@ornexus/neocortex 4.59.1

package/install.sh

@@ -0,0 +1,2013 @@
+#!/bin/bash
+
+# Neocortex - Instalador Unix
+# Development Orchestrator
+
+# Versao do instalador
+VERSION="4.59.1"
+
+# Flags
+MIGRATION_DETECTED=false
+MIGRATION_SOURCES=""
+CODERABBIT_INSTALLED=false
+LEGACY_ITEMS=""
+LEGACY_WARNINGS=0
+SELECTED_TARGETS=""
+VALID_TARGETS="claude-code cursor vscode gemini gemini-cli codex antigravity opencode kimi openclaw"
+# LOCAL_MODE removed (Epic 50): thin-client ALWAYS, zero IP on client
+# SSoT: packages/client/src/constants.ts DEFAULT_SERVER_URL
+NEOCORTEX_SERVER_URL="https://api.neocortex.sh"
+
+# =============================================================================
+# DETECCAO DE AMBIENTE
+# =============================================================================
+
+is_interactive() { [ -t 0 ] && [ -t 1 ]; }
+
+supports_colors() { [ -t 1 ] && [ "$(tput colors 2>/dev/null || echo 0)" -ge 8 ]; }
+
+supports_unicode() {
+    case "${LANG:-}${LC_ALL:-}${LC_CTYPE:-}" in
+        *UTF-8*|*utf-8*|*utf8*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+if [ -z "$HOME" ]; then
+    HOME=$(getent passwd "$(whoami)" | cut -d: -f6 2>/dev/null || echo "/root")
+    export HOME
+fi
+
+# =============================================================================
+# PARSING DE ARGUMENTOS
+# =============================================================================
+
+AUTO_YES=false
+DEBUG_MODE=false
+SKIP_PROJECT_DIRS=false
+CREATE_PROJECT=false
+QUIET_MODE=false
+NO_BANNER=false
+CLEANUP_LEGACY=false
+DRY_RUN=false
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -y|--yes) AUTO_YES=true; shift ;;
+        -d|--debug) DEBUG_MODE=true; shift ;;
+        -s|--skip-project) SKIP_PROJECT_DIRS=true; shift ;;
+        -q|--quiet) QUIET_MODE=true; shift ;;
+        --dry-run) DRY_RUN=true; shift ;;
+        --no-banner) NO_BANNER=true; shift ;;
+        --cleanup-legacy) CLEANUP_LEGACY=true; shift ;;
+        --targets=*) SELECTED_TARGETS="${1#--targets=}"; shift ;;
+        --create-project) CREATE_PROJECT=true; shift ;;
+        --local) warn "--local flag removed: thin-client mode is now mandatory (zero IP on client)"; shift ;;
+        --server-url=*) NEOCORTEX_SERVER_URL="${1#--server-url=}"; shift ;;
+        -h|--help)
+            echo ""
+            echo "  Neocortex Installer v${VERSION}"
+            echo "  Development Orchestrator"
+            echo ""
+            echo "  Uso: npx @ornexus/neocortex [opcoes]"
+            echo ""
+            echo "  Opcoes:"
+            echo "    -y, --yes                 Modo automatico (Claude Code only)"
+            echo "    --targets=<lista>         Plataformas separadas por virgula"
+            echo "    --create-project          Instalar estrutura no projeto"
+            echo "    -s, --skip-project        Nao perguntar sobre projeto"
+            echo "    -q, --quiet               Modo silencioso"
+            echo "    --dry-run                 Mostra adapters/stubs resolvidos sem modificar arquivos"
+            echo "    --cleanup-legacy          (Redundante) Limpeza agora e automatica"
+            echo "    --local                   (Removido) Thin-client obrigatorio, zero IP no client"
+            echo "    --server-url=<url>        URL do server Neocortex (padrao: api.neocortex.sh)"
+            echo "    -d, --debug               Modo debug"
+            echo "    -h, --help                Mostra esta ajuda"
+            echo ""
+            echo "  Plataformas: claude-code, cursor, vscode, gemini, codex, antigravity, opencode, kimi, openclaw"
+            exit 0
+            ;;
+        *) shift ;;
+    esac
+done
+
+if ! is_interactive; then
+    AUTO_YES=true
+fi
+
+# =============================================================================
+# CORES E SIMBOLOS
+# =============================================================================
+
+if supports_colors && [ "$QUIET_MODE" = false ]; then
+    RED='\033[0;31m'
+    GREEN='\033[0;32m'
+    YELLOW='\033[1;33m'
+    BLUE='\033[0;34m'
+    MAGENTA='\033[0;35m'
+    CYAN='\033[0;36m'
+    WHITE='\033[1;37m'
+    GRAY='\033[0;90m'
+    BOLD='\033[1m'
+    DIM='\033[2m'
+    NC='\033[0m'
+else
+    RED='' GREEN='' YELLOW='' BLUE='' MAGENTA='' CYAN=''
+    WHITE='' GRAY='' BOLD='' DIM='' NC=''
+fi
+
+if supports_unicode; then
+    SYM_OK="✓"
+    SYM_FAIL="✗"
+    SYM_WARN="!"
+    SYM_ARROW="→"
+    SYM_DOT="·"
+    SYM_SPINNER_FRAMES=('⠋' '⠙' '⠹' '⠸' '⠼' '⠴' '⠦' '⠧' '⠇' '⠏')
+else
+    SYM_OK="ok"
+    SYM_FAIL="x"
+    SYM_WARN="!"
+    SYM_ARROW="->"
+    SYM_DOT="."
+    SYM_SPINNER_FRAMES=('|' '/' '-' '\')
+fi
+
+# =============================================================================
+# FUNCOES DE LOG
+# =============================================================================
+
+# Step header: [1/5] Installing core...
+step() {
+    local num=$1 total=$2 msg=$3
+    echo ""
+    echo -e "  ${BOLD}${CYAN}[$num/$total]${NC} ${BOLD}$msg${NC}"
+}
+
+# Success line
+ok() { echo -e "  ${GREEN}${SYM_OK}${NC} $1"; }
+
+# Warning line
+warn() { echo -e "  ${YELLOW}${SYM_WARN}${NC} $1"; }
+
+# Error line
+fail() { echo -e "  ${RED}${SYM_FAIL}${NC} $1"; }
+
+# Info line
+info() { echo -e "  ${DIM}${SYM_ARROW} $1${NC}"; }
+
+# Public-safe diagnostic helpers. Installer diagnostics must stay bounded and must
+# not print raw child output, private paths, tokens or vendor onboarding text.
+redact_public_text() {
+    local msg="${1:-}"
+    if [ -n "${HOME:-}" ]; then msg="${msg//$HOME/~}"; fi
+    if [ -n "${SOURCE_DIR:-}" ]; then msg="${msg//$SOURCE_DIR/<install-dir>}"; fi
+    if [ -n "${SCRIPT_DIR:-}" ]; then msg="${msg//$SCRIPT_DIR/<install-dir>}"; fi
+    if [ -n "${PWD:-}" ]; then msg="${msg//$PWD/<project-dir>}"; fi
+    printf '%s' "$msg" | sed -E \
+        -e 's#/home/[^[:space:]]+#<redacted-path>#g' \
+        -e 's#/Users/[^[:space:]]+#<redacted-path>#g' \
+        -e 's#/(tmp|media|mnt|workspace|workspaces)/[^[:space:]]+#<redacted-path>#g' \
+        -e 's#C:\\Users\\[^[:space:]]+#<redacted-path>#g' \
+        -e 's#[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}#<redacted-email>#g' \
+        -e 's#(^|[^A-Za-z0-9])(NX|ghp|github_pat|ctx7sk|sk|pk)[_-][A-Za-z0-9_.-]{8,}#\1<redacted-token>#g'
+}
+
+sanitize_diag_token() {
+    local value
+    value="$(redact_public_text "${1:-unknown}")"
+    value="$(printf '%s' "$value" | tr -c 'A-Za-z0-9_.:/-' '_')"
+    value="${value%%_}"
+    [ -n "$value" ] && printf '%s' "$value" || printf '%s' "unknown"
+}
+
+emit_installer_diagnostic() {
+    local tool phase status reason_code code signal timed_out retry_attempt timeout_ms summary doc_path
+    tool="$(sanitize_diag_token "${1:-neocortex}")"
+    phase="$(sanitize_diag_token "${2:-installer}")"
+    status="$(sanitize_diag_token "${3:-info}")"
+    reason_code="$(sanitize_diag_token "${4:-P177_PUBLIC_SAFE_LOG_REDACTED}")"
+    code="$(sanitize_diag_token "${5:-null}")"
+    signal="$(sanitize_diag_token "${6:-null}")"
+    timed_out="$(sanitize_diag_token "${7:-false}")"
+    retry_attempt="$(sanitize_diag_token "${8:-0}")"
+    timeout_ms="$(sanitize_diag_token "${9:-0}")"
+    summary="$(sanitize_diag_token "${10:-public_safe_bounded_diagnostic}")"
+    doc_path="$(sanitize_diag_token "${11:-docs/install/coderabbit-manual-setup.md}")"
+    echo "  [neocortex-installer] tool=${tool} phase=${phase} status=${status} reasonCode=${reason_code} code=${code} signal=${signal} timedOut=${timed_out} retryAttempt=${retry_attempt} timeoutMs=${timeout_ms} docPath=${doc_path} redactionReasonCode=P177_PUBLIC_SAFE_LOG_REDACTED summary=${summary}"
+}
+
+# Debug line
+debug() { [ "$DEBUG_MODE" = true ] && echo -e "  ${GRAY}[debug] $(redact_public_text "$1")${NC}"; }
+
+get_effective_uid() {
+    if [ -n "${NEOCORTEX_TEST_EFFECTIVE_UID:-}" ]; then
+        printf '%s\n' "$NEOCORTEX_TEST_EFFECTIVE_UID"
+        return 0
+    fi
+    if command -v id >/dev/null 2>&1; then
+        id -u 2>/dev/null || true
+        return 0
+    fi
+    printf '\n'
+}
+
+get_platform_name() {
+    if [ -n "${NEOCORTEX_TEST_UNAME:-}" ]; then
+        printf '%s\n' "$NEOCORTEX_TEST_UNAME"
+        return 0
+    fi
+    uname -s 2>/dev/null || printf '\n'
+}
+
+is_linux_platform() {
+    [ "$(get_platform_name)" = "Linux" ]
+}
+
+is_root_like_home() {
+    case "${1:-}" in
+        ""|"/"|"/root"|"/root/"*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+is_system_npm_prefix() {
+    case "${1:-}" in
+        "/usr"|"/usr/"*|"/usr/local"|"/usr/local/"*|"/opt"|"/opt/"*|"/root"|"/root/"*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+is_safe_nonroot_home() {
+    local candidate="${1:-}"
+    [ -n "$candidate" ] || return 1
+    is_root_like_home "$candidate" && return 1
+    case "$candidate" in
+        *$'\n'*|*":"*) return 1 ;;
+    esac
+    return 0
+}
+
+resolve_sudo_user_home() {
+    if [ -n "${NEOCORTEX_TEST_SUDO_HOME:-}" ]; then
+        printf '%s\n' "$NEOCORTEX_TEST_SUDO_HOME"
+        return 0
+    fi
+    [ -n "${SUDO_USER:-}" ] || return 1
+    [ "${SUDO_USER:-}" != "root" ] || return 1
+    if command -v getent >/dev/null 2>&1; then
+        getent passwd "$SUDO_USER" 2>/dev/null | cut -d: -f6
+        return 0
+    fi
+    return 1
+}
+
+warn_linux_root_home_context() {
+    is_linux_platform || return 0
+
+    local effective_uid sudo_context root_home system_prefix intended_home can_resolve_intended
+    effective_uid="$(get_effective_uid)"
+    sudo_context=false
+    root_home=false
+    system_prefix=false
+    can_resolve_intended=false
+
+    [ -n "${SUDO_USER:-}" ] && [ "${SUDO_USER:-}" != "root" ] && sudo_context=true
+    is_root_like_home "${HOME:-}" && root_home=true
+    is_system_npm_prefix "${npm_config_prefix:-}" && system_prefix=true
+
+    intended_home="$(resolve_sudo_user_home 2>/dev/null || true)"
+    if is_safe_nonroot_home "$intended_home"; then
+        can_resolve_intended=true
+    fi
+
+    if [ "$effective_uid" = "0" ] || [ "$sudo_context" = true ] || [ "$root_home" = true ] || [ "$system_prefix" = true ]; then
+        emit_installer_diagnostic "neocortex" "root-home-check" "warning" "P177_ROOT_HOME_DETECTED" "null" "null" "false" "0" "0" "root_home_context_detected" "docs/install/linux-global-install.md"
+        warn "P177_ROOT_HOME_DETECTED: Linux root/sudo install may write Neocortex user config under an elevated HOME."
