@0dai-dev/cli 3.10.0 → 4.0.0

package/bin/0dai.js

@@ -1,2153 +1,37 @@
 #!/usr/bin/env node
 "use strict";
 
-const https = require("https");
-const http = require("http");
-const fs = require("fs");
-const path = require("path");
-const os = require("os");
-
-const VERSION = require("../package.json").version;
-
-// CRITICAL: validate API_URL to prevent credential exfiltration to attacker hosts
-function _validateApiUrl(url) {
-  const DEFAULT = "https://api.0dai.dev";
-  if (!url) return DEFAULT;
-  try {
-    const u = new URL(url);
-    // Only allow https (or http for localhost during dev)
-    if (u.protocol === "https:") return url;
-    if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1")) {
-      return url;
-    }
-    console.error(`[0dai] warning: ODAI_API_URL must use https (or http://localhost). Got: ${u.protocol}//${u.hostname}. Ignoring.`);
-    return DEFAULT;
-  } catch {
-    console.error(`[0dai] warning: ODAI_API_URL is not a valid URL, ignoring`);
-    return DEFAULT;
-  }
-}
-const API_URL = _validateApiUrl(process.env.ODAI_API_URL);
-const T = process.stdout.isTTY ? "\x1b[38;2;45;212;168m" : ""; // teal
-const R = process.stdout.isTTY ? "\x1b[0m" : ""; // reset
-const D = process.stdout.isTTY ? "\x1b[2m" : ""; // dim
-const log = (msg) => console.log(`${T}[0dai]${R} ${msg}`);
-const CONFIG_DIR = path.join(os.homedir(), ".0dai");
-const AUTH_FILE = path.join(CONFIG_DIR, "auth.json");
-const VERSION_CHECK_FILE = path.join(CONFIG_DIR, ".version_check");
-const PROJECTS_FILE = path.join(CONFIG_DIR, "projects.json");
-
-const MANIFEST_FILES = [
-  // Node ecosystem
-  "package.json", "tsconfig.json",
-  "next.config.js", "next.config.mjs", "next.config.ts",
-  "vite.config.js", "vite.config.ts", "vite.config.mjs",
-  "vue.config.js", "nuxt.config.js", "nuxt.config.ts",
-  "svelte.config.js", "astro.config.mjs", "astro.config.ts",
-  "remix.config.js", "angular.json",
-  // Other languages
-  "go.mod", "pyproject.toml", "requirements.txt", "setup.py",
-  "pubspec.yaml", "Cargo.toml", "pom.xml", "build.gradle",
-  "Gemfile", "composer.json",
-  // Build/deploy
-  "Makefile", "docker-compose.yml", "Dockerfile",
-  "pnpm-workspace.yaml", "lerna.json", "turbo.json", "nx.json",
-];
-
-const PROBE_DIRS = [
-  "src", "lib", "app", "apps", "packages", "services",
-  "cmd", "internal", "web", "frontend", "backend",
-  "tests", "test", "spec", "__tests__",
-  "infra", "deploy", "docker", ".github",
-  "android", "ios", "linux", "macos", "windows",
-];
-
-// Single source of truth for all supported agent CLIs.
-// Adding a new CLI here automatically wires detection, doctor, validate,
-// and update — no other changes needed in this file. Keep in sync with
-// bootstrap/common.sh's detect_available_clis() and scripts/swarm.py's
-// AGENT_STRENGTHS dict (those are the bash + python equivalents).
-//
-// Fields:
-//   name        logical name used in discovery.json + swarm
-//   bin         actual binary name in $PATH (only differs from name for qoder)
-//   pkg         package name for install/update (null = no auto-update)
-//   pkgType     "npm" | "pip" | "go" — drives update install command
-//   install     human-readable install hint shown in doctor output
-//   altAuth     optional alternative auth hint (subscription, etc.)
-//   agentFiles  files that must exist when this CLI is selected (cmdValidate)
-const SUPPORTED_CLIS = [
-  {
-    name: "claude", bin: "claude",
-    pkg: "@anthropic-ai/claude-code", pkgType: "npm",
-    install: "npm i -g @anthropic-ai/claude-code",
-    altAuth: "Pro/Team subscription",
-    agentFiles: [".claude/settings.json", ".claude/CLAUDE.md", ".mcp.json"],
-  },
-  {
-    name: "codex", bin: "codex",
-    pkg: "@openai/codex", pkgType: "npm",
-    install: "npm i -g @openai/codex",
-    altAuth: "ChatGPT Pro subscription",
-    agentFiles: ["AGENTS.md", ".codex/config.toml"],
-  },
-  {
-    name: "opencode", bin: "opencode",
-    pkg: null, pkgType: "go",
-    install: "go install github.com/nichochar/opencode@latest",
-    altAuth: null,
-    agentFiles: ["opencode.json"],
-  },
-  {
-    name: "gemini", bin: "gemini",
-    pkg: "@google/gemini-cli", pkgType: "npm",
-    install: "npm i -g @google/gemini-cli",
-    altAuth: null,
-    agentFiles: null,
-  },
-  {
-    name: "aider", bin: "aider",
-    pkg: "aider-chat", pkgType: "pip",
-    install: "pip install aider-chat",
-    altAuth: null,
-    agentFiles: null,
-  },
-  {
-    name: "qoder", bin: "qodercli",
-    pkg: "@qoder-ai/qodercli", pkgType: "npm",
-    install: "npm i -g @qoder-ai/qodercli",
-    altAuth: null,
-    agentFiles: [".qoder/settings.json"],
-  },
-];
-
-function deviceFingerprint() {
-  const crypto = require("crypto");
-  const parts = [
-    os.hostname(),
-    os.userInfo().username,
-    os.platform(),
-    os.arch(),
-    os.cpus().length.toString(),
-    os.totalmem().toString(),
-  ];
-  // Try machine-id
-  try {
-    if (os.platform() === "linux") parts.push(fs.readFileSync("/etc/machine-id", "utf8").trim());
-    else if (os.platform() === "darwin") {
-      const { execSync } = require("child_process");
-      parts.push(execSync("ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/'", { encoding: "utf8" }).trim());
-    }
-  } catch {}
-  return crypto.createHash("sha256").update(parts.join(":")).digest("hex").slice(0, 32);
-}
-
-function registerProject(projectPath, name, stack) {
-  try {
-    fs.mkdirSync(CONFIG_DIR, { recursive: true });
-    let projects = [];
-    try { projects = JSON.parse(fs.readFileSync(PROJECTS_FILE, "utf8")).projects || []; } catch {}
-    const abs = path.resolve(projectPath);
-    const idx = projects.findIndex(p => p.path === abs);
-    const entry = { path: abs, name: name || path.basename(abs), stack: stack || "?", last_seen: new Date().toISOString() };
-    if (idx >= 0) projects[idx] = entry;
-    else projects.unshift(entry);
-    fs.writeFileSync(PROJECTS_FILE, JSON.stringify({ projects: projects.slice(0, 50) }, null, 2));
-  } catch {}
-}
-
-function cmdPortfolio() {
-  let projects = [];
-  try { projects = JSON.parse(fs.readFileSync(PROJECTS_FILE, "utf8")).projects || []; } catch {}
-
-  if (!projects.length) {
-    log(`no projects registered yet`);
-    console.log(`  Run ${D}0dai init${R} in a project to start tracking it.`);
-    return;
-  }
-
-  const rows = [];
-  let totalSessions = 0, totalScore = 0, scored = 0;
-
-  for (const p of projects) {
-    if (!fs.existsSync(p.path)) continue;
-
-    let sessions = 0, lastSession = null, agentMap = {};
-    try {
-      const stats = JSON.parse(fs.readFileSync(path.join(p.path, "ai", "feedback", ".usage_stats.json"), "utf8"));
-      sessions = stats.total_sessions || 0;
-      lastSession = stats.last_session || null;
-      agentMap = stats.agents || {};
-    } catch {}
-
-    let name = p.name, stack = p.stack;
-    try {
-      const disc = JSON.parse(fs.readFileSync(path.join(p.path, "ai", "manifest", "discovery.json"), "utf8"));
-      name = disc.project_name || name;
-      stack = disc.stack || stack;
-    } catch {}
-
-    // Effectiveness score (mirrors metrics command)
-    let score = 0;
-    if (sessions > 0) {
-      score += Math.min(sessions * 5, 35);
-      let done = 0;
-      try { done = fs.readdirSync(path.join(p.path, "ai", "swarm", "done")).filter(f => f.endsWith(".json")).length; } catch {}
-      if (done > 0) score += Math.min(done * 6, 30);
-      try {
-        const hasFb = fs.readdirSync(path.join(p.path, "ai", "feedback")).some(f => f.endsWith("-report.json"));
-        if (hasFb) score += 20;
-      } catch {}
-      const layerFiles = ["ai/manifest/discovery.json", "ai/manifest/commands.yaml", "ai/playbooks/quick-start.md"];
-      score += Math.round(layerFiles.filter(f => fs.existsSync(path.join(p.path, f))).length / layerFiles.length * 15);
-    }
-
-    totalSessions += sessions;
-    if (sessions > 0) { totalScore += score; scored++; }
-
-    const agentList = Object.keys(agentMap).join("·") || "—";
-
-    let ago = "never";
-    if (lastSession) {
-      const h = Math.floor((Date.now() - new Date(lastSession).getTime()) / 3600000);
-      const d = Math.floor(h / 24);
-      if (h < 1) ago = "<1h ago";
-      else if (h < 24) ago = `${h}h ago`;
-      else if (d < 7) ago = `${d}d ago`;
-      else ago = `${Math.floor(d / 7)}w ago`;
-    }
-
-    rows.push({ name, stack, score: sessions > 0 ? score : null, sessions, agents: agentList, ago });
-  }
-
-  if (!rows.length) {
-    log("no projects found (paths may have moved)");
-    return;
-  }
-
-  const nameW = Math.min(Math.max(...rows.map(r => r.name.length), 4), 28);
-  const stackW = Math.min(Math.max(...rows.map(r => r.stack.length), 5), 16);
-
-  console.log(`\n  ${T}Portfolio${R} — ${rows.length} project${rows.length === 1 ? "" : "s"}\n`);
-  for (const r of rows) {
-    const nm = r.name.slice(0, nameW).padEnd(nameW);
-    const st = r.stack.slice(0, stackW).padEnd(stackW);
-    const sc = r.score !== null ? `score ${String(r.score).padStart(3)}` : "         ";
-    const se = `${String(r.sessions).padStart(2)} session${r.sessions === 1 ? " " : "s"}`;
-    console.log(`  ${T}${nm}${R}  ${D}${st}${R}  ${sc}  ${se}  ${r.agents.padEnd(14)}  ${D}${r.ago}${R}`);
-  }
-
-  if (totalSessions > 0) {
-    const avg = scored > 0 ? Math.round(totalScore / scored) : 0;
-    const stacks = [...new Set(rows.map(r => r.stack))].length;
-    console.log(`\n  ${D}${"─".repeat(70)}`);
-    console.log(`  Total: ${totalSessions} sessions  ${stacks} stack${stacks === 1 ? "" : "s"}  avg effectiveness: ${avg}${R}\n`);
-  } else {
-    console.log(`\n  ${D}Tip: run '0dai init' in your projects to start tracking sessions.${R}\n`);
-  }
-}
-
-async function cmdRun(goal, target, args = []) {
-  if (!goal) {
-    console.log(`Usage: 0dai run <goal> [--dry-run] [--agent claude|codex|gemini]`);
-    console.log(`  Example: 0dai run "add dark mode to settings page"`);
-    return;
-  }
-
-  const dryRun = args.includes("--dry-run");
-  const agentIdx = args.indexOf("--agent");
-  const agentOverride = agentIdx >= 0 ? args[agentIdx + 1] : null;
-
-  // Read project context
-  let stack = "generic", agents = ["claude"], commands = {};
-  try {
-    const disc = JSON.parse(fs.readFileSync(path.join(target, "ai", "manifest", "discovery.json"), "utf8"));
-    stack = disc.stack || "generic";
-    agents = disc.selected_agents || ["claude"];
-  } catch {}
-
-  if (!dryRun) process.stdout.write(`${T}[0dai]${R} decomposing goal...`);
-  const result = await apiCall("/v1/run", { goal, context: { stack, agents, commands } });
-  if (!dryRun) process.stdout.write("\r" + " ".repeat(40) + "\r");
-
-  if (result.error) { log(`error: ${result.error}`); return; }
-
-  const tasks = result.tasks || [];
-  if (!tasks.length) { log("no tasks returned"); return; }
-
-  console.log(`\n  ${T}Goal:${R} ${goal}`);
-  console.log(`  Decomposed into ${tasks.length} task${tasks.length === 1 ? "" : "s"}:\n`);
-
-  for (let i = 0; i < tasks.length; i++) {
-    const t = tasks[i];
-    const agent = agentOverride || t.assigned_to;
-    console.log(`  ${T}${i + 1}.${R} ${t.title}`);
-    console.log(`     ${D}→ ${agent}  [${t.model_tier}]${t.description ? "  " + t.description : ""}${R}`);
-  }
-
-  if (dryRun) {
-    console.log(`\n  ${D}[dry-run] would create ${tasks.length} task(s) in swarm queue${R}\n`);
-    return;
-  }
-
-  // Create queue entries
-  const queueDir = path.join(target, "ai", "swarm", "queue");
-  try { fs.mkdirSync(queueDir, { recursive: true }); } catch {}
-
-  const created = [];
-  for (const t of tasks) {
-    const ts = Date.now();
-    const rand = Math.random().toString(36).slice(2, 6);
-    const id = `run-${ts}-${rand}`;
-    const entry = {
-      id,
-      title: t.title,
-      description: t.description || "",
-      assigned_to: agentOverride || t.assigned_to,
-      model_tier: t.model_tier,
-      created_by: "run",
-      created_at: new Date().toISOString(),
-      context: { goal },
-    };
-    try {
-      fs.writeFileSync(path.join(queueDir, `${id}.json`), JSON.stringify(entry, null, 2));
-      created.push(id);
-    } catch (e) { log(`warn: could not write task ${id}: ${e.message}`); }
-  }
-
-  console.log(`\n  ${T}✓${R} ${created.length} task${created.length === 1 ? "" : "s"} added to swarm queue`);
