@f-o-h/cli 0.1.88 → 0.1.89

package/dist/foh.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path2 = require("node:path");
-    var fs = require("node:fs");
+    var path5 = require("node:path");
+    var fs4 = require("node:fs");
     var process4 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path2.resolve(baseDir, baseName);
-          if (fs.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path2.extname(baseName))) return void 0;
+          const localBin = path5.resolve(baseDir, baseName);
+          if (fs4.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path5.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs.existsSync(`${localBin}${ext}`)
+            (ext) => fs4.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs4.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path2.resolve(
-            path2.dirname(resolvedScriptPath),
+          executableDir = path5.resolve(
+            path5.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path2.basename(
+            const legacyName = path5.basename(
               this._scriptPath,
-              path2.extname(this._scriptPath)
+              path5.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path2.extname(executableFile));
+        launchWithNode = sourceExt.includes(path5.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path2.basename(filename, path2.extname(filename));
+        this._name = path5.basename(filename, path5.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path3) {
-        if (path3 === void 0) return this._executableDir;
-        this._executableDir = path3;
+      executableDir(path6) {
+        if (path6 === void 0) return this._executableDir;
+        this._executableDir = path6;
         return this;
       }
       /**
@@ -6288,8 +6288,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input = path2;
+    function removeDotSegments(path5) {
+      let input = path5;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -6488,8 +6488,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path2, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const [path5, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -9851,12 +9851,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs, exportName) {
+    function addFormats(ajv, list, fs4, exportName) {
       var _a2;
       var _b;
       (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== void 0 ? _a2 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs[f]);
+        ajv.addFormat(f, fs4[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -10787,8 +10787,8 @@ var resolvedOrgCache = /* @__PURE__ */ new Map();
 function cacheKey(apiUrl, token) {
   return `${apiUrl}::${token}`;
 }
-function isOrgRequiredPath(path2) {
-  return path2.startsWith("/v1/console/") && !path2.startsWith("/v1/console/auth/");
+function isOrgRequiredPath(path5) {
+  return path5.startsWith("/v1/console/") && !path5.startsWith("/v1/console/auth/");
 }
 async function discoverDefaultOrgId(apiUrl, token) {
   const key = cacheKey(apiUrl, token);
@@ -10810,16 +10810,16 @@ async function discoverDefaultOrgId(apiUrl, token) {
   }
   return usable;
 }
-async function apiFetch(path2, init = {}) {
-  const res = await apiFetchRaw(path2, init);
+async function apiFetch(path5, init = {}) {
+  const res = await apiFetchRaw(path5, init);
   return res.json();
 }
-async function apiFetchRaw(path2, init = {}) {
+async function apiFetchRaw(path5, init = {}) {
   const { orgId, apiUrlOverride, ...fetchInit } = init;
   const creds = loadCredentials(apiUrlOverride);
-  const url2 = creds.apiUrl.replace(/\/$/, "") + path2;
+  const url2 = creds.apiUrl.replace(/\/$/, "") + path5;
   let resolvedOrgId = isUsableOrgId(orgId) ? orgId : isUsableOrgId(creds.orgId) ? creds.orgId : void 0;
-  if (!resolvedOrgId && isOrgRequiredPath(path2)) {
+  if (!resolvedOrgId && isOrgRequiredPath(path5)) {
     try {
       const discovered = await discoverDefaultOrgId(creds.apiUrl, creds.token);
       if (isUsableOrgId(discovered)) {
@@ -10853,7 +10853,7 @@ async function apiFetchRaw(path2, init = {}) {
     const errorMsg = body.error || responseText || `HTTP ${res.status}`;
     const remediation = body.remediation || getRemediation(res.status);
     throw new FohError({
-      step: path2,
+      step: path5,
       error: errorMsg,
       remediation,
       statusCode: res.status,
@@ -13957,11 +13957,11 @@ function serialiseManifest(manifest) {
 function flattenObject(obj, prefix = "") {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
-    const path2 = prefix ? `${prefix}.${key}` : key;
+    const path5 = prefix ? `${prefix}.${key}` : key;
     if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      Object.assign(result, flattenObject(value, path2));
+      Object.assign(result, flattenObject(value, path5));
     } else {
-      result[path2] = value;
+      result[path5] = value;
     }
   }
   return result;
@@ -13976,12 +13976,12 @@ function diffManifest(current, desired) {
     "agent"
   );
   const diffs = [];
-  for (const [path2, desiredVal] of Object.entries(desiredFlat)) {
-    const currentVal = currentFlat[path2];
+  for (const [path5, desiredVal] of Object.entries(desiredFlat)) {
+    const currentVal = currentFlat[path5];
     const currentSer = JSON.stringify(currentVal);
     const desiredSer = JSON.stringify(desiredVal);
     if (currentSer !== desiredSer) {
-      diffs.push({ path: path2, from: currentVal, to: desiredVal });
+      diffs.push({ path: path5, from: currentVal, to: desiredVal });
     }
   }
   return diffs;
@@ -15180,15 +15180,406 @@ function registerTemplates(program3) {
   }));
 }
 
