skillwiki 0.10.111 → 0.10.112

package/dist/{chunk-5IBLXGLY.js → chunk-CKQPUHM2.js}

@@ -4,11 +4,11 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-TKX6PSWZ.js";
 import {
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/chunk-DOHWNPAZ.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import {
+  parseDotenvFile,
+  resolveSkillwikiHome
+} from "./chunk-SKOLE6US.js";
+
+// src/utils/mcp-auth-env.ts
+import { join } from "path";
+var MCP_URL_ENV = "SKILLWIKI_MCP_URL";
+var MCP_TOKEN_ENV = "SKILLWIKI_MCP_TOKEN";
+var MCP_HOST_ID_ENV = "SKILLWIKI_HOST_ID";
+function nonEmptyEnvValue(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mcpAuthFromEnv(env) {
+  return {
+    url: nonEmptyEnvValue(env[MCP_URL_ENV]),
+    token: nonEmptyEnvValue(env[MCP_TOKEN_ENV]),
+    hostId: nonEmptyEnvValue(env[MCP_HOST_ID_ENV])
+  };
+}
+async function resolveMcpAuthEnv(input) {
+  const processAuth = mcpAuthFromEnv(input.env ?? process.env);
+  const dotenv = await parseDotenvFile(join(resolveSkillwikiHome(input.home, input.env), ".skillwiki", ".env"));
+  const fileAuth = mcpAuthFromEnv(dotenv);
+  return {
+    url: processAuth.url ?? fileAuth.url,
+    token: processAuth.token ?? fileAuth.token,
+    hostId: processAuth.hostId ?? fileAuth.hostId
+  };
+}
+async function mergeMcpAuthIntoEnv(home, env) {
+  const auth = await resolveMcpAuthEnv({ home, env });
+  const merged = { ...env };
+  if (auth.url && !nonEmptyEnvValue(env[MCP_URL_ENV])) merged[MCP_URL_ENV] = auth.url;
+  if (auth.token && !nonEmptyEnvValue(env[MCP_TOKEN_ENV])) merged[MCP_TOKEN_ENV] = auth.token;
+  if (auth.hostId && !nonEmptyEnvValue(env[MCP_HOST_ID_ENV])) merged[MCP_HOST_ID_ENV] = auth.hostId;
+  return merged;
+}
+function redactMcpSecret(text, secret) {
+  if (!secret || secret.length === 0 || !text.includes(secret)) return text;
+  return text.split(secret).join("[REDACTED]");
+}
+function isMcpOnlyLeaf(input) {
+  return !input.resolvedPath && Boolean(input.token) && !input.vaultSyncInstalled;
+}
+
+export {
+  MCP_URL_ENV,
+  MCP_TOKEN_ENV,
+  MCP_HOST_ID_ENV,
+  nonEmptyEnvValue,
+  mcpAuthFromEnv,
+  resolveMcpAuthEnv,
+  mergeMcpAuthIntoEnv,
+  redactMcpSecret,
+  isMcpOnlyLeaf
+};

package/dist/{chunk-GQWCTJTU.js → chunk-EE7W3GLA.js}

@@ -2,7 +2,7 @@
 import {
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/atomic-write.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-KWEYA3OE.js → chunk-FCA3RRNF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-EE7W3GLA.js";
 
 // src/clip-outbox/journal.ts
 import { mkdir, readFile, open } from "fs/promises";

package/dist/{chunk-MRPJ7X7W.js → chunk-IR2DI4Y5.js}

@@ -2,14 +2,14 @@
 import {
   ROOT_INDEX_SECTION_ORDER,
   buildRootIndexUniverse
-} from "./chunk-I6IRJCUJ.js";
+} from "./chunk-KJG2CSYD.js";
 import {
   atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-EE7W3GLA.js";
 import {
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";

