skillwiki 0.10.108 → 0.10.110

package/dist/{chunk-Z4NCF6K6.js → chunk-6X6PPQNI.js}

@@ -6,7 +6,7 @@ import {
 import {
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-DTTKCCQ4.js";
+} from "./chunk-KX5Y3GSX.js";
 import {
   CONFIG_KEYS,
   VAULT_HYGIENE_GENERATED_COMMIT_PATHS,
@@ -31,6 +31,7 @@ import {
   releaseOwnedSyncLock,
   resolveConfiguredSnapshotWorktree,
   resolveRuntimePath,
+  resolveSkillwikiHome,
   resolveVaultSyncPullHelper,
   resolveWikiS3Remote,
   runLint,
@@ -40,11 +41,11 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-PGD3J2GE.js";
+} from "./chunk-QU2CKXM4.js";
 import {
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-HMHMCPCE.js";
+} from "./chunk-WPJHDRTP.js";
 import {
   applySourceCompileClaim,
   applySourceCompilePublished,
@@ -57,12 +58,13 @@ import {
   planSourceCompileRelease,
   planSourceReview,
   runSourcesPending
-} from "./chunk-QU2IXZRN.js";
+} from "./chunk-NA3TZ4JN.js";
 import {
   eventPathFor,
   writeLogEvent
-} from "./chunk-JCDAEZVD.js";
+} from "./chunk-5MV5SSRM.js";
 import {
+  CLIP_OUTBOX_DEFAULTS,
   CompoundSchema,
   ExitCode,
   MetaSchema,
@@ -72,8 +74,10 @@ import {
   detectSchema,
   err,
   extractFrontmatter,
+  isClipOutboxKey,
   isVaultSyncKey,
   ok,
+  parseClipOutboxKeyValue,
   parseVaultSyncKeyValue,
   readPage,
   redactSensitiveContent,
@@ -82,7 +86,7 @@ import {
   scanVault,
   splitFrontmatter,
   systemdPropertyFor
-} from "./chunk-GJC2CI3W.js";
+} from "./chunk-R2DJ7IJ5.js";
 
 // src/commands/log-append.ts
 import { readFile, stat } from "fs/promises";
@@ -636,7 +640,7 @@ function computeAdamicAdar(adj) {
 import { resolve as resolvePath } from "path";
 async function guardProtectedVaultWrite(input) {
   const env = input.env ?? process.env;
-  const home = input.home ?? process.env.HOME ?? "";
+  const home = resolveSkillwikiHome(input.home, env);
   const cwd = input.cwd ?? process.cwd();
   const liveVaultPath = await resolveLiveVaultPath({ env, home, cwd });
   const load = await loadFleetManifestAndHost({
@@ -1016,14 +1020,14 @@ import { readFile as readFile5 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { join as join5 } from "path";
 function validateKey(key) {
-  return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key) || isVaultSyncKey(key);
+  return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key) || isVaultSyncKey(key) || isClipOutboxKey(key);
 }
 function displayConfigValue(key, value) {
   if (key === "SKILLWIKI_MCP_TOKEN") return value.length > 0 ? "TOKEN_SET" : "";
   return value;
 }
 function configPath(home) {
-  return join5(home, ".skillwiki", ".env");
+  return join5(resolveSkillwikiHome(home), ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -1043,6 +1047,12 @@ async function runConfigSet(input) {
       return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { key: input.key, value: input.value, message: parsed.message }) };
     }
   }
+  if (isClipOutboxKey(input.key)) {
+    const parsed = parseClipOutboxKeyValue(input.key, input.value);
+    if (!parsed.ok) {
+      return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { key: input.key, value: input.value, message: parsed.message }) };
+    }
+  }
   const filePath = configPath(input.home);
   try {
     let originalContent;
@@ -1104,7 +1114,7 @@ function mcpAuthFromEnv(env) {
 }
 async function resolveMcpAuthEnv(input) {
   const processAuth = mcpAuthFromEnv(input.env ?? process.env);
-  const dotenv = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
+  const dotenv = await parseDotenvFile(join6(resolveSkillwikiHome(input.home, input.env), ".skillwiki", ".env"));
   const fileAuth = mcpAuthFromEnv(dotenv);
   return {
     url: processAuth.url ?? fileAuth.url,
@@ -1129,7 +1139,7 @@ function isMcpOnlyLeaf(input) {
 }
 
