heyspex 0.2.0 → 0.2.1

package/dist/cli/hs-vault.mjs

@@ -10,11 +10,26 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// scripts/lib/heyspex-home.mjs
+import { homedir } from "node:os";
+function heyspexHome(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir();
+}
+var init_heyspex_home = __esm({
+  "scripts/lib/heyspex-home.mjs"() {
+    "use strict";
+  }
+});
+
 // vendor/heyspex-mcp/credentials.mjs
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import os, { homedir } from "node:os";
+import os, { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join2, resolve } from "node:path";
-function credentialsFilePath(homeDir = homedir()) {
+function credentialsFilePath(homeDir = heyspexHome()) {
   return join2(homeDir, ".heyspex", "credentials.yaml");
 }
 function parseMcpToken(raw) {
@@ -127,14 +142,14 @@ function readLegacyConfigAccountId(read, homeDir) {
   const value = raw?.match(CONFIG_ACCOUNT_ID_RE)?.[1]?.trim() ?? "";
   return value || null;
 }
-function readBearer({ env = process.env, homeDir = homedir(), readFile: readFile2, accountId: accountId2 } = {}) {
+function readBearer({ env = process.env, homeDir = heyspexHome(), readFile: readFile2, accountId: accountId2 } = {}) {
   const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
   const credentialsText = readTextOrNull(read, credentialsFilePath(homeDir));
   const named = typeof accountId2 === "string" && accountId2.trim() ? accountId2.trim() : null;
   const legacyAccountId = named && parseCredentialsStore(credentialsText).schemaVersion === 1 ? readLegacyConfigAccountId(read, homeDir) : null;
   return resolveBearer({ envToken: env?.[MCP_TOKEN_ENV], credentialsText, accountId: named, legacyAccountId });
 }
-function readCurrentAccountId({ homeDir = homedir(), readFile: readFile2 } = {}) {
+function readCurrentAccountId({ homeDir = heyspexHome(), readFile: readFile2 } = {}) {
   const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
   const store = parseCredentialsStore(readTextOrNull(read, credentialsFilePath(homeDir)));
   if (store.schemaVersion === 2 && store.currentAccountId && store.currentAccountId !== LEGACY_ACCOUNT_ID) {
@@ -152,6 +167,7 @@ var MCP_TOKEN_ENV, MCP_TOKEN_LINE_RE, CREDENTIALS_SCHEMA_VERSION, LEGACY_ACCOUNT
 var init_credentials = __esm({
   "vendor/heyspex-mcp/credentials.mjs"() {
     "use strict";
+    init_heyspex_home();
     MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
     MCP_TOKEN_LINE_RE = /^mcp_token:[ \t]*["']?([^"'\r\n#]+)/m;
     CREDENTIALS_SCHEMA_VERSION = 2;
@@ -164,9 +180,9 @@ var init_credentials = __esm({
 
 // vendor/heyspex-mcp/session-owner.mjs
 import { readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
-function resolveSessionOwnerUncached({ env = process.env, homeDir = homedir2(), readFile: readFile2 } = {}) {
+function resolveSessionOwnerUncached({ env = process.env, homeDir = heyspexHome(), readFile: readFile2 } = {}) {
   const fromEnv = typeof env?.HS_ACCOUNT_ID === "string" ? env.HS_ACCOUNT_ID.trim() : "";
   if (fromEnv) return fromEnv;
   return readCurrentAccountId({ homeDir, readFile: readFile2 });
@@ -174,10 +190,26 @@ function resolveSessionOwnerUncached({ env = process.env, homeDir = homedir2(),
 var init_session_owner = __esm({
   "vendor/heyspex-mcp/session-owner.mjs"() {
     "use strict";
+    init_heyspex_home();
     init_credentials();
   }
 });
 
+// spex-console/src/lib/heyspex-home.ts
+import { homedir as homedir6 } from "node:os";
+function heyspexHome2(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir6();
+}
+var init_heyspex_home2 = __esm({
+  "spex-console/src/lib/heyspex-home.ts"() {
+    "use strict";
+  }
+});
+
 // spex-console/src/lib/vault-registry/types.ts
 function emptyVaultRegistry() {
   return {
@@ -198,14 +230,13 @@ var init_types = __esm({
 });
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 function vaultRegistryDir(opts = {}) {
-  return opts.registryDir ?? join6(homedir5(), ".heyspex");
+  return opts.registryDir ?? join7(heyspexHome2(), ".heyspex");
 }
 function vaultRegistryFilePath(opts = {}) {
-  return join6(vaultRegistryDir(opts), "registry.json");
+  return join7(vaultRegistryDir(opts), "registry.json");
 }
 function isNonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
@@ -306,9 +337,9 @@ function parseVaultRegistryFile(json) {
 }
 function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync3(filePath)) return { kind: "missing" };
+  if (!existsSync4(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync5(filePath, "utf8");
+    const raw = readFileSync6(filePath, "utf8");
     const json = JSON.parse(raw);
     if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
     return { kind: "ok", raw, json };
@@ -362,14 +393,14 @@ function underTestRunner() {
 }
 function samePathLoose(a, b) {
   const norm = (p) => {
-    const r = resolve3(p).replace(/[\\/]+$/, "");
+    const r = resolve4(p).replace(/[\\/]+$/, "");
     return process.platform === "win32" ? r.toLowerCase() : r;
   };
   return norm(a) === norm(b);
 }
 function assertNotRealHomeRegistryUnderTest(filePath) {
   if (!underTestRunner()) return;
-  if (samePathLoose(dirname4(filePath), join6(homedir5(), ".heyspex"))) {
+  if (samePathLoose(dirname4(filePath), join7(heyspexHome2(), ".heyspex"))) {
     throw new Error(
       `registry-file: refusing to write ${filePath} under a test runner \u2014 that is the real ~/.heyspex registry. Pass opts.registryDir (a temp dir).`
     );
@@ -378,10 +409,10 @@ function assertNotRealHomeRegistryUnderTest(filePath) {
 function writeVaultRegistry(registry, opts = {}) {
   const filePath = vaultRegistryFilePath(opts);
   assertNotRealHomeRegistryUnderTest(filePath);
-  mkdirSync2(dirname4(filePath), { recursive: true });
+  mkdirSync3(dirname4(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  writeFileSync2(tmpPath, serializeVaultRegistry(registry), "utf8");
-  renameSync2(tmpPath, filePath);
+  writeFileSync3(tmpPath, serializeVaultRegistry(registry), "utf8");
+  renameSync3(tmpPath, filePath);
 }
 function isValidId(id) {
   if (!isNonEmptyString(id)) return false;
@@ -550,10 +581,10 @@ function rekeyVaultRowsToCloudIds(registry, proofs, plan) {
   };
 }
 function planRegistryMigration(registry, opts = {}) {
-  const pathExists = opts.pathExists ?? ((p) => existsSync3(p));
+  const pathExists = opts.pathExists ?? ((p) => existsSync4(p));
   const readMarker = opts.readMarker ?? ((root) => {
     try {
-      return readFileSync5(join6(root, "heyspex.yaml"), "utf8");
+      return readFileSync6(join7(root, "heyspex.yaml"), "utf8");
     } catch {
       return null;
     }
@@ -687,6 +718,7 @@ var emptyPlan;
 var init_registry_file = __esm({
   "spex-console/src/lib/vault-registry/registry-file.ts"() {
     "use strict";
+    init_heyspex_home2();
     init_types();
     init_types();
     emptyPlan = (current) => ({
@@ -703,11 +735,11 @@ var init_registry_file = __esm({
 });
 
