@agent-team-foundation/first-tree-hub 0.9.10 → 0.9.11

package/dist/{core-BWaSYpXv.mjs → core-CuSIXoof.mjs}

@@ -1,15 +1,14 @@
 import { m as __toESM } from "./esm-CYu4tXXn.mjs";
-import { _ as withSpan, a as endWsConnectionSpan, b as require_pino, c as messageAttrs, d as rootLogger$1, g as startWsConnectionSpan, i as currentTraceId, n as applyLoggerConfig, o as getFastifyOtelPlugin, p as setWsConnectionAttrs, r as createLogger$1, t as adapterAttrs, u as observabilityPlugin, v as withWsMessageSpan, y as FIRST_TREE_HUB_ATTR } from "./observability-DV_fQKqV-CuLWzBxQ.mjs";
-import { s as formatPrettyEntry$1, t as LOG_LEVELS$1, u as parseLogLevel$1 } from "./logger-core-BTmvdflj-DhdipBkV.mjs";
-import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, d as DEFAULT_HOME_DIR$1, f as agentConfigSchema, g as initConfig, i as loadCredentials, l as DEFAULT_CONFIG_DIR, m as collectMissingPrompts, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, s as saveAgentConfig, u as DEFAULT_DATA_DIR$1, v as migrateLegacyHome, w as setConfigValue } from "./bootstrap-hh_PkTu6.mjs";
-import { $ as sessionStateMessageSchema, A as createMemberSchema, B as loginSchema, C as agentTypeSchema$1, D as createAdapterMappingSchema, E as createAdapterConfigSchema, F as extractMentions, G as runtimeStateMessageSchema, H as notificationQuerySchema, I as imageInlineContentSchema, J as sendToAgentSchema, K as selfServiceFeishuBotSchema, L as inboxPollQuerySchema, M as createTaskSchema, N as delegateFeishuUserSchema, O as createAgentSchema, P as dryRunAgentRuntimeConfigSchema, Q as sessionReconcileRequestSchema, R as isRedactedEnvValue, S as agentRuntimeConfigPayloadSchema$1, T as connectTokenExchangeSchema, U as paginationQuerySchema, V as messageSourceSchema$1, W as refreshTokenSchema, X as sessionEventMessageSchema, Y as sessionCompletionMessageSchema, Z as sessionEventSchema$1, _ as addParticipantSchema, a as AGENT_SELECTOR_HEADER$1, at as updateMemberSchema, b as agentBindRequestSchema, c as AGENT_TYPES, ct as updateTaskStatusSchema, d as SYSTEM_CONFIG_DEFAULTS, et as taskListQuerySchema, f as TASK_CREATOR_TYPES, g as WS_AUTH_FRAME_TIMEOUT_MS, h as TASK_TERMINAL_STATUSES, i as AGENT_BIND_REJECT_REASONS, it as updateChatSchema, j as createOrganizationSchema, k as createChatSchema, l as AGENT_VISIBILITY, lt as wsAuthFrameSchema, m as TASK_STATUSES, nt as updateAgentRuntimeConfigSchema, o as AGENT_SOURCES, ot as updateOrganizationSchema, p as TASK_HEALTH_SIGNALS, q as sendMessageSchema, rt as updateAgentSchema, s as AGENT_STATUSES, st as updateSystemConfigSchema, tt as updateAdapterConfigSchema, u as DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD, v as adminCreateTaskSchema, w as clientRegisterSchema, x as agentPinnedMessageSchema$1, y as adminUpdateTaskSchema, z as linkTaskChatSchema } from "./feishu-BJaN64iR.mjs";
+import { _ as withSpan, a as endWsConnectionSpan, b as require_pino, c as messageAttrs, d as rootLogger$1, g as startWsConnectionSpan, i as currentTraceId, n as applyLoggerConfig, o as getFastifyOtelPlugin, p as setWsConnectionAttrs, r as createLogger$1, t as adapterAttrs, u as observabilityPlugin, v as withWsMessageSpan, y as FIRST_TREE_HUB_ATTR } from "./observability-DV_fQKqV-oxfXX6Z2.mjs";
+import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, d as DEFAULT_HOME_DIR$1, f as agentConfigSchema, g as initConfig, i as loadCredentials, l as DEFAULT_CONFIG_DIR, m as collectMissingPrompts, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, s as saveAgentConfig, u as DEFAULT_DATA_DIR$1, v as migrateLegacyHome, w as setConfigValue } from "./bootstrap-CtVqQA8a.mjs";
+import { $ as sessionEventSchema$1, A as createChatSchema, B as isReservedAgentName$1, C as agentRuntimeConfigPayloadSchema$1, D as createAdapterConfigSchema, E as connectTokenExchangeSchema, F as dryRunAgentRuntimeConfigSchema, G as paginationQuerySchema, H as loginSchema, I as extractMentions, J as selfServiceFeishuBotSchema, K as refreshTokenSchema, L as imageInlineContentSchema, M as createOrganizationSchema, N as createTaskSchema, O as createAdapterMappingSchema, P as delegateFeishuUserSchema, Q as sessionEventMessageSchema, R as inboxPollQuerySchema, S as agentPinnedMessageSchema$1, T as clientRegisterSchema, U as messageSourceSchema$1, V as linkTaskChatSchema, W as notificationQuerySchema, X as sendToAgentSchema, Y as sendMessageSchema, Z as sessionCompletionMessageSchema, _ as WS_AUTH_FRAME_TIMEOUT_MS, a as AGENT_NAME_REGEX$1, at as updateAgentSchema, b as adminUpdateTaskSchema, c as AGENT_STATUSES, ct as updateOrganizationSchema, d as DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD, dt as wsAuthFrameSchema, et as sessionReconcileRequestSchema, f as SYSTEM_CONFIG_DEFAULTS, g as TASK_TERMINAL_STATUSES, h as TASK_STATUSES, i as AGENT_BIND_REJECT_REASONS, it as updateAgentRuntimeConfigSchema, j as createMemberSchema, k as createAgentSchema, l as AGENT_TYPES, lt as updateSystemConfigSchema, m as TASK_HEALTH_SIGNALS, nt as taskListQuerySchema, o as AGENT_SELECTOR_HEADER$1, ot as updateChatSchema, p as TASK_CREATOR_TYPES, q as runtimeStateMessageSchema, rt as updateAdapterConfigSchema, s as AGENT_SOURCES, st as updateMemberSchema, tt as sessionStateMessageSchema, u as AGENT_VISIBILITY, ut as updateTaskStatusSchema, v as addParticipantSchema, w as agentTypeSchema$1, x as agentBindRequestSchema, y as adminCreateTaskSchema, z as isRedactedEnvValue } from "./feishu-B2sjp6Z6.mjs";
 import { createRequire } from "node:module";
 import { ZodError, z } from "zod";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { Writable } from "node:stream";
 import { homedir, hostname, platform, tmpdir, userInfo } from "node:os";
 import { EventEmitter } from "node:events";
-import { closeSync, copyFileSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, unwatchFile, watch, watchFile, writeFileSync, writeSync } from "node:fs";
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync, writeSync } from "node:fs";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import WebSocket from "ws";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -32,7 +31,6 @@ import Fastify from "fastify";
 import { bigserial, boolean, index, integer, jsonb, pgTable, primaryKey, serial, text, timestamp, unique, uniqueIndex } from "drizzle-orm/pg-core";
 import { SignJWT, jwtVerify } from "jose";
 import { Client, EventDispatcher, LoggerLevel, WSClient } from "@larksuiteoapi/node-sdk";
-import { createInterface } from "node:readline";
 //#region ../client/dist/observability-B4kO005X.mjs
 var import_pino = /* @__PURE__ */ __toESM(require_pino(), 1);
 /**
@@ -430,8 +428,31 @@ const agentTypeSchema = z.enum([
 const agentVisibilitySchema = z.enum(["private", "organization"]);
 const agentSourceSchema = z.enum(["admin-api", "portal"]);
 z.enum(["active", "suspended"]);
+/**
+* Agent-name rules (see docs/agent-naming-design.md §3.1):
+*   - Lowercase ASCII slug, hyphens + underscores allowed.
