sanook-cli 0.5.2 → 0.5.5

package/dist/bin.js

@@ -18,7 +18,7 @@ import { hasContinueAnyRequest, hasContinueRequest, hasResumeRequest, hasServeCo
 const useColor = !process.env.NO_COLOR && (Boolean(process.env.FORCE_COLOR) || process.stdout.isTTY === true);
 const DIM = useColor ? '\x1b[2m' : '';
 const RESET = useColor ? '\x1b[0m' : '';
-async function runHeadless(model, prompt, budgetUsd, maxSteps, json, history, planMode = false, permissionMode = 'ask', quiet = false, fallbackModel) {
+async function runHeadless(model, prompt, budgetUsd, maxSteps, json, history, planMode = false, permissionMode = 'ask', quiet = false, fallbackModel, planHandoffTask) {
     const controller = new AbortController();
     process.on('SIGINT', () => {
         controller.abort();
@@ -59,6 +59,10 @@ async function runHeadless(model, prompt, budgetUsd, maxSteps, json, history, pl
             process.stdout.write(`\n${DIM}${cost.summary()}${RESET}\n`);
         else if (quiet)
             process.stdout.write('\n');
+        if (planMode && planHandoffTask && !json && !quiet) {
+            const { formatPlanExecuteHandoff } = await import('./plan-handoff.js');
+            process.stderr.write(`\n${DIM}${formatPlanExecuteHandoff(planHandoffTask)}${RESET}\n`);
+        }
         // จำ session ไว้ทำงานต่อได้ (sanook --continue "...") — แก้ concern AI ลืมว่าทำถึงไหน
         const now = new Date().toISOString();
         await saveSession({ id: newSessionId(), created: now, updated: now, model, cwd: process.cwd(), messages });
@@ -68,6 +72,16 @@ async function runHeadless(model, prompt, budgetUsd, maxSteps, json, history, pl
         if (brain) {
             await appendBrainWorklog(brain, { prompt, summary: cost.summary(), model, today: now.slice(0, 10) }).catch(() => { });
         }
+        // opt-in (experimental, default OFF): auto-distill durable decisions/gotchas/preferences from this
+        // session into the compounding memory store so the self-retrieving brain surfaces them next time.
+        // Off by default per experiment H5 — extraction is high-precision (~0.88) but end-to-end recall is
+        // gated by retrieval quality (semantic helps). Enable with SANOOK_AUTO_DISTILL=1.
+        if (envFlag('SANOOK_AUTO_DISTILL')) {
+            const { distilledFactsFromMessages } = await import('./session-distill.js');
+            const { appendMemory } = await import('./memory.js');
+            for (const fact of distilledFactsFromMessages(messages))
+                await appendMemory(fact).catch(() => { });
+        }
     }
     catch (err) {
         const msg = redactKey(err.message);
@@ -78,6 +92,28 @@ async function runHeadless(model, prompt, budgetUsd, maxSteps, json, history, pl
         process.exit(1);
     }
 }
+/** sanook plan "<task>" — read-only plan mode; stderr prints execute handoff after success */
+async function runPlan(args) {
+    const parsed = parseArgs(args);
+    if (parsed.budgetInvalid)
+        process.stderr.write(`${BRAND.cliName}: ⚠ --budget ไม่ถูกต้อง (ต้องเป็นจำนวนบวก) — รันต่อโดยไม่มี spend cap\n`);
+    const resumeSession = await requestedResumeSession(args, parsed.resume);
+    const budgetUsd = Number.isFinite(parsed.budget) ? parsed.budget : undefined;
+    const piped = process.stdin.isTTY ? '' : (await readStdin()).trim();
+    const prompt = piped ? `${parsed.prompt}\n\n<stdin>\n${piped}\n</stdin>`.trim() : parsed.prompt;
+    if (!prompt) {
+        console.error(`ใช้: ${BRAND.cliName} plan "<task>" [--json] [-m model]`);
+        process.exit(1);
+    }
+    const config = await loadConfig({ model: parsed.model ?? resumeSession?.model, budgetUsd });
+    const noKey = headlessKeyHint(config.model);
+    if (noKey) {
+        process.stderr.write(`${noKey}\n`);
+        process.exit(1);
+    }
+    const history = resumeSession?.messages ?? (await requestedContinuationHistory(args));
+    await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, parsed.json, history, true, 'ask', parsed.quiet, config.fallbackModel, prompt);
+}
 // อ่านจาก package.json (single source of truth) — กัน version constant drift
 const PACKAGE = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 const VERSION = PACKAGE.version;
@@ -86,15 +122,19 @@ const HELP = `${BRAND.productName} — a terminal AI coding agent (BYOK)
 
 usage:
   ${BRAND.cliName} "<task>"            run one task (headless)
+  ${BRAND.cliName} plan "<task>"       plan-only (read-only) + execute handoff hint on stderr
   ${BRAND.cliName} -z "<task>"         one-shot final output (script-friendly)
   ${BRAND.cliName} chat -q "<query>"   direct one-shot query
   ${BRAND.cliName}                     interactive REPL
   ${BRAND.cliName} setup [section]      setup wizard (model | gateway | tools | agent | brain)
+  ${BRAND.cliName} dashboard [--port]   Sanook Dashboard (local web admin UI)
   ${BRAND.cliName} model                choose provider + model
   ${BRAND.cliName} --json "<task>"     headless, JSONL output (for CI/scripts)
   ${BRAND.cliName} sessions             list/resume-audit saved conversation sessions
   ${BRAND.cliName} insights             local usage/session insights
   ${BRAND.cliName} dump [--show-keys]   support snapshot (secrets redacted)
+  ${BRAND.cliName} prompt-size [--json]  inspect prompt/context budget without calling a model
+  ${BRAND.cliName} runtimes [--json]     inspect optional Python/Rust runtime surface
   ${BRAND.cliName} update              update ${BRAND.cliName} to the latest npm release
   ${BRAND.cliName} doctor              ตรวจการติดตั้ง + วิธีแก้ PATH (เมื่อพิมพ์ "${BRAND.cliName}" แล้วไม่เจอ)
 
@@ -119,6 +159,7 @@ gateway (อยู่ยาว 24/7 — HTTP loopback + cron):
   ${BRAND.cliName} gateway start [--port 8787]     เปิด gateway เป็น background process
   ${BRAND.cliName} gateway stop|restart|install    จัดการ gateway service
   ${BRAND.cliName} gateway status                  ดู config/status gateway
+  ${BRAND.cliName} gateway doctor                  ตรวจ token/webhook/allowlist ของ channels ที่ตั้งไว้
   ${BRAND.cliName} send --to telegram|discord|slack|mattermost|homeassistant|email|line|sms|ntfy|signal|whatsapp|matrix|googlechat|bluebubbles|teams[:target] "msg" ส่งข้อความออก platform โดยไม่เรียก LLM
   ${BRAND.cliName} webhook subscribe <route> [--prompt "..."] [--to telegram|slack|mattermost|homeassistant|sms|ntfy|signal|whatsapp|matrix|googlechat|bluebubbles|teams]
                                            รับ event จาก GitHub/GitLab/Jira/Stripe แล้ว trigger agent/delivery
@@ -131,21 +172,36 @@ gateway (อยู่ยาว 24/7 — HTTP loopback + cron):
 
 skills (built-in + ติดตั้งเพิ่มได้):
   ${BRAND.cliName} skill list                     ดู skill ทั้งหมด
+  ${BRAND.cliName} skill install <name|path>      ติดตั้ง skill จาก bundled catalog / local path
   ${BRAND.cliName} skill add <user/repo|url|path> ติดตั้ง skill จาก GitHub / URL / local
   ${BRAND.cliName} skill remove <name>            ลบ skill ที่ติดตั้ง
   ${BRAND.cliName} models [provider]              ดู/verify model id (เทียบ provider จริงถ้ามี key)
 
+project setup:
+  ${BRAND.cliName} init [--trust]                 scaffold .sanook/commands + onboarding hints
+
 second brain (Obsidian workspace สำหรับจัดเก็บงาน + ความจำ AI):
