volute 0.24.0 → 0.26.0

package/dist/{chunk-PHHKNGA3.js → chunk-3TV4GLFO.js}

@@ -4,11 +4,11 @@ import {
 } from "./chunk-YUIHSKR6.js";
 import {
   gitExec
-} from "./chunk-JTDFJWI2.js";
+} from "./chunk-YJA7P64S.js";
 import {
   isIsolationEnabled,
   mindUserName
-} from "./chunk-NWPT4ASZ.js";
+} from "./chunk-XOXLRRR2.js";
 import {
   voluteHome
 } from "./chunk-B2CPS4QU.js";

package/dist/{chunk-4TJ72QQ3.js → chunk-5Y3PBKW6.js}

@@ -2,7 +2,7 @@
 import {
   readVoluteConfig,
   writeVoluteConfig
-} from "./chunk-XLC342FO.js";
+} from "./chunk-SIAG3QMM.js";
 import {
   mindEnvPath,
   readEnv,
@@ -39,7 +39,7 @@ async function run(args) {
     return;
   }
   const wsDir = resolveWorkspace(inputPath);
-  const { daemonFetch } = await import("./daemon-client-JOVQZ52X.js");
+  const { daemonFetch } = await import("./daemon-client-Z7FAJ6JW.js");
   const { getClient, urlOf } = await import("./api-client-YPKOZP2O.js");
   const client = getClient();
   const res = await daemonFetch(urlOf(client.api.minds.import.$url()), {
@@ -91,7 +91,7 @@ async function importArchive(archivePath, nameOverride) {
     process.exit(1);
   }
   try {
-    const { daemonFetch } = await import("./daemon-client-JOVQZ52X.js");
+    const { daemonFetch } = await import("./daemon-client-Z7FAJ6JW.js");
     const { getClient, urlOf } = await import("./api-client-YPKOZP2O.js");
     const client = getClient();
     const res = await daemonFetch(urlOf(client.api.minds.import.$url()), {

package/dist/{chunk-BFK6SOEJ.js → chunk-J2CO4WEV.js}

@@ -2,7 +2,7 @@
 import {
   activity,
   getDb
-} from "./chunk-33XAVCS4.js";
+} from "./chunk-WBHMQ5OZ.js";
 import {
   logger_default
 } from "./chunk-YUIHSKR6.js";

package/dist/{chunk-TQDITGES.js → chunk-LX22GRG7.js}

@@ -4,10 +4,13 @@ import {
   modeLabel,
   pollHealth,
   startService
-} from "./chunk-3AIBT4TW.js";
+} from "./chunk-V63B7DX3.js";
 import {
   parseArgs
 } from "./chunk-D424ZQGI.js";
+import {
+  readGlobalConfig
+} from "./chunk-TZKJLDQN.js";
 import {
   voluteHome
 } from "./chunk-B2CPS4QU.js";
@@ -16,22 +19,13 @@ import {
 import { spawn } from "child_process";
 import { existsSync, mkdirSync, openSync, readFileSync } from "fs";
 import { dirname, resolve } from "path";
-function readGlobalConfig() {
-  const configPath = resolve(voluteHome(), "config.json");
-  if (!existsSync(configPath)) return {};
-  try {
-    return JSON.parse(readFileSync(configPath, "utf-8"));
-  } catch (err) {
-    console.error(`Invalid config file ${configPath}: ${err instanceof Error ? err.message : err}`);
-    process.exit(1);
-  }
-}
 async function run(args) {
   const { flags } = parseArgs(args, {
     port: { type: "number" },
     host: { type: "string" },
     foreground: { type: "boolean" },
-    tailscale: { type: "boolean" }
+    tailscale: { type: "boolean" },
+    "no-sandbox": { type: "boolean" }
   });
   const mode = getServiceMode();
   if (!flags.foreground && mode !== "manual") {
@@ -95,6 +89,9 @@ async function run(args) {
     }
   } catch {
   }
+  if (flags["no-sandbox"]) {
+    process.env.VOLUTE_SANDBOX = "0";
+  }
   if (flags.foreground) {
     const { startDaemon } = await import("./daemon.js");
     await startDaemon({ port, hostname, foreground: true, tailscale: flags.tailscale });
@@ -110,6 +107,7 @@ async function run(args) {
   const logFd = openSync(logFile, "a");
   const daemonArgs = [daemonModule, "--port", String(port), "--host", hostname];
   if (flags.tailscale) daemonArgs.push("--tailscale");
+  if (flags["no-sandbox"]) daemonArgs.push("--no-sandbox");
   const child = spawn(process.execPath, daemonArgs, {
     stdio: ["ignore", "ignore", logFd],
     detached: true
@@ -151,6 +149,5 @@ async function run(args) {
 }
 