 // scripts/lib/dev-mode.mjs
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
-function devModeFilePath(homeDir = homedir6()) {
-  return join7(homeDir, ".heyspex", DEV_MODE_FILENAME);
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
+function devModeFilePath(homeDir = heyspexHome()) {
+  return join8(homeDir, ".heyspex", DEV_MODE_FILENAME);
 }
 function normalizeMode(raw) {
   const v = String(raw ?? "").trim().toLowerCase();
@@ -731,7 +763,7 @@ function deriveSemantics(mode, reliance) {
     vaultWriteMode: local ? "local" : "cloud"
   };
 }
-function readLocalDevModeRecord({ homeDir = homedir6(), readFile: readFile2 = defaultReadFile } = {}) {
+function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile: readFile2 = defaultReadFile } = {}) {
   let raw;
   try {
     raw = readFile2(devModeFilePath(homeDir));
@@ -761,7 +793,7 @@ function readLocalDevModeRecord({ homeDir = homedir6(), readFile: readFile2 = de
 }
 function resolveDevMode({
   env = process.env,
-  homeDir = homedir6(),
+  homeDir = heyspexHome(),
   readFile: readFile2 = defaultReadFile,
   cloudSetting = void 0
 } = {}) {
@@ -824,11 +856,12 @@ var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
 var init_dev_mode = __esm({
   "scripts/lib/dev-mode.mjs"() {
     "use strict";
+    init_heyspex_home();
     init_credentials();
     CLOUD_CONSOLE_URL = "https://app.heyspex.com";
     LOCAL_CONSOLE_URL = "http://localhost:3000";
     DEV_MODE_FILENAME = "dev-mode.json";
-    defaultReadFile = (p) => readFileSync6(p, "utf8");
+    defaultReadFile = (p) => readFileSync7(p, "utf8");
   }
 });
 
@@ -903,13 +936,12 @@ var init_default_workspace = __esm({
 });
 
 // spex-console/src/lib/cli/vault-workspace-shared.ts
-import { readFileSync as readFileSync8 } from "node:fs";
-import os2 from "node:os";
+import { readFileSync as readFileSync9 } from "node:fs";
 function resolveConfiguredAccountId(opts = {}) {
   return resolveSessionOwnerUncached({
     env: opts.env ?? process.env,
-    homeDir: opts.homeDir ?? os2.homedir(),
-    readFile: opts.readFile ?? ((p) => readFileSync8(p, "utf-8"))
+    homeDir: opts.homeDir ?? heyspexHome2(),
+    readFile: opts.readFile ?? ((p) => readFileSync9(p, "utf-8"))
   });
 }
 function resolveCloudAccountIdOrRefuse(opts = {}) {
@@ -919,6 +951,9 @@ function resolveCloudAccountIdOrRefuse(opts = {}) {
 function vaultOwnedByOtherAccountMessage(id) {
   return `vault "${id}" is already registered to another HeySpex account, so nothing was changed. To move it to this account: sign in as the account that owns it (\`hs login --switch-account\`), remove it there (\`hs vault unregister ${id}\` or the console's vault settings; this deletes only the registry row, never repo files, and archiving alone keeps the id taken), then sign back in here and re-run this command. Or keep both by registering this repo under a new vault id (\`hs vault register --path . --id <new-id>\`). Transferring a vault between accounts is not supported.`;
 }
+function vaultNotOwnedByCallerMessage(id) {
+  return `vault "${id}" belongs to another HeySpex account, so nothing was changed. Only the account that owns a vault can rename, move, archive, restore or unregister it (\`hs login --switch-account\` to act as that account).`;
+}
 function workspaceOwnedByOtherAccountMessage(id) {
   return `workspace "${id}" belongs to another HeySpex account, so nothing was changed. Pick a different workspace id (e.g. \`--workspace <new-id>\`), or sign in as the account that owns it (\`hs login --switch-account\`). Transferring a workspace between accounts is not supported.`;
 }
@@ -1005,8 +1040,14 @@ async function mutateHttp(http, method, path5, body, landed) {
   const res = await cloudHttpRequest(http, method, path5, body);
   if (res.ok) return landed;
   if (res.status === 404) return "not_found";
+  if (res.status === 403 && isOwnedByOtherAccountCode(errorCodeOf(res.json))) {
+    return "owned_by_other_account";
+  }
   return cloudWriteFailure(http, res);
 }
+function isOwnedByOtherAccountCode(code) {
+  return code === VAULT_OWNED_BY_OTHER_ACCOUNT || code === WORKSPACE_OWNED_BY_OTHER_ACCOUNT;
+}
 function manageVerbPath(kind, id) {
   return `/api/${kind}/${encodeURIComponent(id)}`;
 }
@@ -1014,6 +1055,7 @@ var CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE, VAULT_OWNED_BY_OTHER_ACCOUNT, WORKSPACE_O
 var init_vault_workspace_shared = __esm({
   "spex-console/src/lib/cli/vault-workspace-shared.ts"() {
     "use strict";
+    init_heyspex_home2();
     init_session_owner();
     init_default_workspace();
     CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE = "refusing -- no signed-in account (no HS_ACCOUNT_ID env var, and no account_id: in ~/.heyspex/config.yaml). Run `hs login` first; nothing was written.";
@@ -1058,7 +1100,7 @@ var init_interfaces = __esm({
 });
 
