@quireco/cli 0.0.11 → 0.0.13

package/dist/{cli-CIBEsC75.mjs → cli-DIvpEXlX.mjs}

@@ -8,10 +8,10 @@ import { exec, execFile, execFileSync, spawn } from "node:child_process";
 import pc from "picocolors";
 import { calculateCost, createAssistantMessageEventStream } from "@earendil-works/pi-ai";
 import { convertMessages } from "@earendil-works/pi-ai/openai-completions";
-import { access, constants, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { access, constants, mkdir, mkdtemp, readFile, readdir, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { homedir, networkInterfaces, tmpdir } from "node:os";
-import { closeSync, constants as constants$1, copyFileSync, existsSync, fstatSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { closeSync, constants as constants$1, copyFileSync, existsSync, fstatSync, fsyncSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { customAlphabet } from "nanoid";
 import { Type } from "@sinclair/typebox";
@@ -671,8 +671,17 @@ async function createInvestigationModelSessionDependencies({ runId, store = auth
 		fetchFn
 	});
 }
-async function createLocalModelSessionDependencies(localAuthStorage) {
-	const localRegistries = (localAuthStorage === void 0 ? [AuthStorage.create(readQuireModelAuthPath()), AuthStorage.create()] : [localAuthStorage]).map((authStorage) => ({
+async function detectLocalInvestigationModelSource(options = {}) {
+	const localModel = await createLocalModelSessionDependencies(options.localAuthStorage, options.env);
+	if (localModel === null || localModel.source === "quire_credits") return null;
+	return {
+		source: localModel.source,
+		provider: localModel.model.provider,
+		modelId: localModel.model.id
+	};
+}
+async function createLocalModelSessionDependencies(localAuthStorage, env = process.env) {
+	const localRegistries = (localAuthStorage === void 0 ? [AuthStorage.create(readQuireModelAuthPath(env)), AuthStorage.create()] : [localAuthStorage]).map((authStorage) => ({
 		authStorage,
 		modelRegistry: ModelRegistry.create(authStorage)
 	}));
@@ -690,8 +699,8 @@ async function createLocalModelSessionDependencies(localAuthStorage) {
 	}
 	return null;
 }
-function readQuireModelAuthPath() {
-	return defaultModelAuthPath();
+function readQuireModelAuthPath(env = process.env) {
+	return defaultModelAuthPath(env);
 }
 function quireModelDefinition() {
 	return {
@@ -1375,21 +1384,28 @@ const FINDING_RELATIONSHIPS_TO_REQUEST = [
 ];
 function createRunDir(repoPath, options = {}) {
 	const workspaceKey = workspaceKeyForRepoPath(resolve(repoPath));
-	const runsRoot = resolve(options.runsRoot ?? defaultRunsRoot());
-	const { runId, root } = options.runId === void 0 ? createUniqueRunRoot(runsRoot, workspaceKey, options.createRunId ?? createRunId) : {
+	const { runsRoot, runId, root, temporaryRunsRoot } = allocateRunRoot({
+		runsRoot: resolve(options.runsRoot ?? defaultRunsRoot()),
+		workspaceKey,
 		runId: options.runId,
-		root: join(runsRoot, workspaceKey, options.runId)
-	};
-	const paths = runDirPaths(root);
-	mkdirSync(paths.evidence, {
-		recursive: true,
-		mode: 448
+		runIdFactory: options.createRunId ?? createRunId,
+		allowTemporaryFallback: options.runsRoot === void 0 && (process.env.QUIRE_RUNS_DIR?.trim().length ?? 0) === 0
 	});
+	const paths = runDirPaths(root);
+	try {
+		mkdirSync(paths.evidence, {
+			recursive: true,
+			mode: 448
+		});
+	} catch (error) {
+		throw writableRunsRootError(error, runsRoot);
+	}
 	return {
 		runId,
 		workspaceKey,
 		runsRoot,
 		root,
+		...temporaryRunsRoot ? { temporaryRunsRoot: true } : {},
 		paths
 	};
 }
@@ -1416,6 +1432,9 @@ function runPlanPath(runPath) {
 function runHandoffPath(runPath) {
 	return join(resolve(runPath), "handoff.md");
 }
+function runPendingHandoffPath(runPath) {
+	return join(resolve(runPath), ".pending-handoff.json");
+}
 function runDirPaths(root) {
 	const evidence = join(root, "evidence");
 	return {
@@ -1432,6 +1451,51 @@ function runDirPaths(root) {
 		harnessSessions: join(root, ".harness-sessions")
 	};
 }
+function allocateRunRoot(input) {
+	try {
+		return {
+			...createRunRoot(input.runsRoot, input.workspaceKey, input.runId, input.runIdFactory),
+			runsRoot: input.runsRoot,
+			temporaryRunsRoot: false
+		};
+	} catch (error) {
+		if (!isWriteAccessError$2(error)) throw error;
+		if (!input.allowTemporaryFallback) throw writableRunsRootError(error, input.runsRoot);
+		const runsRoot = mkdtempSync(join(tmpdir(), "quire-runs-"));
+		return {
+			...createRunRoot(runsRoot, input.workspaceKey, input.runId, input.runIdFactory),
+			runsRoot,
+			temporaryRunsRoot: true
+		};
+	}
+}
+function createRunRoot(runsRoot, workspaceKey, runId, runIdFactory) {
+	return runId === void 0 ? createUniqueRunRoot(runsRoot, workspaceKey, runIdFactory) : createNamedRunRoot(runsRoot, workspaceKey, runId);
+}
+function createNamedRunRoot(runsRoot, workspaceKey, runId) {
+	const root = join(runsRoot, workspaceKey, runId);
+	mkdirSync(join(root, "evidence"), {
+		recursive: true,
+		mode: 448
+	});
+	return {
+		runId,
+		root
+	};
+}
+function writableRunsRootError(error, runsRoot) {
+	if (!isWriteAccessError$2(error)) return error;
+	return new CliError$1([
+		`Quire could not write run data at ${runsRoot}: ${error.message}`,
+		"In sandboxed coding-agent environments, retry with a temporary run directory:",
+		"  quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)",
+		"  QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json <your request>",
+		"Use the same QUIRE_RUNS_DIR value for follow-up `quire wait`, `quire status`, `quire watch`, or `quire cancel` commands."
+	].join("\n"), ExitCode.InvalidInput);
+}
+function isWriteAccessError$2(error) {
+	return error instanceof Error && "code" in error && (error.code === "EROFS" || error.code === "EACCES" || error.code === "EPERM");
+}
 function defaultRunsRoot(env = process.env) {
 	return defaultRunsRoot$1(env);
 }
@@ -1483,6 +1547,20 @@ function writeRunFinalHandoff(runDir, final) {
 		finalResult: final.result
 	});
 }
+function writeRunPendingHandoff(runDir, handoff) {
+	const writtenAt = (/* @__PURE__ */ new Date()).toISOString();
+	writeFileAtomically(runPendingHandoffPath(runDir.root), `${stableJson({
+		version: 1,
+		writtenAt,
+		handoff
+	})}\n`, 384);
+	writeFileAtomically(runDir.paths.handoff, `${handoff.handoffMarkdown.trimEnd()}\n`, 384);
+}
+function clearRunPendingHandoff(runDir) {
+	try {
+		unlinkSync(runPendingHandoffPath(runDir.root));
+	} catch {}
+}
 function patchRunStatusJson(runDir, patch) {
 	if (!existsSync(runDir.paths.status)) return;
 	let existing;
@@ -1752,18 +1830,32 @@ function readFreshRunStatus(runPath) {
 		if (existsSync(runHandoffPath(runPath))) return updateRunStatus(runPath, { status: "completed" });
 		return updateRunStatus(runPath, {
 			status: "stale",
-			error: "Worker process exited before marking the run as running."
+			error: staleWorkerError(runPath, "Worker process exited before marking the run as running.")
 		});
 	}
 	if ((status.status === "running" || status.status === "canceling") && !isPidAlive(status.pid)) {
 		if (existsSync(runHandoffPath(runPath))) return updateRunStatus(runPath, { status: "completed" });
 		return updateRunStatus(runPath, {
 			status: status.status === "canceling" ? "canceled" : "stale",
-			error: status.status === "canceling" ? void 0 : "Worker process is no longer running."
+			error: status.status === "canceling" ? void 0 : staleWorkerError(runPath, "Worker process is no longer running.")
