@gajae-gateway/cli 0.1.3 → 0.1.5

package/dist/main.js

@@ -3,8 +3,8 @@
 
 // src/main.ts
 import { Database } from "bun:sqlite";
-import { copyFile, lstat, readFile as readFile3, stat as stat2 } from "fs/promises";
-import { isAbsolute, join as join3 } from "path";
+import { copyFile as copyFile2, lstat as lstat2, readFile as readFile8, stat as stat3 } from "fs/promises";
+import { isAbsolute, join as join10 } from "path";
 import { LOOPBACK_ORIGIN, originKey as originKey2 } from "@gajae-gateway/protocol";
 import { GajaewayClient } from "@gajae-gateway/sdk";
 
@@ -98,12 +98,29 @@ function triggerSummary(monitor) {
   }
 }
 var MONITOR_COLUMNS = [
-  { name: "id", value: (monitor) => monitor.monitorId.slice(0, 8) },
-  { name: "name", value: (monitor) => monitor.name },
-  { name: "schedule", value: triggerSummary },
-  { name: "events", value: (monitor) => [...monitor.eventTypes] },
-  { name: "target", value: (monitor) => monitor.channelTarget ? originKey(monitor.channelTarget.origin) : null },
-  { name: "enabled", value: (monitor) => monitor.enabled }
+  { name: "id", value: (row) => row.monitor.monitorId.slice(0, 8) },
+  { name: "name", value: (row) => row.monitor.name },
+  { name: "schedule", value: (row) => triggerSummary(row.monitor) },
+  { name: "timezone", value: (row) => row.schedule?.effectiveTimezone ?? null },
+  {
+    name: "nextFire",
+    value: (row) => {
+      const { monitor, schedule } = row;
+      if (monitor.trigger.kind !== "cron")
+        return null;
+      if (!monitor.enabled)
+        return "paused";
+      if (!schedule)
+        return null;
+      if (!schedule.nextFireAt)
+        return "never";
+      const utc = schedule.nextFireAt.utc.replace(/:\d{2}\.\d{3}Z$/, "Z");
+      return `${schedule.nextFireAt.local} / ${utc}`;
+    }
+  },
+  { name: "events", value: (row) => [...row.monitor.eventTypes] },
+  { name: "target", value: (row) => row.monitor.channelTarget ? originKey(row.monitor.channelTarget.origin) : null },
+  { name: "enabled", value: (row) => row.monitor.enabled }
 ];
 var SESSION_COLUMNS = [
   { name: "index", value: (_session, index) => index },
@@ -123,20 +140,1020 @@ function renderList(columns, rows, options, envelope) {
     return renderTable(selected, entries);
   if (!options.fields && options.limit === undefined && options.offset === 0)
     return [JSON.stringify(envelope.result)];
-  const projected = options.fields ? projectRows(selected, entries) : entries.map((entry) => entry.row);
+  const projected = options.fields ? projectRows(selected, entries) : entries.map((entry) => envelope.serializeRow ? envelope.serializeRow(entry.row) : entry.row);
   return [JSON.stringify({ ...envelope.result, [envelope.key]: projected })];
 }
 
+// src/migrate.ts
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+
+// src/migrate/hermes.ts
+import { join as join2 } from "path";
+
+// src/migrate/plan.ts
+import { eventTypeOrigin, validateOriginRef } from "@gajae-gateway/protocol";
+function emptyExtract(source, root) {
+  return {
+    source,
+    root,
+    inventory: { persona: [], memory: [], channels: [], schedules: [], skills: [] },
+    files: [],
+    merges: [],
+    monitors: [],
+    unmapped: [],
+    warnings: []
+  };
+}
+var CRON_FIELD = /^(\*|\d+(-\d+)?)(\/\d+)?(,(\*|\d+(-\d+)?)(\/\d+)?)*$/;
+var CRON_BOUNDS = [
+  [0, 59],
+  [0, 23],
+  [1, 31],
+  [1, 12],
+  [0, 7]
+];
+function gatewayCron(expr) {
+  const fields = expr.trim().split(/\s+/);
+  if (fields.length !== 5)
+    return;
+  for (const [index, field] of fields.entries()) {
+    if (!CRON_FIELD.test(field))
+      return;
+    const [min, max] = CRON_BOUNDS[index];
+    for (const number of field.match(/\d+/g) ?? []) {
+      const value = Number(number);
+      if (field.includes(`/${number}`))
+        continue;
+      if (value < min || value > max)
+        return;
+    }
+  }
+  return fields.join(" ");
+}
+function intervalCron(minutes) {
+  if (!Number.isInteger(minutes) || minutes < 1)
+    return;
+  if (minutes === 1)
+    return "* * * * *";
+  if (minutes < 60 && 60 % minutes === 0)
+    return `*/${minutes} * * * *`;
+  if (minutes === 60)
+    return "0 * * * *";
+  if (minutes % 60 === 0 && minutes < 1440 && 24 % (minutes / 60) === 0)
+    return `0 */${minutes / 60} * * *`;
+  if (minutes === 1440)
+    return "0 0 * * *";
+  return;
+}
+function slug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48).replace(/-+$/, "") || "job";
+}
+var MONITOR_INSTRUCTION_MAX = 4000;
+function cronMonitor(input) {
+  const instruction = input.instruction.trim();
+  if (!instruction)
+    return "job has no prompt text to use as the monitor instruction";
+  if (instruction.length > MONITOR_INSTRUCTION_MAX)
+    return `prompt is ${instruction.length} characters; monitor instructions are limited to ${MONITOR_INSTRUCTION_MAX}`;
+  const base = `${input.source}-${slug(input.name)}`;
+  let name = base;
+  for (let n = 2;input.taken.has(name); n++)
+    name = `${base}-${n}`;
+  const eventType = `migrated.${name}`;
+  validateOriginRef(eventTypeOrigin(eventType));
+  if (input.target)
+    validateOriginRef(input.target);
+  input.taken.add(name);
+  return {
+    name,
+    trigger: { kind: "cron", schedule: input.schedule },
+    eventTypes: [eventType],
+    burstPolicy: "dedupe",
+    instruction,
+    ...input.target ? { channelTarget: { origin: input.target } } : {},
+    enabled: input.enabled
+  };
+}
+function deliveryOrigin(platform, rawTarget) {
+  const target = rawTarget.trim();
+  if (platform === "telegram") {
+    const chat = target.replace(/^(channel|group|chat):/, "").split(":")[0] ?? "";
+    if (!/^-?\d+$/.test(chat))
+      return `telegram target ${JSON.stringify(target)} is not a numeric chat id`;
+    return chat.startsWith("-") ? { platform: "telegram", kind: "channel", conversationId: chat } : { platform: "telegram", kind: "dm", conversationId: chat, peerId: chat };
+  }
+  if (platform === "discord" || platform === "slack") {
+    if (target.startsWith("user:"))
+      return `${platform} user target ${JSON.stringify(target)} needs a DM conversation id the source does not record`;
+    const id = target.replace(/^channel:/, "");
+    const valid = platform === "discord" ? /^\d+$/.test(id) : /^[CG][A-Z0-9]+$/.test(id);
+    if (!valid)
+      return `${platform} target ${JSON.stringify(target)} is not a channel id`;
+    return { platform, kind: "channel", conversationId: id };
+  }
+  return `delivery platform ${JSON.stringify(platform)} has no gajae-way adapter`;
+}
+var SECRET_FILES = {
+  discord: "secrets/discord-token",
+  telegram: "secrets/telegram-token",
+  "slack-bot": "secrets/slack-bot-token",
+  "slack-app": "secrets/slack-app-token"
+};
+function emptyChannelPlan() {
+  return { credentials: {}, channels: {}, allowlist: new Set };
+}
+function emitChannels(extract, plan, home, configSource) {
+  const credentialSources = Object.values(plan.credentials).map((entry) => entry.source);
+  for (const [name, entry] of Object.entries(plan.credentials)) {
+    extract.files.push({
+      category: "credentials",
+      sources: [entry.source],
+      target: SECRET_FILES[name],
+      content: `${entry.value}
+`,
+      secret: true
+    });
+  }
+  const has = (name) => plan.credentials[name] !== undefined;
+  const byPlatform = (platform) => Object.fromEntries(Object.entries(plan.channels).filter(([key]) => key.startsWith(`${platform}:`)).map(([key, policy]) => [key.slice(platform.length + 1), policy]));
+  const credentialRefs = {};
+  if (has("discord"))
+    credentialRefs.discord = { credentialFile: `${home}/${SECRET_FILES.discord}` };
+  if (has("telegram"))
+    credentialRefs.telegram = { credentialFile: `${home}/${SECRET_FILES.telegram}` };
+  if (has("slack-bot"))
+    credentialRefs.slackBot = { credentialFile: `${home}/${SECRET_FILES["slack-bot"]}` };
+  if (has("slack-app"))
+    credentialRefs.slackApp = { credentialFile: `${home}/${SECRET_FILES["slack-app"]}` };
+  const allowlist = [...plan.allowlist].sort();
+  extract.merges.push({
+    category: "channels",
+    sources: [configSource, ...credentialSources],
+    target: "config.json",
+    merge(existing) {
+      const base = existing ?? { schemaVersion: 1 };
+      const credentials = { ...base.credentials };
+      for (const [name, reference] of Object.entries(credentialRefs))
+        credentials[name] ??= reference;
+      const channels = { ...base.channels };
+      for (const [key, policy] of Object.entries(plan.channels))
+        channels[key] ??= policy;
+      const existingAllow = Array.isArray(base.mentionAllowlist) ? base.mentionAllowlist : [];
+      const mergedAllow = [...new Set([...existingAllow, ...allowlist])];
+      return {
+        ...base,
+        ...Object.keys(credentials).length ? { credentials } : {},
+        ...Object.keys(channels).length ? { channels } : {},
+        ...mergedAllow.length ? { mentionAllowlist: mergedAllow } : {},
+        ...base.dmPolicy === undefined && plan.dmPolicy ? { dmPolicy: plan.dmPolicy } : {}
+      };
+    }
+  });
+  const adapter = (target, required, channelKey, platform) => {
+    const channels = byPlatform(platform);
+    const adapterChannels = platform === "telegram" ? Object.fromEntries(Object.entries(channels).filter(([, policy]) => policy.engagement === "open")) : channels;
+    extract.merges.push({
+      category: "channels",
+      sources: [configSource],
+      target,
+      merge(existing) {
+        const base = { ...existing };
+        for (const [field, value] of Object.entries(required))
+          base[field] ??= value;
+        const merged = { ...base[channelKey] };
+        for (const [id, policy] of Object.entries(adapterChannels))
+          merged[id] ??= policy;
+        return { ...base, ...Object.keys(merged).length ? { [channelKey]: merged } : {} };
+      }
+    });
+  };
+  if (has("discord"))
+    adapter("adapter-discord.json", { tokenFile: SECRET_FILES.discord }, "channels", "discord");
+  if (has("telegram"))
+    adapter("adapter-telegram.json", { tokenFile: SECRET_FILES.telegram }, "chats", "telegram");
+  if (has("slack-bot") && has("slack-app"))
+    adapter("adapter-slack.json", { botTokenFile: SECRET_FILES["slack-bot"], appTokenFile: SECRET_FILES["slack-app"] }, "channels", "slack");
+  else if (has("slack-bot") !== has("slack-app"))
+    extract.warnings.push("Slack needs both a bot token (xoxb-) and a Socket Mode app token (xapp-); only one was found, so adapter-slack.json was not written");
+  for (const [name, prefix] of [
+    ["slack-bot", "xoxb-"],
+    ["slack-app", "xapp-"]
+  ]) {
+    const value = plan.credentials[name]?.value;
+    if (value !== undefined && !value.startsWith(prefix))
+      extract.warnings.push(`${SECRET_FILES[name]} does not start with ${prefix}; the Slack adapter will refuse it`);
+  }
+}
+function emitMonitors(extract) {
+  if (extract.monitors.length === 0)
+    return;
+  const specs = extract.monitors.map((entry) => entry.spec);
+  extract.merges.push({
+    category: "monitors",
+    sources: [...new Set(extract.monitors.map((entry) => entry.source))],
+    target: MIGRATED_MONITORS_FILE,
+    merge(existing) {
+      const current = Array.isArray(existing?.monitors) ? existing.monitors : [];
+      const names = new Set(current.map((spec) => spec.name));
+      return { version: 1, monitors: [...current, ...specs.filter((spec) => !names.has(spec.name))] };
+    }
+  });
+}
+var MIGRATED_MONITORS_FILE = "migration/monitors.json";
+var IMPORTED_AXIS = {
+  id: "imported",
+  displayName: "Imported memory",
+  root: "imported",
+  nesting: "nested",
+  index: "tree",
+  layout: "free",
+  retrievalPriority: 50
+};
+function emitImportedAxis(extract) {
+  extract.merges.push({
+    category: "memory",
+    sources: [],
+    target: "memory/axes.json",
+    merge(existing) {
+      const axes = Array.isArray(existing?.axes) ? existing.axes : [];
+      if (axes.some((axis) => axis.id === IMPORTED_AXIS.id))
+        return { version: 1, ...existing, axes };
+      return { version: 1, ...existing, axes: [...axes, IMPORTED_AXIS] };
+    }
+  });
+}
+
+// src/migrate/source-fs.ts
+import { lstat, readdir, readFile } from "fs/promises";
+import { homedir } from "os";
+import { join, relative } from "path";
+
+class SourceTree {
+  root;