+        info "Prefer a no-sudo npm user prefix or a Node version manager before retrying."
+        if [ "$sudo_context" = true ] && [ "$can_resolve_intended" = true ]; then
+            info "Intended-user HOME was detected but not printed; rerun without sudo or configure that user's npm prefix."
+            if [ "${NEOCORTEX_USE_SUDO_USER_HOME:-}" = "1" ] && [ "$effective_uid" != "0" ]; then
+                HOME="$intended_home"
+                export HOME
+                info "Using intended-user HOME because NEOCORTEX_USE_SUDO_USER_HOME=1 and the effective user is not root."
+            fi
+        else
+            info "Intended-user HOME unresolved [TBD]; review docs/install/linux-global-install.md before writing user config."
+        fi
+    fi
+}
+
+is_neocortex_source_project() {
+    local candidate_dir="$1"
+    local package_file="$candidate_dir/package.json"
+
+    [ -f "$package_file" ] || return 1
+    grep -q '"name"[[:space:]]*:[[:space:]]*"@ornexus/neocortex"' "$package_file" 2>/dev/null || return 1
+    [ -d "$candidate_dir/core" ] || return 1
+    [ -d "$candidate_dir/packages/server" ] || return 1
+    [ -d "$candidate_dir/targets-stubs" ] || return 1
+    [ -f "$candidate_dir/install.sh" ] || return 1
+
+    return 0
+}
+
+resolve_target_dir() {
+    local target="$1"
+    local stub_dir="$SOURCE_DIR/targets-stubs/$target"
+    local dev_dir="$SOURCE_DIR/targets/$target"
+
+    [ "$target" = "gemini" ] && stub_dir="$SOURCE_DIR/targets-stubs/gemini-cli" && dev_dir="$SOURCE_DIR/targets/gemini-cli"
+
+    if [ -d "$stub_dir" ]; then
+        printf '%s\n' "$stub_dir"
+        return 0
+    fi
+
+    if is_neocortex_source_project "$SOURCE_DIR" && [ -d "$dev_dir" ]; then
+        debug "Fallback dev targets/ para $target: $dev_dir"
+        printf '%s\n' "$dev_dir"
+        return 0
+    fi
+
+    warn "$target ${DIM}(adapter nao encontrado; paths tentados: $stub_dir, $dev_dir)${NC}"
+    return 1
+}
+
+resolve_target_adapter_script() {
+    local target="$1"
+    local adapter_name="$target"
+    [ "$target" = "gemini-cli" ] && adapter_name="gemini"
+
+    local target_dir
+    target_dir=$(resolve_target_dir "$target") || return 1
+    local adapter_script="$target_dir/install-${adapter_name}.sh"
+    if [ -f "$adapter_script" ]; then
+        printf '%s\n' "$adapter_script"
+        return 0
+    fi
+    warn "$target ${DIM}(adapter nao encontrado; path tentado: $adapter_script)${NC}"
+    return 1
+}
+
+# Spinner for background tasks
+run_with_spinner() {
+    local msg="$1"
+    shift
+    "$@" &
+    local pid=$!
+    local i=0
+    local len=${#SYM_SPINNER_FRAMES[@]}
+
+    while kill -0 "$pid" 2>/dev/null; do
+        printf "\r  ${CYAN}%s${NC} %s" "${SYM_SPINNER_FRAMES[$((i % len))]}" "$msg"
+        i=$((i + 1))
+        sleep 0.08
+    done
+
+    wait "$pid"
+    local exit_code=$?
+
+    if [ $exit_code -eq 0 ]; then
+        printf "\r  ${GREEN}${SYM_OK}${NC} %s\n" "$msg"
+    else
+        printf "\r  ${RED}${SYM_FAIL}${NC} %s\n" "$msg"
+    fi
+
+    return $exit_code
+}
+
+# =============================================================================
+# FUNCOES DE COPIA (silenciosas - sem log individual)
+# =============================================================================
+
+copy_file() {
+    local src="$1" dest="$2"
+    debug "Copiando: $src -> $dest"
+    if [ -f "$src" ]; then
+        cp "$src" "$dest" 2>/dev/null
+    else
+        debug "Arquivo nao encontrado: $src"
+        return 1
+    fi
+}
+
+copy_dir() {
+    local src="$1" dest="$2"
+    debug "Copiando dir: $src -> $dest"
+    [ -d "$src" ] && cp -r "$src" "$dest" 2>/dev/null
+}
+
+# Patch description tier in any agent file (YAML frontmatter or Markdown H1)
+# Usage: patch_description_tier <file>
+# Reads tier from ~/.neocortex/config.json and replaces ANY tier label with actual tier.
+# Supports: (Free) <-> (Pro) <-> (Enterprise) in any direction.
+# Works on both frontmatter description and banner body lines.
+patch_description_tier() {
+    local target_file="$1"
+    local config_file="${HOME}/.neocortex/config.json"
+
+    [ -f "$target_file" ] || return 0
+    [ -f "$config_file" ] || return 0
+
+    local tier
+    tier=$(cat "$config_file" 2>/dev/null | grep -o '"tier"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')
+    [ -n "$tier" ] || return 0
+
+    local tier_label
+    case "$tier" in
+        free)       tier_label="Free" ;;
+        pro)        tier_label="Pro" ;;
+        enterprise) tier_label="Enterprise" ;;
+        *)          return 0 ;;
+    esac
+
+    # Replace ANY tier label with the correct one in non-banner lines
+    # (frontmatter description, body text, H1 headers, etc.)
+    # Each sed expression replaces one possible source tier with the target tier.
+    # If source == target, sed is a no-op (replaces X with X). This is correct.
+    sed -i.bak \
+        -e "s/(Free)/(${tier_label})/g" \
+        -e "s/(Pro)/(${tier_label})/g" \
+        -e "s/(Enterprise)/(${tier_label})/g" \
+        "$target_file" 2>/dev/null
+    rm -f "${target_file}.bak" 2>/dev/null
+
+    # Fix banner alignment: the OrNexus Team line has a fixed 62-char frame.
+    # After replacing tier labels of different lengths, re-pad to maintain alignment.
+    # Pattern: "│ ##   ###  ######  ##    OrNexus Team (Tier)<spaces>│"
+    # Inner width must be exactly 60 chars (│ + 60 + │ = 62).
+    if grep -q "OrNexus Team (${tier_label})" "$target_file" 2>/dev/null; then
+        local prefix="│ ##   ###  ######  ##    "  # 25 chars inner prefix
+        local content="OrNexus Team (${tier_label})"
+        local content_len=${#content}
+        local pad_len=$((60 - 25 - content_len))
+        local padding=""
+        local i
+        for ((i=0; i<pad_len; i++)); do padding="${padding} "; done
+        local new_line="${prefix}${content}${padding}│"
+        # Replace the (possibly misaligned) banner line with the correctly padded one
+        sed -i.bak -e "s|│ ##   ###  ######  ##    OrNexus Team ([^)]*).*│|${new_line}|" "$target_file" 2>/dev/null
+        rm -f "${target_file}.bak" 2>/dev/null
+    fi
+
+    debug "Tier patched to (${tier_label}) in $(basename "$target_file")"
+}
+
+# =============================================================================
+# DETECCAO DE VERSAO ANTIGA
+# =============================================================================
+
+detect_old_installation() {
+    debug "Verificando instalacoes antigas..."
+
+    local dest_dir="${HOME}/.claude/agents/neocortex"
+
+    if [ -f "$dest_dir/.version" ]; then
+        INSTALLED_VERSION=$(cat "$dest_dir/.version" 2>/dev/null)
+        local new_version=""
+        if [ -f "$SOURCE_DIR/package.json" ]; then
+            new_version=$(grep '"version"' "$SOURCE_DIR/package.json" 2>/dev/null | head -1 | sed 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+        fi
+        if [ -n "$INSTALLED_VERSION" ] && [ -n "$new_version" ]; then
+            if [ "$INSTALLED_VERSION" = "$new_version" ]; then
+                info "Reinstalando v$new_version"
+            else
+                info "Atualizando v$INSTALLED_VERSION ${SYM_ARROW} v$new_version"
+            fi
+        fi
+    fi
+
+    # Check for old files
+    local old_files=()
+    if [ -f "$dest_dir/step-registry.json" ]; then
+        if ! grep -q "state.json" "$dest_dir/workflow.md" 2>/dev/null; then
+            old_files+=("workflow antigo")
+        fi
+    fi
+
+    if grep -r "orchestrator.db" "$dest_dir" 2>/dev/null | grep -v "backup" | grep -v "migrated" > /dev/null; then
+        old_files+=("referencias SQLite")
+    fi
+
+    if [ ${#old_files[@]} -gt 0 ]; then
+        MIGRATION_DETECTED=true
+        MIGRATION_SOURCES="${old_files[*]}"
+        debug "Detectado: $MIGRATION_SOURCES"
+    fi
+}
+
+# =============================================================================
+# LIMPEZA AUTOMATICA DE ARTEFATOS LEGADOS (auto_cleanup_legacy)
+# Unifica: detect_legacy_artifacts + cleanup_legacy_artifacts + cleanup_legacy_ip
+#          + cleanup_legacy_ip_project + npm globals + cross-platform cleanup
+# Roda AUTOMATICAMENTE a cada instalacao - sem necessidade de --cleanup-legacy
+# Idempotente: rodar multiplas vezes sem efeitos colaterais
+# Seguro: NAO remove dados do usuario (stories, epics, state.json, config.json)
+# =============================================================================
+
+auto_cleanup_legacy() {
+    local removed=0
+    local claude_dir="$HOME/.claude"
+    local neocortex_dir="$claude_dir/agents/neocortex"
+    local skills_dir="$claude_dir/skills/neocortex"
+
+    debug "Executando limpeza automatica de artefatos legados..."
