@opennous/cli 0.10.1 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opennous/cli",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "Nous CLI — set up Nous, connect it to your coding agent, and read the Context API from your terminal",
   "type": "module",
   "bin": {

package/src/index.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 
-// Nous CLI — a thin client of the v2 Context API.
+// OpenNous CLI — the setup + auth utility. NOT a data surface.
 //
-// You read engineered, epistemics-tagged context and write observations.
-// You never overwrite — Nous derives the facts.
+// It signs you in (browser device flow → key in ~/.nous/config.json) and installs the
+// opennous plugin into your agent (`init`). All data work happens in the agent through
+// the 7 MCP primitives — the CLI never duplicates them.
 
 import { program, Command } from "commander";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, appendFileSync, readdirSync } from "fs";
@@ -19,6 +20,34 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // CI log full of escape codes is worse than no colour at all.
 const COLOR = process.stdout.isTTY && !process.env.NO_COLOR;
 const dim = (t) => (COLOR ? `\x1b[2m${t}\x1b[0m` : t);
+const bold = (t) => (COLOR ? `\x1b[1m${t}\x1b[0m` : t);
+const green = (t) => (COLOR ? `\x1b[32m${t}\x1b[0m` : t);
+
+// Fetch the acting identity for a key — the same whoami the agent gets — so sign-in can
+// confirm WHO you are, not just that a key was written. Best-effort; never throws.
+async function fetchWhoami(apiUrl, key) {
+  try {
+    const r = await fetch(`${apiUrl}/v2/workspace/whoami`, { headers: { Authorization: `Bearer ${key}` } });
+    if (!r.ok) return null;
+    return await r.json();
+  } catch { return null; }
+}
+// "Bennet Glinder · WindSeeker AI · admin · AE"
+function identityLine(who) {
+  const y = who?.you || {};
+  return [
+    y.name || (y.user_id ? "member" : "shared workspace key"),
+    who?.workspace?.name,
+    y.scope,
+    (Array.isArray(y.roles) && y.roles.length) ? y.roles.join(", ") : null,
+  ].filter(Boolean).join(dim(" · "));
+}
+// The one thing left after signing in: install the plugin in the agent.
+function printNextSteps() {
+  console.log(`  ${dim("Next — install the plugin in Claude Code:")}`);
+  console.log(`    /plugin marketplace add NousC/nous-plugin`);
+  console.log(`    /plugin install opennous@opennous\n`);
+}
 
 // Best-effort open the user's browser; if it fails they have the printed URL.
 //
@@ -105,305 +134,6 @@ function apiClient() {
   };
 }
 