 // spex-console/src/lib/db/schema/postgres.ts
-var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, tsvector, specs, tags, edges, wikilinks, specLinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, fileClaims, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, consoleSettingsStore, wipLedger, wipLedgerArchive, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, pendingVaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
+var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, tsvector, specs, tags, edges, wikilinks, specLinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, fileClaims, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, consoleSettingsStore, wipLedger, wipLedgerArchive, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, pendingVaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements, sessionBranchDeclarations;
 var init_postgres = __esm({
   "spex-console/src/lib/db/schema/postgres.ts"() {
     "use strict";
@@ -1500,7 +1542,13 @@ var init_postgres = __esm({
       "priority_change",
       "parent_change",
       "claim_acquired",
-      "claim_released"
+      "claim_released",
+      // Collaborator write audit (HS-FWB6, migration 0077).
+      "spec_created",
+      "spec_edited",
+      "spec_deleted",
+      "capture_written",
+      "wip_recorded"
     ]);
     focusPin = pgTable(
       "focus_pin",
@@ -2693,11 +2741,43 @@ var init_postgres = __esm({
         // `owner/name`
         branch: text("branch").notNull(),
         commitSha: text("commit_sha").notNull(),
-        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`)
+        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // The pull request that carries this settlement
+        // ([[HS-9D25-CWPX-EPIC-branch-lifecycle-open-a-pull-request]]). NULL until
+        // the branch has gone quiet and a PR was opened or found; a write made
+        // after its PR merged stays NULL, which is what triggers the next PR.
+        pullRequestNumber: integer("pull_request_number"),
+        pullRequestUrl: text("pull_request_url")
       },
       (table) => [
         // "latest settlement for this spec" — the read path's only query.
-        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc())
+        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc()),
+        // The PR sweep's only query: branches with settlements not yet in a PR.
+        index("spec_settlements_unproposed_idx").on(table.vaultId, table.repo, table.branch).where(sql`${table.pullRequestNumber} IS NULL`)
+      ]
+    );
+    sessionBranchDeclarations = pgTable(
+      "session_branch_declarations",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        actorKey: text("actor_key").notNull(),
+        sessionId: text("session_id").notNull(),
+        branch: text("branch").notNull(),
+        declaredAt: timestamp("declared_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        uniqueIndex("session_branch_declarations_uq").on(
+          table.vaultId,
+          table.actorKey,
+          table.sessionId
+        ),
+        index("session_branch_declarations_lookup_idx").on(
+          table.vaultId,
+          table.actorKey,
+          table.declaredAt.desc()
+        )
       ]
     );
   }
@@ -3352,7 +3432,7 @@ var init_spec_read_service = __esm({
 });
 
 // spex-console/bin/hs-vault.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import path4 from "node:path";
 import process4 from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
@@ -3379,11 +3459,12 @@ function shellQuote(p) {
 var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
 
 // vendor/heyspex-mcp/console-fetch.mjs
+init_heyspex_home();
 init_credentials();
 init_session_owner();
-import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join6 } from "node:path";
 
 // vendor/heyspex-mcp/vault-less-endpoints.mjs
 var VAULT_LESS_ENDPOINTS = Object.freeze([
@@ -3409,10 +3490,41 @@ function isVaultLessEndpoint(method, path5) {
   });
 }
 
+// vendor/heyspex-mcp/write-outbox.mjs
+import {
+  readdirSync,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync2,
+  existsSync as existsSync2,
+  renameSync as renameSync2,
+  rmSync
+} from "node:fs";
+import { basename, join as join4, isAbsolute as isAbsolute2 } from "node:path";
+
+// scripts/lib/shared-path-helpers.mjs
+import { isAbsolute, resolve as resolve2, sep } from "node:path";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
+
 // vendor/heyspex-mcp/vault-resolve.mjs
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir3, tmpdir } from "node:os";
-import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
+init_heyspex_home();
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4, tmpdir } from "node:os";
+import { dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
@@ -3540,10 +3652,11 @@ function withCloudScope(deps, accountId2, vaultId) {
 }
 
 // scripts/lib/console-url-resolver.mjs
+init_heyspex_home();
 init_dev_mode();
-import { readFileSync as readFileSync7 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join9 } from "node:path";
 var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
   return url.replace(/\/+$/, "");
@@ -3569,9 +3682,9 @@ function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
   } catch {
   }
 }
-function readCredentialsConsoleUrl({ homeDir = homedir7(), readFile: readFile2 = defaultReadFile2 } = {}) {
+function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile: readFile2 = defaultReadFile2 } = {}) {
   try {
-    const raw = readFile2(join8(homeDir, ".heyspex", "credentials.yaml"));
+    const raw = readFile2(join9(homeDir, ".heyspex", "credentials.yaml"));
     const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
     const value = match?.[1]?.trim();
     return value && value.length > 0 ? trimTrailingSlash(value) : null;
@@ -3580,12 +3693,12 @@ function readCredentialsConsoleUrl({ homeDir = homedir7(), readFile: readFile2 =
   }
 }
 function defaultReadFile2(p) {
-  return readFileSync7(p, "utf8");
+  return readFileSync8(p, "utf8");
 }
 function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
   if (!repoRoot) return null;
   try {
-    const discovery = String(readDiscovery(join8(repoRoot, ".heyspex", "console-url")) ?? "").trim();
+    const discovery = String(readDiscovery(join9(repoRoot, ".heyspex", "console-url")) ?? "").trim();
     if (discovery.length > 0) return trimTrailingSlash(discovery);
   } catch {
   }
@@ -3613,7 +3726,7 @@ function resolveModeEnvelope({ env, homeDir }) {
 function resolveConsoleUrl({
   repoRoot,
   env = process.env,
-  homeDir = homedir7(),
+  homeDir = heyspexHome(),
   strict = false,
   devMode,
   log = (line) => process.stderr.write(line),
@@ -3677,37 +3790,19 @@ var HELP = [
 ].join("\n");
 
