vibemancer 1.0.36 → 1.0.38

package/dist/cli.js

@@ -6,6 +6,7 @@ import {
   resolveOpponent
 } from "./chunk-CMTEJ5MU.js";
 import {
+  AUTH_TIMEOUT_MS,
   MCP_BASE_URL,
   NotLoggedInError,
   clearCredentials,
@@ -14,7 +15,7 @@ import {
   getAccessToken,
   loadCredentials,
   registerClient
-} from "./chunk-MCU2B4PZ.js";
+} from "./chunk-UKMSXLZR.js";
 
 // src/cli-version.ts
 import fs from "fs";
@@ -42,6 +43,18 @@ function cliVersion() {
   return "unknown";
 }
 
+// src/flag-numbers.ts
+var DECIMAL = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
+function parseNumberFlag(flag, raw, kind) {
+  const expected = kind === "integer" ? "a whole number" : "a number";
+  const refuse = () => ({ ok: false, message: `${flag} must be ${expected}, got "${raw}".` });
+  if (!DECIMAL.test(raw)) return refuse();
+  const value = Number(raw);
+  if (!Number.isFinite(value)) return refuse();
+  if (kind === "integer" && !Number.isInteger(value)) return refuse();
+  return { ok: true, value };
+}
+
 // src/commands/dev.ts
 import { execFile } from "child_process";
 
@@ -328,9 +341,28 @@ function respond(res, status, data) {
   res.end(JSON.stringify(data));
 }
 
+// src/project-root.ts
+import fs3 from "fs";
+import path3 from "path";
+var PROJECT_MARKER = "vibemancer.json";
+function findProjectRoot(startDir) {
+  let current = path3.resolve(startDir);
+  for (; ; ) {
+    const marker = path3.join(current, PROJECT_MARKER);
+    try {
+      if (fs3.statSync(marker).isFile()) return current;
+    } catch {
+    }
+    const parent = path3.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return path3.resolve(startDir);
+}
+
 // src/commands/dev.ts
 async function runDev(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const bots = await discoverAllBots(projectDir);
   if (bots.length === 0) {
     console.log("No bots discovered in src/. Add a .ts file with a PascalCase export, e.g.:");
@@ -373,7 +405,7 @@ async function runTest(_options) {
   const code = await new Promise((resolve) => {
     const child = spawn("npx vitest run", {
       stdio: "inherit",
-      cwd: process.cwd(),
+      cwd: findProjectRoot(process.cwd()),
       shell: true
     });
     child.on("error", () => resolve(1));
@@ -385,8 +417,8 @@ async function runTest(_options) {
 }
 
 // src/commands/fight.ts
-import fs3 from "fs";
-import path3 from "path";
+import fs4 from "fs";
+import path4 from "path";
 import { BotBundle, sandboxFight, sandboxSimulate, scoreFight, runBundleFight } from "@vibemancer/core";
 
 // src/commands/fight-errors.ts
@@ -551,7 +583,7 @@ async function runFight(options) {
   return runFullFight(options);
 }
 async function runSingleFight(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   console.log(`
   Bot: ${botInfo.exportName}`);
@@ -594,7 +626,7 @@ async function runSingleFight(options) {
   }
 }
 async function runFullFight(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   const userBundle = new BotBundle(botInfo.sourcePath, botInfo.exportName);
   const opponents = getBuiltinBotNames();
@@ -662,13 +694,13 @@ async function runFullFight(options) {
   console.log("");
 }
 function getHistoryPath(projectDir) {
-  return path3.join(projectDir, ".vibemancer", "history.json");
+  return path4.join(projectDir, ".vibemancer", "history.json");
 }
 function loadHistory(projectDir) {
   const historyPath = getHistoryPath(projectDir);
-  if (!fs3.existsSync(historyPath)) return [];
+  if (!fs4.existsSync(historyPath)) return [];
   try {
-    const raw = fs3.readFileSync(historyPath, "utf-8");
+    const raw = fs4.readFileSync(historyPath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return [];
@@ -676,10 +708,10 @@ function loadHistory(projectDir) {
 }
 function saveHistory(projectDir, history, current) {
   const historyPath = getHistoryPath(projectDir);
-  const dir = path3.dirname(historyPath);
-  fs3.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(historyPath);
+  fs4.mkdirSync(dir, { recursive: true });
   const updated = [...history.slice(-19), current];
-  fs3.writeFileSync(historyPath, JSON.stringify(updated, null, "	") + "\n");
+  fs4.writeFileSync(historyPath, JSON.stringify(updated, null, "	") + "\n");
 }
 function showDiff(current, previous) {
   const prevMap = new Map(previous.map((e) => [e.opponent, e]));
@@ -738,7 +770,7 @@ function describeTickCap(winner, ticks, maxTicks) {
   return `NOTE: this trace stopped at its ${maxTicks}-tick cap, not because the match was a draw. A real match runs ${FULL_MATCH_TICKS.toLocaleString("en-US")} ticks, so you are seeing the first ${Math.round(maxTicks / FULL_MATCH_TICKS * 100)}% of the fight and the outcome above is NOT the result. Re-run with --ticks N to see further.`;
 }
 async function runTrace(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   const distance = options.distance ?? 600;
   let result;
@@ -804,7 +836,7 @@ function summarisePairing(bot1Name, bot2Name, result) {
   };
 }
 async function runTournament(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   const userBundle = new BotBundle3(botInfo.sourcePath, botInfo.exportName);
   const opponentNames = options.opponents && options.opponents.length > 0 ? options.opponents : getBuiltinBotNames();
@@ -975,7 +1007,7 @@ function resolveOpponentNames(opponents) {
   return opponents;
 }
 async function runOptimize(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   const source = readFileSync(botInfo.sourcePath, "utf-8");
   const params = parseParams(source);
@@ -1060,11 +1092,11 @@ function escapeRegex(s) {
 }
 
