buildwithnexus 0.3.1 → 0.3.3

package/dist/bin.js

@@ -363,7 +363,7 @@ __export(qemu_exports, {
 import fs3 from "fs";
 import net from "net";
 import path3 from "path";
-import { execa } from "execa";
+import { execa, execaSync } from "execa";
 import { select } from "@inquirer/prompts";
 import chalk5 from "chalk";
 async function isQemuInstalled(platform) {
@@ -378,10 +378,16 @@ async function installQemu(platform) {
   if (platform.os === "mac") {
     await execa("brew", ["install", "qemu", "cdrtools"], { stdio: "inherit", env: scrubEnv() });
   } else if (platform.os === "linux") {
+    let hasApt = false;
     try {
+      await execa("which", ["apt-get"], { env: scrubEnv() });
+      hasApt = true;
+    } catch {
+    }
+    if (hasApt) {
       await execa("sudo", ["apt-get", "update"], { stdio: "inherit", env: scrubEnv() });
       await execa("sudo", ["apt-get", "install", "-y", "qemu-system", "qemu-utils", "genisoimage"], { stdio: "inherit", env: scrubEnv() });
-    } catch {
+    } else {
       await execa("sudo", ["yum", "install", "-y", "qemu-system-arm", "qemu-system-x86", "qemu-img", "genisoimage"], { stdio: "inherit", env: scrubEnv() });
     }
   } else {
@@ -392,7 +398,7 @@ async function downloadImage(platform) {
   const imagePath = path3.join(IMAGES_DIR, platform.ubuntuImage);
   if (fs3.existsSync(imagePath)) return imagePath;
   const url = `${UBUNTU_BASE_URL}/${platform.ubuntuImage}`;
-  await execa("curl", ["-L", "-o", imagePath, "--progress-bar", url], { stdio: "inherit", env: scrubEnv() });
+  await execa("curl", ["-L", "-C", "-", "-o", imagePath, "--progress-bar", url], { stdio: "inherit", env: scrubEnv() });
   return imagePath;
 }
 async function createDisk(basePath, sizeGb) {
@@ -490,38 +496,36 @@ async function resolvePortConflicts(ports) {
   return resolved;
 }
 async function launchVm(platform, diskPath, initIsoPath, ram, cpus, ports) {
-  const machineArg = platform.os === "mac" ? "-machine virt,gic-version=3" : "-machine pc";
+  const machineArgs = platform.os === "mac" ? ["-machine", "virt,gic-version=3"] : ["-machine", "pc"];
   const biosArgs = fs3.existsSync(platform.biosPath) ? ["-bios", platform.biosPath] : [];
-  function buildArgs(cpuFlag) {
-    return [
-      ...machineArg.split(" "),
-      ...cpuFlag.split(" "),
-      "-m",
-      `${ram}G`,
-      "-smp",
-      `${cpus}`,
-      "-drive",
-      `file=${diskPath},if=virtio,cache=writethrough`,
-      "-drive",
-      `file=${initIsoPath},if=virtio,format=raw,cache=writethrough`,
-      "-display",
-      "none",
-      "-serial",
-      "none",
-      "-net",
-      "nic,model=virtio",
-      "-net",
-      `user,hostfwd=tcp::${ports.ssh}-:22,hostfwd=tcp::${ports.http}-:4200,hostfwd=tcp::${ports.https}-:443`,
-      ...biosArgs,
-      "-pidfile",
-      PID_FILE,
-      "-daemonize"
-    ];
-  }
+  const buildArgs = (cpuArgs) => [
+    ...machineArgs,
+    ...cpuArgs,
+    "-m",
+    `${ram}G`,
+    "-smp",
+    `${cpus}`,
+    "-drive",
+    `file=${diskPath},if=virtio,cache=writethrough`,
+    "-drive",
+    `file=${initIsoPath},if=virtio,format=raw,cache=writethrough`,
+    "-display",
+    "none",
+    "-serial",
+    "none",
+    "-net",
+    "nic,model=virtio",
+    "-net",
+    `user,hostfwd=tcp::${ports.ssh}-:22,hostfwd=tcp::${ports.http}-:4200,hostfwd=tcp::${ports.https}-:443`,
+    ...biosArgs,
+    "-pidfile",
+    PID_FILE,
+    "-daemonize"
+  ];
   try {
-    await execa(platform.qemuBinary, buildArgs(platform.qemuCpuFlag), { env: scrubEnv() });
+    await execa(platform.qemuBinary, buildArgs(platform.qemuCpuFlag.split(" ")), { env: scrubEnv() });
   } catch {
-    const fallbackCpu = platform.os === "mac" ? "-cpu max" : "-cpu qemu64";
+    const fallbackCpu = platform.os === "mac" ? ["-cpu", "max"] : ["-cpu", "qemu64"];
     await execa(platform.qemuBinary, buildArgs(fallbackCpu), { env: scrubEnv() });
   }
   return ports;
@@ -533,6 +537,14 @@ function readValidPid() {
   if (!Number.isInteger(pid) || pid <= 1 || pid > 4194304) return null;
   return pid;
 }
+function isQemuPid(pid) {
+  try {
+    const { stdout } = execaSync("ps", ["-p", String(pid), "-o", "comm="], { env: scrubEnv() });
+    return stdout.trim().toLowerCase().includes("qemu");
+  } catch {
+    return false;
+  }
+}
 function isVmRunning() {
   const pid = readValidPid();
   if (!pid) return false;
@@ -546,6 +558,13 @@ function isVmRunning() {
 function stopVm() {
   const pid = readValidPid();
   if (!pid) return;
+  if (!isQemuPid(pid)) {
+    try {
+      fs3.unlinkSync(PID_FILE);
+    } catch {
+    }
+    return;
+  }
   try {
     process.kill(pid, "SIGTERM");
   } catch {
@@ -722,6 +741,7 @@ import { Command as Command14 } from "commander";
 // src/commands/init.ts
 init_banner();
 import { Command } from "commander";
+import chalk6 from "chalk";
 
 // src/ui/spinner.ts
 import ora from "ora";
@@ -928,69 +948,65 @@ async function createCloudInitIso(userDataPath) {
   fs5.writeFileSync(metaDataPath, "instance-id: nexus-vm-1\nlocal-hostname: nexus-vm\n", { mode: 384 });
   const isoPath = path5.join(IMAGES_DIR2, "init.iso");
   const env = scrubEnv();
-  let created = false;
   try {
-    await execa3("mkisofs", [
-      "-output",
-      isoPath,
-      "-volid",
-      "cidata",
-      "-joliet",
-      "-rock",
-      userDataPath,
-      metaDataPath
-    ], { env });
-    created = true;
-  } catch {
-  }
-  if (!created) {
+    let created = false;
+    for (const tool of ["mkisofs", "genisoimage"]) {
+      if (created) break;
+      try {
+        await execa3(tool, [
+          "-output",
+          isoPath,
+          "-volid",
+          "cidata",
+          "-joliet",
+          "-rock",
+          userDataPath,
+          metaDataPath
+        ], { env });
+        created = true;
+      } catch {
+      }
+    }
+    if (!created) {
+      try {
+        const stagingDir = path5.join(CONFIGS_DIR, "cidata-staging");
+        fs5.mkdirSync(stagingDir, { recursive: true, mode: 448 });
+        fs5.copyFileSync(userDataPath, path5.join(stagingDir, "user-data"));
+        fs5.copyFileSync(metaDataPath, path5.join(stagingDir, "meta-data"));
+        await execa3("hdiutil", [
+          "makehybrid",
+          "-o",
+          isoPath,
+          "-joliet",
+          "-iso",
+          "-default-volume-name",
+          "cidata",
+          stagingDir
+        ], { env });
+        fs5.rmSync(stagingDir, { recursive: true, force: true });
+        created = true;
+      } catch {
+      }
+    }
+    if (!created) {
+      throw new Error(
+        "Cannot create cloud-init ISO: none of mkisofs, genisoimage, or hdiutil are available. On macOS, install cdrtools: brew install cdrtools. On Linux: sudo apt install genisoimage"
+      );
+    }
+    fs5.chmodSync(isoPath, 384);
+    audit("cloudinit_iso_created", "init.iso created");
+    return isoPath;
+  } finally {
     try {
-      await execa3("genisoimage", [
-        "-output",
-        isoPath,
-        "-volid",
-        "cidata",
-        "-joliet",
-        "-rock",
-        userDataPath,
-        metaDataPath
-      ], { env });
-      created = true;
+      fs5.unlinkSync(userDataPath);
     } catch {
     }
-  }
-  if (!created) {
     try {
-      const stagingDir = path5.join(CONFIGS_DIR, "cidata-staging");
-      fs5.mkdirSync(stagingDir, { recursive: true, mode: 448 });
-      fs5.copyFileSync(userDataPath, path5.join(stagingDir, "user-data"));
-      fs5.copyFileSync(metaDataPath, path5.join(stagingDir, "meta-data"));
-      await execa3("hdiutil", [
-        "makehybrid",
-        "-o",
-        isoPath,
-        "-joliet",
-        "-iso",
-        "-default-volume-name",
-        "cidata",
-        stagingDir
-      ], { env });
-      fs5.rmSync(stagingDir, { recursive: true, force: true });
-      created = true;
+      fs5.unlinkSync(metaDataPath);
     } catch {
     }
+    audit("cloudinit_plaintext_deleted", "user-data.yaml and meta-data.yaml removed");
   }
-  if (!created) {
-    throw new Error(
-      "Cannot create cloud-init ISO: none of mkisofs, genisoimage, or hdiutil are available. On macOS, install cdrtools: brew install cdrtools. On Linux: sudo apt install genisoimage"
-    );
-  }
-  fs5.chmodSync(isoPath, 384);
-  fs5.unlinkSync(userDataPath);
-  fs5.unlinkSync(metaDataPath);
-  audit("cloudinit_plaintext_deleted", "user-data.yaml and meta-data.yaml removed");
-  audit("cloudinit_iso_created", "init.iso created");
-  return isoPath;
 }
 
 // src/core/health.ts
@@ -1029,27 +1045,51 @@ async function checkHealth(port, vmRunning) {
   }
   return status;
 }
-async function waitForServer(port, timeoutMs = 6e5) {
+async function waitForServer(port, timeoutMs = 9e5) {
