motebit 1.11.2 → 1.12.0

package/dist/index.js

@@ -361,17 +361,17 @@ function optimalPathTrace(graph, source, target) {
   const value = dist.get(target) ?? sr.zero;
   if (value === sr.zero && source !== target)
     return null;
-  const path19 = [];
+  const path20 = [];
   let current2 = target;
   const visited = /* @__PURE__ */ new Set();
   while (current2 != null && !visited.has(current2)) {
     visited.add(current2);
-    path19.unshift(current2);
+    path20.unshift(current2);
     current2 = pred.get(current2) ?? null;
   }
-  if (path19[0] !== source)
+  if (path20[0] !== source)
     return null;
-  return { value, path: path19 };
+  return { value, path: path20 };
 }
 var init_traversal = __esm({
   "../../packages/protocol/dist/traversal.js"() {
@@ -1690,10 +1690,14 @@ function modelVendorHint(model) {
     return "groq";
   if (m4.startsWith("claude"))
     return "anthropic";
+  if (m4.startsWith("gpt-oss"))
+    return "local";
   if (m4.startsWith("gpt-") || /^o[0-9]/.test(m4))
     return "openai";
   if (m4.startsWith("gemini"))
     return "google";
+  if (m4.startsWith("deepseek-r1"))
+    return "local";
   if (m4.startsWith("deepseek"))
     return "deepseek";
   if (m4.includes(":") || /^(llama|mistral|qwen|phi|gemma|smollm)/.test(m4))
@@ -1712,7 +1716,27 @@ function providerAcceptsModel(provider, model) {
     return hint === "groq" || hint === "local";
   return hint === provider;
 }
-var ANTHROPIC_MODELS, OPENAI_MODELS, GOOGLE_MODELS, DEEPSEEK_MODELS, GROQ_MODELS, LOCAL_SERVER_SUGGESTED_MODELS, OLLAMA_SUGGESTED_MODELS, PROXY_MODELS, DEFAULT_ANTHROPIC_MODEL, DEFAULT_OPENAI_MODEL, DEFAULT_GOOGLE_MODEL, DEFAULT_DEEPSEEK_MODEL, DEFAULT_GROQ_MODEL, DEFAULT_OLLAMA_MODEL, DEFAULT_LOCAL_SERVER_MODEL, DEFAULT_PROXY_MODEL;
+function modelCapabilityTier(model) {
+  const m4 = model.trim().toLowerCase();
+  if (m4 === "")
+    return "capable";
+  const sizeTag = /[:\-_](\d+(?:\.\d+)?)b(?:[-_.:]|$)/.exec(m4);
+  if (sizeTag != null) {
+    return parseFloat(sizeTag[1]) < 7 ? "minimal" : "capable";
+  }
+  const base = m4.split(":")[0];
+  if (MINIMAL_FAMILIES.some((f7) => base.startsWith(f7))) {
+    return "minimal";
+  }
+  if (base.endsWith("-mini") || base.endsWith("-nano") || base.includes("flash")) {
+    return "capable";
+  }
+  if (FRONTIER_PREFIXES.some((p5) => base.startsWith(p5))) {
+    return "frontier";
+  }
+  return "capable";
+}
+var ANTHROPIC_MODELS, OPENAI_MODELS, GOOGLE_MODELS, DEEPSEEK_MODELS, GROQ_MODELS, LOCAL_SERVER_SUGGESTED_MODELS, OLLAMA_SUGGESTED_MODELS, PROXY_MODELS, DEFAULT_ANTHROPIC_MODEL, DEFAULT_OPENAI_MODEL, DEFAULT_GOOGLE_MODEL, DEFAULT_DEEPSEEK_MODEL, DEFAULT_GROQ_MODEL, DEFAULT_OLLAMA_MODEL, DEFAULT_LOCAL_SERVER_MODEL, DEFAULT_PROXY_MODEL, MODEL_DEFAULT_REVIEW_BY, MINIMAL_FAMILIES, FRONTIER_PREFIXES;
 var init_models = __esm({
   "../../packages/sdk/dist/models.js"() {
     "use strict";
@@ -1739,14 +1763,20 @@ var init_models = __esm({
     DEEPSEEK_MODELS = ["deepseek-chat"];
     GROQ_MODELS = ["llama-3.3-70b-versatile", "openai/gpt-oss-120b"];
     LOCAL_SERVER_SUGGESTED_MODELS = [
-      "llama3.2",
-      "llama3.1",
-      "llama3",
-      "mistral",
-      "codellama",
-      "gemma2",
-      "phi3",
-      "qwen2"
+      "qwen3",
+      // balanced all-rounder, tool-capable — the first-run default
+      "gpt-oss",
+      // OpenAI open-weights — best small tool-use class (~16GB)
+      "gemma3",
+      // Google open family
+      "llama4",
+      // Meta current family
+      "phi4-mini",
+      // minimal-hardware tier (entry laptops, iGPU)
+      "deepseek-r1",
+      // reasoning-class open weights
+      "mistral-small3.2"
+      // Mistral current small
     ];
     OLLAMA_SUGGESTED_MODELS = LOCAL_SERVER_SUGGESTED_MODELS;
     PROXY_MODELS = [
@@ -1765,9 +1795,37 @@ var init_models = __esm({
     DEFAULT_GOOGLE_MODEL = "gemini-2.5-flash";
     DEFAULT_DEEPSEEK_MODEL = "deepseek-chat";
     DEFAULT_GROQ_MODEL = "llama-3.3-70b-versatile";
-    DEFAULT_OLLAMA_MODEL = "llama3.2";
+    DEFAULT_OLLAMA_MODEL = "qwen3";
     DEFAULT_LOCAL_SERVER_MODEL = DEFAULT_OLLAMA_MODEL;
     DEFAULT_PROXY_MODEL = "claude-sonnet-4-6";
+    MODEL_DEFAULT_REVIEW_BY = {
+      anthropic: "2026-10-31",
+      openai: "2026-10-31",
+      google: "2026-10-31",
+      deepseek: "2026-10-31",
+      groq: "2026-10-31",
+      "local-server": "2026-10-31",
+      proxy: "2026-10-31"
+    };
+    MINIMAL_FAMILIES = [
+      "llama3.2",
+      // 1B/3B family — the witnessed weak-model floor
+      "phi4-mini",
+      "phi-3",
+      "phi3",
+      "smollm",
+      "tinyllama",
+      "gpt-5.4-nano"
+    ];
+    FRONTIER_PREFIXES = [
+      "claude-fable",
+      "claude-mythos",
+      "claude-opus",
+      "claude-sonnet",
+      "gpt-5.4",
+      // bare flagship; -mini/-nano handled before this check
+      "gemini-2.5-pro"
+    ];
   }
 });
 
@@ -4403,6 +4461,7 @@ __export(dist_exports2, {
   MEMORY_SOURCE_MARKER_UNKNOWN: () => MEMORY_SOURCE_MARKER_UNKNOWN,
   MERKLE_TREE_VERSION_REGISTRY: () => MERKLE_TREE_VERSION_REGISTRY,
   MICRO: () => MICRO,
+  MODEL_DEFAULT_REVIEW_BY: () => MODEL_DEFAULT_REVIEW_BY,
   MaxProductLogSemiring: () => MaxProductLogSemiring,
   MemoryType: () => MemoryType,
   MotebitType: () => MotebitType,
@@ -4515,6 +4574,7 @@ __export(dist_exports2, {
   maxSensitivity: () => maxSensitivity,
   migrateAppearanceConfig: () => migrateAppearanceConfig,
   migrateVoiceConfig: () => migrateVoiceConfig,
+  modelCapabilityTier: () => modelCapabilityTier,
   modelVendorHint: () => modelVendorHint,
   normalizeLocalServerEndpoint: () => normalizeLocalServerEndpoint,
   oklchToRgb: () => oklchToRgb,
@@ -22572,7 +22632,15 @@ var init_sanitizer = __esm({
       /\b(?:pretend|act\s+as\s+if|roleplay)\b/i,
       /\bdo\s+not\s+(?:follow|obey|listen)\b/i,
       /\b(?:override|bypass|ignore)\s+(?:safety|policy|rules|constraints)\b/i,
-      /<\s*(?:system|prompt|instruction)/i,
+      // Exact tag shape only (`<system>`, `< prompt >`, `<instructions/>`).
+      // The old open-prefix form (`<\s*(?:system|prompt|instruction)`) fired on
+      // TypeScript generics (`Array<PromptTemplate>`), JSX components, and any
+      // docs page whose prose puts these words after a `<` — witnessed live
+      // 2026-07-31 flagging motebit's own CLI docs (#499). An attack needs the
+      // tag to CLOSE to read as chat-template framing; attribute-carrying
+      // variants fall through to the directive-density and boundary layers
+      // (the [EXTERNAL_DATA] wrap is the defense — detection is signal).
+      /<\s*(?:system|prompt|instruction)s?\s*\/?>/i,
       // --- Chat template injection ---
       /<\|im_start\|>\s*system/i,
       /<\|im_end\|>/i,
@@ -25587,7 +25655,7 @@ var init_config2 = __esm({
   "src/config.ts"() {
     "use strict";
     init_esm_shims();
-    VERSION = true ? "1.11.2" : "0.0.0-dev";
+    VERSION = true ? "1.12.0" : "0.0.0-dev";
     CONFIG_DIR = process.env["MOTEBIT_CONFIG_DIR"] ?? path2.join(os.homedir(), ".motebit");
     CONFIG_PATH = path2.join(CONFIG_DIR, "config.json");
     RELAY_DIR = path2.join(CONFIG_DIR, "relay");
@@ -26457,13 +26525,13 @@ var init_intelligence = __esm({
 });
 
