@wibeco/bridge 0.2.14 → 0.2.16

package/README.md

@@ -18,6 +18,11 @@ Dependency-light TypeScript foundations for normalizing agent hooks and sending
 Install and authorize Wibe from any GitHub repository:
 
 ```sh
+npx --yes --package @wibeco/bridge@latest wibe onboard \
+  --adapter cursor \
+  --url https://trywibe.com \
+  --repository <owner/repository>
+
 npx --yes --package @wibeco/bridge@latest wibe setup \
   --adapter cursor \
   --project <uuid> \

package/dist/{chunk-7LWUGOKM.js → chunk-E2RWE6UW.js}

@@ -27,7 +27,189 @@ import { homedir, hostname } from "os";
 import { basename, join, resolve } from "path";
 import { fileURLToPath } from "url";
 import { execFile } from "child_process";
+
+// src/onboard.ts
+import { z } from "zod";
+var sessionCreatedSchema = z.object({
+  session_id: z.string().uuid(),
+  session_secret: z.string().min(1),
+  authorization_url: z.string().url(),
+  expires_at: z.string()
+});
+var snapshotSchema = z.object({
+  status: z.enum(["pending_auth", "authenticated", "completed", "expired"]),
+  next: z.enum([
+    "authenticate",
+    "create_organization",
+    "install_github",
+    "create_project",
+    "connect_device",
+    "activate",
+    "done"
+  ]),
+  user_id: z.string().uuid().nullable(),
+  organization_id: z.string().uuid().nullable(),
+  project_id: z.string().uuid().nullable(),
+  github_connected: z.boolean(),
+  project_url: z.string().url().nullable(),
+  expires_at: z.string(),
+  access_token: z.string().min(1).optional()
+});
+var organizationSchema = z.object({
+  organization_id: z.string().uuid()
+});
+var githubInstallSchema = z.object({
+  github_connected: z.boolean(),
+  install_url: z.string().url().nullable()
+});
+var repositoriesSchema = z.object({
+  repositories: z.array(
+    z.object({
+      id: z.number().int(),
+      installationId: z.number().int(),
+      fullName: z.string(),
+      name: z.string()
+    })
+  )
+});
+var projectSchema = z.object({
+  project_id: z.string().uuid(),
+  reused: z.boolean().optional(),
+  setup_status: z.string().optional()
+});
+var invitesSchema = z.object({
+  invites: z.array(
+    z.object({
+      email: z.string().nullable().optional(),
+      url: z.string().url()
+    })
+  )
+});
+var deviceSchema = z.object({
+  accessToken: z.string().min(1),
+  projectId: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  repositoryId: z.string().uuid().optional(),
+  deviceId: z.string().uuid()
+});
+var activateSchema = z.object({
+  project_id: z.string().uuid(),
+  project_url: z.string().url()
+});
+function origin(appUrl) {
+  return appUrl.replace(/\/$/, "");
+}
+async function readJson(response) {
+  return await response.json().catch(() => ({}));
+}
+async function requestJson(url, schema, init) {
+  const response = await fetch(url, init);
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw new Error(
+      typeof body.error === "string" ? body.error : `Onboarding request failed (${response.status}).`
+    );
+  }
+  return schema.parse(body);
+}
+function authorized(accessToken) {
+  return {
+    authorization: `Bearer ${accessToken}`,
+    "content-type": "application/json"
+  };
+}
+async function createOnboardingSession(appUrl) {
+  return requestJson(
+    `${origin(appUrl)}/api/onboarding/sessions`,
+    sessionCreatedSchema,
+    { method: "POST" }
+  );
+}
+async function pollOnboardingSession(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/sessions/${input.sessionId}`,
+    snapshotSchema,
+    { headers: { "x-wibe-onboarding-secret": input.sessionSecret } }
+  );
+}
+async function createOnboardingOrganization(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/organization`,
+    organizationSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({ name: input.name })
+    }
+  );
+}
+async function requestGitHubInstall(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/github/install`,
+    githubInstallSchema,
+    { method: "POST", headers: authorized(input.accessToken) }
+  );
+}
+async function listOnboardingRepositories(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/github/repositories`,
+    repositoriesSchema,
+    { headers: authorized(input.accessToken) }
+  );
+}
+async function createOnboardingProject(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/project`,
+    projectSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({
+        projectName: input.projectName,
+        githubInstallationId: input.githubInstallationId,
+        providerRepositoryId: input.providerRepositoryId,
+        repository: input.repository
+      })
+    }
+  );
+}
+async function createOnboardingInvites(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/invites`,
+    invitesSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({ emails: input.emails })
+    }
+  );
+}
+async function mintOnboardingDevice(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/device`,
+    deviceSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({
