@todoforai/cli 0.1.54 → 0.1.56

package/dist/todoforai-cli.js

@@ -42926,6 +42926,19 @@ class ApiClient {
   upsertProjectGroup(projectId, slug, fields) {
     return this.request("PUT", `/api/v1/projects/${projectId}/groups/${encodeURIComponent(slug)}`, { projectId, slug, ...fields });
   }
+  listFeed(opts = {}) {
+    const qs = new URLSearchParams({ all: "true" });
+    for (const [k, v] of Object.entries(opts))
+      if (v !== undefined)
+        qs.set(k, String(v));
+    return this.request("GET", `/api/v1/feed?${qs}`);
+  }
+  markFeedSeen(opts = {}) {
+    return this.request("POST", "/api/v1/feed/seen", { all: true, ...opts });
+  }
+  sendFeedMessage(msg) {
+    return this.request("POST", "/api/v1/feed/message", msg);
+  }
   listProjectSurfaces(projectId) {
     return this.request("GET", `/api/v1/projects/${projectId}/surfaces`);
   }
@@ -43207,6 +43220,7 @@ class FrontendWebSocket {
   apiUrl;
   apiKey;
   ws = null;
+  connecting = null;
   tabId = randomUUID();
   connected = false;
   callbacks = new Map;
@@ -43230,28 +43244,61 @@ class FrontendWebSocket {
       wsUrl = `wss://${url}`;
     return `${wsUrl}/ws/v1/frontend?tabId=${this.tabId}`;
   }
-  async connect() {
+  connect() {
     if (this.connected && this.ws)
-      return true;
+      return Promise.resolve(true);
+    this.connecting ??= this.open().finally(() => {
+      this.connecting = null;
+    });
+    return this.connecting;
+  }
+  open() {
     return new Promise((resolve) => {
       const wsUrl = this.getWsUrl();
-      this.ws = new WebSocket(wsUrl, [this.apiKey], { maxPayload: 5 * 1024 * 1024 });
-      this.ws.on("open", () => {
+      const sock = new WebSocket(wsUrl, [this.apiKey], { maxPayload: 5 * 1024 * 1024, handshakeTimeout: 1e4 });
+      this.ws = sock;
+      const current = () => this.ws === sock;
+      let alive = true;
+      let heartbeat;
+      sock.on("pong", () => {
+        alive = true;
+      });
+      sock.on("open", () => {
+        if (!current())
+          return;
         this.connected = true;
+        heartbeat = setInterval(() => {
+          if (!alive) {
+            sock.terminate();
+            return;
+          }
+          alive = false;
+          try {
+            sock.ping();
+          } catch {}
+        }, 15000);
+        heartbeat.unref?.();
         resolve(true);
       });
-      this.ws.on("message", (data) => {
+      sock.on("message", (data) => {
+        if (!current())
+          return;
         try {
           this.handleMessage(JSON.parse(data.toString()));
         } catch {}
       });
-      this.ws.on("close", () => {
+      sock.on("close", () => {
+        clearInterval(heartbeat);
+        if (!current())
+          return;
         this.connected = false;
         this.settleAll();
+        resolve(false);
       });
-      this.ws.on("error", (err) => {
+      sock.on("error", (err) => {
         log("error", "WS error:", err.message);
-        this.connected = false;
+        if (current())
+          this.connected = false;
         resolve(false);
       });
     });
@@ -43320,7 +43367,7 @@ class FrontendWebSocket {
       }
     }
   }
-  async subscribe(todoId, callback) {
+  async subscribe(todoId, callback, opts = {}) {
     if (!this.connected && !await this.connect())
       return false;
     if (callback)
@@ -43328,8 +43375,16 @@ class FrontendWebSocket {
     const res = await fetch(`${this.apiUrl}/api/v1/todos/${todoId}/subscribe`, {
       method: "POST",
       headers: { "x-api-key": this.apiKey, "x-tab-id": this.tabId, "Content-Type": "application/json" },
-      body: JSON.stringify({ todoId })
+      body: JSON.stringify({ todoId }),
+      signal: AbortSignal.timeout(15000)
     });
+    if (res.ok && opts.replayStatus) {
+      this.pendingBlocks.delete(todoId);
+      this.lastReadyPayload.delete(todoId);
+      const status = (await res.json().catch(() => null))?.status;
+      if (status)
+        this.handleMessage({ type: "todo:status", payload: { todoId, status } });
+    }
     return res.ok;
   }
   setCallback(todoId, callback) {
@@ -43339,17 +43394,16 @@ class FrontendWebSocket {
       this.callbacks.delete(todoId);
   }
   async sendInterrupt(projectId, todoId) {
-    if (!this.connected || !this.ws)
-      return false;
-    try {
-      this.ws.send(JSON.stringify({
-        type: "todo:interrupt_signal",
-        payload: { projectId, todoId }
-      }));
-      return true;
-    } catch {
+    const ws = this.ws;
+    if (!this.connected || !ws)
       return false;
-    }
+    return new Promise((resolve) => {
+      try {
+        ws.send(JSON.stringify({ type: "todo:interrupt_signal", payload: { projectId, todoId } }), (err) => resolve(!err));
+      } catch {
+        resolve(false);
+      }
+    });
   }
   async sendQueueCancel(todoId, messageId) {
     if (!this.connected || !this.ws)
@@ -43407,6 +43461,10 @@ class FrontendWebSocket {
     return this.completion(todoId);
   }
   completion(todoId) {
+    if (!this.connected && !this.completionResults.has(todoId)) {
+      this.callbacks.delete(todoId);
+      return Promise.resolve({ type: "socket:closed", payload: { todoId, status: "DISCONNECTED" }, success: false });
+    }
     const early = this.completionResults.get(todoId);
     if (early) {
       this.completionResults.delete(todoId);
@@ -43782,6 +43840,7 @@ var SERVER_TO_FRONTENDS = {
     msgMetaAi: (todoId) => `${"todo:msg_meta_ai" /* TODO_MSG_META_AI */}:${todoId}`,
     msgQueueUpdate: (todoId) => `${"todo:msg_queue_update" /* TODO_MSG_QUEUE_UPDATE */}:${todoId}`,
     message_removed: (todoId) => `${"todo:message_removed" /* TODO_MESSAGE_REMOVED */}:${todoId}`,
+    commentUpdate: (todoId) => `${"todo:comment_update" /* TODO_COMMENT_UPDATE */}:${todoId}`,
     start_universal: (todoId) => `${"block:start_universal" /* BLOCK_START_UNIVERSAL */}:${todoId}`,
     message: (todoId) => `${"block:message" /* BLOCK_MESSAGE */}:${todoId}`,
     end: (todoId) => `${"block:end" /* BLOCK_END */}:${todoId}`,
@@ -43823,6 +43882,7 @@ function manualAnswersOf(sources) {
   return out;
 }
 var manualSamples = (answers) => Object.entries(answers).filter(([, a]) => a.trim()).map(([prompt, text]) => ({ prompt, text: text.trim() }));
+var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : `${s.name} · your agent`;
 // ../packages/shared-fbe/src/templateBody.ts
 var USER_HEADINGS = new Set([
   "your task",
@@ -44332,6 +44392,1499 @@ var OUTPUT_POLICIES = {
   full: { firstLimit: Infinity, lastLimit: 0, hardCap: RUN_OUTPUT_CAP, lineLimit: MAX_LINE_LEN },
   raw: { firstLimit: Infinity, lastLimit: 0, hardCap: Infinity, lineLimit: Infinity }
 };
+// ../packages/shared-fbe/src/tool_catalog.json
+var tool_catalog_default = {
+  zele: {
+    category: "email",
+    pkg: "zele",
+    installer: "npm",
+    label: "Gmail",
+    summary: "Read and send Gmail from your own account.",
+    statusCmd: "zele whoami 2>/dev/null | grep 'email:' | grep -m1 .",
+    loginNeedsPty: true,
+    loginCmd: "zele login --method google",
+    oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
+    oauthCallbackPort: 8089,
+    credentialPaths: ["~/.zele/sqlite.db"],
+    versionCmd: "zele --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true,
+    description: "Gmail (multi-account, OAuth login): inbox, search, send, reply, contacts. Google Calendar via `zele cal`: list/create/update/delete events (Meet links, recurrence), respond to invites, free/busy."
+  },
+  "zele-calendar": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "zele",
+    installer: "npm",
+    binName: "zele",
+    label: "Google Calendar",
+    summary: "See your Google Calendar and book, move or cancel events.",
+    statusCmd: "zele whoami 2>/dev/null | grep 'email:' | grep -m1 .",
+    loginNeedsPty: true,
+    loginCmd: "zele login --method google",
+    oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
+    oauthCallbackPort: 8089,
+    credentialPaths: ["~/.zele/sqlite.db"],
+    versionCmd: "zele --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    description: "Google Calendar via `zele cal`: list calendars and events, create/update/delete events with Google Meet links, recurrence and reminders, respond to invites, free/busy."
+  },
+  xurl: {
+    category: "social",
+    pkg: "@xdevplatform/xurl",
+    installer: "npm",
+    label: "X",
+    summary: "Post to X and read timelines, replies and DMs.",
+    statusCmd: `xurl whoami 2>&1 | sed -n 's/.*"username"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "xurl auth oauth2",
+    loginTerminalHint: "X needs your own developer app first: create one at developer.x.com (callback `http://localhost:8080/callback`), run `xurl auth apps add tfa --client-id <id> --client-secret <secret>`, then `xurl auth oauth2`.",
+    oauthUrlPattern: "(https://(?:twitter|x)\\.com/i/oauth2\\S+)",
+    oauthCallbackPort: 8080,
+    credentialPaths: ["~/.xurl"],
+    description: "Raw X API access via `xurl <method> <path>`.",
+    versionCmd: "xurl version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    preinstallCloud: true
+  },
+  "linkedin-api": {
+    preinstallCloud: true,
+    category: "social",
+    pkg: "@todoforai/linkedin-api",
+    installer: "npm",
+    label: "LinkedIn",
+    summary: "Read LinkedIn profiles and send messages and connection requests.",
+    statusCmd: `linkedin-api whoami 2>/dev/null | sed -n 's/.*"publicId"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "linkedin-api auth <li_at> <jsessionid>",
+    credentialPaths: ["~/.config/linkedin-api/credentials.json"],
+    description: "LinkedIn Voyager API CLI for profiles, conversations, DMs, and connections.",
+    versionCmd: "linkedin-api --version 2>/dev/null | sed -n 1p"
+  },
+  "figma-api": {
+    category: "design",
+    pkg: "@todoforai/figma-api",
+    installer: "npm",
+    label: "Figma",
+    summary: "Read Figma files, export images and leave comments.",
+    statusCmd: `figma-api me 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "figma-api auth <token>",
+    credentialPaths: ["~/.config/figma-api/credentials.json"],
+    description: "Figma REST API CLI. File commands take a file key or Figma URL. Canvas writes (frames/text/shapes) use `figma-api run` via the plugin bridge. Run `figma-api <cmd> --help` for params.",
+    versionCmd: "figma-api --version 2>/dev/null | sed -n 1p"
+  },
+  "slack-cli": {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_amd64.tar.gz | tar -xz -C /tmp bin/slack && install -m0755 /tmp/bin/slack /usr/local/bin/slack-cli && rm -rf /tmp/bin",
+    cloudVerifyCmd: "slack-cli --version",
+    category: "social",
+    pkg: "slack-cli",
+    installer: "binary",
+    label: "Slack",
+    summary: "Work with Slack workspaces and apps.",
+    statusCmd: "slack-cli auth list 2>&1 | grep 'Team' >/dev/null && echo authenticated",
+    loginCmd: "slack-cli login",
+    loginTerminalHint: "Run `slack-cli login` in a terminal on this host, paste the `/slackauthticket …` command it prints into any Slack channel, then type the challenge code Slack shows you back into the terminal.",
+    credentialPaths: ["~/.slack/credentials.json"],
+    description: "Invoked as `slack-cli` to avoid colliding with the Slack desktop app’s `slack` binary.",
+    versionCmd: "slack-cli version 2>/dev/null | sed -n 1p",
+    binName: "slack-cli",
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_amd64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_arm64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_macOS_amd64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_macOS_arm64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_windows_64-bit.zip",
+        archive: "zip",
+        extract: "bin/slack.exe"
+      }
+    }
+  },
+  "telegram-send": {
+    preinstallCloud: true,
+    packages: ["telegram-send==0.39.2"],
+    category: "social",
+    pkg: "telegram-send",
+    installer: "pip",
+    label: "Telegram",
+    summary: "Send Telegram messages, photos and files.",
+    loginCmd: `t=<bot_token>; c=$(curl -sf "https://api.telegram.org/bot$t/getUpdates" | python3 -c "import json,sys; u=[x for x in json.load(sys.stdin)['result'] if 'message' in x]; print(u[-1]['message']['chat']['id'])" 2>/dev/null) || { echo "No message from you yet: open your bot in Telegram, send it any message, then retry"; exit 1; }; mkdir -p "$HOME/.config" && printf '[telegram]\\ntoken = %s\\nchat_id = %s\\n' "$t" "$c" > "$HOME/.config/telegram-send.conf" && telegram-send "Connected to TODOforAI"`,
+    credentialPaths: ["~/.config/telegram-send.conf"],
+    versionCmd: "telegram-send --version 2>/dev/null | sed -n 1p",
+    statusCmd: "test -f ~/.config/telegram-send.conf && echo authenticated",
+    description: "Send messages, send files & images, send video & audio, Markdown/HTML formatting, channel & group support"
+  },
+  "meta-ads": {
+    preinstallCloud: true,
+    packages: ["meta-ads==1.1.0"],
+    category: "marketing",
+    pkg: "meta-ads",
+    installer: "pip",
+    label: "Meta Ads",
+    summary: "Run Facebook and Instagram ad campaigns and see how they perform.",
+    binName: "meta",
+    statusCmd: `out=$(meta auth status 2>&1); rc=$?; printf '%s\\n' "$out" | grep -m1 .; exit $rc`,
+    versionCmd: "meta --version 2>/dev/null | sed -n 1p",
+    description: "Meta/Facebook & Instagram ad campaigns: campaigns/adsets/ads CRUD, insights & reporting, catalog/product-feed/product-set/product-item, ad creatives, datasets (pixels), pages — Marketing API via the official `meta` CLI. No raw/passthrough mode; for arbitrary Graph API calls with a Page token use `facebook-pages-api request <method> <path>`."
+  },
+  "elevenlabs-api": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/elevenlabs-api",
+    installer: "npm",
+    label: "ElevenLabs",
+    summary: "Turn text into natural speech, in many voices and languages.",
+    versionCmd: "elevenlabs-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/elevenlabs.json -o -n "$ELEVENLABS_API_KEY" && echo authenticated',
+    loginCmd: "elevenlabs-api auth <api_key>",
+    credentialPaths: ["~/.config/todoforai/elevenlabs.json"],
+    description: "Text-to-speech, voice cloning, multiple languages."
+  },
+  ffmpeg: {
+    commodity: true,
+    category: "media",
+    pkg: "ffmpeg",
+    installer: "system",
+    label: "FFmpeg",
+    summary: "Convert, trim and resize video and audio files.",
+    cloudAptPackages: ["ffmpeg"],
+    preinstallCloud: true,
+    description: "Media swiss-army knife: `ffmpeg -i in.mp4 out.webm`; `ffprobe` for metadata.",
+    versionCmd: "ffmpeg -version 2>/dev/null | sed -n 1p"
+  },
+  "tfa-imagegen": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/image-api",
+    installer: "npm",
+    label: "Image Gen",
+    summary: "Generate and edit images from a description.",
+    platformAuth: true,
+    versionCmd: "tfa-imagegen --version 2>/dev/null | sed -n 1p",
+    credentialPaths: ["~/.config/todoforai/credentials.json"],
+    description: "AI image generation & editing via TODOFORAI backend (gpt-image, nano-banana, nano-banana-pro, mai-image-2.6)"
+  },
+  "suno-api": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/suno-api",
+    installer: "npm",
+    label: "Suno",
+    summary: "Generate music and songs from a prompt.",
+    versionCmd: "suno-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/suno.json -o -n "$SUNO_API_KEY" && echo authenticated',
+    loginCmd: "suno-api auth <api_key>",
+    credentialPaths: [
+      "~/.config/todoforai/suno.json"
+    ],
+    description: "AI music generation, custom lyrics, multiple genres."
