@polderlabs/bizar 10.2.0 → 10.4.0

package/cli/provision.mjs

@@ -1,33 +1,14 @@
+#!/usr/bin/env node
 /**
  * cli/provision.mjs
  *
- * v6.3.0 — Unified installer + updater (Claude Code-native).
+ * v10.0.0 — Unified installer + updater (Claude Code-native).
  *
- * `bizar install` and `bizar update` used to be two separate code paths
- * (install.sh + cli/install.mjs for install, cli/update.mjs for update)
- * with massive overlap: both copied agents, both patched settings.json,
- * both ran the plugin copy, both kicked off the service, both called
- * `bizar doctor` at the end. The two paths diverged over time.
- *
- * This module is the single source of truth. Both `bizar install` and
- * `bizar update` call `runProvision({ mode, ... })`. The differences
- * between modes are explicit and small:
- *
- *   install: bootstrap a fresh install. Detects what exists, installs
- *            everything that's missing, configures the service, runs
- *            doctor. Does NOT kill running instances (fresh install
- *            has none).
- *   update:   refresh an existing install. Kills running instances,
- *            upgrades @polderlabs/bizar + @anthropic-ai/claude-code via
- *            npm, re-copies agent files / skills / commands, re-patches
- *            ~/.claude/settings.json (idempotent), restarts the
- *            dashboard, runs doctor.
- *
- * Both modes are safe to re-run — every step is idempotent and skips
- * work that's already done.
+ * `bizar install` and `bizar update` are the same code path with
+ * different `mode` flags. Both are idempotent and safe to re-run.
  *
  * Public API:
- *   runProvision({ mode, dryRun, force, restart, ...flags })
+ *   runProvision({ mode, dryRun, force, yes, restart, ... })
  *     Runs the full provision flow for `mode` ('install' | 'update').
  *   detectState()
  *     Probe what's installed without modifying anything.
@@ -35,86 +16,68 @@
  */
 
 import chalk from 'chalk';
-import { execSync, spawn, spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, rmSync, writeFileSync, mkdirSync, statSync, copyFileSync, chmodSync } from 'node:fs';
+import { execFileSync, execSync, spawn, spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
-import { join, dirname, sep } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { bizarConfigDir } from './utils.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const HOME = homedir();
 
-// `cli/provision.mjs` lives at `<pkg>/cli/provision.mjs`. The repo root
-// (where `plugins/bizar/`, `bizar-dash/`, `package.json` etc. live) is
-// one level up. This works both in source checkouts AND in global npm
-// installs (`<npm root -g>/@polderlabs/bizar/cli/provision.mjs`).
-export const REPO_ROOT = join(__dirname, '..');
+// Repo root = `<pkg>/cli/provision.mjs` → one level up.
+export const REPO_ROOT = resolve(__dirname, '..');
 export const PKG_MAIN = '@polderlabs/bizar';
 
-export const BIZAR_HOME = bizarConfigDir();
+// ─── Paths ────────────────────────────────────────────────────────────────────
 
 /**
  * Resolve the Claude Code config directory.
- *
- * Claude Code (v1.0+) uses `~/.claude/` (or `$CLAUDE_CONFIG_DIR`) as the
- * global config dir for `agents/`, `skills/`, `plugins/`, `commands/`,
- * `hooks/`, and `settings.json`.
- *
- * Resolution order (matches Claude Code's configuration discovery):
- *   1. `process.env.CLAUDE_CONFIG_DIR` (explicit override)
- *   2. `$HOME/.claude` (the Claude Code default)
- *   3. (Windows only) `%USERPROFILE%/.claude`
- *
- * `BIZAR_LEGACY_CLAUDE_DIR=1` opts back into the old Cline layout
- * (`~/.config/cline/`) for users who deliberately want the legacy path.
- * Removed in v6.3.0 — Claude Code is the only supported backend.
+ *   1. `process.env.CLAUDE_CONFIG_DIR`
+ *   2. `$HOME/.claude`
  */
-function resolveClaudeDir() {
-  if (process.env.BIZAR_LEGACY_CLAUDE_DIR === '1') {
-    return join(
-      process.env.XDG_CONFIG_HOME || join(HOME, '.config'),
-      'cline',
-    );
-  }
+export function resolveClaudeDir() {
   if (process.env.CLAUDE_CONFIG_DIR && process.env.CLAUDE_CONFIG_DIR.trim()) {
     return process.env.CLAUDE_CONFIG_DIR.trim();
   }
   if (process.platform === 'win32') {
-    return join(HOME, '.claude');
+    return process.env.APPDATA
+      ? join(process.env.APPDATA, 'Claude')
+      : join(HOME, '.claude');
   }
   return join(HOME, '.claude');
 }
 
-/**
- * Compatibility export — many existing checks still reference this name.
- * @deprecated Use `CLAUDE_DIR` instead.
- */
 export const CLAUDE_DIR = resolveClaudeDir();
 
-/**
- * Back-compat alias used by other modules + scripts.
- * Same value as CLAUDE_DIR; kept so old imports still resolve.
- * @deprecated Use `CLAUDE_DIR` instead.
- */
-export const CLINE_DIR = resolveClaudeDir();
+/** `~/.config/bizar/` — Bizar runtime state (NOT under ~/.claude/). */
+export const BIZAR_HOME = process.env.BIZAR_HOME
+  || join(process.env.XDG_CONFIG_HOME || join(HOME, '.config'), 'bizar');
 
-/**
- * Legacy Cline directory (the old OpenCode layout).
- *
- * Kept as an opt-in fallback. The installer warns but does not write
- * here under the v6.3.0 Claude Code-native flow.
- */
-export const LEGACY_CLAUDE_DIR = join(
-  process.env.XDG_CONFIG_HOME || join(HOME, '.config'),
-  'cline',
-);
+// Standard Claude Code subdirectories
+export const CLAUDE_AGENTS_DIR   = join(CLAUDE_DIR, 'agents');
+export const CLAUDE_SKILLS_DIR   = join(CLAUDE_DIR, 'skills');
+export const CLAUDE_COMMANDS_DIR = join(CLAUDE_DIR, 'commands');
+export const CLAUDE_HOOKS_DIR    = join(CLAUDE_DIR, 'hooks');
+export const CLAUDE_RULES_DIR    = join(CLAUDE_DIR, 'rules');
+export const CLAUDE_PLUGINS_DIR  = join(CLAUDE_DIR, 'plugins');
 
-const SERVICE_PID_FILE = join(BIZAR_HOME, 'service.pid');
-const DASHBOARD_PID_FILE = join(BIZAR_HOME, 'dashboard.pid');
-const DASHBOARD_PORT_FILE = join(BIZAR_HOME, 'dashboard.port');
-const INSTALL_MARKER_FILE = join(BIZAR_HOME, 'installed.json');
+// PID / port files
+const SERVICE_PID_FILE     = join(BIZAR_HOME, 'service.pid');
+const DASHBOARD_PID_FILE  = join(BIZAR_HOME, 'dashboard.pid');
+const DASHBOARD_PORT_FILE  = join(BIZAR_HOME, 'dashboard.port');
+const INSTALL_MARKER_FILE  = join(BIZAR_HOME, 'installed.json');
 
 // ─── Tiny utilities ──────────────────────────────────────────────────────────
 
@@ -145,6 +108,25 @@ function readJsonSafe(file, fallback = null) {
   }
 }
 
+function ensureDir(dir) {
+  mkdirSync(dir, { recursive: true });
+}
+
+function copyDirContents(src, dest) {
+  ensureDir(dest);
+  for (const name of readdirSync(src)) {
+    const sp = join(src, name);
+    const dp = join(dest, name);
+    const st = statSync(sp);
+    if (st.isDirectory()) copyDirContents(sp, dp);
+    else copyFileSync(sp, dp);
+  }
+}
+
+function rimrafSafe(p) {
+  try { rmSync(p, { recursive: true, force: true }); } catch { /* ignore */ }
+}
+
 /** Read a PID file and return the live PID, or null if missing/stale. */
 export function readLivePid(pidFile) {
   if (!existsSync(pidFile)) return null;
@@ -208,19 +190,22 @@ export async function killAndWait(pid, { timeoutMs = 5000, label = 'process' } =
   }
 }
 
+// ─── Logging helpers ─────────────────────────────────────────────────────────
+
+function logOk(msg)   { console.log(chalk.green('  ✓') + ' ' + msg); }
+function logInfo(msg)  { console.log(chalk.cyan('  →') + ' ' + msg); }
+function logWarn(msg)  { console.log(chalk.yellow('  ⚠') + ' ' + msg); }
+function logErr(msg)   { console.log(chalk.red('  ✗') + ' ' + msg); }
+function section(title) { console.log('\n' + chalk.bold.cyan(`── ${title} ──`)); }
+
 // ─── Install marker ──────────────────────────────────────────────────────────
 
-/**
- * Read the install marker file. Returns null if missing.
- * Marker shape: { version, installedAt, repoPath, serviceUnit }
- */
+/** Read the install marker file. Returns null if missing. */
 export function readInstallMarker() {
   return readJsonSafe(INSTALL_MARKER_FILE, null);
 }
 
-/**
- * Write the install marker file.
- */
+/** Write the install marker file. */
 export function writeInstallMarker({ version, repoPath, serviceUnit }) {
   const marker = {
     version: version || currentVersion(PKG_MAIN) || 'unknown',
@@ -237,304 +222,7 @@ export function writeInstallMarker({ version, repoPath, serviceUnit }) {
   }
 }
 
-/**
- * v6.2.5 - Register every `config/skills/<name>/SKILL.md` in
- * `${agentsDir}/.skill-lock.json` so Cline's marketplace UI
- * (`isMarketplaceSkillInstalled`) actually shows them as installed.
- *
- * Cline reads `~/.agents/.skill-lock.json` as its source of truth for
- * skill installation state. The Bizar harness mirrors SKILL.md files
- * to both `~/.cline/skills/` and `~/.agents/skills/`, but Cline still
- * shows "No skills installed" in the Skills tab until each entry is
- * registered here. Verified via `npx skills list -g` (writes the entry
- * then the skill appears).
- *
- * Idempotent: entries already tagged `source: 'bizar/builtin'` only
- * get their `updatedAt` refreshed; user-installed skills (any other
- * source) are never touched.
- *
- * @param {object} opts
- * @param {string} opts.skillsSrc   - directory containing config/skills/<name>
- * @param {string} opts.agentsDir   - typically HOME/.agents
- * @returns {{ok: boolean, count: number, path: string}}
- */
-export function writeBizarSkillLock({ skillsSrc, agentsDir }) {
-  if (!existsSync(skillsSrc)) {
-    return { ok: true, count: 0, path: join(agentsDir, '.skill-lock.json') };
-  }
-  const lockPath = join(agentsDir, '.skill-lock.json');
-  let lock = { version: 3, skills: {} };
-  try {
-    const raw = readFileSync(lockPath, 'utf8');
-    lock = JSON.parse(raw);
-    if (!lock.skills || typeof lock.skills !== 'object') lock.skills = {};
-    if (typeof lock.version !== 'number') lock.version = 3;
-  } catch {
-    // first install - start fresh
-  }
-  const now = new Date().toISOString();
-  let count = 0;
-  for (const skillDir of readdirSync(skillsSrc, { withFileTypes: true })) {
-    if (!skillDir.isDirectory()) continue;
-    const name = skillDir.name;
-    const existing = lock.skills[name];
-    if (existing && existing.source === 'bizar/builtin') {
-      existing.updatedAt = now;
-      count += 1;
-      continue;
-    }
-    lock.skills[name] = {
-      source: 'bizar/builtin',
-      sourceType: 'local',
-      sourceUrl: 'https://github.com/DrB0rk/BizarHarness',
-      skillPath: 'config/skills/' + name + '/SKILL.md',
-      skillFolderHash: 'bizar-managed',
-      pluginName: 'bizar',
-      installedAt: existing && existing.installedAt ? existing.installedAt : now,
-      updatedAt: now,
-    };
-    count += 1;
-  }
-  try {
-    mkdirSync(agentsDir, { recursive: true });
-    writeFileSync(lockPath, JSON.stringify(lock, null, 2));
-    return { ok: true, count, path: lockPath };
-  } catch (err) {
-    return { ok: false, count: 0, path: lockPath, error: err.message };
-  }
-}
-
-// ─── State detection ──────────────────────────────────────────────────────────
-
-/**
- * Probe the current state without modifying anything. Both install and
- * update flows start here so they can decide what to skip.
- *
- * Returned shape:
- *   {
- *     pkgRoot: string,         // <npm root -g>/@polderlabs/bizar
- *     pkgVersion: string|null, // installed @polderlabs/bizar version
- *     pkgLatest: string|null,  // latest @polderlabs/bizar version on npm
- *     plugin: { sourceDir, destDir, installed, upToDate, symlink },
- *     clineJson: { path, hasPluginEntry, exists },
- *     service: { installed, running, unitPath },
- *     dashboard: { running, pid, port },
- *     claudeCli: { version, latest },
- *     headsUpState: { ok, blockerCount, warningCount },
- *     gitRepo: boolean,        // are we running from a git checkout?
- *   }
- */
-export function detectState({ cwd = process.cwd() } = {}) {
-  // ── npm-global package location ─────────────────────────────────────
-  // Try multiple strategies because `npm root -g` doesn't always
-  // respect NPM_CONFIG_PREFIX (notably when npm is installed by the
-  // system package manager on Debian/Ubuntu).
-  let globalRoot = null;
-  const npmRootCandidates = [];
-
-  // 1. Honour the user's explicit env override first.
-  if (process.env.NPM_CONFIG_PREFIX) {
-    npmRootCandidates.push(join(process.env.NPM_CONFIG_PREFIX, 'lib', 'node_modules'));
-  }
-  // 2. Honour NPM_CONFIG_GLOBAL_PREFIX (set by `npm -g`).
-  if (process.env.NPM_CONFIG_GLOBAL_PREFIX) {
-    npmRootCandidates.push(join(process.env.NPM_CONFIG_GLOBAL_PREFIX, 'lib', 'node_modules'));
-  }
-  // 3. The classic `npm root -g` query (works on most distros).
-  try {
-    const r = execSync('npm root -g', { stdio: ['ignore', 'pipe', 'ignore'] })
-      .toString().trim();
-    if (r) npmRootCandidates.push(r);
-  } catch { /* ignore */ }
-  // 4. Common distro defaults.
-  npmRootCandidates.push('/usr/local/lib/node_modules');
-  npmRootCandidates.push('/usr/lib/node_modules');
-
-  // Pick the first candidate that actually has @polderlabs/bizar.
-  for (const candidate of npmRootCandidates) {
-    if (existsSync(join(candidate, '@polderlabs', 'bizar'))) {
-      globalRoot = candidate;
-      break;
-    }
-  }
-  // Fall back to the first candidate (even if it doesn't have the
-  // package) so downstream code can produce a clean error message.
-  if (!globalRoot) globalRoot = npmRootCandidates[0] ?? null;
-
-  const pkgRoot = globalRoot ? join(globalRoot, '@polderlabs', 'bizar') : null;
-  const pkgVersion = globalRoot ? currentVersion(PKG_MAIN) : null;
-  const pkgLatest = latestVersion(PKG_MAIN);
-
-  // ── Plugin copy (deployed to ${CLAUDE_DIR}/plugins/bizar) ──
-  const pluginSourceDir = pkgRoot ? join(pkgRoot, 'plugins', 'bizar') : null;
-  const pluginDestDir = join(CLAUDE_DIR, 'plugins', 'bizar');
-  let pluginInstalled = false;
-  let pluginUpToDate = false;
-  let pluginSymlink = false;
-  try {
-    const st = statSync(pluginDestDir);
-    pluginSymlink = st.isSymbolicLink();
-    pluginInstalled = true;
-    if (pluginSourceDir && existsSync(pluginSourceDir)) {
-      // Cheap freshness check: compare source vs dest mtime. The plugin
-      // source ships its bundled node_modules + compiled JS; if dest's
-      // mtime is older than source's, treat as out of date.
-      try {
-        const srcSt = statSync(pluginSourceDir);
-        const dstSt = statSync(pluginDestDir);
-        pluginUpToDate = srcSt.mtimeMs <= dstSt.mtimeMs;
-      } catch {
-        pluginUpToDate = false;
-      }
-    }
-  } catch {
-    pluginInstalled = false;
-  }
-
-  // ── cline.json plugin entry ───────────────────────────────────────
-  // v6.3.0 — Read Claude Code settings.json (replaces cline.json).
-  const claudeSettingsPath = join(CLAUDE_DIR, 'settings.json');
-  const claudeSettings = readJsonSafe(claudeSettingsPath, null);
-  let hasMcpServerEntry = false;
-  if (claudeSettings && claudeSettings.mcpServers && typeof claudeSettings.mcpServers === 'object') {
-    hasMcpServerEntry = !!claudeSettings.mcpServers.bizar;
-  }
-
-  // ── Background service ─────────────────────────────────────────────
-  let serviceInstalled = false;
-  let serviceUnitPath = null;
-  if (pkgRoot) {
-    try {
-      const sc = require_safe(join(pkgRoot, 'cli', 'service-controller.mjs'));
-      serviceInstalled = sc?.isInstalled?.() ?? false;
-      serviceUnitPath = sc?.serviceUnitPath?.() ?? null;
-    } catch { /* ignore */ }
-  }
-  const servicePid = readLivePid(SERVICE_PID_FILE);
-  const serviceRunning = servicePid !== null;
-
-  // ── Dashboard process ──────────────────────────────────────────────
-  const dashboardPid = readLivePid(DASHBOARD_PID_FILE);
-  const dashboardPort = parseInt(readTextSafe(DASHBOARD_PORT_FILE, '').trim(), 10) || null;
-
-  // ── Claude Code CLI version ────────────────────────────────────────
-  const claudeCli = {
-    version: currentVersion('@anthropic-ai/claude-code'),
-    latest: latestVersion('@anthropic-ai/claude-code'),
-  };
-
-  // ── Heads-up gate (.bizar/PRE_PUSH_NOTES.md) ───────────────────────
-  let headsUpState = { ok: true, blockerCount: 0, warningCount: 0 };
-  try {
-    const { checkHeadsUps, findBizarDir } = require_safe('./heads-up.mjs');
-    const bizarDir = findBizarDir(cwd);
-    if (bizarDir && checkHeadsUps) {
-      headsUpState = checkHeadsUps(bizarDir);
-    }
-  } catch { /* ignore */ }
-
-  // ── Git checkout? ─────────────────────────────────────────────────
-  const gitRepo = existsSync(join(REPO_ROOT, '.git'));
-
-  // ── Installed mods ─────────────────────────────────────────────────
-  // v4.4.11 — `bizar install` and `bizar update` never install or
-  // upgrade mods. The list below is informational only. Use
-  // `bizar mod install <id>` to add a mod explicitly.
-  const MODS_DIR = join(BIZAR_HOME, 'mods');
-  const installedMods = listInstalledMods(MODS_DIR);
-
-  return {
-    pkgRoot,
-    pkgVersion,
-    pkgLatest,
-    plugin: {
-      sourceDir: pluginSourceDir,
-      destDir: pluginDestDir,
-      installed: pluginInstalled,
-      upToDate: pluginUpToDate,
-      symlink: pluginSymlink,
-    },
-    claudeSettings: {
-      path: claudeSettingsPath,
-      exists: !!claudeSettings,
-      hasMcpServerEntry,
-    },
-    service: {
-      installed: serviceInstalled,
-      running: serviceRunning,
-      pid: servicePid,
-      unitPath: serviceUnitPath,
-    },
-    dashboard: {
-      running: dashboardPid !== null,
-      pid: dashboardPid,
-      port: dashboardPort,
-    },
-    claudeCli,
-    headsUpState,
-    gitRepo,
-    installedMods,
-  };
-}
-
-/**
- * v4.4.11 — Lightweight read-only scan of `~/.config/bizar/mods/`.
- * Returns one entry per mod folder with the id + enabled flag parsed
- * from mod.json. Never throws; mods with a missing or invalid mod.json
- * are reported as `{id, error}` so the provisioner can surface them.
- */
-function listInstalledMods(modsDir) {
-  const out = [];
-  if (!existsSync(modsDir)) return out;
-  let entries;
-  try {
-    entries = readdirSync(modsDir, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dir = join(modsDir, entry.name);
-    const manifestPath = join(dir, 'mod.json');
-    if (!existsSync(manifestPath)) {
-      out.push({ id: entry.name, error: 'missing mod.json' });
-      continue;
-    }
-    let manifest;
-    try {
-      manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-    } catch {
-      out.push({ id: entry.name, error: 'invalid mod.json' });
-      continue;
-    }
-    out.push({
-      id: manifest.id || entry.name,
-      name: manifest.name || entry.name,
-      version: manifest.version || '?',
-      enabled: manifest.enabled !== false,
-      installedAt: manifest.installedAt || null,
-      path: dir,
-    });
-  }
-  return out;
-}
-
-/**
- * Lightweight CommonJS-ish require for ESM contexts. Used to detect the
- * service-controller + heads-up modules without paying the static-import
- * cost when those features aren't needed. Falls back gracefully if the
- * import fails (e.g. during `bizar install` from a corrupted package).
- */
-async function require_safe(spec) {
-  try {
-    const url = new URL(spec, `file://${__dirname}/`).href;
-    return await import(url);
-  } catch {
-    return null;
-  }
-}
-
-// ─── Version + npm helpers ───────────────────────────────────────────────────
+// ─── Version helpers ─────────────────────────────────────────────────────────
 
