wyrm-mcp 7.0.2 → 7.1.0

package/LICENSE

@@ -661,7 +661,7 @@ For more information on this, and how to apply and follow the GNU AGPL, see
 <https://www.gnu.org/licenses/>.
 
 ---
-Copyright (c) 2024-2026 Ghost Protocol (Pvt) Ltd
+Copyright (c) 2026 Ghost Protocol (Pvt) Ltd
 https://ghosts.lk
 
 For commercial licensing inquiries: ghosts.lk@proton.me

package/NOTICE

@@ -0,0 +1,29 @@
+Wyrm — Persistent Memory for AI Agents
+Copyright © 2026 Ghost Protocol (Pvt) Ltd. All rights reserved.
+
+This software ("Wyrm", published as the npm package "wyrm-mcp") and its source
+code, documentation, and associated materials are the original work and
+intellectual property of Ghost Protocol (Pvt) Ltd, Colombo, Sri Lanka.
+
+LICENSE — dual-licensed:
+
+  1. Open source: GNU Affero General Public License, version 3 or later
+     (AGPL-3.0-or-later). See the LICENSE file for the full terms. Note in
+     particular AGPL section 13: if you run a modified version of this software
+     to provide a network service, you must offer the complete corresponding
+     source code of your modified version to the users of that service.
+
+  2. Commercial: a separate, non-copyleft commercial license is available for
+     embedding Wyrm in a closed-source product, or operating it as a managed
+     service without AGPL's source-sharing obligations. Contact:
+     ghosts.lk@proton.me
+
+Trademarks: "Wyrm", "Ghost Protocol", and the silver-dragon mark are trademarks
+of Ghost Protocol (Pvt) Ltd. Use of the AGPL license does not grant any
+trademark rights.
+
+Unauthorized copying, reverse engineering to circumvent the license, or
+distribution of derivative works outside the terms above is prohibited and may
+infringe the copyright and other rights of Ghost Protocol (Pvt) Ltd.
+
+Ghost Protocol (Pvt) Ltd · Colombo, Sri Lanka · ghosts.lk · ghosts.lk@proton.me

package/dist/agent-daemon.d.ts

@@ -15,7 +15,7 @@
  * alive, `start()` refuses (no fork-bomb). `restart()` is provided as
  * an explicit operation.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/agent-daemon.js

@@ -15,7 +15,7 @@
  * alive, `start()` refuses (no fork-bomb). `restart()` is provided as
  * an explicit operation.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { spawn } from 'child_process';

package/dist/agent-loop.d.ts

@@ -26,7 +26,7 @@
  *   {"thought":"...","action":"done","summary":"..."} or
  *   {"thought":"...","action":"block","reason":"..."}
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/agent-loop.js

@@ -26,7 +26,7 @@
  *   {"thought":"...","action":"done","summary":"..."} or
  *   {"thought":"...","action":"block","reason":"..."}
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { Goals } from './goals.js';

package/dist/analytics.d.ts

@@ -1,7 +1,7 @@
 /**
  * Wyrm Analytics — Persistent Usage Tracking & Cost Monitoring
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module analytics
  * @version 3.2.0

package/dist/analytics.js

@@ -1,7 +1,7 @@
 /**
  * Wyrm Analytics — Persistent Usage Tracking & Cost Monitoring
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module analytics
  * @version 3.2.0

package/dist/audit.d.ts

@@ -59,7 +59,7 @@
  * unsigned, byte-identical to 6.x behavior. `WYRM_AUDIT_SIGNING_KEY` holds a
  * PEM-encoded (pkcs8) Ed25519 private key, or a path to one.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/audit.js

@@ -59,7 +59,7 @@
  * unsigned, byte-identical to 6.x behavior. `WYRM_AUDIT_SIGNING_KEY` holds a
  * PEM-encoded (pkcs8) Ed25519 private key, or a path to one.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, } from 'crypto';

package/dist/auto-capture.js

@@ -12,7 +12,7 @@
  * stored with needs_review=1 so the operator vets them (wyrm_review) — nothing
  * auto-trusted, matching Wyrm's distillation-queue discipline.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { classifyCapture } from './capture.js';

package/dist/auto-orchestrator.d.ts

@@ -10,7 +10,7 @@
  * - Task Decomposition: Large features via subtasks + parallel execution
  * - Verification: High-risk code changes via multi-angle review
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 export type TaskType = 'decision' | 'generation' | 'research' | 'verification' | 'decomposition';

