skillwiki 0.9.1 → 0.9.4

package/dist/cli.js

@@ -14,7 +14,7 @@ import {
 } from "./chunk-TPS5XD2J.js";
 
 // src/cli.ts
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 import { Command as Command2 } from "commander";
 
 // ../shared/src/exit-codes.ts
@@ -69,7 +69,8 @@ var ExitCode = {
   BODY_TRUNCATION_GUARD: 47,
   SYNC_LOCK_HELD: 48,
   LOG_APPEND_LOCK_HELD: 49,
-  FLEET_MANIFEST_INVALID: 50
+  FLEET_MANIFEST_INVALID: 50,
+  SENSITIVE_CONTENT_DETECTED: 51
 };
 
 // ../shared/src/json-output.ts
@@ -450,6 +451,148 @@ function sanitizeUrl(u) {
 // src/commands/validate.ts
 import { readFile as readFile2, writeFile } from "fs/promises";
 import { join as join2, resolve, relative, sep } from "path";
+
+// src/utils/sensitive-content.ts
+import { createHash as createHash2 } from "crypto";
+var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
+var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
+var MATCHERS = [
+  {
+    kind: "private_key",
+    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
+  },
+  {
+    kind: "authorization_header",
+    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "cookie",
+    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "jwt",
+    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "provider_key",
+    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "api_key",
+    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "password",
+    re: /\b(?:pass(?:word|wd)?)["']?\s*[:=]\s*["']?([^\s`"']{8,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "secret",
+    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "token",
+    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  }
+];
+function fingerprint(value) {
+  return createHash2("sha256").update(value).digest("hex").slice(0, 12);
+}
+function lineFor(text, offset) {
+  return text.slice(0, offset).split(/\r?\n/).length;
+}
+function redactMarker(kind, value) {
+  return `[REDACTED:${kind}:${fingerprint(value)}]`;
+}
+function isSyntheticPlaceholder(value) {
+  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
+}
+function collectMatches(text) {
+  const matches = [];
+  for (const matcher of MATCHERS) {
+    matcher.re.lastIndex = 0;
+    for (const m of text.matchAll(matcher.re)) {
+      const whole = m[0];
+      const start = m.index ?? 0;
+      if (REDACTED_RE.test(whole)) continue;
+      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
+      if (isSyntheticPlaceholder(value)) continue;
+      const valueOffset = whole.lastIndexOf(value);
+      const valueStart = start + Math.max(0, valueOffset);
+      matches.push({
+        start,
+        end: start + whole.length,
+        valueStart,
+        valueEnd: valueStart + value.length,
+        kind: matcher.kind
+      });
+    }
+  }
+  return matches.sort((a, b) => {
+    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
+    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
+  });
+}
+function collapseOverlaps(matches) {
+  const kept = [];
+  for (const match of matches) {
+    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
+    if (!overlaps) kept.push(match);
+  }
+  return kept;
+}
+function scanSensitiveContent(text, opts = {}) {
+  return collapseOverlaps(collectMatches(text)).map((match) => {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    const marker = redactMarker(match.kind, value);
+    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
+    const preview = rawPreview.replace(value, marker);
+    return {
+      file: opts.file,
+      line: lineFor(text, match.valueStart),
+      kind: match.kind,
+      preview,
+      fingerprint: fingerprint(value)
+    };
+  });
+}
+function redactSensitiveContent(text, opts = {}) {
+  const matches = collapseOverlaps(collectMatches(text));
+  if (matches.length === 0) return { text, changed: false, findings: [] };
+  let out = "";
+  let cursor = 0;
+  for (const match of matches) {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    out += text.slice(cursor, match.valueStart);
+    out += redactMarker(match.kind, value);
+    cursor = match.valueEnd;
+  }
+  out += text.slice(cursor);
+  return {
+    text: out,
+    changed: out !== text,
+    findings: scanSensitiveContent(text, opts)
+  };
+}
+
+// src/commands/validate.ts
 var TYPE_TO_SECTION = {
   entity: "Entities",
   concept: "Concepts",
@@ -480,6 +623,26 @@ async function runValidate(input) {
     return { exitCode: ExitCode.INVALID_FRONTMATTER, result: fm };
   }
   const det = detectSchema(fm.data);
+  const sensitiveFindings = scanSensitiveContent(text, { file: input.file });
+  if (sensitiveFindings.length > 0) {
+    const errors = sensitiveFindings.map((f) => ({
+      path: "sensitive_content",
+      message: `${f.kind} at line ${f.line}: ${f.preview}`
+    }));
+    return {
+      exitCode: ExitCode.SENSITIVE_CONTENT_DETECTED,
+      result: ok({
+        schema: det.schema,
+        valid: false,
+        errors,
+        index_updated: false,
+        log_updated: false,
+        humanHint: `SENSITIVE CONTENT (${sensitiveFindings.length})
+${errors.map((e) => `  ${e.message}`).join("\n")}`,
+        sensitive_findings: sensitiveFindings
+      })
+    };
+  }
   if (!det.schema) {
     return { exitCode: ExitCode.SCHEMA_NOT_DETECTED, result: ok({ schema: null, valid: false, errors: [], index_updated: false, log_updated: false, humanHint: "schema not detected" }) };
   }
@@ -1159,8 +1322,8 @@ function simulateRemoval(adj, removed) {
 }
 
 // src/commands/audit.ts
-import { readFile as readFile5, stat as stat2 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve2, join as join5 } from "path";
+import { readFile as readFile5, stat as stat3 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2, join as join6 } from "path";
 
 // src/parsers/citations.ts
 var FENCE2 = /```[\s\S]*?```/g;
@@ -1178,6 +1341,7 @@ function extractCitationMarkers(body) {
   const out = [];
   let m;
   while ((m = MARKER_RE.exec(stripped)) !== null) {
+    if (m[1] === "raw/...") continue;
     out.push({ marker: m[0], target: m[1] });
   }
   return out;
@@ -1267,6 +1431,41 @@ function hasWikilinkCitations(body) {
   return /\[\[raw\/[^\]]+\]\]/.test(stripped);
 }
 
+// src/utils/raw-source.ts
+import { existsSync } from "fs";
+import { stat as stat2 } from "fs/promises";
+import { join as join5 } from "path";
+function normalizeRawSourceTarget(entry) {
+  let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
+  target = target.replace(/^\^\[/, "").replace(/\]$/, "");
+  if (!target.startsWith("raw/") && !target.startsWith("_archive/raw/")) return null;
+  return target;
+}
+function rawSourceTargetCandidates(vault, target) {
+  const normalized = normalizeRawSourceTarget(target);
+  if (!normalized) return [];
+  const candidates = [join5(vault, normalized)];
+  if (!normalized.endsWith(".md")) candidates.push(join5(vault, `${normalized}.md`));
+  if (normalized.startsWith("raw/")) {
+    candidates.push(join5(vault, "_archive", normalized));
+    if (!normalized.endsWith(".md")) candidates.push(join5(vault, "_archive", `${normalized}.md`));
+  }
+  return [...new Set(candidates)];
+}
+function rawSourceTargetExistsSync(vault, target) {
+  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync(candidate));
+}
+async function rawSourceTargetExists(vault, target) {
+  for (const candidate of rawSourceTargetCandidates(vault, target)) {
+    try {
+      await stat2(candidate);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+
 // src/commands/audit.ts
 async function runAudit(input) {
   let text;
@@ -1283,12 +1482,7 @@ async function runAudit(input) {
   if (!vault) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID") };
   const markers = extractCitationMarkers(body);
   const resolved = await Promise.all(markers.map(async (m) => {
-    try {
-      await stat2(join5(vault, m.target));
-      return { ...m, resolved: true };
-    } catch {
-      return { ...m, resolved: false };
-    }
+    return { ...m, resolved: await rawSourceTargetExists(vault, m.target) };
   }));
   const sources = (fm.data.sources ?? []).map((s) => s.replace(/^\^\[/, "").replace(/\]$/, ""));
   const referenced = new Set(resolved.map((m) => m.target));
@@ -1329,7 +1523,7 @@ async function findVaultRoot(start) {
   let cur = start;
   for (let i = 0; i < 20; i++) {
     try {
-      await stat2(join5(cur, "SCHEMA.md"));
+      await stat3(join6(cur, "SCHEMA.md"));
       return cur;
     } catch {
     }
@@ -1381,17 +1575,17 @@ async function validateCompoundReferences(vault) {
 }
 
 // src/commands/install.ts
-import { readdir as readdir2, stat as stat4, symlink, unlink, mkdir as mkdir4, readFile as readFile6 } from "fs/promises";
-import { join as join6, resolve as resolve3, dirname as dirname5 } from "path";
+import { readdir as readdir2, stat as stat5, symlink, unlink, mkdir as mkdir4, readFile as readFile6 } from "fs/promises";
+import { join as join7, resolve as resolve3, dirname as dirname5 } from "path";
 
 // src/utils/install-fs.ts
-import { copyFile, mkdir as mkdir3, rename, writeFile as writeFile4, stat as stat3 } from "fs/promises";
+import { copyFile, mkdir as mkdir3, rename, writeFile as writeFile4, stat as stat4 } from "fs/promises";
 import { dirname as dirname4 } from "path";
 async function atomicCopyWithBackup(src, dst) {
   await mkdir3(dirname4(dst), { recursive: true });
   let backupPath = null;
   try {
-    await stat3(dst);
+    await stat4(dst);
     backupPath = `${dst}.bak`;
     await copyFile(dst, backupPath);
   } catch {
@@ -1445,7 +1639,7 @@ async function runInstall(input) {
     const withSkill = [];
     for (const d of dirs) {
       try {
-        await stat4(join6(input.skillsRoot, d.name, "SKILL.md"));
+        await stat5(join7(input.skillsRoot, d.name, "SKILL.md"));
         withSkill.push(d.name);
       } catch {
       }
@@ -1462,10 +1656,10 @@ async function runInstall(input) {
   const version_warnings = [];
   const skillMetas = {};
   for (const name of entries) {
-    const src = join6(input.skillsRoot, name, "SKILL.md");
-    const dst = join6(input.target, name, "SKILL.md");
+    const src = join7(input.skillsRoot, name, "SKILL.md");
+    const dst = join7(input.target, name, "SKILL.md");
     try {
-      await stat4(src);
+      await stat5(src);
     } catch {
       return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { missing: src }) };
     }
@@ -1504,10 +1698,10 @@ async function runInstall(input) {
       if (r.data.backupPath) backed_up.push(r.data.backupPath);
     }
   }
-  const binSrc = join6(input.skillsRoot, "bin", "skillwiki");
+  const binSrc = join7(input.skillsRoot, "bin", "skillwiki");
   try {
-    await stat4(binSrc);
-    const binDst = join6(input.target, "bin", "skillwiki");
+    await stat5(binSrc);
+    const binDst = join7(input.target, "bin", "skillwiki");
     if (!input.dryRun) {
       if (input.symlink) {
         const r = await createSymlink(binSrc, binDst);
@@ -1524,7 +1718,7 @@ async function runInstall(input) {
     }
   } catch {
   }
-  const manifest_path = join6(input.target, "wiki-manifest.json");
+  const manifest_path = join7(input.target, "wiki-manifest.json");
   if (!input.dryRun) await writeManifest(manifest_path, { installed, backed_up, symlink: input.symlink || void 0, skills: skillMetas });
   const mode = input.symlink ? "symlink (dev mode)" : "copy";
   const hintLines = [
@@ -1566,7 +1760,7 @@ async function runPath(input) {
 }
 
 // src/utils/lang.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var ALIASES = {
   english: "en",
   en: "en",
@@ -1589,7 +1783,7 @@ async function resolveLang(input) {
   if (input.envValue !== void 0 && input.envValue.length > 0) {
     return { value: input.envValue, source: "env", canonical: normalizeLang(input.envValue) };
   }
-  const dotenv = await parseDotenvFile(join7(input.home, ".skillwiki", ".env"));
+  const dotenv = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
   if (dotenv.WIKI_LANG !== void 0) {
     return { value: dotenv.WIKI_LANG, source: "skillwiki-dotenv", canonical: normalizeLang(dotenv.WIKI_LANG) };
   }
@@ -1597,7 +1791,7 @@ async function resolveLang(input) {
 }
 
 // src/commands/lang.ts
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 async function runLang(input) {
   const resolved = await resolveLang({ flag: input.flag, envValue: input.envValue, home: input.home });
   let chain;
@@ -1606,7 +1800,7 @@ async function runLang(input) {
       { source: "flag", matched: input.flag !== void 0 && input.flag.length > 0, value: input.flag },
       { source: "env", matched: input.envValue !== void 0 && input.envValue.length > 0, value: input.envValue }
     ];
-    const sw = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
+    const sw = await parseDotenvFile(join9(input.home, ".skillwiki", ".env"));
     chain.push({ source: "skillwiki-dotenv", matched: sw.WIKI_LANG !== void 0, value: sw.WIKI_LANG });
     chain.push({ source: "default", matched: resolved.source === "default", value: "en" });
   }
@@ -1624,7 +1818,7 @@ async function runLang(input) {
 
 // src/commands/init.ts
 import { mkdir as mkdir5, readFile as readFile7, readdir as readdir3, writeFile as writeFile5 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/parsers/taxonomy.ts
 import yaml2 from "js-yaml";
@@ -1652,16 +1846,16 @@ function extractTaxonomy(schemaText) {
 }
 