+  },
+  ntn: {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "ntn",
+    installer: "npm",
+    label: "Notion",
+    summary: "Read and update Notion pages and databases.",
+    statusCmd: "ntn doctor 2>&1 | grep -E 'Token valid\\s+✔' >/dev/null && echo authenticated",
+    loginCmd: "ntn login",
+    loginNeedsPty: true,
+    oauthUrlPattern: "(https://www\\.notion\\.so/workers/cli-login\\S+)",
+    sessionIdPattern: "verificationCode=([A-Z0-9-]{5,12})",
+    credentialPaths: ["~/.config/notion"],
+    versionCmd: "ntn --version 2>/dev/null | sed -n 1p",
+    description: "Official Notion CLI: raw API calls (`ntn api <path>`), page/data-source management, file uploads, Workers deploy."
+  },
+  "perplexity-api": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "@todoforai/perplexity-api",
+    installer: "npm",
+    label: "Perplexity",
+    summary: "Ask questions and get answers researched from the web.",
+    versionCmd: "perplexity-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/perplexity.json && echo authenticated || test -n "$PERPLEXITY_API_KEY" && echo authenticated',
+    loginCmd: "perplexity-api auth <api_key>",
+    credentialPaths: ["~/.config/todoforai/perplexity.json"],
+    description: "AI-powered web search, chat completions, async chat, embeddings and agent runs"
+  },
+  gh: {
+    category: "development",
+    pkg: "gh",
+    installer: "binary",
+    preinstallCloud: true,
+    label: "GitHub",
+    summary: "Work with your GitHub repos, pull requests and issues.",
+    statusCmd: "gh auth status 2>&1 | grep 'Logged in to' | grep -m1 .",
+    loginCmd: "gh auth login --hostname github.com --git-protocol https",
+    oauthUrlPattern: "(https://github\\.com/login/device\\S*)",
+    deviceCodePattern: "one-time code:\\s*([A-Z0-9]{4}-[A-Z0-9]{4})",
+    canStreamLogin: true,
+    logoutCmd: "gh auth logout --hostname github.com --user {{ACCOUNT}}",
+    credentialPaths: ["~/.config/gh/hosts.yml"],
+    description: "Prefer `gh` over raw GitHub API calls.",
+    versionCmd: "gh --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true
+  },
+  mcporter: {
+    category: "development",
+    pkg: "mcporter",
+    installer: "npm",
+    label: "MCP (mcporter)",
+    summary: "Use tools from any MCP server.",
+    statusCmd: "mcporter list 2>/dev/null | grep -v 'No MCP servers' | grep -m1 .",
+    description: "MCP servers as CLI: `mcporter list [server] [--schema]`, `mcporter call <server>.<tool> key=value` (`key=@file`), `mcporter config add <name> <cmd-or-url>`, `mcporter auth <server>`. `--help` for more.",
+    versionCmd: "mcporter --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    preinstallCloud: true
+  },
+  glab: {
+    category: "development",
+    pkg: "glab",
+    installer: "binary",
+    label: "GitLab",
+    summary: "Work with your GitLab repos, merge requests and pipelines.",
+    statusCmd: "glab auth status 2>&1 | grep 'Logged in to' | grep -m1 .",
+    loginCmd: "glab auth login --device",
+    credentialPaths: ["~/.config/glab-cli/config.yml"],
+    description: "GitLab equivalent of `gh`.",
+    versionCmd: "glab --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "one-time code: ([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://gitlab\\.com/oauth/device)",
+    canStreamLogin: true
+  },
+  vercel: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "vercel",
+    installer: "npm",
+    label: "Vercel",
+    summary: "Deploy websites to Vercel and manage them.",
+    statusCmd: "vercel whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "vercel login",
+    credentialPaths: ["~/.local/share/com.vercel.cli/auth.json"],
+    description: "`vercel deploy`; manage env vars, domains, preview URLs.",
+    versionCmd: "vercel --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "user_code=([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://vercel\\.com/oauth/device\\S*)",
+    canStreamLogin: true
+  },
+  eas: {
+    category: "deployment",
+    pkg: "eas-cli",
+    installer: "npm",
+    label: "Expo EAS",
+    summary: "Build, update and submit mobile apps with Expo.",
+    statusCmd: `out=$(eas whoami 2>/dev/null) && printf '%s\\n' "$out" | tr -d '\\r' | grep -m1 .`,
+    loginCmd: "eas login --browser",
+    logoutCmd: "eas logout",
+    oauthUrlPattern: "(https://expo\\.dev/(?:sso-)?login\\?\\S+)",
+    canStreamLogin: true,
+    credentialPaths: ["~/.expo/state.json"],
+    description: "Expo Application Services for React Native apps: `eas update --channel <c>` ships a JS-only OTA, `eas build -p ios --profile production --auto-submit` (`-p all` for both) makes a native build and sends it to TestFlight / Play. `eas build:list`, `eas update:list` and `eas submit` inspect or re-submit existing builds. An OTA only reaches installs whose runtimeVersion matches, so a native version bump needs a real build. The browser login binds to a RANDOM loopback port, so it only completes in a browser on the same host; on a remote/headless host set EXPO_TOKEN (Account -> Access tokens) instead. EXPO_TOKEN (Account -> Access tokens) works in CI instead of a login.",
+    versionCmd: "eas --version 2>/dev/null | sed -n 1p"
+  },
+  netlify: {
+    category: "deployment",
+    pkg: "netlify-cli",
+    installer: "npm",
+    label: "Netlify",
+    summary: "Deploy websites to Netlify and manage them.",
+    statusCmd: `netlify api getCurrentUser 2>&1 | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "netlify login",
+    credentialPaths: ["~/.netlify/config.json"],
+    description: "`netlify deploy --prod` for production; manage env vars, forms, identity.",
+    versionCmd: "netlify --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://app\\.netlify\\.com/authorize\\S+)",
+    canStreamLogin: true
+  },
+  firebase: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "firebase-tools",
+    installer: "npm",
+    label: "Firebase",
+    summary: "Deploy and manage Firebase hosting, database and functions.",
+    statusCmd: "firebase login:list 2>&1 | grep -oiE '[[:alnum:]._%+-]+@[[:alnum:].-]+\\.[[:alpha:]]{2,}' | grep -m1 .",
+    loginCmd: "firebase login --no-localhost --reauth",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    credentialPaths: ["~/.config/configstore/firebase-tools.json"],
+    description: "Deploy hosting/functions, manage Firestore/RTDB rules and data, auth users, emulators.",
+    versionCmd: "firebase --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://auth\\.firebase\\.tools/login\\S+)",
+    sessionIdPattern: "session ID:\\s*([0-9A-Za-z]{4,8})"
+  },
+  wrangler: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "wrangler",
+    installer: "npm",
+    label: "Cloudflare",
+    summary: "Deploy and manage Cloudflare Workers and Pages.",
+    statusCmd: "wrangler whoami 2>&1 | grep -oiE '[[:alnum:]._%+-]+@[[:alnum:].-]+\\.[[:alpha:]]{2,}' | grep -m1 .",
+    loginCmd: "wrangler login",
+    credentialPaths: ["~/.config/.wrangler/config/default.toml"],
+    description: "Tail logs with `wrangler tail`. Use `cloudflared` for tunnels.",
+    versionCmd: "wrangler --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://dash\\.cloudflare\\.com/oauth2/auth\\S+)",
+    oauthCallbackPort: 8976
+  },
+  stripe: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/stripe/stripe-cli/releases/download/v1.50.10/stripe_1.50.10_linux_x86_64.tar.gz | tar -xz -C /usr/local/bin stripe",
+    cloudVerifyCmd: "stripe --version",
+    category: "payments",
+    pkg: "stripe",
+    installer: "binary",
+    label: "Stripe",
+    summary: "Look up Stripe payments, customers and subscriptions.",
+    statusCmd: "stripe config --list 2>/dev/null | sed -n 's/^account_id[[:space:]]*=[[:space:]]*.\\([^'\\'']*\\).*/\\1/p' | grep -m10 .",
+    loginCmd: "stripe login",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.config/stripe/config.toml"],
+    description: "`stripe listen` forwards webhooks locally; `stripe get/post /v1/...` for raw API.",
+    versionCmd: "stripe --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "verification code:\\s*([A-Z0-9]{4}-[A-Z0-9]{4})",
+    oauthUrlPattern: "(https://access\\.stripe\\.com/stripecli/\\S+)",
+    canStreamLogin: true
+  },
+  flyctl: {
+    category: "cloud",
+    pkg: "flyctl",
+    installer: "binary",
+    label: "Fly.io",
+    summary: "Deploy and scale apps on Fly.io.",
+    statusCmd: "flyctl auth whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "flyctl auth login -t <access_token>",
+    credentialPaths: ["~/.fly/config.yml"],
+    description: "`flyctl deploy` from app dir; manage Postgres/volumes/machines/secrets.",
+    versionCmd: "flyctl version 2>/dev/null | sed -n 1p"
+  },
+  supabase: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/supabase/cli/releases/download/v2.117.0/supabase_2.117.0_linux_amd64.tar.gz | tar -xz -C /usr/local/bin supabase",
+    cloudVerifyCmd: "supabase --version",
+    category: "cloud",
+    pkg: "supabase",
+    installer: "binary",
+    label: "Supabase",
+    summary: "Manage your Supabase database, auth and storage.",
+    statusCmd: "supabase projects list >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "supabase login --token <access_token>",
+    credentialPaths: ["~/.config/supabase/access-token"],
+    description: "Link to cloud project; runs/migrates local Postgres.",
+    versionCmd: "supabase --version 2>/dev/null | sed -n 1p"
+  },
+  railway: {
+    category: "cloud",
+    pkg: "@railway/cli",
+    installer: "npm",
+    label: "Railway",
+    summary: "Deploy and manage apps and databases on Railway.",
+    statusCmd: `out=$(RAILWAY_NO_TELEMETRY=1 railway whoami 2>&1); rc=$?; printf '%s\\n' "$out" | grep -m1 .; exit $rc`,
+    loginCmd: "railway login --browserless",
+    credentialPaths: ["~/.railway/config.json"],
+    description: "`railway up` to deploy current dir.",
+    versionCmd: "railway --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "user_code=([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://railway\\.com/activate\\S*)",
+    canStreamLogin: true
+  },
+  shopify: {
+    preinstallCloud: true,
+    category: "ecommerce",
+    pkg: "@shopify/cli",
+    installer: "npm",
+    label: "Shopify",
+    summary: "Build and manage Shopify stores and themes.",
+    loginCmd: "shopify auth login --alias tfa",
+    credentialPaths: ["~/.config/shopify-cli-kit-nodejs/config.json"],
+    versionCmd: `node -p "require(require('fs').realpathSync(require('child_process').execSync('command -v shopify',{encoding:'utf8'}).trim()).replace(/\\/bin\\/[^/]*$/, '/package.json')).version" 2>/dev/null`,
+    statusCmd: `python3 -c "import json,os,sys;p=os.path.expanduser('~/.config/shopify-cli-kit-nodejs/config.json');sys.exit(0 if json.load(open(p)).get('session') else 1)" 2>/dev/null && echo authenticated`,
+    deviceCodePattern: "verification code: ([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://accounts\\.shopify\\.com/activate-with-code\\S*)",
+    canStreamLogin: true,
+    description: "Theme development, app scaffolding, store management"
+  },
+  "shop-app": {
+    preinstallCloud: true,
+    category: "ecommerce",
+    pkg: "@todoforai/shop-app",
+    installer: "npm",
+    label: "Shop",
+    summary: "Search products and compare prices across Shopify stores.",
+    description: "Shop.app product search across Shopify stores. `shop-app search '<query>' --ships-to HU -n 10` returns products with price, rating, URL, and variants. `shop-app similar <variantId>` finds lookalikes.",
+    versionCmd: "shop-app --version 2>/dev/null | sed -n 1p"
+  },
+  "datadog-ci": {
+    category: "monitoring",
+    pkg: "@datadog/datadog-ci",
+    installer: "npm",
+    label: "Datadog",
+    summary: "Send test results and releases to Datadog.",
+    versionCmd: "datadog-ci version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -n "$DATADOG_API_KEY" && echo authenticated',
+    description: "CI test visibility, sourcemap uploads, deployment tracking."
+  },
+  "sentry-cli": {
+    preinstallCloud: true,
+    category: "monitoring",
+    pkg: "@sentry/cli",
+    installer: "npm",
+    label: "Sentry",
+    summary: "Manage Sentry releases and error tracking.",
+    statusCmd: "sentry-cli info --no-defaults >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "sentry-cli login --auth-token <auth_token>",
+    credentialPaths: ["~/.sentryclirc"],
+    description: "`sentry-cli releases new <version>`.",
+    versionCmd: "sentry-cli --version 2>/dev/null | sed -n 1p"
+  },
+  "tfa-cli": {
+    category: "utility",
+    pkg: "@todoforai/cli",
+    installer: "npm",
+    label: "TODOforAI",
+    summary: "Create and follow up on your TODOs, and show results in the chat.",
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype; `--card <name>` via project renderer; `--alias <name>` updates in place), `open <url>` embeds a live preview. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push — recipient is ALWAYS the key\'s own user (no --to; cannot message teammates or anyone else), shown as from you, same text is delivered once, max 10/day, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
+    installCmd: "npm install -g @todoforai/cli",
+    versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true,
+    aliases: ["todoforai-cli", "todoai"]
+  },
+  curl: {
+    commodity: true,
+    category: "networking",
+    pkg: "curl",
+    installer: "system",
+    label: "Web Request",
+    summary: "Fetch URLs and call web APIs.",
+    binName: "curl",
+    description: "HTTP/HTTPS/FTP client: GET/POST/PUT/DELETE, headers, auth, file upload/download, follow redirects, cookies, TLS.",
+    versionCmd: "curl --version 2>/dev/null | sed -n 1p | cut -d' ' -f1-2",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  cloudflared: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/cloudflare/cloudflared/releases/download/2026.9.0/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared && chmod 0755 /usr/local/bin/cloudflared",
+    cloudVerifyCmd: "cloudflared --version",
+    commodity: true,
+    category: "networking",
+    pkg: "cloudflared",
+    installer: "binary",
+    label: "Tunnel",
+    summary: "Put a local app on a public web address.",
+    description: "`cloudflared tunnel --url http://localhost:<port>` prints a public https URL.",
+    versionCmd: "cloudflared --version 2>/dev/null | sed -n 1p"
+  },
+  vault: {
+    category: "security",
+    pkg: "vault",
+    installer: "binary",
+    label: "HashiCorp Vault",
+    summary: "Read and manage secrets in HashiCorp Vault.",
+    statusCmd: "vault token lookup >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "vault login <token>",
+    credentialPaths: ["~/.vault-token"],
+    versionCmd: "vault --version 2>/dev/null | sed -n '1s/ (.*//p'",
+    description: "HashiCorp Vault secrets management and dynamic credentials."
+  },
+  rclone: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "Cloud Storage",
+    summary: "Move files between Google Drive, Dropbox, OneDrive, S3 and more.",
+    statusCmd: "rclone listremotes --long 2>/dev/null | tr -s ' ' | grep -v ' todoforai *$' | grep -m20 .",
+    loginCmd: "rclone config",
+    loginTerminalHint: "Connect a storage from its own tile (Google Drive, OneDrive, Dropbox…). For other backends run `rclone config` in a terminal on this host.",
+    oauthUrlPattern: "(https?://127\\.0\\.0\\.1:\\d+/auth\\?\\S+)",
+    oauthCallbackPort: 53682,
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    subProviders: {
+      gdrive: {
+        label: "Google Drive",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} drive",
+        remoteName: "gdrive",
+        rcloneType: "drive",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://www.googleapis.com/drive/v3/about?fields=user' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['user']['emailAddress'])" 2>/dev/null`
+      },
+      onedrive: {
+        label: "OneDrive",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} onedrive",
+        remoteName: "onedrive",
+        rcloneType: "onedrive",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://graph.microsoft.com/v1.0/me' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('mail') or d.get('userPrincipalName',''))" 2>/dev/null`
+      },
+      dropbox: {
+        label: "Dropbox",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} dropbox",
+        remoteName: "dropbox",
+        rcloneType: "dropbox",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf -X POST 'https://api.dropboxapi.com/2/users/get_current_account' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['email'])" 2>/dev/null`
+      },
+      s3: {
+        label: "Amazon S3",
+        authType: "credentials",
+        connectCmd: "rclone config create {{REMOTE}} s3",
+        remoteName: "s3",
+        rcloneType: "s3"
+      }
+    },
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    description: "Access Google Drive, OneDrive, Dropbox, S3, and 40+ cloud providers. List, copy, sync, move, and mount files; use `rclone config create <name> <provider>` to connect."