 // src/commands/build.ts
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import { BotBundle as BotBundle5, compileMatchBundle } from "@vibemancer/core";
 async function runBuild(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   const coreSourceDir = findCoreSourceDir();
   const userBundle = new BotBundle5(botInfo.sourcePath, botInfo.exportName);
@@ -1079,9 +1111,9 @@ async function runBuild(options) {
   });
   const elapsed = Date.now() - start;
   const outFile = options.output ?? `dist/${botInfo.exportName}-vs-${options.opponent}.js`;
-  const outDir = path4.dirname(path4.resolve(outFile));
-  fs4.mkdirSync(outDir, { recursive: true });
-  fs4.writeFileSync(path4.resolve(outFile), bundle);
+  const outDir = path5.dirname(path5.resolve(outFile));
+  fs5.mkdirSync(outDir, { recursive: true });
+  fs5.writeFileSync(path5.resolve(outFile), bundle);
   const sizeKb = (bundle.length / 1024).toFixed(1);
   console.log(`  Output: ${outFile} (${sizeKb} KB)`);
   console.log(`  Compiled in ${elapsed}ms
@@ -1091,15 +1123,44 @@ async function runBuild(options) {
 // src/commands/bots.ts
 import { BOT_GROUPS, ALL_BOTS } from "@vibemancer/core";
 
