@lovinka/vitrinka 1.5.0 → 1.7.0

package/dist/cli.js

@@ -10,7 +10,7 @@
 // skills/screenshot/gallery.mjs (offline marker, COPYFILE_DISABLE, control-file excludes,
 // `--key`, repeatable `--chip`). gallery.mjs is now a passthrough shim to this file.
 // Design: vitrinka/docs/plans/2026-07-03-hand-in-hand-tooling-design.md
-import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, readdirSync, copyFileSync, mkdtempSync, chmodSync, appendFileSync, statSync, cpSync, openSync, readSync, closeSync, } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, readdirSync, copyFileSync, mkdtempSync, chmodSync, appendFileSync, statSync, cpSync, openSync, readSync, closeSync, realpathSync, } from 'node:fs';
 import { join, resolve, basename, dirname, extname, relative, sep } from 'node:path';
 import { tmpdir, hostname } from 'node:os';
 import { spawnSync, spawn } from 'node:child_process';
@@ -111,6 +111,10 @@ function buildIndex(root) {
     const m = loadManifest(root);
     const project = basename(dirname(root)) || 'project';
     const htmlPath = htmlPathOf(root);
+    // A fresh/nonexistent root builds an empty gallery — mirror saveManifest's
+    // dir creation instead of crashing with a raw ENOENT.
+    mkdirSync(root, { recursive: true });
+    ensureRootSelfIgnored(root);
     writeFileSync(htmlPath, renderHtml(m.shots, project));
     return { count: m.shots.length, htmlPath };
 }
@@ -756,12 +760,45 @@ function loadVitrinkaCfg(root) {
     }
 }
 function shareUrl(cfg) {
-    return `${cfg.base}/${cfg.project}/${cfg.slug}/${cfg.key}`;
+    const ws = cfg.workspace ? `/w/${cfg.workspace}` : '';
+    return `${cfg.base}${ws}/${cfg.project}/${cfg.slug}/${cfg.key}`;
+}
+// resolveWorkspace resolves the multitenant workspace slug for DISPLAY URLs.
+// Precedence: --workspace flag > $VITRINKA_WORKSPACE > GET {base}/api/v1/whoami
+// (token-routed, the token IS the workspace) > "" (single-tenant). whoami is a
+// pure display-URL nicety — any failure (offline, older server, non-JSON) yields
+// "" and must never fail the command that called it.
+async function resolveWorkspace(args, base) {
+    const flag = strArg(args.workspace);
+    if (flag)
+        return flag;
+    if (process.env.VITRINKA_WORKSPACE)
+        return process.env.VITRINKA_WORKSPACE;
+    try {
+        const headers = {};
+        const token = readToken();
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
+        const res = await fetch(`${base}/api/v1/whoami`, { headers, signal: AbortSignal.timeout(15_000) });
+        if (!res.ok)
+            return '';
+        return String((await res.json()).workspace || '');
+    }
+    catch {
+        // Best-effort: unreachable/older server (no whoami) ⇒ single-tenant display URLs.
+        return '';
+    }
 }
-function remoteInitCmd(root, args) {
+async function remoteInitCmd(root, args) {
     if (existsSync(vitrinkaCfgPath(root))) {
         // Sticky per session dir — reuse, so re-activation never forks the set.
         const cfg = loadVitrinkaCfg(root);
+        // Older descriptors predate the workspace field — resolve + persist once so
+        // display URLs carry /w/<ws> without a whoami call on every re-activation.
+        if (cfg.workspace === undefined) {
+            cfg.workspace = await resolveWorkspace(args, cfg.base);
+            writeFileSync(vitrinkaCfgPath(root), JSON.stringify(cfg, null, 2) + '\n');
+        }
         console.log(`vitrinka set (existing) → ${shareUrl(cfg)}`);
         return cfg;
     }
@@ -791,6 +828,7 @@ function remoteInitCmd(root, args) {
         kind: args.kind && args.kind !== true ? String(args.kind) : 'screenshots',
         issue: args.issue && args.issue !== true ? String(args.issue) : '',
     };
+    cfg.workspace = await resolveWorkspace(args, base);
     mkdirSync(root, { recursive: true });
     ensureRootSelfIgnored(root);
     writeFileSync(vitrinkaCfgPath(root), JSON.stringify(cfg, null, 2) + '\n');
@@ -978,6 +1016,86 @@ async function nameCmd(rest, args) {
     else
         console.log(`named ${segs[0]}/${segs[1]}/${segs[2]} → ${base}/${segs[0]}/${segs[1]}/${encodeURIComponent(newName)}`);
 }
+// ---------- login: the CLI device dance ----------
+// loginCmd — `vitrinka login`: the multitenant sign-in. Starts a device-code
+// request, opens the browser approval page (the signed-in user confirms the
+// code and picks a workspace), polls until the server parks the minted PAT,
+// and saves it to ~/.config/vitrinka/token. On single-tenant/mesh installs
+// (no /api/v1/cli/auth route) it explains the shared-token path instead.
+async function loginCmd(args) {
+    const base = (strArg(args.base) || process.env.VITRINKA_URL || process.env.VITRINKA_BASE_URL
+        || 'https://vitrinka.lovinka.com').replace(/\/+$/, '');
+    let start;
+    try {
+        start = await fetch(`${base}/api/v1/cli/auth`, { method: 'POST', signal: AbortSignal.timeout(15_000) });
+    }
+    catch (e) {
+        fail(`login: ${base} unreachable (${e instanceof Error ? e.message : String(e)})`);
+        return;
+    }
+    if (start.status === 404) {
+        fail(`login: ${base} has no CLI sign-in (single-tenant install?) — use the shared token instead:\n\n${tokenHelp()}`);
+        return;
+    }
+    if (!start.ok)
+        fail(`login: ${base} refused (${start.status})`);
+    const s = (await start.json());
+    const verifyUrl = `${base}${s.verify_path}`;
+    console.log('');
+    console.log(`  Confirm this code in your browser:  ${s.user_code}`);
+    console.log(`  ${verifyUrl}`);
+    console.log('');
+    // Best-effort browser launch; the printed URL is the real contract.
+    const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    spawnSync(opener, [verifyUrl], { stdio: 'ignore' });
+    const intervalMs = Math.max(1, s.interval ?? 2) * 1000;
+    const deadline = Date.now() + (s.expires_in ?? 600) * 1000;
+    process.stdout.write('  waiting for approval …');
+    while (Date.now() < deadline) {
+        await new Promise((f) => setTimeout(f, intervalMs));
+        let res;
+        try {
+            res = await fetch(`${base}/api/v1/cli/auth/claim`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ device_code: s.device_code }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch {
+            process.stdout.write('.'); // transient network blip — keep polling
+            continue;
+        }
+        if (res.status === 202) {
+            process.stdout.write('.');
+            continue;
+        }
+        if (!res.ok) {
+            console.log('');
+            fail(`login: ${res.status === 404 ? 'code expired — run vitrinka login again' : `claim failed (${res.status})`}`);
+        }
+        const { token } = (await res.json());
+        const p = tokenPath();
+        mkdirSync(dirname(p), { recursive: true });
+        writeFileSync(p, token + '\n', { mode: 0o600 });
+        console.log('\n');
+        // The token IS the workspace — show which one this machine now acts in.
+        try {
+            const who = await fetch(`${base}/api/v1/whoami`, {
+                headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(15_000),
+            });
+            const w = (await who.json());
+            console.log(`  ✓ signed in — token saved to ${p}${w.workspace ? ` (workspace: ${w.workspace})` : ''}`);
+        }
+        catch {
+            console.log(`  ✓ signed in — token saved to ${p}`);
+        }
+        console.log('  next: vitrinka install   (skills + MCP + shim, if not done yet)');
+        return;
+    }
+    console.log('');
+    fail('login: approval timed out (10 min) — run vitrinka login again');
+}
 // ---------- operator: the board-attribution persona ----------
 // operatorCmd manages the operator persona name — how vitrinka credits this
 // machine's writes on boards.
