@nolto/cli 0.5.0 → 0.6.1

package/dist/index.js

@@ -2,8 +2,8 @@
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import path8 from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import path12 from "path";
 import { CommanderError } from "commander";
 
 // src/config.ts
@@ -67,18 +67,9 @@ function isNetworkError(err) {
 }
 
 // src/constants.ts
-var PLAN_STATUSES = ["not_started", "in_progress", "done", "discarded"];
-var TEST_VERDICTS = ["passed", "failed", "skipped"];
-var REVIEW_VERDICTS = ["go", "no_go"];
-var PLAN_DOCUMENT_KINDS = ["plan", "final_report", "review_report", "test_report", "other"];
-var PLAN_TITLE_MAX = 500;
-var PLAN_CONTENT_MAX = 5e4;
-var PHASES_MAX = 50;
 var DOCUMENT_MAX_BYTES = 2 * 1024 * 1024;
-var DOCUMENT_FILENAME_MAX = 255;
 var DEFAULT_BASE_URL = "https://nolto.app";
 var CLI_USER_AGENT_NAME = "nolto-cli";
-var QUEUE_MAX_ENTRIES = 200;
 
 // src/config.ts
 var configSchema = z.object({
@@ -86,7 +77,10 @@ var configSchema = z.object({
   baseUrl: z.string().url().optional(),
   defaultProjectId: z.string().uuid().optional()
 }).strict();
-var repoBindingSchema = z.object({ projectId: z.string().uuid() }).passthrough();
+var repoBindingSchema = z.object({
+  projectId: z.string().uuid(),
+  roadmapSlug: z.string().regex(/^[a-z0-9][a-z0-9._-]*$/).optional()
+}).passthrough();
 async function loadRepoBinding(filePath) {
   let raw;
   try {
@@ -135,8 +129,7 @@ function findRepoBindingFile(args) {
   const startDir = cpd != null && cpd.length > 0 ? cpd : args.cwd;
   return findNoltoJsonSync(startDir);
 }
-async function writeRepoBinding(root, projectId) {
-  const filePath = path.join(root, "nolto.json");
+async function mergeJsonFile(filePath, patch) {
   let existing = {};
   try {
     const raw = await readFile(filePath, "utf8");
@@ -154,11 +147,17 @@ async function writeRepoBinding(root, projectId) {
     if (code !== "ENOENT") {
     }
   }
-  const merged = { ...existing, projectId };
+  const merged = { ...existing, ...patch };
   const { chmod } = await import("fs/promises");
   await writeFile(filePath, JSON.stringify(merged, null, 2) + "\n", { mode: 420 });
   await chmod(filePath, 420);
 }
+async function writeRepoBinding(root, projectId) {
+  await mergeJsonFile(path.join(root, "nolto.json"), { projectId });
+}
+async function writeRoadmapSlug(root, slug) {
+  await mergeJsonFile(path.join(root, "nolto.json"), { roadmapSlug: slug });
+}
 function getConfigDir(env) {
   const xdg = env["XDG_CONFIG_HOME"];
   const base = xdg != null && xdg.length > 0 ? xdg : path.join(os.homedir(), ".config");
@@ -273,80 +272,49 @@ function maskToken(token) {
   return "\u2026" + token.slice(-4);
 }
 
-// src/mcp.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-function buildMcpEndpoint(baseUrl) {
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return new URL(normalized + "/mcp");
-}
-function createMcpCaller(opts) {
-  const { baseUrl, token, version } = opts;
-  return {
-    async call(toolName, args) {
-      const capture = { lastNonOk: null };
-      const capturingFetch = async (input, init) => {
-        const res = await fetch(input, init);
-        if (!res.ok) {
-          capture.lastNonOk = {
-            status: res.status,
-            retryAfter: res.headers.get("retry-after") ?? void 0,
-            wwwAuthenticate: res.headers.get("www-authenticate") ?? void 0
-          };
-        }
-        return res;
-      };
-      const transport = new StreamableHTTPClientTransport(buildMcpEndpoint(baseUrl), {
-        requestInit: {
-          headers: { Authorization: `Bearer ${token}` }
-        },
-        fetch: capturingFetch
+// src/http.ts
+function createHttpClient(opts) {
+  const { baseUrl, version, token } = opts;
+  const base = baseUrl.replace(/\/+$/, "");
+  async function request(method, path13, body) {
+    if (!path13.startsWith("/api/")) {
+      throw new CliError(`HTTP client path must start with /api/, got: ${path13}`, 2);
+    }
+    const url = `${base}${path13}`;
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": `${CLI_USER_AGENT_NAME}/${version}`
+    };
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body)
       });
-      const client = new Client({ name: CLI_USER_AGENT_NAME, version });
-      try {
-        await client.connect(transport);
-        const result = await client.callTool({ name: toolName, arguments: args });
-        if (result.isError === true) {
-          const content2 = result.content;
-          const firstText = Array.isArray(content2) && content2.length > 0 ? content2[0]?.text : void 0;
-          throw new CliError(firstText ?? "Tool error", 1);
-        }
-        const content = result.content;
-        const firstItem = Array.isArray(content) && content.length > 0 ? content[0] : void 0;
-        const rawText = firstItem?.text;
-        if (rawText == null) {
-          return result;
-        }
-        try {
-          return JSON.parse(rawText);
-        } catch {
-          return rawText;
-        }
-      } catch (err) {
-        if (err instanceof CliError) {
-          throw err;
-        }
-        if (capture.lastNonOk != null) {
-          throw mapHttpStatusToCliError(
-            capture.lastNonOk.status,
-            capture.lastNonOk.retryAfter,
-            capture.lastNonOk.wwwAuthenticate
-          );
-        }
-        if (isNetworkError(err)) {
-          throw new CliError(`Cannot reach ${baseUrl}`, 5);
-        }
-        if (err instanceof Error && err.message) {
-          throw new CliError(err.message, 1);
-        }
-        throw new CliError(String(err), 1);
-      } finally {
-        try {
-          await client.close();
-        } catch {
-        }
+    } catch (err) {
+      if (isNetworkError(err)) {
+        throw new CliError(
+          `Network error contacting ${base}: ${err instanceof Error ? err.message : String(err)}`,
+          5
+        );
       }
+      throw err;
     }
+    if (!response.ok) {
+      const retryAfter = response.headers.get("retry-after") ?? void 0;
+      const wwwAuthenticate = response.headers.get("www-authenticate") ?? void 0;
+      throw mapHttpStatusToCliError(response.status, retryAfter, wwwAuthenticate);
+    }
+    return response.json();
+  }
+  return {
+    get: (p) => request("GET", p),
+    post: (p, b) => request("POST", p, b),
+    put: (p, b) => request("PUT", p, b)
   };
 }
 
@@ -356,466 +324,620 @@ import { Command } from "commander";
 // src/commands/init.ts
 import readline from "readline/promises";
 import { createRequire } from "module";
-import { fileURLToPath } from "url";
-import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import path6 from "path";
 import fs from "fs";
 
-// src/unwrap.ts
-function unwrapList(result, key) {
-  if (Array.isArray(result)) {
-    return result;
-  }
-  if (result != null && typeof result === "object") {
-    const inner = result[key];
-    if (Array.isArray(inner)) {
-      return inner;
+// src/commands/link.ts
+import path2 from "path";
+import { statSync as statSync2 } from "fs";
+
+// src/output.ts
+function printResult(value, mode2, opts = {}) {
+  const out = opts.stream ?? process.stdout;
+  if (mode2 === "json") {
+    out.write(JSON.stringify(value, null, 2) + "\n");
+  } else {
+    out.write(formatValue(value) + "\n");
+  }
+}
+function printError(err, mode2) {
+  if (mode2 === "json") {
+    const envelope = {
+      error: {
+        message: err.message,
+        exitCode: err.exitCode,
+        ...err.status != null ? { status: err.status } : {},
+        ...err.hint != null ? { hint: err.hint } : {}
+      }
+    };
+    process.stderr.write(JSON.stringify(envelope, null, 2) + "\n");
+  } else {
+    process.stderr.write(`Error: ${err.message}
+`);
+    if (err.hint != null) {
+      process.stderr.write(`Hint: ${err.hint}
+`);
     }
   }
-  return [];
+}
+function formatValue(value) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => formatValue(v)).join("\n");
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj);
+    const maxKeyLen = keys.reduce((m, k) => Math.max(m, k.length), 0);
+    return keys.map((k) => `${k.padEnd(maxKeyLen)}: ${formatValue(obj[k])}`).join("\n");
+  }
+  return JSON.stringify(value, null, 2);
 }
 