-// A name that matches several entities comes back as { status: 'ambiguous' }.
-// Print the candidates and stop — the caller re-runs with a precise focus.
-function handleAmbiguous(r) {
-  if (r && r.status === "ambiguous") {
-    console.log("Several entities match that focus — re-run with one of:");
-    for (const c of r.candidates ?? []) {
-      const detail = c.detail ? ` — ${c.detail}` : "";
-      console.log(`  ${c.name || "(unnamed)"}${detail}  [${c.entity_id}]`);
-    }
-    return true;
-  }
-  return false;
-}
-
-// --value accepts JSON ('{"description":"…"}') or a bare string.
-function parseValue(raw) {
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return raw;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// nous install — drop a starter Nous integration into the current project
-// ---------------------------------------------------------------------------
-// Detects the framework, asks for the API key, writes a single module with the
-// helpers wired (signup tracking + Stripe webhook handler + generic track()),
-// and prints exactly where the user has to hook it up.
-//
-// No magic — everything is plain code the user can read and edit. The CLI's job
-// is to save them the 30 minutes of writing it from scratch and to make sure
-// the event names match what the Nous UI expects.
-
-function detectStack(root) {
-  // Returns one of: "next", "node-esm", "node-cjs", "python", "unknown"
-  const pkgPath = join(root, "package.json");
-  if (existsSync(pkgPath)) {
-    try {
-      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-      const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-      if (deps.next) return "next";
-      if (pkg.type === "module") return "node-esm";
-      return "node-cjs";
-    } catch { /* fall through */ }
-  }
-  if (existsSync(join(root, "pyproject.toml")) || existsSync(join(root, "requirements.txt"))) {
-    return "python";
-  }
-  return "unknown";
-}
-
-function prompt(question, fallback) {
-  return new Promise(resolve => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(question + (fallback ? ` [${fallback}] ` : " "), answer => {
-      rl.close();
-      resolve(answer.trim() || fallback || "");
-    });
-  });
-}
-
-const TEMPLATES = {
-  // Node ESM template — works for raw Express, Fastify, Hono, anything that
-  // accepts async functions with the request body. The user wires the import
-  // into whichever route handles signups + Stripe.
-  "node-esm": `// Nous event tracking. Generated by \`nous install\`.
-// Edit freely — this is just a starting point.
-
-const NOUS_API_URL = process.env.NOUS_API_URL || "https://api.opennous.cloud";
-const NOUS_API_KEY = process.env.NOUS_API_KEY;
-
-async function postObservations(focus, observations) {
-  if (!NOUS_API_KEY) { console.warn("[NOUS] NOUS_API_KEY not set, skipping"); return; }
-  try {
-    const res = await fetch(\`\${NOUS_API_URL}/v2/observations\`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: \`Bearer \${NOUS_API_KEY}\` },
-      body: JSON.stringify({ focus, observations }),
-    });
-    if (!res.ok) console.error("[NOUS] observation failed:", res.status, await res.text().catch(() => ""));
-  } catch (err) {
-    console.error("[NOUS] observation error:", err.message);
-  }
-}
-
-// Call this right after a new user account is created in your auth flow.
-export async function trackSignup({ email, first_name = null, last_name = null, company = null, plan = "free", source }) {
-  if (!email) return;
-  await postObservations(email, [
-    { kind: "event", property: "interaction.signed_up",
-      value: { plan, source: source || "your-app", first_name, last_name, company, at: new Date().toISOString() } },
-    { kind: "state", property: "stage", value: plan === "free" ? "Free User" : "Trial" },
-    ...(company ? [{ kind: "state", property: "company", value: company }] : []),
-  ]);
-}
-
-// Mount this on your Stripe webhook handler. Expects a Stripe Event object.
-export async function handleStripeEvent(event, { customerEmail }) {
-  if (!customerEmail) return;
-  const sub = event.data?.object;
-  if (event.type === "customer.subscription.created" || event.type === "customer.subscription.updated") {
-    if (sub?.status !== "active") return;
-    const price = sub.items?.data?.[0]?.price;
-    await postObservations(customerEmail, [
-      { kind: "event",
-        property: event.type === "customer.subscription.created"
-          ? "interaction.subscription_started"
-          : "interaction.subscription_updated",
-        value: {
-          source: "stripe", plan: sub.metadata?.plan_id || price?.lookup_key || null, status: sub.status,
-          amount: price?.unit_amount ? price.unit_amount / 100 : null, currency: sub.currency || null,
-          stripe_subscription_id: sub.id, at: new Date().toISOString(),
-        } },
-      { kind: "state", property: "stage", value: "Customer" },
-      { kind: "state", property: "plan", value: sub.metadata?.plan_id || price?.lookup_key || null },
-    ]);
-    return;
-  }
-  if (event.type === "customer.subscription.deleted") {
-    await postObservations(customerEmail, [
-      { kind: "event", property: "interaction.subscription_canceled",
-        value: { source: "stripe", stripe_subscription_id: sub?.id, at: new Date().toISOString() } },
-      { kind: "state", property: "stage", value: "Churned" },
-    ]);
-  }
-}
-
-// Escape hatch for any other event you want to land on the timeline.
-export async function track(focus, property, value = {}) {
-  await postObservations(focus, [{ kind: "event", property, value: { ...value, at: new Date().toISOString() } }]);
-}
-`,
-
-  python: `# Nous event tracking. Generated by \`nous install\`.
-# Edit freely — this is just a starting point.
-import os
-import urllib.request
-import json
-from datetime import datetime, timezone
-
-NOUS_API_URL = os.getenv("NOUS_API_URL", "https://api.opennous.cloud")
-NOUS_API_KEY = os.getenv("NOUS_API_KEY")
-
-def _post(focus, observations):
-    if not NOUS_API_KEY:
-        print("[NOUS] NOUS_API_KEY not set, skipping")
-        return
-    body = json.dumps({"focus": focus, "observations": observations}).encode()
-    req = urllib.request.Request(
-        f"{NOUS_API_URL}/v2/observations", data=body, method="POST",
-        headers={"Content-Type": "application/json", "Authorization": f"Bearer {NOUS_API_KEY}"},
-    )
-    try:
-        with urllib.request.urlopen(req, timeout=5) as r:
-            if r.status >= 400: print("[NOUS] observation failed:", r.status)
-    except Exception as e:
-        print("[NOUS] observation error:", e)
-
-def track_signup(email, *, first_name=None, last_name=None, company=None, plan="free", source="your-app"):
-    if not email: return
-    now = datetime.now(timezone.utc).isoformat()
-    _post(email, [
-        {"kind":"event","property":"interaction.signed_up",
-         "value":{"plan":plan,"source":source,"first_name":first_name,"last_name":last_name,"company":company,"at":now}},
-        {"kind":"state","property":"stage","value":"Free User" if plan=="free" else "Trial"},
-        *([{"kind":"state","property":"company","value":company}] if company else []),
-    ])
-
-def handle_stripe_event(event, customer_email):
-    if not customer_email: return
-    sub = event.get("data", {}).get("object", {})
-    t = event.get("type")
-    now = datetime.now(timezone.utc).isoformat()
-    if t in ("customer.subscription.created", "customer.subscription.updated"):
-        if sub.get("status") != "active": return
-        price = (sub.get("items", {}).get("data") or [{}])[0].get("price", {}) or {}
-        _post(customer_email, [
-            {"kind":"event",
-             "property":"interaction.subscription_started" if t.endswith("created") else "interaction.subscription_updated",
-             "value":{"source":"stripe","plan":sub.get("metadata",{}).get("plan_id"),"status":sub.get("status"),
-                      "amount":(price.get("unit_amount") or 0)/100 or None,"currency":sub.get("currency"),
-                      "stripe_subscription_id":sub.get("id"),"at":now}},
-            {"kind":"state","property":"stage","value":"Customer"},
-        ])
-    elif t == "customer.subscription.deleted":
-        _post(customer_email, [
-            {"kind":"event","property":"interaction.subscription_canceled",
-             "value":{"source":"stripe","stripe_subscription_id":sub.get("id"),"at":now}},
-            {"kind":"state","property":"stage","value":"Churned"},
-        ])
-
-def track(focus, property_, value=None):
-    now = datetime.now(timezone.utc).isoformat()
-    _post(focus, [{"kind":"event","property":property_,"value":{**(value or {}),"at":now}}])
-`,
-};
-
-const NEXT_STEPS = {
-  "node-esm": `Next steps:
-  1. Set NOUS_API_KEY in your .env (see https://app.opennous.cloud/integrations).
-  2. Import { trackSignup } from "./nous.js" — call it right after you persist a new user.
-  3. Import { handleStripeEvent } in your Stripe webhook route — call it after verifying the signature.
-  4. Use track(email, "interaction.<your_event>", {...}) for anything else.`,
-  "node-cjs": `Next steps:
-  1. Set NOUS_API_KEY in your .env (see https://app.opennous.cloud/integrations).
-  2. const { trackSignup, handleStripeEvent, track } = require("./nous.js");
-  3. Call trackSignup() after persisting a new user; handleStripeEvent() inside your Stripe webhook.`,
-  next: `Next steps:
-  1. Set NOUS_API_KEY in your .env (see https://app.opennous.cloud/integrations).
-  2. Inside your signup API route, await trackSignup({ email, ... }) after the user row is written.
-  3. Inside app/api/webhooks/stripe/route.ts (or pages/api/webhooks/stripe.ts), await handleStripeEvent(event, { customerEmail }) after Stripe signature verification.`,
-  python: `Next steps:
-  1. Set NOUS_API_KEY in your .env (see https://app.opennous.cloud/integrations).
-  2. from nous import track_signup, handle_stripe_event, track — call track_signup() after persisting a new user.
-  3. Call handle_stripe_event(event, customer_email) inside your Stripe webhook view.`,
-};
-
-// `nous track init` — drop event tracking into the user's app. This used to be
-// `nous install`, which collided head-on with the front-door meaning of "install":
-// people typed `nous install` expecting to set Nous up and got an app-instrumentation
-// scaffolder instead. The front door is now `nous init`. `install` stays as a hidden
-// deprecated alias so nobody's script breaks, and it prints where the command went.
-const trackCmd = program
-  .command("track")
-  .description("Instrument your app to send events to Nous");
-
-function defineTrackInit(cmd) {
-  return cmd
-  .description("Drop Nous event tracking (signups + Stripe lifecycle) into the current project")
-  .option("--dir <path>", "Target project directory (default: cwd)", process.cwd())
-  .option("--lang <stack>", "Force language/stack: next | node-esm | node-cjs | python")
-  .option("--key <key>", "API key (otherwise prompted)")
-  .option("--yes", "Skip prompts and use defaults", false)
-  .action(async ({ dir, lang, key, yes }) => {
-    const root = resolve(dir);
-    if (!existsSync(root)) {
-      console.error(`Directory not found: ${root}`);
-      process.exit(1);
-    }
-
-    const detected = lang || detectStack(root);
-    const stack = (detected === "unknown") ? "node-esm" : detected;
-    const templateKey = stack === "next" ? "node-esm" : (stack === "node-cjs" ? "node-esm" : stack);
-    const template = TEMPLATES[templateKey];
-    if (!template) {
-      console.error(`No template for stack: ${stack}. Use --lang next|node-esm|node-cjs|python.`);
-      process.exit(1);
-    }
-
-    const outFile = stack === "python" ? "nous.py" : "nous.js";
-    const outPath = join(root, outFile);
-
-    if (existsSync(outPath) && !yes) {
-      const answer = await prompt(`${outFile} already exists. Overwrite? (y/N)`, "N");
-      if (!answer.toLowerCase().startsWith("y")) {
-        console.log("Aborted.");
-        process.exit(0);
-      }
-    }
-
-    let apiKey = key || process.env.NOUS_API_KEY || readConfig().apiKey;
-    if (!apiKey && !yes) {
-      apiKey = await prompt("Paste your Nous API key (or press Enter to skip and set NOUS_API_KEY later):", "");
-    }
-
-    writeFileSync(outPath, template);
-
-    // Append NOUS_API_KEY to .env if not already there.
-    const envPath = join(root, ".env");
-    let envTouched = false;
-    if (existsSync(envPath)) {
-      const env = readFileSync(envPath, "utf8");
-      if (!/^NOUS_API_KEY\s*=/m.test(env)) {
-        appendFileSync(envPath, `\n# Nous event tracking (https://app.opennous.cloud)\nNOUS_API_KEY=${apiKey || ""}\n`);
-        envTouched = true;
-      }
-    } else if (apiKey) {
-      writeFileSync(envPath, `# Nous event tracking (https://app.opennous.cloud)\nNOUS_API_KEY=${apiKey}\n`);
-      envTouched = true;
-    }
-
-    console.log(`\n✓ Wrote ${outFile}`);
-    if (envTouched) console.log(`✓ Updated .env`);
-    console.log(`\nDetected stack: ${stack}`);
-    console.log(`\n${NEXT_STEPS[stack] || NEXT_STEPS["node-esm"]}\n`);
-  });
-}
-
-// The real command: `nous track init`.
-defineTrackInit(trackCmd.command("init"));
-
-// Deprecated alias: `nous install`. Kept so existing scripts don't break; it does the
-// same thing but says where it moved, because "install" is now `nous init`.
-defineTrackInit(program.command("install"))
-  .hook("preAction", () => {
-    console.error(dim("note: `nous install` is now `nous track init`. Run `nous init` to set up Nous itself.\n"));
-  });
 
