@shmulikdav/solix 1.5.0 → 1.9.0

package/dist/index.js

@@ -56,195 +56,527 @@ var pinAdvisorCmd = (id) => postAdvisor(id, "pin");
 var unpinAdvisorCmd = (id) => postAdvisor(id, "unpin");
 
 // src/demo.ts
+import { spawn } from "child_process";
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-var PORT2 = process.env.SOLIX_PORT ?? "4242";
-var BASE2 = `http://127.0.0.1:${PORT2}`;
-async function postEvent(payload) {
-  await fetch(`${BASE2}/events`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(payload)
-  });
+import { fileURLToPath } from "url";
+var SOLIX_HOME = process.env.SOLIX_HOME ?? join(homedir(), ".solix");
+var DEMO_DB_PATH = join(SOLIX_HOME, "demo.db");
+var DEMO_PID_PATH = join(SOLIX_HOME, "demo.pid");
+var TOKEN_PATH = join(SOLIX_HOME, "token");
+var demoToken = "";
+try {
+  demoToken = readFileSync(TOKEN_PATH, "utf8").trim();
+} catch {
+}
+var TICKER_COMET_MS = 2500;
+var TICKER_PROMOTE_MS = 25e3;
+var TICKER_MISSION_MS = 45e3;
+var TICKER_PERMISSION_MS = 75e3;
+var TICKER_ADVISOR_MS = 12e4;
+function baseUrl(port) {
+  return `http://127.0.0.1:${port}`;
 }
 function ts() {
   return Date.now();
 }
-async function ensureReachable() {
+async function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function isPortFree(port) {
   try {
-    const res = await fetch(`${BASE2}/api/health`, {
-      signal: AbortSignal.timeout(800)
+    await fetch(`${baseUrl(port)}/api/health`, {
+      signal: AbortSignal.timeout(300)
     });
-    return res.ok;
-  } catch {
     return false;
+  } catch {
+    return true;
   }
 }
-async function pin(advisorId) {
-  await fetch(`${BASE2}/api/advisors/${encodeURIComponent(advisorId)}/pin`, {
-    method: "POST"
-  });
+async function waitForServer(port, timeoutMs = 8e3) {
+  const start2 = Date.now();
+  while (Date.now() - start2 < timeoutMs) {
+    if (!await isPortFree(port)) return true;
+    await sleep(150);
+  }
+  return false;
 }
-async function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
+async function postEvent(base, payload) {
+  try {
+    await fetch(`${base}/events`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...demoToken ? { "x-solix-token": demoToken } : {}
+      },
+      body: JSON.stringify(payload)
+    });
+  } catch {
+  }
 }
-async function demoCmd(opts = {}) {
-  if (opts.port) process.env.SOLIX_PORT = String(opts.port);
-  if (!await ensureReachable()) {
-    console.error(
-      "[solix] server not reachable \u2014 run `solix start` first, then `solix demo` in another terminal"
+async function postJson(base, path, body) {
+  try {
+    const res = await fetch(`${base}${path}`, {
+      method: "POST",
+      headers: body ? { "Content-Type": "application/json" } : {},
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (!res.ok) return null;
+    if (res.headers.get("content-type")?.includes("json")) {
+      return await res.json();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getJson(base, path) {
+  try {
+    const res = await fetch(`${base}${path}`);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+function randomChoice(arr) {
+  return arr[Math.floor(Math.random() * arr.length)];
+}
+async function bootSandbox(preferredPort) {
+  let port = preferredPort;
+  if (!await isPortFree(port)) {
+    console.log(
+      `[solix demo] port ${port} is in use \u2014 falling back to ${port + 1} for the sandbox.`
     );
-    process.exitCode = 1;
-    return;
+    port += 1;
+    if (!await isPortFree(port)) {
+      console.error(
+        `[solix demo] both ${preferredPort} and ${port} are in use. Stop one of them or pass --port.`
+      );
+      return null;
+    }
   }
-  const cwd = opts.cwd ?? join(homedir(), "demo-project");
-  console.log(`[solix demo] seeding fake state for ${BASE2}`);
-  console.log(`[solix demo] using fake cwd: ${cwd}`);
-  const sessions = [
-    {
-      id: "demo-a",
-      pid: 90001,
-      cwd,
-      payload: { session_id: "demo-a", model: "opus" },
-      prompt: "Refactor the orbital math for stable layout",
-      tools: [
-        { tool: "Read", file: "packages/web/src/scene/orbits.ts" },
-        { tool: "Edit", file: "packages/web/src/scene/orbits.ts" },
-        { tool: "Bash", cmd: "pnpm --filter @solix/web typecheck" }
-      ]
-    },
-    {
-      id: "demo-b",
-      pid: 90002,
-      cwd,
-      payload: { session_id: "demo-b", model: "sonnet" },
-      prompt: "Wire up the asteroid belt to real skill data",
-      tools: [
-        { tool: "Read", file: "packages/server/src/state/skills.ts" },
-        { tool: "Write", file: "packages/web/src/scene/AsteroidBelt.tsx" }
-      ]
-    },
+  if (existsSync(DEMO_PID_PATH)) {
+    try {
+      const pid = parseInt(readFileSync(DEMO_PID_PATH, "utf8").trim(), 10);
+      if (pid > 0) {
+        try {
+          process.kill(pid, 0);
+          try {
+            process.kill(pid);
+          } catch {
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  mkdirSync(SOLIX_HOME, { recursive: true });
+  const selfScript = fileURLToPath(import.meta.url);
+  const child = spawn(
+    process.execPath,
+    [selfScript, "start", "--port", String(port), "--no-open"],
     {
-      id: "demo-c",
-      pid: 90003,
-      cwd,
-      payload: { session_id: "demo-c", model: "haiku" },
-      prompt: "Document the context envelope strategy",
-      tools: []
+      env: {
+        ...process.env,
+        SOLIX_DB_PATH: DEMO_DB_PATH
+      },
+      stdio: ["ignore", "inherit", "inherit"],
+      detached: false
     }
-  ];
-  for (const s of sessions) {
-    await postEvent({
+  );
+  if (child.pid) {
+    try {
+      (await import("fs")).writeFileSync(
+        DEMO_PID_PATH,
+        String(child.pid)
+      );
+    } catch {
+    }
+  }
+  child.on("exit", (code) => {
+    if (code != null && code !== 0) {
+      console.error(`[solix demo] sandbox server exited with code ${code}`);
+    }
+  });
+  if (!await waitForServer(port)) {
+    console.error(`[solix demo] sandbox server failed to start within 8s.`);
+    try {
+      child.kill();
+    } catch {
+    }
+    return null;
+  }
+  return { child, port, base: baseUrl(port) };
+}
+var PROJECTS = [
+  "web-app",
+  "infrastructure",
+  "data-pipeline",
+  "mobile-client",
+  "design-system",
+  "observability",
+  "ml-research",
+  "docs-site"
+];
+var MODELS = ["opus", "sonnet", "haiku", "default"];
+var PROMPTS = [
+  "Refactor the orbital math for stable layout",
+  "Wire up the asteroid belt to real skill data",
+  "Document the context envelope strategy",
+  "Audit the auth flow for token leak risk",
+  "Generate a migration plan for the new schema",
+  "Triage the failing Playwright spec",
+  "Build a flame graph from the last week of traces",
+  "Sweep deprecated APIs out of the SDK",
+  "Polish the README with three quickstart examples",
+  "Draft a runbook for the budget breach scenario"
+];
+var TOOL_FILES = [
+  "packages/web/src/scene/Planet.tsx",
+  "packages/server/src/router.ts",
+  "packages/cli/src/install.ts",
+  "packages/shared/src/types.ts",
+  "packages/web/src/store/index.ts"
+];
+var TOOL_COMMANDS = [
+  "pnpm -r typecheck",
+  "pnpm --filter @solix/web build",
+  "git status -sb",
+  "cargo test --workspace",
+  "curl -s http://127.0.0.1:4242/api/health"
+];
+var STATUS_PLAN = [
+  ...Array(5).fill("active"),
+  ...Array(3).fill("awaiting_permission"),
+  ...Array(2).fill("awaiting_input"),
+  ...Array(1).fill("error"),
+  ...Array(1).fill("plan_review"),
+  ...Array(18).fill("idle")
+];
+async function richSeed(base, demoRootCwd) {
+  console.log(`[solix demo] seeding ${STATUS_PLAN.length} sessions across ${PROJECTS.length} projects\u2026`);
+  const advisors2 = await getJson(base, "/api/advisors") ?? [];
+  for (const a of advisors2) {
+    await postJson(base, `/api/advisors/${encodeURIComponent(a.id)}/enable`);
+  }
+  console.log(`[solix demo] enabled ${advisors2.length} advisors`);
+  const sessions = [];
+  let pid = 9e4;
+  for (let i = 0; i < STATUS_PLAN.length; i++) {
+    const projectName = PROJECTS[i % PROJECTS.length];
+    const cwd = join(demoRootCwd, projectName);
+    const status = STATUS_PLAN[i];
+    const id = `demo-${String(i).padStart(2, "0")}-${projectName}`;
+    const model = MODELS[i % MODELS.length];
+    sessions.push({ id, pid, cwd, projectName, status });
+    await postEvent(base, {
       event: "session_start",
+      pid,
+      cwd,
+      ts: ts(),
+      payload: { session_id: id, model }
+    });
+    pid += 1;
+  }
+  await sleep(120);
+  for (const s of sessions) {
+    const prompt = randomChoice(PROMPTS);
+    if (s.status === "active" || s.status === "idle" || s.status === "awaiting_input") {
+      await postEvent(base, {
+        event: "user_prompt_submit",
+        pid: s.pid,
+        cwd: s.cwd,
+        ts: ts(),
+        payload: { session_id: s.id, prompt }
+      });
+    }
+    if (s.status === "idle") {
+      await postEvent(base, {
+        event: "stop",
+        pid: s.pid,
+        cwd: s.cwd,
+        ts: ts(),
+        payload: { session_id: s.id }
+      });
+    }
+    if (s.status === "awaiting_permission") {
+      await postEvent(base, {
+        event: "notification",
+        pid: s.pid,
+        cwd: s.cwd,
+        ts: ts(),
+        payload: {
+          session_id: s.id,
+          tool_name: "Bash",
+          tool_input: { command: "git push origin main" },
+          message: "Permission for git push"
+        }
+      });
+    }
+  }
+  const active = sessions.filter((s) => s.status === "active");
+  for (const s of active) {
+    await postEvent(base, {
+      event: "pre_tool_file",
       pid: s.pid,
       cwd: s.cwd,
       ts: ts(),
-      payload: s.payload
+      payload: {
+        session_id: s.id,
+        tool_name: "Read",
+        tool_input: { file_path: randomChoice(TOOL_FILES) }
+      }
     });
+    await sleep(40);
   }
-  await sleep(150);
-  for (const s of sessions.slice(0, 2)) {
-    await postEvent({
-      event: "user_prompt_submit",
+  for (const s of active.slice(0, 2)) {
+    await postEvent(base, {
+      event: "pre_tool_task",
       pid: s.pid,
       cwd: s.cwd,
       ts: ts(),
-      payload: { session_id: s.id, prompt: s.prompt }
+      payload: { session_id: s.id }
     });
   }
-  await sleep(100);
-  for (const t of sessions[0].tools) {
-    if (t.tool === "Bash") {
-      await postEvent({
-        event: "pre_tool_bash",
-        pid: sessions[0].pid,
-        cwd: sessions[0].cwd,
+  if (active[0]) {
+    await postJson(base, `/api/sessions/${active[0].id}/context`, { pct: 62 });
+  }
+  if (active[1]) {
+    await postJson(base, `/api/sessions/${active[1].id}/context`, { pct: 89 });
+  }
+  console.log(`[solix demo] seed complete:`);
+  console.log(`  \u2022 ${sessions.length} sessions across ${PROJECTS.length} projects`);
+  console.log(`  \u2022 ${advisors2.length} advisors enabled`);
+  console.log(`  \u2022 status mix: 5 active, 18 idle, 3 awaiting_permission, 2 awaiting_input, 1 error, 1 plan_review`);
+  console.log(`  \u2022 2 subagent moons, 1 high-context flare`);
+  return { sessions, advisorIds: advisors2.map((a) => a.id) };
+}
+function startTicker(base, state) {
+  const intervals = [];
+  const activeIds = new Set(
+    state.sessions.filter((s) => s.status === "active").map((s) => s.id)
+  );
+  const idleIds = new Set(
+    state.sessions.filter((s) => s.status === "idle").map((s) => s.id)
+  );
+  const byId = new Map(state.sessions.map((s) => [s.id, s]));
+  intervals.push(
+    setInterval(() => {
+      const candidates = [...activeIds];
+      if (candidates.length === 0) return;
+      const id = randomChoice(candidates);
+      const s = byId.get(id);
+      if (!s) return;
+      const useBash = Math.random() < 0.4;
+      void postEvent(base, {
+        event: useBash ? "pre_tool_bash" : "pre_tool_file",
+        pid: s.pid,
+        cwd: s.cwd,
         ts: ts(),
-        payload: {
-          session_id: sessions[0].id,
-          command: t.cmd
+        payload: useBash ? { session_id: s.id, command: randomChoice(TOOL_COMMANDS) } : {
+          session_id: s.id,
+          tool_name: Math.random() < 0.5 ? "Read" : "Edit",
+          tool_input: { file_path: randomChoice(TOOL_FILES) }
         }
       });
-    } else {
-      await postEvent({
-        event: "pre_tool_file",
-        pid: sessions[0].pid,
-        cwd: sessions[0].cwd,
+    }, TICKER_COMET_MS)
+  );
+  intervals.push(
+    setInterval(() => {
+      if (Math.random() < 0.5 && idleIds.size > 0) {
+        const id = randomChoice([...idleIds]);
+        const s = byId.get(id);
+        if (!s) return;
+        idleIds.delete(id);
+        activeIds.add(id);
+        void postEvent(base, {
+          event: "user_prompt_submit",
+          pid: s.pid,
+          cwd: s.cwd,
+          ts: ts(),
+          payload: { session_id: id, prompt: randomChoice(PROMPTS) }
+        });
+      } else if (activeIds.size > 1) {
+        const id = randomChoice([...activeIds]);
+        const s = byId.get(id);
+        if (!s) return;
+        activeIds.delete(id);
+        idleIds.add(id);
+        void postEvent(base, {
+          event: "stop",
+          pid: s.pid,
+          cwd: s.cwd,
+          ts: ts(),
+          payload: { session_id: id }
+        });
+      }
+    }, TICKER_PROMOTE_MS)
+  );
+  intervals.push(
+    setInterval(() => {
+      const actives = [...activeIds];
+      if (actives.length < 2) return;
+      const finisher = byId.get(randomChoice(actives));
+      const starter = byId.get(
+        randomChoice(actives.filter((id) => id !== finisher.id))
+      );
+      void postEvent(base, {
+        event: "stop",
+        pid: finisher.pid,
+        cwd: finisher.cwd,
+        ts: ts(),
+        payload: { session_id: finisher.id }
+      });
+      void postEvent(base, {
+        event: "user_prompt_submit",
+        pid: starter.pid,
+        cwd: starter.cwd,
+        ts: ts(),
+        payload: { session_id: starter.id, prompt: randomChoice(PROMPTS) }
+      });
+    }, TICKER_MISSION_MS)
+  );
+  intervals.push(
+    setInterval(() => {
+      const actives = [...activeIds];
+      if (actives.length === 0) return;
+      const s = byId.get(randomChoice(actives));
+      if (!s) return;
+      void postEvent(base, {
+        event: "notification",
+        pid: s.pid,
+        cwd: s.cwd,
         ts: ts(),
         payload: {
-          session_id: sessions[0].id,
-          tool_name: t.tool,
-          tool_input: { file_path: t.file }
+          session_id: s.id,
+          tool_name: "Bash",
+          tool_input: { command: "rm -rf node_modules" },
+          message: "Permission for destructive shell command"
         }
       });
+    }, TICKER_PERMISSION_MS)
+  );
+  intervals.push(
+    setInterval(() => {
+      if (state.advisorIds.length === 0 || activeIds.size === 0) return;
+      const advisorId = randomChoice(state.advisorIds);
+      const targetSessionId = randomChoice([...activeIds]);
+      void postJson(
+        base,
+        `/api/advisors/${encodeURIComponent(advisorId)}/invoke`,
+        {
+          targetSessionId,
+          prompt: "Spot-check this session before the next mission."
+        }
+      );
+    }, TICKER_ADVISOR_MS)
+  );
+  return () => {
+    for (const i of intervals) clearInterval(i);
+  };
+}
+function registerTeardown(opts) {
+  let torn = false;
+  const onSignal = (sig) => {
+    if (torn) return;
+    torn = true;
+    console.log(`
+[solix demo] received ${sig} \u2014 tearing down\u2026`);
+    if (opts.stopTicker) opts.stopTicker();
+    if (opts.child) {
+      try {
+        opts.child.kill();
+      } catch {
+      }
+    }
+    if (!opts.keep) {
+      for (const p of [DEMO_DB_PATH, `${DEMO_DB_PATH}-shm`, `${DEMO_DB_PATH}-wal`, DEMO_PID_PATH]) {
+        try {
+          if (existsSync(p)) unlinkSync(p);
+        } catch {
+        }
+      }
+      console.log(`[solix demo] sandbox cleaned up.`);
+    } else {
+      console.log(`[solix demo] --keep set; ${DEMO_DB_PATH} preserved.`);
     }
-    await sleep(80);
+    process.exit(0);
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+}
+async function tryOpenBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+  try {
+    const child = spawn(cmd, [url], { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
   }
-  await postEvent({
-    event: "pre_tool_task",
-    pid: sessions[1].pid,
-    cwd: sessions[1].cwd,
-    ts: ts(),
-    payload: { session_id: sessions[1].id }
-  });
-  await postEvent({
-    event: "notification",
-    pid: sessions[2].pid,
-    cwd: sessions[2].cwd,
-    ts: ts(),
-    payload: {
-      session_id: sessions[2].id,
-      tool_name: "Bash",
-      tool_input: { command: "git push origin main" },
-      message: "Permission for git push"
+}
+async function demoCmd(opts = {}) {
+  const preferredPort = opts.port ?? 4242;
+  const demoRootCwd = opts.cwd ?? join(homedir(), "demo-projects");
+  let boot = null;
+  if (opts.noServer) {
+    if (!await waitForServer(preferredPort, 1e3)) {
+      console.error(
+        `[solix demo] --no-server set but nothing is listening on ${preferredPort}. Start a server first.`
+      );
+      process.exitCode = 1;
+      return;
     }
-  });
-  await fetch(`${BASE2}/api/sessions/demo-a/context`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ pct: 62 })
-  });
-  await fetch(`${BASE2}/api/sessions/demo-b/context`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ pct: 87 })
-  });
-  await pin("compass");
-  console.log(`[solix demo] seeded:`);
-  console.log(`  \u2022 3 user planets (opus / sonnet / haiku)`);
-  console.log(`  \u2022 1 active mission with tool-call comets`);
-  console.log(`  \u2022 1 subagent moon`);
-  console.log(`  \u2022 1 planet awaiting permission (red flare)`);
-  console.log(`  \u2022 1 planet at 87% context (orange flare)`);
-  console.log(`  \u2022 Compass pinned (always-on)`);
-  console.log(`[solix demo] open ${BASE2} to see it.`);
+    boot = { child: null, port: preferredPort, base: baseUrl(preferredPort) };
+  } else {
+    boot = await bootSandbox(preferredPort);
+    if (!boot) {
+      process.exitCode = 1;
+      return;
+    }
+    console.log(
+      `[solix demo] server up at ${boot.base} (sandbox DB at ${DEMO_DB_PATH})`
+    );
+  }
+  const seed = await richSeed(boot.base, demoRootCwd);
+  console.log(`[solix demo] open ${boot.base} to see the galaxy.`);
+  void tryOpenBrowser(boot.base);
+  if (opts.noTicker) {
+    console.log(
+      `[solix demo] --no-ticker set; static snapshot only. Exiting.`
+    );
+    return;
+  }
   console.log(
-    `[solix demo] in ~3s: Compass will be invoked on demo-a (watch for the toast + Audit tab row).`
+    `[solix demo] live ticker running. Press Ctrl+C to stop and tear down.`
   );
-  await sleep(3e3);
-  await fetch(`${BASE2}/api/advisors/compass/invoke`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      targetSessionId: "demo-a",
-      prompt: "Review the orbital math refactor before merging"
-    })
+  const stopTicker = startTicker(boot.base, seed);
+  registerTeardown({
+    child: boot.child,
+    stopTicker,
+    keep: opts.keep ?? false
+  });
+  await new Promise(() => {
   });
-  console.log(`[solix demo] Compass invoked. Demo complete.`);
 }
 
