@beastmode-develeap/beastmode 0.1.145 → 0.1.147

package/dist/index.js

@@ -4343,7 +4343,7 @@ You are currently scoped to project "${scope}". Focus your answers on this proje
   async function runViaCli(session, content, scope = "factory") {
     session.busy = true;
     try {
-      const { spawn } = await import("child_process");
+      const { spawn: spawn3 } = await import("child_process");
       let boardContext = "";
       try {
         const boardUrl = getBoardUrl(session.factoryPath);
@@ -4435,7 +4435,7 @@ Respond concisely. Continue the conversation naturally.`;
         spawnCmd = "claude";
         spawnArgs = claudeArgs;
       }
-      const child = spawn(spawnCmd, spawnArgs, {
+      const child = spawn3(spawnCmd, spawnArgs, {
         cwd: session.factoryPath,
         env: {
           ...process.env,
@@ -6959,28 +6959,214 @@ var init_server = __esm({
   }
 });
 
+// src/cli/commands/board.ts
+import { Command } from "commander";
+import { resolve as resolve5, join as join15 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync14, mkdirSync as mkdirSync12, writeFileSync as writeFileSync13, readdirSync as readdirSync7 } from "fs";
+import { execSync as execSync4 } from "child_process";
+function findFactoryDir(startDir) {
+  let dir = startDir || process.cwd();
+  const root = resolve5("/");
+  while (dir !== root) {
+    if (existsSync17(join15(dir, ".beastmode", "factory.json"))) {
+      return dir;
+    }
+    const parent = resolve5(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  if (existsSync17(join15(dir, ".beastmode", "factory.json"))) {
+    return dir;
+  }
+  return null;
+}
+function inferProjectName(factoryDir) {
+  const projectsDir = join15(factoryDir, ".beastmode", "projects");
+  if (!existsSync17(projectsDir)) return null;
+  const files = readdirSync7(projectsDir).filter((f) => f.endsWith(".json"));
+  if (files.length === 1) return files[0].replace(/\.json$/, "");
+  return null;
+}
+function tryExecSync(cmd, timeoutMs = 15e3) {
+  try {
+    return execSync4(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs }).trim();
+  } catch {
+    return null;
+  }
+}
+async function setItemStatus(itemId, status, opts) {
+  if (!itemId || !/^\d+$/.test(itemId)) {
+    throw new Error(`Invalid item_id: ${itemId} (expected numeric id)`);
+  }
+  const trimmedStatus = status.trim();
+  if (!trimmedStatus) {
+    throw new Error("status cannot be empty");
+  }
+  let project = opts.project;
+  if (!project) {
+    const factoryDir = findFactoryDir();
+    if (!factoryDir) {
+      throw new Error("No .beastmode factory found in cwd tree. Pass --project <name> explicitly.");
+    }
+    const inferred = inferProjectName(factoryDir);
+    if (!inferred) {
+      throw new Error(
+        "Could not determine project name from factory (0 or >1 projects configured). Pass --project <name>."
+      );
+    }
+    project = inferred;
+  }
+  const payload = JSON.stringify({ status: trimmedStatus });
+  if (opts.boardUrl) {
+    const url2 = `${opts.boardUrl.replace(/\/+$/, "")}/api/items/${itemId}?board=${encodeURIComponent(project)}`;
+    const cmd2 = `curl -sS -X PATCH '${url2}' -H 'Content-Type: application/json' -d '${payload.replace(/'/g, "'\\''")}'`;
+    const out2 = tryExecSync(cmd2);
+    if (!out2) throw new Error(`curl failed hitting ${url2}`);
+    info(out2);
+    return;
+  }
+  const container = tryExecSync(`docker ps --filter 'label=com.docker.compose.service=daemon' --format '{{.Names}}' | head -n1`) || tryExecSync(`docker ps --filter 'label=com.docker.compose.service=ui' --format '{{.Names}}' | head -n1`);
+  if (!container) {
+    throw new Error(
+      "No running daemon or ui container found. Start the factory with `docker compose up -d`, or pass --board-url."
+    );
+  }
+  const escapedPayload = payload.replace(/'/g, "'\\''");
+  const url = `http://board:8080/api/items/${itemId}?board=${encodeURIComponent(project)}`;
+  const cmd = `docker exec ${container} curl -sS -X PATCH '${url}' -H 'Content-Type: application/json' -d '${escapedPayload}'`;
+  const out = tryExecSync(cmd);
+  if (!out) {
+    throw new Error(`docker exec curl failed hitting ${url} via ${container}`);
+  }
+  try {
+    const parsed = JSON.parse(out);
+    if (parsed.detail) {
+      throw new Error(`Board rejected update: ${parsed.detail}`);
+    }
+    if (parsed.id && parsed.status) {
+      info(`Item ${parsed.id} \u2192 ${parsed.status} (project=${project})`);
+      return;
+    }
+  } catch (e) {
+    if (e instanceof Error && e.message.startsWith("Board rejected update:")) throw e;
+  }
+  info(out);
+}
+async function runBoard(opts) {
+  let factoryDir = findFactoryDir();
+  if (!factoryDir) {
+    factoryDir = process.cwd();
+    const bmDir = join15(factoryDir, ".beastmode");
+    if (!existsSync17(bmDir)) {
+      mkdirSync12(bmDir, { recursive: true });
+    }
+    const factoryJsonPath2 = join15(bmDir, "factory.json");
+    if (!existsSync17(factoryJsonPath2)) {
+      writeFileSync13(
+        factoryJsonPath2,
+        JSON.stringify({ factory_name: "BeastMode", created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
+        "utf-8"
+      );
+      info("No factory found \u2014 created minimal stub at .beastmode/factory.json");
+    }
+  }
+  const factoryJsonPath = join15(factoryDir, ".beastmode", "factory.json");
+  const factoryJson = JSON.parse(readFileSync14(factoryJsonPath, "utf-8"));
+  const factoryName = factoryJson.factory_name || "BeastMode Factory";
+  header(`BeastMode Board \u2014 ${factoryName}`);
+  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
+  const port = parseInt(opts.port, 10) || 7669;
+  const uiServer = await startServer2({
+    port,
+    host: opts.host,
+    factoryName,
+    factoryPath: factoryDir,
+    mode: "board"
+  });
+  info(`Board running at ${uiServer.url}/board`);
+  info("Press Ctrl+C to stop.\n");
+  const skipOpen = process.env.BEASTMODE_NO_OPEN === "1" || !!process.env.DOCKER_CONTAINER;
+  if (!skipOpen) {
+    try {
+      const open = (await import("open")).default;
+      await open(`${uiServer.url}/board`);
+    } catch {
+      info(`Open ${uiServer.url}/board in your browser.`);
+    }
+  } else {
+    info(`Open ${uiServer.url}/board in your browser.`);
+  }
+  await new Promise((resolvePromise) => {
+    uiServer.server.on("close", resolvePromise);
+    process.on("SIGINT", async () => {
+      info("\nShutting down board server...");
+      await uiServer.shutdown();
+      resolvePromise();
+    });
+  });
+}
+var boardCommand;
+var init_board = __esm({
+  "src/cli/commands/board.ts"() {
+    "use strict";
+    init_display();
+    boardCommand = new Command("board").description("Launch the BeastMode Board web UI").option("--port <number>", "Port to serve on", "7669").option("--host <host>", "Host to bind to (use 0.0.0.0 for external access)", "127.0.0.1").action(async (opts) => {
+      try {
+        await runBoard(opts);
+      } catch (err) {
+        error(err.message);
+        process.exit(1);
+      }
+    });
+    boardCommand.command("set-status <item_id> <status>").description(
+      "Safely change a board item's status via the board HTTP API (never sqlite3 against the live DB \u2014 Gap 24)"
+    ).option("--project <name>", "Project/board name (defaults to the factory's only project, or errors if ambiguous)").option("--board-url <url>", "Override board HTTP URL (default: use running board container via docker exec)").action(async (itemId, status, opts) => {
+      try {
+        await setItemStatus(itemId, status, opts);
+      } catch (err) {
+        error(err.message);
+        process.exit(1);
+      }
+    });
+  }
+});
+
 // src/cli/commands/sync-claude-creds.ts
 var sync_claude_creds_exports = {};
 __export(sync_claude_creds_exports, {
   installAgent: () => installAgent,
+  installAgentLinux: () => installAgentLinux,
   readKeychainTokenSafe: () => readKeychainTokenSafe,
   syncClaudeCredsCommand: () => syncClaudeCredsCommand,
+  syncClaudeCredsLinux: () => syncClaudeCredsLinux,
   syncClaudeCredsOnce: () => syncClaudeCredsOnce
 });
-import { Command } from "commander";
-import { execSync as execSync4, spawnSync as spawnSync2 } from "child_process";
-import { writeFileSync as writeFileSync13, chmodSync, mkdirSync as mkdirSync12, existsSync as existsSync17, unlinkSync as unlinkSync4 } from "fs";
-import { join as join15 } from "path";
+import { Command as Command2 } from "commander";
+import { execSync as execSync5, spawnSync as spawnSync2 } from "child_process";
+import { writeFileSync as writeFileSync14, readFileSync as readFileSync15, chmodSync, mkdirSync as mkdirSync13, existsSync as existsSync18, unlinkSync as unlinkSync4 } from "fs";
+import { join as join16 } from "path";
 import { homedir as homedir2, platform } from "os";
+function systemdUserDir() {
+  return join16(homedir2(), ".config", "systemd", "user");
+}
+function systemdServicePath() {
+  return join16(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.service`);
+}
+function systemdTimerPath() {
+  return join16(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.timer`);
+}
+function linuxCredsPath() {
+  return join16(homedir2(), ".claude", ".credentials.json");
+}
 function plistPath() {
-  return join15(homedir2(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`);
+  return join16(homedir2(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`);
 }
 function agentLogPath() {
-  return join15(homedir2(), ".beastmode", "logs", "sync-claude-creds.log");
+  return join16(homedir2(), ".beastmode", "logs", "sync-claude-creds.log");
 }
 function readKeychainTokenSafe() {
   try {
-    return execSync4(
+    return execSync5(
       `security find-generic-password -s "Claude Code-credentials" -w`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -7008,10 +7194,10 @@ function writeCredentialsFile(rawJson) {
   if (!oauth?.accessToken) {
     throw new Error("Keychain entry missing claudeAiOauth.accessToken. Fix: run `claude login` again to reset the credential.");
   }
-  const claudeDir = join15(homedir2(), ".claude");
-  if (!existsSync17(claudeDir)) mkdirSync12(claudeDir, { recursive: true });
-  const credsPath = join15(claudeDir, ".credentials.json");
-  writeFileSync13(credsPath, rawJson + "\n", "utf-8");
+  const claudeDir = join16(homedir2(), ".claude");
+  if (!existsSync18(claudeDir)) mkdirSync13(claudeDir, { recursive: true });
+  const credsPath = join16(claudeDir, ".credentials.json");
+  writeFileSync14(credsPath, rawJson + "\n", "utf-8");
   chmodSync(credsPath, 384);
   if (oauth.expiresAt) {
     const hoursLeft = Math.round((oauth.expiresAt - Date.now()) / 36e5);
@@ -7023,10 +7209,31 @@ function writeCredentialsFile(rawJson) {
   }
   return credsPath;
 }
-function buildPlist(intervalSeconds) {
+function urgencyMarkerHostPath(factoryDir) {
+  return join16(factoryDir, "daemon", "logs", ".cred-refresh-needed");
+}
+function removeUrgencyMarker(factoryDir) {
+  if (!factoryDir) return;
+  const markerPath = urgencyMarkerHostPath(factoryDir);
+  try {
+    unlinkSync4(markerPath);
+  } catch {
+  }
+}
+function buildPlist(intervalSeconds, factoryDir) {
   const nodePath = process.execPath;
   const cliEntry = process.argv[1];
   const logPath = agentLogPath();
+  const keychainPath = join16(homedir2(), "Library", "Keychains", "login.keychain-db");
+  const watchPaths = [keychainPath];
+  if (factoryDir) {
+    watchPaths.push(urgencyMarkerHostPath(factoryDir));
+  }
+  const watchPathsXml = `    <key>WatchPaths</key>
+    <array>
+${watchPaths.map((p) => `        <string>${p}</string>`).join("\n")}
+    </array>
+`;
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -7043,7 +7250,7 @@ function buildPlist(intervalSeconds) {
     <integer>${intervalSeconds}</integer>
     <key>RunAtLoad</key>
     <true/>
-    <key>StandardOutPath</key>
+${watchPathsXml}    <key>StandardOutPath</key>
     <string>${logPath}</string>
     <key>StandardErrorPath</key>
     <string>${logPath}</string>
@@ -7051,17 +7258,21 @@ function buildPlist(intervalSeconds) {
 </plist>
 `;
 }
-function installAgent(intervalSeconds, { throwOnError = false } = {}) {
+function installAgent(intervalSeconds, {
+  throwOnError = false,
+  factoryDir
+} = {}) {
   const plist = plistPath();
   const logPath = agentLogPath();
-  mkdirSync12(join15(homedir2(), "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync12(join15(homedir2(), ".beastmode", "logs"), { recursive: true });
+  mkdirSync13(join16(homedir2(), "Library", "LaunchAgents"), { recursive: true });
+  mkdirSync13(join16(homedir2(), ".beastmode", "logs"), { recursive: true });
   const uid = process.getuid?.();
-  if (existsSync17(plist)) {
+  if (existsSync18(plist)) {
     spawnSync2("launchctl", ["bootout", `gui/${uid}`, plist], { stdio: "pipe" });
   }
-  writeFileSync13(plist, buildPlist(intervalSeconds), "utf-8");
-  writeFileSync13(logPath, "", { flag: "a" });
+  const resolvedFactory = factoryDir ?? findFactoryDir() ?? void 0;
+  writeFileSync14(plist, buildPlist(intervalSeconds, resolvedFactory), "utf-8");
+  writeFileSync14(logPath, "", { flag: "a" });
   const result = spawnSync2("launchctl", ["bootstrap", `gui/${uid}`, plist], {
     stdio: "pipe",
     encoding: "utf-8"
@@ -7080,7 +7291,7 @@ function installAgent(intervalSeconds, { throwOnError = false } = {}) {
   info(`  Plist:    ${plist}`);
   info(`  Interval: every ${Math.round(intervalSeconds / 60)} minutes`);
   info(`  Logs:     ${logPath}`);
-  info(`  Runs at:  load + every ${Math.round(intervalSeconds / 60)}min (while you're logged in)`);
+  info(`  Triggers: load + every ${Math.round(intervalSeconds / 60)}min + Keychain change`);
   console.log();
   info("The agent also runs once right now (RunAtLoad=true) \u2014 credentials synced.");
 }
@@ -7099,7 +7310,7 @@ function syncClaudeCredsOnce() {
 function uninstallAgent() {
   const plist = plistPath();
   const uid = process.getuid?.();
-  if (!existsSync17(plist)) {
+  if (!existsSync18(plist)) {
     info("No LaunchAgent installed \u2014 nothing to remove.");
     return;
   }
@@ -7119,7 +7330,7 @@ function uninstallAgent() {
 function showStatus() {
   const plist = plistPath();
   const uid = process.getuid?.();
-  if (!existsSync17(plist)) {
+  if (!existsSync18(plist)) {
     info("LaunchAgent not installed.");
     info("Install with: beastmode sync-claude-creds --install");
     return;
@@ -7141,18 +7352,257 @@ function showStatus() {
     warn(`Plist exists but agent not loaded. Re-install with: beastmode sync-claude-creds --install`);
   }
 }
-var LAUNCH_AGENT_LABEL, syncClaudeCredsCommand;
+function syncClaudeCredsLinux() {
+  const credsPath = linuxCredsPath();
+  if (!existsSync18(credsPath)) {
+    return {
+      error: `${credsPath} not found \u2014 run \`claude login\` first`
+    };
+  }
+  let parsed;
+  try {
+    const raw = readFileSync15(credsPath, "utf-8");
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      error: `${credsPath} exists but is not valid JSON \u2014 run \`claude login\` to reset`
+    };
+  }
+  const oauth = parsed.claudeAiOauth;
+  if (!oauth?.accessToken) {
+    return {
+      error: `${credsPath} missing claudeAiOauth.accessToken \u2014 run \`claude login\``
+    };
+  }
+  if (oauth.expiresAt) {
+    const minutesLeft = (oauth.expiresAt - Date.now()) / 6e4;
+    if (minutesLeft < 60) {
+      info(
+        `Token expiring in ${Math.round(minutesLeft)}min \u2014 triggering refresh via \`claude --print ping\`...`
+      );
+      const result = spawnSync2("claude", ["--print", "ping"], {
+        stdio: "pipe",
+        timeout: 15e3
+      });
+      if (result.status !== 0) {
+        warn(
+          `claude --print ping failed (exit ${result.status ?? "?"}) \u2014 token may still be valid`
+        );
+      }
+      try {
+        const raw2 = readFileSync15(credsPath, "utf-8");
+        const parsed2 = JSON.parse(raw2);
+        if (parsed2.claudeAiOauth?.expiresAt) {
+          const newMinutes = (parsed2.claudeAiOauth.expiresAt - Date.now()) / 6e4;
+          info(`Token now valid for ${Math.round(newMinutes)} more minutes`);
+        }
+      } catch {
+      }
+    }
+  }
+  return { path: credsPath };
+}
+function buildServiceUnit(nodePath, cliEntry, logPath) {
+  return `[Unit]
+Description=BeastMode Claude credential sync
+
+[Service]
+Type=oneshot
+ExecStart=${nodePath} ${cliEntry} sync-claude-creds
+StandardOutput=append:${logPath}
+StandardError=append:${logPath}
+`;
+}
+function buildTimerUnit(intervalSeconds) {
+  return `[Unit]
+Description=BeastMode Claude credential sync timer
+
+[Timer]
+OnBootSec=30s
+OnUnitActiveSec=${intervalSeconds}s
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+`;
+}
+function ensureSystemctlAvailable() {
+  const result = spawnSync2("systemctl", ["--version"], {
+    stdio: "pipe",
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    return "systemctl not available \u2014 systemd user units not supported on this system";
