bostrat-node 0.2.4 → 0.2.6

package/bin/bostrat-changelog

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import g from"node:fs/promises";var h=process.env.BOSTRAT_AGENT_URL||`http://127.0.0.1:${process.env.BOSTRAT_AGENT_PORT||3362}`;async function l(n,t,e){let s=await fetch(`${h}${t}`,{method:n,headers:e?{"content-type":"application/json"}:void 0,body:e?JSON.stringify(e):void 0}),o=await s.json().catch(()=>({}));if(!s.ok)throw new Error(o.error||`HTTP ${s.status}`);return o}function r(n){console.error(`[bostrat-changelog] ${n}`),process.exit(1)}var i=process.argv.slice(2),a=i.shift();if(a==="draft"){let n=null;for(let t=0;t<i.length;t++)i[t]==="--since"&&(n=i[++t]);try{let t=n?`?since=${encodeURIComponent(n)}`:"",{since:e,prs:s}=await l("GET",`/api/changelog/draft${t}`);s.length||(console.log(`EMPTY WINDOW \u2014 nothing merged since ${new Date(e).toISOString()}; publish nothing.`),process.exit(0)),console.log(`Merged since ${new Date(e).toISOString()}:`);for(let o of s){let c=o.mergedAt?` (merged ${new Date(o.mergedAt).toISOString()})`:"";console.log(`- ${o.repo}#${o.number} \u2014 ${o.title||"(no title recorded)"}${c}${o.url?` ${o.url}`:""}`)}}catch(t){r(t.message)}}else if(a==="publish"){let n=null,t=null;for(let e=0;e<i.length;e++)i[e]==="--day"?n=i[++e]:i[e].startsWith("--")||(t=i[e]);t||r("usage: bostrat-changelog publish <file.md> [--day YYYY-MM-DD]");try{let e=await g.readFile(t,"utf8").catch(()=>r(`cannot read ${t}`)),{entry:s}=await l("POST","/api/changelog/publish",{md:e,cwd:process.cwd(),...n?{day:n}:{}});console.log(`[bostrat-changelog] published ${s.day}: ${s.bullets.length} bullet(s)${s.title?` under "${s.title}"`:""}`),console.log("The operator sees it in Settings \u2192 Changelog \u2014 re-publishing the same day replaces this entry.")}catch(e){r(e.message)}}else r("usage: bostrat-changelog <draft|publish> \u2026  (draft [--since 24h]; publish <file.md> [--day YYYY-MM-DD])");

package/bin/bostrat-git-credential

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-var o=process.argv.slice(2),a=o[o.length-1],c=(o.length>1?o[0]:"")||process.env.BOSTRAT_AGENT_URL||"http://127.0.0.1:3362";a!=="get"&&process.exit(0);var r="";process.stdin.setEncoding("utf8");process.stdin.on("data",e=>r+=e);process.stdin.on("end",async()=>{let e={};for(let t of r.split(`
-`)){let s=t.indexOf("=");s>0&&(e[t.slice(0,s)]=t.slice(s+1).trim())}(e.host!=="github.com"||e.protocol&&e.protocol!=="https")&&process.exit(0);let n=String(e.path||"").replace(/^\/+/,"").replace(/\.git$/,"");/^[^/\s]+\/[^/\s]+$/.test(n)||process.exit(0);try{let t=await fetch(`${c.replace(/\/+$/,"")}/api/github/token?repo=${encodeURIComponent(n)}`);if(!t.ok){let i=await t.json().catch(()=>({}));process.stderr.write(`bostrat-git-credential: ${i?.error||`agent replied ${t.status}`}
-`),process.exit(0)}let{token:s}=await t.json();s&&process.stdout.write(`username=x-access-token
-password=${s}
-`)}catch(t){process.stderr.write(`bostrat-git-credential: agent unreachable at ${c} (${t?.message||t})
+var n=process.argv.slice(2),p=n[n.length-1],r=(n.length>1?n[0]:"")||process.env.BOSTRAT_AGENT_URL||"http://127.0.0.1:3362";p!=="get"&&process.exit(0);var i="";process.stdin.setEncoding("utf8");process.stdin.on("data",s=>i+=s);process.stdin.on("end",async()=>{let s={};for(let e of i.split(`
+`)){let t=e.indexOf("=");t>0&&(s[e.slice(0,t)]=e.slice(t+1).trim())}(s.host!=="github.com"||s.protocol&&s.protocol!=="https")&&process.exit(0);let c=String(s.path||"").replace(/^\/+/,"").replace(/\.git$/,"");/^[^/\s]+\/[^/\s]+$/.test(c)||process.exit(0);let o=process.env.BOSTRAT_NODE_API_TOKEN||"";if(!o)try{let e=process.getBuiltinModule("node:fs"),t=`${process.env.BOSTRAT_STATE_DIR||`${process.env.HOME}/.bostrat`}/api-token`;o=e.readFileSync(t,"utf8").trim()}catch{}try{let e=await fetch(`${r.replace(/\/+$/,"")}/api/github/token?repo=${encodeURIComponent(c)}`,{headers:o?{"x-bostrat-token":o}:{}});if(!e.ok){let a=await e.json().catch(()=>({}));process.stderr.write(`bostrat-git-credential: ${a?.error||`agent replied ${e.status}`}
+`),process.exit(0)}let{token:t}=await e.json();t&&process.stdout.write(`username=x-access-token
+password=${t}
+`)}catch(e){process.stderr.write(`bostrat-git-credential: agent unreachable at ${r} (${e?.message||e})
 `)}process.exit(0)});

package/bin/bostrat-gmail

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+var r=process.env.BOSTRAT_AGENT_URL||`http://127.0.0.1:${process.env.BOSTRAT_AGENT_PORT||process.env.PORT||3362}`;async function c(s){let e=await fetch(`${r}${s}`),o=await e.json().catch(()=>({}));if(!e.ok)throw new Error(o.error||`HTTP ${e.status}`);return o}function n(s){console.error(`[bostrat-gmail] ${s}`),process.exit(1)}var a=process.argv.slice(2),l=a.shift();if(l==="search"){let s=null,e=10;for(let o=0;o<a.length;o++)a[o]==="--max"?e=Number(a[++o])||10:s===null&&(s=a[o]);s===null&&n('usage: bostrat-gmail search "<gmail query>" [--max N]');try{let{messages:o}=await c(`/api/gmail/search?q=${encodeURIComponent(s)}&max=${e}`);o.length||(console.log("(no messages match)"),process.exit(0));for(let t of o)console.log(`${t.unread?"\u25CF":"\u25CB"} ${t.id}  ${t.date||""}`),console.log(`  from: ${t.from||"?"}`),console.log(`  subj: ${t.subject||"(no subject)"}`),t.snippet&&console.log(`  ${t.snippet}`)}catch(o){n(o.message)}}else if(l==="read"){let s=a[0];s||n("usage: bostrat-gmail read <messageId>");try{let{message:e}=await c(`/api/gmail/messages/${encodeURIComponent(s)}`);console.log(`From:    ${e.from||"?"}`),console.log(`To:      ${e.to||"?"}`),console.log(`Subject: ${e.subject||"(no subject)"}`),console.log(`Date:    ${e.date||"?"}`),e.attachments?.length&&console.log(`Attachments: ${e.attachments.map(o=>`${o.name} (${o.size}b)`).join(", ")}`),console.log(""),console.log(e.body||"(no text body)")}catch(e){n(e.message)}}else n('usage: bostrat-gmail <search|read> \u2026  (search "<gmail query>" [--max N] \xB7 read <messageId>)');