 export function currentVersion(pkg) {
   try {
@@ -543,8 +231,7 @@ export function currentVersion(pkg) {
       timeout: 15000,
     }).toString();
     const parsed = JSON.parse(out);
-    const deps = parsed.dependencies ?? {};
-    return deps[pkg]?.version ?? null;
+    return parsed.dependencies?.[pkg]?.version ?? null;
   } catch {
     return null;
   }
@@ -562,675 +249,575 @@ export function latestVersion(pkg) {
   }
 }
 
-/**
- * Print the installed-vs-latest version matrix in a stable column layout.
- */
-export function printVersionMatrix(components) {
-  const colWidth = Math.max(8, ...components.map((c) => c.label.length));
-  for (const c of components) {
-    const cur = c.current ?? '(not installed)';
-    const lat = c.latest ?? '(unknown)';
-    const same = c.current && c.current === c.latest;
-    const marker = same ? chalk.green('✓ up to date') : chalk.yellow('⤵ update available');
-    console.log(`    ${c.label.padEnd(colWidth)}  ${cur.padEnd(15)} → ${lat}  ${marker}`);
-  }
-}
-
-// ─── Step implementations ───────────────────────────────────────────────────
+// ─── Build helpers ───────────────────────────────────────────────────────────
 
 /**
- * Ensure @polderlabs/bizar is installed via npm. Returns
- * `{ ok, message, installed: <version|null> }`.
- *
- * `mode`:
- *   'install' — install if missing; never upgrade an existing install
- *   'update'  — install the latest version (upgrade or install)
+ * Build the SDK workspace so its compiled JS output lives at
+ * `<pkg>/packages/sdk/dist/`. The dashboard imports from `dist/memory/index.js`.
+ * Idempotent: skips when dist already exists. Non-fatal.
  */
-export async function ensureNpmPackage(pkg, { mode, dryRun, force }) {
-  const current = currentVersion(pkg);
-  const latest = latestVersion(pkg);
-
-  if (mode === 'install' && current && !force) {
-    return { ok: true, message: `${pkg}@${current} already installed`, installed: current };
-  }
+export async function buildSdk({ dryRun = false } = {}) {
+  const sdkRoot  = join(REPO_ROOT, 'packages', 'sdk');
+  const distEntry = join(sdkRoot, 'dist', 'memory', 'index.js');
+  const srcEntry  = join(sdkRoot, 'src', 'memory', 'index.ts');
 
-  if (current && current === latest && !force) {
-    return { ok: true, message: `${pkg}@${current} already up to date`, installed: current };
-  }
+  if (!existsSync(srcEntry)) return { ok: true, skipped: true, message: `SDK src not found — skipping build` };
+  if (existsSync(distEntry)) return { ok: true, skipped: true, message: `SDK dist already present — skipping build` };
+  if (dryRun) return { ok: true, skipped: false, message: `would build SDK at ${sdkRoot}` };
 
-  if (dryRun) {
-    return {
-      ok: true,
-      message: `[dry-run] would run: npm install -g ${pkg}${latest ? `@${latest}` : '@latest'}`,
-      installed: latest ?? current,
-    };
+  const bunBin = join(process.env.HOME || '', '.bun', 'bin', 'bun');
+  let cmd, args, childEnv;
+  if (existsSync(bunBin)) {
+    cmd = bunBin; args = ['run', 'build:sdk'];
+    const pathDelim = process.platform === 'win32' ? ';' : ':';
+    let npmGlobalBin = '';
+    try {
+      const npmRootG = execSync('npm root -g', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      npmGlobalBin = join(dirname(npmRootG), '..', 'bin');
+    } catch {
+      npmGlobalBin = process.platform === 'win32' ? join(process.env.APPDATA || '', 'npm') : join(process.env.HOME || '', '.local', 'bin');
+    }
+    childEnv = { ...process.env, PATH: [dirname(bunBin), ...(npmGlobalBin && existsSync(npmGlobalBin) ? [npmGlobalBin] : []), process.env.PATH || ''].join(pathDelim) };
+  } else if (haveCmd('bun')) {
+    cmd = 'bun'; args = ['run', 'build:sdk']; childEnv = process.env;
+  } else {
+    cmd = 'npx'; args = ['--yes', 'tsc', '-p', 'packages/sdk/tsconfig.json']; childEnv = process.env;
   }
 
-  // If we're inside a `bizar update`, the dashboard service / dashboard
-  // processes are reading files inside the npm-global install dir. We
-  // can't replace those files atomically while they're open. The caller
-  // is expected to have already killed them via ensureInstancesKilled().
-  const npmArgs = ['install', '-g', `${pkg}@latest`];
-  if (process.env.NPM_CONFIG_PREFIX) {
-    npmArgs.push('--prefix', process.env.NPM_CONFIG_PREFIX);
-  }
-  const r = spawnSync('npm', npmArgs, { stdio: 'inherit', timeout: 600000 });
-  if (r.status === null && r.error?.code === 'ETIMEDOUT') {
-    return { ok: false, message: `${pkg} install timed out after 10 minutes`, installed: current };
-  }
-  if (r.status !== 0) {
-    return { ok: false, message: `${pkg} install failed`, installed: current };
+  try {
+    logInfo(`building SDK with \`${cmd} ${args.join(' ')}\``);
+    execFileSync(cmd, args, { cwd: REPO_ROOT, stdio: 'pipe', timeout: 180_000, env: childEnv });
+    if (existsSync(distEntry)) return { ok: true, skipped: false, message: 'SDK built (dist/memory/index.js present)' };
+    return { ok: false, message: `build completed but ${distEntry} still missing` };
+  } catch (err) {
+    const stderr = err.stderr ? err.stderr.toString().split('\n').slice(0, 5).join(' | ') : '(no stderr)';
+    return { ok: false, message: `SDK build failed: ${stderr}` };
   }
-  return { ok: true, message: `${pkg} updated`, installed: latestVersion(pkg) };
-}
-
-export async function updateClineCli({ dryRun, force }) {
-  // v6.3.0 — Back-compat alias. The new code path upgrades the
-  // `@anthropic-ai/claude-code` npm package instead of `cline`.
-  return updateClaudeCodeCli({ dryRun, force });
 }
 
-export async function updateClaudeCodeCli({ dryRun, force }) {
-  const current = currentVersion('@anthropic-ai/claude-code');
-  const latest = latestVersion('@anthropic-ai/claude-code');
+/**
+ * Build the Bizar plugin shim so `plugins/bizar/dist/index.js` exists.
+ * Idempotent. Non-fatal.
+ */
+export async function buildPlugin({ dryRun = false } = {}) {
+  const pluginRoot = join(REPO_ROOT, 'plugins', 'bizar');
+  const distEntry  = join(pluginRoot, 'dist', 'index.js');
+  const srcEntry   = join(pluginRoot, 'index.ts');
 
-  if (current && current === latest && !force) {
-    return {
-      ok: true,
-      message: `@anthropic-ai/claude-code@${current} up to date`,
-      installed: current,
-    };
-  }
+  if (!existsSync(srcEntry))  return { ok: true, skipped: true, message: `Plugin src not found — skipping build` };
+  if (existsSync(distEntry)) return { ok: true, skipped: true, message: `Plugin dist already present — skipping build` };
+  if (dryRun) return { ok: true, skipped: false, message: `would build plugin at ${pluginRoot}` };
 
-  if (dryRun) {
-    return { ok: true, message: '[dry-run] @anthropic-ai/claude-code upgrade' };
+  const bunBin = join(process.env.HOME || '', '.bun', 'bin', 'bun');
+  let cmd, args, childEnv;
+  if (existsSync(bunBin)) {
+    cmd = bunBin; args = ['x', 'tsc', '-p', 'plugins/bizar/tsconfig.json'];
+    const pathDelim = process.platform === 'win32' ? ';' : ':';
+    let npmGlobalBin = '';
+    try {
+      const npmRootG = execSync('npm root -g', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      npmGlobalBin = join(dirname(npmRootG), '..', 'bin');
+    } catch {
+      npmGlobalBin = process.platform === 'win32' ? join(process.env.APPDATA || '', 'npm') : join(process.env.HOME || '', '.local', 'bin');
+    }
+    childEnv = { ...process.env, PATH: [dirname(bunBin), ...(npmGlobalBin && existsSync(npmGlobalBin) ? [npmGlobalBin] : []), process.env.PATH || ''].join(pathDelim) };
+  } else if (haveCmd('bun')) {
+    cmd = 'bun'; args = ['x', 'tsc', '-p', 'plugins/bizar/tsconfig.json']; childEnv = process.env;
+  } else {
+    cmd = 'npx'; args = ['--yes', 'tsc', '-p', 'plugins/bizar/tsconfig.json']; childEnv = process.env;
   }
 
-  // Claude Code ships via npm; `claude upgrade` is not a built-in
-  // subcommand. Always go through npm.
-  const npmArgs = ['install', '-g', '@anthropic-ai/claude-code@latest'];
-  if (process.env.NPM_CONFIG_PREFIX) {
-    npmArgs.push('--prefix', process.env.NPM_CONFIG_PREFIX);
-  }
-  const r = spawnSync('npm', npmArgs, { stdio: 'inherit', timeout: 600000 });
-  if (r.status === null && r.error?.code === 'ETIMEDOUT') {
-    return {
-      ok: false,
-      message: '@anthropic-ai/claude-code install timed out after 10 minutes',
-    };
-  }
-  if (r.status !== 0) {
-    return { ok: false, message: '@anthropic-ai/claude-code install failed' };
+  try {
+    logInfo(`building plugin with \`${cmd} ${args.join(' ')}\``);
+    execFileSync(cmd, args, { cwd: REPO_ROOT, stdio: 'pipe', timeout: 180_000, env: childEnv });
+    if (existsSync(distEntry)) return { ok: true, skipped: false, message: 'Plugin built (dist/index.js present)' };
+    return { ok: false, message: `build completed but ${distEntry} still missing` };
+  } catch (err) {
+    const stderr = err.stderr ? err.stderr.toString().split('\n').slice(0, 5).join(' | ') : '(no stderr)';
+    return { ok: false, message: `Plugin build failed: ${stderr}` };
   }
-  return {
-    ok: true,
-    message: '@anthropic-ai/claude-code updated',
-    installed: latestVersion('@anthropic-ai/claude-code'),
-  };
 }
 
