@ouro.bot/cli 0.1.0-alpha.8 → 0.1.0-alpha.81

package/dist/heart/daemon/daemon-cli.js

@@ -34,12 +34,16 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureDaemonRunning = ensureDaemonRunning;
+exports.listGithubCopilotModels = listGithubCopilotModels;
+exports.pingGithubCopilotModel = pingGithubCopilotModel;
 exports.parseOuroCommand = parseOuroCommand;
+exports.readFirstBundleMetaVersion = readFirstBundleMetaVersion;
+exports.discoverExistingCredentials = discoverExistingCredentials;
 exports.createDefaultOuroCliDeps = createDefaultOuroCliDeps;
 exports.runOuroCli = runOuroCli;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
-const net = __importStar(require("net"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const identity_1 = require("../identity");
@@ -47,16 +51,202 @@ const runtime_1 = require("../../nerves/runtime");
 const store_file_1 = require("../../mind/friends/store-file");
 const types_1 = require("../../mind/friends/types");
 const ouro_uti_1 = require("./ouro-uti");
-const subagent_installer_1 = require("./subagent-installer");
+const ouro_path_installer_1 = require("./ouro-path-installer");
+const ouro_version_manager_1 = require("./ouro-version-manager");
+const skill_management_installer_1 = require("./skill-management-installer");
 const hatch_flow_1 = require("./hatch-flow");
 const specialist_orchestrator_1 = require("./specialist-orchestrator");
+const specialist_prompt_1 = require("./specialist-prompt");
+const specialist_tools_1 = require("./specialist-tools");
+const runtime_metadata_1 = require("./runtime-metadata");
+const runtime_mode_1 = require("./runtime-mode");
+const daemon_runtime_sync_1 = require("./daemon-runtime-sync");
+const agent_discovery_1 = require("./agent-discovery");
+const update_hooks_1 = require("./update-hooks");
+const bundle_meta_1 = require("./hooks/bundle-meta");
+const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const tasks_1 = require("../../repertoire/tasks");
+const thoughts_1 = require("./thoughts");
+const ouro_bot_global_installer_1 = require("./ouro-bot-global-installer");
+const launchd_1 = require("./launchd");
+const socket_client_1 = require("./socket-client");
+const session_activity_1 = require("../session-activity");
+const auth_flow_1 = require("./auth-flow");
+function stringField(value) {
+    return typeof value === "string" ? value : null;
+}
+function numberField(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function booleanField(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function parseStatusPayload(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    const raw = data;
+    const overview = raw.overview;
+    const senses = raw.senses;
+    const workers = raw.workers;
+    if (!overview || typeof overview !== "object" || Array.isArray(overview))
+        return null;
+    if (!Array.isArray(senses) || !Array.isArray(workers))
+        return null;
+    const parsedOverview = {
+        daemon: stringField(overview.daemon) ?? "unknown",
+        health: stringField(overview.health) ?? "unknown",
+        socketPath: stringField(overview.socketPath) ?? "unknown",
+        version: stringField(overview.version) ?? "unknown",
+        lastUpdated: stringField(overview.lastUpdated) ?? "unknown",
+        repoRoot: stringField(overview.repoRoot) ?? "unknown",
+        configFingerprint: stringField(overview.configFingerprint) ?? "unknown",
+        workerCount: numberField(overview.workerCount) ?? 0,
+        senseCount: numberField(overview.senseCount) ?? 0,
+        entryPath: stringField(overview.entryPath) ?? "unknown",
+        mode: stringField(overview.mode) ?? "unknown",
+    };
+    const parsedSenses = senses.map((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return null;
+        const row = entry;
+        const agent = stringField(row.agent);
+        const sense = stringField(row.sense);
+        const status = stringField(row.status);
+        const detail = stringField(row.detail);
+        const enabled = booleanField(row.enabled);
+        if (!agent || !sense || !status || detail === null || enabled === null)
+            return null;
+        return {
+            agent,
+            sense,
+            label: stringField(row.label) ?? undefined,
+            enabled,
+            status,
+            detail,
+        };
+    });
+    const parsedWorkers = workers.map((entry) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return null;
+        const row = entry;
+        const agent = stringField(row.agent);
+        const worker = stringField(row.worker);
+        const status = stringField(row.status);
+        const restartCount = numberField(row.restartCount);
+        const hasPid = Object.prototype.hasOwnProperty.call(row, "pid");
+        const pid = row.pid === null ? null : numberField(row.pid);
+        const pidInvalid = !hasPid || (row.pid !== null && pid === null);
+        if (!agent || !worker || !status || restartCount === null || pidInvalid)
+            return null;
+        return {
+            agent,
+            worker,
+            status,
+            pid,
+            restartCount,
+        };
+    });
+    if (parsedSenses.some((row) => row === null) || parsedWorkers.some((row) => row === null))
+        return null;
+    return {
+        overview: parsedOverview,
+        senses: parsedSenses,
+        workers: parsedWorkers,
+    };
+}
+function humanizeSenseName(sense, label) {
+    if (label)
+        return label;
+    if (sense === "cli")
+        return "CLI";
+    if (sense === "bluebubbles")
+        return "BlueBubbles";
+    if (sense === "teams")
+        return "Teams";
+    return sense;
+}
+function formatTable(headers, rows) {
+    const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index].length)));
+    const renderRow = (row) => `| ${row.map((cell, index) => cell.padEnd(widths[index])).join(" | ")} |`;
+    const divider = `|-${widths.map((width) => "-".repeat(width)).join("-|-")}-|`;
+    return [
+        renderRow(headers),
+        divider,
+        ...rows.map(renderRow),
+    ].join("\n");
+}
+function formatDaemonStatusOutput(response, fallback) {
+    const payload = parseStatusPayload(response.data);
+    if (!payload)
+        return fallback;
+    const overviewRows = [
+        ["Daemon", payload.overview.daemon],
+        ["Socket", payload.overview.socketPath],
+        ["Version", payload.overview.version],
+        ["Last Updated", payload.overview.lastUpdated],
+        ["Entry Path", payload.overview.entryPath],
+        ["Mode", payload.overview.mode],
+        ["Workers", String(payload.overview.workerCount)],
+        ["Senses", String(payload.overview.senseCount)],
+        ["Health", payload.overview.health],
+    ];
+    const senseRows = payload.senses.map((row) => [
+        row.agent,
+        humanizeSenseName(row.sense, row.label),
+        row.enabled ? "ON" : "OFF",
+        row.status,
+        row.detail,
+    ]);
+    const workerRows = payload.workers.map((row) => [
+        row.agent,
+        row.worker,
+        row.status,
+        row.pid === null ? "n/a" : String(row.pid),
+        String(row.restartCount),
+    ]);
+    return [
+        "Overview",
+        formatTable(["Item", "Value"], overviewRows),
+        "",
+        "Senses",
+        formatTable(["Agent", "Sense", "Enabled", "State", "Detail"], senseRows),
+        "",
+        "Workers",
+        formatTable(["Agent", "Worker", "State", "PID", "Restarts"], workerRows),
+    ].join("\n");
+}
 async function ensureDaemonRunning(deps) {
     const alive = await deps.checkSocketAlive(deps.socketPath);
     if (alive) {
-        return {
-            alreadyRunning: true,
-            message: `daemon already running (${deps.socketPath})`,
+        const localRuntime = (0, runtime_metadata_1.getRuntimeMetadata)();
+        let runningRuntimePromise = null;
+        const fetchRunningRuntimeMetadata = async () => {
+            runningRuntimePromise ??= (async () => {
+                const status = await deps.sendCommand(deps.socketPath, { kind: "daemon.status" });
+                const payload = parseStatusPayload(status.data);
+                return {
+                    version: payload?.overview.version ?? "unknown",
+                    lastUpdated: payload?.overview.lastUpdated ?? "unknown",
+                    repoRoot: payload?.overview.repoRoot ?? "unknown",
+                    configFingerprint: payload?.overview.configFingerprint ?? "unknown",
+                };
+            })();
+            return runningRuntimePromise;
         };
+        return (0, daemon_runtime_sync_1.ensureCurrentDaemonRuntime)({
+            socketPath: deps.socketPath,
+            localVersion: localRuntime.version,
+            localLastUpdated: localRuntime.lastUpdated,
+            localRepoRoot: localRuntime.repoRoot,
+            localConfigFingerprint: localRuntime.configFingerprint,
+            fetchRunningVersion: async () => (await fetchRunningRuntimeMetadata()).version,
+            fetchRunningRuntimeMetadata,
+            stopDaemon: async () => {
+                await deps.sendCommand(deps.socketPath, { kind: "daemon.stop" });
+            },
+            cleanupStaleSocket: deps.cleanupStaleSocket,
+            startDaemonProcess: deps.startDaemonProcess,
+        });
     }
     deps.cleanupStaleSocket(deps.socketPath);
     const started = await deps.startDaemonProcess(deps.socketPath);
@@ -65,17 +255,95 @@ async function ensureDaemonRunning(deps) {
         message: `daemon started (pid ${started.pid ?? "unknown"})`,
     };
 }
+/**
+ * Extract `--agent <name>` from an args array, returning the agent name and
+ * the remaining args with the flag pair removed.