+        deviceName: input.deviceName,
+        agentName: input.agentName
+      })
+    }
+  );
+}
+async function activateOnboardingProject(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/activate`,
+    activateSchema,
+    { method: "POST", headers: authorized(input.accessToken) }
+  );
+}
+
+// src/cli/commands.ts
 var ADAPTERS = ["cursor", "claude-code", "codex"];
+var WIBE_ACTIVITY_BEGIN = "<!-- BEGIN:wibe-activity -->";
+var WIBE_ACTIVITY_END = "<!-- END:wibe-activity -->";
 var MAX_SCREENSHOT_BYTES = 5 * 1024 * 1024;
 function screenshotMimeType(bytes) {
   if ([137, 80, 78, 71, 13, 10, 26, 10].every(
@@ -132,7 +314,7 @@ async function setupCommand(requestedAdapter, options = {}) {
     );
     return {
       exitCode: heartbeat2.error ? 1 : 0,
-      message: heartbeat2.error ? `Wibe is already authorized, but verification failed (${heartbeat2.error}). No new device was created. Retry with wibe doctor; if the token is rejected, rerun setup with --reauthorize.` : `Wibe was already authorized and the event connection was verified. Installed ${installedNativeFiles2.length} missing native config file(s); existing configs were left untouched.`
+      message: `${heartbeat2.error ? `Wibe is already authorized, but verification failed (${heartbeat2.error}). No new device was created. Retry with wibe doctor; if the token is rejected, rerun setup with --reauthorize.` : `Wibe was already authorized and the event connection was verified. Installed or refreshed ${installedNativeFiles2.length} native config file(s); unmanaged configuration was left untouched.`}${adapterSetupNextSteps(adapter)}`
     };
   }
   const authorization = await requestDeviceAuthorization({
@@ -218,9 +400,225 @@ Confirm code ${authorization.user_code}
   const heartbeat = await sendVerificationHeartbeat(credential, adapter, "setup");
   return {
     exitCode: heartbeat.error ? 1 : 0,
-    message: heartbeat.error ? `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched.` : `Connected ${adapter} to Wibe and verified the event connection. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched and reviewable templates are at ${destination}.`
+    message: `${heartbeat.error ? `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor. Installed or refreshed ${installedNativeFiles.length} native config file(s); unmanaged configuration was left untouched.` : `Connected ${adapter} to Wibe and verified the event connection. Installed or refreshed ${installedNativeFiles.length} native config file(s); unmanaged configuration was left untouched and reviewable templates are at ${destination}.`}${adapterSetupNextSteps(adapter)}`
+  };
+}
+function adapterSetupNextSteps(adapter) {
+  return adapter === "codex" ? "\nCodex next steps: trust this project when prompted, review and trust the Wibe command hooks in /hooks, then restart Codex so the project MCP server and activity instructions load." : "";
+}
+async function onboardCommand(requestedAdapter, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const expectedRepository = options.expectedRepository ? normalizeGitHubRepository(options.expectedRepository) : void 0;
+  if (options.expectedRepository && !expectedRepository) {
+    throw new Error(
+      `Expected repository "${options.expectedRepository}" is not a valid GitHub owner/repository.`
+    );
+  }
+  const detectedRepository = await detectRepository(cwd);
+  const repository = expectedRepository ?? (detectedRepository?.remote ? normalizeGitHubRepository(detectedRepository.remote) : void 0);
+  if (!repository) {
+    throw new Error(
+      "Could not detect a GitHub repository remote. Run this from a repository root or pass --repository owner/repo."
+    );
+  }
+  if (expectedRepository) {
+    await assertExpectedRepository(cwd, expectedRepository);
+  }
+  const adapter = await detectAdapter(requestedAdapter, cwd);
+  const source = await resolveTemplateSource(adapter);
+  const destination = join(cwd, ".wibe", "integrations", adapter);
+  if (!await exists(destination)) {
+    await mkdir(join(cwd, ".wibe", "integrations"), { recursive: true });
+    await cp(source, destination, { recursive: true, errorOnExist: true, force: false });
+  }
+  const appUrl = (options.appUrl ?? process.env.WIBE_APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
+  const created = options.sessionId && options.sessionSecret ? {
+    session_id: options.sessionId,
+    session_secret: options.sessionSecret,
+    authorization_url: `${appUrl}/onboard`,
+    expires_at: new Date(Date.now() + 30 * 60 * 1e3).toISOString()
+  } : await createOnboardingSession(appUrl);
+  let snapshot = await pollOnboardingSession({
+    appUrl,
+    sessionId: created.session_id,
+    sessionSecret: created.session_secret
+  });
+  if (snapshot.next === "authenticate") {
+    process.stdout.write(
+      `Open ${created.authorization_url}
+Approve GitHub sign-in in your browser, then return here.