+  #consumed = new Set;
+  constructor(root) {
+    this.root = root;
+  }
+  rel(path) {
+    const inside = relative(this.root, path);
+    return inside.startsWith("..") ? path : inside || ".";
+  }
+  consume(path) {
+    this.#consumed.add(path);
+  }
+  isConsumed(path) {
+    for (const consumed of this.#consumed)
+      if (path === consumed || path.startsWith(`${consumed}/`) || consumed.startsWith(`${path}/`))
+        return true;
+    return false;
+  }
+  isFullyConsumed(path) {
+    for (const consumed of this.#consumed)
+      if (path === consumed || path.startsWith(`${consumed}/`))
+        return true;
+    return false;
+  }
+  async text(path) {
+    const info = await regularFile(path);
+    if (!info)
+      return;
+    this.consume(path);
+    return readFile(path, "utf8");
+  }
+  async bytes(path) {
+    const info = await regularFile(path);
+    if (!info)
+      return;
+    this.consume(path);
+    return new Uint8Array(await readFile(path));
+  }
+}
+async function regularFile(path) {
+  try {
+    const info = await lstat(path);
+    return info.isFile() ? { mtime: info.mtime } : undefined;
+  } catch {
+    return;
+  }
+}
+async function isDirectory(path) {
+  try {
+    return (await lstat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function entries(path) {
+  try {
+    return (await readdir(path)).sort();
+  } catch {
+    return [];
+  }
+}
+async function walkFiles(dir, prefix = "") {
+  const out = [];
+  for (const name of await entries(dir)) {
+    const full = join(dir, name);
+    const info = await lstat(full).catch(() => {
+      return;
+    });
+    if (!info)
+      continue;
+    if (info.isDirectory())
+      out.push(...await walkFiles(full, join(prefix, name)));
+    else if (info.isFile())
+      out.push(join(prefix, name));
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const values = new Map;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match)
+      continue;
+    let value = match[2] ?? "";
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.lastIndexOf(quote) > 0)
+      value = value.slice(1, value.lastIndexOf(quote));
+    else
+      value = value.replace(/\s+#.*$/, "").trim();
+    values.set(match[1], value);
+  }
+  return values;
+}
+function expandHome(path) {
+  return path === "~" ? homedir() : path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringList(value) {
+  const items = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
+  return items.map((item) => String(item).trim()).filter(Boolean);
+}
+
+// src/migrate/hermes.ts
+var HERMES_ENTRY_DELIMITER = `
+\xA7
+`;
+async function detectHermes(root) {
+  return await regularFile(join2(root, "config.yaml")) !== undefined || await isDirectory(join2(root, "memories")) || await regularFile(join2(root, "cron", "jobs.json")) !== undefined;
+}
+var TOKEN_KEYS = {
+  DISCORD_BOT_TOKEN: "discord",
+  TELEGRAM_BOT_TOKEN: "telegram",
+  SLACK_BOT_TOKEN: "slack-bot",
+  SLACK_APP_TOKEN: "slack-app"
+};
+var ALLOWLIST_KEYS = ["DISCORD_ALLOWED_USERS", "TELEGRAM_ALLOWED_USERS", "SLACK_ALLOWED_USERS"];
+var HOME_CHANNEL_KEYS = {
+  discord: "DISCORD_HOME_CHANNEL",
+  telegram: "TELEGRAM_HOME_CHANNEL",
+  slack: "SLACK_HOME_CHANNEL"
+};
+async function readHermes(tree, home) {
+  const root = tree.root;
+  const extract = emptyExtract("hermes", root);
+  for (const name of ["SOUL.md", "AGENTS.md"]) {
+    const path = join2(root, name);
+    const text = await tree.text(path);
+    if (text === undefined)
+      continue;
+    const info = await regularFile(path);
+    extract.inventory.persona.push(tree.rel(path));
+    extract.files.push({
+      category: "persona",
+      sources: [tree.rel(path)],
+      target: `workspace/${name}`,
+      content: text,
+      mtime: info?.mtime
+    });
+  }
+  const memoryDir = join2(root, "memories");
+  const userPath = join2(memoryDir, "USER.md");
+  const userText = await tree.text(userPath);
+  if (userText !== undefined) {
+    const info = await regularFile(userPath);
+    extract.inventory.persona.push(tree.rel(userPath));
+    extract.files.push({
+      category: "persona",
+      sources: [tree.rel(userPath)],
+      target: "workspace/USER.md",
+      content: entriesToMarkdown("User profile (imported from Hermes)", userText),
+      mtime: info?.mtime
+    });
+  }
+  const memoryPath = join2(memoryDir, "MEMORY.md");
+  const memoryText = await tree.text(memoryPath);
+  if (memoryText !== undefined) {
+    const info = await regularFile(memoryPath);
+    extract.inventory.memory.push(tree.rel(memoryPath));
+    extract.files.push({
+      category: "memory",
+      sources: [tree.rel(memoryPath)],
+      target: "memory/imported/hermes/MEMORY.md",
+      content: entriesToMarkdown("Long-term memory (imported from Hermes)", memoryText),
+      mtime: info?.mtime
+    });
+    emitImportedAxis(extract);
+  }
+  const envPath = join2(root, ".env");
+  const envText = await tree.text(envPath);
+  const env = envText === undefined ? new Map : parseDotenv(envText);
+  const consumedEnv = new Set;
+  const configPath = join2(root, "config.yaml");
+  const configText = await tree.text(configPath);
+  let config = {};
+  if (configText !== undefined) {
+    try {
+      const parsed = Bun.YAML.parse(configText);
+      if (isRecord(parsed))
+        config = parsed;
+    } catch (error) {
+      extract.warnings.push(`config.yaml could not be parsed (${error instanceof Error ? error.message : String(error)}); channel policies were not read`);
+    }
+  }
+  const consumedConfig = new Set;
+  const channels = emptyChannelPlan();
+  for (const [key, credential] of Object.entries(TOKEN_KEYS)) {
+    const value = env.get(key);
+    if (!value)
+      continue;
+    consumedEnv.add(key);
+    extract.inventory.channels.push(`.env ${key}`);
+    if (value.includes(",")) {
+      extract.unmapped.push({
+        category: "credentials",
+        source: `.env ${key}`,
+        reason: "holds several comma-separated tokens (multi-workspace); gajae-way runs one bot per adapter, so none was imported"
+      });
+      continue;
+    }
+    channels.credentials[credential] = { value, source: `.env ${key}` };
+  }
+  for (const key of ALLOWLIST_KEYS) {
+    const value = env.get(key);
+    if (value === undefined)
+      continue;
+    consumedEnv.add(key);
+    for (const id of stringList(value))
+      channels.allowlist.add(id);
+  }
+  readHermesChannelPolicy(config, env, channels, consumedConfig, consumedEnv, extract);
+  if (Object.keys(channels.credentials).length > 0 || Object.keys(channels.channels).length > 0)
+    emitChannels(extract, channels, home, ".env / config.yaml");
+  await readHermesCron(tree, env, consumedEnv, extract);
+  emitMonitors(extract);
+  await readHermesSkills(tree, extract);
+  for (const key of env.keys())
+    if (!consumedEnv.has(key))
+      extract.unmapped.push({
+        category: "credentials",
+        source: `.env ${key}`,
+        reason: /(_KEY|_TOKEN|_SECRET|PASSWORD)$/.test(key) ? "provider/tool credential; gajae-way sessions use the shared gjc agent profile, so set it there if still needed" : "setting has no gajae-way equivalent"
+      });
+  for (const key of Object.keys(config))
+    if (!consumedConfig.has(key))
+      extract.unmapped.push({
+        category: "other",
+        source: `config.yaml ${key}`,
+        reason: "setting has no gajae-way equivalent"
+      });
+  return extract;
+}
+function entriesToMarkdown(title, raw) {
+  const items = raw.split(HERMES_ENTRY_DELIMITER).map((entry) => entry.trim()).filter(Boolean);
+  return `# ${title}
+
+${items.map((entry) => `- ${entry.replace(/\n/g, `
+  `)}`).join(`
+`)}
+`;
+}
+function readHermesChannelPolicy(config, env, channels, consumedConfig, consumedEnv, extract) {
+  const discord = isRecord(config.discord) ? config.discord : undefined;
+  if (discord) {
+    consumedConfig.add("discord");
+    const free = stringList(discord.free_response_channels);
+    for (const id of free) {
+      if (id === "*") {
+        extract.unmapped.push({
+          category: "channels",
+          source: "config.yaml discord.free_response_channels",
+          reason: '"*" (every channel) has no per-channel equivalent; list channels explicitly'
+        });
+        continue;
+      }
+      channels.channels[`discord:${id}`] = { engagement: "open" };
+      extract.inventory.channels.push(`config.yaml discord.free_response_channels ${id}`);
+    }
+    for (const key of Object.keys(discord))
+      if (key !== "free_response_channels" && key !== "require_mention")
+        extract.unmapped.push({
+          category: "channels",
+          source: `config.yaml discord.${key}`,
+          reason: "Discord adapter setting has no gajae-way equivalent"
+        });
+  }
+  const slackChannels = env.get("SLACK_ALLOWED_CHANNELS");
+  if (slackChannels !== undefined) {
+    consumedEnv.add("SLACK_ALLOWED_CHANNELS");
+    for (const id of stringList(slackChannels))
+      channels.channels[`slack:${id}`] = { engagement: "mention-open" };
+  }
+  const telegram = isRecord(config.telegram) ? config.telegram : undefined;
+  if (telegram)
+    consumedConfig.add("telegram");
+  const telegramGroups = env.get("TELEGRAM_GROUP_ALLOWED_CHATS");
+  if (telegramGroups !== undefined) {
+    consumedEnv.add("TELEGRAM_GROUP_ALLOWED_CHATS");
+    const engagement = telegram?.require_mention === true ? "mention-open" : "open";
+    for (const id of stringList(telegramGroups))
+      channels.channels[`telegram:${id}`] = { engagement };
+  }
+  for (const key of [
+    "DISCORD_ALLOW_ALL_USERS",
+    "TELEGRAM_ALLOW_ALL_USERS",
+    "SLACK_ALLOW_ALL_USERS",
+    "GATEWAY_ALLOW_ALL_USERS"
+  ]) {
+    if (!env.has(key))
+      continue;
+    consumedEnv.add(key);
+    extract.unmapped.push({
+      category: "channels",
+      source: `.env ${key}`,
+      reason: 'allow-everyone is not carried over; gajae-way DMs default to the allowlist. Set dmPolicy "open" in config.json deliberately if wanted'
+    });
+  }
+}
+async function readHermesCron(tree, env, consumedEnv, extract) {
+  const path = join2(tree.root, "cron", "jobs.json");
+  const text = await tree.text(path);
+  if (text === undefined)
+    return;
+  let jobs = [];
+  try {
+    const parsed = JSON.parse(text);
+    jobs = Array.isArray(parsed) ? parsed : isRecord(parsed) && Array.isArray(parsed.jobs) ? parsed.jobs : [];
+  } catch {
+    extract.unmapped.push({ category: "monitors", source: tree.rel(path), reason: "is not valid JSON" });
+    return;
+  }
+  const taken = new Set;
+  for (const job of jobs) {
+    if (!isRecord(job))
+      continue;
+    const label = String(job.name ?? job.id ?? "job");
+    const source = `${tree.rel(path)} ${JSON.stringify(label)}`;
+    extract.inventory.schedules.push(source);
+    const skip = (reason) => extract.unmapped.push({ category: "monitors", source, reason });
+    if (job.no_agent === true || typeof job.script === "string" && job.script) {
+      skip("script job: gajae-way script monitors run a command under scriptRoot, recreate it with a script trigger");
+      continue;
+    }
+    if (typeof job.monitor_script === "string" || typeof job.monitor_url === "string") {
+      skip("change-detection pre-check (monitor_script/monitor_url) has no equivalent");
+      continue;
+    }
+    const schedule = isRecord(job.schedule) ? job.schedule : {};
+    let cron;
+    if (schedule.kind === "cron" && typeof schedule.expr === "string") {
+      cron = gatewayCron(schedule.expr);
+      if (!cron) {
+        skip(`cron expression ${JSON.stringify(schedule.expr)} uses syntax the gateway cron trigger does not evaluate`);
+        continue;
+      }
+    } else if (schedule.kind === "interval" && typeof schedule.minutes === "number") {
+      cron = intervalCron(schedule.minutes);
+      if (!cron) {
+        skip(`every ${schedule.minutes}m does not divide an hour or a day, so it has no cron form`);
+        continue;
+      }
+    } else {
+      skip(`schedule kind ${JSON.stringify(schedule.kind)} (one-shot) has no recurring monitor equivalent`);
+      continue;
+    }
+    const skills = stringList(job.skills);
+    const prompt = typeof job.prompt === "string" ? job.prompt : "";
+    const instruction = skills.length ? `Use the skill(s): ${skills.join(", ")}.
