skillwiki 0.9.2 → 0.9.4

package/dist/cli.js

@@ -69,7 +69,8 @@ var ExitCode = {
   BODY_TRUNCATION_GUARD: 47,
   SYNC_LOCK_HELD: 48,
   LOG_APPEND_LOCK_HELD: 49,
-  FLEET_MANIFEST_INVALID: 50
+  FLEET_MANIFEST_INVALID: 50,
+  SENSITIVE_CONTENT_DETECTED: 51
 };
 
 // ../shared/src/json-output.ts
@@ -450,6 +451,148 @@ function sanitizeUrl(u) {
 // src/commands/validate.ts
 import { readFile as readFile2, writeFile } from "fs/promises";
 import { join as join2, resolve, relative, sep } from "path";
+
+// src/utils/sensitive-content.ts
+import { createHash as createHash2 } from "crypto";
+var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
+var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
+var MATCHERS = [
+  {
+    kind: "private_key",
+    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
+  },
+  {
+    kind: "authorization_header",
+    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "cookie",
+    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "jwt",
+    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "provider_key",
+    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
+    valueGroup: 1
+  },
+  {
+    kind: "access_key",
+    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "api_key",
+    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "password",
+    re: /\b(?:pass(?:word|wd)?)["']?\s*[:=]\s*["']?([^\s`"']{8,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "secret",
+    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  },
+  {
+    kind: "token",
+    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
+    valueGroup: 1
+  }
+];
+function fingerprint(value) {
+  return createHash2("sha256").update(value).digest("hex").slice(0, 12);
+}
+function lineFor(text, offset) {
+  return text.slice(0, offset).split(/\r?\n/).length;
+}
+function redactMarker(kind, value) {
+  return `[REDACTED:${kind}:${fingerprint(value)}]`;
+}
+function isSyntheticPlaceholder(value) {
+  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
+}
+function collectMatches(text) {
+  const matches = [];
+  for (const matcher of MATCHERS) {
+    matcher.re.lastIndex = 0;
+    for (const m of text.matchAll(matcher.re)) {
+      const whole = m[0];
+      const start = m.index ?? 0;
+      if (REDACTED_RE.test(whole)) continue;
+      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
+      if (isSyntheticPlaceholder(value)) continue;
+      const valueOffset = whole.lastIndexOf(value);
+      const valueStart = start + Math.max(0, valueOffset);
+      matches.push({
+        start,
+        end: start + whole.length,
+        valueStart,
+        valueEnd: valueStart + value.length,
+        kind: matcher.kind
+      });
+    }
+  }
+  return matches.sort((a, b) => {
+    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
+    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
+  });
+}
+function collapseOverlaps(matches) {
+  const kept = [];
+  for (const match of matches) {
+    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
+    if (!overlaps) kept.push(match);
+  }
+  return kept;
+}
+function scanSensitiveContent(text, opts = {}) {
+  return collapseOverlaps(collectMatches(text)).map((match) => {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    const marker = redactMarker(match.kind, value);
+    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
+    const preview = rawPreview.replace(value, marker);
+    return {
+      file: opts.file,
+      line: lineFor(text, match.valueStart),
+      kind: match.kind,
+      preview,
+      fingerprint: fingerprint(value)
+    };
+  });
+}
+function redactSensitiveContent(text, opts = {}) {
+  const matches = collapseOverlaps(collectMatches(text));
+  if (matches.length === 0) return { text, changed: false, findings: [] };
+  let out = "";
+  let cursor = 0;
+  for (const match of matches) {
+    const value = text.slice(match.valueStart, match.valueEnd);
+    out += text.slice(cursor, match.valueStart);
+    out += redactMarker(match.kind, value);
+    cursor = match.valueEnd;
+  }
+  out += text.slice(cursor);
+  return {
+    text: out,
+    changed: out !== text,
+    findings: scanSensitiveContent(text, opts)
+  };
+}
+
+// src/commands/validate.ts
 var TYPE_TO_SECTION = {
   entity: "Entities",
   concept: "Concepts",
@@ -480,6 +623,26 @@ async function runValidate(input) {
     return { exitCode: ExitCode.INVALID_FRONTMATTER, result: fm };
   }
   const det = detectSchema(fm.data);
+  const sensitiveFindings = scanSensitiveContent(text, { file: input.file });
+  if (sensitiveFindings.length > 0) {
+    const errors = sensitiveFindings.map((f) => ({
+      path: "sensitive_content",
+      message: `${f.kind} at line ${f.line}: ${f.preview}`
+    }));
+    return {
+      exitCode: ExitCode.SENSITIVE_CONTENT_DETECTED,
+      result: ok({
+        schema: det.schema,
+        valid: false,
+        errors,
+        index_updated: false,
+        log_updated: false,
+        humanHint: `SENSITIVE CONTENT (${sensitiveFindings.length})
+${errors.map((e) => `  ${e.message}`).join("\n")}`,
+        sensitive_findings: sensitiveFindings
+      })
+    };
+  }
   if (!det.schema) {
     return { exitCode: ExitCode.SCHEMA_NOT_DETECTED, result: ok({ schema: null, valid: false, errors: [], index_updated: false, log_updated: false, humanHint: "schema not detected" }) };
   }
@@ -2704,6 +2867,7 @@ ${content}
 // src/commands/lint.ts
 import { existsSync as existsSync6 } from "fs";
 import { readFile as readFile17 } from "fs/promises";
+import { createHash as createHash4 } from "crypto";
 import { join as join23 } from "path";
 
 // src/commands/sparse-community.ts
@@ -2920,7 +3084,7 @@ async function safeWritePage(absPath, newContent, opts = {}) {
 }
 
 // src/commands/raw-body-dedup.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 async function runRawBodyDedup(vault) {
   const scan = await scanVault(vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
@@ -2931,7 +3095,7 @@ async function runRawBodyDedup(vault) {
     const split = splitFrontmatter(text);
     if (!split.ok) continue;
     totalFiles++;
-    const bodyHash = createHash2("sha256").update(split.data.body).digest("hex");
+    const bodyHash = createHash3("sha256").update(split.data.body).digest("hex");
     const fm = extractFrontmatter(text);
     let fmSha256 = null;
     if (fm.ok && typeof fm.data.sha256 === "string" && fm.data.sha256.length === 64) {
@@ -3387,7 +3551,7 @@ function extractSourceEntries(rawFm) {
   }
   return entries;
 }
-var ERROR_ORDER = ["broken_wikilinks", "invalid_frontmatter", "raw_source_identity_conflict", "raw_dedup", "broken_sources", "tag_not_in_taxonomy", "path_too_long"];
+var ERROR_ORDER = ["sensitive_content", "broken_wikilinks", "invalid_frontmatter", "raw_source_identity_conflict", "raw_dedup", "broken_sources", "tag_not_in_taxonomy", "path_too_long"];
 var WARNING_ORDER = ["raw_body_duplicate", "raw_subdirectory_duplicate", "file_source_url", "index_incomplete", "index_link_format", "stale_page", "page_too_large", "log_rotate_needed", "orphans", "compound_refs", "legacy_citation_style", "orphaned_citations", "duplicate_frontmatter", "work_item_health", "orphaned_project_pages", "missing_overview", "missing_diagram"];
 var INFO_ORDER = ["bridges", "sparse_community", "page_structure", "topic_map_recommended", "frontmatter_wikilink", "wikilink_citation", "missing_tldr", "stale_sections", "cli_refs"];
 var KNOWN_BUCKETS = [...ERROR_ORDER, ...WARNING_ORDER, ...INFO_ORDER];
@@ -3416,6 +3580,26 @@ function summarizeBucket(bucket, severity, vaultPath, examplesLimit) {
     details_command: `skillwiki lint ${shellQuote(vaultPath)} --only ${bucket.kind}`
   };
 }
+function recomputeRawSha256IfPresent(content) {
+  const split = splitFrontmatter(content);
+  if (!split.ok) return content;
+  if (!/^sha256:\s*[0-9a-f]{64}$/m.test(split.data.rawFrontmatter)) return content;
+  const sha256 = createHash4("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
+  const rawFrontmatter = split.data.rawFrontmatter.replace(/^sha256:\s*[0-9a-f]{64}$/m, `sha256: ${sha256}`);
+  return `---
+${rawFrontmatter}
+---
+${split.data.body}`;
+}
+function appendLintFixLastOp(vault, fixed) {
+  if (fixed.length === 0) return;
+  appendLastOp(vault, {
+    operation: "lint-fix",
+    summary: `fixed ${fixed.length} page(s)`,
+    files: fixed,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
 function summarizeLintOutput(output, examplesLimit = 3) {
   const buckets = [
     ...output.by_severity.error.map((bucket) => summarizeBucket(bucket, "error", output.vault.path, examplesLimit)),
@@ -3517,6 +3701,16 @@ async function runLint(input) {
   const allPages = scan.ok ? [...scan.data.typedKnowledge, ...scan.data.raw, ...scan.data.workItems, ...scan.data.compound] : [];
   const slugs = scan.ok ? buildSlugMap(allPages) : /* @__PURE__ */ new Map();
   if (scan.ok) {
+    const sensitiveFlags = [];
+    for (const page of scan.data.allMarkdown) {
+      try {
+        const text = await readPage(page);
+        const findings = scanSensitiveContent(text, { file: page.relPath });
+        sensitiveFlags.push(...findings);
+      } catch {
+      }
+    }
+    if (sensitiveFlags.length > 0) buckets.sensitive_content = sensitiveFlags;
     const subDirDupes = [];
     const flatStems = /* @__PURE__ */ new Map();
     const deepFiles = [];
@@ -3732,6 +3926,36 @@ async function runLint(input) {
       }
     }
     if (staleSectionFlags.length > 0) buckets.stale_sections = staleSectionFlags;
+    if (shouldFix("sensitive_content") && buckets.sensitive_content) {
+      const sensitiveFixed = [];
+      for (const page of scan.data.allMarkdown) {
+        try {
+          const raw = await readPage(page);
+          const redacted = redactSensitiveContent(raw, { file: page.relPath });
+          if (!redacted.changed) continue;
+          const next = recomputeRawSha256IfPresent(redacted.text);
+          const w = await safeWritePage(page.absPath, next, { minBodyRatio: null });
+          if (!w.ok) {
+            unresolved.push(page.relPath);
+            continue;
+          }
+          sensitiveFixed.push(page.relPath);
+        } catch {
+          unresolved.push(page.relPath);
+        }
+      }
+      fixed.push(...sensitiveFixed);
+      const remainingSensitiveFlags = [];
+      for (const page of scan.data.allMarkdown) {
+        try {
+          const text = await readPage(page);
+          remainingSensitiveFlags.push(...scanSensitiveContent(text, { file: page.relPath }));
+        } catch {
+        }
+      }
+      if (remainingSensitiveFlags.length > 0) buckets.sensitive_content = remainingSensitiveFlags;
+      else delete buckets.sensitive_content;
+    }
     if (shouldFix("legacy_citation_style") && legacyPages.length > 0) {
       const FENCE_RE2 = /```[\s\S]*?```/g;
       const INLINE_MARKER = /\^\[raw\/[^\]]+\]/g;
@@ -4088,6 +4312,7 @@ ${newBody}`;
       humanHint: `--only ${input.only}
 ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items.length}`).join("\n")}`
     };
+    if (input.fix) appendLintFixLastOp(input.vault, fixed);
     return {
       exitCode: fExit,
       result: ok(input.summary ? summarizeLintOutput(output2, input.examplesLimit) : output2)
@@ -4110,14 +4335,7 @@ ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items
     hintLines.push(`  ${b.kind}: ${b.items.length}`);
   }
   if (hintLines.length === 0) hintLines.push("0 errors, 0 warnings, 0 info");
-  if (input.fix && fixed.length > 0) {
-    appendLastOp(input.vault, {
-      operation: "lint-fix",
-      summary: `fixed ${fixed.length} page(s)`,
-      files: fixed,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
+  if (input.fix) appendLintFixLastOp(input.vault, fixed);
   const output = {
     vault: { path: input.vault, source: input.source ?? "resolved" },
     summary,
@@ -4134,12 +4352,12 @@ ${match.length === 0 ? "0 violations" : match.map((b) => `  ${b.kind}: ${b.items
 
