@useorgx/wizard 0.1.52 → 0.1.56

package/dist/cli.js

@@ -2,9 +2,9 @@
 
 // src/cli.ts
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="edb4168b-4102-5109-afd1-34d3193fbf8c")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="02842523-d681-5cea-96aa-0f0c896e9fb5")}catch(e){}}();
 import * as clack from "@clack/prompts";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync5 } from "child_process";
 import { readFileSync as readFileSync8 } from "fs";
 import { hostname } from "os";
 import { resolve as resolve3 } from "path";
@@ -82,6 +82,7 @@ var CLAUDE_DIR = join(HOME, ".claude");
 var CURSOR_DIR = join(HOME, ".cursor");
 var CODEX_DIR = join(HOME, ".codex");
 var OPENCLAW_DIR = join(HOME, ".openclaw");
+var DEEPSEEK_HARNESS_DIR = process.env.DSH_HOME?.trim() || join(HOME, ".dsh");
 var AGENTS_DIR = join(HOME, ".agents");
 var CLAUDE_PROJECTS_DIR = join(CLAUDE_DIR, "projects");
 var CODEX_SESSIONS_DIR = join(CODEX_DIR, "sessions");
@@ -125,6 +126,15 @@ var CLAUDE_INSTALL_PATHS = uniquePaths([CLAUDE_DIR]);
 var CURSOR_INSTALL_PATHS = uniquePaths([CURSOR_DIR]);
 var CODEX_INSTALL_PATHS = uniquePaths([CODEX_DIR]);
 var OPENCLAW_INSTALL_PATHS = uniquePaths([OPENCLAW_DIR]);
+var DEEPSEEK_HARNESS_PROFILE_PATH = join(
+  DEEPSEEK_HARNESS_DIR,
+  "profiles",
+  "headless",
+  "package.json"
+);
+var DEEPSEEK_HARNESS_INSTALL_PATHS = uniquePaths([
+  DEEPSEEK_HARNESS_DIR
+]);
 var VSCODE_MCP_PATHS = uniquePaths([
   join(HOME, "Library", "Application Support", "Code", "User", "mcp.json"),
   join(XDG_CONFIG_HOME, "Code", "User", "mcp.json"),
@@ -1098,6 +1108,34 @@ async function exchangeCodeForTokens(options) {
     ...typeof data.scope === "string" ? { scope: data.scope } : {}
   };
 }
+async function refreshAccessToken(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: options.refreshToken,
+    client_id: options.clientId
+  });
+  const response = await fetchImpl(ORGX_HOSTED_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new Error(`Token refresh failed (HTTP ${response.status}): ${text2}`);
+  }
+  const data = await response.json();
+  if (!isRecord(data) || typeof data.access_token !== "string") {
+    throw new Error("Refresh response missing access_token.");
+  }
+  return {
+    access_token: data.access_token,
+    token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
+    ...typeof data.expires_in === "number" ? { expires_in: data.expires_in } : {},
+    ...typeof data.refresh_token === "string" ? { refresh_token: data.refresh_token } : {}
+  };
+}
 async function startPkceLogin(options = {}) {
   const port = options.preferredPort ?? ORGX_WIZARD_OAUTH_PREFERRED_PORT;
   const scope = options.scope ?? ORGX_WIZARD_OAUTH_SCOPE;
@@ -1152,6 +1190,7 @@ var SURFACE_NAMES = [
   "claude",
   "cursor",
   "codex",
+  "deepseek",
   "openclaw",
   "vscode",
   "windsurf",
@@ -1162,6 +1201,7 @@ var AUTOMATED_SURFACE_NAMES = [
   "claude",
   "cursor",
   "codex",
+  "deepseek",
   "openclaw",
   "vscode",
   "windsurf",
@@ -2125,16 +2165,13 @@ async function checkWorkspaceConnectivity(options = {}) {
 import { spawn } from "child_process";
 import {
   existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
-  mkdtempSync,
-  readFileSync as readFileSync2,
-  readdirSync as readdirSync2,
-  rmSync,
-  statSync as statSync2,
-  writeFileSync as writeFileSync2
+  mkdirSync as mkdirSync3,
+  mkdtempSync as mkdtempSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join3, relative } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 
 // src/surfaces/mcp-config.ts
 import * as TOML from "@iarna/toml";
@@ -2481,6 +2518,10 @@ var SURFACE_LOCATORS = {
     configPaths: CODEX_CONFIG_PATHS,
     installPaths: CODEX_INSTALL_PATHS
   },
+  deepseek: {
+    configPaths: [DEEPSEEK_HARNESS_PROFILE_PATH],
+    installPaths: DEEPSEEK_HARNESS_INSTALL_PATHS
+  },
   openclaw: {
     configPaths: OPENCLAW_CONFIG_PATHS,
     installPaths: OPENCLAW_INSTALL_PATHS
@@ -2544,10 +2585,359 @@ function detectSurface(name, exists = existsSync2) {
   return detection;
 }
 
+// src/lib/claude-plugin-bundle.ts
+var ORGX_CLAUDE_PLUGIN_NAME = "orgx-claude-code-plugin";
+var ORGX_CLAUDE_MARKETPLACE_NAME = "orgx-local";
+var ORGX_CLAUDE_PLUGIN_VERSION = "0.1.12";
+var ORGX_CLAUDE_PLUGIN_REF = `v${ORGX_CLAUDE_PLUGIN_VERSION}`;
+var ORGX_CLAUDE_PLUGIN_MCP_URL = "https://mcp.useorgx.com/mcp?profile=claude-directory";
+var ALLOWED_FILES = [
+  ".claude-plugin/marketplace.json",
+  ".claude-plugin/plugin.json",
+  ".mcp.json",
+  "commands/orgx-login.md",
+  "commands/orgx-operator-chronicle.md",
+  "commands/orgx-status.md",
+  "skills/orgx-setup/SKILL.md"
+];
+var PROHIBITED_CONTENT = [
+  { label: "transcript access", pattern: /\btranscripts?\b/i },
+  {
+    label: "telemetry collection",
+    pattern: /\b(?:collect|capture|record|send|upload|emit|track|enable|configure)\b[^\n]{0,80}\btelemetry\b/i
+  },
+  {
+    label: "telemetry collection",
+    pattern: /\btelemetry\b[^\n]{0,40}\b(?:collection|capture|recording|upload|emission|tracking|enabled)\b/i
+  },
+  {
+    label: "telemetry collection",
+    pattern: /\btelemetry\b\s*[:=]\s*true\b/i
+  },
+  { label: "dynamic context sync", pattern: /dynamic(?:[\s_-]+context)?[\s_-]+sync/i },
+  { label: "runtime hook", pattern: /orgx-session-hook|emit-execution-graph|post-install\.sh/i }
+];
+var MANIFEST_CAPABILITY_FIELDS = [
+  "agents",
+  "commands",
+  "hooks",
+  "lspServers",
+  "mcpServers",
+  "skills"
+];
+var EXPECTED_PLUGIN_MANIFEST = {
+  $schema: "https://json.schemastore.org/claude-code-plugin-manifest.json",
+  name: ORGX_CLAUDE_PLUGIN_NAME,
+  displayName: "OrgX",
+  version: ORGX_CLAUDE_PLUGIN_VERSION,
+  description: "Connect Claude Code to a focused, non-destructive, closed-world OrgX status profile through native OAuth.",
+  author: {
+    name: "OrgX Team",
+    email: "reviewers@useorgx.com",
+    url: "https://useorgx.com"
+  },
+  homepage: "https://useorgx.com",
+  repository: "https://github.com/useorgx/orgx-claude-code-plugin",
+  license: "MIT",
+  keywords: [
+    "orgx",
+    "mcp",
+    "productivity",
+    "status",
+    "native-oauth"
+  ]
+};
+function parseJsonFile(files, path) {
+  const bytes = files.get(path);
+  if (!bytes) {
+    throw new Error(`Rejected Claude plugin bundle: required file '${path}' is missing.`);
+  }
+  let value;
+  try {
+    value = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new Error(`Rejected Claude plugin bundle: '${path}' is not valid JSON.`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`Rejected Claude plugin bundle: '${path}' must contain a JSON object.`);
+  }
+  return value;
+}
+function assertExactKeys(value, expected, label) {
+  const actualKeys = Object.keys(value).sort();
+  const expectedKeys = [...expected].sort();
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    throw new Error(
+      `Rejected Claude plugin bundle: ${label} must contain only ${expectedKeys.join(", ")}.`
+    );
+  }
+}
+function canonicalizeJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalizeJson(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalizeJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+function validateClaudePluginBundle(files) {
+  const actualFiles = [...files.keys()].sort();
+  const expectedFiles = [...ALLOWED_FILES].sort();
+  const missingFiles = expectedFiles.filter((path) => !files.has(path));
+  const unexpectedFiles = actualFiles.filter(
+    (path) => !ALLOWED_FILES.includes(path)
+  );
+  if (missingFiles.length > 0 || unexpectedFiles.length > 0) {
+    const details = [
+      ...missingFiles.length > 0 ? [`missing ${missingFiles.join(", ")}`] : [],
+      ...unexpectedFiles.length > 0 ? [`unexpected ${unexpectedFiles.join(", ")}`] : []
+    ].join("; ");
+    throw new Error(`Rejected Claude plugin bundle: file set is not allowed (${details}).`);
+  }
+  const manifest = parseJsonFile(files, ".claude-plugin/plugin.json");
+  if (manifest.name !== ORGX_CLAUDE_PLUGIN_NAME || manifest.version !== ORGX_CLAUDE_PLUGIN_VERSION) {
+    throw new Error(
+      `Rejected Claude plugin bundle: manifest must identify ${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_PLUGIN_VERSION}.`
+    );
+  }
+  const capabilityFields = MANIFEST_CAPABILITY_FIELDS.filter((field) => field in manifest);
+  if (capabilityFields.length > 0) {
+    throw new Error(
+      `Rejected Claude plugin bundle: manifest cannot declare capability fields (${capabilityFields.join(", ")}).`
+    );
+  }
+  if (canonicalizeJson(manifest) !== canonicalizeJson(EXPECTED_PLUGIN_MANIFEST)) {
+    throw new Error(
+      "Rejected Claude plugin bundle: manifest does not match the reviewed v0.1.12 metadata contract."