+ */
+function extractAgentFlag(args) {
+    const idx = args.indexOf("--agent");
+    if (idx === -1 || idx + 1 >= args.length)
+        return { rest: args };
+    const agent = args[idx + 1];
+    const rest = [...args.slice(0, idx), ...args.slice(idx + 2)];
+    return { agent, rest };
+}
 function usage() {
     return [
         "Usage:",
         "  ouro [up]",
-        "  ouro stop|status|logs|hatch",
+        "  ouro stop|down|status|logs|hatch",
+        "  ouro -v|--version",
+        "  ouro config model --agent <name> <model-name>",
+        "  ouro config models --agent <name>",
+        "  ouro auth --agent <name> [--provider <provider>]",
+        "  ouro auth verify --agent <name> [--provider <provider>]",
+        "  ouro auth switch --agent <name> --provider <provider>",
         "  ouro chat <agent>",
         "  ouro msg --to <agent> [--session <id>] [--task <ref>] <message>",
         "  ouro poke <agent> --task <task-id>",
         "  ouro link <agent> --friend <id> --provider <provider> --external-id <external-id>",
+        "  ouro task board [<status>] [--agent <name>]",
+        "  ouro task create <title> [--type <type>] [--agent <name>]",
+        "  ouro task update <id> <status> [--agent <name>]",
+        "  ouro task show <id> [--agent <name>]",
+        "  ouro task actionable|deps|sessions [--agent <name>]",
+        "  ouro reminder create <title> --body <body> [--at <iso>] [--cadence <interval>] [--category <category>] [--agent <name>]",
+        "  ouro friend list [--agent <name>]",
+        "  ouro friend show <id> [--agent <name>]",
+        "  ouro friend create --name <name> [--trust <level>] [--agent <name>]",
+        "  ouro friend update <id> --trust <level> [--agent <name>]",
+        "  ouro thoughts [--last <n>] [--json] [--follow] [--agent <name>]",
+        "  ouro friend link <agent> --friend <id> --provider <p> --external-id <eid>",
+        "  ouro friend unlink <agent> --friend <id> --provider <p> --external-id <eid>",
+        "  ouro whoami [--agent <name>]",
+        "  ouro session list [--agent <name>]",
+        "  ouro mcp list",
+        "  ouro mcp call <server> <tool> [--args '{...}']",
+        "  ouro rollback [<version>]",
+        "  ouro versions",
     ].join("\n");
 }
+function formatVersionOutput() {
+    return (0, runtime_metadata_1.getRuntimeMetadata)().version;
+}
+function buildStoppedStatusPayload(socketPath) {
+    const metadata = (0, runtime_metadata_1.getRuntimeMetadata)();
+    const repoRoot = (0, identity_1.getRepoRoot)();
+    return {
+        overview: {
+            daemon: "stopped",
+            health: "warn",
+            socketPath,
+            version: metadata.version,
+            lastUpdated: metadata.lastUpdated,
+            repoRoot: metadata.repoRoot,
+            configFingerprint: metadata.configFingerprint,
+            workerCount: 0,
+            senseCount: 0,
+            entryPath: path.join(repoRoot, "dist", "heart", "daemon", "daemon-entry.js"),
+            mode: (0, runtime_mode_1.detectRuntimeMode)(repoRoot),
+        },
+        senses: [],
+        workers: [],
+    };
+}
+function daemonUnavailableStatusOutput(socketPath) {
+    return [
+        formatDaemonStatusOutput({
+            ok: true,
+            summary: "daemon not running",
+            data: buildStoppedStatusPayload(socketPath),
+        }, "daemon not running"),
+        "",
+        "daemon not running; run `ouro up`",
+    ].join("\n");
+}
+function isDaemonUnavailableError(error) {
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code ?? "")
+        : "";
+    return code === "ENOENT" || code === "ECONNREFUSED";
+}
 function parseMessageCommand(args) {
     let to;
     let sessionId;
@@ -127,7 +395,7 @@ function parsePokeCommand(args) {
         throw new Error(`Usage\n${usage()}`);
     return { kind: "task.poke", agent, taskId };
 }
-function parseLinkCommand(args) {
+function parseLinkCommand(args, kind = "friend.link") {
     const agent = args[0];
     if (!agent)
         throw new Error(`Usage\n${usage()}`);
@@ -159,7 +427,7 @@ function parseLinkCommand(args) {
         throw new Error(`Unknown identity provider '${providerRaw}'. Use aad|local|teams-conversation.`);
     }
     return {
-        kind: "friend.link",
+        kind,
         agent,
         friendId,
         provider: providerRaw,
@@ -167,7 +435,132 @@ function parseLinkCommand(args) {
     };
 }
 function isAgentProvider(value) {
-    return value === "azure" || value === "anthropic" || value === "minimax" || value === "openai-codex";
+    return value === "azure" || value === "anthropic" || value === "minimax" || value === "openai-codex" || value === "github-copilot";
+}
+/* v8 ignore start -- hasStoredCredentials: per-provider branches tested via auth switch tests @preserve */
+function hasStoredCredentials(provider, providerSecrets) {
+    if (provider === "anthropic")
+        return !!providerSecrets.setupToken;
+    if (provider === "openai-codex")
+        return !!providerSecrets.oauthAccessToken;
+    if (provider === "github-copilot")
+        return !!providerSecrets.githubToken;
+    if (provider === "minimax")
+        return !!providerSecrets.apiKey;
+    // azure
+    return !!providerSecrets.endpoint && !!providerSecrets.apiKey;
+}
+/* v8 ignore stop */
+/* v8 ignore start -- verifyProviderCredentials: per-provider branches tested via auth verify tests @preserve */
+async function verifyProviderCredentials(provider, providers, fetchImpl = fetch) {
+    const p = providers[provider];
+    if (!p)
+        return "not configured";
+    if (provider === "anthropic") {
+        const token = p.setupToken || "";
+        if (!token)
+            return "failed (no token)";
+        if (token.startsWith("sk-ant-"))
+            return "ok";
+        return "failed (invalid token format)";
+    }
+    if (provider === "openai-codex") {
+        const token = p.oauthAccessToken || "";
+        return token ? "ok" : "failed (no token)";
+    }
+    if (provider === "github-copilot") {
+        const token = p.githubToken || "";
+        if (!token)
+            return "failed (no token)";
+        try {
+            const response = await fetchImpl("https://api.github.com/copilot_internal/user", {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return response.ok ? "ok" : `failed (HTTP ${response.status})`;
+        }
+        catch (error) {
+            return `failed (${error.message})`;
+        }
+    }
+    if (provider === "minimax") {
+        const apiKey = p.apiKey || "";
+        return apiKey ? "ok" : "failed (no api key)";
+    }
+    // azure
+    const endpoint = p.endpoint || "";
+    const apiKey = p.apiKey || "";
+    if (!endpoint)
+        return "failed (no endpoint)";
+    if (!apiKey)
+        return "failed (no api key)";
+    return "ok";
+}
+async function listGithubCopilotModels(baseUrl, token, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/models`;
+    const response = await fetchImpl(url, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!response.ok) {
+        throw new Error(`model listing failed (HTTP ${response.status})`);
+    }
+    const body = await response.json();
+    /* v8 ignore start -- response shape handling: tested via config-models.test.ts @preserve */
+    const items = Array.isArray(body) ? body : (body?.data ?? []);
+    return items.map((item) => {
+        const rec = item;
+        const capabilities = Array.isArray(rec.capabilities)
+            ? rec.capabilities.filter((c) => typeof c === "string")
+            : undefined;
+        return {
+            id: String(rec.id ?? rec.name ?? ""),
+            name: String(rec.name ?? rec.id ?? ""),
+            ...(capabilities ? { capabilities } : {}),
+        };
+    });
+    /* v8 ignore stop */
+}
+async function pingGithubCopilotModel(baseUrl, token, model, fetchImpl = fetch) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const isClaude = model.startsWith("claude");
+    const url = isClaude ? `${base}/chat/completions` : `${base}/responses`;
+    const body = isClaude
+        ? JSON.stringify({ model, messages: [{ role: "user", content: "ping" }], max_tokens: 1 })
+        : JSON.stringify({ model, input: "ping", max_output_tokens: 16 });
+    try {
+        const response = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body,
+        });
+        if (response.ok)
+            return { ok: true };
+        let detail = `HTTP ${response.status}`;
+        try {
+            const json = await response.json();
+            /* v8 ignore start -- error format parsing: all branches tested via config-models.test.ts @preserve */
+            if (typeof json.error === "string")
+                detail = json.error;
+            else if (typeof json.error === "object" && json.error !== null) {
+                const errObj = json.error;
+                if (typeof errObj.message === "string")
+                    detail = errObj.message;
+            }
+            else if (typeof json.message === "string")
+                detail = json.message;
+            /* v8 ignore stop */
+        }
+        catch {
+            // response body not JSON — keep HTTP status
+        }
+        return { ok: false, error: detail };
+    }
+    catch (err) {
+        /* v8 ignore next -- defensive: fetch errors are always Error instances @preserve */
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
 }
 function parseHatchCommand(args) {
     let agentName;
@@ -224,7 +617,7 @@ function parseHatchCommand(args) {
         }
     }
     if (providerRaw && !isAgentProvider(providerRaw)) {
-        throw new Error("Unknown provider. Use azure|anthropic|minimax|openai-codex.");
+        throw new Error("Unknown provider. Use azure|anthropic|minimax|openai-codex|github-copilot.");
     }
     const provider = providerRaw && isAgentProvider(providerRaw) ? providerRaw : undefined;
     return {
@@ -236,13 +629,293 @@ function parseHatchCommand(args) {
         migrationPath,
     };
 }
+function parseTaskCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const [sub, ...rest] = cleaned;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "board") {
+        const status = rest[0];
+        return status
+            ? { kind: "task.board", status, ...(agent ? { agent } : {}) }
+            : { kind: "task.board", ...(agent ? { agent } : {}) };
+    }
+    if (sub === "create") {
+        const title = rest[0];
+        if (!title)
+            throw new Error(`Usage\n${usage()}`);
+        let type;
+        for (let i = 1; i < rest.length; i++) {
+            if (rest[i] === "--type" && rest[i + 1]) {
+                type = rest[i + 1];
+                i += 1;
+            }
+        }
+        return type
+            ? { kind: "task.create", title, type, ...(agent ? { agent } : {}) }
+            : { kind: "task.create", title, ...(agent ? { agent } : {}) };
+    }
+    if (sub === "update") {
+        const id = rest[0];
+        const status = rest[1];
+        if (!id || !status)
+            throw new Error(`Usage\n${usage()}`);
+        return { kind: "task.update", id, status, ...(agent ? { agent } : {}) };
+    }
+    if (sub === "show") {
+        const id = rest[0];
+        if (!id)
+            throw new Error(`Usage\n${usage()}`);
+        return { kind: "task.show", id, ...(agent ? { agent } : {}) };
+    }
+    if (sub === "actionable")
+        return { kind: "task.actionable", ...(agent ? { agent } : {}) };
+    if (sub === "deps")
+        return { kind: "task.deps", ...(agent ? { agent } : {}) };
+    if (sub === "sessions")
+        return { kind: "task.sessions", ...(agent ? { agent } : {}) };
+    throw new Error(`Usage\n${usage()}`);
+}
+function parseAuthCommand(args) {
+    const first = args[0];
+    // Support both positional (`auth switch`) and flag (`auth --switch`) forms
+    if (first === "verify" || first === "switch" || first === "--verify" || first === "--switch") {
+        const subcommand = first.replace(/^--/, "");
+        const { agent, rest } = extractAgentFlag(args.slice(1));
+        let provider;
+        /* v8 ignore start -- provider flag parsing: branches tested via CLI parsing tests @preserve */
