scrybe-cli 0.5.0__tar.gz → 0.6.1__tar.gz

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/Cargo.lock

@@ -3906,7 +3906,7 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "scrybe-app"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "dirs 5.0.1",
@@ -3916,6 +3916,7 @@ dependencies = [
  "scrybe-mcp-server",
  "scrybe-render",
  "scrybe-rpc",
+ "scrybe-tools",
  "scrybe-vcs",
  "serde",
  "serde_json",
@@ -3933,11 +3934,10 @@ dependencies = [
 
 [[package]]
 name = "scrybe-cli"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "clap",
- "hex",
  "scrybe-core",
  "scrybe-mcp-server",
  "scrybe-mermaid",
@@ -3946,14 +3946,13 @@ dependencies = [
  "scrybe-tools",
  "serde",
  "serde_json",
- "sha2",
  "tracing",
  "tracing-subscriber",
 ]
 
 [[package]]
 name = "scrybe-core"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "blake3",
@@ -3970,7 +3969,7 @@ dependencies = [
 
 [[package]]
 name = "scrybe-mcp-client"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "dirs 5.0.1",
@@ -3985,7 +3984,7 @@ dependencies = [
 
 [[package]]
 name = "scrybe-mcp-server"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "clap",
@@ -4001,12 +4000,11 @@ dependencies = [
  "tokio",
  "tracing",
  "tracing-subscriber",
- "which",
 ]
 
 [[package]]
 name = "scrybe-mermaid"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -4023,7 +4021,7 @@ dependencies = [
 
 [[package]]
 name = "scrybe-mermaid-render"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "hex",
@@ -4033,7 +4031,7 @@ dependencies = [
 
 [[package]]
 name = "scrybe-py"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "pyo3",
@@ -4045,9 +4043,17 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "scrybe-ratatui"
+version = "0.6.1"
+dependencies = [
+ "ratatui",
+ "scrybe-core",
+]
+
 [[package]]
 name = "scrybe-render"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "pulldown-cmark",
@@ -4060,7 +4066,7 @@ dependencies = [
 
 [[package]]
 name = "scrybe-rpc"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "serde",
  "serde_json",
@@ -4069,8 +4075,9 @@ dependencies = [
 
 [[package]]
 name = "scrybe-tools"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
+ "anyhow",
  "scrybe-core",
  "scrybe-mermaid",
  "scrybe-mermaid-render",
@@ -4078,24 +4085,27 @@ dependencies = [
  "scrybe-rpc",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.18",
  "uuid",
+ "which",
 ]
 
 [[package]]
 name = "scrybe-tui"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "clap",
  "crossterm",
  "ratatui",
  "scrybe-core",
+ "scrybe-ratatui",
 ]
 
 [[package]]
 name = "scrybe-vcs"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "anyhow",
  "chrono",

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/Cargo.toml

@@ -6,7 +6,7 @@ members = ["scrybe-core", "scrybe-render", "scrybe-mcp-server", "scrybe-mermaid"
 # `version.workspace = true`, so a release bumps all crates in lock-step
 # from one place. (See RELEASE.md; issue #128.)
 [workspace.package]
-version = "0.5.0"
+version = "0.6.1"
 