 // src/utils/last-op.ts
-import { readFileSync as readFileSync2, writeFileSync, mkdirSync, unlinkSync, existsSync } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, unlinkSync, existsSync as existsSync2 } from "fs";
+import { join as join10 } from "path";
 var LAST_OP_DIR = ".skillwiki";
 var LAST_OP_FILE = "last-op.json";
 function lastOpPath(vault) {
-  return join9(vault, LAST_OP_DIR, LAST_OP_FILE);
+  return join10(vault, LAST_OP_DIR, LAST_OP_FILE);
 }
 function readLastOp(vault) {
   const p = lastOpPath(vault);
-  if (!existsSync(p)) return [];
+  if (!existsSync2(p)) return [];
   try {
     const raw = readFileSync2(p, "utf8");
     const parsed = JSON.parse(raw);
@@ -1681,8 +1875,8 @@ function readLastOp(vault) {
 function appendLastOp(vault, entry) {
   const existing = readLastOp(vault);
   existing.push(entry);
-  const dir = join9(vault, LAST_OP_DIR);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  const dir = join10(vault, LAST_OP_DIR);
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(lastOpPath(vault), JSON.stringify(existing, null, 2), "utf8");
 }
 function clearLastOp(vault) {
@@ -1735,13 +1929,13 @@ async function discoverTagsFromPages(target, knownSlugs) {
   for (const dir of ["entities", "concepts", "comparisons", "queries"]) {
     let entries;
     try {
-      entries = (await readdir3(join10(target, dir), { withFileTypes: true })).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => e.name);
+      entries = (await readdir3(join11(target, dir), { withFileTypes: true })).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => e.name);
     } catch {
       continue;
     }
     for (const file of entries) {
       try {
-        const text = await readFile7(join10(target, dir, file), "utf8");
+        const text = await readFile7(join11(target, dir, file), "utf8");
         const fm = extractFrontmatter(text);
         if (!fm.ok || !fm.data.tags || !Array.isArray(fm.data.tags)) continue;
         for (const t of fm.data.tags) {
@@ -1760,7 +1954,7 @@ async function runInit(input) {
   const canonicalLang = langRes.canonical;
   let oldSchemaText;
   try {
-    oldSchemaText = await readFile7(join10(target, "SCHEMA.md"), "utf8");
+    oldSchemaText = await readFile7(join11(target, "SCHEMA.md"), "utf8");
   } catch {
   }
   if (oldSchemaText && !input.force) {
@@ -1769,7 +1963,7 @@ async function runInit(input) {
       result: err("INIT_TARGET_NOT_EMPTY", { target })
     };
   }
-  const envPath = join10(input.home, ".skillwiki", ".env");
+  const envPath = join11(input.home, ".skillwiki", ".env");
   let existingEnvRaw = "";
   try {
     existingEnvRaw = await readFile7(envPath, "utf8");
@@ -1795,7 +1989,7 @@ async function runInit(input) {
   try {
     await mkdir5(target, { recursive: true });
     for (const d of VAULT_DIRS) {
-      await mkdir5(join10(target, d), { recursive: true });
+      await mkdir5(join11(target, d), { recursive: true });
       created.push(d + "/");
     }
   } catch (e) {
@@ -1824,9 +2018,9 @@ async function runInit(input) {
   const discovered_tags = discovered.length;
   const fullTaxonomyYaml = discovered.length > 0 ? taxonomy.map((t) => `  - ${t}`).join("\n") + "\n  # --- Discovered from existing pages ---\n" + discovered.map((t) => `  - ${t}`).join("\n") : taxonomy.map((t) => `  - ${t}`).join("\n");
   try {
-    const schemaTpl = await readFile7(join10(input.templates, "SCHEMA.md"), "utf8");
+    const schemaTpl = await readFile7(join11(input.templates, "SCHEMA.md"), "utf8");
     const schema = schemaTpl.replace("{{DOMAIN}}", domain).replace("{{WIKI_LANG}}", canonicalLang).replace("{{TAXONOMY_YAML}}", fullTaxonomyYaml);
-    await writeFile5(join10(target, "SCHEMA.md"), schema, "utf8");
+    await writeFile5(join11(target, "SCHEMA.md"), schema, "utf8");
     created.push("SCHEMA.md");
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { file: "SCHEMA.md", message: String(e) }) };
@@ -1834,7 +2028,7 @@ async function runInit(input) {
   const preserved = [];
   async function writeOrPreserve(fileName, render) {
     try {
-      const existing = await readFile7(join10(target, fileName), "utf8");
+      const existing = await readFile7(join11(target, fileName), "utf8");
       if (existing.split("\n").length > 10) {
         preserved.push(fileName);
         return void 0;
@@ -1842,7 +2036,7 @@ async function runInit(input) {
     } catch {
     }
     try {
-      await writeFile5(join10(target, fileName), await render(), "utf8");
+      await writeFile5(join11(target, fileName), await render(), "utf8");
       created.push(fileName);
       return void 0;
     } catch (e) {
@@ -1850,7 +2044,7 @@ async function runInit(input) {
     }
   }
   const err1 = await writeOrPreserve("index.md", async () => {
-    const tpl = await readFile7(join10(input.templates, "index.md"), "utf8");
+    const tpl = await readFile7(join11(input.templates, "index.md"), "utf8");
     return tpl.replace("{{INIT_DATE}}", today);
   });
   if (err1) return err1;
@@ -1877,7 +2071,7 @@ async function runInit(input) {
   });
   if (errTemplate) return errTemplate;
   const err22 = await writeOrPreserve("log.md", async () => {
-    const tpl = await readFile7(join10(input.templates, "log.md"), "utf8");
+    const tpl = await readFile7(join11(input.templates, "log.md"), "utf8");
     return tpl.replace(/\{\{INIT_DATE\}\}/g, today).replace("{{DOMAIN}}", domain).replace("{{WIKI_LANG}}", canonicalLang);
   });
   if (err22) return err22;
@@ -1975,11 +2169,11 @@ ${broken.map((b) => `  ${b.page}:[[${b.slug}]] (line ${b.line})`).join("\n")}` }
 
 // src/commands/tag-audit.ts
 import { readFile as readFile8 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 async function runTagAudit(input) {
   const scan = await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
-  const schemaText = await readFile8(join11(input.vault, "SCHEMA.md"), "utf8");
+  const schemaText = await readFile8(join12(input.vault, "SCHEMA.md"), "utf8");
   const tax = extractTaxonomy(schemaText);
   if (!tax.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tax };
   const allowed = new Set(tax.data);
@@ -2004,13 +2198,13 @@ async function runTagAudit(input) {
 
 // src/commands/index-check.ts
 import { readFile as readFile9 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 async function runIndexCheck(input) {
   const scan = await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
   let indexText = "";
   try {
-    indexText = await readFile9(join12(input.vault, "index.md"), "utf8");
+    indexText = await readFile9(join13(input.vault, "index.md"), "utf8");
   } catch {
   }
   const indexSlugsLower = /* @__PURE__ */ new Map();
@@ -2050,7 +2244,7 @@ async function runIndexCheck(input) {
 
 // src/commands/stale.ts
 import { readdir as readdir4, rename as rename2, mkdir as mkdir6, readFile as readFile10 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/parsers/expiry-annotations.ts
 var HEADING_RE = /^#{1,6}\s+(.+)$/;
@@ -2098,7 +2292,7 @@ async function runStale(input) {
   const archived = [];
   const workDirs = /* @__PURE__ */ new Map();
   const workDirsBySlug = /* @__PURE__ */ new Map();
-  const projectsDir = join13(input.vault, "projects");
+  const projectsDir = join14(input.vault, "projects");
   let projectSlugs = [];
   try {
     projectSlugs = (await readdir4(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2111,7 +2305,7 @@ async function runStale(input) {
     projectSlugs = [input.project];
   }
   for (const slug of projectSlugs) {
-    const workPath = join13(projectsDir, slug, "work");
+    const workPath = join14(projectsDir, slug, "work");
     let entries;
     try {
       entries = await readdir4(workPath, { withFileTypes: true });
@@ -2122,7 +2316,7 @@ async function runStale(input) {
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const relDir = `projects/${slug}/work/${e.name}`;
-      const absDir = join13(workPath, e.name);
+      const absDir = join14(workPath, e.name);
       let status = "";
       let files;
       try {
@@ -2135,7 +2329,7 @@ async function runStale(input) {
       for (const f of files) {
         if (!f.endsWith(".md")) continue;
         try {
-          const fm = extractFrontmatter(await readFile10(join13(absDir, f), "utf8"));
+          const fm = extractFrontmatter(await readFile10(join14(absDir, f), "utf8"));
           if (fm.ok && typeof fm.data.status === "string") {
             status = fm.data.status;
             break;
@@ -2159,7 +2353,7 @@ async function runStale(input) {
   const transcriptMeta = /* @__PURE__ */ new Map();
   for (const t of transcripts) {
     try {
-      const content = await readFile10(join13(input.vault, t.relPath), "utf8");
+      const content = await readFile10(join14(input.vault, t.relPath), "utf8");
       const fm = extractFrontmatter(content);
       let kind = fm.ok && typeof fm.data.kind === "string" ? fm.data.kind : "";
       let project = fm.ok && typeof fm.data.project === "string" ? fm.data.project : "";
@@ -2227,7 +2421,7 @@ async function runStale(input) {
     }
   }
   for (const [relDir] of workDirs) {
-    const specPath = join13(input.vault, relDir, "spec.md");
+    const specPath = join14(input.vault, relDir, "spec.md");
     try {
       const specContent = await readFile10(specPath, "utf8");
       const specFm = extractFrontmatter(specContent);
@@ -2258,7 +2452,7 @@ async function runStale(input) {
     if (daysSince(dateStr) < input.days) continue;
     let files;
     try {
-      files = await readdir4(join13(input.vault, relDir));
+      files = await readdir4(join14(input.vault, relDir));
     } catch {
       continue;
     }
@@ -2274,7 +2468,7 @@ async function runStale(input) {
   const stale = [];
   for (const page of scan.data.typedKnowledge) {
     try {
-      const text = await readFile10(join13(input.vault, page.relPath), "utf8");
+      const text = await readFile10(join14(input.vault, page.relPath), "utf8");
       const fm = extractFrontmatter(text);
       if (fm.ok && typeof fm.data.updated === "string") {
         if (input.project) {
@@ -2294,7 +2488,7 @@ async function runStale(input) {
   const staleSections = [];
   for (const page of scan.data.typedKnowledge) {
     try {
-      const text = await readFile10(join13(input.vault, page.relPath), "utf8");
+      const text = await readFile10(join14(input.vault, page.relPath), "utf8");
       const projectFilter = input.project;
       if (projectFilter) {
         const fm = extractFrontmatter(text);
@@ -2323,11 +2517,11 @@ async function runStale(input) {
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   if (input.archive) {
-    const archiveDir = join13(input.vault, "_archive", today);
+    const archiveDir = join14(input.vault, "_archive", today);
     await mkdir6(archiveDir, { recursive: true });
     const citedRawPaths = /* @__PURE__ */ new Set();
     for (const page of scan.data.typedKnowledge) {
-      const text = await readFile10(join13(input.vault, page.relPath), "utf8").catch(() => "");
+      const text = await readFile10(join14(input.vault, page.relPath), "utf8").catch(() => "");
       for (const line of text.split("\n")) {
         for (const m of line.matchAll(/\^\[(raw\/[^\]]+)\]/g)) {
           citedRawPaths.add(m[1]);
@@ -2339,9 +2533,9 @@ async function runStale(input) {
     }
     for (const t of staleTranscripts) {
       if (citedRawPaths.has(t.path) || citedRawPaths.has(t.path.replace(/\.md$/, ""))) continue;
-      const dest = join13(archiveDir, t.path.split("/").pop());
+      const dest = join14(archiveDir, t.path.split("/").pop());
       try {
-        await rename2(join13(input.vault, t.path), dest);
+        await rename2(join14(input.vault, t.path), dest);
         archived.push(t.path);
       } catch {
       }
@@ -2351,18 +2545,18 @@ async function runStale(input) {
       if (parts.length >= 4 && parts[0] === "projects") {
         const slug = parts[1];
         const itemName = parts[3];
-        const histDir = join13(input.vault, "projects", slug, "history", "archived-work");
+        const histDir = join14(input.vault, "projects", slug, "history", "archived-work");
         await mkdir6(histDir, { recursive: true });
-        const dest = join13(histDir, itemName);
+        const dest = join14(histDir, itemName);
         try {
-          await rename2(join13(input.vault, w.path), dest);
+          await rename2(join14(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
       } else {
-        const dest = join13(archiveDir, w.path.replace(/\//g, "_"));
+        const dest = join14(archiveDir, w.path.replace(/\//g, "_"));
         try {
-          await rename2(join13(input.vault, w.path), dest);
+          await rename2(join14(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
@@ -2402,8 +2596,8 @@ async function runStale(input) {
 
 // src/commands/claim.ts
 import { mkdir as mkdir7, writeFile as writeFile6, readFile as readFile11 } from "fs/promises";
-import { existsSync as existsSync2, statSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync3, statSync } from "fs";
+import { join as join15 } from "path";
 function extractDate(filename) {
   const m = filename.match(/^(\d{4}-\d{2}-\d{2})/);
   return m?.[1] ?? "";
@@ -2415,11 +2609,11 @@ function extractProjectSlug(projectField) {
   return projectField.replace(/^\[\[/, "").replace(/\]\]$/, "").replace(/^"|"$/g, "");
 }
 async function runClaim(input) {
-  if (!existsSync2(input.vault) || !statSync(input.vault).isDirectory()) {
+  if (!existsSync3(input.vault) || !statSync(input.vault).isDirectory()) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { path: input.vault }) };
   }
-  const absTranscript = join14(input.vault, input.transcript);
-  if (!existsSync2(absTranscript)) {
+  const absTranscript = join15(input.vault, input.transcript);
+  if (!existsSync3(absTranscript)) {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.transcript }) };
   }
   const content = await readFile11(absTranscript, "utf8");
@@ -2434,8 +2628,8 @@ async function runClaim(input) {
       result: err("SCHEME_REJECTED", { message: "No project specified. Use --project or set project in transcript frontmatter." })
     };
   }
-  const projectDir = join14(input.vault, "projects", projectSlug);
-  if (!existsSync2(projectDir) || !statSync(projectDir).isDirectory()) {
+  const projectDir = join15(input.vault, "projects", projectSlug);
+  if (!existsSync3(projectDir) || !statSync(projectDir).isDirectory()) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
       result: err("PROJECT_NOT_FOUND", { project: projectSlug })
@@ -2451,10 +2645,10 @@ async function runClaim(input) {
   }
   const workSlug = input.slug || extractSlugFromFilename(filename);
   const dirName = `${date}-${workSlug}`;
-  const workDir = join14(projectDir, "work", dirName);
+  const workDir = join15(projectDir, "work", dirName);
   const relWorkDir = `projects/${projectSlug}/work/${dirName}`;
   const relSpecPath = `${relWorkDir}/spec.md`;
-  if (existsSync2(workDir)) {
+  if (existsSync3(workDir)) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -2480,7 +2674,7 @@ async function runClaim(input) {
     `Claimed from ${input.transcript}`,
     ""
   ];
-  await writeFile6(join14(workDir, "spec.md"), specLines.join("\n"), "utf8");
+  await writeFile6(join15(workDir, "spec.md"), specLines.join("\n"), "utf8");
   appendLastOp(input.vault, {
     operation: "claim",
     summary: `claimed ${input.transcript} \u2192 ${relWorkDir}`,
@@ -2515,16 +2709,16 @@ async function runPagesize(input) {
 }
 
