@wibeco/bridge 0.2.15 → 0.2.17

package/dist/{chunk-7LWUGOKM.js → chunk-YLC4TF4F.js}

@@ -19,15 +19,206 @@ import {
   startPresenceSession,
   stopPresenceSession,
   updatePresenceSession
-} from "./chunk-K7TK7FHF.js";
+} from "./chunk-4WIGVKDR.js";
 
 // src/cli/commands.ts
-import { access, cp, mkdir, readFile, writeFile } from "fs/promises";
+import { createHash } from "crypto";
+import { realpathSync } from "fs";
+import {
+  access,
+  cp,
+  mkdir,
+  readFile,
+  rename,
+  writeFile
+} from "fs/promises";
 import { homedir, hostname } from "os";
-import { basename, join, resolve } from "path";
+import { basename, extname, join, resolve } from "path";
 import { fileURLToPath } from "url";
 import { execFile } from "child_process";
+
+// src/onboard.ts
+import { z } from "zod";
+var sessionCreatedSchema = z.object({
+  session_id: z.string().uuid(),
+  session_secret: z.string().min(1),
+  authorization_url: z.string().url(),
+  expires_at: z.string()
+});
+var snapshotSchema = z.object({
+  status: z.enum(["pending_auth", "authenticated", "completed", "expired"]),
+  next: z.enum([
+    "authenticate",
+    "create_organization",
+    "install_github",
+    "create_project",
+    "connect_device",
+    "activate",
+    "done"
+  ]),
+  user_id: z.string().uuid().nullable(),
+  organization_id: z.string().uuid().nullable(),
+  project_id: z.string().uuid().nullable(),
+  github_connected: z.boolean(),
+  project_url: z.string().url().nullable(),
+  expires_at: z.string(),
+  access_token: z.string().min(1).optional()
+});
+var organizationSchema = z.object({
+  organization_id: z.string().uuid()
+});
+var githubInstallSchema = z.object({
+  github_connected: z.boolean(),
+  install_url: z.string().url().nullable()
+});
+var repositoriesSchema = z.object({
+  repositories: z.array(
+    z.object({
+      id: z.number().int(),
+      installationId: z.number().int(),
+      fullName: z.string(),
+      name: z.string()
+    })
+  )
+});
+var projectSchema = z.object({
+  project_id: z.string().uuid(),
+  reused: z.boolean().optional(),
+  setup_status: z.string().optional()
+});
+var invitesSchema = z.object({
+  invites: z.array(
+    z.object({
+      email: z.string().nullable().optional(),
+      url: z.string().url()
+    })
+  )
+});
+var deviceSchema = z.object({
+  accessToken: z.string().min(1),
+  projectId: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  repositoryId: z.string().uuid().optional(),
+  deviceId: z.string().uuid()
+});
+var activateSchema = z.object({
+  project_id: z.string().uuid(),
+  project_url: z.string().url()
+});
+function origin(appUrl) {
+  return appUrl.replace(/\/$/, "");
+}
+async function readJson(response) {
+  return await response.json().catch(() => ({}));
+}
+async function requestJson(url, schema, init) {
+  const response = await fetch(url, init);
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw new Error(
+      typeof body.error === "string" ? body.error : `Onboarding request failed (${response.status}).`
+    );
+  }
+  return schema.parse(body);
+}
+function authorized(accessToken) {
+  return {
+    authorization: `Bearer ${accessToken}`,
+    "content-type": "application/json"
+  };
+}
+async function createOnboardingSession(appUrl) {
+  return requestJson(
+    `${origin(appUrl)}/api/onboarding/sessions`,
+    sessionCreatedSchema,
+    { method: "POST" }
+  );
+}
+async function pollOnboardingSession(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/sessions/${input.sessionId}`,
+    snapshotSchema,
+    { headers: { "x-wibe-onboarding-secret": input.sessionSecret } }
+  );
+}
+async function createOnboardingOrganization(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/organization`,
+    organizationSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({ name: input.name })
+    }
+  );
+}
+async function requestGitHubInstall(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/github/install`,
+    githubInstallSchema,
+    { method: "POST", headers: authorized(input.accessToken) }
+  );
+}
+async function listOnboardingRepositories(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/github/repositories`,
+    repositoriesSchema,
+    { headers: authorized(input.accessToken) }
+  );
+}
+async function createOnboardingProject(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/project`,
+    projectSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({
+        projectName: input.projectName,
+        githubInstallationId: input.githubInstallationId,
+        providerRepositoryId: input.providerRepositoryId,
+        repository: input.repository
+      })
