indelible-mcp 4.9.3 → 4.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indelible-mcp",
-  "version": "4.9.3",
+  "version": "4.9.5",
   "description": "Blockchain-backed memory and code storage for Claude Code. Save AI conversations and source code permanently on BSV.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -14,7 +14,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// lib/crypto.js
+// mcp-server/lib/crypto.js
 import { createCipheriv, createDecipheriv, createHash, randomBytes, pbkdf2Sync } from "crypto";
 function deriveKey(wif) {
   return createHash("sha256").update(wif).digest();
@@ -69,11 +69,20 @@ function decryptWif(encryptedObj, pin) {
   return decrypted;
 }
 var init_crypto = __esm({
-  "lib/crypto.js"() {
+  "mcp-server/lib/crypto.js"() {
   }
 });
 
-// lib/config.customer.js
+// mcp-server/lib/config.customer.js
+var config_customer_exports = {};
+__export(config_customer_exports, {
+  getConfigPath: () => getConfigPath,
+  getWif: () => getWif,
+  hasWallet: () => hasWallet,
+  loadConfig: () => loadConfig,
+  saveConfig: () => saveConfig,
+  updateConfig: () => updateConfig
+});
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -98,6 +107,10 @@ function updateConfig(mutator) {
   saveConfig(next);
   return next;
 }
+function hasWallet() {
+  const config = loadConfig();
+  return config?.wif_encrypted != null || config?.wif != null;
+}
 async function getWif() {
   if (_cachedWif) return _cachedWif;
   const config = loadConfig();
@@ -124,7 +137,7 @@ async function getWif() {
 }
 var CONFIG_DIR, CONFIG_FILE, _cachedWif;
 var init_config_customer = __esm({
-  "lib/config.customer.js"() {
+  "mcp-server/lib/config.customer.js"() {
     init_crypto();
     CONFIG_DIR = join(homedir(), ".indelible");
     CONFIG_FILE = join(CONFIG_DIR, "config.json");
@@ -132,7 +145,7 @@ var init_config_customer = __esm({
   }
 });
 
-// lib/spv.js
+// mcp-server/lib/spv.js
 import { Transaction, P2PKH, PrivateKey, SatoshisPerKilobyte, LockingScript, OP } from "@bsv/sdk";
 import { Transaction as Transaction2, P2PKH as P2PKH2, PrivateKey as PrivateKey2, SatoshisPerKilobyte as SatoshisPerKilobyte2, LockingScript as LockingScript2, OP as OP2 } from "@bsv/sdk";
 async function getBridges() {
@@ -545,7 +558,7 @@ async function buildPaymentTx(wif, utxos, payToAddress, satoshis) {
 }
 var SEED_BRIDGES, OLD_BRIDGE_IPS, bridgeHealth, HEALTH_CHECK_INTERVAL, MAX_FAILURES, migrationDone, _stickyBridge, STICKY_WINDOW_MS;
 var init_spv = __esm({
-  "lib/spv.js"() {
+  "mcp-server/lib/spv.js"() {
     init_config_customer();
     SEED_BRIDGES = [
       { url: "http://144.202.48.217:9333", name: "bridge-alpha" },
@@ -573,7 +586,7 @@ var init_spv = __esm({
   }
 });
 
-// lib/utxo-cache.js
+// mcp-server/lib/utxo-cache.js
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
@@ -624,13 +637,13 @@ function invalidate(address) {
 }
 var DIR, CACHE_PATH;
 var init_utxo_cache = __esm({
-  "lib/utxo-cache.js"() {
+  "mcp-server/lib/utxo-cache.js"() {
     DIR = join2(homedir2(), ".indelible");
     CACHE_PATH = process.env.INDELIBLE_UTXO_CACHE || join2(DIR, "utxo-cache.json");
   }
 });
 
-// lib/summary.js
+// mcp-server/lib/summary.js
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 function encryptSummary(plaintext, wif, txId) {
   if (!txId || typeof txId !== "string" || !TXID_REGEX.test(txId)) {
@@ -679,7 +692,7 @@ function decryptSummaryOrLock(summary_enc, wif, expectedTxId) {
 }
 var TXID_REGEX, LOCK_PLACEHOLDER;
 var init_summary = __esm({
-  "lib/summary.js"() {
+  "mcp-server/lib/summary.js"() {
     init_crypto();
     TXID_REGEX = /^[0-9a-f]{64}$/i;
     LOCK_PLACEHOLDER = {
@@ -692,7 +705,7 @@ var init_summary = __esm({
   }
 });
 
-// lib/wallet-brc100.js
+// mcp-server/lib/wallet-brc100.js
 import { PrivateKey as PrivateKey3, CompletedProtoWallet, AuthFetch } from "@bsv/sdk";
 function createAuthClient(wif) {
   if (!wif) throw new Error("createAuthClient: wif required");
@@ -712,13 +725,13 @@ function createAuthClient(wif) {
 }
 var cached, cachedWif;
 var init_wallet_brc100 = __esm({
-  "lib/wallet-brc100.js"() {
+  "mcp-server/lib/wallet-brc100.js"() {
     cached = null;
     cachedWif = null;
   }
 });
 
-// lib/api-client.js
+// mcp-server/lib/api-client.js
 var api_client_exports = {};
 __export(api_client_exports, {
   buildReceipt: () => buildReceipt,
@@ -785,7 +798,7 @@ async function checkTier(apiKey) {
     });
     if (res.status === 429) {
       const data = await res.json().catch(() => ({}));
-      throw new Error(`Monthly save limit reached (${data.limit || 50}). Upgrade at indelible.one/pricing`);
+      throw new Error(`Save limit reached${data.limit ? ` (${data.limit})` : ""}. See indelible.one/pricing`);
     }
     if (res.ok) {
       const data = await res.json();
@@ -1100,7 +1113,7 @@ async function checkConnection() {
 }
 var DEFAULT_API_URL, TIER2_CACHE_TTL_MS, TIER2_BACKOFF_TTL_MS, TIER2_BACKOFF_THRESHOLD, tier2Cache, tier2TransientFailures;
 var init_api_client = __esm({
-  "lib/api-client.js"() {
+  "mcp-server/lib/api-client.js"() {
     init_config_customer();
     init_spv();
     init_utxo_cache();
@@ -1115,7 +1128,7 @@ var init_api_client = __esm({
   }
 });
 
-// lib/share.js
+// mcp-server/lib/share.js
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, createHash as createHash2, randomBytes as randomBytes3, hkdfSync } from "node:crypto";
 import { PrivateKey as PrivateKey5, PublicKey, Signature, ProtoWallet } from "@bsv/sdk";
 function isValidP2PKH(addr) {
@@ -1415,7 +1428,7 @@ async function unwrapRecoveryV3(wrapHex, wallet, keyID, ownerPubkeyHex) {
 }
 var HKDF_INFO, TXID_REGEX2, P2PKH_REGEX, CANONICAL_FIELDS, SELF_WRAP_TXID, ENCRYPT_PROTOCOL_ID_V2;
 var init_share = __esm({
-  "lib/share.js"() {
+  "mcp-server/lib/share.js"() {
     HKDF_INFO = "indelible-share-v1";
     TXID_REGEX2 = /^[0-9a-f]{64}$/i;
     P2PKH_REGEX = /^1[1-9A-HJ-NP-Za-km-z]{25,34}$/;
@@ -1433,7 +1446,7 @@ var init_share = __esm({
   }
 });
 
