@mytegroupinc/myte-core 0.0.44 → 0.0.45

package/mytecody-cli.js

@@ -1,2025 +1,2025 @@
-#!/usr/bin/env node
-"use strict";
-
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const crypto = require("crypto");
-const zlib = require("zlib");
-const { spawn } = require("child_process");
-const readline = require("readline");
-const {
-  DEFAULT_MYTEAI_BASE,
-  normalizeMyteAiBase,
-} = require("./lib/ai-gateway");
-const { createMyteSplash } = require("./lib/mytecody-splash");
-
-const PACKAGE_NAME = "myte";
-const PACKAGE_VERSION = require("./package.json").version;
-const DEFAULT_PACKAGE_LATEST_URL = "https://registry.npmjs.org/myte/latest";
-const DEFAULT_CHANNEL = "alpha";
-const DEFAULT_MODEL_ALIAS = "myte";
-const DEFAULT_CONTEXT_WINDOW = Number(process.env.MYTE_CODY_CONTEXT_WINDOW || 49152);
-const DEFAULT_AUTO_COMPACT_TOKENS = Number(process.env.MYTE_CODY_AUTO_COMPACT_TOKENS || 40960);
-const DEFAULT_TOOL_OUTPUT_TOKENS = Number(process.env.MYTE_CODY_TOOL_OUTPUT_TOKENS || 10000);
-const DEFAULT_AGENT_THREADS = Number(process.env.MYTE_CODY_AGENT_THREADS || 4);
-const CLIENT_BASE_INSTRUCTIONS =
-  "You are MyteCody, a coding agent running through the Myte coding gateway.";
-
-function findEnvPath(startDir) {
-  let cur = startDir;
-  for (let i = 0; i < 8; i += 1) {
-    const candidate = path.join(cur, ".env");
-    if (fs.existsSync(candidate)) return candidate;
-    const parent = path.dirname(cur);
-    if (parent === cur) break;
-    cur = parent;
-  }
-  return null;
-}
-
-function loadEnv() {
-  const envPath = findEnvPath(process.cwd());
-  if (!envPath || !fs.existsSync(envPath)) return null;
-  const content = fs.readFileSync(envPath, "utf8");
-  content.split(/\r?\n/).forEach((line) => {
-    const trimmed = String(line || "").trim();
-    if (!trimmed || trimmed.startsWith("#")) return;
-    const idx = trimmed.indexOf("=");
-    if (idx === -1) return;
-    const key = trimmed.slice(0, idx).trim();
-    let value = trimmed.slice(idx + 1).trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    if (key && !(key in process.env)) process.env[key] = value;
-  });
-  return envPath;
-}
-
-function parseArgs(argv) {
-  const parsed = { _: [] };
-  for (let i = 0; i < argv.length; i += 1) {
-    const token = argv[i];
-    if (token === "--") {
-      parsed._.push(...argv.slice(i + 1));
-      break;
-    }
-    if (token.startsWith("--no-")) {
-      parsed[token.slice(5)] = false;
-      continue;
-    }
-    if (token.startsWith("--")) {
-      const eqIdx = token.indexOf("=");
-      if (eqIdx !== -1) {
-        parsed[token.slice(2, eqIdx)] = token.slice(eqIdx + 1);
-        continue;
-      }
-      const key = token.slice(2);
-      const next = argv[i + 1];
-      if (next !== undefined && !next.startsWith("-")) {
-        parsed[key] = next;
-        i += 1;
-      } else {
-        parsed[key] = true;
-      }
-      continue;
-    }
-    parsed._.push(token);
-  }
-  return parsed;
-}
-
-function getKeyInfo(env = process.env) {
-  if (String(env.MYTEAI_API_KEY || "").trim()) {
-    return { present: true, source: "MYTEAI_API_KEY" };
-  }
-  if (String(env.MYTE_AI_API_KEY || "").trim()) {
-    return { present: true, source: "MYTE_AI_API_KEY" };
-  }
-  return { present: false, source: null };
-}
-
-function getAuthToken(env = process.env) {
-  return String(env.MYTEAI_API_KEY || env.MYTE_AI_API_KEY || "").trim();
-}
-
-function gatewayBase(args = {}) {
-  const raw =
-    args["base-url"] ||
-    process.env.MYTE_CODY_API_BASE ||
-    process.env.MYTEAI_API_BASE ||
-    process.env.MYTE_AI_API_BASE ||
-    DEFAULT_MYTEAI_BASE;
-  return normalizeMyteAiBase(raw);
-}
-
-function gatewayRoot(args = {}) {
-  return gatewayBase(args).replace(/\/v1$/i, "");
-}
-
-function codyGatewayUrl(args = {}, suffix = "") {
-  const root = gatewayRoot(args).replace(/\/+$/, "");
-  const tail = String(suffix || "").startsWith("/") ? String(suffix) : `/${suffix}`;
-  return `${root}${tail}`;
-}
-
-function codyInferenceBase(args = {}) {
-  return codyGatewayUrl(args, "/cody/v1");
-}
-
-function manifestUrl(args = {}) {
-  return String(
-    args.manifest ||
-      process.env.MYTE_CODY_RELEASE_MANIFEST ||
-      `${gatewayRoot(args)}/cody/releases/manifest.json`,
-  );
-}
-
-function platformKey() {
-  return `${process.platform}-${process.arch}`;
-}
-
-function installRoot() {
-  if (process.env.MYTE_CODY_HOME) return path.resolve(process.env.MYTE_CODY_HOME);
-  if (process.platform === "win32") {
-    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), "AppData", "Local");
-    return path.join(base, "Myte", "Cody");
-  }
-  return path.join(os.homedir(), ".myte", "cody");
-}
-
-function currentInstallRoot() {
-  return path.join(installRoot(), "current");
-}
-
-function currentClientManifestPath() {
-  return path.join(currentInstallRoot(), "manifest.json");
-}
-
-function currentEnginePath() {
-  const executable = process.platform === "win32" ? "mytecody-engine.exe" : "mytecody-engine";
-  return path.join(currentInstallRoot(), "bin", executable);
-}
-
-function currentBridgePath() {
-  return path.join(currentInstallRoot(), "lib", "mytecody-async-responses-bridge.js");
-}
-
-function currentControllerPath() {
-  return path.join(currentInstallRoot(), "lib", "mytecody-controller.js");
-}
-
-function codexHome() {
-  return path.join(installRoot(), "engine-home");
-}
-
-function codexModelCatalogPath() {
-  return path.join(codexHome(), "mytecody-models.json");
-}
-
-function readCurrentClientManifest() {
-  const filePath = currentClientManifestPath();
-  if (!fs.existsSync(filePath)) return null;
-  try {
-    return JSON.parse(fs.readFileSync(filePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-function installedClientCommand() {
-  const enginePath = currentEnginePath();
-  if (!fs.existsSync(enginePath)) return null;
-  return { cmd: enginePath, args: [], source: "myte-installed-engine" };
-}
-
-function installedClientUsable() {
-  return Boolean(
-    installedClientCommand() &&
-      fs.existsSync(currentBridgePath()) &&
-      fs.existsSync(currentControllerPath()) &&
-      readCurrentClientManifest(),
-  );
-}
-
-function loadSignedBridge() {
-  const bridgePath = currentBridgePath();
-  if (!fs.existsSync(bridgePath)) {
-    throw new Error("signed MyteCody inference bridge asset is missing; run `mytecody update`.");
-  }
-  const bridge = require(bridgePath);
-  if (!bridge || typeof bridge.startMyteCodyAsyncResponsesBridge !== "function") {
-    throw new Error("signed MyteCody inference bridge asset is invalid.");
-  }
-  return bridge;
-}
-
-function loadSignedController() {
-  const controllerPath = currentControllerPath();
-  if (!fs.existsSync(controllerPath)) {
-    throw new Error("signed MyteCody controller asset is missing; run `mytecody update`.");
-  }
-  const controller = require(controllerPath);
-  if (!controller || typeof controller.runMyteCodyController !== "function") {
-    throw new Error("signed MyteCody controller asset is invalid.");
-  }
-  return controller;
-}
-
-function controllerRunsRoot() {
-  return path.join(installRoot(), "controller-runs");
-}
-
-function readJsonFileIfPresent(filePath) {
-  try {
-    return JSON.parse(fs.readFileSync(filePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-function listControllerRunRecords() {
-  const root = controllerRunsRoot();
-  if (!fs.existsSync(root)) return [];
-  const records = [];
-  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    const runPath = path.join(root, entry.name, "run.json");
-    const run = readJsonFileIfPresent(runPath);
-    if (!run || !run.run_id) continue;
-    let mtimeMs = 0;
-    try {
-      mtimeMs = fs.statSync(runPath).mtimeMs;
-    } catch {}
-    records.push({
-      run_id: run.run_id,
-      workspace_root: run.workspace_root || process.cwd(),
-      status: run.status || "unknown",
-      path: runPath,
-      mtimeMs,
-    });
-  }
-  return records.sort((a, b) => b.mtimeMs - a.mtimeMs);
-}
-
-function resolveControllerRunTarget(target = "latest") {
-  const records = listControllerRunRecords();
-  if (!records.length) return null;
-  const wanted = String(target || "latest");
-  if (wanted === "latest") return records[0];
-  const exact = records.find((record) => record.run_id === wanted);
-  if (exact) return exact;
-  const prefixed = records.filter((record) => record.run_id.startsWith(wanted));
-  if (prefixed.length === 1) return prefixed[0];
-  if (prefixed.length > 1) throw new Error(`CodyRun prefix is ambiguous: ${wanted}`);
-  return null;
-}
-
-function releaseAssetsForPlatform(manifest, artifact) {
-  const assets = [];
-  const collect = (value, source) => {
-    if (!value) return;
-    if (Array.isArray(value)) {
-      value.forEach((item, index) => {
-        if (item && typeof item === "object") {
-          assets.push({ ...item, source, index });
-        }
-      });
-      return;
-    }
-    if (typeof value === "object") {
-      Object.entries(value).forEach(([name, item], index) => {
-        if (item && typeof item === "object") {
-          assets.push({ name: item.name || name, ...item, source, index });
-        }
-      });
-    }
-  };
-
-  collect(manifest && manifest.client_assets, "manifest.client_assets");
-  collect(artifact && artifact.assets, "artifact.assets");
-
-  return assets
-    .map((asset) => ({
-      ...asset,
-      install_path: asset.install_path || asset.path || "",
-    }))
-    .filter((asset) => asset && asset.url && asset.sha256 && asset.install_path);
-}
-
-function assertSafeReleaseAssetInstallPath(installPath) {
-  const raw = String(installPath || "").replace(/\\/g, "/").trim();
-  if (!raw) throw new Error("release asset install_path is required");
-  if (path.isAbsolute(raw) || /^[A-Za-z]:/.test(raw)) {
-    throw new Error(`release asset install_path must be relative: ${installPath}`);
-  }
-  const parts = raw.split("/").filter(Boolean);
-  if (!parts.length || parts.includes("..")) {
-    throw new Error(`release asset install_path is unsafe: ${installPath}`);
-  }
-  return path.join(currentInstallRoot(), ...parts);
-}
-
-function currentReleaseAssetRecordByPath(current) {
-  const map = new Map();
-  for (const asset of Array.isArray(current && current.assets) ? current.assets : []) {
-    if (asset && asset.install_path) {
-      map.set(String(asset.install_path).replace(/\\/g, "/"), asset);
-    }
-  }
-  return map;
-}
-
-function installedReleaseAssetsMatchManifest(manifest, artifact) {
-  const assets = releaseAssetsForPlatform(manifest, artifact);
-  if (!assets.length) return true;
-  const current = readCurrentClientManifest();
-  const currentAssets = currentReleaseAssetRecordByPath(current);
-
-  for (const asset of assets) {
-    const installPath = String(asset.install_path || "").replace(/\\/g, "/");
-    const currentAsset = currentAssets.get(installPath);
-    if (!currentAsset) return false;
-    if (String(currentAsset.sha256 || "").toLowerCase() !== String(asset.sha256 || "").toLowerCase()) {
-      return false;
-    }
-    const targetPath = assertSafeReleaseAssetInstallPath(asset.install_path);
-    if (!fs.existsSync(targetPath)) return false;
-    const installedSha = sha256Hex(fs.readFileSync(targetPath));
-    if (installedSha.toLowerCase() !== String(asset.installed_sha256 || asset.sha256).toLowerCase()) {
-      return false;
-    }
-  }
-  return true;
-}
-
-function installedClientMatchesManifest(manifest, artifact) {
-  const current = readCurrentClientManifest();
-  if (!current || !installedClientCommand()) return false;
-  if (manifest && manifest.version && current.version !== manifest.version) return false;
-
-  const currentArtifact = current.artifact || {};
-  if (artifact && artifact.sha256) {
-    if (String(currentArtifact.sha256 || "").toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
-      return false;
-    }
-  }
-
-  const expectedInstalledSha =
-    artifact && (artifact.installed_sha256 || artifact.executable_sha256 || artifact.uncompressed_sha256);
-  if (expectedInstalledSha) {
-    if (String(currentArtifact.installed_sha256 || "").toLowerCase() !== String(expectedInstalledSha).toLowerCase()) {
-      return false;
-    }
-  }
-
-  if (!installedReleaseAssetsMatchManifest(manifest, artifact)) return false;
-
-  return true;
-}
-
-function printHelp() {
-  console.log(`MYTE CODY - Your Tech Your Way
-
-Usage:
-  mytecody
-  mytecody [prompt...]
-  mytecody doctor [--json] [--base-url <url>] [--probe-gateway]
-  mytecody exec [prompt or agent exec args...]
-  mytecody resume [codex-session-id|latest]
-  mytecody controller-resume [controller-run-id|latest]
-  mytecody codex [raw engine args...]
-  mytecody update --dry-run [--json] [--manifest <url-or-file>] [--fetch-manifest]
-  mytecody update [--json] [--manifest <url-or-file>]
-  mytecody help
-
-Defaults:
-  mytecody opens the branded Codex harness with Myte context hardening.
-  Non-command prompt args are forwarded to the branded engine, not the experimental controller.
-  Use --controller on exec or controller-shell for temporary controller diagnostics.
-  Use mytecody controller-shell only for temporary controller-shell diagnostics.
-  Use mytecody codex only for raw engine diagnostics.
-
-Updates:
-  mytecody update              updates the signed MyteCody engine only
-  npm install -g myte@latest   updates this npm launcher and Myte API tools
-
-Network:
-  The distributed MyteCody client uses the Myte AI gateway for coding
-  inference. It can inspect local config without network, but coding requires
-  gateway access and a Myte AI key.
