@cabane/cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,1939 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+
+// src/commands/bridge.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { join as join2 } from "path";
+
+// src/log.ts
+var BOLD = "\x1B[1m";
+var RED = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RESET = "\x1B[0m";
+var useColor = () => process.stderr.isTTY === true && !process.env.NO_COLOR;
+var paint = (code, s) => useColor() ? `${code}${s}${RESET}` : s;
+function step(msg) {
+  process.stderr.write(`${paint(BOLD, "\u203A")} ${msg}
+`);
+}
+function info(msg) {
+  process.stderr.write(`  ${msg}
+`);
+}
+function ok(msg) {
+  process.stderr.write(`${paint(GREEN, "\u2713")} ${msg}
+`);
+}
+function warn(msg) {
+  process.stderr.write(`${paint(YELLOW, "\u26A0")} ${msg}
+`);
+}
+function error(msg) {
+  process.stderr.write(`${paint(RED, "\u2717")} ${msg}
+`);
+}
+
+// src/paths.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var SELFHOST_DIRNAME = ".cabane-selfhost";
+var LEGACY_DIRNAME = ".cabane";
+function classifyHome(dir) {
+  if (existsSync(join(dir, "app"))) return "selfhost";
+  let cfg = null;
+  try {
+    cfg = JSON.parse(readFileSync(join(dir, "config.json"), "utf8"));
+  } catch {
+    cfg = null;
+  }
+  if (cfg) {
+    if (typeof cfg.distBase === "string" || typeof cfg.pgPort === "number") return "selfhost";
+    if (typeof cfg.baseUrl === "string" || typeof cfg.deviceToken === "string") return "bridge";
+  }
+  return "empty";
+}
+function defaultRoot(home = homedir()) {
+  const selfhost = join(home, SELFHOST_DIRNAME);
+  if (existsSync(selfhost)) return selfhost;
+  const legacy = join(home, LEGACY_DIRNAME);
+  if (classifyHome(legacy) === "selfhost") return legacy;
+  return selfhost;
+}
+function cabaneHome() {
+  return process.env.CABANE_HOME && process.env.CABANE_HOME.length > 0 ? process.env.CABANE_HOME : defaultRoot();
+}
+function resolvePaths(root = cabaneHome(), dataDir) {
+  const data = dataDir && dataDir.length > 0 ? dataDir : join(root, "data");
+  return {
+    root,
+    configFile: join(root, "config.json"),
+    appsDir: join(root, "app"),
+    dataDir: data,
+    pgDataDir: join(data, "pg"),
+    storageRoot: join(data, "storage"),
+    bridgeHome: join(root, "bridge"),
+    logsDir: join(root, "logs"),
+    serverLog: join(root, "logs", "server.log"),
+    bridgeLog: join(root, "logs", "bridge.log"),
+    runDir: join(root, "run"),
+    supervisorPidFile: join(root, "run", "supervisor.pid"),
+    stateFile: join(root, "run", "state.json")
+  };
+}
+function assertNotForeignBridge(root = cabaneHome()) {
+  if (classifyHome(root) !== "bridge") return;
+  throw new Error(
+    `${root} holds a standalone @cabane/bridge config (a device pairing), not a Cabane self-host install \u2014 refusing to write here and overwrite it.
+Self-host defaults to ~/.cabane-selfhost; unset CABANE_HOME, or point it at a different directory.`
+  );
+}
+function appDirFor(paths, version) {
+  return join(paths.appsDir, version);
+}
+
+// src/proc.ts
+import { spawn } from "child_process";
+function run(cmd, args, opts = {}) {
+  const { allowFail, ...spawnOpts } = opts;
+  return new Promise((resolve2, reject) => {
+    const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"], ...spawnOpts });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => stdout += d.toString());
+    child.stderr?.on("data", (d) => stderr += d.toString());
+    child.on("error", reject);
+    child.on("close", (code) => {
+      const result = { code: code ?? 0, stdout, stderr };
+      if (code === 0 || allowFail) resolve2(result);
+      else
+        reject(
+          new Error(`${cmd} ${args.join(" ")} exited ${code}
+${stderr.trim() || stdout.trim()}`)
+        );
+    });
+  });
+}
+async function waitUntil(check, { timeoutMs, intervalMs = 500 }) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      if (await check()) return true;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return false;
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function portInUse(port) {
+  const { createServer } = await import("net");
+  return new Promise((resolve2) => {
+    const srv = createServer();
+    srv.once("error", (err) => resolve2(err.code === "EADDRINUSE"));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(false)));
+  });
+}
+
+// src/commands/bridge.ts
+var STATE_DIRS = ["cursors", "dispatched", "completed", "resume-attempts"];
+async function bridgeReset(opts = {}) {
+  const paths = resolvePaths();
+  const bridgeCabane = join2(paths.bridgeHome, ".cabane");
+  const running = bridgeRunning(paths.stateFile);
+  if (running && !opts.force) {
+    warn("the bridge is running \u2014 a reset only takes effect on the next boot.");
+    info("stop it first (`cabane down`), or re-run with `--force` to clear anyway.");
+    return;
+  }
+  let cleared = 0;
+  for (const dir of STATE_DIRS) {
+    const target = join2(bridgeCabane, dir);
+    if (existsSync2(target)) {
+      rmSync(target, { recursive: true, force: true });
+      cleared += 1;
+    }
+  }
+  if (cleared === 0) {
+    ok("bridge resume state already clean \u2014 nothing to reset.");
+  } else {
+    ok(`cleared bridge resume state (${cleared} of ${STATE_DIRS.length} stores).`);
+    info(
+      "the bridge will start fresh (no interrupted turn to replay) on the next `cabane up`."
+    );
+  }
+}
+function bridgeRunning(stateFile) {
+  try {
+    const state = JSON.parse(readFileSync2(stateFile, "utf8"));
+    return state.bridgePid ? pidAlive(state.bridgePid) : false;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/doctor.ts
+import { writeSync } from "fs";
+import { homedir as homedir2 } from "os";
+
+// src/config.ts
+import { mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { dirname } from "path";
+var DEFAULT_DIST_BASE = "https://app.cabane.ai";
+var DEFAULT_PORT = 3e3;
+var DEFAULT_PG_PORT = 55432;
+function defaultConfig() {
+  return {
+    distBase: DEFAULT_DIST_BASE,
+    port: DEFAULT_PORT,
+    pgPort: DEFAULT_PG_PORT
+  };
+}
+function loadConfig(root) {
+  const file = resolvePaths(root).configFile;
+  try {
+    const parsed = JSON.parse(readFileSync3(file, "utf8"));
+    return { ...defaultConfig(), ...parsed };
+  } catch {
+    return defaultConfig();
+  }
+}
+function saveConfig(config, root) {
+  const file = resolvePaths(root).configFile;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function updateConfig(mutate, root) {
+  const config = loadConfig(root);
+  mutate(config);
+  saveConfig(config, root);
+  return config;
+}
+function pathsFor(config, root) {
+  return resolvePaths(root, config.dataDir);
+}
+
+// src/doctor/checks.ts
+import { createRequire } from "module";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { statfs } from "fs/promises";
+import { dirname as dirname2, join as join3 } from "path";
+import { pathToFileURL } from "url";
+
+// src/doctor/types.ts
+var pass = (id, name, detail) => ({
+  id,
+  name,
+  status: "pass",
+  detail
+});
+var warn2 = (id, name, detail, fix) => ({
+  id,
+  name,
+  status: "warn",
+  detail,
+  ...fix ? { fix } : {}
+});
+var fail = (id, name, detail, fix) => ({
+  id,
+  name,
+  status: "fail",
+  detail,
+  ...fix ? { fix } : {}
+});
+var skip = (id, name, detail) => ({
+  id,
+  name,
+  status: "skip",
+  detail
+});
+
+// src/doctor/checks.ts
+var NODE_FLOOR_FALLBACK = "22";
+function parseMajor(v) {
+  const m = /^v?(\d+)/.exec(v.trim());
+  return m ? Number(m[1]) : NaN;
+}
+function evaluateNode(current, floor) {
+  const cur = parseMajor(current);
+  const min = parseMajor(floor);
+  if (Number.isNaN(cur) || Number.isNaN(min)) {
+    return warn2("node", "Node", `could not compare v${current} against floor "${floor}"`);
+  }
+  if (cur >= min) return pass("node", "Node", `v${current} (\u2265 ${min} required)`);
+  return fail(
+    "node",
+    "Node",
+    `v${current} is below the required Node ${min}`,
+    `Install Node ${min}+ (e.g. \`nvm install ${min}\`) and re-run.`
+  );
+}
+function checkNode(ctx) {
+  const floor = installedNodeFloor(ctx) ?? NODE_FLOOR_FALLBACK;
+  return evaluateNode(ctx.sys.nodeVersion, floor);
+}
+async function checkPort(ctx) {
+  const port = ctx.config.port;
+  if (!await portInUse(port)) return pass("port", "Port", `:${port} is free`);
+  const ours = ownSupervisorPid(ctx.paths);
+  if (ours) {
+    return pass("port", "Port", `:${port} in use by a running cabane (supervisor pid ${ours})`);
+  }
+  return fail(
+    "port",
+    "Port",
+    `:${port} is occupied by another process`,
+    `Free port ${port}, or install on another with \`cabane install --port <n>\`, then retry.`
+  );
+}
+function ownSupervisorPid(paths) {
+  try {
+    const pid = Number(readFileSync4(paths.supervisorPidFile, "utf8").trim());
+    return pid > 0 && pidAlive(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+var GiB = 1024 ** 3;
+var DISK_WARN_BYTES = 2 * GiB;
+var DISK_FAIL_BYTES = 500 * 1024 ** 2;
+function evaluateDisk(freeBytes, where) {
+  const gb = (freeBytes / GiB).toFixed(1);
+  if (freeBytes < DISK_FAIL_BYTES) {
+    return fail(
+      "disk",
+      "Disk",
+      `${gb} GB free on ${where} \u2014 critically low`,
+      "Free up disk space; Cabane needs room for the Postgres data dir + file storage."