 export {
-  readGlobalConfig,
   run
 };

package/dist/{chunk-E7GOKNOT.js → chunk-NWI2425I.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   publish
-} from "./chunk-BFK6SOEJ.js";
+} from "./chunk-J2CO4WEV.js";
 import {
   logger_default
 } from "./chunk-YUIHSKR6.js";

package/dist/{chunk-2767L2RZ.js → chunk-OZFKBXD6.js}

@@ -5,7 +5,7 @@ import {
   pollHealthDown,
   readDaemonConfig,
   stopService
-} from "./chunk-3AIBT4TW.js";
+} from "./chunk-V63B7DX3.js";
 import {
   voluteHome
 } from "./chunk-B2CPS4QU.js";

package/dist/{chunk-XLC342FO.js → chunk-SIAG3QMM.js}

@@ -14,7 +14,20 @@ function readJson(path) {
 }
 function readVoluteConfig(mindDir) {
   const path = resolve(mindDir, "home/.config/volute.json");
-  return readJson(path);
+  const config = readJson(path);
+  if (!config) return null;
+  const legacy = config;
+  if (!config.profile && ("displayName" in config || "description" in config || "avatar" in config)) {
+    config.profile = {
+      displayName: legacy.displayName,
+      description: legacy.description,
+      avatar: legacy.avatar
+    };
+    delete legacy.displayName;
+    delete legacy.description;
+    delete legacy.avatar;
+  }
+  return config;
 }
 function writeVoluteConfig(mindDir, config) {
   const path = resolve(mindDir, "home/.config/volute.json");

package/dist/{chunk-RVKR2R7F.js → chunk-SSI47XP2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/lib/prompt.ts
-function promptLine(prompt) {
+function rawPrompt(prompt, echo) {
   process.stderr.write(prompt);
   return new Promise((resolve) => {
     let value = "";
@@ -23,6 +23,7 @@ function promptLine(prompt) {
           value = value.slice(0, -1);
         } else {
           value += String.fromCharCode(byte);
+          if (echo) process.stderr.write(String.fromCharCode(byte));
         }
       }
     };
@@ -31,7 +32,14 @@ function promptLine(prompt) {
     process.stdin.on("data", onData);
   });
 }
+function promptLine(prompt) {
+  return rawPrompt(prompt, true);
+}
+function promptPassword(prompt) {
+  return rawPrompt(prompt, false);
+}
 
 export {
-  promptLine
+  promptLine,
+  promptPassword
 };

