@elu-labs/elu 0.0.0-stage → 0.1.0

package/SECURITY.md

@@ -0,0 +1,333 @@
+# Security
+
+## Reporting a vulnerability
+
+Report it privately. Open the repository's **Security** tab and choose **Report a
+vulnerability**, or go straight to
+<https://github.com/ELU-Labs/elu/security/advisories/new>. Please do not open a
+public issue or post reproduction details before a fix is out.
+
+Say what you ran: the output of `elu --version`, your operating system,
+the vendor command line and its release, the session's permission mode, and the steps.
+Fixes are made on `main`; there are no older versions that get fixes.
+
+## What is trusted
+
+ELU Code launches installed vendor CLIs. The executables and your local installation are
+trusted. Repository content, check scripts, prompts, and model responses are untrusted.
+Only the owner can approve a push.
+
+Prompts explain the task but are not security controls. This tool cannot prove a change is
+correct, and model review is not a substitute for a person reviewing a pull request.
+
+## What an agent may do
+
+It depends on the session's permission mode ([docs/permissions.md](docs/permissions.md)).
+
+- **Read only** is the profile of every reviewer, every teammate question and every task
+  saved without a mode. It gives no shell tools unless the Claude role declares explicit
+  command prefixes. ELU Code adds none by itself: the test and build scripts it finds in a
+  project run only as checks, inside the check sandbox, and a prefix reaches the model only
+  from the project's settings file (`roles.lead.commands`). Ordinary questions in Read only
+  have only read-only file tools, with no shell, workspace creation, or check execution.
+- **Ask for approval** and **Approve for me** give the session's model, and a bot that
+  works in the session, a shell inside the vendor's own sandbox, with no network. In Ask
+  for approval an action outside it asks you where the vendor can ask during a turn
+  (Claude Code, and Antigravity and Grok Build once their one-time check has proven it);
+  on Codex, which cannot, it is refused and reported. In Approve for me a reviewer model
+  decides instead of you. The sandbox differs by vendor: Antigravity in Ask for approval
+  has none, so every command needs your approval and one you approve runs outside any
+  sandbox, and Grok Build's sandbox blocks the network on Linux only. The vendor pages in
+  [docs/vendors](docs/vendors) have the details. In both modes your session's answer
+  turns, and a working bot's, also read your home folder without asking, except the
+  secret folders ([docs/permissions.md](docs/permissions.md)).
+- **Full access** gives an unsandboxed shell. A Full access shell can read anything your
+  user can, except where the vendor's deny rules cover a file tool.
+
+The helpers a bot hands work to run under the same mode and the same denied commands as
+the bot.
+
+A teammate's question starts only after you accept it, unless you set that teammate to be
+accepted without asking. Its answer then goes back to them without waiting for you to read
+it, unless you chose to read that teammate's replies first. A reply that looks like it
+holds a key or a token is always held for you; that check looks for the shapes of secrets
+and is not a guarantee. Only a project's own folder can be shared, never your home folder,
+and a shared project answers only the teams it was shared with.
+
+A picture goes to a teammate only with a message you typed yourself that names it. A path
+in text you pasted into the message counts the same as one you typed, and the line that
+says how many pictures went (`with 2 pictures`) comes after the message is sent. A model's
+draft never attaches a file, and a picture in a folder that holds secrets is refused; a
+hard link in another folder to a file in such a folder is not recognized, and is attached.
+"A picture" means a file whose first bytes say PNG, JPEG, GIF or WebP: the rest of the file
+is not checked, and it is sent as it is, with what it records about the place, the device
+and the time. A picture a teammate sends you is kept in ELU Code's private folder under a
+name made here, readable only by you, and is never run. When you accept their question, its
+run can read the shared project and a copy of those pictures, and nothing else. The copy
+sits in the temporary directory, closed to other users, until the run ends; another session
+of yours that can read the temporary directory could read it in that time.
+
+Only Full access uses a vendor permission bypass, and only for the model of a session you
+gave it and the bots that work in that session; every other launcher asks or denies.
+Unsupported policies stop before a role launches. In Read only, Ask for approval and
+Approve for me, task metadata and source checks stay outside agent write access: the file
+tools and the sandboxed shell may not change the repository's Git folder or the protected
+project files, and may not read ELU Code's records in that folder; a command that leaves
+the sandbox asks first. Full access can change them, as it can change anything your user
+can.
+
+A sandboxed command reads the rest of the Git folder, so `git status`, `git diff` and
+`git log` work without an approval. Through git it can read the repository's whole
+history: every committed version of every file, including a file committed once and later
+removed, and committed files the sandbox hides by name in the worktree (`.env*`, `*.pem`,
+`.npmrc`). It can read the Git settings file, with its remote URLs and any token written
+into one, and the stash and the reflog. The sandbox has no network, so a sandboxed
+command cannot send what it reads anywhere; what it prints goes to the model, as all
+output does, and into the session's record. `git add`, `git commit` and anything else
+that writes in the folder stay refused. A teammate's question is given tracked files
+only: its commands read none of the folder.