 /**
- * Copy `plugins/bizar/` from the npm-installed package into
- * `${CLAUDE_DIR}/plugins/bizar/`. Skips if the dest is a dev symlink
- * (set by `bizar dev-link`). Idempotent — safe to re-run.
- *
- * Bug history (v5.6.0-beta.12): the cp filter used to be
- *   `!p.includes('node_modules') && !p.includes('dist')`
- * which always returned `false` for the SOURCE path itself because
- * `pkgRoot = $(npm root -g)/@polderlabs/bizar` always contains
- * `node_modules`. Net effect: 0 files were copied, the dest kept stale
- * `index.ts` ("// fake plugin" leftovers from older installs), and the
- * "up to date" mtime check then made subsequent installs skip the copy
- * because `dest mtime >= src mtime`. Fixed by:
- *
- *   1. Filtering on RELATIVE path segments, not absolute substrings.
- *   2. Adding content-hash comparison as a secondary freshness check.
- *   3. Detecting the "fake plugin" stub and forcing a re-copy.
+ * Build the dashboard SPA so `bizar-dash/dist/index.html` exists.
+ * Idempotent. Non-fatal.
  */
-export async function copyPluginToCline({ dryRun, force }) {
-  const state = detectState();
-  const src = state.plugin.sourceDir;
-  const dest = state.plugin.destDir;
+export async function buildDash({ dryRun = false } = {}) {
+  const dashDir   = join(REPO_ROOT, 'bizar-dash');
+  const distIndex = join(dashDir, 'dist', 'index.html');
 
-  if (!src || !existsSync(src)) {
-    return {
-      ok: false,
-      message: `plugin source not found at ${src ?? '(unknown)'} — reinstall @polderlabs/bizar`,
-    };
-  }
+  if (!existsSync(join(dashDir, 'src', 'web', 'index.html'))) return { ok: true, skipped: true, message: `Dashboard src not found — skipping build` };
+  if (existsSync(distIndex)) return { ok: true, skipped: true, message: `Dashboard dist already present — skipping build` };
+  if (dryRun) return { ok: true, skipped: false, message: `would build dashboard at ${dashDir}` };
 
-  // v6.3.0 — Claude Code uses MCP servers, not the legacy Cline
-  // plugin manifest. The Bizar SDK ships under packages/sdk/ and is
-  // registered in ~/.claude/settings.json as `mcpServers.bizar`. The
-  // plugins/bizar/ tree is now a thin shim that re-exports the SDK,
-  // and we no longer copy it into ${CLAUDE_DIR}/plugins/bizar/.
-  // We only verify that the source has a package.json (sanity check).
-  const pkgJsonPath = join(src, 'package.json');
-  if (!existsSync(pkgJsonPath)) {
-    return {
-      ok: false,
-      message:
-        `plugin source missing package.json at ${pkgJsonPath} — ` +
-        `rebuild @polderlabs/bizar`,
-    };
+  const bunBin = join(process.env.HOME || '', '.bun', 'bin', 'bun');
+  let cmd, args, childEnv;
+  if (existsSync(bunBin)) {
+    cmd = bunBin; args = ['run', 'build:dash'];
+    childEnv = { ...process.env, PATH: [dirname(bunBin), process.env.PATH || ''].join(process.platform === 'win32' ? ';' : ':') };
+  } else if (haveCmd('bun')) {
+    cmd = 'bun'; args = ['run', 'build:dash']; childEnv = process.env;
+  } else {
+    cmd = 'npx'; args = ['--yes', 'vite', 'build']; childEnv = process.env;
   }
+
   try {
-    const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
-    if (!pkg.name) {
-      return {
-        ok: false,
-        message: `plugin package.json at ${pkgJsonPath} is missing required 'name' field`,
-      };
-    }
+    logInfo(`building dashboard with \`${cmd} ${args.join(' ')}\``);
+    execFileSync(cmd, args, { cwd: REPO_ROOT, stdio: 'pipe', timeout: 240_000, env: childEnv });
+    if (existsSync(distIndex)) return { ok: true, skipped: false, message: 'Dashboard built (dist/index.html present)' };
+    return { ok: false, message: `build completed but ${distIndex} still missing` };
   } catch (err) {
-    return {
-      ok: false,
-      message: `plugin package.json at ${pkgJsonPath} is invalid JSON: ${err.message}`,
-    };
-  }
-
-  if (state.plugin.symlink && !force) {
-    return {
-      ok: true,
-      message: `plugin dest is a dev symlink — skipping copy (use \`bizar dev-unlink\` to restore)`,
-    };
+    const stderr = err.stderr ? err.stderr.toString().split('\n').slice(0, 5).join(' | ') : '(no stderr)';
+    return { ok: false, message: `Dashboard build failed: ${stderr}` };
   }
+}
 
-  // Detect a stale "fake plugin" stub at the dest — these were left
-  // behind by older broken installs that wrote `// fake plugin\n` and
-  // nothing else. Always overwrite those.
-  const destIndexTs = join(dest, 'index.ts');
-  if (existsSync(destIndexTs) && isFakePluginStub(destIndexTs)) {
-    if (!dryRun) {
-      try { rmSync(dest, { recursive: true, force: true }); } catch { /* ignore */ }
-    }
-    state.plugin.installed = false;
-    state.plugin.upToDate = false;
-  }
+// ─── Bizar HOME bootstrap ────────────────────────────────────────────────────
 
-  // Content-hash freshness check — supersedes the dir-mtime check that
-  // gave false positives for stale "fake plugin" dirs.
-  if (state.plugin.installed && !force && pluginContentMatches(src, dest)) {
-    return { ok: true, message: 'plugin copy is up to date (content verified)' };
-  }
+/** Ensure `~/.config/bizar/` exists with memory-vault, loops, port file. Idempotent. */
+export function ensureBizarHome({ dryRun = false } = {}) {
+  if (dryRun) return { ok: true, message: `[dry-run] would ensure ${BIZAR_HOME}` };
+  mkdirSync(BIZAR_HOME, { recursive: true });
+  mkdirSync(join(BIZAR_HOME, 'memory-vault'), { recursive: true });
+  mkdirSync(join(BIZAR_HOME, 'loops'), { recursive: true });
+  if (!existsSync(DASHBOARD_PORT_FILE)) writeFileSync(DASHBOARD_PORT_FILE, '4321\n');
+  return { ok: true, message: `${BIZAR_HOME} ready`, path: BIZAR_HOME };
+}
 
-  if (dryRun) {
-    return { ok: true, message: `[dry-run] would copy ${src} → ${dest}` };
-  }
+// ─── Toolchain ───────────────────────────────────────────────────────────────
 
-  if (state.plugin.symlink && force) {
-    try { rmSync(dest, { force: true }); } catch { /* ignore */ }
-  }
+function checkToolchain() {
+  section('Toolchain');
+  if (haveCmd('node')) logOk(`node ${execSync('node --version').toString().trim()}`);
+  else { logErr('node not on PATH — install Node.js 18+'); process.exit(1); }
+  if (haveCmd('npm'))  logOk(`npm ${execSync('npm --version').toString().trim()}`);
+  else logWarn('npm not on PATH');
+  if (haveCmd('git'))  logOk(`git ${execSync('git --version').toString().trim().split(' ')[2]}`);
+  else logWarn('git not on PATH');
+  if (haveCmd('claude')) logOk(`claude ${execSync('claude --version').toString().trim().split('\n')[0]}`);
+  else logWarn('claude not on PATH — will install via npm');
+}
 
-  const { cp } = await import('node:fs/promises');
+/** Install Claude Code CLI globally via npm. Idempotent. */
+function installClaudeCli({ force = false, dryRun = false } = {}) {
+  if (haveCmd('claude') && !force) return;
+  section('Installing Claude Code CLI');
+  logInfo('npm install -g @anthropic-ai/claude-agent-sdk @anthropic-ai/claude-code');
+  if (dryRun) return;
   try {
-    // Start fresh — wipe dest so leftover files from a previous version
-    // don't linger (otherwise an older index.ts can shadow the new one).
-    try { rmSync(dest, { recursive: true, force: true }); } catch { /* ignore */ }
-    mkdirSync(dest, { recursive: true });
-
-    // Filter against RELATIVE path segments, not absolute substrings. This
-    // is the v5.6.0-beta.12 fix: the old filter excluded the src dir itself
-    // because npm-global paths contain `node_modules`.
-    //
-    // v5.6.0-beta.14: also skip `tests/` and `scripts/` (test fixtures &
-    // helper scripts aren't part of the runtime plugin) and `coverage/`
-    // (jest artifacts). The runtime only needs `index.ts`, `src/`,
-    // `package.json`, and the static docs.
-    const skipDirs = new Set([
-      'node_modules',
-      'dist',
-      'tests',
-      'scripts',
-      'coverage',
-      '.DS_Store',
-    ]);
-    await cp(src, dest, {
-      recursive: true,
-      filter: (p) => {
-        const rel = p.slice(src.length).split(sep).filter(Boolean);
-        // Drop any path that has a skip segment.
-        return !rel.some((seg) => skipDirs.has(seg));
-      },
-    });
-
-    // Copy the SDK into the deployed plugin's node_modules so Bun can
-    // resolve @polderlabs/bizar-sdk when loading the plugin from
-    // ${CLAUDE_DIR}/plugins/bizar/.
-    const sdkSrc = join(state.pkgRoot, 'node_modules', '@polderlabs', 'bizar-sdk');
-    const sdkDst = join(dest, 'node_modules', '@polderlabs', 'bizar-sdk');
-    if (existsSync(sdkSrc)) {
-      mkdirSync(join(dest, 'node_modules', '@polderlabs'), { recursive: true });
-      await cp(sdkSrc, sdkDst, { recursive: true });
-    }
-
-    // Wire runtime deps (`zod`, `@anthropic-ai/claude-agent-sdk`) into
-    // the deployed plugin's node_modules/ so Bun's module resolver
-    // finds them when loading the plugin from
-    // ${CLAUDE_DIR}/plugins/bizar/. Without this, the plugin throws
-    // "Cannot find module 'zod' (+2 more)" at startup.
-    //
-    // The resolution logic lives in `cli/plugin-runtime-deps.mjs` and is
-    // shared with the legacy installer (`cli/install.mjs`). It searches
-    // the Bizar npm pkg's own `node_modules/`, then the
-    // `@anthropic-ai/claude-code` npm pkg's `node_modules/`, then the
-    // dev source tree. Symlinks are preferred; recursive copy is the
-    // fallback.
-    //
-    // Only wire when the plugin entry is a `.ts` source file. If the
-    // plugin ships a pre-bundled `dist/index.js`, the runtime deps are
-    // already inlined and wiring is wasted work (and might shadow an
-    // intentional `node_modules/` layout in the bundle).
-    let needsWiring = true;
-    try {
-      const pkg = JSON.parse(readFileSync(join(dest, 'package.json'), 'utf8'));
-      if (typeof pkg.main === 'string' && !pkg.main.endsWith('.ts')) {
-        needsWiring = false;
-      }
-    } catch {
-      // missing/invalid package.json — proceed and let the wiring try.
-    }
-    if (needsWiring) {
-      const { wirePluginRuntimeDeps } = await import('./plugin-runtime-deps.mjs');
-      await wirePluginRuntimeDeps(dest, undefined, { pkgRoot: state.pkgRoot });
-    }
-    return { ok: true, message: `plugin copied to ${dest}` };
+    execSync('npm install -g @anthropic-ai/claude-agent-sdk @anthropic-ai/claude-code', { stdio: 'inherit' });
+    logOk('Claude Code CLI installed');
   } catch (err) {
-    return { ok: false, message: `plugin copy failed: ${err.message}` };
+    logErr(`npm install failed: ${err.message}`);
+    logWarn('retry manually: npm install -g @anthropic-ai/claude-code');
   }
 }
 
-/**
- * Detect a "fake plugin" stub at the dest. These were emitted by old test
- * suites and early install paths that wrote `// fake plugin\n` and never
- * updated the file again. Anything under ~200 bytes is considered a stub.
- */
-function isFakePluginStub(file) {
-  try {
-    const st = statSync(file);
-    if (st.size < 200) return true;
-    const head = readFileSync(file, 'utf8').slice(0, 200).toLowerCase();
-    if (head.includes('fake plugin')) return true;
-    return false;
-  } catch {
-    return true; // missing/unreadable → treat as bad
-  }
-}
+// ─── File sync helpers ──────────────────────────────────────────────────────
 
-/**
- * Recursively compare the contents of `src` and `dest`, returning true if
- * every file in src exists in dest with the same content (size + mtime).
- *
- * Cheap O(n) walk; n is the plugin source size (typically <2k files).
- * Skips `node_modules/` and `dist/` in both sides.
- */
-function pluginContentMatches(src, dest) {
-  const skipDirs = new Set(['node_modules', 'dist', '.DS_Store']);
-  function walk(s, d) {
-    const sEntries = readdirSyncSafe(s);
-    const dEntries = readdirSyncSafe(d);
-    if (!sEntries) return false;
-    // src should not have files missing from dest
-    for (const e of sEntries) {
-      if (skipDirs.has(e.name)) continue;
-      const sFull = join(s, e.name);
-      const dFull = join(d, e.name);
-      try {
-        const sSt = statSync(sFull);
-        if (sSt.isDirectory()) {
-          if (!walk(sFull, dFull)) return false;
-        } else {
-          const dSt = statSync(dFull);
-          if (dSt.size !== sSt.size) return false;
-          if (dSt.mtimeMs < sSt.mtimeMs) return false;
-        }
-      } catch {
-        return false;
-      }
-    }
-    // dest may have extra files (legacy artefacts) — that's OK.
-    void dEntries;
-    return true;
+function syncDir(srcDir, destDir, opts = {}) {
+  if (!existsSync(srcDir)) return { copied: 0, skipped: 0 };
+  ensureDir(destDir);
+  let copied = 0, skipped = 0;
+  for (const name of readdirSync(srcDir)) {
+    if (name.startsWith('.')) continue;
+    const sp = join(srcDir, name), dp = join(destDir, name);
+    const st = statSync(sp);
+    if (opts.filter && !opts.filter(name, sp)) { skipped++; continue; }
+    if (st.isDirectory()) { const r = syncDir(sp, dp, opts); copied += r.copied; skipped += r.skipped; }
+    else { copyFileSync(sp, dp); copied++; }
   }
-  return walk(src, dest);
+  return { copied, skipped };
 }
 
