@hybridlabor-api/aos 4.7.0 → 4.7.2

package/docs/AUDIT_BRIEF_ECC_STORE.md

@@ -0,0 +1,122 @@
+# Audit Brief: AOS Skill, Subagent & Extras Store (ECC Fork Integration)
+
+**Datum:** 2026-09-24  
+**Projekt:** `@hybridlabor-api/aos` (AOS — Curated AI Agent OS)  
+**Dokumenttyp:** Architektur- & Sicherheits-Audit-Briefing für externe Reviewer- / Auditor-Agenten  
+**Status:** Vor Implementierung (Architektur-Review)
+
+---
+
+## 1. Executive Summary & Zielsetzung
+
+AOS (`@hybridlabor-api/aos`) ist ein multi-harness Agenten-Betriebssystem für autonome Coding-Pipelines (unterstützt Claude Code, Google Antigravity, Codex, Cursor, Roo Code und OpenCode). Aktuell liefert AOS ca. 185 kuratierte Kern-Skills und eine 7-Node-Graph-Architektur mit deterministischen Übergängen (Architect → TechLead → Build → Reviewer → Shipping).
+
+### Geplante Erweiterung
+Aufbau eines dezentralen **Skill-, Subagent- und Extras-Stores** als Fallback-Ebene auf Basis eines gepflegten Forks von **[affaan-m/ECC](https://github.com/affaan-m/ECC)** (Everything Claude Code, MIT-Lizenz):
+1. **Fallback in `/ask-tim`:** Wenn ein Nutzer nach einer Domäne oder einem Framework sucht (z. B. Spring Boot, Godot, Django), das nicht im 185-Skill-Kern von AOS liegt, soll `/ask-tim` automatisch passende Erweiterungen aus dem Store vorschlagen.
+2. **Fallback in `--skill=<name>`:** Bei Pipeline-Aufrufen wie `/startcycle-graph --skill=django-pro "Ziel"` soll ein lokal fehlender Skill nicht sofort hart mit einer Eskalation abbrechen, sondern im Store gesucht, validiert und on-demand geladen werden.
+3. **Subagent & Extras Katalog:** Bereitstellung von spezialisierten Auxiliary Agents, Templates, Rules und Hooks aus dem ECC-Ökosystem als modulare AOS-Erweiterungen.
+
+---
+
+## 2. Aktueller Systembestand in AOS (Ist-Zustand)
+
+### 2.1 Relevante Code- & Konfigurations-Pfade
+- **Multi-Harness Installer:** [`installer.js`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/installer.js) — Synchronisiert Skills, MCP-Configs und Agents nach `~/.claude/`, `~/.agents/`, `~/.codex/`, `~/.cursor/` etc.
+- **Pipeline Dispatcher:** [`.claude/workflows/startcycle-dispatch.mjs`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/.claude/workflows/startcycle-dispatch.mjs) — Verwaltet den Startcycle-Graph, GO-Gates, mandatory skills (`--skill=<name>`) und Agenten-Orchestrierung.
+- **Skill Router:** [`skills/global_config/ask-tim/SKILL.md`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/skills/global_config/ask-tim/SKILL.md) — Zentraler Einstiegspunkt für Intent-Erkennung und Skill-Auswahl.
+- **Vendor Tracking:** [`~/.agents/vendor-manifest.json`](file:///Users/timrennings/.agents/vendor-manifest.json) — Pinned Git SHAs für Upstream-Repositories (z. B. `anti-slop`, `skylos`, `claude-red`).
