@hybridlabor-api/aos 4.7.1 → 4.8.0

package/.claude/workflows/startcycle-dispatch.mjs

@@ -823,7 +823,7 @@ if (mandatorySkillNames.length > 0) {
     let message = `--skill named skill(s) that could not be found on this machine: ${missing.join(', ')}. `;
     if (storeMatches.length > 0) {
       message += `Found in the AOS / ECC Store: ${storeMatches.join(', ')}. ` +
-        `Run: aos store install ${storeMatches.join(' ')} ` +
+        `Run: aos store install ${storeMatches.join(' ')} --net ` +
         'Then re-run your startcycle command. ';
     } else if (near.length > 0) {
       message += `Did you mean: ${near.join(', ')}? `;

package/bin/aos-doctor.mjs

@@ -6,7 +6,7 @@
 //   node bin/aos-doctor.mjs [--json] [--net]
 
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { execFileSync, execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { connect } from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
@@ -49,7 +49,7 @@ const add = (area, name, ok, detail, fix, warningOnly = false) => {
 };
 
 const which = (bin) => {
-  const probe = IS_WIN ? 'where' : 'which';
+  const probe = IS_WIN ? 'where.exe' : 'which';
   try {
     return tilde(execFileSync(probe, [bin], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim().split(/\r?\n/)[0]);
   } catch {
@@ -107,6 +107,26 @@ function checkAosCore() {
     manifest ? `v${manifest.version || '4.x'} · tier ${manifest.tier || 'full'} · modules: ${(manifest.installedModules || []).join(', ') || 'default'}` : `${manifestPath} missing or unreadable`,
     'Run the AOS installer: npx @hybridlabor-api/aos@latest');
 
+  // Network version check gated by --net
+  if (NET) {
+    try {
+      const npmBin = IS_WIN ? 'npm.cmd' : 'npm';
+      const latest = execFileSync(npmBin, ['view', '@hybridlabor-api/aos', 'version'], {
+        encoding: 'utf8',
+        timeout: 8000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        shell: IS_WIN
+      }).trim();
+      const currentVer = manifest?.version || '4.7.1';
+      add('aos-core', 'Version vs npm', currentVer === latest, `local v${currentVer} · npm v${latest}`,
+        'Run: npx @hybridlabor-api/aos@latest');
+    } catch {
+      add('aos-core', 'Version vs npm', false, 'npm view failed (offline or network timeout)', 'Re-run with network or omit --net', true);
+    }
+  } else {
+    add('aos-core', 'Version vs npm', true, 'Skipped (offline mode — pass --net to check npm)', '', true);
+  }
+
   // Check store index
   const storeIndexCandidates = [
     path.join(path.dirname(new URL(import.meta.url).pathname), '..', 'lib', 'ecc-store-index.json'),
@@ -284,7 +304,7 @@ async function checkDaemonsAndModules() {
   if (IS_MAC && aoBin) {
     let signed = false;
     try {
-      execSync(`codesign -v "${aoBin}"`, { stdio: 'ignore' });
+      execFileSync('codesign', ['-v', aoBin], { stdio: 'ignore' });
       signed = true;
     } catch {}
     add('security', 'AO Binary Signature (AMFI)', signed,

package/bin/aos-store.mjs

@@ -12,6 +12,7 @@ const index = JSON.parse(readFileSync(INDEX_PATH, 'utf8'));
 const args = process.argv.slice(2);
 const dryRun = args.includes('--dry-run');
 const project = args.includes('--project');
+const net = args.includes('--net');
 const positional = args.filter((arg) => !arg.startsWith('--'));
 const option = (name) => args.find((arg) => arg === name || arg.startsWith(`${name}=`))?.split('=').slice(1).join('=');
 
@@ -121,6 +122,9 @@ async function install(name) {
     for (const target of targets) console.log(`[dry-run] write ${target}`);
     return;
   }
+  if (!net) {
+    throw new Error(`Downloading '${name}' requires internet access to fetch from upstream GitHub. Pass --net to confirm: aos store install ${name} --net`);
+  }
   const content = await download(item.upstream_path);
   const digest = createHash('sha256').update(content).digest('hex');
   if (digest !== item.sha256) throw new Error(`SHA-256 mismatch for ${name}: expected ${item.sha256}, got ${digest}`);
@@ -135,7 +139,7 @@ function usage() {
   console.log('Usage:');
   console.log('  aos store list [--type=skills|agents]');
   console.log('  aos store search <query>');
-  console.log('  aos store install <name> [--project] [--dry-run]');
+  console.log('  aos store install <name> [--project] [--dry-run] [--net]');
 }
 