-// src/commands/widget.ts
-var SMOKE_TURNS = [
-  "Hello, I need help with a property",
-  "I am interested in buying a 3-bedroom house in the area",
-  "Can I book a viewing for this week?"
+// src/lib/widget-platforms.ts
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_os = __toESM(require("node:os"));
+var import_node_path = __toESM(require("node:path"));
+var import_node_child_process = require("node:child_process");
+
+// src/lib/widget-install-guidance.ts
+function normalizeOriginHint(originOrHost) {
+  if (!originOrHost) return null;
+  const value = originOrHost.trim();
+  if (!value) return null;
+  if (/^https?:\/\//i.test(value)) return value;
+  return `https://${value}`;
+}
+function uniqueCommands(commands) {
+  return Array.from(new Set(commands.filter((command) => Boolean(command && command.trim()))));
+}
+function buildWidgetSmokeCommand(params) {
+  const origin = normalizeOriginHint(params.origin);
+  if (params.publicKey) {
+    return `foh widget smoke --channel ${params.publicKey} --json${origin ? ` --origin ${origin}` : ""}`;
+  }
+  if (params.agentId) {
+    return `foh widget smoke --agent ${params.agentId} --json`;
+  }
+  return null;
+}
+function buildWidgetVerifyInstallCommand(params) {
+  if (!params.publicKey) return null;
+  const origin = normalizeOriginHint(params.origin);
+  const resolvedOrigin = origin ?? (params.placeholderOrigin ? "https://www.example.com" : null);
+  return `foh widget verify-install --channel ${params.publicKey} --json${resolvedOrigin ? ` --origin ${resolvedOrigin}` : ""}`;
+}
+function buildWidgetInstallGuidance(params) {
+  const domainAllowlist = Array.isArray(params.domains) ? params.domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : [];
+  const originHint = normalizeOriginHint(params.origin) ?? normalizeOriginHint(domainAllowlist[0]);
+  const installVerificationCommand = buildWidgetVerifyInstallCommand({
+    publicKey: params.publicKey,
+    origin: originHint,
+    placeholderOrigin: params.placeholderOrigin
+  });
+  const runtimeSmokeCommand = buildWidgetSmokeCommand({
+    publicKey: params.publicKey,
+    agentId: params.agentId,
+    origin: originHint
+  });
+  return {
+    widget_public_key: params.publicKey?.trim() || null,
+    domain_allowlist: domainAllowlist,
+    origin_hint: originHint,
+    install_verification_command: installVerificationCommand,
+    runtime_smoke_command: runtimeSmokeCommand,
+    verification_commands: uniqueCommands([installVerificationCommand ?? runtimeSmokeCommand])
+  };
+}
+
+// src/lib/widget-platforms.ts
+var DEFAULT_WIDGET_API_URL = "https://api.frontofhouse.okii.uk";
+var DEFAULT_WORDPRESS_PLUGIN_NAME = "Front Of House Widget";
+var SUPPORTED_INSTALL_PLATFORMS = ["custom", "wordpress", "wix", "squarespace", "webflow", "shopify"];
+var SHARED_BUILDER_INTRO = [
+  "Use the platform custom-code or embed surface, not a theme redesign path.",
+  "Paste the hosted Front Of House snippet exactly as generated unless a native adapter is provided.",
+  "Keep the widget domain allowlist aligned to the real production website hostnames."
 ];
-function isGenericTroubleReply(reply) {
-  const normalized = reply.trim().toLowerCase();
-  return /\bi'?m sorry\b/.test(normalized) && /having trouble|try again|something went wrong|unable to help right now/.test(normalized);
+var BUILDER_PLATFORM_GUIDES = {
+  wordpress: {
+    label: "WordPress",
+    paste_surface: "Custom HTML block or site-wide code injection area",
+    steps: [
+      "Preferred path: generate the preconfigured WordPress plugin bundle and upload/activate it in WordPress.",
+      "Fallback path: open the page, template, or footer area where the widget should load.",
+      "Use a Custom HTML block for page-level install, or the site code-injection/header-footer area for site-wide install.",
+      "If using manual embed, paste the snippet once, publish the page/theme change, then verify on the live site domain."
+    ],
+    nativeAdapterCommand: ({ publicKey }) => publicKey ? `foh widget wordpress-plugin --channel ${publicKey} --out ./front-of-house-widget --json` : null
+  },
+  wix: {
+    label: "Wix",
+    paste_surface: "Custom code or embed area",
+    steps: [
+      "Open the site custom-code or embed settings for the target page or all pages.",
+      "Paste the snippet into the body/site code area that supports custom scripts.",
+      "Publish the Wix site, then verify on the live site domain."
+    ]
+  },
+  squarespace: {
+    label: "Squarespace",
+    paste_surface: "Code Injection or Embed block",
+    steps: [
+      "Open the target page or the global code-injection area.",
+      "Paste the snippet into a code/embed block for page-level install or the global injection area for site-wide install.",
+      "Save, publish, and verify on the live site domain."
+    ]
+  },
+  webflow: {
+    label: "Webflow",
+    paste_surface: "Embed element or page/site custom code",
+    steps: [
+      "Open the target page or the site/page custom-code settings.",
+      "Paste the snippet into an Embed element or the footer custom-code area.",
+      "Publish the site, then verify on the live site domain."
+    ]
+  },
+  shopify: {
+    label: "Shopify",
+    paste_surface: "Theme custom liquid/embed area",
+    steps: [
+      "Open the active theme customization or theme code area.",
+      "Add the snippet once through a custom liquid/embed block or the theme custom-code area.",
+      "Save the theme change, publish if needed, then verify on the live storefront domain."
+    ]
+  }
+};
+function resolveWidgetApiUrl(apiUrlOverride) {
+  return (apiUrlOverride || DEFAULT_WIDGET_API_URL).replace(/\/$/, "");
+}
+function widgetSnippetFromPublicKey(publicKey, apiUrl) {
+  const resolvedApiUrl = resolveWidgetApiUrl(apiUrl);
+  return `<script src="${resolvedApiUrl}/widget.js" data-channel="${publicKey}" data-api-url="${resolvedApiUrl}" async></script>`;
+}
+function normalizeInstallPlatform(value) {
+  const normalized = typeof value === "string" ? value.trim().toLowerCase() : "custom";
+  if (!normalized) return "custom";
+  if (SUPPORTED_INSTALL_PLATFORMS.includes(normalized)) return normalized;
+  throw new FohError({
+    step: "install.platform",
+    error: `Unsupported platform: ${String(value || "")}`,
+    remediation: `Use one of: ${SUPPORTED_INSTALL_PLATFORMS.join(", ")}`
+  });
+}
+function isBuilderHostedPlatform(platform) {
+  return platform !== "custom";
+}
+function buildBuilderPlatformInstructions(params) {
+  const guide = BUILDER_PLATFORM_GUIDES[params.platform];
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: params.publicKey,
+    domains: params.domains,
+    origin: params.origin
+  });
+  return {
+    schema_version: "foh_widget_builder_install.v1",
+    platform: params.platform,
+    platform_label: guide.label,
+    paste_surface: guide.paste_surface,
+    snippet: params.snippet,
+    ...guidance,
+    steps: [...SHARED_BUILDER_INTRO, ...guide.steps],
+    native_adapter_command: guide.nativeAdapterCommand?.({ publicKey: params.publicKey }) ?? null
+  };
+}
+function slugifyWordPressPluginName(name) {
+  const normalized = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "front-of-house-widget";
+}
+function renderWordPressPluginPhp(params) {
+  return `<?php
+/**
+ * Plugin Name: ${params.pluginName}
+ * Description: Injects the hosted Front Of House widget site-wide.
+ * Version: 0.1.0
+ * Author: Front Of House
+ */
+
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+function foh_widget_render() {
+    ?>
+<script src="<?php echo esc_url('${params.apiUrl}/widget.js'); ?>" data-channel="<?php echo esc_attr('${params.publicKey}'); ?>" data-api-url="<?php echo esc_url('${params.apiUrl}'); ?>" async></script>
+    <?php
+}
+
+add_action('wp_footer', 'foh_widget_render', 100);
+`;
+}
+function renderWordPressPluginReadme(params) {
+  return `${params.pluginName}
+======================
+
+This plugin injects the hosted Front Of House widget site-wide.
+
+Public widget key: ${params.publicKey}
+API URL: ${params.apiUrl}
+
+Install:
+1. Upload this plugin to WordPress.
+2. Activate it.
+3. Verify the live site with:
+   ${params.verificationCommand}
+`;
+}
+function writeUtf8File(targetPath, content, dryRun) {
+  if (dryRun) return;
+  import_node_fs.default.mkdirSync(import_node_path.default.dirname(targetPath), { recursive: true });
+  import_node_fs.default.writeFileSync(targetPath, content, "utf8");
+}
+function packZipDirectory(sourceDir, outputZipPath) {
+  if (process.platform === "win32") {
+    const script = `Compress-Archive -LiteralPath '${sourceDir.replace(/'/g, "''")}' -DestinationPath '${outputZipPath.replace(/'/g, "''")}' -Force`;
+    const result2 = (0, import_node_child_process.spawnSync)("powershell.exe", ["-NoProfile", "-Command", script], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    if (result2.status !== 0) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: "Failed to package the WordPress plugin zip.",
+        remediation: "Use a directory output path instead of a .zip path, or rerun on a host with zip packaging support.",
+        detail: {
+          stdout: String(result2.stdout || ""),
+          stderr: String(result2.stderr || "")
+        }
+      });
+    }
+    return;
+  }
+  const result = (0, import_node_child_process.spawnSync)("zip", ["-qr", outputZipPath, import_node_path.default.basename(sourceDir)], {
+    cwd: import_node_path.default.dirname(sourceDir),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    throw new FohError({
+      step: "widget.wordpress_plugin",
+      error: "Failed to package the WordPress plugin zip.",
+      remediation: "Use a directory output path instead of a .zip path, or install a zip tool and retry.",
+      detail: {
+        stdout: String(result.stdout || ""),
+        stderr: String(result.stderr || "")
+      }
+    });
+  }
+}
+function buildWordPressPluginBundle(params) {
+  const pluginName = (params.pluginName || DEFAULT_WORDPRESS_PLUGIN_NAME).trim() || DEFAULT_WORDPRESS_PLUGIN_NAME;
+  const pluginSlug = slugifyWordPressPluginName(pluginName);
+  const apiUrl = resolveWidgetApiUrl(params.apiUrl);
+  const snippet2 = widgetSnippetFromPublicKey(params.publicKey, apiUrl);
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: params.publicKey,
+    placeholderOrigin: true
+  });
+  const requestedOutput = import_node_path.default.resolve(params.outPath);
+  const zipOutput = /\.zip$/i.test(requestedOutput);
+  const artifactType = zipOutput ? "zip" : "directory";
+  const bundleRoot = zipOutput ? import_node_path.default.join(import_node_fs.default.mkdtempSync(import_node_path.default.join(import_node_os.default.tmpdir(), "foh-wp-plugin-")), pluginSlug) : requestedOutput;
+  const entryFile = import_node_path.default.join(bundleRoot, `${pluginSlug}.php`);
+  const readmeFile = import_node_path.default.join(bundleRoot, "README.txt");
+  if (!params.dryRun) {
+    if (artifactType === "directory" && import_node_fs.default.existsSync(requestedOutput)) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: `Output path already exists: ${requestedOutput}`,
+        remediation: "Choose a new output path for the plugin bundle."
+      });
+    }
+    if (artifactType === "zip" && import_node_fs.default.existsSync(requestedOutput)) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: `Output zip already exists: ${requestedOutput}`,
+        remediation: "Choose a new .zip output path for the plugin bundle."
+      });
+    }
+  }
+  try {
+    writeUtf8File(entryFile, renderWordPressPluginPhp({
+      pluginName,
+      publicKey: params.publicKey,
+      apiUrl
+    }), Boolean(params.dryRun));
+    writeUtf8File(readmeFile, renderWordPressPluginReadme({
+      pluginName,
+      publicKey: params.publicKey,
+      apiUrl,
+      verificationCommand: guidance.install_verification_command || `foh widget verify-install --channel ${params.publicKey} --json --origin https://www.example.com`
+    }), Boolean(params.dryRun));
+    if (!params.dryRun && artifactType === "zip") {
+      import_node_fs.default.mkdirSync(import_node_path.default.dirname(requestedOutput), { recursive: true });
+      packZipDirectory(bundleRoot, requestedOutput);
+    }
+    return {
+      schema_version: "foh_wordpress_plugin_bundle.v1",
+      status: params.dryRun ? "dry_run" : "generated",
+      artifact_type: artifactType,
+      output_path: requestedOutput,
+      plugin_name: pluginName,
+      plugin_slug: pluginSlug,
+      plugin_entry_file: artifactType === "zip" ? `${pluginSlug}/${pluginSlug}.php` : import_node_path.default.relative(process.cwd(), entryFile).replaceAll("\\", "/"),
+      ...guidance,
+      api_url: apiUrl,
+      snippet: snippet2
+    };
+  } finally {
+    if (!params.dryRun && artifactType === "zip") {
+      try {
+        import_node_fs.default.rmSync(import_node_path.default.dirname(bundleRoot), { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
+// src/lib/widget-site-install.ts
+var import_node_fs2 = __toESM(require("node:fs"));
+var import_node_path2 = __toESM(require("node:path"));
+var WIDGET_MARKER_START = "<!-- Front Of House widget start -->";
+var WIDGET_MARKER_END = "<!-- Front Of House widget end -->";
+var WIDGET_JSX_MARKER_START = "{/* Front Of House widget start */}";
+var WIDGET_JSX_MARKER_END = "{/* Front Of House widget end */}";
+function isPathInside(basePath, candidatePath) {
+  const relative4 = import_node_path2.default.relative(basePath, candidatePath);
+  return relative4 === "" || !relative4.startsWith("..") && !import_node_path2.default.isAbsolute(relative4);
+}
+function normalizeSnippet(snippet2) {
+  return snippet2.trim();
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isJsxLayoutPath(targetPath) {
+  return /\.(tsx|jsx)$/i.test(targetPath);
+}
+function markedSnippet(snippet2, targetPath) {
+  const normalized = normalizeSnippet(snippet2);
+  if (isJsxLayoutPath(targetPath)) {
+    return `${WIDGET_JSX_MARKER_START}
+${normalized}
+${WIDGET_JSX_MARKER_END}`;
+  }
+  return `${WIDGET_MARKER_START}
+${normalized}
+${WIDGET_MARKER_END}`;
+}
+function extractChannelPublicKeyFromSnippet(snippet2) {
+  const match = snippet2.match(/\bdata-channel=(["'])([^"']+)\1/i);
+  return match?.[2]?.trim() || void 0;
+}
+function installWidgetSnippetIntoShell(source, snippet2, targetPath) {
+  const jsxShell = isJsxLayoutPath(targetPath);
+  const markerStart = jsxShell ? WIDGET_JSX_MARKER_START : WIDGET_MARKER_START;
+  const markerEnd = jsxShell ? WIDGET_JSX_MARKER_END : WIDGET_MARKER_END;
+  const block = markedSnippet(snippet2, targetPath);
+  const existingBlockPattern = new RegExp(
+    `${escapeRegex(markerStart)}[\\s\\S]*?${escapeRegex(markerEnd)}`,
+    "m"
+  );
+  if (existingBlockPattern.test(source)) {
+    const html2 = source.replace(existingBlockPattern, block);
+    return {
+      html: html2,
+      changed: html2 !== source,
+      mode: html2 === source ? "unchanged" : "replaced",
+      markerStart,
+      markerEnd
+    };
+  }
+  if (!/<\/body>/i.test(source)) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "No </body> tag found in target file.",
+      remediation: "Pass --target for a site shell such as index.html or app/layout.tsx, or paste the embed snippet into the site shell manually."
+    });
+  }
+  const html = source.replace(/<\/body>/i, `  ${block}
+  </body>`);
+  return { html, changed: html !== source, mode: "inserted", markerStart, markerEnd };
+}
+function resolveWidgetInstallTarget(siteRoot, target) {
+  const root = import_node_path2.default.resolve(siteRoot || ".");
+  const candidates = target ? [target] : [
+    "index.html",
+    import_node_path2.default.join("apps", "web", "index.html"),
+    import_node_path2.default.join("apps", "frontend", "index.html"),
+    import_node_path2.default.join("apps", "site", "index.html"),
+    import_node_path2.default.join("apps", "landing", "index.html"),
+    import_node_path2.default.join("app", "layout.tsx"),
+    import_node_path2.default.join("app", "layout.jsx"),
+    import_node_path2.default.join("src", "app", "layout.tsx"),
+    import_node_path2.default.join("src", "app", "layout.jsx")
+  ];
+  for (const candidate of candidates) {
+    const resolved = import_node_path2.default.resolve(root, candidate);
+    if (!isPathInside(root, resolved)) {
+      throw new FohError({
+        step: "widget.install_site",
+        error: `Refusing to patch a file outside --site-root: ${candidate}`,
+        remediation: "Run the command from the website repository root or pass a target inside --site-root."
+      });
+    }
+    if (import_node_fs2.default.existsSync(resolved) && import_node_fs2.default.statSync(resolved).isFile()) return resolved;
+  }
+  throw new FohError({
+    step: "widget.install_site",
+    error: "Could not find a supported site shell to patch.",
+    remediation: "Pass --target index.html, --target apps/web/index.html, or --target app/layout.tsx from the website repository root."
+  });
 }
 async function resolveChannelPublicKey(agentId, orgId, apiUrlOverride) {
   const data = await apiFetch(
@@ -15204,7 +15595,209 @@ async function resolveChannelPublicKey(agentId, orgId, apiUrlOverride) {
   }
   return data.channel.public_key;
 }
-async function runWidgetSmoke(publicKey, apiUrlOverride) {
+async function installWidgetSite(opts) {
+  if (!opts.snippet && !opts.agent) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "Missing --agent or --snippet.",
+      remediation: "Run: foh install <install-link>, or foh install --agent <agent-id> --domains example.com,www.example.com"
+    });
+  }
+  const agentId = opts.agent;
+  const domains = Array.isArray(opts.domains) ? opts.domains.map((domain2) => domain2.trim()).filter(Boolean) : [];
+  let snippet2 = typeof opts.snippet === "string" ? opts.snippet : "";
+  let widgetPublicKey;
+  if (!snippet2) {
+    if (!agentId) {
+      throw new FohError({
+        step: "widget.install_site",
+        error: "Missing --agent.",
+        remediation: "Run: foh install <install-link>, or foh install --agent <agent-id>"
+      });
+    }
+    await apiFetch("/v1/console/channels/widget/ensure", {
+      method: "POST",
+      body: JSON.stringify({ agentId }),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    if (domains.length > 0) {
+      await apiFetch("/v1/console/channels/widget/domains", {
+        method: "POST",
+        body: JSON.stringify({ agentId, domains }),
+        orgId: opts.org,
+        apiUrlOverride: opts.apiUrl
+      });
+    }
+    const embed = await apiFetch(
+      "/v1/console/channels/widget/embed-snippet",
+      {
+        orgId: opts.org,
+        apiUrlOverride: opts.apiUrl,
+        headers: { "x-agent-id": agentId }
+      }
+    );
+    snippet2 = String(embed.snippet || "").trim();
+    widgetPublicKey = embed.widget_public_key;
+  } else {
+    widgetPublicKey = extractChannelPublicKeyFromSnippet(snippet2);