   ${BRAND.cliName} brain init [path]              สร้างโครงสร้าง second-brain ที่ path (ไม่ใส่ = ถาม)
   ${BRAND.cliName} brain doctor                   ตรวจ health ของ second-brain ที่ config.brainPath
-  ${BRAND.cliName} brain context [--task "..."]    แสดง context ที่ Sanook จะ inject + retrieval hits ต่อ task
+  ${BRAND.cliName} brain context [--task "..."] [--project <slug>]  แสดง context ที่ Sanook จะ inject (+ project auto-detect จาก cwd)
+  ${BRAND.cliName} brain projects list            แสดง Projects/<slug>/ + repo_path mapping
   ${BRAND.cliName} brain eval                     รัน second-brain benchmark sanity checks
   ${BRAND.cliName} brain review                   curator review: inbox, packs, sessions, evals, note hygiene
+  ${BRAND.cliName} brain pack list|show <name>    ดู context packs ใน Shared/Context-Packs/
+  ${BRAND.cliName} brain new project [--title "..."] [--repo /path] [--verify "..."]  scaffold Projects/<slug>/ workspace
+  ${BRAND.cliName} brain repair [--dry-run]       แก้ one-line fixes หลัง doctor/review
+  ${BRAND.cliName} brain consolidate [--apply]      sleep-time consolidation (inbox, stale, retrieval; dry-run default)
+  ${BRAND.cliName} brain metrics [--no-retrieval] vault counts, stale notes, index freshness, retrieval coverage
   ${BRAND.cliName} brain final --task "..."        สร้าง final gate note ใน Sessions พร้อม evidence scaffold
 
 search (BM25 + optional BYOK semantic เหนือ vault + memory + sessions + skills):
   ${BRAND.cliName} index                          (re)index vault+memory แบบ incremental (O(delta))
   ${BRAND.cliName} search "<query>" [--mode auto|fts|semantic|hybrid] [--limit N] [--source vault,memory]
+  ${BRAND.cliName} web status [--json] [--probe]  ตรวจ true web/search readiness ผ่าน MCP (local search ไม่ใช่ internet)
+  ${BRAND.cliName} web doctor [--json]             probe web/search/fetch MCP candidates
+  ${BRAND.cliName} web fetch <url> [--json]        ดึงหน้าเว็บสาธารณะ + สรุปโครงสร้าง (fallback ladder ที่ถูกกติกา)
+  ${BRAND.cliName} web search "<q>" [--limit N]    ค้นเว็บผ่าน Tavily (ต้องมี TAVILY_API_KEY)
+  ${BRAND.cliName} web setup tavily [--api-key K]  ตั้งค่า Tavily (เขียน MCP + เก็บ key 0600)
   ${BRAND.cliName} mcp serve                       expose brain เป็น MCP server (stdio) ให้ Claude Desktop/Cursor
 
 config & mcp:
@@ -153,10 +209,14 @@ config & mcp:
   ${BRAND.cliName} auth [list|status|add|remove]  จัดการ API keys ของ providers (BYOK, redacted)
   ${BRAND.cliName} sessions [list|latest|show|rm] จัดการ saved sessions
   ${BRAND.cliName} insights [--days N] [--all]    ดู usage/session insights ในเครื่อง
+  ${BRAND.cliName} memory [stats|log "<q>"]       ดู memory: สถิติ + วิวัฒนาการของ belief (เคยเชื่ออะไร ถูก supersede ตอนไหน)
   ${BRAND.cliName} dump [--show-keys]             diagnostic/support dump แบบไม่โชว์ raw secret
+  ${BRAND.cliName} prompt-size [--json]            ดู system prompt / skills / brain / tools token budget แบบ offline
+  ${BRAND.cliName} runtimes [--json]               ดู Python/Rust optional runtime + บทบาทใน Sanook
+  ${BRAND.cliName} web status [--json]             ดู web-search/fetch readiness และ grounding policy
   ${BRAND.cliName} tools                          ดู tool surface ที่ agent ใช้ได้
   ${BRAND.cliName} config [get|set <k> <v>]       ดู/แก้ ${appHomePath('config.json')} (model/budgetUsd/permissionMode/cacheTtl/compaction/contextCompression/thinking/embeddingModel)
-  ${BRAND.cliName} mcp [search|info|install|test|doctor|preset|list|add|remove]   จัดการ MCP servers
+  ${BRAND.cliName} mcp [search|info|install|test|doctor|enable|disable|preset|list|add|remove]   จัดการ MCP servers
   ${BRAND.cliName} trust [status|add|remove]      อนุญาต/ยกเลิก project .sanook mcp/hooks/skills/commands
 
 flags:
@@ -183,6 +243,10 @@ async function runServe(args) {
         console.error(`port ไม่ถูกต้อง: ${parsed.portError}`);
         process.exit(1);
     }
+    if (parsed.modelError) {
+        console.error(`model ไม่ถูกต้อง: ${parsed.modelError}`);
+        process.exit(1);
+    }
     const config = await loadConfig({ model: parsed.model });
     const { startGateway } = await import('./gateway/serve.js');
     process.stdout.write(`${DIM}${BRAND.productName} gateway — model: ${config.model}${RESET}\n`);
@@ -215,6 +279,35 @@ async function startModelSetup() {
         },
     });
 }
+async function runDashboard(args = []) {
+    let port = 9119;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--port' && args[i + 1]) {
+            port = Number(args[++i]);
+            if (!Number.isFinite(port) || port <= 0) {
+                console.error(`${BRAND.cliName}: --port ต้องเป็นจำนวนบวก`);
+                process.exit(1);
+            }
+        }
+        else if (args[i] === '-h' || args[i] === '--help') {
+            console.log(`ใช้: ${BRAND.cliName} dashboard [--port 9119]`);
+            console.log('เปิด Sanook Dashboard (local web UI — Hermes-style admin panel)');
+            return;
+        }
+    }
+    const { startDashboardServer } = await import('./dashboard/server.js');
+    const stop = await startDashboardServer({
+        port,
+        onLog: (m) => console.log(m),
+    });
+    const shutdown = () => {
+        stop();
+        process.stdout.write('\n[dashboard] stopped\n');
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
 async function runTools(_args = []) {
     const { tools } = await import('./tools/index.js');
     const names = Object.keys(tools).sort();
@@ -222,6 +315,207 @@ async function runTools(_args = []) {
     console.log(names.map((n) => `  ${n}`).join('\n'));
     console.log(`\nจัดการ MCP เพิ่มเติม: ${BRAND.cliName} mcp add <name> <command> [args...]`);
 }
+async function runPromptSize(args = []) {
+    const allowed = new Set(['--json']);
+    const unknown = args.find((arg) => !allowed.has(arg));
+    if (unknown) {
+        console.error(`ไม่รู้จัก option: ${unknown}`);
+        console.error(`ใช้: ${BRAND.cliName} prompt-size [--json]`);
+        process.exit(1);
+    }
+    const { buildPromptSizeBreakdown, renderPromptSizeBreakdown } = await import('./prompt-size.js');
+    const report = await buildPromptSizeBreakdown();
+    if (args.includes('--json'))
+        console.log(JSON.stringify(report, null, 2));
+    else
+        process.stdout.write(renderPromptSizeBreakdown(report));
+}
+async function runRuntimes(args = []) {
+    const allowed = new Set(['--json']);
+    const unknown = args.find((arg) => !allowed.has(arg));
+    if (unknown) {
+        console.error(`ไม่รู้จัก option: ${unknown}`);
+        console.error(`ใช้: ${BRAND.cliName} runtimes [--json]`);
+        process.exit(1);
+    }
+    const { inspectPolyglotRuntimes, renderPolyglotReport } = await import('./polyglot.js');
+    const report = await inspectPolyglotRuntimes();
+    if (args.includes('--json'))
+        console.log(JSON.stringify(report, null, 2));
+    else
+        process.stdout.write(renderPolyglotReport(report));
+}
+async function runWeb(args = []) {
+    const action = args[0] && !args[0].startsWith('--') ? args[0] : 'status';
+    const rest = action === args[0] ? args.slice(1) : args;
+    if (action === 'fetch')