@@ -1100,6 +1218,53 @@ async function doctorCmd(args) {
         console.log(`✓ operator   ${op}`);
     else
         console.log('✗ operator   unset — board writes stay anonymous (fix: vitrinka operator <name>)');
+    // Setup surfaces (skills / shim / MCP / Claude UI) — informational rows, and
+    // `--fix` repairs everything repairable in place. Token/operator stay manual
+    // (they're credentials/identity, not installation).
+    const fix = args.fix === true;
+    const home = process.env.HOME || '';
+    const bundle = bundledSkillsDir(CLI_PATH);
+    if (bundle && home) {
+        const st = skillsStateOf(bundle, join(home, '.claude', 'skills'));
+        if (st === 'current')
+            console.log('✓ skills     current');
+        else if (fix)
+            installSkillsCmd(args);
+        else
+            console.log(`✗ skills     ${st} — repair: vitrinka doctor --fix`);
+    }
+    if (home) {
+        const shimP = shimPathOf(home);
+        const shimOk = existsSync(shimP) && readFileSync(shimP, 'utf8') === SHIM_CONTENT;
+        if (shimOk)
+            console.log(`✓ shim       ${shimP}`);
+        else if (fix) {
+            mkdirSync(dirname(shimP), { recursive: true });
+            writeFileSync(shimP, SHIM_CONTENT);
+            chmodSync(shimP, 0o755);
+            console.log(`✓ shim       rewritten → ${shimP}`);
+        }
+        else
+            console.log(`✗ shim       ${existsSync(shimP) ? 'stale (points at another CLI copy)' : 'missing'} — repair: vitrinka doctor --fix`);
+    }
+    if (claudeCliPresent()) {
+        if (mcpRegistered())
+            console.log('✓ mcp        registered');
+        else if (fix) {
+            if (registerMcp('user'))
+                console.log('✓ mcp        re-registered (--scope user)');
+            else
+                console.log('✗ mcp        re-registration failed — see output above');
+        }
+        else
+            console.log('✗ mcp        not registered — repair: vitrinka doctor --fix (or vitrinka install)');
+    }
+    if (home && existsSync(join(home, '.claude', 'vitrinka-statusline.sh'))) {
+        if (fix)
+            installClaudeCmd(args);
+        else
+            console.log('✓ claude ui  wired (refresh: vitrinka doctor --fix)');
+    }
     if (failed)
         process.exit(1);
 }
@@ -1116,9 +1281,9 @@ export function bundledSkillsDir(cliPath) {
 }
 // installSkillsCmd copies the packaged skills bundle (vitrinka + listen,
 // screenshot, artifact, brainstorming) into the Claude skills directory —
-// ~/.claude/skills by default, ./.claude/skills with --local. This is the
-// npm-package twin of install.sh's skills step, so `npm i -g @lovinka/vitrinka
-// && vitrinka install-skills` fully equips a machine without a repo checkout.
+// ~/.claude/skills by default, ./.claude/skills with --local. `npm i -g
+// @lovinka/vitrinka && vitrinka install-skills` fully equips a machine
+// without a repo checkout.
 function installSkillsCmd(args) {
     const bundle = bundledSkillsDir(CLI_PATH);
     if (!bundle)
@@ -1129,8 +1294,8 @@ function installSkillsCmd(args) {
         fail('install-skills: $HOME is not set (or pass --local)');
     const target = local ? resolve('.claude', 'skills') : join(home, '.claude', 'skills');
     mkdirSync(target, { recursive: true });
-    // Whole directories, like install.sh: a skill may nest its SKILL.md (the
-    // vitrinka skill keeps it under listen/ next to its CLI + tests).
+    // Whole directories: a skill may nest its SKILL.md (the vitrinka skill
+    // keeps it under listen/ next to its CLI + tests).
     const names = readdirSync(bundle).filter((n) => !n.startsWith('.') && statSync(join(bundle, n)).isDirectory());
     if (!names.length)
         fail(`install-skills: no skills found in ${bundle}`);
@@ -1163,80 +1328,383 @@ function installSkillsCmd(args) {
     }
     console.log(`${names.length} skill${names.length === 1 ? '' : 's'} installed (${names.sort().join(', ')})`);
 }
-// installCmd writes an executable shim `vitrinka` into ~/.local/bin (so the
-// CLI works in interactive shells AND non-interactive AI/tool shells, which a
-// zshrc alias would not) and makes sure ~/.local/bin is on PATH via a
-// marker-guarded ~/.zshrc block. Idempotent: re-running reports and no-ops.
-function installCmd(args) {
+// ---------- setup state probing (shared by install / doctor / uninstall) ----------
+// dirsEqual — recursive byte comparison, the node twin of install.sh's `diff -rq`.
+function dirsEqual(a, b) {
+    const names = new Set([...readdirSync(a), ...readdirSync(b)]);
+    for (const n of names) {
+        const pa = join(a, n), pb = join(b, n);
+        if (!existsSync(pa) || !existsSync(pb))
+            return false;
+        const da = statSync(pa).isDirectory(), db = statSync(pb).isDirectory();
+        if (da !== db)
+            return false;
+        if (da) {
+            if (!dirsEqual(pa, pb))
+                return false;
+        }
+        else if (!readFileSync(pa).equals(readFileSync(pb)))
+            return false;
+    }
+    return true;
+}
+// skillsStateOf — the bundled skills' freshness at a target skills dir. Local
+// installs rewrite CLI paths after copy, so a fresh local copy reads "outdated"
+// against the bundle — harmless (refresh is idempotent), same as install.sh.
+function skillsStateOf(bundle, target) {
+    const names = readdirSync(bundle).filter((n) => !n.startsWith('.') && statSync(join(bundle, n)).isDirectory());
+    if (names.some((n) => !existsSync(join(target, n))))
+        return 'missing';
+    return names.every((n) => dirsEqual(join(bundle, n), join(target, n))) ? 'current' : 'outdated';
+}
+const SHIM_CONTENT = `#!/bin/sh\nexec node "${CLI_PATH}" "$@"\n`;
+function shimPathOf(home) { return join(home, '.local', 'bin', 'vitrinka'); }
+function rcPathOf(home) {
+    return join(home, (process.env.SHELL || '').includes('bash') ? '.bashrc' : '.zshrc');
+}
+// claudeCliPresent / mcpRegistered / registerMcp — the `claude mcp` touchpoints.
+// The MCP target mirrors updateCmd's repo-vs-npm detection: a checkout registers
+// the repo's stdio shim (a `git pull` IS the update), an npm install registers
+// the published package via npx.
+function claudeCliPresent() {
+    return !spawnSync('claude', ['--version'], { stdio: 'ignore' }).error;
+}
+function mcpRegistered() {
+    const r = spawnSync('claude', ['mcp', 'list'], { encoding: 'utf8' });
+    return r.status === 0 && /\bvitrinka\b/.test(r.stdout);
+}
+function mcpTarget() {
+    const repoTop = git(['rev-parse', '--show-toplevel'], dirname(CLI_PATH));
+    const shim = repoTop ? join(repoTop, 'mcp', 'server.ts') : '';
+    if (shim && existsSync(shim))
+        return ['node', shim];
+    return ['npx', '-y', '--package=@lovinka/vitrinka', 'vitrinka-mcp'];
+}
+function registerMcp(scope) {
+    spawnSync('claude', ['mcp', 'remove', '--scope', scope, 'vitrinka'], { stdio: 'ignore' });
+    return spawnSync('claude', ['mcp', 'add', '--scope', scope, 'vitrinka', '--', ...mcpTarget()], { stdio: 'inherit' }).status === 0;
+}
+// promptLine — visible one-line read from the controlling TTY ('' when
+// non-interactive, like promptYesNo).
