atris 3.80.0 → 3.82.1

package/lib/computer-core.js

@@ -0,0 +1,2447 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const readline = require('readline');
+const { spawnSync } = require('child_process');
+const { decodeJwtClaims, promptUser, abortOnAuthFailure } = require('../utils/auth');
+const { resolveBackendRoot } = require('../utils/backend-root');
+const api = require('../utils/api');
+const { businessWorkspaceBase, loadBusinesses, saveBusinesses } = require('../commands/business');
+const { consoleCommand } = require('../commands/console');
+const { streamSession } = require('../commands/serve');
+const { buildRemoteAtrisBootstrapCommand } = require('./runtime-bootstrap');
+const { envForcesNonInteractive } = require('./noninteractive');
+
+function apiRequestJson(...args) {
+  return api.apiRequestJson(...args);
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function askComputerSetup(question, deps = {}) {
+  const prompt = deps.prompt || promptUser;
+  return String(await prompt(question) || '').trim();
+}
+
+function setupComputerChoices(data) {
+  const businesses = Array.isArray(data)
+    ? data
+    : (Array.isArray(data?.businesses) ? data.businesses : []);
+  return businesses
+    .filter((business) => business && business.id)
+    .map((business) => {
+      const owner = business.name || business.slug || 'business';
+      const computer = business.computer_name || business.workspace_name || '';
+      return {
+        label: computer ? `${owner}: ${computer}` : `${owner} computer`,
+        target: { type: 'business', id: business.id },
+      };
+    });
+}
+
+async function chooseSetupComputer(computers, deps = {}) {
+  const choices = computers.length
+    ? computers
+    : [{ label: 'your personal computer', target: { type: 'user' } }];
+  if (choices.length === 1) {
+    console.log(`using ${choices[0].label}.`);
+    return choices[0];
+  }
+
+  choices.forEach((computer, index) => console.log(`${index + 1}. ${computer.label}`));
+  const answer = await askComputerSetup('which computer? [1] ', deps);
+  const selected = Number.parseInt(answer || '1', 10);
+  return choices[selected >= 1 && selected <= choices.length ? selected - 1 : 0];
+}
+
+async function chooseSetupProviders(deps = {}) {
+  while (true) {
+    const answer = (await askComputerSetup(
+      'which coding accounts do you want to connect? (codex / claude / both) [both] ',
+      deps
+    ) || 'both').toLowerCase();
+    if (answer === 'codex') return ['codex'];
+    if (answer === 'claude') return ['claude'];
+    if (answer === 'both') return ['codex', 'claude'];
+    console.error('choose codex, claude, or both.');
+  }
+}
+
+const VALID_CLOUD_WORKERS = new Set(['claude', 'openai']);
+const LOCAL_BRIDGE_RECONNECT_MS = 2000;
+const VALID_COMPUTER_TYPES = new Set([
+  'general',
+  'business_ops',
+  'codeops',
+  'research',
+  'crm',
+  'reporting',
+  'recruiting',
+  'event_ops',
+  'support',
+]);
+const RECRUITING_BUSINESS_SLUG = 'atris-labs';
+const RECRUITING_LOCAL_SYNC_COMMANDS = new Set(['pull', 'push', 'publish', 'watch', 'review', 'doctor']);
+const KNOWN_CHAT_COMMANDS = new Set([
+  '/audit',
+  '/exit',
+  '/files',
+  '/help',
+  '/login',
+  '/model',
+  '/pwd',
+  '/quit',
+  '/reset',
+  '/run',
+  '/start',
+  '/status',
+  '/worker',
+  '/workflow',
+]);
+
+const CODEOPS_WORKFLOW_PROMPT = `
+## Atris CodeOps Workflow
+
+You are running inside Atris CodeOps with full computer permissions (permission_mode=bypassPermissions).
+Use those permissions to inspect, edit, test, commit, push, and open PRs when the task calls for it.
+
+Do not behave like an open-ended chat.
+Every coding or repo operation must follow the scientific workflow:
+OBSERVE -> HYPOTHESIS -> PLAN -> ACTION -> VALIDATION -> EVIDENCE -> NEXT STATE.
+
+For a new coding request, first show a concise PLAN with Files, Checks, Risk, and Merge policy.
+If the user has not clearly approved execution, ask for approval before editing.
+If the user explicitly says to execute, proceed after the concise plan.
+
+After work, always report:
+- edited_files
+- commands_run
+- validation_result
+- evidence
+- pr_url if any
+- pr_state
+- merge_state
+- next_task
+
+Use one of these next states:
+planned, executing, validated, pr_opened, merge_ready, merge_blocked_checks, merge_blocked_policy, merged, failed, needs_human.
+
+Never hide failures.
+A blocked check or missing permission is evidence, not success.
+`.trim();
+
+const RECRUITING_WORKFLOW_PROMPT = `
+## Atris Recruiting Workflow
+
+You are running inside the recruiting computer.
+Optimize for recruiter throughput: pipeline clarity, candidate follow-up, role context, interview loops, and decision notes.
+Do not send outreach, DMs, emails, or calendar invites without explicit operator approval.
+
+For each work block, report:
+- role or pipeline touched
+- candidates or sources reviewed
+- artifact changed
+- follow-up owner
+- sync/proof status
+`.trim();
+
+function color(code, value) {
+  if (process.env.NO_COLOR || !process.stdout.isTTY) return String(value);
+  return `\x1b[${code}m${value}\x1b[0m`;
+}
+
+const ui = {
+  bold: (value) => color(1, value),
+  dim: (value) => color(2, value),
+  green: (value) => color(32, value),
+  yellow: (value) => color(33, value),
+  cyan: (value) => color(36, value),
+  red: (value) => color(31, value),
+};
+
+function useInteractiveCloudUi() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !envForcesNonInteractive());
+}
+
+function useInteractiveTerminalUi() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !envForcesNonInteractive());
+}
+
+async function readPipedStdin() {
+  if (process.stdin.isTTY) return null;
+  let input = '';
+  for await (const chunk of process.stdin) {
+    input += chunk.toString();
+  }
+  return input;
+}
+
+function printCloudWordmark() {
+  if (!process.stdout.isTTY) return;
+  console.log(ui.cyan('    ___  __________  ________   CLOUD'));
+  console.log(ui.cyan('   / _ |/_  __/ __ \\/  _/ __/'));
+  console.log(ui.cyan('  / __ | / / / /_/ // /_\\ \\  '));
+  console.log(ui.cyan(' /_/ |_|/_/  \\____/___/___/  '));
+}
+
+function printLocalWordmark() {
+  if (!process.stdout.isTTY) return;
+  console.log(ui.green('    ___  __________  ________   LOCAL'));
+  console.log(ui.green('   / _ |/_  __/ __ \\/  _/ __/'));
+  console.log(ui.green('  / __ | / / / /_/ // /_\\ \\  '));
+  console.log(ui.green(' /_/ |_|/_/  \\____/___/___/  '));
+}
+
+function activeWorker(worker) {
+  return (worker || 'claude').toLowerCase() === 'default' ? 'claude' : (worker || 'claude').toLowerCase();
+}
+
+function formatWorkerName(worker) {
+  const active = activeWorker(worker);
+  return active === 'openai' ? 'OpenAI' : 'Claude';
+}
+
+function extractAttachedWorkspaceMismatch(...values) {
+  const text = values
+    .filter((value) => value !== null && value !== undefined)
+    .map((value) => {
+      if (typeof value === 'string') return value;
+      try {
+        return JSON.stringify(value);
+      } catch {
+        return String(value);
+      }
+    })
+    .join('\n');
+  const match = text.match(/attached to workspace\s+([a-z0-9-]+)\.\s*Activate workspace\s+([a-z0-9-]+)\s+to switch/i);
+  if (!match) return null;
+  return {
+    attachedWorkspaceId: match[1],
+    requestedWorkspaceId: match[2],
+  };
+}
+
+function contextForAttachedWorkspaceMismatch(ctx, failure) {
+  const mismatch = extractAttachedWorkspaceMismatch(
+    failure?.result?.error,
+    failure?.result?.errorMessage,
+    failure?.result?.data,
+    failure?.fallback?.error,
+    failure?.fallback?.payload
+  );
+  if (!mismatch?.attachedWorkspaceId || mismatch.attachedWorkspaceId === ctx?.workspaceId) return null;
+  return { ...ctx, workspaceId: mismatch.attachedWorkspaceId };
+}
+
+async function describeClaudeAuth(token, ctx) {
+  try {
+    const status = await fetchBusinessClaudeLoginStatus(token, ctx);
+    if (!status.ok) {
+      return {
+        connected: false,
+        label: 'Claude login: unknown',
+        detail: 'run /login to connect the remote computer',
+      };
+    }
+    const data = status.data || {};
+    if (data.loggedIn || data.connected || data.status === 'completed' || data.next_action === 'connected') {
+      return {
+        connected: true,
+        label: 'Claude login: connected',
+        detail: 'Claude subscription lane is active',
+      };
+    }
+    return {
+      connected: false,
+      label: 'Claude login: not connected',
+      detail: 'run /login to turn on the 0-credit Claude lane',
+    };
+  } catch {
+    return {
+      connected: false,
+      label: 'Claude login: unknown',
+      detail: 'run /login to connect the remote computer',
+    };
+  }
+}
+
+async function describeBillingMode(token, ctx, worker) {
+  if (activeWorker(worker) === 'openai') {
+    return 'Atris credits';
+  }
+  const auth = await describeClaudeAuth(token, ctx);
+  if (auth.connected) {
+    return 'Claude subscription connected - 0 Atris credits';
+  }
+  return 'Claude via Atris credits - /login makes it 0 credits';
+}
+
+function printCloudHelp() {
+  console.log('');
+  console.log(ui.bold('Useful commands'));
+  console.log('  /start               Show the beginner flow again');
+  console.log('  /help                Show this menu');
+  console.log('  /status              Show cloud computer status');
+  console.log('  /workflow            Show the CodeOps workflow contract');
+  console.log('  /files [path]        List files in the workspace');
+  console.log('  /run <cmd>           Run shell without the model');
+  console.log('  /audit [n]           Show recent runs, output, and charges');
+  console.log('  /worker claude       Use Claude subscription lane');
+  console.log('  /worker openai       Use OpenAI credit lane');
+  console.log('  /login               Connect Claude subscription on the remote box');
+  console.log('  /reset               Start a fresh chat session');
+  console.log('  /exit                Leave cloud mode');
+  console.log('');
+  console.log(ui.dim('No code needed: type the outcome in normal English. Unknown /commands are blocked locally.'));
+}
+
+function printCloudStartPanel(ctx, worker, model, billingLabel, authSummary = null) {
+  console.log('');
+  console.log(ui.bold('Atris Cloud Computer'));
+  console.log(`${ctx.businessName}  ${ui.dim('/workspace persists')}`);
+  console.log(`Lane: ${ui.bold(formatWorkerName(worker))}  ${ui.dim(formatCloudSelection({ worker, model }))}`);
+  console.log(`Billing: ${billingLabel}`);
+  if (authSummary) console.log(`${authSummary.label}  ${ui.dim(authSummary.detail)}`);
+  console.log(`${ui.green('Atris loaded')}  ${ui.dim('plain English -> workspace actions')}`);
+  console.log('');
+  console.log(ui.bold('Start here'));
