botapp-cli 0.2.5 → 0.2.8

package/dist/bin/bot.js

@@ -7,8 +7,8 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/index.ts
-import { Command as Command24 } from "commander";
-import pc25 from "picocolors";
+import { Command as Command25 } from "commander";
+import pc26 from "picocolors";
 
 // src/commands/server.ts
 import { Command } from "commander";
@@ -195,7 +195,8 @@ function writeYaml(profiles) {
       server: p.server,
       daemonId: p.daemonId,
       daemonName: p.daemonName,
-      token: p.token
+      token: p.token,
+      ...p.userEmail ? { userEmail: p.userEmail } : {}
     };
   }
   writeFileSync2(DAEMON_FILE, stringify2({ profiles: map }), "utf-8");
@@ -235,7 +236,8 @@ function loadDaemonProfiles() {
         server: normalizeServer(value.server),
         daemonId: value.daemonId,
         daemonName: value.daemonName ?? value.daemonId,
-        token: value.token
+        token: value.token,
+        userEmail: value.userEmail
       });
     }
   }
@@ -271,11 +273,21 @@ function saveDaemonProfile(input2) {
     server,
     daemonId: input2.daemonId,
     daemonName: input2.daemonName ?? input2.daemonId,
-    token: input2.token
+    token: input2.token,
+    userEmail: input2.userEmail
   };
   writeYaml([...remaining, next]);
   return next;
 }
+function removeDaemonProfile(serverOrAlias) {
+  const target = findDaemonProfile(serverOrAlias);
+  if (!target) return false;
+  const remaining = loadDaemonProfiles().filter(
+    (p) => p.alias !== target.alias
+  );
+  writeYaml(remaining);
+  return true;
+}
 