+        return runWebFetch(rest);
+    if (action === 'search')
+        return runWebSearch(rest);
+    if (action === 'setup')
+        return runWebSetup(rest);
+    const flags = rest;
+    const allowed = new Set(['--json', '--probe']);
+    const unknown = flags.find((arg) => !allowed.has(arg));
+    if (!['status', 'doctor'].includes(action) || unknown) {
+        if (unknown)
+            console.error(`ไม่รู้จัก option: ${unknown}`);
+        console.error(`ใช้: ${BRAND.cliName} web status [--json] [--probe]`);
+        console.error(`     ${BRAND.cliName} web doctor [--json]`);
+        console.error(`     ${BRAND.cliName} web fetch <url> [--json] [--no-reader] [--no-archive] [--no-robots] [--allow-private]`);
+        console.error(`     ${BRAND.cliName} web search "<query>" [--json] [--limit N]`);
+        console.error(`     ${BRAND.cliName} web setup tavily [--api-key <key>]`);
+        process.exit(1);
+    }
+    const { inspectWebSurface, renderWebSurfaceReport } = await import('./web-surface.js');
+    const report = await inspectWebSurface({ cwd: process.cwd(), probe: action === 'doctor' || flags.includes('--probe') });
+    if (flags.includes('--json'))
+        console.log(JSON.stringify(report, null, 2));
+    else
+        process.stdout.write(renderWebSurfaceReport(report));
+    if (action === 'doctor' && report.webCandidates.some((candidate) => candidate.probe && !candidate.probe.ok))
+        process.exit(1);
+}
+/** TAVILY_API_KEY from env first, then any MCP server env in ~/.sanook/mcp.json. */
+async function resolveTavilyKey() {
+    const fromEnv = process.env.TAVILY_API_KEY?.trim();
+    if (fromEnv)
+        return fromEnv;
+    try {
+        const { loadMcpConfig } = await import('./mcp.js');
+        const cfg = await loadMcpConfig();
+        for (const server of Object.values(cfg)) {
+            const key = server.env?.TAVILY_API_KEY?.trim();
+            if (key)
+                return key;
+        }
+    }
+    catch {
+        /* no mcp config */
+    }
+    return undefined;
+}
+async function runWebFetch(args) {
+    const url = args.find((a) => !a.startsWith('--'));
+    if (!url) {
+        console.error(`ใช้: ${BRAND.cliName} web fetch <url> [--json] [--no-reader] [--no-archive] [--no-robots] [--allow-private]`);
+        process.exit(1);
+    }
+    const { fetchWeb, renderWebFetchResult } = await import('./web-fetch.js');
+    const result = await fetchWeb(url, {
+        allowReader: !args.includes('--no-reader'),
+        allowArchive: !args.includes('--no-archive'),
+        respectRobots: !args.includes('--no-robots'),
+        allowPrivateHosts: args.includes('--allow-private'),
+        tavilyApiKey: await resolveTavilyKey(),
+    });
+    if (args.includes('--json'))
+        console.log(JSON.stringify(result, null, 2));
+    else
+        process.stdout.write(`${renderWebFetchResult(result)}\n`);
+    if (!result.ok)
+        process.exit(1);
+}
+async function runWebSearch(args) {
+    let limit = 5;
+    const terms = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--json')
+            continue;
+        if (a === '--limit') {
+            limit = Number(args[++i]) || limit;
+            continue;
+        }
+        if (a.startsWith('--limit=')) {
+            limit = Number(a.slice('--limit='.length)) || limit;
+            continue;
+        }
+        if (a.startsWith('--'))
+            continue;
+        terms.push(a);
+    }
+    const query = terms.join(' ').trim();
+    if (!query) {
+        console.error(`ใช้: ${BRAND.cliName} web search "<query>" [--json] [--limit N]`);
+        process.exit(1);
+    }
+    const apiKey = await resolveTavilyKey();
+    if (!apiKey) {
+        console.error(`web search ต้องมี Tavily API key — ตั้งค่า: ${BRAND.cliName} web setup tavily`);
+        process.exit(1);
+    }
+    const { tavilySearch } = await import('./web-fetch.js');
+    try {
+        const hits = await tavilySearch(query, { apiKey, maxResults: Math.min(Math.max(limit, 1), 20) });
+        if (args.includes('--json')) {
+            console.log(JSON.stringify(hits, null, 2));
+            return;
+        }
+        if (!hits.length) {
+            console.log('(no results)');
+            return;
+        }
+        for (const h of hits)
+            console.log(`- ${h.title}\n  ${h.url}\n  ${h.content.slice(0, 200)}`);
+    }
+    catch (e) {
+        console.error(`web search ล้มเหลว: ${e.message}`);
+        process.exit(1);
+    }
+}
+async function runWebSetup(args) {
+    const provider = args.find((a) => !a.startsWith('--'));
+    if (provider !== 'tavily') {
+        console.error(`ใช้: ${BRAND.cliName} web setup tavily [--api-key <key>]`);
+        process.exit(1);
+    }
+    let apiKey = (argValue(args, '--api-key') ?? process.env.TAVILY_API_KEY ?? '').trim();
+    if (!apiKey)
+        apiKey = (await askText('Tavily API key (tvly-...): ')).trim();
+    if (!apiKey) {
+        console.error('ต้องระบุ Tavily API key');
+        process.exit(1);
+    }
+    const mcpPath = appHomePath('mcp.json');
+    let cfg;
+    try {
+        const parsed = JSON.parse(await readFile(mcpPath, 'utf8'));
+        cfg = { mcpServers: parsed.mcpServers ?? {} };
+    }
+    catch {
+        cfg = { mcpServers: {} };
+    }
+    cfg.mcpServers.tavily = { command: 'npx', args: ['-y', 'tavily-mcp'], env: { TAVILY_API_KEY: apiKey } };
+    await mkdir(dirname(mcpPath), { recursive: true });
+    await writeFile(mcpPath, `${JSON.stringify(cfg, null, 2)}\n`, { mode: 0o600 });
+    await chmod(mcpPath, 0o600).catch(() => { });
+    console.log(`ตั้งค่า Tavily แล้ว → ${mcpPath} (chmod 600; key เก็บแบบ env ไม่ echo ออกจอ)`);
+    console.log(`  • agent runtime ใช้ผ่าน MCP "tavily" (search/extract)`);
+    console.log(`  • ${BRAND.cliName} web fetch <url> และ ${BRAND.cliName} web search "<q>" จะหยิบ key นี้อัตโนมัติ`);
+    console.log(`ทดสอบ: ${BRAND.cliName} mcp test tavily`);
+}
+/** sanook memory [log "<query>" | stats] — read-only view over the bi-temporal memory store */
+async function runMemory(args = []) {
+    const action = args[0] && !args[0].startsWith('--') ? args[0] : undefined;
+    const rest = action ? args.slice(1) : args;
+    const json = args.includes('--json');
+    const { loadStore } = await import('./memory-store.js');
+    const { memoryLog, renderMemoryLog, memoryStats, renderMemoryStats } = await import('./memory-log.js');
+    const store = await loadStore();
+    if (action === 'log') {
+        const query = rest.filter((a) => !a.startsWith('--')).join(' ').trim();
+        const entries = memoryLog(store, query);
+        if (json)
+            console.log(JSON.stringify(entries, null, 2));
+        else
+            process.stdout.write(`${renderMemoryLog(entries, query)}\n`);
+        return;
+    }
+    // default + `stats`: overview of what's remembered (active / superseded / archived)
+    const stats = memoryStats(store);
+    console.log(json ? JSON.stringify(stats, null, 2) : renderMemoryStats(stats));
+}
 async function runAgentSetupSummary() {
     const cfg = await loadConfig({});
     console.log(`${BRAND.productName} agent settings`);
@@ -239,6 +533,13 @@ async function runAgentSetupSummary() {