package/bin/bostrat-notify

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+var a=process.env.BOSTRAT_AGENT_URL||`http://127.0.0.1:${process.env.BOSTRAT_AGENT_PORT||3362}`;function s(t){console.error(`[bostrat-notify] ${t}`),process.exit(1)}var e=process.argv.slice(2),n=null,l=!1,r=[];for(let t=0;t<e.length;t++)e[t]==="--title"?n=e[++t]:e[t]==="--urgent"?l=!0:e[t]==="--help"||e[t]==="-h"?(console.log('usage: bostrat-notify "<message>" [--title "<title>"] [--urgent]'),process.exit(0)):r.push(e[t]);var i=r.join(" ").trim();i||s('usage: bostrat-notify "<message>" [--title "<title>"] [--urgent]');try{let t=await fetch(`${a}/api/notify`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({title:n,body:i,urgency:l?"high":"normal",cwd:process.cwd()})}),o=await t.json().catch(()=>({}));t.ok||s(o.error||`HTTP ${t.status}`),console.log(`[bostrat-notify] sent: ${o.notification?.title??"Bostrat"} \u2014 ${o.notification?.body??i}`),o.delivered===!1&&console.log("Note: this node isn't linked to the plane right now \u2014 it will deliver when the link is back.")}catch(t){s(t.message)}

package/bin/gh

@@ -43,8 +43,19 @@ case "$slug" in
 esac
 
 agent_url="${BOSTRAT_AGENT_URL:-http://127.0.0.1:3362}"
-token="$(curl -fsS --max-time 10 "$agent_url/api/github/token?repo=$slug" 2>/dev/null \
-  | sed -nE 's/.*"token":"([^"]+)".*/\1/p')"
+# /api/github/token is a SENSITIVE route (api-token.js rule 2): it requires the
+# node API token even from loopback. Same uid, same file the agent minted it to.
+ntoken="${BOSTRAT_NODE_API_TOKEN:-}"
+if [ -z "$ntoken" ]; then
+  ntoken="$(cat "${BOSTRAT_STATE_DIR:-$HOME/.bostrat}/api-token" 2>/dev/null | tr -d '[:space:]')"
+fi
+if [ -n "$ntoken" ]; then
+  token="$(curl -fsS --max-time 10 -H "x-bostrat-token: $ntoken" "$agent_url/api/github/token?repo=$slug" 2>/dev/null \
+    | sed -nE 's/.*"token":"([^"]+)".*/\1/p')"
+else
+  token="$(curl -fsS --max-time 10 "$agent_url/api/github/token?repo=$slug" 2>/dev/null \
+    | sed -nE 's/.*"token":"([^"]+)".*/\1/p')"
+fi
 if [ -n "$token" ]; then
   GH_TOKEN="$token" exec "$real" "$@"
 fi

package/dist/cli.js

@@ -1,4 +1,4 @@
-var se=Object.defineProperty;var ie=(e,t)=>()=>(e&&(t=e(e=0)),t);var ae=(e,t)=>{for(var n in t)se(e,n,{get:t[n],enumerable:!0})};var ee={};ae(ee,{commandPlan:()=>q,flyDockerfile:()=>J,flyToml:()=>V,flyWizard:()=>Oe,parseFlyFlags:()=>Z,stageBuild:()=>Q});import S from"node:fs";import f from"node:path";import ye from"node:os";import he from"node:readline/promises";import{execFile as we}from"node:child_process";import{randomUUID as ge}from"node:crypto";import{fileURLToPath as Te}from"node:url";function V({app:e,region:t,nodeName:n=e,planeUrl:o=X}){return`# bostrat node on YOUR Fly org \u2014 written by \`bostrat-node fly\`.
+var ie=Object.defineProperty;var ae=(e,t)=>()=>(e&&(t=e(e=0)),t);var ce=(e,t)=>{for(var n in t)ie(e,n,{get:t[n],enumerable:!0})};var te={};ce(te,{NODE_IMAGE:()=>F,commandPlan:()=>q,flyToml:()=>J,flyWizard:()=>be,parseFlyFlags:()=>Q,stageConfig:()=>ee});import U from"node:fs";import _ from"node:path";import ge from"node:os";import we from"node:readline/promises";import{execFile as Te}from"node:child_process";import{createRequire as _e}from"node:module";import{randomUUID as Se}from"node:crypto";function J({app:e,region:t,nodeName:n=e,planeUrl:o=Z,image:s=F}){return`# bostrat node on YOUR Fly org \u2014 written by \`bostrat-node fly\`.
 # Redeploy after edits: fly deploy <this dir> -c <this file> -a ${e} --ha=false
 # No [http_service] and none should be added: the node dials OUT to the plane;
 # nothing inbound, ever. The node token lives in \`fly secrets\`, not here.
@@ -6,7 +6,10 @@ app = "${e}"
 primary_region = "${t}"
 
 [build]
-  dockerfile = "Dockerfile"
+  # The published node image (claude + cursor-agent + codex baked in, logged
+  # out), pinned to the bostrat-node version that wrote this file. Update with:
+  # npm i -g bostrat-node && bostrat-node fly (re-run is safe), or bump the tag.
+  image = "${s}"
 