 		});
 	}
 	return status;
 }
+function staleWorkerError(runPath, message) {
+	const workerLogPath = join(runPath, "worker.log");
+	if (!existsSync(workerLogPath)) return message;
+	const tail = readWorkerLogTail$1(workerLogPath);
+	if (tail.length === 0) return `${message}\n\nWorker log: ${workerLogPath} (empty)`;
+	return `${message}\n\nWorker log: ${workerLogPath}\n\nLast worker output:\n${tail}`;
+}
+function readWorkerLogTail$1(workerLogPath) {
+	try {
+		return readFileSync(workerLogPath, "utf8").slice(-12e3).trim();
+	} catch {
+		return "";
+	}
+}
 function readRequiredRunStatus(runPath) {
 	const status = readRunStatus(runPath);
 	if (status === void 0) throw new CliError$1(`Run status not found: ${runPath}`, ExitCode.InvalidInput);
@@ -1799,10 +1891,27 @@ function writeStatus(filePath, status) {
 		mode: 448
 	});
 	const tempPath = join(dirname(filePath), `.${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.status.tmp`);
-	writeFileSync(tempPath, `${JSON.stringify(status, null, 2)}\n`, { mode: 384 });
-	fsyncFile(tempPath);
-	renameSync(tempPath, filePath);
-	fsyncDirectory(dirname(filePath));
+	try {
+		writeFileSync(tempPath, `${JSON.stringify(status, null, 2)}\n`, { mode: 384 });
+		fsyncFile(tempPath);
+		renameSync(tempPath, filePath);
+		fsyncDirectory(dirname(filePath));
+	} catch (error) {
+		throw writableRunStatusError(error, status.runPath);
+	}
+}
+function writableRunStatusError(error, runPath) {
+	if (!isWriteAccessError$1(error)) return error;
+	return new CliError$1([
+		`Quire could not update run status at ${runPath}: ${error.message}`,
+		"In sandboxed coding-agent environments, put Quire run data in a temporary directory and reuse it for every lifecycle command:",
+		"  quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)",
+		"  QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json <your request>",
+		"  QUIRE_RUNS_DIR=$quire_runs_dir quire wait <run-id> --json"
+	].join("\n"), ExitCode.InvalidInput);
+}
+function isWriteAccessError$1(error) {
+	return error instanceof Error && "code" in error && (error.code === "EROFS" || error.code === "EACCES" || error.code === "EPERM");
 }
 function fsyncFile(filePath) {
 	const file = openSync(filePath, "r");
@@ -2801,6 +2910,7 @@ function materializeHandoff({ handoff, runDir, continuation, modelUsage, metadat
 		result: materializedResult
 	});
 	writeHandoffArtifact(runDir, materializedHandoff);
+	clearRunPendingHandoff(runDir);
 	return {
 		result: materializedResult,
 		metadata: nextMetadata
@@ -45315,6 +45425,23 @@ const writeHandoffToolDefinition = {
 		};
 	}
 };
+function makeWriteHandoffTool(options = {}) {
+	return defineTool({
+		...writeHandoffToolDefinition,
+		async execute(_toolCallId, params, _signal) {
+			const handoff = normalizeWriteHandoffInput(params);
+			await options.onHandoff?.(handoff);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(handoff, null, 2)
+				}],
+				details: handoff,
+				terminate: true
+			};
+		}
+	});
+}
 function normalizeWriteHandoffInput(params) {
 	const { status, ...rest } = params;
 	return {
@@ -45327,7 +45454,7 @@ function normalizeHandoffStatus(status) {
 	if (status === "no_issue_found" || status === "not_a_bug" || status === "verified_no_bug_found" || status === "verified_no_issue_found") return "not_reproduced";
 	return status;
 }
-const writeHandoffTool = defineTool(writeHandoffToolDefinition);
+makeWriteHandoffTool();
 //#endregion
 //#region src/utils/schema.ts
 function stringEnumSchema(values) {
@@ -46153,7 +46280,11 @@ async function runQuireAgent({ intent, runBrief, runInstructions, remoteAddons,
 		followup,
 		skillPack,
 		mcpGateway,
-		intent
+		intent,
+		onHandoff: (handoff) => {
+			emittedHandoff ??= handoff;
+			writeRunPendingHandoff(runDir, handoff);
+		}
 	});
 	const { session, logAgentProgress, registeredTargetTools } = runtime;
 	onResolvedModel?.({
@@ -46161,18 +46292,31 @@ async function runQuireAgent({ intent, runBrief, runInstructions, remoteAddons,
 		provider: runtime.model.provider,
 		modelId: runtime.model.id
 	});
+	let rejectCurrentPromptOnModelError;
 	const unsubscribe = session.subscribe((event) => {
 		touchRunActivity(runDir.root, { minIntervalMs: RUN_ACTIVITY_HEARTBEAT_INTERVAL_MS });
 		logAgentProgress(event);
+		const sessionError = modelErrorFromSessionEvent(event);
+		if (sessionError !== void 0) rejectCurrentPromptOnModelError?.(sessionError);
 		emittedHandoff ??= extractWriteHandoff(event);
 		rememberTargetToolCallArgs(event, registeredTargetTools, targetToolCallArgs);
 		const attemptsObserved = countNewTargetAttempts(event, registeredTargetTools, observedTargetToolCallIds, targetToolCallArgs);
 		if (attemptsObserved > 0) observedToolAttempts += attemptsObserved;
 	});
 	try {
-		await session.prompt(runBrief, { expandPromptTemplates: false });
-		if (emittedHandoff === void 0) await session.prompt(buildMissingRunHandoffPrompt(observedToolAttempts), { expandPromptTemplates: false });
+		try {
+			await promptOrModelError(session.prompt(runBrief, { expandPromptTemplates: false }), (reject) => {
+				rejectCurrentPromptOnModelError = reject;
+			});
+			if (emittedHandoff === void 0) await promptOrModelError(session.prompt(buildMissingRunHandoffPrompt(observedToolAttempts), { expandPromptTemplates: false }), (reject) => {
+				rejectCurrentPromptOnModelError = reject;
+			});
+		} catch (error) {
+			if (emittedHandoff === void 0) throw error;
+			progress?.("Recovered terminal write_handoff after the agent session stopped.");
+		}
 	} finally {
+		rejectCurrentPromptOnModelError = void 0;
 		runtime.writeSessionState();
 		unsubscribe();
 		runtime.dispose();
@@ -46182,7 +46326,23 @@ async function runQuireAgent({ intent, runBrief, runInstructions, remoteAddons,
 		runDir
 	});
 }
-async function createQuireAgentRuntime({ runDir, codebasePath, sessionId, headed, intent, progress, onProgressEvent, runInstructions, remoteAddons, runtimeCapabilities, followup, skillPack, mcpGateway }) {
+async function promptOrModelError(prompt, setRejectCurrentPromptOnModelError) {
+	try {
+		return await Promise.race([prompt, new Promise((_resolve, reject) => {
+			setRejectCurrentPromptOnModelError(reject);
+		})]);
+	} finally {
+		setRejectCurrentPromptOnModelError(void 0);
+	}
+}
+function modelErrorFromSessionEvent(event) {
+	if (!isRecord$14(event) || event.type !== "message" || !isRecord$14(event.message)) return;
+	const message = event.message;
+	if (message.role !== "assistant" || message.stopReason !== "error") return;
+	const errorMessage = typeof message.errorMessage === "string" && message.errorMessage.trim().length > 0 ? message.errorMessage.trim() : "model request failed";
+	return /* @__PURE__ */ new Error(`Quire model request failed: ${errorMessage}`);
+}
+async function createQuireAgentRuntime({ runDir, codebasePath, sessionId, headed, intent, progress, onProgressEvent, runInstructions, remoteAddons, runtimeCapabilities, followup, skillPack, mcpGateway, onHandoff }) {
 	const logAgentProgress = createAgentProgressLogger({
 		runDir,
 		write: progress
@@ -46212,6 +46372,7 @@ async function createQuireAgentRuntime({ runDir, codebasePath, sessionId, headed
 		gateway: mcpGateway,
 		runId: runDir.runId
 	});
+	const writeHandoffTool = makeWriteHandoffTool({ onHandoff });
 	const registeredTargetTools = [...browserTool === void 0 ? [] : [{
 		toolName: "agent-browser",
 		target: "web"
@@ -48183,6 +48344,8 @@ function runPath(runDir) {
 }
 //#endregion
 //#region src/pipeline/background-investigation.ts
+const WORKER_BOOTSTRAP_TIMEOUT_MS = 2e3;
+const WORKER_LOG_FILE = "worker.log";