 // src/doctor.ts
-import { existsSync as existsSync2, readdirSync, statSync } from "fs";
+import { existsSync as existsSync3, readdirSync, statSync } from "fs";
 import { join as join3 } from "path";
 
 // src/paths.ts
 import { homedir as homedir2 } from "os";
-import { existsSync } from "fs";
-import { join as join2, dirname } from "path";
-import { fileURLToPath } from "url";
-var SOLIX_HOME = process.env.SOLIX_HOME ?? join2(homedir2(), ".solix");
-var HOOKS_DIR = join2(SOLIX_HOME, "hooks");
-var SOLIX_SKILLS_DIR = join2(SOLIX_HOME, "skills");
+import { existsSync as existsSync2 } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var SOLIX_HOME2 = process.env.SOLIX_HOME ?? join2(homedir2(), ".solix");
+var HOOKS_DIR = join2(SOLIX_HOME2, "hooks");
+var SOLIX_SKILLS_DIR = join2(SOLIX_HOME2, "skills");
+var SOLIX_TOKEN_FILE = join2(SOLIX_HOME2, "token");
 var CLAUDE_DIR = join2(homedir2(), ".claude");
 var CLAUDE_SETTINGS = join2(CLAUDE_DIR, "settings.json");
 var CLAUDE_BACKUP = join2(CLAUDE_DIR, "settings.solix.backup.json");
@@ -262,38 +594,40 @@ var HOOK_NAMES = [
   "notification"
 ];
 function packagedHooksDir() {
-  const here = dirname(fileURLToPath(import.meta.url));
+  const here = dirname2(fileURLToPath2(import.meta.url));
   const candidates = [
     join2(here, "hooks"),
     join2(here, "..", "hooks"),
     join2(here, "..", "..", "hooks")
   ];
   for (const p of candidates) {
-    if (existsSync(join2(p, "session-start.sh"))) return p;
+    if (existsSync2(join2(p, "session-start.sh"))) return p;
   }
   return candidates[0];
 }
 function packagedAgentsDir() {
-  const here = dirname(fileURLToPath(import.meta.url));
+  const here = dirname2(fileURLToPath2(import.meta.url));
   const candidates = [
+    join2(here, "agents"),
     join2(here, "..", "..", "agents"),
     join2(here, "..", "..", "..", "agents"),
     join2(here, "..", "..", "..", "..", "packages", "agents")
   ];
   for (const p of candidates) {
-    if (existsSync(join2(p, "manifest.json"))) return p;
+    if (existsSync2(join2(p, "manifest.json"))) return p;
   }
   return candidates[0];
 }
 function packagedSkillsDir() {
-  const here = dirname(fileURLToPath(import.meta.url));
+  const here = dirname2(fileURLToPath2(import.meta.url));
   const candidates = [
+    join2(here, "skills"),
     join2(here, "..", "..", "skills"),
     join2(here, "..", "..", "..", "skills"),
     join2(here, "..", "..", "..", "..", "packages", "skills")
   ];
   for (const p of candidates) {
-    if (existsSync(p)) return p;
+    if (existsSync2(p)) return p;
   }
   return candidates[0];
 }
@@ -394,15 +728,15 @@ async function doctor() {
     detail: `v${nodeVersion}`
   });
   checks.push({
-    ok: existsSync2(SOLIX_HOME),
+    ok: existsSync3(SOLIX_HOME2),
     label: "Solix home directory",
-    detail: SOLIX_HOME
+    detail: SOLIX_HOME2
   });
   let allHooksPresent = true;
   const missing = [];
   for (const name of HOOK_NAMES) {
     const p = join3(HOOKS_DIR, `${name}.sh`);
-    if (!existsSync2(p)) {
+    if (!existsSync3(p)) {
       allHooksPresent = false;
       missing.push(name);
       continue;
@@ -420,17 +754,17 @@ async function doctor() {
     detail: allHooksPresent ? `${HOOK_NAMES.length} scripts in ${HOOKS_DIR}` : `missing: ${missing.join(", ")}`
   });
   checks.push({
-    ok: existsSync2(CLAUDE_SETTINGS),
+    ok: existsSync3(CLAUDE_SETTINGS),
     label: "Claude settings.json present",
     detail: CLAUDE_SETTINGS
   });
   checks.push({
-    ok: existsSync2(CLAUDE_BACKUP),
+    ok: existsSync3(CLAUDE_BACKUP),
     label: "Backup of settings.json",
-    detail: existsSync2(CLAUDE_BACKUP) ? CLAUDE_BACKUP : "not yet created"
+    detail: existsSync3(CLAUDE_BACKUP) ? CLAUDE_BACKUP : "not yet created"
   });
   let advisorCount = 0;
-  if (existsSync2(CLAUDE_AGENTS_DIR)) {
+  if (existsSync3(CLAUDE_AGENTS_DIR)) {
     try {
       advisorCount = readdirSync(CLAUDE_AGENTS_DIR).filter(
         (f) => f.endsWith(".md")
@@ -445,7 +779,7 @@ async function doctor() {
     detail: advisorCount > 0 ? `${advisorCount} agents in ${CLAUDE_AGENTS_DIR}` : "none yet \u2014 run `solix install`"
   });
   let skillCount = 0;
-  if (existsSync2(SOLIX_SKILLS_DIR)) {
+  if (existsSync3(SOLIX_SKILLS_DIR)) {
     try {
       skillCount = readdirSync(SOLIX_SKILLS_DIR).filter((entry) => {
         try {
@@ -486,11 +820,11 @@ async function doctor() {
 }
 
