message : String(error))}</code></div>`));
@@ -10120,6 +10526,7 @@ function reportPersist(outcome, options, log) {
   log(`  slug        ${outcome.slug}`);
   log(`  visibility  ${outcome.record.visibility}`);
   if (outcome.recordPath) log(`  record      ${outcome.recordPath}`);
+  log(`  again       flatbread pull ${outcome.slug}   (the next share replaces ${path15.basename(options.outputPath)}, not this record)`);
   log("");
   log(`open ${outcome.publish?.ok ? outcome.publish.url : `${base}/r/${outcome.slug}`}`);
   log("");
@@ -10228,6 +10635,7 @@ async function runShare(options) {
       sessionPath: target,
       draftPath: options.outputPath,
       titleDraft: previewTitle,
+      keepsRun: options.persist !== false && (options.storeDir ?? resolveStoreDir()) !== null,
       ...isPublisher(reviewPublisher) ? { publishTo: reviewPublisher.description } : {},
       ...options.ports ? { ports: options.ports } : {},
       ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
@@ -10241,9 +10649,9 @@ async function runShare(options) {
     });
     if (!session) {
       console.error(
-        `could not bind a review port (tried ${(options.ports ?? [4321, 4322, 4323, 4324, 4325]).join(", ")})`
+        `could not bind a review port on ${REVIEW_SERVER.host} (tried ${(options.ports ?? REVIEW_SERVER.ports).join(", ")}, then any port the OS would give)`
       );
-      console.error("Close whatever is using them, or run with --no-review.");
+      console.error("Loopback itself refused, so this machine needs a look; --no-review redacts everything without the page.");
       return { exitCode: 1, status: "port-unavailable" };
     }
     log(`  review at ${session.url}`);
@@ -10661,7 +11069,7 @@ function logCapture(dir, line, now = (/* @__PURE__ */ new Date()).toISOString())
 
 // src/mcp.ts
 var MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
-var MCP_SERVER_VERSION = "0.2.0";
+var MCP_SERVER_VERSION = "0.3.1";
 function defaultMcpDeps(storeDir2, bucketDir2) {
   return {
     storeDir: storeDir2,
@@ -10751,6 +11159,10 @@ async function searchEverywhere(query, deps, options = {}) {
     if (local.unreadable > 0) out.push(`(${local.unreadable} local record file${local.unreadable === 1 ? "" : "s"} could not be read)`);
   }
   const seen = new Set(localHits.map((hit) => hit.slug));
+  for (const record of local.records) {
+    const { harness, sessionId } = record.trace.source;
+    if (sessionId.length > 0 && localHits.some((hit) => hit.slug === record.slug)) seen.add(bucketSlug(harness, sessionId));
+  }
   if (deps.bucketDir !== null) {
     const bucket = readBucket(deps.bucketDir);
     const captured = bucket.rows.filter((row) => !seen.has(row.summary.slug) && matchesQuery(row.summary, query));
@@ -10784,18 +11196,24 @@ async function searchTool(args, deps) {
   const { lines: lines2 } = await searchEverywhere(query, deps);
   return text([...lines2, "", "Pass a run ID to flatbread_get_capsule for what that run learned."].join("\n"));
 }
+async function readCapsule(ref, deps) {
+  if (ref.site === void 0) {
+    const stored = localRecords(deps).records.find((record) => record.slug === ref.slug);
+    if (stored !== void 0) return { ok: true, capsule: buildCapsule(stored.trace), from: "store" };
+    const captured = deps.bucketDir !== null ? readBucketRecord(deps.bucketDir, ref.slug) : null;
+    if (captured !== null) return { ok: true, capsule: buildCapsule(captured.trace), from: "bucket" };
+  }
+  const remote = await deps.capsule(ref);
+  return remote.ok ? { ok: true, capsule: remote.capsule, from: "site" } : remote;
+}
 async function capsuleTool(args, deps) {
   const raw = args["slug"];
   if (typeof raw !== "string") return text("slug must be a run ID or a /r/<id> link", true);
   const ref = parseRunRef(raw);
   if (ref === null) return text(`"${raw}" is not a run ID or a /r/<id> link`, true);
-  if (ref.site === void 0) {
-    const local = localRecords(deps).records.find((record) => record.slug === ref.slug) ?? (deps.bucketDir !== null ? readBucketRecord(deps.bucketDir, ref.slug) : null);
-    if (local !== null && local !== void 0) return text(buildCapsule(local.trace));
-  }
-  const remote = await deps.capsule(ref);
-  if (remote.ok) return text(remote.capsule);