 async function startInvestigationRun(options) {
 	assertHasInvestigationInput(options.query, options.inputText);
 	const repoPath = resolve(options.cwd ?? process.cwd());
@@ -48238,6 +48401,8 @@ async function startInvestigationRun(options) {
 		runId: runDir.runId,
 		workspaceKey: runDir.workspaceKey,
 		runPath: runDir.root,
+		runsRoot: runDir.runsRoot,
+		temporaryRunsRoot: runDir.temporaryRunsRoot === true,
 		pid: worker.pid
 	});
 }
@@ -48315,6 +48480,8 @@ function workerStartedBrowserSessionIds(runDir) {
 function spawnInvestigationWorker({ runPath }) {
 	const entryPoint = process.argv[1];
 	if (entryPoint === void 0 || entryPoint.length === 0) throw new CliError$1("Unable to locate Quire CLI entrypoint for background worker.", ExitCode.InternalError);
+	const workerLogPath = `${runPath}/${WORKER_LOG_FILE}`;
+	const workerLogFd = openSync(workerLogPath, "a", 384);
 	const child = spawn(process.execPath, [
 		...process.execArgv,
 		entryPoint,
@@ -48327,23 +48494,89 @@ function spawnInvestigationWorker({ runPath }) {
 		env: process.env,
 		stdio: [
 			"ignore",
-			"ignore",
-			"ignore"
+			workerLogFd,
+			workerLogFd
 		]
 	});
-	child.unref();
-	return Promise.resolve({ pid: child.pid });
+	closeSync(workerLogFd);
+	return waitForWorkerBootstrap({
+		child,
+		runPath,
+		workerLogPath
+	}).finally(() => {
+		child.unref();
+	});
+}
+async function waitForWorkerBootstrap({ child, runPath, workerLogPath }) {
+	const exit = new Promise((resolveExit) => {
+		child.once("exit", (code, signal) => resolveExit({
+			code,
+			signal
+		}));
+	});
+	const timeout = new Promise((resolveTimeout) => {
+		setTimeout(() => resolveTimeout("timeout"), WORKER_BOOTSTRAP_TIMEOUT_MS).unref();
+	});
+	const started = waitForRunToLeaveQueued(runPath);
+	const result = await Promise.race([
+		exit,
+		timeout,
+		started.promise
+	]);
+	started.stop();
+	if (result === "started") return { pid: child.pid };
+	const status = readRunStatus(runPath);
+	if (result !== "timeout" && status?.status === "queued") throw new CliError$1(formatEarlyWorkerExitError({
+		workerLogPath,
+		code: result.code,
+		signal: result.signal
+	}), ExitCode.InternalError);
+	return { pid: child.pid };
+}
+function waitForRunToLeaveQueued(runPath) {
+	let stopped = false;
+	return {
+		promise: new Promise((resolveStarted) => {
+			const checkStatus = () => {
+				if (stopped) return;
+				const status = readRunStatus(runPath);
+				if (status !== void 0 && status.status !== "queued") {
+					resolveStarted("started");
+					return;
+				}
+				setTimeout(checkStatus, 25).unref();
+			};
+			checkStatus();
+		}),
+		stop: () => {
+			stopped = true;
+		}
+	};
+}
+function formatEarlyWorkerExitError({ workerLogPath, code, signal }) {
+	const exit = signal === null ? `exit code ${code ?? "unknown"}` : `signal ${signal}`;
+	const tail = readWorkerLogTail(workerLogPath);
+	return `Worker process exited before marking the run as running (${exit}).\n\n${tail.length === 0 ? `Worker log: ${workerLogPath} (empty)` : `Worker log: ${workerLogPath}\n\nLast worker output:\n${tail}`}`;
+}
+function readWorkerLogTail(workerLogPath) {
+	try {
+		return readFileSync(workerLogPath, "utf8").slice(-12e3).trim();
+	} catch {
+		return "";
+	}
 }
 function runHandle(input) {
+	const commandPrefix = input.temporaryRunsRoot ? `QUIRE_RUNS_DIR=${shellQuote(input.runsRoot)} ` : "";
 	return {
 		status: "queued",
 		runId: input.runId,
 		workspaceKey: input.workspaceKey,
 		runPath: toJsonPath(input.runPath),
 		...input.pid === void 0 ? {} : { pid: input.pid },
-		statusCommand: `quire status ${shellQuote(input.runId)} --json`,
-		watchCommand: `quire watch ${shellQuote(input.runId)}`,
-		cancelCommand: `quire cancel ${shellQuote(input.runId)}`
+		statusCommand: `${commandPrefix}quire status ${shellQuote(input.runId)} --json`,
+		waitCommand: `${commandPrefix}quire wait ${shellQuote(input.runId)} --json`,
+		watchCommand: `${commandPrefix}quire watch ${shellQuote(input.runId)}`,
+		cancelCommand: `${commandPrefix}quire cancel ${shellQuote(input.runId)}`
 	};
 }
 function readWorkerRequest(runPath) {
@@ -48528,6 +48761,38 @@ const watchCommand = defineCommand({
 		await watchRun(readRequiredString(args.run, "run"));
 	}
 });
+const waitCommand = defineCommand({
+	meta: {
+		name: "wait",
+		description: "Wait for a Quire investigation run to reach a terminal status."
+	},
+	args: {
+		run: {
+			type: "positional",
+			description: "Run id or run directory.",
+			required: true
+		},
+		json: {
+			type: "boolean",
+			description: "Emit terminal status JSON."
+		},
+		"timeout-ms": {
+			type: "string",
+			description: "Maximum time to wait in milliseconds. Defaults to 600000."
+		},
+		"interval-ms": {
+			type: "string",
+			description: "Polling interval in milliseconds. Defaults to 5000."
+		}
+	},
+	async run({ args }) {
+		await waitRun(readRequiredString(args.run, "run"), {
+			json: args.json === true,
+			timeoutMs: readPositiveIntegerOption(args["timeout-ms"], "--timeout-ms") ?? 6e5,
+			intervalMs: readPositiveIntegerOption(args["interval-ms"], "--interval-ms") ?? 5e3
+		});
+	}
+});
 const cancelCommand = defineCommand({
 	meta: {
 		name: "cancel",
@@ -48653,6 +48918,28 @@ async function watchRun(run, options = {}) {
 		if (sigintHandler !== void 0) process.off("SIGINT", sigintHandler);
 	}
 }
+async function waitRun(run, options = {}) {
+	const stdout = options.io?.stdout ?? process.stdout;
+	const runPath = resolveRunPath(run, options);
+	const sleep = options.sleep ?? defaultSleep$1;
+	const intervalMs = options.intervalMs ?? 5e3;
+	const timeoutMs = options.timeoutMs ?? 6e5;
+	const now = options.now ?? Date.now;
+	const deadline = now() + timeoutMs;
+	while (true) {
+		const status = withSyncStatus(readFreshRunStatus(runPath));
+		if (isTerminalRunStatus(status.status)) {
+			if (options.json === true) writeJson(stdout, status);
+			else {
+				writeLine(stdout, renderFinalStatus(status));
+				writeHandoffSummary(stdout, runDirFromStatus(status).paths.handoff);
+			}
+			return status;
+		}
+		if (now() >= deadline) throw new CliError$1(`Timed out waiting for run ${status.runId} to finish; latest status is ${status.status}. Use \`quire status ${status.runId} --json\` or \`quire watch ${status.runId}\` to inspect progress.`, ExitCode.InvalidInput);
+		await sleep(Math.min(intervalMs, Math.max(0, deadline - now())));
+	}
+}
 async function cancelRun(run, options = {}) {
 	const stdout = options.io?.stdout ?? process.stdout;
 	const runPath = resolveRunPath(run, options);
@@ -48713,9 +49000,15 @@ async function syncRun(run, options = {}) {
 function withSyncStatus(status) {
 	const sync = readInvestigationSyncStatus(runDirFromStatus(status));
 	const { sync: _storedSync, ...baseStatus } = status;
-	return sync === void 0 ? baseStatus : {
+	if (sync === void 0) return baseStatus;
+	return sync.caseUrl === void 0 ? {
 		...baseStatus,
 		sync
+	} : {
+		...baseStatus,
+		sync,
+		webUrl: sync.caseUrl,
+		caseUrl: sync.caseUrl
 	};
 }
 function signalRunProcess(pid, signal) {
@@ -48738,6 +49031,13 @@ function statusColor(status) {
 function formatNumber(value) {
 	return new Intl.NumberFormat("en-US").format(value);
 }
+function readPositiveIntegerOption(value, name) {
+	if (value === void 0 || value === null || value === false) return;
+	if (typeof value !== "string" || value.trim().length === 0) throw new CliError$1(`${name} must be a positive integer.`, ExitCode.InvalidInput);
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed <= 0) throw new CliError$1(`${name} must be a positive integer.`, ExitCode.InvalidInput);
+	return parsed;
