indelible-mcp 5.7.6 → 5.7.7

package/CLI_HANDBOOK.md

@@ -172,27 +172,27 @@ How the money works, honestly: a buyer pays **your agent's own address** (never
 
 ### Save Session
 ```bash
-node C:/Indelible-main/indelible-cli/src/index.js save --summary "what happened"
+indelible-mcp save --summary "what happened"
 ```
 
 ### Load from Blockchain
 ```bash
-node C:/Indelible-main/indelible-cli/src/index.js load --sessions=5
+indelible-mcp load --sessions=5
 ```
 
 ### Check Status
 ```bash
-node C:/Indelible-main/indelible-cli/src/index.js status
+indelible-mcp status
 ```
 
 ### Save a File
 ```bash
-node C:/Indelible-main/indelible-cli/src/index.js vault save-file /path/to/file.js
+indelible-mcp vault save-file /path/to/file.js
 ```
 
 ### Ask Codex
 ```bash
-node C:/Indelible-main/indelible-cli/src/index.js diary chat "How should we architect this?"
+indelible-mcp diary chat "How should we architect this?"
 ```
 
 ---
@@ -249,15 +249,13 @@ The CLI and MCP server are the **same codebase**. They import the same tool func
 
 | | CLI | MCP Server |
 |---|---|---|
-| **Location** | `C:/Indelible-main/indelible-cli/src/` | `C:/bsv-claude-wrapper/mcp-server/` |
+| **Location** | `(published package)` | `(core source)` |
 | **Config** | Sync (`readFileSync`/`writeFileSync`) | Async (`await loadConfig()`) |
 | **Fetch** | Native `fetch` (Node 18+) | `node-fetch` package |
 | **Timeout** | `AbortSignal.timeout(ms)` | Manual `AbortController` + `setTimeout` |
 | **Entry point** | CLI arg parser in `index.js` | JSON-RPC stdin/stdout in `index.js` |
 | **How Claude calls it** | `node src/index.js <command>` | MCP protocol via Claude Code hooks |
 
-**Sync rule:** Any feature, fix, or change that goes into one MUST go into both. No exceptions. Adapt sync/async config pattern accordingly.
-
 ---
 
 ## Testing / Dog-Fooding
@@ -267,24 +265,24 @@ The CLI is a live test harness for the MCP. When you test a CLI command, you're
 ### Safe tests (no sats spent)
 ```bash
 # Config loads correctly
-node C:/Indelible-main/indelible-cli/src/index.js status
+indelible-mcp status
 
 # Blockchain read works
-node C:/Indelible-main/indelible-cli/src/index.js load --sessions=1
+indelible-mcp load --sessions=1
 
 # Style loads from chain
-node C:/Indelible-main/indelible-cli/src/index.js vault load-style
+indelible-mcp vault load-style
 ```
 
 ### Function-level tests (no sats spent)
 ```bash
-cd "C:/Indelible-main/indelible-cli" && node --input-type=module -e "
+cd /path/to/indelible-cli && node --input-type=module -e "
 import { checkConfirmation } from './src/lib/spv.js';
 const r = await checkConfirmation('TXID_HERE');
 console.log(JSON.stringify(r, null, 2));
 " 2>&1
 
-cd "C:/Indelible-main/indelible-cli" && node --input-type=module -e "
+cd /path/to/indelible-cli && node --input-type=module -e "
 import { checkTier } from './src/lib/api-client.js';
 import { loadConfig } from './src/lib/config.js';
 const config = loadConfig();
@@ -292,7 +290,7 @@ const r = await checkTier(config.api_key);
 console.log(JSON.stringify(r, null, 2));
 " 2>&1
 
-cd "C:/Indelible-main/indelible-cli" && node --input-type=module -e "
+cd /path/to/indelible-cli && node --input-type=module -e "
 import { verifyRecentSaves } from './src/tools/save_file.js';
 const r = await verifyRecentSaves();
 console.log(JSON.stringify(r, null, 2));
@@ -302,16 +300,16 @@ console.log(JSON.stringify(r, null, 2));
 ### Live tests (spends sats)
 ```bash
 # Session save (delta if prior save exists)
-node C:/Indelible-main/indelible-cli/src/index.js save --summary "test save"
+indelible-mcp save --summary "test save"
 
 # File save
-node C:/Indelible-main/indelible-cli/src/index.js vault save-file /path/to/small/file.txt
+indelible-mcp vault save-file /path/to/small/file.txt
 
 # Style save (auto-prepends core rules via ensureCoreRules)
-node C:/Indelible-main/indelible-cli/src/index.js vault save-style /path/to/rules.txt --name=test
+indelible-mcp vault save-style /path/to/rules.txt --name=test
 
 # Diary chat (costs OpenAI tokens, not sats)
-node C:/Indelible-main/indelible-cli/src/index.js diary chat "hello"
+indelible-mcp diary chat "hello"
 ```
 
 ---
@@ -370,7 +368,7 @@ indelible-cli/src/
 ## Rebuild the Executable
 
