@harborgroup/my-team 0.1.0 → 0.2.0

package/README.md

@@ -24,6 +24,28 @@ Opens a local, token-protected dashboard in your browser (bound to `127.0.0.1` o
 
 Chat runs with this repo as Claude's working directory, and tool calls (file edits, shell commands) are auto-approved via Claude's own safety classifier (`permissionMode: 'auto'`) rather than prompted per action — there's no terminal in this flow to answer y/n prompts.
 
+## Your AI CEO
+
+The first time you run `npm run team` in a repo, Claude opens the conversation itself — it introduces itself and asks about your company (name, mission), what to call itself, and what personality it should have. Once it has answers, it writes `.my-team/profile.json` itself and adopts that identity from then on: not "an assistant with some context," but your company's AI CEO by name, on every chat turn (via a strong identity system prompt — weak "you're also helping company X" framing gets treated as low-trust incidental context and can get second-guessed; asserting it as configured identity doesn't).
+
+**Commit `.my-team/profile.json`** — don't gitignore it. It's shared, non-sensitive team config, the same category as a checked-in `CLAUDE.md`: the whole point of it living per-repo is that teammates cloning the repo share the same CEO persona without re-onboarding. Use the "Edit profile" button on the dashboard to adjust the company name, mission, CEO name, or personality later; changes take effect on the next chat turn without restarting the server.
+
+## Interface
+
+An icon rail (Home / Messages / Profile / Settings) plus a Slack-style Messages page: a `#general` channel (placeholder for now) and a DM with your CEO, real token-by-token streaming (via the SDK's `includePartialMessages`), a typing indicator, and a status dot on the CEO's avatar reflecting connection state. It's plain static HTML/CSS/JS talking to the backend over local HTTP + SSE — no browser-only assumptions — so a future native (Tauri) shell can point at the same server without a rewrite; there's no Tauri wrapper yet.
+
+## Model & effort
+
+Set a default model and reasoning effort for your CEO on the Profile page (fetched live from the SDK's `supportedModels()` — the effort dropdown only ever offers levels the chosen model actually supports, e.g. Haiku offers none). Override either per message from a small selector above the chat input; each response shows a small badge with the model actually used.
+
+## Updates
+
+On startup, `my-team` checks the npm registry in the background for a newer published version. If one exists, a banner appears with an "Update" button that runs the install for you (`npm install --save-dev` the new version) — restart `npm run team` afterward to pick it up. No auto-restart; that's a deliberate simplicity/safety tradeoff over self-respawning the running server process.
+
+## Logs
+
+Every raw request sent to the Claude Agent SDK (including the exact system prompt) and every raw message it streams back is logged verbatim to a JSON-lines file, one per `npm run team` run, under `~/.my-team/logs/` (outside the repo — old runs beyond a retention count are pruned automatically). The current run's log path is printed on startup and shown on the Settings page.
+
 ## Status
 
-v1: onboarding + a single chat session per launch. No persisted chat history, no multi-user support.
+v1.4: CLI-auth onboarding + conversational company/CEO-persona onboarding + Slack-style chat shell with real streaming + per-message model/effort selection + update checker + structured logging. No persisted chat history across restarts, no multi-user support, no `#general` backend (sidebar placeholder only).