+
+    # ─── Helper: remove e loga ───────────────────────────────────────────
+    _remove_legacy() {
+        local target="$1"
+        local label="$2"
+        if [ -e "$target" ]; then
+            local display="${target/#$HOME/~}"
+            if rm -rf "$target" 2>/dev/null; then
+                info "Removido: $display ($label)"
+                removed=$((removed + 1))
+            else
+                debug "Falha ao remover: $display"
+            fi
+        fi
+    }
+
+    # ─── Categoria 1: Pacotes NPM globais legados ────────────────────────
+    if command -v npm >/dev/null 2>&1; then
+        # Verificar e remover pacotes npm globais legados
+        for pkg in "@ornexus/neocortex-cli" "@ornexus-ai/neocortex"; do
+            if npm list -g "$pkg" --depth=0 2>/dev/null | grep -q "$pkg"; then
+                if npm uninstall -g "$pkg" 2>/dev/null; then
+                    info "Removido: $pkg (pacote npm global legado)"
+                    removed=$((removed + 1))
+                else
+                    debug "Falha ao remover pacote npm: $pkg"
+                fi
+            fi
+        done
+
+        # Verificar binario neocortex-cli no PATH
+        local ncli_path
+        ncli_path=$(command -v neocortex-cli 2>/dev/null || true)
+        if [ -n "$ncli_path" ]; then
+            # Verificar se e um link/binario npm (nao remover se for outro tool)
+            if [[ "$ncli_path" == *"node_modules"* ]] || [[ "$ncli_path" == *"npm"* ]]; then
+                rm -f "$ncli_path" 2>/dev/null && {
+                    info "Removido: $ncli_path (binario neocortex-cli legado)"
+                    removed=$((removed + 1))
+                }
+            fi
+        fi
+    fi
+
+    # ─── Categoria 2: Claude Code (~/.claude/) ────────────────────────────
+    # IP proprietaria de versoes anteriores
+    _remove_legacy "$neocortex_dir/core"             "IP legada"
+    _remove_legacy "$skills_dir"                     "skills legadas"
+    _remove_legacy "$neocortex_dir/workflow.md"      "workflow removido no Tier 3"
+    _remove_legacy "$neocortex_dir/package.json"     "arquivo desnecessario"
+    _remove_legacy "$neocortex_dir/README.md"        "arquivo desnecessario"
+
+    # Step folders legados
+    for folder in steps-c steps-e steps-p steps-r steps-u; do
+        _remove_legacy "$neocortex_dir/$folder"      "steps legados"
+    done
+
+    # Artefatos de instalacoes anteriores
+    _remove_legacy "$claude_dir/agents/.git"         "repo git antigo"
+    _remove_legacy "$claude_dir/.claude"             "diretorio aninhado (erro BMAD)"
+    _remove_legacy "$claude_dir/agents-ldtn"         "diretorio legado"
+    _remove_legacy "$claude_dir/.superclaude-metadata.json" "metadata SuperClaude"
+
+    # Backups SuperClaude antigos
+    if [ -d "$claude_dir/backups" ]; then
+        for f in "$claude_dir/backups"/superclaude_backup_*.tar.gz; do
+            [ -f "$f" ] || continue
+            _remove_legacy "$f"                      "backup SuperClaude antigo"
+        done
+    fi
+
+    # ─── Categoria 3: Cursor ──────────────────────────────────────────────
+    _remove_legacy "$HOME/.cursor/neocortex"         "configs Cursor legadas"
+    # .cursorrules com referencias neocortex (verificar antes de remover)
+    if [ -f "$HOME/.cursorrules" ]; then
+        if grep -qi "neocortex\|ornexus\|synapse" "$HOME/.cursorrules" 2>/dev/null; then
+            _remove_legacy "$HOME/.cursorrules"      "cursorrules com refs legadas"
+        fi
+    fi
+
+    # ─── Categoria 4: VS Code ─────────────────────────────────────────────
+    _remove_legacy "$HOME/.vscode/neocortex"         "configs VS Code legadas"
+    # .instructions.md com referencias neocortex antigo
+    if [ -f "$HOME/.instructions.md" ]; then
+        if grep -qi "neocortex\|ornexus\|synapse" "$HOME/.instructions.md" 2>/dev/null; then
+            _remove_legacy "$HOME/.instructions.md"  "instructions.md com refs legadas"
+        fi
+    fi
+
+    # ─── Categoria 5: Gemini CLI ──────────────────────────────────────────
+    _remove_legacy "$HOME/.gemini/neocortex"         "configs Gemini legadas"
+
+    # ─── Categoria 6: Codex ───────────────────────────────────────────────
+    _remove_legacy "$HOME/.codex/neocortex"          "configs Codex legadas"
+
+    # ─── Categoria 7: Antigravity ─────────────────────────────────────────
+    # Configs legadas de Antigravity sao gerenciadas pelo adapter, sem path fixo global
+
+    # ─── Categoria 8: Plaintext cache cleanup (Epic 62 - GAP 1) ─────────
+    local cache_dir="$HOME/.neocortex/cache"
+    if [ -d "$cache_dir" ]; then
+        # Remove plaintext menu-cache.json
+        _remove_legacy "$cache_dir/menu-cache.json" "cache plaintext (menu)"
+
+        # Remove any non-.enc files in cache dir (excluding directories)
+        for cache_file in "$cache_dir"/*; do
+            [ -f "$cache_file" ] || continue
+            case "$cache_file" in
+                *.enc) continue ;;  # Keep encrypted cache files
+                *) _remove_legacy "$cache_file" "cache plaintext" ;;
+            esac
+        done
+    fi
+
+    # ─── Resultado ────────────────────────────────────────────────────────
+    if [ $removed -gt 0 ]; then
+        ok "$removed artefato(s) legado(s) removido(s) automaticamente"
+    else
+        debug "Nenhum artefato legado encontrado"
+    fi
+
+    # Resetar contadores legados (compatibilidade)
+    LEGACY_ITEMS=""
+    LEGACY_WARNINGS=0
+
+    return 0
+}
+
+# Cleanup de IP legada em projetos individuais (project-level)
+auto_cleanup_legacy_project() {
+    local project_dir="$1"
+    local neocortex_dir="$project_dir/.claude/agents/neocortex"
+    local skills_dir="$project_dir/.claude/skills/neocortex"
+    local cleaned=false
+
+    # Remover core/ e seus subdiretorios
+    if [ -d "$neocortex_dir/core" ]; then
+        rm -rf "$neocortex_dir/core"
+        cleaned=true
+    fi
+
+    # Remover step folders
+    for folder in steps-c steps-e steps-p steps-r steps-u; do
+        if [ -d "$neocortex_dir/$folder" ]; then
+            rm -rf "$neocortex_dir/$folder"
+            cleaned=true
+        fi
+    done
+
+    # Remover skills
+    if [ -d "$skills_dir" ]; then
+        rm -rf "$skills_dir"
+        cleaned=true
+    fi
+
+    # Remover arquivos desnecessarios
+    for file in package.json README.md workflow.md; do
+        if [ -f "$neocortex_dir/$file" ]; then
+            rm -f "$neocortex_dir/$file"
+            cleaned=true
+        fi
+    done
+
+    if [ "$cleaned" = true ]; then
+        info "IP proprietaria removida do projeto (agora servida via server remoto)"
+    fi
+}
+
+detect_project_migration_needs() {
+    local migration_needed=false
+    local sources=()
+
+    [ -f ".neocortex/orchestrator.db" ] && { migration_needed=true; sources+=("orchestrator.db"); }
+    for yaml_path in "bmad-output/sprint-status.yaml" ".neocortex/sprint-status.yaml" "docs/sprint-status.yaml"; do
+        [ -f "$yaml_path" ] && { migration_needed=true; sources+=("$yaml_path"); }
+    done
+
+    if [ "$migration_needed" = true ]; then
+        echo "${sources[*]}"
+        return 0
+    fi
+    return 1
+}
+
+# =============================================================================
+# BANNER
+# =============================================================================
+
+show_banner() {
+    [ "$QUIET_MODE" = true ] && return
+    [ "$NO_BANNER" = true ] && return
+
+    echo ""
+    echo -e "${CYAN}       #######${NC}"
+    echo -e "${CYAN}      ###  ########${NC}"
+    echo -e "${CYAN} #########      #####${NC}"
+    echo -e "${CYAN} ##    ##############    ${BOLD}N E O C O R T E X${NC}"
+    echo -e "${CYAN} ##   ###  ######  ##    ${BOLD}v${VERSION}${NC}"
+    echo -e "${CYAN} ##   ###    ###   ##${NC}"
+    echo -e "${CYAN} ##  ######  ###   ##    ${DIM}OrNexus Team${NC}"
+    echo -e "${CYAN} ###############   ##${NC}"
+    echo -e "${CYAN} #####       ########${NC}"
+    echo -e "${CYAN}   ########  ##${NC}"
+    echo -e "${CYAN}        #######${NC}"
+    echo ""
+}
+
+# =============================================================================
+# DETECCAO DO DIRETORIO FONTE
+# =============================================================================
+
+detect_source_dir() {
+    if [ -n "${BASH_SOURCE[0]}" ]; then
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+    elif [ -n "$0" ]; then
+        SCRIPT_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+    else
+        SCRIPT_DIR="$PWD"
+    fi
+
+    local source_found=false
+    if [ -f "$SCRIPT_DIR/targets-stubs/claude-code/neocortex.md" ] || \
+       [ -f "$SCRIPT_DIR/neocortex.md" ]; then
+        source_found=true
+    else
+        for possible_dir in \
+            "$SCRIPT_DIR" \
+            "$(npm root -g 2>/dev/null)/@ornexus/neocortex" \
+            "$(npm root -g 2>/dev/null)/neocortex" \
+            "$(dirname "$0")" \
+            "$PWD/node_modules/@ornexus/neocortex" \
+            "$PWD/node_modules/neocortex" \
+            "$HOME/.npm/_npx/"*"/node_modules/@ornexus/neocortex" \
+            "$HOME/.npm/_npx/"*"/node_modules/neocortex"; do
+            if [ -f "$possible_dir/targets-stubs/claude-code/neocortex.md" ] 2>/dev/null || \
+               [ -f "$possible_dir/neocortex.md" ] 2>/dev/null; then
+                SCRIPT_DIR="$possible_dir"
+                source_found=true
+                break
+            fi
+        done
+    fi
+
+    SOURCE_DIR="$SCRIPT_DIR"
+    debug "Source: $SOURCE_DIR"
+
+    # Epic 65: Emit visible warning when stubs cannot be found
+    if [ "$source_found" = false ]; then
+        warn "Arquivos de instalacao (stubs) nao encontrados em nenhum path conhecido"
+        warn "SCRIPT_DIR: $SCRIPT_DIR"
+        warn "Tente reinstalar: npm install -g @ornexus/neocortex"
+    fi
+}
+
+show_target_resolution_dry_run() {
+    local targets="$1"
+    targets=$(echo "$targets" | tr ',' ' ')
+    info "Dry-run: nenhum arquivo do usuario sera modificado"
+    for target in $targets; do
+        local resolved
+        if resolved=$(resolve_target_dir "$target"); then
+            info "Dry-run target=$target adapter=$resolved scope=published-stub"
+            case "$target" in
+                cursor)