 // src/commands/health.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname10, join as join29, resolve as resolve6 } from "path";
+import { dirname as dirname10, join as join30, resolve as resolve6 } from "path";
 import { platform as platform3 } from "os";
 
 // src/commands/doctor.ts
 import { existsSync as existsSync11, lstatSync, readlinkSync, readdirSync as readdirSync2, statSync as statSync3, readFileSync as readFileSync7 } from "fs";
-import { join as join28, resolve as resolve5 } from "path";
+import { join as join29, resolve as resolve5 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
@@ -4381,135 +4599,535 @@ function parseTomlScalar(rawValue) {
   return value;
 }
 
-// src/utils/s3-mount-health.ts
-import { execSync } from "child_process";
-import { platform } from "os";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readFileSync as readFile19 } from "fs";
+// src/commands/fleet.ts
+import { readFile as readFile19 } from "fs/promises";
+import { hostname as nodeHostname, userInfo } from "os";
 import { join as join27 } from "path";
-var OS = platform();
-function findRcloneMountPid() {
-  try {
-    const out = execSync("pgrep -f 'rclone.*mount'", {
-      encoding: "utf8",
-      timeout: 2e3,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const pids = out.split("\n").filter(Boolean);
-    if (pids.length === 0) return null;
-    return parseInt(pids[0], 10);
-  } catch {
-    try {
-      const out = execSync("ps aux", { encoding: "utf8", timeout: 2e3, stdio: ["pipe", "pipe", "pipe"] });
-      for (const line of out.split("\n")) {
-        if (line.includes("rclone") && line.includes("mount") && !line.includes("grep")) {
-          const parts = line.trim().split(/\s+/);
-          if (parts.length >= 2) return parseInt(parts[1], 10);
-        }
-      }
-    } catch {
+import yaml3 from "js-yaml";
+var FLEET_REL_PATH = join27("projects", "llm-wiki", "architecture", "fleet.yaml");
+async function runFleetValidate(input) {
+  const loaded = await loadFleetManifest(input.file);
+  if (!loaded.ok) {
+    if (loaded.error === "FILE_NOT_FOUND") {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
     }
-    return null;
+    const errors = fleetLoadErrors(loaded);
+    return invalidFleet(errors);
   }
+  const warnings = fleetWarnings(loaded.manifest);
+  const snapshotter = findSnapshotter(loaded.manifest);
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      valid: true,
+      errors: [],
+      warnings,
+      host_count: Object.keys(loaded.manifest.hosts).length,
+      snapshotter,
+      humanHint: `VALID fleet manifest (${Object.keys(loaded.manifest.hosts).length} hosts; snapshotter: ${snapshotter ?? "none"})`
+    })
+  };
 }
-function parseRcloneFlags(pid) {
-  const flags = /* @__PURE__ */ new Map();
-  try {
-    const args = getRcloneArgs(pid);
-    for (let i = 0; i < args.length; i++) {
-      const arg = args[i];
-      if (arg.startsWith("--") && arg.includes("=")) {
-        const eq = arg.indexOf("=");
-        flags.set(arg.slice(0, eq), arg.slice(eq + 1));
-      } else if (arg.startsWith("--")) {
-        const next = args[i + 1];
-        if (next && !next.startsWith("-")) {
-          flags.set(arg, next);
-          i++;
-        } else {
-          flags.set(arg, "");
-        }
-      }
-    }
-  } catch {
+async function runFleetContext(input) {
+  const env = input.env ?? process.env;
+  const home = input.home ?? env.HOME ?? "";
+  const cwd = input.cwd ?? process.cwd();
+  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
+  const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
+  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
+  const file = input.file ?? (vault ? join27(vault, FLEET_REL_PATH) : void 0);
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
+  if (!loaded.ok) {
+    const warnings = ["fleet manifest unavailable or invalid"];
+    const markdown2 = formatUnknownContext({
+      generatedAt,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      reason: warnings[0],
+      trace: [],
+      warnings
+    });
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: false,
+        generated_at: generatedAt,
+        identity_status: "unknown",
+        resolver_trace: [],
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
+    };
   }
-  return flags;
-}
-function getRcloneVersion() {
-  try {
-    const out = execSync("rclone version", {
-      encoding: "utf8",
-      timeout: 3e3,
-      stdio: ["pipe", "pipe", "pipe"]
+  const resolved = await resolveHostId({
+    manifest: loaded.manifest,
+    hostId: input.hostId,
+    env,
+    home,
+    osHostname
+  });
+  if (resolved.hostId && !loaded.manifest.hosts[resolved.hostId]) {
+    const source = resolved.source ?? "unknown";
+    const warnings = [`resolved host id \`${resolved.hostId}\` from ${source} is not in fleet.yaml`];
+    const markdown2 = formatInvalidContext({
+      generatedAt,
+      hostId: resolved.hostId,
+      source,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      trace: resolved.trace,
+      warnings
     });
-    const match = out.match(/rclone\s+v(\d+)\.(\d+)\.(\d+)/i);
-    if (!match) return null;
     return {
-      major: parseInt(match[1], 10),
-      minor: parseInt(match[2], 10),
-      patch: parseInt(match[3], 10),
-      raw: out.split("\n")[0].trim()
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: true,
+        host_id: resolved.hostId,
+        source: resolved.source,
+        generated_at: generatedAt,
+        identity_status: "invalid",
+        resolver_trace: resolved.trace,
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
     };
-  } catch {
-    return null;
   }
-}
-function extractRcloneFs(args) {
-  let foundMount = false;
-  for (const arg of args) {
-    if (arg === "mount") {
-      foundMount = true;
-      continue;
-    }
-    if (foundMount && arg.includes(":") && !arg.startsWith("-") && !arg.startsWith("/")) {
-      return arg;
-    }
+  if (!resolved.hostId) {
+    const warnings = ["host identity is unresolved"];
+    const markdown2 = formatUnknownContext({
+      generatedAt,
+      osHostname,
+      user,
+      cwd,
+      vault,
+      reason: warnings[0],
+      trace: resolved.trace,
+      warnings
+    });
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        manifest_loaded: true,
+        generated_at: generatedAt,
+        identity_status: "unknown",
+        resolver_trace: resolved.trace,
+        warnings,
+        markdown: markdown2,
+        humanHint: markdown2
+      })
+    };
   }
-  return null;
+  const markdown = formatKnownContext({
+    manifest: loaded.manifest,
+    hostId: resolved.hostId,
+    source: resolved.source,
+    generatedAt,
+    osHostname,
+    user,
+    cwd,
+    vault,
+    trace: resolved.trace
+  });
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      manifest_loaded: true,
+      host_id: resolved.hostId,
+      source: resolved.source,
+      generated_at: generatedAt,
+      identity_status: "known",
+      resolver_trace: resolved.trace,
+      warnings: [],
+      markdown,
+      humanHint: markdown
+    })
+  };
 }
-function getRcloneArgs(pid) {
+async function loadFleetManifest(file) {
+  let text;
   try {
-    if (OS === "linux") {
-      const raw = readFileSync6(`/proc/${pid}/cmdline`);
-      return new TextDecoder().decode(raw).split("\0").filter(Boolean);
-    } else {
-      const out = execSync(`ps -o args= -p ${pid}`, {
-        encoding: "utf8",
-        timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
-      }).trim();
-      return out.split(/\s+/);
-    }
+    text = await readFile19(file, "utf8");
   } catch {
-    return [];
+    return { ok: false, error: "FILE_NOT_FOUND" };
   }
-}
-function queryRcloneRC(rcAddr, fs) {
+  let parsed;
   try {
-    const payload = JSON.stringify({ fs });
-    const out = execSync(
-      `curl -s --max-time 3 -X POST "http://${rcAddr}/vfs/stats" -H "Content-Type: application/json" -d '${payload}' 2>/dev/null`,
-      { encoding: "utf8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
-    );
-    if (!out.trim()) return null;
-    const data = JSON.parse(out);
-    if (data.status && data.status >= 400) {
-      return { error: data.error || `RC error (status ${data.status})`, erroredFiles: 0, uploadsInProgress: 0, uploadsQueued: 0, outOfSpace: false, bytesUsed: 0, files: 0, totalSize: "unknown" };
-    }
-    const dc = data.diskCache || {};
-    return {
-      erroredFiles: dc.erroredFiles ?? 0,
-      uploadsInProgress: dc.uploadsInProgress ?? 0,
-      uploadsQueued: dc.uploadsQueued ?? 0,
-      outOfSpace: dc.outOfSpace ?? false,
-      bytesUsed: dc.bytesUsed ?? 0,
-      files: dc.files ?? 0,
-      totalSize: data.totalSize || "unknown"
-    };
-  } catch {
-    return { error: "RC endpoint unreachable", erroredFiles: 0, uploadsInProgress: 0, uploadsQueued: 0, outOfSpace: false, bytesUsed: 0, files: 0, totalSize: "unknown" };
+    parsed = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
+  } catch (error) {
+    return { ok: false, error: "INVALID_YAML", detail: error instanceof Error ? error.message : String(error) };
   }
-}
-function detectFuseMount(vaultPath) {
+  const result = FleetManifestSchema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, error: "INVALID_FLEET_MANIFEST", detail: result.error.issues };
+  }
+  return { ok: true, manifest: result.data };
+}
+function invalidFleet(errors) {
+  return {
+    exitCode: ExitCode.FLEET_MANIFEST_INVALID,
+    result: ok({
+      valid: false,
+      errors,
+      warnings: [],
+      host_count: 0,
+      humanHint: `INVALID fleet manifest
+${errors.map((e) => `  ${e.path || "(root)"}: ${e.message}`).join("\n")}`
+    })
+  };
+}
+function fleetLoadErrors(loaded) {
+  if (loaded.error === "INVALID_YAML") {
+    return [{ path: "", message: `invalid YAML: ${String(loaded.detail ?? "parse failed")}` }];
+  }
+  if (loaded.error === "INVALID_FLEET_MANIFEST" && Array.isArray(loaded.detail)) {
+    return loaded.detail.map((issue) => {
+      const zodIssue = issue;
+      return {
+        path: (zodIssue.path ?? []).join("."),
+        message: zodIssue.message ?? "invalid value"
+      };
+    });
+  }
+  return [{ path: "", message: loaded.error }];
+}
+function fleetWarnings(manifest) {
+  const warnings = [];
+  for (const [id, host] of Object.entries(manifest.hosts)) {
+    if (host.role === "snapshotter" && host.protected !== true) {
+      warnings.push(`snapshotter host '${id}' is not protected=true`);
+    }
+  }
+  return warnings;
+}
+function findSnapshotter(manifest) {
+  return Object.entries(manifest.hosts).find(([, host]) => host.role === "snapshotter")?.[0];
+}
+async function resolveHostId(input) {
+  const trace = [];
+  if (input.hostId) {
+    trace.push({ source: "--host-id", status: "matched", value: input.hostId });
+    return { hostId: input.hostId, source: "host-id", trace };
+  }
+  trace.push({ source: "--host-id", status: "unset" });
+  if (input.env.SKILLWIKI_HOST_ID) {
+    trace.push({ source: "SKILLWIKI_HOST_ID", status: "matched", value: input.env.SKILLWIKI_HOST_ID });
+    return { hostId: input.env.SKILLWIKI_HOST_ID, source: "SKILLWIKI_HOST_ID", trace };
+  }
+  trace.push({ source: "SKILLWIKI_HOST_ID", status: "unset" });
+  if (input.env.AGENT_HOST_ID) {
+    trace.push({ source: "AGENT_HOST_ID", status: "matched", value: input.env.AGENT_HOST_ID });
+    return { hostId: input.env.AGENT_HOST_ID, source: "AGENT_HOST_ID", trace };
+  }
+  trace.push({ source: "AGENT_HOST_ID", status: "unset" });
+  if (input.home) {
+    const dotenv = await parseDotenvFile(join27(input.home, ".skillwiki", ".env"));
+    if (dotenv.SKILLWIKI_HOST_ID) {
+      trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "matched", value: dotenv.SKILLWIKI_HOST_ID });
+      return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", trace };
+    }
+    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "unset" });
+  } else {
+    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "skipped" });
+  }
+  if (input.env.VS_HOSTNAME) {
+    trace.push({ source: "VS_HOSTNAME", status: "matched", value: input.env.VS_HOSTNAME });
+    return { hostId: input.env.VS_HOSTNAME, source: "VS_HOSTNAME", trace };
+  }
+  trace.push({ source: "VS_HOSTNAME", status: "unset" });
+  const hostname = input.osHostname.trim();
+  if (hostname) {
+    if (input.manifest.hosts[hostname]) {
+      trace.push({ source: "hostname", status: "matched", value: hostname });
+      return { hostId: hostname, source: "hostname", trace };
+    }
+    const byHostname = Object.entries(input.manifest.hosts).find(([, host]) => host.identity.hostnames.includes(hostname));