 async function main() {

package/installer.js

@@ -41,7 +41,7 @@ function verifyDaemonListening(port, name, timeoutMs = 4000) {
         tryConnect();
     });
 }
-const { execSync, spawn, spawnSync, exec } = require('child_process');
+const { execSync, spawn, spawnSync, exec, execFileSync } = require('child_process');
 const clack = require('@clack/prompts');
 
 const {
@@ -233,8 +233,12 @@ const conditionalMcpConfigKeys = [
 
 function hasExecutable(binary) {
     try {
-        const lookup = process.platform === 'win32' ? `where ${binary}` : `command -v ${binary}`;
-        execSync(lookup, { stdio: 'ignore' });
+        if (process.platform === 'win32') {
+            execFileSync('where.exe', [binary], { stdio: 'ignore' });
+        } else {
+            if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(binary)) return false;
+            execSync(`command -v ${binary}`, { stdio: 'ignore' });
+        }
         return true;
     } catch (e) {
         return false;
@@ -250,7 +254,7 @@ function findWindowsGoBin() {
     if (process.platform !== 'win32') return null;
     const candidates = [];
     try {
-        const found = execSync('where.exe go', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+        const found = execFileSync('where.exe', ['go'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
             .split(/\r?\n/).map(s => s.trim()).find(Boolean);
         if (found) candidates.push(path.dirname(found));
     } catch (_) { /* PATH can be stale immediately after installation */ }
@@ -1705,7 +1709,8 @@ function checkModuleUpdate(pkgName, targetDir) {
         let remoteVer = null;
         let checkFailed = false;
         try {
-            remoteVer = execSync(`npm view ${pkgName} version`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8', timeout: 4000 }).trim();
+            const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+            remoteVer = execFileSync(npmBin, ['view', pkgName, 'version'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8', timeout: 4000, shell: process.platform === 'win32' }).trim();
         } catch (e) {
             // Offline, a proxy, or a misconfigured registry. Swallowing this
             // made every module report "up to date" forever on such a machine,
@@ -2046,13 +2051,23 @@ async function installSynapse() {
     }
 
     const isWin = process.platform === 'win32';
-    const binaryName = isWin ? 'synapse.js' : 'synapse';
-    let binaryPath = path.join(synapseDir, 'bin', binaryName);
-    if (!fs.existsSync(binaryPath)) {
-        if (process.platform === 'darwin' && fs.existsSync(path.join(synapseDir, 'bin', 'synapse-darwin-arm64'))) {
-            binaryPath = path.join(synapseDir, 'bin', 'synapse-darwin-arm64');
-        } else if (process.platform === 'linux' && fs.existsSync(path.join(synapseDir, 'bin', 'synapse-linux-amd64'))) {
-            binaryPath = path.join(synapseDir, 'bin', 'synapse-linux-amd64');
+    let binaryPath;
+    if (isWin) {
+        if (fs.existsSync(path.join(synapseDir, 'bin', 'synapse.exe'))) {
+            binaryPath = path.join(synapseDir, 'bin', 'synapse.exe');
+        } else if (fs.existsSync(path.join(synapseDir, 'bin', 'synapse-windows-amd64.exe'))) {
+            binaryPath = path.join(synapseDir, 'bin', 'synapse-windows-amd64.exe');
+        } else {
+            binaryPath = path.join(synapseDir, 'bin', 'synapse.js');
+        }
+    } else {
+        binaryPath = path.join(synapseDir, 'bin', 'synapse');
+        if (!fs.existsSync(binaryPath)) {
+            if (process.platform === 'darwin' && fs.existsSync(path.join(synapseDir, 'bin', 'synapse-darwin-arm64'))) {
+                binaryPath = path.join(synapseDir, 'bin', 'synapse-darwin-arm64');
+            } else if (process.platform === 'linux' && fs.existsSync(path.join(synapseDir, 'bin', 'synapse-linux-amd64'))) {
+                binaryPath = path.join(synapseDir, 'bin', 'synapse-linux-amd64');
+            }
         }
     }
 
@@ -2192,8 +2207,11 @@ async function installOpenWikiVisualizer() {
     // bin dir, so resolve the absolute binary path now instead of relying on PATH at boot.
     let openwikiBin = 'openwiki';
     try {
-        const lookup = process.platform === 'win32' ? 'where openwiki' : 'command -v openwiki';
-        openwikiBin = execSync(lookup, { encoding: 'utf8' }).split(/\r?\n/)[0].trim() || 'openwiki';
+        if (process.platform === 'win32') {
+            openwikiBin = execFileSync('where.exe', ['openwiki'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'openwiki';
+        } else {
+            openwikiBin = execSync('command -v openwiki', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'openwiki';
+        }
     } catch (e) { logDebug(e, 'openwiki path lookup'); }
 