-  return text(describeReadFailure(remote, `capsule ${ref.slug}`), true);
+  const read2 = await readCapsule(ref, deps);
+  if (read2.ok) return text(read2.capsule);
+  return text(describeReadFailure(read2, `capsule ${ref.slug}`), true);
 }
 async function handleMcpMessage(message, deps) {
   if (typeof message !== "object" || message === null || Array.isArray(message)) {
@@ -10844,7 +11262,7 @@ async function handleMcpMessage(message, deps) {
 }
 async function runMcpServer(deps, io) {
   const input = io?.input ?? process.stdin;
-  const write = io?.write ?? ((line) => process.stdout.write(line));
+  const write2 = io?.write ?? ((line) => process.stdout.write(line));
   const log = io?.log ?? ((line) => process.stderr.write(`${line}
 `));
   log(`flatbread mcp ${MCP_SERVER_VERSION} on stdio${deps.storeDir === null ? " (no local store)" : ` (local store ${deps.storeDir})`}`);
@@ -10857,12 +11275,12 @@ async function runMcpServer(deps, io) {
       try {
         message = JSON.parse(line);
       } catch {
-        write(`${JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } })}
+        write2(`${JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } })}
 `);
         return;
       }
       const reply = await handleMcpMessage(message, deps);
-      if (reply !== null) write(`${JSON.stringify(reply)}
+      if (reply !== null) write2(`${JSON.stringify(reply)}
 `);
     });
   }
@@ -10870,9 +11288,134 @@ async function runMcpServer(deps, io) {
   return 0;
 }
 
-// src/git-hook.ts
+// src/claude-mcp.ts
 import fs19 from "node:fs";
+import os7 from "node:os";
 import path18 from "node:path";
+var MCP_SERVER_NAME = "flatbread";
+function claudeUserConfigPath(env = process.env) {
+  const dir = env["CLAUDE_CONFIG_DIR"]?.trim();
+  return path18.join(dir ? dir : os7.homedir(), ".claude.json");
+}
+function mcpEntryFor(execPath, entryPath) {
+  return { type: "stdio", command: execPath, args: [entryPath, "mcp"] };
+}
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function runsFlatbreadMcp(entry) {
+  if (!isObject(entry) || !Array.isArray(entry["args"])) return false;
+  const words = [entry["command"], ...entry["args"]].filter((word) => typeof word === "string");
+  return words[words.length - 1] === "mcp" && words.some((word) => /flatbread/i.test(word));
+}
+var BOM = "\uFEFF";
+function readConfig(file) {
+  let raw;
+  try {
+    raw = fs19.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return { root: {}, raw: null };
+    return { problem: error.message };
+  }
+  const text2 = raw.startsWith(BOM) ? raw.slice(1) : raw;
+  if (text2.trim() === "") return { root: {}, raw };
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch (error) {
+    return { problem: `not JSON (${error.message})` };
+  }
+  if (!isObject(parsed)) return { problem: "not a JSON object" };
+  if (parsed["mcpServers"] !== void 0 && !isObject(parsed["mcpServers"])) return { problem: "its mcpServers is not an object" };
+  return { root: parsed, raw };
+}
+function serializeLike(raw, root) {
+  let body = JSON.stringify(root, null, 2);
+  if (raw === null || raw.trimEnd() !== raw || raw.trim() === "") body += "\n";
+  if (raw !== null && raw.includes("\r\n")) body = body.replace(/\n/g, "\r\n");
+  if (raw !== null && raw.startsWith(BOM)) body = BOM + body;
+  return body;
+}
+function write(file, read2, next) {
+  if (read2.raw !== null) {
+    try {
+      fs19.accessSync(file, fs19.constants.W_OK);
+    } catch {
+      return `${file} is read-only, so it was left as it was`;
+    }
+    if (fs19.readFileSync(file, "utf8") !== read2.raw) return `${file} changed while setup ran (Claude Code writes it); run setup again`;
+    const backup = `${file}.flatbread.bak`;
+    if (!fs19.existsSync(backup)) fs19.copyFileSync(file, backup);
+  }
+  const mode = read2.raw !== null ? fs19.statSync(file).mode & 511 : 384;
+  fs19.mkdirSync(path18.dirname(file), { recursive: true });
+  const temp = `${file}.flatbread-${process.pid}.tmp`;
+  fs19.writeFileSync(temp, next, { encoding: "utf8", mode });
+  fs19.renameSync(temp, file);
+  return null;
+}
+function registerClaudeMcp(options) {
+  const { file, log } = options;
+  const read2 = readConfig(file);
+  if ("problem" in read2) {