+
+${prompt}` : prompt;
+    const target = hermesTarget(job, env, consumedEnv, extract, source);
+    const repeat = isRecord(job.repeat) ? job.repeat.times : null;
+    if (typeof repeat === "number")
+      extract.warnings.push(`${source}: repeat limit ${repeat} dropped; the monitor fires until removed`);
+    const spec = cronMonitor({
+      source: "hermes",
+      name: label,
+      schedule: cron,
+      instruction,
+      enabled: job.enabled !== false && job.state !== "paused",
+      target,
+      taken
+    });
+    if (typeof spec === "string")
+      skip(spec);
+    else
+      extract.monitors.push({ source, spec });
+  }
+}
+function hermesTarget(job, env, consumedEnv, extract, source) {
+  const targets = stringList(job.deliver ?? "local").filter((target) => target !== "local");
+  if (targets.length === 0)
+    return;
+  const resolved = [];
+  for (const target of targets) {
+    let result;
+    if (target === "origin" || target === "origin_fallback") {
+      const origin = isRecord(job.origin) ? job.origin : undefined;
+      result = origin && typeof origin.platform === "string" && origin.chat_id !== undefined ? deliveryOrigin(origin.platform, String(origin.chat_id)) : "origin delivery recorded no origin chat";
+    } else {
+      const [platform = "", ...rest] = target.split(":");
+      let chat = rest.join(":");
+      if (!chat && HOME_CHANNEL_KEYS[platform]) {
+        chat = env.get(HOME_CHANNEL_KEYS[platform]) ?? "";
+        consumedEnv.add(HOME_CHANNEL_KEYS[platform]);
+        consumedEnv.add(`${HOME_CHANNEL_KEYS[platform]}_NAME`);
+      }
+      result = chat ? deliveryOrigin(platform, chat) : `delivery target ${JSON.stringify(target)} has no chat id or home channel`;
+    }
+    if (typeof result === "string")
+      extract.warnings.push(`${source}: ${result}; delivered to the owner target instead`);
+    else
+      resolved.push(result);
+  }
+  if (resolved.length > 1)
+    extract.warnings.push(`${source}: a monitor has one channel target; kept the first of ${resolved.length}`);
+  return resolved[0];
+}
+async function readHermesSkills(tree, extract) {
+  const skillsDir = join2(tree.root, "skills");
+  if (!await isDirectory(skillsDir))
+    return;
+  tree.consume(skillsDir);
+  const bundledText = await tree.text(join2(skillsDir, ".bundled_manifest"));
+  const bundled = new Set((bundledText ?? "").split(/\r?\n/).map((line) => line.split(":")[0]?.trim() ?? "").filter(Boolean));
+  const files = (await walkFiles(skillsDir)).filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const skillRoots = files.filter((file) => file.endsWith("/SKILL.md") || file === "SKILL.md").map((file) => file.slice(0, -"/SKILL.md".length));
+  const seen = new Set;
+  for (const skillRoot of skillRoots) {
+    const name = skillRoot.split("/").at(-1) ?? skillRoot;
+    if (bundled.has(name))
+      continue;
+    await copySkill(tree, join2(skillsDir, skillRoot), name, extract, seen);
+  }
+  if (bundled.size)
+    extract.warnings.push(`${bundled.size} Hermes-bundled skill(s) skipped; they ship with Hermes, not with your data`);
+}
+async function copySkill(tree, dir, name, extract, seen) {
+  const source = tree.rel(dir);
+  extract.inventory.skills.push(source);
+  if (name === "self-ops" || seen.has(name)) {
+    extract.unmapped.push({
+      category: "skills",
+      source,
+      reason: `a skill named ${name} is already imported or built in`
+    });
+    return;
+  }
+  seen.add(name);
+  for (const file of await walkFiles(dir)) {
+    const path = join2(dir, file);
+    const content = await tree.bytes(path);
+    if (content === undefined)
+      continue;
+    extract.files.push({
+      category: "skills",
+      sources: [tree.rel(path)],
+      target: `workspace/.gjc/skills/${name}/${file}`,
+      content,
+      mtime: (await regularFile(path))?.mtime
+    });
+  }
+}
+
+// src/migrate/openclaw.ts
+import { join as join3 } from "path";
+var OPENCLAW_CONFIG = "config.json";
+async function detectOpenClaw(root) {
+  const configPath = join3(root, OPENCLAW_CONFIG);
+  const stat = await regularFile(configPath);
+  return stat !== undefined;
+}
+async function readOpenClaw(tree, _home) {
+  const extract = emptyExtract("openclaw", tree.root);
+  const configPath = join3(tree.root, OPENCLAW_CONFIG);
+  const envPath = join3(tree.root, ".env");
+  let config = {};
+  const configText = await tree.text(configPath);
+  if (configText) {
+    try {
+      config = JSON.parse(configText);
+    } catch (e) {
+      extract.warnings.push(`Invalid config.json: ${String(e)}`);
+    }
+  }
+  const env = new Map;
+  const envText = await tree.text(envPath);
+  if (envText) {
+    const parsed = parseDotenv(envText);
+    for (const [key, val] of parsed.entries()) {
+      env.set(key, val);
+    }
+  }
+  const consumedConfig = new Set;
+  const consumedEnv = new Set;
+  if (config.persona?.name) {
+    extract.files.push({
+      category: "persona",
+      sources: ["config.persona.name"],
+      target: "persona.json",
+      content: JSON.stringify({ name: config.persona.name })
+    });
+    consumedConfig.add("persona");
+  }
+  const channels = emptyChannelPlan();
+  if (isRecord(config.channels)) {
+    readOpenClawChannels(config.channels, env, channels, consumedConfig, consumedEnv);
+  }
+  if (isRecord(config.monitors)) {
+    for (const [name, spec] of Object.entries(config.monitors)) {
+      if (isRecord(spec)) {
+        const monitorResult = buildOpenClawMonitor(name, spec);
+        if (typeof monitorResult === "object") {
+          extract.monitors.push({ source: `config.monitors.${name}`, spec: monitorResult });
+        } else {
+          extract.unmapped.push({
+            source: `config.monitors.${name}`,
+            reason: monitorResult,
+            category: "monitors"
+          });
+        }
+      }
+    }
+    consumedConfig.add("monitors");
+  }
+  if (isRecord(config.skills)) {
+    await readOpenClawSkills(tree, config.skills, extract);
+    consumedConfig.add("skills");
+  }
+  if (isRecord(config.memory)) {
+    await readOpenClawMemory(tree, config.memory, extract);
+    consumedConfig.add("memory");
+  }
+  for (const [key] of Object.entries(config)) {
+    if (!consumedConfig.has(key)) {
+      extract.unmapped.push({
+        source: `config.${key}`,
+        reason: "not mapped by migration",
+        category: "other"
+      });
+    }
+  }
+  for (const [key] of env.entries()) {
+    if (!consumedEnv.has(key)) {
+      extract.unmapped.push({
+        source: `.env.${key}`,
+        reason: "not mapped by migration",
+        category: "credentials"
+      });
+    }
+  }
+  return extract;
+}
+function readOpenClawChannels(config, env, channels, consumedConfig, consumedEnv) {
+  for (const [platform, platformConfig] of Object.entries(config)) {
+    if (!isRecord(platformConfig))
+      continue;
+    if (platform === "discord" || platform === "telegram" || platform === "slack") {
+      const credKey = `${platform.toUpperCase()}_TOKEN`;
+      const token = env.get(credKey);
+      if (token) {
+        consumedEnv.add(credKey);
+        channels.credentials[platform === "slack" ? "slack-bot" : platform] = {
+          value: token,
+          source: `.env ${credKey}`
+        };
+      }
+      if (isRecord(platformConfig.channels)) {
+        for (const [channelId, channelPolicy] of Object.entries(platformConfig.channels)) {
+          if (isRecord(channelPolicy)) {
+            const engagement = typeof channelPolicy.engagement === "string" ? channelPolicy.engagement : "open";
+            channels.channels[`${platform}:${channelId}`] = {
+              engagement
+            };
+          }
+        }
+      }
+      const allowlistKey = `${platform.toUpperCase()}_ALLOWED_USERS`;
+      const allowlist = env.get(allowlistKey);
+      if (allowlist) {
+        consumedEnv.add(allowlistKey);
+        for (const user of stringList(allowlist)) {
+          channels.allowlist.add(`${platform}:${user}`);
+        }
+      }
+    }
+  }
+  consumedConfig.add("channels");
+}
+function buildOpenClawMonitor(name, spec) {
+  const schedule = typeof spec.schedule === "string" ? spec.schedule : undefined;
+  const enabled = typeof spec.enabled === "boolean" ? spec.enabled : true;
+  const instruction = typeof spec.instruction === "string" ? spec.instruction : "";
+  const target = typeof spec.target === "string" ? spec.target : undefined;
+  if (!schedule || instruction.length === 0) {
+    return "Missing schedule or instruction";
+  }
+  if (instruction.length > MONITOR_INSTRUCTION_MAX) {
+    return `Instruction exceeds ${MONITOR_INSTRUCTION_MAX} characters`;
+  }
+  const cronExpr = schedule.includes("/") ? schedule : intervalCron(parseInt(schedule, 10));
+  if (!cronExpr) {
+    return "Invalid schedule";
+  }
+  let deliveryTarget;
+  if (target) {
+    const [platform, ...rest] = target.split(":");
+    const rawTarget = rest.join(":");
+    const origin = deliveryOrigin(platform, rawTarget);
+    if (typeof origin === "object") {
+      deliveryTarget = origin;
+    }
+  }
+  const taken = new Set;
+  return cronMonitor({
+    source: "openclaw",
+    name: slug(name),
+    instruction,
+    schedule: cronExpr,
+    enabled,
+    target: deliveryTarget,
+    taken
+  });
+}
+async function readOpenClawSkills(tree, skillsConfig, extract) {
+  const skillsDir = join3(tree.root, "skills");
+  const hasSkillsDir = await isDirectory(skillsDir);
+  for (const [skillName] of Object.entries(skillsConfig)) {
+    if (!hasSkillsDir)
+      continue;
+    const skillPath = join3(skillsDir, `${skillName}.md`);
+    const skillContent = await tree.text(skillPath);
+    if (skillContent) {
+      extract.files.push({
+        category: "skills",
+        sources: [skillPath],
+        target: join3(".gjc", "skills", `${slug(skillName)}.md`),
+        content: skillContent
+      });
+    }
+  }
+}
+async function readOpenClawMemory(tree, _memoryConfig, extract) {
+  const memoryDir = join3(tree.root, "memory");
+  const hasMemoryDir = await isDirectory(memoryDir);
+  if (!hasMemoryDir) {
+    return;
+  }
+  const files = await walkFiles(memoryDir);
+  for (const file of files) {
+    if (file.endsWith(".md")) {
+      const fullPath = join3(memoryDir, file);
+      const content = await tree.text(fullPath);
+      if (content) {
+        extract.files.push({
+          category: "memory",
+          sources: [fullPath],
+          target: join3("memory", "imported.md"),
+          content
+        });
+      }
+    }
+  }
+}
+
+// src/migrate.ts
+async function migrate(options) {
+  const sourceRoot = expandHome(options.source ?? ".");
+  const targetHome = expandHome(options.target ?? `${process.env.HOME ?? "~"}/.gajaeway`);
+  let sourceType;
+  if (await detectHermes(sourceRoot)) {
+    sourceType = "hermes";
+  } else if (await detectOpenClaw(sourceRoot)) {
+    sourceType = "openclaw";
+  } else {
+    throw new Error(`No Hermes or OpenClaw configuration detected at ${sourceRoot}. Expected .hermes.config.json or config.json`);
+  }
+  console.log(`Detected ${sourceType} configuration at ${sourceRoot}`);
+  const tree = new SourceTree(sourceRoot);
+  let extract;
+  if (sourceType === "hermes") {
+    extract = await readHermes(tree, targetHome);
+  } else {
+    extract = await readOpenClaw(tree, targetHome);
+  }
+  for (const warning of extract.warnings) {
+    console.warn(`Warning: ${warning}`);
+  }
+  if (extract.unmapped.length > 0) {
+    console.log(`
+Unmapped entries (these will not be migrated):`);
+    const byCategory = new Map;
+    for (const entry of extract.unmapped) {
+      if (!byCategory.has(entry.category)) {
+        byCategory.set(entry.category, []);
+      }
+      const cat = byCategory.get(entry.category);
+      if (cat) {
+        cat.push(entry);
+      }
+    }
+    for (const [category, entries2] of byCategory) {
+      console.log(`  ${category}:`);
+      for (const entry of entries2) {
+        console.log(`    - ${entry.source}: ${entry.reason}`);
+      }
+    }
+  }
+  if (extract.inventory.persona.length > 0 || extract.inventory.schedules.length > 0) {
+    console.log(`
+Migration summary:`);
+    console.log(`  Personas: ${extract.inventory.persona.length}`);