-// src/commands/init.ts
-var __dirname = path2.dirname(fileURLToPath(import.meta.url));
-var _require = createRequire(import.meta.url);
-function getCliVersion() {
-  const candidates = [
-    path2.resolve(__dirname, "../package.json"),
-    // bundled: dist/../package.json
-    path2.resolve(__dirname, "../../package.json")
-    // source:  src/commands/../../package.json
-  ];
-  for (const pkgPath of candidates) {
-    if (fs.existsSync(pkgPath)) {
-      try {
-        const pkg = _require(pkgPath);
-        return pkg.version ?? "0.0.0";
-      } catch {
-      }
+// src/commands/link.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function resolveStartDir(env, cwd) {
+  const cpd = env["CLAUDE_PROJECT_DIR"];
+  return cpd != null && cpd.length > 0 ? cpd : cwd;
+}
+function dirHasGit(dir) {
+  try {
+    statSync2(path2.join(dir, ".git"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findRepoRoot(startDir, hasGit = dirHasGit) {
+  let current = startDir;
+  while (true) {
+    if (hasGit(current)) {
+      return { root: current, foundGit: true };
     }
+    const parent = path2.dirname(current);
+    if (parent === current) break;
+    current = parent;
   }
-  return "0.0.0";
+  return { root: startDir, foundGit: false };
 }
-function register(program, deps) {
-  program.command("init").description("Interactive setup: configure token, base URL, and default project.").option("--force", "Overwrite existing config without prompting").action(async (opts) => {
-    const configPath = deps.configPath;
-    if (!opts.force) {
-      let existing = null;
-      try {
-        existing = await loadConfigFile(configPath);
-      } catch {
-      }
-      if (existing != null) {
-        const rl2 = readline.createInterface({ input: process.stdin, output: process.stdout });
-        try {
-          const answer = await rl2.question(`Config already exists at ${configPath}. Overwrite? [y/N] `);
-          if (answer.trim().toLowerCase() !== "y") {
-            process.stdout.write("Cancelled.\n");
-            return;
-          }
-        } finally {
-          rl2.close();
-        }
-      }
+async function handleShow(deps, projectBindingPath, mode2) {
+  if (projectBindingPath == null) {
+    if (mode2 === "json") {
+      printResult({ bound: false, projectBindingPath: null }, mode2);
+    } else {
+      process.stdout.write("No nolto.json binding found in this directory tree.\n");
     }
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    let token = "";
-    try {
-      const rawUrl = await rl.question(`Base URL [${DEFAULT_BASE_URL}]: `);
-      const baseUrl = rawUrl.trim() || DEFAULT_BASE_URL;
-      token = await promptHidden(rl, "API token: ");
-      if (token.length === 0) {
-        throw new CliError("Token is required.", 2);
-      }
-      const caller = createMcpCaller({ baseUrl, token, version: getCliVersion() });
-      let projects = [];
-      try {
-        const result = await caller.call("list_projects", {});
-        projects = unwrapList(result, "projects");
-      } catch (err) {
-        if (err instanceof CliError && err.exitCode === 3) {
-          throw new CliError(`Token rejected by ${baseUrl}`, 3, "Check that your token is valid and has not been revoked.");
-        }
-        throw err;
-      }
-      let defaultProjectId;
-      let defaultProjectName;
-      if (projects.length > 0) {
-        process.stdout.write("\nProjects:\n");
-        projects.forEach((p, i) => {
-          process.stdout.write(`  (${i + 1}) ${p.name} \u2014 ${p.id}
-`);
-        });
-        const pick = await rl.question("Default project number (or skip): ");
-        const num = parseInt(pick.trim(), 10);
-        if (!isNaN(num) && num >= 1 && num <= projects.length) {
-          defaultProjectId = projects[num - 1].id;
-          defaultProjectName = projects[num - 1].name;
-        }
-      }
-      await saveConfigFile(configPath, {
-        token,
-        baseUrl: baseUrl !== DEFAULT_BASE_URL ? baseUrl : void 0,
-        defaultProjectId
-      });
-      const projectDisplay = defaultProjectId != null ? `${defaultProjectName ?? ""} (${defaultProjectId})` : "not set";
-      process.stdout.write(`
-Saved ${configPath}
+    return;
+  }
+  const binding = await loadRepoBinding(projectBindingPath).catch((err) => {
+    if (err instanceof CliError) throw err;
+    throw new CliError(`Cannot read binding: ${String(err)}`, 2);
+  });
+  if (mode2 === "json") {
+    printResult({
+      bound: binding != null,
+      projectId: binding?.projectId ?? null,
+      projectBindingPath,
+      source: deps.settings.source.project === "repo" ? "repo" : "file"
+    }, mode2);
+  } else {
+    if (binding == null) {
+      process.stdout.write(`Binding file found at ${projectBindingPath} but could not be read.
 `);
-      process.stdout.write(`baseUrl:          ${baseUrl}
+    } else {
+      process.stdout.write(`Binding file : ${projectBindingPath}
 `);
-      process.stdout.write(`token:            ${maskToken(token)}  (verified)
+      process.stdout.write(`projectId    : ${binding.projectId}
 `);
-      process.stdout.write(`defaultProject:   ${projectDisplay}
+      const active = deps.settings.source.project === "repo" ? "repo (active)" : "repo (not active \u2014 overridden)";
+      process.stdout.write(`source       : ${active}
 `);
-    } finally {
-      rl.close();
     }
-  });
+  }
 }
-async function promptHidden(rl, prompt) {
-  const iface = rl;
-  const originalWrite = iface._writeToOutput?.bind(rl);
-  let muted = false;
-  iface._writeToOutput = (str) => {
-    if (muted) {
-      if (str !== "\r\n" && str !== "\n" && str !== "\r" && !str.startsWith("\x1B")) {
-        process.stdout.write("*");
-      } else {
-        originalWrite?.(str);
-      }
-      return;
+async function handleUnlink(projectBindingPath, mode2) {
+  const { readFile: readFile7, writeFile: writeFile6, chmod } = await import("fs/promises");
+  let existing = {};
+  try {
+    const raw = await readFile7(projectBindingPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new CliError(
+        `Cannot unlink ${projectBindingPath}: file contains valid JSON but is not a plain object (got ${Array.isArray(parsed) ? "array" : String(parsed)}). Remove or fix the file manually.`,
+        2
+      );
     }
-    originalWrite?.(str);
-  };
-  muted = true;
-  const value = await rl.question(prompt);
-  muted = false;
-  process.stdout.write("\n");
-  iface._writeToOutput = originalWrite;
-  return value;
-}
-
-// src/commands/login.ts
-import readline2 from "readline/promises";
-
-// src/http.ts
-function createHttpClient(opts) {
-  const { baseUrl, version, token } = opts;
-  const base = baseUrl.replace(/\/+$/, "");
-  return {
-    async post(path9, body) {
-      if (!path9.startsWith("/api/")) {
-        throw new CliError(`HTTP client path must start with /api/, got: ${path9}`, 2);
-      }
-      const url = `${base}${path9}`;
-      const headers = {
-        "Content-Type": "application/json",
-        "User-Agent": `${CLI_USER_AGENT_NAME}/${version}`
-      };
-      if (token) {
-        headers["Authorization"] = `Bearer ${token}`;
-      }
-      let response;
-      try {
-        response = await fetch(url, {
-          method: "POST",
-          headers,
-          body: JSON.stringify(body)
-        });
-      } catch (err) {
-        if (isNetworkError(err)) {
-          throw new CliError(
-            `Network error contacting ${base}: ${err instanceof Error ? err.message : String(err)}`,
-            5
-          );
-        }
-        throw err;
-      }
-      if (!response.ok) {
-        const retryAfter = response.headers.get("retry-after") ?? void 0;
-        const wwwAuthenticate = response.headers.get("www-authenticate") ?? void 0;
-        throw mapHttpStatusToCliError(response.status, retryAfter, wwwAuthenticate);
-      }
-      return response.json();
-    }
-  };
+    existing = parsed;
+  } catch (err) {
+    if (err instanceof CliError) throw err;
+    throw new CliError(`Cannot read ${projectBindingPath}: ${String(err)}`, 2);
+  }
+  const { projectId: _removed, ...rest } = existing;
+  void _removed;
+  await writeFile6(projectBindingPath, JSON.stringify(rest, null, 2) + "\n", { mode: 420 });
+  await chmod(projectBindingPath, 420);
+  if (mode2 === "json") {
+    printResult({ unlinked: true, projectBindingPath }, mode2);
+  } else {
+    process.stdout.write(`Removed projectId from ${projectBindingPath}.
+`);
+  }
 }
-
-// src/login-poll.ts
-async function pollUntilToken(opts) {
-  const { http, deviceCode, expiresIn, baseUrl } = opts;
-  let intervalSeconds = opts.intervalSeconds;
-  const deadline = Date.now() + expiresIn * 1e3;
-  await sleep(intervalSeconds * 1e3);
-  while (Date.now() < deadline) {
-    let resp;
+async function performLink(deps, projectId, mode2) {
+  if (!UUID_RE.test(projectId)) {
+    throw new CliError(
+      `Invalid project ID: "${projectId}". Must be a UUID (e.g. 00000000-0000-0000-0000-000000000001).`,
+      2
+    );
+  }
+  const startDir = resolveStartDir(process.env, process.cwd());
+  const { root, foundGit } = findRepoRoot(startDir);
+  if (!foundGit) {
+    process.stderr.write(
+      `Warning: no .git directory found above ${startDir}. Writing nolto.json to current directory.
+`
+    );
+  }
+  if (deps.settings.token != null) {
     try {
-      resp = await http.post("/api/cli/auth/poll", {
-        device_code: deviceCode
+      const http = deps.http ?? createHttpClient({
+        baseUrl: deps.settings.baseUrl,
+        token: deps.settings.token,
+        version: deps.version
       });
-    } catch (err) {
-      if (err instanceof CliError && err.exitCode === 4) {
-        await sleep(intervalSeconds * 1e3);
-        continue;
+      const result = await http.get(
+        "/api/projects"
+      );
+      const projects = Array.isArray(result.projects) ? result.projects : [];
+      if (!projects.some((p) => p.id === projectId)) {
+        process.stderr.write(
+          `Warning: project ${projectId} was not found in GET /api/projects.
+Proceeding anyway \u2014 verify the ID is correct.
+`
+        );
       }
-      throw err;
+    } catch {
+      process.stderr.write(
+        "Warning: could not verify project membership (offline or token issue). Proceeding anyway.\n"
+      );
     }
-    if (!resp.error) {
-      if (!resp.token) {
-        throw new CliError("Server returned success but no token.", 5);
+  }
+  await writeRepoBinding(root, projectId);
+  const writtenPath = path2.join(root, "nolto.json");
+  if (mode2 === "json") {
+    printResult({ linked: true, projectId, projectBindingPath: writtenPath }, mode2);
+  } else {
+    process.stdout.write(
+      `Linked this repo to project ${projectId} (wrote ${writtenPath}).
+Commit nolto.json to share the binding with your team.
+`
+    );
+  }
+}
+function register(program, deps) {
+  const cmd = program.command("link [projectId]").description(
+    "Bind this repository to a Nolto project.\nWrites nolto.json at the repo root. Commit it to share the binding with your team.\n\nExamples:\n  nolto link <uuid>      Write / update nolto.json\n  nolto link --show      Show the current binding\n  nolto link --unlink    Remove the projectId from nolto.json"
+  ).option("--show", "Show the current repo binding (path + projectId + source)").option("--unlink", "Remove the projectId key from nolto.json");
+  cmd.action(async (projectId) => {
+    const { output } = deps;
+    const projectBindingPath = deps.projectBindingPath ?? null;
+    const mode2 = output.mode;
+    if (cmd.opts()["show"]) {
+      await handleShow(deps, projectBindingPath, mode2);
+      return;
+    }
+    if (cmd.opts()["unlink"]) {
+      if (projectBindingPath == null) {
+        throw new CliError("No nolto.json found in this directory tree. Nothing to unlink.", 2);
       }
-      return resp.token;
+      await handleUnlink(projectBindingPath, mode2);
+      return;
     }
-    switch (resp.error) {
-      case "authorization_pending":
-        await sleep(intervalSeconds * 1e3);
-        break;
-      case "slow_down":
-        intervalSeconds += 5;
-        await sleep(intervalSeconds * 1e3);
-        break;
-      case "expired_token":
-        throw new CliError("Device code expired. Run `nolto login` again.", 2);
-      case "access_denied":
-        throw new CliError("\u30ED\u30B0\u30A4\u30F3\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F\u3002", 3);
-      case "token_cap_exceeded":
-        throw new CliError(
-          `\u30A2\u30AF\u30C6\u30A3\u30D6\u306A API token \u304C\u4E0A\u9650(20)\u3067\u3059\u3002${baseUrl}/settings/tokens \u3067\u4E0D\u8981\u306A\u30C8\u30FC\u30AF\u30F3\u3092\u5931\u52B9\u3057\u3066\u304B\u3089\u518D\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002`,
-          2
-        );
-      default:
-        throw new CliError(`Unexpected poll response: ${resp.error}`, 5);
+    if (projectId == null || projectId.trim().length === 0) {
+      throw new CliError(
+        "Usage: nolto link <projectId>  (provide a UUID)\nOr use --show to view the current binding, --unlink to remove it.",
+        2
+      );
     }
-  }
-  throw new CliError("Login timed out. Run `nolto login` again.", 2);
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+    await performLink(deps, projectId, mode2);
+  });
 }
 
-// src/client-inject.ts
-import { readFile as readFile2, writeFile as writeFile2, rename, mkdir as mkdir2, unlink } from "fs/promises";
-import { execFile } from "child_process";
-import { promisify } from "util";
-import os2 from "os";
+// src/skill-install.ts
+import { cp, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, rm } from "fs/promises";
+import { existsSync } from "fs";
 import path3 from "path";
-function getExecFileAsync() {
-  return promisify(execFile);
-}
-async function atomicWrite(filePath, content, mode2) {
-  const dir = path3.dirname(filePath);
-  await mkdir2(dir, { recursive: true, mode: 448 });
-  const tmp = `${filePath}.tmp.${Date.now()}`;
-  try {
-    await writeFile2(tmp, content, { mode: mode2 });
-    await rename(tmp, filePath);
-  } catch (err) {
-    await unlink(tmp).catch(() => void 0);
-    throw err;
-  }
-}
-async function readJsonConfig(filePath) {
-  try {
-    const raw = await readFile2(filePath, "utf8");
-    const parsed = JSON.parse(raw);
-    return { parsed, raw };
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") return null;
-    return null;
-  }
-}
-async function injectCursor(opts) {
-  const configDir = opts.cursorConfigDir ?? process.env["CURSOR_CONFIG_DIR"] ?? path3.join(os2.homedir(), ".cursor");
-  const configPath = path3.join(configDir, "mcp.json");
-  const mcpUrl = `${opts.baseUrl.replace(/\/+$/, "")}/mcp`;
-  let existing = {};
-  const raw = await readFile2(configPath, "utf8").catch((err) => {
-    if (err.code === "ENOENT") return null;
-    return null;
-  });
-  if (raw !== null) {
+import { fileURLToPath } from "url";
+var __dirname = path3.dirname(fileURLToPath(import.meta.url));
+function resolveSkillSourceDir() {
+  const candidates = [
+    path3.resolve(__dirname, "skill/roadmap-progress"),
+    // bundled: dist/skill/...
+    path3.resolve(__dirname, "../../../skills/roadmap-progress")
+    // source:  <repo>/skills/...
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(path3.join(candidate, "SKILL.md"))) return candidate;
+  }
+  throw new Error("Bundled roadmap-progress skill not found. Reinstall @nolto/cli.");
+}
+var VERSION_MARKER = ".nolto-skill-version";
+async function installSkill(args) {
+  const targetDir = path3.join(args.skillsParentDir, "roadmap-progress");
+  const markerPath = path3.join(targetDir, VERSION_MARKER);
+  const dirExists = existsSync(targetDir);
+  let installedVersion = null;
+  if (dirExists) {
     try {
-      existing = JSON.parse(raw);
+      installedVersion = (await readFile2(markerPath, "utf8")).trim();
     } catch {
-      const backupPath = `${configPath}.bak.${Date.now()}`;
-      process.stdout.write(
-        `Warning: ${configPath} contains invalid JSON. Backing up to ${backupPath}
-`
-      );
-      await writeFile2(backupPath, raw, { mode: 384 }).catch(() => void 0);
-      existing = {};
+      installedVersion = null;
     }
   }
-  const updatedServers = {
-    ...existing.mcpServers,
-    nolto: {
-      url: mcpUrl,
-      headers: {
-        Authorization: `Bearer ${opts.token}`
-      }
-    }
-  };
-  const newConfig = {
-    ...existing,
-    mcpServers: updatedServers
-  };
-  await atomicWrite(configPath, JSON.stringify(newConfig, null, 2) + "\n", 384);
-  process.stdout.write(`Updated ${configPath} (cursor)
-`);
-}
-async function injectClaude(opts) {
-  const mcpUrl = `${opts.baseUrl.replace(/\/+$/, "")}/mcp`;
-  const claudePath = await findOnPath("claude");
-  if (claudePath) {
-    const execFileAsync2 = getExecFileAsync();
-    await execFileAsync2(claudePath, ["mcp", "remove", "nolto", "--scope", "user"]).catch(
-      () => void 0
-    );
-    try {
-      const { stderr } = await execFileAsync2(claudePath, [
-        "mcp",
-        "add",
-        "nolto",
-        mcpUrl,
-        "--transport",
-        "http",
-        "--scope",
-        "user",
-        "--header",
-        `Authorization: Bearer ${opts.token}`
-      ]);
-      if (stderr) {
-        process.stderr.write(`[claude mcp add] ${stderr}
-`);
-      }
-      process.stdout.write("Registered nolto MCP server in Claude Code (user scope).\n");
-      process.stdout.write("Reconnect or restart Claude Code to use it.\n");
-      return;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        `Warning: claude mcp add failed (${msg}); writing project .mcp.json instead.
-`
-      );
-    }
+  if (dirExists && installedVersion === args.version && args.force !== true) {
+    return { action: "skipped", targetDir };
   }
-  const cwd = opts.claudeCwd ?? process.cwd();
-  const configPath = path3.join(cwd, ".mcp.json");
-  const result = await readJsonConfig(configPath);
-  const existing = result?.parsed ?? {};
-  const updatedServers = {
-    ...existing.mcpServers,
-    nolto: {
-      url: mcpUrl,
-      headers: {
-        Authorization: "Bearer ${NOLTO_MCP_TOKEN}"
-      }
-    }
-  };
-  const newConfig = {
-    ...existing,
-    mcpServers: updatedServers
-  };
-  await atomicWrite(configPath, JSON.stringify(newConfig, null, 2) + "\n", 384);
-  const tokensUrl = `${opts.baseUrl.replace(/\/+$/, "")}/settings/tokens`;
-  process.stdout.write(
-    `Updated ${configPath} (claude project .mcp.json) \u2014 uses the NOLTO_MCP_TOKEN env var; no token is stored in the file, so it is safe to commit.
-`
-  );
-  process.stdout.write("Set NOLTO_MCP_TOKEN in your environment before launching Claude Code, e.g.:\n");
-  process.stdout.write("  export NOLTO_MCP_TOKEN=<your token>\n");
-  process.stdout.write(`Your token is saved in your nolto config (from this login); or create one at ${tokensUrl}
-`);
+  await rm(targetDir, { recursive: true, force: true });
+  await mkdir2(args.skillsParentDir, { recursive: true });
+  await cp(args.sourceDir, targetDir, { recursive: true });
+  await writeFile2(markerPath, args.version + "\n", "utf8");
+  return { action: dirExists ? "updated" : "installed", targetDir };
 }
-async function injectCodex(opts) {
-  const mcpUrl = `${opts.baseUrl.replace(/\/+$/, "")}/mcp`;
-  const codexPath = await findOnPath("codex");
-  if (!codexPath) {
-    process.stdout.write(
-      `
-To add Nolto to Codex, run:
-
-  codex mcp add nolto --url ${mcpUrl} --bearer-token-env-var NOLTO_TOKEN
 