+- **Bereits portierte ECC-Komponenten:** [`THIRD_PARTY_NOTICES.md`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/THIRD_PARTY_NOTICES.md) — 6 Auxiliary Agents (`silent-failure-hunter`, `security-reviewer`, `go-build-resolver`, `database-reviewer`, `opensource-forker`, `opensource-sanitizer`) und `plan-canvas`.
+
+### 2.2 Bestehende `--skill` Validierungslogik (`startcycle-dispatch.mjs:701-741`)
+```javascript
+// Aktuelles Verhalten:
+if (mandatorySkillNames.length > 0) {
+  const skillCheckResult = await agent(`Check whether each of these skill names resolves to an installed skill...`);
+  const missing = skillCheckResult?.missing ?? [];
+  if (missing.length > 0) {
+    // HARTES ESKALIEREN:
+    return await escalate(`--skill named skill(s) that could not be found: ${missing.join(', ')}...`);
+  }
+}
+```
+
+---
+
+## 3. Geplante Soll-Architektur
+
+```mermaid
+flowchart TD
+    User([Nutzer-Anfrage / Prompt]) --> Trigger{Einstiegspunkt}
+    
+    Trigger -->|1. /ask-tim Suche| AskTim[ask-tim Router]
+    Trigger -->|2. --skill=name Flag| Dispatcher[startcycle-dispatch]
+    
+    AskTim --> CheckCore1{Im 185-Skill AOS Core?}
+    Dispatcher --> CheckCore2{Lokal auf Disk installiert?}
+    
+    CheckCore1 -->|Ja| UseCore[Empfehle/Nutze nativen AOS-Skill]
+    CheckCore2 -->|Ja| RunCore[Starte Pipeline mit Core-Skill]
+    
+    CheckCore1 -->|Nein| QueryStore[Abfrage lokaler ecc-store-index.json]
+    CheckCore2 -->|Nein| QueryStore
+    
+    QueryStore --> MatchFound{Match im Store?}
+    MatchFound -->|Nein| FinalEscalate[Eskalation / Keine Treffer]
+    MatchFound -->|Ja| StoreAction{Aktion}
+    
+    StoreAction -->|bei /ask-tim| ShowOption[Empfehlung + 'aos store install <name>']
+    StoreAction -->|bei --skill| GateCheck[GO-Gate / Confirmation]
+    
+    GateCheck -->|Genehmigt| FetchEngine[On-Demand Sync in ~/.agents/skills/]
+    FetchEngine --> ValidateHarness[POSIX & Harness-Tool Linter]
+    ValidateHarness --> RunPipeline[Pipeline-Start ohne Unterbrechung]
+```
+
+---
+
+## 4. Kernfragen & Prüffelder für das Audit
+
+Der Auditor-Agent wird gebeten, folgende kritische Fragestellungen strukturiert zu beleuchten:
+
+### 1. GO-Gate & Sicherheit (Supply-Chain-Risiko)
+* **Problem:** Dürfen externe Skills oder Agents während eines autonomen Pipeline-Laufs dynamisch aus einem Remote-Repository nachgeladen werden?
+* **Audit-Frage:** Wie muss die Bestätigung strukturiert sein, damit die strikte AOS-Regel (*"read-only until literal GO"*) nicht kompromittiert wird? Genügt ein lokales, kryptografisch verifiziertes Manifest mit SHA-256 Checksummen?
+
+### 2. Multi-Harness Tool-Inkompatibilitäten
+* **Problem:** `affaan-m/ECC` ist primär für Claude Code konzipiert und verwendet teils hardcodierte Tool-Namen wie `Bash`, `View`, `Edit`, `GlobTool`.
