skillwiki 0.10.105 → 0.10.107

package/dist/{chunk-XYXTV2YD.js → chunk-DTTKCCQ4.js}

@@ -3,11 +3,11 @@ import {
   ROOT_INDEX_SECTION_ORDER,
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-KDH352MC.js";
+} from "./chunk-HMHMCPCE.js";
 import {
   err,
   ok
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-QM64LUEY.js → chunk-GJC2CI3W.js}

@@ -161,6 +161,7 @@ var TypedKnowledgeSchema = z.object({
   }
 });
 var sha256Hex = z.string().regex(/^[0-9a-f]{64}$/);
+var identityToken = z.string().min(1).max(128).regex(/^[a-zA-Z0-9_.-]+$/, "must be bounded alphanumeric token with _.-");
 var RawSourceSchema = z.object({
   title: z.string().min(1).optional(),
   source_url: z.string().nullable(),
@@ -170,7 +171,10 @@ var RawSourceSchema = z.object({
   sha256: sha256Hex.optional(),
   project: wikilink.optional(),
   work_item: wikilink.optional(),
-  kind: z.enum(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]).optional()
+  kind: z.enum(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]).optional(),
+  host: identityToken.optional(),
+  agent_role: identityToken.optional(),
+  agent_id: identityToken.optional()
 }).superRefine((v, ctx) => {
   if (v.work_item !== void 0 && (v.project === void 0 || v.kind === void 0)) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "project and kind are required when work_item is set" });
@@ -201,6 +205,9 @@ var WorkItemSchema = z.object({
   parent: wikilink.optional(),
   related: z.array(wikilink).optional(),
   sources: z.array(z.string()).optional(),
+  host: identityToken.optional(),
+  agent_role: identityToken.optional(),
+  agent_id: identityToken.optional(),
   post_release_verification: PostReleaseVerificationSchema.optional()
 }).superRefine((v, ctx) => {
   if (v.status === "completed" && !v.completed) {

package/dist/{chunk-KDH352MC.js → chunk-HMHMCPCE.js}

@@ -8,7 +8,7 @@ import {
   ok,
   scanSensitiveContent,
   scanVault
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/utils/atomic-write.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-F5GFUYPF.js → chunk-JCDAEZVD.js}

@@ -6,7 +6,7 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/{chunk-PVIOU7BN.js → chunk-PGD3J2GE.js}

@@ -2,7 +2,7 @@
 import {
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-KDH352MC.js";
+} from "./chunk-HMHMCPCE.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -22,7 +22,7 @@ import {
   resolveExistingRegularFileInsideVault,
   stripFencedBlocks,
   writeLogEvent
-} from "./chunk-F5GFUYPF.js";
+} from "./chunk-JCDAEZVD.js";
 import {
   ExitCode,
   FleetManifestSchema,
@@ -41,7 +41,7 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/utils/managed-write-preflight.ts
 import { existsSync as existsSync11 } from "fs";

package/dist/{chunk-H42EY6E7.js → chunk-QU2IXZRN.js}

@@ -8,7 +8,7 @@ import {
   readLogEvents,
   resolveExistingRegularFileInsideVault,
   writeLogEvent
-} from "./chunk-F5GFUYPF.js";
+} from "./chunk-JCDAEZVD.js";
 import {
   ExitCode,
   RawSourceSchema,
@@ -19,7 +19,7 @@ import {
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/commands/sources.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/{chunk-2BPOEEMW.js → chunk-Z4NCF6K6.js}

@@ -6,7 +6,7 @@ import {
 import {
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-XYXTV2YD.js";
+} from "./chunk-DTTKCCQ4.js";
 import {
   CONFIG_KEYS,
   VAULT_HYGIENE_GENERATED_COMMIT_PATHS,
@@ -40,11 +40,11 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-PVIOU7BN.js";
+} from "./chunk-PGD3J2GE.js";
 import {
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-KDH352MC.js";
+} from "./chunk-HMHMCPCE.js";
 import {
   applySourceCompileClaim,
   applySourceCompilePublished,
@@ -57,11 +57,11 @@ import {
   planSourceCompileRelease,
   planSourceReview,
   runSourcesPending
-} from "./chunk-H42EY6E7.js";
+} from "./chunk-QU2IXZRN.js";
 import {
   eventPathFor,
   writeLogEvent
-} from "./chunk-F5GFUYPF.js";
+} from "./chunk-JCDAEZVD.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -82,7 +82,7 @@ import {
   scanVault,
   splitFrontmatter,
   systemdPropertyFor
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/commands/log-append.ts
 import { readFile, stat } from "fs/promises";
@@ -6606,7 +6606,7 @@ async function runQuery(input) {
   }
   let pendingSources;
   if (input.includePending) {
-    const { runSourcesPending: runSourcesPending2 } = await import("./sources-OSGKH6KN.js");
+    const { runSourcesPending: runSourcesPending2 } = await import("./sources-QTQSZMST.js");
     const pending = await runSourcesPending2({
       vault: input.vault,
       match: input.text,