+    log(`  mcp          refused: ${file}: ${read2.problem}`);
+    log("               Claude Code's own state lives there, so a file we cannot read is not one we rewrite.");
+    if (options.uninstall !== true) log(`               by hand: claude mcp add --scope user ${MCP_SERVER_NAME} -- "${options.execPath}" "${options.entryPath}" mcp`);
+    return 1;
+  }
+  const servers = isObject(read2.root["mcpServers"]) ? read2.root["mcpServers"] : void 0;
+  const current = servers?.[MCP_SERVER_NAME];
+  if (options.uninstall === true) {
+    if (current === void 0) {
+      log(`  mcp          no ${MCP_SERVER_NAME} server in ${file}`);
+      return 0;
+    }
+    if (!runsFlatbreadMcp(current)) {
+      log(`  mcp          ${file}: the ${MCP_SERVER_NAME} server there does not run flatbread, left alone`);
+      return 0;
+    }
+    if (options.dryRun === true) {
+      log(`  mcp          ${file}: would remove the ${MCP_SERVER_NAME} server`);
+      return 0;
+    }
+    const rest = { ...servers };
+    delete rest[MCP_SERVER_NAME];
+    const problem2 = write(file, read2, serializeLike(read2.raw, { ...read2.root, mcpServers: rest }));
+    if (problem2 !== null) {
+      log(`  mcp          refused: ${problem2}`);
+      return 1;
+    }
+    log(`  mcp          ${file}: removed the ${MCP_SERVER_NAME} server`);
+    const backup = `${file}.flatbread.bak`;
+    if (fs19.existsSync(backup)) log(`               ${backup} is the copy setup took before its first write; delete it when you like`);
+    return 0;
+  }
+  const entry = mcpEntryFor(options.execPath, options.entryPath);
+  if (current !== void 0 && !runsFlatbreadMcp(current)) {
+    log(`  mcp          refused: ${file} already has a server named ${MCP_SERVER_NAME} that does not run flatbread, left alone`);
+    return 1;
+  }
+  if (JSON.stringify(current) === JSON.stringify(entry)) {
+    log(`  mcp          ${file}: registered for every project, unchanged`);
+    return 0;
+  }
+  const verb = current === void 0 ? "register" : "update";
+  if (options.dryRun === true) {
+    log(`  mcp          ${file}: would ${verb} "${MCP_SERVER_NAME}": ${JSON.stringify(entry)}`);
+    return 0;
+  }
+  const root = { ...read2.root, mcpServers: { ...servers ?? {}, [MCP_SERVER_NAME]: entry } };
+  const problem = write(file, read2, serializeLike(read2.raw, root));
+  if (problem !== null) {
+    log(`  mcp          refused: ${problem}`);
+    return 1;
+  }
+  log(`  mcp          ${file}: ${verb === "register" ? "registered" : "updated"} for every project (user scope)`);
+  log("               restart Claude Code (or reload the VS Code window) so it starts the server");
+  return 0;
+}
+
+// src/git-hook.ts
+import fs20 from "node:fs";
+import path19 from "node:path";
 var POST_COMMIT_MARKER = "# flatbread post-commit hook - remove with: flatbread setup --uninstall";
 var CHAINED_HOOK = "post-commit.pre-flatbread";
 var sq = (value) => `'${value.replace(/\\/g, "/").replace(/'/g, "'\\''")}'`;
@@ -10916,33 +11459,33 @@ function hooksDirFor(cwd, options = {}) {
   }
   const common = git(top, ["rev-parse", "--git-common-dir"], options)?.trim();
   if (common === void 0 || common.length === 0) return { ok: false, reason: "unreadable", detail: `git could not name the git directory of ${top}` };
-  return { ok: true, repo: path18.resolve(top), dir: path18.resolve(top, common, "hooks"), ...machineHooksPath !== void 0 ? { machineHooksPath } : {} };
+  return { ok: true, repo: path19.resolve(top), dir: path19.resolve(top, common, "hooks"), ...machineHooksPath !== void 0 ? { machineHooksPath } : {} };
 }
 var read = (file) => {
   try {
-    return fs19.readFileSync(file, "utf8");
+    return fs20.readFileSync(file, "utf8");
   } catch {
     return null;
   }
 };
 function installGitHook(dir, script, options = {}) {
-  const hook = path18.join(dir, "post-commit");
-  const chained = path18.join(dir, CHAINED_HOOK);
+  const hook = path19.join(dir, "post-commit");
+  const chained = path19.join(dir, CHAINED_HOOK);
   const current = read(hook);
-  const write = (lines2) => {
+  const write2 = (lines2) => {
     if (options.dryRun === true) return { code: 0, lines: [...lines2, "--dry-run: nothing was written"] };
-    fs19.mkdirSync(dir, { recursive: true });