     console.log(`  ${BRAND.cliName} config set budgetUsd 0.25`);
     console.log(`  ${BRAND.cliName} config set fallbackModel haiku`);
 }
+async function runGatewayDoctor() {
+    const { checkGateway, formatGatewayDoctorReport } = await import('./gateway/doctor.js');
+    const report = await checkGateway();
+    console.log(formatGatewayDoctorReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
 async function runGatewayStatus() {
     const { readGatewayConfig, redactGatewayConfig, resolveBlueBubblesConfig, resolveDiscordConfig, resolveEmailConfig, resolveGoogleChatConfig, resolveHomeAssistantConfig, resolveLineConfig, resolveMattermostConfig, resolveMatrixConfig, resolveNtfyConfig, resolveSignalConfig, resolveSlackConfig, resolveSmsConfig, resolveTelegramConfig, resolveTeamsConfig, resolveWhatsAppConfig, resolveWebhookConfig, gatewayConfigPath, } = await import('./gateway/config.js');
     const cfg = await readGatewayConfig();
@@ -415,6 +716,31 @@ async function runGatewayStatus() {
         console.log(`    public url:      ${webhooks.publicUrl ?? '(not set)'}`);
         console.log(`    rate limit:      ${webhooks.rateLimitPerMinute}/minute`);
     }
+    const { checkGateway, formatGatewayDoctorStatus, listPendingCronJobs, listRecentDeliveryFailures, summarizeChannelHealth, } = await import('./gateway/doctor.js');
+    const pendingCron = await listPendingCronJobs();
+    console.log(`\ncron (pending): ${pendingCron.length}`);
+    if (pendingCron.length) {
+        for (const task of pendingCron.slice(0, 10)) {
+            const when = new Date(task.runAt).toISOString();
+            const deliver = task.deliver ? ` → ${task.deliver}` : '';
+            console.log(`  ${task.id}  ${when}  ${task.schedule ?? 'once'}  ${task.spec.slice(0, 60)}${deliver}`);
+        }
+        if (pendingCron.length > 10)
+            console.log(`  … และอีก ${pendingCron.length - 10} งาน`);
+    }
+    const deliveryFailures = await listRecentDeliveryFailures(5);
+    console.log(`\ndelivery failures (recent): ${deliveryFailures.length ? deliveryFailures.length : 'none'}`);
+    for (const failure of deliveryFailures) {
+        const when = failure.lastRun ? new Date(failure.lastRun).toISOString() : '(unknown)';
+        console.log(`  ${failure.taskId}  ${when}  ${failure.deliver}  ${failure.error.slice(0, 120)}`);
+    }
+    const healthReport = await checkGateway({ config: cfg, skipNetwork: true });
+    const health = summarizeChannelHealth(healthReport.checks).filter((item) => item.status !== 'skip');
+    console.log(`\nchannel health (config): ${health.length ? '' : 'no configured channels'}`);
+    for (const item of health) {
+        console.log(`  ${item.channel.padEnd(12)} ${formatGatewayDoctorStatus(item.status)}`);
+    }
+    console.log(`  (live token/webhook probes: ${BRAND.cliName} gateway doctor)`);
     console.log(`\nredacted config:\n${JSON.stringify(redactGatewayConfig(cfg), null, 2)}`);
 }
 async function runGatewaySetup(args) {
@@ -1604,6 +1930,8 @@ async function runGateway(args) {
     const [action, ...rest] = args;
     if (!action || action === 'status' || action === 'list')
         return runGatewayStatus();
+    if (action === 'doctor')
+        return runGatewayDoctor();
     if (action === 'setup')
         return runGatewaySetup(rest);
     if (action === 'run') {
@@ -1651,7 +1979,7 @@ async function runGateway(args) {
         console.log(removed.length ? `ลบ service files:\n${removed.map((p) => `  ${p}`).join('\n')}` : 'ไม่พบ service file ที่ต้องลบ');
         return;
     }
-    console.error(`ไม่รู้จัก: gateway ${action} — ใช้ setup / run / start / stop / restart / install / status`);
+    console.error(`ไม่รู้จัก: gateway ${action} — ใช้ setup / run / start / stop / restart / install / doctor / status`);
     process.exit(1);
 }
 async function runStatus() {
@@ -2308,7 +2636,7 @@ providers: ${providerIds()}`);
         process.exit(1);
     }
     const history = resumeSession?.messages ?? (await requestedContinuationHistory(args));
-    await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, parsed.json, history, parsed.planMode, parsed.yes || yolo ? 'auto' : safeMode ? 'ask' : config.permissionMode, parsed.quiet, config.fallbackModel);
+    await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, parsed.json, history, parsed.planMode, parsed.yes || yolo ? 'auto' : safeMode ? 'ask' : config.permissionMode, parsed.quiet, config.fallbackModel, parsed.planMode ? prompt : undefined);
 }
 async function runPureOneShot(args) {
     const rest = args;
@@ -2328,7 +2656,7 @@ async function runPureOneShot(args) {
         process.exit(1);
     }
     const history = resumeSession?.messages ?? (await requestedContinuationHistory(rest));
-    await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, parsed.json, history, parsed.planMode, parsed.yes ? 'auto' : config.permissionMode, true, config.fallbackModel);
+    await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, parsed.json, history, parsed.planMode, parsed.yes ? 'auto' : config.permissionMode, true, config.fallbackModel, parsed.planMode ? prompt : undefined);
 }
 async function runSend(args) {
     const json = args.includes('--json');
@@ -2686,19 +3014,31 @@ async function runCron(args) {
     console.error(`ไม่รู้จัก: cron ${action} — ใช้ add / list / rm`);
     process.exit(1);
 }
-/** sanook skill list | add <source> | remove <name> */
+/** sanook init [--trust] — scaffold project .sanook/commands + onboarding hints */
+async function runInit(args) {
+    const trust = args.includes('--trust');
+    const unknown = args.filter((a) => a !== '--trust');
+    if (unknown.length) {
+        console.error(`ใช้: ${BRAND.cliName} init [--trust]`);
+        process.exit(1);
+    }
+    const { initProject, formatInitResult } = await import('./project-init.js');
+    const result = await initProject({ trust });
+    console.log(formatInitResult(result));
+}
+/** sanook skill list | install <name|path> | add <source> | remove <name> */
 async function runSkill(args) {
     const [action, ...rest] = args;
-    if (action === 'add') {
+    if (action === 'add' || action === 'install') {
         const source = rest[0];
         if (!source) {
-            console.error('ใช้: sanook skill add <github "user/repo" | URL ของ SKILL.md | local path>');
+            console.error(`ใช้: ${BRAND.cliName} skill install <bundled-name|path> หรือ ${BRAND.cliName} skill add <github "user/repo" | URL ของ SKILL.md | local path>`);
             process.exit(1);
         }
         console.error(`${DIM}⚠ skill = instruction ที่ AI จะทำตาม — ติดตั้งจาก source ที่เชื่อถือเท่านั้น${RESET}`);
-        const { installSkill } = await import('./skill-install.js');
+        const { installNamedSkill } = await import('./skill-install.js');
         try {
-            const installed = await installSkill(source, (m) => process.stderr.write(`${DIM}${m}${RESET}\n`));
+            const installed = await installNamedSkill(source, (m) => process.stderr.write(`${DIM}${m}${RESET}\n`));
             console.log(`ติดตั้ง ${installed.length} skill: ${installed.map((s) => s.name).join(', ')}`);
         }
         catch (e) {