package/dist/cli.js

@@ -63,7 +63,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-2BPOEEMW.js";
+} from "./chunk-Z4NCF6K6.js";
 import {
   normalizeDistTag,
   readCache,
@@ -76,7 +76,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-XYXTV2YD.js";
+} from "./chunk-DTTKCCQ4.js";
 import {
   FLEET_REL_PATH,
   REDACTED_MALFORMED_REFERENCE,
@@ -168,12 +168,12 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-PVIOU7BN.js";
+} from "./chunk-PGD3J2GE.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-KDH352MC.js";
+} from "./chunk-HMHMCPCE.js";
 import {
   applySourceDisposition,
   decodeSourceActionApproval,
@@ -181,7 +181,7 @@ import {
   inventorySources,
   planSourceDisposition,
   runSourcesPending
-} from "./chunk-H42EY6E7.js";
+} from "./chunk-QU2IXZRN.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -198,7 +198,7 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-F5GFUYPF.js";
+} from "./chunk-JCDAEZVD.js";
 import {
   ExitCode,
   MetaSchema,
@@ -219,7 +219,7 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-QM64LUEY.js";
+} from "./chunk-GJC2CI3W.js";
 
 // src/cli.ts
 import { join as join45 } from "path";
@@ -4117,7 +4117,7 @@ ${fmRewritten}
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-6OHDINHT.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ESBJOBS7.js");
     const before = await readFile8(join20(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -4240,7 +4240,7 @@ async function runRemove(input) {
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
     const { readFile: readFile24 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-6OHDINHT.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ESBJOBS7.js");
     const before = await readFile24(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -9856,7 +9856,11 @@ function localRecord(p, githubOid) {
 }
 function liveDriftRecord(p) {
   if (!p || p.unknown || p.content === void 0 && p.ledger === void 0) {
-    return { state: "unknown", detail: p?.detail ?? "live drift unmeasured" };
+    return {
+      state: "unknown",
+      reason_code: p?.reason_code ?? "live_drift_unmeasured",
+      detail: p?.detail ?? "live drift unmeasured"
+    };
   }
   const content = p.content ?? 0;
   const ledger = p.ledger ?? 0;
@@ -9872,6 +9876,7 @@ function formatLiveDrift(rec) {
   const parts = [`live_drift: ${rec.state}`];
   if (rec.content !== void 0) parts.push(`content=${rec.content}`);
   if (rec.ledger !== void 0) parts.push(`ledger=${rec.ledger}`);
+  if (rec.reason_code) parts.push(`reason_code=${rec.reason_code}`);
   if (rec.detail) parts.push(rec.detail);
   return parts.join(" ");
 }
@@ -9929,6 +9934,9 @@ function defaultCopyStatusDeps(input) {
   const nestedWithLive = selection.path !== void 0 && (pathsAreNested(selection.path, input.vault) || pathsAreNested(input.vault, selection.path));
   const configuredProjection = sameAsLive || nestedWithLive ? void 0 : selection.path;
   const projectionProblem = selection.invalidDetail ?? (sameAsLive ? "configured fetch projection must be distinct from live vault" : nestedWithLive ? "configured fetch projection and live vault must not be nested" : void 0);
+  let unmeasuredLiveDriftReason = "fetch_projection_not_configured";
+  if (selection.invalidDetail) unmeasuredLiveDriftReason = "fetch_projection_invalid";
+  else if (projectionProblem) unmeasuredLiveDriftReason = "fetch_projection_conflicts_with_live_vault";
   const gitVault = input.vault;
   const projectionWarning = selection.configured ? `configured fetch projection ignored for Git status; using live vault${projectionProblem ? ` (${projectionProblem})` : ""}` : void 0;
   const invalidProjectionDetail = projectionProblem ?? "configured fetch projection is not a git repository";
@@ -9999,10 +10007,18 @@ function defaultCopyStatusDeps(input) {
     },
     probeLiveDrift() {
       if (!configuredProjection) {
-        return { unknown: true, detail: projectionProblem ?? "live drift requires a configured fetch projection" };
+        return {
+          unknown: true,
+          reason_code: unmeasuredLiveDriftReason,
+          detail: projectionProblem ?? "live drift requires a configured fetch projection"
+        };
       }
       if (!existsSync13(join39(configuredProjection, ".git"))) {
-        return { unknown: true, detail: invalidProjectionDetail };
+        return {
+          unknown: true,
+          reason_code: "fetch_projection_invalid",
+          detail: invalidProjectionDetail
+        };
       }
       return measureAuthoritativeLiveDrift(input.vault, configuredProjection);
     }
@@ -11207,7 +11223,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-ATDFVLJV.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-AYD3CJYD.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -12302,7 +12318,7 @@ memoryCmd.command("index [vault]").description("build the derived project memory
       check: false,
       ifStale: !!opts.ifStale
     }),
-    { postCommit: true }
+    { postCommit: false }
   );
 });
 memoryCmd.command("recall [vault]").description("recall bounded source summaries for a memory topic").requiredOption("--project <slug>", "project slug").requiredOption("--topic <slug>", "memory topic slug").option("--scope <scope>", "memory scope: project, global, cross-agent, or all").option("--limit <n>", "maximum sources to return", (s) => parseInt(s, 10), 10).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {

package/dist/{index-projection-6OHDINHT.js → index-projection-ESBJOBS7.js}

@@ -4,9 +4,9 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-XYXTV2YD.js";
-import "./chunk-KDH352MC.js";
-import "./chunk-QM64LUEY.js";
+} from "./chunk-DTTKCCQ4.js";
+import "./chunk-HMHMCPCE.js";
+import "./chunk-GJC2CI3W.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{managed-write-preflight-ATDFVLJV.js → managed-write-preflight-AYD3CJYD.js}

@@ -6,10 +6,10 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-PVIOU7BN.js";
-import "./chunk-KDH352MC.js";
-import "./chunk-F5GFUYPF.js";
-import "./chunk-QM64LUEY.js";
+} from "./chunk-PGD3J2GE.js";
+import "./chunk-HMHMCPCE.js";
+import "./chunk-JCDAEZVD.js";
+import "./chunk-GJC2CI3W.js";
 export {
   DEFAULT_MANAGED_WRITE_WAIT_MS,
   MANAGED_WRITE_POLL_INTERVAL_MS,

package/dist/skillwiki-mcp.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-2BPOEEMW.js";
+} from "./chunk-Z4NCF6K6.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-XYXTV2YD.js";
-import "./chunk-PVIOU7BN.js";
-import "./chunk-KDH352MC.js";
-import "./chunk-H42EY6E7.js";
-import "./chunk-F5GFUYPF.js";
-import "./chunk-QM64LUEY.js";
+import "./chunk-DTTKCCQ4.js";
+import "./chunk-PGD3J2GE.js";
+import "./chunk-HMHMCPCE.js";
+import "./chunk-QU2IXZRN.js";
+import "./chunk-JCDAEZVD.js";
+import "./chunk-GJC2CI3W.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-QTQSZMST.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-QU2IXZRN.js";
+import "./chunk-JCDAEZVD.js";
+import "./chunk-GJC2CI3W.js";
+export {
+  runSourcesPending
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 22 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "description": "Project-aware Karpathy-style knowledge base: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.105",
+  "version": "0.10.107",
   "private": true,
   "files": [
     "wiki-*",

package/skills/scripts/check_readiness.py

@@ -16,12 +16,24 @@ from typing import Mapping
 PRODUCTION_MCP_URL = "https://wiki.karldigi.dev/mcp"
 TOKEN_ENV = "SKILLWIKI_MCP_TOKEN"
 URL_ENV = "SKILLWIKI_MCP_URL"
+HEADLESS_OAUTH_LOOPBACK_WARNING = (
+    "headless_oauth_loopback: SSH is a hint that the operator browser may not "
+    "be this host. MCP OAuth loopback (localhost callback) binds on this host, "
+    "so an operator browser on another machine cannot finish it. Set "
+    f"{TOKEN_ENV} via process env, host Configure, or skillwiki connect "
+    "--from-file. Do not click the SkillWiki OAuth login on another machine."
+)
 
 
 def _strip(value: str | None) -> str:
     return (value or "").strip()
 
