buildwithnexus 0.7.1 → 0.7.2

package/dist/bin.js

@@ -9,27 +9,215 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/core/config.ts
-import dotenv from "dotenv";
+// src/core/dlp.ts
+import crypto from "crypto";
+import fs from "fs";
 import path from "path";
-import os from "os";
-function loadApiKeys() {
-  return {
-    anthropic: process.env.ANTHROPIC_API_KEY || void 0,
-    openai: process.env.OPENAI_API_KEY || void 0,
-    google: process.env.GOOGLE_API_KEY || void 0
-  };
+function shellEscape(value) {
+  if (value.includes("\0")) {
+    throw new DlpViolation("Null byte in shell argument");
+  }
+  return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-function hasAnyKey() {
-  return !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY || process.env.GOOGLE_API_KEY);
+function shellCommand(strings, ...values) {
+  let result = strings[0];
+  for (let i = 0; i < values.length; i++) {
+    result += shellEscape(values[i]) + strings[i + 1];
+  }
+  return result;
+}
+function redact(text) {
+  let result = text;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, "[REDACTED]");
+  }
+  return result;
+}
+function redactError(err) {
+  if (err instanceof Error) {
+    const safe = new Error(redact(err.message));
+    safe.name = err.name;
+    if (err.stack) safe.stack = redact(err.stack);
+    return safe;
+  }
+  return new Error(redact(String(err)));
+}
+function validateKeyValue(keyName, value) {
+  if (FORBIDDEN_KEY_CHARS.test(value)) {
+    throw new DlpViolation(
+      `${keyName} contains characters that are not permitted in API keys`
+    );
+  }
+  if (value.length < 10 || value.length > 256) {
+    throw new DlpViolation(
+      `${keyName} length out of expected range (10-256 characters)`
+    );
+  }
+  const validator = KEY_VALIDATORS[keyName];
+  if (validator && !validator.test(value)) {
+    throw new DlpViolation(
+      `${keyName} does not match the expected format for this key type`
+    );
+  }
+}
+function validateAllKeys(keys) {
+  const violations = [];
+  for (const [name, value] of Object.entries(keys)) {
+    if (!value) continue;
+    try {
+      validateKeyValue(name, value);
+    } catch (err) {
+      if (err instanceof DlpViolation) violations.push(err.message);
+    }
+  }
+  return violations;
+}
+function computeFileHmac(filePath, secret) {
+  const content = fs.readFileSync(filePath);
+  return crypto.createHmac("sha256", secret).update(content).digest("hex");
+}
+function sealKeysFile(keysPath, masterSecret) {
+  const hmac = computeFileHmac(keysPath, masterSecret);
+  fs.writeFileSync(HMAC_PATH, hmac, { mode: 384 });
+}
+function verifyKeysFile(keysPath, masterSecret) {
+  const keysExist = fs.existsSync(keysPath);
+  const hmacExist = fs.existsSync(HMAC_PATH);
+  if (!keysExist && !hmacExist) return true;
+  if (keysExist && !hmacExist) return false;
+  try {
+    const stored = fs.readFileSync(HMAC_PATH, "utf-8").trim();
+    const computed = computeFileHmac(keysPath, masterSecret);
+    return crypto.timingSafeEqual(
+      Buffer.from(stored, "hex"),
+      Buffer.from(computed, "hex")
+    );
+  } catch {
+    return false;
+  }
+}
+function audit(event, detail = "") {
+  try {
+    const dir = path.dirname(AUDIT_PATH);
+    if (!fs.existsSync(dir)) return;
+    if (fs.existsSync(AUDIT_PATH)) {
+      const stat = fs.statSync(AUDIT_PATH);
+      if (stat.size > MAX_AUDIT_SIZE) {
+        const rotated = AUDIT_PATH + ".1";