 // src/commands/daemon-agent-config.ts
 import { spawnSync } from "child_process";
@@ -1073,6 +1085,28 @@ function pickProfilesToRun(alias, server) {
   }
   return loadDaemonProfiles();
 }
+daemonCommand.command("unpair").description("Remove a paired profile from ~/.botapp/daemon.yaml (does not touch the server)").argument("<aliasOrServer>", "Profile alias (e.g. local) or server URL").action((aliasOrServer) => {
+  const removed = removeDaemonProfile(aliasOrServer);
+  if (!removed) {
+    console.error(pc3.red(`No paired profile matching "${aliasOrServer}".`));
+    process.exitCode = 1;
+    return;
+  }
+  console.log(pc3.green(`Removed daemon profile: ${aliasOrServer}`));
+});
+daemonCommand.command("list").alias("ls").description("List paired daemon profiles from ~/.botapp/daemon.yaml").action(() => {
+  const profiles = loadDaemonProfiles();
+  if (profiles.length === 0) {
+    console.log(pc3.dim("No paired daemons. Run `bot pair` to add one."));
+    return;
+  }
+  for (const p of profiles) {
+    console.log(pc3.bold(p.alias ?? p.server));
+    console.log(`  Server: ${p.server}`);
+    console.log(`  Daemon: ${p.daemonName} ${pc3.dim(`(${p.daemonId})`)}`);
+    console.log(`  User:   ${p.userEmail ?? pc3.dim("unknown \u2014 re-pair to capture")}`);
+  }
+});
 daemonCommand.command("stop").description("Stop the background daemon started by `bot launch`").action(async () => {
   const pidFile = join5(homedir5(), ".botapp", "daemon.pid");
   if (!existsSync5(pidFile)) {
@@ -1101,16 +1135,17 @@ daemonCommand.command("agent").description("Manage agents hosted by this daemon"
     for (const agent of data.agents ?? []) {
       console.log(`${pc3.bold(agent.name)} ${pc3.dim(`(${agent.id})`)}`);
       console.log(`  Kind:    ${agent.kind}`);
+      if (agent.model) console.log(`  Model:   ${agent.model}`);
       console.log(`  Command: ${agent.command} ${(agent.args ?? []).join(" ")}`);
       if (agent.cwd) console.log(`  CWD:     ${agent.cwd}`);
     }
   })
 ).addCommand(createDaemonAgentConfigCommand()).addCommand(
-  new Command3("add").description("Register a local agent command").argument("<name>", "Name, e.g. codex, claude-code, openclaw, hermes, or hermes-agent").requiredOption("--command <command>", "Executable command").option(
+  new Command3("add").description("Register a local agent command").argument("<name>", "Name, e.g. codex, claude-code, kimi, openclaw, hermes, or hermes-agent").requiredOption("--command <command>", "Executable command").option(
     "--kind <kind>",
-    "Agent adapter kind: acp, codex, claude-code, openclaw, hermes, hermes-agent, or shell",
+    "Agent adapter kind: acp, codex, claude-code, kimi, openclaw, hermes, hermes-agent, or shell",
     "acp"
-  ).option("--arg <arg...>", "Argument passed to the executable").option("--cwd <cwd>", "Working directory for the agent process").option("--env <entry...>", "Environment entries in KEY=VALUE form").option("--profile <alias>", "Daemon profile alias to register against").option("--server <url>", "Daemon profile by server URL").action(async (name, opts) => {
+  ).option("--arg <arg...>", "Argument passed to the executable").option("--cwd <cwd>", "Working directory for the agent process").option("--env <entry...>", "Environment entries in KEY=VALUE form").option("--model <model>", "Provider model to pass to the agent runtime").option("--profile <alias>", "Daemon profile alias to register against").option("--server <url>", "Daemon profile by server URL").action(async (name, opts) => {
     const profile = requireSelectedProfile(opts);
     if (!profile) return;
     const env = parseEnv(opts.env ?? []);
@@ -1126,12 +1161,14 @@ daemonCommand.command("agent").description("Manage agents hosted by this daemon"
           command: opts.command,
           args: opts.arg ?? [],
           cwd: opts.cwd,
-          env
+          env,
+          model: opts.model
         }
       }
     );
     console.log(pc3.green(`Registered daemon agent: ${pc3.bold(data.agent.name)}`));
     console.log(`  ID:      ${data.agent.id}`);
+    if (data.agent.model) console.log(`  Model:   ${data.agent.model}`);
     console.log(`  Command: ${data.agent.command} ${(data.agent.args ?? []).join(" ")}`);
   })
 ).addCommand(
@@ -1297,7 +1334,10 @@ async function runAgentJob(job, update) {
   if (job.agent.kind === "claude-code" || job.agent.kind === "claude_code") {
     return runClaudeCodeAgent(job, update);
   }
-  if (job.agent.kind === "openclaw" || job.agent.kind === "kimiclaw") {
+  if (job.agent.kind === "kimi") {
+    return runKimiCodeAgent(job, update);
+  }
+  if (job.agent.kind === "openclaw") {
     return runOpenClawAgent(job, update);
   }
   if (job.agent.kind === "hermes" || job.agent.kind === "hermes-agent") {
@@ -1338,6 +1378,9 @@ async function runCodexAgent(job, update) {
   if (!args.includes("--skip-git-repo-check")) {
     args.push("--skip-git-repo-check");
   }
+  if (job.agent.model && !hasAnyFlag(args, ["--model", "-m"])) {
+    args.push("--model", job.agent.model);
+  }
   if (!hasAnyFlag(args, [
     "--sandbox",
     "-s",
@@ -1366,12 +1409,19 @@ async function runCodexAgent(job, update) {
     rawEvents: []
   };
   const toolCalls = /* @__PURE__ */ new Map();
+  const errors = [];
   function processLine(line) {
     if (!line.trim()) return;
     try {
       const event = JSON.parse(line);
       result.rawEvents.push(event);
       update({ kind: "codex_event", event });
+      if (event?.type === "error" && typeof event.message === "string") {
+        errors.push(event.message);
+      }
+      if (event?.type === "turn.failed" && typeof event.error?.message === "string") {
+        errors.push(event.error.message);
+      }
       if (event?.type === "item.completed" && event.item?.type === "agent_message") {
         if (typeof event.item.text === "string") {
           result.messages.push(event.item.text);
@@ -1401,7 +1451,7 @@ async function runCodexAgent(job, update) {
   rl.on("line", processLine);
   const code = await new Promise((resolve11) => child.on("close", resolve11));
   if (code !== 0) {
-    throw new Error(stderr.trim() || `Codex exited with code ${code}`);
+    throw new Error(errors.at(-1) ?? (stderr.trim() || `Codex exited with code ${code}`));
   }
   result.text = result.messages.at(-1)?.trim() || "";
   result.toolCalls = [...toolCalls.values()];
@@ -1418,6 +1468,9 @@ async function runClaudeCodeAgent(job, update) {
   if (!args.includes("--verbose")) {
     args.push("--verbose");
   }
+  if (job.agent.model && !hasAnyFlag(args, ["--model"])) {
+    args.push("--model", job.agent.model);
+  }
   if (!hasAnyFlag(args, [
     "--permission-mode",
     "--dangerously-skip-permissions",
@@ -1440,6 +1493,9 @@ async function runClaudeCodeAgent(job, update) {
   child.stderr.on("data", (chunk) => {
     stderr += chunk.toString();
   });
+  const noiseLines = [];
+  const errorEvents = [];
+  const NOISE_TAIL = 6;
   const result = {
     kind: "claude-code",
     text: "",
@@ -1497,11 +1553,19 @@ async function runClaudeCodeAgent(job, update) {
     try {
       event = JSON.parse(line);
     } catch {
+      noiseLines.push(line);
+      if (noiseLines.length > NOISE_TAIL) noiseLines.shift();
       return;
     }
     result.rawEvents.push(event);
     update({ kind: "claude_code_event", event });
     captureSessionId(event);
+    if (event && (event.is_error === true || event.subtype === "error" || event.type === "result" && event.is_error)) {
+      try {
+        errorEvents.push(JSON.stringify(event).slice(0, 1e3));
+      } catch {
+      }
+    }
     if (event.type === "assistant" && event.message?.content) {
       ingestAssistantContent(
         Array.isArray(event.message.content) ? event.message.content : []
@@ -1522,7 +1586,146 @@ async function runClaudeCodeAgent(job, update) {
   rl.on("line", processLine);
   const code = await new Promise((resolve11) => child.on("close", resolve11));
   if (code !== 0) {
-    throw new Error(stderr.trim() || `Claude Code exited with code ${code}`);
+    const parts = [];
+    if (stderr.trim()) parts.push(stderr.trim());
+    if (errorEvents.length > 0) {
+      parts.push(`Error events: ${errorEvents.join(" | ")}`);
+    }
+    if (noiseLines.length > 0 && parts.length === 0) {
+      parts.push(`Last stdout lines: ${noiseLines.join(" | ").slice(-1500)}`);
+    }
+    if (parts.length === 0) {
+      parts.push(`Claude Code exited with code ${code} (no stderr or stdout output)`);
+    }
+    throw new Error(parts.join(" \u2014 "));
+  }
+  if (!result.text) {
+    result.text = result.messages.at(-1)?.trim() ?? "";
+  }
+  result.toolCalls = [...toolCalls.values()];
+  return JSON.stringify(result);
+}
+async function runKimiCodeAgent(job, update) {
+  const args = [...job.agent.args];
+  if (!args.includes("--print") && !args.includes("-p")) {
+    args.push("--print");
+  }
+  if (!args.includes("--output-format")) {
+    args.push("--output-format", "stream-json");
+  }
+  if (!hasAnyFlag(args, ["--yolo", "--yes", "-y"])) {
+    args.push("--yolo");
+  }
+  if (job.agent.model && !hasAnyFlag(args, ["--model", "-m"])) {
+    args.push("--model", job.agent.model);
+  }
+  const resume = job.resumeSessionId ?? job.agent.env?.KIMI_SESSION_ID ?? null;
+  if (resume && !hasAnyFlag(args, ["--session", "-S", "-r", "--resume", "--continue", "-C"])) {
+    args.push("-r", resume);
+  }
+  const cwd = job.agent.cwd ?? process.cwd();
+  let prompt = job.query;
+  if (!resume) {
+    const agentsMdPath = join5(cwd, "AGENTS.md");
+    if (existsSync5(agentsMdPath)) {
+      try {
+        const primer = readFileSync3(agentsMdPath, "utf-8").trim();
+        if (primer) {
+          prompt = `# System instructions (read carefully before responding)
+
+${primer}
+
+---
+
+# Your task
+
+${job.query}`;
+        }
+      } catch {
+      }
+    }
+  }
+  const child = spawn3(job.agent.command, args, {
+    cwd,
+    env: { ...process.env, ...job.agent.env ?? {} },
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  child.stdin.write(prompt);
+  child.stdin.end();
+  let stderr = "";
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const result = {
+    kind: "kimi",
+    text: "",
+    messages: [],
+    toolCalls: [],
+    sessionId: resume,
+    rawEvents: []
+  };
+  const toolCalls = /* @__PURE__ */ new Map();
+  function ingestAssistantContent(blocks) {
+    for (const block of blocks) {
+      if (!block || typeof block !== "object") continue;
+      if (block.type === "text" && typeof block.text === "string") {
+        result.messages.push(block.text);
+        update({ kind: "message", text: block.text });
+      }
+    }
+  }
+  function ingestToolCalls(calls) {
+    for (const call of calls) {
+      if (!call || typeof call !== "object") continue;
+      const id = typeof call.id === "string" ? call.id : null;
+      if (!id) continue;
+      const name = String(call.function?.name ?? call.name ?? "tool");
+      let input2 = call.function?.arguments ?? call.arguments;
+      if (typeof input2 === "string") {
+        try {
+          input2 = JSON.parse(input2);
+        } catch {
+        }
+      }
+      const next = { ...toolCalls.get(id) ?? {}, id, name, input: input2 };
+      toolCalls.set(id, next);
+      update({ kind: "tool_call", toolCall: next });
+    }
+  }
+  function ingestToolResult(event) {
+    const id = event?.tool_call_id;
+    if (typeof id !== "string") return;
+    const existing = toolCalls.get(id) ?? { id, name: "tool" };
+    const output2 = typeof event.content === "string" ? event.content : JSON.stringify(event.content);
+    const next = { ...existing, output: output2 };
+    toolCalls.set(id, next);
+    update({ kind: "tool_call", toolCall: next });
+  }
+  function processLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed[0] !== "{") return;
+    let event;
+    try {
+      event = JSON.parse(trimmed);
+    } catch {
+      return;
+    }
+    result.rawEvents.push(event);
+    update({ kind: "kimi_event", event });
+    if (event.role === "assistant") {
+      if (Array.isArray(event.content)) ingestAssistantContent(event.content);
+      if (Array.isArray(event.tool_calls)) ingestToolCalls(event.tool_calls);
+    } else if (event.role === "tool") {
+      ingestToolResult(event);
+    }
+  }
+  const rl = createInterface2({ input: child.stdout });
+  rl.on("line", processLine);
+  const code = await new Promise((resolve11) => child.on("close", resolve11));
+  const resumeMatch = stderr.match(/To resume this session:\s*kimi\s+-r\s+([A-Za-z0-9_-]+)/);
+  if (resumeMatch) result.sessionId = resumeMatch[1];
+  if (code !== 0) {
+    throw new Error(stderr.trim() || `Kimi Code exited with code ${code}`);
   }
   if (!result.text) {
     result.text = result.messages.at(-1)?.trim() ?? "";
@@ -1586,6 +1789,7 @@ async function runOpenClawAgent(job, update) {
   };
   const toolCalls = /* @__PURE__ */ new Map();
   let stderr = "";
+  const stdoutLines = [];
   let stopPolling = false;
   const child = spawn3(job.agent.command, args, {
     cwd: job.agent.cwd ?? process.cwd(),
@@ -1593,7 +1797,15 @@ async function runOpenClawAgent(job, update) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const stdout = createInterface2({ input: child.stdout });
-  stdout.on("line", () => {
+  stdout.on("line", (line) => {
+    const text = line.trim();
+    if (!text) return;
+    stdoutLines.push(text);
+    const stdoutText = extractOpenClawStdoutText(text);
+    if (!stdoutText) return;
+    result.text = stdoutText;
+    result.messages.push(stdoutText);
+    update({ kind: "message", text: stdoutText });
   });
   const stderrReader = createInterface2({ input: child.stderr });
   stderrReader.on("line", (line) => {
@@ -1625,11 +1837,11 @@ async function runOpenClawAgent(job, update) {
   }
   result.sessionFile = state.selectedFile;
   result.toolCalls = [...toolCalls.values()];
-  result.text = result.text || result.messages.at(-1)?.trim() || "";
+  result.text = result.text || result.messages.at(-1)?.trim() || extractOpenClawStdoutText(stdoutLines.at(-1) ?? "") || "";
   if (code !== 0) {
     throw new Error(stderr.trim() || `OpenClaw exited with code ${code}`);
   }
-  if (!result.sessionId) {
+  if (!result.sessionId && !result.text && result.toolCalls.length === 0) {
     throw new Error(
       [
         "OpenClaw completed, but the session key was not resolved from sessions.json.",
@@ -1650,6 +1862,17 @@ async function runOpenClawAgent(job, update) {
   }
   return JSON.stringify(result);
 }
+function extractOpenClawStdoutText(line) {
+  const text = line.trim();
+  if (!text) return "";
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object") return JSON.stringify(parsed);
+    if (typeof parsed === "string") return parsed;
+  } catch {
+  }
+  return text;
+}
 function resolveOpenClawSessionDir(args, env) {
   const configured = env.BOTAPP_OPENCLAW_SESSION_DIR ?? env.OPENCLAW_SESSION_DIR;
   if (configured) return expandPath(configured);
@@ -2162,7 +2385,7 @@ Invalid ACP stdout: ${line}`;
       clientInfo: {
         name: "botapp-daemon",
         title: "botapp daemon",
-        version: "0.2.5"
+        version: "0.2.8"
       }
     });
     const session = await request2("session/new", {
@@ -2737,7 +2960,8 @@ Configured for ${serverUrl}`));
           server: result.serverUrl ?? serverUrl,
           daemonId: data.daemon.id,
           daemonName: data.daemon.name,
-          token: data.token
+          token: data.token,
+          userEmail: result.userEmail
         });
         console.log(
           `  Daemon:  ${pc5.bold(data.daemon.name)} ${pc5.dim(`(${data.daemon.id})`)}` + pc5.dim(` profile=${savedProfile.alias}`)
@@ -3796,7 +4020,8 @@ var pairingCommand = new Command18("pairing").alias("pair").description("Pair th
       server: serverUrl,
       daemonId: data.daemon.id,
       daemonName: data.daemon.name,
-      token: data.token
+      token: data.token,
+      userEmail: grant.userEmail
     });
     console.log(pc19.green(`Paired daemon: ${pc19.bold(data.daemon.name)}`));
     console.log(`  ID:      ${data.daemon.id}`);
@@ -3832,13 +4057,130 @@ async function obtainPairingToken(opts) {
   return { pairingToken: result.pairingToken, userEmail: result.userEmail };
 }
 