+* **Audit-Frage:** Welche automatisierten Transformations- oder Linter-Regeln müssen beim Ingest/Installationsschritt greifen, damit importierte Skills fehlerfrei in Google Antigravity (`run_command`, `view_file`), OpenAI Codex (`exec`, `read_file`) und Cursor funktionieren?
+
+### 3. Context Window & Token-Budget
+* **Problem:** Ein ungefilterter Import von 400+ Skills würde die Context-Limits und System-Prompts überlasten.
+* **Audit-Frage:** Ist die gewählte Architektur mit einem leichtgewichtigen, lokalen Vektor- oder Metadaten-Index (`ecc-store-index.json` < 100 KB) optimal, und wie sollte das semantische Ranking bei ungenauen Begriffen erfolgen?
+
+### 4. Namenskonflikte & Rangfolge (Precedence)
+* **Problem:** Was passiert, wenn ein ECC-Skill denselben Namen trägt wie ein existierender oder zukünftiger AOS-Kern-Skill (z. B. `tailwind-patterns` oder `tdd-workflow`)?
+* **Audit-Frage:** Sollte ein striktes Namespacing (`ecc/<skill-name>` oder Tagging `origin: ecc`) erzwungen werden, um Overwrites und Seiteneffekte auszuschließen?
+
+### 5. Wartungs- und Sync-Strategie des Forks
+* **Problem:** ECC wird kontinuierlich weiterentwickelt.
+* **Audit-Frage:** Wie sieht eine nachhaltige GitHub-Action-Sync-Pipeline für den Fork `hybridlabor-api/ECC` aus, die neue Upstream-Releases verarbeitet, ohne manuell angepasste Harness-Kompatibilitäts-Fixes zu überschreiben?
+
+---
+
+## 5. Referenzierte Komponenten & Schnittstellen
+
+| Komponente | Datei / Pfad | Relevante Zeilen / Kontext |
+|---|---|---|
+| **Pipeline-Dispatcher** | [`.claude/workflows/startcycle-dispatch.mjs`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/.claude/workflows/startcycle-dispatch.mjs) | Z. 701–741 (Mandatory Skill Check & Eskalation) |
+| **Skill Router** | [`skills/global_config/ask-tim/SKILL.md`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/skills/global_config/ask-tim/SKILL.md) | Z. 1–70 (Main Flow & Intent Index) |
+| **Vendor Registry** | [`~/.agents/vendor-manifest.json`](file:///Users/timrennings/.agents/vendor-manifest.json) | Vorhandene Pinned-Upstream-Repositories |
+| **Lizenz- & Provenance** | [`THIRD_PARTY_NOTICES.md`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/THIRD_PARTY_NOTICES.md) | Z. 12–50 (Bisheriger Port von ECC-Agents) |
+| **AOS Installer & Sync** | [`installer.js`](file:///Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills/installer.js) | Z. 110–135 (Multi-Platform Fan-out) |
+
+---
+
+## 6. Erwartetes Audit-Ergebnis
+
+Der externe Auditor-Agent sollte am Ende einen Bericht mit folgendem Schema abliefern:
+1. **Architektur-Bewertung:** Bestätigung oder Korrektur der vorgeschlagenen Store- und Fallback-Architektur.
+2. **Identifizierte Risiken:** Kategorisiert nach *Blocker*, *Warnung*, *Empfehlung*.
+3. **Konkrete Lösungsvorschläge:** Für Tool-Mapping, Token-Schonung und GO-Gate-Integration.
+4. **Sign-Off / Freigabe-Empfehlung:** Für den Start der Implementierung von Phase 1.