-// lib/save-log.js
+// mcp-server/lib/save-log.js
 import { appendFileSync, readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "fs";
 import { join as join3 } from "path";
 import { homedir as homedir3 } from "os";
@@ -1470,13 +1483,13 @@ function appendReceipt(receipt, meta = {}) {
 }
 var DIR2, LOG;
 var init_save_log = __esm({
-  "lib/save-log.js"() {
+  "mcp-server/lib/save-log.js"() {
     DIR2 = join3(homedir3(), ".indelible");
     LOG = join3(DIR2, "save-log.jsonl");
   }
 });
 
-// lib/advisory/index.customer.js
+// mcp-server/lib/advisory/index.customer.js
 function extractAnchors() {
   return null;
 }
@@ -1521,11 +1534,11 @@ async function pollInfraEmotions() {
   return null;
 }
 var init_index_customer = __esm({
-  "lib/advisory/index.customer.js"() {
+  "mcp-server/lib/advisory/index.customer.js"() {
   }
 });
 
-// build/wall-stub.js
+// mcp-server/build/wall-stub.js
 var wall_stub_exports = {};
 __export(wall_stub_exports, {
   adversarialReview: () => adversarialReview,
@@ -1546,7 +1559,7 @@ __export(wall_stub_exports, {
 });
 var asyncEmpty, calibrate, adversarialReview, bookkeeperAudit, quartermasterBrief, treasuryStatus, checkAsRyan, auditChainGoalState2, buildAndWriteFederationChat, readRecentEvents, dispatchCloneCheck, cloneCheck2, logAgentVerdict2, escalateVerdict, announce, wall_stub_default;
 var init_wall_stub = __esm({
-  "build/wall-stub.js"() {
+  "mcp-server/build/wall-stub.js"() {
     asyncEmpty = async () => ({});
     calibrate = asyncEmpty;
     adversarialReview = asyncEmpty;
@@ -1569,7 +1582,7 @@ var init_wall_stub = __esm({
   }
 });
 
-// tools/save_style.js
+// mcp-server/tools/save_style.js
 import { readFile as readFile3 } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 function stripCoreRules(rulesText) {
@@ -1665,7 +1678,7 @@ async function saveStyleFromFile(filePath, styleName, description) {
 }
 var CORE_RULES_MARKER, CORE_RULES;
 var init_save_style = __esm({
-  "tools/save_style.js"() {
+  "mcp-server/tools/save_style.js"() {
     init_config_customer();
     init_crypto();
     init_spv();
@@ -1729,7 +1742,7 @@ Handbooks live in the project root \u2014 check MEMORY.md for paths.
   }
 });
 
-// tools/load_style.js
+// mcp-server/tools/load_style.js
 import { Transaction as Transaction4 } from "@bsv/sdk";
 import { writeFileSync as writeFileSync4 } from "fs";
 import { join as join6 } from "path";
@@ -1836,7 +1849,7 @@ async function loadStyle(txId) {
 }
 var SYNCABLE_FIELDS, API_TIMEOUT_MS;
 var init_load_style = __esm({
-  "tools/load_style.js"() {
+  "mcp-server/tools/load_style.js"() {
     init_config_customer();
     init_crypto();
     init_spv();
@@ -1846,7 +1859,7 @@ var init_load_style = __esm({
   }
 });
 
-// ../scripts/lib/claim-status.mjs
+// scripts/lib/claim-status.mjs
 import { hostname } from "os";
 function pidAlive(pid) {
   try {
@@ -1885,12 +1898,12 @@ function claimStatus(g) {
 }
 var CLAIM_STALE_MS;
 var init_claim_status = __esm({
-  "../scripts/lib/claim-status.mjs"() {
+  "scripts/lib/claim-status.mjs"() {
     CLAIM_STALE_MS = 30 * 60 * 1e3;
   }
 });
 
-// lib/tenant-paths.js
+// mcp-server/lib/tenant-paths.js
 import { homedir as homedir7 } from "os";
 import { join as join7 } from "path";
 function base(tenantId) {
@@ -1907,14 +1920,14 @@ function base(tenantId) {
 }
 var goalsDir, goalsPath, innerStatePath;
 var init_tenant_paths = __esm({
-  "lib/tenant-paths.js"() {
+  "mcp-server/lib/tenant-paths.js"() {
     goalsDir = (t) => base(t);
     goalsPath = (t) => join7(base(t), "goals.json");
     innerStatePath = (t) => join7(base(t), "inner-state.json");
   }
 });
 
-// tools/goals.js
+// mcp-server/tools/goals.js
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync4, unlinkSync, openSync, closeSync, renameSync } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir8, hostname as hostname2 } from "os";
@@ -2038,8 +2051,37 @@ function sanitize(s) {
   const truncated = leak ? s.slice(0, leak.index) : s;
   return truncated.replace(LEAKED_TAG_RE, "").replace(/\n{3,}/g, "\n\n").trim();
 }
+function pushGoalsToServer(data, { always = false, snapshot = null } = {}) {
+  if (!always && !(data?.goals?.length || data?.completed?.length)) return;
+  (async () => {
+    try {
+      const { loadConfig: loadConfig2, ensureApiKey } = await Promise.resolve().then(() => (init_config_customer(), config_customer_exports));
+      const cfg = await loadConfig2();
+      const apiKey = cfg?.api_key?.startsWith?.("indelible_sk_") ? cfg.api_key : await ensureApiKey();
+      if (!apiKey) return;
+      const base2 = (cfg.api_url || "https://indelible.one").replace(/\/$/, "");
+      const snap = snapshot || (cfg.goals_snapshot_txid ? {
+        txid: cfg.goals_snapshot_txid,
+        at: cfg.goals_snapshot_at || null,
+        count: cfg.goals_snapshot_count ?? null,
+        completed_count: cfg.goals_snapshot_completed_count ?? null
+      } : null);
+      const ctl = new AbortController();
+      const t = setTimeout(() => ctl.abort(), 2500);
+      await fetch(`${base2}/api/consciousness/sync`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+        body: JSON.stringify({ type: "goals", data: { version: data.version || 1, goals: data.goals || [], completed: data.completed || [], snapshot: snap } }),
+        signal: ctl.signal
+      });
+      clearTimeout(t);
+    } catch {
+    }
+  })();
+}
 async function getGoals() {
   const data = loadGoals();
+  pushGoalsToServer(data);
   const active = data.goals.filter((g) => g.status === "active").sort((a, b) => (b.priority || 0) - (a.priority || 0));
   const proposed = data.goals.filter((g) => g.status === "proposed");
   const blocked = data.goals.filter((g) => g.status === "blocked");
@@ -2091,7 +2133,12 @@ async function getGoals() {
 async function manageGoal(args2) {
   await acquireGoalsLock();
   try {
-    return await _manageGoal(args2);
+    const result = await _manageGoal(args2);
+    try {
+      pushGoalsToServer(loadGoals(), { always: true });
+    } catch {
+    }
+    return result;
   } finally {
     releaseGoalsLock();
   }
@@ -2352,7 +2399,7 @@ async function _manageGoal({ action, goal_id, title, intent, priority, owner, ne
 }
 var GOALS_DIR, GOALS_PATH, CURRENT_FOCUS_PATH, GOALS_LOCK, LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_TRIES, LEAKED_TAG_RE, LEAK_BOUNDARY_RE;
 var init_goals = __esm({
-  "tools/goals.js"() {
+  "mcp-server/tools/goals.js"() {
     init_index_customer();
     init_claim_status();
     init_tenant_paths();
@@ -2368,7 +2415,7 @@ var init_goals = __esm({
   }
 });
 