+                    info "Dry-run MCP target=cursor file=${CURSOR_HOME:-$HOME/.cursor}/mcp.json root=mcpServers managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=add-or-update-preserve-custom"
+                    ;;
+                vscode)
+                    local vscode_mcp
+                    if [ -n "$VSCODE_MCP_FILE" ]; then vscode_mcp="$VSCODE_MCP_FILE"; elif [ "$(uname -s 2>/dev/null)" = "Darwin" ]; then vscode_mcp="$HOME/Library/Application Support/Code/User/mcp.json"; else vscode_mcp="${XDG_CONFIG_HOME:-$HOME/.config}/Code/User/mcp.json"; fi
+                    info "Dry-run MCP target=vscode file=$vscode_mcp root=servers managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=add-or-update-preserve-custom"
+                    ;;
+                gemini|gemini-cli)
+                    info "Dry-run MCP target=gemini file=${GEMINI_HOME:-$HOME/.gemini}/settings.json root=mcpServers managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=add-or-update-preserve-custom"
+                    ;;
+                codex)
+                    info "Dry-run MCP target=codex file=${CODEX_HOME:-$HOME/.codex}/config.toml root=mcp_servers managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=replace-managed-sections-preserve-unknown"
+                    ;;
+                opencode)
+                    info "Dry-run MCP target=opencode file=${OPENCODE_HOME:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}/opencode.json root=mcp managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=add-or-update-preserve-custom"
+                    ;;
+                kimi)
+                    info "Dry-run MCP target=kimi file=${KIMI_HOME:-$HOME/.kimi}/mcp.json root=mcpServers managed=playwright,context7,browser_use,figma,shadcn,chrome-devtools action=add-or-update-preserve-custom"
+                    ;;
+                openclaw)
+                    info "Dry-run Skill target=openclaw file=${OPENCLAW_HOME:-$HOME/.openclaw}/skills/neocortex/SKILL.md action=copy-skill-preserve-openclaw-json config=${OPENCLAW_HOME:-$HOME/.openclaw}/openclaw.json non-overwrite"
+                    info "Dry-run project target=openclaw file=.openclaw/skills/neocortex/SKILL.md action=copy-skill-when-create-project"
+                    ;;
+            esac
+        else
+            info "Dry-run target=$target adapter=NOT_FOUND"
+        fi
+    done
+}
+
+# =============================================================================
+# TIER 3: CONFIG DO THIN CLIENT
+# =============================================================================
+
+setup_thin_client_config() {
+    local config_dir="${HOME}/.neocortex"
+    local config_file="${config_dir}/config.json"
+
+    mkdir -p "$config_dir" 2>/dev/null
+    mkdir -p "$config_dir/cache" 2>/dev/null
+
+    # Story 61.4 - F4 remediation: restrictive permissions
+    chmod 700 "$config_dir" 2>/dev/null
+    chmod 700 "$config_dir/cache" 2>/dev/null
+
+    if [ -f "$config_file" ]; then
+        # Preservar config existente, atualizar apenas serverUrl se necessario
+        local existing_mode
+        existing_mode=$(grep '"mode"' "$config_file" 2>/dev/null | head -1 | sed 's/.*"mode"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+
+        if [ "$existing_mode" = "active" ] || [ "$existing_mode" = "local" ] || [ "$existing_mode" = "remote" ]; then
+            # ─── Config schema migration (Epic 62 - GAP 4) ────────────────
+            # Check if config needs schema migration
+            local has_config_version
+            has_config_version=$(grep '"configVersion"' "$config_file" 2>/dev/null)
+            if [ -z "$has_config_version" ]; then
+                debug "Migrando schema do config.json (adicionando configVersion)"
+                if command -v node >/dev/null 2>&1; then
+                    node -e "
+const fs = require('fs');
+const path = '$config_file';
+try {
+    const cfg = JSON.parse(fs.readFileSync(path, 'utf-8'));
+    // Add configVersion
+    cfg.configVersion = 1;
+    // Remove known obsolete fields from old base template
+    delete cfg.version;
+    delete cfg.cache;
+    // Clean obsolete tier:3 from old base template (preserve real tier values)
+    if (cfg.tier === 3 && cfg.mode === 'pending-activation') {
+        delete cfg.tier;
+    }
+    fs.writeFileSync(path, JSON.stringify(cfg, null, 2) + '\n');
+}" 2>/dev/null
+                    chmod 600 "$config_file" 2>/dev/null
+                    debug "Config migrada para configVersion 1"
+                fi
+            fi
+            # ─── Fix stale localhost serverUrl (Epic 70 - Story 70.02) ────
+            # If config has localhost serverUrl and installer has production URL,
+            # update serverUrl while preserving all other config fields.
+            local existing_server_url
+            existing_server_url=$(grep '"serverUrl"' "$config_file" 2>/dev/null | head -1 | sed 's/.*"serverUrl"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+
+            if echo "$existing_server_url" | grep -qE '^https?://(localhost|127\.0\.0\.1|0\.0\.0\.0)(:[0-9]+)?'; then
+                if [ "$NEOCORTEX_SERVER_URL" != "$existing_server_url" ]; then
+                    debug "Fixing stale localhost serverUrl: $existing_server_url -> $NEOCORTEX_SERVER_URL"
+                    if command -v node >/dev/null 2>&1; then
+                        node -e "
+const fs = require('fs');
+const p = '$config_file';
+try {
+    const raw = fs.readFileSync(p, 'utf-8').replace(/^\uFEFF/, '');
+    const cfg = JSON.parse(raw);
+    cfg.serverUrl = '${NEOCORTEX_SERVER_URL}';
+    fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + '\n');
+}" 2>/dev/null
+                        chmod 600 "$config_file" 2>/dev/null
+                        debug "serverUrl updated to $NEOCORTEX_SERVER_URL"
+                    fi
+                fi
+            fi
+
+            # ─── Fix stale legacy serverUrl (Epic P46 - Story P46.03) ────
+            # If config has a deprecated API host, update to api.neocortex.sh.
+            local legacy_server_host
+            legacy_server_host="$(printf '%s.%s.%s.%s' api neocortex ornexus com)"
+            if echo "$existing_server_url" | grep -qF "$legacy_server_host"; then
+                debug "Fixing legacy serverUrl: $existing_server_url -> $NEOCORTEX_SERVER_URL"
+                if command -v node >/dev/null 2>&1; then
+                    node -e "
+const fs = require('fs');
+const p = '$config_file';
+try {
+    const raw = fs.readFileSync(p, 'utf-8').replace(/^\uFEFF/, '');
+    const cfg = JSON.parse(raw);
+    cfg.serverUrl = '${NEOCORTEX_SERVER_URL}';
+    fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + '\n');
+}" 2>/dev/null
+                    chmod 600 "$config_file" 2>/dev/null
+                    debug "serverUrl updated from legacy host to $NEOCORTEX_SERVER_URL"
+                fi
+            fi
+
+            # Story 61.4 - ensure permissions are always enforced even on existing configs
+            chmod 600 "$config_file" 2>/dev/null
+            debug "Config existente preservada (mode=$existing_mode)"
+            return 0
+        fi
+    fi
+
+    # Criar config base para thin client
+    cat > "$config_file" << EOFCONFIG
+{
+  "configVersion": 1,
+  "mode": "pending-activation",
+  "serverUrl": "${NEOCORTEX_SERVER_URL}",
+  "resilience": {
+    "circuitBreaker": true,
+    "maxRetries": 3,
+    "timeoutMs": 5000
+  },
+  "installedAt": "$(date -Iseconds 2>/dev/null || date '+%Y-%m-%dT%H:%M:%S')",
+  "installerVersion": "${VERSION}"
+}
+EOFCONFIG
+
+    # Story 61.4 - F4 remediation: config file readable only by owner
+    chmod 600 "$config_file" 2>/dev/null
+
+    debug "Thin client config criada: $config_file"
+}
+
+# cleanup_legacy_ip_project() substituida por auto_cleanup_legacy_project()
+# (definida na secao de limpeza automatica acima)
+
+# =============================================================================
+# INSTALACAO CORE
+# =============================================================================
+
+install_core() {
+    local errors=0
+
+    CLAUDE_DIR="${HOME}/.claude"
+    AGENTS_DIR="${CLAUDE_DIR}/agents"
+    DEST_DIR="${AGENTS_DIR}/neocortex"
+
+    debug "HOME=$HOME | DEST=$DEST_DIR | MODE=thin-client"
+
+    # Create directories
+    if [ ! -d "$CLAUDE_DIR" ]; then
+        mkdir -p "$CLAUDE_DIR" 2>/dev/null || { fail "Falha ao criar $CLAUDE_DIR"; return 1; }
+    fi
+    mkdir -p "$AGENTS_DIR" 2>/dev/null || { fail "Falha ao criar $AGENTS_DIR"; return 1; }
+
+    # Clean previous installation
+    if [ -d "$DEST_DIR" ]; then
+        rm -rf "$DEST_DIR" 2>/dev/null
+        debug "Instalacao anterior removida"
+    fi
+    mkdir -p "$DEST_DIR" 2>/dev/null || { fail "Falha ao criar $DEST_DIR"; return 1; }
+
+    # Thin-client ONLY: zero IP on client, all content from server
+    setup_thin_client_config
+
+    # ─── Version-aware cache purge on upgrade (Epic 62 - GAP 2+3) ───────
+    local pkg_version=""
+    if [ -f "$SOURCE_DIR/package.json" ]; then
+        pkg_version=$(grep '"version"' "$SOURCE_DIR/package.json" 2>/dev/null | head -1 | sed 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+    fi
+
+    if [ -n "$pkg_version" ]; then
+        local old_version=""
+        # Read existing .version from either location
+        if [ -f "$DEST_DIR/.version" ]; then
+            old_version=$(cat "$DEST_DIR/.version" 2>/dev/null | tr -d '[:space:]')
+        elif [ -f "$HOME/.neocortex/.version" ]; then
+            old_version=$(cat "$HOME/.neocortex/.version" 2>/dev/null | tr -d '[:space:]')
+        fi
+
+        # If version changed, purge all cache files
+        if [ -n "$old_version" ] && [ "$old_version" != "$pkg_version" ]; then
+            local cache_dir="$HOME/.neocortex/cache"
+            if [ -d "$cache_dir" ]; then
+                local purged=0
+                # Remove all .enc files
+                for enc_file in "$cache_dir"/*.enc; do
+                    [ -f "$enc_file" ] || continue
+                    rm -f "$enc_file" 2>/dev/null && purged=$((purged + 1))
+                done
+                # Remove menu-cache.json (redundancy with 62.1)
+                [ -f "$cache_dir/menu-cache.json" ] && rm -f "$cache_dir/menu-cache.json" 2>/dev/null && purged=$((purged + 1))