 // src/commands/log-rotate.ts
-import { readFile as readFile12, rename as rename3, writeFile as writeFile7, stat as stat5 } from "fs/promises";
-import { join as join15 } from "path";
+import { readFile as readFile12, rename as rename3, writeFile as writeFile7, stat as stat6 } from "fs/promises";
+import { join as join16 } from "path";
 var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 async function runLogRotate(input) {
   try {
-    await stat5(join15(input.vault, "SCHEMA.md"));
+    await stat6(join16(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
-  const logPath = join15(input.vault, "log.md");
+  const logPath = join16(input.vault, "log.md");
   let logText;
   try {
     logText = await readFile12(logPath, "utf8");
@@ -2544,7 +2738,7 @@ async function runLogRotate(input) {
   }
   const newestYear = matches[matches.length - 1][1];
   const rotatedName = `log-${newestYear}.md`;
-  const rotatedPath = join15(input.vault, rotatedName);
+  const rotatedPath = join16(input.vault, rotatedName);
   try {
     await rename3(logPath, rotatedPath);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -2570,14 +2764,14 @@ Chronological action log. Newest entries last. Skill writes append entries; lint
 }
 
 // src/commands/log-append.ts
-import { readFile as readFile13, rename as rename4, writeFile as writeFile8, stat as stat6 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile13, rename as rename4, writeFile as writeFile8, stat as stat7 } from "fs/promises";
+import { join as join18 } from "path";
 
 // src/utils/log-lock.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join17 } from "path";
 function logLockPath(vault) {
-  return join16(vault, ".skillwiki", "log-append.lock");
+  return join17(vault, ".skillwiki", "log-append.lock");
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function acquireLogLock(vault, opts = {}) {
@@ -2585,8 +2779,8 @@ async function acquireLogLock(vault, opts = {}) {
   const pollMs = opts.pollMs ?? 50;
   const staleMs = opts.staleMs ?? 1e4;
   const path = logLockPath(vault);
-  const dir = join16(vault, ".skillwiki");
-  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
+  const dir = join17(vault, ".skillwiki");
+  if (!existsSync4(dir)) mkdirSync2(dir, { recursive: true });
   const deadline = Date.now() + retryMs;
   const content = JSON.stringify({ pid: process.pid, acquired: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
   for (; ; ) {
@@ -2621,7 +2815,7 @@ function releaseLogLock(vault) {
 var ENTRY_RE2 = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 async function runLogAppend(input) {
   try {
-    await stat6(join17(input.vault, "SCHEMA.md"));
+    await stat7(join18(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
@@ -2633,7 +2827,7 @@ async function runLogAppend(input) {
   if (!acquired.ok) {
     return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
   }
-  const logPath = join17(input.vault, "log.md");
+  const logPath = join18(input.vault, "log.md");
   try {
     let logText;
     try {
@@ -2671,9 +2865,10 @@ ${content}
 }
 
 // src/commands/lint.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { readFile as readFile17 } from "fs/promises";
-import { join as join22 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { join as join23 } from "path";
 
 // src/commands/sparse-community.ts
 async function runSparseCommunity(input) {
@@ -2709,12 +2904,12 @@ async function runTopicMapCheck(input) {
 
 // src/commands/index-link-format.ts
 import { readFile as readFile14 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var MD_LINK_RE = /\[[^\[\]]+\]\([^)]+\.md\)/;
 async function runIndexLinkFormat(input) {
   let text = "";
   try {
-    text = await readFile14(join18(input.vault, "index.md"), "utf8");
+    text = await readFile14(join19(input.vault, "index.md"), "utf8");
   } catch {
   }
   const markdown_links = [];
@@ -2728,7 +2923,7 @@ ${markdown_links.map((l) => `  line ${l.line}: ${l.text}`).join("\n")}`;
 
 // src/commands/dedup.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 async function runDedup(input) {
   const scan = await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
@@ -2756,7 +2951,7 @@ async function runDedup(input) {
       }
     }
     for (const page of scan.data.typedKnowledge) {
-      const text = readFileSync3(join19(input.vault, page.relPath), "utf-8");
+      const text = readFileSync3(join20(input.vault, page.relPath), "utf-8");
       let updated = text;
       let changed = false;
       for (const [oldPath, newPath] of replacements) {
@@ -2774,12 +2969,12 @@ async function runDedup(input) {
         }
       }
       if (changed) {
-        writeFileSync3(join19(input.vault, page.relPath), updated);
+        writeFileSync3(join20(input.vault, page.relPath), updated);
         rewired.push(page.relPath);
       }
     }
     for (const [oldPath] of replacements) {
-      const fullPath = join19(input.vault, oldPath);
+      const fullPath = join20(input.vault, oldPath);
       try {
         unlinkSync3(fullPath);
         removed.push(oldPath);
@@ -2816,7 +3011,7 @@ async function runDedup(input) {
 // src/utils/safe-write.ts
 import { open, readFile as readFile15, rename as rename5, unlink as unlink2, writeFile as writeFile9 } from "fs/promises";
 import { randomBytes } from "crypto";
-import { dirname as dirname7, basename, join as join20 } from "path";
+import { dirname as dirname7, basename, join as join21 } from "path";
 var DEFAULT_MIN_BODY_RATIO = 0.5;
 var DEFAULT_MIN_OLD_BODY_BYTES = 200;
 function bodyBytes(text) {
@@ -2865,7 +3060,7 @@ async function safeWritePage(absPath, newContent, opts = {}) {
   }
   const dir = dirname7(absPath);
   const tmpName = `.${basename(absPath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  const tmpPath = join20(dir, tmpName);
+  const tmpPath = join21(dir, tmpName);
   try {
     const handle = await open(tmpPath, "w");
     try {
@@ -2889,7 +3084,7 @@ async function safeWritePage(absPath, newContent, opts = {}) {
 }
 
 // src/commands/raw-body-dedup.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 async function runRawBodyDedup(vault) {
   const scan = await scanVault(vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
@@ -2900,7 +3095,7 @@ async function runRawBodyDedup(vault) {
     const split = splitFrontmatter(text);
     if (!split.ok) continue;
     totalFiles++;
-    const bodyHash = createHash2("sha256").update(split.data.body).digest("hex");
+    const bodyHash = createHash3("sha256").update(split.data.body).digest("hex");
     const fm = extractFrontmatter(text);
     let fmSha256 = null;
     if (fm.ok && typeof fm.data.sha256 === "string" && fm.data.sha256.length === 64) {
@@ -2929,9 +3124,9 @@ async function runRawBodyDedup(vault) {
 }
 
 // src/commands/path-too-long.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { mkdir as mkdir8, readFile as readFile16, rename as rename6, unlink as unlink3 } from "fs/promises";
-import { dirname as dirname8, join as join21, posix, resolve as resolve4 } from "path";
+import { dirname as dirname8, join as join22, posix, resolve as resolve4 } from "path";
 var MAX_PATH_LENGTH = 240;
 var WINDOWS_ABSOLUTE_PATH_LIMIT = 259;
 async function runPathTooLong(input) {
@@ -2964,10 +3159,10 @@ async function fixPathTooLong(input) {
     }
     try {
       if (target.mode === "dedupe") {
-        await unlink3(join21(input.vault, violation.relPath));
+        await unlink3(join22(input.vault, violation.relPath));
       } else {
-        await mkdir8(dirname8(join21(input.vault, target.relPath)), { recursive: true });
-        await rename6(join21(input.vault, violation.relPath), join21(input.vault, target.relPath));
+        await mkdir8(dirname8(join22(input.vault, target.relPath)), { recursive: true });
+        await rename6(join22(input.vault, violation.relPath), join22(input.vault, target.relPath));
       }
       fixed.push({ from: violation.relPath, to: target.relPath });
     } catch {
@@ -3044,9 +3239,9 @@ function truncateFilename(relPath, maxLength = MAX_PATH_LENGTH) {
 async function resolveFixTarget(vault, original, preferred, maxLength) {
   for (const candidate of candidateRelPaths(preferred, maxLength)) {
     if (candidate === original || candidate.length > maxLength) continue;
-    const candidatePath = join21(vault, candidate);
-    if (!existsSync4(candidatePath)) return { relPath: candidate, mode: "rename" };
-    if (await hasSameContent(join21(vault, original), candidatePath)) {
+    const candidatePath = join22(vault, candidate);
+    if (!existsSync5(candidatePath)) return { relPath: candidate, mode: "rename" };
+    if (await hasSameContent(join22(vault, original), candidatePath)) {
       return { relPath: candidate, mode: "dedupe" };
     }
   }
@@ -3356,7 +3551,7 @@ function extractSourceEntries(rawFm) {
   }
   return entries;
 }
-var ERROR_ORDER = ["broken_wikilinks", "invalid_frontmatter", "raw_source_identity_conflict", "raw_dedup", "broken_sources", "tag_not_in_taxonomy", "path_too_long"];
+var ERROR_ORDER = ["sensitive_content", "broken_wikilinks", "invalid_frontmatter", "raw_source_identity_conflict", "raw_dedup", "broken_sources", "tag_not_in_taxonomy", "path_too_long"];
 var WARNING_ORDER = ["raw_body_duplicate", "raw_subdirectory_duplicate", "file_source_url", "index_incomplete", "index_link_format", "stale_page", "page_too_large", "log_rotate_needed", "orphans", "compound_refs", "legacy_citation_style", "orphaned_citations", "duplicate_frontmatter", "work_item_health", "orphaned_project_pages", "missing_overview", "missing_diagram"];
 var INFO_ORDER = ["bridges", "sparse_community", "page_structure", "topic_map_recommended", "frontmatter_wikilink", "wikilink_citation", "missing_tldr", "stale_sections", "cli_refs"];
 var KNOWN_BUCKETS = [...ERROR_ORDER, ...WARNING_ORDER, ...INFO_ORDER];
@@ -3385,6 +3580,26 @@ function summarizeBucket(bucket, severity, vaultPath, examplesLimit) {
     details_command: `skillwiki lint ${shellQuote(vaultPath)} --only ${bucket.kind}`
   };
 }
+function recomputeRawSha256IfPresent(content) {
+  const split = splitFrontmatter(content);
+  if (!split.ok) return content;
+  if (!/^sha256:\s*[0-9a-f]{64}$/m.test(split.data.rawFrontmatter)) return content;
+  const sha256 = createHash4("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
+  const rawFrontmatter = split.data.rawFrontmatter.replace(/^sha256:\s*[0-9a-f]{64}$/m, `sha256: ${sha256}`);
+  return `---
+${rawFrontmatter}
+---
+${split.data.body}`;
+}
+function appendLintFixLastOp(vault, fixed) {
+  if (fixed.length === 0) return;
+  appendLastOp(vault, {
+    operation: "lint-fix",
+    summary: `fixed ${fixed.length} page(s)`,
+    files: fixed,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
 function summarizeLintOutput(output, examplesLimit = 3) {
   const buckets = [
     ...output.by_severity.error.map((bucket) => summarizeBucket(bucket, "error", output.vault.path, examplesLimit)),
@@ -3486,6 +3701,16 @@ async function runLint(input) {
   const allPages = scan.ok ? [...scan.data.typedKnowledge, ...scan.data.raw, ...scan.data.workItems, ...scan.data.compound] : [];
   const slugs = scan.ok ? buildSlugMap(allPages) : /* @__PURE__ */ new Map();
   if (scan.ok) {
+    const sensitiveFlags = [];
+    for (const page of scan.data.allMarkdown) {
+      try {
+        const text = await readPage(page);
+        const findings = scanSensitiveContent(text, { file: page.relPath });
+        sensitiveFlags.push(...findings);
+      } catch {
+      }
+    }
+    if (sensitiveFlags.length > 0) buckets.sensitive_content = sensitiveFlags;
     const subDirDupes = [];
     const flatStems = /* @__PURE__ */ new Map();
     const deepFiles = [];
@@ -3543,7 +3768,7 @@ async function runLint(input) {
     const noOverview = [];
     const fmWikilinkFlags = [];
     const wikilinkCitationFlags = [];
-    const brokenSourceFlags = [];
+    const brokenSourceFlags = /* @__PURE__ */ new Set();
     const missingTldrFlags = [];
     const missingDiagramFlags = [];
     for (const page of scan.data.typedKnowledge) {
@@ -3558,11 +3783,15 @@ async function runLint(input) {
       if (hasWikilinkCitations(body)) wikilinkCitationFlags.push(page.relPath);
       const sourcesEntries = extractSourceEntries(rawFm);
       for (const entry of sourcesEntries) {
-        let rawPath = entry.replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
-        rawPath = rawPath.replace(/^\^\[/, "").replace(/\]$/, "");
-        if (!rawPath.startsWith("raw/") && !rawPath.startsWith("_archive/raw/")) continue;
-        if (!existsSync5(join22(input.vault, rawPath)) && !existsSync5(join22(input.vault, rawPath + ".md")) && !rawPath.startsWith("_archive/") && !existsSync5(join22(input.vault, "_archive", rawPath)) && !existsSync5(join22(input.vault, "_archive", rawPath + ".md"))) {
-          brokenSourceFlags.push(`${page.relPath}: ${rawPath}`);
+        const rawPath = normalizeRawSourceTarget(entry);
+        if (!rawPath) continue;
+        if (!rawSourceTargetExistsSync(input.vault, rawPath)) {
+          brokenSourceFlags.add(`${page.relPath}: ${rawPath}`);
+        }
+      }
+      for (const marker of extractCitationMarkers(body)) {
+        if (!rawSourceTargetExistsSync(input.vault, marker.target)) {
+          brokenSourceFlags.add(`${page.relPath}: ${marker.target}`);
         }
       }
       const fmLinks = rawFm.match(/\[\[([^\[\]|]+)(?:\|[^\[\]]*)?\]\]/g) ?? [];
@@ -3601,7 +3830,7 @@ async function runLint(input) {
     if (noOverview.length > 0) buckets.missing_overview = noOverview;
     if (fmWikilinkFlags.length > 0) buckets.frontmatter_wikilink = fmWikilinkFlags;
     if (wikilinkCitationFlags.length > 0) buckets.wikilink_citation = wikilinkCitationFlags;
-    if (brokenSourceFlags.length > 0) buckets.broken_sources = brokenSourceFlags;
+    if (brokenSourceFlags.size > 0) buckets.broken_sources = [...brokenSourceFlags];
     if (missingTldrFlags.length > 0) buckets.missing_tldr = missingTldrFlags;
     if (missingDiagramFlags.length > 0) buckets.missing_diagram = missingDiagramFlags;
     const workItemHealth = [];
@@ -3652,8 +3881,8 @@ async function runLint(input) {
         const slugMatch = String(entry).match(/\[\[([^\]]+)\]\]/);
         if (!slugMatch) continue;
         const slug = slugMatch[1];
-        const knowledgePath = join22(input.vault, "projects", slug, "knowledge.md");
-        if (!existsSync5(knowledgePath)) continue;
+        const knowledgePath = join23(input.vault, "projects", slug, "knowledge.md");
+        if (!existsSync6(knowledgePath)) continue;
         const pageRef = page.relPath.replace(/\.md$/, "");
         try {
           const knowledgeContent = await readFile17(knowledgePath, "utf8");
@@ -3697,6 +3926,36 @@ async function runLint(input) {
       }
     }
     if (staleSectionFlags.length > 0) buckets.stale_sections = staleSectionFlags;
+    if (shouldFix("sensitive_content") && buckets.sensitive_content) {
+      const sensitiveFixed = [];
+      for (const page of scan.data.allMarkdown) {
+        try {
+          const raw = await readPage(page);
+          const redacted = redactSensitiveContent(raw, { file: page.relPath });
+          if (!redacted.changed) continue;
+          const next = recomputeRawSha256IfPresent(redacted.text);
+          const w = await safeWritePage(page.absPath, next, { minBodyRatio: null });
+          if (!w.ok) {
+            unresolved.push(page.relPath);
+            continue;
+          }
+          sensitiveFixed.push(page.relPath);
+        } catch {
+          unresolved.push(page.relPath);
+        }
+      }
+      fixed.push(...sensitiveFixed);
+      const remainingSensitiveFlags = [];
+      for (const page of scan.data.allMarkdown) {
+        try {
+          const text = await readPage(page);
+          remainingSensitiveFlags.push(...scanSensitiveContent(text, { file: page.relPath }));
+        } catch {
+        }
+      }
+      if (remainingSensitiveFlags.length > 0) buckets.sensitive_content = remainingSensitiveFlags;
+      else delete buckets.sensitive_content;
+    }
     if (shouldFix("legacy_citation_style") && legacyPages.length > 0) {
       const FENCE_RE2 = /```[\s\S]*?```/g;
       const INLINE_MARKER = /\^\[raw\/[^\]]+\]/g;
@@ -4053,6 +4312,7 @@ ${newBody}`;
       humanHint: `--only ${input.only}
 ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items.length}`).join("\n")}`
     };
+    if (input.fix) appendLintFixLastOp(input.vault, fixed);
     return {
       exitCode: fExit,
       result: ok(input.summary ? summarizeLintOutput(output2, input.examplesLimit) : output2)
@@ -4075,14 +4335,7 @@ ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items
     hintLines.push(`  ${b.kind}: ${b.items.length}`);
   }
   if (hintLines.length === 0) hintLines.push("0 errors, 0 warnings, 0 info");
-  if (input.fix && fixed.length > 0) {
-    appendLastOp(input.vault, {
-      operation: "lint-fix",
-      summary: `fixed ${fixed.length} page(s)`,
-      files: fixed,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
+  if (input.fix) appendLintFixLastOp(input.vault, fixed);
   const output = {
     vault: { path: input.vault, source: input.source ?? "resolved" },
     summary,
@@ -4098,25 +4351,25 @@ ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items
 }
 