+// src/auth/gateway-failure.ts
+var MAX_BODY = 500;
+function trimBody(body) {
+  const text = body.trim();
+  return text.length > MAX_BODY ? `${text.slice(0, MAX_BODY)}\u2026` : text;
+}
+function retryAfterSeconds(retryAfter) {
+  if (retryAfter === null) return null;
+  const seconds = Number(retryAfter.trim());
+  if (!Number.isFinite(seconds) || seconds <= 0) return null;
+  return Math.ceil(seconds);
+}
+function describeGatewayFailure(operation, status, retryAfter, body) {
+  if (status === 429) {
+    const seconds = retryAfterSeconds(retryAfter);
+    if (seconds === null) return "Rate limited. Wait a moment and try again.";
+    return `Rate limited. Try again in ${seconds} ${seconds === 1 ? "second" : "seconds"}.`;
+  }
+  if (status === 401 || status === 403) {
+    return `${operation} was refused: your session is missing or expired. Run: vibemancer login`;
+  }
+  if (status >= 500 && status !== 501 && status !== 505) {
+    const detail = trimBody(body);
+    return `${operation} failed: the server had a problem (${status}). Try again in a moment.` + (detail ? `
+Server said: ${detail}` : "");
+  }
+  return `${operation} failed (${status}): ${trimBody(body)}`;
+}
+
 // src/auth/env-headers.ts
 import os from "os";
 import { readFileSync as readFileSync2 } from "fs";
-import path5 from "path";
+import path6 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function findCliVersionFrom(here) {
   for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
     try {
-      const parsed = JSON.parse(readFileSync2(path5.resolve(here, rel), "utf8"));
+      const parsed = JSON.parse(readFileSync2(path6.resolve(here, rel), "utf8"));
       if (typeof parsed !== "object" || parsed === null) continue;
       if (!("name" in parsed) || !("version" in parsed)) continue;
       const { name, version } = parsed;
@@ -1111,7 +1172,7 @@ function findCliVersionFrom(here) {
 }
 function readCliVersion() {
   try {
-    return findCliVersionFrom(path5.dirname(fileURLToPath2(import.meta.url)));
+    return findCliVersionFrom(path6.dirname(fileURLToPath2(import.meta.url)));
   } catch {
     return "";
   }
@@ -1155,7 +1216,7 @@ async function uploadBot(payload) {
     body: JSON.stringify(payload),
     signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
   });
-  if (!res.ok) throw new Error(`Upload failed (${res.status}): ${await res.text()}`);
+  if (!res.ok) throw new Error(describeGatewayFailure("Upload", res.status, res.headers.get("retry-after"), await res.text()));
   const data = await res.json();
   const wizardId = typeof data === "object" && data !== null && "wizardId" in data && typeof data.wizardId === "string" ? data.wizardId : "";
   const message = typeof data === "object" && data !== null && "message" in data && typeof data.message === "string" ? data.message : "Uploaded.";
@@ -1186,7 +1247,7 @@ async function listMyBotsPage() {
     headers: { Authorization: `Bearer ${token}`, ...envHeaders() },
     signal: AbortSignal.timeout(READ_TIMEOUT_MS)
   });
-  if (!res.ok) throw new Error(`Could not list your bots (${res.status}): ${await res.text()}`);
+  if (!res.ok) throw new Error(describeGatewayFailure("Listing your bots", res.status, res.headers.get("retry-after"), await res.text()));
   const data = await res.json();
   const bots = typeof data === "object" && data !== null && "bots" in data ? data.bots : null;
   if (!Array.isArray(bots)) throw new Error("The server returned an unexpected response while listing your bots. This is not the same as having none - try again, and report it if it persists.");
@@ -1205,7 +1266,7 @@ async function pullBot(name) {
     headers: { Authorization: `Bearer ${token}`, ...envHeaders() },
     signal: AbortSignal.timeout(READ_TIMEOUT_MS)
   });
-  if (!res.ok) throw new Error(`Pull failed (${res.status}): ${await res.text()}`);
+  if (!res.ok) throw new Error(describeGatewayFailure("Pull", res.status, res.headers.get("retry-after"), await res.text()));
   const data = await res.json();
   const source = typeof data === "object" && data !== null && "sourceCode" in data && typeof data.sourceCode === "string" ? data.sourceCode : "";
   if (source) {
@@ -1376,55 +1437,101 @@ function getStyleDescription(bot) {
 }
 
 // src/commands/upload.ts
-import fs6 from "fs";
+import fs7 from "fs";
 
 // src/pull-safety.ts
 import { createHash } from "crypto";
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 function hashContent(content) {
-  const normalised = content.replace(/\r\n/g, "\n").replace(/\s+$/, "");
+  const BYTE_ORDER_MARK = String.fromCharCode(65279);
+  const withoutBom = content.startsWith(BYTE_ORDER_MARK) ? content.slice(1) : content;
+  const normalised = withoutBom.replace(/\r\n/g, "\n").trimEnd();
   return createHash("sha256").update(normalised, "utf8").digest("hex");
 }
 function pullDecision(situation) {
   if (!situation.fileExists) return "write";
-  if (situation.force) return "write";
-  const local = situation.localContent ?? "";
+  const local = situation.localContent;
   if (hashContent(local) === hashContent(situation.incomingContent)) return "skip-identical";
+  if (situation.force) return "write";
   if (situation.recordedHash === void 0) return "refuse-unknown";
   return hashContent(local) === situation.recordedHash ? "write" : "refuse-modified";
 }
 var STATE_FILE = ".vibemancer-state.json";
 function statePath(projectDir) {
-  return path6.join(projectDir, STATE_FILE);
+  return path7.join(projectDir, STATE_FILE);
 }
-function readState(projectDir) {
+function readRaw(projectDir) {
   try {
-    const parsed = JSON.parse(fs5.readFileSync(statePath(projectDir), "utf-8"));
-    if (typeof parsed !== "object" || parsed === null) return {};
+    const parsed = JSON.parse(fs6.readFileSync(statePath(projectDir), "utf-8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
     const out = {};
-    for (const [k, v] of Object.entries(parsed)) if (typeof v === "string") out[k] = v;
+    for (const [key, value] of Object.entries(parsed)) out[key] = value;
     return out;
   } catch {
     return {};
   }
 }
+var NOTE_PREFIX = "_";
+var README_NOTE = "Written by the vibemancer CLI: hashes of what it last wrote here, so `vibemancer pull` can tell its own output from your edits. Commit it. Safe to delete - the cost is one --force, never data.";
+function readState(projectDir) {
+  const out = {};
+  for (const [k, v] of Object.entries(readRaw(projectDir))) {
+    if (!k.startsWith(NOTE_PREFIX) && typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+function stateKey(projectDir, filePath) {
+  const canonical = (p) => {
+    try {
+      return fs6.realpathSync.native(p);
+    } catch {
+      return path7.resolve(p);
+    }
+  };
+  return path7.relative(canonical(projectDir), canonical(filePath)).split(path7.sep).join("/");
+}
 function recordedHashFor(projectDir, filePath) {
-  return readState(projectDir)[path6.relative(projectDir, filePath).split(path6.sep).join("/")];
+  const state = readState(projectDir);
+  const key = stateKey(projectDir, filePath);
+  if (key in state) return state[key];
+  return legacyRecordFor(key, state, (candidateKey) => {
+    const asFile = path7.join(projectDir, candidateKey);
+    return fs6.existsSync(asFile) && stateKey(projectDir, asFile) === candidateKey;
+  });
+}
+function legacyRecordFor(key, state, isDistinctFile) {
+  const folded = key.toLowerCase();
+  for (const [k, v] of Object.entries(state)) {
+    if (k === key || k.toLowerCase() !== folded) continue;
+    if (isDistinctFile(k)) continue;
+    return v;
+  }
+  return void 0;
 }
 function recordWritten(projectDir, filePath, content) {
+  const tmp = `${statePath(projectDir)}.${process.pid}.tmp`;
   try {
-    const state = readState(projectDir);
-    state[path6.relative(projectDir, filePath).split(path6.sep).join("/")] = hashContent(content);
-    fs5.writeFileSync(statePath(projectDir), JSON.stringify(state, null, 2) + String.fromCharCode(10));
+    const state = readRaw(projectDir);
+    state._readme = README_NOTE;
+    const key = stateKey(projectDir, filePath);
+    const folded = key.toLowerCase();
+    for (const k of Object.keys(state)) if (k !== key && k.toLowerCase() === folded) delete state[k];
+    state[key] = hashContent(content);
+    fs6.writeFileSync(tmp, JSON.stringify(state, null, 2) + String.fromCharCode(10));
+    fs6.renameSync(tmp, statePath(projectDir));
   } catch {
+    try {
+      fs6.unlinkSync(tmp);
+    } catch {
+    }
   }
 }
 