   const start = Date.now();
+  let lastLog = 0;
   while (Date.now() - start < timeoutMs) {
     try {
       const { stdout, code } = await sshExec(port, "curl -sf http://localhost:4200/health");
       if (code === 0 && stdout.includes("ok")) return true;
     } catch {
     }
-    await new Promise((r) => setTimeout(r, 1e4));
+    const elapsed = Date.now() - start;
+    if (elapsed - lastLog >= 3e4) {
+      lastLog = elapsed;
+      try {
+        const { stdout } = await sshExec(port, "systemctl is-active nexus 2>/dev/null || echo 'starting...'");
+        process.stderr.write(`
+  [server ${Math.round(elapsed / 1e3)}s] ${stdout.trim().slice(0, 120)}
+`);
+      } catch {
+      }
+    }
+    await new Promise((r) => setTimeout(r, 5e3));
   }
   return false;
 }
-async function waitForCloudInit(port, timeoutMs = 9e5) {
+async function waitForCloudInit(port, timeoutMs = 18e5) {
   const start = Date.now();
+  let lastLog = 0;
   while (Date.now() - start < timeoutMs) {
     try {
       const { code } = await sshExec(port, "test -f /var/lib/cloud/instance/boot-finished");
       if (code === 0) return true;
     } catch {
     }
-    await new Promise((r) => setTimeout(r, 1e4));
+    const elapsed = Date.now() - start;
+    if (elapsed - lastLog >= 6e4) {
+      lastLog = elapsed;
+      try {
+        const { stdout } = await sshExec(port, "tail -1 /var/log/cloud-init-output.log 2>/dev/null || echo 'waiting...'");
+        process.stderr.write(`
+  [cloud-init ${Math.round(elapsed / 1e3)}s] ${stdout.trim().slice(0, 120)}
+`);
+      } catch {
+      }
+    }
+    await new Promise((r) => setTimeout(r, 2e4));
   }
   return false;
 }
@@ -1076,17 +1116,19 @@ async function installCloudflared(sshPort, arch) {
 }
 async function startTunnel(sshPort) {
   await sshExec(sshPort, [
-    "nohup cloudflared tunnel --url http://localhost:4200",
-    "> /tmp/tunnel.log 2>&1 &",
+    "install -m 600 /dev/null /home/nexus/.nexus/tunnel.log",
+    "&& nohup cloudflared tunnel --no-autoupdate --url http://localhost:4200",
+    "> /home/nexus/.nexus/tunnel.log 2>&1 &",
     "disown"
   ].join(" "));
   const start = Date.now();
-  while (Date.now() - start < 3e4) {
+  while (Date.now() - start < 6e4) {
     try {
-      const { stdout } = await sshExec(sshPort, "grep -o 'https://[^ ]*\\.trycloudflare\\.com' /tmp/tunnel.log 2>/dev/null | head -1");
+      const { stdout } = await sshExec(sshPort, "grep -oE 'https://[a-z0-9-]+\\.trycloudflare\\.com' /home/nexus/.nexus/tunnel.log 2>/dev/null | head -1");
       if (stdout.includes("https://")) {
         const url = stdout.trim();
         if (!/^https:\/\/[a-z0-9-]+\.trycloudflare\.com$/.test(url)) {
+          audit("tunnel_url_rejected", `Invalid URL format: ${url.slice(0, 80)}`);
           return null;
         }
         await sshExec(sshPort, shellCommand`printf '%s\n' ${url} > /home/nexus/.nexus/tunnel-url.txt && chmod 600 /home/nexus/.nexus/tunnel-url.txt`);
@@ -1119,176 +1161,283 @@ function getReleaseTarball() {
   if (fs6.existsSync(rootPath)) return rootPath;
   throw new Error("nexus-release.tar.gz not found. Run: npm run bundle");
 }
-var TOTAL_PHASES = 10;
 function getCloudInitTemplate() {
   const dir = path6.dirname(fileURLToPath(import.meta.url));
   const templatePath = path6.join(dir, "templates", "cloud-init.yaml.ejs");
-  if (fs6.existsSync(templatePath)) {
-    return fs6.readFileSync(templatePath, "utf-8");
-  }
+  if (fs6.existsSync(templatePath)) return fs6.readFileSync(templatePath, "utf-8");
   const srcPath = path6.resolve(dir, "..", "src", "templates", "cloud-init.yaml.ejs");
   return fs6.readFileSync(srcPath, "utf-8");
 }
-var initCommand = new Command("init").description("Scaffold and launch a new NEXUS runtime").action(async () => {
-  try {
-    showBanner();
-    showPhase(1, TOTAL_PHASES, "Configuration");
-    const platform = detectPlatform();
-    log.detail("Platform", `${platform.os} ${platform.arch}`);
-    log.detail("QEMU", platform.qemuBinary);
-    const userConfig = await promptInitConfig();
-    ensureHome();
-    const masterSecret = generateMasterSecret();
-    const config = {
-      vmRam: userConfig.vmRam,
-      vmCpus: userConfig.vmCpus,
-      vmDisk: userConfig.vmDisk,
-      enableTunnel: userConfig.enableTunnel,
-      sshPort: 2222,
-      httpPort: 4200,
-      httpsPort: 8443,
-      masterSecret
-    };
-    const keys = {
-      ANTHROPIC_API_KEY: userConfig.anthropicKey,
-      OPENAI_API_KEY: userConfig.openaiKey || void 0,
-      GOOGLE_API_KEY: userConfig.googleKey || void 0,
-      NEXUS_MASTER_SECRET: masterSecret
-    };
-    const violations = validateAllKeys(keys);
-    if (violations.length > 0) {
-      for (const v of violations) log.error(v);
-      process.exit(1);
+async function withSpinner(spinner, label, fn) {
+  spinner.text = label;
+  spinner.start();
+  const result = await fn();
+  succeed(spinner, label);
+  return result;
+}
+var phases = [
+  // Phase 1 — Configuration
+  {
+    name: "Configuration",
+    run: async (ctx) => {
+      showBanner();
+      const platform = detectPlatform();
+      log.detail("Platform", `${platform.os} ${platform.arch}`);
+      log.detail("QEMU", platform.qemuBinary);
+      const userConfig = await promptInitConfig();
+      ensureHome();
+      const masterSecret = generateMasterSecret();
+      const config = {
+        vmRam: userConfig.vmRam,
+        vmCpus: userConfig.vmCpus,
+        vmDisk: userConfig.vmDisk,
+        enableTunnel: userConfig.enableTunnel,
+        sshPort: 2222,
+        httpPort: 4200,
+        httpsPort: 8443,
+        masterSecret
+      };
+      const keys = {
+        ANTHROPIC_API_KEY: userConfig.anthropicKey,
+        OPENAI_API_KEY: userConfig.openaiKey || void 0,
+        GOOGLE_API_KEY: userConfig.googleKey || void 0,
+        NEXUS_MASTER_SECRET: masterSecret
+      };
+      const violations = validateAllKeys(keys);
+      if (violations.length > 0) {
+        for (const v of violations) log.error(v);
+        process.exit(1);
+      }
+      saveConfig(config);
+      saveKeys(keys);
+      log.success("Configuration saved");
+      ctx.platform = platform;
+      ctx.config = config;
+      ctx.keys = keys;
     }
-    saveConfig(config);
-    saveKeys(keys);
-    log.success("Configuration saved");
-    showPhase(2, TOTAL_PHASES, "QEMU Installation");
-    let spinner = createSpinner("Checking QEMU...");
-    spinner.start();
-    const hasQemu = await isQemuInstalled(platform);
-    if (hasQemu) {
-      succeed(spinner, "QEMU already installed");
-    } else {
-      spinner.text = "Installing QEMU...";
-      await installQemu(platform);
-      succeed(spinner, "QEMU installed");
+  },
+  // Phase 2 — QEMU
+  {
+    name: "QEMU Installation",
+    run: async (ctx, spinner) => {
+      const { platform } = ctx;
+      await withSpinner(spinner, "Checking QEMU...", async () => {
+        const hasQemu = await isQemuInstalled(platform);
+        if (!hasQemu) {
+          spinner.text = "Installing QEMU...";
+          await installQemu(platform);
+        }
+      });
+      succeed(spinner, hasQemuLabel(await isQemuInstalled(ctx.platform)));
     }
-    showPhase(3, TOTAL_PHASES, "SSH Key Setup");
-    spinner = createSpinner("Generating SSH key...");
-    spinner.start();
-    await generateSshKey();
-    addSshConfig(config.sshPort);
-    succeed(spinner, "SSH key ready (ed25519)");
-    showPhase(4, TOTAL_PHASES, "VM Image Download");
-    spinner = createSpinner(`Downloading Ubuntu 24.04 (${platform.ubuntuImage})...`);
-    spinner.start();
-    const imagePath = await downloadImage(platform);
-    succeed(spinner, "Ubuntu image ready");
-    showPhase(5, TOTAL_PHASES, "Cloud-Init Generation");
-    spinner = createSpinner("Locating release tarball...");
-    spinner.start();
-    const tarballPath = getReleaseTarball();
-    succeed(spinner, `Release tarball found (${path6.basename(tarballPath)})`);
-    spinner = createSpinner("Rendering cloud-init...");
-    spinner.start();
-    const pubKey = getPubKey();
-    const template = getCloudInitTemplate();
-    const userDataPath = await renderCloudInit({ sshPubKey: pubKey, keys, config }, template);
-    const isoPath = await createCloudInitIso(userDataPath);
-    succeed(spinner, "Cloud-init ISO created");
-    showPhase(6, TOTAL_PHASES, "VM Launch");
-    spinner = createSpinner("Checking port availability...");
-    spinner.start();
-    const requestedPorts = { ssh: config.sshPort, http: config.httpPort, https: config.httpsPort };
-    spinner.stop();
-    spinner.clear();
-    const resolvedPorts = await resolvePortConflicts(requestedPorts);
