@useorgx/wizard 0.1.14 → 0.1.16

package/dist/cli.js

@@ -37,6 +37,8 @@ var ORGX_WIZARD_NPM_PACKAGE_NAME = "@useorgx/wizard";
 var NPM_REGISTRY_BASE_URL = "https://registry.npmjs.org";
 var DEFAULT_OPENCLAW_GATEWAY_PORT = 18789;
 var DEFAULT_ORGX_BASE_URL = process.env.ORGX_BASE_URL?.trim() || "https://useorgx.com";
+var ORGX_WIZARD_OAUTH_CALLBACK_PATH = "/oauth/callback";
+var ORGX_WIZARD_OAUTH_PREFERRED_PORT = 6274;
 var ORGX_WIZARD_OAUTH_SCOPES = [
   "decisions:read",
   "decisions:write",
@@ -368,12 +370,16 @@ function parseStoredWizardAuthRecord(raw) {
     return null;
   }
   const storage = parsed.storage === "keytar" ? "keytar" : "file";
+  const source = parsed.source === "pkce" ? "pkce" : "manual";
   return {
     baseUrl: parsed.baseUrl.trim(),
     ...isNonEmptyString(parsed.apiKey) ? { apiKey: parsed.apiKey.trim() } : {},
     keyPrefix: parsed.keyPrefix.trim(),
+    source,
     storage,
-    verifiedAt: parsed.verifiedAt.trim()
+    verifiedAt: parsed.verifiedAt.trim(),
+    ...isNonEmptyString(parsed.refreshToken) ? { refreshToken: parsed.refreshToken.trim() } : {},
+    ...isNonEmptyString(parsed.oauthClientId) ? { oauthClientId: parsed.oauthClientId.trim() } : {}
   };
 }
 async function loadDefaultSecretStore() {
@@ -402,8 +408,11 @@ function buildStoredRecord(value) {
     ...value.storage === "file" ? { apiKey: value.apiKey } : {},
     baseUrl: value.baseUrl,
     keyPrefix: value.keyPrefix,
+    source: value.source,
     storage: value.storage,
-    verifiedAt: value.verifiedAt
+    verifiedAt: value.verifiedAt,
+    ...value.refreshToken ? { refreshToken: value.refreshToken } : {},
+    ...value.oauthClientId ? { oauthClientId: value.oauthClientId } : {}
   };
 }
 function readWizardAuthMetadata(authPath = ORGX_WIZARD_AUTH_PATH) {
@@ -414,7 +423,7 @@ function readWizardAuthMetadata(authPath = ORGX_WIZARD_AUTH_PATH) {
   return {
     baseUrl: stored.baseUrl,
     keyPrefix: stored.keyPrefix,
-    source: "manual",
+    source: stored.source ?? "manual",
     storage: stored.storage,
     verifiedAt: stored.verifiedAt
   };
@@ -424,15 +433,18 @@ async function readWizardAuth(authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
   if (!stored) {
     return null;
   }
+  const source = stored.source ?? "manual";
   const apiKeyFromFile = stored.storage === "file" && isNonEmptyString(stored.apiKey) ? stored.apiKey.trim() : null;
   if (apiKeyFromFile) {
     return {
       apiKey: apiKeyFromFile,
       baseUrl: stored.baseUrl,
       keyPrefix: stored.keyPrefix,
-      source: "manual",
+      source,
       storage: "file",
-      verifiedAt: stored.verifiedAt
+      verifiedAt: stored.verifiedAt,
+      ...stored.refreshToken ? { refreshToken: stored.refreshToken } : {},
+      ...stored.oauthClientId ? { oauthClientId: stored.oauthClientId } : {}
     };
   }
   if (stored.storage !== "keytar") {
@@ -453,9 +465,11 @@ async function readWizardAuth(authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
     apiKey: apiKey.trim(),
     baseUrl: stored.baseUrl,
     keyPrefix: stored.keyPrefix,
-    source: "manual",
+    source,
     storage: "keytar",
-    verifiedAt: stored.verifiedAt
+    verifiedAt: stored.verifiedAt,
+    ...stored.refreshToken ? { refreshToken: stored.refreshToken } : {},
+    ...stored.oauthClientId ? { oauthClientId: stored.oauthClientId } : {}
   };
 }
 async function writeWizardAuth(value, authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
@@ -464,9 +478,11 @@ async function writeWizardAuth(value, authPath = ORGX_WIZARD_AUTH_PATH, options
     apiKey: value.apiKey.trim(),
     keyPrefix: value.keyPrefix?.trim() || extractKeyPrefix(value.apiKey),
     baseUrl: value.baseUrl.trim(),
-    source: "manual",
+    source: value.source ?? "manual",