+    );
+  }
+  if (freeBytes < DISK_WARN_BYTES) {
+    return warn2(
+      "disk",
+      "Disk",
+      `${gb} GB free on ${where} \u2014 low`,
+      "Consider freeing space; Postgres and uploads grow over time."
+    );
+  }
+  return pass("disk", "Disk", `${gb} GB free on ${where}`);
+}
+async function checkDisk(ctx) {
+  const probe = nearestExisting(ctx.paths.dataDir);
+  const st = await statfs(probe);
+  const free = st.bavail * st.bsize;
+  return evaluateDisk(free, probe);
+}
+function checkStorage(ctx) {
+  const root = ctx.paths.storageRoot;
+  const target = existsSync3(root) ? root : nearestExisting(root);
+  if (!isWritableDir(target)) {
+    return fail(
+      "storage",
+      "Storage root",
+      `${root} is not writable (${target} is read-only)`,
+      `Make ${target} writable, or point Cabane elsewhere with \`CABANE_HOME=<dir>\`.`
+    );
+  }
+  const note = existsSync3(root) ? "" : " (will be created on first `cabane up`)";
+  return pass("storage", "Storage root", `${root} \u2014 writable${note}`);
+}
+async function resolvePgBinaries(platform, arch) {
+  const pkg = pgPlatformPackage(platform, arch);
+  if (!pkg) return null;
+  try {
+    const cliRequire = createRequire(import.meta.url);
+    let entry;
+    try {
+      const epRequire = createRequire(cliRequire.resolve("embedded-postgres"));
+      entry = epRequire.resolve(pkg);
+    } catch {
+      entry = cliRequire.resolve(pkg);
+    }
+    const mod = await import(pathToFileURL(entry).href);
+    if (!mod.postgres || !mod.initdb || !mod.pg_ctl) return null;
+    return { postgres: mod.postgres, initdb: mod.initdb, pg_ctl: mod.pg_ctl };
+  } catch {
+    return null;
+  }
+}
+function pgPlatformPackage(platform, arch) {
+  const map = {
+    darwin: { arm64: "darwin-arm64", x64: "darwin-x64" },
+    linux: {
+      arm64: "linux-arm64",
+      arm: "linux-arm",
+      ia32: "linux-ia32",
+      ppc64: "linux-ppc64",
+      x64: "linux-x64"
+    },
+    win32: { x64: "windows-x64" }
+  };
+  const slug = map[platform]?.[arch];
+  return slug ? `@embedded-postgres/${slug}` : null;
+}
+async function checkPostgres(ctx) {
+  const { platform, arch } = ctx.sys;
+  const bin = await resolvePgBinaries(platform, arch);
+  if (!bin) {
+    return fail(
+      "postgres",
+      "Embedded Postgres",
+      `no Postgres binaries for ${platform}-${arch}`,
+      "Reinstall the CLI so the platform Postgres package is present (`npm i -g @cabane/cli`)."
+    );
+  }
+  const dataDir = ctx.paths.pgDataDir;
+  if (!existsSync3(join3(dataDir, "PG_VERSION"))) {
+    return pass(
+      "postgres",
+      "Embedded Postgres",
+      `binaries present; data dir uninitialised \u2014 first \`cabane up\` will init it (${dataDir})`
+    );
+  }
+  const stale = stalePostmaster(dataDir);
+  if (stale) {
+    return warn2(
+      "postgres",
+      "Embedded Postgres",
+      `data dir initialised but holds a stale postmaster.pid (pid ${stale}, not running) \u2014 ${dataDir}`,
+      "Harmless \u2014 Postgres clears it on the next `cabane up`; remove data/pg/postmaster.pid if start still refuses."
+    );
+  }
+  return pass("postgres", "Embedded Postgres", `binaries present; data dir healthy \u2014 ${dataDir}`);
+}
+function stalePostmaster(dataDir) {
+  try {
+    const pid = Number(
+      readFileSync4(join3(dataDir, "postmaster.pid"), "utf8").split("\n")[0]?.trim()
+    );
+    return pid > 0 && !pidAlive(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+async function checkGatekeeper(ctx) {
+  const { platform, arch } = ctx.sys;
+  if (platform !== "darwin") return skip("gatekeeper", "macOS Gatekeeper", "not macOS \u2014 n/a");
+  const bin = await resolvePgBinaries(platform, arch);
+  if (!bin) return skip("gatekeeper", "macOS Gatekeeper", "Postgres binaries not found \u2014 n/a");
+  if (await hasQuarantine(bin.postgres)) {
+    return fail(
+      "gatekeeper",
+      "macOS Gatekeeper",
+      "the Postgres binaries are quarantined \u2014 Gatekeeper will block them from running",
+      `Clear it: \`xattr -dr com.apple.quarantine "${dirname2(dirname2(bin.postgres))}"\`, then retry.`
+    );
+  }
+  return pass("gatekeeper", "macOS Gatekeeper", "Postgres binaries are not quarantined");
+}
+async function hasQuarantine(file) {
+  try {
+    const res = await run("xattr", ["-p", "com.apple.quarantine", file], { allowFail: true });
+    return res.code === 0;
+  } catch {
+    return false;
+  }
+}
+var CREDENTIAL_SOURCE = {
+  subscription: "Claude subscription login (~/.claude)",
+  "env-api-key": "ANTHROPIC_API_KEY (env or `cabane set-env`)",
+  "env-auth-token": "ANTHROPIC_AUTH_TOKEN (env or `cabane set-env`)",
+  "settings-api-key": "ANTHROPIC_API_KEY in Claude settings.json"
+};
+function evaluateExecutor(p) {
+  const name = "Executor (Claude Code)";
+  if (!p.binaryFound) {
+    return fail(
+      "executor",
+      name,
+      `\`${p.binaryName}\` is not on PATH \u2014 the house bridge has no executor to run`,
+      "Install Claude Code (or your chosen executor) and make sure it is on PATH."
+    );
+  }
+  const apiKeyOnly = p.credential === "env-api-key" || p.credential === "env-auth-token" || p.credential === "settings-api-key";
+  if (p.forceLoginMethod === "claudeai" && apiKeyOnly) {
+    return fail(
+      "executor",
+      name,
+      "a Claude Code managed policy forces subscription login (`forceLoginMethod: claudeai`), which refuses your API key",
+      "Log in with the required method (`claude` \u2192 /login), or remove the managed-settings force-login policy."
+    );
+  }
+  if (!p.credential) {
+    return fail(
+      "executor",
+      name,
+      "no executor credential is reachable by the house bridge",
+      "Log in to Claude Code, or persist a key with `cabane set-env ANTHROPIC_API_KEY=\u2026`, or export it before `cabane up`."