-Then set NOLTO_TOKEN=${opts.token} in your environment.
-`
-    );
-    return;
-  }
+// src/registry.ts
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
+import path4 from "path";
+import { z as z2 } from "zod";
+var registrySchema = z2.object({
+  schemaVersion: z2.literal(1),
+  repos: z2.array(z2.object({ root: z2.string().min(1) }).passthrough())
+}).passthrough();
+function getRegistryPath(env) {
+  return path4.join(getConfigDir(env), "registry.json");
+}
+async function loadRegistry(filePath) {
+  let raw;
   try {
-    const execFileAsync2 = getExecFileAsync();
-    const { stderr } = await execFileAsync2(codexPath, [
-      "mcp",
-      "add",
-      "nolto",
-      "--url",
-      mcpUrl,
-      "--bearer-token-env-var",
-      "NOLTO_TOKEN"
-    ]);
-    if (stderr) {
-      process.stderr.write(`[codex mcp add] ${stderr}
-`);
-    }
-    process.stdout.write(`Registered nolto MCP server in Codex.
-`);
-    process.stdout.write(
-      `Set NOLTO_TOKEN=${opts.token.slice(0, 8)}... in your environment (or shell profile).
-`
-    );
+    raw = await readFile3(filePath, "utf8");
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new CliError(`codex mcp add failed: ${msg}`, 5);
+    const code = err != null && typeof err === "object" && "code" in err ? err.code : "";
+    if (code === "ENOENT") {
+      return { schemaVersion: 1, repos: [] };
+    }
+    throw new CliError(`Cannot read registry: ${filePath}: ${String(err)}`, 2);
   }
-}
-async function findOnPath(bin) {
+  let parsed;
   try {
-    const execFileAsync2 = getExecFileAsync();
-    const { stdout } = await execFileAsync2(
-      process.platform === "win32" ? "where" : "which",
-      [bin]
-    );
-    const found = stdout.trim().split("\n")[0]?.trim();
-    return found && found.length > 0 ? found : null;
+    parsed = JSON.parse(raw);
   } catch {
-    return null;
-  }
-}
-async function injectClient(opts) {
-  switch (opts.client) {
-    case "cursor":
-      return injectCursor(opts);
-    case "claude":
-      return injectClaude(opts);
-    case "codex":
-      return injectCodex(opts);
-    default: {
-      const _never = opts.client;
-      throw new CliError(`Unknown client: ${String(_never)}`, 2);
-    }
+    throw new CliError(`Malformed JSON in ${filePath}. Fix or remove the file.`, 2);
+  }
+  const result = registrySchema.safeParse(parsed);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    const fieldPath = issue?.path.join(".") ?? "";
+    throw new CliError(
+      `Invalid registry at ${filePath}: ${fieldPath.length > 0 ? `field "${fieldPath}" \u2014 ` : ""}${issue?.message ?? "validation failed"}`,
+      2
+    );
+  }
+  return result.data;
+}
+async function addRepoToRegistry(filePath, repoRoot) {
+  const registry = await loadRegistry(filePath);
+  if (registry.repos.some((repo) => repo.root === repoRoot)) {
+    return { added: false, registry };
   }
+  const updated = { ...registry, repos: [...registry.repos, { root: repoRoot }] };
+  await mkdir3(path4.dirname(filePath), { recursive: true, mode: 448 });
+  await writeFile3(filePath, JSON.stringify(updated, null, 2) + "\n", "utf8");
+  return { added: true, registry: updated };
 }
 
-// src/commands/login.ts
+// src/roadmap-scaffold.ts
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path5 from "path";
+function slugifyProjectId(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9.-]+/g, "-").replace(/^[^a-z0-9]+/, "").replace(/[-_.]+$/, "");
+  return slug.length > 0 ? slug : "project";
+}
+async function scaffoldRoadmap(args) {
+  const dir = path5.join(args.repoRoot, ".roadmap");
+  const filePath = path5.join(dir, "roadmap.json");
+  if (existsSync2(filePath)) {
+    return { created: false, path: filePath };
+  }
+  const repoBasename = path5.basename(args.repoRoot);
+  const roadmap = {
+    schemaVersion: 2,
+    project: {
+      id: slugifyProjectId(repoBasename),
+      name: args.projectName,
+      repository: repoBasename
+    },
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    currentTaskId: null,
+    summary: "",
+    phases: []
+  };
+  await mkdir4(dir, { recursive: true });
+  await writeFile4(filePath, JSON.stringify(roadmap, null, 2) + "\n", "utf8");
+  return { created: true, path: filePath };
+}
+
+// src/commands/init.ts
+var __dirname2 = path6.dirname(fileURLToPath2(import.meta.url));
+var _require = createRequire(import.meta.url);
+function getCliVersion() {
+  const candidates = [
+    path6.resolve(__dirname2, "../package.json"),
+    // bundled: dist/../package.json
+    path6.resolve(__dirname2, "../../package.json")
+    // source:  src/commands/../../package.json
+  ];
+  for (const pkgPath of candidates) {
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = _require(pkgPath);
+        return pkg.version ?? "0.0.0";
+      } catch {
+      }
+    }
+  }
+  return "0.0.0";
+}
 function register2(program, deps) {
-  program.command("login").description("Authenticate via browser and save an API token to the config file.").option("--client <name>", "Inject token into MCP client config (cursor|claude|codex)").option("--force", "Overwrite existing token without prompting").action(
-    async (opts) => {
-      const { configPath, settings, output } = deps;
-      const validClients = ["cursor", "claude", "codex"];
-      if (opts.client !== void 0 && !validClients.includes(opts.client)) {
-        throw new CliError(
-          `--client must be one of: ${validClients.join(", ")}. Got: ${opts.client}`,
-          2
-        );
+  program.command("init").description("Interactive setup: configure token, base URL, and default project.").option("--force", "Overwrite existing config without prompting").action(async (opts) => {
+    const configPath = deps.configPath;
+    if (!opts.force) {
+      let existing = null;
+      try {
+        existing = await loadConfigFile(configPath);
+      } catch {
       }
-      const clientTarget = opts.client;
-      if (!opts.force) {
-        let existing = null;
+      if (existing != null) {
+        const rl2 = readline.createInterface({ input: process.stdin, output: process.stdout });
         try {
-          existing = await loadConfigFile(configPath);
-        } catch {
-        }
+          const answer = await rl2.question(`Config already exists at ${configPath}. Overwrite? [y/N] `);
+          if (answer.trim().toLowerCase() !== "y") {
+            process.stdout.write("Cancelled.\n");
+            return;
+          }
+        } finally {
+          rl2.close();
+        }
+      }
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    let token = "";
+    try {
+      const rawUrl = await rl.question(`Base URL [${DEFAULT_BASE_URL}]: `);
+      const baseUrl = rawUrl.trim() || DEFAULT_BASE_URL;
+      const currentToken = deps.settings.token;
+      const tokenPrompt = currentToken != null ? "API token [press Enter to keep current token]: " : "API token: ";
+      const enteredToken = await promptHidden(rl, tokenPrompt);
+      token = enteredToken.length > 0 ? enteredToken : currentToken ?? "";
+      if (token.length === 0) {
+        throw new CliError("Token is required.", 2);
+      }
+      const http = createHttpClient({
+        baseUrl,
+        token,
+        version: getCliVersion()
+      });
+      let projects = [];
+      try {
+        const result = await http.get("/api/projects");
+        projects = Array.isArray(result.projects) ? result.projects : [];
+      } catch (err) {
+        if (err instanceof CliError && err.exitCode === 3) {
+          throw new CliError(`Token rejected by ${baseUrl}`, 3, "Check that your token is valid and has not been revoked.");
+        }
+        throw err;
+      }
+      let defaultProjectId;
+      let defaultProjectName;
+      if (projects.length > 0) {
+        process.stdout.write("\nProjects:\n");
+        projects.forEach((p, i) => {
+          process.stdout.write(`  (${i + 1}) ${p.name} \u2014 ${p.id}
+`);
+        });
+      } else {
+        process.stdout.write("\nNo projects yet.\n");
+      }
+      const pick = await rl.question("Default project number, 'c' to create new (or Enter to skip): ");
+      const trimmedPick = pick.trim().toLowerCase();
+      if (trimmedPick === "c") {
+        const name = await rl.question("New project name: ");
+        if (name.trim().length === 0) {
+          throw new CliError("Project name is required.", 2);
+        }
+        const created = await http.post(
+          "/api/projects",
+          { name: name.trim() }
+        );
+        if (created.project?.id == null) {
+          throw new CliError("Project API did not return a project id.", 2);
+        }
+        defaultProjectId = created.project.id;
+        defaultProjectName = created.project.name ?? name.trim();
+        process.stdout.write(`Created project ${defaultProjectName} (${defaultProjectId})
+`);
+      } else {
+        const num = parseInt(trimmedPick, 10);
+        if (!isNaN(num) && num >= 1 && num <= projects.length) {
+          defaultProjectId = projects[num - 1].id;
+          defaultProjectName = projects[num - 1].name;
+        }
+      }
+      await saveConfigFile(configPath, {
+        token,
+        baseUrl: baseUrl !== DEFAULT_BASE_URL ? baseUrl : void 0,
+        defaultProjectId
+      });
+      const projectDisplay = defaultProjectId != null ? `${defaultProjectName ?? ""} (${defaultProjectId})` : "not set";
+      process.stdout.write(`
+Saved ${configPath}
+`);
+      process.stdout.write(`baseUrl:          ${baseUrl}
+`);
+      process.stdout.write(`token:            ${maskToken(token)}  (verified)
+`);
+      process.stdout.write(`defaultProject:   ${projectDisplay}
+`);
+      if (defaultProjectId != null) {
+        const startDir = resolveStartDir(process.env, process.cwd());
+        const { root, foundGit } = findRepoRoot(startDir);
+        if (foundGit) {
+          const setup = await rl.question(`
+Set up this repository (${root}) for roadmap sync? [Y/n] `);
+          if (setup.trim().toLowerCase() !== "n") {
+            await writeRepoBinding(root, defaultProjectId);
+            process.stdout.write(`binding:        wrote ${path6.join(root, "nolto.json")}
+`);
+            const sourceDir = resolveSkillSourceDir();
+            const version = getCliVersion();
+            const claudeInstall = await installSkill({
+              skillsParentDir: path6.join(root, ".claude", "skills"),
+              sourceDir,
+              version
+            });
+            process.stdout.write(`skill (claude): ${claudeInstall.action} ${claudeInstall.targetDir}
+`);
+            if (fs.existsSync(path6.join(root, ".agents")) || fs.existsSync(path6.join(root, ".codex"))) {
+              const agentsInstall = await installSkill({
+                skillsParentDir: path6.join(root, ".agents", "skills"),
+                sourceDir,
+                version
+              });
+              process.stdout.write(`skill (agents): ${agentsInstall.action} ${agentsInstall.targetDir}
+`);
+            }
+            const scaffold = await scaffoldRoadmap({
+              repoRoot: root,
+              projectName: defaultProjectName ?? path6.basename(root)
+            });
+            process.stdout.write(
+              scaffold.created ? `roadmap:        created ${scaffold.path}
+` : `roadmap:        exists ${scaffold.path}
+`
+            );
+            const registryResult = await addRepoToRegistry(getRegistryPath(process.env), root);
+            process.stdout.write(
+              registryResult.added ? `watch registry: added ${root}
+` : `watch registry: already registered
+`
+            );
+          }
+        } else {
+          process.stdout.write("\nNo git repository found here \u2014 skipped repo setup. Run `nolto init` inside a repo to set up roadmap sync.\n");
+        }
+      }
+    } finally {
+      rl.close();
+    }
+  });
+}
+async function promptHidden(rl, prompt) {
+  const iface = rl;
+  const originalWrite = iface._writeToOutput?.bind(rl);
+  let muted = false;
+  iface._writeToOutput = (str) => {
+    if (muted) {
+      if (str !== "\r\n" && str !== "\n" && str !== "\r" && !str.startsWith("\x1B")) {
+        process.stdout.write("*");
+      } else {
+        originalWrite?.(str);
+      }
+      return;
+    }
+    originalWrite?.(str);
+  };
+  muted = true;
+  const value = await rl.question(prompt);
+  muted = false;
+  process.stdout.write("\n");
+  iface._writeToOutput = originalWrite;
+  return value;
+}
+
+// src/commands/login.ts
+import readline2 from "readline/promises";
+
+// src/login-poll.ts
+async function pollUntilToken(opts) {
+  const { http, deviceCode, expiresIn, baseUrl } = opts;
+  let intervalSeconds = opts.intervalSeconds;
+  const deadline = Date.now() + expiresIn * 1e3;
+  await sleep(intervalSeconds * 1e3);
+  while (Date.now() < deadline) {
+    let resp;
+    try {
+      resp = await http.post("/api/cli/auth/poll", {
+        device_code: deviceCode
+      });
+    } catch (err) {
+      if (err instanceof CliError && err.exitCode === 4) {
+        await sleep(intervalSeconds * 1e3);
+        continue;
+      }
+      throw err;
+    }
+    if (!resp.error) {
+      if (!resp.token) {
+        throw new CliError("Server returned success but no token.", 5);
+      }
+      return resp.token;
+    }
+    switch (resp.error) {
+      case "authorization_pending":
+        await sleep(intervalSeconds * 1e3);
+        break;
+      case "slow_down":
+        intervalSeconds += 5;
+        await sleep(intervalSeconds * 1e3);
+        break;
+      case "expired_token":
+        throw new CliError("Device code expired. Run `nolto login` again.", 2);
+      case "access_denied":
+        throw new CliError("\u30ED\u30B0\u30A4\u30F3\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F\u3002", 3);
+      case "token_cap_exceeded":
+        throw new CliError(
+          `\u30A2\u30AF\u30C6\u30A3\u30D6\u306A API token \u304C\u4E0A\u9650(20)\u3067\u3059\u3002${baseUrl}/settings/tokens \u3067\u4E0D\u8981\u306A\u30C8\u30FC\u30AF\u30F3\u3092\u5931\u52B9\u3057\u3066\u304B\u3089\u518D\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002`,
+          2
+        );
+      default:
+        throw new CliError(`Unexpected poll response: ${resp.error}`, 5);
+    }
+  }
+  throw new CliError("Login timed out. Run `nolto login` again.", 2);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/commands/login.ts
+function register3(program, deps) {
+  program.command("login").description("Authenticate via browser and save an API token to the config file.").option("--force", "Overwrite existing token without prompting").action(
+    async (opts) => {
+      const { configPath, settings, output } = deps;
+      if (!opts.force) {
+        let existing = null;
+        try {
+          existing = await loadConfigFile(configPath);
+        } catch {
+        }
         if (existing?.token) {
           const rl = readline2.createInterface({
             input: process.stdin,
@@ -883,103 +1005,25 @@ function register2(program, deps) {
         process.stdout.write(`token: ${maskToken(token)}
 `);
       }
-      if (clientTarget) {
-        try {
-          await injectClient({
-            client: clientTarget,
-            token,
-            baseUrl: settings.baseUrl
-          });
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          process.stderr.write(
-            `Warning: failed to inject into ${clientTarget} config: ${msg}
-`
-          );
-        }
-      }
     }
   );
 }
 
