@passioncode-ai/passioncode 0.1.53 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.2.1 - 2026-10-13
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.30.0`** (it was `v0.29.0`). The Node service kit now installs and uninstalls a launchd job the way the Python kit does: `launchdPlist`, `launchdInstall` and `launchdUninstall`. A service's plist comes out the same from either kit. The service probe (`check_service.py`) gains a rule, `lifecycle.supervisor-marker`: it fails a launchd job whose plist does not tell the service that launchd supervises it. Without that marker, a second copy that finds the lock held exits at once and launchd restarts it every few seconds.
+
+## 0.2.0 - 2026-10-13
+
+### Added
+
+- **`setup` (alias `onboard`): one command for a new computer and for one that is already set up.**
+  It checks everything first, then installs the PassionCode.ai apps that are missing (Fabric
+  Switchboard, Fabric Dashboards, Project Observatory, Fabric Inbox, and Fabric as an early
+  preview when Docker and the Supabase CLI are present), installs the skills, registers every
+  app's MCP server for every coding agent present, repairs what is wrong, checks again and prints
+  a before → after table with one list of the steps that stay yours. On a healthy computer it
+  changes nothing and exits 0. In a terminal it asks one question per app; `--yes`, `--with`,
+  `--without`, `--no-apps`, `--no-open`, `--dry-run` and `--json` serve agents and scripts.
+- **No unverified byte is installed.** Each release's `SHA256SUMS.asc` is verified against the
+  PassionCode.ai release key bundled in the package (pinned by fingerprint, no gpg needed); the
+  download must match the signed checksum and GitHub's digest; the app must pass `codesign`,
+  carry team `KJ35UYYL22`, have its notarization ticket stapled and pass Gatekeeper. An outdated
+  or damaged app is reinstalled only when it is not running, and the old one goes to the Trash.
+- **`doctor`: a read-only check of the whole setup** — prerequisites, the skill set, each app's
+  version, signature and team, each agent's MCP entries with one real proving call per server,
+  and the family's Fabric services. Every line names its state and its fix; exit 0 means no check
+  failed. `doctor --fix` runs setup's repairs without installing new apps.
+- **`update` registers Fabric Switchboard's MCP server (`switchboard mcp`)** next to Fabric
+  Dashboards', under the same never-clobber, reversible rules; an entry counts as the same only
+  with the same command and arguments. **`setup` also registers Fabric's (`fabric-mcp --runner
+  <agent>`)**: an early preview, it is never added by a background update (ADR-0004).
+- **Safer installs and removals**: an app is copied beside its target and swapped in with two
+  renames, after a second check that nothing runs from it; uninstall keeps a Codex entry that
+  gained settings since it was written; a dry run copies no config file.
+- **The `setting-up-passioncode` skill**: "set me up" or "check my setup" makes any coding agent
+  run setup or doctor, finish the steps an agent may take and hand you only sign-ins, consents
+  and secrets typed into a product's own hidden prompt. The README and passioncode.ai/start/
+  carry a one-paragraph prompt to paste into Claude Code or Codex.
+- **Session start names the problems of the last setup check** while it has any; it never runs
+  the check itself.
+
 ## 0.1.53 - 2026-10-13
 
 ### Changed

package/README.md

@@ -1,38 +1,65 @@
 # PassionCode.ai launcher
 
-The **PassionCode.ai launcher** (`@passioncode-ai/passioncode` on npm) installs and updates the
-PassionCode.ai skills and plugins listed in [`family.json`](family.json) — the Fabric Agent Adapter,
-Observatory Log and the organization's working rules — for Claude Code and every other agent on your machine, as one set.
-It is how a teammate's agent gets the tools that build for Fabric, PassionCode.ai's CEO AI agent,
-and it works on its own: no Fabric install, no account, no key.
+The **PassionCode.ai launcher** (`@passioncode-ai/passioncode` on npm) sets up PassionCode.ai on a
+computer with one command: the apps (Fabric, Fabric Switchboard, Fabric Dashboards, Fabric Inbox,
+Project Observatory) from their signed releases, their MCP servers for every coding agent on it,
+and the PassionCode.ai skills listed in [`family.json`](family.json). Run the same command on a
+computer that is already set up, and it checks everything, repairs what is wrong and tells you
+what changed.
 
 ```bash
-npx @passioncode-ai/passioncode@latest update
+npx @passioncode-ai/passioncode@latest setup     # a new computer: set up · an existing one: check and repair
+npx @passioncode-ai/passioncode@latest doctor    # check only; changes nothing
 ```
 
