@archme/cli 0.4.2 → 0.4.4

package/dist/cli.js

@@ -1020,15 +1020,15 @@ var require_windows = __commonJS({
       }
       return false;
     }
-    function checkStat(stat10, path7, options) {
-      if (!stat10.isSymbolicLink() && !stat10.isFile()) {
+    function checkStat(stat11, path7, options) {
+      if (!stat11.isSymbolicLink() && !stat11.isFile()) {
         return false;
       }
       return checkPathExt(path7, options);
     }
     function isexe(path7, options, cb) {
-      fs.stat(path7, function(er, stat10) {
-        cb(er, er ? false : checkStat(stat10, path7, options));
+      fs.stat(path7, function(er, stat11) {
+        cb(er, er ? false : checkStat(stat11, path7, options));
       });
     }
     function sync(path7, options) {
@@ -1044,20 +1044,20 @@ var require_mode = __commonJS({
     isexe.sync = sync;
     var fs = __require("fs");
     function isexe(path7, options, cb) {
-      fs.stat(path7, function(er, stat10) {
-        cb(er, er ? false : checkStat(stat10, options));
+      fs.stat(path7, function(er, stat11) {
+        cb(er, er ? false : checkStat(stat11, options));
       });
     }
     function sync(path7, options) {
       return checkStat(fs.statSync(path7), options);
     }
-    function checkStat(stat10, options) {
-      return stat10.isFile() && checkMode(stat10, options);
+    function checkStat(stat11, options) {
+      return stat11.isFile() && checkMode(stat11, options);
     }
-    function checkMode(stat10, options) {
-      var mod = stat10.mode;
-      var uid = stat10.uid;
-      var gid = stat10.gid;
+    function checkMode(stat11, options) {
+      var mod = stat11.mode;
+      var uid = stat11.uid;
+      var gid = stat11.gid;
       var myUid = options.uid !== void 0 ? options.uid : process.getuid && process.getuid();
       var myGid = options.gid !== void 0 ? options.gid : process.getgid && process.getgid();
       var u2 = parseInt("100", 8);
@@ -1091,12 +1091,12 @@ var require_isexe = __commonJS({
         if (typeof Promise !== "function") {
           throw new TypeError("callback not provided");
         }
-        return new Promise(function(resolve4, reject) {
+        return new Promise(function(resolve5, reject) {
           isexe(path7, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
-              resolve4(is);
+              resolve5(is);
             }
           });
         });
@@ -1162,27 +1162,27 @@ var require_which = __commonJS({
         opt = {};
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
       const found = [];
-      const step = (i2) => new Promise((resolve4, reject) => {
+      const step = (i2) => new Promise((resolve5, reject) => {
         if (i2 === pathEnv.length)
-          return opt.all && found.length ? resolve4(found) : reject(getNotFoundError(cmd));
+          return opt.all && found.length ? resolve5(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i2];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
         const pCmd = path7.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
-        resolve4(subStep(p, i2, 0));
+        resolve5(subStep(p, i2, 0));
       });
-      const subStep = (p, i2, ii) => new Promise((resolve4, reject) => {
+      const subStep = (p, i2, ii) => new Promise((resolve5, reject) => {
         if (ii === pathExt.length)
-          return resolve4(step(i2 + 1));
+          return resolve5(step(i2 + 1));
         const ext2 = pathExt[ii];
         isexe(p + ext2, { pathExt: pathExtExe }, (er, is) => {
           if (!er && is) {
             if (opt.all)
               found.push(p + ext2);
             else
-              return resolve4(p + ext2);
+              return resolve5(p + ext2);
           }
-          return resolve4(subStep(p, i2, ii + 1));
+          return resolve5(subStep(p, i2, ii + 1));
         });
       });
       return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
@@ -1253,12 +1253,12 @@ var require_resolveCommand = __commonJS({
       if (shouldSwitchCwd) {
         try {
           process.chdir(parsed.options.cwd);
-        } catch (err) {
+        } catch (err2) {
         }
       }
-      let resolved;
+      let resolved2;
       try {
-        resolved = which.sync(parsed.command, {
+        resolved2 = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
           pathExt: withoutPathExt ? path7.delimiter : void 0
         });
@@ -1268,10 +1268,10 @@ var require_resolveCommand = __commonJS({
           process.chdir(cwd);
         }
       }
-      if (resolved) {
-        resolved = path7.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+      if (resolved2) {
+        resolved2 = path7.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved2);
       }
-      return resolved;
+      return resolved2;
     }
     function resolveCommand(parsed) {
       return resolveCommandAttempt(parsed) || resolveCommandAttempt(parsed, true);
@@ -1394,7 +1394,7 @@ var require_parse = __commonJS({
       }
       return parsed;
     }
-    function parse(command, args, options) {
+    function parse2(command, args, options) {
       if (args && !Array.isArray(args)) {
         options = args;
         args = null;
@@ -1413,7 +1413,7 @@ var require_parse = __commonJS({
       };
       return options.shell ? parsed : parseNonShell(parsed);
     }
-    module.exports = parse;
+    module.exports = parse2;
   }
 });
 
@@ -1438,9 +1438,9 @@ var require_enoent = __commonJS({
       const originalEmit = cp.emit;
       cp.emit = function(name, arg1) {
         if (name === "exit") {
-          const err = verifyENOENT(arg1, parsed);
-          if (err) {
-            return originalEmit.call(cp, "error", err);
+          const err2 = verifyENOENT(arg1, parsed);
+          if (err2) {
+            return originalEmit.call(cp, "error", err2);
           }
         }
         return originalEmit.apply(cp, arguments);
@@ -1472,16 +1472,16 @@ var require_cross_spawn = __commonJS({
   "node_modules/cross-spawn/index.js"(exports, module) {
     "use strict";
     var cp = __require("child_process");
-    var parse = require_parse();
+    var parse2 = require_parse();
     var enoent = require_enoent();
     function spawn2(command, args, options) {
-      const parsed = parse(command, args, options);
+      const parsed = parse2(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
       return spawned;
     }
     function spawnSync2(command, args, options) {
-      const parsed = parse(command, args, options);
+      const parsed = parse2(command, args, options);
       const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
@@ -1489,7 +1489,7 @@ var require_cross_spawn = __commonJS({
     module.exports = spawn2;
     module.exports.spawn = spawn2;
     module.exports.sync = spawnSync2;
-    module.exports._parse = parse;
+    module.exports._parse = parse2;
     module.exports._enoent = enoent;
   }
 });
@@ -2262,8 +2262,8 @@ var init_deferred = __esm({
   "node_modules/execa/lib/utils/deferred.js"() {
     createDeferred = () => {
       const methods = {};
-      const promise = new Promise((resolve4, reject) => {
-        Object.assign(methods, { resolve: resolve4, reject });
+      const promise = new Promise((resolve5, reject) => {
+        Object.assign(methods, { resolve: resolve5, reject });
       });
       return Object.assign(promise, methods);
     };
@@ -4057,8 +4057,8 @@ function prettyMilliseconds(milliseconds, options) {
     const flooredValue = Math.round(flooredInterimValue) / 10 ** decimalDigits;
     return flooredValue.toFixed(decimalDigits);
   };
-  const add = (value, long, short, valueString) => {
-    if ((result.length === 0 || !options.colonNotation) && isZero(value) && !(options.colonNotation && short === "m")) {
+  const add = (value, long, short4, valueString) => {
+    if ((result.length === 0 || !options.colonNotation) && isZero(value) && !(options.colonNotation && short4 === "m")) {
       return;
     }
     valueString ??= String(value);
@@ -4067,7 +4067,7 @@ function prettyMilliseconds(milliseconds, options) {
       const minLength = result.length > 0 ? 2 : 1;
       valueString = "0".repeat(Math.max(0, minLength - wholeDigits)) + valueString;
     } else {
-      valueString += options.verbose ? " " + pluralize(long, value) : short;
+      valueString += options.verbose ? " " + pluralize(long, value) : short4;
     }
     result.push(valueString);
   };
@@ -7560,11 +7560,11 @@ var init_concurrent = __esm({
       const promises = weakMap.get(stream);
       const promise = createDeferred();
       promises.push(promise);
-      const resolve4 = promise.resolve.bind(promise);
-      return { resolve: resolve4, promises };
+      const resolve5 = promise.resolve.bind(promise);
+      return { resolve: resolve5, promises };
     };
-    waitForConcurrentStreams = async ({ resolve: resolve4, promises }, subprocess) => {
-      resolve4();
+    waitForConcurrentStreams = async ({ resolve: resolve5, promises }, subprocess) => {
+      resolve5();
       const [isSubprocessExit] = await Promise.race([
         Promise.allSettled([true, subprocess]),
         Promise.all([false, ...promises])
@@ -8376,9 +8376,9 @@ async function saveCredentials(credentials) {
       next2.push(merged2);
       try {
         await keytar.setPassword(SERVICE_NAME, credentials.supabase_url, serializeStore(next2));
-      } catch (err) {
-        warnCredentialPersistFailure("macOS Keychain", err);
-        throw err;
+      } catch (err2) {
+        warnCredentialPersistFailure("macOS Keychain", err2);
+        throw err2;
       }
       return { credentials: merged2, source: "keychain" };
     }
@@ -8391,8 +8391,8 @@ async function saveCredentials(credentials) {
     return { credentials: merged, source: "file", path: fallbackPath() };
   });
 }
-function warnCredentialPersistFailure(target, err) {
-  const detail = err instanceof Error ? err.message : String(err);
+function warnCredentialPersistFailure(target, err2) {
+  const detail = err2 instanceof Error ? err2.message : String(err2);
   console.error(
     `auth: CRITICAL \u2014 failed to persist credentials to ${target}: ${detail}. The rotated refresh token was NOT saved; the daemon keeps working on its in-memory token until it restarts, then may fail with "Refresh Token Not Found" because it reloads the previous, already-used refresh token. If a keychain password prompt was dismissed, grant access (or re-run \`archme login\`) before restarting.`
   );
@@ -8452,9 +8452,9 @@ async function writeFileStore(all) {
     await writeFile(fallbackPath(), serializeStore(all), { mode: 384 });
     await chmod(fallbackPath(), 384).catch(() => {
     });
-  } catch (err) {
-    warnCredentialPersistFailure(`file fallback (${fallbackPath()})`, err);
-    throw err;
+  } catch (err2) {
+    warnCredentialPersistFailure(`file fallback (${fallbackPath()})`, err2);
+    throw err2;
   }
 }
 function describeCredentialSource(result) {
@@ -8518,8 +8518,8 @@ function resolveConfig() {
   if (!archmeDaemonClientId) missing.push("ARCHME_DAEMON_CLIENT_ID");
   if (!archmeMcpBaseUrl) missing.push("ARCHME_MCP_BASE_URL");
   if (missing.length > 0) {
-    const err = new MissingConfigError({ archmeEnv, missing });
-    throw err;
+    const err2 = new MissingConfigError({ archmeEnv, missing });
+    throw err2;
   }
   return {
     archmeEnv,
@@ -8596,12 +8596,12 @@ async function runLogin() {
   let SUPABASE_URL2;
   try {
     SUPABASE_URL2 = resolveConfig().supabaseUrl;
-  } catch (err) {
-    if (err instanceof MissingConfigError) {
-      console.error(err.message);
+  } catch (err2) {
+    if (err2 instanceof MissingConfigError) {
+      console.error(err2.message);
       process.exit(1);
     }
-    throw err;
+    throw err2;
   }
   function functionsBaseUrl() {
     return `${SUPABASE_URL2.replace(/\/$/, "")}/functions/v1/agents-device`;
@@ -8636,7 +8636,7 @@ async function runLogin() {
   const expiresAt = Date.now() + data.expires_in * 1e3;
   let intervalMs = Math.max(data.interval, 1) * 1e3;
   while (Date.now() < expiresAt) {
-    await new Promise((resolve4) => setTimeout(resolve4, intervalMs));
+    await new Promise((resolve5) => setTimeout(resolve5, intervalMs));
     const poll = await postJson("/poll", {
       device_code: data.device_code
     });
@@ -8667,8 +8667,8 @@ var init_enroll = __esm({
     init_credentials();
     init_defaults();
     if (import.meta.url === `file://${process.argv[1]}`) {
-      runLogin().catch((err) => {
-        console.error(err instanceof Error ? err.message : err);
+      runLogin().catch((err2) => {
+        console.error(err2 instanceof Error ? err2.message : err2);
         process.exit(1);
       });
     }
@@ -8852,7 +8852,7 @@ var init_launchctl = __esm({
         if (r.exitCode === 0 || r.exitCode === 17) return;
         if (r.exitCode === 5) {
           await this.opts.spawner.run("launchctl", ["bootout", SERVICE_TARGET(this.opts.uid)]);
-          await new Promise((resolve4) => setTimeout(resolve4, 500));
+          await new Promise((resolve5) => setTimeout(resolve5, 500));
           r = await bootstrap();
           if (r.exitCode === 0 || r.exitCode === 17) return;
         }
@@ -9222,16 +9222,16 @@ async function tailLog(opts = {}) {
       await handle.close();
     }
     offset = st.size;
-  } catch (err) {
-    if (err.code === "ENOENT") {
+  } catch (err2) {
+    if (err2.code === "ENOENT") {
       out.write(`(no log file yet at ${path7})
 `);
     } else {
-      throw err;
+      throw err2;
     }
   }
   if (!opts.follow) return;
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve5, reject) => {
     let fileWatcher = null;
     let dirWatcher = null;
     const dir = dirname6(path7);
@@ -9249,9 +9249,9 @@ async function tailLog(opts = {}) {
           });
           offset = st.size;
         }
-      } catch (err) {
-        if (err.code === "ENOENT") return;
-        reject(err);
+      } catch (err2) {
+        if (err2.code === "ENOENT") return;
+        reject(err2);
       }
     };
     const attachFileWatcher = () => {
@@ -9259,9 +9259,9 @@ async function tailLog(opts = {}) {
         fileWatcher = watch(path7, (event) => {
           if (event === "change") void onChange();
         });
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-          reject(err);
+      } catch (err2) {
+        if (err2.code !== "ENOENT") {
+          reject(err2);
           return;
         }
         attachDirWatcher();
@@ -9278,24 +9278,24 @@ async function tailLog(opts = {}) {
             });
           }
         });
-      } catch (err) {
-        reject(err);
+      } catch (err2) {
+        reject(err2);
       }
     };
     stat(path7).then(
       () => attachFileWatcher(),
-      (err) => {
-        if (err.code === "ENOENT") {
+      (err2) => {
+        if (err2.code === "ENOENT") {
           attachDirWatcher();
         } else {
-          reject(err);
+          reject(err2);
         }
       }
     );
     const handleSigint = () => {
       fileWatcher?.close();
       dirWatcher?.close();
-      resolve4();
+      resolve5();
     };
     process.once("SIGINT", handleSigint);
   });
@@ -9495,6 +9495,83 @@ var init_env_scrub = __esm({
   }
 });
 
+// src/preflight.ts
+import { accessSync, constants as constants4 } from "node:fs";
+import { delimiter as pathDelimiter, join as join6 } from "node:path";
+function defaultIsExecutable(path7) {
+  try {
+    accessSync(path7, constants4.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findOnPath(name, opts = {}) {
+  const env = opts.env ?? process.env;
+  const isExecutable = opts.isExecutable ?? defaultIsExecutable;
+  const delim = opts.delimiter ?? pathDelimiter;
+  const dirs = (env.PATH ?? "").split(delim).filter((d) => d.length > 0);
+  if (dirs.length === 0) return null;
+  const exts = env.PATHEXT ? ["", ...env.PATHEXT.split(";").filter(Boolean)] : [""];
+  for (const dir of dirs) {
+    for (const ext2 of exts) {
+      const candidate = join6(dir, `${name}${ext2}`);
+      if (isExecutable(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+function missingBinaryMessage(binary) {
+  const spec = REQUIRED_BINARIES[binary];
+  return [
+    `\`${spec.name}\` was not found on your PATH.`,
+    "",
+    spec.why,
+    "",
+    "Install it, then re-run:",
+    `  ${spec.install}`,
+    "",
+    `If \`${spec.name}\` is installed somewhere unusual, add its directory to PATH.`,
+    "Note: the daemon service captures PATH at `archme daemon start`, so after",
+    "changing PATH you must run `archme daemon restart` for it to take effect."
+  ].join("\n");
+}
+function requireBinary(binary, opts = {}) {
+  const cached = resolved.get(binary);
+  if (cached) return cached;
+  const found = findOnPath(binary, opts);
+  if (!found) throw new MissingBinaryError(binary, missingBinaryMessage(binary));
+  resolved.set(binary, found);
+  return found;
+}
+var REQUIRED_BINARIES, MissingBinaryError, resolved;
+var init_preflight = __esm({
+  "src/preflight.ts"() {
+    "use strict";
+    REQUIRED_BINARIES = {
+      claude: {
+        name: "claude",
+        why: "archme runs Claude Code locally to read your diff and update the architecture.",
+        install: "npm i -g @anthropic-ai/claude-code"
+      },
+      git: {
+        name: "git",
+        why: "archme clones and diffs repositories with git.",
+        install: "macOS: xcode-select --install   \xB7   Debian/Ubuntu: sudo apt-get install git"
+      }
+    };
+    MissingBinaryError = class extends Error {
+      binary;
+      constructor(binary, message) {
+        super(message);
+        this.name = "MissingBinaryError";
+        this.binary = binary;
+      }
+    };
+    resolved = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../shared/daemonModel.ts
 var DEFAULT_CLAUDE_MODEL;
 var init_daemonModel = __esm({
@@ -9504,6 +9581,9 @@ var init_daemonModel = __esm({
 });
 
 // src/scan/spawn-claude.ts
+function stripNulBytes(arg) {
+  return arg.includes("\0") ? arg.replaceAll("\0", "\uFFFD") : arg;
+}
 function buildClaudeArgs(opts) {
   const tools = (opts.allowedTools ?? DEFAULT_ALLOWED_TOOLS).join(",");
   const args = [
@@ -9530,9 +9610,10 @@ function buildClaudeArgs(opts) {
   if (opts.model) {
     args.push("--model", opts.model);
   }
-  return args;
+  return args.map(stripNulBytes);
 }
 function spawnClaude(opts) {
+  requireBinary("claude");
   const env = scrubPrivilegedEnv(process.env);
   const args = buildClaudeArgs({ ...opts, model: opts.model || DEFAULT_CLAUDE_MODEL });
   if (opts.streamJson && !opts.interactive) {
@@ -9571,6 +9652,7 @@ var init_spawn_claude = __esm({
     init_execa();
     init_env_scrub();
     init_mcp_config();
+    init_preflight();
     init_daemonModel();
     init_daemonModel();
     mcpTool = (name) => `mcp__${MCP_SERVER_NAME}__${name}`;
@@ -9743,7 +9825,7 @@ var init_digestPrompt = __esm({
 // src/daemon/digest.ts
 import { mkdtemp as mkdtemp2, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function isCleanDigestExit(res) {
   return !res.timedOut && res.signal == null && res.exitCode === 0;
 }
@@ -9777,12 +9859,12 @@ async function runDigestJob(ctx, job, deviceId, inFlight2, mcp) {
   }
   let dir;
   try {
-    dir = await mkdtemp2(join6(tmpdir2(), "archme-digest-"));
+    dir = await mkdtemp2(join7(tmpdir2(), "archme-digest-"));
     let mcpConfigPath;
     if (mcp) {
       mcpConfigPath = mcp.configPath;
     } else {
-      mcpConfigPath = join6(dir, "mcp.json");
+      mcpConfigPath = join7(dir, "mcp.json");
       await writeFile5(mcpConfigPath, JSON.stringify({ mcpServers: {} }));
     }
     const model = await resolveModelPin(ctx.supabase);
@@ -9813,8 +9895,8 @@ async function runDigestJob(ctx, job, deviceId, inFlight2, mcp) {
     }
     await completeDigest(ctx, job.id, deviceId, narrative);
     console.log(`[${job.id}] digest synthesized (${narrative.length} chars) for ${payload.projectName}`);
-  } catch (err) {
-    await failDigest(ctx, job.id, deviceId, err instanceof Error ? err.message : String(err));
+  } catch (err2) {
+    await failDigest(ctx, job.id, deviceId, err2 instanceof Error ? err2.message : String(err2));
   } finally {
     inFlight2?.delete(job.id);
     if (dir) await rm5(dir, { recursive: true, force: true }).catch(() => {
@@ -11774,8 +11856,8 @@ function extractParticipantsFromSequence(sequence) {
   return [...participants];
 }
 function componentScopeSegments(componentPath) {
-  const resolved = resolveWaypoint(componentPath, []);
-  return resolved.leafId ? [...resolved.scopePath, resolved.leafId] : resolved.scopePath;
+  const resolved2 = resolveWaypoint(componentPath, []);
+  return resolved2.leafId ? [...resolved2.scopePath, resolved2.leafId] : resolved2.scopePath;
 }
 function isPrefix(prefix, full) {
   return full.length >= prefix.length && prefix.every((s, i2) => full[i2] === s);
@@ -12270,10 +12352,10 @@ async function ensureBugsFolder(client, projectId) {
     const createdId = created?.id ?? null;
     if (createdId) cache.set(projectId, createdId);
     return createdId;
-  } catch (err) {
+  } catch (err2) {
     console.warn(
       `[bugs-folder] could not resolve/create the "Bugs" folder for project ${projectId}; bug filing falls back to agent find-or-create:`,
-      err instanceof Error ? err.message : err
+      err2 instanceof Error ? err2.message : err2
     );
     return null;
   }
@@ -12334,17 +12416,17 @@ var init_lang_detect = __esm({
 