-// src/output.ts
-function printResult(value, mode2, opts = {}) {
-  const out = opts.stream ?? process.stdout;
-  if (mode2 === "json") {
-    out.write(JSON.stringify(value, null, 2) + "\n");
-  } else {
-    out.write(formatValue(value) + "\n");
-  }
-}
-function printError(err, mode2) {
-  if (mode2 === "json") {
-    const envelope = {
-      error: {
-        message: err.message,
-        exitCode: err.exitCode,
-        ...err.status != null ? { status: err.status } : {},
-        ...err.hint != null ? { hint: err.hint } : {}
-      }
-    };
-    process.stderr.write(JSON.stringify(envelope, null, 2) + "\n");
-  } else {
-    process.stderr.write(`Error: ${err.message}
-`);
-    if (err.hint != null) {
-      process.stderr.write(`Hint: ${err.hint}
-`);
-    }
-  }
-}
-function formatTable(rows, columns) {
-  if (rows.length === 0) {
-    return "(empty)";
-  }
-  const maxKeyLen = columns.reduce((m, c) => Math.max(m, c.length), 0);
-  return rows.map(
-    (row) => columns.map((col) => {
-      const val = row[col] ?? "";
-      return `  ${col.padEnd(maxKeyLen)}: ${val}`;
-    }).join("\n")
-  ).join("\n\n");
-}
-function formatRecord(record) {
-  const keys = Object.keys(record);
-  const maxKeyLen = keys.reduce((m, k) => Math.max(m, k.length), 0);
-  return keys.map((k) => `${k.padEnd(maxKeyLen)}: ${record[k] ?? ""}`).join("\n");
-}
-function formatValue(value) {
-  if (value === null || value === void 0) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value);
-  }
-  if (Array.isArray(value)) {
-    return value.map((v) => formatValue(v)).join("\n");
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj);
-    const maxKeyLen = keys.reduce((m, k) => Math.max(m, k.length), 0);
-    return keys.map((k) => `${k.padEnd(maxKeyLen)}: ${formatValue(obj[k])}`).join("\n");
-  }
-  return JSON.stringify(value, null, 2);
-}
-
 // src/commands/whoami.ts
-function register3(program, deps) {
+function register4(program, deps) {
   program.command("whoami").description("Show the current authentication and configuration state.").action(async () => {
     const { settings, output, configPath } = deps;
     const mode2 = output.mode;
     let projectCount;
     if (settings.token != null) {
       try {
-        const result = await deps.caller.call("list_projects", {});
-        projectCount = unwrapList(result, "projects").length;
+        const http = deps.http ?? createHttpClient({
+          baseUrl: settings.baseUrl,
+          token: settings.token,
+          version: deps.version
+        });
+        const result = await http.get("/api/projects");
+        projectCount = Array.isArray(result.projects) ? result.projects.length : 0;
       } catch {
       }
     }
@@ -1018,1087 +1062,469 @@ function register3(program, deps) {
   });
 }
 
-// src/commands/project.ts
-function assertToken(token) {
-  if (token == null) {
-    throw new CliError(
-      "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-      3
-    );
-  }
-}
-function register4(program, deps) {
-  const project = program.command("project").description("Manage projects.");
-  project.command("list").description("List all projects.").action(async () => {
-    assertToken(deps.settings.token);
-    const result = await deps.caller.call("list_projects", {});
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const rows = unwrapList(result, "projects");
-    const defaultId = deps.settings.defaultProjectId;
-    const tableRows = rows.map((p) => ({
-      id: p.id ?? "",
-      name: p.name ?? "",
-      role: p.role ?? "",
-      default: p.id === defaultId ? "yes" : ""
-    }));
-    process.stdout.write(formatTable(tableRows, ["id", "name", "role", "default"]) + "\n");
-  });
-  project.command("register <name>").description("Register a new project.").option("--description <text>", "Project description").option("--repository-url <url>", "Repository URL").action(async (name, opts) => {
-    assertToken(deps.settings.token);
-    const args = { name };
-    if (opts.description != null) args["description"] = opts.description;
-    if (opts.repositoryUrl != null) args["repositoryUrl"] = opts.repositoryUrl;
-    const result = await deps.caller.call("register_project", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const r = result;
-    const id = r?.id ?? "";
-    const registeredName = r?.name ?? name;
-    process.stdout.write(`Registered ${registeredName} (${id})
-`);
-  });
-  project.command("set-default <projectId>").description("Set the default project.").option("--local", "Write to local config file only (no MCP call)").action(async (projectId, opts) => {
-    if (opts.local) {
-      const existing = await loadConfigFile(deps.configPath).catch(() => null);
-      await saveConfigFile(deps.configPath, { ...existing ?? {}, defaultProjectId: projectId });
-    } else {
-      assertToken(deps.settings.token);
-      await deps.caller.call("set_default_project", { projectId });
-    }
-    process.stdout.write(`Default project set to ${projectId}.
-`);
-  });
-}
-
-// src/commands/plan-register.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-import { z as z2 } from "zod";
+// src/commands/sync.ts
+import { readFile as readFile4 } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
 
-// src/fsx.ts
-import { readFile as readFile3, stat as stat2 } from "fs/promises";
-import path4 from "path";
-async function readPlanFile(filePath) {
-  const absPath = path4.resolve(filePath);
-  let content;
-  try {
-    content = await readFile3(absPath, "utf8");
-  } catch (err) {
-    const code = err != null && typeof err === "object" && "code" in err ? err.code : "";
-    if (code === "ENOENT") {
-      throw new CliError(`File not found: ${absPath}`, 2);
-    }
-    throw new CliError(`Cannot read file: ${absPath}: ${String(err)}`, 2);
-  }
-  const trimmed = content.trim();
-  if (trimmed.length === 0) {
-    throw new CliError(`Plan file is empty: ${absPath}`, 2);
-  }
-  if (trimmed.length > PLAN_CONTENT_MAX) {
-    throw new CliError(
-      `Plan file exceeds ${PLAN_CONTENT_MAX} characters (${trimmed.length}): ${absPath}`,
-      2
-    );
-  }
-  const stem = path4.basename(absPath, path4.extname(absPath));
-  return { content: trimmed, sourcePath: absPath, titleFallback: stem };
-}
-async function readDocFile(filePath) {
-  const absPath = path4.resolve(filePath);
-  let fileSize;
-  try {
-    const info = await stat2(absPath);
-    fileSize = info.size;
-  } catch (err) {
-    const code = err != null && typeof err === "object" && "code" in err ? err.code : "";
-    if (code === "ENOENT") {
-      throw new CliError(`File not found: ${absPath}`, 2);
-    }
-    throw new CliError(`Cannot stat file: ${absPath}: ${String(err)}`, 2);
-  }
-  if (fileSize > DOCUMENT_MAX_BYTES) {
-    throw new CliError(`Document exceeds 2 MiB: ${absPath}`, 2);
-  }
-  let buf;
-  try {
-    buf = await readFile3(absPath);
-  } catch (err) {
-    throw new CliError(`Cannot read file: ${absPath}: ${String(err)}`, 2);
-  }
-  const isBinary = buf.includes(0) || !isUtf8RoundTrip(buf);
-  const rawFilename = path4.basename(absPath);
-  const filename = rawFilename.slice(0, DOCUMENT_FILENAME_MAX);
-  if (isBinary) {
-    return { content: buf.toString("base64"), encoding: "base64", filename };
-  }
-  return { content: buf.toString("utf8"), encoding: "utf8", filename };
-}
-function isUtf8RoundTrip(buf) {
-  try {
-    const str = buf.toString("utf8");
-    const reEncoded = Buffer.from(str, "utf8");
-    if (reEncoded.length !== buf.length) {
-      return false;
-    }
-    for (let i = 0; i < buf.length; i++) {
-      if (buf[i] !== reEncoded[i]) {
-        return false;
-      }
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/markdown.ts
-function extractTitle(md) {
-  const lines = md.split("\n");
-  let inFence = false;
-  let fenceChar = "";
-  for (const line of lines) {
-    const trimmed = line.trimStart();
-    if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) {
-      const ch = trimmed[0];
-      if (!inFence) {
-        inFence = true;
-        fenceChar = ch;
-      } else if (ch === fenceChar) {
-        inFence = false;
-        fenceChar = "";
-      }
-      continue;
-    }
-    if (inFence) {
-      continue;
-    }
-    if (trimmed.startsWith("# ")) {
-      const title = trimmed.slice(2).trim();
-      if (title.length > 0) {
-        return title;
-      }
-    }
-  }
-  return null;
-}
+// src/sync-repo.ts
+import path8 from "path";
 