 // src/commands/health.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname10, join as join28, resolve as resolve6 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname10, join as join30, resolve as resolve6 } from "path";
 import { platform as platform3 } from "os";
 
 // src/commands/doctor.ts
-import { existsSync as existsSync10, lstatSync, readlinkSync, readdirSync as readdirSync2, statSync as statSync3, readFileSync as readFileSync7 } from "fs";
-import { join as join27, resolve as resolve5 } from "path";
+import { existsSync as existsSync11, lstatSync, readlinkSync, readdirSync as readdirSync2, statSync as statSync3, readFileSync as readFileSync7 } from "fs";
+import { join as join29, resolve as resolve5 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
 // src/commands/config.ts
 import { readFile as readFile18 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { join as join24 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key);
 }
 function configPath(home) {
-  return join23(home, ".skillwiki", ".env");
+  return join24(home, ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -4166,15 +4419,15 @@ async function runConfigList(input) {
 }
 async function runConfigPath(input) {
   const filePath = configPath(input.home);
-  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync6(filePath), humanHint: filePath }) };
+  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync7(filePath), humanHint: filePath }) };
 }
 
 // src/utils/auto-update.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
-import { join as join24, dirname as dirname9 } from "path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync3 } from "fs";
+import { join as join25, dirname as dirname9 } from "path";
 import { spawn } from "child_process";
 function cachePath(home) {
-  return join24(home, ".skillwiki", CACHE_FILENAME);
+  return join25(home, ".skillwiki", CACHE_FILENAME);
 }
 function readCacheRaw(home) {
   try {
@@ -4218,7 +4471,7 @@ function triggerAutoUpdate(home, currentVersion) {
   if (!isStale2) return;
   const distTag = distTagFromCache(home);
   const bgScript = new URL("../auto-update-bg.js", import.meta.url).pathname;
-  if (!existsSync7(bgScript)) return;
+  if (!existsSync8(bgScript)) return;
   const child = spawn(process.execPath, [bgScript, home, currentVersion, distTag], {
     detached: true,
     stdio: "ignore"
@@ -4229,14 +4482,14 @@ function triggerAutoUpdate(home, currentVersion) {
 }
 
 // src/utils/plugin-registry.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync5 } from "fs";
-import { join as join25 } from "path";
-var REGISTRY_PATH = join25(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join25(".codex", "config.toml");
+import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync5 } from "fs";
+import { join as join26 } from "path";
+var REGISTRY_PATH = join26(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join26(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync5(join25(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync5(join26(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -4272,8 +4525,8 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join25(home, ".codex", "plugins", "cache", marketplace, pluginName);
-  if (!existsSync8(cacheRoot)) return null;
+  const cacheRoot = join26(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  if (!existsSync9(cacheRoot)) return null;
   let versions;
   try {
     versions = readdirSync(cacheRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -4288,7 +4541,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join25(cacheRoot, version),
+    installPath: join26(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -4305,7 +4558,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync5(join25(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync5(join26(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -4346,90 +4599,490 @@ function parseTomlScalar(rawValue) {
   return value;
 }
 