 // src/doctor/runner.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 
 // src/doctor/probes/environment.ts
 import { existsSync as existsSync4, lstatSync, readlinkSync } from "fs";
@@ -1398,7 +1408,7 @@ async function checkConfigFile(home) {
   try {
     const map = await parseDotenvFile(cfgPath);
     const keys = Object.keys(map);
-    return check("pass", "config_file", "Config file exists", `Found with keys: ${keys.length > 0 ? keys.join(", ") : "(none set)"}`);
+    return check("pass", "config_file", "Config file exists", `Found ${cfgPath} with keys: ${keys.length > 0 ? keys.join(", ") : "(none set)"}`);
   } catch (e) {
     return check("warn", "config_file", "Config file exists", `Failed to parse ${cfgPath}: ${String(e)}`);
   }
@@ -2101,7 +2111,9 @@ import { execSync as execSync4 } from "child_process";
 // src/utils/s3-mount-health.ts
 import { execSync as execSync3 } from "child_process";
 import { platform as platform2 } from "os";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, readFileSync as readFile6 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
+import { readFile as readFile6, writeFile as writeFile2, unlink } from "fs/promises";
+import { randomUUID } from "crypto";
 import { join as join13 } from "path";
 var OS = platform2();
 function findRcloneMountPid() {
@@ -2259,36 +2271,45 @@ function detectFuseMount(vaultPath) {
   }
   return null;
 }
-function writeTest(dir) {
-  const testFile = join13(dir, `.doctor-write-test-${process.pid}.tmp`);
-  const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
+async function writeTest(dir, options = {}) {
+  const testFile = join13(dir, options.fileName ?? `.doctor-write-test-${process.pid}.tmp`);
+  const io = options.io ?? {
+    write: (path, payload2) => writeFile2(path, payload2, "utf8"),
+    read: (path) => readFile6(path, "utf8"),
+    remove: (path) => unlink(path)
+  };
+  const payload = `skillwiki write test \u2014 ${(/* @__PURE__ */ new Date()).toISOString()} \u2014 ${randomUUID()}`;
   const start = Date.now();
   try {
-    writeFileSync2(testFile, payload, "utf8");
+    await io.write(testFile, payload);
   } catch (e) {
+    try {
+      await io.remove(testFile);
+    } catch {
+    }
     return { success: false, writeMs: Date.now() - start, readMs: 0, size: 0, error: `write failed: ${e.message}` };
   }
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile6(testFile, "utf8");
+    const back = await io.read(testFile);
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
-        unlinkSync2(testFile);
+        await io.remove(testFile);
       } catch {
       }
       return { success: false, writeMs, readMs, size: Buffer.byteLength(payload, "utf8"), error: "content mismatch \u2014 wrote and read-back differ" };
     }
   } catch (e) {
     try {
-      unlinkSync2(testFile);
+      await io.remove(testFile);
     } catch {
     }
     return { success: false, writeMs, readMs: Date.now() - readStart, size: 0, error: `read failed: ${e.message}` };
   }
   try {
-    unlinkSync2(testFile);
+    await io.remove(testFile);
   } catch {
   }
   return { success: true, writeMs, readMs: Date.now() - readStart, size: Buffer.byteLength(payload, "utf8") };
@@ -2522,7 +2543,7 @@ function checkRcloneVersion(resolvedPath, vaultSyncInstalled, pushEnabled = true
   }
   return check("pass", "rclone_version", "rclone version", ver.raw);
 }
-function checkWriteTest(resolvedPath) {
+async function checkWriteTest(resolvedPath) {
   if (!resolvedPath) {
     return check("pass", "s3_write_test", "S3 write test", "No vault path \u2014 check skipped");
   }
@@ -2534,7 +2555,7 @@ function checkWriteTest(resolvedPath) {
   if (!existsSync10(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
-  const result = writeTest(conceptsDir);
+  const result = await writeTest(conceptsDir);
   if (result.success) {
     const totalMs = result.writeMs + result.readMs;
     if (totalMs > 3e3) {
@@ -2617,13 +2638,13 @@ function checkVfsCacheHealth(resolvedPath) {
 }
 var s3MountHealthProbe = {
   id: "s3_mount_health",
-  run(ctx) {
+  async run(ctx) {
     return [
       checkS3MountPerf(ctx.resolvedPath),
       checkS3MountFreshness(ctx.resolvedPath),
       checkRcloneFlagAudit(ctx.resolvedPath),
       checkRcloneVersion(ctx.resolvedPath, ctx.vsConfig.installed, ctx.vsConfig.pushEnabled !== false, ctx.mcpOnlyLeaf),
-      checkWriteTest(ctx.resolvedPath),
+      await checkWriteTest(ctx.resolvedPath),
       checkVfsCacheHealth(ctx.resolvedPath)
     ];
   }
@@ -4255,6 +4276,46 @@ var dsStoreNoiseProbe = {
 // src/doctor/probes/mcp-handshake.ts
 import { existsSync as existsSync17 } from "fs";
 import { join as join21 } from "path";
+
+// src/utils/mcp-client.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var MCP_PROBE_TIMEOUT_MS = 1e4;
+async function withMcpClient(input, probe) {
+  const controller = new AbortController();
+  const client = new Client({ name: input.clientName, version: input.version });
+  const fetchFn = input.fetchFn ?? globalThis.fetch;
+  const transport = new StreamableHTTPClientTransport(new URL(input.url), {
+    requestInit: { headers: { Authorization: `Bearer ${input.token}` } },
+    fetch: (url, init) => fetchFn(url, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, controller.signal]) : controller.signal
+    })
+  });
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      const error = new Error(`MCP probe timed out after ${MCP_PROBE_TIMEOUT_MS}ms`);
+      reject(error);
+      controller.abort(error);
+    }, MCP_PROBE_TIMEOUT_MS);
+  });
+  try {
+    const work = async () => {
+      await client.connect(transport, { signal: controller.signal, timeout: MCP_PROBE_TIMEOUT_MS });
+      return probe(client, controller.signal);
+    };
+    return await Promise.race([work(), deadline]);
+  } catch (error) {
+    throw new Error(redactMcpSecret(error instanceof Error ? error.message : String(error), input.token));
+  } finally {
+    clearTimeout(timer);
+    controller.abort();
+    await client.close();
+  }
+}
+
+// src/doctor/probes/mcp-handshake.ts
 var DEFAULT_MCP_URL = "https://wiki.karldigi.dev/mcp";
 function mcpEnv(ctx) {
   return ctx.input.env ?? process.env;
@@ -4322,54 +4383,6 @@ function redactSecret(detail, secret) {
 function handshakeRow(status, detail, secret) {
   return check(status, HANDSHAKE_ID, HANDSHAKE_LABEL, redactSecret(detail, secret));
 }
-function parseMcpBody(text) {
-  const trimmed = text.trim();
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    return JSON.parse(trimmed);
-  }
-  for (const line of trimmed.split(/\r?\n/)) {
-    const prefix = line.startsWith("data:") ? line.slice(5).trim() : "";
-    if (prefix.startsWith("{")) return JSON.parse(prefix);
-  }
-  throw new Error("non-JSON MCP body");
-}
-function jsonRpcResult(body) {
-  if (typeof body !== "object" || body === null) {
-    throw new Error("invalid JSON-RPC body");
-  }
-  const rec = body;
-  if (rec.error) {
-    throw new Error(typeof rec.error.message === "string" ? rec.error.message : "JSON-RPC error");
-  }
-  if (typeof rec.result !== "object" || rec.result === null) {
-    throw new Error("missing JSON-RPC result");
-  }
-  return rec.result;
-}
-async function mcpJsonRpc(fetchFn, url, token, method, id, params, sessionId) {
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream"
-  };
-  if (sessionId) headers["mcp-session-id"] = sessionId;
-  const res = await fetchFn(url, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
-  });
-  if (!res.ok) {
-    throw new Error(`HTTP ${res.status}`);
-  }
-  const nextSession = res.headers.get("mcp-session-id") ?? sessionId;
-  const result = jsonRpcResult(parseMcpBody(await res.text()));
-  return { result, sessionId: nextSession ?? void 0 };
-}
-function toolNames(result) {
-  const tools = result.tools;
-  if (!Array.isArray(tools)) return [];
-  return tools.map((t) => typeof t === "object" && t !== null && typeof t.name === "string" ? t.name : "").filter((name) => name.length > 0);
-}
 async function checkMcpHandshake(ctx) {
   if (!ctx.input.checkMcp) {
     return handshakeRow("pass", "not requested \u2014 check skipped");
@@ -4384,33 +4397,16 @@ async function checkMcpHandshake(ctx) {
   const fetchFn = ctx.input.mcpFetch ?? globalThis.fetch;
   const shipped = ctx.input.currentVersion;
   try {
-    const init = await mcpJsonRpc(
-      fetchFn,
-      url,
-      token,
-      "initialize",
-      1,
-      {
-        protocolVersion: "2025-11-25",
-        capabilities: {},
-        clientInfo: { name: "skillwiki-doctor", version: shipped }
-      }
+    const { advertised, tools } = await withMcpClient(
+      { fetchFn, url, token, clientName: "skillwiki-doctor", version: shipped },
+      async (client, signal) => ({
+        advertised: client.getServerVersion()?.version ?? "",
+        tools: (await client.listTools({}, { signal })).tools.map((tool) => tool.name)
+      })
     );
-    const serverInfo = init.result.serverInfo;
-    const advertised = typeof serverInfo === "object" && serverInfo !== null && typeof serverInfo.version === "string" ? serverInfo.version : "";
     if (!advertised) {
       return handshakeRow("error", "handshake failed \u2014 missing serverInfo.version", token);
     }
-    const listed = await mcpJsonRpc(
-      fetchFn,
-      url,
-      token,
-      "tools/list",
-      2,
-      {},
-      init.sessionId
-    );
-    const tools = toolNames(listed.result);
     const frozen = Boolean(ctx.resolvedPath && existsSync17(join21(ctx.resolvedPath, ".WIKI_GIT_FROZEN")));
     if (frozen && !tools.includes(WORKITEM_TOOL)) {
       return handshakeRow(
@@ -4446,6 +4442,307 @@ var mcpHandshakeProbe = {
   }
 };
 