+        if (fs.existsSync(rotated)) fs.unlinkSync(rotated);
+        fs.renameSync(AUDIT_PATH, rotated);
+        try {
+          fs.chmodSync(rotated, 384);
+        } catch {
+        }
+      }
+    }
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} | ${event} | ${redact(detail)}
+`;
+    fs.appendFileSync(AUDIT_PATH, line, { mode: 384 });
+    try {
+      fs.chmodSync(AUDIT_PATH, 384);
+    } catch {
+    }
+  } catch {
+  }
+}
+var NEXUS_HOME, SECRET_PATTERNS, FORBIDDEN_KEY_CHARS, KEY_VALIDATORS, DlpViolation, HMAC_PATH, AUDIT_PATH, MAX_AUDIT_SIZE;
+var init_dlp = __esm({
+  "src/core/dlp.ts"() {
+    "use strict";
+    NEXUS_HOME = path.join(process.env.HOME || "~", ".buildwithnexus");
+    SECRET_PATTERNS = [
+      /sk-ant-api03-[A-Za-z0-9_-]{20,}/g,
+      // Anthropic API key
+      /sk-[A-Za-z0-9]{20,}/g,
+      // OpenAI API key
+      /AIza[A-Za-z0-9_-]{35}/g
+      // Google AI API key
+    ];
+    FORBIDDEN_KEY_CHARS = /[\n\r\t'"\\`${}();&|<>!#%^]/;
+    KEY_VALIDATORS = {
+      ANTHROPIC_API_KEY: /^sk-ant-[A-Za-z0-9_-]{20,}$/,
+      OPENAI_API_KEY: /^sk-[A-Za-z0-9_-]{20,}$/,
+      GOOGLE_API_KEY: /^AIza[A-Za-z0-9_-]{35,}$/,
+      NEXUS_MASTER_SECRET: /^[A-Za-z0-9_-]{20,64}$/
+    };
+    DlpViolation = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "DlpViolation";
+      }
+    };
+    HMAC_PATH = path.join(NEXUS_HOME, ".keys.hmac");
+    AUDIT_PATH = path.join(NEXUS_HOME, "audit.log");
+    MAX_AUDIT_SIZE = 10 * 1024 * 1024;
+  }
+});
+
+// src/core/secrets.ts
+import fs2 from "fs";
+import path2 from "path";
+import crypto2 from "crypto";
+function ensureHome() {
+  fs2.mkdirSync(NEXUS_HOME2, { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "images"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "configs"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "logs"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "ssh"), { recursive: true, mode: 448 });
+}
+function generateMasterSecret() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+function saveConfig(config) {
+  const { masterSecret: _secret, ...safeConfig } = config;
+  fs2.writeFileSync(CONFIG_PATH, JSON.stringify(safeConfig, null, 2), { mode: 384 });
+}
+function loadConfig() {
+  if (!fs2.existsSync(CONFIG_PATH)) return null;
+  return JSON.parse(fs2.readFileSync(CONFIG_PATH, "utf-8"));
+}
+function saveKeys(keys) {
+  const violations = validateAllKeys(keys);
+  if (violations.length > 0) {
+    throw new DlpViolation(`Key validation failed: ${violations.join("; ")}`);
+  }
+  const lines = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`);
+  fs2.writeFileSync(KEYS_PATH, lines.join("\n") + "\n", { mode: 384 });
+  sealKeysFile(KEYS_PATH, keys.NEXUS_MASTER_SECRET);
+  audit("keys_saved", `${Object.keys(keys).filter((k) => keys[k]).length} keys saved`);
+}
+function loadKeys() {
+  if (!fs2.existsSync(KEYS_PATH)) return null;
+  const content = fs2.readFileSync(KEYS_PATH, "utf-8");
+  const keys = {};
+  for (const line of content.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0) keys[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  const result = keys;
+  if (result.NEXUS_MASTER_SECRET && !verifyKeysFile(KEYS_PATH, result.NEXUS_MASTER_SECRET)) {
+    audit("keys_tampered", "HMAC mismatch on .env.keys");
+    throw new DlpViolation(
+      ".env.keys has been modified outside of buildwithnexus. Run 'buildwithnexus keys set' to re-enter your keys, or 'buildwithnexus destroy' to start fresh."