+    if (byHostname) {
+      trace.push({ source: "hostname", status: "matched", value: hostname });
+      return { hostId: byHostname[0], source: "hostname", trace };
+    }
+    trace.push({ source: "hostname", status: "unmatched", value: hostname });
+  } else {
+    trace.push({ source: "hostname", status: "unset" });
+  }
+  return { trace };
+}
+function formatKnownContext(input) {
+  const host = input.manifest.hosts[input.hostId];
+  const protectedValue = host.protected === true ? "true" : "false";
+  const writesTo = host.writes_to.join(", ");
+  const selfAliases = collectSelfAliases(input.manifest, input.hostId);
+  const outbound = collectOutboundAccess(input.manifest, input.hostId);
+  const maintenanceLines = formatMaintenanceLines(host);
+  const guidance = input.hostId === "macos-dev" ? "use declared SSH aliases for remote work when needed; do not assume undeclared hosts have reciprocal SSH access." : `this session is already on \`${input.hostId}\`; do not SSH to self aliases unless the user explicitly asks. Do not assume outbound SSH to other fleet hosts is configured.`;
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    `- Current machine: \`${input.hostId}\`${input.source ? ` (source: \`${input.source}\`)` : ""}`,
+    "- Identity status: `known`",
+    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    `- Fleet role: \`${host.role}\`; protected: \`${protectedValue}\`; writes_to: \`${writesTo}\``,
+    ...maintenanceLines,
+    `- Self SSH aliases known in fleet: ${formatList(selfAliases)}`,
+    `- Declared outbound SSH from this source: ${formatOutboundAccess(outbound)}`,
+    `- Guidance: ${guidance}`
+  ].join("\n");
+}
+function formatUnknownContext(input) {
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    "- Current machine: unknown",
+    "- Identity status: `unknown`",
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- Warnings: ${formatWarnings(input.warnings)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    "- Fleet role: unknown",
+    "- Self SSH aliases known in fleet: unknown",
+    "- Declared outbound SSH from this source: unknown",
+    `- Guidance: ${input.reason}; do not assume local vs remote role. Inspect runtime or ask before SSH/deploy/sync work.`
+  ].join("\n");
+}
+function formatInvalidContext(input) {
+  return [
+    "## Runtime Host Context",
+    "",
+    `- Context generated: \`${input.generatedAt}\``,
+    "- Current machine: unknown",
+    "- Identity status: `invalid`",
+    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
+    `- Resolver trace: ${formatTrace(input.trace)}`,
+    `- Warnings: ${formatWarnings(input.warnings)}`,
+    `- OS hostname: ${formatMaybe(input.osHostname)}`,
+    `- User: ${formatMaybe(input.user)}`,
+    `- Workspace: ${formatMaybe(input.cwd)}`,
+    `- Vault: ${formatMaybe(input.vault)}`,
+    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
+    "- Fleet role: unknown",
+    "- Self SSH aliases known in fleet: unknown",
+    "- Declared outbound SSH from this source: unknown",
+    `- Guidance: do not trust this identity; rerun with \`--host-id\` only if the user confirms \`${input.hostId}\` is the current fleet host id.`
+  ].join("\n");
+}
+function collectSelfAliases(manifest, hostId2) {
+  const aliases = [];
+  const host = manifest.hosts[hostId2];
+  const access = host?.access?.from ?? {};
+  for (const profile of Object.values(access)) {
+    for (const alias of profile.ssh_aliases ?? []) aliases.push(alias);
+  }
+  return [...new Set(aliases)];
+}
+function collectOutboundAccess(manifest, sourceHostId) {
+  const hosts = [];
+  for (const [targetId, target] of Object.entries(manifest.hosts)) {
+    if (targetId === sourceHostId) continue;
+    const profile = target.access?.from?.[sourceHostId];
+    if (profile && (profile.status === "configured" || profile.status === "local")) {
+      hosts.push({
+        hostId: targetId,
+        sshAliases: [...new Set(profile.ssh_aliases ?? [])],
+        users: [...new Set(profile.users ?? [])]
+      });
+    }
+  }
+  return hosts.sort((left, right) => left.hostId.localeCompare(right.hostId));
+}
+function formatMaintenanceLines(host) {
+  const satellite = host.maintenance?.skillwiki_satellite;
+  if (!satellite?.enabled) return [];
+  return [
+    `- Maintenance role: \`skillwiki satellite\`; user: \`${satellite.user}\`; ssh: \`${satellite.ssh_alias}\``,
+    `- Maintenance paths: maintenance vault: \`${satellite.vault_path}\`; repo: \`${satellite.repo_path}\`; scheduler: \`${satellite.scheduler}\`; jobs: ${formatList(satellite.jobs)}`
+  ];
+}
+function formatOutboundAccess(values) {
+  if (values.length === 0) return "none";
+  return values.map((value) => {
+    const aliasPart = value.sshAliases.length > 0 ? ` via ${formatList(value.sshAliases)}` : " (no SSH aliases)";
+    const usersPart = value.users.length > 0 ? ` (users: ${formatList(value.users)})` : "";
+    return `\`${value.hostId}\`${aliasPart}${usersPart}`;
+  }).join("; ");
+}
+function formatResolution(source, hostId2) {
+  return source ? `\`${source === "host-id" ? "--host-id" : source}\` -> \`${hostId2}\`` : `unknown -> \`${hostId2}\``;
+}
+function formatTrace(values) {
+  if (values.length === 0) return "not available";
+  return values.map((value) => {
+    const source = `\`${value.source}\``;
+    if (value.status === "matched") return `${source} matched \`${value.value ?? ""}\``;
+    if (value.status === "unmatched") return `${source} unmatched \`${value.value ?? ""}\``;
+    return `${source} ${value.status}`;
+  }).join("; ");
+}
+function formatWarnings(values) {
+  return values.length > 0 ? values.join("; ") : "none";
+}
+function formatList(values) {
+  return values.length > 0 ? values.map((v) => `\`${v}\``).join(", ") : "none";
+}
+function formatMaybe(value) {
+  return value && value.trim().length > 0 ? `\`${value}\`` : "unknown";
+}
+function safeEnvValue(value) {
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function safeUserName() {
+  try {
+    return userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+// src/utils/s3-mount-health.ts
+import { execSync } from "child_process";
+import { platform } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readFileSync as readFile20 } from "fs";
+import { join as join28 } from "path";
+var OS = platform();
+function findRcloneMountPid() {
+  try {
+    const out = execSync("pgrep -f 'rclone.*mount'", {
+      encoding: "utf8",
+      timeout: 2e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const pids = out.split("\n").filter(Boolean);
+    if (pids.length === 0) return null;
+    return parseInt(pids[0], 10);
+  } catch {
+    try {
+      const out = execSync("ps aux", { encoding: "utf8", timeout: 2e3, stdio: ["pipe", "pipe", "pipe"] });
+      for (const line of out.split("\n")) {
+        if (line.includes("rclone") && line.includes("mount") && !line.includes("grep")) {
+          const parts = line.trim().split(/\s+/);
+          if (parts.length >= 2) return parseInt(parts[1], 10);
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+}
+function parseRcloneFlags(pid) {
+  const flags = /* @__PURE__ */ new Map();
+  try {
+    const args = getRcloneArgs(pid);
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i];
+      if (arg.startsWith("--") && arg.includes("=")) {
+        const eq = arg.indexOf("=");
+        flags.set(arg.slice(0, eq), arg.slice(eq + 1));
+      } else if (arg.startsWith("--")) {
+        const next = args[i + 1];
+        if (next && !next.startsWith("-")) {
+          flags.set(arg, next);
+          i++;
+        } else {
+          flags.set(arg, "");
+        }
+      }
+    }
+  } catch {
+  }
+  return flags;
+}
+function getRcloneVersion() {
+  try {
+    const out = execSync("rclone version", {
+      encoding: "utf8",
+      timeout: 3e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const match = out.match(/rclone\s+v(\d+)\.(\d+)\.(\d+)/i);
+    if (!match) return null;
+    return {
+      major: parseInt(match[1], 10),
+      minor: parseInt(match[2], 10),
+      patch: parseInt(match[3], 10),
+      raw: out.split("\n")[0].trim()
+    };
+  } catch {
+    return null;
+  }
+}
+function extractRcloneFs(args) {
+  let foundMount = false;
+  for (const arg of args) {
+    if (arg === "mount") {
+      foundMount = true;
+      continue;
+    }
+    if (foundMount && arg.includes(":") && !arg.startsWith("-") && !arg.startsWith("/")) {
+      return arg;
+    }
+  }
+  return null;
+}
+function getRcloneArgs(pid) {
+  try {
+    if (OS === "linux") {
+      const raw = readFileSync6(`/proc/${pid}/cmdline`);
+      return new TextDecoder().decode(raw).split("\0").filter(Boolean);
+    } else {
+      const out = execSync(`ps -o args= -p ${pid}`, {
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      return out.split(/\s+/);
+    }
+  } catch {
+    return [];
+  }
+}
+function queryRcloneRC(rcAddr, fs) {
+  try {
+    const payload = JSON.stringify({ fs });
+    const out = execSync(
+      `curl -s --max-time 3 -X POST "http://${rcAddr}/vfs/stats" -H "Content-Type: application/json" -d '${payload}' 2>/dev/null`,
+      { encoding: "utf8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (!out.trim()) return null;
+    const data = JSON.parse(out);
+    if (data.status && data.status >= 400) {
+      return { error: data.error || `RC error (status ${data.status})`, erroredFiles: 0, uploadsInProgress: 0, uploadsQueued: 0, outOfSpace: false, bytesUsed: 0, files: 0, totalSize: "unknown" };
+    }
+    const dc = data.diskCache || {};
+    return {
+      erroredFiles: dc.erroredFiles ?? 0,
+      uploadsInProgress: dc.uploadsInProgress ?? 0,
+      uploadsQueued: dc.uploadsQueued ?? 0,
+      outOfSpace: dc.outOfSpace ?? false,
+      bytesUsed: dc.bytesUsed ?? 0,
+      files: dc.files ?? 0,
+      totalSize: data.totalSize || "unknown"
+    };
+  } catch {
+    return { error: "RC endpoint unreachable", erroredFiles: 0, uploadsInProgress: 0, uploadsQueued: 0, outOfSpace: false, bytesUsed: 0, files: 0, totalSize: "unknown" };
+  }
+}
+function detectFuseMount(vaultPath) {
   try {
     if (OS === "linux") {
       const mounts = readFileSync6("/proc/mounts", "utf8");
@@ -4543,7 +5161,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join27(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join28(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -4554,7 +5172,7 @@ function writeTest(dir) {
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile19(testFile, "utf8");
+    const back = readFile20(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
@@ -4643,12 +5261,12 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join28(plugin.installPath, "bin", "skillwiki");
+    const pluginBin = join29(plugin.installPath, "bin", "skillwiki");
     if (existsSync11(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join28(home, ".claude", "skills", "bin", "skillwiki");
+  const installBin = join29(home, ".claude", "skills", "bin", "skillwiki");
   if (existsSync11(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
@@ -4729,9 +5347,9 @@ function checkVaultStructure(resolvedPath) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync11(join28(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync11(join29(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync11(join28(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync11(join29(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -4739,7 +5357,7 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join28(cwd, "packages", "skills") : void 0;
+  const srcDir = cwd ? join29(cwd, "packages", "skills") : void 0;
   if (srcDir && existsSync11(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
@@ -4753,7 +5371,7 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join28(home, ".claude", "skills");
+  const skillsDir = join29(home, ".claude", "skills");
   if (existsSync11(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
@@ -4764,10 +5382,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join28(home, ".claude", "skills");
+  const skillsDir = join29(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join28(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join28(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join29(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join29(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -4866,7 +5484,7 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join28(dir, ".skillwiki", ".env");
+  const envPath = join29(dir, ".skillwiki", ".env");
   if (existsSync11(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