 // ../../packages/runtime/dist/commands/types.js
-async function relayFetch(relay, path19, options) {
+async function relayFetch(relay, path20, options) {
   const headers = {
     "Content-Type": "application/json",
     Authorization: `Bearer ${relay.authToken}`,
     ...options?.headers
   };
-  const res = await fetch(`${relay.relayUrl}${path19}`, { ...options, headers });
+  const res = await fetch(`${relay.relayUrl}${path20}`, { ...options, headers });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
     throw new Error(`${res.status}: ${text}`);
@@ -29923,8 +29991,8 @@ function urlAuditDetail(url) {
   }
   try {
     const parsed = new URL(url);
-    const path19 = parsed.pathname;
-    const hasPath = path19.length > 0 && path19 !== "/";
+    const path20 = parsed.pathname;
+    const hasPath = path20.length > 0 && path20 !== "/";
     return {
       // Drop the trailing colon ("https:" → "https"). Lowercased
       // for canonical-form audit comparisons across replays.
@@ -30660,7 +30728,7 @@ var init_cloud_browser_dispatcher = __esm({
         };
       }
       // ── Internal: signed HTTP roundtrip ────────────────────────────────
-      async request(method, path19, body) {
+      async request(method, path20, body) {
         let token;
         try {
           token = await this.getAuthToken();
@@ -30675,7 +30743,7 @@ var init_cloud_browser_dispatcher = __esm({
           headers["Content-Type"] = "application/json";
         let response;
         try {
-          response = await this.fetchImpl(`${this.baseUrl}${path19}`, {
+          response = await this.fetchImpl(`${this.baseUrl}${path20}`, {
             method,
             headers,
             body: body === void 0 ? void 0 : JSON.stringify(body)
@@ -41660,8 +41728,8 @@ var init_three_core = __esm({
        * @param {string} path - The base path.
        * @return {Loader} A reference to this instance.
        */
-      setPath(path19) {
-        this.path = path19;
+      setPath(path20) {
+        this.path = path20;
         return this;
       }
       /**
@@ -41709,10 +41777,10 @@ var init_three_core = __esm({
     );
     _supportedObjectNames = ["material", "materials", "bones", "map"];
     Composite = class {
-      constructor(targetGroup, path19, optionalParsedPath) {
-        const parsedPath = optionalParsedPath || PropertyBinding.parseTrackName(path19);
+      constructor(targetGroup, path20, optionalParsedPath) {
+        const parsedPath = optionalParsedPath || PropertyBinding.parseTrackName(path20);
         this._targetGroup = targetGroup;
-        this._bindings = targetGroup.subscribe_(path19, parsedPath);
+        this._bindings = targetGroup.subscribe_(path20, parsedPath);
       }
       getValue(array, offset) {
         this.bind();
@@ -41746,9 +41814,9 @@ var init_three_core = __esm({
        * @param {string} path - The path.
        * @param {?Object} [parsedPath] - The parsed path.
        */
-      constructor(rootNode, path19, parsedPath) {
-        this.path = path19;
-        this.parsedPath = parsedPath || _PropertyBinding.parseTrackName(path19);
+      constructor(rootNode, path20, parsedPath) {
+        this.path = path20;
+        this.parsedPath = parsedPath || _PropertyBinding.parseTrackName(path20);
         this.node = _PropertyBinding.findNode(rootNode, this.parsedPath.nodeName);
         this.rootNode = rootNode;
         this.getValue = this._getValue_unbound;
@@ -41763,11 +41831,11 @@ var init_three_core = __esm({
        * @param {?Object} [parsedPath] - The parsed path.
        * @return {PropertyBinding|Composite} The created property binding or composite.
        */
-      static create(root, path19, parsedPath) {
+      static create(root, path20, parsedPath) {
         if (!(root && root.isAnimationObjectGroup)) {
-          return new _PropertyBinding(root, path19, parsedPath);
+          return new _PropertyBinding(root, path20, parsedPath);
         } else {
-          return new _PropertyBinding.Composite(root, path19, parsedPath);
+          return new _PropertyBinding.Composite(root, path20, parsedPath);
         }
       }
       /**
@@ -59694,6 +59762,8 @@ var init_motebit_runtime = __esm({
       /** Allowed proactive capability names. Empty by default — fail-closed
        *  sovereign default. User opts in explicitly via runtime config. */
       _proactiveCapabilities;
+      /** #501 — config override: offer R4_MONEY tools to minimal-tier models. */
+      _offerMoneyToolsToMinimalModels;
       /** Auto-anchor policy; null when disabled. Stored by reference so the
        *  submitter can be rotated by the surface without re-constructing the
        *  runtime. */
@@ -59875,8 +59945,11 @@ var init_motebit_runtime = __esm({
         });
         this._proactiveCapabilities = new Set(config.proactiveCapabilities ?? []);
         this._proactiveAnchor = config.proactiveAnchor ?? null;
+        this._offerMoneyToolsToMinimalModels = config.offerMoneyToolsToMinimalModels ?? false;
         this.scopedToolRegistry = new ScopedToolRegistry(this.toolRegistry, {
           allows: (toolName) => {
+            if (!this.tierAllowsTool(toolName))
+              return false;
             const presence = this.presence.get();
             if (presence.mode === "responsive" || presence.mode === "idle")
               return true;
@@ -60285,6 +60358,39 @@ var init_motebit_runtime = __esm({
       get currentModel() {
         return this.provider?.model ?? null;
       }
+      /**
+       * Capability-tiered tool admission (#501): may the CURRENT model be
+       * offered `toolName`? True unless the model is `minimal`-tier AND the
+       * tool classifies at `R4_MONEY` AND the config override is off. Keys on
+       * the SAME `classifyTool` vocabulary the approval gate uses, so any
+       * future money tool inherits the policy at birth — and a rail-less
+       * `delegate_to_agent` (R2 without a payment builder) stays offered:
+       * the tool crosses the withholding line exactly when it can move money.
+       */
+      tierAllowsTool(toolName) {
+        if (this._offerMoneyToolsToMinimalModels)
+          return true;
+        const model = this.provider?.model ?? null;
+        if (model == null || modelCapabilityTier(model) !== "minimal")
+          return true;
+        const def = this.toolRegistry.list().find((t3) => t3.name === toolName);
+        if (def == null)
+          return true;
+        return classifyTool(def).risk < RiskLevel.R4_MONEY;
+      }
+      /**
+       * Surface-honesty readout (#501): true when the current model's tier is
+       * withholding at least one registered money tool. Surfaces render ONE
+       * calm line from this (launch / model switch) — never a toast.
+       */
+      get moneyToolsWithheld() {
+        if (this._offerMoneyToolsToMinimalModels)
+          return false;
+        const model = this.provider?.model ?? null;
+        if (model == null || modelCapabilityTier(model) !== "minimal")
+          return false;
+        return this.toolRegistry.list().some((t3) => classifyTool(t3).risk >= RiskLevel.R4_MONEY);
+      }
       setModel(model) {
         if (!this.provider)
           throw new Error("No AI provider configured");
@@ -73914,14 +74020,14 @@ var init_dependency_container = __esm({
           provider = providerOrConstructor;
         }
         if (isTokenProvider(provider)) {
-          var path19 = [token];
+          var path20 = [token];
           var tokenProvider = provider;
           while (tokenProvider != null) {
             var currentToken = tokenProvider.useToken;
-            if (path19.includes(currentToken)) {
-              throw new Error("Token registration cycle detected! " + __spread(path19, [currentToken]).join(" -> "));
+            if (path20.includes(currentToken)) {
+              throw new Error("Token registration cycle detected! " + __spread(path20, [currentToken]).join(" -> "));
             }
-            path19.push(currentToken);
+            path20.push(currentToken);
             var registration = this._registry.get(currentToken);
             if (registration && isTokenProvider(registration.provider)) {
               tokenProvider = registration.provider;
@@ -83998,8 +84104,8 @@ ${FRONTMATTER_DELIM}`);
   const validation = SkillManifestSchema.safeParse(frontmatter);
   if (!validation.success) {
     const first = validation.error.issues[0];
-    const path19 = first?.path.join(".") ?? "(root)";
-    throw new SkillParseError(`Frontmatter failed schema validation at \`${path19}\`: ${first?.message ?? "unknown"}`);
+    const path20 = first?.path.join(".") ?? "(root)";
+    throw new SkillParseError(`Frontmatter failed schema validation at \`${path20}\`: ${first?.message ?? "unknown"}`);
   }
   return {
     manifest: validation.data,
@@ -84379,16 +84485,16 @@ var init_dist32 = __esm({
 // ../../packages/skills/dist/fs-adapter.js
 import { closeSync, fsyncSync, mkdirSync as mkdirSync2, openSync, readdirSync, readFileSync as readFileSync3, renameSync, rmSync, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { dirname, join as join2, relative, sep } from "path";
-function existsFile(path19) {
+function existsFile(path20) {
   try {
-    statSync(path19);
+    statSync(path20);
     return true;
   } catch {
     return false;
   }
 }
-function atomicWriteFile(path19, content) {
-  const tempPath = `${path19}.tmp.${process.pid}`;
+function atomicWriteFile(path20, content) {
+  const tempPath = `${path20}.tmp.${process.pid}`;
   const fd = openSync(tempPath, "w");
   try {
     writeFileSync3(fd, content);
@@ -84396,7 +84502,7 @@ function atomicWriteFile(path19, content) {
   } finally {
     closeSync(fd);
   }
-  renameSync(tempPath, path19);
+  renameSync(tempPath, path20);
 }
 function collectAuxFiles(dir) {
   const out = {};
@@ -84432,9 +84538,9 @@ function ensureSafeRelativePath(relPath) {
   }
   return segments.join("/");
 }
-function resolveDirectorySkillSource(path19) {
-  const skillMdPath = join2(path19, SKILL_MD);
-  const envPath = join2(path19, SKILL_ENVELOPE_JSON);
+function resolveDirectorySkillSource(path20) {
+  const skillMdPath = join2(path20, SKILL_MD);
+  const envPath = join2(path20, SKILL_ENVELOPE_JSON);
   if (!existsFile(skillMdPath)) {
     throw new SkillParseError(`No SKILL.md at ${skillMdPath}`);
   }
@@ -84443,7 +84549,7 @@ function resolveDirectorySkillSource(path19) {
   }
   const parsed = parseSkillFile(readFileSync3(skillMdPath, "utf-8"));
   const envelope = JSON.parse(readFileSync3(envPath, "utf-8"));
-  const files = collectAuxFiles(path19);
+  const files = collectAuxFiles(path20);
   return {
     kind: "in_memory",
     manifest: parsed.manifest,
@@ -84567,10 +84673,10 @@ var init_fs_adapter = __esm({
         return join2(this.root, name);
       }
       readIndex() {
-        const path19 = join2(this.root, INSTALLED_JSON);
-        if (!existsFile(path19))
+        const path20 = join2(this.root, INSTALLED_JSON);
+        if (!existsFile(path20))
           return [];
-        const raw = readFileSync3(path19, "utf-8");
+        const raw = readFileSync3(path20, "utf-8");
         if (raw.trim() === "")
           return [];
         try {
@@ -84579,7 +84685,7 @@ var init_fs_adapter = __esm({
             return [];
           return parsed;
         } catch (err2) {
-          throw new Error(`Failed to parse skills index at ${path19}: ${err2 instanceof Error ? err2.message : String(err2)}`, { cause: err2 instanceof Error ? err2 : void 0 });
+          throw new Error(`Failed to parse skills index at ${path20}: ${err2 instanceof Error ? err2.message : String(err2)}`, { cause: err2 instanceof Error ? err2 : void 0 });
         }
       }
       writeIndex(index) {
@@ -86332,7 +86438,6 @@ function createTerminalRenderer(io) {
     if (result === "submit") {
       submit();
     } else if (result === "exit") {
-      io.write("\n");
       destroyTerminal();
       process.exit(0);
     } else {
@@ -86368,6 +86473,22 @@ function createTerminalRenderer(io) {
       reject();
     }
   }
+  function finalize2() {
+    let scrollback = "";
+    if (tail2 !== "") {
+      scrollback += tail2 + "\n";
+      tail2 = "";
+    }
+    if (inputActive) {
+      scrollback += buildInputRow().row + "\n";
+      inputResolver = null;
+      inputRejecter = null;
+      inputActive = false;
+    }
+    statusRow = null;
+    modeRow = null;
+    commit(scrollback);
+  }
   return {
     writeOutput: writeOutput2,
     writeLine: writeLine2,
@@ -86377,7 +86498,8 @@ function createTerminalRenderer(io) {
     setModeRow: setModeRow2,
     handleEvent,
     repaint: () => commit(""),
-    detach
+    detach,
+    finalize: finalize2
   };
 }
 function applyEvent(state, event) {
@@ -86593,6 +86715,7 @@ function initTerminal() {
 function destroyTerminal() {
   if (!initialized) return;
   initialized = false;
+  renderer.finalize();
   process.stdin.removeListener("data", onStdinData);
   process.stdout.removeListener("resize", onResize);
   if (process.stdin.isTTY) {
@@ -87160,6 +87283,10 @@ async function createRuntime(config, motebitId, toolRegistry, mcpServers, person
       // (enableInteractiveDelegation). Absent ⇒ delegation degrades to
       // relay-mode honestly.
       ...solanaWallet ? { solanaWallet } : {},
+      // #501 — sovereign override for capability-tiered tool admission.
+      // Default (absent/false): a minimal-tier model is never offered
+      // R4_MONEY tools; the owner can restore full exposure in config.
+      ...loadFullConfig().offer_money_tools_to_minimal_models === true ? { offerMoneyToolsToMinimalModels: true } : {},
       policy: {
         operatorMode: config.operator,
         pathAllowList: config.allowedPaths,
@@ -94028,8 +94155,8 @@ var init_x402_facilitator = __esm({
 
 // ../../services/relay/dist/tasks.js
 import { HTTPException as HTTPException7 } from "hono/http-exception";
-function extractMotebitIdFromPath(path19) {
-  const match = path19.match(/\/agent\/([^/]+)\/task/);
+function extractMotebitIdFromPath(path20) {
+  const match = path20.match(/\/agent\/([^/]+)\/task/);
   return match ? match[1] : null;
 }
 function getListingUnitCost(moteDb, agentId, capability) {
@@ -95916,9 +96043,9 @@ function enrichWithBondStatus(agents, db, nowMs = Date.now()) {
 function registerAgentAuthMiddleware(deps) {
   const { app, apiToken, identityManager, parseTokenPayloadUnsafe: parseTokenPayloadUnsafe2, verifySignedTokenForDevice: verifySignedTokenForDevice2, isTokenBlacklisted, isAgentRevoked } = deps;
   app.use("/api/v1/agents/*", async (c5, next) => {
-    const path19 = c5.req.path;
+    const path20 = c5.req.path;
     const method = c5.req.method;
-    if (PUBLIC_AGENT_ROUTES.some((r2) => r2.match(path19, method))) {
+    if (PUBLIC_AGENT_ROUTES.some((r2) => r2.match(path20, method))) {
       await next();
       return;
     }
@@ -95936,25 +96063,25 @@ function registerAgentAuthMiddleware(deps) {
       throw new HTTPException8(401, { message: "Invalid token" });
     }
     let agentAudience;
-    if (path19.includes("/p2p-eligibility")) {
+    if (path20.includes("/p2p-eligibility")) {
       agentAudience = "market:listing";
-    } else if (path19.includes("/listing")) {
+    } else if (path20.includes("/listing")) {
       agentAudience = "market:listing";
-    } else if (path19.includes("/credentials")) {
+    } else if (path20.includes("/credentials")) {
       agentAudience = "credentials";
-    } else if (path19.includes("/presentation")) {
+    } else if (path20.includes("/presentation")) {
       agentAudience = "credentials:present";
-    } else if (path19.includes("/proxy-token")) {
+    } else if (path20.includes("/proxy-token")) {
       agentAudience = "proxy:token";
-    } else if (path19.includes("/receipts")) {
+    } else if (path20.includes("/receipts")) {
       agentAudience = "receipts:read";
-    } else if (path19.endsWith("/balance") || path19.endsWith("/settlements")) {
+    } else if (path20.endsWith("/balance") || path20.endsWith("/settlements")) {
       agentAudience = "account:balance";
-    } else if (path19.endsWith("/withdrawals")) {
+    } else if (path20.endsWith("/withdrawals")) {
       agentAudience = "account:withdrawals";
-    } else if (path19.endsWith("/withdraw")) {
+    } else if (path20.endsWith("/withdraw")) {
       agentAudience = "account:withdraw";
-    } else if (path19.endsWith("/checkout")) {
+    } else if (path20.endsWith("/checkout")) {
       agentAudience = "account:checkout";
     } else {
       agentAudience = "admin:query";
@@ -95974,7 +96101,7 @@ function registerAgentAuthMiddleware(deps) {
         reason,
         expectedAudience: agentAudience,
         mid: claims.mid,
-        path: path19
+        path: path20
       })
     );
     if (!valid) {
@@ -101753,7 +101880,7 @@ function admitModelForProvider(provider, model) {
     const flag = VENDOR_PROVIDER_FLAG[hint];
     return {
       admissible: false,
-      teach: `${model} is a hosted ${hint} model \u2014 a local server can't serve it. ` + (flag != null ? `Restart with --provider ${flag}, or pick a local model (e.g. /model llama3.2).` : `Pick a local model instead (e.g. /model llama3.2).`)
+      teach: `${model} is a hosted ${hint} model \u2014 a local server can't serve it. ` + (flag != null ? `Restart with --provider ${flag}, or pick a local model (e.g. /model ${DEFAULT_LOCAL_SERVER_MODEL}).` : `Pick a local model instead (e.g. /model ${DEFAULT_LOCAL_SERVER_MODEL}).`)
     };
   }
   if (!providerAcceptsModel(provider, model)) {
@@ -101765,6 +101892,7 @@ function admitModelForProvider(provider, model) {
   }
   return { admissible: true };
 }
+var MONEY_TOOLS_WITHHELD_NOTICE = "money tools withheld from this model (minimal tier) \u2014 set offer_money_tools_to_minimal_models in ~/.motebit/config.json if you mean it";
 
 // src/index.ts
 init_dist8();
@@ -101804,10 +101932,10 @@ function generateUUIDv72() {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 function loadStoredGrant(grantId) {
-  const path19 = join7(grantsDir(), `${grantId}.json`);
-  if (!existsSync(path19)) return null;
+  const path20 = join7(grantsDir(), `${grantId}.json`);
+  if (!existsSync(path20)) return null;
   try {
-    return JSON.parse(readFileSync4(path19, "utf8"));
+    return JSON.parse(readFileSync4(path20, "utf8"));
   } catch {
     return null;
   }
@@ -102254,6 +102382,7 @@ function renderPreflight(pf, dim2) {
 
 // src/args.ts
 init_esm_shims();
+init_dist2();
 init_config2();
 init_colors();
 import { parseArgs } from "util";
@@ -102352,11 +102481,12 @@ function parseCliArgs(args = process.argv.slice(2)) {
     );
   }
   const cliProvider = rawProvider;
-  const defaultModel = cliProvider === "local-server" ? "llama3.2" : cliProvider === "openai" ? "gpt-5.4-mini" : cliProvider === "google" ? "gemini-2.5-flash" : cliProvider === "groq" ? "llama-3.3-70b-versatile" : cliProvider === "deepseek" ? "deepseek-chat" : "claude-sonnet-4-6";
+  const defaultModel = defaultModelForProvider(cliProvider);
   const allowedPaths = values["allowed-paths"] != null && values["allowed-paths"] !== "" ? values["allowed-paths"].split(",").map((p5) => p5.trim()) : [process.cwd()];
   return {
     provider: cliProvider,
     model: values.model ?? defaultModel,
+    modelExplicit: values.model != null,
     dbPath: values["db-path"],
     noStream: values["no-stream"],
     syncUrl: values["sync-url"],
@@ -102479,7 +102609,10 @@ var COMMANDS = [
   { usage: "/proposal <id> [accept|reject|counter]", desc: "Respond to a proposal" },
   { usage: "/operator", desc: "Show operator mode status" },
   { usage: "/invoke <cap> <prompt>", desc: "Invoke a capability deterministically (no AI loop)" },
-  { usage: "/receipt <task-id>", desc: "Re-render an archived receipt (offline-verified)" },
+  {
+    usage: "/receipt [task-id-prefix]",
+    desc: "Re-render an archived receipt (offline-verified); no arg = latest"
+  },
   { usage: "/voice [on|off]", desc: "Toggle TTS voice output (opt-in, off by default)" },
   { usage: "/say <text>", desc: "Speak text via TTS (requires voice provider)" },
   { usage: "/skills", desc: "List installed skills with provenance badges" },
@@ -102660,6 +102793,9 @@ Slash commands (in REPL):`
 function printVersion() {
   console.log(VERSION);
 }
+function defaultModelForProvider(provider) {
+  return provider === "local-server" ? DEFAULT_LOCAL_SERVER_MODEL : provider === "openai" ? DEFAULT_OPENAI_MODEL : provider === "google" ? DEFAULT_GOOGLE_MODEL : provider === "groq" ? DEFAULT_GROQ_MODEL : provider === "deepseek" ? DEFAULT_DEEPSEEK_MODEL : DEFAULT_ANTHROPIC_MODEL;
+}
 function printBanner(opts) {
   const W2 = 56;
   const pad = (s3, visibleLen) => s3 + " ".repeat(Math.max(0, W2 - visibleLen));
@@ -102706,6 +102842,80 @@ function trimHistory(history) {
 
