@kvell007/embed-labs-cli 0.1.0-alpha.3 → 0.1.0-alpha.30

package/dist/index.js

@@ -1,24 +1,28 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
+import { createHash, createHmac, generateKeyPairSync, randomBytes, sign as signCrypto } from "node:crypto";
 import { constants } from "node:fs";
 import { spawn } from "node:child_process";
-import { access, cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { access, chmod, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { homedir, tmpdir } from "node:os";
+import { arch, hostname, homedir, platform, tmpdir } from "node:os";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { startServer } from "@embed-labs/local-bridge";
 import { composeBootLogoPackage } from "./image-compose.js";
-import { buildTaishanPiQtSmoke, compileTaishanPiSingleFile, validateLocalToolchain } from "./local-toolchain.js";
+import { buildTaishanPiQtSmoke, compileTaishanPiSingleFile, currentLocalToolchain, installLocalToolchain, latestLocalToolchain, listLocalToolchainEnvironments, validateLocalToolchain } from "./local-toolchain.js";
 import { fail, ok } from "@embed-labs/protocol";
 const require = createRequire(import.meta.url);
 const CLI_MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 const SOURCE_CHECKOUT_ROOT = resolve(CLI_MODULE_DIR, "..", "..", "..");
 const qrcodeTerminal = require("qrcode-terminal");
 const DEFAULT_BRIDGE_URL = process.env.EMBED_BRIDGE_URL ?? "http://127.0.0.1:18083";
-const DEFAULT_CLOUD_API_URL = process.env.EMBED_CLOUD_API_URL ?? "http://127.0.0.1:18100";
+const DEFAULT_CLOUD_API_URL = process.env.EMBED_CLOUD_API_URL ?? "https://api.embedboard.com";
 const DEFAULT_AUTH_FILE = process.env.EMBED_AUTH_FILE ?? ".embed-labs/auth.json";
+const DEFAULT_DEVICE_FILE = process.env.EMBED_DEVICE_FILE ?? join(dirname(DEFAULT_AUTH_FILE), "device.json");
+const DEFAULT_DASHBOARD_URL = process.env.EMBED_DASHBOARD_URL ?? "https://api.embedboard.com/dashboard";
+const EMBED_CLIENT_NAME = "embedlabs-cli";
+const EMBED_CLIENT_VERSION = process.env.EMBED_CLIENT_VERSION ?? "0.1.0";
 const DEFAULT_AGENT_ARTIFACT_DIR = process.env.EMBED_AGENT_ARTIFACT_DIR ?? ".embed-labs/artifacts";
+const TOOL_INTEGRITY_RELOGIN_MESSAGE = "工具完整性校验失败，请在当前电脑重新执行 embedlabs auth login --token <key>";
 const DOCTOR_USAGE = "Usage: embed doctor [--json]";
 const DOCTOR_HTTP_TIMEOUT_MS = 8000;
 const MIN_NODE_MAJOR = 20;
@@ -27,7 +31,19 @@ const DEVICE_PROBE_USAGE = "Usage: embed device probe --host <host> --ports 22,1
 const QUERY_USAGE = "Usage: embed query <natural language request> [--account <account_id>] [--qr] [--json]";
 const DEFAULT_PLUGIN_RELEASE_URL = process.env.EMBED_PLUGIN_RELEASE_URL?.trim() || "https://api.embedboard.com/plugin-releases/agent-plugins/latest";
 const PLUGIN_LIST_USAGE = "Usage: embed plugin list [--release-dir <dir>] [--release-url <url>] [--json]";
+const CODEX_PLUGIN_NAME = "embed-labs";
+const CODEX_MARKETPLACE_NAME = "embed-labs";
+const LEGACY_CODEX_PLUGIN_NAMES = [
+    "dbt-agent",
+    "Dbt Agent",
+    "development-board-toolchain",
+    "development-board-toolchain-dev",
+    "deve"
+];
+const LEGACY_CODEX_MARKETPLACE_NAMES = new Set(["embed-labs-plugins", "plugins", "Plugins", "deve"]);
 const PLUGIN_INSTALL_USAGE = "Usage: embed plugin install <codex|opencode|all> [--release-dir <dir>] [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--force] [--json]";
+const PLUGIN_UPDATE_CHECK_USAGE = "Usage: embed plugin update check [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]";
+const PLUGIN_UPDATE_USAGE = "Usage: embed plugin update <codex|opencode|all> [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]";
 const CLOUD_TASK_ARTIFACTS_USAGE = "Usage: embed cloud task artifacts <task_id> [--json]";
 const CLOUD_TASK_EVIDENCE_USAGE = "Usage: embed cloud task evidence <task_id> [--json]";
 const ARTIFACT_STATUS_USAGE = "Usage: embed artifact status <artifact_id> [--json]";
@@ -81,9 +97,17 @@ const BUILD_IMAGE_BOOT_LOGO_USAGE = "Usage: embed build image boot-logo --logo <
 const IMAGE_BOOT_LOGO_COMPOSE_USAGE = "Usage: embed image boot-logo compose --package <boot-logo-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]";
 const BUILD_IMAGE_DTB_USAGE = "Usage: embed build image dtb --dtb <local.dtb|local.dts> [--input-format auto|dtb|dts] [--account <account_id>] [--project <project_id>] [--board taishanpi] [--variant 1M-RK3566] [--output <package.json>] [--json]";
 const IMAGE_DTB_COMPOSE_USAGE = "Usage: embed image dtb compose --package <dtb-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]";
-const LOCAL_TOOLCHAIN_VALIDATE_USAGE = "Usage: embed local toolchain validate [--release-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_LIST_USAGE = "Usage: embed local toolchain list [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_LATEST_USAGE = "Usage: embed local toolchain latest [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_CURRENT_USAGE = "Usage: embed local toolchain current [--install-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_INSTALL_USAGE = "Usage: embed local toolchain install [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--mode minimal|compile|qt|full|images] [--force] [--json]\nDefault source: the production download channel at download.embedboard.com.";
+const LOCAL_TOOLCHAIN_VALIDATE_USAGE = "Usage: embed local toolchain validate [--release-root <path>] [--mode minimal|compile|qt|full|images] [--json]";
 const LOCAL_COMPILE_TAISHANPI_USAGE = "Usage: embed local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--release-root <path>] [--account <account_id>] [--json]";
 const LOCAL_BUILD_QT_SMOKE_USAGE = "Usage: embed local build qt-smoke --build-dir <dir> [--source <qt-smoke-dir>] [--release-root <path>] [--account <account_id>] [--json]";
+const AUTH_DEVICE_STATUS_USAGE = "Usage: embed auth device status [--json]";
+const AUTH_DEVICE_LIST_USAGE = "Usage: embed auth device list [--json]";
+const AUTH_DEVICE_REVOKE_USAGE = "Usage: embed auth device revoke <device_id> [--json]";
+const AUTH_DEVICE_RENAME_USAGE = "Usage: embed auth device rename <device_id> --label <name> [--json]";
 const BOARD_REGISTRY_LIST_USAGE = "Usage: embed board registry list [--json]";
 const BOARD_REGISTRY_SHOW_USAGE = "Usage: embed board registry show <template_id> [--json]";
 const BOARD_METHODS_USAGE = "Usage: embed board methods <template_id> [--json]";
@@ -93,8 +117,10 @@ const MODEL_LIST_USAGE = "Usage: embed model list [--json]";
 const MODEL_DEFAULT_USAGE = "Usage: embed model default [--json]";
 const SERVICE_MODES_USAGE = "Usage: embed service modes [--json]";
 const AGENT_RUN_USAGE = "Usage: embed agent run --prompt <request> [--account <account_id>] [--workspace <workspace_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--max-tool-calls 6] [--host <ip>] [--ports 22,15301] [--artifact <local_file>|--artifact-id <artifact_id>|--artifact-task <task_id>] [--artifact-output <path>] [--remote-path <path>] [--run] [--approve] [--json]";
+let cachedLocalHardwareFingerprint;
 const TOOL_LIST_USAGE = "Usage: embed tool list [--json]";
 const TOOL_CALL_USAGE = "Usage: embed tool call <capability_id> [--input-json '<json>'] [--approve] [--json]";
+const MCP_TOOL_EVENT_USAGE = "Usage: embed mcp log --tool <tool_name> [--client codex|opencode] [--mode local_ai|server_ai] [--local-device-id <id>] [--server-model-used true|false] [--success true|false] [--request-id <id>] [--duration-ms <ms>] [--input-summary <text>] [--output-summary <text>] [--json]";
 const BOARD_DEPLOY_TAISHANPI_USAGE = "Usage: embed deploy taishanpi --host <ip> --artifact <local_file> --approve [--user root] [--remote-path /userdata/embed-labs/apps/app] [--run] [--timeout 30] [--json]";
 const CLOUD_TASK_EVENT_APPEND_USAGE = "Usage: embed cloud task event append <task_id> [--state <state>] [--progress-stage <stage>|--stage <stage>] [--progress-text <text>|--message <text>] [--progress-percent 0-100] [--severity info|warning|error] [--type <event_type>] [--artifact-json '<json>'] [--evidence-json '<json>'] [--json]";
 const TASK_STATES = new Set([
@@ -144,11 +170,7 @@ async function main(argv) {
             return output(parsed, await bridgePost("/v1/board/taishanpi/deploy", request), renderBoardDeployResult);
         }
         if (area === "bridge" && action === "start") {
-            startServer({
-                host: stringFlag(parsed, "host"),
-                port: numberFlag(parsed, "port")
-            });
-            return await waitForever();
+            return await runBridgeStart(parsed);
         }
         if (area === "bridge" && action === "status") {
             return output(parsed, await bridgeGet("/healthz"), renderBridgeStatus);
@@ -276,7 +298,18 @@ async function main(argv) {
                 const result = await pluginInstall(parsed);
                 return output(parsed, result, renderPluginInstall, result.ok ? 0 : 2);
             }
-            return output(parsed, fail("invalid_args", [PLUGIN_LIST_USAGE, PLUGIN_INSTALL_USAGE].join("\n")), undefined, 2);
+            if (action === "update") {
+                if (parsed.command[2] === "check") {
+                    const result = await pluginUpdateCheck(parsed);
+                    return output(parsed, result, renderPluginUpdateCheck, result.ok ? 0 : 2);
+                }
+                if (["codex", "opencode", "all"].includes(parsed.command[2] ?? "")) {
+                    const result = await pluginUpdate(parsed);
+                    return output(parsed, result, renderPluginInstall, result.ok ? 0 : 2);
+                }
+                return output(parsed, fail("invalid_args", [PLUGIN_UPDATE_CHECK_USAGE, PLUGIN_UPDATE_USAGE].join("\n")), undefined, 2);
+            }
+            return output(parsed, fail("invalid_args", [PLUGIN_LIST_USAGE, PLUGIN_INSTALL_USAGE, PLUGIN_UPDATE_CHECK_USAGE, PLUGIN_UPDATE_USAGE].join("\n")), undefined, 2);
         }
         if (area === "auth" && action === "login") {
             const result = await authLogin(parsed);
@@ -285,6 +318,31 @@ async function main(argv) {
         if (area === "auth" && action === "status") {
             return output(parsed, ok(await authStatus()), renderAuthStatus);
         }
+        if (area === "auth" && action === "device") {
+            const deviceAction = parsed.command[2] ?? "status";
+            if (deviceAction === "status") {
+                const result = await authDeviceStatus(parsed);
+                return output(parsed, result, renderAuthDeviceStatus, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "list") {
+                const result = await authDeviceList(parsed);
+                return output(parsed, result, renderAuthDeviceList, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "revoke") {
+                const result = await authDeviceRevoke(parsed);
+                return output(parsed, result, renderAuthDevice, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "rename") {
+                const result = await authDeviceRename(parsed);
+                return output(parsed, result, renderAuthDevice, result.ok ? 0 : 2);
+            }
+            return output(parsed, fail("invalid_args", [
+                AUTH_DEVICE_STATUS_USAGE,
+                AUTH_DEVICE_LIST_USAGE,
+                AUTH_DEVICE_REVOKE_USAGE,
+                AUTH_DEVICE_RENAME_USAGE
+            ].join("\n")), undefined, 2);
+        }
         if (area === "auth" && action === "logout") {
             await rm(DEFAULT_AUTH_FILE, { force: true });
             return output(parsed, ok(await authStatus()), renderAuthStatus);
@@ -364,6 +422,16 @@ async function main(argv) {
                 USAGE_EVENTS_USAGE
             ].join("\n")), undefined, 2);
         }
+        if (area === "mcp") {
+            if (action === "log" || action === "tool-event") {
+                const body = mcpToolEventBody(parsed);
+                if (typeof body === "string") {
+                    return output(parsed, fail("invalid_args", body), undefined, 2);
+                }
+                return output(parsed, await cloudPost("/v1/mcp/tool-events", body), renderMcpToolEvent);
+            }
+            return output(parsed, fail("invalid_args", MCP_TOOL_EVENT_USAGE), undefined, 2);
+        }
         if (area === "billing") {
             if (action === "statement") {
                 const request = billingStatementRequest(parsed);
@@ -503,12 +571,40 @@ async function main(argv) {
             return output(parsed, fail("invalid_args", [IMAGE_BOOT_LOGO_COMPOSE_USAGE, IMAGE_DTB_COMPOSE_USAGE].join("\n")), undefined, 2);
         }
         if (area === "local") {
+            if (action === "toolchain" && parsed.command[2] === "list") {
+                const request = localToolchainListRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await listLocalToolchainEnvironments(request)), renderLocalToolchainList);
+            }
+            if (action === "toolchain" && parsed.command[2] === "latest") {
+                const request = localToolchainLatestRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await latestLocalToolchain(request)), renderLocalToolchainLatest);
+            }
+            if (action === "toolchain" && parsed.command[2] === "current") {
+                const request = localToolchainCurrentRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await currentLocalToolchain(request.installRoot)), renderLocalToolchainCurrent);