+
+Vendor tool permissions restrict direct file tools. Claude Code's own sandbox fences only
+shell commands and is never required: where it cannot start, commands run outside it under
+the same rules (Ask asks you for each, a reviewer model decides in Approve for me, a Read
+only role keeps its command prefixes).
+
+Claude shell roles are labelled "temp folder writable": shared temp directories are denied,
+but the vendor can retain its own writable temporary folder outside the worktree. This
+exception is visible in `elu policy show`. In Read only, Ask for approval and Approve for
+me ELU Code names that folder itself where its path is short enough for Claude Code to
+use: a private one under your cache folder, or in your runtime folder where that path is
+too long, made for the run and removed when it ends (`docs/vendors/claude.md`).
+
+## What teammates are told
+
+A project is shared with `elu share` or `/share`, and also when a teammate is added:
+`elu invite` and `elu join` share the folder they run in when it is an ELU Code project
+(`--project PATH` names another), and `/invite` and `/join` share the open project. A share has status
+on unless you made it with `elu share --no-status`; `/share`, and `elu share` without that
+flag, turn status on again. While status is on, and the project has an `origin` remote, the
+teammates on a team it is shared with are told two things about it, and neither is checked
+for secrets:
+
+- **Status rows**, one for each live editing task (one being prepared, running, ready or
+  waiting for you; a plain conversation has none): the first line of the request it works
+  on, up to 80 characters; its state and what is at work on it (`lead`, `checks`, a shared
+  bot's `@name`, or `bot` for another bot); and the paths, relative to the repository, of up
+  to 200 files it has changed or added. They are used to warn about overlapping work. The
+  peer daemon reads them every 10 seconds and sends them when they change, and to each
+  teammate when they connect.
+- **Tasks**: for each session, the approved Task its work is on and any finished in the
+  last 24 hours, with the title, description, goal, objectives, priority, severity, state,
+  subtasks, which objectives are met, who works on it, and its times. They are sent within
+  5 seconds of a change, and to each teammate when they connect.
+
+Every teammate on any of your teams is also told, whatever the status of your shares, this
+machine's name (the peer setting `box`, by default the first part of its host name), the
+bots you share and what each is for, and the names of the projects shared with their team.
+Nothing else about your work is told: not a Task you have not approved or a rejected one,
+the rest of your request, the chat, file contents or absolute paths. A teammate's question
+and its answer are another matter, covered above.
+
+What a teammate tells is untrusted text: each field is checked and cut to its limit before
+it is kept, and it counts only in a project you share with a team that teammate is on. Your
+own model and bots in that project are given the titles and goals as data, marked as a
+teammate's text and never as a request; a teammate's question running on your machine is
+given none of it.
+
+## The never list
+
+The never list (push, tag, merge, deploy, publish) is enforced only where the means are
+missing: Read only and Ask for approval, with the one exception below. In Approve for me
+and Full access it is prompt text plus the vendor's deny rules, which match command text
+and can be sidestepped by an obscured command. ELU Code's own publish step still needs
+your confirmation and still refuses a default branch in every mode.
+
+One entry can open. A bot that is allowed to merge pull requests (`@elu` comes allowed; a
+bot you make is not) may run `gh pr merge` in its own working turn on Claude Code: its deny
+rules leave that command out, and its `gh` stand-in lets it through. In Ask for approval
+you are asked before each merge. In Approve for me the reviewer model decides and you are
+not asked, and Full access does not ask. A turn its schedule started runs with Approve for
+me at most, so in a session set to Approve for me or Full access the hourly `@elu` can
+merge with nobody watching. Push, tag, `git merge`, deploy and publish stay blocked for
+that bot as for every other.
+
+A rule on command text does not see what a script runs, and Codex has no deny rules at
+all. So every vendor's session, in every mode but Read only, also gets stand-in commands:
+a private folder (`~/.local/share/elu-code/never-list`, mode 0700) goes first on the
+session's PATH with one script per command word, and each refuses the never-list call by
+name whatever runs it, a script or `sh -c` included. Claude Code builds PATH again for
+each command, so ELU Code names a one-line file in `CLAUDE_ENV_FILE` that puts the folder
+back in front. This was seen with the real Codex and the real Claude Code in Ask for
+approval and Approve for me, not in Full access; with Antigravity and Grok Build only in
+tests against stand-in tools. They are a tripwire as well, not a sandbox. These get
+past them: a full path to the real command (`/usr/bin/git push`), a changed PATH, a Git
+alias (`git -c alias.p=push p`) and another program that does the same work (`gh api`,
+`git send-pack`). Two things pass on purpose, because they are not publishing: a
+`git push` to a folder on this machine (a path or a `file://` URL, as git itself resolves
+the remote), and a `git merge` or `git tag` in a scratch repository that lies, links
+resolved, inside the system temporary directory. A push to another machine, or one git
+cannot place, is refused before anything is sent. A project kept under the temporary
+directory is treated as scratch. A session in Full access can also rewrite the folder; it is written
+again, and cleared of anything else, when the next session starts. In Ask for approval
+and Approve for me the vendor's sandbox, where it runs one, still stands behind them; in
+Full access nothing does.