-// src/utils/s3-mount-health.ts
-import { execSync } from "child_process";
-import { platform } from "os";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readFileSync as readFile19 } from "fs";
-import { join as join26 } from "path";
-var OS = platform();
-function findRcloneMountPid() {
-  try {
-    const out = execSync("pgrep -f 'rclone.*mount'", {
-      encoding: "utf8",
-      timeout: 2e3,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const pids = out.split("\n").filter(Boolean);
-    if (pids.length === 0) return null;
-    return parseInt(pids[0], 10);
-  } catch {
-    try {
-      const out = execSync("ps aux", { encoding: "utf8", timeout: 2e3, stdio: ["pipe", "pipe", "pipe"] });
-      for (const line of out.split("\n")) {
-        if (line.includes("rclone") && line.includes("mount") && !line.includes("grep")) {
-          const parts = line.trim().split(/\s+/);
-          if (parts.length >= 2) return parseInt(parts[1], 10);
-        }
-      }
-    } catch {
+// src/commands/fleet.ts
+import { readFile as readFile19 } from "fs/promises";
+import { hostname as nodeHostname, userInfo } from "os";
+import { join as join27 } from "path";
+import yaml3 from "js-yaml";
+var FLEET_REL_PATH = join27("projects", "llm-wiki", "architecture", "fleet.yaml");
+async function runFleetValidate(input) {
+  const loaded = await loadFleetManifest(input.file);
+  if (!loaded.ok) {
+    if (loaded.error === "FILE_NOT_FOUND") {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
     }
-    return null;
+    const errors = fleetLoadErrors(loaded);
+    return invalidFleet(errors);
   }
+  const warnings = fleetWarnings(loaded.manifest);
+  const snapshotter = findSnapshotter(loaded.manifest);
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      valid: true,
+      errors: [],
+      warnings,
+      host_count: Object.keys(loaded.manifest.hosts).length,
+      snapshotter,
+      humanHint: `VALID fleet manifest (${Object.keys(loaded.manifest.hosts).length} hosts; snapshotter: ${snapshotter ?? "none"})`
+    })
+  };
 }
-function parseRcloneFlags(pid) {
-  const flags = /* @__PURE__ */ new Map();
-  try {
-    const args = getRcloneArgs(pid);
-    for (let i = 0; i < args.length; i++) {
-      const arg = args[i];
-      if (arg.startsWith("--") && arg.includes("=")) {
-        const eq = arg.indexOf("=");
-        flags.set(arg.slice(0, eq), arg.slice(eq + 1));
-      } else if (arg.startsWith("--")) {
-        const next = args[i + 1];
-        if (next && !next.startsWith("-")) {
-          flags.set(arg, next);
-          i++;
-        } else {
-          flags.set(arg, "");
-        }
-      }
-    }
-  } catch {
+async function runFleetContext(input) {
+  const env = input.env ?? process.env;
+  const home = input.home ?? env.HOME ?? "";
+  const cwd = input.cwd ?? process.cwd();
+  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
+  const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
+  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
+  const file = input.file ?? (vault ? join27(vault, FLEET_REL_PATH) : void 0);
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
+  if (!loaded.ok) {
+    const warnings = ["fleet manifest unavailable or invalid"];
+    const markdown2 = formatUnknownContext({
+      generatedAt,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      reason: warnings[0],
+      trace: [],
+      warnings
+    });
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: false,
+        generated_at: generatedAt,
+        identity_status: "unknown",
+        resolver_trace: [],
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
+    };
   }
-  return flags;
-}
-function getRcloneVersion() {
-  try {
-    const out = execSync("rclone version", {
-      encoding: "utf8",
-      timeout: 3e3,
-      stdio: ["pipe", "pipe", "pipe"]
+  const resolved = await resolveHostId({
+    manifest: loaded.manifest,
+    hostId: input.hostId,
+    env,
+    home,
+    osHostname
+  });
+  if (resolved.hostId && !loaded.manifest.hosts[resolved.hostId]) {
+    const source = resolved.source ?? "unknown";
+    const warnings = [`resolved host id \`${resolved.hostId}\` from ${source} is not in fleet.yaml`];
+    const markdown2 = formatInvalidContext({
+      generatedAt,
+      hostId: resolved.hostId,
+      source,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      trace: resolved.trace,
+      warnings
     });
-    const match = out.match(/rclone\s+v(\d+)\.(\d+)\.(\d+)/i);
-    if (!match) return null;
     return {
-      major: parseInt(match[1], 10),
-      minor: parseInt(match[2], 10),
-      patch: parseInt(match[3], 10),
-      raw: out.split("\n")[0].trim()
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: true,
+        host_id: resolved.hostId,
+        source: resolved.source,
+        generated_at: generatedAt,
+        identity_status: "invalid",
+        resolver_trace: resolved.trace,
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
     };
-  } catch {
-    return null;
   }
-}
-function extractRcloneFs(args) {
-  let foundMount = false;
-  for (const arg of args) {
-    if (arg === "mount") {
-      foundMount = true;
-      continue;
-    }
-    if (foundMount && arg.includes(":") && !arg.startsWith("-") && !arg.startsWith("/")) {
-      return arg;
-    }
+  if (!resolved.hostId) {
+    const warnings = ["host identity is unresolved"];
+    const markdown2 = formatUnknownContext({
+      generatedAt,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      reason: warnings[0],
+      trace: resolved.trace,
+      warnings
+    });
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: true,
+        generated_at: generatedAt,
+        identity_status: "unknown",
+        resolver_trace: resolved.trace,
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
+    };
   }
-  return null;
+  const markdown = formatKnownContext({
+    manifest: loaded.manifest,
+    hostId: resolved.hostId,
+    source: resolved.source,
+    generatedAt,
+    osHostname,
+    user,
+    cwd,
+    vault,
+    trace: resolved.trace
+  });
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      manifest_loaded: true,
+      host_id: resolved.hostId,
+      source: resolved.source,
+      generated_at: generatedAt,
+      identity_status: "known",
+      resolver_trace: resolved.trace,
+      warnings: [],
+      markdown,
+      humanHint: markdown
+    })
+  };
+}
+async function loadFleetManifest(file) {
+  let text;
+  try {
+    text = await readFile19(file, "utf8");
+  } catch {
+    return { ok: false, error: "FILE_NOT_FOUND" };
+  }
+  let parsed;
+  try {
+    parsed = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
+  } catch (error) {
+    return { ok: false, error: "INVALID_YAML", detail: error instanceof Error ? error.message : String(error) };
+  }
+  const result = FleetManifestSchema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, error: "INVALID_FLEET_MANIFEST", detail: result.error.issues };
+  }
+  return { ok: true, manifest: result.data };
+}
+function invalidFleet(errors) {
+  return {
+    exitCode: ExitCode.FLEET_MANIFEST_INVALID,
+    result: ok({
+      valid: false,
+      errors,
+      warnings: [],
+      host_count: 0,
+      humanHint: `INVALID fleet manifest
+${errors.map((e) => `  ${e.path || "(root)"}: ${e.message}`).join("\n")}`
+    })
+  };
+}
+function fleetLoadErrors(loaded) {
+  if (loaded.error === "INVALID_YAML") {
+    return [{ path: "", message: `invalid YAML: ${String(loaded.detail ?? "parse failed")}` }];
+  }
+  if (loaded.error === "INVALID_FLEET_MANIFEST" && Array.isArray(loaded.detail)) {
+    return loaded.detail.map((issue) => {
+      const zodIssue = issue;
+      return {
+        path: (zodIssue.path ?? []).join("."),
+        message: zodIssue.message ?? "invalid value"
+      };
+    });
+  }
+  return [{ path: "", message: loaded.error }];
+}
+function fleetWarnings(manifest) {
+  const warnings = [];
+  for (const [id, host] of Object.entries(manifest.hosts)) {
+    if (host.role === "snapshotter" && host.protected !== true) {
+      warnings.push(`snapshotter host '${id}' is not protected=true`);
+    }
+  }
+  return warnings;
+}
+function findSnapshotter(manifest) {
+  return Object.entries(manifest.hosts).find(([, host]) => host.role === "snapshotter")?.[0];
+}
+async function resolveHostId(input) {
+  const trace = [];
+  if (input.hostId) {
+    trace.push({ source: "--host-id", status: "matched", value: input.hostId });
+    return { hostId: input.hostId, source: "host-id", trace };
+  }
+  trace.push({ source: "--host-id", status: "unset" });
+  if (input.env.SKILLWIKI_HOST_ID) {
+    trace.push({ source: "SKILLWIKI_HOST_ID", status: "matched", value: input.env.SKILLWIKI_HOST_ID });
+    return { hostId: input.env.SKILLWIKI_HOST_ID, source: "SKILLWIKI_HOST_ID", trace };
+  }
+  trace.push({ source: "SKILLWIKI_HOST_ID", status: "unset" });
+  if (input.env.AGENT_HOST_ID) {
+    trace.push({ source: "AGENT_HOST_ID", status: "matched", value: input.env.AGENT_HOST_ID });
+    return { hostId: input.env.AGENT_HOST_ID, source: "AGENT_HOST_ID", trace };
+  }
+  trace.push({ source: "AGENT_HOST_ID", status: "unset" });
+  if (input.home) {
+    const dotenv = await parseDotenvFile(join27(input.home, ".skillwiki", ".env"));
+    if (dotenv.SKILLWIKI_HOST_ID) {
+      trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "matched", value: dotenv.SKILLWIKI_HOST_ID });
+      return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", trace };
+    }
+    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "unset" });
+  } else {
+    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "skipped" });
+  }
+  if (input.env.VS_HOSTNAME) {
+    trace.push({ source: "VS_HOSTNAME", status: "matched", value: input.env.VS_HOSTNAME });
+    return { hostId: input.env.VS_HOSTNAME, source: "VS_HOSTNAME", trace };
+  }
+  trace.push({ source: "VS_HOSTNAME", status: "unset" });
+  const hostname = input.osHostname.trim();
+  if (hostname) {
+    if (input.manifest.hosts[hostname]) {
+      trace.push({ source: "hostname", status: "matched", value: hostname });
+      return { hostId: hostname, source: "hostname", trace };
+    }
+    const byHostname = Object.entries(input.manifest.hosts).find(([, host]) => host.identity.hostnames.includes(hostname));
+    if (byHostname) {
+      trace.push({ source: "hostname", status: "matched", value: hostname });
+      return { hostId: byHostname[0], source: "hostname", trace };
+    }
+    trace.push({ source: "hostname", status: "unmatched", value: hostname });
+  } else {
+    trace.push({ source: "hostname", status: "unset" });
+  }
+  return { trace };
+}
+function formatKnownContext(input) {
+  const host = input.manifest.hosts[input.hostId];
+  const protectedValue = host.protected === true ? "true" : "false";
+  const writesTo = host.writes_to.join(", ");
+  const selfAliases = collectSelfAliases(input.manifest, input.hostId);
+  const outbound = collectOutboundAccess(input.manifest, input.hostId);
+  const maintenanceLines = formatMaintenanceLines(host);
+  const guidance = input.hostId === "macos-dev" ? "use declared SSH aliases for remote work when needed; do not assume undeclared hosts have reciprocal SSH access." : `this session is already on \`${input.hostId}\`; do not SSH to self aliases unless the user explicitly asks. Do not assume outbound SSH to other fleet hosts is configured.`;
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    `- Current machine: \`${input.hostId}\`${input.source ? ` (source: \`${input.source}\`)` : ""}`,
+    "- Identity status: `known`",
+    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    `- Fleet role: \`${host.role}\`; protected: \`${protectedValue}\`; writes_to: \`${writesTo}\``,
+    ...maintenanceLines,
+    `- Self SSH aliases known in fleet: ${formatList(selfAliases)}`,
+    `- Declared outbound SSH from this source: ${formatOutboundAccess(outbound)}`,
+    `- Guidance: ${guidance}`
+  ].join("\n");
+}
+function formatUnknownContext(input) {
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    "- Current machine: unknown",
+    "- Identity status: `unknown`",
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- Warnings: ${formatWarnings(input.warnings)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    "- Fleet role: unknown",
+    "- Self SSH aliases known in fleet: unknown",
+    "- Declared outbound SSH from this source: unknown",
+    `- Guidance: ${input.reason}; do not assume local vs remote role. Inspect runtime or ask before SSH/deploy/sync work.`
+  ].join("\n");
+}
+function formatInvalidContext(input) {
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    "- Current machine: unknown",
+    "- Identity status: `invalid`",
+    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- Warnings: ${formatWarnings(input.warnings)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    "- Fleet role: unknown",
+    "- Self SSH aliases known in fleet: unknown",
+    "- Declared outbound SSH from this source: unknown",
+    `- Guidance: do not trust this identity; rerun with \`--host-id\` only if the user confirms \`${input.hostId}\` is the current fleet host id.`
+  ].join("\n");
+}
+function collectSelfAliases(manifest, hostId2) {
+  const aliases = [];
+  const host = manifest.hosts[hostId2];
+  const access = host?.access?.from ?? {};
+  for (const profile of Object.values(access)) {
+    for (const alias of profile.ssh_aliases ?? []) aliases.push(alias);
+  }
+  return [...new Set(aliases)];
+}
+function collectOutboundAccess(manifest, sourceHostId) {
+  const hosts = [];
+  for (const [targetId, target] of Object.entries(manifest.hosts)) {
+    if (targetId === sourceHostId) continue;
+    const profile = target.access?.from?.[sourceHostId];
+    if (profile && (profile.status === "configured" || profile.status === "local")) {
+      hosts.push({
+        hostId: targetId,
+        sshAliases: [...new Set(profile.ssh_aliases ?? [])],
+        users: [...new Set(profile.users ?? [])]
+      });
+    }
+  }
+  return hosts.sort((left, right) => left.hostId.localeCompare(right.hostId));
+}
+function formatMaintenanceLines(host) {
+  const satellite = host.maintenance?.skillwiki_satellite;
+  if (!satellite?.enabled) return [];
+  return [
+    `- Maintenance role: \`skillwiki satellite\`; user: \`${satellite.user}\`; ssh: \`${satellite.ssh_alias}\``,
+    `- Maintenance paths: maintenance vault: \`${satellite.vault_path}\`; repo: \`${satellite.repo_path}\`; scheduler: \`${satellite.scheduler}\`; jobs: ${formatList(satellite.jobs)}`
+  ];
+}
+function formatOutboundAccess(values) {
+  if (values.length === 0) return "none";
+  return values.map((value) => {
+    const aliasPart = value.sshAliases.length > 0 ? ` via ${formatList(value.sshAliases)}` : " (no SSH aliases)";
+    const usersPart = value.users.length > 0 ? ` (users: ${formatList(value.users)})` : "";
+    return `\`${value.hostId}\`${aliasPart}${usersPart}`;
+  }).join("; ");
+}
+function formatResolution(source, hostId2) {
+  return source ? `\`${source === "host-id" ? "--host-id" : source}\` -> \`${hostId2}\`` : `unknown -> \`${hostId2}\``;
+}
+function formatTrace(values) {
+  if (values.length === 0) return "not available";
+  return values.map((value) => {
+    const source = `\`${value.source}\``;
+    if (value.status === "matched") return `${source} matched \`${value.value ?? ""}\``;
+    if (value.status === "unmatched") return `${source} unmatched \`${value.value ?? ""}\``;
+    return `${source} ${value.status}`;
+  }).join("; ");
+}
+function formatWarnings(values) {
+  return values.length > 0 ? values.join("; ") : "none";
+}
+function formatList(values) {
+  return values.length > 0 ? values.map((v) => `\`${v}\``).join(", ") : "none";
+}
+function formatMaybe(value) {
+  return value && value.trim().length > 0 ? `\`${value}\`` : "unknown";
+}
+function safeEnvValue(value) {
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function safeUserName() {
+  try {
+    return userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+// src/utils/s3-mount-health.ts
+import { execSync } from "child_process";
+import { platform } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readFileSync as readFile20 } from "fs";
+import { join as join28 } from "path";
+var OS = platform();
+function findRcloneMountPid() {
+  try {
+    const out = execSync("pgrep -f 'rclone.*mount'", {
+      encoding: "utf8",
+      timeout: 2e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const pids = out.split("\n").filter(Boolean);
+    if (pids.length === 0) return null;
+    return parseInt(pids[0], 10);
+  } catch {
+    try {
+      const out = execSync("ps aux", { encoding: "utf8", timeout: 2e3, stdio: ["pipe", "pipe", "pipe"] });
+      for (const line of out.split("\n")) {
+        if (line.includes("rclone") && line.includes("mount") && !line.includes("grep")) {
+          const parts = line.trim().split(/\s+/);
+          if (parts.length >= 2) return parseInt(parts[1], 10);
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+}
+function parseRcloneFlags(pid) {
+  const flags = /* @__PURE__ */ new Map();
+  try {
+    const args = getRcloneArgs(pid);
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i];
+      if (arg.startsWith("--") && arg.includes("=")) {
+        const eq = arg.indexOf("=");
+        flags.set(arg.slice(0, eq), arg.slice(eq + 1));
+      } else if (arg.startsWith("--")) {
+        const next = args[i + 1];
+        if (next && !next.startsWith("-")) {
+          flags.set(arg, next);
+          i++;
+        } else {
+          flags.set(arg, "");
+        }
+      }
+    }
+  } catch {
+  }
+  return flags;
+}
+function getRcloneVersion() {
+  try {
+    const out = execSync("rclone version", {
+      encoding: "utf8",
+      timeout: 3e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const match = out.match(/rclone\s+v(\d+)\.(\d+)\.(\d+)/i);
+    if (!match) return null;
+    return {
+      major: parseInt(match[1], 10),
+      minor: parseInt(match[2], 10),
+      patch: parseInt(match[3], 10),
+      raw: out.split("\n")[0].trim()
+    };
+  } catch {
+    return null;
+  }
+}
+function extractRcloneFs(args) {
+  let foundMount = false;
+  for (const arg of args) {
+    if (arg === "mount") {
+      foundMount = true;
+      continue;
+    }
+    if (foundMount && arg.includes(":") && !arg.startsWith("-") && !arg.startsWith("/")) {
+      return arg;
+    }
+  }
+  return null;
 }
 function getRcloneArgs(pid) {
   try {
@@ -4508,7 +5161,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join26(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join28(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -4519,7 +5172,7 @@ function writeTest(dir) {
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile19(testFile, "utf8");
+    const back = readFile20(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
@@ -4608,13 +5261,13 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join27(plugin.installPath, "bin", "skillwiki");
-    if (existsSync10(pluginBin)) {
+    const pluginBin = join29(plugin.installPath, "bin", "skillwiki");
+    if (existsSync11(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join27(home, ".claude", "skills", "bin", "skillwiki");
-  if (existsSync10(installBin)) {
+  const installBin = join29(home, ".claude", "skills", "bin", "skillwiki");
+  if (existsSync11(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
   return channels;
@@ -4666,7 +5319,7 @@ function checkCliChannels(argv, home) {
 }
 async function checkConfigFile(home) {
   const cfgPath = configPath(home);
-  if (!existsSync10(cfgPath)) {
+  if (!existsSync11(cfgPath)) {
     return check("warn", "config_file", "Config file exists", `${cfgPath} not found`);
   }
   try {
@@ -4681,7 +5334,7 @@ function checkWikiPathExists(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "wiki_path_exists", "Vault directory exists", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (existsSync10(resolvedPath) && statSync3(resolvedPath).isDirectory()) {
+  if (existsSync11(resolvedPath) && statSync3(resolvedPath).isDirectory()) {
     return check("pass", "wiki_path_exists", "Vault directory exists", resolvedPath);
   }
   return check("error", "wiki_path_exists", "Vault directory exists", `${resolvedPath} does not exist or is not a directory`);
@@ -4690,13 +5343,13 @@ function checkVaultStructure(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync10(resolvedPath)) {
+  if (!existsSync11(resolvedPath)) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync10(join27(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync11(join29(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync10(join27(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync11(join29(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -4704,8 +5357,8 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join27(cwd, "packages", "skills") : void 0;
-  if (srcDir && existsSync10(srcDir)) {
+  const srcDir = cwd ? join29(cwd, "packages", "skills") : void 0;
+  if (srcDir && existsSync11(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (source)`);
@@ -4718,8 +5371,8 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join27(home, ".claude", "skills");
-  if (existsSync10(skillsDir)) {
+  const skillsDir = join29(home, ".claude", "skills");
+  if (existsSync11(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (CLI install)`);
@@ -4729,10 +5382,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join27(home, ".claude", "skills");
+  const skillsDir = join29(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join27(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join27(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join29(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join29(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -4831,8 +5484,8 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join27(dir, ".skillwiki", ".env");
-  if (existsSync10(envPath)) {
+  const envPath = join29(dir, ".skillwiki", ".env");
+  if (existsSync11(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
   return check("pass", "project_local", "Project-local config", "None");
@@ -4841,7 +5494,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync10(join27(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -4864,9 +5517,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync10(join27(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync10(join27(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync10(join27(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync11(join29(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync11(join29(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync11(join29(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -4876,8 +5529,8 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join27(resolvedPath, "raw");
-  if (!existsSync10(rawDir)) {
+  const rawDir = join29(resolvedPath, "raw");
+  if (!existsSync11(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
   const found = [];
@@ -4892,7 +5545,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk2(join27(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk2(join29(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -4905,7 +5558,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync10(join27(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -4953,7 +5606,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync10(join27(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -4994,7 +5647,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync10(join27(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -5014,13 +5667,38 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
     return check("warn", id, label, "Could not compare HEAD with origin/main");
   }
 }
+async function checkFleetIdentity(input) {
+  if (!input.vaultPath) {
+    return check("pass", "fleet_identity", "Fleet identity", "No vault path \u2014 check skipped");
+  }
+  const r = await runFleetContext({
+    vault: input.vaultPath,
+    env: { ...process.env, WIKI_PATH: input.envValue ?? input.vaultPath },
+    home: input.home,
+    cwd: input.cwd ?? process.cwd(),
+    osHostname: process.env.HOSTNAME,
+    user: process.env.USER
+  });
+  if (!r.result.ok) {
+    return check("warn", "fleet_identity", "Fleet identity", "Could not evaluate fleet identity");
+  }
+  const data = r.result.data;
+  if (!data.manifest_loaded) {
+    return check("pass", "fleet_identity", "Fleet identity", "Fleet manifest unavailable \u2014 check skipped");
+  }
+  if (data.identity_status === "known") {
+    return check("pass", "fleet_identity", "Fleet identity", `Resolved ${data.host_id ?? "unknown"} via ${data.source ?? "unknown"}`);
+  }
+  const detail = data.warnings.length > 0 ? data.warnings.join("; ") : "Fleet identity is unresolved";
+  return check("warn", "fleet_identity", "Fleet identity", detail);
+}
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join27(home, "Library", "Logs", "wiki-pull.log"),
-    join27(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join29(home, "Library", "Logs", "wiki-pull.log"),
+    join29(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join27(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join27(home, "Library", "Logs", "wiki-pull.log")
+    join29(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join29(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -5032,7 +5710,7 @@ function isRecentLogLine(line, nowMs) {
   return nowMs - ts <= 24 * 60 * 60 * 1e3;
 }
 function checkVaultGitPullFailures(home) {
-  const path = pullLogPaths(home).find((p) => existsSync10(p));
+  const path = pullLogPaths(home).find((p) => existsSync11(p));
   if (!path) {
     return check("pass", "vault_git_pull_failures", "Vault pull failures", "No wiki-pull.log found \u2014 check skipped");
   }
@@ -5060,8 +5738,8 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join27(resolvedPath, "concepts");
-  if (!existsSync10(conceptsDir)) {
+  const conceptsDir = join29(resolvedPath, "concepts");
+  if (!existsSync11(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
   const start = Date.now();
@@ -5243,8 +5921,8 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join27(resolvedPath, "concepts");
-  if (!existsSync10(conceptsDir)) {
+  const conceptsDir = join29(resolvedPath, "concepts");
+  if (!existsSync11(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
   const result = writeTest(conceptsDir);
@@ -5330,7 +6008,7 @@ function checkVfsCacheHealth(resolvedPath) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync7(join27(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync7(join29(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     for (const line of content.split(/\r?\n/)) {
@@ -5364,12 +6042,12 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join27(home, "Library", "Logs") : join27(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join27(home, "Library", "Application Support", "vault-sync", "bin") : join27(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join27(home, ".config", "rclone", "wiki-push-filters.txt");
+  const logDir = input.logDir ?? (isMac ? join29(home, "Library", "Logs") : join29(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join29(home, "Library", "Application Support", "vault-sync", "bin") : join29(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join29(home, ".config", "rclone", "wiki-push-filters.txt");
   const snapshotPath = input.snapshotScriptPath ?? "/root/.hermes/scripts/wiki-snapshot-v3.sh";
-  const pushScriptPath = join27(shareDir, "wiki-push.sh");
-  const c1 = existsSync10(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
+  const pushScriptPath = join29(shareDir, "wiki-push.sh");
+  const c1 = existsSync11(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
     if (isMac) {
@@ -5420,7 +6098,7 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join27(logDir, "wiki-push.log");
+  const logFile = join29(logDir, "wiki-push.log");
   let c3;
   try {
     const logContent = readFileSync7(logFile, "utf8");
@@ -5479,7 +6157,7 @@ function vaultSyncChecks(input) {
       }
     }
   } catch {
-    c3 = existsSync10(logDir) ? check(
+    c3 = existsSync11(logDir) ? check(
       "warn",
       "vault_sync_last_push_age",
       "Vault sync last push recency",
@@ -5491,7 +6169,7 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join27(logDir, "wiki-fetch.log");
+  const fetchLogFile = join29(logDir, "wiki-fetch.log");
   let cFetch;
   try {
     const logContent = readFileSync7(fetchLogFile, "utf8");
@@ -5538,7 +6216,7 @@ function vaultSyncChecks(input) {
   }
   let c4;
   try {
-    if (!existsSync10(filterPath)) {
+    if (!existsSync11(filterPath)) {
       c4 = check(
         "error",
         "vault_sync_filter_present",
@@ -5587,7 +6265,7 @@ function vaultSyncChecks(input) {
     );
   } else {
     try {
-      if (!existsSync10(snapshotPath)) {
+      if (!existsSync11(snapshotPath)) {
         c5 = check(
           "error",
           "vault_sync_snapshot_guard",
@@ -5633,15 +6311,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join27(dir, entry.name));
+      results.push(join29(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join27(dir, entry.name)));
+      results.push(...findSkillMd(join29(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join27(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join29(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -5653,7 +6331,7 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync10(join27(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync11(join29(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
@@ -5697,7 +6375,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync7(join27(resolvedPath, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync7(join29(resolvedPath, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -5727,6 +6405,12 @@ async function runDoctor(input) {
   checks.push(checkVaultStructure(resolvedPath));
   checks.push(checkObsidianTemplates(resolvedPath));
   checks.push(checkVaultGitRemote(resolvedPath));
+  checks.push(await checkFleetIdentity({
+    vaultPath: resolvedPath,
+    home: input.home,
+    cwd: input.cwd,
+    envValue: input.envValue
+  }));
   checks.push(checkSyncLastPush(resolvedPath));
   checks.push(checkVaultGitDirty(resolvedPath));
   checks.push(checkVaultGitAhead(resolvedPath));
@@ -5881,7 +6565,7 @@ function summarizeChecks(checks) {
   };
 }
 function classifyLog(path, id, label, okPattern) {
-  if (!existsSync11(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
+  if (!existsSync12(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
   const lines = readFileSync8(path, "utf8").split(/\r?\n/).filter(Boolean);
   const last = lines[lines.length - 1] ?? "";
   if (!last) return { id, label, status: "warn", detail: `log file empty: ${path}` };
@@ -5900,28 +6584,28 @@ function runVaultSyncHealth(home, syncMode) {
     };
   }
   const isMac = platform3() === "darwin";
-  const shareDir = isMac ? join28(home, "Library", "Application Support", "vault-sync", "bin") : join28(home, ".local", "share", "vault-sync", "bin");
-  const logDir = isMac ? join28(home, "Library", "Logs") : join28(home, ".local", "state", "vault-sync", "log");
-  const filterPath = join28(home, ".config", "rclone", "wiki-push-filters.txt");
+  const shareDir = isMac ? join30(home, "Library", "Application Support", "vault-sync", "bin") : join30(home, ".local", "share", "vault-sync", "bin");
+  const logDir = isMac ? join30(home, "Library", "Logs") : join30(home, ".local", "state", "vault-sync", "log");
+  const filterPath = join30(home, ".config", "rclone", "wiki-push-filters.txt");
   const checks = [];
-  const pushScript = join28(shareDir, "wiki-push.sh");
-  checks.push(existsSync11(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
+  const pushScript = join30(shareDir, "wiki-push.sh");
+  checks.push(existsSync12(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
   if (isMac) {
-    const pushPlist = join28(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
-    const fetchPlist = join28(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
-    checks.push(existsSync11(pushPlist) && existsSync11(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
+    const pushPlist = join30(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
+    const fetchPlist = join30(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
+    checks.push(existsSync12(pushPlist) && existsSync12(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
     checks.push({ id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "macOS host \u2014 check skipped" });
   } else {
-    const pushTimer = join28(home, ".config", "systemd", "user", "wiki-push.timer");
-    const fetchTimer = join28(home, ".config", "systemd", "user", "wiki-fetch.timer");
-    const fuseTimer = join28(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
-    const fuseService = join28(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
-    checks.push(existsSync11(pushTimer) && existsSync11(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
-    checks.push(existsSync11(fuseTimer) && existsSync11(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
-  }
-  checks.push(classifyLog(join28(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
-  checks.push(classifyLog(join28(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
-  if (!existsSync11(filterPath)) {
+    const pushTimer = join30(home, ".config", "systemd", "user", "wiki-push.timer");
+    const fetchTimer = join30(home, ".config", "systemd", "user", "wiki-fetch.timer");
+    const fuseTimer = join30(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
+    const fuseService = join30(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
+    checks.push(existsSync12(pushTimer) && existsSync12(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
+    checks.push(existsSync12(fuseTimer) && existsSync12(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
+  }
+  checks.push(classifyLog(join30(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  checks.push(classifyLog(join30(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
+  if (!existsSync12(filterPath)) {
     checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "error", detail: `Filter missing: ${filterPath}` });
   } else {
     const content = readFileSync8(filterPath, "utf8");
@@ -6146,8 +6830,8 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename7, mkdir as mkdir9, readFile as readFile20, writeFile as writeFile10 } from "fs/promises";
-import { join as join29, dirname as dirname11 } from "path";
+import { rename as rename7, mkdir as mkdir9, readFile as readFile21, writeFile as writeFile10 } from "fs/promises";
+import { join as join31, dirname as dirname11 } from "path";
 function countWikilinks(body, slug) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\[\\[${escaped}(?:[|#][^\\]]*)?\\]\\]`, "g");
@@ -6175,7 +6859,7 @@ async function runArchive(input) {
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join29("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = join31("_archive", relPath).replace(/\\/g, "/");
   let cascade;
   if (input.cascade) {
     const wikilinkRefs = [];
@@ -6199,7 +6883,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile20(join29(input.vault, "index.md"), "utf8");
+        const idx = await readFile21(join31(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -6225,8 +6909,8 @@ async function runArchive(input) {
   }
   if (input.cascade && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join29(input.vault, ref.page);
-      const text = await readFile20(absPath, "utf8");
+      const absPath = join31(input.vault, ref.page);
+      const text = await readFile21(absPath, "utf8");
       const split = splitFrontmatter(text);
       if (!split.ok) continue;
       const before = split.data.rawFrontmatter;
@@ -6243,12 +6927,12 @@ ${fmRewritten}
       }
     }
   }
-  await mkdir9(dirname11(join29(input.vault, archivePath)), { recursive: true });
+  await mkdir9(dirname11(join31(input.vault, archivePath)), { recursive: true });
   let indexUpdated = false;
   if (!isRaw) {
-    const indexPath = join29(input.vault, "index.md");
+    const indexPath = join31(input.vault, "index.md");
     try {
-      const idx = await readFile20(indexPath, "utf8");
+      const idx = await readFile21(indexPath, "utf8");
       const originalLines = idx.split("\n");
       const filtered = originalLines.filter((l) => !l.includes(`[[${slug}]]`));
       if (filtered.length !== originalLines.length) {
@@ -6259,7 +6943,7 @@ ${fmRewritten}
       if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
     }
   }
-  await rename7(join29(input.vault, relPath), join29(input.vault, archivePath));
+  await rename7(join31(input.vault, relPath), join31(input.vault, archivePath));
   appendLastOp(input.vault, {
     operation: input.cascade ? "archive-cascade" : "archive",
     summary: `moved ${relPath} to ${archivePath}${input.cascade ? ` (cascade: ${cascade?.source_array_refs.length ?? 0} source arrays updated)` : ""}`,
@@ -6282,7 +6966,7 @@ ${fmRewritten}
 }
 