+  console.log('  Type what you want built. Atris can inspect, edit, run, and save files.');
+  console.log('  "look around this workspace and tell me what is here"');
+  console.log('  "build me a one-page website for my coffee shop"');
+  console.log('  "make a script that turns a CSV into a chart"');
+  console.log('');
+  console.log(ui.bold('Controls'));
+  console.log('  /start   this screen      /status  lane, auth, billing');
+  console.log('  /files   workspace files  /run pwd shell without the model');
+  console.log('  /login   connect Claude   /worker openai use credits');
+  console.log('  /audit 5 recent runs      /exit leave cloud mode');
+  console.log('');
+  console.log(ui.dim('Plain English goes to Atris. Slash commands control the computer.'));
+}
+
+function appendSystemPrompt(basePrompt, extraPrompt) {
+  if (!extraPrompt) return basePrompt || null;
+  const marker = String(extraPrompt).split('\n', 1)[0];
+  if (basePrompt && marker && basePrompt.includes(marker)) return basePrompt;
+  if (!basePrompt) return extraPrompt;
+  return `${String(basePrompt).trim()}\n\n${extraPrompt}`;
+}
+
+function codeOpsCloudOptions(options = {}) {
+  return {
+    ...options,
+    worker: options.worker || null,
+    mode: 'codeops',
+    systemPrompt: appendSystemPrompt(options.systemPrompt, CODEOPS_WORKFLOW_PROMPT),
+  };
+}
+
+function recruitingCloudOptions(options = {}) {
+  return {
+    ...options,
+    worker: options.worker || null,
+    mode: 'recruiting',
+    systemPrompt: appendSystemPrompt(options.systemPrompt, RECRUITING_WORKFLOW_PROMPT),
+  };
+}
+
+function printCodeOpsStartPanel(ctx, worker, model, billingLabel, authSummary = null) {
+  console.log('');
+  console.log(ui.bold('Atris CodeOps Computer'));
+  console.log(`${ctx.businessName}  ${ui.dim('/workspace persists, full permissions enabled')}`);
+  console.log(`Lane: ${ui.bold(formatWorkerName(worker))}  ${ui.dim(formatCloudSelection({ worker, model }))}`);
+  console.log(`Billing: ${billingLabel}`);
+  if (authSummary) console.log(`${authSummary.label}  ${ui.dim(authSummary.detail)}`);
+  console.log(`${ui.green('Workflow locked')}  ${ui.dim('observe -> plan -> act -> validate -> evidence -> next')}`);
+  console.log('');
+  console.log(ui.bold('Start here'));
+  console.log('  Type a coding goal in plain English.');
+  console.log('  CodeOps will plan first, then execute after approval or explicit proceed language.');
+  console.log('  Use /workflow to see the contract, /run for shell, /audit for run history, /exit to leave.');
+  console.log('');
+}
+
+function printCodeOpsWorkflowContract() {
+  console.log('');
+  console.log(ui.bold('CodeOps workflow'));
+  console.log('  observe -> hypothesis -> plan -> action -> validation -> evidence -> next state');
+  console.log('');
+  console.log('  Required final evidence: edited_files, commands_run, validation_result, pr_url, pr_state, merge_state, next_task.');
+  console.log('  Allowed states: planned, executing, validated, pr_opened, merge_ready, merge_blocked_checks, merge_blocked_policy, merged, failed, needs_human.');
+  console.log('  Full permissions stay on; the workflow contract controls how the computer uses them.');
+}
+
+function printRecruitingWorkflowContract() {
+  console.log('');
+  console.log(ui.bold('Recruiting workflow'));
+  console.log('  pipeline -> candidates -> next touch -> owner -> proof -> sync');
+  console.log('');
+  console.log('  No external outreach, DMs, emails, or calendar invites without explicit operator approval.');
+  console.log('  Required final evidence: pipeline touched, candidates reviewed, artifact changed, follow-up owner, sync/proof status.');
+}
+
+function printRecruitingComputerHelp() {
+  console.log('Usage: atris computer recruiting [chat|status|sync|doctor|pull|push|publish|watch|review|wake|sleep|run|grep|ls|cat|exec|audit|workflow|create]');
+  console.log('');
+  console.log('Examples:');
+  console.log('  atris computer recruiting');
+  console.log('  atris computer recruiting status');
+  console.log('  atris computer recruiting doctor');
+  console.log('  atris computer recruiting sync');
+  console.log('  atris computer recruiting pull');
+  console.log('  atris computer recruiting push --dry-run');
+  console.log('  atris computer recruiting publish --dry-run');
+  console.log('  atris computer recruiting watch');
+  console.log('  atris computer recruiting run "pwd && find . -maxdepth 2 -type f | head"');
+  console.log("  atris computer recruiting exec \"Summarize today's candidate follow-ups\"");
+  console.log('  atris computer recruiting create');
+}
+
+function displayHomeRelativePath(targetPath) {
+  const home = os.homedir();
+  if (targetPath && home && targetPath === home) return '~';
+  if (targetPath && home && targetPath.startsWith(`${home}${path.sep}`)) {
+    return `~${targetPath.slice(home.length)}`;
+  }
+  return targetPath;
+}
+
+function recruitingBusinessWorkspacePath(slug = RECRUITING_BUSINESS_SLUG) {
+  const root = businessWorkspaceBase();
+  return path.join(root, slug);
+}
+
+function normalizeBusinessSlug(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-|-$/g, '');
+}
+
+function bindingMatchesBusinessSlug(binding, slug) {
+  if (!binding) return false;
+  const wanted = normalizeBusinessSlug(slug);
+  return [binding.slug, binding.business_slug, binding.name]
+    .map(normalizeBusinessSlug)
+    .some((candidate) => candidate && candidate === wanted);
+}
+
+function bindingBusinessLabel(binding) {
+  return binding?.slug || binding?.business_slug || binding?.name || 'unknown';
+}
+
+function resolveRecruitingSyncWorkspace(slug = RECRUITING_BUSINESS_SLUG) {
+  const currentBinding = readBusinessBinding();
+  if (bindingMatchesBusinessSlug(currentBinding, slug)) {
+    return {
+      cwd: process.cwd(),
+      binding: currentBinding,
+      source: 'current',
+    };
+  }
+
+  const canonicalCwd = recruitingBusinessWorkspacePath(slug);
+  const canonicalBinding = readBusinessBinding(canonicalCwd);
+  if (bindingMatchesBusinessSlug(canonicalBinding, slug)) {
+    return {
+      cwd: canonicalCwd,
+      binding: canonicalBinding,
+      source: 'canonical',
+    };
+  }
+
+  return null;
+}
+
+function printRecruitingSyncNextSteps(slug = RECRUITING_BUSINESS_SLUG, workspacePath = null) {
+  const target = workspacePath || recruitingBusinessWorkspacePath(slug);
+  console.log('');
+  console.log('Recruiting sync commands');
+  console.log(`  cd ${displayHomeRelativePath(target)}`);
+  console.log('  atris computer recruiting doctor');
+  console.log('  atris computer recruiting pull');
+  console.log('  atris computer recruiting push --dry-run');
+  console.log('  atris computer recruiting publish --dry-run');
+  console.log('  atris sync --status');
+  console.log('  atris sync --dry-run');
+  console.log('  atris sync');
+  console.log('  atris sync --watch');
+}
+
+function recruitingLocalSyncCommand(action, slug = RECRUITING_BUSINESS_SLUG, args = []) {
+  const withFlag = (items, flag) => items.includes(flag) ? items : [...items, flag];
+  switch (action) {
+    case 'pull':
+      return ['pull', slug, '--keep-local', '--fail-on-conflict', ...args];
+    case 'push':
+      return ['push', slug, ...args];
+    case 'publish':
+      return ['push', slug, ...withFlag(args, '--allow-broad-workspace')];
+    case 'watch':
+      return ['sync', '--watch', ...args];
+    case 'review':
+      return ['sync', '--review', ...args];
+    case 'doctor':
+      return ['sync', '--status', ...args];
+    default:
+      return ['sync', ...args];
+  }
+}
+
+function printRecruitingLocalSyncCommandHelp(action, slug = RECRUITING_BUSINESS_SLUG) {
+  const command = recruitingLocalSyncCommand(action, slug, (action === 'push' || action === 'publish') ? ['--dry-run'] : []);
+  console.log(`Usage: atris computer recruiting ${action} [flags]`);
+  console.log('');
+  console.log('Runs from the current or canonical Atris Labs recruiting workspace.');
+  if (action === 'pull') {
+    console.log('Use --dry-run first; use --apply to write into a dirty local workspace.');
+  } else if (action === 'push') {
+    console.log('Use --dry-run first; after reviewing a broad publish, add --allow-broad-workspace.');
+  } else if (action === 'publish') {
+    console.log('Reviewed publish shortcut. Use --dry-run first, then run without --dry-run.');
+  }
+  console.log('');
+  console.log('Underlying command:');
+  console.log(`  atris ${command.join(' ')}`);
+  if (action === 'push') {
+    console.log('');
+    console.log('Reviewed broad publish:');
+    console.log('  atris computer recruiting push --dry-run --allow-broad-workspace');
+    console.log('  atris computer recruiting push --allow-broad-workspace');
+  } else if (action === 'publish') {
+    console.log('');
+    console.log('Reviewed publish:');
+    console.log('  atris computer recruiting publish --dry-run');
+    console.log('  atris computer recruiting publish');
+  }
+}
+
+function withoutRecruitingWrapperFlags(action, args = []) {
+  if (action !== 'pull') return args;
+  return args.filter((arg) => arg !== '--apply');
+}
+
+function gitDirtySummary(cwd) {
+  const result = spawnSync('git', ['-C', cwd, 'status', '--short'], {
+    encoding: 'utf8',
+    env: { ...process.env, ATRIS_SKIP_UPDATE_CHECK: '1' },
+  });
+  if (result.status !== 0) return null;
+  const lines = String(result.stdout || '').split(/\r?\n/).filter(Boolean);
+  return {
+    count: lines.length,
+    sample: lines.slice(0, 5),
+  };
+}
+
+function gitOutput(cwd, args = []) {
+  const result = spawnSync('git', ['-C', cwd, ...args], {
+    encoding: 'utf8',
+    env: { ...process.env, ATRIS_SKIP_UPDATE_CHECK: '1' },
+  });
+  if (result.status !== 0) return '';
+  return String(result.stdout || '');
+}
+
+function recruitingCheckpointStamp() {
+  return (process.env.ATRIS_RECRUITING_CHECKPOINT_STAMP || new Date().toISOString())
+    .replace(/[-:]/g, '')
+    .replace(/\.\d{3}Z$/, 'Z');
+}
+
+function listRecruitingUntrackedFiles(cwd) {
+  return gitOutput(cwd, ['ls-files', '--others', '--exclude-standard'])
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .filter((filePath) => !filePath.startsWith('.atris/sync/checkpoints/'));
+}
+
+function copyRecruitingUntrackedFiles(cwd, checkpointDir, untrackedFiles = []) {
+  let copied = 0;
+  const targetRoot = path.join(checkpointDir, 'untracked');
+  for (const filePath of untrackedFiles) {
+    const source = path.join(cwd, filePath);
+    const target = path.join(targetRoot, filePath);
+    try {
+      if (!fs.statSync(source).isFile()) continue;
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(source, target);
+      copied++;
+    } catch {
+      // Some files move while tools write state; keep the checkpoint best-effort.