+`
+    );
+    openBrowser(created.authorization_url);
+    snapshot = await waitForOnboarding(
+      appUrl,
+      created.session_id,
+      created.session_secret,
+      (current) => current.next !== "authenticate" && Boolean(current.access_token)
+    );
+  }
+  const accessToken = snapshot.access_token;
+  if (!accessToken) {
+    throw new Error("Wibe onboarding did not return an access token.");
+  }
+  if (snapshot.next === "create_organization" || !snapshot.organization_id) {
+    const orgName = options.orgName?.trim() || repository.split("/")[0] || "Organization";
+    await createOnboardingOrganization({
+      appUrl,
+      accessToken,
+      name: orgName
+    });
+    snapshot = await pollOnboardingSession({
+      appUrl,
+      sessionId: created.session_id,
+      sessionSecret: created.session_secret
+    });
+  }
+  if (snapshot.next === "install_github" || !snapshot.github_connected) {
+    const install = await requestGitHubInstall({ appUrl, accessToken });
+    if (!install.github_connected) {
+      if (!install.install_url) {
+        throw new Error("Wibe did not return a GitHub App install URL.");
+      }
+      process.stdout.write(
+        `Open ${install.install_url}
+Install the Wibe GitHub App on ${repository}, then return here.
+`
+      );
+      openBrowser(install.install_url);
+      snapshot = await waitForOnboarding(
+        appUrl,
+        created.session_id,
+        created.session_secret,
+        (current) => current.github_connected
+      );
+    }
+  }
+  const repositories = await listOnboardingRepositories({ appUrl, accessToken });
+  const matched = repositories.repositories.find(
+    (candidate) => normalizeGitHubRepository(candidate.fullName) === repository
+  );
+  if (!matched) {
+    throw new Error(
+      `GitHub App install does not include ${repository}. Install Wibe on that repository and retry.`
+    );
+  }
+  if (snapshot.next === "create_project" || !snapshot.project_id) {
+    await createOnboardingProject({
+      appUrl,
+      accessToken,
+      projectName: matched.name,
+      githubInstallationId: matched.installationId,
+      providerRepositoryId: matched.id,
+      repository: matched.fullName
+    });
+    snapshot = await pollOnboardingSession({
+      appUrl,
+      sessionId: created.session_id,
+      sessionSecret: created.session_secret
+    });
+  }
+  const inviteEmails = (options.invites ?? []).filter(Boolean);
+  const invites = await createOnboardingInvites({
+    appUrl,
+    accessToken,
+    emails: inviteEmails
+  });
+  if (!snapshot.project_id) {
+    throw new Error("Wibe onboarding did not create a project.");
+  }
+  const projectConfigPath = join(cwd, ".wibe", "project.json");
+  const existingProjectConfig = await readProjectConfig(projectConfigPath);
+  const existingCredential = existingProjectConfig ? await loadCredential(cwd) : null;
+  let credential = existingCredential;
+  if (!credential || credential.projectId !== snapshot.project_id || credential.appUrl.replace(/\/$/, "") !== appUrl) {
+    const minted = await mintOnboardingDevice({
+      appUrl,
+      accessToken,
+      deviceName: `${hostname()} (${adapter})`,
+      agentName: adapter
+    });
+    credential = {
+      appUrl,
+      accessToken: minted.accessToken,
+      projectId: minted.projectId,
+      organizationId: minted.organizationId,
+      repositoryId: minted.repositoryId,
+      deviceId: minted.deviceId
+    };
+    await new SystemCredentialStore().set(
+      "dev.wibe.bridge",
+      minted.projectId,
+      JSON.stringify(credential)
+    );
+    if (!existingProjectConfig) {
+      await mkdir(join(cwd, ".wibe"), { recursive: true });
+      await writeFile(
+        projectConfigPath,
+        `${JSON.stringify(
+          {
+            projectId: minted.projectId,
+            appUrl,
+            adapter,
+            repository
+          },
+          null,
+          2
+        )}
+`,
+        { mode: 384, flag: "wx" }
+      );
+    }
+  }
+  const installedNativeFiles = await installNativeConfigs(
+    adapter,
+    source,
+    cwd,
+    appUrl,
+    snapshot.project_id
+  );
+  const heartbeat = await sendVerificationHeartbeat(credential, adapter, "setup");
+  if (heartbeat.error) {
+    return {
+      exitCode: 1,
+      message: `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor.`
+    };
+  }
+  snapshot = await pollOnboardingSession({
+    appUrl,
+    sessionId: created.session_id,
+    sessionSecret: created.session_secret
+  });
+  let projectUrl = snapshot.project_url;
+  if (snapshot.next === "activate" || !projectUrl) {