     storage: secretStore ? "keytar" : "file",
-    verifiedAt: value.verifiedAt.trim()
+    verifiedAt: value.verifiedAt.trim(),
+    ...value.refreshToken ? { refreshToken: value.refreshToken } : {},
+    ...value.oauthClientId ? { oauthClientId: value.oauthClientId } : {}
   };
   if (secretStore) {
     await secretStore.setPassword(
@@ -863,6 +879,241 @@ function openBrowser(url) {
   return { ok: true };
 }
 
+// src/lib/local-auth-server.ts
+import { createServer } from "http";
+var DEFAULT_SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head><title>OrgX connected</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f9fafb}
+.card{text-align:center;padding:2rem;max-width:400px}
+h1{font-size:1.5rem;color:#111}p{color:#555;margin-top:.5rem}</style>
+</head>
+<body><div class="card">
+<h1>&#10003; Connected to OrgX</h1>
+<p>You can close this tab and return to your terminal.</p>
+</div></body></html>`;
+var DEFAULT_ERROR_HTML = `<!DOCTYPE html>
+<html>
+<head><title>OrgX auth error</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fef2f2}
+.card{text-align:center;padding:2rem;max-width:400px}
+h1{font-size:1.5rem;color:#b91c1c}p{color:#555;margin-top:.5rem}</style>
+</head>
+<body><div class="card">
+<h1>&#10007; Authentication failed</h1>
+<p>Return to your terminal and try again.</p>
+</div></body></html>`;
+function tryListen(port, hostname2) {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once("error", reject);
+    server.listen(port, hostname2, () => {
+      server.removeListener("error", reject);
+      resolve(server);
+    });
+  });
+}
+async function bindServer(preferredPort, hostname2) {
+  if (preferredPort === 0) {
+    const server = await tryListen(0, hostname2);
+    const port = server.address().port;
+    return { server, port };
+  }
+  for (let offset = 0; offset < 10; offset++) {
+    const port = preferredPort + offset;
+    try {
+      const server = await tryListen(port, hostname2);
+      return { server, port };
+    } catch {
+    }
+  }
+  throw new Error(
+    `Could not bind local auth server: ports ${preferredPort}\u2013${preferredPort + 9} are all in use.`
+  );
+}
+async function startLocalAuthServer(options) {
+  const hostname2 = "127.0.0.1";
+  const callbackPath = options.callbackPath ?? "/oauth/callback";
+  const timeoutMs = options.timeoutMs ?? 5 * 6e4;
+  const successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
+  const errorHtml = options.errorHtml ?? DEFAULT_ERROR_HTML;
+  const { server, port } = await bindServer(options.preferredPort, hostname2);
+  const result = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("Timed out waiting for browser authorization."));
+    }, timeoutMs);
+    server.on("request", (req, res) => {
+      if (!req.url) {
+        res.writeHead(400).end(errorHtml);
+        return;
+      }
+      const url = new URL(req.url, `http://${hostname2}:${port}`);
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404).end("Not found");
+        return;
+      }
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error(errorDescription ?? error));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code || !state) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error("Missing code or state in callback."));
+        return;
+      }
+      if (state !== options.expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error("State mismatch \u2014 possible CSRF. Retry auth."));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" }).end(successHtml);
+      clearTimeout(timer);
+      server.close();
+      resolve({ code, state });
+    });
+  });
+  return { port, result };
+}
+function buildRedirectUri(port, callbackPath = "/oauth/callback") {
+  return `http://127.0.0.1:${port}${callbackPath}`;
+}
+
+// src/lib/pkce.ts