-
-Environment:
-  MYTEAI_API_KEY       Myte AI inference key
-  MYTE_CODY_API_BASE   Myte AI gateway base URL
-  MYTE_CODY_HOME       local MyteCody client cache/install directory
-`);
-}
-
-function commonStatus(args, envPath) {
-  const keyInfo = getKeyInfo();
-  const current = readCurrentClientManifest();
-  return {
-    product: "MyteCody",
-    command: "mytecody",
-    package_version: PACKAGE_VERSION,
-    package: packageStatusBase(args),
-    mode: "team-gateway",
-    workspace: process.cwd(),
-    env_file: envPath,
-    auth: keyInfo,
-    gateway: {
-      base_url: gatewayBase(args),
-      inference_base_url: codyInferenceBase(args),
-      responses_transport: "async-job-bridge",
-      network_required_for_coding: true,
-    },
-    instruction_pack: {
-      owner: "myte-cody-gateway",
-      client_embedded: false,
-    },
-    runtime: {
-      context_window: DEFAULT_CONTEXT_WINDOW,
-      auto_compact_tokens: DEFAULT_AUTO_COMPACT_TOKENS,
-      tool_output_tokens: DEFAULT_TOOL_OUTPUT_TOKENS,
-      max_concurrent_agent_threads: DEFAULT_AGENT_THREADS,
-    },
-    release: {
-      channel: String(args.channel || process.env.MYTE_CODY_RELEASE_CHANNEL || DEFAULT_CHANNEL),
-      manifest_url: manifestUrl(args),
-      platform: platformKey(),
-      install_root: installRoot(),
-      engine_path: currentEnginePath(),
-      bridge_path: currentBridgePath(),
-      controller_path: currentControllerPath(),
-      client_manifest: currentClientManifestPath(),
-      client_installed: Boolean(current && installedClientCommand()),
-      bridge_installed: fs.existsSync(currentBridgePath()),
-      controller_installed: fs.existsSync(currentControllerPath()),
-      client_version: current && current.version ? current.version : null,
-    },
-  };
-}
-
-function packageLatestUrl(args = {}) {
-  return String(
-    args["package-latest-url"] ||
-      process.env.MYTE_CODY_PACKAGE_LATEST_URL ||
-      process.env.MYTE_PACKAGE_LATEST_URL ||
-      DEFAULT_PACKAGE_LATEST_URL,
-  );
-}
-
-function packageUpdateCheckEnabled(args = {}) {
-  if (args["package-update-check"] === false) return false;
-  return process.env.MYTE_CODY_PACKAGE_UPDATE_CHECK !== "0";
-}
-
-function packageStatusBase(args = {}) {
-  return {
-    name: PACKAGE_NAME,
-    installed_version: PACKAGE_VERSION,
-    latest_version: null,
-    update_available: null,
-    check_status: "not-checked",
-    latest_url: packageLatestUrl(args),
-    update_command: `npm install -g ${PACKAGE_NAME}@latest`,
-    engine_update_command: "mytecody update",
-  };
-}
-
-function parseSemverish(version) {
-  const main = String(version || "")
-    .trim()
-    .replace(/^v/i, "")
-    .split(/[+-]/)[0];
-  const match = main.match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
-  if (!match) return null;
-  return [match[1], match[2] || "0", match[3] || "0"].map((part) => Number(part));
-}
-
-function compareSemverish(left, right) {
-  const leftParts = parseSemverish(left);
-  const rightParts = parseSemverish(right);
-  if (!leftParts || !rightParts) return String(left || "").localeCompare(String(right || ""));
-  for (let i = 0; i < 3; i += 1) {
-    if (leftParts[i] > rightParts[i]) return 1;
-    if (leftParts[i] < rightParts[i]) return -1;
-  }
-  return 0;
-}
-
-function isVersionNewer(latest, installed = PACKAGE_VERSION) {
-  return compareSemverish(latest, installed) > 0;
-}
-
-function packageUpdateTimeoutMs() {
-  const value = Number(process.env.MYTE_CODY_PACKAGE_UPDATE_TIMEOUT_MS || 1500);
-  return Number.isFinite(value) && value > 0 ? value : 1500;
-}
-
-async function checkPackageUpdate(args = {}) {
-  const status = packageStatusBase(args);
-  if (!packageUpdateCheckEnabled(args)) {
-    return { ...status, check_status: "skipped" };
-  }
-  try {
-    const response = await fetchJson(status.latest_url, {
-      timeoutMs: packageUpdateTimeoutMs(),
-    });
-    if (!response.ok) {
-      return {
-        ...status,
-        check_status: "unavailable",
-        registry_status: response.status,
-      };
-    }
-    const latestVersion = response.body && response.body.version ? String(response.body.version) : "";
-    if (!latestVersion) {
-      return { ...status, check_status: "invalid-response" };
-    }
-    return {
-      ...status,
-      latest_version: latestVersion,
-      update_available: isVersionNewer(latestVersion, PACKAGE_VERSION),
-      check_status: "ok",
-    };
-  } catch (error) {
-    return {
-      ...status,
-      check_status: "unavailable",
-      error: error && error.message ? error.message : String(error),
-    };
-  }
-}
-
-function packageUpdateNotice(packageStatus) {
-  if (!packageStatus || packageStatus.update_available !== true) return "";
-  return `myte package update available: ${packageStatus.latest_version} (installed ${packageStatus.installed_version}). Run ${packageStatus.update_command}`;
-}
-
-function printJson(payload) {
-  console.log(JSON.stringify(payload, null, 2));
-}
-
-function isUrl(value) {
-  return /^https?:\/\//i.test(String(value || ""));
-}
-
-function statusLine(message) {
-  if (process.env.MYTE_CODY_QUIET_SETUP === "1") return;
-  console.error(`[MYTE CODY] ${message}`);
-}
-
-function setupProgress(splash) {
-  return (message) => {
-    if (splash && splash.enabled) {
-      splash.setStatus(message);
-      return;
-    }
-    statusLine(message);
-  };
-}
-
-function formatBytes(bytes) {
-  const value = Number(bytes || 0);
-  if (!Number.isFinite(value) || value <= 0) return "unknown size";
-  const units = ["B", "KB", "MB", "GB"];
-  let size = value;
-  let unit = 0;
-  while (size >= 1024 && unit < units.length - 1) {
-    size /= 1024;
-    unit += 1;
-  }
-  return `${size.toFixed(unit === 0 ? 0 : 1)} ${units[unit]}`;
-}
-
-async function readManifest(source, { fetchManifest, progress } = {}) {
-  if (!source) return { status: "missing", manifest: null };
-  if (isUrl(source)) {
-    if (!fetchManifest) {
-      return { status: "skipped", manifest: null };
-    }
-    if (progress) progress("checking signed release manifest");
-    const response = await fetch(source);
-    const text = await response.text();
-    if (!response.ok) {
-      throw new Error(`Manifest fetch failed (${response.status}): ${text.slice(0, 300)}`);
-    }
-    return { status: "fetched", manifest: JSON.parse(text) };
-  }
-  const filePath = path.resolve(source);
-  const text = fs.readFileSync(filePath, "utf8");
-  return { status: "read", manifest: JSON.parse(text), file_path: filePath };
-}
-
-function stableJson(value) {
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.keys(value)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
-      .join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-function manifestWithoutSignature(manifest) {
-  const clone = JSON.parse(JSON.stringify(manifest || {}));
-  delete clone.signature;
-  return clone;
-}
-
-function verifyManifestSignature(manifest) {
-  const signature = manifest && manifest.signature;
-  if (!signature || !signature.value) {
-    return { status: "missing", verified: false };
-  }
-  const publicKey = builtInPublicKeyPem();
-  if (!publicKey) {
-    return {
-      status: "public-key-missing",
-      verified: false,
-      key_id: signature.key_id || null,
-    };
-  }
-  const verifier = crypto.createVerify("SHA256");
-  verifier.update(stableJson(manifestWithoutSignature(manifest)));
-  verifier.end();
-  return {
-    status: "checked",
-    verified: verifier.verify(publicKey, String(signature.value), "base64"),
-    key_id: signature.key_id || null,
-  };
-}
-
-function builtInPublicKeyPem() {
-  const publicKeyPath = path.join(__dirname, "lib", "mytecody-release-public-key.pem");
-  if (!fs.existsSync(publicKeyPath)) return "";
-  return fs.readFileSync(publicKeyPath, "utf8");
-}
-
-function artifactForPlatform(manifest) {
-  const artifacts = manifest && manifest.artifacts;
-  const platform = platformKey();
-  if (Array.isArray(artifacts)) {
-    return (
-      artifacts.find((artifact) => {
-        if (!artifact || typeof artifact !== "object") return false;
-        const combined = `${artifact.platform || process.platform}-${artifact.arch || process.arch}`;
-        return artifact.platform_key === platform || combined === platform;
-      }) || null
-    );
-  }
-  if (!artifacts || typeof artifacts !== "object") return null;
-  return artifacts[platform] || null;
-}
-
-function validateArtifactMetadata(artifact) {
-  if (!artifact) return { status: "missing", ok: false };
-  const missing = [];
-  if (!artifact.url) missing.push("url");
-  if (!artifact.sha256) missing.push("sha256");
-  return {
-    status: missing.length ? "invalid" : "present",
-    ok: missing.length === 0,
-    missing,
-    url: artifact.url || null,
-    format: artifact.format || null,
-    sha256_present: Boolean(artifact.sha256),
-  };
-}
-
-function localPathFromArtifactUrl(urlValue) {
-  const raw = String(urlValue || "").trim();
-  if (/^file:\/\//i.test(raw)) {
-    const url = new URL(raw);
-    return decodeURIComponent(url.pathname.replace(/^\/([A-Za-z]:)/, "$1"));
-  }
-  if (!isUrl(raw)) return path.resolve(raw);
-  return null;
-}
-
-async function readArtifactBytes(artifact, { progress, label = "MyteCody engine" } = {}) {
-  const urlValue = artifact && artifact.url ? String(artifact.url) : "";
-  const localPath = localPathFromArtifactUrl(urlValue);
-  if (localPath) {
-    if (progress) progress(`reading local ${label} artifact`);
-    return fs.readFileSync(localPath);
-  }
-  const headers = {};
-  const token = getAuthToken();
-  if (token) headers.Authorization = `Bearer ${token}`;
-  if (progress) {
-    const expectedSize = Number(artifact && artifact.size_bytes ? artifact.size_bytes : 0);
-    progress(`downloading ${label} (${formatBytes(expectedSize)})`);
-  }
-  const response = await fetch(urlValue, { method: "GET", headers });
-  if (!response.ok) {
-    const bytes = Buffer.from(await response.arrayBuffer());
-    throw new Error(`Artifact fetch failed (${response.status}): ${bytes.toString("utf8", 0, Math.min(bytes.length, 300))}`);
-  }
-  if (!response.body || typeof response.body.getReader !== "function") {
-    const bytes = Buffer.from(await response.arrayBuffer());
-    if (progress) progress(`downloaded ${label} (${formatBytes(bytes.length)})`);
-    return bytes;
-  }
-
-  const total = Number(response.headers.get("content-length") || artifact?.size_bytes || 0);
-  const reader = response.body.getReader();
-  const chunks = [];
-  let received = 0;
-  let lastPct = -1;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    const chunk = Buffer.from(value);
-    chunks.push(chunk);
-    received += chunk.length;
-    if (progress && total > 0) {
-      const pct = Math.min(100, Math.floor((received / total) * 100));
-      if (pct >= lastPct + 10 || pct === 100) {
-        progress(`downloading ${label} ${pct}% (${formatBytes(received)} / ${formatBytes(total)})`);
-        lastPct = pct;
-      }
-    }
-  }
-  const bytes = Buffer.concat(chunks);
-  if (progress) progress(`downloaded ${label} (${formatBytes(bytes.length)})`);
-  return bytes;
-}
-
-function sha256Hex(bytes) {
-  return crypto.createHash("sha256").update(bytes).digest("hex");
-}
-
-function artifactFormat(artifact) {
-  const explicit = String((artifact && artifact.format) || "").trim().toLowerCase();
-  if (explicit) return explicit;
-  const urlValue = String((artifact && artifact.url) || "").trim().toLowerCase();
-  if (urlValue.endsWith(".gz")) return "gzip";
-  return "exe";
-}
-
-function artifactBytesForInstall(bytes, artifact) {
-  const format = artifactFormat(artifact);
-  if (format === "exe" || format === "binary" || format === "raw") return bytes;
-  if (format === "gzip" || format === "gz") return zlib.gunzipSync(bytes);
-  throw new Error(`Unsupported MyteCody release artifact format: ${format}`);
-}
-
-function signatureAccepted(manifest, args = {}) {
-  const signature = verifyManifestSignature(manifest);
-  if (signature.verified) return { ok: true, signature, trusted_unsigned: false };
-  return { ok: false, signature, trusted_unsigned: false };
-}
-
-function installArtifactBytes(bytes, manifest, artifact) {
-  const installBytes = artifactBytesForInstall(bytes, artifact);
-  const enginePath = currentEnginePath();
-  fs.rmSync(path.dirname(path.dirname(enginePath)), { recursive: true, force: true });
-  fs.mkdirSync(path.dirname(enginePath), { recursive: true });
-  fs.writeFileSync(enginePath, installBytes);
-  if (process.platform !== "win32") {
-    fs.chmodSync(enginePath, 0o755);
-  }
-  const installedManifest = {
-    schema_version: manifest.schema_version || 1,
-    channel: manifest.channel || DEFAULT_CHANNEL,
-    version: manifest.version || "unknown",
-    installed_at: new Date().toISOString(),
-    launcher_version: PACKAGE_VERSION,
-    platform: platformKey(),
-    executable: enginePath,
-    artifact: {
-      url: artifact.url,
-      sha256: artifact.sha256,
-      format: artifactFormat(artifact),
-      size_bytes: bytes.length,
-      installed_sha256: sha256Hex(installBytes),
-      installed_size_bytes: installBytes.length,
-    },
-  };
-  fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installedManifest, null, 2), "utf8");
-  return installedManifest;
-}
-
-function reusableInstalledArtifact(artifact) {
-  const enginePath = currentEnginePath();
-  const current = readCurrentClientManifest();
-  if (!current || !fs.existsSync(enginePath)) return null;
-
-  const currentArtifact = current.artifact || {};
-  if (artifact && artifact.sha256) {
-    if (String(currentArtifact.sha256 || "").toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
-      return null;
-    }
-  }
-
-  const engineBytes = fs.readFileSync(enginePath);
-  const installedSha = sha256Hex(engineBytes);
-  const expectedInstalledSha =
-    artifact && (artifact.installed_sha256 || artifact.executable_sha256 || artifact.uncompressed_sha256);
-  if (expectedInstalledSha && installedSha.toLowerCase() !== String(expectedInstalledSha).toLowerCase()) {
-    return null;
-  }
-  if (
-    currentArtifact.installed_sha256 &&
-    installedSha.toLowerCase() !== String(currentArtifact.installed_sha256).toLowerCase()
-  ) {
-    return null;
-  }
-
-  return {
-    enginePath,
-    engineBytes,
-    artifactSizeBytes: Number(currentArtifact.size_bytes || artifact?.size_bytes || 0),
-    installedSha,
-  };
-}
-
-function installManifestForReusableArtifact(reusable, manifest, artifact) {
-  const installedManifest = {
-    schema_version: manifest.schema_version || 1,
-    channel: manifest.channel || DEFAULT_CHANNEL,
-    version: manifest.version || "unknown",
-    installed_at: new Date().toISOString(),
-    launcher_version: PACKAGE_VERSION,
-    platform: platformKey(),
-    executable: reusable.enginePath,
-    artifact: {
-      url: artifact.url,
-      sha256: artifact.sha256,
-      format: artifactFormat(artifact),
-      size_bytes: reusable.artifactSizeBytes,
-      installed_sha256: reusable.installedSha,
-      installed_size_bytes: reusable.engineBytes.length,
-    },
-  };
-  fs.mkdirSync(path.dirname(currentClientManifestPath()), { recursive: true });
-  fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installedManifest, null, 2), "utf8");
-  return installedManifest;
-}
-
-async function installReleaseAssets(manifest, artifact, { progress } = {}) {
-  const assets = releaseAssetsForPlatform(manifest, artifact);
-  const installed = [];
-  for (const asset of assets) {
-    const name = String(asset.name || path.basename(String(asset.install_path || "")) || "client asset");
-    const bytes = await readArtifactBytes(asset, { progress, label: `MyteCody ${name}` });
-    const digest = sha256Hex(bytes);
-    if (digest.toLowerCase() !== String(asset.sha256 || "").toLowerCase()) {
-      throw new Error(`Release asset SHA-256 mismatch for ${name}: expected ${asset.sha256}, got ${digest}`);
-    }
-    const installBytes = artifactBytesForInstall(bytes, asset);
-    const targetPath = assertSafeReleaseAssetInstallPath(asset.install_path);
-    fs.mkdirSync(path.dirname(targetPath), { recursive: true });
-    fs.writeFileSync(targetPath, installBytes);
-    installed.push({
-      name,
-      install_path: String(asset.install_path || "").replace(/\\/g, "/"),
-      url: asset.url,
-      sha256: asset.sha256,
-      format: artifactFormat(asset),
-      size_bytes: bytes.length,
-      installed_sha256: sha256Hex(installBytes),
-      installed_size_bytes: installBytes.length,
-    });
-  }
-  return installed;
-}
-
-async function fetchJson(url, { headers = {}, timeoutMs = 8000 } = {}) {
-  const controller = typeof AbortController !== "undefined" ? new AbortController() : undefined;
-  const timeoutId =
