@askexenow/exe-os 0.9.299 → 0.9.301

package/dist/chunk-5FP7YHCG.js

@@ -0,0 +1,1158 @@
+import {
+  getMasterKey,
+  setMasterKey
+} from "./chunk-Z42MXYWW.js";
+import {
+  LEGACY_LANCE_PATH,
+  MODELS_DIR,
+  loadConfig,
+  saveConfig
+} from "./chunk-R36FAN53.js";
+import {
+  atomicWriteJsonSync,
+  atomicWriteSync
+} from "./chunk-LYH5HE24.js";
+
+// src/lib/setup-wizard.ts
+import crypto from "crypto";
+import { execSync } from "child_process";
+import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, writeFileSync, chmodSync } from "fs";
+import os from "os";
+import path2 from "path";
+import { createInterface } from "readline";
+
+// src/lib/model-downloader.ts
+import { createWriteStream, createReadStream, existsSync, unlinkSync, renameSync, statSync } from "fs";
+import { mkdir, statfs } from "fs/promises";
+import { createHash } from "crypto";
+import path from "path";
+var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? "";
+var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? "";
+var EXPECTED_SIZE = Number(process.env.EXE_EMBED_MODEL_SIZE ?? "0") || 396836064;
+var LOCAL_FILENAME = "exe-embeddings-v1-q4_k_m.gguf";
+var MIN_FREE_BYTES = EXPECTED_SIZE + 100 * 1024 * 1024;
+var INACTIVITY_TIMEOUT_MS = 6e4;
+async function downloadModel(opts) {
+  const { destDir, onProgress, fetchFn = globalThis.fetch, url = GGUF_URL } = opts;
+  const destPath = path.join(destDir, LOCAL_FILENAME);
+  const tmpPath = destPath + ".tmp";
+  if (!url) {
+    throw new Error(
+      "Embedding model download URL not configured (set EXE_EMBED_MODEL_URL). Embeddings are optional and OFF by default \u2014 graph + keyword search needs no model."
+    );
+  }
+  await mkdir(destDir, { recursive: true });
+  await assertEnoughFreeSpace(destDir);
+  if (existsSync(destPath)) {
+    const hash = await fileHash(destPath);
+    if (hash === EXPECTED_SHA256) {
+      return destPath;
+    }
+  }
+  const MAX_RETRIES = 3;
+  let lastErr;
+  for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      const resumeFrom = existsSync(tmpPath) ? statSync(tmpPath).size : 0;
+      if (resumeFrom >= EXPECTED_SIZE) {
+        const actualHash2 = await fileHash(tmpPath);
+        if (actualHash2 === EXPECTED_SHA256) {
+          renameSync(tmpPath, destPath);
+          return destPath;
+        }
+        unlinkSync(tmpPath);
+        throw new Error(
+          `SHA256 mismatch: expected ${EXPECTED_SHA256}, got ${actualHash2}`
+        );
+      }
+      let downloaded = resumeFrom;
+      const controller = new AbortController();
+      let inactivityTimer = setTimeout(() => controller.abort(), INACTIVITY_TIMEOUT_MS);
+      const resetInactivityTimer = () => {
+        clearTimeout(inactivityTimer);
+        inactivityTimer = setTimeout(() => controller.abort(), INACTIVITY_TIMEOUT_MS);
+      };
+      const response = await fetchFn(url, {
+        redirect: "follow",
+        signal: controller.signal,
+        headers: resumeFrom > 0 ? { Range: `bytes=${resumeFrom}-` } : void 0
+      });
+      if (!response.ok || !response.body) {
+        throw new Error(`Download failed: HTTP ${response.status}`);
+      }
+      if (resumeFrom > 0 && response.status !== 206) {
+        clearTimeout(inactivityTimer);
+        unlinkSync(tmpPath);
+        throw new Error("Download server did not honor Range resume");
+      }
+      const rangeTotal = parseTotalSize(response.headers.get("content-range"));
+      const lengthHeaderRaw = response.headers.get("content-length");
+      const lengthHeader = lengthHeaderRaw != null ? Number(lengthHeaderRaw) : null;
+      const advertisedTotal = rangeTotal ?? (lengthHeader != null ? response.status === 206 ? resumeFrom + lengthHeader : lengthHeader : null);
+      const contentLength = advertisedTotal ?? EXPECTED_SIZE;
+      const fileStream = createWriteStream(tmpPath, { flags: resumeFrom > 0 ? "a" : "w" });
+      const reader = response.body.getReader();
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          resetInactivityTimer();
+          if (!fileStream.write(value)) {
+            await new Promise((resolve) => fileStream.once("drain", resolve));
+          }
+          downloaded += value.byteLength;
+          onProgress?.(downloaded, contentLength);
+        }
+      } finally {
+        clearTimeout(inactivityTimer);
+        fileStream.end();
+        await new Promise((resolve, reject) => {
+          fileStream.on("finish", resolve);
+          fileStream.on("error", reject);
+        });
+      }
+      const finalSize = statSync(tmpPath).size;
+      if (advertisedTotal != null && finalSize !== advertisedTotal) {
+        throw new Error(`Downloaded size mismatch: expected ${advertisedTotal}, got ${finalSize} (truncated \u2014 will resume)`);
+      }
+      const actualHash = await fileHash(tmpPath);
+      if (actualHash !== EXPECTED_SHA256) {
+        unlinkSync(tmpPath);
+        throw new Error(
+          `SHA256 mismatch: expected ${EXPECTED_SHA256}, got ${actualHash}`
+        );
+      }
+      renameSync(tmpPath, destPath);
+      return destPath;
+    } catch (err) {
+      lastErr = err instanceof Error ? err : new Error(String(err));
+      if (lastErr.message.includes("SHA256 mismatch")) break;
+      if (attempt < MAX_RETRIES) {
+        process.stderr.write(`
+Download attempt ${attempt} failed, retrying...