@@ -2793,13 +3133,15 @@ async function runBrainContext(args) {
     const parsed = parseBrainContextArgs(args);
     if (!parsed.ok) {
         console.error(parsed.message);
-        console.error(`ใช้: ${BRAND.cliName} brain context [--task "..."] [--mode auto|fts|semantic|hybrid] [--limit N] [--source vault,session,skill] [--no-content]`);
+        console.error(`ใช้: ${BRAND.cliName} brain context [--task "..."] [--project <slug>] [--mode auto|fts|semantic|hybrid] [--limit N] [--source vault,session,skill] [--no-content]`);
         process.exit(1);
     }
     const cfg = await loadConfig({});
     const report = await inspectBrainContext({
         brainPath: cfg.brainPath,
         task: parsed.value.task,
+        cwd: process.cwd(),
+        projectSlug: parsed.value.project,
         mode: parsed.value.mode,
         limit: parsed.value.limit,
         sources: parsed.value.sources,
@@ -2842,6 +3184,130 @@ async function runBrainReview(args) {
     if (!report.ok)
         process.exit(1);
 }
+/** sanook brain consolidate [--apply] [--archive] [--memory] — sleep-time consolidation runner */
+async function runBrainConsolidate(args) {
+    const { parseBrainConsolidateArgs, runBrainConsolidate: consolidate, formatBrainConsolidateReport } = await import('./brain-consolidate.js');
+    const parsed = parseBrainConsolidateArgs(args);
+    if (!parsed.ok) {
+        console.error(parsed.message);
+        console.error(`ใช้: ${BRAND.cliName} brain consolidate [--apply] [--apply --archive] [--memory] [--no-retrieval]`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    const report = await consolidate({
+        brainPath: cfg.brainPath,
+        apply: parsed.value.apply,
+        archive: parsed.value.archive,
+        memory: parsed.value.memory,
+        runRetrieval: parsed.value.runRetrieval,
+    });
+    console.log(formatBrainConsolidateReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
+/** sanook brain metrics [--no-retrieval] — vault counts, stale notes, index + retrieval coverage */
+async function runBrainMetrics(args) {
+    const allowed = new Set(['--no-retrieval']);
+    const unknown = args.filter((arg) => !allowed.has(arg));
+    if (unknown.length) {
+        console.error(`ไม่รู้จัก option: ${unknown.join(' ')}`);
+        console.error(`ใช้: ${BRAND.cliName} brain metrics [--no-retrieval]`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    const { collectBrainMetrics, formatBrainMetricsReport } = await import('./brain-metrics.js');
+    const report = await collectBrainMetrics({ brainPath: cfg.brainPath, runRetrievalEval: !args.includes('--no-retrieval') });
+    console.log(formatBrainMetricsReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
+/** sanook brain projects list — show vault project workspaces and repo_path mappings */
+async function runBrainProjects(args) {
+    if (args[0] && args[0] !== 'list') {
+        console.error(`ใช้: ${BRAND.cliName} brain projects list`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    if (!cfg.brainPath) {
+        console.error('ยังไม่ได้ตั้ง brainPath — รัน `sanook brain init [path]` ก่อน');
+        process.exit(1);
+    }
+    const { listVaultProjects, formatVaultProjectLine, resolveVaultProject } = await import('./project-registry.js');
+    const projects = await listVaultProjects(cfg.brainPath);
+    const active = await resolveVaultProject({ brainPath: cfg.brainPath, cwd: process.cwd() });
+    console.log(`${BRAND.productName} brain projects`);
+    console.log(`vault: ${cfg.brainPath}`);
+    console.log(`cwd: ${process.cwd()}${active ? ` → active: ${active.slug}` : ''}`);
+    if (!projects.length) {
+        console.log('(no project workspaces — run `sanook brain new project --title "..." --repo /path`)');
+        return;
+    }
+    console.log('\nslug             repo_path');
+    for (const project of projects) {
+        const marker = active?.slug === project.slug ? ' *' : '';
+        console.log(`${formatVaultProjectLine(project)}${marker}`);
+    }
+}
+/** sanook brain pack list|show <name> — inspect Shared/Context-Packs/ bundles */
+async function runBrainPack(args) {
+    const { parseBrainPackArgs, listContextPacks, showContextPack, formatBrainPackListReport, formatBrainPackShowReport } = await import('./brain-pack.js');
+    const parsed = parseBrainPackArgs(args);
+    if (!parsed.ok) {
+        console.error(parsed.message);
+        console.error(`ใช้: ${BRAND.cliName} brain pack list | ${BRAND.cliName} brain pack show <name>`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    if (!cfg.brainPath) {
+        console.error('ยังไม่ได้ตั้ง brainPath — รัน `sanook brain init [path]` ก่อน');
+        process.exit(1);
+    }
+    if (parsed.action === 'list') {
+        const report = await listContextPacks(cfg.brainPath);
+        console.log(formatBrainPackListReport(report));
+        if (!report.ok)
+            process.exit(1);
+        return;
+    }
+    const report = await showContextPack(cfg.brainPath, parsed.name);
+    console.log(formatBrainPackShowReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
+/** sanook brain new <type> [--title "..."] — template-backed note creation in the correct vault folder */
+async function runBrainNew(args) {
+    const { parseBrainNewArgs, createBrainNote, formatBrainNewReport } = await import('./brain-new.js');
+    const parsed = parseBrainNewArgs(args);
+    if (!parsed.ok) {
+        console.error(parsed.message);
+        console.error(`ใช้: ${BRAND.cliName} brain new <session|bug|handoff|project|golden-case|checklist> [--title "..."] [--repo /path] [--verify "..."] [--output path] [--force]`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    const report = await createBrainNote({
+        brainPath: cfg.brainPath,
+        today: new Date().toISOString().slice(0, 10),
+        ...parsed.value,
+    });
+    console.log(formatBrainNewReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
+/** sanook brain repair [--dry-run] — apply safe one-line fixes after doctor/review findings */
+async function runBrainRepair(args) {
+    const { parseBrainRepairArgs, repairBrain, formatBrainRepairReport } = await import('./brain-repair.js');
+    const parsed = parseBrainRepairArgs(args);
+    if (!parsed.ok) {
+        console.error(parsed.message);
+        console.error(`ใช้: ${BRAND.cliName} brain repair [--dry-run]`);
+        process.exit(1);
+    }
+    const cfg = await loadConfig({});
+    const report = await repairBrain({ brainPath: cfg.brainPath, dryRun: parsed.dryRun });
+    console.log(formatBrainRepairReport(report));
+    if (!report.ok)
+        process.exit(1);
+}
 /** sanook brain final [--task "..."] [--from-diff] [--lite] — create an evidence-backed closeout note */
 async function runBrainFinal(args) {
     const { parseBrainFinalArgs, createBrainFinal, formatBrainFinalReport } = await import('./brain-final.js');
@@ -2871,16 +3337,39 @@ async function runBrain(args) {
         return runBrainEval(args.slice(1));
     if (args[0] === 'review')
         return runBrainReview(args.slice(1));
+    if (args[0] === 'projects')
+        return runBrainProjects(args.slice(1));
+    if (args[0] === 'pack')
+        return runBrainPack(args.slice(1));