+function promptLine(question) {
+    if (!process.stdin.isTTY)
+        return '';
+    process.stdout.write(question);
+    try {
+        const fd = openSync('/dev/tty', 'r');
+        const buf = Buffer.alloc(512);
+        const n = readSync(fd, buf, 0, 512, null);
+        closeSync(fd);
+        return buf.toString('utf8', 0, n).trim();
+    }
+    catch {
+        return ''; // no controlling TTY — treat as non-interactive, never block
+    }
+}
+// promptSecret — promptLine with terminal echo off (token input, the old
+// install.sh's `read -rs`). Degrades to a visible read if stty is unavailable.
+function promptSecret(question) {
+    if (!process.stdin.isTTY)
+        return '';
+    const echoOff = spawnSync('stty', ['-echo'], { stdio: 'inherit' }).status === 0;
+    const val = promptLine(question);
+    if (echoOff) {
+        spawnSync('stty', ['echo'], { stdio: 'inherit' });
+        process.stdout.write('\n'); // the suppressed Enter
+    }
+    return val;
+}
+// ---------- install: status-first onboarding ----------
+//
+// The one-command machine setup (decisions: docs/specs/2026-07-08-cli-onboarding-
+// decisions.md — this replaced the deleted install.sh). Status-first: print a
+// ✓/✗ table of every component, silently install the harmless ones (skills,
+// shim, PATH, completion — own dirs, fully reversible), then ask ONLY for the
+// missing config-touchers (MCP registration, write token, operator persona,
+// Claude UI wiring). Re-runs are near-silent. Non-interactive runs (CI,
+// curl|bash) skip every prompt and print the manual command instead.
+async function installCmd(args) {
     const home = process.env.HOME;
     if (!home)
         fail('install: $HOME is not set');
-    // Skills first — `npm i -g @lovinka/vitrinka && vitrinka install` must fully
-    // equip a machine on its own (there is deliberately no npm postinstall side
-    // effect). Idempotent: re-runs refresh the bundle copies.
-    if (bundledSkillsDir(CLI_PATH))
+    const local = args.local === true;
+    const base = resolveBaseUrl(strArg(args.base));
+    const mcpScope = local ? 'project' : 'user';
+    // ---- probe (before touching anything) ----
+    const bundle = bundledSkillsDir(CLI_PATH);
+    const skillsTarget = local ? resolve('.claude', 'skills') : join(home, '.claude', 'skills');
+    const skills = bundle ? skillsStateOf(bundle, skillsTarget) : 'no-bundle';
+    const shimP = shimPathOf(home);
+    const shimOk = existsSync(shimP) && readFileSync(shimP, 'utf8') === SHIM_CONTENT;
+    const rc = rcPathOf(home);
+    const completionOk = existsSync(rc) && readFileSync(rc, 'utf8').includes('# vitrinka-completion');
+    const haveClaude = claudeCliPresent();
+    const mcpOk = haveClaude ? mcpRegistered() : false;
+    const tokenSrc = tokenSource();
+    const op = readOperator(true);
+    const wrapperP = join(home, '.claude', 'vitrinka-statusline.sh');
+    const uiOk = existsSync(wrapperP);
+    const row = (ok, label, detail) => {
+        console.log(`  ${ok ? '✓' : '✗'} ${label.padEnd(11)}${detail}`);
+    };
+    console.log(`vitrinka setup — ${base}${local ? '  (local scope)' : ''}`);
+    row(skills === 'current', 'skills', skills === 'no-bundle' ? 'bundle not found next to the CLI (reinstall the package)'
+        : skills === 'current' ? `current → ${skillsTarget}` : `${skills} → will refresh`);
+    if (!local)
+        row(shimOk, 'shim', shimOk ? shimP : 'will install');
+    if (!local)
+        row(completionOk, 'completion', completionOk ? rc : args['no-completion'] === true ? 'skipped (--no-completion)' : 'will enable');
+    row(mcpOk, 'mcp', mcpOk ? 'registered' : haveClaude ? `not registered (scope ${mcpScope})` : 'claude CLI not found');
+    row(tokenSrc !== 'missing', 'token', tokenSrc === 'missing' ? 'missing — writes will 401' : `present (${tokenSrc === 'env' ? '$VITRINKA_TOKEN' : tokenPath()})`);
+    row(!!op, 'operator', op || 'unset — board writes stay anonymous');
+    row(uiOk, 'claude ui', uiOk ? 'statusline + footer wired' : 'not wired');
+    console.log('');
+    // ---- silent steps: skills, shim, PATH, completion (reversible, own dirs) ----
+    if (bundle && skills !== 'current')
         installSkillsCmd(args);
-    else
-        console.log('skills: bundle not found next to the CLI — skipped (reinstall the package, or run install.sh from a checkout)');
-    const binDir = join(home, '.local', 'bin');
-    const shimPath = join(binDir, 'vitrinka');
-    const shim = `#!/bin/sh\nexec node "${CLI_PATH}" "$@"\n`;
-    if (existsSync(shimPath) && readFileSync(shimPath, 'utf8') === shim) {
-        console.log(`shim already installed: ${shimPath}`);
+    if (!local) {
+        if (!shimOk) {
+            mkdirSync(dirname(shimP), { recursive: true });
+            writeFileSync(shimP, SHIM_CONTENT);
+            chmodSync(shimP, 0o755);
+            console.log(`✓ shim → ${shimP}`);
+        }
+        const binDir = dirname(shimP);
+        const marker = '# vitrinka-cli';
+        const zshrc = join(home, '.zshrc');
+        const zshrcContent = existsSync(zshrc) ? readFileSync(zshrc, 'utf8') : '';
+        if (!zshrcContent.includes(marker) && !(process.env.PATH || '').split(':').includes(binDir)) {
+            appendFileSync(zshrc, `\n${marker}\nexport PATH="$HOME/.local/bin:$PATH"\n`);
+            console.log(`✓ PATH block → ${zshrc} (open a new shell, or: source ${zshrc})`);
+        }
+        if (args['no-completion'] !== true && !completionOk) {
+            const shellName = rc.endsWith('.bashrc') ? 'bash' : 'zsh';
+            appendFileSync(rc, `\n# vitrinka-completion\neval "$(vitrinka completion ${shellName})"\n`);
+            console.log(`✓ ${shellName} completion → ${rc}`);
+        }
+    }
+    // ---- asked steps: the config-touchers ----
+    // 1. MCP registration (claude's registry).
+    const mcpCmdHint = `claude mcp add --scope ${mcpScope} vitrinka -- ${mcpTarget().join(' ')}`;
+    if (!haveClaude) {
+        console.error(`⚠ claude CLI not found — register the MCP later with:\n  ${mcpCmdHint}`);
+    }
+    else if (!mcpOk) {
+        if (args['no-mcp'] === true)
+            console.log('mcp: skipped (--no-mcp)');
+        else if (args.mcp === true || promptYesNo(`Register the vitrinka MCP for Claude Code (scope ${mcpScope})? [Y/n] `)) {
+            if (registerMcp(mcpScope))
+                console.log(`✓ mcp registered (--scope ${mcpScope})`);
+            else
+                console.error(`⚠ mcp registration failed — retry with:\n  ${mcpCmdHint}`);
+        }
+        else {
+            console.log(`mcp: skipped — register later with:\n  ${mcpCmdHint}`);
+        }
+    }
+    // 2. Write token (reads work without one; pushes/board writes 401).