@@ -4876,7 +5494,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync11(join28(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -4899,9 +5517,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync11(join28(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync11(join28(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync11(join28(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync11(join29(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync11(join29(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync11(join29(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -4911,7 +5529,7 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join28(resolvedPath, "raw");
+  const rawDir = join29(resolvedPath, "raw");
   if (!existsSync11(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
@@ -4927,7 +5545,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk2(join28(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk2(join29(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -4940,7 +5558,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync11(join28(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -4988,7 +5606,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync11(join28(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -5029,7 +5647,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync11(join28(resolvedPath, ".git"))) {
+  if (!existsSync11(join29(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -5049,13 +5667,38 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
     return check("warn", id, label, "Could not compare HEAD with origin/main");
   }
 }
+async function checkFleetIdentity(input) {
+  if (!input.vaultPath) {
+    return check("pass", "fleet_identity", "Fleet identity", "No vault path \u2014 check skipped");
+  }
+  const r = await runFleetContext({
+    vault: input.vaultPath,
+    env: { ...process.env, WIKI_PATH: input.envValue ?? input.vaultPath },
+    home: input.home,
+    cwd: input.cwd ?? process.cwd(),
+    osHostname: process.env.HOSTNAME,
+    user: process.env.USER
+  });
+  if (!r.result.ok) {
+    return check("warn", "fleet_identity", "Fleet identity", "Could not evaluate fleet identity");
+  }
+  const data = r.result.data;
+  if (!data.manifest_loaded) {
+    return check("pass", "fleet_identity", "Fleet identity", "Fleet manifest unavailable \u2014 check skipped");
+  }
+  if (data.identity_status === "known") {
+    return check("pass", "fleet_identity", "Fleet identity", `Resolved ${data.host_id ?? "unknown"} via ${data.source ?? "unknown"}`);
+  }
+  const detail = data.warnings.length > 0 ? data.warnings.join("; ") : "Fleet identity is unresolved";
+  return check("warn", "fleet_identity", "Fleet identity", detail);
+}
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join28(home, "Library", "Logs", "wiki-pull.log"),
-    join28(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join29(home, "Library", "Logs", "wiki-pull.log"),
+    join29(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join28(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join28(home, "Library", "Logs", "wiki-pull.log")
+    join29(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join29(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -5095,7 +5738,7 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join28(resolvedPath, "concepts");
+  const conceptsDir = join29(resolvedPath, "concepts");
   if (!existsSync11(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
@@ -5278,7 +5921,7 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join28(resolvedPath, "concepts");
+  const conceptsDir = join29(resolvedPath, "concepts");
   if (!existsSync11(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
@@ -5365,7 +6008,7 @@ function checkVfsCacheHealth(resolvedPath) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync7(join28(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync7(join29(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     for (const line of content.split(/\r?\n/)) {
@@ -5399,11 +6042,11 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join28(home, "Library", "Logs") : join28(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join28(home, "Library", "Application Support", "vault-sync", "bin") : join28(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join28(home, ".config", "rclone", "wiki-push-filters.txt");
+  const logDir = input.logDir ?? (isMac ? join29(home, "Library", "Logs") : join29(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join29(home, "Library", "Application Support", "vault-sync", "bin") : join29(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join29(home, ".config", "rclone", "wiki-push-filters.txt");
   const snapshotPath = input.snapshotScriptPath ?? "/root/.hermes/scripts/wiki-snapshot-v3.sh";
-  const pushScriptPath = join28(shareDir, "wiki-push.sh");
+  const pushScriptPath = join29(shareDir, "wiki-push.sh");
   const c1 = existsSync11(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
@@ -5455,7 +6098,7 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join28(logDir, "wiki-push.log");
+  const logFile = join29(logDir, "wiki-push.log");
   let c3;
   try {
     const logContent = readFileSync7(logFile, "utf8");
@@ -5526,7 +6169,7 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join28(logDir, "wiki-fetch.log");
+  const fetchLogFile = join29(logDir, "wiki-fetch.log");
   let cFetch;
   try {
     const logContent = readFileSync7(fetchLogFile, "utf8");
@@ -5668,15 +6311,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join28(dir, entry.name));
+      results.push(join29(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join28(dir, entry.name)));
+      results.push(...findSkillMd(join29(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join28(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join29(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -5688,7 +6331,7 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync11(join28(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync11(join29(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
@@ -5732,7 +6375,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync7(join28(resolvedPath, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync7(join29(resolvedPath, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -5762,6 +6405,12 @@ async function runDoctor(input) {
   checks.push(checkVaultStructure(resolvedPath));
   checks.push(checkObsidianTemplates(resolvedPath));
   checks.push(checkVaultGitRemote(resolvedPath));
+  checks.push(await checkFleetIdentity({
+    vaultPath: resolvedPath,
+    home: input.home,
+    cwd: input.cwd,
+    envValue: input.envValue
+  }));
   checks.push(checkSyncLastPush(resolvedPath));
   checks.push(checkVaultGitDirty(resolvedPath));
   checks.push(checkVaultGitAhead(resolvedPath));
@@ -5935,27 +6584,27 @@ function runVaultSyncHealth(home, syncMode) {
     };
   }
   const isMac = platform3() === "darwin";
-  const shareDir = isMac ? join29(home, "Library", "Application Support", "vault-sync", "bin") : join29(home, ".local", "share", "vault-sync", "bin");
-  const logDir = isMac ? join29(home, "Library", "Logs") : join29(home, ".local", "state", "vault-sync", "log");
-  const filterPath = join29(home, ".config", "rclone", "wiki-push-filters.txt");
+  const shareDir = isMac ? join30(home, "Library", "Application Support", "vault-sync", "bin") : join30(home, ".local", "share", "vault-sync", "bin");
+  const logDir = isMac ? join30(home, "Library", "Logs") : join30(home, ".local", "state", "vault-sync", "log");
+  const filterPath = join30(home, ".config", "rclone", "wiki-push-filters.txt");
   const checks = [];
-  const pushScript = join29(shareDir, "wiki-push.sh");
+  const pushScript = join30(shareDir, "wiki-push.sh");
   checks.push(existsSync12(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
   if (isMac) {
-    const pushPlist = join29(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
-    const fetchPlist = join29(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
+    const pushPlist = join30(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
+    const fetchPlist = join30(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
     checks.push(existsSync12(pushPlist) && existsSync12(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
     checks.push({ id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "macOS host \u2014 check skipped" });
   } else {
-    const pushTimer = join29(home, ".config", "systemd", "user", "wiki-push.timer");
-    const fetchTimer = join29(home, ".config", "systemd", "user", "wiki-fetch.timer");
-    const fuseTimer = join29(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
-    const fuseService = join29(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
+    const pushTimer = join30(home, ".config", "systemd", "user", "wiki-push.timer");
+    const fetchTimer = join30(home, ".config", "systemd", "user", "wiki-fetch.timer");
+    const fuseTimer = join30(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
+    const fuseService = join30(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
     checks.push(existsSync12(pushTimer) && existsSync12(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
     checks.push(existsSync12(fuseTimer) && existsSync12(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
   }
-  checks.push(classifyLog(join29(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
-  checks.push(classifyLog(join29(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
+  checks.push(classifyLog(join30(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  checks.push(classifyLog(join30(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
   if (!existsSync12(filterPath)) {
     checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "error", detail: `Filter missing: ${filterPath}` });
   } else {
@@ -6181,8 +6830,8 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename7, mkdir as mkdir9, readFile as readFile20, writeFile as writeFile10 } from "fs/promises";
-import { join as join30, dirname as dirname11 } from "path";
+import { rename as rename7, mkdir as mkdir9, readFile as readFile21, writeFile as writeFile10 } from "fs/promises";
+import { join as join31, dirname as dirname11 } from "path";
 function countWikilinks(body, slug) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\[\\[${escaped}(?:[|#][^\\]]*)?\\]\\]`, "g");
@@ -6210,7 +6859,7 @@ async function runArchive(input) {
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join30("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = join31("_archive", relPath).replace(/\\/g, "/");
   let cascade;
   if (input.cascade) {
     const wikilinkRefs = [];
@@ -6234,7 +6883,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile20(join30(input.vault, "index.md"), "utf8");
+        const idx = await readFile21(join31(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -6260,8 +6909,8 @@ async function runArchive(input) {
   }
   if (input.cascade && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join30(input.vault, ref.page);
-      const text = await readFile20(absPath, "utf8");
+      const absPath = join31(input.vault, ref.page);
+      const text = await readFile21(absPath, "utf8");
       const split = splitFrontmatter(text);
       if (!split.ok) continue;
       const before = split.data.rawFrontmatter;
@@ -6278,12 +6927,12 @@ ${fmRewritten}
       }
     }
   }
-  await mkdir9(dirname11(join30(input.vault, archivePath)), { recursive: true });
+  await mkdir9(dirname11(join31(input.vault, archivePath)), { recursive: true });
   let indexUpdated = false;
   if (!isRaw) {
-    const indexPath = join30(input.vault, "index.md");
+    const indexPath = join31(input.vault, "index.md");
     try {
-      const idx = await readFile20(indexPath, "utf8");
+      const idx = await readFile21(indexPath, "utf8");
       const originalLines = idx.split("\n");
       const filtered = originalLines.filter((l) => !l.includes(`[[${slug}]]`));
       if (filtered.length !== originalLines.length) {
@@ -6294,7 +6943,7 @@ ${fmRewritten}
       if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
     }
   }
-  await rename7(join30(input.vault, relPath), join30(input.vault, archivePath));
+  await rename7(join31(input.vault, relPath), join31(input.vault, archivePath));
   appendLastOp(input.vault, {
     operation: input.cascade ? "archive-cascade" : "archive",
     summary: `moved ${relPath} to ${archivePath}${input.cascade ? ` (cascade: ${cascade?.source_array_refs.length ?? 0} source arrays updated)` : ""}`,
@@ -6317,7 +6966,7 @@ ${fmRewritten}
 }
 