+  },
+  aws: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o /tmp/awscli.zip && unzip -qo /tmp/awscli.zip -d /tmp && /tmp/aws/install --update && rm -rf /tmp/aws /tmp/awscli.zip",
+    cloudVerifyCmd: "aws --version",
+    category: "cloud",
+    pkg: "awscli",
+    installer: "system",
+    label: "AWS",
+    summary: "Manage your AWS account and services.",
+    installCmd: `mkdir -p "$HOME/.todoforai/tools/bin"; if [ "$(uname -s)" = Darwin ]; then curl -fsSL https://awscli.amazonaws.com/AWSCLIV2.pkg -o /tmp/AWSCLIV2.pkg && printf '<?xml version="1.0" encoding="UTF-8"?>\\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\\n<plist version="1.0"><array><dict><key>choiceAttribute</key><string>customLocation</string><key>attributeSetting</key><string>%s</string><key>choiceIdentifier</key><string>default</string></dict></array></plist>\\n' "$HOME/.todoforai/tools" > /tmp/aws-choices.xml && installer -pkg /tmp/AWSCLIV2.pkg -target CurrentUserHomeDirectory -applyChoiceChangesXML /tmp/aws-choices.xml && mkdir -p "$HOME/.todoforai/tools/bin" && ln -sf "$HOME/.todoforai/tools/aws-cli/aws" "$HOME/.todoforai/tools/bin/aws" && ln -sf "$HOME/.todoforai/tools/aws-cli/aws_completer" "$HOME/.todoforai/tools/bin/aws_completer"; rc=$?; rm -f /tmp/AWSCLIV2.pkg /tmp/aws-choices.xml; exit $rc; else ARCH=$(uname -m); case "$ARCH" in arm64|aarch64) ARCH=aarch64;; *) ARCH=x86_64;; esac; curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$ARCH.zip" -o /tmp/awscli.zip && rm -rf /tmp/aws && unzip -qo /tmp/awscli.zip -d /tmp && /tmp/aws/install --update --install-dir "$HOME/.todoforai/tools/aws-cli" --bin-dir "$HOME/.todoforai/tools/bin"; rc=$?; rm -rf /tmp/aws /tmp/awscli.zip; exit $rc; fi`,
+    statusCmd: "aws sts get-caller-identity --query Arn --output text 2>/dev/null | sed 's/.*\\///' | grep -m1 .",
+    loginCmd: "aws configure set aws_access_key_id <access_key_id> && aws configure set aws_secret_access_key <secret_access_key> && aws configure set region <region>",
+    credentialPaths: ["~/.aws/credentials", "~/.aws/config", "~/.aws/sso/cache"],
+    description: "Official AWS CLI v2, installed user-locally into ~/.todoforai/tools (no sudo; Linux x86_64/aarch64 + macOS). Auth via `aws configure` (access keys) or `aws configure sso` + `aws sso login` (browser device flow).",
+    versionCmd: "aws --version 2>/dev/null | sed -n 1p",
+    uninstallCmd: 'rm -rf "$HOME/.todoforai/tools/aws-cli" "$HOME/.todoforai/tools/bin/aws" "$HOME/.todoforai/tools/bin/aws_completer"; hash -r 2>/dev/null; ! command -v aws >/dev/null 2>&1 || { echo "aws is still on PATH: $(command -v aws) — not installed by TODOforAI, remove it with the package manager that installed it (snap/apt/brew/sudo)"; exit 1; }'
+  },
+  gcloud: {
+    category: "cloud",
+    pkg: "google-cloud-sdk",
+    installer: "system",
+    label: "Google Cloud",
+    summary: "Manage your Google Cloud projects and services.",
+    installCmd: 'curl -sSL https://sdk.cloud.google.com | bash -s -- --disable-prompts && mkdir -p "$HOME/.todoforai/tools/bin" && ln -sf "$HOME/google-cloud-sdk/bin/gcloud" "$HOME/.todoforai/tools/bin/gcloud"',
+    statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
+    loginCmd: "gcloud auth login --no-launch-browser",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    oauthUrlPattern: "(https://accounts\\.google\\.com/o/oauth2/auth\\S+)",
+    credentialPaths: ["~/.config/gcloud"],
+    description: "Official Google Cloud CLI. `gcloud auth login --no-launch-browser` prints the OAuth URL and waits for the pasted verification code.",
+    versionCmd: "gcloud --version 2>/dev/null | sed -n 1p",
+    uninstallCmd: 'rm -rf "$HOME/google-cloud-sdk" "$HOME/.todoforai/tools/bin/gcloud"; hash -r 2>/dev/null; ! command -v gcloud >/dev/null 2>&1 || { echo "gcloud is still on PATH: $(command -v gcloud)"; exit 1; }',
+    updateCmd: "gcloud components update --quiet"
+  },
+  az: {
+    category: "cloud",
+    pkg: "azure-cli",
+    installer: "pip",
+    label: "Azure",
+    summary: "Manage your Microsoft Azure resources.",
+    binName: "az",
+    statusCmd: "az account show --query user.name -o tsv 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "az login --use-device-code",
+    oauthUrlPattern: "(https://login\\.microsoft\\.com/device\\S*)",
+    deviceCodePattern: "enter the code ([A-Z0-9]+)",
+    canStreamLogin: true,
+    credentialPaths: ["~/.azure"],
+    description: "Official Azure CLI. Device-code login: prints login.microsoft.com/device + a code, then polls — no callback port.",
+    versionCmd: `az version --query '"azure-cli"' -o tsv 2>/dev/null | sed -n 1p`
+  },
+  doctl: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/digitalocean/doctl/releases/download/v1.168.0/doctl-1.168.0-linux-amd64.tar.gz | tar -xz -C /usr/local/bin doctl",
+    cloudVerifyCmd: "doctl version",
+    category: "cloud",
+    pkg: "doctl",
+    installer: "binary",
+    label: "DigitalOcean",
+    summary: "Manage your DigitalOcean servers and apps.",
+    statusCmd: "doctl account get --format Email --no-header 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "doctl auth init -t <access_token>",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.config/doctl/config.yaml"],
+    description: "Official DigitalOcean CLI. `doctl auth init` prompts for an API token from cloud.digitalocean.com/account/api/tokens.",
+    versionCmd: "doctl version 2>/dev/null | sed -n 1p"
+  },
+  rdt: {
+    preinstallCloud: true,
+    packages: ["rdt-cli==0.4.1"],
+    category: "social",
+    pkg: "rdt-cli",
+    installer: "pip",
+    label: "Reddit",
+    summary: "Search Reddit, read threads and post comments.",
+    statusCmd: `rdt status 2>&1 | sed -n 's/.*"username"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "rdt login",
+    loginTerminalHint: "Log in to reddit.com in a browser on this host (Chrome/Firefox), then run `rdt login`: it imports that browser's Reddit cookies.",
+    credentialPaths: ["~/.config/rdt-cli/credential.json"],
+    description: 'Reddit CLI. Read: `rdt search "<query>" -r <sub> --json -c`, `rdt sub <name>`, `rdt read <postId>`, `rdt user-comments <user>`. Write: `rdt comment <postId> "<text>"`, `rdt upvote`, `rdt save`.',
+    versionCmd: "rdt --version 2>/dev/null | sed -n 1p"
+  },
+  pymupdf: {
+    category: "utility",
+    pkg: "pymupdf",
+    packages: ["pymupdf==1.28.2"],
+    installer: "pip",
+    label: "PDF",
+    summary: "Read, edit, merge and split PDF files.",
+    versionCmd: "{ python -c 'import pymupdf; print(pymupdf.__version__)' || python3 -c 'import pymupdf; print(pymupdf.__version__)' || py -c 'import pymupdf; print(pymupdf.__version__)'; } 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "python3 -c 'import pymupdf'",
+    preinstallJarvis: true,
+    description: "PDF text editing, extraction, merge, split. Call via `python3 -c`."
+  },
+  pyhanko: {
+    category: "security",
+    pkg: "pyhanko-cli",
+    packages: ["pyhanko-cli==0.5.0", "pyHanko[pkcs11,image-support,opentype]==0.37.0"],
+    installer: "pip",
+    binName: "pyhanko",
+    label: "PDF Signing",
+    summary: "Digitally sign and verify PDFs with a certificate (PAdES, timestamps, smart cards).",
+    versionCmd: "pyhanko --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    cloudVerifyCmd: "pyhanko --version",
+    preinstallJarvis: true,
+    description: "Cryptographic PDF signing/validation (PAdES B-B..B-LTA). Sign: `pyhanko sign addsig --field Sig1 [--timestamp-url <tsa>] pkcs12 --passfile pass.txt in.pdf out.pdf cert.p12`; smart card/eID: `... pkcs11 --lib <pkcs11.so> in.pdf out.pdf`; verify: `pyhanko sign validate --pretty-print [--trust ca.pem] out.pdf`; list fields: `pyhanko sign list`. The signer's cert/key comes from the user (vault); self-signed certs validate only with `--trust`. Not for click-to-sign workflows."
+  },
+  anydoc: {
+    category: "utility",
+    pkg: "@firecrawl/anydoc",
+    installer: "npm",
+    binName: "anydoc",
+    label: "Doc to Markdown",
+    summary: "Turn Word, PowerPoint, Excel and other documents into clean text.",
+    description: "Office/rich docs (docx/pptx/xlsx/odt/rtf/epub/csv) → Markdown, fully local. `anydoc file.docx` → stdout, `-o out.md` writes, `anydoc - --format csv < stdin`. Prefer over raw XML extraction for reading; one-way, no OCR for scanned PDFs.",
+    versionCmd: "anydoc --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "agent-browser": {
+    category: "development",
+    pkg: "agent-browser@0.30.1",
+    installer: "npm",
+    preinstallCloud: true,
+    label: "Browser",
+    summary: "Browse websites automatically: click, type, read and screenshot.",
+    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome), verify with `snapshot`; if empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`.",
+    versionCmd: "agent-browser --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true
+  },
+  "browser-manager-cli": {
+    category: "development",
+    pkg: "browser-manager-cli",
+    installer: "binary",
+    binName: "browser-manager-cli",
+    preinstallCloud: true,
+    label: "Browser Manager",
+    summary: "Start browsers in the cloud for automated browsing.",
+    platformAuth: true,
+    description: "Spawns cloud Chromium sessions, each exposed as a CDP WebSocket for agent-browser to drive. `create` prints one line ending in a cdpUrl — pass it straight to `agent-browser connect '<cdpUrl>'` (connect the cdpUrl, not the Chrome debug port). `list`/`get <id>`, `delete <id>`/`delete-all`, `hibernate`/`restore`. Sessions run stealth Chromium that reads as a real desktop browser. For sites that block datacenter IPs, route through a proxy: `create --proxy socks5://host:port [--proxy-user U --proxy-pass P]`. Use this on the cloud VM instead of launching a local browser.",
+    versionCmd: "browser-manager-cli version 2>/dev/null | sed -n 1p",
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-linux-x86_64",
+        archive: "raw"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-linux-aarch64",
+        archive: "raw"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-darwin-x86_64",
+        archive: "raw"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-darwin-aarch64",
+        archive: "raw"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-windows-x86_64.exe",
+        archive: "raw"
+      }
+    },
+    preinstallJarvis: true
+  },
+  "todoforai-browser": {
+    category: "development",
+    pkg: "@todoforai/browser",
+    aliases: ["tfa-browser"],
+    installer: "npm",
+    preinstallCloud: true,
+    label: "Browser (Extension)",
+    summary: "Drive your own browser through the TODOforAI extension.",
+    versionCmd: `node -p "require(require('fs').realpathSync(require('child_process').execSync('command -v todoforai-browser',{encoding:'utf8'}).trim()).replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
+    internal: true,
+    preinstallJarvis: true,
+    description: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation"
+  },
+  "tfa-explore": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-explore",
+    installer: "npm",
+    label: "Explore",
+    summary: "Send a helper agent to explore a codebase and report back.",
+    platformAuth: true,
+    description: 'Sub-agent codebase exploration in its own context, you get only the answer: `tfa-explore "where is auth handled?" [--repo <path>]`. Prefer over manual multi-file searching.',
+    versionCmd: "tfa-explore --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-explore",
+    internal: true
+  },
+  "tfa-review": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-review",
+    installer: "npm",
+    label: "Review",
+    summary: "Send a helper agent to review your code changes.",
+    platformAuth: true,
+    description: 'Sub-agent review of a git diff in its own context: `tfa-review "<goal>" [--repo <path>] [--against <ref>]` (default: uncommitted). Run before calling a non-trivial change done.',
+    versionCmd: "tfa-review --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-review",
+    internal: true
+  },
+  "tfa-summary": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-summary",
+    installer: "npm",
+    label: "Summary",
+    summary: "Summarize files or long output with a helper agent.",
+    platformAuth: true,
+    description: 'Sub-agent summary so raw text never enters your context: `cat big.log | tfa-summary "what failed?"`, or `-f <file>` (repeatable).',
+    versionCmd: "tfa-summary --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-summary",
+    internal: true
+  },
+  "tfa-handoff": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-handoff",
+    installer: "npm",
+    label: "Handoff",
+    summary: "Turn a long conversation into a short handover note.",
+    platformAuth: true,
+    description: "Compact a conversation into a handoff document for a fresh agent.",
+    versionCmd: "tfa-handoff --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-handoff",
+    internal: true
+  },
+  "tfa-wait": {
+    category: "development",
+    pkg: "@todoforai/tfa-wait",
+    installer: "npm",
+    label: "Wait",
+    summary: "Wait for a time or an event, then continue the task.",
+    platformAuth: true,
+    description: "Schedule a wake-up: `tfa-wait '<expr>' \"<message>\"` — expr is a time (`3h`, `daily@9:00`), a webhook, or a command's output; the message arrives later as a new chat message. Wait for a long job: `tfa-wait 'bench || 6h' \"Done: exit {{payload.exit}}\"` then `tfa-wait run '<cmd>' --pipe bench --on-exit &` (each stdout line = event; cancelling kills the command). Never pgrep/sleep poll loops.",
+    versionCmd: "tfa-wait --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-wait",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  "tfa-vault": {
+    category: "security",
+    pkg: "@todoforai/tfa-vault",
+    installer: "npm",
+    label: "Vault",
+    summary: "Your password and secret store.",
+    platformAuth: true,
+    description: "The user's encrypted secret vault — using its secrets is the intended workflow. READ: when a task needs a key/token/password the user owns, `tfa-vault list` then `get <path>`; don't ask for what's already stored; never echo values. WRITE proactively: any new secret in the conversation (pasted, generated, from a login) → `put <path> field=value` (`patch` adds fields; `put` refuses an existing path — `put --force` replaces all fields on rotation). Paths: `accounts/<svc>`, `api/<svc>`, `secrets/<name>`.",
+    versionCmd: "tfa-vault --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-vault",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "tfa-settings": {
+    category: "utility",
+    pkg: "@todoforai/tfa-settings",
+    installer: "npm",
+    label: "Settings",
+    summary: "Change your TODOforAI app preferences from the shell.",
+    platformAuth: true,
+    description: "The user's TODOforAI app preferences (AppSettings): `list`, `get <key>`, `set key=value …`, `keys` (documented keys). Use when asked to change theme, list style, tool-block density, thinking traces, sounds/toasts, preview columns, wallpaper etc. Values are JSON when parseable. Consent/credential/escalation keys (shellExecution, notifications, analytics, keyboard bindings, vault provider, billing address) are refused from an agent shell — tell the user to change those in Settings.",
+    versionCmd: "tfa-settings --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-settings",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "tfa-memory": {
+    category: "productivity",
+    pkg: "@todoforai/tfa-memory",
+    installer: "npm",
+    label: "Memory",
+    summary: "Your long-term memory of notes, facts and past TODOs.",
+    platformAuth: true,
+    description: 'User\'s long-term memory (notes/procedures/decisions, address `source/ref`) plus every past TODO message (read-only, `todo/<todoId>:<messageId>`). READ: `search "<topic>" --mode fused` first (`lexical` = all words newest first, `semantic` = meaning; `--source todo` / `--todo <id>` narrow). stderr prints `N row(s) contain a query word` — if N exceeds what you saw, page with `--exclude <address>`. `get <address>` = full row, `around <address> --before N --after N` = surrounding dialogue. Before answering from memory, search once more with your draft\'s key facts. WRITE durable facts proactively: `add <source>/<ref> "text"` (same address updates in place; short source names like deploy-notes, preferences). `sources` lists them.',
+    versionCmd: "tfa-memory --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-memory",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "todoregistry-cli": {
+    category: "development",
+    pkg: "@todoforai/todoregistry-cli",
+    installer: "npm",
+    label: "TODO Registry",
+    summary: "Browse ready-made business task templates.",
+    description: "Reusable business task templates (SEO, email, CRM, ads, social, …): `search <q>`, `get <id>`, `list [category]`, `categories`, `create --name … --description … --body @prompt.md`. To recommend a template, don't create a todo directly — `tfa-cli recommend --template <id> --project <projectId>`.",
+    versionCmd: "todoregistry-cli --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/todoregistry-cli",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  "tfa-surface": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "@todoforai/tfa-surface",
+    installer: "npm",
+    label: "Surface",
+    summary: "See and control what is on your TODOforAI screen.",
+    platformAuth: true,
+    description: "The user's live UI from the shell. Everything on screen is a SURFACE holding one ref (a todo id, `<todoId>:<alias>` = a shown artifact, or a url). `describe` lists them (kind, id, ref, focus, embedded-browser CDP URL; `--json`). `open overlay <todoId>` (full page), `open window <ref>` (floating), `open panel changes|preview|browser|terminal [--url]` (a todo's side panel), `open card <ref> [--title] [--group <slug>]` (a persisted board card every member sees); `close|focus <kind> <id>`. Persistent state (plans, reports, live status) → `show chat.panel <todoId> \"...md\"` (stdin ok; re-show updates in place), `clear` removes; events go in chat. `card add|list|get|rm <name>` = project HTML renderers. Exit 2 = no frontend connected.",
+    versionCmd: "tfa-surface --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-surface",
+    internal: true
+  },
+  bun: {
+    commodity: true,
+    category: "development",
+    pkg: "bun",
+    installer: "system",
+    label: "JS/TS Runtime",
+    summary: "Run JavaScript and TypeScript code, fast.",
+    versionCmd: "bun --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "export BUN_INSTALL=/usr/local && curl -fsSL https://bun.sh/install | bash && ln -sf /usr/local/bin/bun /usr/local/bin/bunx",
+    cloudVerifyCmd: "bun --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run JavaScript/TypeScript, install packages, run tests (`bun`, `bunx`)."