 // src/analyze/tree-sitter/cache.ts
 import { mkdir as mkdir5, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname7, join as join7 } from "node:path";
+import { dirname as dirname7, join as join8 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { createHash } from "node:crypto";
 function defaultCacheRoot() {
-  return process.env.ARCHME_TOOLS_DIR ?? join7(homedir3(), ".archme", "tools");
+  return process.env.ARCHME_TOOLS_DIR ?? join8(homedir3(), ".archme", "tools");
 }
 function grammarCacheDir(cacheRoot) {
-  return join7(cacheRoot, "grammars");
+  return join8(cacheRoot, "grammars");
 }
 function cachedGrammarPath(cacheRoot, lang, version) {
-  return join7(grammarCacheDir(cacheRoot), `${lang}-${version}.wasm`);
+  return join8(grammarCacheDir(cacheRoot), `${lang}-${version}.wasm`);
 }
 async function fileExists(path7) {
   try {
@@ -12354,6 +12436,12 @@ async function fileExists(path7) {
     return false;
   }
 }
+function describeFetchFailure(err2) {
+  const top = err2 instanceof Error ? err2.message : String(err2);
+  const cause = err2?.cause;
+  const inner = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "";
+  return inner && inner !== top ? `${top} (${inner})` : top;
+}
 async function ensureGrammar(opts) {
   const target = cachedGrammarPath(opts.cacheDir, opts.lang, opts.version);
   if (await fileExists(target)) {
@@ -12363,11 +12451,25 @@ async function ensureGrammar(opts) {
   const url = `${opts.urlBase}/${opts.filename}`;
   process.stderr.write(`fetching grammar: ${opts.lang}@${opts.version} (${url})
 `);
-  const res = await fetch(url);
+  let res;
+  try {
+    res = await fetch(url);
+  } catch (err2) {
+    throw new GrammarFetchError({
+      lang: opts.lang,
+      version: opts.version,
+      url,
+      reason: describeFetchFailure(err2),
+      cause: err2
+    });
+  }
   if (!res.ok) {
-    throw new Error(
-      `failed to fetch grammar ${opts.lang}@${opts.version}: HTTP ${res.status}`
-    );
+    throw new GrammarFetchError({
+      lang: opts.lang,
+      version: opts.version,
+      url,
+      reason: `HTTP ${res.status}${res.statusText ? ` ${res.statusText}` : ""}`
+    });
   }
   const buf = Buffer.from(await res.arrayBuffer());
   const actualHash = createHash("sha256").update(buf).digest("hex");
@@ -12379,9 +12481,41 @@ async function ensureGrammar(opts) {
   await writeFile6(target, buf);
   return { path: target, downloaded: true };
 }
+var GrammarFetchError;
 var init_cache = __esm({
   "src/analyze/tree-sitter/cache.ts"() {
     "use strict";
+    GrammarFetchError = class extends Error {
+      lang;
+      url;
+      constructor(opts) {
+        super(
+          [
+            `Failed to download the ${opts.lang} tree-sitter grammar (${opts.lang}@${opts.version}).`,
+            `  URL:    ${opts.url}`,
+            `  Reason: ${opts.reason}`,
+            "",
+            "archme fetches language grammars on first use and caches them under",
+            "~/.archme/tools/grammars (override with ARCHME_TOOLS_DIR). This host could",
+            "not reach the CDN.",
+            "",
+            "If you're behind a proxy, export it before re-running:",
+            "  export HTTPS_PROXY=http://proxy.example.com:8080",
+            "  export HTTP_PROXY=$HTTPS_PROXY",
+            "",
+            "Then warm the cache once (it is reused by every later run):",
+            "  archme analyze prefetch --all",
+            "",
+            "Offline/air-gapped: copy a populated ~/.archme/tools/grammars directory",
+            "from a machine that has network access, or point ARCHME_TOOLS_DIR at one."
+          ].join("\n"),
+          opts.cause === void 0 ? void 0 : { cause: opts.cause }
+        );
+        this.name = "GrammarFetchError";
+        this.lang = opts.lang;
+        this.url = opts.url;
+      }
+    };
   }
 });
 
@@ -12864,13 +12998,13 @@ async function outlineSource(source, file) {
       confidence: 0.8,
       data: { file, symbols }
     });
-  } catch (err) {
+  } catch (err2) {
     return envelope({
       tool: "file",
       tier: 0,
       confidence: 0.2,
       data: { file, symbols: [] },
-      warnings: [`parse failed, falling back to file tier: ${err.message}`]
+      warnings: [`parse failed, falling back to file tier: ${err2.message}`]
     });
   }
 }
@@ -12887,13 +13021,13 @@ async function runOutline(file) {
   let source;
   try {
     source = await readFile6(file, "utf8");
-  } catch (err) {
+  } catch (err2) {
     return envelope({
       tool: "file",
       tier: 0,
       confidence: 0,
       data: { file, symbols: [] },
-      errors: [`cannot read ${file}: ${err.message}`]
+      errors: [`cannot read ${file}: ${err2.message}`]
     });
   }
   return outlineSource(source, file);
@@ -13496,11 +13630,11 @@ var require_ignore = __commonJS({
 
 // src/analyze/repo-walk.ts
 import { readdir, readFile as readFile7, stat as stat4 } from "node:fs/promises";
-import { join as join8, relative } from "node:path";
+import { join as join9, relative } from "node:path";
 async function loadGitignore(root) {
   const ig = (0, import_ignore.default)();
   try {
-    const text = await readFile7(join8(root, ".gitignore"), "utf8");
+    const text = await readFile7(join9(root, ".gitignore"), "utf8");
     ig.add(text);
   } catch {
     ig.add(["node_modules", "dist", "build", ".next", "coverage", ".turbo"]);
@@ -13514,7 +13648,7 @@ async function* walkRepoFiles(root, filter2 = {}) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const e of entries) {
       if (ALWAYS_SKIP.has(e.name)) continue;
-      const full = join8(dir, e.name);
+      const full = join9(dir, e.name);
       const rel = relative(root, full);
       if (e.isDirectory()) {
         if (ig.ignores(rel + "/")) continue;
@@ -13538,7 +13672,7 @@ async function collectRepoFiles(root, filter2 = {}) {
 }
 async function gitListFiles(root) {
   try {
-    await stat4(join8(root, ".git"));
+    await stat4(join9(root, ".git"));
   } catch {
     return null;
   }
@@ -13579,11 +13713,11 @@ var init_repo_walk = __esm({
 });
 
 // src/analyze/commands/repo.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 async function* walkRepo(root, opts = {}) {
   const files = await collectRepoFilesWithGit(root, opts);
   for (const rel of files) {
-    const env = await runOutline(join9(root, rel));
+    const env = await runOutline(join10(root, rel));
     yield env;
   }
 }
@@ -13597,9 +13731,9 @@ var init_repo = __esm({
 
 // src/analyze/matchers/file.ts
 import { stat as stat5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 async function matchFileAnchor(anchor, repoRoot) {
-  const full = join10(repoRoot, anchor.path);
+  const full = join11(repoRoot, anchor.path);
   try {
     const s = await stat5(full);
     if (!s.isFile()) {
@@ -13630,9 +13764,9 @@ var init_file = __esm({
 
 // src/analyze/matchers/directory.ts
 import { stat as stat6 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 async function matchDirectoryAnchor(anchor, repoRoot) {
-  const full = join11(repoRoot, anchor.path);
+  const full = join12(repoRoot, anchor.path);
   try {
     const s = await stat6(full);
     if (!s.isDirectory()) {
@@ -13701,9 +13835,9 @@ var init_findSymbol = __esm({
 
 // src/analyze/matchers/symbol.ts
 import { stat as stat7 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 async function matchSymbolAnchor(anchor, repoRoot) {
-  const full = join12(repoRoot, anchor.path);
+  const full = join13(repoRoot, anchor.path);
   try {
     await stat7(full);
   } catch {
@@ -13805,8 +13939,8 @@ async function runPrefetch(langs) {
       } else {
         result.skipped.push(lang);
       }
-    } catch (err) {
-      result.errors.push({ lang, message: err.message });
+    } catch (err2) {
+      result.errors.push({ lang, message: err2.message });
     }
   }
   return result;
@@ -14027,8 +14161,8 @@ async function acquireSingleInstanceLock(pidfile) {
   await mkdir6(dirname8(pidfile), { recursive: true });
   try {
     await writeFile7(pidfile, String(process.pid), { flag: "wx" });
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
+  } catch (err2) {
+    if (err2.code !== "EEXIST") throw err2;
   }
   let release;
   try {
@@ -14097,7 +14231,7 @@ var init_semaphore = __esm({
       acquire() {
         const slot = this.tryAcquire();
         if (slot) return Promise.resolve(slot);
-        return new Promise((resolve4) => this.waiters.push(resolve4));
+        return new Promise((resolve5) => this.waiters.push(resolve5));
       }
       makeRelease() {
         let released = false;
@@ -14144,11 +14278,11 @@ async function refreshOAuthCredentialsWith(refreshToken, cfg) {
         client_id: cfg.clientId
       })
     });
-  } catch (err) {
+  } catch (err2) {
     return {
       ok: false,
       permanent: false,
-      error: `network error: ${err instanceof Error ? err.message : String(err)}`
+      error: `network error: ${err2 instanceof Error ? err2.message : String(err2)}`
     };
   }
   const body = await parseJsonResponse(response);
@@ -14182,11 +14316,11 @@ async function getOAuthUserInfoWith(accessToken, cfg) {
 function resolveUserId(userInfo2, storedUserId) {
   return userInfo2.sub ?? storedUserId ?? null;
 }
-function isAuthError(err) {
-  if (!err || typeof err !== "object") return false;
-  const msg = ("message" in err ? String(err.message) : "").toLowerCase();
-  const code = ("code" in err ? String(err.code) : "").toLowerCase();
-  const status = "status" in err ? Number(err.status) : 0;
+function isAuthError(err2) {
+  if (!err2 || typeof err2 !== "object") return false;
+  const msg = ("message" in err2 ? String(err2.message) : "").toLowerCase();
+  const code = ("code" in err2 ? String(err2.code) : "").toLowerCase();
+  const status = "status" in err2 ? Number(err2.status) : 0;
   return status === 401 || code === "pgrst301" || msg.includes("jwt expired") || msg.includes("invalid jwt") || msg.includes("not authenticated");
 }
 async function withAuthRetry(label, fn, reLogin) {
@@ -14195,8 +14329,8 @@ async function withAuthRetry(label, fn, reLogin) {
   console.warn(`${label}: auth error on first attempt, re-logging in and retrying once`);
   try {
     await reLogin();
-  } catch (err) {
-    console.error(`${label}: re-login failed:`, err);
+  } catch (err2) {
+    console.error(`${label}: re-login failed:`, err2);
     return first;
   }
   return await fn();
@@ -14207,8 +14341,8 @@ async function fetchWithAuthRetry(label, doFetch, reLogin) {
   console.warn(`${label}: 401 on first attempt, re-logging in and retrying once`);
   try {
     await reLogin();
-  } catch (err) {
-    console.error(`${label}: re-login failed:`, err);
+  } catch (err2) {
+    console.error(`${label}: re-login failed:`, err2);
     return first;
   }
   return await doFetch();
@@ -14315,8 +14449,8 @@ var init_sessionAuth = __esm({
         for (const l of this.listeners) {
           try {
             l(token);
-          } catch (err) {
-            console.error("sessionAuth: listener error:", err);
+          } catch (err2) {
+            console.error("sessionAuth: listener error:", err2);
           }
         }
       }
@@ -14362,7 +14496,7 @@ var init_sessionAuth = __esm({
       armRefreshTimer(delayMs) {
         if (this.refreshTimer) clearTimeout(this.refreshTimer);
         this.refreshTimer = setTimeout(() => {
-          this.runScheduledRefresh().catch((err) => console.error("auth: token refresh failed:", err));
+          this.runScheduledRefresh().catch((err2) => console.error("auth: token refresh failed:", err2));
         }, delayMs);
       }
       // Translate a token lifetime (seconds) into the timer delay: fire 5 min before
@@ -14404,9 +14538,9 @@ var init_sessionAuth = __esm({
         try {
           await this.coalescedRefresh("token refresh");
           this.rearmFromLiveExpiry();
-        } catch (err) {
-          const detail = err instanceof Error ? err.message : String(err);
-          const permanent = err instanceof LoadStoredAndRefreshError && err.permanent;
+        } catch (err2) {
+          const detail = err2 instanceof Error ? err2.message : String(err2);
+          const permanent = err2 instanceof LoadStoredAndRefreshError && err2.permanent;
           if (permanent) {
             console.error(`auth: token refresh failed permanently; auto-refresh stopped: ${detail}`);
             return;
@@ -14750,9 +14884,13 @@ function rateLimitDeferPlan(text, nowMs = Date.now(), defaultTimeZone = localTim
   }
   return null;
 }
+function stripPromptEcho(haystack, prompt) {
+  if (!prompt || prompt.length < 40) return haystack;
+  return haystack.split(prompt).join(" ");
+}
 function rateLimitDeferPlanForExit(channels, nowMs = Date.now(), defaultTimeZone = localTimeZone()) {
-  const haystack = `${channels.message}
-${channels.stderr}`;
+  const haystack = stripPromptEcho(`${channels.message}
+${channels.stderr}`, channels.prompt);
   return rateLimitDeferPlan(haystack, nowMs, defaultTimeZone);
 }
 var RATE_LIMIT_RE, MONTHS, RATE_LIMIT_TENTATIVE_PAUSE_MS, DATED_RESET_ROLLOVER_GRACE_MS, RATE_LIMIT_PAUSE_PADDING_MS, RATE_LIMIT_SHAPED_RE;
@@ -14781,15 +14919,50 @@ var init_rateLimit = __esm({
   }
 });
 
+// src/packageRoot.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname9, join as join14, parse } from "node:path";
+function defaultReadFile(path7) {
+  return readFileSync4(path7, "utf8");
+}
+function findPackageRoot2(startDir, opts = {}) {
+  const readFile14 = opts.readFile ?? defaultReadFile;
+  const stopAt = parse(startDir).root;
+  let dir = startDir;
+  for (; ; ) {
+    try {
+      const parsed = JSON.parse(readFile14(join14(dir, "package.json")));
+      if (parsed.name === PACKAGE_NAME) return dir;
+    } catch {
+    }
+    if (dir === stopAt) return null;
+    const parent = dirname9(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+var PACKAGE_NAME;
+var init_packageRoot = __esm({
+  "src/packageRoot.ts"() {
+    "use strict";
+    PACKAGE_NAME = "@archme/cli";
+  }
+});
+
 // src/daemon/version.ts
+var version_exports = {};
+__export(version_exports, {
+  readDaemonVersion: () => readDaemonVersion
+});
 import { readFile as readFile10 } from "node:fs/promises";
-import { dirname as dirname9, join as join13 } from "node:path";
+import { dirname as dirname10, join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 async function readDaemonVersion() {
   try {
-    const here = dirname9(fileURLToPath4(import.meta.url));
-    const pkgPath = join13(here, "..", "..", "package.json");
-    const raw = await readFile10(pkgPath, "utf8");
+    const here = dirname10(fileURLToPath4(import.meta.url));
+    const root = findPackageRoot2(here);
+    if (!root) return null;
+    const raw = await readFile10(join15(root, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : null;
   } catch {
@@ -14799,12 +14972,13 @@ async function readDaemonVersion() {
 var init_version = __esm({
   "src/daemon/version.ts"() {
     "use strict";
+    init_packageRoot();
   }
 });
 
 // src/daemon/materializeDiff.ts
 import { mkdir as mkdir7, writeFile as writeFile8 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 function splitPatchByFile(patch) {
   if (!patch.trim()) return [];
@@ -14889,18 +15063,18 @@ function buildManifest(files, rangeLabel) {
 }
 async function materializeDiff(worktreeDir, patch, rangeLabel) {
   const files = splitPatchByFile(patch);
-  const dir = join14(worktreeDir, CHANGES_DIR);
-  const byFileDir = join14(dir, "by-file");
+  const dir = join16(worktreeDir, CHANGES_DIR);
+  const byFileDir = join16(dir, "by-file");
   await mkdir7(byFileDir, { recursive: true });
-  await writeFile8(join14(dir, "FULL.diff"), patch.endsWith("\n") ? patch : `${patch}
+  await writeFile8(join16(dir, "FULL.diff"), patch.endsWith("\n") ? patch : `${patch}
 `, "utf8");
   for (const f of files) {
     const rel = `by-file/${hashPath(f.path)}.diff`;
     f.diffPath = rel;
-    await writeFile8(join14(dir, rel), f.diff.endsWith("\n") ? f.diff : `${f.diff}
+    await writeFile8(join16(dir, rel), f.diff.endsWith("\n") ? f.diff : `${f.diff}
 `, "utf8");
   }
-  await writeFile8(join14(dir, "MANIFEST.md"), buildManifest(files, rangeLabel), "utf8");
+  await writeFile8(join16(dir, "MANIFEST.md"), buildManifest(files, rangeLabel), "utf8");
   return { dir, fileCount: files.length };
 }
 var CHANGES_DIR, STATUS_LABEL;
@@ -14912,6 +15086,583 @@ var init_materializeDiff = __esm({
   }
 });
 