+    if (args[0] === 'new')
+        return runBrainNew(args.slice(1));
+    if (args[0] === 'repair')
+        return runBrainRepair(args.slice(1));
+    if (args[0] === 'consolidate')
+        return runBrainConsolidate(args.slice(1));
+    if (args[0] === 'metrics')
+        return runBrainMetrics(args.slice(1));
     if (args[0] === 'final')
         return runBrainFinal(args.slice(1));
     if (args[0] !== 'init') {
         console.log(`ใช้:
   sanook brain init [path]   สร้างโครงสร้าง second-brain (Obsidian vault)
   sanook brain doctor        ตรวจ health ของ second-brain ที่ config.brainPath
-  sanook brain context       แสดง context ที่ Sanook จะ inject
+  sanook brain context       แสดง context ที่ Sanook จะ inject (project auto-detect จาก cwd)
   sanook brain context --task "..."  ดู retrieval hits ต่อ task
+  sanook brain context --project <slug>  บังคับ project workspace
+  sanook brain projects list  แสดง Projects/<slug>/ + repo_path
   sanook brain eval          รัน second-brain benchmark sanity checks
   sanook brain review        curator review: inbox, packs, sessions, evals, note hygiene
+  sanook brain pack list     แสดง context packs ใน Shared/Context-Packs/
+  sanook brain pack show <name>  แสดง load order / done criteria ของ pack
+  sanook brain new project --title "..." --repo /path [--verify "..."]
+  sanook brain new <type> [--title "..."]  สร้างโน้ตจาก template
+  sanook brain repair [--dry-run]  แก้ one-line fixes หลัง doctor/review
+  sanook brain consolidate [--apply] [--apply --archive] [--memory]
+                            sleep-time consolidation (dry-run default)
+  sanook brain metrics [--no-retrieval]
+                            vault counts, stale notes, index freshness, retrieval coverage
   sanook brain final --task "..." [--from-diff] [--lite]
                             สร้าง final gate note ใน Sessions
 
@@ -2898,7 +3387,9 @@ async function runBrain(args) {
         return;
     }
     const { scaffoldBrain, BRAIN_DEFAULTS, expandHome, wireBrainMcp } = await import('./brain.js');
-    const target = expandHome(pathArg ?? join(homedir(), 'Documents', BRAIN_DEFAULTS.vaultName));
+    // resolve to absolute before persisting — getBrainPath() is later read from an arbitrary cwd,
+    // so a relative path (e.g. "./vault") would resolve differently per run
+    const target = resolve(expandHome(pathArg ?? join(homedir(), 'Documents', BRAIN_DEFAULTS.vaultName)));
     const today = new Date().toISOString().slice(0, 10);
     try {
         const res = await scaffoldBrain(target, { ...BRAIN_DEFAULTS, today });
@@ -2985,11 +3476,16 @@ async function runConfig(args) {
             console.error('contextCompression ต้องเป็น off, selective หรือ headroom');
             process.exit(1);
         }
+        else if (key === 'brainPath') {
+            // store absolute — getBrainPath() is read from arbitrary cwd, so a relative path drifts
+            const { expandHome } = await import('./brain.js');
+            value = resolve(expandHome(raw.trim()));
+        }
         else if (key === 'thinking') {
             // เก็บเป็น number (budget) หรือ boolean ให้ตรง ConfigSchema (ไม่เก็บ string)
             value = parseThinkingConfigValue(raw);
             if (value === undefined) {
-                console.error('thinking ต้องเป็น on/off หรือ budget tokens (integer บวก เช่น 4000)');
+                console.error('thinking ต้องเป็น on/off, true/false, yes/no หรือ budget tokens (integer บวก เช่น 4000)');
                 process.exit(1);
             }
         }
@@ -3065,7 +3561,7 @@ async function runMcpServe() {
     const { runMcpServer } = await import('./mcp-server.js');
     await runMcpServer();
 }
-/** sanook mcp [search|info|install|test|doctor|list|add|remove] — จัดการ ~/.sanook/mcp.json */
+/** sanook mcp [search|info|install|test|doctor|enable|disable|list|add|remove] — จัดการ ~/.sanook/mcp.json */
 async function runMcp(args) {
     const readConfig = async (path) => {
         try {
@@ -3132,34 +3628,22 @@ async function runMcp(args) {
         return;
     }
     if (action === 'install') {
-        const { buildMcpInstallPlan, getMcpRegistryServer, parseKeyValueList, formatRegistryInfo, } = await import('./mcp-registry.js');
-        const name = positionals(rest, new Set(['--name', '--transport', '--env', '--header', '--version']))[0];
-        if (!name) {
-            console.error(`ใช้: ${BRAND.cliName} mcp install <registry-server-name> [--name alias] [--transport auto|remote|stdio] [--env KEY=value] [--header KEY=value] [--project]`);
+        const { buildMcpInstallPlan, getMcpRegistryServer, parseKeyValueList, formatRegistryInfo, parseMcpRegistryInstallArgs, } = await import('./mcp-registry.js');
+        const parsedInstall = parseMcpRegistryInstallArgs(rest);
+        if (!parsedInstall.ok) {
+            console.error(parsedInstall.message);
             process.exit(1);
         }
-        const optionValues = (flag) => {
-            const out = [];
-            for (let i = 0; i < rest.length; i++) {
-                if (rest[i] === flag && rest[i + 1])
-                    out.push(rest[++i]);
-                else if (rest[i].startsWith(`${flag}=`))
-                    out.push(rest[i].slice(flag.length + 1));
-            }
-            return out;
-        };
-        const valueOf = (flag) => optionValues(flag)[0];
-        const alias = valueOf('--name');
+        const { name, alias, transport, version, env, headers, project } = parsedInstall.value;
         if (alias && !isValidMcpServerName(alias)) {
             console.error('ชื่อ MCP server ต้องเป็น a-z/A-Z/0-9/_/- ความยาวไม่เกิน 64 และห้ามใช้ชื่อพิเศษ');
             process.exit(1);
         }
-        const transport = valueOf('--transport');
         if (transport && !['auto', 'remote', 'stdio'].includes(transport)) {
             console.error('--transport ต้องเป็น auto, remote, หรือ stdio');
             process.exit(1);
         }
-        const server = await getMcpRegistryServer(name, { version: valueOf('--version') });
+        const server = await getMcpRegistryServer(name, { version });
         if (!server) {
             console.error(`ไม่เจอ MCP registry server: ${name}`);
             process.exit(1);
@@ -3167,8 +3651,8 @@ async function runMcp(args) {
         const plan = buildMcpInstallPlan(server, {
             alias,
             transport,
-            env: parseKeyValueList(optionValues('--env')),
-            headers: parseKeyValueList(optionValues('--header')),
+            env: parseKeyValueList(env),
+            headers: parseKeyValueList(headers),
         });
         if (!plan.ok) {
             console.log(formatRegistryInfo(server));
@@ -3182,20 +3666,25 @@ async function runMcp(args) {
             process.exit(1);
         }
         let targetPath = mcpPath;
-        if (rest.includes('--project')) {
-            const { projectConfigPathIfTrusted, projectRoot } = await import('./trust.js');
+        if (project) {
+            // Use trust status (not projectConfigPathIfTrusted, which requires a PRE-EXISTING file) so the
+            // FIRST project-scoped install into a trusted project can create .sanook/mcp.json.