+  }
+  return null;
+}
+function installAgentLinux(intervalSeconds, { throwOnError = false } = {}) {
+  const unavail = ensureSystemctlAvailable();
+  if (unavail) {
+    if (throwOnError) throw new Error(unavail);
+    error(unavail);
+    process.exit(1);
+  }
+  const unitDir = systemdUserDir();
+  const logDir = join16(homedir2(), ".beastmode", "logs");
+  mkdirSync13(unitDir, { recursive: true });
+  mkdirSync13(logDir, { recursive: true });
+  const logPath = join16(logDir, "sync-claude-creds.log");
+  const nodePath = process.execPath;
+  const cliEntry = process.argv[1];
+  writeFileSync14(
+    systemdServicePath(),
+    buildServiceUnit(nodePath, cliEntry, logPath),
+    "utf-8"
+  );
+  writeFileSync14(
+    systemdTimerPath(),
+    buildTimerUnit(intervalSeconds),
+    "utf-8"
+  );
+  const reload = spawnSync2("systemctl", ["--user", "daemon-reload"], {
+    stdio: "pipe",
+    encoding: "utf-8"
+  });
+  if (reload.status !== 0) {
+    const msg = `systemctl --user daemon-reload failed: ${reload.stderr || reload.stdout}`;
+    if (throwOnError) throw new Error(msg);
+    error(msg);
+    process.exit(1);
+  }
+  const enable = spawnSync2(
+    "systemctl",
+    ["--user", "enable", "--now", `${SYSTEMD_UNIT_NAME}.timer`],
+    { stdio: "pipe", encoding: "utf-8" }
+  );
+  if (enable.status !== 0) {
+    const msg = `systemctl --user enable --now failed: ${enable.stderr || enable.stdout}`;
+    if (throwOnError) throw new Error(msg);
+    error(msg);
+    info(`Service: ${systemdServicePath()}`);
+    info(`Timer:   ${systemdTimerPath()}`);
+    process.exit(1);
+  }
+  success(`Systemd timer installed: ${SYSTEMD_UNIT_NAME}.timer`);
+  info(`  Service:  ${systemdServicePath()}`);
+  info(`  Timer:    ${systemdTimerPath()}`);
+  info(`  Interval: every ${Math.round(intervalSeconds / 60)} minutes`);
+  info(`  Logs:     ${logPath}`);
+}
+function uninstallAgentLinux() {
+  const unavail = ensureSystemctlAvailable();
+  if (unavail) {
+    error(unavail);
+    process.exit(1);
+  }
+  spawnSync2("systemctl", ["--user", "stop", `${SYSTEMD_UNIT_NAME}.timer`], {
+    stdio: "pipe"
+  });
+  spawnSync2(
+    "systemctl",
+    ["--user", "disable", `${SYSTEMD_UNIT_NAME}.timer`],
+    { stdio: "pipe" }
+  );
+  const servicePath = systemdServicePath();
+  const timerPath = systemdTimerPath();
+  let removed = false;
+  if (existsSync18(servicePath)) {
+    try {
+      unlinkSync4(servicePath);
+      removed = true;
+    } catch {
+    }
+  }
+  if (existsSync18(timerPath)) {
+    try {
+      unlinkSync4(timerPath);
+      removed = true;
+    } catch {
+    }
+  }
+  spawnSync2("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+  if (removed) {
+    success(`Systemd timer uninstalled: ${SYSTEMD_UNIT_NAME}.timer`);
+  } else {
+    info("No systemd unit files found \u2014 nothing to remove.");
+  }
+}
+function statusAgentLinux() {
+  const unavail = ensureSystemctlAvailable();
+  if (unavail) {
+    error(unavail);
+    return;
+  }
+  if (!existsSync18(systemdTimerPath())) {
+    info("Systemd timer not installed.");
+    info("Install with: beastmode sync-claude-creds --install");
+    return;
+  }
+  const isActive = spawnSync2(
+    "systemctl",
+    ["--user", "is-active", `${SYSTEMD_UNIT_NAME}.timer`],
+    { stdio: "pipe", encoding: "utf-8" }
+  );
+  const active = (isActive.stdout || "").trim();
+  if (active === "active") {
+    success(`Systemd timer active: ${SYSTEMD_UNIT_NAME}.timer`);
+  } else {
+    warn(`Systemd timer not active (state: ${active || "unknown"})`);
+  }
+  const show = spawnSync2(
+    "systemctl",
+    [
+      "--user",
+      "show",
+      `${SYSTEMD_UNIT_NAME}.service`,
+      "--property=ExecMainStartTimestamp,ExecMainStatus"
+    ],
+    { stdio: "pipe", encoding: "utf-8" }
+  );
+  if (show.status === 0 && show.stdout) {
+    for (const line of show.stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed) info(`  ${trimmed}`);
+    }
+  }
+  info(`  Service:  ${systemdServicePath()}`);
+  info(`  Timer:    ${systemdTimerPath()}`);
+}
+function restartAgentLinux() {
+  const unavail = ensureSystemctlAvailable();
+  if (unavail) {
+    error(unavail);
+    process.exit(1);
+  }
+  const result = spawnSync2(
+    "systemctl",
+    ["--user", "restart", `${SYSTEMD_UNIT_NAME}.timer`],
+    { stdio: "pipe", encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    error(
+      `systemctl --user restart failed: ${result.stderr || result.stdout}`
+    );
+    process.exit(1);
+  }
+  success(`Restarted: ${SYSTEMD_UNIT_NAME}.timer`);
+}
+var LAUNCH_AGENT_LABEL, SYSTEMD_UNIT_NAME, syncClaudeCredsCommand;
 var init_sync_claude_creds = __esm({
   "src/cli/commands/sync-claude-creds.ts"() {
     "use strict";
     init_display();
+    init_board();
     LAUNCH_AGENT_LABEL = "com.develeap.beastmode.claude-creds";
-    syncClaudeCredsCommand = new Command("sync-claude-creds").description(
-      "Sync Claude Code credentials from macOS Keychain to ~/.claude/.credentials.json (for Docker)"
-    ).option("--restart", "Restart the daemon container after syncing (one-shot only)").option("--install", "Install a launchd agent that re-syncs every 30 minutes").option("--uninstall", "Remove the launchd agent").option("--status", "Show launchd agent status").option("--interval <seconds>", "Sync interval for --install (default: 1800)", "1800").action(async (opts) => {
-      if (platform() !== "darwin") {
-        info("Not macOS \u2014 Docker mounts ~/.claude/.credentials.json directly. Nothing to sync.");
-        return;
+    SYSTEMD_UNIT_NAME = "beastmode-claude-creds";
+    syncClaudeCredsCommand = new Command2("sync-claude-creds").description(
+      "Sync/validate Claude credentials for Docker (macOS: extract from Keychain; Linux: validate ~/.claude/.credentials.json + refresh)"
+    ).option("--restart", "Restart the daemon container after syncing (one-shot only)").option("--install", "Install a watcher (launchd on macOS, systemd user timer on Linux) that re-syncs periodically").option("--uninstall", "Remove the watcher").option("--status", "Show watcher status").option("--interval <seconds>", "Sync interval for --install (default: 1800)", "1800").action(async (opts) => {
+      const plat = platform();
+      if (plat !== "darwin" && plat !== "linux") {
+        error(`Unsupported platform: ${plat}`);
+        info("Supported: macOS (darwin), Linux");
+        process.exit(1);
       }
       if (opts.install) {
         header("Install Claude Credential Sync Agent");
@@ -7162,45 +7612,78 @@ var init_sync_claude_creds = __esm({
           error(`Invalid --interval: ${opts.interval} (minimum 60 seconds)`);
           process.exit(1);
         }
-        installAgent(seconds);
+        if (plat === "darwin") {
+          installAgent(seconds);
+        } else {
+          installAgentLinux(seconds);
+        }
         return;
       }
       if (opts.uninstall) {
         header("Remove Claude Credential Sync Agent");
         console.log();
-        uninstallAgent();
+        if (plat === "darwin") {
+          uninstallAgent();
+        } else {
+          uninstallAgentLinux();
+        }
         return;
       }
       if (opts.status) {
         header("Claude Credential Sync Agent Status");
         console.log();
-        showStatus();
+        if (plat === "darwin") {
+          showStatus();
+        } else {
+          statusAgentLinux();
+        }
         return;
       }
-      header("Sync Claude Code Credentials");
-      console.log();
-      const rawJson = readKeychainToken();
-      let credsPath;
-      try {
-        credsPath = writeCredentialsFile(rawJson);
-      } catch (e) {
-        error(e instanceof Error ? e.message : String(e));
-        process.exit(1);
+      if (opts.restart && plat === "linux") {
+        header("Restart Claude Credential Sync Timer");
+        console.log();
+        restartAgentLinux();
+        return;
       }
-      success(`Wrote ${credsPath}`);
-      if (opts.restart) {
+      if (plat === "darwin") {
+        header("Sync Claude Code Credentials");
         console.log();
-        info("Restarting daemon container...");
-        const result = spawnSync2("docker", ["compose", "restart", "daemon"], { stdio: "inherit" });
-        if (result.status !== 0) {
-          warn("docker compose restart daemon failed \u2014 run it manually.");
-          process.exit(result.status ?? 1);
+        const rawJson = readKeychainToken();
+        let credsPath;
+        try {
+          credsPath = writeCredentialsFile(rawJson);
+        } catch (e) {
+          error(e instanceof Error ? e.message : String(e));
+          process.exit(1);
         }
-        success("Daemon restarted.");
-      } else {
-        console.log();
-        info("Automate: beastmode sync-claude-creds --install");
+        success(`Wrote ${credsPath}`);
+        removeUrgencyMarker(findFactoryDir() ?? void 0);
+        if (opts.restart) {
+          console.log();
+          info("Restarting daemon container...");
+          const result2 = spawnSync2("docker", ["compose", "restart", "daemon"], { stdio: "inherit" });
+          if (result2.status !== 0) {
+            warn("docker compose restart daemon failed \u2014 run it manually.");
+            process.exit(result2.status ?? 1);
+          }
+          success("Daemon restarted.");
+        } else {
+          console.log();
+          info("Automate: beastmode sync-claude-creds --install");
+        }
+        return;
       }
+      header("Validate Claude Credentials");
+      console.log();
+      const result = syncClaudeCredsLinux();
+      if ("error" in result) {
+        error(result.error);
+        process.exit(1);
+      }
+      success(`Credentials valid: ${result.path}`);
+      removeUrgencyMarker(findFactoryDir() ?? void 0);
+      console.log();
+      info("Automate: beastmode sync-claude-creds --install");
     });
   }
 });
@@ -7209,13 +7692,13 @@ var init_sync_claude_creds = __esm({
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
-import { readFileSync as readFileSync27, writeFileSync as writeFileSync24, existsSync as existsSync31, readdirSync as readdirSync11, mkdirSync as mkdirSync19 } from "fs";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync24, existsSync as existsSync31, readdirSync as readdirSync11, mkdirSync as mkdirSync19 } from "fs";
 import { join as join29, resolve as resolve18, basename as basename5 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function readJsonFile2(filePath) {
   if (!existsSync31(filePath)) return null;
   try {
-    return JSON.parse(readFileSync27(filePath, "utf-8"));
+    return JSON.parse(readFileSync28(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -7242,7 +7725,7 @@ function getFactoryPath() {
 function readFactoryStatus(factoryDir) {
   const bmDir = join29(factoryDir, ".beastmode");
   const factoryIdentity = FactoryIdentitySchema.parse(
-    JSON.parse(readFileSync27(join29(bmDir, "factory.json"), "utf-8"))
+    JSON.parse(readFileSync28(join29(bmDir, "factory.json"), "utf-8"))
   );
   const projectsDir = join29(bmDir, "projects");
   const projectCount = existsSync31(projectsDir) ? readdirSync11(projectsDir).filter((f) => f.endsWith(".json")).length : 0;
@@ -7250,7 +7733,7 @@ function readFactoryStatus(factoryDir) {
   let pluginNames = [];
   if (existsSync31(lockPath)) {
     try {
-      const lock = JSON.parse(readFileSync27(lockPath, "utf-8"));
+      const lock = JSON.parse(readFileSync28(lockPath, "utf-8"));
       pluginNames = Object.keys(lock.plugins || {});
     } catch {
     }
@@ -7286,7 +7769,7 @@ function readFactoryStatus(factoryDir) {
   let pidAlive = false;
   if (existsSync31(pidFile)) {
     try {
-      daemonPid = parseInt(readFileSync27(pidFile, "utf-8").trim(), 10);
+      daemonPid = parseInt(readFileSync28(pidFile, "utf-8").trim(), 10);
       process.kill(daemonPid, 0);
       pidAlive = true;
     } catch {
@@ -7310,7 +7793,7 @@ function readBoardItems(factoryDir) {
   const filePath = join29(factoryDir, ".beastmode", "board.json");
   if (!existsSync31(filePath)) return [];
   try {
-    const raw = JSON.parse(readFileSync27(filePath, "utf-8"));
+    const raw = JSON.parse(readFileSync28(filePath, "utf-8"));
     return Array.isArray(raw.items) ? raw.items : [];
   } catch {
     return [];
@@ -7342,7 +7825,7 @@ function createMcpServer() {
     async ({ key_path }) => {
       const factoryDir = getFactoryPath();
       const configPath = join29(factoryDir, ".beastmode", "config.json");
-      const config = existsSync31(configPath) ? JSON.parse(readFileSync27(configPath, "utf-8")) : generateDefaults();
+      const config = existsSync31(configPath) ? JSON.parse(readFileSync28(configPath, "utf-8")) : generateDefaults();
       try {
         const value = configGet(config, key_path);
         return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
@@ -7361,7 +7844,7 @@ function createMcpServer() {
     async ({ key_path, value }) => {
       const factoryDir = getFactoryPath();
       const configPath = join29(factoryDir, ".beastmode", "config.json");
-      const config = existsSync31(configPath) ? JSON.parse(readFileSync27(configPath, "utf-8")) : generateDefaults();
+      const config = existsSync31(configPath) ? JSON.parse(readFileSync28(configPath, "utf-8")) : generateDefaults();
       const coerced = coerceValue(value);
       const updated = configSet(config, key_path, coerced);
       writeFileSync24(configPath, JSON.stringify(updated, null, 2) + "\n", "utf-8");
@@ -7480,7 +7963,7 @@ function createMcpServer() {
       const lockPath = join29(bmDir, "extensions.lock");
       if (existsSync31(lockPath)) {
         try {
-          const lock = JSON.parse(readFileSync27(lockPath, "utf-8"));
+          const lock = JSON.parse(readFileSync28(lockPath, "utf-8"));
           plugins = lock.plugins || {};
         } catch {
         }
@@ -7520,7 +8003,7 @@ function createMcpServer() {
       }
       const projects = readdirSync11(projectsDir).filter((f) => f.endsWith(".json")).map((f) => {
         try {
-          return JSON.parse(readFileSync27(join29(projectsDir, f), "utf-8"));
+          return JSON.parse(readFileSync28(join29(projectsDir, f), "utf-8"));
         } catch {
           return null;
         }
@@ -7658,15 +8141,15 @@ var init_mcp = __esm({
 });
 
 // src/index.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/cli/commands/init.ts
 init_engine();
 init_file_writer();
-import { Command as Command2 } from "commander";
+import { Command as Command3 } from "commander";
 import inquirer from "inquirer";
-import { resolve as resolve5, basename as basename4, join as join16 } from "path";
-import { existsSync as existsSync18, writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve6, basename as basename4, join as join17 } from "path";
+import { existsSync as existsSync19, writeFileSync as writeFileSync15, mkdirSync as mkdirSync14, readFileSync as readFileSync16 } from "fs";
 
 // src/cli/utils/docker.ts
 import { existsSync as existsSync9 } from "fs";
@@ -7887,7 +8370,7 @@ function generateComposeYaml(tag) {
 
 // src/cli/commands/init.ts
 init_display();
-var initCommand = new Command2("init").description("Create a new BeastMode factory").argument("[name]", "Factory name (default: current directory name)").option("--project <path>", "Path to target project").option("--preset <preset>", "Pipeline preset (full, lean, prototype, infra, docs)").option("--backend <backend>", "Task backend (beastmode-board, github-issues)").option("--deploy <target>", "Deploy target (pr-only, vercel, aws-ecs, ...)").option("--methodology <name>", "Development methodology plugin").option("--plugin <name>", "Install plugin (repeatable)", collect, []).option("--from <template>", "Import config from template file").option("--ui", "Open web wizard instead of CLI").option("--yes", "Accept all defaults (non-interactive)").option(
+var initCommand = new Command3("init").description("Create a new BeastMode factory").argument("[name]", "Factory name (default: current directory name)").option("--project <path>", "Path to target project").option("--preset <preset>", "Pipeline preset (full, lean, prototype, infra, docs)").option("--backend <backend>", "Task backend (beastmode-board, github-issues)").option("--deploy <target>", "Deploy target (pr-only, vercel, aws-ecs, ...)").option("--methodology <name>", "Development methodology plugin").option("--plugin <name>", "Install plugin (repeatable)", collect, []).option("--from <template>", "Import config from template file").option("--ui", "Open web wizard instead of CLI").option("--yes", "Accept all defaults (non-interactive)").option(
   "--project-github-token <token>",
   "GitHub PAT for the daemon's project operations (commit/push/PR/merge against PROJECT_DIR's git remote \u2014 needs `repo` scope). Alias for the legacy --github-token flag."