+    }
+  );
+}
+async function createOnboardingInvites(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/invites`,
+    invitesSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({ emails: input.emails })
+    }
+  );
+}
+async function mintOnboardingDevice(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/device`,
+    deviceSchema,
+    {
+      method: "POST",
+      headers: authorized(input.accessToken),
+      body: JSON.stringify({
+        deviceName: input.deviceName,
+        agentName: input.agentName
+      })
+    }
+  );
+}
+async function activateOnboardingProject(input) {
+  return requestJson(
+    `${origin(input.appUrl)}/api/onboarding/activate`,
+    activateSchema,
+    { method: "POST", headers: authorized(input.accessToken) }
+  );
+}
+
+// src/cli/commands.ts
 var ADAPTERS = ["cursor", "claude-code", "codex"];
+var WIBE_ACTIVITY_BEGIN = "<!-- BEGIN:wibe-activity -->";
+var WIBE_ACTIVITY_END = "<!-- END:wibe-activity -->";
 var MAX_SCREENSHOT_BYTES = 5 * 1024 * 1024;
 function screenshotMimeType(bytes) {
   if ([137, 80, 78, 71, 13, 10, 26, 10].every(
@@ -125,14 +316,16 @@ async function setupCommand(requestedAdapter, options = {}) {
       appUrl,
       options.projectId
     );
+    await adoptPendingQueue(cwd, options.projectId);
     const heartbeat2 = await sendVerificationHeartbeat(
       existingCredential,
       adapter,
-      "setup"
+      "setup",
+      cwd
     );
     return {
       exitCode: heartbeat2.error ? 1 : 0,
-      message: heartbeat2.error ? `Wibe is already authorized, but verification failed (${heartbeat2.error}). No new device was created. Retry with wibe doctor; if the token is rejected, rerun setup with --reauthorize.` : `Wibe was already authorized and the event connection was verified. Installed ${installedNativeFiles2.length} missing native config file(s); existing configs were left untouched.`
+      message: `${heartbeat2.error ? `Wibe is already authorized, but verification failed (${heartbeat2.error}). No new device was created. Retry with wibe doctor; if the token is rejected, rerun setup with --reauthorize.` : `Wibe was already authorized and the event connection was verified. Installed or refreshed ${installedNativeFiles2.length} native config file(s); unmanaged configuration was left untouched.`}${adapterSetupNextSteps(adapter)}`
     };
   }
   const authorization = await requestDeviceAuthorization({
@@ -215,16 +408,246 @@ Confirm code ${authorization.user_code}
     appUrl,
     token.projectId
   );
-  const heartbeat = await sendVerificationHeartbeat(credential, adapter, "setup");
+  await adoptPendingQueue(cwd, token.projectId);
+  const heartbeat = await sendVerificationHeartbeat(
+    credential,
+    adapter,
+    "setup",
+    cwd
+  );
   return {
     exitCode: heartbeat.error ? 1 : 0,
-    message: heartbeat.error ? `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched.` : `Connected ${adapter} to Wibe and verified the event connection. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched and reviewable templates are at ${destination}.`
+    message: `${heartbeat.error ? `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor. Installed or refreshed ${installedNativeFiles.length} native config file(s); unmanaged configuration was left untouched.` : `Connected ${adapter} to Wibe and verified the event connection. Installed or refreshed ${installedNativeFiles.length} native config file(s); unmanaged configuration was left untouched and reviewable templates are at ${destination}.`}${adapterSetupNextSteps(adapter)}`
   };
 }
+function adapterSetupNextSteps(adapter) {
+  return adapter === "codex" ? "\nCodex next steps: trust this project when prompted, review and trust the Wibe command hooks in /hooks, then restart Codex so the project MCP server and activity instructions load." : "";
+}
+async function onboardCommand(requestedAdapter, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const expectedRepository = options.expectedRepository ? normalizeGitHubRepository(options.expectedRepository) : void 0;
+  if (options.expectedRepository && !expectedRepository) {
+    throw new Error(
+      `Expected repository "${options.expectedRepository}" is not a valid GitHub owner/repository.`
+    );
+  }
+  const detectedRepository = await detectRepository(cwd);
+  const repository = expectedRepository ?? (detectedRepository?.remote ? normalizeGitHubRepository(detectedRepository.remote) : void 0);
+  if (!repository) {
+    throw new Error(
+      "Could not detect a GitHub repository remote. Run this from a repository root or pass --repository owner/repo."