+// src/doctor/probes/clip-outbox.ts
+import { existsSync as existsSync19 } from "fs";
+import { execSync as execSync7 } from "child_process";
+import { platform as platform6 } from "os";
+import { join as join23 } from "path";
+
+// src/utils/clip-outbox-config.ts
+import { realpathSync, statSync as statSync3, existsSync as existsSync18, accessSync, constants } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join as join22, resolve as resolve3, sep as sep2 } from "path";
+var CLIP_NOT_CONFIGURED = "clip channel not configured";
+var PRODUCTION_WATCHER_LABEL = CLIP_OUTBOX_DEFAULTS.watcher_label;
+var RETIRED_WATCHER_LABELS = [
+  "com.karlchow.wiki-dev-outbox",
+  "com.karlchow.wiki-dev-sse",
+  "com.karlchow.wiki-dev-hourly",
+  "com.karlchow.skillwiki-note-outbox"
+];
+function expandUserPath(raw, home) {
+  if (raw === "~") return home;
+  if (raw.startsWith("~/")) return resolve3(home, raw.slice(2));
+  return raw;
+}
+function canonicalPath(raw, home) {
+  const expanded = expandUserPath(raw.trim(), home);
+  if (expanded.includes("\0")) return { ok: false, message: "path contains NUL" };
+  if (expanded.includes("://") || expanded.includes("@")) {
+    return { ok: false, message: "path must not include URL credentials" };
+  }
+  if (!isAbsolute(expanded)) return { ok: false, message: "must be an absolute path" };
+  try {
+    const real = existsSync18(expanded) ? realpathSync(expanded) : resolve3(expanded);
+    if (real.split(sep2).some((seg) => seg === "..")) {
+      return { ok: false, message: "path must not contain traversal" };
+    }
+    return { ok: true, path: real };
+  } catch (error) {
+    return { ok: false, message: error instanceof Error ? error.message : "invalid path" };
+  }
+}
+function nestedOrEqual(a, b) {
+  if (a === b) return true;
+  const prefixA = a.endsWith(sep2) ? a : a + sep2;
+  const prefixB = b.endsWith(sep2) ? b : b + sep2;
+  return prefixA.startsWith(prefixB) || prefixB.startsWith(prefixA);
+}
+function intField(value, fallback) {
+  return Number(value && value.length > 0 ? value : fallback);
+}
+function requireWritableDir(path, label) {
+  try {
+    const st = statSync3(path);
+    if (!st.isDirectory()) return `${label} is not a directory`;
+    accessSync(path, constants.W_OK);
+    return void 0;
+  } catch {
+    return `${label} is missing or not writable`;
+  }
+}
+function resolveClipOutboxConfig(map, home) {
+  const present = Object.keys(map).filter(isClipOutboxKey);
+  for (const key of present) {
+    const parsed = parseClipOutboxKeyValue(key, map[key] ?? "");
+    if (!parsed.ok) return { ok: false, message: `${key}: ${parsed.message}` };
+  }
+  const enabled = (map["clip_outbox.enabled"] ?? CLIP_OUTBOX_DEFAULTS.enabled) === "true";
+  if (!enabled) {
+    return { ok: true, enabled: false };
+  }
+  const required = [
+    "clip_outbox.root",
+    "clip_outbox.state_root",
+    "clip_outbox.mirror_root",
+    "clip_outbox.ready_url",
+    "clip_outbox.s3_credential_ref",
+    "clip_outbox.ready_credential_ref"
+  ];
+  for (const key of required) {
+    if (!map[key]) return { ok: false, message: `${key} is required when clip_outbox.enabled=true` };
+  }
+  const d8Absent = map["clip_outbox.d8_note_absent"] === "true";
+  const d8RootRaw = map["clip_outbox.d8_note_root"];
+  if (d8Absent && d8RootRaw) {
+    return { ok: false, message: "clip_outbox.d8_note_root and clip_outbox.d8_note_absent cannot both be set" };
+  }
+  if (!d8Absent && !d8RootRaw) {
+    return { ok: false, message: "clip_outbox.d8_note_root or clip_outbox.d8_note_absent=true is required when enabled" };
+  }
+  const root = canonicalPath(map["clip_outbox.root"], home);
+  const stateRoot = canonicalPath(map["clip_outbox.state_root"], home);
+  const mirrorRoot = canonicalPath(map["clip_outbox.mirror_root"], home);
+  if (!root.ok) return { ok: false, message: `clip_outbox.root: ${root.message}` };
+  if (!stateRoot.ok) return { ok: false, message: `clip_outbox.state_root: ${stateRoot.message}` };
+  if (!mirrorRoot.ok) return { ok: false, message: `clip_outbox.mirror_root: ${mirrorRoot.message}` };
+  let d8NoteRoot = null;
+  if (d8RootRaw) {
+    const d8 = canonicalPath(d8RootRaw, home);
+    if (!d8.ok) return { ok: false, message: `clip_outbox.d8_note_root: ${d8.message}` };
+    d8NoteRoot = d8.path;
+  }
+  if (nestedOrEqual(root.path, mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.root must be outside the frozen mirror" };
+  }
+  if (nestedOrEqual(root.path, stateRoot.path) || nestedOrEqual(stateRoot.path, mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.state_root must be disjoint from outbox and mirror" };
+  }
+  if (d8NoteRoot && (nestedOrEqual(root.path, d8NoteRoot) || nestedOrEqual(stateRoot.path, d8NoteRoot))) {
+    return { ok: false, message: "clip outbox must not equal or nest the D8 note outbox" };
+  }
+  const rootErr = requireWritableDir(root.path, "clip_outbox.root");
+  if (rootErr) return { ok: false, message: rootErr };
+  const stateErr = requireWritableDir(stateRoot.path, "clip_outbox.state_root");
+  if (stateErr) {
+    if (existsSync18(stateRoot.path)) return { ok: false, message: stateErr };
+    const parentErr = requireWritableDir(resolve3(stateRoot.path, ".."), "clip_outbox.state_root parent");
+    if (parentErr) return { ok: false, message: stateErr };
+  }
+  if (!existsSync18(mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.mirror_root does not exist" };
+  }
+  const vaultId = map["clip_outbox.vault_id"] ?? CLIP_OUTBOX_DEFAULTS.vault_id;
+  if (vaultId !== "central") return { ok: false, message: "clip_outbox.vault_id must be central" };
+  const destination = map["clip_outbox.destination"] ?? CLIP_OUTBOX_DEFAULTS.destination;
+  if (destination !== CLIP_OUTBOX_DEFAULTS.destination) {
+    return { ok: false, message: "clip_outbox.destination must be seaweed-wiki:cloud/wiki" };
+  }
+  const mode = map["clip_outbox.mode"] ?? CLIP_OUTBOX_DEFAULTS.mode;
+  if (mode !== "event-watch") return { ok: false, message: "clip_outbox.mode must be event-watch" };
+  const watcherLabel = map["clip_outbox.watcher_label"] ?? CLIP_OUTBOX_DEFAULTS.watcher_label;
+  if (watcherLabel !== PRODUCTION_WATCHER_LABEL) {
+    return { ok: false, message: "clip_outbox.watcher_label must be the production clip watcher" };
+  }
+  const imageTypes = (map["clip_outbox.image_types"] ?? CLIP_OUTBOX_DEFAULTS.image_types).split(",").map((p) => p.trim()).filter(Boolean);
+  return {
+    ok: true,
+    enabled: true,
+    config: {
+      enabled: true,
+      root: root.path,
+      stateRoot: stateRoot.path,
+      mirrorRoot: mirrorRoot.path,
+      d8NoteRoot,
+      d8NoteAbsent: d8Absent,
+      vaultId: "central",
+      allowedPrefixes: ["raw/articles", "raw/assets"],
+      destination: "seaweed-wiki:cloud/wiki",
+      mode: "event-watch",
+      pollFallbackEnabled: (map["clip_outbox.poll_fallback_enabled"] ?? CLIP_OUTBOX_DEFAULTS.poll_fallback_enabled) === "true",
+      reconcileSeconds: intField(map["clip_outbox.reconcile_seconds"], CLIP_OUTBOX_DEFAULTS.reconcile_seconds),
+      debounceMs: intField(map["clip_outbox.debounce_ms"], CLIP_OUTBOX_DEFAULTS.debounce_ms),
+      stableHashMs: intField(map["clip_outbox.stable_hash_ms"], CLIP_OUTBOX_DEFAULTS.stable_hash_ms),
+      maxArticleBytes: intField(map["clip_outbox.max_article_bytes"], CLIP_OUTBOX_DEFAULTS.max_article_bytes),
+      maxImages: intField(map["clip_outbox.max_images"], CLIP_OUTBOX_DEFAULTS.max_images),