+`);
+      }
+    }
+  }
+  throw lastErr;
+}
+function parseTotalSize(contentRange) {
+  const match = contentRange?.match(/\/(\d+)$/);
+  return match ? Number(match[1]) : null;
+}
+async function assertEnoughFreeSpace(destDir) {
+  const stats = await statfs(destDir);
+  const available = stats.bavail * stats.bsize;
+  if (available < MIN_FREE_BYTES) {
+    throw new Error(
+      `Insufficient disk space for model download: need at least ${MIN_FREE_BYTES} bytes free, have ${available}`
+    );
+  }
+}
+async function fileHash(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = createHash("sha256");
+    const stream = createReadStream(filePath);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => resolve(hash.digest("hex")));
+    stream.on("error", reject);
+  });
+}
+
+// src/lib/setup-wizard.ts
+function findPackageRoot() {
+  let dir = path2.dirname(new URL(import.meta.url).pathname);
+  const root = path2.parse(dir).root;
+  while (dir !== root) {
+    const pkgPath = path2.join(dir, "package.json");
+    if (existsSync2(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
+      } catch {
+      }
+    }
+    dir = path2.dirname(dir);
+  }
+  return null;
+}
+var SETUP_STATE_PATH = path2.join(os.homedir(), ".exe-os", "setup-state.json");
+function loadSetupState() {
+  try {
+    return JSON.parse(readFileSync(SETUP_STATE_PATH, "utf8"));
+  } catch {
+    return { completedSteps: [], startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+}
+function saveSetupState(state) {
+  mkdirSync(path2.dirname(SETUP_STATE_PATH), { recursive: true });
+  atomicWriteJsonSync(SETUP_STATE_PATH, state);
+}
+function clearSetupState() {
+  try {
+    unlinkSync2(SETUP_STATE_PATH);
+  } catch {
+  }
+}
+function ask(rl, prompt, allowEmpty = false) {
+  return new Promise((resolve) => {
+    const doAsk = () => {
+      rl.question(prompt, (answer) => {
+        const trimmed = answer.trim();
+        if (!allowEmpty && trimmed.length === 0) {
+          doAsk();
+          return;
+        }
+        resolve(trimmed);
+      });
+    };
+    doAsk();
+  });
+}
+function askHeadless(envVar, fallback, log, prompt) {
+  const value = envVar ?? fallback;
+  if (value) log(`  [headless] ${prompt.replace(/[:\s]+$/, "")}: ${value}`);
+  return value;
+}
+function getAvailableMemoryGB() {
+  if (process.platform === "darwin") {
+    try {
+      const vmstat = execSync("vm_stat", { encoding: "utf8" });
+      const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
+      const pageSize = pageSizeMatch?.[1] ? parseInt(pageSizeMatch[1], 10) : 16384;
+      const free = vmstat.match(/Pages free:\s+(\d+)/);
+      const inactive = vmstat.match(/Pages inactive:\s+(\d+)/);
+      const speculative = vmstat.match(/Pages speculative:\s+(\d+)/);
+      const freePages = free?.[1] ? parseInt(free[1], 10) : 0;
+      const inactivePages = inactive?.[1] ? parseInt(inactive[1], 10) : 0;
+      const speculativePages = speculative?.[1] ? parseInt(speculative[1], 10) : 0;
+      return (freePages + inactivePages + speculativePages) * pageSize / (1024 * 1024 * 1024);
+    } catch {
+      return os.freemem() / (1024 * 1024 * 1024);
+    }
+  }
+  return os.freemem() / (1024 * 1024 * 1024);
+}
+function isWSL() {
+  if (process.platform !== "linux") return false;
+  try {
+    const release = execSync("uname -r", { encoding: "utf8", timeout: 3e3 }).toLowerCase();
+    return release.includes("microsoft");
+  } catch {
+    return false;
+  }
+}
+function getTotalMemoryGB() {
+  return os.totalmem() / (1024 * 1024 * 1024);
+}
+function isLowMemory() {
+  return getAvailableMemoryGB() < 2;
+}
+async function validateModel(log) {
+  const totalGB = getTotalMemoryGB();
+  const freeGB = getAvailableMemoryGB();
+  if (totalGB <= 8 || isLowMemory()) {
+    log(`System memory: ${totalGB.toFixed(0)}GB total, ${freeGB.toFixed(1)}GB free`);
+    log("Skipping in-memory model validation (low memory \u2014 will validate on first use).");
+    const modelPath = path2.join(MODELS_DIR, LOCAL_FILENAME);
+    if (existsSync2(modelPath)) {
+      const { statSync: statSync2 } = await import("fs");
+      const size = statSync2(modelPath).size;
+      if (size > 300 * 1e6) {
+        log(`Model file verified (${(size / 1e6).toFixed(0)} MB).`);
+        return;
+      }
+      throw new Error(`Model file too small (${(size / 1e6).toFixed(0)} MB) \u2014 may be corrupted. Delete and re-run setup.`);
+    }
+    throw new Error("Model file not found after download.");
+  }
+  log("Validating model...");
+  const result = await validateModelViaWorker();
+  if (result.dim !== 1024) {
+    throw new Error(
+      result.error ? `Model validation failed: ${result.error}` : `Model produced ${result.dim}-dim embeddings, expected 1024`
+    );
+  }
+  log("Model validation passed (1024-dim embeddings confirmed).");
+}
+async function validateModelViaWorker() {
+  const { fork } = await import("child_process");
+  const workerUrl = new URL("./embed-worker.js", import.meta.url);
+  const workerPath = workerUrl.pathname;
+  if (!existsSync2(workerPath)) {
+    return { dim: 0, error: `embed worker not found at ${workerPath}` };
+  }
+  const HEAP_FLAG_RE = /^--(max[-_]old[-_]space[-_]size|max[-_]semi[-_]space[-_]size|max[-_]heap[-_]size)(=|$)/i;
+  const execArgv = [
+    ...process.execArgv.filter((a) => !HEAP_FLAG_RE.test(a)),
+    "--max-old-space-size=6144"
+  ];
+  const env = { ...process.env, EXE_EMBED_WORKER_CONTEXT: "1" };
+  return await new Promise((resolve) => {
+    const child = fork(workerPath, [], { stdio: ["ignore", "ignore", "inherit", "ipc"], execArgv, env });
+    let settled = false;
+    const finish = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child.removeAllListeners();
+      } catch {
+      }
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve(r);
+    };
+    const timer = setTimeout(() => finish({ dim: 0, error: "validation timed out after 120s" }), 12e4);
+    child.on("message", (msg) => {
+      if (msg?.type === "ready") finish({ dim: msg.dim ?? 0, error: msg.error });
+    });
+    child.on("error", (err) => finish({ dim: 0, error: err.message }));
+    child.on("exit", (code, signal) => finish({ dim: 0, error: `worker exited before ready (code=${code}, signal=${signal ?? "none"})` }));
+  });
+}
+async function runSetupWizard(opts = {}) {
+  const {
+    skipModel: skipModelOpt = false,