 // spex-console/src/lib/cli/install-identity.ts
+init_heyspex_home2();
+init_registry_file();
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join10 } from "node:path";
 import { createInterface } from "node:readline/promises";
-
-// scripts/lib/shared-path-helpers.mjs
-import { isAbsolute, resolve as resolve4, sep } from "node:path";
-function resolveCodeRoot({
-  explicit,
-  packageRoot,
-  vaultRoot,
-  env = process.env
-} = {}) {
-  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
-  if (fromExplicit) return fromExplicit;
-  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
-  if (fromEnv) return fromEnv;
-  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
-  if (fromPackage) return fromPackage;
-  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
-  return fromVault;
-}
-
-// spex-console/src/lib/cli/install-identity.ts
 init_credentials();
 init_session_owner();
 
 // vendor/heyspex-mcp/whoami.mjs
+init_heyspex_home();
 init_credentials();
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 var SESSION_PATH = "/api/mcp/session";
 async function probeCredentialIdentity({ consoleUrl, token, fetchImpl = fetch } = {}) {
   if (!token) return { kind: "no_credential" };
@@ -3809,6 +3904,81 @@ var HELP2 = [
   "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed"
 ].join("\n");
 
+// spex-console/src/lib/cli/satellite.ts
+init_registry_file();
+import { resolve as resolveNodePath } from "node:path";
+import process2 from "node:process";
+var SATELLITE_VAULT_ENV = "HEYSPEX_VAULT_ROOT";
+var SATELLITE_MANIFEST_RELS = [
+  [".mcp.json"],
+  [".cursor", "mcp.json"]
+];
+function normalizePathForCompare(p) {
+  return p.trim().replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function samePath(a, b) {
+  return normalizePathForCompare(a) === normalizePathForCompare(b);
+}
+function isAtOrUnder(child, parent) {
+  const c = normalizePathForCompare(child);
+  const p = normalizePathForCompare(parent);
+  return c === p || c.startsWith(`${p}/`);
+}
+function isAbsolutePathForCompare(p) {
+  const s = p.trim();
+  return /^[\\/]/.test(s) || /^[a-zA-Z]:[\\/]/.test(s);
+}
+function expandPinPlaceholders(value, repoRoot) {
+  return value.replace(/\$\{(?:CLAUDE_PROJECT_DIR|workspaceFolder)(?::-[^}]*)?\}/g, repoRoot);
+}
+function lexicalJoin(base, rel) {
+  const parts = `${base}/${rel}`.replace(/\\/g, "/").split("/");
+  const out = [];
+  for (const seg of parts) {
+    if (seg === "" && out.length > 0) continue;
+    if (seg === ".") continue;
+    if (seg === ".." && out.length > 1) {
+      out.pop();
+      continue;
+    }
+    out.push(seg);
+  }
+  return out.join("/");
+}
+function parseMarkerVaultPath(content) {
+  const m = content.match(/^vault_path:[ \t]*(.+?)[ \t]*$/m);
+  if (!m) return null;
+  const v = m[1].trim().replace(/\s+#.*$/, "").replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1").trim();
+  if (!v || v.includes("${") || /^[\\/]/.test(v) || /^[a-zA-Z]:[\\/]/.test(v)) return null;
+  return v;
+}
+function readPinnedVaultRoot(repoRoot, deps) {
+  const pins = [];
+  for (const rel of SATELLITE_MANIFEST_RELS) {
+    const path5 = deps.joinPath(repoRoot, ...rel);
+    if (!deps.fileExists(path5)) continue;
+    const raw = deps.readFile(path5);
+    if (!raw) continue;
+    let value;
+    try {
+      const parsed = JSON.parse(raw);
+      value = parsed?.mcpServers?.heyspex?.env?.[SATELLITE_VAULT_ENV];
+    } catch {
+      continue;
+    }
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (!trimmed) continue;
+    const expanded = expandPinPlaceholders(trimmed, repoRoot);
+    if (expanded.includes("${")) continue;
+    if (/^[a-zA-Z]:(?![\\/])/.test(expanded)) continue;
+    const abs = isAbsolutePathForCompare(expanded) ? expanded.includes("..") ? lexicalJoin(expanded, ".") : expanded : lexicalJoin(repoRoot, expanded);
+    if (expanded !== trimmed && isAtOrUnder(abs, repoRoot)) continue;
+    pins.push({ source: rel.join("/"), value: abs });
+  }
+  return pins;
+}
+
 // spex-console/src/lib/cli/install-identity.ts
 var SWITCH_HINT = "Sign in as another account with `hs login --switch-account` (or create one with `hs login --create-account`).";
 var ATTACH_WORDING = {
@@ -4044,7 +4214,7 @@ async function gateWriteVerb(opts) {
   if (!opts.writeVerbs.has(opts.sub)) return null;
   return runIdentityGate(opts.io, opts.flags, `${opts.namespace} ${opts.sub}`, WRITE_WORDING);
 }
-function readConfiguredAccountId(env = process.env, homeDir = homedir9()) {
+function readConfiguredAccountId(env = process.env, homeDir = heyspexHome2()) {
   return resolveSessionOwnerUncached({ env, homeDir });
 }
 function isInteractiveTerminal() {
@@ -4052,7 +4222,7 @@ function isInteractiveTerminal() {
 }
 function defaultIdentityGateIo(opts) {
   const consoleUrl = opts.consoleUrl.trim().replace(/\/+$/, "");
-  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join9(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync4(p));
+  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join10(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync5(p));
   return {
     consoleUrl,
     interactive: opts.interactive ?? isInteractiveTerminal(),
@@ -4276,12 +4446,17 @@ async function listWorkspacesNeon(accountId2, deps = {}) {
       id: workspaces.id,
       displayName: workspaces.displayName,
       githubOrg: workspaces.githubOrg,
-      createdAt: workspaces.createdAt
+      createdAt: workspaces.createdAt,
+      archived: workspaces.archived
     }).from(workspaces).where(eq(workspaces.accountId, accountId2));
     return rows.map((r) => ({
       id: r.id,
       display_name: r.displayName,
       created_at: (r.createdAt instanceof Date ? r.createdAt : /* @__PURE__ */ new Date()).toISOString(),
+      // The flag `setWorkspaceArchivedNeon` writes; `list.ts` filters on it.
+      // On a cloud host this row IS the roster (no registry.json to carry the