+  }
+  if (!snippet2) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "Widget embed snippet is empty.",
+      remediation: "Run: foh widget embed-snippet --agent <agent-id> --json"
+    });
+  }
+  const targetPath = resolveWidgetInstallTarget(opts.siteRoot || ".", opts.target);
+  const before = import_node_fs2.default.readFileSync(targetPath, "utf8");
+  const patch = installWidgetSnippetIntoShell(before, snippet2, targetPath);
+  if (!opts.dryRun && patch.changed) {
+    import_node_fs2.default.writeFileSync(targetPath, patch.html, "utf8");
+  }
+  const relativeTarget = import_node_path2.default.relative(process.cwd(), targetPath).replaceAll("\\", "/");
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: widgetPublicKey ?? null,
+    agentId: opts.agent,
+    domains
+  });
+  return {
+    schema_version: "foh_widget_site_install.v1",
+    status: opts.dryRun ? "dry_run" : "installed",
+    target_path: relativeTarget,
+    absolute_target_path: targetPath,
+    changed: patch.changed,
+    mode: patch.mode,
+    marker_start: patch.markerStart,
+    marker_end: patch.markerEnd,
+    ...guidance,
+    snippet: snippet2,
+    next_commands: ["build the website", ...guidance.verification_commands]
+  };
+}
+async function ensureWidgetChannelPublicKey(agentId, orgId, apiUrlOverride) {
+  return resolveChannelPublicKey(agentId, orgId, apiUrlOverride);
+}
+
+// src/lib/widget-public.ts
+var SMOKE_TURNS = [
+  "Hello, I need help with a property",
+  "I am interested in buying a 3-bedroom house in the area",
+  "Can I book a viewing for this week?"
+];
+function isGenericTroubleReply(reply) {
+  const normalized = reply.trim().toLowerCase();
+  return /\bi'?m sorry\b/.test(normalized) && /having trouble|try again|something went wrong|unable to help right now/.test(normalized);
+}
+function isProgressPlaceholderReply(reply) {
+  const normalized = reply.trim().toLowerCase();
+  return /still working on that|one moment|just a moment|please hold|bear with me/.test(normalized);
+}
+function normalizeOrigin(originOrHost) {
+  if (!originOrHost) return void 0;
+  const value = originOrHost.trim();
+  if (!value) return void 0;
+  if (/^https?:\/\//i.test(value)) return value;
+  return `https://${value}`;
+}
+async function postPublicWidgetInbound(payload, apiUrlOverride, originOverride) {
+  const res = await fetch(`${resolveWidgetApiUrl(apiUrlOverride)}/v1/widget/inbound`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...originOverride ? { Origin: originOverride } : {}
+    },
+    body: JSON.stringify(payload)
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "/v1/widget/inbound",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.remediation || "Check the widget public key and API health, then retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return body;
+}
+async function fetchPublicWidgetInstallVerification(publicKey, apiUrlOverride, originOverride) {
+  const apiUrl = resolveWidgetApiUrl(apiUrlOverride);
+  const url2 = new URL(`${apiUrl}/v1/widget/install-verification`);
+  url2.searchParams.set("key", publicKey);
+  const res = await fetch(url2.toString(), {
+    method: "GET",
+    headers: {
+      ...originOverride ? { Origin: originOverride } : {}
+    }
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "/v1/widget/install-verification",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.code === "domain_not_allowed" ? "Use the live website origin with --origin https://www.example.com and confirm the domain allowlist." : body?.code === "invalid_widget_public_key" ? "Check the widget public key or regenerate the install link." : "Check the widget public key, origin, and API health, then retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return body;
+}
+function normalizeReplyText(value) {
+  return value.trim().toLowerCase();
+}
+function matchAnyTerms(reply, terms) {
+  if (!Array.isArray(terms) || terms.length === 0) return true;
+  const normalized = normalizeReplyText(reply);
+  return terms.some((term) => normalized.includes(term.toLowerCase()));
+}
+function matchForbiddenTerms(reply, terms) {
+  if (!Array.isArray(terms) || terms.length === 0) return false;
+  const normalized = normalizeReplyText(reply);
+  return terms.some((term) => normalized.includes(term.toLowerCase()));
+}
+function resolveSemanticEvalPack(profile) {
+  const semanticEvalProfile = typeof profile?.semantic_eval_profile === "string" ? profile.semantic_eval_profile.trim().toLowerCase() : "";
+  const businessName = typeof profile?.business_name === "string" ? profile.business_name.trim().toLowerCase() : "";
+  const businessCategory = typeof profile?.business_category === "string" ? profile.business_category.trim().toLowerCase() : "";
+  if (semanticEvalProfile === "okii_consulting" || businessName === "okii" || businessCategory === "real_estate_ai_consulting") {
+    return {
+      id: "okii_consulting",
+      scenarios: [
+        {
+          id: "identity",
+          message: "What does OKII do?",
+          required_any: ["okii", "ai", "front", "automation"],
+          forbidden_any: ["estate agency", "estate agent", "book a viewing"]
+        },
+        {
+          id: "non_estate_identity",
+          message: "Are you an estate agent?",
+          required_any: ["not an estate agency", "not an estate agent", "okii"],
+          forbidden_any: ["we can book a viewing", "valuation request"]
+        },
+        {
+          id: "consulting_lead",
+          message: "I run an estate agency and want AI help with calls and leads.",
+          required_any: ["ai", "calls", "leads", "workflow", "automate"],
+          forbidden_any: ["which property", "book the viewing"]
+        }
+      ]
+    };
+  }
+  return null;
+}
+async function runWidgetSmoke(publicKey, apiUrlOverride, originOverride) {
   let conversationId;
   const traceIds = [];
   const correlationIds = [];
@@ -15213,34 +15806,31 @@ async function runWidgetSmoke(publicKey, apiUrlOverride) {
     const message = SMOKE_TURNS[i];
     const start = Date.now();
     try {
-      const data = await apiFetch(
-        "/v1/widget/inbound",
-        {
-          method: "POST",
-          body: JSON.stringify({
-            channel_public_key: publicKey,
-            message_body: message,
-            preview: true,
-            ...conversationId ? { conversation_id: conversationId } : {}
-          }),
-          apiUrlOverride
-        }
-      );
+      const data = await postPublicWidgetInbound({
+        channel_public_key: publicKey,
+        message_body: message,
+        ...conversationId ? { conversation_id: conversationId } : {}
+      }, apiUrlOverride, originOverride);
       const latencyMs = Date.now() - start;
       if (!data.reply) throw new Error("Empty reply");
       conversationId = data.conversationId;
       if (data.trace_id) traceIds.push(data.trace_id);
       if (data.correlation_id) correlationIds.push(data.correlation_id);
       const genericTroubleReply = isGenericTroubleReply(data.reply);
+      const placeholderReply = isProgressPlaceholderReply(data.reply);
+      const unhealthyReply = genericTroubleReply || placeholderReply;
       turns.push({
         turn: i + 1,
         message,
-        ok: !genericTroubleReply,
+        ok: !unhealthyReply,
         latency_ms: latencyMs,
         reply: data.reply,
         ...genericTroubleReply ? {
           reason_code: "widget_generic_trouble_reply",
           error: "Widget returned a generic trouble reply instead of advancing the customer request."
+        } : placeholderReply ? {
+          reason_code: "widget_progress_placeholder_reply",
+          error: "Widget returned a placeholder holding reply instead of advancing the customer request."
         } : {},
         conversation_id: data.conversationId,
         trace_id: data.trace_id ?? null,
@@ -15261,6 +15851,119 @@ async function runWidgetSmoke(publicKey, apiUrlOverride) {
     turns
   };
 }
+async function runWidgetSemanticEval(publicKey, apiUrlOverride, originOverride, profile) {
+  const pack = resolveSemanticEvalPack(profile);
+  if (!pack) {
+    return {
+      pack_id: null,
+      passed: 0,
+      failed: 0,
+      turns: []
+    };
+  }
+  const turns = [];
+  for (const scenario of pack.scenarios) {
+    try {
+      const data = await postPublicWidgetInbound({
+        channel_public_key: publicKey,
+        message_body: scenario.message
+      }, apiUrlOverride, originOverride);
+      const reply = String(data.reply || "");
+      const missingRequired = !matchAnyTerms(reply, scenario.required_any);
+      const foundForbidden = matchForbiddenTerms(reply, scenario.forbidden_any);
+      const ok = !missingRequired && !foundForbidden && !isGenericTroubleReply(reply) && !isProgressPlaceholderReply(reply);
+      turns.push({
+        scenario_id: scenario.id,
+        ok,
+        message: scenario.message,
+        reply,
+        ...ok ? {} : {
+          reason_code: missingRequired ? "widget_semantic_required_terms_missing" : foundForbidden ? "widget_semantic_forbidden_terms_found" : isGenericTroubleReply(reply) ? "widget_generic_trouble_reply" : "widget_progress_placeholder_reply"
+        },
+        trace_id: data.trace_id ?? null,
+        correlation_id: data.correlation_id ?? null
+      });
+    } catch (err) {
+      turns.push({
+        scenario_id: scenario.id,
+        ok: false,
+        message: scenario.message,
+        error: err?.message || String(err),
+        reason_code: "widget_semantic_request_failed"
+      });
+    }
+  }
+  return {
+    pack_id: pack.id,
+    passed: turns.filter((turn) => turn.ok).length,
+    failed: turns.filter((turn) => !turn.ok).length,
+    turns
+  };
+}
+async function runWidgetInstallVerification(publicKey, apiUrlOverride, originOverride) {
+  const checks = [];
+  try {
+    const config2 = await fetchPublicWidgetInstallVerification(publicKey, apiUrlOverride, originOverride);
+    checks.push({
+      name: "install_config",
+      status: "pass",
+      reason_code: "install_config_ok",
+      summary: "Public install verification config is reachable and the origin passed the domain gate.",
+      detail: config2
+    });
+  } catch (error2) {
+    checks.push({
+      name: "install_config",
+      status: "fail",
+      reason_code: error2?.detail?.code === "domain_not_allowed" ? "domain_not_allowed" : error2?.detail?.code === "invalid_widget_public_key" ? "invalid_widget_public_key" : "install_config_request_failed",
+      summary: error2?.message || String(error2),
+      detail: error2?.detail || null,
+      next_command: "Confirm the live site origin and widget public key, then rerun verification."
+    });
+    checks.push({
+      name: "widget_smoke",
+      status: "skipped",
+      reason_code: "install_config_required",
+      summary: "Skipped because install-config verification failed.",
+      next_command: "Fix install-config verification first, then rerun this command."
+    });
+    return {
+      schema_version: "foh_widget_public_install_verification.v1",
+      status: "fail",
+      widget_public_key: publicKey,
+      origin: originOverride ?? null,
+      checks
+    };
+  }
+  const smoke = await runWidgetSmoke(publicKey, apiUrlOverride, originOverride);
+  if (smoke.failed > 0) {
+    checks.push({
+      name: "widget_smoke",
+      status: "fail",
+      reason_code: "widget_smoke_failed",
+      summary: `${smoke.failed} widget smoke turn(s) failed.`,
+      detail: smoke,
+      next_command: `Run: foh widget smoke --channel ${publicKey} --json${originOverride ? ` --origin ${originOverride}` : ""}`
+    });
+  } else {
+    checks.push({
+      name: "widget_smoke",
+      status: "pass",
+      reason_code: "widget_smoke_ok",
+      summary: "Widget smoke passed from the public builder-install path.",
+      detail: smoke
+    });
+  }
+  return {
+    schema_version: "foh_widget_public_install_verification.v1",
+    status: checks.some((check2) => check2.status === "fail") ? "fail" : "pass",
+    widget_public_key: publicKey,
+    origin: originOverride ?? null,
+    checks
+  };
+}
+
+// src/commands/widget.ts
 function registerWidget(program3) {
   const widget = program3.command("widget").description("Manage the web widget channel");
   widget.command("ensure").description("Ensure a widget channel exists for an agent (idempotent)").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -15274,9 +15977,9 @@ function registerWidget(program3) {
   }));
   widget.command("set-domains").description("Update widget domain allowlist (idempotent)").requiredOption("--domains <d1,d2>", "Comma-separated domain list").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const domains = opts.domains.split(",").map((domain2) => domain2.trim());
-    const data = await apiFetch(`/v1/console/agents/${opts.agent}/draft`, {
-      method: "PATCH",
-      body: JSON.stringify({ allowed_domains: domains }),
+    const data = await apiFetch("/v1/console/channels/widget/domains", {
+      method: "POST",
+      body: JSON.stringify({ agentId: opts.agent, domains }),
       orgId: opts.org,
       apiUrlOverride: opts.apiUrl
     });
@@ -15294,8 +15997,47 @@ function registerWidget(program3) {
       process.stdout.write(data.snippet + "\n");
     }
   }));
+  widget.command("install-link").description("Mint a short-lived one-time website install link for an agent").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist to set before minting").option("--expires-in <seconds>", "Install-link TTL in seconds", "3600").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const domains = typeof opts.domains === "string" ? opts.domains.split(",").map((domain2) => domain2.trim()).filter(Boolean) : [];
+    const data = await apiFetch("/v1/console/channels/widget/install-link", {
+      method: "POST",
+      body: JSON.stringify({
+        agentId: opts.agent,
+        expiresInSec: Number(opts.expiresIn),
+        ...domains.length > 0 ? { domains } : {}
+      }),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const installUrl = typeof data?.install_url === "string" ? String(data.install_url) : null;
+    if (installUrl && domains.length > 0) {
+      const url2 = new URL(installUrl);
+      url2.searchParams.delete("domains");
+      for (const domain2 of domains) {
+        url2.searchParams.append("domains", domain2);
+      }
+      ;
+      data.install_url = url2.toString();
+      data.domains = domains;
+    }
+    format(data, { json: opts.json ?? false });
+  }));
+  widget.command("install-site").description("Install or update the hosted widget snippet in a static/Vite website shell").option("--agent <id>", "Agent ID; required unless --snippet is supplied").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist").option("--site-root <path>", "Website repository root", ".").option("--target <path>", "HTML shell to patch, relative to --site-root").option("--snippet <html>", "Embed snippet to install without calling the FOH API").option("--api-url <url>", "API base URL override").option("--dry-run", "Resolve and report the patch without writing the file").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const domains = typeof opts.domains === "string" ? opts.domains.split(",").map((domain2) => domain2.trim()).filter(Boolean) : [];
+    const result = await installWidgetSite({
+      agent: opts.agent,
+      org: opts.org,
+      domains,
+      siteRoot: opts.siteRoot,
+      target: opts.target,
+      snippet: opts.snippet,
+      apiUrl: opts.apiUrl,
+      dryRun: opts.dryRun
+    });
+    format(result, { json: opts.json ?? false });
+  }));
   widget.command("chat").description("Send a single message through the widget and return the reply").requiredOption("--agent <id>", "Agent ID").requiredOption("--message <text>", "Message to send").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const publicKey = await resolveChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
+    const publicKey = await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
     const start = Date.now();
     const data = await apiFetch("/v1/widget/inbound", {
       method: "POST",
@@ -15316,12 +16058,52 @@ function registerWidget(program3) {
     };
     format(result, { json: opts.json ?? false });
   }));
-  widget.command("smoke").description("Run a canned 3-turn conversation to verify end-to-end widget health").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const publicKey = await resolveChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
-    const summary = await runWidgetSmoke(publicKey, opts.apiUrl);
+  widget.command("smoke").description("Run a canned 3-turn conversation to verify end-to-end widget health").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.smoke",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget smoke --channel <public-key> --json, or foh widget smoke --agent <agent-id> --json"
+      });
+    }
+    const origin = normalizeOrigin(typeof opts.origin === "string" ? opts.origin : void 0);
+    const summary = await runWidgetSmoke(publicKey, opts.apiUrl, origin);
     format(summary, { json: opts.json ?? false });
     if (summary.failed > 0) markCommandFailed(1);
   }));
+  widget.command("verify-install").description("Run the public builder-install verification path: config/domain gate plus runtime smoke").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").option("--origin <urlOrHost>", "Live website origin to verify against, e.g. https://www.example.com").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.verify_install",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget verify-install --channel <public-key> --origin https://www.example.com --json"
+      });
+    }
+    const origin = normalizeOrigin(typeof opts.origin === "string" ? opts.origin : void 0);
+    const summary = await runWidgetInstallVerification(publicKey, opts.apiUrl, origin);
+    format(summary, { json: opts.json ?? false });
+    if (summary.status !== "pass") markCommandFailed(1);
+  }));
+  widget.command("wordpress-plugin").description("Generate a preconfigured WordPress plugin bundle for the hosted widget").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").requiredOption("--out <path>", "Output directory or .zip path for the plugin bundle").option("--plugin-name <name>", "WordPress plugin display name", DEFAULT_WORDPRESS_PLUGIN_NAME).option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--dry-run", "Resolve the bundle without writing files").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget wordpress-plugin --channel <public-key> --out <path> --json"
+      });
+    }
+    const result = buildWordPressPluginBundle({
+      publicKey,
+      apiUrl: opts.apiUrl,
+      outPath: opts.out,
+      pluginName: opts.pluginName,
+      dryRun: Boolean(opts.dryRun)
+    });
+    format(result, { json: opts.json ?? false });
+  }));
 }
 