+            const { projectTrustStatus, projectRoot } = await import('./trust.js');
+            const { appProjectPath } = await import('./brand.js');
             const root = await projectRoot(process.cwd());
-            const projectPath = await projectConfigPathIfTrusted('mcp.json', root);
-            if (!projectPath) {
+            const trust = await projectTrustStatus(root);
+            if (!trust.trusted) {
                 console.error(`project MCP ต้อง trust ก่อน: ${BRAND.cliName} trust add`);
                 process.exit(1);
             }
-            targetPath = projectPath;
+            targetPath = appProjectPath(root, 'mcp.json'); // may not exist yet — writeConfig creates it
         }
         cfg = await readConfig(targetPath);
         cfg.mcpServers[plan.alias] = plan.config;
         await writeConfig(targetPath, cfg);
         console.log(`ติดตั้ง MCP "${plan.alias}" จาก ${server.name} (${plan.source}) → ${targetPath}`);
+        const { inferRegistryServerRisk, formatMcpRiskLabel } = await import('./mcp-risk.js');
+        console.log(`risk: ${formatMcpRiskLabel(inferRegistryServerRisk(server))}`);
         if (plan.requirements.length)
             console.log(`requirements: ${plan.requirements.join(', ')}`);
         for (const warning of plan.warnings)
@@ -3204,10 +3693,16 @@ async function runMcp(args) {
         return;
     }
     if (action === 'test' || action === 'doctor') {
-        const { loadMcpConfig, probeMcpServer } = await import('./mcp.js');
+        const { loadMcpConfig, probeMcpServer, isMcpServerEnabled } = await import('./mcp.js');
+        const { inferConfiguredServerRisk, formatMcpRiskLabel } = await import('./mcp-risk.js');
         const logs = [];
         const merged = await loadMcpConfig((m) => logs.push(m));
-        const names = action === 'test' && rest[0] ? [rest[0]] : Object.keys(merged);
+        const explicitName = action === 'test' && rest[0] ? rest[0] : undefined;
+        const names = explicitName
+            ? [explicitName]
+            : action === 'test'
+                ? Object.keys(merged).filter((n) => isMcpServerEnabled(merged[n]))
+                : Object.keys(merged);
         if (!names.length) {
             console.log(`ยังไม่มี MCP server — เพิ่ม: ${BRAND.cliName} mcp search github`);
             return;
@@ -3223,9 +3718,14 @@ async function runMcp(args) {
                 console.log(`[FAIL] ${n} — ไม่เจอใน config`);
                 continue;
             }
+            if (!explicitName && action === 'doctor' && !isMcpServerEnabled(server)) {
+                console.log(`[SKIP] ${n} (disabled)`);
+                continue;
+            }
             const probe = await probeMcpServer(server);
+            const risk = formatMcpRiskLabel(inferConfiguredServerRisk(n, server, probe.tools));
             if (probe.ok) {
-                console.log(`[PASS] ${n} (${probe.transport}) — ${probe.tools.length} tool(s)`);
+                console.log(`[PASS] ${n} (${probe.transport}) — ${probe.tools.length} tool(s) · risk: ${risk}`);
                 for (const tool of probe.tools.slice(0, action === 'doctor' ? 8 : 30))
                     console.log(`       - ${tool.name}${tool.description ? ` — ${tool.description}` : ''}`);
                 if (action === 'doctor' && probe.tools.length > 8)
@@ -3233,13 +3733,39 @@ async function runMcp(args) {
             }
             else {
                 failed = true;
-                console.log(`[FAIL] ${n} (${probe.transport}) — ${probe.error}`);
+                console.log(`[FAIL] ${n} (${probe.transport}) — ${probe.error} · risk: ${risk}`);
+                if (probe.authHints?.length)
+                    for (const hint of probe.authHints)
+                        console.log(`       hint: ${hint}`);
             }
         }
         if (failed)
             process.exit(1);
         return;
     }
+    if (action === 'enable' || action === 'disable') {
+        const { findMcpServerConfigPath } = await import('./mcp.js');
+        const [name] = rest;
+        if (!name) {
+            console.error(`ใช้: ${BRAND.cliName} mcp ${action} <name>`);
+            process.exit(1);
+        }
+        const targetPath = await findMcpServerConfigPath(name);
+        if (!targetPath) {
+            console.error(`ไม่เจอ MCP server "${name}" ใน global หรือ trusted project config`);
+            process.exit(1);
+        }
+        const targetCfg = await readConfig(targetPath);
+        if (!targetCfg.mcpServers[name]) {
+            console.error(`ไม่เจอ MCP server "${name}" ใน ${targetPath}`);
+            process.exit(1);
+        }
+        targetCfg.mcpServers[name] = { ...targetCfg.mcpServers[name], enabled: action === 'enable' };
+        await writeConfig(targetPath, targetCfg);
+        console.log(`${action === 'enable' ? 'เปิด' : 'ปิด'} MCP server "${name}" แล้ว → ${targetPath}`);
+        console.log(`ทดสอบ: ${BRAND.cliName} mcp test ${name}`);
+        return;
+    }
     if (action === 'add') {
         const [name, command, ...cmdArgs] = rest;
         if (!name || !command) {
@@ -3269,10 +3795,11 @@ async function runMcp(args) {
         return;
     }
     if (action !== 'list') {
-        console.log(`ใช้: ${BRAND.cliName} mcp [search|info|install|test|doctor|preset|list|add|remove|serve]`);
+        console.log(`ใช้: ${BRAND.cliName} mcp [search|info|install|test|doctor|enable|disable|preset|list|add|remove|serve]`);
         return;
     }
-    const { loadMcpConfig } = await import('./mcp.js');
+    const { loadMcpConfig, isMcpServerEnabled } = await import('./mcp.js');
+    const { inferConfiguredServerRisk, formatMcpRiskLabel } = await import('./mcp-risk.js');
     const logs = [];
     const merged = await loadMcpConfig((m) => logs.push(m));
     const names = Object.keys(merged);
@@ -3286,13 +3813,23 @@ async function runMcp(args) {
     console.log(`${names.length} MCP servers:`);
     for (const n of names) {
         const s = merged[n];
-        console.log(`  ${n}  —  ${s.url ? `${s.url} (http)` : `${s.command} ${(s.args ?? []).join(' ')}`}`);
+        const enabled = isMcpServerEnabled(s);
+        const risk = formatMcpRiskLabel(inferConfiguredServerRisk(n, s));
+        console.log(`  ${n}${enabled ? '' : ' (disabled)'}  —  risk: ${risk}  —  ${s.url ? `${s.url} (http)` : `${s.command} ${(s.args ?? []).join(' ')}`}`);
     }
     if (rest.includes('--tools')) {
         const { probeMcpServer } = await import('./mcp.js');
         for (const n of names) {
+            if (!isMcpServerEnabled(merged[n])) {
+                console.log(`\n[SKIP] ${n} tools (disabled)`);
+                continue;
+            }
             const probe = await probeMcpServer(merged[n]);
-            console.log(`\n${probe.ok ? '[PASS]' : '[FAIL]'} ${n} tools${probe.ok ? ` (${probe.tools.length})` : ` — ${probe.error}`}`);
+            const risk = formatMcpRiskLabel(inferConfiguredServerRisk(n, merged[n], probe.tools));
+            console.log(`\n${probe.ok ? '[PASS]' : '[FAIL]'} ${n} tools${probe.ok ? ` (${probe.tools.length})` : ` — ${probe.error}`} · risk: ${risk}`);
+            if (probe.authHints?.length)
+                for (const hint of probe.authHints)
+                    console.log(`  hint: ${hint}`);
             for (const tool of probe.tools.slice(0, 30))
                 console.log(`  - ${tool.name}`);
         }
@@ -3505,11 +4042,15 @@ async function main() {
         process.exit(1);
     }
     const argv = process.argv.slice(2);
-    if (argv.length === 1 && (argv[0] === '-v' || argv[0] === '--version')) {
+    // --version/--help win in ANY position before `--` (so `sanook --help foo`, `-m x -h` work),
+    // not only as the sole argument. (Quoted prompts like `sanook "explain --help"` are one token → unaffected.)