 | Member | Skills |
 |---|---|
 | Fabric Agent Adapter | `creating-fabric-agents`, `adapting-projects-to-fabric`, `building-fabric-services` |
 | Observatory Log | `explaining-changes`, `handling-secrets`, `tracking-resources` (+ its session hooks) |
-| passioncode | `working-in-passioncode` (the organisation's working rules, for every contributor's agent) and the once-a-day update check |
+| passioncode | `setting-up-passioncode` (set up and check a computer), `working-in-passioncode` (the organisation's working rules, for every contributor's agent) and the once-a-day update check |
 
 Only PassionCode.ai products are members. Agents that people build for themselves stay
 out of it, even when they implement Fabric protocols.
 
+## Set it up with your coding agent
+
+Paste this into Claude Code, Codex or another coding agent:
+
+> Set up PassionCode.ai on this computer, or check and repair it if it is already set up. Run
+> `npx --yes @passioncode-ai/passioncode@latest setup --yes --json` (it needs Node 18 or newer)
+> and read its JSON: it installs the missing apps from their signed releases, the skills and
+> every MCP server, repairs whatever is wrong, and checks everything again. Do not download or
+> install anything by hand, and never stop or kill a running app. Then run each product
+> onboarding step it lists that an agent may run, never ask me for a key or password in the
+> chat (the tools open their own hidden prompts), and finish with
+> `npx --yes @passioncode-ai/passioncode@latest doctor`. Tell me briefly what you set up or
+> fixed, what still fails, and the numbered steps only I can do, such as signing in, and
+> remind me to restart you so the new skills and MCP servers load.
+
+Once the skills are installed, "set me up" or "check my setup" is enough: the
+`setting-up-passioncode` skill knows the rest. What stays yours: signing in, consenting, typing a
+secret into a product's own hidden prompt, starting Docker for Fabric, and restarting your agent.
+
 ## Quick start for a new teammate
 