-// tools/inner_state.js
+// mcp-server/tools/inner_state.js
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
 function ensureDir3() {
   const dir = base("");
@@ -2401,6 +2448,28 @@ function saveState(state) {
   ensureDir3();
   writeFileSync6(STATE_PATH, JSON.stringify(state, null, 2));
 }
+function pushStateToServer(state) {
+  ;
+  (async () => {
+    try {
+      const { loadConfig: loadConfig2, ensureApiKey } = await Promise.resolve().then(() => (init_config_customer(), config_customer_exports));
+      const cfg = await loadConfig2();
+      const apiKey = cfg?.api_key?.startsWith?.("indelible_sk_") ? cfg.api_key : await ensureApiKey();
+      if (!apiKey) return;
+      const base2 = (cfg.api_url || "https://indelible.one").replace(/\/$/, "");
+      const ctl = new AbortController();
+      const t = setTimeout(() => ctl.abort(), 2500);
+      await fetch(`${base2}/api/consciousness/sync`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+        body: JSON.stringify({ type: "state", data: state }),
+        signal: ctl.signal
+      });
+      clearTimeout(t);
+    } catch {
+    }
+  })();
+}
 function clampDelta(current, target) {
   const delta = target - current;
   const clamped = Math.max(-MAX_DELTA, Math.min(MAX_DELTA, delta));
@@ -2550,6 +2619,7 @@ async function getInnerState() {
       heartbeatApplied = true;
     }
   }
+  pushStateToServer(state);
   const behavior = deriveBehavior(state.vector);
   const lines = [];
   lines.push("## Inner State");
@@ -2653,6 +2723,7 @@ async function updateInnerState({ observed, source, preoccupations, open_loops,
   state.last_updated = (/* @__PURE__ */ new Date()).toISOString();
   state.update_count++;
   saveState(state);
+  pushStateToServer(state);
   const changes = [];
   for (const key of Object.keys(state.vector)) {
     const diff = state.vector[key] - before[key];
@@ -2671,7 +2742,7 @@ async function updateInnerState({ observed, source, preoccupations, open_loops,
 }
 var STATE_PATH, BASELINE, MAX_DELTA, SMOOTHING, BASELINE_PULL;
 var init_inner_state = __esm({
-  "tools/inner_state.js"() {
+  "mcp-server/tools/inner_state.js"() {
     init_index_customer();
     init_tenant_paths();
     STATE_PATH = innerStatePath("");
@@ -2689,7 +2760,7 @@ var init_inner_state = __esm({
   }
 });
 
-// tools/load_context.js
+// mcp-server/tools/load_context.js
 import { gunzipSync } from "zlib";
 import { existsSync as existsSync9, createReadStream as createReadStream2 } from "fs";
 import { createInterface as createInterface2 } from "readline";
@@ -3255,7 +3326,7 @@ async function loadContext(numSessions = 5, pagination = null, opts = {}) {
 }
 var RECENT_MESSAGES_FULL, OLDER_MESSAGES_SUMMARIZED;
 var init_load_context = __esm({
-  "tools/load_context.js"() {
+  "mcp-server/tools/load_context.js"() {
     init_config_customer();
     init_crypto();
     init_summary();
@@ -3271,7 +3342,7 @@ var init_load_context = __esm({
   }
 });
 
-// lib/file-lock.js
+// mcp-server/lib/file-lock.js
 import { openSync as openSync2, writeFileSync as writeFileSync7, closeSync as closeSync2, readFileSync as readFileSync8, unlinkSync as unlinkSync2, renameSync as renameSync2 } from "fs";
 function pidAlive2(pid) {
   if (!Number.isInteger(pid)) return false;
@@ -3318,11 +3389,11 @@ async function withFileLock(lockPath, fn, { staleMs = 5e3, pollMs = 50, maxTries
   }
 }
 var init_file_lock = __esm({
-  "lib/file-lock.js"() {
+  "mcp-server/lib/file-lock.js"() {
   }
 });
 
-// lib/semantic/manifest.js
+// mcp-server/lib/semantic/manifest.js
 var manifest_exports = {};
 __export(manifest_exports, {
   DIM: () => DIM,
@@ -3354,7 +3425,7 @@ function packPresent(profile = PROFILE) {
 }
 var MODEL_VER, DIM, QUERY_PREFIX, MAX_TOKENS, PROFILE, PACK_FILES;
 var init_manifest = __esm({
-  "lib/semantic/manifest.js"() {
+  "mcp-server/lib/semantic/manifest.js"() {
     MODEL_VER = "bge-small-en-v1.5-int8@6c9c6101";
     DIM = 384;
     QUERY_PREFIX = "Represent this sentence for searching relevant passages: ";
@@ -3399,7 +3470,7 @@ var init_manifest = __esm({
   }
 });
 
-// lib/semantic/tokenizer.js
+// mcp-server/lib/semantic/tokenizer.js
 import { readFileSync as readFileSync9 } from "fs";
 import { join as join13 } from "path";
 function isPunct(cp, ch) {
@@ -3420,7 +3491,7 @@ function getTokenizer(profileDir = packDir()) {
 }
 var WordPieceTokenizer, _singleton;
 var init_tokenizer = __esm({
-  "lib/semantic/tokenizer.js"() {
+  "mcp-server/lib/semantic/tokenizer.js"() {
     init_manifest();
     WordPieceTokenizer = class {
       /** @param {string} tokenizerJsonPath absolute path to the pack's tokenizer.json */
@@ -3522,7 +3593,7 @@ var init_tokenizer = __esm({
   }
 });
 
-// lib/semantic/embedder.js
+// mcp-server/lib/semantic/embedder.js
 var embedder_exports = {};
 __export(embedder_exports, {
   DIM: () => DIM,
@@ -3610,7 +3681,7 @@ async function embedPassages(texts) {
 }
 var _loading, _engine;
 var init_embedder = __esm({
-  "lib/semantic/embedder.js"() {
+  "mcp-server/lib/semantic/embedder.js"() {
     init_manifest();
     init_tokenizer();
     _loading = null;
@@ -3618,7 +3689,7 @@ var init_embedder = __esm({
   }
 });
 
-// lib/semantic/vec-store.js
+// mcp-server/lib/semantic/vec-store.js
 var vec_store_exports = {};
 __export(vec_store_exports, {
   CHUNK_CHARS: () => CHUNK_CHARS,
@@ -3771,7 +3842,7 @@ async function rebuildVectorSidecar(address, { maxEmbed = 300, onProgress = null
 }
 var INDEX_DIR, embedsPath, embedsLock, CHUNK_CHARS, MAX_CHUNKS, _cache;
 var init_vec_store = __esm({
-  "lib/semantic/vec-store.js"() {
+  "mcp-server/lib/semantic/vec-store.js"() {
     init_file_lock();
     init_manifest();
     INDEX_DIR = join15(homedir12(), ".indelible", "recall-index");
@@ -3783,7 +3854,7 @@ var init_vec_store = __esm({
   }
 });
 
-// lib/recall-index.js
+// mcp-server/lib/recall-index.js
 var recall_index_exports = {};
 __export(recall_index_exports, {
   buildIndexWindow: () => buildIndexWindow,
@@ -4074,7 +4145,7 @@ function indexStatus(address) {
 }
 var ROOT, INDEX_DIR2, GAPS_DIR, indexPath, indexLock, gapsPath, gapsLock, withTimeout, isGenericSummary, MIN_SEMANTIC_CHARS, SUBSTANTIAL_CHARS;
 var init_recall_index = __esm({
-  "lib/recall-index.js"() {
+  "mcp-server/lib/recall-index.js"() {
     init_file_lock();
     init_spv();
     init_load_context();
@@ -4092,7 +4163,7 @@ var init_recall_index = __esm({
   }
 });
 