-function readdirSyncSafe(p) {
-  try {
-    return readdirSync(p, { withFileTypes: true });
-  } catch {
-    return null;
+export async function syncAgentFiles({ dryRun = false } = {}) {
+  const src = join(REPO_ROOT, 'config', 'agents');
+  const dest = CLAUDE_AGENTS_DIR;
+  if (!existsSync(src)) return { ok: true, message: `no agents source at ${src}`, copied: 0, skipped: 0 };
+  if (dryRun) return { ok: true, message: `[dry-run] would sync ${src} → ${dest}` };
+  ensureDir(dest); ensureDir(join(dest, '_shared'));
+  let { copied, skipped } = syncDir(src, dest, { filter: n => n.endsWith('.md') });
+  const sharedSrc = join(src, '_shared');
+  if (existsSync(sharedSrc)) {
+    for (const entry of readdirSync(sharedSrc, { withFileTypes: true })) {
+      if (entry.isFile()) { copyFileSync(join(sharedSrc, entry.name), join(dest, '_shared', entry.name)); copied++; }
+    }
+  }
+  return { ok: true, message: `${copied} agent(s) synced (${skipped} kept)`, copied, skipped };
+}
+
+export async function syncSkillFiles({ dryRun = false } = {}) {
+  const src = join(REPO_ROOT, 'config', 'skills');
+  const dest = CLAUDE_SKILLS_DIR;
+  if (!existsSync(src)) return { ok: true, message: `no skills source at ${src}`, copied: 0, skipped: 0 };
+  if (dryRun) return { ok: true, message: `[dry-run] would sync ${src} → ${dest}` };
+  ensureDir(dest); copyDirContents(src, dest);
+  const sharedBaseline = join(REPO_ROOT, 'config', 'agents', '_shared', 'AGENT_BASELINE.md');
+  if (existsSync(sharedBaseline)) {
+    const baselineDir = join(dest, 'agent-baseline');
+    ensureDir(baselineDir);
+    copyFileSync(sharedBaseline, join(baselineDir, 'SKILL.md'));
+  }
+  const count = readdirSync(dest).filter(n => { try { return statSync(join(dest, n)).isDirectory(); } catch { return false; } }).length;
+  return { ok: true, message: `${count} skill(s) synced`, copied: count, skipped: 0 };
+}
+
+export async function syncCommandFiles({ dryRun = false } = {}) {
+  const candidates = [join(REPO_ROOT, '.claude', 'commands'), join(REPO_ROOT, 'config', 'commands')];
+  let src = null;
+  for (const c of candidates) if (existsSync(c)) { src = c; break; }
+  if (!src) return { ok: true, message: 'no commands source found', copied: 0, skipped: 0 };
+  const dest = CLAUDE_COMMANDS_DIR;
+  if (dryRun) return { ok: true, message: `[dry-run] would sync ${src} → ${dest}` };
+  ensureDir(dest);
+  const { copied, skipped } = syncDir(src, dest, { filter: n => n.endsWith('.md') });
+  return { ok: true, message: `${copied} command(s) synced (${skipped} kept)`, copied, skipped };
+}
+
+export async function syncRulesFiles({ dryRun = false } = {}) {
+  const src = join(REPO_ROOT, 'config', 'rules');
+  const dest = CLAUDE_RULES_DIR;
+  if (!existsSync(src)) return { ok: true, message: `no rules source at ${src}`, copied: 0, skipped: 0 };
+  if (dryRun) return { ok: true, message: `[dry-run] would sync ${src} → ${dest}` };
+  ensureDir(dest);
+  const { copied, skipped } = syncDir(src, dest, { filter: n => n.endsWith('.md') || n.endsWith('.txt') });
+  return { ok: true, message: `${copied} rule(s) synced (${skipped} kept)`, copied, skipped };
+}
+
+export async function syncHookFiles({ dryRun = false } = {}) {
+  const src = join(REPO_ROOT, '.claude', 'hooks');
+  const dest = CLAUDE_HOOKS_DIR;
+  ensureDir(dest);
+  if (!existsSync(src)) return { ok: true, message: `no hooks source at ${src}`, copied: 0, skipped: 0 };
+  if (dryRun) return { ok: true, message: `[dry-run] would sync ${src} → ${dest}` };
+  copyDirContents(src, dest);
+  for (const name of readdirSync(dest)) {
+    const fp = join(dest, name);
+    try {
+      const st = statSync(fp);
+      if (st.isFile() && (name.endsWith('.sh') || name.endsWith('.mjs'))) chmodSync(fp, 0o755);
+    } catch { /* ignore */ }
   }
+  return { ok: true, message: 'hook scripts installed', copied: readdirSync(dest).length, skipped: 0 };
 }
 
-/**
- * Ensure the Bizar plugin entry exists in `${CLAUDE_DIR}/cline.json`.
- * Idempotent: if the entry already exists, no-op.
- */
-export async function patchClineJson({ dryRun, force }) {
-  // v6.3.0 — Claude Code-native. The "plugin entry" model is gone;
-  // Claude Code uses an MCP server entry in `mcpServers` plus optional
-  // hooks in `hooks`. We still expose this function under the old name
-  // for back-compat with callers (e.g. update.mjs), but the body now
-  // patches ~/.claude/settings.json.
-  return patchClaudeSettings({ dryRun, force });
-}
+// ─── settings.json ──────────────────────────────────────────────────────────
 
-export async function patchClaudeSettings({ dryRun, force }) {
-  const cfgPath = join(CLAUDE_DIR, 'settings.json');
-  if (!existsSync(cfgPath)) {
-    if (dryRun) {
-      return { ok: true, message: `[dry-run] would bootstrap ${cfgPath}` };
-    }
-    mkdirSync(CLAUDE_DIR, { recursive: true });
-    const templateSrc = join(REPO_ROOT, 'config', 'claude.settings.json');
-    if (existsSync(templateSrc)) {
-      const { copyFileSync: cfs } = await import('node:fs');
-      cfs(templateSrc, cfgPath);
-      return { ok: true, message: `${cfgPath} bootstrapped from package template` };
-    }
-    writeFileSync(cfgPath, JSON.stringify({
-      $schema: 'https://json.schemastore.org/claude-code-settings.json',
-      mcpServers: {
-        bizar: {
-          command: 'bizar-mcp',
-          args: [],
+export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
+  const fp = join(CLAUDE_DIR, 'settings.json');
+  const existing = readJsonSafe(fp, {}) || {};
+
+  const bizarSettings = {
+    $schema: 'https://json.schemastore.org/claude-code-settings.json',
+    mcpServers: {
+      bizar: {
+        type: 'stdio',
+        command: 'npx',
+        args: ['-y', '@polderlabs/bizar-sdk', 'mcp'],
+        env: {
+          BIZAR_HOME,
+          BIZAR_MEMORY_VAULT: process.env.BIZAR_MEMORY_VAULT || join(BIZAR_HOME, 'memory-vault'),
         },
       },
-      hooks: {},
-    }, null, 2));
-    return { ok: true, message: `${cfgPath} created` };
-  }
-
-  // File exists. Patch the Bizar config surface idempotently.
-  const cfg = readJsonSafe(cfgPath, null);
-  if (!cfg || typeof cfg !== 'object') {
-    return { ok: false, message: `${cfgPath} is not valid JSON` };
-  }
+    },
+    permissions: {
+      allow: ['mcp__bizar__*'],
+      deny: [
+        'Read(./.env)', 'Read(./.env.*)',
+        'Bash(rm -rf /)', 'Bash(sudo *)',
+        'Write(./node_modules/**)', 'Write(./package-lock.json)',
+      ],
+    },
+    env: {
+      BIZAR_HOME,
+      BIZAR_MEMORY_VAULT: process.env.BIZAR_MEMORY_VAULT || join(BIZAR_HOME, 'memory-vault'),
+    },
+    hooks: {
+      PreToolUse: [{ matcher: 'Write|Edit|MultiEdit|Bash', hooks: [{ type: 'command', command: join(CLAUDE_HOOKS_DIR, 'pretooluse-editwrite.mjs'), timeout: 10 }] }],
+      PostToolUse: [{ matcher: 'Edit|Write|MultiEdit', hooks: [{ type: 'command', command: join(CLAUDE_HOOKS_DIR, 'posttooluse-editwrite.mjs'), timeout: 10 }] }],
+      UserPromptSubmit: [{ hooks: [{ type: 'command', command: join(CLAUDE_HOOKS_DIR, 'userpromptsubmit-tag.mjs'), timeout: 10 }] }],
+      SessionStart: [{ hooks: [{ type: 'command', command: join(CLAUDE_HOOKS_DIR, 'sessionstart-prime.mjs'), timeout: 10 }] }],
+      SessionEnd: [{ hooks: [{ type: 'command', command: join(CLAUDE_HOOKS_DIR, 'sessionend-record.mjs'), timeout: 10 }] }],
+    },
+  };
 
-  // v6.3.0 — Multi-patch installer. On every install/update, ensure the
-  // Bizar config surface is present in ~/.claude/settings.json:
-  //
-  //   1. mcpServers.bizar — register the Bizar MCP server (the critical
-  //      entry; without this, Claude Code has no access to Bizar tools).
-  //   2. $schema — add if missing (helps editors validate).
-  //   3. hooks — point at .claude/hooks/bizar-tools.md so Claude Code
-  //      fires them on every session.
-  //
-  // Per user request: "the installer should do nothing with providers,
-  // the user has to configure it themselves." The installer sets up the
-  // Bizar scaffolding (MCP server entry, schema, hooks) and stays out of
-  // provider configuration entirely.
-  //
-  // All patches are additive and idempotent. We never overwrite a value
-  // the user has set; the `force` flag bypasses that protection for the
-  // MCP server entry only.
-  let addedMcpServer = false;
-  let addedSchema = false;
-  let addedHooks = false;
-
-  const mcpServers = (cfg.mcpServers && typeof cfg.mcpServers === 'object')
-    ? cfg.mcpServers : {};
-  if (!mcpServers.bizar) {
-    mcpServers.bizar = {
-      command: 'bizar-mcp',
-      args: [],
+  const merged = { ...existing };
+  if (force) { Object.assign(merged, bizarSettings); }
+  else {
+    merged.$schema   = merged.$schema || bizarSettings.$schema;
+    merged.mcpServers = { ...(existing.mcpServers || {}), ...bizarSettings.mcpServers };
+    merged.permissions = {
+      allow: [...new Set([...(existing.permissions?.allow || []), ...bizarSettings.permissions.allow])],
+      deny:  [...new Set([...(existing.permissions?.deny || []),  ...bizarSettings.permissions.deny])],
+      ask:   [...new Set([...(existing.permissions?.ask || [])])],
     };
-    addedMcpServer = true;
+    merged.env   = { ...(existing.env || {}), ...bizarSettings.env };
+    merged.hooks = { ...(existing.hooks || {}), ...bizarSettings.hooks };
   }
-  cfg.mcpServers = mcpServers;
 
-  // 2. $schema
-  if (!cfg.$schema) {
-    cfg.$schema = 'https://json.schemastore.org/claude-code-settings.json';
-    addedSchema = true;
-  }
+  if (dryRun) return { ok: true, message: `[dry-run] would write ${fp}` };
+  ensureDir(CLAUDE_DIR);
+  writeFileSync(fp, JSON.stringify(merged, null, 2) + '\n');
+  return { ok: true, message: `wrote ${fp}`, path: fp };
+}
 
-  // 3. hooks — point at the bundled Bizar hooks file.
-  if (!cfg.hooks || (typeof cfg.hooks === 'object' && Object.keys(cfg.hooks).length === 0)) {
-    cfg.hooks = {
-      SessionStart: [
-        {
-          hooks: [
-            {
-              type: 'command',
-              command: 'cat .claude/hooks/bizar-tools.md',
-            },
-          ],
-        },
-      ],
-    };
-    addedHooks = true;
-  }
+// ─── CLAUDE.md mirror ──────────────────────────────────────────────────────
 
-  const anyAdded = addedMcpServer || addedSchema || addedHooks;
+export function writeClaudeMdMirror({ dryRun = false, force = false } = {}) {
+  const srcCandidates = [join(REPO_ROOT, 'AGENTS.md'), join(REPO_ROOT, 'CLAUDE.md')];
+  const src = srcCandidates.find(p => existsSync(p));
+  const dest = join(CLAUDE_DIR, 'CLAUDE.md');
+  if (!src) return { ok: false, message: 'no CLAUDE.md / AGENTS.md found in repo root' };
+  if (existsSync(dest) && !force) return { ok: true, message: `${dest} already exists — pass --force to overwrite` };
+  if (dryRun) return { ok: true, message: `[dry-run] would mirror ${src} → ${dest}` };
+  ensureDir(CLAUDE_DIR);
+  const body = readFileSync(src, 'utf8');
+  const banner = `# CLAUDE.md — Mirror of AGENTS.md for Claude Code compatibility\n\n` +
+    `> Auto-generated by \`cli/provision.mjs:writeClaudeMdMirror\`.\n` +
+    `> DO NOT EDIT THIS FILE DIRECTLY — edit \`AGENTS.md\` and run \`make mirror-claude-md\`.\n\n` +
+    `---\n\n`;
+  writeFileSync(dest, banner + body);
+  return { ok: true, message: `mirrored ${src} → ${dest}`, path: dest };
+}
 
-  if (!addedMcpServer && !force && !anyAdded) {
-    return { ok: true, message: 'settings.json already has Bizar MCP server entry' };
-  }
+// ─── MCP server + plugin registration ───────────────────────────────────────
 
-  if (dryRun) {
-    const added = [];
-    if (addedMcpServer) added.push('mcpServers.bizar');
-    if (addedSchema) added.push('$schema');
-    if (addedHooks) added.push('hooks');
-    return { ok: true, message: `[dry-run] would patch settings.json with: ${added.join(', ')}` };
+export function setupMcpServer({ dryRun = false } = {}) {
+  const settingsPath = join(CLAUDE_DIR, 'settings.json');
+  const existing = readJsonSafe(settingsPath, null);
+  if (existing && existing.mcpServers && existing.mcpServers.bizar) {
+    return { ok: true, message: `bizar MCP server already registered in ${settingsPath}` };
   }
+  if (!haveCmd('claude')) return { ok: false, message: 'claude CLI not on PATH' };
+  if (dryRun) return { ok: true, message: '[dry-run] would run: claude mcp add bizar -- npx -y @polderlabs/bizar-sdk mcp' };
+  const r = spawnSync('claude', ['mcp', 'add', '-f', '-s', 'user', 'bizar', '--', 'npx', '-y', '@polderlabs/bizar-sdk', 'mcp'], { stdio: 'inherit', timeout: 60_000 });
+  if (r.status !== 0) return { ok: false, message: `claude mcp add exited with code ${r.status}` };
+  return { ok: true, message: 'bizar MCP server registered' };
+}
 
-  writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n');
-  const added = [];
-  if (addedMcpServer) added.push('mcpServers.bizar');
-  if (addedSchema) added.push('$schema');
-  if (addedHooks) added.push('hooks');
-  return {
-    ok: true,
-    message: added.length > 0
-      ? `settings.json patched: ${added.join(', ')}`
-      : 'settings.json already complete',
-  };
+export function setupClaudePlugin({ dryRun = false } = {}) {
+  const manifestPath = join(REPO_ROOT, '.claude-plugin', 'plugin.json');
+  if (!existsSync(manifestPath)) return { ok: true, message: `no plugin manifest — skipping` };
+  if (!haveCmd('claude')) return { ok: false, message: 'claude CLI not on PATH' };
+  if (dryRun) return { ok: true, message: `[dry-run] would run: claude plugin install ${REPO_ROOT}` };
+  const r = spawnSync('claude', ['plugin', 'install', '.'], { stdio: 'inherit', timeout: 120_000, cwd: REPO_ROOT });
+  if (r.status !== 0) return { ok: false, message: `claude plugin install exited with code ${r.status}` };
+  return { ok: true, message: `claude plugin installed from ${REPO_ROOT}` };
 }
 
-/**
- * Copy `config/agents/*.md` into `${CLAUDE_DIR}/agents/`. Idempotent.
- * Doesn't overwrite existing files unless `force: true`.
- */
-export async function syncAgentFiles({ dryRun, force }) {
-  /**
-   * v5.6.0-beta.12 — handle the Cline agent format.
-   *
-   * Cline reads agents from `~/.cline/agents/<name>.{yml,yaml}` with a
-   * Zod-validated schema:
-   *   { name: string, description: string, tools?, skills?,
-   *     providerId?, modelId?, maxIterations? }
-   *
-   * Our source agents are written in OpenCode-flavored Markdown
-   * (frontmatter + body). Both are valid: the body is the system prompt,
-   * the frontmatter is config. To make agents loadable by the Cline CLI
-   * we copy both `.md` (legacy / docs) and `.yaml` (Cline-loadable) into
-   * `${CLAUDE_DIR}/agents/`. The YAML version is auto-generated if
-   * missing, with the `name` field added from the filename.
-   */
-  const srcDir = join(REPO_ROOT, 'config', 'agents');
-  const dstDir = join(CLAUDE_DIR, 'agents');
-  if (!existsSync(srcDir)) {
-    return { ok: true, message: 'no bundled agents to sync' };
-  }
-  if (dryRun) {
-    return { ok: true, message: `[dry-run] would sync ${srcDir} → ${dstDir}` };
-  }
+// ─── Dashboard service ─────────────────────────────────────────────────────
 