+    );
+  }
+  if (expectedRepository) {
+    await assertExpectedRepository(cwd, expectedRepository);
+  }
+  const adapter = await detectAdapter(requestedAdapter, cwd);
+  const source = await resolveTemplateSource(adapter);
+  const destination = join(cwd, ".wibe", "integrations", adapter);
+  if (!await exists(destination)) {
+    await mkdir(join(cwd, ".wibe", "integrations"), { recursive: true });
+    await cp(source, destination, { recursive: true, errorOnExist: true, force: false });
+  }
+  const appUrl = (options.appUrl ?? process.env.WIBE_APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
+  const created = options.sessionId && options.sessionSecret ? {
+    session_id: options.sessionId,
+    session_secret: options.sessionSecret,
+    authorization_url: `${appUrl}/onboard`,
+    expires_at: new Date(Date.now() + 30 * 60 * 1e3).toISOString()
+  } : await createOnboardingSession(appUrl);
+  let snapshot = await pollOnboardingSession({
+    appUrl,
+    sessionId: created.session_id,
+    sessionSecret: created.session_secret
+  });
+  if (snapshot.next === "authenticate") {
+    process.stdout.write(
+      `Open ${created.authorization_url}
+Approve GitHub sign-in in your browser, then return here.
+`
+    );
+    openBrowser(created.authorization_url);
+    snapshot = await waitForOnboarding(
+      appUrl,
+      created.session_id,
+      created.session_secret,
+      (current) => current.next !== "authenticate" && Boolean(current.access_token)
+    );
+  }
+  const accessToken = snapshot.access_token;
+  if (!accessToken) {
+    throw new Error("Wibe onboarding did not return an access token.");
+  }
+  if (snapshot.next === "create_organization" || !snapshot.organization_id) {
+    const orgName = options.orgName?.trim() || repository.split("/")[0] || "Organization";
+    await createOnboardingOrganization({
+      appUrl,
+      accessToken,
+      name: orgName
+    });
+    snapshot = await pollOnboardingSession({
+      appUrl,
+      sessionId: created.session_id,
+      sessionSecret: created.session_secret
+    });
+  }
+  if (snapshot.next === "install_github" || !snapshot.github_connected) {
+    const install = await requestGitHubInstall({ appUrl, accessToken });
+    if (!install.github_connected) {
+      if (!install.install_url) {
+        throw new Error("Wibe did not return a GitHub App install URL.");
+      }
+      process.stdout.write(
+        `Open ${install.install_url}
+Install the Wibe GitHub App on ${repository}, then return here.
+`
+      );
+      openBrowser(install.install_url);
+      snapshot = await waitForOnboarding(
+        appUrl,
+        created.session_id,
+        created.session_secret,
+        (current) => current.github_connected
+      );
+    }
+  }
+  const repositories = await listOnboardingRepositories({ appUrl, accessToken });
+  const matched = repositories.repositories.find(
+    (candidate) => normalizeGitHubRepository(candidate.fullName) === repository
+  );
+  if (!matched) {
+    throw new Error(
+      `GitHub App install does not include ${repository}. Install Wibe on that repository and retry.`
+    );
+  }
+  if (snapshot.next === "create_project" || !snapshot.project_id) {
+    await createOnboardingProject({
+      appUrl,
+      accessToken,
+      projectName: matched.name,
+      githubInstallationId: matched.installationId,
+      providerRepositoryId: matched.id,
+      repository: matched.fullName
+    });
+    snapshot = await pollOnboardingSession({
+      appUrl,
+      sessionId: created.session_id,
+      sessionSecret: created.session_secret
+    });
+  }
+  const inviteEmails = (options.invites ?? []).filter(Boolean);
+  const invites = await createOnboardingInvites({
+    appUrl,
+    accessToken,
+    emails: inviteEmails
+  });
+  if (!snapshot.project_id) {
+    throw new Error("Wibe onboarding did not create a project.");
+  }
+  const projectConfigPath = join(cwd, ".wibe", "project.json");
+  const existingProjectConfig = await readProjectConfig(projectConfigPath);
+  const existingCredential = existingProjectConfig ? await loadCredential(cwd) : null;
+  let credential = existingCredential;
+  if (!credential || credential.projectId !== snapshot.project_id || credential.appUrl.replace(/\/$/, "") !== appUrl) {
+    const minted = await mintOnboardingDevice({
+      appUrl,
+      accessToken,
+      deviceName: `${hostname()} (${adapter})`,
+      agentName: adapter
+    });
+    credential = {
+      appUrl,
+      accessToken: minted.accessToken,