 // src/galaxy.ts
-import { readFileSync, writeFileSync } from "fs";
-var PORT3 = process.env.SOLIX_PORT ?? "4242";
-var BASE3 = `http://127.0.0.1:${PORT3}`;
+import { readFileSync as readFileSync2, writeFileSync } from "fs";
+var PORT2 = process.env.SOLIX_PORT ?? "4242";
+var BASE2 = `http://127.0.0.1:${PORT2}`;
 async function api2(path, init) {
-  const res = await fetch(`${BASE3}${path}`, init);
+  const res = await fetch(`${BASE2}${path}`, init);
   if (!res.ok) {
     const text = await res.text().catch(() => "");
     throw new Error(`HTTP ${res.status} on ${path}: ${text}`);
@@ -517,7 +851,7 @@ async function exportGalaxyCmd(outFile, opts = {}) {
 }
 async function publishGalaxyCmd(slug, opts = {}) {
   try {
-    const res = await fetch(`${BASE3}/api/galaxy/publish`, {
+    const res = await fetch(`${BASE2}/api/galaxy/publish`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ slug, ...opts })
@@ -542,7 +876,7 @@ async function publishGalaxyCmd(slug, opts = {}) {
 async function installFromRegistryCmd(slug) {
   try {
     const res = await fetch(
-      `${BASE3}/api/galaxy/registry/${encodeURIComponent(slug)}/install`,
+      `${BASE2}/api/galaxy/registry/${encodeURIComponent(slug)}/install`,
       { method: "POST" }
     );
     const data = await res.json();
@@ -567,7 +901,7 @@ async function importGalaxyCmd(fileOrUrl) {
     if (fileOrUrl.startsWith("http://") || fileOrUrl.startsWith("https://")) {
       body = JSON.stringify({ url: fileOrUrl });
     } else {
-      const text = readFileSync(fileOrUrl, "utf8");
+      const text = readFileSync2(fileOrUrl, "utf8");
       body = text;
     }
     const res = await api2(`/api/galaxy/import`, {
@@ -593,19 +927,20 @@ async function importGalaxyCmd(fileOrUrl) {
 import {
   copyFileSync,
   cpSync,
-  existsSync as existsSync3,
-  mkdirSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   statSync as statSync2,
   writeFileSync as writeFileSync2,
   chmodSync
 } from "fs";
+import { randomBytes } from "crypto";
 import { join as join4 } from "path";
 function readSettings() {
-  if (!existsSync3(CLAUDE_SETTINGS)) return {};
+  if (!existsSync4(CLAUDE_SETTINGS)) return {};
   try {
-    const txt = readFileSync2(CLAUDE_SETTINGS, "utf8");
+    const txt = readFileSync3(CLAUDE_SETTINGS, "utf8");
     return JSON.parse(txt);
   } catch (err) {
     console.warn(`[solix] could not parse ${CLAUDE_SETTINGS}: ${String(err)}`);
@@ -654,10 +989,19 @@ function mergeHooks(existing, solix) {
   }
   return merged;
 }
+function ensureToken() {
+  if (existsSync4(SOLIX_TOKEN_FILE)) return;
+  const token = randomBytes(24).toString("hex");
+  writeFileSync2(SOLIX_TOKEN_FILE, token, { mode: 384 });
+  try {
+    chmodSync(SOLIX_TOKEN_FILE, 384);
+  } catch {
+  }
+}
 function installHookScripts() {
-  mkdirSync(HOOKS_DIR, { recursive: true });
+  mkdirSync2(HOOKS_DIR, { recursive: true });
   const src = packagedHooksDir();
-  if (!existsSync3(src)) {
+  if (!existsSync4(src)) {
     throw new Error(
       `Solix hook scripts not found at ${src}. Did the package build correctly?`
     );
@@ -671,19 +1015,19 @@ function installHookScripts() {
 }
 function installAdvisorAgents() {
   const src = packagedAgentsDir();
-  if (!existsSync3(src)) {
+  if (!existsSync4(src)) {
     console.warn(`[solix] no advisors/ directory at ${src}; skipping`);
     return 0;
   }
   const manifestPath = join4(src, "manifest.json");
-  if (!existsSync3(manifestPath)) return 0;
-  const manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
-  mkdirSync(CLAUDE_AGENTS_DIR, { recursive: true });
+  if (!existsSync4(manifestPath)) return 0;
+  const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  mkdirSync2(CLAUDE_AGENTS_DIR, { recursive: true });
   let copied = 0;
   for (const a of manifest.advisors) {
     const from = join4(src, a.agentMd);
     const to = join4(CLAUDE_AGENTS_DIR, a.agentMd);
-    if (!existsSync3(from)) continue;
+    if (!existsSync4(from)) continue;
     copyFileSync(from, to);
     copied += 1;
   }
@@ -691,8 +1035,8 @@ function installAdvisorAgents() {
 }
 function installSolixSkills() {
   const src = packagedSkillsDir();
-  if (!existsSync3(src)) return 0;
-  mkdirSync(SOLIX_SKILLS_DIR, { recursive: true });
+  if (!existsSync4(src)) return 0;
+  mkdirSync2(SOLIX_SKILLS_DIR, { recursive: true });
   let copied = 0;
   for (const entry of readdirSync2(src)) {
     const fromDir = join4(src, entry);
@@ -710,15 +1054,16 @@ function installSolixSkills() {
   return copied;
 }
 function install(opts = {}) {
-  mkdirSync(SOLIX_HOME, { recursive: true });
-  mkdirSync(CLAUDE_DIR, { recursive: true });
+  mkdirSync2(SOLIX_HOME2, { recursive: true });
+  mkdirSync2(CLAUDE_DIR, { recursive: true });
   const existing = readSettings();
-  if (existsSync3(CLAUDE_SETTINGS) && !existsSync3(CLAUDE_BACKUP)) {
+  if (existsSync4(CLAUDE_SETTINGS) && !existsSync4(CLAUDE_BACKUP)) {
     copyFileSync(CLAUDE_SETTINGS, CLAUDE_BACKUP);
     console.log(`[solix] backed up settings.json -> ${CLAUDE_BACKUP}`);
-  } else if (opts.force && existsSync3(CLAUDE_SETTINGS)) {
+  } else if (opts.force && existsSync4(CLAUDE_SETTINGS)) {
     copyFileSync(CLAUDE_SETTINGS, CLAUDE_BACKUP);
   }
+  ensureToken();
   installHookScripts();
   console.log(`[solix] installed hook scripts in ${HOOKS_DIR}`);
   const advisorsCopied = installAdvisorAgents();
@@ -742,8 +1087,8 @@ function install(opts = {}) {
 // src/install-shim.ts
 import {
   appendFileSync,
-  existsSync as existsSync4,
-  readFileSync as readFileSync3,
+  existsSync as existsSync5,
+  readFileSync as readFileSync4,
   writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -753,19 +1098,19 @@ var BLOCK_END = "# <<< solix shim <<<";
 function detectShellRcPath() {
   const shell = process.env.SHELL ?? "";
   const home = homedir3();
-  if (shell.endsWith("zsh") || existsSync4(join5(home, ".zshrc"))) {
+  if (shell.endsWith("zsh") || existsSync5(join5(home, ".zshrc"))) {
     return join5(home, ".zshrc");
   }
-  if (shell.endsWith("bash") || existsSync4(join5(home, ".bashrc"))) {
+  if (shell.endsWith("bash") || existsSync5(join5(home, ".bashrc"))) {
     return join5(home, ".bashrc");
   }
-  if (existsSync4(join5(home, ".bash_profile"))) {
+  if (existsSync5(join5(home, ".bash_profile"))) {
     return join5(home, ".bash_profile");
   }
   return null;
 }
 function readRc(rcPath) {
-  return existsSync4(rcPath) ? readFileSync3(rcPath, "utf8") : "";
+  return existsSync5(rcPath) ? readFileSync4(rcPath, "utf8") : "";
 }
 function blockText() {
   return [
@@ -816,15 +1161,15 @@ function uninstallShim() {
 
 // src/run.ts
 import { createServer as createUnixServer } from "net";
-import { mkdirSync as mkdirSync2, unlinkSync } from "fs";
+import { mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 import { nanoid } from "nanoid";
-var PORT4 = process.env.SOLIX_PORT ?? "4242";
-var BASE4 = `http://127.0.0.1:${PORT4}`;
+var PORT3 = process.env.SOLIX_PORT ?? "4242";
+var BASE3 = `http://127.0.0.1:${PORT3}`;
 async function registerWithServer(payload) {
   try {
-    const res = await fetch(`${BASE4}/api/wrappers/register`, {
+    const res = await fetch(`${BASE3}/api/wrappers/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload),
@@ -838,7 +1183,7 @@ async function registerWithServer(payload) {
 async function unregisterFromServer(wrapperId) {
   try {
     await fetch(
-      `${BASE4}/api/wrappers/${encodeURIComponent(wrapperId)}/unregister`,
+      `${BASE3}/api/wrappers/${encodeURIComponent(wrapperId)}/unregister`,
       { method: "POST", signal: AbortSignal.timeout(800) }
     );
   } catch {
@@ -857,7 +1202,7 @@ async function runWrapped(args) {
   }
   const wrapperId = nanoid(10);
   const sockDir = join6(homedir4(), ".solix", "wrappers");
-  mkdirSync2(sockDir, { recursive: true });
+  mkdirSync3(sockDir, { recursive: true });
   const socketPath = join6(sockDir, `${wrapperId}.sock`);
   const cwd = process.cwd();
   const registered = await registerWithServer({ wrapperId, socketPath, cwd });
@@ -919,7 +1264,7 @@ async function runWrapped(args) {
     );
   } else {
     process.stderr.write(
-      `[solix run] note: Solix server not reachable at ${BASE4}; claude will run normally, but the UI composer won't be active.
+      `[solix run] note: Solix server not reachable at ${BASE3}; claude will run normally, but the UI composer won't be active.
 `
     );
   }
@@ -932,7 +1277,7 @@ async function runWrapped(args) {
     } catch {
     }
     try {
-      unlinkSync(socketPath);
+      unlinkSync2(socketPath);
     } catch {
     }
     if (registered) await unregisterFromServer(wrapperId);
@@ -960,10 +1305,10 @@ async function runWrapped(args) {
 }
 
 // src/skills.ts
-var PORT5 = process.env.SOLIX_PORT ?? "4242";
-var BASE5 = `http://127.0.0.1:${PORT5}`;
+var PORT4 = process.env.SOLIX_PORT ?? "4242";
+var BASE4 = `http://127.0.0.1:${PORT4}`;
 async function api3(path, init) {
-  const res = await fetch(`${BASE5}${path}`, init);
+  const res = await fetch(`${BASE4}${path}`, init);
   if (!res.ok) {
     const text = await res.text().catch(() => "");
     throw new Error(`HTTP ${res.status} on ${path}: ${text}`);
@@ -987,7 +1332,7 @@ async function listSkillsCmd() {
       );
     }
   } catch (err) {
-    console.error(`[solix] could not reach server at ${BASE5}: ${String(err)}`);
+    console.error(`[solix] could not reach server at ${BASE4}: ${String(err)}`);
     process.exitCode = 1;
   }
 }
@@ -1020,8 +1365,145 @@ async function installSkillCmd(id, projectId) {
   }
 }
 
+// src/schedule.ts
+var PORT5 = process.env.SOLIX_PORT ?? "4242";
+var BASE5 = `http://127.0.0.1:${PORT5}`;
+async function api4(path, init) {
+  const res = await fetch(`${BASE5}${path}`, {
+    ...init,
+    headers: { "content-type": "application/json", ...init?.headers ?? {} }
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`HTTP ${res.status} on ${path}: ${text}`);
+  }
+  return await res.json();
+}
+function unreachable(err) {
+  console.error(`[solix] could not reach server at ${BASE5}: ${String(err)}`);
+  console.error("[solix] is `solix start` running?");
+  process.exitCode = 1;
+}
+async function listSchedulesCmd() {
+  try {
+    const list = await api4("/api/schedules");
+    if (!list.length) {
+      console.log("No schedules. Add one with `solix schedule add`.");
+      return;
+    }
+    console.log("id        every  state   next run             prompt");
+    for (const s of list) {
+      const next = new Date(s.nextRunAt).toLocaleString();
+      const state = s.enabled ? "on " : "off";
+      console.log(
+        `  ${s.id.padEnd(8)} ${s.cron.padEnd(5)} [${state}] ${next.padEnd(20)} ${s.prompt.slice(0, 40)}`
+      );
+    }
+  } catch (err) {
+    unreachable(err);
+  }
+}
+async function addScheduleCmd(prompt, opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const cadence = opts.every ?? "1h";
+  try {
+    const s = await api4("/api/schedules", {
+      method: "POST",
+      body: JSON.stringify({ cwd, prompt, cadence, name: opts.name })
+    });
+    console.log(
+      `[solix] scheduled ${s.id} \u2014 every ${s.cron} in ${cwd}
+        next run: ${new Date(s.nextRunAt).toLocaleString()}`
+    );
+  } catch (err) {
+    unreachable(err);
+  }
+}
+async function toggle(id, enabled) {
+  try {
+    await api4(`/api/schedules/${encodeURIComponent(id)}/toggle`, {
+      method: "POST",
+      body: JSON.stringify({ enabled })
+    });
+    console.log(`[solix] schedule ${id} \u2192 ${enabled ? "enabled" : "disabled"}`);
+  } catch (err) {
+    unreachable(err);
+  }
+}
+var enableScheduleCmd = (id) => toggle(id, true);
+var disableScheduleCmd = (id) => toggle(id, false);
+async function removeScheduleCmd(id) {
+  try {
+    await api4(`/api/schedules/${encodeURIComponent(id)}`, { method: "DELETE" });
+    console.log(`[solix] removed schedule ${id}`);
+  } catch (err) {
+    unreachable(err);
+  }
+}
+
+// src/goals.ts
+var PORT6 = process.env.SOLIX_PORT ?? "4242";
+var BASE6 = `http://127.0.0.1:${PORT6}`;
+async function api5(path, init) {
+  const res = await fetch(`${BASE6}${path}`, {
+    ...init,
+    headers: { "content-type": "application/json", ...init?.headers ?? {} }
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`HTTP ${res.status} on ${path}: ${text}`);
+  }
+  return await res.json();
+}
+function unreachable2(err) {
+  console.error(`[solix] could not reach server at ${BASE6}: ${String(err)}`);
+  console.error("[solix] is `solix start` running?");
+  process.exitCode = 1;
+}
+async function listGoalsCmd() {
+  try {
+    const goals2 = await api5("/api/goals");
+    if (!goals2.length) {
+      console.log('No goals. Add one with `solix goal add "<name>"`.');
+      return;
+    }
+    console.log("id        color    name");
+    for (const g of goals2) {
+      console.log(`  ${g.id.padEnd(8)} ${g.color.padEnd(8)} ${g.name}`);
+    }
+  } catch (err) {
+    unreachable2(err);
+  }
+}
+async function addGoalCmd(name, opts) {
+  try {
+    const g = await api5("/api/goals", {
+      method: "POST",
+      body: JSON.stringify({
+        name,
+        description: opts.description,
+        color: opts.color
+      })
+    });
+    console.log(`[solix] created goal ${g.id} \u2014 "${g.name}" (${g.color})`);
+  } catch (err) {
+    unreachable2(err);
+  }
+}
+async function removeGoalCmd(id) {
+  try {
+    await api5(`/api/goals/${encodeURIComponent(id)}`, { method: "DELETE" });
+    console.log(`[solix] removed goal ${id}`);
+  } catch (err) {
+    unreachable2(err);
+  }
+}
+
 // ../server/src/create.ts
 import { serve } from "@hono/node-server";
+import { readFileSync as readFileSync9 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join15 } from "path";
 