-  console.log(`  ${D}Monitor: 0dai watch  |  Queue: 0dai swarm status${R}\n`);
-}
-
-function apiCall(endpoint, data) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(endpoint, API_URL);
-    const mod = url.protocol === "https:" ? https : http;
-    const body = data ? JSON.stringify(data) : null;
-    const headers = { "Content-Type": "application/json", "X-Device-ID": deviceFingerprint(), "X-CLI-Version": VERSION };
-
-    try {
-      const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf8"));
-      const token = auth.api_key || auth.access_token || auth.token;
-      if (token) headers["Authorization"] = `Bearer ${token}`;
-    } catch {}
-
-    const opts = {
-      hostname: url.hostname,
-      port: url.port || (url.protocol === "https:" ? 443 : 80),
-      path: url.pathname,
-      method: body ? "POST" : "GET",
-      headers,
-      timeout: 60000,
-    };
-    if (body) opts.headers["Content-Length"] = Buffer.byteLength(body);
-
-    const req = mod.request(opts, (res) => {
-      let chunks = [];
-      res.on("data", (c) => chunks.push(c));
-      res.on("end", () => {
-        try {
-          resolve(JSON.parse(Buffer.concat(chunks).toString()));
-        } catch {
-          resolve({ error: `HTTP ${res.statusCode}` });
-        }
-      });
-    });
-    req.on("error", (e) => resolve({ error: `${e.message}. Is ${API_URL} reachable?` }));
-    req.on("timeout", () => { req.destroy(); resolve({ error: "timeout" }); });
-    if (body) req.write(body);
-    req.end();
-  });
-}
-
-function collectMetadata(target) {
-  const projectFiles = [];
-  const fileContents = {};
-
-  for (const d of PROBE_DIRS) {
-    try { if (fs.statSync(path.join(target, d)).isDirectory()) projectFiles.push(d + "/"); } catch {}
-  }
-
-  for (const f of MANIFEST_FILES) {
-    const p = path.join(target, f);
-    try {
-      const stat = fs.statSync(p);
-      if (stat.isFile()) {
-        projectFiles.push(f);
-        const content = fs.readFileSync(p, "utf8");
-        if (content.length < 10000) fileContents[f] = content;
-      }
-    } catch {}
-  }
-
-  const clis = [];
-  const { execSync } = require("child_process");
-  for (const cli of SUPPORTED_CLIS) {
-    try {
-      execSync(`command -v ${cli.bin}`, { stdio: "ignore", shell: "/bin/sh", env: process.env });
-      clis.push(cli.name);
-    } catch {}
-  }
-
-  return { projectFiles, fileContents, clis };
-}
-
-// Fields in settings.json that belong to the user, not to 0dai
-const SETTINGS_PRESERVE_FIELDS = ["model", "permissionMode", "effortLevel"];
-
-function mergeSettingsJson(existing, incoming) {
-  try {
-    const base = JSON.parse(incoming);
-    const user = JSON.parse(existing);
-    // Preserve user-owned fields
-    for (const field of SETTINGS_PRESERVE_FIELDS) {
-      if (field in user && user[field] !== base[field]) {
-        base[field] = user[field];
-      }
-    }
-    return JSON.stringify(base, null, 2) + "\n";
-  } catch { return incoming; }
-}
-
-function writeFiles(target, files) {
-  let created = 0, updated = 0, unchanged = 0, merged = 0, skipped = 0;
-  const targetResolved = path.resolve(target);
-  for (const [rel, content] of Object.entries(files)) {
-    // HIGH: path traversal protection — reject absolute paths and `..` escapes
-    if (typeof rel !== "string" || !rel || path.isAbsolute(rel) || rel.split(/[/\\]/).includes("..")) {
-      skipped++;
-      continue;
-    }
-    const p = path.resolve(targetResolved, rel);
-    if (!p.startsWith(targetResolved + path.sep) && p !== targetResolved) {
-      skipped++;
-      continue;
-    }
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-
-    let finalContent = content;
-
-    // Smart merge for specific files
-    if (fs.existsSync(p)) {
-      const existing = fs.readFileSync(p, "utf8");
-      if (existing === content) { unchanged++; continue; }
-
-      if (rel.endsWith("settings.json")) {
-        finalContent = mergeSettingsJson(existing, content);
-        merged++;
-      } else if (rel === "AGENTS.md") {
-        if (existing.includes("managed: false")) {
-          unchanged++; // User owns this file, skip
-          continue;
-        }
-        // Backup existing AGENTS.md before overwrite
-        const backupDir = path.join(target, "ai", ".backups");
-        fs.mkdirSync(backupDir, { recursive: true });
-        fs.writeFileSync(path.join(backupDir, "AGENTS.md.bak"), existing, "utf8");
-        updated++;
-      } else {
-        updated++;
-      }
-    } else {
-      created++;
-    }
-
-    fs.writeFileSync(p, finalContent, "utf8");
-  }
-  const parts = [`${created} created`, `${updated} updated`, `${unchanged} unchanged`];
-  if (merged) parts.push(`${merged} merged`);
-  if (skipped) parts.push(`${skipped} skipped (unsafe path)`);
-  log(parts.join(", "));
-  return created + updated;
-}
-
-async function cmdInit(target, args = []) {
-  const dryRun = args.includes("--dry-run");
-  const minimal = args.includes("--minimal");
-
-  if (fs.existsSync(path.join(target, "ai", "VERSION"))) {
-    const v = fs.readFileSync(path.join(target, "ai", "VERSION"), "utf8").trim();
-    log(`ai/ layer already exists (v${v}). Run '0dai sync' to update.`);
-    return;
-  }
-
-  const isTTY = process.stdout.isTTY;
-  let spinner = null;
-  if (isTTY) {
-    try { spinner = require("@clack/prompts").spinner(); } catch {}
-  }
-
-  const { projectFiles, fileContents, clis } = collectMetadata(target);
-  if (dryRun) log(`${D}dry-run: would generate ai/ layer (${projectFiles.length} files, ${clis.length} CLIs)${R}`);
-  if (spinner) spinner.start(`${dryRun ? "[dry-run] " : ""}Generating ai/ layer (${projectFiles.length} files, ${clis.length} CLIs)...`);
-  else if (!dryRun) log(`sending to API (${projectFiles.length} files, ${clis.length} CLIs)...`);
-  const result = await apiCall("/v1/init", {
-    project_files: projectFiles,
-    file_contents: fileContents,
-    available_clis: clis,
-    dry_run: dryRun,
-    minimal: minimal,
-  });
-
-  if (result.error) {
-    if (result.error.includes("authentication")) {
-      log(`authentication required`);
-      console.log(`  0dai auth is separate from your agent CLIs (Claude Code, Codex).`);
-      console.log(`  It tracks projects, usage limits, and team features.\n`);
-      console.log(`  ${D}Run: 0dai auth login${R}`);
-    } else if (result.hint) {
-      log(`${result.message || result.error}`);
-      console.log(`  ${result.hint}\n`);
-    } else {
-      log(`error: ${result.error}`);
-    }
-    process.exit(1);
-  }
-
-  if (spinner) spinner.stop(`${dryRun ? "[dry-run] " : ""}Detected: ${result.stack || "?"}`);
-  else log(`detected: ${result.stack || "?"}`);
-  if (dryRun) {
-    const files = Object.keys(result.files || {});
-    log(`${D}dry-run: would write ${files.length} files:${R}`);
-    for (const f of files.slice(0, 20)) console.log(`  ${D}+ ${f}${R}`);
-    if (files.length > 20) console.log(`  ${D}… and ${files.length - 20} more${R}`);
-    return;
-  }
-  writeFiles(target, result.files || {});
-
-  // Ensure ai/VERSION matches CLI version
-  const versionFile = path.join(target, "ai", "VERSION");
-  fs.mkdirSync(path.dirname(versionFile), { recursive: true });
-  fs.writeFileSync(versionFile, VERSION + "\n", "utf8");
-
-  // Add to .gitignore
-  const gi = path.join(target, ".gitignore");
-  try {
-    const text = fs.existsSync(gi) ? fs.readFileSync(gi, "utf8") : "";
-    if (!text.includes(".0dai")) fs.appendFileSync(gi, "\n.0dai/\n");
-  } catch {}
-
-  // Register in global portfolio
-  registerProject(target, path.basename(target), result.stack);
-
-  log(`initialized (${result.file_count || "?"} files)`);
-  console.log("  skills: /build /review /status /feedback /bugfix /delegate");
-
-  // Detect agent auth status for smart onboarding hints
-  const { execFileSync: _ef } = require("child_process");
-  const agents = [];
-  try { _ef("claude", ["--version"], { timeout: 8000 }); agents.push("claude"); } catch {}
-  try { _ef("codex", ["--version"], { timeout: 8000 }); agents.push("codex"); } catch {}
-  try { _ef("gemini", ["--version"], { timeout: 8000 }); agents.push("gemini"); } catch {}
-
-  // Next steps — guide user to first value
-  console.log(`\n  ${T}Next steps:${R}`);
-  console.log(`  ${D}1.${R} Check health:  ${D}0dai doctor${R}`);
-  if (agents.length > 0) {
-    const a = agents[0];
-    console.log(`  ${D}2.${R} Try delegation: ${D}0dai run "write tests for auth"${R}`);
-    console.log(`     ${D}(${agents.join(", ")} detected — delegation will use ${a} by default)${R}`);
-  } else {
-    console.log(`  ${D}2.${R} Install an agent CLI to enable delegation:`);
-    console.log(`     ${D}claude:${R} npm i -g @anthropic-ai/claude-code  ${D}(or Pro subscription)${R}`);
-    console.log(`     ${D}codex:${R}  npm i -g @openai/codex              ${D}(or ChatGPT Pro)${R}`);
-  }
-  console.log(`  ${D}3.${R} Open dashboard: ${D}https://0dai.dev/dashboard${R}`);
-
-  // Send anonymous usage ping
-  apiCall("/v1/feedback", { report: {
-    stack_detected: result.stack || "?", _auto: true, _plan: result.plan || "trial",
-    _cli_version: VERSION, _files_generated: result.file_count || 0,
-  }}).catch(() => {});
-}
-
-async function cmdSync(target, args = []) {
-  const dryRun = args.includes("--dry-run");
-  const quiet = args.includes("--quiet") || args.includes("-q");
-
-  // Quick local check: skip API if already at current version (unless dry-run)
-  let version = "unknown";
-  try { version = fs.readFileSync(path.join(target, "ai", "VERSION"), "utf8").trim(); } catch {}
-  if (!dryRun && version === VERSION) {
-    log("already up to date (v" + version + ")");
-    return;
-  }
-
-  const { projectFiles, fileContents, clis } = collectMetadata(target);
-  let stack = "generic", agents = [];
-  try {
-    const d = JSON.parse(fs.readFileSync(path.join(target, "ai", "manifest", "discovery.json"), "utf8"));
-    stack = d.stack || "generic";
-    agents = d.selected_agents || [];
-  } catch {}
-
-  // Collect current ai/ files
-  const currentFiles = {};
-  const aiDir = path.join(target, "ai");
-  if (fs.existsSync(aiDir)) {
-    const walk = (dir) => {
-      for (const f of fs.readdirSync(dir, { withFileTypes: true })) {
-        const p = path.join(dir, f.name);
-        if (f.isDirectory()) walk(p);
-        else {
-          try {
-            const stat = fs.statSync(p);
-            if (stat.size < 10000) currentFiles[path.relative(target, p)] = fs.readFileSync(p, "utf8");
-          } catch {}
-        }
-      }
-    };
-    walk(aiDir);
-  }
-
-  if (dryRun) log(`${D}dry-run: checking what sync would change...${R}`);
-
-  const result = await apiCall("/v1/sync", {
-    ai_version: version, stack, agents: agents.length ? agents : clis,
-    current_files: currentFiles, file_contents: fileContents,
-    dry_run: dryRun, quiet,
-  });
-
-  if (result.error) {
-    if (result.error.includes("authentication")) {
-      log(`authentication required`);
-      console.log(`  0dai auth is separate from your agent CLIs (Claude Code, Codex).`);
-      console.log(`  It tracks projects, usage limits, and team features.\n`);
-      console.log(`  ${D}Run: 0dai auth login${R}`);
-    } else {
-      log(`error: ${result.error}`);
-    }
-    process.exit(1);
-  }
-
-  const updated = result.files_updated || {};
-  if (dryRun) {
-    const files = Object.keys(updated);
-    if (files.length) {
-      log(`${D}dry-run: would update ${files.length} file(s):${R}`);
-      for (const f of files) console.log(`  ${D}~ ${f}${R}`);
-    } else {
-      log(`${D}dry-run: nothing to update${R}`);
-    }
-    return;
-  }
-  const changedCount = Object.keys(updated).length;
-  if (changedCount) {
-    writeFiles(target, updated);
-    if (!quiet) {
-      for (const f of Object.keys(updated)) console.log(`  ~ ${f}`);
-    }
-    log(`sync: ${changedCount} file(s) updated`);
-    console.log(`  ${D}Run: 0dai doctor to verify project health${R}`);
-  } else {
-    log("already up to date");
-  }
-
-  // Ensure ai/VERSION matches CLI version after successful sync
-  const versionFile = path.join(target, "ai", "VERSION");
-  try {
-    const current = fs.existsSync(versionFile) ? fs.readFileSync(versionFile, "utf8").trim() : "";