+            }
+            if (action === "toolchain" && parsed.command[2] === "install") {
+                const request = localToolchainInstallRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await installLocalToolchain(request)), renderLocalToolchainInstall);
+            }
             if (action === "toolchain" && parsed.command[2] === "validate") {
                 const request = localToolchainValidateRequest(parsed);
                 if (typeof request === "string") {
                     return output(parsed, fail("invalid_args", request), undefined, 2);
                 }
-                return output(parsed, ok(await validateLocalToolchain(request.releaseRoot)), renderLocalToolchainValidation);
+                return output(parsed, ok(await validateLocalToolchain(request)), renderLocalToolchainValidation);
             }
             if (action === "compile" && parsed.command[2] === "taishanpi") {
                 const request = localCompileTaishanPiRequest(parsed, await authStatus());
@@ -525,6 +621,10 @@ async function main(argv) {
                 return output(parsed, ok(await buildTaishanPiQtSmoke(request)), renderLocalCompileResult);
             }
             return output(parsed, fail("invalid_args", [
+                LOCAL_TOOLCHAIN_LIST_USAGE,
+                LOCAL_TOOLCHAIN_LATEST_USAGE,
+                LOCAL_TOOLCHAIN_CURRENT_USAGE,
+                LOCAL_TOOLCHAIN_INSTALL_USAGE,
                 LOCAL_TOOLCHAIN_VALIDATE_USAGE,
                 LOCAL_COMPILE_TAISHANPI_USAGE,
                 LOCAL_BUILD_QT_SMOKE_USAGE
@@ -1099,11 +1199,11 @@ async function doctor() {
     const bridgeHealth = await apiDoctorCheck("bridge_health", "Local Bridge health", `${bridgeBaseUrl}/healthz`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderHealthSummary, healthStatus);
     checks.push(bridgeHealth);
     if (isUsableDoctorCheck(bridgeHealth)) {
-        checks.push(await apiDoctorCheck("device_scan", "Device scan", `${bridgeBaseUrl}/v1/devices`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDeviceScanSummary, warningIfWarnings));
+        checks.push(await apiDoctorCheck("device_scan", "Device inventory", `${bridgeBaseUrl}/v1/devices`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDeviceScanSummary, warningIfWarnings));
         checks.push(await apiDoctorCheck("debug_tools", "Debug tool scan", `${bridgeBaseUrl}/v1/debug/tools`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDebugToolScanSummary, warningIfWarnings));
     }
     else {
-        checks.push(dependentDoctorCheck("device_scan", "Device scan", `${bridgeBaseUrl}/v1/devices`, "Device scan requires a reachable Local Bridge."));
+        checks.push(dependentDoctorCheck("device_scan", "Device inventory", `${bridgeBaseUrl}/v1/devices`, "Device inventory requires a reachable Local Bridge."));
         checks.push(dependentDoctorCheck("debug_tools", "Debug tool scan", `${bridgeBaseUrl}/v1/debug/tools`, "Debug tool scan requires a reachable Local Bridge."));
     }
     checks.push(await apiDoctorCheck("cloud_api_health", "Cloud API health", `${cloudBaseUrl}/healthz`, "cloud_api_unreachable", `Cloud API is unreachable at ${cloudBaseUrl}.`, renderHealthSummary, healthStatus));
@@ -1162,7 +1262,8 @@ function authDoctorCheck(status) {
             : {
                 code: "auth_not_ready",
                 message: "No CLI auth token is configured.",
-                remediation: "Run: embed auth login --token <token>"
+                remediation: cloudAuthSetupRemediation(),
+                details: cloudAuthSetupDetails()
             }
     };
 }
@@ -1295,7 +1396,7 @@ function warningIfWarnings(data) {
 }
 function renderDeviceScanSummary(result) {
     const warningText = result.warnings?.length ? ` ${result.warnings.length} warning(s).` : "";
-    return `Device scan completed: ${result.devices.length} device(s), ${result.usb.length} USB item(s), ${result.serial.length} serial port(s).${warningText}`;
+    return `Device inventory snapshot: ${result.devices.length} device(s), ${result.usb.length} USB item(s), ${result.serial.length} serial port(s).${warningText}`;
 }
 function renderDebugToolScanSummary(result) {
     const available = result.tools.filter((tool) => tool.available).length;
@@ -1313,16 +1414,142 @@ function isApiResponse(value) {
     return isJsonObject(error) && typeof error.code === "string" && typeof error.message === "string";
 }
 async function bridgeGet(path) {
-    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`);
-    return await response.json();
+    return await bridgeRequest("GET", path);
 }
 async function bridgePost(path, body) {
-    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body)
+    return await bridgeRequest("POST", path, body);
+}
+async function bridgeRequest(method, path, body) {
+    const bodyText = body === undefined ? "" : JSON.stringify(body);
+    const makeRequest = async () => {
+        const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
+            method,
+            headers: bridgeHeaders(method, path, method === "POST" ? bodyText : "", method === "POST" ? { "content-type": "application/json" } : {}),
+            body: method === "POST" ? bodyText : undefined
+        });
+        return await response.json();
+    };
+    try {
+        return await makeRequest();
+    }
+    catch (error) {
+        if (!isBridgeConnectionFailure(error)) {
+            throw error;
+        }
+        const started = await ensureBridgeStartedForRequest();
+        if (!started.ok) {
+            return started;
+        }
+        return await makeRequest();
+    }
+}
+function bridgeHeaders(method, path, bodyText, base = {}) {
+    const token = process.env.EMBED_BRIDGE_TOKEN?.trim();
+    if (!token) {
+        return base;
+    }
+    const headers = {
+        ...base,
+        authorization: `Bearer ${token}`
+    };
+    addBridgeRequestSignature(headers, method, path, bodyText, token);
+    return headers;
+}
+function addBridgeRequestSignature(headers, method, pathWithQuery, bodyText, token) {
+    if (process.env.EMBED_BRIDGE_SIGNING === "0") {
+        return;
+    }
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const nonce = randomBytes(16).toString("hex");
+    const bodySha256 = createHash("sha256").update(bodyText).digest("hex");
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const canonical = cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256);
+    headers["x-embed-key-id"] = keyId;
+    headers["x-embed-timestamp"] = timestamp;
+    headers["x-embed-nonce"] = nonce;
+    headers["x-embed-body-sha256"] = bodySha256;
+    headers["x-embed-signature"] = createHmac("sha256", token).update(canonical).digest("hex");
+}
+function isBridgeConnectionFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes("fetch failed") ||
+        message.includes("ECONNREFUSED") ||
+        message.includes("ECONNRESET") ||
+        message.includes("UND_ERR_SOCKET");
+}
+async function ensureBridgeStartedForRequest() {
+    if (process.env.EMBED_BRIDGE_AUTO_START === "0") {
+        return fail("bridge_unavailable", `embed-local-bridge is not running at ${DEFAULT_BRIDGE_URL}.`, {
+            remediation: `Start it with: embed bridge start`
+        });
+    }
+    let bridgeURL;
+    try {
+        bridgeURL = new URL(DEFAULT_BRIDGE_URL);
+    }
+    catch {
+        return fail("bridge_url_invalid", `EMBED_BRIDGE_URL is not a valid URL: ${DEFAULT_BRIDGE_URL}`);
+    }
+    if (!isLocalBridgeURL(bridgeURL)) {
+        return fail("bridge_unavailable", `embed-local-bridge is not reachable at ${DEFAULT_BRIDGE_URL}.`, {
+            remediation: `Start the bridge for that host, or set EMBED_BRIDGE_URL to a local bridge URL.`
+        });
+    }
+    const launcher = await resolveBridgeLauncher();
+    const host = bridgeURL.hostname === "::1" ? "::1" : bridgeURL.hostname || "127.0.0.1";
+    const port = bridgeURL.port || "18083";
+    const env = {
+        ...process.env,
+        EMBED_BRIDGE_HOST: host,
+        EMBED_BRIDGE_PORT: port
+    };
+    const child = spawn(launcher.command, [...launcher.args, "--host", host, "--port", port], {
+        cwd: process.cwd(),
+        detached: true,
+        stdio: "ignore",
+        env
+    });
+    child.unref();
+    const ready = await waitForBridgeHealth(bridgeURL, 8000);
+    if (!ready.ok) {
+        return ready;
+    }
+    return ok({
+        started: true,
+        bridge_url: DEFAULT_BRIDGE_URL,
+        command: launcher.command
+    });
+}
+function isLocalBridgeURL(url) {
+    const host = url.hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+async function waitForBridgeHealth(bridgeURL, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError = "";
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(new URL("/healthz", bridgeURL), {
+                headers: bridgeHeaders("GET", "/healthz", "")
+            });
+            const parsed = await response.json();
+            if (parsed.ok) {
+                return parsed;
+            }
+            lastError = parsed.error?.message ?? `HTTP ${response.status}`;
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error.message : String(error);
+        }
+        await delay(100);
+    }
+    return fail("bridge_start_failed", `embed-local-bridge did not become healthy at ${DEFAULT_BRIDGE_URL}.`, {
+        remediation: `Run embed bridge start in a separate terminal and retry.`,
+        details: { last_error: lastError }
     });
-    return await response.json();
+}
+function delay(ms) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));
 }
 async function cloudGet(path) {
     return await cloudRequest("GET", path);
@@ -1333,16 +1560,23 @@ async function cloudPost(path, body) {
 async function cloudDownloadArtifact(artifactId, outputPath) {
     try {
         const headers = {};
-        const token = await cloudAuthToken();
-        if (token) {
-            headers.authorization = `Bearer ${token}`;
+        const auth = await cloudAuthConfig();
+        if (auth.token) {
+            if (auth.device) {
+                const integrity = await validateLocalDeviceIntegrity(auth.device);
+                if (!integrity.ok) {
+                    return integrity;
+                }
+            }
+            headers.authorization = `Bearer ${auth.token}`;
+            addCloudRequestSignature(headers, "GET", `/v1/artifacts/${encodeURIComponent(artifactId)}/download`, "", auth.token, auth.device);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}/v1/artifacts/${encodeURIComponent(artifactId)}/download`, {
             headers: Object.keys(headers).length > 0 ? headers : undefined
         });
         if (!response.ok) {
             const parsed = await parseErrorResponse(response);
-            return parsed ?? fail("artifact_download_failed", `Artifact download failed with HTTP ${response.status}.`);
+            return parsed ? enrichCloudAuthFailure(parsed, Boolean(auth.token)) : fail("artifact_download_failed", `Artifact download failed with HTTP ${response.status}.`);
         }
         const bytes = Buffer.from(await response.arrayBuffer());
         const expectedSha256 = response.headers.get("x-embed-artifact-sha256")?.trim();
@@ -1371,19 +1605,28 @@ async function cloudDownloadArtifact(artifactId, outputPath) {
 async function cloudRequest(method, path, body) {
     try {
         const headers = {};
-        if (body !== undefined) {
+        const bodyText = body === undefined ? "" : JSON.stringify(body);
+        if (bodyText) {
             headers["content-type"] = "application/json";
         }
-        const token = await cloudAuthToken();
-        if (token) {
-            headers.authorization = `Bearer ${token}`;
+        const auth = await cloudAuthConfig();
+        if (auth.token) {
+            if (auth.device) {
+                const integrity = await validateLocalDeviceIntegrity(auth.device);
+                if (!integrity.ok) {
+                    return integrity;
+                }
+            }
+            headers.authorization = `Bearer ${auth.token}`;
+            addCloudRequestSignature(headers, method, path, bodyText, auth.token, auth.device);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}${path}`, {
             method,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
-            body: body === undefined ? undefined : JSON.stringify(body)
+            body: body === undefined ? undefined : bodyText
         });
-        return await response.json();
+        const parsed = await response.json();
+        return enrichCloudAuthFailure(parsed, Boolean(auth.token));
     }
     catch (error) {
         return fail("cloud_api_unreachable", error instanceof Error ? error.message : String(error), {
@@ -1391,6 +1634,129 @@ async function cloudRequest(method, path, body) {
         });
     }
 }
+async function validateLocalDeviceIntegrity(device) {
+    const current = await localHardwareFingerprint();
+    if (current.fingerprint_hash === device.fingerprint_hash) {
+        return ok(undefined);
+    }
+    return fail("tool_integrity_check_failed", TOOL_INTEGRITY_RELOGIN_MESSAGE, {
+        remediation: [
+            "当前 Embed Labs CLI/插件配置绑定的电脑与本机硬件唯一码不一致。",
+            TOOL_INTEGRITY_RELOGIN_MESSAGE,
+            "如果账号设备数量已达上限，请先在原电脑或用户后台撤销旧设备。"
+        ].join("\n"),
+        details: {