+    console.log(`  Schedules: ${extract.inventory.schedules.length}`);
+    console.log(`  Memory entries: ${extract.inventory.memory.length}`);
+    console.log(`  Skills: ${extract.inventory.skills.length}`);
+    console.log(`  Channels: ${extract.inventory.channels.length}`);
+  }
+  if (options.dryRun) {
+    console.log(`
+[DRY RUN] Output would be written to:`);
+    for (const file of extract.files) {
+      console.log(`  ${file.target} (${file.category})`);
+    }
+    return;
+  }
+  await mkdir(targetHome, { recursive: true });
+  const channels = emptyChannelPlan();
+  emitChannels(extract, channels, targetHome, sourceType);
+  emitMonitors(extract);
+  emitImportedAxis(extract);
+  for (const file of extract.files) {
+    const filePath = join4(targetHome, file.target);
+    await mkdir(join4(filePath, ".."), { recursive: true });
+    await writeFile(filePath, file.content);
+  }
+  for (const merge of extract.merges) {
+    const filePath = join4(targetHome, merge.target);
+    await mkdir(join4(filePath, ".."), { recursive: true });
+    let existing;
+    try {
+      const text = await readFile2(filePath, "utf-8");
+      existing = JSON.parse(text);
+    } catch {}
+    const merged = merge.merge(existing);
+    await writeFile(filePath, JSON.stringify(merged, null, 2));
+  }
+  console.log(`
+Migration complete. Output written to ${targetHome}`);
+}
+function parseMigrateArgs(args) {
+  const options = {};
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--source" && args[i + 1]) {
+      options.source = args[++i];
+    } else if (arg === "--target" && args[i + 1]) {
+      options.target = args[++i];
+    } else if (arg === "--dry-run") {
+      options.dryRun = true;
+    } else if (arg.startsWith("--")) {
+      throw new Error(`Unknown option: ${arg}`);
+    } else if (!options.source) {
+      options.source = arg;
+    } else {
+      throw new Error(`Unexpected argument: ${arg}`);
+    }
+  }
+  return options;
+}
+
 // src/restart-stack.ts
 import { randomUUID } from "crypto";
-import { access, mkdir as mkdir2, readFile as readFile2, rename, stat, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { access, mkdir as mkdir3, readFile as readFile4, rename, stat, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
 
 // src/services.ts
-import { chmod, mkdir, readFile, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
+import { chmod, mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
 import { parseRuntimeConfig, RuntimeConfigError } from "@gajae-gateway/protocol";
 var CONFIG_SCHEMA_VERSION = 1;
 var FALLBACK_PATH_DIRS = ["/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"];
@@ -170,18 +1187,18 @@ function serviceSpecs() {
   return SERVICE_SPECS;
 }
 function homeForEnvironment(env) {
-  return env.GAJAEWAY_HOME || join(env.HOME || homedir(), ".gajaeway");
+  return env.GAJAEWAY_HOME || join5(env.HOME || homedir2(), ".gajaeway");
 }
-function expandHome(value, home) {
-  return value.startsWith("~/") ? join(home, value.slice(2)) : value;
+function expandHome2(value, home) {
+  return value.startsWith("~/") ? join5(home, value.slice(2)) : value;
 }
-function normalizedEntries(entries, home) {
+function normalizedEntries(entries2, home) {
   const seen = new Set;
   const result = [];
-  for (const raw of entries) {
+  for (const raw of entries2) {
     if (raw.length === 0)
       continue;
-    const entry = expandHome(raw, home);
+    const entry = expandHome2(raw, home);
     if (seen.has(entry))
       continue;
     seen.add(entry);
@@ -191,10 +1208,10 @@ function normalizedEntries(entries, home) {
 }
 function mergePathEntries(binDir, userHome, loginPath) {
   return normalizedEntries([
-    expandHome(binDir, userHome),
-    join(userHome, "bin"),
-    join(userHome, ".local", "bin"),
-    join(userHome, ".bun", "bin"),
+    expandHome2(binDir, userHome),
+    join5(userHome, "bin"),
+    join5(userHome, ".local", "bin"),
+    join5(userHome, ".bun", "bin"),
     ...loginPath.replace(/(?:\r\n|\n)+$/, "").split(":"),
     ...FALLBACK_PATH_DIRS
   ], userHome);
@@ -237,7 +1254,7 @@ function plistString(value) {
   return `<string>${escapeXml(value)}</string>`;
 }
 function renderLaunchAgent(spec, binDir, home, path) {
-  const program = join(binDir, spec.binary);
+  const program = join5(binDir, spec.binary);
   const argumentsXml = [program, ...spec.args].map(plistString).join("");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -251,8 +1268,8 @@ function renderLaunchAgent(spec, binDir, home, path) {
   </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key>${plistString(join(home, `${spec.id}.stdout.log`))}
-  <key>StandardErrorPath</key>${plistString(join(home, `${spec.id}.stderr.log`))}
+  <key>StandardOutPath</key>${plistString(join5(home, `${spec.id}.stdout.log`))}
+  <key>StandardErrorPath</key>${plistString(join5(home, `${spec.id}.stderr.log`))}
 </dict></plist>
 `;
 }
@@ -263,7 +1280,7 @@ function systemdUnitName(spec) {
   return `gajaeway-${spec.id}.service`;
 }
 function renderSystemdUnit(spec, binDir, home, path) {
-  const execStart = [join(binDir, spec.binary), ...spec.args].join(" ");
+  const execStart = [join5(binDir, spec.binary), ...spec.args].join(" ");
   const unit = [
     "[Unit]",
     `Description=gajaeway ${spec.id}`,
@@ -276,7 +1293,7 @@ function renderSystemdUnit(spec, binDir, home, path) {
     unitEnvironment("PATH", path),
     "Restart=always",
     "RestartSec=2",
-    ...spec.dependsOnGateway ? [] : ["KillMode=process", "TimeoutStopSec=30s"],
+    ...spec.dependsOnGateway ? [] : ["KillMode=mixed", "TimeoutStopSec=30s"],
     "",
     "[Install]",
     `WantedBy=${spec.dependsOnGateway ? GATEWAY_UNIT : "default.target"}`,
@@ -286,14 +1303,14 @@ function renderSystemdUnit(spec, binDir, home, path) {
 `);
 }
 function systemdUnitDir(env, userHome) {
-  const base = env.XDG_CONFIG_HOME || join(userHome, ".config");
-  return join(base, "systemd", "user");
+  const base = env.XDG_CONFIG_HOME || join5(userHome, ".config");
+  return join5(base, "systemd", "user");
 }
 function launchAgentPlistPath(spec, launchAgentsDir) {
-  return join(launchAgentsDir, `dev.gajaeway.${spec.id}.plist`);
+  return join5(launchAgentsDir, `dev.gajaeway.${spec.id}.plist`);
 }
 function systemdUnitPath(spec, unitDir) {
-  return join(unitDir, systemdUnitName(spec));
+  return join5(unitDir, systemdUnitName(spec));
 }
 function restartStackCommands(platform, uid) {
   if (platform === "linux")
@@ -321,10 +1338,10 @@ function currentPlatform() {
   throw new Error(`unsupported service platform: ${process.platform}`);
 }
 async function readRuntime(home) {
-  const configPath = join(home, "config.json");
+  const configPath = join5(home, "config.json");
   let raw;
   try {
-    raw = await readFile(configPath, "utf8");
+    raw = await readFile3(configPath, "utf8");
   } catch (error) {
     throw new Error(`could not read ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -351,10 +1368,10 @@ async function installServices(options) {
     throw new Error("services requires a non-empty --bin-dir DIR");
   const env = options.env ?? process.env;
   const platform = options.platform === undefined ? currentPlatform() : requirePlatform(options.platform);
-  const userHome = env.HOME || homedir();
+  const userHome = env.HOME || homedir2();
   const home = homeForEnvironment(env);
-  const binDir = expandHome(options.binDir, userHome);
-  const targetDir = platform === "darwin" ? expandHome(options.launchAgentsDir ?? join(userHome, "Library", "LaunchAgents"), userHome) : expandHome(options.unitDir ?? systemdUnitDir(env, userHome), userHome);
+  const binDir = expandHome2(options.binDir, userHome);
+  const targetDir = platform === "darwin" ? expandHome2(options.launchAgentsDir ?? join5(userHome, "Library", "LaunchAgents"), userHome) : expandHome2(options.unitDir ?? systemdUnitDir(env, userHome), userHome);
   const runtime = await readRuntime(home);
   const path = await resolvePath({
     binDir,
@@ -363,17 +1380,17 @@ async function installServices(options) {
     env,
     loginPathRunner: options.loginPathRunner
   });
-  await mkdir(targetDir, { recursive: true, mode: 448 });
+  await mkdir2(targetDir, { recursive: true, mode: 448 });
   const definitions = SERVICE_SPECS.map((spec) => platform === "darwin" ? {
-    path: join(targetDir, `dev.gajaeway.${spec.id}.plist`),
+    path: join5(targetDir, `dev.gajaeway.${spec.id}.plist`),
     contents: renderLaunchAgent(spec, binDir, home, path)
-  } : { path: join(targetDir, systemdUnitName(spec)), contents: renderSystemdUnit(spec, binDir, home, path) });
+  } : { path: join5(targetDir, systemdUnitName(spec)), contents: renderSystemdUnit(spec, binDir, home, path) });
   const write = options.writeFile;
   for (const definition of definitions) {
     if (write)
       await write(definition.path, definition.contents);
     else {
-      await writeFile(definition.path, definition.contents, { encoding: "utf8", mode: 384 });
+      await writeFile2(definition.path, definition.contents, { encoding: "utf8", mode: 384 });
       await chmod(definition.path, 384);
     }
   }
@@ -388,12 +1405,12 @@ var RECEIPT_FILE = "restart-stack.json";
 var VERIFY_TIMEOUT_MS = 90000;
 var POLL_MS = 1000;
 function restartReceiptPath(home) {
-  return join2(home, RECEIPT_FILE);
+  return join6(home, RECEIPT_FILE);
 }
 async function readRestartReceipt(home) {
   let raw;
   try {
-    raw = await readFile2(restartReceiptPath(home), "utf8");
+    raw = await readFile4(restartReceiptPath(home), "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -402,10 +1419,10 @@ async function readRestartReceipt(home) {
   return JSON.parse(raw);
 }
 async function writeReceipt(home, receipt) {
-  await mkdir2(home, { recursive: true });
+  await mkdir3(home, { recursive: true });
   const path = restartReceiptPath(home);
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile2(temporary, `${JSON.stringify(receipt, null, 2)}
+  await writeFile3(temporary, `${JSON.stringify(receipt, null, 2)}
 `, { mode: 384 });
   await rename(temporary, path);
 }
@@ -475,8 +1492,8 @@ function defaultIsServiceInstalled(options) {
     if (spec === undefined)
       return false;
     if (options.platform === "darwin") {
-      const userHome2 = options.env.HOME || homedir2();
-      const agentsDir = options.launchAgentsDir || join2(userHome2, "Library", "LaunchAgents");
+      const userHome2 = options.env.HOME || homedir3();
+      const agentsDir = options.launchAgentsDir || join6(userHome2, "Library", "LaunchAgents");
       const plistPath = launchAgentPlistPath(spec, agentsDir);
       try {
         await access(plistPath);
@@ -485,7 +1502,7 @@ function defaultIsServiceInstalled(options) {
         return false;
       }
     }
-    const userHome = options.env.HOME || homedir2();
+    const userHome = options.env.HOME || homedir3();
     const unitDirPath = options.unitDir || systemdUnitDir(options.env, userHome);
     const unitPath = systemdUnitPath(spec, unitDirPath);
     try {
@@ -496,9 +1513,10 @@ function defaultIsServiceInstalled(options) {
     }
   };
 }
-function floorSecond(ms) {
-  return Math.floor(ms / 1000) * 1000;
+function psStartBound(ms) {
+  return Math.floor(ms / 1000) * 1000 - PS_START_SKEW_MS;
 }
+var PS_START_SKEW_MS = 1000;
 async function runRestartStack(options) {
   const platform = options.platform ?? currentPlatform();
   const runner = options.runner ?? defaultCommandRunner;
@@ -569,7 +1587,7 @@ async function runRestartStack(options) {
         step.processStartedAt = new Date(running.startedAt).toISOString();
         step.binary = running.binary;
         step.binaryModifiedAt = new Date(binaryModifiedAt).toISOString();
-        if (running.startedAt >= floorSecond(Math.max(binaryModifiedAt, since))) {
+        if (running.startedAt >= psStartBound(Math.max(binaryModifiedAt, since))) {
           step.result = "ok";
           delete step.detail;
           return;
@@ -657,6 +1675,956 @@ function renderRestartReceipt(receipt) {
   return lines;
 }
 
+// src/setup.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { chmod as chmod2, mkdir as mkdir4, readFile as readFile5, rename as rename2, rm, writeFile as writeFile4 } from "fs/promises";
+import { join as join7 } from "path";
+var SETUP_PLATFORMS = ["discord", "slack", "telegram"];