-    if (current !== VERSION) {
-      fs.writeFileSync(versionFile, VERSION + "\n", "utf8");
-    }
-  } catch {}
-
-  // Update portfolio registry
-  registerProject(target, path.basename(target), stack);
-}
-
-async function cmdDetect(target) {
-  const OPTIONAL_CLIS = ["gemini", "aider", "opencode"];
-  const { projectFiles, fileContents, clis: localClis } = collectMetadata(target);
-  // Send file contents AND local CLI inventory so server can do content-based detection
-  const result = await apiCall("/v1/detect", {
-    project_files: projectFiles,
-    file_contents: fileContents,
-    available_clis: localClis,
-  });
-  if (result.error) { log(`error: ${result.error}`); return; }
-  console.log(`stack: ${result.stack || "?"}`);
-  // Use local CLIs if server didn't return any (server can't detect locally installed binaries)
-  const clis = (result.available_clis && result.available_clis.length && result.available_clis[0]) ? result.available_clis : localClis;
-  if (clis.length) {
-    console.log(`clis:  ${clis.join(", ")}`);
-  } else {
-    console.log(`clis:  none detected`);
-    console.log(`       ${D}install claude, codex, or opencode to use 0dai${R}`);
-  }
-  // Explain optional CLIs so missing doesn't alarm users
-  const missing = OPTIONAL_CLIS.filter(c => !clis.includes(c));
-  if (missing.length && clis.length) {
-    console.log(`       ${D}optional (not installed): ${missing.join(", ")}${R}`);
-  }
-}
-
-function cmdAudit(target) {
-  const W = process.stdout.isTTY ? "\x1b[33m" : "";   // yellow
-  const RE = process.stdout.isTTY ? "\x1b[31m" : "";  // red
-  const G = process.stdout.isTTY ? "\x1b[32m" : "";   // green
-
-  // Secret patterns: [label, regex, severity]
-  const PATTERNS = [
-    ["Anthropic API key",  /sk-ant-api[0-9A-Za-z_-]{20,}/g,         "critical"],
-    ["OpenAI API key",     /sk-[A-Za-z0-9]{20,}/g,                   "critical"],
-    ["GitHub PAT (ghp)",   /ghp_[A-Za-z0-9]{36}/g,                   "critical"],
-    ["GitHub PAT (gho)",   /gho_[A-Za-z0-9]{36}/g,                   "critical"],
-    ["GitHub fine-grained",/github_pat_[A-Za-z0-9_]{59}/g,           "critical"],
-    ["AWS access key",     /AKIA[0-9A-Z]{16}/g,                       "critical"],
-    ["AWS secret key",     /aws_secret_access_key\s*[=:]\s*\S{20,}/gi,"critical"],
-    ["Google API key",     /AIza[0-9A-Za-z_-]{35}/g,                  "high"],
-    ["Bearer token",       /Bearer\s+[A-Za-z0-9_-]{32,}/g,           "high"],
-    ["Private key block",  /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY/g, "critical"],
-    ["Generic secret var", /(?:secret|password|passwd|pwd)\s*[=:]\s*["']?[A-Za-z0-9+/=_-]{12,}["']?/gi, "medium"],
-  ];
-
-  // Files to scan
-  const SCAN_FILES = [
-    "CLAUDE.md", "AGENTS.md", "GEMINI.md", ".cursorrules",
-    ".codex/config.md", ".codex/instructions.md",
-    "opencode.json", ".mcp.json",
-  ];
-
-  // Walk a directory recursively, return all file paths
-  function walk(dir, maxDepth = 6, _depth = 0) {
-    if (_depth > maxDepth) return [];
-    let results = [];
-    try {
-      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        if (entry.name.startsWith(".git") || entry.name === "node_modules") continue;
-        const full = path.join(dir, entry.name);
-        if (entry.isDirectory()) results = results.concat(walk(full, maxDepth, _depth + 1));
-        else results.push(full);
-      }
-    } catch { /* skip unreadable */ }
-    return results;
-  }
-
-  const findings = []; // {file, line, label, severity, excerpt}
-
-  function scanContent(filePath, content) {
-    const lines = content.split("\n");
-    for (const [label, regex, severity] of PATTERNS) {
-      regex.lastIndex = 0;
-      for (let i = 0; i < lines.length; i++) {
-        let m;
-        regex.lastIndex = 0;
-        while ((m = regex.exec(lines[i])) !== null) {
-          const val = m[0];
-          // Redact: show first 6 + ... + last 4 chars
-          const excerpt = val.length > 14 ? val.slice(0, 6) + "..." + val.slice(-4) : val.slice(0, 4) + "...";
-          findings.push({ file: filePath, line: i + 1, label, severity, excerpt });
-        }
-      }
-    }
-  }
-
-  // Collect files to scan
-  const toScan = new Set();
-
-  for (const rel of SCAN_FILES) {
-    const p = path.join(target, rel);
-    if (fs.existsSync(p)) toScan.add(p);
-  }
-
-  const aiDir = path.join(target, "ai");
-  if (fs.existsSync(aiDir)) {
-    for (const f of walk(aiDir)) {
-      if (/\.(md|json|yaml|yml|txt|toml)$/.test(f)) toScan.add(f);
-    }
-  }
-
-  // Warn about .env files (don't scan content, just flag existence)
-  const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
-  const foundEnv = envFiles.filter(e => fs.existsSync(path.join(target, e)));
-
-  console.log(`\n  ${T}0dai audit${R} — scanning for leaked secrets\n`);
-  console.log(`  ${D}target: ${target}${R}`);
-  console.log(`  ${D}files:  ${toScan.size} scanned${R}\n`);
-
-  for (const filePath of toScan) {
-    try {
-      const content = fs.readFileSync(filePath, "utf8");
-      scanContent(filePath, content);
-    } catch { /* skip */ }
-  }
-
-  if (foundEnv.length > 0) {
-    console.log(`  ${W}WARN${R}  .env files detected — ensure they are in .gitignore`);
-    for (const e of foundEnv) console.log(`         ${D}${e}${R}`);
-    console.log();
-  }
-
-  if (findings.length === 0) {
-    console.log(`  ${G}✓ No secrets found${R} in scanned files\n`);
-    return;
-  }
-
-  const critical = findings.filter(f => f.severity === "critical");
-  const high = findings.filter(f => f.severity === "high");
-  const medium = findings.filter(f => f.severity === "medium");
-
-  const colorFor = (s) => s === "critical" ? RE : s === "high" ? W : D;
-
-  for (const f of findings) {
-    const c = colorFor(f.severity);
-    const rel = path.relative(target, f.file);
-    console.log(`  ${c}${f.severity.toUpperCase().padEnd(8)}${R} ${rel}:${f.line}`);
-    console.log(`           ${D}${f.label}: ${f.excerpt}${R}`);
-  }
-
-  console.log();
-  if (critical.length > 0) console.log(`  ${RE}${critical.length} critical${R} · ${W}${high.length} high${R} · ${D}${medium.length} medium${R}\n`);
-  else console.log(`  ${W}${high.length} high${R} · ${D}${medium.length} medium${R}\n`);
-
-  console.log(`  ${D}Tip: add secrets to .gitignore or use env vars, not plaintext files${R}\n`);
-
-  if (critical.length > 0) process.exit(1);
-}
-
-function cmdDoctor(target) {
-  const ai = path.join(target, "ai");
-  if (!fs.existsSync(ai)) { log("no ai/ layer. Run '0dai init' first."); return; }
-  let v = "?", stack = "generic";
-  try { v = fs.readFileSync(path.join(ai, "VERSION"), "utf8").trim(); } catch {}
-  try { stack = JSON.parse(fs.readFileSync(path.join(ai, "manifest", "discovery.json"), "utf8")).stack || "generic"; } catch {}
-
-  const W = process.stdout.isTTY ? "\x1b[33m" : "";  // yellow
-  const E = process.stdout.isTTY ? "\x1b[31m" : "";  // red
-  const G = process.stdout.isTTY ? "\x1b[32m" : "";  // green
-  const R2 = process.stdout.isTTY ? "\x1b[0m" : "";
-
-  // --- ai/ layer checks ---
-  const layerChecks = {
-    "ai/VERSION":                  { path: path.join(ai, "VERSION"),                   sev: "error" },
-    "ai/manifest/project.yaml":    { path: path.join(ai, "manifest", "project.yaml"),  sev: "error" },
-    "ai/manifest/commands.yaml":   { path: path.join(ai, "manifest", "commands.yaml"), sev: "warn"  },
-    "ai/manifest/discovery.json":  { path: path.join(ai, "manifest", "discovery.json"),sev: "warn"  },
-    ".claude/settings.json":       { path: path.join(target, ".claude", "settings.json"), sev: "warn" },
-    "AGENTS.md":                   { path: path.join(target, "AGENTS.md"),             sev: "warn"  },
-  };
-
-  // --- credentials checklist ---
-  // Detect subscription-based auth (not just env API keys)
-  const { execFileSync: _execFile } = require("child_process");
-  function cliAuthed(cli) {
-    try {
-      if (cli === "claude") {
-        const out = _execFile("claude", ["auth", "status"], { timeout: 5000 }).toString();
-        try { return JSON.parse(out).loggedIn === true; } catch {}
-        return out.includes("loggedIn");
-      }
-      _execFile("which", [cli], { timeout: 2000 });
-      return true;
-    } catch { return false; }
-  }
-
-  const claudeAuth = cliAuthed("claude");
-  const codexAuth = cliAuthed("codex");
-
-  const credChecks = [
-    {
-      name: "Claude Code",
-      present: claudeAuth || !!process.env.ANTHROPIC_API_KEY,
-      sev: (claudeAuth || process.env.ANTHROPIC_API_KEY) ? "ok" : "warn",
-      hint: claudeAuth ? "authenticated via subscription" : "run: claude auth login (or set ANTHROPIC_API_KEY)",
-    },
-    {
-      name: "Codex CLI",
-      present: codexAuth || !!process.env.OPENAI_API_KEY,
-      sev: (codexAuth || process.env.OPENAI_API_KEY) ? "ok" : "warn",
-      hint: codexAuth ? "installed (uses ChatGPT subscription)" : "run: npm i -g @openai/codex (or set OPENAI_API_KEY)",
-    },
-    {
-      name: "GITHUB_TOKEN",
-      present: !!process.env.GITHUB_TOKEN,
-      sev: process.env.GITHUB_TOKEN ? "ok" : "info",
-      hint: "Optional — for gh CLI, PR creation",
-    },
-  ];
-
-  // Stack-specific creds
-  if (stack.includes("vercel") || stack.includes("next")) {
-    credChecks.push({ name: "VERCEL_TOKEN", present: !!process.env.VERCEL_TOKEN, sev: process.env.VERCEL_TOKEN ? "ok" : "info", hint: "Optional — for Vercel deployments" });
-  }
-  if (stack.includes("aws") || stack.includes("lambda") || stack.includes("cdk")) {
-    credChecks.push({ name: "AWS_ACCESS_KEY_ID", present: !!process.env.AWS_ACCESS_KEY_ID, sev: process.env.AWS_ACCESS_KEY_ID ? "ok" : "info", hint: "Optional — for AWS deployments" });
-  }
-  if (stack.includes("gcp") || stack.includes("firebase") || stack.includes("flutter")) {
-    credChecks.push({ name: "GCP_CREDENTIALS", present: !!process.env.GOOGLE_APPLICATION_CREDENTIALS, sev: process.env.GOOGLE_APPLICATION_CREDENTIALS ? "ok" : "info", hint: "Optional — for GCP/Firebase" });
-  }
-
-  // --- run checks ---
-  let errors = 0, warnings = 0;
-  log(`v${v} | stack: ${stack}\n`);
-
-  const missingConfigs = [];
-  console.log("  ai/ layer:");
-  for (const [name, { path: p, sev }] of Object.entries(layerChecks)) {
-    const exists = fs.existsSync(p);
-    if (!exists) {
-      sev === "error" ? errors++ : warnings++;
-      if (sev === "warn") missingConfigs.push(name);
-    }
-    const mark = exists ? `${G}ok${R2}` : sev === "error" ? `${E}MISSING${R2}` : `${W}missing${R2}`;
-    console.log(`    ${mark.padEnd(22)} ${name}`);
-  }
-  // Explain WHY native configs are missing and what to do
-  if (missingConfigs.length > 0) {
-    const hasDiscovery = fs.existsSync(path.join(ai, "manifest", "discovery.json"));
-    if (hasDiscovery) {
-      console.log(`\n    ${W}→ Native configs not generated yet.${R2}`);
-      console.log(`      ${D}Run: 0dai sync --target .${R2}`);
-    } else {
-      console.log(`\n    ${W}→ ai/ layer incomplete — run '0dai init' first.${R2}`);
-    }
-  }
-
-  console.log("\n  credentials:");
-  for (const c of credChecks) {
-    if (!c.present && c.sev === "warn") warnings++;
-    const mark = c.present ? `${G}ok${R2}` : c.sev === "warn" ? `${W}not set${R2}` : `${D}not set${R2}`;
-    const hint = c.present && c.hint.includes("subscription") ? ` ${D}(${c.hint})${R2}` : (!c.present ? `\n      ${D}→ ${c.hint}${R2}` : "");
-    console.log(`    ${mark.padEnd(22)} ${c.name}${hint}`);
-  }
-
-  // --- agent CLIs check ---
-  const { execFileSync: _ef2 } = require("child_process");
-  let updatesAvailable = 0;
-  console.log("\n  agent CLIs:");
-  for (const cli of SUPPORTED_CLIS) {
-    let installed = false, ver = null;
-    try {
-      const out = _ef2(cli.bin, ["--version"], { timeout: 8000 }).toString().trim();
-      installed = true;
-      const m = out.match(/(\d+\.\d+\.\d+)/);
-      if (m) ver = m[1];
-    } catch {}
-
-    if (installed) {
-      let latest = null;
-      if (cli.pkg) {
-        try {
-          const npmOut = _ef2("npm", ["view", cli.pkg, "version"], { timeout: 5000 }).toString().trim();
-          if (npmOut.match(/^\d+\.\d+\.\d+$/)) latest = npmOut;
-        } catch {}
-      }
-      if (latest && ver && latest !== ver) {