+*   - Must start with alphanumeric: `-` / `_` as first char collide with
+*     CLI flag parsing and markdown list syntax.
+*   - 1–64 chars — aligned with `MENTION_REGEX` so any valid name can be
+*     @-mentioned in chat. Older rows created under the previous 1–100
+*     regex are grandfathered; the tight rule only gates new creates.
+*/
+const AGENT_NAME_REGEX = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const RESERVED_AGENT_NAMES_SET = new Set([
+	"admin",
+	"agent",
+	"first-tree",
+	"hub",
+	"me",
+	"null",
+	"system",
+	"undefined"
+]);
+function isReservedAgentName(name) {
+	return RESERVED_AGENT_NAMES_SET.has(name);
+}
 z.object({
-	name: z.string().min(1).max(100).regex(/^[a-z0-9_-]+$/, "Only lowercase alphanumeric, hyphens, and underscores").optional(),
+	name: z.string().min(1).max(64).regex(AGENT_NAME_REGEX, "Must start with a letter or digit and contain only lowercase letters, digits, hyphens (-), and underscores (_). Max 64 chars.").refine((n) => !isReservedAgentName(n), { message: "That agent name is reserved — pick a different one." }).optional(),
 	type: agentTypeSchema,
 	displayName: z.string().max(200).optional(),
 	delegateMention: z.string().max(100).optional(),
@@ -5373,386 +5394,84 @@ function getContainerPassword() {
 	throw new Error("Cannot determine PostgreSQL password from container");
 }
 //#endregion
-//#region src/core/doctor.ts
-function getServerConfig() {
-	return resolveConfigReadonly({
-		schema: serverConfigSchema,
-		role: "server"
-	});
-}
-function getClientConfig() {
-	return resolveConfigReadonly({
-		schema: clientConfigSchema,
-		role: "client"
+//#region src/core/service-install.ts
+/**
+* Run a subprocess capturing stderr so failures surface a meaningful error
+* instead of Node's opaque "Command failed". Used for launchctl/systemctl —
+* anywhere the stderr message is diagnostically crucial.
+*/
+function runCapture(program, args, timeoutMs) {
+	const res = spawnSync(program, args, {
+		encoding: "utf-8",
+		timeout: timeoutMs,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
 	});
-}
-function get(obj, dotPath) {
-	const parts = dotPath.split(".");
-	let current = obj;
-	for (const part of parts) {
-		if (current === null || current === void 0 || typeof current !== "object") return void 0;
-		current = current[part];
-	}
-	return current;
-}
-function checkNodeVersion() {
-	const version = process.versions.node;
-	const [major] = version.split(".").map(Number);
-	const ok = major !== void 0 && major >= 22;
-	return {
-		label: "Node.js",
-		ok,
-		detail: ok ? `v${version}` : `v${version} (requires >= 22.16)`
-	};
-}
-function checkDocker() {
-	try {
-		return {
-			label: "Docker",
-			ok: true,
-			detail: execFileSync("docker", ["--version"], {
-				encoding: "utf-8",
-				timeout: 5e3
-			}).trim().replace("Docker version ", "v").split(",")[0] ?? ""
-		};
-	} catch {
-		return {
-			label: "Docker",
-			ok: false,
-			detail: "not found (optional — needed for auto PG provisioning)"
-		};
-	}
-}
-function checkServerConfig() {
-	const hasFile = existsSync(join(DEFAULT_CONFIG_DIR, "server.yaml"));
-	const hasEnv = !!process.env.FIRST_TREE_HUB_DATABASE_URL;
-	if (hasFile && hasEnv) return {
-		label: "Config",
-		ok: true,
-		detail: "config file + env vars"
-	};
-	if (hasFile) return {
-		label: "Config",
-		ok: true,
-		detail: join(DEFAULT_CONFIG_DIR, "server.yaml")
-	};
-	if (hasEnv) return {
-		label: "Config",
-		ok: true,
-		detail: "via environment variables"
-	};
+	if (res.status === 0) return { ok: true };
 	return {
-		label: "Config",
 		ok: false,
-		detail: "no config file or env vars found"
+		stderr: (res.stderr ?? "").trim(),
+		code: res.status
 	};
 }
-async function checkDatabase() {
-	const dbUrl = get(getServerConfig(), "database.url");
-	if (typeof dbUrl !== "string" || !dbUrl) return {
-		label: "Database",
-		ok: false,
-		detail: "not configured (FIRST_TREE_HUB_DATABASE_URL or config file)"
-	};
+function sleepSync(ms) {
+	const shared = new Int32Array(new SharedArrayBuffer(4));
+	Atomics.wait(shared, 0, 0, ms);
+}
+const LAUNCHD_LABEL = "dev.first-tree-hub.client";
+const SYSTEMD_UNIT = "first-tree-hub-client.service";
+const LOG_DIR = join(DEFAULT_HOME_DIR$1, "logs");
+function whichBin(name) {
 	try {
-		const { default: pg } = await import("postgres");
-		const sql = pg(dbUrl, {
-			max: 1,
-			connect_timeout: 5,
-			idle_timeout: 1
-		});
-		await sql.unsafe("SELECT 1");
-		await sql.end();
-		return {
-			label: "Database",
-			ok: true,
-			detail: "connected"
-		};
-	} catch (err) {
-		return {
-			label: "Database",
-			ok: false,
-			detail: `unreachable — ${(err instanceof Error ? err.message : String(err)).slice(0, 80)}`
-		};
+		return execFileSync(process.platform === "win32" ? "where" : "which", [name], {
+			encoding: "utf-8",
+			timeout: 3e3
+		}).split(/\r?\n/).map((s) => s.trim()).filter(Boolean)[0] ?? null;
+	} catch {
+		return null;
 	}
 }
-async function checkServerHealth() {
-	const config = getServerConfig();
-	const host = get(config, "server.host") ?? "127.0.0.1";
-	const port = get(config, "server.port") ?? 8e3;
-	const url = `http://${host}:${port}/healthz`;
-	try {
-		const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
-		if (res.ok) return {
-			label: "Server Health",
-			ok: true,
-			detail: `running at ${host}:${port}`
-		};
+/**
+* Resolve how the service should launch the CLI.
+*
+* Prefers the installed `first-tree-hub` bin on PATH (usually a shim under
+* /usr/local/bin or ~/.npm-global/bin). Falls back to invoking the current
+* Node interpreter against the running script (handles `pnpm dev`, tsx, and
+* dev-only global installs).