package/dist/chunk-TZKJLDQN.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import {
+  voluteHome
+} from "./chunk-B2CPS4QU.js";
+
+// src/lib/setup.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { resolve } from "path";
+function configPath() {
+  return resolve(voluteHome(), "config.json");
+}
+function readGlobalConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    console.error(`Failed to parse ${path}: ${err instanceof Error ? err.message : err}`);
+    return {};
+  }
+}
+function writeGlobalConfig(config) {
+  const path = configPath();
+  mkdirSync(voluteHome(), { recursive: true });
+  writeFileSync(path, JSON.stringify(config, null, 2) + "\n");
+}
+function isSetupComplete() {
+  const config = readGlobalConfig();
+  return config.setup != null;
+}
+function migrateSetupConfig() {
+  const config = readGlobalConfig();
+  if (config.setup) return;
+  const home = voluteHome();
+  const registryPath = resolve(home, "minds.json");
+  if (!existsSync(registryPath)) return;
+  const isSystem = process.env.VOLUTE_ISOLATION === "user";
+  const mindsDir = process.env.VOLUTE_MINDS_DIR || resolve(home, "minds");
+  let hasService = false;
+  try {
+    if (process.platform === "darwin") {
+      const plistPath = resolve(
+        process.env.HOME || "",
+        "Library",
+        "LaunchAgents",
+        "com.volute.daemon.plist"
+      );
+      if (existsSync(plistPath)) hasService = true;
+    }
+    if (process.platform === "linux") {
+      if (existsSync("/etc/systemd/system/volute.service")) hasService = true;
+      const userUnit = resolve(
+        process.env.HOME || "",
+        ".config",
+        "systemd",
+        "user",
+        "volute.service"
+      );
+      if (existsSync(userUnit)) hasService = true;
+    }
+  } catch {
+  }
+  const setup = {
+    type: isSystem ? "system" : "local",
+    isolation: isSystem ? "user" : "none",
+    mindsDir,
+    service: hasService
+  };
+  writeGlobalConfig({ ...config, setup });
+}
+
+export {
+  configPath,
+  readGlobalConfig,
+  writeGlobalConfig,
+  isSetupComplete,
+  migrateSetupConfig
+};

package/dist/{chunk-P3W36ZGD.js → chunk-USNBKHYG.js}

@@ -2,14 +2,14 @@
 import {
   getDb,
   sharedSkills
-} from "./chunk-33XAVCS4.js";
+} from "./chunk-WBHMQ5OZ.js";
 import {
   logger_default
 } from "./chunk-YUIHSKR6.js";
 import {
   exec,
   gitExec
-} from "./chunk-JTDFJWI2.js";
+} from "./chunk-YJA7P64S.js";
 import {
   voluteHome
 } from "./chunk-B2CPS4QU.js";
@@ -30,7 +30,7 @@ import { basename, dirname, join, resolve } from "path";
 import { eq, sql } from "drizzle-orm";
 var VALID_SKILL_ID = /^[a-zA-Z0-9_-]+$/;
 var SEED_SKILLS = ["orientation", "memory"];
-var STANDARD_SKILLS = ["volute-mind", "memory", "sessions"];
+var STANDARD_SKILLS = ["volute-mind", "memory", "sessions", "notes", "dreaming"];
 function validateSkillId(id) {
   if (!id || !VALID_SKILL_ID.test(id)) {
     throw new Error(`Invalid skill ID: ${id}`);
@@ -41,13 +41,15 @@ function sharedSkillsDir() {
 }
 function parseSkillMd(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!match) return { name: "", description: "" };
+  if (!match) return { name: "", description: "", npmDependencies: [] };
   const frontmatter = match[1];
   const nameMatch = frontmatter.match(/^name:\s*(.+)$/m);
   const descMatch = frontmatter.match(/^description:\s*(.+)$/m);
+  const depsMatch = frontmatter.match(/^\s*npm-dependencies:\s*(.+)$/m);
   return {
     name: nameMatch?.[1].trim() ?? "",
-    description: descMatch?.[1].trim() ?? ""
+    description: descMatch?.[1].trim() ?? "",
+    npmDependencies: depsMatch ? depsMatch[1].trim().split(/[\s,]+/).filter(Boolean) : []
   };
 }
 async function listSharedSkills() {
@@ -127,7 +129,32 @@ async function installSkill(_mindName, dir, skillId) {
   if (existsSync(destDir)) throw new Error(`Skill already installed: ${skillId}`);
   mkdirSync(destDir, { recursive: true });
   cpSync(sourceDir, destDir, { recursive: true });
+  const npmInstalled = [];
+  const skillMdPath = join(sourceDir, "SKILL.md");
+  if (existsSync(skillMdPath)) {
+    const { npmDependencies } = parseSkillMd(readFileSync(skillMdPath, "utf-8"));
+    if (npmDependencies.length > 0) {
+      try {
+        await exec("npm", ["install", ...npmDependencies], { cwd: dir });
+        npmInstalled.push(...npmDependencies);
+      } catch (e) {
+        rmSync(destDir, { recursive: true });
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(
+          `Failed to install npm dependencies (${npmDependencies.join(", ")}): ${msg}`
+        );
+      }
+    }
+  }
+  let installNotes = null;
+  const installMdPath = join(destDir, "references", "INSTALL.md");
+  if (existsSync(installMdPath)) {
+    installNotes = readFileSync(installMdPath, "utf-8");
+  }
   await gitExec(["add", join("home", ".claude", "skills", skillId)], { cwd: dir });
+  if (npmInstalled.length > 0) {
+    await gitExec(["add", "package.json", "package-lock.json"], { cwd: dir });
+  }
   await gitExec(["commit", "-m", `Install shared skill: ${skillId}`], { cwd: dir });
   const commitHash = (await gitExec(["rev-parse", "HEAD"], { cwd: dir })).trim();
   const upstream = {
@@ -141,6 +168,7 @@ async function installSkill(_mindName, dir, skillId) {
     cwd: dir
   });
   await gitExec(["commit", "--amend", "--no-edit"], { cwd: dir });
+  return { installNotes, npmInstalled };
 }
 async function uninstallSkill(_mindName, dir, skillId) {
   validateSkillId(skillId);