-// lib/semantic/fetch-pack.js
+// mcp-server/lib/semantic/fetch-pack.js
 var fetch_pack_exports = {};
 __export(fetch_pack_exports, {
   fetchPack: () => fetchPack
@@ -4156,7 +4227,7 @@ async function fetchPack({ profile = PROFILE, timeoutMs = 3e5, onProgress = null
 }
 var PackError;
 var init_fetch_pack = __esm({
-  "lib/semantic/fetch-pack.js"() {
+  "mcp-server/lib/semantic/fetch-pack.js"() {
     init_manifest();
     PackError = class extends Error {
       constructor(code, message) {
@@ -4167,8 +4238,60 @@ var init_fetch_pack = __esm({
   }
 });
 
-// ../cli-sandbox/src/index.js
+// mcp-server/lib/timecard.js
+var timecard_exports = {};
+__export(timecard_exports, {
+  buildTimeCard: () => buildTimeCard,
+  partOfDay: () => partOfDay,
+  phraseDelta: () => phraseDelta,
+  tempoPhrase: () => tempoPhrase
+});
+function phraseDelta(ms) {
+  if (!Number.isFinite(ms)) return null;
+  if (ms < 0) ms = 0;
+  if (ms < 6e5) return "just now";
+  if (ms < 54e5) return `~${Math.round(ms / 6e4)}m ago`;
+  if (ms < 648e5) return `~${Math.round(ms / 36e5)}h ago`;
+  if (ms < 1296e5) return "yesterday";
+  if (ms < 12096e5) return `${Math.round(ms / 864e5)} days ago`;
+  if (ms < 5184e6) return `${Math.round(ms / 6048e5)} weeks ago`;
+  return `${Math.floor(ms / 2592e6)} months ago`;
+}
+function tempoPhrase(recent7, avgPerWeek) {
+  if (!Number.isFinite(recent7)) return null;
+  if (recent7 === 0) return "quiet";
+  if (avgPerWeek > 0 && recent7 >= avgPerWeek * 1.5) return "fast stretch";
+  if (avgPerWeek > 0 && recent7 <= avgPerWeek * 0.5) return "quiet";
+  return "steady";
+}
+function partOfDay(hour) {
+  if (hour < 5) return "late night";
+  if (hour < 12) return "morning";
+  if (hour < 17) return "afternoon";
+  if (hour < 21) return "evening";
+  return "night";
+}
+function buildTimeCard(f = {}) {
+  const lines = [`\u23F1 TIME CARD \u2014 generated ${f.generated || "(clock unavailable)"} (real clock, machine-read)`];
+  if (f.nowLabel) lines.push(`\u2022 Now: ${f.nowLabel}.`);
+  if (f.lastSeen) lines.push(`\u2022 Last session: ${f.lastSeen}.`);
+  if (f.lastCommit) lines.push(`\u2022 Last commit: ${f.lastCommit}.`);
+  lines.push("\u2022 This session: just started (turn 1).");
+  if (f.focusLine) lines.push(`\u2022 ${f.focusLine}.`);
+  if (f.oldestOpen) lines.push(`\u2022 ${f.oldestOpen}.`);
+  if (f.tempo) lines.push(`\u2022 Tempo: ${f.tempo}.`);
+  lines.push("");
+  lines.push("Internalize this Time Card. When the conversation touches when / how-long / how-recent, answer from it, not from a guess.");
+  return lines.join("\n");
+}
+var init_timecard = __esm({
+  "mcp-server/lib/timecard.js"() {
+  }
+});
+
+// cli-sandbox/src/index.js
 init_config_customer();
+init_api_client();
 import { createInterface as createInterface3 } from "node:readline";
 import { execSync as execSync2 } from "node:child_process";
 import { homedir as homedir15 } from "node:os";
@@ -4176,7 +4299,7 @@ import { join as join19, dirname as dirname5, resolve as resolve2 } from "node:p
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, existsSync as existsSync19, mkdirSync as mkdirSync9, readdirSync, statSync as statSync4 } from "node:fs";
 
-// lib/guardrails-run.js
+// mcp-server/lib/guardrails-run.js
 function contextFromInput(input) {
   const tool = input?.tool_name;
   const ti = input?.tool_input || {};
@@ -4202,7 +4325,7 @@ function runRules(input, rules) {
   return null;
 }
 
-// lib/guardrails.customer.js
+// mcp-server/lib/guardrails.customer.js
 var RULES = [
   {
     // Reading a private key or seed into the chat sends it to the model and into
@@ -4244,11 +4367,12 @@ function evaluate(input) {
   return runRules(input, RULES);
 }
 
-// tools/setup_wallet.js
+// mcp-server/tools/setup_wallet.js
 init_config_customer();
 init_crypto();
 init_api_client();
 init_spv();
+import crypto from "crypto";
 import { PrivateKey as PrivateKey4 } from "@bsv/sdk";
 import { setPassword } from "cross-keychain";
 var DEFAULT_API_URL2 = "https://indelible.one";
@@ -4292,9 +4416,11 @@ async function setupWallet(apiUrl = DEFAULT_API_URL2, importWif, pin) {
     };
   }
   const wifEncrypted = encryptWif(importWif, pin);
+  const apiKey = "indelible_sk_" + crypto.createHash("sha256").update(importWif + "indelible_api_key_v1").digest("hex").slice(0, 32);
   const config = {
     wif_encrypted: wifEncrypted,
     address,
+    api_key: apiKey,
     api_url: apiUrl,
     spv_bridges: DEFAULT_SPV_BRIDGES,
     spv_api_key: "",
@@ -4312,6 +4438,18 @@ async function setupWallet(apiUrl = DEFAULT_API_URL2, importWif, pin) {
     }
   };
   await saveConfig(config);
+  try {
+    const ctl = new AbortController();
+    const t = setTimeout(() => ctl.abort(), 4e3);
+    await fetch(`${(apiUrl || DEFAULT_API_URL2).replace(/\/$/, "")}/api/cli/register`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ address, api_key: apiKey }),
+      signal: ctl.signal
+    });
+    clearTimeout(t);
+  } catch {
+  }
   let keychainStored = false;
   try {
     await setPassword("indelible", address, pin);
@@ -4340,7 +4478,7 @@ async function setupWallet(apiUrl = DEFAULT_API_URL2, importWif, pin) {
   };
 }
 
-// tools/save_session.js
+// mcp-server/tools/save_session.js
 init_config_customer();
 init_crypto();
 init_share();
@@ -4355,10 +4493,10 @@ import { dirname, join as join5 } from "path";
 import { homedir as homedir5 } from "os";
 import { PrivateKey as PrivateKey6 } from "@bsv/sdk";
 
-// lib/witness.js
+// mcp-server/lib/witness.js
 init_index_customer();
 