+import { createHash, randomBytes } from "crypto";
+function generatePkce() {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
+}
+function generateState() {
+  return randomBytes(16).toString("base64url");
+}
+function buildAuthorizeUrl(options) {
+  const url = new URL(options.authorizeEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("scope", options.scope);
+  url.searchParams.set("code_challenge", options.codeChallenge);
+  url.searchParams.set("code_challenge_method", options.codeChallengeMethod);
+  url.searchParams.set("state", options.state);
+  return url.toString();
+}
+
+// src/lib/oauth-client.ts
+async function registerPublicClient(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const response = await fetchImpl(ORGX_HOSTED_OAUTH_REGISTER_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "OrgX Wizard CLI",
+      redirect_uris: [options.redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"]
+    }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new Error(`OAuth client registration failed (HTTP ${response.status}): ${text2}`);
+  }
+  const data = await response.json();
+  if (!isRecord(data) || typeof data.client_id !== "string") {
+    throw new Error("OAuth registration response missing client_id.");
+  }
+  return { client_id: data.client_id };
+}
+async function exchangeCodeForTokens(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: options.code,
+    redirect_uri: options.redirectUri,
+    client_id: options.clientId,
+    code_verifier: options.codeVerifier
+  });
+  const response = await fetchImpl(ORGX_HOSTED_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new Error(`Token exchange failed (HTTP ${response.status}): ${text2}`);
+  }
+  const data = await response.json();
+  if (!isRecord(data) || typeof data.access_token !== "string") {
+    throw new Error("Token response missing access_token.");
+  }
+  return {
+    access_token: data.access_token,
+    token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
+    ...typeof data.expires_in === "number" ? { expires_in: data.expires_in } : {},
+    ...typeof data.refresh_token === "string" ? { refresh_token: data.refresh_token } : {},
+    ...typeof data.scope === "string" ? { scope: data.scope } : {}
+  };
+}
+async function startPkceLogin(options = {}) {
+  const port = options.preferredPort ?? ORGX_WIZARD_OAUTH_PREFERRED_PORT;
+  const scope = options.scope ?? ORGX_WIZARD_OAUTH_SCOPE;
+  const { codeVerifier, codeChallenge, codeChallengeMethod } = generatePkce();
+  const state = generateState();
+  const serverOpts = {
+    preferredPort: port,
+    expectedState: state,
+    callbackPath: ORGX_WIZARD_OAUTH_CALLBACK_PATH,
+    ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {}
+  };
+  const { port: boundPort, result: callbackPromise } = await startLocalAuthServer(serverOpts);
+  const redirectUri = buildRedirectUri(boundPort, ORGX_WIZARD_OAUTH_CALLBACK_PATH);
+  const clientOpts = {
+    redirectUri,
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  };
+  const client = await registerPublicClient(clientOpts);
+  const authorizeUrl = buildAuthorizeUrl({
+    authorizeEndpoint: ORGX_HOSTED_OAUTH_AUTHORIZE_URL,
+    clientId: client.client_id,
+    redirectUri,
+    scope,
+    codeChallenge,
+    codeChallengeMethod,
+    state
+  });
+  options.onAuthorizeUrl?.(authorizeUrl);
+  const { code } = await callbackPromise;
+  const exchangeOpts = {
+    code,
+    codeVerifier,
+    redirectUri,
+    clientId: client.client_id,
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  };
+  const tokens = await exchangeCodeForTokens(exchangeOpts);
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    redirectUri,
+    clientId: client.client_id,
+    expiresIn: tokens.expires_in
+  };
+}
+
 // src/lib/wizard-state.ts