-    controller && timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
-  try {
-    const response = await fetch(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        ...headers,
-      },
-      signal: controller?.signal,
-    });
-    const text = await response.text();
-    let body = {};
-    if (text.trim()) {
-      try {
-        body = JSON.parse(text);
-      } catch {
-        body = { raw_text: text.slice(0, 500) };
-      }
-    }
-    return {
-      ok: Boolean(response.ok),
-      status: response.status,
-      body,
-    };
-  } finally {
-    if (timeoutId) clearTimeout(timeoutId);
-  }
-}
-
-async function probeGateway(args = {}) {
-  const token = getAuthToken();
-  const healthUrl = codyGatewayUrl(args, "/cody/health");
-  const modelsUrl = codyGatewayUrl(args, "/cody/v1/models");
-  const result = {
-    ok: false,
-    health: {
-      url: healthUrl,
-      ok: false,
-      status: null,
-    },
-    models: {
-      url: modelsUrl,
-      ok: false,
-      status: null,
-      skipped: !token,
-    },
-  };
-  try {
-    const health = await fetchJson(healthUrl);
-    result.health.ok = Boolean(health.ok && health.body && health.body.ok === true);
-    result.health.status = health.status;
-    result.health.service = health.body && health.body.service ? String(health.body.service) : null;
-    result.health.model = health.body && health.body.model ? health.body.model : null;
-  } catch (error) {
-    result.health.error = error && error.message ? error.message : String(error);
-  }
-
-  if (token) {
-    try {
-      const models = await fetchJson(modelsUrl, {
-        headers: { Authorization: `Bearer ${token}` },
-      });
-      const ids = Array.isArray(models.body?.data)
-        ? models.body.data.map((item) => String(item && item.id ? item.id : "")).filter(Boolean)
-        : [];
-      result.models.ok = Boolean(models.ok && ids.includes("myte"));
-      result.models.status = models.status;
-      result.models.ids = ids;
-      result.models.skipped = false;
-    } catch (error) {
-      result.models.error = error && error.message ? error.message : String(error);
-      result.models.skipped = false;
-    }
-  }
-
-  result.ok = Boolean(result.health.ok && result.models.ok);
-  return result;
-}
-
-function tomlString(value) {
-  return JSON.stringify(String(value || ""));
-}
-
-function tomlLiteralString(value) {
-  const text = String(value || "");
-  if (!text.includes("'") && !text.includes("\n") && !text.includes("\r")) {
-    return `'${text}'`;
-  }
-  return tomlString(text);
-}
-
-function pathForToml(value) {
-  return String(value || "");
-}
-
-function writeCodexModelCatalog() {
-  fs.mkdirSync(codexHome(), { recursive: true });
-  const catalog = {
-    models: [
-      {
-        slug: DEFAULT_MODEL_ALIAS,
-        display_name: "Myte",
-        description: "Myte AI coding model.",
-        base_instructions: CLIENT_BASE_INSTRUCTIONS,
-        default_reasoning_level: "medium",
-        supported_reasoning_levels: [
-          { effort: "low", description: "Fast local coding pass." },
-          { effort: "medium", description: "Balanced coding pass." },
-          { effort: "high", description: "Deeper coding pass." },
-        ],
-        shell_type: "shell_command",
-        visibility: "list",
-        supported_in_api: true,
-        priority: 0,
-        availability_nux: null,
-        upgrade: null,
-        supports_reasoning_summaries: false,
-        default_reasoning_summary: "none",
-        support_verbosity: false,
-        default_verbosity: null,
-        apply_patch_tool_type: "freeform",
-        web_search_tool_type: "text",
-        truncation_policy: {
-          mode: "tokens",
-          limit: 10000,
-        },
-        supports_parallel_tool_calls: true,
-        supports_image_detail_original: false,
-        context_window: DEFAULT_CONTEXT_WINDOW,
-        max_context_window: DEFAULT_CONTEXT_WINDOW,
-        auto_compact_token_limit: DEFAULT_AUTO_COMPACT_TOKENS,
-        effective_context_window_percent: 90,
-        experimental_supported_tools: [],
-        input_modalities: ["text"],
-        supports_search_tool: false,
-        use_responses_lite: false,
-        auto_review_model_override: null,
-      },
-    ],
-  };
-  const catalogPath = codexModelCatalogPath();
-  fs.writeFileSync(catalogPath, JSON.stringify(catalog, null, 2), "utf8");
-  return catalogPath;
-}
-
-function writeCodexConfig(args = {}, providerBaseUrl = codyInferenceBase(args)) {
-  fs.mkdirSync(codexHome(), { recursive: true });
-  const catalogPath = writeCodexModelCatalog();
-  const config = `model = ${tomlString(DEFAULT_MODEL_ALIAS)}
-model_provider = "myte_ai"
-model_catalog_json = ${tomlString(catalogPath)}
-model_context_window = ${DEFAULT_CONTEXT_WINDOW}
-model_auto_compact_token_limit = ${DEFAULT_AUTO_COMPACT_TOKENS}
-tool_output_token_limit = ${DEFAULT_TOOL_OUTPUT_TOKENS}
-web_search = "disabled"
-suppress_unstable_features_warning = true
-check_for_update_on_startup = false
-
-[tui]
-show_tooltips = false
-status_line = ["run-state", "current-dir"]
-status_line_use_colors = true
-terminal_title = ["project"]
-
-[model_providers.myte_ai]
-name = "Myte AI"
-base_url = ${tomlString(providerBaseUrl)}
-env_key = "MYTE_CODY_AUTH_TOKEN"
-wire_api = "responses"
-requires_openai_auth = false
-
-[features]
-apps = false
-multi_agent = false
-hooks = false
-memories = false
-plugins = false
-tool_suggest = false
-
-[features.multi_agent_v2]
-enabled = true
-max_concurrent_threads_per_session = ${DEFAULT_AGENT_THREADS}
-
-[skills]
-include_instructions = true
-
-[skills.bundled]
-enabled = false
-
-[projects.${tomlLiteralString(process.cwd())}]
-trust_level = "trusted"
-
-[windows]
-sandbox = "unelevated"
-`;
-  const configPath = path.join(codexHome(), "config.toml");
-  fs.writeFileSync(configPath, config, "utf8");
-  return { configPath, catalogPath };
-}
-
-function resolveCodexCommand() {
-  const installed = installedClientCommand();
-  if (installed) return installed;
-  return null;
-}
-
-function codexProviderArgs(args = {}, providerBaseUrl = codyInferenceBase(args)) {
-  return [
-    "-c",
-    'model_provider="myte_ai"',
-    "-c",
-    'model_providers.myte_ai.name="Myte AI"',
-    "-c",
-    `model_providers.myte_ai.base_url="${providerBaseUrl}"`,
-    "-c",
-    'model_providers.myte_ai.env_key="MYTE_CODY_AUTH_TOKEN"',
-    "-c",
-    'model_providers.myte_ai.wire_api="responses"',
-    "-c",
-    `model_catalog_json=${tomlString(codexModelCatalogPath())}`,
-    "-c",
-    `model_context_window=${DEFAULT_CONTEXT_WINDOW}`,
-    "-c",
-    `model_auto_compact_token_limit=${DEFAULT_AUTO_COMPACT_TOKENS}`,
-    "-c",
-    `tool_output_token_limit=${DEFAULT_TOOL_OUTPUT_TOKENS}`,
-    "-c",
-    "web_search=\"disabled\"",
-    "-c",
-    "suppress_unstable_features_warning=true",
-    "-c",
-    "features.multi_agent_v2.enabled=true",
-    "-c",
-    `features.multi_agent_v2.max_concurrent_threads_per_session=${DEFAULT_AGENT_THREADS}`,
-    "--sandbox",
-    "danger-full-access",
-    "--ask-for-approval",
-    "never",
-    "-m",
-    DEFAULT_MODEL_ALIAS,
-  ];
-}
-
-function codexLaunchArgs(rawArgs, args = {}, providerBaseUrl = codyInferenceBase(args)) {
-  const providerArgs = codexProviderArgs(args, providerBaseUrl);
-  if (!rawArgs.length) return providerArgs;
-  if (rawArgs[0] === "exec") return [...providerArgs, "exec", "--skip-git-repo-check", ...rawArgs.slice(1)];
-  return [...providerArgs, ...rawArgs];
-}
-
-function execArgsAndStdin(rawArgs) {
-  if (!rawArgs.length) return { args: [], stdin: null };
-  const valueOptions = new Set([
-    "-a",
-    "--ask-for-approval",
-    "-C",
-    "--cd",
-    "-c",
-    "--config",
-    "-i",
-    "--image",
-    "-m",
-    "--model",
-    "-o",
-    "--output-last-message",
-    "-p",
-    "--profile",
-    "-s",
-    "--sandbox",
-    "--color",
-    "--local-provider",
-    "--output-schema",
-  ]);
-  const forwarded = [];
-  let index = 0;
-  while (index < rawArgs.length) {
-    const arg = rawArgs[index];
-    if (arg === "--") {
-      index += 1;
-      break;
-    }
-    if (arg === "-") break;
-    if (!arg.startsWith("-")) break;
-    forwarded.push(arg);
-    index += 1;
-    if (valueOptions.has(arg) && index < rawArgs.length) {
-      forwarded.push(rawArgs[index]);
-      index += 1;
-    }
-  }
-  const promptParts = rawArgs.slice(index);
-  if (!promptParts.length) return { args: forwarded, stdin: null };
-  if (promptParts.length === 1 && promptParts[0] === "-") {
-    return { args: [...forwarded, "-"], stdin: fs.readFileSync(0, "utf8") };
-  }
-  const prompt = promptParts.join(" ");
-  if (prompt.includes("\n") || prompt.includes("\r") || promptParts.length > 1) {
-    return { args: [...forwarded, "-"], stdin: prompt };
-  }
-  return { args: [...forwarded, prompt], stdin: null };
-}
-
-function stripControllerArgs(rawArgs) {
-  const kept = [];
-  let enabled = process.env.MYTE_CODY_CONTROLLER === "1";
-  for (let i = 0; i < rawArgs.length; i += 1) {
-    const arg = rawArgs[i];
-    if (arg === "--controller") {
-      const next = rawArgs[i + 1];
-      const normalizedNext = String(next || "").toLowerCase();
-      if (next !== undefined && !next.startsWith("-") && ["0", "1", "false", "true", "off", "on", "raw"].includes(normalizedNext)) {
-        enabled = !["0", "false", "off", "raw"].includes(String(next).toLowerCase());
-        i += 1;
-      } else {
-        enabled = true;
-      }
-      continue;
-    }
-    if (arg.startsWith("--controller=")) {
-      const value = arg.slice("--controller=".length);
-      enabled = !["0", "false", "off", "raw"].includes(String(value).toLowerCase());
-      continue;
-    }
-    if (arg === "--no-controller") {
-      enabled = false;
-      continue;
-    }
-    kept.push(arg);
-  }
-  return { enabled, args: kept };
-}
-
-function controllerPromptFromExecArgs(rawArgs) {
-  const execInput = execArgsAndStdin(rawArgs);
-  if (execInput.stdin != null) return { prompt: execInput.stdin, forwardedArgs: [] };
-  const prompt = execInput.args.length ? execInput.args[execInput.args.length - 1] : "";
-  if (!prompt || prompt.startsWith("-")) {
-    return { prompt: "", forwardedArgs: execInput.args };
-  }
-  return { prompt, forwardedArgs: execInput.args.slice(0, -1) };
-}
-
-function classifyMyteCodyInvocation(rawArgs = []) {
-  const args = Array.isArray(rawArgs) ? rawArgs : [];
-  if (!args.length) return { mode: "raw-codex", args: [], controller: false };
-
-  const command = args[0];
-  if (command === "codex") return { mode: "raw-codex", args: args.slice(1), controller: false };
-  if (command === "controller-shell") return { mode: "controller-shell", args: args.slice(1) };
-  if (command === "controller-resume") return { mode: "controller-resume", args: args.slice(1) };
-  if (command === "resume") return { mode: "raw-codex", args, controller: false };
-  if (command === "exec") {
-    const controller = stripControllerArgs(args.slice(1));
-    if (controller.enabled) return { mode: "controller-exec", args: controller.args };
-    return { mode: "raw-codex", args: ["exec", ...controller.args] };
-  }
-  if (String(command || "").startsWith("-")) return { mode: "raw-codex", args };
-  return { mode: "raw-codex", args, controller: false };
-}
-
-function runEngineExecWorker({ command, args, providerBaseUrl, token, prompt, timeoutMs }) {
-  return new Promise((resolve) => {
-    const started = Date.now();
-    const env = {
-      ...process.env,
-      CODEX_HOME: codexHome(),
-      MYTE_CODY_AUTH_TOKEN: token,
-      MYTE_CODY_BRAND: "1",
-      MYTE_CODY_CONTROLLER: "0",
-      MYTE_CODY_BRIDGE_BASE_URL: providerBaseUrl,
-    };
-    const launchArgs = [...command.args, ...codexLaunchArgs(["exec", "--json", "-"], args, providerBaseUrl)];
-    const child = spawn(command.cmd, launchArgs, {
-      cwd: process.cwd(),
-      env,
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: process.platform === "win32" && command.cmd === "codex",
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled) return;
-      try {
-        child.kill();
-      } catch {}
-    }, timeoutMs || 180000);
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.on("error", (error) => {
-      settled = true;
-      clearTimeout(timer);
-      resolve({
-        status: 1,
-        stdout,
-        stderr,
-        error: error.message || String(error),
-        durationMs: Date.now() - started,
-      });
-    });
-    child.on("exit", (code, signal) => {
-      settled = true;
-      clearTimeout(timer);
-      resolve({
-        status: code == null ? 1 : code,
-        signal: signal || null,
-        stdout,
-        stderr,
-        error: null,
-        durationMs: Date.now() - started,
-      });
-    });
-    child.stdin.end(prompt);
-  });
-}
-
-async function runSignedControllerPrompt({ signedController, command, args, bridge, token, promptInfo }) {
-  if (!promptInfo.prompt.trim()) {
-    console.error("MyteCody controller requires a prompt.");
-    return 1;
-  }
-  const summary = await signedController.runMyteCodyController({
-    prompt: promptInfo.prompt,
-    workspace: process.cwd(),
-    artifactRoot: path.join(installRoot(), "controller-runs"),
-    runWorker: (workerPrompt, workerOptions = {}) =>
-      runEngineExecWorker({
-        command,
-        args,
-        providerBaseUrl: bridge.baseUrl,
-        token,
-        prompt: workerPrompt,
-        timeoutMs: workerOptions.timeoutMs || 180000,
-      }),
-  });
-  console.error(`[MYTE CODY] controller run: ${summary.artifact_dir}`);
-  console.error(`[MYTE CODY] controller status: ${summary.status}`);
-  if (summary.status === "paused") {
-    console.error(`[MYTE CODY] resume: mytecody resume ${summary.run_id}`);
-  }
-  return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
-}
-
-async function runSignedControllerResume({ signedController, command, args, bridge, token, target }) {
-  if (!signedController || typeof signedController.resumeMyteCodyControllerRun !== "function") {
-    console.error("Installed MyteCody controller does not support resume; run `mytecody update`.");
-    return 1;
-  }
-  let record;
-  try {
-    record = resolveControllerRunTarget(target || "latest");
-  } catch (error) {
-    console.error(`[MYTE CODY] ${error && error.message ? error.message : error}`);
-    return 1;
-  }
-  if (!record) {
-    console.error(`[MYTE CODY] CodyRun not found: ${target || "latest"}`);
-    return 1;
-  }
-  const summary = await signedController.resumeMyteCodyControllerRun({
-    runId: record.run_id,
-    workspace: record.workspace_root || process.cwd(),
-    artifactRoot: controllerRunsRoot(),
-    runWorker: (workerPrompt, workerOptions = {}) =>
-      runEngineExecWorker({
-        command,
-        args,
-        providerBaseUrl: bridge.baseUrl,
-        token,
-        prompt: workerPrompt,
-        timeoutMs: workerOptions.timeoutMs || 180000,
-      }),
-  });
-  console.error(`[MYTE CODY] resumed CodyRun: ${summary.run_id}`);
-  console.error(`[MYTE CODY] controller status: ${summary.status}`);
-  if (summary.status === "paused") {
-    console.error(`[MYTE CODY] resume: mytecody resume ${summary.run_id}`);
-  }
-  return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
-}
-
-function isControllerShellExit(value) {
-  return ["/exit", "/quit", "exit", "quit"].includes(String(value || "").trim().toLowerCase());
-}
-
-function compactWorkspacePath(workspace = process.cwd()) {
-  const home = os.homedir();
-  const resolved = path.resolve(workspace);
-  if (resolved.toLowerCase().startsWith(home.toLowerCase())) {
-    return `~${resolved.slice(home.length)}`;
-  }
-  return resolved;
-}
-
-function fitCell(value, width) {
-  const text = String(value || "");
-  if (text.length <= width) return `${text}${" ".repeat(width - text.length)}`;
-  return `${text.slice(0, Math.max(0, width - 1))}…`;
-}
-
-function printControllerShellBanner() {
-  const width = 70;
-  const lines = [
-    "MYTE CODY - Your Tech Your Way",
-    `workspace: ${compactWorkspacePath()}`,
-    "mode:      sovereign coding agent - Myte AI gateway",
-    "enter a prompt, /resume latest, /diagnostics, /help, or /exit",
-  ];
-  console.log(`╭${"─".repeat(width)}╮`);
-  for (const line of lines) console.log(`│ ${fitCell(line, width - 2)} │`);
-  console.log(`╰${"─".repeat(width)}╯`);
-}
-
-function printControllerShellHelp() {
-  console.log("");
-  console.log("MYTE CODY commands");
-  console.log("/resume [run_id|latest]  Continue a paused CodyRun.");
-  console.log("/diagnostics             Open the raw engine diagnostics view.");
-  console.log("/exit                    Quit.");
-  console.log("");
-}
-
-async function runControllerShell({ signedController, command, args, bridge, token }) {