 // src/commands/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -6361,7 +7045,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash5("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -6668,7 +7352,7 @@ ${newBody}`;
 
 // src/commands/update.ts
 import { execSync as execSync3 } from "child_process";
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 
 // src/utils/package-info.ts
 import { readFileSync as readFileSync9 } from "fs";
@@ -6698,7 +7382,7 @@ function resolveGlobalSkillsRoot() {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
-    return join30(globalRoot, "skillwiki", "skills");
+    return join32(globalRoot, "skillwiki", "skills");
   } catch {
     return null;
   }
@@ -6722,7 +7406,7 @@ async function runUpdate(input) {
   const pkg2 = readCliPackageJson();
   const currentVersion = pkg2.version;
   const tag = normalizeDistTag(input.distTag);
-  const target = join30(input.home, ".claude", "skills");
+  const target = join32(input.home, ".claude", "skills");
   let latest;
   try {
     latest = execSync3(`npm view skillwiki@${tag} version`, {
@@ -6793,15 +7477,15 @@ async function runUpdate(input) {
 
 // src/commands/self-update.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
+import { join as join33 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
   const currentVersion = readCliPackageJson().version;
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
-  const localPkgPath = join31(sourceRoot, "packages", "cli", "package.json");
-  const hasLocalSource = existsSync12(localPkgPath);
+  const localPkgPath = join33(sourceRoot, "packages", "cli", "package.json");
+  const hasLocalSource = existsSync13(localPkgPath);
   if (input.check) {
     let availableVersion = null;
     let source;
@@ -6932,10 +7616,10 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir5, stat as stat7, readFile as readFile21 } from "fs/promises";
-import { join as join32 } from "path";
+import { readdir as readdir5, stat as stat8, readFile as readFile22 } from "fs/promises";
+import { join as join34 } from "path";
 async function runTranscripts(input) {
-  const dir = join32(input.vault, "raw", "transcripts");
+  const dir = join34(input.vault, "raw", "transcripts");
   let entries;
   try {
     entries = await readdir5(dir, { withFileTypes: true });
@@ -6945,13 +7629,13 @@ async function runTranscripts(input) {
   const transcripts = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const filePath = join32(dir, entry.name);
-    const content = await readFile21(filePath, "utf8");
+    const filePath = join34(dir, entry.name);
+    const content = await readFile22(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
     if (input.since && ingested && ingested < input.since) continue;
-    const s = await stat7(filePath);
+    const s = await stat8(filePath);
     transcripts.push({
       file: `raw/transcripts/${entry.name}`,
       ingested,
@@ -6963,12 +7647,12 @@ async function runTranscripts(input) {
 }
 