 import { randomUUID } from "crypto";
 
@@ -1516,7 +1767,7 @@ function formatHttpError(status, body) {
 }
 async function listWorkspaces(options = {}) {
   const auth = await requireOrgxAuth(options);
-  const url = buildOrgxApiUrl("/entities?type=command_center&limit=100", auth.baseUrl);
+  const url = buildOrgxApiUrl("/entities?type=workspace&limit=100", auth.baseUrl);
   const response = await fetch(url, {
     method: "GET",
     headers: {
@@ -1562,7 +1813,7 @@ async function createWorkspace(input, options = {}) {
   const auth = await requireOrgxAuth(options);
   const url = buildOrgxApiUrl("/entities", auth.baseUrl);
   const payload = {
-    type: "command_center",
+    type: "workspace",
     name,
     ...input.description?.trim() ? { description: input.description.trim() } : {}
   };
@@ -1589,7 +1840,7 @@ async function updateWorkspace(input, patch, options = {}) {
     method: "PATCH",
     headers: buildRequestHeaders(auth.apiKey),
     body: JSON.stringify({
-      type: "command_center",
+      type: "workspace",
       id: input.id,
       ...patch
     }),
@@ -3133,7 +3384,7 @@ async function ensureOnboardingTask(workspace, options = {}) {
 }
 
 // src/lib/skills.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3, readdirSync } from "fs";
 import { basename, join as join2 } from "path";
 var DEFAULT_ORGX_SKILL_PACKS = [
@@ -3206,7 +3457,7 @@ Install and use these packs alongside this base skill:
 5. Carry \`_context\` through any widget-producing flows so the UI can render and resume correctly.
 `;
 function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 function normalizeSkillId(value) {
   const normalized = value.trim().toLowerCase();
@@ -5081,6 +5332,199 @@ async function trackWizardTelemetry(event, properties = {}, options = {}) {
   return response?.ok === true;
 }
 
+// src/lib/daily-brief-onboarding.ts
+var BASELINE_PROMPTS = [
+  { task_type: "code_review", label: "Code review", placeholder: "20" },
+  { task_type: "prd_draft", label: "PRD draft", placeholder: "45" },
+  { task_type: "test_writeup", label: "Test writeup", placeholder: "25" },
+  { task_type: "pr_description", label: "PR description", placeholder: "10" },
+  { task_type: "launch_post", label: "Launch post", placeholder: "60" },
+  { task_type: "architecture_doc", label: "Architecture doc", placeholder: "90" }
+];
+async function runDailyBriefOnboarding(options) {
+  if (!options.interactive) {
+    return {
+      status: "skipped_non_interactive",
+      message: "Daily Brief onboarding skipped \u2014 not attached to a TTY."
+    };
+  }
+  if (!options.workspace) {
+    return {
+      status: "skipped_no_workspace",
+      message: "Daily Brief onboarding skipped \u2014 no workspace resolved."
+    };
+  }
+  const auth = await resolveOrgxAuth();
+  if (!auth) {
+    return {
+      status: "failed",
+      message: "Daily Brief onboarding needs OrgX auth.",
+      error: "no_auth"
+    };
+  }
+  const state = await fetchOnboardingState(auth).catch(() => null);
+  if (state) {
+    const row = state.workspaces.find((w) => w.id === options.workspace.id);
+    if (row?.onboardingCompletedAt) {
+      return {
+        status: "skipped_already_completed",
+        message: "Daily Brief onboarding already completed for this workspace."
+      };
+    }
+  }
+  const { prompts } = options;
+  const proceed = await prompts.confirm({
+    message: "Set up your Daily Brief? (captures baselines so tomorrow's brief can show real time-saved numbers)",
+    initialValue: true
+  });
+  if (prompts.isCancel(proceed)) {
+    return { status: "cancelled", message: "Daily Brief onboarding cancelled." };
+  }
+  if (!proceed) {
+    return {
+      status: "cancelled",
+      message: "Skipped \u2014 run `wizard brief setup` later to configure."