+      maxImageBytes: intField(map["clip_outbox.max_image_bytes"], CLIP_OUTBOX_DEFAULTS.max_image_bytes),
+      maxBundleBytes: intField(map["clip_outbox.max_bundle_bytes"], CLIP_OUTBOX_DEFAULTS.max_bundle_bytes),
+      maxPixels: intField(map["clip_outbox.max_pixels"], CLIP_OUTBOX_DEFAULTS.max_pixels),
+      downloadConcurrency: intField(map["clip_outbox.download_concurrency"], CLIP_OUTBOX_DEFAULTS.download_concurrency),
+      imageTypes,
+      maxRedirects: intField(map["clip_outbox.max_redirects"], CLIP_OUTBOX_DEFAULTS.max_redirects),
+      requestTimeoutMs: intField(map["clip_outbox.request_timeout_ms"], CLIP_OUTBOX_DEFAULTS.request_timeout_ms),
+      localizeTimeoutMs: intField(map["clip_outbox.localize_timeout_ms"], CLIP_OUTBOX_DEFAULTS.localize_timeout_ms),
+      readyUrl: map["clip_outbox.ready_url"],
+      s3CredentialRef: map["clip_outbox.s3_credential_ref"],
+      readyCredentialRef: map["clip_outbox.ready_credential_ref"],
+      watcherLabel: PRODUCTION_WATCHER_LABEL
+    }
+  };
+}
+function clipOutboxConfigPath(home) {
+  return join22(resolveSkillwikiHome(home), ".skillwiki", ".env");
+}
+async function loadClipOutboxConfig(home) {
+  const map = await parseDotenvFile(clipOutboxConfigPath(home));
+  return resolveClipOutboxConfig(map, home || homedir());
+}
+
+// src/doctor/probes/clip-outbox.ts
+var CLIP_CHECK_IDS = [
+  "clip_config",
+  "clip_frozen_mirror",
+  "clip_push_isolation",
+  "clip_outbox_root",
+  "clip_watcher",
+  "clip_storage_credentials",
+  "clip_ready_channel",
+  "clip_mirror_listener"
+];
+function notConfigured() {
+  return CLIP_CHECK_IDS.map(
+    (id) => check("info", id, clipLabel(id), CLIP_NOT_CONFIGURED)
+  );
+}
+function clipLabel(id) {
+  switch (id) {
+    case "clip_config":
+      return "Clip outbox configuration";
+    case "clip_frozen_mirror":
+      return "Clip frozen mirror";
+    case "clip_push_isolation":
+      return "Clip push isolation";
+    case "clip_outbox_root":
+      return "Clip outbox root";
+    case "clip_watcher":
+      return "Clip outbox watcher";
+    case "clip_storage_credentials":
+      return "Clip storage credentials";
+    case "clip_ready_channel":
+      return "Clip ready channel";
+    case "clip_mirror_listener":
+      return "Clip mirror listener";
+    default:
+      return id;
+  }
+}
+function launchdLoaded(label) {
+  if (platform6() !== "darwin") return false;
+  try {
+    execSync7(`launchctl list ${label}`, {
+      encoding: "utf8",
+      timeout: 2e3,
+      stdio: ["pipe", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function watcherStatus(env, label) {
+  const fixture = env.CLIP_WATCHER_FIXTURE;
+  if (fixture === "loaded-enabled") return { loaded: true, enabled: true, kind: "production" };
+  if (fixture === "stopped") return { loaded: false, enabled: false, kind: "production" };
+  if (fixture === "retired-wiki-dev") return { loaded: true, enabled: true, kind: "retired" };
+  if (fixture === "missing") return { loaded: false, enabled: false, kind: "unknown" };
+  if (RETIRED_WATCHER_LABELS.includes(label)) {
+    return { loaded: false, enabled: false, kind: "retired" };
+  }
+  if (!launchdLoaded(label)) {
+    return { loaded: false, enabled: false, kind: "unknown" };
+  }
+  const plist = join23(process.env.HOME ?? "", "Library", "LaunchAgents", `${label}.plist`);
+  return { loaded: true, enabled: existsSync19(plist), kind: "production" };
+}
+function pushLoaded(env) {
+  if (env.CLIP_PUSH_FIXTURE === "loaded") return true;
+  if (env.CLIP_PUSH_FIXTURE === "unloaded") return false;
+  return launchdLoaded("com.karlchow.wiki-push");
+}
+function credentialPresent(env, ref) {
+  if (env.CLIP_CREDENTIAL_FIXTURE === "present") return true;
+  if (env.CLIP_CREDENTIAL_FIXTURE === "absent") return false;
+  const value = env[ref];
+  return typeof value === "string" && value.length > 0;
+}
+function listenerOk(env) {
+  if (env.CLIP_LISTENER_FIXTURE === "ok") return true;
+  return false;
+}
+function conditionalCreateEvidence(env) {
+  return env.CLIP_CONDITIONAL_CREATE_FIXTURE === "ok";
+}
+var clipOutboxProbe = {
+  id: "clip_outbox",
+  async run(ctx) {
+    if (ctx.mcpOnlyLeaf) {
+      return CLIP_CHECK_IDS.map(
+        (id) => check("info", id, clipLabel(id), MCP_ONLY_LEAF_SKIP)
+      );
+    }
+    const env = ctx.input.env ?? process.env;
+    const resolved = await loadClipOutboxConfig(ctx.input.home);
+    if (!resolved.ok) {
+      return [
+        check("error", "clip_config", clipLabel("clip_config"), resolved.message),
+        ...CLIP_CHECK_IDS.slice(1).map((id) => check("error", id, clipLabel(id), "clip configuration invalid"))
+      ];
+    }
+    if (!resolved.enabled) {
+      return notConfigured();
+    }
+    const cfg = resolved.config;
+    const frozen = existsSync19(join23(cfg.mirrorRoot, ".WIKI_GIT_FROZEN"));
+    const pushOn = ctx.vsConfig.pushEnabled !== false;
+    const pushIsLoaded = pushLoaded(env);
+    const watch = watcherStatus(env, cfg.watcherLabel);
+    const s3Creds = credentialPresent(env, cfg.s3CredentialRef);
+    const readyCreds = credentialPresent(env, cfg.readyCredentialRef);
+    const condCreate = conditionalCreateEvidence(env);
+    const listener = listenerOk(env);
+    return [
+      check("pass", "clip_config", clipLabel("clip_config"), "clip_outbox.enabled=true; schema valid"),
+      frozen ? check("pass", "clip_frozen_mirror", clipLabel("clip_frozen_mirror"), "frozen marker present") : check("error", "clip_frozen_mirror", clipLabel("clip_frozen_mirror"), "frozen marker missing; do not unfreeze"),
+      !pushOn && !pushIsLoaded ? check("pass", "clip_push_isolation", clipLabel("clip_push_isolation"), "wiki-push disabled and unloaded") : check("error", "clip_push_isolation", clipLabel("clip_push_isolation"), "wiki-push must stay disabled and unloaded"),
+      check("pass", "clip_outbox_root", clipLabel("clip_outbox_root"), "outbox and state roots are canonical and disjoint"),
+      watch.kind === "retired" ? check("error", "clip_watcher", clipLabel("clip_watcher"), "retired wiki-dev or D8 job does not satisfy the clip watcher") : watch.loaded && watch.enabled && watch.kind === "production" ? check("pass", "clip_watcher", clipLabel("clip_watcher"), `loaded and enabled: ${PRODUCTION_WATCHER_LABEL}`) : check("error", "clip_watcher", clipLabel("clip_watcher"), "production clip watcher not loaded and enabled"),
+      s3Creds && readyCreds && condCreate ? check("pass", "clip_storage_credentials", clipLabel("clip_storage_credentials"), "credential references present; conditional-create evidence available") : check("error", "clip_storage_credentials", clipLabel("clip_storage_credentials"), "missing credential reference or conditional-create evidence"),
+      readyCreds ? check("pass", "clip_ready_channel", clipLabel("clip_ready_channel"), "ready URL and credential reference present") : check("error", "clip_ready_channel", clipLabel("clip_ready_channel"), "ready credential missing"),
+      listener ? check("pass", "clip_mirror_listener", clipLabel("clip_mirror_listener"), "inbound production SSE listener configured") : check("error", "clip_mirror_listener", clipLabel("clip_mirror_listener"), "inbound SSE listener disabled or missing")
+    ];
+  }
+};
+
 // src/doctor/probes/index.ts
 var DOCTOR_PROBES = [
   environmentProbe,
@@ -4460,7 +4757,8 @@ var DOCTOR_PROBES = [
   fuseStalenessProbe,
   activationMarkerProbe,
   dsStoreNoiseProbe,
-  mcpHandshakeProbe
+  mcpHandshakeProbe,
+  clipOutboxProbe
 ];
 