+*/
+function resolveCliInvocation() {
+	const bin = whichBin("first-tree-hub");
+	if (bin && isAbsolute(bin)) try {
 		return {
-			label: "Server Health",
-			ok: false,
-			detail: `unhealthy (HTTP ${res.status}) at ${host}:${port}`
+			kind: "bin",
+			program: realpathSync(bin)
 		};
 	} catch {
 		return {
-			label: "Server Health",
-			ok: false,
-			detail: `not running at ${host}:${port}`
+			kind: "bin",
+			program: bin
 		};
 	}
-}
-function checkClientConfig() {
-	const hasFile = existsSync(join(DEFAULT_CONFIG_DIR, "client.yaml"));
-	const hasEnv = !!process.env.FIRST_TREE_HUB_SERVER_URL;
-	if (hasFile && hasEnv) return {
-		label: "Config",
-		ok: true,
-		detail: "config file + env vars"
-	};
-	if (hasFile) return {
-		label: "Config",
-		ok: true,
-		detail: join(DEFAULT_CONFIG_DIR, "client.yaml")
-	};
-	if (hasEnv) return {
-		label: "Config",
-		ok: true,
-		detail: "via environment variables"
-	};
+	const script = process.argv[1];
+	if (!script) throw new Error("Cannot resolve CLI entry point (process.argv[1] is empty).");
+	const scriptAbs = isAbsolute(script) ? script : join(process.cwd(), script);
 	return {
-		label: "Config",
-		ok: false,
-		detail: "no config file or env vars found"
+		kind: "node",
+		program: process.execPath,
+		args: [scriptAbs]
 	};
 }
-async function checkServerReachable() {
-	const serverUrl = get(getClientConfig(), "server.url");
-	if (typeof serverUrl !== "string" || !serverUrl) return {
-		label: "Server URL",
-		ok: false,
-		detail: "not configured (FIRST_TREE_HUB_SERVER_URL or config file)"
-	};
-	try {
-		const res = await fetch(`${serverUrl}/healthz`, { signal: AbortSignal.timeout(5e3) });
-		if (res.ok) return {
-			label: "Server URL",
-			ok: true,
-			detail: serverUrl
-		};
-		return {
-			label: "Server URL",
-			ok: false,
-			detail: `unhealthy (HTTP ${res.status}) at ${serverUrl}`
-		};
-	} catch {
-		return {
-			label: "Server URL",
-			ok: false,
-			detail: `unreachable at ${serverUrl}`
-		};
-	}
+function ensureLogDir() {
+	mkdirSync(LOG_DIR, {
+		recursive: true,
+		mode: 448
+	});
 }
-function checkAgentConfigs() {
-	const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
-	if (!existsSync(agentsDir)) return {
-		label: "Agents",
-		ok: false,
-		detail: "no agents configured"
-	};
-	try {
-		const agents = loadAgents({
-			schema: agentConfigSchema,
-			agentsDir
-		});
-		if (agents.size === 0) return {
-			label: "Agents",
-			ok: false,
-			detail: "no agents configured"
-		};
-		const names = [...agents.keys()].join(", ");
-		return {
-			label: "Agents",
-			ok: true,
-			detail: `${agents.size} configured (${names})`
-		};
-	} catch {
-		return {
-			label: "Agents",
-			ok: false,
-			detail: "error reading agent configs"
-		};
-	}
-}
-async function checkWebSocket() {
-	const serverUrl = get(getClientConfig(), "server.url");
-	if (typeof serverUrl !== "string" || !serverUrl) return {
-		label: "WebSocket",
-		ok: false,
-		detail: "cannot check (no server URL)"
-	};
-	const wsUrl = serverUrl.replace(/^http/, "ws");
-	try {
-		if ((await fetch(`${serverUrl}/healthz`, { signal: AbortSignal.timeout(3e3) })).ok) return {
-			label: "WebSocket",
-			ok: true,
-			detail: `${wsUrl} (server reachable)`
-		};
-		return {
-			label: "WebSocket",
-			ok: false,
-			detail: "server not healthy"
-		};
-	} catch {
-		return {
-			label: "WebSocket",
-			ok: false,
-			detail: `server unreachable at ${serverUrl}`
-		};
-	}
-}
-function printResults(results) {
-	for (const r of results) {
-		const icon = r.ok ? "✓" : "✗";
-		print.line(`  ${icon} ${r.label.padEnd(22)} ${r.detail}\n`);
-	}
-	blank();
-	const failures = results.filter((r) => !r.ok);
-	if (failures.length === 0) print.line("  All checks passed.\n");
-	else print.line(`  ${failures.length} issue(s) found.\n`);
-	blank();
-}
-//#endregion
-//#region src/core/migrate.ts
-/**
-* Resolve the drizzle migrations directory.
-* 1. npm install: embedded at dist/drizzle/ (relative to the built CLI)
-* 2. Monorepo dev: resolved from @first-tree-hub/server package
-*/
-function resolveMigrationsFolder() {
-	const embeddedPath = join(dirname(fileURLToPath(import.meta.url)), "..", "drizzle");
-	if (existsSync(embeddedPath)) return embeddedPath;
-	return join(dirname(fileURLToPath(import.meta.resolve("@first-tree-hub/server/package.json"))), "drizzle");
-}
-/**
-* Validate that migration journal timestamps are strictly increasing.
-* Drizzle silently skips migrations whose `when` is <= the last applied
-* timestamp, which causes missing columns/tables with no error.
-*/
-function validateJournalOrder(migrationsFolder) {
-	const journalPath = join(migrationsFolder, "meta", "_journal.json");
-	if (!existsSync(journalPath)) return;
-	const journal = JSON.parse(readFileSync(journalPath, "utf-8"));
-	let prevWhen = 0;
-	let prevTag = "";
-	for (const entry of journal.entries) {
-		if (entry.when <= prevWhen) throw new Error(`Migration journal timestamps are not monotonically increasing:\n  "${prevTag}" (when: ${prevWhen}) >= "${entry.tag}" (when: ${entry.when})\n  Drizzle will silently skip "${entry.tag}". Fix the 'when' values in:\n  ${journalPath}`);
-		prevWhen = entry.when;
-		prevTag = entry.tag;
-	}
-}
-/**
-* Run Drizzle database migrations.
-*/
-async function runMigrations(databaseUrl) {
-	const migrationsFolder = resolveMigrationsFolder();
-	validateJournalOrder(migrationsFolder);
-	const client = postgres(databaseUrl, { max: 1 });
-	const db = drizzle(client);
-	try {
-		await migrate(db, { migrationsFolder });
-	} finally {
-		await client.end();
-	}
-	const countClient = postgres(databaseUrl, { max: 1 });
-	try {
-		return (await countClient`
-      SELECT count(*)::int AS count
-      FROM information_schema.tables
-      WHERE table_schema = 'public' AND table_type = 'BASE TABLE'
-    `)[0].count;
-	} finally {
-		await countClient.end();
-	}
-}
-//#endregion
-//#region src/core/service-install.ts
-/**
-* Run a subprocess capturing stderr so failures surface a meaningful error
-* instead of Node's opaque "Command failed". Used for launchctl/systemctl —
-* anywhere the stderr message is diagnostically crucial.
-*/
-function runCapture(program, args, timeoutMs) {
-	const res = spawnSync(program, args, {
-		encoding: "utf-8",
-		timeout: timeoutMs,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	if (res.status === 0) return { ok: true };
-	return {
-		ok: false,
-		stderr: (res.stderr ?? "").trim(),
-		code: res.status
-	};
-}
-function sleepSync(ms) {
-	const shared = new Int32Array(new SharedArrayBuffer(4));
-	Atomics.wait(shared, 0, 0, ms);
-}
-const LAUNCHD_LABEL = "dev.first-tree-hub.client";
-const SYSTEMD_UNIT = "first-tree-hub-client.service";
-const LOG_DIR$1 = join(DEFAULT_HOME_DIR$1, "logs");
-function whichBin(name) {
-	try {
-		return execFileSync(process.platform === "win32" ? "where" : "which", [name], {
-			encoding: "utf-8",
-			timeout: 3e3
-		}).split(/\r?\n/).map((s) => s.trim()).filter(Boolean)[0] ?? null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve how the service should launch the CLI.
-*
-* Prefers the installed `first-tree-hub` bin on PATH (usually a shim under
-* /usr/local/bin or ~/.npm-global/bin). Falls back to invoking the current
-* Node interpreter against the running script (handles `pnpm dev`, tsx, and
-* dev-only global installs).