 
+def _ssh_remote_session(source: Mapping[str, str]) -> bool:
+    """SSH is a hint that the operator browser may not be this host (callback would bind here)."""
+    return bool(_strip(source.get("SSH_CONNECTION")) or _strip(source.get("SSH_TTY")))
+
+
 def probe(environ: Mapping[str, str] | None = None) -> dict:
     source = os.environ if environ is None else environ
     token = _strip(source.get(TOKEN_ENV))
@@ -30,6 +42,8 @@ def probe(environ: Mapping[str, str] | None = None) -> dict:
     reasons: list[str] = []
 
     if not token:
+        if _ssh_remote_session(source):
+            warnings.append(HEADLESS_OAUTH_LOOPBACK_WARNING)
         return {
             "status": "missing_prereq",
             "reasons": [f"{TOKEN_ENV} unset"],

package/skills/skills/skillwiki-connect/SKILL.md

@@ -21,6 +21,7 @@ Unknown-agent HTTP MCP setup. Use when the client has no SkillWiki plugin and no
 - Do **not** use 云盘 / Drive / CloudStorage as the secret path. Only a chat-attached file reaches the VM.
 - Missing `WIKI_PATH` is expected on an MCP-only leaf. Handshake pass is done.
 - Do **not** instruct the operator to paste the bearer into the chat transcript.
+- Do **not** tell the operator to complete SkillWiki OAuth login in a laptop browser for an SSH/remote host. Loopback `http://localhost:<port>/callback` binds on the remote client; headed vs headless is not the discriminator, and SSH is a hint that the operator browser may not be this host. Use `skillwiki connect --from-file`.
 
 ## Paste-once prompt
 

package/skills/skills/skillwiki-mcp/SKILL.md

@@ -16,6 +16,7 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. Optional non-secret `SKILLWIKI_EXTRA_VAULTS` (comma-separated vault ids such as `wiki-fin`) opts the client into extra vaults on the **same** connector URL. It is not a second connector, not a secret, and not written to `~/.cursor/mcp.json` or Grok `config.toml`. Server `allowed_vaults` remains the security boundary; an extra listed here but missing from the bearer still fails closed. Omit `vault=` on tools to use the live handshake `default_vault`; specify an extra vault only when requested. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- **Operator browser not on this host (SSH):** installed `.mcp.json` already sends `Authorization: Bearer ${SKILLWIKI_MCP_TOKEN}`. If the token is missing, a 401 may start MCP OAuth with `http://localhost:<port>/callback` on this host. MCP OAuth loopback binds on this host; headed vs headless is not the discriminator (DISPLAY, VNC, or local Chrome cannot complete loopback when the operator browser is on another machine), and SSH is a hint that the operator browser may not be this host. If `check_readiness.py` `warnings` contain `headless_oauth_loopback`, or the host shows an OAuth login URL over SSH: stop. Ask the operator to set `SKILLWIKI_MCP_TOKEN` (process env, Configure, or `skillwiki connect --from-file`). Do not tell the operator to click the login link on another machine. If SkillWiki tools are already connected, continue.
 - A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). Connector hosts put the printed value into process env or host Configure. Unknown agents (no plugin / no usable connector) ingest a chat-attached env file with `skillwiki connect --from-file` (or `--from-stdin`); do not instruct paste-into-chat. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
 - First-run order: install plugin/CLI → operator issues on metal → connector Configure **or** unknown-agent `skillwiki connect --from-file <attachment>` → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
@@ -30,14 +31,14 @@ Remotes still on a pre-HTTP-MCP plugin or CLI must upgrade the plugin channel (a
 
 ## Writes
 
-On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
+Local Mac coding agents with a valid bearer are managed read-write peers through advertised MCP tools. Remote and other agents are read-mostly; they write only when explicitly authorized and the advertised tool permits the target. On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
 
 Check the successful write receipt's `vault_id` against the intended vault before reporting any write as saved.
 