+    };
+  }
+  const baselines = [];
+  for (const bp of BASELINE_PROMPTS) {
+    const answer = await prompts.text({
+      message: `How long does ${bp.label.toLowerCase()} usually take? (minutes, blank to skip)`,
+      placeholder: bp.placeholder,
+      validate(value) {
+        if (!value || value.trim() === "") return void 0;
+        const n = Number.parseInt(value, 10);
+        if (!Number.isFinite(n) || n <= 0 || n > 24 * 60) {
+          return "Enter 1 \u2013 1440 or leave blank.";
+        }
+        return void 0;
+      }
+    });
+    if (prompts.isCancel(answer)) {
+      return { status: "cancelled", message: "Daily Brief onboarding cancelled." };
+    }
+    if (typeof answer === "string" && answer.trim() !== "") {
+      const minutes = Number.parseInt(answer, 10);
+      if (Number.isFinite(minutes) && minutes > 0) {
+        baselines.push({ task_type: bp.task_type, minutes, confidence: 0.5 });
+      }
+    }
+  }
+  const goals = [];
+  const goalAnswer = await prompts.text({
+    message: "Weekly time saved target (minutes, blank to skip)",
+    placeholder: "180",
+    validate(value) {
+      if (!value || value.trim() === "") return void 0;
+      const n = Number.parseInt(value, 10);
+      if (!Number.isFinite(n) || n <= 0) {
+        return "Enter a positive number or leave blank.";
+      }
+      return void 0;
+    }
+  });
+  if (prompts.isCancel(goalAnswer)) {
+    return { status: "cancelled", message: "Daily Brief onboarding cancelled." };
+  }
+  if (typeof goalAnswer === "string" && goalAnswer.trim() !== "") {
+    const target = Number.parseInt(goalAnswer, 10);
+    if (Number.isFinite(target) && target > 0) {
+      goals.push({
+        goal_type: "time_saved_weekly",
+        target_value: target,
+        unit: "minutes",
+        period: "weekly"
+      });
+    }
+  }
+  const sendTimeAnswer = await prompts.text({
+    message: "When should your daily brief arrive? (HH:MM local, default 07:00)",
+    placeholder: "07:00",
+    validate(value) {
+      if (!value || value.trim() === "") return void 0;
+      if (!/^\d{1,2}:\d{2}$/.test(value.trim())) {
+        return "Use HH:MM (24h).";
+      }
+      return void 0;
+    }
+  });
+  if (prompts.isCancel(sendTimeAnswer)) {
+    return { status: "cancelled", message: "Daily Brief onboarding cancelled." };
+  }
+  const sendTimeLocal = typeof sendTimeAnswer === "string" && sendTimeAnswer.trim() ? sendTimeAnswer.trim().length === 4 ? `0${sendTimeAnswer.trim()}` : sendTimeAnswer.trim() : "07:00";
+  const onlyOnAttentionAnswer = await prompts.confirm({
+    message: "Only email when something needs your attention?",
+    initialValue: false
+  });
+  if (prompts.isCancel(onlyOnAttentionAnswer)) {
+    return { status: "cancelled", message: "Daily Brief onboarding cancelled." };
+  }
+  const onlyOnAttention = Boolean(onlyOnAttentionAnswer);
+  const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+  const commitPayload = {
+    workspace_id: options.workspace.id,
+    agent_roster: [
+      { id: "engineering-agent", display_name: "Eli", color: "6, 182, 212", enabled: true },
+      { id: "product-agent", display_name: "Pace", color: "22, 163, 74", enabled: true },
+      { id: "marketing-agent", display_name: "Mark", color: "249, 115, 22", enabled: true },
+      { id: "orchestrator-agent", display_name: "Xandy", color: "20, 184, 166", enabled: true }
+    ],
+    baselines,
+    goals,
+    starter_skill_loadouts: [],
+    notification_preference: {
+      channel: "email",
+      digest_kind: "daily_brief",
+      enabled: true,
+      send_time_local: `${sendTimeLocal}:00`,
+      timezone,
+      only_on_attention: onlyOnAttention
+    }
+  };
+  const commitResponse = await fetch(buildOrgxApiUrl("/v1/onboarding/daily-brief", auth.baseUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${auth.apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(commitPayload),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!commitResponse.ok) {