+// src/commands/doctor.ts
+import { Command as Command19 } from "commander";
+import pc20 from "picocolors";
+var doctorCommand = new Command19("doctor").description("Diagnose paired daemon profiles (server reachability, token validity, account ownership)").action(async () => {
+  const profiles = loadDaemonProfiles();
+  if (profiles.length === 0) {
+    console.log(pc20.dim("No paired daemons in ~/.botapp/daemon.yaml."));
+    console.log(pc20.dim("Run `bot pair` to add one."));
+    return;
+  }
+  let warns = 0;
+  let fails = 0;
+  for (const profile of profiles) {
+    console.log(pc20.bold(`
+[${profile.alias ?? profile.server}]`));
+    console.log(`  Server: ${profile.server}`);
+    console.log(`  Daemon: ${profile.daemonName} ${pc20.dim(`(${profile.daemonId})`)}`);
+    const findings = await checkProfile(profile);
+    for (const f of findings) {
+      const tag = f.severity === "ok" ? pc20.green("  \u2713 ") : f.severity === "warn" ? pc20.yellow("  \u26A0 ") : pc20.red("  \u2717 ");
+      console.log(`${tag}${f.message}`);
+      if (f.fix) console.log(pc20.dim(`     \u2192 ${f.fix}`));
+      if (f.severity === "warn") warns += 1;
+      if (f.severity === "fail") fails += 1;
+    }
+  }
+  console.log("");
+  if (fails === 0 && warns === 0) {
+    console.log(pc20.green("All checks passed."));
+  } else {
+    const parts = [];
+    if (fails > 0) parts.push(pc20.red(`${fails} failing`));
+    if (warns > 0) parts.push(pc20.yellow(`${warns} warning${warns === 1 ? "" : "s"}`));
+    console.log(parts.join(", ") + ".");
+    if (fails > 0) process.exitCode = 1;
+  }
+});
+async function checkProfile(profile) {
+  const findings = [];
+  let serverOk = false;
+  try {
+    const res = await fetch(`${profile.server}/health`, {
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (res.ok) {
+      findings.push({ severity: "ok", message: "Server reachable" });
+      serverOk = true;
+    } else {
+      findings.push({
+        severity: "fail",
+        message: `Server returned ${res.status} ${res.statusText}`,
+        fix: `Verify the server at ${profile.server} is running.`
+      });
+    }
+  } catch (e) {
+    findings.push({
+      severity: "fail",
+      message: `Server unreachable: ${e.message ?? e}`,
+      fix: `Start the server, or remove this profile with \`bot daemon unpair ${profile.alias ?? profile.server}\`.`
+    });
+  }
+  if (!serverOk) return findings;
+  let serverEmail = null;
+  try {
+    const data = await daemonRequest(profile.server, profile.token, "/api/daemon/self");
+    findings.push({ severity: "ok", message: "Token valid" });
+    serverEmail = data.user?.email ?? null;
+    if (serverEmail) {
+      findings.push({
+        severity: "ok",
+        message: `Token paired under ${pc20.bold(serverEmail)}`
+      });
+    } else {
+      findings.push({
+        severity: "warn",
+        message: "Server returned no user record for this daemon",
+        fix: "The owning user may have been deleted. Re-pair with `bot pair`."
+      });
+    }
+    if (data.daemon?.status === "online") {
+      findings.push({ severity: "ok", message: "Daemon currently online" });
+    } else {
+      findings.push({
+        severity: "warn",
+        message: `Daemon status: ${data.daemon?.status ?? "unknown"}`,
+        fix: `Run \`bot daemon run --server ${profile.server}\` to bring it online.`
+      });
+    }
+  } catch (e) {
+    const msg = e?.message ?? String(e);
+    if (/unauthor/i.test(msg) || /token/i.test(msg)) {
+      findings.push({
+        severity: "fail",
+        message: `Token rejected: ${msg}`,
+        fix: "The token is stale (likely the server DB was reset). Re-pair with `bot pair`."
+      });
+      return findings;
+    }
+    findings.push({ severity: "fail", message: `Identity probe failed: ${msg}` });
+    return findings;
+  }
+  if (profile.userEmail && serverEmail && profile.userEmail !== serverEmail) {
+    findings.push({
+      severity: "warn",
+      message: `daemon.yaml says \`userEmail: ${profile.userEmail}\` but server says \`${serverEmail}\``,
+      fix: "Re-pair to refresh the recorded email."
+    });
+  } else if (!profile.userEmail && serverEmail) {
+    findings.push({
+      severity: "warn",
+      message: "daemon.yaml has no userEmail recorded",
+      fix: "Re-pair to capture it (cosmetic \u2014 auth still works)."
+    });
+  }
+  return findings;
+}
+
 // src/commands/update.ts
 import { spawn as spawn7 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { Command as Command19 } from "commander";
-import pc20 from "picocolors";
+import { Command as Command20 } from "commander";
+import pc21 from "picocolors";
 var PACKAGE_NAME = "botapp-cli";
-var updateCommand = new Command19("update").description("Update the `bot` CLI itself to the latest published version").option(
+var updateCommand = new Command20("update").description("Update the `bot` CLI itself to the latest published version").option(
   "--manager <pm>",
   "Force a package manager: npm | pnpm | yarn | brew (default: auto-detect)"
 ).option("--dry-run", "Print the command that would run, but do not execute it").action(async (opts) => {
@@ -3846,12 +4188,12 @@ var updateCommand = new Command19("update").description("Update the `bot` CLI it
   const manager = forced ?? detectPackageManager();
   if (manager === "npx") {
     console.log(
-      pc20.green(
+      pc21.green(
         "You are running `bot` via `npx -y botapp-cli@latest` \u2014 every invocation already fetches the latest version."
       )
     );
     console.log(
-      pc20.dim(
+      pc21.dim(
         "For a faster startup, install it globally instead:\n  npm  i -g botapp-cli@latest\n  pnpm add -g botapp-cli@latest"
       )
     );
@@ -3859,34 +4201,34 @@ var updateCommand = new Command19("update").description("Update the `bot` CLI it
   }
   if (!manager) {
     console.error(
-      pc20.red(
+      pc21.red(
         "Couldn't detect how `bot` was installed. Pick one of these manually:"
       )
     );
-    console.log(pc20.cyan("  npm  i -g botapp-cli@latest"));
-    console.log(pc20.cyan("  pnpm add -g botapp-cli@latest"));
-    console.log(pc20.cyan("  yarn global add botapp-cli@latest"));
-    console.log(pc20.cyan("  brew upgrade botapp-cli"));
+    console.log(pc21.cyan("  npm  i -g botapp-cli@latest"));
+    console.log(pc21.cyan("  pnpm add -g botapp-cli@latest"));
+    console.log(pc21.cyan("  yarn global add botapp-cli@latest"));
+    console.log(pc21.cyan("  brew upgrade botapp-cli"));
     process.exitCode = 1;
     return;
   }
   const { command, args } = updateCommandFor(manager);
-  console.log(pc20.dim(`$ ${command} ${args.join(" ")}`));
+  console.log(pc21.dim(`$ ${command} ${args.join(" ")}`));
   if (opts.dryRun) return;
   const child = spawn7(command, args, { stdio: "inherit" });
   const code = await new Promise((resolve11) => {
     child.once("error", (err) => {
-      console.error(pc20.red(`Failed to spawn ${command}: ${err.message}`));
+      console.error(pc21.red(`Failed to spawn ${command}: ${err.message}`));
       resolve11(127);
     });
     child.once("close", resolve11);
   });
   if (code !== 0) {
-    console.error(pc20.red(`Update failed (exit ${code}).`));
+    console.error(pc21.red(`Update failed (exit ${code}).`));
     process.exitCode = code ?? 1;
     return;
   }
-  console.log(pc20.green("botapp-cli updated. Run `bot --version` to confirm."));
+  console.log(pc21.green("botapp-cli updated. Run `bot --version` to confirm."));
 });
 function detectPackageManager() {
   const argv = process.argv[1] ?? "";
@@ -3921,27 +4263,27 @@ function updateCommandFor(manager) {
 }
 