+        for (let i = 0; i < rest.length; i += 1) {
+            if (rest[i] === "--provider") {
+                const value = rest[i + 1];
+                if (!isAgentProvider(value))
+                    throw new Error(`Usage\n${usage()}`);
+                provider = value;
+                i += 1;
+                continue;
+            }
+        }
+        /* v8 ignore stop */
+        /* v8 ignore next -- defensive: agent always provided in tests @preserve */
+        if (!agent)
+            throw new Error(`Usage\n${usage()}`);
+        if (subcommand === "switch") {
+            if (!provider)
+                throw new Error(`auth switch requires --provider.\n${usage()}`);
+            return { kind: "auth.switch", agent, provider };
+        }
+        return provider ? { kind: "auth.verify", agent, provider } : { kind: "auth.verify", agent };
+    }
+    const { agent, rest } = extractAgentFlag(args);
+    let provider;
+    for (let i = 0; i < rest.length; i += 1) {
+        if (rest[i] === "--provider") {
+            const value = rest[i + 1];
+            if (!isAgentProvider(value))
+                throw new Error(`Usage\n${usage()}`);
+            provider = value;
+            i += 1;
+            continue;
+        }
+    }
+    if (!agent)
+        throw new Error(`Usage\n${usage()}`);
+    return provider ? { kind: "auth.run", agent, provider } : { kind: "auth.run", agent };
+}
+function parseReminderCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const [sub, ...rest] = cleaned;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "create") {
+        const title = rest[0];
+        if (!title)
+            throw new Error(`Usage\n${usage()}`);
+        let body;
+        let scheduledAt;
+        let cadence;
+        let category;
+        let requester;
+        for (let i = 1; i < rest.length; i++) {
+            if (rest[i] === "--body" && rest[i + 1]) {
+                body = rest[i + 1];
+                i += 1;
+            }
+            else if (rest[i] === "--at" && rest[i + 1]) {
+                scheduledAt = rest[i + 1];
+                i += 1;
+            }
+            else if (rest[i] === "--cadence" && rest[i + 1]) {
+                cadence = rest[i + 1];
+                i += 1;
+            }
+            else if (rest[i] === "--category" && rest[i + 1]) {
+                category = rest[i + 1];
+                i += 1;
+            }
+            else if (rest[i] === "--requester" && rest[i + 1]) {
+                requester = rest[i + 1];
+                i += 1;
+            }
+        }
+        if (!body)
+            throw new Error(`Usage\n${usage()}`);
+        if (!scheduledAt && !cadence)
+            throw new Error(`Usage\n${usage()}`);
+        return {
+            kind: "reminder.create",
+            title,
+            body,
+            ...(scheduledAt ? { scheduledAt } : {}),
+            ...(cadence ? { cadence } : {}),
+            ...(category ? { category } : {}),
+            ...(requester ? { requester } : {}),
+            ...(agent ? { agent } : {}),
+        };
+    }
+    throw new Error(`Usage\n${usage()}`);
+}
+function parseSessionCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const [sub] = cleaned;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "list")
+        return { kind: "session.list", ...(agent ? { agent } : {}) };
+    throw new Error(`Usage\n${usage()}`);
+}
+function parseThoughtsCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    let last;
+    let json = false;
+    let follow = false;
+    for (let i = 0; i < cleaned.length; i++) {
+        if (cleaned[i] === "--last" && i + 1 < cleaned.length) {
+            last = Number.parseInt(cleaned[i + 1], 10);
+            i++;
+        }
+        if (cleaned[i] === "--json")
+            json = true;
+        if (cleaned[i] === "--follow" || cleaned[i] === "-f")
+            follow = true;
+    }
+    return { kind: "thoughts", ...(agent ? { agent } : {}), ...(last ? { last } : {}), ...(json ? { json } : {}), ...(follow ? { follow } : {}) };
+}
+function parseFriendCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const [sub, ...rest] = cleaned;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "list")
+        return { kind: "friend.list", ...(agent ? { agent } : {}) };
+    if (sub === "show") {
+        const friendId = rest[0];
+        if (!friendId)
+            throw new Error(`Usage\n${usage()}`);
+        return { kind: "friend.show", friendId, ...(agent ? { agent } : {}) };
+    }
+    if (sub === "create") {
+        let name;
+        let trustLevel;
+        for (let i = 0; i < rest.length; i++) {
+            if (rest[i] === "--name" && rest[i + 1]) {
+                name = rest[i + 1];
+                i += 1;
+            }
+            else if (rest[i] === "--trust" && rest[i + 1]) {
+                trustLevel = rest[i + 1];
+                i += 1;
+            }
+        }
+        if (!name)
+            throw new Error(`Usage\n${usage()}`);
+        return {
+            kind: "friend.create",
+            name,
+            ...(trustLevel ? { trustLevel } : {}),
+            ...(agent ? { agent } : {}),
+        };
+    }
+    if (sub === "update") {
+        const friendId = rest[0];
+        if (!friendId)
+            throw new Error(`Usage: ouro friend update <id> --trust <level>`);
+        let trustLevel;
+        /* v8 ignore start -- flag parsing loop: tested via CLI parsing tests @preserve */
+        for (let i = 1; i < rest.length; i++) {
+            if (rest[i] === "--trust" && rest[i + 1]) {
+                trustLevel = rest[i + 1];
+                i += 1;
+            }
+        }
+        /* v8 ignore stop */
+        const VALID_TRUST_LEVELS = new Set(["stranger", "acquaintance", "friend", "family"]);
+        if (!trustLevel || !VALID_TRUST_LEVELS.has(trustLevel)) {
+            throw new Error(`Usage: ouro friend update <id> --trust <stranger|acquaintance|friend|family>`);
+        }
+        return {
+            kind: "friend.update",
+            friendId,
+            trustLevel: trustLevel,
+            ...(agent ? { agent } : {}),
+        };
+    }
+    if (sub === "link")
+        return parseLinkCommand(rest, "friend.link");
+    if (sub === "unlink")
+        return parseLinkCommand(rest, "friend.unlink");
+    throw new Error(`Usage\n${usage()}`);
+}
+function parseConfigCommand(args) {
+    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const [sub, ...rest] = cleaned;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "model") {
+        if (!agent)
+            throw new Error("--agent is required for config model");
+        const modelName = rest[0];
+        if (!modelName)
+            throw new Error(`Usage: ouro config model --agent <name> <model-name>`);
+        return { kind: "config.model", agent, modelName };
+    }
+    if (sub === "models") {
+        if (!agent)
+            throw new Error("--agent is required for config models");
+        return { kind: "config.models", agent };
+    }
+    throw new Error(`Usage\n${usage()}`);
+}
+function parseMcpCommand(args) {
+    const [sub, ...rest] = args;
+    if (!sub)
+        throw new Error(`Usage\n${usage()}`);
+    if (sub === "list")
+        return { kind: "mcp.list" };
+    if (sub === "call") {
+        const server = rest[0];
+        const tool = rest[1];
+        if (!server || !tool)
+            throw new Error(`Usage\n${usage()}`);
+        const argsIdx = rest.indexOf("--args");
+        const mcpArgs = argsIdx !== -1 && rest[argsIdx + 1] ? rest[argsIdx + 1] : undefined;
+        return { kind: "mcp.call", server, tool, ...(mcpArgs ? { args: mcpArgs } : {}) };
+    }
+    throw new Error(`Usage\n${usage()}`);
+}
 function parseOuroCommand(args) {
     const [head, second] = args;
     if (!head)
         return { kind: "daemon.up" };
+    if (head === "--agent" && second) {
+        return parseOuroCommand(args.slice(2));
+    }
     if (head === "up")
         return { kind: "daemon.up" };
-    if (head === "stop")
+    if (head === "rollback")
+        return { kind: "rollback", ...(second ? { version: second } : {}) };
+    if (head === "versions")
+        return { kind: "versions" };
+    if (head === "stop" || head === "down")
         return { kind: "daemon.stop" };
     if (head === "status")
         return { kind: "daemon.status" };
@@ -250,6 +923,36 @@ function parseOuroCommand(args) {
         return { kind: "daemon.logs" };
     if (head === "hatch")
         return parseHatchCommand(args.slice(1));
+    if (head === "auth")
+        return parseAuthCommand(args.slice(1));
+    if (head === "task")
+        return parseTaskCommand(args.slice(1));
+    if (head === "reminder")
+        return parseReminderCommand(args.slice(1));
+    if (head === "friend")
+        return parseFriendCommand(args.slice(1));
+    if (head === "config")
+        return parseConfigCommand(args.slice(1));
+    if (head === "mcp")
+        return parseMcpCommand(args.slice(1));
+    if (head === "whoami") {
+        const { agent } = extractAgentFlag(args.slice(1));
+        return { kind: "whoami", ...(agent ? { agent } : {}) };
+    }
+    if (head === "session")
+        return parseSessionCommand(args.slice(1));
+    if (head === "changelog") {
+        const sliced = args.slice(1);
+        const { agent, rest: remaining } = extractAgentFlag(sliced);
+        let from;
+        const fromIdx = remaining.indexOf("--from");
+        if (fromIdx !== -1 && remaining[fromIdx + 1]) {
+            from = remaining[fromIdx + 1];
+        }
+        return { kind: "changelog", ...(from ? { from } : {}), ...(agent ? { agent } : {}) };
+    }
+    if (head === "thoughts")
+        return parseThoughtsCommand(args.slice(1));
     if (head === "chat") {
         if (!second)
             throw new Error(`Usage\n${usage()}`);
@@ -263,38 +966,6 @@ function parseOuroCommand(args) {
         return parseLinkCommand(args.slice(1));
     throw new Error(`Unknown command '${args.join(" ")}'.\n${usage()}`);
 }
-function defaultSendCommand(socketPath, command) {
-    return new Promise((resolve, reject) => {
-        const client = net.createConnection(socketPath);
-        let raw = "";
-        client.on("connect", () => {
-            client.write(JSON.stringify(command));
-            client.end();
-        });
-        client.on("data", (chunk) => {
-            raw += chunk.toString("utf-8");
-        });
-        client.on("error", reject);
-        client.on("end", () => {
-            const trimmed = raw.trim();
-            if (trimmed.length === 0 && command.kind === "daemon.stop") {
-                resolve({ ok: true, message: "daemon stopped" });
-                return;
-            }
-            if (trimmed.length === 0) {
-                reject(new Error("Daemon returned empty response."));
-                return;
-            }
-            try {
-                const parsed = JSON.parse(trimmed);
-                resolve(parsed);
-            }
-            catch (error) {
-                reject(error);
-            }
-        });
-    });
-}
 function defaultStartDaemonProcess(socketPath) {
     const entry = path.join((0, identity_1.getRepoRoot)(), "dist", "heart", "daemon", "daemon-entry.js");
     const child = (0, child_process_1.spawn)("node", [entry, "--socket", socketPath], {
@@ -308,45 +979,32 @@ function defaultWriteStdout(text) {
     // eslint-disable-next-line no-console -- terminal UX: CLI command output
     console.log(text);
 }
-function defaultCheckSocketAlive(socketPath) {
-    return new Promise((resolve) => {
-        const client = net.createConnection(socketPath);
-        let raw = "";
-        let done = false;
-        const finalize = (alive) => {
-            if (done)
-                return;
-            done = true;
-            resolve(alive);
-        };
-        if ("setTimeout" in client && typeof client.setTimeout === "function") {
-            client.setTimeout(800, () => {
-                client.destroy();
-                finalize(false);
-            });
+/**
+ * Read the runtimeVersion from the first .ouro bundle's bundle-meta.json.
+ * Returns undefined if none found or unreadable.