+    );
+  }
+  audit("keys_loaded", `${Object.keys(keys).length} keys loaded`);
+  return result;
 }
-function reloadEnv(envPath) {
-  const resolvedPath = envPath ?? path.join(os.homedir(), ".env.local");
-  dotenv.config({ path: resolvedPath, override: true });
+function maskKey(key) {
+  if (key.length <= 8) return "***";
+  const reveal = Math.min(4, Math.floor(key.length * 0.1));
+  return key.slice(0, reveal) + "..." + key.slice(-reveal);
 }
-var init_config = __esm({
-  "src/core/config.ts"() {
+var NEXUS_HOME2, CONFIG_PATH, KEYS_PATH;
+var init_secrets = __esm({
+  "src/core/secrets.ts"() {
     "use strict";
+    init_dlp();
+    NEXUS_HOME2 = process.env.NEXUS_HOME || path2.join(process.env.HOME || "~", ".buildwithnexus");
+    CONFIG_PATH = process.env.NEXUS_CONFIG_PATH || path2.join(NEXUS_HOME2, "config.json");
+    KEYS_PATH = process.env.NEXUS_KEYS_PATH || path2.join(NEXUS_HOME2, ".env.keys");
   }
 });
 
@@ -38,1491 +226,1637 @@ var init_command_exports = {};
 __export(init_command_exports, {
   deepAgentsInitCommand: () => deepAgentsInitCommand
 });
-import fs from "fs";
-import path2 from "path";
-import os2 from "os";
 import * as readline from "readline";
 async function deepAgentsInitCommand() {
-  const envPath = path2.join(os2.homedir(), ".env.local");
+  const inputHandler = new InputHandler();
+  ensureHome();
+  let existingKeys = null;
+  try {
+    existingKeys = loadKeys();
+  } catch {
+  }
+  if (existingKeys) {
+    console.log("\nKeys found in ~/.buildwithnexus/.env.keys:");
+    if (existingKeys.ANTHROPIC_API_KEY) {
+      console.log(`  ANTHROPIC_API_KEY: ${maskKey(existingKeys.ANTHROPIC_API_KEY)}`);
+    }
+    if (existingKeys.OPENAI_API_KEY) {
+      console.log(`  OPENAI_API_KEY: ${maskKey(existingKeys.OPENAI_API_KEY)}`);
+    }
+    if (existingKeys.GOOGLE_API_KEY) {
+      console.log(`  GOOGLE_API_KEY: ${maskKey(existingKeys.GOOGLE_API_KEY)}`);
+    }
+    const choice = await inputHandler.askQuestion(
+      "\nPress Enter to use cached keys, or type 'new' to reconfigure: "
+    );
+    if (choice.trim().toLowerCase() !== "new") {
+      process.env.ANTHROPIC_API_KEY = existingKeys.ANTHROPIC_API_KEY || "";
+      if (existingKeys.OPENAI_API_KEY) process.env.OPENAI_API_KEY = existingKeys.OPENAI_API_KEY;
+      if (existingKeys.GOOGLE_API_KEY) process.env.GOOGLE_API_KEY = existingKeys.GOOGLE_API_KEY;
+      console.log("Using cached keys.");
+      inputHandler.close();
+      return;
+    }
+  }
   console.log(
-    "Please provide your LLM API keys:\n(You can set these later by editing .env.local)\n"
+    "\nPlease provide your LLM API keys:\n(Stored securely in ~/.buildwithnexus/.env.keys)\n"
   );
-  const anthropicKey = await askQuestion(
+  const anthropicKey = await inputHandler.askQuestion(
     "ANTHROPIC_API_KEY (Claude - optional, press Enter to skip): "
   );
-  const openaiKey = await askQuestion(
+  const openaiKey = await inputHandler.askQuestion(
     "OPENAI_API_KEY (GPT - optional, press Enter to skip): "
   );
-  const googleKey = await askQuestion(
+  const googleKey = await inputHandler.askQuestion(
     "GOOGLE_API_KEY (Gemini - optional, press Enter to skip): "
   );
   if (!anthropicKey && !openaiKey && !googleKey) {
-    console.log("Error: At least one API key must be provided.");
+    const anthropicStatus = anthropicKey ? "provided" : "empty";
+    const openaiStatus = openaiKey ? "provided" : "empty";
+    const googleStatus = googleKey ? "provided" : "empty";
+    console.log(
+      `Error: API keys status: Anthropic [${anthropicStatus}], OpenAI [${openaiStatus}], Google [${googleStatus}]. Please provide at least one.`
+    );
+    inputHandler.close();
     return;
   }