 // ../server/src/broadcaster.ts
 var Broadcaster = class {
@@ -1055,14 +1537,14 @@ import Database from "better-sqlite3";
 // ../server/src/paths.ts
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
-import { mkdirSync as mkdirSync3 } from "fs";
-var SOLIX_HOME2 = process.env.SOLIX_HOME ?? join7(homedir5(), ".solix");
-var DB_PATH = join7(SOLIX_HOME2, "solix.db");
-var HOOKS_DIR2 = join7(SOLIX_HOME2, "hooks");
-var LOG_PATH = join7(SOLIX_HOME2, "solix.log");
+import { mkdirSync as mkdirSync4 } from "fs";
+var SOLIX_HOME3 = process.env.SOLIX_HOME ?? join7(homedir5(), ".solix");
+var DB_PATH = process.env.SOLIX_DB_PATH ?? join7(SOLIX_HOME3, "solix.db");
+var HOOKS_DIR2 = join7(SOLIX_HOME3, "hooks");
+var LOG_PATH = join7(SOLIX_HOME3, "solix.log");
 function ensureSolixHome() {
-  mkdirSync3(SOLIX_HOME2, { recursive: true });
-  mkdirSync3(HOOKS_DIR2, { recursive: true });
+  mkdirSync4(SOLIX_HOME3, { recursive: true });
+  mkdirSync4(HOOKS_DIR2, { recursive: true });
 }
 
 // ../server/src/db.ts
@@ -1197,6 +1679,14 @@ CREATE TABLE IF NOT EXISTS scheduled_tasks (
   last_run_at INTEGER,
   next_run_at INTEGER NOT NULL
 );
+
+CREATE TABLE IF NOT EXISTS goals (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  description TEXT,
+  color TEXT NOT NULL,
+  created_at INTEGER NOT NULL
+);
 `;
 var _db = null;
 function ensureColumn(db, table, column, ddl) {
@@ -1222,14 +1712,20 @@ function getDb() {
   ensureColumn(db, "sessions", "pr_check_status", "pr_check_status TEXT");
   ensureColumn(db, "advisors", "texture_pack", "texture_pack TEXT");
   ensureColumn(db, "missions", "error_summary", "error_summary TEXT");
+  ensureColumn(db, "sessions", "cost_usd", "cost_usd REAL DEFAULT 0");
+  ensureColumn(db, "sessions", "budget_usd", "budget_usd REAL");
+  ensureColumn(db, "sessions", "current_goal_id", "current_goal_id TEXT");
+  ensureColumn(db, "missions", "goal_id", "goal_id TEXT");
+  ensureColumn(db, "scheduled_tasks", "cwd", "cwd TEXT");
+  ensureColumn(db, "scheduled_tasks", "name", "name TEXT");
   _db = db;
   return db;
 }
 
 // ../server/src/http.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { dirname as dirname4, extname, join as join11, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync9, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
+import { dirname as dirname5, extname, join as join11, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { spawnSync } from "child_process";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
@@ -1311,7 +1807,10 @@ function rowToSession(row) {
     agentViewId: row.agent_view_id ?? void 0,
     agentViewSummary: row.agent_view_summary ?? void 0,
     prUrl: row.pr_url ?? void 0,
-    prCheckStatus: row.pr_check_status ?? void 0
+    prCheckStatus: row.pr_check_status ?? void 0,
+    costUsd: row.cost_usd ?? 0,
+    budgetUsd: row.budget_usd ?? void 0,
+    currentGoalId: row.current_goal_id ?? void 0
   };
 }
 function nextOrbitSlot(db, projectId) {
@@ -1392,7 +1891,8 @@ function upsertSession(db, input) {
     agentViewId: input.agentViewId,
     agentViewSummary: input.agentViewSummary,
     prUrl: input.prUrl,
-    prCheckStatus: input.prCheckStatus
+    prCheckStatus: input.prCheckStatus,
+    costUsd: 0
   };
 }
 function setAgentViewFields(db, sessionId, fields) {
@@ -1456,6 +1956,27 @@ function setSessionContextUsage(db, sessionId, pct) {
   ).run(clamped, ts2, sessionId);
   return getSession(db, sessionId);
 }
+function setSessionCost(db, sessionId, costUsd) {
+  const ts2 = now();
+  db.prepare(
+    `UPDATE sessions SET cost_usd = ?, updated_at = ? WHERE id = ?`
+  ).run(Math.max(0, costUsd), ts2, sessionId);
+  return getSession(db, sessionId);
+}
+function setSessionBudget(db, sessionId, budgetUsd) {
+  const ts2 = now();
+  db.prepare(
+    `UPDATE sessions SET budget_usd = ?, updated_at = ? WHERE id = ?`
+  ).run(budgetUsd, ts2, sessionId);
+  return getSession(db, sessionId);
+}
+function setSessionGoal(db, sessionId, goalId) {
+  const ts2 = now();
+  db.prepare(
+    `UPDATE sessions SET current_goal_id = ?, updated_at = ? WHERE id = ?`
+  ).run(goalId, ts2, sessionId);
+  return getSession(db, sessionId);
+}
 function getSession(db, sessionId) {
   const row = db.prepare("SELECT * FROM sessions WHERE id = ?").get(sessionId);
   return row ? rowToSession(row) : null;
@@ -1504,7 +2025,8 @@ function rowToMission(row) {
       toolCallCount: row.tool_call_count
     },
     filesTouched,
-    errorSummary: row.error_summary ?? void 0
+    errorSummary: row.error_summary ?? void 0,
+    goalId: row.goal_id ?? void 0
   };
 }
 function setMissionError(db, missionId, errorSummary) {
@@ -1520,14 +2042,14 @@ function shortNameFromPrompt(prompt) {
     (w) => w.replace(/[^a-zA-Z0-9-]/g, "").toLowerCase().replace(/^./, (c) => c.toUpperCase())
   ).filter(Boolean).join(" ") || "New Mission";
 }
-function startMission(db, sessionId, prompt) {
+function startMission(db, sessionId, prompt, goalId) {
   const id = nanoid2();
   const ts2 = now();
   const shortName = shortNameFromPrompt(prompt);
   db.prepare(
-    `INSERT INTO missions (id, session_id, prompt, short_name, status, started_at, files_touched_json)
-     VALUES (?, ?, ?, ?, 'active', ?, '[]')`
-  ).run(id, sessionId, prompt, shortName, ts2);
+    `INSERT INTO missions (id, session_id, prompt, short_name, status, started_at, files_touched_json, goal_id)
+     VALUES (?, ?, ?, ?, 'active', ?, '[]', ?)`
+  ).run(id, sessionId, prompt, shortName, ts2, goalId ?? null);
   return {
     id,
     sessionId,
@@ -1536,9 +2058,16 @@ function startMission(db, sessionId, prompt) {
     shortName,
     status: "active",
     metrics: { subagentCount: 0, toolCallCount: 0 },
-    filesTouched: []
+    filesTouched: [],
+    goalId
   };
 }
+function addMissionTokens(db, missionId, tokens) {
+  if (tokens <= 0) return;
+  db.prepare(
+    `UPDATE missions SET total_tokens = COALESCE(total_tokens, 0) + ? WHERE id = ?`
+  ).run(Math.round(tokens), missionId);
+}
 function completeMission(db, missionId, status = "completed") {
   const ts2 = now();
   const row = db.prepare("SELECT * FROM missions WHERE id = ?").get(missionId);
@@ -1778,14 +2307,14 @@ function listAudit(db, opts = {}) {
 }
 
 // ../server/src/state/advisors.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname2, join as join8, resolve } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname3, join as join8, resolve } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function findAgentsDir() {
-  if (process.env.SOLIX_AGENTS_DIR && existsSync5(process.env.SOLIX_AGENTS_DIR)) {
+  if (process.env.SOLIX_AGENTS_DIR && existsSync6(process.env.SOLIX_AGENTS_DIR)) {
     return process.env.SOLIX_AGENTS_DIR;
   }
-  const here = dirname2(fileURLToPath2(import.meta.url));
+  const here = dirname3(fileURLToPath3(import.meta.url));
   const candidates = [
     // Bundled npm package: agents/ ships next to the bundled JS file.
     resolve(here, "agents"),
@@ -1795,17 +2324,17 @@ function findAgentsDir() {
     resolve(process.cwd(), "packages", "agents")
   ];
   for (const c of candidates) {
-    if (existsSync5(join8(c, "manifest.json"))) return c;
+    if (existsSync6(join8(c, "manifest.json"))) return c;
   }
   return candidates[0];
 }
 var AGENTS_DIR = findAgentsDir();
 function readManifest() {
   const path = join8(AGENTS_DIR, "manifest.json");
-  if (!existsSync5(path)) {
+  if (!existsSync6(path)) {
     return { version: 1, advisors: [] };
   }
-  return JSON.parse(readFileSync4(path, "utf8"));
+  return JSON.parse(readFileSync5(path, "utf8"));
 }
 function rowToAdvisor(row) {
   let requiredSkills = [];
@@ -1906,15 +2435,15 @@ function setAdvisorPinned(db, id, pinned, sessionId) {
   return getAdvisor(db, id);
 }
 function readAdvisorAgentMd(advisor) {
-  if (!existsSync5(advisor.agentMdPath)) {
+  if (!existsSync6(advisor.agentMdPath)) {
     return "";
   }
-  return readFileSync4(advisor.agentMdPath, "utf8");
+  return readFileSync5(advisor.agentMdPath, "utf8");
 }
 
 // ../server/src/state/wrappers.ts
 import { connect } from "net";
-import { existsSync as existsSync6, readdirSync as readdirSync3, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync3, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join9 } from "path";
 var wrappers = /* @__PURE__ */ new Map();
@@ -1937,12 +2466,12 @@ function listWrappers() {
 }
 function cleanupOrphanedSockets() {
   const dir = join9(homedir6(), ".solix", "wrappers");
-  if (!existsSync6(dir)) return 0;
+  if (!existsSync7(dir)) return 0;
   let removed = 0;
   for (const f of readdirSync3(dir)) {
     if (!f.endsWith(".sock")) continue;
     try {
-      unlinkSync2(join9(dir, f));
+      unlinkSync3(join9(dir, f));
       removed++;
     } catch {
     }
@@ -1963,7 +2492,7 @@ function claimWrapperForCwd(cwd) {
   return best;
 }
 function writeToWrapperSocket(socketPath, text) {
-  if (!existsSync6(socketPath)) return false;
+  if (!existsSync7(socketPath)) return false;
   try {
     const client = connect(socketPath);
     client.on("error", () => {
@@ -1980,6 +2509,138 @@ function writeToWrapperSocket(socketPath, text) {
   }
 }
 