-        updatesAvailable++;
-        console.log(`    ${W}update${R2}  ${cli.name} ${D}${ver} → ${latest}${R2}`);
-        console.log(`      ${D}→ ${cli.install}${R2}`);
-      } else {
-        console.log(`    ${G}ok${R2}      ${cli.name}${ver ? ` ${D}v${ver}${R2}` : ""}`);
-      }
-    } else {
-      console.log(`    ${D}—${R2}       ${cli.name} ${D}not installed${R2}`);
-      console.log(`      ${D}→ ${cli.install}${cli.altAuth ? ` (or ${cli.altAuth})` : ""}${R2}`);
-    }
-  }
-  if (updatesAvailable) {
-    console.log(`\n    ${D}Run: 0dai update${R2} to update all`);
-  }
-
-  // --- swarm check ---
-  const swarmDir = path.join(ai, "swarm");
-  const countDir = (d) => { try { return fs.readdirSync(d).filter(f => f.endsWith(".json")).length; } catch { return 0; } };
-  const qCount = countDir(path.join(swarmDir, "queue"));
-  const dCount = countDir(path.join(swarmDir, "done"));
-  if (qCount || dCount) {
-    console.log(`\n  swarm: ${qCount} queued, ${dCount} done`);
-    if (qCount) console.log(`    ${W}→ run '0dai reflect' to review pending tasks${R2}`);
-  }
-
-  const summary = errors ? `${E}${errors} error(s)${R2}` : warnings ? `${W}${warnings} warning(s)${R2}` : `${G}healthy${R2}`;
-  console.log(`\n  status: ${summary}`);
-  if (errors) process.exitCode = 1;
-}
-
-function cmdValidate(target) {
-  const ai = path.join(target, "ai");
-  if (!fs.existsSync(ai)) {
-    log("no ai/ layer. Run '0dai init' first.");
-    process.exitCode = 1;
-    return;
-  }
-  const E = process.stdout.isTTY ? "\x1b[31m" : "";
-  const G = process.stdout.isTTY ? "\x1b[32m" : "";
-  const D2 = process.stdout.isTTY ? "\x1b[2m" : "";
-  const R2 = process.stdout.isTTY ? "\x1b[0m" : "";
-
-  const required = [
-    "ai/VERSION", "ai/VERSION_SCHEMA",
-    "ai/manifest/project.yaml", "ai/manifest/discovery.json",
-    "ai/manifest/applied-lock.json", "ai/manifest/environment.yaml",
-    "ai/manifest/commands.yaml",
-  ];
-
-  let agents = [];
-  try {
-    agents = JSON.parse(fs.readFileSync(path.join(ai, "manifest", "discovery.json"), "utf8")).selected_agents || [];
-  } catch {}
-
-  const agentFiles = Object.fromEntries(
-    SUPPORTED_CLIS
-      .filter((c) => c.agentFiles && c.agentFiles.length > 0)
-      .map((c) => [c.name, c.agentFiles])
-  );
-  for (const agent of agents) {
-    for (const f of agentFiles[agent] || []) required.push(f);
-  }
-
-  const FIX_HINTS = {
-    "ai/VERSION": "run: 0dai init",
-    "ai/VERSION_SCHEMA": "run: 0dai sync",
-    "ai/manifest/project.yaml": "run: 0dai init",
-    "ai/manifest/discovery.json": "run: 0dai init",
-    "ai/manifest/applied-lock.json": "run: 0dai sync",
-    "ai/manifest/environment.yaml": "run: 0dai sync",
-    "ai/manifest/commands.yaml": "run: 0dai sync",
-    "AGENTS.md": "run: 0dai sync",
-    ".claude/settings.json": "run: 0dai sync",
-    ".claude/CLAUDE.md": "run: 0dai sync",
-    ".mcp.json": "run: 0dai sync",
-    ".codex/config.toml": "install codex, then: 0dai sync",
-    "opencode.json": "install opencode, then: 0dai sync",
-  };
-
-  const present = required.filter(f => fs.existsSync(path.join(target, f)));
-  const missing = required.filter(f => !fs.existsSync(path.join(target, f)));
-
-  for (const f of present) console.log(`  ${G}✓${R2} ${f}`);
-  for (const f of missing) {
-    const hint = FIX_HINTS[f] || "run: 0dai sync";
-    console.log(`  ${E}✗${R2} ${f} ${D2}— ${hint}${R2}`);
-  }
-
-  if (missing.length) {
-    console.log(`\n${E}${missing.length} missing${R2} / ${present.length + missing.length} total`);
-    process.exitCode = 1;
-  } else {
-    log(`${G}validate ok${R2} — all ${present.length} required files present`);
-  }
-}
-
-// --- Update agent CLIs ---
-function cmdUpdate(args) {
-  const { execFileSync: _ef3, execSync } = require("child_process");
-  const dryRun = args.includes("--dry-run");
-
-  // 0dai self-update entry, then all supported agent CLIs.
-  const CLIS = [
-    { name: "0dai", pkg: "@0dai-dev/cli", bin: "0dai", pkgType: "npm" },
-    ...SUPPORTED_CLIS,
-  ];
-
-  let updated = 0;
-  for (const cli of CLIS) {
-    let installed = false, ver = null;
-    try {
-      const out = _ef3(cli.bin, ["--version"], { timeout: 8000 }).toString().trim();
-      installed = true;
-      const m = out.match(/(\d+\.\d+\.\d+)/);
-      if (m) ver = m[1];
-    } catch {}
-
-    if (!installed) continue;
-
-    let latest = null;
-    if (cli.pkgType === "npm" && cli.pkg) {
-      try { latest = _ef3("npm", ["view", cli.pkg, "version"], { timeout: 5000 }).toString().trim(); } catch {}
-    } else if (cli.pkgType === "pip" && cli.pkg) {
-      try {
-        const out = _ef3("pip", ["index", "versions", cli.pkg], { timeout: 8000, encoding: "utf8" });
-        const m = out.match(/LATEST:\s*(\d+\.\d+\.\d+)/i) || out.match(/(\d+\.\d+\.\d+)/);
-        if (m) latest = m[1];
-      } catch {}
-    }
-
-    if (!latest || latest === ver) {
-      console.log(`  ${cli.name} ${ver || ""} — up to date`);
-      continue;
-    }
-
-    console.log(`  ${cli.name} ${ver} → ${latest}`);
-    if (dryRun) { updated++; continue; }
-
-    try {
-      if (cli.pkgType === "npm") {
-        log(`updating ${cli.name}...`);
-        execSync(`npm install -g ${cli.pkg}@latest`, { timeout: 60000, stdio: "pipe" });
-        log(`${cli.name} updated to ${latest}`);
-        updated++;
-      } else if (cli.pkgType === "pip") {
-        log(`updating ${cli.name}...`);
-        execSync(`pip install --upgrade ${cli.pkg}`, { timeout: 60000, stdio: "pipe" });
-        log(`${cli.name} updated to ${latest}`);
-        updated++;
-      }
-    } catch (e) {
-      log(`failed to update ${cli.name}: ${e.message.split("\n")[0]}`);
-    }
-  }
-  if (updated) {
-    log(`${dryRun ? "would update" : "updated"} ${updated} CLI(s)`);
-  } else {
-    log("all CLIs are up to date");
-  }
-}
-
-// --- Session reflection --- (dogfood feedback #36)
-function cmdReflect(target, args) {
-  const ai = path.join(target, "ai");
-  const W = process.stdout.isTTY ? "\x1b[33m" : "";
-  const G = process.stdout.isTTY ? "\x1b[32m" : "";
-  const R2 = process.stdout.isTTY ? "\x1b[0m" : "";
-  const B = process.stdout.isTTY ? "\x1b[1m" : "";
-
-  // Collect swarm done tasks
-  const doneDir = path.join(ai, "swarm", "done");
-  const queueDir = path.join(ai, "swarm", "queue");
-  const activeDir = path.join(ai, "swarm", "active");
-  const doneTasks = [], queueTasks = [];
-
-  // -- how many days to look back (default 7)
-  const daysArg = args.find((_, i) => args[i - 1] === "--days");
-  const days = parseInt(daysArg || "7");
-  const since = Date.now() - days * 24 * 60 * 60 * 1000;
-
-  const readJsonDir = (dir) => {
-    const out = [];
-    try {
-      for (const f of fs.readdirSync(dir).filter(f => f.endsWith(".json"))) {
-        try { out.push(JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"))); } catch {}
-      }
-    } catch {}
-    return out;
-  };
-
-  const allDone = readJsonDir(doneDir).filter(t => {
-    const ts = t.completed_at || t.created_at;
-    return !ts || new Date(ts).getTime() >= since;
-  });
-  const allQueue = readJsonDir(queueDir);
-  const allActive = readJsonDir(activeDir);
-
-  // Aggregate by agent
-  const byAgent = {};
-  for (const t of allDone) {
-    const a = t.assigned_to || t.agent || "unknown";
-    if (!byAgent[a]) byAgent[a] = { done: 0, tasks: [] };
-    byAgent[a].done++;
-    byAgent[a].tasks.push(t.title || t.id || "?");
-  }
-
-  // Session data
-  let sessionGoal = "?";
-  try {
-    const active = JSON.parse(fs.readFileSync(path.join(ai, "sessions", "active.json"), "utf8"));
-    sessionGoal = (active.task || {}).goal || "?";
-  } catch {}
-
-  console.log(`\n  ${B}${T}0dai reflect${R2}${R} — last ${days} days\n`);
-
-  // Goal
-  if (sessionGoal !== "?") console.log(`  ${B}Goal${R2}      ${sessionGoal}`);
-
-  // Delegation stats
-  const totalDone = allDone.length;
-  const totalPending = allQueue.length + allActive.length;
-  const successRate = totalDone + totalPending > 0
-    ? Math.round((totalDone / (totalDone + totalPending)) * 100)
-    : null;
-
-  console.log(`  ${B}Delivered${R2}  ${G}${totalDone}${R2} tasks completed`);
-  if (totalPending) console.log(`  ${B}Remaining${R2}  ${W}${totalPending}${R2} tasks still pending`);
-  if (successRate !== null) console.log(`  ${B}Rate${R2}       ${successRate >= 80 ? G : W}${successRate}%${R2} delegation success rate`);
-
-  // By agent breakdown with per-agent completion rate
-  const allPendingByAgent = {};
-  for (const t of [...allQueue, ...allActive]) {
-    const a = t.assigned_to || "unknown";
-    allPendingByAgent[a] = (allPendingByAgent[a] || 0) + 1;
-  }
-
-  if (Object.keys(byAgent).length) {
-    console.log(`\n  ${B}By agent:${R2}`);
-    for (const [agent, data] of Object.entries(byAgent).sort((a, b) => b[1].done - a[1].done)) {
-      const pending = allPendingByAgent[agent] || 0;
-      const total = data.done + pending;
-      const rate = total > 0 ? Math.round((data.done / total) * 100) : 100;
-      const bar = "█".repeat(Math.min(data.done, 20));
-      const rateStr = total > 1 ? ` (${rate >= 80 ? G : W}${rate}%${R2})` : "";
-      console.log(`    ${(agent + " ").padEnd(14)} ${G}${bar}${R2} ${data.done}/${total}${rateStr}`);
-    }
-    // Agents with only pending tasks (never completed anything in window)
-    for (const [agent, count] of Object.entries(allPendingByAgent)) {
-      if (!byAgent[agent]) {
-        console.log(`    ${(agent + " ").padEnd(14)} ${W}${"░".repeat(Math.min(count, 20))}${R2} 0/${count} ${W}(pending)${R2}`);
-      }
-    }
-  }
-
-  // Budget summary from budget.json
-  const budgetFile = path.join(ai, "swarm", "budget.json");
-  try {
-    const budget = JSON.parse(fs.readFileSync(budgetFile, "utf8"));
-    const today = new Date().toISOString().slice(0, 10);
-    const sessionKey = process.env.ODAI_SESSION_ID ||
-      new Date().toISOString().slice(0, 13).replace("T", "-"); // YYYY-MM-DD-HH
-    const dailySpent = budget.daily?.[today] || 0;
-    const totalSpent = budget.total_spent || 0;
-    const sess = budget.sessions?.[sessionKey];
-
-    // Tier distribution across all tasks
-    const tierCount = { fast: 0, balanced: 0, deep: 0 };
-    for (const t of Object.values(budget.tasks || {})) {
-      if (t.tier && tierCount[t.tier] !== undefined) tierCount[t.tier]++;
-    }
-    const tieredTotal = tierCount.fast + tierCount.balanced + tierCount.deep;
-
-    if (dailySpent > 0 || totalSpent > 0 || sess) {
-      console.log(`\n  ${B}Budget:${R2}`);
-      if (sess && sess.total_cost > 0) {
-        const taskCount = (sess.tasks || []).length;
-        const avgCost = taskCount > 0 ? (sess.total_cost / taskCount).toFixed(4) : "0";
-        console.log(`    ${B}This session${R2}  $${sess.total_cost.toFixed(4)} · ${taskCount} tasks · avg $${avgCost}/task`);
-        if (sess.tiers) {
-          const tiers = Object.entries(sess.tiers).filter(([, n]) => n > 0).map(([t, n]) => `${n}×${t}`).join("  ");
-          if (tiers) console.log(`    ${D}Tiers          ${tiers}${R2}`);
-        }
-      }
-      if (dailySpent > 0) {
-        const dailyLimit = parseFloat(process.env.ODAI_DAILY_BUDGET || "5");
-        const pct = Math.round((dailySpent / dailyLimit) * 100);
-        const bar = "█".repeat(Math.round(pct / 5)).padEnd(20, "░");
-        const col = pct < 50 ? G : pct < 80 ? W : "\x1b[31m";
-        console.log(`    ${B}Today${R2}         ${col}$${dailySpent.toFixed(4)}${R2} / $${dailyLimit.toFixed(2)} ${D}${bar} ${pct}%${R2}`);
-      }
-      if (totalSpent > 0) {
-        console.log(`    ${B}All time${R2}      ${D}$${totalSpent.toFixed(4)}${R2}`);
-      }
-      if (tieredTotal > 0) {
-        const fastPct = Math.round((tierCount.fast / tieredTotal) * 100);
-        console.log(`    ${D}Model routing  ${tierCount.fast}×fast  ${tierCount.balanced}×balanced  ${tierCount.deep}×deep  (${fastPct}% cheap)${R2}`);
-      }
-    }
-  } catch {}
-
-  // Insights — learn from patterns
-  if (totalDone >= 3) {
-    const insights = [];
-    // Best agent by completion rate
-    const agentEntries = Object.entries(byAgent).map(([a, d]) => {
-      const pending = allPendingByAgent[a] || 0;
-      const total = d.done + pending;
-      return { agent: a, done: d.done, total, rate: total > 0 ? d.done / total : 1 };