package/dist/auto-orchestrator.js

@@ -10,7 +10,7 @@
  * - Task Decomposition: Large features via subtasks + parallel execution
  * - Verification: High-risk code changes via multi-angle review
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 /**

package/dist/autoconfig.d.ts

@@ -5,7 +5,7 @@
  * Cursor, Windsurf, Zed, etc.) and configures Wyrm's MCP server in each.
  * Handles provider switching seamlessly — change your AI, Wyrm follows.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module autoconfig
  * @version 3.0.0

package/dist/autoconfig.js

@@ -5,7 +5,7 @@
  * Cursor, Windsurf, Zed, etc.) and configures Wyrm's MCP server in each.
  * Handles provider switching seamlessly — change your AI, Wyrm follows.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module autoconfig
  * @version 3.0.0

package/dist/buddy-runner.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Companion-buddy runner (v7 F4 T036 - extracted from the index.ts monolith).
+ * The buddy fold's ONE implementation: wyrm_buddy calls it directly and the
+ * well-known `buddy` tool calls it when any companion param is present. Lifted
+ * VERBATIM behind a factory that captures the same singletons it always closed
+ * over (db / mcpClient / our version string for cycle-prevention).
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license AGPL-3.0-or-later
+ */
+import type { WyrmDB } from "./database.js";
+import type { OutboundMcpClient } from "./mcp-client.js";
+export interface BuddyRunnerDeps {
+    db: WyrmDB;
+    mcpClient: OutboundMcpClient;
+    version: string;
+}
+export declare function makeRunCompanionBuddy(deps: BuddyRunnerDeps): (args: Record<string, unknown>) => Promise<{
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=buddy-runner.d.ts.map

package/dist/buddy-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buddy-runner.d.ts","sourceRoot":"","sources":["../src/buddy-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIzD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,UA0DpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAoC3H"}

package/dist/buddy-runner.js

@@ -0,0 +1,109 @@
+/**
+ * Companion-buddy runner (v7 F4 T036 - extracted from the index.ts monolith).
+ * The buddy fold's ONE implementation: wyrm_buddy calls it directly and the
+ * well-known `buddy` tool calls it when any companion param is present. Lifted
+ * VERBATIM behind a factory that captures the same singletons it always closed
+ * over (db / mcpClient / our version string for cycle-prevention).
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license AGPL-3.0-or-later
+ */
+import { gatherBuddyInputs, buildBuddyOutput } from "./buddy.js";
+export function makeRunCompanionBuddy(deps) {
+    const { db, mcpClient, version } = deps;
+    /**
+     * Spec 015 — buddy federation.
+     *
+     * For each registered + enabled outbound MCP server, list its tools and
+     * call any whose name matches /^(buddy_|.+_buddy$)/ (case-insensitive).
+     * Collects up to 3 replies; budget-frugal, best-effort.
+     */
+    async function collectExternalBuddyReplies(projectId) {
+        const replies = [];
+        const servers = mcpClient.list().filter((r) => r.enabled);
+        // Identify ourselves for cycle prevention per Buddy Protocol v1.0 §4.
+        const fromBuddy = `wyrm@${version}`;
+        // Try to give peers context — name of the project the local buddy is on.
+        let projectHint;
+        try {
+            const row = db.getDatabase().prepare('SELECT name FROM projects WHERE id = ?').get(projectId);
+            projectHint = row?.name;
+        }
+        catch { /* fine */ }
+        for (const srv of servers) {
+            if (replies.length >= 3)
+                break;
+            let tools = null;
+            try {
+                tools = await mcpClient.listTools(srv.server_name);
+            }
+            catch {
+                continue;
+            }
+            if (!tools)
+                continue;
+            // Prefer well-known `buddy` (Buddy Protocol v1.0); fall back to `*_buddy` / `buddy_*` patterns.
+            const wellKnown = tools.find((t) => t.name.toLowerCase() === 'buddy');
+            const buddyTools = wellKnown
+                ? [wellKnown]
+                : tools.filter((t) => /^(buddy_|.*_buddy)$/i.test(t.name));
+            for (const t of buddyTools) {
+                if (replies.length >= 3)
+                    break;
+                try {
+                    const r = await mcpClient.call(srv.server_name, t.name, {
+                        from_buddy: fromBuddy,
+                        project_hint: projectHint,
+                        size: 'compact',
+                    });
+                    const text = typeof r.result === 'string' ? r.result : JSON.stringify(r.result).slice(0, 800);
+                    if (text)
+                        replies.push({ server: srv.server_name, tool: t.name, reply: text });
+                }
+                catch { /* skip on error */ }
+            }
+        }
+        return replies;
+    }
+    /**
+     * v7 F3 (T021) — the companion buddy code path, extracted VERBATIM from the
+     * wyrm_buddy switch case so the buddy fold shares ONE implementation:
+     * `wyrm_buddy` calls it directly, and the well-known `buddy` tool calls it
+     * whenever any companion param (persona/persona_name/mood/federate/
+     * project_path — handlers/alias-adapters.ts) is present. Never a duplicate;
+     * the alias spine routes wyrm_buddy → buddy with an argument adapter and the
+     * golden replay CI proves both entries byte-equivalent.
+     */
+    async function runCompanionBuddy(args) {
+        const { project_path: bdPath, mood: bdMood, persona: bdPersona, persona_name: bdPersonaName, federate: bdFederate, size: bdSize } = args;
+        // Resolve project: explicit path > cwd > nothing
+        const cwd = bdPath ?? process.cwd();
+        const project = db.getProject(cwd);
+        if (!project) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: `󱅝 I don't see *${cwd}* in my hoard yet — scan it first with \`wyrm_scan_projects\`, then come back.`,
+                    }],
+            };
+        }
+        const persona = bdPersona ?? process.env.WYRM_BUDDY_DEFAULT_PERSONA ?? 'wyrm';
+        const inputs = gatherBuddyInputs(db.getDatabase(), project.id);
+        // Federate with other "*_buddy" tools on registered external MCPs.
+        // Skipped in quiet mode (token-frugal) and on explicit federate:false.
+        if (bdFederate !== false && bdMood !== 'quiet') {
+            try {
+                const externals = await collectExternalBuddyReplies(project.id);
+                if (externals.length > 0)
+                    inputs.externalBuddies = externals;
+            }
+            catch {
+                // Federation is best-effort. Don't fail the local buddy on a remote hiccup.
+            }
+        }
+        const out = buildBuddyOutput(inputs, { mood: bdMood, persona, personaName: bdPersonaName, size: bdSize });
+        return { content: [{ type: 'text', text: out.markdown }] };
+    }
+    return runCompanionBuddy;
+}
+//# sourceMappingURL=buddy-runner.js.map