 # Workspace-level dependency pins keep all crates in lock-step.
 [workspace.dependencies]
@@ -60,16 +60,17 @@ tauri-build = { version = "2", features = [] }
 # Internal crates — version pinned (=) so cargo publish accepts the
 # tarballs (path-deps without versions are rejected at publish time).
 # Workspace lock-step: every release bumps all members together.
-scrybe-core       = { path = "scrybe-core",       version = "=0.5.0" }
-scrybe-render     = { path = "scrybe-render",     version = "=0.5.0" }
-scrybe-mcp-client = { path = "scrybe-mcp-client", version = "=0.5.0" }
-scrybe-mcp-server = { path = "scrybe-mcp-server", version = "=0.5.0" }
-scrybe-mermaid    = { path = "scrybe-mermaid",    version = "=0.5.0" }
-scrybe-vcs        = { path = "scrybe-vcs",        version = "=0.5.0" }
-scrybe-py         = { path = "scrybe-py",         version = "=0.5.0" }
-scrybe-rpc        = { path = "scrybe-rpc",        version = "=0.5.0" }
-scrybe-tools      = { path = "scrybe-tools",      version = "=0.5.0" }
-scrybe-mermaid-render = { path = "scrybe-mermaid-render", version = "=0.5.0" }
+scrybe-core       = { path = "scrybe-core",       version = "=0.6.1" }
+scrybe-render     = { path = "scrybe-render",     version = "=0.6.1" }
+scrybe-mcp-client = { path = "scrybe-mcp-client", version = "=0.6.1" }
+scrybe-mcp-server = { path = "scrybe-mcp-server", version = "=0.6.1" }
+scrybe-mermaid    = { path = "scrybe-mermaid",    version = "=0.6.1" }
+scrybe-vcs        = { path = "scrybe-vcs",        version = "=0.6.1" }
+scrybe-py         = { path = "scrybe-py",         version = "=0.6.1" }
+scrybe-rpc        = { path = "scrybe-rpc",        version = "=0.6.1" }
+scrybe-tools      = { path = "scrybe-tools",      version = "=0.6.1" }
+scrybe-ratatui    = { path = "scrybe-ratatui",    version = "=0.6.1" }
+scrybe-mermaid-render = { path = "scrybe-mermaid-render", version = "=0.6.1" }
 
 # Adopted pure-Rust Mermaid → SVG renderer (#132 spike-Pass, 2026-07-17).
 # SVG-only by default here; the `png` feature (resvg) is opted into per-crate.

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scrybe-cli
-Version: 0.5.0
+Version: 0.6.1
 Summary: Scrybe CLI — headless Markdown render/lint/mermaid tool (binary wheel)
 Home-Page: https://github.com/hartsock/scrybe
 License: Apache-2.0
@@ -39,8 +39,8 @@ also the launcher for the Tauri GUI app: `scrybe file.md` locates the
 | `scrybe render [FILE]` | Render Markdown to HTML (stdin → stdout by default); `--theme`, `--full-html`, `--output` |
 | `scrybe lint FILE` | Word count, headings, code blocks, broken links; `--json` for machine output; exits 1 if broken links found |
 | `scrybe mermaid embed PNG SOURCE` | Embed Mermaid source into PNG iTXt chunk |
-| `scrybe mermaid extract PNG` | Print embedded Mermaid source |
-| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered |
+| `scrybe mermaid extract PNG` | Print embedded Mermaid source, verifying its SHA-256 by default; exit 2 if tampered, `--unverified` to skip the check (forensics) |
+| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered or digest missing |
 | `scrybe open [PATH]` | Launch the Scrybe GUI, optionally at a file or directory |
 | `scrybe version` | Print version and active feature flags |
 | `scrybe [PATH]` | Bare invocation with a path injects `open` automatically |

{scrybe_cli-0.5.0/scrybe-cli → scrybe_cli-0.6.1}/README.md

@@ -29,8 +29,8 @@ also the launcher for the Tauri GUI app: `scrybe file.md` locates the
 | `scrybe render [FILE]` | Render Markdown to HTML (stdin → stdout by default); `--theme`, `--full-html`, `--output` |
 | `scrybe lint FILE` | Word count, headings, code blocks, broken links; `--json` for machine output; exits 1 if broken links found |
 | `scrybe mermaid embed PNG SOURCE` | Embed Mermaid source into PNG iTXt chunk |
-| `scrybe mermaid extract PNG` | Print embedded Mermaid source |
-| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered |
+| `scrybe mermaid extract PNG` | Print embedded Mermaid source, verifying its SHA-256 by default; exit 2 if tampered, `--unverified` to skip the check (forensics) |
+| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered or digest missing |
 | `scrybe open [PATH]` | Launch the Scrybe GUI, optionally at a file or directory |
 | `scrybe version` | Print version and active feature flags |
 | `scrybe [PATH]` | Bare invocation with a path injects `open` automatically |

