heyspex 0.2.2 → 0.2.4

package/dev-factory/lib/fleet-readiness.mjs

@@ -14,7 +14,8 @@
 import { loadFleetState } from "./fleet-state.mjs";
 import { readFileSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+import { isMainModule } from "../../scripts/lib/shared-path-helpers.mjs";
 
 export const DEFAULT_FLEET_FRESHNESS_MS = 15 * 60 * 1000; // 15 minutes
 
@@ -266,9 +267,6 @@ function runSelfTest() {
   return ok ? 0 : 1;
 }
 
-if (
-  process.argv[1] &&
-  pathToFileURL(process.argv[1]).href === import.meta.url
-) {
+if (isMainModule(import.meta.url)) {
   if (process.argv.includes("--self-test")) process.exit(runSelfTest());
 }

package/dev-factory/lib/fleet-state.mjs

@@ -30,7 +30,7 @@
 
 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { pathToFileURL } from "node:url";
+import { isMainModule } from "../../scripts/lib/shared-path-helpers.mjs";
 import { tmpdir } from "node:os";
 import { codeRepoRoot } from "./code-repo-root.mjs";
 import { OLLAMA } from "./model-catalog.mjs";
@@ -232,7 +232,7 @@ function runSelfTest() {
 }
 
 // ── Main ─────────────────────────────────────────────────────────────────────────
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+if (isMainModule(import.meta.url)) {
   if (process.argv.includes("--self-test")) process.exit(runSelfTest());
   console.log([
     "lib/fleet-state.mjs — per-machine runtime state sidecar (.heyspex/fleet-state.json).",

package/dev-factory/lib/sufficiency-score.mjs

@@ -42,7 +42,8 @@
  * `node dev-factory/lib/sufficiency-score.mjs --self-test`).
  */
 
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+import { isMainModule } from "../../scripts/lib/shared-path-helpers.mjs";
 import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 
@@ -439,9 +440,6 @@ function runSelfTest() {
   return ok ? 0 : 1;
 }
 
-if (
-  process.argv[1] &&
-  pathToFileURL(process.argv[1]).href === import.meta.url
-) {
+if (isMainModule(import.meta.url)) {
   if (process.argv.includes("--self-test")) process.exit(runSelfTest());
 }

package/dist/cli/hs-check.mjs

@@ -124,9 +124,9 @@ function resolveBearer({ envToken, credentialsText, accountId, legacyAccountId }
   if (entry?.mcp_token) return { token: entry.mcp_token, source: "credentials-file" };
   return { token: null, source: null };
 }
-function readTextOrNull(read, path3) {
+function readTextOrNull(read, path4) {
   try {
-    const raw = read(path3);
+    const raw = read(path4);
     return typeof raw === "string" ? raw : null;
   } catch {
     return null;
@@ -169,8 +169,8 @@ var init_credentials = __esm({
 });
 
 // scripts/lib/dev-mode.mjs
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
 import { join as join8 } from "node:path";
 function devModeFilePath(homeDir = heyspexHome()) {
   return join8(homeDir, ".heyspex", DEV_MODE_FILENAME);
@@ -225,6 +225,11 @@ function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile = defaultRea
     return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
   }
 }
+function overrideCloudCheck(source, cloudKnown, staleAgainstCloud) {
+  if (source !== "local-override") return "not-applicable";
+  if (!cloudKnown) return "unverified";
+  return staleAgainstCloud ? "stale" : "in-sync";
+}
 function resolveDevMode({
   env = process.env,
   homeDir = heyspexHome(),
@@ -264,6 +269,7 @@ function resolveDevMode({
   const semantics = deriveSemantics(mode, reliance);
   const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
   const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  const cloudCheck = overrideCloudCheck(source, cloudKnown, staleAgainstCloud);
   return {
     mode,
     reliance: semantics.reliance,
@@ -281,7 +287,8 @@ function resolveDevMode({
       present: local.record !== null,
       record: local.record,
       parseError: local.parseError,
-      staleAgainstCloud
+      staleAgainstCloud,
+      cloudCheck
     },
     cloudSetting: { known: cloudKnown, value: cloudValue }
   };
@@ -295,18 +302,20 @@ var init_dev_mode = __esm({
     CLOUD_CONSOLE_URL = "https://app.heyspex.com";
     LOCAL_CONSOLE_URL = "http://localhost:3000";
     DEV_MODE_FILENAME = "dev-mode.json";
-    defaultReadFile = (p) => readFileSync7(p, "utf8");
+    defaultReadFile = (p) => readFileSync8(p, "utf8");
   }
 });
 