 // src/index.ts
 init_config2();
+
+// src/update-nudge.ts
+init_esm_shims();
+init_config2();
+import * as fs7 from "fs";
+import * as path9 from "path";
+var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+function updateCheckPath() {
+  return path9.join(CONFIG_DIR, "update-check.json");
+}
+function isNewerVersion(latest, current2) {
+  const parse3 = (v3) => {
+    const parts = v3.trim().split(".");
+    if (parts.length !== 3) return null;
+    const nums = parts.map((p5) => /^\d+$/.test(p5) ? Number(p5) : NaN);
+    return nums.some((n2) => Number.isNaN(n2)) ? null : nums;
+  };
+  const l6 = parse3(latest);
+  const c5 = parse3(current2);
+  if (l6 == null || c5 == null) return false;
+  for (let i = 0; i < 3; i++) {
+    if (l6[i] > c5[i]) return true;
+    if (l6[i] < c5[i]) return false;
+  }
+  return false;
+}
+function readUpdateState(statePath = updateCheckPath()) {
+  try {
+    const raw = JSON.parse(fs7.readFileSync(statePath, "utf-8"));
+    if (typeof raw.last_checked_at !== "number") return null;
+    return {
+      last_checked_at: raw.last_checked_at,
+      ...typeof raw.latest === "string" ? { latest: raw.latest } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function renderUpdateNudge(params) {
+  const latest = params.state?.latest;
+  if (latest == null || !isNewerVersion(latest, params.currentVersion)) return null;
+  return `motebit ${latest} available \u2014 npm i -g motebit`;
+}
+function refreshUpdateCheckInBackground(params) {
+  const statePath = params?.statePath ?? updateCheckPath();
+  const now = params?.nowMs ?? Date.now();
+  const ttl = params?.ttlMs ?? UPDATE_CHECK_TTL_MS;
+  const fetchFn = params?.fetchFn ?? fetch;
+  const state = readUpdateState(statePath);
+  if (state != null && now - state.last_checked_at < ttl) return;
+  void (async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+      const resp = await fetchFn("https://registry.npmjs.org/motebit/latest", {
+        signal: controller.signal
+      });
+      if (!resp.ok) return;
+      const body = await resp.json();
+      if (typeof body.version !== "string") return;
+      fs7.mkdirSync(path9.dirname(statePath), { recursive: true });
+      fs7.writeFileSync(
+        statePath,
+        JSON.stringify({ last_checked_at: now, latest: body.version })
+      );
+    } catch {
+    } finally {
+      clearTimeout(timer);
+    }
+  })();
+}
+
+// src/index.ts
 init_identity();
 init_runtime_factory();
 
@@ -102725,8 +102935,20 @@ function archiveReceipt(receipt) {
   if (!receipt.task_id) return;
   ARCHIVE.set(receipt.task_id, receipt);
 }
-function getArchivedReceipt(taskId) {
-  return ARCHIVE.get(taskId);
+function findArchivedReceipt(idOrPrefix) {
+  const prefix = idOrPrefix.replace(/…$/, "");
+  if (prefix === "") return { kind: "miss" };
+  const exact = ARCHIVE.get(prefix);
+  if (exact) return { kind: "hit", receipt: exact };
+  const matches = [...ARCHIVE.keys()].filter((id) => id.startsWith(prefix));
+  if (matches.length === 1) return { kind: "hit", receipt: ARCHIVE.get(matches[0]) };
+  if (matches.length > 1) return { kind: "ambiguous", taskIds: matches };
+  return { kind: "miss" };
+}
+function latestArchivedReceipt() {
+  let last;
+  for (const r2 of ARCHIVE.values()) last = r2;
+  return last;
 }
 var CAPABILITY_PRICES_USD = {
   review_pr: 0.01,
@@ -103176,14 +103398,14 @@ var JsonLineDecoder = class {
 
 // ../../packages/runtime-host/dist/paths-shared.js
 init_esm_shims();
-function isWindowsPipePath(path19) {
-  return path19.startsWith("\\\\.\\pipe\\");
+function isWindowsPipePath(path20) {
+  return path20.startsWith("\\\\.\\pipe\\");
 }
 
 // ../../packages/runtime-host/dist/lockfile.js
 init_esm_shims();
-async function readLockfile(platform, path19) {
-  const raw = await platform.readFile(path19);
+async function readLockfile(platform, path20) {
+  const raw = await platform.readFile(path20);
   if (raw === null)
     return null;
   try {
@@ -103203,16 +103425,16 @@ async function readLockfile(platform, path19) {
     return null;
   }
 }
-async function writeLockfile(platform, path19, record) {
-  await platform.writeFile(path19, `${JSON.stringify(record)}
+async function writeLockfile(platform, path20, record) {
+  await platform.writeFile(path20, `${JSON.stringify(record)}
 `);
 }
-async function removeLockfile(platform, path19, pid) {
-  const current2 = await readLockfile(platform, path19);
+async function removeLockfile(platform, path20, pid) {
+  const current2 = await readLockfile(platform, path20);
   if (current2 !== null && current2.pid !== pid)
     return;
   try {
-    await platform.removeFile(path19);
+    await platform.removeFile(path20);
   } catch {
   }
 }
@@ -104203,11 +104425,11 @@ init_esm_shims();
 
 // ../../packages/runtime-host/dist/node-platform.js
 init_esm_shims();
-import { chmodSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync, mkdirSync as mkdirSync6, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { connect, createServer } from "net";
-import { dirname as dirname4 } from "path";
-function isWindowsPipe(path19) {
-  return path19.startsWith("\\\\.\\pipe\\");
+import { dirname as dirname5 } from "path";
+function isWindowsPipe(path20) {
+  return path20.startsWith("\\\\.\\pipe\\");
 }
 function wrapSocket(socket) {
   return {
@@ -104301,36 +104523,36 @@ function nodePlatform(overrides = {}) {
       }
     },
     // eslint-disable-next-line @typescript-eslint/require-await
-    async readFile(path19) {
+    async readFile(path20) {
       try {
-        return readFileSync5(path19, "utf8");
+        return readFileSync6(path20, "utf8");
       } catch {
         return null;
       }
     },
     // eslint-disable-next-line @typescript-eslint/require-await
-    async writeFile(path19, content) {
-      mkdirSync5(dirname4(path19), { recursive: true, mode: 448 });
-      writeFileSync5(path19, content, { mode: 384 });
+    async writeFile(path20, content) {
+      mkdirSync6(dirname5(path20), { recursive: true, mode: 448 });
+      writeFileSync6(path20, content, { mode: 384 });
     },
     // eslint-disable-next-line @typescript-eslint/require-await
-    async removeFile(path19) {
-      rmSync2(path19, { force: true });
+    async removeFile(path20) {
+      rmSync2(path20, { force: true });
     },
     // eslint-disable-next-line @typescript-eslint/require-await
-    async mkdirExclusive(path19) {
-      mkdirSync5(dirname4(path19), { recursive: true, mode: 448 });
+    async mkdirExclusive(path20) {
+      mkdirSync6(dirname5(path20), { recursive: true, mode: 448 });
       try {
-        mkdirSync5(path19);
+        mkdirSync6(path20);
         return "created";
       } catch {
         return "exists";
       }
     },
     // eslint-disable-next-line @typescript-eslint/require-await
-    async removeDir(path19) {
+    async removeDir(path20) {
       try {
-        rmSync2(path19, { recursive: true, force: true });
+        rmSync2(path20, { recursive: true, force: true });
       } catch {
       }
     },
@@ -104352,19 +104574,19 @@ function nodePlatform(overrides = {}) {
 init_esm_shims();
 import { createHash } from "crypto";
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function defaultRuntimeHostPaths(home = homedir3(), platform = process.platform) {
-  const dir = join8(home, ".motebit");
+  const dir = join9(home, ".motebit");
   if (platform === "win32") {
     const tag2 = createHash("sha256").update(dir).digest("hex").slice(0, 16);
     return {
       socketPath: `\\\\.\\pipe\\motebit-runtime-${tag2}`,
-      lockfilePath: join8(dir, "runtime.lock")
+      lockfilePath: join9(dir, "runtime.lock")
     };
   }
   return {
-    socketPath: join8(dir, "runtime.sock"),
-    lockfilePath: join8(dir, "runtime.lock")
+    socketPath: join9(dir, "runtime.sock"),
+    lockfilePath: join9(dir, "runtime.lock")
   };
 }
 
@@ -104486,202 +104708,6 @@ async function electAttachOrCoordinate(fullConfig, motebitId, runtimeRef) {
 init_esm_shims();
 init_colors();
 init_terminal();
-init_statusline();
-init_status_render();
-async function renderStream(stream) {
-  let pendingApproval = null;
-  let status = null;
-  let thinking = null;
-  const stopThinking = () => {
-    thinking?.stop();
-    thinking = null;
-  };
-  const stopStatus = () => {
-    stopThinking();
-    const elapsed = status?.stop() ?? 0;
-    status = null;
-    return elapsed;
-  };
-  thinking = startStatus("thinking");
-  try {
-    for await (const raw of stream) {
-      const chunk = raw;
-      switch (chunk.type) {
-        case "text":
-          stopThinking();
-          if (typeof chunk.text === "string") writeOutput(chunk.text);
-          break;
-        case "tool_status": {
-          const name = chunk.name ?? "tool";
-          if (chunk.status === "calling") {
-            if (name === "delegate_to_agent" && status) break;
-            stopThinking();
-            status = name === "delegate_to_agent" ? startStatus("delegating") : startStatus("running", name);
-          } else if (status) {
-            writeLine(
-              `  ${action("\u25CF")} ${action(name)} ${meta(`\xB7 done \xB7 ${formatElapsed(0, stopStatus())}`)}`
-            );
-            thinking = startStatus("thinking");
-          }
-          break;
-        }
-        case "approval_request":
-          pendingApproval = {
-            name: chunk.name ?? "tool",
-            args: chunk.args ?? {},
-            ...chunk.risk_level != null ? { riskLevel: chunk.risk_level } : {}
-          };
-          break;
-        case "delegation_start":
-          if (status) break;
-          stopThinking();
-          status = startStatus("delegating", chunk.tool ?? "task");
-          break;
-        case "delegation_complete":
-          stopStatus();
-          if (chunk.receipt?.task_id != null) {
-            writeLine(
-              dim(`[receipt ${chunk.receipt.task_id.slice(0, 8)} \xB7 ${chunk.receipt.status ?? ""}]`)
-            );
-          }
-          thinking = startStatus("thinking");
-          break;
-        case "injection_warning":
-          writeLine(`${warn2("\u26A0")} suspicious content in ${chunk.tool_name ?? "tool"} output`);
-          break;
-        case "approval_expired":
-          stopStatus();
-          writeLine(
-            `${warn2("[this approval expired before your answer arrived \u2014 nothing was executed]")}
-${dim(`(${chunk.tool_name ?? "the tool"} was never run; no money moved. Ask again when ready.)`)}`
-          );
-          break;
-        case "approval_voided":
-          stopStatus();
-          writeLine(
-            `${warn2("[your new message set aside the pending approval \u2014 nothing was executed]")}
-${dim(`(${chunk.tool_name ?? "the tool"} was never run; no money moved. It can be proposed again.)`)}`
-          );
-          break;
-        case "invoke_error":
-          stopStatus();
-          writeLine(
-            `${warn2(`[invoke failed${chunk.code != null ? ` \xB7 ${chunk.code}` : ""}]`)} ${chunk.message ?? ""}`
-          );
-          break;
-        case "task_step_narration":
-          if (typeof chunk.text === "string") {
-            status?.step(chunk.text.trim());
-            writeLine(`    ${meta("\xB7 " + chunk.text.trim())}`);
-          }
-          break;
-        default:
-          break;
-      }
-    }
-  } catch (err2) {
-    writeLine(`${warn2("[coordinator error]")} ${err2 instanceof Error ? err2.message : String(err2)}`);
-  } finally {
-    stopStatus();
-  }
-  return { pendingApproval };
-}
-async function renderTurn(client, motebitId, stream) {
-  let current2 = stream;
-  for (; ; ) {
-    const { pendingApproval } = await renderStream(current2);
-    if (pendingApproval === null) return;
-    for (const line of renderApprovalRequest({
-      name: pendingApproval.name,
-      args: pendingApproval.args,
-      ...pendingApproval.riskLevel != null ? { riskLevel: pendingApproval.riskLevel } : {}
-    })) {
-      writeLine(line);
-    }
-    const answer = await askQuestion(`  ${warn2("Allow?")} ${dim("(y/n)")} `);
-    const approved = answer.trim().toLowerCase() === "y";
-    current2 = client.resolveApproval(approved, motebitId);
-  }
-}
-var ATTACHED_HELP = `
-  Attached mode \u2014 the coordinator process owns the runtime; this terminal renders.
-    <text>                chat with your motebit (proxied to the coordinator)
-    /invoke <cap> <text>  invoke a capability deterministically
-    /help                 this help
-    /exit                 leave (the coordinator keeps running)
-  Other slash commands need the runtime in-process: exit, stop the coordinator, and re-run \`motebit\`.
-`;
-async function runAttachedRepl(client, motebitId) {
-  writeOutput(
-    `
-  ${dim("Attached to the machine's coordinator runtime")} ${dim(`(pid ${client.coordinatorPid})`)}
-  ${dim("This terminal renders; the coordinator acts. /help for what's available.")}
-
-`
-  );
-  setModeRow(renderModeRow({ attachedPid: client.coordinatorPid }));
-  let closed = false;
-  client.onClose(() => {
-    closed = true;
-    writeOutput(
-      `
-${warn2("Coordinator exited.")} Run \`motebit\` again to take over as coordinator.
-`
-    );
-    destroyTerminal();
-    process.exit(0);
-  });
-  for (; ; ) {
-    if (closed) return;
-    let line;
-    try {
-      line = await readInput(prompt("you>") + " ");
-    } catch {
-      break;
-    }
-    const trimmed = line.trim();
-    if (trimmed === "") continue;
-    if (trimmed === "/exit" || trimmed === "/quit" || trimmed === "exit" || trimmed === "quit") {
-      writeOutput("Goodbye! (coordinator keeps running)\n");
-      break;
-    }
-    if (trimmed === "/help") {
-      writeOutput(ATTACHED_HELP);
-      continue;
-    }
-    if (trimmed.startsWith("/invoke ")) {
-      const rest = trimmed.slice("/invoke ".length).trim();
-      const space = rest.indexOf(" ");
-      const capability = space === -1 ? rest : rest.slice(0, space);
-      const prompt2 = space === -1 ? "" : rest.slice(space + 1);
-      if (capability === "") {
-        writeOutput(`${warn2("usage:")} /invoke <capability> <prompt>
-`);
-        continue;
-      }
-      writeOutput(prompt("mote>") + " ");
-      await renderTurn(client, motebitId, client.invoke(capability, prompt2));
-      writeOutput("\n");
-      continue;
-    }
-    if (trimmed.startsWith("/")) {
-      writeOutput(
-        `${dim(`${trimmed.split(" ")[0]} needs the runtime in-process \u2014 not available in attached mode.`)}
-${dim("Stop the coordinator and re-run `motebit` to use it.")}
-`
-      );
-      continue;
-    }
-    writeOutput(prompt("mote>") + " ");
-    await renderTurn(client, motebitId, client.chat(trimmed));
-    writeOutput("\n");
-  }
-  client.close();
-  destroyTerminal();
-}
-
-// src/index.ts
-init_colors();
 