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`. Verify its returned `path` with `wiki_read_page` in that vault.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content` (optional `operation_id` is 64 hex). Success returns a receipt (`operation_id`, `event_path`, hashes, `s3_verified`). Verify the exact block via `wiki_read_page(event_path)`. Do not require reading `log.md`. If `log.md` is over 256 KiB, full `wiki_read_page("log.md")` returns `PAGE_TOO_LARGE`; use `tail_bytes` only to browse the newest end.
 3. **Feature-detect work-item and page-publish tools**:
-   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown. For work-item `spec.md` or goal-plan `plan.md`, pass optional `agent_role` / `agent_id`; the server stamps authenticated `host` and supplied agent identity into frontmatter. Supported workspace paths are: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
    - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
    - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
 4. **`PATH_DENIED` means STOP.** Paths outside the allowlist (`projects/<slug>/history/**`, non-`.md` files such as `fleet.yaml` or `.canvas`, `AGENTS.md`/`CLAUDE.md`, raw edits, index/projection rebuilds) have no agent write path over MCP. wiki-push / `rclone copy` is **not** an agent writer: it bypasses the daemon working copy, so `wiki_read_page` cannot see those bytes until the sg01 snapshot. Never report an S3-only copy as "saved to wiki". Capture the blocked intent via `wiki_capture` and report the denial instead.
@@ -46,8 +47,8 @@ Check the successful write receipt's `vault_id` against the intended vault befor
 
 Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror. Frozen-leaf agents should use HTTP `wiki_sources_pending`, `wiki_lint_summary`, `wiki_stale`, `wiki_compile_status`, and `wiki_reviews` instead of local CLI commands when those tools are advertised.
 
-`wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
+`wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For recent progress, key projects, or to-dos, feature-detect and call `wiki_progress`; apply `project`, `host`, or `agent_role` filters when requested, and present `recent_progress`, `key_projects`, and `todos` as complete bullet lists. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
 
 ## Errors
 
-Report handshake, capture, and append failures literally. If tools are missing after a 401 or `missing_prereq`, stop and tell the operator to set `SKILLWIKI_MCP_TOKEN` via process env, host Configure, or `skillwiki connect --from-file` (unknown agents; never paste-into-chat), run `grok plugin update skillwiki`, and start a new session. Do not fall back to local `raw/transcripts/` writes.
+Report handshake, capture, and append failures literally. If tools are missing after a 401 or `missing_prereq`, stop and tell the operator to set `SKILLWIKI_MCP_TOKEN` via process env, host Configure, or `skillwiki connect --from-file` (unknown agents; never paste-into-chat), run `grok plugin update skillwiki`, and start a new session. Over SSH, treat an OAuth login URL the same way: report `headless_oauth_loopback` and stop. Do not fall back to local `raw/transcripts/` writes.

package/skills/skills/using-skillwiki/activation.md

@@ -16,7 +16,7 @@ Choose the matching installed skill:
 - Projects and planning: `proj-init`, `proj-work`, `proj-distill`,
   `proj-decide`, `wiki-gate-plan-mode`, `dev-loop:research`.
 - Fleet and visualization: `wiki-sync`, `wiki-canvas`.
-- HTTP MCP capture or append: `skillwiki-mcp`.
+- HTTP MCP capture, append, or progress query: `skillwiki-mcp`.
 
 If routing is unclear, invoke `using-skillwiki` rather than guessing.
 
@@ -39,10 +39,7 @@ PRD provider and stage, SkillWiki provenance, and simplify review independent.
 
 ## Managed-Write Safety
 
-The HTTP MCP contract below controls remote reads and mutations. On leaf hosts,
-captures use MCP, never local `raw/transcripts` or `log.md` writes. Project
-workspace writes use `wiki_workitem_write` with compare-and-swap; stop if the
-tool or path family is unavailable. A wiki push or rclone copy is not a managed
+The HTTP MCP contract below controls remote reads and mutations. Local Mac coding agents with a valid bearer are managed read-write peers through advertised MCP tools. Remote and other agents are read-mostly; they write only when explicitly authorized and the advertised MCP tool permits the target. On leaf hosts, captures use MCP, never local `raw/transcripts` or `log.md` writes. Project workspace writes use `wiki_workitem_write` with compare-and-swap; stop if the tool or path family is unavailable. A wiki push or rclone copy is not a managed
 write and is not visible until the authoritative snapshot. Never use bare `rm`
 or `git rm` for fleet deletion. Never auto-install SkillWiki in unattended
 sessions. If required publish support is unavailable, fail closed.
@@ -72,6 +69,9 @@ vault.
 For `wiki_workitem_write` or `wiki_page_publish`, read first, send the returned
 sha256 as `base_sha256`, and on `FILE_CHANGED` re-read, rebase, and retry.
 