+// ../server/src/state/schedules.ts
+import { nanoid as nanoid4 } from "nanoid";
+function rowToSchedule(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    cwd: row.cwd ?? "",
+    name: row.name ?? void 0,
+    prompt: row.prompt,
+    cron: row.cron,
+    enabled: row.enabled !== 0,
+    lastRunAt: row.last_run_at ?? void 0,
+    nextRunAt: row.next_run_at
+  };
+}
+function cadenceToMs(cadence) {
+  const m = cadence.trim().match(/^(\d+)\s*([mhd])$/i);
+  if (!m) return null;
+  const n = Number(m[1]);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const unit = m[2].toLowerCase();
+  const mult = unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return n * mult;
+}
+function nextRunFrom(fromMs, cadence) {
+  const ms = cadenceToMs(cadence);
+  return fromMs + (ms ?? 36e5);
+}
+function createSchedule(db, input) {
+  const project = ensureProject(db, input.cwd);
+  const id = nanoid4(8);
+  const ts2 = now();
+  const nextRun = nextRunFrom(ts2, input.cadence);
+  db.prepare(
+    `INSERT INTO scheduled_tasks
+       (id, project_id, cwd, name, prompt, cron, enabled, last_run_at, next_run_at)
+     VALUES (?, ?, ?, ?, ?, ?, 1, NULL, ?)`
+  ).run(id, project.id, input.cwd, input.name ?? null, input.prompt, input.cadence, nextRun);
+  return getSchedule(db, id);
+}
+function getSchedule(db, id) {
+  const row = db.prepare("SELECT * FROM scheduled_tasks WHERE id = ?").get(id);
+  return row ? rowToSchedule(row) : null;
+}
+function listSchedules(db) {
+  const rows = db.prepare("SELECT * FROM scheduled_tasks ORDER BY next_run_at ASC").all();
+  return rows.map(rowToSchedule);
+}
+function listDueSchedules(db, asOf) {
+  const rows = db.prepare(
+    `SELECT * FROM scheduled_tasks WHERE enabled = 1 AND next_run_at <= ?`
+  ).all(asOf);
+  return rows.map(rowToSchedule);
+}
+function setScheduleEnabled(db, id, enabled) {
+  db.prepare("UPDATE scheduled_tasks SET enabled = ? WHERE id = ?").run(
+    enabled ? 1 : 0,
+    id
+  );
+  return getSchedule(db, id);
+}
+function markScheduleRun(db, id) {
+  const sched = getSchedule(db, id);
+  if (!sched) return null;
+  const ts2 = now();
+  const next = nextRunFrom(ts2, sched.cron);
+  db.prepare(
+    "UPDATE scheduled_tasks SET last_run_at = ?, next_run_at = ? WHERE id = ?"
+  ).run(ts2, next, id);
+  return getSchedule(db, id);
+}
+function deleteSchedule(db, id) {
+  const res = db.prepare("DELETE FROM scheduled_tasks WHERE id = ?").run(id);
+  return res.changes > 0;
+}
+
+// ../server/src/state/goals.ts
+import { nanoid as nanoid5 } from "nanoid";
+var PALETTE = [
+  "#38bdf8",
+  // sky
+  "#a78bfa",
+  // violet
+  "#34d399",
+  // emerald
+  "#fbbf24",
+  // amber
+  "#f472b6",
+  // pink
+  "#f87171",
+  // red
+  "#22d3ee",
+  // cyan
+  "#c084fc"
+  // purple
+];
+function rowToGoal(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description ?? void 0,
+    color: row.color,
+    createdAt: row.created_at
+  };
+}
+function nextColor(db) {
+  const count = db.prepare("SELECT COUNT(*) AS n FROM goals").get().n;
+  return PALETTE[count % PALETTE.length];
+}
+function createGoal(db, input) {
+  const id = nanoid5(8);
+  const ts2 = now();
+  const color = input.color ?? nextColor(db);
+  db.prepare(
+    `INSERT INTO goals (id, name, description, color, created_at)
+     VALUES (?, ?, ?, ?, ?)`
+  ).run(id, input.name, input.description ?? null, color, ts2);
+  return { id, name: input.name, description: input.description, color, createdAt: ts2 };
+}
+function listGoals(db) {
+  const rows = db.prepare("SELECT * FROM goals ORDER BY created_at ASC").all();
+  return rows.map(rowToGoal);
+}
+function deleteGoal(db, id) {
+  db.prepare(
+    `UPDATE sessions SET current_goal_id = NULL WHERE current_goal_id = ?`
+  ).run(id);
+  db.prepare(`UPDATE missions SET goal_id = NULL WHERE goal_id = ?`).run(id);
+  const res = db.prepare("DELETE FROM goals WHERE id = ?").run(id);
+  return res.changes > 0;
+}
+
 // ../server/src/state/context.ts
 var MISSIONS_FOR_HANDOFF = 3;
 var DEFAULT_ASKS = {
@@ -2067,19 +2728,19 @@ function buildContextEnvelope(db, args) {
 }
 
 // ../server/src/state/skills.ts
-import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
-import { dirname as dirname3, join as join10, resolve as resolve2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { dirname as dirname4, join as join10, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { homedir as homedir7 } from "os";
 function findSolixSkillsDir() {
-  const here = dirname3(fileURLToPath3(import.meta.url));
+  const here = dirname4(fileURLToPath4(import.meta.url));
   const candidates = [
     resolve2(here, "..", "..", "..", "skills"),
     resolve2(here, "..", "..", "skills"),
     resolve2(process.cwd(), "packages", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync7(c)) return c;
+    if (existsSync8(c)) return c;
   }
   return candidates[0];
 }
@@ -2087,7 +2748,7 @@ var SOLIX_SKILLS_DIR2 = findSolixSkillsDir();
 var ANTHROPIC_SKILLS_DIR = join10(homedir7(), ".claude", "skills");
 function parseSkillManifest(manifestPath, fallbackId) {
   try {
-    const txt = readFileSync5(manifestPath, "utf8");
+    const txt = readFileSync6(manifestPath, "utf8");
     const match = txt.match(/^---\n([\s\S]*?)\n---/);
     let name = fallbackId;
     let description = "";
@@ -2136,7 +2797,7 @@ function discoverSkills(db) {
     { dir: SOLIX_SKILLS_DIR2, source: "solix" }
   ];
   for (const { dir, source } of sources) {
-    if (!existsSync7(dir)) continue;
+    if (!existsSync8(dir)) continue;
     for (const entry of readdirSync4(dir)) {
       const full = join10(dir, entry);
       let isDir = false;
@@ -2147,7 +2808,7 @@ function discoverSkills(db) {
       }
       if (!isDir) continue;
       const manifestPath = join10(full, "SKILL.md");
-      if (!existsSync7(manifestPath)) continue;
+      if (!existsSync8(manifestPath)) continue;
       const parsed = parseSkillManifest(manifestPath, entry);
       if (!parsed) continue;
       const id = `${source}:${parsed.id}`;
@@ -2172,8 +2833,8 @@ function getSkill(db, id) {
   return row ? rowToSkill(row) : null;
 }
 function readSkillManifest(skill) {
-  if (!existsSync7(skill.manifestPath)) return "";
-  return readFileSync5(skill.manifestPath, "utf8");
+  if (!existsSync8(skill.manifestPath)) return "";
+  return readFileSync6(skill.manifestPath, "utf8");
 }
 function recordSkillInstall(db, skillId, projectId) {
   const skill = getSkill(db, skillId);
@@ -2186,7 +2847,7 @@ function recordSkillInstall(db, skillId, projectId) {
 }
 
 // ../server/src/state/galaxy.ts
-import { nanoid as nanoid4 } from "nanoid";
+import { nanoid as nanoid6 } from "nanoid";
 function exportManifest(db, opts = {}) {
   const advisors2 = listAdvisors(db);
   const skills2 = listSkills(db);
@@ -2234,7 +2895,7 @@ function importManifest(db, manifest, sourceUrl) {
   db.prepare(
     `INSERT INTO galaxy_imports (id, source_url, manifest_json, imported_at)
      VALUES (?, ?, ?, ?)`
-  ).run(nanoid4(), sourceUrl ?? null, JSON.stringify(manifest), now());
+  ).run(nanoid6(), sourceUrl ?? null, JSON.stringify(manifest), now());
   return {
     advisorsEnabled: enabled,
     advisorsDisabled: disabled,
@@ -2295,7 +2956,7 @@ function snapshotExport(db, manifest) {
       return rowToVersion(existing);
     }
   }
-  const id = nanoid4();
+  const id = nanoid6();
   const ts2 = now();
   const ordinal = (last?.ordinal ?? 0) + 1;
   db.prepare(
@@ -2373,10 +3034,33 @@ function diffManifests(a, b) {
   };
 }
 
+// ../shared/src/pricing.ts
+var MODEL_PRICING = {
+  opus: { input: 15, output: 75, cacheRead: 1.5, cacheWrite: 18.75 },
+  sonnet: { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3.75 },
+  haiku: { input: 0.8, output: 4, cacheRead: 0.08, cacheWrite: 1 }
+};
+function pricingFor(model) {
+  const m = (model ?? "").toLowerCase();
+  if (m.includes("opus")) return MODEL_PRICING.opus;
+  if (m.includes("haiku")) return MODEL_PRICING.haiku;
+  return MODEL_PRICING.sonnet;
+}
+function costForUsage(model, usage) {
+  if (!usage) return 0;
+  const p = pricingFor(model);
+  const cost = ((usage.input_tokens ?? 0) * p.input + (usage.output_tokens ?? 0) * p.output + (usage.cache_read_input_tokens ?? 0) * p.cacheRead + (usage.cache_creation_input_tokens ?? 0) * p.cacheWrite) / 1e6;
+  return cost;
+}
+function totalTokens(usage) {
+  if (!usage) return 0;
+  return (usage.input_tokens ?? 0) + (usage.output_tokens ?? 0) + (usage.cache_read_input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0);
+}
+
 // ../server/src/cloud.ts
 var RegistryClient = class {
-  constructor(baseUrl = process.env.SOLIX_REGISTRY_URL ?? "", apiKey = process.env.SOLIX_REGISTRY_KEY) {
-    this.baseUrl = baseUrl;
+  constructor(baseUrl2 = process.env.SOLIX_REGISTRY_URL ?? "", apiKey = process.env.SOLIX_REGISTRY_KEY) {
+    this.baseUrl = baseUrl2;
     this.apiKey = apiKey;
   }
   baseUrl;
@@ -2446,6 +3130,42 @@ var RegistryClient = class {
   }
 };
 
+// ../server/src/origins.ts
+function isAllowedOrigin(origin) {
+  if (!origin) return true;
+  let hostname;
+  try {
+    hostname = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+  return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+}
+function isSafeFetchUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  const h = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (h === "localhost" || h === "::1" || h.endsWith(".localhost")) return false;
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const a = Number(m[1]);
+    const b = Number(m[2]);
+    if (a === 0 || a === 127 || a === 10) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+  }
+  if (h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80")) {
+    return false;
+  }
+  return true;
+}
+
 // ../server/src/http.ts
 function isAgentViewVersion(version) {
   if (!version) return false;
@@ -2462,14 +3182,44 @@ function isAgentViewVersion(version) {
 }
 function createHttpApp(opts) {
   const app = new Hono();
-  app.use("*", cors());
+  app.use(
+    "*",
+    cors({
+      origin: [
+        "http://127.0.0.1:4242",
+        "http://localhost:4242",
+        "http://127.0.0.1:4243",
+        "http://localhost:4243"
+      ]
+    })
+  );
+  app.use("*", async (c, next) => {
+    const method = c.req.method;
+    const mutating = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+    if (mutating && !isAllowedOrigin(c.req.header("origin"))) {
+      return c.json({ error: "cross-origin request refused" }, 403);
+    }
+    await next();
+  });
+  if (opts.token) {
+    const expected = opts.token;
+    const paths = ["/events", "/events/permission"];
+    for (const p of paths) {
+      app.use(p, async (c, next) => {
+        if (c.req.header("x-solix-token") !== expected) {
+          return c.json({ error: "unauthorized" }, 401);
+        }
+        await next();
+      });
+    }
+  }
   const registry = new RegistryClient();
   app.get(
     "/api/health",
     (c) => c.json({
       ok: true,
       service: "solix",
-      version: "1.0.0",
+      version: opts.version ?? "unknown",
       ts: Date.now()
     })
   );
@@ -2486,6 +3236,18 @@ function createHttpApp(opts) {
     }
     return c.json({ ok: true });
   });
+  app.post("/events/permission", async (c) => {
+    let body = null;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ decision: "allow" });
+    }
+    if (!body || !body.event) return c.json({ decision: "allow" });
+    const result = await opts.router.requestPermission(body);
+    const decision = result.timedOut ? "timeout" : result.approved ? "allow" : "deny";
+    return c.json({ decision });
+  });
   app.get("/api/projects", (c) => c.json(listProjects(opts.db)));
   app.get("/api/projects/:id/sessions", (c) => {
     const id = c.req.param("id");
@@ -2566,11 +3328,11 @@ function createHttpApp(opts) {
     return c.json({ ...a, agentMd: readAdvisorAgentMd(a) });
   });
   app.post("/api/advisors/:id/enable", (c) => {
-    const a = setAdvisorEnabled(opts.db, c.req.param("id"), true);
+    const a = opts.router.setAdvisorEnabled(c.req.param("id"), true);
     return c.json({ ok: Boolean(a), advisor: a });
   });
   app.post("/api/advisors/:id/disable", (c) => {
-    const a = setAdvisorEnabled(opts.db, c.req.param("id"), false);
+    const a = opts.router.setAdvisorEnabled(c.req.param("id"), false);
     return c.json({ ok: Boolean(a), advisor: a });
   });
   app.post("/api/advisors/:id/pin", (c) => {
@@ -2673,6 +3435,12 @@ function createHttpApp(opts) {
     let sourceUrl;
     if ("url" in body && typeof body.url === "string") {
       sourceUrl = body.url;
+      if (!isSafeFetchUrl(body.url)) {
+        return c.json(
+          { error: "import URL not allowed (must be a public http(s) address)" },
+          400
+        );
+      }
       try {
         const res = await fetch(body.url, {
           signal: AbortSignal.timeout(5e3)
@@ -2726,6 +3494,52 @@ function createHttpApp(opts) {
     return c.json({ ok: true });
   });
   app.get("/api/wrappers", (c) => c.json(listWrappers()));
+  app.get("/api/schedules", (c) => c.json(listSchedules(opts.db)));
+  app.post("/api/schedules", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.cwd || !body.prompt || !body.cadence) {
+      return c.json({ error: "cwd, prompt, cadence required" }, 400);
+    }
+    const schedule = createSchedule(opts.db, {
+      cwd: body.cwd,
+      prompt: body.prompt,
+      cadence: body.cadence,
+      name: body.name
+    });
+    opts.router.broadcastScheduleUpsert(schedule);
+    return c.json(schedule);
+  });
+  app.post("/api/schedules/:id/toggle", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const s = setScheduleEnabled(opts.db, c.req.param("id"), Boolean(body.enabled));
+    if (!s) return c.json({ error: "not found" }, 404);
+    opts.router.broadcastScheduleUpsert(s);
+    return c.json(s);
+  });
+  app.delete("/api/schedules/:id", (c) => {
+    const id = c.req.param("id");
+    const ok = deleteSchedule(opts.db, id);
+    if (ok) opts.router.broadcastScheduleRemove(id);
+    return c.json({ ok });
+  });
+  app.get("/api/goals", (c) => c.json(listGoals(opts.db)));
+  app.post("/api/goals", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.name) return c.json({ error: "name required" }, 400);
+    const goal = createGoal(opts.db, {
+      name: body.name,
+      description: body.description,
+      color: body.color
+    });
+    opts.router.broadcastGoalUpsert(goal);
+    return c.json(goal);
+  });
+  app.delete("/api/goals/:id", (c) => {
+    const id = c.req.param("id");
+    const ok = deleteGoal(opts.db, id);
+    if (ok) opts.router.broadcastGoalRemove(id);
+    return c.json({ ok });
+  });
   let preflightCache = null;
   app.get("/api/system/preflight", (c) => {
     if (preflightCache) return c.json(preflightCache);
@@ -2760,14 +3574,14 @@ function createHttpApp(opts) {
       const candidate = join11(webDist, safe === "/" ? "index.html" : safe);
       let filePath = candidate;
       try {
-        if (!existsSync8(filePath) || statSync4(filePath).isDirectory()) {
+        if (!existsSync9(filePath) || statSync4(filePath).isDirectory()) {
           filePath = join11(webDist, "index.html");
         }
       } catch {
         filePath = join11(webDist, "index.html");
       }
-      if (!existsSync8(filePath)) return c.notFound();
-      const data = readFileSync6(filePath);
+      if (!existsSync9(filePath)) return c.notFound();
+      const data = readFileSync7(filePath);
       return new Response(data, {
         headers: { "Content-Type": mimeFor(filePath) }
       });
@@ -2825,9 +3639,9 @@ function createHttpApp(opts) {
 }
 function findWebDist() {
   if (process.env.SOLIX_WEB_DIST) {
-    return existsSync8(process.env.SOLIX_WEB_DIST) ? process.env.SOLIX_WEB_DIST : null;
+    return existsSync9(process.env.SOLIX_WEB_DIST) ? process.env.SOLIX_WEB_DIST : null;
   }
-  const here = dirname4(fileURLToPath4(import.meta.url));
+  const here = dirname5(fileURLToPath5(import.meta.url));
   const candidates = [
     // Bundled npm package: web/ ships next to the bundled JS file.
     resolve3(here, "web"),
@@ -2838,7 +3652,7 @@ function findWebDist() {
     resolve3(process.cwd(), "packages", "web", "dist")
   ];
   for (const c of candidates) {
-    if (existsSync8(join11(c, "index.html"))) return c;
+    if (existsSync9(join11(c, "index.html"))) return c;
   }
   return null;
 }
@@ -2863,11 +3677,11 @@ function mimeFor(filePath) {
 }
 