package/dist/init.js

@@ -1,21 +1,7 @@
-import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// dist/init.js -> package root is one level up.
-const OWN_PACKAGE_ROOT = path.join(__dirname, '..');
-const OWN_PACKAGE_JSON = JSON.parse(readFileSync(path.join(OWN_PACKAGE_ROOT, 'package.json'), 'utf-8'));
-function npmInstall(cwd, spec) {
-    // On Windows, npm is a .cmd batch file that spawnSync can't execute
-    // directly (EINVAL). Routing through cmd.exe /c as the actual child
-    // (rather than shell: true) avoids that without the argument-escaping
-    // risk Node warns about (DEP0190) for shell: true + an args array.
-    const result = process.platform === 'win32'
-        ? spawnSync('cmd.exe', ['/d', '/s', '/c', 'npm', 'install', '--save-dev', spec], { cwd, stdio: 'inherit' })
-        : spawnSync('npm', ['install', '--save-dev', spec], { cwd, stdio: 'inherit' });
-    return result.status === 0;
-}
+import { npmInstall } from './npm-install.js';
+import { OWN_PACKAGE_NAME, OWN_PACKAGE_ROOT, OWN_PACKAGE_VERSION } from './own-package.js';
 function addTeamScript(repoPackageJsonPath) {
     const raw = readFileSync(repoPackageJsonPath, 'utf-8');
     const pkg = JSON.parse(raw);
@@ -32,14 +18,12 @@ function addTeamScript(repoPackageJsonPath) {
 }
 export async function runInit(cwd) {
     const repoPackageJsonPath = path.join(cwd, 'package.json');
-    const name = OWN_PACKAGE_JSON.name;
     if (!existsSync(repoPackageJsonPath)) {
-        console.error(`No package.json found at ${cwd}. Run "npm init" first, then re-run "npx ${name} init".`);
+        console.error(`No package.json found at ${cwd}. Run "npm init" first, then re-run "npx ${OWN_PACKAGE_NAME} init".`);
         process.exitCode = 1;
         return;
     }
-    const version = OWN_PACKAGE_JSON.version;
-    const installed = npmInstall(cwd, `${name}@${version}`) || npmInstall(cwd, OWN_PACKAGE_ROOT);
+    const installed = npmInstall(cwd, `${OWN_PACKAGE_NAME}@${OWN_PACKAGE_VERSION}`) || npmInstall(cwd, OWN_PACKAGE_ROOT);
     if (!installed) {
         console.error('Failed to install my-team as a devDependency.');
         process.exitCode = 1;

package/dist/npm-install.js

@@ -0,0 +1,13 @@
+import { spawnSync } from 'node:child_process';
+/**
+ * On Windows, npm is a .cmd batch file that spawnSync can't execute
+ * directly (EINVAL). Routing through cmd.exe /c as the actual child
+ * (rather than shell: true) avoids that without the argument-escaping
+ * risk Node warns about (DEP0190) for shell: true + an args array.
+ */
+export function npmInstall(cwd, spec) {
+    const result = process.platform === 'win32'
+        ? spawnSync('cmd.exe', ['/d', '/s', '/c', 'npm', 'install', '--save-dev', spec], { cwd, stdio: 'inherit' })
+        : spawnSync('npm', ['install', '--save-dev', spec], { cwd, stdio: 'inherit' });
+    return result.status === 0;
+}

package/dist/own-package.js

@@ -0,0 +1,9 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// dist/own-package.js -> package root is one level up.
+export const OWN_PACKAGE_ROOT = path.join(__dirname, '..');
+export const OWN_PACKAGE_JSON = JSON.parse(readFileSync(path.join(OWN_PACKAGE_ROOT, 'package.json'), 'utf-8'));
+export const OWN_PACKAGE_NAME = OWN_PACKAGE_JSON.name;
+export const OWN_PACKAGE_VERSION = OWN_PACKAGE_JSON.version;