+
+## Approvals
+
+Approvals have limits. They are a convenience, not a boundary against an agent that is
+already outside the sandbox: a process running as your user can forge an answer file. Ask
+for approval keeps the agent inside the sandbox until you say yes; Approve for me trusts
+the vendor's reviewer model; Full access trusts your choice. Request text is model output:
+control characters are stripped, otherwise the command, path or URL is shown exactly.
+
+## Configuration, MCP servers and hooks
+
+A project's own settings and instructions (`.elu-code/config.yaml`, `instructions.md` and
+`context.md`) come with its folder, so they count as yours only once you have approved
+their exact content on this machine. ELU Code shows a file that is new or changed and asks
+once whether to use it. Until you approve a first version, sessions run on the default
+settings and without those instructions. After that, the version you approved last stays in
+use until you approve a change: a file that changed, that you turned down or that was
+removed does not put the defaults back. A file over 100 KB is never used. Scripted runs
+are refused while the settings file in the folder is not one you approved. Your answers are
+kept by content hash, with the text you approved last, in ELU Code's own state folder,
+never in the project. Like approvals, this is not a boundary against a process that already
+runs as your user: a Full access session can write that folder, and so can a command that
+was approved to leave the sandbox in Ask for approval or in Approve for me, where the
+approver is the vendor's reviewer model. With a Codex model, the repository's own
+`AGENTS.md` reaches the model as Codex itself reads it, and this step does not cover it.
+
+ELU Code starts one MCP server of its own, the approval relay, and only for a session with
+permissions: a dependency-free process that turns Claude Code's permission prompts into
+requests you answer in the terminal. Its Claude launcher otherwise uses strict MCP
+configuration, holding only the servers ELU Code passes, and loads no settings files
+(`--setting-sources ''`). The Codex reviewer ignores user configuration and refuses
+project or managed configuration that has not passed isolation tests.
+
+Your own Claude Code MCP servers (`claude mcp list`: the ones in `~/.claude.json`, for all
+folders and for the project folder) are given to the model of your sessions on Claude Code
+and to each bot that works there, unless you turn one off for the project with
+`/mcp off NAME`. A bot also gets the servers its page names, even one turned off for the
+project. Bots that only review or answer, a read-only turn and a teammate's question get
+none. Their tools run without asking in every mode: in Read only (a task saved without a
+mode), Ask for approval and Approve for me they are allowed by name, and Full access
+allows everything. They run as their own processes, so neither the shell sandbox nor the
+never list covers them: a server that can push, merge, post or send mail can do so
+without asking you. Their settings, which can hold tokens, are copied for each run into a
+private file in ELU Code's state folder and removed when the run ends.
+
+On Claude Code, the model of your sessions and each bot that works there also get your
+Claude Code instructions and memory for the project folder, as Claude Code itself would
+load them: `~/.claude/CLAUDE.md`, the folder's `CLAUDE.md`, and the notes in
+`~/.claude/projects/<folder>/memory`. The two instruction files and the memory index go
+into the prompt of a session's first turn; the notes are copied for each run into a
+private folder in the system temporary directory, which the run may read, and removed when
+it ends. A teammate's question gets none of them. The folder's `CLAUDE.md` comes with the
+folder, and the approval step above does not cover it.
+
+Hooks are inspected before editing. Configured hook folders in the task worktree are
+protected, and a changed hook stops checks and publication. Publishing uses an absolute
+private copy of the reviewed hooks. It runs the existing pre-push guards, including the
+guard in Git's common directory; commit hooks are not run. Git preparation and staging do
+not execute checkout or index hooks. Push guards run with a read-only worktree, private
+temporary space, and network access denied. A hook that invokes edited source inherits
+these same limits. The original hook files and Git configuration are unchanged. Git
+attributes and submodules that could execute repository code are refused.
+
+Terminal requests pin a hashed policy in private task state; scripted runs pin
+configuration and commands to a base commit. A session's mode, place and folders live in
+that private state, never in repository files, and changing the mode between turns changes
+no policy.
+
+## Credentials
+
+Agents do not receive cloud or GitHub credentials from ELU Code's inherited environment.
+Vendor authentication remains the vendor CLI's responsibility. ELU Code never signs you in.