 // src/commands/channel-instagram.ts
@@ -15428,8 +16210,8 @@ function buildReasonedNextSteps({
 }
 
 // src/commands/channel-whatsapp-live-proof.ts
-var import_node_fs = require("node:fs");
-var path = __toESM(require("node:path"));
+var import_node_fs3 = require("node:fs");
+var path3 = __toESM(require("node:path"));
 
 // src/lib/channel-live-proof-evaluator.mjs
 function normalizeStatusValue(value) {
@@ -15514,8 +16296,8 @@ function resolveLiveProof({
       freshness: { timestamp_field: null, timestamp: null, age_hours: null, max_age_hours: maxAgeHours }
     };
   }
-  const artifactPath = path.resolve(process.cwd(), artifactPathRaw);
-  if (!(0, import_node_fs.existsSync)(artifactPath)) {
+  const artifactPath = path3.resolve(process.cwd(), artifactPathRaw);
+  if (!(0, import_node_fs3.existsSync)(artifactPath)) {
     return {
       requested: true,
       artifact_path: artifactPath,
@@ -15527,7 +16309,7 @@ function resolveLiveProof({
   }
   let payload;
   try {
-    payload = JSON.parse((0, import_node_fs.readFileSync)(artifactPath, "utf8"));
+    payload = JSON.parse((0, import_node_fs3.readFileSync)(artifactPath, "utf8"));
   } catch {
     return {
       requested: true,
@@ -15556,7 +16338,7 @@ function resolveLiveProof({
 }
 
 // src/commands/channel-whatsapp-onboarding.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 
 // src/commands/channel-whatsapp-setup.ts
 var import_node_crypto = require("node:crypto");
@@ -15695,7 +16477,7 @@ function parseBatchManifest(manifestPathRaw) {
     });
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)(manifestPath, "utf8");
+    const raw = (0, import_node_fs4.readFileSync)(manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.businesses) || parsed.businesses.length === 0) {
       throw new Error("manifest_missing_businesses");
@@ -16513,7 +17295,7 @@ function registerTools(program3) {
 }
 
 // src/commands/mcp-serve.ts
-var import_node_child_process = require("node:child_process");
+var import_node_child_process2 = require("node:child_process");
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/helpers/util.js
 var util;
@@ -16874,8 +17656,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path: path5, errorMaps, issueData } = params;
+  const fullPath = [...path5, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -16990,11 +17772,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path5, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path5;
     this._key = key;
   }
   get path() {
@@ -20492,7 +21274,7 @@ __export(util_exports, {
   createTransparentProxy: () => createTransparentProxy,
   defineLazy: () => defineLazy,
   esc: () => esc,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   extend: () => extend3,
   finalizeIssue: () => finalizeIssue,
   floatSafeRemainder: () => floatSafeRemainder2,
@@ -20640,10 +21422,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -20765,7 +21547,7 @@ var getParsedType2 = (data) => {
 };
 var propertyKeyTypes = /* @__PURE__ */ new Set(["string", "number", "symbol"]);
 var primitiveTypes = /* @__PURE__ */ new Set(["string", "number", "bigint", "boolean", "symbol", "undefined"]);
-function escapeRegex(str2) {
+function escapeRegex2(str2) {
   return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -21026,11 +21808,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -21384,7 +22166,7 @@ function emoji() {
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+  const escapedDelim = escapeRegex2(delimiter ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -21885,7 +22667,7 @@ var $ZodCheckUpperCase = /* @__PURE__ */ $constructor("$ZodCheckUpperCase", (ins
 });
 var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const escapedRegex = escapeRegex(def.includes);
+  const escapedRegex = escapeRegex2(def.includes);
   const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
   def.pattern = pattern;
   inst._zod.onattach.push((inst2) => {
@@ -21909,7 +22691,7 @@ var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst,
 });
 var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+  const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -21932,7 +22714,7 @@ var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (i
 });
 var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+  const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -23474,7 +24256,7 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
   const values = getEnumValues(def.entries);
   const valuesSet = new Set(values);
   inst._zod.values = valuesSet;
-  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex2(o) : o.toString()).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (valuesSet.has(input)) {
@@ -23496,7 +24278,7 @@ var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
   }
   const values = new Set(def.values);
   inst._zod.values = values;
-  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex2(o) : o ? escapeRegex2(o.toString()) : String(o)).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (values.has(input)) {
@@ -23852,7 +24634,7 @@ var $ZodTemplateLiteral = /* @__PURE__ */ $constructor("$ZodTemplateLiteral", (i
       const end = source.endsWith("$") ? source.length - 1 : source.length;
       regexParts.push(source.slice(start, end));
     } else if (part === null || primitiveTypes.has(typeof part)) {
-      regexParts.push(escapeRegex(`${part}`));
+      regexParts.push(escapeRegex2(`${part}`));
     } else {
       throw new Error(`Invalid template literal part: ${part}`);
     }
@@ -32941,7 +33723,7 @@ var StdioServerTransport = class {
 };
 
 // src/lib/cli-version.ts
-var injectedVersion = true ? String("0.1.88").trim() : "";
+var injectedVersion = true ? String("0.1.89").trim() : "";
 var envVersion = String(process.env.FOH_CLI_VERSION || process.env.npm_package_version || "").trim();
 var CLI_VERSION = injectedVersion || envVersion || "0.0.0-dev";
 
@@ -33129,7 +33911,7 @@ async function runFohCli(params) {
   }
   const command = `foh ${effectiveArgv.join(" ")}`;
   return await new Promise((resolve16) => {
-    const child = (0, import_node_child_process.spawn)(process.execPath, [cliEntry, ...effectiveArgv], {
+    const child = (0, import_node_child_process2.spawn)(process.execPath, [cliEntry, ...effectiveArgv], {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
         ...process.env,
@@ -33207,6 +33989,19 @@ var TOOL_EXECUTION_SCHEMA = {
 var APPROVAL_TOKEN_SCHEMA = {
   approval_token: string2().min(1).max(256).optional()
 };
+var MCP_OBJECTIVE_INDUSTRIES = ["real_estate", "restaurant", "general"];
+var MCP_TEMPLATE_CATEGORIES = ["buyer", "seller", "landlord", "commercial"];
+var MCP_PROOF_MISSIONS = ["setup", "widget", "voice", "publish"];
+var MCP_CONTACT_PATHS = ["auto", "managed", "byon"];
+var MCP_MUTATION_MODES = ["read-only", "ensure"];
+function appendOptionalArg(argv, flag, value) {
+  const text = asOptionalString(value);
+  if (text) argv.push(flag, text);
+}
+function appendOptionalCsvArg(argv, flag, value) {
+  const values = asStringArray(value);
+  if (values.length > 0) argv.push(flag, values.join(","));
+}
 var TYPED_TOOL_SPECS = [
   {
     name: "foh_auth_whoami",
@@ -33263,6 +34058,193 @@ var TYPED_TOOL_SPECS = [
       return argv;
     }
   },
+  {
+    name: "foh_templates_list",
+    title: "FOH Templates List",
+    description: "List available setup templates, optionally filtered by category.",
+    commandKey: "templates list",
+    risk: "read",
+    inputSchema: {
+      category: _enum(MCP_TEMPLATE_CATEGORIES).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "list"];
+      appendOptionalArg(argv, "--category", args.category);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_templates_show",
+    title: "FOH Templates Show",
+    description: "Show a setup template before applying it.",
+    commandKey: "templates show",
+    risk: "read",
+    inputSchema: {
+      template: string2().min(1).max(128),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "show", "--template", String(args.template)];
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_templates_select",
+    title: "FOH Templates Select",
+    description: "Select candidate templates from a business requirement brief JSON string.",
+    commandKey: "templates select",
+    risk: "read",
+    inputSchema: {
+      brief_json: string2().min(2).max(5e4),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "select", "--brief", String(args.brief_json)];
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_setup_objective",
+    title: "FOH Setup Objective",
+    description: "Plan objective-first setup from explicit business inputs without applying changes.",
+    commandKey: "setup",
+    risk: "read",
+    inputSchema: {
+      objective: string2().min(1).max(1e3),
+      business_name: string2().min(1).max(256),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES),
+      source_url: string2().url(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = [
+        "setup",
+        "--objective",
+        String(args.objective),
+        "--business-name",
+        String(args.business_name),
+        "--industry",
+        String(args.industry),
+        "--source-url",
+        String(args.source_url)
+      ];
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_objective_status",
+    title: "FOH Objective Status",
+    description: "Compose setup and launch evidence into one objective status envelope.",
+    commandKey: "objective status",
+    risk: "read",
+    inputSchema: {
+      business_name: string2().min(1).max(256),
+      source_url: string2().url(),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES).optional(),
+      business_objective: string2().min(1).max(1e3).optional(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      environment: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      out: string2().min(1).max(1024).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["objective", "status", "--business-name", String(args.business_name), "--source-url", String(args.source_url)];
+      appendOptionalArg(argv, "--industry", args.industry);
+      appendOptionalArg(argv, "--business-objective", args.business_objective);
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--environment", args.environment);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--out", args.out);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_objective_prove",
+    title: "FOH Objective Prove",
+    description: "Run objective proof status against the customer-live gate.",
+    commandKey: "objective prove",
+    risk: "read",
+    inputSchema: {
+      business_name: string2().min(1).max(256),
+      source_url: string2().url(),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES).optional(),
+      business_objective: string2().min(1).max(1e3).optional(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      environment: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      out: string2().min(1).max(1024).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["objective", "prove", "--business-name", String(args.business_name), "--source-url", String(args.source_url)];
+      appendOptionalArg(argv, "--industry", args.industry);
+      appendOptionalArg(argv, "--business-objective", args.business_objective);
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--environment", args.environment);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--out", args.out);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_prove_agent",
+    title: "FOH Prove Agent",
+    description: "Produce a setup/runtime proof bundle for an agent.",
+    commandKey: "prove",
+    risk: "read",
+    inputSchema: {
+      agent: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      mission: _enum(MCP_PROOF_MISSIONS).optional(),
+      contact_path: _enum(MCP_CONTACT_PATHS).optional(),
+      mutation_mode: _enum(MCP_MUTATION_MODES).optional(),
+      require_phone: boolean2().optional(),
+      skip_smoke: boolean2().optional(),
+      skip_voice_health: boolean2().optional(),
+      out: string2().min(1).max(1024).optional(),
+      strict: boolean2().optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["prove"];
+      appendOptionalArg(argv, "--agent", args.agent);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--mission", args.mission);
+      appendOptionalArg(argv, "--contact-path", args.contact_path);
+      appendOptionalArg(argv, "--mutation-mode", args.mutation_mode);
+      if (asOptionalBoolean(args.require_phone) === true) argv.push("--require-phone");
+      if (asOptionalBoolean(args.skip_smoke) === true) argv.push("--skip-smoke");
+      if (asOptionalBoolean(args.skip_voice_health) === true) argv.push("--skip-voice-health");
+      appendOptionalArg(argv, "--out", args.out);
+      if (asOptionalBoolean(args.strict) === true) argv.push("--strict");
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
   {
     name: "foh_agent_list",
     title: "FOH Agent List",
@@ -33951,9 +34933,9 @@ function parsePositiveInt(value, fallback, min, max) {
   if (!Number.isFinite(parsed)) return fallback;
   return Math.max(min, Math.min(max, Math.trunc(parsed)));
 }
-function withQuery(path2, params) {
+function withQuery(path5, params) {
   const query = params.toString();
-  return query ? `${path2}?${query}` : path2;
+  return query ? `${path5}?${query}` : path5;
 }
 