package/docs/PLAN_AOS_STORE_PHASE1.md

@@ -0,0 +1,190 @@
+# Execution Plan: AOS Skill, Subagent & Extras Store (Phase 1)
+
+**Target Repository:** `/Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills`  
+**Target Worktree:** `/Users/timrennings/dev/bdb-dev/aos-wt-store`  
+**Branch:** `feat/aos-store` (branched from `main`)  
+**Scope:** Phase 1 — Core Store Infrastructure, Offline Index, CLI, and Dispatcher Fallback  
+**Audience:** Autonomous Implementation Agent  
+**Upstream Source:** `https://github.com/affaan-m/ECC` (Pinned Commit, MIT License)
+
+---
+
+## 🎯 1. Mission & Architectural Invariants
+
+You are implementing Phase 1 of the **AOS Store** (`@hybridlabor-api/aos`). This provides an on-demand fallback layer for skills and subagents sourced from `affaan-m/ECC` whenever a requested capability is not in AOS's 185-skill core.
+
+### ⚠️ Non-Negotiable Invariants (Audit-Mandated)
+1. **No Forks:** Do NOT fork ECC to GitHub. Pin `affaan-m/ECC` directly via Git SHA in `vendor-manifest.json` (identical to `anti-slop` and `skylos`).
+2. **No Mid-Run Downloads:** Never download or prompt to download during a `/startcycle-graph` run (violates the GO-Gate and headless guarantees). If `--skill=<name>` is missing, the dispatcher must escalate with a clear manual install instruction:
+   ```text
+   "<name> is not installed. Found in the ECC store.
+   Run: aos store install <name>
+   Then re-run your startcycle command."
+   ```
+3. **No File System in Dispatcher:** `.claude/workflows/startcycle-dispatch.mjs` has no direct `fs` access. The mandatory skill check is an `agent()` call (Haiku); you must extend its JSON schema with `store_matches: string[]` instead of adding `fs` calls.
+4. **Trust Anchor is AOS Package:** `lib/ecc-store-index.json` ships inside the `@hybridlabor-api/aos` npm package. Downloads from GitHub must match the SHA-256 hash in this index. Hash mismatch = hard failure.
+5. **Phase-1 Scope: Markdown Only:**
+   - Only import `skills/` and `agents/` (Subagents).
+   - **Strictly exclude** `scripts/`, `hooks/`, and `rules/` (prevents RCE and config pollution).
+6. **Collision Invariant:** AOS core skills ALWAYS take precedence. If an ECC skill shares a name with an existing AOS skill, it is skipped and logged.
+7. **Future-Proofing for Fucksaas & AO:** Every store item must contain schema fields for `tier: "free"`, `requires_auth: false`, and `origin: "ecc"` so Fucksaas PRO pay-gates and AO marketplace UI can be layered on in Phase 2 without changing the schema.
+
+---
+
+## 🛠️ 2. Worktree Initialization
+
+Execute the following commands to create and enter the isolated worktree:
+
+```bash
+cd /Users/timrennings/dev/bdb-dev/bdb-dev-optimized-agent-skills
+git fetch origin main
+git worktree add -b feat/aos-store /Users/timrennings/dev/bdb-dev/aos-wt-store main
+cd /Users/timrennings/dev/bdb-dev/aos-wt-store
+```
+
+All modifications below MUST take place inside `/Users/timrennings/dev/bdb-dev/aos-wt-store/`.
+
+---
+
+## 📋 3. Step-by-Step Implementation Checklist
+
+### Step 1: Upstream Pinning & Provenance
+- [ ] Inspect the latest stable commit SHA of `affaan-m/ECC`:
+  ```bash
+  gh api repos/affaan-m/ECC/commits/main --jq '.sha'
+  ```
+- [ ] Add `ecc-store` entry to `vendor-manifest.json`:
+  ```json
+  "ecc-store": {
+    "upstream": "https://github.com/affaan-m/ECC",
+    "pinned_commit": "<FULL_SHA>",
+    "purpose": "On-demand fallback store for skills and auxiliary subagents",
+    "target": "lib/ecc-store-index.json"
+  }
+  ```
+- [ ] Update `THIRD_PARTY_NOTICES.md` to document the full scope of ECC components and MIT license terms.
+
+### Step 2: Store Index Generator (`scripts/build-ecc-store-index.mjs`)
+- [ ] Create `scripts/build-ecc-store-index.mjs`. The script must:
+  1. Fetch the tree from GitHub API for the pinned commit (`repos/affaan-m/ECC/git/trees/<sha>?recursive=1`) or clone to a temporary cache.
+  2. Filter strictly for Markdown:
+     - `skills/**/SKILL.md` or `skills/**/*.md`
+     - `agents/*.md`
+  3. Validate & sanitize frontmatter:
+     - Must conform to AOS standards (runnable through `scripts/validate-skills.mjs` rules).
+     - Compute SHA-256 for each raw file.
+     - Scan for forbidden tokens (hardcoded Claude-only tools like `Bash`, `View`; replace or flag compatibility).
+  4. Build schema:
+     ```typescript
+     interface StoreIndex {
+       version: "1.0.0";
+       generated_at: string;
+       pinned_commit: string;
+       skills: Record<string, {
+         name: string;
+         description: string;
+         category: string;
+         tier: "free";
+         origin: "ecc";