     // The openwiki CLI is a Node script (#!/usr/bin/env node shebang). Under
@@ -2202,8 +2220,11 @@ async function installOpenWikiVisualizer() {
     // the interpreter itself is baked in as an absolute path.
     let nodeBin = 'node';
     try {
-        const lookup = process.platform === 'win32' ? 'where node' : 'command -v node';
-        nodeBin = execSync(lookup, { encoding: 'utf8' }).split(/\r?\n/)[0].trim() || 'node';
+        if (process.platform === 'win32') {
+            nodeBin = execFileSync('where.exe', ['node'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'node';
+        } else {
+            nodeBin = execSync('command -v node', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split(/\r?\n/)[0].trim() || 'node';
+        }
     } catch (e) { logDebug(e, 'node path lookup'); }
 
     // Which wiki :4321 serves is per-machine setup configuration, not a
@@ -2396,79 +2417,148 @@ async function installDevToolInstaller() {
     }
 }
 
-// AO ships one prebuilt binary: backend/ao-daemon, Mach-O arm64. The package
-// carries Windows and Linux sources but nothing built for them, and its CLI
-// shim picks the first candidate path that EXISTS without checking whether it
-// can run — so on any other platform it hands spawn a Mach-O file and fails
-// with an exec-format error instead of the "go build" hint it means to give.
-// Installing it there would be installing something known not to work.
+// AO is fully supported across macOS (arm64, amd64), Linux (amd64, arm64), and Windows (amd64).
 function aoSupportedHere() {
-    return process.platform === 'darwin' && process.arch === 'arm64';
+    return ['darwin', 'linux', 'win32'].includes(process.platform);
 }
 
 async function installOSAgentWorkspace() {
     if (!aoSupportedHere()) {
-        log.warn(`AO ships only a macOS arm64 binary — skipping on ${process.platform}/${process.arch}.`);
-        log.warn('Build it from source instead: github.com/hybridlabor-api/bdb-agent-orchestrator');
+        log.warn(`AO is not supported on ${process.platform}/${process.arch}.`);
         return;
     }
 
-    const osAgentDir = path.join(moduleBasePath(), 'bdb-agent-orchestrator');
-    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-agent-orchestrator', osAgentDir, 'BDB Agent Orchestrator')) {
-        log.warn('Skipping AO setup: the module could not be downloaded.');
-        return;
+    const isWin = process.platform === 'win32';
+    const isMac = process.platform === 'darwin';
+    const isLinux = process.platform === 'linux';
+
+    // Discover AO directory: check local development checkouts first, then moduleBasePath
+    const candidateDirs = [
+        path.join(homeDir, 'dev', 'agents', 'bdb-agent-orchestrator'),
+        path.join(homeDir, 'dev', 'bdb-dev', 'bdb-agent-orchestrator'),
+        path.join(moduleBasePath(), 'bdb-agent-orchestrator')
+    ];
+    const osAgentDir = candidateDirs.find(d => fs.existsSync(d)) || candidateDirs[candidateDirs.length - 1];
+    const isLocalGitRepo = fs.existsSync(path.join(osAgentDir, '.git'));
+
+    if (isLocalGitRepo) {
+        log.step(`Using local development workspace for AO: ${osAgentDir}`);
+    } else {
+        if (!downloadOrUpdateModule('@hybridlabor-api/bdb-agent-orchestrator', osAgentDir, 'BDB Agent Orchestrator')) {
+            log.warn('Skipping AO setup: the module could not be downloaded.');
+            return;
+        }
     }
     if (DRY_RUN) {
-        log.step('[dry-run] would link ~/.local/bin/ao and run `ao service install`');
+        log.step('[dry-run] would link ao binary and run `ao service install`');
         return;
     }
 