+    );
+  }
+  const marketplace = parseJsonFile(files, ".claude-plugin/marketplace.json");
+  if (marketplace.version !== ORGX_CLAUDE_PLUGIN_VERSION) {
+    throw new Error(
+      `Rejected Claude plugin bundle: marketplace version must be ${ORGX_CLAUDE_PLUGIN_VERSION}.`
+    );
+  }
+  const mcp = parseJsonFile(files, ".mcp.json");
+  assertExactKeys(mcp, ["mcpServers"], ".mcp.json");
+  const mcpServers = mcp.mcpServers;
+  if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) {
+    throw new Error("Rejected Claude plugin bundle: mcpServers must be a JSON object.");
+  }
+  const servers = mcpServers;
+  assertExactKeys(servers, ["orgx"], "mcpServers");
+  const orgx = servers.orgx;
+  if (!orgx || typeof orgx !== "object" || Array.isArray(orgx)) {
+    throw new Error("Rejected Claude plugin bundle: the orgx MCP server must be a JSON object.");
+  }
+  const orgxServer = orgx;
+  assertExactKeys(orgxServer, ["type", "url"], "the orgx MCP server");
+  if (orgxServer.type !== "http" || orgxServer.url !== ORGX_CLAUDE_PLUGIN_MCP_URL) {
+    throw new Error(
+      "Rejected Claude plugin bundle: the orgx MCP server must match the reviewed closed-world status profile endpoint."
+    );
+  }
+  const combinedContent = actualFiles.map((path) => files.get(path)?.toString("utf8") ?? "").join("\n");
+  for (const prohibited of PROHIBITED_CONTENT) {
+    if (prohibited.pattern.test(combinedContent)) {
+      throw new Error(
+        `Rejected Claude plugin bundle: prohibited ${prohibited.label} content was found.`
+      );
+    }
+  }
+}
+
+// src/lib/managed-plugin-tree.ts
+import {
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  readFileSync as readFileSync2,
+  readlinkSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3, isAbsolute, join as join2, sep } from "path";
+function lstatIfExists(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    const code = typeof error === "object" && error && "code" in error ? String(error.code) : void 0;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw error;
+  }
+}
+function assertSafeRelativePath(path) {
+  const segments = path.split(/[\\/]/);
+  const hasUnsafeSegment = segments.some(
+    (segment) => !segment || segment === "." || segment === ".."
+  );
+  if (isAbsolute(path) || hasUnsafeSegment) {
+    throw new Error(`Refusing to sync managed plugin tree: unsafe destination path '${path}'.`);
+  }
+}
+function occupiesExpectedManagedPath(relativePath, expectedPaths) {
+  const descendantPrefix = `${relativePath}${sep}`;
+  return [...expectedPaths].some(
+    (expectedPath) => expectedPath === relativePath || expectedPath.startsWith(descendantPrefix)
+  );
+}
+function readManagedTreeSnapshot(root, expectedPaths) {
+  const rootStat = lstatIfExists(root);
+  if (!rootStat) return null;
+  if (rootStat.isSymbolicLink()) {
+    throw new Error("Refusing to sync managed plugin tree: destination root is a symbolic link.");
+  }
+  if (!rootStat.isDirectory()) {
+    throw new Error("Refusing to sync managed plugin tree: destination root is not a directory.");
+  }
+  const snapshot = {
+    directories: /* @__PURE__ */ new Set(),
+    files: /* @__PURE__ */ new Map(),
+    symlinks: /* @__PURE__ */ new Map()
+  };
+  const visit = (directory, relativeDirectory) => {
+    for (const name of readdirSync(directory)) {
+      const path = join2(directory, name);
+      const relativePath = relativeDirectory ? join2(relativeDirectory, name) : name;
+      const entryStat = lstatSync(path);
+      if (entryStat.isSymbolicLink()) {
+        if (occupiesExpectedManagedPath(relativePath, expectedPaths)) {
+          throw new Error(
+            `Refusing to sync managed plugin tree: destination entry '${relativePath}' is a symbolic link.`
+          );
+        }
+        snapshot.symlinks.set(relativePath, readlinkSync(path));
+        continue;
+      }
+      if (entryStat.isDirectory()) {
+        snapshot.directories.add(relativePath);
+        visit(path, relativePath);
+        continue;
+      }
+      if (entryStat.isFile()) {
+        snapshot.files.set(relativePath, readFileSync2(path));
+        continue;
+      }
+      throw new Error(
+        `Refusing to sync managed plugin tree: destination entry '${relativePath}' is not a regular file or directory.`
+      );
+    }
+  };
+  visit(root, "");
+  return snapshot;
+}
+function setsEqual(left, right) {
+  return left.size === right.size && [...left].every((value) => right.has(value));
+}
+function snapshotsEqual(left, right) {
+  if (!left || !right) return left === right;
+  if (!setsEqual(left.directories, right.directories) || left.files.size !== right.files.size || left.symlinks.size !== right.symlinks.size) {
+    return false;
+  }
+  const filesEqual = [...left.files].every(([path, bytes]) => {
+    const other = right.files.get(path);
+    return other !== void 0 && Buffer.compare(bytes, other) === 0;
+  });
+  if (!filesEqual) return false;
+  return [...left.symlinks].every(
+    ([path, target]) => right.symlinks.get(path) === target
+  );
+}
+function expectedDirectories(files) {
+  const directories = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    let current = dirname3(file.path);
+    while (current !== "." && current !== "/") {
+      directories.add(current);
+      const parent = dirname3(current);
+      if (parent === current) break;
+      current = parent;
+    }
+  }
+  return directories;
+}
+function snapshotMatchesFiles(snapshot, files) {
+  if (!snapshot || snapshot.files.size !== files.length) return false;
+  if (snapshot.symlinks.size > 0) return false;
+  if (!setsEqual(snapshot.directories, expectedDirectories(files))) return false;
+  return files.every((file) => {
+    const existing = snapshot.files.get(file.path);
+    return existing !== void 0 && Buffer.compare(existing, file.bytes) === 0;
+  });
+}
+function stageAndReplaceManagedTree(destinationRoot, files, originalSnapshot, expectedPaths) {
+  const destinationParent = dirname3(destinationRoot);
+  mkdirSync2(destinationParent, { recursive: true });
+  const transactionRoot = mkdtempSync(join2(destinationParent, ".orgx-plugin-sync-"));
+  const nextRoot = join2(transactionRoot, "next");
+  const previousRoot = join2(transactionRoot, "previous");
+  let preserveTransaction = false;
+  try {
+    mkdirSync2(nextRoot);
+    for (const file of files) {
+      const destination = join2(nextRoot, file.path);
+      mkdirSync2(dirname3(destination), { recursive: true });
+      writeFileSync2(destination, file.bytes);
+    }
+    const latestSnapshot = readManagedTreeSnapshot(destinationRoot, expectedPaths);
+    if (!snapshotsEqual(originalSnapshot, latestSnapshot)) {
+      throw new Error("Refusing to sync managed plugin tree: destination changed during staging.");
+    }
+    let previousMoved = false;
+    try {
+      if (latestSnapshot) {
+        renameSync(destinationRoot, previousRoot);
+        previousMoved = true;
+      }
+      renameSync(nextRoot, destinationRoot);
+      if (previousMoved) {
+        rmSync(previousRoot, { force: true, recursive: true });
+        previousMoved = false;
+      }
+    } catch (error) {
+      if (previousMoved && !lstatIfExists(destinationRoot)) {
+        try {
+          renameSync(previousRoot, destinationRoot);
+          previousMoved = false;
+        } catch (rollbackError) {
+          preserveTransaction = true;
+          throw new AggregateError(
+            [error, rollbackError],
+            `Managed plugin replacement failed and rollback could not restore the prior tree. Recovery data remains at ${transactionRoot}.`
+          );
+        }
+      }
+      throw error;
+    }
+  } finally {