 // ---------------------------------------------------------------------------
 // nous auth
@@ -451,389 +181,49 @@ program
   );
 
 // ---------------------------------------------------------------------------
-// nous context <focus> — engineered, intent-shaped context for a task
-// ---------------------------------------------------------------------------
-program
-  .command("context <focus>")
-  .description("Engineered context for a task about one person or company")
-  .option(
-    "--intent <intent>",
-    "draft_email | follow_up | meeting_prep | call_prep | account_review",
-    "account_review"
-  )
-  .option("--budget <tokens>", "Token budget for the assembled context")
-  .option("--json", "Print the raw JSON response")
-  .action(async (focus, { intent, budget, json }) => {
-    const api = apiClient();
-    const ctx = await api.post("/v2/context", {
-      focus,
-      intent,
-      budget_tokens: budget ? Number(budget) : undefined,
-    });
-    if (handleAmbiguous(ctx)) return;
-    if (json) {
-      console.log(JSON.stringify(ctx, null, 2));
-      return;
-    }
-    const lines = [`${ctx.entity.type} ${ctx.entity.id}  ·  intent: ${ctx.intent}`];
-    if (ctx.summary) lines.push(`\n${ctx.summary}`);
-    if (ctx.claims?.length) {
-      lines.push(`\nClaims:`);
-      ctx.claims.forEach(c => {
-        const val = typeof c.value === "object" ? JSON.stringify(c.value) : c.value;
-        lines.push(
-          `  ${c.property} = ${val}  (${c.epistemic_class}, ${c.freshness}, ` +
-            `conf ${Math.round((c.confidence ?? 0) * 100)}%)`
-        );
-      });
-    }
-    if (ctx.timeline?.length) {
-      lines.push(`\nTimeline:`);
-      ctx.timeline.slice(0, 8).forEach(t => {
-        const when = t.when ? new Date(t.when).toLocaleDateString() : "";
-        const detail = t.summary ? `: ${t.summary}` : t.count ? ` ×${t.count}` : "";
-        lines.push(`  ${when} — ${t.type}${detail}`);
-      });
-    }
-    if (ctx.stakeholders?.length) {
-      lines.push(`\nStakeholders:`);
-      ctx.stakeholders.forEach(s =>
-        lines.push(`  ${s.name || s.entity_id}${s.role ? ` — ${s.role}` : ""}`)
-      );
-    }
-    lines.push(`\n~${ctx.meta?.token_estimate ?? "?"} tokens`);
-    console.log(lines.join("\n"));
-  });
-
-// ---------------------------------------------------------------------------
-// nous account <focus> — the full record: every claim + its epistemics
-// ---------------------------------------------------------------------------
-program
-  .command("account <focus>")
-  .description("The full account record — every claim with its epistemics + timeline")
-  .option("--json", "Print the raw JSON response")
-  .action(async (focus, { json }) => {
-    const api = apiClient();
-    const rec = await api.get(`/v2/accounts/${encodeURIComponent(focus)}`);
-    if (handleAmbiguous(rec)) return;
-    if (json) {
-      console.log(JSON.stringify(rec, null, 2));
-      return;
-    }
-    const lines = [`${rec.type} ${rec.entity_id}`];
-    const claims = Object.entries(rec.claims ?? {});
-    if (claims.length) {
-      lines.push(`\nClaims:`);
-      claims.forEach(([prop, c]) => {
-        const val = typeof c.value === "object" ? JSON.stringify(c.value) : c.value;
-        lines.push(
-          `  ${prop} = ${val}  (${c.epistemic_class}, ${c.freshness}, ` +
-            `conf ${Math.round((c.confidence ?? 0) * 100)}%)`
-        );
-      });
-    }
-    const obs = rec.recent_observations ?? [];
-    if (obs.length) {
-      lines.push(`\nRecent observations:`);
-      obs.slice(0, 10).forEach(o => {
-        const when = o.observed_at ? new Date(o.observed_at).toLocaleDateString() : "";
-        lines.push(`  ${when} — [${o.kind}] ${o.property}  (${o.source})`);
-      });
-    }
-    console.log(lines.join("\n"));
-  });
-
-// ---------------------------------------------------------------------------
-// nous record <focus> — observe what happened; Nous derives the facts
-// ---------------------------------------------------------------------------
-program
-  .command("record <focus>")
-  .description("Record an observation. You observe — Nous derives the claims.")
-  .requiredOption("--kind <kind>", "event | state")
-  .requiredOption("--property <property>", "e.g. interaction.email_sent or job_title")
-  .option("--value <value>", "The event detail or fact value (JSON or string)")
-  .option("--source <source>", "Where this came from", "cli")
-  .option("--method <method>", "How it was observed")
-  .option("--observed-at <iso>", "When it was observed (ISO 8601)")
-  .action(async (focus, opts) => {
-    const api = apiClient();
-    const observation = {
-      kind: opts.kind,
-      property: opts.property,
-      value: parseValue(opts.value),
-      source: opts.source,
-      method: opts.method,
-      observed_at: opts.observedAt,
-    };
-    const result = await api.post("/v2/observations", { focus, observations: [observation] });
-    if (handleAmbiguous(result)) return;
-    const recomputed = result.claims_recomputed ?? [];
-    console.log(
-      `✓ Recorded ${result.recorded} observation(s) for ${result.entity_id}` +
-        (recomputed.length ? `\n  Claims recomputed: ${recomputed.join(", ")}` : "")
-    );
-  });
-
-// ---------------------------------------------------------------------------
-// nous query — retrieve and summarise a corpus of activity across many people
-// ---------------------------------------------------------------------------
-program
-  .command("query")
-  .description("Retrieve and summarise activity across many people")
-  .option("--kind <kind>", "event | state")
-  .option("--property <prefix>", "Property prefix — e.g. interaction.linkedin")
-  .option("--source <source>", "Filter by source")
-  .option("--entity <id>", "Restrict to one entity")
-  .option("--since <days>", "Look back this many days")
-  .option("--limit <n>", "Max results", "20")
-  .option("--question <text>", "A question — switches to semantic retrieval")
-  .option("--json", "Print the raw JSON response")
-  .action(async opts => {
-    const api = apiClient();
-    const scope = {
-      kind: opts.kind,
-      property: opts.property,
-      source: opts.source,
-      entity_id: opts.entity,
-      since_days: opts.since ? Number(opts.since) : undefined,
-      limit: opts.limit ? Number(opts.limit) : undefined,
-    };
-    const data = await api.post("/v2/query", { scope, question: opts.question });
-    if (opts.json) {
-      console.log(JSON.stringify(data, null, 2));
-      return;
-    }
-    const items = data.items ?? [];
-    if (!items.length) {
-      console.log("No matching activity.");
-      return;
-    }
-    items.forEach(it => {
-      const when = it.when ? new Date(it.when).toLocaleDateString() : "";
-      const who = it.entity_name || it.entity_id;
-      const sim = it.similarity != null ? `  ${Math.round(it.similarity * 100)}%` : "";
-      console.log(`  ${when} — ${who} — ${it.type}${sim}${it.summary ? `: ${it.summary}` : ""}`);
-    });
-    console.log(
-      `\n${data.returned} of ${data.matched} (${data.mode})` +
-        (data.sampled ? " — sampled" : "")
-    );
-  });
-
-// ---------------------------------------------------------------------------
-// nous attention — what needs attention across the workspace
-// ---------------------------------------------------------------------------
-program
-  .command("attention")
-  .description("Accounts gone quiet, facts decayed — ranked, with suggested actions")
-  .option("--limit <n>", "Max results", "20")
-  .option("--json", "Print the raw JSON response")
-  .action(async ({ limit, json }) => {
-    const api = apiClient();
-    const data = await api.get("/v2/attention", { limit });
-    if (json) {
-      console.log(JSON.stringify(data, null, 2));
-      return;
-    }
-    const items = data.items ?? [];
-    if (!items.length) {
-      console.log("Nothing needs attention. ✓");
-      return;
-    }
-    items.forEach(it => {
-      const who = it.entity_name || it.entity_id;
-      console.log(`  [${it.kind}] ${who} — ${it.what} (${it.age_days}d)`);
-      console.log(`     → ${it.suggested_action}`);
-    });
-  });
-
-// ---------------------------------------------------------------------------
-// nous audit — is this graph actually sound?
-//
-// The command that answers the only question a technical team has before trusting
-// data they didn't collect themselves. It is deliberately a COMMAND and not a
-// dashboard: a dashboard makes a claim about our own product and asks you to
-// believe it; a command runs against your data, in your terminal, and returns an