+            expected_fingerprint_hash: device.fingerprint_hash,
+            current_fingerprint_hash: current.fingerprint_hash,
+            platform: current.platform,
+            arch: current.arch,
+            fingerprint_source: current.source
+        }
+    });
+}
+function enrichCloudAuthFailure(response, hadToken) {
+    if (response.ok) {
+        return response;
+    }
+    if (response.error.code.startsWith("device_") || response.error.code.startsWith("request_signature_")) {
+        return fail(response.error.code, response.error.message, {
+            remediation: [
+                "This computer is not fully registered for the configured Embed Labs API Token.",
+                "Run: embedlabs auth login --token <your_token>",
+                "Then verify with: embedlabs auth device status",
+                "If the account already has too many devices, revoke one with: embedlabs auth device revoke <device_id>"
+            ].join("\n"),
+            details: response.error.details
+        });
+    }
+    if (response.error.code !== "unauthorized") {
+        return response;
+    }
+    if (!hadToken) {
+        return fail("auth_token_missing", "Embed Labs API Token is not configured. Register or sign in, create an API Token, then configure it locally before using cloud and plugin services.", {
+            remediation: cloudAuthSetupRemediation(),
+            details: cloudAuthSetupDetails()
+        });
+    }
+    return fail("auth_token_rejected", "The configured Embed Labs API Token was rejected by the server. Recreate or copy a fresh token from the dashboard and sign in again.", {
+        remediation: cloudAuthSetupRemediation(),
+        details: cloudAuthSetupDetails()
+    });
+}
+function cloudAuthSetupRemediation() {
+    return [
+        `1. Open ${DEFAULT_DASHBOARD_URL} and register or sign in.`,
+        "2. Create or copy your Embed Labs API Token from the user dashboard.",
+        "3. Run: embedlabs auth login --token <your_token>",
+        "4. For automation, set: EMBED_API_TOKEN=<your_token>",
+        "5. Verify with: embedlabs auth status"
+    ].join("\n");
+}
+function cloudAuthSetupDetails() {
+    return {
+        dashboard_url: DEFAULT_DASHBOARD_URL,
+        login_command: "embedlabs auth login --token <your_token>",
+        env_var: "EMBED_API_TOKEN",
+        auth_status_command: "embedlabs auth status",
+        auth_file: DEFAULT_AUTH_FILE
+    };
+}
+function addCloudRequestSignature(headers, method, pathWithQuery, bodyText, token, device) {
+    if (process.env.EMBED_CLOUD_API_SIGNING === "0") {
+        return;
+    }
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const nonce = randomBytes(16).toString("hex");
+    const bodySha256 = createHash("sha256").update(bodyText).digest("hex");
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const canonical = device
+        ? cloudRequestCanonicalStringV2(method, pathWithQuery, timestamp, nonce, bodySha256, device, EMBED_CLIENT_NAME, EMBED_CLIENT_VERSION)
+        : cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256);
+    headers["x-embed-key-id"] = keyId;
+    headers["x-embed-timestamp"] = timestamp;
+    headers["x-embed-nonce"] = nonce;
+    headers["x-embed-body-sha256"] = bodySha256;
+    if (device) {
+        headers["x-embed-signature-version"] = "v2";
+        headers["x-embed-device-id"] = device.device_id;
+        headers["x-embed-device-fingerprint-sha256"] = device.fingerprint_hash;
+        headers["x-embed-client-name"] = EMBED_CLIENT_NAME;
+        headers["x-embed-client-version"] = EMBED_CLIENT_VERSION;
+        headers["x-embed-device-signature"] = signCrypto(null, Buffer.from(canonical), device.private_key_pem).toString("base64url");
+    }
+    headers["x-embed-signature"] = createHmac("sha256", token).update(canonical).digest("hex");
+}
+function cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256) {
+    return [
+        method.toUpperCase(),
+        normalizeCloudPathForSignature(pathWithQuery),
+        timestamp,
+        nonce,
+        bodySha256
+    ].join("\n");
+}
+function cloudRequestCanonicalStringV2(method, pathWithQuery, timestamp, nonce, bodySha256, device, clientName, clientVersion) {
+    return [
+        method.toUpperCase(),
+        normalizeCloudPathForSignature(pathWithQuery),
+        timestamp,
+        nonce,
+        bodySha256,
+        device.device_id,
+        device.fingerprint_hash,
+        clientName,
+        clientVersion
+    ].join("\n");
+}
+function normalizeCloudPathForSignature(pathWithQuery) {
+    try {
+        const parsed = new URL(pathWithQuery, "http://embed.local");
+        return `${parsed.pathname}${parsed.search}`;
+    }
+    catch {
+        return pathWithQuery.startsWith("/") ? pathWithQuery : `/${pathWithQuery}`;
+    }
+}
 async function pluginList(parsed) {
     const releaseDir = stringFlag(parsed, "release-dir");
     const manifest = releaseDir ? await readPluginReleaseManifest(releaseDir) : undefined;
@@ -1490,13 +1856,112 @@ async function pluginInstall(parsed) {
         await rm(tempDir, { recursive: true, force: true });
     }
 }
+async function pluginUpdateCheck(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["release-url", "target", "codex-target", "opencode-target", "json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${PLUGIN_UPDATE_CHECK_USAGE}`);
+    }
+    const unexpected = parsed.command.slice(3);
+    if (unexpected.length > 0) {
+        return fail("invalid_args", `Unexpected argument: ${unexpected[0]}. ${PLUGIN_UPDATE_CHECK_USAGE}`);
+    }
+    const remoteManifest = await fetchRemotePluginManifest(parsed);
+    if (!remoteManifest.ok) {
+        return remoteManifest;
+    }
+    const manifest = remoteManifest.data;
+    const codexPackage = manifest.packages?.find((item) => item.id === "codex-embed-labs");
+    const opencodePackage = manifest.packages?.find((item) => item.id === "opencode-embed-labs");
+    const codexTarget = join(codexPluginTargetRoot(parsed, true), CODEX_PLUGIN_NAME);
+    const openCodeTarget = openCodePluginTargetRoot(parsed, true);
+    return ok({
+        release_url: pluginReleaseBaseUrl(parsed),
+        latest_version: manifest.version,
+        release_notes: normalizedReleaseNotes(manifest.release_notes),
+        plugins: [
+            await pluginUpdateItem({
+                id: "codex",
+                displayName: "Embed Labs Codex plugin",
+                targetPath: codexTarget,
+                installedVersion: await installedCodexPluginVersion(codexTarget),
+                latestVersion: codexPackage?.version ?? manifest.version,
+                releaseFile: codexPackage?.file,
+                updateCommand: "embedlabs plugin update codex"
+            }),
+            await pluginUpdateItem({
+                id: "opencode",
+                displayName: "Embed Labs OpenCode plugin",
+                targetPath: openCodeTarget,
+                installedVersion: await installedOpenCodePluginVersion(openCodeTarget),
+                latestVersion: opencodePackage?.version ?? manifest.version,
+                releaseFile: opencodePackage?.file,
+                updateCommand: "embedlabs plugin update opencode"
+            })
+        ]
+    });
+}
+function normalizedReleaseNotes(notes) {
+    if (!Array.isArray(notes)) {
+        return [];
+    }
+    return notes
+        .filter((item) => typeof item === "string" && item.trim().length > 0)
+        .map((item) => item.trim());
+}
+async function pluginUpdate(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["release-url", "target", "codex-target", "opencode-target", "json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${PLUGIN_UPDATE_USAGE}`);
+    }
+    const target = parsed.command[2];
+    if (!target || !["codex", "opencode", "all"].includes(target)) {
+        return fail("invalid_args", PLUGIN_UPDATE_USAGE);
+    }
+    const unexpected = parsed.command.slice(3);
+    if (unexpected.length > 0) {
+        return fail("invalid_args", `Unexpected argument: ${unexpected[0]}. ${PLUGIN_UPDATE_USAGE}`);
+    }
+    const installParsed = {
+        ...parsed,
+        command: ["plugin", "install", target],
+        flags: { ...parsed.flags, force: true }
+    };
+    return await pluginInstall(installParsed);
+}
+async function pluginUpdateItem(input) {
+    const installed = !!input.installedVersion;
+    const updateAvailable = !!input.latestVersion && input.installedVersion !== input.latestVersion;
+    const notes = [];
+    if (!installed) {
+        notes.push("Plugin is not installed in the selected target.");
+    }
+    else if (updateAvailable) {
+        notes.push("A newer plugin release is available. Run the update command, then restart Codex/OpenCode.");
+    }
+    else {
+        notes.push("Plugin is up to date for the selected release channel.");
+    }
+    return {
+        id: input.id,
+        display_name: input.displayName,
+        installed,
+        installed_version: input.installedVersion,
+        latest_version: input.latestVersion,
+        update_available: updateAvailable,
+        target_path: input.targetPath,
+        release_file: input.releaseFile,
+        update_command: input.updateCommand,
+        notes
+    };
+}
 async function installCodexPlugin(parsed, context) {
     const source = await resolveCodexPluginSource(context);
     if (!source.ok) {
         return source;
     }
     const targetRoot = codexPluginTargetRoot(parsed, context.installingAll);
-    const targetPath = join(targetRoot, "embed-labs");
+    const targetPath = join(targetRoot, CODEX_PLUGIN_NAME);
+    const legacyCleanup = await cleanupLegacyCodexPluginRemnants(targetRoot);
     if (await pathExists(targetPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `Codex plugin already exists at ${targetPath}.`, {
             remediation: "Pass --force to replace it, or pass --codex-target/--target to install into a different directory."
@@ -1506,16 +1971,24 @@ async function installCodexPlugin(parsed, context) {
     await mkdir(targetRoot, { recursive: true });
     await cp(source.data.sourcePath, targetPath, { recursive: true });
     const mcpRegistration = await maybeRegisterCodexMcp(parsed, targetRoot, targetPath);
+    const marketplaceRegistration = await maybeRegisterCodexMarketplace(parsed, targetRoot, targetPath);
     return ok({
         id: "codex",
         target_path: targetPath,
         source: source.data.sourceLabel,
         version: source.data.version,
         command_hint: mcpRegistration.registered
-            ? "Codex MCP was registered. Start a new Codex session to reload tools."
+            ? (marketplaceRegistration.registered
+                ? "Codex MCP and plugin marketplace entry were registered. Fully restart Codex to reload @Embed Labs."
+                : "Codex MCP was registered. Start a new Codex session to reload tools.")
             : mcpRegistration.hint,
+        warning: legacyCodexCleanupWarning(legacyCleanup),
         mcp_registered: mcpRegistration.registered,
-        mcp_warning: mcpRegistration.warning
+        mcp_warning: mcpRegistration.warning,
+        marketplace_registered: marketplaceRegistration.registered,
+        marketplace_path: marketplaceRegistration.marketplacePath,
+        marketplace_warning: marketplaceRegistration.warning,
+        cleanup: legacyCleanup
     });
 }
 async function installOpenCodePlugin(parsed, context) {
@@ -1524,8 +1997,10 @@ async function installOpenCodePlugin(parsed, context) {
         return source;
     }
     const targetRoot = openCodePluginTargetRoot(parsed, context.installingAll);
-    const wrapperPath = join(targetRoot, "plugins", "development-board-toolchain.js");
-    if (await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
+    const globalInstall = isGlobalOpenCodeRoot(targetRoot);
+    const wrapperPath = join(targetRoot, "plugins", "embed-labs.js");
+    const legacyCleanup = await cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall);
+    if (!globalInstall && await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `OpenCode plugin wrapper already exists at ${wrapperPath}.`, {
             remediation: "Pass --force to replace it, or pass --opencode-target/--target to install into a different directory."
         });
@@ -1551,15 +2026,25 @@ async function installOpenCodePlugin(parsed, context) {
         });
     }
     await ensureOpenCodeInstallPackageJson(targetRoot);
-    await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    if (globalInstall) {
+        await rm(wrapperPath, { force: true });
+        legacyCleanup.legacy_removed_config_entries?.push(...await ensureOpenCodeGlobalPluginConfig());
+    }
+    else {
+        await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    }
     const duplicateWarning = await openCodeDuplicatePluginWarning(targetRoot);
+    const cleanupWarning = legacyOpenCodeCleanupWarning(legacyCleanup);
     return ok({
         id: "opencode",
         target_path: targetRoot,
         source: source.data.sourceLabel,
         version: source.data.version,
-        command_hint: "Start OpenCode from the project containing this .opencode directory.",
-        warning: duplicateWarning
+        command_hint: globalInstall
+            ? "Restart OpenCode so the global embed-labs package plugin is reloaded."