+}
 function defaultSleep$1(ms) {
 	return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
@@ -48797,6 +49097,7 @@ const investigationCommandSchema = {
 			"workspaceKey",
 			"runPath",
 			"statusCommand",
+			"waitCommand",
 			"watchCommand",
 			"cancelCommand"
 		],
@@ -48810,6 +49111,7 @@ const investigationCommandSchema = {
 				optional: true
 			},
 			statusCommand: { type: "string" },
+			waitCommand: { type: "string" },
 			watchCommand: { type: "string" },
 			cancelCommand: { type: "string" }
 		}
@@ -48817,6 +49119,7 @@ const investigationCommandSchema = {
 	followUpCommands: {
 		continue: "quire continue <run-id> \"additional context or instruction\"",
 		status: "quire status <run-id> --json",
+		wait: "quire wait <run-id> --json",
 		watch: "quire watch <run-id>",
 		cancel: "quire cancel <run-id>"
 	},
@@ -48851,6 +49154,7 @@ const investigationCommandSchema = {
 		"quire \"verify checkout before I approve this PR\"",
 		"printf 'why is CI failing?\\nRelevant log: ...' | quire run --json",
 		"quire status run_9x4mdq7p2h8kc6nv4apz --json",
+		"quire wait run_9x4mdq7p2h8kc6nv4apz --json",
 		"quire watch run_9x4mdq7p2h8kc6nv4apz"
 	]
 };
@@ -48938,7 +49242,9 @@ async function runInvestigate(options) {
 		});
 		if (options.detach === true) log.message([
 			`${color.label("Run")}: ${color.path(handle.runPath)}`,
+			...handle.webUrl === void 0 ? [] : [`${color.label("Case")}: ${handle.webUrl}`],
 			`${color.label("Status")}: ${color.command(handle.statusCommand)}`,
+			`${color.label("Wait")}: ${color.command(handle.waitCommand)}`,
 			`${color.label("Watch")}: ${color.command(handle.watchCommand)}`,
 			`${color.label("Cancel")}: ${color.command(handle.cancelCommand)}`
 		], {
@@ -48949,15 +49255,16 @@ async function runInvestigate(options) {
 		else log.message([
 			`${color.label("Run")}: ${color.path(handle.runPath)}`,
 			`${color.label("Status")}: ${color.command(handle.statusCommand)}`,
+			`${color.label("Wait")}: ${color.command(handle.waitCommand)}`,
 			`${color.label("Watch")}: ${color.command(handle.watchCommand)}`,
-			`This run continues in the background. You can safely exit; use ${color.command(handle.statusCommand)} for the current state or ${color.command(handle.watchCommand)} to follow progress logs.`
+			`This run continues in the background. You can safely exit; use ${color.command(handle.waitCommand)} for the terminal handoff, ${color.command(handle.statusCommand)} for the current state, or ${color.command(handle.watchCommand)} to follow progress logs.`
 		], {
 			output: stdout,
 			spacing: 0,
 			withGuide: true
 		});
 	}
-	if (options.json !== true && options.detach !== true) await (options.watchRunner ?? watchRun)(handle.runId, {
+	if (options.json !== true && options.detach !== true) await (options.watchRunner ?? watchRun)(handle.runPath, {
 		cwd: options.cwd,
 		runsRoot: options.runsRoot,
 		io: { stdout }
@@ -49098,11 +49405,13 @@ function pluralize(count, singular, plural) {
 //#region src/doctor/checks.ts
 const execFileAsync = promisify(execFile);
 function createDoctorContext(overrides = {}) {
+	const env = overrides.env ?? process.env;
 	return {
 		cwd: resolve(overrides.cwd ?? process.cwd()),
-		runsRoot: resolve(overrides.runsRoot ?? defaultRunsRoot()),
+		runsRoot: resolve(overrides.runsRoot ?? defaultRunsRoot(env)),
+		runsRootExplicit: overrides.runsRootExplicit ?? (overrides.runsRoot !== void 0 || (env.QUIRE_RUNS_DIR?.trim().length ?? 0) > 0),
 		authStore: overrides.authStore ?? authStore,
-		env: overrides.env ?? process.env,
+		env,
 		fetchFn: overrides.fetchFn ?? fetch,
 		execFn: overrides.execFn ?? defaultExecFn,
 		probeTimeoutMs: overrides.probeTimeoutMs ?? 2e3
@@ -49204,6 +49513,13 @@ async function checkAuthValid(context, auth) {
 	}
 }
 async function checkAuthBroker(context, auth) {
+	const localModelSource = await detectLocalInvestigationModelSource({ env: context.env });
+	if (localModelSource !== null) return {
+		id: "auth.broker",
+		section: "identity",
+		severity: "pass",
+		message: `Local model provider connected (${formatLocalModelSource(localModelSource.source)}; ${localModelSource.provider}/${localModelSource.modelId}).`
+	};
 	try {
 		return brokerToCheckResult(await fetchModelSourceBrokerStatus({
 			apiBaseUrl: auth.apiBaseUrl,
@@ -49220,6 +49536,9 @@ async function checkAuthBroker(context, auth) {
 		};
 	}
 }
+function formatLocalModelSource(source) {
+	return source === "local_openai_codex" ? "ChatGPT/Codex" : "GitHub Copilot";
+}
 function brokerToCheckResult(status) {
 	if (status.requiredNextAction !== null) return {
 		id: "auth.broker",
@@ -49294,6 +49613,22 @@ async function checkRunsRoot(context) {
 			message: `Runs root writable (${context.runsRoot}).`
 		};
 	} catch (error) {
+		if (!context.runsRootExplicit && isWriteAccessError(error)) {
+			const fallbackRunsRoot = await mkdtemp(join(tmpdir(), "quire-runs-"));
+			await mkdir(fallbackRunsRoot, {
+				recursive: true,
+				mode: 448
+			});
+			await access(fallbackRunsRoot, constants.W_OK);
+			context.runsRoot = fallbackRunsRoot;
+			return {
+				id: "runs.rootWritable",
+				section: "runs",
+				severity: "warn",
+				message: `Default runs root not writable (${toMessage(error)}); using temporary runs root ${fallbackRunsRoot}.`,
+				fix: { command: `Set QUIRE_RUNS_DIR=${fallbackRunsRoot} for follow-up Quire commands in this shell.` }
+			};
+		}
 		return {
 			id: "runs.rootWritable",
 			section: "runs",
@@ -49338,6 +49673,9 @@ function checkStuckRuns(context) {
 		};
 	}
 }
+function isWriteAccessError(error) {
+	return error instanceof Error && "code" in error && (error.code === "EROFS" || error.code === "EACCES" || error.code === "EPERM");
+}
 function formatUser$2(user) {
 	if (user.email !== void 0 && user.email !== null && user.email.length > 0) return user.email;
 	if (user.name !== void 0 && user.name !== null && user.name.length > 0) return user.name;
@@ -49648,6 +49986,7 @@ const logoutCommand = defineCommand({
 async function runLogout(options) {
 	const store = options.store ?? authStore;
 	const stdout = options.io?.stdout ?? process.stdout;
+	const env = options.env ?? process.env;
 	const existing = await store.get();
 	await store.clear();
 	if (existing === null) log.info("Already logged out.", {
@@ -49658,48 +49997,379 @@ async function runLogout(options) {
 		output: stdout,
 		spacing: 0
 	});
+	if (env["QUIRE_API_TOKEN"]?.trim()) log.warn(`${QUIRE_API_TOKEN_ENV} is still set, so Quire commands may still authenticate.`, {
+		output: stdout,
+		spacing: 0
+	});
 }
 //#endregion
 //#region src/commands/setup.ts
-const SETUP_URL = "https://quire.sh/agent-setup";
-const VERIFICATION_SKILL_URL = "https://quire.sh/agent-verification";
-const AGENT_SETUP_PROMPT = `Set up this repository for Quire investigations.
+const DEFAULT_PUBLIC_BASE_URL = "https://quire.sh";
+const SETUP_URL_PLACEHOLDER = "__QUIRE_SETUP_URL__";
+const VERIFICATION_SKILL_URL_PLACEHOLDER = "__QUIRE_VERIFICATION_SKILL_URL__";
+const AGENT_SETUP_PROMPT = `Help me set up Quire for this repo. Use \`quire\` if available, otherwise \`npx @quireco/cli@latest\`. Load and follow ${SETUP_URL_PLACEHOLDER}. Guide any login/model setup with me, create the repo runbook, and run one setup smoke only if Quire doctor is healthy. Report the run link/evidence or exact blocker.`;
+const QUIRE_VERIFY_SKILL_MARKDOWN = `---
+name: verify
+description: Verify claims, code changes, bug fixes, workflows, and release readiness with independent evidence. Use when asked to verify, QA, smoke test, prove a fix, or check non-trivial work before completion.
