@cohortapp/agent-sdk 2.3.0

package/scripts/setup/configure-macos.sh

@@ -0,0 +1,674 @@
+#!/bin/bash
+# =============================================================================
+# configure-macos.sh — Mac Mini Hardening for Maestro Agent Deployment
+# =============================================================================
+#
+# Configures a Mac mini as a headless, always-on agent server:
+#   1. Enables automatic login (no password on reboot)
+#   2. Disables sleep, standby, and screen saver
+#   3. Configures Parsec for remote desktop access (auto-launch on login)
+#   4. Launches Slack with Chrome DevTools Protocol (CDP) for huddle automation
+#   5. Sets up BlackHole virtual audio for voice integration
+#   6. Configures Login Items for all required apps
+#   7. Installs launchd agents for boot-time service startup
+#
+# Usage:
+#   sudo ./scripts/setup/configure-macos.sh           # Full configuration
+#   sudo ./scripts/setup/configure-macos.sh --check    # Verify current config
+#   ./scripts/setup/configure-macos.sh --apps-only     # Non-sudo app setup only
+#
+# IMPORTANT: Some steps require sudo (auto-login, power management).
+#            Run with sudo for full configuration.
+#
+# =============================================================================
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+AGENT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+AGENT_NAME=$(basename "$AGENT_DIR")
+CURRENT_USER=$(whoami)
+
+# The directory from which this script was invoked — used as the boot-time
+# Claude Code working directory (e.g. ~/agent-name, ~/wundr, etc.)
+CALLER_DIR="${PWD}"
+
+# Colours
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+log()  { echo -e "${BLUE}[config]${NC} $1"; }
+ok()   { echo -e "${GREEN}  ✓${NC} $1"; }
+warn() { echo -e "${YELLOW}  ⚠${NC} $1"; }
+fail() { echo -e "${RED}  ✗${NC} $1"; }
+section() { echo ""; echo -e "${CYAN}━━━ $1 ━━━${NC}"; }
+
+# =============================================================================
+# 1. AUTO-LOGIN (requires sudo)
+# =============================================================================
+
+configure_auto_login() {
+  section "Auto-Login Configuration"
+
+  if [ "$(id -u)" -ne 0 ]; then
+    warn "Skipping auto-login — requires sudo"
+    warn "Run: sudo ./scripts/setup/configure-macos.sh"
+    return 0
+  fi
+
+  log "Configuring auto-login for user: $SUDO_USER"
+
+  # Enable auto-login via defaults
+  defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser "$SUDO_USER"
+
+  # Disable login screen items that slow down boot
+  defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false
+  defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false
+
+  # Disable "Reopen windows when logging back in" prompt
+  defaults write com.apple.loginwindow TALLogoutSavesState -bool false
+  defaults write com.apple.loginwindow LoginwindowLaunchesRelaunchApps -bool false
+
+  ok "Auto-login enabled for $SUDO_USER"
+
+  # --- Disable all password gates that could block unattended operation -------
+  local real_home
+  real_home=$(eval echo "~$SUDO_USER")
+
+  # Disable "Require password after sleep or screen saver"
+  sudo -u "$SUDO_USER" defaults write com.apple.screensaver askForPassword -int 0
+  sudo -u "$SUDO_USER" defaults write com.apple.screensaver askForPasswordDelay -int 0
+  ok "Screen saver password prompt disabled"
+
+  # Disable screen lock via sysadminctl
+  sysadminctl -screenLock off 2>/dev/null || true
+  ok "Screen lock disabled"
+
+  # Disable idle logout (Privacy & Security > Log out when idle)
+  defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 0
+  ok "Idle auto-logout disabled"
+
+  # Disable screen lock on wake for current user
+  sudo -u "$SUDO_USER" defaults -currentHost write com.apple.screensaver idleTime -int 0
+  ok "Screen saver idle timer set to never"
+
+  # Prevent display from sleeping and requiring login on wake
+  # (already handled by pmset displaysleep 0, but belt-and-suspenders)
+  defaults write /Library/Preferences/com.apple.loginwindow DisableScreenLock -bool true 2>/dev/null || true
+
+  warn "NOTE: FileVault must be disabled for auto-login to work"
+  warn "Check: fdesetup status"
+
+  # Check FileVault status
+  if fdesetup status 2>/dev/null | grep -q "On"; then
+    warn "FileVault is ON — auto-login will NOT work until FileVault is disabled"
+    warn "Disable with: sudo fdesetup disable"
+    warn "This is a security trade-off for headless server operation"
+  else
+    ok "FileVault is off — auto-login will work"
+  fi
+}
+
+# =============================================================================
+# 2. PREVENT SLEEP / STANDBY / SCREEN SAVER
+# =============================================================================
+
+configure_power_management() {
+  section "Power Management (No Sleep)"
+
+  if [ "$(id -u)" -ne 0 ]; then
+    warn "Skipping power management — requires sudo"
+    return 0
+  fi
+
+  log "Disabling all sleep modes..."