 // spex-console/bin/hs-check.ts
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync9 } from "node:fs";
-import path2 from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync10 } from "node:fs";
+import path3 from "node:path";
 import process3 from "node:process";
 
 // scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 function resolveCodeRoot({
   explicit,
   packageRoot,
@@ -751,16 +760,16 @@ var HELP = [
 ].join("\n");
 
 // spex-console/src/lib/cli/control-shared.ts
-import path from "node:path";
+import path2 from "node:path";
 
 // scripts/lib/hs-command.mjs
 import { existsSync } from "node:fs";
 import { delimiter, dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var HS_BIN_NAME = "hs";
 var HS_DISPATCHER_PATH = (() => {
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
+    const here = dirname(fileURLToPath2(import.meta.url));
     return join(dirname(dirname(here)), "bin", "hs.mjs");
   } catch {
     return null;
@@ -841,8 +850,8 @@ function hsCommand(args = "", options = {}) {
 // vendor/heyspex-mcp/console-fetch.mjs
 init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { join as join6 } from "node:path";
 
 // vendor/heyspex-mcp/session-owner.mjs
@@ -867,14 +876,14 @@ var VAULT_LESS_ENDPOINTS = Object.freeze([
   "GET /api/workspaces",
   "* /api/admin/dev-mode"
 ]);
-function pathnameOf(path3) {
-  const raw = String(path3 ?? "").split("?")[0].split("#")[0];
+function pathnameOf(path4) {
+  const raw = String(path4 ?? "").split("?")[0].split("#")[0];
   const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
   return noTrailing || "/";
 }
-function isVaultLessEndpoint(method, path3) {
+function isVaultLessEndpoint(method, path4) {
   const m = String(method || "GET").toUpperCase();
-  const pathname = pathnameOf(path3);
+  const pathname = pathnameOf(path4);
   return VAULT_LESS_ENDPOINTS.some((row) => {
     const [rowMethod, rowPath] = row.split(" ");
     return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
@@ -895,9 +904,30 @@ import { basename, join as join4, isAbsolute as isAbsolute2 } from "node:path";
 
 // vendor/heyspex-mcp/vault-resolve.mjs
 init_heyspex_home();
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4, tmpdir } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { homedir as homedir5, tmpdir } from "node:os";
+
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync2,
+  renameSync as renameSync3,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var VAULT_NOT_REGISTERED = "VAULT_NOT_REGISTERED";
@@ -929,7 +959,7 @@ function isCloudVaultId(value) {
 var MARKER_VAULT_ID_RE = /^vault_id:[ \t]*["']?([^"'\r\n#]+)/m;
 function readMarkerVaultId(repoRootAbs, { readFile } = {}) {
   if (typeof repoRootAbs !== "string" || !repoRootAbs.trim()) return null;
-  const read = readFile ?? ((p) => readFileSync5(p, "utf8"));
+  const read = readFile ?? ((p) => readFileSync6(p, "utf8"));
   try {
     const raw = read(join6(repoRootAbs, "heyspex.yaml"));
     const value = String(raw ?? "").match(MARKER_VAULT_ID_RE)?.[1]?.trim() ?? "";
@@ -951,17 +981,17 @@ var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMAT
 init_credentials();
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 
 // spex-console/src/lib/heyspex-home.ts
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 function heyspexHome2(env = process.env) {
   const override = env?.HEYSPEX_HOME;
   if (typeof override === "string" && override.trim().length > 0) {
     return override.trim();
   }
-  return homedir6();
+  return homedir7();
 }
 
 // spex-console/src/lib/vault-registry/types.ts
@@ -1083,9 +1113,9 @@ function parseVaultRegistryFile(json) {
 }
 function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync4(filePath)) return { kind: "missing" };
+  if (!existsSync5(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync6(filePath, "utf8");
+    const raw = readFileSync7(filePath, "utf8");
     const json = JSON.parse(raw);
     if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
     return { kind: "ok", raw, json };
@@ -1220,11 +1250,11 @@ function bearerHeaderFor(consoleUrl, opts = {}) {
     return {};
   }
 }
-function scopeHeadersFor(scope, method, path3) {
+function scopeHeadersFor(scope, method, path4) {
   if (scope === "none") {
-    if (!isVaultLessEndpoint(method, path3)) {
+    if (!isVaultLessEndpoint(method, path4)) {
       throw new Error(
-        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path3} is vault-scoped and must name { accountId, vaultId }.`
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path4} is vault-scoped and must name { accountId, vaultId }.`
       );
     }
     return {};
@@ -1293,7 +1323,7 @@ async function controlRequest(deps, req) {
   return { ok: true, status: res.status, body: parsed };
 }
 function normalizeRoot(p) {
-  return path.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
+  return path2.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
 }
 function resolveControlScope(input) {
   const target = normalizeRoot(input.vaultRoot);
@@ -1362,8 +1392,8 @@ function resolveControlScopeFromMachine(vaultRoot, opts = {}) {
 // scripts/lib/console-url-resolver.mjs
 init_heyspex_home();
 init_dev_mode();
-import { readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { join as join9 } from "node:path";
 var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
@@ -1401,7 +1431,7 @@ function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile = default
   }
 }
 function defaultReadFile2(p) {
-  return readFileSync8(p, "utf8");
+  return readFileSync9(p, "utf8");
 }
 function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
   if (!repoRoot) return null;
@@ -1527,14 +1557,14 @@ function runEntry(name, main2, options = {}) {
 