 ```bash
-cd "C:/Indelible-main/indelible-cli" && bun build --compile src/index.js --outfile dist/indelible.exe
+cd /path/to/indelible-cli && bun build --compile src/index.js --outfile dist/indelible.exe
 ```
 
 This creates a standalone `indelible.exe` — no Node.js required on the target machine.
@@ -395,7 +393,7 @@ This creates a standalone `indelible.exe` — no Node.js required on the target
 
 ## Config File
 
-`C:/Users/oorel/.indelible/config.json` — shared with MCP server.
+`~/.indelible/config.json` — shared with MCP server.
 
 | Setting | Description |
 |---------|-------------|
@@ -420,35 +418,35 @@ This creates a standalone `indelible.exe` — no Node.js required on the target
 - **Balance:** `indelible-mcp status`, or look your address up in the Chain Browser at indelible.one/explorer
 - **Fund it:** Send BSV to your own address
 - **Cost:** ~$0.21/MB at BSV=$16. Session saves are fractions of a cent.
-
----
-
-## The Strongbox — your raw session files, kept
-
-Claude Code deletes your raw session transcripts by default after about 30 days (its cleanup
-setting). Those files are the richest record you have — every tool call, every word, verbatim —
-richer even than your encrypted chain saves. The Strongbox keeps a verified, byte-identical copy
-of them under your own roof: `~/.indelible/transcript-vault/` on your machine. Nothing leaves
-your computer; nothing is redacted (it is a byte-copy in your own trust domain — your chain
-saves redact, your local Strongbox does not, deliberately).
-
-**You mostly never touch it.** `setup` installs two hooks so every compaction banks a copy and
-every session end does a forced verified refresh. Every successful save also protects the file
-it just read — including Codex sessions. If protecting ever fails, it fails silently rather
-than break your session.
-
-**Commands:**
-
-    indelible-mcp strongbox                 # look: what's protected, sizes, when
-    indelible-mcp strongbox run             # protect the current project's session now
-    indelible-mcp strongbox run --session <id>     # pick one when several exist (it never guesses)
-    indelible-mcp strongbox run --path <file>      # protect a specific transcript file
-
-A path outside your recognized transcript folders is refused — if you're deliberately rescuing
-a stray transcript from a backup, add `--outside-transcript-roots` (named that loudly on
-purpose). Symlinks are refused. The Strongbox never shrinks: a copy is only ever replaced by a
-verified larger one, and the original source file is never written to, ever.
-
-**Disk honesty:** copies cost disk. The Strongbox warns loudly when space runs low and never
-deletes anything on its own. Don't cloud-sync `~/.indelible` — it holds your keys and now your
-raw conversations.
+
+---
+
+## The Strongbox — your raw session files, kept
+
+Claude Code deletes your raw session transcripts by default after about 30 days (its cleanup
+setting). Those files are the richest record you have — every tool call, every word, verbatim —
+richer even than your encrypted chain saves. The Strongbox keeps a verified, byte-identical copy
+of them under your own roof: `~/.indelible/transcript-vault/` on your machine. Nothing leaves
+your computer; nothing is redacted (it is a byte-copy in your own trust domain — your chain
+saves redact, your local Strongbox does not, deliberately).
+
+**You mostly never touch it.** `setup` installs two hooks so every compaction banks a copy and
+every session end does a forced verified refresh. Every successful save also protects the file
+it just read — including Codex sessions. If protecting ever fails, it fails silently rather
+than break your session.
+
+**Commands:**
+
+    indelible-mcp strongbox                 # look: what's protected, sizes, when
+    indelible-mcp strongbox run             # protect the current project's session now
+    indelible-mcp strongbox run --session <id>     # pick one when several exist (it never guesses)
+    indelible-mcp strongbox run --path <file>      # protect a specific transcript file
+
+A path outside your recognized transcript folders is refused — if you're deliberately rescuing
+a stray transcript from a backup, add `--outside-transcript-roots` (named that loudly on
+purpose). Symlinks are refused. The Strongbox never shrinks: a copy is only ever replaced by a
+verified larger one, and the original source file is never written to, ever.
+
+**Disk honesty:** copies cost disk. The Strongbox warns loudly when space runs low and never
+deletes anything on its own. Don't cloud-sync `~/.indelible` — it holds your keys and now your
+raw conversations.

package/CUSTOMER_AGENT_HANDBOOK.md

@@ -19,7 +19,7 @@ Your day-one roster is small and real: two guards, one companion, and one memory
 
 That is the whole list **for this package**. Your agent crew is a different thing and it lives in the web app: sign in at indelible.one, open the Sanctuary, and birth sixteen agents derived from your own wallet. They are yours today, not a preview. Section 7 walks through it, and section 8 is honest about the two parts that are still unfinished.
 
-### The 29 tools you can call today
+### The 32 tools you can call today
 
 Grouped by what they cost:
 
@@ -38,9 +38,14 @@ One important nuance on "free": free means no subscription. On-chain writes stil
 
 ---
 
-## 2. What fires automatically (the four hooks)
+## 2. What fires automatically (the hooks)
 
-When you ran setup, the installer wired four hooks into Claude Code (`~/.claude/settings.local.json`). This is what each one does and why it is there.
+When you ran setup, the installer wired **six hooks across four events** into Claude Code, in
+`~/.claude/settings.json`: two on PreCompact, two on SessionStart, one on PreToolUse, and one on
+SessionEnd. (`settings.local.json` is the older location the installer migrates *from*.) You can
+see exactly what is installed at any time with `indelible-mcp install-hooks`, which prints the
+full inventory of every hook it manages before it writes anything. This is what each one does and
+why it is there.
 
 | Hook | Fires | Does |
 |---|---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indelible-mcp",
-  "version": "5.7.6",
+  "version": "5.7.7",