+         requires_auth: false;
+         sha256: string;
+         upstream_path: string;
+         harness_support: ("claude" | "antigravity" | "codex" | "cursor" | "roo")[];
+       }>;
+       subagents: Record<string, {
+         name: string;
+         description: string;
+         role: string;
+         tier: "free";
+         origin: "ecc";
+         sha256: string;
+         upstream_path: string;
+       }>;
+     }
+     ```
+  5. Check collisions against local `skills/` in AOS. Any collision is skipped.
+  6. Output the compiled index to `lib/ecc-store-index.json` (keep size under 100 KB).
+- [ ] Run `node scripts/build-ecc-store-index.mjs` and verify `lib/ecc-store-index.json`.
+
+### Step 3: CLI Implementation (`bin/aos-store.mjs` & `installer.js`)
+- [ ] Create `bin/aos-store.mjs`:
+  - `aos store list [--type=skills|agents]` -> Formatted table of available items.
+  - `aos store search <query>` -> Search by name, tags, description in `lib/ecc-store-index.json`.
+  - `aos store install <name> [--project]` ->
+    1. Look up `<name>` in `lib/ecc-store-index.json`.
+    2. Check if already installed locally; collision guard against AOS core.
+    3. Download raw content from `https://raw.githubusercontent.com/affaan-m/ECC/<pinned_sha>/<upstream_path>`.
+    4. Compute SHA-256 and assert match with index (halt on mismatch).
+    5. Write file:
+       - If `--project`: write to `./skills/<name>/SKILL.md`.
+       - If global: fan-out to all active harnesses (`~/.agents/skills/<name>/SKILL.md`, `~/.claude/skills/<name>/SKILL.md`, etc., reusing logic from `installer.js`).
+    6. Log success with green checkmark.
+- [ ] Make `bin/aos-store.mjs` executable (`chmod +x bin/aos-store.mjs`).
+- [ ] Register in `package.json`:
+  ```json
+  "bin": {
+    ...
+    "aos-store": "bin/aos-store.mjs"
+  }
+  ```
+- [ ] Wire up `aos store <args>` in `installer.js` so running `aos store search` forwards directly to `bin/aos-store.mjs`.
+
+### Step 4: Dispatcher Hook (`.claude/workflows/startcycle-dispatch.mjs`)
+- [ ] Locate the `validate-mandatory-skills` agent call around lines 701–741.
+- [ ] Update the prompt and JSON schema:
+  - Add `store_matches: { type: 'array', items: { type: 'string' } }` to the output schema.
+  - Instruct the agent to check `lib/ecc-store-index.json` for any skill not found locally on disk.
+- [ ] Update escalation handling (lines 728–739):
+  ```javascript
+  const missing = skillCheckResult?.missing ?? [];
+  if (missing.length > 0) {
+    const storeMatches = skillCheckResult?.store_matches ?? [];
+    const suggestions = skillCheckResult?.suggestions ?? [];
+    
+    let msg = `--skill named skill(s) that are not currently installed: ${missing.join(', ')}.\n`;
+    if (storeMatches.length > 0) {
+      msg += `Found in the AOS / ECC Store: ${storeMatches.join(', ')}.\n` +
+             `Run: aos store install ${storeMatches.join(' ')}\n` +
+             `Then re-run your startcycle command.\n`;
+    } else if (suggestions.length > 0) {
+      msg += `Did you mean: ${suggestions.join(', ')}?\n`;
+    }
+    return await escalate(msg);
+  }
+  ```
+
+### Step 5: Router Update (`skills/global_config/ask-tim/SKILL.md`)
+- [ ] Add a new section in `ask-tim/SKILL.md` titled `## Outside the core: the ECC store`:
+  - Explain that when no native AOS skill fits (e.g. Django, Spring, Godot), the user can query the store via `aos store search <query>`.
+  - Document `aos store install <name>` for on-demand activation.
+  - Reiterate that the core remains 185 high-trust skills.
+
+### Step 6: Verification & Quality Gate
+- [ ] Run skill validator:
+  ```bash
+  npm run test
+  npm run validate:strict
+  ```
+- [ ] Test the CLI commands:
+  ```bash
+  node bin/aos-store.mjs list | head -n 20
+  node bin/aos-store.mjs search django
+  node bin/aos-store.mjs search spring
+  ```
+- [ ] Test mock installation:
+  ```bash
+  node bin/aos-store.mjs install <test-skill> --dry-run
+  ```
+- [ ] Ensure Git working tree is clean and commits follow Conventional Commits:
+  - `feat(store): add build-ecc-store-index generator and store-index.json`
+  - `feat(store): implement aos-store CLI and installer integration`
+  - `feat(dispatcher): suggest aos store install on missing mandatory skills`
+  - `docs(ask-tim): add ECC store fallback section`
+
+---
+
+## 🚀 4. Definition of Done
+1. `npm test` and `npm run validate` pass with zero errors.
+2. `lib/ecc-store-index.json` is generated, valid JSON, under 100 KB.
+3. `bin/aos-store.mjs` executes cleanly without unhandled rejections.
+4. Worktree is ready for review and merge into `main`.