+    skipModelValidation = false,
+    nonInteractive = false,
+    log = (msg) => process.stderr.write(msg + "\n"),
+    runInstaller
+  } = opts;
+  let skipModel = skipModelOpt;
+  if (process.platform === "win32") {
+    log(
+      "\nexe-os does not support native Windows. Use WSL2 instead:\n  1. Run `wsl --install` in PowerShell\n  2. Open Ubuntu/WSL2\n  3. Install and run exe-os inside WSL2\n"
+    );
+    return;
+  }
+  const sigintHandler = () => {
+    process.stderr.write("\n\n\u26A0 Setup interrupted. If your encryption key was already created,\n");
+    process.stderr.write("  run `exe-os setup` again to resume and see your recovery phrase.\n\n");
+    process.exit(130);
+  };
+  process.on("SIGINT", sigintHandler);
+  if (nonInteractive) {
+    log("[headless] Non-interactive mode enabled. Using env vars for config.");
+  }
+  const rl = opts.createReadline ? opts.createReadline() : createInterface({ input: process.stdin, output: process.stderr });
+  const askOrEnv = (prompt, envVar, fallback = "") => {
+    if (nonInteractive) {
+      return Promise.resolve(askHeadless(envVar ? process.env[envVar] : void 0, fallback, log, prompt));
+    }
+    return ask(rl, prompt, fallback.length > 0);
+  };
+  const askOptional = (prompt, envVar, fallback = "") => {
+    if (nonInteractive) {
+      return Promise.resolve(askHeadless(envVar ? process.env[envVar] : void 0, fallback, log, prompt));
+    }
+    return ask(rl, prompt, true);
+  };
+  try {
+    log("");
+    log("=== exe-os Setup ===");
+    log("");
+    if (process.platform === "darwin") {
+      const currentShell = process.env.SHELL ?? "";
+      if (currentShell.includes("bash")) {
+        log("  \u26A0 Your default shell is bash.");
+        log("  macOS uses zsh by default since Catalina (2019).");
+        log("  exe-os works with bash, but switching to zsh is recommended:");
+        log("    chsh -s /bin/zsh");
+        log("  Then restart your terminal.");
+        log("");
+        const cont = await askOrEnv("  Continue with bash? (y/n, default: y): ", void 0, "y");
+        if (cont.toLowerCase() === "n") {
+          log("  Run `chsh -s /bin/zsh`, restart your terminal, then run setup again.");
+          rl.close();
+          return;
+        }
+        log("");
+      }
+    }
+    if (isWSL()) {
+      log("  Detected: Windows Subsystem for Linux (WSL)");
+      log("");
+      if (process.cwd().startsWith("/mnt/")) {
+        log("  \u26A0 Your current directory is on the Windows filesystem (/mnt/).");
+        log("  This is ~10x slower than the native Linux filesystem.");
+        log("  For best performance, keep your projects in ~/  (e.g., ~/projects/)");
+        log("  and run exe-os from there.");
+        log("");
+      }
+      log("  Encryption: using file-based key storage (OS keychain not available in WSL).");
+      log("  This is normal \u2014 your key is still encrypted and machine-bound.");
+      log("");
+    }
+    log("What are you setting up?");
+    log("");
+    log("  [1] First device / brand new Exe OS memory");
+    log("  [2] Another device / I already have a 24-word recovery phrase");
+    log("");
+    const installType = await askOrEnv("Choice (1/2): ", "EXE_INSTALL_TYPE", "1");
+    let isPairing = false;
+    let pairingRosterPulled = false;
+    if (installType === "2") {
+      isPairing = true;
+      log("");
+      const { importMnemonic } = await import("./lib/keychain.js");
+      log("On your existing device, open Terminal and run:");
+      log("  exe-os cloud link --show-full");
+      log("Then copy the 24-word phrase here.");
+      log("");
+      const mnemonic = await askOrEnv("Paste the 24-word recovery phrase: ", "EXE_PASSPHRASE");
+      try {
+        const key = await importMnemonic(mnemonic);
+        await setMasterKey(key);
+        log("Master key imported and stored securely.");
+        log("");
+        log("Now paste the Cloud API key from that same `exe-os cloud link --show-full` output.");
+        log("It starts with: exe_sk_");
+        log("");
+        const apiKey = await askOptional("Cloud API key (starts with exe_sk_): ", "EXE_LICENSE_KEY");
+        if (apiKey && apiKey.startsWith("exe_sk_")) {
+          const cloudEndpoint = "https://api.askexe.com";
+          const cloudCfg = { apiKey, endpoint: cloudEndpoint };
+          const earlyConfig = await loadConfig();
+          earlyConfig.cloud = cloudCfg;
+          await saveConfig(earlyConfig);
+          const { saveLicense: saveLic, mirrorLicenseKey: mirrorLic } = await import("./lib/license.js");
+          saveLic(apiKey);
+          mirrorLic(apiKey);
+          log("Cloud sync configured.");
+          try {
+            const { initSyncCrypto } = await import("./lib/crypto.js");
+            const { cloudPullRoster } = await import("./lib/cloud-sync.js");
+            initSyncCrypto(key);
+            const result = await cloudPullRoster({ apiKey, endpoint: cloudEndpoint });
+            if (result.added > 0) {
+              log(`Pulled ${result.added} employee(s) from Exe Cloud.`);
+              pairingRosterPulled = true;
+            }
+          } catch {
+            log("Could not pull roster from cloud \u2014 you can set up employees manually.");
+          }
+        } else {
+          log("No API key provided \u2014 cloud sync will need to be configured later.");
+          log("Run /exe-cloud after setup to connect.");
+        }
+        log("");
+      } catch (err) {
+        log(`Key import failed: ${err instanceof Error ? err.message : String(err)}`);
+        log("Check your phrase and try again, or choose option 1 for a fresh install.");
+        rl.close();
+        return;
+      }
+    }
+    const state = loadSetupState();
+    if (state.completedSteps.length > 0) {
+      const visibleStep = Math.max(...state.completedSteps.filter((step) => step < 50), 0) + 1;
+      log(`Resuming setup from step ${visibleStep}...`);
+    }
+    if (existsSync2(LEGACY_LANCE_PATH)) {
+      log("\u26A0 Found v1.0 LanceDB at ~/.exe-os/local.lance");
+      log("  v1.1 uses libSQL (SQLite). Your existing memories are not automatically migrated.");
+      log("  The old directory will not be modified or deleted.");
+      log("");
+    }
+    if (!state.completedSteps.includes(1)) {
+      const existingKey = await getMasterKey();
+      if (existingKey) {