   "description": "Blockchain-backed memory and code storage for Claude Code. Save AI conversations and source code permanently on BSV.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -1003,8 +1003,8 @@ async function linkReservation(token, { buildCacheKey: buildCacheKey2 = null, tx
     return true;
   }, LOCK_OPTS);
 }
-async function linkOrRefuse(token, payload2 = {}) {
-  const linked = await linkReservation(token, payload2);
+async function linkOrRefuse(token, payload = {}) {
+  const linked = await linkReservation(token, payload);
   if (linked) return true;
   const err9 = new Error(
     "RESERVATION_LOST: the reservation holding these inputs is gone, so the coins are no longer excluded from another writer. Nothing was broadcast. Retry \u2014 the next attempt reserves fresh inputs. (Broadcasting now could spend a coin a second process has already sent.)"
@@ -2397,12 +2397,12 @@ async function commitSession(session, wif) {
     claim2 = await claimSpendableUtxos(session.address, getUtxos, { reconcile: RECONCILE_HOOKS });
     const utxos = claim2.utxos;
     if (utxos && utxos.length > 0) {
-      const payload2 = {
+      const payload = {
         protocol: "indelible.claude-code",
         encrypted: session.encrypted,
         wrap_owner: session.wrap_owner || null
       };
-      let { txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload2));
+      let { txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload));
       await linkOrRefuse(claim2.token, { txId, txHex, changeUtxos });
       let writeReceipt;
       try {
@@ -2413,7 +2413,7 @@ async function commitSession(session, wif) {
         claim2 = await claimSpendableUtxos(session.address, getUtxos, { reconcile: RECONCILE_HOOKS });
         const fresh = claim2.utxos;
         if (!fresh || fresh.length === 0) throw bErr;
-        ({ txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, fresh, JSON.stringify(payload2)));
+        ({ txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, fresh, JSON.stringify(payload)));
         await linkOrRefuse(claim2.token, { txId, txHex, changeUtxos });
         try {
           writeReceipt = await broadcastTx(txHex);
@@ -3043,22 +3043,22 @@ function consumeShare(envelope, recipientPrivkey, ownerPubkey) {
   const aad = buildAAD(envelope.owner_addr, envelope.recipient_addr, envelope.scope_txid);
   return eciesUnwrap(envelope.wrap_recipient, recipientPrivkey, aad);
 }
-function detectSaveFormat(payload2) {
-  const hasV3Fields = payload2 != null && (payload2.wrap_self !== void 0 || payload2.wrap_version !== void 0);
+function detectSaveFormat(payload) {
+  const hasV3Fields = payload != null && (payload.wrap_self !== void 0 || payload.wrap_version !== void 0);
   if (hasV3Fields) {
-    if (payload2.wrap_version === 3 && typeof payload2.wrap_self === "string" && payload2.wrap_self.length > 0) return "v3-wallet";
+    if (payload.wrap_version === 3 && typeof payload.wrap_self === "string" && payload.wrap_self.length > 0) return "v3-wallet";
     return "v3-malformed";
   }
-  if (payload2 && payload2.version === 2) return "v2-brc100";
-  if (payload2 && typeof payload2.wrap_owner === "string" && payload2.wrap_owner.length > 0) return "v2-wrapped";
+  if (payload && payload.version === 2) return "v2-brc100";
+  if (payload && typeof payload.wrap_owner === "string" && payload.wrap_owner.length > 0) return "v2-wrapped";
   return "legacy";
 }
-function detectVaultFormat(payload2) {
-  if (!payload2) return "legacy";
+function detectVaultFormat(payload) {
+  if (!payload) return "legacy";
   return detectSaveFormat({
-    wrap_owner: payload2.wrap_owner,
-    wrap_self: payload2.wrap_self,
-    wrap_version: payload2.wrap_version
+    wrap_owner: payload.wrap_owner,
+    wrap_self: payload.wrap_self,
+    wrap_version: payload.wrap_version
   });
 }
 function generateContentKey() {
@@ -3367,7 +3367,7 @@ async function saveStyle(rulesText, styleName, description) {
     rules: rulesText
   };
   const encrypted = encrypt(JSON.stringify(style), wif);
-  const payload2 = {
+  const payload = {
     protocol: "indelible.style",
     version: 1,
     name: styleName,
@@ -3390,7 +3390,7 @@ async function saveStyle(rulesText, styleName, description) {
       await settleReservation(claim2.token, "abort");
       return { success: false, error: "No UTXOs available. Fund your wallet first." };
     }
-    const { txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload2));
+    const { txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload));
     await linkOrRefuse(claim2.token, { txId, txHex, changeUtxos });
     let writeReceipt = null;
     let bcastErr = null;
@@ -4503,16 +4503,16 @@ import { PrivateKey as PrivateKey7, CompletedProtoWallet as CompletedProtoWallet
 import { Transaction as Transaction5 } from "@bsv/sdk";
 import { readFileSync as readFileSync11 } from "fs";
 async function decryptSession(payloadOrEncrypted, wif, wallet = null) {
-  let payload2;
+  let payload;
   if (typeof payloadOrEncrypted === "string") {
-    payload2 = { encrypted: payloadOrEncrypted, wrap_owner: null };
+    payload = { encrypted: payloadOrEncrypted, wrap_owner: null };
   } else {
-    payload2 = payloadOrEncrypted;
+    payload = payloadOrEncrypted;
   }
-  const encrypted = payload2.encrypted;
-  const wrap_owner = payload2.wrap_owner;
+  const encrypted = payload.encrypted;
+  const wrap_owner = payload.wrap_owner;
   let text;
-  const fmt = detectSaveFormat({ wrap_owner, wrap_self: payload2.wrap_self, wrap_version: payload2.wrap_version });
+  const fmt = detectSaveFormat({ wrap_owner, wrap_self: payload.wrap_self, wrap_version: payload.wrap_version });
   if (fmt === "v3-wallet") {
     let w = wallet;
     if (!w && wif) {
@@ -4523,24 +4523,24 @@ async function decryptSession(payloadOrEncrypted, wif, wallet = null) {
       }
     }
     let r = null;
-    if (payload2.owner_pubkey && w) {
+    if (payload.owner_pubkey && w) {
       let idPub = null;
       try {
         idPub = (await w.getPublicKey({ identityKey: true }))?.publicKey || null;
       } catch {
       }
-      if (idPub && idPub !== payload2.owner_pubkey) {
-        if (payload2.wrap_recovery) {
-          const rr = await unwrapRecoveryV3(payload2.wrap_recovery, w, payload2.key_id, payload2.owner_pubkey);
+      if (idPub && idPub !== payload.owner_pubkey) {
+        if (payload.wrap_recovery) {