+    const activated = await activateOnboardingProject({ appUrl, accessToken });
+    projectUrl = activated.project_url;
+  }
+  const inviteLines = invites.invites.map((invite) => invite.url).join("\n");
+  return {
+    exitCode: 0,
+    message: [
+      `Connected ${adapter} to Wibe and opened the project space.`,
+      projectUrl,
+      inviteLines ? `Invite links:
+${inviteLines}` : null,
+      `Installed ${installedNativeFiles.length} native config file(s); reviewable templates are at ${destination}.`
+    ].filter(Boolean).join("\n")
   };
 }
+async function waitForOnboarding(appUrl, sessionId, sessionSecret, ready) {
+  const deadline = Date.now() + 10 * 60 * 1e3;
+  let snapshot = await pollOnboardingSession({ appUrl, sessionId, sessionSecret });
+  while (Date.now() < deadline) {
+    if (ready(snapshot)) return snapshot;
+    if (snapshot.status === "expired") {
+      throw new Error("Onboarding expired. Restart wibe onboard.");
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 3e3));
+    snapshot = await pollOnboardingSession({ appUrl, sessionId, sessionSecret });
+  }
+  throw new Error("Timed out waiting for the browser step to finish.");
+}
 async function statusCommand(cwd = process.cwd()) {
   const repo = await detectRepository(cwd);
   const credential = await loadCredential(cwd);
@@ -488,7 +886,10 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
     adapterError = error instanceof Error ? error.message : String(error);
   }
   const heartbeat = credential && adapter && repositoryMatches ? await sendVerificationHeartbeat(credential, adapter, "doctor") : void 0;
-  const nativeConfig = adapter ? await validateNativeConfigs(adapter, cwd) : { hooks: false, mcp: false, activityRule: false };
+  const nativeConfig = adapter ? await validateNativeConfigs(adapter, cwd) : { hooks: false, mcp: false, activityRule: false, projectTrust: void 0 };
+  const trustNotes = adapter === "codex" && nativeConfig.projectTrust === void 0 ? [
+    "note  Codex project trust could not be verified because the user config was not found; trust this project in Codex and rerun doctor"
+  ] : [];
   const checks = [
     ["node", Number(process.versions.node.split(".")[0]) >= 20],
     ["git repository", Boolean(repository)],
@@ -508,6 +909,14 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
     ["agent hooks configuration", nativeConfig.hooks],
     ["MCP endpoint configuration", nativeConfig.mcp],
     ["agent activity instructions", nativeConfig.activityRule],
+    ...adapter === "codex" ? [
+      ...nativeConfig.projectTrust === void 0 ? [] : [
+        [
+          nativeConfig.projectTrust ? "Codex project trust" : "Codex project trust (trust this project in Codex, then review Wibe hooks in /hooks)",
+          nativeConfig.projectTrust
+        ]
+      ]
+    ] : [],
     [
       heartbeat?.error ? `verification heartbeat (${heartbeat.error})` : "verification heartbeat",
       Boolean(heartbeat && !heartbeat.error)
@@ -516,7 +925,10 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
   const failures = checks.filter(([, okay]) => !okay).length;
   return {
     exitCode: failures ? 1 : 0,
-    message: checks.map(([name, okay]) => `${okay ? "ok" : "missing"}  ${name}`).join("\n")
+    message: [
+      ...checks.map(([name, okay]) => `${okay ? "ok" : "missing"}  ${name}`),
+      ...trustNotes
+    ].join("\n")
   };
 }
 async function loadCredential(cwd) {
@@ -582,13 +994,57 @@ async function installNativeConfigs(adapter, source, cwd, appUrl, projectId) {
     await mkdir(resolve(destinationPath, ".."), { recursive: true });
     await writeFile(
       destinationPath,
-      template.replaceAll("${env:WIBE_APP_URL}", appUrl).replaceAll("${WIBE_APP_URL}", appUrl).replaceAll("${WIBE_PROJECT_ID}", projectId),
+      renderTemplate(template, appUrl, projectId),
       { mode: 384 }
     );
     installed.push(destinationName);
   }
+  if (adapter !== "cursor") {
+    const activityTemplate = renderTemplate(
+      await readFile(join(source, "wibe-activity.md.example"), "utf8"),
+      appUrl,
+      projectId
+    );
+    await installManagedActivitySection(join(cwd, "AGENTS.md"), activityTemplate);
+    installed.push("AGENTS.md");
+    if (adapter === "claude-code") {
+      const claudePath = join(cwd, "CLAUDE.md");
+      if (await ensureClaudeImportsAgents(claudePath)) {
+        installed.push("CLAUDE.md");
+      }
+    }
+  }
   return installed;
 }
+function renderTemplate(template, appUrl, projectId) {
+  return template.replaceAll("${env:WIBE_APP_URL}", appUrl).replaceAll("${WIBE_APP_URL}", appUrl).replaceAll("${WIBE_PROJECT_ID}", projectId);