+            : "Start OpenCode from the project containing this .opencode directory.",
+        warning: combineWarnings(cleanupWarning, duplicateWarning),
+        cleanup: legacyCleanup
     });
 }
 async function resolveCodexPluginSource(context) {
@@ -1773,7 +2258,458 @@ function openCodePluginTargetRoot(parsed, installingAll) {
     return resolve(target ?? defaultOpenCodeRoot());
 }
 function defaultCodexPluginRoot() {
-    return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "plugins");
+    return join(defaultCodexHome(), "plugins");
+}
+function defaultCodexHome() {
+    return resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
+}
+function codexConfigPath() {
+    return join(defaultCodexHome(), "config.toml");
+}
+async function cleanupLegacyCodexPluginRemnants(targetRoot) {
+    const removedPaths = [];
+    const removedConfigTables = [];
+    const warnings = [];
+    const stoppedProcesses = await stopLegacyCodexPluginProcesses(warnings);
+    const legacyPaths = [
+        join(targetRoot, "cache", CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_NAME)
+    ];
+    for (const marketplaceName of LEGACY_CODEX_MARKETPLACE_NAMES) {
+        legacyPaths.push(join(targetRoot, "cache", marketplaceName, CODEX_PLUGIN_NAME));
+    }
+    for (const pluginName of LEGACY_CODEX_PLUGIN_NAMES) {
+        legacyPaths.push(join(targetRoot, pluginName));
+        legacyPaths.push(join(targetRoot, "cache", pluginName));
+        for (const marketplaceName of [CODEX_MARKETPLACE_NAME, ...LEGACY_CODEX_MARKETPLACE_NAMES]) {
+            legacyPaths.push(join(targetRoot, "cache", marketplaceName, pluginName));
+        }
+    }
+    legacyPaths.push(...await discoverLegacyCodexCachePaths(targetRoot));
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        legacyPaths.push(join(defaultCodexHome(), ".tmp", "plugins"), join(defaultCodexHome(), ".tmp", "plugins.sha"), join(defaultCodexHome(), "ambient-suggestions"), join(defaultCodexHome(), "skills", "dbt-agent"), join(defaultCodexHome(), "skills", "development-board-toolchain-dev"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-live-board-ops"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-platform-plugin-maintenance"));
+        legacyPaths.push(...legacyCodexLocalMarketplacePaths(), ...await discoverLegacyHomeAgentsMarketplacePaths(warnings), ...await discoverLegacyCodexProjectMarketplacePaths(warnings), ...legacyDevelopmentBoardRuntimePluginPaths());
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        const configPath = codexConfigPath();
+        try {
+            if (await pathExists(configPath)) {
+                const current = await readFile(configPath, "utf8");
+                const updated = removeLegacyCodexConfigTables(current);
+                if (updated.text !== current) {
+                    await writeFile(configPath, updated.text, "utf8");
+                }
+                removedConfigTables.push(...updated.removedTables);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not update ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const removedHistoryEntries = await cleanupLegacyCodexTextState(warnings);
+    return {
+        legacy_removed_paths: Array.from(new Set(removedPaths)),
+        legacy_removed_config_tables: removedConfigTables,
+        legacy_removed_history_entries: removedHistoryEntries,
+        legacy_stopped_processes: stoppedProcesses,
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+async function stopLegacyCodexPluginProcesses(warnings) {
+    if (process.platform === "win32")
+        return 0;
+    try {
+        const ps = await runLocalProcess("ps", ["-axo", "pid=,command="]);
+        if (ps.code !== 0)
+            return 0;
+        let stopped = 0;
+        for (const line of ps.stdout.split("\n")) {
+            const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+            if (!match)
+                continue;
+            const pid = Number(match[1]);
+            const command = match[2] || "";
+            if (!isLegacyCodexPluginProcess(command))
+                continue;
+            try {
+                process.kill(pid, "SIGTERM");
+                stopped += 1;
+            }
+            catch (error) {
+                warnings.push(`Could not stop legacy Codex plugin process ${pid}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return stopped;
+    }
+    catch (error) {
+        warnings.push(`Could not scan legacy Codex plugin processes: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexPluginProcess(command) {
+    const trimmed = command.trim();
+    return /^\/.*\/dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed)
+        || /^dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed)
+        || legacyDevelopmentBoardRuntimeProcessPatterns().some((pattern) => pattern.test(trimmed));
+}
+function legacyDevelopmentBoardRuntimeProcessPatterns() {
+    const home = escapeRegExp(homedir());
+    return [
+        new RegExp(`^${home}/Library/development-board-toolchain/agent/bin/dbt-agentd(?:\\s|$)`),
+        new RegExp(`^${home}/Library/Application Support/development-board-toolchain/agent/bin/dbt-agentd(?:\\s|$)`),
+        new RegExp(`^${home}/Library/development-board-toolchain/runtime/dbtctl\\s+status(?:\\s|$)`),
+        new RegExp(`^${home}/Library/Application Support/development-board-toolchain/runtime/dbtctl\\s+status(?:\\s|$)`),
+        new RegExp(`^${home}/.*?/DBT-Agent\\.app/Contents/MacOS/DBT-Agent(?:\\s|$)`)
+    ];
+}
+function legacyDevelopmentBoardRuntimePluginPaths() {
+    return [
+        join(homedir(), "Library", "development-board-toolchain", "runtime", "editor_plugins"),
+        join(homedir(), "Library", "development-board-toolchain", "runtime", "opencode_plugin"),
+        join(homedir(), "Library", "Application Support", "development-board-toolchain", "runtime", "editor_plugins"),
+        join(homedir(), "Library", "Application Support", "development-board-toolchain", "runtime", "opencode_plugin")
+    ];
+}
+function legacyCodexLocalMarketplacePaths() {
+    return Array.from(LEGACY_CODEX_MARKETPLACE_NAMES)
+        .filter((name) => name !== CODEX_MARKETPLACE_NAME)
+        .map((name) => join(defaultCodexHome(), "local-marketplaces", name));
+}
+async function discoverLegacyHomeAgentsMarketplacePaths(warnings) {
+    const paths = [];
+    const pluginRoot = join(homedir(), ".agents", "plugins");
+    try {
+        const entries = await readdir(pluginRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.startsWith("marketplace.json"))
+                continue;
+            const filePath = join(pluginRoot, entry.name);
+            try {
+                const current = await readFile(filePath, "utf8");
+                if (isLegacyHomeAgentsMarketplace(current)) {
+                    paths.push(filePath);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy Codex home marketplace ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+function isLegacyHomeAgentsMarketplace(text) {
+    return marketplaceTextHasLegacyCodexPlugin(text);
+}
+async function discoverLegacyCodexProjectMarketplacePaths(warnings) {
+    const configPath = codexConfigPath();
+    let text = "";
+    try {
+        text = await readFile(configPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const paths = new Set();
+    for (const projectPath of legacyCodexProjectPathsFromConfig(text)) {
+        for (const candidate of [
+            join(projectPath, ".agents", "plugins", "marketplace.json"),
+            join(projectPath, "platform_plugin", ".agents", "plugins", "marketplace.json"),
+            join(projectPath, "platform_plugins", "codex_plugin", ".agents", "plugins", "marketplace.json")
+        ]) {
+            try {
+                if (!await pathExists(candidate))
+                    continue;
+                const current = await readFile(candidate, "utf8");
+                if (marketplaceTextHasLegacyCodexPlugin(current)) {
+                    paths.add(candidate);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy Codex project marketplace ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    return Array.from(paths);
+}
+function legacyCodexProjectPathsFromConfig(text) {
+    const paths = [];
+    const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    for (const line of lines) {
+        const table = parseTomlTableHeader(line);
+        const match = table ? /^projects\."([^"]+)"$/.exec(table) : undefined;
+        if (match?.[1] && /DBT-Agent-Project|development-board-toolchain|dbt-agent/i.test(match[1])) {
+            paths.push(match[1].replace(/\\"/g, '"'));
+        }
+    }
+    return paths;
+}
+function marketplaceTextHasLegacyCodexPlugin(text) {
+    try {
+        const parsed = JSON.parse(text);
+        const marketplaceName = typeof parsed.name === "string" ? parsed.name : "";
+        const marketplaceDisplayName = typeof parsed.interface?.displayName === "string" ? parsed.interface.displayName : "";
+        const marketplaceLooksLegacy = legacyTextHasCodexPluginResidue(marketplaceName)
+            || legacyTextHasCodexPluginResidue(marketplaceDisplayName)
+            || LEGACY_CODEX_MARKETPLACE_NAMES.has(marketplaceName);
+        return (parsed.plugins ?? []).some((plugin) => {
+            const values = [
+                plugin.name,
+                plugin.category,
+                plugin.source?.path,
+                plugin.interface?.displayName
+            ].filter((value) => typeof value === "string");
+            return values.some(legacyTextHasCodexPluginResidue) || marketplaceLooksLegacy && values.some((value) => /embed-labs|dbt|development-board/i.test(value));
+        });
+    }
+    catch {
+        return legacyTextHasCodexPluginResidue(text);
+    }
+}
+async function discoverLegacyCodexCachePaths(targetRoot) {
+    const paths = [];
+    const cacheRoot = join(targetRoot, "cache");
+    try {
+        const marketplaces = await readdir(cacheRoot, { withFileTypes: true });
+        for (const entry of marketplaces) {
+            if (!entry.isDirectory())
+                continue;
+            if (LEGACY_CODEX_MARKETPLACE_NAMES.has(entry.name)) {
+                paths.push(join(cacheRoot, entry.name, CODEX_PLUGIN_NAME));
+            }
+            for (const pluginName of LEGACY_CODEX_PLUGIN_NAMES) {
+                paths.push(join(cacheRoot, entry.name, pluginName));
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+async function cleanupLegacyCodexTextState(warnings) {
+    let removed = 0;
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "history.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "session_index.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "rules", "default.rules"), warnings);
+    return removed;
+}
+async function cleanupLegacyCodexTextFile(filePath, warnings) {
+    try {
+        if (!await pathExists(filePath))
+            return 0;
+        const current = await readFile(filePath, "utf8");
+        const lines = current.split("\n");
+        let removed = 0;
+        const kept = lines.filter((line) => {
+            if (!line)
+                return true;
+            if (isLegacyCodexHistoryMention(line)) {
+                removed += 1;
+                return false;
+            }
+            return true;
+        });
+        if (removed > 0) {
+            await writeFile(filePath, kept.join("\n"), "utf8");
+        }
+        return removed;
+    }
+    catch (error) {
+        warnings.push(`Could not clean Codex legacy text state ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexHistoryMention(line) {
+    return line.includes("plugin://dbt-agent@plugins")
+        || line.includes("plugin://dbt-agent@embed-labs")
+        || line.includes("development-board-toolchain-dev")
+        || line.includes("development-board-toolchain")
+        || /plugin:\/\/Dbt Agent@/i.test(line)
+        || /plugin:\/\/deve@/i.test(line)
+        || /dbt-agent/i.test(line);
+}
+function removeLegacyCodexConfigTables(text) {
+    const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    const output = [];
+    const removedTables = [];
+    let skipping = false;
+    for (const line of lines) {
+        const table = parseTomlTableHeader(line);
+        if (table) {
+            skipping = isLegacyCodexConfigTable(table);
+            if (skipping) {
+                removedTables.push(table);
+                continue;
+            }
+        }
+        if (!skipping) {
+            output.push(line);
+        }
+    }
+    return { text: output.join("").replace(/\n{3,}/g, "\n\n"), removedTables };
+}
+function parseTomlTableHeader(line) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line);
+    return match?.[1]?.trim();
+}
+function isLegacyCodexConfigTable(table) {
+    return /^plugins\."dbt-agent@[^"]+"$/.test(table)
+        || /^plugins\."Dbt Agent@[^"]+"$/i.test(table)
+        || /^plugins\."deve@[^"]+"$/i.test(table)
+        || isLegacyEmbedLabsCodexMarketplaceConfigTable(table)
+        || table === "mcp_servers.dbt-agent"
+        || table.startsWith("mcp_servers.dbt-agent.")
+        || table === 'mcp_servers."dbt-agent"'
+        || table.startsWith('mcp_servers."dbt-agent".')
+        || table === "mcp_servers.deve"
+        || table.startsWith("mcp_servers.deve.")