+---
+
+# Verify
+
+Load and follow the current Quire verification skill from ${VERIFICATION_SKILL_URL_PLACEHOLDER}.
+
+Use this skill to prove whether a claim, code change, bug fix, test result, workflow, or release/readiness assertion is actually correct. Quire is the independent read-only QA/verification agent for this workflow. Quire does not implement fixes. Quire reports pass, fail, blocked, or partial results honestly with evidence.
+
+## When to use this skill
+
+Use this skill when the user asks to verify, QA, smoke test, validate, prove a fix, check a workflow, confirm a release claim, ask Quire, run Quire, or get a Quire run id/verdict/handoff.
 
-Please load and follow the Quire agent setup instructions from ${SETUP_URL}.
+Also use Quire before declaring non-trivial coding work complete when independent verification would materially increase confidence, especially for UI/workflow changes, bug fixes, failing or flaky tests, auth, security, permissions, billing, data loss, migrations, concurrency, integrations, or release-readiness work.
 
-Inspect the project, ask focused questions for important missing runbook facts instead of writing placeholder unknowns, then create a .quire/runbook.md that encodes the best-practices verification loop for this specific project. Capture how Quire should self-verify work in this domain: target/environment choice, local startup, browser/API/CLI/mobile checks, console/runtime signals, core flows, verification commands, design/reference surfaces, auth/data setup, performance/accessibility expectations, and mutation-safety rules. Update AGENTS.md with concise Quire notes, then run Quire doctor using the available Quire command, e.g. \`quire doctor\` or \`npx @quireco/cli doctor\`, and report anything still blocked.`;
-const QUIRE_SKILL_MARKDOWN = `---
+Do not use Quire for every tiny task. Usually skip independent verification for purely conversational answers, simple docs/formatting edits, trivial mechanical changes where local checks are enough, or repeated verification of the same unchanged diff. Exception: if the user explicitly asks for Quire or independent verification, use Quire anyway.
+
+## Hard requirement
+
+If the caller explicitly asks for Quire or independent verification, do not substitute your own direct checks, web fetches, curl commands, tests, browser checks, or manual reasoning and claim that is equivalent. You may do basic preparation, but Quire itself must be invoked.
+
+Required path: if this harness exposes a native subagent named \`quire\`, delegate the verification brief to that subagent and wait for its result. Do not decide the task is simple enough to run \`quire\` directly from the parent session when a native \`quire\` subagent is available. Use CLI fallback only when no native \`quire\` subagent is available.
+
+If the caller asks whether the Quire agent/subagent path was used, answer from your actual invocation path. If you used a native \`quire\` child task/subagent, report that the native Quire subagent path was used even when \`quire wait\` returns metadata for an older run whose internal harness was \`pi\`, Codex, or another agent. Treat old run metadata as separate historical context, not as evidence that the current adapter path was not used.
+
+When communicating Quire results to the user, produce a compact verification report like a QA test run summary: verdict, checks run, pass/fail/blocked counts when available, known non-regressions, synced Quire run link from \`webUrl\`, \`caseUrl\`, or \`sync.caseUrl\`, report/handoff markdown path or excerpt, and useful artifacts such as screenshots, recordings, traces, console/network output, or other evidence.
+
+## How to invoke Quire
+
+Preferred order:
+
+1. If this harness exposes a native subagent named \`quire\`, delegate the verification brief to that subagent and wait for its result. This is mandatory when available.
+2. If no native Quire subagent is available, run the CLI directly.
+
+CLI fallback:
+
+\`\`\`bash
+run_json=$(quire run --detach --json --url "<url>" "<verification request>")
+run_id=$(printf '%s' "$run_json" | jq -r '.runId')
+quire wait "$run_id" --json
+\`\`\`
+
+If the caller provides an existing Quire run id, do not start a new run and do not use \`quire status\` as the final result. Wait for and return the handoff with:
+
+\`\`\`bash
+quire wait "<run-id>" --json
+\`\`\`
+
+The JSON output includes \`webUrl\` / \`caseUrl\` when the run has synced to Quire's web app. Use that link as the shareable evidence URL in user-facing summaries.
+
+Omit \`--url\` when there is no URL and include the target context in the natural-language request. Use \`quire wait\` as the waiting primitive. Do not manually poll unless \`quire wait\` is unavailable.
+
+If Quire reports \`EROFS\`, \`EACCES\`, or another write error under \`~/.local/share/quire/runs\`, retry with a temporary run store and reuse the same value for every lifecycle command:
+
+\`\`\`bash
+quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)
+QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json --url "<url>" "<verification request>"
+QUIRE_RUNS_DIR=$quire_runs_dir quire wait "<run-id>" --json
+\`\`\`
+
+## Verification brief template
+
+- Claim/change to verify:
+- Relevant files/paths:
+- Commands already run:
+- Expected behavior:
+- Known risks or edge cases:
+- Constraints: read-only verification; do not edit code.
+
+Return Quire's terminal handoff with:
+
+- Verdict: pass, fail, blocked, partial, or setup-blocked
+- Quire run id
+- Quire web URL when present
+- What Quire verified, including checks run and pass/fail/blocked counts when available
+- Key evidence, artifacts, report, screenshots, recordings, traces, or handoff excerpt
+- Known non-regressions or pre-existing issues, when relevant
+- Follow-up actions for the implementation agent
+`;
+const QUIRE_DEBUG_SKILL_MARKDOWN = `---
+name: debug
+description: Diagnose bugs, regressions, flaky behavior, and broken workflows with a reproduce-first loop. Use when asked to debug, diagnose, investigate a failure, reproduce a bug, or triage a regression.
+---
+
+# Debug
+
+Use this skill for disciplined diagnosis: reproduce the failure, minimize the loop, form hypotheses, instrument only what distinguishes them, fix, and regression-test. Quire is the independent evidence collector for this workflow when a fresh reproduction, browser/API/mobile check, or external verification handoff would materially improve confidence.
+
+## When to use Quire during diagnosis
+
+Use the native \`quire\` subagent when you need an independent read-only investigator to:
+
+- reproduce a reported bug or flaky workflow;
+- verify a suspected fix against the real app, browser, API, CLI, or mobile surface;
+- gather evidence such as screenshots, recordings, console output, terminal logs, or a concise handoff;
+- check whether a failure is environment/setup-blocked versus a product bug;
+- produce a run id and terminal verdict that another agent can use in an implementation/verification loop.
+
+Do not outsource implementation to Quire. Quire should not edit code. The parent/debugging agent owns hypotheses, code changes, and regression tests.
+
+## Recommended invocation
+
+1. Build or identify the best reproduction loop you can from the report.
+2. If this harness exposes a native subagent named \`quire\`, delegate a concise reproduction or verification brief to that subagent and wait for its handoff. This is mandatory when available.
+3. If no native \`quire\` subagent is available, use the Quire CLI fallback from ${VERIFICATION_SKILL_URL_PLACEHOLDER}.
+4. Use Quire's result as evidence, not as a substitute for understanding the code path. When communicating the result, surface the synced Quire run link from \`webUrl\`, \`caseUrl\`, or \`sync.caseUrl\` when present, and mention useful report artifacts such as screenshots, recordings, traces, or the handoff markdown when they help the user review the diagnosis. If Quire reports blocked, preserve that honestly and fix the setup or ask for the missing environment.
+
+## Quire brief template
+
+- Failure or regression to reproduce:
+- User-visible symptom:
+- Target URL, command, app, or environment:
+- Steps already tried:
+- Expected behavior:
+- Actual behavior:
+- Evidence to capture:
+- Constraints: read-only investigation; do not edit code.
+
+## CLI fallback
+
+Use CLI fallback only if the native \`quire\` subagent is unavailable. Prefer detached JSON mode and wait for the terminal handoff:
+
+\`\`\`bash
+run_json=$(quire run --detach --json --url "<url>" "<reproduction or verification request>")
+run_id=$(printf '%s' "$run_json" | jq -r '.runId')
+quire wait "$run_id" --json
+\`\`\`
+
+If the caller provides an existing Quire run id, do not start a new run and do not use \`quire status\` as the final result:
+
+\`\`\`bash
+quire wait "<run-id>" --json
+\`\`\`
+
+For more CLI details, sandbox recovery, and handoff interpretation, follow ${VERIFICATION_SKILL_URL_PLACEHOLDER}.