+    if (!preserveTransaction) {
+      rmSync(transactionRoot, { force: true, recursive: true });
+    }
+  }
+}
+function replaceManagedPluginTreeIfChanged(destinationRoot, files) {
+  const paths = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    assertSafeRelativePath(file.path);
+    if (paths.has(file.path)) {
+      throw new Error(`Refusing to sync managed plugin tree: duplicate destination path '${file.path}'.`);
+    }
+    paths.add(file.path);
+  }
+  const snapshot = readManagedTreeSnapshot(destinationRoot, paths);
+  if (snapshotMatchesFiles(snapshot, files)) return false;
+  stageAndReplaceManagedTree(destinationRoot, files, snapshot, paths);
+  return true;
+}
+
 // src/lib/skills.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync3, readdirSync } from "fs";
-import { basename, join as join2 } from "path";
+import { existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
+import { basename, join as join3 } from "path";
 var DEFAULT_ORGX_SKILL_PACKS = [
   "morning-briefing",
   "initiative-kickoff",
@@ -2645,7 +3035,7 @@ function defaultExtensionTitle(skillId, scope) {
   return `${prefix} ${skillId} behavior`;
 }
 function extensionFilePath(skillId, scope, extensionsDir = ORGX_SKILL_EXTENSIONS_DIR) {
-  return join2(extensionsDir, `${scope}.${skillId}.md`);
+  return join3(extensionsDir, `${scope}.${skillId}.md`);
 }
 function extensionTemplate(input) {
   const body = input.content?.trim() ? input.content.trim() : [
@@ -2729,8 +3119,8 @@ function listSkillExtensions(options = {}) {
   if (!existsSync3(extensionsDir)) {
     return [];
   }
-  return readdirSync(extensionsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => {
-    const path = join2(extensionsDir, entry.name);
+  return readdirSync2(extensionsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => {
+    const path = join3(extensionsDir, entry.name);
     const content = readTextIfExists(path);
     return content === null ? null : parseSkillExtension(path, content);
   }).filter((entry) => Boolean(entry)).sort((left, right) => left.id.localeCompare(right.id));
@@ -3002,7 +3392,7 @@ async function installSkillPack(skillName, claudeSkillsDir, fetchImpl, ref, trac
     const content = relativePath === "SKILL.md" ? composeSkillContent(skillName, coreContent, tracking.extensions) : coreContent;
     writes.push(
       writeManagedFile(
-        join2(claudeSkillsDir, skillName, relativePath),
+        join3(claudeSkillsDir, skillName, relativePath),
         content,
         `${skillName}/${relativePath}`,
         file.sourceUrl,
@@ -3141,8 +3531,6 @@ function getSkillStatus(options = {}) {
 var DEFAULT_ORGX_PLUGIN_TARGETS = ["cursor", "claude", "codex", "openclaw"];
 var ORGX_PLUGIN_GITHUB_OWNER = "useorgx";
 var ORGX_PLUGIN_GITHUB_REF = "main";
-var ORGX_CLAUDE_PLUGIN_NAME = "orgx-claude-code-plugin";
-var ORGX_CLAUDE_MARKETPLACE_NAME = "orgx-local";
 var ORGX_CODEX_PLUGIN_NAME = "orgx-codex-plugin";
 var ORGX_CURSOR_PLUGIN_NAME = "cursor-plugin";
 var ORGX_OPENCLAW_PLUGIN_ID = "orgx";
@@ -3150,16 +3538,14 @@ var ORGX_OPENCLAW_PLUGIN_PACKAGE_NAME = "@useorgx/openclaw-plugin";
 var CLAUDE_PLUGIN_SYNC_SPEC = {
   owner: ORGX_PLUGIN_GITHUB_OWNER,
   repo: ORGX_CLAUDE_PLUGIN_NAME,
-  ref: ORGX_PLUGIN_GITHUB_REF,
+  ref: ORGX_CLAUDE_PLUGIN_REF,
   include: [
     { localPath: ".claude-plugin", remotePath: ".claude-plugin" },
-    { localPath: "agents", remotePath: "agents" },
+    { localPath: ".mcp.json", remotePath: ".mcp.json" },
     { localPath: "commands", remotePath: "commands" },
-    { localPath: "hooks", remotePath: "hooks" },
-    { localPath: "lib", remotePath: "lib" },
-    { localPath: "scripts", remotePath: "scripts" },
     { localPath: "skills", remotePath: "skills" }
-  ]
+  ],
+  validate: validateClaudePluginBundle
 };
 var CODEX_PLUGIN_SYNC_SPEC = {
   owner: ORGX_PLUGIN_GITHUB_OWNER,
@@ -3282,7 +3668,7 @@ async function listRemoteRepoFiles(spec, path, localPath, fetchImpl) {
         ...await listRemoteRepoFiles(
           spec,
           entry.path,
-          join3(localPath, entry.name),
+          join4(localPath, entry.name),
           fetchImpl
         )
       );
@@ -3292,7 +3678,7 @@ async function listRemoteRepoFiles(spec, path, localPath, fetchImpl) {
       throw new Error(`GitHub did not provide a download URL for '${entry.path}'.`);
     }
     files.push({
-      localPath: join3(localPath, entry.name),
+      localPath: join4(localPath, entry.name),
       path: entry.path,
       sourceUrl: entry.download_url
     });
@@ -3328,88 +3714,25 @@ async function fetchRemoteBytes(sourceUrl, fetchImpl) {
   }
   return Buffer.from(await response.arrayBuffer());
 }
-function readBytesIfExists(path) {
-  if (!existsSync4(path)) return null;
-  try {
-    if (!statSync2(path).isFile()) {
-      return null;
-    }
-    return readFileSync2(path);
-  } catch (error) {
-    const code = typeof error === "object" && error && "code" in error ? String(error.code) : void 0;
-    if (code === "ENOENT" || code === "ENOTDIR" || code === "EISDIR") {
-      return null;
-    }
-    throw error;
-  }
-}
-function writeBytesIfChanged(path, bytes) {
-  const existing = readBytesIfExists(path);
-  if (existing && Buffer.compare(existing, bytes) === 0) {
-    return false;
-  }
-  mkdirSync2(dirname3(path), { recursive: true });
-  writeFileSync2(path, bytes);
-  return true;
-}
 function removePathIfExists(path) {
   if (!existsSync4(path)) return false;
-  rmSync(path, { force: true, recursive: true });
+  rmSync2(path, { force: true, recursive: true });
   return true;
 }
-function listRelativeFiles(root, base = root) {
-  if (!existsSync4(root)) return [];
-  if (!statSync2(root).isDirectory()) {
-    return [];
-  }
-  const files = [];
-  for (const entry of readdirSync2(root, { withFileTypes: true })) {
-    const nextPath = join3(root, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...listRelativeFiles(nextPath, base));
-      continue;
-    }
-    if (entry.isFile()) {
-      files.push(relative(base, nextPath));
-    }
-  }
-  return files.sort();
-}
-function pruneEmptyDirectories(root, current = root) {
-  if (!existsSync4(current) || !statSync2(current).isDirectory()) {
-    return false;
-  }
-  let changed = false;
-  for (const entry of readdirSync2(current, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    changed = pruneEmptyDirectories(root, join3(current, entry.name)) || changed;
-  }
-  if (current !== root && readdirSync2(current).length === 0) {
-    rmSync(current, { force: true, recursive: true });
-    return true;
-  }
-  return changed;
-}
 async function syncManagedRepoTree(spec, destinationRoot, fetchImpl) {
   const remoteFiles = await collectRemoteRepoFiles(spec, fetchImpl);
-  let changed = false;
-  const expected = new Set(remoteFiles.map((file) => file.localPath));
-  if (existsSync4(destinationRoot) && !statSync2(destinationRoot).isDirectory()) {
-    rmSync(destinationRoot, { force: true, recursive: true });
-    changed = true;
-  }
-  for (const file of listRelativeFiles(destinationRoot)) {
-    if (expected.has(file)) continue;
-    rmSync(join3(destinationRoot, file), { force: true });
-    changed = true;
-  }
-  changed = pruneEmptyDirectories(destinationRoot) || changed;
+  const fetchedFiles = [];
   for (const file of remoteFiles) {
-    const bytes = await fetchRemoteBytes(file.sourceUrl, fetchImpl);
-    if (writeBytesIfChanged(join3(destinationRoot, file.localPath), bytes)) {
-      changed = true;
-    }
+    fetchedFiles.push({
+      ...file,
+      bytes: await fetchRemoteBytes(file.sourceUrl, fetchImpl)
+    });
   }
+  spec.validate?.(new Map(fetchedFiles.map((file) => [file.localPath, file.bytes])));