+It never reads Claude Code's sign-in, in the macOS Keychain or in its credentials file, and
+it sends no request of its own with any vendor sign-in.
+
+The Usage tab shows plan usage. Claude usage comes from the rate limit lines Claude Code
+writes to its own output during a session that ELU Code runs. No request is made for it,
+and until such a session has run, the tab says so.
+
+Codex usage comes from Codex's own `app-server` command: ELU Code starts it and asks it for
+your plan's rate limits, so the request with your Codex sign-in is made by Codex. It starts
+in an empty private folder with MCP servers, hooks, apps, plugins and analytics turned off,
+and no thread or turn is ever started. ELU Code asks for this check whenever `codex` is on
+your PATH, including when you have it only for the check sandbox:
+
+- when you open a project that is set up, unless another ELU Code window already has it
+  open, and when you finish setting one up;
+- when you start a session or send a message;
+- every minute while a session, or the new session form, is on screen;
+- when the Usage tab opens and its last check is more than two minutes old, and when you
+  press `r` there.
+
+Apart from `r`, a check asked for less than a minute after the last one is skipped.
+
+What is saved, in `~/.config/elu-code`, is usage reduced to numbers and times
+(`usage.json`), and the email and plan name of each account seen, with its last usage
+(`accounts.json`). The Usage tab takes the Claude email, plan name and rate limit tier from
+`~/.claude.json`. It decodes the Codex email and plan on your machine from the id token in
+`auth.json` in the Codex home. No token from that file is sent, saved or shown.
+
+## Checks and evidence
+
+Check scripts and pre-push guards run inside Codex's OS sandbox (`codex sandbox`, or the
+copy `ELU_CODE_SANDBOX_HELPER` names), with an empty Codex home of their own, so Codex must
+be installed whatever vendor your sessions use, but need not be signed in. A check that
+cannot start in the sandbox fails; it never retries without isolation. Runtime directories
+needed by installed check programs are readable, not writable.
+
+Checks have a fresh private temporary directory inside the task worktree. Shared system
+temporary directories are denied. Ignored output is included in the evidence digest and
+blocks completion because it would be absent from the commit. Build and test scripts must
+not depend on unpublished generated files.
+
+Missing project checks leave code unverified and cannot authorize publication. Source
+edits after a check or review invalidate that evidence. Changing an allowed test to assert
+less is still possible and must be caught in review.
+
+## Output and secrets
+
+Raw output can contain secrets. It remains in `.git/elu-code/` (or personal conversation
+state before a folder has Git history), never in the PR evidence block. Review responses
+get conservative pattern-based redaction, which cannot recognize all personal or business
+information. Inspect the exact body before approving publication.
+
+## What the tests prove
+
+Compiler and fake-CLI tests establish ELU Code's behavior. Sandbox probes establish the
+installed helper's boundaries. Actual agent enforcement requires live tests on the exact
+vendor release, including commands launched by a test script, outside writes, synthetic
+secret reads, network requests, protected edits, configured MCP servers, and cancellation.
+A model choosing not to attempt an action is not proof that the vendor refused it.
+
+Use a tested vendor release for sensitive repositories. Operating system updates, managed
+settings, and vendor updates can change enforcement.
+
+## Linux
+
+A write outside the mounted files may land in a private, temporary filesystem without an
+error. Sandbox probes and tests verify that the real files remain unchanged. Keep
+repositories with push hooks outside shared `/tmp` and `/var/tmp` folders: the tested
+helper cannot mount read-only hook inputs there.
+
+## Antigravity and Grok Build
+
+Antigravity CLI runs under a private HOME holding only ELU Code's settings and hook; its
+rules and that hook were designed from Google's documentation, and the steps of its
+one-time check, which ELU Code runs before your first message to it, are the only proof on
+a given machine. Google's FAQ says that using third-party software to access Antigravity
+violates its terms and can get the account suspended or terminated, and that wrapping
+`agy` in other applications is not supported on consumer plans. ELU Code wraps it: using
+it is the owner's decision, and the owner's account carries the risk. Antigravity's deny
+rules and hook match command text: in Approve for me and Full access the never list is a
+tripwire, not a boundary.
+
+Grok Build runs with a private HOME and every documented Claude/Cursor compatibility,
+telemetry and upload switch off; the `isolation` step of its one-time check is the only
+proof on a given machine, and the vendor's own issue
+[xai-org/grok-build-plugin-cc#34](https://github.com/xai-org/grok-build-plugin-cc/issues/34)
+says some switches are ignored. Grok's deny rules match command text: in Approve for me
+and Full access the never list is a tripwire, not a boundary.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,62 @@
+# Third-party notices
+
+Two of the bots ELU Code comes with are adapted from skills published by others. Their
+instructions are in `lib/default-bots.mjs`. Some test files are examples copied from a
+published specification; they are in the repository only, not in the npm package.