package/dist/chunk-K3M6OSUW.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// src/clip-outbox/files.ts
+import { constants } from "fs";
+import { lstat, mkdir, open, realpath } from "fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
+async function readRegular(root, path, maxBytes) {
+  const rel = relative(root, path);
+  if (!rel || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel)) throw new Error("unsafe input path");
+  let current = resolve(root);
+  for (const part of ["", ...rel.split(sep)]) {
+    current = resolve(current, part);
+    const st = await lstat(current);
+    if (st.isSymbolicLink()) throw new Error("symlink input refused");
+    if (current !== path && !st.isDirectory()) throw new Error("invalid input parent");
+  }
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.size > maxBytes) throw new Error("input type or size refused");
+    const bytes = Buffer.alloc(before.size + 1);
+    let bytesRead = 0;
+    while (bytesRead < bytes.length) {
+      const chunk = await handle.read(bytes, bytesRead, bytes.length - bytesRead, bytesRead);
+      if (chunk.bytesRead === 0) break;
+      bytesRead += chunk.bytesRead;
+    }
+    const after = await handle.stat();
+    if (await realpath(path) !== path) throw new Error("input path changed during read");
+    const leaf = await lstat(path);
+    if (leaf.ino !== before.ino || leaf.dev !== before.dev) throw new Error("input identity changed during read");
+    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) throw new Error("input changed during read");
+    return bytes.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function writeRegularExclusive(root, rel, body) {
+  const dest = resolve(root, ...rel.split("/"));
+  const checked = relative(root, dest);
+  if (!checked || checked.startsWith(`..${sep}`) || checked === ".." || isAbsolute(checked)) throw new Error("unsafe dest path");
+  let current = resolve(root);
+  const parts = checked.split(sep);
+  for (let i = 0; i < parts.length - 1; i++) {
+    current = resolve(current, parts[i]);
+    try {
+      const st = await lstat(current);
+      if (st.isSymbolicLink()) throw new Error("symlink dest refused");
+      if (!st.isDirectory()) throw new Error("invalid dest parent");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await mkdir(current);
+    }
+  }
+  const leaf = resolve(current, parts[parts.length - 1]);
+  if (dirname(leaf) !== current) throw new Error("unsafe dest path");
+  try {
+    const handle = await open(leaf, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 420);
+    try {
+      await handle.writeFile(body);
+    } finally {
+      await handle.close();
+    }
+    return "created";
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const st = await lstat(leaf);
+    if (st.isSymbolicLink() || !st.isFile() || st.size !== body.length) return "conflict";
+    const existing = await readRegular(root, leaf, body.length);
+    return existing.equals(body) ? "idempotent" : "conflict";
+  }
+}
+
+export {
+  readRegular,
+  writeRegularExclusive
+};

package/dist/{chunk-I6IRJCUJ.js → chunk-KJG2CSYD.js}

@@ -3,14 +3,14 @@ import {
   extractFrontmatter,
   scanSensitiveContent,
   scanVault
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-TKX6PSWZ.js";
 import {
   MetaSchema,
   TypedKnowledgeSchema,
   detectSchema,
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/index-universe.ts
 import { readFile } from "fs/promises";