+    if (tokenSrc === 'missing') {
+        if (process.stdin.isTTY) {
+            console.log('No write token yet — reads work without one, writes 401. It is the');
+            console.log('server\'s VITRINKA_TOKEN (one shared secret — copy it from a configured');
+            console.log('machine or the server admin; details: vitrinka doctor).');
+            const tok = promptSecret('Write token (Enter to skip): ');
+            if (tok) {
+                mkdirSync(dirname(tokenPath()), { recursive: true });
+                writeFileSync(tokenPath(), tok + '\n');
+                chmodSync(tokenPath(), 0o600);
+                console.log(`✓ token → ${tokenPath()}`);
+            }
+            else {
+                console.error(`⚠ no token — writes will 401 until you add one (${tokenPath()})`);
+            }
+        }
+        else {
+            console.error('⚠ no token and non-interactive — writes will 401 until you add one:');
+            console.error(tokenHelp());
+        }
     }
-    else {
-        mkdirSync(binDir, { recursive: true });
-        writeFileSync(shimPath, shim);
-        chmodSync(shimPath, 0o755);
-        console.log(`installed shim: ${shimPath} → node ${CLI_PATH}`);
+    // 3. Operator persona (board attribution) — same engine as `vitrinka operator`.
+    const opArg = strArg(args.operator);
+    if (opArg) {
+        await operatorCmd(['operator', opArg], args);
     }
-    const marker = '# vitrinka-cli';
-    const zshrc = join(home, '.zshrc');
-    const zshrcContent = existsSync(zshrc) ? readFileSync(zshrc, 'utf8') : '';
-    if (zshrcContent.includes(marker)) {
-        console.log(`PATH block already in ${zshrc}`);
+    else if (!op) {
+        const name = promptLine('Operator name — how should vitrinka credit you on boards? (Enter to skip): ');
+        if (name)
+            await operatorCmd(['operator', name], args);
+        else
+            console.error('⚠ no operator — board writes stay anonymous (set later: vitrinka operator <name>)');
     }
-    else if ((process.env.PATH || '').split(':').includes(binDir)) {
-        console.log(`${binDir} already on PATH — ${zshrc} left untouched`);
+    // 4. Claude Code UI wiring (edits ~/.claude/settings.json). Already-wired
+    // machines refresh silently (consent was given once); fresh ones are asked.
+    if (args['no-claude'] === true) {
+        console.log('claude ui: skipped (--no-claude)');
     }
-    else {
-        appendFileSync(zshrc, `\n${marker}\nexport PATH="$HOME/.local/bin:$PATH"\n`);
-        console.log(`added PATH block to ${zshrc} (open a new shell, or: source ${zshrc})`);
+    else if (uiOk || args.claude === true
+        || promptYesNo('Wire Claude Code UI (🧷 board statusline segment + clickable footer badge)? [Y/n] ')) {
+        installClaudeCmd(args);
     }
-    // Shell completion — state-aware, opt-out via --no-completion. Appends a
-    // single guarded `eval "$(vitrinka completion zsh)"` line (skipped if present).
-    if (args['no-completion'] === true) {
-        console.log('completion: skipped (--no-completion)');
+    else if (!process.stdin.isTTY) {
+        console.log('claude ui: skipped (non-interactive — run `vitrinka install-claude`, or pass --claude)');
     }
     else {
-        const compMarker = '# vitrinka-completion';
-        const shellName = (process.env.SHELL || '').includes('bash') ? 'bash' : 'zsh';
-        const rc = join(home, shellName === 'bash' ? '.bashrc' : '.zshrc');
-        const rcContent = existsSync(rc) ? readFileSync(rc, 'utf8') : '';
-        if (rcContent.includes(compMarker)) {
-            console.log(`completion already enabled in ${rc}`);
+        console.log('claude ui: skipped (re-run any time: vitrinka install-claude)');
+    }
+    // ---- environment checks (non-fatal) ----
+    if (spawnSync('jq', ['--version'], { stdio: 'ignore' }).error) {
+        console.error('⚠ jq missing (brew install jq) — the statusline 🧷 board segment won\'t render without it');
+    }
+    if (spawnSync('cwebp', ['-version'], { stdio: 'ignore' }).error) {
+        console.error('⚠ cwebp missing (brew install webp) — snap falls back to PNG');
+    }
+    try {
+        const res = await fetch(`${base}/healthz`, { signal: AbortSignal.timeout(5_000) });
+        if (!res.ok)
+            console.error(`⚠ ${base} answered HTTP ${res.status}`);
+    }
+    catch {
+        console.error(`⚠ ${base} unreachable — vitrinka is WireGuard-mesh-only; bring the VPN up`);
+    }
+    console.log('');
+    console.log('done — health check any time with: vitrinka doctor');
+}
+// ---------- uninstall: clean offboarding ----------
+// stripMarkerBlock removes a marker comment line AND the single payload line
+// after it (the exact shape install writes), plus the blank separator install
+// prepended. PURE — unit-tested.
+export function stripMarkerBlock(content, marker) {
+    const lines = content.split('\n');
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].trim() === marker) {
+            if (out.length && out[out.length - 1] === '')
+                out.pop(); // the blank install added
+            i++; // skip the payload line too
+            continue;
         }
-        else {
-            appendFileSync(rc, `\n${compMarker}\neval "$(vitrinka completion ${shellName})"\n`);
-            console.log(`added ${shellName} completion to ${rc} (open a new shell, or: source ${rc})`);
+        out.push(lines[i]);
+    }
+    return out.join('\n');
+}
+// The bundled skill names — used by uninstall when the bundle isn't next to the
+// CLI anymore (e.g. the package was removed first).
+const BUNDLED_SKILLS = ['artifact', 'brainstorming', 'screenshot', 'vitrinka'];
+// uninstallCmd removes everything install put on the machine — the exact
+// inverse: bundled skills + the /vitrinka:listen stub, shim, rc marker blocks,
+// statusline wrapper (restoring the original statusLine command), the /boards/
+// footer badge entry, and the MCP registration. ~/.config/vitrinka (token +
+// operator) survives by default; --purge removes it too.
+function uninstallCmd(args) {
+    const home = process.env.HOME;
+    if (!home)
+        fail('uninstall: $HOME is not set');
+    const local = args.local === true;
+    if (args.yes !== true && !promptYesNo(`Remove vitrinka from this machine (skills, shim, completion, Claude wiring, MCP${args.purge === true ? ', token+operator' : ''})? [Y/n] `)) {
+        fail('uninstall: aborted (non-interactive runs need --yes)', 2);
+    }
+    // Skills + the /vitrinka:listen command stub.
+    const bundle = bundledSkillsDir(CLI_PATH);
+    const names = bundle
+        ? readdirSync(bundle).filter((n) => !n.startsWith('.') && statSync(join(bundle, n)).isDirectory())
+        : BUNDLED_SKILLS;
+    const skillsDir = local ? resolve('.claude', 'skills') : join(home, '.claude', 'skills');
+    const commandsDir = local ? resolve('.claude', 'commands', 'vitrinka') : join(home, '.claude', 'commands', 'vitrinka');
+    for (const n of names) {
+        if (!existsSync(join(skillsDir, n)))
+            continue;
+        rmSync(join(skillsDir, n), { recursive: true, force: true });
+        console.log(`✓ removed skill ${n}`);
+    }
+    if (existsSync(join(commandsDir, 'listen.md'))) {
+        rmSync(join(commandsDir, 'listen.md'));
+        try {
+            rmSync(commandsDir, { recursive: false });
+        }
+        catch { /* not empty — other files live there */ }
+        console.log('✓ removed /vitrinka:listen command stub');
+    }
+    // Shim + rc marker blocks (global installs only — local never wrote them).