+    );
+  }
+  return pass(
+    "executor",
+    name,
+    `\`${p.binaryName}\` present; credential reachable via ${CREDENTIAL_SOURCE[p.credential]} (reachability only \u2014 not verified against the provider)`
+  );
+}
+function checkExecutor(ctx) {
+  return evaluateExecutor(probeExecutor(ctx));
+}
+function probeExecutor(ctx) {
+  const { env, homeDir } = ctx.sys;
+  const cred = (key) => {
+    const v = env[key] ?? ctx.config.bridgeEnv?.[key];
+    return typeof v === "string" && v.length > 0;
+  };
+  const configDir = env.CLAUDE_CONFIG_DIR ?? join3(homeDir, ".claude");
+  let credential = null;
+  if (cred("ANTHROPIC_API_KEY")) credential = "env-api-key";
+  else if (cred("ANTHROPIC_AUTH_TOKEN")) credential = "env-auth-token";
+  else if (existsSync3(join3(configDir, ".credentials.json"))) credential = "subscription";
+  else if (settingsHasApiKey(join3(configDir, "settings.json"))) credential = "settings-api-key";
+  return {
+    binaryName: "claude",
+    binaryFound: onPath("claude", env),
+    forceLoginMethod: readForceLoginMethod(ctx.sys),
+    credential
+  };
+}
+function settingsHasApiKey(file) {
+  try {
+    const s = JSON.parse(readFileSync4(file, "utf8"));
+    return Boolean(s.env?.ANTHROPIC_API_KEY || s.apiKeyHelper);
+  } catch {
+    return false;
+  }
+}
+function managedSettingsPath(sys) {
+  switch (sys.platform) {
+    case "darwin":
+      return "/Library/Application Support/ClaudeCode/managed-settings.json";
+    case "linux":
+      return "/etc/claude-code/managed-settings.json";
+    case "win32":
+      return join3(sys.env.PROGRAMDATA ?? "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+    default:
+      return null;
+  }
+}
+function readForceLoginMethod(sys) {
+  const path = managedSettingsPath(sys);
+  if (!path) return null;
+  try {
+    const s = JSON.parse(readFileSync4(path, "utf8"));
+    return s.forceLoginMethod ?? null;
+  } catch {
+    return null;
+  }
+}
+function onPath(bin, env) {
+  const dirs = (env.PATH ?? "").split(process.platform === "win32" ? ";" : ":");
+  const names = process.platform === "win32" ? [bin, `${bin}.exe`, `${bin}.cmd`] : [bin];
+  for (const dir of dirs) {
+    if (!dir) continue;
+    for (const name of names) if (existsSync3(join3(dir, name))) return true;
+  }
+  return false;
+}
+function evaluateVersions(input) {
+  const name = "Bridge/server version";
+  const { serverVersion, bridgeVersion } = input;
+  if (!serverVersion) {
+    return skip("versions", name, "no server artifact installed yet \u2014 run `cabane install`");
+  }
+  if (!bridgeVersion) {
+    return warn2(
+      "versions",
+      name,
+      `the installed artifact ships no bundled bridge to check against (server ${serverVersion})`,
+      "Reinstall the server artifact \u2014 a current build bundles its own bridge (`cabane install`)."
+    );
+  }
+  if (bridgeVersion === serverVersion) {
+    return pass("versions", name, `bundled bridge and server both ${serverVersion} (lockstep)`);
+  }
+  return fail(
+    "versions",
+    name,
+    `bundled bridge ${bridgeVersion} \u2260 server ${serverVersion} \u2014 a version skew (they must ship from one build)`,
+    "Reinstall a single matching artifact with `cabane install` so the bundled bridge and server are the same version."
+  );
+}
+function checkVersions(ctx) {
+  return evaluateVersions({
+    serverVersion: ctx.config.currentVersion ?? null,
+    bridgeVersion: readBundledBridgeVersion(ctx)
+  });
+}
+function readBundledBridgeVersion(ctx) {
+  const version = ctx.config.currentVersion;
+  if (!version) return null;
+  try {
+    const pkg = JSON.parse(
+      readFileSync4(join3(appDirFor(ctx.paths, version), "bridge", "package.json"), "utf8")
+    );
+    return pkg.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function installedNodeFloor(ctx) {
+  const version = ctx.config.currentVersion;
+  if (!version) return null;
+  try {
+    const manifest = JSON.parse(
+      readFileSync4(join3(appDirFor(ctx.paths, version), "manifest.json"), "utf8")
+    );
+    return manifest.nodeFloor ?? null;
+  } catch {
+    return null;
+  }
+}
+function nearestExisting(path) {
+  let cur = path;
+  while (!existsSync3(cur)) {
+    const parent = dirname2(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return cur;
+}
+function isWritableDir(dir) {
+  try {
+    const probe = mkdtempSync(join3(dir, ".cabane-doctor-"));
+    writeFileSync2(join3(probe, "w"), "");
+    rmSync2(probe, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/doctor/report.ts
+function summarize(results) {
+  const count = (s) => results.filter((r) => r.status === s).length;
+  const failed = count("fail");
+  return {
+    results,
+    passed: count("pass"),
+    warned: count("warn"),
+    failed,
+    skipped: count("skip"),
+    ok: failed === 0
+  };
+}
+var STATUS_GLYPH = {
+  pass: "\u2713",
+  warn: "\u26A0",
+  fail: "\u2717",
+  skip: "\u2013"
+};
+var NAME_WIDTH = 22;
+function reportLines(summary) {
+  const lines = ["cabane doctor", ""];
+  for (const r of summary.results) {
+    lines.push(`${STATUS_GLYPH[r.status]} ${r.name.padEnd(NAME_WIDTH)} ${r.detail}`);
+    if (r.fix) lines.push(`  ${" ".repeat(NAME_WIDTH)} \u21B3 fix: ${r.fix}`);
+  }
+  lines.push("");
+  lines.push(rollup(summary));
+  return lines;
+}
+function rollup(s) {
+  const parts = [`${s.results.length} checks`, `${s.passed} passed`];
+  if (s.warned) parts.push(`${s.warned} warn`);
+  if (s.failed) parts.push(`${s.failed} failed`);
+  if (s.skipped) parts.push(`${s.skipped} skipped`);
+  const verdict = s.ok ? "all clear" : "problems found";
+  return `${parts.join(" \xB7 ")} \u2014 ${verdict}`;
+}
+
+// src/commands/doctor.ts
+var CHECKS = [
+  { run: checkNode },
+  { run: checkExecutor },
+  { run: checkPort },
+  { run: checkPostgres },
+  { run: checkStorage },
+  { run: checkVersions },
+  { run: checkDisk },
+  { run: checkGatekeeper }
+];
+async function doctor() {
+  const config = loadConfig();
+  const ctx = {
+    paths: pathsFor(config),
+    config,
+    sys: {
+      platform: process.platform,
+      arch: process.arch,
+      nodeVersion: process.versions.node,
+      env: process.env,
+      homeDir: homedir2()
+    }
+  };
+  const results = [];
+  for (const check of CHECKS) {
+    try {
+      results.push(await check.run(ctx));
+    } catch (err) {
+      results.push(
+        fail("unknown", "Check errored", err instanceof Error ? err.message : String(err))
+      );
+    }
+  }
+  const summary = summarize(results);
+  const text = reportLines(summary).map(colorize).join("\n") + "\n";
+  try {
+    writeSync(1, text);
+  } catch {
+    process.stdout.write(text);
+  }
+  process.exit(summary.ok ? 0 : 1);
+}
+var COLOR = {
+  [STATUS_GLYPH.pass]: "[32m",
+  // green
+  [STATUS_GLYPH.warn]: "[33m",
+  // yellow
+  [STATUS_GLYPH.fail]: "[31m",
+  // red
+  [STATUS_GLYPH.skip]: "[2m"
+  // dim
+};
+var RESET2 = "[0m";
+function colorize(line) {
+  if (process.stdout.isTTY !== true || process.env.NO_COLOR) return line;
+  const glyph = line[0];
+  const code = glyph ? COLOR[glyph] : void 0;
+  return code ? `${code}${glyph}${RESET2}${line.slice(1)}` : line;
+}
+
+// src/commands/down.ts
+import { readFileSync as readFileSync5, rmSync as rmSync3 } from "fs";
+import { join as join4 } from "path";
+async function down() {
+  const config = loadConfig();
+  const paths = pathsFor(config);
+  const state = readState(paths.stateFile);
+  const supervisorPid = readPid(paths.supervisorPidFile) ?? state.supervisorPid;
+  const port = state.port ?? config.port;
+  if (supervisorPid && pidAlive(supervisorPid)) {
+    step(`stopping supervisor (pid ${supervisorPid})\u2026`);
+    await killPid(supervisorPid);
+  } else {
+    info("no live supervisor \u2014 reaping any orphaned children.");
+  }
+  for (const pid of [
+    state.bridgePid,
+    state.serverPid,
+    readPid(join4(paths.pgDataDir, "postmaster.pid"))
+  ]) {
+    if (pid && pidAlive(pid)) await killPid(pid);
+  }
+  const free = await waitUntil(async () => !await portInUse(port), {
+    timeoutMs: 15e3,
+    intervalMs: 300
+  });
+  rmSync3(paths.supervisorPidFile, { force: true });
+  rmSync3(paths.stateFile, { force: true });
+  if (free) ok("stopped");
+  else warn(`stopped, but port ${port} still looks busy \u2014 check \`cabane status\`.`);
+}
+async function killPid(pid) {
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const gone = await waitUntil(async () => !pidAlive(pid), { timeoutMs: 8e3, intervalMs: 250 });
+  if (!gone) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+}
+function readState(file) {
+  try {
+    return JSON.parse(readFileSync5(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function readPid(file) {
+  try {
+    const pid = Number(readFileSync5(file, "utf8").trim());
+    return pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { isAbsolute, join as join5, resolve } from "path";
+
+// src/artifact.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
+function readTarballManifest(tarball) {
+  const raw = execFileSync("tar", ["-xzOf", tarball, "./manifest.json"], {
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return JSON.parse(raw.toString("utf8"));
+}
+function unpackArtifact(tarball, destDir) {
+  mkdirSync2(destDir, { recursive: true });
+  execFileSync("tar", ["-xzf", tarball, "-C", destDir], { stdio: "inherit" });
+}
+async function npmInstall(appDir) {
+  await run("npm", ["install", "--omit=dev", "--legacy-peer-deps", "--no-audit", "--no-fund"], {
+    cwd: appDir,
+    stdio: ["ignore", "inherit", "inherit"]
+  });
+}
+function isInstalled(appDir) {
+  return existsSync4(appDir) && existsSync4(`${appDir}/node_modules`) && existsSync4(`${appDir}/server.js`);
+}
+
+// src/prompt.ts
+import { createInterface } from "readline";
+function isInteractive() {
+  return process.stdin.isTTY === true;
+}
+async function promptLine(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve2) => rl.question(question, resolve2));
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function promptSecret(question) {
+  if (!isInteractive()) return promptLine(question);
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stderr,
+    terminal: true
+  });
+  let muted = false;
+  rl._writeToOutput = (s) => {
+    if (!muted) process.stderr.write(s);
+  };
+  try {
+    const answer = await new Promise((resolve2) => {
+      rl.question(question, resolve2);
+      muted = true;
+    });
+    process.stderr.write("\n");
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+
+// src/commands/init.ts
+var EXECUTOR_KEY = "ANTHROPIC_API_KEY";
+async function init() {
+  if (!isInteractive()) {
+    throw new Error(
+      "`cabane init` is an interactive wizard \u2014 run it in a terminal, or configure non-interactively with `cabane install --port \u2026` + `cabane set-env KEY=VALUE`."
