brand-manager-worker 0.1.0

package/README.md

@@ -0,0 +1,62 @@
+# brand-manager-worker
+
+The Goose Tools brand worker — one daemon serving **Brand Manager** (inbound: reads your brand
+email, drafts replies in your voice) and **Brand Outreach** (outbound: researches brands you want
+to work with and drafts the pitch). It runs on **your** computer using **your own Claude account** — so there's no API key and nothing to pay
+for beyond the Claude subscription you already have.
+
+**It never sends anything.** Every reply is created as a Gmail draft for you to review. The Gmail
+permission granted doesn't include sending, and no code in this package calls Gmail's send endpoint.
+
+## Setup
+
+You don't normally run these by hand — <https://goosetools.com/dashboard/brand-manager> gives you a
+one-line command with your token in it. For reference:
+
+```bash
+npm install -g @anthropic-ai/claude-code   # the thing that writes your replies
+claude                                     # once, to sign in — then type /exit
+
+npx --yes brand-manager-worker install --token gt_…
+```
+
+`install` registers a background service that starts with your computer. You don't need to leave a
+terminal open.
+
+```bash
+npx --yes brand-manager-worker@latest status     # what's running, recent logs
+npx --yes brand-manager-worker@latest update     # pull the newest version, restart
+npx --yes brand-manager-worker uninstall         # remove it
+```
+
+One token connects your computer to every Goose Tools worker. If you've already set up the Carousel
+or Caption worker, `install` here needs no `--token`.
+
+## Where your stuff lives
+
+Everything personal is on your machine, in `~/.goosetools/brand-manager/`:
+
+```
+base/       prompt files synced down from Goose Tools — don't hand-edit, they get overwritten
+voice/      how you write to brands
+playbook/   rate-card.md and your negotiation moves
+deals/      one markdown ledger per brand: terms, dates, what's outstanding
+stats/      your media-kit numbers and screenshots
+drafts.md   every reply it has drafted
+state.json  which threads it has already handled
+```
+
+These are ordinary files. You can open the folder in Claude Code and talk to the agent directly —
+"bump my Reel rate", "what did this brand agree to?" — exactly as you would in the standalone
+brand-manager repo. The website is a view onto these files, not the other way round.
+
+Your email bodies and contracts are never uploaded. What the site stores is thread metadata (who,
+subject, when), your ledgers and knowledge files, and the drafts the agent wrote.
+
+## Development
+
+```bash
+node worker/index.js --url http://localhost:3000 --token gt_…
+```
+
+Config precedence: command-line flags → environment → `worker/.env` → `~/.goosetools/env`.

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "brand-manager-worker",
+  "version": "0.1.0",
+  "description": "The Goose Tools brand-deal worker — your computer reads your brand email and drafts replies in your voice for goosetools.com, using your own Claude account. Drafts only; it never sends.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ernkerr/brand-manager-worker.git"
+  },
+  "files": [
+    "worker",
+    "README.md"
+  ],
+  "type": "module",
+  "bin": {
+    "brand-manager-worker": "worker/cli.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "worker": "node worker/index.js",
+    "test": "node --test \"test/*.test.js\""
+  },
+  "dependencies": {
+    "mammoth": "^1.8.0",
+    "pdf-parse": "^1.1.1"
+  }
+}