 // src/slash-commands.ts
 init_esm_shims();
@@ -105007,21 +105033,21 @@ var RelayClientError = class extends Error {
   path;
   /** Relay-provided error body text when available (non-2xx responses). */
   body;
-  constructor(kind, path19, message2, options) {
+  constructor(kind, path20, message2, options) {
     super(message2, options?.cause !== void 0 ? { cause: options.cause } : void 0);
     this.name = "RelayClientError";
     this.kind = kind;
-    this.path = path19;
+    this.path = path20;
     this.status = options?.status;
     this.body = options?.body;
   }
 };
 
 // ../../packages/relay-client/dist/client.js
-function validate(schema, body, path19, label) {
+function validate(schema, body, path20, label) {
   const parsed = schema.safeParse(body);
   if (!parsed.success) {
-    throw new RelayClientError("schema", path19, `${label} response failed wire-schema validation: ${parsed.error.message}`);
+    throw new RelayClientError("schema", path20, `${label} response failed wire-schema validation: ${parsed.error.message}`);
   }
   return parsed.data;
 }
@@ -105060,11 +105086,11 @@ var RelayClient = class {
    * never sends credentials, regardless of configured auth.
    */
   async discover(motebitId) {
-    const path19 = `/api/v1/discover/${encodeURIComponent(motebitId)}`;
-    const body = await this.requestJson("GET", path19, {
+    const path20 = `/api/v1/discover/${encodeURIComponent(motebitId)}`;
+    const body = await this.requestJson("GET", path20, {
       retry: true
     });
-    return validate(AgentResolutionResultSchema, body, path19, "discover");
+    return validate(AgentResolutionResultSchema, body, path20, "discover");
   }
   /**
    * `GET /api/v1/agents/:motebitId/balance`. Contract tier: VALIDATED
@@ -105073,12 +105099,12 @@ var RelayClient = class {
    * converts from micro-units at its boundary; never convert again.
    */
   async getBalance(motebitId) {
-    const path19 = `/api/v1/agents/${encodeURIComponent(motebitId)}/balance`;
-    const body = await this.requestJson("GET", path19, {
+    const path20 = `/api/v1/agents/${encodeURIComponent(motebitId)}/balance`;
+    const body = await this.requestJson("GET", path20, {
       audience: ACCOUNT_BALANCE_AUDIENCE,
       retry: true
     });
-    return validate(AccountBalanceResultSchema, body, path19, "balance");
+    return validate(AccountBalanceResultSchema, body, path20, "balance");
   }
   /**
    * `POST /agent/:targetMotebitId/task` — submit a delegation task.
@@ -105087,8 +105113,8 @@ var RelayClient = class {
    * caller supplies it so a retry by the CALLER replays, never double-spends.
    */
   async submitTask(targetMotebitId, request, options) {
-    const path19 = `/agent/${encodeURIComponent(targetMotebitId)}/task`;
-    const body = await this.requestJson("POST", path19, {
+    const path20 = `/agent/${encodeURIComponent(targetMotebitId)}/task`;
+    const body = await this.requestJson("POST", path20, {
       audience: TASK_SUBMIT_AUDIENCE,
       retry: false,
       jsonBody: request,
@@ -105102,8 +105128,8 @@ var RelayClient = class {
    * token; the relay authorizes submitter-or-target).
    */
   async getTask(targetMotebitId, taskId) {
-    const path19 = `/agent/${encodeURIComponent(targetMotebitId)}/task/${encodeURIComponent(taskId)}`;
-    const body = await this.requestJson("GET", path19, {
+    const path20 = `/agent/${encodeURIComponent(targetMotebitId)}/task/${encodeURIComponent(taskId)}`;
+    const body = await this.requestJson("GET", path20, {
       audience: TASK_QUERY_AUDIENCE,
       retry: true
     });
@@ -105121,24 +105147,24 @@ var RelayClient = class {
    * `kind: "http"`, `status: 402`.
    */
   async withdraw(motebitId, request, options) {
-    const path19 = `/api/v1/agents/${encodeURIComponent(motebitId)}/withdraw`;
-    const body = await this.requestJson("POST", path19, {
+    const path20 = `/api/v1/agents/${encodeURIComponent(motebitId)}/withdraw`;
+    const body = await this.requestJson("POST", path20, {
       audience: ACCOUNT_WITHDRAW_AUDIENCE,
       retry: false,
       jsonBody: request,
       headers: { "Idempotency-Key": options.idempotencyKey }
     });
-    return validate(AccountWithdrawResultSchema, body, path19, "withdraw");
+    return validate(AccountWithdrawResultSchema, body, path20, "withdraw");
   }
   // ── Transport kernel ─────────────────────────────────────────────────
-  async requestJson(method, path19, opts) {
+  async requestJson(method, path20, opts) {
     const headers = { ...opts.headers };
     if (opts.jsonBody !== void 0)
       headers["Content-Type"] = "application/json";
     if (opts.audience !== void 0) {
       const token = await this.resolveToken(opts.audience);
       if (token == null) {
-        throw new RelayClientError("auth", path19, `no credential available for ${path19} (audience ${opts.audience}) \u2014 provide credentialSource, deviceKey, or staticToken`);
+        throw new RelayClientError("auth", path20, `no credential available for ${path20} (audience ${opts.audience}) \u2014 provide credentialSource, deviceKey, or staticToken`);
       }
       headers["Authorization"] = `Bearer ${token}`;
     }
@@ -105147,7 +105173,7 @@ var RelayClient = class {
       headers,
       ...opts.jsonBody !== void 0 ? { body: JSON.stringify(opts.jsonBody) } : {}
     };
-    const res = await this.fetchWithRetry(path19, init, opts.retry);
+    const res = await this.fetchWithRetry(path20, init, opts.retry);
     if (!res.ok) {
       let bodyText;
       try {
@@ -105155,7 +105181,7 @@ var RelayClient = class {
       } catch {
         bodyText = void 0;
       }
-      throw new RelayClientError("http", path19, `${method} ${path19} \u2192 ${res.status}`, {
+      throw new RelayClientError("http", path20, `${method} ${path20} \u2192 ${res.status}`, {
         status: res.status,
         body: bodyText
       });
@@ -105163,13 +105189,13 @@ var RelayClient = class {
     try {
       return await res.json();
     } catch (err2) {
-      throw new RelayClientError("parse", path19, `${method} ${path19} returned non-JSON body`, {
+      throw new RelayClientError("parse", path20, `${method} ${path20} returned non-JSON body`, {
         cause: err2
       });
     }
   }
-  async fetchWithRetry(path19, init, retry) {
-    const url = `${this.baseUrl}${path19}`;
+  async fetchWithRetry(path20, init, retry) {
+    const url = `${this.baseUrl}${path20}`;
     const attempts = retry ? this.maxRetries + 1 : 1;
     let lastNetworkError;
     for (let attempt = 0; attempt < attempts; attempt++) {
@@ -105186,7 +105212,7 @@ var RelayClient = class {
       }
       await this.backoff(attempt);
     }
-    throw new RelayClientError("network", path19, `request to ${path19} failed after ${attempts} attempt(s)`, {
+    throw new RelayClientError("network", path20, `request to ${path20} failed after ${attempts} attempt(s)`, {
       cause: lastNetworkError
     });
   }
@@ -105471,7 +105497,7 @@ init_dist6();
 
 // ../../packages/mcp-server/dist/bootstrap-service.js
 init_esm_shims();
-import { writeFileSync as writeFileSync7 } from "fs";
+import { writeFileSync as writeFileSync8 } from "fs";
 import { resolve as resolve6 } from "path";
 
 // ../../packages/core-identity/dist/node.js
@@ -105479,12 +105505,12 @@ init_esm_shims();
 
 // ../../packages/core-identity/dist/file-stores.js
 init_esm_shims();
-import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6, renameSync as renameSync2, chmodSync as chmodSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync7, renameSync as renameSync2, chmodSync as chmodSync2 } from "fs";
 
 // ../../packages/core-identity/dist/bootstrap-service.js
 init_esm_shims();
-import { mkdirSync as mkdirSync6, existsSync as existsSync3 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync7, existsSync as existsSync3 } from "fs";
+import { join as join10 } from "path";
 init_dist17();
 init_dist16();
 
@@ -106274,7 +106300,7 @@ var McpServerAdapter = class _McpServerAdapter {
 init_config2();
 init_dist32();
 init_node_fs();
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/utils.ts
 init_esm_shims();
@@ -106343,14 +106369,25 @@ async function handleInvokeCommand(args, deps) {
 async function handleReceiptCommand(args, deps) {
   const out = deps.out ?? ((s3) => console.log(s3));
   const taskId = args.trim();
+  let receipt;
   if (!taskId) {
-    out(error2("Usage: /receipt <task-id>"));
-    return;
-  }
-  const receipt = getArchivedReceipt(taskId);
-  if (!receipt) {
-    out(warn2(`No archived receipt for task_id=${taskId}`));
-    return;
+    receipt = latestArchivedReceipt();
+    if (!receipt) {
+      out(warn2("No receipts archived this session. Usage: /receipt [task-id-prefix]"));
+      return;
+    }
+  } else {
+    const found = findArchivedReceipt(taskId);
+    if (found.kind === "ambiguous") {
+      out(warn2(`Prefix "${taskId}" matches ${found.taskIds.length} receipts:`));
+      for (const id of found.taskIds) out(dim(`  ${id}`));
+      return;
+    }
+    if (found.kind === "miss") {
+      out(warn2(`No archived receipt matches "${taskId}" this session.`));
+      return;
+    }
+    receipt = found.receipt;
   }
   out("");
   await renderReceipt(receipt, out);
@@ -106391,6 +106428,369 @@ async function drainInvokeStream(stream, out, voice) {
   }
 }
 