 // src/doctor/runner.ts
@@ -4471,7 +4769,7 @@ function resolveSnapshotGitWorktree(home) {
   const configured = resolveConfiguredSnapshotWorktree(home);
   if (configured) return configured;
   const defaultPath = "/root/wiki-git";
-  return existsSync18(defaultPath) ? defaultPath : void 0;
+  return existsSync20(defaultPath) ? defaultPath : void 0;
 }
 var DoctorRunner = class {
   probes;
@@ -4482,6 +4780,7 @@ var DoctorRunner = class {
     return this.probes;
   }
   async run(input) {
+    input = { ...input, home: resolveSkillwikiHome(input.home, input.env) };
     const devSourceRun = isDevSourceRun(input.argv);
     const vsConfig = readVaultSyncConfig(input.home);
     const baseEnv = input.env ?? process.env;
@@ -4581,8 +4880,8 @@ function readCliPackageJson(baseUrl = import.meta.url) {
 
 // src/utils/vault-write-gates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync19, readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync3 } from "fs";
-import { join as join22, relative as relative2 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync4 } from "fs";
+import { join as join24, relative as relative2 } from "path";
 var DEFAULT_DIRTY_VOLUME_THRESHOLD = 50;
 var DEFAULT_CAPTURE_BUDGET = 20;
 var DEFAULT_NO_DECISION_STREAK = 3;
@@ -4638,7 +4937,7 @@ function isEventLedgerPath(rel) {
   return n === "meta/log-events" || n.startsWith("meta/log-events/");
 }
 function countEventLedgerFiles(vault) {
-  return listFilesRecursive(join22(vault, "meta", "log-events")).length;
+  return listFilesRecursive(join24(vault, "meta", "log-events")).length;
 }
 function measureDirtyVolume(vault) {
   const empty = (extra = {}) => ({
@@ -4654,7 +4953,7 @@ function measureDirtyVolume(vault) {
     is_git_repo: false,
     ...extra
   });
-  if (!existsSync19(vault) || !statSync3(vault).isDirectory()) {
+  if (!existsSync21(vault) || !statSync4(vault).isDirectory()) {
     return empty();
   }
   const gitDir = git(vault, ["rev-parse", "--absolute-git-dir"]);
@@ -4698,8 +4997,8 @@ function measureDirtyVolume(vault) {
     if (!rel) continue;
     if (code === "??") {
       untracked += 1;
-      const abs = join22(vault, rel);
-      if (existsSync19(abs) && statSync3(abs).isDirectory()) {
+      const abs = join24(vault, rel);
+      if (existsSync21(abs) && statSync4(abs).isDirectory()) {
         const files = listFilesRecursive(abs);
         expanded += files.length;
         addBucket(rel, files.length);
@@ -4742,9 +5041,9 @@ function listFilesRecursive(dir) {
   }
   for (const name of entries) {
     if (name === ".git") continue;
-    const p = join22(dir, name);
+    const p = join24(dir, name);
     try {
-      const st = statSync3(p);
+      const st = statSync4(p);
       if (st.isDirectory()) out.push(...listFilesRecursive(p));
       else if (st.isFile()) out.push(p);
     } catch {
@@ -4837,7 +5136,7 @@ var CAPTURE_HYGIENE_CONTRACT = `After each productive cycle (or when daily captu
 function listProjectDayCaptures(vault, project, day) {
   const found = [];
   const slug = project.replace(/^\[\[/, "").replace(/\]\]$/, "").trim();
-  if (!slug || !existsSync19(vault)) return found;
+  if (!slug || !existsSync21(vault)) return found;
   const consider = (abs, rel) => {
     if (!rel.endsWith(".md")) return;
     const base = rel.split(/[/\\]/).pop() ?? "";
@@ -4865,7 +5164,7 @@ function listProjectDayCaptures(vault, project, day) {
     }
   };
   const walk = (dir, relBase) => {
-    if (!existsSync19(dir)) return;
+    if (!existsSync21(dir)) return;
     let entries;
     try {
       entries = readdirSync7(dir);
@@ -4873,27 +5172,27 @@ function listProjectDayCaptures(vault, project, day) {
       return;
     }
     for (const name of entries) {
-      const abs = join22(dir, name);
+      const abs = join24(dir, name);
       const rel = relBase ? `${relBase}/${name}` : name;
       try {
-        const st = statSync3(abs);
+        const st = statSync4(abs);
         if (st.isDirectory()) walk(abs, rel);
         else if (st.isFile()) consider(abs, rel);
       } catch {
       }
     }
   };
-  walk(join22(vault, "raw", "transcripts"), "raw/transcripts");
-  walk(join22(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
-  walk(join22(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
-  const workRoot = join22(vault, "projects", slug, "work");
-  if (existsSync19(workRoot)) {
+  walk(join24(vault, "raw", "transcripts"), "raw/transcripts");
+  walk(join24(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
+  walk(join24(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
+  const workRoot = join24(vault, "projects", slug, "work");
+  if (existsSync21(workRoot)) {
     try {
       for (const name of readdirSync7(workRoot)) {
         if (!name.startsWith(day)) continue;
         if (!/investigate|pilot-q|research|cycle|dev-loop/.test(name)) continue;
-        const abs = join22(workRoot, name);
-        if (statSync3(abs).isDirectory()) {
+        const abs = join24(workRoot, name);
+        if (statSync4(abs).isDirectory()) {
           for (const f of listFilesRecursive(abs)) {
             const rel = relative2(vault, f).replace(/\\/g, "/");
             if (rel.endsWith(".md")) found.push(rel);
@@ -4937,7 +5236,7 @@ function evaluateCaptureBudget(input) {
   return { allowed: true, reason: "under_budget", report };
 }
 function runWritePreflight(input) {
-  if (!input.vault || !existsSync19(input.vault)) {
+  if (!input.vault || !existsSync21(input.vault)) {
     return err(GateError.VAULT_PATH_INVALID, { path: input.vault });
   }
   const want = new Set(input.checks ?? ["all"]);
@@ -4996,9 +5295,9 @@ function runWritePreflight(input) {
 }
 