package/worker/agent.js

@@ -0,0 +1,212 @@
+// The inbound drafting brain: classification, the drafting prompt, decision
+// parsing, and the learn-from-sent-edits diff. Ported from brand-manager's
+// src/core/agent.ts + the classify/pre-filter half of src/core/pipeline.ts.
+//
+// decide() is deliberately single-shot with tools OFF — all context inlined
+// by loadContext() — per the ~36s-vs-10min lesson recorded in claude.js.
+
+import { oneShot, parseJson, session } from "./claude.js";
+import { loadContext, invalidateContext } from "./context.js";
+import { BRAND_DIR } from "./paths.js";
+
+// Automated / no-reply senders never send brand deals — skip them WITHOUT
+// spending a Claude call. Conservative on purpose: real brands/agencies use
+// human addresses.
+const AUTOMATED_SENDER =
+  /no-?reply|do-?not-?reply|noreply|mailer-daemon|postmaster|notifications?@|accounts\.google\.com|@.*\.(beehiiv|substack)\.com|@e\.|@email\.|@mail\./i;
+
+export const isAutomated = (from) => AUTOMATED_SENDER.test(from);
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Decide whether a thread needs the agent, and why. Pure: state lookups are
+ * injected so this is unit-testable and reusable from any handler.
+ * Returns 'new-or-reply' | 'followup-due' | null.
+ */
+export function classify(thread, { followupDays, isHandled, lastFollowupAt }) {
+  const last = thread.last;
+  if (!last.fromMe && isAutomated(last.from)) return null;
+  const ageDays = (Date.now() - Date.parse(last.date)) / DAY_MS;
+
+  if (last.fromMe) {
+    // Ball is in the brand's court. Nudge only once per followupDays window.
+    if (ageDays < followupDays) return null;
+    const lastNudge = lastFollowupAt(thread.id);
+    if (lastNudge && (Date.now() - Date.parse(lastNudge)) / DAY_MS < followupDays) return null;
+    return "followup-due";
+  }
+
+  // Brand sent last — draft a reply, unless we already drafted against this message.
+  if (isHandled(thread.id, last.id)) return null;
+  return "new-or-reply";
+}
+
+function renderThread(thread) {
+  const n = thread.messages.length;
+  return thread.messages
+    .map((m, i) => {
+      const isLast = i === n - 1;
+      const text = (m.body || m.snippet).slice(0, isLast ? 6000 : 1800);
+      const who = m.fromMe ? "YOU (the creator)" : "BRAND";
+      const tag = isLast ? "   <<<<< LATEST MESSAGE — your reply responds to THIS one" : "";
+      return `--- ${who} | ${m.from} | ${m.date}${tag}\nSubject: ${m.subject}\n${text}`;
+    })
+    .join("\n\n");
+}
+
+function buildPrompt({ thread, reason, instruction, contracts, context }) {
+  const contractBlock = contracts.length
+    ? `\n\nATTACHED DOCUMENTS (extracted text — verify per the contract mode above):\n${contracts
+        .map((d) => `### ${d.filename}\n${d.text.slice(0, 8000) || "(could not extract text)"}`)
+        .join("\n\n")}`
+    : "";
+
+  // A user instruction steers THIS draft only. It sits above the mode
+  // guidance so it wins for the turn without becoming a learned rule.
+  const steeringBlock = instruction
+    ? [
+        ``,
+        `===== CREATOR'S INSTRUCTION FOR THIS REPLY (overrides mode guidance for this draft only) =====`,
+        instruction,
+      ].join("\n")
+    : "";
+
+  return [
+    `You are brand-manager, drafting a brand-deal email reply for the creator.`,
+    `EVERYTHING you need is provided below. DO NOT use any tools and DO NOT read files —`,
+    `all voice, playbook, rate card, stats, deal ledgers, and mode guidance are inline here.`,
+    `Respond with ONLY the JSON described at the end. Work from the provided context alone.`,
+    ``,
+    `===== CONTEXT (voice · playbook · rates · stats · deal ledgers · modes) =====`,
+    context,
+    `===== END CONTEXT =====`,
+    steeringBlock,
+    ``,
+    `===== TASK =====`,
+    `REASON: ${reason}`,
+    `ACCOUNT: ${thread.account}`,
+    `THREAD ID: ${thread.id}`,
+    `REPLY TO MESSAGE ID: ${thread.last.id}`,
+    `BRAND CONTACT: ${thread.last.from}`,
+    `EXISTING UNSENT DRAFT IN THREAD: ${thread.hasUnsentDraft ? "yes — produce a distinct SECOND option" : "no"}`,
+    ``,
+    `THREAD (oldest first — read ALL of it before drafting):`,
+    renderThread(thread),
+    contractBlock,
+    ``,
+    `===== HOW TO READ THE THREAD =====`,
+    `- Your reply responds to the LATEST message (marked above). Address that message and its sender.`,
+    `- But READ THE WHOLE THREAD first and treat it all as established context. The brand has often`,
+    `  already told you things earlier in the thread (number of videos, deliverables, channel, budget,`,
+    `  timeline, usage). NEVER ask for something they already stated anywhere in the thread. If they said`,
+    `  "2 reels," acknowledge 2 reels and move on — do not ask "how many reels?". Only ask what is`,
+    `  genuinely still missing, and skip the scoping questions entirely if it's all already answered.`,
+    `- Don't re-introduce yourself or repeat points you already made earlier in the thread.`,