+          const rr = await unwrapRecoveryV3(payload.wrap_recovery, w, payload.key_id, payload.owner_pubkey);
           if (rr.ok) r = rr;
         }
         if (!r) r = { ok: false, reason: "wallet_unavailable" };
       }
     }
     if (!r) {
-      r = await unwrapForSelfV3(payload2.wrap_self, w, payload2.key_id);
-      if (!r.ok && r.reason === "corrupt" && payload2.wrap_recovery && payload2.owner_pubkey) {
-        r = await unwrapRecoveryV3(payload2.wrap_recovery, w, payload2.key_id, payload2.owner_pubkey);
+      r = await unwrapForSelfV3(payload.wrap_self, w, payload.key_id);
+      if (!r.ok && r.reason === "corrupt" && payload.wrap_recovery && payload.owner_pubkey) {
+        r = await unwrapRecoveryV3(payload.wrap_recovery, w, payload.key_id, payload.owner_pubkey);
       }
     }
     if (!r.ok) {
@@ -4622,14 +4622,14 @@ async function fetchEncryptedFromChain(txId) {
           }
           if (end > 0) {
             try {
-              const payload2 = JSON.parse(str.slice(jsonStart, end + 1));
-              if (payload2.encrypted) {
-                const out = { encrypted: payload2.encrypted, wrap_owner: payload2.wrap_owner || null };
-                if (payload2.wrap_version !== void 0) out.wrap_version = payload2.wrap_version;
-                if (payload2.wrap_self !== void 0) out.wrap_self = payload2.wrap_self;
-                if (payload2.key_id !== void 0) out.key_id = payload2.key_id;
-                if (payload2.wrap_recovery !== void 0) out.wrap_recovery = payload2.wrap_recovery;
-                if (payload2.owner_pubkey !== void 0) out.owner_pubkey = payload2.owner_pubkey;
+              const payload = JSON.parse(str.slice(jsonStart, end + 1));
+              if (payload.encrypted) {
+                const out = { encrypted: payload.encrypted, wrap_owner: payload.wrap_owner || null };
+                if (payload.wrap_version !== void 0) out.wrap_version = payload.wrap_version;
+                if (payload.wrap_self !== void 0) out.wrap_self = payload.wrap_self;
+                if (payload.key_id !== void 0) out.key_id = payload.key_id;
+                if (payload.wrap_recovery !== void 0) out.wrap_recovery = payload.wrap_recovery;
+                if (payload.owner_pubkey !== void 0) out.owner_pubkey = payload.owner_pubkey;
                 return out;
               }
             } catch {
@@ -6462,11 +6462,11 @@ function canonicalJson(obj) {
   const keys = Object.keys(obj).sort();
   return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJson(obj[k])).join(",") + "}";
 }
-function signEnvelopeWith(identity, payload2) {
+function signEnvelopeWith(identity, payload) {
   if (!identity?.wif || !identity?.identity_key_hex) {
     throw new Error("customer-agent: signEnvelopeWith needs an identity with { wif, identity_key_hex }");
   }
-  const signedPayload = { ...payload2, issued_at: payload2.issued_at || (/* @__PURE__ */ new Date()).toISOString() };
+  const signedPayload = { ...payload, issued_at: payload.issued_at || (/* @__PURE__ */ new Date()).toISOString() };
   const canonical = canonicalJson(signedPayload);
   const priv = PrivateKey11.fromWif(identity.wif);
   const digestBytes = Hash.sha256(canonical);
@@ -7676,7 +7676,7 @@ async function writeRecoveryArtifact(scope, plan, secret) {
   const cipher = createCipheriv4("aes-256-gcm", pinKey, iv);
   const enc = Buffer.concat([cipher.update(body, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
-  const payload2 = {
+  const payload = {
     version: MIGRATION_VERSION,
     alg: "aes-256-gcm",
     kdf,
@@ -7691,7 +7691,7 @@ async function writeRecoveryArtifact(scope, plan, secret) {
   };
   const path = join33(dirname14(agentsDir(scope)), `agent-keys-recovery-${Date.now()}.json`);
   const tmp = `${path}.tmp`;
-  await writeFile8(tmp, JSON.stringify(payload2, null, 2), { mode: 384 });
+  await writeFile8(tmp, JSON.stringify(payload, null, 2), { mode: 384 });
   await rename6(tmp, path);
   const back = JSON.parse(await readFile14(path, "utf8"));
   let recovered;
@@ -9295,8 +9295,8 @@ function makeHeartbeat(cfg2) {
     }
     return set;
   };
-  const emit2 = async (kind, payload2, parents, entryEpoch) => {
-    const ikBasis = digest2(DIGEST_DOMAINS.event, canonicalize2({ me, kind, payload: payload2, parents }));
+  const emit2 = async (kind, payload, parents, entryEpoch) => {
+    const ikBasis = digest2(DIGEST_DOMAINS.event, canonicalize2({ me, kind, payload, parents }));
     const ev = makeEvent({
       event_kind: kind,
       actor: { host: me, instance_ref: encryptRef(cfg2.wif, `inst:${me}`), thread_ref: encryptRef(cfg2.wif, `thread:${me}`) },
@@ -9304,7 +9304,7 @@ function makeHeartbeat(cfg2) {
       causality: { parents: parents ?? [], basis: [] },
       semantics: { provenance_class: kind === "state.inference" ? "derived" : "observed", claim_status: "asserted" },
       idempotency_key: `ik-${me}-${ikBasis.slice(0, 24)}`,
-      payload: payload2,
+      payload,
       created_at: (/* @__PURE__ */ new Date()).toISOString()
     });
     const pre = gate();
@@ -10326,14 +10326,14 @@ async function setupWallet(apiUrl = DEFAULT_API_URL2, importWif, pin) {
   if (!importWif) {
     return {
       success: false,
-      error: "Private key required. Sign in at indelible.one with Google to get your key, then run: indelible-mcp setup --wif=YOUR_KEY --pin=YOUR_PIN",
+      error: "Private key required. Get it at indelible.one \u2192 Settings \u2192 Private Key, then run `indelible-mcp` with no arguments and follow the prompts \u2014 that path takes the key at a prompt, so it never lands in your shell history. For automation: setup --wif=YOUR_KEY --pin=YOUR_PIN (clear your shell history afterward).",
       hint: "Your key is shown in Settings after signing in at indelible.one"
     };
   }
   if (!pin || pin.length < 4) {
     return {
       success: false,
-      error: "PIN required (minimum 4 characters). Run: indelible-mcp setup --wif=YOUR_KEY --pin=YOUR_PIN",
+      error: "PIN required (minimum 4 characters). Run `indelible-mcp` with no arguments to be prompted for both \u2014 neither value is written to your shell history that way. For automation: setup --wif=YOUR_KEY --pin=YOUR_PIN.",
       hint: "Your PIN encrypts your private key locally. Never share it."
     };
   }
@@ -10561,9 +10561,9 @@ function base58Decode(str) {
 function isValidWif(candidate) {