+var SETUP_ENV = {
+  discordToken: "GAJAEWAY_DISCORD_TOKEN",
+  discordAppId: "GAJAEWAY_DISCORD_APP_ID",
+  slackBotToken: "GAJAEWAY_SLACK_BOT_TOKEN",
+  slackAppToken: "GAJAEWAY_SLACK_APP_TOKEN",
+  telegramToken: "GAJAEWAY_TELEGRAM_TOKEN",
+  ownerIds: "GAJAEWAY_OWNER_IDS"
+};
+var SETUP_USAGE = "usage: gajaeway setup [--from-env] [--adapters discord,slack,telegram] [--owner ID[,ID...]] [--discord-app-id ID] | setup --status";
+var SECRET_FILES2 = {
+  discord: "discord-token",
+  slackBot: "slack-bot-token",
+  slackApp: "slack-app-token",
+  telegram: "telegram-token"
+};
+
+class SetupError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SetupError";
+  }
+}
+var REDACTED = "[redacted]";
+function redact(text, secrets) {
+  let out = text;
+  for (const secret of secrets)
+    if (secret.length >= 8)
+      out = out.split(secret).join(REDACTED);
+  return out;
+}
+function parseSetupArgs(args) {
+  let fromEnv = false;
+  let status = false;
+  let adapters;
+  const owners = [];
+  let discordAppId;
+  for (let i = 0;i < args.length; i++) {
+    const flag = args[i];
+    if (flag === "--from-env")
+      fromEnv = true;
+    else if (flag === "--status")
+      status = true;
+    else if (flag === "--adapters" || flag === "--owner" || flag === "--discord-app-id") {
+      const value = args[++i];
+      if (value === undefined || value.trim() === "" || value.startsWith("--"))
+        throw new SetupError(`${flag} expects a value
+${SETUP_USAGE}`);
+      if (flag === "--adapters")
+        adapters = parseAdapterList(value);
+      else if (flag === "--owner")
+        owners.push(...splitList(value));
+      else
+        discordAppId = value.trim();
+    } else if (/token/i.test(flag)) {
+      throw new SetupError(`${flag.split("=")[0]}: tokens are never accepted as arguments (argv is visible to every local user); export ${SETUP_ENV.discordToken}/${SETUP_ENV.slackBotToken}/${SETUP_ENV.slackAppToken}/${SETUP_ENV.telegramToken} and pass --from-env, or run setup interactively`);
+    } else
+      throw new SetupError(`unknown option: ${flag.split("=")[0]}
+${SETUP_USAGE}`);
+  }
+  if (status && (fromEnv || adapters || owners.length > 0 || discordAppId))
+    throw new SetupError(`--status takes no other options
+${SETUP_USAGE}`);
+  return {
+    mode: status ? "status" : "setup",
+    fromEnv,
+    ...adapters ? { adapters } : {},
+    owners,
+    ...discordAppId ? { discordAppId } : {}
+  };
+}
+function splitList(value) {
+  return value.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+}
+function parseAdapterList(value) {
+  const list = splitList(value);
+  if (list.length === 0)
+    throw new SetupError("--adapters expects at least one of discord, slack, telegram");
+  for (const name of list)
+    if (!SETUP_PLATFORMS.includes(name))
+      throw new SetupError(`unknown adapter: ${name} (expected discord, slack, or telegram)`);
+  return [...new Set(list)];
+}
+function nonEmpty(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function tokensFromEnv(env, adapters, discordAppId) {
+  const discord = nonEmpty(env[SETUP_ENV.discordToken]);
+  const slackBot = nonEmpty(env[SETUP_ENV.slackBotToken]);
+  const slackApp = nonEmpty(env[SETUP_ENV.slackAppToken]);
+  const telegram = nonEmpty(env[SETUP_ENV.telegramToken]);
+  const appId = discordAppId ?? nonEmpty(env[SETUP_ENV.discordAppId]);
+  const wanted = adapters ?? SETUP_PLATFORMS.filter((platform) => presentFor(platform));
+  function presentFor(platform) {
+    if (platform === "discord")
+      return discord !== undefined;
+    if (platform === "telegram")
+      return telegram !== undefined;
+    return slackBot !== undefined || slackApp !== undefined;
+  }
+  if (wanted.length === 0)
+    throw new SetupError(`--from-env found no adapter tokens; set ${SETUP_ENV.discordToken}, ${SETUP_ENV.slackBotToken} and ${SETUP_ENV.slackAppToken}, or ${SETUP_ENV.telegramToken}`);
+  const tokens = {};
+  for (const platform of wanted) {
+    if (platform === "discord") {
+      if (!discord)
+        throw new SetupError(`discord: ${SETUP_ENV.discordToken} is not set`);
+      tokens.discord = { token: discord, ...appId ? { appId } : {} };
+    } else if (platform === "slack") {
+      if (!slackBot)
+        throw new SetupError(`slack: ${SETUP_ENV.slackBotToken} is not set`);
+      if (!slackApp)
+        throw new SetupError(`slack: ${SETUP_ENV.slackAppToken} is not set (Socket Mode app-level token)`);
+      tokens.slack = { botToken: slackBot, appToken: slackApp };
+    } else {
+      if (!telegram)
+        throw new SetupError(`telegram: ${SETUP_ENV.telegramToken} is not set`);
+      tokens.telegram = { token: telegram };
+    }
+  }
+  return tokens;
+}
+function secretsOf(tokens) {
+  return [tokens.discord?.token, tokens.slack?.botToken, tokens.slack?.appToken, tokens.telegram?.token].filter((value) => value !== undefined);
+}
+async function requestJson(fetcher, platform, url, init, secrets) {
+  let response;
+  try {
+    response = await fetcher(url, { ...init, signal: AbortSignal.timeout(15000) });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new SetupError(`${platform}: could not reach the platform API (${redact(message, secrets)})`);
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = {};
+  }
+  return {
+    status: response.status,
+    body: typeof body === "object" && body !== null && !Array.isArray(body) ? body : {}
+  };
+}
+async function validateDiscord(credentials, fetcher) {
+  const secrets = [credentials.token];
+  const headers = { authorization: `Bot ${credentials.token}` };
+  const me = await requestJson(fetcher, "discord", "https://discord.com/api/v10/users/@me", { headers }, secrets);
+  if (me.status === 401)
+    throw new SetupError("discord: the platform rejected the bot token (HTTP 401); copy a fresh token from the Bot page");
+  if (me.status !== 200)
+    throw new SetupError(`discord: token check failed with HTTP ${me.status}`);
+  if (me.body.bot !== true)
+    throw new SetupError("discord: the token authenticates a user account, not a bot; use the Bot page token");
+  const app = await requestJson(fetcher, "discord", "https://discord.com/api/v10/applications/@me", { headers }, secrets);
+  if (app.status !== 200)
+    throw new SetupError(`discord: application lookup failed with HTTP ${app.status}`);
+  const appId = String(app.body.id ?? "");
+  if (credentials.appId !== undefined && appId !== credentials.appId)
+    throw new SetupError(`discord: the token belongs to application ${appId}, not ${credentials.appId}`);
+  const owner = app.body.owner;
+  const hasTeam = app.body.team !== null && app.body.team !== undefined;
+  const ownerId = !hasTeam && typeof owner?.id === "string" ? owner.id : undefined;
+  return {
+    platform: "discord",
+    summary: `bot ${String(me.body.username ?? "?")} (${String(me.body.id ?? "?")}) of application ${appId}`,
+    ...ownerId ? { ownerId } : {}
+  };
+}
+async function validateSlack(credentials, fetcher) {
+  if (!credentials.botToken.startsWith("xoxb-"))
+    throw new SetupError("slack: the bot token must start with xoxb- (OAuth & Permissions > Bot User OAuth Token)");
+  if (!credentials.appToken.startsWith("xapp-"))
+    throw new SetupError("slack: the app-level token must start with xapp- (Basic Information > App-Level Tokens, scope connections:write)");
+  const secrets = [credentials.botToken, credentials.appToken];
+  const call = (method, token) => requestJson(fetcher, "slack", `https://slack.com/api/${method}`, { method: "POST", headers: { authorization: `Bearer ${token}` } }, secrets);
+  const auth = await call("auth.test", credentials.botToken);
+  if (auth.body.ok !== true)
+    throw new SetupError(`slack: the platform rejected the bot token (${slackError(auth.body, auth.status)})`);
+  if (typeof auth.body.bot_id !== "string")
+    throw new SetupError("slack: the bot token does not authenticate a bot user");
+  const socket = await call("apps.connections.open", credentials.appToken);
+  if (socket.body.ok !== true)
+    throw new SetupError(`slack: the app-level token cannot open a Socket Mode connection (${slackError(socket.body, socket.status)}); enable Socket Mode and grant connections:write`);
+  return {
+    platform: "slack",
+    summary: `bot ${String(auth.body.user ?? "?")} (${String(auth.body.user_id ?? "?")}) in workspace ${String(auth.body.team ?? "?")}`
+  };
+}
+function slackError(body, status) {
+  const code = typeof body.error === "string" && /^[a-z_]{1,64}$/.test(body.error) ? body.error : `HTTP ${status}`;
+  return code;
+}
+async function validateTelegram(credentials, fetcher) {
+  const me = await requestJson(fetcher, "telegram", `https://api.telegram.org/bot${credentials.token}/getMe`, {}, [
+    credentials.token
+  ]);
+  const result = me.body.result;
+  if (me.body.ok !== true || !result)
+    throw new SetupError(`telegram: the platform rejected the bot token (HTTP ${me.status})`);
+  return { platform: "telegram", summary: `bot @${String(result.username ?? "?")} (${String(result.id ?? "?")})` };
+}
+async function validateAll(tokens, fetcher) {
+  const secrets = secretsOf(tokens);
+  const identities = [];
+  try {
+    if (tokens.discord)
+      identities.push(await validateDiscord(tokens.discord, fetcher));
+    if (tokens.slack)
+      identities.push(await validateSlack(tokens.slack, fetcher));
+    if (tokens.telegram)
+      identities.push(await validateTelegram(tokens.telegram, fetcher));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new SetupError(redact(message, secrets));
+  }
+  return identities;
+}
+async function writePrivateFile(path, contents) {
+  const temporary = `${path}.${randomUUID2()}.tmp`;
+  try {
+    await writeFile4(temporary, contents, { flag: "wx", mode: 384 });
+    await chmod2(temporary, 384);
+    await rename2(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function readJsonObject(path) {
+  let text;
+  try {
+    text = await readFile5(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw new SetupError(`cannot read ${path}: ${error.code ?? "unreadable"}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new SetupError(`${path} is not valid JSON; fix or remove it, then run setup again`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    throw new SetupError(`${path} must contain a JSON object`);
+  return parsed;
+}
+async function applySetup(options) {
+  const { home, tokens } = options;
+  const secretsDir = join7(home, "secrets");
+  const configPath = join7(home, "config.json");
+  const adapterPath = (platform) => join7(home, `adapter-${platform}.json`);
+  const existingConfig = await readJsonObject(configPath);
+  const existingAdapters = new Map;
+  for (const platform of SETUP_PLATFORMS)
+    if (tokens[platform])
+      existingAdapters.set(platform, await readJsonObject(adapterPath(platform)));
+  await mkdir4(home, { recursive: true, mode: 448 });
+  await chmod2(home, 448);
+  await mkdir4(secretsDir, { recursive: true, mode: 448 });
+  await chmod2(secretsDir, 448);
+  const written = [];
+  const secret = async (name, value) => {
+    const path = join7(secretsDir, name);
+    await writePrivateFile(path, `${value}
+`);
+    written.push(path);
+    return path;
+  };
+  const credentials = {};
+  const adapterConfigs = [];
+  if (tokens.discord) {
+    credentials.discord = { credentialFile: await secret(SECRET_FILES2.discord, tokens.discord.token) };
+    adapterConfigs.push(["discord", { tokenFile: `secrets/${SECRET_FILES2.discord}` }]);
+  }
+  if (tokens.slack) {
+    credentials["slack-bot"] = { credentialFile: await secret(SECRET_FILES2.slackBot, tokens.slack.botToken) };
+    credentials["slack-app"] = { credentialFile: await secret(SECRET_FILES2.slackApp, tokens.slack.appToken) };
+    adapterConfigs.push([
+      "slack",
+      { botTokenFile: `secrets/${SECRET_FILES2.slackBot}`, appTokenFile: `secrets/${SECRET_FILES2.slackApp}` }
+    ]);
+  }
+  if (tokens.telegram) {
+    credentials.telegram = { credentialFile: await secret(SECRET_FILES2.telegram, tokens.telegram.token) };
+    adapterConfigs.push(["telegram", { tokenFile: `secrets/${SECRET_FILES2.telegram}` }]);
+  }
+  for (const [platform, references] of adapterConfigs) {
+    const path = adapterPath(platform);