+    ``,
+    `===== TONE =====`,
+    `Warm and friendly first, professional underneath. Sound like a real person who is glad to hear from`,
+    `them, not a terms-and-conditions bot. Open with genuine warmth, keep pushback collaborative and kind`,
+    `(questions and requests, never demands or accusations), and close on a friendly note. Firm on the`,
+    `substance, soft in the delivery.`,
+    ``,
+    `===== OUTPUT =====`,
+    `Output ONLY a single fenced \`\`\`json block with this shape:`,
+    `{"action":"draft"|"skip","to":"<email>","subject":"Re: ...","body":"<full reply, warm + professional, no em dashes, never the phrase 'happy to explore this'>","attachments":["stats/screenshots/..."],"summary":"<one line>","flags":["<any contract/exclusivity discrepancy>"]}`,
+    `Rules: draft only (never send); honor the voice (no em dashes; banned phrases); reply to the latest`,
+    `message using the whole thread as context (never re-ask answered questions); if an unsent draft`,
+    `exists, produce a distinct second option; gifted-only -> Story mention, not a free Reel; verify any`,
+    `attached contract and FLAG specific discrepancies; check the deal ledgers for exclusivity conflicts.`,
+    `If no reply is warranted, use action "skip" with a reason in summary.`,
+  ].join("\n");
+}
+
+/**
+ * Run the drafting agent over one thread. Returns the Decision or null on
+ * failure — and null MUST mean "retry later", never "skip this thread".
+ */
+export async function decide({ thread, reason, instruction = null, contracts = [] }) {
+  const context = loadContext();
+  const prompt = buildPrompt({ thread, reason, instruction, contracts, context });
+  const stdout = await oneShot(prompt, { cwd: BRAND_DIR });
+  const decision = parseJson(stdout);
+  if (!decision || (decision.action !== "draft" && decision.action !== "skip")) return null;
+  return decision;
+}
+
+const normalizeWs = (s) => s.replace(/\s+/g, " ").trim();
+
+/**
+ * Word-level LCS diff -> list of `- "DRAFT text" -> "SENT text"` hunks.
+ * Ignores whitespace so plain-text re-wrapping on send doesn't register.
+ */
+export function wordDiffHunks(a, b) {
+  const A = normalizeWs(a).split(" ");
+  const B = normalizeWs(b).split(" ");
+  const n = A.length;
+  const m = B.length;
+  const dp = Array.from({ length: n + 1 }, () => new Int32Array(m + 1));
+  for (let i = n - 1; i >= 0; i--)
+    for (let j = m - 1; j >= 0; j--)
+      dp[i][j] = A[i] === B[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+  const hunks = [];
+  let i = 0;
+  let j = 0;
+  let del = [];
+  let ins = [];
+  const flush = () => {
+    if (del.length || ins.length) hunks.push(`- "${del.join(" ")}" -> "${ins.join(" ")}"`);
+    del = [];
+    ins = [];
+  };
+  while (i < n && j < m) {
+    if (A[i] === B[j]) {
+      flush();
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) del.push(A[i++]);
+    else ins.push(B[j++]);
+  }
+  while (i < n) del.push(A[i++]);
+  while (j < m) ins.push(B[j++]);
+  flush();
+  return hunks;
+}
+
+/**
+ * Diff what the creator actually sent against the body we drafted, and let
+ * the agent save any DURABLE preference to the personal layer. Edits files,
+ * so it runs as a tool-enabled session scoped to the brand directory.
+ * Returns a one-line summary ('' = nothing learned).
+ */
+export async function learnFromEdit({ subject, brandContact, original, sent }) {
+  const hunks = wordDiffHunks(original, sent);
+  if (hunks.length === 0) return ""; // sent verbatim
+  // A huge diff means a rewrite, not a tweak — too noisy to mine reliably.
+  if (hunks.length > 40) return "";
+
+  const prompt = [
+    `You are brand-manager. The creator edited your drafted reply before sending it. Learn from the`,
+    `edits per base/rules/feedback-loop.md — this IS the "diff the sent draft against the original`,
+    `and learn" step.`,
+    ``,
+    `Thread subject: ${subject}`,
+    `Brand contact: ${brandContact}`,
+    ``,
+    `The exact changes they made (DRAFT wording -> what they SENT):`,
+    ...hunks,
+    ``,
+    `For each change, decide whether it reflects a DURABLE preference worth saving:`,
+    `- Wording / tone / phrasing -> append to voice/voice.md (or voice/never-words.md if they removed`,
+    `  a word/phrase they dislike).`,
+    `- A rate or number -> playbook/rate-card.md. A negotiation move -> playbook/negotiation.md.`,
+    `- A fact specific to this brand -> deals/<brand>.md.`,
+    `Rules: APPEND, never overwrite. Choose the MOST SPECIFIC file. Skip typos and one-off phrasings`,
+    `that carry no reusable lesson. If nothing is durable, save nothing.`,
+    `Finally, output ONE line summarizing what you saved, or exactly "no durable lesson" if you saved nothing.`,
+  ].join("\n");
+
+  const { text } = await session(prompt, { cwd: BRAND_DIR, timeoutMs: 4 * 60 * 1000 });
+  invalidateContext();
+  return text.trim().split("\n").filter(Boolean).pop() ?? "";
+}