+        || /^projects\."[^"]*\/DBT-Agent-Project(?:\/[^"]*)?"$/.test(table);
+}
+function isLegacyEmbedLabsCodexMarketplaceConfigTable(table) {
+    for (const marketplaceName of LEGACY_CODEX_MARKETPLACE_NAMES) {
+        if (table === `marketplaces.${marketplaceName}`) {
+            return true;
+        }
+        if (table === `plugins."${CODEX_PLUGIN_NAME}@${marketplaceName}"`) {
+            return true;
+        }
+    }
+    return false;
+}
+function legacyTextHasCodexPluginResidue(value) {
+    return /dbt-agent|Dbt Agent|development-board-toolchain|development-board-toolchain-dev/i.test(value)
+        || value === "deve"
+        || value.replace(/\\/g, "/").includes("/plugins/deve")
+        || value.includes("plugin://deve@");
+}
+function legacyCodexCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} stale/legacy Codex plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_tables?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_tables.length} legacy Codex config table(s)`);
+    }
+    if (cleanup.legacy_removed_history_entries) {
+        parts.push(`removed ${cleanup.legacy_removed_history_entries} legacy Codex text-state mention(s)`);
+    }
+    if (cleanup.legacy_stopped_processes) {
+        parts.push(`stopped ${cleanup.legacy_stopped_processes} legacy Codex plugin process(es)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Codex plugin cleanup: ${parts.join(", ")}.` : undefined;
+}
+async function cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall) {
+    const removedPaths = [];
+    const warnings = [];
+    const legacyPaths = [
+        join(targetRoot, "plugins", "development-board-toolchain.js"),
+        join(targetRoot, "plugins", "development-board-toolchain-dev.js"),
+        join(targetRoot, "plugins", "dbt-agent.js"),
+        join(targetRoot, "plugins", "Dbt Agent.js"),
+        join(targetRoot, "plugins", "deve.js"),
+        join(targetRoot, "plugins", "deve"),
+        join(targetRoot, "node_modules", "development-board-toolchain"),
+        join(targetRoot, "node_modules", "development-board-toolchain-dev"),
+        join(targetRoot, "node_modules", "dbt-agent")
+    ];
+    if (globalInstall) {
+        legacyPaths.push(join(targetRoot, "plugins", "embed-labs.js"));
+        legacyPaths.push(...await discoverLegacyOpenCodeBackupPaths(targetRoot, warnings));
+        legacyPaths.push(...await discoverLegacyOpenCodePluginCachePaths(targetRoot, warnings));
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        legacy_removed_paths: removedPaths,
+        legacy_removed_config_entries: [],
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+async function discoverLegacyOpenCodeBackupPaths(targetRoot, warnings) {
+    const paths = [];
+    try {
+        const entries = await readdir(targetRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.includes(".bak"))
+                continue;
+            const filePath = join(targetRoot, entry.name);
+            try {
+                const current = await readFile(filePath, "utf8");
+                if (legacyTextHasCodexPluginResidue(current)) {
+                    paths.push(filePath);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy OpenCode backup ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+async function discoverLegacyOpenCodePluginCachePaths(targetRoot, warnings) {
+    const paths = [];
+    const cacheRoot = join(targetRoot, ".embed-labs", "plugin-cache");
+    try {
+        const entries = await readdir(cacheRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            if (/^(embed-labs|embed-labs-opencode-plugin)-\d+\.\d+\.\d+\.tgz$/.test(entry.name)) {
+                paths.push(join(cacheRoot, entry.name));
+            }
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            warnings.push(`Could not inspect OpenCode plugin cache ${cacheRoot}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return paths;
+}
+function legacyOpenCodeCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} legacy OpenCode plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_entries?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_entries.length} legacy OpenCode config entry(s)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Legacy OpenCode cleanup: ${parts.join(", ")}.` : undefined;
+}
+function combineWarnings(...warnings) {
+    const actual = warnings.filter((warning) => Boolean(warning));
+    return actual.length > 0 ? actual.join(" ") : undefined;
 }
 async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
     const explicitTarget = Boolean(stringFlag(parsed, "target") || stringFlag(parsed, "codex-target"));
@@ -1834,6 +2770,115 @@ async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
     const warning = await upsertCodexMcpRuntimeConfig(bridgePath);
     return warning ? { registered: true, warning } : { registered: true };
 }
+async function maybeRegisterCodexMarketplace(parsed, targetRoot, targetPath) {
+    const explicitTarget = Boolean(stringFlag(parsed, "target") || stringFlag(parsed, "codex-target"));
+    if (explicitTarget && process.env.EMBED_CODEX_MARKETPLACE_REGISTER !== "1") {
+        return {
+            registered: false,
+            warning: "Codex plugin marketplace entry was not registered because a custom target was used. Set EMBED_CODEX_MARKETPLACE_REGISTER=1 to register it anyway."
+        };
+    }
+    if (resolve(targetRoot) !== resolve(defaultCodexPluginRoot()) && process.env.EMBED_CODEX_MARKETPLACE_REGISTER !== "1") {
+        return {
+            registered: false,
+            warning: "Codex plugin marketplace entry was not registered because the install target is not the default Codex plugin root."
+        };
+    }
+    const marketplacePath = defaultCodexLocalMarketplaceRoot();
+    const marketplacePluginPath = join(marketplacePath, "plugins", CODEX_PLUGIN_NAME);
+    try {
+        if (!await pathExists(join(targetPath, ".codex-plugin", "plugin.json"))) {
+            return {
+                registered: false,
+                warning: `Codex plugin manifest was not found at ${join(targetPath, ".codex-plugin", "plugin.json")}.`
+            };
+        }
+        await rm(marketplacePluginPath, { recursive: true, force: true });
+        await mkdir(dirname(marketplacePluginPath), { recursive: true });
+        await cp(targetPath, marketplacePluginPath, { recursive: true });
+        await refreshCodexPluginCache(targetPath);
+        await writeCodexLocalMarketplaceManifest(marketplacePath);
+        const warning = await upsertCodexPluginMarketplaceConfig(marketplacePath);
+        return warning ? { registered: true, marketplacePath, warning } : { registered: true, marketplacePath };
+    }
+    catch (error) {
+        return {
+            registered: false,
+            marketplacePath,
+            warning: `Could not register Codex plugin marketplace entry: ${error instanceof Error ? error.message : String(error)}`
+        };
+    }
+}
+function defaultCodexLocalMarketplaceRoot() {
+    return join(defaultCodexHome(), "local-marketplaces", CODEX_PLUGIN_NAME);
+}
+async function refreshCodexPluginCache(targetPath) {
+    const manifestPath = join(targetPath, ".codex-plugin", "plugin.json");
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    const version = typeof manifest.version === "string" && manifest.version.trim()
+        ? manifest.version.trim()
+        : "local";
+    const cachePluginRoot = join(defaultCodexPluginRoot(), "cache", CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_NAME);
+    const cacheVersionPath = join(cachePluginRoot, version);
+    await rm(cachePluginRoot, { recursive: true, force: true });
+    await mkdir(dirname(cacheVersionPath), { recursive: true });
+    await cp(targetPath, cacheVersionPath, { recursive: true });
+}
+async function writeCodexLocalMarketplaceManifest(marketplacePath) {
+    const manifestPath = join(marketplacePath, ".agents", "plugins", "marketplace.json");
+    const manifest = {
+        name: CODEX_MARKETPLACE_NAME,
+        interface: {
+            displayName: "Embed Labs"
+        },
+        plugins: [
+            {
+                name: CODEX_PLUGIN_NAME,
+                source: {
+                    source: "local",
+                    path: `./plugins/${CODEX_PLUGIN_NAME}`
+                },
+                policy: {
+                    installation: "AVAILABLE",
+                    authentication: "ON_USE"
+                },
+                category: "Developer Tools"
+            }
+        ]
+    };
+    await mkdir(dirname(manifestPath), { recursive: true });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+}
+async function upsertCodexPluginMarketplaceConfig(marketplacePath) {
+    const configPath = codexConfigPath();
+    try {
+        await mkdir(dirname(configPath), { recursive: true });
+        let text = "";
+        try {
+            text = await readFile(configPath, "utf8");
+        }
+        catch {
+            text = "";
+        }
+        const original = text;
+        const cleaned = removeLegacyCodexConfigTables(text).text;
+        let updated = upsertTomlTableKeys(cleaned, `marketplaces.${CODEX_MARKETPLACE_NAME}`, {
+            source_type: tomlString("local"),
+            source: tomlString(marketplacePath),
+            last_updated: tomlString(new Date().toISOString().replace(/\.\d{3}Z$/, "Z"))
+        });
+        updated = upsertTomlTableKeys(updated, `plugins."${CODEX_PLUGIN_NAME}@${CODEX_MARKETPLACE_NAME}"`, {
+            enabled: "true"
+        });
+        if (updated !== original) {
+            await writeFile(configPath, updated, "utf8");
+        }
+        return undefined;
+    }
+    catch (error) {
+        return `${configPath} could not be updated with the Embed Labs plugin marketplace entry: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}
 function codexMcpAlreadyRegistered(stdout, bridgePath, cloudUrl, authFile, embedCliBin) {
     try {
         const parsed = JSON.parse(stdout);
@@ -1922,34 +2967,183 @@ function pluginMcpCloudApiUrl(parsed) {
         return DEFAULT_CLOUD_API_URL.replace(/\/+$/, "");
     }
 }
-async function resolveExecutableOnPath(name) {
-    if (name.includes("/")) {
+async function resolveExecutableOnPath(name) {
+    if (name.includes("/")) {
+        try {
+            await access(name, constants.X_OK);
+            return name;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const pathEntries = (process.env.PATH || "").split(delimiter).filter(Boolean);
+    for (const entry of pathEntries) {
+        const candidate = join(entry, name);
+        try {
+            await access(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep searching PATH.
+        }
+    }
+    return undefined;
+}
+async function runBridgeStart(parsed) {
+    const host = stringFlag(parsed, "host");
+    const port = numberFlag(parsed, "port");
+    const bridge = await resolveBridgeLauncher();
+    const args = [...bridge.args];
+    if (host) {
+        args.push("--host", host);
+    }
+    if (port !== undefined) {
+        args.push("--port", String(port));
+    }
+    const env = {
+        ...process.env,
+        ...(host ? { EMBED_BRIDGE_HOST: host } : {}),
+        ...(port !== undefined ? { EMBED_BRIDGE_PORT: String(port) } : {})
+    };
+    const child = spawn(bridge.command, args, {
+        stdio: "inherit",
+        env
+    });
+    const forwardSignal = (signal) => {
+        if (!child.killed) {
+            child.kill(signal);
+        }
+    };
+    process.once("SIGINT", forwardSignal);
+    process.once("SIGTERM", forwardSignal);
+    return await new Promise((resolveCode) => {
+        child.on("error", (error) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            console.error(error instanceof Error ? error.message : String(error));
+            resolveCode(1);
+        });
+        child.on("close", (code, signal) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            if (signal === "SIGINT" || signal === "SIGTERM") {
+                resolveCode(0);
+            }
+            else {
+                resolveCode(code ?? 0);
+            }
+        });
+    });
+}
+async function resolveBridgeLauncher() {
+    const explicitBinary = process.env.EMBED_LOCAL_BRIDGE_BINARY?.trim();
+    if (explicitBinary) {
         try {
-            await access(name, constants.X_OK);
-            return name;
+            await access(explicitBinary, constants.X_OK);
+            return { command: explicitBinary, args: [] };
         }
         catch {
-            return undefined;
+            // Fall through so the package launcher can print its clearer repair message.
         }
     }
-    const pathEntries = (process.env.PATH || "").split(delimiter).filter(Boolean);
-    for (const entry of pathEntries) {
-        const candidate = join(entry, name);
+    const pathBinary = await resolveExecutableOnPath(process.platform === "win32" ? "embed-local-bridge.cmd" : "embed-local-bridge");
+    if (pathBinary) {
+        return { command: pathBinary, args: [] };
+    }
+    const packageLauncher = await resolveBridgePackageLauncher();
+    if (packageLauncher) {
+        return { command: process.execPath, args: [packageLauncher] };
+    }
+    return {
+        command: process.execPath,
+        args: [resolve(SOURCE_CHECKOUT_ROOT, "packages", "local-bridge", "dist", "index.js")]
+    };
+}
+async function resolveBridgePackageLauncher() {
+    const candidates = [];
+    try {
+        const packageJson = require.resolve("@embed-labs/local-bridge/package.json");
+        candidates.push(join(dirname(packageJson), "dist", "index.js"));
+    }
+    catch {
+        // Source checkout fallback below.
+    }
+    candidates.push(resolve(SOURCE_CHECKOUT_ROOT, "packages", "local-bridge", "dist", "index.js"));
+    for (const candidate of candidates) {
         try {
-            await access(candidate, constants.X_OK);
+            await access(candidate, constants.R_OK);
             return candidate;
         }
         catch {
-            // Keep searching PATH.
+            // Keep looking.