 [env]
   PORT = "3362"
@@ -31,87 +34,64 @@ primary_region = "${t}"
   # Scale later with: fly scale memory 4096 -a ${e}
   size = "shared-cpu-2x"
   memory = "2gb"
-`}function J({layout:e="src"}={}){return`# bostrat node image \u2014 written by \`bostrat-node fly\`; context = this directory.
-FROM node:24-slim AS deps
-RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \\
-  && rm -rf /var/lib/apt/lists/*
-WORKDIR /app/agent
-COPY package.json package-lock.json* ./
-RUN npm install --omit=dev --no-audit --no-fund
-
-FROM node:24-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \\
-    tmux git ca-certificates curl procps openssh-client \\
-  && rm -rf /var/lib/apt/lists/*
-RUN npm install -g @anthropic-ai/claude-code --no-audit --no-fund
-WORKDIR /app/agent
-COPY --from=deps /app/agent/node_modules ./node_modules
-COPY package.json ./
-COPY ${e} ./${e}
-COPY bin ./bin
-COPY node-entrypoint.sh /usr/local/bin/node-entrypoint.sh
-RUN chmod +x /usr/local/bin/node-entrypoint.sh
-ENV NODE_ENV=production
-ENV HOME=/data/home
-CMD ["node-entrypoint.sh"]
 `}function q({app:e,org:t,region:n,sizeGb:o,token:s,owner:r,dir:i}){let a=[`BOSTRAT_PLANE_TOKEN=${s}`,...r?[`BOSTRAT_OWNER=${r}`]:[]];return[{argv:["apps","create",e,"-o",t],display:`fly apps create ${e} -o ${t}`,tolerate:/already|taken|exists/i},{argv:["volumes","create","node_data","-a",e,"-r",n,"-s",String(o),"-y"],display:`fly volumes create node_data -a ${e} -r ${n} -s ${o} -y`,tolerate:/already|exists/i},{argv:["secrets","import","-a",e,"--stage"],display:`fly secrets import -a ${e} --stage   # BOSTRAT_PLANE_TOKEN=<redacted>${r?" BOSTRAT_OWNER=\u2026":""} via stdin`,stdin:a.join(`
 `)+`
-`},{argv:["deploy",i,"-c",f.join(i,"fly.toml"),"-a",e,"--ha=false"],display:`fly deploy ${i} -c ${f.join(i,"fly.toml")} -a ${e} --ha=false`}]}function Z(e=[]){let t={},n={"--app":"app","--org":"org","--region":"region","--size-gb":"sizeGb","--name":"name","--plane-url":"planeUrl","--token":"token","--owner":"owner"};for(let o=0;o<e.length;o++){let s=e[o];if(s==="--yes"||s==="-y")t.yes=!0;else if(n[s])t[n[s]]=e[++o]??"";else if(s.startsWith("--")&&s.includes("=")){let[r,...i]=s.split("=");n[r]?t[n[r]]=i.join("="):r==="--yes"&&(t.yes=!0)}}return t.sizeGb!=null&&(t.sizeGb=Number(t.sizeGb)||10),t}function Q({app:e,agentDir:t=_e,dest:n,toml:o}){let s=n||f.join(ye.homedir(),".bostrat","fly",e);S.mkdirSync(s,{recursive:!0});let r=[],i=(u,{optional:p=!1}={})=>{let l=f.join(t,u);if(!S.existsSync(l)){if(p)return;throw new Error(`staging: ${l} missing \u2014 is this a complete bostrat-agent install?`)}S.cpSync(l,f.join(s,u),{recursive:!0}),r.push(u)};i("package.json"),i("package-lock.json",{optional:!0});let a=S.existsSync(f.join(t,"src"))?"src":"dist";return i(a),i("bin"),i("node-entrypoint.sh"),S.writeFileSync(f.join(s,".dockerignore"),`node_modules
-`),S.writeFileSync(f.join(s,"Dockerfile"),J({layout:a})),S.writeFileSync(f.join(s,"fly.toml"),o),r.push(".dockerignore","Dockerfile","fly.toml"),{dir:s,manifest:r}}async function Se({ask:e,output:t,exec:n,flag:o}){if(o)return o;try{let{stdout:s}=await B(["orgs","list","--json"],{exec:n}),r=JSON.parse(s),i=Array.isArray(r)?r.map(a=>a.Slug||a.slug).filter(Boolean):Object.keys(r);if(i.length===1)return t.write(`Org: ${i[0]} (your only org)
-`),i[0];if(i.length>1)return await e(`Fly org (${i.join(" / ")})`,i[0])}catch{}return await e("Fly org slug (see `fly orgs list`)","personal")}async function Oe({argv:e=[],input:t=process.stdin,output:n=process.stdout,exec:o,stageDest:s}={}){let r=Z(e),i=he.createInterface({input:t,output:n}),a=async(c,y)=>(await i.question(y?`${c} [${y}]: `:`${c}: `)).trim()||y||"",u=c=>(i.close(),c);n.write(`bostrat-node fly \u2014 a node on YOUR Fly org, on your bill.
+`},{argv:["deploy",i,"-c",_.join(i,"fly.toml"),"-a",e,"--ha=false"],display:`fly deploy ${i} -c ${_.join(i,"fly.toml")} -a ${e} --ha=false`}]}function Q(e=[]){let t={},n={"--app":"app","--org":"org","--region":"region","--size-gb":"sizeGb","--name":"name","--plane-url":"planeUrl","--token":"token","--owner":"owner","--image":"image"};for(let o=0;o<e.length;o++){let s=e[o];if(s==="--yes"||s==="-y")t.yes=!0;else if(n[s])t[n[s]]=e[++o]??"";else if(s.startsWith("--")&&s.includes("=")){let[r,...i]=s.split("=");n[r]?t[n[r]]=i.join("="):r==="--yes"&&(t.yes=!0)}}return t.sizeGb!=null&&(t.sizeGb=Number(t.sizeGb)||10),t}function ee({app:e,dest:t,toml:n}){let o=t||_.join(ge.homedir(),".bostrat","fly",e);U.mkdirSync(o,{recursive:!0});for(let s of["Dockerfile",".dockerignore","package.json","package-lock.json","src","dist","bin","node-entrypoint.sh"])U.rmSync(_.join(o,s),{recursive:!0,force:!0});return U.writeFileSync(_.join(o,"fly.toml"),n),{dir:o,manifest:["fly.toml"]}}async function Ae({ask:e,output:t,exec:n,flag:o}){if(o)return o;try{let{stdout:s}=await I(["orgs","list","--json"],{exec:n}),r=JSON.parse(s),i=Array.isArray(r)?r.map(a=>a.Slug||a.slug).filter(Boolean):Object.keys(r);if(i.length===1)return t.write(`Org: ${i[0]} (your only org)
+`),i[0];if(i.length>1)return await e(`Fly org (${i.join(" / ")})`,i[0])}catch{}return await e("Fly org slug (see `fly orgs list`)","personal")}async function be({argv:e=[],input:t=process.stdin,output:n=process.stdout,exec:o,stageDest:s}={}){let r=Q(e),i=we.createInterface({input:t,output:n}),a=async(c,m)=>(await i.question(m?`${c} [${m}]: `:`${c}: `)).trim()||m||"",d=c=>(i.close(),c);n.write(`bostrat-node fly \u2014 a node on YOUR Fly org, on your bill.
 bostrat never sees your Fly account: this wizard only runs your own \`fly\` CLI.
 
-`);try{await B(["version"],{exec:o})}catch{return n.write("\u2717 `fly` (flyctl) is not installed or not on PATH.\n  install: https://fly.io/docs/flyctl/install/  \u2014 then re-run `bostrat-node fly`\n"),u(1)}try{let{stdout:c}=await B(["auth","whoami"],{exec:o});n.write(`\u2713 signed in to Fly as ${c.trim()}
-`)}catch{return n.write("\u2717 not signed in to Fly. Run `fly auth login` (or `fly auth signup`) and re-run `bostrat-node fly`.\n"),u(1)}let p=await Se({ask:a,output:n,exec:o,flag:r.org}),l=r.app||await a("App name",`bostrat-node-${ge().slice(0,4)}`),k=r.region||await a("Region (see `fly platform regions`)","iad"),C=r.sizeGb||Number(await a("Volume size GB (logins + repos live here)","10"))||10,g=r.name||l,v=r.planeUrl||X,E=r.token||await a("Node token (minted in the bostrat setup chat \u2014 shown once)");if(!E)return n.write(`\u2717 a node token is required \u2014 mint one in the bostrat setup chat (Connect a node \u2192 Fly), then re-run with it.
-`),u(1);let j=r.owner??await a("Owner userId (shown next to the token; empty = infer from token)",""),{dir:T,manifest:N}=Q({app:l,dest:s,toml:V({app:l,region:k,nodeName:g,planeUrl:v})});n.write(`
-staged build context \u2192 ${T} (${N.join(", ")})
+`);try{await I(["version"],{exec:o})}catch{return n.write("\u2717 `fly` (flyctl) is not installed or not on PATH.\n  install: https://fly.io/docs/flyctl/install/  \u2014 then re-run `bostrat-node fly`\n"),d(1)}try{let{stdout:c}=await I(["auth","whoami"],{exec:o});n.write(`\u2713 signed in to Fly as ${c.trim()}
+`)}catch{return n.write("\u2717 not signed in to Fly. Run `fly auth login` (or `fly auth signup`) and re-run `bostrat-node fly`.\n"),d(1)}let p=await Ae({ask:a,output:n,exec:o,flag:r.org}),u=r.app||await a("App name",`bostrat-node-${Se().slice(0,4)}`),k=r.region||await a("Region (see `fly platform regions`)","iad"),B=r.sizeGb||Number(await a("Volume size GB (logins + repos live here)","10"))||10,g=r.name||u,E=r.planeUrl||Z,R=r.token||await a("Node token (minted in the bostrat setup chat \u2014 shown once)");if(!R)return n.write(`\u2717 a node token is required \u2014 mint one in the bostrat setup chat (Connect a node \u2192 Fly), then re-run with it.
+`),d(1);let C=r.owner??await a("Owner userId (shown next to the token; empty = infer from token)",""),v=r.image||F,{dir:w}=ee({app:u,dest:s,toml:J({app:u,region:k,nodeName:g,planeUrl:E,image:v})});n.write(`
+wrote ${_.join(w,"fly.toml")} \u2014 deploys the prebuilt node image ${v}
+(claude + cursor-agent + codex baked in, logged out; nothing builds on your machine)
 