+    const shimP = shimPathOf(home);
+    if (existsSync(shimP)) {
+        rmSync(shimP);
+        console.log(`✓ removed shim ${shimP}`);
+    }
+    for (const [file, marker] of [
+        [join(home, '.zshrc'), '# vitrinka-cli'],
+        [join(home, '.zshrc'), '# vitrinka-completion'],
+        [join(home, '.bashrc'), '# vitrinka-completion'],
+    ]) {
+        if (!existsSync(file))
+            continue;
+        const cur = readFileSync(file, 'utf8');
+        const next = stripMarkerBlock(cur, marker);
+        if (next !== cur) {
+            writeFileSync(file, next);
+            console.log(`✓ removed ${marker} block from ${file}`);
         }
     }
-    // Claude Code UI wiring — consent-gated (it edits ~/.claude/settings.json):
-    // --claude / --no-claude decide outright; otherwise ask on a TTY, skip with a
-    // hint when non-interactive (curl|bash, CI).
-    if (args['no-claude'] === true) {
-        console.log('claude wiring: skipped (--no-claude)');
+    // Claude UI wiring — restore statusLine from the wrapper's VITRINKA_ORIG,
+    // drop the /boards/ footer entry, delete the wrapper.
+    const settingsPath = join(home, '.claude', 'settings.json');
+    const wrapperP = join(home, '.claude', 'vitrinka-statusline.sh');
+    if (existsSync(settingsPath)) {
+        let settings;
+        try {
+            settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        }
+        catch (e) {
+            fail(`uninstall: ${settingsPath} is not valid JSON — nothing was changed there; fix it first (${e.message})`);
+        }
+        let changed = false;
+        const sl = settings.statusLine;
+        if (sl?.command && sl.command.replace(/^~(?=\/)/, home) === wrapperP) {
+            const orig = existsSync(wrapperP) ? wrapperOrigCommand(readFileSync(wrapperP, 'utf8')) : '';
+            if (orig)
+                settings.statusLine = { type: 'command', command: orig };
+            else
+                delete settings.statusLine;
+            changed = true;
+            console.log(`✓ statusline restored${orig ? ` → ${orig}` : ' (removed — none was configured before)'}`);
+        }
+        const arr = settings.footerLinksRegexes;
+        if (Array.isArray(arr)) {
+            const kept = arr.filter((e) => !(typeof e?.pattern === 'string' && e.pattern.replaceAll('\\', '').includes('/boards/')));
+            if (kept.length !== arr.length) {
+                if (kept.length)
+                    settings.footerLinksRegexes = kept;
+                else
+                    delete settings.footerLinksRegexes;
+                changed = true;
+                console.log('✓ footer badge entry removed');
+            }
+        }
+        if (changed)
+            writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
     }
-    else if (args.claude === true || promptYesNo('Wire Claude Code UI (🧷 board statusline segment + clickable footer badge)? [Y/n] ')) {
-        installClaudeCmd(args);
+    if (existsSync(wrapperP)) {
+        rmSync(wrapperP);
+        console.log(`✓ removed ${wrapperP}`);
     }
-    else if (!process.stdin.isTTY) {
-        console.log('claude wiring: skipped (non-interactive — run `vitrinka install-claude`, or pass --claude)');
+    // MCP registration (both scopes — cheap, and remove is idempotent).
+    if (claudeCliPresent()) {
+        for (const scope of local ? ['project', 'user'] : ['user', 'project']) {
+            spawnSync('claude', ['mcp', 'remove', '--scope', scope, 'vitrinka'], { stdio: 'ignore' });
+        }
+        console.log('✓ MCP registration removed');
     }
-    else {
-        console.log('claude wiring: skipped (re-run any time: vitrinka install-claude)');
+    // Token + operator only with --purge — they're credentials, not installation.
+    const cfgDir = join(home, '.config', 'vitrinka');
+    if (args.purge === true) {
+        if (existsSync(cfgDir)) {
+            rmSync(cfgDir, { recursive: true, force: true });
+            console.log(`✓ purged ${cfgDir}`);
+        }
+    }
+    else if (existsSync(cfgDir)) {
+        console.log(`token/operator kept at ${cfgDir} (remove with --purge)`);
     }
-    console.log('done — try: vitrinka --help');
+    console.log('uninstall done');
 }
 // ---------- install-claude: Claude Code UI wiring ----------
 //
@@ -1274,8 +1742,9 @@ export function hasBoardFooterLink(settings) {
 // original command is recorded on the VITRINKA_ORIG line (single-quoted), both
 // to run it and so a re-run can recover it instead of wrapping the wrapper.
 // Board detection mirrors the CLI's capture-root contract: .screenshots/.vitrinka
-// with {base, key} → ${base}/boards/${key}. Needs jq (like the statusline
-// examples in Claude's own docs); without jq it degrades to pass-through.
+// with {base, key[, workspace]} → ${base}[/w/${workspace}]/boards/${key}. Needs jq
+// (like the statusline examples in Claude's own docs); without jq it degrades to
+// pass-through.
 export function buildStatuslineWrapper(origCmd) {
     const quoted = origCmd.replaceAll("'", `'\\''`);
     return `#!/bin/bash
@@ -1306,7 +1775,9 @@ for VJSON in "$DIR/.screenshots/.vitrinka" "$PROJECT_DIR/.screenshots/.vitrinka"
   [ -f "$VJSON" ] || continue
   VBASE=$(jq -r '.base // empty' "$VJSON" 2>/dev/null)
   VKEY=$(jq -r '.key // empty' "$VJSON" 2>/dev/null)
+  VWS=$(jq -r '.workspace // empty' "$VJSON" 2>/dev/null)
   if [ -n "$VBASE" ] && [ -n "$VKEY" ]; then
+    [ -n "$VWS" ] && VBASE="$VBASE/w/$VWS"
     BOARD=$(printf '\\033[35m🧷\\033[0m \\033[2m%s\\033[0m' "$VBASE/boards/$VKEY")
   fi
   break
@@ -1421,6 +1892,251 @@ export function installClaudeCmd(_args) {
     }
     console.log(`install-claude done — restart Claude Code sessions to pick up ${settingsPath}`);
 }
+// ---------- open: jump to the live board ----------
+// boardUrlOf — the current capture root's live board URL ('' when the root has
+// no .vitrinka descriptor yet). Board slug == set key (board-from-set contract).
+function boardUrlOf(root) {
+    if (!existsSync(vitrinkaCfgPath(root)))
+        return '';
+    const cfg = loadVitrinkaCfg(root);
+    const ws = cfg.workspace ? `/w/${cfg.workspace}` : '';
+    return `${cfg.base}${ws}/boards/${cfg.key}`;
+}
+// openCmd opens the thing you're working on: the capture root's live board when
+// one exists, else the vitrinka home. --qr renders the URL as a terminal QR
+// (scan with the iPad → annotate with the Pencil) and skips the local browser;
+// --print only prints.
+function openCmd(root, args) {
+    const url = boardUrlOf(root) || resolveBaseUrl(strArg(args.base));
+    console.log(url);
+    if (args.qr === true) {
+        // Zero-dep rule: we shell to qrencode rather than hand-roll a QR encoder.