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "scrybe-cli"
-version = "0.5.0"
+version = "0.6.1"
 description = "Scrybe CLI — headless Markdown render/lint/mermaid tool (binary wheel)"
 license = {text = "Apache-2.0"}
 readme = "README.md"

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/python/scrybe_cli/__init__.py

@@ -4,7 +4,7 @@ This package installs the `scrybe` command on your PATH, providing
 render, lint, mermaid embed/extract, and the GUI integration RPC client.
 
 For programmatic Python library access (Document, render_markdown,
-ContentId, etc.), install scrybe-py:
+ContentDigest, etc.), install scrybe-py:
 
     pip install scrybe-py
     >>> import scrybe
@@ -30,7 +30,12 @@ except ImportError:
 # Soft dependency on scrybe-py: re-export when present so users can drive
 # the Rust library directly without juggling two imports.
 try:
-    from scrybe import ContentId, Document, render_markdown  # type: ignore[import-not-found]
+    from scrybe import (  # type: ignore[import-not-found]
+        ContentDigest,
+        ContentId,  # deprecated alias for ContentDigest
+        Document,
+        render_markdown,
+    )
 
     _SCRYBE_LIB_AVAILABLE = True
 except ImportError:
@@ -52,12 +57,14 @@ except ImportError:
         def __call__(self, *args: object, **kwargs: object) -> None:
             raise ImportError(f"{self._name}: {_MISSING_MSG}")
 
+    ContentDigest = _Missing("ContentDigest")  # type: ignore[assignment,misc]
     ContentId = _Missing("ContentId")  # type: ignore[assignment,misc]
     Document = _Missing("Document")  # type: ignore[assignment,misc]
     render_markdown = _Missing("render_markdown")  # type: ignore[assignment]
 
 
 __all__ = [
+    "ContentDigest",
     "ContentId",
     "Document",
     "render_markdown",

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/scrybe-cli/Cargo.toml

@@ -28,8 +28,6 @@ scrybe-tools.workspace = true
 anyhow.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-sha2.workspace = true
-hex.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
 clap.workspace = true

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1/scrybe-cli}/README.md

@@ -29,8 +29,8 @@ also the launcher for the Tauri GUI app: `scrybe file.md` locates the
 | `scrybe render [FILE]` | Render Markdown to HTML (stdin → stdout by default); `--theme`, `--full-html`, `--output` |
 | `scrybe lint FILE` | Word count, headings, code blocks, broken links; `--json` for machine output; exits 1 if broken links found |
 | `scrybe mermaid embed PNG SOURCE` | Embed Mermaid source into PNG iTXt chunk |
-| `scrybe mermaid extract PNG` | Print embedded Mermaid source |
-| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered |
+| `scrybe mermaid extract PNG` | Print embedded Mermaid source, verifying its SHA-256 by default; exit 2 if tampered, `--unverified` to skip the check (forensics) |
+| `scrybe mermaid verify PNG` | Verify SHA-256 integrity of embedded source; exits 1 if tampered or digest missing |
 | `scrybe open [PATH]` | Launch the Scrybe GUI, optionally at a file or directory |
 | `scrybe version` | Print version and active feature flags |
 | `scrybe [PATH]` | Bare invocation with a path injects `open` automatically |