package/dist/server/auth-check.js

@@ -1,5 +1,6 @@
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import { sanitizeEnv } from './env.js';
+import { forLog } from './logger.js';
 /**
  * Live probe, run fresh on every /api/status call rather than caching an
  * "onboarded" flag, so it can't go stale.
@@ -9,34 +10,44 @@ import { sanitizeEnv } from './env.js';
  * `system init` message arrives is enough to call accountInfo() without ever
  * dispatching a turn.
  */
-export async function checkAuth(cwd) {
+export async function checkAuth(cwd, logger) {
     const controller = new AbortController();
-    const q = query({
-        prompt: '',
-        options: {
-            cwd,
-            env: sanitizeEnv(process.env),
-            permissionMode: 'plan',
-            abortController: controller,
-            maxTurns: 1,
-        },
-    });
+    const options = {
+        cwd,
+        env: sanitizeEnv(process.env),
+        permissionMode: 'plan',
+        abortController: controller,
+        maxTurns: 1,
+    };
+    logger.log({ type: 'auth-check-request', options: forLog(options) });
+    const q = query({ prompt: '', options });
     try {
         for await (const msg of q) {
+            logger.log({ type: 'auth-check-sdk-message', message: msg });
             if (msg.type === 'system' && msg.subtype === 'init') {
                 const accountInfo = await q.accountInfo();
+                const models = await q.supportedModels();
+                logger.log({ type: 'auth-check-account-info', accountInfo });
+                logger.log({ type: 'auth-check-models', models });
                 controller.abort();
                 if (!accountInfo.email && !accountInfo.apiProvider) {
-                    return { ok: false, reason: 'not-authenticated' };
+                    const result = { ok: false, reason: 'not-authenticated' };
+                    logger.log({ type: 'auth-check-result', result });
+                    return result;
                 }
-                return { ok: true, accountInfo };
+                const result = { ok: true, accountInfo, models };
+                logger.log({ type: 'auth-check-result', result });
+                return result;
             }
         }
-        return { ok: false, reason: 'not-authenticated' };
+        const result = { ok: false, reason: 'not-authenticated' };
+        logger.log({ type: 'auth-check-result', result });
+        return result;
     }
     catch (err) {
         controller.abort();
         const message = String(err?.message ?? err);
+        logger.log({ type: 'auth-check-error', error: message, stack: err?.stack });
         if (/native binary not found|ENOENT|not recognized as an internal/i.test(message)) {
             return { ok: false, reason: 'cli-missing' };
         }

package/dist/server/chat-session.js

@@ -1,43 +1,72 @@
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import { sanitizeEnv } from './env.js';
+import { forLog } from './logger.js';
+import { formatProfileForSystemPrompt, getOnboardingSystemPrompt, readProfile } from './profile.js';
 /**
  * One ongoing SDK session per running server process. Conversation history
  * lives only in the CLI's own session store (resumed via session_id) — no
  * disk persistence of our own, lost on server restart (acceptable for v1).
  */
 export class ChatSession {
+    logger;
     sessionId;
     turnInFlight = false;
+    constructor(logger) {
+        this.logger = logger;
+    }
     isBusy() {
         return this.turnInFlight;
     }
-    async *sendTurn(message, cwd) {
+    async *sendTurn(message, cwd, overrides = {}) {
         if (this.turnInFlight) {
             yield { type: 'error', message: 'A previous turn is still in progress.' };
             return;
         }
         this.turnInFlight = true;
         try {
-            const q = query({
-                prompt: message,
-                options: {
-                    cwd,
-                    env: sanitizeEnv(process.env),
-                    permissionMode: 'auto',
-                    ...(this.sessionId ? { resume: this.sessionId } : {}),
-                },
-            });
+            const profile = await readProfile(cwd);
+            const onboarded = profile?.onboardingComplete === true;
+            const systemPromptAppend = onboarded
+                ? formatProfileForSystemPrompt(profile)
+                : getOnboardingSystemPrompt(cwd);
+            // Per-message override wins, then the CEO's configured default, then no
+            // override at all (Claude Code picks its own default).
+            const model = overrides.model || profile?.defaultModel || undefined;
+            const effort = overrides.effort || profile?.defaultEffort || undefined;
+            const options = {
+                cwd,
+                env: sanitizeEnv(process.env),
+                permissionMode: 'auto',
+                includePartialMessages: true,
+                ...(this.sessionId ? { resume: this.sessionId } : {}),
+                systemPrompt: { type: 'preset', preset: 'claude_code', append: systemPromptAppend },
+                ...(model ? { model } : {}),
+                ...(effort ? { effort: effort } : {}),
+            };
+            this.logger.log({ type: 'chat-request', message, options: forLog(options) });
+            const q = query({ prompt: message, options });
             for await (const msg of q) {
+                this.logger.log({ type: 'chat-sdk-message', message: msg });
                 if (msg.type === 'system' && msg.subtype === 'init') {
                     this.sessionId = msg.session_id;
-                    yield { type: 'meta', sessionId: msg.session_id };
+                    // msg.model reflects what the SDK actually resolved and used for
+                    // this turn; effort isn't echoed back on the message stream, so we
+                    // report what we requested (the UI only ever offers effort levels
+                    // the chosen model's own supportedEffortLevels confirms are valid,
+                    // so a silent downgrade in practice shouldn't occur).
+                    yield { type: 'meta', sessionId: msg.session_id, model: msg.model, effort: effort ?? '' };
+                }
+                else if (msg.type === 'stream_event') {
+                    const event = msg.event;
+                    if (event.type === 'content_block_delta' && event.delta.type === 'text_delta') {
+                        yield { type: 'text-delta', text: event.delta.text };
+                    }
                 }
                 else if (msg.type === 'assistant') {
+                    // Text was already streamed via stream_event deltas above — only tool
+                    // calls are new information here (tool inputs don't render usefully).
                     for (const block of msg.message.content) {
-                        if (block.type === 'text') {
-                            yield { type: 'text', text: block.text };
-                        }
-                        else if (block.type === 'tool_use') {
+                        if (block.type === 'tool_use') {
                             yield { type: 'tool-use', name: block.name };
                         }
                     }
@@ -51,6 +80,7 @@ export class ChatSession {
             }
         }
         catch (err) {
+            this.logger.log({ type: 'chat-error', error: String(err?.message ?? err), stack: err?.stack });
             yield { type: 'error', message: String(err?.message ?? err) };
         }
         finally {