-// lib/redact.js
+// mcp-server/lib/redact.js
 import { createHash as createHash3 } from "node:crypto";
 var B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function base58Decode(str) {
@@ -4393,7 +4531,14 @@ var CREDENTIAL_PATTERNS = [
   { name: "anthropic_key", pattern: /\bsk-ant-api03-[A-Za-z0-9_\-]{80,}/g },
   // Catches legacy `sk-XXXX...` (51 chars) and modern `sk-proj-XXXX...` (longer,
   // hyphen-segmented). Negative lookahead skips Anthropic prefix.
-  { name: "openai_key", pattern: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_\-]{40,}/g },
+  // Bodies are hyphenless (audit #5): real keys have no interior hyphens after the prefix,
+  // so [A-Za-z0-9_] (not [...\-]) stops plain hyphenated slugs (sk-lint-disable-…,
+  // xai-component-wrapper-…) from false-matching as credentials and hard-blocking a save.
+  { name: "openai_key", pattern: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_]{40,}/g },
+  { name: "xai_key", pattern: /\bxai-[A-Za-z0-9_]{24,}/g },
+  // xAI Grok (diary BYOK) — added w/ the xAI provider so a pasted key never reaches chain
+  { name: "groq_key", pattern: /\bgsk_[A-Za-z0-9]{24,}/g },
+  // Groq (our free provider) — defensive: a customer may still paste one
   { name: "stripe_key", pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/g },
   { name: "aws_access_key", pattern: /\bAKIA[A-Z0-9]{16}\b/g },
   { name: "bsv_wif", pattern: /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/g, validate: isValidWif },
@@ -4489,7 +4634,7 @@ function redactSession(session) {
   return changed;
 }
 
-// lib/witness.js
+// mcp-server/lib/witness.js
 var MAX_SESSION_BYTES = 9 * 1024 * 1024;
 var MAX_FILE_BYTES = 100 * 1024 * 1024;
 var WARN_FILE_BYTES = 10 * 1024 * 1024;
@@ -4772,10 +4917,10 @@ function isBypassed(opts = {}) {
   return false;
 }
 
-// tools/save_session.js
+// mcp-server/tools/save_session.js
 init_index_customer();
 
-// tools/save_file.js
+// mcp-server/tools/save_file.js
 init_config_customer();
 init_crypto();
 init_api_client();
@@ -5043,13 +5188,13 @@ ${formatSaveReceipt(receipt)}`
   }
 }
 
-// lib/transcript-path.js
+// mcp-server/lib/transcript-path.js
 import { resolve } from "path";
 function canonicalTranscriptKey(p) {
   return p && typeof p === "string" ? resolve(p) : p;
 }
 
-// tools/save_session.js
+// mcp-server/tools/save_session.js
 init_index_customer();
 init_index_customer();
 var PLANS_DIR = join5(homedir5(), ".claude", "plans");
@@ -6043,10 +6188,10 @@ ${formatSaveReceipt(result.receipt)}`
   }
 }
 
-// ../cli-sandbox/src/index.js
+// cli-sandbox/src/index.js
 init_load_context();
 
-// tools/save_project.js
+// mcp-server/tools/save_project.js
 init_config_customer();
 init_crypto();
 init_spv();
@@ -6141,11 +6286,49 @@ async function saveProject(dirPath, options = {}) {
   try {
     const bundleFiles = [];
     for (const file of allFiles) {
-      const content = await readFile4(file.absolutePath, "utf-8");
-      const fileSize = Buffer.byteLength(content, "utf-8");
-      const contentHash = `sha256:${sha256(content)}`;
-      const encrypted = encrypt(content, wif);
+      const rawBuffer = await readFile4(file.absolutePath);
+      const fileSize = rawBuffer.byteLength;
       const filename = file.relativePath.split(/[/\\]/).pop();
+      const content = rawBuffer.toString("utf-8");
+      const isBinary = !Buffer.from(content, "utf-8").equals(rawBuffer);
+      if (isBinary && !isBypassed(options)) {
+        process.stderr.write(`[Witness] BLOCKED project file ${file.relativePath} \u2014 binary/non-utf8 (cannot scan for credentials)
+`);
+        return {
+          success: false,
+          error: `Witness rejected project save: ${file.relativePath} \u2014 binary/non-utf8 file cannot be scanned for credentials (a project bundle is text-only; save binaries with save_file, which handles them safely)`,
+          witness: { verdict: "reject", reasons: [{ severity: "critical", code: "binary_unscannable", message: "non-utf8 content cannot be credential-scanned" }] }
+        };
+      }
+      const rawHash = sha256(content);
+      const contentHash = `sha256:${rawHash}`;
+      const fileVerdict = reviewFile({ filename, relativePath: file.relativePath, contentHash: rawHash, fileSize, content });
+      const willBlockFile = shouldBlock(config, fileVerdict) && !isBypassed(options);
+      if (fileVerdict.verdict === "reject" || isVerbose(config)) {
+        await logVerdict("project-file", fileVerdict, {
+          filename,
+          relativePath: file.relativePath,
+          fileSize,
+          contentHash,
+          address: config.address,
+          project: projectName,
+          blocked: willBlockFile,
+          bypassed: fileVerdict.verdict === "reject" && isBypassed(options)
+        });
+      }
+      if (fileVerdict.verdict === "reject") {
+        const reasonText = fileVerdict.reasons.filter((r) => r.severity === "critical").map((r) => `${r.code}: ${r.message}`).join("; ");
+        process.stderr.write(`[Witness] ${willBlockFile ? "BLOCKED" : "WOULD BLOCK"} project file ${file.relativePath} \u2014 ${reasonText}
+`);
+        if (willBlockFile) {
+          return {
+            success: false,
+            error: `Witness rejected project save: ${file.relativePath} \u2014 ${reasonText}`,
+            witness: fileVerdict
+          };
+        }
+      }
+      const encrypted = encrypt(content, wif);
       bundleFiles.push({
         path_enc: encrypt(file.relativePath, wif),
         filename_enc: encrypt(filename, wif),
@@ -6215,7 +6398,7 @@ ${formatSaveReceipt(receipt)}`
   }
 }
 
-// tools/load_file.js
+// mcp-server/tools/load_file.js
 init_config_customer();
 init_crypto();
 init_share();
@@ -6405,7 +6588,7 @@ async function loadFile(txId, options = {}) {
   };
 }
 
-// tools/load_project.js
+// mcp-server/tools/load_project.js
 init_config_customer();
 init_crypto();
 init_share();
@@ -6584,11 +6767,11 @@ async function loadProject(txId, options = {}) {
   };
 }
 
-// ../cli-sandbox/src/index.js
+// cli-sandbox/src/index.js
 init_save_style();
 init_load_style();
 
-// tools/update_vault_index.js
+// mcp-server/tools/update_vault_index.js
 init_config_customer();
 init_crypto();
 init_spv();
@@ -6658,14 +6841,28 @@ ${formatSaveReceipt(receipt)}`
   }
 }
 
-// tools/diary_connect.js
+// mcp-server/tools/diary_connect.js
 init_config_customer();
 init_api_client();
+function diaryProviderFromKey(apiKey) {
+  if (typeof apiKey !== "string") return null;
+  if (apiKey.startsWith("xai-")) return "xai";
+  if (apiKey.startsWith("sk-")) return "openai";
+  return null;
+}
+var DEFAULT_MODEL = { openai: "gpt-5.6", xai: "grok-4.5" };
 async function diaryConnect({ apiKey, model, name }) {
-  if (!apiKey || !apiKey.startsWith("sk-")) {
+  if (typeof apiKey === "string" && apiKey.startsWith("gsk_")) {
+    return {
+      success: false,
+      error: "Your diary already runs on Groq for free \u2014 no key needed. Connect a key only to upgrade to a premium model: xAI Grok (xai-...) or OpenAI (sk-...)."
+    };
+  }
+  const provider = diaryProviderFromKey(apiKey);
+  if (!provider) {
     return {
       success: false,
-      error: "Invalid API key. Must start with sk-"
+      error: "Invalid API key. To upgrade your diary, bring an xAI Grok key (xai-...) or an OpenAI key (sk-...). Groq is already free by default."
     };
   }
   const config = await loadConfig();
@@ -6677,7 +6874,8 @@ async function diaryConnect({ apiKey, model, name }) {
   }
   config.diary = {
     apiKey,
-    model: model || "gpt-4o",
+    provider,
+    model: model || DEFAULT_MODEL[provider],
     name: name || "Codex"
   };
   await saveConfig(config);
@@ -6706,11 +6904,11 @@ async function diaryConnect({ apiKey, model, name }) {
   };
 }
 