-    });
-    const best = agentEntries.sort((a, b) => b.rate - a.rate)[0];
-    if (best && agentEntries.length > 1) {
-      insights.push(`${best.agent} has the highest success rate (${Math.round(best.rate * 100)}%)`);
-    }
-    // Fastest agent by avg elapsed
-    try {
-      const budget = JSON.parse(fs.readFileSync(path.join(ai, "swarm", "budget.json"), "utf8"));
-      const agentElapsed = {};
-      const agentCounts = {};
-      for (const t of Object.values(budget.tasks || {})) {
-        if (t.elapsed > 0) {
-          agentElapsed[t.agent] = (agentElapsed[t.agent] || 0) + t.elapsed;
-          agentCounts[t.agent] = (agentCounts[t.agent] || 0) + 1;
-        }
-      }
-      let fastest = null, fastestAvg = Infinity;
-      for (const [a, total] of Object.entries(agentElapsed)) {
-        const avg = total / agentCounts[a];
-        if (avg < fastestAvg) { fastest = a; fastestAvg = avg; }
-      }
-      if (fastest && Object.keys(agentElapsed).length > 1) {
-        insights.push(`${fastest} is fastest (avg ${Math.round(fastestAvg)}s per task)`);
-      }
-    } catch {}
-    // Cost efficiency
-    if (allDone.length > 0) {
-      try {
-        const budget = JSON.parse(fs.readFileSync(path.join(ai, "swarm", "budget.json"), "utf8"));
-        if (budget.total_spent > 0) {
-          const costPerTask = budget.total_spent / allDone.length;
-          insights.push(`avg cost: $${costPerTask.toFixed(4)}/task`);
-        }
-      } catch {}
-    }
-    if (insights.length) {
-      console.log(`\n  ${B}Insights:${R2}`);
-      for (const i of insights) console.log(`    ${G}→${R2} ${i}`);
-    }
-  }
-
-  // Remaining blockers
-  if (allQueue.length) {
-    console.log(`\n  ${B}Blockers / queue:${R2}`);
-    for (const t of allQueue.slice(0, 8)) {
-      const agent = t.assigned_to ? ` → ${t.assigned_to}` : "";
-      console.log(`    ${W}•${R2} ${(t.title || t.id || "?").slice(0, 60)}${agent}`);
-    }
-    if (allQueue.length > 8) console.log(`    ${D}… and ${allQueue.length - 8} more${R2}`);
-  }
-
-  // No data
-  if (!totalDone && !totalPending) {
-    console.log(`  ${D}No swarm tasks found in the last ${days} days.${R2}`);
-    console.log(`  ${D}Use '0dai swarm add --task "..." --to codex' to delegate tasks.${R2}`);
-  }
-
-  console.log();
-}
-
-function cmdMetrics(target) {
-  const ai = path.join(target, "ai");
-  const G = "\x1b[32m", W = "\x1b[33m", R2 = "\x1b[0m", D = "\x1b[2m",
-        B = "\x1b[34m", T = "\x1b[36m", M = "\x1b[35m";
-
-  // --- Data sources ---
-  let stats = {}, budget = {}, discovery = {};
-  try { stats  = JSON.parse(fs.readFileSync(path.join(ai, "feedback", ".usage_stats.json"), "utf8")); } catch {}
-  try { budget = JSON.parse(fs.readFileSync(path.join(ai, "swarm", "budget.json"), "utf8")); } catch {}
-  try { discovery = JSON.parse(fs.readFileSync(path.join(ai, "manifest", "discovery.json"), "utf8")); } catch {}
-
-  const projectName = discovery.project_name || path.basename(target);
-  const stack = discovery.stack || "?";
-  const totalSessions = stats.total_sessions || 0;
-  const agentBreakdown = stats.agents || {};
-  const layerInfo = stats.layer || {};
-  const lastSession = stats.last_session ? new Date(stats.last_session) : null;
-  const layerVersion = stats.version || "?";
-
-  // Swarm tasks: count done files
-  let tasksDone = 0, tasksQueue = 0;
-  const doneDir = path.join(ai, "swarm", "done");
-  const queueDir = path.join(ai, "swarm", "queue");
-  try { tasksDone = fs.readdirSync(doneDir).filter(f => f.endsWith(".json")).length; } catch {}
-  try { tasksQueue = fs.readdirSync(queueDir).filter(f => f.endsWith(".json")).length; } catch {}
-
-  // Activity: count events from activity.jsonl
-  let activityEvents = 0;
-  try {
-    const lines = fs.readFileSync(path.join(ai, "swarm", "activity.jsonl"), "utf8").trim().split("\n").filter(Boolean);
-    activityEvents = lines.length;
-  } catch {}
-
-  // Feedback submissions
-  let feedbackCount = layerInfo.feedback_reports || 0;
-
-  // Budget totals
-  const totalSpent = budget.total_spent || 0;
-  const sessionsWithBudget = Object.keys(budget.sessions || {}).length;
-
-  // --- Effectiveness score (0-100) ---
-  let score = 0, scoreNotes = [];
-
-  // Sessions depth: 1 = tried, 3 = habit forming, 7 = regular use
-  const sessionScore = Math.min(Math.floor((totalSessions / 7) * 35), 35);
-  score += sessionScore;
-  if (totalSessions === 0)       scoreNotes.push("not started");
-  else if (totalSessions === 1)  scoreNotes.push("first session");
-  else if (totalSessions < 3)    scoreNotes.push("early");
-  else if (totalSessions < 7)    scoreNotes.push("habit forming");
-  else                           scoreNotes.push("regular use");
-
-  // Delegation: did they delegate to swarm?
-  const delegationScore = tasksDone > 0 ? Math.min(Math.floor((tasksDone / 5) * 30), 30) : 0;
-  score += delegationScore;
-  if (tasksDone > 0) scoreNotes.push(`${tasksDone} tasks delegated`);
-
-  // Feedback: submitted = trust signal
-  const feedbackScore = feedbackCount > 0 ? 20 : 0;
-  score += feedbackScore;
-  if (feedbackCount > 0) scoreNotes.push("feedback submitted");
-
-  // Layer completeness: has playbooks and commands?
-  const layerScore = (layerInfo.playbooks && layerInfo.commands) ? 15 : (layerInfo.commands ? 8 : 0);
-  score += layerScore;
-
-  const scoreColor = score >= 70 ? G : score >= 40 ? W : "\x1b[31m";
-  const bar = "█".repeat(Math.round(score / 5)).padEnd(20, "░");
-
-  // --- Output ---
-  console.log(`\n  ${T}Metrics${R2}  ${D}${projectName} · ${stack} · ai v${layerVersion}${R2}\n`);
-
-  // Effectiveness score
-  console.log(`  ${B}Effectiveness${R2}`);
-  console.log(`    ${scoreColor}${score}/100${R2}  ${D}${bar}${R2}`);
-  if (scoreNotes.length) console.log(`    ${D}${scoreNotes.join("  ·  ")}${R2}`);
-
-  // Adoption funnel
-  console.log(`\n  ${B}Adoption funnel${R2}`);
-  const funnelStep = (label, value, done, hint) => {
-    const icon = done ? `${G}✓${R2}` : `${D}○${R2}`;
-    const val = value !== null ? `  ${D}${value}${R2}` : "";
-    const h = !done && hint ? `  ${D}← ${hint}${R2}` : "";
-    console.log(`    ${icon}  ${label}${val}${h}`);
-  };
-  funnelStep("Initialized",       `ai/ v${layerVersion}`,    true);
-  funnelStep("Returned (>1 session)",  `${totalSessions} total`,  totalSessions > 1, "run 0dai reflect after each session");
-  funnelStep("Used swarm delegation",  tasksDone > 0 ? `${tasksDone} tasks done` : null, tasksDone > 0, "try: 0dai swarm add --task '...' --to codex");
-  funnelStep("Submitted feedback",     feedbackCount > 0 ? `${feedbackCount} reports` : null, feedbackCount > 0, "0dai feedback log + push");
-
-  // Session stats
-  if (totalSessions > 0) {
-    console.log(`\n  ${B}Sessions${R2}`);
-    console.log(`    Total      ${totalSessions}`);
-    if (lastSession) {
-      const daysAgo = Math.floor((Date.now() - lastSession.getTime()) / 86400000);
-      const when = daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo}d ago`;
-      console.log(`    Last       ${when}`);
-    }
-    const agentEntries = Object.entries(agentBreakdown).sort((a, b) => b[1] - a[1]);
-    if (agentEntries.length) {
-      console.log(`    Agents     ${agentEntries.map(([a, n]) => `${a}: ${n}`).join("  ")}`);
-    }
-    if (sessionsWithBudget > 0 && totalSpent > 0) {
-      console.log(`    Cost       $${totalSpent.toFixed(4)} total  ${D}(${sessionsWithBudget} sessions tracked)${R2}`);
-    }
-  }
-
-  // Delegation stats
-  if (tasksDone > 0 || tasksQueue > 0) {
-    console.log(`\n  ${B}Delegation${R2}`);
-    if (tasksDone > 0) console.log(`    Done       ${G}${tasksDone}${R2}`);
-    if (tasksQueue > 0) console.log(`    Queue      ${W}${tasksQueue}${R2}`);
-    if (activityEvents > 0) console.log(`    Events     ${activityEvents}`);
-  }
-
-  // Layer health
-  console.log(`\n  ${B}ai/ layer${R2}`);
-  const checks = [
-    ["commands.yaml",  layerInfo.commands],
-    ["playbooks",      layerInfo.playbooks],
-    ["personas",       layerInfo.personas],
-    ["session roaming", layerInfo.session_active],
-    ["swarm queue",    (layerInfo.swarm_queue || 0) > 0],
-  ];
-  for (const [label, ok] of checks) {
-    const icon = ok ? `${G}✓${R2}` : `${D}—${R2}`;
-    console.log(`    ${icon}  ${label}`);
-  }
-
-  // Next suggested action
-  console.log(`\n  ${B}Next${R2}`);
-  if (totalSessions === 0)   console.log(`    ${D}Start a Claude Code session — session_start hook will print project context${R2}`);
-  else if (tasksDone === 0)  console.log(`    ${D}Try delegating a task: 0dai swarm add --task "write tests for auth module" --to codex${R2}`);
-  else if (feedbackCount === 0) console.log(`    ${D}Submit feedback: 0dai feedback log --type positive --detail "what worked"${R2}`);
-  else                       console.log(`    ${D}Score ${score}/100 — keep delegating and submitting feedback${R2}`);
-
-  console.log();
-}
-
-function cmdStatus(target) {
-  const ai = path.join(target, "ai");
-  let v = "?", stack = "?";
-  try { v = fs.readFileSync(path.join(ai, "VERSION"), "utf8").trim(); } catch {}
-  try { stack = JSON.parse(fs.readFileSync(path.join(ai, "manifest", "discovery.json"), "utf8")).stack || "?"; } catch {}
-  log(`v${v} | stack: ${stack}`);
-
-  const count = (dir) => { try { return fs.readdirSync(dir).filter(f => f.endsWith(".json")).length; } catch { return 0; } };
-  const q = count(path.join(ai, "swarm", "queue"));
-  const a = count(path.join(ai, "swarm", "active"));
-  const d = count(path.join(ai, "swarm", "done"));
-  if (q || a || d) console.log(`  swarm: ${q} queued, ${a} active, ${d} done`);
-
-  try {
-    const s = JSON.parse(fs.readFileSync(path.join(ai, "sessions", "active.json"), "utf8"));
-    console.log(`  session: ${(s.task || {}).goal || "?"} (agent: ${s.current_agent || "?"})`);
-  } catch {}
-}
-
-async function checkVersion() {
-  try {
-    // Check interval: 1 hour during debug, configurable via env
-    const intervalSec = parseInt(process.env.ODAI_UPDATE_CHECK_INTERVAL || "3600");
-    let lastCheck = 0;
-    try { lastCheck = parseFloat(fs.readFileSync(VERSION_CHECK_FILE, "utf8")); } catch {}
-    if (Date.now() / 1000 - lastCheck < intervalSec) return;
-
-    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    fs.writeFileSync(VERSION_CHECK_FILE, String(Date.now() / 1000));
-
-    const result = await apiCall("/v1/version");
-    if (result.version && result.version !== VERSION) {
-      // Only suggest update if remote version is actually newer
-      const cmp = (a, b) => { const [a1,a2,a3] = a.split(".").map(Number); const [b1,b2,b3] = b.split(".").map(Number); return a1 - b1 || a2 - b2 || a3 - b3; };
-      if (cmp(result.version, VERSION) > 0) {
-        log(`Update available: ${VERSION} → ${result.version}`);
-        console.log(`  Run: npm update -g @0dai-dev/cli\n`);
-      }
-    }
-  } catch {}
-}
-
-async function cmdAuthLogin() {
-  const isTTY = process.stdout.isTTY && process.stdin.isTTY;
-
-  // Check if already authenticated
-  try {
-    const existing = JSON.parse(fs.readFileSync(AUTH_FILE, "utf8"));
-    if (existing.access_token || existing.email) {
-      if (isTTY) {
-        const p = require("@clack/prompts");
-        p.intro(`${T}0dai${R} authentication`);
-        p.log.success(`Already logged in as ${T}${existing.email || "unknown"}${R} (${existing.plan || "free"} plan)`);
-        const reauth = await p.confirm({ message: "Sign in with a different account?" });
-        if (p.isCancel(reauth) || !reauth) {
-          p.outro("Current session kept");
-          return;
-        }
-      } else {
-        log(`Already logged in as ${existing.email || "unknown"} (${existing.plan || "free"} plan)`);
-        log("To switch accounts, delete ~/.0dai/auth.json and run again");
-        return;
-      }
-    }
-  } catch {}
-
-  if (isTTY) {
-    // Interactive TUI flow
-    const p = require("@clack/prompts");
-    if (!p._intro_shown) p.intro(`${T}0dai${R} authentication`);
-
-    p.note(
-      "0dai auth is separate from agent CLIs (Claude Code, Codex).\n" +
-      "It tracks your projects, usage limits, and team features.\n" +
-      "Your agent CLIs keep their own auth (subscription/API key).",
-      "Why sign in?"