-  printControllerShellBanner();
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-    prompt: "\n› ",
-  });
-  rl.prompt();
-  for await (const line of rl) {
-    const prompt = String(line || "").trim();
-    if (!prompt) {
-      rl.prompt();
-      continue;
-    }
-    if (isControllerShellExit(prompt)) break;
-    if (prompt === "/help") {
-      printControllerShellHelp();
-      rl.prompt();
-      continue;
-    }
-    if (prompt === "/diagnostics" || prompt === "/codex") {
-      rl.close();
-      return { rawCodexRequested: true };
-    }
-    if (prompt.startsWith("/resume")) {
-      const target = prompt.split(/\s+/).slice(1)[0] || "latest";
-      await runSignedControllerResume({
-        signedController,
-        command,
-        args,
-        bridge,
-        token,
-        target,
-      });
-      rl.prompt();
-      continue;
-    }
-    await runSignedControllerPrompt({
-      signedController,
-      command,
-      args,
-      bridge,
-      token,
-      promptInfo: { prompt, forwardedArgs: [] },
-    });
-    rl.prompt();
-  }
-  return { rawCodexRequested: false };
-}
-
-function emitSidecarEvent(event) {
-  process.stdout.write(`${JSON.stringify(event)}\n`);
-}
-
-async function runControllerSidecar() {
-  let request;
-  try {
-    const raw = fs.readFileSync(0, "utf8");
-    request = raw.trim() ? JSON.parse(raw) : {};
-  } catch (error) {
-    emitSidecarEvent({
-      type: "failed",
-      message: `Invalid MyteCody sidecar request: ${error && error.message ? error.message : error}`,
-    });
-    return 1;
-  }
-
-  const prompt = String(request.prompt || "").trim();
-  const workspace = path.resolve(request.workspace || process.cwd());
-  if (!prompt) {
-    emitSidecarEvent({ type: "failed", message: "MyteCody sidecar request did not include a prompt." });
-    return 1;
-  }
-
-  const token = process.env.MYTE_CODY_AUTH_TOKEN || getAuthToken();
-  const providerBaseUrl = process.env.MYTE_CODY_BRIDGE_BASE_URL;
-  const command = resolveCodexCommand();
-  if (!token || !providerBaseUrl || !command) {
-    emitSidecarEvent({
-      type: "failed",
-      message: "MyteCody sidecar is missing auth, bridge URL, or installed engine command.",
-    });
-    return 1;
-  }
-
-  emitSidecarEvent({
-    type: "started",
-    message: "MyteCody controller started.",
-    workspace,
-  });
-
-  try {
-    const signedController = loadSignedController();
-    const summary = await signedController.runMyteCodyController({
-      prompt,
-      workspace,
-      artifactRoot: process.env.MYTE_CODY_CONTROLLER_RUNS_DIR || controllerRunsRoot(),
-      mode: process.env.MYTE_CODY_CONTROLLER_MODE || "gateway",
-      runWorker: (workerPrompt, workerOptions = {}) =>
-        runEngineExecWorker({
-          command,
-          args: {},
-          providerBaseUrl,
-          token,
-          prompt: workerPrompt,
-          timeoutMs: workerOptions.timeoutMs || 180000,
-        }),
-    });
-    const resumeCommand = `mytecody resume ${summary.run_id}`;
-    emitSidecarEvent({
-      type: summary.status === "paused" ? "paused" : "completed",
-      run_id: summary.run_id,
-      status: summary.status,
-      artifact_dir: summary.artifact_dir,
-      resume: summary.status === "paused" ? resumeCommand : null,
-      message:
-        summary.status === "paused"
-          ? `MyteCody paused with a durable run state. Resume with: ${resumeCommand}`
-          : `MyteCody controller completed with status: ${summary.status}`,
-    });
-    return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
-  } catch (error) {
-    emitSidecarEvent({
-      type: "failed",
-      message: error && error.stack ? error.stack : error && error.message ? error.message : String(error),
-    });
-    return 1;
-  }
-}
-
-async function runCodex(rawArgs, args = {}, envPath = null) {
-  const token = getAuthToken();
-  if (!token) {
-    console.error("MyteCody requires MYTEAI_API_KEY for coding.");
-    return 1;
-  }
-  const splash = createMyteSplash();
-  const progress = setupProgress(splash);
-  splash.start("preparing trusted workspace");
-  progress("preparing trusted workspace");
-  try {
-    const install = await ensureBrandedEngineInstalled(args, envPath, { progress });
-    if (install.ok && install.installed) {
-      progress(`engine installed: ${install.payload.installed.version}`);
-    } else if (install.ok) {
-      progress("engine ready");
-    } else if (!install.ok) {
-      await splash.stop();
-      console.error(`MyteCody branded engine could not be verified: ${install.reason || "unknown"}.`);
-      console.error("Run `mytecody update` with access to the Myte release manifest.");
-      return 1;
-    }
-  } catch (error) {
-    await splash.stop();
-    console.error(`MyteCody engine verification failed: ${error && error.message ? error.message : error}`);
-    return 1;
-  }
-
-  let packageNotice = "";
-  try {
-    progress("checking myte package version");
-    packageNotice = packageUpdateNotice(await checkPackageUpdate(args));
-  } catch {
-    packageNotice = "";
-  }
-
-  const command = resolveCodexCommand();
-  if (!command) {
-    await splash.stop();
-    console.error("MyteCody branded engine is not installed.");
-    console.error("Run `mytecody update` with access to the Myte release manifest.");
-    return 1;
-  }
-  let bridge = null;
-  try {
-    progress("opening Myte inference bridge");
-    const signedBridge = loadSignedBridge();
-    bridge = await signedBridge.startMyteCodyAsyncResponsesBridge({
-      gatewayRoot: gatewayRoot(args),
-      token,
-    });
-    writeCodexConfig(args, bridge.baseUrl);
-  } catch (error) {
-    await splash.stop();
-    console.error(`MyteCody inference bridge failed to start: ${error && error.message ? error.message : error}`);
-    return 1;
-  }
-
-  const invocation = classifyMyteCodyInvocation(rawArgs);
-  if (["controller-exec", "controller-prompt", "controller-shell", "controller-resume"].includes(invocation.mode)) {
-    try {
-      progress("opening MyteCody controller");
-      const signedController = loadSignedController();
-      await splash.stop();
-      if (packageNotice) statusLine(packageNotice);
-
-      if (invocation.mode === "controller-resume") {
-        const code = await runSignedControllerResume({
-          signedController,
-          command,
-          args,
-          bridge,
-          token,
-          target: invocation.args[0] || "latest",
-        });
-        await bridge.close();
-        return code;
-      }
-
-      if (invocation.mode === "controller-shell") {
-        const shellResult = await runControllerShell({
-          signedController,
-          command,
-          args,
-          bridge,
-          token,
-        });
-        if (shellResult.rawCodexRequested) {
-          const rawArgs = [...command.args, ...codexLaunchArgs([], args, bridge.baseUrl)];
-          const env = {
-            ...process.env,
-            CODEX_HOME: codexHome(),
-            MYTE_CODY_AUTH_TOKEN: token,
-            MYTE_CODY_BRAND: "1",
-            MYTE_CODY_CONTROLLER: "0",
-            MYTE_CODY_BRIDGE_BASE_URL: bridge.baseUrl,
-          };
-          return await new Promise((resolve) => {
-            const child = spawn(command.cmd, rawArgs, {
-              cwd: process.cwd(),
-              env,
-              stdio: "inherit",
-              shell: process.platform === "win32" && command.cmd === "codex",
-            });
-            child.on("error", (error) => {
-              console.error(`Unable to launch MyteCody engine: ${error.message || error}`);
-              bridge.close().finally(() => resolve(1));
-            });
-            child.on("close", (code) => {
-              bridge.close().finally(() => resolve(Number.isInteger(code) ? code : 1));
-            });
-          });
-        }
-        await bridge.close();
-        return 0;
-      }
-
-      const promptInfo = controllerPromptFromExecArgs(invocation.args);
-      if (!promptInfo.prompt.trim()) {
-        await splash.stop();
-        await bridge.close();
-        console.error("MyteCody controller requires a prompt.");
-        return 1;
-      }
-      const code = await runSignedControllerPrompt({
-        signedController,
-        command,
-        args,
-        bridge,
-        token,
-        promptInfo,
-      });
-      await bridge.close();
-      return code;
-    } catch (error) {
-      await splash.stop();
-      await bridge.close();
-      console.error(`MyteCody controller failed: ${error && error.message ? error.message : error}`);
-      return 1;
-    }
-  }
-
-  const launchArgs = [...command.args, ...codexLaunchArgs(invocation.args, args, bridge.baseUrl)];
-  const env = {
-    ...process.env,
-    CODEX_HOME: codexHome(),
-    MYTE_CODY_AUTH_TOKEN: token,
-    MYTE_CODY_BRAND: "1",
-    MYTE_CODY_CONTROLLER: invocation.controller === true ? "1" : "0",
-    MYTE_CODY_CONTROLLER_MODE: "gateway",
-    MYTE_CODY_CONTROLLER_NODE: process.execPath,
-    MYTE_CODY_CONTROLLER_ENTRY: __filename,
-    MYTE_CODY_CONTROLLER_RUNS_DIR: controllerRunsRoot(),
-    MYTE_CODY_BRIDGE_BASE_URL: bridge.baseUrl,
-  };
-  progress("opening MyteCody workspace");
-  await splash.stop();
-  if (packageNotice) statusLine(packageNotice);
-  return new Promise((resolve) => {
-    const child = spawn(command.cmd, launchArgs, {
-      cwd: process.cwd(),
-      env,
-      stdio: "inherit",
-      shell: process.platform === "win32" && command.cmd === "codex",
-    });
-    child.on("error", (error) => {
-      console.error(`Unable to launch MyteCody engine: ${error.message || error}`);
-      bridge.close().finally(() => resolve(1));
-    });
-    child.on("close", (code) => {
-      bridge.close().finally(() => resolve(Number.isInteger(code) ? code : 1));
-    });
-  });
-}
-
-async function runDoctor(args, envPath) {
-  const payload = {
-    ok: true,
-    ready_for_coding: false,
-    ...commonStatus(args, envPath),
-  };
-  payload.package = await checkPackageUpdate(args);
-  if (args["probe-gateway"]) {
-    payload.gateway.probe = await probeGateway(args);
-  }
-  payload.ready_for_coding =
-    payload.auth.present &&
-    payload.release.client_installed &&
-    payload.release.bridge_installed;
-  if (payload.gateway.probe) {
-    payload.ready_for_coding = Boolean(payload.ready_for_coding && payload.gateway.probe.ok);
-  }
-  if (args.json) {
-    printJson(payload);
-    return 0;
-  }
-  console.log("MYTE CODY - Your Tech Your Way");
-  console.log("");
-  console.log(`mode:       ${payload.mode}`);
-  console.log(`workspace:  ${payload.workspace}`);
-  console.log(`auth:       ${payload.auth.present ? `present (${payload.auth.source})` : "missing"}`);
-  console.log(`gateway:    ${payload.gateway.base_url}`);
-  if (payload.gateway.probe) {
-    console.log(`gateway probe: ${payload.gateway.probe.ok ? "ok" : "failed"}`);
-  }
-  console.log(`package:    ${payload.package.installed_version}`);
-  if (payload.package.check_status === "ok" && payload.package.update_available) {
-    console.log(`package update: ${payload.package.latest_version} available`);
-    console.log(`package command: ${payload.package.update_command}`);
-  } else if (payload.package.check_status === "ok") {
-    console.log("package update: current");
-  } else if (payload.package.check_status === "skipped") {
-    console.log("package update: skipped");
-  } else {
-    console.log(`package update: ${payload.package.check_status}`);
-  }
-  console.log(`client:     ${payload.release.client_installed ? payload.release.client_version : "not installed"}`);
-  console.log(`bridge:     ${payload.release.bridge_installed ? "installed" : "not installed"}`);
-  console.log(`install:    ${payload.release.install_root}`);
-  console.log("");
-  console.log("Coding requires the Myte AI gateway and a Myte AI key.");
-  return 0;
-}
-
-async function buildUpdatePayload(args, envPath, { dryRun = false, progress = null } = {}) {
-  const isDryRun = Boolean(dryRun);
-  const source = manifestUrl(args);
-  const manifestResult = await readManifest(source, {
-    fetchManifest: Boolean(args["fetch-manifest"]) || !isDryRun,
-    progress,
-  });
-  const manifest = manifestResult.manifest;
-  const artifact = manifest ? artifactForPlatform(manifest) : null;
-  const signature = manifest ? signatureAccepted(manifest, args) : { ok: false, signature: { status: "not-checked", verified: false } };
-  const artifactMetadata = manifest ? validateArtifactMetadata(artifact) : { status: "not-checked", ok: false };
-  const releaseAssets = manifest ? releaseAssetsForPlatform(manifest, artifact) : [];
-  const payload = {
-    ok: true,
-    dry_run: isDryRun,
-    would_write: !isDryRun,
-    ...commonStatus(args, envPath),
-    manifest: {
-      source,
-      read_status: manifestResult.status,
-      version: manifest && manifest.version ? manifest.version : null,
-      signature: signature.signature,
-      trusted_unsigned: Boolean(signature.trusted_unsigned),
-    },
-    artifact: artifactMetadata,
-    release_assets: releaseAssets.map((asset) => ({
-      name: asset.name || null,
-      install_path: asset.install_path,
-      url: asset.url || null,
-      format: asset.format || null,
-      sha256_present: Boolean(asset.sha256),
-    })),
-  };
-
-  if (!isDryRun) {
-    if (!manifest) {
-      throw new Error("Cannot install MyteCody engine without a readable release manifest.");
-    }
-    if (!signature.ok) {
-      throw new Error("MyteCody release manifest signature is not trusted.");
-    }
-    if (!artifactMetadata.ok) {
-      throw new Error(`MyteCody release artifact metadata is ${artifactMetadata.status}.`);
-    }
-    let installed;
-    let artifactDigest = String(artifact.sha256 || "");
-    let artifactSizeBytes = Number(artifact.size_bytes || 0);
-    const reusable = reusableInstalledArtifact(artifact);
-    if (reusable) {
-      if (progress) progress("reusing installed MyteCody engine");
-      installed = installManifestForReusableArtifact(reusable, manifest, artifact);
-      artifactSizeBytes = reusable.artifactSizeBytes;
-    } else {
-      const bytes = await readArtifactBytes(artifact, { progress });
-      artifactDigest = sha256Hex(bytes);
-      artifactSizeBytes = bytes.length;
-      if (artifactDigest.toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
-        throw new Error(`Artifact SHA-256 mismatch: expected ${artifact.sha256}, got ${artifactDigest}`);
-      }
-      installed = installArtifactBytes(bytes, manifest, artifact);
-    }
-    const installedAssets = await installReleaseAssets(manifest, artifact, { progress });
-    if (installedAssets.length) {
-      installed.assets = installedAssets;
-      fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installed, null, 2), "utf8");
-    }
-    payload.installed = {
-      ok: true,
-      version: installed.version,
-      executable: installed.executable,
-      sha256: artifactDigest,
-      size_bytes: artifactSizeBytes,
-      installed_sha256: installed.artifact.installed_sha256,
-      installed_size_bytes: installed.artifact.installed_size_bytes,
-      format: installed.artifact.format,
-      assets: installedAssets,
-    };
-    payload.release = {
-      ...payload.release,
-      client_installed: true,
-      client_version: installed.version,
-      engine_path: installed.executable,
-    };
-  }
-
-  return payload;
-}
-
-function autoInstallEnabled(args = {}) {
-  if (args["auto-update"] === false) return false;
-  if (process.env.MYTE_CODY_AUTO_UPDATE === "0") return false;
-  return true;
-}
-
-async function ensureBrandedEngineInstalled(args = {}, envPath = null, { progress = null } = {}) {
-  const updateArgs = {
-    ...args,
-    "fetch-manifest": true,
-  };
-  delete updateArgs["dry-run"];
-  delete updateArgs.json;
-
-  const source = manifestUrl(updateArgs);
-  let manifestResult;
-  try {
-    manifestResult = await readManifest(source, { fetchManifest: true, progress });
-  } catch (error) {
-    if (isUrl(source) && installedClientUsable()) {
-      return {
-        ok: true,
-        installed: false,
-        reason: "cached-engine-manifest-unavailable",
-        manifest_status: "fetch-failed",
-        error: error && error.message ? error.message : String(error),
-      };
-    }
-    throw error;
-  }
-  const manifest = manifestResult.manifest;
-  if (!manifest) {
-    if (isUrl(source) && installedClientUsable()) {
-      return {
-        ok: true,
-        installed: false,
-        reason: "cached-engine-manifest-unavailable",
-        manifest_status: manifestResult.status,
-      };
-    }
-    return { ok: false, installed: false, reason: "manifest-unavailable", manifest_status: manifestResult.status };
-  }