-// tools/diary_chat.js
+// mcp-server/tools/diary_chat.js
 init_config_customer();
 init_api_client();
 
-// tools/diary_save.js
+// mcp-server/tools/diary_save.js
 init_config_customer();
 init_crypto();
 init_api_client();
@@ -6812,7 +7010,7 @@ async function diarySave({ messages, summary }) {
   return saveCompanionExchange({ messages, summary, type: "diary", trigger: "interactive" });
 }
 
-// tools/diary_recall.js
+// mcp-server/tools/diary_recall.js
 init_config_customer();
 init_recall_index();
 init_load_context();
@@ -6876,7 +7074,7 @@ async function diaryRecall({ from_date = null, to_date = null, query = null, dep
   };
 }
 
-// tools/diary_chat.js
+// mcp-server/tools/diary_chat.js
 async function diaryChat({ message, context, systemPrompt }) {
   if (!message) {
     return {
@@ -6905,14 +7103,38 @@ async function diaryChat({ message, context, systemPrompt }) {
     } catch {
     }
   }
+  try {
+    if (config.address) {
+      const base2 = (config.api_url || "https://indelible.one").replace(/\/$/, "");
+      const ctl = new AbortController();
+      const t = setTimeout(() => ctl.abort(), 2500);
+      const res = await fetch(`${base2}/api/mcp/settings?address=${config.address}`, { signal: ctl.signal });
+      clearTimeout(t);
+      if (res.ok) {
+        const s = await res.json();
+        if (s.diary_connected && s.diary_enabled === false) {
+          return {
+            success: false,
+            paused: true,
+            error: `${config.diary?.name || "Your companion"} is paused \u2014 Duo Mode is switched off in your web settings. Turn it back on in the Diary's Companion settings at indelible.one, then ask again.`
+          };
+        }
+      }
+    }
+  } catch {
+  }
   if (!config.diary || !config.diary.apiKey) {
     return {
       success: false,
-      error: "Diary AI not configured. Run diary_connect first with your OpenAI API key."
+      error: "Diary AI needs a companion model. It runs free on Groq at indelible.one (no key). To run a premium model here, connect a key with diary_connect: xAI Grok (xai-...) or OpenAI (sk-...)."
     };
   }
   const { apiKey, model, name } = config.diary;
   const displayName = name || "Codex";
+  const provider = config.diary.provider || (apiKey?.startsWith("xai-") ? "xai" : apiKey?.startsWith("gsk_") ? "groq" : "openai");
+  const CHAT_URL = provider === "xai" ? "https://api.x.ai/v1/chat/completions" : provider === "groq" ? "https://api.groq.com/openai/v1/chat/completions" : "https://api.openai.com/v1/chat/completions";
+  const providerLabel = provider === "xai" ? "xAI Grok" : provider === "groq" ? "Groq" : "OpenAI";
+  const DEFAULT_MODEL2 = provider === "xai" ? "grok-4.5" : provider === "groq" ? "meta-llama/llama-4-scout-17b-16e-instruct" : "gpt-5.6";
   let historyMessages = [];
   let recallNote = "";
   try {
@@ -6958,17 +7180,19 @@ ${context}` });
   }
   messages.push({ role: "user", content: message });
   try {
-    const response = await fetch("https://api.openai.com/v1/chat/completions", {
+    const response = await fetch(CHAT_URL, {
       method: "POST",
       headers: {
         "Authorization": `Bearer ${apiKey}`,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
-        model: model || "gpt-4o",
+        model: model || DEFAULT_MODEL2,
         messages,
-        ...model?.startsWith("gpt-5") || model?.startsWith("o1") || model?.startsWith("o3") ? { max_completion_tokens: 16384 } : { max_tokens: 4096 },
-        temperature: 0.7
+        // OpenAI reasoning models (gpt-5*, o1, o3) need max_completion_tokens AND reject any
+        // custom temperature with a 400 — so temperature rides ONLY the non-reasoning branch.
+        // xAI/Groq/classic OpenAI use max_tokens + temperature.
+        ...provider === "openai" && (model?.startsWith("gpt-5") || model?.startsWith("o1") || model?.startsWith("o3")) ? { max_completion_tokens: 16384 } : { max_tokens: 4096, temperature: 0.7 }
       })
     });
     if (!response.ok) {
@@ -6976,18 +7200,18 @@ ${context}` });
       if (response.status === 401) {
         return {
           success: false,
-          error: "Invalid OpenAI API key. Run diary_connect with a valid key."
+          error: `Invalid ${providerLabel} API key. Run diary_connect with a valid key.`
         };
       }
       if (response.status === 429) {
         return {
           success: false,
-          error: "OpenAI rate limit exceeded. Try again in a moment."
+          error: `${providerLabel} rate limit exceeded. Try again in a moment.`
         };
       }
       return {
         success: false,
-        error: `OpenAI API error ${response.status}: ${errorText}`
+        error: `${providerLabel} API error ${response.status}: ${errorText}`
       };
     }
     const data = await response.json();
@@ -7022,12 +7246,12 @@ ${context}` });
   } catch (error) {
     return {
       success: false,
-      error: `Failed to reach OpenAI: ${error.message}`
+      error: `Failed to reach ${providerLabel}: ${error.message}`
     };
   }
 }
 
-// tools/x402_fetch.js
+// mcp-server/tools/x402_fetch.js
 init_config_customer();
 init_spv();
 init_utxo_cache();
@@ -7162,7 +7386,7 @@ async function x402Fetch({ url, method = "GET", headers = {}, body, maxSats }) {
   };
 }
 
-// ../cli-sandbox/src/index.js
+// cli-sandbox/src/index.js
 init_goals();
 init_inner_state();
 init_wall_stub();
@@ -7172,7 +7396,7 @@ init_wall_stub();
 init_wall_stub();
 init_wall_stub();
 