 Plan (your flyctl, your org, your bill):
-`);let _=q({app:l,org:p,region:k,sizeGb:C,token:E,owner:j,dir:T});for(let c of _)n.write(`  $ ${c.display}
+`);let T=q({app:u,org:p,region:k,sizeGb:B,token:R,owner:C,dir:w});for(let c of T)n.write(`  $ ${c.display}
 `);if(!r.yes&&(await a(`
 Run it? (Y/n)`,"Y")).toLowerCase().startsWith("n"))return n.write(`aborted \u2014 nothing was created. Re-run any time; the staged context is kept.
-`),u(1);for(let c of _){n.write(`
+`),d(1);for(let c of T){n.write(`
 \u2192 ${c.display}
-`);try{let{stdout:y,stderr:$}=await B(c.argv,{stdin:c.stdin,exec:o}),K=`${y||""}${$||""}`.trim();K&&n.write(K.split(`
-`).map(re=>`  ${re}`).join(`
+`);try{let{stdout:m,stderr:$}=await I(c.argv,{stdin:c.stdin,exec:o}),z=`${m||""}${$||""}`.trim();z&&n.write(z.split(`
+`).map(se=>`  ${se}`).join(`
 `)+`
-`)}catch(y){let $=`${y?.stdout||""}${y?.stderr||""}${y?.message||""}`;if(c.tolerate&&c.tolerate.test($)){n.write(`  (already exists \u2014 continuing)
+`)}catch(m){let $=`${m?.stdout||""}${m?.stderr||""}${m?.message||""}`;if(c.tolerate&&c.tolerate.test($)){n.write(`  (already exists \u2014 continuing)
 `);continue}return n.write(`\u2717 failed: ${$.trim().split(`
 `).slice(-4).join(`
 `)}
   fix and re-run \`bostrat-node fly\` \u2014 every step is safe to repeat.
-`),u(1)}}return n.write(`
+`),d(1)}}return n.write(`
 \u2713 deployed. The node dials out to the plane by itself \u2014 watch the bostrat setup
   chat: the node step advances on its own within a minute.
-  logs:     fly logs -a ${l}
-  redeploy: fly deploy ${T} -c ${f.join(T,"fly.toml")} -a ${l} --ha=false
+  logs:     fly logs -a ${u}
+  redeploy: fly deploy ${w} -c ${_.join(w,"fly.toml")} -a ${u} --ha=false
 Vendor logins (Claude/Codex) are NOT set up here \u2014 you type those later, inside
 boxes, and they land on this machine's volume, never on bostrat (box-auth-policy).
-`),u(0)}var _e,X,B,te=ie(()=>{_e=f.resolve(f.dirname(Te(import.meta.url)),".."),X="wss://plane.bostrat.ai/v1/node";B=(e,{stdin:t,exec:n}={})=>new Promise((o,s)=>{if(n)return n(e,{stdin:t}).then(o,s);let r=we("fly",e,{timeout:6e5,maxBuffer:16*1024*1024},(i,a,u)=>i?s(Object.assign(i,{stdout:a,stderr:u})):o({stdout:a,stderr:u}));t!=null&&r.stdin?.end(t)})});import m from"node:fs";import d from"node:path";import x from"node:os";import{createRequire as U}from"node:module";import{execFile as be,spawn as Ae}from"node:child_process";import{promisify as xe}from"node:util";import Re from"node:readline/promises";import{randomUUID as ve}from"node:crypto";import{fileURLToPath as Ee}from"node:url";import P from"node:fs";import D from"node:path";import ce from"node:os";var le=process.env.BOSTRAT_STATE_DIR||D.join(process.env.HOME||ce.tmpdir(),".bostrat"),A=()=>D.join(le,"node.env");function L(e){let t=String(e||"").trim();if(!t)return"";let n=/^[a-z][a-z0-9+.-]*:\/\//i.test(t)?t:`wss://${t}`,o;try{o=new URL(n)}catch{return t}let s={"https:":"wss:","http:":"ws:","wss:":"wss:","ws:":"ws:"}[o.protocol];return s?(o.protocol=s,(o.pathname===""||o.pathname==="/")&&(o.pathname="/v1/node"),o.toString()):t}function I(e){let t;try{t=P.readFileSync(e,"utf8")}catch{return{}}let n={};for(let o of t.split(`
-`)){let s=o.trim();if(!s||s.startsWith("#"))continue;let r=/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(s);if(!r)continue;let i=r[2].trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),n[r[1]]=i}return n}function H(e,t=process.env){let n=I(e);for(let[o,s]of Object.entries(n))o in t||(t[o]=s);return n}function W(e,t,{header:n=""}={}){let o=[];n&&o.push(...n.split(`
-`).map(s=>s?`# ${s}`:"#"));for(let[s,r]of Object.entries(t))r==null||r===""||o.push(`${s}=${r}`);P.mkdirSync(D.dirname(e),{recursive:!0}),P.writeFileSync(e,o.join(`
+`),d(0)}var Z,Oe,F,I,ne=ae(()=>{Z="wss://plane.bostrat.ai/v1/node",Oe=_e(import.meta.url)("../package.json").version,F=`ghcr.io/globocodes/bostrat-node:${Oe}`;I=(e,{stdin:t,exec:n}={})=>new Promise((o,s)=>{if(n)return n(e,{stdin:t}).then(o,s);let r=Te("fly",e,{timeout:6e5,maxBuffer:16*1024*1024},(i,a,d)=>i?s(Object.assign(i,{stdout:a,stderr:d})):o({stdout:a,stderr:d}));t!=null&&r.stdin?.end(t)})});import f from"node:fs";import l from"node:path";import b from"node:os";import{createRequire as H}from"node:module";import{execFile as xe,spawn as Ee}from"node:child_process";import{promisify as Re}from"node:util";import ve from"node:readline/promises";import{randomUUID as ke}from"node:crypto";import{fileURLToPath as $e}from"node:url";import N from"node:fs";import L from"node:path";import le from"node:os";var ue=process.env.BOSTRAT_STATE_DIR||L.join(process.env.HOME||le.tmpdir(),".bostrat"),A=()=>L.join(ue,"node.env");function j(e){let t=String(e||"").trim();if(!t)return"";let n=/^[a-z][a-z0-9+.-]*:\/\//i.test(t)?t:`wss://${t}`,o;try{o=new URL(n)}catch{return t}let s={"https:":"wss:","http:":"ws:","wss:":"wss:","ws:":"ws:"}[o.protocol];return s?(o.protocol=s,(o.pathname===""||o.pathname==="/")&&(o.pathname="/v1/node"),o.toString()):t}function P(e){let t;try{t=N.readFileSync(e,"utf8")}catch{return{}}let n={};for(let o of t.split(`
+`)){let s=o.trim();if(!s||s.startsWith("#"))continue;let r=/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(s);if(!r)continue;let i=r[2].trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),n[r[1]]=i}return n}function W(e,t=process.env){let n=P(e);for(let[o,s]of Object.entries(n))o in t||(t[o]=s);return n}function G(e,t,{header:n=""}={}){let o=[];n&&o.push(...n.split(`
+`).map(s=>s?`# ${s}`:"#"));for(let[s,r]of Object.entries(t))r==null||r===""||o.push(`${s}=${r}`);N.mkdirSync(L.dirname(e),{recursive:!0}),N.writeFileSync(e,o.join(`
 `)+`
-`,{mode:384}),P.chmodSync(e,384)}function Y(e=process.platform){return e==="darwin"?{BOSTRAT_TMUX_BIN:"/opt/homebrew/bin/tmux",BOSTRAT_TMUX_SOCKET:`/tmp/tmux-${process.getuid?.()??501}/bostrat`,BOSTRAT_CHROMIUM_BIN:"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"}:{}}import{execFile as pe}from"node:child_process";import{promisify as fe}from"node:util";import ue from"node:os";import z from"node:path";var de=process.env.BOSTRAT_DEBUG_DIR||z.join(ue.homedir(),".bostrat","debug"),rt=z.join(de,"handoff.jsonl"),st=Number(process.env.BOSTRAT_HANDOFF_DEBUG_MAX)||500;var me=fe(pe);var Tt=process.env.BOSTRAT_TMUX_BIN||"/usr/bin/tmux",_t=process.env.BOSTRAT_TMUX_SOCKET||"/tmp/tmux-1000/default",St=process.env.BOSTRAT_DEFAULT_CWD||process.env.HOME||"/",Ot=process.env.BOSTRAT_AGENT_CMD||"claude --dangerously-skip-permissions";async function G(e,{loginShell:t=!1,failOpen:n=!1}={}){if(!e)return!1;let o=t?process.env.SHELL||"/bin/sh":"sh",s=t?"-lic":"-c";try{return await me(o,[s,'command -v "$1" >/dev/null 2>&1',"_",e],{timeout:5e3}),!0}catch(r){return r?.code===1?!1:n}}var bt=Number(process.env.BOSTRAT_PROMPT_CAPTURE_COLS)||100,At=Number(process.env.BOSTRAT_PROMPT_CAPTURE_ROWS)||40,xt=Number(process.env.BOSTRAT_PROMPT_CAPTURE_LINES)||80,Rt=Number(process.env.BOSTRAT_BOX_COLS)||120,vt=Number(process.env.BOSTRAT_BOX_ROWS)||40;var O=xe(be),M=d.dirname(Ee(import.meta.url)),b=d.resolve(M,".."),ke=d.join(M,"index.js"),Ne="wss://plane.bostrat.ai/v1/node",$e=U(import.meta.url)("../package.json").version,w=(e,t)=>({name:e,level:"pass",detail:t}),R=(e,t,n)=>({name:e,level:"warn",detail:t,fix:n}),h=(e,t,n)=>({name:e,level:"fail",detail:t,fix:n});async function Pe(){let[e,t]=process.versions.node.split(".").map(Number);return e>22||e===22&&t>=5?w("node runtime",`${process.version} at ${process.execPath}`):h("node runtime",`${process.version} < 22.5`,"install Node \u226522.5 via nvm and re-run under it")}function Ie(e){let t;try{t=m.statSync(e)}catch{return R("node.env",`${e} missing`,"run `bostrat-node init`")}let n=t.mode&511;return n&63?R("node.env",`${e} mode ${n.toString(8)} \u2014 group/world readable and it can hold a key`,`chmod 600 ${e}`):w("node.env",`${e} (0600)`)}async function Be(e){let t=e.BOSTRAT_TMUX_BIN||"/usr/bin/tmux";try{let{stdout:n}=await O(t,["-V"],{timeout:5e3});return w("tmux",`${t} (${n.trim()})`)}catch{return h("tmux",`${t} not runnable`,process.platform==="darwin"?"brew install tmux (then BOSTRAT_TMUX_BIN=/opt/homebrew/bin/tmux)":"install tmux")}}async function F(e,{required:t=!1}={}){if(await G(e,{loginShell:!0,failOpen:!1}))return w(e,"resolves on the login-shell PATH");let o="not on the login-shell PATH";return t?h(e,o,`install ${e} so \`$SHELL -lic 'command -v ${e}'\` finds it`):R(e,o)}async function Ce(){let e=await Promise.all(["claude","codex","cursor-agent"].map(t=>F(t)));return e.some(t=>t.level==="pass")||e.push(h("agent CLIs","no agent CLI found at all \u2014 a node with nothing to drive","install at least one of claude / codex / cursor-agent")),e}async function je(){try{let t=U(d.join(b,"src","node-cli.js"))("node-pty");return await new Promise((n,o)=>{let s=t.spawn("/bin/echo",["ok"],{cols:20,rows:5}),r=setTimeout(()=>o(new Error("spawn timeout")),5e3);s.onExit(()=>{clearTimeout(r),n()})}),w("node-pty","loads and spawns under this runtime")}catch(e){let t=`cd ${b} && npm rebuild node-pty  # with THIS node first on PATH \u2014 never the system npm`;try{let n=U(d.join(b,"package.json")),o=d.join(d.dirname(n.resolve("node-pty/package.json")),"prebuilds",`${process.platform}-${process.arch}`,"spawn-helper");m.existsSync(o)&&!(m.statSync(o).mode&73)&&(t=`chmod +x ${o}  # node-pty ships it non-executable`)}catch{}return h("node-pty",`load/spawn failed: ${e?.message||e}`,t)}}function De(e){let t=e.BOSTRAT_CHROMIUM_BIN||"/usr/bin/chromium";return m.existsSync(t)?w("chromium (mocks)",t):R("chromium (mocks)",`${t} missing \u2014 mock rendering unavailable`,"install Chromium/Chrome and set BOSTRAT_CHROMIUM_BIN")}function Le(e){let t=e.BOSTRAT_CLAUDE_USE_API_KEY==="1";return t&&!e.ANTHROPIC_API_KEY?h("claude lane","BOSTRAT_CLAUDE_USE_API_KEY=1 but ANTHROPIC_API_KEY is empty","add the key to node.env or set the flag to 0"):w("claude lane",t?"BYO API key (injected per new box)":"box-local login (subscription \u2014 you type `claude login` inside the box)")}async function Ue(e,{WebSocketImpl:t}={}){if(!e.BOSTRAT_PLANE_URL||!e.BOSTRAT_PLANE_TOKEN)return R("plane link","BOSTRAT_PLANE_URL/TOKEN unset \u2014 node runs pure M1 (local only)","run `bostrat-node init`");let n=t||(await import("ws")).default,o=Date.now(),s=L(e.BOSTRAT_PLANE_URL);return await new Promise(r=>{let i=new n(s,{headers:{authorization:`Bearer ${e.BOSTRAT_PLANE_TOKEN}`}}),a=p=>{clearTimeout(u);try{i.close()}catch{}r(p)},u=setTimeout(()=>a(h("plane link",`no hello_ok within 5s from ${s}`,"check the URL, the token, and the plane's IP gate")),5e3);i.on("open",()=>i.send(JSON.stringify({v:1,ch:"ctl",type:"hello",nodeId:`doctor-${ve().slice(0,8)}`}))),i.on("message",p=>{try{let l=JSON.parse(p);l.type==="hello_ok"?a(w("plane link",`hello_ok in ${Date.now()-o}ms (${s})`)):l.type==="error"&&a(h("plane link",`plane said: ${l.code} ${l.message||""}`,"check the token"))}catch{}}),i.on("error",p=>a(h("plane link",`${p?.message||p}`,"check the URL, the token, and the plane's IP gate")))})}function Fe(e){return e.BOSTRAT_STATE_REMOTE?w("state remote",`${e.BOSTRAT_STATE_REMOTE} (this node's own \u2014 never another node's repo)`):R("state remote","unset \u2014 state syncs to a local repo only, no off-box durability","create a per-node private repo and set BOSTRAT_STATE_REMOTE")}async function ne(e,t={}){let n=[];return n.push(await Pe()),n.push(Ie(t.envFile||A())),n.push(await Be(e)),n.push(...await Ce()),n.push(await F("git",{required:!0})),n.push(await F("gh")),n.push(await je()),n.push(De(e)),n.push(Le(e)),n.push(await Ue(e,t)),n.push(Fe(e)),n}function oe(e,t=console.log){let n={pass:"\u2713",warn:"!",fail:"\u2717"};for(let r of e)t(`${n[r.level]} ${r.name}: ${r.detail}`),r.fix&&r.level!=="pass"&&t(`    fix: ${r.fix}`);let o=e.filter(r=>r.level==="fail").length,s=e.filter(r=>r.level==="warn").length;return t(o?`
+`,{mode:384}),N.chmodSync(e,384)}function Y(e=process.platform){return e==="darwin"?{BOSTRAT_TMUX_BIN:"/opt/homebrew/bin/tmux",BOSTRAT_TMUX_SOCKET:`/tmp/tmux-${process.getuid?.()??501}/bostrat`,BOSTRAT_CHROMIUM_BIN:"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"}:{}}import{execFile as me}from"node:child_process";import{promisify as he}from"node:util";import pe from"node:os";import X from"node:path";var fe=process.env.BOSTRAT_DEBUG_DIR||X.join(pe.homedir(),".bostrat","debug"),lt=X.join(fe,"handoff.jsonl"),ut=Number(process.env.BOSTRAT_HANDOFF_DEBUG_MAX)||500;var ye=he(me);var Et=process.env.BOSTRAT_TMUX_BIN||"/usr/bin/tmux",Rt=process.env.BOSTRAT_TMUX_SOCKET||"/tmp/tmux-1000/default",vt=process.env.BOSTRAT_DEFAULT_CWD||process.env.HOME||"/",kt=process.env.BOSTRAT_AGENT_CMD||"claude --dangerously-skip-permissions";async function V(e,{loginShell:t=!1,failOpen:n=!1}={}){if(!e)return!1;let o=t?process.env.SHELL||"/bin/sh":"sh",s=t?"-lic":"-c";try{return await ye(o,[s,'command -v "$1" >/dev/null 2>&1',"_",e],{timeout:5e3}),!0}catch(r){return r?.code===1?!1:n}}var D={claude:"npm install -g @anthropic-ai/claude-code",codex:"npm install -g @openai/codex","cursor-agent":"curl https://cursor.com/install -fsS | bash"};var $t=Number(process.env.BOSTRAT_PROMPT_CAPTURE_COLS)||100,Nt=Number(process.env.BOSTRAT_PROMPT_CAPTURE_ROWS)||40,Pt=Number(process.env.BOSTRAT_PROMPT_CAPTURE_LINES)||80,It=Number(process.env.BOSTRAT_BOX_COLS)||120,Bt=Number(process.env.BOSTRAT_BOX_ROWS)||40;var S=Re(xe),K=l.dirname($e(import.meta.url)),O=l.resolve(K,".."),Ne=l.join(K,"index.js"),Pe="wss://plane.bostrat.ai/v1/node",Ie=H(import.meta.url)("../package.json").version,y=(e,t)=>({name:e,level:"pass",detail:t}),x=(e,t,n)=>({name:e,level:"warn",detail:t,fix:n}),h=(e,t,n)=>({name:e,level:"fail",detail:t,fix:n});async function Be(){let[e,t]=process.versions.node.split(".").map(Number);return e>22||e===22&&t>=5?y("node runtime",`${process.version} at ${process.execPath}`):h("node runtime",`${process.version} < 22.5`,"install Node \u226522.5 via nvm and re-run under it")}function Ce(e){let t;try{t=f.statSync(e)}catch{return x("node.env",`${e} missing`,"run `bostrat-node init`")}let n=t.mode&511;return n&63?x("node.env",`${e} mode ${n.toString(8)} \u2014 group/world readable and it can hold a key`,`chmod 600 ${e}`):y("node.env",`${e} (0600)`)}async function Le(e){let t=e.BOSTRAT_TMUX_BIN||"/usr/bin/tmux";try{let{stdout:n}=await S(t,["-V"],{timeout:5e3});return y("tmux",`${t} (${n.trim()})`)}catch{return h("tmux",`${t} not runnable`,process.platform==="darwin"?"brew install tmux (then BOSTRAT_TMUX_BIN=/opt/homebrew/bin/tmux)":"install tmux")}}async function M(e,{required:t=!1}={}){if(await V(e,{loginShell:!0,failOpen:!1}))return y(e,"resolves on the login-shell PATH");let o="not on the login-shell PATH \u2014 boxes for this agent (and handoffs to it) will be refused",s=D[e]?`${D[e]}${e==="cursor-agent"?"   # installs to ~/.local/bin \u2014 ensure your login shell has it on PATH":""}`:`install ${e} so \`$SHELL -lic 'command -v ${e}'\` finds it`;return t?h(e,o,s):x(e,o,s)}async function je(){let e=await Promise.all(["claude","codex","cursor-agent"].map(t=>M(t)));return e.some(t=>t.level==="pass")||e.push(h("agent CLIs","no agent CLI found at all \u2014 a node with nothing to drive","install at least one of claude / codex / cursor-agent")),e}async function De(){try{let t=H(l.join(O,"src","node-cli.js"))("node-pty");return await new Promise((n,o)=>{let s=t.spawn("/bin/echo",["ok"],{cols:20,rows:5}),r=setTimeout(()=>o(new Error("spawn timeout")),5e3);s.onExit(()=>{clearTimeout(r),n()})}),y("node-pty","loads and spawns under this runtime")}catch(e){let t=`cd ${O} && npm rebuild node-pty  # with THIS node first on PATH \u2014 never the system npm`;try{let n=H(l.join(O,"package.json")),o=l.join(l.dirname(n.resolve("node-pty/package.json")),"prebuilds",`${process.platform}-${process.arch}`,"spawn-helper");f.existsSync(o)&&!(f.statSync(o).mode&73)&&(t=`chmod +x ${o}  # node-pty ships it non-executable`)}catch{}return h("node-pty",`load/spawn failed: ${e?.message||e}`,t)}}function Ue(e){let t=e.BOSTRAT_CHROMIUM_BIN||"/usr/bin/chromium";return f.existsSync(t)?y("chromium (mocks)",t):x("chromium (mocks)",`${t} missing \u2014 mock rendering unavailable`,"install Chromium/Chrome and set BOSTRAT_CHROMIUM_BIN")}function Fe(e){let t=e.BOSTRAT_CLAUDE_USE_API_KEY==="1";return t&&!e.ANTHROPIC_API_KEY?h("claude lane","BOSTRAT_CLAUDE_USE_API_KEY=1 but ANTHROPIC_API_KEY is empty","add the key to node.env or set the flag to 0"):y("claude lane",t?"BYO API key (injected per new box)":"box-local login (subscription \u2014 you type `claude login` inside the box)")}async function He(e,{WebSocketImpl:t}={}){if(!e.BOSTRAT_PLANE_URL||!e.BOSTRAT_PLANE_TOKEN)return x("plane link","BOSTRAT_PLANE_URL/TOKEN unset \u2014 node runs pure M1 (local only)","run `bostrat-node init`");let n=t||(await import("ws")).default,o=Date.now(),s=j(e.BOSTRAT_PLANE_URL);return await new Promise(r=>{let i=new n(s,{headers:{authorization:`Bearer ${e.BOSTRAT_PLANE_TOKEN}`}}),a=p=>{clearTimeout(d);try{i.close()}catch{}r(p)},d=setTimeout(()=>a(h("plane link",`no hello_ok within 5s from ${s}`,"check the URL, the token, and the plane's IP gate")),5e3);i.on("open",()=>i.send(JSON.stringify({v:1,ch:"ctl",type:"hello",nodeId:`doctor-${ke().slice(0,8)}`}))),i.on("message",p=>{try{let u=JSON.parse(p);u.type==="hello_ok"?a(y("plane link",`hello_ok in ${Date.now()-o}ms (${s})`)):u.type==="error"&&a(h("plane link",`plane said: ${u.code} ${u.message||""}`,"check the token"))}catch{}}),i.on("error",p=>a(h("plane link",`${p?.message||p}`,"check the URL, the token, and the plane's IP gate")))})}function Me(e){return e.BOSTRAT_STATE_REMOTE?y("state remote",`${e.BOSTRAT_STATE_REMOTE} (this node's own \u2014 never another node's repo)`):x("state remote","unset \u2014 state syncs to a local repo only, no off-box durability","create a per-node private repo and set BOSTRAT_STATE_REMOTE")}async function oe(e,t={}){let n=[];return n.push(await Be()),n.push(Ce(t.envFile||A())),n.push(await Le(e)),n.push(...await je()),n.push(await M("git",{required:!0})),n.push(await M("gh")),n.push(await De()),n.push(Ue(e)),n.push(Fe(e)),n.push(await He(e,t)),n.push(Me(e)),n}function re(e,t=console.log){let n={pass:"\u2713",warn:"!",fail:"\u2717"};for(let r of e)t(`${n[r.level]} ${r.name}: ${r.detail}`),r.fix&&r.level!=="pass"&&t(`    fix: ${r.fix}`);let o=e.filter(r=>r.level==="fail").length,s=e.filter(r=>r.level==="warn").length;return t(o?`
 FAIL \u2014 ${o} blocking, ${s} warnings`:`
-OK \u2014 0 blocking, ${s} warnings`),o===0}async function Me({envFile:e=A(),input:t=process.stdin,output:n=process.stdout}={}){let o=I(e),s=Re.createInterface({input:t,output:n}),r=async(_,c)=>(await s.question(c?`${_} [${c}]: `:`${_}: `)).trim()||c||"";n.write(`bostrat-node init \u2014 plane link + machine config. No vendor logins here:
+OK \u2014 0 blocking, ${s} warnings`),o===0}async function Ke({envFile:e=A(),input:t=process.stdin,output:n=process.stdout}={}){let o=P(e),s=ve.createInterface({input:t,output:n}),r=async(T,c)=>(await s.question(c?`${T} [${c}]: `:`${T}: `)).trim()||c||"";n.write(`bostrat-node init \u2014 plane link + machine config. No vendor logins here:
 you type those inside each box, later (box-auth-policy).
 