package/dist/server/http-server.js

@@ -2,8 +2,11 @@ import http from 'node:http';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { OWN_PACKAGE_NAME } from '../own-package.js';
+import { npmInstall } from '../npm-install.js';
 import { checkAuth } from './auth-check.js';
 import { ChatSession } from './chat-session.js';
+import { readProfile, validateProfileInput, writeProfile } from './profile.js';
 import { tokensMatch } from './token.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const WEB_DIR = path.join(__dirname, '..', 'web');
@@ -28,8 +31,8 @@ async function readJsonBody(req) {
     return raw ? JSON.parse(raw) : {};
 }
 export function createServer(options) {
-    const { cwd, token, portRef } = options;
-    const chatSession = new ChatSession();
+    const { cwd, token, portRef, logger, updateInfoRef } = options;
+    const chatSession = new ChatSession(logger);
     return http.createServer(async (req, res) => {
         if (!isAllowedHost(req.headers.host, portRef.port)) {
             res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Bad Host header');
@@ -56,8 +59,46 @@ export function createServer(options) {
             return;
         }
         if (req.method === 'GET' && url.pathname === '/api/status') {
-            const result = await checkAuth(cwd);
-            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify(result));
+            const result = await checkAuth(cwd, logger);
+            const body = result.ok ? { ...result, profile: await readProfile(cwd) } : result;
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify(body));
+            return;
+        }
+        if (req.method === 'GET' && url.pathname === '/api/meta') {
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ logFilePath: logger.filePath, updateInfo: updateInfoRef.current }));
+            return;
+        }
+        if (req.method === 'POST' && url.pathname === '/api/update') {
+            const info = updateInfoRef.current;
+            if (!info?.updateAvailable || !info.latestVersion) {
+                res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify({ error: 'no update available' }));
+                return;
+            }
+            const ok = npmInstall(cwd, `${OWN_PACKAGE_NAME}@${info.latestVersion}`);
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok }));
+            return;
+        }
+        if (req.method === 'GET' && url.pathname === '/api/profile') {
+            const profile = await readProfile(cwd);
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ profile }));
+            return;
+        }
+        if (req.method === 'POST' && url.pathname === '/api/profile') {
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify({ error: 'invalid body' }));
+                return;
+            }
+            const validated = validateProfileInput(body);
+            if ('error' in validated) {
+                res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify(validated));
+                return;
+            }
+            await writeProfile(cwd, validated);
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true }));
             return;
         }
         if (req.method === 'POST' && url.pathname === '/api/chat') {
@@ -66,9 +107,13 @@ export function createServer(options) {
                 return;
             }
             let message;
+            let model;
+            let effort;
             try {
                 const body = await readJsonBody(req);
                 message = String(body.message ?? '');
+                model = typeof body.model === 'string' && body.model ? body.model : undefined;
+                effort = typeof body.effort === 'string' && body.effort ? body.effort : undefined;
             }
             catch {
                 res.writeHead(400, { 'Content-Type': 'application/json' }).end(JSON.stringify({ error: 'invalid body' }));
@@ -83,7 +128,7 @@ export function createServer(options) {
                 'Cache-Control': 'no-cache',
                 Connection: 'keep-alive',
             });
-            for await (const event of chatSession.sendTurn(message, cwd)) {
+            for await (const event of chatSession.sendTurn(message, cwd, { model, effort })) {
                 res.write(`data: ${JSON.stringify(event)}\n\n`);
             }
             res.end();