+    );
+  }
+  assertNotForeignBridge();
+  const root = cabaneHome();
+  const config = loadConfig();
+  step("Configure your self-hosted Cabane");
+  info(`home: ${root} (config + installed app)`);
+  info("");
+  const currentDataDir = pathsFor(config, root).dataDir;
+  const dataAnswer = await promptLine(
+    `Where should your workspace data live? [${currentDataDir}]
+  (uploaded files \u2192 <dir>/storage, database \u2192 <dir>/pg)
+> `
+  );
+  const dataDir = dataAnswer ? expandPath(dataAnswer, root) : currentDataDir;
+  const defaultDataDir = resolvePaths(root).dataDir;
+  config.dataDir = dataDir === defaultDataDir ? void 0 : dataDir;
+  const oldPg = pathsFor(loadConfig(), root).pgDataDir;
+  const newPg = join5(dataDir, "pg");
+  if (oldPg !== newPg && existsSync5(join5(oldPg, "PG_VERSION"))) {
+    warn(`existing database at ${oldPg} will NOT move \u2014 a fresh one initializes at ${newPg}.`);
+    info(
+      "to keep your current data, copy that directory over, or leave the location unchanged."
+    );
+  }
+  config.port = await promptPort(config.port || DEFAULT_PORT);
+  const urlAnswer = await promptLine(
+    `Public URL the box is reachable at? [${config.publicUrl ?? `http://localhost:${config.port}`}]
+  (blank = serve on localhost only)
+> `
+  );
+  if (urlAnswer) {
+    if (!/^https?:\/\//.test(urlAnswer)) {
+      throw new Error(`public URL must start with http:// or https:// \u2014 got: ${urlAnswer}`);
+    }
+    config.publicUrl = urlAnswer.replace(/\/$/, "");
+  }
+  info("");
+  info(
+    `Executor API key \u2014 for API-key billing (stored as ${EXECUTOR_KEY}). Leave blank if your`
+  );
+  info("executor is already logged in (e.g. a Claude subscription under ~/.claude).");
+  const key = await promptSecret(`${EXECUTOR_KEY} (hidden, blank to skip): `);
+  if (key) {
+    config.bridgeEnv = { ...config.bridgeEnv ?? {}, [EXECUTOR_KEY]: key };
+  }
+  saveConfig(config, root);
+  const paths = pathsFor(config, root);
+  info("");
+  ok("configuration saved");
+  info(`  data      ${paths.dataDir}`);
+  info(`  storage   ${paths.storageRoot}  (your uploaded files)`);
+  info(`  database  ${paths.pgDataDir}`);
+  info(`  port      ${config.port}`);
+  info(`  url       ${config.publicUrl ?? `http://localhost:${config.port}`}`);
+  info(
+    `  ${EXECUTOR_KEY}  ${config.bridgeEnv?.[EXECUTOR_KEY] ? mask(config.bridgeEnv[EXECUTOR_KEY]) : "(not set \u2014 using on-disk executor auth)"}`
+  );
+  info("");
+  const installed = config.currentVersion && isInstalled(appDirFor(paths, config.currentVersion));
+  if (installed) {
+    info("next: `cabane up` (no flags needed), then sign up and `cabane setup-agent`.");
+  } else {
+    info("next: `cabane install` to fetch the server, then `cabane up` (no flags needed).");
+  }
+}
+function expandPath(input, root) {
+  let p = input;
+  if (p === "~") p = homedir3();
+  else if (p.startsWith("~/")) p = join5(homedir3(), p.slice(2));
+  return isAbsolute(p) ? p : resolve(root, p);
+}
+async function promptPort(current) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const answer = await promptLine(`Port the server listens on? [${current}]
+> `);
+    if (!answer) return current;
+    const n = Number(answer);
+    if (Number.isInteger(n) && n > 0 && n <= 65535) return n;
+    warn(`invalid port: ${answer} \u2014 enter a number between 1 and 65535.`);
+  }
+  throw new Error("no valid port after several tries \u2014 re-run `cabane init`.");
+}
+function mask(value) {
+  if (value.length <= 8) return "\u2022\u2022\u2022\u2022";
+  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
+
+// src/commands/install.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, rmSync as rmSync4 } from "fs";
+import { tmpdir } from "os";
+import { join as join6 } from "path";
+
+// src/dist.ts
+import { createHash } from "crypto";
+import { createWriteStream } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+var bearer = (token) => ({ authorization: `Bearer ${token}` });
+async function fetchManifest(distBase, token, version) {
+  const q = version && version.length > 0 ? `?version=${encodeURIComponent(version)}` : "";
+  const res = await fetch(`${distBase.replace(/\/$/, "")}/api/dist/manifest${q}`, {
+    headers: bearer(token)
+  });
+  if (res.status === 404) return null;
+  if (res.status === 401) {
+    throw new Error(
+      "distribution token rejected (401) \u2014 check the token passed to `cabane install`"
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`GET /api/dist/manifest \u2192 ${res.status}: ${(await res.text()).slice(0, 200)}`);
+  }
+  return await res.json();
+}
+async function downloadArtifact(distBase, token, manifest, destPath) {
+  const q = `?version=${encodeURIComponent(manifest.version)}`;
+  const res = await fetch(`${distBase.replace(/\/$/, "")}/api/dist/artifact${q}`, {
+    headers: bearer(token),
+    // fetch follows the 302 to the presigned URL on its own; the redirect target
+    // is unauthenticated (the signature is the gate) so the bearer header is
+    // simply ignored there.
+    redirect: "follow"
+  });
+  if (!res.ok || !res.body) {
+    throw new Error(`GET /api/dist/artifact \u2192 ${res.status}: ${(await res.text()).slice(0, 200)}`);
+  }
+  const hash = createHash("sha256");
+  const source = Readable.fromWeb(res.body);
+  source.on("data", (chunk) => hash.update(chunk));
+  await pipeline(source, createWriteStream(destPath));
+  const digest = hash.digest("hex");
+  if (digest !== manifest.sha256) {
+    throw new Error(
+      `downloaded artifact sha256 mismatch: got ${digest}, manifest says ${manifest.sha256}`
+    );
+  }
+  return digest;
+}
+
+// src/commands/install.ts
+async function install(opts) {
+  assertNotForeignBridge();
+  const config = loadConfig();
+  const paths = pathsFor(config);
+  const dataExisted = existsSync6(paths.dataDir);
+  if (opts.distBase) config.distBase = opts.distBase.replace(/\/$/, "");
+  if (opts.port) config.port = opts.port;
+  mkdirSync3(paths.appsDir, { recursive: true });
+  let tarball;
+  let version;
+  let cleanup = null;
+  if (opts.from) {
+    if (!existsSync6(opts.from)) throw new Error(`--from tarball not found: ${opts.from}`);
+    tarball = opts.from;
+    version = readTarballManifest(tarball).version;
+    step(`installing from local tarball \u2192 version ${version}`);
+  } else {
+    const token = await resolveToken(opts, config);
+    config.distToken = token;
+    step(`fetching artifact from ${config.distBase}`);
+    const manifest = await fetchManifest(config.distBase, token, opts.version);
+    if (!manifest) {
+      throw new Error(
+        `no artifact available at ${config.distBase}` + (opts.version ? ` for version ${opts.version}` : "") + " \u2014 nothing published, or the version is unknown."