+}
+async function installManagedActivitySection(path, template) {
+  const managedSection = template.trim();
+  const current = await exists(path) ? await readFile(path, "utf8") : "";
+  const beginIndex = current.indexOf(WIBE_ACTIVITY_BEGIN);
+  const endIndex = current.indexOf(WIBE_ACTIVITY_END);
+  const hasBegin = beginIndex >= 0;
+  const hasEnd = endIndex >= 0;
+  if (hasBegin !== hasEnd || hasBegin && endIndex < beginIndex) {
+    throw new Error(
+      `${path} contains incomplete Wibe activity markers. Restore or remove the managed section markers, then rerun setup.`
+    );
+  }
+  const next = hasBegin ? `${current.slice(0, beginIndex)}${managedSection}${current.slice(
+    endIndex + WIBE_ACTIVITY_END.length
+  )}` : `${current.trimEnd()}${current.trim() ? "\n\n" : ""}${managedSection}
+`;
+  await writeFile(path, next, { mode: 420 });
+}
+async function ensureClaudeImportsAgents(path) {
+  const current = await exists(path) ? await readFile(path, "utf8") : "";
+  if (/^\s*@AGENTS\.md\s*$/m.test(current)) return false;
+  const next = `${current.trimEnd()}${current.trim() ? "\n\n" : ""}@AGENTS.md
+`;
+  await writeFile(path, next, { mode: 420 });
+  return true;
+}
 function queuePath() {
   return process.env.WIBE_QUEUE_PATH ?? join(homedir(), ".wibe", "events.json");
 }
@@ -613,7 +1069,12 @@ async function validateNativeConfigs(adapter, cwd) {
     } catch {
       mcp = false;
     }
-    return { hooks, mcp, activityRule: true };
+    return {
+      hooks,
+      mcp,
+      activityRule: await validWibeActivityInstructions(join(cwd, "AGENTS.md")),
+      projectTrust: await codexProjectTrust(cwd)
+    };
   }
   const hookPath = adapter === "cursor" ? join(cwd, ".cursor", "hooks.json") : join(cwd, ".claude", "settings.json");
   const mcpPath = adapter === "cursor" ? join(cwd, ".cursor", "mcp.json") : join(cwd, ".mcp.json");
@@ -624,12 +1085,49 @@ async function validateNativeConfigs(adapter, cwd) {
       const wibe = value.mcpServers.wibe;
       return isRecord(wibe) && typeof wibe.url === "string" && wibe.url.replace(/\/$/, "").endsWith("/api/mcp");
     }),
-    activityRule: adapter !== "cursor" || await validText(
+    activityRule: adapter === "cursor" ? await validText(
       join(cwd, ".cursor", "rules", "wibe-activity.mdc"),
       (value) => value.includes("alwaysApply: true") && value.includes("wibe_share_progress") && value.includes("wibe share-progress")
-    )
+    ) : await validWibeActivityInstructions(join(cwd, "AGENTS.md")),
+    projectTrust: void 0
   };
 }
+function validWibeActivityInstructions(path) {
+  return validText(
+    path,
+    (value) => value.includes(WIBE_ACTIVITY_BEGIN) && value.includes(WIBE_ACTIVITY_END) && value.includes("wibe_share_progress") && value.includes("wibe share-progress")
+  );
+}
+async function codexProjectTrust(cwd) {
+  const codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex");
+  let config;
+  try {
+    config = await readFile(join(codexHome, "config.toml"), "utf8");
+  } catch {
+    return void 0;
+  }
+  let currentProject;
+  for (const rawLine of config.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    const section = line.match(
+      /^\[projects\.(?:"((?:\\.|[^"])*)"|'([^']*)')\]$/
+    );
+    if (section) {
+      try {
+        currentProject = resolve(
+          section[1] !== void 0 ? JSON.parse(`"${section[1]}"`) : section[2]
+        );
+      } catch {
+        currentProject = void 0;
+      }
+      continue;
+    }
+    if (currentProject === resolve(cwd) && /^trust_level\s*=\s*["']trusted["'](?:\s*#.*)?$/.test(line)) {
+      return true;
+    }
+  }
+  return false;
+}
 async function validText(path, predicate) {
   try {
     return predicate(await readFile(path, "utf8"));
@@ -787,6 +1285,7 @@ async function sendVerificationHeartbeat(credential, adapter, reason) {
 
 export {
   setupCommand,
+  onboardCommand,
   statusCommand,
   emitCommand,
   shareProgressCommand,

package/dist/cli.js

@@ -2,11 +2,12 @@
 import {
   doctorCommand,
   emitCommand,
+  onboardCommand,
   parseAdapter,
   setupCommand,
   shareProgressCommand,
   statusCommand
-} from "./chunk-7LWUGOKM.js";
+} from "./chunk-E2RWE6UW.js";
 import {
   runPresenceHeartbeat
 } from "./chunk-K7TK7FHF.js";
@@ -15,6 +16,9 @@ import {
 var HELP = `wibe-bridge <command>
 
 Commands:
+  onboard [--adapter <cursor|claude-code|codex>] [--url <wibe-url>] [--repository <owner/repo>] [--org-name <name>] [--invite <email>]
+        Creates a Wibe account session, organization, project, and local connection.