+    const text2 = await commitResponse.text().catch(() => "");
+    return {
+      status: "failed",
+      message: "Could not commit onboarding capture.",
+      error: `HTTP ${commitResponse.status}: ${text2.slice(0, 200)}`
+    };
+  }
+  const commitBody = await commitResponse.json().catch(() => ({}));
+  const previewUrl = typeof commitBody.daily_brief_preview_url === "string" ? commitBody.daily_brief_preview_url : "/today?mode=preview";
+  return {
+    status: "completed",
+    message: "Your Daily Brief is configured. First brief lands tomorrow.",
+    previewUrl
+  };
+}
+async function fetchOnboardingState(auth) {
+  try {
+    const res = await fetch(
+      buildOrgxApiUrl("/v1/onboarding/daily-brief", auth.baseUrl),
+      {
+        method: "GET",
+        headers: { Authorization: `Bearer ${auth.apiKey}` },
+        signal: AbortSignal.timeout(5e3)
+      }
+    );
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (!body || !Array.isArray(body.workspaces)) return null;
+    return body;
+  } catch {
+    return null;
+  }
+}
+
 // src/spinner.ts
 import ora from "ora";
 import pc2 from "picocolors";
@@ -5157,6 +5601,21 @@ function printMutationResults(results) {
     console.log(`  ${icon}  ${pc3.bold(result.name.padEnd(10))} ${state}  ${pc3.dim(result.message)}`);
   }
 }
+function printSurfaceSummary(results) {
+  const summarized = summarizeMutationResults(results);
+  const updated = summarized.filter((r) => r.state === "updated");
+  if (updated.length === 0) {
+    console.log(
+      `  ${ICON.skip}  ${pc3.dim(`${summarized.length} surface${summarized.length === 1 ? "" : "s"} already configured`)}`
+    );
+    return;
+  }
+  for (const result of summarized) {
+    const icon = result.state === "updated" ? ICON.ok : ICON.skip;
+    const state = result.state === "updated" ? pc3.green("updated  ") : pc3.dim("unchanged");
+    console.log(`  ${icon}  ${pc3.bold(result.name.padEnd(10))} ${state}  ${pc3.dim(result.message)}`);
+  }
+}
 function printPluginMutationReport(report) {
   for (const result of report.results) {
     const icon = result.changed ? ICON.ok : ICON.skip;
@@ -5166,10 +5625,16 @@ function printPluginMutationReport(report) {
     );
   }
 }
-async function printPluginStatusSection() {
+async function checkPluginStatusesCompact() {
   const spinner = createOrgxSpinner("Checking OrgX companion plugin status");
   spinner.start();
   const statuses = await listOrgxPluginStatuses();
+  const installable = statuses.filter((s) => s.available && !s.installed);
+  const installed = statuses.filter((s) => s.installed).length;
+  if (installable.length === 0) {
+    spinner.succeed(`Plugins ready (${installed} installed)`);
+    return statuses;
+  }
   spinner.succeed("OrgX companion plugin status checked");
   console.log("");
   console.log(pc3.dim("  plugins"));
@@ -5787,7 +6252,7 @@ function printDoctorReport(report, assessment) {
 async function main() {
   const program = new Command();
   program.name("orgx-wizard").description("Add OrgX MCP configs, skills/rules, and companion plugins to your local AI tools.").showHelpAfterError();
-  const pkgVersion = true ? "0.1.14" : void 0;
+  const pkgVersion = true ? "0.1.16" : void 0;
   program.version(pkgVersion ?? "unknown", "-V, --version");
   program.hook("preAction", () => {
     console.log(renderBanner(pkgVersion));
@@ -5899,13 +6364,14 @@ async function main() {
     spinner.start();
     const results = await setupDetectedSurfaces();
     spinner.succeed("Detected surfaces configured");
-    printMutationResults(results);
-    const pluginStatuses = await printPluginStatusSection();
+    printSurfaceSummary(results);
+    const pluginStatuses = await checkPluginStatusesCompact();
     await safeTrackWizardTelemetry("mcp_injected", {
       changed_count: results.filter((result) => result.changed).length,