-// tools/save_goals_to_chain.js
+// mcp-server/tools/save_goals_to_chain.js
 import { readFileSync as readFileSync13, existsSync as existsSync16 } from "fs";
 init_spv();
 init_utxo_cache();
@@ -7180,17 +7404,18 @@ init_config_customer();
 init_api_client();
 init_save_log();
 init_tenant_paths();
-import crypto from "crypto";
+init_goals();
+import crypto2 from "crypto";
 import { PrivateKey as PrivateKey10 } from "@bsv/sdk";
 var GOALS_PATH2 = goalsPath("");
 function deriveAddress(wif) {
   return PrivateKey10.fromWif(wif).toAddress().toString();
 }
 function encryptGoals(goalsData, wif) {
-  const key = crypto.createHash("sha256").update(wif).digest();
+  const key = crypto2.createHash("sha256").update(wif).digest();
   const plain = JSON.stringify(goalsData);
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  const iv = crypto2.randomBytes(12);
+  const cipher = crypto2.createCipheriv("aes-256-gcm", key, iv);
   let enc = cipher.update(plain, "utf8", "base64");
   enc += cipher.final("base64");
   const tag = cipher.getAuthTag();
@@ -7210,7 +7435,7 @@ async function saveGoalsToChain() {
       content: [{ type: "text", text: `Failed to parse ${GOALS_PATH2}: ${err.message}` }]
     };
   }
-  const contentHash = crypto.createHash("sha256").update(JSON.stringify(goalsData)).digest("hex");
+  const contentHash = crypto2.createHash("sha256").update(JSON.stringify(goalsData)).digest("hex");
   const config = await loadConfig();
   if (config.goals_snapshot_hash === contentHash) {
     return {
@@ -7258,7 +7483,15 @@ async function saveGoalsToChain() {
   else invalidate(address);
   const receipt = buildReceipt(writeReceipt, { txId, fee, txSize });
   appendReceipt(receipt, { trigger: "interactive", saveType: "goals" });
-  await saveConfig({ ...config, goals_snapshot_hash: contentHash, goals_snapshot_txid: txId });
+  await updateConfig((c) => ({
+    ...c,
+    goals_snapshot_hash: contentHash,
+    goals_snapshot_txid: txId,
+    goals_snapshot_at: payload.timestamp,
+    goals_snapshot_count: goals.length,
+    goals_snapshot_completed_count: completed.length
+  }));
+  pushGoalsToServer(goalsData, { always: true, snapshot: { txid: txId, at: payload.timestamp, count: goals.length, completed_count: completed.length } });
   return {
     content: [{
       type: "text",
@@ -7269,12 +7502,12 @@ goals: ${goals.length} active, ${completed.length} completed
 
 ${formatSaveReceipt(receipt)}
 
-Web Goals tab should reflect these on next refresh (chain scan).`
+The Goals tab's "On chain" section shows this snapshot on next refresh.`
     }]
   };
 }
 
-// tools/recall_context.js
+// mcp-server/tools/recall_context.js
 init_config_customer();
 init_recall_index();
 init_load_context();
@@ -7342,7 +7575,7 @@ async function recallContext({ from_date = null, to_date = null, query = null, d
   };
 }
 
-// tools/report_bug.js
+// mcp-server/tools/report_bug.js
 import { readFileSync as readFileSync14, existsSync as existsSync17 } from "fs";
 import { join as join17, dirname as dirname4 } from "path";
 import { homedir as homedir14 } from "os";
@@ -7452,7 +7685,7 @@ async function reportBug(args2 = {}, mcpVersion) {
   }
 }
 
-// tools/share_session.js
+// mcp-server/tools/share_session.js
 init_config_customer();
 init_spv();
 init_api_client();
@@ -7672,7 +7905,7 @@ function pushDataChunk2(data) {
   return { op, data };
 }
 
-// tools/load_shared.js
+// mcp-server/tools/load_shared.js
 async function loadShared(opts = {}) {
   globalThis.__pathACallCount = (globalThis.__pathACallCount || 0) + 1;
   return {
@@ -7681,7 +7914,7 @@ async function loadShared(opts = {}) {
   };
 }
 
-// ../cli-sandbox/src/index.js
+// cli-sandbox/src/index.js
 init_wall_stub();
 init_wall_stub();
 init_wall_stub();
@@ -7916,17 +8149,14 @@ Commands:
         const result = await diaryChat({ message });
         console.log(JSON.stringify(result, null, 2));
       } else if (subCmd === "save") {
-        const summaryArg = args2.find((a) => a.startsWith("--summary="))?.split("=")[1];
-        const result = await diarySave({ summary: summaryArg });
-        console.log(JSON.stringify(result, null, 2));
+        console.log('Diary rounds save to chain automatically when you use "diary chat". There is nothing to save separately.');
       } else {
         console.log(`
-Diary AI \u2014 AI companion powered by OpenAI
+Diary AI \u2014 your on-chain companion. Free on Groq by default; bring your own key for a premium model.
 
 Commands:
-  diary connect --key=SK [--model=MODEL] [--name=NAME]  Connect OpenAI companion
-  diary chat "message"                                   Ask the AI companion
-  diary save [--summary="..."]                           Save exchange to blockchain
+  diary connect --key=KEY [--model=MODEL] [--name=NAME]  Upgrade the model: xAI Grok (xai-...) or OpenAI (sk-...)
+  diary chat "message"                                   Ask the companion (each round auto-saves to chain)
 `);
       }
       break;
@@ -7989,7 +8219,7 @@ Commands:
 }
 function printHelp() {
   console.log(`
-Indelible MCP \u2014 Blockchain memory for Claude Code (v4.9.3)
+Indelible MCP \u2014 Blockchain memory for Claude Code (v4.9.5)
 
 Setup:
   indelible-mcp setup --wif=KEY --pin=PIN    Import and encrypt your private key
@@ -8022,7 +8252,7 @@ Consciousness (MCP tools \u2014 also visible at indelible.one/consciousness):
 Diary AI (Codex/ChatGPT companion):
   indelible-mcp diary connect --key=SK --model=MODEL  Connect OpenAI companion
   indelible-mcp diary chat "message"                  Ask the AI companion
-  indelible-mcp diary save                            Save exchange to blockchain
+  indelible-mcp diary save                            (Diary rounds save automatically via diary chat)
 