+
+## @reviewer
+
+Adapted from the `code-review` skill of the Engineering plugin in
+[anthropics/knowledge-work-plugins](https://github.com/anthropics/knowledge-work-plugins)
+(`engineering/skills/code-review/SKILL.md`, version 1.2.0), by Anthropic, licensed under the
+Apache License, Version 2.0. A copy of that license is in
+[LICENSES/Apache-2.0.txt](LICENSES/Apache-2.0.txt).
+
+Changes: the review dimensions (security, performance, correctness, maintainability) and the
+shape of the answer (summary, critical issues, suggestions, what looks good, verdict) are
+kept. The text is rewritten for a bot that reviews the change of a session and reports its
+findings as blocking or optional comments. The slash command, the connector notes and the
+usage tips are left out.
+
+## @qa
+
+Adapted from the `qa` skill of [garrytan/gstack](https://github.com/garrytan/gstack)
+(`qa/SKILL.md`), licensed under the MIT License. The method is kept: test, report a
+baseline by severity, then for each finding reproduce it, write the regression test first,
+make the smallest fix, test again and classify the result, with rules for when to stop. The
+text is rewritten for a bot in a session; the browser tooling, the setup steps, the report
+files and the telemetry of the original are left out.
+
+```text
+MIT License
+
+Copyright (c) 2026 Garry Tan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## A2A specification examples
+
+The six files in `test/fixtures/a2a/` are examples from the Agent2Agent (A2A) Protocol
+specification in [a2aproject/A2A](https://github.com/a2aproject/A2A)
+(`docs/specification.md`, tag `v1.0.1`), licensed under the Apache License, Version 2.0. A
+copy of that license is in [LICENSES/Apache-2.0.txt](LICENSES/Apache-2.0.txt).
+
+Changes: each file holds one example, as JSON, with a `_source` field added that names the
+section of the specification and the lines it comes from.

package/bin/elu-code.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline/promises';
+import { repository, findRepository } from '../lib/git.mjs';
+import { initPlan, applyInit, uninstallPlan, applyUninstall } from '../lib/init.mjs';
+import { runPlan, runTask } from '../lib/runner.mjs';
+import { readTask, saveTask, taskDir, tasks, lock } from '../lib/state.mjs';
+import { runChecks, pinnedConfig } from '../lib/checks.mjs';
+import { policyReport, assertPolicy } from '../lib/policy.mjs';
+import { unsupportedVendors } from '../lib/detect.mjs';
+import { ADAPTERS } from '../lib/adapters/index.mjs';
+import { preparePublish, publish, prBody } from '../lib/publish.mjs';
+import { refuse, quote, readJson } from '../lib/util.mjs';
+import { recoverProcess, addUserBin } from '../lib/process.mjs';
+import {formatResult}from'../lib/format.mjs';
+import {botKey}from'../lib/bots.mjs';
+import { sweepServers } from '../lib/mcp.mjs';
+
+addUserBin();
+// MCP settings a run could not remove because its process died (lib/mcp.mjs).
+sweepServers();
+// Peer commands load lib/peer/ only when used; it never imports the optional packages at load time.
+const PEER_COMMANDS = new Set(['id', 'team', 'invite', 'join', 'share', 'unshare', 'peers', 'peer', 'ask', 'relay']);
+const HELP = `ELU Code — terminal coding workspace\n\nRun elu anywhere to open the terminal app.\nThe first start asks for a project name; later starts open your last project.\nSessions lists every session; type a message to start one.\nKanban shows the open project's tasks. Chats holds your channels and direct messages. Type / for commands and help.\nEditing workspaces are prepared automatically. Pushes require separate approval.\n\nCommands:\n  conductor [stop]\n  schedule [list]\n  dashboard\n  init [--yes] [--dry-run]\n  run <goal> [--yes] [--dry-run] [--permissions auto|full] [--place here|branch:NAME] [--folder PATH]...\n  run <id> --publish [--approve-push <confirmationId>]\n  status [id] [--recover]\n  open <id> [--bot NAME] [--exec]\n  check <id>\n  policy show\n  uninstall [--yes] [--dry-run]\n\nPeer network:\n  id [--name N] [--export] [--import CODE]\n  team create NAME | team\n  invite [--team ID] [--hours N] [--project PATH]\n  join CODE [--project PATH]\n  share [PATH] [--as HANDLE] [--no-status] | unshare HANDLE\n  peers\n  peer on|off|status|install|uninstall\n  ask [@NAME] [--project H] TEXT\n  relay [--team ID]\n\nEvery command accepts --json. --dry-run prints the proposed task setup;\nit does not execute the task or verify the resulting implementation.\n`;
+function argumentsOf(argv) {
+  const flags = {}; const words = [];
+  const boolean = new Set(['json', 'yes', 'dry-run', 'publish', 'recover', 'exec', 'help', 'version', 'daemon', 'export', 'no-status']);
+  const values = new Set(['role', 'bot', 'approve-push', 'name', 'import', 'team', 'hours', 'as', 'project', 'permissions', 'place']);
+  const repeatable = new Set(['folder']);
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    // -h alone or straight after a command; inside a goal or a question it is a word of the text.