+      projectId: minted.projectId,
+      organizationId: minted.organizationId,
+      repositoryId: minted.repositoryId,
+      deviceId: minted.deviceId
+    };
+    await new SystemCredentialStore().set(
+      "dev.wibe.bridge",
+      minted.projectId,
+      JSON.stringify(credential)
+    );
+    if (!existingProjectConfig) {
+      await mkdir(join(cwd, ".wibe"), { recursive: true });
+      await writeFile(
+        projectConfigPath,
+        `${JSON.stringify(
+          {
+            projectId: minted.projectId,
+            appUrl,
+            adapter,
+            repository
+          },
+          null,
+          2
+        )}
+`,
+        { mode: 384, flag: "wx" }
+      );
+    }
+  }
+  const installedNativeFiles = await installNativeConfigs(
+    adapter,
+    source,
+    cwd,
+    appUrl,
+    snapshot.project_id
+  );
+  await adoptPendingQueue(cwd, snapshot.project_id);
+  const heartbeat = await sendVerificationHeartbeat(
+    credential,
+    adapter,
+    "setup",
+    cwd
+  );
+  if (heartbeat.error) {
+    return {
+      exitCode: 1,
+      message: `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor.`
+    };
+  }
+  snapshot = await pollOnboardingSession({
+    appUrl,
+    sessionId: created.session_id,
+    sessionSecret: created.session_secret
+  });
+  let projectUrl = snapshot.project_url;
+  if (snapshot.next === "activate" || !projectUrl) {
+    const activated = await activateOnboardingProject({ appUrl, accessToken });
+    projectUrl = activated.project_url;
+  }
+  const inviteLines = invites.invites.map((invite) => invite.url).join("\n");
+  return {
+    exitCode: 0,
+    message: [
+      `Connected ${adapter} to Wibe and opened the project space.`,
+      projectUrl,
+      inviteLines ? `Invite links:
+${inviteLines}` : null,
+      `Installed ${installedNativeFiles.length} native config file(s); reviewable templates are at ${destination}.`
+    ].filter(Boolean).join("\n")
+  };
+}
+async function waitForOnboarding(appUrl, sessionId, sessionSecret, ready) {
+  const deadline = Date.now() + 10 * 60 * 1e3;
+  let snapshot = await pollOnboardingSession({ appUrl, sessionId, sessionSecret });
+  while (Date.now() < deadline) {
+    if (ready(snapshot)) return snapshot;
+    if (snapshot.status === "expired") {
+      throw new Error("Onboarding expired. Restart wibe onboard.");
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 3e3));
+    snapshot = await pollOnboardingSession({ appUrl, sessionId, sessionSecret });
+  }
+  throw new Error("Timed out waiting for the browser step to finish.");
+}
 async function statusCommand(cwd = process.cwd()) {
+  const legacyQueue = await quarantineLegacyQueue();
   const repo = await detectRepository(cwd);
   const credential = await loadCredential(cwd);
-  const queue = queuePath();
+  const queue = credential ? projectQueuePath(credential.projectId) : pendingQueuePath(repo?.root ?? cwd);
+  const queueBacklog = await new JsonFileOfflineQueue(queue).size();
   const installed = (await Promise.all(
     ADAPTERS.map(async (adapter) => ({
       adapter,
@@ -240,7 +663,9 @@ async function statusCommand(cwd = process.cwd()) {
         connected: Boolean(credential),
         projectId: credential?.projectId ?? null,
         eventEndpoint: credential ? `${credential.appUrl}/api/events/batch` : null,
-        offlineQueue: queue
+        offlineQueue: queue,
+        offlineQueueBacklog: queueBacklog,
+        legacyQueue: legacyQueue.pending ? legacyQueue.quarantined : null
       },
       null,
       2
@@ -359,8 +784,11 @@ async function emitCommand(adapter, eventName, input) {
   const publishableEvents = [event, ...repositoryEvents].filter(
     (candidate) => eventTypeForHook(candidate)
   );
-  const queue = new JsonFileOfflineQueue(queuePath());
   const credential = await loadCredential(process.cwd());
+  await quarantineLegacyQueue();
+  const queue = new JsonFileOfflineQueue(
+    credential ? projectQueuePath(credential.projectId) : pendingQueuePath(repo?.root ?? process.cwd())
+  );
   if (!credential) {
     if (publishableEvents.length) await queue.enqueue(publishableEvents);
     return {
@@ -399,6 +827,7 @@ async function shareProgressCommand(options, cwd = process.cwd()) {
   if (!projectConfig || !credential) {
     throw new Error("Wibe is not authorized in this repository. Run wibe setup first.");
   }
+  await quarantineLegacyQueue();
   const summary = options.summary?.trim() ?? "";