package/dist/chunk-UTL75LP6.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+import {
+  logger_default
+} from "./chunk-YUIHSKR6.js";
+import {
+  readGlobalConfig
+} from "./chunk-TZKJLDQN.js";
+import {
+  voluteHome
+} from "./chunk-B2CPS4QU.js";
+
+// src/lib/sandbox.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var slog = logger_default.child("sandbox");
+var sandboxManager = null;
+function isSandboxEnabled() {
+  if (process.env.VOLUTE_SANDBOX === "0") return false;
+  return readGlobalConfig().setup?.isolation === "sandbox";
+}
+async function initSandbox() {
+  if (!isSandboxEnabled()) return;
+  try {
+    const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
+    const config = {
+      network: {
+        allowedDomains: ["*"],
+        deniedDomains: [],
+        allowLocalBinding: true
+      },
+      filesystem: {
+        denyRead: [],
+        allowWrite: [],
+        denyWrite: []
+      }
+    };
+    await SandboxManager.initialize(config);
+    sandboxManager = SandboxManager;
+  } catch (err) {
+    slog.error(
+      "sandbox runtime not available \u2014 minds will run without sandbox isolation",
+      logger_default.errorData(err)
+    );
+  }
+}
+function buildDenyRead(mindName, mindDir) {
+  const home = voluteHome();
+  const userHome = process.env.HOME || "";
+  const mindsDir = process.env.VOLUTE_MINDS_DIR || resolve(home, "minds");
+  const deny = [];
+  deny.push(resolve(home, "state"));
+  deny.push(resolve(home, "volute.db"));
+  deny.push(resolve(home, "env.json"));
+  deny.push(resolve(home, "config.json"));
+  deny.push(resolve(home, "daemon.json"));
+  deny.push(resolve(home, "minds.json"));
+  deny.push(resolve(home, "systems.json"));
+  try {
+    const registryPath = resolve(home, "minds.json");
+    if (existsSync(registryPath)) {
+      const registry = JSON.parse(readFileSync(registryPath, "utf-8"));
+      for (const entry of registry) {
+        if (entry.name === mindName.split("@")[0]) continue;
+        const otherDir = resolve(mindsDir, entry.name);
+        if (otherDir !== mindDir) {
+          deny.push(otherDir);
+        }
+      }
+    }
+  } catch (err) {
+    slog.warn("failed to read minds registry for deny-read list", logger_default.errorData(err));
+  }
+  if (userHome) {
+    deny.push(resolve(userHome, ".ssh"));
+    deny.push(resolve(userHome, ".aws"));
+    deny.push(resolve(userHome, ".gnupg"));
+    deny.push(resolve(userHome, ".config"));
+  }
+  return deny;
+}
+function shellEscape(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+async function wrapForSandbox(cmd, args, mindDir, mindName, allowWrite) {
+  if (!sandboxManager) return [cmd, args];
+  const denyRead = buildDenyRead(mindName, mindDir);
+  const customConfig = {
+    filesystem: {
+      denyRead,
+      allowWrite: allowWrite ?? [mindDir],
+      denyWrite: []
+    }
+  };
+  try {
+    const shellCmd = [cmd, ...args].map(shellEscape).join(" ");
+    const wrapped = await sandboxManager.wrapWithSandbox(shellCmd, void 0, customConfig);
+    return ["bash", ["-c", wrapped]];
+  } catch (err) {
+    slog.error(
+      `failed to sandbox mind ${mindName} \u2014 running without isolation`,
+      logger_default.errorData(err)
+    );
+    return [cmd, args];
+  }
+}
+
+export {
+  isSandboxEnabled,
+  initSandbox,
+  buildDenyRead,
+  shellEscape,
+  wrapForSandbox
+};