+    }
+  }
+  return copied;
+}
+
+function writeRecruitingPullCheckpoint(cwd, dirty) {
+  if (!dirty || dirty.count === 0) return null;
+
+  const stamp = recruitingCheckpointStamp();
+  const relDir = `.atris/sync/checkpoints/${stamp}`;
+  const checkpointDir = path.join(cwd, relDir);
+  const untrackedFiles = listRecruitingUntrackedFiles(cwd);
+  fs.mkdirSync(checkpointDir, { recursive: true });
+
+  const trackedPatch = gitOutput(cwd, ['diff', '--binary']);
+  const stagedPatch = gitOutput(cwd, ['diff', '--cached', '--binary']);
+  fs.writeFileSync(path.join(checkpointDir, 'tracked.patch'), trackedPatch, 'utf8');
+  fs.writeFileSync(path.join(checkpointDir, 'staged.patch'), stagedPatch, 'utf8');
+  fs.writeFileSync(path.join(checkpointDir, 'untracked.txt'), `${untrackedFiles.join('\n')}${untrackedFiles.length ? '\n' : ''}`, 'utf8');
+  const copiedUntracked = copyRecruitingUntrackedFiles(cwd, checkpointDir, untrackedFiles);
+
+  const summary = [
+    '# Recruiting Pull Checkpoint',
+    '',
+    `created_at: ${new Date().toISOString()}`,
+    `workspace: ${cwd}`,
+    `git_status_count: ${dirty.count}`,
+    `untracked_files_listed: ${untrackedFiles.length}`,
+    `untracked_files_copied: ${copiedUntracked}`,
+    '',
+    'Sample status:',
+    ...dirty.sample.map((line) => `- ${line}`),
+    '',
+    'Restore hints:',
+    `- git apply ${relDir}/tracked.patch`,
+    `- git apply --cached ${relDir}/staged.patch`,
+    `- cp -R ${relDir}/untracked/. .`,
+    '',
+  ].join('\n');
+  fs.writeFileSync(path.join(checkpointDir, 'summary.md'), summary, 'utf8');
+
+  return {
+    relDir,
+    summary: `${relDir}/summary.md`,
+    untrackedFiles: untrackedFiles.length,
+    copiedUntracked,
+  };
+}
+
+function printRecruitingPullPreflight(summary) {
+  console.log('');
+  console.log('Recruiting pull preflight');
+  console.log(`  local git changes: ${summary.count}`);
+  summary.sample.forEach((line) => console.log(`  ${line}`));
+  console.log('');
+  console.log('Safe next step');
+  console.log('  atris computer recruiting pull --dry-run');
+  console.log('  atris computer recruiting pull --apply   # writes pull changes and conflict review packet');
+}
+
+function latestRecruitingConflictPacket(cwd) {
+  const conflictsRoot = path.join(cwd, '.atris', 'sync', 'conflicts');
+  const summaries = [];
+
+  function walk(dir) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile() && entry.name === 'summary.md') {
+        summaries.push(path.relative(cwd, full).replace(/\\/g, '/'));
+      }
+    }
+  }
+
+  walk(conflictsRoot);
+  summaries.sort();
+  return summaries[summaries.length - 1] || null;
+}
+
+function latestRecruitingCheckpoint(cwd) {
+  const checkpointRoot = path.join(cwd, '.atris', 'sync', 'checkpoints');
+  const summaries = [];
+
+  function walk(dir) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile() && entry.name === 'summary.md') {
+        summaries.push(path.relative(cwd, full).replace(/\\/g, '/'));
+      }
+    }
+  }
+
+  walk(checkpointRoot);
+  summaries.sort();
+  return summaries[summaries.length - 1] || null;
+}
+
+function printRecruitingSyncDoctor(workspace, slug = RECRUITING_BUSINESS_SLUG) {
+  const dirty = gitDirtySummary(workspace.cwd);
+  const latestPacket = latestRecruitingConflictPacket(workspace.cwd);
+  const latestCheckpoint = latestRecruitingCheckpoint(workspace.cwd);
+  console.log('Recruiting sync doctor');
+  console.log(`  workspace: ${displayHomeRelativePath(workspace.cwd)}`);
+  console.log(`  business: ${bindingBusinessLabel(workspace.binding) || slug}`);
+  if (dirty) {
+    console.log(`  local git changes: ${dirty.count}`);
+    dirty.sample.forEach((line) => console.log(`  ${line}`));
+  } else {
+    console.log('  local git changes: unknown');
+  }
+  console.log(`  review packet: ${latestPacket || 'none'}`);
+  console.log(`  latest checkpoint: ${latestCheckpoint || 'none'}`);
+  console.log('');
+  console.log('Next command');
+  if (latestPacket) {
+    console.log('  atris computer recruiting review');
+  } else if (dirty && dirty.count > 0) {
+    console.log('  atris computer recruiting pull --dry-run');
+  } else {
+    console.log('  atris computer recruiting pull --dry-run');
+  }
+}
+
+function runAtrisCliCommand(cliArgs, cwd) {
+  const result = spawnSync(process.execPath, [path.join(__dirname, '..', 'bin', 'atris.js'), ...cliArgs], {
+    cwd,
+    stdio: 'inherit',
+    env: { ...process.env, ATRIS_SKIP_UPDATE_CHECK: '1' },
+  });
+  if (result.error) throw result.error;
+  if (result.signal) {
+    process.exitCode = 1;
+    return 1;
+  }
+  process.exitCode = result.status || 0;
+  return process.exitCode;
+}
+
+function printRecruitingLocalSyncOutcome(action, status = 0, args = []) {
+  const isPublishLike = action === 'push' || action === 'publish';
+
+  if (action === 'pull') {
+    console.log('');
+    console.log('Recruiting next step');
+    if (args.includes('--dry-run')) {
+      console.log('  atris computer recruiting pull --apply   # writes review packet if conflicts were reported');
+      console.log('  atris computer recruiting review');
+      console.log('  atris computer recruiting push --dry-run');
+      return;
+    }
+    console.log('  atris computer recruiting review   # if conflicts were reported');
+    console.log('  atris computer recruiting push --dry-run');
+    return;
+  }
+
+  if (isPublishLike && status !== 0) {
+    console.log('');
+    console.log('Recruiting next step');
+    console.log('  If the output says review before publish:');
+    console.log('  atris computer recruiting publish --dry-run');
+    console.log('  atris computer recruiting publish');
+    console.log('  Otherwise:');
+    console.log('  atris computer recruiting pull --dry-run');
+    console.log('  atris computer recruiting review   # if conflicts were reported');
+    return;
+  }
+
+  if (action === 'publish' && args.includes('--dry-run')) {
+    console.log('');
+    console.log('Recruiting next step');
+    console.log('  atris computer recruiting publish');
+    return;
+  }
+
+  if (action === 'push' && args.includes('--dry-run')) {
+    console.log('');
+    console.log('Recruiting next step');
+    if (args.includes('--allow-broad-workspace')) {
+      console.log('  atris computer recruiting push --allow-broad-workspace');
+      return;
+    }
+    console.log('  If the dry-run showed review before publish:');
+    console.log('  atris computer recruiting push --dry-run --allow-broad-workspace');
+    console.log('  atris computer recruiting push --allow-broad-workspace');
+    console.log('  Otherwise:');
+    console.log('  atris computer recruiting push');
+  }
+
+  if (action === 'review') {
+    console.log('');
+    console.log('Review note');
+    console.log('  If pull --dry-run reported conflicts but no packet appears:');
+    console.log('  atris computer recruiting pull --apply');
+  }
+}
+
+async function runRecruitingLocalSyncCommand(action, args = [], cloudOptions = {}) {
+  const slug = cloudOptions.businessSlug || RECRUITING_BUSINESS_SLUG;
+  if (args.includes('--help') || args.includes('-h') || args[0] === 'help') {
+    printRecruitingLocalSyncCommandHelp(action, slug);
+    return;
+  }
+
+  const workspace = resolveRecruitingSyncWorkspace(slug);
+  console.log(`Recruiting local ${action}`);
+  if (!workspace) {
+    const currentBinding = readBusinessBinding();
+    if (currentBinding && !bindingMatchesBusinessSlug(currentBinding, slug)) {
+      console.log(`  current workspace: ${bindingBusinessLabel(currentBinding)} (not ${slug})`);
+    } else {
+      console.log('  local workspace: not detected in this folder');
+    }
+    printRecruitingLocalSyncCommandHelp(action, slug);
+    printRecruitingSyncNextSteps(slug);
+    return;
+  }
+
+  if (workspace.source === 'canonical') {
+    console.log(`  folder: ${displayHomeRelativePath(workspace.cwd)} (auto-detected)`);
+  }
+
+  if (action === 'doctor') {
+    printRecruitingSyncDoctor(workspace, slug);
+    return;
+  }
+
+  const commandArgs = withoutRecruitingWrapperFlags(action, args);
+  if (action === 'pull' && !args.includes('--dry-run') && !args.includes('--apply')) {
+    const dirty = gitDirtySummary(workspace.cwd);
+    if (dirty && dirty.count > 0) {
+      printRecruitingPullPreflight(dirty);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  if (action === 'pull' && args.includes('--apply')) {
+    const dirty = gitDirtySummary(workspace.cwd);
+    const checkpoint = writeRecruitingPullCheckpoint(workspace.cwd, dirty);
+    if (checkpoint) {
+      console.log('');
+      console.log('Recruiting checkpoint');
+      console.log(`  wrote: ${checkpoint.summary}`);
+      console.log(`  untracked copied: ${checkpoint.copiedUntracked}/${checkpoint.untrackedFiles}`);
+    }
+  }
+
+  const command = recruitingLocalSyncCommand(action, workspace.binding.slug || slug, commandArgs);
+  const status = runAtrisCliCommand(command, workspace.cwd);
+  printRecruitingLocalSyncOutcome(action, status, commandArgs);
+}
+
+async function runRecruitingSyncHelper(args = [], cloudOptions = {}) {
+  const slug = cloudOptions.businessSlug || RECRUITING_BUSINESS_SLUG;
+  if (args.includes('--help') || args.includes('-h') || args[0] === 'help') {
+    console.log('Usage: atris computer recruiting sync [--status|--dry-run|--watch|--review|--resolve local|cloud|merge]');
+    console.log('');
+    console.log('Runs local recruiting workspace sync from the current or canonical Atris Labs folder.');
+    printRecruitingSyncNextSteps(slug);
+    return;
+  }
+
+  const workspace = resolveRecruitingSyncWorkspace(slug);
+  console.log('Recruiting local sync');
+  if (!workspace) {
+    const currentBinding = readBusinessBinding();
+    if (currentBinding && !bindingMatchesBusinessSlug(currentBinding, slug)) {
+      console.log(`  current workspace: ${bindingBusinessLabel(currentBinding)} (not ${slug})`);
+    } else {
+      console.log('  local workspace: not detected in this folder');
+    }
+    printRecruitingSyncNextSteps(slug);
+    return;
+  }
+
+  if (workspace.source === 'canonical') {
+    console.log(`  folder: ${displayHomeRelativePath(workspace.cwd)} (auto-detected)`);
+  }
+
+  const { businessSync } = require('../commands/business-sync');
+  await businessSync(args.length > 0 ? args : ['--status'], workspace.cwd);
+  printRecruitingSyncNextSteps(workspace.binding.slug || slug, workspace.cwd);
+}
+
+function buildLocalBridgeSystemPrompt(sessionId, localRoot, allowBash) {
+  const endpoint = `/api/cli/sessions/${sessionId}/file-op`;
+  const bashLine = allowBash
+    ? '- Run local commands with local_file_op({ "type": "bash", "command": "..." }).'
+    : '- Bash is disabled for this local session. Use read/write/edit/delete only.';
+
+  return `
+
+## Atris Local Folder Mode
+
+The user connected their LOCAL folder to Atris through CLI session ${sessionId}.
+Their local root is: ${localRoot}
+Treat this local folder as the primary workspace for this chat.