   const wordCount = summary.split(/\s+/).filter(Boolean).length;
   if (wordCount < 20 || wordCount > 55 || summary.length > 500) {
@@ -462,7 +891,7 @@ async function shareProgressCommand(options, cwd = process.cwd()) {
     projectId: credential.projectId,
     repositoryId: credential.repositoryId,
     deviceId: credential.deviceId,
-    queue: new JsonFileOfflineQueue(queuePath())
+    queue: new JsonFileOfflineQueue(projectQueuePath(credential.projectId))
   }).capture(event);
   return {
     exitCode: result.error ? 1 : 0,
@@ -470,16 +899,29 @@ async function shareProgressCommand(options, cwd = process.cwd()) {
   };
 }
 async function doctorCommand(cwd = process.cwd(), requestedRepository) {
+  const legacyQueue = await quarantineLegacyQueue();
   const credential = await loadCredential(cwd);
   const projectConfig = await readProjectConfig(join(cwd, ".wibe", "project.json"));
+  const repositoryForQueue = await detectRepository(cwd);
+  const queuePath = credential ? projectQueuePath(credential.projectId) : pendingQueuePath(repositoryForQueue?.root ?? cwd);
+  let queueBacklog;
+  let queueError;
+  try {
+    queueBacklog = await new JsonFileOfflineQueue(queuePath).size();
+  } catch (error) {
+    queueError = error instanceof Error ? error.message : String(error);
+  }
   const expectedRepository = requestedRepository ? normalizeGitHubRepository(requestedRepository) : projectConfig?.repository;
   if (requestedRepository && !expectedRepository) {
     throw new Error(
       `Expected repository "${requestedRepository}" is not a valid GitHub owner/repository.`
     );
   }
-  const repository = await detectRepository(cwd);
+  const repository = repositoryForQueue;
   const repositoryMatches = expectedRepository ? matchesGitHubRepository(repository?.remote, expectedRepository) : true;
+  const credentialMatchesProjectConfig = Boolean(
+    credential && projectConfig && credential.projectId === projectConfig.projectId && credential.appUrl.replace(/\/$/, "") === projectConfig.appUrl.replace(/\/$/, "")
+  );
   let adapter;
   let adapterError;
   try {
@@ -487,8 +929,17 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
   } catch (error) {
     adapterError = error instanceof Error ? error.message : String(error);
   }
-  const heartbeat = credential && adapter && repositoryMatches ? await sendVerificationHeartbeat(credential, adapter, "doctor") : void 0;
-  const nativeConfig = adapter ? await validateNativeConfigs(adapter, cwd) : { hooks: false, mcp: false, activityRule: false };
+  const heartbeat = credential && adapter && repositoryMatches && credentialMatchesProjectConfig ? await sendVerificationHeartbeat(credential, adapter, "doctor", cwd) : void 0;
+  const nativeConfig = adapter ? await validateNativeConfigs(adapter, cwd, projectConfig?.projectId) : { hooks: false, mcp: false, activityRule: false, projectTrust: void 0 };
+  const trustNotes = adapter === "codex" && nativeConfig.projectTrust === void 0 ? [
+    "note  Codex project trust could not be verified because the user config was not found; trust this project in Codex and rerun doctor"
+  ] : [];
+  const queueNotes = [
+    `note  project queue ${queuePath} contains ${queueBacklog ?? "unknown"} event(s)`,
+    ...legacyQueue.pending ? [
+      `note  legacy shared queue is quarantined at ${legacyQueue.quarantined} and will not be delivered automatically`
+    ] : []
+  ];
   const checks = [
     ["node", Number(process.versions.node.split(".")[0]) >= 20],
     ["git repository", Boolean(repository)],
@@ -501,6 +952,14 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
     ["device authorization", Boolean(credential)],
     ["event endpoint", Boolean(credential?.appUrl)],
     ["project scope", Boolean(credential?.projectId)],
+    [
+      "project config matches device credential",
+      credentialMatchesProjectConfig
+    ],
+    [
+      queueError ? `project queue (${queueError})` : "project queue",
+      queueError === void 0
+    ],
     [
       adapterError ? `adapter detection (${adapterError})` : "adapter detection",
       Boolean(adapter)
@@ -508,6 +967,14 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
     ["agent hooks configuration", nativeConfig.hooks],
     ["MCP endpoint configuration", nativeConfig.mcp],
     ["agent activity instructions", nativeConfig.activityRule],
+    ...adapter === "codex" ? [
+      ...nativeConfig.projectTrust === void 0 ? [] : [
+        [
+          nativeConfig.projectTrust ? "Codex project trust" : "Codex project trust (trust this project in Codex, then review Wibe hooks in /hooks)",