-    spinner = createSpinner("Creating disk and launching VM...");
-    spinner.start();
-    const diskPath = await createDisk(imagePath, config.vmDisk);
-    await launchVm(platform, diskPath, isoPath, config.vmRam, config.vmCpus, resolvedPorts);
-    config.sshPort = resolvedPorts.ssh;
-    config.httpPort = resolvedPorts.http;
-    config.httpsPort = resolvedPorts.https;
-    saveConfig(config);
-    const portNote = resolvedPorts.ssh !== 2222 || resolvedPorts.http !== 4200 || resolvedPorts.https !== 8443 ? ` (ports: SSH=${resolvedPorts.ssh}, HTTP=${resolvedPorts.http}, HTTPS=${resolvedPorts.https})` : "";
-    succeed(spinner, `VM launched (daemonized)${portNote}`);
-    showPhase(7, TOTAL_PHASES, "VM Provisioning");
-    spinner = createSpinner("Waiting for SSH...");
-    spinner.start();
-    const sshReady = await waitForSsh(config.sshPort);
-    if (!sshReady) {
-      fail(spinner, "SSH connection timed out");
-      process.exit(1);
+  },
+  // Phase 3 — SSH Keys
+  {
+    name: "SSH Key Setup",
+    run: async (ctx, spinner) => {
+      const { config } = ctx;
+      await withSpinner(spinner, "Generating SSH key...", async () => {
+        await generateSshKey();
+        addSshConfig(config.sshPort);
+      });
     }
-    succeed(spinner, "SSH connected");
-    spinner = createSpinner("Uploading NEXUS release tarball...");
-    spinner.start();
-    await sshUploadFile(config.sshPort, tarballPath, "/tmp/nexus-release.tar.gz");
-    succeed(spinner, "Tarball uploaded");
-    spinner = createSpinner("Staging API keys...");
-    spinner.start();
-    const keysContent = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
-    const tmpKeysPath = path6.join(os2.tmpdir(), `.nexus-keys-${crypto4.randomBytes(8).toString("hex")}`);
-    fs6.writeFileSync(tmpKeysPath, keysContent, { mode: 384 });
-    try {
-      await sshUploadFile(config.sshPort, tmpKeysPath, "/tmp/.nexus-env-keys");
-      await sshExec(config.sshPort, "chmod 600 /tmp/.nexus-env-keys");
-    } finally {
-      try {
-        fs6.writeFileSync(tmpKeysPath, "0".repeat(keysContent.length));
-        fs6.unlinkSync(tmpKeysPath);
-      } catch {
-      }
+  },
+  // Phase 4 — Ubuntu Image
+  {
+    name: "VM Image Download",
+    run: async (ctx, spinner) => {
+      const { platform } = ctx;
+      const imagePath = await withSpinner(
+        spinner,
+        `Downloading Ubuntu 24.04 (${platform.ubuntuImage})...`,
+        () => downloadImage(platform)
+      );
+      ctx.imagePath = imagePath;
     }
-    succeed(spinner, "API keys staged");
-    spinner = createSpinner("Cloud-init provisioning (extracting NEXUS, building Docker, installing deps)...");
-    spinner.start();
-    const cloudInitDone = await waitForCloudInit(config.sshPort);
-    if (!cloudInitDone) {
-      fail(spinner, "Cloud-init timed out");
-      log.warn("You can check progress with: buildwithnexus ssh then: tail -f /var/log/cloud-init-output.log");
-      process.exit(1);
+  },
+  // Phase 5 — Cloud-Init
+  {
+    name: "Cloud-Init Generation",
+    run: async (ctx, spinner) => {
+      const { keys, config } = ctx;
+      const tarballPath = await withSpinner(spinner, "Locating release tarball...", async () => {
+        return getReleaseTarball();
+      });
+      ctx.tarballPath = tarballPath;
+      const isoPath = await withSpinner(spinner, "Rendering cloud-init...", async () => {
+        const pubKey = getPubKey();
+        const template = getCloudInitTemplate();
+        const userDataPath = await renderCloudInit({ sshPubKey: pubKey, keys, config }, template);
+        return createCloudInitIso(userDataPath);
+      });
+      ctx.isoPath = isoPath;
     }
-    succeed(spinner, "VM fully provisioned");
-    spinner = createSpinner("Delivering API keys...");
-    spinner.start();
-    await sshExec(config.sshPort, "mkdir -p /home/nexus/.nexus && mv /tmp/.nexus-env-keys /home/nexus/.nexus/.env.keys && chown -R nexus:nexus /home/nexus/.nexus && chmod 600 /home/nexus/.nexus/.env.keys");
-    succeed(spinner, "API keys delivered securely");
-    showPhase(8, TOTAL_PHASES, "NEXUS Server Startup");
-    spinner = createSpinner("Waiting for NEXUS server...");
-    spinner.start();
-    const serverReady = await waitForServer(config.sshPort);
-    if (!serverReady) {
-      fail(spinner, "Server failed to start");
-      log.warn("Check logs: buildwithnexus logs");
-      process.exit(1);
+  },
+  // Phase 6 — VM Boot
+  {
+    name: "VM Launch",
+    run: async (ctx, spinner) => {
+      const { platform, imagePath, isoPath, config } = ctx;
+      spinner.text = "Checking port availability...";
+      spinner.start();
+      spinner.stop();
+      spinner.clear();
+      const requestedPorts = { ssh: config.sshPort, http: config.httpPort, https: config.httpsPort };
+      const resolvedPorts = await resolvePortConflicts(requestedPorts);
+      const diskPath = await withSpinner(spinner, "Creating disk and launching VM...", async () => {
+        const disk = await createDisk(imagePath, config.vmDisk);
+        await launchVm(platform, disk, isoPath, config.vmRam, config.vmCpus, resolvedPorts);
+        return disk;
+      });
+      config.sshPort = resolvedPorts.ssh;
+      config.httpPort = resolvedPorts.http;
+      config.httpsPort = resolvedPorts.https;
+      saveConfig(config);
+      const portNote = resolvedPorts.ssh !== 2222 || resolvedPorts.http !== 4200 || resolvedPorts.https !== 8443 ? ` (ports: SSH=${resolvedPorts.ssh}, HTTP=${resolvedPorts.http}, HTTPS=${resolvedPorts.https})` : "";
+      succeed(spinner, `VM launched (daemonized)${portNote}`);
+      ctx.diskPath = diskPath;
+      ctx.resolvedPorts = resolvedPorts;
+      ctx.vmLaunched = true;
     }
-    succeed(spinner, "NEXUS server healthy on port 4200");
-    let tunnelUrl;
-    if (config.enableTunnel) {
-      showPhase(9, TOTAL_PHASES, "Cloudflare Tunnel");
-      spinner = createSpinner("Installing cloudflared...");
+  },
+  // Phase 7 — VM Provisioning
+  {
+    name: "VM Provisioning",
+    run: async (ctx, spinner) => {
+      const { config, keys, tarballPath } = ctx;
+      const pinPath = path6.join(process.env.HOME || "~", ".buildwithnexus", "ssh", "vm_host_key.pin");
+      if (fs6.existsSync(pinPath)) fs6.unlinkSync(pinPath);
+      spinner.text = "Waiting for SSH...";
+      spinner.start();
+      const sshReady = await waitForSsh(config.sshPort);
+      if (!sshReady) {
+        fail(spinner, "SSH connection timed out");
+        throw new Error("SSH connection timed out");
+      }
+      succeed(spinner, "SSH connected");
+      await withSpinner(
+        spinner,
+        "Uploading NEXUS release tarball...",
+        () => sshUploadFile(config.sshPort, tarballPath, "/tmp/nexus-release.tar.gz")
+      );
+      await withSpinner(spinner, "Staging API keys...", async () => {
+        const keysContent = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
+        const tmpKeysPath = path6.join(os2.tmpdir(), `.nexus-keys-${crypto4.randomBytes(8).toString("hex")}`);
+        fs6.writeFileSync(tmpKeysPath, keysContent, { mode: 384 });
+        try {
+          await sshUploadFile(config.sshPort, tmpKeysPath, "/tmp/.nexus-env-keys");
+          await sshExec(config.sshPort, "chmod 600 /tmp/.nexus-env-keys");
+        } finally {
+          try {
+            fs6.writeFileSync(tmpKeysPath, "0".repeat(keysContent.length));
+            fs6.unlinkSync(tmpKeysPath);
+          } catch {
+          }
+        }
+      });
+      spinner.text = "Cloud-init provisioning \u2014 this takes 10-20 min (extracting NEXUS, building Docker, installing deps)...";
+      spinner.start();
+      const cloudInitDone = await waitForCloudInit(config.sshPort);
+      if (!cloudInitDone) {
+        fail(spinner, "Cloud-init timed out after 30 minutes");
+        log.warn("Check progress: buildwithnexus ssh  \u2192  tail -f /var/log/cloud-init-output.log");
+        throw new Error("Cloud-init timed out");
+      }
+      succeed(spinner, "VM fully provisioned");
+      await withSpinner(
+        spinner,
+        "Delivering API keys...",
+        () => sshExec(
+          config.sshPort,
+          "mkdir -p /home/nexus/.nexus && mv /tmp/.nexus-env-keys /home/nexus/.nexus/.env.keys && chown -R nexus:nexus /home/nexus/.nexus && chmod 600 /home/nexus/.nexus/.env.keys"
+        )
+      );
+    }
+  },
+  // Phase 8 — Server Health
+  {
+    name: "NEXUS Server Startup",
+    run: async (ctx, spinner) => {
+      const { config } = ctx;
+      spinner.text = "Waiting for NEXUS server...";
       spinner.start();
-      await installCloudflared(config.sshPort, platform.arch);
+      const serverReady = await waitForServer(config.sshPort);
+      if (!serverReady) {