-// exit code. One of those can fail a build.
+// nous connect <provider> — connect Gmail / Google Calendar via Composio
 // ---------------------------------------------------------------------------
+// You're already signed in (the saved key identifies you), so there's no device-code
+// dance — we start a Composio consent, open it in your browser, and poll until the
+// account goes ACTIVE. Composio holds the OAuth token; Nous never sees it.
+const CONNECT_ALIASES = {
+  gmail: "gmail_oauth",
+  gmail_oauth: "gmail_oauth",
+  calendar: "google_calendar",
+  gcal: "google_calendar",
+  "google-calendar": "google_calendar",
+  google_calendar: "google_calendar",
+};
 program
-  .command("audit")
-  .description("Audit your GTM data — what's broken, what's unsure, and what to do about it")
-  .option("--check <name>", "One check only: arriving, resolved, evidenced, current, reachable")
-  .option("--list", "List the records behind each finding")
-  .option("--fail-under <n>", "Exit 1 if health is below this percentage — for CI")
-  .option("--fix", "Show the repairs that can be made safely, without making them")
-  .option("--apply", "Actually make them (use with --fix)")
-  .option("--json", "Print the raw JSON response")
-  .action(async ({ check, list, failUnder, fix, apply, json }) => {
-    const api = apiClient();
-
-    // ── nous audit --fix ──
-    //
-    // Only the repairs that need no judgment: records sharing an email or a
-    // LinkedIn profile are the same human by definition. Everything else the audit
-    // finds needs a decision, a browser, or you — and a --fix that quietly did
-    // those too would be one nobody could trust.
-    if (fix) {
-      const out = await api.post("/v2/audit/fix", { apply: !!apply });
-      if (json) { console.log(JSON.stringify(out, null, 2)); return; }
-
-      if (out.dry_run) {
-        if (!out.would_merge) {
-          console.log("\n  Nothing to repair automatically.\n");
-          return;
-        }
-        console.log(`\n  ${out.would_merge} ${out.would_merge === 1 ? "merge" : "merges"} can be made safely:\n`);
-        for (const m of out.merges) {
-          console.log(`    · ${m.who ?? m.keep}  ${dim("— " + m.why)}`);
-        }
-        console.log(dim("\n  Nothing changed. Re-run with --fix --apply to make them.\n"));
-        return;
-      }
-
-      console.log(`\n  Merged ${out.merged}.${out.failed ? `  ${out.failed} failed.` : ""}\n`);
-      for (const f of out.failures ?? []) console.error(`    ✗ ${f.who ?? f.keep}: ${f.error}`);
-      if (out.failed) process.exit(1);
-      return;
-    }
-
-    const data = await api.get("/v2/audit", check ? { check } : {});
-
-    if (json) {
-      console.log(JSON.stringify(data, null, 2));
-    } else {
-      const checks = check ? [data.check] : data.checks;
-      const findings = data.findings ?? [];
-
-      console.log("");
-      for (const c of checks) {
-        const pct = String(c.pct).padStart(4);
-        const mark = c.pct === 100 ? "\u2713" : "\u2717";
-        console.log(`  ${pct}%  ${c.label.toUpperCase().padEnd(11)} ${c.summary}  ${mark}`);
-        // What we deliberately did not count. An audit cannot itself be a black box.
-        if (c.note) console.log(`         ${dim(c.note)}`);
-      }
-
-      if (!findings.length) {
-        console.log("\n  Nothing to fix.\n");
-      } else {
-        console.log("");
-        for (const f of findings) {
-          console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-          console.log(`         ${dim(f.detail)}`);
-          // Who can fix it, said plainly. Pretending we can re-authorise someone's
-          // Gmail is how a tool loses trust the first time it fails to.
-          const by = f.fixable_by === "human"
-            ? "needs you"
-            : f.fixable_by === "agent_with_confirmation"
-              ? "the agent, once you confirm"
-              : "the agent";
-          console.log(`         \u2192 ${f.fix}  (${by})`);
-
-          if (list && f.subjects?.length) {
-            for (const sub of f.subjects.slice(0, 20)) {
-              const line = sub.who
-                ? (Array.isArray(sub.who) ? sub.who.join("  \u2194  ") : sub.who)
-                : Object.entries(sub).map(([k, v]) => `${k}=${v}`).join(" ");
-              console.log(`           \u00b7 ${line}${sub.why ? dim("  — " + sub.why) : ""}`);
-            }
-            if (f.subjects.length > 20) {
-              console.log(`           \u00b7 ${dim(`and ${f.subjects.length - 20} more`)}`);
-            }
-          }
-          console.log("");
-        }
-        if (!list) console.log(dim("  Add --list to see the records behind each finding.\n"));
-      }
-    }
-
-    // The reason this is a command. An exit code can stop a deploy; a dashboard
-    // cannot. You would have known about a dead connector on day one, not day 48.
-    const health = check ? data.check.pct : data.health;
-    if (failUnder !== undefined) {
-      const floor = Number(failUnder);
-      if (health < floor) {
-        console.error(`\n  FAIL: health ${health}% is below the threshold of ${floor}%\n`);
-        process.exit(1);
-      }
+  .command("connect <provider>")
+  .description("Connect a source: gmail | calendar (via Composio)")
+  .action(async (provider) => {
+    const name = CONNECT_ALIASES[String(provider).toLowerCase()];
+    if (!name) {
+      console.error(`Unknown source "${provider}". Try: nous connect gmail  |  nous connect calendar`);
+      process.exit(1);
     }
-  });
-
-// ---------------------------------------------------------------------------
-// nous verify <focus> <property> — re-check a claim before acting on it
-// ---------------------------------------------------------------------------
-program
-  .command("verify <focus> <property>")
-  .description("Re-check a claim before acting on it — the calibration check")
-  .action(async (focus, property) => {
     const api = apiClient();
-    const r = await api.post("/v2/verify", { focus, property });
-    if (handleAmbiguous(r)) return;
-    const fmt = c =>
-      c
-        ? `${typeof c.value === "object" ? JSON.stringify(c.value) : c.value} ` +
-          `(${c.freshness}, conf ${Math.round((c.confidence ?? 0) * 100)}%)`
-        : "—";
-    console.log(`${r.property}`);
-    console.log(`  before: ${fmt(r.before)}`);
-    console.log(`  after:  ${fmt(r.after)}`);
-    if (r.note) console.log(`  ${r.note}`);
-  });
-
-// ---------------------------------------------------------------------------
-// nous classify — pre-flight cold-outbound dedup
-// ---------------------------------------------------------------------------
-program
-  .command("classify")
-  .description("Pre-flight dedup a list of emails and/or LinkedIn URLs against the workspace's engagement history")
-  .option("--emails <list>", "Comma-separated emails")
-  .option("--linkedin <list>", "Comma-separated LinkedIn URLs")
-  .option("--file <path>", "Path to any text/CSV — both emails and LinkedIn URLs are auto-extracted")
-  .option("--json", "Print the raw JSON response")
-  .action(async ({ emails, linkedin, file, json }) => {
-    const api = apiClient();
-    const EMAIL_RE    = /[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,}/gi;
-    const LINKEDIN_RE = /https?:\/\/(?:www\.)?linkedin\.com\/in\/[a-zA-Z0-9_\-%]+/gi;
-
-    let emailList = [];
-    let linkedinList = [];
-
-    if (file) {
-      const { readFileSync } = await import("fs");
-      const text = readFileSync(file, "utf8");
-      emailList = text.match(EMAIL_RE) || [];
-      linkedinList = text.match(LINKEDIN_RE) || [];
-    }
-    if (emails)   emailList    = emailList.concat(emails.split(/[\s,]+/).filter(Boolean));
-    if (linkedin) linkedinList = linkedinList.concat(linkedin.split(/[\s,]+/).filter(Boolean));
-
-    emailList    = [...new Set(emailList.map(e => e.toLowerCase().trim()))].filter(Boolean);
-    linkedinList = [...new Set(linkedinList.map(u => u.trim()))].filter(Boolean);
-
-    if (!emailList.length && !linkedinList.length) {
-      console.error("Pass at least one of --emails, --linkedin, or --file");
+    const start = await api.post("/api/connect/composio/start", { provider: name });
+    if (!start?.redirect_url) {
+      console.error("Couldn't start the connection. Ask an admin to set up the Integration Engine (Composio) in Settings first.");
       process.exit(1);
     }
+    console.log(`\nOpening your browser to authorize ${name === "gmail_oauth" ? "Gmail" : "Google Calendar"}…`);
+    console.log(dim(start.redirect_url) + "\n");
+    openBrowser(start.redirect_url);
 