+// src/daemon/branchMarker.ts
+async function readBranchMarker(client, projectId, archmeBranch) {
+  const { data, error } = await client.from("branches").select("last_source_sha, last_source_repo").eq("project_id", projectId).eq("name", archmeBranch).is("deleted_at", null).maybeSingle();
+  if (error || !data) return { sha: null, repo: null };
+  return { sha: data.last_source_sha ?? null, repo: data.last_source_repo ?? null };
+}
+var init_branchMarker = __esm({
+  "src/daemon/branchMarker.ts"() {
+    "use strict";
+  }
+});
+
+// src/daemon/localRepos.ts
+import { chmod as chmod2, mkdir as mkdir8, readFile as readFile11, writeFile as writeFile9 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname11, join as join17 } from "node:path";
+function localReposPath(env = process.env) {
+  return env.ARCHME_LOCAL_REPOS_PATH ?? join17(homedir4(), ".archme", "repos.json");
+}
+function isEntry(v) {
+  if (!v || typeof v !== "object") return false;
+  const o2 = v;
+  return REQUIRED_KEYS.every((k) => typeof o2[k] === "string" && o2[k].length > 0);
+}
+function parseLocalRepos(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+  const env = parsed;
+  if (env.v !== LOCAL_REPOS_VERSION) return [];
+  if (!Array.isArray(env.repos)) return [];
+  return env.repos.filter(isEntry).map((e) => {
+    const entry = {
+      watchedRepoId: e.watchedRepoId,
+      mirrorPath: e.mirrorPath,
+      sourcePath: e.sourcePath,
+      repoOwner: e.repoOwner,
+      repoName: e.repoName
+    };
+    const raw2 = e;
+    if (typeof raw2.haltedAt === "string" && raw2.haltedAt) entry.haltedAt = raw2.haltedAt;
+    if (typeof raw2.haltReason === "string" && raw2.haltReason) entry.haltReason = raw2.haltReason;
+    if (typeof raw2.haltCode === "string" && raw2.haltCode) entry.haltCode = raw2.haltCode;
+    return entry;
+  });
+}
+function serializeLocalRepos(repos) {
+  return JSON.stringify({ v: LOCAL_REPOS_VERSION, repos }, null, 2);
+}
+function keyOf(e) {
+  return e.watchedRepoId;
+}
+function upsertLocalRepo(repos, entry) {
+  const k = keyOf(entry);
+  const next = repos.filter((r) => keyOf(r) !== k);
+  next.push(entry);
+  return next;
+}
+function slugOf(e) {
+  return `${e.repoOwner}/${e.repoName}`;
+}
+function findLocalReposBySlug(repos, slug) {
+  const want = slug.toLowerCase();
+  return repos.filter((r) => slugOf(r).toLowerCase() === want);
+}
+function removeLocalReposBySlug(repos, slug) {
+  const want = slug.toLowerCase();
+  return repos.filter((r) => slugOf(r).toLowerCase() !== want);
+}
+function markHalted(repos, watchedRepoId, reason, at, code) {
+  return repos.map(
+    (r) => r.watchedRepoId === watchedRepoId ? { ...r, haltedAt: at, haltReason: reason, haltCode: code } : r
+  );
+}
+function clearHalt(repos, watchedRepoId) {
+  return repos.map((r) => {
+    if (r.watchedRepoId !== watchedRepoId) return r;
+    const { haltedAt: _at, haltReason: _reason, haltCode: _code, ...rest } = r;
+    return rest;
+  });
+}
+function findLocalRepoForJob(repos, job) {
+  if (!job.watched_repo_id) return null;
+  const match2 = repos.find((r) => r.watchedRepoId === job.watched_repo_id);
+  if (!match2) return null;
+  const sameRepo = match2.repoOwner.toLowerCase() === job.repo_owner.toLowerCase() && match2.repoName.toLowerCase() === job.repo_name.toLowerCase();
+  return sameRepo ? match2 : null;
+}
+async function loadLocalRepos(env = process.env) {
+  try {
+    return parseLocalRepos(await readFile11(localReposPath(env), "utf8"));
+  } catch {
+    return [];
+  }
+}
+async function saveLocalRepos(repos, env = process.env) {
+  const path7 = localReposPath(env);
+  await mkdir8(dirname11(path7), { recursive: true, mode: 448 });
+  await writeFile9(path7, serializeLocalRepos(repos), { mode: 384 });
+  await chmod2(path7, 384).catch(() => {
+  });
+}
+async function registerLocalRepo(entry, env = process.env) {
+  await saveLocalRepos(upsertLocalRepo(await loadLocalRepos(env), entry), env);
+}
+var LOCAL_REPOS_VERSION, REQUIRED_KEYS;
+var init_localRepos = __esm({
+  "src/daemon/localRepos.ts"() {
+    "use strict";
+    LOCAL_REPOS_VERSION = 1;
+    REQUIRED_KEYS = [
+      "watchedRepoId",
+      "mirrorPath",
+      "sourcePath",
+      "repoOwner",
+      "repoName"
+    ];
+  }
+});
+
+// ../shared/commitAdvance.ts
+function planAdvance(input) {
+  const { marker, upstreamTip, markerIsAncestorOfTip, tipIsAncestorOfMarker, firstParentShas } = input;
+  if (!marker) return { kind: "bootstrap-needed" };
+  if (marker === upstreamTip) return { kind: "up-to-date" };
+  if (markerIsAncestorOfTip) {
+    return firstParentShas.length === 0 ? { kind: "force-push", tip: upstreamTip } : { kind: "fast-forward", shas: firstParentShas };
+  }
+  if (tipIsAncestorOfMarker) return { kind: "upstream-behind", tip: upstreamTip };
+  return { kind: "force-push", tip: upstreamTip };
+}
+var init_commitAdvance = __esm({
+  "../shared/commitAdvance.ts"() {
+  }
+});
+
+// ../shared/commitGate.ts
+function decideGate(input) {
+  const { targetSha, markerSha, job, elapsedMs, timeoutMs } = input;
+  const pushedNewRef = input.pushedNewRef ?? true;
+  const noopGraceMs = input.noopGraceMs ?? 5 * 60 * 1e3;
+  if (markerSha && markerSha === targetSha) {
+    return {
+      action: "advance",
+      code: "marker-advanced",
+      reason: "marker advanced to target (clean completion)"
+    };
+  }
+  if (job && (job.status === "failed" || job.status === "cancelled")) {
+    return {
+      action: "stop",
+      code: "job-terminal",
+      reason: `job ${job.status} after ${job.attemptCount} attempt(s); marker did not advance \u2014 re-push commit ${short(targetSha)} (fresh delivery) or admin-requeue, do not fold forward`
+    };
+  }
+  if (!pushedNewRef && job === null && elapsedMs >= noopGraceMs) {
+    return {
+      action: "stop",
+      code: "noop-push-no-job",
+      reason: `no webhook fired for ${short(targetSha)} (fork ref already there) and no job appeared in ${Math.round(noopGraceMs / 1e3)}s \u2014 likely a lost webhook or rolled-back job; re-push with a fresh delivery (ref-bounce) or admin-requeue`
+    };
+  }
+  if (elapsedMs >= timeoutMs) {
+    return {
+      action: "stop",
+      code: "timeout",
+      reason: `timed out after ${Math.round(elapsedMs / 1e3)}s waiting for marker to reach ${short(targetSha)} (job: ${job ? job.status : "not enqueued"})`
+    };
+  }
+  return {
+    action: "wait",
+    code: "waiting",
+    reason: job ? `job ${job.status}` : "job not enqueued yet"
+  };
+}
+function short(sha) {
+  return sha.slice(0, 7);
+}
+var init_commitGate = __esm({
+  "../shared/commitGate.ts"() {
+  }
+});
+
+// src/daemon/localPoll.ts
+function planPollTick(input) {
+  const { marker, repo } = input;
+  if (!marker.sha) {
+    return { kind: "idle", reason: "waiting for the initial scan to establish the diff marker" };
+  }
+  if (marker.repo !== repo) {
+    return {
+      kind: "halt",
+      code: "job-terminal",
+      reason: `marker repo ${marker.repo ?? "n/a"} does not match ${repo} \u2014 local mode requires a github.com origin (re-run \`archme init\` if the remote changed)`
+    };
+  }
+  const plan = planAdvance({
+    marker: marker.sha,
+    upstreamTip: input.upstreamTip,
+    markerIsAncestorOfTip: input.markerIsAncestorOfTip,
+    tipIsAncestorOfMarker: input.tipIsAncestorOfMarker,
+    firstParentShas: input.firstParentShas
+  });
+  let target;
+  switch (plan.kind) {
+    case "bootstrap-needed":
+      return { kind: "idle", reason: "waiting for the initial scan to establish the diff marker" };
+    case "up-to-date":
+      return { kind: "idle", reason: "up to date" };
+    case "upstream-behind":
+      return {
+        kind: "idle",
+        reason: `upstream is behind the marker (reset to ${short2(plan.tip)}); nothing to do`
+      };
+    case "force-push":
+      target = plan.tip;
+      break;
+    case "fast-forward":
+      target = plan.shas[0];
+      break;
+  }
+  if (!input.jobForTarget) {
+    return { kind: "enqueue", beforeSha: marker.sha, afterSha: target };
+  }
+  const decision = decideGate({
+    targetSha: target,
+    markerSha: marker.sha,
+    job: { status: input.jobForTarget.status, attemptCount: input.jobForTarget.attemptCount },
+    elapsedMs: input.nowMs - input.jobForTarget.createdAtMs,
+    timeoutMs: input.gateTimeoutMs,
+    // The poller enqueues directly, so the "no-op push fired no webhook" case
+    // decideGate guards for cannot arise here.
+    pushedNewRef: true
+  });
+  switch (decision.action) {
+    case "stop":
+      return {
+        kind: "halt",
+        code: decision.code,
+        reason: localHaltReason(decision, input.jobForTarget, target)
+      };
+    case "advance":
+      return { kind: "idle", reason: decision.reason };
+    case "wait":
+      return { kind: "idle", reason: `${short2(target)}: ${decision.reason}` };
+  }
+}
+function localHaltReason(decision, job, targetSha) {
+  if (decision.code !== "job-terminal" || !job) return decision.reason;
+  return `commit ${short2(targetSha)} could not be processed (job ${job.status} after ${job.attemptCount} attempt(s)). Polling has stopped here rather than skipping it, because skipping would fold its changes into the next update.
+This one needs us \u2014 the failure is recorded against your account and visible to the ArchMe team. Get in touch if it is blocking you.`;
+}
+function short2(sha) {
+  return sha.slice(0, 7);
+}
+var init_localPoll = __esm({
+  "src/daemon/localPoll.ts"() {
+    "use strict";
+    init_commitAdvance();
+    init_commitGate();
+  }
+});
+
+// src/daemon/defaultBranch.ts
+function pickDefaultBranch(input) {
+  const onOrigin = new Set(input.remoteBranches);
+  if (input.symbolicRef) {
+    const slash = input.symbolicRef.indexOf("/");
+    const named = slash >= 0 ? input.symbolicRef.slice(slash + 1) : null;
+    if (named && onOrigin.has(named)) return named;
+  }
+  for (const candidate of CONVENTIONAL) {
+    if (onOrigin.has(candidate)) return candidate;
+  }
+  if (input.currentBranch && onOrigin.has(input.currentBranch)) return input.currentBranch;
+  return null;
+}
+var CONVENTIONAL;
+var init_defaultBranch = __esm({
+  "src/daemon/defaultBranch.ts"() {
+    "use strict";
+    CONVENTIONAL = ["main", "master"];
+  }
+});
+
+// src/daemon/localGit.ts
+var localGit_exports = {};
+__export(localGit_exports, {
+  createMirrorClone: () => createMirrorClone,
+  detectDefaultBranch: () => detectDefaultBranch,
+  fetchOrigin: () => fetchOrigin,
+  firstParentRange: () => firstParentRange,
+  isAncestor: () => isAncestor,
+  readCommitMeta: () => readCommitMeta,
+  readOriginUrl: () => readOriginUrl,
+  revParse: () => revParse,
+  setOriginUrl: () => setOriginUrl
+});
+import { mkdir as mkdir9 } from "node:fs/promises";
+import { dirname as dirname12 } from "node:path";
+async function git(dir, args, opts = {}) {
+  requireBinary("git");
+  const res = await execa("git", args, {
+    cwd: dir ?? void 0,
+    reject: false,
+    timeout: GIT_TIMEOUT_MS,
+    // Kill the whole process group: a hung `git fetch` has spawned helper
+    // processes (ssh, credential helpers) that keep the pipe open, so killing
+    // git alone can leave the await pending on a dead parent.
+    killSignal: "SIGKILL",
+    // A large `rev-list` on a busy repo can be megabytes.
+    maxBuffer: 64 * 1024 * 1024
+  });
+  const exitCode = res.exitCode ?? 1;
+  if (!opts.allowFail && exitCode !== 0) {
+    throw new Error(`git ${args.join(" ")} failed (${exitCode}): ${(res.stderr || "").trim()}`);
+  }
+  return { exitCode, stdout: res.stdout || "", stderr: res.stderr || "" };
+}
+async function createMirrorClone(sourcePath, mirrorPath, originUrl) {
+  await mkdir9(dirname12(mirrorPath), { recursive: true });
+  await git(null, ["clone", "--local", "--no-hardlinks", sourcePath, mirrorPath]);
+  await git(mirrorPath, ["remote", "set-url", "origin", originUrl]);
+}
+async function setOriginUrl(dir, originUrl) {
+  await git(dir, ["remote", "set-url", "origin", originUrl]);
+}
+async function readOriginUrl(dir) {
+  const { exitCode, stdout } = await git(dir, ["remote", "get-url", "origin"], { allowFail: true });
+  if (exitCode !== 0) return null;
+  return stdout.trim() || null;
+}
+async function fetchOrigin(dir, branch) {
+  await git(dir, ["fetch", "--quiet", "--no-tags", "origin", branch]);
+}
+async function revParse(dir, ref) {
+  return (await git(dir, ["rev-parse", ref])).stdout.trim();
+}
+async function isAncestor(dir, a2, b) {
+  return (await git(dir, ["merge-base", "--is-ancestor", a2, b], { allowFail: true })).exitCode === 0;
+}
+async function firstParentRange(dir, marker, tip) {
+  const { stdout } = await git(dir, [
+    "rev-list",
+    "--reverse",
+    "--first-parent",
+    `${marker}..${tip}`
+  ]);
+  return stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+}
+async function readCommitMeta(dir, sha) {
+  const { exitCode, stdout } = await git(
+    dir,
+    ["show", "-s", "--format=%s%n%an%n%cI", sha],
+    { allowFail: true }
+  );
+  if (exitCode !== 0) return { message: "", authorName: null, committedAt: null };
+  const [message = "", authorName = "", committedAt = ""] = stdout.split("\n");
+  return {
+    message: message.trim(),
+    authorName: authorName.trim() || null,
+    committedAt: committedAt.trim() || null
+  };
+}
+async function detectDefaultBranch(dir) {
+  const symbolic = await git(dir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], {
+    allowFail: true
+  });
+  const remotes = await git(
+    dir,
+    ["for-each-ref", "--format=%(refname:strip=3)", "refs/remotes/origin"],
+    { allowFail: true }
+  );
+  const current = await git(dir, ["rev-parse", "--abbrev-ref", "HEAD"], { allowFail: true });
+  return pickDefaultBranch({
+    symbolicRef: symbolic.exitCode === 0 ? symbolic.stdout.trim() : null,
+    remoteBranches: remotes.exitCode === 0 ? remotes.stdout.split("\n").map((l) => l.trim()).filter((l) => l && l !== "HEAD") : [],
+    // Detached HEAD reports the literal "HEAD", which is not a branch name.
+    currentBranch: current.exitCode === 0 && current.stdout.trim() !== "HEAD" ? current.stdout.trim() : null
+  });
+}
+var GIT_TIMEOUT_MS;
+var init_localGit = __esm({
+  "src/daemon/localGit.ts"() {
+    "use strict";
+    init_execa();
+    init_preflight();
+    init_defaultBranch();
+    GIT_TIMEOUT_MS = 10 * 60 * 1e3;
+  }
+});
+
+// src/daemon/localPoller.ts
+async function pollRepoOnce(entry, deps) {
+  const repo = `${entry.repoOwner}/${entry.repoName}`;
+  const gateTimeoutMs = deps.gateTimeoutMs ?? DEFAULT_GATE_TIMEOUT_MS;
+  const row = await deps.readWatchedRepo(entry.watchedRepoId);
+  if (!row) {
+    return {
+      kind: "halt",
+      // Not a gate outcome — the repo is gone from under us. Reuses the
+      // terminal code because the consequence is the same: this will not fix
+      // itself, and `--resume` cannot clear it.
+      code: "job-terminal",
+      reason: `${repo} is no longer registered on the server (the watched repo was removed). Stop watching it here with \`archme local-watch --stop ${repo}\`.`
+    };
+  }
+  if (row.sourceKind !== "local") {
+    return {
+      kind: "halt",
+      code: "job-terminal",
+      reason: `${repo} is now connected via the GitHub App, which produces its own updates. Local polling is no longer needed \u2014 \`archme local-watch --stop ${repo}\`.`
+    };
+  }
+  if (!row.enabled) {
+    return { kind: "idle", reason: `${repo}: watching is disabled on the server` };
+  }
+  await deps.git.fetchOrigin(entry.mirrorPath, row.repoBranch);
+  const marker = await deps.readMarker(row.projectId, row.archmeBranch);
+  const upstreamTip = await deps.git.revParse(entry.mirrorPath, `origin/${row.repoBranch}`);
+  const base = {
+    repo,
+    marker,
+    upstreamTip,
+    nowMs: deps.now(),
+    gateTimeoutMs
+  };
+  if (!marker.sha) {
+    return planPollTick({
+      ...base,
+      markerIsAncestorOfTip: false,
+      tipIsAncestorOfMarker: false,
+      firstParentShas: [],
+      jobForTarget: null
+    });
+  }
+  const markerIsAncestorOfTip = await deps.git.isAncestor(entry.mirrorPath, marker.sha, upstreamTip);
+  const tipIsAncestorOfMarker = await deps.git.isAncestor(entry.mirrorPath, upstreamTip, marker.sha);
+  const firstParentShas = markerIsAncestorOfTip ? await deps.git.firstParentRange(entry.mirrorPath, marker.sha, upstreamTip) : [];
+  const ancestry = {
+    ...base,
+    markerIsAncestorOfTip,
+    tipIsAncestorOfMarker,
+    firstParentShas
+  };
+  const first = planPollTick({ ...ancestry, jobForTarget: null });
+  if (first.kind !== "enqueue") return first;
+  const jobForTarget = await deps.readJobForSha(row.projectId, row.archmeBranch, first.afterSha);
+  const observedAtMs = deps.firstObservedAt(
+    `${entry.watchedRepoId}:${first.afterSha}`,
+    deps.now()
+  );
+  const decision = planPollTick({
+    ...ancestry,
+    jobForTarget: jobForTarget ? { ...jobForTarget, createdAtMs: observedAtMs } : null
+  });
+  if (decision.kind !== "enqueue") return decision;
+  const result = await deps.enqueue(entry, row, decision.beforeSha, decision.afterSha);
+  if (result.dedup) {
+    deps.log(`  ${repo}: ${short3(decision.afterSha)} already enqueued elsewhere`);
+  } else {
+    deps.log(`  ${repo}: enqueued ${short3(decision.afterSha)} (job ${result.jobId ?? "?"})`);
+  }
+  return decision;
+}
+async function pollAllRepos(repos, deps) {
+  for (const entry of repos) {
+    const key = `${entry.repoOwner}/${entry.repoName} (${entry.watchedRepoId.slice(0, 8)})`;
+    if (entry.haltedAt) continue;
+    try {
+      const action = await pollRepoOnce(entry, deps);
+      if (action.kind === "halt") {
+        await deps.persistHalt(entry, action.reason, action.code);
+        deps.log(
+          `
+  \u26A0 local poll HALTED for ${key}: ${action.reason}
+    No further commits will be processed for this repo.
+    Advancing past a failed commit would fold it into the next diff and break the
+    one-ArchMe-commit-per-git-commit guarantee, so this stops instead.
+    When the cause is fixed:  archme local-watch --resume ${entry.repoOwner}/${entry.repoName}
+`
+        );
+      }
+    } catch (err2) {
+      deps.log(`  local poll ${key} failed (will retry): ${err2.message}`);
+    }
+  }
+}
+function makePollerDeps(client, log, gateTimeoutMs) {
+  const firstSeen = /* @__PURE__ */ new Map();
+  return {
+    git: localGit_exports,
+    log,
+    now: () => Date.now(),
+    gateTimeoutMs,
+    firstObservedAt(key, nowMs) {
+      const existing = firstSeen.get(key);
+      if (existing !== void 0) return existing;
+      firstSeen.set(key, nowMs);
+      return nowMs;
+    },
+    async persistHalt(entry, reason, code) {
+      const repos = await loadLocalRepos();
+      await saveLocalRepos(
+        markHalted(repos, entry.watchedRepoId, reason, (/* @__PURE__ */ new Date()).toISOString(), code)
+      );
+    },
+    async readWatchedRepo(watchedRepoId) {
+      const { data, error } = await client.from("watched_repos").select("project_id, branch, commit_update_archme_branch, source_kind, enabled").eq("id", watchedRepoId).is("deleted_at", null).maybeSingle();
+      if (error || !data) return null;
+      const r = data;
+      return {
+        projectId: r.project_id,
+        repoBranch: r.branch,
+        // Mirrors the webhook's own fallback (`commit_update_archme_branch ??
+        // branch`), so both producers resolve the same lane for the same row.
+        archmeBranch: r.commit_update_archme_branch ?? r.branch,
+        sourceKind: r.source_kind,
+        enabled: r.enabled
+      };
+    },
+    // Shared with the job runner and local-watch's readiness check: three
+    // readers of the same marker drifting apart is how one of them ends up
+    // deciding against a value the others don't see.
+    readMarker: (projectId, archmeBranch) => readBranchMarker(client, projectId, archmeBranch),
+    async readJobForSha(projectId, archmeBranch, sha) {
+      const { data, error } = await client.from("archme_jobs").select("status, attempt_count, created_at").eq("project_id", projectId).eq("archme_branch", archmeBranch).eq("after_sha", sha).order("created_at", { ascending: false }).limit(1);
+      if (error || !data || data.length === 0) return null;
+      const row = data[0];
+      return {
+        status: row.status,
+        attemptCount: row.attempt_count ?? 0,
+        createdAtMs: new Date(row.created_at).getTime()
+      };
+    },
+    async enqueue(entry, row, beforeSha, afterSha) {
+      const meta = await readCommitMeta(entry.mirrorPath, afterSha);
+      const { data, error } = await client.rpc("enqueue_local_archme_job", {
+        p_watched_repo_id: entry.watchedRepoId,
+        // From the ROW, not the registry: these decide which lane the job lands
+        // in, and a stale copy would enqueue against the wrong branch.
+        p_repo_branch: row.repoBranch,
+        p_archme_branch: row.archmeBranch,
+        p_before_sha: beforeSha,
+        p_after_sha: afterSha,
+        p_commit_message: meta.message || null,
+        p_head_commit_timestamp: meta.committedAt,
+        p_author_name: meta.authorName,
+        // `author_login` is a GitHub concept with no git equivalent. The webhook
+        // path fills it from the push payload; local mode leaves it null.
+        p_author_login: null
+      });
+      if (error) throw new Error(`enqueue_local_archme_job: ${error.message}`);
+      return data ?? {};
+    }
+  };
+}
+function short3(sha) {
+  return sha.slice(0, 7);
+}
+var DEFAULT_POLL_INTERVAL_MS, DEFAULT_GATE_TIMEOUT_MS;
+var init_localPoller = __esm({
+  "src/daemon/localPoller.ts"() {
+    "use strict";
+    init_localPoll();
+    init_localRepos();
+    init_branchMarker();
+    init_localGit();
+    DEFAULT_POLL_INTERVAL_MS = 6e4;
+    DEFAULT_GATE_TIMEOUT_MS = 4 * 60 * 60 * 1e3;
+  }
+});
+
 // src/daemon/run.ts
 var run_exports = {};
 __export(run_exports, {
@@ -14933,11 +15684,11 @@ __export(run_exports, {
 });
 import { createClient } from "@supabase/supabase-js";
 import { randomUUID } from "node:crypto";
-import { mkdtemp as mkdtemp3, mkdir as mkdir8, writeFile as writeFile9, rm as rm6, stat as stat8, chmod as chmod2 } from "node:fs/promises";
+import { mkdtemp as mkdtemp3, mkdir as mkdir10, writeFile as writeFile10, rm as rm6, stat as stat8, chmod as chmod3 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join18 } from "node:path";
 import { pathToFileURL } from "node:url";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 function attributeKillCause(result, recorded) {
   if (recorded) return recorded;
   if (result.signal === "SIGTERM") return "timeout";
@@ -14968,7 +15719,7 @@ async function lookupProjectSlug(client, projectId) {
   return `${orgSlug}/${data.slug}`;
 }
 function cloneDirFor(baseDir, owner, name) {
-  return join15(baseDir, owner, name);
+  return join18(baseDir, owner, name);
 }
 async function exists(p) {
   try {
@@ -15013,9 +15764,9 @@ async function getRepoCredentials(ctx, jobId, deviceId) {
   };
 }
 async function buildGitEnv(credentials) {
-  const dir = await mkdtemp3(join15(tmpdir3(), "archme-git-askpass-"));
-  const askpassPath = join15(dir, "askpass.sh");
-  await writeFile9(
+  const dir = await mkdtemp3(join18(tmpdir3(), "archme-git-askpass-"));
+  const askpassPath = join18(dir, "askpass.sh");
+  await writeFile10(
     askpassPath,
     [
       "#!/bin/sh",
@@ -15028,7 +15779,7 @@ async function buildGitEnv(credentials) {
     ].join("\n"),
     { mode: 448 }
   );
-  await chmod2(askpassPath, 448).catch(() => {
+  await chmod3(askpassPath, 448).catch(() => {
   });
   const gitConfigEntries = [
     ["credential.helper", ""],
@@ -15053,16 +15804,38 @@ async function buildGitEnv(credentials) {
   return { env, cleanup: () => rm6(dir, { recursive: true, force: true }).catch(() => {
   }) };
 }
+async function ensureLocalCloneAndFetch(job, entry) {
+  const dir = entry.mirrorPath;
+  await cloneMutex.runExclusive(dir, async () => {
+    if (!await exists(join18(dir, ".git"))) {
+      throw new Error(
+        `local mirror ${dir} is missing or not a git repo \u2014 re-run \`archme init ${entry.sourcePath}\``
+      );
+    }
+    await execa("git", ["fetch", "--no-tags", "origin", job.repo_branch], { cwd: dir, reject: false });
+    const afterCheck = await execa("git", ["cat-file", "-e", job.after_sha], { cwd: dir, reject: false });
+    if (afterCheck.exitCode !== 0) {
+      await execa("git", ["fetch", "origin"], { cwd: dir, reject: false });
+    }
+  }).catch((err2) => {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
+    throw new Error(`local repo ${job.repo_owner}/${job.repo_name} is not usable: ${msg}`);
+  });
+  return { dir, gitEnv: process.env, cleanupGitEnv: async () => {
+  } };
+}
 async function ensureCloneAndFetch(ctx, job, claimDeviceId) {
+  const localEntry = findLocalRepoForJob(await loadLocalRepos(), job);
+  if (localEntry) return await ensureLocalCloneAndFetch(job, localEntry);
   const deviceId = claimDeviceId ?? ctx.deviceForOrg(job.org_id) ?? ctx.auth.getDeviceId();
   if (!deviceId) throw new Error("daemon is not signed in with a registered device");
   const credentials = await getRepoCredentials(ctx, job.id, deviceId);
-  await mkdir8(ctx.cloneBaseDir, { recursive: true });
+  await mkdir10(ctx.cloneBaseDir, { recursive: true });
   const dir = cloneDirFor(ctx.cloneBaseDir, job.repo_owner, job.repo_name);
   const { env, cleanup: cleanupGitEnv } = await buildGitEnv(credentials);
   await cloneMutex.runExclusive(dir, async () => {
-    if (!await exists(join15(dir, ".git"))) {
-      await mkdir8(join15(ctx.cloneBaseDir, job.repo_owner), { recursive: true });
+    if (!await exists(join18(dir, ".git"))) {
+      await mkdir10(join18(ctx.cloneBaseDir, job.repo_owner), { recursive: true });
       console.log(`  cloning ${job.repo_owner}/${job.repo_name} \u2192 ${dir}`);
       await execa("git", ["clone", "--no-tags", credentials.https_url, dir], { env, reject: true });
     } else {
@@ -15083,22 +15856,22 @@ async function ensureCloneAndFetch(ctx, job, claimDeviceId) {
         await execa("git", ["fetch", "origin", job.before_sha], { cwd: dir, env, reject: false });
       }
     }
-  }).catch(async (err) => {
+  }).catch(async (err2) => {
     await cleanupGitEnv();
-    const msg = err instanceof Error ? err.message : String(err);
+    const msg = err2 instanceof Error ? err2.message : String(err2);
     throw new Error(`GitHub App cannot access ${job.repo_owner}/${job.repo_name}: ${msg}`);
   });
   return { dir, gitEnv: env, cleanupGitEnv };
 }
 async function createJobWorktree(repoDir, job) {
-  const parentDir = await mkdtemp3(join15(tmpdir3(), "archme-job-worktree-"));
-  const worktreeDir = join15(parentDir, "repo");
+  const parentDir = await mkdtemp3(join18(tmpdir3(), "archme-job-worktree-"));
+  const worktreeDir = join18(parentDir, "repo");
   try {
     await cloneMutex.runExclusive(repoDir, () => execa("git", ["worktree", "add", "--detach", worktreeDir, job.after_sha], { cwd: repoDir, reject: true }));
-  } catch (err) {
+  } catch (err2) {
     await rm6(parentDir, { recursive: true, force: true }).catch(() => {
     });
-    throw err;
+    throw err2;
   }
   return {
     worktreeDir,
@@ -15117,7 +15890,7 @@ function noUsableBaseError(branch, markerSha, detail) {
   );
 }
 async function isShaReachable(repoDir, sha) {
-  const { exitCode } = await execa("git", ["cat-file", "-e", sha], { cwd: repoDir, reject: false });
+  const { exitCode } = await execa("git", ["cat-file", "-e", `${sha}^{commit}`], { cwd: repoDir, reject: false });
   return exitCode === 0;
 }
 async function buildDiffPayload(repoDir, before, after) {
@@ -15140,7 +15913,16 @@ async function forcePushProvenance(repoDir, base, after) {
   const forkNote = fork.trim() ? ` (history diverged at \`${fork.trim().slice(0, 8)}\`)` : "";
   return `Force push: the branch tip was rewritten${forkNote}. The diff below is the exact net delta from the last reflected commit \`${base.slice(0, 8)}\` to the new tip \`${after.slice(0, 8)}\`, computed tree-to-tree \u2014 the rewrite does not affect it.`;
 }
+function isGitSha(v) {
+  return typeof v === "string" && GIT_SHA_RE.test(v);
+}
+function assertGitSha(v, field) {
+  if (!isGitSha(v)) {
+    throw new Error(`${field} ${v ?? "(null)"} is not a 40-character git SHA`);
+  }
+}
 async function computeDiff(job, repoDir, marker, gitEnv) {
+  assertGitSha(job.after_sha, "after_sha");
   if (!await isShaReachable(repoDir, job.after_sha)) {
     throw new Error(`after_sha ${job.after_sha} is not reachable after fetch`);
   }
@@ -15163,6 +15945,9 @@ async function computeDiff(job, repoDir, marker, gitEnv) {
   if (marker.repo !== repo) {
     throw noUsableBaseError(job.archme_branch, marker.sha, `marker repo ${marker.repo ?? "n/a"} does not match job repo ${repo}`);
   }
+  if (!isGitSha(marker.sha)) {
+    throw noUsableBaseError(job.archme_branch, marker.sha, `marker SHA ${marker.sha} is not a 40-character git SHA`);
+  }
   const base = marker.sha;
   if (base === after) return "skip";
   if (!await isShaReachable(repoDir, base)) {
@@ -15177,11 +15962,6 @@ async function computeDiff(job, repoDir, marker, gitEnv) {
   if (job.forced) payload.provenance = await forcePushProvenance(repoDir, base, after);
   return payload;
 }
-async function readBranchMarker(client, projectId, archmeBranch) {
-  const { data, error } = await client.from("branches").select("last_source_sha, last_source_repo").eq("project_id", projectId).eq("name", archmeBranch).maybeSingle();
-  if (error || !data) return { sha: null, repo: null };
-  return { sha: data.last_source_sha ?? null, repo: data.last_source_repo ?? null };
-}
 function buildDiffPrompt(job, projectSlug, diff, checkoutDir, affectedSeed, bugsFolderId) {
   const sentinel = `UNTRUSTED-DIFF-${randomUUID()}`;
   const seedBlock = affectedSeed ? `
@@ -15515,9 +16295,9 @@ async function probeMcpAuth(mcpUrl, bearer, opts = {}) {
         };
       }
       lastDetail = "MCP returned 401 \u2014 token rejected by JWKS verification";
-    } catch (err) {
+    } catch (err2) {
       lastStatus = null;
-      lastDetail = `network error reaching MCP: ${err instanceof Error ? err.message : String(err)}`;
+      lastDetail = `network error reaching MCP: ${err2 instanceof Error ? err2.message : String(err2)}`;
     }
   }
   if (lastStatus === 401) {
@@ -15655,6 +16435,7 @@ async function runJob(ctx, job, claimDeviceId) {
   };
   let metrics = { durations_ms: timings };
   let logs = { stdout: "", stderr: "" };
+  let sentPrompt;
   const cleanupFns = [];
   const heartbeat = setInterval(() => {
     rpcHeartbeat(ctx, job.id, deviceId);
@@ -15765,7 +16546,7 @@ async function runJob(ctx, job, claimDeviceId) {
         const affected = resolveAffected(seedArch, diff.changedFiles, changedSymbolsByFile);
         affectedForComplete = affected;
         const symbolsInFile = async (file) => {
-          const outline = await runOutline(join15(worktreeDir, file));
+          const outline = await runOutline(join18(worktreeDir, file));
           if (outline.tier !== 2) return null;
           return outline.data.symbols.map((s) => s.name);
         };
@@ -15788,6 +16569,7 @@ async function runJob(ctx, job, claimDeviceId) {
     }
     const bugsFolderId = await ensureBugsFolder(ctx.supabase, job.project_id);
     const prompt = buildDiffPrompt(job, projectSlug, diff, worktreeDir, affectedSeed, bugsFolderId);
+    sentPrompt = prompt;
     if (cancelled.has(job.id)) {
       log(`cancelled before claude spawn, aborting`);
       return;
@@ -15893,9 +16675,9 @@ async function runJob(ctx, job, claimDeviceId) {
       true,
       affectedFieldForComplete(job.source_mode, affectedForComplete)
     );
-  } catch (err) {
+  } catch (err2) {
     if (cancelled.has(job.id)) {
-      console.log(`[${job.id}] cancelled, swallowing error: ${err instanceof Error ? err.message : err}`);
+      console.log(`[${job.id}] cancelled, swallowing error: ${err2 instanceof Error ? err2.message : err2}`);
       await rpcRollback(ctx, job.id, deviceId);
       return;
     }
@@ -15903,10 +16685,15 @@ async function runJob(ctx, job, claimDeviceId) {
       console.log(`[${job.id}] shutdown \u2014 routed to retry by shutdown handler`);
       return;
     }
-    const msg = err instanceof Error ? err.message : String(err);
-    const haystack = `${msg}
-${logs.stderr}`;
-    const plan = rateLimitDeferPlanForExit({ message: msg, stderr: logs.stderr, stdout: logs.stdout });
+    const msg = err2 instanceof Error ? err2.message : String(err2);
+    const haystack = stripPromptEcho(`${msg}
+${logs.stderr}`, sentPrompt);
+    const plan = rateLimitDeferPlanForExit({
+      message: msg,
+      stderr: logs.stderr,
+      stdout: logs.stdout,
+      prompt: sentPrompt
+    });
     if (plan) {
       const { parsed, pauseUntil, info } = plan;
       if (!parsed) {
@@ -15975,7 +16762,7 @@ async function dispatch(sched) {
         }
         ctxByJob.set(claimed.job.id, claimed.ctx);
         deviceByJob.set(claimed.job.id, claimed.deviceId);
-        const p = sched.run(claimed.ctx, claimed.job, claimed.deviceId).catch((err) => console.error(`[${claimed.job.id}] run error:`, err instanceof Error ? err.message : err)).finally(() => {
+        const p = sched.run(claimed.ctx, claimed.job, claimed.deviceId).catch((err2) => console.error(`[${claimed.job.id}] run error:`, err2 instanceof Error ? err2.message : err2)).finally(() => {
           ctxByJob.delete(claimed.job.id);
           deviceByJob.delete(claimed.job.id);
           slot();
@@ -16011,7 +16798,7 @@ function subscribe(client, sched) {
     "postgres_changes",
     { event: "INSERT", schema: "public", table: "archme_jobs" },
     (payload) => {
-      if (payload.new.status === "pending") dispatch(sched).catch((err) => console.error("dispatch:", err));
+      if (payload.new.status === "pending") dispatch(sched).catch((err2) => console.error("dispatch:", err2));
     }
   ).on(
     "postgres_changes",
@@ -16028,12 +16815,12 @@ function subscribe(client, sched) {
           console.log(`[${payload.new.id}] received cancellation (pre-spawn), will abort`);
         }
       } else if (payload.new.status === "pending") {
-        dispatch(sched).catch((err) => console.error("dispatch:", err));
+        dispatch(sched).catch((err2) => console.error("dispatch:", err2));
       }
     }
   ).subscribe((status) => {
     console.log(`realtime channel: ${status}`);
-    if (status === "SUBSCRIBED") dispatch(sched).catch((err) => console.error("startup dispatch:", err));
+    if (status === "SUBSCRIBED") dispatch(sched).catch((err2) => console.error("startup dispatch:", err2));
   });
   return () => {
     client.removeChannel(channel);
@@ -16074,9 +16861,9 @@ async function signInAccount(creds, makeAuth) {
       active = { auth, cred, result };
       usedFallback = attempts > 1;
       break;
-    } catch (err) {
+    } catch (err2) {
       auth.clearRefreshTimer();
-      lastErr = err;
+      lastErr = err2;
     }
   }
   if (active) {
@@ -16093,19 +16880,19 @@ async function runDaemon() {
   let lockHandle = null;
   try {
     lockHandle = await acquireSingleInstanceLock(resolvePidfilePath(process.env));
-  } catch (err) {
-    if (err instanceof SingleInstanceLockedError) {
-      console.error(String(err.message));
+  } catch (err2) {
+    if (err2 instanceof SingleInstanceLockedError) {
+      console.error(String(err2.message));
       process.exit(64);
     }
-    throw err;
+    throw err2;
   }
   let cfg;
   try {
     cfg = resolveConfig();
-  } catch (err) {
-    if (err instanceof MissingConfigError) {
-      console.error(err.message);
+  } catch (err2) {
+    if (err2 instanceof MissingConfigError) {
+      console.error(err2.message);
       if (lockHandle) {
         try {
           await lockHandle.release();
@@ -16114,7 +16901,7 @@ async function runDaemon() {
       }
       process.exit(1);
     }
-    throw err;
+    throw err2;
   }
   SUPABASE_URL = cfg.supabaseUrl;
   SUPABASE_ANON_KEY = cfg.supabaseAnonKey;
@@ -16148,9 +16935,9 @@ async function runDaemon() {
   let credentials;
   try {
     credentials = assertSingleAccount(loaded);
-  } catch (err) {
-    if (err instanceof MultipleAccountsError) {
-      console.error(err.message);
+  } catch (err2) {
+    if (err2 instanceof MultipleAccountsError) {
+      console.error(err2.message);
       if (lockHandle) {
         try {
           await lockHandle.release();
@@ -16159,7 +16946,7 @@ async function runDaemon() {
       }
       process.exit(78);
     }
-    throw err;
+    throw err2;
   }
   const devices = buildDevices(credentials);
   console.log(`  booting 1 session across ${devices.length} org(s)`);
@@ -16251,16 +17038,49 @@ async function runDaemon() {
     console.warn(`daemon_pauses lookup failed (proceeding unpaused): ${e.message}`);
   }
   const sweepTimer = setInterval(
-    () => dispatch(sched).catch((err) => console.error("safety sweep:", err)),
+    () => dispatch(sched).catch((err2) => console.error("safety sweep:", err2)),
     SAFETY_SWEEP_MS
   );
-  const shutdown = async (signal) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    console.log(`
-${signal} received, shutting down`);
+  const localPollDeps = makePollerDeps(client, (m) => console.log(m));
+  const localPollIntervalMs = Number.parseInt(process.env.ARCHME_LOCAL_POLL_INTERVAL_MS ?? "", 10);
+  const pollEveryMs = Number.isFinite(localPollIntervalMs) && localPollIntervalMs > 0 ? localPollIntervalMs : DEFAULT_POLL_INTERVAL_MS;
+  let localPollInFlight = false;
+  const runLocalPoll = async () => {
+    if (localPollInFlight) return;
+    localPollInFlight = true;
+    try {
+      const repos = await loadLocalRepos();
+      if (repos.length === 0) return;
+      await pollAllRepos(repos, localPollDeps);
+    } finally {
+      localPollInFlight = false;
+    }
+  };
+  const initialLocalRepos = await loadLocalRepos();
+  if (initialLocalRepos.length > 0) {
+    const halted = initialLocalRepos.filter((r) => r.haltedAt);
+    console.log(
+      `  local-poll: ${initialLocalRepos.length} repo(s) every ${Math.round(pollEveryMs / 1e3)}s`
+    );
+    for (const r of halted) {
+      console.log(
+        `    \u26A0 ${r.repoOwner}/${r.repoName} is HALTED (${r.haltReason ?? "unknown reason"}) \u2014 resume with \`archme local-watch --resume ${r.repoOwner}/${r.repoName}\``
+      );
+    }
+  }
+  const localPollTimer = setInterval(
+    () => void runLocalPoll().catch((err2) => console.error("local poll:", err2)),
+    pollEveryMs
+  );
+  void runLocalPoll().catch((err2) => console.error("local poll:", err2));
+  const shutdown = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    console.log(`
+${signal} received, shutting down`);
     for (const ctx of sessions) ctx.auth.clearRefreshTimer();
     clearInterval(sweepTimer);
+    clearInterval(localPollTimer);
     for (const u2 of unsubscribers) u2();
     const SHUTDOWN_DEADLINE_MS = 3e4;
     const deadline = setTimeout(() => {
@@ -16300,7 +17120,7 @@ ${signal} received, shutting down`);
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
 }
-var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, DEFAULT_CLONE_BASE_DIR, INLINE_PATCH_BYTE_CAP, CURATOR_PREAMBLE, CORE_PRINCIPLES, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
+var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, DEFAULT_CLONE_BASE_DIR, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
 var init_run = __esm({
   "src/daemon/run.ts"() {
     "use strict";
@@ -16331,6 +17151,10 @@ var init_run = __esm({
     init_rateLimit();
     init_version();
     init_materializeDiff();
+    init_branchMarker();
+    init_branchMarker();
+    init_localRepos();
+    init_localPoller();
     HEARTBEAT_INTERVAL_MS = 6e4;
     CLAUDE_TIMEOUT_MS = 30 * 60 * 1e3;
     CLAUDE_LARGE_DIFF_TIMEOUT_MS = 45 * 60 * 1e3;
@@ -16351,8 +17175,9 @@ var init_run = __esm({
     MAX_CONCURRENT_JOBS = Math.max(1, Number(process.env.MAX_CONCURRENT_JOBS) || 3);
     ctxByJob = /* @__PURE__ */ new Map();
     deviceByJob = /* @__PURE__ */ new Map();
-    DEFAULT_CLONE_BASE_DIR = `${homedir4()}/.archme-job-runner/clones`;
+    DEFAULT_CLONE_BASE_DIR = `${homedir5()}/.archme-job-runner/clones`;
     INLINE_PATCH_BYTE_CAP = 2e5;
+    GIT_SHA_RE = /^[0-9a-f]{40}$/;
     CURATOR_PREAMBLE = `## Your role
 