+        Prints browser URLs for GitHub sign-in and GitHub App install.
   setup --project <uuid> [--adapter <cursor|claude-code|codex>] [--url <wibe-url>] [--repository <owner/repo>] [--reauthorize]
         Auto-detects one adapter from the environment or repository config.
         Use --adapter when multiple agent configs are present.
@@ -26,7 +30,20 @@ Commands:
 async function main() {
   const [command, ...args] = process.argv.slice(2);
   let result;
-  if (command === "setup") {
+  if (command === "onboard") {
+    const adapterOption = option(args, "--adapter");
+    result = await onboardCommand(
+      adapterOption ? parseAdapter(adapterOption) : void 0,
+      {
+        appUrl: option(args, "--url"),
+        expectedRepository: option(args, "--repository"),
+        orgName: option(args, "--org-name"),
+        invites: options(args, "--invite"),
+        sessionId: option(args, "--session"),
+        sessionSecret: option(args, "--session-secret")
+      }
+    );
+  } else if (command === "setup") {
     const adapterOption = option(args, "--adapter");
     result = await setupCommand(adapterOption ? parseAdapter(adapterOption) : void 0, {
       projectId: option(args, "--project"),
@@ -79,6 +96,16 @@ function option(args, name) {
   const index = args.indexOf(name);
   return index >= 0 ? args[index + 1] : void 0;
 }
+function options(args, name) {
+  const values = [];
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name && args[index + 1]) {
+      values.push(args[index + 1]);
+      index += 1;
+    }
+  }
+  return values;
+}
 async function readJsonStdin() {
   if (process.stdin.isTTY) return {};
   const chunks = [];

package/dist/codex-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   emitCommand
-} from "./chunk-7LWUGOKM.js";
+} from "./chunk-E2RWE6UW.js";
 import "./chunk-K7TK7FHF.js";
 
 // src/codex-hook.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wibeco/bridge",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Privacy-first live activity bridge for Cursor, Claude Code, and Codex.",
   "repository": {
     "type": "git",

package/templates/claude-code/README.md

@@ -1,9 +1,10 @@
 # Claude Code template
 
-These files are inert examples. Review and merge `settings.json.example` into the appropriate
-Claude Code settings file. It uses command hooks because the local bridge must normalize and redact
-the payload before network delivery. Do not point an HTTP hook directly at a collector: Claude hook
-payloads can include prompts, tool inputs/results, and other raw content.
+These files are reviewable setup templates. `settings.json.example` configures command hooks,
+`mcp.json.example` configures MCP, and `wibe-activity.md.example` is installed as a managed section
+in the repository's `AGENTS.md`. Setup also ensures `CLAUDE.md` imports `AGENTS.md`. Do not point an
+HTTP hook directly at a collector: Claude hook payloads can include prompts, tool inputs/results,
+and other raw content.
 `SessionStart` owns a metadata-only heartbeat every 45 seconds until `SessionEnd`; `Stop` and tool
 hooks remain operational signals and are not published as presence.
 

package/templates/claude-code/wibe-activity.md.example

@@ -0,0 +1,15 @@
+<!-- BEGIN:wibe-activity -->
+## Wibe activity
+
+- This repository is connected to Wibe project `${WIBE_PROJECT_ID}`.
+- At the start of a task that will edit files, call `wibe_get_active_work` for this project. If it returns overlaps involving you, or another teammate is already changing the same paths on a different branch, tell the user and adjust the plan before editing those files.