package/dist/chunk-LOVLZNLX.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import {
+  ExitCode,
+  err,
+  ipv4InCidr,
+  isBlockedHost,
+  ok
+} from "./chunk-7POLZOFY.js";
+
+// src/commands/fetch-guard.ts
+var REDACT_PARAMS = /* @__PURE__ */ new Set(["api_key", "token", "key", "auth", "password", "secret", "access_token"]);
+var PATH_TOKEN_RE = /[A-Fa-f0-9]{32,}|[A-Za-z0-9_\-]{40,}/g;
+function runFetchGuard(input) {
+  return Promise.resolve(runFetchGuardSync(input));
+}
+function runFetchGuardSync(input) {
+  let u;
+  try {
+    u = new URL(input.url);
+  } catch {
+    return { exitCode: ExitCode.MALFORMED_URL, result: err("MALFORMED_URL", { url: input.url }) };
+  }
+  const sanitized = sanitizeUrl(u);
+  if (u.protocol !== "https:") {
+    return {
+      exitCode: ExitCode.SCHEME_REJECTED,
+      result: err("SCHEME_REJECTED", { sanitized_url: sanitized, scheme: u.protocol })
+    };
+  }
+  if (isBlockedHost(u.hostname)) {
+    return {
+      exitCode: ExitCode.HOST_BLOCKED,
+      result: err("HOST_BLOCKED", { sanitized_url: sanitized, host: u.hostname })
+    };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ allowed: true, sanitized_url: sanitized, humanHint: `ALLOWED: ${sanitized}` }) };
+}
+function sanitizeUrl(u) {
+  const clone = new URL(u.toString());
+  if (clone.username || clone.password) {
+    clone.username = "";
+    clone.password = "";
+  }
+  for (const k of Array.from(clone.searchParams.keys())) {
+    if (REDACT_PARAMS.has(k.toLowerCase())) clone.searchParams.set(k, "REDACTED");
+  }
+  let s = clone.toString();
+  s = s.replace(PATH_TOKEN_RE, "REDACTED");
+  return s;
+}
+
+// src/clip-outbox/ssrf.ts
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
+var extraBlockedV4 = [
+  ["0.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["192.0.2.0", 24],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+];
+function isBlockedAddress(address) {
+  if (isBlockedHost(address)) return true;
+  const version = isIP(address);
+  if (version === 4) {
+    return extraBlockedV4.some(([base, prefix]) => ipv4InCidr(address, base, prefix));
+  }
+  if (version === 6) {
+    const lower = address.toLowerCase();
+    return lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+  }
+  return false;
+}
+async function assertPublicHttpsUrl(url, lookup = defaultLookup) {
+  const guard = runFetchGuardSync({ url });
+  if (!guard.result.ok) {
+    return { ok: false, reason: guard.result.error };
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, reason: "MALFORMED_URL" };
+  }
+  if (isBlockedAddress(parsed.hostname)) {
+    return { ok: false, reason: "HOST_BLOCKED" };
+  }
+  try {
+    const addresses = await lookup(parsed.hostname);
+    if (addresses.length === 0) return { ok: false, reason: "DNS_EMPTY" };
+    if (addresses.some(isBlockedAddress)) return { ok: false, reason: "HOST_BLOCKED" };
+  } catch {
+    return { ok: false, reason: "DNS_FAILED" };
+  }
+  return { ok: true, href: parsed.href };
+}
+async function defaultLookup(hostname) {
+  if (isIP(hostname)) return [hostname];
+  const v4 = await dnsLookup(hostname, { all: true, verbatim: true });
+  return v4.map((row) => row.address);
+}
+
+export {
+  runFetchGuard,
+  runFetchGuardSync,
+  assertPublicHttpsUrl,
+  defaultLookup
+};

package/dist/{chunk-HBJLFPQP.js → chunk-Q6EZF37H.js}

@@ -18,10 +18,10 @@ import {
   resolveExistingRegularFileInsideVault,
   stripFencedBlocks,
   writeLogEvent
-} from "./chunk-5IBLXGLY.js";
+} from "./chunk-CKQPUHM2.js";
 import {
   buildRootIndexUniverse
-} from "./chunk-I6IRJCUJ.js";
+} from "./chunk-KJG2CSYD.js";
 import {
   extractFrontmatter,
   filterGitIgnoredRelativePaths,
@@ -34,23 +34,23 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-TKX6PSWZ.js";
+import {
+  atomicWriteText
+} from "./chunk-EE7W3GLA.js";
 import {
   parseDotenvFile,
   parseDotenvText,
   profileKey,
   resolveSkillwikiHome
-} from "./chunk-PYPPG7RF.js";
-import {
-  atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-SKOLE6US.js";
 import {
   ExitCode,
   FleetManifestSchema,
   err,
   getErrorMessage,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/managed-write-preflight.ts
 import { existsSync as existsSync11 } from "fs";

package/dist/{chunk-JQV5KNPT.js → chunk-RR6VDWSI.js}

@@ -8,20 +8,20 @@ import {
   readLogEvents,
   resolveExistingRegularFileInsideVault,
   writeLogEvent
-} from "./chunk-5IBLXGLY.js";
+} from "./chunk-CKQPUHM2.js";
 import {
   extractFrontmatter,
   readPage,
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-TKX6PSWZ.js";
 import {
   ExitCode,
   RawSourceSchema,
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/commands/sources.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/{chunk-PYPPG7RF.js → chunk-SKOLE6US.js}