+`;
+const QUIRE_AGENT_MARKDOWN = `---
 name: quire
-description: Runs Quire CLI evidence-backed QA, verification, triage, and investigation work. Use after implementing UI or workflow changes, when testing local/preview/prod URLs, or when claims need screenshots, command output, observations, and a trustworthy handoff.
+description: "Run Quire, the independent read-only QA/verification/triage agent. Use when the user explicitly asks for Quire or when independent verification of a non-trivial change, bug fix, test failure, or release claim is warranted. Returns pass, fail, blocked, or partial with evidence; never edits code."
+color: green
+model: inherit
 ---
 
-# Quire verification
+You are Quire's native harness adapter. Your job is to launch Quire through the Quire CLI, wait for the result, and return the evidence-backed result to the parent agent.
+
+Do not implement code changes. Do not commit, stage, format, rewrite, patch, or edit files. Do not perform broad independent QA outside Quire unless Quire cannot run and the caller explicitly asks for fallback evidence. Do not read or print secrets, tokens, .env files, or credential vaults. Treat production targets as read-only unless the caller explicitly approves mutation.
 
-Load and follow the current Quire verification skill from ${VERIFICATION_SKILL_URL}.
+When reporting whether the Quire agent/subagent path was used, answer only about this native adapter invocation. If you are running these instructions as the \`quire\` subagent, then the native Quire subagent path was used. Do not add a second "internal run harness" answer, do not discuss a previous run's \`harness: "pi"\` metadata, and do not answer "no" for the current adapter path.
 
-Use Quire when a task needs evidence-backed verification, QA, product dogfooding, bug reproduction, or triage. Prefer \`quire run\` for new work.
+## Workflow
+
+1. Convert the parent request into a concise Quire verification brief.
+2. Prefer the local \`quire\` command. Use the exact command style available in the workspace if the caller provides one. Do not downgrade an explicit Quire request to direct curl/browser/test checks, and do not report \`N/A\` for the run id because the claim looked small.
+3. Include \`--url <url>\` when the caller provides a URL or the project runbook clearly identifies the local/preview target.
+4. Start one Quire run for the verification claim. Do not start duplicate runs for the same claim just because the first run is still active.
+
+   If the caller provides an existing Quire run id, do not start a new run. Use \`quire wait "<run-id>" --json\` and return its terminal handoff.
+
+   Prefer detached JSON mode for agent handoffs:
+
+   \`\`\`bash
+   run_json=$(quire run --detach --json --url "<url>" "<verification request>")
+   run_id=$(printf '%s' "$run_json" | jq -r '.runId')
+   \`\`\`
+
+   If there is no URL, omit \`--url\` and put target context in the natural-language request.
+
+5. Wait patiently until terminal status:
+
+   \`\`\`bash
+   quire wait "$run_id" --json
+   \`\`\`
+
+   If Quire reports \`EROFS\`, \`EACCES\`, or another write error under \`~/.local/share/quire/runs\`, retry with a temporary run store and reuse the same value for every lifecycle command:
+
+   \`\`\`bash
+   quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)
+   QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json --url "<url>" "<verification request>"
+   QUIRE_RUNS_DIR=$quire_runs_dir quire wait "<run-id>" --json
+   \`\`\`
+
+   Terminal statuses are \`completed\`, \`failed\`, \`canceled\`, and \`stale\`. Quire can take several minutes while it inspects context, opens browsers, runs shell checks, captures evidence, and writes a handoff.
+
+6. Return \`finalHandoff.handoffMarkdown\` from \`quire wait --json\` when present. Include the synced Quire run link from \`webUrl\`, \`caseUrl\`, or \`sync.caseUrl\` when present. Format the result like a QA test run summary: verdict, checks run, pass/fail/blocked counts when available, report path or excerpt, screenshots, recordings, traces, console/network output, known non-regressions, and follow-up actions.
+7. If Quire reports blocked, failed, stale, or untested checks, preserve that honestly and include the next action. Do not summarize blocked or untested assertions as passed.
+8. If Quire cannot start because auth, model provider, wallet, browser, mobile, or target setup is missing, report setup-blocked with the exact reason and the next command Quire suggested.
+
+## Return format
+
+- Native Quire adapter invocation: yes, if you are running as the \`quire\` subagent.
+- Verdict: pass, fail, blocked, partial, or setup-blocked
+- Quire run id
+- Quire web URL when present
+- What Quire verified, including checks run and pass/fail/blocked counts when available
+- Key evidence, artifacts, report, screenshots, recordings, traces, or handoff excerpt
+- Known non-regressions or pre-existing issues, when relevant
+- Follow-up actions for the implementation agent
 `;
-const SKILL_INSTALL_TARGETS = [{
-	id: "agents",
-	label: "Universal",
-	targetPath: ".agents/skills/quire/SKILL.md",
-	hint: "~/.agents/skills/quire/SKILL.md · Pi, OpenCode, Amp, Codex-style agents",
-	aliases: [
-		"agents",
-		"agent-skills",
-		"pi",
-		"opencode",
-		"amp",
-		"codex",
-		"other"
-	]
-}, {
-	id: "claude",
-	label: "Claude Code",
-	targetPath: ".claude/skills/quire/SKILL.md",
-	hint: "~/.claude/skills/quire/SKILL.md",
-	aliases: ["claude", "claude-code"]
-}];
+const QUIRE_CURSOR_MARKDOWN = QUIRE_AGENT_MARKDOWN.replace("model: inherit\n---", "model: inherit\nreadonly: true\n---");
+const QUIRE_CODEX_TOML = `name = "quire"
+description = "Run Quire, the independent read-only QA/verification/triage agent. Use when explicitly asked for Quire or when independent verification of a non-trivial change, bug fix, test failure, or release claim is warranted. Returns pass, fail, blocked, or partial with evidence; never edits code."
+
+developer_instructions = """
+You are Quire's native harness adapter. Your job is to launch Quire through the Quire CLI, wait for the result, and return the evidence-backed result to the parent agent.
+
+Do not implement code changes. Do not commit, stage, format, rewrite, patch, or edit files. Do not perform broad independent QA outside Quire unless Quire cannot run and the caller explicitly asks for fallback evidence. Do not read or print secrets, tokens, .env files, or credential vaults. Treat production targets as read-only unless the caller explicitly approves mutation.
+
+When reporting whether the Quire agent/subagent path was used, answer only about this native adapter invocation. If you are running these instructions as the \`quire\` subagent, then the native Quire subagent path was used. Do not add a second "internal run harness" answer, do not discuss a previous run's \`harness: "pi"\` metadata, and do not answer "no" for the current adapter path.
+
+Workflow:
+1. Convert the parent request into a concise Quire verification brief.
+2. Prefer the local \`quire\` command. Use the exact command style available in the workspace if the caller provides one. Do not downgrade an explicit Quire request to direct curl/browser/test checks, and do not report \`N/A\` for the run id because the claim looked small.
+3. Include \`--url <url>\` when the caller provides a URL or the project runbook clearly identifies the local/preview target.
+4. Start one Quire run for the verification claim. Do not start duplicate runs for the same claim just because the first run is still active.
+
+   If the caller provides an existing Quire run id, do not start a new run. Use \`quire wait "<run-id>" --json\` and return its terminal handoff.
+
+   run_json=$(quire run --detach --json --url "<url>" "<verification request>")
+   run_id=$(printf '%s' "$run_json" | jq -r '.runId')
+   quire wait "$run_id" --json
+
+5. If Quire reports EROFS, EACCES, or another write error under ~/.local/share/quire/runs, retry with a temporary run store and reuse the same value for every lifecycle command:
+
+   quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)
+   QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json --url "<url>" "<verification request>"
+   QUIRE_RUNS_DIR=$quire_runs_dir quire wait "<run-id>" --json
+
+6. Return finalHandoff.handoffMarkdown from \`quire wait --json\` when present. Include the synced Quire run link from \`webUrl\`, \`caseUrl\`, or \`sync.caseUrl\` when present. Format the result like a QA test run summary: verdict, checks run, pass/fail/blocked counts when available, report path or excerpt, screenshots, recordings, traces, console/network output, known non-regressions, and follow-up actions.
+7. If Quire reports blocked, failed, stale, or untested checks, preserve that honestly and include the next action. Do not summarize blocked or untested assertions as passed.
+
+Return:
+- Native Quire adapter invocation: yes, if you are running as the \`quire\` subagent.