+  },
+  bunx: {
+    commodity: true,
+    category: "development",
+    pkg: "bunx",
+    installer: "system",
+    label: "Bun Package Runner",
+    summary: "Run a JavaScript package without installing it.",
+    versionCmd: "bunx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "bunx --version",
+    internal: true,
+    description: "Run package binaries with Bun."
+  },
+  node: {
+    commodity: true,
+    category: "development",
+    pkg: "node",
+    installer: "system",
+    label: "JavaScript Runtime",
+    summary: "Run JavaScript code.",
+    versionCmd: "node -p 'process.version' 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://deb.nodesource.com/setup_24.x | bash -",
+    cloudAptPackages: ["nodejs"],
+    cloudVerifyCmd: "node --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run Node.js scripts."
+  },
+  python3: {
+    commodity: true,
+    category: "development",
+    pkg: "python3",
+    installer: "system",
+    label: "Python",
+    summary: "Run Python code.",
+    versionCmd: "{ python3 --version || python --version || py --version; } 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    cloudAptPackages: ["python3"],
+    cloudVerifyCmd: "python3 --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run Python scripts."
+  },
+  npm: {
+    commodity: true,
+    category: "development",
+    pkg: "npm",
+    installer: "system",
+    label: "Node Package Manager",
+    summary: "Install JavaScript packages.",
+    versionCmd: "npm --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "npm --version",
+    internal: true,
+    description: "Install Node packages and run package scripts."
+  },
+  npx: {
+    commodity: true,
+    category: "development",
+    pkg: "npx",
+    installer: "system",
+    label: "Node Package Runner",
+    summary: "Run a JavaScript package without installing it.",
+    versionCmd: "npx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "npx --version",
+    internal: true,
+    description: "Run npm package binaries."
+  },
+  pip3: {
+    preinstallCloud: true,
+    cloudAptPackages: ["python3-pip"],
+    cloudVerifyCmd: "pip3 --version",
+    commodity: true,
+    category: "development",
+    pkg: "pip3",
+    installer: "system",
+    label: "Python Package Installer",
+    summary: "Install Python packages.",
+    versionCmd: "pip3 --version 2>/dev/null | sed -n 1p | cut -d' ' -f1-2",
+    internal: true,
+    description: "Install Python packages."
+  },
+  uv: {
+    commodity: true,
+    category: "development",
+    pkg: "uv",
+    installer: "system",
+    label: "Python Package Manager",
+    summary: "Install Python packages and manage environments, fast.",
+    versionCmd: "uv --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -LsSf https://astral.sh/uv/0.9.6/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh",
+    cloudVerifyCmd: "uv --version",
+    internal: true,
+    description: "Manage Python dependencies, environments, tools, and scripts (`uv`, `uvx`)."
+  },
+  uvx: {
+    commodity: true,
+    category: "development",
+    pkg: "uvx",
+    installer: "system",
+    label: "Python Tool Runner",
+    summary: "Run a Python tool without installing it.",
+    versionCmd: "uvx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "uvx --version",
+    internal: true,
+    description: "Run Python tools in isolated environments."
+  },
+  ripgrep: {
+    commodity: true,
+    category: "development",
+    pkg: "ripgrep",
+    installer: "binary",
+    label: "Search",
+    summary: "Search text across files, very fast.",
+    description: "Fast recursive grep with regex, .gitignore-aware, parallel, unicode-correct",
+    versionCmd: "rg --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-x86_64-unknown-linux-musl/rg"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-unknown-linux-gnu.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-aarch64-unknown-linux-gnu/rg"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-x86_64-apple-darwin/rg"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-aarch64-apple-darwin/rg"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "ripgrep-14.1.1-x86_64-pc-windows-msvc/rg.exe"
+      }
+    },
+    binName: "rg",
+    internal: true,
+    preinstallJarvis: true
+  },
+  "ast-grep": {
+    category: "development",
+    pkg: "ast-grep",
+    installer: "binary",
+    label: "Structural Search",
+    summary: "Search and rewrite code by its structure, not just text.",
+    description: 'Use when regex cannot distinguish syntax from text: `ast-grep -p "foo($$$)" -l ts` finds real calls while ignoring strings and comments; add `--rewrite "..."` for codemods. Prefer `rg` for literal or token search.',
+    versionCmd: "ast-grep --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-unknown-linux-gnu.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-aarch64-unknown-linux-gnu.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-apple-darwin.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-aarch64-apple-darwin.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "ast-grep.exe"
+      }
+    },
+    binName: "ast-grep",
+    internal: true,
+    preinstallJarvis: true
+  },
+  fd: {
+    commodity: true,
+    category: "development",
+    pkg: "fd-find",
+    installer: "binary",
+    label: "Find Files",
+    summary: "Find files and folders by name.",
+    description: "Fast user-friendly find replacement: regex by default, .gitignore-aware, parallel",
+    versionCmd: "fd --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-unknown-linux-musl.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-x86_64-unknown-linux-musl/fd"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-unknown-linux-gnu.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-aarch64-unknown-linux-gnu/fd"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-x86_64-apple-darwin/fd"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-aarch64-apple-darwin/fd"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "fd-v10.2.0-x86_64-pc-windows-msvc/fd.exe"
+      }
+    },
+    binName: "fd",
+    internal: true,
+    preinstallJarvis: true
+  },
+  jq: {
+    commodity: true,
+    category: "development",
+    pkg: "jq",
+    installer: "binary",
+    label: "JSON",
+    summary: "Read and reshape JSON data.",
+    description: "Command-line JSON processor: query, filter, transform, format JSON streams",
+    versionCmd: "jq --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64",
+        archive: "raw"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-arm64",
+        archive: "raw"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-amd64",
+        archive: "raw"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-arm64",
+        archive: "raw"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe",
+        archive: "raw"
+      }
+    },
+    binName: "jq",
+    internal: true,
+    preinstallJarvis: true
+  },
+  patch: {
+    commodity: true,
+    category: "development",
+    pkg: "patch",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Apply Diff",
+    summary: "Apply a diff to files.",
+    description: "Apply unified/context diff patches to files; reverse, dry-run, fuzzy matching",
+    versionCmd: "patch --version 2>/dev/null | sed -n 1p",
+    binName: "patch",
+    internal: true,
+    preinstallJarvis: true
+  },
+  sed: {
+    commodity: true,
+    category: "development",
+    pkg: "sed",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Replace Text",
+    summary: "Find and replace text in files.",
+    description: "Stream editor: in-place text substitution, line filtering, scripted edits",
+    versionCmd: "sed --version 2>/dev/null | sed -n 1p",
+    binName: "sed",
+    internal: true,
+    preinstallJarvis: true
+  },
+  grep: {
+    commodity: true,
+    category: "development",
+    pkg: "grep",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Search Text",
+    summary: "Search for text in files.",
+    description: "Search plain text for lines matching a regex: recursive, fixed-string, context, invert, count",
+    versionCmd: "grep --version 2>/dev/null | sed -n 1p",
+    binName: "grep",
+    internal: true,
+    preinstallJarvis: true
+  },
+  "wordpress-api": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/wordpress-api",
+    installer: "npm",
+    label: "WordPress",
+    summary: "Read and publish WordPress posts and pages.",
+    statusCmd: `wordpress-api whoami 2>/dev/null | sed -n 's/.*"slug"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "wordpress-api auth --site <url> --user <username> --password <app_password>",
+    credentialPaths: ["~/.config/wordpress-api/credentials.json"],
+    description: "WordPress REST API CLI. `wordpress-api auth --site https://example.com --user <user> --password '<application password>'` (application password, not the login password). Reading published content needs no auth. `posts list|get|create|update|delete`, `pages`, `media`, `categories`. `posts create` saves a draft unless --status publish. On Elementor/JetEngine sites content.rendered comes back empty — fetch the post's public URL for the body.",
+    versionCmd: "wordpress-api --version 2>/dev/null | sed -n 1p"
+  },
+  "facebook-pages-api": {
+    preinstallCloud: true,
+    category: "social",
+    pkg: "@todoforai/facebook-pages-api",
+    installer: "npm",
+    label: "Facebook Pages",
+    summary: "Post to your Facebook Page and handle comments.",
+    statusCmd: `facebook-pages-api whoami 2>/dev/null | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "facebook-pages-api auth --page-id <id> --page-token <token>",
+    credentialPaths: ["~/.config/facebook-pages-api/credentials.json"],
+    description: "Facebook Pages CLI (Meta Graph API). `auth --page-id <id> --page-token <token>` (or env FB_PAGE_ID/FB_PAGE_TOKEN). `feed`, `comments`, `insights`, `conversations`, `media`, and `request <GET|POST|DELETE> <path> [--data <json>]` = any Graph edge with the page token attached (use instead of curl). Writes are live: `feed create --published false` for tests; `comments reply` posts publicly — get human approval. Follower totals: `whoami --fields followers_count,fan_count` (many classic insights metrics are retired). `--help` for subcommands.",
+    versionCmd: "facebook-pages-api --version 2>/dev/null | sed -n 1p"
+  },
+  "ews-api": {
+    category: "email",
+    pkg: "ews-api",
+    installer: "pip",
+    label: "Exchange (EWS)",
+    summary: "Read and write mail on a company Exchange server.",
+    statusCmd: `ews-api whoami 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "ews-api auth --email <email> --username <username> --server <server> --password <password>",
+    credentialPaths: ["~/.config/ews-api/credentials.json"],
+    description: "On-prem Microsoft Exchange mail over EWS (cloud/M365 → outlook-api). `auth --email <e> --username 'DOMAIN\\\\user' --server <host>` (NTLM; password prompt or `--password-stdin`; --server required). Multi-mailbox: `whoami`, `--account <email>`/EWS_ACCOUNT, `default`, `logout`; EWS_EMAIL/EWS_USERNAME/EWS_PASSWORD/EWS_SERVER for unattended runs. `list`, `search <q>`, `read <id>`, `draft`, `reply <id>` — draft/reply stay in Drafts unless --send. Password stored plaintext in ~/.config/ews-api (0600); re-auth after rotation.",
+    versionCmd: "ews-api --version 2>/dev/null | sed -n 1p",
+    logoutCmd: "ews-api logout {{ACCOUNT}}"
+  },
+  "outlook-api": {
+    preinstallCloud: true,
+    category: "email",
+    pkg: "@todoforai/outlook-api",
+    installer: "npm",
+    label: "Outlook (Graph)",
+    summary: "Read and write your Outlook mail.",
+    statusCmd: `outlook-api whoami 2>/dev/null | sed -n 's/.*"userPrincipalName"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "outlook-api auth",
+    credentialPaths: ["~/.config/outlook-api/config.json"],
+    description: "Outlook/Hotmail/M365 mail over Microsoft Graph (on-prem Exchange → ews-api). `auth` = device-code flow; `--tenant consumers` (default, personal) | `organizations`. list/search/read/attachments are read-only; `draft`/`reply` stay in Drafts unless --send; `send <draftId>`. `get <path>` = raw Graph GET. JSON out.",
+    versionCmd: "outlook-api --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "enter the code ([A-Z0-9]+)",
+    oauthUrlPattern: "(https://(?:www\\.microsoft\\.com/link|login\\.microsoft\\.com/device))",
+    canStreamLogin: true
+  },
+  neonctl: {
+    category: "database",
+    pkg: "neonctl",
+    installer: "npm",
+    label: "Neon Postgres",
+    summary: "Manage your Neon Postgres databases and branches.",
+    statusCmd: `test -f ~/.config/neon/credentials.json && neonctl me --output json 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "neonctl auth",
+    oauthUrlPattern: "(https://oauth2\\.neon\\.tech/oauth2/auth\\S+)",
+    credentialPaths: ["~/.config/neon/credentials.json"],
+    description: "Manage Neon Postgres branches and run SQL: `neonctl projects list`, `neonctl branches create`, `neonctl connection-string`. Aliased as `neon`.",
+    versionCmd: "neonctl --version 2>/dev/null | sed -n 1p",
+    aliases: ["neon"],
+    canStreamLogin: true
+  },
+  m365: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "@pnp/cli-microsoft365",
+    installer: "npm",
+    label: "Microsoft 365",
+    summary: "Work with Microsoft 365 mail, Teams, SharePoint and users.",
+    statusCmd: `m365 status --output text 2>/dev/null | tr -d '"' | grep -vi 'logged out' | grep -m1 .`,
+    loginCmd: "m365 login --authType deviceCode --appId 04b07795-8ddb-461a-bbee-02f9e1bf7b46",
+    deviceCodePattern: "enter the code ([A-Z0-9]{8,}) to authenticate",
+    oauthUrlPattern: "open the page (https://\\S+) and enter",
+    credentialPaths: ["~/.cli-m365-msal.json", "~/.cli-m365-connection.json"],
+    description: "Microsoft 365 from the shell: `m365 outlook message list`, `m365 teams team list`, `m365 spo site list`. Device-code login; add `--output json` for parseable output.",
+    versionCmd: `m365 version 2>/dev/null | tr -d '"' | sed -n 1p`
+  },
+  hubspot: {
+    preinstallCloud: true,
+    category: "marketing",
+    pkg: "@hubspot/cli",
+    installer: "npm",
+    label: "HubSpot",
+    summary: "Work with your HubSpot contacts, deals and content.",
+    binName: "hs",
+    statusCmd: "hs account list >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "hs account auth",
+    oauthUrlPattern: "(https://app\\.hubspot\\.com/l/personal-access-key\\S+)",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.hscli/config.yml"],
+    description: "Invoked as `hs`. `hs api <endpoint>` makes authenticated calls to any HubSpot API (contacts, deals, companies) — prefer it over raw curl.",
+    versionCmd: "hs --version 2>/dev/null | sed -n 1p",
+    canStreamLogin: true
+  },
+  "posthog-cli": {
+    preinstallCloud: true,
+    category: "monitoring",
+    pkg: "@posthog/cli",
+    installer: "npm",
+    label: "PostHog",
+    summary: "Query PostHog product analytics and manage feature flags.",
+    statusCmd: `grep -q '"token"' "\${POSTHOG_HOME:-$HOME/.posthog}/credentials.json" 2>/dev/null && echo authenticated`,
+    loginCmd: "posthog-cli login",
+    loginTerminalHint: "Interactive only: run `posthog-cli login` in a terminal on this host (it asks for host, project and a personal API key), or set `POSTHOG_CLI_API_KEY` + `POSTHOG_CLI_PROJECT_ID`.",
+    credentialPaths: ["~/.posthog/credentials.json"],
+    description: "Official PostHog CLI. `posthog-cli api tools` lists the agent-first API tool catalog, `posthog-cli api call <tool> '<json>'` runs one (SQL queries, insights, flags). Also uploads sourcemaps/dSYM. Env alternative: POSTHOG_CLI_API_KEY + POSTHOG_CLI_PROJECT_ID.",
+    versionCmd: "posthog-cli --version 2>/dev/null | sed -n 1p"
+  },
+  canva: {
+    category: "design",
+    pkg: "@canva/cli",
+    installer: "npm",
+    label: "Canva",
+    summary: "Build and deploy Canva apps.",
+    statusCmd: "test -s ~/.canva-cli/credentials && echo authenticated",
+    loginCmd: "canva login --mode manual --lite",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    credentialPaths: ["~/.canva-cli/credentials"],
+    description: "Official Canva CLI — app-development focused: `canva apps create/list/preview`. `canva mcp` starts the Canva Developer MCP server. For design/export automation use the Canva Connect REST API.",
+    versionCmd: "canva --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "OPEN_URL: (https://www\\.canva\\.com/api/oauth/authorize\\S+)"
+  },
+  webflow: {
+    category: "development",
+    pkg: "@webflow/webflow-cli",
+    installer: "npm",
+    label: "Webflow",
+    summary: "Manage Webflow sites, CMS content and assets.",
+    statusCmd: "webflow auth status --skip-update-check >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "webflow auth login --skip-update-check",
+    loginNeedsPty: true,
+    oauthUrlPattern: "(https://webflow\\.com/oauth/webflow/initiate\\S+)",
+    credentialPaths: ["~/.config/webflow"],
+    description: "Manage Webflow sites from the shell: `webflow sites list`, `webflow cms ...`, `webflow assets ...`. Add `--skip-update-check` in scripts.",
+    versionCmd: "webflow --version 2>/dev/null | sed -n 1p"
+  },
+  readwise: {
+    category: "productivity",
+    pkg: "@readwise/cli",
+    installer: "npm",
+    label: "Readwise",
+    summary: "Search and save articles and highlights in Readwise.",
+    statusCmd: "readwise whoami >/dev/null 2>&1 && readwise whoami 2>/dev/null | sed 's/\\x1b\\[[0-9;]*m//g' | grep -m1 .",
+    loginCmd: "readwise login",
+    credentialPaths: ["~/.readwise-cli.json"],
+    description: "Official Readwise/Reader CLI. `readwise search <query>`, `readwise list`, `readwise save <url>`; supports JSON output for piping and a read-only mode for agents. Token login for CI: `readwise login-with-token <token>` (get one at readwise.io/access_token).",
+    versionCmd: "readwise --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "OPEN_URL: (https://readwise\\.io/o/authorize\\S+)",
+    oauthCallbackPort: 6274
+  },
+  granola: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "granola-cli",
+    installer: "npm",
+    binName: "granola",
+    label: "Granola",
+    summary: "Read your Granola meeting notes and transcripts.",
+    statusCmd: `granola auth status -o json 2>/dev/null | sed -n 's/.*"authenticated": *true.*/authenticated/p' | grep -m1 .`,
+    loginCmd: "granola auth login",
+    loginTerminalHint: "Imports the Granola desktop app's session: install Granola on this host, sign in there, then run `granola auth login`.",
+    credentialPaths: ["~/.config/keyring", "~/.config/granola"],
+    versionCmd: "granola --version 2>/dev/null | sed -n 1p",
+    description: "Community Granola CLI (read-only). `granola meeting list [-l N] [--since <date>] [-s <query>] [-a <attendee>] -o json`, `granola meeting notes|enhanced|transcript <id>`, `granola meeting export <id>`; `granola folder list`, `granola workspace list`. `-o json|yaml|toon` for piping. Login imports credentials from the installed Granola desktop app (`granola auth login`) — desktop app must be logged in on the same machine; transcripts need a paid Granola plan."