 1. **Install** (Node 18 or newer; the Claude Code CLI on `PATH` for the plugins):
-   `npx @passioncode-ai/passioncode@latest update`, then restart your agents. Check it with
-   `npx @passioncode-ai/passioncode@latest status` (every member `claude: plugin · hub: n/n`) and
-   `claude plugin list` (the plugins listed in `family.json`, under `@passioncode`).
-   Always call the scoped package shown above.
+   `npx @passioncode-ai/passioncode@latest setup`, then restart your agents. In a terminal it asks
+   one question per app; `--yes` accepts the plan, `--with`/`--without <ids>` choose apps
+   (`switchboard`, `dashboards`, `observatory`, `inbox`, `fabric`), `--no-apps` sets up the skills
+   and MCP only, `--dry-run` shows the plan. Apps are installed on macOS; on other systems setup
+   names each download page. Skills only: `npx @passioncode-ai/passioncode@latest update`.
 2. **Configure:** nothing to set, no account and no key. Background updates are on by default;
-   `npx @passioncode-ai/passioncode@latest config set update.auto off` turns them off.
-3. **MCP:** none today, and not planned. The launcher installs skills and session hooks and is
-   driven by its CLI (`update`, `status`, `restore`, `uninstall`, `config`); it neither serves nor
-   calls an MCP server. The products it installs for, and the ones that serve MCP (Fabric
-   Switchboard, Fabric Inbox, Fabric Dashboards), document their own registration and proving
-   call; the Fabric Agent Adapter's quick start builds and calls one.
+   `npx @passioncode-ai/passioncode@latest config set update.auto off` turns them off. Each app's
+   own onboarding (sign-ins, Fabric Inbox's server, Observatory's projects) is listed by `setup`.
+3. **MCP:** the launcher serves no MCP server of its own. It registers the apps' servers —
+   `fabric-dashboards`, `fabric` (`fabric-mcp --runner <agent>`) and `switchboard`
+   (`switchboard mcp`) — for Claude Code, Codex CLI, Gemini CLI and Kimi Code, and `doctor` proves
+   each one with a real call: `initialize`, `tools/list`, then `list_services`,
+   `switchboard_accounts` or `observatory_status`. Fabric's server is never started by doctor,
+   because it enrols a session as it starts: doctor checks its entry, and your agent's first
+   `fabric_whoami` is the proving call. Fabric is an early preview, so only `setup` registers it,
+   never a background update. Project Observatory and Fabric Inbox register their
+   own servers through their onboarding; `doctor` checks those too.
 4. **Develop:** clone, then `npm test` — there are no dependencies and no lockfile, so there is
    nothing to install (`npm ci` refuses to run here). `npm run vendor` builds `payload/` from the
    members pinned in `family.json`; `claude plugin validate ./payload --strict` checks it. Start
@@ -55,12 +82,34 @@ out of it, even when they implement Fabric protocols.
   `~/.passioncode/quarantine/` — `npx @passioncode-ai/passioncode@latest restore` puts them back.
 - Each version is an immutable release under `~/.passioncode/releases/<version>`; an update
   keeps the release it replaced for rollback and removes older ones.
-- When the Fabric Dashboards app is installed, `update` also registers its MCP server
-  (`fabric-dashboards`) for every agent that is present — Claude Code (through
-  `claude mcp add --scope user`), Codex CLI (`~/.codex/config.toml`), Gemini CLI
-  (`~/.gemini/settings.json`) and Kimi Code (`~/.kimi-code/mcp.json`). An entry that
-  already points at the same command is left alone; one that points elsewhere is reported
-  and kept. `restore` and `uninstall` remove what the launcher added.
+- `update` (and therefore `setup`) registers the MCP server inside each installed app — Fabric
+  Dashboards (`fabric-dashboards`), Fabric Switchboard (`switchboard`, unless Claude Code already
+  gets it from the `switchboard` plugin) and, from `setup` only because it is an early preview,
+  Fabric (`fabric`, with each agent's own `--runner`) —
+  for every agent that is present: Claude Code (through `claude mcp add --scope user`), Codex CLI
+  (`~/.codex/config.toml`), Gemini CLI (`~/.gemini/settings.json`) and Kimi Code
+  (`~/.kimi-code/mcp.json`). An entry that already exists is left alone; one that points elsewhere
+  is reported and kept. `restore` and `uninstall` remove what the launcher added
+  ([ADR-0003](docs/adr/0003-fabric-dashboards-mcp-registration.md),
+  [ADR-0004](docs/adr/0004-setup-installs-verified-apps-and-registers-their-mcp.md)).
+
+## Setup and doctor
+
+`setup` checks first, then installs the absent apps you chose, repairs what the checks found,
+checks again and prints a before → after table and the steps that stay yours. On a healthy
+computer it changes nothing and exits 0. An app is installed only after its release's
+`SHA256SUMS.asc` verifies against the PassionCode.ai release key bundled in this package
+(fingerprint `63B3 0DC3 24BD 6974 87AA 3194 4FAF B8AE C803 B6A7`), the file matches the signed
+checksum and GitHub's digest, and the app passes `codesign`, carries team `KJ35UYYL22`, has its
+notarization ticket stapled and is accepted by Gatekeeper. An outdated or damaged app is
+reinstalled only when it is not running; the old one goes to the Trash. A family service that
+does not answer is started through launchd (`launchctl kickstart`, never a kill).
+
+`doctor` changes nothing. It reads prerequisites, the skill set, each app's version, signature
+and team, each agent's MCP entries with one proving call per server, and the Fabric services of
+the family; each line names its state and its fix. Exit codes: **0** no check failed, **1** a
+check (or a setup step) failed, **2** bad arguments. `doctor --fix` runs setup's repairs without
+installing new apps. Details: the [CLI contract](docs/reference/cli.md#setup-and-doctor).
 