-  const signature = signatureAccepted(manifest, updateArgs);
-  if (!signature.ok) {
-    return { ok: false, installed: false, reason: "manifest-untrusted", signature: signature.signature };
-  }
-  const artifact = artifactForPlatform(manifest);
-  const artifactMetadata = validateArtifactMetadata(artifact);
-  if (!artifactMetadata.ok) {
-    return { ok: false, installed: false, reason: "artifact-metadata-invalid", artifact: artifactMetadata };
-  }
-  if (installedClientMatchesManifest(manifest, artifact)) {
-    return { ok: true, installed: false, reason: "already-current" };
-  }
-
-  if (!autoInstallEnabled(args)) {
-    return { ok: false, installed: false, reason: "update-required-auto-install-disabled" };
-  }
-
-  const payload = await buildUpdatePayload(updateArgs, envPath, { dryRun: false, progress });
-  return {
-    ok: Boolean(payload.installed && payload.installed.ok),
-    installed: Boolean(payload.installed && payload.installed.ok),
-    reason: "installed",
-    payload,
-  };
-}
-
-async function runUpdate(args, envPath) {
-  const dryRun = Boolean(args["dry-run"]);
-  const payload = await buildUpdatePayload(args, envPath, {
-    dryRun,
-    progress: args.json ? null : statusLine,
-  });
-
-  if (args.json) {
-    printJson(payload);
-    return 0;
-  }
-  console.log(dryRun ? "MYTE CODY update dry-run" : "MYTE CODY update");
-  console.log("scope: MyteCody engine only");
-  console.log(`manifest: ${payload.manifest.source}`);
-  console.log(`manifest read: ${payload.manifest.read_status}`);
-  console.log(`platform: ${payload.release.platform}`);
-  console.log(`install: ${payload.release.install_root}`);
-  console.log(`would write: ${payload.would_write}`);
-  if (payload.manifest.read_status !== "skipped") {
-    console.log(`version: ${payload.manifest.version || "unknown"}`);
-    console.log(`signature: ${payload.manifest.signature.status}`);
-    console.log(`artifact: ${payload.artifact.status}`);
-  } else {
-    console.log("manifest fetch skipped; pass --fetch-manifest to test the configured endpoint.");
-  }
-  if (payload.installed) {
-    console.log(`installed: ${payload.installed.executable}`);
-  }
-  console.log(`npm launcher/API tools: ${payload.package.update_command}`);
-  return 0;
-}
-
-async function run(argv = process.argv.slice(2)) {
-  const envPath = loadEnv();
-  const parsed = parseArgs(argv);
-  const command = argv[0] || "codex";
-  const restArgs = parseArgs(argv.slice(1));
-
-  if (command === "help" || command === "--help" || command === "-h") {
-    printHelp();
-    return 0;
-  }
-  if (command === "doctor") return runDoctor(restArgs, envPath);
-  if (command === "update") return runUpdate(restArgs, envPath);
-  if (command === "controller-sidecar") return runControllerSidecar();
-  if (command === "version" || command === "--version" || command === "-v") {
-    console.log(PACKAGE_VERSION);
-    return 0;
-  }
-
-  return runCodex(argv, parsed, envPath);
-}
-
-async function main() {
-  try {
-    const code = await run();
-    process.exitCode = code;
-  } catch (error) {
-    console.error(error && error.message ? error.message : error);
-    process.exitCode = 1;
-  }
-}
-
-if (require.main === module) {
-  main();
-}
-
-module.exports = {
-  checkPackageUpdate,
-  classifyMyteCodyInvocation,
-  codexLaunchArgs,
-  codexProviderArgs,
-  codyInferenceBase,
-  codyGatewayUrl,
-  currentBridgePath,
-  currentControllerPath,
-  currentClientManifestPath,
-  currentEnginePath,
-  ensureBrandedEngineInstalled,
-  gatewayRoot,
-  installedClientCommand,
-  isVersionNewer,
-  packageUpdateNotice,
-  resolveCodexCommand,
-  run,
-  sha256Hex,
-  stableJson,
-  tomlLiteralString,
-  verifyManifestSignature,
-  writeCodexConfig,
-};
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const crypto = require("crypto");
+const zlib = require("zlib");
+const { spawn } = require("child_process");
+const readline = require("readline");
+const {
+  DEFAULT_MYTEAI_BASE,
+  normalizeMyteAiBase,
+} = require("./lib/ai-gateway");
+const { createMyteSplash } = require("./lib/mytecody-splash");
+
+const PACKAGE_NAME = "myte";
+const PACKAGE_VERSION = require("./package.json").version;
+const DEFAULT_PACKAGE_LATEST_URL = "https://registry.npmjs.org/myte/latest";
+const DEFAULT_CHANNEL = "alpha";
+const DEFAULT_MODEL_ALIAS = "myte";
+const DEFAULT_CONTEXT_WINDOW = Number(process.env.MYTE_CODY_CONTEXT_WINDOW || 49152);
+const DEFAULT_AUTO_COMPACT_TOKENS = Number(process.env.MYTE_CODY_AUTO_COMPACT_TOKENS || 40960);
+const DEFAULT_TOOL_OUTPUT_TOKENS = Number(process.env.MYTE_CODY_TOOL_OUTPUT_TOKENS || 10000);
+const DEFAULT_AGENT_THREADS = Number(process.env.MYTE_CODY_AGENT_THREADS || 4);
+const CLIENT_BASE_INSTRUCTIONS =
+  "You are MyteCody, a coding agent running through the Myte coding gateway.";
+
+function findEnvPath(startDir) {
+  let cur = startDir;
+  for (let i = 0; i < 8; i += 1) {
+    const candidate = path.join(cur, ".env");
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return null;
+}
+
+function loadEnv() {
+  const envPath = findEnvPath(process.cwd());
+  if (!envPath || !fs.existsSync(envPath)) return null;
+  const content = fs.readFileSync(envPath, "utf8");
+  content.split(/\r?\n/).forEach((line) => {
+    const trimmed = String(line || "").trim();
+    if (!trimmed || trimmed.startsWith("#")) return;
+    const idx = trimmed.indexOf("=");
+    if (idx === -1) return;
+    const key = trimmed.slice(0, idx).trim();
+    let value = trimmed.slice(idx + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (key && !(key in process.env)) process.env[key] = value;
+  });
+  return envPath;
+}
+
+function parseArgs(argv) {
+  const parsed = { _: [] };
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (token === "--") {
+      parsed._.push(...argv.slice(i + 1));
+      break;
+    }
+    if (token.startsWith("--no-")) {
+      parsed[token.slice(5)] = false;
+      continue;
+    }
+    if (token.startsWith("--")) {
+      const eqIdx = token.indexOf("=");
+      if (eqIdx !== -1) {
+        parsed[token.slice(2, eqIdx)] = token.slice(eqIdx + 1);
+        continue;
+      }
+      const key = token.slice(2);
+      const next = argv[i + 1];
+      if (next !== undefined && !next.startsWith("-")) {
+        parsed[key] = next;
+        i += 1;
+      } else {
+        parsed[key] = true;
+      }
+      continue;
+    }
+    parsed._.push(token);
+  }
+  return parsed;
+}
+
+function getKeyInfo(env = process.env) {
+  if (String(env.MYTEAI_API_KEY || "").trim()) {
+    return { present: true, source: "MYTEAI_API_KEY" };
+  }
+  if (String(env.MYTE_AI_API_KEY || "").trim()) {
+    return { present: true, source: "MYTE_AI_API_KEY" };
+  }
+  return { present: false, source: null };
+}
+
+function getAuthToken(env = process.env) {
+  return String(env.MYTEAI_API_KEY || env.MYTE_AI_API_KEY || "").trim();
+}
+
+function gatewayBase(args = {}) {
+  const raw =
+    args["base-url"] ||
+    process.env.MYTE_CODY_API_BASE ||
+    process.env.MYTEAI_API_BASE ||
+    process.env.MYTE_AI_API_BASE ||
+    DEFAULT_MYTEAI_BASE;
+  return normalizeMyteAiBase(raw);
+}
+
+function gatewayRoot(args = {}) {
+  return gatewayBase(args).replace(/\/v1$/i, "");
+}
+
+function codyGatewayUrl(args = {}, suffix = "") {
+  const root = gatewayRoot(args).replace(/\/+$/, "");
+  const tail = String(suffix || "").startsWith("/") ? String(suffix) : `/${suffix}`;
+  return `${root}${tail}`;
+}
+
+function codyInferenceBase(args = {}) {
+  return codyGatewayUrl(args, "/cody/v1");
+}
+
+function manifestUrl(args = {}) {
+  return String(
+    args.manifest ||
+      process.env.MYTE_CODY_RELEASE_MANIFEST ||
+      `${gatewayRoot(args)}/cody/releases/manifest.json`,
+  );
+}
+
+function platformKey() {
+  return `${process.platform}-${process.arch}`;
+}
+
+function installRoot() {
+  if (process.env.MYTE_CODY_HOME) return path.resolve(process.env.MYTE_CODY_HOME);
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), "AppData", "Local");
+    return path.join(base, "Myte", "Cody");
+  }
+  return path.join(os.homedir(), ".myte", "cody");
+}
+
+function currentInstallRoot() {
+  return path.join(installRoot(), "current");
+}
+
+function currentClientManifestPath() {
+  return path.join(currentInstallRoot(), "manifest.json");
+}
+
+function currentEnginePath() {
+  const executable = process.platform === "win32" ? "mytecody-engine.exe" : "mytecody-engine";
+  return path.join(currentInstallRoot(), "bin", executable);
+}
+
+function currentBridgePath() {
+  return path.join(currentInstallRoot(), "lib", "mytecody-async-responses-bridge.js");
+}
+
+function currentControllerPath() {
+  return path.join(currentInstallRoot(), "lib", "mytecody-controller.js");
+}
+
+function codexHome() {
+  return path.join(installRoot(), "engine-home");
+}
+
+function codexModelCatalogPath() {
+  return path.join(codexHome(), "mytecody-models.json");
+}
+
+function readCurrentClientManifest() {
+  const filePath = currentClientManifestPath();
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function installedClientCommand() {
+  const enginePath = currentEnginePath();
+  if (!fs.existsSync(enginePath)) return null;
+  return { cmd: enginePath, args: [], source: "myte-installed-engine" };
+}
+
+function installedClientUsable() {
+  return Boolean(
+    installedClientCommand() &&
+      fs.existsSync(currentBridgePath()) &&
+      fs.existsSync(currentControllerPath()) &&
+      readCurrentClientManifest(),
+  );
+}
+
+function loadSignedBridge() {
+  const bridgePath = currentBridgePath();
+  if (!fs.existsSync(bridgePath)) {
+    throw new Error("signed MyteCody inference bridge asset is missing; run `mytecody update`.");
+  }
+  const bridge = require(bridgePath);
+  if (!bridge || typeof bridge.startMyteCodyAsyncResponsesBridge !== "function") {
+    throw new Error("signed MyteCody inference bridge asset is invalid.");
+  }
+  return bridge;
+}
+
+function loadSignedController() {
+  const controllerPath = currentControllerPath();
+  if (!fs.existsSync(controllerPath)) {
+    throw new Error("signed MyteCody controller asset is missing; run `mytecody update`.");
+  }
+  const controller = require(controllerPath);
+  if (!controller || typeof controller.runMyteCodyController !== "function") {
+    throw new Error("signed MyteCody controller asset is invalid.");
+  }
+  return controller;
+}
+
+function controllerRunsRoot() {
+  return path.join(installRoot(), "controller-runs");
+}
+
+function readJsonFileIfPresent(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function listControllerRunRecords() {
+  const root = controllerRunsRoot();
+  if (!fs.existsSync(root)) return [];
+  const records = [];
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const runPath = path.join(root, entry.name, "run.json");
+    const run = readJsonFileIfPresent(runPath);
+    if (!run || !run.run_id) continue;
+    let mtimeMs = 0;
+    try {
+      mtimeMs = fs.statSync(runPath).mtimeMs;
+    } catch {}
+    records.push({
+      run_id: run.run_id,
+      workspace_root: run.workspace_root || process.cwd(),
+      status: run.status || "unknown",
+      path: runPath,
+      mtimeMs,
+    });
+  }
+  return records.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+
+function resolveControllerRunTarget(target = "latest") {
+  const records = listControllerRunRecords();
+  if (!records.length) return null;
+  const wanted = String(target || "latest");
+  if (wanted === "latest") return records[0];
+  const exact = records.find((record) => record.run_id === wanted);
+  if (exact) return exact;
+  const prefixed = records.filter((record) => record.run_id.startsWith(wanted));
+  if (prefixed.length === 1) return prefixed[0];
+  if (prefixed.length > 1) throw new Error(`CodyRun prefix is ambiguous: ${wanted}`);
+  return null;
+}
+
+function releaseAssetsForPlatform(manifest, artifact) {
+  const assets = [];
+  const collect = (value, source) => {
+    if (!value) return;
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        if (item && typeof item === "object") {
+          assets.push({ ...item, source, index });
+        }
+      });
+      return;
+    }
+    if (typeof value === "object") {
+      Object.entries(value).forEach(([name, item], index) => {
+        if (item && typeof item === "object") {
+          assets.push({ name: item.name || name, ...item, source, index });
+        }
+      });
+    }
+  };
+
+  collect(manifest && manifest.client_assets, "manifest.client_assets");
+  collect(artifact && artifact.assets, "artifact.assets");
+
+  return assets
+    .map((asset) => ({
+      ...asset,
+      install_path: asset.install_path || asset.path || "",
+    }))
+    .filter((asset) => asset && asset.url && asset.sha256 && asset.install_path);
+}
+
+function assertSafeReleaseAssetInstallPath(installPath) {
+  const raw = String(installPath || "").replace(/\\/g, "/").trim();
+  if (!raw) throw new Error("release asset install_path is required");
+  if (path.isAbsolute(raw) || /^[A-Za-z]:/.test(raw)) {
+    throw new Error(`release asset install_path must be relative: ${installPath}`);
+  }
+  const parts = raw.split("/").filter(Boolean);
+  if (!parts.length || parts.includes("..")) {
+    throw new Error(`release asset install_path is unsafe: ${installPath}`);
+  }
+  return path.join(currentInstallRoot(), ...parts);
+}
+
+function currentReleaseAssetRecordByPath(current) {
+  const map = new Map();
+  for (const asset of Array.isArray(current && current.assets) ? current.assets : []) {
+    if (asset && asset.install_path) {
+      map.set(String(asset.install_path).replace(/\\/g, "/"), asset);
+    }
+  }
+  return map;
+}
+
+function installedReleaseAssetsMatchManifest(manifest, artifact) {
+  const assets = releaseAssetsForPlatform(manifest, artifact);
+  if (!assets.length) return true;
+  const current = readCurrentClientManifest();
+  const currentAssets = currentReleaseAssetRecordByPath(current);
+
+  for (const asset of assets) {
+    const installPath = String(asset.install_path || "").replace(/\\/g, "/");
+    const currentAsset = currentAssets.get(installPath);
+    if (!currentAsset) return false;
+    if (String(currentAsset.sha256 || "").toLowerCase() !== String(asset.sha256 || "").toLowerCase()) {
+      return false;
+    }
+    const targetPath = assertSafeReleaseAssetInstallPath(asset.install_path);
+    if (!fs.existsSync(targetPath)) return false;
+    const installedSha = sha256Hex(fs.readFileSync(targetPath));
+    if (installedSha.toLowerCase() !== String(asset.installed_sha256 || asset.sha256).toLowerCase()) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function installedClientMatchesManifest(manifest, artifact) {
+  const current = readCurrentClientManifest();
+  if (!current || !installedClientCommand()) return false;
+  if (manifest && manifest.version && current.version !== manifest.version) return false;
+
+  const currentArtifact = current.artifact || {};
+  if (artifact && artifact.sha256) {
+    if (String(currentArtifact.sha256 || "").toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
+      return false;
+    }
+  }
+
+  const expectedInstalledSha =
+    artifact && (artifact.installed_sha256 || artifact.executable_sha256 || artifact.uncompressed_sha256);
+  if (expectedInstalledSha) {
+    if (String(currentArtifact.installed_sha256 || "").toLowerCase() !== String(expectedInstalledSha).toLowerCase()) {
+      return false;
+    }
+  }
+
+  if (!installedReleaseAssetsMatchManifest(manifest, artifact)) return false;
+
+  return true;
+}
+
+function printHelp() {
+  console.log(`MYTE CODY - Your Tech Your Way
+
+Usage:
+  mytecody
+  mytecody [prompt...]
+  mytecody doctor [--json] [--base-url <url>] [--probe-gateway]
+  mytecody exec [prompt or agent exec args...]
+  mytecody resume [codex-session-id|latest]
+  mytecody controller-resume [controller-run-id|latest]
+  mytecody codex [raw engine args...]
+  mytecody update --dry-run [--json] [--manifest <url-or-file>] [--fetch-manifest]
+  mytecody update [--json] [--manifest <url-or-file>]
+  mytecody help
+
+Defaults:
+  mytecody opens the branded Codex harness with Myte context hardening.
+  Non-command prompt args are forwarded to the branded engine, not the experimental controller.
+  Use --controller on exec or controller-shell for temporary controller diagnostics.
+  Use mytecody controller-shell only for temporary controller-shell diagnostics.
+  Use mytecody codex only for raw engine diagnostics.
+
+Updates:
+  mytecody update              updates the signed MyteCody engine only
+  npm install -g myte@latest   updates this npm launcher and Myte API tools
+
+Network:
+  The distributed MyteCody client uses the Myte AI gateway for coding
+  inference. It can inspect local config without network, but coding requires
+  gateway access and a Myte AI key.