-*/
-function resolveCliInvocation() {
-	const bin = whichBin("first-tree-hub");
-	if (bin && isAbsolute(bin)) try {
-		return {
-			kind: "bin",
-			program: realpathSync(bin)
-		};
-	} catch {
-		return {
-			kind: "bin",
-			program: bin
-		};
-	}
-	const script = process.argv[1];
-	if (!script) throw new Error("Cannot resolve CLI entry point (process.argv[1] is empty).");
-	const scriptAbs = isAbsolute(script) ? script : join(process.cwd(), script);
-	return {
-		kind: "node",
-		program: process.execPath,
-		args: [scriptAbs]
-	};
-}
-function ensureLogDir() {
-	mkdirSync(LOG_DIR$1, {
-		recursive: true,
-		mode: 448
-	});
-}
-function launchdPlistPath() {
-	return join(homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+function launchdPlistPath() {
+	return join(homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
 }
 function renderPlist(invocation) {
 	const argsXml = (invocation.kind === "bin" ? [
@@ -5767,8 +5486,8 @@ function renderPlist(invocation) {
 		"start",
 		"--no-interactive"
 	]).map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
-	const stdoutFallback = join(LOG_DIR$1, "client.stdout.log");
-	const stderrFallback = join(LOG_DIR$1, "client.stderr.log");
+	const stdoutFallback = join(LOG_DIR, "client.stdout.log");
+	const stderrFallback = join(LOG_DIR, "client.stderr.log");
 	return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTD/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -5888,7 +5607,7 @@ function installLaunchd() {
 		lastBootstrapErr = res;
 		if (attempt < 2) sleepSync(1e3);
 	}
-	if (lastBootstrapErr) throw new Error(`launchctl bootstrap failed: ${lastBootstrapErr.stderr || `exit ${lastBootstrapErr.code ?? "unknown"}`}\n    Command: launchctl bootstrap ${target} ${plistPath}\n    Recovery: \`launchctl bootout ${target}/${LAUNCHD_LABEL}\` then \`first-tree-hub service install\`.`);
+	if (lastBootstrapErr) throw new Error(`launchctl bootstrap failed: ${lastBootstrapErr.stderr || `exit ${lastBootstrapErr.code ?? "unknown"}`}\n    Command: launchctl bootstrap ${target} ${plistPath}\n    Recovery: \`launchctl bootout ${target}/${LAUNCHD_LABEL}\` then \`first-tree-hub client connect <server-url>\`.`);
 	const enableRes = runCapture("launchctl", ["enable", `${target}/${LAUNCHD_LABEL}`], 5e3);
 	if (!enableRes.ok) print.line(`    warning: launchctl enable: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n`);
 	const { state, detail } = launchdState();
@@ -5896,7 +5615,7 @@ function installLaunchd() {
 		platform: "launchd",
 		label: LAUNCHD_LABEL,
 		unitPath: plistPath,
-		logDir: LOG_DIR$1,
+		logDir: LOG_DIR,
 		state,
 		detail
 	};
@@ -5910,7 +5629,7 @@ function uninstallLaunchd() {
 		platform: "launchd",
 		label: LAUNCHD_LABEL,
 		unitPath: plistPath,
-		logDir: LOG_DIR$1,
+		logDir: LOG_DIR,
 		state: "not-installed"
 	};
 }
@@ -5928,8 +5647,8 @@ Type=simple
 ExecStart=${invocation.kind === "bin" ? `${shellQuote(invocation.program)} client start --no-interactive` : `${shellQuote(invocation.program)} ${invocation.args.map(shellQuote).join(" ")} client start --no-interactive`}
 Restart=always
 RestartSec=10
-StandardOutput=append:${join(LOG_DIR$1, "client.stdout.log")}
-StandardError=append:${join(LOG_DIR$1, "client.stderr.log")}
+StandardOutput=append:${join(LOG_DIR, "client.stdout.log")}
+StandardError=append:${join(LOG_DIR, "client.stderr.log")}
 Environment=PATH=/usr/local/bin:/usr/bin:/bin
 Environment=FIRST_TREE_HUB_SERVICE_MODE=1
 
@@ -5941,128 +5660,453 @@ function shellQuote(value) {
 	if (/^[A-Za-z0-9_\-./:=]+$/.test(value)) return value;
 	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
-function systemdState() {
-	if (!existsSync(systemdUnitPath())) return { state: "not-installed" };
-	const res = spawnSync("systemctl", [
-		"--user",
-		"is-active",
-		SYSTEMD_UNIT
-	], {
-		encoding: "utf-8",
-		timeout: 5e3,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	const out = (res.stdout ?? "").trim();
-	if (res.status === 0 && out === "active") return {
-		state: "active",
-		detail: "running"
+function systemdState() {
+	if (!existsSync(systemdUnitPath())) return { state: "not-installed" };
+	const res = spawnSync("systemctl", [
+		"--user",
+		"is-active",
+		SYSTEMD_UNIT
+	], {
+		encoding: "utf-8",
+		timeout: 5e3,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	const out = (res.stdout ?? "").trim();
+	if (res.status === 0 && out === "active") return {
+		state: "active",
+		detail: "running"
+	};
+	return {
+		state: "inactive",
+		detail: out || "unit present but not active"
+	};
+}
+function installSystemd() {
+	const invocation = resolveCliInvocation();
+	ensureLogDir();
+	const unitPath = systemdUnitPath();
+	mkdirSync(dirname(unitPath), { recursive: true });
+	writeFileSync(unitPath, renderSystemdUnit(invocation), { mode: 420 });
+	const reloadRes = runCapture("systemctl", ["--user", "daemon-reload"], 5e3);
+	if (!reloadRes.ok) throw new Error(`systemctl --user daemon-reload failed: ${reloadRes.stderr || `exit ${reloadRes.code ?? "unknown"}`}`);
+	const enableRes = runCapture("systemctl", [
+		"--user",
+		"enable",
+		"--now",
+		SYSTEMD_UNIT
+	], 1e4);
+	if (!enableRes.ok) throw new Error(`systemctl --user enable --now ${SYSTEMD_UNIT} failed: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n    Recovery: \`systemctl --user stop ${SYSTEMD_UNIT}\` then \`first-tree-hub client connect <server-url>\`.`);
+	const { state, detail } = systemdState();
+	return {
+		platform: "systemd",
+		label: SYSTEMD_UNIT,
+		unitPath,
+		logDir: LOG_DIR,
+		state,
+		detail
+	};
+}
+function uninstallSystemd() {
+	const unitPath = systemdUnitPath();
+	const disableRes = runCapture("systemctl", [
+		"--user",
+		"disable",
+		"--now",
+		SYSTEMD_UNIT
+	], 1e4);
+	if (!disableRes.ok && !/not found|no such|not loaded/i.test(disableRes.stderr)) print.line(`    warning: systemctl disable during uninstall: ${disableRes.stderr || `exit ${disableRes.code ?? "unknown"}`}\n`);
+	if (existsSync(unitPath)) rmSync(unitPath);
+	const reloadRes = runCapture("systemctl", ["--user", "daemon-reload"], 5e3);
+	if (!reloadRes.ok) print.line(`    warning: systemctl daemon-reload during uninstall: ${reloadRes.stderr || `exit ${reloadRes.code ?? "unknown"}`}\n`);
+	return {
+		platform: "systemd",
+		label: SYSTEMD_UNIT,
+		unitPath,
+		logDir: LOG_DIR,
+		state: "not-installed"
+	};
+}
+/** Is background-service install supported on the current platform? */
+function isServiceSupported() {
+	return process.platform === "darwin" || process.platform === "linux";
+}
+/**
+* Install the background service for the current platform.
+*
+* @throws {Error} if the platform is not supported or the service manager fails.