+The cloud /workspace is only a control plane.
+Do not use Write/Edit/apply_patch for requested local edits.
+Use the native local_file_op tool for every local filesystem change.
+
+Preferred tool calls:
+- local_file_op({ "type": "read", "path": "relative/path.txt" })
+- local_file_op({ "type": "write", "path": "file.txt", "content": "..." })
+- local_file_op({ "type": "edit", "path": "file.txt", "find": "...", "replace": "..." })
+- local_file_op({ "type": "delete", "path": "file.txt" })
+${bashLine}
+
+Fallback if the native tool is unavailable: use Bash to call the Atris Python API from the cloud workspace:
+
+\`\`\`python
+from atris_api import api
+api("POST", "${endpoint}", {
+    "type": "read",
+    "path": "relative/path.txt",
+    "wait_for_ack": True,
+    "timeout_seconds": 30,
+})
+\`\`\`
+
+Supported operations:
+- Read: { "type": "read", "path": "file.txt", "wait_for_ack": true }
+- Write: { "type": "write", "path": "file.txt", "content": "...", "wait_for_ack": true }
+- Edit: { "type": "edit", "path": "file.txt", "find": "...", "replace": "...", "wait_for_ack": true }
+- Delete: { "type": "delete", "path": "file.txt", "wait_for_ack": true }
+
+Rules:
+- All paths must be relative to the local root.
+- Read before editing unless you are creating a new file.
+- Use local bash for ls/rg/tests when available.
+- Do not ask the user to copy, paste, or save files. Apply the change through the bridge.
+- In final answers, say what changed locally and how you verified it.
+---`;
+}
+
+function printLocalAtrisStartPanel(ctx, bridge, worker, model, billingLabel, authSummary = null) {
+  console.log('');
+  console.log(ui.bold('Atris Local Computer'));
+  console.log(`${ctx.businessName}  ${ui.dim('cloud brain -> local folder')}`);
+  console.log(`Local: ${bridge.workingDir}`);
+  console.log(`Bridge: ${bridge.sessionId.slice(0, 8)}  ${ui.dim(bridge.allowBash ? 'local bash enabled' : 'file ops only')}`);
+  console.log(`Lane: ${ui.bold(formatWorkerName(worker))}  ${ui.dim(formatCloudSelection({ worker, model }))}`);
+  console.log(`Billing: ${billingLabel}`);
+  if (authSummary) console.log(`${authSummary.label}  ${ui.dim(authSummary.detail)}`);
+  console.log(`${ui.green('Atris loaded')}  ${ui.dim('plain English -> local edits')}`);
+  console.log('');
+  console.log(ui.bold('Start here'));
+  console.log('  "look around this folder and tell me what is here"');
+  console.log('  "make the homepage look premium"');
+  console.log('  "add a script that converts a CSV into a chart"');
+  console.log('');
+  console.log(ui.bold('Controls'));
+  console.log('  /status  local bridge, lane, billing');
+  console.log('  /files   local files');
+  console.log('  /run     local shell command');
+  console.log('  /audit   recent cloud brain runs');
+  console.log('  /worker  claude|openai');
+  console.log('  /exit    leave local Atris mode');
+  console.log('');
+  console.log(ui.dim('Tokens run through Atris/cloud billing. Edits land in this local folder.'));
+}
+
+async function printCloudSessionStatus(token, ctx, worker, model) {
+  const statusResult = await apiRequestJson(`/business/${ctx.businessId}/ai-computer/status`, {
+    method: 'GET',
+    token,
+  });
+  const d = statusResult.ok ? (statusResult.data || {}) : {};
+  const computerState = d.status || (statusResult.ok ? 'unknown' : `error ${statusResult.status}`);
+  const authSummary = activeWorker(worker) === 'claude' ? await describeClaudeAuth(token, ctx) : null;
+  const billingLabel = await describeBillingMode(token, ctx, worker);
+
+  console.log('');
+  console.log(ui.bold('Cloud status'));
+  console.log(`  Computer: ${computerState}`);
+  console.log(`  Business: ${ctx.businessName}`);
+  console.log('  Workspace: /workspace');
+  console.log(`  Lane: ${formatWorkerName(worker)}  ${formatCloudSelection({ worker, model })}`);
+  console.log(`  Billing: ${billingLabel}`);
+  console.log('  Atris: loaded');
+  if (authSummary) console.log(`  Claude: ${authSummary.connected ? 'connected' : 'not connected'}  ${authSummary.detail}`);
+  if (d.endpoint) console.log(`  Endpoint: ${d.endpoint}`);
+}
+
+function questionAsync(rl, question) {
+  return new Promise((resolve) => rl.question(question, resolve));
+}
+
+async function selectFromDropdown(title, choices) {
+  if (!useInteractiveTerminalUi() || !choices.length) return choices[0] || null;
+
+  console.log(ui.bold(title));
+  choices.forEach((choice, i) => {
+    console.log(`${i + 1}. ${choice.label}  ${ui.dim(choice.detail || '')}`.trimEnd());
+  });
+
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = String(await questionAsync(rl, `Choose [1-${choices.length}] (default 1): `) || '').trim();
+  rl.close();
+
+  if (!answer) return choices[0];
+  if (answer.toLowerCase() === 'q' || answer.toLowerCase() === 'quit' || answer.toLowerCase() === 'exit') {
+    return null;
+  }
+  const selected = Number.parseInt(answer, 10);
+  if (Number.isFinite(selected) && selected >= 1 && selected <= choices.length) {
+    return choices[selected - 1];
+  }
+  return choices[0];
+}
+
+async function chooseComputerSurface(hasBusinessBinding, hasLocalHarness) {
+  if (!useInteractiveTerminalUi()) {
+    return hasBusinessBinding ? 'cloud' : 'local';
+  }
+  if (hasBusinessBinding) {
+    const choices = [
+      { label: 'Cloud workspace', value: 'cloud', detail: '/workspace, shared, Atris loaded' },
+      { label: 'Local folder', value: 'local-atris', detail: 'edits this folder, tokens run through Atris' },
+    ];
+    if (hasLocalHarness) {
+      choices.push({ label: 'Local BYO Claude', value: 'local-byo', detail: 'advanced, tokens go to Anthropic' });
+    }
+    const selected = await selectFromDropdown('Choose computer', choices);
+    if (selected === null) return null;
+    return selected?.value || 'cloud';
+  }
+  return 'local';
+}
+
+async function chooseCloudLane(token, ctx, initialOptions = {}) {
+  let worker = initialOptions.worker || ctx?.worker || null;
+  let model = initialOptions.model || null;
+
+  if (!worker && useInteractiveCloudUi()) {
+    const selected = await selectFromDropdown('Choose compute lane', [
+      { label: 'Claude', value: 'claude', detail: 'subscription lane when connected, 0 Atris credits' },
+      { label: 'OpenAI', value: 'openai', detail: 'works now, uses Atris credits' },
+    ]);
+    if (selected === null) return { cancelled: true };
+    if (selected?.value) worker = selected.value;
+  }
+
+  if (activeWorker(worker) === 'claude' && useInteractiveCloudUi()) {
+    let state = null;
+    try {
+      const status = await fetchBusinessClaudeLoginStatus(token, ctx);
+      state = status.ok ? status.data : null;
+    } catch {
+      state = null;
+    }
+
+    if (!state?.connected && !state?.loggedIn && state?.status !== 'completed' && state?.next_action !== 'connected') {
+      const selected = await selectFromDropdown('Claude subscription auth', [
+        { label: 'Use Atris Claude', value: 'continue', detail: 'works now, uses Atris credits' },
+        { label: 'Login to Claude', value: 'login', detail: 'turns on 0-credit Claude lane' },
+        { label: 'Use OpenAI', value: 'openai', detail: 'works now, uses Atris credits' },
+      ]);
+      if (selected === null) return { cancelled: true };
+      if (selected?.value === 'login') {
+        await computerCloudLogin(token, ctx);
+      } else if (selected?.value === 'openai') {
+        worker = 'openai';
+      }
+    }
+  }
+
+  return { worker, model };
+}
+
+function parseComputerOptions(argv) {
+  const positional = [];
+  let worker = process.env.ATRIS_CLOUD_WORKER || null;
+  let model = process.env.ATRIS_CLOUD_MODEL || null;
+  let businessSlug = null;
+  let workspaceId = null;
+  let waitForResult = true;
+  let message = null;
+  let force = false;
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if ((arg === '--business' || arg === '-b') && argv[i + 1]) {
+      businessSlug = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--business=')) {
+      businessSlug = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if ((arg === '--workspace' || arg === '--workspace-id') && argv[i + 1]) {
+      workspaceId = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--workspace=')) {
+      workspaceId = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if (arg.startsWith('--workspace-id=')) {
+      workspaceId = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if (arg === '--worker' && argv[i + 1]) {
+      worker = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--worker=')) {
+      worker = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if (arg === '--model' && argv[i + 1]) {
+      model = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--model=')) {
+      model = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if (arg === '--message' && argv[i + 1]) {
+      message = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--message=')) {
+      message = arg.slice('--message='.length);
+      continue;
+    }
+    if (arg === '--no-wait' || arg === '--async') {
+      waitForResult = false;
+      continue;
+    }
+    if (arg === '--force') {
+      force = true;
+      continue;
+    }
+    positional.push(arg);
+  }
+
+  if (worker && !VALID_CLOUD_WORKERS.has(worker)) {
+    console.error(`Invalid cloud worker: ${worker}`);
+    console.error('Expected one of: claude, openai');
+    process.exit(1);
+  }
+
+  return {
+    positional,
+    options: {
+      worker: worker || null,
+      model: model || null,
+      businessSlug: businessSlug ? String(businessSlug).trim() : null,
+      workspaceId: workspaceId ? String(workspaceId).trim() : null,
+      waitForResult,
+      message,
+      force,
+    },
+  };
+}
+
+function parseComputerCreateArgs(argv = []) {
+  const nameParts = [];
+  let businessSlug = null;
+  let help = false;
+  let setDefault = false;
+  let computerType = null;
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--help' || arg === '-h' || arg === 'help') {
+      help = true;
+      continue;
+    }
+    if ((arg === '--business' || arg === '-b') && argv[i + 1]) {
+      businessSlug = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--business=')) {
+      businessSlug = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if ((arg === '--type' || arg === '-t') && argv[i + 1] && !argv[i + 1].startsWith('-')) {
+      computerType = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--type=')) {
+      computerType = arg.split('=', 2)[1] || null;
+      continue;
+    }
+    if (arg === '--set-default') {
+      setDefault = true;
+      continue;
+    }
+    nameParts.push(arg);
+  }
+
+  return {
+    name: nameParts.join(' ').trim(),
+    businessSlug: businessSlug ? String(businessSlug).trim() : null,
+    computerType: computerType ? normalizeComputerType(computerType) : null,
+    help,
+    setDefault,
+  };
+}
+
+function computerCreateArgsHaveName(argv = []) {
+  const flagsWithValues = new Set(['--business', '-b', '--type', '-t']);
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (flagsWithValues.has(arg)) {
+      i++;
+      continue;
+    }
+    if (!arg || arg.startsWith('-') || arg === 'help') continue;