 // ../server/src/launcher.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir8 } from "os";
 import { basename as basename3, join as join12 } from "path";
-import { nanoid as nanoid5 } from "nanoid";
+import { nanoid as nanoid7 } from "nanoid";
 function ensureWorktree(opts) {
   const repoRoot = (() => {
     const r = spawnSync2("git", ["rev-parse", "--show-toplevel"], {
@@ -2890,7 +3704,7 @@ function ensureWorktree(opts) {
   if (list.status === 0 && (list.stdout ?? "").includes(`worktree ${path}`)) {
     return { path, created: false };
   }
-  mkdirSync4(worktreesDir, { recursive: true });
+  mkdirSync5(worktreesDir, { recursive: true });
   const branchProbe = spawnSync2(
     "git",
     ["rev-parse", "--verify", "--quiet", `refs/heads/${opts.branch}`],
@@ -2909,6 +3723,53 @@ function ensureWorktree(opts) {
   return { path, created: true };
 }
 var FAKE_CLAUDE = process.env.SOLIX_FAKE_CLAUDE === "1";
+function buildSpawnEnv() {
+  const scrub = process.env.SOLIX_ENV_SCRUB === "1" || (process.env.SOLIX_SANDBOX_CMD ?? "").trim() !== "";
+  if (!scrub) return void 0;
+  const allow = [
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "LANG",
+    "LC_ALL",
+    "TERM",
+    "TMPDIR",
+    "TZ",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "SOLIX_HOME",
+    "SOLIX_HOST",
+    "SOLIX_PORT",
+    "SOLIX_GATE_ENABLED",
+    "SOLIX_GATE_POLICY",
+    "SOLIX_GATE_TIMEOUT"
+  ];
+  const extra = (process.env.SOLIX_ENV_PASSTHROUGH ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const keep = /* @__PURE__ */ new Set([...allow, ...extra]);
+  const env = {};
+  for (const k of keep) {
+    if (process.env[k] !== void 0) env[k] = process.env[k];
+  }
+  for (const k of Object.keys(process.env)) {
+    if (k.startsWith("ANTHROPIC_") || k.startsWith("CLAUDE_")) {
+      env[k] = process.env[k];
+    }
+  }
+  return env;
+}
+function sandboxWrap(file, args) {
+  const cmd = (process.env.SOLIX_SANDBOX_CMD ?? "").trim();
+  if (!cmd) return { file, args };
+  const parts = cmd.split(/\s+/);
+  const bin = parts[0];
+  return { file: bin, args: [...parts.slice(1), file, ...args] };
+}
 var Launcher = class {
   constructor(db, broadcaster) {
     this.db = db;
@@ -2938,15 +3799,17 @@ var Launcher = class {
       return this.pinSynthetic(advisor.id, advisor.codename, cwd);
     }
     try {
-      const child = spawn(
-        "claude",
-        ["--agent", advisor.id, "--no-tty"],
-        {
-          cwd,
-          stdio: ["pipe", "pipe", "pipe"],
-          detached: false
-        }
-      );
+      const spawnSpec = sandboxWrap("claude", [
+        "--agent",
+        advisor.id,
+        "--no-tty"
+      ]);
+      const child = spawn2(spawnSpec.file, spawnSpec.args, {
+        cwd,
+        stdio: ["pipe", "pipe", "pipe"],
+        detached: false,
+        env: buildSpawnEnv()
+      });
       const pid = child.pid;
       if (!pid) {
         this.broadcaster.broadcast({
@@ -2985,7 +3848,7 @@ var Launcher = class {
   }
   pinSynthetic(advisorId, codename, cwd) {
     const project = ensureProject(this.db, cwd);
-    const sessionId = `advisor-${advisorId}-${nanoid5(6)}`;
+    const sessionId = `advisor-${advisorId}-${nanoid7(6)}`;
     const fakePid = 1e5 + Math.floor(Math.random() * 1e5);
     const session = upsertSession(this.db, {
       id: sessionId,
@@ -3099,10 +3962,12 @@ var Launcher = class {
         cwd: spawnCwd,
         model: opts.model,
         initialPrompt: opts.initialPrompt,
-        worktreePath
+        worktreePath,
+        budgetUsd: opts.budgetUsd,
+        goalId: opts.goalId
       });
     }
-    if (!existsSync9(spawnCwd)) {
+    if (!existsSync10(spawnCwd)) {
       this.broadcaster.broadcast({
         type: "toast",
         level: "error",
@@ -3113,13 +3978,15 @@ var Launcher = class {
     const args = ["--print"];
     if (opts.model) args.push("--model", String(opts.model));
     args.push(opts.initialPrompt);
-    const sessionId = `task-${nanoid5(8)}`;
+    const sessionId = `task-${nanoid7(8)}`;
     return this.spawnPrint({
       sessionId,
       cwd: spawnCwd,
       args,
       isFollowUp: false,
-      worktreePath
+      worktreePath,
+      budgetUsd: opts.budgetUsd,
+      goalId: opts.goalId
     });
   }
   /**
@@ -3138,7 +4005,7 @@ var Launcher = class {
       });
       return { ok: true };
     }
-    if (!existsSync9(opts.cwd)) {
+    if (!existsSync10(opts.cwd)) {
       this.broadcaster.broadcast({
         type: "toast",
         level: "error",
@@ -3152,10 +4019,12 @@ var Launcher = class {
     args.push("--bg", opts.initialPrompt);
     let child;
     try {
-      child = spawn("claude", args, {
+      const spawnSpec = sandboxWrap("claude", args);
+      child = spawn2(spawnSpec.file, spawnSpec.args, {
         cwd: opts.cwd,
         stdio: ["ignore", "pipe", "pipe"],
-        detached: false
+        detached: false,
+        env: buildSpawnEnv()
       });
     } catch (err) {
       this.broadcaster.broadcast({
@@ -3199,6 +4068,15 @@ var Launcher = class {
       });
       return false;
     }
+    const full = getSession(this.db, sessionId);
+    if (full?.budgetUsd != null && full.costUsd >= full.budgetUsd) {
+      this.broadcaster.broadcast({
+        type: "toast",
+        level: "warn",
+        message: `Budget reached for ${full.name ?? sessionId.slice(0, 8)} ($${full.costUsd.toFixed(2)}/$${full.budgetUsd.toFixed(2)}). Raise the cap to continue.`
+      });
+      return false;
+    }
     if (FAKE_CLAUDE) {
       this.broadcaster.broadcast({
         type: "chat_delta",
@@ -3230,13 +4108,29 @@ var Launcher = class {
     }
     return void 0;
   }
+  /** Sprint M — budget cap recorded at launch for a cwd, if any. */
+  budgetForInternalCwd(cwd) {
+    for (const rec of this.internalTasks.values()) {
+      if (rec.cwd === cwd && rec.budgetUsd != null) return rec.budgetUsd;
+    }
+    return void 0;
+  }
+  /** Sprint M — goal recorded at launch for a cwd, if any. */
+  goalForInternalCwd(cwd) {
+    for (const rec of this.internalTasks.values()) {
+      if (rec.cwd === cwd && rec.goalId) return rec.goalId;
+    }
+    return void 0;
+  }
   spawnPrint(opts) {
     let child;
     try {
-      child = spawn("claude", opts.args, {
+      const spawnSpec = sandboxWrap("claude", opts.args);
+      child = spawn2(spawnSpec.file, spawnSpec.args, {
         cwd: opts.cwd,
         stdio: ["ignore", "pipe", "pipe"],
-        detached: false
+        detached: false,
+        env: buildSpawnEnv()
       });
     } catch (err) {
       this.broadcaster.broadcast({
@@ -3251,7 +4145,9 @@ var Launcher = class {
     if (!opts.isFollowUp) {
       this.internalTasks.set(opts.sessionId, {
         cwd: opts.cwd,
-        worktreePath: opts.worktreePath
+        worktreePath: opts.worktreePath,
+        budgetUsd: opts.budgetUsd,
+        goalId: opts.goalId
       });
     }
     let stdout = "";
@@ -3297,7 +4193,7 @@ var Launcher = class {
   }
   launchSynthetic(opts) {
     const project = ensureProject(this.db, opts.cwd);
-    const sessionId = `task-${nanoid5(8)}`;
+    const sessionId = `task-${nanoid7(8)}`;
     const fakePid = 2e5 + Math.floor(Math.random() * 1e5);
     upsertSession(this.db, {
       id: sessionId,
@@ -3308,6 +4204,8 @@ var Launcher = class {
       model: opts.model ?? "sonnet",
       worktreePath: opts.worktreePath
     });
+    if (opts.budgetUsd != null) setSessionBudget(this.db, sessionId, opts.budgetUsd);
+    if (opts.goalId) setSessionGoal(this.db, sessionId, opts.goalId);
     const active = setSessionStatus(this.db, sessionId, "active");
     if (active)
       this.broadcaster.broadcast({ type: "session_upsert", session: active });
@@ -3343,12 +4241,12 @@ var Launcher = class {
 };
 
 // ../server/src/router.ts
-import { nanoid as nanoid7 } from "nanoid";
+import { nanoid as nanoid9 } from "nanoid";
 