 // spex-console/bin/hs-check.ts
 function manifestForSpecId(vaultRoot, specId) {
-  return path2.join(vaultRoot, "specs", "checks", `${specId}.checks.json`);
+  return path3.join(vaultRoot, "specs", "checks", `${specId}.checks.json`);
 }
 function resolveManifestPath(target, vaultRoot, invokedCwd) {
-  const literal = path2.resolve(invokedCwd, target);
-  if (existsSync5(literal)) return literal;
+  const literal = path3.resolve(invokedCwd, target);
+  if (existsSync6(literal)) return literal;
   if (target.endsWith(".json")) return null;
   const byId = manifestForSpecId(vaultRoot, target);
-  return existsSync5(byId) ? byId : null;
+  return existsSync6(byId) ? byId : null;
 }
 function countTscErrors(output) {
   const matches = output.match(/error TS\d+/g);
@@ -1548,12 +1578,12 @@ function resolveWindowsPosixShell() {
     "C:\\Program Files\\Git\\bin\\bash.exe"
   ].filter((c) => typeof c === "string" && c.length > 0);
   for (const candidate of candidates) {
-    if (existsSync5(candidate)) return cachedPosixShell = candidate;
+    if (existsSync6(candidate)) return cachedPosixShell = candidate;
   }
   const where = spawnSync("where", ["bash"], { encoding: "utf8", windowsHide: true });
   if (where.status === 0 && where.stdout) {
     const hit = where.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).find((line) => !/\\system32\\/i.test(line));
-    if (hit && existsSync5(hit)) return cachedPosixShell = hit;
+    if (hit && existsSync6(hit)) return cachedPosixShell = hit;
   }
   return cachedPosixShell = null;
 }
@@ -1610,7 +1640,7 @@ function makeRunCheck(vaultRoot, codeRoot) {
   return async (check) => {
     const cwds = resolveCheckCwds(check, {
       repoRoot: codeRoot,
-      consoleRoot: path2.join(codeRoot, "spex-console"),
+      consoleRoot: path3.join(codeRoot, "spex-console"),
       vaultRoot
     });
     let lastFailure = null;
@@ -1641,8 +1671,8 @@ async function main() {
   }
   if (process3.argv[3] === "judge") {
     const pkgRoot = resolveCodeRoot({ vaultRoot });
-    const judgeScript = path2.join(pkgRoot, "dev-factory", "judge.mjs");
-    if (!existsSync5(judgeScript)) {
+    const judgeScript = path3.join(pkgRoot, "dev-factory", "judge.mjs");
+    if (!existsSync6(judgeScript)) {
       process3.stderr.write(
         `hs check judge: script not found at ${judgeScript} (source checkout only \u2014 not available in a published install).
 `
@@ -1678,13 +1708,13 @@ async function main() {
   if (!manifestPath) {
     process3.stderr.write(
       `hs check: no manifest for "${args.target}".
-  Pass a manifest path, or create ${path2.join("specs", "checks", `${args.target}.checks.json`)} under the vault root.
+  Pass a manifest path, or create ${path3.join("specs", "checks", `${args.target}.checks.json`)} under the vault root.
 `
     );
     process3.exitCode = EXIT.NOT_FOUND;
     return;
   }
-  const { manifest, error } = parseChecksManifest(readFileSync9(manifestPath, "utf-8"));
+  const { manifest, error } = parseChecksManifest(readFileSync10(manifestPath, "utf-8"));
   if (error) {
     process3.stderr.write(`hs check: ${manifestPath}: ${error}
 `);
@@ -1716,7 +1746,7 @@ async function main() {
   process3.exitCode = reportExitCode(report);
 }
 async function reportVerdict(target, report, vaultRoot, unattended = false) {
-  if (existsSync5(target) || target.endsWith(".json")) {
+  if (existsSync6(target) || target.endsWith(".json")) {
     process3.stderr.write(
       "hs check: --report needs a spec-id target (to identify the claim), not a manifest path.\n"
     );
@@ -1724,7 +1754,7 @@ async function reportVerdict(target, report, vaultRoot, unattended = false) {
   }
   const consoleUrl = resolveSpexConsoleUrl(vaultRoot, (p) => {
     try {
-      return readFileSync9(p, "utf-8");
+      return readFileSync10(p, "utf-8");
     } catch {
       return null;
     }