 ).option(
@@ -7918,16 +8401,16 @@ function collect(val, acc) {
   return acc;
 }
 function readSecretFile(filePath) {
-  return readFileSync14(resolve5(filePath), "utf-8").trim();
+  return readFileSync16(resolve6(filePath), "utf-8").trim();
 }
 function isSourceRepo(dir) {
-  return existsSync18(resolve5(dir, "daemon")) && existsSync18(resolve5(dir, "board")) && existsSync18(resolve5(dir, "cli"));
+  return existsSync19(resolve6(dir, "daemon")) && existsSync19(resolve6(dir, "board")) && existsSync19(resolve6(dir, "cli"));
 }
 async function runInit(name, opts) {
   if (opts.ui) {
     const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
-    const factoryName2 = name || basename4(resolve5("."));
-    const projectPath2 = opts.project ? resolve5(opts.project) : void 0;
+    const factoryName2 = name || basename4(resolve6("."));
+    const projectPath2 = opts.project ? resolve6(opts.project) : void 0;
     info("Starting init wizard...");
     const uiServer = await startServer2({
       port: 7669,
@@ -7952,20 +8435,20 @@ async function runInit(name, opts) {
     });
     return;
   }
-  if (!isSourceRepo(resolve5("."))) {
+  if (!isSourceRepo(resolve6("."))) {
     await runImageModeInit(name, opts);
     return;
   }
   const totalSteps = 5;
   header("BeastMode \u2014 Dark Factory Init");
   info("Creating your Custom Dark Factory\n");
-  const factoryName = name || basename4(resolve5("."));
-  if (existsSync18(factoryName) && existsSync18(resolve5(factoryName, ".beastmode"))) {
+  const factoryName = name || basename4(resolve6("."));
+  if (existsSync19(factoryName) && existsSync19(resolve6(factoryName, ".beastmode"))) {
     throw new Error(`Factory already exists at ./${factoryName}. Use 'beastmode config' to modify.`);
   }
   if (opts.from) {
-    const { readFileSync: readFileSync30 } = await import("fs");
-    const templateContent = readFileSync30(resolve5(opts.from), "utf-8");
+    const { readFileSync: readFileSync31 } = await import("fs");
+    const templateContent = readFileSync31(resolve6(opts.from), "utf-8");
     const { parseTemplate: parseTemplate2 } = await Promise.resolve().then(() => (init_template_importer(), template_importer_exports));
     const template = parseTemplate2(templateContent);
     info(`Importing from template: ${opts.from}`);
@@ -7973,7 +8456,7 @@ async function runInit(name, opts) {
     if (!opts.project) {
       throw new Error("--project is required when using --from");
     }
-    const templateProjectPath = resolve5(opts.project);
+    const templateProjectPath = resolve6(opts.project);
     const templateStack = detectStack(templateProjectPath);
     const templateProjectName = basename4(templateProjectPath);
     const actions2 = scaffoldFactory(factoryName, template.config, {
@@ -7999,9 +8482,9 @@ async function runInit(name, opts) {
   step(1, totalSteps, "Detect");
   let projectPath;
   if (opts.project) {
-    projectPath = resolve5(opts.project);
+    projectPath = resolve6(opts.project);
   } else if (opts.yes) {
-    projectPath = resolve5(".");
+    projectPath = resolve6(".");
     info("No --project specified, using current directory");
   } else {
     const answer = await inquirer.prompt([
@@ -8010,10 +8493,10 @@ async function runInit(name, opts) {
         name: "project",
         message: "Path to your project:",
         default: ".",
-        validate: (input) => existsSync18(resolve5(input)) || `Directory not found: ${input}`
+        validate: (input) => existsSync19(resolve6(input)) || `Directory not found: ${input}`
       }
     ]);
-    projectPath = resolve5(answer.project);
+    projectPath = resolve6(answer.project);
   }
   const stack = detectStack(projectPath);
   success(`Detected: ${stack.framework} (${stack.language}) with ${stack.package_manager || "no package manager"}`);
@@ -8195,7 +8678,7 @@ async function runInit(name, opts) {
     collectedSecrets.push(`BEASTMODE_UI_PASSWORD=${uiPassword}`);
   }
   if (collectedSecrets.length > 0) {
-    const secretsPath = resolve5(factoryName, ".beastmode", "secrets.env.local");
+    const secretsPath = resolve6(factoryName, ".beastmode", "secrets.env.local");
     const secretsContent = "# BeastMode secrets \u2014 DO NOT COMMIT\n" + collectedSecrets.join("\n") + "\n";
     const { writeFileSync: writeSecrets } = await import("fs");
     writeSecrets(secretsPath, secretsContent, "utf-8");
@@ -8219,6 +8702,25 @@ async function runInit(name, opts) {
     } catch (e) {
       warn(`Claude-creds setup skipped: ${e instanceof Error ? e.message : String(e)}`);
     }
+  } else if (process.platform === "linux") {
+    try {
+      const { syncClaudeCredsLinux: syncClaudeCredsLinux2, installAgentLinux: installAgentLinux2 } = await Promise.resolve().then(() => (init_sync_claude_creds(), sync_claude_creds_exports));
+      const sync = syncClaudeCredsLinux2();
+      if ("error" in sync) {
+        warn(`Claude creds check skipped: ${sync.error}`);
+        info("  Run `claude login` then `beastmode sync-claude-creds --install`.");
+      } else {
+        success(`Claude creds validated: ${sync.path}`);
+        try {
+          installAgentLinux2(1800, { throwOnError: true });
+        } catch (e) {
+          warn(`Claude-creds timer install failed: ${e instanceof Error ? e.message : String(e)}`);
+          info("  You can retry with: beastmode sync-claude-creds --install");
+        }
+      }
+    } catch (e) {
+      warn(`Claude-creds setup skipped: ${e instanceof Error ? e.message : String(e)}`);
+    }
   }
   console.log();
   header(`Factory "${factoryName}" is ready!`);
@@ -8238,7 +8740,7 @@ async function runImageModeInit(name, opts) {
   header("BeastMode \u2014 Factory Init (Image Mode)");
   info("Setting up BeastMode from pre-built Docker images\n");
   const factoryName = name || ".";
-  const targetDir = resolve5(factoryName === "." ? "." : factoryName);
+  const targetDir = resolve6(factoryName === "." ? "." : factoryName);
   step(1, totalSteps, "Credentials");
   let projectGithubToken = opts.projectGithubToken || (opts.projectGithubTokenFile ? readSecretFile(opts.projectGithubTokenFile) : "") || opts.githubToken || (opts.githubTokenFile ? readSecretFile(opts.githubTokenFile) : "") || process.env.PROJECT_GITHUB_TOKEN || process.env.GITHUB_TOKEN || "";
   if (!projectGithubToken && !opts.yes) {
@@ -8296,15 +8798,15 @@ async function runImageModeInit(name, opts) {
   }
   let projectPath;
   if (opts.project) {
-    projectPath = resolve5(opts.project);
-    if (!existsSync18(projectPath)) {
+    projectPath = resolve6(opts.project);
+    if (!existsSync19(projectPath)) {
       error(`--project path does not exist: ${projectPath}`);
       process.exit(1);
     }
     success(`Project path: ${projectPath}`);
   } else if (opts.yes) {
-    const cwd = resolve5(".");
-    if (!existsSync18(join16(cwd, ".git"))) {
+    const cwd = resolve6(".");
+    if (!existsSync19(join17(cwd, ".git"))) {
       error(
         "--project is required in non-interactive mode (--yes) unless you run from inside a git repository. Pass --project <path> or cd into your project clone first."
       );
@@ -8320,16 +8822,16 @@ async function runImageModeInit(name, opts) {
         message: "Path to your project (must be a git clone with an origin remote):",
         default: ".",
         validate: (input) => {
-          const p = resolve5(input);
-          if (!existsSync18(p)) return `Directory not found: ${p}`;
-          if (!existsSync18(join16(p, ".git"))) {
+          const p = resolve6(input);
+          if (!existsSync19(p)) return `Directory not found: ${p}`;
+          if (!existsSync19(join17(p, ".git"))) {
             return `Not a git repo: ${p} (run 'git init' first, or pick a different path)`;
           }
           return true;
         }
       }
     ]);
-    projectPath = resolve5(answer.project);
+    projectPath = resolve6(answer.project);
     success(`Project path: ${projectPath}`);
   }
   step(2, totalSteps, "Docker Registry");
@@ -8361,9 +8863,9 @@ async function runImageModeInit(name, opts) {
     success("Authenticated to ghcr.io");
   }
   step(3, totalSteps, "Generate");
-  mkdirSync13(targetDir, { recursive: true });
+  mkdirSync14(targetDir, { recursive: true });
   const composeContent = generateComposeYaml("latest");
-  writeFileSync14(join16(targetDir, "docker-compose.yml"), composeContent, "utf-8");
+  writeFileSync15(join17(targetDir, "docker-compose.yml"), composeContent, "utf-8");
   success("docker-compose.yml");
   const envLines = [
     "# BeastMode environment \u2014 DO NOT COMMIT",
@@ -8403,10 +8905,10 @@ async function runImageModeInit(name, opts) {
     "# PROJECT_REPO=owner/repo",
     ""
   ];
-  writeFileSync14(join16(targetDir, ".env"), envLines.join("\n"), "utf-8");
+  writeFileSync15(join17(targetDir, ".env"), envLines.join("\n"), "utf-8");
   success(`.env (PROJECT_DIR=${projectPath}, two-PAT model)`);
   for (const dir of ["data", "runs", "daemon/logs", ".beastmode", "config"]) {
-    mkdirSync13(join16(targetDir, dir), { recursive: true });
+    mkdirSync14(join17(targetDir, dir), { recursive: true });
   }
   step(4, totalSteps, "Pull Images");
   try {
@@ -8456,6 +8958,25 @@ async function runImageModeInit(name, opts) {
     } catch (e) {
       warn(`Claude-creds setup skipped: ${e instanceof Error ? e.message : String(e)}`);
     }
+  } else if (process.platform === "linux") {
+    try {
+      const { syncClaudeCredsLinux: syncClaudeCredsLinux2, installAgentLinux: installAgentLinux2 } = await Promise.resolve().then(() => (init_sync_claude_creds(), sync_claude_creds_exports));
+      const sync = syncClaudeCredsLinux2();
+      if ("error" in sync) {
+        warn(`Claude creds check skipped: ${sync.error}`);
+        info("  Run `claude login` then `beastmode sync-claude-creds --install`.");
+      } else {
+        success(`Claude creds validated: ${sync.path}`);
+        try {
+          installAgentLinux2(1800, { throwOnError: true });
+        } catch (e) {
+          warn(`Claude-creds timer install failed: ${e instanceof Error ? e.message : String(e)}`);
+          info("  You can retry with: beastmode sync-claude-creds --install");
+        }
+      }
+    } catch (e) {
+      warn(`Claude-creds setup skipped: ${e instanceof Error ? e.message : String(e)}`);
+    }
   }
   console.log();
   header("BeastMode is ready!");
@@ -8475,21 +8996,21 @@ async function runImageModeInit(name, opts) {
 // src/cli/commands/export-config.ts
 init_export_adapter();
 init_display();
-import { Command as Command3 } from "commander";
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync15, existsSync as existsSync19, readdirSync as readdirSync7 } from "fs";
-import { resolve as resolve6, join as join17 } from "path";
+import { Command as Command4 } from "commander";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync16, existsSync as existsSync20, readdirSync as readdirSync8 } from "fs";
+import { resolve as resolve7, join as join18 } from "path";
 function exportFactory(factoryDir, outputPath) {
-  const bmDir = join17(factoryDir, ".beastmode");
-  const configPath = join17(bmDir, "config.json");
-  if (!existsSync19(configPath)) {
+  const bmDir = join18(factoryDir, ".beastmode");
+  const configPath = join18(bmDir, "config.json");
+  if (!existsSync20(configPath)) {
     throw new Error(`No factory found at ${factoryDir}`);
   }
-  const config = JSON.parse(readFileSync15(configPath, "utf-8"));
-  const identity = JSON.parse(readFileSync15(join17(bmDir, "factory.json"), "utf-8"));
+  const config = JSON.parse(readFileSync17(configPath, "utf-8"));
+  const identity = JSON.parse(readFileSync17(join18(bmDir, "factory.json"), "utf-8"));
   let plugins = [];
-  const lockPath = join17(bmDir, "extensions.lock");
-  if (existsSync19(lockPath)) {
-    const lock = JSON.parse(readFileSync15(lockPath, "utf-8"));
+  const lockPath = join18(bmDir, "extensions.lock");
+  if (existsSync20(lockPath)) {
+    const lock = JSON.parse(readFileSync17(lockPath, "utf-8"));
     plugins = Object.keys(lock.plugins || {});
   }
   const template = {
@@ -8498,15 +9019,15 @@ function exportFactory(factoryDir, outputPath) {
     config,
     plugins
   };
-  writeFileSync15(outputPath, JSON.stringify(template, null, 2) + "\n", "utf-8");
+  writeFileSync16(outputPath, JSON.stringify(template, null, 2) + "\n", "utf-8");
 }
 function findRunDir(runId) {
   const candidates = [
-    resolve6(".", "runs", runId),
-    resolve6(".", runId)
+    resolve7(".", "runs", runId),
+    resolve7(".", runId)
   ];
   for (const candidate of candidates) {
-    if (existsSync19(candidate)) {
+    if (existsSync20(candidate)) {
       return candidate;
     }
   }
@@ -8515,28 +9036,28 @@ function findRunDir(runId) {
   );
 }
 function createArtifactExportCommand(artifact) {
-  return new Command3(artifact).description(`Export ${artifact} from a pipeline run`).requiredOption("--run <id>", "Run ID to export from").option("--adapter <id>", "Export adapter (default: generic:markdown)", "generic:markdown").option("--output <path>", "Output file path (default: stdout)").action((opts) => {
+  return new Command4(artifact).description(`Export ${artifact} from a pipeline run`).requiredOption("--run <id>", "Run ID to export from").option("--adapter <id>", "Export adapter (default: generic:markdown)", "generic:markdown").option("--output <path>", "Output file path (default: stdout)").action((opts) => {
     try {
       const runDir = findRunDir(opts.run);
       let sourceContent;
       if (artifact === "scenarios") {
-        const scenariosDir = join17(runDir, "scenarios");
-        if (!existsSync19(scenariosDir)) {
+        const scenariosDir = join18(runDir, "scenarios");
+        if (!existsSync20(scenariosDir)) {
           throw new Error(`No scenarios directory found in run ${opts.run}`);
         }
-        const files = readdirSync7(scenariosDir).filter((f) => f.endsWith(".md")).sort();
-        sourceContent = files.map((f) => readFileSync15(join17(scenariosDir, f), "utf-8")).join("\n\n---\n\n");
+        const files = readdirSync8(scenariosDir).filter((f) => f.endsWith(".md")).sort();
+        sourceContent = files.map((f) => readFileSync17(join18(scenariosDir, f), "utf-8")).join("\n\n---\n\n");
       } else {
         const artifactFile = artifact === "nlspec" ? "nlspec.md" : "plan.md";
-        const artifactPath = join17(runDir, artifactFile);
-        if (!existsSync19(artifactPath)) {
+        const artifactPath = join18(runDir, artifactFile);
+        if (!existsSync20(artifactPath)) {
           throw new Error(`${artifactFile} not found in run ${opts.run}`);
         }
-        sourceContent = readFileSync15(artifactPath, "utf-8");
+        sourceContent = readFileSync17(artifactPath, "utf-8");
       }
       const result = runExportAdapter(opts.adapter, sourceContent);
       if (opts.output) {
-        writeFileSync15(resolve6(opts.output), result, "utf-8");
+        writeFileSync16(resolve7(opts.output), result, "utf-8");
         header(`Exported ${artifact}`);