+  const changed = replaceManagedPluginTreeIfChanged(
+    destinationRoot,
+    fetchedFiles.map((file) => ({ path: file.localPath, bytes: file.bytes }))
+  );
   return { changed, fileCount: remoteFiles.length };
 }
 function serializeJson(value) {
@@ -3422,8 +3745,8 @@ function writeJsonIfChanged(path, value) {
   if (existing === next) {
     return false;
   }
-  mkdirSync2(dirname3(path), { recursive: true });
-  writeFileSync2(path, next, "utf8");
+  mkdirSync3(dirname4(path), { recursive: true });
+  writeFileSync3(path, next, "utf8");
   return true;
 }
 function buildClaudeMarketplaceManifest() {
@@ -3437,7 +3760,7 @@ function buildClaudeMarketplaceManifest() {
     plugins: [
       {
         name: ORGX_CLAUDE_PLUGIN_NAME,
-        description: "OrgX MCP tools and runtime telemetry hooks for Claude Code.",
+        description: "Connect Claude Code to a focused, non-destructive, closed-world OrgX status profile through native OAuth.",
         source: `./plugins/${ORGX_CLAUDE_PLUGIN_NAME}`
       }
     ]
@@ -3494,7 +3817,7 @@ function removeCodexMarketplaceEntry(path) {
     return false;
   }
   if (nextPlugins.length === 0) {
-    rmSync(path, { force: true });
+    rmSync2(path, { force: true });
     return true;
   }
   return writeJsonIfChanged(path, {
@@ -3506,16 +3829,21 @@ function codexMarketplaceHasOrgxEntry(path) {
   const { plugins } = readMarketplacePlugins(path);
   return plugins.some((plugin) => plugin.name === ORGX_CODEX_PLUGIN_NAME);
 }
-function extractClaudePluginNames(payload) {
+function extractClaudePluginInstallations(payload) {
   try {
     const parsed = JSON.parse(payload);
     if (!Array.isArray(parsed)) return [];
     return parsed.flatMap((entry) => {
-      if (typeof entry === "string") return [entry];
+      if (typeof entry === "string") return [{ id: entry }];
       if (!entry || typeof entry !== "object") return [];
-      if (typeof entry.name === "string") return [entry.name];
-      if (typeof entry.id === "string") return [entry.id];
-      return [];
+      const item = entry;
+      const id = typeof item.id === "string" ? item.id : typeof item.name === "string" ? item.name : void 0;
+      if (!id) return [];
+      return [{
+        id,
+        ...typeof item.scope === "string" ? { scope: item.scope } : {},
+        ...typeof item.version === "string" ? { version: item.version } : {}
+      }];
     });
   } catch {
     return [];
@@ -3600,11 +3928,30 @@ async function getClaudeInstallState(runner) {
   if (result.exitCode !== 0) {
     return { available: true, installed: false };
   }
+  const managedPluginId = `${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_MARKETPLACE_NAME}`;
+  const installation = extractClaudePluginInstallations(result.stdout).find(
+    (plugin) => plugin.id === managedPluginId && plugin.scope === "user"
+  );
   return {
     available: true,
-    installed: extractClaudePluginNames(result.stdout).includes(ORGX_CLAUDE_PLUGIN_NAME)
+    installed: Boolean(installation),
+    ...installation?.version ? { version: installation.version } : {}
   };
 }
+async function requireManagedClaudePluginVersion(runner, operation) {
+  const state = await getClaudeInstallState(runner);
+  if (!state.installed) {
+    throw new Error(
+      `Claude plugin ${operation} completed, but Claude Code does not report ${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_MARKETPLACE_NAME} as installed at user scope.`
+    );
+  }
+  if (state.version !== ORGX_CLAUDE_PLUGIN_VERSION) {
+    throw new Error(
+      `Claude plugin ${operation} completed, but Claude Code reports version ${state.version ?? "unknown"}; expected ${ORGX_CLAUDE_PLUGIN_VERSION}.`
+    );
+  }
+  return state;
+}
 async function getOpenclawInstallState(runner) {
   const available = detectSurface("openclaw").detected || await commandExists("openclaw", runner);
   if (!available) {
@@ -3620,17 +3967,17 @@ async function getOpenclawInstallState(runner) {
   };
 }
 function cursorPluginManifestPath(paths) {
-  return join3(paths.cursorPluginDir, ".cursor-plugin", "plugin.json");
+  return join4(paths.cursorPluginDir, ".cursor-plugin", "plugin.json");
 }
 function cursorPluginMcpPath(paths) {
-  return join3(paths.cursorPluginDir, ".mcp.json");
+  return join4(paths.cursorPluginDir, ".mcp.json");
 }
 function isCursorPluginInstalled(paths) {
   return existsSync4(cursorPluginManifestPath(paths)) && existsSync4(cursorPluginMcpPath(paths));
 }
 function getCursorToolingState(options = {}) {
   const paths = resolvePluginPaths(options.paths);
-  const mcpFile = options.mcpPath ?? CURSOR_MCP_PATH ?? join3(CURSOR_DIR, "mcp.json");
+  const mcpFile = options.mcpPath ?? CURSOR_MCP_PATH ?? join4(CURSOR_DIR, "mcp.json");
   const mcpText = readTextIfExists(mcpFile);
   const inspection = inspectCursorMcpConfig(mcpText);
   return {
@@ -3640,7 +3987,7 @@ function getCursorToolingState(options = {}) {
   };
 }
 function isCursorPluginAvailable(paths) {
-  return detectSurface("cursor").detected || existsSync4(paths.cursorPluginDir) || existsSync4(dirname3(paths.cursorPluginDir)) || readTextIfExists(paths.cursorRulePath) !== null;
+  return detectSurface("cursor").detected || existsSync4(paths.cursorPluginDir) || existsSync4(dirname4(paths.cursorPluginDir)) || readTextIfExists(paths.cursorRulePath) !== null;
 }
 function buildCursorStatus(paths) {
   const existingRules = readTextIfExists(paths.cursorRulePath);
@@ -3826,36 +4173,44 @@ async function installClaudePlugin(paths, fetchImpl, runner) {
     throw new Error(formatCommandFailure("claude", ["plugin", "marketplace", "add", paths.claudeMarketplaceDir], marketplaceAdd));
   }
   let installedChanged = false;
+  let updatedChanged = false;
   if (!state.installed) {
-    const install = await runner("claude", [
+    const installArgs = [
       "plugin",
       "install",
       `${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_MARKETPLACE_NAME}`,
       "--scope",
       "user"
-    ]);
+    ];
+    const install = await runner("claude", installArgs);
     if (install.exitCode !== 0) {
       throw new Error(
-        formatCommandFailure(
-          "claude",
-          [
-            "plugin",
-            "install",
-            `${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_MARKETPLACE_NAME}`,
-            "--scope",
-            "user"
-          ],
-          install
-        )
+        formatCommandFailure("claude", installArgs, install)
       );
     }
+    await requireManagedClaudePluginVersion(runner, "install");
     installedChanged = true;
+  } else {
+    const updateArgs = [
+      "plugin",
+      "update",
+      `${ORGX_CLAUDE_PLUGIN_NAME}@${ORGX_CLAUDE_MARKETPLACE_NAME}`,
+      "--scope",
+      "user"
+    ];
+    const update = await runner("claude", updateArgs);
+    if (update.exitCode !== 0) {
+      throw new Error(formatCommandFailure("claude", updateArgs, update));
+    }
+    await requireManagedClaudePluginVersion(runner, "update");
+    updatedChanged = state.version !== ORGX_CLAUDE_PLUGIN_VERSION;
   }
-  const changed = syncResult.changed || manifestChanged || installedChanged;
+  const changed = syncResult.changed || manifestChanged || installedChanged || updatedChanged;
+  const operationMessage = installedChanged ? `installed version ${ORGX_CLAUDE_PLUGIN_VERSION}` : updatedChanged ? `updated the Claude cache from ${state.version ?? "an older version"} to ${ORGX_CLAUDE_PLUGIN_VERSION}` : "confirmed the Claude cache is current";
   return {
     target: "claude",
     changed,
-    message: changed ? `Synced ${syncResult.fileCount} Claude plugin files and ensured the plugin is installed.` : "Claude Code plugin is already installed and up to date."