   const decoded = base58Decode(candidate);
   if (!decoded || decoded.length < 5) return false;
-  const payload2 = decoded.subarray(0, decoded.length - 4);
+  const payload = decoded.subarray(0, decoded.length - 4);
   const checksum = decoded.subarray(decoded.length - 4);
-  const h = createHash6("sha256").update(createHash6("sha256").update(payload2).digest()).digest();
+  const h = createHash6("sha256").update(createHash6("sha256").update(payload).digest()).digest();
   return h.subarray(0, 4).equals(checksum);
 }
 var MAX_VALIDATED_CANDIDATES = 2e4;
@@ -10983,10 +10983,10 @@ var CODE_EXTS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", "
 var CLONE_CHECK_TIMEOUT_MS = 5e3;
 var MAX_CHUNK_SIZE = 1e7;
 var TX_CACHE_DIR = join11(homedir8(), ".indelible", "tx-cache");
-async function cacheTx(txId, payload2) {
+async function cacheTx(txId, payload) {
   try {
     if (!existsSync8(TX_CACHE_DIR)) await mkdir2(TX_CACHE_DIR, { recursive: true });
-    await writeFile2(join11(TX_CACHE_DIR, `${txId}.json`), JSON.stringify(payload2));
+    await writeFile2(join11(TX_CACHE_DIR, `${txId}.json`), JSON.stringify(payload));
   } catch (e) {
   }
 }
@@ -11111,7 +11111,7 @@ async function saveFile(filePath, options = {}) {
     const filenameEnc = encrypt(filename, wif);
     const pathEnc = encrypt(relativePath, wif);
     if (encrypted.length <= MAX_CHUNK_SIZE) {
-      const payload2 = {
+      const payload = {
         protocol: "indelible.file",
         version: 2,
         filename_enc: filenameEnc,
@@ -11126,7 +11126,7 @@ async function saveFile(filePath, options = {}) {
       const bc = await idempotentBuildAndBroadcast({
         address: config2.address,
         contentKey: `file|${relativePath}|sha256:${contentHash}`,
-        build: () => buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload2)),
+        build: () => buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload)),
         broadcast: (hex) => broadcastTx(hex),
         checkConfirmation: (id) => checkConfirmation(id),
         onPersisted: heldClaims[0] ? () => linkOrRefuse(heldClaims[0].token, { buildCacheKey: buildCacheKey(config2.address, `file|${relativePath}|sha256:${contentHash}`) }) : void 0
@@ -11137,7 +11137,7 @@ async function saveFile(filePath, options = {}) {
       _finalWrite = bc.write;
       _saveFee += fee;
       _finalSize = txSize;
-      if (!bc.reused) await cacheTx(txId, payload2).catch((e) => process.stderr.write(`[indelible] payload cache write failed (non-fatal): ${e?.message}
+      if (!bc.reused) await cacheTx(txId, payload).catch((e) => process.stderr.write(`[indelible] payload cache write failed (non-fatal): ${e?.message}
 `));
       masterTxId = txId;
       finalChangeUtxos = changeUtxos;
@@ -12979,13 +12979,13 @@ import { join as join19, relative, basename as basename3 } from "path";
 import { homedir as homedir15 } from "os";
 
 // mcp-server/lib/reconcile.js
-function payloadContentKey(payload2) {
-  if (!payload2 || typeof payload2 !== "object") return null;
-  if (payload2.protocol === "indelible.project-bundle" && Array.isArray(payload2.files)) {
-    const hashes = payload2.files.map((f) => f && f.content_hash).filter(Boolean);
+function payloadContentKey(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  if (payload.protocol === "indelible.project-bundle" && Array.isArray(payload.files)) {
+    const hashes = payload.files.map((f) => f && f.content_hash).filter(Boolean);
     return hashes.length ? `bundle:${hashes.join(",")}` : null;
   }
-  if (payload2.content_hash) return String(payload2.content_hash).replace(/^sha256:/, "");
+  if (payload.content_hash) return String(payload.content_hash).replace(/^sha256:/, "");
   return null;
 }
 async function findByContentKey({
@@ -13020,14 +13020,14 @@ async function findByContentKey({
     if (!txid || exclude.has(txid.toLowerCase())) continue;
     if (confirmedOnly && !(h.height > 0)) continue;
     scanned++;
-    let payload2 = null;
+    let payload = null;
     try {
-      payload2 = await fetchPayload(txid);
+      payload = await fetchPayload(txid);
     } catch {
       fetchFailures++;
       continue;
     }
-    if (payloadContentKey(payload2) === targetKey) {
+    if (payloadContentKey(payload) === targetKey) {
       const height = h.height || null;
       matches.push({ txid, height });
       if (height > 0) confirmedFound = true;
@@ -13051,10 +13051,10 @@ async function findByContentKey({
 
 // mcp-server/tools/save_project.js
 var TX_CACHE_DIR2 = join19(homedir15(), ".indelible", "tx-cache");
-async function cacheTx2(txId, payload2) {
+async function cacheTx2(txId, payload) {
   try {
     if (!existsSync15(TX_CACHE_DIR2)) await mkdir5(TX_CACHE_DIR2, { recursive: true });
-    await writeFile4(join19(TX_CACHE_DIR2, `${txId}.json`), JSON.stringify(payload2));
+    await writeFile4(join19(TX_CACHE_DIR2, `${txId}.json`), JSON.stringify(payload));
   } catch (e) {
   }
 }
@@ -13187,7 +13187,7 @@ async function saveProject(dirPath, options = {}) {
       });
       totalSize += fileSize;
     }
-    const payload2 = {
+    const payload = {
       protocol: "indelible.project-bundle",
       version: 1,
       name_enc: encrypt(projectName, wif),
@@ -13214,7 +13214,7 @@ async function saveProject(dirPath, options = {}) {
     const bc = await idempotentBuildAndBroadcast({
       address: config2.address,
       contentKey: `project|${projectName}|${bundleKey}`,
-      build: () => buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload2), "INDELIBLE_PROJECT_BUNDLE"),
+      build: () => buildOpReturnTxWithChange(wif, utxos, JSON.stringify(payload), "INDELIBLE_PROJECT_BUNDLE"),
       broadcast: (hex) => broadcastTx(hex),
       checkConfirmation: (id) => checkConfirmation(id),
       onPersisted: () => linkOrRefuse(claim2.token, { buildCacheKey: buildCacheKey(config2.address, `project|${projectName}|${bundleKey}`) })
@@ -13224,7 +13224,7 @@ async function saveProject(dirPath, options = {}) {
 `);
     const _wr = bc.write;
     await settleFromWriteResult(claim2.token, { writeReceipt: _wr, changeUtxos });
-    if (!bc.reused) await cacheTx2(txId, payload2).catch((e) => process.stderr.write(`[indelible] payload cache write failed (non-fatal): ${e?.message}