+        fail(spinner, "Server failed to start");
+        log.warn("Check logs: buildwithnexus logs");
+        throw new Error("NEXUS server failed to start");
+      }
+      succeed(spinner, "NEXUS server healthy on port 4200");
+    }
+  },
+  // Phase 9 — Cloudflare Tunnel
+  {
+    name: "Cloudflare Tunnel",
+    run: async (ctx, spinner) => {
+      const { config, platform } = ctx;
+      if (!config.enableTunnel) {
+        log.dim("Skipped (not enabled)");
+        return;
+      }
+      await withSpinner(
+        spinner,
+        "Installing cloudflared...",
+        () => installCloudflared(config.sshPort, platform.arch)
+      );
       spinner.text = "Starting tunnel...";
+      spinner.start();
       const url = await startTunnel(config.sshPort);
       if (url) {
-        tunnelUrl = url;
+        ctx.tunnelUrl = url;
         succeed(spinner, `Tunnel active: ${url}`);
       } else {
         fail(spinner, "Tunnel failed to start (server still accessible locally)");
       }
-    } else {
-      showPhase(9, TOTAL_PHASES, "Cloudflare Tunnel");
-      log.dim("Skipped (not enabled)");
     }
-    showPhase(10, TOTAL_PHASES, "Complete");
-    showCompletion({
-      remote: tunnelUrl,
-      ssh: "buildwithnexus ssh"
-    });
+  },
+  // Phase 10 — Complete
+  {
+    name: "Complete",
+    run: async (ctx) => {
+      showCompletion({ remote: ctx.tunnelUrl, ssh: "buildwithnexus ssh" });
+    }
+  }
+];
+function hasQemuLabel(installed) {
+  return installed ? "QEMU ready" : "QEMU installed";
+}
+var TOTAL_PHASES = phases.length;
+async function runInit() {
+  const ctx = { vmLaunched: false, tunnelUrl: void 0 };
+  const spinner = createSpinner("");
+  for (let i = 0; i < phases.length; i++) {
+    const phase = phases[i];
+    showPhase(i + 1, TOTAL_PHASES, phase.name);
+    if (phase.skip?.(ctx)) {
+      log.dim("Skipped");
+      continue;
+    }
+    try {
+      await phase.run(ctx, spinner);
+    } catch (err) {
+      try {
+        spinner.stop();
+      } catch {
+      }
+      if (ctx.vmLaunched) {
+        process.stderr.write(chalk6.dim("\n  Stopping VM due to init failure...\n"));
+        try {
+          stopVm();
+        } catch {
+        }
+      }
+      throw err;
+    }
+  }
+}
+var initCommand = new Command("init").description("Scaffold and launch a new NEXUS runtime").action(async () => {
+  try {
+    await runInit();
   } catch (err) {
     const safeErr = redactError(err);
     log.error(`Init failed: ${safeErr.message}`);
@@ -1394,7 +1543,7 @@ var stopCommand = new Command3("stop").description("Gracefully shut down the NEX
 
 // src/commands/status.ts
 import { Command as Command4 } from "commander";
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 init_secrets();
 init_qemu();
 var statusCommand = new Command4("status").description("Check NEXUS runtime health").option("--json", "Output as JSON").action(async (opts) => {
@@ -1409,15 +1558,15 @@ var statusCommand = new Command4("status").description("Check NEXUS runtime heal
     console.log(JSON.stringify({ ...health, pid: getVmPid(), ports: { ssh: config.sshPort, http: config.httpPort, https: config.httpsPort } }, null, 2));
     return;
   }
-  const check = (ok) => ok ? chalk6.green("\u25CF") : chalk6.red("\u25CB");
+  const check = (ok) => ok ? chalk7.green("\u25CF") : chalk7.red("\u25CB");
   console.log("");
-  console.log(chalk6.bold("  NEXUS Runtime Status"));
+  console.log(chalk7.bold("  NEXUS Runtime Status"));
   console.log("");
-  console.log(`  ${check(health.vmRunning)}  VM         ${health.vmRunning ? chalk6.green("running") + chalk6.dim(` (PID ${getVmPid()})`) : chalk6.red("stopped")}`);
-  console.log(`  ${check(health.sshReady)}  SSH        ${health.sshReady ? chalk6.green("connected") + chalk6.dim(` (port ${config.sshPort})`) : chalk6.red("unreachable")}`);
-  console.log(`  ${check(health.dockerReady)}  Docker     ${health.dockerReady ? chalk6.green("ready") : chalk6.red("not ready")}`);
-  console.log(`  ${check(health.serverHealthy)}  Server     ${health.serverHealthy ? chalk6.green("healthy") + chalk6.dim(` (port ${config.httpPort})`) : chalk6.red("unhealthy")}`);
-  console.log(`  ${check(!!health.tunnelUrl)}  Tunnel     ${health.tunnelUrl ? chalk6.green(health.tunnelUrl) : chalk6.dim("not active")}`);
+  console.log(`  ${check(health.vmRunning)}  VM         ${health.vmRunning ? chalk7.green("running") + chalk7.dim(` (PID ${getVmPid()})`) : chalk7.red("stopped")}`);
+  console.log(`  ${check(health.sshReady)}  SSH        ${health.sshReady ? chalk7.green("connected") + chalk7.dim(` (port ${config.sshPort})`) : chalk7.red("unreachable")}`);
+  console.log(`  ${check(health.dockerReady)}  Docker     ${health.dockerReady ? chalk7.green("ready") : chalk7.red("not ready")}`);
+  console.log(`  ${check(health.serverHealthy)}  Server     ${health.serverHealthy ? chalk7.green("healthy") + chalk7.dim(` (port ${config.httpPort})`) : chalk7.red("unhealthy")}`);
+  console.log(`  ${check(!!health.tunnelUrl)}  Tunnel     ${health.tunnelUrl ? chalk7.green(health.tunnelUrl) : chalk7.dim("not active")}`);
   console.log("");
   if (health.serverHealthy) {
     log.success(`NEXUS CLI ready \u2014 connect via: buildwithnexus ssh`);
@@ -1426,7 +1575,7 @@ var statusCommand = new Command4("status").description("Check NEXUS runtime heal
 
 // src/commands/doctor.ts
 import { Command as Command5 } from "commander";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 import fs7 from "fs";
 init_qemu();
 init_secrets();
@@ -1434,12 +1583,12 @@ import path8 from "path";
 import { execa as execa4 } from "execa";
 var doctorCommand = new Command5("doctor").description("Diagnose NEXUS runtime environment").action(async () => {
   const platform = detectPlatform();
-  const check = (ok) => ok ? chalk7.green("\u2713") : chalk7.red("\u2717");
+  const check = (ok) => ok ? chalk8.green("\u2713") : chalk8.red("\u2717");
   console.log("");
-  console.log(chalk7.bold("  NEXUS Doctor"));
+  console.log(chalk8.bold("  NEXUS Doctor"));
   console.log("");
   const nodeOk = Number(process.versions.node.split(".")[0]) >= 18;
-  console.log(`  ${check(nodeOk)}  Node.js ${process.versions.node} ${nodeOk ? "" : chalk7.red("(need >= 18)")}`);
+  console.log(`  ${check(nodeOk)}  Node.js ${process.versions.node} ${nodeOk ? "" : chalk8.red("(need >= 18)")}`);
   console.log(`  ${check(true)}  Platform: ${platform.os} ${platform.arch}`);
   const qemuOk = await isQemuInstalled(platform);
   if (qemuOk) {
@@ -1479,14 +1628,14 @@ var doctorCommand = new Command5("doctor").description("Diagnose NEXUS runtime e
           });
           server.listen(port);
         });
-        console.log(`  ${check(available)}  Port ${port} (${name}) ${available ? "available" : chalk7.red("in use")}`);
+        console.log(`  ${check(available)}  Port ${port} (${name}) ${available ? "available" : chalk8.red("in use")}`);
       } catch {
         console.log(`  ${check(false)}  Port ${port} (${name}) \u2014 check failed`);
       }
     }
   }
   const biosOk = fs7.existsSync(platform.biosPath);
-  console.log(`  ${check(biosOk)}  UEFI firmware ${biosOk ? "" : chalk7.dim(platform.biosPath)}`);
+  console.log(`  ${check(biosOk)}  UEFI firmware ${biosOk ? "" : chalk8.dim(platform.biosPath)}`);
   console.log("");
   if (qemuOk && isoTool && biosOk) {
     log.success("Environment ready for NEXUS");
@@ -1597,7 +1746,7 @@ var updateCommand = new Command7("update").description("Update NEXUS to the late
 
 // src/commands/destroy.ts
 import { Command as Command8 } from "commander";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 import fs9 from "fs";
 import { input as input2 } from "@inquirer/prompts";
 init_secrets();
@@ -1607,11 +1756,11 @@ var destroyCommand = new Command8("destroy").description("Remove NEXUS VM and al
   const config = loadConfig();
   if (!opts.force) {
     console.log("");
-    console.log(chalk8.red.bold("  This will permanently delete:"));
-    console.log(chalk8.red("  - NEXUS VM and all data inside it"));
-    console.log(chalk8.red("  - VM disk images"));
-    console.log(chalk8.red("  - SSH keys"));
-    console.log(chalk8.red("  - Configuration and API keys"));
+    console.log(chalk9.red.bold("  This will permanently delete:"));
+    console.log(chalk9.red("  - NEXUS VM and all data inside it"));
+    console.log(chalk9.red("  - VM disk images"));
+    console.log(chalk9.red("  - SSH keys"));
+    console.log(chalk9.red("  - Configuration and API keys"));
     console.log("");
     const confirm2 = await input2({
       message: 'Type "destroy" to confirm:'
@@ -1655,7 +1804,7 @@ var destroyCommand = new Command8("destroy").description("Remove NEXUS VM and al