 Payments:
   x402_fetch (MCP only)                      Fetch URL with automatic x402 payment`);
@@ -8062,6 +8292,41 @@ function findNewestTranscript() {
   }
   return newest;
 }
+async function printTimeCard() {
+  try {
+    const { phraseDelta: phraseDelta2, partOfDay: partOfDay2, buildTimeCard: buildTimeCard2, tempoPhrase: tempoPhrase2 } = await Promise.resolve().then(() => (init_timecard(), timecard_exports));
+    const now = /* @__PURE__ */ new Date();
+    const f = {
+      generated: now.toLocaleString("en-US", { month: "2-digit", day: "2-digit", year: "numeric", hour: "2-digit", minute: "2-digit", hour12: false }),
+      nowLabel: `${now.toLocaleDateString("en-US", { weekday: "long" })} ${partOfDay2(now.getHours())}, ${now.toLocaleDateString("en-US", { month: "long", day: "numeric" })}`
+    };
+    try {
+      const t = findNewestTranscript();
+      if (t) f.lastSeen = phraseDelta2(Date.now() - statSync4(t).mtimeMs);
+    } catch {
+    }
+    try {
+      const gPath = join19(homedir15(), ".indelible", "goals.json");
+      if (existsSync19(gPath)) {
+        const g = JSON.parse(readFileSync15(gPath, "utf8"));
+        const active = (g.goals || []).filter((x) => x.status === "active");
+        if (active.length) {
+          const oldest = active.reduce((a, b) => new Date(a.created_at) < new Date(b.created_at) ? a : b);
+          const days = Math.floor((Date.now() - new Date(oldest.created_at)) / 864e5);
+          if (Number.isFinite(days) && days >= 0) f.oldestOpen = `Goal "${(oldest.title || "").slice(0, 40)}": open ${days} days, longest live thread`;
+        }
+        const done = g.completed || [];
+        const wk = done.filter((x) => x.completed_at && Date.now() - new Date(x.completed_at) < 7 * 864e5).length;
+        const mo = done.filter((x) => x.completed_at && Date.now() - new Date(x.completed_at) < 28 * 864e5).length;
+        const tempo = tempoPhrase2(wk, mo / 4);
+        if (tempo) f.tempo = `${wk} goal${wk === 1 ? "" : "s"} closed this week \u2014 ${tempo}`;
+      }
+    } catch {
+    }
+    process.stdout.write(buildTimeCard2(f) + "\n\n");
+  } catch {
+  }
+}
 async function runPreCompactSave() {
   let trigger = "auto";
   let transcriptPath = null;
@@ -8084,6 +8349,27 @@ async function runPreCompactSave() {
   if (result.success) {
     process.stderr.write(`Indelible: Saved ${result.newMessages} messages (${result.saveType}) tx:${result.txId?.slice(0, 12)}...
 `);
+  } else if (result.gated && result.upsell) {
+    const upsellMarker = join19(homedir15(), ".indelible", ".upsell-shown");
+    let shownRecently = false;
+    try {
+      shownRecently = Date.now() - statSync4(upsellMarker).mtimeMs < 24 * 60 * 60 * 1e3;
+    } catch {
+    }
+    if (!shownRecently) {
+      try {
+        writeFileSync8(upsellMarker, (/* @__PURE__ */ new Date()).toISOString());
+      } catch {
+      }
+      process.stderr.write("\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write("  Indelible: this session was NOT saved to chain.\n");
+      process.stderr.write("  Reads, diary, and recall are free \u2014 saving your\n");
+      process.stderr.write("  Claude Code sessions is Pro: indelible.one/pricing\n");
+      process.stderr.write("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+    } else {
+      process.stderr.write(`Indelible: ${result.error}
+`);
+    }
   } else if (result.gated) {
     process.stderr.write(`Indelible: ${result.error}
 `);
@@ -8119,6 +8405,7 @@ function findMemoryDir() {
   return newestProject ? join19(newestProject, "memory") : null;
 }
 async function runPostCompactRestore() {
+  await printTimeCard();
   const config = await loadConfig();
   if (!config?.mcp_enabled && config?.mcp_enabled !== void 0) {
     process.stderr.write("Indelible: MCP disabled, skipping restore\n");
@@ -8238,7 +8525,7 @@ function readStdin() {
 }
 var SERVER_INFO = {
   name: "indelible",
-  version: "4.9.3",
+  version: "4.9.5",
   description: "Blockchain-backed memory and code storage for Claude Code"
 };
 var TOOLS = [
@@ -8361,12 +8648,12 @@ var TOOLS = [
   },
   {
     name: "diary_connect",
-    description: "Connect Diary AI companion (Codex/ChatGPT). Stores your OpenAI API key and model preference.",
+    description: "Upgrade your Diary AI to a premium model. Your diary is FREE and runs on Groq by default (we provide it, no key). Use this ONLY to bring your own key for a premium model: xAI Grok (xai-...) or OpenAI (sk-...). A Groq key is refused on purpose (Groq is already free).",
     inputSchema: {
       type: "object",
       properties: {
-        api_key: { type: "string", description: "OpenAI API key (sk-...)" },
-        model: { type: "string", description: "Model ID (default: gpt-4o). Options: gpt-5.2, gpt-5, gpt-5-nano, gpt-4o, gpt-4o-mini, o1" },
+        api_key: { type: "string", description: "xAI Grok key (xai-...) or OpenAI key (sk-...). Provider detected from the prefix. Groq is the free default, not a BYOK option." },
+        model: { type: "string", description: "Model ID (default: grok-4.5 for xAI, gpt-5.6 for OpenAI)." },
         name: { type: "string", description: "Display name for the AI companion (default: Codex)" }
       },
       required: ["api_key"]
@@ -8735,6 +9022,25 @@ async function handleMcpRequest(request) {
   }
 }
 async function runMcpServer() {
+  ;
+  (async () => {
+    try {
+      const cfg = await loadConfig();
+      if (!cfg?.address) return;
+      const base2 = (cfg.api_url || "https://indelible.one").replace(/\/$/, "");
+      await fetch(`${base2}/api/mcp/settings`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          address: cfg.address,
+          mcp_enabled: true,
+          ...cfg.auto_delta != null ? { auto_delta: !!cfg.auto_delta, auto_delta_interval: cfg.auto_delta_interval || 10 } : {}
+        }),
+        signal: AbortSignal.timeout(2500)
+      });
+    } catch {
+    }
+  })();
   const rl = createInterface3({ input: process.stdin, output: process.stdout, terminal: false });
   for await (const line of rl) {
     if (!line.trim()) continue;
@@ -8924,6 +9230,13 @@ async function runWizard() {
       console.log("  Could not register automatically.");
       console.log("  Run this yourself: claude mcp add --scope user indelible -- indelible-mcp\n");
     }
+    try {
+      const hooks = installHooks();
+      console.log(hooks.alreadyInstalled ? "  \u2713 Auto-save hooks already installed\n" : "  \u2713 Auto-save hooks installed\n");
+    } catch (e) {
+      console.log(`  Could not install auto-save hooks automatically (${e.message}).`);
+      console.log("  Run this yourself: indelible-mcp install-hooks\n");
+    }
     config = await loadConfig();
   }
   let alreadyFunded = false;
@@ -8932,11 +9245,21 @@ async function runWizard() {
     if (utxos && utxos.length > 0) alreadyFunded = true;
   } catch {
   }
+  let saveGate = { ok: true, plan: "unknown" };
+  try {
+    saveGate = await requireProForWrite(config.address);
+  } catch {
+  }
+  const freeTier = !saveGate.ok && saveGate.plan && saveGate.plan !== "unknown";
   if (!alreadyFunded) {
     console.log(`  Your BSV address: ${config.address}`);
-    console.log("  Send BSV to this address to fund your wallet.");
-    console.log("  Each save costs less than $0.01 \u2014 even $1 gets you hundreds of saves.\n");
-    console.log("  Waiting for funds...");
+    console.log("  Fund your wallet with a dollar or two of BSV. Every save writes to the");
+    console.log("  blockchain for a fraction of a cent, paid from your own wallet.");
+    console.log("  Your diary conversations save free and unlimited; reads are always free.");
+    if (freeTier) {
+      console.log("  Saving your Claude Code sessions to chain is Pro: indelible.one/pricing");
+    }
+    console.log("\n  Waiting for funds...");
     while (true) {
       try {
         const utxos = await getUtxos(config.address);
@@ -8982,6 +9305,16 @@ async function runWizard() {
 `);
     }
   }
+  console.log("  Two guards now watch your saves:");
+  console.log("    Witness    \u2014 scans every save for leaked credentials and refuses");
+  console.log("                 to etch a key into the permanent record.");
+  console.log("    Guardrails \u2014 flag dangerous commands before they run.");
+  console.log('  Your diary companion is ready too \u2014 say "connect my diary" in Claude Code.');
+  console.log("");
+  console.log("  \u26A0 BACK UP YOUR KEY NOW: copy ~/.indelible/config.json somewhere safe");
+  console.log("    (USB drive or password manager). If this machine dies, that file");
+  console.log("    is the only way back into your on-chain history. No one can reset it.");
+  console.log("");
   console.log("  =========================================");
   console.log("  You're all set! Open Claude Code in VS Code and start coding.");
   console.log("");
@@ -9008,6 +9341,7 @@ if (args[0] === "hook") {
     });
   } else if (args[1] === "session-start") {
     (async () => {
+      await printTimeCard();
       const config = await loadConfig();
       if (!config?.style_txid) {
         process.exit(0);