+        const r = spawnSync('qrencode', ['-t', 'ANSIUTF8', url], { stdio: 'inherit' });
+        if (r.error)
+            console.error('open: qrencode not found (brew install qrencode) — URL printed above');
+        return; // QR targets another device — don't also grab the local browser
+    }
+    if (args.print === true)
+        return;
+    const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    const r = spawnSync(opener, [url], { stdio: 'ignore' });
+    if (r.error || r.status !== 0)
+        console.error(`open: could not launch ${opener} — URL printed above`);
+}
+// ---------- status: the session dashboard ----------
+// statusCmd — one glance at this repo+branch's vitrinka world: the live board,
+// the open work queue (same scope derivation as `watch`), and who holds the
+// listener lease. Degrades row-by-row when the server is unreachable.
+async function statusCmd(root, args) {
+    const base = resolveBaseUrl(strArg(args.base));
+    const cwd = resolve('.');
+    const project = sanitizeSeg(strArg(args.project) || basename(mainWorktreeTop(cwd) || cwd), 64);
+    const branch = sanitizeSeg(strArg(args.branch) || git(['branch', '--show-current'], cwd) || 'main', 100);
+    console.log(`vitrinka status — ${project}/${branch}`);
+    const board = boardUrlOf(root);
+    console.log(board ? `  board      ${board}` : '  board      none yet (publish one: vitrinka board-from-set)');
+    try {
+        const q = new URLSearchParams({ status: 'open', project, branch });
+        const d = await watchFetchJson(`${base}/api/v1/work?${q}`, 15_000);
+        const items = Array.isArray(d?.work) ? d.work : [];
+        console.log(`  queue      ${items.length} open item${items.length === 1 ? '' : 's'}`);
+        for (const it of items.slice(0, 10))
+            console.log(`             ${announceLine(it)}`);
+        if (items.length > 10)
+            console.log(`             … ${items.length - 10} more`);
+    }
+    catch (e) {
+        console.log(`  queue      unreachable (${e instanceof Error ? e.message : e})`);
+    }
+    try {
+        const d = await watchFetchJson(`${base}/api/v1/work/listeners`, 15_000);
+        const ls = Array.isArray(d?.listeners) ? d.listeners : [];
+        const boardSlug = board ? board.slice(board.lastIndexOf('/') + 1) : '';
+        const mine = ls.filter((l) => l.scopeKind === 'all'
+            || (l.scopeKind === 'project' && l.scope === project && (!l.branch || l.branch === branch))
+            || (l.scopeKind === 'board' && !!boardSlug && l.scope === boardSlug));
+        if (!mine.length)
+            console.log('  listener   none — arm one with /vitrinka:listen (or: vitrinka watch)');
+        for (const l of mine) {
+            console.log(`  listener   ${l.actor || 'anonymous'} @ ${l.session || '?'} (${l.scopeKind}${l.scope ? ` ${l.scope}` : ''}${l.branch ? `/${l.branch}` : ''})`);
+        }
+    }
+    catch (e) {
+        console.log(`  listener   unreachable (${e instanceof Error ? e.message : e})`);
+    }
+}
+// ---------- passive update notifier + first-run hint ----------
+// cmpSemver — numeric dotted-version compare (>0: a newer). PURE — unit-tested.
+export function cmpSemver(a, b) {
+    const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const d = (pa[i] || 0) - (pb[i] || 0);
+        if (d)
+            return d;
+    }
+    return 0;
+}
+// Commands that must never carry the notifier/hint noise (setup and meta paths).
+const HINT_SKIP = new Set(['install', 'install-claude', 'install-skills', 'update', 'uninstall',
+    'doctor', 'help', 'completion', '__complete', 'ai']);
+function updateCheckPath() {
+    return join(process.env.HOME || '', '.config', 'vitrinka', 'update-check');
+}
+// maybeNotifyUpdate — one dim stderr line when a newer published version is
+// known, npm installs only (a repo checkout is a dev seat that pulls itself).
+// The registry check runs DETACHED at most once a day and writes a cache file;
+// the hot path only ever reads it — a command never waits on the network.
+function maybeNotifyUpdate(cmd) {
+    if (HINT_SKIP.has(cmd) || !process.stderr.isTTY || !process.env.HOME)
+        return;
+    if (git(['rev-parse', '--show-toplevel'], dirname(CLI_PATH)))
+        return;
+    const p = updateCheckPath();
+    let cache = {};
+    try {
+        cache = JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch {
+        // Absent or corrupt cache — the background refresh below rewrites it.
+    }
+    const current = pkgVersion();
+    if (cache.latest && current && cmpSemver(cache.latest, current) > 0) {
+        console.error(`\x1b[2mupdate available ${current} → ${cache.latest} · run: vitrinka update\x1b[0m`);
+    }
+    if (Date.now() - (cache.ts || 0) < 24 * 3600 * 1000)
+        return;
+    const script = `const fs=require('fs'),path=require('path'),f=${JSON.stringify(p)};`
+        + `fetch('https://registry.npmjs.org/@lovinka/vitrinka/latest',{signal:AbortSignal.timeout(10000)})`
+        + `.then(r=>r.json()).then(d=>{fs.mkdirSync(path.dirname(f),{recursive:true});`
+        + `fs.writeFileSync(f,JSON.stringify({ts:Date.now(),latest:String(d.version||'')}))}).catch(()=>{})`;
+    try {
+        spawn(process.execPath, ['-e', script], { detached: true, stdio: 'ignore' }).unref();
+    }
+    catch {
+        // A notifier must never break the actual command.
+    }
+}
+// maybeHintFirstRun — one stderr line on a machine with zero vitrinka setup
+// (no skills, no token, no shim). All three must be absent, so a configured
+// machine (or a local-scope one with a token) is never nagged.
+function maybeHintFirstRun(cmd) {
+    if (HINT_SKIP.has(cmd))
+        return;
+    const home = process.env.HOME;
+    if (!home)
+        return;
+    if (existsSync(join(home, '.claude', 'skills', 'vitrinka')))
+        return;
+    if (readToken())
+        return;
+    if (existsSync(shimPathOf(home)))
+        return;
+    console.error('\x1b[2mhint: this machine has no vitrinka setup yet — run: vitrinka install\x1b[0m');
+}
+// ---------- what's new (changelog) ----------
+// changelogSince — the `## x.y.z` sections newer than `since`, verbatim.
+// '' when nothing is newer or the file has no versioned headings. PURE.
+export function changelogSince(md, since) {
+    const out = [];
+    let taking = false;
+    for (const line of md.split('\n')) {
+        const m = /^##\s+\[?(\d+(?:\.\d+)*)\]?/.exec(line);
+        if (m) {
+            if (since && cmpSemver(m[1], since) <= 0)
+                break;
+            taking = true;
+        }
+        if (taking)
+            out.push(line);
+    }
+    return out.join('\n').trim();
+}
+// ---------- update: bring the CLI + installed surfaces to the latest ----------
+// pkgVersion reads the version of the package the running CLI belongs to.
+// dirname(CLI_PATH) is pkg/src (repo checkout) or <pkg>/dist (npm install) —
+// package.json sits one level up in both layouts.
+function pkgVersion() {
+    try {
+        return String(JSON.parse(readFileSync(join(dirname(CLI_PATH), '..', 'package.json'), 'utf8')).version || '');
+    }
+    catch {
+        return ''; // no package.json next to the CLI (odd layout) — version is cosmetic here
+    }
+}
+// updateCmd updates the CLI source (git pull in a repo checkout, `npm i -g` for
+// a global npm install — detected from where the running file lives), then
+// refreshes every surface a previous install put on this machine: the skills
+// bundle (+ /vitrinka:listen command stub) and, ONLY where it was consented to
+// before, the Claude Code UI wiring. It never asks new consent questions —
+// that stays `vitrinka install`'s job. The refresh steps re-exec the (possibly
+// just replaced) CLI file so they run the NEW code, not this stale process.