-  const backendUrl = await askQuestion("Backend URL (http://localhost:4200): ") || "http://localhost:4200";
-  const dashboardPort = await askQuestion("Dashboard port (4201): ") || "4201";
-  const envContent = `# Nexus Configuration
-# Generated by buildwithnexus init
-
-# LLM API Keys
-${anthropicKey ? `ANTHROPIC_API_KEY=${anthropicKey}` : "# ANTHROPIC_API_KEY="}
-${openaiKey ? `OPENAI_API_KEY=${openaiKey}` : "# OPENAI_API_KEY="}
-${googleKey ? `GOOGLE_API_KEY=${googleKey}` : "# GOOGLE_API_KEY="}
-
-# Backend
-BACKEND_URL=${backendUrl}
-DASHBOARD_PORT=${dashboardPort}
-
-# Optional
-# LOG_LEVEL=debug
-`;
-  fs.writeFileSync(envPath, envContent, { mode: 384 });
-  reloadEnv(envPath);
-  console.log("Configuration saved to .env.local and loaded into environment.");
-}
-function setupInputHandling() {
-  return new Promise((resolve) => {
-    if (isSetup) {
-      resolve();
-      return;
-    }
-    isSetup = true;
-    if (process.stdin.isTTY) {
-      resolve();
-    } else {
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-        terminal: false
-      });
-      rl.on("line", (line) => {
-        inputLines.push(line);
-      });
-      rl.on("close", () => {
-        resolve();
-      });
-    }
-  });
-}
-async function askQuestion(prompt) {
-  await setupInputHandling();
-  if (process.stdin.isTTY) {
-    return new Promise((resolve) => {
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      rl.question(prompt, (answer) => {
-        rl.close();
-        resolve(answer);
-      });
-    });
-  } else {
-    process.stdout.write(prompt);
-    const answer = inputLines[lineIndex] || "";
-    lineIndex++;
-    console.log(answer);
-    return answer;
-  }
+  const masterSecret = generateMasterSecret();
+  const keys = {
+    ANTHROPIC_API_KEY: anthropicKey,
+    OPENAI_API_KEY: openaiKey || void 0,
+    GOOGLE_API_KEY: googleKey || void 0,
+    NEXUS_MASTER_SECRET: masterSecret
+  };
+  saveKeys(keys);
+  if (anthropicKey) process.env.ANTHROPIC_API_KEY = anthropicKey;
+  if (openaiKey) process.env.OPENAI_API_KEY = openaiKey;
+  if (googleKey) process.env.GOOGLE_API_KEY = googleKey;
+  console.log("Configuration saved to ~/.buildwithnexus/.env.keys and loaded into environment.");
+  inputHandler.close();
 }
-var inputLines, lineIndex, isSetup;
+var InputHandler;
 var init_init_command = __esm({
   "src/cli/init-command.ts"() {
     "use strict";
-    init_config();
-    inputLines = [];
-    lineIndex = 0;
-    isSetup = false;
+    init_secrets();
+    InputHandler = class {
+      inputLines = [];
+      lineIndex = 0;
+      isSetup = false;
+      rl = null;
+      setupInputHandling() {
+        return new Promise((resolve) => {
+          if (this.isSetup) {
+            resolve();
+            return;
+          }
+          this.isSetup = true;
+          if (process.stdin.isTTY) {
+            this.rl = readline.createInterface({
+              input: process.stdin,
+              output: process.stdout
+            });
+            resolve();
+          } else {
+            const rl = readline.createInterface({
+              input: process.stdin,
+              output: process.stdout,
+              terminal: false
+            });
+            rl.on("line", (line) => {
+              this.inputLines.push(line);
+            });
+            rl.on("close", () => {
+              resolve();
+            });
+          }
+        });
+      }
+      async askQuestion(prompt) {
+        await this.setupInputHandling();
+        if (process.stdin.isTTY) {
+          return new Promise((resolve) => {
+            this.rl.question(prompt, (answer) => {
+              resolve(answer);
+            });
+          });
+        } else {
+          process.stdout.write(prompt);