+
+  # Disable system sleep
+  pmset -a sleep 0
+
+  # Disable display sleep (0 = never)
+  pmset -a displaysleep 0
+
+  # Disable hard disk sleep
+  pmset -a disksleep 0
+
+  # Disable standby mode
+  pmset -a standby 0
+
+  # Disable Power Nap
+  pmset -a powernap 0
+
+  # Disable hibernation
+  pmset -a hibernatemode 0
+
+  # Wake on network access (Wake-on-LAN)
+  pmset -a womp 1
+
+  # Auto-restart after power failure
+  pmset -a autorestart 1
+
+  # Disable proximity wake (Apple Watch)
+  pmset -a proximitywake 0
+
+  ok "Sleep disabled (system, display, disk, standby)"
+  ok "Wake-on-LAN enabled"
+  ok "Auto-restart on power failure enabled"
+
+  # Disable screen saver
+  log "Disabling screen saver..."
+  defaults -currentHost write com.apple.screensaver idleTime -int 0
+  ok "Screen saver disabled"
+
+  # Verify
+  log "Current power settings:"
+  pmset -g | grep -E "sleep|standby|hibernatemode|womp|autorestart" | while read -r line; do
+    echo "    $line"
+  done
+}
+
+# =============================================================================
+# 3. PARSEC AUTO-LAUNCH
+# =============================================================================
+
+configure_parsec() {
+  section "Parsec Remote Desktop"
+
+  # Check if Parsec is installed
+  if [ -d "/Applications/Parsec.app" ]; then
+    ok "Parsec installed"
+  else
+    warn "Parsec not installed"
+    warn "Install from: https://parsec.app/downloads"
+    warn "Or: brew install --cask parsec"
+    return 0
+  fi
+
+  # Add Parsec to Login Items via osascript
+  log "Adding Parsec to Login Items..."
+  osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/Parsec.app", hidden:false}' 2>/dev/null || true
+  ok "Parsec added to Login Items (launches on boot)"
+
+  # Create a launchd agent for Parsec as a fallback
+  local PLIST_PATH="$HOME/Library/LaunchAgents/com.parsec.agent.plist"
+
+  if [ ! -f "$PLIST_PATH" ]; then
+    cat > "$PLIST_PATH" << 'PLIST_EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.parsec.agent</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>open</string>
+        <string>-a</string>
+        <string>Parsec</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/dev/null</string>
+    <key>StandardErrorPath</key>
+    <string>/dev/null</string>
+</dict>
+</plist>
+PLIST_EOF
+    launchctl load "$PLIST_PATH" 2>/dev/null || true
+    ok "Parsec launchd agent installed (backup auto-launch)"
+  else
+    ok "Parsec launchd agent already exists"
+  fi
+}
+
+# =============================================================================
+# 4. SLACK WITH CDP (Chrome DevTools Protocol)
+# =============================================================================
+
+configure_slack_cdp() {
+  section "Slack with CDP (Huddle Support)"
+
+  if [ ! -d "/Applications/Slack.app" ]; then
+    warn "Slack not installed"
+    warn "Install: brew install --cask slack"
+    return 0
+  fi
+
+  ok "Slack installed"
+
+  # Remove Slack from Login Items (we manage it ourselves via boot-slack-cdp)
+  log "Ensuring Slack is NOT in Login Items (managed by launchd instead)..."