{scrybe_cli-0.5.0 → scrybe_cli-0.6.1}/scrybe-cli/src/main.rs

@@ -288,10 +288,17 @@ enum Command {
 
     /// Extract Mermaid source from a PNG iTXt metadata chunk.
     ///
-    /// Top-level shortcut for `scrybe mermaid extract`. Same args.
+    /// Top-level shortcut for `scrybe mermaid extract`. Same args and exit
+    /// codes: 0 = success, 1 = extraction failed (no payload / unreadable
+    /// PNG), 2 = verification failed (stored sha256 does not match the
+    /// extracted source).
     Extract {
         #[arg(value_name = "PNG")]
         png: std::path::PathBuf,
+        /// Skip digest verification and print the raw stored source
+        /// (forensics on tampered payloads).
+        #[arg(long)]
+        unverified: bool,
     },
 
     /// Print version and active feature flags.
@@ -309,10 +316,21 @@ enum MermaidCmd {
         #[arg(short, long)]
         out: Option<std::path::PathBuf>,
     },
-    /// Extract Mermaid source from a PNG.
+    /// Extract Mermaid source from a PNG, verifying its sha256 by default.
+    ///
+    /// The stored digest is checked against a freshly-computed hash of the
+    /// extracted source. Exit codes: 0 = success (a payload with no stored
+    /// digest prints a note to stderr), 1 = extraction failed (no payload /
+    /// unreadable PNG), 2 = verification failed (tampered — stored sha256
+    /// does not match the extracted source). Use --unverified to skip the
+    /// check and print the raw stored source for forensics.
     Extract {
         #[arg(value_name = "PNG")]
         png: std::path::PathBuf,
+        /// Skip digest verification and print the raw stored source
+        /// (forensics on tampered payloads).
+        #[arg(long)]
+        unverified: bool,
     },
     /// Verify the sha256 integrity of the embedded Mermaid source in a PNG.
     ///
@@ -336,6 +354,20 @@ enum MermaidCmd {
         #[arg(short, long, value_name = "OUT")]
         out: std::path::PathBuf,
     },
+    /// Export every Mermaid diagram in a document to sibling PNG figures.
+    ///
+    /// For `foo.md`, writes `foo_fig_01.png`, `foo_fig_02.png`, … next to the
+    /// document in document order; each PNG embeds its Mermaid source (uuid +
+    /// sha256) so it round-trips via `scrybe mermaid extract`. Pure-Rust
+    /// rendering (no `mmdc`) via the shared `export_figures` tool.
+    Export {
+        /// Markdown document whose Mermaid diagrams to export.
+        #[arg(value_name = "FILE")]
+        input: std::path::PathBuf,
+        /// Output JSON (`{count, figures}`) instead of one path per line.
+        #[arg(long)]
+        json: bool,
+    },
 }
 
 /// Known subcommand names. Anything else in argv[1] is treated as a path to open.
@@ -443,12 +475,12 @@ fn main() -> anyhow::Result<()> {
                 for bl in &report.broken_links {
                     eprintln!("  - [{}]({})", bl.text, bl.url);
                 }
-                // Also print content-id.
+                // Also print the content digest.
                 eprintln!(
-                    "{:<30} {} (CID {})",
+                    "{:<30} {} (digest {})",
                     "File:",
                     input.display(),
-                    doc.content_id()
+                    doc.content_digest()
                 );
             }
 