+      // flag), so leaving it out made an archived workspace list forever.
+      archived: r.archived,
       ...r.githubOrg ? { github_org: r.githubOrg } : {}
     }));
   } catch {
@@ -4299,7 +4474,8 @@ async function listVaultsNeon(accountId2, deps = {}) {
       repoRootAbs: vaults.repoRootAbs,
       githubRemote: vaults.githubRemote,
       schemaVersion: vaults.schemaVersion,
-      createdAt: vaults.createdAt
+      createdAt: vaults.createdAt,
+      archived: vaults.archived
     }).from(vaults).where(eq(vaults.accountId, accountId2));
     const grantsDb = deps.db ?? getPostgresAdminDb();
     const grantedRows = await grantsDb.select({
@@ -4309,7 +4485,10 @@ async function listVaultsNeon(accountId2, deps = {}) {
       repoRootAbs: vaults.repoRootAbs,
       githubRemote: vaults.githubRemote,
       schemaVersion: vaults.schemaVersion,
-      createdAt: vaults.createdAt
+      createdAt: vaults.createdAt,
+      archived: vaults.archived,
+      // [[HS-RRCG-8QDO-DIAG-a-shared-vault-is-labelled-read-only-in]] -- the grant's access level must reach the client.
+      access: vaultGrants.access
     }).from(vaultGrants).innerJoin(vaults, eq(vaults.id, vaultGrants.vaultId)).where(and(eq(vaultGrants.accountId, accountId2), ne(vaults.accountId, accountId2)));
     const toRecord = (r, granted) => ({
       id: r.id,
@@ -4321,8 +4500,16 @@ async function listVaultsNeon(accountId2, deps = {}) {
       repo_root_abs: r.repoRootAbs ?? "",
       schema_version: r.schemaVersion,
       registered_at: (r.createdAt instanceof Date ? r.createdAt : /* @__PURE__ */ new Date()).toISOString(),
+      // The flag `setVaultArchivedNeon` writes and `list.ts` filters on. On a
+      // cloud host (VERCEL=1) this row IS the roster -- there is no
+      // registry.json to carry the flag -- so omitting it here is why
+      // `PATCH /api/vaults/:id {archived:true}` answered 200 while
+      // `GET /api/vaults` kept listing the vault with no `archived` field.
+      archived: r.archived,
       ...r.githubRemote ? { github_remote: r.githubRemote } : {},
-      ...granted ? { granted: true } : {}
+      ...granted ? { granted: true } : {},
+      // [[HS-RRCG-8QDO-DIAG-a-shared-vault-is-labelled-read-only-in]]: granted rows only; unknown = read.
+      ...granted ? { access: r.access === "write" ? "write" : "read" } : {}
     });
     return [
       ...ownedRows.map((r) => toRecord(r, false)),
@@ -4332,6 +4519,14 @@ async function listVaultsNeon(accountId2, deps = {}) {
     return null;
   }
 }
+async function classifyZeroRowVaultWrite(db, id, accountId2) {
+  try {
+    const rows = await db.select({ accountId: vaults.accountId }).from(vaults).where(eq(vaults.id, id)).limit(1);
+    return rows[0] && rows[0].accountId !== accountId2 ? "owned_by_other_account" : "not_found";
+  } catch {
+    return "not_found";
+  }
+}
 async function renameVaultNeon(id, displayName, accountId2, deps = {}) {
   if (shouldUseCloudHttp(deps)) {
     return mutateHttp(
@@ -4346,7 +4541,7 @@ async function renameVaultNeon(id, displayName, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.update(vaults).set({ displayName, updatedAt: /* @__PURE__ */ new Date() }).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
-    return rows.length > 0 ? "updated" : "not_found";
+    return rows.length > 0 ? "updated" : classifyZeroRowVaultWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -4361,6 +4556,9 @@ async function moveVaultNeon(id, workspaceId, accountId2, deps = {}) {
     if (res.status === 409 && code === WORKSPACE_OWNED_BY_OTHER_ACCOUNT) {
       return "workspace_owned_by_other_account";
     }
+    if (res.status === 403 && code === VAULT_OWNED_BY_OTHER_ACCOUNT) {
+      return "owned_by_other_account";
+    }
     if (res.status === 404)
       return code === "workspace_not_found" ? "workspace_not_found" : "not_found";
     return cloudWriteFailure(deps.http, res);
@@ -4379,7 +4577,7 @@ async function moveVaultNeon(id, workspaceId, accountId2, deps = {}) {
     ).returning({ id: vaults.id });
     if (rows.length > 0) return "updated";
     const mine = await db.select({ id: vaults.id }).from(vaults).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).limit(1);
-    if (mine.length === 0) return "not_found";
+    if (mine.length === 0) return classifyZeroRowVaultWrite(db, id, accountId2);
     const ws = await db.select({ accountId: workspaces.accountId }).from(workspaces).where(eq(workspaces.id, workspaceId)).limit(1);
     return ws[0] ? "workspace_owned_by_other_account" : "workspace_not_found";
   } catch {
@@ -4394,7 +4592,7 @@ async function setVaultArchivedNeon(id, archived, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.update(vaults).set({ archived, updatedAt: /* @__PURE__ */ new Date() }).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
-    return rows.length > 0 ? "updated" : "not_found";
+    return rows.length > 0 ? "updated" : classifyZeroRowVaultWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -4407,7 +4605,7 @@ async function deleteVaultNeon(id, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.delete(vaults).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
-    return rows.length > 0 ? "deleted" : "not_found";
+    return rows.length > 0 ? "deleted" : classifyZeroRowVaultWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -4468,7 +4666,7 @@ async function repointActiveVaultOnRemoval(accountId2, removedVaultId, removedVa
     return { repointed: false, newActiveId: activeId };
   }
   const registry = loadVaultRegistry(deps.registryOpts);
-  const candidate = registry.vaults.find(
+  const candidate = removedVaultWorkspaceId === null ? void 0 : registry.vaults.find(
     (v) => v.id !== removedVaultId && v.workspace_id === removedVaultWorkspaceId && !v.archived
   );
   if (!candidate) {
@@ -4481,16 +4679,40 @@ async function repointActiveVaultOnRemoval(accountId2, removedVaultId, removedVa
 