+      );
+    }
+    version = manifest.version;
+    info(`resolved ${version} (${(manifest.bytes / 1024 / 1024).toFixed(1)} MB)`);
+    const tmp = join6(tmpdir(), `cabane-artifact-${Date.now().toString(36)}.tgz`);
+    await downloadArtifact(config.distBase, token, manifest, tmp);
+    ok("downloaded + sha256 verified");
+    tarball = tmp;
+    cleanup = () => rmSync4(tmp, { force: true });
+  }
+  try {
+    const appDir = appDirFor(paths, version);
+    if (isInstalled(appDir) && !opts.force) {
+      info(`version ${version} already installed \u2014 reusing (pass --force to reinstall)`);
+    } else {
+      rmSync4(appDir, { recursive: true, force: true });
+      step(`unpacking \u2192 ${appDir}`);
+      unpackArtifact(tarball, appDir);
+      step("npm install --omit=dev (runtime deps)\u2026");
+      await npmInstall(appDir);
+      ok("runtime deps installed");
+    }
+    persistInstall(config, version);
+    ok(`installed ${version}`);
+    if (dataExisted) {
+      ok(`your data is preserved \u2014 ${paths.dataDir} (pg + storage) was untouched`);
+    } else {
+      info(`data will live at ${paths.dataDir} (pg + storage) \u2014 preserved across upgrades`);
+    }
+    info("next: cabane up");
+  } finally {
+    cleanup?.();
+  }
+}
+async function resolveToken(opts, config) {
+  if (opts.token) return opts.token.trim();
+  if (config.distToken) return config.distToken;
+  if (isInteractive()) {
+    const t = await promptSecret("Paste your Cabane access token (cabdist_\u2026): ");
+    if (t) return t;
+  }
+  throw new Error(
+    "no distribution token. Pass --token <cabdist_\u2026>, or --from <tarball> to install a local build."
+  );
+}
+function persistInstall(config, version) {
+  if (!config.visionSecret) config.visionSecret = randomBytes(32).toString("hex");
+  if (config.currentVersion && config.currentVersion !== version) {
+    config.previousVersion = config.currentVersion;
+  }
+  config.currentVersion = version;
+  saveConfig(config);
+}
+
+// src/commands/logs.ts
+import { existsSync as existsSync7 } from "fs";
+async function logs(opts) {
+  const paths = resolvePaths();
+  const n = String(opts.lines ?? 80);
+  const targets = [];
+  if (opts.server || !opts.bridge) targets.push(paths.serverLog);
+  if (opts.bridge || !opts.server) targets.push(paths.bridgeLog);
+  const present = targets.filter((t) => existsSync7(t));
+  if (present.length === 0) {
+    info("no logs yet \u2014 start the stack with `cabane up`.");
+    return;
+  }
+  const args = opts.follow ? ["-n", n, "-F", ...present] : ["-n", n, ...present];
+  await run("tail", args, { stdio: ["ignore", "inherit", "inherit"] });
+}
+
+// src/commands/set-env.ts
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function mask2(value) {
+  if (value.length <= 8) return "\u2022\u2022\u2022\u2022";
+  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
+function printList() {
+  const env = loadConfig().bridgeEnv ?? {};
+  const keys = Object.keys(env);
+  if (keys.length === 0) {
+    info("no persisted bridge env. Add one: `cabane set-env ANTHROPIC_API_KEY=\u2026`");
+    return;
+  }
+  step("persisted bridge env:");
+  for (const key of keys) info(`${key}=${mask2(env[key])}`);
+}
+async function setEnv(pairs, opts) {
+  if (opts.list || pairs.length === 0 && !opts.unset?.length) {
+    printList();
+    return;
+  }
+  assertNotForeignBridge();
+  if (opts.unset?.length) {
+    updateConfig((config) => {
+      if (!config.bridgeEnv) return;
+      for (const key of opts.unset) delete config.bridgeEnv[key];
+      if (Object.keys(config.bridgeEnv).length === 0) delete config.bridgeEnv;
+    });
+    ok(`unset ${opts.unset.join(", ")}`);
+  }
+  const parsed = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq < 0) {
+      const key2 = pair;
+      if (!KEY_RE.test(key2)) throw new Error(`invalid env var name: ${key2}`);
+      if (!isInteractive()) {
+        throw new Error(
+          `no value for ${key2} and not a TTY \u2014 pass ${key2}=VALUE, or run interactively to be prompted.`
+        );
+      }
+      const value = await promptSecret(`Value for ${key2} (hidden): `);
+      if (!value) throw new Error(`no value entered for ${key2}.`);
+      parsed[key2] = value;
+      continue;
+    }
+    if (eq === 0) throw new Error(`expected KEY=VALUE, got: ${pair}`);
+    const key = pair.slice(0, eq);
+    if (!KEY_RE.test(key)) throw new Error(`invalid env var name: ${key}`);
+    parsed[key] = pair.slice(eq + 1);
+  }
+  if (Object.keys(parsed).length > 0) {
+    updateConfig((config) => {
+      config.bridgeEnv = { ...config.bridgeEnv ?? {}, ...parsed };
+    });
+    for (const key of Object.keys(parsed)) ok(`set ${key}=${mask2(parsed[key])}`);
+    info("restart to apply: `cabane down && cabane up --daemon`");
+  }
+}
+
+// src/commands/setup-agent.ts
+import { existsSync as existsSync10 } from "fs";
+
+// src/api.ts
+var ApiError = class extends Error {
+  constructor(message, status2, body) {
+    super(message);
+    this.status = status2;
+    this.body = body;
+    this.name = "ApiError";
+  }
+  status;
+  body;
+};
+function makeClient(base, token) {
+  const trimmed = base.replace(/\/$/, "");
+  const call = async (method, path, body) => {
+    const res = await fetch(`${trimmed}${path}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...body !== void 0 ? { "content-type": "application/json" } : {}
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const text = await res.text();
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = text;
+    }
+    if (!res.ok) {
+      const detail = json && typeof json === "object" ? JSON.stringify(json) : String(json).slice(0, 300);
+      throw new ApiError(`${method} ${path} \u2192 ${res.status}: ${detail}`, res.status, json);
+    }
+    return json;
+  };
+  return {
+    base: trimmed,
+    get: (p) => call("GET", p),
+    post: (p, b) => call("POST", p, b),
+    put: (p, b) => call("PUT", p, b),
+    del: (p) => call("DELETE", p)
+  };
+}
+
+// src/env-compose.ts
+import { join as join7 } from "path";
+function composeServerEnv(opts) {
+  const dataDir = join7(opts.appDir, "data");
+  return {
+    NODE_ENV: "production",
+    PORT: String(opts.port),
+    DATABASE_URL: opts.databaseUrl,
+    STORAGE_BACKEND: "filesystem",
+    STORAGE_ROOT: opts.storageRoot,
+    WEB_DIST: "web",
+    PUBLIC_BASE_URL: opts.publicBaseUrl?.replace(/\/$/, "") || `http://localhost:${opts.port}`,
+    VISION_URL_SIGNING_SECRET: opts.visionSecret,
+    // Runtime file-read overrides → the artifact's own data/ tree.