+### Progress Queries
+Use `wiki_progress` for recent progress, key projects, or to-dos. Apply requested project, host, or agent-role filters and answer with complete bullet lists.
+
 ### Capture Kinds
 `wiki_capture` kind is `task | idea | bug | note`. Captures append to
 `raw/transcripts/`. Verify its returned `path` with `wiki_read_page`.

package/skills/skills/wiki-query/SKILL.md

@@ -14,6 +14,7 @@ Standard four reads (SCHEMA, index, log, project context if applicable).
 0. **Resolve vault and language.** Run `skillwiki path` (fail if NO_VAULT_CONFIGURED) and `skillwiki lang`.
 1. **Determine scope.** Ask the user once if ambiguous: vault | current project | project+concepts.
    - Ordinary questions are typed-knowledge-first. Run `skillwiki query "<text>" [vault]` without widening into raw captures. Default ranking is 4-signal only. Optional `skillwiki query "<text>" --hybrid` RRF-fuses that ranking with a rebuildable TF-IDF cache (`skillwiki vectors rebuild`); if the cache is missing, stop and rebuild instead of silently falling back.
+   - Recent progress, key-project, or to-do questions use the MCP `wiki_progress` tool when advertised. Apply requested `project`, `host`, or `agent_role` filters and render all three result sections as complete bullet lists.
    - Setup, MCP, doctor, plugin-drift, or "open work" questions are not typed-knowledge searches. Call `wiki_context` (active_work) or `skillwiki query "<text>" --scope work` / `--scope all`. Default typed query never ranks `projects/*/work`.
    - Explicit freshness language — `new`, `recent`, `fresh`, `clipped`, `raw`, `pending`, `undigested`, `unprocessed`, `not yet ingested`, or `not yet integrated` — requests the pending evidence channel. Run `skillwiki sources pending [vault]` for inventory and `skillwiki query "<text>" [vault] --include-pending` for synthesis support.
 2. **Refresh graph.** If `.skillwiki/graph.json` is missing or older than 24h: `skillwiki graph build <vault>`.

package/skills/skillwiki-connect/SKILL.md

@@ -21,6 +21,7 @@ Unknown-agent HTTP MCP setup. Use when the client has no SkillWiki plugin and no
 - Do **not** use 云盘 / Drive / CloudStorage as the secret path. Only a chat-attached file reaches the VM.
 - Missing `WIKI_PATH` is expected on an MCP-only leaf. Handshake pass is done.
 - Do **not** instruct the operator to paste the bearer into the chat transcript.
+- Do **not** tell the operator to complete SkillWiki OAuth login in a laptop browser for an SSH/remote host. Loopback `http://localhost:<port>/callback` binds on the remote client; headed vs headless is not the discriminator, and SSH is a hint that the operator browser may not be this host. Use `skillwiki connect --from-file`.
 
 ## Paste-once prompt
 

package/skills/skillwiki-mcp/SKILL.md

@@ -16,6 +16,7 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. Optional non-secret `SKILLWIKI_EXTRA_VAULTS` (comma-separated vault ids such as `wiki-fin`) opts the client into extra vaults on the **same** connector URL. It is not a second connector, not a secret, and not written to `~/.cursor/mcp.json` or Grok `config.toml`. Server `allowed_vaults` remains the security boundary; an extra listed here but missing from the bearer still fails closed. Omit `vault=` on tools to use the live handshake `default_vault`; specify an extra vault only when requested. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- **Operator browser not on this host (SSH):** installed `.mcp.json` already sends `Authorization: Bearer ${SKILLWIKI_MCP_TOKEN}`. If the token is missing, a 401 may start MCP OAuth with `http://localhost:<port>/callback` on this host. MCP OAuth loopback binds on this host; headed vs headless is not the discriminator (DISPLAY, VNC, or local Chrome cannot complete loopback when the operator browser is on another machine), and SSH is a hint that the operator browser may not be this host. If `check_readiness.py` `warnings` contain `headless_oauth_loopback`, or the host shows an OAuth login URL over SSH: stop. Ask the operator to set `SKILLWIKI_MCP_TOKEN` (process env, Configure, or `skillwiki connect --from-file`). Do not tell the operator to click the login link on another machine. If SkillWiki tools are already connected, continue.
 - A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). Connector hosts put the printed value into process env or host Configure. Unknown agents (no plugin / no usable connector) ingest a chat-attached env file with `skillwiki connect --from-file` (or `--from-stdin`); do not instruct paste-into-chat. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
 - First-run order: install plugin/CLI → operator issues on metal → connector Configure **or** unknown-agent `skillwiki connect --from-file <attachment>` → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
@@ -30,14 +31,14 @@ Remotes still on a pre-HTTP-MCP plugin or CLI must upgrade the plugin channel (a
 
 ## Writes
 
-On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
+Local Mac coding agents with a valid bearer are managed read-write peers through advertised MCP tools. Remote and other agents are read-mostly; they write only when explicitly authorized and the advertised tool permits the target. On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
 
 Check the successful write receipt's `vault_id` against the intended vault before reporting any write as saved.
 