-  mkdirSync(dstDir, { recursive: true });
-  mkdirSync(join(dstDir, '_shared'), { recursive: true });
-
-  let copied = 0;
-  let skipped = 0;
-  const files = readdirSync(srcDir, { withFileTypes: true });
-  for (const entry of files) {
-    if (entry.isDirectory()) continue;
-    if (entry.name === '_shared') continue;
-    const src = join(srcDir, entry.name);
-    const dst = join(dstDir, entry.name);
-
-    // Always copy the source file (md or yaml) verbatim.
-    if (existsSync(dst) && !force) {
-      skipped++;
-    } else {
-      copyFileSync(src, dst);
-      copied++;
-    }
+function installDashboardService({ dryRun = false } = {}) {
+  const bin = join(REPO_ROOT, 'cli', 'bin.mjs');
+  if (!existsSync(bin)) return { ok: false, message: `cli/bin.mjs not found — service registration deferred` };
+  if (dryRun) return { ok: true, message: `[dry-run] would run: node ${bin} service install` };
+  const r = spawnSync('node', [bin, 'service', 'install'], { stdio: 'inherit' });
+  if (r.status !== 0) return { ok: false, message: `service install returned ${r.status}` };
+  return { ok: true, message: 'dashboard service registered' };
+}
 
-    // If the source is .md and there's no matching .yaml/.yml in the
-    // dest, generate one so Cline can load it.
-    if (entry.name.endsWith('.md')) {
-      const base = entry.name.slice(0, -3);
-      const yamlDst = join(dstDir, base + '.yaml');
-      if (!existsSync(yamlDst) || force) {
-        const mdText = readFileSync(src, 'utf8');
-        const yamlText = mdToClineAgentYaml(mdText, base);
-        writeFileSync(yamlDst, yamlText);
-        copied++;
-      }
-    }
-  }
+// ─── Detection ─────────────────────────────────────────────────────────────
 
-  // _shared/ — always overwrite (it's tiny + ships agent defaults).
-  const sharedSrc = join(srcDir, '_shared');
-  if (existsSync(sharedSrc)) {
-    for (const entry of readdirSync(sharedSrc, { withFileTypes: true })) {
-      if (!entry.isFile()) continue;
-      copyFileSync(join(sharedSrc, entry.name), join(dstDir, '_shared', entry.name));
-      copied++;
-    }
-  }
+/**
+ * Probe the current state without modifying anything.
+ * Returned shape:
+ *   {
+ *     claudeDir, claudeCli, agentsDir, skillsDir, commandsDir,
+ *     hooksDir, rulesDir, settingsFile, mcpServer, pluginManifest,
+ *     bizarHome, gitRepo,
+ *   }
+ */
+export function detectState() {
+  const settingsPath = join(CLAUDE_DIR, 'settings.json');
+  const settings = readJsonSafe(settingsPath, null);
+  let claudeVersion = null;
+  try {
+    claudeVersion = execFileSync('claude', ['--version'], { encoding: 'utf8', timeout: 5000 })
+      .toString().trim().split('\n')[0] || null;
+  } catch { /* not installed */ }
+
+  const countMd = (dir) => {
+    if (!existsSync(dir)) return 0;
+    try { return readdirSync(dir, { withFileTypes: true }).filter(e => e.isFile() && (e.name.endsWith('.md') || e.name.endsWith('.mjs'))).length; }
+    catch { return 0; }
+  };
+  const countSkillDirs = (dir) => {
+    if (!existsSync(dir)) return 0;
+    try { return readdirSync(dir, { withFileTypes: true }).filter(e => e.isDirectory()).length; }
+    catch { return 0; }
+  };
+
+  const mcpServer = settings?.mcpServers?.bizar
+    ? { registered: true, type: settings.mcpServers.bizar.type || 'stdio', command: settings.mcpServers.bizar.command || 'npx' }
+    : { registered: false };
 
   return {
-    ok: true,
-    message: `agents synced (${copied} copied, ${skipped} kept)`,
-    copied,
-    skipped,
+    claudeDir: CLAUDE_DIR,
+    claudeCli: { available: !!claudeVersion, version: claudeVersion },
+    agentsDir:   { exists: existsSync(CLAUDE_AGENTS_DIR),   count: countMd(CLAUDE_AGENTS_DIR) },
+    skillsDir:   { exists: existsSync(CLAUDE_SKILLS_DIR),   count: countSkillDirs(CLAUDE_SKILLS_DIR) },
+    commandsDir:  { exists: existsSync(CLAUDE_COMMANDS_DIR), count: countMd(CLAUDE_COMMANDS_DIR) },
+    hooksDir:    { exists: existsSync(CLAUDE_HOOKS_DIR),    count: countMd(CLAUDE_HOOKS_DIR) },
+    rulesDir:    { exists: existsSync(CLAUDE_RULES_DIR),     count: countMd(CLAUDE_RULES_DIR) },
+    settingsFile: { exists: existsSync(settingsPath), parses: settings !== null && typeof settings === 'object', path: settingsPath },
+    mcpServer,
+    pluginManifest: { exists: existsSync(join(REPO_ROOT, '.claude-plugin', 'plugin.json')) },
+    bizarHome: { exists: existsSync(BIZAR_HOME), path: BIZAR_HOME },
+    gitRepo: existsSync(join(REPO_ROOT, '.git')),
   };
 }
 
-/**
- * Convert an OpenCode-style agent markdown (frontmatter + body) into a
- * Cline-loadable YAML agent. Cline's Zod schema requires `name` and
- * `description`; the markdown body becomes the system prompt.
+export function detectStateJson() {
+  return JSON.stringify(detectState(), null, 2);
+}
+
+// ─── Top-level orchestration ─────────────────────────────────────────────────
+
+/**
+ * The unified provision flow. `mode` is 'install' or 'update'.
+ * Every step is idempotent.
  */
-function mdToClineAgentYaml(mdText, fallbackName) {
-  const m = mdText.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/);
-  if (!m) {
-    // No frontmatter — write a minimal YAML with just the name + body.
-    return [
-      'name: ' + JSON.stringify(fallbackName),
-      'description: ' + JSON.stringify(fallbackName),
-      '',
-    ].join('\n');
-  }
-  // Wrap the fallback as a YAML mapping block too.
-  const _fbFallback = '---\n' +
-    'name: ' + JSON.stringify(fallbackName) + '\n' +
-    'description: ' + JSON.stringify(fallbackName) + '\n' +
-    '---\n\n' + mdText.trim() + '\n';
-  if (!mdText.includes('---')) return _fbFallback;
-
-  const fm = m[1];
-  const body = m[2];
-
-  // If frontmatter already has a `name:` line, leave it alone.
-  let newFm = fm;
-  if (!/^name:/m.test(newFm)) {
-    newFm = `name: ${fallbackName}\n` + newFm;
-  }
+export async function runProvision(opts = {}) {
+  const { mode = 'install', dryRun = false, force = false, yes = false, start = true } = opts;
+  const effectiveMode = mode === 'update' ? 'update' : 'install';
 
-  // Cline uses YAML, but OpenCode uses a YAML superset. Strip keys Cline
-  // doesn't know about (`color`, `mode`, `permission`, etc.) — they were
-  // relevant for the OpenCode runtime, but they would only confuse the
-  // Cline Zod validator (it accepts only `name`, `description`, `tools`,
-  // `skills`, `providerId`, `modelId`, `maxIterations`).
-  const ALLOWED = new Set([
-    'name',
-    'description',
-    'tools',
-    'skills',
-    'providerId',
-    'modelId',
-    'maxIterations',
-  ]);
-  // Drop blocks whose top-level key isn't allowed (e.g. `permission:`).
-  // An indented line whose top-level parent wasn't allowed is a sub-key of
-  // a dropped block — skip it.
-  const lines = newFm.split('\n');
-  const filteredLines = [];
-  let currentTopAllowed = false;
-  for (const line of lines) {
-    const isIndented = line.startsWith(' ') || line.startsWith('\t');
-    if (line === '' || isIndented) {
-      if (currentTopAllowed) filteredLines.push(line);
-      continue;
-    }
-    const keyMatch = line.match(/^(\w[\w-]*)\s*:/);
-    if (!keyMatch) {
-      filteredLines.push(line);
-      currentTopAllowed = false;
-      continue;
-    }
-    if (ALLOWED.has(keyMatch[1])) {
-      filteredLines.push(line);
-      currentTopAllowed = true;
-    } else {
-      currentTopAllowed = false;
-    }
-  }
-  const filtered = filteredLines.join('\n');
+  console.log('');
+  console.log(chalk.bold.cyan('  ⚡ BizarHarness Provisioner v10.0.0 (Claude Code)'));
+  console.log(chalk.dim(`     Mode: ${effectiveMode}${force ? ' (force)' : ''}${dryRun ? ' (dry-run)' : ''}`));
+  console.log('');
+
+  const state = detectState();
+
+  section('Bizar HOME');
+  const bizarHomeStep = ensureBizarHome({ dryRun });
+  if (bizarHomeStep.ok) logOk(bizarHomeStep.message); else logErr(bizarHomeStep.message);
+
+  checkToolchain();
+  installClaudeCli({ force, dryRun });
 
-  return '---\n' + filtered + '\n---\n\n' + body.trim() + '\n';
+  const stepResults = [];
+  const runStep = async (label, fn) => {
+    section(label);
+    const r = await fn();
+    console.log(`  ${r.ok ? '✓' : '✗'} ${r.message}`);
+    stepResults.push({ label, ...r });
+    return r;
+  };
+
+  await runStep('Syncing agents',    () => syncAgentFiles({ dryRun, force }));
+  await runStep('Syncing skills',    () => syncSkillFiles({ dryRun, force }));
+  await runStep('Syncing commands',   () => syncCommandFiles({ dryRun, force }));
+  await runStep('Syncing rules',      () => syncRulesFiles({ dryRun, force }));
+  await runStep('Syncing hooks',      () => syncHookFiles({ dryRun, force }));
+  await runStep('Building SDK',       () => buildSdk({ dryRun }));
+  await runStep('Building plugin',    () => buildPlugin({ dryRun }));
+  await runStep('Building dashboard', () => buildDash({ dryRun }));
+
+  section('Writing settings.json');
+  const settingsStep = writeClaudeSettings({ dryRun, force });
+  if (settingsStep.ok) logOk(settingsStep.message); else logErr(settingsStep.message);
+  stepResults.push({ label: 'settings.json', ...settingsStep });
+
+  section('MCP server (bizar)');
+  const mcpStep = setupMcpServer({ dryRun });
+  if (mcpStep.ok) logOk(mcpStep.message); else logWarn(mcpStep.message);
+  stepResults.push({ label: 'mcp-server', ...mcpStep });
+
+  section('Claude plugin');
+  const pluginStep = setupClaudePlugin({ dryRun });
+  if (pluginStep.ok) logOk(pluginStep.message); else logWarn(pluginStep.message);
+  stepResults.push({ label: 'claude-plugin', ...pluginStep });
+
+  section('CLAUDE.md mirror');
+  const claudeMdStep = writeClaudeMdMirror({ dryRun, force });
+  if (claudeMdStep.ok) logOk(claudeMdStep.message); else logWarn(claudeMdStep.message);
+  stepResults.push({ label: 'claude-md', ...claudeMdStep });
+
+  if (start && effectiveMode === 'install') {
+    section('Dashboard service');
+    const svcStep = installDashboardService({ dryRun });
+    if (svcStep.ok) logOk(svcStep.message); else logWarn(svcStep.message);
+    stepResults.push({ label: 'service', ...svcStep });
+  }
+
+  section('Provision complete');
+  console.log(chalk.dim(JSON.stringify(detectState(), null, 2)));
+  console.log('');
+  const anyFail = stepResults.some(r => !r.ok);
+  if (anyFail) console.log(chalk.yellow('  ⚠ Some steps had issues.'));
+  else { console.log(chalk.bold.green('  ✓ Bizar is ready.')); console.log(chalk.dim('     Next: restart your Claude Code session.')); }
+  console.log('');
+  return { ok: !anyFail, mode: effectiveMode, state: detectState(), stepResults };
 }
 
+// ─── Legacy / gap-closure helpers (from old provision.mjs) ───────────────────
+
 /**
- * Copy slash commands + skills to the cline config dir.
+ * LightRAG install via uv tool. Idempotent.
  */
+export async function installLightragProvision({ dryRun = false } = {}) {
+  if (dryRun) return { ok: true, message: '[dry-run] would run: uv tool install lightrag-hku[api]' };
+  if (haveCmd('lightrag-server')) return { ok: true, message: 'lightrag-server already on PATH' };
+  if (!haveCmd('uv')) return { ok: false, message: 'uv not found' };
+  try {
+    const r = spawnSync('uv', ['tool', 'install', 'lightrag-hku[api]'], { stdio: 'inherit', timeout: 120_000 });
+    return r.status === 0 || r.status === null
+      ? { ok: true, message: 'lightrag-hku[api] installed via uv' }
+      : { ok: false, message: `uv tool install failed (exit ${r.status})` };
+  } catch (err) {
+    return { ok: false, message: `lightrag install error: ${err.message}` };
+  }
+}
+
 /**
- * Sync slash commands + skills + hooks + rules + workflows into the
- * Cline config dir.
- *
- * v5.6.0-beta.12 — complete rewrite:
- *   - Iterates ALL subdirs of `config/skills/` dynamically instead of
- *     hardcoding 3 names. Previously only `obsidian`, `glyph`, and
- *     `read-the-damn-docs` were copied; the other 7 skills
- *     (`bizar`, `cpp-coding-standards`, `cpp-testing`, `embedded-esp-idf`,
- *     `lightrag`, `memory-protocol`, `self-improvement`) were silently
- *     missing from the installed Cline.
- *   - Each skill is copied as its OWN subdirectory under
- *     `${CLAUDE_DIR}/skills/<name>/` (e.g. `skills/obsidian/SKILL.md`),
- *     matching Cline's `resolveSkillsConfigSearchPaths` layout. Previously
- *     all skills were flattened into one dir, causing `SKILL.md` from
- *     each to overwrite the previous one — only the last copy survived.
- *   - Same per-directory layout for `commands/`, `hooks/`, `workflows/`,
- *     `rules/`.
- *   - Idempotent: re-running refreshes content but never deletes user
- *     additions.
- *
- * v6.0.1 — also syncs `config/rules/*.md` into `${CLAUDE_DIR}/rules/`.
- * Previously `config/rules/*.md` was only copied by the legacy
- * `cli/copy.mjs:installRules()` helper, never invoked by `bizar install`
- * or `bizar update` (which both go through `runProvision`). This meant
- * `general.md`, `git.md`, `javascript.md`, `python.md`, `testing.md`,
- * `thinking.md`, `uncertainty.md` were silently absent from the user's
- * `~/.cline/rules/`, breaking the always-on rules contract defined in
- * `AGENTS.md`. See https://docs.cline.bot/customization/cline-rules.
+ * v6.2.5 — Register every config/skills/<name>/SKILL.md in
+ * `~/.agents/.skill-lock.json` so Cline's marketplace UI shows them.
  */
-export async function syncConfigExtras({ dryRun }) {
-  if (dryRun) {
-    return {
-      ok: true,
-      message: '[dry-run] would sync commands + skills + hooks + rules + workflows',
-      counts: { skills: 0, commands: 0, hooks: 0, rules: 0, workflows: 0 },
+export function writeBizarSkillLock({ skillsSrc, agentsDir }) {
+  if (!existsSync(skillsSrc)) return { ok: true, count: 0, path: join(agentsDir, '.skill-lock.json') };
+  const lockPath = join(agentsDir, '.skill-lock.json');
+  let lock = { version: 3, skills: {} };
+  try {
+    const raw = readFileSync(lockPath, 'utf8');
+    lock = JSON.parse(raw);
+    if (!lock.skills || typeof lock.skills !== 'object') lock.skills = {};
+  } catch { /* first install */ }
+  const now = new Date().toISOString();
+  let count = 0;
+  for (const skillDir of readdirSync(skillsSrc, { withFileTypes: true })) {
+    if (!skillDir.isDirectory()) continue;
+    const name = skillDir.name;
+    const existing = lock.skills[name];
+    if (existing && existing.source === 'bizar/builtin') { existing.updatedAt = now; count++; continue; }
+    lock.skills[name] = {
+      source: 'bizar/builtin', sourceType: 'local',
+      sourceUrl: 'https://github.com/DrB0rk/BizarHarness',
+      skillPath: 'config/skills/' + name + '/SKILL.md',
+      skillFolderHash: 'bizar-managed', pluginName: 'bizar',
+      installedAt: existing && existing.installedAt ? existing.installedAt : now,
+      updatedAt: now,
     };
+    count++;
   }
+  try {
+    mkdirSync(agentsDir, { recursive: true });
+    writeFileSync(lockPath, JSON.stringify(lock, null, 2));
+    return { ok: true, count, path: lockPath };
+  } catch (err) {
+    return { ok: false, count: 0, path: lockPath, error: err.message };
+  }
+}
+
+/**
+ * Sync commands + skills + hooks + rules + workflows into CLAUDE_DIR.
+ * Combines the old syncAgentFiles / syncConfigExtras into one.
+ */
+export async function syncConfigExtras({ dryRun = false } = {}) {
+  if (dryRun) return { ok: true, message: '[dry-run] would sync commands + skills + hooks + rules + workflows', counts: { skills: 0, commands: 0, hooks: 0, rules: 0, workflows: 0 } };
 
   const copyDirIfExists = async (srcDir, dstDir) => {
     if (!existsSync(srcDir)) return;
-    mkdirSync(dstDir, { recursive: true });
+    ensureDir(dstDir);
     for (const entry of readdirSync(srcDir, { withFileTypes: true })) {
       const src = join(srcDir, entry.name);
       const dst = join(dstDir, entry.name);
@@ -1239,995 +826,105 @@ export async function syncConfigExtras({ dryRun }) {
     }
   };
 