+ */
+function readFirstBundleMetaVersion(bundlesRoot) {
+    try {
+        if (!fs.existsSync(bundlesRoot))
+            return undefined;
+        const entries = fs.readdirSync(bundlesRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            /* v8 ignore next -- skip non-.ouro dirs: tested via version-detect tests @preserve */
+            if (!entry.isDirectory() || !entry.name.endsWith(".ouro"))
+                continue;
+            const metaPath = path.join(bundlesRoot, entry.name, "bundle-meta.json");
+            if (!fs.existsSync(metaPath))
+                continue;
+            const raw = fs.readFileSync(metaPath, "utf-8");
+            const meta = JSON.parse(raw);
+            if (meta.runtimeVersion)
+                return meta.runtimeVersion;
         }
-        client.on("connect", () => {
-            client.write(JSON.stringify({ kind: "daemon.status" }));
-            client.end();
-        });
-        client.on("data", (chunk) => {
-            raw += chunk.toString("utf-8");
-        });
-        client.on("error", () => finalize(false));
-        client.on("end", () => {
-            if (raw.trim().length === 0) {
-                finalize(false);
-                return;
-            }
-            try {
-                JSON.parse(raw);
-                finalize(true);
-            }
-            catch {
-                finalize(false);
-            }
-        });
-    });
+    }
+    catch {
+        // Best effort — return undefined on any error
+    }
+    return undefined;
 }
 function defaultCleanupStaleSocket(socketPath) {
     if (fs.existsSync(socketPath)) {
@@ -382,9 +1040,38 @@ function defaultFallbackPendingMessage(command) {
     });
     return pendingPath;
 }
-async function defaultInstallSubagents() {
-    return (0, subagent_installer_1.installSubagentsForAvailableCli)({
-        repoRoot: (0, identity_1.getRepoRoot)(),
+function defaultEnsureDaemonBootPersistence(socketPath) {
+    if (process.platform !== "darwin") {
+        return;
+    }
+    const homeDir = os.homedir();
+    const launchdDeps = {
+        exec: (cmd) => { (0, child_process_1.execSync)(cmd, { stdio: "ignore" }); },
+        writeFile: (filePath, content) => fs.writeFileSync(filePath, content, "utf-8"),
+        removeFile: (filePath) => fs.rmSync(filePath, { force: true }),
+        existsFile: (filePath) => fs.existsSync(filePath),
+        mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
+        homeDir,
+        userUid: process.getuid?.() ?? 0,
+    };
+    const entryPath = path.join((0, identity_1.getRepoRoot)(), "dist", "heart", "daemon", "daemon-entry.js");
+    /* v8 ignore next -- covered via mock in daemon-cli-defaults.test.ts; v8 on CI attributes the real fs.existsSync branch to the non-mock load @preserve */
+    if (!fs.existsSync(entryPath)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.entry_path_missing",
+            message: "entryPath does not exist on disk — plist may point to a stale location. Run 'ouro daemon install' from the correct location.",
+            meta: { entryPath },
+        });
+    }
+    const logDir = (0, identity_1.getAgentDaemonLogsDir)();
+    (0, launchd_1.installLaunchAgent)(launchdDeps, {
+        nodePath: process.execPath,
+        entryPath,
+        socketPath,
+        logDir,
+        envPath: process.env.PATH,
     });
 }
 async function defaultPromptInput(question) {
@@ -402,146 +1089,331 @@ async function defaultPromptInput(question) {
     }
 }
 function defaultListDiscoveredAgents() {
-    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+    return (0, agent_discovery_1.listEnabledBundleAgents)({
+        bundlesRoot: (0, identity_1.getAgentBundlesRoot)(),
+        readdirSync: fs.readdirSync,
+        readFileSync: fs.readFileSync,
+    });
+}
+function discoverExistingCredentials(secretsRoot) {
+    const found = [];
     let entries;
     try {
-        entries = fs.readdirSync(bundlesRoot, { withFileTypes: true });
+        entries = fs.readdirSync(secretsRoot, { withFileTypes: true });
     }
     catch {
-        return [];
+        return found;
     }
-    const discovered = [];
     for (const entry of entries) {
-        if (!entry.isDirectory() || !entry.name.endsWith(".ouro"))
+        if (!entry.isDirectory())
             continue;
-        const agentName = entry.name.slice(0, -5);
-        const configPath = path.join(bundlesRoot, entry.name, "agent.json");
-        let enabled = true;
+        const secretsPath = path.join(secretsRoot, entry.name, "secrets.json");
+        let raw;
         try {
-            const raw = fs.readFileSync(configPath, "utf-8");
-            const parsed = JSON.parse(raw);
-            if (typeof parsed.enabled === "boolean") {
-                enabled = parsed.enabled;
-            }
+            raw = fs.readFileSync(secretsPath, "utf-8");
         }
         catch {
             continue;
         }
-        if (enabled) {
-            discovered.push(agentName);
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed.providers)
+            continue;
+        for (const [provName, provConfig] of Object.entries(parsed.providers)) {
+            if (provName === "anthropic" && provConfig.setupToken) {
+                found.push({ agentName: entry.name, provider: "anthropic", credentials: { setupToken: provConfig.setupToken }, providerConfig: { ...provConfig } });
+            }
+            else if (provName === "openai-codex" && provConfig.oauthAccessToken) {
+                found.push({ agentName: entry.name, provider: "openai-codex", credentials: { oauthAccessToken: provConfig.oauthAccessToken }, providerConfig: { ...provConfig } });
+            }
+            else if (provName === "minimax" && provConfig.apiKey) {
+                found.push({ agentName: entry.name, provider: "minimax", credentials: { apiKey: provConfig.apiKey }, providerConfig: { ...provConfig } });
+            }
+            else if (provName === "azure" && provConfig.apiKey && provConfig.endpoint && provConfig.deployment) {
+                found.push({ agentName: entry.name, provider: "azure", credentials: { apiKey: provConfig.apiKey, endpoint: provConfig.endpoint, deployment: provConfig.deployment }, providerConfig: { ...provConfig } });
+            }
         }
     }
-    return discovered.sort((left, right) => left.localeCompare(right));
-}
-async function defaultLinkFriendIdentity(command) {
-    const friendStore = new store_file_1.FileFriendStore(path.join((0, identity_1.getAgentBundlesRoot)(), `${command.agent}.ouro`, "friends"));
-    const current = await friendStore.get(command.friendId);
-    if (!current) {
-        return `friend not found: ${command.friendId}`;
-    }
-    const alreadyLinked = current.externalIds.some((ext) => ext.provider === command.provider && ext.externalId === command.externalId);
-    if (alreadyLinked) {
-        return `identity already linked: ${command.provider}:${command.externalId}`;
-    }
-    const now = new Date().toISOString();
-    await friendStore.put(command.friendId, {
-        ...current,
-        externalIds: [
-            ...current.externalIds,
-            {
-                provider: command.provider,
-                externalId: command.externalId,
-                linkedAt: now,
-            },
-        ],
-        updatedAt: now,
+    // Deduplicate by provider+credential value (keep first seen)
+    const seen = new Set();
+    return found.filter((cred) => {
+        const key = `${cred.provider}:${JSON.stringify(cred.credentials)}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
     });
-    return `linked ${command.provider}:${command.externalId} to ${command.friendId}`;
 }
-/* v8 ignore next 49 -- integration: interactive terminal specialist session @preserve */
+/* v8 ignore start -- integration: interactive terminal specialist session @preserve */
 async function defaultRunAdoptionSpecialist() {
-    const readline = await Promise.resolve().then(() => __importStar(require("readline/promises")));
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const prompt = async (q) => {
-        const answer = await rl.question(q);
+    const { runCliSession } = await Promise.resolve().then(() => __importStar(require("../../senses/cli")));
+    const { patchRuntimeConfig } = await Promise.resolve().then(() => __importStar(require("../config")));
+    const { setAgentName, setAgentConfigOverride } = await Promise.resolve().then(() => __importStar(require("../identity")));
+    const readlinePromises = await Promise.resolve().then(() => __importStar(require("readline/promises")));
+    const crypto = await Promise.resolve().then(() => __importStar(require("crypto")));
+    // Phase 1: cold CLI — collect provider/credentials with a simple readline
+    const coldRl = readlinePromises.createInterface({ input: process.stdin, output: process.stdout });
+    const coldPrompt = async (q) => {
+        const answer = await coldRl.question(q);
         return answer.trim();
     };
+    let providerRaw;
+    let credentials = {};
+    let providerConfig = {};
+    const tempDir = path.join(os.tmpdir(), `ouro-hatch-${crypto.randomUUID()}`);
     try {
-        process.stdout.write("\nwelcome to ouro. let's get you set up.\n");
-        process.stdout.write("i need an API key to power our conversation.\n\n");
-        const providerRaw = await prompt("provider (anthropic/azure/minimax/openai-codex): ");
-        if (!isAgentProvider(providerRaw)) {
-            process.stdout.write("unknown provider. run `ouro hatch` to try again.\n");
-            return null;
+        const secretsRoot = path.join(os.homedir(), ".agentsecrets");
+        const discovered = discoverExistingCredentials(secretsRoot);
+        const existingBundleCount = (0, specialist_orchestrator_1.listExistingBundles)((0, identity_1.getAgentBundlesRoot)()).length;
+        const hatchVerb = existingBundleCount > 0 ? "let's hatch a new agent." : "let's hatch your first agent.";
+        // Default models per provider (used when entering new credentials)
+        const defaultModels = {
+            anthropic: "claude-opus-4-6",
+            minimax: "MiniMax-Text-01",
+            "openai-codex": "gpt-5.4",
+            "github-copilot": "claude-sonnet-4.6",
+            azure: "",
+        };
+        if (discovered.length > 0) {
+            process.stdout.write(`\n\ud83d\udc0d welcome to ouroboros! ${hatchVerb}\n`);
+            process.stdout.write("i found existing API credentials:\n\n");
+            const unique = [...new Map(discovered.map((d) => [`${d.provider}`, d])).values()];
+            for (let i = 0; i < unique.length; i++) {
+                const model = unique[i].providerConfig.model || unique[i].providerConfig.deployment || "";
+                const modelLabel = model ? `, ${model}` : "";
+                process.stdout.write(`  ${i + 1}. ${unique[i].provider}${modelLabel} (from ${unique[i].agentName})\n`);
+            }
+            process.stdout.write("\n");
+            const choice = await coldPrompt("use one of these? enter number, or 'new' for a different key: ");
+            const idx = parseInt(choice, 10) - 1;
+            if (idx >= 0 && idx < unique.length) {
+                providerRaw = unique[idx].provider;
+                credentials = unique[idx].credentials;
+                providerConfig = unique[idx].providerConfig;
+            }
+            else {
+                const pRaw = await coldPrompt("provider (anthropic/azure/minimax/openai-codex/github-copilot): ");
+                if (!isAgentProvider(pRaw)) {
+                    process.stdout.write("unknown provider. run `ouro hatch` to try again.\n");
+                    coldRl.close();
+                    return null;
+                }
+                providerRaw = pRaw;
+                providerConfig = { model: defaultModels[providerRaw] };
+                if (providerRaw === "anthropic")
+                    credentials.setupToken = await coldPrompt("API key: ");
+                if (providerRaw === "openai-codex")
+                    credentials.oauthAccessToken = await coldPrompt("OAuth token: ");
+                if (providerRaw === "minimax")
+                    credentials.apiKey = await coldPrompt("API key: ");
+                if (providerRaw === "azure") {
+                    credentials.apiKey = await coldPrompt("API key: ");
+                    credentials.endpoint = await coldPrompt("endpoint: ");
+                    credentials.deployment = await coldPrompt("deployment: ");
+                }
+            }
         }
-        const credentials = {};
-        if (providerRaw === "anthropic")
-            credentials.setupToken = await prompt("API key: ");
-        if (providerRaw === "openai-codex")
-            credentials.oauthAccessToken = await prompt("OAuth token: ");
-        if (providerRaw === "minimax")
-            credentials.apiKey = await prompt("API key: ");
-        if (providerRaw === "azure") {
-            credentials.apiKey = await prompt("API key: ");
-            credentials.endpoint = await prompt("endpoint: ");
-            credentials.deployment = await prompt("deployment: ");
+        else {
+            process.stdout.write(`\n\ud83d\udc0d welcome to ouroboros! ${hatchVerb}\n`);
+            process.stdout.write("i need an API key to power our conversation.\n\n");
+            const pRaw = await coldPrompt("provider (anthropic/azure/minimax/openai-codex/github-copilot): ");
+            if (!isAgentProvider(pRaw)) {
+                process.stdout.write("unknown provider. run `ouro hatch` to try again.\n");
+                coldRl.close();
+                return null;
+            }
+            providerRaw = pRaw;
+            providerConfig = { model: defaultModels[providerRaw] };
+            if (providerRaw === "anthropic")
+                credentials.setupToken = await coldPrompt("API key: ");
+            if (providerRaw === "openai-codex")
+                credentials.oauthAccessToken = await coldPrompt("OAuth token: ");
+            if (providerRaw === "minimax")
+                credentials.apiKey = await coldPrompt("API key: ");
+            if (providerRaw === "azure") {
+                credentials.apiKey = await coldPrompt("API key: ");
+                credentials.endpoint = await coldPrompt("endpoint: ");
+                credentials.deployment = await coldPrompt("deployment: ");
+            }
         }
-        rl.close();
+        coldRl.close();
         process.stdout.write("\n");
-        // Locate the bundled AdoptionSpecialist.ouro shipped with the npm package
+        // Phase 2: configure runtime for adoption specialist
         const bundleSourceDir = path.resolve(__dirname, "..", "..", "..", "AdoptionSpecialist.ouro");
         const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
-        const secretsRoot = path.join(os.homedir(), ".agentsecrets");
-        return await (0, specialist_orchestrator_1.runAdoptionSpecialist)({
-            bundleSourceDir,
-            bundlesRoot,
-            secretsRoot,
+        const secretsRoot2 = path.join(os.homedir(), ".agentsecrets");
+        // Suppress non-critical log noise during adoption (no secrets.json, etc.)