-// src/commands/plan-register.ts
-var execFileAsync = promisify2(execFile2);
-function assertToken2(token) {
-  if (token == null) {
-    throw new CliError(
-      "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-      3
-    );
-  }
-}
-var phaseArraySchema = z2.array(
-  z2.object({
-    title: z2.string().min(1),
-    content: z2.string().min(1),
-    status: z2.string().optional(),
-    plannedStartAt: z2.string().optional(),
-    plannedEndAt: z2.string().optional()
-  })
-).max(PHASES_MAX);
-function collect(val, prev) {
-  return [...prev, val];
-}
-function resolveUrl(detailUrl, baseUrl) {
-  if (detailUrl == null) return "";
-  try {
-    return new URL(detailUrl, baseUrl).href;
-  } catch {
-    return detailUrl;
-  }
-}
-async function getGitContributor() {
-  const result = {};
-  try {
-    const { stdout: name } = await execFileAsync("git", ["config", "user.name"], { timeout: 3e3 });
-    const trimmed = name.trim();
-    if (trimmed.length > 0) result["userName"] = trimmed;
-  } catch {
-  }
-  try {
-    const { stdout: email } = await execFileAsync("git", ["config", "user.email"], { timeout: 3e3 });
-    const trimmed = email.trim();
-    if (trimmed.length > 0) result["userEmail"] = trimmed;
-  } catch {
-  }
-  return result;
-}
-function registerPlanRegisterSubcommand(plan, deps) {
-  plan.command("register").description("Register a new plan from a file.").requiredOption("--file <path>", "Path to plan markdown file").option("--title <text>", "Plan title (default: first # heading or filename)").option("--status <status>", "Initial status").option("--planned-start <ISO>", "Planned start date (ISO 8601)").option("--planned-end <ISO>", "Planned end date (ISO 8601)").option("--phases <json>", "Phases JSON array").option("--doc <kind=path>", "Attach a document (repeatable; e.g. --doc plan=report.md)", collect, []).option("--source-url <url>", "Source URL").option("--source-hash <hex>", "Source content hash").option("--no-git", "Skip git author detection").action(async (opts) => {
-    assertToken2(deps.settings.token);
-    if (opts.status != null && !PLAN_STATUSES.includes(opts.status)) {
-      throw new CliError(
-        `Invalid status "${opts.status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-        2
-      );
-    }
-    const { content, sourcePath, titleFallback } = await readPlanFile(opts.file);
-    const title = opts.title ?? extractTitle(content) ?? titleFallback;
-    if (title.length > PLAN_TITLE_MAX) {
-      throw new CliError(
-        `Plan title is too long (${title.length} chars, max ${PLAN_TITLE_MAX}).`,
-        2
-      );
-    }
-    let parsedPhases;
-    if (opts.phases != null) {
-      try {
-        parsedPhases = JSON.parse(opts.phases);
-      } catch (err) {
-        throw new CliError(
-          `Invalid --phases JSON: ${err instanceof Error ? err.message : String(err)}`,
-          2
-        );
-      }
-      const phaseResult = phaseArraySchema.safeParse(parsedPhases);
-      if (!phaseResult.success) {
-        const issue = phaseResult.error.issues[0];
-        if (issue?.code === "too_big" && issue.path.length === 0) {
-          throw new CliError(`Too many phases (max ${PHASES_MAX}).`, 2);
-        }
-        const fieldPath = issue?.path.join(".") ?? "";
-        const fieldDesc = fieldPath.length > 0 ? `field "${fieldPath}"` : "unknown field";
-        throw new CliError(`Invalid --phases JSON: ${fieldDesc}`, 2);
-      }
-      parsedPhases = phaseResult.data;
-    }
-    if (opts.doc.length > 10) {
-      throw new CliError("Too many documents (max 10).", 2);
-    }
-    const documents = [];
-    for (const docSpec of opts.doc) {
-      const match = /^([a-z_]+)=(.+)$/.exec(docSpec);
-      if (match == null) {
-        throw new CliError(`Invalid --doc format "${docSpec}". Expected kind=path.`, 2);
-      }
-      const kind = match[1];
-      const docPath = match[2];
-      if (!PLAN_DOCUMENT_KINDS.includes(kind)) {
-        throw new CliError(
-          `Invalid document kind "${kind}". Valid values: ${PLAN_DOCUMENT_KINDS.join(", ")}`,
-          2
-        );
-      }
-      const { content: docContent, encoding, filename } = await readDocFile(docPath);
-      documents.push({ kind, filename, content: docContent, encoding });
-    }
-    const source = { kind: "file", path: sourcePath };
-    if (opts.sourceUrl != null) source["url"] = opts.sourceUrl;
-    if (opts.sourceHash != null) source["hash"] = opts.sourceHash;
-    const git = opts.git !== false ? await getGitContributor() : {};
-    const planPayload = {
-      title,
-      content,
-      ...opts.status != null ? { status: opts.status } : {},
-      ...opts.plannedStart != null ? { plannedStartAt: opts.plannedStart } : {},
-      ...opts.plannedEnd != null ? { plannedEndAt: opts.plannedEnd } : {},
-      ...parsedPhases != null ? { phases: parsedPhases } : {},
-      ...documents.length > 0 ? { documents } : {}
-    };
-    const mcpArgs = { plan: planPayload, source, git };
-    if (deps.settings.defaultProjectId != null) {
-      mcpArgs["projectId"] = deps.settings.defaultProjectId;
-    }
-    const result = await deps.caller.call("register_plan", mcpArgs);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const r = result;
-    const detailUrl = resolveUrl(r?.detailUrl, deps.settings.baseUrl);
-    process.stdout.write(
-      formatRecord({
-        planId: r?.planId ?? "",
-        transformStatus: r?.transformStatus ?? "",
-        url: detailUrl
-      }) + "\n"
-    );
-  });
-}
+// src/sync-core.ts
+import { createHash } from "crypto";
+import path7 from "path";
 
-// src/commands/plan.ts
-function assertToken3(token) {
-  if (token == null) {
-    throw new CliError(
-      "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-      3
-    );
-  }
-}
-function register5(program, deps) {
-  const plan = program.command("plan").description("Manage plans.");
-  plan.command("list").description("List plans.").option("--status <status>", "Filter by status").action(async (opts) => {
-    assertToken3(deps.settings.token);
-    if (opts.status != null && !PLAN_STATUSES.includes(opts.status)) {
-      throw new CliError(
-        `Invalid status "${opts.status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-        2
-      );
-    }
-    const args = {};
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (opts.status != null) args["status"] = opts.status;
-    const result = await deps.caller.call("list_plans", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const rows = unwrapList(result, "plans");
-    const tableRows = rows.map((p) => ({
-      id: p.id ?? "",
-      title: p.display_title ?? p.raw_title ?? p.title ?? "",
-      status: p.status ?? "",
-      createdAt: p.created_at ?? p.createdAt ?? ""
-    }));
-    process.stdout.write(formatTable(tableRows, ["id", "title", "status", "createdAt"]) + "\n");
-  });
-  plan.command("get <planId>").description("Get plan details.").action(async (planId) => {
-    assertToken3(deps.settings.token);
-    const args = { planId };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    const result = await deps.caller.call("get_plan", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    printResult(result, "human");
-  });
-  registerPlanRegisterSubcommand(plan, deps);
-  plan.command("status <planId> <status>").description("Update plan status.").option("--message <text>", "Optional message").action(async (planId, status, opts) => {
-    assertToken3(deps.settings.token);
-    if (!PLAN_STATUSES.includes(status)) {
-      throw new CliError(
-        `Invalid status "${status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-        2
-      );
-    }
-    const args = { planId, status };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (opts.message != null) args["message"] = opts.message;
-    const result = await deps.caller.call("update_plan_status", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    process.stdout.write(`Plan ${planId} \u2192 ${status}.
-`);
-  });
-  plan.command("review <planId> <verdict>").description("Record a plan review.").option("--summary <text>", "Review summary").action(async (planId, verdict, opts) => {
-    assertToken3(deps.settings.token);
-    if (!REVIEW_VERDICTS.includes(verdict)) {
-      throw new CliError(
-        `Invalid verdict "${verdict}". Valid values: ${REVIEW_VERDICTS.join(", ")}`,
-        2
-      );
-    }
-    const args = { planId, verdict };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (opts.summary != null) args["summary"] = opts.summary;
-    const result = await deps.caller.call("record_plan_review", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    process.stdout.write(`Review recorded: ${verdict}.
-`);
-  });
+// ../roadmap-schema/src/index.ts
+var STATUSES = /* @__PURE__ */ new Set(["todo", "in-progress", "done", "blocked"]);
+var ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var ALLOWED_KEYS = {
+  roadmap: /* @__PURE__ */ new Set(["schemaVersion", "project", "updatedAt", "currentTaskId", "summary", "phases"]),
+  project: /* @__PURE__ */ new Set(["id", "name", "repository"]),
+  phase: /* @__PURE__ */ new Set(["id", "title", "status", "plan", "tasks"]),
+  task: /* @__PURE__ */ new Set(["id", "title", "status", "startedAt", "completedAt", "note", "dependsOn", "plan"])
+};
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function checkKeys(value, allowed, at, errors) {
+  if (!isRecord(value)) return;
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) errors.push(`${at} contains unsupported property "${key}".`);
+  }
+}
+function checkPlan(value, at, errors) {
+  if (value === void 0) return;
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push(`${at}.plan must be a non-empty string.`);
+  }
+}
+function derivePhaseStatus(phase) {
+  if (phase.tasks.length > 0 && phase.tasks.every((task) => task.status === "done")) return "done";
+  if (phase.tasks.some((task) => task.status === "in-progress")) return "in-progress";
+  if (phase.tasks.some((task) => task.status === "blocked")) return "blocked";
+  if (phase.tasks.some((task) => task.status === "done")) return "in-progress";
+  return "todo";
+}
+function validateRoadmap(value) {
+  const errors = [];
+  const warnings = [];
+  if (!isRecord(value)) return { errors: ["Root must be an object."], warnings };
+  checkKeys(value, ALLOWED_KEYS.roadmap, "roadmap", errors);
+  if (value["schemaVersion"] !== 1 && value["schemaVersion"] !== 2) {
+    errors.push("schemaVersion must be 1 or 2.");
+  } else if (value["schemaVersion"] === 1) {
+    warnings.push("schemaVersion 1 is legacy; the next roadmap-progress mutation migrates this file to 2.");
+  }
+  const project = value["project"];
+  checkKeys(project, ALLOWED_KEYS.project, "project", errors);
+  const projectRecord = isRecord(project) ? project : {};
+  if (!ID_PATTERN.test(String(projectRecord["id"] ?? ""))) errors.push("project.id is invalid.");
+  if (projectRecord["name"] == null || projectRecord["name"] === "") errors.push("project.name is required.");
+  if (projectRecord["repository"] == null || projectRecord["repository"] === "") errors.push("project.repository is required.");
+  if (Number.isNaN(Date.parse(String(value["updatedAt"])))) errors.push("updatedAt must be a valid date-time.");
+  if (typeof value["summary"] !== "string") errors.push("summary must be a string.");
+  if (!Array.isArray(value["phases"])) errors.push("phases must be an array.");
+  const allIds = /* @__PURE__ */ new Set();
+  const tasks = /* @__PURE__ */ new Map();
+  const phases = Array.isArray(value["phases"]) ? value["phases"] : [];
+  for (const [phaseIndex, rawPhase] of phases.entries()) {
+    const at = `phases[${phaseIndex}]`;
+    checkKeys(rawPhase, ALLOWED_KEYS.phase, at, errors);
+    const phase = isRecord(rawPhase) ? rawPhase : {};
+    const phaseId = String(phase["id"] ?? "");
+    if (!ID_PATTERN.test(phaseId)) errors.push(`${at}.id is invalid.`);
+    if (allIds.has(phaseId)) errors.push(`Duplicate id "${phaseId}".`);
+    allIds.add(phaseId);
+    if (phase["title"] == null || phase["title"] === "") errors.push(`${at}.title is required.`);
+    if (!STATUSES.has(String(phase["status"]))) errors.push(`${at}.status is invalid.`);
+    checkPlan(phase["plan"], at, errors);
+    if (!Array.isArray(phase["tasks"])) errors.push(`${at}.tasks must be an array.`);
+    const rawTasks = Array.isArray(phase["tasks"]) ? phase["tasks"] : [];
+    for (const [taskIndex, rawTask] of rawTasks.entries()) {
+      const taskAt = `${at}.tasks[${taskIndex}]`;
+      checkKeys(rawTask, ALLOWED_KEYS.task, taskAt, errors);
+      const task = isRecord(rawTask) ? rawTask : {};
+      const taskId = String(task["id"] ?? "");
+      if (!ID_PATTERN.test(taskId)) errors.push(`${taskAt}.id is invalid.`);
+      if (allIds.has(taskId)) errors.push(`Duplicate id "${taskId}".`);
+      allIds.add(taskId);
+      tasks.set(taskId, task);
+      if (task["title"] == null || task["title"] === "") errors.push(`${taskAt}.title is required.`);
+      if (!STATUSES.has(String(task["status"]))) errors.push(`${taskAt}.status is invalid.`);
+      checkPlan(task["plan"], taskAt, errors);
+      if (task["status"] === "done" && task["completedAt"] == null) warnings.push(`${taskId} is done without completedAt.`);
+      if (task["status"] === "in-progress" && task["startedAt"] == null) warnings.push(`${taskId} is in-progress without startedAt.`);
+      if (task["dependsOn"] !== void 0 && !Array.isArray(task["dependsOn"])) errors.push(`${taskAt}.dependsOn must be an array.`);
+    }
+    if (Array.isArray(phase["tasks"]) && STATUSES.has(String(phase["status"]))) {
+      const expected = derivePhaseStatus({ ...phase, tasks: rawTasks });
+      if (phase["status"] !== expected) warnings.push(`${phaseId} status is ${String(phase["status"])}; task states derive ${expected}.`);
+    }
+  }
+  for (const task of tasks.values()) {
+    for (const dependency of task.dependsOn ?? []) {
+      if (!tasks.has(dependency)) warnings.push(`${task.id} depends on unknown task ${dependency}.`);
+      if (task.id === dependency) errors.push(`${task.id} cannot depend on itself.`);
+    }
+  }
+  const currentTaskId = value["currentTaskId"];
+  if (currentTaskId !== null && currentTaskId !== void 0) {
+    const current = tasks.get(String(currentTaskId));
+    if (current == null) errors.push(`currentTaskId ${String(currentTaskId)} does not exist.`);
+    else if (current.status !== "in-progress") warnings.push(`currentTaskId ${String(currentTaskId)} is not in-progress.`);
+  }
+  return { errors, warnings };
+}
+function deriveTaskStats(roadmap) {
+  let done = 0;
+  let blocked = 0;
+  let inProgress = 0;
+  let todo = 0;
+  for (const phase of roadmap.phases) {
+    for (const task of phase.tasks) {
+      if (task.status === "done") done += 1;
+      else if (task.status === "blocked") blocked += 1;
+      else if (task.status === "in-progress") inProgress += 1;
+      else todo += 1;
+    }
+  }
+  const total = done + blocked + inProgress + todo;
+  return {
+    total,
+    done,
+    blocked,
+    inProgress,
+    todo,
+    progressPct: total > 0 ? Math.round(done / total * 100) : 0
+  };
 }
 