+    CABANE_API_ROOT: join7(dataDir, "api"),
+    CABANE_SKILLS_DIR: join7(dataDir, "skills"),
+    CABANE_DOCS_CONTENT_DIR: join7(dataDir, "docs-content"),
+    CABANE_WELCOME_DIR: join7(dataDir, "welcome"),
+    ...opts.houseOwnerUserId ? { CABANE_HOUSE_OWNER_USER_ID: opts.houseOwnerUserId } : {},
+    ...opts.appVersion ? { CABANE_APP_VERSION: opts.appVersion } : {}
+  };
+}
+function composeBridgeEnv(opts) {
+  return {
+    ...opts.persistedEnv,
+    ...opts.parentEnv,
+    CABANE_BRIDGE_HOME: opts.bridgeHome,
+    CLAUDE_CONFIG_DIR: opts.claudeConfigDir,
+    BRIDGE_NO_OPEN: "1",
+    CABANE_BRIDGE_CLASS: "house"
+  };
+}
+function localBaseUrl(port) {
+  return `http://localhost:${port}`;
+}
+function embeddedDatabaseUrl(port) {
+  return `postgres://cabane:cabane@127.0.0.1:${port}/cabane`;
+}
+
+// src/supervisor/house-bridge.ts
+import { spawn as spawn2 } from "child_process";
+import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, join as join8 } from "path";
+var PAIRING_VERSION = 1;
+function resolveBridgeBin(appDir) {
+  const pkgPath = join8(appDir, "bridge", "package.json");
+  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+  const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["cabane-bridge"];
+  if (!rel) {
+    throw new Error(
+      `the installed artifact's bridge (${pkgPath}) exposes no cabane-bridge bin \u2014 reinstall.`
+    );
+  }
+  return join8(dirname3(pkgPath), rel);
+}
+function encodePairingString(input) {
+  const payload = {
+    v: PAIRING_VERSION,
+    baseUrl: input.baseUrl,
+    deviceToken: input.deviceToken,
+    ...input.deviceId ? { deviceId: input.deviceId } : {},
+    ...input.deviceLabel ? { deviceLabel: input.deviceLabel } : {}
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+async function pairBridge(opts) {
+  mkdirSync4(opts.bridgeHome, { recursive: true });
+  const pairingString = encodePairingString(opts);
+  const tmp = join8(opts.bridgeHome, `.pairing-${process.pid}.txt`);
+  writeFileSync3(tmp, pairingString, { mode: 384 });
+  try {
+    await run("node", [resolveBridgeBin(opts.appDir), "pair", "--file", tmp], {
+      env: {
+        PATH: process.env.PATH ?? "",
+        ...process.env.HOME ? { HOME: process.env.HOME } : {},
+        CABANE_BRIDGE_HOME: opts.bridgeHome
+      }
+    });
+  } finally {
+    rmSync5(tmp, { force: true });
+  }
+  ok("bridge paired");
+}
+function bridgeConfigPath(bridgeHome) {
+  return join8(bridgeHome, ".cabane", "config.json");
+}
+function readBridgeConfig(bridgeHome) {
+  try {
+    return JSON.parse(readFileSync6(bridgeConfigPath(bridgeHome), "utf8"));
+  } catch {
+    return null;
+  }
+}
+var BridgeChild = class {
+  constructor(appDir, bridgeHome, claudeConfigDir, logFile, persistedEnv) {
+    this.appDir = appDir;
+    this.bridgeHome = bridgeHome;
+    this.claudeConfigDir = claudeConfigDir;
+    this.logFile = logFile;
+    this.persistedEnv = persistedEnv;
+  }
+  appDir;
+  bridgeHome;
+  claudeConfigDir;
+  logFile;
+  persistedEnv;
+  child = null;
+  /** Spawn `cabane-bridge start --no-open` with the forwarded shell env under the
+   * house-class overrides (CT480). */
+  start() {
+    const out = openSync(this.logFile, "a");
+    this.child = spawn2("node", [resolveBridgeBin(this.appDir), "start", "--no-open"], {
+      env: composeBridgeEnv({
+        parentEnv: process.env,
+        bridgeHome: this.bridgeHome,
+        claudeConfigDir: this.claudeConfigDir,
+        persistedEnv: this.persistedEnv
+      }),
+      stdio: ["ignore", out, out]
+    });
+    this.child.on("exit", (code, signal) => {
+      if (code && code !== 0)
+        warn(`bridge exited (code ${code}${signal ? `, ${signal}` : ""})`);
+      this.child = null;
+    });
+    ok("house bridge started");
+  }
+  get running() {
+    return this.child !== null;
+  }
+  get pid() {
+    return this.child?.pid;
+  }
+  async stop() {
+    const child = this.child;
+    if (!child) return;
+    this.child = null;
+    await new Promise((resolve2) => {
+      const kill9 = setTimeout(() => child.kill("SIGKILL"), 5e3);
+      child.once("exit", () => {
+        clearTimeout(kill9);
+        resolve2();
+      });
+      child.kill("SIGTERM");
+    });
+  }
+};
+
+// src/commands/up.ts
+import { spawn as spawn4 } from "child_process";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
+
+// src/supervisor/postgres.ts
+import { existsSync as existsSync8 } from "fs";
+import { join as join9 } from "path";
+import EmbeddedPostgres from "embedded-postgres";
+var EmbeddedPg = class {
+  constructor(dataDir, port) {
+    this.dataDir = dataDir;
+    this.port = port;
+    this.databaseUrl = embeddedDatabaseUrl(port);
+  }
+  dataDir;
+  port;
+  pg = null;
+  databaseUrl;
+  make() {
+    return new EmbeddedPostgres({
+      databaseDir: this.dataDir,
+      user: "cabane",
+      password: "cabane",
+      port: this.port,
+      persistent: true,
+      // keep the data dir across restarts (the laptop reality)
+      onLog: () => {
+      },
+      // quiet — pg writes its own logs under the data dir
+      onError: (err) => warn(`[pg] ${err instanceof Error ? err.message : String(err)}`)
+    });
+  }
+  initialised() {
+    return existsSync8(join9(this.dataDir, "PG_VERSION"));
+  }
+  /** Init (first run) + start the postmaster + ensure the app database exists. */
+  async start() {
+    this.pg = this.make();
+    if (!this.initialised()) {
+      info("initialising Postgres data dir (first run)\u2026");
+      await this.pg.initialise();
+    }
+    await this.pg.start();
+    try {
+      await this.pg.createDatabase("cabane");
+    } catch {
+    }
+    ok(`Postgres up on 127.0.0.1:${this.port}`);
+  }
+  /** Clean shutdown (pg_ctl stop) — no orphaned postmaster. Idempotent. */
+  async stop() {
+    const pg = this.pg ?? this.make();
+    try {
+      await pg.stop();
+    } catch {
+    }
+    this.pg = null;
+  }
+};
+
+// src/supervisor/server.ts
+import { openSync as openSync2 } from "fs";
+import { spawn as spawn3 } from "child_process";
+var ServerChild = class {
+  constructor(appDir, env, port, logFile) {
+    this.appDir = appDir;
+    this.env = env;
+    this.port = port;
+    this.logFile = logFile;
+  }
+  appDir;
+  env;
+  port;
+  logFile;
+  child = null;
+  childEnv() {
+    return {
+      PATH: process.env.PATH ?? "",
+      HOME: process.env.HOME ?? "",
+      ...process.env.TZ ? { TZ: process.env.TZ } : {},
+      ...this.env
+    };
+  }
+  /** Apply the shipped migrations (idempotent). Runs the artifact's standalone
+   * `migrate.mjs` against DATABASE_URL. */
+  async migrate() {
+    info("applying migrations\u2026");
+    await run("node", ["migrate.mjs"], {
+      cwd: this.appDir,
+      env: { PATH: process.env.PATH ?? "", DATABASE_URL: this.env.DATABASE_URL },
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+  }
+  /** Spawn `node server.js` and wait for /healthz. */
+  async start() {
+    const out = openSync2(this.logFile, "a");
+    this.child = spawn3("node", ["server.js"], {
+      cwd: this.appDir,
+      env: this.childEnv(),
+      stdio: ["ignore", out, out]
+    });
+    this.child.on("exit", (code, signal) => {
+      if (code && code !== 0)
+        warn(`server exited (code ${code}${signal ? `, ${signal}` : ""})`);
+      this.child = null;
+    });
+    const healthy3 = await waitUntil(() => this.healthy(), { timeoutMs: 45e3, intervalMs: 500 });
+    if (!healthy3) {
+      throw new Error(
+        `server did not become healthy on :${this.port} within 45s \u2014 see ${this.logFile}`
+      );
+    }
+    ok(`server up on http://localhost:${this.port}`);
+  }
+  async healthy() {
+    try {
+      const res = await fetch(`http://127.0.0.1:${this.port}/healthz`);
+      return res.ok;
+    } catch {
+      return false;
+    }
+  }
+  get pid() {
+    return this.child?.pid;
+  }
+  /** SIGTERM, then SIGKILL after a grace period. */
+  async stop() {
+    const child = this.child;
+    if (!child) return;
+    this.child = null;
+    await new Promise((resolve2) => {
+      const kill9 = setTimeout(() => child.kill("SIGKILL"), 5e3);
+      child.once("exit", () => {
+        clearTimeout(kill9);
+        resolve2();
+      });
+      child.kill("SIGTERM");
+    });
+  }
+};
+
+// src/commands/up.ts
+async function up(opts) {
+  const config = loadConfig();
+  const paths = pathsFor(config);
+  if (opts.port) config.port = opts.port;
+  if (!config.currentVersion) {
+    throw new Error("nothing installed yet \u2014 run `cabane install` first.");
+  }
+  const appDir = appDirFor(paths, config.currentVersion);
+  if (!isInstalled(appDir)) {
+    throw new Error(`install ${config.currentVersion} looks incomplete at ${appDir} \u2014 reinstall.`);
+  }
+  if (!config.visionSecret) {
+    throw new Error("config has no vision secret \u2014 reinstall to generate one.");
+  }
+  if (await portInUse(config.port)) {
+    throw new Error(
+      `port ${config.port} is already in use. If cabane is running, use \`cabane down\`; otherwise a stale process is holding it \u2014 free it and retry.`