+          nativeConfig.projectTrust
+        ]
+      ]
+    ] : [],
     [
       heartbeat?.error ? `verification heartbeat (${heartbeat.error})` : "verification heartbeat",
       Boolean(heartbeat && !heartbeat.error)
@@ -516,12 +983,16 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
   const failures = checks.filter(([, okay]) => !okay).length;
   return {
     exitCode: failures ? 1 : 0,
-    message: checks.map(([name, okay]) => `${okay ? "ok" : "missing"}  ${name}`).join("\n")
+    message: [
+      ...checks.map(([name, okay]) => `${okay ? "ok" : "missing"}  ${name}`),
+      ...trustNotes,
+      ...queueNotes
+    ].join("\n")
   };
 }
 async function loadCredential(cwd) {
   if (process.env.WIBE_ACCESS_TOKEN && process.env.WIBE_PROJECT_ID && process.env.WIBE_ORGANIZATION_ID && process.env.WIBE_DEVICE_ID) {
-    return {
+    const credential = {
       appUrl: process.env.WIBE_APP_URL ?? "http://localhost:3000",
       accessToken: process.env.WIBE_ACCESS_TOKEN,
       projectId: process.env.WIBE_PROJECT_ID,
@@ -529,17 +1000,22 @@ async function loadCredential(cwd) {
       repositoryId: process.env.WIBE_REPOSITORY_ID,
       deviceId: process.env.WIBE_DEVICE_ID
     };
+    const project = await readProjectConfig(join(cwd, ".wibe", "project.json"));
+    if (!project || project.projectId !== credential.projectId || project.appUrl.replace(/\/$/, "") !== credential.appUrl.replace(/\/$/, "")) {
+      return null;
+    }
+    return credential;
   }
   try {
-    const project = JSON.parse(
-      await readFile(join(cwd, ".wibe", "project.json"), "utf8")
-    );
-    if (!project.projectId) return null;
+    const project = await readProjectConfig(join(cwd, ".wibe", "project.json"));
+    if (!project) return null;
     const stored = await new SystemCredentialStore().get(
       "dev.wibe.bridge",
       project.projectId
     );
-    return stored ? JSON.parse(stored) : null;
+    if (!stored) return null;
+    const credential = JSON.parse(stored);
+    return credential.projectId === project.projectId && credential.appUrl.replace(/\/$/, "") === project.appUrl.replace(/\/$/, "") ? credential : null;
   } catch {
     return null;
   }
@@ -570,8 +1046,19 @@ async function installNativeConfigs(adapter, source, cwd, appUrl, projectId) {
   for (const [sourceName, destinationName] of files) {
     const destinationPath = join(cwd, destinationName);
     const destinationExists = await exists(destinationPath);
+    const isMcpConfig = destinationName === ".cursor/mcp.json" || destinationName === ".mcp.json" || destinationName === ".codex/config.toml";
     const isCursorActivityRule = adapter === "cursor" && destinationName === ".cursor/rules/wibe-activity.mdc";
     if (destinationExists) {
+      if (isMcpConfig) {
+        if (await refreshMcpConfig(
+          adapter,
+          destinationPath,
+          `${appUrl}/api/mcp/projects/${projectId}`
+        )) {
+          installed.push(destinationName);
+        }
+        continue;
+      }
       if (!isCursorActivityRule) continue;
       const existingRule = await readFile(destinationPath, "utf8");
       if (!existingRule.includes("# Wibe activity") || !existingRule.includes("wibe_share_progress")) {
@@ -582,15 +1069,151 @@ async function installNativeConfigs(adapter, source, cwd, appUrl, projectId) {
     await mkdir(resolve(destinationPath, ".."), { recursive: true });
     await writeFile(
       destinationPath,
-      template.replaceAll("${env:WIBE_APP_URL}", appUrl).replaceAll("${WIBE_APP_URL}", appUrl).replaceAll("${WIBE_PROJECT_ID}", projectId),
+      renderTemplate(template, appUrl, projectId),
       { mode: 384 }
     );
     installed.push(destinationName);
   }
+  if (adapter !== "cursor") {
+    const activityTemplate = renderTemplate(
+      await readFile(join(source, "wibe-activity.md.example"), "utf8"),
+      appUrl,
+      projectId
+    );
+    await installManagedActivitySection(join(cwd, "AGENTS.md"), activityTemplate);
+    installed.push("AGENTS.md");
+    if (adapter === "claude-code") {
+      const claudePath = join(cwd, "CLAUDE.md");
+      if (await ensureClaudeImportsAgents(claudePath)) {
+        installed.push("CLAUDE.md");
+      }
+    }
+  }
   return installed;
 }
-function queuePath() {
-  return process.env.WIBE_QUEUE_PATH ?? join(homedir(), ".wibe", "events.json");
+async function refreshMcpConfig(adapter, path, resourceUrl) {
+  const current = await readFile(path, "utf8");