+    message: changed ? `Synced ${syncResult.fileCount} Claude plugin files and ${operationMessage}.` : `Claude Code plugin ${ORGX_CLAUDE_PLUGIN_VERSION} is already installed and up to date.`
   };
 }
 async function installCodexPlugin(paths, fetchImpl, runner) {
@@ -3894,10 +4249,10 @@ async function installOpenclawPlugin(fetchImpl, runner) {
   }
   const { tarballUrl, version } = await resolveOpenclawTarball(fetchImpl);
   const tarballBytes = await fetchRemoteBytes(tarballUrl, fetchImpl);
-  const tempRoot = mkdtempSync(join3(tmpdir(), "orgx-wizard-openclaw-"));
-  const archivePath = join3(tempRoot, `orgx-openclaw-plugin-${version}.tgz`);
+  const tempRoot = mkdtempSync2(join4(tmpdir(), "orgx-wizard-openclaw-"));
+  const archivePath = join4(tempRoot, `orgx-openclaw-plugin-${version}.tgz`);
   try {
-    writeFileSync2(archivePath, tarballBytes);
+    writeFileSync3(archivePath, tarballBytes);
     const install = await runner("openclaw", ["plugins", "install", archivePath]);
     if (install.exitCode !== 0) {
       throw new Error(
@@ -3905,7 +4260,7 @@ async function installOpenclawPlugin(fetchImpl, runner) {
       );
     }
   } finally {
-    rmSync(tempRoot, { force: true, recursive: true });
+    rmSync2(tempRoot, { force: true, recursive: true });
   }
   return {
     target: "openclaw",
@@ -4079,6 +4434,134 @@ function countPluginReportChanges(report) {
   return report.results.filter((result) => result.changed).length;
 }
 
+// src/surfaces/deepseek.ts
+import { spawnSync as spawnSync3 } from "child_process";
+var DEEPSEEK_HARNESS_VERSION = "0.1.0-rc.6";
+var DEEPSEEK_ORGX_PLUGIN = "@useorgx/deepseek-harness-plugin";
+var DEEPSEEK_ORGX_PLUGIN_VERSION = "0.1.0";
+var DEEPSEEK_PROFILE = "headless";
+var runDeepseekCommand = (command, args) => {
+  const result = spawnSync3(command, [...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    ...result.error ? { error: result.error } : {}
+  };
+};
+function normalizeVersionOutput(value) {
+  const normalized = value.trim();
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalized) ? normalized : void 0;
+}
+function inspectDeepseekRuntime(runner = runDeepseekCommand) {
+  const result = runner("dsh", ["--version"]);
+  const version = normalizeVersionOutput(result.stdout);
+  if (result.status !== 0 || !version) {
+    return {
+      installed: false,
+      supported: false,
+      details: [
+        result.error?.message ?? (result.stderr.trim() || "dsh --version did not return a version")
+      ]
+    };
+  }
+  const supported = version === DEEPSEEK_HARNESS_VERSION;
+  return {
+    installed: true,
+    supported,
+    version,
+    details: [
+      supported ? `DeepSeek Harness ${version} detected` : `DeepSeek Harness ${version} detected; OrgX currently requires ${DEEPSEEK_HARNESS_VERSION}`
+    ]
+  };
+}
+function readDependencyVersion(raw) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    for (const key of ["dependencies", "devDependencies", "optionalDependencies"]) {
+      const dependencies = parsed[key];
+      if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) {
+        continue;
+      }
+      const version = dependencies[DEEPSEEK_ORGX_PLUGIN];
+      if (typeof version === "string" && version.trim()) return version.trim();
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function inspectDeepseekPlugin(profileManifestPath) {
+  const version = readDependencyVersion(readTextIfExists(profileManifestPath));
+  return {
+    installed: Boolean(version),
+    ...version ? { version } : {},
+    details: [
+      version ? `${DEEPSEEK_ORGX_PLUGIN} ${version} is installed in the ${DEEPSEEK_PROFILE} profile` : `${DEEPSEEK_ORGX_PLUGIN} is not installed in the ${DEEPSEEK_PROFILE} profile`
+    ]
+  };
+}
+function installDeepseekPlugin(profileManifestPath, runner = runDeepseekCommand) {
+  const runtime = inspectDeepseekRuntime(runner);
+  if (!runtime.installed) {
+    return {
+      changed: false,
+      message: `DeepSeek Harness was not found. Install @deepseek-ai/dsh@${DEEPSEEK_HARNESS_VERSION}, then run setup again.`
+    };
+  }
+  if (!runtime.supported) {
+    return {
+      changed: false,
+      message: `DeepSeek Harness ${runtime.version ?? "unknown"} is not supported; OrgX requires ${DEEPSEEK_HARNESS_VERSION}.`
+    };
+  }
+  const before = inspectDeepseekPlugin(profileManifestPath);
+  if (before.installed && before.version === DEEPSEEK_ORGX_PLUGIN_VERSION) {
+    return {
+      changed: false,
+      message: `${DEEPSEEK_ORGX_PLUGIN}@${DEEPSEEK_ORGX_PLUGIN_VERSION} is already installed.`
+    };
+  }
+  const spec = `${DEEPSEEK_ORGX_PLUGIN}@${DEEPSEEK_ORGX_PLUGIN_VERSION}`;
+  const result = runner("dsh", ["plugin", "--profile", DEEPSEEK_PROFILE, "add", spec]);
+  if (result.status !== 0) {
+    const detail = result.stderr.trim() || result.error?.message || `exit ${result.status ?? "unknown"}`;
+    throw new Error(`Could not install ${spec}: ${detail}`);
+  }
+  return {
+    changed: true,
+    message: `${spec} installed in the ${DEEPSEEK_PROFILE} profile.`
+  };
+}
+function removeDeepseekPlugin(profileManifestPath, runner = runDeepseekCommand) {
+  if (!inspectDeepseekPlugin(profileManifestPath).installed) {
+    return {
+      changed: false,
+      message: `${DEEPSEEK_ORGX_PLUGIN} is not installed.`
+    };
+  }
+  const result = runner("dsh", [
+    "plugin",
+    "--profile",
+    DEEPSEEK_PROFILE,
+    "remove",
+    DEEPSEEK_ORGX_PLUGIN
+  ]);
+  if (result.status !== 0) {
+    const detail = result.stderr.trim() || result.error?.message || `exit ${result.status ?? "unknown"}`;
+    throw new Error(`Could not remove ${DEEPSEEK_ORGX_PLUGIN}: ${detail}`);
+  }
+  return {
+    changed: true,
+    message: `${DEEPSEEK_ORGX_PLUGIN} removed from the ${DEEPSEEK_PROFILE} profile.`
+  };
+}
+
 // src/surfaces/registry.ts
 var AUTH_SETUP_HINT = "orgx-wizard auth login";
 var AUTH_SET_KEY_HINT = "orgx-wizard auth set-key";
@@ -4113,6 +4596,19 @@ function automatedSurfaceStatus(name) {
   const detection = detectSurface(name);
   const path = detection.existingPath ?? detection.preferredPath;
   const openclaw = getOpenClawDependencyState();
+  if (name === "deepseek") {
+    const runtime = inspectDeepseekRuntime();
+    const plugin = path ? inspectDeepseekPlugin(path) : { installed: false, details: ["DeepSeek profile path is unavailable"] };
+    return {
+      name,
+      mode: "automated",
+      detected: detection.detected || runtime.installed,
+      configured: runtime.supported && plugin.installed,
+      ...path ? { path } : {},
+      details: [...runtime.details, ...plugin.details, ...detection.evidence],
+      summary: !runtime.installed ? "DeepSeek Harness was not detected." : !runtime.supported ? "DeepSeek Harness is installed, but the version is not supported by the OrgX plugin." : plugin.installed ? "OrgX is installed in the DeepSeek Harness headless profile." : "DeepSeek Harness is ready for the OrgX plugin."
+    };
+  }
   if (name === "claude") {
     const inspection2 = inspectClaudeMcpConfig(path ? readTextIfExists(path) : null);
     const configured = inspection2.hostedConfigured === true && (openclaw.detected ? inspection2.localConfigured === true : true);
@@ -4400,6 +4896,15 @@ async function addAutomatedSurface(name) {
         message: openclaw.detected ? "OrgX is connected in Codex with the local OpenClaw bridge." : "OrgX cloud MCP is connected in Codex."
       };
     }
+    case "deepseek": {
+      const result = installDeepseekPlugin(path);
+      return {
+        name,
+        changed: result.changed,
+        path,
+        message: result.message
+      };
+    }
     case "openclaw": {
       const previous = readTextIfExists(path);
       const auth = await resolveOrgxAuth();
@@ -4497,6 +5002,15 @@ function removeAutomatedSurface(name) {
         message: "OrgX connection was removed from Codex."
       };
     }
+    case "deepseek": {
+      const result = removeDeepseekPlugin(path);
+      return {
+        name,
+        changed: result.changed,
+        path,
+        message: result.message
+      };
+    }
     case "openclaw": {
       const previous = readTextIfExists(path);
       const next = removeOpenClawConfig(previous);
@@ -5230,8 +5744,8 @@ async function ensureOnboardingTask(workspace, options = {}) {
 
 // src/lib/local-skill-discovery.ts
 import { createHash as createHash3 } from "crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
-import { basename as basename2, join as join4, relative as relative2 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { basename as basename2, join as join5, relative } from "path";
 var DEFAULT_MAX_BYTES = 48e3;
 var DEFAULT_LIMIT = 12;
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", ".next", ".turbo", "build", "dist", "node_modules"]);
@@ -5249,26 +5763,26 @@ function hash(value, length = 10) {
 }
 function safeStat(path) {
   try {
-    return statSync3(path);
+    return statSync2(path);
   } catch {
     return null;
   }
 }
 function defaultRoots(input) {
   return {
-    agents: [join4(input.home, ".agents", "skills")],
-    claude: [join4(input.home, ".claude", "skills"), join4(input.cwd, ".claude", "skills")],
-    codex: [join4(input.home, ".codex", "skills"), join4(input.cwd, ".codex", "skills")],
+    agents: [join5(input.home, ".agents", "skills")],
+    claude: [join5(input.home, ".claude", "skills"), join5(input.cwd, ".claude", "skills")],