+        log("Encryption key already exists \u2014 skipping generation.");
+      } else {
+        log("Generating 256-bit encryption key...");
+        const key = crypto.randomBytes(32);
+        await setMasterKey(key);
+        log("Encryption key generated and stored securely.");
+        log("");
+        const { exportMnemonic } = await import("./lib/keychain.js");
+        const mnemonic = await exportMnemonic(key);
+        log("=============================================================");
+        log("  YOUR 24-WORD RECOVERY PHRASE");
+        log("=============================================================");
+        log("");
+        log("  " + mnemonic);
+        log("");
+        log("  SAVE THIS NOW before continuing.");
+        log("  Best: put it in your password manager, or write it down and keep it safe.");
+        log("  This phrase is the ONLY way to decrypt your memories if you lose this computer.");
+        log("  We cannot recover it for you.");
+        log("");
+        log("  Like a Bitcoin wallet \u2014 lose the phrase, lose everything.");
+        log("=============================================================");
+        log("");
+        const confirmation = nonInteractive ? "" : await ask(rl, 'Type "I SAVED MY RECOVERY PHRASE" after you have saved it: ', true);
+        if (nonInteractive) {
+          const recoveryPath = path2.join(os.homedir(), ".exe-os", "recovery-phrase.txt");
+          mkdirSync(path2.dirname(recoveryPath), { recursive: true });
+          writeFileSync(recoveryPath, mnemonic + "\n", { mode: 384 });
+          chmodSync(recoveryPath, 384);
+          log(`[headless] Recovery phrase written to ${recoveryPath} (0600). It is not marked as confirmed.`);
+        }
+        if (!nonInteractive && confirmation.toUpperCase().trim() !== "I SAVED MY RECOVERY PHRASE") {
+          throw new Error(
+            "Setup cancelled: recovery phrase was not confirmed. Save the 24-word phrase before continuing \u2014 it is required to recover encrypted memories."
+          );
+        }
+        if (!nonInteractive) {
+          const { markKeyBackupConfirmed } = await import("./key-backup-status-2EPRIAXU.js");
+          markKeyBackupConfirmed("setup-wizard");
+        }
+      }
+      state.completedSteps.push(1);
+      saveSetupState(state);
+    } else {
+      log("Step 1 already complete \u2014 skipping.");
+    }
+    log("");
+    let cloudConfig;
+    if (isPairing) {
+      const pairingConfig = await loadConfig();
+      if (pairingConfig.cloud?.apiKey) {
+        cloudConfig = pairingConfig.cloud;
+        log("Cloud sync: using shared API key from pairing.");
+      }
+      state.completedSteps.push(2);
+      saveSetupState(state);
+    } else if (!state.completedSteps.includes(2)) {
+      log("Exe Cloud: your memories are end-to-end encrypted, compressed, and");
+      log("backed up on Exe Cloud. Free for all plans. We can't read your data \u2014");
+      log("only your encryption key can decrypt it.");
+      log("Cloud setup may POST your device ID to api.askexe.com to provision sync.");
+      log("Free-tier telemetry is sent for product health and plan enforcement.");
+      log("");
+      const enableCloud = (await askOrEnv("Enable Exe Cloud sync? [Y/n]: ", "EXE_ENABLE_CLOUD", "y")).toLowerCase() !== "n";
+      const existingKey = enableCloud ? await askOptional("Paste your Exe OS license key, or press Enter to start as a free user: ", "EXE_LICENSE_KEY") : "";
+      if (!enableCloud) {
+        log("Cloud sync disabled. Setup will stay local-only.");
+      }
+      if (existingKey && existingKey.startsWith("exe_sk_")) {
+        const cloudEndpoint = "https://api.askexe.com";
+        try {
+          const { loadDeviceId } = await import("./lib/license.js");
+          const deviceId = loadDeviceId();
+          const res = await fetch(`${cloudEndpoint}/auth/activate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ apiKey: existingKey, deviceId }),
+            signal: AbortSignal.timeout(1e4)
+          });
+          if (res.ok) {
+            const data = await res.json();
+            if (data.valid) {
+              cloudConfig = { apiKey: existingKey, endpoint: cloudEndpoint };
+              const { saveLicense: saveLicense2, mirrorLicenseKey: mirrorLicenseKey2 } = await import("./lib/license.js");
+              saveLicense2(existingKey);
+              mirrorLicenseKey2(existingKey);
+              log(`API key validated. Plan: ${data.plan}, email: ${data.email}`);
+              log("Cloud sync configured.");
+            } else {
+              log("API key is invalid or expired. Proceeding with auto-provisioning.");
+            }
+          }
+        } catch {
+          log("Could not validate key \u2014 saving it and proceeding.");
+          cloudConfig = { apiKey: existingKey, endpoint: "https://api.askexe.com" };
+          const { saveLicense: saveLicense2, mirrorLicenseKey: mirrorLicenseKey2 } = await import("./lib/license.js");
+          saveLicense2(existingKey);
+          mirrorLicenseKey2(existingKey);
+        }
+      }
+      if (enableCloud && !cloudConfig) {
+        try {
+          const { loadDeviceId } = await import("./lib/license.js");
+          const deviceId = loadDeviceId();
+          let res;
+          try {
+            res = await fetch("https://api.askexe.com/auth/auto-provision", {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ deviceId }),
+              signal: AbortSignal.timeout(1e4)
+            });
+          } catch {
+            await new Promise((r) => setTimeout(r, 500));
+            res = await fetch("https://api.askexe.com/auth/auto-provision", {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ deviceId }),
+              signal: AbortSignal.timeout(1e4)
+            });
+          }
+          if (res.ok) {
+            const data = await res.json();
+            if (data.apiKey) {
+              cloudConfig = { apiKey: data.apiKey, endpoint: "https://api.askexe.com" };
+              const { saveLicense: saveLicense2, mirrorLicenseKey: mirrorLicenseKey2 } = await import("./lib/license.js");
+              saveLicense2(data.apiKey);
+              mirrorLicenseKey2(data.apiKey);
+              log("Cloud sync activated automatically.");
+            }
+          }
+        } catch {
+          log("Cloud sync will activate when online.");