 ## Staying current
 

package/SECURITY.md

@@ -3,7 +3,7 @@
 Report vulnerabilities privately to contact@passioncode.ai. Do not open an issue that
 carries credentials or a working exploit.
 
-What `passioncode update` touches: `~/.passioncode/` (releases, state, quarantine,
+What `passioncode update` touches (setup and doctor: [below](#what-setup-and-doctor-touch)): `~/.passioncode/` (releases, state, quarantine,
 logs); Claude Code's plugin registry through the `claude plugin` CLI only;
 `~/.agents/skills/<member skill>` and `<agent channel>/<member skill>` links; and
 `~/.claude/skills/<member skill>`, which it moves into the quarantine once the plugin
@@ -11,8 +11,9 @@ that replaces it is verified. For a member's old single-member marketplace
 (`legacyMarketplaces` in `family.json`), once that plugin is verified and nothing else
 installed comes from it, it also moves the `extraKnownMarketplaces` entry out of
 `~/.claude/settings.json` (a copy of the file is kept in the quarantine) and runs
-`claude plugin marketplace remove <name>`. When the Fabric Dashboards app is installed it
-also registers a `fabric-dashboards` MCP entry for every agent that is present: through
+`claude plugin marketplace remove <name>`. For each installed app with an MCP server in its
+bundle (Fabric Dashboards, Fabric, Fabric Switchboard) it also registers that entry for every
+agent that is present: through
 `claude mcp add --scope user` for Claude Code (it never writes `~/.claude.json` itself),
 and in `~/.codex/config.toml`, `~/.gemini/settings.json` and `~/.kimi-code/mcp.json`,
 copying each existing file into the quarantine first; an entry that already exists is
@@ -26,6 +27,25 @@ records. Each update removes the launcher's own older releases (its output, rein
 from npm) and keeps the one it replaced for rollback. A failed removal
 returns a nonzero exit code. See the [CLI recovery contract](docs/reference/cli.md).
 
+## What `setup` and `doctor` touch
+
+`doctor` reads: `~/.claude.json`, `~/.codex/config.toml`, `~/.gemini/settings.json`,
+`~/.kimi-code/mcp.json` (entry names, commands and arguments; environment values are passed to
+the server it starts and never printed), the Fabric service descriptors (never their token
+files), the apps' `Info.plist`, and the GitHub releases API. It starts each registered stdio MCP
+server for one proving call and stops it (never Fabric's, which enrols a session as it starts), and writes only `~/.passioncode/doctor.json` and a
+release cache.
+
+`setup` also downloads releases from GitHub into `~/.passioncode/downloads/` (removed after
+each app), copies a verified app into `/Applications`, moves an app it replaces into `~/.Trash/`,
+runs `update` (above), runs `launchctl kickstart gui/<uid>/<label>` for a family service whose
+descriptor names launchd and that does not answer, and opens the apps it installed. It never
+stops or kills a process, never replaces a running app, never asks for or stores a secret, and
+never installs a byte whose signature, checksum, team or notarization does not verify. The trust
+root is the release key bundled at `lib/release-key.asc`, pinned by fingerprint in
+`lib/openpgp.js`; a new key needs a launcher release. `PASSIONCODE_RELEASE_KEY` replaces it for
+tests and is named in setup's output whenever it is set.
+
 ## The self-update and who it trusts
 
 The SessionStart hook reads `~/.passioncode/state.json` and reuses a check for up to

package/bin/passioncode.js

@@ -17,19 +17,84 @@ function cachedNpmStatus({ latest, checkedAt, installed }) {
   return `npm latest (cached) ${latest} (${checked}${stale ? '; stale: older than installed' : ''})`;
 }
 