+  },
+  trello: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "trello-cli",
+    installer: "npm",
+    binName: "trello",
+    label: "Trello",
+    summary: "Manage your Trello boards, lists and cards.",
+    statusCmd: "trello board:list --format json </dev/null >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "trello auth:api-key <key> && trello auth:token <token>",
+    credentialPaths: [
+      "~/.trello-cli"
+    ],
+    versionCmd: "trello --version 2>/dev/null | sed -n 1p",
+    description: "Community Trello CLI (mheap/trello-cli, no official one exists). Auth is a Trello API key + token from https://trello.com/app-key — `trello auth:api-key <key>` then `trello auth:token <token>`. `board:list`, `list:list --board <name>`, `card:list --board <b> --list <l>`, `card:create --board <b> --list <l> --name <n> [--description ..] [--due <date>]`, `card:move`, `card:comment`, `label:*`, `search <q>`. Add `--format json` for piping. Names resolve via a local cache; run `trello board:list` once after login to warm it."
+  },
+  mapps: {
+    category: "development",
+    pkg: "@mondaycom/apps-cli",
+    installer: "npm",
+    label: "monday.com",
+    summary: "Build and deploy monday.com apps.",
+    statusCmd: "grep -qsE '[A-Za-z0-9]' ~/.config/mapps/.mappsrc ~/.mappsrc && echo authenticated",
+    loginCmd: "mapps init -t <api_token>",
+    credentialPaths: ["~/.config/mapps/.mappsrc", "~/.mappsrc"],
+    description: "Invoked as `mapps` — app development and monday-code deployments only; `mapps init -t <token>` stores a monday.com API token in ~/.mappsrc. To read/write board DATA use the monday.com GraphQL API (api.monday.com/v2) with that same token.",
+    versionCmd: "mapps --version 2>/dev/null | sed -n 1p"
+  },
+  "exa-cli": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "exa-cli",
+    installer: "npm",
+    label: "Exa Search",
+    summary: "Search the web and pull page contents, built for AI.",
+    binName: "exa",
+    statusCmd: 'test -n "$EXA_API_KEY" && echo authenticated',
+    credentialPaths: [],
+    description: "Invoked as `exa`. `exa search <query>`, `exa answer <question>`, `exa contents <url>`, `exa find-similar <url>` — JSON by default. Needs EXA_API_KEY in the environment (get one at dashboard.exa.ai); store it in the vault.",
+    versionCmd: "exa --version 2>/dev/null | sed -n 1p"
+  },
+  mobbin: {
+    category: "design",
+    pkg: "mobbin",
+    installer: "npm",
+    label: "Mobbin",
+    summary: "Browse real app and website design examples.",
+    statusCmd: "mobbin auth print-cookie 2>/dev/null | grep -E '[A-Za-z0-9]' >/dev/null && echo authenticated",
+    loginCmd: "mobbin auth save-cookie",
+    loginTerminalHint: "Log in to mobbin.com in a browser on this host, then run `mobbin auth save-cookie`: it imports that browser's cookies.",
+    credentialPaths: ["~/.config/mobbin/cookie.txt", "~/.config/mobbin/storage-state.json"],
+    description: 'Unofficial CLI over Mobbin\'s undocumented web endpoints. `mobbin search --query "login" --platform ios`. Auth reuses browser cookies: log into mobbin.com in Chrome, then `mobbin auth save-cookie`.',
+    versionCmd: "mobbin --version 2>/dev/null | sed -n '1,2p' | tr '\\n' ' '"
+  },
+  "blender-mcp": {
+    preinstallCloud: true,
+    packages: ["blender-mcp==1.9.1"],
+    category: "design",
+    pkg: "blender-mcp",
+    installer: "pip",
+    label: "Blender",
+    summary: "Model, texture and render 3D scenes in a running Blender.",
+    statusCmd: `command -v blender-mcp >/dev/null && mcporter call blender.get_addon_status --output json 2>/dev/null | grep -o '"blender_version": "[^"]*"' | grep -m1 .`,
+    loginNoBrowser: true,
+    loginTerminalHint: "Needs Blender (blender.org) open on this host: in Blender, Edit → Preferences → Add-ons, enable `Blender MCP`, then press N in the 3D view → BlenderMCP tab → Connect / Start MCP server. Then press Connect here.",
+    loginCmd: `blender-mcp install-addon >/dev/null 2>&1; command -v mcporter >/dev/null 2>&1 || npm install -g --prefix "$HOME/.local" mcporter; mcporter config add blender --command blender-mcp --env BLENDER_MCP_DISABLE_TELEMETRY=1 --description 'Blender 3D via ahujasid/blender-mcp addon' --scope home`,
+    logoutCmd: "cd ~ && mcporter config remove blender",
+    credentialPaths: ["~/.mcporter/mcporter.json"],
+    description: "Blender 3D via the ahujasid/blender-mcp server through mcporter: `mcporter list blender --schema`, `mcporter call blender.<tool> key=value` (`code=@file.py`; every tool needs `user_prompt`). Workhorse: execute_blender_code (any bpy Python); also scene/object info, viewport screenshot (`--save-images <dir>`), PolyHaven/Sketchfab import. Needs a GUI Blender with the addon server started (socket :9876; headless has none). 'Could not connect' → `blender-mcp install-addon`, enable in Preferences → Add-ons, N-panel → Start MCP Server (scripted: `blender --python s.py`, s.py registers a `bpy.app.timers` calling `bpy.ops.blendermcp.start_server()`). Code runs unguarded: save first (`bpy.ops.wm.save_mainfile()`), approve destructive ops.",
+    versionCmd: `{ python -c 'from importlib.metadata import version; print(version("blender-mcp"))' || python3 -c 'from importlib.metadata import version; print(version("blender-mcp"))'; } 2>/dev/null`
+  },
+  "google-ads": {
+    category: "marketing",
+    pkg: "google-ads",
+    packages: [
+      "google-ads==32.0.0"
+    ],
+    installer: "pip",
+    label: "Google Ads",
+    summary: "Query and manage Google Ads campaigns, keywords and conversions.",
+    loginCmd: `printf 'developer_token: %s\\nclient_id: %s\\nclient_secret: %s\\nrefresh_token: %s\\nlogin_customer_id: %s\\nuse_proto_plus: true\\n' <developer_token> <client_id> <client_secret> <refresh_token> <mcc_id_digits_only> > "$HOME/google-ads.yaml" && python3 -c 'from google.ads.googleads.client import GoogleAdsClient; GoogleAdsClient.load_from_storage(); print("ok")'`,
+    credentialPaths: [
+      "~/google-ads.yaml"
+    ],
+    statusCmd: `python3 -c 'from google.ads.googleads.client import GoogleAdsClient; c=GoogleAdsClient.load_from_storage(); print(c.login_customer_id or "authenticated")' 2>/dev/null | grep -m1 .`,
+    versionCmd: "python3 -c 'import google.ads.googleads as g; print(g.VERSION)' 2>/dev/null",
+    cloudVerifyCmd: "python3 -c 'import google.ads.googleads'",
+    description: "Official Google Ads API client library (Python) — there is no official CLI, so call it via `python3 -c` or a script. Config `~/google-ads.yaml` (developer_token, client_id/secret, refresh_token, login_customer_id = MCC digits). Mint refresh_token with the bundled `google-oauthlib-tool --client-secrets <json> --scope https://www.googleapis.com/auth/adwords --save --headless` (or examples/authentication/generate_user_credentials.py). Read: `client.get_service('GoogleAdsService').search_stream(customer_id=<digits>, query=<GAQL>)`. Write: `<X>Service.mutate_<x>s(customer_id, operations, validate_only=True)` first, then real. Keyword ideas: `KeywordPlanIdeaService.generate_keyword_ideas`. Offline conversions: `ConversionUploadService.upload_click_conversions`. Customer ids are digits without dashes."
+  },
+  "cua-driver": {
+    category: "development",
+    pkg: "cua-driver",
+    installer: "system",
+    label: "Desktop Control",
+    summary: "Click, type and read native desktop apps without taking over the mouse or focus.",
+    installCmd: 'curl -fsSL https://cua.ai/driver/install.sh | CUA_DRIVER_NO_MODIFY_PATH=1 CUA_DRIVER_BIN_DIR="$HOME/.todoforai/tools/bin" bash',
+    uninstallCmd: 'curl -fsSL https://cua.ai/driver/uninstall.sh | bash; rm -f "$HOME/.todoforai/tools/bin/cua-driver" "$HOME/.todoforai/tools/bin/cua-cursor-theme"; hash -r 2>/dev/null; ! command -v cua-driver >/dev/null 2>&1 || { echo "cua-driver is still on PATH: $(command -v cua-driver)"; exit 1; }',
+    installCmdWindows: "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command '$ProgressPreference='\\''SilentlyContinue'\\''; $ErrorActionPreference='\\''Stop'\\''; [Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $t=Join-Path $env:USERPROFILE '\\''.todoforai\\tools'\\''; $d=Join-Path $t '\\''bin'\\''; New-Item -ItemType Directory -Force -Path $d | Out-Null; $env:CUA_DRIVER_RS_INSTALL_DIR=Join-Path $t '\\''cua-driver\\bin'\\''; $f=Join-Path $env:TEMP '\\''cua-driver-install.ps1'\\''; Invoke-RestMethod -UseBasicParsing https://cua.ai/driver/install.ps1 | Set-Content -LiteralPath $f -Encoding UTF8; & $f -NoAutoStart -NoPathUpdate; if($LASTEXITCODE){exit $LASTEXITCODE}; $u=New-Object Text.UTF8Encoding $false; [IO.File]::WriteAllText((Join-Path $d '\\''cua-driver'\\''), \"#!/bin/sh`nexec `\"`$(dirname `\"`$0`\")/../cua-driver/bin/cua-driver.exe`\" `\"`$@`\"`n\", $u); [IO.File]::WriteAllText((Join-Path $d '\\''cua-driver.cmd'\\''), \"@echo off`r`n`\"%~dp0..\\cua-driver\\bin\\cua-driver.exe`\" %*`r`n\", $u)'",
+    uninstallCmdWindows: "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command '$ErrorActionPreference='\\''Continue'\\''; $t=Join-Path $env:USERPROFILE '\\''.todoforai\\tools'\\''; $d=Join-Path $t '\\''bin'\\''; $j=Join-Path $t '\\''cua-driver\\bin'\\''; $exe=Join-Path $j '\\''cua-driver.exe'\\''; if(Test-Path -LiteralPath $exe){& $exe stop 2>$null | Out-Null}; Stop-Process -Name cua-driver -Force -ErrorAction SilentlyContinue; $env:CUA_DRIVER_RS_UNINSTALL_FORCE='\\''1'\\''; $env:CUA_DRIVER_RS_INSTALL_DIR=$j; Invoke-RestMethod -UseBasicParsing https://cua.ai/driver/uninstall.ps1 | Invoke-Expression; Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $d '\\''cua-driver'\\''), (Join-Path $d '\\''cua-driver.cmd'\\''); if(Test-Path -LiteralPath $j){[IO.Directory]::Delete($j,$false)}; Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $t '\\''cua-driver'\\'')'",
+    versionCmd: "cua-driver --version 2>/dev/null | sed -n 1p",
+    description: 'Native desktop automation (macOS/Windows/Linux X11; Wayland only via AT-SPI, no window screenshots) through the accessibility tree — actions land in the BACKGROUND without moving the user\'s focus or pointer. Needs a daemon: `cua-driver status || (cua-driver serve --no-overlay >/dev/null 2>&1 &)`; on macOS grant permissions first with `cua-driver permissions grant`; on Windows the daemon must run in the interactive desktop session (`cua-driver autostart enable` registers a logon task). Loop: `cua-driver call list_windows \'{}\'` → pid+window_id; `cua-driver call get_window_state \'{"pid":P,"window_id":W,"include_screenshot":false}\'` → `elements[]` with `element_token`; act with `cua-driver call click \'{"pid":P,"window_id":W,"element_token":"s..:N"}\'`, `type_text {..,"text":".."}`, `hotkey {..,"keys":["ctrl","s"]}`, `press_key`, `scroll`, `invoke_menu`. Tokens are snapshot-bound: re-run get_window_state after EVERY action (stale token = refusal). Window screenshot: add `--screenshot-out-file out.png` (`max_dimension` to shrink). Responses say `effect:unverifiable` — verify from a fresh tree, not from the click reply. `delivery_mode:"foreground"` steals focus; use only when asked. Chrome/Electron trees are near-empty — use agent-browser for web pages. `cua-driver list-tools` / `describe <tool>` for the full surface; `cua-driver mcp` exposes the same over stdio MCP.'