+- If the set of files you plan to change shifts, call `wibe_get_active_work` or `wibe_check_overlap` again. Do not poll on every edit.
+- For most tasks, publish one update only after the requested outcome is complete. Do not publish plans, routine progress, or separate updates for editing, testing, committing, or pushing.
+- For text-only outcomes, use `wibe_share_progress` with phase `shipped` at completion. Publish earlier only with phase `blocked` when a material blocker leaves the task unfinished.
+- Write one self-contained paragraph of 20–55 words in past tense. Lead with what now works, then explain the user or team impact and meaningful validation. Mention important limitations when present.
+- Describe the outcome, not the agent’s process. Never include first-person narration, prompts, source code, secrets, raw commands, routine tool calls, filenames, line counts, praise, hype, or speculation; Wibe displays code and file changes separately.
+- When calling `wibe_share_progress`, also pass structured `paths`, `lines_added`, and `lines_deleted` for the local uncommitted diff so Wibe can display accurate file and line-change metadata. Prefer `git diff --numstat HEAD` totals rather than guessing.
+- This instruction is standing user authorization to publish the single completion update described here; do not ask for separate per-task approval.
+- If the MCP tool is unavailable, run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked>`.
+- Do not silently skip reporting. If both mechanisms fail, state `Wibe: update failed` and the reason in the final response. Report a Wibe update as sent only after the tool or CLI confirms success.
+<!-- END:wibe-activity -->

package/templates/codex/README.md

@@ -1,17 +1,16 @@
 # Codex template
 
-These are reviewable setup templates. `config.toml.example` configures Codex notifications and MCP;
-`hooks.json.example` provides lifecycle hooks where supported. Wibe installs native files only when
-the destination does not already exist. The bridge maps allow-listed fields in-process and queues or
-sends only canonical events. Prompt text, messages, tool data, command text, file content, and
-transcripts are not retained.
+These are reviewable setup templates. `config.toml.example` configures MCP,
+`hooks.json.example` provides lifecycle hooks, and `wibe-activity.md.example` is installed as a
+managed section in the repository's `AGENTS.md`. The bridge maps allow-listed fields in-process and
+queues or sends only canonical events. Prompt text, messages, tool data, command text, file content,
+and transcripts are not retained.
 
 Run `wibe setup` to authorize a revocable, project-scoped device token stored in the operating-system
 keychain. Hooks do not require repository signing secrets.
 
 The MCP block connects Codex to Wibe's remote `/api/mcp` endpoint. Codex completes OAuth separately
-from the bridge device token. Set `WIBE_APP_URL` to the same Wibe origin used during setup. Codex
-notification coverage can be narrower than Cursor or Claude Code lifecycle hooks.
-Codex appends one JSON notification argument to `wibe-codex-hook`; the bridge extracts only opaque
-`thread-id`/`turn-id` and approved model metadata. Where session hooks are available, they own a
-metadata-only 45-second heartbeat that ends cleanly with `SessionEnd`.
+from the bridge device token. Set `WIBE_APP_URL` to the same Wibe origin used during setup.
+Project-local Codex configuration loads only after the project is trusted, and command hooks must be
+reviewed in `/hooks`. Session hooks own a metadata-only 45-second heartbeat that ends cleanly with
+`SessionEnd`.

package/templates/codex/config.toml.example

@@ -1,6 +1,2 @@
-# Codex passes one JSON notification argument to this command. The adapter only keeps allow-listed
-# operational metadata and never forwards the full argument.
-notify = ["npx", "-y", "--package", "@wibeco/bridge@latest", "wibe-codex-hook"]
-
 [mcp_servers.wibe]
 url = "${WIBE_APP_URL}/api/mcp"

package/templates/codex/wibe-activity.md.example

@@ -0,0 +1,15 @@
+<!-- BEGIN:wibe-activity -->
+## Wibe activity
+
+- This repository is connected to Wibe project `${WIBE_PROJECT_ID}`.
+- At the start of a task that will edit files, call `wibe_get_active_work` for this project. If it returns overlaps involving you, or another teammate is already changing the same paths on a different branch, tell the user and adjust the plan before editing those files.
+- If the set of files you plan to change shifts, call `wibe_get_active_work` or `wibe_check_overlap` again. Do not poll on every edit.
+- For most tasks, publish one update only after the requested outcome is complete. Do not publish plans, routine progress, or separate updates for editing, testing, committing, or pushing.
+- For text-only outcomes, use `wibe_share_progress` with phase `shipped` at completion. Publish earlier only with phase `blocked` when a material blocker leaves the task unfinished.