+        const { setRuntimeLogger } = await Promise.resolve().then(() => __importStar(require("../../nerves/runtime")));
+        const { createLogger } = await Promise.resolve().then(() => __importStar(require("../../nerves")));
+        setRuntimeLogger(createLogger({ level: "error" }));
+        // Configure runtime: set agent identity + config override so runAgent
+        // doesn't try to read from ~/AgentBundles/AdoptionSpecialist.ouro/
+        setAgentName("AdoptionSpecialist");
+        // Build specialist system prompt
+        const soulText = (0, specialist_orchestrator_1.loadSoulText)(bundleSourceDir);
+        const identitiesDir = path.join(bundleSourceDir, "psyche", "identities");
+        const identity = (0, specialist_orchestrator_1.pickRandomIdentity)(identitiesDir);
+        // Load identity-specific spinner phrases (falls back to DEFAULT_AGENT_PHRASES)
+        const { loadIdentityPhrases } = await Promise.resolve().then(() => __importStar(require("./specialist-orchestrator")));
+        const phrases = loadIdentityPhrases(bundleSourceDir, identity.fileName);
+        setAgentConfigOverride({
+            version: 1,
+            enabled: true,
             provider: providerRaw,
-            credentials,
-            humanName: os.userInfo().username,
-            createReadline: () => {
-                const rl2 = readline.createInterface({ input: process.stdin, output: process.stdout });
-                return { question: (q) => rl2.question(q), close: () => rl2.close() };
-            },
-            callbacks: {
-                onModelStart: () => { },
-                onModelStreamStart: () => { },
-                onTextChunk: (text) => process.stdout.write(text),
-                onReasoningChunk: () => { },
-                onToolStart: () => { },
-                onToolEnd: () => { },
-                onError: (err) => process.stderr.write(`error: ${err.message}\n`),
+            phrases,
+        });
+        patchRuntimeConfig({
+            providers: {
+                [providerRaw]: { ...providerConfig, ...credentials },
             },
         });
+        const existingBundles = (0, specialist_orchestrator_1.listExistingBundles)(bundlesRoot);
+        const systemPrompt = (0, specialist_prompt_1.buildSpecialistSystemPrompt)(soulText, identity.content, existingBundles, {
+            tempDir,
+            provider: providerRaw,
+        });
+        // Build specialist tools
+        const specialistTools = (0, specialist_tools_1.getSpecialistTools)();
+        const specialistExecTool = (0, specialist_tools_1.createSpecialistExecTool)({
+            tempDir,
+            credentials,
+            provider: providerRaw,
+            bundlesRoot,
+            secretsRoot: secretsRoot2,
+            animationWriter: (text) => process.stdout.write(text),
+        });
+        // Run the adoption specialist session via runCliSession
+        const result = await runCliSession({
+            agentName: "AdoptionSpecialist",
+            tools: specialistTools,
+            execTool: specialistExecTool,
+            exitOnToolCall: "complete_adoption",
+            autoFirstTurn: true,
+            banner: false,
+            disableCommands: true,
+            skipSystemPromptRefresh: true,
+            messages: [
+                { role: "system", content: systemPrompt },
+                { role: "user", content: "hi" },
+            ],
+        });
+        if (result.exitReason === "tool_exit" && result.toolResult) {
+            const parsed = typeof result.toolResult === "string" ? JSON.parse(result.toolResult) : result.toolResult;
+            if (parsed.success && parsed.agentName) {
+                return parsed.agentName;
+            }
+        }
+        return null;
     }
-    catch {
-        rl.close();
+    catch (err) {
+        process.stderr.write(`\nouro adoption error: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+        coldRl.close();
         return null;
     }
+    finally {
+        // Clear specialist config/identity so the hatched agent gets its own
+        setAgentConfigOverride(null);
+        const { resetProviderRuntime } = await Promise.resolve().then(() => __importStar(require("../core")));
+        resetProviderRuntime();
+        const { resetConfigCache } = await Promise.resolve().then(() => __importStar(require("../config")));
+        resetConfigCache();
+        // Restore default logging
+        const { setRuntimeLogger: restoreLogger } = await Promise.resolve().then(() => __importStar(require("../../nerves/runtime")));
+        restoreLogger(null);
+        // Clean up temp dir if it still exists
+        try {
+            if (fs.existsSync(tempDir)) {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+        }
+        catch {
+            // Best effort cleanup
+        }
+    }
 }
-function createDefaultOuroCliDeps(socketPath = "/tmp/ouroboros-daemon.sock") {
+/* v8 ignore stop */
+function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SOCKET_PATH) {
     return {
         socketPath,
-        sendCommand: defaultSendCommand,
+        sendCommand: socket_client_1.sendDaemonCommand,
         startDaemonProcess: defaultStartDaemonProcess,
         writeStdout: defaultWriteStdout,
-        checkSocketAlive: defaultCheckSocketAlive,
+        checkSocketAlive: socket_client_1.checkDaemonSocketAlive,
         cleanupStaleSocket: defaultCleanupStaleSocket,
         fallbackPendingMessage: defaultFallbackPendingMessage,
-        installSubagents: defaultInstallSubagents,
-        linkFriendIdentity: defaultLinkFriendIdentity,
         listDiscoveredAgents: defaultListDiscoveredAgents,
         runHatchFlow: hatch_flow_1.runHatchFlow,
         promptInput: defaultPromptInput,
         runAdoptionSpecialist: defaultRunAdoptionSpecialist,
+        runAuthFlow: auth_flow_1.runRuntimeAuthFlow,
         registerOuroBundleType: ouro_uti_1.registerOuroBundleUti,
+        installOuroCommand: ouro_path_installer_1.installOuroCommand,
+        /* v8 ignore start -- self-healing: ensures versioned layout has current version installed @preserve */
+        ensureCurrentVersionInstalled: () => {
+            const currentVersion = (0, ouro_version_manager_1.getCurrentVersion)({});
+            if (currentVersion)
+                return; // Already installed and linked
+            const version = (0, bundle_manifest_1.getPackageVersion)();
+            (0, ouro_version_manager_1.ensureLayout)({});
+            const cliHome = (0, ouro_version_manager_1.getOuroCliHome)();
+            const versionEntry = path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli", "dist", "heart", "daemon", "ouro-entry.js");
+            if (!fs.existsSync(versionEntry)) {
+                (0, ouro_version_manager_1.installVersion)(version, {});
+            }
+            (0, ouro_version_manager_1.activateVersion)(version, {});
+        },
+        /* v8 ignore stop */
+        syncGlobalOuroBotWrapper: ouro_bot_global_installer_1.syncGlobalOuroBotWrapper,
+        ensureSkillManagement: skill_management_installer_1.ensureSkillManagement,
+        ensureDaemonBootPersistence: defaultEnsureDaemonBootPersistence,
         /* v8 ignore next 3 -- integration: launches interactive CLI session @preserve */
         startChat: async (agentName) => {
             const { main } = await Promise.resolve().then(() => __importStar(require("../../senses/cli")));
             await main(agentName);
         },
+        scanSessions: async () => {
+            const agentName = (0, identity_1.getAgentName)();
+            const agentRoot = (0, identity_1.getAgentRoot)(agentName);
+            return (0, session_activity_1.listSessionActivity)({
+                sessionsDir: path.join(agentRoot, "state", "sessions"),
+                friendsDir: path.join(agentRoot, "friends"),
+                agentName,
+            }).map((entry) => ({
+                friendId: entry.friendId,
+                friendName: entry.friendName,
+                channel: entry.channel,
+                lastActivity: entry.lastActivityAt,
+            }));
+        },
     };
 }
+function formatMcpResponse(command, response) {
+    if (command.kind === "mcp.list") {
+        const allTools = response.data;
+        if (!allTools || allTools.length === 0) {
+            return response.message ?? "no tools available from connected MCP servers";
+        }
+        const lines = [];
+        for (const entry of allTools) {
+            lines.push(`[${entry.server}]`);
+            for (const tool of entry.tools) {
+                lines.push(`  ${tool.name}: ${tool.description}`);
+            }
+        }
+        return lines.join("\n");
+    }
+    // mcp.call
+    const result = response.data;
+    if (!result) {
+        return response.message ?? "no result";
+    }
+    return result.content.map((c) => c.text).join("\n");
+}
 function toDaemonCommand(command) {
     return command;
 }
@@ -549,28 +1421,17 @@ async function resolveHatchInput(command, deps) {
     const prompt = deps.promptInput;
     const agentName = command.agentName ?? (prompt ? await prompt("Hatchling name: ") : "");
     const humanName = command.humanName ?? (prompt ? await prompt("Your name: ") : os.userInfo().username);
-    const providerRaw = command.provider ?? (prompt ? await prompt("Provider (azure|anthropic|minimax|openai-codex): ") : "");
+    const providerRaw = command.provider ?? (prompt ? await prompt("Provider (azure|anthropic|minimax|openai-codex|github-copilot): ") : "");
     if (!agentName || !humanName || !isAgentProvider(providerRaw)) {
         throw new Error(`Usage\n${usage()}`);
     }
-    const credentials = { ...(command.credentials ?? {}) };
-    if (providerRaw === "anthropic" && !credentials.setupToken && prompt) {
-        credentials.setupToken = await prompt("Anthropic setup-token: ");
-    }
-    if (providerRaw === "openai-codex" && !credentials.oauthAccessToken && prompt) {
-        credentials.oauthAccessToken = await prompt("OpenAI Codex OAuth token: ");
-    }
-    if (providerRaw === "minimax" && !credentials.apiKey && prompt) {
-        credentials.apiKey = await prompt("MiniMax API key: ");
-    }
-    if (providerRaw === "azure") {
-        if (!credentials.apiKey && prompt)
-            credentials.apiKey = await prompt("Azure API key: ");
-        if (!credentials.endpoint && prompt)
-            credentials.endpoint = await prompt("Azure endpoint: ");
-        if (!credentials.deployment && prompt)
-            credentials.deployment = await prompt("Azure deployment: ");
-    }
+    const credentials = await (0, auth_flow_1.resolveHatchCredentials)({
+        agentName,
+        provider: providerRaw,
+        credentials: command.credentials,
+        promptInput: prompt,
+        runAuthFlow: deps.runAuthFlow,
+    });
     return {
         agentName,
         humanName,
@@ -596,12 +1457,274 @@ async function registerOuroBundleTypeNonBlocking(deps) {
         });
     }
 }
+async function performSystemSetup(deps) {
+    // Install ouro command to PATH (non-blocking)
+    if (deps.installOuroCommand) {
+        try {
+            const installResult = deps.installOuroCommand();
+            /* v8 ignore next -- migration hint: only fires once during old→new layout migration @preserve */
+            if (installResult.migratedFromOldPath) {
+                deps.writeStdout("migrated ouro to ~/.ouro-cli/ — open a new terminal or run: source ~/.zshrc");
+            }
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_ouro_cmd_error",
+                message: "failed to install ouro command to PATH",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
+            });
+        }
+    }
+    // Self-healing: ensure current version is installed in ~/.ouro-cli/ layout.