+- Verdict: pass, fail, blocked, partial, or setup-blocked
+- Quire run id
+- Quire web URL when present
+- What Quire verified, including checks run and pass/fail/blocked counts when available
+- Key evidence, artifacts, report, screenshots, recordings, traces, or handoff excerpt
+- Known non-regressions or pre-existing issues, when relevant
+- Follow-up actions for the implementation agent
+"""
+`;
+const QUIRE_OPENCODE_MARKDOWN = `---
+description: Native @quire subagent. If the user mentions @quire, the parent must invoke the Task tool's quire subagent and must not run Bash/CLI directly in the parent session. For existing run IDs, this subagent uses quire wait <run-id> --json, not quire status. If asked whether the agent/subagent path was used, answer yes for this native child invocation; old run harness metadata is separate historical context.
+mode: subagent
+permission:
+  edit: deny
+---
+
+You are Quire's native harness adapter. Your job is to launch Quire through the Quire CLI, wait for the result, and return the evidence-backed result to the parent agent.
+
+Do not implement code changes. Do not commit, stage, format, rewrite, patch, or edit files. Do not perform broad independent QA outside Quire unless Quire cannot run and the caller explicitly asks for fallback evidence. Do not read or print secrets, tokens, .env files, or credential vaults. Treat production targets as read-only unless the caller explicitly approves mutation.
+
+When reporting whether the Quire agent/subagent path was used, answer only about this native adapter invocation. If you are running these instructions as the \`quire\` subagent, then the native Quire subagent path was used. Do not add a second "internal run harness" answer, do not discuss a previous run's \`harness: "pi"\` metadata, and do not answer "no" for the current adapter path.
+
+## Workflow
+
+1. Convert the parent request into a concise Quire verification brief.
+2. Prefer the local \`quire\` command. Use the exact command style available in the workspace if the caller provides one. Do not downgrade an explicit Quire request to direct curl/browser/test checks, and do not report \`N/A\` for the run id because the claim looked small.
+3. Include \`--url <url>\` when the caller provides a URL or the project runbook clearly identifies the local/preview target.
+4. Start one Quire run for the verification claim. Do not start duplicate runs for the same claim just because the first run is still active.
+
+   If the caller provides an existing Quire run id, do not start a new run. Use \`quire wait "<run-id>" --json\` and return its terminal handoff.
+
+   \`\`\`bash
+   run_json=$(quire run --detach --json --url "<url>" "<verification request>")
+   run_id=$(printf '%s' "$run_json" | jq -r '.runId')
+   quire wait "$run_id" --json
+   \`\`\`
+
+5. If Quire reports \`EROFS\`, \`EACCES\`, or another write error under \`~/.local/share/quire/runs\`, retry with a temporary run store and reuse the same value for every lifecycle command:
+
+   \`\`\`bash
+   quire_runs_dir=$(mktemp -d -t quire-runs-XXXXXX)
+   QUIRE_RUNS_DIR=$quire_runs_dir quire run --detach --json --url "<url>" "<verification request>"
+   QUIRE_RUNS_DIR=$quire_runs_dir quire wait "<run-id>" --json
+   \`\`\`
+
+6. Return \`finalHandoff.handoffMarkdown\` from \`quire wait --json\` when present. Include the synced Quire run link from \`webUrl\`, \`caseUrl\`, or \`sync.caseUrl\` when present. Format the result like a QA test run summary: verdict, checks run, pass/fail/blocked counts when available, report path or excerpt, screenshots, recordings, traces, console/network output, known non-regressions, and follow-up actions.
+7. If Quire reports blocked, failed, stale, or untested checks, preserve that honestly and include the next action. Do not summarize blocked or untested assertions as passed.
+
+## Return format
+
+- Native Quire adapter invocation: yes, if you are running as the \`quire\` subagent.
+- Verdict: pass, fail, blocked, partial, or setup-blocked
+- Quire run id
+- Quire web URL when present
+- What Quire verified, including checks run and pass/fail/blocked counts when available
+- Key evidence, artifacts, report, screenshots, recordings, traces, or handoff excerpt
+- Known non-regressions or pre-existing issues, when relevant
+- Follow-up actions for the implementation agent
+`;
+const SKILL_INSTALL_TARGETS = [
+	{
+		id: "agents",
+		label: "Universal",
+		skillPaths: [{
+			path: ".agents/skills/verify/SKILL.md",
+			contents: QUIRE_VERIFY_SKILL_MARKDOWN
+		}, {
+			path: ".agents/skills/debug/SKILL.md",
+			contents: QUIRE_DEBUG_SKILL_MARKDOWN
+		}],
+		agentPath: ".agents/agents/quire.md",
+		codexAgentPath: ".codex/agents/quire.toml",
+		opencodeAgentPath: ".config/opencode/agents/quire.md",
+		piAgentPath: ".pi/agent/agents/quire.md",
+		hint: "~/.agents/skills/{verify,debug}/SKILL.md · plus Codex/OpenCode/Pi Quire subagents",
+		aliases: [
+			"agents",
+			"agent-skills",
+			"pi",
+			"opencode",
+			"amp",
+			"codex",
+			"other"
+		]
+	},
+	{
+		id: "claude",
+		label: "Claude Code",
+		skillPaths: [{
+			path: ".claude/skills/verify/SKILL.md",
+			contents: QUIRE_VERIFY_SKILL_MARKDOWN
+		}, {
+			path: ".claude/skills/debug/SKILL.md",
+			contents: QUIRE_DEBUG_SKILL_MARKDOWN
+		}],
+		agentPath: ".claude/agents/quire.md",
+		hint: "~/.claude/skills/{verify,debug}/SKILL.md · plus native Quire subagent",
+		aliases: ["claude", "claude-code"]
+	},
+	{
+		id: "cursor",
+		label: "Cursor",
+		skillPaths: [{
+			path: ".cursor/skills/verify/SKILL.md",
+			contents: QUIRE_VERIFY_SKILL_MARKDOWN
+		}, {
+			path: ".cursor/skills/debug/SKILL.md",
+			contents: QUIRE_DEBUG_SKILL_MARKDOWN
+		}],
+		agentPath: ".cursor/agents/quire.md",
+		agentContents: QUIRE_CURSOR_MARKDOWN,
+		hint: "~/.cursor/skills/{verify,debug}/SKILL.md · plus native Quire subagent",
+		aliases: ["cursor", "cursor-cli"]
+	}
+];
+const LEGACY_QUIRE_VERIFIER_PATHS = [
+	".agents/agents/quire-verifier.md",
+	".agents/skills/quire-verifier/SKILL.md",
+	".claude/agents/quire-verifier.md",
+	".codex/agents/quire-verifier.toml",
+	".cursor/agents/quire-verifier.md",
+	".config/opencode/agents/quire-verifier.md"
+];
+const LEGACY_QUIRE_SKILL_PATHS = [
+	".agents/skills/quire/SKILL.md",
+	".claude/skills/quire/SKILL.md",
+	".cursor/skills/quire/SKILL.md"
+];
 const setupCommand = defineCommand({
 	meta: {
 		name: "setup",
@@ -49708,7 +50378,7 @@ const setupCommand = defineCommand({
 	args: {
 		skill: {
 			type: "string",
-			description: "Comma-separated local agent skill targets to install: agents, claude, all, none.",
+			description: "Comma-separated local agent skill targets to install: agents, claude, cursor, all, none.",
 			valueHint: "targets"
 		},
 		"no-skill": {
@@ -49721,37 +50391,76 @@ const setupCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
+		const noSkill = args["no-skill"] === true || args.noSkill === true;
+		const noInteractive = args["no-interactive"] === true || args.noInteractive === true || args.interactive === false;
 		await runSetup({
-			skill: args["no-skill"] === true ? false : args.skill,
-			interactive: args["no-interactive"] !== true
+			skill: noSkill ? false : args.skill,
+			interactive: !noInteractive
 		});
 	}
 });
 async function runSetup(options = {}) {
 	const stdout = options.io?.stdout ?? process.stdout;
+	const env = options.env ?? process.env;
+	const interactive = options.interactive ?? (options.io?.stdout === void 0 && process.stdout.isTTY === true);
+	const authStore$1 = options.authStore ?? authStore;
+	const urls = setupUrls(env);
 	const selectedTargets = await selectSkillInstallTargets({
 		skill: options.skill,
-		interactive: options.interactive ?? (options.io?.stdout === void 0 && process.stdout.isTTY === true)
+		interactive
 	});
-	const installedSkills = await installQuireSkill(options.homeDir ?? homedir(), selectedTargets);