@@ -465,35 +497,42 @@ fn main() -> anyhow::Result<()> {
                 std::fs::write(&dest, &embedded)?;
                 println!("Embedded into {}", dest.display());
             }
-            MermaidCmd::Extract { png } => {
-                let bytes = std::fs::read(&png)?;
-                let payload = scrybe_mermaid::extract(&bytes)?;
-                println!("{}", payload.source);
+            MermaidCmd::Extract { png, unverified } => {
+                run_mermaid_extract(&png, unverified)?;
             }
             MermaidCmd::Verify { png } => {
                 let bytes = std::fs::read(&png)?;
+                // `extract` verifies by default — a mismatch is a typed error.
                 match scrybe_mermaid::extract(&bytes) {
-                    Err(e) => {
-                        eprintln!("scrybe mermaid verify: failed to extract payload: {e}");
-                        std::process::exit(1);
-                    }
-                    Ok(payload) => {
-                        // Recompute the sha256 of the extracted source.
-                        use sha2::{Digest, Sha256};
-                        let mut hasher = Sha256::new();
-                        hasher.update(payload.source.as_bytes());
-                        let computed = hex::encode(hasher.finalize());
-
-                        if computed == payload.sha256 {
-                            println!("OK — sha256 {} matches embedded source", &computed[..16]);
-                        } else {
+                    Ok(payload) => match &payload.verification {
+                        scrybe_mermaid::VerificationStatus::Verified { digest, .. } => {
+                            println!(
+                                "OK — sha256 {} matches embedded source",
+                                digest_short(digest)
+                            );
+                        }
+                        scrybe_mermaid::VerificationStatus::NoDigest => {
                             eprintln!(
-                                "TAMPERED — stored sha256 {} does not match computed {}",
-                                &payload.sha256[..16],
-                                &computed[..16]
+                                "MISSING — payload carries no sha256 digest; nothing to verify"
                             );
                             std::process::exit(1);
                         }
+                    },
+                    Err(scrybe_mermaid::MermaidError::VerificationFailed {
+                        expected,
+                        actual,
+                        ..
+                    }) => {
+                        eprintln!(
+                            "TAMPERED — stored sha256 {} does not match computed {}",
+                            digest_short(&expected),
+                            digest_short(&actual)
+                        );
+                        std::process::exit(1);
+                    }
+                    Err(e) => {
+                        eprintln!("scrybe mermaid verify: failed to extract payload: {e}");
+                        std::process::exit(1);
                     }
                 }
             }
@@ -517,6 +556,28 @@ fn main() -> anyhow::Result<()> {
                 println!("  uuid   {}", d["uuid"].as_str().unwrap_or(""));
                 println!("  sha256 {}", d["sha256"].as_str().unwrap_or(""));
             }
+            MermaidCmd::Export { input, json } => {
+                let reg = scrybe_tools::Registry::default();
+                let outcome = reg.call(
+                    "export_figures",
+                    &scrybe_tools::Ctx::headless(),
+                    &serde_json::json!({ "path": input.to_string_lossy() }),
+                )?;
+                if let Some(err) = outcome.tool_error {
+                    eprintln!("scrybe mermaid export: {}", err.message);
+                    std::process::exit(1);
+                }
+                let d = &outcome.data;
+                if json {
+                    println!("{}", serde_json::to_string_pretty(d)?);
+                } else {
+                    let figures = d["figures"].as_array().cloned().unwrap_or_default();
+                    for f in &figures {
+                        println!("{}", f["path"].as_str().unwrap_or(""));
+                    }
+                    println!("{} figure(s)", d["count"].as_u64().unwrap_or(0));
+                }
+            }
         },
 