-// src/commands/phase.ts
-function assertToken4(token) {
-  if (token == null) {
-    throw new CliError(
-      "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-      3
-    );
-  }
-}
-function register6(program, deps) {
-  const phase = program.command("phase").description("Manage plan phases.");
-  phase.command("status <planId> <phaseId> <status>").description("Update a phase status.").option("--message <text>", "Optional message").action(async (planId, phaseId, status, opts) => {
-    assertToken4(deps.settings.token);
-    if (!PLAN_STATUSES.includes(status)) {
-      throw new CliError(
-        `Invalid status "${status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-        2
-      );
-    }
-    const args = {
-      planId,
-      phaseId,
-      status
-    };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (opts.message != null) args["message"] = opts.message;
-    const result = await deps.caller.call("update_phase_status", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const r = result;
-    const planStatus = r?.planStatus ?? "";
-    process.stdout.write(`Phase ${phaseId} \u2192 ${status} (plan now ${planStatus}).
-`);
-  });
-  phase.command("test <planId> <phaseId> <verdict>").description("Record a phase test result.").option("--round <n>", "Test round number (positive integer)").option("--summary <text>", "Test summary").action(async (planId, phaseId, verdict, opts) => {
-    assertToken4(deps.settings.token);
-    if (!TEST_VERDICTS.includes(verdict)) {
-      throw new CliError(
-        `Invalid verdict "${verdict}". Valid values: ${TEST_VERDICTS.join(", ")}`,
-        2
-      );
-    }
-    let round;
-    if (opts.round != null) {
-      if (!/^[1-9]\d*$/.test(opts.round)) {
-        throw new CliError(`--round must be a positive integer, got "${opts.round}"`, 2);
-      }
-      const parsed = Number(opts.round);
-      if (!Number.isInteger(parsed) || parsed < 1) {
-        throw new CliError(`--round must be a positive integer, got "${opts.round}"`, 2);
+// src/sync-core.ts
+function sha256Hex(content) {
+  return "sha256:" + createHash("sha256").update(content, "utf8").digest("hex");
+}
+function collectPlanRefs(roadmap) {
+  const seen = /* @__PURE__ */ new Set();
+  const refs = [];
+  for (const phase of roadmap.phases) {
+    if (phase.plan != null && !seen.has(phase.plan)) {
+      seen.add(phase.plan);
+      refs.push({ path: phase.plan, ownerId: phase.id });
+    }
+    for (const task of phase.tasks) {
+      if (task.plan != null && !seen.has(task.plan)) {
+        seen.add(task.plan);
+        refs.push({ path: task.plan, ownerId: task.id });
       }
-      round = parsed;
-    }
-    const args = {
-      planId,
-      phaseId,
-      verdict
-    };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (round != null) args["round"] = round;
-    if (opts.summary != null) args["summary"] = opts.summary;
-    const result = await deps.caller.call("record_phase_test_result", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const roundDisplay = round != null ? String(round) : "\u2014";
-    process.stdout.write(`Recorded ${verdict} (round ${roundDisplay}).
-`);
-  });
-}
-
-// src/commands/doc.ts
-function assertToken5(token) {
-  if (token == null) {
-    throw new CliError(
-      "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-      3
-    );
-  }
-}
-function register7(program, deps) {
-  const doc = program.command("doc").description("Manage plan documents.");
-  doc.command("upload <planId>").description("Upload a document to a plan.").requiredOption("--file <path>", "Path to document file").requiredOption("--kind <kind>", `Document kind (${PLAN_DOCUMENT_KINDS.join(", ")})`).option("--phase <phaseId>", "Associate with a specific phase").option("--filename <name>", "Override filename").action(async (planId, opts) => {
-    assertToken5(deps.settings.token);
-    if (!PLAN_DOCUMENT_KINDS.includes(opts.kind)) {
-      throw new CliError(
-        `Invalid kind "${opts.kind}". Valid values: ${PLAN_DOCUMENT_KINDS.join(", ")}`,
-        2
-      );
-    }
-    const { content, encoding, filename: autoFilename } = await readDocFile(opts.file);
-    const filename = opts.filename != null ? opts.filename.slice(0, DOCUMENT_FILENAME_MAX) : autoFilename;
-    const args = {
-      planId,
-      kind: opts.kind,
-      filename,
-      content,
-      encoding
-    };
-    if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-    if (opts.phase != null) args["phaseId"] = opts.phase;
-    const result = await deps.caller.call("upload_plan_document", args);
-    if (deps.output.mode === "json") {
-      printResult(result, "json");
-      return;
-    }
-    const byteCount = encoding === "base64" ? Math.floor(content.length * 3 / 4) : Buffer.byteLength(content, "utf8");
-    process.stdout.write(`Uploaded ${filename} (${encoding}, ${byteCount} bytes).
-`);
-  });
-}
-
-// src/queue-file.ts
-import { openSync, closeSync, writeFileSync, unlinkSync, renameSync, statSync as statSync2 } from "fs";
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, unlink as unlink2, appendFile } from "fs/promises";
-import path5 from "path";
-import crypto from "crypto";
-function queueFilePath(projectDir) {
-  return path5.join(projectDir, ".nolto", "pending.jsonl");
-}
-function lockFilePath(projectDir) {
-  return path5.join(projectDir, ".nolto", "flush.lock");
-}
-function logFilePath(projectDir) {
-  return path5.join(projectDir, ".nolto", "flush.log");
-}
-function resolveQueueDir(inputs) {
-  if (inputs.flagDir != null) return inputs.flagDir;
-  if (inputs.env["NOLTO_QUEUE_DIR"]) return inputs.env["NOLTO_QUEUE_DIR"];
-  if (inputs.env["CLAUDE_PROJECT_DIR"]) return inputs.env["CLAUDE_PROJECT_DIR"];
-  return findAncestorWithMarker(inputs.cwd);
-}
-function findAncestorWithMarker(startDir) {
-  let current = startDir;
-  while (true) {
-    if (hasMarkerSync(current, ".git") || hasMarkerSync(current, ".nolto")) {
-      return current;
     }
-    const parent = path5.dirname(current);
-    if (parent === current) break;
-    current = parent;
-  }
-  return startDir;
-}
-function hasMarkerSync(dir, marker) {
-  try {
-    statSync2(path5.join(dir, marker));
-    return true;
-  } catch {
-    return false;
   }
+  return refs;
 }
-async function readQueue(projectDir) {
-  const filePath = queueFilePath(projectDir);
+async function loadValidRoadmap(repoRoot, readFile7) {
+  const filePath = path7.join(repoRoot, ".roadmap", "roadmap.json");
   let raw;
   try {
-    raw = await readFile4(filePath, "utf8");
-  } catch {
-    return [];
-  }
-  const entries = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      const obj = JSON.parse(trimmed);
-      entries.push(obj);
-    } catch {
-      await appendLog(projectDir, "warn", `malformed queue line skipped: ${trimmed.slice(0, 80)}`);
-    }
-  }
-  return entries;
-}
-async function appendEntry(projectDir, entry) {
-  const noltoDir = path5.join(projectDir, ".nolto");
-  await mkdir3(noltoDir, { recursive: true, mode: 448 });
-  const existing = await readQueue(projectDir);
-  if (existing.length >= QUEUE_MAX_ENTRIES) {
-    throw new CliError(
-      `Queue is full (${QUEUE_MAX_ENTRIES} entries). Flush before adding more.`,
-      2
-    );
-  }
-  const newEntry = {
-    id: crypto.randomUUID(),
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    tool: entry.tool,
-    args: { ...entry.args }
-  };
-  const line = JSON.stringify(newEntry) + "\n";
-  try {
-    await appendFile(queueFilePath(projectDir), line, "utf8");
-  } catch (err) {
-    if (err instanceof CliError) throw err;
-    throw new CliError(
-      `Failed to write queue entry: ${err.message ?? String(err)}`,
-      2
-    );
-  }
-  return newEntry;
-}
-async function atomicRewriteQueue(projectDir, entries) {
-  const filePath = queueFilePath(projectDir);
-  if (entries.length === 0) {
-    try {
-      await unlink2(filePath);
-    } catch (err) {
-      const code = err.code;
-      if (code !== "ENOENT") throw err;
-    }
-    return;
-  }
-  const noltoDir = path5.join(projectDir, ".nolto");
-  await mkdir3(noltoDir, { recursive: true });
-  const tmpPath = filePath + ".tmp";
-  const content = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await writeFile3(tmpPath, content, "utf8");
-  renameSync(tmpPath, filePath);
-}
-async function acquireLock(projectDir) {
-  const noltoDir = path5.join(projectDir, ".nolto");
-  await mkdir3(noltoDir, { recursive: true });
-  const lockPath = lockFilePath(projectDir);
-  return tryAcquire(lockPath);
-}
-async function tryAcquire(lockPath) {
-  try {
-    const fd = openSync(lockPath, "wx");
-    writeFileSync(fd, String(process.pid));
-    closeSync(fd);
-    return makeLockHandle(lockPath);
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
-  }
-  let pidStr;
-  try {
-    pidStr = await readFile4(lockPath, "utf8");
-  } catch {
-    try {
-      unlinkSync(lockPath);
-    } catch {
-    }
-    return tryAcquire(lockPath);
-  }
-  const pid = parseInt(pidStr, 10);
-  if (isNaN(pid)) {
-    try {
-      unlinkSync(lockPath);
-    } catch {
-    }
-    return tryAcquire(lockPath);
-  }
-  try {
-    process.kill(pid, 0);
-    return null;
-  } catch (sigErr) {
-    if (sigErr.code === "ESRCH") {
-      try {
-        unlinkSync(lockPath);
-      } catch {
-      }
-      return tryAcquire(lockPath);
-    }
-    return null;
-  }
-}
-function makeLockHandle(lockPath) {
-  let released = false;
-  return {
-    async release() {
-      if (released) return;
-      released = true;
-      try {
-        unlinkSync(lockPath);
-      } catch {
-      }
-    }
-  };
-}
-async function appendLog(projectDir, level, message) {
-  try {
-    const noltoDir = path5.join(projectDir, ".nolto");
-    await mkdir3(noltoDir, { recursive: true });
-    const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}
-`;
-    await appendFile(logFilePath(projectDir), line, "utf8");
+    raw = await readFile7(filePath);
+  } catch {
+    throw new CliError(`No roadmap found at ${filePath}. Run \`nolto init\` first.`, 2);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
   } catch {
+    throw new CliError(`Malformed JSON in ${filePath}.`, 2);
+  }
+  const { errors } = validateRoadmap(parsed);
+  if (errors.length > 0) {
+    throw new CliError(
+      `roadmap.json failed validation \u2014 not syncing:
+  ${errors.join("\n  ")}`,
+      2
+    );
   }
+  return parsed;
 }
-
-// src/commands/queue.ts
-function withQueueDir(cmd) {
-  return cmd.option("--queue-dir <path>", "Override project directory for queue files");
-}
-function registerQueue(program, deps) {
-  const queue = program.command("queue").description("Queue a progress report for later flush.");
-  withQueueDir(
-    queue.command("phase-status <planId> <phaseId> <status>").description("Queue a phase status update (offline, no token required).").option("--message <text>", "Optional message")
-  ).action(
-    async (planId, phaseId, status, opts) => {
-      if (!PLAN_STATUSES.includes(status)) {
-        throw new CliError(
-          `Invalid status "${status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-          2
-        );
-      }
-      const projectDir = resolveQueueDir({
-        flagDir: opts.queueDir,
-        env: process.env,
-        cwd: process.cwd()
-      });
-      const args = {
-        planId,
-        phaseId,
-        status
-      };
-      if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-      if (opts.message != null) args["message"] = opts.message;
-      const entry = await appendEntry(projectDir, { tool: "update_phase_status", args });
-      if (deps.output.mode === "json") {
-        printResult({ queued: true, id: entry.id }, "json");
-        return;
-      }
-      process.stdout.write(`Queued update_phase_status.
-`);
-    }
-  );
-  withQueueDir(
-    queue.command("phase-test <planId> <phaseId> <verdict>").description("Queue a phase test result (offline, no token required).").option("--round <n>", "Test round number (positive integer)").option("--summary <text>", "Test summary")
-  ).action(
-    async (planId, phaseId, verdict, opts) => {
-      if (!TEST_VERDICTS.includes(verdict)) {
-        throw new CliError(
-          `Invalid verdict "${verdict}". Valid values: ${TEST_VERDICTS.join(", ")}`,
-          2
-        );
-      }
-      let round;
-      if (opts.round != null) {
-        if (!/^[1-9]\d*$/.test(opts.round)) {
-          throw new CliError(`--round must be a positive integer, got "${opts.round}"`, 2);
-        }
-        const parsed = Number(opts.round);
-        if (!Number.isInteger(parsed) || parsed < 1) {
-          throw new CliError(`--round must be a positive integer, got "${opts.round}"`, 2);
-        }
-        round = parsed;
-      }
-      const projectDir = resolveQueueDir({
-        flagDir: opts.queueDir,
-        env: process.env,
-        cwd: process.cwd()
-      });
-      const args = {
-        planId,
-        phaseId,
-        verdict
-      };
-      if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-      if (round != null) args["round"] = round;
-      if (opts.summary != null) args["summary"] = opts.summary;
-      const entry = await appendEntry(projectDir, { tool: "record_phase_test_result", args });
-      if (deps.output.mode === "json") {
-        printResult({ queued: true, id: entry.id }, "json");
-        return;
-      }
-      process.stdout.write(`Queued record_phase_test_result.
-`);
-    }
-  );
-  withQueueDir(
-    queue.command("plan-status <planId> <status>").description("Queue a plan status update (offline, no token required).").option("--message <text>", "Optional message")
-  ).action(
-    async (planId, status, opts) => {
-      if (!PLAN_STATUSES.includes(status)) {
-        throw new CliError(
-          `Invalid status "${status}". Valid values: ${PLAN_STATUSES.join(", ")}`,
-          2
-        );
-      }
-      const projectDir = resolveQueueDir({
-        flagDir: opts.queueDir,
-        env: process.env,
-        cwd: process.cwd()
-      });
-      const args = {
-        planId,
-        status
-      };
-      if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-      if (opts.message != null) args["message"] = opts.message;
-      const entry = await appendEntry(projectDir, { tool: "update_plan_status", args });
-      if (deps.output.mode === "json") {
-        printResult({ queued: true, id: entry.id }, "json");
-        return;
-      }
-      process.stdout.write(`Queued update_plan_status.
-`);
+async function buildSyncBody(args) {
+  const planDocuments = [];
+  for (const ref of collectPlanRefs(args.roadmap)) {
+    const absolute = path7.join(args.repoRoot, ref.path);
+    if (!args.deps.fileExists(absolute)) {
+      args.deps.warn(`plan file not found, skipping: ${ref.path}`);
+      continue;
     }
+    const content = await args.deps.readFile(absolute);
+    planDocuments.push({
+      path: ref.path,
+      taskId: ref.ownerId,
+      content,
+      contentHash: sha256Hex(content)
+    });
+  }
+  return { roadmap: args.roadmap, planDocuments };
+}
+async function runSync(args, deps) {
+  const body = await buildSyncBody({
+    roadmap: args.roadmap,
+    repoRoot: args.repoRoot,
+    deps
+  });
+  const response = await deps.http.put(
+    `/api/projects/${args.projectId}/roadmaps/${args.slug}`,
+    body
   );
-  withQueueDir(
-    queue.command("plan-review <planId> <verdict>").description("Queue a plan review (offline, no token required).").option("--summary <text>", "Review summary")
-  ).action(
-    async (planId, verdict, opts) => {
-      if (!REVIEW_VERDICTS.includes(verdict)) {
-        throw new CliError(
-          `Invalid verdict "${verdict}". Valid values: ${REVIEW_VERDICTS.join(", ")}`,
-          2
-        );
-      }
-      const projectDir = resolveQueueDir({
-        flagDir: opts.queueDir,
-        env: process.env,
-        cwd: process.cwd()
-      });
-      const args = {
-        planId,
-        verdict
-      };
-      if (deps.settings.defaultProjectId != null) args["projectId"] = deps.settings.defaultProjectId;
-      if (opts.summary != null) args["summary"] = opts.summary;
-      const entry = await appendEntry(projectDir, { tool: "record_plan_review", args });
-      if (deps.output.mode === "json") {
-        printResult({ queued: true, id: entry.id }, "json");
-        return;
-      }
-      process.stdout.write(`Queued record_plan_review.
-`);
-    }
+  const stats = deriveTaskStats(args.roadmap);
+  deps.log(
+    `Synced ${args.slug}: ${stats.done}/${stats.total} done \u2014 docs upserted ${response.documents.upserted}, unchanged ${response.documents.unchanged}, deleted ${response.documents.deleted}`
   );
+  return response;
 }
 