+- Write one self-contained paragraph of 20–55 words in past tense. Lead with what now works, then explain the user or team impact and meaningful validation. Mention important limitations when present.
+- Describe the outcome, not the agent’s process. Never include first-person narration, prompts, source code, secrets, raw commands, routine tool calls, filenames, line counts, praise, hype, or speculation; Wibe displays code and file changes separately.
+- When calling `wibe_share_progress`, also pass structured `paths`, `lines_added`, and `lines_deleted` for the local uncommitted diff so Wibe can display accurate file and line-change metadata. Prefer `git diff --numstat HEAD` totals rather than guessing.
+- This instruction is standing user authorization to publish the single completion update described here; do not ask for separate per-task approval.
+- If the MCP tool is unavailable, run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked>`.
+- Do not silently skip reporting. If both mechanisms fail, state `Wibe: update failed` and the reason in the final response. Report a Wibe update as sent only after the tool or CLI confirms success.
+<!-- END:wibe-activity -->

package/templates/cursor/wibe-activity.mdc.example

@@ -6,12 +6,18 @@ alwaysApply: true
 # Wibe activity
 
 - This repository is connected to Wibe project `${WIBE_PROJECT_ID}`.
+- At the start of a task that will edit files, call `wibe_get_active_work` for this project. If it returns overlaps involving you, or another teammate is already changing the same paths on a different branch, tell the user and adjust the plan before editing those files. Use teammate summaries in the response to explain the conflict.
+- If the set of files you plan to change shifts, call `wibe_get_active_work` or `wibe_check_overlap` again. Do not poll on every edit. Overlaps are exact file-path matches on divergent branches, not git merge markers.
 - For most tasks, publish one update only after the requested outcome is complete. Do not publish plans, routine progress, or separate updates for editing, testing, committing, or pushing.
 - For text-only outcomes, use `wibe_share_progress` with phase `shipped` at completion. Publish earlier only with phase `blocked` when a material blocker leaves the task unfinished.
 - Write one self-contained paragraph of 20–55 words in past tense. Lead with what now works, then explain the user or team impact and meaningful validation. Mention important limitations when present.
 - Describe the outcome, not the agent’s process. Never include first-person narration, prompts, source code, secrets, raw commands, routine tool calls, filenames, line counts, praise, hype, or speculation; Wibe displays code and file changes separately.
+- When calling `wibe_share_progress`, also pass structured `paths`, `lines_added`, and `lines_deleted` for the local uncommitted diff so Wibe can display accurate file and line-change metadata. Prefer `git diff --numstat HEAD` totals rather than guessing.
 - Bias frontend outcomes toward visual evidence without asking for per-task approval. For UI components, pages, styling, responsive behavior, interactions, and visual fixes, attach one screenshot when the app or preview is already runnable. Prefer a screenshot already made during visual QA; otherwise capture the clearest final state.
 - Frame screenshots around the feature, not the whole application. Use the browser snapshot to identify the smallest element that contains the changed component and the context needed to understand it, then call `browser_take_screenshot` with that element’s `ref` and a descriptive `element` name. Include the trigger with an open menu, popover, or dialog when practical. Use viewport or full-page screenshots only for page-wide work, and reject captures dominated by blank space.
 - Skip screenshots for backend, infrastructure, documentation, refactors, and non-visual frontend logic. Never launch or repair an app solely for Wibe, and omit the image when navigation needs manual authentication, the state contains sensitive data, visual validation is blocked, or the project has visual updates disabled.
-- When a screenshot is available, do not call `wibe_share_progress`. Instead run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked> --screenshot "<path>"` so the local bridge uploads the image and publishes the outcome together.
-- If the Wibe MCP tool is unavailable, run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked>`.
+- This rule is standing user authorization to publish the single completion update described here; do not ask for separate per-task approval.
+- When a screenshot is available, first run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked> --screenshot "<path>"` so the local bridge uploads the image and publishes the outcome together.
+- Screenshot delivery is best-effort, but the text update is required. If Auto-review blocks the screenshot publish, immediately retry the exact same command with the tool's native approval option so Cursor shows the user an approval card. Do not silently omit the screenshot before offering that choice.
+- If the user declines, the approved retry fails, or screenshot delivery otherwise remains unavailable, omit the screenshot and publish the same summary through `wibe_share_progress`. If that tool is unavailable, run `npx --yes --package @wibeco/bridge@latest wibe share-progress --summary "<summary>" --phase <shipped|blocked>`.
+- If a text-only publish is also held by an approval or safety check, retry it with the native approval mechanism instead of silently skipping it. Report a Wibe update as sent only after the tool or CLI confirms success.