+  }
+};
+
+// ../packages/shared-fbe/src/toolCatalog.ts
+var TOOL_CATALOG = tool_catalog_default;
+// ../packages/shared-fbe/src/toolInstallCommand.ts
+var KEY_OF = new Map(Object.entries(TOOL_CATALOG).map(([k, e]) => [e, k]));
+var NODE_MIN_MAJOR = 24;
+var NODE_OK = `command -v npm >/dev/null 2>&1 && node -e 'process.exit(+process.versions.node.split(".")[0]>=${NODE_MIN_MAJOR}?0:1)' >/dev/null 2>&1`;
 // ../packages/shared-fbe/src/model_promos.json
 var model_promos_default = {
   _doc: [
@@ -44483,6 +46036,10 @@ var TOPICS = {
     channel: (p) => SERVER_TO_FRONTENDS.todo.message_removed(p.todoId),
     audience: "frontend"
   },
+  ["todo:comment_update" /* TODO_COMMENT_UPDATE */]: {
+    channel: (p) => SERVER_TO_FRONTENDS.todo.commentUpdate(p.todoId),
+    audience: "frontend"
+  },
   ["todo:msg_meta_usr" /* TODO_MSG_META_USR */]: {
     channel: (p) => SERVER_TO_FRONTENDS.todo.msgMetaUsr(p.todoId),
     audience: "frontend"
@@ -44559,7 +46116,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
-  version: "0.1.54",
+  version: "0.1.56",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -44627,6 +46184,9 @@ Examples:
   tfa-cli show list|rm …              # List / take down shown files
   tfa-cli open <url> [todo-id]        # Live url preview in the chat
   tfa-cli recommend --template <id>    # Add a template as a recommendation card
+  tfa-cli inbox [needs-you|messages|activity] [--unread]  # Read the notification feed (the bell)
+  tfa-cli inbox seen [tab]              # Mark notifications read
+  tfa-cli notify "Title" "message" [--href /t/<id>]  # Note to YOUR OWN user only (Messages tab + phone push); no --to
   tfa-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> links for a project you own
   tfa-cli next [--direction "<text>"]  # Analyzer growth recommendation cards
   tfa-cli <command> help                # Details per command
@@ -44707,7 +46267,7 @@ var WORD_FLAGS = {
   agents: "list-agents",
   config: "show-config"
 };
-var HELP_SUBCOMMANDS = ["agent", "todo", "project", "brand", "device", "list", "ls", "status", "show", "open"];
+var HELP_SUBCOMMANDS = ["agent", "todo", "project", "brand", "device", "list", "ls", "status", "show", "open", "inbox", "notify"];
 function parseCliArgs() {
   const { values, positionals } = parseArgs({
     args: process.argv.slice(2),
@@ -44742,6 +46302,10 @@ function parseCliArgs() {
       seed: { type: "string" },
       emails: { type: "string" },
       ttl: { type: "string" },
+      subject: { type: "string" },
+      href: { type: "string" },
+      unread: { type: "boolean", default: false },
+      limit: { type: "string" },
       resume: { type: "string", short: "r" },
       continue: { type: "boolean", short: "c", default: false },
       "non-interactive": { type: "boolean", short: "n", default: false },
@@ -46999,7 +48563,88 @@ function renderDiff(originalContent, modifiedContent, filePath) {
   return parts.join("");
 }
 
+// src/shutdown.ts
+var activeRun = null;
+var cleanups = [];
+var exiting = null;
+var cancelling = null;
+var CANCEL_TIMEOUT_MS = 5000;
+function setActiveRun(run) {
+  activeRun = run;
+}
+function withTimeout(p, ms, fallback) {
+  let timer;
+  const timeout = new Promise((r) => {
+    timer = setTimeout(() => r(fallback), ms);
+  });
+  return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
+function cancelActiveRun(timeoutMs = CANCEL_TIMEOUT_MS) {
+  if (cancelling)
+    return cancelling;
+  const pending = activeRun;
+  if (!pending)
+    return Promise.resolve({ ok: false, todoId: null });
+  const res = { ok: false };
+  const attempt = (async () => {
+    const run = await pending;
+    res.todoId = run?.todoId ?? null;
+    if (!run)
+      return res;
+    if (!run.ws.connected && !await run.ws.connect())
+      return res;
+    res.ok = await run.ws.sendInterrupt(run.projectId, run.todoId);
+    return res;
+  })().catch(() => res);
+  cancelling = withTimeout(attempt, timeoutMs, res).finally(() => {
+    if (activeRun === pending)
+      activeRun = null;
+    cancelling = null;
+  });
+  return cancelling;
+}
+function shutdown(code, reason) {
+  return exiting ??= (async () => {
+    if (reason)
+      process.stderr.write(`
+${reason}
+`);
+    if (activeRun) {
+      const { ok, todoId } = await cancelActiveRun();
+      if (ok)
+        process.stderr.write(`Stopped todo ${todoId}
+`);
+      else if (todoId)
+        process.stderr.write(`Warning: could not stop todo ${todoId} (backend unreachable)
+`);
+      else if (todoId === undefined)
+        process.stderr.write(`Warning: could not stop the todo being created (timed out)
+`);
+    }
+    for (const fn of cleanups.splice(0)) {
+      try {
+        fn();
+      } catch {}
+    }
+    process.exit(code);
+  })();
+}
+
 // src/watch.ts
+var RECONNECT_WINDOW_MS = 60000;
+var DISCONNECTED = { type: "socket:closed", success: false };
+async function resubscribe(ws, todoId, callback, windowMs = RECONNECT_WINDOW_MS) {
+  const deadline = Date.now() + windowMs;
+  for (let delay = 1000;; delay = Math.min(delay * 2, 5000)) {
+    await new Promise((r) => setTimeout(r, Math.max(0, Math.min(delay, deadline - Date.now()))));
+    const left = deadline - Date.now();
+    if (left <= 0)
+      return false;
+    const attempt = ws.subscribe(todoId, callback, { replayStatus: true }).catch(() => false);
+    if (await withTimeout(attempt, left, false))
+      return true;
+  }
+}
 var diffStoreByWs = new WeakMap;
 function classifyBlock(info) {
   const inner = (info.block_type || "").toLowerCase();
@@ -47081,12 +48726,8 @@ async function watchTodo(ws, todoId, projectId, opts = {}) {
   process.removeAllListeners("SIGINT");
   process.on("SIGINT", () => {
     interruptCount++;
-    if (interruptCount >= 2) {
-      process.stderr.write(`
-${RED}Force exit (double Ctrl+C)${RESET}
-`);
-      process.exit(130);
-    }
+    if (opts.exitOnInterrupt || interruptCount >= 2)
+      return void shutdown(130, "Cancelled by user (Ctrl+C)");
     process.stderr.write(`
 ${YELLOW}Interrupting... (Ctrl+C again to force exit)${RESET}
 `);
@@ -47285,8 +48926,22 @@ ${DIM}[todo:status] ${status}${RESET}
       callback(msgType, payload);
     }
   }
+  setActiveRun({ ws, projectId, todoId });
   try {
-    const result = await ws.waitForCompletion(todoId, callback);
+    const subscribed = await ws.subscribe(todoId, callback).catch(() => false);
+    let result = subscribed ? await ws.completion(todoId) : DISCONNECTED;
+    while (result?.type === "socket:closed") {
+      process.stderr.write(`
+${YELLOW}Connection lost — reconnecting...${RESET}
+`);
+      if (!await resubscribe(ws, todoId, callback)) {
+        await shutdown(1, `${RED}Error: backend unreachable for ${RECONNECT_WINDOW_MS / 1000}s — giving up on todo ${todoId}${RESET}`);
+      }
+      process.stderr.write(`${DIM}Reconnected.${RESET}
+`);
+      result = await ws.completion(todoId);
+    }
+    setActiveRun(null);
     process.stdout.write(`
 `);
     if (!result?.success) {
@@ -47299,6 +48954,8 @@ ${DIM}[todo:status] ${status}${RESET}
     }
     return true;
   } catch (e) {
+    await cancelActiveRun();
+    process.exitCode = 1;
     if (!opts.suppressCancelNotice) {
       process.stderr.write(`${YELLOW}Interrupted${RESET}
 `);
@@ -48362,210 +50019,629 @@ async function deviceCommand(api, positionals, args) {
     await api.renameDevice(found.id, value);
     process.stderr.write(`${GREEN}✅ ${found.name} → ${value}${RESET}
 `);
-    return;
+    return;
+  }
+  if (sub === "wallpaper") {
+    if (value !== "auto" && value !== "off")
+      fail("Usage: tfa-cli device wallpaper <device> auto|off");
+    await api.setDeviceWallpaperMode(found.id, value);
+    process.stderr.write(`${GREEN}✅ ${found.name} wallpaper: ${value}${RESET}
+`);
+    return;
+  }
+  fail(`Unknown 'device' subcommand: ${sub}`);
+}
+
+// src/list-todos.ts
+import { parseArgs as parseArgs2 } from "util";
+var STATUS_COLOR = {
+  DONE: GREEN,
+  READY: GREEN,
+  READY_CHECKED: GREEN,
+  ERROR: RED,
+  ERROR_CHECKED: RED,
+  CANCELLED: RED,
+  CANCELLED_CHECKED: RED,
+  RUNNING: YELLOW,
+  STOPPING: YELLOW,
+  COMPACTING: YELLOW,
+  REVIEW_REQUESTED: YELLOW,
+  TODO: CYAN,
+  SCHEDULED: CYAN,
+  POSTPONED: CYAN,
+  PAUSED: CYAN
+};
+var CLOSED = new Set([
+  "DONE",
+  "READY_CHECKED",
+  "CANCELLED",
+  "CANCELLED_CHECKED",
+  "ERROR_CHECKED",
+  "ARCHIVED",
+  "DELETED"
+]);
+var VALID_STATUS = new Set(Object.values(TodoStatus));
+var isOpen = (s) => !CLOSED.has(s);
+function printListTodosHelp() {
+  process.stderr.write(`
+todoforai-cli list — list todos in a project (recent first)
+
+Usage:
+  todoforai-cli list [flags]
+
+Flags:
+  -n, --limit <n>          Max rows to show (default: 30)
+      --cursor <n>         Fetch todos older than this cursor (lastActivityAt)
+      --page-size <n>      Backend page size per request (default: min(limit, 100), max: 100)
+      --search <text>      Search content/status on the backend
+  -s, --status <S[,S2]>    Filter by status (comma-separated, union).
+  -A, --all                Include DONE (also CANCELLED, ARCHIVED, …)
+      --project <id>       Project ID (default: current default project)
+      --json               Output { items, nextCursor } as JSON
+  -h, --help               Show this help
+
+Examples:
+  todoforai-cli list                         # 30 most recent open todos
+  todoforai-cli list -n 50                   # last 50 open
+  todoforai-cli list --cursor 1719234567890  # next page
+  todoforai-cli list --all                   # include DONE
+  todoforai-cli list -s RUNNING,REVIEW_REQUESTED
+  todoforai-cli list --search bug --json | jq '.items[].id'
+`);
+}
+function positiveInt(value, name) {
+  if (value === undefined)
+    return;
+  const n = Number(value);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) {
+    process.stderr.write(`${RED}Error: ${name} must be a positive integer${RESET}
+`);
+    process.exit(2);
+  }
+  return n;
+}
+function cursorValue(value) {
+  if (value === undefined)
+    return;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n < 0) {
+    process.stderr.write(`${RED}Error: --cursor must be a non-negative number${RESET}
+`);
+    process.exit(2);
+  }
+  return n;
+}
+function toItemsPage(response) {
+  if (Array.isArray(response))
+    return { items: response };
+  return {
+    items: Array.isArray(response?.items) ? response.items : [],
+    nextCursor: typeof response?.nextCursor === "number" ? response.nextCursor : undefined
+  };
+}
+function rowTime(t) {
+  return Number(t.lastActivityAt ?? t.createdAt ?? 0);
+}
+function printStatusError(unknown) {
+  process.stderr.write(`${RED}Error: unknown status ${unknown.map((s) => `'${s}'`).join(", ")}${RESET}
+`);
+  process.stderr.write(`${DIM}Use OPEN or one of: ${Object.values(TodoStatus).join(", ")}${RESET}
+`);
+  process.exit(2);
+}
+function matchesRequestedStatus(t, requested, wanted, wantOpen) {
+  if (!requested)
+    return true;
+  const s = String(t.status).toUpperCase();
+  return wantOpen && isOpen(s) || (wanted?.has(s) ?? false);
+}
+async function listTodosCommand(api, defaultProjectId, argv) {
+  const { values } = parseArgs2({
+    args: argv,
+    options: {
+      limit: { type: "string", short: "n" },
+      cursor: { type: "string" },
+      "page-size": { type: "string" },
+      search: { type: "string" },
+      status: { type: "string", short: "s" },
+      all: { type: "boolean", short: "A", default: false },
+      project: { type: "string" },
+      json: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    strict: true
+  });
+  if (values.help) {
+    printListTodosHelp();
+    return;
+  }
+  const projectId = values.project || defaultProjectId;
+  if (!projectId) {
+    process.stderr.write(`${RED}Error: no project (pass --project <id> or set a default)${RESET}
+`);
+    process.exit(1);
+  }
+  const limit = positiveInt(values.limit, "--limit") ?? 30;
+  const pageSize = Math.min(positiveInt(values["page-size"], "--page-size") ?? Math.min(Math.max(limit, 1), 100), 100);
+  let cursor = cursorValue(values.cursor);
+  const search = values.search ? String(values.search) : undefined;
+  const requested = values.status ? String(values.status).split(",").map((s) => s.trim().toUpperCase()).filter(Boolean) : null;
+  const unknown = requested?.filter((s) => s !== "OPEN" && !VALID_STATUS.has(s)) ?? [];
+  if (unknown.length)
+    printStatusError(unknown);
+  const wantOpen = !!requested?.some((s) => s === "OPEN");
+  const wanted = requested ? new Set(requested.filter((s) => VALID_STATUS.has(s))) : null;
+  const includeClosed = !!values.all || !!wanted && wanted.size > 0;
+  const rows = [];
+  let backendNextCursor;
+  while (rows.length < limit) {
+    const requestLimit = Math.min(pageSize, limit - rows.length);
+    const page = toItemsPage(await api.listTodos(projectId, { limit: requestLimit, cursor, search }));
+    backendNextCursor = page.nextCursor;
+    for (const t of page.items) {
+      const status = String(t.status).toUpperCase();
+      if (!includeClosed && CLOSED.has(status))
+        continue;
+      if (!matchesRequestedStatus(t, requested, wanted, wantOpen))
+        continue;
+      rows.push(t);
+      if (rows.length >= limit)
+        break;
+    }
+    if (!backendNextCursor || page.items.length === 0)
+      break;
+    cursor = backendNextCursor;
+  }
+  rows.sort((a, b) => rowTime(b) - rowTime(a));
+  const visible = rows.slice(0, limit);
+  const hasBufferedRows = rows.length > visible.length;
+  const nextCursor = visible.length && (backendNextCursor !== undefined || hasBufferedRows) ? rowTime(visible[visible.length - 1]) : undefined;
+  if (values.json) {