+                # Remove any other non-directory files
+                for cache_file in "$cache_dir"/*; do
+                    [ -f "$cache_file" ] || continue
+                    rm -f "$cache_file" 2>/dev/null && purged=$((purged + 1))
+                done
+                [ $purged -gt 0 ] && info "Cache purgado: versao alterada de $old_version para $pkg_version ($purged arquivo(s))"
+            fi
+        fi
+
+        # Write version file
+        echo "$pkg_version" > "$DEST_DIR/.version"
+    fi
+
+    if [ $errors -eq 0 ]; then
+        ok "Remote mode configured ${DIM}(thin client ready)${NC}"
+    else
+        fail "Core instalado com erros"
+    fi
+
+    return $errors
+}
+
+# =============================================================================
+# INSTALACAO DE SKILLS
+# =============================================================================
+
+install_skills() {
+    local errors=0
+
+    SKILLS_DIR="${CLAUDE_DIR}/skills"
+    SKILLS_DEST="${SKILLS_DIR}/neocortex"
+    SKILLS_SOURCE="${SOURCE_DIR}/core/skills"
+
+    # Thin-client: skills delivered by remote server, never copied
+    ok "Skills: delivered by remote server"
+    return 0
+
+    mkdir -p "$SKILLS_DIR" 2>/dev/null || { fail "Falha ao criar $SKILLS_DIR"; return 1; }
+
+    # Clean previous
+    [ -d "$SKILLS_DEST" ] && rm -rf "$SKILLS_DEST" 2>/dev/null
+
+    if cp -r "$SKILLS_SOURCE" "$SKILLS_DEST" 2>/dev/null; then
+        # Count skills
+        local skill_count=0
+        for skill_file in "$SKILLS_DEST"/step-skills/*/*.md "$SKILLS_DEST"/domain-skills/*/*.md; do
+            if [ -f "$skill_file" ] && [[ "$(basename "$skill_file")" != "_template.md" ]]; then
+                ((skill_count++))
+            fi
+        done
+        ok "Skills instaladas ${DIM}($skill_count skills) [modo local]${NC}"
+    else
+        fail "Falha ao copiar skills"
+        ((errors++))
+    fi
+
+    return $errors
+}
+
+# =============================================================================
+# INSTALACAO DE AGENT (Claude Code)
+# =============================================================================
+
+install_agent() {
+    local errors=0
+
+    CLAUDE_TARGET_DIR="$SOURCE_DIR/targets-stubs/claude-code"
+    if [ ! -d "$CLAUDE_TARGET_DIR" ] && is_neocortex_source_project "$SOURCE_DIR" && [ -d "$SOURCE_DIR/targets/claude-code" ]; then
+        CLAUDE_TARGET_DIR="$SOURCE_DIR/targets/claude-code"
+    fi
+    if [ ! -d "$CLAUDE_TARGET_DIR" ]; then
+        CLAUDE_TARGET_DIR="$SOURCE_DIR"
+    fi
+
+    # Epic 65: Early validation — if neither source file exists, emit clear error
+    if [ ! -f "$CLAUDE_TARGET_DIR/neocortex.md" ] && [ ! -f "$CLAUDE_TARGET_DIR/neocortex.agent.yaml" ]; then
+        fail "Arquivos fonte nao encontrados para target claude-code em: $CLAUDE_TARGET_DIR"
+        fail "Diretorio de origem ($SOURCE_DIR) pode estar incompleto"
+        fail "Tente reinstalar: npm install -g @ornexus/neocortex"
+        return 2
+    fi
+
+    # Tier 3 Stub-Only: copiar apenas 2 arquivos de interface (stubs minimos)
+    copy_file "$CLAUDE_TARGET_DIR/neocortex.md" "$DEST_DIR/" || ((errors++))
+    copy_file "$CLAUDE_TARGET_DIR/neocortex.agent.yaml" "$DEST_DIR/" || ((errors++))
+
+    # Epic 65: Post-copy verification
+    if [ ! -f "$DEST_DIR/neocortex.md" ]; then
+        fail "neocortex.md nao encontrado no destino apos copia: $DEST_DIR/"
+        ((errors++))
+    fi
+    if [ ! -f "$DEST_DIR/neocortex.agent.yaml" ]; then
+        fail "neocortex.agent.yaml nao encontrado no destino apos copia: $DEST_DIR/"
+        ((errors++))
+    fi
+
+    # Dynamic description: patch tier from existing config (if activated)
+    patch_description_tier "$DEST_DIR/neocortex.md"
+    patch_description_tier "$DEST_DIR/neocortex.agent.yaml"
+
+    # Cleanup: remover workflow.md de instalacoes anteriores (v3.8 -> v3.9)
+    if [ -f "$DEST_DIR/workflow.md" ]; then
+        rm -f "$DEST_DIR/workflow.md"
+        [ "$QUIET_MODE" = false ] && echo "  Removed workflow.md (content now server-side)"
+    fi
+
+    # Thin-client ONLY: 2 stub files + server-side orchestration
+
+    return $errors
+}
+
+# =============================================================================
+# INSTALACAO DE TARGETS
+# =============================================================================
+
+install_targets() {
+    local targets="$1"
+    local target_errors=0
+    local target_count=0
+    local target_results=()
+
+    targets=$(echo "$targets" | tr ',' ' ')
+
+    for target in $targets; do
+        local func_target="$target"
+        [ "$target" = "gemini-cli" ] && func_target="gemini"
+        local func_name="install_$(echo "$func_target" | tr '-' '_')"
+        local adapter_script=""
+
+        case "$target" in
+            opencode)
+                local opencode_target="$SOURCE_DIR/targets-stubs/opencode"
+                local opencode_home="${OPENCODE_HOME:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}"
+                if [ -f "$opencode_target/neocortex.md" ] && [ -f "$opencode_target/neocortex-root.md" ]; then
+                    mkdir -p "$opencode_home/agents" 2>/dev/null
+                    if cp "$opencode_target/neocortex.md" "$opencode_home/agents/neocortex.md" 2>/dev/null && \
+                       cp "$opencode_target/neocortex-root.md" "$opencode_home/agents/neocortex-root.md" 2>/dev/null; then
+                        if [ -f "$opencode_target/opencode-mcp.json" ] && command -v node >/dev/null 2>&1; then
+                            node "$SOURCE_DIR/targets-stubs/lib/mcp-merge.js" json "$opencode_target/opencode-mcp.json" "$opencode_home/opencode.json" mcp OPENCODE || true
+                        fi
+                        patch_description_tier "$opencode_home/agents/neocortex.md"
+                        patch_description_tier "$opencode_home/agents/neocortex-root.md"
+                        target_results+=("$target:OK")
+                        ((target_count++))
+                        ok "${BOLD}opencode${NC} ${DIM}(root + subagent)${NC}"
+                    else
+                        target_results+=("$target:SKIP")
+                        warn "opencode ${DIM}(perfil indisponivel)${NC}"
+                    fi
+                else
+                    target_results+=("$target:SKIP")
+                    warn "opencode ${DIM}(root/subagent stubs nao encontrados)${NC}"
+                fi
+                continue
+                ;;
+            kimi)
+                local kimi_target="$SOURCE_DIR/targets-stubs/kimi"
+                local kimi_home="${KIMI_HOME:-$HOME/.kimi}"
+                if [ -f "$kimi_target/neocortex.md" ]; then
+                    mkdir -p "$kimi_home/skills/neocortex" "$HOME/.config/agents/skills/neocortex" 2>/dev/null
+                    local kimi_ok=0
+                    cp "$kimi_target/neocortex.md" "$kimi_home/skills/neocortex/SKILL.md" 2>/dev/null || kimi_ok=1
+                    cp "$kimi_target/neocortex.md" "$HOME/.config/agents/skills/neocortex/SKILL.md" 2>/dev/null || kimi_ok=1
+                    if [ -f "$kimi_target/mcp.json" ] && command -v node >/dev/null 2>&1; then
+                        node "$SOURCE_DIR/targets-stubs/lib/mcp-merge.js" json "$kimi_target/mcp.json" "$kimi_home/mcp.json" mcpServers KIMI || true
+                    fi
+                    if [ $kimi_ok -eq 0 ]; then
+                        patch_description_tier "$kimi_home/skills/neocortex/SKILL.md"
+                        patch_description_tier "$HOME/.config/agents/skills/neocortex/SKILL.md"
+                        target_results+=("$target:OK")
+                        ((target_count++))
+                        ok "${BOLD}kimi${NC} ${DIM}(native-needs-validation skill)${NC}"
+                    else
+                        target_results+=("$target:SKIP")
+                        warn "kimi ${DIM}(perfil indisponivel)${NC}"
+                    fi
+                else
+                    target_results+=("$target:SKIP")
+                    warn "kimi ${DIM}(adapter nao encontrado)${NC}"
+                fi
+                continue
+                ;;
+            openclaw)
+                local openclaw_target="$SOURCE_DIR/targets-stubs/openclaw"
+                local openclaw_home="${OPENCLAW_HOME:-$HOME/.openclaw}"
+                local openclaw_dest="$openclaw_home/skills/neocortex"
+                if [ -f "$openclaw_target/SKILL.md" ]; then
+                    mkdir -p "$openclaw_dest" 2>/dev/null
+                    if cp "$openclaw_target/SKILL.md" "$openclaw_dest/SKILL.md" 2>/dev/null; then
+                        patch_description_tier "$openclaw_dest/SKILL.md"
+                        target_results+=("$target:OK")
+                        ((target_count++))
+                        ok "${BOLD}openclaw${NC} ${DIM}(Skill thin-client; openclaw.json preservado)${NC}"
+                    else
+                        target_results+=("$target:SKIP")
+                        warn "openclaw ${DIM}(falha ao copiar Skill para $openclaw_dest/SKILL.md)${NC}"
+                    fi
+                else
+                    target_results+=("$target:SKIP")
+                    warn "openclaw ${DIM}(Skill stub nao encontrado; path tentado: $openclaw_target/SKILL.md)${NC}"
+                fi
+                continue
+                ;;
+        esac
+
+        if ! adapter_script=$(resolve_target_adapter_script "$target"); then
+            if [ "$target" = "claude-code" ]; then
+                install_agent
+                local result=$?
+                if [ $result -eq 0 ]; then
+                    target_results+=("$target:OK")
+                    ((target_count++))
+                    ok "${BOLD}claude-code${NC} ${DIM}(thin client)${NC}"
+                else
+                    target_results+=("$target:FAIL")
+                    ((target_errors++))
+                    fail "claude-code"
+                fi
+                continue
+            fi
+
+            target_results+=("$target:SKIP")
+            ((target_errors++))
+            continue
+        fi
+
+        . "$adapter_script"
+
+        if type "$func_name" >/dev/null 2>&1; then
+            "$func_name" "$SOURCE_DIR" "$HOME"
+            local result=$?