 // src/commands/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -6396,7 +7045,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash5("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -6703,7 +7352,7 @@ ${newBody}`;
 
 // src/commands/update.ts
 import { execSync as execSync3 } from "child_process";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 
 // src/utils/package-info.ts
 import { readFileSync as readFileSync9 } from "fs";
@@ -6733,7 +7382,7 @@ function resolveGlobalSkillsRoot() {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
-    return join31(globalRoot, "skillwiki", "skills");
+    return join32(globalRoot, "skillwiki", "skills");
   } catch {
     return null;
   }
@@ -6757,7 +7406,7 @@ async function runUpdate(input) {
   const pkg2 = readCliPackageJson();
   const currentVersion = pkg2.version;
   const tag = normalizeDistTag(input.distTag);
-  const target = join31(input.home, ".claude", "skills");
+  const target = join32(input.home, ".claude", "skills");
   let latest;
   try {
     latest = execSync3(`npm view skillwiki@${tag} version`, {
@@ -6829,13 +7478,13 @@ async function runUpdate(input) {
 // src/commands/self-update.ts
 import { execSync as execSync4 } from "child_process";
 import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
   const currentVersion = readCliPackageJson().version;
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
-  const localPkgPath = join32(sourceRoot, "packages", "cli", "package.json");
+  const localPkgPath = join33(sourceRoot, "packages", "cli", "package.json");
   const hasLocalSource = existsSync13(localPkgPath);
   if (input.check) {
     let availableVersion = null;
@@ -6967,10 +7616,10 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir5, stat as stat8, readFile as readFile21 } from "fs/promises";
-import { join as join33 } from "path";
+import { readdir as readdir5, stat as stat8, readFile as readFile22 } from "fs/promises";
+import { join as join34 } from "path";
 async function runTranscripts(input) {
-  const dir = join33(input.vault, "raw", "transcripts");
+  const dir = join34(input.vault, "raw", "transcripts");
   let entries;
   try {
     entries = await readdir5(dir, { withFileTypes: true });
@@ -6980,8 +7629,8 @@ async function runTranscripts(input) {
   const transcripts = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const filePath = join33(dir, entry.name);
-    const content = await readFile21(filePath, "utf8");
+    const filePath = join34(dir, entry.name);
+    const content = await readFile22(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
@@ -6998,12 +7647,12 @@ async function runTranscripts(input) {
 }
 