 // src/commands/simulate.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 import { resolve as resolve8, join as join11 } from "path";
 import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 import { spawn as spawn8 } from "child_process";
-import pc21 from "picocolors";
-var simulateCommand = new Command20("simulate").description("Dev-tunnel a local app to a botapp server (per-user shadow)").argument("[path]", "Path to the app directory", ".").option("-s, --server <url>", "botapp server URL (default: active profile / $BOTAPP_SERVER)").option("-t, --token <token>", "auth token (default: active profile / $BOTAPP_TOKEN)").option("--entry <file>", "override the manifest entry path").option("--lifetime <minutes>", "dev-session token lifetime in minutes", "480").action(async (appPath, opts) => {
+import pc22 from "picocolors";
+var simulateCommand = new Command21("simulate").description("Dev-tunnel a local app to a botapp server (per-user shadow)").argument("[path]", "Path to the app directory", ".").option("-s, --server <url>", "botapp server URL (default: active profile / $BOTAPP_SERVER)").option("-t, --token <token>", "auth token (default: active profile / $BOTAPP_TOKEN)").option("--entry <file>", "override the manifest entry path").option("--lifetime <minutes>", "dev-session token lifetime in minutes", "480").action(async (appPath, opts) => {
   const absPath = resolve8(appPath);
   if (!existsSync13(absPath)) {
-    console.error(pc21.red(`Path not found: ${absPath}`));
+    console.error(pc22.red(`Path not found: ${absPath}`));
     process.exitCode = 1;
     return;
   }
   const manifestPath = join11(absPath, "botapp.app.json");
   if (!existsSync13(manifestPath)) {
-    console.error(pc21.red(`No botapp.app.json found in ${absPath}`));
+    console.error(pc22.red(`No botapp.app.json found in ${absPath}`));
     process.exitCode = 1;
     return;
   }
   const manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
   if (!manifest.name) {
-    console.error(pc21.red('manifest missing "name"'));
+    console.error(pc22.red('manifest missing "name"'));
     process.exitCode = 1;
     return;
   }
@@ -3949,31 +4291,31 @@ var simulateCommand = new Command20("simulate").description("Dev-tunnel a local
   const wsServer = httpServer.replace(/^http:/, "ws:").replace(/^https:/, "wss:") + "/ws/host";
   const token = resolveToken(opts.token);
   if (!token) {
-    console.error(pc21.red("not logged in: run `bot login` or pass --token"));
+    console.error(pc22.red("not logged in: run `bot login` or pass --token"));
     process.exitCode = 1;
     return;
   }
   const lifetimeMs = Math.max(6e4, Number(opts.lifetime) * 6e4);
-  console.log(pc21.dim(`requesting dev token for "${manifest.name}" from ${httpServer}...`));
+  console.log(pc22.dim(`requesting dev token for "${manifest.name}" from ${httpServer}...`));
   const devToken = await issueDevToken({
     serverUrl: httpServer,
     token,
     appName: manifest.name,
     lifetimeMs
   });
-  console.log(pc21.green("\u2713"), `dev token issued (lifetime ${opts.lifetime} min)`);
+  console.log(pc22.green("\u2713"), `dev token issued (lifetime ${opts.lifetime} min)`);
   const entryPath = resolveEntry(absPath, opts.entry ?? manifest.entry);
   if (!existsSync13(entryPath)) {
-    console.error(pc21.red(`entry not found: ${entryPath}`));
-    console.error(pc21.dim("  run `pnpm build` (or your build script) first."));
+    console.error(pc22.red(`entry not found: ${entryPath}`));
+    console.error(pc22.dim("  run `pnpm build` (or your build script) first."));
     process.exitCode = 1;
     return;
   }
-  console.log(pc21.dim(`spawning ${entryPath} ...`));
-  console.log(pc21.dim(`  BOTAPP_SERVER=${wsServer}`));
-  console.log(pc21.dim(`  BOTAPP_APP_NAME=${manifest.name}`));
+  console.log(pc22.dim(`spawning ${entryPath} ...`));
+  console.log(pc22.dim(`  BOTAPP_SERVER=${wsServer}`));
+  console.log(pc22.dim(`  BOTAPP_APP_NAME=${manifest.name}`));
   console.log(
-    pc21.cyan(
+    pc22.cyan(
       `
 When ready, your dashboard at ${httpServer} will route "${manifest.name}" to this process for your account only.
 `
@@ -3991,7 +4333,7 @@ When ready, your dashboard at ${httpServer} will route "${manifest.name}" to thi
     stdio: "inherit"
   });
   const stop = (signal) => {
-    console.log(pc21.dim(`
+    console.log(pc22.dim(`
 stopping (${signal})...`));
     if (!child.killed) child.kill(signal);
   };
@@ -3999,7 +4341,7 @@ stopping (${signal})...`));
   process.on("SIGTERM", () => stop("SIGTERM"));
   child.on("exit", (code, sig) => {
     const reason = sig ? `signal ${sig}` : `exit ${code}`;
-    console.log(pc21.dim(`child exited (${reason})`));
+    console.log(pc22.dim(`child exited (${reason})`));
     process.exit(typeof code === "number" ? code : 0);
   });
 });
@@ -4036,14 +4378,14 @@ function resolveEntry(appDir, entry) {
 }
 