-`);let i=await r("Plane URL",o.BOSTRAT_PLANE_URL||Ne),a=L(i);a!==i.trim()&&n.write(`  \u2192 using ${a}
-`);let u=await r("Node token (minted plane-side; stored 0600)",o.BOSTRAT_PLANE_TOKEN),p=await r("Owner userId (just press Enter \u2014 the plane infers it from your token)",o.BOSTRAT_OWNER||"");p&&!/^user_[A-Za-z0-9]+$/.test(p)&&n.write(`  ! that doesn't look like a Clerk userId (user_\u2026) \u2014 leave it empty next time and the plane infers the owner from the token; saved as typed.
-`);let l=await r("Node name",o.BOSTRAT_NODE_NAME||x.hostname().split(".")[0]),k=await r("Repos root",o.BOSTRAT_REPOS_ROOT||d.join(x.homedir(),"Documents")),C=await r("State remote (per-node private repo; empty = local-only)",o.BOSTRAT_STATE_REMOTE||""),g=(await r("Route NEW claude boxes through a BYO API key? (y/N)",o.BOSTRAT_CLAUDE_USE_API_KEY==="1"?"y":"N")).toLowerCase().startsWith("y");g&&n.write(`
+`);let i=await r("Plane URL",o.BOSTRAT_PLANE_URL||Pe),a=j(i);a!==i.trim()&&n.write(`  \u2192 using ${a}
+`);let d=await r("Node token (minted plane-side; stored 0600)",o.BOSTRAT_PLANE_TOKEN),p=await r("Owner userId (just press Enter \u2014 the plane infers it from your token)",o.BOSTRAT_OWNER||"");p&&!/^user_[A-Za-z0-9]+$/.test(p)&&n.write(`  ! that doesn't look like a Clerk userId (user_\u2026) \u2014 leave it empty next time and the plane infers the owner from the token; saved as typed.
+`);let u=await r("Node name",o.BOSTRAT_NODE_NAME||b.hostname().split(".")[0]),k=await r("Repos root",o.BOSTRAT_REPOS_ROOT||l.join(b.homedir(),"Documents")),B=await r("State remote (per-node private repo; empty = local-only)",o.BOSTRAT_STATE_REMOTE||""),g=(await r("Route NEW claude boxes through a BYO API key? (y/N)",o.BOSTRAT_CLAUDE_USE_API_KEY==="1"?"y":"N")).toLowerCase().startsWith("y");g&&n.write(`
 BYO API key (box-auth-policy rule 5): claude boxes on this node bill to YOUR key,
 injected per box, stored 0600 in node.env, never sent to the plane.
   \u2022 create/copy a key: https://console.anthropic.com/settings/keys
   \u2022 set a monthly spend limit while you're there \u2014 the key is live.
 