-  // Track counts for the success message.
   const counts = { skills: 0, commands: 0, hooks: 0, rules: 0, workflows: 0 };
 
-  // ── Slash commands ───────────────────────────────────────────
-  // Cline searches `~/.cline/commands/` for command files (.md).
+  // Commands
   const commandsSrc = join(REPO_ROOT, 'config', 'commands');
   if (existsSync(commandsSrc)) {
     const commandsDst = join(CLAUDE_DIR, 'commands');
-    mkdirSync(commandsDst, { recursive: true });
-    // One subdir per command (matching Cline's command loading pattern).
+    ensureDir(commandsDst);
     for (const cmd of readdirSync(commandsSrc, { withFileTypes: true })) {
       if (!cmd.isFile() && !cmd.isDirectory()) continue;
       const src = join(commandsSrc, cmd.name);
       const dst = join(commandsDst, cmd.name);
-      if (cmd.isDirectory()) {
-        await copyDirIfExists(src, dst);
-      } else {
-        copyFileSync(src, dst);
-      }
-      counts.commands += 1;
-    }
-  }
-
-  // Legacy: also drop a copy under `commands-bizar/` for back-compat
-  // with anyone referencing the v3.x command tree path.
-  if (existsSync(commandsSrc)) {
-    const commandsBizarDst = join(CLAUDE_DIR, 'commands-bizar');
-    mkdirSync(commandsBizarDst, { recursive: true });
-    for (const cmd of readdirSync(commandsSrc, { withFileTypes: true })) {
-      if (!cmd.isFile()) continue;
-      const src = join(commandsSrc, cmd.name);
-      const dst = join(commandsBizarDst, cmd.name);
-      copyFileSync(src, dst);
+      if (cmd.isDirectory()) await copyDirIfExists(src, dst);
+      else copyFileSync(src, dst);
+      counts.commands++;
     }
   }
 
-  // ── Skills ───────────────────────────────────────────────────
-  // Cline expects `<configDir>/skills/<name>/SKILL.md`. We sync every
-  // subdir of `config/skills/` (no hardcoded list).
+  // Skills
   const skillsSrc = join(REPO_ROOT, 'config', 'skills');
   if (existsSync(skillsSrc)) {
     const skillsDst = join(CLAUDE_DIR, 'skills');
-    mkdirSync(skillsDst, { recursive: true });
-    for (const skillDir of readdirSync(skillsSrc, { withFileTypes: true })) {
-      if (!skillDir.isDirectory()) continue;
-      const src = join(skillsSrc, skillDir.name);
-      const dst = join(skillsDst, skillDir.name);
-      await copyDirIfExists(src, dst);
-      counts.skills += 1;
-    }
-  }
-
-  // Also mirror to `~/.agents/skills/<name>/` since Cline checks that
-  // path too (`resolveSkillsConfigSearchPaths`). Optional but cheap.
-  const agentsSkillsDst = join(HOME, '.agents', 'skills');
-  if (existsSync(skillsSrc) && counts.skills > 0) {
-    mkdirSync(agentsSkillsDst, { recursive: true });
+    ensureDir(skillsDst);
     for (const skillDir of readdirSync(skillsSrc, { withFileTypes: true })) {
       if (!skillDir.isDirectory()) continue;
-      const src = join(skillsSrc, skillDir.name);
-      const dst = join(agentsSkillsDst, skillDir.name);
-      await copyDirIfExists(src, dst);
-    }
-  }
-
-  // v6.2.5 - Register every Bizar skill in `~/.agents/.skill-lock.json`
-  // so Cline's marketplace UI (`isMarketplaceSkillInstalled`) actually
-  // shows them. Without this, users see "0 skills" in the Skills tab
-  // even though the files are correctly mirrored. See the
-  // `writeBizarSkillLock` JSDoc for the full rationale.
-  if (existsSync(skillsSrc)) {
-    const skillLock = writeBizarSkillLock({
-      skillsSrc,
-      agentsDir: join(HOME, '.agents'),
-    });
-    if (!skillLock.ok && skillLock.error) {
-      console.warn(`bizar: skill lock write failed: ${skillLock.error}`);
+      await copyDirIfExists(join(skillsSrc, skillDir.name), join(skillsDst, skillDir.name));
+      counts.skills++;
     }
   }
 
-  // v6.2.5 - Mirror `config/agents/_shared/AGENT_BASELINE.md` to both
-  // `~/.cline/skills/agent-baseline/SKILL.md` and
-  // `~/.agents/skills/agent-baseline/SKILL.md`. The auto-loaded
-  // `config/agents/_shared/AGENT_BASELINE.md` references skills by
-  // `name: agent-baseline`, which the Cline skill loader resolves
-  // via `~/.cline/skills/agent-baseline/SKILL.md` (and the
-  // `npx skills` lookup uses `~/.agents/skills/...`). Without this
-  // mirror the agent-baseline SKILL.md never appears in the
-  // marketplace / loader, and the baseline fails to attach.
-  const sharedAgentsDir = join(REPO_ROOT, 'config', 'agents', '_shared');
-  if (existsSync(join(sharedAgentsDir, 'AGENT_BASELINE.md'))) {
-    const baselineSkillDir1 = join(CLAUDE_DIR, 'skills', 'agent-baseline');
-    const baselineSkillDir2 = join(HOME, '.agents', 'skills', 'agent-baseline');
-    mkdirSync(baselineSkillDir1, { recursive: true });
-    mkdirSync(baselineSkillDir2, { recursive: true });
-    copyFileSync(
-      join(sharedAgentsDir, 'AGENT_BASELINE.md'),
-      join(baselineSkillDir1, 'SKILL.md'),
-    );
-    copyFileSync(
-      join(sharedAgentsDir, 'AGENT_BASELINE.md'),
-      join(baselineSkillDir2, 'SKILL.md'),
-    );
-  }
-
-  // ── Hooks ────────────────────────────────────────────────────
-  // v6.2.1 — Cline hooks are real executable scripts (PreToolUse,
-  // PostToolUse, TaskStart, TaskResume, UserPromptSubmit). They live in
-  // `~/.cline/hooks/` AND `~/Documents/Cline/Hooks/`. Cline only loads
-  // hooks from the second path (the first is for additional runtime
-  // hook injection via `--hooks-dir`), but we install to BOTH so:
-  //   1. `bizar validate` can verify the hooks are on disk.
-  //   2. Power users who pass `--hooks-dir ~/.cline/hooks` get them.
-  //   3. The official `~/Documents/Cline/Hooks/` location is canonical
-  //      and works without any extra config.
-  //
-  // Hooks must be `chmod +x` executable (Cline silently skips
-  // non-executable hook files per the Cline hooks contract).
-  const hooksSrc = join(REPO_ROOT, 'config', 'hooks');
+  // Hooks
+  const hooksSrc = join(REPO_ROOT, '.claude', 'hooks');
   if (existsSync(hooksSrc)) {
-    const hookEntries = readdirSync(hooksSrc, { withFileTypes: true });
-    const hookFiles = hookEntries
-      .filter((e) => e.isFile() && !e.name.endsWith('.md') && !e.name.endsWith('.txt'))
-      .map((e) => e.name);
-
-    // Install to ~/.cline/hooks/ (used by --hooks-dir override)
-    const hooksDst1 = join(CLAUDE_DIR, 'hooks');
-    mkdirSync(hooksDst1, { recursive: true });
-    for (const hookFile of hookFiles) {
-      const src = join(hooksSrc, hookFile);
-      const dst = join(hooksDst1, hookFile);
-      copyFileSync(src, dst);
-      try { chmodSync(dst, 0o755); } catch { /* best-effort */ }
-    }
-
-    // Also install to the canonical location: ~/Documents/Cline/Hooks/
-    // (Cline's default global hooks directory per the official docs)
-    const hooksDst2 = join(HOME, 'Documents', 'Cline', 'Hooks');
-    mkdirSync(hooksDst2, { recursive: true });
-    for (const hookFile of hookFiles) {
-      const src = join(hooksSrc, hookFile);
-      const dst = join(hooksDst2, hookFile);
-      copyFileSync(src, dst);
-      try { chmodSync(dst, 0o755); } catch { /* best-effort */ }
+    const hooksDst = join(CLAUDE_DIR, 'hooks');
+    ensureDir(hooksDst);
+    for (const entry of readdirSync(hooksSrc, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      copyFileSync(join(hooksSrc, entry.name), join(hooksDst, entry.name));
+      try { chmodSync(join(hooksDst, entry.name), 0o755); } catch { /* ignore */ }
     }
-
-    counts.hooks = hookFiles.length;
+    counts.hooks = readdirSync(hooksSrc, { withFileTypes: true }).filter(e => e.isFile()).length;
   }
 
-  // ── Rules ────────────────────────────────────────────────────
-  // Cline reads every `.md` and `.txt` file in `~/.cline/rules/` as a
-  // rule (https://docs.cline.bot/customization/cline-rules). The Bizar
-  // harness ships 7 always-on rule files in `config/rules/` (general,
-  // git, javascript, python, testing, thinking, uncertainty). Copying
-  // them here means `bizar install` and `bizar update` actually wire up
-  // the always-on rules contract; before this change the directory
-  // existed but was empty on a fresh install.
+  // Rules
   const rulesSrc = join(REPO_ROOT, 'config', 'rules');
   if (existsSync(rulesSrc)) {
     const rulesDst = join(CLAUDE_DIR, 'rules');
-    mkdirSync(rulesDst, { recursive: true });
+    ensureDir(rulesDst);
     let ruleCount = 0;
     for (const entry of readdirSync(rulesSrc, { withFileTypes: true })) {
       if (!entry.isFile()) continue;
-      const name = entry.name;
-      if (!name.endsWith('.md') && !name.endsWith('.txt')) continue;
-      const src = join(rulesSrc, name);
-      const dst = join(rulesDst, name);
-      copyFileSync(src, dst);
-      ruleCount += 1;
+      if (!entry.name.endsWith('.md') && !entry.name.endsWith('.txt')) continue;
+      copyFileSync(join(rulesSrc, entry.name), join(rulesDst, entry.name));
+      ruleCount++;
     }
     counts.rules = ruleCount;
   }
 
-  // ── Workflows ────────────────────────────────────────────────
+  // Workflows
   const workflowsSrc = join(REPO_ROOT, 'config', 'workflows');
   if (existsSync(workflowsSrc)) {
     const workflowsDst = join(CLAUDE_DIR, 'workflows');
-    mkdirSync(workflowsDst, { recursive: true });
     await copyDirIfExists(workflowsSrc, workflowsDst);
     counts.workflows = 1;
   }
 
-  // ── Legacy `skill/`, `skills/` (flat) ───────────────────────
-  // Old versions of this function flattened all skills into one dir.
-  // That caused collisions (each skill wrote SKILL.md at the same
-  // path). Clean up those legacy flat dirs so users on older installs
-  // don't keep seeing the wrong skill.
-  for (const legacy of ['skill']) {
-    const p = join(CLAUDE_DIR, legacy);
-    if (existsSync(p)) {
-      // Only remove if it's flat (no subdirs). Real skill dirs under
-      // skills/<name>/SKILL.md live in `skills/`, not `skill/`.
-      const entries = readdirSync(p, { withFileTypes: true });
-      const onlyFiles = entries.every((e) => e.isFile());
-      if (onlyFiles) {
-        rmSync(p, { recursive: true, force: true });
-      }
-    }
-  }
-
-  return {
-    ok: true,
-    message:
-      `commands + skills + hooks + rules + workflows synced ` +
-      `(${counts.commands} commands, ${counts.skills} skills, ` +
-      `${counts.hooks} hooks, ${counts.rules} rules, ` +
-      `${counts.workflows} workflows)`,
-    counts,
-  };
+  return { ok: true, message: `synced (${counts.commands} commands, ${counts.skills} skills, ${counts.hooks} hooks, ${counts.rules} rules, ${counts.workflows} workflows)`, counts };
 }
 
-/**
- * Run the system-deps + service-registration steps. These are shell-only
- * (need sudo + platform package manager). We shell to the bundled
- * install.sh which knows the platform.
- */
-export async function ensureSystemDeps({ dryRun, mode }) {
-  const installSh = join(REPO_ROOT, 'install.sh');
-  if (!existsSync(installSh)) {
-    return {
-      ok: true,
-      message: `install.sh not found at ${installSh} — skipping system deps`,
-    };
-  }
-
-  if (dryRun) {
-    return { ok: true, message: '[dry-run] would shell to install.sh for system deps' };
-  }
+// ─── CLI entry ──────────────────────────────────────────────────────────────
 
-  const useBash = process.platform !== 'win32' || process.env.WSL_DISTRO_NAME;
-  if (useBash) {
-    // install.sh accepts --mode and a few other flags. Pass --mode
-    // through so the bash script can skip what we already did in JS.
-    const args = [installSh, '--mode', mode, '--non-interactive'];
-    const r = spawnSync('bash', args, { stdio: 'inherit' });
-    if (r.status !== 0) {
-      return { ok: false, message: `install.sh exited with code ${r.status}` };
+function parseFlags(argv) {
+  const opts = { mode: 'install', dryRun: false, force: false, yes: false, start: true, update: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--mode=install') opts.mode = 'install';
+    else if (a === '--mode=update') opts.mode = 'update';
+    else if (a === '--mode=install-only-system') opts.mode = 'install-only-system';
+    else if (a === '--mode') {
+      const v = argv[++i];
+      if (v === 'install' || v === 'update' || v === 'install-only-system') opts.mode = v;
+    } else if (a === '--dry-run') opts.dryRun = true;
+    else if (a === '--force') opts.force = true;
+    else if (a === '--yes' || a === '-y') opts.yes = true;
+    else if (a === '--non-interactive') opts.yes = true;
+    else if (a === '--no-service') opts.start = false;
+    else if (a === '--update') opts.mode = 'update';
+    else if (a === '--help' || a === '-h') {
+      console.log('Usage: node cli/provision.mjs [--mode=install|update|install-only-system]\n       [--dry-run] [--force] [--yes] [--non-interactive] [--no-service]');
+      process.exit(0);
     }
-    return { ok: true, message: 'install.sh completed' };
   }
-
-  // Windows without WSL — bash isn't available. The user can install
-  // system deps manually (Windows doesn't need apt/dnf for Node tooling).
-  return {
-    ok: true,
-    message: 'Windows without WSL: skipping system deps (none required for Node tooling)',
-  };
+  if (opts.mode === 'update') opts.update = true;
+  return opts;
 }
 