package/installer.js

@@ -41,7 +41,7 @@ function verifyDaemonListening(port, name, timeoutMs = 4000) {
         tryConnect();
     });
 }
-const { execSync, spawn, spawnSync, exec } = require('child_process');
+const { execSync, spawn, spawnSync, exec, execFileSync } = require('child_process');
 const clack = require('@clack/prompts');
 
 const {
@@ -233,8 +233,12 @@ const conditionalMcpConfigKeys = [
 
 function hasExecutable(binary) {
     try {
-        const lookup = process.platform === 'win32' ? `where ${binary}` : `command -v ${binary}`;
-        execSync(lookup, { stdio: 'ignore' });
+        if (process.platform === 'win32') {
+            execFileSync('where.exe', [binary], { stdio: 'ignore' });
+        } else {
+            if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(binary)) return false;
+            execSync(`command -v ${binary}`, { stdio: 'ignore' });
+        }
         return true;
     } catch (e) {
         return false;
@@ -250,7 +254,7 @@ function findWindowsGoBin() {
     if (process.platform !== 'win32') return null;
     const candidates = [];
     try {
-        const found = execSync('where.exe go', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+        const found = execFileSync('where.exe', ['go'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
             .split(/\r?\n/).map(s => s.trim()).find(Boolean);
         if (found) candidates.push(path.dirname(found));
     } catch (_) { /* PATH can be stale immediately after installation */ }
@@ -2192,8 +2196,11 @@ async function installOpenWikiVisualizer() {
     // bin dir, so resolve the absolute binary path now instead of relying on PATH at boot.
     let openwikiBin = 'openwiki';
     try {
-        const lookup = process.platform === 'win32' ? 'where openwiki' : 'command -v openwiki';
-        openwikiBin = execSync(lookup, { encoding: 'utf8' }).split(/\r?\n/)[0].trim() || 'openwiki';
+        if (process.platform === 'win32') {
+            openwikiBin = execFileSync('where.exe', ['openwiki'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'openwiki';
+        } else {
+            openwikiBin = execSync('command -v openwiki', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'openwiki';
+        }
     } catch (e) { logDebug(e, 'openwiki path lookup'); }
 
     // The openwiki CLI is a Node script (#!/usr/bin/env node shebang). Under
@@ -2202,8 +2209,11 @@ async function installOpenWikiVisualizer() {
     // the interpreter itself is baked in as an absolute path.
     let nodeBin = 'node';
     try {
-        const lookup = process.platform === 'win32' ? 'where node' : 'command -v node';
-        nodeBin = execSync(lookup, { encoding: 'utf8' }).split(/\r?\n/)[0].trim() || 'node';
+        if (process.platform === 'win32') {
+            nodeBin = execFileSync('where.exe', ['node'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'node';
+        } else {
+            nodeBin = execSync('command -v node', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'node';
+        }
     } catch (e) { logDebug(e, 'node path lookup'); }
 