-`);let v=g?await r("ANTHROPIC_API_KEY (starts sk-ant-)",o.ANTHROPIC_API_KEY):"";g&&v&&!/^sk-ant-/.test(v)&&n.write(`  ! that doesn't look like an Anthropic key (expected sk-ant-\u2026) \u2014 saved as-is; re-run init to correct.
-`),s.close();let E={...Y(),...o,BOSTRAT_PLANE_URL:a,BOSTRAT_PLANE_TOKEN:u,BOSTRAT_OWNER:p,BOSTRAT_NODE_NAME:l,BOSTRAT_NODE_ID:o.BOSTRAT_NODE_ID||l,BOSTRAT_REPOS_ROOT:k,BOSTRAT_STATE_REMOTE:C,BOSTRAT_CLAUDE_USE_API_KEY:g?"1":"0",ANTHROPIC_API_KEY:g?v:o.ANTHROPIC_API_KEY};W(e,E,{header:`bostrat node config \u2014 written by \`bostrat-node init\` ${new Date().toISOString()}
+`);let E=g?await r("ANTHROPIC_API_KEY (starts sk-ant-)",o.ANTHROPIC_API_KEY):"";g&&E&&!/^sk-ant-/.test(E)&&n.write(`  ! that doesn't look like an Anthropic key (expected sk-ant-\u2026) \u2014 saved as-is; re-run init to correct.
+`),s.close();let R={...Y(),...o,BOSTRAT_PLANE_URL:a,BOSTRAT_PLANE_TOKEN:d,BOSTRAT_OWNER:p,BOSTRAT_NODE_NAME:u,BOSTRAT_NODE_ID:o.BOSTRAT_NODE_ID||u,BOSTRAT_REPOS_ROOT:k,BOSTRAT_STATE_REMOTE:B,BOSTRAT_CLAUDE_USE_API_KEY:g?"1":"0",ANTHROPIC_API_KEY:g?E:o.ANTHROPIC_API_KEY};G(e,R,{header:`bostrat node config \u2014 written by \`bostrat-node init\` ${new Date().toISOString()}
 0600: BOSTRAT_PLANE_TOKEN always lives here, ANTHROPIC_API_KEY may. Never commit.
 Bind host: unset = loopback-only while plane-linked; BOSTRAT_HOST=all restores bind-all (LAN).`}),n.write(`
 wrote ${e}
 