         success(`Written to: ${opts.output}`);
       } else {
@@ -8548,12 +9069,12 @@ function createArtifactExportCommand(artifact) {
     }
   });
 }
-var exportCommand = new Command3("export").description("Export factory config or pipeline artifacts");
+var exportCommand = new Command4("export").description("Export factory config or pipeline artifacts");
 exportCommand.addCommand(
-  new Command3("config").description("Export factory configuration template (secrets excluded)").option("--output <path>", "Output file path", "beastmode-template.json").action((opts) => {
+  new Command4("config").description("Export factory configuration template (secrets excluded)").option("--output <path>", "Output file path", "beastmode-template.json").action((opts) => {
     try {
-      const factoryDir = resolve6(".");
-      exportFactory(factoryDir, resolve6(opts.output));
+      const factoryDir = resolve7(".");
+      exportFactory(factoryDir, resolve7(opts.output));
       header("Factory template exported");
       success(`Written to: ${opts.output}`);
       info("Share with teammates: beastmode init my-factory --from " + opts.output);
@@ -8570,10 +9091,10 @@ exportCommand.addCommand(createArtifactExportCommand("scenarios"));
 // src/cli/commands/validate.ts
 init_config_validator();
 init_display();
-import { Command as Command4 } from "commander";
-import { resolve as resolve7 } from "path";
-var validateCommand = new Command4("validate").description("Validate factory health").option("--verbose", "Show all checks").action((opts) => {
-  const factoryDir = resolve7(".");
+import { Command as Command5 } from "commander";
+import { resolve as resolve8 } from "path";
+var validateCommand = new Command5("validate").description("Validate factory health").option("--verbose", "Show all checks").action((opts) => {
+  const factoryDir = resolve8(".");
   const result = validateFactory(factoryDir, process.env);
   header("Factory Validation");
   if (result.errors.length > 0) {
@@ -8602,8 +9123,8 @@ init_mcp_manager();
 init_hook_manager();
 init_skill_manager();
 init_display();
-import { Command as Command5 } from "commander";
-import { resolve as resolve8 } from "path";
+import { Command as Command6 } from "commander";
+import { resolve as resolve9 } from "path";
 async function addPluginAction(factoryDir, source, options) {
   await installPlugin(factoryDir, source);
 }
@@ -8617,7 +9138,7 @@ function addMcpAction(factoryDir, name, command, args, config) {
   });
 }
 function addSkillAction(factoryDir, sourcePath) {
-  addSkill(factoryDir, resolve8(sourcePath));
+  addSkill(factoryDir, resolve9(sourcePath));
 }
 function addHookAction(factoryDir, event, name, options) {
   addHook(factoryDir, event, {
@@ -8629,10 +9150,10 @@ function addHookAction(factoryDir, event, name, options) {
     source: "user"
   });
 }
-var addCommand = new Command5("add").description("Add extensions to the factory").addCommand(
-  new Command5("plugin").description("Install a plugin (from path, URL, or registry name)").argument("<source>", "Plugin source: local path, git URL, or registry name").option("--version <ver>", "Specific version to install").action(async (source, opts) => {
+var addCommand = new Command6("add").description("Add extensions to the factory").addCommand(
+  new Command6("plugin").description("Install a plugin (from path, URL, or registry name)").argument("<source>", "Plugin source: local path, git URL, or registry name").option("--version <ver>", "Specific version to install").action(async (source, opts) => {
     try {
-      const factoryDir = resolve8(".");
+      const factoryDir = resolve9(".");
       await addPluginAction(factoryDir, source, opts);
       success(`Plugin installed from ${source}`);
     } catch (err) {
@@ -8641,10 +9162,10 @@ var addCommand = new Command5("add").description("Add extensions to the factory"
     }
   })
 ).addCommand(
-  new Command5("mcp").description("Add an MCP server").argument("<name>", "Server name").requiredOption("--command <cmd>", "Command to run").option("--args <args...>", "Command arguments", []).option("--config <json>", "Configuration as JSON string").action(
+  new Command6("mcp").description("Add an MCP server").argument("<name>", "Server name").requiredOption("--command <cmd>", "Command to run").option("--args <args...>", "Command arguments", []).option("--config <json>", "Configuration as JSON string").action(
     (name, opts) => {
       try {
-        const factoryDir = resolve8(".");
+        const factoryDir = resolve9(".");
         const config = opts.config ? JSON.parse(opts.config) : void 0;
         addMcpAction(factoryDir, name, opts.command, opts.args, config);
         success(`MCP server '${name}' added`);
@@ -8655,9 +9176,9 @@ var addCommand = new Command5("add").description("Add extensions to the factory"
     }
   )
 ).addCommand(
-  new Command5("skill").description("Add a custom skill from a directory").argument("<path>", "Path to skill directory (must contain SKILL.md)").action((path) => {
+  new Command6("skill").description("Add a custom skill from a directory").argument("<path>", "Path to skill directory (must contain SKILL.md)").action((path) => {
     try {
-      const factoryDir = resolve8(".");
+      const factoryDir = resolve9(".");
       addSkillAction(factoryDir, path);
       success(`Skill added from ${path}`);
     } catch (err) {
@@ -8666,10 +9187,10 @@ var addCommand = new Command5("add").description("Add extensions to the factory"
     }
   })
 ).addCommand(
-  new Command5("hook").description("Add a pipeline hook").argument("<event>", "Hook event (e.g., pre-build, post-verify)").argument("<name>", "Hook name").option("--command <cmd>", "Shell command to run").option("--skill <name>", "Skill to invoke").option("--webhook <url>", "Webhook URL to POST to").option("--config <json>", "Configuration as JSON string").action(
+  new Command6("hook").description("Add a pipeline hook").argument("<event>", "Hook event (e.g., pre-build, post-verify)").argument("<name>", "Hook name").option("--command <cmd>", "Shell command to run").option("--skill <name>", "Skill to invoke").option("--webhook <url>", "Webhook URL to POST to").option("--config <json>", "Configuration as JSON string").action(
     (event, name, opts) => {
       try {
-        const factoryDir = resolve8(".");
+        const factoryDir = resolve9(".");
         const config = opts.config ? JSON.parse(opts.config) : void 0;
         addHookAction(factoryDir, event, name, {
           command: opts.command,
@@ -8692,8 +9213,8 @@ init_mcp_manager();
 init_hook_manager();
 init_skill_manager();
 init_display();
-import { Command as Command6 } from "commander";
-import { resolve as resolve9 } from "path";
+import { Command as Command7 } from "commander";
+import { resolve as resolve10 } from "path";
 function removePluginAction(factoryDir, name, options) {
   removePlugin(factoryDir, name, options);
 }
@@ -8706,10 +9227,10 @@ function removeSkillAction(factoryDir, name) {
 function removeHookAction(factoryDir, event, name) {
   removeHook(factoryDir, event, name);
 }
-var removeCommand = new Command6("remove").description("Remove extensions from the factory").addCommand(
-  new Command6("plugin").description("Remove an installed plugin").argument("<name>", "Plugin name").option("--force", "Force removal even if other plugins depend on it").action((name, opts) => {
+var removeCommand = new Command7("remove").description("Remove extensions from the factory").addCommand(
+  new Command7("plugin").description("Remove an installed plugin").argument("<name>", "Plugin name").option("--force", "Force removal even if other plugins depend on it").action((name, opts) => {
     try {
-      const factoryDir = resolve9(".");
+      const factoryDir = resolve10(".");
       removePluginAction(factoryDir, name, opts);
       success(`Plugin '${name}' removed`);
     } catch (err) {
@@ -8718,9 +9239,9 @@ var removeCommand = new Command6("remove").description("Remove extensions from t
     }
   })
 ).addCommand(
-  new Command6("mcp").description("Remove an MCP server").argument("<name>", "Server name").action((name) => {
+  new Command7("mcp").description("Remove an MCP server").argument("<name>", "Server name").action((name) => {
     try {
-      const factoryDir = resolve9(".");
+      const factoryDir = resolve10(".");
       removeMcpAction(factoryDir, name);
       success(`MCP server '${name}' removed`);
     } catch (err) {
@@ -8729,9 +9250,9 @@ var removeCommand = new Command6("remove").description("Remove extensions from t
     }
   })
 ).addCommand(
-  new Command6("skill").description("Remove a custom skill").argument("<name>", "Skill name").action((name) => {
+  new Command7("skill").description("Remove a custom skill").argument("<name>", "Skill name").action((name) => {
     try {
-      const factoryDir = resolve9(".");
+      const factoryDir = resolve10(".");
       removeSkillAction(factoryDir, name);
       success(`Skill '${name}' removed`);
     } catch (err) {
@@ -8740,9 +9261,9 @@ var removeCommand = new Command6("remove").description("Remove extensions from t
     }
   })
 ).addCommand(
-  new Command6("hook").description("Remove a pipeline hook").argument("<event>", "Hook event (e.g., pre-build, post-verify)").argument("<name>", "Hook name").action((event, name) => {
+  new Command7("hook").description("Remove a pipeline hook").argument("<event>", "Hook event (e.g., pre-build, post-verify)").argument("<name>", "Hook name").action((event, name) => {
     try {
-      const factoryDir = resolve9(".");
+      const factoryDir = resolve10(".");
       removeHookAction(factoryDir, event, name);
       success(`Hook '${name}' removed from ${event}`);
     } catch (err) {
@@ -8758,17 +9279,17 @@ init_hook_manager();
 init_skill_manager();
 init_presets();
 init_display();
-import { Command as Command7 } from "commander";
-import { resolve as resolve10 } from "path";
-import { readFileSync as readFileSync16, existsSync as existsSync20 } from "fs";
-import { join as join18 } from "path";
+import { Command as Command8 } from "commander";
+import { resolve as resolve11 } from "path";
+import { readFileSync as readFileSync18, existsSync as existsSync21 } from "fs";
+import { join as join19 } from "path";
 function listPluginsAction(factoryDir) {
-  const lockPath = join18(factoryDir, ".beastmode", "extensions.lock");
-  if (!existsSync20(lockPath)) {
+  const lockPath = join19(factoryDir, ".beastmode", "extensions.lock");
+  if (!existsSync21(lockPath)) {
     console.log("  No plugins installed (extensions.lock not found).");
     return;
   }
-  const lock = JSON.parse(readFileSync16(lockPath, "utf-8"));
+  const lock = JSON.parse(readFileSync18(lockPath, "utf-8"));
   const plugins = lock.plugins || {};
   const names = Object.keys(plugins);
   if (names.length === 0) {
@@ -8841,24 +9362,24 @@ function listPresetsAction() {
     console.log(`  ${name} \u2014 ${preset.description}`);
   }
 }
-var listCommand = new Command7("list").description("List installed extensions and resources").addCommand(
-  new Command7("plugins").description("List installed plugins").action(() => {
-    listPluginsAction(resolve10("."));
+var listCommand = new Command8("list").description("List installed extensions and resources").addCommand(
+  new Command8("plugins").description("List installed plugins").action(() => {
+    listPluginsAction(resolve11("."));
   })
 ).addCommand(
-  new Command7("mcps").description("List configured MCP servers").action(() => {
-    listMcpsAction(resolve10("."));
+  new Command8("mcps").description("List configured MCP servers").action(() => {
+    listMcpsAction(resolve11("."));
   })
 ).addCommand(
-  new Command7("skills").description("List available skills").action(() => {
-    listSkillsAction(resolve10("."));
+  new Command8("skills").description("List available skills").action(() => {
+    listSkillsAction(resolve11("."));
   })
 ).addCommand(
-  new Command7("hooks").description("List configured hooks").action(() => {
-    listHooksAction(resolve10("."));
+  new Command8("hooks").description("List configured hooks").action(() => {
+    listHooksAction(resolve11("."));
   })
 ).addCommand(
-  new Command7("presets").description("List available pipeline presets").action(() => {
+  new Command8("presets").description("List available pipeline presets").action(() => {
     listPresetsAction();
   })
 );
@@ -8866,32 +9387,32 @@ var listCommand = new Command7("list").description("List installed extensions an
 // src/cli/commands/import-cmd.ts
 init_import_adapter();
 init_display();
-import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync16, mkdirSync as mkdirSync14, existsSync as existsSync21 } from "fs";
-import { resolve as resolve11, join as join19 } from "path";
+import { Command as Command9 } from "commander";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync17, mkdirSync as mkdirSync15, existsSync as existsSync22 } from "fs";
+import { resolve as resolve12, join as join20 } from "path";
 var VALID_ARTIFACTS = ["nlspec", "plan", "scenarios"];
 function createArtifactCommand(artifact) {
-  return new Command8(artifact).description(`Import external document as ${artifact}`).requiredOption("--from <path>", "Path to source file").requiredOption("--adapter <id>", "Adapter ID (e.g., generic:prd, bmad:brainstorm)").option("--output <path>", "Output path (default: stdout)").action((opts) => {
+  return new Command9(artifact).description(`Import external document as ${artifact}`).requiredOption("--from <path>", "Path to source file").requiredOption("--adapter <id>", "Adapter ID (e.g., generic:prd, bmad:brainstorm)").option("--output <path>", "Output path (default: stdout)").action((opts) => {
     try {
-      const sourcePath = resolve11(opts.from);
-      if (!existsSync21(sourcePath)) {
+      const sourcePath = resolve12(opts.from);
+      if (!existsSync22(sourcePath)) {
         throw new Error(`Source file not found: ${sourcePath}`);
       }
-      const sourceContent = readFileSync17(sourcePath, "utf-8");
+      const sourceContent = readFileSync19(sourcePath, "utf-8");
       const result = runImportAdapter(opts.adapter, sourceContent);
       if (opts.output) {
-        const outputPath = resolve11(opts.output);
+        const outputPath = resolve12(opts.output);
         if (artifact === "scenarios" && opts.adapter.endsWith(":test-cases")) {
           const scenarios = JSON.parse(result);
-          mkdirSync14(outputPath, { recursive: true });
+          mkdirSync15(outputPath, { recursive: true });
           for (const scenario of scenarios) {
-            const filePath = join19(outputPath, `${scenario.name}.md`);
-            writeFileSync16(filePath, scenario.content, "utf-8");
+            const filePath = join20(outputPath, `${scenario.name}.md`);
+            writeFileSync17(filePath, scenario.content, "utf-8");
             success(`  ${scenario.name}.md`);
           }