-    if (current !== null && !isOurs(current)) fs19.renameSync(hook, chained);
-    fs19.writeFileSync(hook, script, { encoding: "utf8", mode: 493 });
-    fs19.chmodSync(hook, 493);
+    fs20.mkdirSync(dir, { recursive: true });
+    if (current !== null && !isOurs(current)) fs20.renameSync(hook, chained);
+    fs20.writeFileSync(hook, script, { encoding: "utf8", mode: 493 });
+    fs20.chmodSync(hook, 493);
     return { code: 0, lines: lines2 };
   };
-  if (current === null) return write([`post-commit  ${hook} (new)`]);
+  if (current === null) return write2([`post-commit  ${hook} (new)`]);
   if (isOurs(current)) {
     if (current === script) return { code: 0, lines: [`post-commit  ${hook}`, "already installed, unchanged"] };
-    return write([`post-commit  ${hook}`, "updated the flatbread hook"]);
+    return write2([`post-commit  ${hook}`, "updated the flatbread hook"]);
   }
-  if (fs19.existsSync(chained)) {
+  if (fs20.existsSync(chained)) {
     return {
       code: 1,
       lines: [
@@ -10952,16 +11495,16 @@ function installGitHook(dir, script, options = {}) {
       ]
     };
   }
-  return write([
+  return write2([
     `post-commit  ${hook}`,
     `your post-commit was kept as ${CHAINED_HOOK} and runs first, unchanged, with its exit status`
   ]);
 }
 function uninstallGitHook(dir, options = {}) {
-  const hook = path18.join(dir, "post-commit");
-  const chained = path18.join(dir, CHAINED_HOOK);
+  const hook = path19.join(dir, "post-commit");
+  const chained = path19.join(dir, CHAINED_HOOK);
   const current = read(hook);
-  const hasChained = fs19.existsSync(chained);
+  const hasChained = fs20.existsSync(chained);
   const done = (lines2, act) => {
     if (options.dryRun === true) return { code: 0, lines: [...lines2, "--dry-run: nothing was written"] };
     act();
@@ -10979,17 +11522,17 @@ function uninstallGitHook(dir, options = {}) {
   if (current === null && !hasChained) return { code: 0, lines: [`no flatbread post-commit in ${dir}`] };
   if (hasChained) {
     return done([`post-commit  ${hook}`, `restored your post-commit from ${CHAINED_HOOK}`], () => {
-      if (current !== null) fs19.rmSync(hook);
-      fs19.renameSync(chained, hook);
+      if (current !== null) fs20.rmSync(hook);
+      fs20.renameSync(chained, hook);
     });
   }
-  return done([`post-commit  ${hook}`, "removed the flatbread hook"], () => fs19.rmSync(hook));
+  return done([`post-commit  ${hook}`, "removed the flatbread hook"], () => fs20.rmSync(hook));
 }
 
 // src/hook.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import fs20 from "node:fs";
-import path19 from "node:path";
+import fs21 from "node:fs";
+import path20 from "node:path";
 var HOOK_EVENTS = ["Stop", "SessionEnd"];
 var OFFER_AFTER_STOPS = 2;
 var MAX_TRACKED_SESSIONS = 50;
@@ -10999,14 +11542,14 @@ function emptyHookState() {
   return { version: HOOK_STATE_VERSION, sessions: {} };
 }
 function hookStatePath(env = process.env) {
-  return path19.join(flatbreadHome(env), "hook-state.json");
+  return path20.join(flatbreadHome(env), "hook-state.json");
 }
 function readHookState(env = process.env) {
   const file = hookStatePath(env);
-  if (!fs20.existsSync(file)) return { ok: true, state: emptyHookState(), present: false };
+  if (!fs21.existsSync(file)) return { ok: true, state: emptyHookState(), present: false };
   let raw;
   try {
-    raw = fs20.readFileSync(file, "utf8");
+    raw = fs21.readFileSync(file, "utf8");
   } catch (error) {
     return { ok: false, reason: "unreadable", detail: error.message };
   }
@@ -11049,9 +11592,9 @@ function pruneHookState(state, keep = MAX_TRACKED_SESSIONS) {
 }
 function writeHookState(state, env = process.env) {
   const dir = flatbreadHome(env);
-  fs20.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs21.mkdirSync(dir, { recursive: true, mode: 448 });
   const file = hookStatePath(env);
-  fs20.writeFileSync(file, JSON.stringify(pruneHookState(state), null, 2) + "\n", {
+  fs21.writeFileSync(file, JSON.stringify(pruneHookState(state), null, 2) + "\n", {
     encoding: "utf8",
     mode: 384
   });
@@ -11197,7 +11740,7 @@ async function runHookNotify(io) {
   const stdout = io.stdout ?? ((line) => process.stdout.write(line + "\n"));
   const stderr = io.stderr ?? ((line) => process.stderr.write(line + "\n"));