+    await writePrivateFile(path, `${JSON.stringify({ ...existingAdapters.get(platform), ...references }, null, "\t")}
+`);
+    written.push(path);
+  }
+  const base = existingConfig ?? { schemaVersion: 1 };
+  const previousCredentials = typeof base.credentials === "object" && base.credentials !== null && !Array.isArray(base.credentials) ? base.credentials : {};
+  const previousAllowlist = Array.isArray(base.mentionAllowlist) ? base.mentionAllowlist.filter((id) => typeof id === "string") : [];
+  const owners = [...new Set([...previousAllowlist, ...options.owners])];
+  const config = {
+    ...base,
+    credentials: { ...previousCredentials, ...credentials },
+    ...owners.length > 0 ? { mentionAllowlist: owners } : {}
+  };
+  await writePrivateFile(configPath, `${JSON.stringify(config, null, "\t")}
+`);
+  written.push(configPath);
+  return { written, owners };
+}
+async function enabledAdapters(home) {
+  const enabled = [];
+  for (const platform of SETUP_PLATFORMS) {
+    if (await Bun.file(join7(home, `adapter-${platform}.json`)).exists())
+      enabled.push(platform);
+  }
+  return enabled;
+}
+async function askYes(prompter, question) {
+  for (;; ) {
+    const answer = (await prompter.ask(`${question} [y/N] `)).trim().toLowerCase();
+    if (answer === "" || answer === "n" || answer === "no")
+      return false;
+    if (answer === "y" || answer === "yes")
+      return true;
+  }
+}
+async function askRequiredSecret(prompter, question) {
+  for (;; ) {
+    const answer = (await prompter.askSecret(question)).trim();
+    if (answer)
+      return answer;
+  }
+}
+async function tokensFromPrompts(prompter, parsed) {
+  const wanted = parsed.adapters ?? [];
+  const enable = async (platform, label) => parsed.adapters ? wanted.includes(platform) : await askYes(prompter, `Enable ${label}?`);
+  const tokens = {};
+  if (await enable("discord", "Discord")) {
+    const token = await askRequiredSecret(prompter, "Discord bot token (input hidden): ");
+    const appId = parsed.discordAppId ?? (await prompter.ask("Discord application id (optional): ")).trim();
+    tokens.discord = { token, ...appId ? { appId } : {} };
+  }
+  if (await enable("slack", "Slack (Socket Mode)")) {
+    const botToken = await askRequiredSecret(prompter, "Slack bot token xoxb-\u2026 (input hidden): ");
+    const appToken = await askRequiredSecret(prompter, "Slack app-level token xapp-\u2026 (input hidden): ");
+    tokens.slack = { botToken, appToken };
+  }
+  if (await enable("telegram", "Telegram")) {
+    tokens.telegram = { token: await askRequiredSecret(prompter, "Telegram bot token (input hidden): ") };
+  }
+  if (!tokens.discord && !tokens.slack && !tokens.telegram)
+    throw new SetupError("no adapter selected; nothing to do");
+  const owners = parsed.owners.length > 0 ? [...parsed.owners] : splitList(await prompter.ask("Your platform user id(s), comma-separated, allowed to DM the bot (blank: Discord app owner only): "));
+  return { tokens, owners };
+}
+function terminalPrompter() {
+  const stdin = process.stdin;
+  if (!stdin.isTTY)
+    throw new SetupError("interactive setup needs a terminal; run it with a TTY (docker compose run -it \u2026) or use --from-env");
+  const readLine = (question, echo) => new Promise((resolve, reject) => {
+    process.stdout.write(question);
+    let line = "";
+    stdin.setRawMode(true);
+    stdin.resume();
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\x03") {
+          finish();
+          process.stdout.write(`
+`);
+          reject(new SetupError("setup cancelled"));
+          return;
+        }
+        if (char === "\r" || char === `
+`) {
+          finish();
+          process.stdout.write(`
+`);
+          resolve(line);
+          return;
+        }
+        if (char === "\x7F" || char === "\b") {
+          if (line.length > 0) {
+            line = line.slice(0, -1);
+            if (echo)
+              process.stdout.write("\b \b");
+          }
+          continue;
+        }
+        line += char;
+        if (echo)
+          process.stdout.write(char);
+      }
+    };
+    const finish = () => {
+      stdin.off("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+    stdin.on("data", onData);
+  });
+  return {
+    ask: (question) => readLine(question, true),
+    askSecret: (question) => readLine(question, false),
+    close: () => stdin.pause()
+  };
+}
+async function runSetup(args, options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const parsed = parseSetupArgs(args);
+  if (parsed.mode === "status") {
+    log((await enabledAdapters(options.home)).join(","));
+    return;
+  }
+  let tokens;
+  let owners;
+  if (parsed.fromEnv) {
+    tokens = tokensFromEnv(options.env ?? process.env, parsed.adapters, parsed.discordAppId);
+    owners = [...parsed.owners, ...splitList((options.env ?? process.env)[SETUP_ENV.ownerIds] ?? "")];
+  } else {
+    const prompter = (options.prompter ?? terminalPrompter)();
+    try {
+      ({ tokens, owners } = await tokensFromPrompts(prompter, parsed));
+    } finally {
+      prompter.close();
+    }
+  }
+  const secrets = secretsOf(tokens);
+  try {
+    const identities = await validateAll(tokens, options.fetch ?? ((input, init) => fetch(input, init)));
+    for (const identity of identities)
+      log(`${identity.platform}: token valid \u2014 ${identity.summary}`);
+    for (const identity of identities)
+      if (identity.ownerId && owners.length === 0) {
+        owners.push(identity.ownerId);
+        log(`${identity.platform}: allowing DMs from the application owner ${identity.ownerId}`);
+      }
+    const applied = await applySetup({ home: options.home, tokens, owners });
+    for (const path of applied.written)
+      log(`wrote ${path}`);
+    if (applied.owners.length === 0)
+      log("warning: no owner id configured; the gateway declines every DM until config.json mentionAllowlist names you (rerun setup with --owner ID)");
+    log(`enabled adapters: ${(await enabledAdapters(options.home)).join(",")}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new SetupError(redact(message, secrets));
+  }
+}
+
+// src/update.ts
+import {
+  chmod as chmod3,
+  copyFile,
+  mkdir as mkdir5,
+  mkdtemp,
+  open,
+  readdir as readdir2,
+  readFile as readFile6,
+  realpath,
+  rename as rename3,
+  rm as rm2,
+  stat as stat2,
+  writeFile as writeFile5
+} from "fs/promises";
+import { tmpdir } from "os";
+import { basename, dirname, join as join8 } from "path";
+// package.json
+var package_default = {
+  name: "@gajae-gateway/cli",
+  version: "0.1.5",
+  type: "module",
+  description: "Owner CLI for the gajaeway gateway: status, sessions, chat, monitors, and worker lanes over the gateway socket. Requires the Bun runtime (uses Bun.file/Bun.spawn).",
+  license: "AGPL-3.0-only",
+  author: "Yeachan Heo",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/Yeachan-Heo/gajae-way.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://github.com/Yeachan-Heo/gajae-way/tree/main/packages/cli#readme",
+  bugs: "https://github.com/Yeachan-Heo/gajae-way/issues",
+  keywords: [
+    "gajaeway",
+    "cli",
+    "gateway"
+  ],
+  files: [
+    "dist",
+    "src"
+  ],
+  main: "./dist/main.js",
+  types: "./src/main.ts",
+  exports: {
+    ".": {
+      bun: "./src/main.ts",
+      types: "./src/main.ts",
+      default: "./dist/main.js"
+    }
+  },
+  bin: {
+    gajaeway: "./dist/main.js"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "rm -rf dist && bun build src/main.ts --outdir dist --target bun --format esm --external @gajae-gateway/protocol --external @gajae-gateway/sdk && tsc -p tsconfig.build.json",
+    prepublishOnly: "bun run build"
+  },
+  dependencies: {
+    "@gajae-gateway/sdk": "workspace:*",
+    "@gajae-gateway/protocol": "workspace:*"
+  },
+  engines: {
+    bun: ">=1.4.0"
+  }
+};
+
+// src/update.ts
+var UPDATE_USAGE = "usage: gajaeway update [--check] [--force] [--bin-dir DIR] [--no-restart]";
+var DEFAULT_RELEASE_REPO = "Yeachan-Heo/gajae-way";
+var RELEASE_REPO_OVERRIDE_ENV = "GAJAEWAY_UPDATE_REPO";
+function releaseRepo(env = process.env) {
+  const override = env[RELEASE_REPO_OVERRIDE_ENV]?.trim();
+  return override ? override : declaredReleaseRepo();
+}
+function declaredReleaseRepo() {
+  const url = package_default.repository?.url;
+  const match = typeof url === "string" ? /^git\+https:\/\/github\.com\/([^/\s]+\/[^/\s]+?)\.git$/.exec(url) : undefined;
+  return match ? match[1] : DEFAULT_RELEASE_REPO;
+}
+function parseUpdateArgs(args) {
+  let check = false;
+  let force = false;
+  let noRestart = false;
+  let binDir;
+  for (let i = 0;i < args.length; i++) {
+    const flag = args[i];
+    if (flag === "--check")
+      check = true;
+    else if (flag === "--force")
+      force = true;
+    else if (flag === "--no-restart")
+      noRestart = true;
+    else if (flag === "--bin-dir") {
+      const value = args[++i];
+      if (value === undefined || value.length === 0 || value.startsWith("--"))
+        throw new Error(`${flag} expects a non-empty DIR`);
+      binDir = value;
+    } else
+      throw new Error(`${UPDATE_USAGE} (unknown option: ${flag})`);
+  }
+  return {
+    check,
+    force,
+    noRestart,
+    ...binDir === undefined ? {} : { binDir }
+  };
+}
+function releaseVersion(tag) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/.exec(tag.trim());
+  return match ? `${match[1]}.${match[2]}.${match[3]}${match[4] ?? ""}` : undefined;
+}
+function releaseAssetName(platform = process.platform, arch = process.arch) {
+  return `gajaeway-${platform}-${arch}.tar.gz`;
+}
+function selectReleaseAsset(release, name) {
+  return release.assets.find((asset) => asset.name === name);
+}
+function isNewer(current, latest) {
+  return Bun.semver.order(latest, current) > 0;
+}
+var KNOWN_BINARIES = [
+  "gajaeway",
+  "gajaeway-gateway",
+  "gajaeway-admin",
+  "gajaeway-slack",
+  "gajaeway-discord",
+  "gajaeway-telegram"
+];
+var CORE_BINARIES = ["gajaeway", "gajaeway-gateway"];
+var MIN_BINARY_BYTES = 1048576;
+var MAX_ASSET_BYTES = 512 * 1024 * 1024;
+var RELEASE_MARKER = ".gajaeway-release";
+var LOCK_FILE = ".gajaeway-update.lock";
+function releaseMarkerPath(binDir) {
+  return join8(binDir, RELEASE_MARKER);
+}
+async function readInstalledRelease(binDir) {
+  try {
+    const version = releaseVersion(await readFile6(releaseMarkerPath(binDir), "utf8"));
+    return version;
+  } catch {
+    return;
+  }
+}
+async function resolveBinDir(flag, execPath = process.execPath) {
+  if (flag !== undefined)
+    return flag;
+  const real = await realpath(execPath).catch(() => {
+    return;
+  });
+  if (real === undefined)
+    return;
+  return basename(real).startsWith("gajaeway") ? dirname(real) : undefined;
+}
+function renderUpdate(result) {
+  const lines = [];
+  if (result.upToDate) {
+    lines.push(result.checkedOnly ? `up to date: ${result.current} (latest release ${result.tag})` : `already up to date: ${result.current} (latest release ${result.tag}); use --force to reinstall`);
+    return lines;
+  }
+  if (result.checkedOnly) {
+    lines.push(`update available: ${result.current} \u2192 ${result.latest} (release ${result.tag})`);
+    return lines;
+  }
+  lines.push(`updated ${result.current} \u2192 ${result.latest} from ${result.repo} (${result.tag})`);
+  lines.push(`installed: ${result.installed.join(", ")}`);
+  if (result.backupDir !== undefined)
+    lines.push(`backup: ${result.backupDir}`);
+  if (result.restartQueued !== undefined)
+    lines.push(`restart: queued ${result.restartQueued} \u2014 check with: gajaeway ops restart-stack --status`);
+  else if (result.restartSkipped)
+    lines.push("restart: skipped (--no-restart)");
+  return lines;
+}
+async function runUpdate(options) {
+  const deps = options.deps ?? {};
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux")
+    throw new Error(`update supports darwin and linux release assets, not ${platform}`);
+  const repo = releaseRepo(deps.env ?? process.env);
+  const release = await (deps.fetchLatestRelease ?? defaultFetchLatestRelease)(repo);
+  const latest = releaseVersion(release.tag);
+  if (latest === undefined)
+    throw new Error(`latest release tag is not a version: ${release.tag}`);
+  const binDir = await resolveBinDir(options.args.binDir, deps.execPath ?? process.execPath);