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`. Verify its returned `path` with `wiki_read_page` in that vault.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content` (optional `operation_id` is 64 hex). Success returns a receipt (`operation_id`, `event_path`, hashes, `s3_verified`). Verify the exact block via `wiki_read_page(event_path)`. Do not require reading `log.md`. If `log.md` is over 256 KiB, full `wiki_read_page("log.md")` returns `PAGE_TOO_LARGE`; use `tail_bytes` only to browse the newest end.
 3. **Feature-detect work-item and page-publish tools**:
-   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown. For work-item `spec.md` or goal-plan `plan.md`, pass optional `agent_role` / `agent_id`; the server stamps authenticated `host` and supplied agent identity into frontmatter. Supported workspace paths are: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
    - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
    - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
 4. **`PATH_DENIED` means STOP.** Paths outside the allowlist (`projects/<slug>/history/**`, non-`.md` files such as `fleet.yaml` or `.canvas`, `AGENTS.md`/`CLAUDE.md`, raw edits, index/projection rebuilds) have no agent write path over MCP. wiki-push / `rclone copy` is **not** an agent writer: it bypasses the daemon working copy, so `wiki_read_page` cannot see those bytes until the sg01 snapshot. Never report an S3-only copy as "saved to wiki". Capture the blocked intent via `wiki_capture` and report the denial instead.
@@ -46,8 +47,8 @@ Check the successful write receipt's `vault_id` against the intended vault befor
 
 Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror. Frozen-leaf agents should use HTTP `wiki_sources_pending`, `wiki_lint_summary`, `wiki_stale`, `wiki_compile_status`, and `wiki_reviews` instead of local CLI commands when those tools are advertised.
 
-`wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
+`wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For recent progress, key projects, or to-dos, feature-detect and call `wiki_progress`; apply `project`, `host`, or `agent_role` filters when requested, and present `recent_progress`, `key_projects`, and `todos` as complete bullet lists. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
 
 ## Errors
 
-Report handshake, capture, and append failures literally. If tools are missing after a 401 or `missing_prereq`, stop and tell the operator to set `SKILLWIKI_MCP_TOKEN` via process env, host Configure, or `skillwiki connect --from-file` (unknown agents; never paste-into-chat), run `grok plugin update skillwiki`, and start a new session. Do not fall back to local `raw/transcripts/` writes.
+Report handshake, capture, and append failures literally. If tools are missing after a 401 or `missing_prereq`, stop and tell the operator to set `SKILLWIKI_MCP_TOKEN` via process env, host Configure, or `skillwiki connect --from-file` (unknown agents; never paste-into-chat), run `grok plugin update skillwiki`, and start a new session. Over SSH, treat an OAuth login URL the same way: report `headless_oauth_loopback` and stop. Do not fall back to local `raw/transcripts/` writes.

package/skills/using-skillwiki/activation.md

@@ -16,7 +16,7 @@ Choose the matching installed skill:
 - Projects and planning: `proj-init`, `proj-work`, `proj-distill`,
   `proj-decide`, `wiki-gate-plan-mode`, `dev-loop:research`.
 - Fleet and visualization: `wiki-sync`, `wiki-canvas`.
-- HTTP MCP capture or append: `skillwiki-mcp`.
+- HTTP MCP capture, append, or progress query: `skillwiki-mcp`.
 
 If routing is unclear, invoke `using-skillwiki` rather than guessing.
 
@@ -39,10 +39,7 @@ PRD provider and stage, SkillWiki provenance, and simplify review independent.
 