+    );
+  }
+  if (opts.daemon) {
+    await launchDaemon(paths, config);
+    return;
+  }
+  await new Supervisor(paths, appDir, config.port).run();
+}
+async function launchDaemon(paths, config) {
+  if (existsSync9(paths.supervisorPidFile)) {
+    const pid = Number(readFileSync7(paths.supervisorPidFile, "utf8").trim());
+    if (pid && pidAlive(pid)) {
+      warn(`already running (supervisor pid ${pid}). Use \`cabane down\` to stop it.`);
+      return;
+    }
+  }
+  mkdirSync5(paths.logsDir, { recursive: true });
+  const entry = process.argv[1];
+  if (!entry) throw new Error("cannot locate the cabane CLI entry to run in the background.");
+  const out = openSync3(paths.serverLog, "a");
+  const child = spawn4(process.execPath, [entry, "up", "--port", String(config.port)], {
+    detached: true,
+    stdio: ["ignore", out, out]
+  });
+  child.unref();
+  step("starting in the background\u2026");
+  const healthy3 = await waitUntil(
+    async () => {
+      try {
+        const res = await fetch(`http://127.0.0.1:${config.port}/healthz`);
+        return res.ok;
+      } catch {
+        return false;
+      }
+    },
+    { timeoutMs: 6e4, intervalMs: 1e3 }
+  );
+  if (!healthy3) {
+    throw new Error(`background start did not come healthy within 60s \u2014 see ${paths.serverLog}`);
+  }
+  ok(`running in the background on http://localhost:${config.port}`);
+  for (const line of daemonFooter(config)) info(line);
+}
+function daemonFooter(config) {
+  const lines = [];
+  if (!config.houseOwnerUserId) {
+    lines.push("next: open the URL, sign up, then `cabane setup-agent`");
+  }
+  lines.push("logs: cabane logs \xB7 stop: cabane down");
+  return lines;
+}
+var Supervisor = class {
+  constructor(paths, appDir, port) {
+    this.paths = paths;
+    this.appDir = appDir;
+    this.port = port;
+    this.pg = new EmbeddedPg(paths.pgDataDir, loadConfig().pgPort);
+  }
+  paths;
+  appDir;
+  port;
+  pg;
+  server = null;
+  bridge = null;
+  shuttingDown = false;
+  buildServer() {
+    const config = loadConfig();
+    const env = composeServerEnv({
+      appDir: this.appDir,
+      port: this.port,
+      databaseUrl: this.pg.databaseUrl,
+      storageRoot: this.paths.storageRoot,
+      visionSecret: config.visionSecret,
+      ...config.publicUrl ? { publicBaseUrl: config.publicUrl } : {},
+      ...config.houseOwnerUserId ? { houseOwnerUserId: config.houseOwnerUserId } : {},
+      // CT484: the artifact's build version → the server reports it on the bridge
+      // heartbeat so a bridge/server skew is detectable. Read from the installed
+      // tree's package.json (stamped at build); best-effort.
+      ...(() => {
+        const v = readAppVersion(this.appDir);
+        return v ? { appVersion: v } : {};
+      })()
+    });
+    return new ServerChild(this.appDir, env, this.port, this.paths.serverLog);
+  }
+  /** Start the bridge child iff it is configured (registered + paired) and not
+   * already running. */
+  ensureBridge() {
+    if (this.bridge?.running) return;
+    const config = loadConfig();
+    const paired = readBridgeConfig(this.paths.bridgeHome)?.deviceId;
+    if (!config.houseDeviceId || !paired) return;
+    const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR ?? `${process.env.HOME}/.claude`;
+    this.bridge = new BridgeChild(
+      this.appDir,
+      this.paths.bridgeHome,
+      claudeConfigDir,
+      this.paths.bridgeLog,
+      config.bridgeEnv
+    );
+    try {
+      this.bridge.start();
+    } catch (err) {
+      this.bridge = null;
+      warn(`house bridge could not start: ${err instanceof Error ? err.message : String(err)}`);
+      info(
+        "the server is up; agents will not answer until this is resolved (try `cabane update`)."
+      );
+    }
+  }
+  /** Publish the supervisor pid as early as possible so `status` / `down` /
+   * `setup-agent` can find us the instant `up --daemon` returns (the daemon
+   * launcher only waits on /healthz, which comes up before the children are all
+   * wired). */
+  writePid() {
+    mkdirSync5(this.paths.runDir, { recursive: true });
+    writeFileSync4(this.paths.supervisorPidFile, `${process.pid}
+`);
+  }
+  writeState() {
+    mkdirSync5(this.paths.runDir, { recursive: true });
+    writeFileSync4(this.paths.supervisorPidFile, `${process.pid}
+`);
+    writeFileSync4(
+      this.paths.stateFile,
+      JSON.stringify(
+        {
+          supervisorPid: process.pid,
+          serverPid: this.server?.pid ?? null,
+          bridgePid: this.bridge?.pid ?? null,
+          port: this.port,
+          // Bumped on every (re)write — a completed reload advances it, which is
+          // how `setup-agent` knows a restart it requested actually finished
+          // (rather than trusting /healthz, which the still-up old server answers).
+          updatedAt: Date.now()
+        },
+        null,
+        2
+      ) + "\n"
+    );
+  }
+  async run() {
+    mkdirSync5(this.paths.logsDir, { recursive: true });
+    mkdirSync5(this.paths.storageRoot, { recursive: true });
+    this.writePid();
+    step("starting embedded Postgres\u2026");
+    await this.pg.start();
+    this.server = this.buildServer();
+    step("starting server\u2026");
+    await this.server.migrate();
+    await this.server.start();
+    this.ensureBridge();
+    this.writeState();
+    process.on("SIGINT", () => void this.teardown("SIGINT"));
+    process.on("SIGTERM", () => void this.teardown("SIGTERM"));
+    process.on("exit", () => {
+      for (const pid of [this.bridge?.pid, this.server?.pid]) {
+        if (pid) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+          }
+        }
+      }
+    });
+    process.on(
+      "uncaughtException",
+      (err) => warn(`ignoring uncaught error: ${err instanceof Error ? err.message : String(err)}`)
+    );
+    process.on(
+      "unhandledRejection",
+      (err) => warn(`ignoring unhandled rejection: ${err instanceof Error ? err.message : String(err)}`)
+    );
+    ok("cabane is up \u2014 Ctrl-C to stop");
+    await new Promise(() => {
+    });
+  }
+  async teardown(signal) {
+    if (this.shuttingDown) return;
+    this.shuttingDown = true;
+    step(`${signal} \u2014 stopping children\u2026`);
+    await this.bridge?.stop();
+    await this.server?.stop();
+    await this.pg.stop();
+    rmSync6(this.paths.supervisorPidFile, { force: true });
+    rmSync6(this.paths.stateFile, { force: true });
+    ok("stopped cleanly");
+    process.exit(0);
+  }
+};
+function readAppVersion(appDir) {
+  try {
+    const pkg = JSON.parse(readFileSync7(join10(appDir, "package.json"), "utf8"));
+    return pkg.version ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/setup-agent.ts
+var DEFAULT_AGENT_MODEL = "anthropic/claude-opus-4-8";
+var DEVICE_LABEL = "cabane-house-bridge";
+async function setupAgent(opts) {
+  const paths = resolvePaths();
+  const config = loadConfig();
+  const base = localBaseUrl(config.port);
+  const model = opts.model ?? DEFAULT_AGENT_MODEL;
+  if (!await healthy(config.port)) {
+    throw new Error(`server is not up on ${base} \u2014 run \`cabane up\` and sign up first.`);
+  }
+  if (!existsSync10(paths.supervisorPidFile)) {
+    throw new Error("no running supervisor found \u2014 start the stack with `cabane up` first.");
+  }
+  const restart = async () => {
+    await down();
+    await up({ daemon: true, port: config.port });
+  };
+  const token = await resolvePat(opts, base);
+  const client = makeClient(base, token);
+  const me = await client.get("/api/auth/me");
+  const ownerId = me.user.id;
+  ok(`owner resolved (${ownerId})`);
+  if (config.houseOwnerUserId !== ownerId) {
+    config.houseOwnerUserId = ownerId;
+    saveConfig(config);
+    step("applying ops identity to the server (restart)\u2026");
+    await restart();
+  }
+  const appDir = appDirFor(paths, config.currentVersion ?? "");
+  const deviceId = await ensureHouseDevice(client, config, appDir, paths.bridgeHome, base);
+  await assignDefaultAgent(client, deviceId, model);
+  step("starting the house bridge + assigning agents (restart)\u2026");
+  await restart();
+  const beating = await waitForHeartbeat(client, deviceId);
+  if (beating) ok("house bridge heartbeating \u2014 agents are live");
+  else warn("no bridge heartbeat yet \u2014 check `cabane logs`; it may need a minute");
+  ok("setup complete");
+  info("message your agent in the app \u2014 it should answer.");
+}
+async function healthy(port) {
+  try {
+    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
+  } catch {
+    return false;
+  }
+}
+async function resolvePat(opts, base) {
+  if (opts.token) return opts.token.trim();
+  if (isInteractive()) {
+    info(`mint a token in the app: ${base} \u2192 Settings \u2192 Developer \u2192 tokens`);
+    const t = await promptSecret("Paste a Cabane access token (cab_\u2026): ");
+    if (t) return t;
+  }
+  throw new Error("no access token. Pass --token <cab_\u2026> (mint it in Settings \u2192 Developer).");