           header(`Imported ${scenarios.length} scenarios to ${opts.output}`);
         } else {
-          writeFileSync16(outputPath, result, "utf-8");
+          writeFileSync17(outputPath, result, "utf-8");
           header(`Imported ${artifact}`);
           success(`Written to: ${opts.output}`);
         }
@@ -8904,7 +9425,7 @@ function createArtifactCommand(artifact) {
     }
   });
 }
-var importCommand = new Command8("import").description("Import external artifacts into BeastMode format");
+var importCommand = new Command9("import").description("Import external artifacts into BeastMode format");
 for (const artifact of VALID_ARTIFACTS) {
   importCommand.addCommand(createArtifactCommand(artifact));
 }
@@ -8913,53 +9434,53 @@ for (const artifact of VALID_ARTIFACTS) {
 init_status_checker();
 init_schemas();
 init_display();
-import { Command as Command9 } from "commander";
-import { existsSync as existsSync22, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
-import { execSync as execSync5 } from "child_process";
-import { join as join20, resolve as resolve12 } from "path";
+import { Command as Command10 } from "commander";
+import { existsSync as existsSync23, readFileSync as readFileSync20, readdirSync as readdirSync9 } from "fs";
+import { execSync as execSync6 } from "child_process";
+import { join as join21, resolve as resolve13 } from "path";
 function statusAction(factoryDir, opts) {
-  const bmDir = join20(factoryDir, ".beastmode");
-  if (!existsSync22(bmDir)) {
+  const bmDir = join21(factoryDir, ".beastmode");
+  if (!existsSync23(bmDir)) {
     throw new Error(`No factory found at ${factoryDir}`);
   }
-  const factoryJsonPath = join20(bmDir, "factory.json");
-  const rawIdentity = JSON.parse(readFileSync18(factoryJsonPath, "utf-8"));
+  const factoryJsonPath = join21(bmDir, "factory.json");
+  const rawIdentity = JSON.parse(readFileSync20(factoryJsonPath, "utf-8"));
   const factoryIdentity = FactoryIdentitySchema.parse(rawIdentity);
-  const projectsDir = join20(bmDir, "projects");
-  const projectCount = existsSync22(projectsDir) ? readdirSync8(projectsDir).filter((f) => f.endsWith(".json")).length : 0;
-  const pluginsDir = join20(bmDir, "plugins");
-  const pluginNames = existsSync22(pluginsDir) ? readdirSync8(pluginsDir) : [];
-  const mcpPath = join20(bmDir, "mcp-servers.json");
+  const projectsDir = join21(bmDir, "projects");
+  const projectCount = existsSync23(projectsDir) ? readdirSync9(projectsDir).filter((f) => f.endsWith(".json")).length : 0;
+  const pluginsDir = join21(bmDir, "plugins");
+  const pluginNames = existsSync23(pluginsDir) ? readdirSync9(pluginsDir) : [];
+  const mcpPath = join21(bmDir, "mcp-servers.json");
   let mcpServers = {};
-  if (existsSync22(mcpPath)) {
+  if (existsSync23(mcpPath)) {
     try {
-      const raw = JSON.parse(readFileSync18(mcpPath, "utf-8"));
+      const raw = JSON.parse(readFileSync20(mcpPath, "utf-8"));
       mcpServers = raw.servers || {};
     } catch {
     }
   }
-  const hooksPath = join20(bmDir, "hooks.json");
+  const hooksPath = join21(bmDir, "hooks.json");
   let hooks = {};
-  if (existsSync22(hooksPath)) {
+  if (existsSync23(hooksPath)) {
     try {
-      const raw = JSON.parse(readFileSync18(hooksPath, "utf-8"));
+      const raw = JSON.parse(readFileSync20(hooksPath, "utf-8"));
       hooks = raw.hooks || {};
     } catch {
     }
   }
-  const skillsDir = join20(bmDir, "skills");
-  const skillCount = existsSync22(skillsDir) ? readdirSync8(skillsDir).length : 0;
-  const runsDir = join20(factoryDir, "runs");
+  const skillsDir = join21(bmDir, "skills");
+  const skillCount = existsSync23(skillsDir) ? readdirSync9(skillsDir).length : 0;
+  const runsDir = join21(factoryDir, "runs");
   let runDirs = [];
-  if (existsSync22(runsDir)) {
-    runDirs = readdirSync8(runsDir).filter((d) => d.startsWith("run-")).sort();
+  if (existsSync23(runsDir)) {
+    runDirs = readdirSync9(runsDir).filter((d) => d.startsWith("run-")).sort();
   }
-  const pidPath = join20(bmDir, "daemon.pid");
+  const pidPath = join21(bmDir, "daemon.pid");
   let daemonPid = null;
   let pidAlive = false;
-  if (existsSync22(pidPath)) {
+  if (existsSync23(pidPath)) {
     try {
-      daemonPid = parseInt(readFileSync18(pidPath, "utf-8").trim(), 10);
+      daemonPid = parseInt(readFileSync20(pidPath, "utf-8").trim(), 10);
       process.kill(daemonPid, 0);
       pidAlive = true;
     } catch {
@@ -8968,7 +9489,7 @@ function statusAction(factoryDir, opts) {
   }
   if (!pidAlive) {
     try {
-      const out = execSync5("pgrep -f 'beastmode_daemon' 2>/dev/null || true", {
+      const out = execSync6("pgrep -f 'beastmode_daemon' 2>/dev/null || true", {
         encoding: "utf-8",
         timeout: 3e3
       }).trim();
@@ -8995,8 +9516,8 @@ function statusAction(factoryDir, opts) {
   };
   return collectStatus(input);
 }
-var statusCommand = new Command9("status").description("Show factory status overview").option("--json", "Output as JSON").option("--watch", "Enable watch mode (display layer)").action((opts) => {
-  const factoryDir = resolve12(".");
+var statusCommand = new Command10("status").description("Show factory status overview").option("--json", "Output as JSON").option("--watch", "Enable watch mode (display layer)").action((opts) => {
+  const factoryDir = resolve13(".");
   try {
     const status = statusAction(factoryDir, { json: !!opts.json });
     if (opts.json) {
@@ -9032,20 +9553,20 @@ var statusCommand = new Command9("status").description("Show factory status over
 // src/cli/commands/config-cmd.ts
 init_config_manager();
 init_display();
-import { Command as Command10 } from "commander";
-import { existsSync as existsSync23, readFileSync as readFileSync19, writeFileSync as writeFileSync17 } from "fs";
-import { join as join21, resolve as resolve13 } from "path";
-import { execSync as execSync6 } from "child_process";
+import { Command as Command11 } from "commander";
+import { existsSync as existsSync24, readFileSync as readFileSync21, writeFileSync as writeFileSync18 } from "fs";
+import { join as join22, resolve as resolve14 } from "path";
+import { execSync as execSync7 } from "child_process";
 function readConfig2(factoryDir) {
-  const configPath = join21(factoryDir, ".beastmode", "config.json");
-  if (!existsSync23(configPath)) {
+  const configPath = join22(factoryDir, ".beastmode", "config.json");
+  if (!existsSync24(configPath)) {
     throw new Error("No config.json found. Run beastmode init first.");
   }
-  return JSON.parse(readFileSync19(configPath, "utf-8"));
+  return JSON.parse(readFileSync21(configPath, "utf-8"));
 }
 function writeConfig2(factoryDir, config) {
-  const configPath = join21(factoryDir, ".beastmode", "config.json");
-  writeFileSync17(configPath, JSON.stringify(config, null, 2) + "\n");
+  const configPath = join22(factoryDir, ".beastmode", "config.json");
+  writeFileSync18(configPath, JSON.stringify(config, null, 2) + "\n");
 }
 function configGetAction(factoryDir, key) {
   const config = readConfig2(factoryDir);
@@ -9062,8 +9583,8 @@ function configResetAction(factoryDir, key) {
   const updated = configReset(config, key);
   writeConfig2(factoryDir, updated);
 }
-var configGetCmd = new Command10("get").description("Get a config value by dot-notation key").argument("<key>", "Config key (e.g., pipeline.preset)").action((key) => {
-  const factoryDir = resolve13(".");
+var configGetCmd = new Command11("get").description("Get a config value by dot-notation key").argument("<key>", "Config key (e.g., pipeline.preset)").action((key) => {
+  const factoryDir = resolve14(".");
   try {
     const value = configGetAction(factoryDir, key);
     if (typeof value === "object" && value !== null) {
@@ -9076,8 +9597,8 @@ var configGetCmd = new Command10("get").description("Get a config value by dot-n
     process.exit(1);
   }
 });
-var configSetCmd = new Command10("set").description("Set a config value by dot-notation key").argument("<key>", "Config key (e.g., pipeline.preset)").argument("<value>", "Value to set (auto-coerces types)").action((key, value) => {
-  const factoryDir = resolve13(".");
+var configSetCmd = new Command11("set").description("Set a config value by dot-notation key").argument("<key>", "Config key (e.g., pipeline.preset)").argument("<value>", "Value to set (auto-coerces types)").action((key, value) => {
+  const factoryDir = resolve14(".");
   try {
     configSetAction(factoryDir, key, value);
     success(`Set ${key} = ${value}`);
@@ -9086,23 +9607,23 @@ var configSetCmd = new Command10("set").description("Set a config value by dot-n
     process.exit(1);
   }
 });
-var configEditCmd = new Command10("edit").description("Open config.json in $EDITOR").action(() => {
-  const factoryDir = resolve13(".");
-  const configPath = join21(factoryDir, ".beastmode", "config.json");
-  if (!existsSync23(configPath)) {
+var configEditCmd = new Command11("edit").description("Open config.json in $EDITOR").action(() => {
+  const factoryDir = resolve14(".");
+  const configPath = join22(factoryDir, ".beastmode", "config.json");
+  if (!existsSync24(configPath)) {
     error("No config.json found. Run beastmode init first.");
     process.exit(1);
   }
   const editor = process.env.EDITOR || "vi";
   try {
-    execSync6(`${editor} ${configPath}`, { stdio: "inherit" });
+    execSync7(`${editor} ${configPath}`, { stdio: "inherit" });
   } catch {
     error(`Failed to open editor: ${editor}`);
     process.exit(1);
   }
 });
-var configResetCmd = new Command10("reset").description("Reset config to defaults (all or specific key)").argument("[key]", "Optional key to reset (resets all if omitted)").action((key) => {
-  const factoryDir = resolve13(".");
+var configResetCmd = new Command11("reset").description("Reset config to defaults (all or specific key)").argument("[key]", "Optional key to reset (resets all if omitted)").action((key) => {
+  const factoryDir = resolve14(".");
   try {
     configResetAction(factoryDir, key);
     if (key) {
@@ -9115,7 +9636,7 @@ var configResetCmd = new Command10("reset").description("Reset config to default
     process.exit(1);
   }
 });
-var configCommand = new Command10("config").description("Manage factory configuration").addCommand(configGetCmd).addCommand(configSetCmd).addCommand(configEditCmd).addCommand(configResetCmd);
+var configCommand = new Command11("config").description("Manage factory configuration").addCommand(configGetCmd).addCommand(configSetCmd).addCommand(configEditCmd).addCommand(configResetCmd);
 
 // src/cli/commands/doctor.ts
 init_doctor();
@@ -9124,180 +9645,13 @@ init_version();
 init_plugin_resolver();
 init_display();
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync25, readFileSync as readFileSync21, readdirSync as readdirSync10 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22, readdirSync as readdirSync10 } from "fs";
 import { join as join23, resolve as resolve15 } from "path";
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync8, spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir3, platform as platform2 } from "os";
 import * as http3 from "http";
 import * as https from "https";
-
-// src/cli/commands/board.ts
-init_display();
-import { Command as Command11 } from "commander";
-import { resolve as resolve14, join as join22 } from "path";
-import { existsSync as existsSync24, readFileSync as readFileSync20, mkdirSync as mkdirSync15, writeFileSync as writeFileSync18, readdirSync as readdirSync9 } from "fs";
-import { execSync as execSync7 } from "child_process";
-var boardCommand = new Command11("board").description("Launch the BeastMode Board web UI").option("--port <number>", "Port to serve on", "7669").option("--host <host>", "Host to bind to (use 0.0.0.0 for external access)", "127.0.0.1").action(async (opts) => {
-  try {
-    await runBoard(opts);
-  } catch (err) {
-    error(err.message);
-    process.exit(1);
-  }
-});
-boardCommand.command("set-status <item_id> <status>").description(
-  "Safely change a board item's status via the board HTTP API (never sqlite3 against the live DB \u2014 Gap 24)"
-).option("--project <name>", "Project/board name (defaults to the factory's only project, or errors if ambiguous)").option("--board-url <url>", "Override board HTTP URL (default: use running board container via docker exec)").action(async (itemId, status, opts) => {
-  try {
-    await setItemStatus(itemId, status, opts);
-  } catch (err) {
-    error(err.message);
-    process.exit(1);
-  }
-});
-function findFactoryDir(startDir) {
-  let dir = startDir || process.cwd();
-  const root = resolve14("/");
-  while (dir !== root) {
-    if (existsSync24(join22(dir, ".beastmode", "factory.json"))) {
-      return dir;
-    }
-    const parent = resolve14(dir, "..");
-    if (parent === dir) break;
-    dir = parent;
-  }
-  if (existsSync24(join22(dir, ".beastmode", "factory.json"))) {
-    return dir;
-  }
-  return null;
-}
-function inferProjectName(factoryDir) {
-  const projectsDir = join22(factoryDir, ".beastmode", "projects");
-  if (!existsSync24(projectsDir)) return null;
-  const files = readdirSync9(projectsDir).filter((f) => f.endsWith(".json"));
-  if (files.length === 1) return files[0].replace(/\.json$/, "");
-  return null;
-}
-function tryExecSync(cmd, timeoutMs = 15e3) {
-  try {
-    return execSync7(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs }).trim();
-  } catch {
-    return null;
-  }
-}
-async function setItemStatus(itemId, status, opts) {
-  if (!itemId || !/^\d+$/.test(itemId)) {
-    throw new Error(`Invalid item_id: ${itemId} (expected numeric id)`);
-  }
-  const trimmedStatus = status.trim();
-  if (!trimmedStatus) {
-    throw new Error("status cannot be empty");
-  }
-  let project = opts.project;
-  if (!project) {
-    const factoryDir = findFactoryDir();
-    if (!factoryDir) {
-      throw new Error("No .beastmode factory found in cwd tree. Pass --project <name> explicitly.");
-    }
-    const inferred = inferProjectName(factoryDir);
-    if (!inferred) {
-      throw new Error(
-        "Could not determine project name from factory (0 or >1 projects configured). Pass --project <name>."
-      );
-    }
-    project = inferred;
-  }
-  const payload = JSON.stringify({ status: trimmedStatus });
-  if (opts.boardUrl) {
-    const url2 = `${opts.boardUrl.replace(/\/+$/, "")}/api/items/${itemId}?board=${encodeURIComponent(project)}`;
-    const cmd2 = `curl -sS -X PATCH '${url2}' -H 'Content-Type: application/json' -d '${payload.replace(/'/g, "'\\''")}'`;
-    const out2 = tryExecSync(cmd2);
-    if (!out2) throw new Error(`curl failed hitting ${url2}`);
-    info(out2);
-    return;
-  }
-  const container = tryExecSync(`docker ps --filter 'label=com.docker.compose.service=daemon' --format '{{.Names}}' | head -n1`) || tryExecSync(`docker ps --filter 'label=com.docker.compose.service=ui' --format '{{.Names}}' | head -n1`);
-  if (!container) {
-    throw new Error(
-      "No running daemon or ui container found. Start the factory with `docker compose up -d`, or pass --board-url."