+    codex: [join5(input.home, ".codex", "skills"), join5(input.cwd, ".codex", "skills")],
     opencode: [
-      join4(input.home, ".opencode", "skills"),
-      join4(input.home, ".config", "opencode", "skills"),
-      join4(input.home, "Library", "Application Support", "opencode", "skills"),
-      join4(input.cwd, ".opencode", "skills")
+      join5(input.home, ".opencode", "skills"),
+      join5(input.home, ".config", "opencode", "skills"),
+      join5(input.home, "Library", "Application Support", "opencode", "skills"),
+      join5(input.cwd, ".opencode", "skills")
     ],
     workspace: [
-      join4(input.cwd, "skills"),
-      join4(input.cwd, ".agents", "skills"),
-      join4(input.cwd, ".orgx", "skills")
+      join5(input.cwd, "skills"),
+      join5(input.cwd, ".agents", "skills"),
+      join5(input.cwd, ".orgx", "skills")
     ]
   };
 }
@@ -5290,7 +5804,7 @@ function walkSkillFiles(root, maxFiles = 200) {
     }
     for (const entry of entries) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const path = join4(current, entry.name);
+      const path = join5(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(path);
       } else if (entry.isFile() && /\.(md|mdc|txt)$/i.test(entry.name)) {
@@ -5421,7 +5935,7 @@ function buildLocalSkillExtensionContent(candidates, context) {
       "",
       `## ${candidate.title}`,
       "",
-      `- Source: ${candidate.source} (${relative2(process.cwd(), candidate.path)})`,
+      `- Source: ${candidate.source} (${relative(process.cwd(), candidate.path)})`,
       `- Suggested agents: ${candidate.agentDomains.join(", ")}`,
       `- Preserve: ${candidate.snippet || "local workflow preference from this skill file."}`
     );
@@ -5697,7 +6211,7 @@ function initializeWizardSentry() {
   Sentry.init({
     dsn,
     environment: process.env.ORGX_SENTRY_ENVIRONMENT || "production",
-    release: "useorgx-wizard@0.1.52",
+    release: "useorgx-wizard@0.1.56",
     tracesSampleRate: sampleRate(process.env.ORGX_SENTRY_TRACES_SAMPLE_RATE),
     enableLogs: true,
     sendDefaultPii: false,
@@ -6415,8 +6929,8 @@ async function fetchOnboardingState(auth) {
 }
 
 // src/lib/ai-session-import.ts
-import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import { basename as basename3, join as join5, relative as relative3 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
+import { basename as basename3, join as join6, relative as relative2 } from "path";
 var AI_SESSION_SOURCES = ["codex", "claude"];
 var DEFAULT_LIMIT_PER_SOURCE = 3;
 var DEFAULT_SINCE_DAYS = 30;
@@ -6582,10 +7096,10 @@ function collectJsonlFiles(root, source) {
       continue;
     }
     for (const entry of entries) {
-      const path = join5(current, entry);
+      const path = join6(current, entry);
       let stats;
       try {
-        stats = statSync4(path);
+        stats = statSync3(path);
       } catch {
         continue;
       }
@@ -6603,7 +7117,7 @@ function collectJsonlFiles(root, source) {
 function readSessionImport(candidate, root, options) {
   let stats;
   try {
-    stats = statSync4(candidate.path);
+    stats = statSync3(candidate.path);
   } catch {
     return null;
   }
@@ -6621,7 +7135,7 @@ function readSessionImport(candidate, root, options) {
   }
   const deduped = [...new Set(relevantLines)].slice(0, 80);
   if (deduped.length === 0) return null;
-  const relativePath = relative3(root, candidate.path);
+  const relativePath = relative2(root, candidate.path);
   return {
     import: {
       sourceId: `${candidate.source}:${basename3(candidate.path, ".jsonl")}`,
@@ -6696,9 +7210,9 @@ function loadAiSessionImports(options) {
 // src/lib/work-graph-source-adapters.ts
 import { createHash as createHash4 } from "crypto";
 import { execFileSync } from "child_process";
-import { closeSync, existsSync as existsSync7, openSync, readFileSync as readFileSync5, readdirSync as readdirSync5, readSync, statSync as statSync5 } from "fs";
+import { closeSync, existsSync as existsSync7, openSync, readFileSync as readFileSync5, readdirSync as readdirSync5, readSync, statSync as statSync4 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename4, join as join6, resolve } from "path";
+import { basename as basename4, join as join7, resolve } from "path";
 var CLIENT_SOURCES = ["claude_code", "codex", "opencode", "goose", "cursor", "github", "slack"];
 var DEFAULT_LIMIT_PER_SOURCE2 = 8;
 var DEFAULT_SINCE_DAYS2 = 45;
@@ -6725,7 +7239,7 @@ function expandPath(path, env) {
 }
 function safeStat2(path) {
   try {
-    return statSync5(path);
+    return statSync4(path);
   } catch {
     return null;
   }
@@ -6746,7 +7260,7 @@ function walkFiles(root, predicate, maxFiles = 500) {
     }
     for (const entry of entries) {
       if (ignored.has(entry)) continue;
-      const path = join6(current, entry);
+      const path = join7(current, entry);
       const stats = safeStat2(path);
       if (!stats) continue;
       if (stats.isDirectory()) {
@@ -8078,11 +8592,138 @@ Rollback: ${plan.recommended_follow_up.rollback}`,
   );
 }
 
+// src/lib/operating-map.ts
+import { createHash as createHash6 } from "crypto";
+function parseResponseBody6(text2) {
+  if (!text2) return null;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+function formatHttpError5(status, body) {
+  if (typeof body === "string" && body.trim()) return `HTTP ${status}: ${body}`;
+  if (isRecord(body) && isRecord(body.error)) {
+    const code = typeof body.error.code === "string" ? body.error.code : "api_error";
+    const message = typeof body.error.message === "string" ? body.error.message : `HTTP ${status}`;
+    return `HTTP ${status} ${code}: ${message}`;
+  }
+  return `HTTP ${status}`;
+}
+function extractData(payload) {
+  return isRecord(payload) && "data" in payload ? payload.data : payload;
+}
+function parseDiscoveryResult(payload) {
+  const data = extractData(payload);
+  if (!isRecord(data) || !isRecord(data.run) || !Array.isArray(data.processCards)) {
+    throw new Error("OrgX returned an incomplete operating-map discovery payload.");
+  }
+  const run = data.run;
+  if (typeof run.id !== "string" || typeof run.mode !== "string" || typeof run.status !== "string") {
+    throw new Error("OrgX returned an invalid operating-map discovery run.");
+  }
+  return {
+    run: {
+      id: run.id,
+      mode: run.mode,
+      status: run.status,
+      query: typeof run.query === "string" ? run.query : null,
+      observationCount: typeof run.observationCount === "number" ? run.observationCount : 0,
+      candidateProcessCardCount: typeof run.candidateProcessCardCount === "number" ? run.candidateProcessCardCount : data.processCards.length,
+      citationCount: typeof run.citationCount === "number" ? run.citationCount : 0,
+      sourceHealth: Array.isArray(run.sourceHealth) ? run.sourceHealth : [],
+      limitations: Array.isArray(run.limitations) ? run.limitations.filter((item) => typeof item === "string") : []
+    },
+    observations: Array.isArray(data.observations) ? data.observations.filter(isRecord) : [],
+    processCards: data.processCards.filter(isRecord).map((card) => {
+      const ref = isRecord(card.processCandidateRef) ? card.processCandidateRef : {};
+      return {
+        processCandidateRef: {
+          id: typeof ref.id === "string" ? ref.id : "",
+          workspaceId: typeof ref.workspaceId === "string" ? ref.workspaceId : ""
+        },
+        displayName: typeof card.displayName === "string" ? card.displayName : "Unnamed workflow",
+        confidence: typeof card.confidence === "number" ? card.confidence : 0,
+        nextConfirmationQuestion: typeof card.nextConfirmationQuestion === "string" ? card.nextConfirmationQuestion : null,
+        candidateTrigger: isRecord(card.candidateTrigger) ? card.candidateTrigger : {},
+        handoffDelays: Array.isArray(card.handoffDelays) ? card.handoffDelays.filter(isRecord).map((handoff) => ({
+          from: typeof handoff.from === "string" ? handoff.from : "unknown",
+          to: typeof handoff.to === "string" ? handoff.to : "unknown",
+          delayMinutes: typeof handoff.delayMinutes === "number" ? handoff.delayMinutes : null
+        })) : [],
+        riskFlags: Array.isArray(card.riskFlags) ? card.riskFlags.filter((item) => typeof item === "string") : []
+      };
+    }),
+    confirmedProcessRefs: Array.isArray(data.confirmedProcessRefs) ? data.confirmedProcessRefs.filter(isRecord).flatMap(
+      (ref) => typeof ref.id === "string" && typeof ref.workspaceId === "string" ? [{ id: ref.id, workspaceId: ref.workspaceId }] : []
+    ) : []
+  };
+}
+async function requireOrgxAuth4(options = {}) {
+  const auth = await resolveOrgxAuth(options);
+  if (!auth) {
+    throw new Error("No OrgX API key configured. Run `wizard auth login` or set ORGX_API_KEY first.");
+  }
+  return auth;
+}
+function defaultOperatingMapIdempotencyKey(input) {
+  const digest = createHash6("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 32);
+  return `wizard:operating-map:${input.workspaceId}:${digest}`;
+}
+async function startOperatingMapDiscovery(input, options = {}) {
+  const auth = await requireOrgxAuth4(options);
+  const response = await fetchWithRetry(buildOrgxApiUrl("/v1/discovery-runs", auth.baseUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${auth.apiKey}`,
+      "Content-Type": "application/json",
+      "Idempotency-Key": input.idempotencyKey
+    },
+    body: JSON.stringify({
+      workspace_id: input.workspaceId,