   const now = io.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const exists = io.exists ?? ((filePath) => fs20.existsSync(filePath));
+  const exists = io.exists ?? ((filePath) => fs21.existsSync(filePath));
   const execPath = io.execPath ?? process.execPath;
   const entryPath = io.entryPath ?? process.argv[1] ?? "";
   try {
@@ -11354,10 +11897,10 @@ function removeHookConfig(settings) {
   return { settings: root, removed };
 }
 function readSettingsFile(file) {
-  if (!fs20.existsSync(file)) return { present: false, file };
+  if (!fs21.existsSync(file)) return { present: false, file };
   let raw;
   try {
-    raw = fs20.readFileSync(file, "utf8");
+    raw = fs21.readFileSync(file, "utf8");
   } catch (error) {
     return { present: true, file, unreadable: error.message };
   }
@@ -11369,10 +11912,10 @@ function readSettingsFile(file) {
   }
 }
 function writeSettingsFile(file, settings) {
-  fs20.mkdirSync(path19.dirname(file), { recursive: true });
+  fs21.mkdirSync(path20.dirname(file), { recursive: true });
   const temp = `${file}.flatbread-${process.pid}.tmp`;
-  fs20.writeFileSync(temp, JSON.stringify(settings, null, 2) + "\n", "utf8");
-  fs20.renameSync(temp, file);
+  fs21.writeFileSync(temp, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  fs21.renameSync(temp, file);
 }
 function handlersFor(execPath, entryPath, capture = false) {
   return {
@@ -11530,8 +12073,8 @@ function runHookUninstall(options = {}) {
 function settingsCandidates(env, cwd) {
   return [
     { label: "user", file: claudeSettingsPath(env) },
-    { label: "project", file: path19.join(cwd, ".claude", "settings.json") },
-    { label: "local", file: path19.join(cwd, ".claude", "settings.local.json") }
+    { label: "project", file: path20.join(cwd, ".claude", "settings.json") },
+    { label: "local", file: path20.join(cwd, ".claude", "settings.local.json") }
   ];
 }
 function installedEventsIn(parsed, exists) {
@@ -11561,7 +12104,7 @@ function runHookStatus(options = {}) {
   const env = options.env ?? process.env;
   const log = options.log ?? ((line) => console.log(line));
   const cwd = options.cwd ?? process.cwd();
-  const exists = options.exists ?? ((filePath) => fs20.existsSync(filePath));
+  const exists = options.exists ?? ((filePath) => fs21.existsSync(filePath));
   const candidates = options.settingsPath === void 0 ? settingsCandidates(env, cwd) : [{ label: "settings", file: options.settingsPath }];
   log("");
   log("flatbread hook");
@@ -11711,6 +12254,22 @@ function runSetup(options = {}) {
     ...options.spawn !== void 0 ? { spawn: options.spawn } : {},
     ...settings
   });
+  let mcp = 0;
+  if (options.noMcp === true) {
+    log("  --no-mcp: Claude Code's MCP servers were not touched");
+  } else if (claude === 0 || options.uninstall === true) {
+    mcp = registerClaudeMcp({
+      file: options.claudeConfigPath ?? claudeUserConfigPath(env),
+      execPath,
+      entryPath,
+      uninstall: options.uninstall === true,
+      dryRun,
+      log
+    });
+  } else {
+    log("  mcp          not registered, because the hook step above was refused");
+  }
+  log("");
   let git2 = 0;
   log("git");
   if (options.noGit === true) {
@@ -11746,11 +12305,11 @@ function runSetup(options = {}) {
     log("  share one with: flatbread share --file <its session>, which opens the review");
   }
   log("");
-  return claude !== 0 || git2 !== 0 ? 1 : 0;
+  return claude !== 0 || mcp !== 0 || git2 !== 0 ? 1 : 0;
 }
 
 // src/login-server.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 import http2 from "node:http";
 function callbackOrigin(port) {
   return `http://127.0.0.1:${port}`;
@@ -11825,7 +12384,7 @@ function parseDelivery(raw, expectedState, nowSeconds) {
   }
   const given = Buffer.from(state, "utf8");
   const wanted = Buffer.from(expectedState, "utf8");
-  if (given.length !== wanted.length || !crypto2.timingSafeEqual(given, wanted)) {
+  if (given.length !== wanted.length || !crypto3.timingSafeEqual(given, wanted)) {
     return { ok: false, problem: "the callback state did not match" };
   }
   const sessionRaw = body["session"];
@@ -11873,7 +12432,7 @@ async function readBody2(req, limitBytes = 64 * 1024) {