-const HELP = `passioncode — the PassionCode.ai skill set (family.json), for every agent on this machine
+const HELP = `passioncode — set up and check PassionCode.ai on this machine: the apps, their MCP servers, the skills
 
-  npx @passioncode-ai/passioncode@latest update [--dry-run] [--json]     install or update the whole set
+  npx @passioncode-ai/passioncode@latest setup [--yes] [--with ids] [--without ids] [--no-apps] [--no-open] [--dry-run] [--json]
+        a new machine: install and configure everything; an existing one: check, repair, check again
+  npx @passioncode-ai/passioncode@latest doctor [--fix] [--json]        check everything (read-only); --fix repairs as setup does
+  npx @passioncode-ai/passioncode@latest update [--dry-run] [--json]     install or update the skill set and the apps' MCP registrations
   npx @passioncode-ai/passioncode@latest status [--json]                 what is installed where
   npx @passioncode-ai/passioncode@latest restore                         put back what the last update moved aside
   npx @passioncode-ai/passioncode@latest config set update.auto on|off   background updates at session start
   npx @passioncode-ai/passioncode@latest uninstall                       remove the set (quarantined items stay restorable)
 
-Claude Code gets plugins from the local "passioncode" marketplace; other agents get
-the same skills through ~/.agents/skills. Restart your agent after an update.`;
+App ids: switchboard, dashboards, observatory, inbox, fabric. Exit codes: 0 nothing failed,
+1 a check or a step failed, 2 bad arguments. Claude Code gets plugins from the local
+"passioncode" marketplace; other agents get the same skills through ~/.agents/skills.
+Restart your agent after a change.`;
 
-function main(argv) {
+const IDS = ['switchboard', 'dashboards', 'observatory', 'inbox', 'fabric'];
+
+/** Flags of setup and doctor: booleans, plus --with/--without taking a comma list. Null when invalid. */
+function parseSetupArgs(cmd, rest) {
+  const allowed = cmd === 'doctor' ? ['--fix', '--json', '--offline'] : ['--yes', '-y', '--json', '--offline', '--no-apps', '--no-open', '--dry-run'];
+  const o = { flags: new Set(), withIds: null, withoutIds: [] };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    const m = /^--(with|without)(?:=(.*))?$/.exec(arg);
+    if (m && cmd !== 'doctor') {
+      const value = m[2] !== undefined ? m[2] : rest[++i];
+      const ids = String(value || '').split(',').map((x) => x.trim()).filter(Boolean);
+      if (!ids.length || ids.some((x) => !IDS.includes(x))) return null;
+      if (m[1] === 'with') o.withIds = [...(o.withIds || []), ...ids]; else o.withoutIds.push(...ids);
+    } else if (allowed.includes(arg)) o.flags.add(arg === '-y' ? '--yes' : arg);
+    else return null;
+  }
+  return o;
+}
+
+function asker() {
+  if (!process.stdin.isTTY || !process.stderr.isTTY) return null;
+  const readline = require('readline');
+  return (question) => new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    rl.question(question, (answer) => { rl.close(); resolve(answer); });
+  });
+}
+
+async function setupOrDoctor(cmd, rest) {
+  const o = parseSetupArgs(cmd, rest);
+  if (!o) {
+    process.stderr.write(`passioncode: unsupported arguments for ${cmd}; run passioncode help. App ids: ${IDS.join(', ')}.\n`);
+    return 2;
+  }
+  const json = o.flags.has('--json');
+  const online = !o.flags.has('--offline');
+  if (cmd === 'doctor' && !o.flags.has('--fix')) {
+    const D = require('../lib/doctor');
+    const r = await D.doctor({ online });
+    process.stdout.write(json ? JSON.stringify(r, null, 2) + '\n' : D.render(r) + '\n');
+    return r.ok ? 0 : 1;
+  }
+  const S = require('../lib/setup');
+  const repairOnly = cmd === 'doctor';
+  const log = json ? () => {} : (line) => process.stderr.write(`${line}\n`);
+  const r = await S.setup({
+    yes: repairOnly || o.flags.has('--yes'), withIds: o.withIds, withoutIds: o.withoutIds, noApps: o.flags.has('--no-apps'),
+    noOpen: o.flags.has('--no-open'), dryRun: o.flags.has('--dry-run'), repairOnly, online, ask: json ? null : asker(), log,
+  });
+  process.stdout.write(json ? JSON.stringify(r, null, 2) + '\n' : S.render(r, { repairOnly }) + '\n');
+  return r.planOnly ? 0 : r.ok ? 0 : 1;
+}
+
+async function main(argv) {
   const [cmd = 'help', ...rest] = argv;
+  if (cmd === 'setup' || cmd === 'onboard' || cmd === 'doctor') {
+    try { return await setupOrDoctor(cmd === 'onboard' ? 'setup' : cmd, rest); } catch (error) {
+      process.stderr.write(`passioncode: ${error.message}\n`);
+      return 1;
+    }
+  }
   const json = rest.includes('--json');
   const quiet = rest.includes('--quiet');
   const out = (value, text) => process.stdout.write(json ? JSON.stringify(value, null, 2) + '\n' : text + '\n');
@@ -89,4 +154,4 @@ function main(argv) {
   }
 }
 