+        }
+      }
+      state.completedSteps.push(2);
+      saveSetupState(state);
+    } else {
+      log("Step 2 already complete \u2014 skipping.");
+    }
+    log("");
+    if (!state.completedSteps.includes(3)) {
+      const totalGB = getTotalMemoryGB();
+      if (!skipModel && !nonInteractive) {
+        log("Search uses keyword + graph by default (fast, no model needed).");
+        log("Embedding model adds semantic search but requires ~600MB download.");
+        log("");
+        const installModel = await ask(rl, "Install embedding model? [y/N]: ", true);
+        if (!installModel || installModel.toLowerCase() !== "y") {
+          skipModel = true;
+        }
+      } else if (!skipModel) {
+        skipModel = true;
+      }
+      if (totalGB <= 8 && !skipModel) {
+        log(`System: ${totalGB.toFixed(0)}GB RAM \u2014 embedding model requires 16GB+. Skipping.`);
+        skipModel = true;
+      }
+      if (!skipModel) {
+        const freeGB = getAvailableMemoryGB();
+        if (freeGB < 2) {
+          log(`\u26A0 Low memory: ${freeGB.toFixed(1)}GB free. Close other apps first.`);
+          if (!nonInteractive) await ask(rl, "Press Enter when ready, or Ctrl+C to abort: ", true);
+        }
+        log("Downloading the embedding model (optional \u2014 embeddings are off by default)...");
+        await downloadModel({
+          destDir: MODELS_DIR,
+          onProgress: (downloaded, total) => {
+            const pct = (downloaded / total * 100).toFixed(1);
+            const dlMB = (downloaded / 1e6).toFixed(0);
+            const totalMB = (total / 1e6).toFixed(0);
+            process.stderr.write(`\rDownloading: ${pct}% (${dlMB}/${totalMB} MB)`);
+          }
+        });
+        process.stderr.write("\n");
+        log("Model downloaded.");
+      } else {
+        log("Search: keyword + graph (no embedding model)");
+      }
+      state.completedSteps.push(3);
+      saveSetupState(state);
+    } else {
+      log("Step 3 already complete \u2014 skipping.");
+    }
+    if (!state.completedSteps.includes(4)) {
+      if (!skipModel && !skipModelValidation) {
+        await validateModel(log);
+      }
+      state.completedSteps.push(4);
+      saveSetupState(state);
+    } else {
+      log("Step 4 already complete \u2014 skipping.");
+    }
+    const config = await loadConfig();
+    if (!state.completedSteps.includes(5)) {
+      if (cloudConfig) {
+        config.cloud = cloudConfig;
+      }
+      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-EMDEZHIU.js");
+      applyDefaultOrchestrationPhase(config);
+      await saveConfig(config);
+      log("");
+      log(`Claude Code trust dialog will be accepted for this project only: ${process.cwd()}`);
+      try {
+        const claudeJsonPath = path2.join(os.homedir(), ".claude.json");
+        let claudeJson = {};
+        try {
+          claudeJson = JSON.parse(readFileSync(claudeJsonPath, "utf8"));
+        } catch {
+        }
+        if (!claudeJson.projects) claudeJson.projects = {};
+        const projects = claudeJson.projects;
+        const dir = process.cwd();
+        if (!projects[dir]) projects[dir] = {};
+        projects[dir].hasTrustDialogAccepted = true;
+        atomicWriteSync(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
+      } catch {
+      }
+      state.completedSteps.push(5);
+      saveSetupState(state);
+    } else {
+      log("Step 5 already complete \u2014 skipping.");
+    }
+    if (!state.completedSteps.includes(55)) {
+      const { savePreferences, loadPreferences: loadPrefs } = await import("./preferences-ERXO6SMJ.js");
+      const existingPrefs = loadPrefs();
+      const prefs = { ...existingPrefs };
+      log("=== Config Defaults ===");
+      log("");
+      const ghosttyDetected = existsSync2(path2.join(os.homedir(), ".config", "ghostty")) || existsSync2(path2.join(os.homedir(), "Library", "Application Support", "com.mitchellh.ghostty"));
+      if (ghosttyDetected) {
+        const ghosttyAnswer = await askOrEnv("Detected Ghostty terminal. Use exe-os Ghostty defaults? (Y/n) ", void 0, "y");
+        prefs.ghostty = ghosttyAnswer.toLowerCase() !== "n";
+      }
+      const weztermDetected = existsSync2(path2.join(os.homedir(), ".wezterm.lua")) || existsSync2(path2.join(os.homedir(), ".config", "wezterm")) || (() => {
+        try {
+          execSync("which wezterm 2>/dev/null", { timeout: 5e3 });
+          return true;
+        } catch {
+          return false;
+        }
+      })();
+      if (weztermDetected) {
+        const weztermAnswer = await askOrEnv("Detected WezTerm terminal. Use exe-os WezTerm defaults? (Y/n) ", void 0, "y");
+        prefs.wezterm = weztermAnswer.toLowerCase() !== "n";
+      }
+      const tmuxAnswer = await askOrEnv("Use exe-os tmux config? (Y/n) ", void 0, "y");
+      prefs.tmux = tmuxAnswer.toLowerCase() !== "n";
+      const statusLineAnswer = await askOrEnv("Install CC context bar in status line? (Y/n) ", void 0, "y");
+      prefs.ccStatusLine = statusLineAnswer.toLowerCase() !== "n";
+      prefs.codexStatusLine = prefs.ccStatusLine;
+      savePreferences(prefs);
+      log("");
+      state.completedSteps.push(55);
+      saveSetupState(state);
+    }
+    if (!state.completedSteps.includes(56)) {
+      log("=== AI Runtime ===");
+      log("");
+      log("  1) Claude Code  (Anthropic \u2014 recommended)");
+      log("  2) Codex        (OpenAI)");
+      log("  3) OpenCode     (75+ providers \u2014 open source)");
+      log("");
+      const rtChoice = await askOrEnv("Choose your AI runtime [1]: ", "EXE_RUNTIME", "1");
+      const rtMap = {
+        "1": { runtime: "claude", defaultModel: "claude-sonnet-4" },
+        "2": { runtime: "codex", defaultModel: "o3" },
+        "3": { runtime: "opencode", defaultModel: "anthropic/claude-sonnet-4" }
+      };
+      const selected = rtMap[rtChoice.trim()] ?? rtMap["1"];
+      const chosenModel = selected.defaultModel;
+      log(`Runtime: ${selected.runtime}`);
+      log(`Default model: ${chosenModel}`);
+      try {
+        const { loadConfig: lc, saveConfig: sc } = await import("./lib/config.js");
+        const cfg = await lc();
+        cfg.defaultRuntime = selected.runtime;
+        cfg.defaultModel = chosenModel;
+        await sc(cfg);
+        log(`Saved: ${selected.runtime} / ${chosenModel}`);