+  const current = (binDir === undefined ? undefined : await readInstalledRelease(binDir)) ?? package_default.version;
+  const upToDate = !isNewer(current, latest);
+  if (upToDate && !options.args.force)
+    return { current, latest, tag: release.tag, repo, checkedOnly: options.args.check, upToDate: true, installed: [] };
+  const asset = selectReleaseAsset(release, releaseAssetName(platform, deps.arch ?? process.arch));
+  if (asset === undefined)
+    throw new Error(`release ${release.tag} has no asset ${releaseAssetName(platform, deps.arch ?? process.arch)} (assets: ${release.assets.map((candidate) => candidate.name).join(", ") || "none"})`);
+  if (options.args.check)
+    return { current, latest, tag: release.tag, repo, checkedOnly: true, upToDate: false, installed: [] };
+  if (binDir === undefined)
+    throw new Error("run the update from a compiled gajaeway binary, or pass --bin-dir DIR");
+  const unlock = await acquireUpdateLock(binDir);
+  try {
+    const staged = await stageRelease(asset, deps);
+    const installedNames = await knownBinariesIn(binDir);
+    const toInstall = binariesToInstall(staged.names, installedNames);
+    const missingCore = CORE_BINARIES.filter((name) => !toInstall.includes(name));
+    if (missingCore.length > 0)
+      throw new Error(`release tarball is missing core binaries: ${missingCore.join(", ")}`);
+    await assertStagedBinariesUsable(staged, toInstall);
+    const stamp = new Date((deps.now ?? Date.now)()).toISOString().replace(/[-:]/g, "").slice(0, 15);
+    const backupDir = join8(binDir, `backup-${current}-${stamp}Z`);
+    await mkdir5(backupDir, { recursive: false });
+    for (const name of toInstall) {
+      const target = join8(binDir, name);
+      if (await exists(target))
+        await copyFile(target, join8(backupDir, name));
+    }
+    for (const name of toInstall) {
+      const stagedPath = join8(staged.dir, name);
+      const tempPath = join8(binDir, `.update-${name}`);
+      await copyFile(stagedPath, tempPath);
+      await chmod3(tempPath, 493);
+      await rename3(tempPath, join8(binDir, name));
+    }
+    await writeFile5(releaseMarkerPath(binDir), `${latest}
+`, "utf8");
+    await rm2(staged.dir, { recursive: true, force: true });
+    if (options.args.noRestart)
+      return {
+        current,
+        latest,
+        tag: release.tag,
+        repo,
+        checkedOnly: false,
+        upToDate: false,
+        installed: toInstall,
+        backupDir,
+        restartSkipped: true
+      };
+    const receipt = await (deps.queueRestart ?? defaultQueueRestart)(options.home);
+    return {
+      current,
+      latest,
+      tag: release.tag,
+      repo,
+      checkedOnly: false,
+      upToDate: false,
+      installed: toInstall,
+      backupDir,
+      restartQueued: receipt.receiptId
+    };
+  } finally {
+    await unlock();
+  }
+}
+function binariesToInstall(stagedNames, installedNames) {
+  const installed = new Set(installedNames);
+  return KNOWN_BINARIES.filter((name) => stagedNames.includes(name) && (installed.has(name) || CORE_BINARIES.includes(name)));
+}
+async function knownBinariesIn(dir) {
+  const entries2 = await readdir2(dir).catch(() => []);
+  const names = new Set(entries2);
+  return KNOWN_BINARIES.filter((name) => names.has(name));
+}
+async function assertStagedBinariesUsable(staged, toInstall) {
+  for (const name of toInstall) {
+    const info = await stat2(join8(staged.dir, name));
+    if (!info.isFile())
+      throw new Error(`staged ${name} is not a regular file`);
+    if (info.size < MIN_BINARY_BYTES)
+      throw new Error(`staged ${name} is only ${info.size} bytes; refusing a broken extraction`);
+  }
+}
+async function exists(path) {
+  try {
+    await stat2(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function stageRelease(asset, deps) {
+  const dir = await mkdtemp(join8(tmpdir(), "gajaeway-update-"));
+  const tarball = await (deps.downloadAsset ?? defaultDownloadAsset)(asset);
+  await (deps.extractTarball ?? defaultExtractTarball)(tarball, dir);
+  const names = (await readdir2(dir)).filter((name) => KNOWN_BINARIES.includes(name));
+  return { dir, names };
+}
+async function defaultFetchLatestRelease(repo) {
+  const response = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+    headers: { Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" }
+  });
+  if (!response.ok)
+    throw new Error(`release lookup failed: HTTP ${response.status} for ${repo}/releases/latest`);
+  const body = await response.json();
+  const tag = typeof body.tag_name === "string" ? body.tag_name : undefined;
+  if (tag === undefined)
+    throw new Error(`latest release of ${repo} has no tag_name`);
+  const assets = (body.assets ?? []).flatMap((asset) => typeof asset.name === "string" && typeof asset.browser_download_url === "string" ? [{ name: asset.name, url: asset.browser_download_url }] : []);
+  return { tag, assets };
+}
+async function defaultDownloadAsset(asset) {
+  const response = await fetch(asset.url);
+  if (!response.ok)
+    throw new Error(`download failed: HTTP ${response.status} for ${asset.name}`);
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > MAX_ASSET_BYTES)
+    throw new Error(`${asset.name} is ${bytes.byteLength} bytes; refusing anything over ${MAX_ASSET_BYTES}`);
+  return bytes;
+}
+async function defaultExtractTarball(tarball, intoDir) {
+  const tarballPath = join8(intoDir, "release.tar.gz");
+  await writeFile5(tarballPath, tarball);
+  const process2 = Bun.spawn(["tar", "-xzf", tarballPath, "-C", intoDir], {
+    stdout: "ignore",
+    stderr: "pipe"
+  });
+  const exitCode = await process2.exited;
+  if (exitCode !== 0) {
+    const detail = await new Response(process2.stderr).text();
+    throw new Error(`extracting ${basename(tarballPath)} failed (tar exit ${exitCode}): ${detail.trim()}`);
+  }
+  await rm2(tarballPath, { force: true });
+}
+async function defaultQueueRestart(home) {
+  const { receipt, supervisorPid } = await launchRestartStack({ home });
+  return { receiptId: receipt.id, supervisorPid };
+}
+async function acquireUpdateLock(binDir) {
+  const lockPath = join8(binDir, LOCK_FILE);
+  for (let attempt = 0;attempt < 2; attempt++) {
+    try {
+      const handle = await open(lockPath, "wx");
+      try {
+        await handle.write(`${JSON.stringify({ pid: process.pid, at: new Date().toISOString() })}
+`);
+      } finally {
+        await handle.close();
+      }
+      return async () => {
+        await rm2(lockPath, { force: true });
+      };
+    } catch (error) {
+      if (!isFileExistsError(error))
+        throw error;
+      const holder = await readLockHolder(lockPath);
+      if (holder !== undefined && isProcessAlive(holder)) {
+        throw new Error(`another gajaeway update is running (pid ${holder}); refusing to run concurrently`);
+      }
+      await rm2(lockPath, { force: true });
+    }
+  }
+  throw new Error(`could not acquire the update lock at ${lockPath}`);
+}
+function isFileExistsError(error) {
+  return error !== null && typeof error === "object" && error.code === "EEXIST";
+}
+async function readLockHolder(lockPath) {
+  try {
+    const parsed = JSON.parse(await readFile6(lockPath, "utf8"));
+    return typeof parsed.pid === "number" ? parsed.pid : undefined;
+  } catch {
+    return;
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// src/upgrade.ts
+import { readFile as readFile7 } from "fs/promises";
+import { join as join9 } from "path";
+async function readGatewayPinnedGjcVersion(home) {
+  try {
+    const packageJsonPath = join9(home, "..", "..", "packages", "gateway", "package.json");
+    const content = await readFile7(packageJsonPath, "utf-8");
+    const pkg = JSON.parse(content);
+    const version = pkg.gjc?.version;
+    if (!version || typeof version !== "string") {
+      throw new Error("gjc.version not found in gateway package.json");
+    }
+    return version;
+  } catch (error) {
+    throw new Error(`Failed to read pinned GJC version: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function checkLatestCiStatus(repo) {
+  try {
+    const branchProc = Bun.spawnSync(["git", "rev-parse", "--abbrev-ref", "HEAD"], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    if (branchProc.exitCode !== 0) {
+      throw new Error("Could not determine current git branch");
+    }
+    const branch = branchProc.stdout?.toString().trim();
+    if (!branch) {
+      throw new Error("Empty branch name");
+    }
+    const runProc = Bun.spawnSync(["gh", "run", "list", "-R", repo, "--branch", branch, "--limit", "1", "--json", "conclusion,status"], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    if (runProc.exitCode !== 0) {
+      throw new Error(`gh run list failed: ${runProc.stderr?.toString()}`);
+    }
+    const output = runProc.stdout?.toString() || "[]";
+    const runs = JSON.parse(output);
+    if (!Array.isArray(runs) || runs.length === 0) {
+      throw new Error("No CI runs found for this branch");
+    }
+    const latestRun = runs[0];
+    if (!latestRun.conclusion || !latestRun.status) {
+      throw new Error(`Latest CI run status is incomplete: ${JSON.stringify(latestRun)}`);
+    }
+    if (latestRun.status === "in_progress") {
+      throw new Error("CI is currently running; wait for completion");
+    }
+    return latestRun.conclusion === "success";
+  } catch (error) {
+    throw new Error(`Failed to check CI status: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function performUpgrade(options) {
+  const readVersion = options.readPinnedVersion || readGatewayPinnedGjcVersion;
+  const targetVersion = options.gjcVersion ?? await readVersion(options.home);
+  try {
+    const checkCi = options.checkCiStatus || checkLatestCiStatus;
+    let ciPassed = false;
+    try {
+      ciPassed = await checkCi("Yeachan-Heo/gajae-way");
+    } catch (ciError) {
+      const ciDetail = ciError instanceof Error ? ciError.message : String(ciError);
+      return { status: "failed", detail: `CI status check failed: ${ciDetail}` };
+    }
+    if (!ciPassed) {
+      return {
+        status: "failed",
+        detail: `Cannot upgrade: latest CI run did not pass. Fix failures and try again.`
+      };
+    }
+    const gjcProc = Bun.spawnSync(["gjc", "--version"], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    if (gjcProc.exitCode !== 0) {
+      return { status: "failed", detail: "Failed to get current gjc version" };
+    }
+    const currentVersionMatch = ((gjcProc.stdout?.toString() || "") + (gjcProc.stderr?.toString() || "")).match(/(?:gjc\/)?(\d+)\.(\d+)\.(\d+)/);
+    if (!currentVersionMatch) {
+      return { status: "failed", detail: "Could not parse current gjc version" };
+    }
+    const currentVersion = currentVersionMatch.slice(1, 4).join(".");
+    if (currentVersion === targetVersion) {
+      return { status: "ok", detail: `Already running gjc ${targetVersion}` };
+    }
+    const installProc = Bun.spawnSync(["bun", "add", "-g", `gajae-code@${targetVersion}`], {
+      stdout: "pipe",
+      stderr: "pipe",
+      cwd: join9(options.home, "workspace")
+    });
+    if (installProc.exitCode !== 0) {
+      return {
+        status: "failed",
+        detail: `Failed to install gjc ${targetVersion}: ${installProc.stderr?.toString()}`
+      };
+    }
+    const verifyProc = Bun.spawnSync(["gjc", "--version"], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    if (verifyProc.exitCode !== 0) {
+      return { status: "failed", detail: "Failed to verify gjc installation" };
+    }
+    const verifiedVersionMatch = ((verifyProc.stdout?.toString() || "") + (verifyProc.stderr?.toString() || "")).match(/(?:gjc\/)?(\d+)\.(\d+)\.(\d+)/);
+    if (!verifiedVersionMatch) {
+      return { status: "failed", detail: "Could not verify installed gjc version" };
+    }
+    const verifiedVersion = verifiedVersionMatch.slice(1, 4).join(".");
+    if (verifiedVersion !== targetVersion) {
+      return {
+        status: "failed",
+        detail: `Verification failed: expected ${targetVersion}, got ${verifiedVersion}`
+      };
+    }
+    return { status: "ok", detail: `Successfully upgraded gjc from ${currentVersion} to ${targetVersion}` };
+  } catch (error) {
+    return {
+      status: "failed",
+      detail: `Upgrade failed: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