 // src/commands/keys.ts
 import { Command as Command9 } from "commander";
 import { password as password2 } from "@inquirer/prompts";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 init_secrets();
 init_dlp();
 var keysCommand = new Command9("keys").description("Manage API keys");
@@ -1665,10 +1814,10 @@ keysCommand.command("list").description("Show configured API keys (masked)").act
     log.error("No keys configured. Run: buildwithnexus init");
     process.exit(1);
   }
-  console.log(chalk9.bold("\n  Configured Keys\n"));
+  console.log(chalk10.bold("\n  Configured Keys\n"));
   for (const [name, value] of Object.entries(keys)) {
     if (value) {
-      console.log(`  ${chalk9.cyan(name.padEnd(24))} ${maskKey(value)}`);
+      console.log(`  ${chalk10.cyan(name.padEnd(24))} ${maskKey(value)}`);
     }
   }
   console.log("");
@@ -1733,18 +1882,18 @@ var sshCommand = new Command10("ssh").description("Open an SSH session into the
 
 // src/commands/brainstorm.ts
 import { Command as Command11 } from "commander";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 import { input as input3 } from "@inquirer/prompts";
 init_secrets();
 init_qemu();
 init_ssh();
 init_dlp();
-var COS_PREFIX = chalk10.bold.cyan("  Chief of Staff");
-var YOU_PREFIX = chalk10.bold.white("  You");
-var DIVIDER = chalk10.dim("  " + "\u2500".repeat(56));
+var COS_PREFIX = chalk11.bold.cyan("  Chief of Staff");
+var YOU_PREFIX = chalk11.bold.white("  You");
+var DIVIDER = chalk11.dim("  " + "\u2500".repeat(56));
 function formatResponse(text) {
   const lines = text.split("\n");
-  return lines.map((line) => chalk10.white("  " + line)).join("\n");
+  return lines.map((line) => chalk11.white("  " + line)).join("\n");
 }
 async function sendMessage(sshPort, message, source) {
   const payload = JSON.stringify({ message, source });
@@ -1787,13 +1936,13 @@ var brainstormCommand = new Command11("brainstorm").description("Brainstorm an i
     }
     succeed(spinner, "Connected to NEXUS");
     console.log("");
-    console.log(chalk10.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-    console.log(chalk10.bold("  \u2551  ") + chalk10.bold.cyan("NEXUS Brainstorm Session") + chalk10.bold("                                \u2551"));
-    console.log(chalk10.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
-    console.log(chalk10.bold("  \u2551  ") + chalk10.dim("The Chief of Staff will discuss your idea with the".padEnd(55)) + chalk10.bold("\u2551"));
-    console.log(chalk10.bold("  \u2551  ") + chalk10.dim("NEXUS team and share their recommendations.".padEnd(55)) + chalk10.bold("\u2551"));
-    console.log(chalk10.bold("  \u2551  ") + chalk10.dim("Type 'exit' or 'quit' to end the session.".padEnd(55)) + chalk10.bold("\u2551"));
-    console.log(chalk10.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+    console.log(chalk11.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+    console.log(chalk11.bold("  \u2551  ") + chalk11.bold.cyan("NEXUS Brainstorm Session") + chalk11.bold("                                \u2551"));
+    console.log(chalk11.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
+    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("The Chief of Staff will discuss your idea with the".padEnd(55)) + chalk11.bold("\u2551"));
+    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("NEXUS team and share their recommendations.".padEnd(55)) + chalk11.bold("\u2551"));
+    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("Type 'exit' or 'quit' to end the session.".padEnd(55)) + chalk11.bold("\u2551"));
+    console.log(chalk11.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
     console.log("");
     let idea = ideaWords.length > 0 ? ideaWords.join(" ") : "";
     if (!idea) {
@@ -1810,7 +1959,7 @@ var brainstormCommand = new Command11("brainstorm").description("Brainstorm an i
     while (true) {
       turn++;
       if (turn === 1) {
-        console.log(`${YOU_PREFIX}: ${chalk10.white(idea)}`);
+        console.log(`${YOU_PREFIX}: ${chalk11.white(idea)}`);
       }
       console.log(DIVIDER);
       const thinking = createSpinner(
@@ -1828,17 +1977,17 @@ var brainstormCommand = new Command11("brainstorm").description("Brainstorm an i
       console.log(formatResponse(redact(response)));
       console.log(DIVIDER);
       const followUp = await input3({
-        message: chalk10.bold("You:")
+        message: chalk11.bold("You:")
       });
       const trimmed = followUp.trim().toLowerCase();
       if (!trimmed || trimmed === "exit" || trimmed === "quit" || trimmed === "q") {
         console.log("");
         log.success("Brainstorm session ended");
-        console.log(chalk10.dim("    Run again anytime: buildwithnexus brainstorm"));
+        console.log(chalk11.dim("    Run again anytime: buildwithnexus brainstorm"));
         console.log("");
         return;
       }
-      console.log(`${YOU_PREFIX}: ${chalk10.white(followUp)}`);
+      console.log(`${YOU_PREFIX}: ${chalk11.white(followUp)}`);
       currentMessage = `[BRAINSTORM FOLLOW-UP] The CEO responds: ${followUp}`;
     }
   } catch (err) {
@@ -1855,18 +2004,18 @@ var brainstormCommand = new Command11("brainstorm").description("Brainstorm an i
 
 // src/commands/ninety-nine.ts
 import { Command as Command12 } from "commander";
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 import { input as input4 } from "@inquirer/prompts";
 init_secrets();
 init_qemu();
 init_ssh();
 init_dlp();
-var AGENT_PREFIX = chalk11.bold.green("  99 \u276F");
-var YOU_PREFIX2 = chalk11.bold.white("  You");
-var DIVIDER2 = chalk11.dim("  " + "\u2500".repeat(56));
+var AGENT_PREFIX = chalk12.bold.green("  99 \u276F");
+var YOU_PREFIX2 = chalk12.bold.white("  You");
+var DIVIDER2 = chalk12.dim("  " + "\u2500".repeat(56));
 function formatAgentActivity(text) {
   const lines = text.split("\n");
-  return lines.map((line) => chalk11.white("  " + line)).join("\n");
+  return lines.map((line) => chalk12.white("  " + line)).join("\n");
 }
 function parsePrefixes(instruction) {
   const files = [];
@@ -1930,14 +2079,14 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
     }
     succeed(spinner, "Connected to NEXUS");
     console.log("");
-    console.log(chalk11.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-    console.log(chalk11.bold("  \u2551  ") + chalk11.bold.green("/99 Pair Programming") + chalk11.dim(" \u2014 powered by NEXUS") + chalk11.bold("           \u2551"));
-    console.log(chalk11.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
-    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("Describe what you want changed. NEXUS engineers".padEnd(55)) + chalk11.bold("\u2551"));
-    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("analyze and modify your code in real time.".padEnd(55)) + chalk11.bold("\u2551"));
-    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("Use @file to attach context, #rule to load rules.".padEnd(55)) + chalk11.bold("\u2551"));
-    console.log(chalk11.bold("  \u2551  ") + chalk11.dim("Type 'exit' or 'quit' to end the session.".padEnd(55)) + chalk11.bold("\u2551"));
-    console.log(chalk11.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+    console.log(chalk12.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+    console.log(chalk12.bold("  \u2551  ") + chalk12.bold.green("/99 Pair Programming") + chalk12.dim(" \u2014 powered by NEXUS") + chalk12.bold("           \u2551"));
+    console.log(chalk12.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
+    console.log(chalk12.bold("  \u2551  ") + chalk12.dim("Describe what you want changed. NEXUS engineers".padEnd(55)) + chalk12.bold("\u2551"));
+    console.log(chalk12.bold("  \u2551  ") + chalk12.dim("analyze and modify your code in real time.".padEnd(55)) + chalk12.bold("\u2551"));
+    console.log(chalk12.bold("  \u2551  ") + chalk12.dim("Use @file to attach context, #rule to load rules.".padEnd(55)) + chalk12.bold("\u2551"));
+    console.log(chalk12.bold("  \u2551  ") + chalk12.dim("Type 'exit' or 'quit' to end the session.".padEnd(55)) + chalk12.bold("\u2551"));
+    console.log(chalk12.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
     console.log("");
     const cwd = process.cwd();
     if (opts.edit) {
@@ -1946,7 +2095,7 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
       });
       const { cleaned, files, rules } = parsePrefixes(instruction);
       const fullInstruction = `Edit file ${opts.edit}: ${cleaned}`;
-      console.log(`${YOU_PREFIX2}: ${chalk11.white(fullInstruction)}`);
+      console.log(`${YOU_PREFIX2}: ${chalk12.white(fullInstruction)}`);
       console.log(DIVIDER2);