+
+Environment:
+  MYTEAI_API_KEY       Myte AI inference key
+  MYTE_CODY_API_BASE   Myte AI gateway base URL
+  MYTE_CODY_HOME       local MyteCody client cache/install directory
+`);
+}
+
+function commonStatus(args, envPath) {
+  const keyInfo = getKeyInfo();
+  const current = readCurrentClientManifest();
+  return {
+    product: "MyteCody",
+    command: "mytecody",
+    package_version: PACKAGE_VERSION,
+    package: packageStatusBase(args),
+    mode: "team-gateway",
+    workspace: process.cwd(),
+    env_file: envPath,
+    auth: keyInfo,
+    gateway: {
+      base_url: gatewayBase(args),
+      inference_base_url: codyInferenceBase(args),
+      responses_transport: "async-job-bridge",
+      network_required_for_coding: true,
+    },
+    instruction_pack: {
+      owner: "myte-cody-gateway",
+      client_embedded: false,
+    },
+    runtime: {
+      context_window: DEFAULT_CONTEXT_WINDOW,
+      auto_compact_tokens: DEFAULT_AUTO_COMPACT_TOKENS,
+      tool_output_tokens: DEFAULT_TOOL_OUTPUT_TOKENS,
+      max_concurrent_agent_threads: DEFAULT_AGENT_THREADS,
+    },
+    release: {
+      channel: String(args.channel || process.env.MYTE_CODY_RELEASE_CHANNEL || DEFAULT_CHANNEL),
+      manifest_url: manifestUrl(args),
+      platform: platformKey(),
+      install_root: installRoot(),
+      engine_path: currentEnginePath(),
+      bridge_path: currentBridgePath(),
+      controller_path: currentControllerPath(),
+      client_manifest: currentClientManifestPath(),
+      client_installed: Boolean(current && installedClientCommand()),
+      bridge_installed: fs.existsSync(currentBridgePath()),
+      controller_installed: fs.existsSync(currentControllerPath()),
+      client_version: current && current.version ? current.version : null,
+    },
+  };
+}
+
+function packageLatestUrl(args = {}) {
+  return String(
+    args["package-latest-url"] ||
+      process.env.MYTE_CODY_PACKAGE_LATEST_URL ||
+      process.env.MYTE_PACKAGE_LATEST_URL ||
+      DEFAULT_PACKAGE_LATEST_URL,
+  );
+}
+
+function packageUpdateCheckEnabled(args = {}) {
+  if (args["package-update-check"] === false) return false;
+  return process.env.MYTE_CODY_PACKAGE_UPDATE_CHECK !== "0";
+}
+
+function packageStatusBase(args = {}) {
+  return {
+    name: PACKAGE_NAME,
+    installed_version: PACKAGE_VERSION,
+    latest_version: null,
+    update_available: null,
+    check_status: "not-checked",
+    latest_url: packageLatestUrl(args),
+    update_command: `npm install -g ${PACKAGE_NAME}@latest`,
+    engine_update_command: "mytecody update",
+  };
+}
+
+function parseSemverish(version) {
+  const main = String(version || "")
+    .trim()
+    .replace(/^v/i, "")
+    .split(/[+-]/)[0];
+  const match = main.match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!match) return null;
+  return [match[1], match[2] || "0", match[3] || "0"].map((part) => Number(part));
+}
+
+function compareSemverish(left, right) {
+  const leftParts = parseSemverish(left);
+  const rightParts = parseSemverish(right);
+  if (!leftParts || !rightParts) return String(left || "").localeCompare(String(right || ""));
+  for (let i = 0; i < 3; i += 1) {
+    if (leftParts[i] > rightParts[i]) return 1;
+    if (leftParts[i] < rightParts[i]) return -1;
+  }
+  return 0;
+}
+
+function isVersionNewer(latest, installed = PACKAGE_VERSION) {
+  return compareSemverish(latest, installed) > 0;
+}
+
+function packageUpdateTimeoutMs() {
+  const value = Number(process.env.MYTE_CODY_PACKAGE_UPDATE_TIMEOUT_MS || 1500);
+  return Number.isFinite(value) && value > 0 ? value : 1500;
+}
+
+async function checkPackageUpdate(args = {}) {
+  const status = packageStatusBase(args);
+  if (!packageUpdateCheckEnabled(args)) {
+    return { ...status, check_status: "skipped" };
+  }
+  try {
+    const response = await fetchJson(status.latest_url, {
+      timeoutMs: packageUpdateTimeoutMs(),
+    });
+    if (!response.ok) {
+      return {
+        ...status,
+        check_status: "unavailable",
+        registry_status: response.status,
+      };
+    }
+    const latestVersion = response.body && response.body.version ? String(response.body.version) : "";
+    if (!latestVersion) {
+      return { ...status, check_status: "invalid-response" };
+    }
+    return {
+      ...status,
+      latest_version: latestVersion,
+      update_available: isVersionNewer(latestVersion, PACKAGE_VERSION),
+      check_status: "ok",
+    };
+  } catch (error) {
+    return {
+      ...status,
+      check_status: "unavailable",
+      error: error && error.message ? error.message : String(error),
+    };
+  }
+}
+
+function packageUpdateNotice(packageStatus) {
+  if (!packageStatus || packageStatus.update_available !== true) return "";
+  return `myte package update available: ${packageStatus.latest_version} (installed ${packageStatus.installed_version}). Run ${packageStatus.update_command}`;
+}
+
+function printJson(payload) {
+  console.log(JSON.stringify(payload, null, 2));
+}
+
+function isUrl(value) {
+  return /^https?:\/\//i.test(String(value || ""));
+}
+
+function statusLine(message) {
+  if (process.env.MYTE_CODY_QUIET_SETUP === "1") return;
+  console.error(`[MYTE CODY] ${message}`);
+}
+
+function setupProgress(splash) {
+  return (message) => {
+    if (splash && splash.enabled) {
+      splash.setStatus(message);
+      return;
+    }
+    statusLine(message);
+  };
+}
+
+function formatBytes(bytes) {
+  const value = Number(bytes || 0);
+  if (!Number.isFinite(value) || value <= 0) return "unknown size";
+  const units = ["B", "KB", "MB", "GB"];
+  let size = value;
+  let unit = 0;
+  while (size >= 1024 && unit < units.length - 1) {
+    size /= 1024;
+    unit += 1;
+  }
+  return `${size.toFixed(unit === 0 ? 0 : 1)} ${units[unit]}`;
+}
+
+async function readManifest(source, { fetchManifest, progress } = {}) {
+  if (!source) return { status: "missing", manifest: null };
+  if (isUrl(source)) {
+    if (!fetchManifest) {
+      return { status: "skipped", manifest: null };
+    }
+    if (progress) progress("checking signed release manifest");
+    const response = await fetch(source);
+    const text = await response.text();
+    if (!response.ok) {
+      throw new Error(`Manifest fetch failed (${response.status}): ${text.slice(0, 300)}`);
+    }
+    return { status: "fetched", manifest: JSON.parse(text) };
+  }
+  const filePath = path.resolve(source);
+  const text = fs.readFileSync(filePath, "utf8");
+  return { status: "read", manifest: JSON.parse(text), file_path: filePath };
+}
+
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function manifestWithoutSignature(manifest) {
+  const clone = JSON.parse(JSON.stringify(manifest || {}));
+  delete clone.signature;
+  return clone;
+}
+
+function verifyManifestSignature(manifest) {
+  const signature = manifest && manifest.signature;
+  if (!signature || !signature.value) {
+    return { status: "missing", verified: false };
+  }
+  const publicKey = builtInPublicKeyPem();
+  if (!publicKey) {
+    return {
+      status: "public-key-missing",
+      verified: false,
+      key_id: signature.key_id || null,
+    };
+  }
+  const verifier = crypto.createVerify("SHA256");
+  verifier.update(stableJson(manifestWithoutSignature(manifest)));
+  verifier.end();
+  return {
+    status: "checked",
+    verified: verifier.verify(publicKey, String(signature.value), "base64"),
+    key_id: signature.key_id || null,
+  };
+}
+
+function builtInPublicKeyPem() {
+  const publicKeyPath = path.join(__dirname, "lib", "mytecody-release-public-key.pem");
+  if (!fs.existsSync(publicKeyPath)) return "";
+  return fs.readFileSync(publicKeyPath, "utf8");
+}
+
+function artifactForPlatform(manifest) {
+  const artifacts = manifest && manifest.artifacts;
+  const platform = platformKey();
+  if (Array.isArray(artifacts)) {
+    return (
+      artifacts.find((artifact) => {
+        if (!artifact || typeof artifact !== "object") return false;
+        const combined = `${artifact.platform || process.platform}-${artifact.arch || process.arch}`;
+        return artifact.platform_key === platform || combined === platform;
+      }) || null
+    );
+  }
+  if (!artifacts || typeof artifacts !== "object") return null;
+  return artifacts[platform] || null;
+}
+
+function validateArtifactMetadata(artifact) {
+  if (!artifact) return { status: "missing", ok: false };
+  const missing = [];
+  if (!artifact.url) missing.push("url");
+  if (!artifact.sha256) missing.push("sha256");
+  return {
+    status: missing.length ? "invalid" : "present",
+    ok: missing.length === 0,
+    missing,
+    url: artifact.url || null,
+    format: artifact.format || null,
+    sha256_present: Boolean(artifact.sha256),
+  };
+}
+
+function localPathFromArtifactUrl(urlValue) {
+  const raw = String(urlValue || "").trim();
+  if (/^file:\/\//i.test(raw)) {
+    const url = new URL(raw);
+    return decodeURIComponent(url.pathname.replace(/^\/([A-Za-z]:)/, "$1"));
+  }
+  if (!isUrl(raw)) return path.resolve(raw);
+  return null;
+}
+
+async function readArtifactBytes(artifact, { progress, label = "MyteCody engine" } = {}) {
+  const urlValue = artifact && artifact.url ? String(artifact.url) : "";
+  const localPath = localPathFromArtifactUrl(urlValue);
+  if (localPath) {
+    if (progress) progress(`reading local ${label} artifact`);
+    return fs.readFileSync(localPath);
+  }
+  const headers = {};
+  const token = getAuthToken();
+  if (token) headers.Authorization = `Bearer ${token}`;
+  if (progress) {
+    const expectedSize = Number(artifact && artifact.size_bytes ? artifact.size_bytes : 0);
+    progress(`downloading ${label} (${formatBytes(expectedSize)})`);
+  }
+  const response = await fetch(urlValue, { method: "GET", headers });
+  if (!response.ok) {
+    const bytes = Buffer.from(await response.arrayBuffer());
+    throw new Error(`Artifact fetch failed (${response.status}): ${bytes.toString("utf8", 0, Math.min(bytes.length, 300))}`);
+  }
+  if (!response.body || typeof response.body.getReader !== "function") {
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (progress) progress(`downloaded ${label} (${formatBytes(bytes.length)})`);
+    return bytes;
+  }
+
+  const total = Number(response.headers.get("content-length") || artifact?.size_bytes || 0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let received = 0;
+  let lastPct = -1;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = Buffer.from(value);
+    chunks.push(chunk);
+    received += chunk.length;
+    if (progress && total > 0) {
+      const pct = Math.min(100, Math.floor((received / total) * 100));
+      if (pct >= lastPct + 10 || pct === 100) {
+        progress(`downloading ${label} ${pct}% (${formatBytes(received)} / ${formatBytes(total)})`);
+        lastPct = pct;
+      }
+    }
+  }
+  const bytes = Buffer.concat(chunks);
+  if (progress) progress(`downloaded ${label} (${formatBytes(bytes.length)})`);
+  return bytes;
+}
+
+function sha256Hex(bytes) {
+  return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+
+function artifactFormat(artifact) {
+  const explicit = String((artifact && artifact.format) || "").trim().toLowerCase();
+  if (explicit) return explicit;
+  const urlValue = String((artifact && artifact.url) || "").trim().toLowerCase();
+  if (urlValue.endsWith(".gz")) return "gzip";
+  return "exe";
+}
+
+function artifactBytesForInstall(bytes, artifact) {
+  const format = artifactFormat(artifact);
+  if (format === "exe" || format === "binary" || format === "raw") return bytes;
+  if (format === "gzip" || format === "gz") return zlib.gunzipSync(bytes);
+  throw new Error(`Unsupported MyteCody release artifact format: ${format}`);
+}
+
+function signatureAccepted(manifest, args = {}) {
+  const signature = verifyManifestSignature(manifest);
+  if (signature.verified) return { ok: true, signature, trusted_unsigned: false };
+  return { ok: false, signature, trusted_unsigned: false };
+}
+
+function installArtifactBytes(bytes, manifest, artifact) {
+  const installBytes = artifactBytesForInstall(bytes, artifact);
+  const enginePath = currentEnginePath();
+  fs.rmSync(path.dirname(path.dirname(enginePath)), { recursive: true, force: true });
+  fs.mkdirSync(path.dirname(enginePath), { recursive: true });
+  fs.writeFileSync(enginePath, installBytes);
+  if (process.platform !== "win32") {
+    fs.chmodSync(enginePath, 0o755);
+  }
+  const installedManifest = {
+    schema_version: manifest.schema_version || 1,
+    channel: manifest.channel || DEFAULT_CHANNEL,
+    version: manifest.version || "unknown",
+    installed_at: new Date().toISOString(),
+    launcher_version: PACKAGE_VERSION,
+    platform: platformKey(),
+    executable: enginePath,
+    artifact: {
+      url: artifact.url,
+      sha256: artifact.sha256,
+      format: artifactFormat(artifact),
+      size_bytes: bytes.length,
+      installed_sha256: sha256Hex(installBytes),
+      installed_size_bytes: installBytes.length,
+    },
+  };
+  fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installedManifest, null, 2), "utf8");
+  return installedManifest;
+}
+
+function reusableInstalledArtifact(artifact) {
+  const enginePath = currentEnginePath();
+  const current = readCurrentClientManifest();
+  if (!current || !fs.existsSync(enginePath)) return null;
+
+  const currentArtifact = current.artifact || {};
+  if (artifact && artifact.sha256) {
+    if (String(currentArtifact.sha256 || "").toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
+      return null;
+    }
+  }
+
+  const engineBytes = fs.readFileSync(enginePath);
+  const installedSha = sha256Hex(engineBytes);
+  const expectedInstalledSha =
+    artifact && (artifact.installed_sha256 || artifact.executable_sha256 || artifact.uncompressed_sha256);
+  if (expectedInstalledSha && installedSha.toLowerCase() !== String(expectedInstalledSha).toLowerCase()) {
+    return null;
+  }
+  if (
+    currentArtifact.installed_sha256 &&
+    installedSha.toLowerCase() !== String(currentArtifact.installed_sha256).toLowerCase()
+  ) {
+    return null;
+  }
+
+  return {
+    enginePath,
+    engineBytes,
+    artifactSizeBytes: Number(currentArtifact.size_bytes || artifact?.size_bytes || 0),
+    installedSha,
+  };
+}
+
+function installManifestForReusableArtifact(reusable, manifest, artifact) {
+  const installedManifest = {
+    schema_version: manifest.schema_version || 1,
+    channel: manifest.channel || DEFAULT_CHANNEL,
+    version: manifest.version || "unknown",
+    installed_at: new Date().toISOString(),
+    launcher_version: PACKAGE_VERSION,
+    platform: platformKey(),
+    executable: reusable.enginePath,
+    artifact: {
+      url: artifact.url,
+      sha256: artifact.sha256,
+      format: artifactFormat(artifact),
+      size_bytes: reusable.artifactSizeBytes,
+      installed_sha256: reusable.installedSha,
+      installed_size_bytes: reusable.engineBytes.length,
+    },
+  };
+  fs.mkdirSync(path.dirname(currentClientManifestPath()), { recursive: true });
+  fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installedManifest, null, 2), "utf8");
+  return installedManifest;
+}
+
+async function installReleaseAssets(manifest, artifact, { progress } = {}) {
+  const assets = releaseAssetsForPlatform(manifest, artifact);
+  const installed = [];
+  for (const asset of assets) {
+    const name = String(asset.name || path.basename(String(asset.install_path || "")) || "client asset");
+    const bytes = await readArtifactBytes(asset, { progress, label: `MyteCody ${name}` });
+    const digest = sha256Hex(bytes);
+    if (digest.toLowerCase() !== String(asset.sha256 || "").toLowerCase()) {
+      throw new Error(`Release asset SHA-256 mismatch for ${name}: expected ${asset.sha256}, got ${digest}`);
+    }
+    const installBytes = artifactBytesForInstall(bytes, asset);
+    const targetPath = assertSafeReleaseAssetInstallPath(asset.install_path);
+    fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+    fs.writeFileSync(targetPath, installBytes);
+    installed.push({
+      name,
+      install_path: String(asset.install_path || "").replace(/\\/g, "/"),
+      url: asset.url,
+      sha256: asset.sha256,
+      format: artifactFormat(asset),
+      size_bytes: bytes.length,
+      installed_sha256: sha256Hex(installBytes),
+      installed_size_bytes: installBytes.length,
+    });
+  }
+  return installed;
+}
+
+async function fetchJson(url, { headers = {}, timeoutMs = 8000 } = {}) {
+  const controller = typeof AbortController !== "undefined" ? new AbortController() : undefined;
+  const timeoutId =
+    controller && timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        ...headers,
+      },
+      signal: controller?.signal,
+    });
+    const text = await response.text();
+    let body = {};
+    if (text.trim()) {
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = { raw_text: text.slice(0, 500) };
+      }
+    }
+    return {
+      ok: Boolean(response.ok),
+      status: response.status,
+      body,
+    };
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+  }
+}
+
+async function probeGateway(args = {}) {
+  const token = getAuthToken();
+  const healthUrl = codyGatewayUrl(args, "/cody/health");
+  const modelsUrl = codyGatewayUrl(args, "/cody/v1/models");
+  const result = {
+    ok: false,
+    health: {
+      url: healthUrl,
+      ok: false,
+      status: null,
+    },
+    models: {
+      url: modelsUrl,
+      ok: false,
+      status: null,
+      skipped: !token,
+    },
+  };
+  try {
+    const health = await fetchJson(healthUrl);
+    result.health.ok = Boolean(health.ok && health.body && health.body.ok === true);
+    result.health.status = health.status;
+    result.health.service = health.body && health.body.service ? String(health.body.service) : null;
+    result.health.model = health.body && health.body.model ? health.body.model : null;