@@ -2,7 +2,7 @@
 import {
   isClipOutboxKey,
   isVaultSyncKey
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/home.ts
 import { homedir } from "os";

package/dist/{chunk-X5GL2FCU.js → chunk-TKX6PSWZ.js}

@@ -3,7 +3,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/parsers/frontmatter.ts
 import yaml from "js-yaml";

package/dist/cli.js

@@ -1,8 +1,4 @@
 #!/usr/bin/env node
-import {
-  runFetchGuard,
-  runFetchGuardSync
-} from "./chunk-I2J3IJB7.js";
 import {
   buildDeleteIntent,
   normalizeVaultRelPath,
@@ -16,9 +12,6 @@ import {
   DEFAULT_MCP_URL,
   DEFAULT_NO_DECISION_STREAK,
   GateError,
-  MCP_HOST_ID_ENV,
-  MCP_TOKEN_ENV,
-  MCP_URL_ENV,
   PUSH_NOT_IN_PROFILE,
   SATELLITE_STALE_MS,
   buildVectorIndex,
@@ -31,17 +24,13 @@ import {
   guardProtectedVaultWrite,
   isEventLedgerPath,
   isFailedRunStatus,
-  mcpAuthFromEnv,
   measureDirtyVolume,
   memoryAuthorityTiersRank,
-  mergeMcpAuthIntoEnv,
-  nonEmptyEnvValue,
   pruneVectorIndex,
   readCliPackageJson,
   readSatelliteLatestRunAt,
   readSatelliteLatestRunFromText,
   readVaultSyncConfig,
-  redactMcpSecret,
   reindexPageInVectorIndex,
   renderIndexUpsert,
   renderProjectIndex,
@@ -75,7 +64,7 @@ import {
   upsertIndexEntry,
   vectorIndexStatus,
   withMcpClient
-} from "./chunk-OJJBZDPR.js";
+} from "./chunk-APKDTEVV.js";
 import {
   applySourceDisposition,
   decodeSourceActionApproval,
@@ -83,7 +72,7 @@ import {
   inventorySources,
   planSourceDisposition,
   runSourcesPending
-} from "./chunk-JQV5KNPT.js";
+} from "./chunk-RR6VDWSI.js";
 import {
   normalizeDistTag,
   readCache,
@@ -96,7 +85,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-MRPJ7X7W.js";
+} from "./chunk-IR2DI4Y5.js";
 import {
   FLEET_REL_PATH,
   REDACTED_MALFORMED_REFERENCE,
@@ -184,7 +173,7 @@ import {
   stageVaultContentChanges,
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage
-} from "./chunk-HBJLFPQP.js";
+} from "./chunk-Q6EZF37H.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -201,11 +190,11 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-5IBLXGLY.js";
+} from "./chunk-CKQPUHM2.js";
 import {
   assertTargetInsideVault,
   prepareTypedPage
-} from "./chunk-I6IRJCUJ.js";
+} from "./chunk-KJG2CSYD.js";
 import {
   extractFrontmatter,
   mapWithConcurrency,
@@ -217,25 +206,38 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-TKX6PSWZ.js";
+import {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret
+} from "./chunk-DOHWNPAZ.js";
 import {
   CLIP_MIGRATION_HINT,
   refreshInstalledClipPlist
-} from "./chunk-TDBUJUYH.js";
+} from "./chunk-25OXNFDV.js";
+import {
+  atomicWriteText
+} from "./chunk-EE7W3GLA.js";
 import {
   CLIP_NOT_CONFIGURED,
   loadClipOutboxConfig
-} from "./chunk-6OQLBNKR.js";
+} from "./chunk-ABRYBO4T.js";
+import {
+  runFetchGuard,
+  runFetchGuardSync
+} from "./chunk-LOVLZNLX.js";
 import {
   parseDotenvFile,
   parseDotenvText,
   profileKey,
   resolveSkillwikiHome,
   writeDotenv
-} from "./chunk-PYPPG7RF.js";
-import {
-  atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-SKOLE6US.js";
 import {
   ExitCode,
   MetaSchema,
@@ -245,7 +247,7 @@ import {
   err,
   ok,
   resolveSessionKind
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/cli.ts
 import { join as join44 } from "path";
@@ -3583,7 +3585,7 @@ async function runClipOutboxStatus(home) {
       result: ok({ enabled: false, humanHint: CLIP_NOT_CONFIGURED })
     };
   }
-  const { readJournal: readJournal2 } = await import("./journal-QU5IDXQF.js");
+  const { readJournal: readJournal2 } = await import("./journal-5IW3TZ5F.js");
   let queue;
   try {
     queue = (await readJournal2(resolved.config.stateRoot)).map(({ captureId, state, reason, attempts }) => ({ captureId, state, reason, attempts }));