package/dist/{chunk-3AIBT4TW.js → chunk-V63B7DX3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   execInherit
-} from "./chunk-JTDFJWI2.js";
+} from "./chunk-YJA7P64S.js";
 import {
   voluteHome
 } from "./chunk-B2CPS4QU.js";
@@ -20,6 +20,7 @@ var LAUNCHD_PLIST_PATH = resolve(
   "LaunchAgents",
   `${LAUNCHD_PLIST_LABEL}.plist`
 );
+var SYSTEM_LAUNCHD_PLIST_PATH = "/Library/LaunchDaemons/com.volute.daemon.plist";
 var HEALTH_POLL_TIMEOUT = 3e4;
 var STOP_GRACE_TIMEOUT = 1e4;
 var POLL_INTERVAL = 500;
@@ -38,6 +39,9 @@ function getServiceMode() {
     } catch {
     }
   }
+  if (process.platform === "darwin" && existsSync(SYSTEM_LAUNCHD_PLIST_PATH)) {
+    return "system-launchd";
+  }
   if (process.platform === "darwin" && existsSync(LAUNCHD_PLIST_PATH)) {
     return "user-launchd";
   }
@@ -92,6 +96,9 @@ async function startService(mode) {
     case "user-systemd":
       await execInherit("systemctl", ["--user", "start", "volute"]);
       break;
+    case "system-launchd":
+      await execInherit("sudo", ["launchctl", "load", SYSTEM_LAUNCHD_PLIST_PATH]);
+      break;
     case "user-launchd":
       await execInherit("launchctl", ["load", LAUNCHD_PLIST_PATH]);
       break;
@@ -105,6 +112,9 @@ async function stopService(mode) {
     case "user-systemd":
       await execInherit("systemctl", ["--user", "stop", "volute"]);
       break;
+    case "system-launchd":
+      await execInherit("sudo", ["launchctl", "unload", SYSTEM_LAUNCHD_PLIST_PATH]);
+      break;
     case "user-launchd":
       await execInherit("launchctl", ["unload", LAUNCHD_PLIST_PATH]);
       break;
@@ -118,6 +128,16 @@ async function restartService(mode) {
     case "user-systemd":
       await execInherit("systemctl", ["--user", "restart", "volute"]);
       break;
+    case "system-launchd":
+      try {
+        await execInherit("sudo", ["launchctl", "unload", SYSTEM_LAUNCHD_PLIST_PATH]);
+      } catch (err) {
+        console.warn(
+          `Warning: launchctl unload failed: ${err instanceof Error ? err.message : err}`
+        );
+      }
+      await execInherit("sudo", ["launchctl", "load", SYSTEM_LAUNCHD_PLIST_PATH]);
+      break;
     case "user-launchd":
       try {
         await execInherit("launchctl", ["unload", LAUNCHD_PLIST_PATH]);
@@ -152,6 +172,8 @@ function modeLabel(mode) {
       return "system service (systemd)";
     case "user-systemd":
       return "user service (systemd)";
+    case "system-launchd":
+      return "system service (launchd)";
     case "user-launchd":
       return "user service (launchd)";
     case "manual":
@@ -164,6 +186,7 @@ export {
   USER_SYSTEMD_UNIT,
   LAUNCHD_PLIST_LABEL,
   LAUNCHD_PLIST_PATH,
+  SYSTEM_LAUNCHD_PLIST_PATH,
   getServiceMode,
   getDaemonUrl,
   pollHealth,