+    process.stdout.write(JSON.stringify({ items: visible, nextCursor }, null, 2) + `
+`);
+    return;
+  }
+  if (!visible.length) {
+    process.stderr.write(`${DIM}(no todos)${RESET}
+`);
+    if (nextCursor !== undefined)
+      process.stderr.write(`${DIM}Next cursor: ${nextCursor} (re-run with the same filters plus --cursor ${nextCursor})${RESET}
+`);
+    return;
+  }
+  const statusW = visible.reduce((n, r) => Math.max(n, String(r.status).length), 0);
+  for (const t of visible) {
+    const status = String(t.status).toUpperCase();
+    const sc = STATUS_COLOR[status] || DIM;
+    const ts = new Date(rowTime(t)).toISOString().slice(0, 16).replace("T", " ");
+    const title = String(t.content ?? "").split(`
+`)[0].slice(0, 100);
+    process.stdout.write(`${sc}${status.padEnd(statusW)}${RESET}  ${DIM}${ts}${RESET}  ${t.id}  ${title}
+`);
+  }
+  process.stderr.write(`${DIM}${visible.length} todo(s)${RESET}
+`);
+  if (nextCursor !== undefined)
+    process.stderr.write(`${DIM}Next cursor: ${nextCursor} (re-run with the same filters plus --cursor ${nextCursor})${RESET}
+`);
+}
+
+// src/notify-command.ts
+import { createHash } from "crypto";
+
+// src/input.ts
+function readMultiline2(prompt, history) {
+  let cancelFn = () => {};
+  const promise = new Promise((resolve4, reject) => {
+    const out = process.stderr;
+    let buf = "";
+    let cursor = 0;
+    let pasting = false;
+    let done = false;
+    let screenRow = 0;
+    let historyIndex = -1;
+    let savedCurrent = "";
+    const promptLen = prompt.replace(/\x1b\[[0-9;]*m/g, "").length;
+    out.write(prompt);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    out.write("\x1B[?2004h");
+    function rowOf(pos) {
+      const cols = process.stderr.columns || 80;
+      const lines = buf.slice(0, pos).split(`
+`);
+      let row = 0;
+      for (let i = 0;i < lines.length; i++) {
+        const len = (i === 0 ? promptLen : 0) + lines[i].length;
+        if (i < lines.length - 1) {
+          row += len === 0 ? 1 : Math.ceil(len / cols);
+        } else {
+          row += len > 0 ? Math.ceil(len / cols) - 1 : 0;
+        }
+      }
+      return row;
+    }
+    function colOf(pos) {
+      const cols = process.stderr.columns || 80;
+      const lastNl = buf.lastIndexOf(`
+`, pos - 1);
+      const lineStart = lastNl + 1;
+      const offset = lineStart === 0 ? promptLen : 0;
+      const linePos = offset + (pos - lineStart);
+      if (linePos > 0 && linePos % cols === 0)
+        return cols;
+      return linePos % cols;
+    }
+    function totalRows() {
+      const cols = process.stderr.columns || 80;
+      const lines = buf.split(`
+`);
+      let rows = 0;
+      for (let i = 0;i < lines.length; i++) {
+        const len = (i === 0 ? promptLen : 0) + lines[i].length;
+        rows += len === 0 ? 1 : Math.ceil(len / cols);
+      }
+      return rows;
+    }
+    function redraw() {
+      const cols = process.stderr.columns || 80;
+      out.write("\r");
+      if (screenRow > 0)
+        out.write(`\x1B[${screenRow}A`);
+      out.write("\x1B[J");
+      out.write(prompt + buf.replace(/\n/g, `\r
+`));
+      const targetRow = rowOf(cursor);
+      const endRow = totalRows() - 1;
+      const rowsBack = endRow - targetRow;
+      const col = colOf(cursor);
+      if (rowsBack > 0)
+        out.write(`\x1B[${rowsBack}A`);
+      if (col <= cols) {
+        out.write("\r");
+        if (col > 0 && col < cols)
+          out.write(`\x1B[${col}C`);
+        if (col === cols)
+          out.write(`\x1B[${cols}G`);
+      }
+      screenRow = targetRow;
+    }
+    function finish(cancelled) {
+      if (done)
+        return;
+      done = true;
+      const rowsDown = totalRows() - 1 - screenRow;
+      if (rowsDown > 0)
+        out.write(`\x1B[${rowsDown}B`);
+      out.write("\x1B[?2004l");
+      out.write(`
+`);
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdin.removeListener("data", onData);
+      if (cancelled)
+        reject(new Error("cancelled"));
+      else
+        resolve4(buf.trim());
+    }
+    function wordRight() {
+      let p = cursor;
+      while (p < buf.length && buf[p] === " ")
+        p++;
+      while (p < buf.length && buf[p] !== " ")
+        p++;
+      return p;
+    }
+    function wordLeft() {
+      let p = cursor;
+      while (p > 0 && buf[p - 1] === " ")
+        p--;
+      while (p > 0 && buf[p - 1] !== " ")
+        p--;
+      return p;
+    }
+    function killToEnd() {
+      buf = buf.slice(0, cursor);
+      redraw();
+    }
+    function deleteWordBack() {
+      const to = wordLeft();
+      if (to === cursor)
+        return;
+      buf = buf.slice(0, to) + buf.slice(cursor);
+      cursor = to;
+      redraw();
+    }
+    function handleCSI(chunk, start) {
+      let i = start + 1;
+      if (i >= chunk.length || chunk[i] !== "[") {
+        if (i < chunk.length)
+          i++;
+        return i;
+      }
+      i++;
+      let params = "";
+      while (i < chunk.length && /[0-9;]/.test(chunk[i])) {
+        params += chunk[i];
+        i++;
+      }
+      const final = i < chunk.length ? chunk[i] : "";
+      i++;
+      const parts = params.split(";");
+      const modifier = parts.length > 1 ? parseInt(parts[1]) : 0;
+      const code = parts[0] || "";
+      const ctrl = modifier === 5;
+      switch (final) {
+        case "D":
+          if (ctrl) {
+            cursor = wordLeft();
+            redraw();
+          } else if (cursor > 0) {
+            cursor--;
+            redraw();
+          }
+          break;
+        case "C":
+          if (ctrl) {
+            cursor = wordRight();
+            redraw();
+          } else if (cursor < buf.length) {
+            cursor++;
+            redraw();
+          }
+          break;
+        case "A":
+          if (history && history.length > 0) {
+            if (historyIndex === -1)
+              savedCurrent = buf;
+            if (historyIndex < history.length - 1) {
+              historyIndex++;
+              buf = history[history.length - 1 - historyIndex];
+              cursor = buf.length;
+              redraw();
+            }
+          }
+          break;
+        case "B":
+          if (history && historyIndex >= 0) {
+            historyIndex--;
+            if (historyIndex === -1) {
+              buf = savedCurrent;
+            } else {
+              buf = history[history.length - 1 - historyIndex];
+            }
+            cursor = buf.length;
+            redraw();
+          }
+          break;
+        case "H":
+          cursor = 0;
+          redraw();
+          break;
+        case "F":
+          cursor = buf.length;
+          redraw();
+          break;
+        case "~":
+          if (code === "3" && cursor < buf.length) {
+            buf = buf.slice(0, cursor) + buf.slice(cursor + 1);
+            redraw();
+          }
+          break;
+      }
+      return i;
+    }
+    function onData(data) {
+      let s = data.toString("utf-8");
+      while (s.length > 0 && !done) {
+        if (pasting) {
+          const end = s.indexOf("\x1B[201~");
+          if (end >= 0) {
+            const text = s.slice(0, end).replace(/\r\n?|\n/g, `
+`);
+            buf = buf.slice(0, cursor) + text + buf.slice(cursor);
+            cursor += text.length;
+            pasting = false;
+            s = s.slice(end + 6);
+            redraw();
+          } else {
+            const text = s.replace(/\r\n?|\n/g, `
+`);
+            buf = buf.slice(0, cursor) + text + buf.slice(cursor);
+            cursor += text.length;
+            s = "";
+            redraw();
+          }
+        } else {
+          const ps = s.indexOf("\x1B[200~");
+          const chunk = ps >= 0 ? s.slice(0, ps) : s;
+          for (let i = 0;i < chunk.length && !done; i++) {
+            const c3 = chunk.charCodeAt(i);
+            if (c3 === 3) {
+              finish(true);
+              return;
+            }
+            if (c3 === 13 || c3 === 10) {
+              finish(false);
+              return;
+            }
+            if (c3 === 23) {
+              deleteWordBack();
+            } else if (c3 === 11) {
+              killToEnd();
+            } else if (c3 === 127 || c3 === 8) {
+              if (cursor > 0) {
+                buf = buf.slice(0, cursor - 1) + buf.slice(cursor);
+                cursor--;
+                redraw();
+              }
+            } else if (c3 === 27) {
+              if (i + 1 < chunk.length && chunk.charCodeAt(i + 1) === 13) {
+                buf = buf.slice(0, cursor) + `
+` + buf.slice(cursor);
+                cursor++;
+                i++;
+                redraw();
+              } else {
+                i = handleCSI(chunk, i) - 1;
+              }
+            } else if (c3 === 1) {
+              cursor = 0;
+              redraw();
+            } else if (c3 === 5) {
+              cursor = buf.length;
+              redraw();
+            } else if (c3 >= 32) {
+              buf = buf.slice(0, cursor) + chunk[i] + buf.slice(cursor);
+              cursor++;
+              redraw();
+            }
+          }
+          if (ps >= 0) {
+            pasting = true;
+            s = s.slice(ps + 6);
+          } else
+            s = "";
+        }
+      }
+    }
+    process.stdin.on("data", onData);
+    cancelFn = () => finish(true);
+  });
+  return { promise, cancel: () => cancelFn() };
+}
+async function readStdin2() {
+  if (process.stdin.isTTY) {
+    try {
+      const content2 = await readMultiline2(`${BRIGHT_WHITE}TODO>${RESET} `).promise;
+      if (!content2) {
+        process.stderr.write(`Error: Empty input
+`);
+        process.exit(1);
+      }
+      return content2;
+    } catch {
+      process.stderr.write(`
+Cancelled
+`);
+      process.exit(1);
+    }
   }
-  if (sub === "wallpaper") {
-    if (value !== "auto" && value !== "off")
-      fail("Usage: tfa-cli device wallpaper <device> auto|off");
-    await api.setDeviceWallpaperMode(found.id, value);
-    process.stderr.write(`${GREEN}✅ ${found.name} wallpaper: ${value}${RESET}
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  const content = Buffer.concat(chunks).toString("utf-8").trim();
+  if (!content) {
+    process.stderr.write(`Error: Empty input
 `);
-    return;
+    process.exit(1);
   }
-  fail(`Unknown 'device' subcommand: ${sub}`);
+  return content;
 }
 
-// src/list-todos.ts
-import { parseArgs as parseArgs2 } from "util";
-var STATUS_COLOR = {
-  DONE: GREEN,
-  READY: GREEN,
-  READY_CHECKED: GREEN,
-  ERROR: RED,
-  ERROR_CHECKED: RED,
-  CANCELLED: RED,
-  CANCELLED_CHECKED: RED,
-  RUNNING: YELLOW,
-  STOPPING: YELLOW,
-  COMPACTING: YELLOW,
-  REVIEW_REQUESTED: YELLOW,
-  TODO: CYAN,
-  SCHEDULED: CYAN,
-  POSTPONED: CYAN,
-  PAUSED: CYAN
-};
-var CLOSED = new Set([
-  "DONE",
-  "READY_CHECKED",
-  "CANCELLED",
-  "CANCELLED_CHECKED",
-  "ERROR_CHECKED",
-  "ARCHIVED",
-  "DELETED"
-]);
-var VALID_STATUS = new Set(Object.values(TodoStatus));
-var isOpen = (s) => !CLOSED.has(s);
-function printListTodosHelp() {
+// src/notify-command.ts
+var TIERS = { "needs-you": "priority", priority: "priority", activity: "activity", messages: "user_messages" };
+function printInboxHelp() {
   process.stderr.write(`
-todoforai-cli list — list todos in a project (recent first)
+tfa-cli inbox — the user's notification feed (the bell)
 
 Usage:
-  todoforai-cli list [flags]
-
-Flags:
-  -n, --limit <n>          Max rows to show (default: 30)
-      --cursor <n>         Fetch todos older than this cursor (lastActivityAt)
-      --page-size <n>      Backend page size per request (default: min(limit, 100), max: 100)
-      --search <text>      Search content/status on the backend
-  -s, --status <S[,S2]>    Filter by status (comma-separated, union).
-  -A, --all                Include DONE (also CANCELLED, ARCHIVED, …)
-      --project <id>       Project ID (default: current default project)
-      --json               Output { items, nextCursor } as JSON
-  -h, --help               Show this help
+  tfa-cli inbox [needs-you|messages|activity] [--unread] [--limit 20] [--json]
+  tfa-cli inbox seen [needs-you|messages|activity]    Mark read (omit = everything)
 
-Examples:
-  todoforai-cli list                         # 30 most recent open todos
-  todoforai-cli list -n 50                   # last 50 open
-  todoforai-cli list --cursor 1719234567890  # next page
-  todoforai-cli list --all                   # include DONE
-  todoforai-cli list -s RUNNING,REVIEW_REQUESTED
-  todoforai-cli list --search bug --json | jq '.items[].id'
+Filters (same as the bell's chips):
+  needs-you  invites, offers, a todo waiting on the user, a failed todo   (alias: priority)
+  messages   notes from the TODO for AI team or from an agent
+  activity   finished / recommended todos
 `);
 }
-function positiveInt(value, name) {
-  if (value === undefined)
-    return;
-  const n = Number(value);
-  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) {
-    process.stderr.write(`${RED}Error: ${name} must be a positive integer${RESET}
+function printNotifyHelp() {
+  process.stderr.write(`
+tfa-cli notify — leave a note for YOUR user (their Messages tab + phone push)
+
+Usage:
+  tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--subject <key>] [--json]
+  echo "message" | tfa-cli notify "Title"
+
+Recipient: ALWAYS the user this key belongs to (the person you work for). There is no --to:
+it cannot message a teammate, a customer or any other account. Shown as from your agent.
+--subject dedupes: the same subject is delivered once (default: hash of title+message,
+so a retry never double-notifies). --href must be an in-app path. Max 10 new notes/day.