       const thinking = createSpinner("NEXUS engineers analyzing the file...");
       thinking.start();
@@ -1960,7 +2109,7 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
     }
     if (opts.search) {
       const fullInstruction = `Search the codebase for: ${opts.search}`;
-      console.log(`${YOU_PREFIX2}: ${chalk11.white(fullInstruction)}`);
+      console.log(`${YOU_PREFIX2}: ${chalk12.white(fullInstruction)}`);
       console.log(DIVIDER2);
       const thinking = createSpinner("Searching with NEXUS context...");
       thinking.start();
@@ -1974,7 +2123,7 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
     }
     if (opts.debug) {
       const fullInstruction = "Debug the current issue \u2014 analyze recent errors, identify the root cause, and propose a fix";
-      console.log(`${YOU_PREFIX2}: ${chalk11.white(fullInstruction)}`);
+      console.log(`${YOU_PREFIX2}: ${chalk12.white(fullInstruction)}`);
       console.log(DIVIDER2);
       const thinking = createSpinner("NEXUS debugger agent analyzing...");
       thinking.start();
@@ -1989,7 +2138,7 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
     let initialInstruction = instructionWords.length > 0 ? instructionWords.join(" ") : "";
     if (!initialInstruction) {
       initialInstruction = await input4({
-        message: chalk11.green("99 \u276F")
+        message: chalk12.green("99 \u276F")
       });
       if (!initialInstruction.trim()) {
         log.warn("No instruction provided");
@@ -2004,13 +2153,13 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
       const display = currentInstruction;
       const nexusInstruction = cleaned || currentInstruction;
       if (turn === 1) {
-        console.log(`${YOU_PREFIX2}: ${chalk11.white(display)}`);
+        console.log(`${YOU_PREFIX2}: ${chalk12.white(display)}`);
       }
       if (files.length > 0) {
-        console.log(chalk11.dim(`  Attaching: ${files.join(", ")}`));
+        console.log(chalk12.dim(`  Attaching: ${files.join(", ")}`));
       }
       if (rules.length > 0) {
-        console.log(chalk11.dim(`  Rules: ${rules.join(", ")}`));
+        console.log(chalk12.dim(`  Rules: ${rules.join(", ")}`));
       }
       console.log(DIVIDER2);
       const thinking = createSpinner(
@@ -2024,17 +2173,17 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
       console.log(formatAgentActivity(redact(response)));
       console.log(DIVIDER2);
       const followUp = await input4({
-        message: chalk11.green("99 \u276F")
+        message: chalk12.green("99 \u276F")
       });
       const trimmed = followUp.trim().toLowerCase();
       if (!trimmed || trimmed === "exit" || trimmed === "quit" || trimmed === "q") {
         console.log("");
         log.success("/99 session ended");
-        console.log(chalk11.dim("    Run again: buildwithnexus 99"));
+        console.log(chalk12.dim("    Run again: buildwithnexus 99"));
         console.log("");
         return;
       }
-      console.log(`${YOU_PREFIX2}: ${chalk11.white(followUp)}`);
+      console.log(`${YOU_PREFIX2}: ${chalk12.white(followUp)}`);
       currentInstruction = followUp;
     }
   } catch (err) {
@@ -2051,7 +2200,7 @@ var ninetyNineCommand = new Command12("99").description("AI pair-programming ses
 
 // src/commands/shell.ts
 import { Command as Command13 } from "commander";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 init_secrets();
 init_qemu();
 init_ssh();
@@ -2062,7 +2211,7 @@ init_secrets();
 import readline from "readline";
 import fs10 from "fs";
 import path11 from "path";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 var HISTORY_FILE = path11.join(NEXUS_HOME2, "shell_history");
 var MAX_HISTORY = 1e3;
 var Repl = class {
@@ -2097,7 +2246,7 @@ var Repl = class {
     this.rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout,
-      prompt: chalk12.bold.cyan("nexus") + chalk12.dim(" \u276F "),
+      prompt: chalk13.bold.cyan("nexus") + chalk13.dim(" \u276F "),
       history: this.history,
       historySize: MAX_HISTORY,
       terminal: true
@@ -2127,25 +2276,25 @@ var Repl = class {
           try {
             await cmd.handler();
           } catch (err) {
-            console.log(chalk12.red(`  \u2717 Command failed: ${err.message}`));
+            console.log(chalk13.red(`  \u2717 Command failed: ${err.message}`));
           }
           this.rl?.prompt();
           return;
         }
-        console.log(chalk12.yellow(`  Unknown command: /${cmdName}. Type /help for available commands.`));
+        console.log(chalk13.yellow(`  Unknown command: /${cmdName}. Type /help for available commands.`));
         this.rl?.prompt();
         return;
       }
       try {
         await this.onMessage(trimmed);
       } catch (err) {
-        console.log(chalk12.red(`  \u2717 ${err.message}`));
+        console.log(chalk13.red(`  \u2717 ${err.message}`));
       }
       this.rl?.prompt();
     });
     this.rl.on("close", () => {
       this.saveHistory();
-      console.log(chalk12.dim("\n  Session ended."));
+      console.log(chalk13.dim("\n  Session ended."));
       process.exit(0);
     });
     this.rl.on("SIGINT", () => {
@@ -2154,15 +2303,15 @@ var Repl = class {
   }
   showHelp() {
     console.log("");
-    console.log(chalk12.bold("  Available Commands:"));
-    console.log(chalk12.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk13.bold("  Available Commands:"));
+    console.log(chalk13.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const [name, cmd] of this.commands) {
-      console.log(`  ${chalk12.cyan("/" + name.padEnd(14))} ${chalk12.dim(cmd.description)}`);
+      console.log(`  ${chalk13.cyan("/" + name.padEnd(14))} ${chalk13.dim(cmd.description)}`);
     }
-    console.log(`  ${chalk12.cyan("/help".padEnd(15))} ${chalk12.dim("Show this help message")}`);
-    console.log(`  ${chalk12.cyan("/exit".padEnd(15))} ${chalk12.dim("Exit the shell")}`);
-    console.log(chalk12.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(chalk12.dim("  Type anything else to chat with NEXUS"));
+    console.log(`  ${chalk13.cyan("/help".padEnd(15))} ${chalk13.dim("Show this help message")}`);
+    console.log(`  ${chalk13.cyan("/exit".padEnd(15))} ${chalk13.dim("Exit the shell")}`);
+    console.log(chalk13.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk13.dim("  Type anything else to chat with NEXUS"));
     console.log("");
   }
   write(text) {
@@ -2188,17 +2337,17 @@ var Repl = class {
 init_ssh();
 init_secrets();
 init_dlp();
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 var ROLE_COLORS = {
-  "Chief of Staff": chalk13.bold.cyan,
-  "VP Engineering": chalk13.bold.blue,
-  "VP Product": chalk13.bold.magenta,
-  "Senior Engineer": chalk13.bold.green,
-  "Engineer": chalk13.green,
-  "QA Lead": chalk13.bold.yellow,
-  "Security Engineer": chalk13.bold.red,
-  "DevOps Engineer": chalk13.bold.hex("#FF8C00"),
-  "default": chalk13.bold.white
+  "Chief of Staff": chalk14.bold.cyan,
+  "VP Engineering": chalk14.bold.blue,
+  "VP Product": chalk14.bold.magenta,
+  "Senior Engineer": chalk14.bold.green,
+  "Engineer": chalk14.green,
+  "QA Lead": chalk14.bold.yellow,
+  "Security Engineer": chalk14.bold.red,
+  "DevOps Engineer": chalk14.bold.hex("#FF8C00"),
+  "default": chalk14.bold.white
 };
 function getColor(role) {
   if (!role) return ROLE_COLORS["default"];
@@ -2209,15 +2358,15 @@ function formatEvent(event) {
   const prefix = event.role ? color(`  [${event.role}]`) : "";
   switch (event.type) {
     case "agent_thinking":
-      return `${prefix} ${chalk13.dim("thinking...")}`;
+      return `${prefix} ${chalk14.dim("thinking...")}`;
     case "agent_response":
       return `${prefix} ${redact(event.content ?? "")}`;
     case "task_delegated":
-      return `${prefix} ${chalk13.dim("\u2192")} delegated to ${chalk13.bold(event.target ?? "agent")}`;
+      return `${prefix} ${chalk14.dim("\u2192")} delegated to ${chalk14.bold(event.target ?? "agent")}`;
     case "agent_complete":
-      return `${prefix} ${chalk13.green("\u2713")} ${chalk13.dim("complete")}`;
+      return `${prefix} ${chalk14.green("\u2713")} ${chalk14.dim("complete")}`;
     case "error":
-      return `  ${chalk13.red("\u2717")} ${redact(event.content ?? "Unknown error")}`;
+      return `  ${chalk14.red("\u2717")} ${redact(event.content ?? "Unknown error")}`;
     case "heartbeat":
       return null;
     default:
@@ -2300,19 +2449,19 @@ async function sendMessage2(sshPort, message) {
   }
 }
 function showShellBanner(health) {
-  const check = chalk14.green("\u2713");
-  const cross = chalk14.red("\u2717");
+  const check = chalk15.green("\u2713");
+  const cross = chalk15.red("\u2717");