         }
     }
     return undefined;
 }
 function defaultOpenCodeRoot() {
-    return join(process.cwd(), ".opencode");
+    return globalOpenCodeRoot();
+}
+function globalOpenCodeRoot() {
+    return join(homedir(), ".config", "opencode");
+}
+function isGlobalOpenCodeRoot(targetRoot) {
+    return resolve(targetRoot) === resolve(globalOpenCodeRoot());
+}
+async function ensureOpenCodeGlobalPluginConfig() {
+    const configPath = join(globalOpenCodeRoot(), "opencode.json");
+    let existing = {};
+    try {
+        const parsed = JSON.parse(await readFile(configPath, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            existing = parsed;
+        }
+    }
+    catch {
+        existing = {};
+    }
+    const configured = Array.isArray(existing.plugin)
+        ? existing.plugin.filter((item) => typeof item === "string")
+        : Array.isArray(existing.plugins)
+            ? existing.plugins.filter((item) => typeof item === "string")
+            : [];
+    const removed = configured.filter(isLegacyOpenCodePluginConfigEntry);
+    const cleaned = configured.filter((item) => !isLegacyOpenCodePluginConfigEntry(item));
+    if (!cleaned.includes("embed-labs")) {
+        cleaned.push("embed-labs");
+    }
+    await writeFile(configPath, `${JSON.stringify({
+        ...existing,
+        plugin: cleaned,
+        plugins: undefined
+    }, null, 2)}\n`, "utf8");
+    return removed;
+}
+function isLegacyOpenCodePluginConfigEntry(item) {
+    const normalized = item.trim().replace(/\\/g, "/");
+    const pathOnly = normalized.split(/[?#]/, 1)[0] || normalized;
+    return normalized === "dbt-agent"
+        || normalized === "Dbt Agent"
+        || normalized === "deve"
+        || normalized === "development-board-toolchain"
+        || normalized === "development-board-toolchain-dev"
+        || normalized === "./plugins/deve"
+        || normalized === "./plugins/deve.js"
+        || /(?:^|\/)plugins\/deve(?:\.js)?$/.test(pathOnly)
+        || /(?:^|\/)plugins\/dbt-agent(?:\.js)?$/.test(pathOnly)
+        || normalized === "./plugins/development-board-toolchain"
+        || normalized === "./plugins/development-board-toolchain.js"
+        || normalized === "./plugins/development-board-toolchain-dev"
+        || normalized === "./plugins/development-board-toolchain-dev.js"
+        || pathOnly.endsWith("/plugins/development-board-toolchain")
+        || pathOnly.endsWith("/plugins/development-board-toolchain.js")
+        || pathOnly.endsWith("/plugins/development-board-toolchain-dev")
+        || pathOnly.endsWith("/plugins/development-board-toolchain-dev.js")
+        || normalized.includes("dbt-agent")
+        || normalized.includes("development-board-toolchain");
 }
 async function openCodeDuplicatePluginWarning(targetRoot) {
-    const globalRoot = join(homedir(), ".config", "opencode");
+    const globalRoot = globalOpenCodeRoot();
     if (resolve(targetRoot) === resolve(globalRoot))
         return undefined;
     const configPath = join(globalRoot, "opencode.json");
@@ -1981,6 +3175,21 @@ async function localPluginVersion(kind) {
         return undefined;
     }
 }
+async function installedCodexPluginVersion(pluginPath) {
+    return await readPackageVersion(join(pluginPath, ".codex-plugin", "plugin.json"));
+}
+async function installedOpenCodePluginVersion(targetRoot) {
+    return await readPackageVersion(join(targetRoot, "node_modules", "embed-labs", "package.json"));
+}
+async function readPackageVersion(filePath) {
+    try {
+        const parsed = JSON.parse(await readFile(filePath, "utf8"));
+        return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function localPluginSourcesAvailable() {
     return await pathExists(sourceCheckoutPath("platform_plugins", "codex_plugin", "plugins", "embed-labs", ".codex-plugin", "plugin.json"))
         && await pathExists(sourceCheckoutPath("platform_plugins", "opencode_plugin", "package.json"));
@@ -2039,19 +3248,65 @@ async function parseErrorResponse(response) {
     return undefined;
 }
 async function cloudAuthToken() {
+    return (await cloudAuthConfig()).token;
+}
+async function cloudAuthConfig() {
     const envToken = process.env.EMBED_API_TOKEN?.trim();
     if (envToken) {
-        return envToken;
+        const fileConfig = await readLocalAuthFile();
+        return {
+            ...fileConfig,
+            token: envToken,
+            profile: process.env.EMBED_AUTH_PROFILE ?? fileConfig.profile ?? "default",
+            source: "env"
+        };
     }
+    const fileConfig = await readLocalAuthFile();
+    return {
+        ...fileConfig,
+        token: fileConfig.token?.trim() || undefined,
+        profile: fileConfig.profile ?? "default",
+        source: fileConfig.token ? "file" : undefined
+    };
+}
+async function readLocalAuthFile() {
     try {
         const parsed = JSON.parse(await readFile(DEFAULT_AUTH_FILE, "utf8"));
-        const fileToken = typeof parsed.token === "string" ? parsed.token.trim() : "";
-        return fileToken || undefined;
+        return normalizeLocalAuthFile(parsed);
     }
     catch {
-        return undefined;
+        return {};
     }
 }
+function normalizeLocalAuthFile(parsed) {
+    const device = isJsonObject(parsed.device) ? parsed.device : undefined;
+    const normalizedDevice = device && typeof device.device_id === "string" && typeof device.fingerprint_hash === "string" && typeof device.private_key_pem === "string"
+        ? {
+            device_id: device.device_id,
+            fingerprint_hash: device.fingerprint_hash,
+            private_key_pem: device.private_key_pem,
+            public_key_pem: typeof device.public_key_pem === "string" ? device.public_key_pem : undefined,
+            label: typeof device.label === "string" ? device.label : undefined,
+            platform: typeof device.platform === "string" ? device.platform : undefined,
+            arch: typeof device.arch === "string" ? device.arch : undefined,
+            hostname_hash: typeof device.hostname_hash === "string" ? device.hostname_hash : undefined,
+            registered_at: typeof device.registered_at === "string" ? device.registered_at : undefined
+        }
+        : undefined;
+    return {
+        profile: typeof parsed.profile === "string" ? parsed.profile : undefined,
+        token: typeof parsed.token === "string" ? parsed.token.trim() : undefined,
+        updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : undefined,
+        account_id: typeof parsed.account_id === "string" ? parsed.account_id : undefined,
+        api_key_id: typeof parsed.api_key_id === "string" ? parsed.api_key_id : undefined,
+        device: normalizedDevice
+    };
+}
+async function writeLocalAuthFile(config) {
+    await mkdir(dirname(DEFAULT_AUTH_FILE), { recursive: true });
+    await writeFile(DEFAULT_AUTH_FILE, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    await chmod(DEFAULT_AUTH_FILE, 0o600).catch(() => undefined);
+}
 function serviceBaseUrl(url) {
     return url.replace(/\/+$/, "");
 }
@@ -3510,30 +4765,272 @@ async function authLogin(parsed) {
         return fail("invalid_args", "Usage: embed auth login --token <token> [--profile default] [--json]");
     }
     const updatedAt = new Date().toISOString();
-    await mkdir(dirname(DEFAULT_AUTH_FILE), { recursive: true });
-    await writeFile(DEFAULT_AUTH_FILE, `${JSON.stringify({ profile, token, updated_at: updatedAt }, null, 2)}\n`, "utf8");
-    return ok({ authenticated: true, profile, source: "file", updated_at: updatedAt });
+    const current = await readLocalAuthFile();
+    const localDevice = await buildLocalDeviceAuth(parsed, current.device);
+    const registration = await registerLocalDevice(token.trim(), localDevice.registration);
+    if (!registration.ok) {
+        return fail(registration.error.code, registration.error.message, {
+            remediation: registration.error.remediation,
+            details: registration.error.details
+        });
+    }
+    const device = {
+        device_id: registration.data.device.device_id,
+        fingerprint_hash: localDevice.device.fingerprint_hash,
+        private_key_pem: localDevice.device.private_key_pem,
+        public_key_pem: localDevice.device.public_key_pem,
+        label: registration.data.device.label ?? localDevice.device.label,
+        platform: registration.data.device.platform ?? localDevice.device.platform,
+        arch: registration.data.device.arch ?? localDevice.device.arch,
+        hostname_hash: registration.data.device.hostname_hash ?? localDevice.device.hostname_hash,
+        registered_at: registration.data.device.first_seen_at
+    };
+    await writeLocalAuthFile({
+        profile,
+        token: token.trim(),
+        updated_at: updatedAt,
+        account_id: registration.data.device.account_id,
+        api_key_id: registration.data.device.api_key_id,
+        device
+    });
+    return ok({
+        authenticated: true,
+        profile,
+        source: "file",
+        updated_at: updatedAt,
+        account_id: registration.data.device.account_id,
+        api_key_id: registration.data.device.api_key_id,
+        device_id: device.device_id,
+        device_fingerprint_hash: device.fingerprint_hash,
+        device_label: device.label,
+        device_registered_at: device.registered_at,
+        device_private_key_configured: true
+    });
 }
 async function authStatus() {
-    if (process.env.EMBED_API_TOKEN?.trim()) {
+    const envToken = process.env.EMBED_API_TOKEN?.trim();
+    const file = await readLocalAuthFile();
+    const deviceIntegrity = file.device
+        ? (await validateLocalDeviceIntegrity(file.device)).ok ? "ok" : "failed"
+        : "unbound";
+    if (envToken) {
         return {
             authenticated: true,
             profile: process.env.EMBED_AUTH_PROFILE ?? "default",
-            source: "env"
+            source: "env",
+            account_id: file.account_id,
+            api_key_id: file.api_key_id,
+            device_id: file.device?.device_id,
+            device_fingerprint_hash: file.device?.fingerprint_hash,
+            device_label: file.device?.label,
+            device_registered_at: file.device?.registered_at,
+            device_private_key_configured: Boolean(file.device?.private_key_pem),
+            device_integrity: deviceIntegrity
         };
     }
+    return {
+        authenticated: Boolean(file.token?.trim()),
+        profile: file.profile ?? "default",
+        source: file.token ? "file" : undefined,
+        updated_at: file.updated_at,
+        account_id: file.account_id,
+        api_key_id: file.api_key_id,
+        device_id: file.device?.device_id,
+        device_fingerprint_hash: file.device?.fingerprint_hash,
+        device_label: file.device?.label,
+        device_registered_at: file.device?.registered_at,
+        device_private_key_configured: Boolean(file.device?.private_key_pem),
+        device_integrity: deviceIntegrity
+    };
+}
+async function authDeviceStatus(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    const unexpected = parsed.command.slice(3);
+    if (unknownFlag || unexpected.length > 0) {
+        return fail("invalid_args", unknownFlag ? `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_STATUS_USAGE}` : AUTH_DEVICE_STATUS_USAGE);
+    }
+    const local = await authStatus();
+    const remote = local.authenticated ? await cloudGet("/v1/me/devices") : undefined;
+    if (remote && !remote.ok) {
+        return ok({ local });
+    }
+    return ok({ local, remote: remote?.data });
+}
+async function authDeviceList(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    const unexpected = parsed.command.slice(3);
+    if (unknownFlag || unexpected.length > 0) {
+        return fail("invalid_args", unknownFlag ? `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_LIST_USAGE}` : AUTH_DEVICE_LIST_USAGE);
+    }
+    return await cloudGet("/v1/me/devices");
+}
+async function authDeviceRevoke(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_REVOKE_USAGE}`);
+    }
+    const id = commandId(parsed, 3, "device_id", AUTH_DEVICE_REVOKE_USAGE);
+    if (!id.ok) {
+        return fail("invalid_args", id.error);
+    }
+    return await cloudPost(`/v1/me/devices/${encodeURIComponent(id.value)}/revoke`, {});
+}
+async function authDeviceRename(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "label"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_RENAME_USAGE}`);
+    }
+    const id = commandId(parsed, 3, "device_id", AUTH_DEVICE_RENAME_USAGE);
+    if (!id.ok) {
+        return fail("invalid_args", id.error);
+    }
+    const label = stringFlag(parsed, "label");
+    if (!label?.trim()) {
+        return fail("invalid_args", AUTH_DEVICE_RENAME_USAGE);
+    }
+    const updated = await cloudPost(`/v1/me/devices/${encodeURIComponent(id.value)}`, { label: label.trim() });
+    if (updated.ok) {
+        const auth = await readLocalAuthFile();
+        if (auth.device?.device_id === updated.data.device_id) {
+            await writeLocalAuthFile({ ...auth, device: { ...auth.device, label: updated.data.label } });
+        }
+    }
+    return updated;
+}
+async function buildLocalDeviceAuth(parsed, existing) {
+    const fingerprint = await localHardwareFingerprint();
+    const keyPair = existing?.fingerprint_hash === fingerprint.fingerprint_hash && existing.private_key_pem && existing.public_key_pem
+        ? { privateKeyPem: existing.private_key_pem, publicKeyPem: existing.public_key_pem }
+        : generateLocalDeviceKeyPair();
+    const label = stringFlag(parsed, "label")?.trim()
+        || existing?.label
+        || `${fingerprint.platform} ${fingerprint.arch}`;
+    const device = {
+        device_id: existing?.fingerprint_hash === fingerprint.fingerprint_hash ? existing.device_id : "",
+        fingerprint_hash: fingerprint.fingerprint_hash,
+        private_key_pem: keyPair.privateKeyPem,
+        public_key_pem: keyPair.publicKeyPem,
+        label,
+        platform: fingerprint.platform,
+        arch: fingerprint.arch,
+        hostname_hash: fingerprint.hostname_hash,
+        registered_at: existing?.registered_at
+    };
+    return {
+        device,
+        registration: {
+            fingerprint_hash: fingerprint.fingerprint_hash,
+            public_key: keyPair.publicKeyPem,
+            label,
+            platform: fingerprint.platform,
+            arch: fingerprint.arch,
+            hostname_hash: fingerprint.hostname_hash,
+            client_name: EMBED_CLIENT_NAME,
+            client_version: EMBED_CLIENT_VERSION,
+            metadata: {
+                fingerprint_version: "v1",
+                fingerprint_source: fingerprint.source
+            }
+        }
+    };
+}
+function generateLocalDeviceKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    return {
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString()
+    };
+}
+async function registerLocalDevice(token, body) {
     try {
-        const parsed = JSON.parse(await readFile(DEFAULT_AUTH_FILE, "utf8"));
-        return {
-            authenticated: typeof parsed.token === "string" && parsed.token.trim().length > 0,
-            profile: typeof parsed.profile === "string" ? parsed.profile : "default",
-            source: "file",
-            updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : undefined
+        const bodyText = JSON.stringify(body);
+        const headers = {
+            "content-type": "application/json",
+            authorization: `Bearer ${token}`
         };
+        addCloudRequestSignature(headers, "POST", "/v1/me/devices/register", bodyText, token);
+        const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}/v1/me/devices/register`, {
+            method: "POST",
+            headers,
+            body: bodyText
+        });
+        const parsed = await response.json();
+        return enrichCloudAuthFailure(parsed, true);
+    }
+    catch (error) {
+        return fail("cloud_api_unreachable", error instanceof Error ? error.message : String(error), {
+            remediation: `Check that embed cloud-api is running at ${DEFAULT_CLOUD_API_URL}. Start it with: npm run cloud-api`
+        });
+    }
+}
+async function localHardwareFingerprint() {
+    cachedLocalHardwareFingerprint ??= localHardwareFingerprintUncached();
+    return await cachedLocalHardwareFingerprint;
+}
+async function localHardwareFingerprintUncached() {
+    const platformName = platform();
+    const archName = arch();
+    const raw = await localHardwareId(platformName);
+    const fingerprintHash = createHash("sha256")
+        .update(`embed-labs:device:v1:${platformName}:${raw.value}`)
+        .digest("hex");
+    const hostnameHash = createHash("sha256")
+        .update(`embed-labs:hostname:v1:${hostname()}`)
+        .digest("hex");
+    return {
+        fingerprint_hash: fingerprintHash,
+        platform: platformName,
+        arch: archName,
+        hostname_hash: hostnameHash,
+        source: raw.source
+    };
+}
+async function localHardwareId(platformName) {
+    if (platformName === "darwin") {
+        const result = await runLocalProcess("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+        const match = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(result.stdout);
+        if (match?.[1]) {
+            return { value: match[1], source: "macos_ioplatformuuid" };
+        }
+    }
+    if (platformName === "win32") {
+        const result = await runLocalProcess("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+        const match = /MachineGuid\s+REG_\w+\s+([^\r\n]+)/.exec(result.stdout);
+        if (match?.[1]?.trim()) {
+            return { value: match[1].trim(), source: "windows_machineguid" };
+        }
+    }
+    if (platformName === "linux") {
+        for (const pathValue of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+            try {
+                const value = (await readFile(pathValue, "utf8")).trim();
+                if (value) {
+                    return { value, source: `linux:${pathValue}` };
+                }
+            }
+            catch {
+                // Try the next stable machine id location.