 You are curating the architecture diagram, not just transcribing the change. The diagram is an abstraction read by engineers and technical leaders to understand the codebase at a higher level than the code itself. Two things have to stay true: (A) it reflects the reality of the code, and (B) it is a useful abstraction of it. Use judgement on the altitude \u2014 pick the level of detail that helps a reader build a mental model, not one that mirrors every function and file.`;
@@ -16517,8 +17342,8 @@ ${ANCHOR_VERIFICATION}`;
       }
     };
     if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-      runDaemon().catch((err) => {
-        console.error("fatal:", err);
+      runDaemon().catch((err2) => {
+        console.error("fatal:", err2);
         process.exit(1);
       });
     }
@@ -16557,12 +17382,12 @@ async function dispatchDaemon(route2) {
         console.log(`Logs:     ${out.logPath}`);
         console.log(`State:    ${out.result.actions.join(" \u2192 ")}`);
         return 0;
-      } catch (err) {
-        if (err instanceof NotSignedInError) {
-          console.error(String(err.message));
+      } catch (err2) {
+        if (err2 instanceof NotSignedInError) {
+          console.error(String(err2.message));
           return 75;
         }
-        console.error(String(err));
+        console.error(String(err2));
         return 1;
       }
     }
@@ -16575,13 +17400,13 @@ async function dispatchDaemon(route2) {
     case "restart": {
       try {
         await ensureStartPrerequisites({ noLogin: route2.noLogin });
-      } catch (err) {
-        if (err instanceof NotSignedInError) {
-          console.error(String(err.message));
+      } catch (err2) {
+        if (err2 instanceof NotSignedInError) {
+          console.error(String(err2.message));
           console.error("(daemon left running unchanged)");
           return 75;
         }
-        console.error(String(err));
+        console.error(String(err2));
         console.error("(daemon left running unchanged)");
         return 1;
       }
@@ -16669,9 +17494,9 @@ async function defaultLoadSupabaseState(_deviceId) {
 async function defaultLoadUptime(pid) {
   if (process.platform === "linux") {
     try {
-      const { readFile: readFile12 } = await import("node:fs/promises");
-      const stat10 = await readFile12(`/proc/${pid}/stat`, "utf8");
-      const parts = stat10.split(") ").pop()?.split(" ") ?? [];
+      const { readFile: readFile14 } = await import("node:fs/promises");
+      const stat11 = await readFile14(`/proc/${pid}/stat`, "utf8");
+      const parts = stat11.split(") ").pop()?.split(" ") ?? [];
       const ticks = Number(parts[19]);
       if (!Number.isFinite(ticks)) return null;
       const { readFile: rf } = await import("node:fs/promises");
@@ -16738,8 +17563,8 @@ async function createAuthedClient(opts) {
   let loaded;
   try {
     loaded = await loadStoredAndRefresh();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
     throw new Error(`${msg}
 \u2192 run \`archme login\` first`);
   }
@@ -16770,9 +17595,9 @@ function deriveWebOrigin(apiUrl, onMalformed = "throw") {
   let parsed;
   try {
     parsed = new URL(apiUrl);
-  } catch (err) {
+  } catch (err2) {
     if (onMalformed === "throw") {
-      throw new Error(`could not parse API URL \`${apiUrl}\`: ${err instanceof Error ? err.message : String(err)}`);
+      throw new Error(`could not parse API URL \`${apiUrl}\`: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
     return "http://localhost:5173";
   }
@@ -16981,8 +17806,8 @@ var init_transcript_signals = __esm({
 });
 