         Command::Open { path } => match path {
@@ -526,13 +587,11 @@ fn main() -> anyhow::Result<()> {
                 // the "one tab, one file, refresh on re-open" semantics.
                 match rpc_client::send("open", serde_json::json!({"path": canon.to_string_lossy()}))
                 {
-                    Ok(resp) => match resp.error {
-                        None => println!("Opening {} in Scrybe", canon.display()),
-                        Some(e) => {
-                            anyhow::bail!("scrybe open failed: {} ({})", e.message, e.code)
-                        }
-                    },
-                    Err(e) if e.contains("no Scrybe running") => {
+                    Ok(_) => println!("Opening {} in Scrybe", canon.display()),
+                    Err(scrybe_rpc::ClientError::Remote(e)) => {
+                        anyhow::bail!("scrybe open failed: {} ({})", e.message, e.code)
+                    }
+                    Err(e) if e.is_not_running() => {
                         // Fall through to launching the app.
                         launch_scrybe(Some(&canon)).map_err(|e| anyhow::anyhow!("{e}"))?;
                         println!("Opening {} in Scrybe", canon.display());
@@ -552,28 +611,23 @@ fn main() -> anyhow::Result<()> {
         Command::Save { path } => {
             let canon = path.canonicalize().unwrap_or_else(|_| path.clone());
             match rpc_client::send("save", serde_json::json!({"path": canon.to_string_lossy()})) {
-                Ok(resp) => match resp.error {
-                    // Reply-correlated save reports { path, bytes, was_dirty };
-                    // an older app replies the legacy {applied} ack with no
-                    // byte count — don't fabricate one.
-                    None => {
-                        let bytes = resp
-                            .result
-                            .as_ref()
-                            .and_then(|r| r.get("bytes"))
-                            .and_then(serde_json::Value::as_u64);
-                        match bytes {
-                            Some(b) => println!("Saved {} ({b} bytes)", canon.display()),
-                            None => println!("Saved {}", canon.display()),
-                        }
-                    }
-                    // Not open: silent no-op per the documented CLI contract.
-                    Some(e) if e.code == scrybe_rpc::ERR_TAB_NOT_OPEN => {}
-                    Some(e) => {
-                        anyhow::bail!("scrybe save failed: {} ({})", e.message, e.code)
+                // Reply-correlated save reports { path, bytes, was_dirty };
+                // an older app replies the legacy {applied} ack with no
+                // byte count — don't fabricate one.
+                Ok(result) => {
+                    let bytes = result.get("bytes").and_then(serde_json::Value::as_u64);
+                    match bytes {
+                        Some(b) => println!("Saved {} ({b} bytes)", canon.display()),
+                        None => println!("Saved {}", canon.display()),
                     }
-                },
-                Err(e) if e.contains("no Scrybe running") => {
+                }
+                // Not open: silent no-op per the documented CLI contract.
+                Err(scrybe_rpc::ClientError::Remote(e))
+                    if e.code == scrybe_rpc::ERR_TAB_NOT_OPEN => {}
+                Err(scrybe_rpc::ClientError::Remote(e)) => {
+                    anyhow::bail!("scrybe save failed: {} ({})", e.message, e.code)
+                }
+                Err(e) if e.is_not_running() => {
                     // Silent no-op per design: nothing open, nothing to save.
                 }
                 Err(e) => anyhow::bail!("scrybe save failed: {e}"),
@@ -586,13 +640,11 @@ fn main() -> anyhow::Result<()> {
                 "close",
                 serde_json::json!({"path": canon.to_string_lossy()}),
             ) {
-                Ok(resp) => match resp.error {
-                    None => println!("Closed {}", canon.display()),
-                    Some(e) => {
-                        anyhow::bail!("scrybe close failed: {} ({})", e.message, e.code)
-                    }
-                },
-                Err(e) if e.contains("no Scrybe running") => {
+                Ok(_) => println!("Closed {}", canon.display()),
+                Err(scrybe_rpc::ClientError::Remote(e)) => {
+                    anyhow::bail!("scrybe close failed: {} ({})", e.message, e.code)
+                }
+                Err(e) if e.is_not_running() => {
                     // Silent no-op.
                 }
                 Err(e) => anyhow::bail!("scrybe close failed: {e}"),
@@ -646,13 +698,11 @@ fn main() -> anyhow::Result<()> {
         }
         Command::Quit { force } => {
             match rpc_client::send("quit", serde_json::json!({"force": force})) {
-                Ok(resp) => match resp.error {
-                    None => println!("Quitting Scrybe"),
-                    Some(e) => {
-                        anyhow::bail!("scrybe quit failed: {} ({})", e.message, e.code)
-                    }
-                },
-                Err(e) if e.contains("no Scrybe running") => {
+                Ok(_) => println!("Quitting Scrybe"),
+                Err(scrybe_rpc::ClientError::Remote(e)) => {
+                    anyhow::bail!("scrybe quit failed: {} ({})", e.message, e.code)
+                }
+                Err(e) if e.is_not_running() => {
                     // Silent no-op.
                 }
                 Err(e) => anyhow::bail!("scrybe quit failed: {e}"),
@@ -687,11 +737,9 @@ fn main() -> anyhow::Result<()> {
             std::fs::write(&dest, &embedded)?;
             println!("Embedded into {}", dest.display());
         }
-        Command::Extract { png } => {
+        Command::Extract { png, unverified } => {
             // Top-level alias for `mermaid extract` — same code path.
-            let bytes = std::fs::read(&png)?;
-            let payload = scrybe_mermaid::extract(&bytes)?;
-            println!("{}", payload.source);
+            run_mermaid_extract(&png, unverified)?;
         }
 