-// src/detach.ts
-import { spawn } from "child_process";
-function spawnDetachedFlush(scriptPath, queueDir) {
-  const extraArgs = queueDir != null ? ["--queue-dir", queueDir] : [];
-  const child = spawn(
-    process.execPath,
-    [scriptPath, "flush", ...extraArgs],
-    {
-      detached: true,
-      stdio: "ignore",
-      env: process.env
-    }
+// src/sync-repo.ts
+async function syncRepo(args, io) {
+  const bindingPath = path8.join(args.root, "nolto.json");
+  const binding = await loadRepoBinding(bindingPath);
+  const projectId = binding?.projectId ?? args.defaultProjectId;
+  if (projectId == null) {
+    throw new CliError("No project binding. Run `nolto init` or `nolto link <projectId>`.", 2);
+  }
+  let slug = binding?.roadmapSlug;
+  if (slug == null) {
+    slug = slugifyProjectId(path8.basename(args.root));
+    await writeRoadmapSlug(args.root, slug);
+    io.log(`roadmapSlug not set \u2014 derived "${slug}" and saved to nolto.json`);
+  }
+  const roadmap = await loadValidRoadmap(args.root, io.readFile);
+  const response = await runSync(
+    { repoRoot: args.root, projectId, slug, roadmap },
+    { http: io.http, readFile: io.readFile, fileExists: io.fileExists, log: io.log, warn: io.warn }
   );
-  child.unref();
-  return child.pid;
+  const planAbsPaths = collectPlanRefs(roadmap).map((ref) => path8.join(args.root, ref.path));
+  return { ...response, planAbsPaths };
 }
 
-// src/commands/flush.ts
-async function runFlushWorker(deps, projectDir) {
-  const lock = await acquireLock(projectDir);
-  if (lock === null) {
-    process.stdout.write("Another flush is running.\n");
-    return { flushed: 0, remaining: 0, failed: 0 };
-  }
-  try {
-    const entries = await readQueue(projectDir);
-    if (entries.length === 0) {
-      process.stdout.write("Nothing to flush.\n");
-      return { flushed: 0, remaining: 0, failed: 0 };
-    }
+// src/commands/sync.ts
+function register5(program, deps) {
+  program.command("sync").description("Push .roadmap/roadmap.json and linked plan documents to Nolto (idempotent full upsert).").action(async () => {
     if (deps.settings.token == null) {
-      await appendLog(projectDir, "warn", "flush skipped: no token configured");
-      return { flushed: 0, remaining: entries.length, failed: 0 };
+      throw new CliError("Not authenticated. Run `nolto login` or set NOLTO_TOKEN.", 3);
     }
-    let flushed = 0;
-    let remaining = entries.slice();
-    for (const entry of entries) {
-      try {
-        await deps.caller.call(entry.tool, entry.args);
-      } catch (err) {
-        const cliErr = err instanceof CliError ? err : new CliError(String(err), 5);
-        await appendLog(
-          projectDir,
-          "error",
-          `${entry.tool} id=${entry.id} exit=${cliErr.exitCode} ${cliErr.message}`
-        );
-        return { flushed, remaining: remaining.length, failed: 1 };
-      }
-      flushed++;
-      remaining = remaining.slice(1);
-      await atomicRewriteQueue(projectDir, remaining);
+    const startDir = resolveStartDir(process.env, process.cwd());
+    const { root, foundGit } = findRepoRoot(startDir);
+    if (!foundGit) {
+      throw new CliError("No git repository found. Run inside a repo set up with `nolto init`.", 2);
     }
-    return { flushed, remaining: 0, failed: 0 };
-  } finally {
-    await lock.release();
-  }
-}
-function register8(program, deps) {
-  program.command("flush").description("Flush the pending queue, sending each entry to the Nolto MCP server.").option("--detach", "Spawn a detached background worker and exit immediately.").option("--queue-dir <path>", "Override project directory for queue files").action(async (opts) => {
-    const projectDir = resolveQueueDir({
-      flagDir: opts.queueDir,
-      env: process.env,
-      cwd: process.cwd()
+    const http = createHttpClient({
+      baseUrl: deps.settings.baseUrl,
+      version: deps.version,
+      token: deps.settings.token
     });
-    if (opts.detach) {
-      spawnDetachedFlush(process.argv[1], opts.queueDir);
-      return;
-    }
-    try {
-      const summary = await runFlushWorker(deps, projectDir);
-      if (deps.output.mode === "json") {
-        process.stdout.write(JSON.stringify(summary) + "\n");
-      } else {
-        if (summary.flushed > 0 || summary.failed > 0) {
-          process.stdout.write(
-            `Flushed ${summary.flushed}, remaining ${summary.remaining}, failed ${summary.failed}.
-`
-          );
-        }
+    const response = await syncRepo(
+      { root, defaultProjectId: deps.settings.defaultProjectId },
+      {
+        readFile: (p) => readFile4(p, "utf8"),
+        fileExists: (p) => existsSync3(p),
+        http,
+        log: (line) => process.stdout.write(line + "\n"),
+        warn: (line) => process.stderr.write("Warning: " + line + "\n")
       }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      await appendLog(projectDir, "error", `unexpected flush error: ${msg}`);
-      process.stderr.write(`Flush error (logged to .nolto/flush.log): ${msg}
-`);
+    );
+    if (deps.output.mode === "json") {
+      const { planAbsPaths: _planAbsPaths, ...publicResponse } = response;
+      printResult(publicResponse, "json");
     }
   });
 }
 