 // src/scan/report.ts
-import { mkdir as mkdir9, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname10 } from "node:path";
+import { mkdir as mkdir11, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname13 } from "node:path";
 async function buildReport(input) {
   return {
     schema_version: REPORT_SCHEMA_VERSION,
@@ -17016,10 +17841,10 @@ async function buildReport(input) {
   };
 }
 async function writeReport(reportPath, orphansTxtPath, report, orphansFull) {
-  await mkdir9(dirname10(reportPath), { recursive: true });
-  await writeFile10(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8");
-  await mkdir9(dirname10(orphansTxtPath), { recursive: true });
-  await writeFile10(
+  await mkdir11(dirname13(reportPath), { recursive: true });
+  await writeFile11(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8");
+  await mkdir11(dirname13(orphansTxtPath), { recursive: true });
+  await writeFile11(
     orphansTxtPath,
     orphansFull.join("\n") + (orphansFull.length ? "\n" : ""),
     "utf8"
@@ -17044,10 +17869,26 @@ var init_github_remote = __esm({
   }
 });
 
+// src/scan/claimDefaultProject.ts
+function isClaimableDefaultProject(c3) {
+  if (c3.slug !== SIGNUP_DEFAULT_SLUG) return false;
+  if (c3.name.trim().toLowerCase() !== SIGNUP_DEFAULT_NAME) return false;
+  if (c3.fileCount === null || c3.commitCount === null) return false;
+  return c3.fileCount === 0 && c3.commitCount === 0;
+}
+var SIGNUP_DEFAULT_SLUG, SIGNUP_DEFAULT_NAME;
+var init_claimDefaultProject = __esm({
+  "src/scan/claimDefaultProject.ts"() {
+    "use strict";
+    SIGNUP_DEFAULT_SLUG = "default";
+    SIGNUP_DEFAULT_NAME = "default";
+  }
+});
+
 // src/scan/run-scan.ts
 import { createWriteStream as createWriteStream2 } from "node:fs";
-import { mkdir as mkdir10, readFile as readFile11 } from "node:fs/promises";
-import { basename as basename2, join as join16 } from "node:path";
+import { mkdir as mkdir12, readFile as readFile12 } from "node:fs/promises";
+import { basename as basename2, join as join19 } from "node:path";
 function buildBootstrapPrompt(opts = {}) {
   const { promptVariant, interactive, briefing } = opts;
   let base = interactive ? briefing ? `${BOOTSTRAP_INTERACTIVE}
@@ -17132,6 +17973,8 @@ async function resolveOrCreateProject(supabase, userId, fullSlug) {
   if (!membership) {
     throw new Error(`you are not a member of org \`${orgSlug}\`; cannot create project there`);
   }
+  const claimed = await claimSignupDefaultProject(supabase, org, projectSlug);
+  if (claimed) return claimed;
   const { data: created, error: cErr } = await supabase.from("projects").insert({ name: projectSlug, org_id: org.id, slug: projectSlug }).select("id").single();
   if (cErr) {
     if (cErr.code === "23505" || /duplicate key/i.test(cErr.message ?? "")) {
@@ -17164,6 +18007,43 @@ async function resolveOrCreateProject(supabase, userId, fullSlug) {
     created: true
   };
 }
+async function claimSignupDefaultProject(supabase, org, projectSlug) {
+  if (projectSlug === SIGNUP_DEFAULT_SLUG) return null;
+  try {
+    const { data: candidate } = await supabase.from("projects").select("id, slug, name").eq("org_id", org.id).eq("slug", SIGNUP_DEFAULT_SLUG).is("deleted_at", null).maybeSingle();
+    if (!candidate) return null;
+    const row = candidate;
+    const [{ count: fileCount }, { count: commitCount }] = await Promise.all([
+      supabase.from("project_files").select("id", { count: "exact", head: true }).eq("project_id", row.id),
+      supabase.from("commits").select("id", { count: "exact", head: true }).eq("project_id", row.id)
+    ]);
+    if (!isClaimableDefaultProject({
+      slug: row.slug,
+      name: row.name,
+      fileCount: fileCount ?? null,
+      commitCount: commitCount ?? null
+    })) {
+      return null;
+    }
+    const { data: branches } = await supabase.from("branches").select("name, is_default").eq("project_id", row.id).is("deleted_at", null);
+    const existing = branches ?? [];
+    if (existing.length === 0) {
+      const { error: bErr } = await supabase.from("branches").insert({ project_id: row.id, name: "main", is_default: true });
+      if (bErr) return null;
+    }
+    const { error: renameErr } = await supabase.from("projects").update({ name: projectSlug, slug: projectSlug }).eq("id", row.id);
+    if (renameErr) return null;
+    return {
+      orgSlug: org.slug,
+      projectSlug,
+      projectId: row.id,
+      defaultBranch: existing.find((b) => b.is_default)?.name ?? "main",
+      created: true
+    };
+  } catch {
+    return null;
+  }
+}
 async function fetchExistingProject(supabase, org, projectSlug) {
   const project = await mustQuery(
     supabase.from("projects").select("id, slug").eq("org_id", org.id).eq("slug", projectSlug).is("deleted_at", null).maybeSingle(),
@@ -17269,8 +18149,8 @@ async function runScan(opts, deps = {}) {
   let headSha;
   try {
     headSha = await repoHeadSha(opts.repoPath);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
     throw new Error(`could not read git HEAD at \`${opts.repoPath}\` (is this a git repo?): ${msg}`);
   }
   let fullSlug;
@@ -17287,19 +18167,19 @@ async function runScan(opts, deps = {}) {
     }
     fullSlug = defaultProjectSlug(orgSlug, opts.repoPath);
   }
-  const resolved = await resolveOrCreateProject(supabase, userId, fullSlug);
-  if (resolved.created) {
-    log(`  project: ${resolved.orgSlug}/${resolved.projectSlug} (created)`);
+  const resolved2 = await resolveOrCreateProject(supabase, userId, fullSlug);
+  if (resolved2.created) {
+    log(`  project: ${resolved2.orgSlug}/${resolved2.projectSlug} (created)`);
   } else {
-    log(`  project: ${resolved.orgSlug}/${resolved.projectSlug} (using existing \u2014 pass --project <unique-slug> to start fresh)`);
+    log(`  project: ${resolved2.orgSlug}/${resolved2.projectSlug} (using existing \u2014 pass --project <unique-slug> to start fresh)`);
   }
-  log(`  default branch: ${resolved.defaultBranch}`);
+  log(`  default branch: ${resolved2.defaultBranch}`);
   const branchName = opts.branch ? normalizeScanBranchName(opts.branch) : defaultBranchName(headSha);
   log(`  scan branch: ${branchName}`);
   const bearer = await getMcpAccessToken();
   const { configPath, cleanup: cleanupMcp } = await writeMcpConfig({
     baseUrl: mcpUrl,
-    projectSlug: `${resolved.orgSlug}/${resolved.projectSlug}`,
+    projectSlug: `${resolved2.orgSlug}/${resolved2.projectSlug}`,
     branch: branchName,
     bearer,
     // No source-SHA block (no job id for a local run), but DO tag these as scan
@@ -17334,9 +18214,9 @@ async function runScan(opts, deps = {}) {
       // Incompatible with an interactive TTY session.
       streamJson: !interactive
     });
-    const transcriptDir = join16(opts.repoPath, ".archme", "scan");
-    const transcriptPath = join16(transcriptDir, "transcript.log");
-    await mkdir10(transcriptDir, { recursive: true });
+    const transcriptDir = join19(opts.repoPath, ".archme", "scan");
+    const transcriptPath = join19(transcriptDir, "transcript.log");
+    await mkdir12(transcriptDir, { recursive: true });
     const transcriptStream = createWriteStream2(transcriptPath, { flags: "w" });
     let finalResultText = "";
     if (proc.stdout) {
@@ -17370,19 +18250,19 @@ async function runScan(opts, deps = {}) {
     } else {
       log(`claude exited ${exitCode}`);
     }
-    const counts = await countArchitecture(supabase, resolved.projectId, branchName);
+    const counts = await countArchitecture(supabase, resolved2.projectId, branchName);
     log(`  components: ${counts.components}`);
     log(`  stories:    ${counts.stories}`);
     let signals2 = null;
     try {
-      await new Promise((resolve4, reject) => {
-        transcriptStream.end((err) => err ? reject(err) : resolve4());
+      await new Promise((resolve5, reject) => {
+        transcriptStream.end((err2) => err2 ? reject(err2) : resolve5());
       });
-      const reportPath = join16(transcriptDir, "report.json");
-      const orphansTxtPath = join16(transcriptDir, "orphans.txt");
-      const transcript = await readFile11(transcriptPath, "utf8").catch(() => "");
+      const reportPath = join19(transcriptDir, "report.json");
+      const orphansTxtPath = join19(transcriptDir, "orphans.txt");
+      const transcript = await readFile12(transcriptPath, "utf8").catch(() => "");
       signals2 = extractTranscriptSignals(transcript);
-      const architecture = await fetchArchitectureDetail(supabase, resolved.projectId, branchName);
+      const architecture = await fetchArchitectureDetail(supabase, resolved2.projectId, branchName);
       const orphans = await classifyOrphans({
         repoRoot: opts.repoPath,
         fileAnchors: architecture.fileAnchors,
@@ -17391,7 +18271,7 @@ async function runScan(opts, deps = {}) {
         excludeGlobs: DEFAULT_EXCLUDE_GLOBS
       });
       const report = await buildReport({
-        projectSlug: `${resolved.orgSlug}/${resolved.projectSlug}`,
+        projectSlug: `${resolved2.orgSlug}/${resolved2.projectSlug}`,
         branch: branchName,
         transcriptPath,
         reportPath,
@@ -17407,8 +18287,8 @@ async function runScan(opts, deps = {}) {
       log(`  coverage: ${report.repo.anchor_coverage_ratio}  orphans: ${orphans.orphan_files_full.length}`);
       log(`  report:     ${reportPath}`);
       log(`  transcript: ${transcriptPath}`);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+    } catch (err2) {
+      const msg = err2 instanceof Error ? err2.message : String(err2);
       log(`warning: failed to build scan report: ${msg}`);
     }
     if (signals2 !== null && shouldStampMarker(signals2, exitCode, signal)) {
@@ -17418,15 +18298,15 @@ async function runScan(opts, deps = {}) {
         repo = stdout ? parseGitHubRepo(stdout) : null;
       } catch {
       }
-      const { error: markerErr } = await supabase.from("branches").update({ last_source_sha: headSha, last_source_repo: repo }).eq("project_id", resolved.projectId).eq("name", branchName);
+      const { error: markerErr } = await supabase.from("branches").update({ last_source_sha: headSha, last_source_repo: repo }).eq("project_id", resolved2.projectId).eq("name", branchName);
       if (markerErr) log(`  marker advance failed (next daemon job has no usable base): ${markerErr.message}`);
       else log(`  marker advanced: ${branchName} \u2192 ${headSha.slice(0, 8)}${repo ? ` (${repo})` : ""}`);
     }
-    const diffBase = resolved.defaultBranch;
+    const diffBase = resolved2.defaultBranch;
     const webUrl = buildWebUrl({
       apiUrl: mcpUrl,
-      orgSlug: resolved.orgSlug,
-      projectSlug: resolved.projectSlug,
+      orgSlug: resolved2.orgSlug,
+      projectSlug: resolved2.projectSlug,
       branchName,
       defaultBranch: diffBase,
       // CLI: throw on malformed mcpUrl so misconfiguration is loud.
@@ -17439,8 +18319,8 @@ async function runScan(opts, deps = {}) {
       components: counts.components,
       stories: counts.stories,
       branchName,
-      orgSlug: resolved.orgSlug,
-      projectSlug: resolved.projectSlug,
+      orgSlug: resolved2.orgSlug,
+      projectSlug: resolved2.projectSlug,
       webUrl,
       summary
     };
@@ -17466,6 +18346,7 @@ var init_run_scan = __esm({
     init_transcript_signals();
     init_report();
     init_github_remote();
+    init_claimDefaultProject();
     BOOTSTRAP_HEADLESS = `Run the \`scan\` MCP prompt now and follow it to completion. This is a non-interactive automated run \u2014 skip any steps that pause for user confirmation (e.g. "does this hierarchy look right?"). Proceed with your best-judgement decisions rather than waiting for human input.`;
     BOOTSTRAP_INTERACTIVE = `Run the \`scan\` MCP prompt now and follow it to completion. The user is at an interactive terminal \u2014 ask them when the prompt says to, and wait for their answer.
 
@@ -17475,6 +18356,62 @@ Before you call \`start_scan\`, show the user this briefing verbatim and ask the
   }
 });
 
+// src/scan/scanOutcome.ts
+function scanSucceeded(r) {
+  return r.exitCode === 0 && !r.signal && r.components > 0;
+}
+function nextSteps() {
+  return [
+    "",
+    "This is a snapshot of your architecture as of now. It will not follow your",
+    "code unless something keeps it up to date:",
+    "",
+    "  archme init          walks you through the options",
+    "",
+    "  \xB7 GitHub App \u2014 a couple of minutes, PR-aware, works for your whole team.",
+    "    Needs someone who can grant the app read access to the repo.",
+    "  \xB7 archme local-watch \u2014 no GitHub App and no approval, but updates only",
+    "    happen while your daemon is running on a machine that stays on."
+  ];
+}
+function formatScanOutcome(r) {
+  const lines = [""];
+  if (!scanSucceeded(r)) {
+    if (r.signal || r.exitCode !== 0) {
+      lines.push("scan did not complete");
+      lines.push(r.signal ? `  killed by ${r.signal}` : `  exit ${r.exitCode}`);
+    } else {
+      lines.push("scan finished but wrote no components");
+    }
+    lines.push(`  branch:     ${r.orgSlug}/${r.projectSlug}@${r.branchName}`);
+    lines.push(`  components: ${r.components}`);
+    lines.push(`  stories:    ${r.stories}`);
+    lines.push("");
+    lines.push("If Claude Code is installed but not signed in, run `claude` once and");
+    lines.push("authenticate, then re-run this command.");
+  } else {
+    lines.push("scan complete");
+    lines.push(`  components: ${r.components}`);
+    lines.push(`  stories:    ${r.stories}`);
+    lines.push(`  branch:     ${r.orgSlug}/${r.projectSlug}@${r.branchName}`);
+    lines.push(`  web UI:     ${r.webUrl}`);
+  }
+  if (r.summary) {
+    const tail = r.summary.length > SUMMARY_TAIL_CHARS ? `\u2026${r.summary.slice(-SUMMARY_TAIL_CHARS)}` : r.summary;
+    lines.push("", `Claude summary:
+${tail}`);
+  }
+  if (scanSucceeded(r)) lines.push(...nextSteps());
+  return lines.join("\n");
+}
+var SUMMARY_TAIL_CHARS;
+var init_scanOutcome = __esm({
+  "src/scan/scanOutcome.ts"() {
+    "use strict";
+    SUMMARY_TAIL_CHARS = 2e3;
+  }
+});
+
 // src/scan/dispatch.ts
 var dispatch_exports3 = {};
 __export(dispatch_exports3, {
@@ -17546,22 +18483,10 @@ async function dispatchScan(args) {
   opts.repoPath = resolve2(repoPath);
   try {
     const result = await runScan(opts);
-    console.log("");
-    console.log(`scan complete`);
-    console.log(`  exit:       ${result.exitCode}${result.signal ? ` (signal: ${result.signal})` : ""}`);
-    console.log(`  components: ${result.components}`);
-    console.log(`  stories:    ${result.stories}`);
-    console.log(`  branch:     ${result.orgSlug}/${result.projectSlug}@${result.branchName}`);
-    console.log(`  web UI:     ${result.webUrl}`);
-    if (result.summary) {
-      const tail = result.summary.length > SUMMARY_TAIL_CHARS ? `\u2026${result.summary.slice(-SUMMARY_TAIL_CHARS)}` : result.summary;
-      console.log(`
-Claude summary:
-${tail}`);
-    }
+    console.log(formatScanOutcome(result));
     return dispatchExitCode(result);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
     console.error(`archme scan: ${msg}`);
     return EX_INFRA;
   }
@@ -17573,7 +18498,7 @@ Usage:
   archme scan <repo-path> [flags]
 
 Flags:
-  --project <org/slug>     Target project. Defaults to e2e/<basename>.
+  --project <org/slug>     Target project. Defaults to <your-org>/<basename>.
   --branch <name>          Target scan branch. Defaults to <date>-<sha7>-scan.
   --no-interactive         Run headless (no questions). For CI/automation.
   --prompt-variant <id>    Scan prompt variant. Defaults to latest.
@@ -17582,23 +18507,23 @@ Flags:
 Reads OAuth credentials from the local keychain (run \`archme login\` first).
 Outputs component / story counts and the web-UI URL on completion.`);
 }
-var EX_OK, EX_SIGNAL, EX_INFRA, EX_USAGE, SUMMARY_TAIL_CHARS, PROJECT_SLUG_RE;
+var EX_OK, EX_SIGNAL, EX_INFRA, EX_USAGE, PROJECT_SLUG_RE;
 var init_dispatch3 = __esm({
   "src/scan/dispatch.ts"() {
     "use strict";
     init_run_scan();
+    init_scanOutcome();
     EX_OK = 0;
     EX_SIGNAL = 2;
     EX_INFRA = 3;
     EX_USAGE = 78;
-    SUMMARY_TAIL_CHARS = 2e3;
     PROJECT_SLUG_RE = /^[^/\s]+\/[^/\s]+$/;
   }
 });
 
 // src/init/repoSize.ts
 import { stat as stat9 } from "node:fs/promises";
-import { extname, join as join17 } from "node:path";
+import { extname, join as join20 } from "node:path";
 async function measureRepo(repoPath) {
   const files = await gitListFiles(repoPath);
   if (!files) return { sourceFiles: 0, sourceBytes: 0, totalFiles: 0 };
@@ -17607,7 +18532,7 @@ async function measureRepo(repoPath) {
   for (const rel of files) {
     if (!SOURCE_EXTENSIONS.has(extname(rel).toLowerCase())) continue;
     try {
-      const s = await stat9(join17(repoPath, rel));
+      const s = await stat9(join20(repoPath, rel));
       if (!s.isFile()) continue;
       sourceFiles++;
       sourceBytes += s.size;
@@ -17726,7 +18651,7 @@ async function watchRepoForProject(input) {
       reason: "the ArchMe GitHub App is not installed on this org yet \u2014 connect it in the app to get automatic updates on every push."
     };
   }
-  const { error } = await supabase.rpc("watch_repo", {
+  const { data: watchedRepoId, error } = await supabase.rpc("watch_repo", {
     p_org_id: orgId,
     p_project_id: projectId,
     p_repo_owner: owner,
@@ -17737,6 +18662,17 @@ async function watchRepoForProject(input) {
   if (error) {
     return { watched: false, reason: `could not watch the repo (${error.message}).` };
   }
+  const { error: enableErr } = await supabase.from("watched_repos").update({
+    commit_update_enabled: true,
+    commit_update_archme_branch: input.archmeBranch,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  }).eq("id", watchedRepoId);
+  if (enableErr) {
+    return {
+      watched: false,
+      reason: `the repo is linked but commit-driven updates could not be switched on (${enableErr.message}). Pushes will not reach your daemon until they are.`
+    };
+  }
   return { watched: true };
 }
 var init_watchRepo = __esm({
@@ -17746,21 +18682,21 @@ var init_watchRepo = __esm({
 });
 