+*/
+function installClientService() {
+	if (process.platform === "darwin") return installLaunchd();
+	if (process.platform === "linux") return installSystemd();
+	throw new Error(`Background service install is not supported on ${process.platform}. Run \`first-tree-hub client start\` manually to keep the computer online.`);
+}
+/** Report the current service state without modifying anything. */
+function getClientServiceStatus() {
+	if (process.platform === "darwin") {
+		const { state, detail } = launchdState();
+		return {
+			platform: "launchd",
+			label: LAUNCHD_LABEL,
+			unitPath: launchdPlistPath(),
+			logDir: LOG_DIR,
+			state,
+			detail
+		};
+	}
+	if (process.platform === "linux") {
+		const { state, detail } = systemdState();
+		return {
+			platform: "systemd",
+			label: SYSTEMD_UNIT,
+			unitPath: systemdUnitPath(),
+			logDir: LOG_DIR,
+			state,
+			detail
+		};
+	}
+	return {
+		platform: "unsupported",
+		label: "",
+		unitPath: "",
+		logDir: LOG_DIR,
+		state: "not-installed",
+		detail: `platform ${process.platform} not supported`
+	};
+}
+/** Uninstall the background service. No-op if not installed. */
+function uninstallClientService() {
+	if (process.platform === "darwin") return uninstallLaunchd();
+	if (process.platform === "linux") return uninstallSystemd();
+	return getClientServiceStatus();
+}
+//#endregion
+//#region src/core/doctor.ts
+function getServerConfig() {
+	return resolveConfigReadonly({
+		schema: serverConfigSchema,
+		role: "server"
+	});
+}
+function getClientConfig() {
+	return resolveConfigReadonly({
+		schema: clientConfigSchema,
+		role: "client"
+	});
+}
+function get(obj, dotPath) {
+	const parts = dotPath.split(".");
+	let current = obj;
+	for (const part of parts) {
+		if (current === null || current === void 0 || typeof current !== "object") return void 0;
+		current = current[part];
+	}
+	return current;
+}
+function checkNodeVersion() {
+	const version = process.versions.node;
+	const [major] = version.split(".").map(Number);
+	const ok = major !== void 0 && major >= 22;
+	return {
+		label: "Node.js",
+		ok,
+		detail: ok ? `v${version}` : `v${version} (requires >= 22.16)`
+	};
+}
+function checkDocker() {
+	try {
+		return {
+			label: "Docker",
+			ok: true,
+			detail: execFileSync("docker", ["--version"], {
+				encoding: "utf-8",
+				timeout: 5e3
+			}).trim().replace("Docker version ", "v").split(",")[0] ?? ""
+		};
+	} catch {
+		return {
+			label: "Docker",
+			ok: false,
+			detail: "not found (optional — needed for auto PG provisioning)"
+		};
+	}
+}
+function checkServerConfig() {
+	const hasFile = existsSync(join(DEFAULT_CONFIG_DIR, "server.yaml"));
+	const hasEnv = !!process.env.FIRST_TREE_HUB_DATABASE_URL;
+	if (hasFile && hasEnv) return {
+		label: "Config",
+		ok: true,
+		detail: "config file + env vars"
+	};
+	if (hasFile) return {
+		label: "Config",
+		ok: true,
+		detail: join(DEFAULT_CONFIG_DIR, "server.yaml")
+	};
+	if (hasEnv) return {
+		label: "Config",
+		ok: true,
+		detail: "via environment variables"
+	};
+	return {
+		label: "Config",
+		ok: false,
+		detail: "no config file or env vars found"
+	};
+}
+async function checkDatabase() {
+	const dbUrl = get(getServerConfig(), "database.url");
+	if (typeof dbUrl !== "string" || !dbUrl) return {
+		label: "Database",
+		ok: false,
+		detail: "not configured (FIRST_TREE_HUB_DATABASE_URL or config file)"
+	};
+	try {
+		const { default: pg } = await import("postgres");
+		const sql = pg(dbUrl, {
+			max: 1,
+			connect_timeout: 5,
+			idle_timeout: 1
+		});
+		await sql.unsafe("SELECT 1");
+		await sql.end();
+		return {
+			label: "Database",
+			ok: true,
+			detail: "connected"
+		};
+	} catch (err) {
+		return {
+			label: "Database",
+			ok: false,
+			detail: `unreachable — ${(err instanceof Error ? err.message : String(err)).slice(0, 80)}`
+		};
+	}
+}
+async function checkServerHealth() {
+	const config = getServerConfig();
+	const host = get(config, "server.host") ?? "127.0.0.1";
+	const port = get(config, "server.port") ?? 8e3;
+	const url = `http://${host}:${port}/healthz`;
+	try {
+		const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+		if (res.ok) return {
+			label: "Server Health",
+			ok: true,
+			detail: `running at ${host}:${port}`
+		};
+		return {
+			label: "Server Health",
+			ok: false,
+			detail: `unhealthy (HTTP ${res.status}) at ${host}:${port}`
+		};
+	} catch {
+		return {
+			label: "Server Health",
+			ok: false,
+			detail: `not running at ${host}:${port}`
+		};
+	}
+}
+function checkClientConfig() {
+	const hasFile = existsSync(join(DEFAULT_CONFIG_DIR, "client.yaml"));
+	const hasEnv = !!process.env.FIRST_TREE_HUB_SERVER_URL;
+	if (hasFile && hasEnv) return {
+		label: "Config",
+		ok: true,
+		detail: "config file + env vars"
+	};
+	if (hasFile) return {
+		label: "Config",
+		ok: true,
+		detail: join(DEFAULT_CONFIG_DIR, "client.yaml")
+	};
+	if (hasEnv) return {
+		label: "Config",
+		ok: true,
+		detail: "via environment variables"
+	};
+	return {
+		label: "Config",
+		ok: false,
+		detail: "no config file or env vars found"
+	};
+}
+async function checkServerReachable() {
+	const serverUrl = get(getClientConfig(), "server.url");
+	if (typeof serverUrl !== "string" || !serverUrl) return {
+		label: "Server URL",
+		ok: false,
+		detail: "not configured (FIRST_TREE_HUB_SERVER_URL or config file)"
+	};
+	try {
+		const res = await fetch(`${serverUrl}/healthz`, { signal: AbortSignal.timeout(5e3) });
+		if (res.ok) return {
+			label: "Server URL",
+			ok: true,
+			detail: serverUrl
+		};
+		return {
+			label: "Server URL",
+			ok: false,
+			detail: `unhealthy (HTTP ${res.status}) at ${serverUrl}`
+		};
+	} catch {
+		return {
+			label: "Server URL",
+			ok: false,
+			detail: `unreachable at ${serverUrl}`
+		};
+	}
+}
+function checkAgentConfigs() {
+	const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+	if (!existsSync(agentsDir)) return {
+		label: "Agents",
+		ok: false,
+		detail: "no agents configured"
+	};
+	try {
+		const agents = loadAgents({
+			schema: agentConfigSchema,
+			agentsDir
+		});
+		if (agents.size === 0) return {
+			label: "Agents",
+			ok: false,
+			detail: "no agents configured"
+		};
+		const names = [...agents.keys()].join(", ");
+		return {
+			label: "Agents",