+    return true;
+  }
+  return false;
+}
+
+function normalizeComputerType(value) {
+  const normalized = String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[\s-]+/g, '_')
+    .replace(/^_+|_+$/g, '');
+  if (normalized === 'business') return 'business_ops';
+  if (normalized === 'event') return 'event_ops';
+  return normalized || 'general';
+}
+
+function formatComputerTypeList() {
+  return [...VALID_COMPUTER_TYPES].join(', ');
+}
+
+function parseComputerDeleteArgs(argv = []) {
+  const options = { help: false, confirm: null };
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--help' || arg === '-h' || arg === 'help') {
+      options.help = true;
+      continue;
+    }
+    if (arg === '--confirm' && argv[i + 1]) {
+      options.confirm = argv[i + 1];
+      i++;
+      continue;
+    }
+    if (arg.startsWith('--confirm=')) {
+      options.confirm = arg.slice('--confirm='.length);
+      continue;
+    }
+  }
+
+  return options;
+}
+
+function formatCloudSelection(options = {}) {
+  const worker = activeWorker(options.worker);
+  const parts = [`worker=${worker}`];
+  if (options.model) parts.push(`model=${options.model}`);
+  if (!options.model) parts.push('model=default');
+  return parts.join(' ');
+}
+
+function printModeBanner(mode, root, lines = []) {
+  console.log(`Mode: ${mode}`);
+  console.log(`Root: ${root}`);
+  for (const line of lines) console.log(line);
+  console.log('');
+}
+
+function findAtrisCodeTerminal() {
+  const envPath = process.env.ATRIS_CODE_PY;
+  const backend = resolveBackendRoot();
+  const candidates = [
+    envPath,
+    path.join(__dirname, '..', 'cli', 'atris_code.py'),
+    path.join(process.cwd(), 'cli', 'atris_code.py'),
+    ...(backend ? [path.join(backend, 'cli', 'atris_code.py')] : []),
+  ].filter(Boolean);
+
+  let dir = process.cwd();
+  for (let i = 0; i < 4; i++) {
+    candidates.push(path.join(dir, 'cli', 'atris_code.py'));
+    dir = path.dirname(dir);
+  }
+
+  for (const p of candidates) {
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+function computerLocalLegacy(extraArgs = []) {
+  printModeBanner('LOCAL', process.cwd(), [
+    'Current folder is the workspace.',
+    'Legacy console mode.',
+  ]);
+
+  const originalArgv = process.argv;
+  process.argv = [originalArgv[0], originalArgv[1], originalArgv[2], ...extraArgs];
+  try {
+    consoleCommand();
+  } finally {
+    process.argv = originalArgv;
+  }
+}
+
+function computerLocal(extraArgs = [], options = {}) {
+  printLocalWordmark();
+  printModeBanner('LOCAL', process.cwd(), [
+    'Claude Code + Atris workspace context.',
+    'BYO local Claude: tokens go through Anthropic, not Atris.',
+    'No Atris credits, no cloud audit, no remote workspace.',
+    'Remote /login only applies to Cloud workspace.',
+  ]);
+
+  const originalArgv = process.argv;
+  process.argv = [originalArgv[0], originalArgv[1], originalArgv[2], 'claude', ...extraArgs];
+  try {
+    consoleCommand(options);
+  } finally {
+    process.argv = originalArgv;
+  }
+}
+
+async function startLocalAtrisBridge(token, options = {}) {
+  const workingDir = process.cwd();
+  const allowBash = options.allowBash !== false;
+  const result = await apiRequestJson('/cli/sessions', {
+    method: 'POST',
+    token,
+    body: {
+      working_directory: workingDir,
+      agent_id: null,
+      allow_bash: allowBash,
+    },
+    timeoutMs: 15000,
+  });
+
+  if (!result.ok) {
+    throw new Error(result.errorMessage || result.error || `failed to create local bridge (${result.status})`);
+  }
+
+  const session = result.data || {};
+  const sessionId = session.session_id;
+  if (!sessionId) {
+    throw new Error('local bridge did not return a session id');
+  }
+
+  let stopped = false;
+  const loop = async () => {
+    while (!stopped) {
+      try {
+        await streamSession(token, sessionId, workingDir);
+      } catch (err) {
+        if (!stopped) console.error(ui.dim(`  local bridge reconnecting: ${err.message}`));
+      }
+      if (!stopped) await sleep(LOCAL_BRIDGE_RECONNECT_MS);
+    }
+  };
+  loop();
+
+  return {
+    sessionId,
+    workingDir,
+    allowBash,
+    stop: async () => {
+      stopped = true;
+      await apiRequestJson(`/cli/sessions/${sessionId}`, {
+        method: 'DELETE',
+        token,
+        timeoutMs: 10000,
+      }).catch(() => {});
+    },
+  };
+}
+
+async function runLocalBridgeOp(token, sessionId, op, timeoutSeconds = 30) {
+  const result = await apiRequestJson(`/cli/sessions/${sessionId}/file-op`, {
+    method: 'POST',
+    token,
+    body: {
+      ...op,
+      wait_for_ack: true,
+      timeout_seconds: timeoutSeconds,
+    },
+    timeoutMs: Math.max(10, timeoutSeconds + 5) * 1000,
+  });
+
+  if (!result.ok) {
+    console.error(`Failed: ${result.errorMessage || result.error || result.status}`);
+    return null;
+  }
+
+  const data = result.data || {};
+  if (data.status === 'error') {
+    const err = data.result?.error || 'local operation failed';
+    console.error(`Failed: ${err}`);
+  }
+  return data;
+}
+
+function readBusinessBinding(cwd = process.cwd()) {
+  const bindingPath = path.join(cwd, '.atris', 'business.json');
+  if (!fs.existsSync(bindingPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(bindingPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function readPackageMeta(cwd = process.cwd()) {
+  const packagePath = path.join(cwd, 'package.json');
+  if (!fs.existsSync(packagePath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function relIfExists(cwd, target) {
+  return fs.existsSync(path.join(cwd, target)) ? target : null;
+}
+
+function detectValidationCommand(cwd = process.cwd(), pkg = null) {
+  const meta = pkg || readPackageMeta(cwd);
+  const testScript = meta?.scripts?.test;
+  if (testScript && !/no test specified/i.test(testScript)) return 'npm test';
+  if (fs.existsSync(path.join(cwd, 'pytest.ini')) || fs.existsSync(path.join(cwd, 'pyproject.toml'))) return 'pytest';
+  if (fs.existsSync(path.join(cwd, 'Cargo.toml'))) return 'cargo test';
+  if (fs.existsSync(path.join(cwd, 'go.mod'))) return 'go test ./...';
+  return 'none detected';
+}
+
+function detectComputerType(cwd = process.cwd(), pkg = null, binding = null) {
+  if (binding?.computer_type) return binding.computer_type;
+  if (binding?.workspace_type) return binding.workspace_type;
+  const meta = pkg || readPackageMeta(cwd);
+  if (meta?.bin || fs.existsSync(path.join(cwd, 'bin')) || fs.existsSync(path.join(cwd, 'commands'))) return 'codeops';
+  if (fs.existsSync(path.join(cwd, 'docs')) || fs.existsSync(path.join(cwd, 'atris', 'wiki'))) return 'research';
+  return 'workspace';
+}
+
+function buildComputerCard(cwd = process.cwd()) {
+  const binding = readBusinessBinding(cwd);
+  const pkg = readPackageMeta(cwd);
+  const folderName = path.basename(cwd);
+  const ownerName = binding?.name || pkg?.name || folderName;
+  const ownerType = binding ? 'business' : 'project';
+  const computerName = binding?.computer_name || binding?.workspace_name || `${ownerName} computer`;
+  const computerType = detectComputerType(cwd, pkg, binding);
+  const memory = [
+    relIfExists(cwd, 'atris/MAP.md'),
+    relIfExists(cwd, 'atris/TODO.md'),
+    relIfExists(cwd, 'atris/wiki'),
+    relIfExists(cwd, 'atris/logs'),
+  ].filter(Boolean);
+  const artifacts = [
+    fs.existsSync(path.join(cwd, 'atris')) ? 'atris/reports/' : null,
+    relIfExists(cwd, '.atris/receipts'),
+  ].filter(Boolean);
+
+  return {
+    ownerName,
+    ownerType,
+    computerName,
+    computerType,
+    workspace: cwd,
+    loop: 'plan -> do -> review',
+    memory,
+    validation: detectValidationCommand(cwd, pkg),
+    proof: binding ? 'atris computer proof' : 'atris proof run',
+    visual: 'atris visualize "<prompt>"',
+    artifacts,
+    generatedAt: new Date().toISOString(),
+  };
+}
+
+function renderList(items) {
+  return items.length ? items.join(', ') : 'none detected';
+}
+
+function renderComputerCard(card) {
+  return [
+    'Atris Computer Card',
+    '',
+    `  Owner:      ${card.ownerName} (${card.ownerType})`,
+    `  Computer:   ${card.computerName}`,
+    `  Type:       ${card.computerType}`,
+    `  Workspace:  ${card.workspace}`,
+    `  Loop:       ${card.loop}`,
+    `  Memory:     ${renderList(card.memory)}`,
+    `  Validate:   ${card.validation}`,
+    `  Proof:      ${card.proof}`,
+    `  Visual:     ${card.visual}`,
+    `  Artifacts:  ${renderList(card.artifacts)}`,
+  ].join('\n');
+}
+
+function renderComputerCardMarkdown(card) {
+  return [
+    '# Atris Computer Card',
+    '',
+    `Generated: ${card.generatedAt}`,
+    '',
+    `- Owner: ${card.ownerName} (${card.ownerType})`,
+    `- Computer: ${card.computerName}`,
+    `- Type: ${card.computerType}`,
+    `- Workspace: ${card.workspace}`,
+    `- Loop: ${card.loop}`,
+    `- Memory: ${renderList(card.memory)}`,
+    `- Validate: ${card.validation}`,
+    `- Proof: ${card.proof}`,
+    `- Visual: ${card.visual}`,
+    `- Artifacts: ${renderList(card.artifacts)}`,
+    '',
+  ].join('\n');
+}
+
+function parseComputerCardArgs(args = []) {
+  const options = { write: false, out: null, help: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--help' || arg === '-h') options.help = true;
+    else if (arg === '--write') options.write = true;
+    else if (arg === '--out' && args[i + 1]) options.out = args[++i];
+    else if (arg.startsWith('--out=')) options.out = arg.slice('--out='.length);
+  }
+  return options;
+}
+
+function defaultComputerCardPath(cwd = process.cwd()) {
+  if (fs.existsSync(path.join(cwd, 'atris'))) {
+    return path.join(cwd, 'atris', 'reports', 'computer-card.md');
+  }
+  return path.join(cwd, 'computer-card.md');
+}
+
+function computerCard(args = [], cwd = process.cwd()) {
+  const options = parseComputerCardArgs(args);
+  if (options.help) {
+    console.log('Usage: atris computer card [--write] [--out <path>]');
+    console.log('');
+    console.log('Show the local owner/computer card for this workspace.');
+    return null;
+  }
+
+  const card = buildComputerCard(cwd);
+  console.log(renderComputerCard(card));
+
+  if (options.write || options.out) {
+    const outputPath = options.out
+      ? (path.isAbsolute(options.out) ? options.out : path.join(cwd, options.out))
+      : defaultComputerCardPath(cwd);
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.writeFileSync(outputPath, renderComputerCardMarkdown(card), 'utf8');
+    console.log('');
+    console.log(`Wrote ${path.relative(cwd, outputPath) || outputPath}`);
+    return outputPath;
+  }
+
+  return card;
+}
+
+function savedBusinessWorker(slug) {
+  if (!slug) return null;
+  const wanted = String(slug).toLowerCase();
+  const businesses = loadBusinesses();
+  const entry = businesses[slug] || Object.values(businesses).find((item) => {
+    if (!item) return false;
+    return String(item.slug || '').toLowerCase() === wanted
+      || String(item.canonical_slug || '').toLowerCase() === wanted
+      || String(item.name || '').toLowerCase() === wanted;
+  });
+  return entry?.worker || null;
+}
+
+async function resolveBusinessContext(token) {
+  const binding = readBusinessBinding();