package/worker/api.js

@@ -0,0 +1,104 @@
+// Talking to Goose Tools: config resolution, the job endpoints, and the base
+// asset sync.
+//
+// Config precedence matches the other workers exactly — flags beat env beats
+// worker/.env beats ~/.goosetools/env — so a machine already connected for
+// carousels or captions is already connected for this, no second token.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { mkdirSync } from "node:fs";
+import { GOOSE_DIR, BASE_DIR, ASSETS_VERSION_FILE } from "./paths.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+function parseEnvFile(file) {
+  if (!existsSync(file)) return {};
+  return Object.fromEntries(
+    readFileSync(file, "utf8")
+      .split("\n")
+      .filter((l) => l.includes("=") && !l.trim().startsWith("#"))
+      .map((l) => [l.slice(0, l.indexOf("=")).trim(), l.slice(l.indexOf("=") + 1).trim()]),
+  );
+}
+
+function flag(name) {
+  const i = process.argv.indexOf(name);
+  return i !== -1 ? process.argv[i + 1] : undefined;
+}
+
+const localEnv = parseEnvFile(join(HERE, ".env"));
+const sharedEnv = parseEnvFile(join(GOOSE_DIR, "env"));
+
+export const BASE_URL = (
+  flag("--url") ??
+  process.env.GOOSETOOLS_URL ??
+  localEnv.GOOSETOOLS_URL ??
+  sharedEnv.GOOSETOOLS_URL ??
+  "https://goosetools.com"
+).replace(/\/$/, "");
+
+export const TOKEN =
+  flag("--token") ??
+  process.env.WORKER_TOKEN ??
+  localEnv.WORKER_TOKEN ??
+  sharedEnv.WORKER_TOKEN;
+
+export const POLL_MS = 30_000;
+
+/** POST to /api/brand/worker/<path>. Returns null on 204 (no work). */
+export async function api(path, body) {
+  const res = await fetch(`${BASE_URL}/api/brand/worker/${path}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${TOKEN}`,
+      "content-type": "application/json",
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (res.status === 204) return null;
+  if (res.status === 401) {
+    console.error(
+      "\nThis computer's token was rejected.\n" +
+        "Reconnect it from https://goosetools.com/dashboard/brand-manager\n",
+    );
+    process.exit(1);
+  }
+  if (!res.ok) {
+    throw new Error(`${path} failed: ${res.status} ${(await res.text()).slice(0, 300)}`);
+  }
+  return res.json();
+}
+
+/**
+ * Sync the base prompt layer if the server's version differs from ours.
+ *
+ * The base layer is served rather than bundled so a prompt fix reaches every
+ * connected machine on the next poll. Local personal files (voice/, playbook/,
+ * deals/) are never touched by this — only base/.
+ */
+export async function syncAssets(serverVersion) {
+  const local = existsSync(ASSETS_VERSION_FILE)
+    ? readFileSync(ASSETS_VERSION_FILE, "utf8").trim()
+    : null;
+  if (serverVersion && local === serverVersion) return false;
+
+  const res = await fetch(
+    `${BASE_URL}/api/brand/assets${local ? `?version=${encodeURIComponent(local)}` : ""}`,
+    { headers: { authorization: `Bearer ${TOKEN}` } },
+  );
+  if (!res.ok) throw new Error(`asset sync failed: ${res.status}`);
+  const data = await res.json();
+  if (data.unchanged) return false;
+
+  for (const [rel, body] of Object.entries(data.files ?? {})) {
+    // Defensive: never let a server response write outside base/.
+    if (rel.includes("..") || rel.startsWith("/")) continue;
+    const dest = join(BASE_DIR, rel);
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, body);
+  }
+  writeFileSync(ASSETS_VERSION_FILE, data.version);
+  return data.version;
+}