-/**
- * Run `bizar doctor` to verify the install.
- */
-export async function runDoctor({ silent = false } = {}) {
-  try {
-    const { runDoctor: doctorFn } = await import('./doctor.mjs');
-    const result = await doctorFn({ silent });
-    return result;
-  } catch (err) {
-    return {
-      ok: false,
-      failed: 1,
-      results: [{ name: 'doctor', ok: false, message: err.message }],
-    };
-  }
-}
-
-/**
- * Run the post-install smoke test.
- */
-export async function runSmokeTest({ silent = false } = {}) {
-  try {
-    const { runSmokeTest: smokeFn } = await import('./post-install-smoke.mjs');
-    const result = await smokeFn();
-    return result;
-  } catch (err) {
-    return {
-      ok: false,
-      checks: [{ name: 'smoke-test', ok: false, message: err.message }],
-      passed: 0,
-      failed: 1,
-    };
-  }
-}
-
-/**
- * v5.x — Install LightRAG via uv tool.
- * Called from the provisioner in case the shell script (install.sh)
- * was skipped (e.g. Windows without WSL). Idempotent — safe to re-run.
- * Fails gracefully if uv is not available.
- */
-export async function installLightragProvision({ dryRun = false } = {}) {
-  if (dryRun) {
-    return { ok: true, message: '[dry-run] would run: uv tool install "lightrag-hku[api]"' };
-  }
-  // Check if already installed
-  if (haveCmd('lightrag-server')) {
-    return { ok: true, message: 'lightrag-server already on PATH' };
-  }
-  if (!haveCmd('uv')) {
-    return { ok: false, message: 'uv not found — LightRAG not installed (install uv to enable)' };
-  }
-  try {
-    const r = spawnSync('uv', ['tool', 'install', 'lightrag-hku[api]'], {
-      stdio: 'inherit',
-      timeout: 120_000,
-    });
-    if (r.status === 0 || r.status === null) {
-      return { ok: true, message: 'lightrag-hku[api] installed via uv' };
-    }
-    return { ok: false, message: `uv tool install failed (exit ${r.status})` };
-  } catch (err) {
-    return { ok: false, message: `lightrag install error: ${err.message}` };
-  }
-}
-
-/**
- * v6.0.0 — Ensure `agent-browser` (native Rust CLI from vercel-labs) is
- * installed and the daemon is up. agent-browser replaces the v5.x
- * `browser-harness` (Python CDP wrapper). The CLI is installed via
- * `npm install -g agent-browser`; Chrome for Testing is downloaded by
- * `agent-browser install`; the daemon is started by
- * `agent-browser serve --headless --port <port> --profile <dir>`.
- *
- * Idempotent. Returns { ok, message, version?, daemonRunning? }.
- */
-export async function ensureAgentBrowser({ dryRun = false, mode = 'install' } = {}) {
-  const ab = await import('./agent-browser-update.mjs');
-  const before = ab.detectState();
-  if (dryRun) {
-    return {
-      ok: true,
-      message: `[dry-run] agent-browser: ${before.installed ? 'installed' : 'not installed'}` +
-               (before.installed ? ` (v${before.version})` : ''),
-      version: before.version,
-      daemonRunning: before.daemonRunning,
-    };
-  }
-  try {
-    const after = mode === 'update' && before.installed
-      ? ab.update({ silent: true, startDaemon: true })
-      : ab.install({ silent: true, startDaemon: true });
-    return {
-      ok: true,
-      message: `agent-browser: ${after.installed ? `v${after.version}` : 'install attempted'}` +
-               ` · daemon: ${after.daemonRunning ? 'running' : 'stopped'}`,
-      version: after.version,
-      daemonRunning: after.daemonRunning,
-    };
-  } catch (err) {
-    return { ok: false, message: `agent-browser install failed: ${err.message}` };
-  }
-}
-
-/**
- * v4.4.11 — The mods step. By default, NEVER install or upgrade mods
- * during `bizar install` or `bizar update`. The step just reports the
- * current mod list so the user can see what's installed.
- *
- * To install a mod as part of the run, the user must opt in by:
- *   - passing `--with-mods <id1,id2>` to `bizar install` / `bizar update`
- *   - or setting the env var `BIZAR_MODS_AUTO_INSTALL=allow`
- *
- * When opted in, we shell to the running dashboard's `/api/mods`
- * endpoint (which already validates the mod) — we don't duplicate the
- * install logic here.
- */
-export async function runModsStep({ mode, dryRun, force, withMods, state }) {
-  // List the current mods (from the state we already detected).
-  const installed = state?.installedMods ?? [];
-  if (installed.length === 0) {
-    console.log(chalk.dim('  Mods: 0 installed.'));
-    return { ok: true, message: 'no mods installed', touched: false };
-  }
-
-  const enabled = installed.filter((m) => m.enabled).length;
-  const disabled = installed.length - enabled;
-  const summary = `${installed.length} installed (${enabled} enabled${disabled ? `, ${disabled} disabled` : ''})`;
-
-  // Resolve which mods the user asked us to install. The CLI parses
-  // `--with-mods a,b,c` into a string array; the provisioner accepts
-  // the same. We also accept a single env var as a comma-separated list.
-  const envList = (process.env.BIZAR_MODS_AUTO_INSTALL || '')
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean);
-  const wantedMods = Array.isArray(withMods) && withMods.length > 0
-    ? withMods
-    : (process.env.BIZAR_MODS_AUTO_INSTALL === 'allow' ? [] : envList);
-
-  // Default behavior: no install. Just print the list.
-  if (!wantedMods || wantedMods.length === 0) {
-    console.log(chalk.dim(`  Mods: ${summary}. Not modified (use \`bizar mod install <id>\` to add one).`));
-    // Surface mods with errors so the user knows they need attention.
-    const broken = installed.filter((m) => m.error);
-    for (const m of broken) {
-      console.log(chalk.yellow(`    ⚠ ${m.id}: ${m.error}`));
-    }
-    return { ok: true, message: `${summary}, not modified`, touched: false };
-  }
-
-  // Opt-in install path. Talk to the dashboard over HTTP — the
-  // dashboard's `POST /api/mods` endpoint already does the actual
-  // install + validation. If the dashboard isn't reachable, the
-  // install fails loudly.
-  console.log(chalk.cyan(`  Installing ${wantedMods.length} mod(s) via dashboard API: ${wantedMods.join(', ')}`));
-  const errors = [];
-  for (const id of wantedMods) {
-    try {
-      const result = await installModViaDashboard(id, { dryRun });
-      if (result.ok) {
-        console.log(chalk.green(`    ✓ ${id}: ${result.message}`));
-      } else {
-        console.log(chalk.red(`    ✗ ${id}: ${result.message}`));
-        errors.push(`${id}: ${result.message}`);
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.log(chalk.red(`    ✗ ${id}: ${msg}`));
-      errors.push(`${id}: ${msg}`);
-    }
-  }
-  if (errors.length > 0) {
-    return {
-      ok: false,
-      message: `mod install failed for ${errors.length} mod(s): ${errors.join('; ')}`,
-      touched: true,
-    };
-  }
-  return { ok: true, message: `${wantedMods.length} mod(s) installed`, touched: true };
-}
-
-/**
- * v4.4.11 — POST to the dashboard's /api/mods endpoint to install a mod.
- * We re-use the dashboard's own validation pipeline (mod-loader.mjs
- * runs the same manifest + route.mjs + permissions checks) so we
- * don't have to duplicate them here.
- */
-async function installModViaDashboard(id, { dryRun }) {
-  if (dryRun) {
-    return { ok: true, message: '[dry-run] would install via dashboard' };
-  }
-  // Find the dashboard's port from BIZAR_HOME/dashboard.port.
-  const portFile = join(BIZAR_HOME, 'dashboard.port');
-  let port = 4321;
-  try {
-    if (existsSync(portFile)) {
-      const parsed = parseInt(readTextSafe(portFile, '4321').trim(), 10);
-      if (Number.isFinite(parsed) && parsed > 0) port = parsed;
-    }
-  } catch { /* ignore */ }
-  // We need an auth token. The dashboard's install endpoint is under
-  // /api/* which is auth-gated. Fetch the auth status + token via
-  // /api/auth/status (skipped from auth via the skipPaths list in
-  // server.mjs). If the dashboard has auth enabled, the user needs to
-  // supply a token via BIZAR_DASHBOARD_TOKEN.
-  const headers = { 'content-type': 'application/json' };
-  const token = process.env.BIZAR_DASHBOARD_TOKEN;
-  if (token) headers['authorization'] = `Basic ${Buffer.from(`cline:${token}`).toString('base64')}`;
-  const url = `http://127.0.0.1:${port}/api/mods`;
-  const res = await fetch(url, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({ id }),
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const opts = parseFlags(process.argv.slice(2));
+  runProvision(opts).catch((err) => {
+    logErr(`provision failed: ${err?.message || err}`);
+    process.exit(1);
   });
-  if (!res.ok) {
-    const text = await res.text().catch(() => '');
-    return { ok: false, message: `dashboard returned ${res.status}: ${text.slice(0, 200) || '(no body)'}` };
-  }
-  const data = await res.json().catch(() => ({}));
-  return { ok: true, message: data?.name ? `installed ${data.name}@${data.version}` : 'installed' };
-}
-
-// ─── Top-level orchestration ──────────────────────────────────────────────────
-
-/**
- * Kill running Bizar instances before mutating npm-global files. Returns
- * the kill results so the caller can report them.
- */
-export async function ensureInstancesKilled({ dryRun, force, instances }) {
-  const live = instances ?? detectInstances();
-  const running = [];
-  if (live.service?.running) running.push({ kind: 'service', pid: live.service.pid });
-  if (live.dashboard?.running) running.push({ kind: 'dashboard', pid: live.dashboard.pid });
-
-  if (running.length === 0) {
-    return { killed: [], skipped: [] };
-  }
-
-  if (dryRun) {
-    return {
-      killed: running.map((r) => ({ ...r, ok: true, dryRun: true })),
-      skipped: [],
-    };
-  }
-
-  // Always kill (the npm update will replace on-disk files; running
-  // processes have those files open). `--force` skips the prompt.
-  // We don't prompt here — the caller (runProvision) is expected to
-  // confirm before calling this function. If we ever want to make
-  // it interactive, plumb `assumeYes` through here.
-  void force;
-  const killed = [];
-  for (const r of running) {
-    const label = r.kind === 'service' ? 'bizar service' : 'bizar-dash';
-    const ok = await killAndWait(r.pid, { label });
-    killed.push({ ...r, ok });
-    if (ok) {
-      try { rmSync(r.kind === 'service' ? SERVICE_PID_FILE : DASHBOARD_PID_FILE, { force: true }); } catch { /* ignore */ }
-      if (r.kind === 'dashboard') {
-        try { rmSync(DASHBOARD_PORT_FILE, { force: true }); } catch { /* ignore */ }
-      }
-    }
-  }
-  return { killed, skipped: [] };
 }
-
-/**
- * Spawn a fresh dashboard detached. Used at the end of an `update` flow
- * to pick up the just-upgraded code.
- */
-export function spawnFreshDashboard({ port } = {}) {
-  const state = detectState();
-  if (!state.pkgRoot) {
-    return { ok: false, message: 'could not locate npm global root' };
-  }
-  const dashBin = join(state.pkgRoot, 'cli', 'bin.mjs');
-  if (!existsSync(dashBin)) {
-    return { ok: false, message: `dashboard binary not found at ${dashBin}` };
-  }
-  try {
-    mkdirSync(BIZAR_HOME, { recursive: true });
-  } catch { /* ignore */ }
-  const args = [dashBin, 'start', '--bg'];
-  if (port) args.push(`--port=${port}`);
-  try {
-    const child = spawn(process.execPath, args, {
-      detached: true,
-      stdio: 'ignore',
-      env: { ...process.env, BIZAR_AUTO_RESPAWN: '1' },
-    });
-    child.on('error', () => { /* ignore */ });
-    child.unref();
-    return { ok: true, message: `dashboard re-spawned (pid ${child.pid})` };
-  } catch (err) {
-    return { ok: false, message: `dashboard re-spawn failed: ${err.message}` };
-  }
-}
-
-/**
- * The unified provision flow. `mode` is 'install' or 'update'.
- *
- * Steps performed:
- *   1. Detect state (no side effects).
- *   2. (update only) Show installed-vs-latest version matrix.
- *   3. (update only) Heads-up gate.
- *   4. Kill running instances (update only — installs have none).
- *   5. Upgrade npm packages (bizar + cline).
- *   6. Shell to install.sh for system-deps + service registration.
- *   7. Sync agent files, slash commands, skills, hooks, workflows.
- *   8. Copy plugin to ${CLAUDE_DIR}/plugins/bizar/.
- *   9. Patch cline.json with the Bizar plugin entry.
- *  10. (update only) Restart dashboard.
- *  11. Doctor health check.
- *  12. Summary.
- *
- * Every step is idempotent — running this twice is safe.
- */
-export async function runProvision(opts = {}) {
-  const {
-    mode = 'install',
-    dryRun = false,
-    force = false,
-    restart = mode === 'update',
-    skipSystemDeps = false,
-    skipHeadsUps = false,
-    yes = false,
-    withMods = null,  // string[] — opt-in mod install. Default null = don't touch mods.
-  } = opts;
-
-  const banner = mode === 'update'
-    ? chalk.bold.hex('#a855f7')('\n  ᚦ BIZAR UPDATE ᚦ\n')
-    : chalk.bold.hex('#6366f1')('\n  ⚡ BIZAR INSTALL ᚦ\n');
-  console.log(banner);
-  if (dryRun) {
-    console.log(chalk.dim('  --dry-run set: no installs, kills, or restarts will be performed.\n'));
-  }
-
-  // ── 0.5. Idempotency: detect existing install ─────────────────────────
-  // v5.x — If a marker file exists and we're in 'install' mode (not 'update'),
-  // treat this as a re-install. In non-interactive mode, auto-upgrade.
-  // In interactive mode, prompt the user.
-  const marker = readInstallMarker();
-  if (mode === 'install' && marker && !dryRun) {
-    if (yes) {
-      // Non-interactive: auto-switch to update mode
-      console.log(chalk.yellow('  ⚠ Existing install detected (marker found).'));
-      console.log(chalk.yellow('  Auto-switching to update mode due to --yes flag.'));
-      console.log('');
-      // Re-call runProvision with update mode
-      return runProvision({ ...opts, mode: 'update' });
-    } else {
-      // Interactive: warn and continue
-      console.log(chalk.yellow('  ⚠ Existing install detected (marker found at ~/.config/bizar/installed.json).'));
-      console.log(chalk.yellow(`    Last installed: ${marker.installedAt || 'unknown'}`));
-      console.log(chalk.yellow('    To update an existing install, use `bizar update` or re-run with --update.'));
-      console.log('');
-    }
-  }
-
-  // ── 1. Detect state ──────────────────────────────────────────────────
-  const state = detectState();
-
-  // ── 2. (update) Version matrix ───────────────────────────────────────
-  if (mode === 'update') {
-    console.log('  Installed vs. latest:');
-    printVersionMatrix([
-      {
-        label: '@anthropic-ai/claude-code',
-        current: state.claudeCli.version,
-        latest: state.claudeCli.latest,
-      },
-      { label: PKG_MAIN, current: state.pkgVersion, latest: state.pkgLatest },
-    ]);
-    console.log('');
-  }
-
-  // ── 3. (update) Heads-up gate ────────────────────────────────────────
-  if (mode === 'update' && !skipHeadsUps) {
-    const h = state.headsUpState;
-    if (h.blockerCount > 0) {
-      if (dryRun) {
-        console.log(chalk.yellow(`  Dry-run: ${h.blockerCount} active blocker(s) — update would be blocked.`));
-      } else if (yes || force) {
-        console.log(chalk.yellow(`  ⚠ ${h.blockerCount} active blocker(s) present — proceeding due to ${yes ? '--yes' : '--force'}.`));
-      } else {