+  osascript -e 'tell application "System Events" to delete login item "Slack"' 2>/dev/null || true
+
+  # Install the boot-time Slack CDP launcher as a launchd agent
+  local PLIST_NAME="ai.maestro.slack-cdp.plist"
+  local PLIST_PATH="$HOME/Library/LaunchAgents/$PLIST_NAME"
+
+  cat > "$PLIST_PATH" << PLIST_EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.maestro.slack-cdp</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>${AGENT_DIR}/scripts/huddle/boot-slack-cdp.sh</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${AGENT_DIR}/logs/huddle/boot-slack-cdp-stdout.log</string>
+    <key>StandardErrorPath</key>
+    <string>${AGENT_DIR}/logs/huddle/boot-slack-cdp-stderr.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <key>CDP_PORT</key>
+        <string>9222</string>
+    </dict>
+</dict>
+</plist>
+PLIST_EOF
+
+  launchctl unload "$PLIST_PATH" 2>/dev/null || true
+  launchctl load "$PLIST_PATH"
+  ok "Slack CDP launchd agent installed (launches with --remote-debugging-port on boot)"
+}
+
+# =============================================================================
+# 5. VIRTUAL AUDIO (BlackHole for Huddle Voice)
+# =============================================================================
+
+configure_audio() {
+  section "Virtual Audio (BlackHole)"
+
+  if [ -f "$AGENT_DIR/scripts/huddle/setup-audio.sh" ]; then
+    log "Running audio setup..."
+    bash "$AGENT_DIR/scripts/huddle/setup-audio.sh" --check 2>&1 | while read -r line; do
+      echo "    $line"
+    done
+
+    # If BlackHole is not installed, offer to install
+    if ! command -v SwitchAudioSource &>/dev/null || ! SwitchAudioSource -a 2>/dev/null | grep -q "BlackHole"; then
+      warn "BlackHole not installed — run: ./scripts/huddle/setup-audio.sh"
+    else
+      ok "BlackHole audio devices present"
+    fi
+  else
+    warn "Audio setup script not found at scripts/huddle/setup-audio.sh"
+  fi
+}
+
+# =============================================================================
+# 6. OTHER APP LAUNCHES
+# =============================================================================
+
+configure_app_launches() {
+  section "Application Auto-Launch"
+
+  # WhatsApp (if installed)
+  if [ -d "/Applications/WhatsApp.app" ]; then
+    osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/WhatsApp.app", hidden:true}' 2>/dev/null || true
+    ok "WhatsApp added to Login Items"
+  else
+    warn "WhatsApp not installed (optional — install if agent uses WhatsApp)"
+  fi
+
+  # Safari (for Gmail web access)
+  # Safari is always available on macOS, but we don't need it as a Login Item
+  # The poller uses IMAP directly, not the browser
+  log "Safari: not needed as Login Item (Gmail uses IMAP polling)"
+
+  # Ensure required directories exist (as the real user, not root)
+  local real_user="${SUDO_USER:-$CURRENT_USER}"
+  local dirs=("$AGENT_DIR/logs/huddle" "$AGENT_DIR/state/huddle" "$AGENT_DIR/logs/watchdog")
+  for d in "${dirs[@]}"; do
+    mkdir -p "$d"
+    chown "$real_user:staff" "$d" 2>/dev/null || true
+  done
+  ok "Log and state directories verified (owned by $real_user)"
+
+  # --- Claude Code boot session (opens Terminal with interactive claude) ------
+  local BOOT_SCRIPT="$AGENT_DIR/scripts/setup/boot-claude-session.sh"