 // spex-console/src/lib/vault-registry/archive.ts
 init_registry_file();
+
+// spex-console/src/lib/vault-registry/side-effects.ts
+function isLocalRegistryHost() {
+  const override = process.env.HEYSPEX_VAULT_WRITE_MODE?.trim().toLowerCase();
+  if (override === "cloud") return false;
+  if (override === "local") return true;
+  return process.env.VERCEL !== "1";
+}
+
+// spex-console/src/lib/vault-registry/archive.ts
 function cloudWriteFailed(failure) {
   return { ok: false, code: "cloud_write_failed", message: failure.message };
 }
+function neonUnwritten(kind, id) {
+  return {
+    ok: false,
+    code: "neon_unwritten",
+    message: `${kind} "${id}" was not written to the cloud registry (database unreachable); nothing was changed. Retry once the console can reach its database.`
+  };
+}
 function vaultNotFound(id) {
   return { ok: false, code: "vault_not_found", message: `vault "${id}" not found` };
 }
+function vaultNotOwned(id) {
+  return {
+    ok: false,
+    code: VAULT_OWNED_BY_OTHER_ACCOUNT,
+    message: vaultNotOwnedByCallerMessage(id)
+  };
+}
 async function setVaultArchivedState(input, archived, deps = {}) {
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.vaults.find((v) => v.id === input.id);
-  if (!existing) return vaultNotFound(input.id);
+  const local = isLocalRegistryHost();
+  const existing = local ? loadVaultRegistry(deps.registryOpts).vaults.find((v) => v.id === input.id) : void 0;
+  if (local && !existing) return vaultNotFound(input.id);
   const neonResult = await setVaultArchivedNeon(
     input.id,
     archived,
@@ -4498,21 +4720,23 @@ async function setVaultArchivedState(input, archived, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return vaultNotFound(input.id);
+  if (neonResult === "owned_by_other_account") return vaultNotOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed(neonResult);
+  if (neonResult === "unreachable" && !existing) return neonUnwritten("vault", input.id);
   if (archived) {
-    await repointActiveVaultOnRemoval(input.accountId, input.id, existing.workspace_id, {
+    await repointActiveVaultOnRemoval(input.accountId, input.id, existing?.workspace_id ?? null, {
       registryOpts: deps.registryOpts,
       accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
     });
   }
-  registerVault({ ...existing, archived }, deps.registryOpts);
+  if (existing) registerVault({ ...existing, archived }, deps.registryOpts);
   return {
     ok: true,
     vault: {
       id: input.id,
       archived,
       neon_written: neonResult === "updated",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
@@ -4551,19 +4775,9 @@ function buildCloseNotDestroyConfirm(kind, verb, displayName) {
 }
 