+    // Handles the case where the wrapper exists but CurrentVersion is missing
+    // (e.g., first run after migration from old npx wrapper).
+    if (deps.ensureCurrentVersionInstalled) {
+        try {
+            deps.ensureCurrentVersionInstalled();
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_version_install_error",
+                message: "failed to ensure current version installed",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive @preserve */ String(error) },
+            });
+        }
+    }
+    if (deps.syncGlobalOuroBotWrapper) {
+        try {
+            await Promise.resolve(deps.syncGlobalOuroBotWrapper());
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_ouro_bot_wrapper_error",
+                message: "failed to sync global ouro.bot wrapper",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
+            });
+        }
+    }
+    // Ensure skill-management skill is available
+    if (deps.ensureSkillManagement) {
+        try {
+            await deps.ensureSkillManagement();
+            /* v8 ignore start -- defensive: ensureSkillManagement handles its own errors internally @preserve */
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_skill_management_error",
+                message: "failed to ensure skill-management skill",
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        /* v8 ignore stop */
+    }
+    // Register .ouro bundle type (UTI on macOS)
+    await registerOuroBundleTypeNonBlocking(deps);
+}
+function executeTaskCommand(command, taskMod) {
+    if (command.kind === "task.board") {
+        if (command.status) {
+            const lines = taskMod.boardStatus(command.status);
+            return lines.length > 0 ? lines.join("\n") : "no tasks in that status";
+        }
+        const board = taskMod.getBoard();
+        return board.full || board.compact || "no tasks found";
+    }
+    if (command.kind === "task.create") {
+        try {
+            const created = taskMod.createTask({
+                title: command.title,
+                type: command.type ?? "one-shot",
+                category: "general",
+                body: "",
+            });
+            return `created: ${created}`;
+        }
+        catch (error) {
+            return `error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+        }
+    }
+    if (command.kind === "task.update") {
+        const result = taskMod.updateStatus(command.id, command.status);
+        if (!result.ok) {
+            return `error: ${result.reason ?? "status update failed"}`;
+        }
+        const archivedSuffix = result.archived && result.archived.length > 0
+            ? ` | archived: ${result.archived.join(", ")}`
+            : "";
+        return `updated: ${command.id} -> ${result.to}${archivedSuffix}`;
+    }
+    if (command.kind === "task.show") {
+        const task = taskMod.getTask(command.id);
+        if (!task)
+            return `task not found: ${command.id}`;
+        return [
+            `title: ${task.title}`,
+            `type: ${task.type}`,
+            `status: ${task.status}`,
+            `category: ${task.category}`,
+            `created: ${task.created}`,
+            `updated: ${task.updated}`,
+            `path: ${task.path}`,
+            task.body ? `\n${task.body}` : "",
+        ].filter(Boolean).join("\n");
+    }
+    if (command.kind === "task.actionable") {
+        const lines = taskMod.boardAction();
+        return lines.length > 0 ? lines.join("\n") : "no action required";
+    }
+    if (command.kind === "task.deps") {
+        const lines = taskMod.boardDeps();
+        return lines.length > 0 ? lines.join("\n") : "no unresolved dependencies";
+    }
+    // command.kind === "task.sessions"
+    const lines = taskMod.boardSessions();
+    return lines.length > 0 ? lines.join("\n") : "no active sessions";
+}
+const TRUST_RANK = { family: 4, friend: 3, acquaintance: 2, stranger: 1 };
+/* v8 ignore start -- defensive: ?? fallbacks are unreachable when inputs are valid TrustLevel values @preserve */
+function higherTrust(a, b) {
+    const rankA = TRUST_RANK[a ?? "stranger"] ?? 1;
+    const rankB = TRUST_RANK[b ?? "stranger"] ?? 1;
+    return rankA >= rankB ? (a ?? "stranger") : (b ?? "stranger");
+}
+/* v8 ignore stop */
+async function executeFriendCommand(command, store) {
+    if (command.kind === "friend.list") {
+        const listAll = store.listAll;
+        if (!listAll)
+            return "friend store does not support listing";
+        const friends = await listAll.call(store);
+        if (friends.length === 0)
+            return "no friends found";
+        const lines = friends.map((f) => {
+            const trust = f.trustLevel ?? "unknown";
+            return `${f.id}  ${f.name}  ${trust}`;
+        });
+        return lines.join("\n");
+    }
+    if (command.kind === "friend.show") {
+        const record = await store.get(command.friendId);
+        if (!record)
+            return `friend not found: ${command.friendId}`;
+        return JSON.stringify(record, null, 2);
+    }
+    if (command.kind === "friend.create") {
+        const now = new Date().toISOString();
+        const id = (0, crypto_1.randomUUID)();
+        const trustLevel = (command.trustLevel ?? "acquaintance");
+        await store.put(id, {
+            id,
+            name: command.name,
+            trustLevel,
+            externalIds: [],
+            tenantMemberships: [],
+            toolPreferences: {},
+            notes: {},
+            totalTokens: 0,
+            createdAt: now,
+            updatedAt: now,
+            schemaVersion: 1,
+        });
+        return `created: ${id} (${command.name}, ${trustLevel})`;
+    }
+    if (command.kind === "friend.update") {
+        const current = await store.get(command.friendId);
+        if (!current)
+            return `friend not found: ${command.friendId}`;
+        const now = new Date().toISOString();
+        await store.put(command.friendId, {
+            ...current,
+            trustLevel: command.trustLevel,
+            role: command.trustLevel,
+            updatedAt: now,
+        });
+        return `updated: ${command.friendId} → trust=${command.trustLevel}`;
+    }
+    if (command.kind === "friend.link") {
+        const current = await store.get(command.friendId);
+        if (!current)
+            return `friend not found: ${command.friendId}`;
+        const alreadyLinked = current.externalIds.some((ext) => ext.provider === command.provider && ext.externalId === command.externalId);
+        if (alreadyLinked)
+            return `identity already linked: ${command.provider}:${command.externalId}`;
+        const now = new Date().toISOString();
+        const newExternalIds = [
+            ...current.externalIds,
+            { provider: command.provider, externalId: command.externalId, linkedAt: now },
+        ];
+        // Orphan cleanup: check if another friend has this externalId
+        const orphan = await store.findByExternalId(command.provider, command.externalId);
+        let mergeMessage = "";
+        let mergedNotes = { ...current.notes };
+        let mergedTrust = current.trustLevel;
+        let orphanExternalIds = [];
+        if (orphan && orphan.id !== command.friendId) {
+            // Merge orphan's notes (target's notes take priority)
+            mergedNotes = { ...orphan.notes, ...current.notes };
+            // Keep higher trust level
+            mergedTrust = higherTrust(current.trustLevel, orphan.trustLevel);
+            // Collect orphan's other externalIds (excluding the one being linked)
+            orphanExternalIds = orphan.externalIds.filter((ext) => !(ext.provider === command.provider && ext.externalId === command.externalId));
+            await store.delete(orphan.id);
+            mergeMessage = ` (merged orphan ${orphan.id})`;
+        }
+        await store.put(command.friendId, {
+            ...current,
+            externalIds: [...newExternalIds, ...orphanExternalIds],
+            notes: mergedNotes,
+            trustLevel: mergedTrust,
+            updatedAt: now,
+        });
+        return `linked ${command.provider}:${command.externalId} to ${command.friendId}${mergeMessage}`;
+    }
+    // command.kind === "friend.unlink"
+    const current = await store.get(command.friendId);
+    if (!current)
+        return `friend not found: ${command.friendId}`;
+    const idx = current.externalIds.findIndex((ext) => ext.provider === command.provider && ext.externalId === command.externalId);
+    if (idx === -1)
+        return `identity not linked: ${command.provider}:${command.externalId}`;
+    const now = new Date().toISOString();
+    const filtered = current.externalIds.filter((_, i) => i !== idx);
+    await store.put(command.friendId, { ...current, externalIds: filtered, updatedAt: now });
+    return `unlinked ${command.provider}:${command.externalId} from ${command.friendId}`;
+}
+function executeReminderCommand(command, taskMod) {
+    try {
+        const created = taskMod.createTask({
+            title: command.title,
+            type: command.cadence ? "habit" : "one-shot",
+            category: command.category ?? "reminder",
+            body: command.body,
+            scheduledAt: command.scheduledAt,
+            cadence: command.cadence,
+            requester: command.requester,
+        });
+        return `created: ${created}`;
+    }
+    catch (error) {
+        return `error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+    }
+}
 async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     if (args.includes("--help") || args.includes("-h")) {
         const text = usage();
         deps.writeStdout(text);
         return text;
     }
+    if (args.length === 1 && (args[0] === "-v" || args[0] === "--version")) {
+        const text = formatVersionOutput();
+        deps.writeStdout(text);
+        return text;
+    }
     let command;
     try {
         command = parseOuroCommand(args);
@@ -620,23 +1743,12 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     if (args.length === 0) {
         const discovered = await Promise.resolve(deps.listDiscoveredAgents ? deps.listDiscoveredAgents() : defaultListDiscoveredAgents());
         if (discovered.length === 0 && deps.runAdoptionSpecialist) {
+            // System setup first — ouro command, subagents, UTI — before the interactive specialist
+            await performSystemSetup(deps);
             const hatchlingName = await deps.runAdoptionSpecialist();
             if (!hatchlingName) {
                 return "";
             }
-            try {
-                await deps.installSubagents();
-            }
-            catch (error) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    component: "daemon",
-                    event: "daemon.subagent_install_error",
-                    message: "subagent auto-install failed",
-                    meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
-                });
-            }
-            await registerOuroBundleTypeNonBlocking(deps);
             await ensureDaemonRunning(deps);
             if (deps.startChat) {
                 await deps.startChat(hatchlingName);
@@ -683,54 +1795,473 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
         meta: { kind: command.kind },
     });
     if (command.kind === "daemon.up") {
-        try {
-            await deps.installSubagents();
+        // ── versioned CLI update check ──
+        if (deps.checkForCliUpdate) {
+            let pendingReExec = false;
+            try {
+                const updateResult = await deps.checkForCliUpdate();
+                if (updateResult.available && updateResult.latestVersion) {
+                    /* v8 ignore next -- fallback: getCurrentCliVersion always injected in tests @preserve */
+                    const currentVersion = deps.getCurrentCliVersion?.() ?? "unknown";
+                    await deps.installCliVersion(updateResult.latestVersion);
+                    deps.activateCliVersion(updateResult.latestVersion);
+                    deps.writeStdout(`ouro updated to ${updateResult.latestVersion} (was ${currentVersion})`);
+                    pendingReExec = true;
+                }
+                /* v8 ignore start -- update check error: tested via daemon-cli-update-flow.test.ts @preserve */
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.cli_update_check_error",
+                    message: "CLI update check failed",
+                    meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
+                });
+            }
+            /* v8 ignore stop */
+            if (pendingReExec) {
+                deps.reExecFromNewVersion(args);
+            }
         }
-        catch (error) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "warn",
-                component: "daemon",
-                event: "daemon.subagent_install_error",
-                message: "subagent auto-install failed",
-                meta: { error: error instanceof Error ? error.message : String(error) },
-            });
+        await performSystemSetup(deps);
+        if (deps.ensureDaemonBootPersistence) {
+            try {
+                await Promise.resolve(deps.ensureDaemonBootPersistence(deps.socketPath));
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.system_setup_launchd_error",
+                    message: "failed to persist daemon boot startup",
+                    meta: { error: error instanceof Error ? error.message : String(error), socketPath: deps.socketPath },
+                });
+            }
+        }
+        // Run update hooks before starting daemon so user sees the output
+        (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
+        const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+        const currentVersion = (0, bundle_manifest_1.getPackageVersion)();
+        // Snapshot the previous CLI version from the first bundle-meta before
+        // hooks overwrite it. This detects when npx downloaded a newer CLI.