+      } catch (e) {
+        log(`Warning: could not save runtime config (${e instanceof Error ? e.message : String(e)})`);
+      }
+      log("");
+      state.completedSteps.push(56);
+      saveSetupState(state);
+    }
+    const {
+      loadEmployees,
+      saveEmployees,
+      addEmployee,
+      registerBinSymlinks,
+      EMPLOYEES_PATH,
+      DEFAULT_COORDINATOR_TEMPLATE_NAME,
+      validateEmployeeName,
+      VALID_AGENT_NAME_DESCRIPTION,
+      isCoordinatorRole
+    } = await import("./lib/employees.js");
+    const { getTemplateByRole } = await import("./lib/employee-templates.js");
+    const { identityPath } = await import("./lib/identity.js");
+    const { getTemplate: getIdentityTemplate } = await import("./lib/identity-templates.js");
+    const {
+      checkLicense,
+      saveLicense,
+      mirrorLicenseKey,
+      validateLicense
+    } = await import("./lib/license.js");
+    const createdEmployees = [];
+    let cooName = DEFAULT_COORDINATOR_TEMPLATE_NAME;
+    const reservedNames = /* @__PURE__ */ new Set(["test", "ls", "cd", "rm", "mv", "cp", "cat", "echo", "exit", "kill", "ps", "top", "sudo", "root", "admin", "node", "npm", "git"]);
+    const promptForEmployeeName = async (prompt, envVar, fallback) => {
+      while (true) {
+        const input = await askOrEnv(prompt, envVar, fallback);
+        const candidate = (input || fallback).toLowerCase();
+        const validation = validateEmployeeName(candidate);
+        if (!validation.valid) {
+          log(validation.error ?? VALID_AGENT_NAME_DESCRIPTION);
+        } else if (reservedNames.has(candidate)) {
+          log(`"${candidate}" is a reserved system command. Choose a different name.`);
+        } else {
+          return candidate;
+        }
+        if (nonInteractive) {
+          const fallbackValidation = validateEmployeeName(fallback);
+          if (fallbackValidation.valid && !reservedNames.has(fallback)) return fallback;
+          throw new Error(`Invalid default employee name '${fallback}'`);
+        }
+      }
+    };
+    if (pairingRosterPulled) {
+      const roster = await loadEmployees(EMPLOYEES_PATH).catch(() => []);
+      const existingCoo = roster.find((e) => isCoordinatorRole(e.role));
+      if (existingCoo) {
+        cooName = existingCoo.name;
+        log("");
+        log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
+        log("  \u2502  Team synced from cloud                  \u2502");
+        log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
+        log("");
+        const maxNameLen = Math.max(...roster.map((e) => e.name.length), 4);
+        for (const emp of roster) {
+          const badge = emp.name === cooName ? " \u2605" : "  ";
+          log(`  ${badge} ${emp.name.padEnd(maxNameLen)}  ${emp.role}`);
+        }
+        log("");
+        createdEmployees.push(...roster.map((e) => ({ name: e.name, role: e.role })));
+      }
+      let missingIdentities = [];
+      for (const emp of roster) {
+        const idPath = identityPath(emp.name);
+        if (!existsSync2(idPath)) {
+          missingIdentities.push(emp.name);
+        }
+      }
+      if (missingIdentities.length > 0) {
+        log("");
+        log(`\u26A0 Identity files missing for: ${missingIdentities.join(", ")}`);
+        log("  Your main device needs to push them to cloud first.");
+        log("");
+        log("  On your MAIN device, run:  exe-os cloud sync");
+        log("  Then come back here and press Enter to retry the pull.");
+        log("");
+        if (!nonInteractive) await ask(rl, "Press Enter after syncing from your main device... ", true);
+        try {
+          const { initSyncCrypto: retryInitCrypto } = await import("./lib/crypto.js");
+          const { cloudPullRoster: retryPull } = await import("./lib/cloud-sync.js");
+          const retryKey = await getMasterKey();
+          if (retryKey) {
+            retryInitCrypto(retryKey);
+            const retryConfig = await loadConfig();
+            if (retryConfig.cloud?.apiKey && retryConfig.cloud?.endpoint) {
+              const retryResult = await retryPull({
+                apiKey: retryConfig.cloud.apiKey,
+                endpoint: retryConfig.cloud.endpoint
+              });
+              if (retryResult.identitiesUpdated && retryResult.identitiesUpdated > 0) {
+                log(`Pulled ${retryResult.identitiesUpdated} identity file(s) from cloud.`);
+              }
+            }
+          }
+          missingIdentities = [];
+          for (const emp of roster) {
+            if (!existsSync2(identityPath(emp.name))) {
+              missingIdentities.push(emp.name);
+            }
+          }
+          if (missingIdentities.length > 0) {
+            log(`\u26A0 Still missing: ${missingIdentities.join(", ")}. Identities will sync on next daemon cycle.`);
+          } else {
+            log("All identity files synced successfully.");
+          }
+        } catch {
+          log("Retry pull failed \u2014 identities will sync when the daemon starts.");
+        }
+      }
+      for (const emp of roster) {
+        registerBinSymlinks(emp.name);
+      }
+      try {
+        const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
+        const pkgRoot = findPackageRoot();
+        if (pkgRoot) {
+          const wrapResult = generateSessionWrappers(pkgRoot);
+          if (wrapResult.created > 0) {
+            log(`Session shortcuts generated: ${roster.map((e) => `${e.name}1`).join(", ")}, ...`);
+          }
+        }
+      } catch {
+      }
+      state.completedSteps.push(6, 7, 8);
+      saveSetupState(state);
+      log("");
+    } else if (!state.completedSteps.includes(6)) {
+      log("=== Your First Hire ===");
+      log("");
+      log("Your new coordinator will hold all your vision, your roadmap, all your");
+      log("projects and everything you think about in business, life and beyond.");
+      log("They can call and hire new employees, executives, and coordinate");
+      log("your entire team. Engineers, marketers, specialists, all working");
+      log("in parallel while you focus on what matters.");
+      log("");
+      cooName = await promptForEmployeeName(
+        `Name your coordinator (default: ${DEFAULT_COORDINATOR_TEMPLATE_NAME}): `,
+        "EXE_COO_NAME",
+        DEFAULT_COORDINATOR_TEMPLATE_NAME
+      );