-    const localBinDir = path.join(homeDir, '.local', 'bin');
-    const binTarget = path.join(localBinDir, 'ao');
-    const daemonBin = path.join(osAgentDir, 'backend', 'ao-daemon');
+    const localBinDir = isWin
+        ? path.join(process.env.LOCALAPPDATA || homeDir, 'Programs', 'ao')
+        : path.join(homeDir, '.local', 'bin');
+    const binTarget = path.join(localBinDir, isWin ? 'ao.exe' : 'ao');
+
+    // Platform-specific binary lookup
+    const candidateBinaries = [];
+    if (isWin) {
+        candidateBinaries.push(
+            path.join(osAgentDir, 'backend', 'bin', 'ao-windows-amd64.exe'),
+            path.join(osAgentDir, 'backend', 'bin', 'ao.exe'),
+            path.join(osAgentDir, 'backend', 'ao.exe')
+        );
+    } else if (isMac) {
+        if (process.arch === 'arm64') {
+            candidateBinaries.push(path.join(osAgentDir, 'backend', 'bin', 'ao-darwin-arm64'));
+        } else {
+            candidateBinaries.push(path.join(osAgentDir, 'backend', 'bin', 'ao-darwin-amd64'));
+        }
+        candidateBinaries.push(
+            path.join(osAgentDir, 'backend', 'ao-daemon'),
+            path.join(osAgentDir, 'backend', 'bin', 'ao'),
+            path.join(osAgentDir, 'backend', 'ao')
+        );
+    } else if (isLinux) {
+        if (process.arch === 'arm64') {
+            candidateBinaries.push(path.join(osAgentDir, 'backend', 'bin', 'ao-linux-arm64'));
+        } else {
+            candidateBinaries.push(path.join(osAgentDir, 'backend', 'bin', 'ao-linux-amd64'));
+        }
+        candidateBinaries.push(
+            path.join(osAgentDir, 'backend', 'ao-daemon'),
+            path.join(osAgentDir, 'backend', 'bin', 'ao'),
+            path.join(osAgentDir, 'backend', 'ao')
+        );
+    }
+    let daemonBin = candidateBinaries.find(p => fs.existsSync(p));
 
-    if (!fs.existsSync(daemonBin)) {
-        log.warn(`AO binary missing at ${daemonBin} — package layout changed?`);
+    // Fallback: compile from Go source if Go is installed and binary is not pre-built
+    if (!daemonBin && hasExecutable('go') && fs.existsSync(path.join(osAgentDir, 'backend', 'cmd', 'ao'))) {
+        const s = spinner();
+        s.start('Compiling AO daemon binary from Go source...');
+        try {
+            const buildTarget = path.join(osAgentDir, 'backend', 'bin', isWin ? 'ao.exe' : 'ao');
+            fs.mkdirSync(path.dirname(buildTarget), { recursive: true });
+            execFileSync('go', ['build', '-ldflags=-s -w', '-o', buildTarget, './cmd/ao'], {
+                cwd: path.join(osAgentDir, 'backend'),
+                stdio: 'ignore'
+            });
+            daemonBin = buildTarget;
+            s.stop('Compiled AO daemon binary successfully.');
+        } catch (e) {
+            s.stop(`Failed to compile AO from source: ${e.message}`);
+        }
+    }
+
+    // Fallback: if already installed and functional, keep it
+    if (!daemonBin && fs.existsSync(binTarget)) {
+        try {
+            execFileSync(binTarget, ['--version'], { stdio: 'ignore' });
+            log.step(`Keeping existing working AO binary at ${binTarget}`);
+            daemonBin = binTarget;
+        } catch (_) {}
+    }
+
+    if (!daemonBin) {
+        log.warn(`AO binary missing in ${osAgentDir} — package layout changed or Go build needed.`);
         return;
     }
 
-    installStep('place the ao binary', () => {
-        fs.mkdirSync(localBinDir, { recursive: true });
-        // copyFileSync preserves bytes, so the package's ad-hoc signature
-        // survives. That matters: an unsigned binary at this path is SIGKILLed
-        // by AMFI on launch (exit 137) and reads as a daemon that simply will
-        // not start, with nothing in the log to say why.
-        fs.copyFileSync(daemonBin, binTarget);
-        fs.chmodSync(binTarget, 0o755);
-        log.step(`Installed ao to ${binTarget}`);
-    }, 'AO cannot be started without its binary.');
+    if (daemonBin !== binTarget) {
+        installStep('place the ao binary', () => {
+            fs.mkdirSync(localBinDir, { recursive: true });
+            fs.copyFileSync(daemonBin, binTarget);
+            if (!isWin) {
+                fs.chmodSync(binTarget, 0o755);
+            }
+            log.step(`Installed ao to ${binTarget}`);
+        }, 'AO cannot be started without its binary.');
+    }
 
-    try {
-        execSync(`codesign -v "${binTarget}"`, { stdio: 'ignore' });
-    } catch {
-        log.warn('The ao binary is not code-signed — AMFI will kill it at launch.');
+    // macOS only: code-sign ad-hoc to prevent AMFI SIGKILL
+    if (isMac) {
         try {
-            execSync(`codesign -s - -f "${binTarget}"`, { stdio: 'ignore' });
-            log.step('Signed it ad-hoc.');
-        } catch (e) { log.warn(`Could not sign it: ${e.message}`); }
+            execFileSync('codesign', ['-v', binTarget], { stdio: 'ignore' });
+        } catch {
+            log.warn('The ao binary is not code-signed — AMFI will kill it at launch.');
+            try {
+                execFileSync('codesign', ['-s', '-', '-f', binTarget], { stdio: 'ignore' });
+                log.step('Signed it ad-hoc.');
+            } catch (e) { log.warn(`Could not sign it: ${e.message}`); }
+        }
     }
 