-process.exit(main(process.argv.slice(2)));
+main(process.argv.slice(2)).then((code) => { process.exitCode = code; });

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.29.0",
+      "ref": "v0.30.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [
@@ -37,7 +37,7 @@
       "displayName": "PassionCode.ai",
       "kind": "self",
       "path": "plugin/passioncode",
-      "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current."
+      "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current."
     }
   ]
 }

package/lib/catalog.js

@@ -0,0 +1,91 @@
+'use strict';
+/**
+ * The PassionCode.ai apps `setup` installs and `doctor` checks: where each is released, which
+ * asset is its macOS build, where it lives once installed, its MCP server and the one read-only
+ * call that proves the server answers, and the product's own onboarding step. Public facts only;
+ * each is the product's own documentation (named per entry).
+ */
+const path = require('path');
+
+const TEAM_ID = 'KJ35UYYL22'; // Developer ID Application team of every PassionCode.ai macOS build
+const SITE = 'https://passioncode.ai';
+
+/** Agents the launcher registers MCP servers for: `cli` is detected by its command, the rest by a directory. */
+const AGENTS = [
+  { id: 'claude', name: 'Claude Code', fabricRunner: 'claude-code' },
+  { id: 'codex', name: 'Codex CLI', fabricRunner: 'codex' },
+  { id: 'gemini', name: 'Gemini CLI', fabricRunner: null }, // fabric-mcp has no Gemini runner
+  { id: 'kimi', name: 'Kimi Code', fabricRunner: 'kimi-code' },
+];
+
+const PRODUCTS = [
+  {
+    // fabric-switchboard docs/INSTALL.md, docs/AGENT-ONBOARDING.md
+    id: 'switchboard', name: 'Fabric Switchboard', repo: 'passioncode-ai/fabric-switchboard',
+    app: 'Fabric Switchboard.app', page: `${SITE}/switchboard/`,
+    asset: (v) => `Fabric-Switchboard-${v}-macos-universal.zip`,
+    mcp: {
+      name: 'switchboard', bin: 'Contents/MacOS/switchboard', args: () => ['mcp'],
+      claudePlugin: 'switchboard@', prove: { tool: 'switchboard_accounts', args: {} },
+    },
+    guide: 'Fabric Switchboard: your agent runs `switchboard onboard --status --json` and follows it; you sign in to each coding-agent account in the app.',
+  },
+  {
+    // fabric-dashboards README "Install", src/core/setup.ts
+    id: 'dashboards', name: 'Fabric Dashboards', repo: 'passioncode-ai/fabric-dashboards',
+    app: 'Fabric Dashboards.app', page: `${SITE}/dashboards/`,
+    asset: (v) => `Fabric-Dashboards-${v}-mac.zip`,
+    mcp: { name: 'fabric-dashboards', bin: 'Contents/Resources/bin/fabric-dashboards-mcp', args: () => [], prove: { tool: 'list_services', args: {} } },
+    guide: 'Fabric Dashboards: open it once; its first session is a Setup console your coding agent runs.',
+  },
+  {
+    // project-observatory-dashboard docs/AGENT-ONBOARDING.md (`full onboard`)