 // src/commands/observe.ts
-import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { existsSync as existsSync20, statSync as statSync4 } from "fs";
-import { join as join23 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { existsSync as existsSync22, statSync as statSync5 } from "fs";
+import { join as join25 } from "path";
 import { createHash as createHash2 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
@@ -5021,7 +5320,7 @@ async function runObserve(input) {
       result: err("SCHEME_REJECTED", { message: "Text must not be empty" })
     };
   }
-  if (!existsSync20(input.vault) || !statSync4(input.vault).isDirectory()) {
+  if (!existsSync22(input.vault) || !statSync5(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: input.vault })
@@ -5047,7 +5346,7 @@ async function runObserve(input) {
       };
     }
   }
-  const transcriptsDir = join23(input.vault, "raw", "transcripts");
+  const transcriptsDir = join25(input.vault, "raw", "transcripts");
   try {
     await mkdir3(transcriptsDir, { recursive: true });
   } catch {
@@ -5059,7 +5358,7 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join23(transcriptsDir, fileName);
+  const filePath = join25(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
@@ -5077,7 +5376,7 @@ ${input.text.trim()}
   frontmatterLines.push("---");
   const content = frontmatterLines.join("\n") + body;
   try {
-    await writeFile2(filePath, content, "utf8");
+    await writeFile3(filePath, content, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -5100,8 +5399,8 @@ ${input.text.trim()}
 