 // src/commands/knowledge.ts
@@ -34745,8 +35727,8 @@ function signReport(reportPayload) {
     }
   };
 }
-function writeSignedJsonArtifact(path2, value) {
-  const absolutePath = (0, import_path3.resolve)(path2);
+function writeSignedJsonArtifact(path5, value) {
+  const absolutePath = (0, import_path3.resolve)(path5);
   (0, import_fs5.mkdirSync)((0, import_path3.dirname)(absolutePath), { recursive: true });
   (0, import_fs5.writeFileSync)(absolutePath, stableStringify(value), "utf-8");
   return absolutePath;
@@ -35780,7 +36762,7 @@ ${passIcon}  Certification loop summary
 }
 
 // src/commands/certify.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 function normalizeProfile(raw) {
   const value = String(raw || "release").trim().toLowerCase();
   if (value === "smoke" || value === "release" || value === "stress") return value;
@@ -35858,7 +36840,7 @@ function registerCertify(program3) {
         next_commands: passed ? [`foh agent publish --agent ${opts.agent} --json`] : [`foh certify run --agent ${opts.agent} --profile ${profile} --json`]
       };
       if (opts.out) {
-        (0, import_node_fs3.writeFileSync)(opts.out, JSON.stringify(result, null, 2) + "\n", "utf-8");
+        (0, import_node_fs5.writeFileSync)(opts.out, JSON.stringify(result, null, 2) + "\n", "utf-8");
       }
       if (opts.json ?? false) {
         format(result, { json: true });
@@ -35898,8 +36880,8 @@ function registerConversations(program3) {
     if (opts.provider) params.set("provider", String(opts.provider));
     params.set("page", String(parsePositiveInt(opts.page, 1, 1, 1e4)));
     params.set("limit", String(parsePositiveInt(opts.limit, 20, 1, 100)));
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("semantic-search").description("Run semantic ranking search against an agent conversation corpus").requiredOption("--agent <id>", "Agent ID").requiredOption("--q <query>", "Query text (min 3 chars)").option("--limit <n>", "Result limit (1-100)", "20").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -35916,13 +36898,13 @@ function registerConversations(program3) {
       q: query,
       limit: String(parsePositiveInt(opts.limit, 20, 1, 100))
     });
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations/semantic-search`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations/semantic-search`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("lead-data").description("Get extracted lead-data fields for a conversation").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/lead-data`;
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/lead-data`;
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("inject-variables").description("Inject or merge conversation vars into an active flow-state").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").requiredOption("--variables <json|@file>", "Variables object JSON or @path").option("--mode <value>", "Mode: merge or replace", "merge").option("--source <value>", "Audit source tag", "cli").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -35944,8 +36926,8 @@ function registerConversations(program3) {
         statusCode: 400
       });
     }
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-variables`;
-    const data = await apiFetch(path2, {
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-variables`;
+    const data = await apiFetch(path5, {
       method: "POST",
       body: JSON.stringify({
         variables: parsed,
@@ -35967,8 +36949,8 @@ function registerConversations(program3) {
         statusCode: 400
       });
     }
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-event`;
-    const data = await apiFetch(path2, {
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-event`;
+    const data = await apiFetch(path5, {
       method: "POST",
       body: JSON.stringify({
         event_type: String(opts.eventType),
@@ -36088,8 +37070,8 @@ function registerTranscripts(program3) {
   transcripts.command("get").description("Fetch one conversation transcript and optional trace events").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").option("--include-traces", "Include ordered trace events").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const params = new URLSearchParams();
     if (opts.includeTraces) params.set("include_traces", "true");
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations/${opts.conversation}`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations/${opts.conversation}`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   transcripts.command("export").description("Export recent transcripts as JSON or JSONL").requiredOption("--agent <id>", "Agent ID").option("--q <query>", "Full-text transcript query").option("--from <iso-date>", "Start datetime (ISO8601)").option("--to <iso-date>", "End datetime (ISO8601)").option("--limit <n>", "Rows to export (1-100)", "100").option("--format <value>", "Export format: jsonl or json", "jsonl").option("--hydrate", "Fetch full conversation detail for every exported row").option("--include-traces", "Hydrate each conversation with ordered trace events").option("--no-redact", "Disable default redaction of emails, phone numbers, and obvious secrets").option("--out <path>", "Output file path").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -36272,8 +37254,8 @@ function registerTests(program3) {
     if (opts.status) params.set("status", String(opts.status));
     if (opts.type) params.set("type", String(opts.type));
     params.set("limit", String(parsePositiveInt(opts.limit, 100, 1, 500)));
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/tests`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/tests`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   tests.command("create").description("Create a new test in an agent test catalog").requiredOption("--agent <id>", "Agent ID").requiredOption("--name <text>", "Test name").requiredOption("--config <json|@file>", "Test config JSON or @path").option("--description <text>", "Description").option("--status <value>", "Status override").option("--enabled <value>", "Enabled flag: true/false").option("--tags <csv>", "Comma-separated tags").option("--metadata <json|@file>", "Metadata JSON object").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -36399,8 +37381,8 @@ function registerTests(program3) {
     if (opts.test) params.set("testId", String(opts.test));
     if (opts.batch) params.set("batchId", String(opts.batch));
     if (opts.includeResults) params.set("includeResults", "true");
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/tests/runs`, params);
-    const data = await apiFetch(path2, {
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/tests/runs`, params);
+    const data = await apiFetch(path5, {
       orgId: opts.org,
       apiUrlOverride: opts.apiUrl
     });
@@ -36460,9 +37442,9 @@ function asStringList(value) {
   if (Array.isArray(value)) return value.map((entry) => String(entry || "").trim()).filter(Boolean);
   return [];
 }
-function getPath(source, path2) {
+function getPath(source, path5) {
   if (!source || typeof source !== "object") return void 0;
-  return path2.split(".").reduce((current, part) => {
+  return path5.split(".").reduce((current, part) => {
     if (!current || typeof current !== "object") return void 0;
     return current[part];
   }, source);
@@ -36476,12 +37458,12 @@ function valuesEqual(actual, expected) {
   }
   return String(actual ?? "") === String(expected ?? "");
 }
-function parseStructuredFile(path2) {
-  const raw = (0, import_fs7.readFileSync)(path2, "utf-8");
-  return path2.toLowerCase().endsWith(".json") ? JSON.parse(raw) : load(raw);
+function parseStructuredFile(path5) {
+  const raw = (0, import_fs7.readFileSync)(path5, "utf-8");
+  return path5.toLowerCase().endsWith(".json") ? JSON.parse(raw) : load(raw);
 }
-function parseSuiteFile(path2) {
-  const parsed = parseStructuredFile(path2);
+function parseSuiteFile(path5) {
+  const parsed = parseStructuredFile(path5);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new FohError({
       step: "test.run",
@@ -36505,8 +37487,8 @@ function turnFromFixtureEntry(entry) {
     expect: row.expect && typeof row.expect === "object" && !Array.isArray(row.expect) ? row.expect : void 0
   };
 }
-function loadFixtureTurns(path2) {
-  const parsed = parseStructuredFile(path2);
+function loadFixtureTurns(path5) {
+  const parsed = parseStructuredFile(path5);
   const entries = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.turns) ? parsed.turns : parsed && typeof parsed === "object" && Array.isArray(parsed.messages) ? parsed.messages : [];
   return entries.map(turnFromFixtureEntry).filter((entry) => !!entry);
 }
@@ -36566,8 +37548,8 @@ function pickVariables(response) {
   return null;
 }
 function pickToolCalls(response) {
-  for (const path2 of ["tool_calls", "toolCalls", "telemetry.tool_calls", "trace.tool_calls"]) {
-    const value = getPath(response, path2);
+  for (const path5 of ["tool_calls", "toolCalls", "telemetry.tool_calls", "trace.tool_calls"]) {
+    const value = getPath(response, path5);
     if (Array.isArray(value)) return value;
   }
   return [];
@@ -36623,9 +37605,9 @@ function evaluateStructuredExpectations(response, expect, latencyMs) {
     const variables = pickVariables(response);
     if (!variables) failures.push("variables expected but response had none");
     else {
-      for (const [path2, expected] of Object.entries(expect.variables)) {
-        const actual = getPath(variables, path2);
-        if (!valuesEqual(actual, expected)) failures.push(`variables.${path2} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+      for (const [path5, expected] of Object.entries(expect.variables)) {
+        const actual = getPath(variables, path5);
+        if (!valuesEqual(actual, expected)) failures.push(`variables.${path5} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
       }
     }
   }
@@ -36667,9 +37649,9 @@ function evaluateStructuredExpectations(response, expect, latencyMs) {
     }
   }
   if (expect.fields && typeof expect.fields === "object") {
-    for (const [path2, expected] of Object.entries(expect.fields)) {
-      const actual = getPath(response, path2);
-      if (!valuesEqual(actual, expected)) failures.push(`fields.${path2} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+    for (const [path5, expected] of Object.entries(expect.fields)) {
+      const actual = getPath(response, path5);
+      if (!valuesEqual(actual, expected)) failures.push(`fields.${path5} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
     }
   }
   return failures;
@@ -37364,9 +38346,9 @@ function nonEmpty2(value) {
   const text = String(value ?? "").trim();
   return text.length > 0 ? text : void 0;
 }
-function getPath2(value, path2) {
+function getPath2(value, path5) {
   let current = value;
-  for (const segment of path2.split(".")) {
+  for (const segment of path5.split(".")) {
     const record2 = asRecord2(current);
     if (!record2) return void 0;
     current = record2[segment];
@@ -37523,10 +38505,10 @@ function assertRedacted(value) {
     });
   }
 }
-function readSourceArtifact(path2) {
-  if (!path2) return null;
+function readSourceArtifact(path5) {
+  if (!path5) return null;
   try {
-    return JSON.parse((0, import_fs9.readFileSync)(path2, "utf-8"));
+    return JSON.parse((0, import_fs9.readFileSync)(path5, "utf-8"));
   } catch (error2) {
     throw new FohError({
       step: "bug.improve",
@@ -37703,8 +38685,8 @@ function parseRequestBody(raw) {
     return text;
   }
 }
-function writeJsonArtifact(path2, value) {
-  const absolutePath = (0, import_path8.resolve)(path2);
+function writeJsonArtifact(path5, value) {
+  const absolutePath = (0, import_path8.resolve)(path5);
   (0, import_fs10.mkdirSync)((0, import_path8.dirname)(absolutePath), { recursive: true });
   (0, import_fs10.writeFileSync)(absolutePath, stableStringify(value), "utf-8");
   return absolutePath;
@@ -37988,8 +38970,8 @@ function registerBug(program3) {
 
 // src/lib/proof-cache.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs4 = require("node:fs");
-var import_node_path = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path3 = require("node:path");
 var DEFAULT_MAX_AGE_MS = 15 * 60 * 1e3;
 var DEFAULT_WAIT_MS = 180 * 1e3;
 var DEFAULT_POLL_MS = 500;
@@ -38007,12 +38989,12 @@ function cacheKey2(kind, keyParts) {
   return (0, import_node_crypto2.createHash)("sha256").update(stableJson({ kind, keyParts, schema_version: "foh_proof_cache_key.v1" })).digest("hex").slice(0, 32);
 }
 function publicPath(filePath) {
-  const rel = (0, import_node_path.relative)(process.cwd(), filePath).replaceAll("\\", "/");
+  const rel = (0, import_node_path3.relative)(process.cwd(), filePath).replaceAll("\\", "/");
   return rel.startsWith("..") ? filePath.replaceAll("\\", "/") : rel;
 }
 function readFreshCache(filePath, maxAgeMs) {
   try {
-    const payload = JSON.parse((0, import_node_fs4.readFileSync)(filePath, "utf8"));
+    const payload = JSON.parse((0, import_node_fs6.readFileSync)(filePath, "utf8"));
     const createdAt = Date.parse(String(payload.created_at || ""));
     if (!Number.isFinite(createdAt)) return null;
     const ageMs = Date.now() - createdAt;
@@ -38024,8 +39006,8 @@ function readFreshCache(filePath, maxAgeMs) {
   }
 }
 function writeCache(filePath, value) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path.dirname)(filePath), { recursive: true });
-  (0, import_node_fs4.writeFileSync)(filePath, `${JSON.stringify({
+  (0, import_node_fs6.mkdirSync)((0, import_node_path3.dirname)(filePath), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(filePath, `${JSON.stringify({
     schema_version: "foh_proof_cache_entry.v1",
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     value
@@ -38035,7 +39017,7 @@ function writeCache(filePath, value) {
 function resolveProofCacheDir(input) {
   const value = String(input || process.env.FOH_PROOF_CACHE_DIR || "").trim();
   if (!value) return null;
-  return (0, import_node_path.isAbsolute)(value) ? value : (0, import_node_path.resolve)(process.cwd(), value);
+  return (0, import_node_path3.isAbsolute)(value) ? value : (0, import_node_path3.resolve)(process.cwd(), value);
 }
 async function withProofCache(options, run) {
   const resolvedDir = resolveProofCacheDir(options.cacheDir);
@@ -38055,12 +39037,12 @@ async function withProofCache(options, run) {
     };
   }
   const key = cacheKey2(options.kind, options.keyParts);
-  const cachePath = (0, import_node_path.join)(resolvedDir, `${key}.json`);
-  const lockPath = (0, import_node_path.join)(resolvedDir, `${key}.lock`);
+  const cachePath = (0, import_node_path3.join)(resolvedDir, `${key}.json`);
+  const lockPath = (0, import_node_path3.join)(resolvedDir, `${key}.lock`);
   const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const waitMs = options.waitMs ?? Number(process.env.FOH_PROOF_CACHE_WAIT_MS || DEFAULT_WAIT_MS);
   const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
-  (0, import_node_fs4.mkdirSync)(resolvedDir, { recursive: true });
+  (0, import_node_fs6.mkdirSync)(resolvedDir, { recursive: true });
   const existing = readFreshCache(cachePath, maxAgeMs);
   if (existing) {
     return {
@@ -38079,7 +39061,7 @@ async function withProofCache(options, run) {
   }
   let lockOwner = false;
   try {
-    (0, import_node_fs4.mkdirSync)(lockPath);
+    (0, import_node_fs6.mkdirSync)(lockPath);
     lockOwner = true;
   } catch {
     const started = Date.now();
@@ -38120,7 +39102,7 @@ async function withProofCache(options, run) {
       }
     };
   } finally {
-    if (lockOwner) (0, import_node_fs4.rmSync)(lockPath, { recursive: true, force: true });
+    if (lockOwner) (0, import_node_fs6.rmSync)(lockPath, { recursive: true, force: true });
   }
 }
 