-    );
-
-    const method = await p.select({
-      message: "How would you like to sign in?",
-      options: [
-        { value: "github", label: "GitHub", hint: "recommended" },
-        { value: "google", label: "Google" },
-        { value: "device", label: "Device code", hint: "no browser needed" },
-      ],
-    });
-    if (p.isCancel(method)) { p.cancel("Cancelled"); process.exit(0); }
-
-    if (method === "github" || method === "google") {
-      const url = `${API_URL}/v1/auth/${method}?cli=true`;
-      p.log.info(`Opening browser: ${url}`);
-      try {
-        const { execFileSync } = require("child_process");
-        const cmd = os.platform() === "darwin" ? "open" : os.platform() === "win32" ? "start" : "xdg-open";
-        // MED: use execFileSync to avoid shell injection via URL metacharacters
-        execFileSync(cmd, [url], { stdio: "ignore" });
-      } catch {
-        p.log.warn(`Could not open browser. Visit manually:\n  ${url}`);
-      }
-
-      const s = p.spinner();
-      s.start("Waiting for browser confirmation...");
-
-      // Poll auth/status until we get a new token (check every 3s, 5min timeout)
-      // For now, ask user to paste token from success page
-      s.stop("Browser opened");
-      const token = await p.text({
-        message: "Paste your token from the success page (or press Enter to skip):",
-        placeholder: "0dai_at_...",
-      });
-      if (token && !p.isCancel(token) && token.startsWith("0dai_at_")) {
-        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-        fs.writeFileSync(AUTH_FILE, JSON.stringify({
-          access_token: token,
-          authenticated_at: new Date().toISOString(),
-        }, null, 2) + "\n", { mode: 0o600 });
-        // Fetch profile
-        const status = await apiCall("/v1/auth/status");
-        if (status.email) {
-          const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf8"));
-          auth.email = status.email;
-          auth.plan = status.plan;
-          auth.name = status.name;
-          fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2) + "\n", { mode: 0o600 });
-          p.outro(`${T}Logged in${R} as ${status.email} (${status.plan} plan)`);
-        } else {
-          p.outro(`${T}Token saved${R}`);
-        }
-        return;
-      }
-      p.log.info("Skipped. You can also use device code flow:");
-    }
-
-    // Device code fallback
-    const result = await apiCall("/v1/auth/device", { client_id: "cli" });
-    if (result.error) { p.log.error(result.error); process.exit(1); }
-
-    p.log.step(`Open: ${result.verification_uri}`);
-    p.log.step(`Code: ${T}${result.user_code}${R}`);
-
-    const s = p.spinner();
-    s.start("Waiting for confirmation...");
-
-    const interval = (result.interval || 5) * 1000;
-    const deadline = Date.now() + (result.expires_in || 600) * 1000;
-    while (Date.now() < deadline) {
-      await new Promise(r => setTimeout(r, interval));
-      const poll = await apiCall("/v1/auth/token", { device_code: result.device_code });
-      if (poll.access_token) {
-        s.stop("Authorized!");
-        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-        fs.writeFileSync(AUTH_FILE, JSON.stringify({
-          access_token: poll.access_token, email: poll.email,
-          plan: poll.plan || "free", authenticated_at: new Date().toISOString(),
-          expires_at: poll.expires_at,
-        }, null, 2) + "\n", { mode: 0o600 });
-        p.outro(`${T}Logged in${R} as ${poll.email} (${poll.plan} plan)`);
-        return;
-      }
-      if (poll.error && poll.error !== "authorization_pending") {
-        s.stop("Failed");
-        p.log.error(poll.error);
-        process.exit(1);
-      }
-    }
-    s.stop("Timed out");
-    p.log.error("Try again.");
-    process.exit(1);
-
-  } else {
-    // Non-interactive: device code only
-    log("0dai auth is separate from agent CLIs. It tracks projects, limits, and team features.");
-    const result = await apiCall("/v1/auth/device", { client_id: "cli" });
-    if (result.error) { log(`error: ${result.error}`); process.exit(1); }
-    log(`Open: ${result.verification_uri}`);
-    log(`Code: ${result.user_code}`);
-    log("Waiting...");
-    const interval = (result.interval || 5) * 1000;
-    const deadline = Date.now() + (result.expires_in || 600) * 1000;
-    while (Date.now() < deadline) {
-      await new Promise(r => setTimeout(r, interval));
-      const poll = await apiCall("/v1/auth/token", { device_code: result.device_code });
-      if (poll.access_token) {
-        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-        fs.writeFileSync(AUTH_FILE, JSON.stringify({
-          access_token: poll.access_token, email: poll.email,
-          plan: poll.plan || "free", authenticated_at: new Date().toISOString(),
-        }, null, 2) + "\n", { mode: 0o600 });
-        log(`Logged in as ${poll.email}`);
-        return;
-      }
-    }
-    log("Timed out");
-    process.exit(1);
-  }
-}
-
-function cmdAuthLogout() {
-  try { fs.unlinkSync(AUTH_FILE); } catch {}
-  log("Logged out");
-}
-
-async function cmdRedeem(code) {
-  if (!code) {
-    console.log("Usage: 0dai redeem <CODE>");
-    console.log("Example: 0dai redeem ESSE-ABCD-1234");
-    process.exit(1);
-  }
-  try {
-    JSON.parse(fs.readFileSync(AUTH_FILE, "utf8"));
-  } catch {
-    log("Not logged in. Run: 0dai auth login");
-    process.exit(1);
-  }
-  log(`Redeeming code ${T}${code.toUpperCase()}${R}...`);
-  const result = await apiCall("/v1/redeem", { code: code.toUpperCase().trim() });
-  if (result.ok) {
-    log(`${T}✓${R} ${result.message}`);
-    if (result.duration_days) {
-      log(`  Plan active for ${result.duration_days} days`);
-    }
-    log(`  Run ${D}0dai auth status${R} to see updated limits`);
-  } else {
-    log(`error: ${result.error || "unknown"}`);
-    if (result.hint) log(`hint: ${result.hint}`);
-    process.exit(1);
-  }
-}
-
-async function cmdAuthStatus() {
-  try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf8"));
-    // Backwards compat: old auth.json used `user`, new uses `email`
-    const email = auth.email || auth.user || "unknown";
-    log(`${email} (${auth.plan || "free"} plan)`);
-    // Get usage from API
-    const status = await apiCall("/v1/auth/status");
-    if (status.usage_today) {
-      console.log("  Usage today:");
-      for (const [k, v] of Object.entries(status.usage_today))
-        console.log(`    ${k}: ${v} / ${status.limits[k]}`);
-    }
-  } catch {
-    log("Not logged in. Run: 0dai auth login");
-  }
-}
-
-async function cmdFeedbackPush(target) {
-  const fbDir = path.join(target, "ai", "feedback");
-  const items = [];
-
-  // Collect from report JSON files
-  try {
-    for (const f of fs.readdirSync(fbDir)) {
-      if (f.endsWith("-report.json") || (f.endsWith(".json") && f.match(/^\d{8}/))) {
-        try {
-          const d = JSON.parse(fs.readFileSync(path.join(fbDir, f), "utf8"));
-          if (d.project || d.verdict) items.push({ type: "report", data: d, file: f });
-        } catch {}
-      }
-    }
-  } catch {}
-
-  // Collect from operational.jsonl (feedback log entries)
-  const jsonlPath = path.join(fbDir, "operational.jsonl");
-  try {
-    if (fs.existsSync(jsonlPath)) {
-      const lines = fs.readFileSync(jsonlPath, "utf8").trim().split("\n").filter(Boolean);
-      for (const line of lines) {
-        try { items.push({ type: "log", data: JSON.parse(line) }); } catch {}
-      }
-    }
-  } catch {}
-
-  if (!items.length) {
-    log("no feedback found");
-    console.log(`  ${D}Log feedback first: 0dai feedback log --type suggestion --detail '...'${R}`);
-    return;
-  }
-
-  // Push all items
-  const report = {
-    project: path.basename(target),
-    entries: items.map(i => i.data),
-    count: items.length,
-    submitted_at: new Date().toISOString(),
-  };
-  log(`pushing ${items.length} feedback item(s)...`);
-  const result = await apiCall("/v1/feedback", { report });
-  if (result.received) {
-    log(`received${result.issue ? `: ${result.issue}` : ""}`);
-    if (result.bonus) log(`${T}bonus:${R} ${result.bonus}`);
-    // Archive pushed entries
-    if (fs.existsSync(jsonlPath)) {
-      const archivePath = path.join(fbDir, `pushed-${Date.now()}.jsonl`);
-      fs.renameSync(jsonlPath, archivePath);
-    }
-  } else {
-    log(`error: ${result.error || "unknown"}`);
-  }
-}
-
-// --- Models ---
-function cmdModels(filter) {
-  // Scores from benchmark_models.py (3-task: read/count/review, 2026-04-06)
-  const MODELS = [
-    { name: "Claude Opus 4.6",   tier: "deep",     score: 95, cli: "claude",   flag: "--model opus" },
-    { name: "GPT-5.4-mini",      tier: "fast",     score: 93, cli: "codex",    flag: "-m gpt-5.4-mini",      tested: true },
-    { name: "MiniMax M2.7",      tier: "balanced", score: 93, cli: "opencode", flag: "-m opencode-go/minimax-m2.7",   tested: true },
-    { name: "Claude Sonnet 4.6", tier: "balanced", score: 90, cli: "claude",   flag: "--model sonnet" },
-    { name: "GPT-5.4",           tier: "balanced", score: 90, cli: "codex",    flag: "-m gpt-5.4",           tested: true },
-    { name: "Kimi K2.5",         tier: "balanced", score: 88, cli: "opencode", flag: "-m opencode-go/kimi-k2.5",      tested: true },
-    { name: "Qwen 3.6+ Free",    tier: "free",     score: 88, cli: "opencode", flag: "-m opencode/qwen3.6-plus-free", tested: true },
-    { name: "Gemini 3.1 Pro",    tier: "balanced", score: 85, cli: "gemini",   flag: "-m gemini-3.1-pro" },
-    { name: "GPT-5.3 Codex",     tier: "deep",     score: 83, cli: "codex",    flag: "-m gpt-5.3-codex",      tested: true },
-    { name: "GPT-5.3 Spark",     tier: "fast",     score: 82, cli: "codex",    flag: "-m gpt-5.3-codex-spark" },
-    { name: "Claude Haiku 4.5",  tier: "fast",     score: 78, cli: "claude",   flag: "--model haiku" },
-    { name: "Gemini 3 Flash",    tier: "fast",     score: 77, cli: "gemini",   flag: "-m gemini-3-flash" },
-    { name: "Mimo v2 Pro",       tier: "fast",     score: 74, cli: "opencode", flag: "-m opencode-go/mimo-v2-pro",    tested: true },
-    { name: "GPT-5.4 (opencode)",tier: "fast",     score: 74, cli: "opencode", flag: "-m openai/gpt-5.4",            tested: true },
-    { name: "GPT-5.2",           tier: "balanced", score: 87, cli: "codex",    flag: "-m gpt-5.2",           tested: true },
-    { name: "MiniMax M2.5",      tier: "slow",     score: 57, cli: "opencode", flag: "-m opencode-go/minimax-m2.5",   tested: true },
-  ];
-
-  const { execFileSync } = require("child_process");
-  const available = new Set();
-  for (const cli of ["claude", "codex", "opencode", "gemini", "aider"]) {
-    try { execFileSync("/bin/sh", ["-c", `command -v ${cli}`], { stdio: "ignore" }); available.add(cli); } catch {}
-  }
-
-  const isTTY = process.stdout.isTTY;
-  const Y  = isTTY ? "\x1b[33m" : "";
-  const G  = isTTY ? "\x1b[32m" : "";
-  const DIM = isTTY ? "\x1b[2m" : "";
-
-  let models = [...MODELS].sort((a, b) => b.score - a.score);
-  if (filter === "--fast")      models = models.filter(m => m.tier === "fast");
-  if (filter === "--balanced")  models = models.filter(m => m.tier === "balanced");
-  if (filter === "--deep")      models = models.filter(m => m.tier === "deep");
-  if (filter === "--available") models = models.filter(m => available.has(m.cli));
-
-  const tc = (t) => t === "deep" ? T : t === "balanced" ? G : DIM;
-  console.log(`\n  ${T}0dai${R} model ratings — ${models.length} models\n`);
-  console.log(`  ${"SCORE".padEnd(6)} ${"MODEL".padEnd(22)} ${"TIER".padEnd(10)} ${"CLI".padEnd(10)} FLAG`);
-  console.log(`  ${"-".repeat(64)}`);
-  for (const m of models) {
-    const dim = available.has(m.cli) ? "" : DIM;
-    const mark = m.tested ? ` ${G}✓${R}` : "";