 // src/commands/upload.ts
 var MAX_BUNDLE_BYTES = 500 * 1024;
 async function runUpload(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   const botInfo = await discoverBot(projectDir, options.bot);
   console.log(`
   Compiling ${botInfo.exportName}...`);
@@ -1437,7 +1544,7 @@ async function runUpload(options) {
   }
   let sourceCode = "";
   try {
-    sourceCode = fs6.readFileSync(botInfo.sourcePath, "utf-8");
+    sourceCode = fs7.readFileSync(botInfo.sourcePath, "utf-8");
   } catch {
   }
   console.log(`  Wizard: ${botInfo.exportName}`);
@@ -1450,7 +1557,7 @@ async function runUpload(options) {
       sourceCode,
       active: options.active
     });
-    if (sourceCode) recordWritten(process.cwd(), botInfo.sourcePath, sourceCode);
+    if (sourceCode) recordWritten(findProjectRoot(process.cwd()), botInfo.sourcePath, sourceCode);
     console.log(`  \u2713 ${result.message}`);
     if (result.wizardId) console.log(`  Wizard ID: ${result.wizardId}`);
     console.log(result.active === false ? `  "${botInfo.exportName}" is retired and no longer competing.
@@ -1468,20 +1575,44 @@ async function runUpload(options) {
 }
 