 // ../server/src/state/toolcalls.ts
-import { nanoid as nanoid6 } from "nanoid";
+import { nanoid as nanoid8 } from "nanoid";
 function recordToolCall(db, input) {
-  const id = nanoid6();
+  const id = nanoid8();
   const ts2 = now();
   const status = input.status ?? "running";
   db.prepare(
@@ -3450,6 +4348,8 @@ var EventRouter = class {
     const sessionId = this.extractSessionId(event);
     const advisorRole = this.launcher?.advisorRoleForPid(event.pid);
     const worktreePath = this.launcher?.worktreePathForInternalCwd(event.cwd);
+    const launchBudget = this.launcher?.budgetForInternalCwd(event.cwd);
+    const launchGoal = this.launcher?.goalForInternalCwd(event.cwd);
     const wrapper = claimWrapperForCwd(event.cwd);
     const session = upsertSession(this.db, {
       id: sessionId,
@@ -3465,7 +4365,14 @@ var EventRouter = class {
       wrapperSocketPath: wrapper?.socketPath
     });
     if (wrapper) bindWrapperToSession(wrapper.wrapperId, session.id);
-    this.broadcaster.broadcast({ type: "session_upsert", session });
+    let enriched = session;
+    if (launchBudget != null) {
+      enriched = setSessionBudget(this.db, session.id, launchBudget) ?? enriched;
+    }
+    if (launchGoal) {
+      enriched = setSessionGoal(this.db, session.id, launchGoal) ?? enriched;
+    }
+    this.broadcaster.broadcast({ type: "session_upsert", session: enriched });
     if (!session.parentSessionId) {
       this.transcripts?.startWatching(sessionId, event.cwd);
     }
@@ -3486,7 +4393,7 @@ var EventRouter = class {
         model: this.extractModel(event)
       });
     }
-    const mission = startMission(this.db, sessionId, prompt);
+    const mission = startMission(this.db, sessionId, prompt, session.currentGoalId);
     const updated = setSessionMission(this.db, sessionId, mission.id);
     const active = updated ? setSessionStatus(this.db, sessionId, "active") : null;
     this.broadcaster.broadcast({ type: "mission_upsert", mission });
@@ -3530,7 +4437,7 @@ var EventRouter = class {
     const parentSessionId = this.extractSessionId(event);
     const parent = getSession(this.db, parentSessionId);
     if (!parent) return;
-    const subId = nanoid7();
+    const subId = nanoid9();
     const sub = upsertSession(this.db, {
       id: subId,
       pid: event.pid,
@@ -3607,7 +4514,7 @@ var EventRouter = class {
     const p = event.payload;
     const message = typeof p.message === "string" ? p.message : "Permission requested";
     const tool = typeof p.tool_name === "string" ? p.tool_name : "unknown";
-    const requestId = nanoid7();
+    const requestId = nanoid9();
     this.permissions.set(requestId, {
       requestId,
       sessionId,
@@ -3635,6 +4542,90 @@ var EventRouter = class {
       message: `Permission requested: ${message}`
     });
   }
+  /**
+   * Synchronous human-in-the-loop gate for the blocking PreToolUse path.
+   * Records the tool call (so the comet/timeline visuals still fire — the gate
+   * hook no longer POSTs to /events), broadcasts a permission_request, and
+   * returns a promise that resolves when a human answers via `permission_response`
+   * (reused unchanged) or when the server-side timeout fires.
+   */
+  requestPermission(event) {
+    const sessionId = this.extractSessionId(event);
+    const p = event.payload;
+    const { tool, args } = this.describeGatedTool(event.event, p);
+    const session = getSession(this.db, sessionId);
+    if (session) {
+      const toolCall = recordToolCall(this.db, {
+        sessionId,
+        missionId: session.currentMissionId,
+        tool,
+        args
+      });
+      if (event.event === "pre_tool_file" && session.currentMissionId && typeof args.file_path === "string" && args.file_path) {
+        addTouchedFile(this.db, session.currentMissionId, args.file_path);
+      }
+      this.broadcaster.broadcast({ type: "tool_call", toolCall });
+    }
+    const requestId = nanoid9();
+    const timeoutMs = Number(process.env.SOLIX_GATE_TIMEOUT_MS ?? 3e5);
+    return new Promise((resolve4) => {
+      const timer = setTimeout(() => {
+        const pending = this.permissions.get(requestId);
+        if (!pending) return;
+        this.permissions.delete(requestId);
+        const s = setSessionStatus(this.db, sessionId, "active");
+        if (s) this.broadcaster.broadcast({ type: "session_upsert", session: s });
+        resolve4({ approved: false, timedOut: true });
+      }, timeoutMs);
+      this.permissions.set(requestId, {
+        requestId,
+        sessionId,
+        tool,
+        args,
+        createdAt: Date.now(),
+        resolve: (approved) => resolve4({ approved, timedOut: false }),
+        timer
+      });
+      const updated = setSessionStatus(
+        this.db,
+        sessionId,
+        "awaiting_permission"
+      );
+      if (updated) {
+        this.broadcaster.broadcast({ type: "session_upsert", session: updated });
+      }
+      this.broadcaster.broadcast({
+        type: "permission_request",
+        sessionId,
+        tool,
+        args,
+        requestId
+      });
+      this.broadcaster.broadcast({
+        type: "toast",
+        level: "warn",
+        message: `Approval requested: ${tool}`
+      });
+    });
+  }
+  describeGatedTool(eventName, p) {
+    const toolInput = p.tool_input ?? {};
+    if (eventName === "pre_tool_bash") {
+      const command = typeof p.command === "string" ? p.command : typeof toolInput.command === "string" ? toolInput.command : "";
+      return { tool: "Bash", args: { command } };
+    }
+    if (eventName === "pre_tool_file") {
+      const tool2 = typeof p.tool_name === "string" ? p.tool_name : "File";
+      const filePath = typeof p.file_path === "string" ? p.file_path : typeof toolInput.file_path === "string" ? toolInput.file_path : "";
+      return { tool: tool2, args: { file_path: filePath } };
+    }
+    if (eventName === "pre_tool_task") {
+      const tool2 = typeof p.tool_name === "string" ? p.tool_name : "Task";
+      return { tool: tool2, args: toolInput };
+    }
+    const tool = typeof p.tool_name === "string" ? p.tool_name : "tool";
+    return { tool, args: toolInput };
+  }
   invokeAdvisor(advisorId, targetSessionId, prompt) {
     const advisor = getAdvisor(this.db, advisorId);
     if (!advisor) return { ok: false };
@@ -3687,6 +4678,20 @@ var EventRouter = class {
     }
     return ok;
   }
+  /** Sprint N — enable/disable an advisor and broadcast the change so open
+   * browsers (and the CLI path) update live. Returns the updated advisor. */
+  setAdvisorEnabled(advisorId, enabled) {
+    const advisor = setAdvisorEnabled(this.db, advisorId, enabled);
+    if (advisor) {
+      this.broadcaster.broadcast({ type: "advisor_upsert", advisor });
+      this.broadcaster.broadcast({
+        type: "toast",
+        level: "info",
+        message: `${advisor.codename} ${enabled ? "added to crew" : "disabled"}`
+      });
+    }
+    return advisor;
+  }
   unpinAdvisor(advisorId) {
     if (this.launcher) {
       this.launcher.unpin(advisorId);
@@ -3708,6 +4713,8 @@ var EventRouter = class {
     const pending = this.permissions.get(requestId);
     if (!pending) return false;
     this.permissions.delete(requestId);
+    if (pending.timer) clearTimeout(pending.timer);
+    if (pending.resolve) pending.resolve(approved);
     const status = approved ? "active" : "idle";
     const session = setSessionStatus(this.db, pending.sessionId, status);
     if (session)
@@ -3745,7 +4752,27 @@ var EventRouter = class {
       worktreeBranch: opts.worktreeBranch,
       worktreeBaseRef: opts.worktreeBaseRef,
       useAgentView: opts.useAgentView,
-      agentName: opts.agentName
+      agentName: opts.agentName,
+      budgetUsd: opts.budgetUsd,
+      goalId: opts.goalId
+    });
+  }
+  /** Sprint M — raise (or clear) a session's budget cap. Clears any standing
+   * budget breach by re-broadcasting the current cost against the new cap. */
+  raiseBudget(sessionId, budgetUsd) {
+    const session = setSessionBudget(this.db, sessionId, budgetUsd);
+    if (!session) return;
+    this.broadcaster.broadcast({ type: "session_upsert", session });
+    this.broadcaster.broadcast({
+      type: "cost_update",
+      sessionId,
+      costUsd: session.costUsd,
+      budgetUsd: session.budgetUsd
+    });
+    this.broadcaster.broadcast({
+      type: "toast",
+      level: "info",
+      message: `Budget raised to $${budgetUsd.toFixed(2)} for ${session.name ?? sessionId.slice(0, 8)}`
     });
   }
   sendPromptToSession(sessionId, text) {
@@ -3790,6 +4817,19 @@ var EventRouter = class {
   broadcastSessionUpsert(session) {
     this.broadcaster.broadcast({ type: "session_upsert", session });
   }
+  // Sprint M — broadcast helpers for schedule/goal CRUD driven by HTTP/CLI.
+  broadcastScheduleUpsert(schedule) {
+    this.broadcaster.broadcast({ type: "schedule_upsert", schedule });
+  }
+  broadcastScheduleRemove(scheduleId) {
+    this.broadcaster.broadcast({ type: "schedule_remove", scheduleId });
+  }
+  broadcastGoalUpsert(goal) {
+    this.broadcaster.broadcast({ type: "goal_upsert", goal });
+  }
+  broadcastGoalRemove(goalId) {
+    this.broadcaster.broadcast({ type: "goal_remove", goalId });
+  }
   broadcastGalaxyImported(manifest) {
     this.broadcaster.broadcast({ type: "galaxy_imported", manifest });
     this.broadcaster.broadcast({
@@ -3832,6 +4872,11 @@ function attachWs(server, ctx) {
         socket.destroy();
         return;
       }
+      if (!isAllowedOrigin(req.headers.origin)) {
+        socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+        socket.destroy();
+        return;
+      }
       wss.handleUpgrade(req, socket, head, (ws) => {
         wss.emit("connection", ws, req);
       });
@@ -3845,7 +4890,9 @@ function attachWs(server, ctx) {
       sessions: listActiveSessions(ctx.db),
       missions: listMissions(ctx.db, { limit: 100 }),
       advisors: listAdvisors(ctx.db),
-      skills: listSkills(ctx.db)
+      skills: listSkills(ctx.db),
+      schedules: listSchedules(ctx.db),
+      goals: listGoals(ctx.db)
     };
     ctx.broadcaster.send(ws, snapshot);
     for (const p of ctx.router.pendingPermissions()) {
@@ -3894,9 +4941,16 @@ function handleClientMessage(ctx, _ws, msg) {
         worktreeBranch: msg.worktreeBranch,
         worktreeBaseRef: msg.worktreeBaseRef,
         useAgentView: msg.useAgentView,
-        agentName: msg.agentName
+        agentName: msg.agentName,
+        budgetUsd: msg.budgetUsd,
+        goalId: msg.goalId
       });
       break;
+    case "raise_budget":
+      ctx.router.raiseBudget(msg.sessionId, msg.budgetUsd);
+      break;
+    case "dismiss_budget_alert":
+      break;
     case "invoke_advisor":
       ctx.router.invokeAdvisor(
         msg.advisorId,
@@ -3910,6 +4964,9 @@ function handleClientMessage(ctx, _ws, msg) {
     case "unpin_advisor":
       ctx.router.unpinAdvisor(msg.advisorId);
       break;
+    case "set_advisor_enabled":
+      ctx.router.setAdvisorEnabled(msg.advisorId, msg.enabled);
+      break;
     default:
       break;
   }
@@ -3918,7 +4975,7 @@ function handleClientMessage(ctx, _ws, msg) {
 // ../server/src/state/transcript.ts
 import {
   closeSync,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   openSync,
   readSync,
   statSync as statSync5,
@@ -3945,12 +5002,15 @@ var TranscriptWatcherManager = class {
   constructor(db, broadcaster) {
     this.db = db;
     this.broadcaster = broadcaster;
-    void this.db;
   }
   db;
   broadcaster;
   records = /* @__PURE__ */ new Map();
   deferredRetry = /* @__PURE__ */ new Map();
+  // Sprint M: sessions we've already raised a budget alert for, so we don't
+  // re-fire on every subsequent assistant message. Cleared when spend drops
+  // back under the cap (e.g. after the cap is raised).
+  budgetAlerted = /* @__PURE__ */ new Set();
   /**
    * Begin tailing this session's transcript. Idempotent. If the file doesn't
    * exist yet, retries every second for up to 10 s (Claude Code creates the
@@ -3959,7 +5019,7 @@ var TranscriptWatcherManager = class {
   startWatching(sessionId, cwd) {
     if (this.records.has(sessionId)) return;
     const filePath = transcriptPathFor(cwd, sessionId);
-    if (!existsSync10(filePath)) {
+    if (!existsSync11(filePath)) {
       this.scheduleRetry(sessionId, cwd, 0);
       return;
     }
@@ -3970,7 +5030,7 @@ var TranscriptWatcherManager = class {
     const t = setTimeout(() => {
       this.deferredRetry.delete(sessionId);
       const filePath = transcriptPathFor(cwd, sessionId);
-      if (existsSync10(filePath)) {
+      if (existsSync11(filePath)) {
         this.attach(sessionId, filePath);
       } else {
         this.scheduleRetry(sessionId, cwd, attempt + 1);
@@ -4082,6 +5142,39 @@ var TranscriptWatcherManager = class {
         sessionId,
         usagePct: pct
       });
+      const inc = costForUsage(message.model, message.usage);
+      const session = getSession(this.db, sessionId);
+      if (session) {
+        const updated = setSessionCost(this.db, sessionId, session.costUsd + inc);
+        const costUsd = updated?.costUsd ?? session.costUsd + inc;
+        const cap = updated?.budgetUsd ?? session.budgetUsd;
+        this.broadcaster.broadcast({
+          type: "cost_update",
+          sessionId,
+          costUsd,
+          budgetUsd: cap
+        });
+        if (session.currentMissionId) {
+          addMissionTokens(
+            this.db,
+            session.currentMissionId,
+            totalTokens(message.usage)
+          );
+        }
+        if (cap != null && costUsd >= cap) {
+          if (!this.budgetAlerted.has(sessionId)) {
+            this.budgetAlerted.add(sessionId);
+            this.broadcaster.broadcast({
+              type: "budget_alert",
+              sessionId,
+              costUsd,
+              budgetUsd: cap
+            });
+          }
+        } else {
+          this.budgetAlerted.delete(sessionId);
+        }
+      }
     }
     const content = this.flattenAssistantContent(message.content);
     if (!content) return;
@@ -4160,7 +5253,7 @@ ${text.slice(0, 600)}`);
 };
 