 // src/commands/project-index.ts
-import { readdir as readdir6, readFile as readFile22, writeFile as writeFile11, mkdir as mkdir10 } from "fs/promises";
-import { join as join34, dirname as dirname12 } from "path";
+import { readdir as readdir6, readFile as readFile23, writeFile as writeFile11, mkdir as mkdir10 } from "fs/promises";
+import { join as join35, dirname as dirname12 } from "path";
 var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 async function runProjectIndex(input) {
   const slug = input.slug;
-  const projectDir = join34(input.vault, "projects", slug);
+  const projectDir = join35(input.vault, "projects", slug);
   try {
     await readdir6(projectDir);
   } catch {
@@ -7014,15 +7663,15 @@ async function runProjectIndex(input) {
   }
   const wikilinkPattern = `[[${slug}]]`;
   const entries = [];
-  const compoundDir = join34(input.vault, "projects", slug, "compound");
+  const compoundDir = join35(input.vault, "projects", slug, "compound");
   try {
     const compoundFiles = await readdir6(compoundDir, { withFileTypes: true });
     for (const entry of compoundFiles) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join34(compoundDir, entry.name);
+      const filePath = join35(compoundDir, entry.name);
       let text;
       try {
-        text = await readFile22(filePath, "utf8");
+        text = await readFile23(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7039,16 +7688,16 @@ async function runProjectIndex(input) {
   for (const dir of LAYER2_DIRS) {
     let files;
     try {
-      files = await readdir6(join34(input.vault, dir), { withFileTypes: true });
+      files = await readdir6(join35(input.vault, dir), { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of files) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join34(input.vault, dir, entry.name);
+      const filePath = join35(input.vault, dir, entry.name);
       let text;
       try {
-        text = await readFile22(filePath, "utf8");
+        text = await readFile23(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7069,11 +7718,11 @@ async function runProjectIndex(input) {
     const tb = typeOrder[b.type] ?? 99;
     return ta !== tb ? ta - tb : a.title.localeCompare(b.title);
   });
-  const indexPath = join34(projectDir, "knowledge.md");
+  const indexPath = join35(projectDir, "knowledge.md");
   let existing = false;
   let stale = false;
   try {
-    const existingText = await readFile22(indexPath, "utf8");
+    const existingText = await readFile23(indexPath, "utf8");
     existing = true;
     const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
     const existingPages = new Set(existingEntries.map((l) => {
@@ -7143,9 +7792,9 @@ ${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e
 
 // src/commands/compound.ts
 import { writeFile as writeFile12, mkdir as mkdir11, readdir as readdir7, unlink as unlink4 } from "fs/promises";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 import { existsSync as existsSync14 } from "fs";
-import { readFile as readFile23 } from "fs/promises";
+import { readFile as readFile24 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -7243,17 +7892,17 @@ function extractRetroFields(date, cycleName, block) {
   };
 }
 async function runCompound(input) {
-  const logPath = join35(input.vault, "log.md");
+  const logPath = join36(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile23(logPath, "utf8");
+    logText = await readFile24(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
   const entries = parseRetroEntries(logText);
   const promoted = [];
   const skipped = [];
-  const compoundDir = join35(input.vault, "projects", input.project, "compound");
+  const compoundDir = join36(input.vault, "projects", input.project, "compound");
   for (const entry of entries) {
     const generalizeValue = entry.generalize.trim();
     if (!/^yes/i.test(generalizeValue)) {
@@ -7261,7 +7910,7 @@ async function runCompound(input) {
       continue;
     }
     const slug = slugify(entry.cycleName);
-    const compoundPath = join35(compoundDir, `${slug}.md`);
+    const compoundPath = join36(compoundDir, `${slug}.md`);
     if (existsSync14(compoundPath)) {
       skipped.push(entry.date);
       continue;
@@ -7322,7 +7971,7 @@ async function runCompound(input) {
   };
 }
 async function runCompoundDelete(input) {
-  const projectDir = join35(input.vault, "projects", input.project);
+  const projectDir = join36(input.vault, "projects", input.project);
   if (!existsSync14(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
@@ -7330,7 +7979,7 @@ async function runCompoundDelete(input) {
     };
   }
   const entryName = input.entry.replace(/\.md$/, "");
-  const compoundPath = join35(projectDir, "compound", `${entryName}.md`);
+  const compoundPath = join36(projectDir, "compound", `${entryName}.md`);
   if (!existsSync14(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -7364,7 +8013,7 @@ knowledge.md regenerated`
   };
 }
 async function runCompoundList(input) {
-  const compoundDir = join35(input.vault, "projects", input.project, "compound");
+  const compoundDir = join36(input.vault, "projects", input.project, "compound");
   if (!existsSync14(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
@@ -7395,10 +8044,10 @@ could not read compound directory`
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
-    const filePath = join35(compoundDir, dirent.name);
+    const filePath = join36(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile23(filePath, "utf8");
+      text = await readFile24(filePath, "utf8");
     } catch {
       continue;
     }
@@ -7429,8 +8078,8 @@ no compound entries found`;
 // src/commands/observe.ts
 import { mkdir as mkdir12, writeFile as writeFile13 } from "fs/promises";
 import { existsSync as existsSync15, statSync as statSync4 } from "fs";
-import { join as join36 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { join as join37 } from "path";
+import { createHash as createHash6 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify2(text) {
   const words = text.trim().split(/\s+/).slice(0, 6).join("-").toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
@@ -7458,7 +8107,7 @@ async function runObserve(input) {
       result: err("VAULT_PATH_INVALID", { path: input.vault })
     };
   }
-  const transcriptsDir = join36(input.vault, "raw", "transcripts");
+  const transcriptsDir = join37(input.vault, "raw", "transcripts");
   try {
     await mkdir12(transcriptsDir, { recursive: true });
   } catch {
@@ -7470,11 +8119,11 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify2(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join36(transcriptsDir, fileName);
+  const filePath = join37(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
-  const sha256 = createHash4("sha256").update(Buffer.from(body, "utf8")).digest("hex");
+  const sha256 = createHash6("sha256").update(Buffer.from(body, "utf8")).digest("hex");
   const frontmatterLines = [
     "---",
     "source_url:",
@@ -7510,8 +8159,8 @@ ${input.text.trim()}
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir13, readFile as readFile24, writeFile as writeFile14 } from "fs/promises";
-import { join as join37, relative as relative3, sep as sep3 } from "path";
+import { mkdir as mkdir13, readFile as readFile25, writeFile as writeFile14 } from "fs/promises";
+import { join as join38, relative as relative3, sep as sep3 } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
   const scan = await scanVault(input.vault);
@@ -7589,7 +8238,7 @@ async function resolveProject(input) {
   const envProject = input.env?.SKILLWIKI_PROJECT;
   if (envProject) return envProject;
   const cwd = input.cwd ?? process.cwd();
-  const projectDotenv = await readProjectSlug(join37(cwd, ".skillwiki", ".env"));
+  const projectDotenv = await readProjectSlug(join38(cwd, ".skillwiki", ".env"));
   if (projectDotenv) return projectDotenv;
   const inferred = inferProjectFromPath(input.vault, cwd);
   if (inferred) return inferred;
@@ -7598,7 +8247,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile24(file, "utf8");
+    text = await readFile25(file, "utf8");
   } catch {
     return void 0;
   }
@@ -7723,7 +8372,7 @@ function appendTextSection(lines, title, items, empty) {
   lines.push("");
 }
 async function loadHealthWarnings(vault) {
-  const text = await readIfExists2(join37(vault, ".skillwiki", "health.json"));
+  const text = await readIfExists2(join38(vault, ".skillwiki", "health.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -7736,11 +8385,11 @@ async function loadHealthWarnings(vault) {
   }
 }
 async function writeBriefArtifacts(vault, input) {
-  const metaPath = join37(vault, "meta", "latest-session-brief.md");
-  const cacheMdPath = join37(vault, ".skillwiki", "session-brief.md");
-  const cacheJsonPath = join37(vault, ".skillwiki", "session-brief.json");
-  await mkdir13(join37(vault, "meta"), { recursive: true });
-  await mkdir13(join37(vault, ".skillwiki"), { recursive: true });
+  const metaPath = join38(vault, "meta", "latest-session-brief.md");
+  const cacheMdPath = join38(vault, ".skillwiki", "session-brief.md");
+  const cacheJsonPath = join38(vault, ".skillwiki", "session-brief.json");
+  await mkdir13(join38(vault, "meta"), { recursive: true });
+  await mkdir13(join38(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists2(metaPath));
   const nextComparable = comparableBrief(committed);
@@ -7800,7 +8449,7 @@ function renderCommittedBrief(input) {
   ].filter((line) => line !== "").join("\n");
 }
 async function ensureIndexEntry(vault) {
-  const indexPath = join37(vault, "index.md");
+  const indexPath = join38(vault, "index.md");
   let text = await readIfExists2(indexPath);
   if (!text) return false;
   if (text.includes("[[meta/latest-session-brief]]")) return false;
@@ -7819,7 +8468,7 @@ async function ensureIndexEntry(vault) {
   return true;
 }
 async function appendMaterialLog(vault, today) {
-  const logPath = join37(vault, "log.md");
+  const logPath = join38(vault, "log.md");
   const text = await readIfExists2(logPath);
   if (!text) return false;
   const entry = `
@@ -7829,7 +8478,7 @@ async function appendMaterialLog(vault, today) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile24(path, "utf8");
+    return await readFile25(path, "utf8");
   } catch {
     return "";
   }
@@ -7871,9 +8520,9 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile25, writeFile as writeFile15, mkdir as mkdir14 } from "fs/promises";
-import { join as join38 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { readFile as readFile26, writeFile as writeFile15, mkdir as mkdir14 } from "fs/promises";
+import { join as join39 } from "path";
+import { createHash as createHash7 } from "crypto";
 var ALLOWED_TYPES = /* @__PURE__ */ new Set(["entity", "concept", "comparison", "query"]);
 var TYPE_DIR = {
   entity: "entities",
@@ -8031,7 +8680,7 @@ async function runIngest(input) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile25(input.source, "utf8");
+      sourceContent = await readFile26(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -8039,15 +8688,25 @@ async function runIngest(input) {
       };
     }
   }
-  const sha256 = createHash5("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sensitiveFindings = scanSensitiveContent(sourceContent, { file: input.source });
+  if (sensitiveFindings.length > 0) {
+    return {
+      exitCode: ExitCode.SENSITIVE_CONTENT_DETECTED,
+      result: err("SENSITIVE_CONTENT_DETECTED", {
+        message: "source content contains sensitive authentication material; provide a redacted source before ingesting",
+        findings: sensitiveFindings
+      })
+    };
+  }
+  const sha256 = createHash7("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify3(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join38(input.vault, rawRelPath);
-  const typedAbsPath = join38(input.vault, typedRelPath);
+  const rawAbsPath = join39(input.vault, rawRelPath);
+  const typedAbsPath = join39(input.vault, typedRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -8129,7 +8788,7 @@ async function runIngest(input) {
     };
   }
   try {
-    await mkdir14(join38(input.vault, "raw", "articles"), { recursive: true });
+    await mkdir14(join39(input.vault, "raw", "articles"), { recursive: true });
     await writeFile15(rawAbsPath, rawContent, "utf8");
   } catch (e) {
     return {
@@ -8138,7 +8797,7 @@ async function runIngest(input) {
     };
   }
   try {
-    await mkdir14(join38(input.vault, typedDir), { recursive: true });
+    await mkdir14(join39(input.vault, typedDir), { recursive: true });
     await writeFile15(typedAbsPath, typedContent, "utf8");
   } catch (e) {
     return {
@@ -8318,19 +8977,19 @@ ${body}`;
 