+    if (arg === '-h' && (i === 0 || (i === 1 && argv.length === 2))) { flags.help = true; continue; }
+    if (!arg.startsWith('--')) { words.push(arg); continue; }
+    const [name, inline] = arg.slice(2).split('=', 2);
+    if (Object.hasOwn(flags, name) && !repeatable.has(name)) refuse(`Duplicate option --${name}.`);
+    if (boolean.has(name) && inline === undefined) flags[name] = true;
+    else if (values.has(name) || repeatable.has(name)) {
+      const value = inline ?? argv[++i];
+      if (!value || value.startsWith('--')) refuse(`--${name} needs a value.`);
+      if (repeatable.has(name)) (flags[name] ??= []).push(value); else flags[name] = value;
+    } else refuse(`Unknown option ${arg}.`);
+  }
+  return { flags, words };
+}
+async function confirm(plan, flags) {
+  if (flags['dry-run']) return false;
+  if (flags.yes) return true;
+  if (flags.json || !process.stdin.isTTY) return false;
+  process.stdout.write(formatResult(plan));
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  const closed=new Promise(resolve=>prompt.once('close',()=>resolve('')));
+  try { const answer=await Promise.race([prompt.question('Make these writes? [y/N] ').catch(error=>{if(error.code==='ERR_USE_AFTER_CLOSE'||error.code==='ABORT_ERR')return'';throw error;}),closed]);return /^y(?:es)?$/i.test(answer.trim()); }
+  finally { prompt.close(); }
+}
+export async function main(argv = process.argv.slice(2)) {
+  const { flags, words } = argumentsOf(argv);
+  if (flags.help || words[0] === 'help') return { help: `${HELP}\nOptions:\n  --help, -h\n  --version\n` };
+  if (flags.version) return { version: readJson(fileURLToPath(new URL('../package.json', import.meta.url))).version };
+  if (words[0] === 'schedule') {
+    const schedules = await import('../lib/schedules.mjs');
+    // The login item runs this every minute. It prints only when something happens.
+    // Bots that have a schedule are counted with the schedules made with /schedule.
+    if (words[1] === 'tick') { const bots = (await import('../lib/bot-schedules.mjs')).runBotSchedules(), fired = bots + schedules.runDue(); (await import('../lib/awake.mjs')).refreshAwake(); return fired ? { message: `Queued ${fired} scheduled task${fired === 1 ? '' : 's'}.` } : { quiet: true }; }
+    if (words[1] === 'list' || !words[1]) return { schedules: schedules.listSchedules(), message: schedules.listSchedules().map(row => `${row.enabled ? row.when.label : 'paused'}  ${row.project}  ${row.goal.split('\n')[0]}${row.nextRunAt ? `  next ${schedules.dateText(new Date(row.nextRunAt))}` : ''}`).join('\n') || 'No schedules. In ELU Code, set When in + New task.' };
+    refuse(`Unknown command: schedule ${words[1]}. Use elu schedule [list|tick].`);
+  }
+  if (words[0] === 'conductor') {
+    const conductor = await import('../lib/conductor.mjs');
+    if (flags.daemon) {
+      const owner = new conductor.Conductor({ onExit: () => close() });
+      let closing = false; const close = async () => { if (closing) return; closing = true; await owner.stop(); process.exit(0); };
+      for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, close);
+      owner.start(); return new Promise(() => {});
+    }
+    if (words[1] === 'stop') {
+      if (!conductor.conductorAlive()) return { message: 'The conductor is not running.' };
+      conductor.sendCommand({ type: 'shutdown' }); return { message: 'The conductor stops its runs, keeps their history, and exits. It starts again when work is queued.' };
+    }
+    if (words[1]) refuse(`Unknown command: conductor ${words[1]}. Use elu conductor [stop].`);
+    if (flags.json || !process.stdin.isTTY || !process.stdout.isTTY) { const { dashboardSnapshot } = await import('../lib/projects.mjs'); const { boardRows } = await import('../lib/board.mjs'); return { conductor: conductor.conductorStatus(), agents: boardRows(dashboardSnapshot().projects).map(({ task, request, key, order, ...row }) => row) }; }
+    const { launchTerminal } = await import('../lib/terminal.mjs'); return launchTerminal();
+  }
+  if (words[0] === 'peer' && flags.daemon) {
+    const { PeerDaemon } = await import('../lib/peer/daemon.mjs');
+    const owner = new PeerDaemon({ onExit: () => close() });
+    let closing = false; const close = async () => { if (closing) return; closing = true; await owner.stop(); process.exit(0); };
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, close);
+    await owner.start(); return new Promise(() => {});
+  }
+  if (words[0] === 'relay') {
+    const { startRelay } = await import('../lib/peer/cli.mjs');
+    const { relay, result } = await startRelay(flags);
+    let closing = false; const close = async () => { if (closing) return; closing = true; await relay.close(); process.exit(0); };
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, close);
+    process.stdout.write(flags.json ? `${JSON.stringify({ success: true, ...result })}\n` : formatResult(result));