+          const answer = this.inputLines[this.lineIndex] || "";
+          this.lineIndex++;
+          console.log(answer);
+          return answer;
+        }
+      }
+      close() {
+        if (this.rl) {
+          this.rl.close();
+          this.rl = null;
+        }
+      }
+    };
   }
 });
 
-// src/ui/banner.ts
-var banner_exports = {};
-__export(banner_exports, {
-  showBanner: () => showBanner,
-  showCompletion: () => showCompletion,
-  showPhase: () => showPhase,
-  showSecurityPosture: () => showSecurityPosture
+// src/ui/logger.ts
+import chalk2 from "chalk";
+var log;
+var init_logger = __esm({
+  "src/ui/logger.ts"() {
+    "use strict";
+    log = {
+      step(msg) {
+        console.log(chalk2.cyan("  \u2192 ") + msg);
+      },
+      success(msg) {
+        console.log(chalk2.green("  \u2713 ") + msg);
+      },
+      error(msg) {
+        console.error(chalk2.red("  \u2717 ") + msg);
+      },
+      warn(msg) {
+        console.log(chalk2.yellow("  \u26A0 ") + msg);
+      },
+      dim(msg) {
+        console.log(chalk2.dim("    " + msg));
+      },
+      detail(label, value) {
+        console.log(chalk2.dim("    " + label + ": ") + value);
+      },
+      progress(current, total, label) {
+        const pct = Math.round(current / total * 100);
+        const filled = Math.round(current / total * 20);
+        const bar = chalk2.cyan("\u2588".repeat(filled)) + chalk2.dim("\u2591".repeat(20 - filled));
+        process.stdout.write(`\r  [${bar}] ${chalk2.bold(`${pct}%`)} ${chalk2.dim(label)}`);
+        if (current >= total) process.stdout.write("\n");
+      }
+    };
+  }
 });
-import chalk5 from "chalk";
-import { readFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function getVersion() {
-  try {
-    const __dirname2 = dirname(fileURLToPath2(import.meta.url));
-    const packagePath = join(__dirname2, "..", "package.json");
-    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
-    return packageJson.version;
-  } catch {
-    return true ? "0.7.1" : "0.0.0-unknown";
+
+// src/core/platform.ts
+import os2 from "os";
+function detectPlatform() {
+  const platform = os2.platform();
+  const arch = os2.arch();
+  if (platform === "darwin") {
+    return {
+      os: "mac",
+      arch: arch === "arm64" ? "arm64" : "x64",
+      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
+    };
   }
+  if (platform === "linux") {
+    return {
+      os: "linux",
+      arch: arch === "arm64" ? "arm64" : "x64",
+      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
+    };
+  }
+  if (platform === "win32") {
+    return {
+      os: "windows",
+      arch: "x64",
+      dockerPlatform: "linux/amd64"
+    };
+  }
+  throw new Error(`Unsupported platform: ${platform} ${arch}`);
 }
-function showBanner() {
-  console.log(BANNER);
-  console.log(chalk5.dim(`  v${getVersion()} \xB7 buildwithnexus.dev
-`));
-}
-function showPhase(phase, total, description) {
-  const progress = chalk5.cyan(`[${phase}/${total}]`);
-  console.log(`
-${progress} ${chalk5.bold(description)}`);
-}
-function showSecurityPosture() {
-  const lines = [
-    "",
-    chalk5.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
-    chalk5.bold("  \u2551  ") + chalk5.bold.green("Security Posture") + chalk5.bold("                                        \u2551"),