@@ -3601,7 +3603,7 @@ async function runClipOutboxStatus(home) {
 }
 async function runClipOutboxInstall(input) {
   try {
-    const { migrateClipOutbox } = await import("./migrate-PIB4QA54.js");
+    const { migrateClipOutbox } = await import("./migrate-RO4BJP5T.js");
     return { exitCode: ExitCode.OK, result: ok(await migrateClipOutbox(input)) };
   } catch (e) {
     return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: e instanceof Error ? e.message : "clip migration failed" }) };
@@ -3614,10 +3616,10 @@ async function runClipOutboxWatch(home) {
   let client;
   try {
     const { S3Client: S3Client3 } = await import("@aws-sdk/client-s3");
-    const { loadClipCredentials, validateRuntime } = await import("./runtime-GLMI5OCT.js");
+    const { loadClipCredentials, validateRuntime } = await import("./runtime-VMFYW2K3.js");
     const { createS3CreateOnlyPut, parseDestination } = await import("./upload-HTE62TOV.js");
     const { postReadyHint } = await import("./ready-S7F53Q2D.js");
-    const { startClipWorker } = await import("./watcher-MHG46J3R.js");
+    const { startClipWorker } = await import("./watcher-MGHQD3UI.js");
     const cfg = resolved.config;
     const credentials = await loadClipCredentials(home, cfg);
     await validateRuntime(home, cfg, credentials.s3.endpoint);
@@ -3653,6 +3655,47 @@ async function runClipOutboxWatch(home) {
     client?.destroy();
   }
 }
+async function runClipOutboxMirrorWatch(home) {
+  const resolved = await loadClipOutboxConfig(home);
+  if (!resolved.ok || !resolved.enabled) return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { message: resolved.ok ? CLIP_NOT_CONFIGURED : resolved.message }) };
+  let client;
+  const abort = new AbortController();
+  try {
+    const { S3Client: S3Client3 } = await import("@aws-sdk/client-s3");
+    const { loadClipCredentials, validateRuntime } = await import("./runtime-VMFYW2K3.js");
+    const { createS3GetObject, eventsUrlFromMcp, parseDestinationForMirror, startMirrorListener } = await import("./mirror-H5BTBAON.js");
+    const { resolveMcpAuthEnv } = await import("./mcp-auth-env-X5MI5IX6.js");
+    const cfg = resolved.config;
+    const credentials = await loadClipCredentials(home, cfg);
+    await validateRuntime(home, cfg, credentials.s3.endpoint);
+    const auth = await resolveMcpAuthEnv({ home });
+    if (!auth.url || !auth.token) throw new Error("MCP bearer required for inbound SSE");
+    const destination = parseDestinationForMirror(cfg.destination);
+    client = new S3Client3({ endpoint: credentials.s3.endpoint, region: credentials.s3.region, credentials: credentials.s3, forcePathStyle: true, maxAttempts: 1 });
+    const done = new Promise((resolve9) => {
+      abort.signal.addEventListener("abort", () => resolve9(), { once: true });
+    });
+    process.once("SIGTERM", () => abort.abort());
+    process.once("SIGINT", () => abort.abort());
+    await Promise.race([
+      startMirrorListener({
+        home,
+        config: cfg,
+        eventsUrl: eventsUrlFromMcp(auth.url),
+        mcpToken: auth.token,
+        getObject: createS3GetObject({ client, bucket: destination.bucket, prefix: destination.prefix, maxBytes: cfg.maxBundleBytes }),
+        signal: abort.signal
+      }),
+      done
+    ]);
+    return { exitCode: ExitCode.OK, result: ok({ humanHint: "Inbound SSE listener stopped." }) };
+  } catch {
+    return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "inbound SSE listener startup failed; check MCP bearer, clip credentials, frozen mirror and wiki-push isolation" }) };
+  } finally {
+    abort.abort();
+    client?.destroy();
+  }
+}
 