 // src/commands/pull.ts
-import fs7 from "fs";
-import path7 from "path";
+import fs8 from "fs";
+import path8 from "path";
+var LocalProjectError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LocalProjectError";
+  }
+};
+function adviceFor(err, name) {
+  if (err instanceof LocalProjectError) return void 0;
+  return name ? "  See your bots with: vibemancer bots --mine" : "  Upload first with: vibemancer upload";
+}
 function pullTargetPath(projectDir, name) {
   const trimmed = name.trim();
   if (!trimmed) throw new Error("A bot name is required.");
   if (/[\u0000-\u001f\u007f]/.test(trimmed)) throw new Error(`Refusing a bot name with a control character: ${JSON.stringify(name)}`);
-  if (trimmed !== path7.basename(trimmed) || trimmed === "." || trimmed === ".." || trimmed.includes("/") || trimmed.includes("\\")) {
+  if (trimmed !== path8.basename(trimmed) || trimmed === "." || trimmed === ".." || trimmed.includes("/") || trimmed.includes("\\")) {
     throw new Error(`Refusing a bot name that is not a plain file name: ${JSON.stringify(name)}`);
   }
-  return path7.resolve(projectDir, "src", `${trimmed}.ts`);
+  return path8.resolve(projectDir, "src", `${trimmed}.ts`);
+}
+function isInsideProject(projectDir, target) {
+  const real = (p) => {
+    try {
+      return fs8.realpathSync.native(p);
+    } catch {
+      return path8.resolve(p);
+    }
+  };
+  const resolved = fs8.existsSync(target) ? real(target) : path8.join(real(path8.dirname(target)), path8.basename(target));
+  const root = real(projectDir);
+  if (resolved === root) return true;
+  const relative = path8.relative(root, resolved);
+  return relative !== "" && !relative.startsWith("..") && !path8.isAbsolute(relative);
 }
 function readProjectConfig(projectDir) {
   try {
-    const raw = fs7.readFileSync(path7.join(projectDir, "vibemancer.json"), "utf-8");
+    const raw = fs8.readFileSync(path8.join(projectDir, "vibemancer.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null) return void 0;
     const bot = parsed.bot;
@@ -1500,50 +1631,56 @@ function pullDestination(projectDir, name, config) {
   const configuredExport = config?.export;
   if (!configured) return { path: fallback };
   if (configuredExport && configuredExport.toLowerCase() === name.trim().toLowerCase()) {
-    return { path: path7.resolve(projectDir, configured) };
+    const configuredPath = path8.resolve(projectDir, configured);
+    if (!isInsideProject(projectDir, configuredPath)) {
+      throw new LocalProjectError(`Refusing to write outside the project: this project's vibemancer.json points "bot" at ${JSON.stringify(configured)}, which resolves outside ${projectDir}. Fix the path in vibemancer.json, or pass --bot with a path inside the project.`);
+    }
+    return { path: configuredPath };
   }
   return {
     path: fallback,
     warning: `Note: this project's vibemancer.json uses ${configuredExport ?? "another bot"} (${configured}), so upload/fight will keep using that, not the file just written.`
   };
 }
+function writeGuarded(projectDir, target, sourceCode, force) {
+  const isNew = !fs8.existsSync(target);
+  const decision = pullDecision(isNew ? { fileExists: false, incomingContent: sourceCode, force } : {
+    fileExists: true,
+    localContent: fs8.readFileSync(target, "utf-8"),
+    incomingContent: sourceCode,
+    recordedHash: recordedHashFor(projectDir, target),
+    force
+  });
+  if (decision === "skip-identical") {
+    console.log(`  Already up to date: ${target}`);
+    recordWritten(projectDir, target, sourceCode);
+    return "identical";
+  }
+  if (decision !== "write") {
+    const why = decision === "refuse-modified" ? "it has changes that were not pulled or uploaded from here" : "this CLI has never written it, so it may be work it did not create";
+    console.error("");
+    console.error(`  Refusing to overwrite ${target}: ${why}.`);
+    console.error("  Save or commit it first, or re-run with --force to replace it.");
+    console.error("");
+    process.exitCode = 1;
+    return "refused";
+  }
+  fs8.mkdirSync(path8.dirname(target), { recursive: true });
+  fs8.writeFileSync(target, sourceCode);
+  recordWritten(projectDir, target, sourceCode);
+  console.log(`  \u2713 ${isNew ? "Created" : "Updated"} ${target}`);
+  console.log(`  ${(sourceCode.length / 1024).toFixed(1)} KB written`);
+  return "written";
+}
 async function pullByName(projectDir, name, force) {
   pullTargetPath(projectDir, name);
   console.log("");
   console.log(`  Pulling latest source for ${name}...`);
   try {
     const pulled = await pullBot(name);
-    const sourceCode = pulled.sourceCode;
     const destination = pullDestination(projectDir, pulled.name, readProjectConfig(projectDir));
-    const target = destination.path;
-    const isNew = !fs7.existsSync(target);
-    const decision = pullDecision({
-      fileExists: !isNew,
-      localContent: isNew ? void 0 : fs7.readFileSync(target, "utf-8"),
-      incomingContent: sourceCode,
-      recordedHash: recordedHashFor(projectDir, target),
-      force
-    });
-    if (decision === "skip-identical") {
-      console.log(`  Already up to date: ${target}`);
-      recordWritten(projectDir, target, sourceCode);
-      return;
-    }
-    if (decision !== "write") {
-      const why = decision === "refuse-modified" ? "it has changes that were not pulled or uploaded from here" : "this CLI has never written it, so it may be work it did not create";
-      console.error("");
-      console.error(`  Refusing to overwrite ${target}: ${why}.`);
-      console.error("  Save or commit it first, or re-run with --force to replace it.");
-      console.error("");
-      process.exitCode = 1;
-      return;
-    }
-    fs7.mkdirSync(path7.dirname(target), { recursive: true });
-    fs7.writeFileSync(target, sourceCode);
-    recordWritten(projectDir, target, sourceCode);
-    console.log(`  \u2713 ${isNew ? "Created" : "Updated"} ${target}`);
-    console.log(`  ${(sourceCode.length / 1024).toFixed(1)} KB written`);
-    if (destination.warning) console.log(`  ${destination.warning}`);
+    const outcome = writeGuarded(projectDir, destination.path, pulled.sourceCode, force);
+    if (outcome !== "refused" && destination.warning) console.log(`  ${destination.warning}`);
   } catch (err) {
     reportPullFailure(err, name);
   }
@@ -1555,27 +1692,24 @@ function reportPullFailure(err, name) {
     console.error("");
   } else {
     console.error(`  Pull failed: ${err instanceof Error ? err.message : String(err)}`);
-    console.error(name ? "  See your bots with: vibemancer bots --mine" : "  Upload first with: vibemancer upload");
+    const advice = adviceFor(err, name);
+    if (advice) console.error(advice);
     console.error("");
   }
   process.exitCode = 1;
 }
 async function runPull(options) {
-  const projectDir = process.cwd();
+  const projectDir = findProjectRoot(process.cwd());
   if (options.name) {
     await pullByName(projectDir, options.name, options.force === true);
     return;
   }
   const botInfo = await discoverBot(projectDir, options.bot, { allowMissingFile: true });
-  const isNew = !fs7.existsSync(botInfo.sourcePath);
   console.log(`
   Pulling latest source for ${botInfo.exportName}...`);
   try {
     const sourceCode = await pullSource(botInfo.exportName);
-    fs7.mkdirSync(path7.dirname(botInfo.sourcePath), { recursive: true });
-    fs7.writeFileSync(botInfo.sourcePath, sourceCode);
-    console.log(`  \u2713 ${isNew ? "Created" : "Updated"} ${botInfo.sourcePath}`);
-    console.log(`  ${(sourceCode.length / 1024).toFixed(1)} KB written`);
+    writeGuarded(projectDir, botInfo.sourcePath, sourceCode, options.force === true);
   } catch (err) {
     reportPullFailure(err);
   }
@@ -1690,7 +1824,8 @@ async function revokeSession(token) {
     const res = await fetch(`${MCP_BASE_URL}/revoke`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ token })
+      body: JSON.stringify({ token }),
+      signal: AbortSignal.timeout(AUTH_TIMEOUT_MS)
     });
     return res.ok;
   } catch {
@@ -1713,7 +1848,7 @@ async function runLogout() {
 