-// src/commands/link.ts
-import path6 from "path";
-import { statSync as statSync3 } from "fs";
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function resolveStartDir(env, cwd) {
-  const cpd = env["CLAUDE_PROJECT_DIR"];
-  return cpd != null && cpd.length > 0 ? cpd : cwd;
-}
-function dirHasGit(dir) {
-  try {
-    statSync3(path6.join(dir, ".git"));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function findRepoRoot(startDir, hasGit = dirHasGit) {
-  let current = startDir;
-  while (true) {
-    if (hasGit(current)) {
-      return { root: current, foundGit: true };
-    }
-    const parent = path6.dirname(current);
-    if (parent === current) break;
-    current = parent;
-  }
-  return { root: startDir, foundGit: false };
-}
-async function handleShow(deps, projectBindingPath, mode2) {
-  if (projectBindingPath == null) {
-    if (mode2 === "json") {
-      printResult({ bound: false, projectBindingPath: null }, mode2);
-    } else {
-      process.stdout.write("No nolto.json binding found in this directory tree.\n");
-    }
-    return;
-  }
-  const binding = await loadRepoBinding(projectBindingPath).catch((err) => {
-    if (err instanceof CliError) throw err;
-    throw new CliError(`Cannot read binding: ${String(err)}`, 2);
-  });
-  if (mode2 === "json") {
-    printResult({
-      bound: binding != null,
-      projectId: binding?.projectId ?? null,
-      projectBindingPath,
-      source: deps.settings.source.project === "repo" ? "repo" : "file"
-    }, mode2);
-  } else {
-    if (binding == null) {
-      process.stdout.write(`Binding file found at ${projectBindingPath} but could not be read.
-`);
-    } else {
-      process.stdout.write(`Binding file : ${projectBindingPath}
-`);
-      process.stdout.write(`projectId    : ${binding.projectId}
-`);
-      const active = deps.settings.source.project === "repo" ? "repo (active)" : "repo (not active \u2014 overridden)";
-      process.stdout.write(`source       : ${active}
-`);
+// src/commands/watch.ts
+import { readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import path10 from "path";
+import chokidar from "chokidar";
+
+// src/watch-core.ts
+var RepoWatch = class {
+  constructor(root, deps) {
+    this.root = root;
+    this.deps = deps;
+  }
+  root;
+  deps;
+  timer = null;
+  running = false;
+  pending = false;
+  watchedPlans = [];
+  handleEvent(_filePath) {
+    if (this.timer != null) {
+      this.deps.clearTimeoutFn(this.timer);
+    }
+    this.timer = this.deps.setTimeoutFn(() => {
+      this.timer = null;
+      void this.flush();
+    }, this.deps.debounceMs);
+  }
+  async flush() {
+    if (this.running) {
+      this.pending = true;
+      return;
     }
-  }
-}
-async function handleUnlink(projectBindingPath, mode2) {
-  const { readFile: readFile6, writeFile: writeFile5, chmod } = await import("fs/promises");
-  let existing = {};
-  try {
-    const raw = await readFile6(projectBindingPath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new CliError(
-        `Cannot unlink ${projectBindingPath}: file contains valid JSON but is not a plain object (got ${Array.isArray(parsed) ? "array" : String(parsed)}). Remove or fix the file manually.`,
-        2
+    this.running = true;
+    try {
+      const result = await this.deps.sync();
+      this.rearmPlanWatches(result.planAbsPaths);
+    } catch (err) {
+      this.deps.warn(
+        `[${this.root}] sync failed: ${err instanceof Error ? err.message : String(err)}`
       );
+    } finally {
+      this.running = false;
+      if (this.pending) {
+        this.pending = false;
+        void this.flush();
+      }
     }
-    existing = parsed;
-  } catch (err) {
-    if (err instanceof CliError) throw err;
-    throw new CliError(`Cannot read ${projectBindingPath}: ${String(err)}`, 2);
-  }
-  const { projectId: _removed, ...rest } = existing;
-  void _removed;
-  await writeFile5(projectBindingPath, JSON.stringify(rest, null, 2) + "\n", { mode: 420 });
-  await chmod(projectBindingPath, 420);
-  if (mode2 === "json") {
-    printResult({ unlinked: true, projectBindingPath }, mode2);
-  } else {
-    process.stdout.write(`Removed projectId from ${projectBindingPath}.
-`);
   }
-}
-async function performLink(deps, projectId, mode2) {
-  if (!UUID_RE.test(projectId)) {
-    throw new CliError(
-      `Invalid project ID: "${projectId}". Must be a UUID (e.g. 00000000-0000-0000-0000-000000000001).`,
-      2
-    );
+  rearmPlanWatches(next) {
+    const current = new Set(this.watchedPlans);
+    const nextSet = new Set(next);
+    const toAdd = next.filter((p) => !current.has(p));
+    const toRemove = this.watchedPlans.filter((p) => !nextSet.has(p));
+    if (toRemove.length > 0) this.deps.watcher.unwatch(toRemove);
+    if (toAdd.length > 0) this.deps.watcher.add(toAdd);
+    this.watchedPlans = next;
   }
-  const startDir = resolveStartDir(process.env, process.cwd());
-  const { root, foundGit } = findRepoRoot(startDir);
-  if (!foundGit) {
-    process.stderr.write(
-      `Warning: no .git directory found above ${startDir}. Writing nolto.json to current directory.
-`
+};
+
+// src/service-install.ts
+import path9 from "path";
+import os2 from "os";
+function buildUnitFile(args) {
+  return [
+    "[Unit]",
+    "Description=Nolto roadmap watch (auto-sync roadmap.json to Nolto)",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    `ExecStart=${args.nodePath} ${args.scriptPath} watch`,
+    "Restart=on-failure",
+    "RestartSec=5",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+function getUnitPath(env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg != null && xdg.length > 0 ? xdg : path9.join(os2.homedir(), ".config");
+  return path9.join(base, "systemd", "user", "nolto-watch.service");
+}
+async function installServiceWith(deps) {
+  const unitPath = getUnitPath(deps.env);
+  await deps.mkdir(path9.dirname(unitPath));
+  await deps.writeFile(unitPath, buildUnitFile({ nodePath: deps.nodePath, scriptPath: deps.scriptPath }));
+  deps.log(`Wrote ${unitPath}`);
+  const reload = await deps.exec(["systemctl", "--user", "daemon-reload"]);
+  const enable = reload.code === 0 ? await deps.exec(["systemctl", "--user", "enable", "--now", "nolto-watch"]) : reload;
+  if (reload.code !== 0 || enable.code !== 0) {
+    deps.warn(
+      "Could not activate the service automatically. Run manually:\n  systemctl --user daemon-reload\n  systemctl --user enable --now nolto-watch"
     );
+    return;
   }
-  if (deps.settings.token != null) {
-    try {
-      const result = await deps.caller.call("list_projects", {});
-      const projects = result?.projects ?? [];
-      if (!projects.some((p) => p.id === projectId)) {
-        process.stderr.write(
-          `Warning: project ${projectId} was not found in your list_projects response.
-Proceeding anyway \u2014 verify the ID is correct.
-`
-        );
+  deps.log("Service nolto-watch enabled and started. Logs: journalctl --user -u nolto-watch -f");
+}
+async function installService() {
+  const { writeFile: writeFile6, mkdir: mkdir6 } = await import("fs/promises");
+  const { execFile } = await import("child_process");
+  const { promisify } = await import("util");
+  const execFileAsync = promisify(execFile);
+  await installServiceWith({
+    env: process.env,
+    nodePath: process.execPath,
+    scriptPath: path9.resolve(process.argv[1] ?? ""),
+    writeFile: (p, content) => writeFile6(p, content, "utf8"),
+    mkdir: async (p) => {
+      await mkdir6(p, { recursive: true });
+    },
+    exec: async (cmd) => {
+      try {
+        await execFileAsync(cmd[0], cmd.slice(1));
+        return { code: 0, stderr: "" };
+      } catch (err) {
+        const e = err;
+        return { code: e.code ?? 1, stderr: e.stderr ?? String(err) };
       }
-    } catch {
-      process.stderr.write(
-        "Warning: could not verify project membership (offline or token issue). Proceeding anyway.\n"
-      );
-    }
-  }
-  await writeRepoBinding(root, projectId);
-  const writtenPath = path6.join(root, "nolto.json");
-  if (mode2 === "json") {
-    printResult({ linked: true, projectId, projectBindingPath: writtenPath }, mode2);
-  } else {
-    process.stdout.write(
-      `Linked this repo to project ${projectId} (wrote ${writtenPath}).
-Commit nolto.json to share the binding with your team.
-`
-    );
-  }
+    },
+    log: (line) => process.stdout.write(line + "\n"),
+    warn: (line) => process.stderr.write("Warning: " + line + "\n")
+  });
 }
-function register9(program, deps) {
-  const cmd = program.command("link [projectId]").description(
-    "Bind this repository to a Nolto project.\nWrites nolto.json at the repo root. Commit it to share the binding with your team.\n\nExamples:\n  nolto link <uuid>      Write / update nolto.json\n  nolto link --show      Show the current binding\n  nolto link --unlink    Remove the projectId from nolto.json"
-  ).option("--show", "Show the current repo binding (path + projectId + source)").option("--unlink", "Remove the projectId key from nolto.json");
-  cmd.action(async (projectId) => {
-    const { output } = deps;
-    const projectBindingPath = deps.projectBindingPath ?? null;
-    const mode2 = output.mode;
-    if (cmd.opts()["show"]) {
-      await handleShow(deps, projectBindingPath, mode2);
+
+// src/commands/watch.ts
+function register6(program, deps) {
+  program.command("watch").description("Watch every registered repository's roadmap + plan files and sync on change.").option("--debounce <ms>", "Debounce window in milliseconds", "2000").option("--install-service", "Install and enable a systemd user unit (nolto-watch) instead of watching").action(async (opts) => {
+    if (opts.installService) {
+      await installService();
       return;
     }
-    if (cmd.opts()["unlink"]) {
-      if (projectBindingPath == null) {
-        throw new CliError("No nolto.json found in this directory tree. Nothing to unlink.", 2);
-      }
-      await handleUnlink(projectBindingPath, mode2);
-      return;
+    if (deps.settings.token == null) {
+      throw new CliError("Not authenticated. Run `nolto login` or set NOLTO_TOKEN.", 3);
     }
-    if (projectId == null || projectId.trim().length === 0) {
-      throw new CliError(
-        "Usage: nolto link <projectId>  (provide a UUID)\nOr use --show to view the current binding, --unlink to remove it.",
-        2
-      );
+    const debounceMs = Number.parseInt(opts.debounce, 10);
+    if (Number.isNaN(debounceMs) || debounceMs < 0) {
+      throw new CliError("--debounce must be a non-negative integer.", 2);
     }
-    await performLink(deps, projectId, mode2);
+    const registry = await loadRegistry(getRegistryPath(process.env));
+    const roots = registry.repos.map((r) => r.root).filter((root) => {
+      if (existsSync4(root)) return true;
+      process.stderr.write(`Warning: registered repo no longer exists, skipping: ${root}
+`);
+      return false;
+    });
+    if (roots.length === 0) {
+      throw new CliError("No watchable repositories in the registry. Run `nolto init` in a repo first.", 2);
+    }
+    const http = createHttpClient({
+      baseUrl: deps.settings.baseUrl,
+      version: deps.version,
+      token: deps.settings.token
+    });
+    const watchers = [];
+    for (const root of roots) {
+      const roadmapPath = path10.join(root, ".roadmap", "roadmap.json");
+      const watcher = chokidar.watch([roadmapPath], { ignoreInitial: true });
+      watchers.push(watcher);
+      const repoWatch = new RepoWatch(root, {
+        sync: () => syncRepo(
+          { root, defaultProjectId: deps.settings.defaultProjectId },
+          {
+            readFile: (p) => readFile5(p, "utf8"),
+            fileExists: (p) => existsSync4(p),
+            http,
+            log: (line) => process.stdout.write(`[${path10.basename(root)}] ${line}
+`),
+            warn: (line) => process.stderr.write(`Warning: [${path10.basename(root)}] ${line}
+`)
+          }
+        ),
+        watcher,
+        debounceMs,
+        setTimeoutFn: (fn, ms) => setTimeout(fn, ms),
+        clearTimeoutFn: (t) => clearTimeout(t),
+        log: (line) => process.stdout.write(line + "\n"),
+        warn: (line) => process.stderr.write(line + "\n")
+      });
+      watcher.on("all", (_event, filePath) => repoWatch.handleEvent(filePath));
+      void repoWatch.flush();
+    }
+    process.stdout.write(`Watching ${roots.length} repositories (debounce ${debounceMs}ms). Ctrl-C to stop.
+`);
+    await new Promise((resolve) => {
+      const stop = () => {
+        void Promise.all(watchers.map((w) => w.close())).then(() => resolve());
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
   });
 }
 
@@ -2109,24 +1535,20 @@ function stripCommanderErrorPrefix(msg) {
 function buildProgram(deps) {
   const writeErr = (_msg) => {
   };
-  const program = new Command("nolto").version(deps.version, "-V, --version", "Print version number").exitOverride().configureOutput({ writeErr }).description("Nolto CLI \u2014 register plans and update progress from your terminal.").option("--token <value>", "API token (overrides env/file)").option("--base-url <url>", "Nolto base URL (default: https://nolto.app)").option("--project <projectId>", "Default project ID").option("--json", "Output as JSON");
-  register(program, deps);
+  const program = new Command("nolto").version(deps.version, "-V, --version", "Print version number").exitOverride().configureOutput({ writeErr }).description("Nolto CLI \u2014 sync repository roadmaps with Nolto.").option("--token <value>", "API token (overrides env/file)").option("--base-url <url>", "Nolto base URL (default: https://nolto.app)").option("--project <projectId>", "Default project ID").option("--json", "Output as JSON");
   register2(program, deps);
   register3(program, deps);
   register4(program, deps);
+  register(program, deps);
   register5(program, deps);
   register6(program, deps);
-  register7(program, deps);
-  registerQueue(program, deps);
-  register8(program, deps);
-  register9(program, deps);
   return program;
 }
 
 // src/update-notifier.ts
-import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
 import https from "https";
-import path7 from "path";
+import path11 from "path";
 var PACKAGE = "@nolto/cli";
 var CACHE_FILE = "update-check.json";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -2184,16 +1606,16 @@ function fetchLatestFromRegistry() {
 async function refreshCache(cachePath, now, fetchLatest) {
   const latest = await fetchLatest();
   if (!latest) return;
-  await mkdir4(path7.dirname(cachePath), { recursive: true }).catch(() => void 0);
+  await mkdir5(path11.dirname(cachePath), { recursive: true }).catch(() => void 0);
   const payload = { checkedAt: now, latest };
-  await writeFile4(cachePath, JSON.stringify(payload), { mode: 384 }).catch(() => void 0);
+  await writeFile5(cachePath, JSON.stringify(payload), { mode: 384 }).catch(() => void 0);
 }
 async function checkForUpdate(opts) {
   if (isDisabled(opts.env)) return null;
-  const cachePath = path7.join(opts.configDir, CACHE_FILE);
+  const cachePath = path11.join(opts.configDir, CACHE_FILE);
   let cache = {};
   try {
-    cache = JSON.parse(await readFile5(cachePath, "utf8"));
+    cache = JSON.parse(await readFile6(cachePath, "utf8"));
   } catch {
   }
   if (typeof cache.checkedAt !== "number" || opts.now - cache.checkedAt > CACHE_TTL_MS) {
@@ -2221,11 +1643,11 @@ async function notifyUpdate(opts) {
 }
 
 // src/index.ts
-var __dirname2 = path8.dirname(fileURLToPath2(import.meta.url));
+var __dirname3 = path12.dirname(fileURLToPath3(import.meta.url));
 var require2 = createRequire2(import.meta.url);
 function getVersion() {
   try {
-    const pkgPath = path8.resolve(__dirname2, "../package.json");
+    const pkgPath = path12.resolve(__dirname3, "../package.json");
     const pkg = require2(pkgPath);
     return pkg.version ?? "0.0.0";
   } catch {
@@ -2274,15 +1696,19 @@ async function main() {
     repoBinding
   });
   const version = getVersion();
-  const caller = settings.token != null ? createMcpCaller({ baseUrl: settings.baseUrl, token: settings.token, version }) : {
-    call: async (_toolName, _args) => {
-      throw new CliError(
-        "No API token configured. Run `nolto init` or set NOLTO_TOKEN.",
-        3
-      );
-    }
-  };
-  const program = buildProgram({ caller, settings, output: { mode }, version, configPath, projectBindingPath });
+  const http = createHttpClient({
+    baseUrl: settings.baseUrl,
+    version,
+    token: settings.token
+  });
+  const program = buildProgram({
+    http,
+    settings,
+    output: { mode },
+    version,
+    configPath,
+    projectBindingPath
+  });
   await program.parseAsync(process.argv);
   await notifyUpdate({ current: version, env: process.env, isJson: mode === "json", now: Date.now() });
 }