+        const previousCliVersion = readFirstBundleMetaVersion(bundlesRoot);
+        const updateSummary = await (0, update_hooks_1.applyPendingUpdates)(bundlesRoot, currentVersion);
+        // Notify about CLI binary update (npx downloaded a new version)
+        /* v8 ignore start -- CLI update detection: tested via daemon-cli-version-detect.test.ts @preserve */
+        if (previousCliVersion && previousCliVersion !== currentVersion) {
+            deps.writeStdout(`ouro updated to ${currentVersion} (was ${previousCliVersion})`);
+        }
+        /* v8 ignore stop */
+        if (updateSummary.updated.length > 0) {
+            const agents = updateSummary.updated.map((e) => e.agent);
+            const from = updateSummary.updated[0].from;
+            const to = updateSummary.updated[0].to;
+            const fromStr = from ? ` (was ${from})` : "";
+            const count = agents.length;
+            deps.writeStdout(`updated ${count} agent${count === 1 ? "" : "s"} to runtime ${to}${fromStr}`);
         }
-        await registerOuroBundleTypeNonBlocking(deps);
         const daemonResult = await ensureDaemonRunning(deps);
         deps.writeStdout(daemonResult.message);
         return daemonResult.message;
     }
+    // ── rollback command (local, no daemon socket needed for symlinks) ──
+    /* v8 ignore start -- rollback/versions: tested via daemon-cli-rollback/versions tests @preserve */
+    if (command.kind === "rollback") {
+        const currentVersion = deps.getCurrentCliVersion?.() ?? "unknown";
+        if (command.version) {
+            // Rollback to a specific version
+            const installed = deps.listCliVersions?.() ?? [];
+            if (!installed.includes(command.version)) {
+                try {
+                    await deps.installCliVersion(command.version);
+                }
+                catch (error) {
+                    const message = `failed to install version ${command.version}: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+                    deps.writeStdout(message);
+                    return message;
+                }
+            }
+            deps.activateCliVersion(command.version);
+        }
+        else {
+            // Rollback to previous version
+            const previousVersion = deps.getPreviousCliVersion?.();
+            if (!previousVersion) {
+                const message = "no previous version to roll back to";
+                deps.writeStdout(message);
+                return message;
+            }
+            deps.activateCliVersion(previousVersion);
+            command = { ...command, version: previousVersion };
+        }
+        // Stop daemon (non-fatal if not running)
+        try {
+            await deps.sendCommand(deps.socketPath, { kind: "daemon.stop" });
+        }
+        catch {
+            // Daemon may not be running — that's fine
+        }
+        const message = `rolled back to ${command.version} (was ${currentVersion})`;
+        deps.writeStdout(message);
+        return message;
+    }
+    // ── versions command (local, no daemon socket needed) ──
+    if (command.kind === "versions") {
+        const versions = deps.listCliVersions?.() ?? [];
+        if (versions.length === 0) {
+            const message = "no versions installed";
+            deps.writeStdout(message);
+            return message;
+        }
+        const current = deps.getCurrentCliVersion?.();
+        const previous = deps.getPreviousCliVersion?.();
+        const lines = versions.map((v) => {
+            let line = v;
+            if (v === current)
+                line += " * current";
+            if (v === previous)
+                line += " (previous)";
+            return line;
+        });
+        const message = lines.join("\n");
+        deps.writeStdout(message);
+        return message;
+    }
+    /* v8 ignore stop */
     if (command.kind === "daemon.logs" && deps.tailLogs) {
         deps.tailLogs();
         return "";
     }
-    if (command.kind === "friend.link") {
-        const linker = deps.linkFriendIdentity ?? defaultLinkFriendIdentity;
-        const message = await linker(command);
+    // ── mcp subcommands (routed through daemon socket) ──
+    if (command.kind === "mcp.list" || command.kind === "mcp.call") {
+        const daemonCommand = toDaemonCommand(command);
+        let response;
+        try {
+            response = await deps.sendCommand(deps.socketPath, daemonCommand);
+        }
+        catch {
+            const message = "daemon unavailable — start with `ouro up` first";
+            deps.writeStdout(message);
+            return message;
+        }
+        if (!response.ok) {
+            const message = response.error ?? "unknown error";
+            deps.writeStdout(message);
+            return message;
+        }
+        const message = formatMcpResponse(command, response);
+        deps.writeStdout(message);
+        return message;
+    }
+    // ── task subcommands (local, no daemon socket needed) ──
+    if (command.kind === "task.board" || command.kind === "task.create" || command.kind === "task.update" ||
+        command.kind === "task.show" || command.kind === "task.actionable" || command.kind === "task.deps" ||
+        command.kind === "task.sessions") {
+        /* v8 ignore start -- production default: requires full identity setup @preserve */
+        const taskMod = deps.taskModule ?? (0, tasks_1.getTaskModule)();
+        /* v8 ignore stop */
+        const message = executeTaskCommand(command, taskMod);
+        deps.writeStdout(message);
+        return message;
+    }
+    // ── reminder subcommands (local, no daemon socket needed) ──
+    if (command.kind === "reminder.create") {
+        /* v8 ignore start -- production default: requires full identity setup @preserve */
+        const taskMod = deps.taskModule ?? (0, tasks_1.getTaskModule)();
+        /* v8 ignore stop */
+        const message = executeReminderCommand(command, taskMod);
+        deps.writeStdout(message);
+        return message;
+    }
+    // ── friend subcommands (local, no daemon socket needed) ──
+    if (command.kind === "friend.list" || command.kind === "friend.show" || command.kind === "friend.create" ||
+        command.kind === "friend.update" || command.kind === "friend.link" || command.kind === "friend.unlink") {
+        /* v8 ignore start -- production default: requires full identity setup @preserve */
+        let store = deps.friendStore;
+        if (!store) {
+            // Derive agent-scoped friends dir from --agent flag or link/unlink's agent field
+            const agentName = ("agent" in command && command.agent) ? command.agent : undefined;
+            const friendsDir = agentName
+                ? path.join((0, identity_1.getAgentBundlesRoot)(), `${agentName}.ouro`, "friends")
+                : path.join((0, identity_1.getAgentBundlesRoot)(), "friends");
+            store = new store_file_1.FileFriendStore(friendsDir);
+        }
+        /* v8 ignore stop */
+        const message = await executeFriendCommand(command, store);
         deps.writeStdout(message);
         return message;
     }
+    // ── auth (local, no daemon socket needed) ──
+    if (command.kind === "auth.run") {
+        const provider = command.provider ?? (0, auth_flow_1.readAgentConfigForAgent)(command.agent).config.provider;
+        /* v8 ignore next -- tests always inject runAuthFlow; default is for production @preserve */
+        const authRunner = deps.runAuthFlow ?? auth_flow_1.runRuntimeAuthFlow;
+        const result = await authRunner({
+            agentName: command.agent,
+            provider,
+            promptInput: deps.promptInput,
+        });
+        // Behavior: ouro auth stores credentials only — does NOT switch provider.
+        // Use `ouro auth switch` to change the active provider.