 // src/init/gitContext.ts
-async function git(cwd, args) {
+async function git2(cwd, args) {
   const { stdout } = await execa("git", args, { cwd });
   return stdout.trim();
 }
 async function resolveGitContext(repoPath) {
   let root;
   try {
-    root = await git(repoPath, ["rev-parse", "--show-toplevel"]);
+    root = await git2(repoPath, ["rev-parse", "--show-toplevel"]);
   } catch {
     throw new Error(
       `\`${repoPath}\` is not inside a git repository \u2014 run \`archme init\` from a repo, or pass its path`
     );
   }
   try {
-    await git(root, ["rev-parse", "HEAD"]);
+    await git2(root, ["rev-parse", "HEAD"]);
   } catch {
     throw new Error(
       `\`${root}\` is a git repository with no commits yet \u2014 make a commit first, then run \`archme init\``
@@ -17768,26 +18704,29 @@ async function resolveGitContext(repoPath) {
   }
   let branch = "";
   try {
-    branch = await git(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    branch = await git2(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
   } catch {
     branch = "";
   }
   if (!branch || branch === "HEAD") {
     try {
-      const ref = await git(root, ["symbolic-ref", "refs/remotes/origin/HEAD"]);
+      const ref = await git2(root, ["symbolic-ref", "refs/remotes/origin/HEAD"]);
       branch = ref.replace(/^refs\/remotes\/origin\//, "");
     } catch {
       branch = "main";
     }
   }
   let repoSlug = null;
+  let originUrl = null;
   try {
-    const url = await git(root, ["remote", "get-url", "origin"]);
+    const url = await git2(root, ["remote", "get-url", "origin"]);
+    originUrl = url || null;
     repoSlug = url ? parseGitHubRepo(url) : null;
   } catch {
     repoSlug = null;
+    originUrl = null;
   }
-  return { root, branch, repoSlug };
+  return { root, branch, repoSlug, originUrl };
 }
 var init_gitContext = __esm({
   "src/init/gitContext.ts"() {
@@ -17797,6 +18736,661 @@ var init_gitContext = __esm({
   }
 });
 
+// src/init/keepCurrent.ts
+async function chooseKeepCurrent(deps) {
+  if (deps.yes) {
+    return { detection: deps.alreadyWatched ? "github-app" : "local-watch", runner: "self" };
+  }
+  const detection = deps.alreadyWatched ? "github-app" : await deps.choose(
+    "How should ArchMe detect new commits?",
+    DETECTION_OPTIONS
+  );
+  const runner = await deps.choose(
+    "Something has to process each update. Who runs it?",
+    RUNNER_OPTIONS
+  );
+  return { detection, runner };
+}
+function formatKeepCurrentPlan(plan, ctx) {
+  const steps = [];
+  if (plan.detection === "local-watch" && !ctx.localWatchRegistered) {
+    steps.push({
+      title: "Register this repo so your machine watches it:",
+      command: "archme local-watch"
+    });
+  }
+  if (plan.runner === "self") {
+    steps.push({
+      title: "Start the daemon \u2014 nothing processes the queue until you do:",
+      command: "archme daemon start",
+      notes: [
+        "Keep it running on a machine that stays on. Each update spends tokens",
+        "from your Claude subscription, the same way this scan did. Your code is",
+        "not sent to our servers \u2014 only the resulting architecture."
+      ]
+    });
+  } else {
+    steps.push({
+      title: `Email ${CONTACT_EMAIL} and we'll set up the daemon for you.`,
+      notes: [
+        ctx.repoSlug ? `Mention ${ctx.repoSlug} so we know which repo you mean.` : "",
+        // Deliberately not "we'll be in touch": running this command notifies
+        // nobody. Promising contact that depends on the user sending the mail
+        // is how someone ends up waiting on a team that never heard.
+        "Until then this architecture stays as it is \u2014 it won't track new commits."
+      ].filter(Boolean)
+    });
+  }
+  const lines = ["", "Keeping it current:"];
+  if (ctx.localWatchRegistered) {
+    lines.push("", `  \u2713 ${ctx.repoSlug ?? "This repo"} is registered \u2014 your machine is watching it.`);
+  }
+  const numbered = steps.length > 1;
+  steps.forEach((step, i2) => {
+    const bullet = numbered ? `  ${i2 + 1}. ` : "  ";
+    const indent = " ".repeat(bullet.length);
+    lines.push("", `${bullet}${step.title}`);
+    if (step.command) lines.push("", `${indent}  ${step.command}`);
+    if (step.notes?.length) {
+      lines.push("");
+      for (const note of step.notes) lines.push(`${indent}${note}`);
+    }
+  });
+  if (ctx.boardUrl) lines.push("", `  Your board: ${ctx.boardUrl}`);
+  return lines.join("\n");
+}
+var CONTACT_EMAIL, DETECTION_OPTIONS, RUNNER_OPTIONS;
+var init_keepCurrent = __esm({
+  "src/init/keepCurrent.ts"() {
+    "use strict";
+    CONTACT_EMAIL = "signup@archme.io";
+    DETECTION_OPTIONS = [
+      {
+        // First, and named as recommended: it is less work per-commit, survives
+        // this laptop being closed, and is the only path that sees pull requests.
+        label: "GitHub App (recommended) \u2014 a couple of minutes to set up. Sees pushes and pull requests, works for your whole team, nothing to keep running on your side. Someone has to grant it read access to the repo.",
+        value: "github-app"
+      },
+      {
+        label: "Local polling \u2014 no GitHub App and nobody's approval needed. This machine watches the repo instead. No pull-request awareness.",
+        value: "local-watch"
+      }
+    ];
+    RUNNER_OPTIONS = [
+      {
+        label: "I'll run it (recommended) \u2014 `archme daemon start` on a machine that stays on. Updates use your own Claude subscription, the same way this scan did, and your code never leaves your machine.",
+        value: "self"
+      },
+      {
+        label: "ArchMe runs it \u2014 if you don't have a machine that's always on, or a Claude subscription to spend on it.",
+        value: "archme"
+      }
+    ];
+  }
+});
+
+// src/init/keepCurrentFlow.ts
+async function applyKeepCurrentPlan(plan, deps, alreadyWatched) {
+  const base = { detection: plan.detection, runner: plan.runner };
+  if (plan.detection === "github-app") {
+    if (alreadyWatched) {
+      return { ...base, wired: true, localWatchRegistered: false };
+    }
+    const url = await deps.startGitHubAppInstall();
+    deps.log("");
+    deps.log("  Install the ArchMe GitHub App here, then come back \u2014 I'll wait:");
+    deps.log("");
+    deps.log(`    ${url}`);
+    deps.log("");
+    const installed = await deps.waitForInstallation();
+    if (!installed) {
+      return {
+        ...base,
+        wired: false,
+        localWatchRegistered: false,
+        reason: "the GitHub App install hasn't come through yet. If your org needs an owner to approve it, that can take a while \u2014 re-run `archme init` once it's approved."
+      };
+    }
+    const watched = await deps.watchRepo();
+    if (!watched.watched) {
+      return {
+        ...base,
+        wired: false,
+        localWatchRegistered: false,
+        reason: watched.reason ?? "the repo could not be linked to this project."
+      };
+    }
+    deps.log("  \u2713 GitHub App installed and the repo is linked.");
+    return { ...base, wired: true, localWatchRegistered: false };
+  }
+  const registered = await deps.registerLocalWatch();
+  if (!registered.ok) {
+    return {
+      ...base,
+      wired: false,
+      localWatchRegistered: false,
+      reason: registered.reason ?? "the repo could not be registered for local polling."
+    };
+  }
+  return { ...base, wired: true, localWatchRegistered: true };
+}
+var init_keepCurrentFlow = __esm({
+  "src/init/keepCurrentFlow.ts"() {
+    "use strict";
+  }
+});
+
+// src/init/githubAppSetup.ts
+async function waitForInstallation(deps) {
+  const deadline = deps.now() + INSTALL_WAIT_TIMEOUT_MS;
+  let announced = false;
+  for (; ; ) {
+    try {
+      if (await deps.hasInstallation()) return true;
+    } catch {
+    }
+    if (deps.now() >= deadline) return false;
+    if (!announced) {
+      deps.log("  waiting for the installation to come through\u2026");
+      announced = true;
+    }
+    await deps.sleep(INSTALL_POLL_INTERVAL_MS);
+  }
+}
+async function buildInstallUrl(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(`${opts.supabaseUrl}/functions/v1/github/install-state`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${opts.accessToken}`
+    },
+    body: JSON.stringify({ orgId: opts.orgId, env: opts.env ?? "prod" })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(body.error ?? `could not start the GitHub App install (${res.status})`);
+  }
+  const { token, url } = await res.json();
+  if (url) return url;
+  if (!token) throw new Error("install-state returned neither a url nor a token");
+  const slug = process.env.ARCHME_GITHUB_APP_SLUG || "architectme";
+  return `https://github.com/apps/${slug}/installations/new?state=${encodeURIComponent(token)}`;
+}
+async function orgHasInstallation(supabase, orgId) {
+  const { data, error } = await supabase.from("org_github_installations").select("installation_id").eq("org_id", orgId).limit(1);
+  if (error) throw new Error(error.message);
+  return (data?.length ?? 0) > 0;
+}
+var INSTALL_WAIT_TIMEOUT_MS, INSTALL_POLL_INTERVAL_MS;
+var init_githubAppSetup = __esm({
+  "src/init/githubAppSetup.ts"() {
+    "use strict";
+    INSTALL_WAIT_TIMEOUT_MS = 5 * 60 * 1e3;
+    INSTALL_POLL_INTERVAL_MS = 3e3;
+  }
+});
+
+// src/daemon/prompt.ts
+import { createInterface } from "node:readline/promises";
+async function withReadline(fn) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await fn(rl);
+  } finally {
+    rl.close();
+  }
+}
+async function promptLine(question) {
+  return await withReadline(async (rl) => {
+    try {
+      return await rl.question(`${question}: `);
+    } catch {
+      return "";
+    }
+  });
+}
+async function promptChoice(question, options) {
+  return await withReadline(async (rl) => {
+    console.log(`
+${question}
+`);
+    options.forEach((o2, i2) => console.log(`  ${i2 + 1}. ${o2.label}
+`));
+    for (let attempt = 0; attempt < 3; attempt++) {
+      let answer;
+      try {
+        answer = (await rl.question(`Choose 1-${options.length} [1]: `)).trim();
+      } catch {
+        return options[0].value;
+      }
+      if (answer === "") return options[0].value;
+      const n2 = Number.parseInt(answer, 10);
+      if (Number.isInteger(n2) && n2 >= 1 && n2 <= options.length) return options[n2 - 1].value;
+      console.log(`  "${answer}" isn't one of the options.`);
+    }
+    return options[0].value;
+  });
+}
+async function promptYesNo(question) {
+  return await withReadline(async (rl) => {
+    try {
+      const answer = (await rl.question(`${question} [Y/n] `)).trim().toLowerCase();
+      return answer === "" || answer === "y" || answer === "yes";
+    } catch {
+      return false;
+    }
+  });
+}
+var init_prompt = __esm({
+  "src/daemon/prompt.ts"() {
+    "use strict";
+  }
+});
+
+// src/daemon/watchReadiness.ts
+function evaluateWatchReadiness(input) {
+  const { marker, repo, archmeBranch } = input;
+  if (!marker.sha) {
+    return {
+      ok: false,
+      reason: `${repo} has no architecture on \`${archmeBranch}\` yet, so there is nothing to keep up to date and no commit to diff against.
+Run \`archme init\` in this repo first \u2014 it creates the architecture, then comes back here.`
+    };
+  }
+  if (!GIT_SHA_RE2.test(marker.sha)) {
+    return {
+      ok: false,
+      reason: `the recorded commit for \`${archmeBranch}\` is "${marker.sha}", which is not a git commit id. Re-run \`archme init --force\` to re-establish it.`
+    };
+  }
+  if (!marker.repo) {
+    return {
+      ok: false,
+      reason: `the architecture on \`${archmeBranch}\` has no source repo recorded, so updates cannot be matched to ${repo}.
+That usually means the scan ran against a non-github.com remote. Re-run \`archme init --force\` from a clone whose \`origin\` is on github.com.`
+    };
+  }
+  if (marker.repo !== repo) {
+    return {
+      ok: false,
+      reason: `\`${archmeBranch}\` is already tracking ${marker.repo}, not ${repo}. Watching it from here would make every update fail on the mismatch.
+Use \`--project <org>/<slug>\` to pick a different project, or a different branch.`
+    };
+  }
+  return { ok: true };
+}
+var GIT_SHA_RE2;
+var init_watchReadiness = __esm({
+  "src/daemon/watchReadiness.ts"() {
+    "use strict";
+    GIT_SHA_RE2 = /^[0-9a-f]{40}$/;
+  }
+});
+
+// src/daemon/localWatchList.ts
+function formatWatchList(repos) {
+  if (repos.length === 0) {
+    return [
+      "Not watching any repos on this machine.",
+      "",
+      "  archme local-watch        register the repo you're in"
+    ].join("\n");
+  }
+  const lines = [
+    `Watching ${repos.length} repo${repos.length === 1 ? "" : "s"} on this machine:`,
+    ""
+  ];
+  for (const r of repos) {
+    const slug = slugOf(r);
+    lines.push(`  ${slug}`);
+    lines.push(`    mirror: ${r.mirrorPath}`);
+    if (r.haltedAt) {
+      lines.push(`    HALTED at ${r.haltedAt}: ${r.haltReason ?? "unknown reason"}`);
+      lines.push(`    no new commits are being picked up. Resume with:`);
+      lines.push(`      archme local-watch --resume ${slug}`);
+    }
+    lines.push("");
+  }
+  if (repos.every((r) => !r.haltedAt)) {
+    lines.push("Updates only happen while the daemon is running:  archme daemon status");
+  }
+  return lines.join("\n").trimEnd();
+}
+var init_localWatchList = __esm({
+  "src/daemon/localWatchList.ts"() {
+    "use strict";
+    init_localRepos();
+  }
+});
+
+// src/daemon/localWatchResolve.ts
+function confirmationFor(target, repoPath) {
+  return `Watch ${target.repo} (branch ${target.repoBranch}) for architecture updates?
+  checkout: ${repoPath}`;
+}
+async function evaluate(path7, deps) {
+  const inspected = await deps.inspect(path7);
+  if (!inspected.ok) return { ok: false, reason: inspected.error };
+  const resolved2 = resolveInitTarget({
+    originUrl: inspected.originUrl,
+    branchOverride: deps.branch,
+    detectedDefaultBranch: inspected.detectedDefaultBranch
+  });
+  if (!resolved2.ok) return { ok: false, reason: resolved2.error };
+  return {
+    ok: true,
+    // The ROOT, never the cwd — registering a subdirectory would mirror a
+    // partial tree and record a source path that isn't the repo.
+    repoPath: inspected.root,
+    originUrl: inspected.originUrl,
+    target: resolved2.target
+  };
+}
+async function resolveRepoInteractive(deps) {
+  const first = deps.explicitPath ?? deps.cwd;
+  let evaluated = await evaluate(first, deps);
+  if (deps.yes) {
+    if (!evaluated.ok) return { ok: false, message: evaluated.reason };
+    return evaluated;
+  }
+  if (evaluated.ok) {
+    if (await deps.confirm(confirmationFor(evaluated.target, evaluated.repoPath))) return evaluated;
+  }
+  let reason = evaluated.ok ? "Which repo should ArchMe watch? Enter its path" : `${evaluated.reason}
+Which repo should ArchMe watch? Enter its path`;
+  for (let attempt = 0; attempt < MAX_REPO_PROMPTS; attempt++) {
+    const answer = (await deps.ask(reason)).trim();
+    if (!answer) return { ok: false, message: "cancelled \u2014 nothing was registered" };
+    evaluated = await evaluate(answer, deps);
+    if (evaluated.ok) {
+      if (await deps.confirm(confirmationFor(evaluated.target, evaluated.repoPath))) return evaluated;
+      reason = "Which repo should ArchMe watch? Enter its path";
+      continue;
+    }
+    reason = `${evaluated.reason}
+Which repo should ArchMe watch? Enter its path`;
+  }
+  return {
+    ok: false,
+    message: "could not find a repo to watch. `archme local-watch` needs a git clone with a github.com origin \u2014 run it from inside one, or pass the path directly."
+  };
+}
+var MAX_REPO_PROMPTS;
+var init_localWatchResolve = __esm({
+  "src/daemon/localWatchResolve.ts"() {
+    "use strict";
+    init_localWatch();
+    MAX_REPO_PROMPTS = 3;
+  }
+});
+
+// src/daemon/localWatch.ts
+var localWatch_exports = {};
+__export(localWatch_exports, {
+  DEFAULT_CLONE_BASE_DIR: () => DEFAULT_CLONE_BASE_DIR2,
+  inspectRepoPath: () => inspectRepoPath,
+  mirrorPathFor: () => mirrorPathFor,
+  registerLocalWatch: () => registerLocalWatch,
+  resolveInitTarget: () => resolveInitTarget,
+  runLocalWatch: () => runLocalWatch,
+  runLocalWatchList: () => runLocalWatchList,
+  runLocalWatchResume: () => runLocalWatchResume,
+  runLocalWatchStop: () => runLocalWatchStop
+});
+import { homedir as homedir6 } from "node:os";
+import { join as join21, resolve as resolve3 } from "node:path";
+import { stat as stat10 } from "node:fs/promises";
+function mirrorPathFor(cloneBaseDir, owner, name) {
+  return join21(cloneBaseDir, owner, name);
+}
+function resolveInitTarget(input) {
+  if (!input.originUrl) {
+    return {
+      ok: false,
+      error: "no `origin` remote found \u2014 archme local-watch needs a clone with a GitHub origin"
+    };
+  }
+  const repo = parseGitHubRepo(input.originUrl);
+  if (!repo) {
+    return {
+      ok: false,
+      error: `origin ${input.originUrl} is not a github.com remote.
+Local mode identifies repos the same way the GitHub App does, so that a team can later install the App without re-scanning or losing history. That identity only exists for github.com remotes.`
+    };
+  }
+  const repoBranch = input.branchOverride ?? input.detectedDefaultBranch;
+  if (!repoBranch) {
+    return {
+      ok: false,
+      error: "could not determine the default branch \u2014 pass --branch <name>"
+    };
+  }
+  const [repoOwner, repoName] = repo.split("/");
+  return {
+    ok: true,
+    target: {
+      repo,
+      repoOwner,
+      repoName,
+      repoBranch,
+      // Scanned projects live on a `<default>-scan` companion branch; the poller
+      // must enqueue against the SAME branch the scan stamped the marker on.
+      archmeBranch: input.archmeBranchOverride ?? normalizeScanBranchName(repoBranch)
+    }
+  };
+}
+async function inspectRepoPath(path7) {
+  const abs = resolve3(path7);
+  const st = await stat10(abs).catch(() => null);
+  if (!st?.isDirectory()) return { ok: false, error: `${abs} is not a directory` };
+  const toplevel = await execa("git", ["rev-parse", "--show-toplevel"], { cwd: abs, reject: false });
+  if (toplevel.exitCode !== 0) return { ok: false, error: `${abs} is not a git repository` };
+  const root = toplevel.stdout.trim() || abs;
+  return {
+    ok: true,
+    root,
+    originUrl: await readOriginUrl(root),
+    detectedDefaultBranch: await detectDefaultBranch(root)
+  };
+}
+async function runLocalWatch(opts) {
+  const log = opts.log ?? ((m) => console.log(m));
+  const cloneBaseDir = opts.cloneBaseDir ?? process.env.CLONE_BASE_DIR ?? DEFAULT_CLONE_BASE_DIR2;
+  const resolved2 = await resolveRepoInteractive({
+    cwd: process.cwd(),
+    explicitPath: opts.repoPath,
+    branch: opts.branch,
+    yes: opts.yes ?? false,
+    inspect: inspectRepoPath,
+    ask: promptLine,
+    confirm: promptYesNo,
+    log
+  });
+  if (!resolved2.ok) {
+    console.error(`archme local-watch: ${resolved2.message}`);
+    return 78;
+  }
+  const { repoPath, originUrl, target } = resolved2;
+  log(`  repo:   ${target.repo}`);
+  log(`  branch: ${target.repoBranch} \u2192 archme branch ${target.archmeBranch}`);
+  const cfg = resolveConfig();
+  let authed;
+  try {
+    authed = await createAuthedClient({
+      supabaseUrl: cfg.supabaseUrl,
+      supabaseAnonKey: cfg.supabaseAnonKey,
+      clientId: cfg.archmeDaemonClientId,
+      preSpawnMinLifetimeMs: SCAN_PRE_SPAWN_TOKEN_MIN_LIFETIME_MS
+    });
+  } catch (err2) {
+    console.error(`archme local-watch: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    return 3;
+  }
+  const { supabase, userId } = authed;
+  const orgId = authed.orgId;
+  if (!orgId) {
+    console.error("archme local-watch: this login is not paired with an org \u2014 run `archme login`");
+    return 3;
+  }
+  const orgSlug = await resolveCurrentOrgSlug(supabase, orgId);
+  if (!opts.project && !orgSlug) {
+    console.error(
+      "archme local-watch: could not resolve your organization slug, so the project name can't be derived \u2014 pass --project <org/slug>"
+    );
+    return 3;
+  }
+  const fullSlug = opts.project ?? defaultProjectSlug(orgSlug, repoPath);
+  const project = await resolveOrCreateProject(supabase, userId, fullSlug);
+  log(`  project: ${project.orgSlug}/${project.projectSlug}${project.created ? " (created)" : ""}`);
+  const registered = await registerLocalWatch({
+    supabase,
+    orgId,
+    projectId: project.projectId,
+    repoPath,
+    originUrl,
+    target,
+    cloneBaseDir,
+    log
+  });
+  if (!registered.ok) {
+    console.error(`archme local-watch: ${registered.reason}`);
+    return registered.exitCode;
+  }
+  log(`
+  \u2713 ${target.repo} is now watched locally.`);
+  log(`
+    Start the daemon if it isn't running:  archme daemon start`);
+  log(`    New commits on ${target.repoBranch} will appear as ArchMe commits within a minute or two.`);
+  return 0;
+}
+async function registerLocalWatch(args) {
+  const log = args.log ?? (() => {
+  });
+  const { target, supabase, orgId, projectId, repoPath, originUrl } = args;
+  const cloneBaseDir = args.cloneBaseDir ?? process.env.CLONE_BASE_DIR ?? DEFAULT_CLONE_BASE_DIR2;
+  const marker = await readBranchMarker(supabase, projectId, target.archmeBranch);
+  const readiness = evaluateWatchReadiness({
+    repo: target.repo,
+    archmeBranch: target.archmeBranch,
+    marker
+  });
+  if (!readiness.ok) return { ok: false, reason: readiness.reason, exitCode: 78 };
+  const { data: watchedRepoId, error: watchErr } = await supabase.rpc("watch_local_repo", {
+    p_org_id: orgId,
+    p_project_id: projectId,
+    p_repo_owner: target.repoOwner,
+    p_repo_name: target.repoName,
+    p_branch: target.repoBranch,
+    // The ArchMe branch has to be RECORDED, not re-derived by each reader.
+    // The poller resolves it from the row (`commit_update_archme_branch ??
+    // branch`, mirroring the webhook); with the column unset it fell back to
+    // the git branch, so registration checked `main-scan` while polling read
+    // `main`, found no marker, and idled forever with everything looking
+    // healthy. Migration 111.
+    p_archme_branch: target.archmeBranch
+  });
+  if (watchErr || typeof watchedRepoId !== "string") {
+    return {
+      ok: false,
+      reason: `could not register the repo: ${watchErr?.message ?? "no id returned"}`,
+      exitCode: 3
+    };
+  }
+  const mirrorPath = mirrorPathFor(cloneBaseDir, target.repoOwner, target.repoName);
+  const mirrorExists = await stat10(join21(mirrorPath, ".git")).then(() => true).catch(() => false);
+  if (mirrorExists) {
+    log(`  mirror:  ${mirrorPath} (reusing)`);
+    await setOriginUrl(mirrorPath, originUrl);
+  } else {
+    log(`  mirror:  ${mirrorPath}`);
+    await createMirrorClone(repoPath, mirrorPath, originUrl);
+  }
+  await execa("git", ["fetch", "--no-tags", "origin", target.repoBranch], {
+    cwd: mirrorPath,
+    reject: true
+  });
+  const entry = {
+    watchedRepoId,
+    mirrorPath,
+    sourcePath: repoPath,
+    repoOwner: target.repoOwner,
+    repoName: target.repoName
+  };
+  await registerLocalRepo(entry);
+  return { ok: true, entry };
+}
+async function runLocalWatchList() {
+  console.log(formatWatchList(await loadLocalRepos()));
+  return 0;
+}
+async function runLocalWatchStop(slug) {
+  const repos = await loadLocalRepos();
+  const matches = findLocalReposBySlug(repos, slug);
+  if (matches.length === 0) {
+    console.error(`archme local-watch: ${slug} is not being watched on this machine.`);
+    console.error("Run `archme local-watch --list` to see what is.");
+    return 78;
+  }
+  await saveLocalRepos(removeLocalReposBySlug(repos, slug));
+  for (const m of matches) {
+    console.log(`Stopped watching ${slugOf(m)}.`);
+  }
+  console.log(
+    `
+The architecture already on the board is untouched \u2014 this only stops new commits
+from being picked up. Re-watch with:  archme local-watch ${matches[0].sourcePath}`
+  );
+  return 0;
+}
+async function runLocalWatchResume(slug) {
+  const repos = await loadLocalRepos();
+  const matches = findLocalReposBySlug(repos, slug);
+  if (matches.length === 0) {
+    console.error(`archme local-watch: ${slug} is not being watched on this machine.`);
+    return 78;
+  }
+  const halted = matches.filter((m) => m.haltedAt);
+  if (halted.length === 0) {
+    console.log(`${slug} is not halted \u2014 nothing to resume.`);
+    return 0;
+  }
+  let next = repos;
+  for (const m of halted) next = clearHalt(next, m.watchedRepoId);
+  await saveLocalRepos(next);
+  for (const m of halted) {
+    console.log(`Resumed ${slugOf(m)} \u2014 was: ${m.haltReason ?? "unknown reason"}`);
+  }
+  const stillTerminal = halted.some((m) => m.haltCode === "job-terminal");
+  if (stillTerminal) {
+    console.log(
+      "\nNote: at least one of these stopped because a job failed outright. Resuming\ndoes not re-run a failed job \u2014 polling will stop again on the next tick.\nThat failure is visible to the ArchMe team; get in touch if it is blocking you."
+    );
+  } else {
+    console.log("\nPolling resumes from the recorded commit on the next tick.");
+  }
+  return 0;
+}
+var DEFAULT_CLONE_BASE_DIR2;
+var init_localWatch = __esm({
+  "src/daemon/localWatch.ts"() {
+    "use strict";
+    init_execa();
+    init_defaults();
+    init_github_remote();
+    init_run_scan();
+    init_authedClient();
+    init_watchReadiness();
+    init_localGit();
+    init_localRepos();
+    init_branchMarker();
+    init_localWatchList();
+    init_localWatchResolve();
+    init_prompt();
+    DEFAULT_CLONE_BASE_DIR2 = join21(homedir6(), ".archme-job-runner", "clones");
+  }
+});
+
 // src/init/plan.ts
 function shouldRunScan(d) {
   if (d.skipScan) return false;
@@ -17826,9 +19420,9 @@ var init_plan = __esm({
 });
 