+    if (!bc.reused) await cacheTx2(txId, payload).catch((e) => process.stderr.write(`[indelible] payload cache write failed (non-fatal): ${e?.message}
 `));
     const freshConfig = await loadConfig();
     const projects = freshConfig.project_txids || [];
@@ -13240,7 +13240,7 @@ async function saveProject(dirPath, options = {}) {
     } catch {
     }
     const receipt = buildReceipt(_wr, { txId, fee, txSize });
-    appendReceipt(receipt, { trigger: "interactive", saveType: "project", contentHash: payloadContentKey(payload2) });
+    appendReceipt(receipt, { trigger: "interactive", saveType: "project", contentHash: payloadContentKey(payload) });
     return {
       success: true,
       txId,
@@ -13319,7 +13319,7 @@ async function healStrandedTxid(strandedTxId, config2) {
     return null;
   }
 }
-async function unwrapVaultV3(payload2, wif) {
+async function unwrapVaultV3(payload, wif) {
   let w = null;
   try {
     w = new CompletedProtoWallet3(PrivateKey8.fromWif(wif));
@@ -13327,23 +13327,23 @@ async function unwrapVaultV3(payload2, wif) {
     w = null;
   }
   if (!w) return { ok: false, code: "WALLET_UNAVAILABLE" };
-  if (payload2.owner_pubkey) {
+  if (payload.owner_pubkey) {
     let idPub = null;
     try {
       idPub = (await w.getPublicKey({ identityKey: true }))?.publicKey || null;
     } catch {
     }
-    if (idPub && idPub !== payload2.owner_pubkey) {
-      if (payload2.wrap_recovery) {
-        const rr = await unwrapRecoveryV3(payload2.wrap_recovery, w, payload2.key_id, payload2.owner_pubkey);
+    if (idPub && idPub !== payload.owner_pubkey) {
+      if (payload.wrap_recovery) {
+        const rr = await unwrapRecoveryV3(payload.wrap_recovery, w, payload.key_id, payload.owner_pubkey);
         if (rr.ok) return { ok: true, contentKey: rr.contentKey };
       }
       return { ok: false, code: "WALLET_UNAVAILABLE" };
     }
   }
-  let r = await unwrapForSelfV3(payload2.wrap_self, w, payload2.key_id);
-  if (!r.ok && r.reason === "corrupt" && payload2.wrap_recovery && payload2.owner_pubkey) {
-    r = await unwrapRecoveryV3(payload2.wrap_recovery, w, payload2.key_id, payload2.owner_pubkey);
+  let r = await unwrapForSelfV3(payload.wrap_self, w, payload.key_id);
+  if (!r.ok && r.reason === "corrupt" && payload.wrap_recovery && payload.owner_pubkey) {
+    r = await unwrapRecoveryV3(payload.wrap_recovery, w, payload.key_id, payload.owner_pubkey);
   }
   if (!r.ok) return { ok: false, code: r.reason === "wallet_unavailable" ? "WALLET_UNAVAILABLE" : "V3_CORRUPT" };
   return { ok: true, contentKey: r.contentKey };
@@ -13390,34 +13390,34 @@ async function loadFile(txId, options = {}) {
   if (!wif) {
     return { success: false, error: "Wallet not configured or PIN incorrect. Run setup_wallet first." };
   }
-  let payload2 = await fetchJsonPayload(txId);
-  if (!payload2) {
+  let payload = await fetchJsonPayload(txId);
+  if (!payload) {
     const healed = await healStrandedTxid(txId, config2);
     if (healed) {
       process.stderr.write(`[g-363] receipt ${txId.slice(0, 12)}\u2026 was stranded \u2014 real tx is ${healed.txid.slice(0, 12)}\u2026, loading that
 `);
-      payload2 = await fetchJsonPayload(healed.txid);
-      if (payload2) {
+      payload = await fetchJsonPayload(healed.txid);
+      if (payload) {
         txId = healed.txid;
         options._healedFrom = healed.from;
       }
     }
-    if (!payload2) {
+    if (!payload) {
       return { success: false, error: `Could not fetch or parse tx: ${txId}` };
     }
   }
-  if (payload2.protocol !== "indelible.file") {
-    return { success: false, error: `Not an indelible.file tx (got: ${payload2.protocol || "unknown"})` };
+  if (payload.protocol !== "indelible.file") {
+    return { success: false, error: `Not an indelible.file tx (got: ${payload.protocol || "unknown"})` };
   }
-  const vfmt = detectVaultFormat(payload2);
+  const vfmt = detectVaultFormat(payload);
   if (vfmt === "v3-wallet") {
-    const uv = await unwrapVaultV3(payload2, wif);
+    const uv = await unwrapVaultV3(payload, wif);
     if (!uv.ok) {
       return { success: false, code: uv.code, error: uv.code === "WALLET_UNAVAILABLE" ? "wallet-native file: not readable from this box \u2014 its key lives in an external wallet (open it in the web app), or this WIF is not the owner" : "wallet-native file: unwrap failed (corrupt or wrong wallet)" };
     }
     let outBuf2;
     try {
-      const dec = decryptWithKey(payload2.encrypted, Buffer.from(uv.contentKey));
+      const dec = decryptWithKey(payload.encrypted, Buffer.from(uv.contentKey));
       outBuf2 = dec.startsWith("gz:") ? gunzipSync2(Buffer.from(dec.slice(3), "base64")) : Buffer.from(dec, "utf8");
     } catch (err9) {
       return { success: false, code: "V3_CORRUPT", error: `wallet-native decrypt failed: ${err9.message}` };
@@ -13425,24 +13425,24 @@ async function loadFile(txId, options = {}) {
     const contentHash2 = sha256(outBuf2);
     let meta = {};
     try {
-      meta = JSON.parse(decryptWithKey(payload2.meta_enc, Buffer.from(uv.contentKey)));
+      meta = JSON.parse(decryptWithKey(payload.meta_enc, Buffer.from(uv.contentKey)));
     } catch {
     }
-    const verified2 = meta.sha256 ? contentHash2 === meta.sha256 : payload2.content_hash ? contentHash2 === payload2.content_hash.replace("sha256:", "") : null;
+    const verified2 = meta.sha256 ? contentHash2 === meta.sha256 : payload.content_hash ? contentHash2 === payload.content_hash.replace("sha256:", "") : null;
     if (options.outputPath) {
       const dir = dirname8(options.outputPath);
       if (!existsSync16(dir)) await mkdir6(dir, { recursive: true });
       await writeFile5(options.outputPath, outBuf2);
     }
-    const isBinary2 = payload2.enc === "b64";
+    const isBinary2 = payload.enc === "b64";
     return {
       success: true,
       txId,
       wallet_native: true,
       filename: meta.filename,
       path: meta.path,
-      size: payload2.size,
-      content_hash: payload2.content_hash,
+      size: payload.size,
+      content_hash: payload.content_hash,
       verified: verified2,
       content: isBinary2 ? `[binary file: ${outBuf2.length} bytes${options.outputPath ? ", written to disk" : ""}]` : outBuf2.toString("utf8")
     };
@@ -13451,10 +13451,10 @@ async function loadFile(txId, options = {}) {
     return { success: false, code: "V3_CORRUPT", error: "file carries malformed v3 wrap fields \u2014 failing closed" };