+      mode: input.mode ?? "bounded_sync",
+      query: input.query ?? null,
+      source_kinds: input.sourceKinds ?? []
+    })
+  });
+  const body = parseResponseBody6(await response.text());
+  if (!response.ok) {
+    throw new Error(`Unable to start the operating-map discovery run. ${formatHttpError5(response.status, body)}`);
+  }
+  const result = parseDiscoveryResult(body);
+  const meta = isRecord(body) && isRecord(body.meta) ? body.meta : {};
+  return { result, duplicate: meta.duplicate === true };
+}
+async function proposeOperatingProcessFromMap(input, options = {}) {
+  const auth = await requireOrgxAuth4(options);
+  const response = await fetchWithRetry(
+    buildOrgxApiUrl(`/v1/discovery-runs/${encodeURIComponent(input.discoveryRunId)}/propose`, auth.baseUrl),
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${auth.apiKey}`,
+        "Content-Type": "application/json",
+        "Idempotency-Key": input.idempotencyKey
+      },
+      body: JSON.stringify({
+        workspace_id: input.workspaceId,
+        process_candidate_id: input.processCandidateId
+      })
+    }
+  );
+  const body = parseResponseBody6(await response.text());
+  if (!response.ok) {
+    throw new Error(`Unable to propose the OperatingProcess. ${formatHttpError5(response.status, body)}`);
+  }
+  return extractData(body);
+}
+
 // src/lib/work-graph.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 
 // src/lib/work-graph-investigation.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var WORK_GRAPH_INVESTIGATION_SCHEMA_VERSION = "2.0.0";
 var WORK_GRAPH_INVESTIGATION_CLIENTS = [
   "claude_code",
@@ -8215,7 +8856,7 @@ var CAPABILITY_CEILINGS = {
   }
 };
 function hash3(value, length = 16) {
-  return createHash6("sha256").update(JSON.stringify(value)).digest("hex").slice(0, length);
+  return createHash7("sha256").update(JSON.stringify(value)).digest("hex").slice(0, length);
 }
 function clamp(value, min = 0, max = 1) {
   return Math.max(min, Math.min(max, value));
@@ -9317,7 +9958,7 @@ function clampScore2(value) {
   return Math.max(0, Math.min(100, Math.round(value)));
 }
 function hashJson(value) {
-  return createHash7("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function normalizeFingerprintText(value) {
   return value.toLowerCase().replace(/https?:\/\/\S+/g, "url").replace(/[0-9a-f]{12,}/g, "hash").replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/g, "uuid").replace(/\s+/g, " ").trim().slice(0, 600);
@@ -12529,14 +13170,14 @@ function renderAqAgentBrief(report, links = {}) {
 }
 
 // src/lib/work-graph-publish.ts
-import { createHash as createHash8, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID2 } from "crypto";
 import { gzipSync } from "zlib";
 var WORK_GRAPH_REPORT_GZIP_THRESHOLD_BYTES = 4e6;
 var WORK_GRAPH_REPORT_CHUNK_UPLOAD_THRESHOLD_BYTES = 5e5;
 var WORK_GRAPH_REPORT_CHUNK_CHARS = 3e4;
 var WORK_GRAPH_REPORT_CHUNK_UPLOAD_TIMEOUT_MS = 3e5;
 function hashText(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function buildWorkGraphReportPostPayload(report, options = {}) {
   return {
@@ -12743,7 +13384,7 @@ async function publishWorkGraphEvents(fingerprint, patch, options = {}) {
 }
 
 // src/lib/work-graph-hook-events.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 var SOURCE_CLIENTS = [
   "codex",
@@ -12778,7 +13419,7 @@ function asStringArray(value) {
   return value.filter((item) => typeof item === "string" && item.trim().length > 0);
 }
 function stableHash(value) {
-  return createHash9("sha256").update(value).digest("hex").slice(0, 20);
+  return createHash10("sha256").update(value).digest("hex").slice(0, 20);
 }
 function normalizeSourceClient2(value) {
   const raw = asString2(value)?.toLowerCase();
@@ -12982,22 +13623,22 @@ function buildWorkGraphHookReplayPatch(readResult) {
 }
 
 // src/lib/runtime-hooks.ts
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3 } from "fs";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 var HOOK_MARKER = "orgx-session-hook.mjs";
 var EMIT_HOOK_MARKER = "orgx-emit-execution-graph.mjs";
 var HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PermissionRequest", "Stop"];
 var CLAUDE_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "SubagentStop", "Stop", "SessionEnd"];
 function defaultPaths(options = {}) {
-  const hookDir = join7(ORGX_WIZARD_CONFIG_HOME, "hooks");
+  const hookDir = join8(ORGX_WIZARD_CONFIG_HOME, "hooks");
   return {
-    claudeSettingsPath: options.claudeSettingsPath ?? join7(CLAUDE_DIR, "settings.json"),
-    codexConfigPath: options.codexConfigPath ?? CODEX_CONFIG_PATH ?? join7(CODEX_DIR, "config.toml"),
-    codexHooksPath: options.codexHooksPath ?? join7(CODEX_DIR, "hooks.json"),
-    hookScriptPath: options.hookScriptPath ?? join7(hookDir, HOOK_MARKER),
-    emitHookScriptPath: options.emitHookScriptPath ?? join7(hookDir, EMIT_HOOK_MARKER),
-    outboxPath: options.outboxPath ?? join7(hookDir, "events.jsonl")
+    claudeSettingsPath: options.claudeSettingsPath ?? join8(CLAUDE_DIR, "settings.json"),
+    codexConfigPath: options.codexConfigPath ?? CODEX_CONFIG_PATH ?? join8(CODEX_DIR, "config.toml"),
+    codexHooksPath: options.codexHooksPath ?? join8(CODEX_DIR, "hooks.json"),
+    hookScriptPath: options.hookScriptPath ?? join8(hookDir, HOOK_MARKER),
+    emitHookScriptPath: options.emitHookScriptPath ?? join8(hookDir, EMIT_HOOK_MARKER),
+    outboxPath: options.outboxPath ?? join8(hookDir, "events.jsonl")
   };
 }
 function countJsonlLines(path) {
@@ -13379,7 +14020,7 @@ function installRuntimeHooks(targets, options = {}) {
     hookScript: false,
     emitHookScript: false
   };
-  mkdirSync3(dirname4(paths.hookScriptPath), { recursive: true, mode: 448 });
+  mkdirSync4(dirname5(paths.hookScriptPath), { recursive: true, mode: 448 });
   const scriptContent = buildRuntimeHookScriptContent();
   if (readTextIfExists(paths.hookScriptPath) !== scriptContent) {
     const backup = backupExisting(paths.hookScriptPath, now);
@@ -13387,7 +14028,7 @@ function installRuntimeHooks(targets, options = {}) {
     writeTextFile(paths.hookScriptPath, scriptContent, { mode: 448 });
     changed.hookScript = true;
   }
-  mkdirSync3(dirname4(paths.emitHookScriptPath), { recursive: true, mode: 448 });
+  mkdirSync4(dirname5(paths.emitHookScriptPath), { recursive: true, mode: 448 });
   const emitScriptContent = buildExecutionGraphEmitScriptContent();
   if (readTextIfExists(paths.emitHookScriptPath) !== emitScriptContent) {
     const backup = backupExisting(paths.emitHookScriptPath, now);
@@ -14013,6 +14654,73 @@ async function requestWorkloadDiagnosis(input, options = {}) {
   return parsed.data;
 }
 
+// src/lib/deepseek-launcher.ts
+import { spawnSync as spawnSync4 } from "child_process";
+async function resolveFreshMcpAuth(deps) {
+  const authPath = deps.authPath ?? ORGX_WIZARD_AUTH_PATH;
+  const readAuth = deps.readAuth ?? readWizardAuth;
+  const stored = await readAuth(authPath);
+  if (!stored) {
+    throw new Error("OrgX is not paired. Run orgx-wizard auth login first.");
+  }
+  if (stored.source !== "pkce") return stored;
+  if (!stored.refreshToken || !stored.oauthClientId) {
+    throw new Error("OrgX browser authorization cannot be refreshed. Run orgx-wizard auth login again.");
+  }
+  const refresh = deps.refreshToken ?? refreshAccessToken;
+  let refreshed;
+  try {
+    refreshed = await refresh({
+      refreshToken: stored.refreshToken,
+      clientId: stored.oauthClientId
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`OrgX authorization refresh failed. Run orgx-wizard auth login again. ${detail}`);
+  }
+  const writeAuth = deps.writeAuth ?? writeWizardAuth;
+  return writeAuth(
+    {
+      apiKey: refreshed.access_token,
+      baseUrl: stored.baseUrl,
+      verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      source: "pkce",
+      refreshToken: refreshed.refresh_token ?? stored.refreshToken,
+      oauthClientId: stored.oauthClientId
+    },
+    authPath
+  );
+}
+async function launchDeepseekWithOrgx(prompt, deps = {}) {
+  if (prompt.length === 0 || prompt.every((part) => !part.trim())) {
+    throw new Error('Give DeepSeek a prompt, for example: orgx-wizard deepseek "What changed while I was away?"');
+  }
+  const runtime = inspectDeepseekRuntime(deps.runtimeRunner);
+  if (!runtime.installed) {
+    throw new Error("DeepSeek Harness was not found. Run orgx-wizard setup after installing DSH.");
+  }
+  if (!runtime.supported) {
+    throw new Error(`DeepSeek Harness ${runtime.version ?? "unknown"} is not supported by this OrgX plugin.`);
+  }
+  const auth = await resolveFreshMcpAuth(deps);
+  const childEnv = {
+    ...deps.env ?? process.env,
+    ORGX_MCP_ACCESS_TOKEN: auth.apiKey
+  };
+  delete childEnv.ORGX_API_KEY;
+  const spawn2 = deps.spawn ?? spawnSync4;
+  const result = spawn2(
+    "dsh",
+    ["--profile", DEEPSEEK_PROFILE, prompt.join(" ")],
+    {
+      env: childEnv,
+      stdio: "inherit"
+    }
+  );
+  if (result.error) throw result.error;
+  return { status: result.status ?? 1 };
+}
+
 // src/cli.ts
 var ICON = {
   ok: pc3.green("\u2713"),
@@ -14082,7 +14790,7 @@ function printSurfaceSummary(results) {
       `  ${ICON.skip}  ${pc3.dim("No supported AI tools detected on this machine.")}`
     );
     console.log(
-      `  ${pc3.dim("\u2192")}  ${pc3.dim("Install Claude, Cursor, Codex, VS Code, Windsurf, or Zed, then re-run setup.")}`
+      `  ${pc3.dim("\u2192")}  ${pc3.dim("Install Claude, Cursor, Codex, DeepSeek Harness, VS Code, Windsurf, or Zed, then re-run setup.")}`