 // spex-console/src/lib/vault-registry/list.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 init_account_pointer();
 init_registry_file();
-
-// spex-console/src/lib/vault-registry/side-effects.ts
-function isLocalRegistryHost() {
-  const override = process.env.HEYSPEX_VAULT_WRITE_MODE?.trim().toLowerCase();
-  if (override === "cloud") return false;
-  if (override === "local") return true;
-  return process.env.VERCEL !== "1";
-}
-
-// spex-console/src/lib/vault-registry/list.ts
 async function defaultNeonReadTierEnabled() {
   const { isNeonReadTierEnabled: isNeonReadTierEnabled2 } = await Promise.resolve().then(() => (init_spec_read_service(), spec_read_service_exports));
   return isNeonReadTierEnabled2();
@@ -4594,7 +4808,7 @@ async function listVaultsForWorkspace(accountId2, workspaceId, deps = {}) {
   const activeId = await getActiveVault(accountId2, sharedPointerDeps) ?? await adoptSole(accountId2, sharedPointerDeps);
   const rows = deps.includeArchived ? allRows : allRows.filter((v) => !v.archived);
   const scoped = workspaceId ? rows.filter((v) => v.workspace_id === workspaceId) : rows;
-  const pathExists = deps.pathExists ?? existsSync5;
+  const pathExists = deps.pathExists ?? existsSync6;
   const anyPathUnusable = scoped.some((v) => !v.repo_root_abs || !pathExists(v.repo_root_abs));
   const neonBackedServeable = anyPathUnusable && neonRows !== null ? await (deps.neonReadTierEnabled ?? defaultNeonReadTierEnabled)() : false;
   return {
@@ -4642,6 +4856,25 @@ function isValidId2(id) {
 function notFound(id) {
   return { ok: false, code: "vault_not_found", message: `vault "${id}" not found` };
 }
+function notOwned(id) {
+  return {
+    ok: false,
+    code: VAULT_OWNED_BY_OTHER_ACCOUNT,
+    message: vaultNotOwnedByCallerMessage(id)
+  };
+}
+function neonUnwritten2(id) {
+  return {
+    ok: false,
+    code: "neon_unwritten",
+    message: `vault "${id}" was not written to the cloud registry (database unreachable); nothing was changed. Retry once the console can reach its database.`
+  };
+}
+function localRow(id, registryOpts) {
+  const local = isLocalRegistryHost();
+  const existing = local ? loadVaultRegistry(registryOpts).vaults.find((v) => v.id === id) : void 0;
+  return { local, existing };
+}
 function cloudWriteFailed2(failure) {
   return { ok: false, code: "cloud_write_failed", message: failure.message };
 }
@@ -4654,20 +4887,21 @@ async function renameVault(input, deps = {}) {
       message: `display name must be 1-${MAX_DISPLAY_NAME_LEN} characters (trimmed)`
     };
   }
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.vaults.find((v) => v.id === input.id);
-  if (!existing) return notFound(input.id);
+  const { local, existing } = localRow(input.id, deps.registryOpts);
+  if (local && !existing) return notFound(input.id);
   const neonResult = await renameVaultNeon(input.id, trimmedName, input.accountId, deps.neon ?? {});
   if (neonResult === "not_found") return notFound(input.id);
+  if (neonResult === "owned_by_other_account") return notOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
-  registerVault({ ...existing, display_name: trimmedName }, deps.registryOpts);
+  if (neonResult === "unreachable" && !existing) return neonUnwritten2(input.id);
+  if (existing) registerVault({ ...existing, display_name: trimmedName }, deps.registryOpts);
   return {
     ok: true,
     vault: {
       id: input.id,
       display_name: trimmedName,
       neon_written: neonResult === "updated",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
@@ -4679,9 +4913,8 @@ async function moveVault(input, deps = {}) {
       message: `invalid workspace id "${String(input.workspaceId)}" -- must be non-empty with no path separators`
     };
   }
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.vaults.find((v) => v.id === input.id);
-  if (!existing) return notFound(input.id);
+  const { local, existing } = localRow(input.id, deps.registryOpts);
+  if (local && !existing) return notFound(input.id);
   const neonResult = await moveVaultNeon(
     input.id,
     input.workspaceId,
@@ -4689,7 +4922,9 @@ async function moveVault(input, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return notFound(input.id);
+  if (neonResult === "owned_by_other_account") return notOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
+  if (neonResult === "unreachable" && !existing) return neonUnwritten2(input.id);
   if (neonResult === "workspace_owned_by_other_account") {
     return {
       ok: false,
@@ -4704,92 +4939,46 @@ async function moveVault(input, deps = {}) {
       message: `workspace "${input.workspaceId}" not found -- create it first (\`hs workspace create\`)`
     };
   }
-  registerVault({ ...existing, workspace_id: input.workspaceId }, deps.registryOpts);
+  if (existing) {
+    registerVault({ ...existing, workspace_id: input.workspaceId }, deps.registryOpts);
+  }
   return {
     ok: true,
     vault: {
       id: input.id,
       workspace_id: input.workspaceId,
       neon_written: neonResult === "updated",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
 async function unregisterVault(input, deps = {}) {
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.vaults.find((v) => v.id === input.id);
-  if (!existing) return notFound(input.id);
+  const { local, existing } = localRow(input.id, deps.registryOpts);
+  if (local && !existing) return notFound(input.id);
   const neonResult = await deleteVaultNeon(input.id, input.accountId, deps.neon ?? {});
   if (neonResult === "not_found") return notFound(input.id);
+  if (neonResult === "owned_by_other_account") return notOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
-  await repointActiveVaultOnRemoval(input.accountId, input.id, existing.workspace_id, {
+  if (neonResult === "unreachable" && !existing) return neonUnwritten2(input.id);
+  await repointActiveVaultOnRemoval(input.accountId, input.id, existing?.workspace_id ?? null, {
     registryOpts: deps.registryOpts,
     accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
   });
-  removeVault(input.id, deps.registryOpts);
+  if (existing) removeVault(input.id, deps.registryOpts);
   return {
     ok: true,
     vault: {
       id: input.id,
       neon_written: neonResult === "deleted",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
 