 // ../server/src/state/agentview.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7, readdirSync as readdirSync5, statSync as statSync6, watch as watch2 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync8, readdirSync as readdirSync5, statSync as statSync6, watch as watch2 } from "fs";
 import { homedir as homedir10 } from "os";
 import { join as join14 } from "path";
 var ROSTER_PATH = join14(homedir10(), ".claude", "daemon", "roster.json");
@@ -4190,9 +5283,9 @@ function mapPrStatus(s) {
   return void 0;
 }
 function readRoster() {
-  if (!existsSync11(ROSTER_PATH)) return [];
+  if (!existsSync12(ROSTER_PATH)) return [];
   try {
-    const raw = readFileSync7(ROSTER_PATH, "utf8");
+    const raw = readFileSync8(ROSTER_PATH, "utf8");
     const parsed = JSON.parse(raw);
     if (Array.isArray(parsed)) return parsed;
     if (parsed && Array.isArray(parsed.sessions)) return parsed.sessions;
@@ -4202,7 +5295,7 @@ function readRoster() {
   }
 }
 function readJobIds() {
-  if (!existsSync11(JOBS_DIR)) return [];
+  if (!existsSync12(JOBS_DIR)) return [];
   try {
     return readdirSync5(JOBS_DIR).filter((entry) => {
       try {
@@ -4217,9 +5310,9 @@ function readJobIds() {
 }
 function readJobState(jobId) {
   const p = join14(JOBS_DIR, jobId, "state.json");
-  if (!existsSync11(p)) return null;
+  if (!existsSync12(p)) return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -4299,7 +5392,7 @@ function debounce(fn, ms) {
 }
 function startAgentViewBridge(opts) {
   const claudeRoot = join14(homedir10(), ".claude");
-  if (!existsSync11(claudeRoot)) return () => {
+  if (!existsSync12(claudeRoot)) return () => {
   };
   const sync = () => {
     try {
@@ -4312,7 +5405,7 @@ function startAgentViewBridge(opts) {
   sync();
   const watchers = [];
   const daemonDir = join14(homedir10(), ".claude", "daemon");
-  if (existsSync11(daemonDir)) {
+  if (existsSync12(daemonDir)) {
     try {
       watchers.push(watch2(daemonDir, { persistent: false }, debounced));
     } catch (err) {
@@ -4322,7 +5415,7 @@ function startAgentViewBridge(opts) {
       );
     }
   }
-  if (existsSync11(JOBS_DIR)) {
+  if (existsSync12(JOBS_DIR)) {
     try {
       watchers.push(watch2(JOBS_DIR, { recursive: true, persistent: false }, debounced));
     } catch (err) {
@@ -4367,7 +5460,17 @@ async function createSolixServer(opts = {}) {
   const launcher = new Launcher(db, broadcaster);
   const transcripts = new TranscriptWatcherManager(db, broadcaster);
   const router = new EventRouter(db, broadcaster, launcher, transcripts);
-  const app = createHttpApp({ db, router });
+  const tokenPath = join15(
+    process.env.SOLIX_HOME ?? join15(homedir11(), ".solix"),
+    "token"
+  );
+  let token = null;
+  try {
+    token = readFileSync9(tokenPath, "utf8").trim() || null;
+  } catch {
+    token = null;
+  }
+  const app = createHttpApp({ db, router, token, version: opts.version });
   const server = serve({
     fetch: app.fetch,
     port,
@@ -4379,10 +5482,31 @@ async function createSolixServer(opts = {}) {
     broadcaster
   });
   const stopAgentViewBridge = startAgentViewBridge({ db, broadcaster });
+  const scheduleTimer = setInterval(() => {
+    try {
+      const due = listDueSchedules(db, now());
+      for (const s of due) {
+        if (!s.cwd) continue;
+        launcher.launch({ cwd: s.cwd, initialPrompt: s.prompt });
+        const updated = markScheduleRun(db, s.id);
+        if (updated) {
+          broadcaster.broadcast({ type: "schedule_upsert", schedule: updated });
+          broadcaster.broadcast({
+            type: "toast",
+            level: "info",
+            message: `Heartbeat fired: ${s.name ?? s.prompt.slice(0, 32)}`
+          });
+        }
+      }
+    } catch (err) {
+      console.warn("[scheduler] tick failed:", err.message);
+    }
+  }, 3e4);
   return {
     port,
     hostname,
     close: () => new Promise((resolve4) => {
+      clearInterval(scheduleTimer);
       stopAgentViewBridge();
       transcripts.shutdownAll();
       launcher.shutdownAll();
@@ -4405,7 +5529,7 @@ var BANNER = `
 async function start(opts = {}) {
   const port = opts.port ?? Number(process.env.SOLIX_PORT ?? 4242);
   console.log(BANNER);
-  const handle = await createSolixServer({ port });
+  const handle = await createSolixServer({ port, version: "1.9.0" });
   const url = `http://${handle.hostname}:${handle.port}`;
   console.log(`[solix] server listening on ${url}`);
   console.log(`[solix] events  -> POST ${url}/events`);
@@ -4431,20 +5555,20 @@ async function start(opts = {}) {
 }
 
 // src/uninstall.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync13, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
 function uninstall() {
   uninstallShim();
-  if (existsSync12(CLAUDE_BACKUP)) {
+  if (existsSync13(CLAUDE_BACKUP)) {
     copyFileSync2(CLAUDE_BACKUP, CLAUDE_SETTINGS);
     console.log(`[solix] restored settings.json from backup`);
     return;
   }
-  if (!existsSync12(CLAUDE_SETTINGS)) {
+  if (!existsSync13(CLAUDE_SETTINGS)) {
     console.log("[solix] nothing to uninstall (no settings.json found)");
     return;
   }
   const cur = JSON.parse(
-    readFileSync8(CLAUDE_SETTINGS, "utf8")
+    readFileSync10(CLAUDE_SETTINGS, "utf8")
   );
   if (cur.hooks) {
     for (const [evt, entries] of Object.entries(cur.hooks)) {
@@ -4460,7 +5584,7 @@ function uninstall() {
 
 // src/index.ts
 var program = new Command();
-program.name("solix").description("Solix \u2014 a solar-system command center for Claude Code agents").version("1.5.0");
+program.name("solix").description("Solix \u2014 a solar-system command center for Claude Code agents").version("1.9.0");
 program.command("start", { isDefault: true }).description("Start the Solix server and open the browser").option("-p, --port <port>", "port to listen on", (v) => parseInt(v, 10), 4242).option("--no-open", "do not open browser automatically").action(async (opts) => {
   await start({ port: opts.port, noOpen: !opts.open });
 });
@@ -4485,49 +5609,84 @@ program.command("doctor").description("Run diagnostics").action(async () => {
   await doctor();
 });
 program.command("demo").description(
-  "Seed the running server with fake planets, missions, and a pinned advisor (great for first-run)"
-).option("-p, --port <port>", "server port", (v) => parseInt(v, 10), 4242).action(async (opts) => {
-  await demoCmd({ port: opts.port });
-});
+  "Boot a sandbox server, seed a rich galaxy (8 projects, ~30 sessions, all advisors), and keep firing activity until Ctrl+C. Showcase mode for live demos."
+).option("-p, --port <port>", "server port (falls back to +1 on conflict)", (v) => parseInt(v, 10), 4242).option("--keep", "preserve ~/.solix/demo.db after teardown (default removes it)").option("--no-server", "skip spawning a sandbox server; seed against the server you already have running").option("--no-ticker", "seed once and exit (static snapshot for screenshots)").action(
+  async (opts) => {
+    await demoCmd({
+      port: opts.port,
+      keep: opts.keep,
+      noServer: !opts.server,
+      noTicker: !opts.ticker
+    });
+  }
+);
 var advisors = program.command("advisors").description("Manage built-in advisor agents (PM, Builder, UX, etc.)");
 advisors.command("list", { isDefault: true }).description("List all advisor agents and their state").action(async () => {
   await listAdvisorsCmd();
 });
-advisors.command("enable <id>").description("Enable an advisor (renders in the inner crew ring)").action(async (id) => {
+advisors.command("enable <id>").description("Enable an advisor (add to the inner ring)").action(async (id) => {
   await enableAdvisorCmd(id);
 });
-advisors.command("disable <id>").description("Disable an advisor").action(async (id) => {
+advisors.command("disable <id>").description("Disable an advisor (remove from the inner ring)").action(async (id) => {
   await disableAdvisorCmd(id);
 });
-advisors.command("pin <id>").description("Pin an advisor (always-on planet)").action(async (id) => {
+advisors.command("pin <id>").description("Pin an advisor (spawn an always-on session)").action(async (id) => {
   await pinAdvisorCmd(id);
 });
-advisors.command("unpin <id>").description("Unpin an advisor (back to on-demand)").action(async (id) => {
+advisors.command("unpin <id>").description("Unpin an advisor (kill the always-on session)").action(async (id) => {
   await unpinAdvisorCmd(id);
 });
-var skills = program.command("skills").description("Manage discovered skills (asteroid belt)");
-skills.command("list", { isDefault: true }).description("List all known skills (Anthropic + Solix pack)").action(async () => {
+var skills = program.command("skills").description("Browse + install skills from Anthropic, Solix, and your own");
+skills.command("list", { isDefault: true }).description("List skills detected in this project").action(async () => {
   await listSkillsCmd();
 });
-skills.command("install <id>").description("Mark a skill as installed in a project").option("--project <projectId>", "project id (hash of cwd)").action(async (id, opts) => {
-  await installSkillCmd(id, opts.project);
+skills.command("install <id>").description("Install a skill into the current project").action(async (id) => {
+  await installSkillCmd(id);
 });
-var galaxy = program.command("galaxy").description("Export and import shareable galaxy configurations");
-galaxy.command("export <out>").description("Export the current galaxy to a JSON manifest file").option("--name <name>", "galaxy name", "My Galaxy").option("--author <author>", "author name").option("--description <desc>", "short description").action(
-  async (out, opts) => {
-    await exportGalaxyCmd(out, opts);
+var galaxy = program.command("galaxy").description("Export, import, and publish galaxy presets");
+galaxy.command("export <name>").description("Snapshot the current crew + skills + projects into a manifest").option("--author <author>", "author tag for the manifest").option("--description <description>", "one-line manifest description").action(
+  async (name, opts) => {
+    await exportGalaxyCmd(name, opts);
   }
 );
-galaxy.command("import <fileOrUrl>").description("Import a galaxy manifest from a local file or URL").action(async (fileOrUrl) => {
-  await importGalaxyCmd(fileOrUrl);
+galaxy.command("import <path>").description("Apply a galaxy manifest (enables advisors, seeds skills + projects)").action(async (path) => {
+  await importGalaxyCmd(path);
+});
+galaxy.command("publish <path>").description("Publish a manifest to the configured registry (SOLIX_REGISTRY_URL)").action(async (path) => {
+  await publishGalaxyCmd(path);
+});
+galaxy.command("install <id>").description("Install a galaxy preset from the registry by id").action(async (id) => {
+  await installFromRegistryCmd(id);
+});
+var schedules = program.command("schedules").description("Manage recurring scheduled tasks");
+schedules.command("list", { isDefault: true }).description("List schedules across all projects").action(async () => {
+  await listSchedulesCmd();
+});
+schedules.command("add <prompt>").description("Schedule a recurring task").option("--cwd <dir>", "working directory (default: current dir)").option("--every <cadence>", "cadence, e.g. 30m, 1h, 1d (default: 1h)").option("--name <name>", "short label for the schedule").action(
+  async (prompt, opts) => {
+    await addScheduleCmd(prompt, opts);
+  }
+);
+schedules.command("remove <id>").description("Remove a schedule").action(async (id) => {
+  await removeScheduleCmd(id);
+});
+schedules.command("enable <id>").description("Enable a schedule").action(async (id) => {
+  await enableScheduleCmd(id);
+});
+schedules.command("disable <id>").description("Disable a schedule").action(async (id) => {
+  await disableScheduleCmd(id);
+});
+var goals = program.command("goals").description("Manage cross-session goals (constellations)");
+goals.command("list", { isDefault: true }).description("List all goals").action(async () => {
+  await listGoalsCmd();
 });
-galaxy.command("publish <slug>").description("Publish the current galaxy to the configured registry").option("--name <name>", "galaxy name", "My Galaxy").option("--author <author>", "author name").option("--description <desc>", "short description").action(
-  async (slug, opts) => {
-    await publishGalaxyCmd(slug, opts);
+goals.command("add <name>").description("Create a goal").option("--description <desc>", "optional description").option("--color <hex>", "goal color (default sky blue)").action(
+  async (name, opts) => {
+    await addGoalCmd(name, opts);
   }
 );
-galaxy.command("install <slug>").description("Pull and install a galaxy from the configured registry").action(async (slug) => {
-  await installFromRegistryCmd(slug);
+goals.command("remove <id>").description("Remove a goal").action(async (id) => {
+  await removeGoalCmd(id);
 });
 program.parseAsync(process.argv).catch((err) => {
   console.error(err);