+            }
+        }
+    }
+    const generated = await localGeneratedInstallId();
+    return { value: generated, source: "generated_install_id" };
+}
+async function localGeneratedInstallId() {
+    try {
+        const parsed = JSON.parse(await readFile(DEFAULT_DEVICE_FILE, "utf8"));
+        if (typeof parsed.generated_install_id === "string" && parsed.generated_install_id.trim()) {
+            return parsed.generated_install_id.trim();
+        }
     }
     catch {
-        return { authenticated: false, profile: "default" };
+        // Fall through and create a local-only fallback id.
     }
+    const generated = `install_${randomBytes(24).toString("base64url")}`;
+    await mkdir(dirname(DEFAULT_DEVICE_FILE), { recursive: true });
+    await writeFile(DEFAULT_DEVICE_FILE, `${JSON.stringify({ generated_install_id: generated, created_at: new Date().toISOString() }, null, 2)}\n`, "utf8");
+    await chmod(DEFAULT_DEVICE_FILE, 0o600).catch(() => undefined);
+    return generated;
 }
 function accountCreateBody(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "email", "display-name"]);
@@ -3689,6 +5186,80 @@ function usageRecordBody(parsed) {
         created_at: createdAtResult.value
     });
 }
+function mcpToolEventBody(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, [
+        "json",
+        "account",
+        "account-id",
+        "tool",
+        "client",
+        "mode",
+        "server-model-used",
+        "success",
+        "local-device-id",
+        "local_device_id",
+        "request-id",
+        "duration-ms",
+        "input-summary",
+        "output-summary"
+    ]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${MCP_TOOL_EVENT_USAGE}`;
+    }
+    const extra = parsed.command.slice(2);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${MCP_TOOL_EVENT_USAGE}`;
+    }
+    const toolResult = optionalTrimmedStringFlag(parsed, "tool");
+    if (toolResult.error)
+        return toolResult.error;
+    if (!toolResult.value)
+        return MCP_TOOL_EVENT_USAGE;
+    const accountResult = optionalTrimmedStringAliasFlag(parsed, ["account", "account-id"], "account or account-id");
+    if (accountResult.error)
+        return accountResult.error;
+    const clientResult = optionalTrimmedStringFlag(parsed, "client");
+    if (clientResult.error)
+        return clientResult.error;
+    const modeResult = optionalTrimmedStringFlag(parsed, "mode");
+    if (modeResult.error)
+        return modeResult.error;
+    const localDeviceResult = optionalTrimmedStringAliasFlag(parsed, ["local-device-id", "local_device_id"], "local-device-id");
+    if (localDeviceResult.error)
+        return localDeviceResult.error;
+    const requestIdResult = optionalTrimmedStringFlag(parsed, "request-id");
+    if (requestIdResult.error)
+        return requestIdResult.error;
+    const inputSummaryResult = optionalTrimmedStringFlag(parsed, "input-summary");
+    if (inputSummaryResult.error)
+        return inputSummaryResult.error;
+    const outputSummaryResult = optionalTrimmedStringFlag(parsed, "output-summary");
+    if (outputSummaryResult.error)
+        return outputSummaryResult.error;
+    const durationResult = optionalNonNegativeIntegerFlag(parsed, "duration-ms");
+    if (durationResult.error)
+        return durationResult.error;
+    const serverModelUsed = optionalBooleanFlag(parsed, "server-model-used");
+    if (typeof serverModelUsed === "string")
+        return serverModelUsed;
+    const success = optionalBooleanFlag(parsed, "success");
+    if (typeof success === "string")
+        return success;
+    return compactBody({
+        account_id: accountResult.value,
+        tool_name: toolResult.value,
+        client: clientResult.value,
+        mode: modeResult.value,
+        local_device_id: localDeviceResult.value,
+        server_model_used: serverModelUsed,
+        success,
+        request_id: requestIdResult.value,
+        duration_ms: durationResult.value,
+        input_summary: inputSummaryResult.value,
+        output_summary: outputSummaryResult.value,
+        metadata: localDeviceResult.value ? { local_device_id: localDeviceResult.value } : undefined
+    });
+}
 function usageSummaryRequest(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "account", "account-id", "api-key-id", "from", "to"]);
     if (unknownFlag) {
@@ -4024,8 +5595,109 @@ function billingSnapshotListRequest(parsed) {
     }
     return { path: `/v1/accounts/${encodeURIComponent(accountResult.value)}/billing/snapshots` };
 }
+function localToolchainListRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root", "install-root"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_LIST_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_TOOLCHAIN_LIST_USAGE}`;
+    }
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error)
+        return board.error;
+    const channel = optionalTrimmedStringFlag(parsed, "channel");
+    if (channel.error)
+        return channel.error;
+    const metadataRoot = optionalTrimmedStringFlag(parsed, "metadata-root");
+    if (metadataRoot.error)
+        return metadataRoot.error;
+    const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
+    if (installRoot.error)
+        return installRoot.error;
+    return { boardId: board.value, channel: channel.value, metadataRoot: metadataRoot.value, installRoot: installRoot.value };
+}
+function localToolchainLatestRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_LATEST_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_TOOLCHAIN_LATEST_USAGE}`;
+    }
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error)
+        return board.error;
+    const channel = optionalTrimmedStringFlag(parsed, "channel");
+    if (channel.error)
+        return channel.error;
+    const metadataRoot = optionalTrimmedStringFlag(parsed, "metadata-root");
+    if (metadataRoot.error)
+        return metadataRoot.error;
+    return { boardId: board.value, channel: channel.value, metadataRoot: metadataRoot.value };
+}
+function localToolchainCurrentRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "install-root"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_CURRENT_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_TOOLCHAIN_CURRENT_USAGE}`;
+    }
+    const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
+    if (installRoot.error)
+        return installRoot.error;
+    return { installRoot: installRoot.value };
+}
+function localToolchainInstallRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root", "source-url", "source-release-root", "install-root", "mode", "force"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_INSTALL_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_TOOLCHAIN_INSTALL_USAGE}`;
+    }
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error)
+        return board.error;
+    const channel = optionalTrimmedStringFlag(parsed, "channel");
+    if (channel.error)
+        return channel.error;
+    const metadataRoot = optionalTrimmedStringFlag(parsed, "metadata-root");
+    if (metadataRoot.error)
+        return metadataRoot.error;
+    const sourceUrl = optionalTrimmedStringFlag(parsed, "source-url");
+    if (sourceUrl.error)
+        return sourceUrl.error;
+    const sourceReleaseRoot = optionalTrimmedStringFlag(parsed, "source-release-root");
+    if (sourceReleaseRoot.error)
+        return sourceReleaseRoot.error;
+    if (sourceUrl.value && sourceReleaseRoot.value) {
+        return "Use only one of --source-url or --source-release-root.";
+    }
+    const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
+    if (installRoot.error)
+        return installRoot.error;
+    const mode = optionalTrimmedStringFlag(parsed, "mode");
+    if (mode.error)
+        return mode.error;
+    return {
+        boardId: board.value,
+        channel: channel.value,
+        metadataRoot: metadataRoot.value,
+        sourceUrl: sourceUrl.value,
+        sourceReleaseRoot: sourceReleaseRoot.value,
+        installRoot: installRoot.value,
+        mode: mode.value,
+        force: booleanFlag(parsed, "force")
+    };
+}
 function localToolchainValidateRequest(parsed) {
-    const unknownFlag = firstUnknownFlag(parsed, ["json", "release-root"]);
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "release-root", "mode"]);
     if (unknownFlag) {
         return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_VALIDATE_USAGE}`;
     }
@@ -4037,7 +5709,11 @@ function localToolchainValidateRequest(parsed) {
     if (releaseRoot.error) {
         return releaseRoot.error;
     }
-    return { releaseRoot: releaseRoot.value };
+    const mode = optionalTrimmedStringFlag(parsed, "mode");
+    if (mode.error) {
+        return mode.error;
+    }
+    return { releaseRoot: releaseRoot.value, mode: mode.value };
 }
 function localCompileTaishanPiRequest(parsed, auth) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "source", "output", "release-root", "account", "account-id"]);
@@ -4122,7 +5798,9 @@ function localToolchainAuthContext(auth, accountId) {
         authenticated: auth.authenticated,
         profile: auth.profile,
         source: auth.source,
-        account_id: accountId
+        account_id: accountId,
+        api_key_id: auth.api_key_id,
+        device_id: auth.device_id
     };
 }
 function usageEventsRequest(parsed) {
@@ -4532,6 +6210,35 @@ function renderPluginList(result) {
         `install="${plugin.install_command}"`
     ].filter(Boolean).join(" ")).join("\n");
 }
+function renderPluginUpdateCheck(result) {
+    const lines = [
+        `release_url=${result.release_url}`,
+        result.latest_version ? `latest_version=${result.latest_version}` : ""
+    ].filter(Boolean);
+    if (result.release_notes.length > 0) {
+        lines.push("release_notes:");
+        for (const note of result.release_notes) {
+            lines.push(`  - ${note}`);
+        }
+    }
+    for (const plugin of result.plugins) {
+        lines.push("");
+        lines.push(`${plugin.display_name} (${plugin.id})`);
+        lines.push(`  installed=${plugin.installed}`);
+        lines.push(`  installed_version=${plugin.installed_version ?? "none"}`);
+        lines.push(`  latest_version=${plugin.latest_version ?? "unknown"}`);
+        lines.push(`  update_available=${plugin.update_available}`);
+        lines.push(`  target=${plugin.target_path}`);
+        lines.push(`  update_command=${plugin.update_command}`);
+        if (plugin.release_file) {
+            lines.push(`  release_file=${plugin.release_file}`);
+        }
+        for (const note of plugin.notes) {
+            lines.push(`  note=${note}`);
+        }
+    }
+    return lines.join("\n");
+}
 function renderPluginInstall(result) {
     const lines = ["Installed plugins:"];
     for (const item of result.installed) {
@@ -4553,6 +6260,15 @@ function renderPluginInstall(result) {
         if (item.mcp_warning) {
             lines.push(`    warning=${item.mcp_warning}`);
         }
+        if (item.marketplace_registered !== undefined) {
+            lines.push(`    codex_marketplace_registered=${item.marketplace_registered}`);
+        }
+        if (item.marketplace_path) {
+            lines.push(`    codex_marketplace=${item.marketplace_path}`);
+        }
+        if (item.marketplace_warning) {
+            lines.push(`    warning=${item.marketplace_warning}`);
+        }
     }
     return lines.join("\n");
 }
@@ -4584,9 +6300,53 @@ function renderAgentRunResult(result) {
     return lines.join("\n");
 }
 function renderAuthStatus(status) {
-    return status.authenticated
-        ? `Authenticated profile=${status.profile}${status.source ? ` source=${status.source}` : ""}`
-        : `Not authenticated profile=${status.profile}`;
+    if (!status.authenticated) {
+        return `Not authenticated profile=${status.profile}`;
+    }
+    return [
+        `Authenticated profile=${status.profile}${status.source ? ` source=${status.source}` : ""}`,
+        status.account_id ? `account=${status.account_id}` : "",
+        status.api_key_id ? `api_key=${status.api_key_id}` : "",
+        status.device_id ? `device=${status.device_id}` : "device=not_registered",
+        status.device_label ? `device_label=${status.device_label}` : "",
+        status.device_integrity ? `device_integrity=${status.device_integrity}` : "",
+        status.device_private_key_configured === false ? "device_private_key=missing" : ""
+    ].filter(Boolean).join("\n");
+}
+function renderAuthDeviceStatus(status) {
+    const lines = [renderAuthStatus(status.local)];
+    if (status.remote) {
+        const activeCount = status.remote.devices.filter((device) => device.status === "active").length;
+        lines.push(`remote_devices=${activeCount}/${status.remote.device_limit}`);
+        const localDevice = status.local.device_id
+            ? status.remote.devices.find((device) => device.device_id === status.local.device_id)
+            : undefined;
+        if (localDevice) {
+            lines.push(`remote_current=${renderAuthDevice(localDevice)}`);
+        }
+    }
+    return lines.join("\n");
+}
+function renderAuthDeviceList(result) {
+    if (result.devices.length === 0) {
+        return `No registered devices. device_limit=${result.device_limit}`;
+    }
+    return [
+        `device_limit=${result.device_limit}`,
+        ...result.devices.map(renderAuthDevice)
+    ].join("\n");
+}
+function renderAuthDevice(device) {
+    return [
+        `${device.device_id} account=${device.account_id}`,
+        device.api_key_id ? `api_key=${device.api_key_id}` : "",
+        `status=${device.status}`,
+        device.label ? `label=${device.label}` : "",
+        device.platform ? `platform=${device.platform}` : "",
+        device.arch ? `arch=${device.arch}` : "",
+        `last_seen_at=${device.last_seen_at}`,