     // AO installs its own service, and does it for macOS, Windows and Linux.
-    // AOS used to hand-write a LaunchAgent instead, labelled
-    // com.bdb.agent-workspace, whose ProgramArguments were just the binary with
-    // NO subcommand -- so launchd started `ao`, which prints help and exits,
-    // and with KeepAlive kept restarting it. The daemon never ran, on any
-    // machine that installed AO through AOS. Delegating to the tool removes
-    // both the wrong label and the wrong arguments, and keeps working when the
-    // service definition changes upstream.
-    const legacyPlist = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.agent-workspace.plist');
-    if (fs.existsSync(legacyPlist)) {
-        try { execSync(`launchctl unload "${legacyPlist}" 2>/dev/null`, { stdio: 'ignore' }); } catch (e) { logDebug(e, 'unload legacy ao agent'); }
-        try { fs.unlinkSync(legacyPlist); log.step('Removed the old com.bdb.agent-workspace service.'); } catch (e) { logDebug(e, 'remove legacy plist'); }
+    if (isMac) {
+        const legacyPlist = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.agent-workspace.plist');
+        if (fs.existsSync(legacyPlist)) {
+            try { execFileSync('launchctl', ['unload', legacyPlist], { stdio: 'ignore' }); } catch (e) { logDebug(e, 'unload legacy ao agent'); }
+            try { fs.unlinkSync(legacyPlist); log.step('Removed the old com.bdb.agent-workspace service.'); } catch (e) { logDebug(e, 'remove legacy plist'); }
+        }
     }
 
     installStep('register the AO service', () => {
-        execSync(`"${binTarget}" service install`, { stdio: 'ignore' });
+        execFileSync(binTarget, ['service', 'install'], { stdio: 'ignore' });
     }, 'Start it by hand with: ao service install');
 
     if (await verifyDaemonListening(3101, 'AO Orchestrator', 8000)) {
@@ -2524,7 +2614,7 @@ function verifyEcosystemInstallation() {
         { name: '1. bdb-synapse', pkg: '@hybridlabor-api/bdb-synapse', paths: [path.join(moduleBasePath(), 'bdb-synapse')] },
         { name: '2. memB', pkg: '@hybridlabor-api/memb', paths: [path.join(moduleBasePath(), 'memB'), path.join(geminiDir, 'config', 'mcps', 'memb-mcp')] },
         { name: '3. heimdall-token-saver', pkg: '@hybridlabor-api/heimdall-token-saver', paths: [path.join(moduleBasePath(), 'heimdall-token-saver'), path.join(srcDir, 'vendor', 'token-saver')] },
-        { name: '4. AO Agent Orchestrator', pkg: '@hybridlabor-api/bdb-agent-orchestrator', paths: [path.join(moduleBasePath(), 'bdb-agent-orchestrator')] },
+        { name: '4. AO Agent Orchestrator', pkg: '@hybridlabor-api/bdb-agent-orchestrator', paths: [path.join(homeDir, 'dev', 'agents', 'bdb-agent-orchestrator'), path.join(moduleBasePath(), 'bdb-agent-orchestrator')] },
         { name: '5. bdb-dev-creator-extension', pkg: '@hybridlabor-api/bdb-dev-creator-extension', paths: [path.join(moduleBasePath(), 'bdb-dev-creator-extension')] },
         { name: '6. bdb-hardware-pcb', pkg: '@hybridlabor-api/bdb-hardware-pcb', paths: [path.join(moduleBasePath(), 'bdb-hardware-pcb')] },
         { name: '7. bdb-os-remote', pkg: '@hybridlabor-api/bdb-os-remote', paths: [path.join(moduleBasePath(), 'bdb-os-remote')] },
@@ -2548,7 +2638,8 @@ function verifyEcosystemInstallation() {
                 let newerVersion = null;
                 let newerTag = null;
                 try {
-                    const distTagsJson = execSync(`npm view ${mod.pkg} dist-tags --json`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8', timeout: 4000 }).trim();
+                    const npmBin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+                    const distTagsJson = execFileSync(npmBin, ['view', mod.pkg, 'dist-tags', '--json'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8', timeout: 4000, shell: process.platform === 'win32' }).trim();
                     const distTags = JSON.parse(distTagsJson);
                     for (const [tag, ver] of Object.entries(distTags)) {
                         if (isNewerVersion(localVer, ver)) {
@@ -2942,8 +3033,11 @@ async function installMcpsForTarget(paths, ctx) {
 