-    const body = {};
-    if (emailList.length)    body.emails        = emailList;
-    if (linkedinList.length) body.linkedin_urls = linkedinList;
-
-    const data = await api.post("/v2/dedup", body);
-    if (json) { console.log(JSON.stringify(data, null, 2)); return; }
-    const s = data.summary || {};
-    const pad = (n, w = 6) => String(n).padStart(w);
-    console.log(`\n  ${pad(s.total)}  total  (${emailList.length} emails, ${linkedinList.length} linkedin)`);
-    console.log(`  ${pad(s.net_new)}  net_new       ← safe to send / safe to buy`);
-    console.log(`  ${pad(s.engaged)}  engaged       skip (in an active convo)`);
-    console.log(`  ${pad(s.recent)}  recent        defer (contacted in last 30d)`);
-    console.log(`  ${pad(s.bounced)}  bounced       skip`);
-    console.log(`  ${pad(s.unsubscribed)}  unsubscribed  skip`);
-    console.log(`  ${pad(s.suppressed)}  suppressed    skip (workspace policy)\n`);
+    process.stdout.write("Waiting for you to finish in the browser");
+    for (let i = 0; i < 150; i++) {   // ~5 min at 2s
+      await sleep(2000);
+      process.stdout.write(".");
+      const s = await api.get("/api/connect/composio/status", { provider: name, connection_request_id: start.connection_request_id });
+      if (s?.status === "connected") { console.log("\n✓ Connected. Your history is backfilling now and new events will flow in automatically."); return; }
+      if (s?.status === "failed") { console.log("\n✗ Google didn't approve the connection. Run the command again to retry."); process.exit(1); }
+    }
+    console.log("\nStill pending. If you finished in the browser, run the command again — it will pick up the active connection.");
   });
 