+// etc/cli-surface.json
+var cli_surface_default = {
+  subcommands: {
+    approvals: [
+      "approve",
+      "deny",
+      "list",
+      "show"
+    ],
+    attest: [],
+    balance: [],
+    credentials: [],
+    delegate: [],
+    discover: [],
+    doctor: [],
+    export: [],
+    federation: [
+      "mesh",
+      "peer",
+      "peer-remove",
+      "peers",
+      "status"
+    ],
+    fund: [],
+    goal: [
+      "add",
+      "list",
+      "outcomes",
+      "pause",
+      "remove",
+      "resume"
+    ],
+    grant: [],
+    id: [],
+    init: [],
+    keychain: [],
+    ledger: [],
+    logs: [],
+    lsp: [],
+    migrate: [],
+    "migrate-keyring": [],
+    ps: [],
+    register: [],
+    relay: [
+      "up"
+    ],
+    restore: [],
+    rotate: [],
+    run: [],
+    schema: [],
+    seed: [],
+    serve: [],
+    skills: [],
+    smoke: [],
+    up: [],
+    verify: [
+      "identity"
+    ],
+    "verify-release": [],
+    wallet: [],
+    withdraw: []
+  },
+  flags: [
+    {
+      name: "address-only",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "all",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "allow-commands",
+      type: "string"
+    },
+    {
+      name: "allowed-paths",
+      type: "string"
+    },
+    {
+      name: "auto-approve",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "block-commands",
+      type: "string"
+    },
+    {
+      name: "budget",
+      type: "string"
+    },
+    {
+      name: "cadence-hours",
+      type: "string"
+    },
+    {
+      name: "capability",
+      type: "string"
+    },
+    {
+      name: "days",
+      type: "string"
+    },
+    {
+      name: "db-path",
+      type: "string"
+    },
+    {
+      name: "destination",
+      type: "string"
+    },
+    {
+      name: "direct",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "dry-run",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "event-type",
+      type: "string"
+    },
+    {
+      name: "every",
+      type: "string"
+    },
+    {
+      name: "facilitator-url",
+      type: "string"
+    },
+    {
+      name: "federation-url",
+      type: "string"
+    },
+    {
+      name: "file",
+      type: "string",
+      short: "f"
+    },
+    {
+      name: "force",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "grant",
+      type: "string"
+    },
+    {
+      name: "help",
+      type: "boolean",
+      default: false,
+      short: "h"
+    },
+    {
+      name: "identity",
+      type: "string"
+    },
+    {
+      name: "json",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "lifetime-usd",
+      type: "string"
+    },
+    {
+      name: "limit",
+      type: "string"
+    },
+    {
+      name: "max-tokens",
+      type: "string"
+    },
+    {
+      name: "model",
+      type: "string"
+    },
+    {
+      name: "network",
+      type: "string"
+    },
+    {
+      name: "no-stream",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "once",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "operator",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "output",
+      type: "string",
+      short: "o"
+    },
+    {
+      name: "passphrase",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "pay-new-agents",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "pay-to-address",
+      type: "string"
+    },
+    {
+      name: "plan",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "port",
+      type: "string"
+    },
+    {
+      name: "presentation",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "price",
+      type: "string"
+    },
+    {
+      name: "project",
+      type: "string"
+    },
+    {
+      name: "provider",
+      type: "string",
+      default: "anthropic"
+    },
+    {
+      name: "prune",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "reason",
+      type: "string"
+    },
+    {
+      name: "routing-strategy",
+      type: "string"
+    },
+    {
+      name: "scope",
+      type: "string"
+    },
+    {
+      name: "self-test",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "serve-port",
+      type: "string"
+    },
+    {
+      name: "serve-transport",
+      type: "string"
+    },
+    {
+      name: "solana-rpc-url",
+      type: "string"
+    },
+    {
+      name: "sovereign",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "subject",
+      type: "string"
+    },
+    {
+      name: "sync-token",
+      type: "string"
+    },
+    {
+      name: "sync-url",
+      type: "string"
+    },
+    {
+      name: "tail",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "target",
+      type: "string"
+    },
+    {
+      name: "tools",
+      type: "string"
+    },
+    {
+      name: "version",
+      type: "boolean",
+      default: false,
+      short: "v"
+    },
+    {
+      name: "voice",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "waive",
+      type: "boolean",
+      default: false
+    },
+    {
+      name: "wall-clock",
+      type: "string"
+    },
+    {
+      name: "window-hours",
+      type: "string"
+    },
+    {
+      name: "window-usd",
+      type: "string"
+    }
+  ],
+  exitCodes: [
+    0,
+    1,
+    2,
+    130
+  ],
+  onDiskLayout: [
+    "config.json",
+    "dev-keyring.json",
+    "identity.md",
+    "motebit.db",
+    "motebit.md",
+    "relay",
+    "relay/relay.db",
+    "smoke-x402-buyer-eoa.txt",
+    "smoke-x402-worker-eoa.txt",
+    "update-check.json"
+  ]
+};
+
 // src/slash-commands.ts
 function isSlashCommand(input) {
   return input.startsWith("/");
@@ -106413,6 +106813,17 @@ function resolveBareCommand(input) {
   if (name === "ledger" && words.length === 2) return `/ledger ${words[1]}`;
   return null;
 }
+function detectShellInvocation(input) {
+  if (input.includes("?")) return null;
+  const words = input.trim().split(/\s+/);
+  if (words.length < 2 || words[0] !== "motebit") return null;
+  const second = words[1];
+  const known = second.startsWith("--") ? CLI_FLAG_NAMES.has(second.slice(2).split("=")[0].toLowerCase()) : CLI_SUBCOMMAND_NAMES.has(second.toLowerCase());
+  if (!known) return null;
+  return "  that's a shell command \u2014 type `quit`, then run it in your terminal";
+}
+var CLI_SUBCOMMAND_NAMES = new Set(Object.keys(cli_surface_default.subcommands));
+var CLI_FLAG_NAMES = new Set(cli_surface_default.flags.map((f7) => f7.name.toLowerCase()));
 function renderProvenanceBadge(record) {
   const status = record.provenance_status;
   if (status === "verified") return success("[verified]");
@@ -106475,8 +106886,8 @@ function parseSub(args) {
   const m4 = args.match(/^(\S+)\s*([\s\S]*)$/);
   return m4 ? { sub: m4[1], rest: (m4[2] ?? "").trim() } : { sub: "", rest: "" };
 }
-async function relayFetch2(baseUrl, path19, opts) {
-  const url = `${baseUrl.replace(/\/+$/, "")}${path19}`;
+async function relayFetch2(baseUrl, path20, opts) {
+  const url = `${baseUrl.replace(/\/+$/, "")}${path20}`;
   const init = { headers: opts?.headers };
   if (opts?.method) init.method = opts.method;
   if (opts?.body != null) init.body = JSON.stringify(opts.body);
@@ -106748,7 +107159,10 @@ ${summary}`);
         "gpt-5.4-mini": "gpt-5.4-mini",
         "gpt-5.4-nano": "gpt-5.4-nano",
         o3: "o3",
+        qwen3: "qwen3",
+        "gpt-oss": "gpt-oss",
         "llama3.2": "llama3.2",
+        // legacy alias — still resolvable, no longer suggested
         mistral: "mistral"
       };
       const envKey = config.provider === "openai" ? process.env["OPENAI_API_KEY"] : process.env["ANTHROPIC_API_KEY"];
@@ -106839,6 +107253,10 @@ Unknown model: ${cyan(args)}
         break;
       }
       runtime.setModel(modelId);
+      if (runtime.moneyToolsWithheld) {
+        console.log(`
+  ${dim(MONEY_TOOLS_WITHHELD_NOTICE)}`);
+      }
       if (fullConfig) {
         fullConfig.default_model = modelId;
         const persistable = ["anthropic", "openai", "google", "local-server", "proxy"];
@@ -107057,9 +107475,9 @@ Unknown model: ${cyan(args)}
             let guardianAttest;
             try {
               const { parse: parse3 } = await Promise.resolve().then(() => (init_dist34(), dist_exports10));
-              const fs19 = await import("fs");
+              const fs20 = await import("fs");
               const idPath = config.identity ?? "motebit.md";
-              const content = fs19.readFileSync(idPath, "utf-8");
+              const content = fs20.readFileSync(idPath, "utf-8");
               const guardian = parse3(content).frontmatter.guardian;
               guardianPubKey = guardian?.public_key;
               guardianAttest = guardian?.attestation;
@@ -108406,7 +108824,7 @@ Curiosity targets (${targets.length}):
     }
     case "skills": {
       const registry = new SkillRegistry(
-        new NodeFsSkillStorageAdapter({ root: join10(CONFIG_DIR, "skills") })
+        new NodeFsSkillStorageAdapter({ root: join11(CONFIG_DIR, "skills") })
       );
       const records = await registry.list();
       if (records.length === 0) {
@@ -108437,7 +108855,7 @@ Curiosity targets (${targets.length}):
         break;
       }
       const registry = new SkillRegistry(
-        new NodeFsSkillStorageAdapter({ root: join10(CONFIG_DIR, "skills") })
+        new NodeFsSkillStorageAdapter({ root: join11(CONFIG_DIR, "skills") })
       );
       const record = await registry.get(name);
       if (!record) {
@@ -108515,6 +108933,209 @@ Curiosity targets (${targets.length}):
   }
 }
 
+// src/attached-repl.ts
+init_statusline();
+init_status_render();
+async function renderStream(stream) {
+  let pendingApproval = null;
+  let status = null;
+  let thinking = null;
+  const stopThinking = () => {
+    thinking?.stop();
+    thinking = null;
+  };
+  const stopStatus = () => {
+    stopThinking();
+    const elapsed = status?.stop() ?? 0;
+    status = null;
+    return elapsed;
+  };
+  thinking = startStatus("thinking");
+  try {
+    for await (const raw of stream) {
+      const chunk = raw;
+      switch (chunk.type) {
+        case "text":
+          stopThinking();
+          if (typeof chunk.text === "string") writeOutput(chunk.text);
+          break;
+        case "tool_status": {
+          const name = chunk.name ?? "tool";
+          if (chunk.status === "calling") {
+            if (name === "delegate_to_agent" && status) break;
+            stopThinking();
+            status = name === "delegate_to_agent" ? startStatus("delegating") : startStatus("running", name);
+          } else if (status) {
+            writeLine(
+              `  ${action("\u25CF")} ${action(name)} ${meta(`\xB7 done \xB7 ${formatElapsed(0, stopStatus())}`)}`
+            );
+            thinking = startStatus("thinking");
+          }
+          break;
+        }
+        case "approval_request":
+          pendingApproval = {
+            name: chunk.name ?? "tool",
+            args: chunk.args ?? {},
+            ...chunk.risk_level != null ? { riskLevel: chunk.risk_level } : {}
+          };
+          break;
+        case "delegation_start":
+          if (status) break;
+          stopThinking();
+          status = startStatus("delegating", chunk.tool ?? "task");
+          break;
+        case "delegation_complete":
+          stopStatus();
+          if (chunk.receipt?.task_id != null) {
+            writeLine(
+              dim(`[receipt ${chunk.receipt.task_id.slice(0, 8)} \xB7 ${chunk.receipt.status ?? ""}]`)
+            );
+          }
+          thinking = startStatus("thinking");
+          break;
+        case "injection_warning":
+          writeLine(`${warn2("\u26A0")} suspicious content in ${chunk.tool_name ?? "tool"} output`);
+          break;
+        case "approval_expired":
+          stopStatus();
+          writeLine(
+            `${warn2("[this approval expired before your answer arrived \u2014 nothing was executed]")}
+${dim(`(${chunk.tool_name ?? "the tool"} was never run; no money moved. Ask again when ready.)`)}`
+          );
+          break;
+        case "approval_voided":
+          stopStatus();
+          writeLine(
+            `${warn2("[your new message set aside the pending approval \u2014 nothing was executed]")}
+${dim(`(${chunk.tool_name ?? "the tool"} was never run; no money moved. It can be proposed again.)`)}`
+          );
+          break;
+        case "invoke_error":
+          stopStatus();
+          writeLine(
+            `${warn2(`[invoke failed${chunk.code != null ? ` \xB7 ${chunk.code}` : ""}]`)} ${chunk.message ?? ""}`
+          );
+          break;
+        case "task_step_narration":
+          if (typeof chunk.text === "string") {
+            status?.step(chunk.text.trim());
+            writeLine(`    ${meta("\xB7 " + chunk.text.trim())}`);
+          }
+          break;
+        default:
+          break;
+      }
+    }
+  } catch (err2) {
+    writeLine(`${warn2("[coordinator error]")} ${err2 instanceof Error ? err2.message : String(err2)}`);
+  } finally {
+    stopStatus();
+  }
+  return { pendingApproval };
+}
+async function renderTurn(client, motebitId, stream) {
+  let current2 = stream;
+  for (; ; ) {
+    const { pendingApproval } = await renderStream(current2);
+    if (pendingApproval === null) return;
+    for (const line of renderApprovalRequest({
+      name: pendingApproval.name,
+      args: pendingApproval.args,
+      ...pendingApproval.riskLevel != null ? { riskLevel: pendingApproval.riskLevel } : {}
+    })) {
+      writeLine(line);
+    }
+    const answer = await askQuestion(`  ${warn2("Allow?")} ${dim("(y/n)")} `);
+    const approved = answer.trim().toLowerCase() === "y";
+    current2 = client.resolveApproval(approved, motebitId);
+  }
+}
+var ATTACHED_HELP = `
+  Attached mode \u2014 the coordinator process owns the runtime; this terminal renders.
+    <text>                chat with your motebit (proxied to the coordinator)
+    /invoke <cap> <text>  invoke a capability deterministically
+    /help                 this help
+    /exit                 leave (the coordinator keeps running)
+  Other slash commands need the runtime in-process: exit, stop the coordinator, and re-run \`motebit\`.
+`;
+async function runAttachedRepl(client, motebitId) {
+  writeOutput(
+    `
+  ${dim("Attached to the machine's coordinator runtime")} ${dim(`(pid ${client.coordinatorPid})`)}
+  ${dim("This terminal renders; the coordinator acts. /help for what's available.")}
+
+`
+  );
+  setModeRow(renderModeRow({ attachedPid: client.coordinatorPid }));
+  let closed = false;
+  client.onClose(() => {
+    closed = true;
+    writeOutput(
+      `
+${warn2("Coordinator exited.")} Run \`motebit\` again to take over as coordinator.
+`
+    );
+    destroyTerminal();
+    process.exit(0);
+  });
+  for (; ; ) {
+    if (closed) return;
+    let line;
+    try {
+      line = await readInput(prompt("you>") + " ");
+    } catch {
+      break;
+    }
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    if (trimmed === "/exit" || trimmed === "/quit" || trimmed === "exit" || trimmed === "quit") {
+      writeOutput("Goodbye! (coordinator keeps running)\n");
+      break;
+    }
+    if (trimmed === "/help") {
+      writeOutput(ATTACHED_HELP);
+      continue;
+    }
+    if (trimmed.startsWith("/invoke ")) {
+      const rest = trimmed.slice("/invoke ".length).trim();
+      const space = rest.indexOf(" ");
+      const capability = space === -1 ? rest : rest.slice(0, space);
+      const prompt2 = space === -1 ? "" : rest.slice(space + 1);
+      if (capability === "") {
+        writeOutput(`${warn2("usage:")} /invoke <capability> <prompt>
+`);
+        continue;
+      }
+      writeOutput(prompt("mote>") + " ");
+      await renderTurn(client, motebitId, client.invoke(capability, prompt2));
+      writeOutput("\n");
+      continue;
+    }
+    if (trimmed.startsWith("/")) {
+      writeOutput(
+        `${dim(`${trimmed.split(" ")[0]} needs the runtime in-process \u2014 not available in attached mode.`)}
+${dim("Stop the coordinator and re-run `motebit` to use it.")}
+`
+      );
+      continue;
+    }
+    const shellTeach = detectShellInvocation(trimmed);
+    if (shellTeach != null) {
+      writeOutput(dim(shellTeach) + "\n\n");
+      continue;
+    }
+    writeOutput(prompt("mote>") + " ");
+    await renderTurn(client, motebitId, client.chat(trimmed));
+    writeOutput("\n");
+  }
+  client.close();
+  destroyTerminal();
+}
+
+// src/index.ts
+init_colors();
+
 // src/subcommands/index.ts
 init_esm_shims();
 
@@ -108647,8 +109268,8 @@ init_dist11();
 init_config2();
 init_identity();
 init_runtime_factory();
-import * as fs7 from "fs";
-import * as path9 from "path";
+import * as fs8 from "fs";
+import * as path10 from "path";
 import * as readline2 from "readline";
 async function buildAttestationCredential(input) {
   return composeHardwareAttestationCredential({
@@ -108731,8 +109352,8 @@ async function handleAttest(config) {
   rl.close();
   const json = JSON.stringify(signed, null, 2);
   if (config.output != null && config.output !== "") {
-    const outPath = path9.resolve(config.output);
-    fs7.writeFileSync(outPath, `${json}
+    const outPath = path10.resolve(config.output);
+    fs8.writeFileSync(outPath, `${json}
 `, "utf-8");
     process.stderr.write(
       `Wrote attestation credential for ${motebitId.slice(0, 8)}\u2026 to ${outPath}
@@ -109386,8 +110007,8 @@ Agent ${data.motebit_id}: found`);
 init_esm_shims();
 init_dist11();
 init_config2();
-import * as fs8 from "fs";
-import * as path10 from "path";
+import * as fs9 from "fs";
+import * as path11 from "path";
 