+  } catch (error) {
+    result.health.error = error && error.message ? error.message : String(error);
+  }
+
+  if (token) {
+    try {
+      const models = await fetchJson(modelsUrl, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      const ids = Array.isArray(models.body?.data)
+        ? models.body.data.map((item) => String(item && item.id ? item.id : "")).filter(Boolean)
+        : [];
+      result.models.ok = Boolean(models.ok && ids.includes("myte"));
+      result.models.status = models.status;
+      result.models.ids = ids;
+      result.models.skipped = false;
+    } catch (error) {
+      result.models.error = error && error.message ? error.message : String(error);
+      result.models.skipped = false;
+    }
+  }
+
+  result.ok = Boolean(result.health.ok && result.models.ok);
+  return result;
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value || ""));
+}
+
+function tomlLiteralString(value) {
+  const text = String(value || "");
+  if (!text.includes("'") && !text.includes("\n") && !text.includes("\r")) {
+    return `'${text}'`;
+  }
+  return tomlString(text);
+}
+
+function pathForToml(value) {
+  return String(value || "");
+}
+
+function writeCodexModelCatalog() {
+  fs.mkdirSync(codexHome(), { recursive: true });
+  const catalog = {
+    models: [
+      {
+        slug: DEFAULT_MODEL_ALIAS,
+        display_name: "Myte",
+        description: "Myte AI coding model.",
+        base_instructions: CLIENT_BASE_INSTRUCTIONS,
+        default_reasoning_level: "medium",
+        supported_reasoning_levels: [
+          { effort: "low", description: "Fast local coding pass." },
+          { effort: "medium", description: "Balanced coding pass." },
+          { effort: "high", description: "Deeper coding pass." },
+        ],
+        shell_type: "shell_command",
+        visibility: "list",
+        supported_in_api: true,
+        priority: 0,
+        availability_nux: null,
+        upgrade: null,
+        supports_reasoning_summaries: false,
+        default_reasoning_summary: "none",
+        support_verbosity: false,
+        default_verbosity: null,
+        apply_patch_tool_type: "freeform",
+        web_search_tool_type: "text",
+        truncation_policy: {
+          mode: "tokens",
+          limit: 10000,
+        },
+        supports_parallel_tool_calls: true,
+        supports_image_detail_original: false,
+        context_window: DEFAULT_CONTEXT_WINDOW,
+        max_context_window: DEFAULT_CONTEXT_WINDOW,
+        auto_compact_token_limit: DEFAULT_AUTO_COMPACT_TOKENS,
+        effective_context_window_percent: 90,
+        experimental_supported_tools: [],
+        input_modalities: ["text"],
+        supports_search_tool: false,
+        use_responses_lite: false,
+        auto_review_model_override: null,
+      },
+    ],
+  };
+  const catalogPath = codexModelCatalogPath();
+  fs.writeFileSync(catalogPath, JSON.stringify(catalog, null, 2), "utf8");
+  return catalogPath;
+}
+
+function writeCodexConfig(args = {}, providerBaseUrl = codyInferenceBase(args)) {
+  fs.mkdirSync(codexHome(), { recursive: true });
+  const catalogPath = writeCodexModelCatalog();
+  const config = `model = ${tomlString(DEFAULT_MODEL_ALIAS)}
+model_provider = "myte_ai"
+model_catalog_json = ${tomlString(catalogPath)}
+model_context_window = ${DEFAULT_CONTEXT_WINDOW}
+model_auto_compact_token_limit = ${DEFAULT_AUTO_COMPACT_TOKENS}
+tool_output_token_limit = ${DEFAULT_TOOL_OUTPUT_TOKENS}
+web_search = "disabled"
+suppress_unstable_features_warning = true
+check_for_update_on_startup = false
+
+[tui]
+show_tooltips = false
+status_line = ["run-state", "current-dir"]
+status_line_use_colors = true
+terminal_title = ["project"]
+
+[model_providers.myte_ai]
+name = "Myte AI"
+base_url = ${tomlString(providerBaseUrl)}
+env_key = "MYTE_CODY_AUTH_TOKEN"
+wire_api = "responses"
+requires_openai_auth = false
+
+[features]
+apps = false
+multi_agent = false
+hooks = false
+memories = false
+plugins = false
+tool_suggest = false
+
+[features.multi_agent_v2]
+enabled = true
+max_concurrent_threads_per_session = ${DEFAULT_AGENT_THREADS}
+
+[skills]
+include_instructions = true
+
+[skills.bundled]
+enabled = false
+
+[projects.${tomlLiteralString(process.cwd())}]
+trust_level = "trusted"
+
+[windows]
+sandbox = "unelevated"
+`;
+  const configPath = path.join(codexHome(), "config.toml");
+  fs.writeFileSync(configPath, config, "utf8");
+  return { configPath, catalogPath };
+}
+
+function resolveCodexCommand() {
+  const installed = installedClientCommand();
+  if (installed) return installed;
+  return null;
+}
+
+function codexProviderArgs(args = {}, providerBaseUrl = codyInferenceBase(args)) {
+  return [
+    "-c",
+    'model_provider="myte_ai"',
+    "-c",
+    'model_providers.myte_ai.name="Myte AI"',
+    "-c",
+    `model_providers.myte_ai.base_url="${providerBaseUrl}"`,
+    "-c",
+    'model_providers.myte_ai.env_key="MYTE_CODY_AUTH_TOKEN"',
+    "-c",
+    'model_providers.myte_ai.wire_api="responses"',
+    "-c",
+    `model_catalog_json=${tomlString(codexModelCatalogPath())}`,
+    "-c",
+    `model_context_window=${DEFAULT_CONTEXT_WINDOW}`,
+    "-c",
+    `model_auto_compact_token_limit=${DEFAULT_AUTO_COMPACT_TOKENS}`,
+    "-c",
+    `tool_output_token_limit=${DEFAULT_TOOL_OUTPUT_TOKENS}`,
+    "-c",
+    "web_search=\"disabled\"",
+    "-c",
+    "suppress_unstable_features_warning=true",
+    "-c",
+    "features.multi_agent_v2.enabled=true",
+    "-c",
+    `features.multi_agent_v2.max_concurrent_threads_per_session=${DEFAULT_AGENT_THREADS}`,
+    "--sandbox",
+    "danger-full-access",
+    "--ask-for-approval",
+    "never",
+    "-m",
+    DEFAULT_MODEL_ALIAS,
+  ];
+}
+
+function codexLaunchArgs(rawArgs, args = {}, providerBaseUrl = codyInferenceBase(args)) {
+  const providerArgs = codexProviderArgs(args, providerBaseUrl);
+  if (!rawArgs.length) return providerArgs;
+  if (rawArgs[0] === "exec") return [...providerArgs, "exec", "--skip-git-repo-check", ...rawArgs.slice(1)];
+  return [...providerArgs, ...rawArgs];
+}
+
+function execArgsAndStdin(rawArgs) {
+  if (!rawArgs.length) return { args: [], stdin: null };
+  const valueOptions = new Set([
+    "-a",
+    "--ask-for-approval",
+    "-C",
+    "--cd",
+    "-c",
+    "--config",
+    "-i",
+    "--image",
+    "-m",
+    "--model",
+    "-o",
+    "--output-last-message",
+    "-p",
+    "--profile",
+    "-s",
+    "--sandbox",
+    "--color",
+    "--local-provider",
+    "--output-schema",
+  ]);
+  const forwarded = [];
+  let index = 0;
+  while (index < rawArgs.length) {
+    const arg = rawArgs[index];
+    if (arg === "--") {
+      index += 1;
+      break;
+    }
+    if (arg === "-") break;
+    if (!arg.startsWith("-")) break;
+    forwarded.push(arg);
+    index += 1;
+    if (valueOptions.has(arg) && index < rawArgs.length) {
+      forwarded.push(rawArgs[index]);
+      index += 1;
+    }
+  }
+  const promptParts = rawArgs.slice(index);
+  if (!promptParts.length) return { args: forwarded, stdin: null };
+  if (promptParts.length === 1 && promptParts[0] === "-") {
+    return { args: [...forwarded, "-"], stdin: fs.readFileSync(0, "utf8") };
+  }
+  const prompt = promptParts.join(" ");
+  if (prompt.includes("\n") || prompt.includes("\r") || promptParts.length > 1) {
+    return { args: [...forwarded, "-"], stdin: prompt };
+  }
+  return { args: [...forwarded, prompt], stdin: null };
+}
+
+function stripControllerArgs(rawArgs) {
+  const kept = [];
+  let enabled = process.env.MYTE_CODY_CONTROLLER === "1";
+  for (let i = 0; i < rawArgs.length; i += 1) {
+    const arg = rawArgs[i];
+    if (arg === "--controller") {
+      const next = rawArgs[i + 1];
+      const normalizedNext = String(next || "").toLowerCase();
+      if (next !== undefined && !next.startsWith("-") && ["0", "1", "false", "true", "off", "on", "raw"].includes(normalizedNext)) {
+        enabled = !["0", "false", "off", "raw"].includes(String(next).toLowerCase());
+        i += 1;
+      } else {
+        enabled = true;
+      }
+      continue;
+    }
+    if (arg.startsWith("--controller=")) {
+      const value = arg.slice("--controller=".length);
+      enabled = !["0", "false", "off", "raw"].includes(String(value).toLowerCase());
+      continue;
+    }
+    if (arg === "--no-controller") {
+      enabled = false;
+      continue;
+    }
+    kept.push(arg);
+  }
+  return { enabled, args: kept };
+}
+
+function controllerPromptFromExecArgs(rawArgs) {
+  const execInput = execArgsAndStdin(rawArgs);
+  if (execInput.stdin != null) return { prompt: execInput.stdin, forwardedArgs: [] };
+  const prompt = execInput.args.length ? execInput.args[execInput.args.length - 1] : "";
+  if (!prompt || prompt.startsWith("-")) {
+    return { prompt: "", forwardedArgs: execInput.args };
+  }
+  return { prompt, forwardedArgs: execInput.args.slice(0, -1) };
+}
+
+function classifyMyteCodyInvocation(rawArgs = []) {
+  const args = Array.isArray(rawArgs) ? rawArgs : [];
+  if (!args.length) return { mode: "raw-codex", args: [], controller: false };
+
+  const command = args[0];
+  if (command === "codex") return { mode: "raw-codex", args: args.slice(1), controller: false };
+  if (command === "controller-shell") return { mode: "controller-shell", args: args.slice(1) };
+  if (command === "controller-resume") return { mode: "controller-resume", args: args.slice(1) };
+  if (command === "resume") return { mode: "raw-codex", args, controller: false };
+  if (command === "exec") {
+    const controller = stripControllerArgs(args.slice(1));
+    if (controller.enabled) return { mode: "controller-exec", args: controller.args };
+    return { mode: "raw-codex", args: ["exec", ...controller.args] };
+  }
+  if (String(command || "").startsWith("-")) return { mode: "raw-codex", args };
+  return { mode: "raw-codex", args, controller: false };
+}
+
+function runEngineExecWorker({ command, args, providerBaseUrl, token, prompt, timeoutMs }) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const env = {
+      ...process.env,
+      CODEX_HOME: codexHome(),
+      MYTE_CODY_AUTH_TOKEN: token,
+      MYTE_CODY_BRAND: "1",
+      MYTE_CODY_CONTROLLER: "0",
+      MYTE_CODY_BRIDGE_BASE_URL: providerBaseUrl,
+    };
+    const launchArgs = [...command.args, ...codexLaunchArgs(["exec", "--json", "-"], args, providerBaseUrl)];
+    const child = spawn(command.cmd, launchArgs, {
+      cwd: process.cwd(),
+      env,
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: process.platform === "win32" && command.cmd === "codex",
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      try {
+        child.kill();
+      } catch {}
+    }, timeoutMs || 180000);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        status: 1,
+        stdout,
+        stderr,
+        error: error.message || String(error),
+        durationMs: Date.now() - started,
+      });
+    });
+    child.on("exit", (code, signal) => {
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        status: code == null ? 1 : code,
+        signal: signal || null,
+        stdout,
+        stderr,
+        error: null,
+        durationMs: Date.now() - started,
+      });
+    });
+    child.stdin.end(prompt);
+  });
+}
+
+async function runSignedControllerPrompt({ signedController, command, args, bridge, token, promptInfo }) {
+  if (!promptInfo.prompt.trim()) {
+    console.error("MyteCody controller requires a prompt.");
+    return 1;
+  }
+  const summary = await signedController.runMyteCodyController({
+    prompt: promptInfo.prompt,
+    workspace: process.cwd(),
+    artifactRoot: path.join(installRoot(), "controller-runs"),
+    runWorker: (workerPrompt, workerOptions = {}) =>
+      runEngineExecWorker({
+        command,
+        args,
+        providerBaseUrl: bridge.baseUrl,
+        token,
+        prompt: workerPrompt,
+        timeoutMs: workerOptions.timeoutMs || 180000,
+      }),
+  });
+  console.error(`[MYTE CODY] controller run: ${summary.artifact_dir}`);
+  console.error(`[MYTE CODY] controller status: ${summary.status}`);
+  if (summary.status === "paused") {
+    console.error(`[MYTE CODY] resume: mytecody resume ${summary.run_id}`);
+  }
+  return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
+}
+
+async function runSignedControllerResume({ signedController, command, args, bridge, token, target }) {
+  if (!signedController || typeof signedController.resumeMyteCodyControllerRun !== "function") {
+    console.error("Installed MyteCody controller does not support resume; run `mytecody update`.");
+    return 1;
+  }
+  let record;
+  try {
+    record = resolveControllerRunTarget(target || "latest");
+  } catch (error) {
+    console.error(`[MYTE CODY] ${error && error.message ? error.message : error}`);
+    return 1;
+  }
+  if (!record) {
+    console.error(`[MYTE CODY] CodyRun not found: ${target || "latest"}`);
+    return 1;
+  }
+  const summary = await signedController.resumeMyteCodyControllerRun({
+    runId: record.run_id,
+    workspace: record.workspace_root || process.cwd(),
+    artifactRoot: controllerRunsRoot(),
+    runWorker: (workerPrompt, workerOptions = {}) =>
+      runEngineExecWorker({
+        command,
+        args,
+        providerBaseUrl: bridge.baseUrl,
+        token,
+        prompt: workerPrompt,
+        timeoutMs: workerOptions.timeoutMs || 180000,
+      }),
+  });
+  console.error(`[MYTE CODY] resumed CodyRun: ${summary.run_id}`);
+  console.error(`[MYTE CODY] controller status: ${summary.status}`);
+  if (summary.status === "paused") {
+    console.error(`[MYTE CODY] resume: mytecody resume ${summary.run_id}`);
+  }
+  return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
+}
+
+function isControllerShellExit(value) {
+  return ["/exit", "/quit", "exit", "quit"].includes(String(value || "").trim().toLowerCase());
+}
+
+function compactWorkspacePath(workspace = process.cwd()) {
+  const home = os.homedir();
+  const resolved = path.resolve(workspace);
+  if (resolved.toLowerCase().startsWith(home.toLowerCase())) {
+    return `~${resolved.slice(home.length)}`;
+  }
+  return resolved;
+}
+
+function fitCell(value, width) {
+  const text = String(value || "");
+  if (text.length <= width) return `${text}${" ".repeat(width - text.length)}`;
+  return `${text.slice(0, Math.max(0, width - 1))}…`;
+}
+
+function printControllerShellBanner() {
+  const width = 70;
+  const lines = [
+    "MYTE CODY - Your Tech Your Way",
+    `workspace: ${compactWorkspacePath()}`,
+    "mode:      sovereign coding agent - Myte AI gateway",
+    "enter a prompt, /resume latest, /diagnostics, /help, or /exit",
+  ];
+  console.log(`╭${"─".repeat(width)}╮`);
+  for (const line of lines) console.log(`│ ${fitCell(line, width - 2)} │`);
+  console.log(`╰${"─".repeat(width)}╯`);
+}
+
+function printControllerShellHelp() {
+  console.log("");
+  console.log("MYTE CODY commands");
+  console.log("/resume [run_id|latest]  Continue a paused CodyRun.");
+  console.log("/diagnostics             Open the raw engine diagnostics view.");
+  console.log("/exit                    Quit.");
+  console.log("");
+}
+
+async function runControllerShell({ signedController, command, args, bridge, token }) {
+  printControllerShellBanner();
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    prompt: "\n› ",
+  });
+  rl.prompt();
+  for await (const line of rl) {
+    const prompt = String(line || "").trim();
+    if (!prompt) {
+      rl.prompt();
+      continue;
+    }
+    if (isControllerShellExit(prompt)) break;
+    if (prompt === "/help") {
+      printControllerShellHelp();
+      rl.prompt();
+      continue;
+    }
+    if (prompt === "/diagnostics" || prompt === "/codex") {
+      rl.close();
+      return { rawCodexRequested: true };
+    }
+    if (prompt.startsWith("/resume")) {
+      const target = prompt.split(/\s+/).slice(1)[0] || "latest";
+      await runSignedControllerResume({
+        signedController,
+        command,
+        args,
+        bridge,
+        token,
+        target,
+      });
+      rl.prompt();
+      continue;
+    }
+    await runSignedControllerPrompt({
+      signedController,
+      command,
+      args,
+      bridge,
+      token,
+      promptInfo: { prompt, forwardedArgs: [] },
+    });
+    rl.prompt();
+  }
+  return { rawCodexRequested: false };
+}
+
+function emitSidecarEvent(event) {
+  process.stdout.write(`${JSON.stringify(event)}\n`);
+}
+
+async function runControllerSidecar() {
+  let request;
+  try {
+    const raw = fs.readFileSync(0, "utf8");
+    request = raw.trim() ? JSON.parse(raw) : {};
+  } catch (error) {
+    emitSidecarEvent({
+      type: "failed",
+      message: `Invalid MyteCody sidecar request: ${error && error.message ? error.message : error}`,
+    });
+    return 1;
+  }
+
+  const prompt = String(request.prompt || "").trim();
+  const workspace = path.resolve(request.workspace || process.cwd());
+  if (!prompt) {
+    emitSidecarEvent({ type: "failed", message: "MyteCody sidecar request did not include a prompt." });
+    return 1;
+  }
+
+  const token = process.env.MYTE_CODY_AUTH_TOKEN || getAuthToken();
+  const providerBaseUrl = process.env.MYTE_CODY_BRIDGE_BASE_URL;
+  const command = resolveCodexCommand();
+  if (!token || !providerBaseUrl || !command) {
+    emitSidecarEvent({
+      type: "failed",
+      message: "MyteCody sidecar is missing auth, bridge URL, or installed engine command.",
+    });
+    return 1;
+  }
+
+  emitSidecarEvent({
+    type: "started",
+    message: "MyteCody controller started.",
+    workspace,
+  });
+
+  try {
+    const signedController = loadSignedController();
+    const summary = await signedController.runMyteCodyController({
+      prompt,
+      workspace,
+      artifactRoot: process.env.MYTE_CODY_CONTROLLER_RUNS_DIR || controllerRunsRoot(),
+      mode: process.env.MYTE_CODY_CONTROLLER_MODE || "gateway",