 // src/commands/sync.ts
 import { existsSync as existsSync17 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 
 // src/utils/sync-lock.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join39 } from "path";
-import { createHash as createHash6 } from "crypto";
+import { join as join40 } from "path";
+import { createHash as createHash8 } from "crypto";
 function getSessionId() {
   if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
   if (process.env.SKILLWIKI_SESSION_ID) return process.env.SKILLWIKI_SESSION_ID;
   return process.pid.toString();
 }
 function lockPath(vault) {
-  return join39(vault, ".skillwiki", "sync.lock");
+  return join40(vault, ".skillwiki", "sync.lock");
 }
 function readLock(vault) {
   const path = lockPath(vault);
@@ -8349,7 +9008,7 @@ function isStale(lock, now) {
 }
 function acquireLock(vault, opts = {}) {
   const path = lockPath(vault);
-  const dir = join39(vault, ".skillwiki");
+  const dir = join40(vault, ".skillwiki");
   if (!existsSync16(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
@@ -8424,7 +9083,7 @@ function releaseLock(vault, opts = {}) {
 function runSyncStatus(input) {
   const vault = input.vault;
   const includeStashes = input.includeStashes ?? false;
-  if (!existsSync17(join40(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: ok({
@@ -8502,7 +9161,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync17(join40(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -8625,7 +9284,7 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync17(join40(vault, ".git"))) {
+  if (!existsSync17(join41(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -8866,7 +9525,7 @@ function runSyncUnlock(input) {
 
 // src/commands/backup.ts
 import { statSync as statSync5, readdirSync as readdirSync3, readFileSync as readFileSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join41, relative as relative4, dirname as dirname13 } from "path";
+import { join as join42, relative as relative4, dirname as dirname13 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -8890,7 +9549,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (SKIP_DIRS2.has(entry.name)) continue;
-    const full = join41(dir, entry.name);
+    const full = join42(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -8913,7 +9572,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join41(input.vault, relPath);
+    const absPath = join42(input.vault, relPath);
     const localStat = statSync5(absPath);
     let needsUpload = true;
     try {
@@ -8989,7 +9648,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join41(target, obj.Key);
+      const localPath = join42(target, obj.Key);
       try {
         const localStat = statSync5(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -9036,8 +9695,8 @@ async function runBackupRestore(input) {
 
 // src/commands/status.ts
 import { existsSync as existsSync18, statSync as statSync6 } from "fs";
-import { readFile as readFile26 } from "fs/promises";
-import { join as join42 } from "path";
+import { readFile as readFile27 } from "fs/promises";
+import { join as join43 } from "path";
 async function runStatus(input) {
   if (!existsSync18(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
@@ -9064,7 +9723,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile26(join42(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile27(join43(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -9125,7 +9784,7 @@ async function runStatus(input) {
 
 // src/commands/seed.ts
 import { mkdir as mkdir15, writeFile as writeFile16, stat as stat9 } from "fs/promises";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -9194,29 +9853,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat9(join43(input.vault, "SCHEMA.md"));
+    await stat9(join44(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join43(input.vault, relPath);
+    const absPath = join44(input.vault, relPath);
     try {
       await stat9(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir15(join43(absPath, ".."), { recursive: true });
+      await mkdir15(join44(absPath, ".."), { recursive: true });
       await writeFile16(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join43(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join44(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat9(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir15(join43(rawPath, ".."), { recursive: true });
+    await mkdir15(join44(rawPath, ".."), { recursive: true });
     await writeFile16(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -9239,9 +9898,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile27, writeFile as writeFile17 } from "fs/promises";
+import { readFile as readFile28, writeFile as writeFile17 } from "fs/promises";
 import { existsSync as existsSync19 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -9319,7 +9978,7 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join44(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join45(input.vault, ".skillwiki", "graph.json");
   if (!existsSync19(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9331,7 +9990,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile27(graphPath, "utf8");
+    raw = await readFile28(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9357,7 +10016,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join44(input.vault, "vault-graph.canvas");
+  const outPath = join45(input.vault, "vault-graph.canvas");
   try {
     await writeFile17(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -9379,8 +10038,8 @@ written: ${outPath}`
 }
 