 // src/subcommands/seed.ts
 init_esm_shims();
@@ -109492,26 +110113,26 @@ async function handleDoctor() {
     detail: major >= 20 ? `v${nodeVer}` : `v${nodeVer} (requires >=20)`
   });
   try {
-    fs8.mkdirSync(CONFIG_DIR, { recursive: true });
-    const testFile = path10.join(CONFIG_DIR, ".doctor-test");
-    fs8.writeFileSync(testFile, "ok", "utf-8");
-    fs8.unlinkSync(testFile);
+    fs9.mkdirSync(CONFIG_DIR, { recursive: true });
+    const testFile = path11.join(CONFIG_DIR, ".doctor-test");
+    fs9.writeFileSync(testFile, "ok", "utf-8");
+    fs9.unlinkSync(testFile);
     checks.push({ name: "Config dir", ok: true, detail: CONFIG_DIR });
   } catch {
     checks.push({ name: "Config dir", ok: false, detail: `Cannot write to ${CONFIG_DIR}` });
   }
   try {
-    const tmpDbPath = path10.join(CONFIG_DIR, ".doctor-test.db");
+    const tmpDbPath = path11.join(CONFIG_DIR, ".doctor-test.db");
     const db = await openMotebitDatabase(tmpDbPath);
     const driverName = db.db.driverName;
     db.close();
-    fs8.unlinkSync(tmpDbPath);
+    fs9.unlinkSync(tmpDbPath);
     try {
-      fs8.unlinkSync(tmpDbPath + "-wal");
+      fs9.unlinkSync(tmpDbPath + "-wal");
     } catch {
     }
     try {
-      fs8.unlinkSync(tmpDbPath + "-shm");
+      fs9.unlinkSync(tmpDbPath + "-shm");
     } catch {
     }
     checks.push({ name: "SQLite", ok: true, detail: `${driverName} loaded and functional` });
@@ -109540,10 +110161,10 @@ async function handleDoctor() {
     checks.push({ name: "Identity", ok: true, detail: "not created yet (run motebit to create)" });
   }
   {
-    const mdPath = path10.join(CONFIG_DIR, "motebit.md");
-    if (fs8.existsSync(mdPath) && fullCfg.device_public_key) {
+    const mdPath = path11.join(CONFIG_DIR, "motebit.md");
+    if (fs9.existsSync(mdPath) && fullCfg.device_public_key) {
       try {
-        const md = fs8.readFileSync(mdPath, "utf-8");
+        const md = fs9.readFileSync(mdPath, "utf-8");
         const keyMatch = /public_key:\s*"?([0-9a-fA-F]{64})"?/.exec(md);
         const fileKey = keyMatch?.[1]?.toLowerCase();
         const stale = fileKey != null && fileKey !== fullCfg.device_public_key.toLowerCase();
@@ -109589,7 +110210,7 @@ async function handleDoctor() {
         detail: "cli_private_key (plaintext, deprecated \u2014 re-encrypt at next run)"
       });
     } else {
-      const clobberedBackups = fs8.readdirSync(CONFIG_DIR).filter((f7) => f7.startsWith("config.json.clobbered-"));
+      const clobberedBackups = fs9.readdirSync(CONFIG_DIR).filter((f7) => f7.startsWith("config.json.clobbered-"));
       const restoreHint = clobberedBackups.length > 0 ? `restore from ~/.motebit/${clobberedBackups[0]} (a clobbered backup is present)` : "run `motebit init` to create or import an identity key";
       checks.push({
         name: "Identity key",
@@ -109873,8 +110494,8 @@ init_config2();
 init_identity();
 init_runtime_factory();
 import * as readline4 from "readline";
-import * as fs9 from "fs";
-import * as path11 from "path";
+import * as fs10 from "fs";
+import * as path12 from "path";
 async function handleExport(config) {
   const fullConfig = loadFullConfig();
   const rl = readline4.createInterface({
@@ -109948,22 +110569,22 @@ async function handleExport(config) {
     },
     privateKey
   );
-  const outputDir = config.output != null && config.output !== "" ? path11.resolve(config.output) : path11.resolve("motebit-export");
-  fs9.mkdirSync(outputDir, { recursive: true });
+  const outputDir = config.output != null && config.output !== "" ? path12.resolve(config.output) : path12.resolve("motebit-export");
+  fs10.mkdirSync(outputDir, { recursive: true });
   const exported = [];
   const skipped = [];
-  const identityPath = path11.join(outputDir, "motebit.md");
-  fs9.writeFileSync(identityPath, identityContent, "utf-8");
+  const identityPath = path12.join(outputDir, "motebit.md");
+  fs10.writeFileSync(identityPath, identityContent, "utf-8");
   exported.push("identity");
   try {
-    fs9.writeFileSync(path11.join(CONFIG_DIR, "motebit.md"), identityContent, "utf-8");
+    fs10.writeFileSync(path12.join(CONFIG_DIR, "motebit.md"), identityContent, "utf-8");
   } catch {
   }
   try {
     const latestGradient = moteDb.gradientStore.latest(motebitId);
     if (latestGradient) {
-      const gradientPath = path11.join(outputDir, "gradient.json");
-      fs9.writeFileSync(gradientPath, JSON.stringify(latestGradient, null, 2), "utf-8");
+      const gradientPath = path12.join(outputDir, "gradient.json");
+      fs10.writeFileSync(gradientPath, JSON.stringify(latestGradient, null, 2), "utf-8");
       exported.push("gradient snapshot");
     } else {
       skipped.push("gradient (no snapshots recorded)");
@@ -109990,8 +110611,8 @@ async function handleExport(config) {
     if (credResult.ok) {
       const credBody = credResult.data;
       const creds = credBody.credentials ?? [];
-      const credPath = path11.join(outputDir, "credentials.json");
-      fs9.writeFileSync(credPath, JSON.stringify(creds, null, 2), "utf-8");
+      const credPath = path12.join(outputDir, "credentials.json");
+      fs10.writeFileSync(credPath, JSON.stringify(creds, null, 2), "utf-8");
       exported.push(`${creds.length} credential${creds.length !== 1 ? "s" : ""}`);
     } else {
       skipped.push(`credentials (${credResult.error})`);
@@ -110003,8 +110624,8 @@ async function handleExport(config) {
     );
     if (vpResult.ok) {
       const vpBody = vpResult.data;
-      const vpPath = path11.join(outputDir, "presentation.json");
-      fs9.writeFileSync(vpPath, JSON.stringify(vpBody.presentation ?? vpBody, null, 2), "utf-8");
+      const vpPath = path12.join(outputDir, "presentation.json");
+      fs10.writeFileSync(vpPath, JSON.stringify(vpBody.presentation ?? vpBody, null, 2), "utf-8");
       const credCount = vpBody.credential_count ?? 0;
       exported.push(`presentation (${credCount} credential${credCount !== 1 ? "s" : ""})`);
     } else {
@@ -110012,16 +110633,16 @@ async function handleExport(config) {
     }
     try {
       const ossaManifest = generateOssaManifest(motebitId, publicKeyHex);
-      const ossaPath = path11.join(outputDir, "ossa-manifest.yaml");
-      fs9.writeFileSync(ossaPath, ossaManifest, "utf-8");
+      const ossaPath = path12.join(outputDir, "ossa-manifest.yaml");
+      fs10.writeFileSync(ossaPath, ossaManifest, "utf-8");
       exported.push("OSSA manifest");
     } catch {
       skipped.push("OSSA manifest (generation failed)");
     }
     const budgetResult = await fetchRelayJson(`${baseUrl}/agent/${motebitId}/budget`, headers);
     if (budgetResult.ok) {
-      const budgetPath = path11.join(outputDir, "budget.json");
-      fs9.writeFileSync(budgetPath, JSON.stringify(budgetResult.data, null, 2), "utf-8");
+      const budgetPath = path12.join(outputDir, "budget.json");
+      fs10.writeFileSync(budgetPath, JSON.stringify(budgetResult.data, null, 2), "utf-8");
       const budgetData = budgetResult.data;
       const allocCount = budgetData.allocations?.length ?? 0;
       exported.push(`budget (${allocCount} allocation${allocCount !== 1 ? "s" : ""})`);
@@ -110485,8 +111106,8 @@ async function handleGoalSetEnabled(config, enabled2) {
 
 // src/subcommands/init.ts
 init_esm_shims();
-import * as fs10 from "fs";
-import * as path12 from "path";
+import * as fs11 from "fs";
+import * as path13 from "path";
 var DEFAULT_PATH = "motebit.yaml";
 var SCAFFOLD = `# motebit.yaml \u2014 declarative config for a motebit.
 #
@@ -110538,14 +111159,14 @@ routines: []
 `;
 function handleInit(config) {
   const targetRelative = config.file ?? DEFAULT_PATH;
-  const target = path12.isAbsolute(targetRelative) ? targetRelative : path12.join(process.cwd(), targetRelative);
-  if (fs10.existsSync(target) && !config.force) {
+  const target = path13.isAbsolute(targetRelative) ? targetRelative : path13.join(process.cwd(), targetRelative);
+  if (fs11.existsSync(target) && !config.force) {
     console.error(
       `Error: ${target} already exists. Edit it directly, or pass --force to overwrite.`
     );
     process.exit(1);
   }
-  fs10.writeFileSync(target, SCAFFOLD, "utf-8");
+  fs11.writeFileSync(target, SCAFFOLD, "utf-8");
   console.log(`Wrote ${target}`);
   console.log("Next: edit the file to declare routines, then run `motebit up`.");
 }
@@ -110767,9 +111388,9 @@ function formatDiagnostic(d6) {
   const pathStr = d6.path.length === 0 ? "" : `${formatPath(d6.path)}: `;
   return `${loc}: ${pathStr}${d6.message}`;
 }
-function formatPath(path19) {
+function formatPath(path20) {
   const parts = [];
-  for (const seg of path19) {
+  for (const seg of path20) {
     if (typeof seg === "number") {
       parts.push(`[${seg}]`);
     } else if (parts.length === 0) {
@@ -110885,7 +111506,7 @@ import { isMap, isSeq, isScalar } from "yaml";
 function findPathAtOffset(doc, offset) {
   return walk(doc.contents, offset, []);
 }
-function walk(node, offset, path19) {
+function walk(node, offset, path20) {
   if (node == null) return null;
   if (isMap(node)) {
     for (const pair of node.items) {
@@ -110894,30 +111515,30 @@ function walk(node, offset, path19) {
       const keyName = key != null && isScalar(key) ? String(key.value) : null;
       const keyRange = key?.range;
       if (keyRange && offset >= keyRange[0] && offset <= keyRange[1]) {
-        return { path: keyName != null ? [...path19, keyName] : path19, onKey: true };
+        return { path: keyName != null ? [...path20, keyName] : path20, onKey: true };
       }
       const valueRange = value?.range;
       if (value && keyName != null && valueRange) {
         if (offset >= valueRange[0] && offset <= valueRange[2]) {
-          const inner = walk(value, offset, [...path19, keyName]);
+          const inner = walk(value, offset, [...path20, keyName]);
           if (inner) return inner;
-          return { path: [...path19, keyName], onKey: false };
+          return { path: [...path20, keyName], onKey: false };
         }
       }
     }
-    return path19.length > 0 ? { path: path19, onKey: false } : null;
+    return path20.length > 0 ? { path: path20, onKey: false } : null;
   }
   if (isSeq(node)) {
     for (let i = 0; i < node.items.length; i++) {
       const item = node.items[i];
       const range = item?.range;
       if (range && offset >= range[0] && offset <= range[2]) {
-        const inner = walk(item, offset, [...path19, i]);
+        const inner = walk(item, offset, [...path20, i]);
         if (inner) return inner;
-        return { path: [...path19, i], onKey: false };
+        return { path: [...path20, i], onKey: false };
       }
     }
-    return path19.length > 0 ? { path: path19, onKey: false } : null;
+    return path20.length > 0 ? { path: path20, onKey: false } : null;
   }
   return null;
 }
@@ -110950,9 +111571,9 @@ function findDescription(schema) {
     cur = next;
   }
 }
-function resolvePath(schema, path19) {
+function resolvePath(schema, path20) {
   let cur = schema;
-  for (const seg of path19) {
+  for (const seg of path20) {
     const inner = unwrapAll(cur);
     if (inner instanceof z44.ZodObject) {
       const shape = inner.shape;
@@ -110969,8 +111590,8 @@ function resolvePath(schema, path19) {
   }
   return cur;
 }
-function objectKeys(schema, path19) {
-  const target = resolvePath(schema, path19);
+function objectKeys(schema, path20) {
+  const target = resolvePath(schema, path20);
   if (target == null) return [];
   const inner = unwrapAll(target);
   if (inner instanceof z44.ZodObject) {
@@ -110984,8 +111605,8 @@ function objectKeys(schema, path19) {
   }
   return [];
 }
-function enumValues(schema, path19) {
-  const target = resolvePath(schema, path19);
+function enumValues(schema, path20) {
+  const target = resolvePath(schema, path20);
   if (target == null) return null;
   const inner = unwrapAll(target);
   if (inner instanceof z44.ZodEnum) {
@@ -111050,9 +111671,9 @@ async function computeDiagnostics(doc) {
   }
   return diagnostics;
 }
-function formatPath2(path19) {
+function formatPath2(path20) {
   const parts = [];
-  for (const seg of path19) {
+  for (const seg of path20) {
     if (typeof seg === "number") {
       parts.push(`[${seg}]`);
     } else if (parts.length === 0) {
@@ -111145,14 +111766,14 @@ function inferParentPath(lines, currentLine, currentIndent) {
     stack.unshift({ indent: effectiveIndent, key, isArray: arrayBullet });
     if (effectiveIndent === 0) break;
   }
-  const path19 = [];
+  const path20 = [];
   for (let i = 0; i < stack.length; i++) {
     const cur = stack[i];
-    path19.push(cur.key);
+    path20.push(cur.key);
     const next = stack[i + 1];
-    if (next && next.isArray) path19.push(0);
+    if (next && next.isArray) path20.push(0);
   }
-  return path19;
+  return path20;
 }
 