-        console.error(chalk.red(`  ✗ ${h.blockerCount} active blocker(s) in .bizar/PRE_PUSH_NOTES.md`));
-        console.error(chalk.dim('    Archive with `bizar heads-up archive` or override with --force.'));
-        process.exit(1);
-      }
-    } else if (h.warningCount > 0) {
-      console.log(chalk.yellow(`  ⚠ ${h.warningCount} warning(s) in active heads-ups.`));
-    } else {
-      console.log(chalk.green('  ✓ Heads-ups: clear'));
-    }
-    console.log('');
-  }
-
-  // ── 4. Kill running instances (update only) ─────────────────────────
-  if (mode === 'update') {
-    const kill = await ensureInstancesKilled({ dryRun, force, instances: {
-      service: state.service.running ? { pid: state.service.pid } : null,
-      dashboard: state.dashboard.running ? { pid: state.dashboard.pid } : null,
-    } });
-    if (kill.killed.length > 0) {
-      const labels = kill.killed.map((k) => `${k.kind}${dryRun ? ' (dry-run)' : ''}`).join(', ');
-      console.log(chalk.yellow(`  ⚠ Stopped running instances: ${labels}`));
-      for (const k of kill.killed) {
-        const marker = k.ok ? chalk.green('✓') : chalk.red('✗');
-        console.log(`    ${marker} ${k.kind} ${k.ok ? 'stopped' : 'kill failed'}`);
-      }
-      // Give the kernel a moment to release file handles.
-      if (!dryRun) await new Promise((r) => setTimeout(r, 500));
-    } else {
-      console.log(chalk.dim('  No running Bizar instances detected.'));
-    }
-    console.log('');
-  }
-
-  // ── 5. npm package upgrades ─────────────────────────────────────────
-  const stepResults = [];
-  const runStep = async (label, fn) => {
-    console.log(chalk.bold(`  → ${label}`));
-    const r = await fn();
-    console.log(`    ${r.ok ? chalk.green('✓') : chalk.red('✗')} ${r.message}`);
-    stepResults.push({ label, ...r });
-    return r;
-  };
-
-  if (mode === 'update') {
-    await runStep('@anthropic-ai/claude-code', () =>
-      updateClaudeCodeCli({ dryRun, force }),
-    );
-  }
-  await runStep(PKG_MAIN, () => ensureNpmPackage(PKG_MAIN, { mode, dryRun, force }));
-
-  // ── 6. System deps + service registration (shell) ──────────────────
-  if (!skipSystemDeps) {
-    console.log('');
-    await runStep('system-deps + service', () => ensureSystemDeps({ dryRun, mode }));
-  }
-
-  // ── 6.5. LightRAG install (Node-side, in case shell script skipped) ─
-  await runStep('lightrag-server', () => installLightragProvision({ dryRun }));
-
-  // ── 7-9. Sync agent files, commands, skills, plugin, settings.json ─
-  console.log('');
-  await runStep('agent files + slash commands + skills', () =>
-    Promise.all([
-      syncAgentFiles({ dryRun, force }),
-      syncConfigExtras({ dryRun }),
-    ]).then((results) => {
-      const allOk = results.every((r) => r.ok);
-      const msgs = results.map((r) => r.message).join('; ');
-      return { ok: allOk, message: msgs || 'synced' };
-    }),
-  );
-  await runStep('settings.json Bizar entry', () =>
-    patchClaudeSettings({ dryRun, force }),
-  );
-
-  // ── 9.5. v5.x — issue #7. Restart the system service so it picks up
-  // the freshly-installed binary. We do this AFTER the npm upgrade
-  // (so the new code is on disk) and AFTER the file sync (so the
-  // service won't try to read stale files on boot). The service has
-  // already been killed in step 4 (mode==='update' branch).
-  // This is also called on first install: if the service was registered
-  // before the npm upgrade, restart is a no-op (unit content matches
-  // and the service is already running with the old code).
-  if (mode === 'update' && !dryRun) {
-    try {
-      const { restartService } = await import('./service-controller.mjs');
-      const restart = restartService({ force: false, dryRun: false });
-      if (restart.ok) {
-        console.log(chalk.green('  ✓ Background service restarted with new code.'));
-        stepResults.push({ label: 'service-restart', ok: true, message: 'restarted' });
-      } else {
-        // Non-fatal: the service may have been killed but failed to
-        // restart, or it may not have been installed. The OS will
-        // attempt to start it on next login either way.
-        console.log(chalk.yellow(`  ⚠ Service restart: ${restart.error || 'unknown'}`));
-        stepResults.push({ label: 'service-restart', ok: false, message: restart.error || 'restart failed' });
-      }
-    } catch (err) {
-      console.log(chalk.yellow(`  ⚠ Service restart skipped: ${err?.message || err}`));
-      stepResults.push({ label: 'service-restart', ok: false, message: err?.message || 'skipped' });
-    }
-  }
-
-  // ── 10. (update) Restart dashboard ──────────────────────────────────
-  if (mode === 'update' && restart && state.dashboard.running) {
-    console.log('');
-    console.log(chalk.cyan('  Restarting dashboard with the new code...'));
-    const r = spawnFreshDashboard({ port: state.dashboard.port });
-    console.log(`    ${r.ok ? chalk.green('✓') : chalk.yellow('⚠')} ${r.message}`);
-    stepResults.push({ label: 'dashboard-restart', ...r });
-  }
-
-  // ── 11. Mods (opt-in only) ─────────────────────────────────────────
-  // v4.4.11 — `bizar install` and `bizar update` never install or
-  // upgrade mods by default. The provisioner reports the current mod
-  // list so the user can see what's installed, then exits the mod step
-  // without touching anything. To install a mod, pass
-  // `--with-mods <id1,id2>` or set `BIZAR_MODS_AUTO_INSTALL=allow`.
-  console.log('');
-  const modsStep = await runModsStep({ mode, dryRun, force, withMods, state });
-  stepResults.push({ label: 'mods', ...modsStep });
-
-  // ── 11.5. Write install marker (v5.x idempotency) ──────────────────
-  if (!dryRun) {
-    const markerWrite = writeInstallMarker({
-      version: state.pkgVersion || null,
-      repoPath: REPO_ROOT,
-      serviceUnit: state.service.unitPath,
-    });
-    if (markerWrite.ok) {
-      console.log(chalk.dim('  ✓ install marker updated'));
-    }
-  }
-
-  // ── 12. Doctor health check ───────────────────────────────────────
-  console.log('');
-  const doctor = await runDoctor({ silent: true });
-  if (doctor.failed > 0) {
-    console.log(chalk.yellow(`  ⚠ Post-${mode} health check found ${doctor.failed} issue(s):`));
-    for (const r of (doctor.results || [])) {
-      if (!r.ok) {
-        console.log(chalk.red(`    ✗ ${r.name}: ${r.message}`));
-      }
-    }
-    console.log(chalk.dim(`  Run \`bizar doctor\` for details.`));
-  } else {
-    console.log(chalk.green('  ✓ Doctor: all checks passed'));
-  }
-
-  // ── 12.5. Smoke test ──────────────────────────────────────────────
-  console.log('');
-  console.log(chalk.bold('  → Smoke test'));
-  const smoke = await runSmokeTest({ silent: false });
-  stepResults.push({ label: 'smoke-test', ok: smoke.ok, message: `${smoke.passed} passed, ${smoke.failed} failed` });
-
-  // ── 12. Summary ─────────────────────────────────────────────────────
-  console.log('');
-  console.log('  Summary:');
-  for (const r of stepResults) {
-    const marker = r.ok ? chalk.green('✓') : chalk.red('✗');
-    console.log(`    ${marker} ${r.label.padEnd(36)} ${r.message}`);
-  }
-
-  const anyFail = stepResults.some((r) => !r.ok);
-  if (anyFail) {
-    console.log(chalk.yellow('\n  Some steps had issues. See messages above.'));
-  } else {
-    console.log(chalk.green(`\n  ✓ ${mode === 'update' ? 'Update' : 'Install'} complete\n`));
-  }
-
-  // ── 13. Provider bootstrap warning ───────────────────────────────
-  // v6.3.0 — The installer no longer configures a provider. The user
-  // must add their own. After a successful install, surface a clear
-  // hint pointing them at Claude Code's settings.json.
-  if (mode === 'install' && !dryRun && !anyFail) {
-    const cfgPath = join(CLAUDE_DIR, 'settings.json');
-    const cfg = readJsonSafe(cfgPath, null);
-    // Claude Code doesn't have a "provider" config block; providers
-    // are configured in `env` (per-session overrides) or via the
-    // `claude` CLI's `/config` command. We only check for the env
-    // presence here.
-    const hasAnthropicKey = !!process.env.ANTHROPIC_API_KEY;
-    if (!hasAnthropicKey) {
-      console.log(chalk.yellow('  ⚠  No ANTHROPIC_API_KEY in your environment.'));
-      console.log(chalk.yellow('     `bizar install` no longer touches provider config (v6.2.2+).'));
-      console.log(chalk.yellow('     You must set one yourself — see the "Provider setup" section below.'));
-      console.log('');
-      console.log(chalk.cyan('  ┌─ Provider setup ─────────────────────────────────────────────┐'));
-      console.log(chalk.cyan('  │ 1. Export ANTHROPIC_API_KEY in your shell, or:                │'));
-      console.log(chalk.cyan('  │ 2. Run `claude /login` to authenticate via OAuth.             │'));
-      console.log(chalk.cyan('  │ 3. Or run `bizar connect` for an interactive TUI setup.       │'));
-      console.log(chalk.cyan('  └──────────────────────────────────────────────────────────────┘'));
-      console.log('');
-      console.log(chalk.dim('  Models available at http://localhost:20128/v1/models:'));
-      console.log(chalk.dim('    minimax/MiniMax-M3, minimax/MiniMax-M2.7, nvidia/minimaxai/minimax-m3,'));
-      console.log(chalk.dim('    nvidia/z-ai/glm-5.2, nvidia/deepseek-ai/deepseek-v4-pro, etc.'));
-      console.log('');
-    }
-  }
-
-  return {
-    ok: !anyFail,
-    mode,
-    state,
-    stepResults,
-    doctor,
-  };
-}
-
-/**
- * CLI-flag-parsing entrypoint for `bizar update`. Kept here so that
- * `cli/update.mjs` (the bin.mjs-facing module) can stay a thin shim
- * without duplicating flag parsing. Accepts the legacy `subargs: string[]`
- * shape so any external callers keep working.
- *
- * Recognized flags (v4.4.14):
- *   --check           Only print current vs. latest, don't update.
- *   --channel <name>  npm dist-tag (stable | beta). Default: stable.
- *   --no-restart      Don't auto-restart the dashboard after update.
- *   --dry-run         Print what would happen, change nothing.
- *   --force           Override .bizar/PRE_PUSH_NOTES.md blockers.
- *   --yes / -y        Same as --force, but named for one-line scripts.
- *   --with-mods <csv> Opt-in: install specific mods as part of the run.
- *
- * With --check, we print the version matrix and release notes between
- * current and latest, then return without touching the system.
- */
-export async function runUpdate(subargs = []) {
-  const args = Array.isArray(subargs) ? subargs : [];
-  const checkOnly = args.includes('--check');
-
-  // --channel <name> — extract a single value. Accepts both
-  //   --channel=beta     (equals form)
-  //   --channel beta     (separate-arg form)
-  // Default: 'stable'.
-  let channel = 'stable';
-  const eqArg = args.find((a) => a.startsWith('--channel='));
-  if (eqArg) {
-    const value = eqArg.slice('--channel='.length);
-    if (value === 'stable' || value === 'beta') {
-      channel = value;
-    } else {
-      console.log(chalk.yellow(`  ⚠ Unknown channel "${value}". Using "stable".`));
-    }
-  } else {
-    const channelIdx = args.indexOf('--channel');
-    if (channelIdx >= 0) {
-      const value = args[channelIdx + 1];
-      if (!value || value.startsWith('--')) {
-        console.log(chalk.yellow('  ⚠ --channel needs a value (stable | beta). Using "stable".'));
-      } else if (value !== 'stable' && value !== 'beta') {
-        console.log(chalk.yellow(`  ⚠ Unknown channel "${value}". Using "stable".`));
-      } else {
-        channel = value;
-      }
-    }
-  }
-
-  if (checkOnly) {
-    return runCheck(channel);
-  }
-
-  // Pass channel through to the provisioner. The provisioner does the
-  // actual npm install; channel maps to the npm dist-tag suffix.
-  return runProvision({
-    mode: 'update',
-    dryRun: args.includes('--dry-run'),
-    force: args.includes('--force'),
-    yes: args.includes('--yes') || args.includes('-y'),
-    restart: !args.includes('--no-restart'),
-    channel,
-  });
-}
-
-/**
- * v4.4.14 — `bizar update --check`. Print the version matrix and (if
- * a newer version exists) the release notes between current and latest.
- * Does NOT touch the system. Exits non-zero when an update is available
- * so callers can use it in CI / pre-flight scripts.
- */
-export async function runCheck(channel = 'stable') {
-  console.log(chalk.bold.hex('#a855f7')('\n  ᚦ BIZAR UPDATE — CHECK ᚦ\n'));
-  console.log(chalk.dim(`  Channel: ${channel}\n`));
-
-  const state = detectState();
-  printVersionMatrix([
-    {
-      label: '@anthropic-ai/claude-code',
-      current: state.claudeCli.version,
-      latest: state.claudeCli.latest,
-    },
-    { label: PKG_MAIN, current: state.pkgVersion, latest: state.pkgLatest },
-  ]);
-
-  const cur = state.pkgVersion;
-  const lat = state.pkgLatest;
-  if (cur && lat && cur !== lat) {
-    console.log(chalk.dim(`\n  Release notes (${cur} → ${lat}):`));
-    const notes = fetchReleaseNotes(PKG_MAIN, cur, lat).catch((err) => {
-      console.log(chalk.dim(`    (could not fetch: ${err.message || err})`));
-      return null;
-    });
-    const text = await notes;
-    if (text) {
-      // Trim to a sensible cap (first 30 lines) so the console stays
-      // readable; the full notes are one `npm view` call away.
-      const lines = text.split(/\r?\n/).slice(0, 30);
-      for (const line of lines) console.log(`    ${line}`);
-      if (lines.length === 30) console.log(chalk.dim('    ... (truncated; run `npm view @polderlabs/bizar` for full)'));
-    }
-    console.log(chalk.yellow(`\n  ⤵ Run \`bizar update\` to apply.\n`));
-    // Non-zero exit so scripts can detect the update-available case.
-    return { ok: true, updateAvailable: true, channel };
-  }
-
-  console.log(chalk.green('\n  ✓ Already on the latest version.\n'));
-  return { ok: true, updateAvailable: false, channel };
-}
-
-/**
- * Fetch the release notes between two versions from the npm registry.
- * Returns a plain-text summary (the registry's "description" field for
- * the latest version), or null on any failure. Never throws — failures
- * are surfaced to the caller as null so the check command stays useful
- * offline.
- */
-async function fetchReleaseNotes(pkg, _from, _to) {
-  // The npm registry does not expose a structured per-version release-
-  // notes field. The best we can do is `npm view <pkg> description`
-  // which is the package's README excerpt. We surface that as "notes".
-  try {
-    const { execFileSync } = await import('node:child_process');
-    const out = execFileSync('npm', ['view', pkg, 'description'], {
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 10000,
-      encoding: 'utf8',
-    }).toString().trim();
-    return out || null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * CLI-flag-parsing entrypoint for `bizar install`. Mirrors `runUpdate`
- * so `cli/install.mjs` can stay a thin shim too.
- */
-export async function runInstallerCli(opts = []) {
-  const subargs = Array.isArray(opts) ? opts : [];
-  return runProvision({
-    mode: 'install',
-    dryRun: subargs.includes('--dry-run'),
-    force: subargs.includes('--force'),
-    yes: subargs.includes('--yes') || subargs.includes('-y'),
-  });
-}