+  if (!binding) return null;
+
+  if (binding.business_id && binding.workspace_id) {
+    return {
+      slug: binding.slug,
+      businessId: binding.business_id,
+      workspaceId: binding.workspace_id,
+      businessName: binding.name || binding.slug || 'business',
+      worker: savedBusinessWorker(binding.slug),
+    };
+  }
+
+  const slug = binding.slug;
+  if (!slug) return null;
+
+  const businesses = loadBusinesses();
+  const list = await apiRequestJson('/business/', { method: 'GET', token });
+  if (list.ok) {
+    const match = (list.data || []).find(
+      (b) => b.slug === slug || (b.name || '').toLowerCase() === slug.toLowerCase()
+    );
+    if (match) {
+      businesses[slug] = {
+        ...(businesses[slug] || {}),
+        business_id: match.id,
+        workspace_id: match.workspace_id,
+        name: match.name,
+        slug: match.slug,
+        added_at: new Date().toISOString(),
+      };
+      saveBusinesses(businesses);
+      return {
+        slug: match.slug,
+        businessId: match.id,
+        workspaceId: match.workspace_id,
+        businessName: match.name || match.slug,
+        worker: businesses[slug].worker || null,
+      };
+    }
+  }
+
+  const cached = businesses[slug];
+  if (cached && cached.business_id && cached.workspace_id) {
+    return {
+      slug,
+      businessId: cached.business_id,
+      workspaceId: cached.workspace_id,
+      businessName: cached.name || slug,
+      worker: cached.worker || null,
+    };
+  }
+
+  return null;
+}
+
+function cachedBusinessContext(slug) {
+  if (!slug) return null;
+  const wanted = String(slug).toLowerCase();
+  const businesses = loadBusinesses();
+  const cached = businesses[slug] || Object.values(businesses).find((entry) => {
+    if (!entry) return false;
+    return String(entry.slug || '').toLowerCase() === wanted
+      || String(entry.canonical_slug || '').toLowerCase() === wanted
+      || String(entry.name || '').toLowerCase() === wanted;
+  });
+  if (!cached?.business_id) return null;
+  return {
+    slug: cached.slug || slug,
+    businessId: cached.business_id,
+    workspaceId: cached.workspace_id || null,
+    businessName: cached.name || cached.slug || slug,
+    worker: cached.worker || null,
+  };
+}
+
+async function resolveBusinessContextBySlug(token, slug, options = {}) {
+  if (!slug) return null;
+
+  if (options.preferCache) {
+    const cached = cachedBusinessContext(slug);
+    if (cached?.workspaceId) return cached;
+  }
+
+  const businesses = loadBusinesses();
+  const list = await apiRequestJson('/business/', { method: 'GET', token });
+  if (list.ok) {
+    const match = (list.data || []).find(
+      (b) => b.slug === slug || (b.name || '').toLowerCase() === slug.toLowerCase()
+    );
+    if (match) {
+      const key = match.slug || slug;
+      businesses[key] = {
+        ...(businesses[key] || {}),
+        business_id: match.id,
+        workspace_id: match.workspace_id,
+        name: match.name,
+        slug: match.slug,
+        added_at: new Date().toISOString(),
+      };
+      saveBusinesses(businesses);
+      return {
+        slug: match.slug,
+        businessId: match.id,
+        workspaceId: match.workspace_id,
+        businessName: match.name || match.slug,
+        worker: businesses[key].worker || null,
+      };
+    }
+  }
+
+  return null;
+}
+
+function shortcutBusinessLabel(slug, fallbackName) {
+  if (normalizeBusinessSlug(slug) === RECRUITING_BUSINESS_SLUG) return 'Atris Labs';
+  return fallbackName || slug;
+}
+
+async function resolveSingleBusinessShortcutFallback(token, slug) {
+  const wantedSlug = normalizeBusinessSlug(slug);
+  if (wantedSlug !== RECRUITING_BUSINESS_SLUG) return null;
+
+  const list = await apiRequestJson('/business/', { method: 'GET', token });
+  const rows = list.ok && Array.isArray(list.data)
+    ? list.data.filter((business) => business && business.id)
+    : [];
+  if (rows.length !== 1) return null;
+
+  const match = rows[0];
+  const businesses = loadBusinesses();
+  const businessName = shortcutBusinessLabel(wantedSlug, match.name || match.slug);
+  businesses[wantedSlug] = {
+    ...(businesses[wantedSlug] || {}),
+    business_id: match.id,
+    workspace_id: match.workspace_id,
+    name: businessName,
+    slug: wantedSlug,
+    cloud_slug: match.slug || null,
+    added_at: new Date().toISOString(),
+  };
+  saveBusinesses(businesses);
+  return {
+    slug: wantedSlug,
+    businessId: match.id,
+    workspaceId: match.workspace_id,
+    businessName,
+    worker: businesses[wantedSlug].worker || null,
+  };
+}
+
+async function resolveComputerCommandContext(token, options = {}) {
+  if (options.businessSlug || options.workspaceId) {
+    const ctx = options.businessSlug
+      ? await resolveBusinessContextBySlug(token, options.businessSlug, { preferCache: true })
+      : await resolveBusinessContext(token);
+    if (!ctx?.businessId) return null;
+    const workspaceId = options.workspaceId
+      ? await resolveWorkspaceSelector(token, ctx, options.workspaceId)
+      : ctx.workspaceId;
+    return {
+      ...ctx,
+      workspaceId,
+    };
+  }
+
+  return resolveBusinessContext(token);
+}
+
+async function resolveTypedBusinessComputerContext(token, options = {}, defaults = {}) {
+  const businessSlug = options.businessSlug || defaults.businessSlug;
+  const computerType = normalizeComputerType(defaults.computerType);
+  if (options.workspaceId) {
+    return resolveComputerCommandContext(token, { ...options, businessSlug });
+  }
+
+  let ctx = await resolveBusinessContextBySlug(token, businessSlug, { preferCache: true });
+  if (!ctx?.businessId && (options.allowCanonicalShortcutFallback || defaults.allowCanonicalShortcutFallback)) {
+    ctx = await resolveSingleBusinessShortcutFallback(token, businessSlug);
+  }
+  if (!ctx?.businessId) return null;
+  const workspaces = await listBusinessWorkspaces(token, ctx);
+  const workspace = resolveWorkspaceByComputerType(workspaces, computerType);
+  if (!workspace?.id) {
+    return {
+      ...ctx,
+      workspaceId: null,
+      missingComputerType: computerType,
+    };
+  }
+  return {
+    ...ctx,
+    workspaceId: workspace.id,
+    workspaceName: workspace.name || null,
+    computerType,
+  };
+}
+
+function printMissingTypedComputer(ctx, computerType, options = {}) {
+  const label = options.label || computerType;
+  const businessSlug = options.businessSlug || ctx?.slug || RECRUITING_BUSINESS_SLUG;
+  console.error(`No ${label} computer found for ${ctx?.businessName || businessSlug}.`);
+  console.error(`Create it: atris computer ${label} create`);
+  console.error(`Or explicitly create one: atris computer create "${label[0].toUpperCase()}${label.slice(1)} Computer" --business ${businessSlug} --type ${computerType}`);
+  process.exitCode = 1;
+}
+
+function looksLikeWorkspaceId(input) {
+  const value = String(input || '').trim();
+  if (!value) return false;
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)
+    || /^ws-[a-z0-9_-]+$/i.test(value);
+}
+
+async function resolveWorkspaceSelector(token, ctx, input) {
+  const selector = String(input || '').trim();
+  if (!selector) return ctx.workspaceId;
+  if (selector === ctx.workspaceId || looksLikeWorkspaceId(selector)) return selector;
+
+  const workspaces = await listBusinessWorkspaces(token, ctx);
+  const workspace = resolveWorkspaceFromList(workspaces, selector);
+  return workspace?.id || selector;
+}
+
+async function resolveBusinessOwnerForCreate(token, businessSlug = null, options = {}) {
+  const wantedSlug = businessSlug ? String(businessSlug).trim() : null;
+  if (wantedSlug) {
+    const fromApi = await resolveBusinessContextBySlug(token, wantedSlug);
+    if (fromApi) return fromApi;
+
+    const cached = loadBusinesses()[wantedSlug];
+    if (cached?.business_id) {
+      return {
+        slug: cached.slug || wantedSlug,
+        businessId: cached.business_id,
+        workspaceId: cached.workspace_id || null,
+        businessName: cached.name || cached.slug || wantedSlug,
+      };
+    }
+    if (options.allowCanonicalShortcutFallback) {
+      return resolveSingleBusinessShortcutFallback(token, wantedSlug);
+    }
+    return null;
+  }
+
+  const binding = readBusinessBinding();
+  if (binding?.business_id) {
+    return {
+      slug: binding.slug || binding.canonical_slug || null,
+      businessId: binding.business_id,
+      workspaceId: binding.workspace_id || null,
+      businessName: binding.name || binding.slug || 'business',
+    };
+  }
+
+  return resolveBusinessContext(token);
+}
+
+function businessSelector(ctx) {
+  return ctx?.slug || ctx?.businessId || '<business>';
+}
+
+function apiFailureDetail(result) {
+  return String(result?.errorMessage || result?.error || result?.data?.detail || result?.status || 'Request failed');
+}
+
+function printComputerCommandFailure(result, ctx = null) {
+  const detail = apiFailureDetail(result);
+  console.error(detail);
+  if (result?.status === 409) {
+    const mismatch = extractAttachedWorkspaceMismatch(detail, result?.data);
+    const targetWorkspace = mismatch?.requestedWorkspaceId || ctx?.workspaceId || '<workspace-id>';
+    const forceFlag = /--force|force to take over|re-run with --force/i.test(detail) ? ' --force' : '';
+    console.error(`Run: atris computer activate --business ${businessSelector(ctx)} --workspace ${targetWorkspace}${forceFlag}`);
+  }
+}
+
+function rememberBusinessWorkspace(ctx, workspaceId, options = {}) {
+  const slug = ctx.slug || (ctx.businessName || '').toLowerCase().replace(/\s+/g, '-');
+  if (!slug || !workspaceId) return;
+  const businesses = loadBusinesses();
+  const existing = businesses[slug] || {};
+  businesses[slug] = {
+    ...existing,
+    business_id: ctx.businessId,
+    workspace_id: workspaceId,
+    name: ctx.businessName,
+    slug,
+    computer_name: options.computerName || existing.computer_name,
+    endpoint: options.endpoint || existing.endpoint,
+    added_at: existing.added_at || new Date().toISOString(),
+    updated_at: new Date().toISOString(),
+  };
+  saveBusinesses(businesses);
+}
+
+function rememberCreatedComputer(ctx, workspace, endpoint = null, options = {}) {
+  const slug = ctx.slug || (ctx.businessName || '').toLowerCase().replace(/\s+/g, '-');
+  if (!slug) return;
+  const businesses = loadBusinesses();
+  const existing = businesses[slug] || {};
+  const shouldSetDefault = Boolean(options.setDefault || !existing.workspace_id);
+  businesses[slug] = {
+    ...existing,
+    business_id: ctx.businessId,
+    workspace_id: shouldSetDefault ? workspace.id : existing.workspace_id,
+    name: ctx.businessName,
+    slug,
+    computer_name: shouldSetDefault ? workspace.name : existing.computer_name,
+    computer_type: shouldSetDefault ? (options.computerType || existing.computer_type) : existing.computer_type,
+    endpoint: shouldSetDefault ? (endpoint || existing.endpoint) : existing.endpoint,
+    added_at: existing.added_at || new Date().toISOString(),
+    updated_at: new Date().toISOString(),
+  };
+  saveBusinesses(businesses);
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function businessPromptUserId(token) {