@@ -38253,7 +39235,7 @@ function isProviderCapacityBlocked(onboarding) {
   return /maximum number of subaccounts|subaccount limit|reserve[- ]number pool|reserve pool exhausted|global safety limit/.test(message);
 }
 function registerProve(program3) {
-  program3.command("prove").description("Produce one setup/runtime proof bundle for an agent").option("--agent <id>", "Agent ID to prove").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--include-certification", "Run explicit simulation certification check (slow)").option("--cert-mode <m>", "Simulation cert mode when --include-certification is set: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive runs for full/stress certification when included", "30").option("--cert-max-improvement-rounds <n>", "Max prompt improvement rounds in included cert loop (0-5)", "1").option("--mission <mission>", "Proof mission: setup, widget, voice, publish", "setup").option("--contact-path <mode>", "Voice contact path: auto, managed, or byon", "auto").option("--mutation-mode <mode>", "Proof mutation mode: read-only or ensure", "read-only").option("--repair", "Alias for --mutation-mode ensure").option("--require-phone", "Hold proof if no phone/contact number is provisioned").option("--skip-cert", "Deprecated compatibility flag; certification is skipped unless --include-certification is set").option("--skip-smoke", "Skip widget runtime smoke check").option("--skip-voice-health", "Skip realtime voice provider health check").option("--proof-cache-dir <path>", "Optional local proof cache directory for shared certification results").option("--out <path>", "Write signed proof report JSON to this path").option("--strict", "Exit non-zero unless all non-skipped checks pass").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+  program3.command("prove").description("Produce one setup/runtime proof bundle for an agent").option("--agent <id>", "Agent ID to prove").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--include-certification", "Run explicit simulation certification check (slow)").option("--cert-mode <m>", "Simulation cert mode when --include-certification is set: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive runs for full/stress certification when included", "30").option("--cert-max-improvement-rounds <n>", "Max prompt improvement rounds in included cert loop (0-5)", "1").option("--mission <mission>", "Proof mission: setup, widget, voice, publish", "setup").option("--contact-path <mode>", "Voice contact path: auto, managed, or byon", "auto").option("--mutation-mode <mode>", "Proof mutation mode: read-only or ensure", "read-only").option("--repair", "Alias for --mutation-mode ensure").option("--require-phone", "Hold proof if no phone/contact number is provisioned").option("--skip-cert", "Deprecated compatibility flag; certification is skipped unless --include-certification is set").option("--skip-smoke", "Skip widget runtime smoke check").option("--skip-voice-health", "Skip realtime voice provider health check").option("--proof-cache-dir <path>", "Optional local proof cache directory for shared certification results").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--out <path>", "Write signed proof report JSON to this path").option("--strict", "Exit non-zero unless all non-skipped checks pass").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const commandStartedMs = Date.now();
     const checks = [];
     const checkTimings = /* @__PURE__ */ new Map();
@@ -38450,16 +39432,25 @@ function registerProve(program3) {
           headers: { "x-agent-id": String(ctx.agentId) }
         }));
         const publicKey = publicKeyFromEmbedResponse(embed);
+        const allowedDomains = Array.isArray(embed.allowed_domains) ? embed.allowed_domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : [];
+        const origin = normalizeOrigin(typeof opts.origin === "string" && opts.origin.trim() ? opts.origin : allowedDomains[0]);
         if (publicKey) {
           checkTimings.set("widget_channel", Math.max(checkTimings.get("widget_channel") ?? 0, checkTimings.get("widget_embed") ?? 0));
           ctx.widgetPublicKey = publicKey;
+          ctx.widgetOrigin = origin;
           checks.push(pass("widget_channel", "Widget channel is available in read-only proof mode.", {
             public_key_present: true,
-            mutation_mode: mutationMode
+            mutation_mode: mutationMode,
+            origin,
+            allowed_domains: allowedDomains
           }));
         }
         if (typeof embed.snippet === "string" && embed.snippet.trim()) {
-          checks.push(pass("widget_embed", "Widget embed snippet is available.", { snippet_present: true }));
+          checks.push(pass("widget_embed", "Widget embed snippet is available.", {
+            snippet_present: true,
+            allowed_domains: allowedDomains,
+            customer_runtime_profile_present: Boolean(embed.customer_runtime_profile)
+          }));
         } else {
           checks.push(hold("widget_embed", "widget_embed_missing", "Widget embed snippet is missing.", `foh widget embed-snippet --agent ${ctx.agentId}`));
         }
@@ -38499,19 +39490,46 @@ function registerProve(program3) {
         checks.push(skipped("widget_smoke", "operator_skipped", "Skipped by --skip-smoke.", `foh widget smoke --agent ${ctx.agentId} --json`));
       } else if (!ctx.widgetPublicKey) {
         checks.push(skipped("widget_smoke", "widget_public_key_required", "Skipped because widget public key is unavailable.", `foh widget ensure --agent ${ctx.agentId} --json`));
+        checks.push(skipped("widget_semantic", "widget_public_key_required", "Skipped because widget public key is unavailable.", `foh widget ensure --agent ${ctx.agentId} --json`));
       } else {
         try {
-          const smoke = await timedCheck(checkTimings, "widget_smoke", () => runWidgetSmoke(ctx.widgetPublicKey, opts.apiUrl));
+          const embed = await apiFetch("/v1/console/channels/widget/embed-snippet", {
+            orgId: ctx.orgId,
+            apiUrlOverride: opts.apiUrl,
+            headers: { "x-agent-id": String(ctx.agentId) }
+          });
+          const smoke = await timedCheck(checkTimings, "widget_smoke", () => runWidgetSmoke(ctx.widgetPublicKey, opts.apiUrl, ctx.widgetOrigin));
           ctx.conversationId = smoke.conversation_id;
           ctx.traceIds = smoke.trace_ids;
           ctx.correlationIds = smoke.correlation_ids;
           if (smoke.failed > 0) {
-            checks.push(hold("widget_smoke", "widget_smoke_failed", `${smoke.failed} widget smoke turn(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, smoke));
+            checks.push(hold("widget_smoke", "widget_smoke_failed", `${smoke.failed} widget smoke transport turn(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, {
+              ...smoke,
+              origin: ctx.widgetOrigin ?? null
+            }));
+            checks.push(skipped("widget_semantic", "widget_smoke_required", "Skipped because transport smoke failed.", `foh widget smoke --agent ${ctx.agentId} --json`));
           } else {
-            checks.push(pass("widget_smoke", "Widget runtime smoke passed.", smoke));
+            checks.push(pass("widget_smoke", "Widget transport smoke passed.", {
+              ...smoke,
+              origin: ctx.widgetOrigin ?? null
+            }));
+            const semantic = await timedCheck(checkTimings, "widget_semantic", () => runWidgetSemanticEval(
+              ctx.widgetPublicKey,
+              opts.apiUrl,
+              ctx.widgetOrigin,
+              embed.customer_runtime_profile ?? null
+            ));
+            if (!semantic.pack_id) {
+              checks.push(skipped("widget_semantic", "widget_semantic_pack_not_configured", "No widget semantic eval pack is configured for this business.", void 0));
+            } else if (semantic.failed > 0) {
+              checks.push(hold("widget_semantic", "widget_semantic_failed", `${semantic.failed} widget semantic scenario(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, semantic));
+            } else {
+              checks.push(pass("widget_semantic", "Widget semantic eval passed.", semantic));
+            }
           }
         } catch (error2) {
           checks.push(fail("widget_smoke", "widget_smoke_failed", error2, `foh widget smoke --agent ${ctx.agentId} --json`));
+          checks.push(skipped("widget_semantic", "widget_smoke_required", "Skipped because widget smoke threw before semantic evaluation.", `foh widget smoke --agent ${ctx.agentId} --json`));
         }
       }
       if (opts.skipCert) {
@@ -38597,6 +39615,7 @@ function registerProve(program3) {
         contact_path: contactPath,
         mutation_mode: mutationMode,
         widget_public_key_present: Boolean(ctx.widgetPublicKey),
+        widget_origin: ctx.widgetOrigin ?? null,
         conversation_id: ctx.conversationId ?? null,
         trace_ids: ctx.traceIds,
         correlation_ids: ctx.correlationIds
@@ -38615,8 +39634,8 @@ function registerProve(program3) {
 }
 