+      let employees = await loadEmployees(EMPLOYEES_PATH).catch(() => []);
+      if (!employees.some((e) => e.name === cooName)) {
+        const cooEmployee = {
+          name: cooName,
+          role: "COO",
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          templateName: DEFAULT_COORDINATOR_TEMPLATE_NAME,
+          templateVersion: 1
+        };
+        employees = addEmployee(employees, cooEmployee);
+        await saveEmployees(employees, EMPLOYEES_PATH);
+      }
+      const cooIdentityContent = getIdentityTemplate("coo");
+      if (cooIdentityContent) {
+        const cooIdPath = identityPath(cooName);
+        mkdirSync(path2.dirname(cooIdPath), { recursive: true });
+        const replaced = cooIdentityContent.replace(/agent_id:\s*exe/g, `agent_id: ${cooName}`).replace(/\$\{agent_id\}/g, cooName);
+        atomicWriteSync(cooIdPath, replaced);
+      }
+      registerBinSymlinks(cooName);
+      createdEmployees.push({ name: cooName, role: "COO" });
+      state.completedSteps.push(6);
+      saveSetupState(state);
+    } else {
+      log("Step 6 already complete \u2014 skipping.");
+      const roster = await loadEmployees(EMPLOYEES_PATH).catch(() => []);
+      const existingCoo = roster.find((e) => isCoordinatorRole(e.role));
+      if (existingCoo) cooName = existingCoo.name;
+    }
+    log("");
+    if (!state.completedSteps.includes(7)) {
+      let license;
+      try {
+        license = await checkLicense();
+      } catch {
+        license = { valid: true, plan: "free", email: "", expiresAt: null, deviceLimit: 1, employeeLimit: 2, memoryLimit: 1e3 };
+      }
+      let isLicensed = license.valid && license.plan !== "free";
+      if (!isLicensed) {
+        let licenseInput = await askOptional("Hire other employees with your Exe OS license key, or press Enter to continue as a free user (COO only): ", "EXE_LICENSE_KEY");
+        if (licenseInput && !licenseInput.startsWith("exe_sk_")) {
+          if (nonInteractive) {
+            log("EXE_LICENSE_KEY doesn't look like a license key (should start with exe_sk_). Skipping.");
+            licenseInput = "";
+          } else {
+            log("That doesn't look like a license key (should start with exe_sk_).");
+            licenseInput = await ask(rl, "Try again (or press Enter to skip): ", true);
+          }
+        }
+        if (licenseInput && licenseInput.startsWith("exe_sk_")) {
+          saveLicense(licenseInput);
+          mirrorLicenseKey(licenseInput);
+          try {
+            const result = await validateLicense(licenseInput);
+            if (result.valid && result.plan !== "free") {
+              isLicensed = true;
+              const planName = result.plan === "pro" ? "Solopreneur" : result.plan.charAt(0).toUpperCase() + result.plan.slice(1);
+              log(`License activated. Plan: ${planName}`);
+            } else if (!result.valid) {
+              log("That license key is invalid or expired.");
+              log("Get a new key at askexe.com.");
+            } else {
+              log("Key saved for cloud sync, but specialists require a paid plan.");
+              log("Upgrade at askexe.com when you're ready.");
+            }
+          } catch {
+            isLicensed = true;
+            log("Couldn't reach the license server \u2014 key saved, specialists enabled.");
+            log("  Your key will be re-validated when connected.");
+          }
+        }
+      }
+      if (!isLicensed) {
+        log("");
+        log("You're all set. You're starting in Phase 1: COO / Chief of Staff mode.");
+        log("Your COO will learn your company context first. You can unlock executives later anytime.");
+        log("When you're ready for specialists, add a license key at askexe.com.");
+        log("");
+        log(`Type your COO's launcher to start: ${cooName}1`);
+        state.completedSteps.push(7, 8);
+        saveSetupState(state);
+      } else {
+        state.completedSteps.push(7);
+        saveSetupState(state);
+      }
+    } else {
+      log("Step 7 already complete \u2014 skipping.");
+    }
+    if (!state.completedSteps.includes(8)) {
+      let employees = await loadEmployees(EMPLOYEES_PATH).catch(() => []);
+      log("=== Orchestration Phase ===");
+      log("");
+      log("Recommended default: Phase 1 \u2014 COO / Chief of Staff mode.");
+      log("Start with one-on-one conversations so your COO learns your company,");
+      log("vision, priorities, constraints, and operating style before delegating.");
+      log("");
+      log("You can jump ahead now if you want. This is a suggestion, not a blocker.");
+      log("");
+      log("  Phase 1: COO only \u2014 build company context first");
+      log("  Phase 2: Executive bench \u2014 add CTO/CMO for repeated domain work");
+      log("  Phase 3: Parallel org \u2014 specialists execute in parallel with reviews");
+      log("");
+      const unlockExecutives = (await askOrEnv("Unlock Phase 2 executives now? (y/N): ", void 0, "n")).toLowerCase() === "y";
+      const { setOrchestrationPhase } = await import("./orchestration-phase-EMDEZHIU.js");
+      if (!unlockExecutives) {
+        await setOrchestrationPhase("phase_1_coo", "setup-wizard");
+        log("");
+        log("Starting in Phase 1. Your executive templates are available when you're ready.");
+        log("Later: run `exe-os org unlock executives` to move to Phase 2.");
+        state.completedSteps.push(8);
+        saveSetupState(state);
+      } else {
+        await setOrchestrationPhase("phase_2_executives", "setup-wizard");
+        log("");
+        log("Phase 2 enabled. Let's name your executive bench.");
+        log("");
+        const ctoTemplate = getTemplateByRole("CTO");
+        const ctoDefault = ctoTemplate?.name ?? "cto";
+        log(`  CTO \u2014 engineering, architecture, code reviews (default: ${ctoDefault})`);
+        const cmoTemplate = getTemplateByRole("CMO");
+        const cmoDefault = cmoTemplate?.name ?? "cmo";
+        log(`  CMO \u2014 design, brand, content, marketing (default: ${cmoDefault})`);
+        log("");
+        const ctoName = await promptForEmployeeName(`Name your CTO (default: ${ctoDefault}): `, "EXE_CTO_NAME", ctoDefault);
+        if (!employees.some((e) => e.name === ctoName)) {
+          const ctoEmployee = {
+            name: ctoName,
+            role: "CTO",