 async function startLoginServer(options = {}) {
   const ports = options.ports ?? DEFAULT_LOGIN_PORTS;
   const now = options.now ?? (() => Math.floor(Date.now() / 1e3));
-  const state = options.state ?? crypto2.randomBytes(32).toString("hex");
+  const state = options.state ?? crypto3.randomBytes(32).toString("hex");
   let settle;
   const delivery = new Promise((resolve) => {
     settle = resolve;
@@ -11959,13 +12518,13 @@ async function bindFirst(server, ports) {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = path20.resolve(path20.dirname(fileURLToPath(import.meta.url)), "..");
-var SOURCE_CHECKOUT = fs21.existsSync(path20.join(PACKAGE_ROOT, "src", "index.ts"));
-var TMP_DIR = process.env["FLATBREAD_TMP_DIR"]?.trim() || (SOURCE_CHECKOUT ? path20.join(PACKAGE_ROOT, ".tmp") : path20.join(os7.homedir(), ".flatbread"));
-var OUTPUT_PATH = path20.join(TMP_DIR, "last-parse.json");
-var SHARE_OUTPUT_PATH = path20.join(TMP_DIR, "last-share.json");
+var PACKAGE_ROOT = path21.resolve(path21.dirname(fileURLToPath2(import.meta.url)), "..");
+var SOURCE_CHECKOUT = fs22.existsSync(path21.join(PACKAGE_ROOT, "src", "index.ts"));
+var TMP_DIR = process.env["FLATBREAD_TMP_DIR"]?.trim() || (SOURCE_CHECKOUT ? path21.join(PACKAGE_ROOT, ".tmp") : path21.join(os8.homedir(), ".flatbread"));
+var OUTPUT_PATH = path21.join(TMP_DIR, "last-parse.json");
+var SHARE_OUTPUT_PATH = path21.join(TMP_DIR, "last-share.json");
 function storeDir() {
-  return resolveStoreDir() ?? (SOURCE_CHECKOUT ? null : path20.join(TMP_DIR, DEFAULT_STORE_DIRNAME));
+  return resolveStoreDir() ?? (SOURCE_CHECKOUT ? null : path21.join(TMP_DIR, DEFAULT_STORE_DIRNAME));
 }
 var USAGE = `flatbread - registry of AI agent runs
 
@@ -11975,14 +12534,16 @@ Usage:
   flatbread share                       Review + sanitize the newest session
   flatbread share --file <path>          Review + sanitize a specific session
   flatbread view                        Write the brief and capsule, print the viewer URL
-  flatbread pull <id|url>               Print a run's Context Capsule
+  flatbread pull <id|url>               Print a run's Context Capsule: a run this machine shared or
+                                        captured is read here, anything else from the site
   flatbread pull <id|url> --out <file>  Write it to a file instead
   flatbread mcp                         MCP server on stdio: flatbread_search_traces and
                                         flatbread_get_capsule, for your coding agent
   flatbread search <words>              Find runs: this machine's shared and captured ones, then
                                         the site (the same answer the MCP server gives)
   flatbread setup                       Auto-capture: the Claude Code hook, plus a chained git
-                                        post-commit in this repository. Captures stay local
+                                        post-commit in this repository, and the MCP server for
+                                        every Claude Code project. Captures stay local
   flatbread setup --uninstall           Remove exactly what setup added
   flatbread capture --file <path>       Capture one session into the local bucket (setup's hooks
                                         run this; redacted, private, never uploaded)
@@ -12024,9 +12585,10 @@ Options for search:
 
 Options for setup:
   --dry-run                             Say what would be written, write nothing
-  --uninstall                           Remove the handlers and the post-commit; restore a
-                                        post-commit hook setup had chained
+  --uninstall                           Remove the handlers, the MCP server and the post-commit;
+                                        restore a post-commit hook setup had chained
   --no-git                              Leave the repository's hooks alone
+  --no-mcp                              Leave Claude Code's MCP servers alone
   --settings <path>  --no-probe         As for hook install
 
 Options for capture:
@@ -12049,14 +12611,16 @@ Options for adapters:
 Notes:
   parse and share record the git branch, HEAD commit and uncommitted file names when the
   session ran inside a git repository. Nothing else from git is read.