 // src/commands/project-index.ts
-import { readdir as readdir6, readFile as readFile22, writeFile as writeFile11, mkdir as mkdir10 } from "fs/promises";
-import { join as join33, dirname as dirname12 } from "path";
+import { readdir as readdir6, readFile as readFile23, writeFile as writeFile11, mkdir as mkdir10 } from "fs/promises";
+import { join as join35, dirname as dirname12 } from "path";
 var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 async function runProjectIndex(input) {
   const slug = input.slug;
-  const projectDir = join33(input.vault, "projects", slug);
+  const projectDir = join35(input.vault, "projects", slug);
   try {
     await readdir6(projectDir);
   } catch {
@@ -6979,15 +7663,15 @@ async function runProjectIndex(input) {
   }
   const wikilinkPattern = `[[${slug}]]`;
   const entries = [];
-  const compoundDir = join33(input.vault, "projects", slug, "compound");
+  const compoundDir = join35(input.vault, "projects", slug, "compound");
   try {
     const compoundFiles = await readdir6(compoundDir, { withFileTypes: true });
     for (const entry of compoundFiles) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join33(compoundDir, entry.name);
+      const filePath = join35(compoundDir, entry.name);
       let text;
       try {
-        text = await readFile22(filePath, "utf8");
+        text = await readFile23(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7004,16 +7688,16 @@ async function runProjectIndex(input) {
   for (const dir of LAYER2_DIRS) {
     let files;
     try {
-      files = await readdir6(join33(input.vault, dir), { withFileTypes: true });
+      files = await readdir6(join35(input.vault, dir), { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of files) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join33(input.vault, dir, entry.name);
+      const filePath = join35(input.vault, dir, entry.name);
       let text;
       try {
-        text = await readFile22(filePath, "utf8");
+        text = await readFile23(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7034,11 +7718,11 @@ async function runProjectIndex(input) {
     const tb = typeOrder[b.type] ?? 99;
     return ta !== tb ? ta - tb : a.title.localeCompare(b.title);
   });
-  const indexPath = join33(projectDir, "knowledge.md");
+  const indexPath = join35(projectDir, "knowledge.md");
   let existing = false;
   let stale = false;
   try {
-    const existingText = await readFile22(indexPath, "utf8");
+    const existingText = await readFile23(indexPath, "utf8");
     existing = true;
     const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
     const existingPages = new Set(existingEntries.map((l) => {
@@ -7108,9 +7792,9 @@ ${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e
 
 // src/commands/compound.ts
 import { writeFile as writeFile12, mkdir as mkdir11, readdir as readdir7, unlink as unlink4 } from "fs/promises";
-import { join as join34 } from "path";
-import { existsSync as existsSync13 } from "fs";
-import { readFile as readFile23 } from "fs/promises";
+import { join as join36 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { readFile as readFile24 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -7208,17 +7892,17 @@ function extractRetroFields(date, cycleName, block) {
   };
 }
 async function runCompound(input) {
-  const logPath = join34(input.vault, "log.md");
+  const logPath = join36(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile23(logPath, "utf8");
+    logText = await readFile24(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
   const entries = parseRetroEntries(logText);
   const promoted = [];
   const skipped = [];
-  const compoundDir = join34(input.vault, "projects", input.project, "compound");
+  const compoundDir = join36(input.vault, "projects", input.project, "compound");
   for (const entry of entries) {
     const generalizeValue = entry.generalize.trim();
     if (!/^yes/i.test(generalizeValue)) {
@@ -7226,8 +7910,8 @@ async function runCompound(input) {
       continue;
     }
     const slug = slugify(entry.cycleName);
-    const compoundPath = join34(compoundDir, `${slug}.md`);
-    if (existsSync13(compoundPath)) {
+    const compoundPath = join36(compoundDir, `${slug}.md`);
+    if (existsSync14(compoundPath)) {
       skipped.push(entry.date);
       continue;
     }
@@ -7265,7 +7949,7 @@ async function runCompound(input) {
     ].join("\n");
     const content = frontmatter + "\n" + body;
     if (!input.dryRun) {
-      if (!existsSync13(compoundDir)) {
+      if (!existsSync14(compoundDir)) {
         await mkdir11(compoundDir, { recursive: true });
       }
       await writeFile12(compoundPath, content, "utf8");
@@ -7287,16 +7971,16 @@ async function runCompound(input) {
   };
 }
 async function runCompoundDelete(input) {
-  const projectDir = join34(input.vault, "projects", input.project);
-  if (!existsSync13(projectDir)) {
+  const projectDir = join36(input.vault, "projects", input.project);
+  if (!existsSync14(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
       result: err("PROJECT_NOT_FOUND", { slug: input.project, path: projectDir })
     };
   }
   const entryName = input.entry.replace(/\.md$/, "");
-  const compoundPath = join34(projectDir, "compound", `${entryName}.md`);
-  if (!existsSync13(compoundPath)) {
+  const compoundPath = join36(projectDir, "compound", `${entryName}.md`);
+  if (!existsSync14(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", { path: compoundPath })
@@ -7329,8 +8013,8 @@ knowledge.md regenerated`
   };
 }
 async function runCompoundList(input) {
-  const compoundDir = join34(input.vault, "projects", input.project, "compound");
-  if (!existsSync13(compoundDir)) {
+  const compoundDir = join36(input.vault, "projects", input.project, "compound");
+  if (!existsSync14(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -7360,10 +8044,10 @@ could not read compound directory`
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
-    const filePath = join34(compoundDir, dirent.name);
+    const filePath = join36(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile23(filePath, "utf8");
+      text = await readFile24(filePath, "utf8");
     } catch {
       continue;
     }
@@ -7393,9 +8077,9 @@ no compound entries found`;
 
 // src/commands/observe.ts
 import { mkdir as mkdir12, writeFile as writeFile13 } from "fs/promises";
-import { existsSync as existsSync14, statSync as statSync4 } from "fs";
-import { join as join35 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync15, statSync as statSync4 } from "fs";
+import { join as join37 } from "path";
+import { createHash as createHash6 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify2(text) {
   const words = text.trim().split(/\s+/).slice(0, 6).join("-").toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
@@ -7417,13 +8101,13 @@ async function runObserve(input) {
       result: err("SCHEME_REJECTED", { message: "Text must not be empty" })
     };
   }
-  if (!existsSync14(input.vault) || !statSync4(input.vault).isDirectory()) {
+  if (!existsSync15(input.vault) || !statSync4(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: input.vault })
     };
   }
-  const transcriptsDir = join35(input.vault, "raw", "transcripts");
+  const transcriptsDir = join37(input.vault, "raw", "transcripts");
   try {
     await mkdir12(transcriptsDir, { recursive: true });
   } catch {
@@ -7435,11 +8119,11 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify2(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join35(transcriptsDir, fileName);
+  const filePath = join37(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
-  const sha256 = createHash4("sha256").update(Buffer.from(body, "utf8")).digest("hex");
+  const sha256 = createHash6("sha256").update(Buffer.from(body, "utf8")).digest("hex");
   const frontmatterLines = [
     "---",
     "source_url:",
@@ -7475,8 +8159,8 @@ ${input.text.trim()}
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir13, readFile as readFile24, writeFile as writeFile14 } from "fs/promises";
-import { join as join36, relative as relative3, sep as sep3 } from "path";
+import { mkdir as mkdir13, readFile as readFile25, writeFile as writeFile14 } from "fs/promises";
+import { join as join38, relative as relative3, sep as sep3 } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
   const scan = await scanVault(input.vault);
@@ -7554,7 +8238,7 @@ async function resolveProject(input) {
   const envProject = input.env?.SKILLWIKI_PROJECT;
   if (envProject) return envProject;
   const cwd = input.cwd ?? process.cwd();
-  const projectDotenv = await readProjectSlug(join36(cwd, ".skillwiki", ".env"));
+  const projectDotenv = await readProjectSlug(join38(cwd, ".skillwiki", ".env"));
   if (projectDotenv) return projectDotenv;
   const inferred = inferProjectFromPath(input.vault, cwd);
   if (inferred) return inferred;
@@ -7563,7 +8247,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile24(file, "utf8");
+    text = await readFile25(file, "utf8");
   } catch {
     return void 0;
   }
@@ -7688,7 +8372,7 @@ function appendTextSection(lines, title, items, empty) {
   lines.push("");
 }
 async function loadHealthWarnings(vault) {
-  const text = await readIfExists2(join36(vault, ".skillwiki", "health.json"));
+  const text = await readIfExists2(join38(vault, ".skillwiki", "health.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -7701,11 +8385,11 @@ async function loadHealthWarnings(vault) {
   }
 }
 async function writeBriefArtifacts(vault, input) {
-  const metaPath = join36(vault, "meta", "latest-session-brief.md");
-  const cacheMdPath = join36(vault, ".skillwiki", "session-brief.md");
-  const cacheJsonPath = join36(vault, ".skillwiki", "session-brief.json");
-  await mkdir13(join36(vault, "meta"), { recursive: true });
-  await mkdir13(join36(vault, ".skillwiki"), { recursive: true });
+  const metaPath = join38(vault, "meta", "latest-session-brief.md");
+  const cacheMdPath = join38(vault, ".skillwiki", "session-brief.md");
+  const cacheJsonPath = join38(vault, ".skillwiki", "session-brief.json");
+  await mkdir13(join38(vault, "meta"), { recursive: true });
+  await mkdir13(join38(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists2(metaPath));
   const nextComparable = comparableBrief(committed);
@@ -7765,7 +8449,7 @@ function renderCommittedBrief(input) {
   ].filter((line) => line !== "").join("\n");
 }
 async function ensureIndexEntry(vault) {
-  const indexPath = join36(vault, "index.md");
+  const indexPath = join38(vault, "index.md");
   let text = await readIfExists2(indexPath);
   if (!text) return false;
   if (text.includes("[[meta/latest-session-brief]]")) return false;
@@ -7784,7 +8468,7 @@ async function ensureIndexEntry(vault) {
   return true;
 }
 async function appendMaterialLog(vault, today) {
-  const logPath = join36(vault, "log.md");
+  const logPath = join38(vault, "log.md");
   const text = await readIfExists2(logPath);
   if (!text) return false;
   const entry = `
@@ -7794,7 +8478,7 @@ async function appendMaterialLog(vault, today) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile24(path, "utf8");
+    return await readFile25(path, "utf8");
   } catch {
     return "";
   }
@@ -7836,9 +8520,9 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile25, writeFile as writeFile15, mkdir as mkdir14 } from "fs/promises";
-import { join as join37 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { readFile as readFile26, writeFile as writeFile15, mkdir as mkdir14 } from "fs/promises";
+import { join as join39 } from "path";
+import { createHash as createHash7 } from "crypto";
 var ALLOWED_TYPES = /* @__PURE__ */ new Set(["entity", "concept", "comparison", "query"]);
 var TYPE_DIR = {
   entity: "entities",
@@ -7996,7 +8680,7 @@ async function runIngest(input) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile25(input.source, "utf8");
+      sourceContent = await readFile26(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -8004,15 +8688,25 @@ async function runIngest(input) {
       };
     }
   }
-  const sha256 = createHash5("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sensitiveFindings = scanSensitiveContent(sourceContent, { file: input.source });
+  if (sensitiveFindings.length > 0) {
+    return {
+      exitCode: ExitCode.SENSITIVE_CONTENT_DETECTED,
+      result: err("SENSITIVE_CONTENT_DETECTED", {
+        message: "source content contains sensitive authentication material; provide a redacted source before ingesting",
+        findings: sensitiveFindings
+      })
+    };
+  }
+  const sha256 = createHash7("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify3(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join37(input.vault, rawRelPath);
-  const typedAbsPath = join37(input.vault, typedRelPath);
+  const rawAbsPath = join39(input.vault, rawRelPath);
+  const typedAbsPath = join39(input.vault, typedRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -8094,7 +8788,7 @@ async function runIngest(input) {
     };
   }
   try {
-    await mkdir14(join37(input.vault, "raw", "articles"), { recursive: true });
+    await mkdir14(join39(input.vault, "raw", "articles"), { recursive: true });
     await writeFile15(rawAbsPath, rawContent, "utf8");
   } catch (e) {
     return {
@@ -8103,7 +8797,7 @@ async function runIngest(input) {
     };
   }
   try {
-    await mkdir14(join37(input.vault, typedDir), { recursive: true });
+    await mkdir14(join39(input.vault, typedDir), { recursive: true });
     await writeFile15(typedAbsPath, typedContent, "utf8");
   } catch (e) {
     return {
@@ -8282,24 +8976,24 @@ ${body}`;
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync16 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join41 } from "path";
 
 // src/utils/sync-lock.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join38 } from "path";
-import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join40 } from "path";
+import { createHash as createHash8 } from "crypto";
 function getSessionId() {
   if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
   if (process.env.SKILLWIKI_SESSION_ID) return process.env.SKILLWIKI_SESSION_ID;
   return process.pid.toString();
 }
 function lockPath(vault) {
-  return join38(vault, ".skillwiki", "sync.lock");
+  return join40(vault, ".skillwiki", "sync.lock");
 }
 function readLock(vault) {
   const path = lockPath(vault);
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   try {
     const raw = readFileSync11(path, "utf8");
     return JSON.parse(raw);
@@ -8314,8 +9008,8 @@ function isStale(lock, now) {
 }
 function acquireLock(vault, opts = {}) {
   const path = lockPath(vault);
-  const dir = join38(vault, ".skillwiki");
-  if (!existsSync15(dir)) {
+  const dir = join40(vault, ".skillwiki");
+  if (!existsSync16(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
   const sessionId = opts.sessionId ?? getSessionId();
@@ -8360,7 +9054,7 @@ function writeLockedFile(path, lock) {
 }
 function releaseLock(vault, opts = {}) {
   const path = lockPath(vault);
-  if (!existsSync15(path)) {
+  if (!existsSync16(path)) {
     return { released: false };
   }
   const sessionId = opts.sessionId ?? getSessionId();
@@ -8389,7 +9083,7 @@ function releaseLock(vault, opts = {}) {
 function runSyncStatus(input) {
   const vault = input.vault;
   const includeStashes = input.includeStashes ?? false;
-  if (!existsSync16(join39(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: ok({
@@ -8467,7 +9161,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync16(join39(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -8590,7 +9284,7 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync16(join39(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -8762,7 +9456,7 @@ function runSyncPeers(input) {
 }
 function runSyncLock(input) {
   const vault = input.vault;
-  if (!existsSync16(vault)) {
+  if (!existsSync17(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -8797,7 +9491,7 @@ function runSyncLock(input) {
 }
 function runSyncUnlock(input) {
   const vault = input.vault;
-  if (!existsSync16(vault)) {
+  if (!existsSync17(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -8831,7 +9525,7 @@ function runSyncUnlock(input) {
 