-    );
-  }
-  const escapedPayload = payload.replace(/'/g, "'\\''");
-  const url = `http://board:8080/api/items/${itemId}?board=${encodeURIComponent(project)}`;
-  const cmd = `docker exec ${container} curl -sS -X PATCH '${url}' -H 'Content-Type: application/json' -d '${escapedPayload}'`;
-  const out = tryExecSync(cmd);
-  if (!out) {
-    throw new Error(`docker exec curl failed hitting ${url} via ${container}`);
-  }
-  try {
-    const parsed = JSON.parse(out);
-    if (parsed.detail) {
-      throw new Error(`Board rejected update: ${parsed.detail}`);
-    }
-    if (parsed.id && parsed.status) {
-      info(`Item ${parsed.id} \u2192 ${parsed.status} (project=${project})`);
-      return;
-    }
-  } catch (e) {
-    if (e instanceof Error && e.message.startsWith("Board rejected update:")) throw e;
-  }
-  info(out);
-}
-async function runBoard(opts) {
-  let factoryDir = findFactoryDir();
-  if (!factoryDir) {
-    factoryDir = process.cwd();
-    const bmDir = join22(factoryDir, ".beastmode");
-    if (!existsSync24(bmDir)) {
-      mkdirSync15(bmDir, { recursive: true });
-    }
-    const factoryJsonPath2 = join22(bmDir, "factory.json");
-    if (!existsSync24(factoryJsonPath2)) {
-      writeFileSync18(
-        factoryJsonPath2,
-        JSON.stringify({ factory_name: "BeastMode", created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
-        "utf-8"
-      );
-      info("No factory found \u2014 created minimal stub at .beastmode/factory.json");
-    }
-  }
-  const factoryJsonPath = join22(factoryDir, ".beastmode", "factory.json");
-  const factoryJson = JSON.parse(readFileSync20(factoryJsonPath, "utf-8"));
-  const factoryName = factoryJson.factory_name || "BeastMode Factory";
-  header(`BeastMode Board \u2014 ${factoryName}`);
-  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
-  const port = parseInt(opts.port, 10) || 7669;
-  const uiServer = await startServer2({
-    port,
-    host: opts.host,
-    factoryName,
-    factoryPath: factoryDir,
-    mode: "board"
-  });
-  info(`Board running at ${uiServer.url}/board`);
-  info("Press Ctrl+C to stop.\n");
-  const skipOpen = process.env.BEASTMODE_NO_OPEN === "1" || !!process.env.DOCKER_CONTAINER;
-  if (!skipOpen) {
-    try {
-      const open = (await import("open")).default;
-      await open(`${uiServer.url}/board`);
-    } catch {
-      info(`Open ${uiServer.url}/board in your browser.`);
-    }
-  } else {
-    info(`Open ${uiServer.url}/board in your browser.`);
-  }
-  await new Promise((resolvePromise) => {
-    uiServer.server.on("close", resolvePromise);
-    process.on("SIGINT", async () => {
-      info("\nShutting down board server...");
-      await uiServer.shutdown();
-      resolvePromise();
-    });
-  });
-}
-
-// src/cli/commands/doctor.ts
+init_board();
 function tryExec(cmd, timeout = 8e3) {
   try {
     return execSync8(cmd, { encoding: "utf-8", timeout, stdio: ["pipe", "pipe", "pipe"] }).trim();
@@ -9439,7 +9793,7 @@ async function checkProjectGithubToken(env, factoryDir) {
     const envPath = join23(factoryDir, ".env");
     if (existsSync25(envPath)) {
       try {
-        const content = readFileSync21(envPath, "utf-8");
+        const content = readFileSync22(envPath, "utf-8");
         const dirLine = content.split("\n").find(
           (l) => l.trim().startsWith("PROJECT_DIR=") && !l.trim().startsWith("#")
         );
@@ -9672,7 +10026,7 @@ function checkProjectDirEnv(factoryDir) {
   }
   let content;
   try {
-    content = readFileSync21(envPath, "utf-8");
+    content = readFileSync22(envPath, "utf-8");
   } catch {
     return {
       label: "PROJECT_DIR (.env)",
@@ -10046,7 +10400,7 @@ function checkProjectDirectory(factoryDir) {
   let anyFail = false;
   for (const file of projectFiles) {
     try {
-      const proj = JSON.parse(readFileSync21(join23(projectsDir, file), "utf-8"));
+      const proj = JSON.parse(readFileSync22(join23(projectsDir, file), "utf-8"));
       const projPath = proj.path || "";
       const projName = proj.name || file.replace(".json", "");
       if (!projPath || !existsSync25(projPath)) {
@@ -10130,7 +10484,7 @@ function checkStack(factoryDir) {
   const stacks = [];
   for (const file of projectFiles) {
     try {
-      const proj = JSON.parse(readFileSync21(join23(projectsDir, file), "utf-8"));
+      const proj = JSON.parse(readFileSync22(join23(projectsDir, file), "utf-8"));
       const name = proj.name || file.replace(".json", "");
       const detected = proj.stack?.detected || "unknown";
       const build = proj.stack?.build_command || "";
@@ -10179,7 +10533,7 @@ function checkBoardPassword(env, factoryDir) {
     for (const filePath of [dotEnv, secretsEnv]) {
       if (existsSync25(filePath)) {
         try {
-          const content = readFileSync21(filePath, "utf-8");
+          const content = readFileSync22(filePath, "utf-8");
           const lines = content.split("\n");
           const line = lines.find((l) => l.startsWith("BEASTMODE_UI_PASSWORD="));
           if (line) {
@@ -10206,7 +10560,7 @@ function doctorAction(factoryDir, env) {
   let factoryIdentity = null;
   if (factoryDirExists) {
     try {
-      const raw = JSON.parse(readFileSync21(join23(bmDir, "factory.json"), "utf-8"));
+      const raw = JSON.parse(readFileSync22(join23(bmDir, "factory.json"), "utf-8"));
       factoryIdentity = FactoryIdentitySchema.parse(raw);
     } catch {
     }
@@ -10217,7 +10571,7 @@ function doctorAction(factoryDir, env) {
     const configPath = join23(bmDir, "config.json");
     if (existsSync25(configPath)) {
       try {
-        const raw = JSON.parse(readFileSync21(configPath, "utf-8"));
+        const raw = JSON.parse(readFileSync22(configPath, "utf-8"));
         const result = FactoryConfigSchema.safeParse(raw);
         if (result.success) {
           config = raw;
@@ -10238,7 +10592,7 @@ function doctorAction(factoryDir, env) {
       for (const file of readdirSync10(projectsDir)) {
         if (file.endsWith(".json")) {
           try {
-            const proj = JSON.parse(readFileSync21(join23(projectsDir, file), "utf-8"));
+            const proj = JSON.parse(readFileSync22(join23(projectsDir, file), "utf-8"));
             if (proj.path) {
               projectPaths.push({
                 name: proj.name || file.replace(".json", ""),
@@ -10252,42 +10606,357 @@ function doctorAction(factoryDir, env) {
       }
     }
   }
-  const installedPlugins = [];
-  if (factoryDirExists) {
-    const pluginsDir = join23(bmDir, "plugins");
-    if (existsSync25(pluginsDir)) {
-      for (const pluginName of readdirSync10(pluginsDir)) {
-        const manifestPath = join23(pluginsDir, pluginName, "manifest.json");
-        if (existsSync25(manifestPath)) {
-          try {
-            const manifest = JSON.parse(readFileSync21(manifestPath, "utf-8"));
-            installedPlugins.push({
-              name: pluginName,
-              engine_version: manifest.engine_version || "*"
+  const installedPlugins = [];
+  if (factoryDirExists) {
+    const pluginsDir = join23(bmDir, "plugins");
+    if (existsSync25(pluginsDir)) {
+      for (const pluginName of readdirSync10(pluginsDir)) {
+        const manifestPath = join23(pluginsDir, pluginName, "manifest.json");
+        if (existsSync25(manifestPath)) {
+          try {
+            const manifest = JSON.parse(readFileSync22(manifestPath, "utf-8"));
+            installedPlugins.push({
+              name: pluginName,
+              engine_version: manifest.engine_version || "*"
+            });
+          } catch {
+          }
+        }
+      }
+    }
+  }
+  const input = {
+    factoryDirExists,
+    factoryIdentity,
+    config,
+    configParseError,
+    env,
+    projectPaths,
+    installedPlugins,
+    engineVersion: ENGINE_VERSION,
+    portsInUse: []
+  };
+  return runDiagnostics(input);
+}
+var SYSTEMD_CREDS_TIMER = "beastmode-claude-creds.timer";
+var LAUNCH_AGENT_LABEL2 = "com.develeap.beastmode.claude-creds";
+function checkCredentialSyncAgent() {
+  const results = [];
+  const credsPath = join23(homedir3(), ".claude", ".credentials.json");
+  if (!existsSync25(credsPath)) {
+    results.push({
+      label: "Claude credentials file",
+      status: "fail",
+      detail: "~/.claude/.credentials.json not found",
+      fix: platform2() === "darwin" ? "Run `claude login` then `beastmode sync-claude-creds --install`" : "Run `claude login`"
+    });
+    return results;
+  }
+  results.push({
+    label: "Claude credentials file",
+    status: "pass",
+    detail: credsPath
+  });
+  try {
+    const creds = JSON.parse(readFileSync22(credsPath, "utf-8"));
+    const expiresAt = creds?.claudeAiOauth?.expiresAt;
+    if (typeof expiresAt === "number") {
+      const hoursLeft = Math.round((expiresAt - Date.now()) / 36e5);
+      if (hoursLeft < 0) {
+        results.push({
+          label: "Claude token expiry",
+          status: "fail",
+          detail: `Token expired ${Math.abs(hoursLeft)}h ago`,
+          fix: "Run `claude login` (then `beastmode sync-claude-creds` on macOS)"
+        });
+      } else if (hoursLeft < 2) {
+        results.push({
+          label: "Claude token expiry",
+          status: "warn",
+          detail: `Token expires in ${hoursLeft}h`,
+          fix: "Token will auto-refresh if the sync agent is running"
+        });
+      } else {
+        results.push({
+          label: "Claude token expiry",
+          status: "pass",
+          detail: `Token valid (${hoursLeft}h remaining)`
+        });
+      }
+    } else {
+      results.push({
+        label: "Claude token expiry",
+        status: "warn",
+        detail: "No expiry timestamp in credentials \u2014 cannot check freshness"
+      });
+    }
+  } catch {
+    results.push({
+      label: "Claude token expiry",
+      status: "warn",
+      detail: "credentials file exists but could not be parsed"
+    });
+  }
+  if (platform2() === "darwin") {
+    const uid = process.getuid?.();
+    const result = spawnSync3(
+      "launchctl",
+      ["print", `gui/${uid}/${LAUNCH_AGENT_LABEL2}`],
+      { stdio: "pipe", encoding: "utf-8" }
+    );
+    if (result.status === 0) {
+      results.push({
+        label: "Credential sync agent",
+        status: "pass",
+        detail: "launchd LaunchAgent loaded"
+      });
+    } else {
+      results.push({
+        label: "Credential sync agent",
+        status: "warn",
+        detail: "launchd LaunchAgent not loaded",
+        fix: "Run `beastmode sync-claude-creds --install`"
+      });
+    }
+  } else if (platform2() === "linux") {
+    const result = spawnSync3(
+      "systemctl",
+      ["--user", "is-active", SYSTEMD_CREDS_TIMER],
+      { stdio: "pipe", encoding: "utf-8" }
+    );
+    if ((result.stdout || "").trim() === "active") {
+      results.push({
+        label: "Credential sync agent",
+        status: "pass",
+        detail: `${SYSTEMD_CREDS_TIMER} active`
+      });
+    } else {
+      results.push({
+        label: "Credential sync agent",
+        status: "warn",
+        detail: `${SYSTEMD_CREDS_TIMER} not active`,
+        fix: "Run `beastmode sync-claude-creds --install`"
+      });
+    }
+  }
+  return results;
+}
+async function checkDaemonCredentialHealth() {
+  const ports = [8420, 8080];
+  let parsed = null;
+  let lastStatus = null;
+  for (const port of ports) {
+    const data2 = await new Promise(
+      (resolveProm) => {
+        const req = http3.get(
+          {
+            host: "127.0.0.1",
+            port,
+            path: "/api/credentials/status",
+            timeout: 5e3
+          },
+          (res) => {
+            let body = "";
+            res.on("data", (chunk) => {
+              body += chunk;
+            });
+            res.on("end", () => {
+              resolveProm({ status: res.statusCode ?? null, body });
+            });
+          }
+        );
+        req.on("error", () => resolveProm({ status: null, body: "" }));
+        req.on("timeout", () => {
+          req.destroy();
+          resolveProm({ status: null, body: "" });
+        });
+      }
+    );
+    if (data2.status !== null) {
+      lastStatus = data2.status;
+      if (data2.status >= 200 && data2.status < 300) {
+        try {
+          parsed = JSON.parse(data2.body);
+        } catch {
+          parsed = null;
+        }
+        break;
+      }
+    }
+  }
+  if (parsed === null) {
+    return [
+      {
+        label: "Daemon credential broker",
+        status: "info",
+        detail: lastStatus === null ? "Could not reach board API \u2014 Docker Compose may not be running (skipped)" : `Board API returned HTTP ${lastStatus}`
+      }
+    ];
+  }
+  const data = parsed;
+  if (data.healthy === null) {
+    return [
+      {
+        label: "Daemon credential broker",
+        status: "warn",
+        detail: "No credential status reported \u2014 daemon may not be running"
+      }
+    ];
+  }
+  if (data.stale === true) {
+    return [
+      {
+        label: "Daemon credential broker",
+        status: "warn",
+        detail: `Last status report is stale (reported at ${data.reported_at})`
+      }
+    ];
+  }
+  if (data.degraded === true) {
+    return [
+      {
+        label: "Daemon credential broker",
+        status: "fail",
+        detail: `Broker DEGRADED \u2014 ${data.consecutive_failures ?? "?"} consecutive auth failures`,
+        fix: "Run `claude login` then `beastmode sync-claude-creds`"
+      }
+    ];
+  }
+  if (data.token_expired === true) {
+    return [
+      {
+        label: "Daemon credential broker",
+        status: "fail",
+        detail: "Broker reports token is expired",
+        fix: "Run `claude login` (then `beastmode sync-claude-creds` on macOS)"
+      }
+    ];
+  }
+  return [
+    {
+      label: "Daemon credential broker",
+      status: "pass",
+      detail: `Healthy \u2014 token expires ${data.token_expires_at ?? "unknown"}`
+    }
+  ];
+}
+async function checkDaemonCredHealth() {
+  const ports = [8420, 8080];
+  let parsed = null;
+  let lastStatus = null;
+  for (const port of ports) {
+    const data2 = await new Promise(
+      (resolveProm) => {
+        const req = http3.get(
+          {
+            host: "127.0.0.1",
+            port,
+            path: "/api/daemon/cred-health",
+            timeout: 5e3
+          },
+          (res) => {
+            let body = "";
+            res.on("data", (chunk) => {
+              body += chunk;
+            });
+            res.on("end", () => {
+              resolveProm({ status: res.statusCode ?? null, body });
             });
-          } catch {
           }
-        }
+        );
+        req.on("error", () => resolveProm({ status: null, body: "" }));
+        req.on("timeout", () => {
+          req.destroy();
+          resolveProm({ status: null, body: "" });
+        });
+      }
+    );
+    if (data2.status !== null) {
+      lastStatus = data2.status;
+      try {
+        parsed = JSON.parse(data2.body);
+      } catch {
+        parsed = null;
       }
+      break;
     }
   }
-  const input = {
-    factoryDirExists,
-    factoryIdentity,
-    config,
-    configParseError,
-    env,
-    projectPaths,
-    installedPlugins,
-    engineVersion: ENGINE_VERSION,
-    portsInUse: []
-  };
-  return runDiagnostics(input);
+  if (lastStatus === null) {
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "info",
+        detail: "Board API not reachable \u2014 Docker Compose may not be running (skipped)"
+      }
+    ];
+  }
+  if (lastStatus === 503) {
+    const detail = parsed && typeof parsed.detail === "string" ? String(parsed.detail) : "Daemon hasn't reported credential state yet";
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "warn",
+        detail
+      }
+    ];
+  }
+  if (lastStatus !== 200 || parsed === null) {
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "warn",
+        detail: `Unexpected HTTP ${lastStatus} from /api/daemon/cred-health`
+      }
+    ];
+  }
+  const data = parsed;
+  const status = String(data.status ?? "unknown");
+  const urgent = data.urgency_marker_present === true;
+  if (status === "failed") {
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "fail",
+        detail: `Broker FAILED${urgent ? " (urgency marker present)" : ""}`,
+        fix: "Run `claude login` then `beastmode sync-claude-creds`"
+      }
+    ];
+  }
+  if (status === "degraded") {
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "warn",