-    console.log(`${dim}  ${Y}${String(m.score).padEnd(6)}${R} ${m.name.padEnd(22)} ${tc(m.tier)}${m.tier.padEnd(10)}${R} ${m.cli.padEnd(10)} ${DIM}${m.flag}${R}${mark}${dim ? R : ""}`);
-  }
-  console.log(`\n  ${DIM}✓ = swarm-benchmarked  |  dimmed = CLI not installed${R}`);
-  console.log(`  ${DIM}Filter: --fast  --balanced  --deep  --available${R}`);
-  console.log(`  ${DIM}Full table: https://0dai.dev/models${R}\n`);
-}
-
-// --- Session (local, file-based) ---
-function cmdSession(target, sub, args) {
-  const sessFile = path.join(target, "ai", "sessions", "active.json");
-  const sessDir = path.dirname(sessFile);
-
-  if (sub === "save") {
-    fs.mkdirSync(sessDir, { recursive: true });
-    const goal = args.find((_, i) => args[i - 1] === "--goal") || "";
-    const summary = args.find((_, i) => args[i - 1] === "--summary") || "";
-    const session = {
-      id: `sess-${Date.now()}`,
-      started: new Date().toISOString(),
-      current_agent: "cli",
-      task: { goal: goal || summary || "active session", status: "in_progress" },
-      handoff_notes: summary,
-      context: { files_touched: [] },
-    };
-    if (fs.existsSync(sessFile)) {
-      const existing = JSON.parse(fs.readFileSync(sessFile, "utf8"));
-      existing.handoff_notes = summary || existing.handoff_notes;
-      if (goal) existing.task.goal = goal;
-      existing.updated = new Date().toISOString();
-      fs.writeFileSync(sessFile, JSON.stringify(existing, null, 2));
-      log("session updated");
-    } else {
-      fs.writeFileSync(sessFile, JSON.stringify(session, null, 2));
-      log(`session started: ${session.id}`);
-    }
-    return;
-  }
-  if (sub === "status") {
-    if (!fs.existsSync(sessFile)) { log("no active session"); return; }
-    const s = JSON.parse(fs.readFileSync(sessFile, "utf8"));
-    log(`session: ${(s.task || {}).goal || "?"}`);
-    console.log(`  agent: ${s.current_agent || "?"}`);
-    if (s.handoff_notes) console.log(`  handoff: ${s.handoff_notes}`);
-    return;
-  }
-  if (sub === "complete") {
-    if (!fs.existsSync(sessFile)) { log("no active session"); return; }
-    const archiveDir = path.join(target, "ai", "sessions", "archive");
-    fs.mkdirSync(archiveDir, { recursive: true });
-    const s = JSON.parse(fs.readFileSync(sessFile, "utf8"));
-    fs.writeFileSync(path.join(archiveDir, `${s.id || "session"}.json`), JSON.stringify(s, null, 2));
-    fs.unlinkSync(sessFile);
-    log(`session ${s.id} archived`);
-    return;
-  }
-  console.log("Usage: 0dai session [save|status|complete] [--goal '...'] [--summary '...']");
-}
-
-// --- Swarm (local, file-based) ---
-function cmdSwarm(target, sub, args) {
-  const swarmDir = path.join(target, "ai", "swarm");
-  const queueDir = path.join(swarmDir, "queue");
-
-  if (sub === "status") {
-    const count = (d) => { try { return fs.readdirSync(d).filter(f => f.endsWith(".json")).length; } catch { return 0; } };
-    const q = count(path.join(swarmDir, "queue"));
-    const a = count(path.join(swarmDir, "active"));
-    const d = count(path.join(swarmDir, "done"));
-    log(`swarm: ${q} queued, ${a} active, ${d} done`);
-    return;
-  }
-  if (sub === "add" || sub === "delegate") {
-    fs.mkdirSync(queueDir, { recursive: true });
-    const task = args.find((_, i) => args[i - 1] === "--task") || "untitled";
-    const forAgent = args.find((_, i) => ["--for", "--to"].includes(args[i - 1])) || "any";
-    const id = `swarm-${Date.now()}`;
-    const t = { id, title: task, assigned_to: forAgent, status: "pending", created_at: new Date().toISOString(), created_by: "cli" };
-    fs.writeFileSync(path.join(queueDir, `${id}.json`), JSON.stringify(t, null, 2));
-    log(`task created: ${id} → ${forAgent}`);
-    return;
-  }
-  if (sub === "webhook") {
-    const webhooksFile = path.join(swarmDir, "webhooks.json");
-    const loadHooks = () => { try { return JSON.parse(fs.readFileSync(webhooksFile, "utf8")); } catch { return []; } };
-    const saveHooks = (h) => { fs.mkdirSync(swarmDir, { recursive: true }); fs.writeFileSync(webhooksFile, JSON.stringify(h, null, 2)); };
-    const action = args[2] || "";
-
-    if (action === "add") {
-      const url = args[3] || args.find((_, i) => args[i-1] === "--url");
-      const event = args.find((_, i) => args[i-1] === "--event") || "all";
-      const secret = args.find((_, i) => args[i-1] === "--secret") || "";
-      if (!url || !url.startsWith("http")) { log("Usage: 0dai swarm webhook add <url> [--event task_done|task_failed|all] [--secret TOKEN]"); return; }
-      // MED: SSRF protection — block internal/metadata endpoints
-      try {
-        const u = new URL(url);
-        const host = u.hostname;
-        const BLOCKED = /^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|::1$|fc00:|fe80:|localhost$|0\.0\.0\.0$)/i;
-        if (BLOCKED.test(host) || host === "metadata.google.internal") {
-          log(`rejected: ${host} is a private/internal address (SSRF protection)`);
-          return;
-        }
-        if (u.protocol !== "https:" && u.protocol !== "http:") {
-          log(`rejected: only http/https allowed, got ${u.protocol}`);
-          return;
-        }
-      } catch {
-        log(`invalid URL: ${url}`);
-        return;
-      }
-      const hooks = loadHooks();
-      if (hooks.find(h => h.url === url)) { log(`already registered: ${url}`); return; }
-      hooks.push({ url, event, secret: secret || undefined, added_at: new Date().toISOString() });
-      saveHooks(hooks);
-      log(`webhook added: ${url} (event: ${event})`);
-      return;
-    }
-    if (action === "list") {
-      const hooks = loadHooks();
-      if (hooks.length === 0) { log("no webhooks registered. Use: 0dai swarm webhook add <url>"); return; }
-      console.log(`\n  ${T}Registered webhooks${R}\n`);
-      hooks.forEach((h, i) => {
-        console.log(`  ${i+1}. ${h.url}`);
-        console.log(`     ${D}event: ${h.event}  added: ${h.added_at?.slice(0,10)}${R}`);
-      });
-      console.log();
-      return;
-    }
-    if (action === "remove") {
-      const url = args[3] || "";
-      if (!url) { log("Usage: 0dai swarm webhook remove <url>"); return; }
-      const hooks = loadHooks().filter(h => h.url !== url);
-      saveHooks(hooks);
-      log(`removed: ${url}`);
-      return;
-    }
-    if (action === "test") {
-      const url = args[3] || loadHooks()[0]?.url;
-      if (!url) { log("Usage: 0dai swarm webhook test <url>"); return; }
-      const payload = JSON.stringify({ event: "test", task_id: "test-ping", title: "Webhook test from 0dai", status: "done", timestamp: new Date().toISOString() });
-      const req = https.request(url, { method: "POST", headers: { "Content-Type": "application/json", "User-Agent": "0dai-swarm/1.0", "Content-Length": Buffer.byteLength(payload) } }, (res) => {
-        log(`test sent to ${url} → HTTP ${res.statusCode}`);
-      });
-      req.on("error", (e) => log(`test failed: ${e.message}`));
-      req.setTimeout(5000, () => { req.destroy(); log("test timed out"); });
-      req.write(payload);
-      req.end();
-      return;
-    }
-    console.log("Usage: 0dai swarm webhook [add|list|remove|test] <url> [--event all|task_done|task_failed] [--secret TOKEN]");
-    return;
-  }
-  if (sub === "budget") {
-    const budgetFile = path.join(swarmDir, "budget.json");
-    if (!fs.existsSync(budgetFile)) { log("no budget data yet"); return; }
-    const b = JSON.parse(fs.readFileSync(budgetFile, "utf8"));
-    const B2 = process.stdout.isTTY ? "\x1b[1m" : "";
-    const R2 = process.stdout.isTTY ? "\x1b[0m" : "";
-    const D2 = process.stdout.isTTY ? "\x1b[2m" : "";
-    const G2 = process.stdout.isTTY ? "\x1b[32m" : "";
-    const W2 = process.stdout.isTTY ? "\x1b[33m" : "";
-    const today = new Date().toISOString().slice(0, 10);
-    const sessionKey = process.env.ODAI_SESSION_ID ||
-      new Date().toISOString().slice(0, 13).replace("T", "-");
-    const dailySpent = b.daily?.[today] || 0;
-    const totalSpent = b.total_spent || 0;
-    const sess = b.sessions?.[sessionKey];
-    // Tier distribution across all tasks
-    const tierCount = { fast: 0, balanced: 0, deep: 0 };
-    for (const t of Object.values(b.tasks || {})) {
-      if (t.tier && tierCount[t.tier] !== undefined) tierCount[t.tier]++;
-    }
-    const tieredTotal = tierCount.fast + tierCount.balanced + tierCount.deep;
-    console.log(`\n  ${B2}Swarm Budget${R2}`);
-    if (sess && sess.total_cost > 0) {
-      const taskCount = (sess.tasks || []).length;
-      const avgCost = taskCount > 0 ? (sess.total_cost / taskCount).toFixed(4) : "0";
-      console.log(`    ${B2}This session${R2}  $${sess.total_cost.toFixed(4)} · ${taskCount} tasks · avg $${avgCost}/task`);
-      if (sess.tiers) {
-        const tiers = Object.entries(sess.tiers).filter(([, n]) => n > 0).map(([t, n]) => `${n}×${t}`).join("  ");
-        if (tiers) console.log(`    ${D2}Tiers          ${tiers}${R2}`);
-      }
-    } else {
-      console.log(`    ${D2}This session   no tracked spend${R2}`);
-    }
-    if (dailySpent > 0) {
-      const dailyLimit = parseFloat(process.env.ODAI_DAILY_BUDGET || "5");
-      const pct = Math.round((dailySpent / dailyLimit) * 100);
-      const bar = "█".repeat(Math.round(pct / 5)).padEnd(20, "░");
-      const col = pct < 50 ? G2 : pct < 80 ? W2 : "\x1b[31m";
-      console.log(`    ${B2}Today${R2}         ${col}$${dailySpent.toFixed(4)}${R2} / $${dailyLimit.toFixed(2)} ${D2}${bar} ${pct}%${R2}`);
-    }
-    console.log(`    ${B2}All time${R2}      ${D2}$${totalSpent.toFixed(4)} (${Object.keys(b.tasks || {}).length} tasks)${R2}`);
-    if (tieredTotal > 0) {
-      const fastPct = Math.round((tierCount.fast / tieredTotal) * 100);
-      console.log(`    ${D2}Model routing  ${tierCount.fast}×fast  ${tierCount.balanced}×balanced  ${tierCount.deep}×deep  (${fastPct}% cheap)${R2}`);
-    }
-    // Recent sessions (last 5)
-    const sessions = Object.entries(b.sessions || {})
-      .sort(([a], [bb]) => bb.localeCompare(a))
-      .slice(0, 5);
-    if (sessions.length > 1) {
-      console.log(`    ${D2}Recent sessions:${R2}`);
-      for (const [key, s] of sessions) {
-        const tasks = (s.tasks || []).length;
-        console.log(`      ${D2}${key}  $${(s.total_cost || 0).toFixed(4)} · ${tasks} tasks${R2}`);
-      }
-    }
-    console.log();
-    return;
-  }
-  console.log("Usage: 0dai swarm [status|add|delegate|budget] [--task '...'] [--to agent]");
-}
-
-// --- Feedback (local + API push) ---
-async function cmdFeedback(target, sub, args) {
-  const fbDir = path.join(target, "ai", "feedback");
-
-  if (sub === "push") {
-    return cmdFeedbackPush(target);
-  }
-  if (sub === "log") {
-    const type = args.find((_, i) => args[i - 1] === "--type") || "suggestion";
-    const detail = args.find((_, i) => args[i - 1] === "--detail") || "";
-    if (!detail) { console.log("Usage: 0dai feedback log --type bug|suggestion|friction|positive --detail '...'"); return; }
-    fs.mkdirSync(fbDir, { recursive: true });
-    const entry = JSON.stringify({ ts: new Date().toISOString(), type, detail, agent: "cli" });
-    fs.appendFileSync(path.join(fbDir, "operational.jsonl"), entry + "\n");
-    log(`logged: [${type}] ${detail.slice(0, 60)}`);
-    return;
-  }
-  if (sub === "list") {
-    try {
-      const files = fs.readdirSync(fbDir).filter(f => f.endsWith("-report.json"));
-      if (!files.length) { log("no reports"); return; }
-      for (const f of files) {
-        try {
-          const d = JSON.parse(fs.readFileSync(path.join(fbDir, f), "utf8"));
-          console.log(`  ${f}: ${d.verdict || "?"} (${d.project || "?"})`);
-        } catch {}
-      }
-    } catch { log("no feedback directory"); }
-    return;
-  }