 // src/commands/backup.ts
 import { statSync as statSync5, readdirSync as readdirSync3, readFileSync as readFileSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join40, relative as relative4, dirname as dirname13 } from "path";
+import { join as join42, relative as relative4, dirname as dirname13 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -8855,7 +9549,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (SKIP_DIRS2.has(entry.name)) continue;
-    const full = join40(dir, entry.name);
+    const full = join42(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -8878,7 +9572,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join40(input.vault, relPath);
+    const absPath = join42(input.vault, relPath);
     const localStat = statSync5(absPath);
     let needsUpload = true;
     try {
@@ -8954,7 +9648,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join40(target, obj.Key);
+      const localPath = join42(target, obj.Key);
       try {
         const localStat = statSync5(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -9000,11 +9694,11 @@ async function runBackupRestore(input) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync17, statSync as statSync6 } from "fs";
-import { readFile as readFile26 } from "fs/promises";
-import { join as join41 } from "path";
+import { existsSync as existsSync18, statSync as statSync6 } from "fs";
+import { readFile as readFile27 } from "fs/promises";
+import { join as join43 } from "path";
 async function runStatus(input) {
-  if (!existsSync17(input.vault)) {
+  if (!existsSync18(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
   const scan = await scanVault(input.vault);
@@ -9029,7 +9723,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile26(join41(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile27(join43(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -9089,8 +9783,8 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir15, writeFile as writeFile16, stat as stat8 } from "fs/promises";
-import { join as join42 } from "path";
+import { mkdir as mkdir15, writeFile as writeFile16, stat as stat9 } from "fs/promises";
+import { join as join44 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -9159,29 +9853,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat8(join42(input.vault, "SCHEMA.md"));
+    await stat9(join44(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join42(input.vault, relPath);
+    const absPath = join44(input.vault, relPath);
     try {
-      await stat8(absPath);
+      await stat9(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir15(join42(absPath, ".."), { recursive: true });
+      await mkdir15(join44(absPath, ".."), { recursive: true });
       await writeFile16(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join42(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join44(input.vault, "raw", "articles", "example-source.md");
   try {
-    await stat8(rawPath);
+    await stat9(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir15(join42(rawPath, ".."), { recursive: true });
+    await mkdir15(join44(rawPath, ".."), { recursive: true });
     await writeFile16(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -9204,9 +9898,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile27, writeFile as writeFile17 } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
-import { join as join43 } from "path";
+import { readFile as readFile28, writeFile as writeFile17 } from "fs/promises";
+import { existsSync as existsSync19 } from "fs";
+import { join as join45 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -9284,8 +9978,8 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join43(input.vault, ".skillwiki", "graph.json");
-  if (!existsSync18(graphPath)) {
+  const graphPath = input.graphPath ?? join45(input.vault, ".skillwiki", "graph.json");
+  if (!existsSync19(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", {
@@ -9296,7 +9990,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile27(graphPath, "utf8");
+    raw = await readFile28(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9322,7 +10016,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join43(input.vault, "vault-graph.canvas");
+  const outPath = join45(input.vault, "vault-graph.canvas");
   try {
     await writeFile17(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -9344,8 +10038,8 @@ written: ${outPath}`
 }
 
 // src/commands/query.ts
-import { readFile as readFile28, stat as stat9 } from "fs/promises";
-import { join as join44 } from "path";
+import { readFile as readFile29, stat as stat10 } from "fs/promises";
+import { join as join46 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -9466,10 +10160,10 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join44(vault, ".skillwiki", "graph.json");
+  const graphPath = join46(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
-    const fileStat = await stat9(graphPath);
+    const fileStat = await stat10(graphPath);
     const ageHours = (Date.now() - fileStat.mtimeMs) / (1e3 * 60 * 60);
     if (ageHours > 24) needsBuild = true;
   } catch {
@@ -9480,274 +10174,22 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile28(graphPath, "utf8");
+    const raw = await readFile29(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 
-// src/commands/fleet.ts
-import { readFile as readFile29 } from "fs/promises";
-import { hostname as nodeHostname, userInfo } from "os";
-import { join as join45 } from "path";
-import yaml3 from "js-yaml";
-var FLEET_REL_PATH = join45("projects", "llm-wiki", "architecture", "fleet.yaml");
-async function runFleetValidate(input) {
-  const loaded = await loadFleetManifest(input.file);
-  if (!loaded.ok) {
-    if (loaded.error === "FILE_NOT_FOUND") {
-      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
-    }
-    const errors = fleetLoadErrors(loaded);
-    return invalidFleet(errors);
-  }
-  const warnings = fleetWarnings(loaded.manifest);
-  const snapshotter = findSnapshotter(loaded.manifest);
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      valid: true,
-      errors: [],
-      warnings,
-      host_count: Object.keys(loaded.manifest.hosts).length,
-      snapshotter,
-      humanHint: `VALID fleet manifest (${Object.keys(loaded.manifest.hosts).length} hosts; snapshotter: ${snapshotter ?? "none"})`
-    })
-  };
-}
-async function runFleetContext(input) {
-  const env = input.env ?? process.env;
-  const home = input.home ?? env.HOME ?? "";
-  const cwd = input.cwd ?? process.cwd();
-  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
-  const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
-  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join45(vault, FLEET_REL_PATH) : void 0);
-  const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
-  if (!loaded.ok) {
-    const markdown2 = formatUnknownContext({ osHostname, user, cwd, vault, reason: "fleet manifest unavailable or invalid" });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({ manifest_loaded: false, markdown: markdown2, humanHint: markdown2 })
-    };
-  }
-  const resolved = await resolveHostId({
-    manifest: loaded.manifest,
-    hostId: input.hostId,
-    env,
-    home,
-    osHostname
-  });
-  if (!resolved.hostId || !loaded.manifest.hosts[resolved.hostId]) {
-    const markdown2 = formatUnknownContext({ osHostname, user, cwd, vault, reason: "host identity is unresolved" });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({ manifest_loaded: true, markdown: markdown2, humanHint: markdown2 })
-    };
-  }
-  const markdown = formatKnownContext({
-    manifest: loaded.manifest,
-    hostId: resolved.hostId,
-    source: resolved.source,
-    osHostname,
-    user,
-    cwd,
-    vault
-  });
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      manifest_loaded: true,
-      host_id: resolved.hostId,
-      source: resolved.source,
-      markdown,
-      humanHint: markdown
-    })
-  };
-}
-async function loadFleetManifest(file) {
-  let text;
-  try {
-    text = await readFile29(file, "utf8");
-  } catch {
-    return { ok: false, error: "FILE_NOT_FOUND" };
-  }
-  let parsed;
-  try {
-    parsed = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
-  } catch (error) {
-    return { ok: false, error: "INVALID_YAML", detail: error instanceof Error ? error.message : String(error) };
-  }
-  const result = FleetManifestSchema.safeParse(parsed);
-  if (!result.success) {
-    return { ok: false, error: "INVALID_FLEET_MANIFEST", detail: result.error.issues };
-  }
-  return { ok: true, manifest: result.data };
-}
-function invalidFleet(errors) {
-  return {
-    exitCode: ExitCode.FLEET_MANIFEST_INVALID,
-    result: ok({
-      valid: false,
-      errors,
-      warnings: [],
-      host_count: 0,
-      humanHint: `INVALID fleet manifest
-${errors.map((e) => `  ${e.path || "(root)"}: ${e.message}`).join("\n")}`
-    })
-  };
-}
-function fleetLoadErrors(loaded) {
-  if (loaded.error === "INVALID_YAML") {
-    return [{ path: "", message: `invalid YAML: ${String(loaded.detail ?? "parse failed")}` }];
-  }
-  if (loaded.error === "INVALID_FLEET_MANIFEST" && Array.isArray(loaded.detail)) {
-    return loaded.detail.map((issue) => {
-      const zodIssue = issue;
-      return {
-        path: (zodIssue.path ?? []).join("."),
-        message: zodIssue.message ?? "invalid value"
-      };
-    });
-  }
-  return [{ path: "", message: loaded.error }];
-}
-function fleetWarnings(manifest) {
-  const warnings = [];
-  for (const [id, host] of Object.entries(manifest.hosts)) {
-    if (host.role === "snapshotter" && host.protected !== true) {
-      warnings.push(`snapshotter host '${id}' is not protected=true`);
-    }
-  }
-  return warnings;
-}
-function findSnapshotter(manifest) {
-  return Object.entries(manifest.hosts).find(([, host]) => host.role === "snapshotter")?.[0];
-}
-async function resolveHostId(input) {
-  if (input.hostId) return { hostId: input.hostId, source: "host-id" };
-  if (input.env.SKILLWIKI_HOST_ID) return { hostId: input.env.SKILLWIKI_HOST_ID, source: "SKILLWIKI_HOST_ID" };
-  if (input.env.AGENT_HOST_ID) return { hostId: input.env.AGENT_HOST_ID, source: "AGENT_HOST_ID" };
-  if (input.home) {
-    const dotenv = await parseDotenvFile(join45(input.home, ".skillwiki", ".env"));
-    if (dotenv.SKILLWIKI_HOST_ID) {
-      return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID" };
-    }
-  }
-  if (input.env.VS_HOSTNAME) return { hostId: input.env.VS_HOSTNAME, source: "VS_HOSTNAME" };
-  const hostname = input.osHostname.trim();
-  if (hostname) {
-    if (input.manifest.hosts[hostname]) return { hostId: hostname, source: "hostname" };
-    const byHostname = Object.entries(input.manifest.hosts).find(([, host]) => host.identity.hostnames.includes(hostname));
-    if (byHostname) return { hostId: byHostname[0], source: "hostname" };
-  }
-  return {};
-}
-function formatKnownContext(input) {
-  const host = input.manifest.hosts[input.hostId];
-  const protectedValue = host.protected === true ? "true" : "false";
-  const writesTo = host.writes_to.join(", ");
-  const selfAliases = collectSelfAliases(input.manifest, input.hostId);
-  const outbound = collectOutboundAccess(input.manifest, input.hostId);
-  const maintenanceLines = formatMaintenanceLines(host);
-  const guidance = input.hostId === "macos-dev" ? "use declared SSH aliases for remote work when needed; do not assume undeclared hosts have reciprocal SSH access." : `this session is already on \`${input.hostId}\`; do not SSH to self aliases unless the user explicitly asks. Do not assume outbound SSH to other fleet hosts is configured.`;
-  return [
-    "## Runtime Host Context",
-    "",
-    `- Current machine: \`${input.hostId}\`${input.source ? ` (source: \`${input.source}\`)` : ""}`,
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    `- Fleet role: \`${host.role}\`; protected: \`${protectedValue}\`; writes_to: \`${writesTo}\``,
-    ...maintenanceLines,
-    `- Self SSH aliases known in fleet: ${formatList(selfAliases)}`,
-    `- Declared outbound SSH from this source: ${formatOutboundAccess(outbound)}`,
-    `- Guidance: ${guidance}`
-  ].join("\n");
-}
-function formatUnknownContext(input) {
-  return [
-    "## Runtime Host Context",
-    "",
-    "- Current machine: unknown",
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    "- Fleet role: unknown",
-    "- Self SSH aliases known in fleet: unknown",
-    "- Declared outbound SSH from this source: unknown",
-    `- Guidance: ${input.reason}; do not assume local vs remote role. Inspect runtime or ask before SSH/deploy/sync work.`
-  ].join("\n");
-}
-function collectSelfAliases(manifest, hostId2) {
-  const aliases = [];
-  const host = manifest.hosts[hostId2];
-  const access = host?.access?.from ?? {};
-  for (const profile of Object.values(access)) {
-    for (const alias of profile.ssh_aliases ?? []) aliases.push(alias);
-  }
-  return [...new Set(aliases)];
-}
-function collectOutboundAccess(manifest, sourceHostId) {
-  const hosts = [];
-  for (const [targetId, target] of Object.entries(manifest.hosts)) {
-    if (targetId === sourceHostId) continue;
-    const profile = target.access?.from?.[sourceHostId];
-    if (profile && (profile.status === "configured" || profile.status === "local")) {
-      hosts.push({
-        hostId: targetId,
-        sshAliases: [...new Set(profile.ssh_aliases ?? [])],
-        users: [...new Set(profile.users ?? [])]
-      });
-    }
-  }
-  return hosts.sort((left, right) => left.hostId.localeCompare(right.hostId));
-}
-function formatMaintenanceLines(host) {
-  const satellite = host.maintenance?.skillwiki_satellite;
-  if (!satellite?.enabled) return [];
-  return [
-    `- Maintenance role: \`skillwiki satellite\`; user: \`${satellite.user}\`; ssh: \`${satellite.ssh_alias}\``,
-    `- Maintenance paths: maintenance vault: \`${satellite.vault_path}\`; repo: \`${satellite.repo_path}\`; scheduler: \`${satellite.scheduler}\`; jobs: ${formatList(satellite.jobs)}`
-  ];
-}
-function formatOutboundAccess(values) {
-  if (values.length === 0) return "none";
-  return values.map((value) => {
-    const aliasPart = value.sshAliases.length > 0 ? ` via ${formatList(value.sshAliases)}` : " (no SSH aliases)";
-    const usersPart = value.users.length > 0 ? ` (users: ${formatList(value.users)})` : "";
-    return `\`${value.hostId}\`${aliasPart}${usersPart}`;
-  }).join("; ");
-}
-function formatList(values) {
-  return values.length > 0 ? values.map((v) => `\`${v}\``).join(", ") : "none";
-}
-function formatMaybe(value) {
-  return value && value.trim().length > 0 ? `\`${value}\`` : "unknown";
-}
-function safeEnvValue(value) {
-  return value && value.trim().length > 0 ? value : void 0;
-}
-function safeUserName() {
-  try {
-    return userInfo().username;
-  } catch {
-    return "";
-  }
-}
-
 // src/utils/auto-commit.ts
-import { existsSync as existsSync19 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync20 } from "fs";
+import { join as join47 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   if (dotenv["AUTO_COMMIT"] === "false") return;
-  if (!existsSync19(join46(vault, ".git"))) return;
+  if (!existsSync20(join47(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain"]);
@@ -9798,7 +10240,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join47(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join48(vault, ".skillwiki", "graph.json");
   emit(await runGraphBuild({ vault, out }), vault);
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");