   console.log("");
-  console.log(chalk14.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  console.log(chalk14.bold("  \u2551  ") + chalk14.bold.cyan("NEXUS Interactive Shell") + chalk14.bold("                                 \u2551"));
-  console.log(chalk14.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
-  console.log(chalk14.bold("  \u2551  ") + `${health.vmRunning ? check : cross} VM    ${health.sshReady ? check : cross} SSH    ${health.dockerReady ? check : cross} Docker    ${health.serverHealthy ? check : cross} Engine`.padEnd(55) + chalk14.bold("\u2551"));
+  console.log(chalk15.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  console.log(chalk15.bold("  \u2551  ") + chalk15.bold.cyan("NEXUS Interactive Shell") + chalk15.bold("                                 \u2551"));
+  console.log(chalk15.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
+  console.log(chalk15.bold("  \u2551  ") + `${health.vmRunning ? check : cross} VM    ${health.sshReady ? check : cross} SSH    ${health.dockerReady ? check : cross} Docker    ${health.serverHealthy ? check : cross} Engine`.padEnd(55) + chalk15.bold("\u2551"));
   if (health.tunnelUrl) {
-    console.log(chalk14.bold("  \u2551  ") + chalk14.dim(`Tunnel: ${health.tunnelUrl}`.padEnd(55)) + chalk14.bold("\u2551"));
+    console.log(chalk15.bold("  \u2551  ") + chalk15.dim(`Tunnel: ${health.tunnelUrl}`.padEnd(55)) + chalk15.bold("\u2551"));
   }
-  console.log(chalk14.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
-  console.log(chalk14.bold("  \u2551  ") + chalk14.dim("Type naturally to chat \xB7 /help for commands".padEnd(55)) + chalk14.bold("\u2551"));
-  console.log(chalk14.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  console.log(chalk15.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
+  console.log(chalk15.bold("  \u2551  ") + chalk15.dim("Type naturally to chat \xB7 /help for commands".padEnd(55)) + chalk15.bold("\u2551"));
+  console.log(chalk15.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
   console.log("");
 }
 async function getAgentList(sshPort) {
@@ -2322,13 +2471,13 @@ async function getAgentList(sshPort) {
     const agents = JSON.parse(stdout);
     if (!Array.isArray(agents)) return stdout;
     const lines = [""];
-    lines.push(chalk14.bold("  Registered Agents:"));
-    lines.push(chalk14.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    lines.push(chalk15.bold("  Registered Agents:"));
+    lines.push(chalk15.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const agent of agents) {
       const name = agent.name ?? agent.id ?? "unknown";
       const role = agent.role ?? "";
-      const status = agent.status === "active" ? chalk14.green("\u25CF") : chalk14.dim("\u25CB");
-      lines.push(`  ${status} ${chalk14.bold(name.padEnd(24))} ${chalk14.dim(role)}`);
+      const status = agent.status === "active" ? chalk15.green("\u25CF") : chalk15.dim("\u25CB");
+      lines.push(`  ${status} ${chalk15.bold(name.padEnd(24))} ${chalk15.dim(role)}`);
     }
     lines.push("");
     return lines.join("\n");
@@ -2340,11 +2489,11 @@ async function getStatus(sshPort) {
   try {
     const vmRunning = isVmRunning();
     const health = await checkHealth(sshPort, vmRunning);
-    const check = chalk14.green("\u2713");
-    const cross = chalk14.red("\u2717");
+    const check = chalk15.green("\u2713");
+    const cross = chalk15.red("\u2717");
     const lines = [""];
-    lines.push(chalk14.bold("  System Status:"));
-    lines.push(chalk14.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    lines.push(chalk15.bold("  System Status:"));
+    lines.push(chalk15.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     lines.push(`  ${health.vmRunning ? check : cross} Virtual Machine`);
     lines.push(`  ${health.sshReady ? check : cross} SSH Connection`);
     lines.push(`  ${health.dockerReady ? check : cross} Docker Engine`);
@@ -2366,17 +2515,17 @@ async function getCost(sshPort) {
     if (code !== 0) return "  Could not retrieve cost data";
     const data = JSON.parse(stdout);
     const lines = [""];
-    lines.push(chalk14.bold("  Token Costs:"));
-    lines.push(chalk14.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    lines.push(chalk15.bold("  Token Costs:"));
+    lines.push(chalk15.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     if (data.total !== void 0) {
-      lines.push(`  Total: ${chalk14.bold.green("$" + Number(data.total).toFixed(4))}`);
+      lines.push(`  Total: ${chalk15.bold.green("$" + Number(data.total).toFixed(4))}`);
     }
     if (data.today !== void 0) {
-      lines.push(`  Today: ${chalk14.bold("$" + Number(data.today).toFixed(4))}`);
+      lines.push(`  Today: ${chalk15.bold("$" + Number(data.today).toFixed(4))}`);
     }
     if (data.by_agent && typeof data.by_agent === "object") {
       lines.push("");
-      lines.push(chalk14.dim("  By Agent:"));
+      lines.push(chalk15.dim("  By Agent:"));
       for (const [agent, cost] of Object.entries(data.by_agent)) {
         lines.push(`    ${agent.padEnd(20)} $${Number(cost).toFixed(4)}`);
       }
@@ -2421,10 +2570,10 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
         thinkingSpinner.stop();
         thinkingSpinner.clear();
         console.log("");
-        console.log(chalk14.bold.cyan("  Chief of Staff:"));
+        console.log(chalk15.bold.cyan("  Chief of Staff:"));
         const lines = redact(response).split("\n");
         for (const line of lines) {
-          console.log(chalk14.white("  " + line));
+          console.log(chalk15.white("  " + line));
         }
         console.log("");
       } catch (err) {
@@ -2438,14 +2587,14 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
       description: "Brainstorm with the full NEXUS org (led by Chief of Staff)",
       handler: async () => {
         console.log("");
-        console.log(chalk14.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-        console.log(chalk14.bold("  \u2551  ") + chalk14.bold.cyan("NEXUS Brainstorm Session") + chalk14.bold("                                \u2551"));
-        console.log(chalk14.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
-        console.log(chalk14.bold("  \u2551  ") + chalk14.dim("The Chief of Staff will facilitate a discussion with".padEnd(55)) + chalk14.bold("\u2551"));
-        console.log(chalk14.bold("  \u2551  ") + chalk14.dim("the full NEXUS org to refine your idea. When ready,".padEnd(55)) + chalk14.bold("\u2551"));
-        console.log(chalk14.bold("  \u2551  ") + chalk14.dim("NEXUS will draft an execution plan for your review.".padEnd(55)) + chalk14.bold("\u2551"));
-        console.log(chalk14.bold("  \u2551  ") + chalk14.dim("Type 'exit' to end brainstorm. Type 'plan' to hand off.".padEnd(55)) + chalk14.bold("\u2551"));
-        console.log(chalk14.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+        console.log(chalk15.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+        console.log(chalk15.bold("  \u2551  ") + chalk15.bold.cyan("NEXUS Brainstorm Session") + chalk15.bold("                                \u2551"));
+        console.log(chalk15.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"));
+        console.log(chalk15.bold("  \u2551  ") + chalk15.dim("The Chief of Staff will facilitate a discussion with".padEnd(55)) + chalk15.bold("\u2551"));
+        console.log(chalk15.bold("  \u2551  ") + chalk15.dim("the full NEXUS org to refine your idea. When ready,".padEnd(55)) + chalk15.bold("\u2551"));
+        console.log(chalk15.bold("  \u2551  ") + chalk15.dim("NEXUS will draft an execution plan for your review.".padEnd(55)) + chalk15.bold("\u2551"));
+        console.log(chalk15.bold("  \u2551  ") + chalk15.dim("Type 'exit' to end brainstorm. Type 'plan' to hand off.".padEnd(55)) + chalk15.bold("\u2551"));
+        console.log(chalk15.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
         console.log("");
         const { input: input5 } = await import("@inquirer/prompts");
         const idea = await input5({ message: "What would you like to brainstorm?" });
@@ -2458,12 +2607,12 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
           brainstormSpinner.stop();
           brainstormSpinner.clear();
           console.log("");
-          console.log(chalk14.bold.cyan("  Chief of Staff:"));
+          console.log(chalk15.bold.cyan("  Chief of Staff:"));
           for (const line of redact(response).split("\n")) {
-            console.log(chalk14.white("  " + line));
+            console.log(chalk15.white("  " + line));
           }
           console.log("");
-          const followUp = await input5({ message: chalk14.bold("You:") });