     // Which wiki :4321 serves is per-machine setup configuration, not a
@@ -2444,11 +2454,11 @@ async function installOSAgentWorkspace() {
     }, 'AO cannot be started without its binary.');
 
     try {
-        execSync(`codesign -v "${binTarget}"`, { stdio: 'ignore' });
+        execFileSync('codesign', ['-v', binTarget], { stdio: 'ignore' });
     } catch {
         log.warn('The ao binary is not code-signed — AMFI will kill it at launch.');
         try {
-            execSync(`codesign -s - -f "${binTarget}"`, { stdio: 'ignore' });
+            execFileSync('codesign', ['-s', '-', '-f', binTarget], { stdio: 'ignore' });
             log.step('Signed it ad-hoc.');
         } catch (e) { log.warn(`Could not sign it: ${e.message}`); }
     }
@@ -2463,12 +2473,12 @@ async function installOSAgentWorkspace() {
     // service definition changes upstream.
     const legacyPlist = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.agent-workspace.plist');
     if (fs.existsSync(legacyPlist)) {
-        try { execSync(`launchctl unload "${legacyPlist}" 2>/dev/null`, { stdio: 'ignore' }); } catch (e) { logDebug(e, 'unload legacy ao agent'); }
+        try { execFileSync('launchctl', ['unload', legacyPlist], { stdio: 'ignore' }); } catch (e) { logDebug(e, 'unload legacy ao agent'); }
         try { fs.unlinkSync(legacyPlist); log.step('Removed the old com.bdb.agent-workspace service.'); } catch (e) { logDebug(e, 'remove legacy plist'); }
     }
 
     installStep('register the AO service', () => {
-        execSync(`"${binTarget}" service install`, { stdio: 'ignore' });
+        execFileSync(binTarget, ['service', 'install'], { stdio: 'ignore' });
     }, 'Start it by hand with: ao service install');
 
     if (await verifyDaemonListening(3101, 'AO Orchestrator', 8000)) {
@@ -2942,8 +2952,11 @@ async function installMcpsForTarget(paths, ctx) {
 
     let uvPath = 'uv';
     try {
-        const whichCmd = process.platform === 'win32' ? 'where uv' : 'which uv';
-        uvPath = execSync(whichCmd, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim().split(/\r?\n/)[0];
+        if (process.platform === 'win32') {
+            uvPath = execFileSync('where.exe', ['uv'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' }).trim().split(/\r?\n/)[0];
+        } else {
+            uvPath = execSync('command -v uv', { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' }).trim().split(/\r?\n/)[0];
+        }
     } catch (e) {
         if (fs.existsSync(path.join(homeDir, '.local', 'bin', 'uv'))) uvPath = path.join(homeDir, '.local', 'bin', 'uv');
         else if (fs.existsSync(path.join(homeDir, '.cargo', 'bin', 'uv'))) uvPath = path.join(homeDir, '.cargo', 'bin', 'uv');
@@ -3608,7 +3621,7 @@ function installGlobalBinaries() {
     }
 
     const isWin = process.platform === 'win32';
-    const cliBins = ['aos-config', 'aos-dashboard', 'aos-uninstall'];
+    const cliBins = ['aos-config', 'aos-dashboard', 'aos-uninstall', 'aos-store', 'aos-doctor'];
 
     for (const name of cliBins) {
         const targetMjs = path.join(globalAgentsBin, `${name}.mjs`);
@@ -4809,7 +4822,38 @@ async function runQuickUpdate(installState) {
 }
 