+    const optArgsEnd = argv.indexOf('--');
+    const topOpts = optArgsEnd === -1 ? argv : argv.slice(0, optArgsEnd);
+    if (topOpts.includes('-v') || topOpts.includes('--version')) {
         console.log(VERSION);
         return;
     }
-    if (argv.length === 1 && (argv[0] === '-h' || argv[0] === '--help')) {
+    if (topOpts.includes('-h') || topOpts.includes('--help')) {
         console.log(HELP);
         return;
     }
@@ -3529,6 +4070,8 @@ async function main() {
         return runPureOneShot(argv.slice(1));
     if (argv[0] === 'chat')
         return runChat(argv.slice(1));
+    if (argv[0] === 'plan')
+        return runPlan(argv.slice(1));
     if (argv[0] === 'setup')
         return runSetup(argv.slice(1));
     if (argv[0] === 'model' && (argv.length === 1 || argv[1].startsWith('--')))
@@ -3543,8 +4086,19 @@ async function main() {
         return runSessions(argv.slice(1));
     if (argv[0] === 'insights')
         return runInsights(argv.slice(1));
+    if (argv[0] === 'memory' && ['log', 'stats', undefined].includes(argv[1]))
+        return runMemory(argv.slice(1));
     if (argv[0] === 'dump')
         return runDump(argv.slice(1));
+    if (argv[0] === 'prompt-size' && (argv.length === 1 || argv[1].startsWith('--')))
+        return runPromptSize(argv.slice(1));
+    if (argv[0] === 'runtimes' && (argv.length === 1 || argv[1].startsWith('--')))
+        return runRuntimes(argv.slice(1));
+    if (argv[0] === 'dashboard' && (argv.length === 1 || !argv[1].startsWith('-') || argv[1] === '--port')) {
+        return runDashboard(argv.slice(1));
+    }
+    if (argv[0] === 'web' && ['status', 'doctor', 'fetch', 'search', 'setup', undefined].includes(argv[1]))
+        return runWeb(argv.slice(1));
     if (argv[0] === 'tools' && (argv.length === 1 || argv[1].startsWith('--')))
         return runTools(argv.slice(1));
     if (argv[0] === 'send')
@@ -3557,12 +4111,15 @@ async function main() {
     if (argv[0] === 'cron' && ['add', 'list', 'rm', 'remove', undefined].includes(argv[1])) {
         return runCron(argv.slice(1));
     }
-    if (argv[0] === 'skill' && ['list', 'add', 'remove', 'rm', undefined].includes(argv[1])) {
+    if (argv[0] === 'skill' && ['list', 'add', 'install', 'remove', 'rm', undefined].includes(argv[1])) {
         return runSkill(argv.slice(1));
     }
+    if (argv[0] === 'init' && (argv.length === 1 || argv[1].startsWith('-')))
+        return runInit(argv.slice(1));
     if (argv[0] === 'models')
         return runModels(argv.slice(1));
-    if (argv[0] === 'brain' && ['init', 'doctor', 'context', 'eval', 'review', 'final', undefined].includes(argv[1]))
+    if (argv[0] === 'brain' &&
+        ['init', 'doctor', 'context', 'eval', 'review', 'projects', 'pack', 'new', 'repair', 'consolidate', 'metrics', 'final', undefined].includes(argv[1]))
         return runBrain(argv.slice(1));
     if (argv[0] === 'config' && ['get', 'set', 'list', undefined].includes(argv[1]))
         return runConfig(argv.slice(1));
@@ -3572,11 +4129,21 @@ async function main() {
         return runSearch(argv.slice(1));
     if (argv[0] === 'mcp' && argv[1] === 'serve')
         return runMcpServe();
-    if (argv[0] === 'mcp' && ['add', 'list', 'remove', 'rm', 'search', 'info', 'install', 'test', 'doctor', 'preset', undefined].includes(argv[1]))
+    if (argv[0] === 'mcp' && ['add', 'list', 'remove', 'rm', 'search', 'info', 'install', 'test', 'doctor', 'enable', 'disable', 'preset', undefined].includes(argv[1]))
         return runMcp(argv.slice(1));
     if (argv[0] === 'trust' && ['status', 'add', 'remove', 'rm', undefined].includes(argv[1]))
         return runTrust(argv.slice(1));
-    const { model, budget, json, quiet, prompt: argPrompt, planMode, yes, resume } = parseArgs(argv);
+    // A management command word whose subcommand didn't match any route above → don't silently
+    // fall through and run it as an LLM task (costly + confusing). These words intentionally
+    // require a valid subcommand; an NL prompt starting with one can still be quoted as a single arg.
+    const MANAGEMENT_WORDS = new Set(['config', 'mcp', 'brain', 'web', 'trust', 'cron', 'skill', 'init', 'dashboard']);
+    if (argv[0] && MANAGEMENT_WORDS.has(argv[0]) && argv[1] && !argv[1].startsWith('-')) {
+        console.error(`${BRAND.cliName}: ไม่รู้จัก subcommand "${argv[0]} ${argv[1]}" — ดูวิธีใช้: ${BRAND.cliName} --help`);
+        process.exit(1);
+    }
+    const { model, budget, budgetInvalid, json, quiet, prompt: argPrompt, planMode, yes, resume } = parseArgs(argv);
+    if (budgetInvalid)
+        process.stderr.write(`${BRAND.cliName}: ⚠ --budget ไม่ถูกต้อง (ต้องเป็นจำนวนบวก) — รันต่อโดยไม่มี spend cap\n`);
     const resumeSession = await requestedResumeSession(argv, resume);
     const budgetUsd = Number.isFinite(budget) ? budget : undefined;
     // stdin piping: `git diff | sanook "review this"` → ผนวก stdin เข้า prompt (headless/CI)
@@ -3592,7 +4159,7 @@ async function main() {
         }
         // --continue / -c → โหลด session ล่าสุดมาต่อ (จำว่าทำถึงไหน)
         const history = resumeSession?.messages ?? (await requestedContinuationHistory(argv));
-        await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, json, history, planMode, yes ? 'auto' : config.permissionMode, quiet, config.fallbackModel);
+        await runHeadless(config.model, prompt, config.budgetUsd, config.maxSteps, json, history, planMode, yes ? 'auto' : config.permissionMode, quiet, config.fallbackModel, planMode ? prompt : undefined);
         return;
     }
     await maybePromptForInteractiveUpdate();