 // src/init/run-init.ts
-import { mkdtemp as mkdtemp4, rm as rm8, writeFile as writeFile11 } from "node:fs/promises";
+import { mkdtemp as mkdtemp4, rm as rm8, writeFile as writeFile12 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join22 } from "node:path";
 function initScanBranch(defaultBranch) {
   return normalizeScanBranchName(defaultBranch);
 }
@@ -17840,10 +19434,10 @@ async function defaultFetchInstallScript(url) {
   return await resp.text();
 }
 async function defaultRunInstallScript(script, cwd) {
-  const dir = await mkdtemp4(join18(tmpdir4(), "archme-init-"));
-  const scriptPath = join18(dir, "install-agent.sh");
+  const dir = await mkdtemp4(join22(tmpdir4(), "archme-init-"));
+  const scriptPath = join22(dir, "install-agent.sh");
   try {
-    await writeFile11(scriptPath, script, { mode: 448 });
+    await writeFile12(scriptPath, script, { mode: 448 });
     await execa("sh", [scriptPath], { cwd, stdio: "inherit" });
   } finally {
     await rm8(dir, { recursive: true, force: true });
@@ -17864,8 +19458,8 @@ async function runInit(opts, deps = {}) {
   const measure = deps.measure ?? measureRepo;
   const watchRepo = deps.watchRepo ?? watchRepoForProject;
   const cfg = resolveConfig();
-  const git2 = await gitContext(opts.repoPath);
-  const repoPath = git2.root;
+  const git4 = await gitContext(opts.repoPath);
+  const repoPath = git4.root;
   const { credentials } = await loadCreds(cfg.supabaseUrl);
   const signedIn = credentials.length > 0;
   if (!signedIn) {
@@ -17924,8 +19518,9 @@ async function runInit(opts, deps = {}) {
     supabase: authed.supabase,
     orgId: authed.orgId,
     projectId: project.projectId,
-    repoSlug: git2.repoSlug,
-    branch: git2.branch,
+    repoSlug: git4.repoSlug,
+    branch: git4.branch,
+    archmeBranch: scanBranch,
     log
   });
   if (!watched.watched && watched.reason) {
@@ -17975,28 +19570,79 @@ Your board: ${webUrl}`);
     log(`
 \u2713 Done. Your architecture: ${finalUrl}`);
     log("  Restart Claude Code in this repo to pick up the archme MCP server.");
-    if (watched.watched) {
-      log("");
-      log("Keeping it up to date \u2014 one more step:");
-      log("  Pushes to this repo now queue an architecture update, but");
-      log("  something has to process that queue, and nothing does yet.");
-      log("");
-      log("  Run the agent yourself, on a machine that stays on:");
-      log("");
-      log("    archme daemon start");
-      log("");
-      log("  Each update counts tokens against your Claude account, the same");
-      log("  way this scan did. Your code is not sent to our servers \u2014 only");
-      log("  the resulting architecture.");
-      log("");
-      log("  Or get in touch at archme.io and we'll run it for you.");
-    } else {
+    const plan = await chooseKeepCurrent({
+      alreadyWatched: watched.watched,
+      yes: Boolean(opts.yes),
+      repoSlug: git4.repoSlug,
+      choose: deps.choose ?? promptChoice,
+      log
+    });
+    const outcome = await applyKeepCurrentPlan(
+      plan,
+      {
+        startGitHubAppInstall: () => (deps.buildInstallUrl ?? buildInstallUrl)({
+          supabaseUrl: cfg.supabaseUrl,
+          accessToken: getCurrentAccessToken() ?? "",
+          orgId: authed.orgId
+        }),
+        waitForInstallation: () => (deps.waitForInstallation ?? waitForInstallation)({
+          hasInstallation: () => (deps.orgHasInstallation ?? orgHasInstallation)(authed.supabase, authed.orgId),
+          sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+          now: () => Date.now(),
+          log
+        }),
+        watchRepo: async () => {
+          const w = await watchRepo({
+            supabase: authed.supabase,
+            orgId: authed.orgId,
+            projectId: project.projectId,
+            repoSlug: git4.repoSlug,
+            branch: git4.branch,
+            archmeBranch: scanBranch,
+            log
+          });
+          return { watched: w.watched, reason: w.reason };
+        },
+        registerLocalWatch: async () => {
+          const target = resolveInitTarget({
+            originUrl: git4.originUrl,
+            detectedDefaultBranch: git4.branch,
+            // The branch this run actually scanned. Deriving it from the git
+            // branch instead would point the poller at `<checkout>-scan` while
+            // the marker sits on `<default>-scan` — so registering would fail
+            // on a feature-branch checkout, immediately after a scan that
+            // succeeded.
+            archmeBranchOverride: scanBranch
+          });
+          if (!target.ok) return { ok: false, reason: target.error };
+          const res = await (deps.registerLocalWatch ?? registerLocalWatch)({
+            supabase: authed.supabase,
+            orgId: authed.orgId,
+            projectId: project.projectId,
+            repoPath: git4.root,
+            originUrl: git4.originUrl,
+            target: target.target,
+            log
+          });
+          return res.ok ? { ok: true } : { ok: false, reason: res.reason };
+        },
+        log
+      },
+      watched.watched
+    );
+    if (!outcome.wired && outcome.reason) {
       log("");
       log("Not yet set up for automatic updates:");
-      log(`  ${watched.reason ?? "the repo could not be linked to this project."}`);
-      log("  Until that is resolved, this architecture will not track new");
-      log("  commits \u2014 re-run `archme init` once it is.");
+      log(`  ${outcome.reason}`);
+      log("  Until that is resolved, this architecture will not track new commits.");
     }
+    log(
+      formatKeepCurrentPlan(plan, {
+        repoSlug: git4.repoSlug,
+        boardUrl: finalUrl,
+        localWatchRegistered: outcome.localWatchRegistered
+      })
+    );
   }
   return {
     exitCode: result.exitCode,
@@ -18020,6 +19666,12 @@ var init_run_init = __esm({
     init_watchRepo();
     init_gitContext();
     init_web_url();
+    init_bearer();
+    init_keepCurrent();
+    init_keepCurrentFlow();
+    init_githubAppSetup();
+    init_prompt();
+    init_localWatch();
     init_plan();
   }
 });
@@ -18111,7 +19763,7 @@ __export(dispatch_exports4, {
   dispatchInit: () => dispatchInit,
   printInitHelp: () => printInitHelp
 });
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 function printInitHelp() {
   console.log(`archme init \u2014 guided first-time setup for this repo
 
@@ -18149,7 +19801,7 @@ async function dispatchInit(argv) {
   }
   try {
     const result = await runInit({
-      repoPath: resolve3(parsed.args.repoPath ?? process.cwd()),
+      repoPath: resolve4(parsed.args.repoPath ?? process.cwd()),
       project: parsed.args.project,
       appOrigin: parsed.args.appOrigin,
       force: parsed.args.force,
@@ -18157,8 +19809,8 @@ async function dispatchInit(argv) {
       yes: parsed.args.yes || parsed.args.noInteractive
     });
     return result.exitCode;
-  } catch (err) {
-    console.error(`archme init: ${err instanceof Error ? err.message : String(err)}`);
+  } catch (err2) {
+    console.error(`archme init: ${err2 instanceof Error ? err2.message : String(err2)}`);
     return EX_INFRA2;
   }
 }
@@ -18174,6 +19826,620 @@ var init_dispatch4 = __esm({
   }
 });
 