-  parse --save writes ${path20.relative(process.cwd(), OUTPUT_PATH) || OUTPUT_PATH}
-  Share drafts are written to ${path20.relative(process.cwd(), SHARE_OUTPUT_PATH) || SHARE_OUTPUT_PATH}
+  parse --save writes ${path21.relative(process.cwd(), OUTPUT_PATH) || OUTPUT_PATH}
+  Share drafts are written to ${path21.relative(process.cwd(), SHARE_OUTPUT_PATH) || SHARE_OUTPUT_PATH}
+  (the latest only; every shared run is also kept under its ID, for search and pull)
   Every parsed run defaults to visibility "private".
   Nothing is uploaded unless you pass --publish, or set FLATBREAD_API_URL and
   FLATBREAD_API_TOKEN yourself. pull and mcp only read: public runs, your own when you
   are signed in, and a private run through its share link. The review UI listens on
-  127.0.0.1 only. Add the MCP server to Claude Code with:
-    claude mcp add flatbread -- npx -y flatbread-cli mcp
+  127.0.0.1 only, on 4321-4325 or, when all five are busy, a port the OS picks.
+  setup registers the MCP server in ~/.claude.json, for every project. By hand instead:
+    claude mcp add --scope user flatbread -- flatbread mcp
   The viewer is a separate dev server: npm run dev -w @flatbread/web
   Captured runs live in ~/.flatbread/bucket (FLATBREAD_HOOK_DISABLED=1 stops every capture).
   A capture is not a share: to publish one, run share --file on its session.
@@ -12085,10 +12649,10 @@ function parseArgv(argv) {
     } else if (arg === "--out") {
       const value = argv[i + 1];
       if (value === void 0 || value.startsWith("--")) throw new Error("--out needs a file path");
-      args.out = path20.resolve(value);
+      args.out = path21.resolve(value);
       i += 1;
     } else if (arg !== void 0 && arg.startsWith("--out=")) {
-      args.out = path20.resolve(arg.slice("--out=".length));
+      args.out = path21.resolve(arg.slice("--out=".length));
     } else if (arg === "--harness") {
       const value = argv[i + 1];
       if (value === void 0 || value.startsWith("--")) {
@@ -12209,12 +12773,12 @@ async function runParse(args) {
     target = found[0];
     console.log(`latest ${harness} session: ${target}`);
   } else if (args.file) {
-    target = path20.resolve(args.file);
-    if (!fs21.existsSync(target)) {
+    target = path21.resolve(args.file);
+    if (!fs22.existsSync(target)) {
       console.error(`file not found: ${target}`);
       return 1;
     }
-    if (!fs21.statSync(target).isFile()) {
+    if (!fs22.statSync(target).isFile()) {
       console.error(`not a file: ${target}`);
       return 1;
     }
@@ -12245,8 +12809,8 @@ async function runParse(args) {
   const trace = withLineage(result.trace, readGitLineage(result.trace.source.cwd));
   FlatbreadTraceSchema.parse(trace);
   if (args.out !== void 0) {
-    fs21.mkdirSync(path20.dirname(args.out), { recursive: true });
-    fs21.writeFileSync(args.out, JSON.stringify(trace, null, 2) + "\n", "utf8");
+    fs22.mkdirSync(path21.dirname(args.out), { recursive: true });
+    fs22.writeFileSync(args.out, JSON.stringify(trace, null, 2) + "\n", "utf8");
   }
   report({ ...result, trace }, args.out);
   return 0;
@@ -12310,8 +12874,8 @@ async function runAdapters(args) {
   }
   let input = null;
   if (args.file !== void 0) {
-    const resolved = path20.resolve(args.file);
-    if (!fs21.existsSync(resolved)) {
+    const resolved = path21.resolve(args.file);
+    if (!fs22.existsSync(resolved)) {