 ## Managed-Write Safety
 
-The HTTP MCP contract below controls remote reads and mutations. On leaf hosts,
-captures use MCP, never local `raw/transcripts` or `log.md` writes. Project
-workspace writes use `wiki_workitem_write` with compare-and-swap; stop if the
-tool or path family is unavailable. A wiki push or rclone copy is not a managed
+The HTTP MCP contract below controls remote reads and mutations. Local Mac coding agents with a valid bearer are managed read-write peers through advertised MCP tools. Remote and other agents are read-mostly; they write only when explicitly authorized and the advertised MCP tool permits the target. On leaf hosts, captures use MCP, never local `raw/transcripts` or `log.md` writes. Project workspace writes use `wiki_workitem_write` with compare-and-swap; stop if the tool or path family is unavailable. A wiki push or rclone copy is not a managed
 write and is not visible until the authoritative snapshot. Never use bare `rm`
 or `git rm` for fleet deletion. Never auto-install SkillWiki in unattended
 sessions. If required publish support is unavailable, fail closed.
@@ -72,6 +69,9 @@ vault.
 For `wiki_workitem_write` or `wiki_page_publish`, read first, send the returned
 sha256 as `base_sha256`, and on `FILE_CHANGED` re-read, rebase, and retry.
 
+### Progress Queries
+Use `wiki_progress` for recent progress, key projects, or to-dos. Apply requested project, host, or agent-role filters and answer with complete bullet lists.
+
 ### Capture Kinds
 `wiki_capture` kind is `task | idea | bug | note`. Captures append to
 `raw/transcripts/`. Verify its returned `path` with `wiki_read_page`.

package/skills/wiki-query/SKILL.md

@@ -14,6 +14,7 @@ Standard four reads (SCHEMA, index, log, project context if applicable).
 0. **Resolve vault and language.** Run `skillwiki path` (fail if NO_VAULT_CONFIGURED) and `skillwiki lang`.
 1. **Determine scope.** Ask the user once if ambiguous: vault | current project | project+concepts.
    - Ordinary questions are typed-knowledge-first. Run `skillwiki query "<text>" [vault]` without widening into raw captures. Default ranking is 4-signal only. Optional `skillwiki query "<text>" --hybrid` RRF-fuses that ranking with a rebuildable TF-IDF cache (`skillwiki vectors rebuild`); if the cache is missing, stop and rebuild instead of silently falling back.
+   - Recent progress, key-project, or to-do questions use the MCP `wiki_progress` tool when advertised. Apply requested `project`, `host`, or `agent_role` filters and render all three result sections as complete bullet lists.
    - Setup, MCP, doctor, plugin-drift, or "open work" questions are not typed-knowledge searches. Call `wiki_context` (active_work) or `skillwiki query "<text>" --scope work` / `--scope all`. Default typed query never ranks `projects/*/work`.
    - Explicit freshness language — `new`, `recent`, `fresh`, `clipped`, `raw`, `pending`, `undigested`, `unprocessed`, `not yet ingested`, or `not yet integrated` — requests the pending evidence channel. Run `skillwiki sources pending [vault]` for inventory and `skillwiki query "<text>" [vault] --include-pending` for synthesis support.
 2. **Refresh graph.** If `.skillwiki/graph.json` is missing or older than 24h: `skillwiki graph build <vault>`.

package/templates/SCHEMA.md

@@ -92,6 +92,9 @@ created: YYYY-MM-DD     # when capture was written
 ingested:          # filled by ingest pipeline (empty at creation)
 kind:             # idea | bug | task | note | other
 project:          # optional: "[[slug]]" for cross-reference
+host:             # optional: host identity token (stamped by MCP writer)
+agent_role:       # optional: agent role identity token
+agent_id:         # optional: agent identity token
 ---
 ```
 
@@ -101,6 +104,9 @@ project:          # optional: "[[slug]]" for cross-reference
 - `ingested`: Date processed into typed knowledge. **Empty at creation.** Filled by `wiki-ingest`, `wiki-crystallize`.
 - `kind`: Capture type. Affects dev-loop routing (`bug`/`task` → work items; `idea` → knowledge development).
 - `project`: Optional project cross-reference. Enables `provenance_projects:` auto-linking.
+- `host`: Optional host identity token (e.g. `macos-dev`, `sg01`). Stamped by MCP writer from authenticated identity.
+- `agent_role`: Optional agent role identity token (e.g. `researcher`, `worker`, `reviewer`).
+- `agent_id`: Optional specific agent instance identifier.
 
 ### vs Ingested Sources
 

package/dist/sources-OSGKH6KN.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import {
-  runSourcesPending
-} from "./chunk-H42EY6E7.js";
-import "./chunk-F5GFUYPF.js";
-import "./chunk-QM64LUEY.js";
-export {
-  runSourcesPending
-};