-  console.log("Usage: 0dai feedback [push|log|list] [--type ...] [--detail '...']");
-}
-
-function cmdWatch(target, args) {
-  const isTTY = process.stdout.isTTY;
-  const B2 = isTTY ? "\x1b[1m" : "";
-  const DIM = isTTY ? "\x1b[2m" : "";
-  const G = isTTY ? "\x1b[32m" : "";
-  const Y = isTTY ? "\x1b[33m" : "";
-  const C = isTTY ? "\x1b[36m" : "";
-  const M = isTTY ? "\x1b[35m" : "";
-  const R2 = isTTY ? "\x1b[0m" : "";
-
-  const swarmDir = path.join(target, "ai", "swarm");
-  const interval = parseInt(args.find((_, i) => args[i - 1] === "--interval") || "3", 10) * 1000;
-
-  function readDir(dir) {
-    try {
-      return fs.readdirSync(dir)
-        .filter(f => f.endsWith(".json"))
-        .map(f => { try { return JSON.parse(fs.readFileSync(path.join(dir, f), "utf8")); } catch { return null; } })
-        .filter(Boolean);
-    } catch { return []; }
-  }
-
-  function ago(ts) {
-    if (!ts) return "—";
-    const s = Math.floor((Date.now() - new Date(ts).getTime()) / 1000);
-    if (s < 60) return `${s}s`;
-    if (s < 3600) return `${Math.floor(s / 60)}m`;
-    return `${Math.floor(s / 3600)}h`;
-  }
-
-  function tierColor(tier) {
-    if (tier === "deep") return M;
-    if (tier === "fast") return C;
-    return G;
-  }
-
-  function statusColor(status) {
-    if (status === "done") return G;
-    if (status === "active" || status === "running") return Y;
-    if (status === "failed") return "\x1b[31m";
-    return DIM;
-  }
-
-  function render() {
-    const queue  = readDir(path.join(swarmDir, "queue"));
-    const active = readDir(path.join(swarmDir, "active"));
-    const done   = readDir(path.join(swarmDir, "done")).sort(
-      (a, b) => new Date(b.completed_at || b.created_at) - new Date(a.completed_at || a.created_at)
-    ).slice(0, 8);
-
-    const lines = [];
-    const w = process.stdout.columns || 100;
-    const sep = DIM + "─".repeat(Math.min(w, 96)) + R2;
-
-    lines.push(`\n  ${B2}${T}0dai watch${R2}  ${DIM}${new Date().toLocaleTimeString()}  (q to quit)${R2}`);
-    lines.push(sep);
-
-    const header = `  ${"STATUS".padEnd(9)} ${"AGENT".padEnd(10)} ${"TIER".padEnd(9)} ${"AGE".padEnd(6)}  TITLE`;
-    lines.push(DIM + header + R2);
-    lines.push(sep);
-
-    const printTask = (t, statusOverride) => {
-      const status = statusOverride || t.status || "queued";
-      const sc = statusColor(status);
-      const tc = tierColor(t.model_tier);
-      const title = (t.title || "—").slice(0, Math.max(20, w - 42));
-      const age = ago(t.created_at);
-      lines.push(
-        `  ${sc}${status.padEnd(9)}${R2} ` +
-        `${DIM}${(t.assigned_to || "—").padEnd(10)}${R2} ` +
-        `${tc}${(t.model_tier || "—").padEnd(9)}${R2} ` +
-        `${DIM}${age.padEnd(6)}${R2}  ${title}`
-      );
-    };
-
-    if (active.length) {
-      active.forEach(t => printTask(t, "active"));
-    }
-    if (queue.length) {
-      queue.forEach(t => printTask(t, "queued"));
-    }
-    if (!active.length && !queue.length) {
-      lines.push(`  ${DIM}No tasks in queue or active.${R2}`);
-    }
-
-    lines.push(sep);
-    if (done.length) {
-      lines.push(`  ${DIM}Recently done:${R2}`);
-      done.forEach(t => printTask(t, "done"));
-    }
-
-    lines.push(`\n  ${DIM}queue: ${queue.length}  active: ${active.length}  done (total): ${readDir(path.join(swarmDir, "done")).length}${R2}\n`);
-
-    if (isTTY) process.stdout.write("\x1b[2J\x1b[H");
-    console.log(lines.join("\n"));
-  }
-
-  render();
-  const timer = setInterval(render, interval);
-
-  // Exit on 'q' or Ctrl+C
-  if (isTTY && process.stdin.setRawMode) {
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.once("data", (key) => {
-      clearInterval(timer);
-      process.stdin.setRawMode(false);
-      process.exit(0);
-    });
-  }
-  process.on("SIGINT", () => { clearInterval(timer); process.exit(0); });
-}
+/**
+ * 0dai CLI entry point — routing only.
+ *
+ * All command implementations live in lib/commands/*.js.
+ * Shared config and utilities live in lib/shared.js.
+ */
+
+const shared = require("../lib/shared");
+const { T, R, D, log, VERSION, fs, path, spawnSync, findRepoScript, checkVersion } = shared;
+
+// --- Command imports ---
+const { cmdAuthLogin, cmdAuthLogout, cmdRedeem, cmdAuthStatus, cmdActivateFree, cmdActivateStatus } = require("../lib/commands/auth");
+const { cmdInit, cmdSync } = require("../lib/commands/init");
+const { cmdDetect } = require("../lib/commands/detect");
+const { cmdAudit } = require("../lib/commands/audit");
+const { cmdDoctor } = require("../lib/commands/doctor");
+const { cmdValidate } = require("../lib/commands/validate");
+const { cmdUpdate } = require("../lib/commands/update");
+const { cmdReflect } = require("../lib/commands/reflect");
+const { cmdMetrics } = require("../lib/commands/metrics");
+const { cmdStatus } = require("../lib/commands/status");
+const { cmdPortfolio } = require("../lib/commands/portfolio");
+const { cmdRun } = require("../lib/commands/run");
+const { cmdWatch } = require("../lib/commands/watch");
+const { cmdModels } = require("../lib/commands/models");
+const { cmdSession } = require("../lib/commands/session");
+const { cmdSwarm } = require("../lib/commands/swarm");
+const { cmdFeedback, cmdFeedbackPush } = require("../lib/commands/feedback");
+const { cmdGraph } = require("../lib/commands/graph");
+const { cmdReport } = require("../lib/commands/report");
+const { cmdExperience } = require("../lib/commands/experience");
 
 async function main() {
   const args = process.argv.slice(2);
@@ -2161,14 +45,59 @@ async function main() {
   // Non-blocking version check (runs in background, once per day)
   checkVersion();
 
+  // Track first run for time-to-init telemetry
+  try { require("../lib/onboarding").trackFirstRun(target); } catch {}
+
+  // First-run wizard prompt for commands that need ai/
+  if (["status", "doctor", "sync", "swarm", "detect", "validate", "reflect", "metrics", "experience", "graph", "session", "report"].includes(cmd)) {
+    try {
+      const { maybeWizard } = require("../lib/wizard");
+      const handled = await maybeWizard(target, cmd);
+      if (handled) return;
+    } catch {}
+  }
+
   switch (cmd) {
+    case "quickstart": {
+      const ob = require("../lib/onboarding");
+      await ob.cmdQuickstart(target, { cmdDoctor, cmdStatus, cmdInit: (t, a) => cmdInit(t, a || []), log, ensureAuthenticated: shared.makeEnsureAuthenticated(cmdAuthLogin) });
+      break;
+    }
     case "run": await cmdRun(args[1] || "", target, args.slice(2)); break;
     case "watch": cmdWatch(target, args.slice(1)); break;
     case "audit": cmdAudit(target); break;
+    case "security": {
+      const secScript = findRepoScript(target, "scan_secrets.py");
+      if (!secScript) { log("secret scanner unavailable"); break; }
+      const fwd = [secScript, "--target", target];
+      if (args.includes("--json")) fwd.push("--json");
+      if (args.includes("--fix")) fwd.push("--fix");
+      const sr = spawnSync("python3", fwd, { stdio: "inherit" });
+      if (typeof sr.status === "number") process.exit(sr.status);
+      break;
+    }
     case "init": await cmdInit(target, args); break;
     case "sync": await cmdSync(target, args); break;
     case "detect": await cmdDetect(target); break;
-    case "doctor": cmdDoctor(target); break;
+    case "doctor":
+      cmdDoctor(target);
+      if (args.includes("--drift")) {
+        const ds = findRepoScript(target, "drift_detector.py");
+        if (ds) spawnSync("python3", [ds, "report", "--target", target], { stdio: "inherit" });
+      }
+      break;
+    case "drift": {
+      const ds = findRepoScript(target, "drift_detector.py");
+      if (!ds) { log("drift detector unavailable"); break; }
+      if (sub === "accept" && args[2]) {
+        spawnSync("python3", [ds, "accept", args[2], "--target", target], { stdio: "inherit" });
+      } else if (sub === "show" && args[2]) {
+        spawnSync("python3", [ds, "show", args[2], "--target", target], { stdio: "inherit" });
+      } else {
+        spawnSync("python3", [ds, "report", "--target", target], { stdio: "inherit" });
+      }
+      break;
+    }
     case "validate": cmdValidate(target); break;
     case "reflect": cmdReflect(target, args); break;
     case "update": cmdUpdate(args); break;
@@ -2179,13 +108,19 @@ async function main() {
       if (sub === "login") await cmdAuthLogin();
       else if (sub === "logout") cmdAuthLogout();
       else if (sub === "status") await cmdAuthStatus();
-      else {
-        console.log("Usage: 0dai auth [login|logout|status]");
-      }
+      else console.log("Usage: 0dai auth [login|logout|status]");
+      break;
+    case "activate":
+      if (sub === "free" || !sub) await cmdActivateFree();
+      else if (sub === "status") await cmdActivateStatus();
+      else console.log("Usage: 0dai activate [free|status]");
       break;
     case "session": cmdSession(target, sub, args); break;
     case "swarm": cmdSwarm(target, sub, args); break;
     case "feedback": await cmdFeedback(target, sub, args); break;
+    case "report": cmdReport(target, sub, args); break;
+    case "experience": cmdExperience(target, sub, args); break;
+    case "graph": await cmdGraph(target, sub, args); break;
     case "models": cmdModels(sub || args[1]); break;
     case "redeem": await cmdRedeem(sub || args[1]); break;
     case "terminal": case "term":
@@ -2207,7 +142,6 @@ async function main() {
             log(`unknown tool: ${tool}. Available: ${Object.keys(TOOL_CMDS).join(", ")}`);
             break;
           }
-          // Pass initial prompt if provided after --
           const dashIdx = args.indexOf("--");
           const prompt = dashIdx >= 0 ? args.slice(dashIdx + 1).join(" ") : "";
           const spawnArgs = [...toolConfig.args];
@@ -2236,7 +170,6 @@ async function main() {
           const prefix = args[1] || "";
           if (!prefix) { log("usage: 0dai terminal kill <session-id-prefix>"); break; }
           const all = Array.from(sm.sessions || []);
-          // Kill by prefix match
           let found = false;
           for (const [id] of all) {
             if (id.startsWith(prefix)) { sm.kill(id); log(`killed ${id.slice(0, 8)}`); found = true; }
@@ -2274,11 +207,21 @@ async function main() {
       console.log("  swarm webhook list Show registered webhooks");
       console.log("  swarm webhook test Send test ping to a webhook URL");
       console.log("  feedback push  Send feedback to 0dai");
+      console.log("  report preview Preview privacy-safe project report");
+      console.log("  report push    Send report to 0dai (with offline queue)");
+      console.log("  report status  Show last report, queue, and auto-report status");
+      console.log("  experience list  Show recent structured experience events");
+      console.log("  experience stats Show success and cost stats by agent/model/type");
+      console.log("  graph push     Upload local graph to server (Pro: edges, Free: nodes)");
+      console.log("  graph pull     Download server graph and merge locally");
+      console.log("  graph status   Show local graph stats and sync state");
       console.log("  models         Show model ratings (--fast/--balanced/--deep/--available)");
       console.log("  terminal       Launch interactive agent session");
       console.log("  auth login     Authenticate (device code flow)");
       console.log("  auth logout    Remove credentials");
       console.log("  auth status    Show account and usage");
+      console.log("  activate free  Claim free activation license");
+      console.log("  activate status Show activation and bound-project status");
       console.log("  redeem <CODE>  Redeem a plan upgrade code");
       console.log("  --version\n");
       console.log("https://0dai.dev");