package/dist/buddy-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buddy-runner.js","sourceRoot":"","sources":["../src/buddy-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AASjE,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH,KAAK,UAAU,2BAA2B,CAAC,SAAiB;QAC1D,MAAM,OAAO,GAA2D,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,sEAAsE;QACtE,MAAM,SAAS,GAAG,QAAQ,OAAO,EAAE,CAAC;QACpC,yEAAyE;QACzE,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAiC,CAAC;YAC9H,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM;YAC/B,IAAI,KAAK,GAAyD,IAAI,CAAC;YACvE,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,gGAAgG;YAChG,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,SAAS;gBAC1B,CAAC,CAAC,CAAC,SAAS,CAAC;gBACb,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM;gBAC/B,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;wBACtD,UAAU,EAAE,SAAS;wBACrB,YAAY,EAAE,WAAW;wBACzB,IAAI,EAAE,SAAS;qBAChB,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAC9F,IAAI,IAAI;wBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAAC,IAA6B;QAC5D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAEnI,CAAC;QAEF,iDAAiD;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mBAAmB,GAAG,gFAAgF;qBAC7G,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB,SAAS,IAAK,OAAO,CAAC,GAAG,CAAC,0BAA2C,IAAI,MAAM,CAAC;QAC9G,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/D,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,UAAU,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAChE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAEC,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/buddy.d.ts

@@ -10,7 +10,7 @@
  * `buddy_*` is queried via `wyrm_call_external` and its output is
  * folded into the response.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/buddy.js

@@ -10,7 +10,7 @@
  * `buddy_*` is queried via `wyrm_call_external` and its output is
  * folded into the response.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { ICON } from './icons.js';

package/dist/capabilities.d.ts

@@ -10,7 +10,7 @@
  * Also used as the body of the `wyrm_capabilities` MCP tool, the
  * `wyrm_inject_prompt` block, and the postinstall pitch.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/capabilities.js