 
+function buildAoAnnouncementBanner() {
+    return [
+        '\x1b[36m╭──────────────────────────────────────────────────────────────────────────────╮\x1b[0m',
+        '\x1b[36m│\x1b[0m                                                                              \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   \x1b[1m\x1b[35m🚀 BDB AGENT ORCHESTRATOR APP — FINALE BETA JETZT VERFÜGBAR!\x1b[0m              \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m                                                                              \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   Die nächste Generation der Cross-Harness Multi-Agenten-Orchestrierung      \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   ist jetzt als finale Beta für alle User freigeschaltet.                    \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m                                                                              \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   • \x1b[1mDashboard & WebUI:\x1b[0m  http://localhost:3101                                \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   • \x1b[1mService-Befehl:\x1b[0m     ao service install  (Hintergrunddienst aktivieren)   \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   • \x1b[1mQuick Launch:\x1b[0m       ao open  oder  ao service status                     \x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m   • \x1b[1mFeatures:\x1b[0m           Session-Telemetrie, Live-AgentTrail & Multi-Workspaces\x1b[36m│\x1b[0m',
+        '\x1b[36m│\x1b[0m                                                                              \x1b[36m│\x1b[0m',
+        '\x1b[36m╰──────────────────────────────────────────────────────────────────────────────╯\x1b[0m\n'
+    ].join('\n');
+}
+
 async function main() {
+    if (process.argv[2] === 'store') {
+        const storeScript = path.join(srcDir, 'bin', 'aos-store.mjs');
+        const result = spawnSync(process.execPath, [storeScript, ...process.argv.slice(3)], { stdio: 'inherit' });
+        process.exitCode = result.status == null ? 1 : result.status;
+        return;
+    }
+    if (process.argv[2] === 'doctor' || process.argv[2] === 'checkup' || process.argv.includes('--doctor')) {
+        const doctorScript = path.join(srcDir, 'bin', 'aos-doctor.mjs');
+        const doctorArgs = process.argv.slice(process.argv[2] === 'doctor' || process.argv[2] === 'checkup' ? 3 : 2).filter(a => a !== '--doctor');
+        const result = spawnSync(process.execPath, [doctorScript, ...doctorArgs], { stdio: 'inherit' });
+        process.exitCode = result.status == null ? 1 : result.status;
+        return;
+    }
     const skipIntro = isAutoYes || process.argv.includes('--no-intro') || process.argv.includes('--no-animation');
     await renderKineticIntro({ rotations: 1, fps: 12.5, skip: skipIntro, pkgVersion: pkg.version });
     console.log(buildWordmarkBanner());
@@ -4827,6 +4871,7 @@ async function main() {
 
     intro(buildHeroHeader(pkg.version));
     console.log(buildTelemetryCard({ installState, detections, daemonStatus }));
+    console.log(buildAoAnnouncementBanner());
 
     if (DRY_RUN) {
         // Precise on purpose: version comparison still queries the registry, and
@@ -4869,12 +4914,14 @@ async function main() {
         const options = installState.updateAvailable
             ? [
                 { value: 'quick', label: `⚡ Quick Update (v${installState.localVersion} ➔ v${installState.currentVersion})`, hint: 'refresh skills, templates & daemons' },
+                { value: 'doctor', label: '🩺 Run System Checkup / Doctor', hint: 'verify environment, placement, daemons & AO' },
                 { value: 'project', label: '📁 Drop Local Project Harness', hint: 'copy dispatcher contract to cwd' },
                 { value: 'reconfigure', label: '🛠️ Reconfigure System', hint: 'change targets, tier or options' },
                 { value: 'uninstall', label: '🗑️ Uninstall AOS', hint: 'remove what this installer placed; your data stays' },
                 { value: 'cancel', label: '❌ Exit' }
               ]
             : [
+                { value: 'doctor', label: '🩺 Run System Checkup / Doctor', hint: 'verify environment, placement, daemons & AO' },
                 { value: 'project', label: '📁 Drop Local Project Harness', hint: 'copy dispatcher contract to cwd' },
                 { value: 'quick', label: '🔄 Verify & Refresh All Skills', hint: 're-sync and health check' },
                 { value: 'reconfigure', label: '🛠️ Reconfigure System', hint: 'switch tier or targets' },
@@ -4892,6 +4939,12 @@ async function main() {
             outro('Cancelled.');
             return;
         }
+        if (action === 'doctor') {
+            const doctorScript = path.join(srcDir, 'bin', 'aos-doctor.mjs');
+            spawnSync(process.execPath, [doctorScript], { stdio: 'inherit' });
+            outro('System Checkup complete.');
+            return;
+        }
         if (action === 'project') {
             installProjectHarness();
             outro('Project harness installation complete.');