 // src/commands/feedback.ts
 async function defaultTokenLookup() {
-  const { getAccessToken: getAccessToken2 } = await import("./oauth-client-AX3HNK6P.js");
+  const { getAccessToken: getAccessToken2 } = await import("./oauth-client-WUOWASU4.js");
   return await getAccessToken2();
 }
 async function runFeedback(options, tokenLookup = defaultTokenLookup) {
@@ -1767,7 +1902,19 @@ async function runFeedback(options, tokenLookup = defaultTokenLookup) {
 }
 
 // src/commands/missile-calc.ts
-import { calculateMissileCastTime, validateMissileConfig, GCD_DURATION, TICKS_PER_SECOND, calculateMissileRadius } from "@vibemancer/core";
+import { calculateMissileCastTime, validateMissileConfig, GCD_DURATION, MATCH_DURATION, TICKS_PER_SECOND, calculateMissileRadius } from "@vibemancer/core";
+function describeAdjustments(raw, used) {
+  const fields = ["damage", "speed", "duration", "turnRate"];
+  const changed = fields.filter((f) => raw[f] !== used[f]);
+  if (changed.length === 0) return null;
+  const lines = changed.map((f) => `    ${f}: you asked for ${raw[f]}, the engine will use ${used[f]}`);
+  return ["  Adjusted to the engine's limits:", ...lines].join("\n");
+}
+function describeCastability(castFrames) {
+  if (castFrames < MATCH_DURATION) return null;
+  return `  NOTE: this cast takes ${castFrames} frames and a match is only ${MATCH_DURATION} - it never completes.
+        The DPS above is theoretical: the missile is never launched.`;
+}
 function runMissileCalc(options) {
   const rawConfig = {
     damage: options.damage,
@@ -1783,6 +1930,7 @@ function runMissileCalc(options) {
   const dps = config.damage / totalCycleSec;
   const range = config.speed * config.duration;
   const radius = calculateMissileRadius(config.damage);
+  const notes = [describeAdjustments(rawConfig, config), describeCastability(castFrames)].filter((n) => n !== null).join("\n");
   console.log(`
   Missile Calculator
   \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
@@ -1793,13 +1941,13 @@ function runMissileCalc(options) {
   Eff. DPS:   ${dps.toFixed(2)} HP/s
   Range:      ${range} units  (speed \xD7 duration)
   Hitbox:     ${radius.toFixed(2)} radius
-`);
+${notes ? notes + "\n" : ""}`);
 }
 