package/dist/server/logger.js

@@ -0,0 +1,68 @@
+import { appendFileSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * Every request sent to the Claude Agent SDK and every raw message it
+ * streams back (init, deltas, tool calls, results, errors) gets logged
+ * verbatim as one JSON-lines file per server run.
+ *
+ * Rotation is per-run rather than byte-size-based: each `npm run team`
+ * invocation gets its own file, and old runs beyond RETENTION_COUNT are
+ * pruned at startup. This sidesteps the concurrent-append/rotate-mid-write
+ * hazards of size-based rotation, and maps naturally onto how you'd actually
+ * want to debug this tool ("show me the log from my last session").
+ *
+ * Logs live outside the repo entirely (under the user's home directory),
+ * not in .my-team/ alongside profile.json — they're ephemeral machine/debug
+ * state, not shared project config, and may contain full file contents or
+ * other repo material flowing through tool calls, so they should never risk
+ * ending up committed.
+ */
+const RETENTION_COUNT = 20;
+/**
+ * Every SDK request carries the full (sanitized) process environment as
+ * `options.env` — dozens of unrelated OS/session variables that are noise,
+ * not signal, for debugging model behavior. Logging that in full would
+ * bloat every single entry with ~2KB of irrelevant PATH/OneDrive/etc.
+ * clutter. Replace it with a count before logging; everything else in the
+ * request (cwd, systemPrompt, permissionMode, resume) is logged verbatim.
+ */
+export function forLog(options) {
+    if (!options.env)
+        return options;
+    return { ...options, env: `[${Object.keys(options.env).length} vars, omitted from log]` };
+}
+function repoKey(cwd) {
+    const hash = createHash('sha256').update(cwd).digest('hex').slice(0, 8);
+    const base = path.basename(cwd).replace(/[^a-zA-Z0-9-_]/g, '_');
+    return `${base}-${hash}`;
+}
+export function createLogger(cwd) {
+    const dir = path.join(os.homedir(), '.my-team', 'logs');
+    mkdirSync(dir, { recursive: true });
+    const key = repoKey(cwd);
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const filePath = path.join(dir, `${key}-${timestamp}.jsonl`);
+    try {
+        const existing = readdirSync(dir)
+            .filter((f) => f.startsWith(`${key}-`) && f.endsWith('.jsonl'))
+            .map((f) => ({ f, mtime: statSync(path.join(dir, f)).mtimeMs }))
+            .sort((a, b) => b.mtime - a.mtime);
+        for (const { f } of existing.slice(RETENTION_COUNT - 1)) {
+            unlinkSync(path.join(dir, f));
+        }
+    }
+    catch {
+        // Pruning is best-effort; never block startup on it.
+    }
+    function log(entry) {
+        try {
+            appendFileSync(filePath, JSON.stringify({ ts: new Date().toISOString(), ...entry }) + '\n', 'utf-8');
+        }
+        catch {
+            // Logging must never crash the thing it's trying to help debug.
+        }
+    }
+    return { log, filePath };
+}