+			ok: true,
+			detail: `${agents.size} configured (${names})`
+		};
+	} catch {
+		return {
+			label: "Agents",
+			ok: false,
+			detail: "error reading agent configs"
+		};
+	}
+}
+function checkBackgroundService() {
+	const info = getClientServiceStatus();
+	if (info.platform === "unsupported") return {
+		label: "Background service",
+		ok: true,
+		detail: `not supported on ${process.platform} — runs inline`
 	};
-	return {
-		state: "inactive",
-		detail: out || "unit present but not active"
+	if (info.state === "active") return {
+		label: "Background service",
+		ok: true,
+		detail: `running (${info.platform}${info.detail ? `, ${info.detail}` : ""}); logs at ${info.logDir}`
+	};
+	if (info.state === "inactive") return {
+		label: "Background service",
+		ok: false,
+		detail: `installed but not running${info.detail ? ` — ${info.detail}` : ""}; unit at ${info.unitPath}`
 	};
-}
-function installSystemd() {
-	const invocation = resolveCliInvocation();
-	ensureLogDir();
-	const unitPath = systemdUnitPath();
-	mkdirSync(dirname(unitPath), { recursive: true });
-	writeFileSync(unitPath, renderSystemdUnit(invocation), { mode: 420 });
-	const reloadRes = runCapture("systemctl", ["--user", "daemon-reload"], 5e3);
-	if (!reloadRes.ok) throw new Error(`systemctl --user daemon-reload failed: ${reloadRes.stderr || `exit ${reloadRes.code ?? "unknown"}`}`);
-	const enableRes = runCapture("systemctl", [
-		"--user",
-		"enable",
-		"--now",
-		SYSTEMD_UNIT
-	], 1e4);
-	if (!enableRes.ok) throw new Error(`systemctl --user enable --now ${SYSTEMD_UNIT} failed: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n    Recovery: \`systemctl --user stop ${SYSTEMD_UNIT}\` then \`first-tree-hub service install\`.`);
-	const { state, detail } = systemdState();
 	return {
-		platform: "systemd",
-		label: SYSTEMD_UNIT,
-		unitPath,
-		logDir: LOG_DIR$1,
-		state,
-		detail
+		label: "Background service",
+		ok: false,
+		detail: "not installed — re-run `first-tree-hub client connect <url>` to install"
 	};
 }
-function uninstallSystemd() {
-	const unitPath = systemdUnitPath();
-	const disableRes = runCapture("systemctl", [
-		"--user",
-		"disable",
-		"--now",
-		SYSTEMD_UNIT
-	], 1e4);
-	if (!disableRes.ok && !/not found|no such|not loaded/i.test(disableRes.stderr)) print.line(`    warning: systemctl disable during uninstall: ${disableRes.stderr || `exit ${disableRes.code ?? "unknown"}`}\n`);
-	if (existsSync(unitPath)) rmSync(unitPath);
-	const reloadRes = runCapture("systemctl", ["--user", "daemon-reload"], 5e3);
-	if (!reloadRes.ok) print.line(`    warning: systemctl daemon-reload during uninstall: ${reloadRes.stderr || `exit ${reloadRes.code ?? "unknown"}`}\n`);
-	return {
-		platform: "systemd",
-		label: SYSTEMD_UNIT,
-		unitPath,
-		logDir: LOG_DIR$1,
-		state: "not-installed"
+async function checkWebSocket() {
+	const serverUrl = get(getClientConfig(), "server.url");
+	if (typeof serverUrl !== "string" || !serverUrl) return {
+		label: "WebSocket",
+		ok: false,
+		detail: "cannot check (no server URL)"
 	};
+	const wsUrl = serverUrl.replace(/^http/, "ws");
+	try {
+		if ((await fetch(`${serverUrl}/healthz`, { signal: AbortSignal.timeout(3e3) })).ok) return {
+			label: "WebSocket",
+			ok: true,
+			detail: `${wsUrl} (server reachable)`
+		};
+		return {
+			label: "WebSocket",
+			ok: false,
+			detail: "server not healthy"
+		};
+	} catch {
+		return {
+			label: "WebSocket",
+			ok: false,
+			detail: `server unreachable at ${serverUrl}`
+		};
+	}
 }
-/** Is background-service install supported on the current platform? */
-function isServiceSupported() {
-	return process.platform === "darwin" || process.platform === "linux";
+function printResults(results) {
+	for (const r of results) {
+		const icon = r.ok ? "✓" : "✗";
+		print.line(`  ${icon} ${r.label.padEnd(22)} ${r.detail}\n`);
+	}
+	blank();
+	const failures = results.filter((r) => !r.ok);
+	if (failures.length === 0) print.line("  All checks passed.\n");
+	else print.line(`  ${failures.length} issue(s) found.\n`);
+	blank();
+}
+//#endregion
+//#region src/core/migrate.ts
+/**
+* Resolve the drizzle migrations directory.
+* 1. npm install: embedded at dist/drizzle/ (relative to the built CLI)
+* 2. Monorepo dev: resolved from @first-tree-hub/server package
+*/
+function resolveMigrationsFolder() {
+	const embeddedPath = join(dirname(fileURLToPath(import.meta.url)), "..", "drizzle");
+	if (existsSync(embeddedPath)) return embeddedPath;
+	return join(dirname(fileURLToPath(import.meta.resolve("@first-tree-hub/server/package.json"))), "drizzle");
 }
 /**
-* Install the background service for the current platform.
-*
-* @throws {Error} if the platform is not supported or the service manager fails.
+* Validate that migration journal timestamps are strictly increasing.
+* Drizzle silently skips migrations whose `when` is <= the last applied
+* timestamp, which causes missing columns/tables with no error.
 */
-function installClientService() {
-	if (process.platform === "darwin") return installLaunchd();
-	if (process.platform === "linux") return installSystemd();
-	throw new Error(`Background service install is not supported on ${process.platform}. Run \`first-tree-hub client start\` manually to keep the computer online.`);
+function validateJournalOrder(migrationsFolder) {
+	const journalPath = join(migrationsFolder, "meta", "_journal.json");
+	if (!existsSync(journalPath)) return;
+	const journal = JSON.parse(readFileSync(journalPath, "utf-8"));
+	let prevWhen = 0;
+	let prevTag = "";
+	for (const entry of journal.entries) {
+		if (entry.when <= prevWhen) throw new Error(`Migration journal timestamps are not monotonically increasing:\n  "${prevTag}" (when: ${prevWhen}) >= "${entry.tag}" (when: ${entry.when})\n  Drizzle will silently skip "${entry.tag}". Fix the 'when' values in:\n  ${journalPath}`);
+		prevWhen = entry.when;
+		prevTag = entry.tag;
+	}
 }
-/** Report the current service state without modifying anything. */
-function getClientServiceStatus() {
-	if (process.platform === "darwin") {
-		const { state, detail } = launchdState();
-		return {
-			platform: "launchd",
-			label: LAUNCHD_LABEL,
-			unitPath: launchdPlistPath(),
-			logDir: LOG_DIR$1,
-			state,
-			detail
-		};
+/**
+* Run Drizzle database migrations.