+    return new Promise(() => {});
+  }
+  if (words[0] === 'team' && !words[1] && !flags.json && process.stdin.isTTY && process.stdout.isTTY) { const { launchTerminal } = await import('../lib/terminal.mjs'); return launchTerminal({ team: true, repo: findRepository(process.cwd()) }); }
+  if (PEER_COMMANDS.has(words[0])) { const { peerCli } = await import('../lib/peer/cli.mjs'); return peerCli(words, flags); }
+  if (words[0] === 'dashboard') {
+    if (flags.json) { const { dashboardSnapshot } = await import('../lib/projects.mjs'); return dashboardSnapshot(); }
+    const { launchTerminal } = await import('../lib/terminal.mjs'); return launchTerminal();
+  }
+  if (!words.length && !flags.json && (!process.stdin.isTTY || !process.stdout.isTTY)) return { help: HELP };
+  if (!words.length) {
+    const repo = findRepository(process.cwd());
+    if (flags.json) { const { projectSnapshot, dashboardSnapshot } = await import('../lib/projects.mjs'); return repo ? projectSnapshot(repo) : { welcome: true, directory: process.cwd(), ...dashboardSnapshot() }; }
+    const { launchTerminal } = await import('../lib/terminal.mjs'); return launchTerminal({ repo, startDirectory: process.cwd(), askProject: true });
+  }
+  const repo = repository(process.cwd());
+  const command = words[0];
+  if (command === 'init') {
+    const plan = initPlan(repo);
+    if (plan.initialized) return plan;
+    return await confirm(plan, flags) ? applyInit(repo, plan) : { ...plan, needsConfirmation: !flags['dry-run'] };
+  }
+  if (command === 'policy' && words[1] === 'show') {
+    const { head } = await import('../lib/git.mjs');
+    const { config } = pinnedConfig(repo, head(repo.root));
+    // Only the lead entry runs. Bots do the reviews, read-only, whatever an older config lists.
+    const role = config.roles.lead; let refusal = null; try { assertPolicy(role); } catch (e) { refusal = e.message; }
+    return { roles: [{ name: 'lead', ...policyReport(role), refusal }], unsupportedVendors: unsupportedVendors().map(({ bin, ...value }) => value) };
+  }
+  if (command === 'run') {
+    if (flags.publish) {
+      if (flags.yes || flags['dry-run']) refuse('Publication uses its own exact push confirmation.');
+      const task = readTask(repo, words[1]); const release = lock(repo, `task-${task.id}`);
+      try { return flags['approve-push'] ? await publish(repo, task, flags['approve-push']) : await preparePublish(repo, task); }
+      finally { release(); }
+    }
+    if (flags['approve-push']) refuse('--approve-push requires --publish.');
+    // A scripted run picks a mode too; ask needs someone at the terminal to answer.
+    if (flags.permissions === 'ask') refuse('Ask needs the terminal app.');
+    const session = { ...(flags.permissions !== undefined ? { permissions: flags.permissions } : {}), ...(flags.place !== undefined ? { place: flags.place } : {}), ...(flags.folder ? { folders: flags.folder.map(dir => path.resolve(dir)) } : {}) };
+    const release = lock(repo);
+    let plan;
+    try { plan = await runPlan(repo, words.slice(1).join(' '), session); } finally { release(); }
+    if(flags['dry-run'])return{...plan,preview:true,needsConfirmation:false,message:'Review this task preview. Nothing ran and no model credit was used.'};
+    const approved = await confirm(plan, flags);
+    if (!approved) return { ...plan, needsConfirmation: true };
+    const task = await runTask(repo, plan);
+    return { ...task, draftPrBody: prBody(task), published: false, message: 'Local work finished. Use run <id> --publish to review the exact commit and push destination.' };
+  }
+  if (command === 'status') {
+    let values = words[1] ? [readTask(repo, words[1])] : tasks(repo);
+    if (flags.recover) {
+      values = values.map((task) => {
+        const release = lock(repo, `task-${task.id}`);
+        try {
+          const file = path.join(taskDir(repo, task.id), 'process.json');
+          const record = fs.existsSync(file) ? readJson(file) : null;
+          if (task.state !== 'running' && !record?.pid) return task;
+          if (record) recoverProcess(record);
+          task.state = 'blocked'; task.error = { message: 'The controlling process ended. Review the worktree and rerun checks; nothing was restarted.' }; saveTask(repo, task); return task;
+        } finally { release(); }
+      });
+    }
+    return { tasks: values.map(({ goal, runs, responses, reviews, ...task }) => ({ ...task, goal, runs: runs.map(({ logFile, ...run }) => run), responses, reviewRounds: reviews.length })) };
+  }
+  if (command === 'check') {
+    const task = readTask(repo, words[1]); const release = lock(repo, `task-${task.id}`);
+    try { return await runChecks(repo, task); } finally { release(); }
+  }
+  if (command === 'open') {
+    // --bot opens what one of the session's bots saved. --role still reads a name an earlier run saved under.