   }
   let encrypted;
-  if (payload2._chunks) {
+  if (payload._chunks) {
     let encryptedParts = "";
-    for (let i = 1; i <= payload2._chunks; i++) {
-      const chunkTxId = payload2[`chunk_${i}`];
+    for (let i = 1; i <= payload._chunks; i++) {
+      const chunkTxId = payload[`chunk_${i}`];
       if (!chunkTxId) {
         return { success: false, error: `Missing chunk_${i} reference in master index` };
       }
@@ -13466,7 +13466,7 @@ async function loadFile(txId, options = {}) {
     }
     encrypted = encryptedParts;
   } else {
-    encrypted = payload2.encrypted;
+    encrypted = payload.encrypted;
   }
   if (!encrypted) {
     return { success: false, error: "No encrypted content found in tx" };
@@ -13483,7 +13483,7 @@ async function loadFile(txId, options = {}) {
     return { success: false, error: `Decryption failed: ${err9.message}` };
   }
   const contentHash = sha256(outBuf);
-  const expectedHash = payload2.content_hash?.replace("sha256:", "") || null;
+  const expectedHash = payload.content_hash?.replace("sha256:", "") || null;
   const verified = expectedHash ? contentHash === expectedHash : null;
   if (options.outputPath) {
     const dir = dirname8(options.outputPath);
@@ -13492,10 +13492,10 @@ async function loadFile(txId, options = {}) {
     }
     await writeFile5(options.outputPath, outBuf);
   }
-  const isBinary = payload2.enc === "b64";
+  const isBinary = payload.enc === "b64";
   const content = isBinary ? `[binary file: ${outBuf.length} bytes${options.outputPath ? ", written to disk" : ""}]` : outBuf.toString("utf8");
-  const filename = payload2.filename_enc ? decrypt(payload2.filename_enc, wif) : payload2.filename;
-  const filePath = payload2.path_enc ? decrypt(payload2.path_enc, wif) : payload2.path;
+  const filename = payload.filename_enc ? decrypt(payload.filename_enc, wif) : payload.filename;
+  const filePath = payload.path_enc ? decrypt(payload.path_enc, wif) : payload.path;
   let onChain = null, blockHeight = null;
   try {
     const seen = await checkConfirmation(txId);
@@ -13509,8 +13509,8 @@ async function loadFile(txId, options = {}) {
     txId,
     filename,
     path: filePath,
-    size: payload2.size,
-    enc: payload2.enc || "utf8",
+    size: payload.size,
+    enc: payload.enc || "utf8",
     content,
     contentHash: `sha256:${contentHash}`,
     verified,
@@ -13519,7 +13519,7 @@ async function loadFile(txId, options = {}) {
     on_chain: onChain,
     block_height: blockHeight,
     source: onChain === true ? "chain" : "federation-custody",
-    chunks: payload2._chunks || 1,
+    chunks: payload._chunks || 1,
     ...options._healedFrom ? { healed_from: options._healedFrom, healed: true } : {},
     message: `File "${filename}" loaded.${verified === true ? " Hash verified." : verified === false ? " WARNING: Hash mismatch!" : ""} ${custody}${options._healedFrom ? ` (Your saved receipt ${options._healedFrom.slice(0, 12)}\u2026 was a stranded save-race attempt; the real on-chain tx is ${txId.slice(0, 12)}\u2026 \u2014 same content, verified. Your data was never lost.)` : ""}`
   };
@@ -13737,7 +13737,7 @@ async function updateVaultIndex() {
     totalSize: p.totalSize || 0,
     timestamp: p.timestamp || null
   } : { txid: p.txId, fileCount: p.fileCount || 0, totalSize: p.totalSize || 0, timestamp: p.timestamp || null, wrap: "v3" });
-  const payload2 = {
+  const payload = {
     protocol: "indelible.vault-index",
     version: 1,
     files: encFiles,
@@ -13762,7 +13762,7 @@ async function updateVaultIndex() {
     const { txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(
       wif,
       utxos,
-      JSON.stringify(payload2)
+      JSON.stringify(payload)
     );
     await linkOrRefuse(claim2.token, { txId, txHex, changeUtxos });
     let result = null;
@@ -14432,10 +14432,10 @@ async function saveGoalsToChain() {
       content: [{ type: "text", text: "No UTXOs available. Fund your wallet." }]
     };
   }
-  let txId, fee, txSize, writeReceipt;
+  let txId, fee, txSize, writeReceipt, snapshotAt;
   try {
     const encrypted = encryptGoals(goalsData, wif);
-    const payload2 = {
+    const payload = {
       protocol: "indelible.goals-snapshot",
       version: 1,
       owner: address,
@@ -14444,11 +14444,12 @@ async function saveGoalsToChain() {
       completed_count: completed.length,
       encrypted
     };
+    snapshotAt = payload.timestamp;
     let txHex, changeUtxos;
     ({ txHex, txId, changeUtxos, fee, txSize } = await buildOpReturnTxWithChange(
       wif,
       utxos,
-      JSON.stringify(payload2)
+      JSON.stringify(payload)
     ));
     await linkOrRefuse(claim2.token, { txId, txHex, changeUtxos });
     writeReceipt = null;
@@ -14465,17 +14466,31 @@ async function saveGoalsToChain() {
     });
     throw err9;
   }
-  const receipt = buildReceipt(writeReceipt, { txId, fee, txSize });
-  appendReceipt(receipt, { trigger: "interactive", saveType: "goals" });
-  await updateConfig((c) => ({
-    ...c,
-    goals_snapshot_hash: contentHash,
-    goals_snapshot_txid: txId,
-    goals_snapshot_at: payload.timestamp,
-    goals_snapshot_count: goals.length,
-    goals_snapshot_completed_count: completed.length
-  }));
-  pushGoalsToServer(goalsData, { always: true, snapshot: { txid: txId, at: payload.timestamp, count: goals.length, completed_count: completed.length } });
+  const warnings = [];
+  let receipt = null;
+  try {
+    receipt = buildReceipt(writeReceipt, { txId, fee, txSize });
+    appendReceipt(receipt, { trigger: "interactive", saveType: "goals" });
+  } catch (e) {
+    warnings.push(`\u26A0\uFE0F THE BROADCAST SUCCEEDED (txid ${txId}) BUT LOCAL RECONCILIATION AND AUDIT STATE WERE NOT RECORDED: the save-log row could not be written (${e && e.message || e}). Your goals ARE on chain and your coin IS spent \u2014 do NOT re-run this to "fix" it. Record that txid somewhere now; the local ledger is missing this save, so reconciliation will not see it.`);
+  }
+  try {
+    await updateConfig((c) => ({
+      ...c,
+      goals_snapshot_hash: contentHash,
+      goals_snapshot_txid: txId,
+      goals_snapshot_at: snapshotAt,
+      goals_snapshot_count: goals.length,
+      goals_snapshot_completed_count: completed.length
+    }));
+  } catch (e) {