 // src/commands/init.ts
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve9, join as join12 } from "path";
-import pc22 from "picocolors";
-var initCommand = new Command21("init").description("Scaffold a new hosted-tier botapp app project").argument("<name>", "App name (kebab-case; used in URL paths and manifest)").option("-d, --dir <path>", "Output directory (default: ./<name>)").option("--headless", "No frontend \u2014 backend-only app (skip src/, tailwind, etc.)").option("--description <text>", "Short description for AI agents to read").option("-f, --force", "Overwrite existing directory contents").action(async (name, opts) => {
+import pc23 from "picocolors";
+var initCommand = new Command22("init").description("Scaffold a new hosted-tier botapp app project").argument("<name>", "App name (kebab-case; used in URL paths and manifest)").option("-d, --dir <path>", "Output directory (default: ./<name>)").option("--headless", "No frontend \u2014 backend-only app (skip src/, tailwind, etc.)").option("--description <text>", "Short description for AI agents to read").option("-f, --force", "Overwrite existing directory contents").action(async (name, opts) => {
   if (!/^[a-z][a-z0-9-]*$/.test(name)) {
-    console.error(pc22.red("Invalid name. Use lowercase letters, digits, dashes; must start with a letter."));
-    console.error(pc22.dim("  e.g. my-app, todo-tracker, gomoku-2"));
+    console.error(pc23.red("Invalid name. Use lowercase letters, digits, dashes; must start with a letter."));
+    console.error(pc23.dim("  e.g. my-app, todo-tracker, gomoku-2"));
     process.exitCode = 1;
     return;
   }
@@ -4057,8 +4399,8 @@ var initCommand = new Command21("init").description("Scaffold a new hosted-tier
       }
     })();
     if (Array.isArray(stat) && stat.length > 0) {
-      console.error(pc22.red(`Target directory exists and is not empty: ${targetDir}`));
-      console.error(pc22.dim("  pass --force to overwrite, or pick a different --dir"));
+      console.error(pc23.red(`Target directory exists and is not empty: ${targetDir}`));
+      console.error(pc23.dim("  pass --force to overwrite, or pick a different --dir"));
       process.exitCode = 1;
       return;
     }
@@ -4075,18 +4417,18 @@ var initCommand = new Command21("init").description("Scaffold a new hosted-tier
     mkdirSync6(dirname2(full), { recursive: true });
     writeFileSync4(full, content);
   }
-  console.log(pc22.green("\u2713"), `Scaffolded ${ctx.headless ? "headless " : ""}app at`, pc22.cyan(targetDir));
+  console.log(pc23.green("\u2713"), `Scaffolded ${ctx.headless ? "headless " : ""}app at`, pc23.cyan(targetDir));
   console.log();
   console.log("Next steps:");
-  console.log(pc22.dim(`  cd ${targetDir.replace(process.cwd() + "/", "")}`));
-  console.log(pc22.dim("  pnpm install        # or npm install"));
-  if (!ctx.headless) console.log(pc22.dim("  pnpm build          # builds api/ + frontend (dist/)"));
-  else console.log(pc22.dim("  pnpm build          # builds api/ to dist/api.js"));
-  console.log(pc22.dim(`  bot login --server <your-botapp-server>`));
-  console.log(pc22.dim(`  bot simulate        # dev-tunnel into the server, hot-reload as you build`));
+  console.log(pc23.dim(`  cd ${targetDir.replace(process.cwd() + "/", "")}`));
+  console.log(pc23.dim("  pnpm install        # or npm install"));
+  if (!ctx.headless) console.log(pc23.dim("  pnpm build          # builds api/ + frontend (dist/)"));
+  else console.log(pc23.dim("  pnpm build          # builds api/ to dist/api.js"));
+  console.log(pc23.dim(`  bot login --server <your-botapp-server>`));
+  console.log(pc23.dim(`  bot simulate        # dev-tunnel into the server, hot-reload as you build`));
   console.log();
   console.log(
-    pc22.dim("Once it works, `bot publish` ships it to the server (per-user install by default).")
+    pc23.dim("Once it works, `bot publish` ships it to the server (per-user install by default).")
   );
 });
 function fullFiles(ctx) {
@@ -4150,7 +4492,7 @@ function packageJson(ctx, headless) {
     typecheck: "tsc --noEmit"
   };
   const deps = {
-    "botapp-sdk": "^0.1.0",
+    "botapp-sdk": "^0.1.1",
     ws: "^8.18.0"
   };
   const devDeps = {
@@ -4312,7 +4654,7 @@ function apiEntryTs(ctx, headless) {
 