 // src/auth/telemetry.ts
 import os2 from "os";
-import fs8 from "fs";
-import path8 from "path";
+import fs9 from "fs";
+import path9 from "path";
 var TIMEOUT_MS = 1e3;
 function isTelemetryEnabled(env) {
   const off = (value) => {
@@ -1819,13 +1967,13 @@ function isTelemetryEnabled(env) {
 }
 var TELEMETRY_NOTICE = "  Vibemancer records which commands are run, your OS and version numbers, to decide\n  which platforms to support. No code, file paths or personal files are ever sent.\n  Opt out any time with VIBEMANCER_TELEMETRY=0 (DO_NOT_TRACK is honoured too).\n";
 function noticePath() {
-  return path8.join(os2.homedir(), ".vibemancer", "telemetry-notice-shown");
+  return path9.join(os2.homedir(), ".vibemancer", "telemetry-notice-shown");
 }
 function showNoticeOnce(marker = noticePath()) {
   try {
-    if (fs8.existsSync(marker)) return false;
-    fs8.mkdirSync(path8.dirname(marker), { recursive: true });
-    fs8.writeFileSync(marker, (/* @__PURE__ */ new Date()).toISOString());
+    if (fs9.existsSync(marker)) return false;
+    fs9.mkdirSync(path9.dirname(marker), { recursive: true });
+    fs9.writeFileSync(marker, (/* @__PURE__ */ new Date()).toISOString());
     console.log(TELEMETRY_NOTICE);
     return true;
   } catch {
@@ -1857,18 +2005,24 @@ function parseFlag(flag) {
   }
   return void 0;
 }
-function parseIntFlag(flag, fallback) {
+function parseNumericFlag(flag, fallback, kind) {
   const str = parseFlag(flag);
   if (str === void 0) return fallback;
-  const n = parseInt(str, 10);
-  if (Number.isNaN(n)) {
-    console.error(`Error: ${flag} must be a number, got "${str}".`);
+  const parsed = parseNumberFlag(flag, str, kind);
+  if (!parsed.ok) {
+    console.error(`Error: ${parsed.message}`);
     process.exit(1);
   }
-  return n;
+  return parsed.value;
 }
-function printHelp() {
-  console.log(`
+function parseIntFlag(flag, fallback) {
+  return parseNumericFlag(flag, fallback, "integer");
+}
+function parseFloatFlag(flag, fallback) {
+  return parseNumericFlag(flag, fallback, "number");
+}
+function helpText() {
+  return `
 Vibemancer CLI - Development tools for wizard bots
 
 Usage:
@@ -1908,6 +2062,27 @@ Trace options:
   --opponent <name>   Opponent: a built-in name OR handle/botname (required)
   --seed <n>          Random seed (default: 1)
   --distance <n>      Spawn distance (default: 600)
+  --ticks <n>         How many ticks to trace (default: 3000, a full match is 30000)
+
+Bots options:
+  --mine              List YOUR uploaded bots instead of the built-ins
+  --name <bot>        Show one bot by name
+
+Pull options:
+  --name <bot>        Pull by name, with no local file needed
+  --bot <path>        Write to this path instead of the project's configured bot
+  --force             Overwrite local changes the CLI did not write. Do not reach for
+                      this by default: pull refuses precisely when the local file may
+                      hold work that was never uploaded.
+
+Login options:
+  --no-browser        Print the URL instead of opening a browser, and paste the code back
+
+Missile-calc options:
+  --damage <n>        Hit point damage (default: 15)
+  --speed <n>         Units per frame (default: 7; the engine's minimum is 1.5)
+  --duration <n>      Lifetime in frames (default: 200; range = speed x duration)
+  --turnRate <n>      Degrees per frame the missile can turn (default: 0 = straight)
 