package/worker/attachments.js

@@ -0,0 +1,50 @@
+// Contract text extraction — download contract-like attachments and pull
+// their text so the drafting prompt can verify terms against the thread.
+// Port of brand-manager's src/actions/attachment.ts.
+//
+// Extracted text is inlined into ONE prompt and discarded; nothing here
+// persists contract contents. The durable record is the deal ledger the
+// agent writes after reading it.
+
+import { createRequire } from "node:module";
+import mammoth from "mammoth";
+import { getAttachment } from "./gmail.js";
+
+// pdf-parse ships as CommonJS with a debug side-effect on default import.
+const require = createRequire(import.meta.url);
+
+const CONTRACT_EXT = /\.(pdf|docx)$/i;
+
+export function isContractLike(a) {
+  return (
+    CONTRACT_EXT.test(a.filename) ||
+    a.mimeType === "application/pdf" ||
+    a.mimeType === "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+  );
+}
+
+async function extractText(buf, filename) {
+  try {
+    if (/\.pdf$/i.test(filename)) {
+      const pdfParse = require("pdf-parse");
+      return (await pdfParse(buf)).text.trim();
+    }
+    if (/\.docx$/i.test(filename)) {
+      return (await mammoth.extractRawText({ buffer: buf })).value.trim();
+    }
+  } catch {
+    // Unsupported/corrupt file → '' and the prompt says so explicitly.
+  }
+  return "";
+}
+
+/** Download + extract text from every contract-like attachment on a message. */
+export async function extractContracts(accessToken, messageId, attachments) {
+  const docs = [];
+  for (const a of attachments) {
+    if (!isContractLike(a)) continue;
+    const buf = await getAttachment(accessToken, messageId, a.id);
+    docs.push({ filename: a.filename, mimeType: a.mimeType, text: await extractText(buf, a.filename) });
+  }
+  return docs;
+}