 // src/commands/objective.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path2 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path4 = require("node:path");
 var DEFAULT_OBJECTIVE_REPORT_PATH = "test-results/objective-status.latest.json";
 var VALID_OBJECTIVE_INDUSTRIES = ["real_estate", "restaurant", "general"];
 var BUSINESS_REQUIREMENT_BRIEF_SCHEMA_VERSION = "business_requirement_brief.v1";
@@ -38626,6 +39645,12 @@ function asRecord3(value) {
 function normalizeString2(value) {
   return typeof value === "string" ? value.trim() : "";
 }
+function quoteCliArg(value) {
+  const normalized = value.trim();
+  if (!normalized) return '""';
+  if (!/[\s"]/.test(normalized)) return normalized;
+  return `"${normalized.replace(/"/g, '\\"')}"`;
+}
 function uniqueStrings(values) {
   return Array.from(new Set(values.map(normalizeString2).filter(Boolean)));
 }
@@ -38684,22 +39709,26 @@ function finiteNumber(value) {
   return Number.isFinite(number3) ? number3 : null;
 }
 function normalizeCustomerEvidenceActions(value) {
-  return asArray(value).map(asRecord3).map((action) => ({
-    id: firstString(action, ["id", "action_id"]),
-    title: firstString(action, ["title"]) || null,
-    owner: firstString(action, ["owner"]) || null,
-    blocker_count: finiteNumber(action.blocker_count) ?? (uniqueStrings(asArray(action.reason_codes)).length || null),
-    target_evidence_paths: uniqueStrings([
-      ...asArray(action.target_evidence_paths),
-      firstString(action, ["target_evidence_path"])
-    ]),
-    validator_commands: uniqueStrings([
-      ...asArray(action.validator_commands),
-      ...asArray(action.next_commands)
-    ]),
-    required_evidence: firstString(action, ["required_evidence"]) || null,
-    unlocks: firstString(action, ["unlocks"]) || null
-  })).filter((action) => normalizeString2(action.id));
+  return asArray(value).map(asRecord3).map((action) => {
+    const id = firstString(action, ["id", "action_id"]);
+    return {
+      id,
+      title: firstString(action, ["title"]) || null,
+      owner: firstString(action, ["owner"]) || null,
+      blocker_count: finiteNumber(action.blocker_count) ?? (uniqueStrings(asArray(action.reason_codes)).length || null),
+      target_evidence_paths: uniqueStrings([
+        ...asArray(action.target_evidence_paths),
+        firstString(action, ["target_evidence_path"]),
+        id ? `customer-evidence/${id}.json` : ""
+      ]),
+      validator_commands: uniqueStrings([
+        ...asArray(action.validator_commands),
+        ...asArray(action.next_commands)
+      ]),
+      required_evidence: firstString(action, ["required_evidence"]) || null,
+      unlocks: firstString(action, ["unlocks"]) || null
+    };
+  }).filter((action) => normalizeString2(action.id));
 }
 function normalizeCustomerEvidenceActionPacket(value) {
   const packet = asRecord3(value);
@@ -38716,7 +39745,63 @@ function normalizeCustomerEvidenceActionPacket(value) {
     instructions: uniqueStrings(asArray(packet.instructions))
   };
 }
+function skeletonHintsById(...sources) {
+  const hints = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    const record2 = asRecord3(source);
+    const evidencePacket = asRecord3(record2.evidence_packet);
+    const skeletons = asArray(evidencePacket.skeletons).map(asRecord3);
+    for (const skeleton of skeletons) {
+      const id = normalizeString2(skeleton.id);
+      if (!id || hints.has(id)) continue;
+      hints.set(id, skeleton);
+    }
+  }
+  return hints;
+}
+function mergeActionPacketWithSkeletonHints(packet, skeletonHints) {
+  if (!packet) return void 0;
+  const actions = asArray(packet.actions).map(asRecord3).filter((action) => normalizeString2(action.id));
+  if (actions.length === 0) return packet;
+  return {
+    ...packet,
+    actions: actions.map((action) => {
+      const hint = skeletonHints.get(normalizeString2(action.id));
+      const hintedTarget = normalizeString2(hint?.target_evidence_path);
+      return {
+        ...action,
+        target_evidence_paths: uniqueStrings([
+          ...asArray(action.target_evidence_paths),
+          hintedTarget
+        ]),
+        required_evidence: action.required_evidence ?? (firstString(asRecord3(hint), ["instructions"]) || null)
+      };
+    })
+  };
+}
+function buildObjectiveApplyPlanCommand(reportPath) {
+  return `foh objective apply --plan ${quoteCliArg(reportPath)} --dry-run --json`;
+}
+function injectObjectiveApplyGuidance(packet, reportPath) {
+  if (!packet) return void 0;
+  const planCommand = buildObjectiveApplyPlanCommand(reportPath);
+  return {
+    ...packet,
+    validation_commands: dedupeCommands([
+      planCommand,
+      ...uniqueStrings(asArray(packet.validation_commands))
+    ]),
+    actions: asArray(packet.actions).map(asRecord3).filter((action) => normalizeString2(action.id)).map((action) => ({
+      ...action,
+      validator_commands: dedupeCommands([
+        planCommand,
+        ...uniqueStrings(asArray(action.validator_commands))
+      ])
+    }))
+  };
+}
 function customerEvidenceActionPacketFromSources(...sources) {
+  const skeletonHints = skeletonHintsById(...sources);
   for (const source of sources) {
     const report = asRecord3(source);
     const requestPackets = asRecord3(report.request_packets);
@@ -38736,14 +39821,14 @@ function customerEvidenceActionPacketFromSources(...sources) {
       report.customer_actions ? { actions: report.customer_actions } : null
     ];
     for (const candidate of candidates) {
-      const normalized = normalizeCustomerEvidenceActionPacket(candidate);
+      const normalized = mergeActionPacketWithSkeletonHints(normalizeCustomerEvidenceActionPacket(candidate), skeletonHints);
       if (normalized) return normalized;
     }
   }
   return void 0;
 }
 function normalizeObjectiveArtifactPath(value) {
-  return value.trim() ? (0, import_node_path2.resolve)(value.trim()) : "";
+  return value.trim() ? (0, import_node_path4.resolve)(value.trim()) : "";
 }
 function resolveObjectiveArtifactPath(value) {
   return normalizeObjectiveArtifactPath(value);
@@ -38758,10 +39843,26 @@ function pickEvidencePacket(value) {
   const payload = firstNonEmptyObject(record2.payload);
   return payload ?? record2;
 }
-function readEvidencePacketFromPlan(path2) {
-  const plan = asRecord3(readJsonArtifact(path2));
+function evidenceRequestFromSkeletonPacket(value) {
+  const packet = asRecord3(value);
+  const skeletons = asArray(packet.skeletons).map(asRecord3).filter((item) => normalizeString2(item.id));
+  if (skeletons.length === 0) return void 0;
+  const launchScopeId = normalizeString2(packet.launch_scope_id) || normalizeString2(skeletons[0]?.launch_scope_id);
+  return {
+    ...launchScopeId ? { launch_scope_id: launchScopeId } : {},
+    evidence: skeletons.map((skeleton) => ({
+      id: normalizeString2(skeleton.id),
+      launch_scope_id: normalizeString2(skeleton.launch_scope_id) || launchScopeId || void 0,
+      target_evidence_path: normalizeString2(skeleton.target_evidence_path) || `customer-evidence/${normalizeString2(skeleton.id)}.json`,
+      payload: asRecord3(skeleton.payload_template)
+    }))
+  };
+}
+function readEvidencePacketFromPlan(path5) {
+  const plan = asRecord3(readJsonArtifact(path5));
   const sourceReports = asRecord3(plan.source_reports);
-  return pickEvidencePacket(plan.evidence) ?? pickEvidencePacket(plan.evidence_packet) ?? pickEvidencePacket(sourceReports.customer_live_status && asRecord3(sourceReports.customer_live_status).evidence) ?? pickEvidencePacket(asRecord3(sourceReports.setup_workflow).evidence_packet) ?? {};
+  const packet = pickEvidencePacket(plan.evidence) ?? pickEvidencePacket(plan.evidence_packet) ?? pickEvidencePacket(sourceReports.customer_live_status && asRecord3(sourceReports.customer_live_status).evidence) ?? pickEvidencePacket(asRecord3(sourceReports.setup_workflow).evidence_packet) ?? {};
+  return evidenceRequestFromSkeletonPacket(packet) ?? packet;
 }
 function inferEvidenceFromProofPaths(evidence) {
   const record2 = asRecord3(evidence);
@@ -38876,16 +39977,16 @@ function buildDeveloperReadinessPacket(input) {
 }
 function resolveObjectiveReportPath(value) {
   const raw = normalizeString2(value);
-  if (!raw || raw === "latest") return (0, import_node_path2.resolve)(DEFAULT_OBJECTIVE_REPORT_PATH);
-  return (0, import_node_path2.resolve)(raw);
+  if (!raw || raw === "latest") return (0, import_node_path4.resolve)(DEFAULT_OBJECTIVE_REPORT_PATH);
+  return (0, import_node_path4.resolve)(raw);
 }
-function writeJsonArtifact2(path2, value) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path2.dirname)(path2), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(path2, `${JSON.stringify(value, null, 2)}
+function writeJsonArtifact2(path5, value) {
+  (0, import_node_fs7.mkdirSync)((0, import_node_path4.dirname)(path5), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(path5, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
-function readJsonArtifact(path2) {
-  return JSON.parse((0, import_node_fs5.readFileSync)(path2, "utf8"));
+function readJsonArtifact(path5) {
+  return JSON.parse((0, import_node_fs7.readFileSync)(path5, "utf8"));
 }
 function buildSetupBody(opts) {
   const tools = parseCsvOption(opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
@@ -39121,8 +40222,14 @@ function buildObjectiveReport(input) {
     ...collectStringArrays(setup, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"])),
     ...collectStringArrays(live, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))
   ]);
+  const objectiveArtifactPath = normalizeString2(input.opts.out) || DEFAULT_OBJECTIVE_REPORT_PATH;
   const debugSource = normalizeString2(input.opts.out) || "latest";
+  let customerEvidenceActionPacket = customerEvidenceActionPacketFromSources(live, setup);
+  if (customerEvidenceActionPacket) {
+    customerEvidenceActionPacket = injectObjectiveApplyGuidance(customerEvidenceActionPacket, objectiveArtifactPath);
+  }
   const nextCommands = dedupeCommands([
+    ...customerEvidenceActionPacket ? [buildObjectiveApplyPlanCommand(objectiveArtifactPath)] : [],
     ...collectStringArrays(setup, /* @__PURE__ */ new Set(["next_commands"])),
     ...collectStringArrays(live, /* @__PURE__ */ new Set(["next_commands"])),
     `foh objective debug --from ${debugSource} --json`
@@ -39136,7 +40243,6 @@ function buildObjectiveReport(input) {
     ...collectArtifactRefs(setup),
     ...collectArtifactRefs(live)
   ]);
-  const customerEvidenceActionPacket = customerEvidenceActionPacketFromSources(live, setup);
   const developerReadinessPacket = buildDeveloperReadinessPacket({
     opts: input.opts,
     setupWorkflow: setup,
@@ -39379,7 +40485,7 @@ function registerObjective(program3) {
   }));
   objective.command("debug").description("Explain the next debugging action for an objective report").option("--from <source>", "Report source alias or path", "latest").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const sourcePath = resolveObjectiveReportPath(opts.from);
-    if (!(0, import_node_fs5.existsSync)(sourcePath)) {
+    if (!(0, import_node_fs7.existsSync)(sourcePath)) {
       format(cliEnvelope({
         schemaVersion: "agent_workbench_debug.v1",
         status: "fail",
@@ -40450,6 +41556,277 @@ function registerInteractive(program3) {
   });
 }
 