 `);
-    process.exit(2);
-  }
-  return n;
 }
-function cursorValue(value) {
-  if (value === undefined)
+function tierArg(name) {
+  if (!name)
     return;
-  const n = Number(value);
-  if (!Number.isFinite(n) || n < 0) {
-    process.stderr.write(`${RED}Error: --cursor must be a non-negative number${RESET}
+  const tier = TIERS[name];
+  if (!tier) {
+    process.stderr.write(`${RED}Unknown tab "${name}" — use needs-you, messages, activity${RESET}
 `);
     process.exit(2);
   }
-  return n;
-}
-function toItemsPage(response) {
-  if (Array.isArray(response))
-    return { items: response };
-  return {
-    items: Array.isArray(response?.items) ? response.items : [],
-    nextCursor: typeof response?.nextCursor === "number" ? response.nextCursor : undefined
-  };
+  return tier;
 }
-function rowTime(t) {
-  return Number(t.lastActivityAt ?? t.createdAt ?? 0);
-}
-function printStatusError(unknown) {
-  process.stderr.write(`${RED}Error: unknown status ${unknown.map((s) => `'${s}'`).join(", ")}${RESET}
-`);
-  process.stderr.write(`${DIM}Use OPEN or one of: ${Object.values(TodoStatus).join(", ")}${RESET}
+var when = (ms) => new Date(ms).toLocaleString(undefined, { dateStyle: "short", timeStyle: "short" });
+async function inboxCommand(api, positionals, args) {
+  const [, first, second] = positionals;
+  if (first === "seen") {
+    const tier2 = tierArg(second);
+    await api.markFeedSeen(tier2 ? { tier: tier2 } : {});
+    process.stderr.write(`${GREEN}✅ Marked ${second ?? "everything"} read${RESET}
 `);
-  process.exit(2);
-}
-function matchesRequestedStatus(t, requested, wanted, wantOpen) {
-  if (!requested)
-    return true;
-  const s = String(t.status).toUpperCase();
-  return wantOpen && isOpen(s) || (wanted?.has(s) ?? false);
-}
-async function listTodosCommand(api, defaultProjectId, argv) {
-  const { values } = parseArgs2({
-    args: argv,
-    options: {
-      limit: { type: "string", short: "n" },
-      cursor: { type: "string" },
-      "page-size": { type: "string" },
-      search: { type: "string" },
-      status: { type: "string", short: "s" },
-      all: { type: "boolean", short: "A", default: false },
-      project: { type: "string" },
-      json: { type: "boolean", default: false },
-      help: { type: "boolean", short: "h", default: false }
-    },
-    strict: true
-  });
-  if (values.help) {
-    printListTodosHelp();
     return;
   }
-  const projectId = values.project || defaultProjectId;
-  if (!projectId) {
-    process.stderr.write(`${RED}Error: no project (pass --project <id> or set a default)${RESET}
-`);
-    process.exit(1);
-  }
-  const limit = positiveInt(values.limit, "--limit") ?? 30;
-  const pageSize = Math.min(positiveInt(values["page-size"], "--page-size") ?? Math.min(Math.max(limit, 1), 100), 100);
-  let cursor = cursorValue(values.cursor);
-  const search = values.search ? String(values.search) : undefined;
-  const requested = values.status ? String(values.status).split(",").map((s) => s.trim().toUpperCase()).filter(Boolean) : null;
-  const unknown = requested?.filter((s) => s !== "OPEN" && !VALID_STATUS.has(s)) ?? [];
-  if (unknown.length)
-    printStatusError(unknown);
-  const wantOpen = !!requested?.some((s) => s === "OPEN");
-  const wanted = requested ? new Set(requested.filter((s) => VALID_STATUS.has(s))) : null;
-  const includeClosed = !!values.all || !!wanted && wanted.size > 0;
-  const rows = [];
-  let backendNextCursor;
-  while (rows.length < limit) {
-    const requestLimit = Math.min(pageSize, limit - rows.length);
-    const page = toItemsPage(await api.listTodos(projectId, { limit: requestLimit, cursor, search }));
-    backendNextCursor = page.nextCursor;
-    for (const t of page.items) {
-      const status = String(t.status).toUpperCase();
-      if (!includeClosed && CLOSED.has(status))
-        continue;
-      if (!matchesRequestedStatus(t, requested, wanted, wantOpen))
-        continue;
-      rows.push(t);
-      if (rows.length >= limit)
-        break;
-    }
-    if (!backendNextCursor || page.items.length === 0)
-      break;
-    cursor = backendNextCursor;
-  }
-  rows.sort((a, b) => rowTime(b) - rowTime(a));
-  const visible = rows.slice(0, limit);
-  const hasBufferedRows = rows.length > visible.length;
-  const nextCursor = visible.length && (backendNextCursor !== undefined || hasBufferedRows) ? rowTime(visible[visible.length - 1]) : undefined;
-  if (values.json) {
-    process.stdout.write(JSON.stringify({ items: visible, nextCursor }, null, 2) + `
-`);
+  const tier = tierArg(first);
+  const limit = args.limit ? Number(args.limit) : 20;
+  const page = await api.listFeed({ tier, limit, sinceSeen: !!args.unread || undefined });
+  if (args.json) {
+    console.log(JSON.stringify(page));
     return;
   }
-  if (!visible.length) {
-    process.stderr.write(`${DIM}(no todos)${RESET}
+  const counts = page.unseenByTier;
+  if (counts)
+    process.stderr.write(`${DIM}unread — needs you ${counts.priority} · messages ${counts.user_messages} · activity ${counts.activity}${RESET}
 `);
-    if (nextCursor !== undefined)
-      process.stderr.write(`${DIM}Next cursor: ${nextCursor} (re-run with the same filters plus --cursor ${nextCursor})${RESET}
+  if (!page.items.length) {
+    process.stderr.write(`${DIM}Nothing here${RESET}
 `);
     return;
   }
-  const statusW = visible.reduce((n, r) => Math.max(n, String(r.status).length), 0);
-  for (const t of visible) {
-    const status = String(t.status).toUpperCase();
-    const sc = STATUS_COLOR[status] || DIM;
-    const ts = new Date(rowTime(t)).toISOString().slice(0, 16).replace("T", " ");
-    const title = String(t.content ?? "").split(`
-`)[0].slice(0, 100);
-    process.stdout.write(`${sc}${status.padEnd(statusW)}${RESET}  ${DIM}${ts}${RESET}  ${t.id}  ${title}
+  for (const e of page.items) {
+    const from = e.sender ? `${CYAN}${senderLabel(e.sender)}${RESET} ` : "";
+    const dot = e.unread ? `${YELLOW}●${RESET}` : " ";
+    const state = e.resolution ? ` ${DIM}[${e.resolution}]${RESET}` : "";
+    console.log(`${dot} ${DIM}${when(e.createdAt)}${RESET} ${from}${BOLD}${e.title ?? e.message}${RESET}${state}`);
+    if (e.title && e.message)
+      console.log(`    ${e.message.replace(/\n/g, `
+    `)}`);
+    if (e.href)
+      console.log(`    ${DIM}${e.href}${RESET}`);
+  }
+}
+var RECIPIENT_FLAGS = ["--to", "--email", "--user", "--recipient", "--cc"];
+async function notifyCommand(api, positionals, args) {
+  const argv = process.argv.slice(2);
+  const bad = argv.find((a) => RECIPIENT_FLAGS.some((f) => a === f || a.startsWith(`${f}=`)));
+  if (bad) {
+    process.stderr.write(`${RED}notify has no recipient option (${bad.split("=")[0]}): it only reaches the user this key belongs to — your own user. Messaging other people is not supported.${RESET}
 `);
+    process.exit(2);
   }
-  process.stderr.write(`${DIM}${visible.length} todo(s)${RESET}
-`);
-  if (nextCursor !== undefined)
-    process.stderr.write(`${DIM}Next cursor: ${nextCursor} (re-run with the same filters plus --cursor ${nextCursor})${RESET}
+  const [, title, ...rest] = positionals;
+  const message = rest.join(" ") || (process.stdin.isTTY ? "" : (await readStdin2()).trim());
+  if (!title || !message) {
+    printNotifyHelp();
+    process.exit(2);
+  }
+  const subject = args.subject || createHash("sha256").update(`${title}
+${message}`).digest("hex").slice(0, 16);
+  const row = await api.sendFeedMessage({ subject, title, message, ...args.href ? { href: String(args.href) } : {} });
+  if (args.json) {
+    console.log(JSON.stringify(row));
+    return;
+  }
+  process.stderr.write(row.created !== false ? `${GREEN}✅ Delivered to your own user's Messages inbox (not anyone else)${RESET} ${DIM}(subject ${subject})${RESET}
+` : `${DIM}Already sent (subject ${subject}) — nothing new delivered${RESET}
 `);
 }
 
@@ -48833,7 +50909,7 @@ async function spawnMayflyBridge(apiUrl, todoId, workspace, opts = {}) {
       }
     });
   });
-  return { child, stop };
+  return { child, stop, stopped: () => stopped };
 }
 
 // src/acp.ts
@@ -72898,6 +74974,93 @@ async function runAcp(apiUrl, apiKey, opts) {
   await agent2.close();
 }
 
+// src/shutdown.ts
+var activeRun2 = null;
+var cleanups2 = [];
+var exiting2 = null;
+var cancelling2 = null;
+var CANCEL_TIMEOUT_MS2 = 5000;
+function setActiveRun2(run2) {
+  activeRun2 = run2;
+}
+function trackStart(ws, projectId, started) {
+  setActiveRun2(started.then((todoId) => ({ ws, projectId, todoId }), () => null));
+}
+function onShutdown(fn) {
+  cleanups2.push(fn);
+}
+function withTimeout2(p, ms, fallback) {
+  let timer;
+  const timeout = new Promise((r) => {
+    timer = setTimeout(() => r(fallback), ms);
+  });
+  return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
+function cancelActiveRun2(timeoutMs = CANCEL_TIMEOUT_MS2) {
+  if (cancelling2)
+    return cancelling2;
+  const pending = activeRun2;
+  if (!pending)
+    return Promise.resolve({ ok: false, todoId: null });
+  const res = { ok: false };
+  const attempt = (async () => {
+    const run2 = await pending;
+    res.todoId = run2?.todoId ?? null;
+    if (!run2)
+      return res;
+    if (!run2.ws.connected && !await run2.ws.connect())
+      return res;
+    res.ok = await run2.ws.sendInterrupt(run2.projectId, run2.todoId);
+    return res;
+  })().catch(() => res);
+  cancelling2 = withTimeout2(attempt, timeoutMs, res).finally(() => {
+    if (activeRun2 === pending)
+      activeRun2 = null;
+    cancelling2 = null;
+  });
+  return cancelling2;
+}
+function shutdown2(code, reason) {
+  return exiting2 ??= (async () => {
+    if (reason)
+      process.stderr.write(`
+${reason}
+`);
+    if (activeRun2) {
+      const { ok, todoId } = await cancelActiveRun2();
+      if (ok)
+        process.stderr.write(`Stopped todo ${todoId}
+`);
+      else if (todoId)
+        process.stderr.write(`Warning: could not stop todo ${todoId} (backend unreachable)
+`);
+      else if (todoId === undefined)
+        process.stderr.write(`Warning: could not stop the todo being created (timed out)
+`);
+    }
+    for (const fn of cleanups2.splice(0)) {
+      try {
+        fn();
+      } catch {}
+    }
+    process.exit(code);
+  })();
+}
+function finish(code) {
+  if (exiting2)
+    return;
+  process.exitCode = code;
+  process.stdout.end(() => {
+    if (!exiting2)
+      process.exit(code);
+  });
+}
+function installSignalHandlers() {
+  process.on("SIGINT", () => void shutdown2(130, "Cancelled by user (Ctrl+C)"));
+  process.on("SIGTERM", () => void shutdown2(143, "Terminated (SIGTERM)"));
+  process.on("SIGHUP", () => void shutdown2(129, "Hangup (SIGHUP)"));
+}
+
 // src/index.ts
 try {
   const pkgPath = path4.resolve(fileURLToPath(import.meta.url), "../../package.json");
@@ -72973,7 +75136,7 @@ async function interactiveLoop(ws, api2, todoId, projectId, agent2, json2, autoA
       cfg.addToHistory(input2);
       process.stderr.write("\u2500".repeat(40) + `
 `);
-      await api2.addMessage(projectId, input2, agent2, todoId);
+      await appendTracked(api2, ws, projectId, input2, agent2, todoId);
       await watchTodo(ws, todoId, projectId, {
         json: json2,
         autoApprove,
@@ -72984,6 +75147,11 @@ async function interactiveLoop(ws, api2, todoId, projectId, agent2, json2, autoA
     }
   }
 }
+async function appendTracked(api2, ws, projectId, text, agent2, todoId) {
+  const sent = api2.addMessage(projectId, text, agent2, todoId).then(() => todoId);
+  trackStart(ws, projectId, sent);
+  await sent;
+}
 async function linkToSpawningBlock(api2, todoId) {
   const { TODOFORAI_TODO_ID: pTodo, TODOFORAI_MESSAGE_ID: pMsg, TODOFORAI_BLOCK_ID: pBlock } = process.env;
   if (!pTodo || !pMsg || !pBlock || pTodo === todoId)
@@ -72992,12 +75160,7 @@ async function linkToSpawningBlock(api2, todoId) {
 `));
 }
 async function main() {
-  process.on("SIGINT", () => {
-    process.stderr.write(`
-Cancelled by user (Ctrl+C)
-`);
-    process.exit(130);
-  });
+  installSignalHandlers();
   const { values: args, positionals } = parseCliArgs();
   const groupTag = args.group === undefined ? getEnv("GROUP_ID") : String(args.group);
   const groupName = args["group-name"] === undefined ? undefined : String(args["group-name"]);
@@ -73042,11 +75205,19 @@ Cancelled by user (Ctrl+C)
     printDeviceHelp();
     process.exit(0);
   }
+  if (positionals[0] === "inbox" && args.help) {
+    printInboxHelp();
+    process.exit(0);
+  }
+  if (positionals[0] === "notify" && args.help) {
+    printNotifyHelp();
+    process.exit(0);
+  }
   if ((positionals[0] === "list" || positionals[0] === "ls") && args.help) {
     printListTodosHelp();
     process.exit(0);
   }
-  if (args.help && !["list", "ls", "agent", "todo", "project", "brand", "device"].includes(positionals[0])) {
+  if (args.help && !["list", "ls", "agent", "todo", "project", "brand", "device", "inbox", "notify"].includes(positionals[0])) {
     printUsage();
     process.exit(0);
   }
@@ -73177,6 +75348,14 @@ Cancelled by user (Ctrl+C)
     await deviceCommand(api2, positionals, args);
     return;
   }
+  if (positionals[0] === "inbox") {
+    await inboxCommand(api2, positionals, args);
+    return;
+  }
+  if (positionals[0] === "notify") {
+    await notifyCommand(api2, positionals, args);
+    return;
+  }
   if (positionals[0] === "delete") {
     const todoId = positionals[1];
     if (!todoId) {
@@ -73533,6 +75712,7 @@ Cancelled by user (Ctrl+C)
     }
     if (!args["no-watch"]) {
       const ws2 = new FrontendWebSocket(apiUrl, apiKey);
+      setActiveRun2({ ws: ws2, projectId: projectId2, todoId });
       await ws2.connect();
       const autoApprove = !!args["dangerously-skip-permissions"];
       let agent3 = todo2.agentSettings || { id: todo2.agentSettingsId };
@@ -73543,7 +75723,8 @@ Cancelled by user (Ctrl+C)
       await watchTodo(ws2, todoId, projectId2, {
         json: !!args.json,
         autoApprove,
-        agentSettings: agent3
+        agentSettings: agent3,
+        exitOnInterrupt: !!args["non-interactive"]
       });
       if (!args["non-interactive"]) {
         process.stderr.write(`
@@ -73592,9 +75773,9 @@ Resumed: ${CYAN2}${getFrontendUrl(apiUrl, todoId)}${RESET2}
     const followUp = promptArg(positionals) ?? (process.stdin.isTTY ? "" : await readStdin());
     if (followUp) {
       cfg.addToHistory(followUp);
-      await api2.addMessage(projectId2, followUp, agent3, todoId);
+      await appendTracked(api2, ws2, projectId2, followUp, agent3, todoId);
       await linkToSpawningBlock(api2, todoId);
-      await watchTodo(ws2, todoId, projectId2, { json: !!args.json, autoApprove, agentSettings: agent3 });
+      await watchTodo(ws2, todoId, projectId2, { json: !!args.json, autoApprove, agentSettings: agent3, exitOnInterrupt: !!args["non-interactive"] });
     }
     if (!args["non-interactive"]) {
       await interactiveLoop(ws2, api2, todoId, projectId2, agent3, !!args.json, autoApprove, cfg);
@@ -73613,9 +75794,15 @@ Resumed: ${CYAN2}${getFrontendUrl(apiUrl, todoId)}${RESET2}
   const bridgeReady = !args["no-bridge"] && !args["no-watch"] && !args.isolated ? ensureBridgeRunning2(apiUrl, apiKey) : null;
   const isolatedTodoId = args.isolated ? randomUUID3() : undefined;
   const mayfly = isolatedTodoId ? await spawnMayflyBridge(apiUrl, isolatedTodoId, realpathSync2(resolve4(args.path || ".")), { debug: !!args.debug, apiKey }) : null;
-  if (mayfly)
+  if (mayfly) {
     process.stderr.write(`${DIM2}Isolated bridge:${RESET2} ${CYAN2}mayfly-${isolatedTodoId}${RESET2}
 `);
+    onShutdown(mayfly.stop);
+    mayfly.child.on("exit", (code, sig) => {
+      if (!mayfly.stopped())
+        shutdown2(1, `${RED3}Error: isolated bridge died (${sig ?? `code ${code}`}) \u2014 stopping todo${RESET2}`);
+    });
+  }
   let preMatchedAgent = null;
   let agents = null;
   if (args.agent) {
@@ -73719,15 +75906,16 @@ Resumed: ${CYAN2}${getFrontendUrl(apiUrl, todoId)}${RESET2}
     agent2 = { ...agent2, permissions: { ...perms, allow: [...perms.allow || [], "*:*"] } };
   }
   cfg.addToHistory(content);
+  const created = api2.addMessage(projectId, content, agent2, isolatedTodoId, undefined, undefined, groupTag || undefined, groupName);
+  if (ws)
+    trackStart(ws, projectId, created.then((t) => t.id));
   let todo;
   try {
-    todo = await api2.addMessage(projectId, content, agent2, isolatedTodoId, undefined, undefined, groupTag || undefined, groupName);
+    todo = await created;
   } catch (e) {
     if (!args.project && !envProjectId && cfgScope.data.default_project_id === projectId && /failed: 403/.test(e.message || "")) {
       cfgScope.clearDefaultProject();
-      process.stderr.write(`${RED3}Not authorized for cached default project ${projectName} (${projectId}) \u2014 cleared it. Re-run to pick a project.${RESET2}
-`);
-      process.exit(1);
+      throw new Error(`Not authorized for cached default project ${projectName} (${projectId}) \u2014 cleared it. Re-run to pick a project.`);
     }
     throw e;
   }
@@ -73748,7 +75936,8 @@ Resumed: ${CYAN2}${getFrontendUrl(apiUrl, todoId)}${RESET2}
     await watchTodo(ws, actualTodoId, projectId, {
       json: !!args.json,
       autoApprove,
-      agentSettings: agent2
+      agentSettings: agent2,
+      exitOnInterrupt: !!args["non-interactive"]
     });
     if (!args["non-interactive"]) {
       process.stderr.write(`
@@ -73760,10 +75949,6 @@ ${"\u2500".repeat(40)}
   }
   mayfly?.stop();
 }
-var finish = (code) => {
-  process.exitCode = code;
-  process.stdout.end(() => process.exit(code));
-};
 main().then(() => finish(process.exitCode ?? 0)).catch((e) => {
   process.stderr.write(`Error: ${e.message}
 `);