 // src/subcommands/lsp.ts
@@ -111210,8 +111831,8 @@ init_dist25();
 init_dist11();
 init_config2();
 init_runtime_factory();
-import * as fs11 from "fs";
-import * as path13 from "path";
+import * as fs12 from "fs";
+import * as path14 from "path";
 async function handleUp(config) {
   const yamlPath = resolveYamlPath(config.file);
   if (yamlPath == null) {
@@ -111246,7 +111867,7 @@ async function handleUp(config) {
   console.log("\nApplied.");
 }
 async function applyMotebitYaml(opts) {
-  const raw = fs11.readFileSync(opts.yamlPath, "utf-8");
+  const raw = fs12.readFileSync(opts.yamlPath, "utf-8");
   const parsed = await parseMotebitYaml(raw, opts.yamlPath);
   if (!parsed.ok) {
     return { kind: "parse_error", diagnostics: parsed.diagnostics };
@@ -111407,14 +112028,14 @@ function printPlan(plan, opts) {
 }
 function resolveYamlPath(explicit) {
   if (explicit != null && explicit !== "") {
-    const abs = path13.isAbsolute(explicit) ? explicit : path13.resolve(explicit);
-    return fs11.existsSync(abs) ? abs : null;
+    const abs = path14.isAbsolute(explicit) ? explicit : path14.resolve(explicit);
+    return fs12.existsSync(abs) ? abs : null;
   }
   let dir = process.cwd();
   for (; ; ) {
-    const candidate = path13.join(dir, "motebit.yaml");
-    if (fs11.existsSync(candidate)) return candidate;
-    const parent = path13.dirname(dir);
+    const candidate = path14.join(dir, "motebit.yaml");
+    if (fs12.existsSync(candidate)) return candidate;
+    const parent = path14.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -111675,8 +112296,8 @@ init_esm_shims();
 init_dist6();
 init_config2();
 init_identity();
-import * as fs12 from "fs";
-import * as path14 from "path";
+import * as fs13 from "fs";
+import * as path15 from "path";
 async function handleMigrateKeyring(config) {
   const force = config.force === true;
   const fullConfig = loadFullConfig();
@@ -111692,8 +112313,8 @@ async function handleMigrateKeyring(config) {
     );
     process.exit(1);
   }
-  const devKeyringPath = path14.join(CONFIG_DIR, "dev-keyring.json");
-  if (!fs12.existsSync(devKeyringPath)) {
+  const devKeyringPath = path15.join(CONFIG_DIR, "dev-keyring.json");
+  if (!fs13.existsSync(devKeyringPath)) {
     console.error(`Error: no plaintext keyring at ${devKeyringPath}.`);
     console.error(
       "  This subcommand recovers from configs where cli_encrypted_key was lost\n  but a plaintext key remains on disk. If you have neither, run\n  `motebit` (no args) to create a fresh identity."
@@ -111702,7 +112323,7 @@ async function handleMigrateKeyring(config) {
   }
   let devKeyring;
   try {
-    const raw = fs12.readFileSync(devKeyringPath, "utf-8");
+    const raw = fs13.readFileSync(devKeyringPath, "utf-8");
     devKeyring = JSON.parse(raw);
   } catch (err2) {
     console.error(
@@ -111768,9 +112389,9 @@ async function handleMigrateKeyring(config) {
   saveFullConfig(fullConfig);
   secureErase(privateKeyBytes);
   try {
-    const stat = fs12.statSync(devKeyringPath);
-    fs12.writeFileSync(devKeyringPath, "0".repeat(Math.min(stat.size, 4096)));
-    fs12.unlinkSync(devKeyringPath);
+    const stat = fs13.statSync(devKeyringPath);
+    fs13.writeFileSync(devKeyringPath, "0".repeat(Math.min(stat.size, 4096)));
+    fs13.unlinkSync(devKeyringPath);
   } catch (err2) {
     console.warn(
       `Warning: could not remove ${devKeyringPath} (${err2 instanceof Error ? err2.message : String(err2)}).`
@@ -112153,7 +112774,7 @@ init_dist6();
 init_config2();
 init_identity();
 init_colors();
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as readline5 from "readline";
 var IDENTITY_SUITE = "motebit-jcs-ed25519-hex-v1";
 function askVisible(prompt2) {
@@ -112179,7 +112800,7 @@ async function handleRestore(config) {
   let mdContent = null;
   if (mdPath != null) {
     try {
-      mdContent = fs13.readFileSync(mdPath, "utf-8");
+      mdContent = fs14.readFileSync(mdPath, "utf-8");
     } catch (err2) {
       console.error(`Cannot read ${mdPath}: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
@@ -112371,7 +112992,7 @@ async function handleKeychain(config) {
 
 // src/subcommands/relay.ts
 init_esm_shims();
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import { serve } from "@hono/node-server";
 
 // ../../services/relay/dist/index.js
@@ -120974,7 +121595,7 @@ function resolveRelayDbPath(override) {
   if (override != null && override !== "") return override;
   const envPath = process.env["MOTEBIT_RELAY_DB_PATH"];
   if (envPath != null && envPath !== "") return envPath;
-  fs14.mkdirSync(RELAY_DIR, { recursive: true });
+  fs15.mkdirSync(RELAY_DIR, { recursive: true });
   return RELAY_DB_PATH;
 }
 async function resolveOptions2(config) {
@@ -121108,22 +121729,22 @@ init_dist6();
 init_config2();
 init_identity();
 import * as readline6 from "readline";
-import * as fs15 from "fs";
-import * as path15 from "path";
+import * as fs16 from "fs";
+import * as path16 from "path";
 function discoverIdentityFile() {
   let dir = process.cwd();
-  const root = path15.parse(dir).root;
-  let parent = path15.dirname(dir);
+  const root = path16.parse(dir).root;
+  let parent = path16.dirname(dir);
   while (dir !== parent && dir !== root) {
-    const candidate = path15.join(dir, "motebit.md");
-    if (fs15.existsSync(candidate)) return candidate;
+    const candidate = path16.join(dir, "motebit.md");
+    if (fs16.existsSync(candidate)) return candidate;
     dir = parent;
-    parent = path15.dirname(dir);
+    parent = path16.dirname(dir);
   }
-  const rootCandidate = path15.join(root, "motebit.md");
-  if (fs15.existsSync(rootCandidate)) return rootCandidate;
-  const homeCandidate = path15.join(CONFIG_DIR, "identity.md");
-  if (fs15.existsSync(homeCandidate)) return homeCandidate;
+  const rootCandidate = path16.join(root, "motebit.md");
+  if (fs16.existsSync(rootCandidate)) return rootCandidate;
+  const homeCandidate = path16.join(CONFIG_DIR, "identity.md");
+  if (fs16.existsSync(homeCandidate)) return homeCandidate;
   return null;
 }
 async function handleRotate(config) {
@@ -121138,7 +121759,7 @@ async function handleRotate(config) {
 Identity file: ${identityPath}`);
   let existingContent;
   try {
-    existingContent = fs15.readFileSync(identityPath, "utf-8");
+    existingContent = fs16.readFileSync(identityPath, "utf-8");
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     console.error(`Error: cannot read identity file: ${msg}`);
@@ -121209,7 +121830,7 @@ Identity file: ${identityPath}`);
     rl.close();
     process.exit(1);
   }
-  fs15.writeFileSync(identityPath, rotatedContent, "utf-8");
+  fs16.writeFileSync(identityPath, rotatedContent, "utf-8");
   console.log("  Identity file: updated and re-signed");
   fullConfig.cli_encrypted_key = await encryptPrivateKey(
     bytesToHex4(rotateResult.newPrivateKey),
@@ -121401,12 +122022,12 @@ init_esm_shims();
 init_dist6();
 init_config2();
 import * as crypto3 from "crypto";
-import * as fs16 from "fs";
-import * as path16 from "path";
+import * as fs17 from "fs";
+import * as path17 from "path";
 var SMOKE_UNIT_COST_USD = 0.01;
 var SMOKE_CAPABILITY = "echo";
-var BUYER_EOA_FILE = path16.join(CONFIG_DIR, "smoke-x402-buyer-eoa.txt");
-var WORKER_EOA_FILE = path16.join(CONFIG_DIR, "smoke-x402-worker-eoa.txt");
+var BUYER_EOA_FILE = path17.join(CONFIG_DIR, "smoke-x402-buyer-eoa.txt");
+var WORKER_EOA_FILE = path17.join(CONFIG_DIR, "smoke-x402-worker-eoa.txt");
 var USDC_CONTRACTS2 = {
   mainnet: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
   testnet: "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
@@ -121484,8 +122105,8 @@ async function handleSmokeX402(config) {
 }
 async function loadOrGenerateEoa(filePath, label) {
   const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
-  if (fs16.existsSync(filePath)) {
-    const privateKey2 = fs16.readFileSync(filePath, "utf-8").trim();
+  if (fs17.existsSync(filePath)) {
+    const privateKey2 = fs17.readFileSync(filePath, "utf-8").trim();
     if (!/^0x[0-9a-f]{64}$/i.test(privateKey2)) {
       throw new Error(
         `${filePath} is not a valid EOA private key (expected 0x + 64 hex). Delete the file to regenerate.`
@@ -121494,9 +122115,9 @@ async function loadOrGenerateEoa(filePath, label) {
     const account2 = privateKeyToAccount(privateKey2);
     return { address: account2.address, privateKey: privateKey2, justGenerated: false };
   }
-  fs16.mkdirSync(path16.dirname(filePath), { recursive: true });
+  fs17.mkdirSync(path17.dirname(filePath), { recursive: true });
   const privateKey = generatePrivateKey();
-  fs16.writeFileSync(filePath, privateKey, { mode: 384 });
+  fs17.writeFileSync(filePath, privateKey, { mode: 384 });
   const account = privateKeyToAccount(privateKey);
   console.log(`Generated ${label} EOA at ${filePath} (mode 0600)`);
   return { address: account.address, privateKey, justGenerated: true };
@@ -121721,13 +122342,13 @@ init_colors();
 import {
   appendFileSync,
   existsSync as existsSync10,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync13,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync4,
   statSync as statSync4,
-  writeFileSync as writeFileSync15
+  writeFileSync as writeFileSync16
 } from "fs";
-import { isAbsolute as isAbsolute3, join as join18, resolve as resolve10 } from "path";
+import { isAbsolute as isAbsolute3, join as join19, resolve as resolve10 } from "path";
 import * as readline7 from "readline";
 var DEFAULT_RELAY_URL = "https://relay.motebit.com";
 var REGISTRY_ADDRESS_RE = /^did:key:z[1-9A-HJ-NP-Za-km-z]+\/[a-z0-9-]+@[^/]+$/;
@@ -121747,15 +122368,15 @@ function resolveRelayUrl() {
 var SKILLS_DIR_NAME = "skills";
 var AUDIT_LOG_NAME = "audit.log";
 function getSkillsRoot() {
-  return join18(CONFIG_DIR, SKILLS_DIR_NAME);
+  return join19(CONFIG_DIR, SKILLS_DIR_NAME);
 }
 function getAuditLogPath() {
-  return join18(getSkillsRoot(), AUDIT_LOG_NAME);
+  return join19(getSkillsRoot(), AUDIT_LOG_NAME);
 }
 function makeAuditSink() {
   return (event) => {
     const root = getSkillsRoot();
-    if (!existsSync10(root)) mkdirSync11(root, { recursive: true });
+    if (!existsSync10(root)) mkdirSync12(root, { recursive: true });
     appendFileSync(getAuditLogPath(), JSON.stringify(event) + "\n", "utf-8");
   };
 }
@@ -121793,18 +122414,18 @@ async function handleSkillsInstall(config) {
   await installFromDirectory(config, sourceArg);
 }
 async function installFromDirectory(config, sourceArg) {
-  const path19 = isAbsolute3(sourceArg) ? sourceArg : resolve10(process.cwd(), sourceArg);
+  const path20 = isAbsolute3(sourceArg) ? sourceArg : resolve10(process.cwd(), sourceArg);
   let stat;
   try {
-    stat = statSync4(path19);
+    stat = statSync4(path20);
   } catch {
-    console.error(error2(`No such path: ${path19}`));
+    console.error(error2(`No such path: ${path20}`));
     process.exit(1);
   }
   if (!stat.isDirectory()) {
     console.error(
       error2(
-        `Source must be a directory containing SKILL.md and skill-envelope.json. Got: ${path19}`
+        `Source must be a directory containing SKILL.md and skill-envelope.json. Got: ${path20}`
       )
     );
     console.error(dim("(git+ssh install sources land in phase 2.)"));
@@ -121812,13 +122433,13 @@ async function installFromDirectory(config, sourceArg) {
   }
   let installSource;
   try {
-    installSource = resolveDirectorySkillSource(path19);
+    installSource = resolveDirectorySkillSource(path20);
   } catch (err2) {
-    console.error(error2(`Failed to read skill at ${path19}:`));
+    console.error(error2(`Failed to read skill at ${path20}:`));
     console.error(`  ${err2 instanceof Error ? err2.message : String(err2)}`);
     process.exit(1);
   }
-  await runInstall(config, installSource, `directory:${path19}`, path19);
+  await runInstall(config, installSource, `directory:${path20}`, path20);
 }
 async function installFromRelay(config, rawAddress, parsed) {
   const relayUrl = resolveRelayUrl().replace(/\/$/, "");
@@ -121894,8 +122515,8 @@ async function installFromRelay(config, rawAddress, parsed) {
   const bodyBytes = base64Decode2(bundle.body);
   const fileBytes = {};
   if (bundle.files) {
-    for (const [path19, b64] of Object.entries(bundle.files)) {
-      fileBytes[path19] = base64Decode2(b64);
+    for (const [path20, b64] of Object.entries(bundle.files)) {
+      fileBytes[path20] = base64Decode2(b64);
     }
   }
   const installSource = {
@@ -122091,9 +122712,9 @@ function parseAuditFilters(config) {
   return { skillName, type, limit, json: config.json };
 }
 function readAuditEvents() {
-  const path19 = getAuditLogPath();
-  if (!existsSync10(path19)) return [];
-  const text = readFileSync13(path19, "utf-8");
+  const path20 = getAuditLogPath();
+  if (!existsSync10(path20)) return [];
+  const text = readFileSync14(path20, "utf-8");
   const events = [];
   for (const line of text.split("\n")) {
     const trimmed = line.trim();
@@ -122255,8 +122876,8 @@ async function handleSkillsRunScript(config) {
   const { mkdtempSync, writeFileSync: writeBytes, chmodSync: chmodSync3, rmSync: rmSync3 } = await import("fs");
   const { tmpdir: tmpdir2 } = await import("os");
   const { spawnSync: spawnSync2 } = await import("child_process");
-  const tempDir = mkdtempSync(join18(tmpdir2(), "motebit-skill-script-"));
-  const tempPath = join18(tempDir, scriptName);
+  const tempDir = mkdtempSync(join19(tmpdir2(), "motebit-skill-script-"));
+  const tempPath = join19(tempDir, scriptName);
   try {
     writeBytes(tempPath, Buffer.from(scriptBytes));
     chmodSync3(tempPath, 448);
@@ -122326,17 +122947,17 @@ function collectAuxFiles2(skillDir) {
   function walk2(current2, base) {
     const entries = readdirSync4(current2, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join18(current2, entry.name);
+      const full = join19(current2, entry.name);
       if (entry.isDirectory()) {
         walk2(full, base);
       } else if (entry.isFile()) {
         const rel = full.slice(base.length + 1).split(/[\\/]+/).join("/");
-        out[rel] = readFileSync13(full);
+        out[rel] = readFileSync14(full);
       }
     }
   }
   for (const subdir of AUX_DIRS2) {
-    const subdirPath = join18(skillDir, subdir);
+    const subdirPath = join19(skillDir, subdir);
     if (existsSync10(subdirPath)) walk2(subdirPath, skillDir);
   }
   return out;
@@ -122387,12 +123008,12 @@ async function loadIdentityKey() {
   };
 }
 async function signSkillDirectory(skillDir, privateKey, publicKey) {
-  const skillMdPath = join18(skillDir, SKILL_MD_NAME);
+  const skillMdPath = join19(skillDir, SKILL_MD_NAME);
   if (!existsSync10(skillMdPath)) {
     console.error(error2(`  No SKILL.md at ${skillMdPath}`));
     process.exit(1);
   }
-  const text = readFileSync13(skillMdPath, "utf-8");
+  const text = readFileSync14(skillMdPath, "utf-8");
   const parsed = parseSkillFile(text);
   const body = parsed.body;
   const motebitNoSig = { ...parsed.manifest.motebit };
@@ -122411,7 +123032,7 @@ async function signSkillDirectory(skillDir, privateKey, publicKey) {
   const bodyHash = await hash(body);
   const auxFiles = collectAuxFiles2(skillDir);
   const filesEntries = await Promise.all(
-    Object.entries(auxFiles).sort(([a4], [b5]) => a4.localeCompare(b5)).map(async ([path19, bytes]) => ({ path: path19, hash: await hash(bytes) }))
+    Object.entries(auxFiles).sort(([a4], [b5]) => a4.localeCompare(b5)).map(async ([path20, bytes]) => ({ path: path20, hash: await hash(bytes) }))
   );
   const signedEnvelope = await signSkillEnvelope(
     {
@@ -122429,9 +123050,9 @@ async function signSkillDirectory(skillDir, privateKey, publicKey) {
     publicKey
   );
   const skillMdContent = serializeSkillFile(signedManifest, body);
-  writeFileSync15(skillMdPath, skillMdContent);
-  writeFileSync15(
-    join18(skillDir, SKILL_ENVELOPE_JSON_NAME),
+  writeFileSync16(skillMdPath, skillMdContent);
+  writeFileSync16(
+    join19(skillDir, SKILL_ENVELOPE_JSON_NAME),
     JSON.stringify(signedEnvelope, null, 2) + "\n"
   );
   return { envelope: signedEnvelope, manifest: signedManifest, body };
@@ -122461,8 +123082,8 @@ async function handleSkillsPublish(config) {
   }
   const auxFiles = collectAuxFiles2(skillDir);
   const filesPayload = {};
-  for (const [path19, bytes] of Object.entries(auxFiles)) {
-    filesPayload[path19] = bytesToBase64(bytes);
+  for (const [path20, bytes] of Object.entries(auxFiles)) {
+    filesPayload[path20] = bytesToBase64(bytes);
   }
   const submission = {
     envelope,
@@ -122508,8 +123129,8 @@ async function handleSkillsPublish(config) {
 init_esm_shims();
 init_dist34();
 init_dist6();
-import * as fs17 from "fs";
-import * as path17 from "path";
+import * as fs18 from "fs";
+import * as path18 from "path";
 function tryParseJson(text) {
   try {
     return JSON.parse(text);
@@ -122520,7 +123141,7 @@ function tryParseJson(text) {
 function readJsonFile(filePath) {
   let raw;
   try {
-    raw = fs17.readFileSync(filePath, "utf-8");
+    raw = fs18.readFileSync(filePath, "utf-8");
   } catch {
     return { ok: false, error: "file not found" };
   }
@@ -122553,10 +123174,10 @@ function extractSubjectMotebitId(vc) {
   return typeof subject.id === "string" ? subject.id : null;
 }
 async function handleVerify(filePath) {
-  const resolved = path17.resolve(filePath);
+  const resolved = path18.resolve(filePath);
   let stat;
   try {
-    stat = fs17.statSync(resolved);
+    stat = fs18.statSync(resolved);
   } catch {
     console.error(`Error: path does not exist: ${resolved}`);
     process.exit(1);
@@ -122581,7 +123202,7 @@ async function handleVerify(filePath) {
 async function verifySingleIdentityFile(filePath) {
   let content;
   try {
-    content = fs17.readFileSync(filePath, "utf-8");
+    content = fs18.readFileSync(filePath, "utf-8");
   } catch {
     console.error(`Error: cannot read file: ${filePath}`);
     process.exit(1);
@@ -122674,16 +123295,16 @@ Verifying ${data.length} credential${data.length !== 1 ? "s" : ""}...
 }
 async function verifyBundle(dirPath) {
   console.log(`
-Verifying ${path17.basename(dirPath)}/...
+Verifying ${path18.basename(dirPath)}/...
 `);
   let passed = true;
   let motebitId = null;
   let identityDid = null;
-  const identityPath = path17.join(dirPath, "motebit.md");
-  if (fs17.existsSync(identityPath)) {
+  const identityPath = path18.join(dirPath, "motebit.md");
+  if (fs18.existsSync(identityPath)) {
     let content;
     try {
-      content = fs17.readFileSync(identityPath, "utf-8");
+      content = fs18.readFileSync(identityPath, "utf-8");
     } catch {
       console.log(`  Identity (motebit.md):     FAILED \u2014 cannot read file`);
       passed = false;
@@ -122705,9 +123326,9 @@ Verifying ${path17.basename(dirPath)}/...
   } else {
     console.log(`  Identity (motebit.md):     not found, skipping`);
   }
-  const credsPath = path17.join(dirPath, "credentials.json");
+  const credsPath = path18.join(dirPath, "credentials.json");
   const credentials = [];
-  if (fs17.existsSync(credsPath)) {
+  if (fs18.existsSync(credsPath)) {
     const credResult = readJsonFile(credsPath);
     if (!credResult.ok) {
       console.log(`  Credentials:               FAILED \u2014 ${credResult.error}`);
@@ -122750,8 +123371,8 @@ Verifying ${path17.basename(dirPath)}/...
   } else {
     console.log(`  Credentials:               not found, skipping`);
   }
-  const vpPath = path17.join(dirPath, "presentation.json");
-  if (fs17.existsSync(vpPath)) {
+  const vpPath = path18.join(dirPath, "presentation.json");
+  if (fs18.existsSync(vpPath)) {
     const vpResult = readJsonFile(vpPath);
     if (!vpResult.ok) {
       console.log(`  Presentation:              FAILED \u2014 ${vpResult.error}`);
@@ -122800,8 +123421,8 @@ Verifying ${path17.basename(dirPath)}/...
       passed = false;
     }
   }
-  const budgetPath = path17.join(dirPath, "budget.json");
-  if (fs17.existsSync(budgetPath)) {
+  const budgetPath = path18.join(dirPath, "budget.json");
+  if (fs18.existsSync(budgetPath)) {
     const budgetResult = readJsonFile(budgetPath);
     if (!budgetResult.ok) {
       console.log(`  Budget:                    FAILED \u2014 ${budgetResult.error}`);
@@ -122823,8 +123444,8 @@ Verifying ${path17.basename(dirPath)}/...
   } else {
     console.log(`  Budget:                    not found, skipping`);
   }
-  const gradientPath = path17.join(dirPath, "gradient.json");
-  if (fs17.existsSync(gradientPath)) {
+  const gradientPath = path18.join(dirPath, "gradient.json");
+  if (fs18.existsSync(gradientPath)) {
     const gradientResult = readJsonFile(gradientPath);
     if (!gradientResult.ok) {
       console.log(`  Gradient:                  FAILED \u2014 ${gradientResult.error}`);
@@ -122851,7 +123472,7 @@ init_esm_shims();
 init_dist6();
 init_dist31();
 init_colors();
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { resolve as resolve12 } from "path";
 var KIND_KEYWORDS = /* @__PURE__ */ new Set(["receipt", "token", "listing"]);
 function isVerifyKind(s3) {
@@ -122862,7 +123483,7 @@ async function verifyWire(kind, filePath, now = Date.now()) {
   const absPath = resolve12(filePath);
   let raw;
   try {
-    const text = readFileSync15(absPath, "utf-8");
+    const text = readFileSync16(absPath, "utf-8");
     raw = JSON.parse(text);
     checks.push({ name: "json", ok: true, detail: `parsed ${text.length} bytes` });
   } catch (err2) {
@@ -122986,7 +123607,7 @@ async function handleVerifyWire(kindArg, pathArg, opts) {
 // src/subcommands/verify-release.ts
 init_esm_shims();
 import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 init_config2();
 init_config2();
 async function handleVerifyRelease(options = {}) {
@@ -123000,7 +123621,7 @@ async function handleVerifyRelease(options = {}) {
   }
   let selfHash;
   try {
-    selfHash = createHash3("sha256").update(readFileSync16(bundlePath)).digest("hex");
+    selfHash = createHash3("sha256").update(readFileSync17(bundlePath)).digest("hex");
   } catch (err2) {
     console.error(
       `verify-release: cannot read own bytes at ${bundlePath}: ${err2 instanceof Error ? err2.message : String(err2)}`
@@ -123065,8 +123686,8 @@ init_dist22();
 init_dist2();
 init_dist6();
 init_dist34();
-import * as fs18 from "fs";
-import * as path18 from "path";
+import * as fs19 from "fs";
+import * as path19 from "path";
 init_dist10();
 init_dist13();
 