 // src/commands/query.ts
-import { readFile as readFile28, stat as stat10 } from "fs/promises";
-import { join as join45 } from "path";
+import { readFile as readFile29, stat as stat10 } from "fs/promises";
+import { join as join46 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -9501,7 +10160,7 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join45(vault, ".skillwiki", "graph.json");
+  const graphPath = join46(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
     const fileStat = await stat10(graphPath);
@@ -9515,265 +10174,13 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile28(graphPath, "utf8");
+    const raw = await readFile29(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 
-// src/commands/fleet.ts
-import { readFile as readFile29 } from "fs/promises";
-import { hostname as nodeHostname, userInfo } from "os";
-import { join as join46 } from "path";
-import yaml3 from "js-yaml";
-var FLEET_REL_PATH = join46("projects", "llm-wiki", "architecture", "fleet.yaml");
-async function runFleetValidate(input) {
-  const loaded = await loadFleetManifest(input.file);
-  if (!loaded.ok) {
-    if (loaded.error === "FILE_NOT_FOUND") {
-      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
-    }
-    const errors = fleetLoadErrors(loaded);
-    return invalidFleet(errors);
-  }
-  const warnings = fleetWarnings(loaded.manifest);
-  const snapshotter = findSnapshotter(loaded.manifest);
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      valid: true,
-      errors: [],
-      warnings,
-      host_count: Object.keys(loaded.manifest.hosts).length,
-      snapshotter,
-      humanHint: `VALID fleet manifest (${Object.keys(loaded.manifest.hosts).length} hosts; snapshotter: ${snapshotter ?? "none"})`
-    })
-  };
-}
-async function runFleetContext(input) {
-  const env = input.env ?? process.env;
-  const home = input.home ?? env.HOME ?? "";
-  const cwd = input.cwd ?? process.cwd();
-  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
-  const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
-  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join46(vault, FLEET_REL_PATH) : void 0);
-  const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
-  if (!loaded.ok) {
-    const markdown2 = formatUnknownContext({ osHostname, user, cwd, vault, reason: "fleet manifest unavailable or invalid" });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({ manifest_loaded: false, markdown: markdown2, humanHint: markdown2 })
-    };
-  }
-  const resolved = await resolveHostId({
-    manifest: loaded.manifest,
-    hostId: input.hostId,
-    env,
-    home,
-    osHostname
-  });
-  if (!resolved.hostId || !loaded.manifest.hosts[resolved.hostId]) {
-    const markdown2 = formatUnknownContext({ osHostname, user, cwd, vault, reason: "host identity is unresolved" });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({ manifest_loaded: true, markdown: markdown2, humanHint: markdown2 })
-    };
-  }
-  const markdown = formatKnownContext({
-    manifest: loaded.manifest,
-    hostId: resolved.hostId,
-    source: resolved.source,
-    osHostname,
-    user,
-    cwd,
-    vault
-  });
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      manifest_loaded: true,
-      host_id: resolved.hostId,
-      source: resolved.source,
-      markdown,
-      humanHint: markdown
-    })
-  };
-}
-async function loadFleetManifest(file) {
-  let text;
-  try {
-    text = await readFile29(file, "utf8");
-  } catch {
-    return { ok: false, error: "FILE_NOT_FOUND" };
-  }
-  let parsed;
-  try {
-    parsed = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
-  } catch (error) {
-    return { ok: false, error: "INVALID_YAML", detail: error instanceof Error ? error.message : String(error) };
-  }
-  const result = FleetManifestSchema.safeParse(parsed);
-  if (!result.success) {
-    return { ok: false, error: "INVALID_FLEET_MANIFEST", detail: result.error.issues };
-  }
-  return { ok: true, manifest: result.data };
-}
-function invalidFleet(errors) {
-  return {
-    exitCode: ExitCode.FLEET_MANIFEST_INVALID,
-    result: ok({
-      valid: false,
-      errors,
-      warnings: [],
-      host_count: 0,
-      humanHint: `INVALID fleet manifest
-${errors.map((e) => `  ${e.path || "(root)"}: ${e.message}`).join("\n")}`
-    })
-  };
-}
-function fleetLoadErrors(loaded) {
-  if (loaded.error === "INVALID_YAML") {
-    return [{ path: "", message: `invalid YAML: ${String(loaded.detail ?? "parse failed")}` }];
-  }
-  if (loaded.error === "INVALID_FLEET_MANIFEST" && Array.isArray(loaded.detail)) {
-    return loaded.detail.map((issue) => {
-      const zodIssue = issue;
-      return {
-        path: (zodIssue.path ?? []).join("."),
-        message: zodIssue.message ?? "invalid value"
-      };
-    });
-  }
-  return [{ path: "", message: loaded.error }];
-}
-function fleetWarnings(manifest) {
-  const warnings = [];
-  for (const [id, host] of Object.entries(manifest.hosts)) {
-    if (host.role === "snapshotter" && host.protected !== true) {
-      warnings.push(`snapshotter host '${id}' is not protected=true`);
-    }
-  }
-  return warnings;
-}
-function findSnapshotter(manifest) {
-  return Object.entries(manifest.hosts).find(([, host]) => host.role === "snapshotter")?.[0];
-}
-async function resolveHostId(input) {
-  if (input.hostId) return { hostId: input.hostId, source: "host-id" };
-  if (input.env.SKILLWIKI_HOST_ID) return { hostId: input.env.SKILLWIKI_HOST_ID, source: "SKILLWIKI_HOST_ID" };
-  if (input.env.AGENT_HOST_ID) return { hostId: input.env.AGENT_HOST_ID, source: "AGENT_HOST_ID" };
-  if (input.home) {
-    const dotenv = await parseDotenvFile(join46(input.home, ".skillwiki", ".env"));
-    if (dotenv.SKILLWIKI_HOST_ID) {
-      return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID" };
-    }
-  }
-  if (input.env.VS_HOSTNAME) return { hostId: input.env.VS_HOSTNAME, source: "VS_HOSTNAME" };
-  const hostname = input.osHostname.trim();
-  if (hostname) {
-    if (input.manifest.hosts[hostname]) return { hostId: hostname, source: "hostname" };
-    const byHostname = Object.entries(input.manifest.hosts).find(([, host]) => host.identity.hostnames.includes(hostname));
-    if (byHostname) return { hostId: byHostname[0], source: "hostname" };
-  }
-  return {};
-}
-function formatKnownContext(input) {
-  const host = input.manifest.hosts[input.hostId];
-  const protectedValue = host.protected === true ? "true" : "false";
-  const writesTo = host.writes_to.join(", ");
-  const selfAliases = collectSelfAliases(input.manifest, input.hostId);
-  const outbound = collectOutboundAccess(input.manifest, input.hostId);
-  const maintenanceLines = formatMaintenanceLines(host);
-  const guidance = input.hostId === "macos-dev" ? "use declared SSH aliases for remote work when needed; do not assume undeclared hosts have reciprocal SSH access." : `this session is already on \`${input.hostId}\`; do not SSH to self aliases unless the user explicitly asks. Do not assume outbound SSH to other fleet hosts is configured.`;
-  return [
-    "## Runtime Host Context",
-    "",
-    `- Current machine: \`${input.hostId}\`${input.source ? ` (source: \`${input.source}\`)` : ""}`,
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    `- Fleet role: \`${host.role}\`; protected: \`${protectedValue}\`; writes_to: \`${writesTo}\``,
-    ...maintenanceLines,
-    `- Self SSH aliases known in fleet: ${formatList(selfAliases)}`,
-    `- Declared outbound SSH from this source: ${formatOutboundAccess(outbound)}`,
-    `- Guidance: ${guidance}`
-  ].join("\n");
-}
-function formatUnknownContext(input) {
-  return [
-    "## Runtime Host Context",
-    "",
-    "- Current machine: unknown",
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    "- Fleet role: unknown",
-    "- Self SSH aliases known in fleet: unknown",
-    "- Declared outbound SSH from this source: unknown",
-    `- Guidance: ${input.reason}; do not assume local vs remote role. Inspect runtime or ask before SSH/deploy/sync work.`
-  ].join("\n");
-}
-function collectSelfAliases(manifest, hostId2) {
-  const aliases = [];
-  const host = manifest.hosts[hostId2];
-  const access = host?.access?.from ?? {};
-  for (const profile of Object.values(access)) {
-    for (const alias of profile.ssh_aliases ?? []) aliases.push(alias);
-  }
-  return [...new Set(aliases)];
-}
-function collectOutboundAccess(manifest, sourceHostId) {
-  const hosts = [];
-  for (const [targetId, target] of Object.entries(manifest.hosts)) {
-    if (targetId === sourceHostId) continue;
-    const profile = target.access?.from?.[sourceHostId];
-    if (profile && (profile.status === "configured" || profile.status === "local")) {
-      hosts.push({
-        hostId: targetId,
-        sshAliases: [...new Set(profile.ssh_aliases ?? [])],
-        users: [...new Set(profile.users ?? [])]
-      });
-    }
-  }
-  return hosts.sort((left, right) => left.hostId.localeCompare(right.hostId));
-}
-function formatMaintenanceLines(host) {
-  const satellite = host.maintenance?.skillwiki_satellite;
-  if (!satellite?.enabled) return [];
-  return [
-    `- Maintenance role: \`skillwiki satellite\`; user: \`${satellite.user}\`; ssh: \`${satellite.ssh_alias}\``,
-    `- Maintenance paths: maintenance vault: \`${satellite.vault_path}\`; repo: \`${satellite.repo_path}\`; scheduler: \`${satellite.scheduler}\`; jobs: ${formatList(satellite.jobs)}`
-  ];
-}
-function formatOutboundAccess(values) {
-  if (values.length === 0) return "none";
-  return values.map((value) => {
-    const aliasPart = value.sshAliases.length > 0 ? ` via ${formatList(value.sshAliases)}` : " (no SSH aliases)";
-    const usersPart = value.users.length > 0 ? ` (users: ${formatList(value.users)})` : "";
-    return `\`${value.hostId}\`${aliasPart}${usersPart}`;
-  }).join("; ");
-}
-function formatList(values) {
-  return values.length > 0 ? values.map((v) => `\`${v}\``).join(", ") : "none";
-}
-function formatMaybe(value) {
-  return value && value.trim().length > 0 ? `\`${value}\`` : "unknown";
-}
-function safeEnvValue(value) {
-  return value && value.trim().length > 0 ? value : void 0;
-}
-function safeUserName() {
-  try {
-    return userInfo().username;
-  } catch {
-    return "";
-  }
-}
-
 // src/utils/auto-commit.ts
 import { existsSync as existsSync20 } from "fs";
 import { join as join47 } from "path";