+}
+async function ensureHouseDevice(client, config, appDir, bridgeHome, base) {
+  step("registering the house device\u2026");
+  let deviceId;
+  let deviceToken;
+  try {
+    const res = await client.post(
+      "/api/bridge-devices",
+      { label: DEVICE_LABEL, class: "house" }
+    );
+    deviceId = res.device.id;
+    deviceToken = res.deviceToken;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409 && config.houseDeviceId) {
+      info(`reusing already-registered house device ${config.houseDeviceId}`);
+      return config.houseDeviceId;
+    }
+    throw err;
+  }
+  config.houseDeviceId = deviceId;
+  saveConfig(config);
+  await pairBridge({
+    appDir,
+    bridgeHome,
+    baseUrl: base,
+    deviceToken,
+    deviceId,
+    deviceLabel: DEVICE_LABEL
+  });
+  return deviceId;
+}
+async function assignDefaultAgent(client, deviceId, model) {
+  const { workspaces } = await client.get("/api/workspaces");
+  const workspace = workspaces.find((w) => w.role === "owner") ?? workspaces[0];
+  if (!workspace) throw new Error("the account owns no workspace \u2014 create one in the app first.");
+  const wsPath = `/api/workspaces/${workspace.id}`;
+  const { agents } = await client.get(
+    `${wsPath}/agents`
+  );
+  const agent = workspace.defaultAgentId && agents.find((a) => a.id === workspace.defaultAgentId) || agents.find((a) => a.username === "cabane") || agents[0];
+  if (!agent) throw new Error("the workspace has no agent to assign.");
+  const { runConfig } = await client.get(
+    `${wsPath}/agents/${agent.id}/run-config`
+  );
+  if (!runConfig?.model) {
+    info(`setting @${agent.username} model \u2192 ${model}`);
+    await client.put(`${wsPath}/agents/${agent.id}/run-config`, { ...runConfig ?? {}, model });
+  }
+  info(`assigning @${agent.username} \u2192 the house bridge`);
+  await client.put(`${wsPath}/agents/${agent.id}/executor`, { executor: "bridge", deviceId });
+}
+async function waitForHeartbeat(client, deviceId) {
+  return waitUntil(
+    async () => {
+      const { devices } = await client.get(
+        "/api/bridge-devices"
+      );
+      return Boolean(devices.find((d) => d.id === deviceId)?.lastSeenAt);
+    },
+    { timeoutMs: 9e4, intervalMs: 3e3 }
+  );
+}
+
+// src/commands/status.ts
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
+function readBridgeCrash(bridgeHome) {
+  try {
+    const path = join11(bridgeHome, ".cabane", "last-error.json");
+    if (!existsSync11(path)) return null;
+    return JSON.parse(readFileSync8(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function status() {
+  const config = loadConfig();
+  const paths = pathsFor(config);
+  const state = readState2(paths.stateFile);
+  const supervisorPid = readSupervisorPid(paths.supervisorPidFile) ?? state.supervisorPid;
+  const supervisorUp = supervisorPid ? pidAlive(supervisorPid) : false;
+  const serverUp = await healthy2(config.port);
+  const bridgeUp = state.bridgePid ? pidAlive(state.bridgePid) : false;
+  const line = (label, value) => {
+    process.stdout.write(`  ${label.padEnd(12)}${value}
+`);
+  };
+  process.stdout.write("cabane\n");
+  line("version", config.currentVersion ?? "(not installed)");
+  if (config.previousVersion) line("previous", config.previousVersion);
+  line("port", String(config.port));
+  line("home", paths.root);
+  line("data", `${paths.dataDir} (pg + storage \xB7 kept across upgrades)`);
+  line("supervisor", supervisorUp ? `up (pid ${supervisorPid})` : "down");
+  line("server", serverUp ? `up \xB7 http://localhost:${config.port}` : "down");
+  const crash = bridgeUp ? null : readBridgeCrash(paths.bridgeHome);
+  line(
+    "bridge",
+    config.houseDeviceId ? bridgeUp ? "up" : crash ? `crashed \u2014 ${crash.reason}` : "configured \xB7 down" : "not set up (cabane setup-agent)"
+  );
+  if (!bridgeUp && crash) {
+    info("see why: cabane logs --bridge");
+  }
+  if (!supervisorUp) info("start it: cabane up");
+}
+function readState2(file) {
+  try {
+    return JSON.parse(readFileSync8(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function readSupervisorPid(file) {
+  try {
+    const pid = Number(readFileSync8(file, "utf8").trim());
+    return pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+async function healthy2(port) {
+  try {
+    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/update.ts
+async function update(opts) {
+  const config = loadConfig();
+  const distBase = (opts.distBase ?? config.distBase).replace(/\/$/, "");
+  const token = opts.token ?? config.distToken;
+  if (!token)
+    throw new Error("no distribution token stored \u2014 run `cabane install --token \u2026` first.");
+  if (!config.currentVersion) throw new Error("nothing installed \u2014 run `cabane install` first.");
+  step(`checking ${distBase} for updates\u2026`);
+  const manifest = await fetchManifest(distBase, token, opts.version);
+  if (!manifest) throw new Error("no artifact available from the distribution endpoint.");
+  const target = manifest.version;
+  if (target === config.currentVersion && !opts.version) {
+    ok(`already up to date (${config.currentVersion})`);
+    return;
+  }
+  if (target === config.currentVersion) {
+    info(`version ${target} already installed`);
+  } else {
+    info(`updating ${config.currentVersion} \u2192 ${target}`);
+  }
+  await install({ token, distBase, version: target });
+  ok(`installed ${target} (previous kept for rollback)`);
+  info("restart to run it: cabane down && cabane up");
+}
+
+// src/cli.ts
+var program = new Command();
+program.name("cabane").description("Run a self-hosted Cabane on your own machine \u2014 no docker, no repo.").version("0.1.0");
+var parsePort = (raw) => {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0 || n > 65535) throw new Error(`invalid port: ${raw}`);
+  return n;
+};
+program.command("init").description("interactive first-run wizard: data location, port, and the executor credential").action(init);
+program.command("install").description("install the server artifact (token \u2192 gated download, or --from a local tarball)").option("--token <token>", "distribution token (cabdist_\u2026) \u2014 prompted if omitted").option("--from <tarball>", "install from a local artifact tarball instead of downloading").option("--dist-base <url>", "distribution origin to fetch from (default https://app.cabane.ai)").option("--version <version>", "install a specific published version (default: latest)").option("--port <port>", "local port the server will listen on (default 3000)", parsePort).option("--force", "reinstall even if this version is already present").action(install);
+program.command("up").description("start + supervise the stack (Postgres, server, house bridge)").option("--daemon", "run in the background (terminal returns; stop with `cabane down`)").option("--port <port>", "override the configured port", parsePort).action(up);
+program.command("setup-agent").description("after browser signup: register the house bridge + put your agent on it").option("--token <token>", "a Cabane access token (cab_\u2026) \u2014 prompted if omitted").option("--model <model>", "model the agent runs (default anthropic/claude-opus-4-8)").action(setupAgent);
+program.command("update").description("install a newer published artifact (keeps the previous for rollback)").option("--token <token>", "distribution token (cabdist_\u2026) \u2014 defaults to the stored one").option("--dist-base <url>", "distribution origin to fetch from").option("--version <version>", "install a specific version instead of latest").action(update);
+program.command("set-env [pairs...]").description(
+  "persist credentials forwarded to the house bridge \u2014 `KEY=VALUE`, or a bare `KEY` to be prompted for the value (kept off shell history)"
+).option("--unset <keys...>", "remove one or more persisted keys").option("--list", "list persisted keys (values masked)").action(setEnv);
+program.command("down").description("stop a running stack").action(down);
+var bridge = program.command("bridge").description("house-bridge maintenance");
+bridge.command("reset").description("clear the house bridge\u2019s resume state (cursors + dispatched/completed dedupe)").option("--force", "clear even while the bridge is running (takes effect next boot)").action(bridgeReset);
+program.command("status").description("show what is installed + running").action(status);
+program.command("doctor").description("preflight: diagnose common self-host failure classes (runs with the stack down)").action(doctor);
+program.command("logs").description("tail the server + bridge logs").option("-n, --lines <n>", "how many lines to show (default 80)", (v) => Number(v)).option("-f, --follow", "follow the logs (Ctrl-C to stop)").option("--server", "only the server log").option("--bridge", "only the bridge log").action(logs);
+program.parseAsync(process.argv).catch((err) => {
+  error(err instanceof Error ? err.message : String(err));
+  process.exitCode = 1;
+});