package/dist/cli/hs-claim.mjs

@@ -124,9 +124,9 @@ function resolveBearer({ envToken, credentialsText, accountId, legacyAccountId }
   if (entry?.mcp_token) return { token: entry.mcp_token, source: "credentials-file" };
   return { token: null, source: null };
 }
-function readTextOrNull(read, path2) {
+function readTextOrNull(read, path3) {
   try {
-    const raw = read(path2);
+    const raw = read(path3);
     return typeof raw === "string" ? raw : null;
   } catch {
     return null;
@@ -169,8 +169,8 @@ var init_credentials = __esm({
 });
 
 // scripts/lib/dev-mode.mjs
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
 import { join as join8 } from "node:path";
 function devModeFilePath(homeDir = heyspexHome()) {
   return join8(homeDir, ".heyspex", DEV_MODE_FILENAME);
@@ -225,6 +225,11 @@ function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile = defaultRea
     return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
   }
 }
+function overrideCloudCheck(source, cloudKnown, staleAgainstCloud) {
+  if (source !== "local-override") return "not-applicable";
+  if (!cloudKnown) return "unverified";
+  return staleAgainstCloud ? "stale" : "in-sync";
+}
 function resolveDevMode({
   env = process.env,
   homeDir = heyspexHome(),
@@ -264,6 +269,7 @@ function resolveDevMode({
   const semantics = deriveSemantics(mode, reliance);
   const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
   const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  const cloudCheck = overrideCloudCheck(source, cloudKnown, staleAgainstCloud);
   return {
     mode,
     reliance: semantics.reliance,
@@ -281,7 +287,8 @@ function resolveDevMode({
       present: local.record !== null,
       record: local.record,
       parseError: local.parseError,
-      staleAgainstCloud
+      staleAgainstCloud,
+      cloudCheck
     },
     cloudSetting: { known: cloudKnown, value: cloudValue }
   };
@@ -295,12 +302,12 @@ var init_dev_mode = __esm({
     CLOUD_CONSOLE_URL = "https://app.heyspex.com";
     LOCAL_CONSOLE_URL = "http://localhost:3000";
     DEV_MODE_FILENAME = "dev-mode.json";
-    defaultReadFile = (p) => readFileSync7(p, "utf8");
+    defaultReadFile = (p) => readFileSync8(p, "utf8");
   }
 });
 
 // spex-console/bin/hs-claim.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import process3 from "node:process";
 
 // spex-console/src/lib/work-stages.ts
@@ -344,7 +351,7 @@ function resolveAgentIdentity(argAgent, argSession) {
 }
 
 // spex-console/src/lib/cli/control-shared.ts
-import path from "node:path";
+import path2 from "node:path";
 
 // scripts/lib/hs-command.mjs
 import { existsSync } from "node:fs";
@@ -434,8 +441,8 @@ function hsCommand(args = "", options = {}) {
 // vendor/heyspex-mcp/console-fetch.mjs
 init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { join as join6 } from "node:path";
 
 // vendor/heyspex-mcp/session-owner.mjs
@@ -460,14 +467,14 @@ var VAULT_LESS_ENDPOINTS = Object.freeze([
   "GET /api/workspaces",
   "* /api/admin/dev-mode"
 ]);
-function pathnameOf(path2) {
-  const raw = String(path2 ?? "").split("?")[0].split("#")[0];
+function pathnameOf(path3) {
+  const raw = String(path3 ?? "").split("?")[0].split("#")[0];
   const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
   return noTrailing || "/";
 }
-function isVaultLessEndpoint(method, path2) {
+function isVaultLessEndpoint(method, path3) {
   const m = String(method || "GET").toUpperCase();
-  const pathname = pathnameOf(path2);
+  const pathname = pathnameOf(path3);
   return VAULT_LESS_ENDPOINTS.some((row) => {
     const [rowMethod, rowPath] = row.split(" ");
     return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
@@ -487,13 +494,36 @@ import {
 import { basename, join as join4, isAbsolute as isAbsolute2 } from "node:path";
 
 // scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve as resolve2, sep } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // vendor/heyspex-mcp/vault-resolve.mjs
 init_heyspex_home();
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4, tmpdir } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { homedir as homedir5, tmpdir } from "node:os";
+
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync2,
+  renameSync as renameSync3,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var VAULT_NOT_REGISTERED = "VAULT_NOT_REGISTERED";
@@ -525,7 +555,7 @@ function isCloudVaultId(value) {
 var MARKER_VAULT_ID_RE = /^vault_id:[ \t]*["']?([^"'\r\n#]+)/m;
 function readMarkerVaultId(repoRootAbs, { readFile } = {}) {
   if (typeof repoRootAbs !== "string" || !repoRootAbs.trim()) return null;
-  const read = readFile ?? ((p) => readFileSync5(p, "utf8"));
+  const read = readFile ?? ((p) => readFileSync6(p, "utf8"));
   try {
     const raw = read(join6(repoRootAbs, "heyspex.yaml"));
     const value = String(raw ?? "").match(MARKER_VAULT_ID_RE)?.[1]?.trim() ?? "";
@@ -547,17 +577,17 @@ var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMAT
 init_credentials();
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 
 // spex-console/src/lib/heyspex-home.ts
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 function heyspexHome2(env = process.env) {
   const override = env?.HEYSPEX_HOME;
   if (typeof override === "string" && override.trim().length > 0) {
     return override.trim();
   }
-  return homedir6();
+  return homedir7();
 }
 
 // spex-console/src/lib/vault-registry/types.ts
@@ -679,9 +709,9 @@ function parseVaultRegistryFile(json) {
 }
 function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync4(filePath)) return { kind: "missing" };
+  if (!existsSync5(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync6(filePath, "utf8");
+    const raw = readFileSync7(filePath, "utf8");
     const json = JSON.parse(raw);
     if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
     return { kind: "ok", raw, json };
@@ -816,11 +846,11 @@ function bearerHeaderFor(consoleUrl, opts = {}) {
     return {};
   }
 }
-function scopeHeadersFor(scope, method, path2) {
+function scopeHeadersFor(scope, method, path3) {
   if (scope === "none") {
-    if (!isVaultLessEndpoint(method, path2)) {
+    if (!isVaultLessEndpoint(method, path3)) {
       throw new Error(
-        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path2} is vault-scoped and must name { accountId, vaultId }.`
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path3} is vault-scoped and must name { accountId, vaultId }.`
       );
     }
     return {};
@@ -914,7 +944,7 @@ function parseTtl(token) {
   return { value: n };
 }
 function normalizeRoot(p) {
-  return path.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
+  return path2.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
 }
 function resolveControlScope(input) {
   const target = normalizeRoot(input.vaultRoot);
@@ -1184,8 +1214,8 @@ ${lines}`,
     return writeFailed(res2.status, res2.body);
   }
   const releaser = resolveAgentIdentity(args.agent, args.session).agent;
-  const path2 = `/api/control/active-claims/${encodeURIComponent(args.specId)}?agent=${encodeURIComponent(releaser)}`;
-  const res = await controlRequest(deps, { method: "DELETE", path: path2 });
+  const path3 = `/api/control/active-claims/${encodeURIComponent(args.specId)}?agent=${encodeURIComponent(releaser)}`;
+  const res = await controlRequest(deps, { method: "DELETE", path: path3 });
   if (!res.ok) return res.error;
   if (res.status === 200) {
     return {
@@ -1245,8 +1275,8 @@ var HELP = [
 // scripts/lib/console-url-resolver.mjs
 init_heyspex_home();
 init_dev_mode();
-import { readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { join as join9 } from "node:path";
 var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
@@ -1284,7 +1314,7 @@ function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile = default
   }
 }
 function defaultReadFile2(p) {
-  return readFileSync8(p, "utf8");
+  return readFileSync9(p, "utf8");
 }
 function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery: readDiscovery2 = defaultReadFile2 } = {}) {
   if (!repoRoot) return null;
@@ -1411,7 +1441,7 @@ function runEntry(name, main2, options = {}) {
 // spex-console/bin/hs-claim.ts
 function readDiscovery(p) {
   try {
-    return readFileSync9(p, "utf-8");
+    return readFileSync10(p, "utf-8");
   } catch {
     return null;
   }