       preset: "standard",
       surface_count: results.length
     });
+    const wasAlreadyPaired = await resolveOrgxAuth() !== null;
     let resolvedAuth = await resolveOrgxAuth();
     if (!resolvedAuth) {
       console.log("");
@@ -5979,6 +6445,24 @@ async function main() {
       if (workspaceSetup.workspace) {
         console.log(`  ${ICON.ok}  ${pc3.green("workspace ")} ${pc3.bold(workspaceSetup.workspace.name)}`);
       }
+      const briefResult = await runDailyBriefOnboarding({
+        interactive,
+        workspace: resolvedWorkspace,
+        prompts: {
+          cancel: clack.cancel,
+          isCancel: clack.isCancel,
+          text: textPrompt,
+          select: selectPrompt,
+          confirm: clack.confirm
+        }
+      });
+      if (briefResult.status === "cancelled") {
+        console.log(`  ${ICON.skip}  ${pc3.dim(briefResult.message)}`);
+      } else if (briefResult.status === "completed") {
+        console.log(`  ${ICON.ok}  ${pc3.green("daily brief")}  ${pc3.dim(briefResult.message)}`);
+      } else if (briefResult.status === "failed") {
+        console.log(`  ${ICON.warn}  ${pc3.yellow("daily brief")}  ${pc3.dim(briefResult.message)}`);
+      }
       const addOnResult = await maybeConfigureOptionalWorkspaceAddOns({
         interactive,
         telemetry: { command: "setup", preset: "standard" },
@@ -6010,6 +6494,11 @@ async function main() {
     console.log("");
     if (assessment.issues.length === 0) {
       console.log(`  ${ICON.ok}  ${pc3.green("You're all set.")}  ${pc3.dim(`OrgX is active across ${configuredCount} editor${configuredCount !== 1 ? "s" : ""}`)}`);
+      if (wasAlreadyPaired) {
+        console.log(
+          `  ${pc3.dim("\u2192")}  ${pc3.dim("If you opened the browser onboarding, click")} ${pc3.cyan("I've already paired")} ${pc3.dim("to continue.")}`
+        );
+      }
     } else {
       printDoctorReport(doctor, assessment);
       if (verification.status === "error") {
@@ -6017,6 +6506,70 @@ async function main() {
       }
     }
   });
+  async function runPkceLogin(opts = {}) {
+    const spinner = createOrgxSpinner("Starting OrgX OAuth login");
+    spinner.start();
+    try {
+      const pkceResult = await startPkceLogin({
+        timeoutMs: (opts.timeout ?? 600) * 1e3,
+        onAuthorizeUrl: (url) => {
+          spinner.succeed("Authorization ready");
+          console.log(`
+  ${pc3.dim("Open this URL to authorize:")}`);
+          console.log(`  ${pc3.cyan(url)}
+`);
+          if (opts.open !== false) {
+            const openResult = openBrowser(url);
+            if (!openResult.ok && openResult.error) {
+              console.log(pc3.yellow(`Browser open failed: ${openResult.error}`));
+            }
+          }
+          spinner.start();
+          spinner.text = "Waiting for browser authorization...";
+        }
+      });
+      spinner.text = "Verifying token...";
+      const baseUrl = normalizeOrgxBaseUrl(DEFAULT_ORGX_BASE_URL);
+      const verification = await verifyOrgxAuth({
+        apiKey: pkceResult.accessToken,
+        keyPrefix: pkceResult.accessToken.slice(0, 12),
+        baseUrl,
+        source: "wizard-store"
+      });
+      if (!verification.ok) {
+        spinner.fail("OAuth token verification failed");
+        console.log(`       ${pc3.red(verification.error ?? `HTTP ${verification.status ?? "error"}`)}`);
+        console.log(`       ${pc3.dim("If this persists, try: wizard auth set-key <oxk_...>")}`);
+        return false;
+      }
+      const stored = await writeWizardAuth({
+        apiKey: pkceResult.accessToken,
+        baseUrl,
+        verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: "pkce",
+        ...pkceResult.refreshToken !== void 0 ? { refreshToken: pkceResult.refreshToken } : {},
+        oauthClientId: pkceResult.clientId
+      });
+      await safeTrackWizardTelemetry("auth_completed", {