+    id: 'observatory', name: 'Project Observatory', repo: 'passioncode-ai/project-observatory-dashboard',
+    app: 'Project Observatory.app', page: `${SITE}/observatory/`,
+    asset: (v) => `ProjectObservatory-${v}-macos.zip`,
+    serviceIds: ['project-observatory'],
+    mcp: { name: 'observatory', external: true, prove: { tool: 'observatory_status', args: {} } },
+    guide: 'Project Observatory: your agent runs `project-observatory full onboard` and follows it (it registers the `observatory` MCP server); secrets go in through its hidden prompt, never the chat.',
+  },
+  {
+    // fabric-inbox docs/agents/onboard.md (B-79)
+    id: 'inbox', name: 'Fabric Inbox', repo: 'passioncode-ai/fabric-inbox',
+    app: 'Fabric Inbox.app', page: `${SITE}/inbox/`,
+    asset: (v) => `Fabric-Inbox-${v}-mac.zip`,
+    mcp: { name: 'fabric-inbox', external: true, remote: true },
+    guide: 'Fabric Inbox: your agent follows its onboard guide (github.com/passioncode-ai/fabric-inbox, docs/agents/onboard.md) to create your mail server; you enter the Cloudflare token in its hidden prompt, sign in with the emailed code and press Allow.',
+  },
+  {
+    // fabric apps/desktop/resources/bin/fabric-mcp, src/main/fabricMcpMain.ts
+    id: 'fabric', name: 'Fabric', repo: 'passioncode-ai/fabric', preview: true, prerelease: true,
+    app: 'Fabric.app', page: `${SITE}/fabric/`,
+    asset: (v) => `Fabric-${v}-universal.dmg`,
+    needs: ['docker', 'supabase'],
+    mcp: {
+      name: 'fabric', bin: 'Contents/Resources/bin/fabric-mcp',
+      args: (agent) => (agent.fabricRunner ? ['--runner', agent.fabricRunner] : null),
+      // fabric-mcp enrols a session with Fabric's hub as soon as it starts (fabricMcpMain.ts runs
+      // proxy.run at start), so doctor never starts it: it checks the entry and the binary, and the
+      // agent's own `fabric_whoami` is the proving call.
+      prove: null, spawn: false,
+    },
+    guide: 'Fabric (early preview): open it and finish its first run; Docker or OrbStack must be running. Then your agent calls `fabric_whoami` once to prove its MCP server.',
+  },
+];
+
+function appsDir() { return process.env.PASSIONCODE_APPLICATIONS || '/Applications'; }
+function appPath(product) { return path.join(appsDir(), product.app); }
+
+/** The stdio command of a product's MCP server for one agent, or null (not bundled / no runner). */
+function mcpCommand(product, agent) {
+  const m = product.mcp;
+  if (!m || m.external || !m.bin) return null;
+  const override = product.id === 'dashboards' ? process.env.PASSIONCODE_FABRIC_DASHBOARDS_MCP : null;
+  const command = override || path.join(appPath(product), m.bin);
+  const args = m.args(agent);
+  return args ? { command, args } : null;
+}
+
+function byId(id) { return PRODUCTS.find((p) => p.id === id) || null; }
+
+module.exports = { PRODUCTS, AGENTS, TEAM_ID, SITE, appsDir, appPath, mcpCommand, byId };