     ctx.serveStatic('./dist/public')
 `;
-  return `import { BotApp } from 'botapp-sdk'
+  return `import { BotApp, runHosted } from 'botapp-sdk'
 
 const app = new BotApp({
   name: '${ctx.name}',
@@ -4334,7 +4676,16 @@ const app = new BotApp({
 ${widget}  },
 })
 
-await app.start()
+export default app
+
+// Hosted-tier bridge: only connects when launched with BOTAPP_SERVER +
+// BOTAPP_APP_TOKEN (set by \`bot simulate\` and the platform-spawned runner).
+// In every other context (tests, in-process discovery) the bridge stays
+// dormant. Use globalThis.process so this typechecks without @types/node.
+const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {}
+if (env.BOTAPP_SERVER && env.BOTAPP_APP_TOKEN) {
+  await runHosted(app)
+}
 `;
 }
 function srcMainTsx(_ctx) {
@@ -4375,32 +4726,53 @@ export function App() {
 }
 function srcApiTs() {
   return `// Tiny client for calling app routes/commands from the browser.
-// Routes resolve as /apps/<name>/* on the platform; the platform forwards
-// each request to your app's WebSocket session.
+// Two ways an app frontend reaches its backend on a botapp server:
+//
+//   1. Path-prefixed:   /apps/<name>/api/commands/<cmd>  (on bare apex)
+//   2. Subdomain:       /api/apps/<name>/commands/<cmd>  (on app subdomain)
+//
+// The subdomain dispatcher in the server leaves /api/* unrewritten on
+// subdomain hosts, so the frontend has to construct the absolute
+// /api/apps/<name>/... URL itself. We resolve <name> three ways and
+// take the first that works:
+//   \u2022 from a /apps/<name>/ path prefix (host is the apex)
+//   \u2022 from the first DNS label (host is <name>.<domain>)
+//   \u2022 fallback: skip the /api/apps/<name> prefix (single-app local dev)
 
-const APP_BASE = ((): string => {
-  const m = location.pathname.match(/^\\/apps\\/[^/]+\\//)
-  return m ? m[0] : '/'
-})()
+function resolveAppName(): string | null {
+  const m = location.pathname.match(/^\\/apps\\/([^/]+)\\//)
+  if (m) return m[1]
+  const host = location.hostname
+  const first = host.split('.')[0]
+  if (first && first !== 'www' && host.split('.').length >= 2) return first
+  return null
+}
 