@@ -123958,10 +124579,10 @@ async function publishServiceListing(syncUrl, motebitId, headers, toolNames, pri
 }
 async function handleRun(config) {
   const explicitIdentity = config.identity != null && config.identity !== "";
-  const identityPath = explicitIdentity ? path18.resolve(config.identity) : path18.resolve("motebit.md");
+  const identityPath = explicitIdentity ? path19.resolve(config.identity) : path19.resolve("motebit.md");
   let identityContent;
   try {
-    identityContent = fs18.readFileSync(identityPath, "utf-8");
+    identityContent = fs19.readFileSync(identityPath, "utf-8");
   } catch {
     if (explicitIdentity) {
       console.error(`Error: cannot read identity file: ${identityPath}`);
@@ -124075,7 +124696,7 @@ async function handleRun(config) {
   if (watchedYaml != null) {
     console.log(`Watching ${watchedYaml} \u2014 changes will re-apply automatically.`);
     try {
-      fs18.watch(watchedYaml, () => {
+      fs19.watch(watchedYaml, () => {
         if (yamlDebounce) clearTimeout(yamlDebounce);
         yamlDebounce = setTimeout(() => {
           void (async () => {
@@ -124555,10 +125176,10 @@ async function handleServe(config) {
   let guardianAttestation;
   let policyOverrides = {};
   if (config.identity != null && config.identity !== "") {
-    const identityPath = path18.resolve(config.identity);
+    const identityPath = path19.resolve(config.identity);
     let identityContent;
     try {
-      identityContent = fs18.readFileSync(identityPath, "utf-8");
+      identityContent = fs19.readFileSync(identityPath, "utf-8");
     } catch {
       console.error(`Error: cannot read identity file: ${identityPath}`);
       process.exit(1);
@@ -124623,7 +125244,7 @@ async function handleServe(config) {
   const runtimeHostServer = election.server;
   if (config.tools) {
     const { pathToFileURL } = await import("url");
-    const resolved = path18.resolve(config.tools);
+    const resolved = path19.resolve(config.tools);
     const mod2 = await import(pathToFileURL(resolved).href);
     const entries = mod2.default ?? mod2.tools;
     if (!Array.isArray(entries)) {
@@ -124863,7 +125484,7 @@ async function handleServe(config) {
   }
   if (config.identity != null && config.identity !== "") {
     try {
-      deps.identityFileContent = fs18.readFileSync(path18.resolve(config.identity), "utf-8");
+      deps.identityFileContent = fs19.readFileSync(path19.resolve(config.identity), "utf-8");
     } catch {
     }
   }
@@ -125140,7 +125761,7 @@ init_esm_shims();
 import { spawn } from "child_process";
 import { mkdtemp, writeFile as writeFile3, unlink } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // ../../packages/voice/dist/index.js
 init_esm_shims();
@@ -125416,22 +126037,22 @@ var SystemTTSProvider = class {
   }
 };
 async function writeTempMp3(buf) {
-  const dir = await mkdtemp(join20(tmpdir(), "motebit-tts-"));
-  const path19 = join20(dir, "out.mp3");
-  await writeFile3(path19, buf);
-  return path19;
+  const dir = await mkdtemp(join21(tmpdir(), "motebit-tts-"));
+  const path20 = join21(dir, "out.mp3");
+  await writeFile3(path20, buf);
+  return path20;
 }
-function mp3PlayerCommand(path19) {
-  if (process.platform === "darwin") return { bin: "afplay", args: [path19] };
-  return { bin: "mpg123", args: ["-q", path19] };
+function mp3PlayerCommand(path20) {
+  if (process.platform === "darwin") return { bin: "afplay", args: [path20] };
+  return { bin: "mpg123", args: ["-q", path20] };
 }
 function systemSpeakCommand() {
   if (process.platform === "darwin") return { bin: "say", args: [] };
   if (process.platform === "linux") return { bin: "espeak", args: [] };
   return null;
 }
-function playMp3(path19, onSpawn) {
-  const cmd = mp3PlayerCommand(path19);
+function playMp3(path20, onSpawn) {
+  const cmd = mp3PlayerCommand(path20);
   if (!cmd) {
     return Promise.reject(new Error(`No MP3 player available on ${process.platform}`));
   }
@@ -125812,12 +126433,16 @@ async function main() {
     const validProviders = ["anthropic", "openai", "google", "local-server", "proxy"];
     if (validProviders.includes(personalityConfig.default_provider)) {
       config.provider = personalityConfig.default_provider;
+      if (!config.modelExplicit) {
+        config.model = defaultModelForProvider(config.provider);
+      }
     }
   }
   if (personalityConfig.default_model != null && personalityConfig.default_model !== "" && !process.argv.includes("--model")) {
     if (admitModelForProvider(config.provider, personalityConfig.default_model).admissible) {
       config.model = personalityConfig.default_model;
     } else {
+      config.model = defaultModelForProvider(config.provider);
       console.log(
         dim(
           `  [config default_model "${personalityConfig.default_model}" belongs to another provider; using ${config.model} for ${config.provider}]`
@@ -125983,13 +126608,13 @@ async function main() {
       runtimeRef
     });
   } catch (err2) {
+    destroyTerminal();
     console.error(
       `Runtime-host election failed: ${err2 instanceof Error ? err2.message : String(err2)}`
     );
     console.error(
       "Another motebit process may be coordinating with an incompatible build. Stop it and retry."
     );
-    destroyTerminal();
     process.exit(1);
   }
   if (election.role === "frontend") {
@@ -126165,7 +126790,8 @@ async function main() {
     moteDb.close();
   };
   process.on("SIGINT", () => {
-    console.log("\nGoodbye!");
+    destroyTerminal();
+    console.log("Goodbye!");
     void shutdown().then(() => process.exit(0));
   });
   const toolCount = toolRegistry.size;
@@ -126184,6 +126810,18 @@ async function main() {
     console.log(dim("  recovery seed not backed up \u2014 `motebit seed reveal` (once, on paper)"));
     console.log();
   }
+  if (process.env["MOTEBIT_NO_UPDATE_CHECK"] !== "1") {
+    const updateNudge = renderUpdateNudge({ currentVersion: VERSION, state: readUpdateState() });
+    if (updateNudge != null) {
+      console.log(dim(`  ${updateNudge}`));
+      console.log();
+    }
+    refreshUpdateCheckInBackground();
+  }
+  if (runtime.moneyToolsWithheld) {
+    console.log(dim(`  ${MONEY_TOOLS_WITHHELD_NOTICE}`));
+    console.log();
+  }
   if (isFirstLaunch) {
     try {
       const activationRunId = crypto.randomUUID();
@@ -126249,6 +126887,15 @@ async function main() {
     const bareSlash = resolveBareCommand(trimmed);
     const effective = bareSlash ?? trimmed;
     if (bareSlash != null) console.log(dim(`  \u2192 ${bareSlash}`));
+    if (bareSlash == null) {
+      const shellTeach = detectShellInvocation(trimmed);
+      if (shellTeach != null) {
+        console.log(dim(shellTeach));
+        console.log();
+        prompt2();
+        return;
+      }
+    }
     if (isSlashCommand(effective)) {
       const { command: command2, args } = parseSlashCommand(effective);
       await handleSlashCommand(command2, args, runtime, config, fullConfig, {