     let uvPath = 'uv';
     try {
-        const whichCmd = process.platform === 'win32' ? 'where uv' : 'which uv';
-        uvPath = execSync(whichCmd, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim().split(/\r?\n/)[0];
+        if (process.platform === 'win32') {
+            uvPath = execFileSync('where.exe', ['uv'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' }).trim().split(/\r?\n/)[0];
+        } else {
+            uvPath = execSync('command -v uv', { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' }).trim().split(/\r?\n/)[0];
+        }
     } catch (e) {
         if (fs.existsSync(path.join(homeDir, '.local', 'bin', 'uv'))) uvPath = path.join(homeDir, '.local', 'bin', 'uv');
         else if (fs.existsSync(path.join(homeDir, '.cargo', 'bin', 'uv'))) uvPath = path.join(homeDir, '.cargo', 'bin', 'uv');
@@ -4782,8 +4876,7 @@ async function runQuickUpdate(installState) {
         if (subId === 'synapse') await installSynapse();
         else if (subId === 'memb') await installMemB(false);
         else if (subId === 'remote') await installOSRemoteGateway();
-        // 'ao' intentionally skipped here even for
-        // existing installs -- see promptOptionalModules() for why.
+        else if (subId === 'ao' && aoSupportedHere()) await installOSAgentWorkspace();
         else if (subId === 'creator') await installCreatorExtension();
         else if (subId === 'hardware') await installHardwarePcb();
         else if (subId === 'installer') await installDevToolInstaller();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.7.1",
+  "version": "4.8.0",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "engines": {
@@ -52,6 +52,7 @@
     ".codex-plugin/",
     ".opencode/",
     "docs/",
+    "!docs/handover/**",
     "assets/",
     "skills/",
     "mcps/",

package/skills/global_config/aos-setup/scripts/aos-doctor.mjs

@@ -52,7 +52,7 @@ const tilde = (p) => (p || '').replace(HOME, '~');
 // `which` does not exist on native Windows; cmd ships `where`, which prints one
 // path per line.
 const which = (bin) => {
-  const probe = process.platform === 'win32' ? 'where' : 'which';
+  const probe = process.platform === 'win32' ? 'where.exe' : 'which';
   try { return tilde(execFileSync(probe, [bin], { encoding: 'utf8' }).trim().split(/\r?\n/)[0]); } catch { return null; }
 };
 const dirCount = (p) => { try { return readdirSync(p, { withFileTypes: true }).filter(d => d.isDirectory()).length; } catch { return 0; } };
@@ -100,7 +100,13 @@ function checkAos() {
 
   if (manifest && NET) {
     try {
-      const latest = execFileSync('npm', ['view', '@hybridlabor-api/aos', 'version'], { encoding: 'utf8', timeout: 8000 }).trim();
+      const npmBin = IS_WIN ? 'npm.cmd' : 'npm';
+      const latest = execFileSync(npmBin, ['view', '@hybridlabor-api/aos', 'version'], {
+        encoding: 'utf8',
+        timeout: 8000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        shell: IS_WIN
+      }).trim();
       add('aos', 'version vs npm', manifest.version === latest, `local v${manifest.version} · npm v${latest}`,
         'npx -y @hybridlabor-api/aos@latest');
     } catch {

package/skills/global_config/ask-tim/SKILL.md

@@ -46,7 +46,7 @@ Reach for `test-driven-development` or `tdd-workflow` on their own when you want
 When no native AOS skill fits, search the markdown-only ECC store before starting a pipeline:
 
 - `aos store search <query>` finds available fallback skills and agents.
-- `aos store install <name>` installs a verified item after explicit user action.
+- `aos store install <name> --net` installs a verified item after explicit user action.
 - `aos store list --type=skills` and `aos store list --type=agents` show the catalogue.
 - The core remains the trusted AOS skill set; the store is a fallback, not a reason to bypass the startcycle validation.
 - A missing `--skill` is reported by the dispatcher with the exact install command. It never downloads during a run.