-export async function callCommand(name: string, params: Record<string, unknown> = {}) {
-  const r = await fetch(\`\${APP_BASE}api/commands/\${encodeURIComponent(name)}\`, {
+const APP_NAME = resolveAppName()
+const API_BASE = APP_NAME ? \`/api/apps/\${APP_NAME}\` : '/api'
+
+async function call(kind: 'commands' | 'actions', name: string, params: Record<string, unknown>): Promise<unknown> {
+  const r = await fetch(\`\${API_BASE}/\${kind}/\${encodeURIComponent(name)}\`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(params),
   })
   if (!r.ok) throw new Error(await r.text())
-  return r.json()
+  // The /api/apps/<name>/... handler wraps responses as
+  // \`{ status: 'success', result }\` or \`{ status: 'error', error }\`.
+  // Unwrap so callers see the bare result; throw on error.
+  const json = (await r.json()) as { status?: string; result?: unknown; error?: string }
+  if (json.status === 'error') throw new Error(json.error ?? 'unknown error')
+  if (json.status === 'success') return json.result
+  return json
+}
+
+export async function callCommand(name: string, params: Record<string, unknown> = {}) {
+  return call('commands', name, params)
 }
 
 export async function callAction(name: string, params: Record<string, unknown> = {}) {
-  const r = await fetch(\`\${APP_BASE}api/actions/\${encodeURIComponent(name)}\`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(params),
-  })
-  if (!r.ok) throw new Error(await r.text())
-  return r.json()
+  return call('actions', name, params)
 }
 `;
 }
@@ -4466,38 +4838,38 @@ function dirname2(p) {
 }
 
 // src/commands/publish.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 import { resolve as resolve10, join as join13, relative as relative2 } from "path";
 import { existsSync as existsSync15, readFileSync as readFileSync10, statSync as statSync4, readdirSync as readdirSync2 } from "fs";
 import { createGzip } from "zlib";
 import { spawn as spawn9 } from "child_process";
-import pc23 from "picocolors";
-var publishCommand = new Command22("publish").description("Build, pack, and upload an app to a botapp server").argument("[path]", "App directory", ".").option("-s, --server <url>", "Server URL (default: active profile / $BOTAPP_SERVER)").option("-t, --token <token>", "Auth token (default: active profile / $BOTAPP_TOKEN)").option("--public", "Request public visibility (queues admin review). Default: private.").option("--no-build", "Skip running `pnpm build` / `npm run build`").option("--bundle-dir <dir>", "Directory to bundle into tar.gz (default: dist/public if exists, else dist)").action(async (appPath, opts) => {
+import pc24 from "picocolors";
+var publishCommand = new Command23("publish").description("Build, pack, and upload an app to a botapp server").argument("[path]", "App directory", ".").option("-s, --server <url>", "Server URL (default: active profile / $BOTAPP_SERVER)").option("-t, --token <token>", "Auth token (default: active profile / $BOTAPP_TOKEN)").option("--public", "Request public visibility (queues admin review). Default: private.").option("--no-build", "Skip running `pnpm build` / `npm run build`").option("--bundle-dir <dir>", "Directory to bundle into tar.gz (default: dist/public if exists, else dist)").action(async (appPath, opts) => {
   const absPath = resolve10(appPath);
   const manifestPath = join13(absPath, "botapp.app.json");
   if (!existsSync15(manifestPath)) {
-    console.error(pc23.red(`No botapp.app.json found in ${absPath}`));
+    console.error(pc24.red(`No botapp.app.json found in ${absPath}`));
     process.exitCode = 1;
     return;
   }
   const manifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
   if (!manifest.name) {
-    console.error(pc23.red('manifest missing "name"'));
+    console.error(pc24.red('manifest missing "name"'));
     process.exitCode = 1;
     return;
   }
   const server = resolveServerUrl(opts.server);
   const token = resolveToken(opts.token);
   if (!token) {
-    console.error(pc23.red("not logged in: run `bot login` or pass --token"));
+    console.error(pc24.red("not logged in: run `bot login` or pass --token"));
     process.exitCode = 1;
     return;
   }
   if (opts.build !== false) {
-    console.log(pc23.dim("building app..."));
+    console.log(pc24.dim("building app..."));
     const ok = await runBuild(absPath);
     if (!ok) {
-      console.error(pc23.red("build failed; aborting"));
+      console.error(pc24.red("build failed; aborting"));
       process.exitCode = 1;
       return;
     }
@@ -4505,14 +4877,14 @@ var publishCommand = new Command22("publish").description("Build, pack, and uplo
   const bundleDir = opts.bundleDir ? resolve10(absPath, opts.bundleDir) : pickBundleDir(absPath);
   let bundleB64;
   if (bundleDir && existsSync15(bundleDir)) {
-    console.log(pc23.dim(`packing ${relative2(absPath, bundleDir)}/ \u2192 tar.gz...`));
+    console.log(pc24.dim(`packing ${relative2(absPath, bundleDir)}/ \u2192 tar.gz...`));
     const bytes = await packDirToTarGz(bundleDir);
     bundleB64 = bytes.toString("base64");
-    console.log(pc23.dim(`  bundle: ${(bytes.length / 1024).toFixed(1)} KiB`));
+    console.log(pc24.dim(`  bundle: ${(bytes.length / 1024).toFixed(1)} KiB`));
   } else {
-    console.log(pc23.dim("no frontend bundle to upload (headless app or no dist/public)"));
+    console.log(pc24.dim("no frontend bundle to upload (headless app or no dist/public)"));
   }
-  console.log(pc23.dim(`uploading to ${server}/api/apps/upload (${opts.public ? "public" : "private"})...`));
+  console.log(pc24.dim(`uploading to ${server}/api/apps/upload (${opts.public ? "public" : "private"})...`));
   const res = await fetch(`${server}/api/apps/upload`, {
     method: "POST",
     headers: authHeaders(token),
@@ -4524,23 +4896,23 @@ var publishCommand = new Command22("publish").description("Build, pack, and uplo
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
-    console.error(pc23.red(`upload failed (${res.status}): ${body}`));
+    console.error(pc24.red(`upload failed (${res.status}): ${body}`));
     process.exitCode = 1;
     return;
   }
   const data = await res.json();
   if (!data.ok) {
-    console.error(pc23.red(`upload rejected: ${data.error ?? "unknown"}`));
+    console.error(pc24.red(`upload rejected: ${data.error ?? "unknown"}`));
     process.exitCode = 1;
     return;
   }
-  console.log(pc23.green("\u2713"), data.message ?? "uploaded");
+  console.log(pc24.green("\u2713"), data.message ?? "uploaded");
   if (data.install) {
-    console.log(pc23.dim(`  id: ${data.install.id}`));
-    console.log(pc23.dim(`  version: ${data.install.version}`));
-    console.log(pc23.dim(`  visibility: ${data.install.visibility}`));
+    console.log(pc24.dim(`  id: ${data.install.id}`));
+    console.log(pc24.dim(`  version: ${data.install.version}`));
+    console.log(pc24.dim(`  visibility: ${data.install.visibility}`));
     if (data.install.reviewStatus !== "none") {
-      console.log(pc23.dim(`  review: ${data.install.reviewStatus}`));
+      console.log(pc24.dim(`  review: ${data.install.reviewStatus}`));
     }
   }
 });
@@ -4615,9 +4987,9 @@ function gzip(input2) {
 }
 