+        deps.writeStdout(result.message);
+        return result.message;
+    }
+    // ── auth verify (local, no daemon socket needed) ──
+    /* v8 ignore start -- auth verify/switch: tested in daemon-cli.test.ts but v8 traces differ in CI @preserve */
+    if (command.kind === "auth.verify") {
+        const { secrets } = (0, auth_flow_1.loadAgentSecrets)(command.agent);
+        const providers = secrets.providers;
+        const fetchFn = deps.fetchImpl ?? fetch;
+        if (command.provider) {
+            const status = await verifyProviderCredentials(command.provider, providers, fetchFn);
+            const message = `${command.provider}: ${status}`;
+            deps.writeStdout(message);
+            return message;
+        }
+        const lines = [];
+        for (const p of Object.keys(providers)) {
+            const status = await verifyProviderCredentials(p, providers, fetchFn);
+            lines.push(`${p}: ${status}`);
+        }
+        const message = lines.join("\n");
+        deps.writeStdout(message);
+        return message;
+    }
+    // ── auth switch (local, no daemon socket needed) ──
+    if (command.kind === "auth.switch") {
+        const { secrets } = (0, auth_flow_1.loadAgentSecrets)(command.agent);
+        const providerSecrets = secrets.providers[command.provider];
+        if (!providerSecrets || !hasStoredCredentials(command.provider, providerSecrets)) {
+            const message = `no credentials stored for ${command.provider}. Run \`ouro auth --agent ${command.agent} --provider ${command.provider}\` first.`;
+            deps.writeStdout(message);
+            return message;
+        }
+        (0, auth_flow_1.writeAgentProviderSelection)(command.agent, command.provider);
+        const message = `switched ${command.agent} to ${command.provider}`;
+        deps.writeStdout(message);
+        return message;
+    }
+    /* v8 ignore stop */
+    // ── config models (local, no daemon socket needed) ──
+    /* v8 ignore start -- config models: tested via daemon-cli.test.ts @preserve */
+    if (command.kind === "config.models") {
+        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent);
+        const provider = config.provider;
+        if (provider !== "github-copilot") {
+            const message = `model listing not available for ${provider} — check provider documentation.`;
+            deps.writeStdout(message);
+            return message;
+        }
+        const { secrets } = (0, auth_flow_1.loadAgentSecrets)(command.agent);
+        const ghConfig = secrets.providers["github-copilot"];
+        if (!ghConfig.githubToken || !ghConfig.baseUrl) {
+            throw new Error(`github-copilot credentials not configured. Run \`ouro auth --agent ${command.agent} --provider github-copilot\` first.`);
+        }
+        const fetchFn = deps.fetchImpl ?? fetch;
+        const models = await listGithubCopilotModels(ghConfig.baseUrl, ghConfig.githubToken, fetchFn);
+        if (models.length === 0) {
+            const message = "no models found";
+            deps.writeStdout(message);
+            return message;
+        }
+        const lines = ["available models:"];
+        for (const m of models) {
+            const caps = m.capabilities?.length ? ` (${m.capabilities.join(", ")})` : "";
+            lines.push(`  ${m.id}${caps}`);
+        }
+        const message = lines.join("\n");
+        deps.writeStdout(message);
+        return message;
+    }
+    /* v8 ignore stop */
+    // ── config model (local, no daemon socket needed) ──
+    /* v8 ignore start -- config model: tested via daemon-cli.test.ts @preserve */
+    if (command.kind === "config.model") {
+        // Validate model availability for github-copilot before writing
+        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent);
+        if (config.provider === "github-copilot") {
+            const { secrets } = (0, auth_flow_1.loadAgentSecrets)(command.agent);
+            const ghConfig = secrets.providers["github-copilot"];
+            if (ghConfig.githubToken && ghConfig.baseUrl) {
+                const fetchFn = deps.fetchImpl ?? fetch;
+                try {
+                    const models = await listGithubCopilotModels(ghConfig.baseUrl, ghConfig.githubToken, fetchFn);
+                    const available = models.map((m) => m.id);
+                    if (available.length > 0 && !available.includes(command.modelName)) {
+                        const message = `model '${command.modelName}' not found. available models:\n${available.map((id) => `  ${id}`).join("\n")}`;
+                        deps.writeStdout(message);
+                        return message;
+                    }
+                }
+                catch {
+                    // Catalog validation failed — fall through to ping test
+                }
+                // Ping test: verify the model actually works before switching
+                const pingResult = await pingGithubCopilotModel(ghConfig.baseUrl, ghConfig.githubToken, command.modelName, fetchFn);
+                if (!pingResult.ok) {
+                    const message = `model '${command.modelName}' ping failed: ${pingResult.error}\nrun \`ouro config models --agent ${command.agent}\` to see available models.`;
+                    deps.writeStdout(message);
+                    return message;
+                }
+            }
+        }
+        const { provider, previousModel } = (0, auth_flow_1.writeAgentModel)(command.agent, command.modelName);
+        const message = previousModel
+            ? `updated ${command.agent} model on ${provider}: ${previousModel} → ${command.modelName}`
+            : `set ${command.agent} model on ${provider}: ${command.modelName}`;
+        deps.writeStdout(message);
+        return message;
+    }
+    /* v8 ignore stop */
+    // ── whoami (local, no daemon socket needed) ──
+    if (command.kind === "whoami") {
+        if (command.agent) {
+            const agentRoot = path.join((0, identity_1.getAgentBundlesRoot)(), `${command.agent}.ouro`);
+            const message = [
+                `agent: ${command.agent}`,
+                `home: ${agentRoot}`,
+                `bones: ${(0, runtime_metadata_1.getRuntimeMetadata)().version}`,
+            ].join("\n");
+            deps.writeStdout(message);
+            return message;
+        }
+        /* v8 ignore start -- production default: requires full identity setup @preserve */
+        try {
+            const info = deps.whoamiInfo
+                ? deps.whoamiInfo()
+                : {
+                    agentName: (0, identity_1.getAgentName)(),
+                    homePath: path.join((0, identity_1.getAgentBundlesRoot)(), `${(0, identity_1.getAgentName)()}.ouro`),
+                    bonesVersion: (0, runtime_metadata_1.getRuntimeMetadata)().version,
+                };
+            const message = [
+                `agent: ${info.agentName}`,
+                `home: ${info.homePath}`,
+                `bones: ${info.bonesVersion}`,
+            ].join("\n");
+            deps.writeStdout(message);
+            return message;
+        }
+        catch {
+            const message = "error: no agent context — use --agent <name> to specify";
+            deps.writeStdout(message);
+            return message;
+        }
+        /* v8 ignore stop */
+    }
+    // ── changelog (local, no daemon socket needed) ──
+    if (command.kind === "changelog") {
+        try {
+            const changelogPath = deps.getChangelogPath
+                ? deps.getChangelogPath()
+                : (0, bundle_manifest_1.getChangelogPath)();
+            const raw = fs.readFileSync(changelogPath, "utf-8");
+            const entries = JSON.parse(raw);
+            let filtered = entries;
+            if (command.from) {
+                const fromVersion = command.from;
+                filtered = entries.filter((e) => e.version > fromVersion);
+            }
+            if (filtered.length === 0) {
+                const message = "no changelog entries found.";
+                deps.writeStdout(message);
+                return message;
+            }
+            const lines = [];
+            for (const entry of filtered) {
+                lines.push(`## ${entry.version}${entry.date ? ` (${entry.date})` : ""}`);
+                if (entry.changes) {
+                    for (const change of entry.changes) {
+                        lines.push(`- ${change}`);
+                    }
+                }
+                lines.push("");
+            }
+            const message = lines.join("\n").trim();
+            deps.writeStdout(message);
+            return message;
+        }
+        catch {
+            const message = "no changelog entries found.";
+            deps.writeStdout(message);
+            return message;
+        }
+    }
+    // ── thoughts (local, no daemon socket needed) ──
+    if (command.kind === "thoughts") {
+        try {
+            const agentName = command.agent ?? (0, identity_1.getAgentName)();
+            const agentRoot = path.join((0, identity_1.getAgentBundlesRoot)(), `${agentName}.ouro`);
+            const sessionFilePath = (0, thoughts_1.getInnerDialogSessionPath)(agentRoot);
+            if (command.json) {
+                try {
+                    const raw = fs.readFileSync(sessionFilePath, "utf-8");
+                    deps.writeStdout(raw);
+                    return raw;
+                }
+                catch {
+                    const message = "no inner dialog session found";
+                    deps.writeStdout(message);
+                    return message;
+                }
+            }
+            const turns = (0, thoughts_1.parseInnerDialogSession)(sessionFilePath);
+            const message = (0, thoughts_1.formatThoughtTurns)(turns, command.last ?? 10);
+            deps.writeStdout(message);
+            if (command.follow) {
+                deps.writeStdout("\n\n--- following (ctrl+c to stop) ---\n");
+                /* v8 ignore start -- callback tested via followThoughts unit tests @preserve */
+                const stop = (0, thoughts_1.followThoughts)(sessionFilePath, (formatted) => {
+                    deps.writeStdout("\n" + formatted);
+                });
+                /* v8 ignore stop */
+                // Block until process exit; cleanup watcher on SIGINT/SIGTERM
+                return new Promise((resolve) => {
+                    const cleanup = () => { stop(); resolve(message); };
+                    process.once("SIGINT", cleanup);
+                    process.once("SIGTERM", cleanup);
+                });
+            }
+            return message;
+        }
+        catch {
+            const message = "error: no agent context — use --agent <name> to specify";
+            deps.writeStdout(message);
+            return message;
+        }
+    }
+    // ── session list (local, no daemon socket needed) ──
+    if (command.kind === "session.list") {
+        /* v8 ignore start -- production default: requires full identity setup @preserve */
+        const scanner = deps.scanSessions ?? (async () => []);
+        /* v8 ignore stop */
+        const sessions = await scanner();
+        if (sessions.length === 0) {
+            const message = "no active sessions";
+            deps.writeStdout(message);
+            return message;
+        }
+        const lines = sessions.map((s) => `${s.friendId}  ${s.friendName}  ${s.channel}  ${s.lastActivity}`);
+        const message = lines.join("\n");
+        deps.writeStdout(message);
+        return message;
+    }
+    if (command.kind === "chat.connect" && deps.startChat) {
+        await ensureDaemonRunning(deps);
+        await deps.startChat(command.agent);
+        return "";
+    }
     if (command.kind === "hatch.start") {
         // Route through adoption specialist when no explicit hatch args were provided
         const hasExplicitHatchArgs = !!(command.agentName || command.humanName || command.provider || command.credentials);
         if (deps.runAdoptionSpecialist && !hasExplicitHatchArgs) {
+            // System setup first — ouro command, subagents, UTI — before the interactive specialist
+            await performSystemSetup(deps);
             const hatchlingName = await deps.runAdoptionSpecialist();
             if (!hatchlingName) {
                 return "";
             }
-            try {
-                await deps.installSubagents();
-            }
-            catch (error) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    component: "daemon",
-                    event: "daemon.subagent_install_error",
-                    message: "subagent auto-install failed",
-                    meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
-                });
-            }
-            await registerOuroBundleTypeNonBlocking(deps);
             await ensureDaemonRunning(deps);
             if (deps.startChat) {
                 await deps.startChat(hatchlingName);
@@ -746,19 +2277,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
         }
         const hatchInput = await resolveHatchInput(command, deps);
         const result = await hatchRunner(hatchInput);
-        try {
-            await deps.installSubagents();
-        }
-        catch (error) {
-            (0, runtime_1.emitNervesEvent)({
-                level: "warn",
-                component: "daemon",
-                event: "daemon.subagent_install_error",
-                message: "subagent auto-install failed",
-                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
-            });
-        }
-        await registerOuroBundleTypeNonBlocking(deps);
+        await performSystemSetup(deps);
         const daemonResult = await ensureDaemonRunning(deps);
         if (deps.startChat) {
             await deps.startChat(hatchInput.agentName);
@@ -780,9 +2299,22 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
             deps.writeStdout(message);
             return message;
         }
+        if (command.kind === "daemon.status" && isDaemonUnavailableError(error)) {
+            const message = daemonUnavailableStatusOutput(deps.socketPath);
+            deps.writeStdout(message);
+            return message;
+        }
+        if (command.kind === "daemon.stop" && isDaemonUnavailableError(error)) {
+            const message = "daemon not running";
+            deps.writeStdout(message);
+            return message;
+        }
         throw error;
     }
-    const message = response.summary ?? response.message ?? (response.ok ? "ok" : `error: ${response.error ?? "unknown error"}`);
+    const fallbackMessage = response.summary ?? response.message ?? (response.ok ? "ok" : `error: ${response.error ?? "unknown error"}`);
+    const message = command.kind === "daemon.status"
+        ? formatDaemonStatusOutput(response, fallbackMessage)
+        : fallbackMessage;
     deps.writeStdout(message);
     return message;
 }