-// ---------------------------------------------------------------------------
-// Browser sign-in (device authorization). Opens the browser, you approve, and a
 // freshly minted API key is saved to ~/.nous/config.json. No copy-paste. Shared
 // by `nous login` and `nous init`.
 // ---------------------------------------------------------------------------
@@ -883,7 +273,9 @@ async function browserLogin(url, opts = {}) {
       cfg.apiKey = j.api_key;
       cfg.apiUrl = apiUrl;
       writeConfig(cfg);
-      console.log(`\n\n✓ Signed in. Key saved to ~/.nous/config.json`);
+      const who = await fetchWhoami(apiUrl, j.api_key);
+      console.log(`\n\n  ${green("✓")} ${bold("Signed in")}${who ? ` as ${identityLine(who)}` : ""}`);
+      console.log(`  ${dim("Key saved to ~/.nous/config.json")}\n`);
       return true;
     }
     if (j.status === "denied")  { console.log("\nAuthorization was denied."); process.exit(1); }
@@ -899,7 +291,7 @@ program
   .option("--url <url>", "API base URL (default: https://api.opennous.cloud)")
   .action(async ({ url }) => {
     await browserLogin(url);
-    console.log("Your Nous tools are ready — try `get_workspace_status` in your agent.");
+    printNextSteps();
   });
 
 program
@@ -908,18 +300,20 @@ program
   .option("--url <url>", "API base URL (default: https://api.opennous.cloud)")
   .action(async (token, { url }) => {
     await browserLogin(url, { startPath: "/api/cli/auth/join/start", startBody: { token } });
-    console.log("You're in — your agent now has its own member-scoped Nous workspace.");
-    console.log("Try `get_workspace_status` in your agent.");
+    console.log(`  ${dim("You're in — your agent now has its own member-scoped workspace.")}\n`);
+    printNextSteps();
   });
 
 // ---------------------------------------------------------------------------
-// MCP registration — connect Nous to whatever agent is on this machine.
+// Connect OpenNous to whatever agent is on this machine — host-aware.
 //
-// There is deliberately no Claude Code plugin/marketplace. A plugin would be Claude-Code-only
-// and put a marketplace between a new user and the product — too much for a first run, and it
-// wouldn't work for Cursor, Codex, or any other host. The MCP server is the whole integration,
-// so registration is one cross-platform step: `claude mcp add` if the Claude CLI is here, else
-// a `.mcp.json` any MCP host reads.
+// The MCP server (7 primitives) is the universal capability: any MCP host runs `npx @opennous/mcp`.
+// But the SKILLS + routing are the product surface, and those are delivered per host:
+//   • Claude Code  → the OpenNous PLUGIN (skills + routing hooks + the trimmed MCP, one install).
+//   • Any other host (Cursor, Codex, Claude Desktop, …) → the trimmed MCP via a `.mcp.json`;
+//     each host's skills pack ships as we light it up.
+// So `init` installs the plugin on Claude Code, and writes the MCP config everywhere else — one
+// signup, the right shell per host, the same 7-primitive surface (NOUS_SURFACE=plugin) throughout.
 //
 // The MCP resolves its key from ~/.nous/config.json on every call, so we never bake the
 // key into any of these configs — sign-in already wrote it there.
@@ -943,11 +337,15 @@ function writeJsonMcp(path, apiUrl) {
     try { cfg = JSON.parse(readFileSync(path, "utf8")); } catch { cfg = {}; }
   }
   cfg.mcpServers = cfg.mcpServers || {};
-  cfg.mcpServers.nous = {
+  cfg.mcpServers.opennous = {
     command: MCP_CMD,
     args: MCP_ARGS,
-    // Only pin a non-default API URL (self-host). Cloud reads the key from the config file.
-    ...(apiUrl && apiUrl !== "https://api.opennous.cloud" ? { env: { NOUS_API_URL: apiUrl } } : {}),
+    // NOUS_SURFACE=plugin trims to the 7 revenue primitives (never the full internal toolset).
+    // Only pin a non-default API URL (self-host); cloud reads the key from ~/.nous/config.json.
+    env: {
+      NOUS_SURFACE: "plugin",
+      ...(apiUrl && apiUrl !== "https://api.opennous.cloud" ? { NOUS_API_URL: apiUrl } : {}),
+    },
   };
   const dir = dirname(path);
   if (dir && !existsSync(dir)) mkdirSync(dir, { recursive: true });
@@ -963,19 +361,26 @@ function writeJsonMcp(path, apiUrl) {
  *   2. Write ./.mcp.json in the current project (Claude Code and most clients read it).
  * We never fail the flow on this — a printed fallback is better than an abort.
  */
-function registerMcp(apiUrl) {
-  if (hasClaudeCli()) {
-    const args = ["mcp", "add", "nous", "--scope", "user"];
-    if (apiUrl && apiUrl !== "https://api.opennous.cloud") args.push("-e", `NOUS_API_URL=${apiUrl}`);
-    args.push("--", MCP_CMD, ...MCP_ARGS);
-    const r = spawnSync("claude", args, { stdio: "ignore" });
-    if (r.status === 0) return "Registered Nous with Claude Code (claude mcp add).";
-    // add fails if a server named nous already exists — that's a success for our purposes.
-    return "Nous is already registered with Claude Code.";
-  }
+const PLUGIN_MARKETPLACE = "NousC/nous-plugin";
+const PLUGIN_ID = "opennous@opennous";
+
+// Claude Code → install the OpenNous PLUGIN (skills + routing hooks + the trimmed MCP, in one).
+// We try the plugin CLI; if this Claude build has no `plugin` subcommand it returns null and the
+// caller prints the two slash-commands instead. We deliberately do NOT fall back to a bare
+// `claude mcp add` — a standalone MCP server would duplicate the plugin's and drop the skills.
+function installClaudePlugin() {
+  const add = spawnSync("claude", ["plugin", "marketplace", "add", PLUGIN_MARKETPLACE], { stdio: "ignore" });
+  if (add.status !== 0 && add.status !== null) { /* non-zero: try install anyway, marketplace may already be added */ }
+  const inst = spawnSync("claude", ["plugin", "install", PLUGIN_ID], { stdio: "ignore" });
+  return inst.status === 0;
+}
+
+// Any other MCP host (Cursor, Codex, Claude Desktop, …) → the trimmed MCP server via a .mcp.json
+// any MCP host reads. Skills for those hosts arrive as their own packs (roadmap).
+function registerMcpServer(apiUrl) {
   const path = join(process.cwd(), ".mcp.json");
   writeJsonMcp(path, apiUrl);
-  return `Wrote ${path} — your agent will pick up Nous from it.`;
+  return `Wrote ${path} — your agent will pick up OpenNous (7 primitives) from it.`;
 }
 
 // Install the ICP auto-sync hook into the project's Claude Code config. Once in place,
@@ -1026,12 +431,25 @@ program
 
     const apiUrl = url || readConfig().apiUrl || "https://api.opennous.cloud";
     if (register !== false) {
-      try {
-        console.log(`\n${registerMcp(apiUrl)}`);
-      } catch (e) {
-        // Never let registration take down sign-in — print the manual line instead.
-        console.log("\nCouldn't register the MCP automatically. Add it with:");
-        console.log(`  claude mcp add nous -- ${MCP_CMD} ${MCP_ARGS.join(" ")}`);
+      // Claude Code → the plugin (skills + hooks + trimmed MCP). Any other host → the MCP config.
+      if (hasClaudeCli()) {
+        let installed = false;
+        try { installed = installClaudePlugin(); } catch { /* fall through to instructions */ }
+        if (installed) {
+          console.log("\n✓ Installed the OpenNous plugin into Claude Code — skills, routing, and the 7 primitives.");
+          console.log("  If Claude Code is already running, apply it with /reload-plugins.");
+        } else {
+          console.log("\nDetected Claude Code. Install the OpenNous plugin (skills + hooks + tools):");
+          console.log("  /plugin marketplace add NousC/nous-plugin");
+          console.log("  /plugin install opennous@opennous");
+        }
+      } else {
+        try {
+          console.log(`\n${registerMcpServer(apiUrl)}`);
+        } catch {
+          console.log("\nCouldn't write .mcp.json automatically. Add OpenNous to your host's MCP config:");
+          console.log(`  command: ${MCP_CMD}  args: ${MCP_ARGS.join(" ")}  env: NOUS_SURFACE=plugin`);
+        }
       }
 