+        auth_source: opts.telemetrySource ?? "pkce",
+        has_base_url: false
+      });
+      const openclawResults = detectSurface("openclaw").detected ? await addSurface("openclaw") : [];
+      spinner.succeed("OrgX account connected");
+      await syncContinuityAfterAuth();
+      console.log(`  ${ICON.ok}  ${pc3.green("verified  ")} ${pc3.bold(stored.keyPrefix)}  ${pc3.dim("OAuth / PKCE")}`);
+      if (openclawResults.length > 0) {
+        console.log("");
+        printMutationResults(openclawResults);
+      }
+      return true;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      spinner.fail("OAuth login failed");
+      console.log(`       ${pc3.red(message)}`);
+      return false;
+    }
+  }
   async function runBrowserLogin(opts = {}) {
     const installationId = getOrCreateWizardInstallationId();
     const spinner = createOrgxSpinner("Starting OrgX browser pairing");
@@ -6096,7 +6649,7 @@ async function main() {
     console.log(pc3.dim("  account"));
     printAuthStatus(status);
   });
-  auth.command("login").description("Start browser pairing for OrgX auth, with direct API key fallback for CI and blocked browsers.").option("--api-key <key>", "Bypass browser pairing and verify this OrgX API key directly.").option("--base-url <url>", "OrgX base URL").option("--device-name <name>", "Device name shown during browser approval.").option("--no-open", "Do not automatically open the browser connect URL.").option("--timeout <seconds>", "How long to wait for browser pairing before giving up.", parseTimeoutSeconds, 600).action(async (options) => {
+  auth.command("login").description("Authenticate with OrgX. Uses OAuth PKCE (no OpenClaw required) by default, with OpenClaw pairing and direct key fallbacks.").option("--api-key <key>", "Bypass browser auth and verify this OrgX API key directly.").option("--base-url <url>", "OrgX base URL (for OpenClaw pairing fallback).").option("--device-name <name>", "Device name shown during OpenClaw pairing.").option("--no-open", "Do not automatically open the browser auth URL.").option("--pairing", "Force OpenClaw pairing flow instead of OAuth PKCE.").option("--timeout <seconds>", "How long to wait for browser auth before giving up.", parseTimeoutSeconds, 600).action(async (options) => {
     if (options.apiKey) {
       const spinner = createOrgxSpinner("Verifying OrgX API key");
       spinner.start();
@@ -6118,13 +6671,31 @@ async function main() {
       }
       return;
     }
-    await runBrowserLogin({
-      ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
-      ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+    if (options.pairing) {
+      await runBrowserLogin({
+        ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
+        ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+        ...options.open !== void 0 ? { open: options.open } : {},
+        telemetrySource: "browser_pairing",
+        timeout: options.timeout
+      });
+      return;
+    }
+    const pkceOk = await runPkceLogin({
       ...options.open !== void 0 ? { open: options.open } : {},
-      telemetrySource: "browser_pairing",
+      telemetrySource: "pkce",
       timeout: options.timeout
     });
+    if (!pkceOk) {
+      console.log(pc3.dim("\n  Falling back to OpenClaw pairing..."));
+      await runBrowserLogin({
+        ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
+        ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+        ...options.open !== void 0 ? { open: options.open } : {},
+        telemetrySource: "browser_pairing_fallback",
+        timeout: options.timeout
+      });
+    }
   });
   auth.command("set-key").description("Verify and persist a per-user OrgX API key for the wizard.").argument("<apiKey>", "per-user OrgX API key (oxk_...)").option("--base-url <url>", "OrgX base URL").action(async (apiKey, options) => {
     const spinner = createOrgxSpinner("Verifying OrgX API key");