+async function updateCmd(args) {
+    const repoTop = git(['rev-parse', '--show-toplevel'], dirname(CLI_PATH));
+    if (repoTop) {
+        // Repo checkout — the shim/MCP run the source directly, so a pull IS the update.
+        const before = git(['rev-parse', '--short', 'HEAD'], repoTop);
+        console.log(`repo checkout ${repoTop} (${before || '?'}) — git pull --ff-only…`);
+        const pull = spawnSync('git', ['-C', repoTop, 'pull', '--ff-only'], { stdio: 'inherit' });
+        if (pull.status !== 0)
+            fail('update: git pull --ff-only failed — fix the repo state (dirty tree / diverged branch) and re-run');
+        const after = git(['rev-parse', '--short', 'HEAD'], repoTop);
+        if (after === before)
+            console.log(`✓ already up to date (${after})`);
+        else {
+            console.log(`✓ updated ${before} → ${after}`);
+            // What's new — the pulled commits, capped so a long-idle machine doesn't scroll.
+            const log = git(['log', '--oneline', '--no-decorate', `${before}..${after}`], repoTop);
+            if (log) {
+                const lines = log.split('\n');
+                for (const l of lines.slice(0, 30))
+                    console.log(`  ${l}`);
+                if (lines.length > 30)
+                    console.log(`  … ${lines.length - 30} more`);
+            }
+        }
+    }
+    else {
+        // Global npm install — compare against the registry, update when behind.
+        const current = pkgVersion();
+        const view = spawnSync('npm', ['view', '@lovinka/vitrinka', 'version'], { encoding: 'utf8' });
+        const latest = view.status === 0 ? view.stdout.trim() : '';
+        if (!latest) {
+            fail(`update: could not read the registry version (npm view @lovinka/vitrinka version): ${String(view.stderr || view.error || '').trim().slice(0, 200) || 'unknown error'}`);
+        }
+        if (latest === current) {
+            console.log(`✓ already at the latest version (${current})`);
+        }
+        else {
+            console.log(`updating @lovinka/vitrinka ${current || '?'} → ${latest}…`);
+            const inst = spawnSync('npm', ['install', '-g', '@lovinka/vitrinka@latest'], { stdio: 'inherit' });
+            if (inst.status !== 0)
+                fail('update: npm install -g @lovinka/vitrinka@latest failed (see npm output above)');
+            console.log(`✓ @lovinka/vitrinka ${latest}`);
+            // What's new — npm just replaced the package files in place, so the
+            // CHANGELOG next to the CLI is the NEW one; print its sections > current.
+            try {
+                const news = changelogSince(readFileSync(join(dirname(CLI_PATH), '..', 'CHANGELOG.md'), 'utf8'), current);
+                if (news)
+                    console.log(`\n${news}\n`);
+            }
+            catch {
+                // Older packages ship no CHANGELOG.md — nothing to show.
+            }
+        }
+    }
+    // Refresh installed surfaces from the NEW code — skills always (an install
+    // implies them), Claude wiring only if the wrapper shows prior consent.
+    const rerun = (sub) => spawnSync(process.execPath, [CLI_PATH, ...sub], { stdio: 'inherit' }).status === 0;
+    if (!rerun(['install-skills', ...(args.local === true ? ['--local'] : [])])) {
+        fail('update: skills refresh failed — re-run: vitrinka install-skills');
+    }
+    const wrapper = join(process.env.HOME || '', '.claude', 'vitrinka-statusline.sh');
+    if (existsSync(wrapper)) {
+        if (!rerun(['install-claude']))
+            console.error('⚠ update: Claude UI refresh failed — re-run: vitrinka install-claude');
+    }
+    console.log('update done — try: vitrinka --help');
+}
 // ---------- snap: one-shot capture → manifest → detached push ----------
 // Filename slug: diacritics folded (Přihlášení → prihlaseni), non-alnum → '-', capped.
 export function kebab(s) {
@@ -1972,7 +2688,7 @@ createRoot(document.getElementById('root')).render(html\`<\${App} />\`);
 </html>
 `;
 }
-function artifactInitCmd(args) {
+async function artifactInitCmd(args) {
     const slugRaw = strArg(args.slug);
     if (!slugRaw) {
         console.error('artifact-init: --slug <slug> is required');
@@ -1991,11 +2707,11 @@ function artifactInitCmd(args) {
     mkdirSync(dir, { recursive: true });
     writeFileSync(indexPath, blankScaffold(title, existsSync(join(dir, 'data.json'))));
     ensureGitIgnored(process.cwd(), '.artifacts/');
-    remoteInitCmd(dir, { ...args, key: slug, kind });
+    await remoteInitCmd(dir, { ...args, key: slug, kind });
     console.log(`scaffolded ${indexPath}`);
     console.log(`author the App, then: node ${CLI_PATH} push --root ${dir} --title "<Human title>"`);
 }
-function artifactFromSetCmd(args) {
+async function artifactFromSetCmd(args) {
     const slugRaw = strArg(args.slug);
     if (!slugRaw) {
         console.error('artifact-from-set: --slug <slug> is required');
@@ -2021,7 +2737,7 @@ function artifactFromSetCmd(args) {
     const title = strArg(args.title) || (fromManifest.journey && fromManifest.journey.title) || slug;
     writeFileSync(indexPath, composedScaffold(title, `${slug}.zip`));
     ensureGitIgnored(process.cwd(), '.artifacts/');
-    remoteInitCmd(dir, { ...args, key: slug, kind: strArg(args.kind) || 'report' });
+    await remoteInitCmd(dir, { ...args, key: slug, kind: strArg(args.kind) || 'report' });
     // Record the source screenshot set (project/branchSlug/key) so push sends ?source= and
     // vitrinka can cross-link set ↔ artifact both ways.