package/docs/handover/agenttrail-for-ao.md

@@ -1,58 +0,0 @@
-# agenttrail for AO — waiting questions & GO/Nein handover
-
-AO (the Go daemon shipped as `@hybridlabor-api/bdb-agent-orchestrator`, binary at `~/.local/bin/ao`) can mirror what the agenttrail live map shows: an agent that waits on the human appears as a question with GO / Nein, and AO surfaces "Needs you" in its own UI — then types the human's decision into the waiting session (approved_plan_go.md:25, :57). agenttrail is the live-map daemon vendored into AOS at `skills/global_config/agenttrail/bin/agenttrail.mjs`, run as `aos-trail`; one daemon per repo, bound to 127.0.0.1 only. This document lists the HTTP surfaces AO may call and the things it must never do. The ask/answer endpoints are the AOS patch defined in production_artifacts/00_execution_plan.md ({#ask-engine}, lines 8-13) and production_artifacts/approved_plan_go.md; `/whoami` and `/model` already exist in the vendored daemon (agenttrail.mjs:583-584, :674-675).
-
-## What AO calls
-
-### 1. Find the repo's daemon — `GET /whoami`
-
-Probe `http://127.0.0.1:5330` through `5344` and match `repoPath` against the repo AO is working in — the same pattern the daemon itself uses for boot dedup (agenttrail.mjs:733-741):
-
-```sh
-curl -s http://127.0.0.1:$p/whoami
-# {"project":"aos","port":5330,"repoPath":"/Users/tim/dev/bdb-dev/aos-wt-go"}
-```
-
-Stop at the first match. If no daemon answers there is nothing to mirror — do not spawn a daemon from AO; the asker's CLI already prints `start: aos-trail . --plan …` on stderr (00_execution_plan.md:5). The `AGENTTRAIL_PORT` env var pins a single port and wins over the probe range (agenttrail.mjs:91).
-
-### 2. Read open questions — `GET /model`, `GET /ask/<id>`, `GET /events`
-
-- `GET /model` carries `asks`: one object per question `{id, question, askedBy, askedAt, expiryAt, status: 'pending' | 'go' | 'deny', decidedAt, by, expired}`. Show every ask, oldest first (`askedAt` ascending — approved_plan_go.md:36).
-- `GET /ask/<id>` returns one ask plus the last 10 decisions — the "wer · wann · was" log (00_execution_plan.md:13).
-- `GET /events` is the SSE stream; activity ticks carry `asks` too (00_execution_plan.md:10), so AO can mirror live instead of polling.
-
-A pending question past `expiryAt` flips to `status: 'deny'` with `expired: true` — render it greyed out (abgelaufen), never as a live GO/Nein pair (00_execution_plan.md:52).
-
-### 3. Answer — `POST /answer`
-
-```sh
-curl -s -X POST http://127.0.0.1:$port/answer \
-  -H 'Content-Type: application/json' \
-  --data '{"id":"<ask-id>","decision":"go"}'   # or "deny"
-```
-
-- The `content-type` header must be exactly `application/json` — a missing or different header (`text/plain`, JSON with a charset suffix) is rejected (00_execution_plan.md:13).
-- The body `{id, decision}` is capped at 4 KB.
-- `origin`: browser callers always send it, and it must equal the daemon's own `http://localhost:<port>` or `http://127.0.0.1:<port>`; AO is a local non-browser caller and may omit the header entirely (00_execution_plan.md:51 — the curl above does). If AO sends an `origin`, it must be the daemon's own.
-- A valid answer sets the ask's status + `decidedAt` + `by: 'you'` and appends `{question, decision, by, at}` to the timestamped decision log; timeout denials land there too, as `by: 'timeout'` (00_execution_plan.md:13).
-- The daemon binds 127.0.0.1 only (agenttrail.mjs:700) and sets no `Access-Control-*` header and no `OPTIONS` handler anywhere in its route chain (agenttrail.mjs:572-689) — that absence is the CSRF protection for the map's browser buttons. AO must not ask for CORS to be relaxed.
-
-That is the whole surface: AO does not call the daemon's other mutating endpoints (`/spawn`, `/setup`, `/setup-board`, `/hook`) and never writes into the repo — the daemon itself never touches the repo; state lives under `~/.agenttrail` (agenttrail.mjs:307).
-
-## What the answer means
-
-`aos-trail ask "<question>"` blocks until the question is answered or expires and exits 0 on go, 1 on deny/timeout (00_execution_plan.md:5). The default deadline is 30 minutes, overridable per question via the asker's `--timeout <10s|30m|2h|N>`; expiry auto-denies and is logged like a human decision (00_execution_plan.md:52). Questions and the decision log persist across daemon restarts in `~/.agenttrail/<repo-hash>.json` (agenttrail.mjs:308).
-
-## Mirroring in AO's UI
-
-- Pending ask → a pinned "Needs you" card with the question, the asking agent (`askedBy`), elapsed time, and one GO and one Nein button.
-- AO answers `POST /answer` only after the human clicked or said the decision for that exact ask id, and only then may it type that decision into the waiting session (approved_plan_go.md:57 — AO already recognizes "Needs You GO" and can write to the terminal, :25).
-- Re-check `GET /ask/<id>` immediately before typing: the human may have answered on the map instead, or the question may have expired meanwhile.
-
-## Hard rules
-
-- The AO button never authorizes `git push`, `npm publish`, `npm version` or recursive `rm` (approved_plan_go.md:30). Those four stay under go-gate's sole authority (`.claude/hooks/go-gate.mjs:43-49`), which opens only for the literal, human-typed `GO` as the last message in the session transcript (go-gate.mjs:10-13, transcript-only check in main() :116-151). The ask/answer flow only resolves explicit `aos-trail ask` questions and never writes to any session transcript — the map and AO remain "an observer and an answer relay, never a permission system" (00_execution_plan.md:50, approved_plan_go.md:49).
-- Never answer without the human. No batching, no defaults, no "the agent seemed sure" — one answer per explicit human decision, per question id.
-- Never auto-retry a timed-out question. Expiry → deny is final (`by: 'timeout'` in the log); only the human asking again starts a new question (approved_plan_go.md:57; the same "no silent retries / a fresh GO per action" rule the gate runs on, go-gate.mjs:13).
-- Never read `~/.agenttrail/<repo-hash>.json` or anything else inside `~/.agenttrail/` directly (agenttrail.mjs:307-308). Those files are internal state with no format contract — use the HTTP surfaces above.
-- Keep the CSRF contract intact: exact `Content-Type: application/json`, own-or-absent `origin`, and never relay an answer through web content the agent loaded.