+  const claims = decodeJwtClaims(token) || {};
+  return claims.sub || claims.user_id || claims.uid || null;
+}
+
+async function runBusinessTerminalCommand(token, ctx, command, timeout = 30) {
+  return apiRequestJson(
+    `/business/${ctx.businessId}/workspaces/${ctx.workspaceId}/terminal`,
+    {
+      method: 'POST',
+      token,
+      body: { command, timeout },
+      timeoutMs: Math.max(timeout + 10, 40) * 1000,
+    }
+  );
+}
+
+async function listBusinessWorkspaces(token, ctx) {
+  const result = await apiRequestJson(`/business/${ctx.businessId}/workspaces`, {
+    method: 'GET',
+    token,
+    timeoutMs: 15000,
+    retries: 0,
+  });
+  return result.ok && Array.isArray(result.data) ? result.data : [];
+}
+
+function formatWorkspaceRef(workspace) {
+  if (!workspace) return '-';
+  return workspace.name ? `${workspace.name} (${workspace.id})` : workspace.id;
+}
+
+function workspaceMatchesInput(workspace, input) {
+  if (!workspace || !input) return false;
+  const wanted = String(input).trim().toLowerCase();
+  if (!wanted) return false;
+  return String(workspace.id || '').toLowerCase() === wanted
+    || String(workspace.name || '').toLowerCase() === wanted;
+}
+
+function resolveWorkspaceFromList(workspaces, input) {
+  return (workspaces || []).find((workspace) => workspaceMatchesInput(workspace, input)) || null;
+}
+
+function workspaceComputerType(workspace) {
+  return normalizeComputerType(workspace?.type || workspace?.computer_type || workspace?.workspace_type || '');
+}
+
+function workspaceMatchesComputerType(workspace, type) {
+  if (!workspace || !type) return false;
+  const wanted = normalizeComputerType(type);
+  if (workspaceComputerType(workspace) === wanted) return true;
+  const compactWanted = wanted.replace(/_/g, '');
+  const name = String(workspace.name || '').toLowerCase().replace(/[^a-z0-9]+/g, '');
+  return Boolean(compactWanted && name.includes(compactWanted));
+}
+
+function resolveWorkspaceByComputerType(workspaces, type) {
+  return (workspaces || []).find((workspace) => workspaceMatchesComputerType(workspace, type)) || null;
+}
+
+function formatLeaseAge(seconds) {
+  const value = Number(seconds);
+  if (!Number.isFinite(value) || value < 0) return '-';
+  if (value < 60) return `${Math.floor(value)}s`;
+  const minutes = Math.floor(value / 60);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 48) return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+
+async function probeAttachedWorkspace(token, ctx) {
+  const result = await apiRequestJson(
+    `/business/${ctx.businessId}/workspaces/${ctx.workspaceId}/terminal`,
+    {
+      method: 'POST',
+      token,
+      body: { command: 'printf "ATRIS_STATUS_OK\\n"', timeout: 5 },
+      timeoutMs: 8000,
+      retries: 0,
+    }
+  );
+  if (result.ok) return { workspaceId: ctx.workspaceId, health: 'ready' };
+  const mismatch = extractAttachedWorkspaceMismatch(apiFailureDetail(result), result.data);
+  if (mismatch?.attachedWorkspaceId) {
+    return { workspaceId: mismatch.attachedWorkspaceId, health: 'workspace_mismatch', result };
+  }
+  return { workspaceId: null, health: 'degraded', result };
+}
+
+async function bootstrapBusinessComputerRuntime(token, ctx, boundary = 'computer-wake', options = {}) {
+  if (!ctx?.businessId || !ctx?.workspaceId) {
+    return { ok: false, skipped: true, reason: 'missing_workspace' };
+  }
+  if (process.env.ATRIS_SKIP_RUNTIME_BOOTSTRAP === '1') {
+    return { ok: true, skipped: true, reason: 'env' };
+  }
+
+  const command = buildRemoteAtrisBootstrapCommand({
+    boundary,
+    businessSlug: ctx.slug || '',
+    businessId: ctx.businessId,
+    workspaceId: ctx.workspaceId,
+  });
+  const result = await runBusinessTerminalCommand(token, ctx, command, 120);
+  if (!result.ok) {
+    if (!options.quiet) {
+      console.log('  Runtime: bootstrap could not run.');
+      console.log(`  Recovery: atris computer run "npm install --prefix /workspace/.atris-npm atris@latest && /workspace/.atris-npm/node_modules/.bin/atris update" --business ${ctx.slug || ctx.businessId} --workspace ${ctx.workspaceId}`);
+    }
+    return { ok: false, result };
+  }
+
+  const data = result.data || {};
+  const output = String(data.stdout || data.output || data.result || '').trim();
+  const line = output.split('\n').find((entry) => entry.includes('atris_runtime_bootstrap'));
+  const recovery = output.split('\n').find((entry) => entry.startsWith('recovery='));
+  if (!options.quiet) {
+    if (line) {
+      console.log(`  Runtime: ${line.replace(/^atris_runtime_bootstrap\s*/, '')}`);
+    } else {
+      console.log('  Runtime: Atris bootstrap receipt written.');
+    }
+    if (recovery) {
+      console.log(`  Recovery: atris computer run "${recovery.slice('recovery='.length)}" --business ${ctx.slug || ctx.businessId} --workspace ${ctx.workspaceId}`);
+    }
+  }
+  return { ok: true, output };
+}
+
+async function readBusinessWorkspaceFile(token, ctx, remotePath, timeoutMs = 15000) {
+  return apiRequestJson(
+    `/business/${ctx.businessId}/workspaces/${ctx.workspaceId}/file?path=${encodeURIComponent(remotePath)}`,
+    {
+      method: 'GET',
+      token,
+      timeoutMs,
+    }
+  );
+}
+
+function extractRunnerProxyText(payload = {}) {
+  const result = String(payload.result || '').trim();
+  if (result) return result;
+  if (Array.isArray(payload.assistant_text)) {
+    const joined = payload.assistant_text.join('').trim();
+    if (joined) return joined;
+  }
+  if (typeof payload.text === 'string' && payload.text.trim()) {
+    return payload.text.trim();
+  }
+  return '';
+}
+
+async function runBusinessPromptViaRunnerProxy(token, ctx, prompt, options = {}) {
+  const requestId = `cli-${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 8)}`;
+  const remoteDir = '/workspace/.atris-runner-proxy';
+  const outputPath = `${remoteDir}/${requestId}.json`;
+  const scriptPath = `/tmp/atris_runner_proxy_${requestId}.py`;
+  const stdoutPath = `/tmp/atris_runner_proxy_${requestId}.stdout`;
+  const stderrPath = `/tmp/atris_runner_proxy_${requestId}.stderr`;
+  const payload = {
+    prompt,
+    permission_mode: 'bypassPermissions',
+    max_turns: Math.min(Math.max(Number(options.maxTurns || 40), 1), 100),
+    reset_context: Boolean(options.resetContext),
+  };
+  if (options.worker) payload.worker = options.worker;
+  if (options.model) payload.model = options.model;
+  if (options.systemPrompt) payload.system_prompt = options.systemPrompt;
+  if (options.allowedTools) payload.allowed_tools = options.allowedTools;
+  if (options.localCliSessionId) payload.local_cli_session_id = options.localCliSessionId;
+
+  const userId = businessPromptUserId(token);
+  if (userId) payload.user_id = userId;
+
+  const payloadB64 = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
+  const remoteScript = [
+    'import base64, json, pathlib, time, urllib.request',
+    `PAYLOAD = json.loads(base64.b64decode(${JSON.stringify(payloadB64)}).decode("utf-8"))`,
+    `OUTPUT_PATH = pathlib.Path(${JSON.stringify(outputPath)})`,
+    'TOKEN = ""',
+    'with open("/opt/atris/config/env", "r", encoding="utf-8") as fh:',
+    '    for line in fh:',
+    '        if line.startswith("ATRIS_SERVICE_TOKEN="):',
+    '            TOKEN = line.split("=", 1)[1].strip()',
+    '            break',
+    'if not TOKEN:',
+    '    OUTPUT_PATH.write_text(json.dumps({"status":"error","error":"missing ATRIS_SERVICE_TOKEN"}), encoding="utf-8")',
+    '    raise SystemExit(0)',
+    'def _fetch(req, timeout=120):',
+    '    with urllib.request.urlopen(req, timeout=timeout) as resp:',
+    '        return json.loads(resp.read().decode("utf-8"))',
+    'try:',
+    '    start_req = urllib.request.Request(',
+    '        "http://127.0.0.1:8081/execute-background",',
+    '        data=json.dumps(PAYLOAD).encode("utf-8"),',
+    '        headers={"Content-Type":"application/json","X-Atris-Service-Token":TOKEN},',
+    '        method="POST",',
+    '    )',
+    '    start = _fetch(start_req)',
+    '    execution_id = start.get("execution_id")',
+    '    result = {"execution_id": execution_id, "assistant_text": [], "result": "", "status": "running", "result_event": None}',
+    '    from_index = 0',
+    '    deadline = time.time() + 300',
+    '    while time.time() < deadline:',
+    '        poll_req = urllib.request.Request(',
+    '            f"http://127.0.0.1:8081/events?execution_id={execution_id}&from_index={from_index}",',
+    '            headers={"X-Atris-Service-Token":TOKEN},',
+    '            method="GET",',
+    '        )',
+    '        data = _fetch(poll_req, timeout=60)',
+    '        events = data.get("events") or []',
+    '        for event in events:',
+    '            typ = event.get("type")',
+    '            if typ in ("assistant_text", "text"):',
+    '                content = event.get("content") or ""',
+    '                if content:',
+    '                    result["assistant_text"].append(content)',
+    '            elif typ == "result":',
+    '                result["result"] = event.get("result") or result["result"]',
+    '                result["result_event"] = event',
+    '        from_index = data.get("next_index", from_index + len(events))',
+    '        result["status"] = data.get("status") or result["status"]',
+    '        if result["status"] in ("completed", "failed", "error", "cancelled"):',
+    '            break',
+    '        time.sleep(2)',
+    '    OUTPUT_PATH.write_text(json.dumps(result), encoding="utf-8")',
+    'except Exception as exc:',
+    '    OUTPUT_PATH.write_text(json.dumps({"execution_id": None, "assistant_text": [], "result": "", "status": "error", "error": str(exc)}), encoding="utf-8")',
+  ].join('\n');
+
+  const launcher = [
+    `mkdir -p ${shellQuote(remoteDir)}`,
+    `cat > ${shellQuote(scriptPath)} <<'PY'`,
+    remoteScript,
+    'PY',
+    `nohup python3 ${shellQuote(scriptPath)} >${shellQuote(stdoutPath)} 2>${shellQuote(stderrPath)} < /dev/null &`,
+    'echo launched',
+  ].join('\n');
+
+  const launchResult = await runBusinessTerminalCommand(token, ctx, launcher, 30);
+  if (!launchResult.ok) {
+    return {
+      ok: false,
+      error: launchResult.error || `launcher failed (${launchResult.status})`,
+      status: launchResult.status,
+    };
+  }
+
+  const deadline = Date.now() + 330000;
+  while (Date.now() < deadline) {
+    const fileResult = await readBusinessWorkspaceFile(token, ctx, outputPath, 15000);
+    if (!fileResult.ok) {
+      if (fileResult.status === 404) {
+        await sleep(2000);
+        continue;
+      }
+      return {
+        ok: false,
+        error: fileResult.error || `runner proxy read failed (${fileResult.status})`,
+        status: fileResult.status,
+      };
+    }
+    try {
+      const payload = JSON.parse(fileResult.data?.content || '{}');
+      const status = payload.status || 'unknown';
+      if (['completed', 'failed', 'error', 'cancelled', 'timeout'].includes(status)) {
+        return { ok: status === 'completed', payload, status };
+      }
+    } catch {
+      // Ignore partial file writes and keep polling.