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            templateName: ctoDefault,
+            templateVersion: 1
+          };
+          employees = addEmployee(employees, ctoEmployee);
+          await saveEmployees(employees, EMPLOYEES_PATH);
+        }
+        const ctoIdentityContent = getIdentityTemplate("cto");
+        if (ctoIdentityContent) {
+          const ctoIdPath = identityPath(ctoName);
+          mkdirSync(path2.dirname(ctoIdPath), { recursive: true });
+          const replaced = ctoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${ctoName}`).replace(/\$\{agent_id\}/g, ctoName);
+          atomicWriteSync(ctoIdPath, replaced);
+        }
+        registerBinSymlinks(ctoName);
+        createdEmployees.push({ name: ctoName, role: "CTO" });
+        log(`Created ${ctoName} (CTO)`);
+        const cmoName = await promptForEmployeeName(`Name your CMO (default: ${cmoDefault}): `, "EXE_CMO_NAME", cmoDefault);
+        if (!employees.some((e) => e.name === cmoName)) {
+          const cmoEmployee = {
+            name: cmoName,
+            role: "CMO",
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            templateName: cmoDefault,
+            templateVersion: 1
+          };
+          employees = addEmployee(employees, cmoEmployee);
+          await saveEmployees(employees, EMPLOYEES_PATH);
+        }
+        const cmoIdentityContent = getIdentityTemplate("cmo");
+        if (cmoIdentityContent) {
+          const cmoIdPath = identityPath(cmoName);
+          mkdirSync(path2.dirname(cmoIdPath), { recursive: true });
+          const replaced = cmoIdentityContent.replace(/agent_id:\s*\w+/g, `agent_id: ${cmoName}`).replace(/\$\{agent_id\}/g, cmoName);
+          atomicWriteSync(cmoIdPath, replaced);
+        }
+        registerBinSymlinks(cmoName);
+        createdEmployees.push({ name: cmoName, role: "CMO" });
+        log(`Created ${cmoName} (CMO)`);
+        log("");
+        state.completedSteps.push(8);
+        saveSetupState(state);
+      }
+    } else {
+      log("Step 8 already complete \u2014 skipping.");
+    }
+    let pathJustConfigured = false;
+    if (!pairingRosterPulled) {
+      try {
+        const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
+        const pkgRoot = findPackageRoot();
+        if (pkgRoot) {
+          const wrapResult = generateSessionWrappers(pkgRoot);
+          if (wrapResult.created > 0) {
+            log(`Session shortcuts generated (${cooName}1, ${cooName}2, ...)`);
+          }
+          if (wrapResult.pathConfigured) {
+            const binDir = path2.join(os.homedir(), ".exe-os", "bin");
+            process.env.PATH = `${binDir}:${process.env.PATH ?? ""}`;
+            pathJustConfigured = true;
+          }
+        }
+      } catch {
+      }
+    }
+    if (runInstaller) {
+      log("Installing Claude Code MCP, hooks, launchers, and daemon supervision...");
+      await runInstaller();
+    } else {
+      log("Skipping installer wiring (not provided). Run `exe-os claude install` to finish MCP + hooks setup.");
+    }
+    clearSetupState();
+    log("=== Getting Started ===");
+    log("");
+    log(`  cd into any project folder, then type \`${cooName}1\` to launch your COO.`);
+    log(`  Your COO manages the team \u2014 you talk to them, they coordinate everyone else.`);
+    log("");
+    let version = "";
+    const pkgRoot2 = findPackageRoot();
+    if (pkgRoot2) {
+      try {
+        version = JSON.parse(readFileSync(path2.join(pkgRoot2, "package.json"), "utf-8")).version;
+      } catch {
+      }
+    }
+    log("");
+    log("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588   \u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588");
+    log("  \u2588\u2588       \u2588\u2588 \u2588\u2588  \u2588\u2588        \u2588\u2588    \u2588\u2588 \u2588\u2588     ");
+    log("  \u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588     \u2588\u2588    \u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588");
+    log("  \u2588\u2588       \u2588\u2588 \u2588\u2588  \u2588\u2588        \u2588\u2588    \u2588\u2588      \u2588\u2588");
+    log("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588   \u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588");
+    if (version) log(`${"".padStart(18)}v${version}`);
+    log("");
+    const syncMode = cloudConfig ? "Exe Cloud (E2EE)" : "local-only";
+    let searchMode = "keyword + graph";
+    if (!skipModel) searchMode = "hybrid (vector + keyword + graph)";
+    const boxWidth = 49;
+    const row = (label, value) => {
+      const prefix = `  \u2502  ${label.padEnd(10)}`;
+      const available = boxWidth - 4 - label.padEnd(10).length;
+      const text = value.length > available ? `...${value.slice(-(available - 3))}` : value;
+      return `${prefix}${text.padEnd(available)}\u2502`;
+    };
+    log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
+    log("  \u2502  Setup Complete                                  \u2502");
+    log("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524");
+    log(row("Database", config.dbPath.replace(os.homedir(), "~")));
+    log(row("Sync", syncMode));
+    log(row("Encryption", "SQLCipher + AES-256-GCM"));
+    log(row("Search", searchMode));
+    if (createdEmployees.length > 0) {
+      log(`  \u2502  Team        ${createdEmployees.length} employee${createdEmployees.length > 1 ? "s" : ""}${" ".repeat(createdEmployees.length >= 10 ? 22 : 23)}\u2502`);
+    }
+    log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
+    if (createdEmployees.length > 0) {
+      log("");
+      const maxNameLen = Math.max(...createdEmployees.map((e) => e.name.length), 4);
+      for (const emp of createdEmployees) {
+        const badge = emp.name === cooName ? " \u2605" : "  ";
+        log(`  ${badge} ${emp.name.padEnd(maxNameLen)}  ${emp.role}`);
+      }
+    }
+    log("");
+    log("  Next: cd into a project folder, then run:");
+    log(`  $ ${cooName}1`);
+    if (pathJustConfigured) {
+      const shell = process.env.SHELL ?? "/bin/zsh";
+      const rcFile = shell.includes("bash") ? "~/.bashrc" : "~/.zshrc";
+      log("");
+      log(`  (Run \`source ${rcFile}\` first, or open a new terminal)`);
+    }
+    log("");
+    process.removeListener("SIGINT", sigintHandler);
+  } finally {
+    rl.close();
+  }
+}
+
+export {
+  validateModel,
+  runSetupWizard
+};