+    const task = readTask(repo, words[1]); const bot = flags.bot === undefined ? null : String(flags.bot).replace(/^@/, '');
+    const role = bot !== null ? botKey(bot) : flags.role ?? 'lead';
+    const session = Object.hasOwn(task.sessions, role) ? task.sessions[role] : null;
+    if (!session || !/^[a-f0-9-]{36}$/i.test(session.id)) refuse(bot !== null ? `@${bot} has no saved session in task ${task.id}.` : 'There is no saved session to open.');
+    if (task.state === 'running') refuse('Wait for the headless run to finish before opening its session.');
+    // The adapter names its resume command; a vendor with a private HOME names it in env.
+    const adapter = ADAPTERS[session.vendor];
+    const plan = adapter?.interactive?.({ session: session.id, cwd: task.worktree }) ?? { bin: session.vendor, args: session.vendor === 'codex' ? ['resume', session.id] : ['--resume', session.id] };
+    const prefix = Object.entries(plan.env ?? {}).map(([key, value]) => `${key}=${quote(value)} `).join('');
+    const info = { command: `cd ${quote(task.worktree)} && ${prefix}${plan.bin} ${plan.args.map(quote).join(' ')}`, message: "Opening uses the vendor's interactive CLI and your own approvals. ELU Code's headless policy does not apply." };
+    if (flags.exec) {
+      if (flags.json || !process.stdin.isTTY) refuse('Interactive opening needs a terminal. Use the printed command.');
+      process.stdout.write(`${info.message}\n`);
+      const { spawnSync } = await import('node:child_process');
+      const result = spawnSync(plan.bin, plan.args, { cwd: task.worktree, env: plan.env ? { ...process.env, ...plan.env } : process.env, stdio: 'inherit' });
+      return { ...info, exitCode: result.status };
+    }
+    return info;
+  }
+  if (command === 'uninstall') {
+    const plan = uninstallPlan(repo);
+    return await confirm(plan, flags) ? applyUninstall(repo, plan) : { ...plan, needsConfirmation: !flags['dry-run'] };
+  }
+  refuse(`Unknown command: ${words.join(' ')}. Use elu --help.`);
+}
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const result = await main();
+    if (process.argv.includes('--json')) process.stdout.write(`${JSON.stringify({ success: true, ...result })}\n`);
+    else if (result.help) process.stdout.write(result.help);
+    else if (process.argv.includes('--version')) process.stdout.write(`${result.version}\n`);
+    else if (result.quiet) { /* Nothing to report. */ }
+    else process.stdout.write(formatResult(result,process.argv[2]));
+    if (result.results?.some((row) => row.status !== 'passed') || result.state === 'blocked'||result.sandboxHelper?.working===false||result.success===false) process.exitCode = 1;
+  } catch (error) {
+    const output = { success: false, message: error.message, ...error.details };
+    if (process.argv.includes('--json')) process.stdout.write(`${JSON.stringify(output)}\n`);
+    else process.stderr.write(`${error.message}\n${error.details&&Object.keys(error.details).length?Object.entries(error.details).map(([key,value])=>`${key}: ${typeof value==='object'?JSON.stringify(value):value}`).join('\n')+'\n':''}`);
+    process.exitCode = 1;
+  }
+}

package/bin/elu.cjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// The first file every start runs. It is written for any Node to read, so an old Node gets
+// one sentence here and not a syntax error. What only a current Node can read is in start.cjs.
+'use strict';
+var MINIMUM = 22;
+if (!(parseInt(process.versions.node, 10) >= MINIMUM)) {
+  process.stderr.write('ELU Code needs Node ' + MINIMUM + ' or newer; this is Node ' + process.versions.node + '.\n');
+  process.exit(1);
+}
+require('./start.cjs');

package/bin/start.cjs

@@ -0,0 +1,6 @@
+'use strict';
+// Loaded by elu.cjs once the Node is new enough to read this line.
+import('../lib/install.mjs').then(function (install) { return install.start(); }).catch(function (error) {
+  process.stderr.write(String((error && error.stack) || error) + '\n');
+  process.exit(1);
+});