+    warnings.push(`the local snapshot marker was not updated (${e && e.message || e}) \u2014 the save landed, but an unchanged re-save will not know it can skip, so it may re-pay.`);
+  }
+  try {
+    await Promise.resolve(pushGoalsToServer(goalsData, { always: true, snapshot: { txid: txId, at: snapshotAt, count: goals.length, completed_count: completed.length } }));
+  } catch (e) {
+    warnings.push(`the web Goals board was not refreshed (${e && e.message || e}) \u2014 chain data is unaffected; the tab catches up on its next sync.`);
+  }
   return {
     content: [{
       type: "text",
@@ -14484,9 +14499,11 @@ async function saveGoalsToChain() {
 address: ${address}
 goals: ${goals.length} active, ${completed.length} completed
 
-${formatSaveReceipt(receipt)}
+${receipt ? formatSaveReceipt(receipt) : `txid: ${txId}`}
+
+` + (warnings.length ? `${warnings.join("\n\n")}
 
-The Goals tab's "On chain" section shows this snapshot on next refresh.`
+` : "") + `The Goals tab's "On chain" section shows this snapshot on next refresh.`
     }]
   };
 }
@@ -15003,7 +15020,7 @@ async function reportBug(args2 = {}, mcpVersion) {
     return { success: false, error: "summary and description are required (you supply the narrative; the tool supplies the facts)." };
   }
   const config2 = readJson(join31(INDELIBLE_DIR, "config.json")) || {};
-  const payload2 = {
+  const payload = {
     // AI-supplied narrative (defensively redacted + length-capped)
     summary: redactSecrets2(summary).slice(0, 200),
     description: redactSecrets2(description).slice(0, 5e3),
@@ -15026,10 +15043,10 @@ async function reportBug(args2 = {}, mcpVersion) {
     const resp = await fetch(INTAKE_URL, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload2)
+      body: JSON.stringify(payload)
     });
     if (!resp.ok) {
-      return { success: false, error: `intake responded ${resp.status}`, sent: { summary: payload2.summary, mcp_version: payload2.mcp_version } };
+      return { success: false, error: `intake responded ${resp.status}`, sent: { summary: payload.summary, mcp_version: payload.mcp_version } };
     }
     const data = await resp.json().catch(() => ({}));
     if (data.known_issue) {
@@ -15138,18 +15155,18 @@ async function shareSession({ session_txid, recipient_addr, expires_at = null })
   if (!_gate.ok) return { success: false, gated: true, plan: _gate.plan, upsell: _gate.upsell, error: _gate.error };
   const ownerPriv = PrivateKey13.fromWif(wif);
   const ownerAddr = ownerPriv.toPublicKey().toAddress();
-  const payload2 = await fetchScopePayload(session_txid);
-  if (!payload2) return { success: false, error: `could not fetch scope tx ${session_txid}` };
-  const fmt = detectSaveFormat({ wrap_owner: payload2.wrap_owner, wrap_self: payload2.wrap_self, wrap_version: payload2.wrap_version });
+  const payload = await fetchScopePayload(session_txid);
+  if (!payload) return { success: false, error: `could not fetch scope tx ${session_txid}` };
+  const fmt = detectSaveFormat({ wrap_owner: payload.wrap_owner, wrap_self: payload.wrap_self, wrap_version: payload.wrap_version });
   let contentKey;
   if (fmt === "v3-wallet") {
-    const rv3 = await unwrapForSelfV3(payload2.wrap_self, new CompletedProtoWallet4(ownerPriv), payload2.key_id);
+    const rv3 = await unwrapForSelfV3(payload.wrap_self, new CompletedProtoWallet4(ownerPriv), payload.key_id);
     if (!rv3.ok) {
       return { success: false, error: rv3.reason === "wallet_unavailable" ? "failed to unwrap own v3 content_key: no wallet available" : `failed to unwrap own v3 content_key: ${rv3.reason} (wallet-native saves made by an external wallet can only be shared from the web app)` };
     }
     contentKey = rv3.contentKey;
   } else if (fmt === "v2-wrapped") {
-    const r = unwrapForOwner(payload2.wrap_owner, ownerPriv);
+    const r = unwrapForOwner(payload.wrap_owner, ownerPriv);
     if (!r.ok) return { success: false, error: `failed to unwrap own content_key: ${r.reason}` };
     contentKey = r.contentKey;
   } else if (fmt === "v3-malformed") {
@@ -15733,9 +15750,17 @@ async function runCli(args2) {
       const importWif = args2.find((a) => a.startsWith("--wif="))?.split("=")[1];
       const pin = args2.find((a) => a.startsWith("--pin="))?.split("=")[1];
       const result = await setupWallet(apiUrl || void 0, importWif, pin);
+      if (!result || result.success === false) {
+        result.hooks = "not installed \u2014 setup did not complete";
+        if (!importWif) {
+          result.hint = "Run `indelible-mcp` with no arguments and follow the prompts. That path takes your key at a prompt, so it never lands in your shell history. Use `setup --wif=\u2026 --pin=\u2026` only for automation, and clear your shell history afterward if you do.";
+        }
+        emit(result);
+        break;
+      }
       const hooks = installHooks();
       result.hooks = hooks.alreadyInstalled ? "Auto-save hooks already installed" : `Installed hooks: ${hooks.installed.join(", ")} \u2192 ${hooks.settingsPath}`;
-      console.log(JSON.stringify(result, null, 2));
+      emit(result);
       break;
     }
     case "save": {
@@ -16999,10 +17024,11 @@ Answer THAT message and nothing else \u2014 the wire also carries unrelated conv
 }
 function printHelp() {
   console.log(`
-Indelible MCP \u2014 Blockchain memory for Claude Code (v5.7.6)
+Indelible MCP \u2014 Blockchain memory for Claude Code (v5.7.7)
 
 Setup:
-  indelible-mcp setup --wif=KEY --pin=PIN    Import and encrypt your private key
+  indelible-mcp                              Set up interactively (recommended \u2014 your key is never written to shell history)
+  indelible-mcp setup --wif=KEY --pin=PIN    Same, for automation (both values land in shell history)
   indelible-mcp install-hooks                Install auto-save/restore hooks
   indelible-mcp semantic-fetch               Enable meaning-based recall (one-time ~50MB local model; nothing leaves your machine)
   indelible-mcp map                          Render "The Shape of the Work" \u2014 a 3D map of everything you've thought about, built locally from your own history
@@ -17327,7 +17353,7 @@ function readStdin() {
 }
 var SERVER_INFO = {
   name: "indelible",
-  version: "5.7.6",
+  version: "5.7.7",
   description: "Blockchain-backed memory and code storage for Claude Code"
 };
 var TOOLS = [