 Upload options:
   --bot <path>        Path to your bot source file
@@ -1947,7 +2122,10 @@ Examples:
   vibemancer build --opponent Battlemage
   vibemancer feedback "missiles go through walls sometimes"
   vibemancer missile-calc --damage 15 --speed 7 --duration 200 --turnRate 3
-`);
+`;
+}
+function printHelp() {
+  console.log(helpText());
 }
 var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--bot",
@@ -1985,7 +2163,11 @@ var KNOWN_FLAGS = {
   // per-bot concept. The flag was accepted, dropped, and the run reported success for a bot
   // path that did not exist. A flag that cannot work has to be refused, not swallowed.
   test: [],
-  fight: ["--bot", "--opponent", "--seed", "--distance"],
+  // --distance is NOT here, and that is the fix rather than an oversight: it is documented
+  // under Trace options, the fight branch never read it, and runFight has no such option. It
+  // was accepted and dropped, so `fight --distance 300` silently ran at the default 600. A
+  // flag that cannot work has to be refused by name, exactly as the `test: []` note says.
+  fight: ["--bot", "--opponent", "--seed"],
   trace: ["--bot", "--opponent", "--seed", "--distance", "--ticks"],
   tournament: ["--bot"],
   optimize: ["--bot", "--steps", "--rounds", "--opponents", "--seed"],
@@ -1998,7 +2180,15 @@ var KNOWN_FLAGS = {
   // flag was accepted and dropped, so `pull --nmae Wiz2` fell through to file discovery and
   // reported "could not find bot source file" about a flag the user had spelled wrong.
   pull: ["--bot", "--name", "--force"],
-  "missile-calc": ["--damage", "--speed", "--duration", "--turnRate"]
+  "missile-calc": ["--damage", "--speed", "--duration", "--turnRate"],
+  // login/logout were absent, so a typo'd flag was silently ignored - the same defect the
+  // fight and upload entries above were added for.
+  login: ["--no-browser"],
+  logout: []
+  // feedback is DELIBERATELY absent, and it is the one command that must stay that way: its
+  // argument is a free-text message, joined from every remaining token. Validating flags here
+  // would reject 'missiles go through walls --sometimes' as an unknown flag, turning a bug
+  // report into an error. A command whose argument is prose cannot also police prose.
 };
 var BOOLEAN_FLAGS = ["--mine", "--inactive", "--active", "--no-browser", "--force"];
 function flagsMissingValues(command2, argv) {
@@ -2026,6 +2216,19 @@ function unknownFlags(command2, argv) {
   }
   return found;
 }
+function duplicateFlags(argv) {
+  const seen = /* @__PURE__ */ new Set();
+  const repeated = /* @__PURE__ */ new Set();
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) continue;
+    const previous = i > 0 ? argv[i - 1] : "";
+    if (VALUE_FLAGS.has(previous)) continue;
+    if (seen.has(arg)) repeated.add(arg);
+    seen.add(arg);
+  }
+  return [...repeated];
+}
 function editDistance(a, b) {
   const rows = [];
   for (let i = 0; i <= a.length; i++) rows.push([i, ...new Array(b.length).fill(0)]);
@@ -2080,6 +2283,14 @@ async function main() {
 Run "vibemancer --help" to see the flags each command takes.`);
     process.exit(1);
   }
+  const repeated = duplicateFlags(args.slice(1));
+  if (repeated.length > 0) {
+    for (const flag of repeated) {
+      console.error(`Error: ${flag} was given more than once, and only the first would be used.`);
+    }
+    console.error("Remove the extra one so there is no doubt which value you meant.");
+    process.exit(1);
+  }
   const valueless = flagsMissingValues(command, args.slice(1));
   if (valueless.length > 0) {
     for (const flag of valueless) {
@@ -2125,7 +2336,7 @@ ${list}
       }
       const bot = parseFlag("--bot");
       const seed = parseFlag("--seed") !== void 0 ? parseIntFlag("--seed", 0) : void 0;
-      const distance = parseFlag("--distance") !== void 0 ? parseIntFlag("--distance", 600) : void 0;
+      const distance = parseFlag("--distance") !== void 0 ? parseFloatFlag("--distance", 600) : void 0;
       const maxTicks = parseFlag("--ticks") !== void 0 ? parseIntFlag("--ticks", 3e3) : void 0;
       await runTrace({ opponent, bot, seed, distance, maxTicks });
       break;
@@ -2205,10 +2416,12 @@ ${list}
     }
     case "missile-calc": {
       runMissileCalc({
-        damage: parseIntFlag("--damage", 15),
-        speed: parseIntFlag("--speed", 7),
-        duration: parseIntFlag("--duration", 200),
-        turnRate: parseIntFlag("--turnRate", 0)
+        // Fractional: MISSILE_MIN_SPEED is 1.5, so an integer-only --speed could not express
+        // the engine's own minimum. The engine floors duration itself.
+        damage: parseFloatFlag("--damage", 15),
+        speed: parseFloatFlag("--speed", 7),
+        duration: parseFloatFlag("--duration", 200),
+        turnRate: parseFloatFlag("--turnRate", 0)
       });
       break;
     }
@@ -2231,8 +2444,11 @@ main().catch((error) => {
   process.exit(1);
 });
 export {
+  KNOWN_FLAGS,
+  duplicateFlags,
   flagHint,
   flagsMissingValues,
+  helpText,
   suggestFlag,
   unknownFlags,
   wantsHelp