+    }
+    await sleep(2000);
+  }
+
+  return { ok: false, error: 'runner proxy timed out', status: 0 };
+}
+
+async function ensureBusinessAwake(token, ctx, maxWaitSec = 90, options = {}) {
+  const status = await apiRequestJson(`/business/${ctx.businessId}/ai-computer/status`, { method: 'GET', token });
+  abortOnAuthFailure(status);
+  if (status.ok && status.data && status.data.status === 'running' && status.data.endpoint) {
+    return true;
+  }
+  if (!options.quiet) process.stdout.write('  Waking business computer... ');
+  const wake = await apiRequestJson(`/business/${ctx.businessId}/ai-computer/wake`, { method: 'POST', token, body: {} });
+  abortOnAuthFailure(wake, !options.quiet);
+  const start = Date.now();
+  while (Date.now() - start < maxWaitSec * 1000) {
+    await sleep(3000);
+    const next = await apiRequestJson(`/business/${ctx.businessId}/ai-computer/status`, { method: 'GET', token });
+    abortOnAuthFailure(next, !options.quiet);
+    if (next.ok && next.data && next.data.status === 'running' && next.data.endpoint) {
+      const elapsed = Math.floor((Date.now() - start) / 1000);
+      if (!options.quiet) console.log(`awake (${elapsed}s)`);
+      await bootstrapBusinessComputerRuntime(token, ctx, 'computer-auto-wake', options);
+      return true;
+    }
+  }
+  if (!options.quiet) console.log('timeout');
+  return false;
+}
+
+async function cancelBusinessChat(token, ctx, executionId) {
+  return apiRequestJson(
+    `/business/${ctx.businessId}/chat/cancel?execution_id=${encodeURIComponent(executionId)}&workspace_id=${encodeURIComponent(ctx.workspaceId)}`,
+    { method: 'POST', token, timeoutMs: 15000, retries: 0 }
+  );
+}
+
+async function fetchBusinessChatAudit(token, ctx, limit = 10) {
+  return apiRequestJson(
+    `/business/${ctx.businessId}/chat/audit?workspace_id=${encodeURIComponent(ctx.workspaceId)}&limit=${Math.max(1, Math.min(limit, 25))}`,
+    { method: 'GET', token, timeoutMs: 15000, retries: 0 }
+  );
+}
+
+async function startBusinessClaudeLogin(token, ctx) {
+  return apiRequestJson('/sandbox-secrets/claude-login/start', {
+    method: 'POST',
+    token,
+    body: { business_id: ctx.businessId },
+    timeoutMs: 15000,
+    retries: 0,
+  });
+}
+
+async function fetchBusinessClaudeLoginStatus(token, ctx) {
+  return apiRequestJson(
+    `/sandbox-secrets/claude-login/status?business_id=${encodeURIComponent(ctx.businessId)}`,
+    { method: 'GET', token, timeoutMs: 15000, retries: 0 }
+  );
+}
+
+async function submitBusinessClaudeLoginCode(token, ctx, code) {
+  return apiRequestJson('/sandbox-secrets/claude-login/input', {
+    method: 'POST',
+    token,
+    body: { business_id: ctx.businessId, code },
+    timeoutMs: 15000,
+    retries: 0,
+  });
+}
+
+async function stopBusinessClaudeLogin(token, ctx) {
+  return apiRequestJson('/sandbox-secrets/claude-login/stop', {
+    method: 'POST',
+    token,
+    body: { business_id: ctx.businessId },
+    timeoutMs: 15000,
+    retries: 0,
+  });
+}
+
+function maybeOpenUrl(url) {
+  if (!url) return;
+  if (process.platform === 'darwin') {
+    spawnSync('open', [url], { stdio: 'ignore' });
+  }
+}
+
+async function computerCloudLogin(token, ctx, rawArg = '') {
+  if (!ctx) {
+    console.error('Cloud login requires a bound business workspace.');
+    return;
+  }
+
+  const arg = String(rawArg || '').trim();
+  if (arg.toLowerCase() === 'stop') {
+    const stopped = await stopBusinessClaudeLogin(token, ctx);
+    if (!stopped.ok) {
+      console.error(`Failed: ${stopped.errorMessage || stopped.status}`);
+      return;
+    }
+    console.log('Claude login stopped.');
+    return;
+  }
+
+  if (arg) {
+    const submitted = await submitBusinessClaudeLoginCode(token, ctx, arg);
+    if (!submitted.ok) {
+      console.error(`Failed: ${submitted.errorMessage || submitted.status}`);
+      return;
+    }
+    console.log(`Claude login status: ${submitted.data?.status || 'running'}`);
+    return;
+  }
+
+  const started = await startBusinessClaudeLogin(token, ctx);
+  if (!started.ok) {
+    console.error(`Failed: ${started.errorMessage || started.status}`);
+    return;
+  }
+
+  let state = started.data || {};
+  const startedAt = Date.now();
+  while (!state.url && !['completed', 'failed', 'idle'].includes(state.status || '') && Date.now() - startedAt < 15000) {
+    await sleep(1000);
+    const status = await fetchBusinessClaudeLoginStatus(token, ctx);
+    if (!status.ok) {
+      console.error(`Failed: ${status.errorMessage || status.status}`);
+      return;
+    }
+    state = status.data || {};
+  }
+
+  if (state.loggedIn || state.status === 'completed') {
+    console.log('Claude App is already logged in on this computer.');
+    return;
+  }
+  if (state.url) {
+    console.log('Open this URL to log the remote computer into your Claude subscription:');
+    console.log(state.url);
+    maybeOpenUrl(state.url);
+    console.log('After approval, paste the code with `/login <code>`.');
+    return;
+  }
+  if (state.output) {
+    console.log(state.output);
+    console.log('If Claude asks for a code, paste it with `/login <code>`.');
+    return;
+  }
+  console.log(`Claude login status: ${state.status || 'unknown'}`);
+}
+
+function printBusinessChatAudit(rows) {
+  console.log('');
+  console.log(ui.bold('Recent cloud runs'));
+  if (!rows.length) {
+    console.log('  No recent cloud runs.');
+    return;
+  }
+  for (const row of rows) {
+    const when = row.started_at ? String(row.started_at).replace('T', ' ').replace(/\.\d+/, '').replace('+00:00', 'Z') : '-';
+    const tokens = Number.isFinite(row.tokens_used) ? `${row.tokens_used} tok` : '-';
+    const cost = Number.isFinite(row.cost_usd) ? `$${Number(row.cost_usd).toFixed(4)}` : '-';
+    const credits = Number(row.credits_charged || 0);
+    const charge = credits > 0 ? ui.yellow(`${credits} cr`) : ui.green('0 cr');
+    console.log(`  ${when}  ${row.status || 'unknown'}  ${tokens}  cost ${cost}  charge ${charge}`);
+    if (row.worker || row.model) console.log(`    ${row.worker || '-'}  ${row.model || '-'}`);
+    if (row.preview) console.log(`    ${String(row.preview).slice(0, 140)}`);
+    if (row.result_preview) console.log(`    => ${String(row.result_preview).slice(0, 180)}`);
+  }
+}
+
+async function computerAudit(token, ctx, limit = 10) {
+  if (!ctx) {
+    console.error('Cloud audit requires a bound business workspace.');
+    return;
+  }
+  const result = await fetchBusinessChatAudit(token, ctx, limit);
+  if (!result.ok) {
+    console.error(`Failed: ${result.errorMessage || result.status}`);
+    return;
+  }
+  printBusinessChatAudit(result.data?.rows || []);
+}
+
+module.exports = {
+  VALID_CLOUD_WORKERS,
+  VALID_COMPUTER_TYPES,
+  RECRUITING_BUSINESS_SLUG,
+  RECRUITING_LOCAL_SYNC_COMMANDS,
+  KNOWN_CHAT_COMMANDS,
+  CODEOPS_WORKFLOW_PROMPT,
+  RECRUITING_WORKFLOW_PROMPT,
+  sleep,
+  askComputerSetup,
+  setupComputerChoices,
+  chooseSetupComputer,
+  chooseSetupProviders,
+  ui,
+  useInteractiveCloudUi,
+  useInteractiveTerminalUi,
+  readPipedStdin,
+  printCloudWordmark,
+  printLocalWordmark,
+  activeWorker,
+  formatWorkerName,
+  extractAttachedWorkspaceMismatch,
+  contextForAttachedWorkspaceMismatch,
+  describeClaudeAuth,
+  describeBillingMode,
+  printCloudHelp,
+  printCloudStartPanel,
+  appendSystemPrompt,
+  codeOpsCloudOptions,
+  recruitingCloudOptions,
+  printCodeOpsStartPanel,
+  printCodeOpsWorkflowContract,
+  printRecruitingWorkflowContract,
+  printRecruitingComputerHelp,
+  withoutRecruitingWrapperFlags,
+  printRecruitingLocalSyncOutcome,
+  runRecruitingLocalSyncCommand,
+  runRecruitingSyncHelper,
+  buildLocalBridgeSystemPrompt,
+  printLocalAtrisStartPanel,
+  printCloudSessionStatus,
+  questionAsync,
+  chooseComputerSurface,
+  chooseCloudLane,
+  parseComputerOptions,
+  parseComputerCreateArgs,
+  computerCreateArgsHaveName,
+  normalizeComputerType,
+  formatComputerTypeList,
+  parseComputerDeleteArgs,
+  formatCloudSelection,
+  findAtrisCodeTerminal,
+  computerLocalLegacy,
+  computerLocal,
+  startLocalAtrisBridge,
+  runLocalBridgeOp,
+  readBusinessBinding,
+  buildComputerCard,
+  renderComputerCard,
+  renderComputerCardMarkdown,
+  parseComputerCardArgs,
+  computerCard,
+  resolveBusinessContext,
+  resolveBusinessContextBySlug,
+  resolveComputerCommandContext,
+  resolveTypedBusinessComputerContext,
+  printMissingTypedComputer,
+  looksLikeWorkspaceId,
+  resolveBusinessOwnerForCreate,
+  apiFailureDetail,
+  printComputerCommandFailure,
+  rememberBusinessWorkspace,
+  rememberCreatedComputer,
+  shellQuote,
+  listBusinessWorkspaces,
+  formatWorkspaceRef,
+  workspaceMatchesInput,
+  resolveWorkspaceFromList,
+  workspaceMatchesComputerType,
+  formatLeaseAge,
+  probeAttachedWorkspace,
+  bootstrapBusinessComputerRuntime,
+  readBusinessWorkspaceFile,
+  extractRunnerProxyText,
+  runBusinessPromptViaRunnerProxy,
+  ensureBusinessAwake,
+  cancelBusinessChat,
+  fetchBusinessChatAudit,
+  computerCloudLogin,
+  computerAudit,
+};