package/dist/server/profile.js

@@ -0,0 +1,125 @@
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+const EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const MAX_FIELD_LENGTH = 2000;
+const DEFAULT_CEO_NAME = 'your AI CEO';
+const DEFAULT_CEO_PERSONALITY = 'direct, pragmatic, and personally invested in the company succeeding';
+export function getProfileDir(cwd) {
+    return path.join(cwd, '.my-team');
+}
+export function getProfilePath(cwd) {
+    return path.join(getProfileDir(cwd), 'profile.json');
+}
+function stringOrDefault(value, fallback) {
+    return typeof value === 'string' && value.trim() ? value : fallback;
+}
+/**
+ * Never throws. Returns null only when the file doesn't exist or isn't
+ * parseable JSON at all — the "nothing written yet" case. Once the file
+ * exists, every field degrades gracefully to a default rather than
+ * invalidating the whole profile, because Claude writes this file itself
+ * incrementally during the onboarding conversation (e.g. companyName known,
+ * mission not yet) so the UI can reflect progress as it happens.
+ */
+export async function readProfile(cwd) {
+    const filePath = getProfilePath(cwd);
+    let raw;
+    try {
+        raw = await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        console.warn(`my-team: ${filePath} exists but isn't valid JSON — treating as unconfigured.`);
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        console.warn(`my-team: ${filePath} exists but has an unexpected shape — treating as unconfigured.`);
+        return null;
+    }
+    return {
+        companyName: stringOrDefault(parsed.companyName, ''),
+        mission: stringOrDefault(parsed.mission, ''),
+        ceoName: stringOrDefault(parsed.ceoName, DEFAULT_CEO_NAME),
+        ceoPersonality: stringOrDefault(parsed.ceoPersonality, DEFAULT_CEO_PERSONALITY),
+        onboardingComplete: parsed.onboardingComplete === true,
+        defaultModel: typeof parsed.defaultModel === 'string' ? parsed.defaultModel : '',
+        defaultEffort: EFFORT_LEVELS.includes(parsed.defaultEffort) ? parsed.defaultEffort : '',
+    };
+}
+function clampField(value, fallback) {
+    const str = typeof value === 'string' ? value.trim() : '';
+    if (!str)
+        return fallback;
+    if (str.length > MAX_FIELD_LENGTH)
+        return { error: `fields must be ${MAX_FIELD_LENGTH} characters or fewer` };
+    return str;
+}
+/** Used by the manual "Edit profile" form — companyName/mission required, ceoName/ceoPersonality optional. */
+export function validateProfileInput(body) {
+    const companyName = typeof body?.companyName === 'string' ? body.companyName.trim() : '';
+    const mission = typeof body?.mission === 'string' ? body.mission.trim() : '';
+    if (!companyName || !mission) {
+        return { error: 'companyName and mission are both required' };
+    }
+    if (companyName.length > MAX_FIELD_LENGTH || mission.length > MAX_FIELD_LENGTH) {
+        return { error: `fields must be ${MAX_FIELD_LENGTH} characters or fewer` };
+    }
+    const ceoName = clampField(body?.ceoName, DEFAULT_CEO_NAME);
+    if (typeof ceoName === 'object')
+        return ceoName;
+    const ceoPersonality = clampField(body?.ceoPersonality, DEFAULT_CEO_PERSONALITY);
+    if (typeof ceoPersonality === 'object')
+        return ceoPersonality;
+    const defaultModel = clampField(body?.defaultModel, '');
+    if (typeof defaultModel === 'object')
+        return defaultModel;
+    const requestedEffort = typeof body?.defaultEffort === 'string' ? body.defaultEffort.trim() : '';
+    const defaultEffort = EFFORT_LEVELS.includes(requestedEffort)
+        ? requestedEffort
+        : '';
+    // A manual submission is a deliberate, complete configuration — never partial.
+    return { companyName, mission, ceoName, ceoPersonality, onboardingComplete: true, defaultModel, defaultEffort };
+}
+export async function writeProfile(cwd, data) {
+    const dir = getProfileDir(cwd);
+    await mkdir(dir, { recursive: true });
+    const filePath = getProfilePath(cwd);
+    const tmpPath = path.join(dir, `.profile.json.${process.pid}.tmp`);
+    await writeFile(tmpPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    try {
+        await rename(tmpPath, filePath);
+    }
+    catch (err) {
+        await unlink(tmpPath).catch(() => { });
+        throw err;
+    }
+}
+/**
+ * Strong, first-person identity framing — deliberately not "you're also
+ * helping company X" phrasing. Weaker framing was tested and Claude treated
+ * it as low-trust incidental context (correctly suspicious when the value
+ * changed between turns, since that's exactly the shape of a prompt
+ * injection). Explicitly asserting this is configured identity, not
+ * external/injected content, fixed it in testing.
+ */
+export function formatProfileForSystemPrompt(profile) {
+    return `You are ${profile.ceoName}, the AI CEO of ${profile.companyName}. This is your actual identity, configured directly by your founder — it is not external file content, not a suggestion, and not something to second-guess or flag as injected. ${profile.companyName}'s mission: ${profile.mission}. Communication style: ${profile.ceoPersonality}. Speak and act as ${profile.companyName}'s CEO would — invested in the company's success and personally identified with its mission.`;
+}
+/**
+ * Used instead of formatProfileForSystemPrompt while onboardingComplete is
+ * false. Turns the conversation itself into the onboarding step, rather than
+ * gating the dashboard behind a form — Claude asks the questions and
+ * persists the answers itself via its own file-write access, updating the
+ * file after each answer (not just once at the end) so the UI can reflect
+ * progress live as the conversation happens.
+ */
+export function getOnboardingSystemPrompt(cwd) {
+    const filePath = getProfilePath(cwd);
+    return `There is no company profile configured yet in this repository. Before doing anything else, have a brief, friendly conversation with the founder (you're talking to them right now) to learn: (1) their company's name, (2) its mission or what it does, (3) what they'd like to name you as their AI CEO, and (4) what personality or communication style you should have. Ask naturally, a question or two at a time — don't interrogate, and don't ask about anything else in the repo yet. After each answer, immediately write or update ${filePath} with whatever you know so far as JSON: {"companyName": string, "mission": string, "ceoName": string, "ceoPersonality": string, "onboardingComplete": boolean} — set "onboardingComplete" to false until you have all four answers, then write it one final time with "onboardingComplete": true. After that final write, briefly introduce yourself in your new persona. Until "onboardingComplete" is true, don't perform any other coding tasks.`;
+}