@@ -10,7 +10,7 @@
  * Also used as the body of the `wyrm_capabilities` MCP tool, the
  * `wyrm_inject_prompt` block, and the postinstall pitch.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { homedir } from 'os';

package/dist/capture.d.ts

@@ -1,7 +1,7 @@
 /**
  * Wyrm Capture Helpers — Classification logic for unified auto-capture.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 export type CaptureType = 'quest' | 'truth' | 'memory';

package/dist/capture.js

@@ -1,7 +1,7 @@
 /**
  * Wyrm Capture Helpers — Classification logic for unified auto-capture.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 /**

package/dist/causality.d.ts

@@ -9,7 +9,7 @@
  * ground truth flips to stale or gets superseded, the invalidation
  * cascade walks the edge graph and flags downstream decisions.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import type Database from 'better-sqlite3';

package/dist/causality.js

@@ -9,7 +9,7 @@
  * ground truth flips to stale or gets superseded, the invalidation
  * cascade walks the edge graph and flags downstream decisions.
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  */
 import { emitEvent } from './events.js';

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 /**
  * Wyrm CLI - Beautiful command-line interface
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module cli
  * @version 3.0.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 /**
  * Wyrm CLI - Beautiful command-line interface
  *
- * @copyright 2024-2026 Ghost Protocol (Pvt) Ltd.
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
  * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
  * @module cli
  * @version 3.0.0

package/dist/cloud/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cloud/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA8CH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsD5D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cloud/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+CH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6D5D"}