+      runWorker: (workerPrompt, workerOptions = {}) =>
+        runEngineExecWorker({
+          command,
+          args: {},
+          providerBaseUrl,
+          token,
+          prompt: workerPrompt,
+          timeoutMs: workerOptions.timeoutMs || 180000,
+        }),
+    });
+    const resumeCommand = `mytecody resume ${summary.run_id}`;
+    emitSidecarEvent({
+      type: summary.status === "paused" ? "paused" : "completed",
+      run_id: summary.run_id,
+      status: summary.status,
+      artifact_dir: summary.artifact_dir,
+      resume: summary.status === "paused" ? resumeCommand : null,
+      message:
+        summary.status === "paused"
+          ? `MyteCody paused with a durable run state. Resume with: ${resumeCommand}`
+          : `MyteCody controller completed with status: ${summary.status}`,
+    });
+    return ["pass", "paused", "completed"].includes(summary.status) ? 0 : 1;
+  } catch (error) {
+    emitSidecarEvent({
+      type: "failed",
+      message: error && error.stack ? error.stack : error && error.message ? error.message : String(error),
+    });
+    return 1;
+  }
+}
+
+async function runCodex(rawArgs, args = {}, envPath = null) {
+  const token = getAuthToken();
+  if (!token) {
+    console.error("MyteCody requires MYTEAI_API_KEY for coding.");
+    return 1;
+  }
+  const splash = createMyteSplash();
+  const progress = setupProgress(splash);
+  splash.start("preparing trusted workspace");
+  progress("preparing trusted workspace");
+  try {
+    const install = await ensureBrandedEngineInstalled(args, envPath, { progress });
+    if (install.ok && install.installed) {
+      progress(`engine installed: ${install.payload.installed.version}`);
+    } else if (install.ok) {
+      progress("engine ready");
+    } else if (!install.ok) {
+      await splash.stop();
+      console.error(`MyteCody branded engine could not be verified: ${install.reason || "unknown"}.`);
+      console.error("Run `mytecody update` with access to the Myte release manifest.");
+      return 1;
+    }
+  } catch (error) {
+    await splash.stop();
+    console.error(`MyteCody engine verification failed: ${error && error.message ? error.message : error}`);
+    return 1;
+  }
+
+  let packageNotice = "";
+  try {
+    progress("checking myte package version");
+    packageNotice = packageUpdateNotice(await checkPackageUpdate(args));
+  } catch {
+    packageNotice = "";
+  }
+
+  const command = resolveCodexCommand();
+  if (!command) {
+    await splash.stop();
+    console.error("MyteCody branded engine is not installed.");
+    console.error("Run `mytecody update` with access to the Myte release manifest.");
+    return 1;
+  }
+  let bridge = null;
+  try {
+    progress("opening Myte inference bridge");
+    const signedBridge = loadSignedBridge();
+    bridge = await signedBridge.startMyteCodyAsyncResponsesBridge({
+      gatewayRoot: gatewayRoot(args),
+      token,
+    });
+    writeCodexConfig(args, bridge.baseUrl);
+  } catch (error) {
+    await splash.stop();
+    console.error(`MyteCody inference bridge failed to start: ${error && error.message ? error.message : error}`);
+    return 1;
+  }
+
+  const invocation = classifyMyteCodyInvocation(rawArgs);
+  if (["controller-exec", "controller-prompt", "controller-shell", "controller-resume"].includes(invocation.mode)) {
+    try {
+      progress("opening MyteCody controller");
+      const signedController = loadSignedController();
+      await splash.stop();
+      if (packageNotice) statusLine(packageNotice);
+
+      if (invocation.mode === "controller-resume") {
+        const code = await runSignedControllerResume({
+          signedController,
+          command,
+          args,
+          bridge,
+          token,
+          target: invocation.args[0] || "latest",
+        });
+        await bridge.close();
+        return code;
+      }
+
+      if (invocation.mode === "controller-shell") {
+        const shellResult = await runControllerShell({
+          signedController,
+          command,
+          args,
+          bridge,
+          token,
+        });
+        if (shellResult.rawCodexRequested) {
+          const rawArgs = [...command.args, ...codexLaunchArgs([], args, bridge.baseUrl)];
+          const env = {
+            ...process.env,
+            CODEX_HOME: codexHome(),
+            MYTE_CODY_AUTH_TOKEN: token,
+            MYTE_CODY_BRAND: "1",
+            MYTE_CODY_CONTROLLER: "0",
+            MYTE_CODY_BRIDGE_BASE_URL: bridge.baseUrl,
+          };
+          return await new Promise((resolve) => {
+            const child = spawn(command.cmd, rawArgs, {
+              cwd: process.cwd(),
+              env,
+              stdio: "inherit",
+              shell: process.platform === "win32" && command.cmd === "codex",
+            });
+            child.on("error", (error) => {
+              console.error(`Unable to launch MyteCody engine: ${error.message || error}`);
+              bridge.close().finally(() => resolve(1));
+            });
+            child.on("close", (code) => {
+              bridge.close().finally(() => resolve(Number.isInteger(code) ? code : 1));
+            });
+          });
+        }
+        await bridge.close();
+        return 0;
+      }
+
+      const promptInfo = controllerPromptFromExecArgs(invocation.args);
+      if (!promptInfo.prompt.trim()) {
+        await splash.stop();
+        await bridge.close();
+        console.error("MyteCody controller requires a prompt.");
+        return 1;
+      }
+      const code = await runSignedControllerPrompt({
+        signedController,
+        command,
+        args,
+        bridge,
+        token,
+        promptInfo,
+      });
+      await bridge.close();
+      return code;
+    } catch (error) {
+      await splash.stop();
+      await bridge.close();
+      console.error(`MyteCody controller failed: ${error && error.message ? error.message : error}`);
+      return 1;
+    }
+  }
+
+  const launchArgs = [...command.args, ...codexLaunchArgs(invocation.args, args, bridge.baseUrl)];
+  const env = {
+    ...process.env,
+    CODEX_HOME: codexHome(),
+    MYTE_CODY_AUTH_TOKEN: token,
+    MYTE_CODY_BRAND: "1",
+    MYTE_CODY_CONTROLLER: invocation.controller === true ? "1" : "0",
+    MYTE_CODY_CONTROLLER_MODE: "gateway",
+    MYTE_CODY_CONTROLLER_NODE: process.execPath,
+    MYTE_CODY_CONTROLLER_ENTRY: __filename,
+    MYTE_CODY_CONTROLLER_RUNS_DIR: controllerRunsRoot(),
+    MYTE_CODY_BRIDGE_BASE_URL: bridge.baseUrl,
+  };
+  progress("opening MyteCody workspace");
+  await splash.stop();
+  if (packageNotice) statusLine(packageNotice);
+  return new Promise((resolve) => {
+    const child = spawn(command.cmd, launchArgs, {
+      cwd: process.cwd(),
+      env,
+      stdio: "inherit",
+      shell: process.platform === "win32" && command.cmd === "codex",
+    });
+    child.on("error", (error) => {
+      console.error(`Unable to launch MyteCody engine: ${error.message || error}`);
+      bridge.close().finally(() => resolve(1));
+    });
+    child.on("close", (code) => {
+      bridge.close().finally(() => resolve(Number.isInteger(code) ? code : 1));
+    });
+  });
+}
+
+async function runDoctor(args, envPath) {
+  const payload = {
+    ok: true,
+    ready_for_coding: false,
+    ...commonStatus(args, envPath),
+  };
+  payload.package = await checkPackageUpdate(args);
+  if (args["probe-gateway"]) {
+    payload.gateway.probe = await probeGateway(args);
+  }
+  payload.ready_for_coding =
+    payload.auth.present &&
+    payload.release.client_installed &&
+    payload.release.bridge_installed;
+  if (payload.gateway.probe) {
+    payload.ready_for_coding = Boolean(payload.ready_for_coding && payload.gateway.probe.ok);
+  }
+  if (args.json) {
+    printJson(payload);
+    return 0;
+  }
+  console.log("MYTE CODY - Your Tech Your Way");
+  console.log("");
+  console.log(`mode:       ${payload.mode}`);
+  console.log(`workspace:  ${payload.workspace}`);
+  console.log(`auth:       ${payload.auth.present ? `present (${payload.auth.source})` : "missing"}`);
+  console.log(`gateway:    ${payload.gateway.base_url}`);
+  if (payload.gateway.probe) {
+    console.log(`gateway probe: ${payload.gateway.probe.ok ? "ok" : "failed"}`);
+  }
+  console.log(`package:    ${payload.package.installed_version}`);
+  if (payload.package.check_status === "ok" && payload.package.update_available) {
+    console.log(`package update: ${payload.package.latest_version} available`);
+    console.log(`package command: ${payload.package.update_command}`);
+  } else if (payload.package.check_status === "ok") {
+    console.log("package update: current");
+  } else if (payload.package.check_status === "skipped") {
+    console.log("package update: skipped");
+  } else {
+    console.log(`package update: ${payload.package.check_status}`);
+  }
+  console.log(`client:     ${payload.release.client_installed ? payload.release.client_version : "not installed"}`);
+  console.log(`bridge:     ${payload.release.bridge_installed ? "installed" : "not installed"}`);
+  console.log(`install:    ${payload.release.install_root}`);
+  console.log("");
+  console.log("Coding requires the Myte AI gateway and a Myte AI key.");
+  return 0;
+}
+
+async function buildUpdatePayload(args, envPath, { dryRun = false, progress = null } = {}) {
+  const isDryRun = Boolean(dryRun);
+  const source = manifestUrl(args);
+  const manifestResult = await readManifest(source, {
+    fetchManifest: Boolean(args["fetch-manifest"]) || !isDryRun,
+    progress,
+  });
+  const manifest = manifestResult.manifest;
+  const artifact = manifest ? artifactForPlatform(manifest) : null;
+  const signature = manifest ? signatureAccepted(manifest, args) : { ok: false, signature: { status: "not-checked", verified: false } };
+  const artifactMetadata = manifest ? validateArtifactMetadata(artifact) : { status: "not-checked", ok: false };
+  const releaseAssets = manifest ? releaseAssetsForPlatform(manifest, artifact) : [];
+  const payload = {
+    ok: true,
+    dry_run: isDryRun,
+    would_write: !isDryRun,
+    ...commonStatus(args, envPath),
+    manifest: {
+      source,
+      read_status: manifestResult.status,
+      version: manifest && manifest.version ? manifest.version : null,
+      signature: signature.signature,
+      trusted_unsigned: Boolean(signature.trusted_unsigned),
+    },
+    artifact: artifactMetadata,
+    release_assets: releaseAssets.map((asset) => ({
+      name: asset.name || null,
+      install_path: asset.install_path,
+      url: asset.url || null,
+      format: asset.format || null,
+      sha256_present: Boolean(asset.sha256),
+    })),
+  };
+
+  if (!isDryRun) {
+    if (!manifest) {
+      throw new Error("Cannot install MyteCody engine without a readable release manifest.");
+    }
+    if (!signature.ok) {
+      throw new Error("MyteCody release manifest signature is not trusted.");
+    }
+    if (!artifactMetadata.ok) {
+      throw new Error(`MyteCody release artifact metadata is ${artifactMetadata.status}.`);
+    }
+    let installed;
+    let artifactDigest = String(artifact.sha256 || "");
+    let artifactSizeBytes = Number(artifact.size_bytes || 0);
+    const reusable = reusableInstalledArtifact(artifact);
+    if (reusable) {
+      if (progress) progress("reusing installed MyteCody engine");
+      installed = installManifestForReusableArtifact(reusable, manifest, artifact);
+      artifactSizeBytes = reusable.artifactSizeBytes;
+    } else {
+      const bytes = await readArtifactBytes(artifact, { progress });
+      artifactDigest = sha256Hex(bytes);
+      artifactSizeBytes = bytes.length;
+      if (artifactDigest.toLowerCase() !== String(artifact.sha256 || "").toLowerCase()) {
+        throw new Error(`Artifact SHA-256 mismatch: expected ${artifact.sha256}, got ${artifactDigest}`);
+      }
+      installed = installArtifactBytes(bytes, manifest, artifact);
+    }
+    const installedAssets = await installReleaseAssets(manifest, artifact, { progress });
+    if (installedAssets.length) {
+      installed.assets = installedAssets;
+      fs.writeFileSync(currentClientManifestPath(), JSON.stringify(installed, null, 2), "utf8");
+    }
+    payload.installed = {
+      ok: true,
+      version: installed.version,
+      executable: installed.executable,
+      sha256: artifactDigest,
+      size_bytes: artifactSizeBytes,
+      installed_sha256: installed.artifact.installed_sha256,
+      installed_size_bytes: installed.artifact.installed_size_bytes,
+      format: installed.artifact.format,
+      assets: installedAssets,
+    };
+    payload.release = {
+      ...payload.release,
+      client_installed: true,
+      client_version: installed.version,
+      engine_path: installed.executable,
+    };
+  }
+
+  return payload;
+}
+
+function autoInstallEnabled(args = {}) {
+  if (args["auto-update"] === false) return false;
+  if (process.env.MYTE_CODY_AUTO_UPDATE === "0") return false;
+  return true;
+}
+
+async function ensureBrandedEngineInstalled(args = {}, envPath = null, { progress = null } = {}) {
+  const updateArgs = {
+    ...args,
+    "fetch-manifest": true,
+  };
+  delete updateArgs["dry-run"];
+  delete updateArgs.json;
+
+  const source = manifestUrl(updateArgs);
+  let manifestResult;
+  try {
+    manifestResult = await readManifest(source, { fetchManifest: true, progress });
+  } catch (error) {
+    if (isUrl(source) && installedClientUsable()) {
+      return {
+        ok: true,
+        installed: false,
+        reason: "cached-engine-manifest-unavailable",
+        manifest_status: "fetch-failed",
+        error: error && error.message ? error.message : String(error),
+      };
+    }
+    throw error;
+  }
+  const manifest = manifestResult.manifest;
+  if (!manifest) {
+    if (isUrl(source) && installedClientUsable()) {
+      return {
+        ok: true,
+        installed: false,
+        reason: "cached-engine-manifest-unavailable",
+        manifest_status: manifestResult.status,
+      };
+    }
+    return { ok: false, installed: false, reason: "manifest-unavailable", manifest_status: manifestResult.status };
+  }
+  const signature = signatureAccepted(manifest, updateArgs);
+  if (!signature.ok) {
+    return { ok: false, installed: false, reason: "manifest-untrusted", signature: signature.signature };
+  }
+  const artifact = artifactForPlatform(manifest);
+  const artifactMetadata = validateArtifactMetadata(artifact);
+  if (!artifactMetadata.ok) {
+    return { ok: false, installed: false, reason: "artifact-metadata-invalid", artifact: artifactMetadata };
+  }
+  if (installedClientMatchesManifest(manifest, artifact)) {
+    return { ok: true, installed: false, reason: "already-current" };
+  }
+
+  if (!autoInstallEnabled(args)) {
+    return { ok: false, installed: false, reason: "update-required-auto-install-disabled" };
+  }
+
+  const payload = await buildUpdatePayload(updateArgs, envPath, { dryRun: false, progress });
+  return {
+    ok: Boolean(payload.installed && payload.installed.ok),
+    installed: Boolean(payload.installed && payload.installed.ok),
+    reason: "installed",
+    payload,
+  };
+}
+
+async function runUpdate(args, envPath) {
+  const dryRun = Boolean(args["dry-run"]);
+  const payload = await buildUpdatePayload(args, envPath, {
+    dryRun,
+    progress: args.json ? null : statusLine,
+  });
+
+  if (args.json) {
+    printJson(payload);
+    return 0;
+  }
+  console.log(dryRun ? "MYTE CODY update dry-run" : "MYTE CODY update");
+  console.log("scope: MyteCody engine only");
+  console.log(`manifest: ${payload.manifest.source}`);
+  console.log(`manifest read: ${payload.manifest.read_status}`);
+  console.log(`platform: ${payload.release.platform}`);
+  console.log(`install: ${payload.release.install_root}`);
+  console.log(`would write: ${payload.would_write}`);
+  if (payload.manifest.read_status !== "skipped") {
+    console.log(`version: ${payload.manifest.version || "unknown"}`);
+    console.log(`signature: ${payload.manifest.signature.status}`);
+    console.log(`artifact: ${payload.artifact.status}`);
+  } else {
+    console.log("manifest fetch skipped; pass --fetch-manifest to test the configured endpoint.");
+  }
+  if (payload.installed) {
+    console.log(`installed: ${payload.installed.executable}`);
+  }
+  console.log(`npm launcher/API tools: ${payload.package.update_command}`);
+  return 0;
+}
+
+async function run(argv = process.argv.slice(2)) {
+  const envPath = loadEnv();
+  const parsed = parseArgs(argv);
+  const command = argv[0] || "codex";
+  const restArgs = parseArgs(argv.slice(1));
+
+  if (command === "help" || command === "--help" || command === "-h") {
+    printHelp();
+    return 0;
+  }
+  if (command === "doctor") return runDoctor(restArgs, envPath);
+  if (command === "update") return runUpdate(restArgs, envPath);
+  if (command === "controller-sidecar") return runControllerSidecar();
+  if (command === "version" || command === "--version" || command === "-v") {
+    console.log(PACKAGE_VERSION);
+    return 0;
+  }
+
+  return runCodex(argv, parsed, envPath);
+}
+
+async function main() {
+  try {
+    const code = await run();
+    process.exitCode = code;
+  } catch (error) {
+    console.error(error && error.message ? error.message : error);
+    process.exitCode = 1;
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  checkPackageUpdate,
+  classifyMyteCodyInvocation,
+  codexLaunchArgs,
+  codexProviderArgs,
+  codyInferenceBase,
+  codyGatewayUrl,
+  currentBridgePath,
+  currentControllerPath,
+  currentClientManifestPath,
+  currentEnginePath,
+  ensureBrandedEngineInstalled,
+  gatewayRoot,
+  installedClientCommand,
+  isVersionNewer,
+  packageUpdateNotice,
+  resolveCodexCommand,
+  run,
+  sha256Hex,
+  stableJson,
+  tomlLiteralString,
+  verifyManifestSignature,
+  writeCodexConfig,
+};