 // src/main.ts
 function socketPath(home = process.env.GAJAEWAY_HOME) {
   return `${home ?? `${process.env.HOME ?? "~"}/.gajaeway`}/gateway.sock`;
@@ -671,9 +2639,12 @@ var COMMANDS = [
   "memory",
   "monitors",
   "work",
-  "services"
+  "services",
+  "migrate",
+  "update",
+  "setup"
 ];
-var CLI_USAGE = "usage: gajaeway [--socket PATH] status|shutdown|chat|daemon run|sessions list [--json] [--fields a,b,c] [--limit N] [--offset N]|sessions inspect <originKey-or-index>|memory audit|memory search <query>|monitors ... (test <id> [--type T] [--payload J] [--wait[=SECONDS]])|work run|start <name> [--cwd DIR] [--resume] [--model ID|--preset NAME] <text>|work status <name>|work steer <name> <text>|work retire <name>|work jobs|ops backup <path>|ops redeliver <deliveryId>|ops redeliver --since <iso>|ops cycle [--json]|ops integrity|ops restore <backupPath>|ops restart-stack [--status]|services install|repair --bin-dir DIR [--launch-agents-dir DIR] [--unit-dir DIR] [--platform darwin|linux] (work run waits for a response; caller timeout does not end the attempt)";
+var CLI_USAGE = "usage: gajaeway [--socket PATH] status|shutdown|chat|daemon run|sessions list [--json] [--fields a,b,c] [--limit N] [--offset N]|sessions inspect <originKey-or-index>|memory audit|memory search <query>|monitors ... (test <id> [--type T] [--payload J] [--wait[=SECONDS]])|work run|start <name> [--cwd DIR] [--resume] [--model ID|--preset NAME] [--notify originKey (start only)] <text>|work status <name>|work steer <name> <text>|work retire [--force] <name>|work retire --all-dead|work jobs|ops backup <path>|ops redeliver <deliveryId>|ops redeliver --since <iso>|ops cycle [--json]|ops integrity|ops restore <backupPath>|ops restart-stack [--status]|services install|repair --bin-dir DIR [--launch-agents-dir DIR] [--unit-dir DIR] [--platform darwin|linux]|migrate [--source PATH] [--target PATH] [--dry-run]|update [--check] [--force] [--bin-dir DIR] [--no-restart]|setup [--from-env] [--adapters discord,slack,telegram] [--owner ID] [--discord-app-id ID]|setup --status (work run waits for a response; caller timeout does not end the attempt); cron timezone is an IANA zone and defaults to the gateway host's local timezone";
 var USAGE_EXIT_CODE = 2;
 function usageFor(command) {
   return command !== undefined && COMMANDS.includes(command) ? undefined : CLI_USAGE;
@@ -922,18 +2893,18 @@ function verifyBackupIntegrity(backupPath) {
     throw new Error(`Backup failed SQLite integrity_check: ${backupPath} (${detail})`);
 }
 async function restoreTargetPath(home = gatewayHome()) {
-  const configPath = join3(home, "config.json");
+  const configPath = join10(home, "config.json");
   let raw;
   try {
-    raw = await readFile3(configPath, "utf8");
+    raw = await readFile8(configPath, "utf8");
   } catch (error) {
     const code = error.code;
-    const entryExists = await lstat(configPath).then(() => true, () => false);
+    const entryExists = await lstat2(configPath).then(() => true, () => false);
     if (code !== "ENOENT" || entryExists)
       throw new Error(`Cannot read ${configPath}; refusing restore.`);
   }
   if (raw === undefined)
-    return join3(home, "gateway.db");
+    return join10(home, "gateway.db");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -944,7 +2915,7 @@ async function restoreTargetPath(home = gatewayHome()) {
     throw new Error(`Invalid configuration ${configPath}: config must be an object; refusing restore.`);
   const dbPath = parsed.dbPath;
   if (dbPath === undefined)
-    return join3(home, "gateway.db");
+    return join10(home, "gateway.db");
   if (typeof dbPath !== "string" || dbPath.length === 0)
     throw new Error(`Invalid configuration ${configPath}: dbPath must be a non-empty string; refusing restore.`);
   return dbPath;
@@ -953,7 +2924,7 @@ async function restoreDatabase(socket, backupPath) {
   if (!isAbsolute(backupPath))
     throw new Error("ops restore requires an absolute backup path");
   try {
-    await stat2(socket);
+    await stat3(socket);
     throw new Error(`Refusing restore: gateway socket ${socket} exists. Stop the daemon before restoring.`);
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("Refusing restore:"))
@@ -964,8 +2935,8 @@ async function restoreDatabase(socket, backupPath) {
   verifyBackupIntegrity(backupPath);
   const databasePath = await restoreTargetPath();
   const preservedPath = `${databasePath}.pre-restore-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-  await copyFile(databasePath, preservedPath);
-  await copyFile(backupPath, databasePath);
+  await copyFile2(databasePath, preservedPath);
+  await copyFile2(backupPath, databasePath);
   console.log(`Validated SQLite backup: ${backupPath}`);
   console.log(`Copied current database to: ${preservedPath}`);
   console.log(`Restored backup to: ${databasePath}`);
@@ -1102,7 +3073,26 @@ async function main(args = process.argv.slice(2), options = {}) {
         break;
       }
       case "ops": {
-        const [command, path] = parsed.rest;
+        const [command, path, ...extraArgs] = parsed.rest;
+        if (command === "upgrade") {
+          const home = gatewayHome();
+          let gjcVersion;
+          if (path === "--gjc" && extraArgs[0]) {
+            gjcVersion = extraArgs[0];
+          } else if (path && path !== "--gjc") {
+            throw new Error("usage: gajaeway ops upgrade [--gjc X.Y.Z]");
+          }
+          const result = await performUpgrade({ home, gjcVersion });
+          console.log(result.detail);
+          if (result.status !== "ok") {
+            process.exitCode = 1;
+            break;
+          }
+          const { receipt, supervisorPid } = await launchRestartStack({ home });
+          console.log(`restart-stack ${receipt.id}: queued (supervisor pid ${supervisorPid})`);
+          console.log("read the outcome with: gajaeway ops restart-stack --status");
+          break;
+        }
         if (command === "restore" && path) {
           await restoreDatabase(parsed.socket, path);
           break;
@@ -1165,7 +3155,7 @@ async function main(args = process.argv.slice(2), options = {}) {
                 console.log(line);
             process.exitCode = cycleExitCode(cycle);
           } else
-            throw new Error("usage: gajaeway ops backup <path>|redeliver <deliveryId>|redeliver --since <iso>|cycle [--json]|integrity|restore <backupPath>|restart-stack [--status]");
+            throw new Error("usage: gajaeway ops backup <path>|redeliver <deliveryId>|redeliver --since <iso>|cycle [--json]|integrity|restore <backupPath>|upgrade [--gjc X.Y.Z]|restart-stack [--status]");
         } finally {
           await client.close();
         }
@@ -1207,9 +3197,14 @@ async function main(args = process.argv.slice(2), options = {}) {
           else if (command === "list") {
             const options2 = listOptions;
             const result = await client.request("monitor.list");
-            for (const line of renderList(MONITOR_COLUMNS, result.monitors, options2, {
+            const rows = result.monitors.map((monitor) => ({
+              monitor,
+              schedule: result.schedules[monitor.monitorId] ?? null
+            }));
+            for (const line of renderList(MONITOR_COLUMNS, rows, options2, {
               key: "monitors",
-              result
+              result,
+              serializeRow: (row) => row.monitor
             }))
               console.log(line);
           } else if (command === "inspect" && args2[0])
@@ -1259,20 +3254,55 @@ async function main(args = process.argv.slice(2), options = {}) {
           break;
         }
         if (command === "retire" || command === "jobs") {
-          if (command === "retire" ? args2.length !== 1 || !args2[0] || args2[0].startsWith("--") : args2.length !== 0)
+          let force = false;
+          let allDead = false;
+          let name2;
+          if (command === "retire") {
+            for (let i = 0;i < args2.length; i++) {
+              const arg = args2[i];
+              if (arg === "--force") {
+                if (force)
+                  throw new Error(usage2);
+                force = true;
+              } else if (arg === "--all-dead") {
+                if (allDead)
+                  throw new Error(usage2);
+                allDead = true;
+              } else if (!arg.startsWith("--")) {
+                if (name2)
+                  throw new Error(usage2);
+                name2 = arg;
+              } else
+                throw new Error(usage2);
+            }
+            if (!allDead && !name2)
+              throw new Error(usage2);
+            if (allDead && name2)
+              throw new Error(usage2);
+          } else if (args2.length !== 0) {
             throw new Error(usage2);
+          }
           const client2 = await GajaewayClient.connectSocket(parsed.socket);
           try {
             if (command === "retire") {
-              const result = await client2.request("work.retire", { name: args2[0] });
-              console.log(result.retired ? `retired: ${result.sessionKey} session=${result.sessionId} closed=${result.closed}` : `not retired: ${result.reason}`);
+              const result = await client2.request("work.retire", {
+                ...name2 !== undefined ? { name: name2 } : {},
+                ...force ? { force } : {},
+                ...allDead ? { allDead } : {}
+              });
+              if (allDead) {
+                console.log(`Retired all dead lanes`);
+              } else {
+                const forced = result.retired && result.forced ? " (forced)" : "";
+                console.log(result.retired ? `retired: ${result.sessionKey} session=${result.sessionId} closed=${result.closed}${forced}` : `not retired: ${result.reason}`);
+              }
             } else {
               const result = await client2.request("work.jobs");
               for (const job of result.jobs) {
-                const name2 = job.lane_key.startsWith("work-") ? job.lane_key.slice("work-".length) : job.lane_key;
+                const name3 = job.lane_key.startsWith("work-") ? job.lane_key.slice("work-".length) : job.lane_key;
                 const state = job.quarantined ? `HELD: quarantined reason=${job.reason} historical_state=${job.state}` : job.state;
                 const head = job.last_commit ? `${job.last_commit.sha.slice(0, 7)}@${job.last_commit.committed_at} ${JSON.stringify(job.last_commit.subject)}` : "-";
-                console.log(`${name2} ${state} session=${job.session_id || "-"} accepted=${job.accepted_at || "-"} op=${job.attempt?.op_ref || "-"} last=${job.last_activity_at || "-"} head=${head} ${job.worktree_path}${job.reports && (job.reports.pending !== 0 || job.reports.claimed !== 0 || job.reports.held !== 0 || job.reports.undeliverable !== 0) ? ` reports=p:${job.reports.pending} c:${job.reports.claimed} h:${job.reports.held} u:${job.reports.undeliverable}` : ""}`);
+                console.log(`${name3} ${state} session=${job.session_id || "-"} accepted=${job.accepted_at || "-"} op=${job.attempt?.op_ref || "-"} last=${job.last_activity_at || "-"} head=${head} ${job.worktree_path}${job.reports && (job.reports.pending !== 0 || job.reports.claimed !== 0 || job.reports.held !== 0 || job.reports.undeliverable !== 0) ? ` reports=p:${job.reports.pending} c:${job.reports.claimed} h:${job.reports.held} u:${job.reports.undeliverable}` : ""}`);
               }
             }
           } finally {
@@ -1364,6 +3394,24 @@ job: ${result.jobId} state: ${result.state}`);
           console.log(definition);
         break;
       }
+      case "migrate":
+        await migrate(parseMigrateArgs(parsed.rest));
+        break;
+      case "update": {
+        const update = parseUpdateArgs(parsed.rest);
+        const result = await runUpdate({
+          args: update,
+          home: gatewayHome(),
+          ...options.update === undefined ? {} : { deps: options.update }
+        });
+        for (const line of renderUpdate(result))
+          console.log(line);
+        break;
+      }
+      case "setup": {
+        await runSetup(parsed.rest, { home: gatewayHome(), ...options.setup });
+        break;
+      }
       default:
         throw new Error(CLI_USAGE);
     }