       // Auto-sync the ICP: a Claude Code hook so editing your ICP file reminds the
@@ -1059,7 +477,7 @@ program
 //
 // It only touches slots that exist, and by default won't clobber a file that's already there
 // (the repo, once it's the author, wins) unless you pass --force.
-const PULL_KINDS = { icp: "icp.md", positioning: "positioning.md", voice: "voice.md", outreach: "messaging.md" };
+const PULL_KINDS = { icp: "icp.md" };
 
 program
   .command("pull")
@@ -1115,273 +533,4 @@ program
   });
 
 // ---------------------------------------------------------------------------
-// nous link <dir> — pair a local folder with your personal vault and keep them in
-// sync, both ways. Your laptop and Nous become two views of the same files: edit in
-// Obsidian/Finder and it flows up; the agent files a brief (once you approve it) and
-// it flows down. This is the "local desk" — the same vault the GitHub sync fills,
-// only the transport is your filesystem instead of a repo. `nous link` is idempotent;
-// run it once and leave it watching, or pass --once for a single reconcile.
-// ---------------------------------------------------------------------------
-
-// Default vault structure (2026-08-21). New folders scaffold with these 7. The legacy
-// folders are still walked/watched/searched so existing files keep syncing.
-const DEFAULT_FOLDERS = ["inbox", "projects", "decisions", "accounts", "people", "resources", "archive"];
-const VAULT_FOLDERS = [...DEFAULT_FOLDERS, "thoughts", "briefs", "content", "company"];
-
-// A resilient API caller for the daemon — unlike apiClient(), a failed poll or push
-// must NOT exit the process; the loop should keep running and retry on the next tick.
-function softClient() {
-  const cfg = readConfig();
-  const apiKey = process.env.NOUS_API_KEY || cfg.apiKey;
-  const apiUrl = process.env.NOUS_API_URL || cfg.apiUrl || "https://api.opennous.cloud";
-  if (!apiKey) { console.error("No API key. Run: nous login"); process.exit(1); }
-  return async (method, path, { body, query } = {}) => {
-    const url = new URL(path, apiUrl);
-    if (query) for (const [k, v] of Object.entries(query)) if (v != null) url.searchParams.set(k, String(v));
-    try {
-      const res = await fetch(url.toString(), {
-        method,
-        headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
-        body: body ? JSON.stringify(body) : undefined,
-      });
-      if (!res.ok) return { ok: false, status: res.status };
-      return { ok: true, data: res.status === 204 ? {} : await res.json() };
-    } catch (e) {
-      return { ok: false, error: e.message };
-    }
-  };
-}
-
-// Every .md under the foundation folders of `root`, as repo-style relative paths.
-function walkVaultMd(root) {
-  const out = [];
-  const rec = (dir, prefix) => {
-    let entries = [];
-    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const e of entries) {
-      if (e.name.startsWith(".")) continue;
-      const abs = join(dir, e.name);
-      const rel = prefix ? `${prefix}/${e.name}` : e.name;
-      if (e.isDirectory()) rec(abs, rel);
-      else if (e.name.endsWith(".md")) out.push({ rel, abs });
-    }
-  };
-  for (const f of VAULT_FOLDERS) rec(join(root, f), f);
-  return out;
-}
-
-const safeRead = (abs) => { try { return readFileSync(abs, "utf8"); } catch { return null; } };
-const saveCursor = (cursor) => { const c = readConfig(); c.link = { ...(c.link || {}), cursor }; writeConfig(c); };
-
-// Write incoming files to disk where they differ. Records what we wrote so the watcher
-// can ignore the change event it will fire, and so we never push a file straight back.
-async function pullOnce(call, root, recentlyWritten, quiet) {
-  const since = readConfig().link?.cursor || new Date(0).toISOString();
-  const r = await call("GET", "/v2/personal/local/pull", { query: { since } });
-  if (!r.ok) return;
-  let wrote = 0;
-  for (const f of r.data.files || []) {
-    const abs = join(root, f.path.split("/").join(sep));
-    if (safeRead(abs) === f.content) continue;   // already identical — no write, no echo
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, f.content);
-    recentlyWritten.set(f.path, Date.now());
-    if (!quiet) process.stdout.write(`  ↓ ${f.path}\n`);
-    wrote++;
-  }
-  if (r.data.cursor) saveCursor(r.data.cursor);
-  return wrote;
-}
-
-program
-  .command("link <dir>")
-  .description("Pair a local folder with your personal vault and keep them in sync")
-  .option("--once", "Reconcile once and exit instead of watching", false)
-  .option("--interval <sec>", "How often to pull incoming changes while watching", "15")
-  .action(async (dir, { once, interval }) => {
-    const call = softClient();
-    const root = resolve(dir);
-    // Scaffold the folder so the desk has the same shape as the vault.
-    if (!existsSync(root)) mkdirSync(root, { recursive: true });
-    for (const f of DEFAULT_FOLDERS) { const d = join(root, f); if (!existsSync(d)) mkdirSync(d, { recursive: true }); }
-
-    const label = hostname() || "my machine";
-    const linked = await call("POST", "/v2/personal/local/link", { body: { label } });
-    if (!linked.ok) { console.error("Couldn't link this folder — check your API key with `nous auth status`."); process.exit(1); }
-
-    const cfg = readConfig();
-    cfg.link = { dir: root, cursor: new Date(0).toISOString() };
-    writeConfig(cfg);
-    console.log(`Linked ${root} ↔ your Nous vault (${label}).\n`);
-
-    const recentlyWritten = new Map();
-    const wasJustWritten = (rel) => { const t = recentlyWritten.get(rel); return t && Date.now() - t < 4000; };
-
-    // ── Initial reconcile: pull server state, then push anything local that differs. ──
-    const serverState = await call("GET", "/v2/personal/local/pull", { query: { since: new Date(0).toISOString() } });
-    const serverMap = new Map((serverState.ok ? serverState.data.files : []).map((f) => [f.path, f.content]));
-    // Write server files that are missing/different on disk.
-    for (const [path, content] of serverMap) {
-      const abs = join(root, path.split("/").join(sep));
-      if (safeRead(abs) === content) continue;
-      mkdirSync(dirname(abs), { recursive: true });
-      writeFileSync(abs, content);
-      recentlyWritten.set(path, Date.now());
-      console.log(`  ↓ ${path}`);
-    }
-    // Push local files the server doesn't have or that differ.
-    const toPush = walkVaultMd(root).filter((f) => serverMap.get(f.rel) !== safeRead(f.abs));
-    if (toPush.length) {
-      const files = toPush.map((f) => ({ path: f.rel, content: safeRead(f.abs) ?? "" }));
-      await call("POST", "/v2/personal/local/push", { body: { files } });
-      for (const f of toPush) console.log(`  ↑ ${f.rel}`);
-    }
-    saveCursor(new Date().toISOString());