+	const installedAgentFiles = await installQuireAgentFiles(options.homeDir ?? homedir(), selectedTargets, urls);
 	log.step("Set up Quire for this workspace", {
 		output: stdout,
 		spacing: 0
 	});
-	log.message([`Open ${color.info(SETUP_URL)} to load the Quire setup skill, or copy this prompt into your coding agent like Claude Code, Codex, Pi, or Amp:`], {
+	log.message([`Open ${color.info(urls.setupUrl)} to load the Quire setup skill, or copy this prompt into your coding agent like Claude Code, Cursor, Codex, Pi, or Amp:`], {
 		output: stdout,
 		spacing: 0,
 		withGuide: true
 	});
 	writeLine(stdout);
 	writeLine(stdout, color.label("--- copy prompt ---"));
-	writeLine(stdout, AGENT_SETUP_PROMPT);
+	writeLine(stdout, renderSetupTemplate(AGENT_SETUP_PROMPT, urls));
 	writeLine(stdout, color.label("--- end prompt ---"));
-	if (installedSkills.length > 0) {
+	if (installedAgentFiles.length > 0) {
 		writeLine(stdout);
-		writeLine(stdout, color.label("Installed local Quire skill:"));
-		for (const path of installedSkills) writeLine(stdout, `  ${color.success("✓")} ${path}`);
+		writeLine(stdout, color.label("Installed local Quire agent files:"));
+		for (const path of installedAgentFiles) writeLine(stdout, `  ${color.success("✓")} ${path}`);
+	}
+	const authConfigured = await completeInteractiveLogin({
+		interactive,
+		env,
+		store: authStore$1,
+		login: options.login ?? runLogin,
+		io: options.io
+	});
+	writeLine(stdout);
+	writeLine(stdout, color.label("Next steps:"));
+	writeLine(stdout, `  1. Give the copy prompt above to your coding agent so it creates ${color.path(".quire/runbook.md")}.`);
+	if (authConfigured) writeLine(stdout, `  2. Run ${color.command("quire doctor")} to confirm this repo is ready.`);
+	else writeLine(stdout, `  2. Authenticate Quire with ${color.command("quire login")} or ${color.command("QUIRE_API_TOKEN")} if this machine is not already signed in.`);
+	writeLine(stdout, `  3. Ask your coding agent to run a small Quire smoke verification once ${color.path(".quire/runbook.md")} and auth are ready.`);
+}
+async function completeInteractiveLogin(options) {
+	if (!options.interactive) return false;
+	const stdout = options.io?.stdout ?? process.stdout;
+	if (await resolveAuthCredentials({
+		store: options.store,
+		env: options.env
+	}) !== null) {
+		log.success("Quire authentication is already configured.", {
+			output: stdout,
+			spacing: 0
+		});
+		return true;
 	}
+	await options.login({
+		apiBaseUrl: readApiBaseUrl(options.env.QUIRE_API_URL),
+		store: options.store,
+		io: options.io
+	});
+	return true;
 }
 async function selectSkillInstallTargets(options) {
 	if (options.skill === false || options.skill === "none") return [];
@@ -49764,7 +50473,11 @@ async function selectSkillInstallTargets(options) {
 			value: target.id,
 			hint: target.hint
 		})),
-		initialValues: ["agents", "claude"],
+		initialValues: [
+			"agents",
+			"claude",
+			"cursor"
+		],
 		required: false
 	});
 	if (isCancel(selected) || selected.length === 0) return [];
@@ -49780,19 +50493,121 @@ function resolveSkillTargets(value) {
 	}
 	return [...selected.values()];
 }
-async function installQuireSkill(homeDir, targets) {
+function setupUrls(env) {
+	const baseUrl = publicBaseUrl(env);
+	return {
+		setupUrl: new URL("/agent-setup", baseUrl).toString(),
+		verificationSkillUrl: new URL("/agent-verification", baseUrl).toString()
+	};
+}
+function publicBaseUrl(env) {
+	const configured = env.QUIRE_SKILL_BASE_URL ?? env.QUIRE_PUBLIC_URL ?? env.QUIRE_API_URL;
+	if (configured === void 0 || configured.trim().length === 0) return DEFAULT_PUBLIC_BASE_URL;
+	return configured;
+}
+function renderSetupTemplate(contents, urls) {
+	return contents.replaceAll(SETUP_URL_PLACEHOLDER, urls.setupUrl).replaceAll(VERIFICATION_SKILL_URL_PLACEHOLDER, urls.verificationSkillUrl);
+}
+async function installQuireAgentFiles(homeDir, targets, urls) {
 	const installed = [];
+	if (targets.length === 0) return installed;
+	await removeLegacyQuireVerifierFiles(homeDir);
+	await removeLegacyQuireSkillFiles(homeDir);
 	await Promise.all(targets.map(async (target) => {
-		const path = join(homeDir, target.targetPath);
-		await mkdir(dirname(path), {
+		for (const skill of target.skillPaths) {
+			const skillPath = join(homeDir, skill.path);
+			await mkdir(dirname(skillPath), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(skillPath, renderSetupTemplate(skill.contents, urls), { mode: 384 });
+			installed.push(skillPath);
+		}
+		const agentPath = join(homeDir, target.agentPath);
+		await mkdir(dirname(agentPath), {
 			recursive: true,
 			mode: 448
 		});
-		await writeFile(path, QUIRE_SKILL_MARKDOWN, { mode: 384 });
-		installed.push(path);
+		await writeFile(agentPath, renderSetupTemplate(target.agentContents ?? QUIRE_AGENT_MARKDOWN, urls), { mode: 384 });
+		installed.push(agentPath);
+		if (target.codexAgentPath !== void 0) {
+			const codexAgentPath = join(homeDir, target.codexAgentPath);
+			await mkdir(dirname(codexAgentPath), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(codexAgentPath, renderSetupTemplate(QUIRE_CODEX_TOML, urls), { mode: 384 });
+			installed.push(codexAgentPath);
+		}
+		if (target.opencodeAgentPath !== void 0) {
+			const opencodeAgentPath = join(homeDir, target.opencodeAgentPath);
+			await mkdir(dirname(opencodeAgentPath), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(opencodeAgentPath, renderSetupTemplate(QUIRE_OPENCODE_MARKDOWN, urls), { mode: 384 });
+			installed.push(opencodeAgentPath);
+		}
+		if (target.piAgentPath !== void 0) {
+			const piAgentPath = join(homeDir, target.piAgentPath);
+			await mkdir(dirname(piAgentPath), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(piAgentPath, renderSetupTemplate(QUIRE_AGENT_MARKDOWN, urls), { mode: 384 });
+			installed.push(piAgentPath);
+		}
 	}));
 	return installed.sort();
 }
+async function removeLegacyQuireVerifierFiles(homeDir) {
+	await Promise.all(LEGACY_QUIRE_VERIFIER_PATHS.map(async (legacyPath) => {
+		const path = join(homeDir, legacyPath);
+		try {
+			if (isLegacyQuireVerifierFile(await readFile(path, "utf8"))) {
+				await rm(path, { force: true });
+				await removeEmptyDirectory(dirname(path));
+			}
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+				await removeEmptyDirectory(dirname(path));
+				return;
+			}
+			throw error;
+		}
+	}));
+}
+async function removeLegacyQuireSkillFiles(homeDir) {
+	await Promise.all(LEGACY_QUIRE_SKILL_PATHS.map(async (legacyPath) => {
+		const path = join(homeDir, legacyPath);
+		try {
+			if (isLegacyQuireSkillFile(await readFile(path, "utf8"))) {
+				await rm(path, { force: true });
+				await removeEmptyDirectory(dirname(path));
+			}
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+				await removeEmptyDirectory(dirname(path));
+				return;
+			}
+			throw error;
+		}
+	}));
+}
+async function removeEmptyDirectory(path) {
+	try {
+		await rmdir(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTEMPTY" || error.code === "EEXIST" || error.code === "EISDIR")) return;
+		throw error;
+	}
+}
+function isLegacyQuireVerifierFile(contents) {
+	return contents.includes("Quire") && contents.includes("quire wait") && (contents.includes("quire-verifier") || contents.includes("Quire verifier"));
+}
+function isLegacyQuireSkillFile(contents) {
+	return contents.includes("name: quire") && contents.includes("/agent-verification") && contents.includes("native subagent named `quire`");
+}
 //#endregion
 //#region src/commands/whoami.ts
 const whoamiCommand = defineCommand({
@@ -49943,7 +50758,7 @@ function formatWalletBalance(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.0.11";
+var version$1 = "0.0.13";
 //#endregion
 //#region src/cli.ts
 const subCommands = {
@@ -49974,6 +50789,7 @@ const subCommands = {
 	setup: setupCommand,
 	status: statusCommand,
 	sync: syncCommand,
+	wait: waitCommand,
 	watch: watchCommand
 };
 const subCommandAliases = new Set(["me", "resume"]);