     );
     return;
   }
@@ -14450,6 +15158,86 @@ async function runAuditCommand(options) {
     console.log(`  ${ICON.ok}  ${pc3.green("follow-up     ")} ${pc3.bold(followUp.title)} ${pc3.dim(followUp.id)}`);
   }
 }
+async function runOperatingMapCommand(queryParts, options) {
+  const auth = await resolveOrgxAuth();
+  if (!auth) {
+    throw new Error("Operating-map discovery requires OrgX auth. Run `wizard auth login` first.");
+  }
+  const workspace = options.workspaceId?.trim() ? { id: options.workspaceId.trim(), name: options.workspaceId.trim() } : await getCurrentWorkspace();
+  if (!workspace) {
+    throw new Error("No current OrgX workspace found. Run `wizard workspace create <name>` first.");
+  }
+  const query = queryParts.join(" ").trim() || null;
+  const mode = options.deepSearch ? "deep_search" : "bounded_sync";
+  const sourceKinds = (options.source ?? "").split(",").map((source) => source.trim()).filter(Boolean);
+  const idempotencyKey = options.idempotencyKey?.trim() || defaultOperatingMapIdempotencyKey({
+    workspaceId: workspace.id,
+    mode,
+    query,
+    sourceKinds
+  });
+  const spinner = createOrgxSpinner(mode === "deep_search" ? "Mapping workflows with cited deep search" : "Mapping observed workflows");
+  spinner.start();
+  const discovery = await startOperatingMapDiscovery({
+    workspaceId: workspace.id,
+    mode,
+    query,
+    sourceKinds,
+    idempotencyKey
+  });
+  spinner.succeed(discovery.duplicate ? "Replayed the existing operating-map discovery" : "Operating-map discovery complete");
+  const payload = {
+    workspaceId: workspace.id,
+    idempotencyKey,
+    duplicate: discovery.duplicate,
+    run: discovery.result.run,
+    processCards: discovery.result.processCards
+  };
+  if (options.json) {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(`  ${ICON.ok}  ${pc3.green("observations  ")} ${pc3.dim(String(discovery.result.run.observationCount))}`);
+    console.log(`  ${ICON.ok}  ${pc3.green("candidates    ")} ${pc3.dim(String(discovery.result.processCards.length))}`);
+    console.log(`  ${ICON.ok}  ${pc3.green("citations     ")} ${pc3.dim(String(discovery.result.run.citationCount))}`);
+    for (const [index, card] of discovery.result.processCards.entries()) {
+      console.log("");
+      console.log(`  ${pc3.bold(`${index + 1}. ${card.displayName}`)} ${pc3.dim(`${Math.round(card.confidence * 100)}% confidence \xB7 ${card.processCandidateRef.id}`)}`);
+      if (card.nextConfirmationQuestion) console.log(`     ${pc3.yellow("confirm:")} ${card.nextConfirmationQuestion}`);
+      if (card.riskFlags.length > 0) console.log(`     ${pc3.yellow("limits:")} ${card.riskFlags.join("; ")}`);
+    }
+    if (discovery.result.run.limitations.length > 0) {
+      console.log("");
+      console.log(`  ${pc3.yellow("limitations:")} ${discovery.result.run.limitations.join("; ")}`);
+    }
+  }
+  const candidate = options.candidate?.trim();
+  if (!candidate) return;
+  const selected = /^\d+$/.test(candidate) ? discovery.result.processCards[Number(candidate) - 1] : discovery.result.processCards.find((card) => card.processCandidateRef.id === candidate);
+  if (!selected?.processCandidateRef.id) {
+    throw new Error(`Process candidate ${candidate} was not found in discovery run ${discovery.result.run.id}.`);
+  }
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!options.yes) {
+    if (!interactive) throw new Error("Proposing an OperatingProcess requires --yes in non-interactive mode.");
+    const confirmed = await clack.confirm({
+      message: `Propose \u201C${selected.displayName}\u201D as an OperatingProcess (still requires human confirmation)?`,
+      initialValue: false
+    });
+    if (clack.isCancel(confirmed) || !confirmed) return;
+  }
+  const proposal = await proposeOperatingProcessFromMap({
+    workspaceId: workspace.id,
+    discoveryRunId: discovery.result.run.id,
+    processCandidateId: selected.processCandidateRef.id,
+    idempotencyKey: `wizard:operating-process:${discovery.result.run.id}:${selected.processCandidateRef.id}`
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ...payload, proposal }, null, 2));
+  } else {
+    console.log(`  ${ICON.ok}  ${pc3.green("proposal      ")} ${pc3.dim(selected.displayName)}`);
+    console.log(`  ${pc3.dim("Next step     ")} Review and confirm the OperatingProcess in OrgX; the wizard never auto-activates inferred workflow ownership.`);
+  }
+}
 function runWorkGraphExtractionSchemaCommand(options) {
   const protocol = buildWorkGraphExtractionProtocol();
   const outputPath = options.output?.trim() ? resolve3(options.output.trim()) : "";
@@ -14749,7 +15537,7 @@ function openPathInEditor(path) {
   if (!editor) {
     return false;
   }
-  const result = spawnSync3(editor, [path], {
+  const result = spawnSync5(editor, [path], {
     shell: true,
     stdio: "inherit"
   });
@@ -15567,14 +16355,20 @@ async function promptOptionalCompanionPluginTargets(input) {
   return selection;
 }
 function printPluginSkillOwnershipNote(targets) {
-  if (!targets.some((target) => target === "cursor" || target === "claude" || target === "codex")) {
-    return;
+  if (targets.includes("claude")) {
+    console.log(
+      `  ${ICON.skip}  ${pc3.dim(
+        "The Claude Code plugin carries static OrgX skills and commands plus a focused, non-destructive, closed-world OrgX status profile through native OAuth. It installs no runtime hooks or transcript/context sync code."
+      )}`
+    );
+  }
+  if (targets.some((target) => target === "cursor" || target === "codex")) {
+    console.log(
+      `  ${ICON.skip}  ${pc3.dim(
+        "Cursor and Codex companion plugins carry their own OrgX assets. Use 'wizard skills add' only for standalone rules or skills when those plugins are not in play."
+      )}`
+    );
   }
-  console.log(
-    `  ${ICON.skip}  ${pc3.dim(
-      "Cursor, Claude Code, and Codex companion plugins carry their own OrgX skills, rules, MCP config, commands, hooks, and agent prompts. Use 'wizard skills add' only for standalone rules or skills when those plugins are not in play."
-    )}`
-  );
 }
 async function installSelectedCompanionPlugins(input) {
   if (input.targets.length === 0) {
@@ -15732,7 +16526,7 @@ async function main() {
   initializeWizardSentry();
   const program = new Command();
   program.name("orgx-wizard").description("Add OrgX MCP configs, skills/rules, and companion plugins to your local AI tools.").showHelpAfterError();
-  const pkgVersion = true ? "0.1.52" : void 0;
+  const pkgVersion = true ? "0.1.56" : void 0;
   program.version(pkgVersion ?? "unknown", "-V, --version");
   program.hook("preAction", (_thisCommand, actionCommand) => {
     if (Boolean(actionCommand.optsWithGlobals().json)) return;
@@ -16035,6 +16829,10 @@ async function main() {
       }
     }
   });
+  program.command("deepseek").description("Run the pinned DeepSeek Harness profile with refreshed OrgX authorization.").argument("<prompt...>", "prompt to run in the DeepSeek Harness headless profile").action(async (prompt) => {
+    const result = await launchDeepseekWithOrgx(prompt);
+    if (result.status !== 0) process.exitCode = result.status;
+  });
   async function runPkceLogin(opts = {}) {
     const spinner = createOrgxSpinner("Starting OrgX OAuth login");
     spinner.start();
@@ -16449,6 +17247,15 @@ async function main() {
     });
     await runAuditCommand(options);
   });
+  program.command("map").alias("discovery").description("Map observed company workflows into evidence-gated OperatingProcess candidates.").argument("[query...]", "workflow, handoff, or system-of-record question for discovery/deep search").option("--deep-search", "query cited external research in addition to connected repository signals").option("--source <kinds>", "comma-separated source kinds to report and constrain (for example github,notion,slack)").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace").option("--candidate <id-or-number>", "propose one returned ProcessCard by id or 1-based display number").option("--idempotency-key <key>", "stable retry key; defaults to a hash of workspace, mode, query, and sources").option("--yes", "approve the explicit proposal in non-interactive mode").option("--json", "emit machine-readable discovery/proposal output").action(async (queryParts, options) => {
+    await safeTrackWizardTelemetry("operating_map_started", {
+      command: "map",
+      deep_search: Boolean(options.deepSearch),
+      has_candidate: Boolean(options.candidate),
+      json: Boolean(options.json)
+    });
+    await runOperatingMapCommand(queryParts, options);
+  });
   const workGraph = program.command("work-graph").description("Run AQ from real AI-work receipts and surface the first repair that raises execution capacity.");
   workGraph.command("extraction-schema").description("Print the packaged AI-client audit skill used to search sessions, messages, tools, domains, and logs.").option("--output <path>", "write the schema prompt to a file").option("--json", "emit the protocol as JSON instead of Markdown").action(async (options) => {
     await safeTrackWizardTelemetry("work_graph_extraction_schema_started", {
@@ -16757,4 +17564,4 @@ main().catch(async (error) => {
   process.exitCode = 1;
 });
 //# sourceMappingURL=cli.js.map
-//# debugId=edb4168b-4102-5109-afd1-34d3193fbf8c
+//# debugId=02842523-d681-5cea-96aa-0f0c896e9fb5