+  if (adapter === "codex") {
+    const next = current.replace(
+      /(\[mcp_servers\.wibe\][\s\S]*?^\s*url\s*=\s*)["'][^"']*\/api\/mcp(?:\/projects\/[0-9a-f-]+)?\/?["']/m,
+      `$1${JSON.stringify(resourceUrl)}`
+    );
+    if (next === current) return false;
+    await writeFile(path, next, { mode: 384 });
+    return true;
+  }
+  let parsed;
+  try {
+    const value = JSON.parse(current);
+    if (!isRecord(value)) return false;
+    parsed = value;
+  } catch {
+    return false;
+  }
+  if (!isRecord(parsed.mcpServers) || !isRecord(parsed.mcpServers.wibe)) {
+    return false;
+  }
+  const existingUrl = parsed.mcpServers.wibe.url;
+  if (typeof existingUrl !== "string" || !existingUrl.includes("/api/mcp")) {
+    return false;
+  }
+  parsed.mcpServers.wibe.url = resourceUrl;
+  await writeFile(path, `${JSON.stringify(parsed, null, 2)}
+`, { mode: 384 });
+  return true;
+}
+function renderTemplate(template, appUrl, projectId) {
+  return template.replaceAll("${env:WIBE_APP_URL}", appUrl).replaceAll("${WIBE_APP_URL}", appUrl).replaceAll("${WIBE_PROJECT_ID}", projectId);
+}
+async function installManagedActivitySection(path, template) {
+  const managedSection = template.trim();
+  const current = await exists(path) ? await readFile(path, "utf8") : "";
+  const beginIndex = current.indexOf(WIBE_ACTIVITY_BEGIN);
+  const endIndex = current.indexOf(WIBE_ACTIVITY_END);
+  const hasBegin = beginIndex >= 0;
+  const hasEnd = endIndex >= 0;
+  if (hasBegin !== hasEnd || hasBegin && endIndex < beginIndex) {
+    throw new Error(
+      `${path} contains incomplete Wibe activity markers. Restore or remove the managed section markers, then rerun setup.`
+    );
+  }
+  const next = hasBegin ? `${current.slice(0, beginIndex)}${managedSection}${current.slice(
+    endIndex + WIBE_ACTIVITY_END.length
+  )}` : `${current.trimEnd()}${current.trim() ? "\n\n" : ""}${managedSection}
+`;
+  await writeFile(path, next, { mode: 420 });
+}
+async function ensureClaudeImportsAgents(path) {
+  const current = await exists(path) ? await readFile(path, "utf8") : "";
+  if (/^\s*@AGENTS\.md\s*$/m.test(current)) return false;
+  const next = `${current.trimEnd()}${current.trim() ? "\n\n" : ""}@AGENTS.md
+`;
+  await writeFile(path, next, { mode: 420 });
+  return true;
+}
+function queueRoot() {
+  const override = process.env.WIBE_QUEUE_PATH?.trim();
+  if (!override) return join(homedir(), ".wibe", "queue");
+  return extname(override) ? `${override}.d` : override;
+}
+function projectQueuePath(projectId) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    projectId
+  )) {
+    throw new Error("Wibe project ID must be a UUID.");
+  }
+  return join(queueRoot(), `${projectId}.json`);
+}
+function pendingQueuePath(cwd) {
+  let canonicalRoot = resolve(cwd);
+  try {
+    canonicalRoot = realpathSync.native(canonicalRoot);
+  } catch {
+  }
+  const repositoryHash = createHash("sha256").update(canonicalRoot).digest("hex").slice(0, 24);
+  return join(queueRoot(), `pending-${repositoryHash}.json`);
+}
+function legacyQueuePaths() {
+  const override = process.env.WIBE_QUEUE_PATH?.trim();
+  if (override && extname(override)) {
+    return {
+      current: override,
+      quarantined: `${override.slice(0, -extname(override).length)}.legacy${extname(override)}`
+    };
+  }
+  const directory = override || join(homedir(), ".wibe");
+  return {
+    current: join(directory, "events.json"),
+    quarantined: join(directory, "events.legacy.json")
+  };
+}
+async function quarantineLegacyQueue() {
+  const paths = legacyQueuePaths();
+  if (await exists(paths.current)) {
+    if (!await exists(paths.quarantined)) {
+      await rename(paths.current, paths.quarantined).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+    }
+  }
+  return {
+    ...paths,
+    pending: await exists(paths.current) || await exists(paths.quarantined)
+  };
+}
+async function adoptPendingQueue(cwd, projectId) {
+  await quarantineLegacyQueue();
+  const repository = await detectRepository(cwd);
+  const pending = new JsonFileOfflineQueue(
+    pendingQueuePath(repository?.root ?? cwd)
+  );
+  const project = new JsonFileOfflineQueue(projectQueuePath(projectId));
+  while (true) {
+    const events = await pending.peek(100);
+    if (!events.length) return;
+    await project.enqueue(events);
+    await pending.remove(events.map((event) => event.id));
+  }
 }
 async function exists(path) {
   try {
@@ -600,7 +1223,7 @@ async function exists(path) {
     return false;