 // src/commands/memory.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile7, readdir as readdir2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
-import { basename as basename2, extname, join as join24, relative as relative3, sep as sep2 } from "path";
+import { mkdir as mkdir4, readFile as readFile7, readdir as readdir2, stat as stat2, writeFile as writeFile4 } from "fs/promises";
+import { basename as basename2, extname, join as join26, relative as relative3, sep as sep3 } from "path";
 
 // src/utils/memory-authority.ts
 var TIER_RANK = {
@@ -5220,9 +5519,9 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join24(input.vault, relCachePath);
-  await mkdir4(join24(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
-  await writeFile3(absCachePath, `${JSON.stringify({
+  const absCachePath = join26(input.vault, relCachePath);
+  await mkdir4(join26(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  await writeFile4(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
     topics: state.topics,
@@ -5413,7 +5712,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists(join24(vault, relCachePath));
+  const cacheText = await readIfExists(join26(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -5822,7 +6121,7 @@ async function walkImportFiles(dir, out) {
   const entries = await readdir2(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join24(dir, entry.name);
+    const path = join26(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -5872,7 +6171,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
   const redacted = redactSensitiveContent(extracted, { file });
   const privacy = redacted.findings.length > 0 ? "sensitive" : "local";
   const sourceSlug = slugify2(basename2(file, extname(file)));
-  const relSource = relative3(sourceRoot, file).split(sep2).join("/");
+  const relSource = relative3(sourceRoot, file).split(sep3).join("/");
   const entry = {
     ...baseEntry,
     status: "ready",
@@ -5889,9 +6188,9 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join24(vault, relPath);
-  await mkdir4(join24(vault, "raw", "transcripts"), { recursive: true });
-  await writeFile3(absPath, renderImportCapture(entry, content, project, today), "utf8");
+  const absPath = join26(vault, relPath);
+  await mkdir4(join26(vault, "raw", "transcripts"), { recursive: true });
+  await writeFile4(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
     relPath,
@@ -5906,7 +6205,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists(join24(vault, candidate))) {
+  while (await readIfExists(join26(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -5944,7 +6243,7 @@ function hiddenString(entry, key) {
   return entry[key] ?? "";
 }
 function classifyImportSource(file) {
-  const rel = file.split(sep2).join("/");
+  const rel = file.split(sep3).join("/");
   const name = basename2(file);
   if (rel.includes("/.codex/memories/")) return "codex-memory";
   if (rel.includes("/.codex/rules/")) return "codex-rule";
@@ -6091,10 +6390,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists(join24(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists(join26(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists(join24(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists(join26(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -6186,7 +6485,7 @@ function slugify2(value) {
 
 // src/commands/query.ts
 import { readFile as readFile9, stat as stat4 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 
 // src/utils/rrf.ts
 var RRF_K = 60;
@@ -6202,8 +6501,8 @@ function fuseRankings(lists, k = RRF_K) {
 
 // src/utils/vector-index.ts
 import { mkdir as mkdir5, readFile as readFile8, stat as stat3 } from "fs/promises";
-import { join as join25 } from "path";
-import { existsSync as existsSync21 } from "fs";
+import { join as join27 } from "path";
+import { existsSync as existsSync23 } from "fs";
 var VECTOR_INDEX_REL = ".skillwiki/vectors/index.json";
 var VECTOR_INDEX_SCHEMA = "skillwiki-tfidf-index/v1";
 function tokenize(text) {
@@ -6217,7 +6516,7 @@ function extractPageTokens(text) {
   return tokenize(`${title} ${body}`);
 }
 function vectorIndexPath(vault) {
-  return join25(vault, ...VECTOR_INDEX_REL.split("/"));
+  return join27(vault, ...VECTOR_INDEX_REL.split("/"));
 }
 function termFreq(tokens) {
   const tf = /* @__PURE__ */ new Map();
@@ -6272,7 +6571,7 @@ async function buildVectorIndex(vault, now = (/* @__PURE__ */ new Date()).toISOS
     docs
   };
   const dest = vectorIndexPath(vault);
-  await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
+  await mkdir5(join27(vault, ".skillwiki", "vectors"), { recursive: true });
   await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   return ok(index);
@@ -6315,7 +6614,7 @@ async function reindexPageInVectorIndex(vault, pageRelPath, now = (/* @__PURE__
   if (!normalizedPage.endsWith(".md")) {
     return err("USAGE", { message: `Page must be a .md file: ${pageRelPath}` });
   }
-  const absPath = join25(vault, ...normalizedPage.split("/"));
+  const absPath = join27(vault, ...normalizedPage.split("/"));
   let text;
   try {
     text = await readFile8(absPath, "utf8");
@@ -6400,7 +6699,7 @@ async function reindexPageInVectorIndex(vault, pageRelPath, now = (/* @__PURE__
     }
   }
   const dest = vectorIndexPath(vault);
-  await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
+  await mkdir5(join27(vault, ".skillwiki", "vectors"), { recursive: true });
   await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   return ok({
@@ -6418,8 +6717,8 @@ async function pruneVectorIndex(vault, opts) {
   const orphans = [];
   for (const docKey of Object.keys(index.docs)) {
     const normalizedKey = docKey.split(/\\|\//).join("/");
-    const absPath = join25(vault, ...normalizedKey.split("/"));
-    if (!existsSync21(absPath)) {
+    const absPath = join27(vault, ...normalizedKey.split("/"));
+    if (!existsSync23(absPath)) {
       orphans.push(normalizedKey);
     }
   }
@@ -6465,7 +6764,7 @@ async function pruneVectorIndex(vault, opts) {
       index.docs[docKey] = toTfIdf(termFreq(tokens), index.df, newPageCount);
     } else {
       try {
-        const text = await readFile8(join25(vault, ...docKey.split("/")), "utf8");
+        const text = await readFile8(join27(vault, ...docKey.split("/")), "utf8");
         const tokens = extractPageTokens(text);
         index.docs[docKey] = toTfIdf(termFreq(tokens), index.df, newPageCount);
       } catch {
@@ -6475,7 +6774,7 @@ async function pruneVectorIndex(vault, opts) {
   }
   if (!opts?.dryRun) {
     const dest = vectorIndexPath(vault);
-    await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
+    await mkdir5(join27(vault, ".skillwiki", "vectors"), { recursive: true });
     await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   }
@@ -6606,7 +6905,7 @@ async function runQuery(input) {
   }
   let pendingSources;
   if (input.includePending) {
-    const { runSourcesPending: runSourcesPending2 } = await import("./sources-QTQSZMST.js");
+    const { runSourcesPending: runSourcesPending2 } = await import("./sources-CLOF5VAT.js");
     const pending = await runSourcesPending2({
       vault: input.vault,
       match: input.text,
@@ -6776,7 +7075,7 @@ function computeKeywordScore(terms, title, tags, body, relPath) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join26(vault, ".skillwiki", "graph.json");
+  const graphPath = join28(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
     const fileStat = await stat4(graphPath);
@@ -6865,27 +7164,27 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join27, resolve as resolve4 } from "path";
+import { join as join29, resolve as resolve5 } from "path";
 