+            if [ $result -eq 0 ]; then
+                target_results+=("$target:OK")
+                ((target_count++))
+                ok "${BOLD}$target${NC}"
+            else
+                target_results+=("$target:WARN")
+                warn "$target ${DIM}(instalado com avisos)${NC}"
+                ((target_count++))
+            fi
+        else
+            fail "$target ${DIM}(funcao $func_name nao encontrada)${NC}"
+            target_results+=("$target:FAIL")
+            ((target_errors++))
+        fi
+    done
+
+    TARGET_RESULTS=("${target_results[@]}")
+    TARGET_COUNT=$target_count
+
+    return $target_errors
+}
+
+# =============================================================================
+# CARREGAMENTO DE .ENV
+# =============================================================================
+
+load_env_file() {
+    local env_file=""
+    for possible_env in "./.env" "$SOURCE_DIR/.env"; do
+        [ -f "$possible_env" ] && { env_file="$possible_env"; break; }
+    done
+
+    if [ -n "$env_file" ] && [ -f "$env_file" ]; then
+        local loaded=0
+        while IFS='=' read -r key value || [ -n "$key" ]; do
+            [[ -z "$key" || "$key" =~ ^[[:space:]]*# ]] && continue
+            key=$(echo "$key" | xargs)
+            value=$(echo "$value" | xargs)
+            value="${value%\"}"; value="${value#\"}"
+            value="${value%\'}"; value="${value#\'}"
+            if [ -n "$value" ] && [ -z "${!key}" ]; then
+                export "$key=$value"
+                ((loaded++))
+            fi
+        done < "$env_file"
+        [ $loaded -gt 0 ] && info "$loaded variavel(eis) carregada(s) do .env"
+        return 0
+    fi
+    return 1
+}
+
+# =============================================================================
+# CONFIGURACAO DE TOKENS
+# =============================================================================
+
+prompt_tokens() {
+    [ "$QUIET_MODE" = true ] && return
+    [ -n "$CONTEXT7_API_KEY" ] && return
+
+    if [ "$AUTO_YES" = true ]; then
+        return
+    fi
+
+    echo ""
+    info "MCP Context7 nao configurado ${DIM}(opcional)${NC}"
+    echo -ne "  Configurar agora? ${BOLD}[s/N]:${NC} "
+
+    local response=""
+    if read -r -t 15 response 2>/dev/null; then
+        : # resposta recebida
+    else
+        echo ""
+        return
+    fi
+
+    if [[ "$response" =~ ^([sS][iI]?[mM]?|[yY][eE]?[sS]?)$ ]]; then
+        echo ""
+        info "Obtenha sua API Key em: ${WHITE}https://context7.com${NC}"
+        echo -ne "  Cole sua ${BOLD}CONTEXT7_API_KEY${NC}: "
+
+        local api_key=""
+        if read -r -t 60 api_key 2>/dev/null; then
+            if [[ "$api_key" =~ ^ctx7sk- ]]; then
+                export CONTEXT7_API_KEY="$api_key"
+                ok "CONTEXT7_API_KEY configurada"
+                echo ""
+                info "Para persistir: ${DIM}echo 'export CONTEXT7_API_KEY=\"$api_key\"' >> ~/.bashrc${NC}"
+            elif [ -n "$api_key" ]; then
+                warn "Formato invalido (esperado: ctx7sk-...)"
+            fi
+        fi
+    fi
+}
+
+# =============================================================================
+# INSTALACAO DE MCP SERVERS
+# =============================================================================
+
+install_mcps() {
+    if ! command -v claude >/dev/null 2>&1; then
+        warn "Claude CLI nao encontrado ${DIM}(MCPs Claude user-scope serao instalados depois; outros targets continuam)${NC}"
+        return 0
+    fi
+
+    local mcp_results=""
+    local browser_use_env_args=()
+
+    [ -n "${OPENAI_API_KEY:-}" ] && browser_use_env_args+=(-e "OPENAI_API_KEY=$OPENAI_API_KEY")
+    [ -n "${ANTHROPIC_API_KEY:-}" ] && browser_use_env_args+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
+
+    if claude mcp add --scope user playwright -- npx -y @playwright/mcp@latest 2>/dev/null; then
+        mcp_results="${mcp_results}playwright:OK "
+    else
+        mcp_results="${mcp_results}playwright:FAIL "
+    fi
+
+    if [ -n "${CONTEXT7_API_KEY:-}" ]; then
+        if claude mcp add --scope user --transport http context7 https://mcp.context7.com/mcp --header "CONTEXT7_API_KEY: $CONTEXT7_API_KEY" 2>/dev/null; then
+            mcp_results="${mcp_results}context7:OK "
+        else
+            mcp_results="${mcp_results}context7:FAIL "
+        fi
+    else
+        mcp_results="${mcp_results}context7:SKIP "
+    fi
+
+    # browser_use: optional (requires uvx and at least one supported LLM API key).
+    # Supported env vars are referenced by name only in logs: OPENAI_API_KEY,
+    # ANTHROPIC_API_KEY.
+    if [ ${#browser_use_env_args[@]} -gt 0 ]; then
+        if ! command -v uvx >/dev/null 2>&1; then
+            warn "uvx nao encontrado ${DIM}(Browser Use MCP requer uvx; instale uv/uvx e tente novamente)${NC}"
+            mcp_results="${mcp_results}browser_use:FAIL "
+        elif claude mcp add --scope user browser_use "${browser_use_env_args[@]}" -- uvx --from 'browser-use[cli]' browser-use --mcp 2>/dev/null; then
+            mcp_results="${mcp_results}browser_use:OK "
+        else
+            mcp_results="${mcp_results}browser_use:FAIL "
+        fi
+    else
+        mcp_results="${mcp_results}browser_use:SKIP "
+    fi
+
+    # Design/component MCPs follow the same baseline install pattern as
+    # Playwright because public target fragments include them by default.
+    if claude mcp add --scope user --transport http figma https://mcp.figma.com/mcp 2>/dev/null; then
+        mcp_results="${mcp_results}figma:OK "
+    else
+        mcp_results="${mcp_results}figma:FAIL "
+    fi
+
+    if claude mcp add --scope user shadcn -- npx shadcn@latest mcp 2>/dev/null; then
+        mcp_results="${mcp_results}shadcn:OK "
+    else
+        mcp_results="${mcp_results}shadcn:FAIL "
+    fi
+
+    if claude mcp add --scope user chrome-devtools -- npx -y chrome-devtools-mcp@latest 2>/dev/null; then
+        mcp_results="${mcp_results}chrome-devtools:OK "
+    else
+        mcp_results="${mcp_results}chrome-devtools:FAIL "
+    fi
+
+    # Show compact MCP results
+    local mcp_ok="" mcp_skip=""
+    for entry in $mcp_results; do
+        local name="${entry%%:*}"
+        local status="${entry##*:}"
+        case "$status" in
+            OK) mcp_ok="${mcp_ok}${name}, " ;;
+            SKIP) mcp_skip="${mcp_skip}${name}, " ;;
+        esac
+    done
+
+    [ -n "$mcp_ok" ] && ok "MCPs: ${DIM}${mcp_ok%, }${NC}"
+    [ -n "$mcp_skip" ] && info "MCPs pendentes: ${DIM}${mcp_skip%, }${NC}"
+
+    return 0
+}
+
+# =============================================================================
+# STATUS DO CODERABBIT CLI (OPCIONAL / MANUAL)
+# =============================================================================
+
+is_ci_environment() {
+    [ "${CI:-}" = "true" ] || [ "${GITHUB_ACTIONS:-}" = "true" ] || [ "${TF_BUILD:-}" = "true" ]
+}
+
+coderabbit_skip_reason() {
+    if is_ci_environment; then
+        printf '%s\n' "P177_OPTIONAL_TOOL_SKIPPED_CI"
+    elif ! is_interactive || [ "$AUTO_YES" = true ] || [ "$QUIET_MODE" = true ]; then
+        printf '%s\n' "P177_OPTIONAL_TOOL_SKIPPED_NONINTERACTIVE"
+    else
+        printf '%s\n' "P177_OPTIONAL_TOOL_OPT_IN_REQUIRED"
+    fi
+}
+
+optional_tool_info() {
+    echo -e "  ${DIM}${SYM_ARROW} $1${NC}"
+}
+
+report_coderabbit_status() {
+    if command -v coderabbit >/dev/null 2>&1; then
+        emit_installer_diagnostic "coderabbit" "optional-tool-setup" "detected" "P177_OPTIONAL_TOOL_DETECTED_MANUAL" "0" "null" "false" "0" "0" "manual_optional_tool_detected" "docs/install/coderabbit-manual-setup.md"
+        ok "CodeRabbit CLI ${DIM}(opcional/manual detectado)${NC}"
+        CODERABBIT_INSTALLED=true
+        return 0
+    fi
+
+    local reason_code
+    reason_code="$(coderabbit_skip_reason)"
+    emit_installer_diagnostic "coderabbit" "optional-tool-setup" "skipped" "$reason_code" "null" "null" "false" "0" "0" "optional_tool_setup_skipped" "docs/install/coderabbit-manual-setup.md"
+    optional_tool_info "CodeRabbit CLI ${DIM}(opcional; setup manual em docs/install/coderabbit-manual-setup.md; ${reason_code})${NC}"
+    CODERABBIT_INSTALLED=false
+
+    return 0
+}
+
+# =============================================================================
+# VERIFICACAO POS-INSTALACAO
+# =============================================================================
+
+verify_installation() {
+    local fails=0
+    local warns=0
+    local report=""
+
+    if ! echo "$SELECTED_TARGETS" | grep -q "claude-code"; then
+        return 0
+    fi
+
+    # ─── Layer 1: File existence + minimum size ─────────────────────────
+    local check_fname check_min check_fpath check_size check_ext check_first_line check_display
+    for check_fname in neocortex.md neocortex.agent.yaml; do
+        case "$check_fname" in
+            neocortex.md)          check_min=512 ;;
+            neocortex.agent.yaml)  check_min=128 ;;
+        esac
+        check_fpath="${DEST_DIR}/${check_fname}"
+
+        if [ ! -f "$check_fpath" ]; then
+            report="${report}FAIL ${check_fname} (nao encontrado)\n"
+            fails=$((fails + 1))
+        else
+            check_size=$(wc -c < "$check_fpath" 2>/dev/null | tr -d ' ')
+            if [ "$check_size" -lt "$check_min" ] 2>/dev/null; then
+                report="${report}FAIL ${check_fname} (${check_size} bytes - possivelmente corrompido, minimo ${check_min})\n"
+                fails=$((fails + 1))
+            else
+                # ─── Layer 2: Content marker (frontmatter) ──────────────
+                check_ext="${check_fname##*.}"
+                if [ "$check_ext" = "md" ]; then
+                    check_first_line=$(head -1 "$check_fpath" 2>/dev/null)
+                    if [ "$check_first_line" != "---" ]; then
+                        report="${report}WARN ${check_fname} (formato invalido - sem frontmatter)\n"
+                        warns=$((warns + 1))
+                    else
+                        if [ "$check_size" -ge 1024 ]; then check_display="$((check_size / 1024))KB"; else check_display="${check_size}B"; fi
+                        report="${report}OK   ${check_fname} (${check_display})\n"
+                    fi
+                else
+                    if [ "$check_size" -ge 1024 ]; then check_display="$((check_size / 1024))KB"; else check_display="${check_size}B"; fi
+                    report="${report}OK   ${check_fname} (${check_display})\n"
+                fi
+            fi
+        fi
+    done
+
+    if false; then
+        # ─── Layer 3: Step directories (removed - thin-client only) ──────
+        for dir in steps-c steps-e steps-p steps-r steps-u; do
+            local dir_path="$DEST_DIR/$dir"