       console.error(`file not found: ${resolved}`);
       return 1;
     }
@@ -12637,7 +13201,7 @@ async function prompt(label) {
   });
 }
 var HOOK_SUBCOMMANDS = ["install", "status", "uninstall", "notify"];
-var CLI_ENTRY = fileURLToPath(import.meta.url);
+var CLI_ENTRY = fileURLToPath2(import.meta.url);
 function parseHookArgv(argv) {
   const [sub, ...rest] = argv;
   if (sub === void 0) {
@@ -12730,13 +13294,13 @@ function parsePullArgv(argv) {
   if (ref === void 0) throw new Error("pull needs a run ID or a /r/<id> link, e.g. flatbread pull quiet-otter-4821");
   return { ref, ...out !== void 0 ? { out } : {} };
 }
-async function runPull(args) {
+async function runPull(args, deps = { ...defaultMcpDeps(storeDir(), bucketDir()), capsule: (ref) => fetchCapsule(ref) }) {
   const ref = parseRunRef(args.ref);
   if (ref === null) {
     console.error(`"${args.ref}" is not a run ID or a /r/<id> link`);
     return 1;
   }
-  const result = await fetchCapsule(ref);
+  const result = await readCapsule(ref, deps);
   if (!result.ok) {
     console.error(describeReadFailure(result, `could not pull ${ref.slug}`));
     return 1;
@@ -12745,10 +13309,10 @@ async function runPull(args) {
     process.stdout.write(result.capsule);
     return 0;
   }
-  const target = path20.resolve(args.out);
-  fs21.mkdirSync(path20.dirname(target), { recursive: true });
-  fs21.writeFileSync(target, result.capsule, "utf8");
-  console.error(`wrote ${target}`);
+  const target = path21.resolve(args.out);
+  fs22.mkdirSync(path21.dirname(target), { recursive: true });
+  fs22.writeFileSync(target, result.capsule, "utf8");
+  console.error(`wrote ${target}${result.from === "site" ? "" : ` (from this machine's ${result.from === "store" ? "shared runs" : "captured runs"})`}`);
   return 0;
 }
 function parseSearchArgv(argv) {
@@ -12860,6 +13424,7 @@ function parseSetupArgv(argv) {
     dryRun: false,
     uninstall: false,
     noGit: false,
+    noMcp: false,
     noProbe: false
   };
   for (let i = 0; i < argv.length; i += 1) {
@@ -12867,6 +13432,7 @@ function parseSetupArgv(argv) {
     if (arg === "--dry-run") args.dryRun = true;
     else if (arg === "--uninstall") args.uninstall = true;
     else if (arg === "--no-git") args.noGit = true;
+    else if (arg === "--no-mcp") args.noMcp = true;
     else if (arg === "--no-probe") args.noProbe = true;
     else if (arg === "--settings") {
       const value = argv[i + 1];
@@ -12913,6 +13479,7 @@ async function main(argv) {
         dryRun: setup.dryRun,
         uninstall: setup.uninstall,
         noGit: setup.noGit,
+        noMcp: setup.noMcp,
         noProbe: setup.noProbe,
         ...setup.settings !== void 0 ? { settingsPath: setup.settings } : {}
       });
@@ -12994,12 +13561,12 @@ var invokedDirectly = (() => {
   if (entry === void 0) return false;
   const real = (file) => {
     try {
-      return fs21.realpathSync(file);
+      return fs22.realpathSync(file);
     } catch {
-      return path20.resolve(file);
+      return path21.resolve(file);
     }
   };
-  return real(entry) === real(fileURLToPath(import.meta.url));
+  return real(entry) === real(fileURLToPath2(import.meta.url));
 })();
 if (invokedDirectly) {
   main(process.argv.slice(2)).then((code) => {
@@ -13022,6 +13589,7 @@ export {
   runCapture,
   runLogin,
   runLogout,
+  runPull,
   runSearch,
   runWhoami
 };