package/dist/cloud/cli.js

@@ -19,7 +19,8 @@ import { resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { CloudClient, CloudError, DEFAULT_BASE, SESSION_FILE, loadSession, saveSession, clearSession } from './client.js';
 import { getMasterKey, keyExists, keyFilePath } from './crypto.js';
-import { runSync } from './sync-engine.js';
+import { computeMachineFp, classifySession } from './machine-id.js';
+import { runSync, CopiedSessionError } from './sync-engine.js';
 import { initializeLicense, hasFeature, getTier } from '../license.js';
 /**
  * Gate the data-movement cloud commands behind a Pro+ license.
@@ -69,6 +70,7 @@ export async function cmdCloud(args) {
             case 'login': return await cmdLogin(rest);
             case 'logout': return await cmdLogout();
             case 'status': return await cmdStatus();
+            case 'doctor': return cmdDoctor();
             case 'devices': return await cmdDevices(rest);
             case 'sync': return await cmdSync(rest);
             case 'export': return await cmdExport(rest);
@@ -83,6 +85,12 @@ export async function cmdCloud(args) {
     catch (err) {
         // Translate common errors to friendly CLI output. Falls through
         // to a generic message for unexpected exceptions.
+        if (err instanceof CopiedSessionError) {
+            // The detailed loud guidance was already written to stderr by the
+            // sync engine. Just exit non-zero without burying it under a
+            // generic message.
+            process.exit(1);
+        }
         if (err instanceof CloudError) {
             if (err.status === 401) {
                 console.error('✘ Not authenticated. Run `wyrm cloud login`.');
@@ -132,10 +140,14 @@ SUBCOMMANDS:
   status                 Show account, tier, storage, and registered devices.
   devices                List devices on this account.
   devices revoke <id>    Revoke a specific device.
-  sync [--dry-run] [--all]
+  sync [--dry-run] [--all] [--force]
                          Push local cross-project rows + pull peer deltas.
                          --all syncs every semantic table (ignores
                          visibility opt-in). Skips telemetry / FTS / logs.
+                         --force proceeds past a copied-session warning
+                         (or set WYRM_ALLOW_COPIED_SESSION=1).
+  doctor                 Diagnose this device's cloud identity (device_id,
+                         machine fingerprint match, copied-session check).
   export [path]          Download full account dump (deltas stay encrypted).
   delete --confirm       Permanently delete the cloud account (irreversible).
   recovery show          Print master key as a 24-word BIP39 phrase.
@@ -228,10 +240,12 @@ async function cmdLogin(_args) {
     try {
         const reg = await authed.registerDevice(deviceName);
         deviceId = reg.device.id;
-        // Update session file with device info
+        // Update session file with device info + this machine's fingerprint.
+        // The fp binds the session to THIS machine so a later copy of
+        // cloud.json to a second box is detected at sync (failure #40).
         const s = loadSession();
         if (s)
-            saveSession({ ...s, email, device_id: deviceId, device_name: deviceName });
+            saveSession({ ...s, email, device_id: deviceId, device_name: deviceName, machine_fp: computeMachineFp() });
     }
     catch (err) {
         console.error(`\n⚠ Logged in but could not register device: ${err instanceof Error ? err.message : err}`);
@@ -303,7 +317,9 @@ async function cmdStatus() {
         console.log(`  Providers:${me.identities.map((i) => ' ' + i.provider).join(',')}`);
         console.log('');
         console.log(`  This machine: ${s.device_name ?? '(not registered)'}`);
+        console.log(`  Device ID:    ${s.device_id ? s.device_id.slice(0, 8) + '…' : '(none)'}`);
         console.log(`  Session age:  ${Math.round((Date.now() - s.created_at) / (24 * 60 * 60 * 1000))} day(s)`);
+        printIdentityHealth(s);
         console.log('');
         // Encryption-key health. The whole operator-owns-data guarantee rests
         // on this file existing — if it's gone, no pulled blob can be decrypted.
@@ -328,6 +344,50 @@ async function cmdStatus() {
         throw err;
     }
 }
+/**
+ * Print the device-identity health line(s) for a session: whether the
+ * stored machine fingerprint matches THIS machine. A mismatch is the
+ * copied-session / device_id-collision symptom (failure #40). Shared by
+ * `status` and `doctor`.
+ */
+function printIdentityHealth(s) {
+    const verdict = classifySession(s.machine_fp);
+    if (verdict.state === 'match') {
+        console.log('  Identity:     ✓ machine fingerprint matches (not a copied session)');
+    }
+    else if (verdict.state === 'adopt') {
+        console.log('  Identity:     — no fingerprint yet (pre-7.0.3 session; adopted on next sync)');
+    }
+    else {
+        console.log('  Identity:     ⚠ FINGERPRINT MISMATCH — this session looks COPIED');
+        console.log(`                  stored ${verdict.stored.slice(0, 12)}… vs this machine ${verdict.current.slice(0, 12)}…`);
+        console.log('                  device_id collision → cross-device pull returns 0 silently.');
+        console.log('                  Fix: rm ~/.wyrm/cloud.json ~/.wyrm/cloud-cursor.json (KEEP cloud.key),');
+        console.log('                       then `wyrm cloud login`.  (Or `wyrm cloud sync --force` if intended.)');
+    }
+}
+// ── doctor ────────────────────────────────────────────────────────────────────
+function cmdDoctor() {
+    const s = loadSession();
+    console.log('');
+    console.log('󱅝 Wyrm Cloud — device identity doctor');
+    console.log('');
+    if (!s) {
+        console.log('  Not logged in. Run `wyrm cloud login`.');
+        console.log('');
+        return;
+    }
+    console.log(`  Account:      ${s.email ?? s.account_id.slice(0, 8) + '…'}`);
+    console.log(`  Device ID:    ${s.device_id ? s.device_id.slice(0, 8) + '…' : '(none — re-run `wyrm cloud login`)'}`);
+    console.log(`  Server:       ${s.base}`);
+    console.log(`  Stored fp:    ${s.machine_fp ? s.machine_fp.slice(0, 12) + '…' : '(none — pre-7.0.3 session)'}`);
+    console.log(`  This box fp:  ${computeMachineFp().slice(0, 12)}…`);
+    printIdentityHealth(s);
+    console.log('');
+    console.log('  Only ~/.wyrm/cloud.key is meant to be shared across your machines.');
+    console.log('  cloud.json + cloud-cursor.json + machine-id are per-device.');
+    console.log('');
+}
 // ── devices ─────────────────────────────────────────────────────────────────
 async function cmdDevices(args) {
     const action = args[0];
@@ -363,6 +423,7 @@ async function cmdSync(args) {
     requireCloudLicense();
     const dryRun = args.includes('--dry-run');
     const all = args.includes('--all');
+    const force = args.includes('--force');
     if (!keyExists()) {
         console.error('⚠ Encryption key not found at', keyFilePath());
         console.error('  A new key will be generated, but it will NOT decrypt deltas');
@@ -376,7 +437,7 @@ async function cmdSync(args) {
         console.log('   Skipped: per-device logs, FTS shadows, sync internals.');
         console.log('');
     }
-    const result = await runSync({ dryRun, all });
+    const result = await runSync({ dryRun, all, force });
     console.log('');
     console.log('󱅝 Sync complete');
     console.log('');