+          const followUp = await input5({ message: chalk15.bold("You:") });
           const trimmed = followUp.trim().toLowerCase();
           if (!trimmed || trimmed === "exit" || trimmed === "quit") {
             console.log("");
@@ -2477,9 +2626,9 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
             planSpinner.stop();
             planSpinner.clear();
             console.log("");
-            console.log(chalk14.bold.green("  Execution Plan:"));
+            console.log(chalk15.bold.green("  Execution Plan:"));
             for (const line of redact(planResponse).split("\n")) {
-              console.log(chalk14.white("  " + line));
+              console.log(chalk15.white("  " + line));
             }
             console.log("");
             log.success("Plan drafted. Use the shell to refine or approve.");
@@ -2519,10 +2668,10 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
       handler: async () => {
         const { stdout } = await sshExec(config.sshPort, "tail -30 /home/nexus/.nexus/logs/server.log 2>/dev/null");
         console.log("");
-        console.log(chalk14.bold("  Recent Logs:"));
-        console.log(chalk14.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        console.log(chalk15.bold("  Recent Logs:"));
+        console.log(chalk15.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
         for (const line of redact(stdout).split("\n")) {
-          console.log(chalk14.dim("  " + line));
+          console.log(chalk15.dim("  " + line));
         }
         console.log("");
       }
@@ -2542,24 +2691,24 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
       description: "Display the NEXUS organizational hierarchy",
       handler: async () => {
         console.log("");
-        console.log(chalk14.bold("  NEXUS Organizational Hierarchy"));
-        console.log(chalk14.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-        console.log(`  ${chalk14.bold.white("You")} ${chalk14.dim("(CEO)")}`);
-        console.log(`  \u2514\u2500\u2500 ${chalk14.bold.cyan("Chief of Staff")} ${chalk14.dim("\u2014 orchestrates all work, your direct interface")}`);
-        console.log(`      \u251C\u2500\u2500 ${chalk14.bold.blue("VP Engineering")} ${chalk14.dim("\u2014 owns technical execution")}`);
-        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk14.green("Senior Engineer")} ${chalk14.dim("\xD7 8 \u2014 implementation, refactoring")}`);
-        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk14.green("Engineer")} ${chalk14.dim("\xD7 12 \u2014 feature work, bug fixes")}`);
-        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk14.hex("#FF8C00")("DevOps Engineer")} ${chalk14.dim("\xD7 4 \u2014 CI/CD, Docker, infra")}`);
-        console.log(`      \u251C\u2500\u2500 ${chalk14.bold.magenta("VP Product")} ${chalk14.dim("\u2014 owns roadmap and priorities")}`);
-        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk14.magenta("Product Manager")} ${chalk14.dim("\xD7 3 \u2014 specs, requirements")}`);
-        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk14.magenta("Designer")} ${chalk14.dim("\xD7 2 \u2014 UI/UX, prototyping")}`);
-        console.log(`      \u251C\u2500\u2500 ${chalk14.bold.yellow("QA Lead")} ${chalk14.dim("\u2014 owns quality assurance")}`);
-        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk14.yellow("QA Engineer")} ${chalk14.dim("\xD7 6 \u2014 testing, coverage, validation")}`);
-        console.log(`      \u251C\u2500\u2500 ${chalk14.bold.red("Security Engineer")} ${chalk14.dim("\xD7 4 \u2014 auth, scanning, compliance")}`);
-        console.log(`      \u2514\u2500\u2500 ${chalk14.bold.white("Knowledge Manager")} ${chalk14.dim("\u2014 RAG, documentation, learning")}`);
+        console.log(chalk15.bold("  NEXUS Organizational Hierarchy"));
+        console.log(chalk15.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        console.log(`  ${chalk15.bold.white("You")} ${chalk15.dim("(CEO)")}`);
+        console.log(`  \u2514\u2500\u2500 ${chalk15.bold.cyan("Chief of Staff")} ${chalk15.dim("\u2014 orchestrates all work, your direct interface")}`);
+        console.log(`      \u251C\u2500\u2500 ${chalk15.bold.blue("VP Engineering")} ${chalk15.dim("\u2014 owns technical execution")}`);
+        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk15.green("Senior Engineer")} ${chalk15.dim("\xD7 8 \u2014 implementation, refactoring")}`);
+        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk15.green("Engineer")} ${chalk15.dim("\xD7 12 \u2014 feature work, bug fixes")}`);
+        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk15.hex("#FF8C00")("DevOps Engineer")} ${chalk15.dim("\xD7 4 \u2014 CI/CD, Docker, infra")}`);
+        console.log(`      \u251C\u2500\u2500 ${chalk15.bold.magenta("VP Product")} ${chalk15.dim("\u2014 owns roadmap and priorities")}`);
+        console.log(`      \u2502   \u251C\u2500\u2500 ${chalk15.magenta("Product Manager")} ${chalk15.dim("\xD7 3 \u2014 specs, requirements")}`);
+        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk15.magenta("Designer")} ${chalk15.dim("\xD7 2 \u2014 UI/UX, prototyping")}`);
+        console.log(`      \u251C\u2500\u2500 ${chalk15.bold.yellow("QA Lead")} ${chalk15.dim("\u2014 owns quality assurance")}`);
+        console.log(`      \u2502   \u2514\u2500\u2500 ${chalk15.yellow("QA Engineer")} ${chalk15.dim("\xD7 6 \u2014 testing, coverage, validation")}`);
+        console.log(`      \u251C\u2500\u2500 ${chalk15.bold.red("Security Engineer")} ${chalk15.dim("\xD7 4 \u2014 auth, scanning, compliance")}`);
+        console.log(`      \u2514\u2500\u2500 ${chalk15.bold.white("Knowledge Manager")} ${chalk15.dim("\u2014 RAG, documentation, learning")}`);
         console.log("");
-        console.log(chalk14.dim("  56 agents total \xB7 Self-learning ML pipeline"));
-        console.log(chalk14.dim("  Full details: https://buildwithnexus.dev/overview"));
+        console.log(chalk15.dim("  56 agents total \xB7 Self-learning ML pipeline"));
+        console.log(chalk15.dim("  Full details: https://buildwithnexus.dev/overview"));
         console.log("");
       }
     });
@@ -2648,14 +2797,14 @@ var shellCommand2 = new Command13("shell").description("Launch the interactive N
         for (let i = 0; i < steps.length; i++) {
           const step = steps[i];
           console.log("");
-          console.log(chalk14.bold(`  \u2500\u2500 ${chalk14.cyan(`Step ${i + 1}/${steps.length}`)} \u2500\u2500 ${step.title} \u2500\u2500`));
+          console.log(chalk15.bold(`  \u2500\u2500 ${chalk15.cyan(`Step ${i + 1}/${steps.length}`)} \u2500\u2500 ${step.title} \u2500\u2500`));
           console.log("");
           for (const line of step.content) {
-            console.log(chalk14.white("  " + line));
+            console.log(chalk15.white("  " + line));
           }
           console.log("");
           if (i < steps.length - 1) {
-            const next = await input5({ message: chalk14.dim("Press Enter to continue (or 'skip' to exit)") });
+            const next = await input5({ message: chalk15.dim("Press Enter to continue (or 'skip' to exit)") });
             if (next.trim().toLowerCase() === "skip") {
               log.success("Tutorial ended. Type /help to see all commands.");
               return;
@@ -2702,9 +2851,9 @@ cli.addCommand(shellCommand2);
 cli.action(async () => {
   try {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_secrets(), secrets_exports));
-    const { isVmRunning: isVmRunning3 } = await Promise.resolve().then(() => (init_qemu(), qemu_exports));
+    const { isVmRunning: isVmRunning2 } = await Promise.resolve().then(() => (init_qemu(), qemu_exports));
     const config = loadConfig2();
-    if (config && isVmRunning3()) {
+    if (config && isVmRunning2()) {
       await shellCommand2.parseAsync([], { from: "user" });
       return;
     }
@@ -2718,7 +2867,7 @@ import fs11 from "fs";
 import path12 from "path";
 import os3 from "os";
 import https from "https";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 var PACKAGE_NAME = "buildwithnexus";
 var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
 var STATE_DIR = path12.join(os3.homedir(), ".buildwithnexus");
@@ -2799,8 +2948,8 @@ async function checkForUpdates(currentVersion) {
 function printUpdateBanner(current, latest) {
   const msg = [
     "",
-    chalk15.yellow(`  Update available: ${current} \u2192 ${latest}`),
-    chalk15.cyan(`  Run: npm update -g buildwithnexus`),
+    chalk16.yellow(`  Update available: ${current} \u2192 ${latest}`),
+    chalk16.cyan(`  Run: npm update -g buildwithnexus`),
     ""
   ].join("\n");
   process.stderr.write(msg + "\n");