     let source = strArg(args.source);
@@ -2102,17 +2818,35 @@ export const COMMANDS = [
         examples: ['vitrinka operator', 'vitrinka operator "Lukáš"'],
     },
     {
-        name: 'doctor', summary: 'Check this machine\'s setup: server reachable, write token valid, operator set',
+        name: 'login', summary: 'Sign this machine in: browser approval mints a personal, workspace-scoped token',
         usage: '[--base <url>]', flags: [BASE_FLAG],
-        examples: ['vitrinka doctor'],
+        examples: ['vitrinka login', 'vitrinka login --base https://vitrinka.lovinka.com'],
     },
     {
-        name: 'install', summary: 'Install the PATH shim (+ optional shell completion + Claude Code UI wiring)',
-        usage: '[--no-completion] [--claude|--no-claude]',
-        flags: [{ f: '--no-completion', d: 'skip appending the shell-completion line' },
+        name: 'doctor', summary: 'Check this machine\'s setup (server, token, operator, skills, shim, MCP); --fix repairs it',
+        usage: '[--fix] [--base <url>]',
+        flags: [{ f: '--fix', d: 'repair everything repairable: refresh skills, rewrite the shim, re-register the MCP, refresh the Claude UI wiring' }, BASE_FLAG],
+        examples: ['vitrinka doctor', 'vitrinka doctor --fix'],
+    },
+    {
+        name: 'install', summary: 'Onboard this machine: status table, then skills + shim + completion + MCP + token + operator + Claude UI',
+        usage: '[--local] [--operator <name>] [--mcp|--no-mcp] [--claude|--no-claude] [--no-completion]',
+        flags: [{ f: '--local', d: 'project scope: skills → ./.claude, MCP --scope project; skips shim/completion' },
+            { f: '--operator', arg: '<name>', d: 'set the board-attribution persona without prompting' },
+            { f: '--mcp', d: 'register the MCP without asking' },
+            { f: '--no-mcp', d: 'skip the MCP registration' },
             { f: '--claude', d: 'wire the Claude Code UI without asking' },
-            { f: '--no-claude', d: 'skip the Claude Code UI wiring (default when non-interactive)' }],
-        examples: ['vitrinka install'],
+            { f: '--no-claude', d: 'skip the Claude Code UI wiring' },
+            { f: '--no-completion', d: 'skip appending the shell-completion line' }],
+        examples: ['vitrinka install', 'vitrinka install --local', 'vitrinka install --operator "Lukáš" --mcp --claude'],
+    },
+    {
+        name: 'uninstall', summary: 'Remove everything install put here (skills, shim, completion, Claude wiring, MCP); token/operator survive',
+        usage: '[--purge] [--yes] [--local]',
+        flags: [{ f: '--purge', d: 'also remove ~/.config/vitrinka (token + operator)' },
+            { f: '--yes', d: 'skip the confirmation (required when non-interactive)' },
+            { f: '--local', d: 'remove the project-local install (./.claude) instead' }],
+        examples: ['vitrinka uninstall', 'vitrinka uninstall --purge --yes'],
     },
     {
         name: 'install-claude', summary: 'Wire the Claude Code UI: 🧷 board statusline segment + clickable footer badge',
@@ -2124,6 +2858,27 @@ export const COMMANDS = [
         usage: '[--local]', flags: [{ f: '--local', d: 'install into ./.claude/skills of the current project instead of ~/.claude/skills' }],
         examples: ['vitrinka install-skills'],
     },
+    {
+        name: 'update', summary: 'Update the CLI (git pull / npm -g), show what\'s new, refresh the installed skills + Claude wiring',
+        usage: '[--local]',
+        flags: [{ f: '--local', d: 'refresh skills into ./.claude/skills of the current project instead of ~/.claude/skills' }],
+        examples: ['vitrinka update'],
+    },
+    {
+        name: 'open', summary: 'Open the capture root\'s live board in the browser (--qr renders a terminal QR for the iPad)',
+        usage: '[--root <dir>] [--qr] [--print]',
+        flags: [ROOT_FLAG, { f: '--qr', d: 'print an ANSI QR code of the URL instead of opening the browser (needs qrencode)' },
+            { f: '--print', d: 'only print the URL' }],
+        examples: ['vitrinka open', 'vitrinka open --qr'],
+    },
+    {
+        name: 'status', summary: 'Session dashboard: live board, open work queue, and listener lease for this repo+branch',
+        usage: '[--root <dir>] [--project <p>] [--branch <b>] [--base <url>]',
+        flags: [ROOT_FLAG, { f: '--project', arg: '<p>', d: 'override the inferred project scope' },
+            { f: '--branch', arg: '<b>', d: 'override the inferred branch scope' }, BASE_FLAG],
+        dynamic: 'projects',
+        examples: ['vitrinka status'],
+    },
     {
         name: 'snap', summary: 'Capture a screenshot → manifest → detached push',
         usage: '<ios|android|macos|web> [--root <dir>] [--file <path>] --route <r> --note <n> [ctx flags] [--udid <u>] [--region x,y,w,h] [--open <deeplink>] [--settle <seconds>] [--hq]',
@@ -2703,7 +3458,11 @@ async function boardFromSetCmd(root, args) {
         process.exit(1);
     }
     const out = await imp.json();
-    console.log(`flow board: ${cfg.base}/boards/${slug}  (${out.cards.length} cards, ${out.edges.length} edges)`);
+    // Prefer the server-authoritative board url (carries /w/<workspace>); compose
+    // the workspace-prefixed path only as a fallback for older servers.
+    const ws = cfg.workspace ? `/w/${cfg.workspace}` : '';
+    const boardUrl = out.board?.url || `${cfg.base}${ws}/boards/${slug}`;
+    console.log(`flow board: ${boardUrl}  (${out.cards.length} cards, ${out.edges.length} edges)`);
     // The board is about to be annotated — make sure its autocomplete index is fresh.
     await pushProjectIndex(dirname(root), cfg.base, cfg.project);
 }
@@ -2967,21 +3726,31 @@ async function runSub(argv) {
     else if (cmd === 'meta')
         metaCmd(root, args);
     else if (cmd === 'remote-init')
-        remoteInitCmd(root, args);
+        await remoteInitCmd(root, args);
     else if (cmd === 'push')
         await pushCmd(root, args);
     else if (cmd === 'name')
         await nameCmd(argv, args);
     else if (cmd === 'operator')
         await operatorCmd(argv, args);
+    else if (cmd === 'login')
+        await loginCmd(args);
     else if (cmd === 'doctor')
         await doctorCmd(args);
     else if (cmd === 'install')
-        installCmd(args);
+        await installCmd(args);
     else if (cmd === 'install-claude')
         installClaudeCmd(args);
     else if (cmd === 'install-skills')
         installSkillsCmd(args);
+    else if (cmd === 'uninstall')
+        uninstallCmd(args);
+    else if (cmd === 'update')
+        await updateCmd(args);
+    else if (cmd === 'open')
+        openCmd(root, args);
+    else if (cmd === 'status')
+        await statusCmd(root, args);
     else if (cmd === 'snap')
         await snapCmd(rest[0] && !rest[0].startsWith('--') ? rest[0] : '', args);
     else if (cmd === 'board-from-set')
@@ -2995,9 +3764,9 @@ async function runSub(argv) {
     else if (cmd === 'embed-shots')
         embedShotsCmd(root, args);
     else if (cmd === 'artifact-init')
-        artifactInitCmd(args);
+        await artifactInitCmd(args);
     else if (cmd === 'artifact-from-set')
-        artifactFromSetCmd(args);
+        await artifactFromSetCmd(args);
     else
         throw new Error(`runSub: unhandled command ${JSON.stringify(cmd)}`); // guarded by the caller
 }
@@ -3006,7 +3775,20 @@ async function runSub(argv) {
 // calling it here — before its definition below — is fine, and keeping the
 // entry block adjacent to runSub keeps the help/completion cases out of the
 // runSub-vs-registry source scan in dx.test.ts.
-const IS_MAIN = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href === import.meta.url : false;
+// realpathSync resolves the PATH symlink (e.g. ~/.bun/bin/vitrinka →
+// .../dist/cli.js) so the entry path matches import.meta.url — resolve() alone
+// doesn't follow symlinks, so the bin shim would otherwise never be IS_MAIN and
+// the CLI would silently exit 0. Fall back to the raw resolve() if the entry
+// somehow can't be realpath'd (never on a real run, but keep it non-fatal).
+function entryHref(argvPath) {
+    try {
+        return pathToFileURL(realpathSync(resolve(argvPath))).href;
+    }
+    catch {
+        return pathToFileURL(resolve(argvPath)).href;
+    }
+}
+const IS_MAIN = process.argv[1] ? entryHref(process.argv[1]) === import.meta.url : false;
 if (IS_MAIN) {
     await main(process.argv.slice(2));
 }
@@ -3044,6 +3826,7 @@ export async function main(argv) {
     else if (!COMMAND_MAP[cmd]) {
         // Unknown command → "did you mean" (plain edit-distance, no AI) + usage,
         // then one additive AI hint. Exit 2.
+        maybeHintFirstRun(cmd);
         const near = nearestCommand(cmd);
         console.error(`unknown command ${JSON.stringify(cmd)}${near ? ` — did you mean "${near}"?` : ''}`);
         console.error(USAGE);
@@ -3051,6 +3834,9 @@ export async function main(argv) {
         process.exit(2);
     }
     else {
+        // Passive DX layer — one dim stderr line each, never blocking, never fatal.
+        maybeHintFirstRun(cmd);
+        maybeNotifyUpdate(cmd);
         await runSub(argv);
     }
 }