 // src/commands/connect.ts
 import { chmod, mkdir as mkdir5, readFile as readFile6, stat as stat3 } from "fs/promises";
@@ -4132,7 +4175,7 @@ ${fmRewritten}
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-UNZG5UJZ.js");
     const before = await readFile7(join19(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -4255,7 +4298,7 @@ async function runRemove(input) {
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
     const { readFile: readFile23 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-UNZG5UJZ.js");
     const before = await readFile23(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -11263,7 +11306,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-GRSHQYKC.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-L7IRQ76C.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -11910,7 +11953,8 @@ program.command("doctor").description("diagnose skillwiki setup issues").option(
 var clipOutboxCmd = program.command("clip-outbox").description("dedicated file-level web-clip outbox");
 clipOutboxCmd.command("status").description("show whether the clip-outbox channel is configured").action(async () => emit(await runClipOutboxStatus(resolveSkillwikiHome())));
 clipOutboxCmd.command("watch").description("run the enabled dedicated outbox worker using macOS FSEvents").action(async () => emit(await runClipOutboxWatch(resolveSkillwikiHome())));
-clipOutboxCmd.command("install-or-migrate").description("refresh the packaged launchd plist without enabling the channel").option("--load", "attended launchd bootstrap; requires existing enabled=true", false).option("--conditional-create-proven", "attest the deployed SeaweedFS If-None-Match:* race test passed", false).action(async (opts) => emit(await runClipOutboxInstall({ home: resolveSkillwikiHome(), load: opts.load, conditionalCreateProven: opts.conditionalCreateProven })));
+clipOutboxCmd.command("mirror-watch").description("copy admitted raw/articles and raw/assets from storage into the frozen mirror using MCP SSE").action(async () => emit(await runClipOutboxMirrorWatch(resolveSkillwikiHome())));
+clipOutboxCmd.command("install-or-migrate").description("refresh the packaged launchd plist without enabling the channel").option("--load", "attended clip watcher bootstrap; requires existing enabled=true", false).option("--load-mirror", "attended inbound SSE bootstrap; requires existing enabled=true; never auto-loaded on upgrade", false).option("--conditional-create-proven", "attest the deployed SeaweedFS If-None-Match:* race test passed", false).action(async (opts) => emit(await runClipOutboxInstall({ home: resolveSkillwikiHome(), load: opts.load, loadMirror: opts.loadMirror, conditionalCreateProven: opts.conditionalCreateProven })));
 program.command("connect").description(CONNECT_DESCRIPTION).option("--from-file <path>", "chat-attached env file (not Drive / \u4E91\u76D8)").option("--from-stdin", "read env file from stdin (no echo)").option("--dry-run", "validate without writing ~/.skillwiki/.env").option("--force", "overwrite a different existing token").action(async (opts) => emit(await runConnect({
   home: resolveSkillwikiHome(),
   fromFile: opts.fromFile,