-`);let j={...E,...process.env},T=await ne(j,{envFile:e}),N=oe(T,_=>n.write(_+`
-`));return N&&n.write("\nnext: `bostrat-node run` (foreground) or `bostrat-node install-service`\n"),{ok:N,results:T}}function Ke({envFile:e=A()}={}){H(e);let t=process.env.BOSTRAT_NODE_BIN||process.execPath,n=Ae(t,[ke],{cwd:b,stdio:"inherit",env:process.env});for(let o of["SIGINT","SIGTERM"])process.on(o,()=>n.kill(o));return n.on("exit",(o,s)=>process.exit(s?1:o??1)),n}function He({agentDir:e=b,nodeBin:t=process.execPath,envFile:n=A(),home:o=x.homedir()}={}){let s=d.dirname(t),r=d.join(d.basename(M),"index.js");return`# bostrat node \u2014 written by \`bostrat-node install-service\`. Config lives in
+`);let C={...R,...process.env},v=await oe(C,{envFile:e}),w=re(v,T=>n.write(T+`
+`));return w&&n.write("\nnext: `bostrat-node run` (foreground) or `bostrat-node install-service`\n"),{ok:w,results:v}}function ze({envFile:e=A()}={}){W(e);let t=process.env.BOSTRAT_NODE_BIN||process.execPath,n=Ee(t,[Ne],{cwd:O,stdio:"inherit",env:process.env});for(let o of["SIGINT","SIGTERM"])process.on(o,()=>n.kill(o));return n.on("exit",(o,s)=>process.exit(s?1:o??1)),n}function We({agentDir:e=O,nodeBin:t=process.execPath,envFile:n=A(),home:o=b.homedir()}={}){let s=l.dirname(t),r=l.join(l.basename(K),"index.js");return`# bostrat node \u2014 written by \`bostrat-node install-service\`. Config lives in
 # ${n} (edit + \`systemctl --user restart bostrat-node\`), not here.
 [Unit]
 Description=bostrat node \u2014 box runtime dialing out to the coordination plane (plane-p1-package-node-scope-2026-07-14.md)
@@ -131,7 +111,7 @@ RestartSec=2
 