+  if [ -f "$BOOT_SCRIPT" ]; then
+    chmod +x "$BOOT_SCRIPT"
+
+    local PLIST_NAME="ai.maestro.boot-claude-session"
+    local PLIST_PATH="$real_home/Library/LaunchAgents/${PLIST_NAME}.plist"
+    local real_home
+    real_home=$(eval echo "~$real_user")
+
+    # Use the directory from which configure-macos.sh was invoked
+    local boot_agent_dir="$CALLER_DIR"
+
+    cat > "$PLIST_PATH" << PLIST_EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${PLIST_NAME}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>${BOOT_SCRIPT}</string>
+        <string>${boot_agent_dir}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${AGENT_DIR}/logs/watchdog/boot-session-stdout.log</string>
+    <key>StandardErrorPath</key>
+    <string>${AGENT_DIR}/logs/watchdog/boot-session-stderr.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:${real_home}/.local/bin</string>
+        <key>HOME</key>
+        <string>${real_home}</string>
+    </dict>
+</dict>
+</plist>
+PLIST_EOF
+
+    chown "$real_user:staff" "$PLIST_PATH" 2>/dev/null || true
+
+    # Load as the real user
+    if [ "$(id -u)" -eq 0 ]; then
+      su "$real_user" -c "launchctl unload '$PLIST_PATH' 2>/dev/null; launchctl load '$PLIST_PATH'" 2>/dev/null || true
+    else
+      launchctl unload "$PLIST_PATH" 2>/dev/null || true
+      launchctl load "$PLIST_PATH" 2>/dev/null || true
+    fi
+
+    ok "Claude Code boot session agent installed (opens Terminal + claude on login)"
+  else
+    warn "Boot session script not found at $BOOT_SCRIPT"
+  fi
+}
+
+# =============================================================================
+# 7. MEMORY WATCHDOG
+# =============================================================================
+
+configure_memory_watchdog() {
+  section "Memory Watchdog (OOM Protection)"
+
+  local WATCHDOG_SCRIPT="$AGENT_DIR/scripts/watchdog/memory-watchdog.sh"
+  local PLIST_SOURCE="$AGENT_DIR/scripts/watchdog/ai.maestro.memory-watchdog.plist"
+
+  if [ ! -f "$WATCHDOG_SCRIPT" ]; then
+    fail "Watchdog script not found at $WATCHDOG_SCRIPT"
+    return 0
+  fi
+
+  chmod +x "$WATCHDOG_SCRIPT"
+  ok "Watchdog script executable"
+
+  # Determine the real user's home for LaunchAgents
+  local real_user="${SUDO_USER:-$CURRENT_USER}"
+  local real_home
+  real_home=$(eval echo "~$real_user")
+  local PLIST_DEST="$real_home/Library/LaunchAgents/ai.maestro.memory-watchdog.plist"
+
+  # Install the plist (update paths for this agent directory)
+  # Template plists may contain `__AGENT_DIR__` (preferred) or the legacy
+  # `/Users/robin/maestro` literal — substitute both for compatibility.
+  sed -e "s|__AGENT_DIR__|$AGENT_DIR|g" -e "s|/Users/robin/maestro|$AGENT_DIR|g" "$PLIST_SOURCE" > "$PLIST_DEST"
+  chown "$real_user:staff" "$PLIST_DEST" 2>/dev/null || true
+
+  # Load it (as the real user)
+  if [ "$(id -u)" -eq 0 ]; then
+    su "$real_user" -c "launchctl unload '$PLIST_DEST' 2>/dev/null; launchctl load '$PLIST_DEST'" 2>/dev/null || true
+  else
+    launchctl unload "$PLIST_DEST" 2>/dev/null || true
+    launchctl load "$PLIST_DEST" 2>/dev/null || true
+  fi
+
+  ok "Memory watchdog launchd agent installed (runs every 30s)"
+  log "Thresholds: warn=60% critical=75% emergency=85% max_procs=8"
+  log "Override via env: WATCHDOG_WARN_PERCENT, WATCHDOG_CRITICAL_PERCENT, etc."