+        detail: `Broker degraded${urgent ? " \u2014 urgency marker present" : ""}`,
+        fix: "Ensure the credential sync agent is running on the host"
+      }
+    ];
+  }
+  if (status === "healthy") {
+    const hours = data.token_hours_remaining;
+    const detail = typeof hours === "number" ? `Healthy \u2014 token has ${hours.toFixed(1)}h remaining` : "Healthy";
+    return [
+      {
+        label: "Daemon cred-health endpoint",
+        status: "pass",
+        detail
+      }
+    ];
+  }
+  return [
+    {
+      label: "Daemon cred-health endpoint",
+      status: "warn",
+      detail: `Unknown broker status: ${status}`
+    }
+  ];
 }
 function printCheck(check) {
   const labelPad = check.label.padEnd(22);
   if (check.status === "pass") {
     success(`${labelPad} ${check.detail}`);
+  } else if (check.status === "info") {
+    info(`${labelPad} ${check.detail}`);
   } else if (check.status === "warn") {
     warn(`${labelPad} ${check.detail}`);
     if (check.fix) {
@@ -10308,6 +10977,9 @@ var doctorCommand = new Command12("doctor").description("Health check \u2014 val
   const hasFactory = existsSync25(join23(factoryDir, ".beastmode"));
   const checks = [];
   checks.push(...await checkClaudeAuth(env.ANTHROPIC_API_KEY));
+  checks.push(...checkCredentialSyncAgent());
+  checks.push(...await checkDaemonCredentialHealth());
+  checks.push(...await checkDaemonCredHealth());
   checks.push(checkGithubToken(env));
   checks.push(await checkProjectGithubToken(env, hasFactory ? factoryDir : null));
   checks.push(checkGhcrPullToken(env));
@@ -10378,11 +11050,11 @@ init_schemas();
 init_version();
 init_display();
 import { Command as Command13 } from "commander";
-import { existsSync as existsSync27, readFileSync as readFileSync23, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync24, writeFileSync as writeFileSync20 } from "fs";
 import { join as join25, resolve as resolve16 } from "path";
 
 // src/cli/utils/regenerate.ts
-import { existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync19, copyFileSync } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync19, copyFileSync } from "fs";
 import { join as join24 } from "path";
 var RECOGNIZED_KEYS = /* @__PURE__ */ new Set([
   "PROJECT_DIR",
@@ -10509,7 +11181,7 @@ function regenerateFactoryFiles(factoryDir, now = /* @__PURE__ */ new Date()) {
       `docker-compose.yml not found at ${composePath}. This does not look like a beastmode factory \u2014 run 'beastmode init' first.`
     );
   }
-  const existingEnv = readFileSync22(envPath, "utf-8");
+  const existingEnv = readFileSync23(envPath, "utf-8");
   const values = parseExistingEnv(existingEnv);
   const missing = [];
   if (!values.projectDir) missing.push("PROJECT_DIR");
@@ -10527,7 +11199,7 @@ function regenerateFactoryFiles(factoryDir, now = /* @__PURE__ */ new Date()) {
   }
   const newEnv = buildNewEnv(values);
   const newCompose = generateComposeYaml("latest");
-  const existingCompose = readFileSync22(composePath, "utf-8");
+  const existingCompose = readFileSync23(composePath, "utf-8");
   const envChanged = newEnv !== existingEnv;
   const composeChanged = newCompose !== existingCompose;
   if (!envChanged && !composeChanged) {
@@ -10567,14 +11239,14 @@ function readIdentity(factoryDir) {
   if (!existsSync27(path)) {
     throw new Error("No factory.json found. Run beastmode init first.");
   }
-  return FactoryIdentitySchema.parse(JSON.parse(readFileSync23(path, "utf-8")));
+  return FactoryIdentitySchema.parse(JSON.parse(readFileSync24(path, "utf-8")));
 }
 function readConfig3(factoryDir) {
   const path = join25(factoryDir, ".beastmode", "config.json");
   if (!existsSync27(path)) {
     return {};
   }
-  return JSON.parse(readFileSync23(path, "utf-8"));
+  return JSON.parse(readFileSync24(path, "utf-8"));
 }
 function upgradeCheckAction(factoryDir) {
   const identity = readIdentity(factoryDir);
@@ -10674,12 +11346,15 @@ var upgradeCommand = new Command13("upgrade").description("Upgrade engine versio
   }
 });
 
+// src/index.ts
+init_board();
+
 // src/cli/commands/migrate.ts
 init_display();
 init_migrator();
 import { Command as Command14 } from "commander";
 import { resolve as resolve17, join as join26 } from "path";
-import { existsSync as existsSync28, readFileSync as readFileSync24, mkdirSync as mkdirSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync25, mkdirSync as mkdirSync16, writeFileSync as writeFileSync21 } from "fs";
 var migrateCommand = new Command14("migrate").description("Migrate a daemon config into a .beastmode/ factory").option("--config <path>", "Path to beastmode.daemon.json").option("--dry-run", "Show what would be created without writing files").action(async (opts) => {
   try {
     await runMigrate(opts);
@@ -10699,7 +11374,7 @@ async function runMigrate(opts) {
   }
   header("BeastMode Migrate");
   info(`Reading daemon config from: ${configPath}`);
-  const configContent = readFileSync24(configPath, "utf-8");
+  const configContent = readFileSync25(configPath, "utf-8");
   const daemonConfig = parseDaemonConfig(configContent);
   const runsDir = join26(cwd, "runs");
   let runDirs = [];
@@ -10717,7 +11392,7 @@ async function runMigrate(opts) {
       const cpPath = join26(runsDir, dir, "checkpoint.json");
       if (existsSync28(cpPath)) {
         try {
-          const cp = JSON.parse(readFileSync24(cpPath, "utf-8"));
+          const cp = JSON.parse(readFileSync25(cpPath, "utf-8"));
           checkpoints.set(dir, cp);
         } catch {
         }
@@ -10726,8 +11401,8 @@ async function runMigrate(opts) {
   }
   let worktreeOutput = "";
   try {
-    const { execSync: execSync10 } = await import("child_process");
-    worktreeOutput = execSync10("git worktree list", {
+    const { execSync: execSync11 } = await import("child_process");
+    worktreeOutput = execSync11("git worktree list", {
       cwd,
       encoding: "utf-8",
       timeout: 5e3
@@ -10813,12 +11488,13 @@ async function runMigrate(opts) {
 
 // src/cli/commands/run.ts
 init_display();
+init_board();
+init_bridge();
+init_schemas();
 import { Command as Command15 } from "commander";
 import { join as join27 } from "path";
-import { existsSync as existsSync29, readFileSync as readFileSync25, writeFileSync as writeFileSync22, mkdirSync as mkdirSync17 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync26, writeFileSync as writeFileSync22, mkdirSync as mkdirSync17 } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
-init_bridge();
-init_schemas();
 var runCommand = new Command15("run").description("Run a single pipeline task").argument("[project]", "Project name (defaults to first project)").option("--task <description>", "Task description").action(async (project, opts) => {
   try {
     await runPipeline(project, opts);
@@ -10844,7 +11520,7 @@ async function runPipeline(projectName, opts) {
     throw new Error("Factory config not found. Run 'beastmode init' first.");
   }
   const factoryConfig = FactoryConfigSchema.parse(
-    JSON.parse(readFileSync25(configPath, "utf-8"))
+    JSON.parse(readFileSync26(configPath, "utf-8"))
   );
   let projectConfig = null;
   const projectsDir = join27(bmDir, "projects");
@@ -10861,11 +11537,11 @@ async function runPipeline(projectName, opts) {
         throw new Error(`Project not found: ${projectName}`);
       }
       projectConfig = ProjectConfigSchema.parse(
-        JSON.parse(readFileSync25(join27(projectsDir, file), "utf-8"))
+        JSON.parse(readFileSync26(join27(projectsDir, file), "utf-8"))
       );
     } else if (projectFiles.length > 0) {
       projectConfig = ProjectConfigSchema.parse(
-        JSON.parse(readFileSync25(join27(projectsDir, projectFiles[0]), "utf-8"))
+        JSON.parse(readFileSync26(join27(projectsDir, projectFiles[0]), "utf-8"))
       );
       info(`Using project: ${projectConfig.name}`);
     }
@@ -10874,7 +11550,7 @@ async function runPipeline(projectName, opts) {
   let boardItems = [];
   if (existsSync29(boardPath)) {
     try {
-      const raw = JSON.parse(readFileSync25(boardPath, "utf-8"));
+      const raw = JSON.parse(readFileSync26(boardPath, "utf-8"));
       boardItems = Array.isArray(raw.items) ? raw.items : [];
     } catch {
       boardItems = [];
@@ -10899,14 +11575,14 @@ async function runPipeline(projectName, opts) {
   const daemonConfig = generateDaemonConfig(factoryConfig, projectConfig, factoryDir);
   writeFileSync22(daemonConfigPath, JSON.stringify(daemonConfig, null, 2), "utf-8");
   info(`Generated daemon config at: ${daemonConfigPath}`);
-  const { execSync: execSync10 } = await import("child_process");
+  const { execSync: execSync11 } = await import("child_process");
   let pythonAvailable = false;
   try {
-    execSync10("python --version", { timeout: 5e3, encoding: "utf-8" });
+    execSync11("python --version", { timeout: 5e3, encoding: "utf-8" });
     pythonAvailable = true;
   } catch {
     try {
-      execSync10("python3 --version", { timeout: 5e3, encoding: "utf-8" });
+      execSync11("python3 --version", { timeout: 5e3, encoding: "utf-8" });
       pythonAvailable = true;
     } catch {
     }
@@ -10934,8 +11610,8 @@ async function runPipeline(projectName, opts) {
   }
   const cmd = buildDaemonCommand(null, daemonConfigPath);
   info(`Spawning daemon: ${cmd.command} ${cmd.args.join(" ")}`);
-  const { spawn } = await import("child_process");
-  const child = spawn(cmd.command, cmd.args, {
+  const { spawn: spawn3 } = await import("child_process");
+  const child = spawn3(cmd.command, cmd.args, {
     stdio: "inherit",
     cwd: factoryDir,
     env: {
@@ -10948,7 +11624,7 @@ async function runPipeline(projectName, opts) {
   const startTime = Date.now();
   const pollInterval = setInterval(() => {
     try {
-      const board = JSON.parse(readFileSync25(boardPath, "utf-8"));
+      const board = JSON.parse(readFileSync26(boardPath, "utf-8"));
       const items = Array.isArray(board.items) ? board.items : [];
       const taskItem = items.find((i) => i.id === taskId);
       if (taskItem) {
@@ -10990,11 +11666,12 @@ async function runPipeline(projectName, opts) {
 
 // src/cli/commands/daemon-cmd.ts
 init_display();
-import { Command as Command16 } from "commander";
-import { join as join28 } from "path";
-import { existsSync as existsSync30, readFileSync as readFileSync26, writeFileSync as writeFileSync23, mkdirSync as mkdirSync18 } from "fs";
+init_board();
 init_bridge();
 init_schemas();
+import { Command as Command16 } from "commander";
+import { join as join28 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync27, writeFileSync as writeFileSync23, mkdirSync as mkdirSync18 } from "fs";
 var daemonCommand = new Command16("daemon").description("Start the BeastMode daemon via bridge").option("--dry-run", "Generate config but don't start daemon").option(
   "--log-level <level>",
   "Log level (DEBUG, INFO, WARNING, ERROR)",
@@ -11021,7 +11698,7 @@ async function runDaemon(opts) {
     throw new Error("Factory config not found. Run 'beastmode init' first.");
   }
   const factoryConfig = FactoryConfigSchema.parse(
-    JSON.parse(readFileSync26(configPath, "utf-8"))
+    JSON.parse(readFileSync27(configPath, "utf-8"))
   );
   let projectConfig = null;
   const projectsDir = join28(bmDir, "projects");
@@ -11032,7 +11709,7 @@ async function runDaemon(opts) {
     );
     if (projectFiles.length > 0) {
       projectConfig = ProjectConfigSchema.parse(
-        JSON.parse(readFileSync26(join28(projectsDir, projectFiles[0]), "utf-8"))
+        JSON.parse(readFileSync27(join28(projectsDir, projectFiles[0]), "utf-8"))
       );
       info(`Using project: ${projectConfig.name}`);
     }
@@ -11058,16 +11735,16 @@ async function runDaemon(opts) {
     console.log(JSON.stringify(daemonConfig, null, 2));
     return;
   }
-  const { execSync: execSync10 } = await import("child_process");
+  const { execSync: execSync11 } = await import("child_process");
   let pythonCmd = "python";
   let pythonAvailable = false;
   try {
-    execSync10("python --version", { timeout: 5e3, encoding: "utf-8" });
+    execSync11("python --version", { timeout: 5e3, encoding: "utf-8" });
     pythonAvailable = true;
     pythonCmd = "python";
   } catch {
     try {
-      execSync10("python3 --version", { timeout: 5e3, encoding: "utf-8" });
+      execSync11("python3 --version", { timeout: 5e3, encoding: "utf-8" });
       pythonAvailable = true;
       pythonCmd = "python3";
     } catch {
@@ -11085,8 +11762,8 @@ async function runDaemon(opts) {
   info(`Starting daemon: ${pythonCmd} ${cmd.args.join(" ")}`);
   console.log();
   const pidFile = join28(bmDir, "daemon.pid");
-  const { spawn } = await import("child_process");
-  const child = spawn(pythonCmd, cmd.args, {
+  const { spawn: spawn3 } = await import("child_process");
+  const child = spawn3(pythonCmd, cmd.args, {
     stdio: "inherit",
     cwd: factoryDir,
     env: {
@@ -11135,7 +11812,7 @@ var mcpCommand = new Command17("mcp").description("Start the BeastMode MCP serve
 init_display();
 import { Command as Command18 } from "commander";
 import { resolve as resolve19, join as join30 } from "path";
-import { existsSync as existsSync32, writeFileSync as writeFileSync25, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync32, writeFileSync as writeFileSync25, readFileSync as readFileSync29 } from "fs";
 import { execSync as execSync9 } from "child_process";
 import { randomBytes } from "crypto";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -11225,8 +11902,8 @@ async function runDeploy(opts) {
   const host = opts.host;
   const dotEnv = join30(factoryDir, ".env");
   const secretsEnv = join30(bmDir, "secrets.env.local");
-  const envContent = existsSync32(dotEnv) ? readFileSync28(dotEnv, "utf-8") : "";
-  const secretsContent = existsSync32(secretsEnv) ? readFileSync28(secretsEnv, "utf-8") : "";
+  const envContent = existsSync32(dotEnv) ? readFileSync29(dotEnv, "utf-8") : "";
+  const secretsContent = existsSync32(secretsEnv) ? readFileSync29(secretsEnv, "utf-8") : "";
   const hasPassword = envContent.includes("BEASTMODE_UI_PASSWORD=") && !envContent.includes("BEASTMODE_UI_PASSWORD=\n") || secretsContent.includes("BEASTMODE_UI_PASSWORD=") && !secretsContent.includes("BEASTMODE_UI_PASSWORD=\n") || !!process.env.BEASTMODE_UI_PASSWORD;
   if (!hasPassword && opts.host === "0.0.0.0") {
     const generated = randomBytes(18).toString("base64url");
@@ -11235,7 +11912,7 @@ async function runDeploy(opts) {
 # Auto-generated board UI password (deploy)
 BEASTMODE_UI_PASSWORD=${generated}
 `;
-    writeFileSync25(target, (existsSync32(target) ? readFileSync28(target, "utf-8") : "") + append, "utf-8");
+    writeFileSync25(target, (existsSync32(target) ? readFileSync29(target, "utf-8") : "") + append, "utf-8");
     info(`Board UI password auto-generated and saved to ${target}`);
     success(`Password: ${generated}`);
     info("Save this password \u2014 you'll need it to access the board UI.");
@@ -11561,7 +12238,63 @@ init_sync_claude_creds();
 
 // src/cli/commands/up.ts
 import { Command as Command19 } from "commander";
+import { spawnSync as spawnSync4 } from "child_process";
 init_display();
+var LAUNCH_AGENT_LABEL3 = "com.develeap.beastmode.claude-creds";
+var SYSTEMD_CREDS_TIMER2 = "beastmode-claude-creds.timer";
+async function ensureCredWatcher(cwd) {
+  const plat = process.platform;
+  if (plat !== "darwin" && plat !== "linux") return;
+  if (plat === "darwin") {
+    const uid = process.getuid?.();
+    const probe = spawnSync4(
+      "launchctl",
+      ["print", `gui/${uid}/${LAUNCH_AGENT_LABEL3}`],
+      { stdio: "pipe", encoding: "utf-8" }
+    );
+    if (probe.status === 0) return;
+  } else {
+    const probe = spawnSync4(
+      "systemctl",
+      ["--user", "is-active", SYSTEMD_CREDS_TIMER2],
+      { stdio: "pipe", encoding: "utf-8" }
+    );
+    if ((probe.stdout || "").trim() === "active") return;
+  }
+  info("Installing credential sync watcher for Docker daemon...");
+  try {
+    if (plat === "darwin") {
+      const { syncClaudeCredsOnce: syncClaudeCredsOnce2, installAgent: installAgent2 } = await Promise.resolve().then(() => (init_sync_claude_creds(), sync_claude_creds_exports));
+      const sync = syncClaudeCredsOnce2();
+      if ("error" in sync) {
+        warn(`Credential sync skipped: ${sync.error}`);
+        info(
+          "  Run `beastmode sync-claude-creds --install` after `claude login`."