         Command::Version => {
@@ -702,6 +750,49 @@ fn main() -> anyhow::Result<()> {
     Ok(())
 }
 
+// ---------------------------------------------------------------------------
+// Mermaid extract handler (shared by `mermaid extract` and top-level `extract`)
+// ---------------------------------------------------------------------------
+
+/// First 16 hex chars of a digest for display — safe on short or garbage
+/// stored values (attacker-controlled input must never panic the CLI).
+fn digest_short(d: &str) -> &str {
+    d.get(..16).unwrap_or(d)
+}
+
+/// Extract embedded Mermaid source from `png` and print it.
+///
+/// Verifies the stored sha256 against the extracted source by default.
+/// Exit codes: 0 = success (no-digest payloads print a stderr note),
+/// 1 = extraction failure (no payload / unreadable PNG, via the returned
+/// error), 2 = verification failure (tampered).
+fn run_mermaid_extract(png: &std::path::Path, unverified: bool) -> anyhow::Result<()> {
+    let bytes = std::fs::read(png)?;
+
+    if unverified {
+        // Forensics path: raw stored fields, no digest check.
+        let payload = scrybe_mermaid::extract_unverified(&bytes)?;
+        println!("{}", payload.source);
+        return Ok(());
+    }
+
+    match scrybe_mermaid::extract(&bytes) {
+        Ok(payload) => {
+            if !payload.is_verified() {
+                eprintln!("note: payload carries no sha256 digest — source is unverified");
+            }
+            println!("{}", payload.source);
+            Ok(())
+        }
+        Err(e @ scrybe_mermaid::MermaidError::VerificationFailed { .. }) => {
+            eprintln!("scrybe mermaid extract: {e}");
+            eprintln!("(use --unverified to print the stored source anyway)");
+            std::process::exit(2);
+        }
+        Err(e) => Err(e.into()),
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Phase 2 read-side handlers
 // ---------------------------------------------------------------------------
@@ -711,13 +802,15 @@ fn require_running_gui<F: FnOnce(serde_json::Value) -> anyhow::Result<()>>(
     params: serde_json::Value,
     on_ok: F,
 ) -> anyhow::Result<()> {
+    // The client types every failure (A3): in-band app errors are `Remote`,
+    // no-app is `is_not_running()`, and malformed replies arrive pre-typed
+    // (envelope/frame/JSON violations) — no message-text matching anywhere.
     match rpc_client::send(method, params) {
-        Ok(resp) => match (resp.result, resp.error) {
-            (Some(r), None) => on_ok(r),
-            (None, Some(e)) => anyhow::bail!("scrybe {method}: {} ({})", e.message, e.code),
-            _ => anyhow::bail!("scrybe {method}: malformed response"),
-        },
-        Err(e) if e.contains("no Scrybe running") => {
+        Ok(result) => on_ok(result),
+        Err(scrybe_rpc::ClientError::Remote(e)) => {
+            anyhow::bail!("scrybe {method}: {} ({})", e.message, e.code)
+        }
+        Err(e) if e.is_not_running() => {
             anyhow::bail!(
                 "scrybe {method}: no Scrybe running — start the app first, or open the file with `scrybe <path>`"
             )