+
+  # Create log directory with correct ownership
+  mkdir -p "$AGENT_DIR/logs/watchdog"
+  chown "$real_user:staff" "$AGENT_DIR/logs/watchdog" 2>/dev/null || true
+}
+
+# =============================================================================
+# 8. ORCHESTRATOR AND SUBSYSTEMS ON BOOT
+# =============================================================================
+
+configure_boot_services() {
+  section "Boot-Time Services (Daemon + Pollers + Triggers)"
+
+  log "Verifying launchd agents are installed..."
+
+  local LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
+  local EXPECTED_AGENTS=(
+    "ai.maestro.*-daemon"
+    "ai.maestro.*-poller"
+    "ai.maestro.*-inbox-processor"
+    "ai.maestro.*-backlog-executor"
+    "ai.maestro.*-meeting-prep"
+    "ai.maestro.*-meeting-action-capture"
+    "ai.maestro.*-midday-sweep"
+  )
+
+  # Count installed agents (current ai.maestro.* namespace + legacy ai.adaptic.*)
+  local installed_count
+  installed_count=$(ls "$LAUNCH_AGENTS_DIR"/ai.maestro.*.plist "$LAUNCH_AGENTS_DIR"/ai.adaptic.*.plist 2>/dev/null | wc -l | tr -d ' ')
+
+  if [ "$installed_count" -gt 0 ]; then
+    ok "$installed_count launchd agents installed"
+
+    # Check which are loaded
+    local loaded_count
+    loaded_count=$(launchctl list 2>/dev/null | grep -cE 'ai\.(maestro|adaptic)' || true)
+    if [ "$loaded_count" -gt 0 ]; then
+      ok "$loaded_count agents currently loaded"
+    else
+      warn "Agents installed but none loaded — run: npm run init-agent"
+    fi
+  else
+    warn "No launchd agents found — run: npm run init-agent"
+  fi
+
+  # Check if the daemon is running
+  if launchctl list 2>/dev/null | grep -q "daemon"; then
+    ok "Main daemon is loaded"
+  else
+    warn "Main daemon not loaded — the orchestrator won't start on boot"
+    warn "Run: npm run init-agent to install all launchd agents"
+  fi
+
+  # Check Slack events server
+  if [ -f "$AGENT_DIR/state/locks/slack-events-server.pid" ]; then
+    local EVENTS_PID
+    EVENTS_PID=$(cat "$AGENT_DIR/state/locks/slack-events-server.pid")
+    if kill -0 "$EVENTS_PID" 2>/dev/null; then
+      ok "Slack events server running (PID $EVENTS_PID)"
+    else
+      warn "Slack events server PID file exists but process not running"
+    fi
+  else
+    warn "Slack events server not running — start with: npm run slack:events:start"
+  fi
+}
+
+# =============================================================================
+# 9. SYSTEM VERIFICATION
+# =============================================================================
+
+verify_all() {
+  section "System Verification"
+
+  local issues=0
+
+  # Check auto-login
+  local auto_login_user
+  auto_login_user=$(defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null || echo "")
+  if [ -n "$auto_login_user" ]; then
+    ok "Auto-login: $auto_login_user"
+  else
+    fail "Auto-login: not configured"
+    issues=$((issues + 1))
+  fi
+
+  # Check sleep settings
+  local sleep_val
+  sleep_val=$(pmset -g | grep "^ sleep" | awk '{print $2}')
+  if [ "$sleep_val" = "0" ]; then
+    ok "System sleep: disabled"
+  else
+    fail "System sleep: $sleep_val minutes (should be 0)"
+    issues=$((issues + 1))
+  fi
+
+  # Check display sleep
+  local dsleep_val
+  dsleep_val=$(pmset -g | grep "displaysleep" | awk '{print $2}')
+  if [ "$dsleep_val" = "0" ]; then
+    ok "Display sleep: disabled"
+  else
+    fail "Display sleep: $dsleep_val minutes (should be 0)"
+    issues=$((issues + 1))
+  fi
+
+  # Check Parsec
+  if pgrep -x "parsecd" &>/dev/null; then
+    ok "Parsec: running"
+  elif [ -d "/Applications/Parsec.app" ]; then
+    warn "Parsec: installed but not running"
+  else
+    fail "Parsec: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check Slack with CDP