+// src/daemon/localWatchDispatch.ts
+var localWatchDispatch_exports = {};
+__export(localWatchDispatch_exports, {
+  EX_INFRA: () => EX_INFRA3,
+  EX_OK: () => EX_OK3,
+  EX_USAGE: () => EX_USAGE3,
+  dispatchLocalWatch: () => dispatchLocalWatch,
+  parseLocalWatchArgs: () => parseLocalWatchArgs,
+  printLocalWatchHelp: () => printLocalWatchHelp
+});
+function err(message) {
+  return { kind: "error", message: `archme local-watch: ${message}` };
+}
+function parseLocalWatchArgs(argv) {
+  if (argv.some((a2) => a2 === "--help" || a2 === "-h" || a2 === "help")) return { kind: "help" };
+  let repoPath;
+  let project;
+  let branch;
+  let yes = false;
+  let list = false;
+  let stop;
+  let resume;
+  for (let i2 = 0; i2 < argv.length; i2++) {
+    const arg = argv[i2];
+    const next = argv[i2 + 1];
+    if (arg === "--project") {
+      if (!next) return err("--project needs an org/slug");
+      if (!PROJECT_SLUG_RE3.test(next)) {
+        return err(
+          `--project '${next}' must be \`org/slug\` (exactly two non-empty segments separated by /)`
+        );
+      }
+      project = next;
+      i2++;
+    } else if (arg === "--branch") {
+      if (!next) return err("--branch needs a branch name");
+      branch = next;
+      i2++;
+    } else if (arg === "--yes" || arg === "--no-interactive") {
+      yes = true;
+    } else if (arg === "--list") {
+      list = true;
+    } else if (arg === "--stop" || arg === "--resume") {
+      if (!next || next.startsWith("-")) return err(`${arg} needs a repo (owner/name)`);
+      if (!REPO_SLUG_RE.test(next)) {
+        return err(`${arg} '${next}' must be \`owner/name\` \u2014 that is how repos are registered`);
+      }
+      if (arg === "--stop") stop = next;
+      else resume = next;
+      i2++;
+    } else if (arg && arg.startsWith("-")) {
+      return err(`unknown flag '${arg}'`);
+    } else if (arg && repoPath === void 0) {
+      repoPath = arg;
+    } else if (arg) {
+      return err(`unexpected argument '${arg}'`);
+    }
+  }
+  const modes = [list && "--list", stop && "--stop", resume && "--resume"].filter(Boolean);
+  if (modes.length > 1) {
+    return err(`${modes.join(" and ")} do different things \u2014 pass one of them at once, not both`);
+  }
+  if (list) return { kind: "list" };
+  if (stop) return { kind: "stop", repo: stop };
+  if (resume) return { kind: "resume", repo: resume };
+  return { kind: "register", repoPath, project, branch, yes };
+}
+function printLocalWatchHelp() {
+  console.log(`archme local-watch \u2014 keep ArchMe current without a GitHub App
+
+Registers a repo so this machine polls \`origin\` and feeds new commits into
+ArchMe, one commit at a time. No GitHub App, no admin approval \u2014 but the
+updates only happen while your daemon is running. Requires a github.com origin.
+
+Your working checkout is read exactly once (to find its origin URL and seed a
+mirror); everything afterwards runs against a daemon-owned copy, so ArchMe
+never touches your working tree.
+
+Usage:
+  archme local-watch [repo-path]     Register a repo (defaults to the one you're in)
+  archme local-watch --list          Show what this machine is watching
+  archme local-watch --stop  <owner/name>
+  archme local-watch --resume <owner/name>
+
+Options:
+  --project <org/slug>   Project to write to (default: derived from the repo name)
+  --branch <name>        Branch to track (default: the repo's default branch)
+  --yes                  Don't ask for confirmation (needs an explicit repo-path)
+
+Watching queues work; the daemon does it. After registering:  archme daemon start`);
+}
+async function dispatchLocalWatch(argv) {
+  const parsed = parseLocalWatchArgs(argv);
+  if (parsed.kind === "help") {
+    printLocalWatchHelp();
+    return EX_OK3;
+  }
+  if (parsed.kind === "error") {
+    console.error(parsed.message);
+    printLocalWatchHelp();
+    return EX_USAGE3;
+  }
+  const mod = await Promise.resolve().then(() => (init_localWatch(), localWatch_exports));
+  switch (parsed.kind) {
+    case "list":
+      return await mod.runLocalWatchList();
+    case "stop":
+      return await mod.runLocalWatchStop(parsed.repo);
+    case "resume":
+      return await mod.runLocalWatchResume(parsed.repo);
+    case "register":
+      return await mod.runLocalWatch(parsed);
+  }
+}
+var EX_OK3, EX_INFRA3, EX_USAGE3, PROJECT_SLUG_RE3, REPO_SLUG_RE;
+var init_localWatchDispatch = __esm({
+  "src/daemon/localWatchDispatch.ts"() {
+    "use strict";
+    EX_OK3 = 0;
+    EX_INFRA3 = 3;
+    EX_USAGE3 = 78;
+    PROJECT_SLUG_RE3 = /^[^/\s]+\/[^/\s]+$/;
+    REPO_SLUG_RE = /^[^/\s]+\/[^/\s]+$/;
+  }
+});
+
+// src/doctor/collect.ts
+import { readFile as readFile13 } from "node:fs/promises";
+import { join as join23 } from "node:path";
+function binaryPresent(name) {
+  try {
+    requireBinary(name);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function git3(cwd, args) {
+  const r = await execa("git", args, { cwd, reject: false });
+  return r.exitCode === 0 ? r.stdout.trim() || null : null;
+}
+async function readMcpPin(repoRoot) {
+  const empty = { installed: false, pin: { project: null, branch: null } };
+  try {
+    const raw = await readFile13(join23(repoRoot, ".mcp.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    const servers = parsed.mcpServers ?? {};
+    const entry = Object.entries(servers).find(([name]) => /archme/i.test(name));
+    if (!entry) return empty;
+    const url = entry[1]?.url;
+    if (!url) return { installed: true, pin: { project: null, branch: null } };
+    const params = new URL(url).searchParams;
+    return {
+      installed: true,
+      pin: { project: params.get("project"), branch: params.get("branch") }
+    };
+  } catch {
+    return empty;
+  }
+}
+async function isDaemonRunning() {
+  const r = await execa("pgrep", ["-f", "archme.*daemon"], { reject: false });
+  return r.exitCode === 0 && Boolean(r.stdout.trim());
+}
+async function collectFacts(cwd) {
+  const facts = {
+    cliVersion: await readDaemonVersion(),
+    // `requireBinary` throws when absent; doctor's whole job is to report that
+    // calmly rather than die on it.
+    claudeInstalled: binaryPresent("claude"),
+    gitInstalled: binaryPresent("git"),
+    signedIn: false,
+    identity: null,
+    orgId: null,
+    inRepo: false,
+    repoRoot: null,
+    repoSlug: null,
+    gitBranch: null,
+    agentConfigInstalled: false,
+    pinnedProject: null,
+    pinnedBranch: null,
+    pinnedOrgVisible: null,
+    projectExists: null,
+    componentCount: null,
+    markerSha: null,
+    watchedBy: "unknown",
+    localRepos: [],
+    daemonRunning: await isDaemonRunning()
+  };
+  const root = facts.gitInstalled ? await git3(cwd, ["rev-parse", "--show-toplevel"]) : null;
+  if (root) {
+    facts.inRepo = true;
+    facts.repoRoot = root;
+    facts.gitBranch = await git3(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const originUrl = await git3(root, ["remote", "get-url", "origin"]);
+    facts.repoSlug = originUrl ? parseGitHubRepo(originUrl) : null;
+    const mcp = await readMcpPin(root);
+    facts.agentConfigInstalled = mcp.installed;
+    facts.pinnedProject = mcp.pin.project;
+    facts.pinnedBranch = mcp.pin.branch;
+  }
+  const registry = await loadLocalRepos();
+  const forThisRepo = facts.repoSlug ? registry.filter((r) => slugOf(r).toLowerCase() === facts.repoSlug.toLowerCase()) : [];
+  facts.localRepos = forThisRepo.map(
+    (r) => ({
+      slug: slugOf(r),
+      halted: Boolean(r.haltedAt),
+      haltReason: r.haltReason
+    })
+  );
+  try {
+    const cfg = resolveConfig();
+    const authed = await createAuthedClient({
+      supabaseUrl: cfg.supabaseUrl,
+      supabaseAnonKey: cfg.supabaseAnonKey,
+      clientId: cfg.archmeDaemonClientId,
+      preSpawnMinLifetimeMs: SCAN_PRE_SPAWN_TOKEN_MIN_LIFETIME_MS
+    });
+    if (!authed.orgId) return facts;
+    facts.signedIn = true;
+    facts.orgId = authed.orgId;
+    facts.identity = authed.identity;
+    const supabase = authed.supabase;
+    const slug = facts.pinnedProject;
+    if (slug) {
+      const [orgSlug, projectSlug] = slug.split("/");
+      const { data: org } = await supabase.from("organizations").select("id").eq("slug", orgSlug ?? "").maybeSingle();
+      facts.pinnedOrgVisible = Boolean(org);
+      const { data: project } = org ? await supabase.from("projects").select("id").eq("org_id", org.id).eq("slug", projectSlug ?? "").is("deleted_at", null).maybeSingle() : { data: null };
+      if (!org) {
+        facts.projectExists = null;
+      } else if (!project) {
+        facts.projectExists = false;
+      } else {
+        facts.projectExists = true;
+        const branch = facts.pinnedBranch ?? "main";
+        const { count: count2 } = await supabase.from("project_files").select("id", { count: "exact", head: true }).eq("project_id", project.id).eq("branch", branch);
+        facts.componentCount = count2 ?? null;
+        const marker = await readBranchMarker(supabase, project.id, branch);
+        facts.markerSha = marker.sha;
+      }
+    }
+    if (facts.localRepos.length > 0) {
+      facts.watchedBy = "local";
+    } else if (facts.repoSlug) {
+      const [owner, name] = facts.repoSlug.split("/");
+      const { data: watched } = await supabase.from("watched_repos").select("source_kind, enabled, commit_update_enabled").eq("repo_owner", owner ?? "").eq("repo_name", name ?? "").is("deleted_at", null);
+      const rows = watched ?? [];
+      const live = rows.find((r) => r.commit_update_enabled);
+      facts.watchedBy = live ? live.source_kind === "local" ? "local" : "github" : "none";
+    }
+  } catch {
+  }
+  return facts;
+}
+var init_collect = __esm({
+  "src/doctor/collect.ts"() {
+    "use strict";
+    init_execa();
+    init_defaults();
+    init_version();
+    init_preflight();
+    init_branchMarker();
+    init_localRepos();
+    init_github_remote();
+    init_authedClient();
+  }
+});
+
+// src/doctor/facts.ts
+function diagnose(f) {
+  const issues = [];
+  if (!f.claudeInstalled) {
+    issues.push({
+      severity: "error",
+      title: "Claude Code is not installed",
+      detail: "archme runs Claude Code locally to read your diff and update the architecture. Without it, scans and every daemon job fail at the spawn.",
+      fix: "npm i -g @anthropic-ai/claude-code"
+    });
+  }
+  if (!f.gitInstalled) {
+    issues.push({
+      severity: "error",
+      title: "git is not installed",
+      detail: "archme clones and diffs repositories with git.",
+      fix: "macOS: xcode-select --install   \xB7   Debian/Ubuntu: sudo apt-get install git"
+    });
+  }
+  if (f.cliVersion === null) {
+    issues.push({
+      severity: "error",
+      title: "this install cannot read its own version",
+      detail: "The daemon reports its version on every job claim, and the server treats an unknown version as below any minimum. If a floor is ever set, this install stops claiming jobs silently \u2014 no error, just an idle daemon.",
+      fix: "npm i -g @archme/cli"
+    });
+  }
+  if (!f.signedIn) {
+    issues.push({
+      severity: "error",
+      title: "not signed in",
+      detail: "Your project, architecture and watch status can't be checked until this machine is paired with an ArchMe account.",
+      fix: "archme login"
+    });
+    return issues;
+  }
+  if (!f.inRepo) {
+    issues.push({
+      severity: "warn",
+      title: "not inside a git repository",
+      detail: "Run this from the repo you want ArchMe to track, so it can check that repo's setup.",
+      fix: "cd <your repo> && archme doctor"
+    });
+    return issues;
+  }
+  if (f.pinnedOrgVisible === false) {
+    issues.push({
+      severity: "error",
+      title: "this repo is pinned to a project your account cannot see",
+      detail: `.mcp.json pins \`${f.pinnedProject}\`, but this machine is signed in to an account that is not a member of that organisation. Nothing here can read or update that project. The architecture may well exist \u2014 you just cannot reach it from this login.`,
+      fix: "archme login   (choose the org that owns the project), or re-run `archme init` to pin one you can reach"
+    });
+    return issues;
+  }
+  if (f.projectExists === false || f.componentCount === 0) {
+    issues.push({
+      severity: "error",
+      title: "this repo has no architecture yet",
+      detail: "Nothing has been scanned, so there is nothing for updates to keep current.",
+      fix: "archme init"
+    });
+    return issues;
+  }
+  if (!f.agentConfigInstalled) {
+    issues.push({
+      severity: "warn",
+      title: "agent config is missing from this repo",
+      detail: "Without `.mcp.json`, Claude Code in this repo can't read or write the architecture while you work. Updates from commits still happen.",
+      fix: "archme init"
+    });
+  }
+  if (f.projectExists === true && f.markerSha === null) {
+    issues.push({
+      severity: "error",
+      title: "the last scan left no resume point",
+      detail: 'Updates diff from the commit the architecture reflects, and that commit was never recorded. Every job will fail with "no usable base" until a scan completes cleanly.',
+      fix: "archme init --force"
+    });
+  }
+  if (f.watchedBy === "none") {
+    issues.push({
+      severity: "error",
+      title: "nothing is watching this repo",
+      detail: "The architecture exists but will not track new commits \u2014 the board stays as it is while the code moves on, which looks current and isn't.",
+      fix: "archme init"
+    });
+  }
+  const halted = f.localRepos.filter((r) => r.halted);
+  for (const r of halted) {
+    issues.push({
+      severity: "error",
+      title: `local polling is halted for ${r.slug}`,
+      detail: `Stopped after: ${r.haltReason ?? "an unrecorded failure"}. No new commits are being picked up. It stops rather than skipping the failed commit, which would fold it into the next diff.`,
+      fix: `archme local-watch --resume ${r.slug}`
+    });
+  }
+  if (!f.daemonRunning && f.watchedBy !== "none" && f.watchedBy !== "unknown") {
+    issues.push({
+      severity: "error",
+      title: "the daemon is not running",
+      detail: "Commits are queueing up, but nothing is processing them. Updates only happen while the daemon runs, on a machine that stays on.",
+      fix: "archme daemon start"
+    });
+  }
+  return issues;
+}
+function yesNo(v) {
+  return v ? "yes" : "no";
+}
+function formatFacts(f) {
+  const lines = ["ArchMe setup"];
+  lines.push("", "  This machine");
+  lines.push(`    archme version:   ${f.cliVersion ?? "UNKNOWN (cannot read its own version)"}`);
+  lines.push(`    claude installed: ${yesNo(f.claudeInstalled)}`);
+  lines.push(`    git installed:    ${yesNo(f.gitInstalled)}`);
+  lines.push(`    signed in:        ${f.signedIn ? f.identity ?? "yes" : "no"}`);
+  lines.push(`    daemon running:   ${yesNo(f.daemonRunning)}`);
+  lines.push("", "  This repo");
+  if (!f.inRepo) {
+    lines.push("    not inside a git repository");
+  } else {
+    lines.push(`    path:      ${f.repoRoot}`);
+    lines.push(`    repo:      ${f.repoSlug ?? "no github.com remote"}`);
+    lines.push(`    branch:    ${f.gitBranch ?? "unknown"}`);
+    lines.push(`    .mcp.json: ${f.agentConfigInstalled ? "installed" : "missing"}`);
+    if (f.pinnedProject) lines.push(`    pinned to: ${f.pinnedProject} @ ${f.pinnedBranch ?? "?"}`);
+  }
+  lines.push("", "  Architecture");
+  if (!f.signedIn) {
+    lines.push("    unknown \u2014 not signed in");
+  } else {
+    if (f.pinnedOrgVisible === false) {
+      lines.push(`    NOT VISIBLE \u2014 ${f.pinnedProject} belongs to another organisation`);
+    }
+    lines.push(`    project exists: ${f.projectExists === null ? "unknown" : yesNo(f.projectExists)}`);
+    lines.push(`    components:     ${f.componentCount === null ? "unknown" : f.componentCount}`);
+    lines.push(
+      `    last scanned at: ${f.markerSha ? f.markerSha.slice(0, 7) : "never recorded"}`
+    );
+    lines.push(`    updates from:   ${describeWatch(f)}`);
+  }
+  for (const r of f.localRepos) {
+    lines.push(
+      `      \xB7 ${r.slug}${r.halted ? `  HALTED: ${r.haltReason ?? "unknown"}` : ""}`
+    );
+  }
+  return lines.join("\n");
+}
+function describeWatch(f) {
+  switch (f.watchedBy) {
+    case "github":
+      return "GitHub App (pushes and pull requests)";
+    case "local":
+      return "local polling on this machine";
+    case "none":
+      return "NOTHING \u2014 this architecture will not track new commits";
+    default:
+      return "unknown";
+  }
+}
+var init_facts = __esm({
+  "src/doctor/facts.ts"() {
+    "use strict";
+  }
+});
+
+// src/doctor/prompt.ts
+function buildDoctorPrompt(facts, issues) {
+  const problems = issues.length === 0 ? "No problems were found." : issues.map((i2) => `- [${i2.severity}] ${i2.title}
+  ${i2.detail}
+  Fix: ${i2.fix}`).join("\n");
+  return `You are helping someone understand their ArchMe setup. This is the
+\`archme doctor\` command.
+
+${HOW_IT_WORKS}
+
+## What was measured on this machine
+
+These facts were gathered by the CLI before you started. They are accurate.
+Do NOT re-derive them, and do not go looking for them in the filesystem \u2014 you
+have everything already.
+
+\`\`\`
+${formatFacts(facts)}
+\`\`\`
+
+## Problems found
+
+${problems}
+
+## Your job
+
+The report above has ALREADY been printed to the user's terminal. Do not repeat
+it back to them.
+
+Open with two or three sentences: where they are in the flow above, and the
+single most important thing to do next (or that nothing needs doing). Then stop
+and let them ask.
+
+Rules:
+- You are READ-ONLY. You cannot fix anything, and you must not offer to. Give
+  them the command to run.
+- Do not invent state. If they ask something the facts above do not answer, say
+  so and tell them which command would show it.
+- Never tell them their setup is fine if a problem was listed.
+- Be brief. They ran a diagnostic, not a tutorial. Depth on request.`;
+}
+var HOW_IT_WORKS;
+var init_prompt2 = __esm({
+  "src/doctor/prompt.ts"() {
+    "use strict";
+    init_facts();
+    HOW_IT_WORKS = `## How ArchMe is meant to work
+
+1. **Scan** \u2014 \`archme init\` maps the repo into an architecture on the board.
+   This is a one-time snapshot. It runs Claude Code locally, on the user's own
+   Claude subscription. Their code is never sent to ArchMe's servers; only the
+   resulting architecture is.
+
+2. **Detection** \u2014 something has to notice new commits. Two options:
+   - **GitHub App**: webhooks. Sees pushes AND pull requests, works for the
+     whole team, nothing to keep running. Needs someone to grant repo read
+     access.
+   - **Local polling** (\`archme local-watch\`): this machine fetches the repo on
+     a timer. No GitHub App, no approvals, but no pull-request awareness.
+
+3. **Execution** \u2014 something has to PROCESS each detected commit. This is the
+   step people miss. Detection only queues work; the queue does nothing on its
+   own. Either the user runs \`archme daemon start\` on a machine that stays on,
+   or they email signup@archme.io and ArchMe runs it for them.
+
+The failure mode that matters most: an architecture that exists but is not
+being updated. The board still looks current, so nobody notices it is stale.
+Detection without execution produces exactly that, which is why step 3 is not
+optional.`;
+  }
+});
+
+// src/doctor/dispatch.ts
+var dispatch_exports5 = {};
+__export(dispatch_exports5, {
+  EX_INFRA: () => EX_INFRA4,
+  EX_OK: () => EX_OK4,
+  EX_USAGE: () => EX_USAGE4,
+  dispatchDoctor: () => dispatchDoctor,
+  parseDoctorArgs: () => parseDoctorArgs,
+  printDoctorHelp: () => printDoctorHelp
+});
+import { mkdtemp as mkdtemp5, rm as rm9, writeFile as writeFile13 } from "node:fs/promises";
+import { tmpdir as tmpdir5 } from "node:os";
+import { join as join24 } from "node:path";
+function parseDoctorArgs(argv) {
+  const args = { plain: false, help: false };
+  for (const a2 of argv) {
+    if (a2 === "--help" || a2 === "-h" || a2 === "help") args.help = true;
+    else if (a2 === "--plain" || a2 === "--no-agent") args.plain = true;
+    else return { ok: false, message: `archme doctor: unknown flag '${a2}'` };
+  }
+  return { ok: true, args };
+}
+function printDoctorHelp() {
+  console.log(`archme doctor \u2014 check this machine's ArchMe setup and explain it
+
+Reports what is installed, signed in, scanned, watched and running, then hands
+the results to Claude Code so you can ask about them.
+
+Read-only: it never changes anything. Anything that needs doing is printed as a
+command for you to run.
+
+Usage:
+  archme doctor [--plain]
+
+Options:
+  --plain    Just print the report \u2014 don't start Claude. Use this when Claude
+             Code itself is what's broken.
+  -h, --help`);
+}
+async function dispatchDoctor(argv) {
+  const parsed = parseDoctorArgs(argv);
+  if (!parsed.ok) {
+    console.error(parsed.message);
+    printDoctorHelp();
+    return EX_USAGE4;
+  }
+  if (parsed.args.help) {
+    printDoctorHelp();
+    return EX_OK4;
+  }
+  const facts = await collectFacts(process.cwd());
+  const issues = diagnose(facts);
+  console.log(formatFacts(facts));
+  if (issues.length === 0) {
+    console.log("\n\u2713 Everything checks out.");
+  } else {
+    console.log("");
+    for (const issue of issues) {
+      console.log(`${issue.severity === "error" ? "\u2717" : "!"} ${issue.title}`);
+      console.log(`    ${issue.detail}`);
+      console.log(`    \u2192 ${issue.fix}`);
+      console.log("");
+    }
+  }
+  if (parsed.args.plain) return EX_OK4;
+  try {
+    requireBinary("claude");
+  } catch {
+    console.log(
+      "Install Claude Code to ask about any of this:  npm i -g @anthropic-ai/claude-code"
+    );
+    return EX_OK4;
+  }
+  const dir = await mkdtemp5(join24(tmpdir5(), "archme-doctor-"));
+  const mcpConfigPath = join24(dir, "mcp.json");
+  await writeFile13(mcpConfigPath, JSON.stringify({ mcpServers: {} }), { mode: 384 });
+  try {
+    const result = await spawnClaude({
+      prompt: buildDoctorPrompt(facts, issues),
+      cwd: facts.repoRoot ?? process.cwd(),
+      mcpConfigPath,
+      interactive: true,
+      // Read-only, and no MCP: doctor diagnoses, it does not repair. An LLM
+      // with write or shell access on a machine whose setup is already broken
+      // is a much larger surface than the problem justifies.
+      allowedTools: ["Read", "Glob", "Grep"]
+    });
+    return result.exitCode === 0 ? EX_OK4 : EX_INFRA4;
+  } finally {
+    await rm9(dir, { recursive: true, force: true });
+  }
+}
+var EX_OK4, EX_INFRA4, EX_USAGE4;
+var init_dispatch5 = __esm({
+  "src/doctor/dispatch.ts"() {
+    "use strict";
+    init_collect();
+    init_facts();
+    init_prompt2();
+    init_spawn_claude();
+    init_preflight();
+    EX_OK4 = 0;
+    EX_INFRA4 = 3;
+    EX_USAGE4 = 78;
+  }
+});
+
 // src/auth/logout.ts
 var logout_exports = {};
 __export(logout_exports, {
@@ -18187,12 +20453,12 @@ async function runLogout(args) {
   let url;
   try {
     url = resolveConfig().supabaseUrl;
-  } catch (err) {
-    if (err instanceof MissingConfigError) {
-      console.error(err.message);
+  } catch (err2) {
+    if (err2 instanceof MissingConfigError) {
+      console.error(err2.message);
       return 1;
     }
-    throw err;
+    throw err2;
   }
   const target = args.find((a2) => !a2.startsWith("-"));
   if (!target || args.includes("--all")) {
@@ -18220,10 +20486,22 @@ var init_logout = __esm({
 
 // src/cli.ts
 init_enroll();
-var KNOWN_COMMANDS = /* @__PURE__ */ new Set(["daemon", "analyze", "login", "logout", "keys", "scan", "init"]);
+var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
+  "daemon",
+  "analyze",
+  "login",
+  "logout",
+  "keys",
+  "scan",
+  "init",
+  "local-watch",
+  "doctor"
+]);
+var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v"]);
 function route(argv) {
   if (argv.length === 0) return { name: "help", args: [] };
   const [first, ...rest] = argv;
+  if (first && VERSION_FLAGS.has(first)) return { name: "version", args: [] };
   if (!first || !KNOWN_COMMANDS.has(first)) {
     return { name: "help", args: [] };
   }
@@ -18287,6 +20565,18 @@ async function main(argv) {
       const { dispatchDaemon: dispatchDaemon2 } = await Promise.resolve().then(() => (init_dispatch2(), dispatch_exports2));
       return await dispatchDaemon2(sub);
     }
+    case "version": {
+      const { readDaemonVersion: readDaemonVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
+      const v = await readDaemonVersion2();
+      if (!v) {
+        console.error(
+          "archme: could not read its own version \u2014 the install looks incomplete.\nThe daemon reports this as no version at all, and a configured minimum-version\nfloor will refuse its job claims. Reinstall with `npm i -g @archme/cli`."
+        );
+        return 1;
+      }
+      console.log(v);
+      return 0;
+    }
     case "login":
       await runLogin();
       return 0;
@@ -18302,6 +20592,14 @@ async function main(argv) {
       const { dispatchInit: dispatchInit2 } = await Promise.resolve().then(() => (init_dispatch4(), dispatch_exports4));
       return await dispatchInit2(r.args);
     }
+    case "local-watch": {
+      const { dispatchLocalWatch: dispatchLocalWatch2 } = await Promise.resolve().then(() => (init_localWatchDispatch(), localWatchDispatch_exports));
+      return await dispatchLocalWatch2(r.args);
+    }
+    case "doctor": {
+      const { dispatchDoctor: dispatchDoctor2 } = await Promise.resolve().then(() => (init_dispatch5(), dispatch_exports5));
+      return await dispatchDoctor2(r.args);
+    }
     case "logout": {
       const { runLogout: runLogout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
       return await runLogout2(r.args);
@@ -18324,7 +20622,12 @@ Other commands:
                                        disable|install|uninstall|run)
   archme analyze <subcommand>         Code analysis (outline|repo|diff|match|prefetch)
   archme scan <repo-path>             Single-pass scan into an explicit project/branch
+  archme local-watch [repo-path]      Watch a repo without a GitHub App
+                                      (--list|--stop|--resume)
+  archme doctor                       Check this machine's setup and explain it
   archme login | logout               Authenticate with archme
+  archme keys list|create|revoke      Manage MCP API keys
+  archme --version                    Print the installed version
 
 Run 'archme init --help', 'archme daemon --help', 'archme analyze --help', or
 'archme scan --help' for subcommand help.`);