 [Install]
 WantedBy=default.target
-`}function We({agentDir:e=b,nodeBin:t=process.execPath,home:n=x.homedir()}={}){let o=d.dirname(t),s=`${n}/Library/Logs/bostrat`;return`<?xml version="1.0" encoding="UTF-8"?>
+`}function Ge({agentDir:e=O,nodeBin:t=process.execPath,home:n=b.homedir()}={}){let o=l.dirname(t),s=`${n}/Library/Logs/bostrat`;return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -153,7 +133,7 @@ WantedBy=default.target
   <key>StandardErrorPath</key><string>${s}/node.err.log</string>
 </dict>
 </plist>
-`}function Ye(e=process.platform,t=x.homedir()){return e==="darwin"?{kind:"launchd",file:d.join(t,"Library","LaunchAgents","com.bostrat.node.plist")}:{kind:"systemd",file:d.join(t,".config","systemd","user","bostrat-node.service")}}async function ze({uninstall:e=!1,start:t=!0,platform:n=process.platform,log:o=console.log,agentDir:s=b}={}){let{kind:r,file:i}=Ye(n);if(!e&&s.split(d.sep).includes("_npx"))return o("\u2717 running from the npx cache \u2014 a service must point at a durable install."),o("  fix: npm install -g bostrat-node && bostrat-node install-service"),1;if(e){r==="systemd"?(await O("systemctl",["--user","disable","--now","bostrat-node.service"]).catch(()=>{}),m.rmSync(i,{force:!0}),await O("systemctl",["--user","daemon-reload"])):(await O("launchctl",["unload","-w",i]).catch(()=>{}),m.rmSync(i,{force:!0})),o(`removed ${i}`);return}m.mkdirSync(d.dirname(i),{recursive:!0}),r==="systemd"?(m.writeFileSync(i,He()),await O("systemctl",["--user","daemon-reload"]),t&&await O("systemctl",["--user","enable","--now","bostrat-node.service"]),o(`installed ${i}${t?" (enabled + started)":""}`),o("logs: journalctl --user -u bostrat-node.service -f")):(m.mkdirSync(d.join(x.homedir(),"Library","Logs","bostrat"),{recursive:!0}),m.writeFileSync(i,We()),t&&await O("launchctl",["load","-w",i]),o(`installed ${i}${t?" (loaded)":""}`),o("logs: ~/Library/Logs/bostrat/node.{out,err}.log"))}async function Gt(e=process.argv.slice(2)){let t=e[0],n=A();if(t==="--version"||t==="-v"||t==="version")return console.log($e),0;if(t==="init")return(await Me({envFile:n})).ok?0:1;if(t==="doctor"){let o={...I(n),...process.env};return oe(await ne(o,{envFile:n}))?0:1}if(t==="run"||t==="start")return Ke({envFile:n}),null;if(t==="install-service")return await ze({uninstall:e.includes("--uninstall"),start:!e.includes("--no-start")})||0;if(t==="fly"){let{flyWizard:o}=await Promise.resolve().then(()=>(te(),ee));return await o({argv:e.slice(1)})}return console.log(`bostrat-node \u2014 install and run a bostrat node (plane P1)
+`}function Ye(e=process.platform,t=b.homedir()){return e==="darwin"?{kind:"launchd",file:l.join(t,"Library","LaunchAgents","com.bostrat.node.plist")}:{kind:"systemd",file:l.join(t,".config","systemd","user","bostrat-node.service")}}async function Xe({uninstall:e=!1,start:t=!0,platform:n=process.platform,log:o=console.log,agentDir:s=O}={}){let{kind:r,file:i}=Ye(n);if(!e&&s.split(l.sep).includes("_npx"))return o("\u2717 running from the npx cache \u2014 a service must point at a durable install."),o("  fix: npm install -g bostrat-node && bostrat-node install-service"),1;if(e){r==="systemd"?(await S("systemctl",["--user","disable","--now","bostrat-node.service"]).catch(()=>{}),f.rmSync(i,{force:!0}),await S("systemctl",["--user","daemon-reload"])):(await S("launchctl",["unload","-w",i]).catch(()=>{}),f.rmSync(i,{force:!0})),o(`removed ${i}`);return}f.mkdirSync(l.dirname(i),{recursive:!0}),r==="systemd"?(f.writeFileSync(i,We()),await S("systemctl",["--user","daemon-reload"]),t&&await S("systemctl",["--user","enable","--now","bostrat-node.service"]),o(`installed ${i}${t?" (enabled + started)":""}`),o("logs: journalctl --user -u bostrat-node.service -f")):(f.mkdirSync(l.join(b.homedir(),"Library","Logs","bostrat"),{recursive:!0}),f.writeFileSync(i,Ge()),t&&await S("launchctl",["load","-w",i]),o(`installed ${i}${t?" (loaded)":""}`),o("logs: ~/Library/Logs/bostrat/node.{out,err}.log"))}async function en(e=process.argv.slice(2)){let t=e[0],n=A();if(t==="--version"||t==="-v"||t==="version")return console.log(Ie),0;if(t==="init")return(await Ke({envFile:n})).ok?0:1;if(t==="doctor"){let o={...P(n),...process.env};return re(await oe(o,{envFile:n}))?0:1}if(t==="run"||t==="start")return ze({envFile:n}),null;if(t==="install-service")return await Xe({uninstall:e.includes("--uninstall"),start:!e.includes("--no-start")})||0;if(t==="fly"){let{flyWizard:o}=await Promise.resolve().then(()=>(ne(),te));return await o({argv:e.slice(1)})}return console.log(`bostrat-node \u2014 install and run a bostrat node (plane P1)
 
 usage: bostrat-node <init | doctor | run | install-service [--uninstall] [--no-start] | fly | --version>
 
@@ -161,4 +141,4 @@ usage: bostrat-node <init | doctor | run | install-service [--uninstall] [--no-s
   doctor           check this machine (CLIs, tmux, node-pty, plane reachability)
   run              start the node in the foreground (sources node.env)
   install-service  run at boot/login: systemd --user (Linux) / launchd (macOS)
-  fly              provision this node on YOUR OWN Fly.io org (uses your flyctl)`),t?1:0}export{Me as init,ze as installService,We as launchdPlist,Gt as main,oe as printDoctor,Ke as runAgent,ne as runDoctor,Ye as servicePaths,He as systemdUnit};
+  fly              provision this node on YOUR OWN Fly.io org (uses your flyctl)`),t?1:0}export{Ke as init,Xe as installService,Ge as launchdPlist,en as main,re as printDoctor,ze as runAgent,oe as runDoctor,Ye as servicePaths,We as systemdUnit};