package/dist/{chunk-33XAVCS4.js → chunk-WBHMQ5OZ.js}

@@ -16,6 +16,9 @@ __export(schema_exports, {
   deliveryQueue: () => deliveryQueue,
   messages: () => messages,
   mindHistory: () => mindHistory,
+  noteComments: () => noteComments,
+  noteReactions: () => noteReactions,
+  notes: () => notes,
   sessions: () => sessions,
   sharedSkills: () => sharedSkills,
   systemPrompts: () => systemPrompts,
@@ -149,6 +152,49 @@ var conversationReads = sqliteTable(
     uniqueIndex("idx_conversation_reads_unique").on(table.user_id, table.conversation_id)
   ]
 );
+var notes = sqliteTable(
+  "notes",
+  {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    author_id: integer("author_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    title: text("title").notNull(),
+    slug: text("slug").notNull(),
+    content: text("content").notNull(),
+    reply_to_id: integer("reply_to_id"),
+    created_at: text("created_at").notNull().default(sql`(datetime('now'))`),
+    updated_at: text("updated_at").notNull().default(sql`(datetime('now'))`)
+  },
+  (table) => [
+    uniqueIndex("idx_notes_author_slug").on(table.author_id, table.slug),
+    index("idx_notes_created_at").on(table.created_at),
+    index("idx_notes_reply_to").on(table.reply_to_id)
+  ]
+);
+var noteComments = sqliteTable(
+  "note_comments",
+  {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    note_id: integer("note_id").notNull().references(() => notes.id, { onDelete: "cascade" }),
+    author_id: integer("author_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    content: text("content").notNull(),
+    created_at: text("created_at").notNull().default(sql`(datetime('now'))`)
+  },
+  (table) => [index("idx_note_comments_note_id").on(table.note_id)]
+);
+var noteReactions = sqliteTable(
+  "note_reactions",
+  {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    note_id: integer("note_id").notNull().references(() => notes.id, { onDelete: "cascade" }),
+    user_id: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    emoji: text("emoji").notNull(),
+    created_at: text("created_at").notNull().default(sql`(datetime('now'))`)
+  },
+  (table) => [
+    uniqueIndex("idx_note_reactions_unique").on(table.note_id, table.user_id, table.emoji),
+    index("idx_note_reactions_note_id").on(table.note_id)
+  ]
+);
 var messages = sqliteTable(
   "messages",
   {
@@ -198,6 +244,9 @@ export {
   deliveryQueue,
   activity,
   conversationReads,
+  notes,
+  noteComments,
+  noteReactions,
   messages,
   getDb
 };

package/dist/{chunk-TRQEV3CD.js → chunk-WGOGUMPO.js}

@@ -6,6 +6,15 @@ import {
 // src/lib/daemon-client.ts
 import { existsSync, readFileSync } from "fs";
 import { resolve } from "path";
+function readCliSession() {
+  const sessionPath = resolve(voluteHome(), "cli-session.json");
+  if (!existsSync(sessionPath)) return null;
+  try {
+    return JSON.parse(readFileSync(sessionPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
 function readDaemonConfig() {
   const configPath = resolve(voluteHome(), "daemon.json");
   if (!existsSync(configPath)) {
@@ -47,12 +56,22 @@ async function daemonFetch(path, options) {
   const config = readDaemonConfig();
   const url = buildUrl(config);
   const headers = new Headers(options?.headers);
-  if (config.token) {
-    headers.set("Authorization", `Bearer ${config.token}`);
+  const cliSession = readCliSession();
+  if (cliSession?.sessionId) {
+    headers.set("Authorization", `Bearer ${cliSession.sessionId}`);
   }
   headers.set("Origin", url);
   try {
-    return await fetch(`${url}${path}`, { ...options, headers });
+    const res = await fetch(`${url}${path}`, { ...options, headers });
+    if (res.status === 401 && !path.startsWith("/api/auth/")) {
+      if (cliSession) {
+        console.error("Session expired. Run `volute login` again.");
+      } else {
+        console.error("Not logged in. Run `volute login` first.");
+      }
+      process.exit(1);
+    }
+    return res;
   } catch (err) {
     if (err instanceof TypeError && err.cause?.code === "ECONNREFUSED") {
       console.error("Volute is not running. Start with: volute up");