+            if [ ! -d "$dir_path" ]; then
+                report="${report}FAIL ${dir}/ (diretorio nao encontrado)\n"
+                fails=$((fails + 1))
+            else
+                local md_count=0
+                for f in "$dir_path"/*.md; do
+                    [ -f "$f" ] && md_count=$((md_count + 1))
+                done
+                if [ $md_count -eq 0 ]; then
+                    report="${report}WARN ${dir}/ (vazio - nenhum arquivo .md)\n"
+                    warns=$((warns + 1))
+                else
+                    report="${report}OK   ${dir}/ (${md_count} arquivos)\n"
+                fi
+            fi
+        done
+
+        # ─── Layer 3b: Core directory (local mode only) ──────────────────
+        if [ ! -d "$DEST_DIR/core" ]; then
+            report="${report}FAIL core/ (diretorio nao encontrado)\n"
+            fails=$((fails + 1))
+        else
+            report="${report}OK   core/\n"
+        fi
+    else
+        # ─── Layer 3: Thin client config (remote mode) ───────────────────
+        local config_file="${HOME}/.neocortex/config.json"
+        if [ -f "$config_file" ]; then
+            report="${report}OK   ~/.neocortex/config.json (thin client configured)\n"
+        else
+            report="${report}WARN ~/.neocortex/config.json (nao encontrado)\n"
+            warns=$((warns + 1))
+        fi
+
+        # Verify NO IP directories exist
+        local ip_found=false
+        for dir in core steps-c steps-e steps-p steps-r steps-u; do
+            if [ -d "$DEST_DIR/$dir" ]; then
+                report="${report}WARN ${dir}/ ainda existe (deveria ter sido removido)\n"
+                warns=$((warns + 1))
+                ip_found=true
+            fi
+        done
+        if [ "$ip_found" = false ]; then
+            report="${report}OK   Zero IP no filesystem (modo remoto)\n"
+        fi
+    fi
+
+    # ─── Display report ─────────────────────────────────────────────────
+    if [ $fails -eq 0 ] && [ $warns -eq 0 ]; then
+        # All good - compact output
+        if [ "$QUIET_MODE" != true ]; then
+            ok "Instalacao verificada"
+        fi
+        return 0
+    fi
+
+    # Show detailed report when issues found
+    if [ "$QUIET_MODE" = true ] && [ $fails -eq 0 ]; then
+        return 0  # In quiet mode, skip warnings-only report
+    fi
+
+    echo ""
+    info "Verificacao pos-instalacao:"
+    echo -e "$report" | while IFS= read -r line; do
+        [ -z "$line" ] && continue
+        local status="${line%% *}"
+        local detail="${line#* }"
+        case "$status" in
+            OK)   echo -e "    ${GREEN}${SYM_OK}${NC} $detail" ;;
+            WARN) echo -e "    ${YELLOW}${SYM_WARN}${NC} $detail" ;;
+            FAIL) echo -e "    ${RED}${SYM_FAIL}${NC} $detail" ;;
+        esac
+    done
+
+    [ $fails -gt 0 ] && return 1
+    return 0
+}
+
+# =============================================================================
+# RESULTADO
+# =============================================================================
+
+show_result() {
+    local install_status=$1
+    [ "$QUIET_MODE" = true ] && return
+
+    echo ""
+    echo -e "  ${DIM}────────────────────────────────────────${NC}"
+
+    if [ $install_status -eq 0 ] && verify_installation; then
+        echo ""
+
+        # Success logo (brain/cortex shape, text centered vertically)
+        echo -e "${CYAN}       #######${NC}"
+        echo -e "${CYAN}      ###  ########${NC}"
+        echo -e "${CYAN} #########      #####${NC}"
+        echo -e "${CYAN} ##    ##############    ${BOLD}N E O C O R T E X${NC}"
+        echo -e "${CYAN} ##   ###  ######  ##    ${BOLD}v${VERSION}${NC}"
+        echo -e "${CYAN} ##   ###    ###   ##${NC}"
+        echo -e "${CYAN} ##  ######  ###   ##    ${GREEN}${BOLD}Installation complete!${NC}"
+        echo -e "${CYAN} ###############   ##    ${DIM}OrNexus Team${NC}"
+        echo -e "${CYAN} #####       ########${NC}"
+        echo -e "${CYAN}   ########  ##${NC}"
+        echo -e "${CYAN}        #######${NC}"
+        echo ""
+        echo -e "  ${DIM}Mode:${NC}    Remote (thin client)"
+        echo -e "  ${DIM}Status:${NC}  Ready to activate"
+        echo ""
+        echo -e "  ${DIM}Activate your license:${NC}"
+        echo -e "    ${CYAN}neocortex activate YOUR-LICENSE-KEY${NC}"
+        echo ""
+        echo -e "  ${DIM}Get your key at:${NC} ${CYAN}https://neocortex.sh/portal/login${NC}"
+        echo ""
+        echo -e "  ${DIM}After activation:${NC}"
+        echo -e "    ${CYAN}@neocortex *menu${NC}"
+        echo ""
+    else
+        echo ""
+        echo -e "  ${RED}${BOLD}Instalacao com problemas${NC}"
+        echo ""
+        echo -e "  Execute novamente com ${BOLD}--debug${NC} para detalhes:"
+        echo -e "    ${YELLOW}npx @ornexus/neocortex --debug${NC}"
+        echo ""
+        return 1
+    fi
+}
+
+# =============================================================================
+# CRIACAO DE DIRETORIOS DO PROJETO
+# =============================================================================
+
+create_project_dirs() {
+    [ "$QUIET_MODE" = true ] && return
+    [ "$SKIP_PROJECT_DIRS" = true ] && return
+
+    local should_create=false
+
+    if [ "$CREATE_PROJECT" = true ] || [ "$AUTO_YES" = true ]; then
+        should_create=true
+    else
+        echo -ne "  Instalar estrutura no projeto atual? ${BOLD}[s/N]:${NC} "
+
+        local response="n"
+        if read -r -t 30 response </dev/tty 2>/dev/null; then
+            :
+        else
+            echo ""
+            response="n"
+        fi
+
+        [[ "$response" =~ ^([sS][iI]?[mM]?|[yY][eE]?[sS]?)$ ]] && should_create=true
+    fi
+
+    if [ "$should_create" = true ]; then
+        local project_dir="$PWD"
+
+        if is_neocortex_source_project "$project_dir"; then
+            warn "Recusando --create-project dentro do repo fonte do Neocortex"
+            warn "Isso preserva core/ e arquivos de desenvolvimento locais"
+            return
+        fi
+
+        # Clean previous project files
+        rm -rf "$project_dir/targets/claude-code" 2>/dev/null
+        rm -f "$project_dir/.cursor/agents/neocortex.md" 2>/dev/null
+        rm -rf "$project_dir/.cursor/skills" 2>/dev/null
+        rm -f "$project_dir/.github/agents/neocortex.md" 2>/dev/null
+        rm -rf "$project_dir/.github/skills" 2>/dev/null
+        # P151: project memory entrypoints are refreshed through the canonical
+        # writer so human-authored content outside owned blocks is preserved.
+        rm -rf "$project_dir/.agent/skills/neocortex" 2>/dev/null
+        rm -f "$project_dir/.opencode/agents/neocortex.md" 2>/dev/null
+        rm -rf "$project_dir/.kimi/skills/neocortex" 2>/dev/null
+        rm -rf "$project_dir/.openclaw/skills/neocortex" 2>/dev/null
+        rm -rf "$project_dir/.agents/skills" 2>/dev/null
+        rm -rf "$project_dir/.claude/agents/neocortex" 2>/dev/null
+        rm -rf "$project_dir/.claude/skills/neocortex" 2>/dev/null
+
+        # Thin-client: cleanup any legacy core/ from previous local installs
+        rm -rf "$project_dir/core" 2>/dev/null
+
+        # Create base directories
+        mkdir -p "$project_dir/.neocortex/specs" \
+                 "$project_dir/.neocortex/planning" \
+                 "$project_dir/docs/stories" \
+                 "$project_dir/docs/epics" \
+                 "$project_dir/docs/proposals" 2>/dev/null
+
+        # Copy state template if needed
+        if [ ! -f "$project_dir/.neocortex/state.json" ]; then
+            [ -f "$SOURCE_DIR/core/data/state-template.json" ] && \
+                cp "$SOURCE_DIR/core/data/state-template.json" "$project_dir/.neocortex/state.json"
+        fi
+
+        # Thin-client: never copy core/ to project
+
+        # Install target-specific files
+        local targets_list
+        targets_list=$(echo "$SELECTED_TARGETS" | tr ',' ' ')
+        local target_summary=""
+
+        for target in $targets_list; do
+            case "$target" in
+                claude-code)
+                    local claude_target_dir
+                    claude_target_dir=$(resolve_target_dir "claude-code") || true
+                    if [ -d "$claude_target_dir" ]; then
+                        mkdir -p "$project_dir/.claude/agents/neocortex"
+
+                        # Tier 3: copiar apenas 2 stub files
+                        cp "$claude_target_dir/neocortex.md" "$project_dir/.claude/agents/neocortex/" 2>/dev/null
+                        cp "$claude_target_dir/neocortex.agent.yaml" "$project_dir/.claude/agents/neocortex/" 2>/dev/null
+                        # Cleanup workflow.md from previous versions
+                        rm -f "$project_dir/.claude/agents/neocortex/workflow.md" 2>/dev/null
+
+                        # Dynamic description: patch tier
+                        patch_description_tier "$project_dir/.claude/agents/neocortex/neocortex.md"
+                        patch_description_tier "$project_dir/.claude/agents/neocortex/neocortex.agent.yaml"
+
+                        # Thin-client: cleanup legacy IP from previous installs
+                        auto_cleanup_legacy_project "$project_dir"
+                        target_summary="${target_summary}claude-code, "
+                    fi
+                    ;;
+                cursor)
+                    # IP Protection: ALWAYS thin-client, zero IP on client
+                    local stub_adapter="$SOURCE_DIR/targets-stubs/cursor/install-cursor.sh"
+                    if [ -f "$stub_adapter" ]; then
+                        . "$stub_adapter"
+                        install_cursor "$SOURCE_DIR" "$project_dir"
+                        patch_description_tier "$project_dir/.cursor/agents/neocortex.md"
+                        target_summary="${target_summary}cursor, "
+                    fi
+                    ;;
+                vscode)
+                    local stub_adapter="$SOURCE_DIR/targets-stubs/vscode/install-vscode.sh"
+                    if [ -f "$stub_adapter" ]; then
+                        . "$stub_adapter"
+                        install_vscode "$SOURCE_DIR" "$project_dir"
+                        patch_description_tier "$project_dir/.github/agents/neocortex.md"
+                        patch_description_tier "$project_dir/.github/agents/neocortex.agent.md"
+                        target_summary="${target_summary}vscode, "
+                    fi
+                    ;;
+                gemini|gemini-cli)
+                    local stub_adapter="$SOURCE_DIR/targets-stubs/gemini-cli/install-gemini.sh"
+                    if [ -f "$stub_adapter" ]; then
+                        . "$stub_adapter"