+*/
+async function runMigrations(databaseUrl) {
+	const migrationsFolder = resolveMigrationsFolder();
+	validateJournalOrder(migrationsFolder);
+	const client = postgres(databaseUrl, { max: 1 });
+	const db = drizzle(client);
+	try {
+		await migrate(db, { migrationsFolder });
+	} finally {
+		await client.end();
 	}
-	if (process.platform === "linux") {
-		const { state, detail } = systemdState();
-		return {
-			platform: "systemd",
-			label: SYSTEMD_UNIT,
-			unitPath: systemdUnitPath(),
-			logDir: LOG_DIR$1,
-			state,
-			detail
-		};
+	const countClient = postgres(databaseUrl, { max: 1 });
+	try {
+		return (await countClient`
+      SELECT count(*)::int AS count
+      FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_type = 'BASE TABLE'
+    `)[0].count;
+	} finally {
+		await countClient.end();
 	}
-	return {
-		platform: "unsupported",
-		label: "",
-		unitPath: "",
-		logDir: LOG_DIR$1,
-		state: "not-installed",
-		detail: `platform ${process.platform} not supported`
-	};
-}
-/** Uninstall the background service. No-op if not installed. */
-function uninstallClientService() {
-	if (process.platform === "darwin") return uninstallLaunchd();
-	if (process.platform === "linux") return uninstallSystemd();
-	return getClientServiceStatus();
 }
 //#endregion
 //#region src/core/migrate-home.ts
@@ -6098,7 +6142,7 @@ function runHomeMigration() {
 	}
 	print.line(`[first-tree-hub] Copied client home to new layout: ${result.from} → ${result.to}\n  (Legacy directory preserved as a backup — delete it manually once you've verified the new location works.)\n`);
 	if (process.argv.includes("--no-interactive")) {
-		print.line("[first-tree-hub] Note: running as background service — skipped auto re-register to avoid self-termination.\n  Run `first-tree-hub client service install` from a terminal to refresh log paths.\n");
+		print.line("[first-tree-hub] Note: running as background service — skipped auto re-register to avoid self-termination.\n  Service paths will refresh on the next `first-tree-hub client connect <url>`.\n");
 		return;
 	}
 	const status = getClientServiceStatus();
@@ -6108,7 +6152,7 @@ function runHomeMigration() {
 		print.line(`[first-tree-hub] Re-registered background service with new home paths.\n`);
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		print.line(`[first-tree-hub] WARNING: home migration succeeded but re-registering the background service failed: ${msg}\n  Run \`first-tree-hub client service install\` to refresh log paths.\n`);
+		print.line(`[first-tree-hub] WARNING: home migration succeeded but re-registering the background service failed: ${msg}\n  Re-run \`first-tree-hub client connect <url>\` to refresh service paths.\n`);
 	}
 }
 //#endregion
@@ -6279,7 +6323,7 @@ async function onboardCreate(args) {
 	}
 	const runtimeAgent = args.type === "human" ? args.assistant : args.id;
 	if (args.feishuBotAppId && args.feishuBotAppSecret) {
-		const { bindFeishuBot } = await import("./feishu-BJaN64iR.mjs").then((n) => n.r);
+		const { bindFeishuBot } = await import("./feishu-B2sjp6Z6.mjs").then((n) => n.r);
 		const targetAgentUuid = args.type === "human" ? assistantUuid : primary.uuid;
 		if (!targetAgentUuid) print.line(`Warning: Cannot bind Feishu bot — no runtime agent available for "${args.id}".\n`);
 		else {
@@ -7177,7 +7221,7 @@ function createFeedbackHandler(config) {
 	return { handle };
 }
 //#endregion
-//#region ../server/dist/app-RWQiJW6_.mjs
+//#region ../server/dist/app-UkoRS4YL.mjs
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -8207,6 +8251,7 @@ async function createAgent(db, data) {
 	const uuid = uuidv7();
 	const name = data.name ?? null;
 	if (name?.startsWith(RESERVED_AGENT_NAME_PREFIX)) throw new BadRequestError(`Agent name "${name}" is reserved — names starting with "${RESERVED_AGENT_NAME_PREFIX}" are Hub-internal`);
+	if (name && isReservedAgentName$1(name)) throw new BadRequestError(`Agent name "${name}" is reserved — pick a different one.`);
 	const inboxId = `inbox_${uuid}`;
 	let orgId;
 	let managerId;
@@ -8262,6 +8307,21 @@ async function createAgent(db, data) {
 		throw err;
 	}
 }
+async function checkAgentNameAvailability(db, orgId, name) {
+	if (!AGENT_NAME_REGEX$1.test(name)) return {
+		available: false,
+		reason: "invalid"
+	};
+	if (isReservedAgentName$1(name) || name.startsWith(RESERVED_AGENT_NAME_PREFIX)) return {
+		available: false,
+		reason: "reserved"
+	};
+	const [existing] = await db.select({ uuid: agents.uuid }).from(agents).where(and(eq(agents.organizationId, orgId), eq(agents.name, name), ne(agents.status, AGENT_STATUSES.DELETED))).limit(1);
+	return existing ? {
+		available: false,
+		reason: "taken"
+	} : { available: true };
+}
 async function getAgent(db, uuid) {
 	const [agent] = await db.select().from(agents).where(and(eq(agents.uuid, uuid), ne(agents.status, AGENT_STATUSES.DELETED))).limit(1);
 	if (!agent) throw new NotFoundError(`Agent "${uuid}" not found`);
@@ -9516,6 +9576,18 @@ async function adminAgentRoutes(app) {
 			nextCursor: result.nextCursor
 		};
 	});
+	/**
+	* Pre-create availability probe for the web creation form. The caller types
+	* an agent name; we answer whether the POST would succeed (`available: true`)
+	* or why it would fail (`invalid` / `reserved` / `taken`) without actually
+	* inserting a row. The regular POST still validates authoritatively — this is
+	* a pure UX convenience. Scoped to the caller's org, so two orgs can each
+	* have a `coder` without one blocking the other.
+	*/
+	app.get("/names/:name/availability", async (request) => {
+		const scope = memberScope(request);
+		return await checkAgentNameAvailability(app.db, scope.organizationId, request.params.name);
+	});
 	app.post("/", async (request, reply) => {
 		const scope = memberScope(request);
 		const body = createAgentSchema.parse(request.body);
@@ -15031,7 +15103,7 @@ async function startServer(options) {
 		instanceId: `srv_${randomUUID().slice(0, 8)}`,
 		commandVersion: COMMAND_VERSION
 	};
-	const { initTelemetry, shutdownTelemetry } = await import("./observability-hDEdrmMS.mjs");
+	const { initTelemetry, shutdownTelemetry } = await import("./observability-DDkJwSKv.mjs");
 	await initTelemetry(serverConfig.observability.tracing, config.instanceId);
 	const app = await buildApp(config);
 	const shutdown = async () => {
@@ -15081,175 +15153,6 @@ function resolveWebDist() {
 	} catch {}
 }
 //#endregion
-//#region src/core/service-logs.ts
-const LOG_DIR = join(DEFAULT_HOME_DIR$1, "logs");
-const PRIMARY_LOG = join(LOG_DIR, "client.log");
-const FALLBACK_STDOUT = join(LOG_DIR, "client.stdout.log");
-const FALLBACK_STDERR = join(LOG_DIR, "client.stderr.log");
-/**
-* Duration string → milliseconds. Accepts `10s`, `5m`, `2h`, `1d`; rejects
-* everything else. Keeps the parser tiny rather than pulling in a library —
-* the `--since` flag is the only consumer.
-*/
-function parseDuration(input) {
-	const match = /^(\d+)\s*(s|m|h|d)$/.exec(input.trim());
-	if (!match) throw new Error(`invalid duration "${input}" (expected e.g. 30s, 5m, 2h, 1d)`);
-	return Number(match[1]) * ({
-		s: 1e3,
-		m: 6e4,
-		h: 36e5,
-		d: 864e5
-	}[match[2]] ?? 0);
-}
-const LEVEL_RANK = {
-	trace: 10,
-	debug: 20,
-	info: 30,
-	warn: 40,
-	error: 50,
-	fatal: 60
-};
-/** Rotated log files, newest-first. Missing files are silently skipped. */
-function listLogFilesNewestFirst() {
-	const files = [];
-	if (existsSync(PRIMARY_LOG)) files.push(PRIMARY_LOG);
-	for (let i = 1;; i++) {
-		const p = `${PRIMARY_LOG}.${i}`;
-		if (!existsSync(p)) break;
-		files.push(p);
-	}
-	return files;
-}
-/** Supervisor fallback files (raw stdout/stderr, not NDJSON). Missing files skipped. */
-function listFallbackFiles() {
-	const files = [];
-	if (existsSync(FALLBACK_STDERR)) files.push(FALLBACK_STDERR);
-	if (existsSync(FALLBACK_STDOUT)) files.push(FALLBACK_STDOUT);
-	return files;
-}
-function matchesFilters(obj, minLevel, cutoffMs) {
-	if (minLevel !== void 0) {
-		const lvl = typeof obj.level === "number" ? obj.level : NaN;
-		if (!Number.isFinite(lvl) || lvl < minLevel) return false;
-	}
-	if (cutoffMs !== void 0) {
-		const t = parseLogTime(obj.time);
-		if (t === null || t < cutoffMs) return false;
-	}
-	return true;
-}
-/** Logger writes `time` as a local-ish string (`YYYY-MM-DD HH:mm:ss`). */
-function parseLogTime(value) {
-	if (typeof value === "number") return value;
-	if (typeof value !== "string") return null;
-	const iso = value.replace(" ", "T");
-	const ms = Date.parse(iso);
-	return Number.isFinite(ms) ? ms : null;
-}
-function renderLine(line, json) {
-	if (!line.trim()) return null;
-	if (json) return `${line}\n`;
-	try {
-		return formatPrettyEntry$1(line);
-	} catch {
-		return `${line}\n`;
-	}
-}
-function processLogLine(line, minLevel, cutoffMs, json) {
-	let obj;
-	try {
-		obj = JSON.parse(line);
-	} catch {
-		return json ? null : `${line}\n`;
-	}
-	if (!matchesFilters(obj, minLevel, cutoffMs)) return null;
-	return renderLine(line, json);
-}
-async function readFileLines(path, minLevel, cutoffMs, json) {
-	const rl = createInterface({ input: createReadStream(path, { encoding: "utf8" }) });
-	for await (const line of rl) {
-		const rendered = processLogLine(line, minLevel, cutoffMs, json);
-		if (rendered) process.stdout.write(rendered);
-	}
-}
-/**
-* Read a supervisor fallback file (launchd / systemd stdout/stderr capture).