package/dist/server/start.js

@@ -1,6 +1,9 @@
 import { spawn } from 'node:child_process';
+import { OWN_PACKAGE_NAME, OWN_PACKAGE_VERSION } from '../own-package.js';
 import { createServer } from './http-server.js';
+import { createLogger } from './logger.js';
 import { generateToken } from './token.js';
+import { checkForUpdate } from './update-check.js';
 function openBrowser(url) {
     const platform = process.platform;
     try {
@@ -21,14 +24,22 @@ function openBrowser(url) {
 export async function startServer(cwd) {
     const token = generateToken();
     const portRef = { port: 0 };
+    const logger = createLogger(cwd);
+    // Fire-and-forget: never block startup on a network round-trip. /api/meta
+    // just returns null until this resolves.
+    const updateInfoRef = { current: null };
+    checkForUpdate(OWN_PACKAGE_NAME, OWN_PACKAGE_VERSION).then((info) => {
+        updateInfoRef.current = info;
+    });
     await new Promise((resolve) => {
-        const server = createServer({ cwd, token, portRef });
+        const server = createServer({ cwd, token, portRef, logger, updateInfoRef });
         server.listen(0, '127.0.0.1', () => {
             const address = server.address();
             portRef.port = typeof address === 'object' && address ? address.port : 0;
             const url = `http://127.0.0.1:${portRef.port}/?token=${token}`;
             console.log(`my-team is running for ${cwd}`);
             console.log(`Open: ${url}`);
+            console.log(`Logging raw requests/responses to: ${logger.filePath}`);
             openBrowser(url);
             resolve();
         });

package/dist/server/update-check.js

@@ -0,0 +1,32 @@
+function isNewerVersion(latest, current) {
+    const a = latest.split('.').map(Number);
+    const b = current.split('.').map(Number);
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const x = a[i] ?? 0;
+        const y = b[i] ?? 0;
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}
+/**
+ * Plain registry GET, no npm CLI involved. Never throws — a failed check
+ * (offline, registry down) just means "no update info available," not an
+ * error worth surfacing to the user.
+ */
+export async function checkForUpdate(packageName, currentVersion) {
+    try {
+        const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, {
+            signal: AbortSignal.timeout(4000),
+        });
+        if (!res.ok)
+            return { currentVersion, latestVersion: null, updateAvailable: false };
+        const data = (await res.json());
+        if (!data.version)
+            return { currentVersion, latestVersion: null, updateAvailable: false };
+        return { currentVersion, latestVersion: data.version, updateAvailable: isNewerVersion(data.version, currentVersion) };
+    }
+    catch {
+        return { currentVersion, latestVersion: null, updateAvailable: false };
+    }
+}