 // spex-console/src/lib/vault-resolve/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import path3 from "node:path";
-
-// spex-console/src/lib/cli/satellite.ts
-init_registry_file();
-import { resolve as resolveNodePath } from "node:path";
-import process2 from "node:process";
-var SATELLITE_VAULT_ENV = "HEYSPEX_VAULT_ROOT";
-var SATELLITE_MANIFEST_RELS = [
-  [".mcp.json"],
-  [".cursor", "mcp.json"]
-];
-function normalizePathForCompare(p) {
-  return p.trim().replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
-}
-function samePath(a, b) {
-  return normalizePathForCompare(a) === normalizePathForCompare(b);
-}
-function isAtOrUnder(child, parent) {
-  const c = normalizePathForCompare(child);
-  const p = normalizePathForCompare(parent);
-  return c === p || c.startsWith(`${p}/`);
-}
-function isAbsolutePathForCompare(p) {
-  const s = p.trim();
-  return /^[\\/]/.test(s) || /^[a-zA-Z]:[\\/]/.test(s);
-}
-function readPinnedVaultRoot(repoRoot, deps) {
-  const pins = [];
-  for (const rel of SATELLITE_MANIFEST_RELS) {
-    const path5 = deps.joinPath(repoRoot, ...rel);
-    if (!deps.fileExists(path5)) continue;
-    const raw = deps.readFile(path5);
-    if (!raw) continue;
-    let value;
-    try {
-      const parsed = JSON.parse(raw);
-      value = parsed?.mcpServers?.heyspex?.env?.[SATELLITE_VAULT_ENV];
-    } catch {
-      continue;
-    }
-    if (typeof value !== "string") continue;
-    const trimmed = value.trim();
-    if (!trimmed || trimmed.includes("${")) continue;
-    if (!isAbsolutePathForCompare(trimmed)) continue;
-    pins.push({ source: rel.join("/"), value: trimmed });
-  }
-  return pins;
-}
-
-// spex-console/src/lib/vault-resolve/index.ts
 var UNREGISTERED_VAULT_ID2 = "unregistered";
 var NoActiveVaultError = class _NoActiveVaultError extends Error {
   constructor(message2 = "resolveActiveVaultRoot: no active vault found -- no explicit vaultId, no heyspex.yaml or specs/ directory at or above cwd, no HEYSPEX_VAULT_ROOT/HEYSPEX_VAULT_DIR env, and no account active_vault_id. Run `hs vault register` to register a vault.") {
@@ -4823,22 +5012,40 @@ function parseMarkerVaultId(content) {
 }
 function readMarkerVaultId(dir) {
   try {
-    return parseMarkerVaultId(readFileSync9(path3.join(dir, "heyspex.yaml"), "utf8"));
+    return parseMarkerVaultId(readFileSync10(path3.join(dir, "heyspex.yaml"), "utf8"));
   } catch {
     return null;
   }
 }
+function readMarkerSatellite(dir) {
+  let raw;
+  try {
+    raw = readFileSync10(path3.join(dir, "heyspex.yaml"), "utf8");
+  } catch {
+    return null;
+  }
+  const vaultPath = parseMarkerVaultPath(raw);
+  if (!vaultPath) return null;
+  const vaultId = parseMarkerVaultId(raw);
+  const candidate = path3.resolve(dir, vaultPath);
+  let vaultRootAbs = null;
+  if (candidate.toLowerCase() !== path3.resolve(dir).toLowerCase() && isVaultRootDir(candidate)) {
+    const theirs = readMarkerVaultId(candidate);
+    if (!vaultId || !theirs || theirs === vaultId) vaultRootAbs = candidate;
+  }
+  return { vaultId, vaultRootAbs };
+}
 function isVaultRootDir(dir) {
   const norm = (p) => path3.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
   if (norm(dir) === norm(tmpdir2())) return false;
-  return existsSync6(path3.join(dir, "heyspex.yaml")) || existsSync6(path3.join(dir, "specs"));
+  return existsSync7(path3.join(dir, "heyspex.yaml")) || existsSync7(path3.join(dir, "specs"));
 }
 function findCwdVaultOrAttachment(startDir, stopAt) {
   const deps = {
-    fileExists: (p) => existsSync6(p),
+    fileExists: (p) => existsSync7(p),
     readFile: (p) => {
       try {
-        return readFileSync9(p, "utf8");
+        return readFileSync10(p, "utf8");
       } catch {
         return null;
       }
@@ -4848,6 +5055,14 @@ function findCwdVaultOrAttachment(startDir, stopAt) {
   const boundary = stopAt ? path3.resolve(stopAt) : null;
   let dir = startDir;
   for (let i = 0; i < 256; i += 1) {
+    const marked = readMarkerSatellite(dir);
+    if (marked) {
+      return {
+        repoRootAbs: marked.vaultRootAbs ?? dir,
+        satellite: true,
+        markerVaultId: marked.vaultId
+      };
+    }
     const pinned = readPinnedVaultRoot(dir, deps).find((pin) => !isAtOrUnder(pin.value, dir));
     if (pinned) return { repoRootAbs: path3.resolve(pinned.value), satellite: true };
     if (isVaultRootDir(dir)) return { repoRootAbs: dir, satellite: false };
@@ -4893,6 +5108,9 @@ async function resolveActiveVaultRoot(options = {}) {
   const cwdMatch = findCwdVaultOrAttachment(cwdBase, options.cwdWalkRoot);
   if (cwdMatch?.satellite) {
     onTier({ tier: "satellite-pin", outcome: "resolved", detail: cwdMatch.repoRootAbs });
+    if (cwdMatch.markerVaultId) {
+      return finalize(cwdMatch.markerVaultId, path3.resolve(cwdMatch.repoRootAbs), "satellite-pin");
+    }
     return finalizePathTier(cwdMatch.repoRootAbs, "satellite-pin");
   }
   if (cwdMatch) {
@@ -5923,7 +6141,7 @@ function statusForVaultManageError(code) {
   if (code === "workspace_owned_by_other_account" || code === "vault_owned_by_other_account") {
     return EXIT.CONFLICT;
   }
-  if (code === "cloud_write_failed") return EXIT.CLOUD_WRITE_FAILED;
+  if (code === "cloud_write_failed" || code === "neon_unwritten") return EXIT.CLOUD_WRITE_FAILED;
   return EXIT.INVALID_ARG;
 }
 async function manageWithReceipt(verb, vaultId, effectiveAccountId, deps, retry, write, success, expected) {
@@ -6338,7 +6556,7 @@ function runEntry(name, main2, options = {}) {
 // spex-console/bin/hs-vault.ts
 function readFile(p) {
   try {
-    return readFileSync10(p, "utf8");
+    return readFileSync11(p, "utf8");
   } catch {
     return null;
   }
@@ -6397,7 +6615,7 @@ async function main() {
   const result = await runVault(
     parsed.args,
     {
-      fileExists: (p) => existsSync7(p),
+      fileExists: (p) => existsSync8(p),
       readFile,
       resolvePath: (p) => path4.resolve(invokedCwd, p),
       joinPath: (...s) => path4.join(...s),
@@ -6405,7 +6623,7 @@ async function main() {
       now: () => (/* @__PURE__ */ new Date()).toISOString(),
       cwd,
       conflictScan: {
-        fileExists: (p) => existsSync7(p),
+        fileExists: (p) => existsSync8(p),
         readFile,
         joinPath: (...s) => path4.join(...s)
       },