 // src/commands/review.ts
-import { Command as Command23 } from "commander";
-import pc24 from "picocolors";
-var reviewCommand = new Command23("review").description("Admin: review queue for public-visibility uploads");
+import { Command as Command24 } from "commander";
+import pc25 from "picocolors";
+var reviewCommand = new Command24("review").description("Admin: review queue for public-visibility uploads");
 reviewCommand.command("list").description("List pending public-visibility uploads").option("-s, --server <url>", "Server URL").option("-t, --token <token>", "Auth token").action(async (opts) => {
   const server = resolveServerUrl(opts.server);
   const token = resolveToken(opts.token);
@@ -4629,15 +5001,15 @@ reviewCommand.command("list").description("List pending public-visibility upload
   }
   const data = await res.json();
   if (!data.pending?.length) {
-    console.log(pc24.dim("queue empty"));
+    console.log(pc25.dim("queue empty"));
     return;
   }
   for (const i of data.pending) {
-    console.log(pc24.bold(i.id), pc24.cyan(i.appName), pc24.dim(`v${i.version}`));
-    console.log(pc24.dim(`  uploader: ${i.ownerUserId ?? "(server-wide)"}`));
-    console.log(pc24.dim(`  uploaded: ${i.uploadedAt}`));
+    console.log(pc25.bold(i.id), pc25.cyan(i.appName), pc25.dim(`v${i.version}`));
+    console.log(pc25.dim(`  uploader: ${i.ownerUserId ?? "(server-wide)"}`));
+    console.log(pc25.dim(`  uploaded: ${i.uploadedAt}`));
     const desc = i.manifest?.description;
-    if (desc) console.log(pc24.dim(`  description: ${desc}`));
+    if (desc) console.log(pc25.dim(`  description: ${desc}`));
     console.log();
   }
 });
@@ -4658,17 +5030,17 @@ async function decide(id, decision, opts) {
   }
   const data = await res.json();
   if (!data.ok) return die(`server rejected: ${data.error ?? "unknown"}`);
-  console.log(pc24.green("\u2713"), `${decision}d`, data.install?.appName, pc24.dim(`(${data.install?.id})`));
-  if (data.install?.reviewNotes) console.log(pc24.dim(`  notes: ${data.install.reviewNotes}`));
+  console.log(pc25.green("\u2713"), `${decision}d`, data.install?.appName, pc25.dim(`(${data.install?.id})`));
+  if (data.install?.reviewNotes) console.log(pc25.dim(`  notes: ${data.install.reviewNotes}`));
 }
 function die(msg) {
-  console.error(pc24.red(msg));
+  console.error(pc25.red(msg));
   process.exitCode = 1;
 }
 
 // src/index.ts
-var version = "0.2.5";
-var program = new Command24().name("bot").description("botapp CLI \u2014 operate apps from the command line").version(version).enablePositionalOptions(true).option("--json", "Output as JSON").option("-s, --server <url>", "Server URL override").option("-t, --token <token>", "Auth token override").option("-v, --verbose", "Verbose output");
+var version = "0.2.8";
+var program = new Command25().name("bot").description("botapp CLI \u2014 operate apps from the command line").version(version).enablePositionalOptions(true).option("--json", "Output as JSON").option("-s, --server <url>", "Server URL override").option("-t, --token <token>", "Auth token override").option("-v, --verbose", "Verbose output");
 program.addCommand(launchCommand);
 program.addCommand(runCommand);
 program.addCommand(appsCommand);
@@ -4679,6 +5051,7 @@ program.addCommand(loginCommand);
 program.addCommand(agentCommand);
 program.addCommand(pairingCommand);
 program.addCommand(daemonCommand);
+program.addCommand(doctorCommand);
 program.addCommand(initCommand);
 program.addCommand(installCommand);
 program.addCommand(uninstallCommand);
@@ -4730,29 +5103,29 @@ To discover what params a command accepts:
 program.on("command:*", (operands) => {
   const first = operands[0];
   const known = program.commands.filter((c) => !c._hidden).map((c) => c.name());
-  const topLevelHint = `Run ${pc25.cyan("bot --help")} for the list of top-level commands.`;
+  const topLevelHint = `Run ${pc26.cyan("bot --help")} for the list of top-level commands.`;
   const argv = process.argv.slice(2);
   const firstIdx = argv.indexOf(first);
   const tail = firstIdx >= 0 ? argv.slice(firstIdx + 1) : [];
   if (tail.length > 0) {
     const suggested = `bot run ${first} ${tail.join(" ")}`;
     console.error(
-      pc25.red(`error: unknown command '${first}'`) + `
+      pc26.red(`error: unknown command '${first}'`) + `
 
-App commands go through ${pc25.bold("bot run")}. Did you mean:
+App commands go through ${pc26.bold("bot run")}. Did you mean:
 
-  ${pc25.cyan(suggested)}
+  ${pc26.cyan(suggested)}
 
 ${topLevelHint}`
     );
     process.exit(1);
   }
   console.error(
-    pc25.red(`error: unknown command '${first}'`) + `
+    pc26.red(`error: unknown command '${first}'`) + `
 
 If '${first}' is an app name, invoke one of its commands with:
-  ${pc25.cyan(`bot run ${first} <command> [--key value ...]`)}
-  ${pc25.cyan("bot apps --json")}   ${pc25.dim("(to see what commands exist)")}
+  ${pc26.cyan(`bot run ${first} <command> [--key value ...]`)}
+  ${pc26.cyan("bot apps --json")}   ${pc26.dim("(to see what commands exist)")}
 
 Top-level commands: ${known.join(", ")}
 ${topLevelHint}`