package/worker/claude.js

@@ -0,0 +1,136 @@
+// Running Claude on this machine.
+//
+// Two modes, and the split matters for speed. brand-manager learned this the
+// hard way (commit c0c1b33): letting Claude loop on tools to gather its own
+// context took 5–10 minutes per draft versus ~36 seconds when everything was
+// inlined up front. So:
+//
+//   oneShot()  — drafting. Tools OFF, all context inlined by the caller. Fast.
+//   session()  — chat, voice-audit, stats, learn. Tools ON, scoped to the
+//                brand directory, and resumable so a follow-up message
+//                remembers the previous turn.
+//
+// There is no API key anywhere here. This runs on the user's own Claude
+// subscription via the `claude` CLI, same as every other Goose Tools worker.
+
+import { spawn } from "node:child_process";
+
+const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
+
+// stdio[0] MUST be "ignore". Inherited stdin makes every invocation hang
+// forever under launchd — brand-manager hit this exact bug (fixed in 3b1f955)
+// and it presents as the worker silently doing nothing after a reboot.
+function run(args, { timeoutMs, cwd }) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(CLAUDE_BIN, args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => (stdout += d));
+    child.stderr.on("data", (d) => (stderr += d));
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`claude timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(
+        err.code === "ENOENT"
+          ? new Error("Claude Code not found. Install: npm install -g @anthropic-ai/claude-code")
+          : err,
+      );
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(stdout);
+      else reject(new Error(`claude exited ${code}: ${stderr.slice(0, 600)}`));
+    });
+  });
+}
+
+/** Single-shot, no tools. For drafting, where the caller inlines all context. */
+export async function oneShot(prompt, { timeoutMs = 4 * 60 * 1000, cwd } = {}) {
+  return run(
+    [
+      "-p",
+      prompt,
+      "--output-format",
+      "text",
+      "--disallowedTools",
+      "Read,Edit,Write,Bash,Glob,Grep,WebFetch,WebSearch",
+    ],
+    { timeoutMs, cwd },
+  );
+}
+
+/**
+ * A real, resumable Claude Code session with tools, scoped to the brand
+ * directory. This is what makes the website chat behave like talking to the
+ * agent in a terminal: it can read the ledgers, edit the rate card, search
+ * Gmail through the worker's own commands, and remember the last turn.
+ *
+ * Returns { text, sessionId } — pass sessionId back in to continue.
+ */
+export async function session(
+  prompt,
+  {
+    cwd,
+    sessionId,
+    timeoutMs = 10 * 60 * 1000,
+    // Outreach research adds WebSearch/WebFetch — the one place minutes-long
+    // tool use is the point, not the failure mode the oneShot split avoids.
+    tools = "Read,Edit,Write,Glob,Grep",
+  } = {},
+) {
+  const args = [
+    "-p",
+    prompt,
+    "--output-format",
+    "json",
+    "--permission-mode",
+    "acceptEdits",
+    "--allowedTools",
+    tools,
+  ];
+  if (sessionId) args.push("--resume", sessionId);
+
+  const raw = await run(args, { timeoutMs, cwd });
+
+  // --output-format json gives a result envelope carrying the session id.
+  // Be forgiving: a shape change shouldn't lose the user's answer, so fall
+  // back to treating the output as plain text.
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      text: parsed.result ?? parsed.text ?? raw,
+      sessionId: parsed.session_id ?? parsed.sessionId ?? sessionId ?? null,
+    };
+  } catch {
+    return { text: raw, sessionId: sessionId ?? null };
+  }
+}
+
+/**
+ * Pull a JSON object out of Claude's text output. Ported verbatim in spirit
+ * from brand-manager's parseDecision: prefer a fenced block, else take the
+ * first {...last }. Returns null on failure — the caller must treat that as
+ * "retry later", never as "skip this thread".
+ */
+export function parseJson(text) {
+  const fenced = text.match(/```json\s*([\s\S]*?)```/);
+  const candidate = fenced
+    ? fenced[1]
+    : (() => {
+        const start = text.indexOf("{");
+        const end = text.lastIndexOf("}");
+        return start !== -1 && end > start ? text.slice(start, end + 1) : null;
+      })();
+  if (!candidate) return null;
+  try {
+    return JSON.parse(candidate);
+  } catch {
+    return null;
+  }
+}

package/worker/cli.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+// brand-manager-worker entrypoint. Like the caption worker, the only
+// prerequisite is Claude Code — it does the drafting, on this machine, with
+// the user's own subscription. Nothing here needs an API key.
+//
+//   install    save token + register a login service (worker runs forever)
+//   update     pull the newest code into the background copy + restart
+//   status     what's installed, whether it's running, recent log lines
+//   uninstall  remove the service + saved token
+//   run        run the worker loop in this window (default)
+
+import { execSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+const command = ["install", "update", "status", "uninstall", "run"].includes(process.argv[2])
+  ? process.argv[2]
+  : "run";
+
+if (command === "uninstall") {
+  const { uninstall } = await import("./service.js");
+  uninstall();
+  process.exit(0);
+}
+
+if (command === "status") {
+  const { status } = await import("./service.js");
+  status();
+  process.exit(0);
+}
+
+function flag(name) {
+  const i = process.argv.indexOf(name);
+  return i !== -1 ? process.argv[i + 1] : undefined;
+}
+
+function has(cmd) {
+  try {
+    execSync(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`, {
+      stdio: "ignore",
+      shell: true,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+if (!has("claude")) {
+  console.error(
+    "\nClaude Code isn't installed yet (it writes your replies).\n" +
+      "Install it with:  npm install -g @anthropic-ai/claude-code\n" +
+      "Then run:         claude   (once, to sign in — type /exit to leave)\n" +
+      "Then run this command again.\n",
+  );
+  process.exit(1);
+}
+
+if (command === "install") {
+  const { install } = await import("./service.js");
+  install({
+    url: (flag("--url") ?? "https://goosetools.com").replace(/\/$/, ""),
+    token: flag("--token"),
+    root: ROOT,
+  });
+} else if (command === "update") {
+  const { update } = await import("./service.js");
+  update({ root: ROOT });
+} else {
+  await import("./index.js");
+}