 // src/mcp/allowlist.ts
-import { resolve as resolve3, sep as sep3 } from "path";
-import { realpathSync } from "fs";
+import { resolve as resolve4, sep as sep4 } from "path";
+import { realpathSync as realpathSync2 } from "fs";
 function parseVaultAllowlist(envValue) {
   if (envValue === void 0 || envValue.trim() === "") return null;
-  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve3(p));
+  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve4(p));
 }
 function vaultAllowedByList(vaultPath, allowlist) {
   if (!allowlist || allowlist.length === 0) return true;
   let canonical = vaultPath;
   try {
-    canonical = realpathSync(vaultPath);
+    canonical = realpathSync2(vaultPath);
   } catch {
-    canonical = resolve3(vaultPath);
+    canonical = resolve4(vaultPath);
   }
-  const resolved = resolve3(canonical);
+  const resolved = resolve4(canonical);
   return allowlist.some((root) => {
-    const r = resolve3(root);
-    return resolved === r || resolved.startsWith(r + sep3);
+    const r = resolve4(root);
+    return resolved === r || resolved.startsWith(r + sep4);
   });
 }
 function getVaultAllowlistFromEnv() {
@@ -6894,11 +7193,11 @@ function getVaultAllowlistFromEnv() {
 
 // src/mcp/vault-resolve.ts
 async function resolveMcpVault(input) {
-  const home = input.home ?? process.env.HOME ?? "";
+  const home = resolveSkillwikiHome(input.home);
   let vaultPath;
   let source = "resolved";
   if (input.vault !== void 0 && input.vault.length > 0) {
-    vaultPath = resolve4(input.vault);
+    vaultPath = resolve5(input.vault);
     source = "flag";
   } else {
     const r = await resolveRuntimePath({
@@ -6910,7 +7209,7 @@ async function resolveMcpVault(input) {
       cwd: input.cwd ?? process.cwd()
     });
     if (!r.ok) return r;
-    vaultPath = resolve4(r.data.path);
+    vaultPath = resolve5(r.data.path);
     source = r.data.source;
   }
   const scan = await scanVault(vaultPath);
@@ -6927,7 +7226,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join27(vault, ".skillwiki", "graph.json");
+  return join29(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -6943,8 +7242,7 @@ function formatToolResult(payload) {
 
 // src/mcp/audit-log.ts
 import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
-import { homedir } from "os";
-import { join as join28 } from "path";
+import { join as join30 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -6956,7 +7254,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join28(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join30(resolveSkillwikiHome(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -6966,7 +7264,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync2(join28(path, ".."), { recursive: true });
+  mkdirSync2(join30(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -7059,7 +7357,7 @@ function registerMcpTools(server) {
       await resolveMcpVault({ vault, wiki });
       const pkg = readCliPackageJson();
       const r = await runDoctor({
-        home: process.env.HOME ?? "",
+        home: resolveSkillwikiHome(),
         envValue: process.env.WIKI_PATH,
         argv: process.argv,
         currentVersion: pkg.version,
@@ -7132,7 +7430,7 @@ function registerMcpTools(server) {
       })
     },
     async ({ key }) => runMcpToolHandler("skillwiki.config_get", {}, async () => {
-      const r = await runConfigGet({ key, home: process.env.HOME ?? "" });
+      const r = await runConfigGet({ key, home: resolveSkillwikiHome() });
       return formatToolResult(r);
     })
   );
@@ -7241,7 +7539,7 @@ function registerMcpMutatingTools(server) {
 
 // src/mcp/resources.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -7371,8 +7669,8 @@ async function fetchQueryPreview(input) {
 
 // src/mcp/graph-html.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join29 } from "path";
-import { existsSync as existsSync22 } from "fs";
+import { join as join31 } from "path";
+import { existsSync as existsSync24 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
   concepts: "#27ae60",
@@ -7440,9 +7738,9 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join29(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join31(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
-  if (!existsSync22(graphPath)) {
+  if (!existsSync24(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("GRAPH_MISSING", { path: graphPath, hint: "Run skillwiki.graph_build first." })
@@ -7514,7 +7812,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile11(join30(vault, rel), "utf8");
+  return readFile11(join32(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -7600,7 +7898,7 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join30(v.data.vault, ".skillwiki", "graph.json");
+      const path = join32(v.data.vault, ".skillwiki", "graph.json");
       try {
         const raw = await readFile11(path, "utf8");
         const graph = JSON.parse(raw);
@@ -7955,6 +8253,7 @@ export {
   MCP_TOKEN_ENV,
   MCP_HOST_ID_ENV,
   nonEmptyEnvValue,
+  mcpAuthFromEnv,
   mergeMcpAuthIntoEnv,
   redactMcpSecret,
   configPath,
@@ -7972,7 +8271,10 @@ export {
   readSatelliteLatestRunFromText,
   readSatelliteLatestRunAt,
   evaluateSatelliteRunHealthState,
+  withMcpClient,
   DEFAULT_MCP_URL,
+  CLIP_NOT_CONFIGURED,
+  loadClipOutboxConfig,
   runDoctor,
   readCliPackageJson,
   DEFAULT_DIRTY_VOLUME_THRESHOLD,