+  if pgrep -x "Slack" &>/dev/null; then
+    if curl -s --connect-timeout 2 "http://localhost:9222/json/version" 2>/dev/null | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
+      ok "Slack: running with CDP on port 9222"
+    else
+      warn "Slack: running but CDP not available (no huddle support)"
+    fi
+  else
+    fail "Slack: not running"
+    issues=$((issues + 1))
+  fi
+
+  # Check Node.js
+  if command -v node &>/dev/null; then
+    ok "Node.js: $(node --version)"
+  else
+    fail "Node.js: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check Claude CLI
+  if command -v claude &>/dev/null; then
+    ok "Claude CLI: installed"
+  else
+    fail "Claude CLI: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check memory watchdog
+  if launchctl list 2>/dev/null | grep -q "ai.maestro.memory-watchdog"; then
+    ok "Memory watchdog: running"
+  elif [ -f "$HOME/Library/LaunchAgents/ai.maestro.memory-watchdog.plist" ]; then
+    warn "Memory watchdog: installed but not loaded"
+  else
+    fail "Memory watchdog: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check heartbeat freshness
+  local heartbeat_file="$AGENT_DIR/state/heartbeat"
+  if [ -f "$heartbeat_file" ]; then
+    local hb_age
+    hb_age=$(( $(date +%s) - $(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$(cat "$heartbeat_file")" +%s 2>/dev/null || echo 0) ))
+    if [ "$hb_age" -lt 120 ]; then
+      ok "Heartbeat: fresh (${hb_age}s ago)"
+    else
+      warn "Heartbeat: stale (${hb_age}s ago — watchdog may not be running)"
+    fi
+  else
+    warn "Heartbeat: no heartbeat file found"
+  fi
+
+  # Summary
+  echo ""
+  if [ "$issues" -eq 0 ]; then
+    ok "All checks passed"
+  else
+    fail "$issues issue(s) found — see above"
+  fi
+
+  return "$issues"
+}
+
+# =============================================================================
+# MAIN
+# =============================================================================
+
+main() {
+  echo ""
+  echo "╔══════════════════════════════════════════════════════════════╗"
+  echo "║        Maestro — Mac Mini Configuration                     ║"
+  echo "╠══════════════════════════════════════════════════════════════╣"
+  echo "║  Maestro:         $AGENT_DIR"
+  echo "║  Boot target:     $CALLER_DIR"
+  echo "║  Current user:    $CURRENT_USER"
+  echo "╚══════════════════════════════════════════════════════════════╝"
+
+  case "${1:-full}" in
+    --check|check)
+      verify_all
+      ;;
+    --apps-only|apps)
+      configure_parsec
+      configure_slack_cdp
+      configure_audio
+      configure_app_launches
+      configure_memory_watchdog
+      configure_boot_services
+      ;;
+    --full|full|"")
+      configure_auto_login
+      configure_power_management
+      configure_parsec
+      configure_slack_cdp
+      configure_audio
+      configure_app_launches
+      configure_memory_watchdog
+      configure_boot_services
+
+      section "Configuration Complete"
+      echo ""
+      log "Next steps:"
+      echo "  1. Reboot to test auto-login: sudo shutdown -r now"
+      echo "  2. After reboot, verify: ./scripts/setup/configure-macos.sh --check"
+      echo "  3. Configure Parsec account (first time only): open /Applications/Parsec.app"
+      echo "  4. Run agent setup: npm run init-agent"
+      echo "  5. Configure identity: claude \"/init-maestro\""
+      echo ""
+      ;;
+    *)
+      echo "Usage: $0 [--full|--check|--apps-only]"
+      echo ""
+      echo "  --full       Full configuration (requires sudo for auto-login and power)"
+      echo "  --check      Verify current configuration"
+      echo "  --apps-only  Configure apps and services only (no sudo needed)"
+      exit 1
+      ;;
+  esac
+}
+
+main "$@"