package/docs/handover/deja-for-ao.md

@@ -1,51 +0,0 @@
-# deja for AO — session-memory handover
-
-AO (the Go daemon shipped as `@hybridlabor-api/bdb-agent-orchestrator`, binary at `~/.local/bin/ao`) can ask deja — the local session-memory engine installed together with memB by the AOS installer — for project history. This document lists the surfaces AO may call and the two things it must not do. Every command below is verified against deja-vu 0.21.1.
-
-## What AO calls at session start
-
-Run in the project directory:
-
-```sh
-deja wip --json
-```
-
-The answer is what the last session in that directory was doing (deja-vu docs/json-output.md:1192-1223):
-
-```json
-{
-  "schema_version": 2,
-  "session": "ses_fb76fff…",
-  "harness": "opencode",
-  "asked": "the orders worker is exhausting its database connections under load",
-  "decision": "bound every orders-worker query with a context",
-  "files": ["internal/worker/orders.go"],
-  "command": "go test ./internal/worker/...",
-  "command_failed": true,
-  "lines": ["working on: …", "settled: …"]
-}
-```
-
-- `schema_version: 2` is the only guaranteed field. Every other field is optional and omitted when the transcript does not carry it — treat all of them as nullable.
-- `lines` is the inject-verbatim form: one string per fact, in display order. A caller that wants to show the digest reads `lines` and does not re-assemble the fields.
-
-## Untrusted historical data
-
-Everything deja returns is transcript-derived and may carry text an attacker influenced: a directive copied from a web page persists in the index and replays into later sessions. deja-vu wraps its own agent-facing recall in `<deja-recall>` markers with an untrusted-data preamble (deja-vu docs/SECURITY-MODEL.md:235-245). AO must label or wrap the content the same way before it reaches a model, and instructions inside it must not be followed.
-
-## Other surfaces AO may use
-
-- `deja fix "<error>" --json` — what this machine ran after that error. Rows carry `command` or `edit`; `candidate: true` marks ran-next-but-unconfirmed evidence, not a guaranteed fix (deja-vu docs/json-output.md:763).
-- `deja last --json` — recent session metadata, never message bodies (deja-vu docs/json-output.md:200).
-- `deja handoff [id-prefix]` — the handoff digest for a session (deja-vu CLI reference, docs/guide/commands.html).
-- `deja blame <path> --json` — which sessions discussed a file; a top-level JSON array, no envelope (deja-vu docs/json-output.md:1107).
-- `deja doctor --json --offline` — index and store health; `--offline` keeps the version check off the network (deja-vu docs/json-output.md:356).
-
-## Stability contract
-
-Envelope-shaped answers carry `schema_version: 2`. Within a version, changes are additive only: existing field names, types and meanings stay the same. Bumping the version signals a breaking change, so branch on `schema_version` before parsing the rest of the envelope (deja-vu docs/json-output.md:7-28). `deja blame --json` returns a bare array and carries no version; its element shapes are stable.
-
-## Hard rules
-
-- Never read `~/.cache/deja/index.db` or anything else inside the index directory (`manifest.gob`, `sessions.gob`, `records.bin`, the buckets, the sidecars) directly. The format has moved forty-odd times and is explicitly not a contract (deja-vu docs/INTEGRATING.md:102-106). Use the CLI surfaces above.
-- AO must NOT run `deja install --auto` and must not wire session-start auto-recall. The approved AOS plan rules both out (production_artifacts/approved_plan_deja.md:61-66): a second writer into agent configs, and old history injected automatically at every session start, are exactly the injection vectors AOS installed deja to avoid. AO calls the `deja` CLI itself, on demand, in the project directory.