+                        install_gemini "$SOURCE_DIR" "$project_dir"
+                        local gemini_home="${GEMINI_HOME:-$HOME/.gemini}"
+                        patch_description_tier "$gemini_home/agents/neocortex.md"
+                        patch_description_tier "$project_dir/.gemini/agents/neocortex.md"
+                        target_summary="${target_summary}gemini, "
+                    fi
+                    ;;
+                codex)
+                    local stub_adapter="$SOURCE_DIR/targets-stubs/codex/install-codex.sh"
+                    if [ -f "$stub_adapter" ]; then
+                        . "$stub_adapter"
+                        install_codex "$SOURCE_DIR" "$project_dir"
+                        patch_description_tier "$project_dir/AGENTS.md"
+                        local codex_home="${CODEX_HOME:-$HOME/.codex}"
+                        patch_description_tier "$codex_home/AGENTS.md"
+                        patch_description_tier "$codex_home/agents/neocortex.toml"
+                        patch_description_tier "$project_dir/.codex/agents/neocortex.toml"
+                        target_summary="${target_summary}codex, "
+                    fi
+                    ;;
+                antigravity)
+                    local stub_adapter="$SOURCE_DIR/targets-stubs/antigravity/install-antigravity.sh"
+                    if [ -f "$stub_adapter" ]; then
+                        . "$stub_adapter"
+                        install_antigravity "$SOURCE_DIR" "$project_dir"
+                        patch_description_tier "$project_dir/.agent/skills/neocortex/SKILL.md"
+                        patch_description_tier "$project_dir/GEMINI.md"
+                        target_summary="${target_summary}antigravity, "
+                    fi
+                    ;;
+                opencode)
+                    local opencode_target="$SOURCE_DIR/targets-stubs/opencode"
+                    if [ -f "$opencode_target/neocortex.md" ] && [ -f "$opencode_target/neocortex-root.md" ]; then
+                        mkdir -p "$project_dir/.opencode/agents" 2>/dev/null
+                        cp "$opencode_target/neocortex.md" "$project_dir/.opencode/agents/neocortex.md" 2>/dev/null
+                        cp "$opencode_target/neocortex-root.md" "$project_dir/.opencode/agents/neocortex-root.md" 2>/dev/null
+                        patch_description_tier "$project_dir/.opencode/agents/neocortex.md"
+                        patch_description_tier "$project_dir/.opencode/agents/neocortex-root.md"
+                        target_summary="${target_summary}opencode, "
+                    fi
+                    ;;
+                kimi)
+                    local kimi_target="$SOURCE_DIR/targets-stubs/kimi"
+                    if [ -f "$kimi_target/neocortex.md" ]; then
+                        mkdir -p "$project_dir/.kimi/skills/neocortex" 2>/dev/null
+                        cp "$kimi_target/neocortex.md" "$project_dir/.kimi/skills/neocortex/SKILL.md" 2>/dev/null
+                        patch_description_tier "$project_dir/.kimi/skills/neocortex/SKILL.md"
+                        target_summary="${target_summary}kimi, "
+                    fi
+                    ;;
+                openclaw)
+                    local openclaw_target="$SOURCE_DIR/targets-stubs/openclaw"
+                    if [ -f "$openclaw_target/SKILL.md" ]; then
+                        mkdir -p "$project_dir/.openclaw/skills/neocortex" 2>/dev/null
+                        cp "$openclaw_target/SKILL.md" "$project_dir/.openclaw/skills/neocortex/SKILL.md" 2>/dev/null
+                        patch_description_tier "$project_dir/.openclaw/skills/neocortex/SKILL.md"
+                        target_summary="${target_summary}openclaw, "
+                    fi
+                    ;;
+            esac
+        done
+
+        # P151: bootstrap NEOCORTEX.md first, then repair platform wrappers or
+        # semantic symlinks for the selected project targets. This is best-effort
+        # during install because older packages may not ship the JS handler yet.
+        if [ -f "$SOURCE_DIR/packages/client/dist/cli.js" ]; then
+            local memory_targets=""
+            for target in $targets_list; do
+                case "$target" in
+                    gemini) target="gemini-cli" ;;
+                esac
+                if [ -z "$memory_targets" ]; then
+                    memory_targets="$target"
+                else
+                    memory_targets="$memory_targets,$target"
+                fi
+            done
+            node "$SOURCE_DIR/packages/client/dist/cli.js" refresh-memory --project-root "$project_dir" --targets "$memory_targets" >/dev/null 2>&1 || \
+                warn "Nao foi possivel reparar memoria canonica automaticamente; execute: neocortex-client refresh-memory --project-root '$project_dir' --targets '$memory_targets'"
+        fi
+
+        echo ""
+        ok "Estrutura do projeto instalada ${DIM}(${target_summary%, })${NC}"
+        echo ""
+        info "Proximo passo: ${CYAN}@neocortex *init @docs/epics.md${NC}"
+    fi
+}
+
+# =============================================================================
+# MIGRACAO
+# =============================================================================
+
+show_migration_info() {
+    [ "$QUIET_MODE" = true ] && return
+
+    local project_sources
+    if project_sources=$(detect_project_migration_needs); then
+        echo ""
+        warn "${BOLD}Migracao detectada${NC}"
+        for src in $project_sources; do
+            info "Arquivo antigo: $src"
+        done
+        info "Execute: ${CYAN}@neocortex *init @docs/epics.md${NC} para migrar"
+    fi
+}
+
+# =============================================================================
+# TIER-BASED PLATFORM GATING (Story 57.4)
+# =============================================================================
+
+# Read tier from config.json (defaults to "free" if not found)
+get_tier_from_config() {
+    local config_file="$HOME/.neocortex/config.json"
+    if [ -f "$config_file" ]; then
+        local tier
+        tier=$(cat "$config_file" 2>/dev/null | grep -o '"tier"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')
+        [ -n "$tier" ] && echo "$tier" || echo "free"
+    else
+        echo "free"
+    fi
+}
+
+# Check if a platform is allowed for the current tier
+# Returns 0 if allowed, 1 if blocked
+check_platform_tier() {
+    local platform=$1
+    local tier=$2
+    case "$platform" in
+        claude-code) return 0 ;;  # Always allowed
+        cursor|gemini|gemini-cli|codex|opencode)
+            if [ "$tier" = "free" ]; then
+                warn "$platform requer plano Pro. Plataforma disponivel: Claude Code."
+                info "Upgrade: ${CYAN}https://neocortex.sh/portal/dashboard/plans${NC}"
+                return 1
+            fi
+            return 0
+            ;;
+        vscode|antigravity|kimi)
+            if [ "$tier" != "enterprise" ]; then
+                warn "$platform requer plano Enterprise."
+                info "Upgrade: ${CYAN}https://neocortex.sh/portal/dashboard/plans${NC}"
+                return 1
+            fi
+            return 0
+            ;;
+    esac
+    return 0  # Unknown platforms pass through
+}
+
+# =============================================================================
+# MAIN
+# =============================================================================
+
+TOTAL_STEPS=4
+
+main() {
+    show_banner
+    warn_linux_root_home_context
+    detect_source_dir
+    detect_old_installation
+
+    # Determine targets
+    if [ -z "$SELECTED_TARGETS" ]; then
+        SELECTED_TARGETS="claude-code"
+    fi
+
+    debug "Targets: $SELECTED_TARGETS"
+
+    # Read user tier for platform gating
+    local user_tier
+    user_tier=$(get_tier_from_config)
+    debug "User tier: $user_tier"
+
+    # Validate targets (name check + tier check)
+    local invalid_targets=""
+    local blocked_targets=""
+    for target in $(echo "$SELECTED_TARGETS" | tr ',' ' '); do
+        echo "$VALID_TARGETS" | grep -wq "$target" || invalid_targets="$invalid_targets $target"
+    done
+
+    if [ -n "$invalid_targets" ]; then
+        fail "Plataformas invalidas:$invalid_targets"
+        fail "Validas: $VALID_TARGETS"
+        exit 1
+    fi
+
+    # Filter out tier-blocked platforms
+    local allowed_targets=""
+    for target in $(echo "$SELECTED_TARGETS" | tr ',' ' '); do
+        if check_platform_tier "$target" "$user_tier"; then
+            if [ -z "$allowed_targets" ]; then
+                allowed_targets="$target"
+            else
+                allowed_targets="$allowed_targets,$target"
+            fi
+        else
+            blocked_targets="$blocked_targets $target"
+        fi
+    done
+
+    if [ -n "$blocked_targets" ]; then
+        info "Plataforma(s) bloqueada(s) por tier:$blocked_targets"
+    fi
+
+    # Use only allowed targets
+    if [ -n "$allowed_targets" ]; then
+        SELECTED_TARGETS="$allowed_targets"
+    else
+        SELECTED_TARGETS="claude-code"
+        info "Usando plataforma padrao: claude-code"
+    fi
+
+    if [ "$DRY_RUN" = true ]; then
+        show_target_resolution_dry_run "$SELECTED_TARGETS"
+        exit 0
+    fi
+
+    # Count targets for step total
+    local target_count=$(echo "$SELECTED_TARGETS" | tr ',' ' ' | wc -w | tr -d ' ')
+    if echo "$SELECTED_TARGETS" | grep -q "claude-code"; then
+        TOTAL_STEPS=6  # cleanup + core + skills + targets + mcps + tools
+    fi
+
+    # Step 1: Limpeza automatica de versoes anteriores
+    step 1 $TOTAL_STEPS "Limpeza de versoes anteriores"
+    auto_cleanup_legacy
+
+    # Step 2: Core
+    step 2 $TOTAL_STEPS "Instalando core"
+    install_core
+    local core_result=$?
+    if [ $core_result -ne 0 ]; then
+        fail "Falha na instalacao do core"
+        exit 1
+    fi
+
+    # Step 3: Skills
+    step 3 $TOTAL_STEPS "Instalando skills"
+    install_skills
+
+    # Step 4: Targets
+    step 4 $TOTAL_STEPS "Instalando ${BOLD}$target_count${NC} plataforma(s)"
+    install_targets "$SELECTED_TARGETS"
+
+    # Step 5-6: Claude Code extras
+    if echo "$SELECTED_TARGETS" | grep -q "claude-code"; then
+        load_env_file
+        prompt_tokens
+
+        step 5 $TOTAL_STEPS "Configurando MCPs"
+        install_mcps
+
+        step 6 $TOTAL_STEPS "Verificando ferramentas"
+        report_coderabbit_status
+    fi
+
+    # Result
+    show_result $core_result
+    local result_code=$?
+
+    if [ $result_code -eq 0 ]; then
+        show_migration_info
+        create_project_dirs
+        echo -e "  ${DIM}Desenvolvido por OrNexus Team${NC}"
+        echo ""
+    fi
+
+    exit $result_code
+}
+
+main