+        );
+        return;
+      }
+      success(`Credentials synced: ${sync.path}`);
+      installAgent2(1800, { throwOnError: true, factoryDir: cwd });
+    } else {
+      const { syncClaudeCredsLinux: syncClaudeCredsLinux2, installAgentLinux: installAgentLinux2 } = await Promise.resolve().then(() => (init_sync_claude_creds(), sync_claude_creds_exports));
+      const sync = syncClaudeCredsLinux2();
+      if ("error" in sync) {
+        warn(`Credential sync skipped: ${sync.error}`);
+        info(
+          "  Run `beastmode sync-claude-creds --install` after `claude login`."
+        );
+        return;
+      }
+      success(`Credentials valid: ${sync.path}`);
+      installAgentLinux2(1800, { throwOnError: true });
+    }
+  } catch (e) {
+    warn(
+      `Credential watcher install failed: ${e instanceof Error ? e.message : String(e)}`
+    );
+    info("  Service startup continues \u2014 re-try with `beastmode sync-claude-creds --install`.");
+  }
+}
 async function runUp(opts) {
   const cwd = opts.cwd ?? process.cwd();
   requireComposeFile(cwd);
@@ -11569,6 +12302,7 @@ async function runUp(opts) {
     runCompose(["pull"], { cwd, inherit: true });
   }
   runCompose(["up", "-d"], { cwd, inherit: true });
+  await ensureCredWatcher(cwd);
 }
 var upCommand = new Command19("up").description("Start BeastMode services").option("--pull", "Pull latest images before starting").action(async (opts) => {
   try {
@@ -11652,13 +12386,13 @@ var logsCommand = new Command21("logs").description("Stream BeastMode service lo
 
 // src/cli/commands/update.ts
 import { Command as Command22 } from "commander";
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync26 } from "fs";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync26 } from "fs";
 init_display();
 async function runUpdate(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const composePath = requireComposeFile(cwd);
   if (opts.tag) {
-    let content = readFileSync29(composePath, "utf-8");
+    let content = readFileSync30(composePath, "utf-8");
     const tagPattern = new RegExp(
       `(${GHCR_IMAGE_PREFIX.replace(/[/]/g, "\\/")}\\/(?:board|daemon|ui)):([\\w.\\-]+)`,
       "g"
@@ -11685,9 +12419,340 @@ var updateCommand = new Command22("update").description("Pull latest BeastMode i
   }
 });
 
+// src/cli/commands/runner-cmd.ts
+init_display();
+import { Command as Command23 } from "commander";
+import { spawn as spawn2 } from "child_process";
+
+// src/cli/github-runners.ts
+var GitHubRunnerApiError = class extends Error {
+  status;
+  endpoint;
+  constructor(status, endpoint, message) {
+    super(message);
+    this.name = "GitHubRunnerApiError";
+    this.status = status;
+    this.endpoint = endpoint;
+  }
+};
+var GITHUB_API_BASE = "https://api.github.com";
+function buildHeaders(token) {
+  return {
+    Authorization: `token ${token}`,
+    Accept: "application/vnd.github.v3+json",
+    "User-Agent": "beastmode-cli"
+  };
+}
+function runnersUrl(owner, repo) {
+  return `${GITHUB_API_BASE}/repos/${owner}/${repo}/actions/runners`;
+}
+async function githubFetch(url, token, method = "GET", body) {
+  const resp = await fetch(url, {
+    method,
+    headers: buildHeaders(token),
+    body: body ? JSON.stringify(body) : void 0
+  });
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => "");
+    const endpoint = url.replace(GITHUB_API_BASE, "");
+    throw new GitHubRunnerApiError(
+      resp.status,
+      endpoint,
+      `GitHub API ${method} ${endpoint} \u2192 ${resp.status}: ${text}`
+    );
+  }
+  if (resp.status === 204) return void 0;
+  return await resp.json();
+}
+async function createRegistrationToken(config) {
+  const url = `${runnersUrl(config.owner, config.repo)}/registration-token`;
+  return githubFetch(url, config.token, "POST");
+}
+async function listRunners(config) {
+  const url = runnersUrl(config.owner, config.repo);
+  return githubFetch(url, config.token);
+}
+function resolveGitHubConfig() {
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (!token) {
+    throw new Error(
+      "GITHUB_TOKEN (or GH_TOKEN) not set. Add it to .env or export it."
+    );
+  }
+  const repo = process.env.PROJECT_REPO;
+  if (!repo || !repo.includes("/")) {
+    throw new Error(
+      "PROJECT_REPO not set or invalid (expected 'owner/repo'). Add it to .env."
+    );
+  }
+  const [owner, repoName] = repo.split("/", 2);
+  return { owner, repo: repoName, token };
+}
+
+// src/cli/runner-helpers.ts
+import { execSync as execSync10, spawn, spawnSync as spawnSync5 } from "child_process";
+import { promises as fs } from "fs";
+init_display();
+function resolveRepoSlug() {
+  let rawUrl;
+  try {
+    rawUrl = execSync10("git remote get-url origin", {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    throw new Error(
+      "Could not determine repo from git remote. Use --repo owner/repo."
+    );
+  }
+  const match = rawUrl.match(/github\.com[:/](.+?)(?:\.git)?$/) || rawUrl.match(/github\.com\/(.+?)(?:\.git)?$/);
+  if (!match) {
+    throw new Error(
+      `Could not parse GitHub repo from remote URL: ${rawUrl}`
+    );
+  }
+  return match[1];
+}
+async function pullImageIfNeeded(image) {
+  const inspect = spawnSync5("docker", ["image", "inspect", image], {
+    stdio: ["ignore", "ignore", "ignore"]
+  });
+  if (inspect.error && inspect.error.code === "ENOENT") {
+    throw new Error(
+      "Docker is required for the default runner. Install Docker, or use --native."
+    );
+  }
+  if (inspect.status === 0) return;
+  await new Promise((resolve20, reject) => {
+    const child = spawn("docker", ["pull", image], {
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    child.on("error", (err) => {
+      const e = err;
+      if (e.code === "ENOENT") {
+        reject(
+          new Error(
+            "Docker is required for the default runner. Install Docker, or use --native."
+          )
+        );
+      } else {
+        reject(err);
+      }
+    });
+    child.on("exit", (code) => {
+      if (code === 0) resolve20();
+      else reject(new Error(`docker pull ${image} exited with code ${code}`));
+    });
+  });
+}
+async function findContainerByName(name) {
+  const result = spawnSync5(
+    "docker",
+    ["inspect", name, "--format", "{{.State.Status}}"],
+    { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+  if (result.error && result.error.code === "ENOENT") {
+    throw new Error(
+      "Docker is required for the default runner. Install Docker, or use --native."
+    );
+  }
+  if (result.status !== 0) return null;
+  const status = (result.stdout || "").trim();
+  if (!status) return null;
+  return { name, status };
+}
+function containerIsHealthy(infoArg) {
+  return infoArg.status === "running";
+}
+async function removeContainer(name) {
+  const result = spawnSync5("docker", ["rm", "-f", name], {
+    stdio: ["ignore", "ignore", "pipe"],
+    encoding: "utf-8"
+  });
+  if (result.error && result.error.code === "ENOENT") {
+    throw new Error(
+      "Docker is required for the default runner. Install Docker, or use --native."
+    );
+  }
+  if (result.status !== 0) {
+    throw new Error(
+      `docker rm -f ${name} failed (exit ${result.status}): ${result.stderr || ""}`
+    );
+  }
+}
+async function startRunnerContainer(opts) {
+  const labelStr = opts.labels.join(",");
+  const args = [
+    "run",
+    "-d",
+    "--restart=unless-stopped",
+    "--name",
+    opts.name,
+    "-e",
+    `REPO_URL=${opts.repoUrl}`,
+    "-e",
+    `RUNNER_TOKEN=${opts.token}`,
+    "-e",
+    `LABELS=${labelStr}`,
+    "-e",
+    `RUNNER_NAME=${opts.name}`,
+    "-v",
+    "/var/run/docker.sock:/var/run/docker.sock",
+    "myoung34/github-runner:latest"
+  ];
+  const result = spawnSync5("docker", args, {
+    stdio: ["ignore", "ignore", "pipe"],
+    encoding: "utf-8"
+  });
+  if (result.error && result.error.code === "ENOENT") {
+    throw new Error(
+      "Docker is required for the default runner. Install Docker, or use --native."
+    );
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || "").replace(opts.token, "<REDACTED>");
+    throw new Error(
+      `docker run failed (exit ${result.status}): ${stderr}`
+    );
+  }
+}
+async function writeEnvEntries(entries, envPath = ".env") {
+  let existing = "";
+  try {
+    existing = await fs.readFile(envPath, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const lines = existing === "" ? [] : existing.split("\n");
+  const remainingKeys = new Set(Object.keys(entries));
+  const updated = lines.map((line) => {
+    for (const key of remainingKeys) {
+      if (line.startsWith(`${key}=`)) {
+        remainingKeys.delete(key);
+        return `${key}=${entries[key]}`;
+      }
+    }
+    return line;
+  });
+  for (const key of remainingKeys) {
+    updated.push(`${key}=${entries[key]}`);
+  }
+  let output = updated.join("\n");
+  if (existing !== "" && !existing.endsWith("\n") && !output.endsWith("\n")) {
+    output += "\n";
+  } else if (existing === "" && !output.endsWith("\n")) {
+    output += "\n";
+  }
+  await fs.writeFile(envPath, output, "utf-8");
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function pollUntilOnline(config, name, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const list = await listRunners(config);
+      const runner = list.runners.find((r) => r.name === name);
+      if (runner && runner.status === "online") return;
+    } catch {
+    }
+    if (Date.now() + 3e3 >= deadline) break;
+    await sleep(3e3);
+  }
+  throw new Error(
+    `Runner '${name}' did not appear online within ${Math.floor(
+      timeoutMs / 1e3
+    )}s \u2014 check container logs with: docker logs ${name}`
+  );
+}
+function setupStep(text) {
+  info(text);
+}
+
+// src/cli/commands/runner-cmd.ts
+var runnerCommand = new Command23("runner").description("Manage self-hosted GitHub Actions runners");
+async function runnerSetupAction(opts) {
+  if (opts.native) {
+    warn("--native is not implemented yet (Story 5)");
+    return;
+  }
+  const ghConfig = resolveGitHubConfig();
+  const repoSlug = opts.repo ?? resolveRepoSlug();
+  setupStep("Generating registration token via GitHub API...");
+  if (opts.dryRun) {
+    info(`[dry-run] Would start container '${opts.name}' for repo ${repoSlug}`);
+    return;
+  }
+  const { token: regToken } = await createRegistrationToken(ghConfig);
+  setupStep("Pulling myoung34/github-runner:latest...");
+  await pullImageIfNeeded("myoung34/github-runner:latest");
+  const existing = await findContainerByName(opts.name);
+  if (existing) {
+    if (containerIsHealthy(existing)) {
+      success(`Runner container '${opts.name}' already running \u2014 reusing.`);
+      return;
+    }
+    setupStep(
+      `Container '${opts.name}' exists but is dead \u2014 removing and recreating...`
+    );
+    await removeContainer(opts.name);
+  }
+  const repoUrl = `https://github.com/${ghConfig.owner}/${ghConfig.repo}`;
+  setupStep("Starting runner container...");
+  await startRunnerContainer({
+    name: opts.name,
+    repoUrl,
+    token: regToken,
+    labels: ["self-hosted", opts.label]
+  });
+  await writeEnvEntries({
+    RUNNER_REPO_URL: repoUrl,
+    RUNNER_TOKEN: regToken,
+    RUNNER_NAME: opts.name
+  });
+  setupStep("Waiting for runner to appear online on GitHub (timeout 60s)...");
+  await pollUntilOnline(ghConfig, opts.name, 6e4);
+  setupStep("Adding runner to docker-compose...");
+  await composeUpRunner();
+  success(`Runner '${opts.name}' registered and online.`);
+}
+async function composeUpRunner() {
+  await new Promise((resolve20, reject) => {
+    const child = spawn2(
+      "docker",
+      ["compose", "--profile", "runner", "up", "-d", "runner"],
+      { stdio: ["ignore", "inherit", "inherit"] }
+    );
+    child.on("error", (err) => reject(err));
+    child.on("exit", (code) => {
+      if (code === 0) resolve20();
+      else
+        reject(
+          new Error(
+            `docker compose --profile runner up -d runner exited with code ${code}`
+          )
+        );
+    });
+  });
+}
+runnerCommand.command("setup").description("Set up a self-hosted GitHub Actions runner").option("--repo <owner/repo>", "GitHub repo for runner registration").option("--name <name>", "Container + runner name", "beastmode-runner").option("--label <label>", "Additional runner label", "beastmode").option("--dry-run", "Print what would happen without mutating state").option("--native", "Use native install instead of Docker").action(async (opts) => {
+  await runnerSetupAction(opts);
+});
+runnerCommand.command("status").description("Show runner status (container + GitHub registration)").action(() => {
+  warn("runner status is not implemented yet (Story 3)");
+});
+runnerCommand.command("remove").description("Remove the runner (container + GitHub deregistration)").action(() => {
+  warn("runner remove is not implemented yet (Story 3)");
+});
+runnerCommand.command("switch-workflows").description("Switch workflow runs-on to self-hosted runner").action(() => {
+  warn("runner switch-workflows is not implemented yet (Story 4)");
+});
+runnerCommand.command("restore-workflows").description("Restore workflows to original runs-on values").action(() => {
+  warn("runner restore-workflows is not implemented yet (Story 4)");
+});
+
 // src/index.ts
 init_version();
-var program = new Command23();
+var program = new Command24();
 program.name("beastmode").description("BeastMode Dark Factory \u2014 turn intent into verified software").version(ENGINE_VERSION);
 program.addCommand(initCommand);
 program.addCommand(boardCommand);
@@ -11711,5 +12776,6 @@ program.addCommand(upCommand);
 program.addCommand(downCommand);
 program.addCommand(logsCommand);
 program.addCommand(updateCommand);
+program.addCommand(runnerCommand);
 program.parse();
 //# sourceMappingURL=index.js.map