+// src/commands/install.ts
+var import_node_fs8 = __toESM(require("node:fs"));
+var import_node_path5 = __toESM(require("node:path"));
+var import_node_child_process3 = require("node:child_process");
+function splitCsv(value) {
+  if (typeof value !== "string") return [];
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function pickFirstParam(url2, names) {
+  for (const name of names) {
+    const value = url2.searchParams.get(name);
+    if (value && value.trim()) return value.trim();
+  }
+  return void 0;
+}
+function parseInstallLink(raw) {
+  if (!raw) return {};
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new FohError({
+      step: "install.link",
+      error: "Install link is not a valid URL.",
+      remediation: "Use the one-time Front Of House install link, or run: foh install --agent <agent-id>"
+    });
+  }
+  const domainsFromRepeatedParams = [
+    ...url2.searchParams.getAll("domain"),
+    ...url2.searchParams.getAll("domains")
+  ].flatMap((value) => splitCsv(value));
+  return {
+    agent: pickFirstParam(url2, ["agent", "agent_id"]),
+    org: pickFirstParam(url2, ["org", "org_id"]),
+    domains: Array.from(new Set(domainsFromRepeatedParams)),
+    apiUrl: pickFirstParam(url2, ["api_url", "apiUrl"]),
+    publicKey: pickFirstParam(url2, ["channel", "channel_public_key", "public_key"]),
+    installToken: pickFirstParam(url2, ["token", "install_token"])
+  };
+}
+async function resolveInstallLinkToken(token, apiUrl) {
+  const baseUrl = (apiUrl || DEFAULT_WIDGET_API_URL).replace(/\/$/, "");
+  const res = await fetch(`${baseUrl}/v1/widget/install-link/resolve`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token })
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "install.link.resolve",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.code === "install_link_token_expired" ? "Ask the operator for a fresh install link." : "Check the install link and retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return {
+    agent: typeof body?.agent_id === "string" ? body.agent_id.trim() : void 0,
+    org: typeof body?.org_id === "string" ? body.org_id.trim() : void 0,
+    publicKey: typeof body?.widget_public_key === "string" ? body.widget_public_key.trim() : void 0,
+    apiUrl: typeof body?.api_url === "string" ? body.api_url.trim() : void 0,
+    domains: Array.isArray(body?.allowed_domains) ? body.allowed_domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : void 0
+  };
+}
+function findPackageJsonForTarget(siteRoot, targetPath) {
+  const root = import_node_path5.default.resolve(siteRoot || ".");
+  let current = import_node_path5.default.dirname(targetPath);
+  while (current.startsWith(root)) {
+    const candidate = import_node_path5.default.join(current, "package.json");
+    if (import_node_fs8.default.existsSync(candidate) && import_node_fs8.default.statSync(candidate).isFile()) return candidate;
+    const next = import_node_path5.default.dirname(current);
+    if (next === current) break;
+    current = next;
+  }
+  return null;
+}
+function packageManagerFor(cwd, siteRoot) {
+  const root = import_node_path5.default.resolve(siteRoot || ".");
+  let current = cwd;
+  while (current.startsWith(root)) {
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "pnpm-lock.yaml"))) return "pnpm";
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "yarn.lock"))) return "yarn";
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "bun.lockb")) || import_node_fs8.default.existsSync(import_node_path5.default.join(current, "bun.lock"))) return "bun";
+    const next = import_node_path5.default.dirname(current);
+    if (next === current) break;
+    current = next;
+  }
+  return "npm";
+}
+function detectBuildCommand(siteRoot, targetPath) {
+  const packageJsonPath = findPackageJsonForTarget(siteRoot, targetPath);
+  if (!packageJsonPath) return null;
+  const packageJson = JSON.parse(import_node_fs8.default.readFileSync(packageJsonPath, "utf8"));
+  if (!packageJson.scripts?.build) return null;
+  const cwd = import_node_path5.default.dirname(packageJsonPath);
+  const packageManager = packageManagerFor(cwd, siteRoot);
+  if (packageManager === "npm") {
+    return {
+      cwd,
+      command: "npm",
+      args: ["run", "build"],
+      display: "npm run build",
+      package_manager: packageManager
+    };
+  }
+  return {
+    cwd,
+    command: packageManager,
+    args: ["build"],
+    display: `${packageManager} build`,
+    package_manager: packageManager
+  };
+}
+function runBuildCommand(build) {
+  const command = process.platform === "win32" ? "cmd.exe" : build.command;
+  const args = process.platform === "win32" ? ["/d", "/s", "/c", build.command, ...build.args] : build.args;
+  const result = (0, import_node_child_process3.spawnSync)(command, args, {
+    cwd: build.cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const stdout = String(result.stdout || "").split(/\r?\n/).filter(Boolean).slice(-20);
+  const stderr = String(result.stderr || "").split(/\r?\n/).filter(Boolean).slice(-20);
+  return {
+    ok: result.status === 0,
+    exit_code: result.status,
+    command: build.display,
+    cwd: import_node_path5.default.relative(process.cwd(), build.cwd).replaceAll("\\", "/") || ".",
+    stdout_tail: stdout,
+    stderr_tail: stderr,
+    ...result.error ? { error: result.error.message } : {}
+  };
+}
+function registerInstall(program3) {
+  program3.command("install [installLink]").description("Install Front Of House on this website").option("--agent <id>", "Agent ID; normally supplied by the install link").option("--org <id>", "Org ID; normally supplied by the install link or stored org context").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist").option("--platform <platform>", `Install target platform: ${SUPPORTED_INSTALL_PLATFORMS.join("|")}`, "custom").option("--site-root <path>", "Website repository root", ".").option("--target <path>", "HTML shell to patch, relative to --site-root").option("--api-url <url>", "API base URL override").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--dry-run", "Resolve and report install actions without writing files or running build/smoke").option("--no-build", "Do not run the website build command after installing").option("--no-smoke", "Do not run the widget smoke check after installing").option("--json", "Output as JSON").action(async (installLink, opts) => withCommandErrorHandling(async () => {
+    const parsedLink = parseInstallLink(installLink);
+    const resolvedLink = parsedLink.installToken ? await resolveInstallLinkToken(parsedLink.installToken, opts.apiUrl || parsedLink.apiUrl) : {};
+    const link = {
+      ...parsedLink,
+      ...resolvedLink,
+      apiUrl: opts.apiUrl || resolvedLink.apiUrl || parsedLink.apiUrl,
+      publicKey: resolvedLink.publicKey || parsedLink.publicKey
+    };
+    const domains = splitCsv(opts.domains);
+    const agent = opts.agent || link.agent;
+    const org = opts.org || link.org;
+    const apiUrl = opts.apiUrl || link.apiUrl;
+    const domainAllowlist = domains.length > 0 ? domains : link.domains || [];
+    const platform = normalizeInstallPlatform(opts.platform);
+    const smokeOrigin = normalizeOrigin(
+      typeof opts.origin === "string" && opts.origin.trim() ? opts.origin : domainAllowlist[0]
+    );
+    const snippet2 = link.publicKey ? widgetSnippetFromPublicKey(link.publicKey, apiUrl) : void 0;
+    if (!agent && !snippet2) {
+      throw new FohError({
+        step: "install",
+        error: "No Front Of House agent was provided.",
+        remediation: "Run: foh install <install-link>, or foh install --agent <agent-id>"
+      });
+    }
+    if (isBuilderHostedPlatform(platform)) {
+      if (!snippet2) {
+        throw new FohError({
+          step: "install",
+          error: "Builder-hosted install requires a public widget snippet or install link.",
+          remediation: "Run: foh install <install-link-with-channel-or-token> --platform <platform>"
+        });
+      }
+      const instructions = buildBuilderPlatformInstructions({
+        platform,
+        snippet: snippet2,
+        publicKey: link.publicKey,
+        domains: domainAllowlist,
+        origin: smokeOrigin
+      });
+      format({
+        schema_version: "foh_site_install.v1",
+        status: opts.dryRun ? "dry_run" : "ready_for_manual_install",
+        install_mode: "builder_platform",
+        platform,
+        site_root: null,
+        target_path: null,
+        changed: false,
+        install: instructions,
+        widget_public_key: instructions.widget_public_key,
+        domain_allowlist: instructions.domain_allowlist,
+        origin_hint: instructions.origin_hint,
+        install_verification_command: instructions.install_verification_command,
+        runtime_smoke_command: instructions.runtime_smoke_command,
+        verification_commands: instructions.verification_commands,
+        build: {
+          ok: null,
+          skipped: true,
+          reason: "builder_platform_manual_install",
+          command: null
+        },
+        smoke: {
+          ok: null,
+          skipped: true,
+          reason: "builder_platform_manual_install"
+        },
+        next_commands: instructions.verification_commands
+      }, { json: opts.json ?? false });
+      return;
+    }
+    const install = await installWidgetSite({
+      agent,
+      org,
+      domains: domainAllowlist,
+      siteRoot: opts.siteRoot,
+      target: opts.target,
+      snippet: snippet2,
+      apiUrl,
+      dryRun: opts.dryRun
+    });
+    const targetPath = install.absolute_target_path || resolveWidgetInstallTarget(opts.siteRoot, opts.target);
+    const buildCommand = detectBuildCommand(opts.siteRoot, targetPath);
+    const installGuidance = buildWidgetInstallGuidance({
+      publicKey: install.widget_public_key || link.publicKey || null,
+      agentId: agent,
+      domains: domainAllowlist,
+      origin: smokeOrigin
+    });
+    const build = !opts.dryRun && opts.build !== false && buildCommand ? runBuildCommand(buildCommand) : null;
+    const smokePublicKey = installGuidance.widget_public_key;
+    const smoke = !opts.dryRun && opts.smoke !== false && smokePublicKey ? await runWidgetSmoke(smokePublicKey, apiUrl, smokeOrigin) : null;
+    const ok = install.status === "installed" && (build ? build.ok : true) && (smoke ? smoke.failed === 0 : true);
+    const result = {
+      schema_version: "foh_site_install.v1",
+      status: opts.dryRun ? "dry_run" : ok ? "installed" : "failed",
+      install_mode: "repo_patch",
+      platform,
+      site_root: import_node_path5.default.resolve(opts.siteRoot || "."),
+      target_path: install.target_path,
+      changed: install.changed,
+      install,
+      widget_public_key: installGuidance.widget_public_key,
+      domain_allowlist: installGuidance.domain_allowlist,
+      origin_hint: installGuidance.origin_hint,
+      install_verification_command: installGuidance.install_verification_command,
+      runtime_smoke_command: installGuidance.runtime_smoke_command,
+      verification_commands: installGuidance.verification_commands,
+      build: build || {
+        ok: null,
+        skipped: opts.dryRun || opts.build === false || !buildCommand,
+        reason: opts.dryRun ? "dry_run" : opts.build === false ? "disabled" : "no package.json build script found near target",
+        command: buildCommand?.display ?? null
+      },
+      smoke: smoke || {
+        ok: null,
+        skipped: opts.dryRun || opts.smoke === false || !install.widget_public_key,
+        reason: opts.dryRun ? "dry_run" : opts.smoke === false ? "disabled" : "widget public key unavailable"
+      },
+      next_commands: ok ? [] : [
+        build && !build.ok ? build.command : null,
+        smoke && smoke.failed > 0 ? installGuidance.runtime_smoke_command : null,
+        !smoke && installGuidance.verification_commands.length > 0 ? installGuidance.verification_commands[0] : null
+      ].filter(Boolean)
+    };
+    format(result, { json: opts.json ?? false });
+    if (!ok && !opts.dryRun) markCommandFailed(1);
+  }));
+}
+
 // src/commands/home-actions.ts
 function resolveHomeState(apiUrlOverride) {
   try {
@@ -41067,9 +42444,9 @@ function compareSemver(a, b) {
   }
   return 0;
 }
-function readPackageJsonVersion(path2) {
+function readPackageJsonVersion(path5) {
   try {
-    const raw = (0, import_fs12.readFileSync)(path2, "utf-8");
+    const raw = (0, import_fs12.readFileSync)(path5, "utf-8");
     const parsed = JSON.parse(raw);
     const version2 = String(parsed.version ?? "").trim();
     return version2 || void 0;
@@ -41320,8 +42697,8 @@ var PHONE_RE2 = /(?<!\w)(?:\+?\d[\d\s().-]{7,}\d)(?!\w)/g;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function pathVariants(path2) {
-  const resolved = (0, import_path11.resolve)(path2);
+function pathVariants(path5) {
+  const resolved = (0, import_path11.resolve)(path5);
   const slash = resolved.replace(/\\/g, "/");
   const backslash = resolved.replace(/\//g, "\\");
   return Array.from(new Set([
@@ -41365,9 +42742,9 @@ function redactExternalAgentSecretText(text) {
 }
 function artifactFiles(runDir) {
   if (!(0, import_fs13.existsSync)(runDir)) return [];
-  return (0, import_fs13.readdirSync)(runDir).map((name) => (0, import_path11.join)(runDir, name)).filter((path2) => {
-    const stat = (0, import_fs13.statSync)(path2);
-    const name = path2.split(/[\\/]/).pop() || "";
+  return (0, import_fs13.readdirSync)(runDir).map((name) => (0, import_path11.join)(runDir, name)).filter((path5) => {
+    const stat = (0, import_fs13.statSync)(path5);
+    const name = path5.split(/[\\/]/).pop() || "";
     if (name.endsWith(".redacted")) return false;
     return stat.isFile() && (TEXT_ARTIFACT_NAMES.has(name) || name.startsWith("command-output-cmd_"));
   }).sort();
@@ -41736,10 +43113,10 @@ function collectDocsFrom(value, docs) {
 }
 function readExternalAgentMetadata(runDir) {
   for (const filename of EXTERNAL_AGENT_METADATA_FILENAMES) {
-    const path2 = (0, import_path14.join)(runDir, filename);
-    if (!(0, import_fs15.existsSync)(path2)) continue;
+    const path5 = (0, import_path14.join)(runDir, filename);
+    if (!(0, import_fs15.existsSync)(path5)) continue;
     try {
-      const parsed = JSON.parse((0, import_fs15.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_fs15.readFileSync)(path5, "utf8"));
       const docs = /* @__PURE__ */ new Set();
       collectDocsFrom(parsed.docs_pages_used, docs);
       collectDocsFrom(parsed.docs_pages_observed, docs);
@@ -41767,11 +43144,11 @@ function readExternalAgentMetadata(runDir) {
 }
 
 // src/lib/external-agent-executor-artifacts.ts
-function redactArtifactFile(path2, input = {}) {
-  if (!(0, import_fs16.existsSync)(path2)) return;
-  const original = (0, import_fs16.readFileSync)(path2, "utf8");
+function redactArtifactFile(path5, input = {}) {
+  if (!(0, import_fs16.existsSync)(path5)) return;
+  const original = (0, import_fs16.readFileSync)(path5, "utf8");
   const redacted = redactExternalAgentArtifactText(original, input);
-  if (redacted !== original) (0, import_fs16.writeFileSync)(path2, redacted, "utf8");
+  if (redacted !== original) (0, import_fs16.writeFileSync)(path5, redacted, "utf8");
 }
 function redactExternalAgentOutputArtifacts(run, input = {}) {
   redactArtifactFile(run.outputs.jsonl, input);
@@ -41812,11 +43189,11 @@ function proofArtifactPasses(runDir) {
     return false;
   }
 }
-function readIfExists(path2) {
-  return (0, import_fs17.existsSync)(path2) ? (0, import_fs17.readFileSync)(path2, "utf8") : "";
+function readIfExists(path5) {
+  return (0, import_fs17.existsSync)(path5) ? (0, import_fs17.readFileSync)(path5, "utf8") : "";
 }
-function relativeArtifactName(path2) {
-  return (0, import_path16.basename)(path2);
+function relativeArtifactName(path5) {
+  return (0, import_path16.basename)(path5);
 }
 function externalAgentSummaryTemplateCommand() {
   return [
@@ -42149,11 +43526,11 @@ async function runExternalAgentEvalAuthPreflight(env = process.env, options = {}
     matched_org: matchedOrg
   };
 }
-function normalizeForCompare(path2) {
-  const resolved = (0, import_path18.resolve)(path2);
+function normalizeForCompare(path5) {
+  const resolved = (0, import_path18.resolve)(path5);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
-function isPathInside(childPath, parentPath) {
+function isPathInside2(childPath, parentPath) {
   const child = normalizeForCompare(childPath);
   const parent = normalizeForCompare(parentPath);
   const rel = (0, import_path18.relative)(parent, child);
@@ -42540,7 +43917,7 @@ function createExternalAgentExecutorPlan(options) {
   });
   const privateRepoRoot = privateRepo.root;
   const workspaceRoot = resolveWorkspaceRoot({ batchPath, workspaceRoot: options.workspaceRoot, privateRepoRoot });
-  if (isPathInside(workspaceRoot, privateRepoRoot)) {
+  if (isPathInside2(workspaceRoot, privateRepoRoot)) {
     throw new ExternalAgentExecutorError(
       "external_agent_workspace_inside_private_repo",
       `Workspace root must be outside the private repository. workspace=${workspaceRoot} repo=${privateRepoRoot}`
@@ -42670,11 +44047,11 @@ function createExternalAgentExecutorPlan(options) {
   };
 }
 function writeExternalAgentExecutorPlan(plan) {
-  const path2 = (0, import_path18.join)(plan.batch_dir, "executor-plan.json");
+  const path5 = (0, import_path18.join)(plan.batch_dir, "executor-plan.json");
   (0, import_fs19.mkdirSync)(plan.batch_dir, { recursive: true });
-  (0, import_fs19.writeFileSync)(path2, `${JSON.stringify(plan, null, 2)}
+  (0, import_fs19.writeFileSync)(path5, `${JSON.stringify(plan, null, 2)}
 `, "utf8");
-  return path2;
+  return path5;
 }
 async function executeExternalAgentExecutorPlan(plan, options = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -43507,16 +44884,16 @@ function writePrompt(runDir, promptVersion, context = {}) {
     knowledgeMissPromptContext(context.knowledgeQuestion, context.expectedAnswer),
     agencySetupPromptContext(context)
   ].join("");
-  const path2 = (0, import_path20.join)(runDir, "prompt.txt");
-  (0, import_fs21.writeFileSync)(path2, `${prompt}
+  const path5 = (0, import_path20.join)(runDir, "prompt.txt");
+  (0, import_fs21.writeFileSync)(path5, `${prompt}
 `, "utf8");
-  return path2;
+  return path5;
 }
 function writeSession(runDir, session) {
-  const path2 = (0, import_path20.join)(runDir, "session.json");
-  (0, import_fs21.writeFileSync)(path2, `${JSON.stringify(session, null, 2)}
+  const path5 = (0, import_path20.join)(runDir, "session.json");
+  (0, import_fs21.writeFileSync)(path5, `${JSON.stringify(session, null, 2)}
 `, "utf8");
-  return path2;
+  return path5;
 }
 function buildDefaultEvalState() {
   return {
@@ -44127,6 +45504,7 @@ registerBug(program2);
 registerProve(program2);
 registerObjective(program2);
 registerInteractive(program2);
+registerInstall(program2);
 registerAgentPublishCommand(program2, { publicAlias: true });
 registerEval(program2);
 registerUpdate(program2);