   }
 }
-async function validateNativeConfigs(adapter, cwd) {
+async function validateNativeConfigs(adapter, cwd, projectId) {
   if (adapter === "codex") {
     const hooks = await validJson(
       join(cwd, ".codex", "hooks.json"),
@@ -609,11 +1232,21 @@ async function validateNativeConfigs(adapter, cwd) {
     let mcp = false;
     try {
       const config = await readFile(join(cwd, ".codex", "config.toml"), "utf8");
-      mcp = config.includes("[mcp_servers.wibe]") && config.includes("/api/mcp");
+      mcp = config.includes("[mcp_servers.wibe]") && Boolean(
+        projectId && config.includes(`/api/mcp/projects/${projectId}`)
+      );
     } catch {
       mcp = false;
     }
-    return { hooks, mcp, activityRule: true };
+    return {
+      hooks,
+      mcp,
+      activityRule: await validWibeActivityInstructions(
+        join(cwd, "AGENTS.md"),
+        projectId
+      ),
+      projectTrust: await codexProjectTrust(cwd)
+    };
   }
   const hookPath = adapter === "cursor" ? join(cwd, ".cursor", "hooks.json") : join(cwd, ".claude", "settings.json");
   const mcpPath = adapter === "cursor" ? join(cwd, ".cursor", "mcp.json") : join(cwd, ".mcp.json");
@@ -622,14 +1255,53 @@ async function validateNativeConfigs(adapter, cwd) {
     mcp: await validJson(mcpPath, (value) => {
       if (!isRecord(value.mcpServers)) return false;
       const wibe = value.mcpServers.wibe;
-      return isRecord(wibe) && typeof wibe.url === "string" && wibe.url.replace(/\/$/, "").endsWith("/api/mcp");
+      return isRecord(wibe) && typeof wibe.url === "string" && Boolean(
+        projectId && wibe.url.replace(/\/$/, "").endsWith(`/api/mcp/projects/${projectId}`)
+      );
     }),
-    activityRule: adapter !== "cursor" || await validText(
+    activityRule: adapter === "cursor" ? await validText(
       join(cwd, ".cursor", "rules", "wibe-activity.mdc"),
-      (value) => value.includes("alwaysApply: true") && value.includes("wibe_share_progress") && value.includes("wibe share-progress")
-    )
+      (value) => value.includes("alwaysApply: true") && Boolean(projectId && value.includes(projectId)) && value.includes("wibe_share_progress") && value.includes("wibe share-progress")
+    ) : await validWibeActivityInstructions(join(cwd, "AGENTS.md"), projectId),
+    projectTrust: void 0
   };
 }
+function validWibeActivityInstructions(path, projectId) {
+  return validText(
+    path,
+    (value) => value.includes(WIBE_ACTIVITY_BEGIN) && value.includes(WIBE_ACTIVITY_END) && Boolean(projectId && value.includes(projectId)) && value.includes("wibe_share_progress") && value.includes("wibe share-progress")
+  );
+}
+async function codexProjectTrust(cwd) {
+  const codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex");
+  let config;
+  try {
+    config = await readFile(join(codexHome, "config.toml"), "utf8");
+  } catch {
+    return void 0;
+  }
+  let currentProject;
+  for (const rawLine of config.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    const section = line.match(
+      /^\[projects\.(?:"((?:\\.|[^"])*)"|'([^']*)')\]$/
+    );
+    if (section) {
+      try {
+        currentProject = resolve(
+          section[1] !== void 0 ? JSON.parse(`"${section[1]}"`) : section[2]
+        );
+      } catch {
+        currentProject = void 0;
+      }
+      continue;
+    }
+    if (currentProject === resolve(cwd) && /^trust_level\s*=\s*["']trusted["'](?:\s*#.*)?$/.test(line)) {
+      return true;
+    }
+  }
+  return false;
+}
 async function validText(path, predicate) {
   try {
     return predicate(await readFile(path, "utf8"));
@@ -757,8 +1429,8 @@ async function assertExpectedRepository(cwd, expected) {
     `Repository mismatch: expected GitHub repository "${expected}", but found ${actual}. Run this command from the expected repository root or correct the origin remote, then retry.`
   );
 }
-async function sendVerificationHeartbeat(credential, adapter, reason) {
-  const repository = await detectRepository(process.cwd());
+async function sendVerificationHeartbeat(credential, adapter, reason, cwd) {
+  const repository = await detectRepository(cwd);
   const workingTree = repository ? await detectWorkingTreeMetrics(repository.root) : void 0;
   return new SignedBatchClient({
     endpoint: `${credential.appUrl}/api/events/batch`,
@@ -787,6 +1459,7 @@ async function sendVerificationHeartbeat(credential, adapter, reason) {
 
 export {
   setupCommand,
+  onboardCommand,
   statusCommand,
   emitCommand,
   shareProgressCommand,