-    console.log(`\n✓ In sync — ${serverMap.size} in Nous, ${walkVaultMd(root).length} on disk.`);
-
-    if (once) return;
-
-    // ── Watch: push local edits up; poll: pull remote edits down. ──
-    let chokidar;
-    try { chokidar = (await import("chokidar")).default; }
-    catch { console.error("\nWatching needs chokidar. Re-run with --once, or `npm i -g @opennous/cli` to get it."); process.exit(1); }
-
-    const pushPath = async (abs, deleted) => {
-      const rel = relative(root, abs).split(sep).join("/");
-      if (!rel.endsWith(".md")) return;
-      if (wasJustWritten(rel)) return;   // this change is one we just pulled — don't echo it back
-      const content = deleted ? "" : (safeRead(abs) ?? "");
-      const r = await call("POST", "/v2/personal/local/push", { body: { files: [{ path: rel, content, deleted: !!deleted }] } });
-      if (r.ok) { saveCursor(new Date().toISOString()); process.stdout.write(deleted ? `  ↑ removed ${rel}\n` : `  ↑ ${rel}\n`); }
-    };
-
-    const watcher = chokidar.watch(VAULT_FOLDERS.map((f) => join(root, f)), {
-      ignoreInitial: true, awaitWriteFinish: { stabilityThreshold: 400, pollInterval: 100 },
-    });
-    watcher.on("add", (p) => pushPath(p, false)).on("change", (p) => pushPath(p, false)).on("unlink", (p) => pushPath(p, true));
-
-    const secs = Math.max(5, Number(interval) || 15);
-    setInterval(() => { pullOnce(call, root, recentlyWritten).catch(() => {}); }, secs * 1000);
-
-    console.log(`\nWatching for changes. Pulling every ${secs}s. Press Ctrl-C to stop.`);
-    process.stdin.resume();   // keep the process alive
-  });
-
-// nous unlink — detach the local folder. Files stay in the vault; only the pairing ends.
-program
-  .command("unlink")
-  .description("Stop syncing your linked local folder (files stay in Nous)")
-  .action(async () => {
-    const call = softClient();
-    await call("POST", "/v2/personal/local/unlink", {});
-    const cfg = readConfig();
-    delete cfg.link;
-    writeConfig(cfg);
-    console.log("✓ Unlinked. Your files are still in Nous; this folder just stopped syncing.");
-  });
-
-// ---------------------------------------------------------------------------
-// nous vault — read + search the LINKED local vault ON-DEVICE. When an agent runs
-// where the vault is linked (`nous link`), it should read these files directly
-// instead of calling the search_my_vault MCP tool: fresher (no sync lag), fuller
-// (whole files, not snippets), faster (no network), and private (the reads never
-// leave the machine). This is the native personal-vault retrieval path.
-// ---------------------------------------------------------------------------
-function linkedVaultRoot() {
-  const dir = readConfig().link?.dir;
-  if (!dir || !existsSync(dir)) return null;
-  return dir;
-}
-function requireVaultRoot() {
-  const root = linkedVaultRoot();
-  if (!root) { console.error("No local vault linked. Run `nous link <dir>` first."); process.exit(1); }
-  return root;
-}
-// Resolve a 'folder/[subfolder/]name' argument to an absolute .md path under the vault.
-function resolveVaultRel(root, p) {
-  const rel = String(p).replace(/^\/+/, "").endsWith(".md") ? String(p).replace(/^\/+/, "") : `${String(p).replace(/^\/+/, "")}.md`;
-  return { rel, abs: join(root, rel.split("/").join(sep)) };
-}
-
-const vaultCmd = program
-  .command("vault")
-  .description("Read and search your linked local vault — on-device, no server round-trip");
-
-vaultCmd
-  .command("path")
-  .description("Print the linked vault folder (point your own Read/Grep at it)")
-  .action(() => { console.log(requireVaultRoot()); });
-
-vaultCmd
-  .command("list [folder]")
-  .description("List vault files, optionally within one folder")
-  .option("--json", "Output JSON", false)
-  .action((folder, { json }) => {
-    const root = requireVaultRoot();
-    let files = walkVaultMd(root).map((f) => f.rel);
-    if (folder) files = files.filter((r) => r.split("/")[0] === folder);
-    files.sort();
-    if (json) { console.log(JSON.stringify(files)); return; }
-    if (!files.length) { console.log(folder ? `No files in ${folder}.` : "Vault is empty."); return; }
-    for (const r of files) console.log(`  ${r}`);
-  });
-
-vaultCmd
-  .command("read <path>")
-  .description("Print a vault file's full content (e.g. decisions/pricing)")
-  .action((p) => {
-    const root = requireVaultRoot();
-    const { rel, abs } = resolveVaultRel(root, p);
-    const content = safeRead(abs);
-    if (content == null) { console.error(`Not found: ${rel}`); process.exit(1); }
-    process.stdout.write(content.endsWith("\n") ? content : content + "\n");
-  });
-
-vaultCmd
-  .command("search <query...>")
-  .description("Search the linked vault locally (on-device — never leaves your machine)")
-  .option("--folder <folder>", "Restrict to one vault folder")
-  .option("--limit <n>", "Max results", "6")
-  .option("--json", "Output JSON", false)
-  .action((queryParts, { folder, limit, json }) => {
-    const root = requireVaultRoot();
-    const query = queryParts.join(" ");
-    const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
-    if (!terms.length) { console.error("Pass a query, e.g. `nous vault search pricing objections`."); process.exit(1); }
-
-    let files = walkVaultMd(root);
-    if (folder) files = files.filter((f) => f.rel.split("/")[0] === folder);
-
-    const hits = [];
-    for (const f of files) {
-      const content = safeRead(f.abs) ?? "";
-      const hay = content.toLowerCase();
-      const name = f.rel.toLowerCase();
-      let score = 0;
-      for (const t of terms) {
-        if (name.includes(t)) score += 5;                         // a filename hit is a strong signal
-        score += Math.min(hay.split(t).length - 1, 5);            // content occurrences, capped
-      }
-      if (score <= 0) continue;
-      // Snippet around the first matching term.
-      let snippet = "";
-      for (const t of terms) {
-        const i = hay.indexOf(t);
-        if (i >= 0) { snippet = content.slice(Math.max(0, i - 60), i + 140).replace(/\s+/g, " ").trim(); break; }
-      }
-      hits.push({ path: f.rel, score, snippet });
-    }
-    hits.sort((a, b) => b.score - a.score);
-    const top = hits.slice(0, Math.min(Math.max(1, Number(limit) || 6), 30));
-
-    if (json) { console.log(JSON.stringify(top)); return; }
-    if (!top.length) { console.log(`No local vault notes matched "${query}".`); return; }
-    console.log(`Local vault notes matching "${query}":\n`);
-    for (const h of top) {
-      console.log(`  ${h.path}`);
-      if (h.snippet) console.log(`    ${h.snippet}`);
-    }
-  });
-
-// ---------------------------------------------------------------------------
-program.name("nous").version("0.8.0").parse();
+program.name("nous").version("0.12.0").parse();