-* These are plain text, not NDJSON: level and time filters don't apply, so we
-* honour `--since` by dropping the whole file when its mtime predates the
-* cutoff and otherwise pass every line through. In pretty mode each line is
-* tagged with the source so operators can tell it apart from pino output; in
-* `--json` mode we emit a synthetic record so NDJSON consumers keep one
-* object per line.
-*/
-async function readFallbackFile(path, cutoffMs, json) {
-	try {
-		const mtime = statSync(path).mtimeMs;
-		if (cutoffMs !== void 0 && mtime < cutoffMs) return;
-	} catch {
-		return;
-	}
-	const source = path.endsWith(".stderr.log") ? "supervisor:stderr" : "supervisor:stdout";
-	const rl = createInterface({ input: createReadStream(path, { encoding: "utf8" }) });
-	for await (const line of rl) {
-		if (!line.trim()) continue;
-		if (json) process.stdout.write(`${JSON.stringify({
-			source,
-			line
-		})}\n`);
-		else process.stdout.write(`[${source}] ${line}\n`);
-	}
-}
-/**
-* Print existing log history, applying filters. `--tail` then switches to
-* follow mode and keeps printing new lines as the active file grows; rotation
-* is not handled during the tail (a follow-up rotation will simply stop
-* emitting new lines — operator can re-run the command).
-*/
-async function showServiceLogs(options) {
-	if (!existsSync(LOG_DIR)) {
-		print.status("logs", `directory not found: ${LOG_DIR}`);
-		return;
-	}
-	const minLevel = options.level ? LEVEL_RANK[options.level] : void 0;
-	const cutoffMs = options.sinceMs !== void 0 ? Date.now() - options.sinceMs : void 0;
-	for (const f of listFallbackFiles()) await readFallbackFile(f, cutoffMs, options.json);
-	const files = listLogFilesNewestFirst().reverse();
-	for (const f of files) await readFileLines(f, minLevel, cutoffMs, options.json);
-	if (!options.tail) return;
-	if (!existsSync(PRIMARY_LOG)) print.status("tail", "waiting for client.log to appear...");
-	await new Promise((resolve) => {
-		let position = existsSync(PRIMARY_LOG) ? statSync(PRIMARY_LOG).size : 0;
-		const onChange = () => {
-			if (!existsSync(PRIMARY_LOG)) return;
-			const current = statSync(PRIMARY_LOG).size;
-			if (current < position) position = 0;
-			if (current <= position) return;
-			const stream = createReadStream(PRIMARY_LOG, {
-				start: position,
-				end: current - 1,
-				encoding: "utf8"
-			});
-			position = current;
-			createInterface({ input: stream }).on("line", (line) => {
-				const rendered = processLogLine(line, minLevel, cutoffMs, options.json);
-				if (rendered) process.stdout.write(rendered);
-			});
-		};
-		watchFile(PRIMARY_LOG, { interval: 500 }, onChange);
-		process.once("SIGINT", () => {
-			unwatchFile(PRIMARY_LOG, onChange);
-			resolve();
-		});
-	});
-}
-/** Validated flag parsers the CLI layer can reuse without re-doing the work. */
-function validateLevel(value) {
-	if (value === void 0) return void 0;
-	const parsed = parseLogLevel$1(value);
-	if (parsed.fellBack) throw new Error(`invalid --level "${value}" (expected one of ${LOG_LEVELS$1.join(", ")})`);
-	return parsed.level;
-}
-//#endregion
 //#region src/core/update.ts
 const PACKAGE_NAME = "@agent-team-foundation/first-tree-hub";
 /**
@@ -15426,4 +15329,4 @@ function createExecuteUpdate({ managed }) {
 	};
 }
 //#endregion
-export { configureClientLoggerForService as $, checkServerHealth as A, createOwner as B, runMigrations as C, checkDocker as D, checkDatabase as E, isDockerAvailable as F, setJsonMode as G, resolveReplyToFromEnv as H, stopPostgres as I, FirstTreeHubSDK as J, status as K, ClientRuntime as L, checkWebSocket as M, printResults as N, checkNodeVersion as O, ensurePostgres as P, applyClientLoggerConfig as Q, handleClientOrgMismatch as R, uninstallClientService as S, checkClientConfig as T, blank as U, hasUser as V, print as W, SessionRegistry as X, SdkError as Y, cleanWorkspaces as Z, runHomeMigration as _, showServiceLogs as a, isServiceSupported as b, COMMAND_VERSION as c, promptMissingFields as d, formatCheckReport as f, saveOnboardState as g, onboardCreate as h, parseDuration as i, checkServerReachable as j, checkServerConfig as k, isInteractive as l, onboardCheck as m, declineUpdate as n, validateLevel as o, loadOnboardState as p, ClientOrgMismatchError$1 as q, promptUpdate as r, startServer as s, createExecuteUpdate as t, promptAddAgent as u, getClientServiceStatus as v, checkAgentConfigs as w, resolveCliInvocation as x, installClientService as y, rotateClientIdWithBackup as z };
+export { resolveCliInvocation as A, resolveReplyToFromEnv as B, checkServerHealth as C, getClientServiceStatus as D, printResults as E, ClientRuntime as F, ClientOrgMismatchError$1 as G, print as H, handleClientOrgMismatch as I, SessionRegistry as J, FirstTreeHubSDK as K, rotateClientIdWithBackup as L, ensurePostgres as M, isDockerAvailable as N, installClientService as O, stopPostgres as P, createOwner as R, checkServerConfig as S, checkWebSocket as T, setJsonMode as U, blank as V, status as W, applyClientLoggerConfig as X, cleanWorkspaces as Y, configureClientLoggerForService as Z, checkBackgroundService as _, COMMAND_VERSION as a, checkDocker as b, promptMissingFields as c, onboardCheck as d, onboardCreate as f, checkAgentConfigs as g, runMigrations as h, startServer as i, uninstallClientService as j, isServiceSupported as k, formatCheckReport as l, runHomeMigration as m, declineUpdate as n, isInteractive as o, saveOnboardState as p, SdkError as q, promptUpdate as r, promptAddAgent as s, createExecuteUpdate as t, loadOnboardState as u, checkClientConfig as v, checkServerReachable as w, checkNodeVersion as x, checkDatabase as y, hasUser as z };