+        device.revoked_at ? `revoked_at=${device.revoked_at}` : ""
+    ].filter(Boolean).join(" ");
 }
 function renderAccount(account) {
     return [
@@ -4636,6 +6396,20 @@ function renderUsageRecord(record) {
         `created_at=${record.created_at}`
     ].filter(Boolean).join(" ");
 }
+function renderMcpToolEvent(event) {
+    return [
+        `${event.event_id} tool=${event.tool_name}`,
+        event.account_id ? `account=${event.account_id}` : "",
+        event.api_key_id ? `api_key=${event.api_key_id}` : "",
+        `client=${event.client}`,
+        `mode=${event.mode}`,
+        `server_model_used=${event.server_model_used}`,
+        `success=${event.success}`,
+        event.request_id ? `request=${event.request_id}` : "",
+        event.duration_ms !== undefined ? `duration_ms=${event.duration_ms}` : "",
+        `created_at=${event.created_at}`
+    ].filter(Boolean).join(" ");
+}
 function renderUsageSummary(summary) {
     const lines = [
         summary.account_id ? `account=${summary.account_id}` : "",
@@ -5159,10 +6933,131 @@ function renderBuildWorkspaceSourcePatch(result) {
     }
     return lines.join("\n");
 }
+function renderLocalToolchainList(result) {
+    const lines = [
+        `Local development environments: ${result.environments.length}`,
+        `host=${result.host}`,
+        `channel=${result.channel}`,
+        result.metadata_root ? `metadata_root=${result.metadata_root}` : "metadata=built-in",
+        `install_root=${result.install_root}`,
+        `registry=${result.registry_path}`
+    ];
+    for (const environment of result.environments) {
+        lines.push("");
+        lines.push(`${environment.display_name} (${environment.board_id})`);
+        lines.push(`  status=${environment.status}`);
+        lines.push(`  latest=${environment.latest.version}`);
+        if (environment.installed) {
+            lines.push(`  installed=${environment.installed.version ?? "unknown"} mode=${environment.installed.mode ?? "unknown"}`);
+            if (environment.installed.release_root) {
+                lines.push(`  release_root=${environment.installed.release_root}`);
+            }
+        }
+        lines.push(`  install_modes=${environment.install_modes.join(",")}`);
+        lines.push(`  install_command=${environment.install_command}`);
+        if (environment.status === "update_available") {
+            lines.push(`  update_command=${environment.update_command}`);
+        }
+        if (environment.components?.length) {
+            lines.push(`  components=${environment.components.map((component) => `${component.id}@${component.version}`).join(", ")}`);
+        }
+        if (environment.notes.length > 0) {
+            for (const note of environment.notes) {
+                lines.push(`  note=${note}`);
+            }
+        }
+    }
+    return lines.join("\n");
+}
+function renderLocalToolchainLatest(result) {
+    const lines = [
+        `board=${result.board_id}`,
+        `channel=${result.channel}`,
+        `version=${result.version}`,
+        `host=${result.host}`,
+        result.metadata_root ? `metadata_root=${result.metadata_root}` : "metadata=built-in",
+        result.download?.source_url ? `download=${result.download.mirror_kind}:${result.download.source_url}` : "",
+        result.download?.archive ? `archive_sha256=${result.download.archive.sha256}` : "",
+        result.download?.archive ? `archive_size_bytes=${result.download.archive.size_bytes}` : "",
+        result.download?.components?.length ? `components=${result.download.components.length}` : "",
+        result.download?.default_mode ? `default_mode=${result.download.default_mode}` : "",
+        result.download_error ? `download_error=${result.download_error}` : ""
+    ].filter(Boolean);
+    if (result.download?.components?.length) {
+        lines.push("download_components:");
+        for (const component of result.download.components) {
+            lines.push(`  ${component.id}@${component.version} modes=${component.install_modes?.join(",") || "all"} bytes=${component.archive.size_bytes}`);
+        }
+    }
+    if (result.packages.length > 0) {
+        lines.push("packages:");
+        for (const pkg of result.packages) {
+            lines.push(`  ${pkg.id}@${pkg.version}`);
+        }
+    }
+    return lines.join("\n");
+}
+function renderLocalToolchainCurrent(result) {
+    if (!result.installed) {
+        return [
+            "No local toolchain installed.",
+            `board=${result.board_id}`,
+            `install_root=${result.install_root}`,
+            `registry=${result.registry_path}`
+        ].join("\n");
+    }
+    return [
+        "Local toolchain installed.",
+        `board=${result.board_id}`,
+        result.version ? `version=${result.version}` : "",
+        result.channel ? `channel=${result.channel}` : "",
+        result.mode ? `mode=${result.mode}` : "",
+        result.release_root ? `release_root=${result.release_root}` : "",
+        `install_root=${result.install_root}`,
+        `registry=${result.registry_path}`
+    ].filter(Boolean).join("\n");
+}
+function renderLocalToolchainInstall(result) {
+    const lines = [
+        "Local toolchain installed.",
+        `board=${result.board_id}`,
+        `version=${result.version}`,
+        `channel=${result.channel}`,
+        `host=${result.host}`,
+        `mode=${result.mode}`,
+        `install_root=${result.install_root}`,
+        `release_root=${result.release_root}`,
+        `registry=${result.registry_path}`,
+        `source=${result.source.kind}:${result.source.value}`,
+        result.source.downloaded_path ? `downloaded=${result.source.downloaded_path}` : "",
+        result.source.components?.length ? `components=${result.source.components.length}` : "",
+        `validation=${result.validation.ok ? "ok" : "failed"}`
+    ].filter(Boolean);
+    if (result.source.components?.length) {
+        lines.push("installed_components:");
+        for (const component of result.source.components) {
+            lines.push(`  ${component.id}@${component.version} ${component.mirror_kind || ""} bytes=${component.size_bytes}`);
+        }
+    }
+    if (result.installed_paths.length > 0) {
+        lines.push("installed_paths:");
+        for (const installedPath of result.installed_paths) {
+            lines.push(`  ${installedPath}`);
+        }
+    }
+    if (result.packages.length > 0) {
+        lines.push("packages:");
+        for (const pkg of result.packages) {
+            lines.push(`  ${pkg.id}@${pkg.version}`);
+        }
+    }
+    return lines.join("\n");
+}
 function renderLocalToolchainValidation(result) {
     const lines = [
         result.ok ? "Local toolchain ready." : "Local toolchain not ready.",
         `board=${result.board_id}`,
+        `mode=${result.mode}`,
         `host=${result.host.platform}/${result.host.arch}`,
         `release_root=${result.release_root}`
     ];
@@ -5617,6 +7512,22 @@ function stringFlag(parsed, name) {
 function booleanFlag(parsed, name) {
     return parsed.flags[name] === true;
 }
+function optionalBooleanFlag(parsed, name) {
+    const values = flagValues(parsed, name);
+    if (values.length === 0)
+        return undefined;
+    const value = values[values.length - 1];
+    if (value === true)
+        return true;
+    if (typeof value !== "string")
+        return `--${name} must be true or false.`;
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "y", "on"].includes(normalized))
+        return true;
+    if (["0", "false", "no", "n", "off"].includes(normalized))
+        return false;
+    return `--${name} must be true or false.`;
+}
 function switchFlag(parsed, name) {
     const values = flagValues(parsed, name);
     for (const value of values) {
@@ -5915,12 +7826,16 @@ Main workflow:
   3. Inspect server model routing:
      embed plugin install codex
      embed plugin install opencode
+     embed plugin update check
      embed service modes
      embed model list
      embed model default
   4. Run a natural-language local tool loop:
      embed agent run --prompt "验证开发板状态"
   5. Validate or use the local TaishanPi toolchain:
+     embed local toolchain list
+     embed local toolchain latest
+     embed local toolchain install
      embed local toolchain validate
      embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
      embed local build qt-smoke --build-dir ./.embed-labs/build/qt-smoke
@@ -5963,9 +7878,14 @@ Local hardware:
   embed tool list
   embed tool call device.probe --input-json '{"host":"198.19.77.2","ports":[22,15301]}'
   embed tool call wifi.scan --input-json '{"host":"198.19.77.2","user":"root"}'
+  embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve
   embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}'
   embed tool call qml.runtime.status --input-json '{"host":"198.19.77.2","user":"root","port":18130}'
   embed device list
+  embed local toolchain list
+  embed local toolchain latest
+  embed local toolchain current
+  embed local toolchain install
   embed local toolchain validate
   embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
   embed local build qt-smoke --build-dir ./.embed-labs/build/qt-smoke
@@ -5979,7 +7899,7 @@ Help:
 
 Environment:
   EMBED_BRIDGE_URL=http://127.0.0.1:18083
-  EMBED_CLOUD_API_URL=http://127.0.0.1:18100
+  EMBED_CLOUD_API_URL=https://api.embedboard.com
   EMBED_API_TOKEN=<token>
   CODEX_HOME=~/.codex
 
@@ -6034,6 +7954,8 @@ Install local AI client plugins explicitly:
   embed plugin list
   embed plugin install codex
   embed plugin install opencode
+  embed plugin update check
+  embed plugin update all
 
 Cloud build path:
 
@@ -6112,6 +8034,8 @@ Usage:
   embed auth logout [--json]
   embed plugin list [--release-dir <dir>] [--release-url <url>] [--json]
   embed plugin install <codex|opencode|all> [--release-dir <dir>] [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--force] [--json]
+  embed plugin update check [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]
+  embed plugin update <codex|opencode|all> [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]
   embed service modes [--json]
   embed model list [--json]
   embed model default [--json]
@@ -6167,7 +8091,12 @@ Usage:
   embed build image generate --workspace <workspace_id> --prompt <request> [--account <account_id>] [--image-profile <profile_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--execution-mode cloud_worker|dry_run] [--worker-pool <pool>] [--json]
   embed build image boot-logo --logo <local_image> [--account <account_id>] [--project <project_id>] [--board taishanpi] [--variant 1M-RK3566] [--kernel-logo <local_image>] [--rotate -90] [--scale 100] [--output <package.json>] [--json]
   embed image boot-logo compose --package <boot-logo-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]
-  embed local toolchain validate [--release-root <path>] [--json]
+  embed local toolchain list [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]
+  embed local toolchain latest [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--json]
+  embed local toolchain current [--install-root <path>] [--json]
+  embed local toolchain install [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--mode minimal|compile|qt|full|images] [--force] [--json]
+      Defaults to the production download channel at download.embedboard.com.
+  embed local toolchain validate [--release-root <path>] [--mode minimal|compile|qt|full|images] [--json]
   embed local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--release-root <path>] [--account <account_id>] [--json]
   embed local build qt-smoke --build-dir <dir> [--source <qt-smoke-dir>] [--release-root <path>] [--account <account_id>] [--json]
   embed debug tools [--json]
@@ -6178,6 +8107,18 @@ Usage:
   embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
   embed tool call qml.runtime.status --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
   embed tool call qml.runtime.start --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
+  embed tool call rp2350.monitor.capabilities [--json]
+  embed tool call rp2350.monitor.status [--json]
+  embed tool call rp2350.monitor.gpio.read --input-json '{"pins":[16,17]}' --approve [--json]
+  embed tool call rp2350.monitor.gpio.write --input-json '{"pin":16,"level":true}' --approve [--json]
+  embed tool call rp2350.monitor.uart.write --input-json '{"baud":115200,"text":"hello","line_ending":"lf"}' --approve [--json]
+  embed tool call rp2350.monitor.i2c.transfer --input-json '{"address":"0x50","write":"00","read_len":4}' --approve [--json]
+  embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve [--json]
+  embed tool call rp2350.monitor.logic.capture --input-json '{"pin_base":16,"pin_count":4,"sample_rate":1000000,"samples":4096}' --approve [--json]
+  embed tool call rp2350.monitor.logic.decode --input-json '{"input_path":".embed-labs/rp2350-monitor/captures/logic.jsonl","decoder":"summary"}' [--json]
+  embed tool call rp2350.monitor.wifi.manage --input-json '{"action":"scan"}' --approve [--json]
+  embed tool call rp2350.monitor.probe.debug --input-json '{"action":"status"}' --approve [--json]
+  embed tool call rp2350.monitor.operation --input-json '{"action":"logic.stop","params":{}}' --approve [--json]
   embed deploy taishanpi --host <ip> --artifact <local_file> --approve [--remote-path /userdata/embed-labs/apps/app] [--run] [--json]
   embed board deploy taishanpi --host <ip> --artifact <local_file> --approve [--remote-path /userdata/embed-labs/apps/app] [--run] [--json]
   embed device list [--json]
@@ -6211,7 +8152,7 @@ Usage:
 
 Environment:
   EMBED_BRIDGE_URL=http://127.0.0.1:18083
-  EMBED_CLOUD_API_URL=http://127.0.0.1:18100
+  EMBED_CLOUD_API_URL=https://api.embedboard.com
   EMBED_API_TOKEN=<token>
   CODEX_HOME=~/.codex
 `);