-    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Triple-nested isolation: Host \u2192 VM \u2192 Docker \u2192 KVM".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Network hardened: UFW deny-all, allow 22/80/443/4200".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" All databases encrypted at rest (AES-256-CBC)".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" API keys never embedded in VM \u2014 delivered via SCP".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" SSH-only communication (no exposed network ports)".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" DLP: secret detection, shell escaping, output redaction".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" HMAC integrity verification on all key files".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Docker: --read-only, no-new-privileges, cap-drop=ALL".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.bold("  \u2551  ") + chalk5.dim("Full details: https://buildwithnexus.dev/security".padEnd(55)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
-    ""
-  ];
-  console.log(lines.join("\n"));
-}
-function showCompletion(urls) {
-  const lines = [
-    "",
-    chalk5.green("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
-    chalk5.green("  \u2551  ") + chalk5.bold.green("NEXUS Runtime is Live!") + chalk5.green("                                 \u2551"),
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.white(`Connect:    ${urls.ssh}`.padEnd(55)) + chalk5.green("\u2551")
-  ];
-  if (urls.remote) {
-    lines.push(chalk5.green("  \u2551  ") + chalk5.white(`Remote:     ${urls.remote}`.padEnd(55)) + chalk5.green("\u2551"));
-  }
-  lines.push(
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.dim("Quick Start:".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus           - Interactive shell".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus brainstorm - Brainstorm ideas".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus status    - Check health".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.dim("All commands:".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus stop/start/update/logs/ssh/destroy".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
-    ""
-  );
-  console.log(lines.join("\n"));
-}
-var BANNER;
-var init_banner = __esm({
-  "src/ui/banner.ts"() {
+var init_platform = __esm({
+  "src/core/platform.ts"() {
     "use strict";
-    BANNER = `
-  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
-  \u2551       ${chalk5.bold.cyan("B U I L D   W I T H   N E X U S")}        \u2551
-  \u2551                                              \u2551
-  \u2551      Autonomous Agent Orchestration          \u2551
-  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
-`;
   }
 });
 
-// src/bin.ts
-init_init_command();
-import { program } from "commander";
-
-// src/cli/tui.ts
-import chalk from "chalk";
-var colors = {
-  accent: chalk.hex("#7D56F4"),
-  // Brand purple
-  success: chalk.hex("#00FF87"),
-  // Bright green
-  warning: chalk.hex("#FFB86C"),
-  // Amber
-  info: chalk.hex("#8BE9FD"),
-  // Cyan
-  muted: chalk.gray,
-  // Adaptive gray
-  error: chalk.red
-};
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var STATUS_SYMBOLS = {
-  done: colors.success("\u2714"),
-  active: colors.info("\u25C9"),
-  pending: colors.muted("\u25CB"),
-  error: colors.error("\u2716")
-};
-var TUI = class {
-  taskStartTime = 0;
-  eventCount = 0;
-  spinnerIndex = 0;
-  getSpinner() {
-    const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
-    this.spinnerIndex++;
-    return frame;
-  }
-  displayHeader(task, agent) {
-    console.clear();
-    const headerBox = this.makeRoundedBox(
-      colors.accent("\u{1F680} NEXUS - Autonomous Agent Orchestration"),
-      62,
-      colors.accent
-    );
-    console.log(headerBox);
-    console.log("");
-    console.log(colors.muted("Task") + colors.muted(":  ") + chalk.white(task));
-    console.log(colors.muted("Agent") + colors.muted(": ") + colors.info(agent));
-    console.log("");
-    this.taskStartTime = Date.now();
-  }
-  displayConnecting() {
-    console.log(`${this.getSpinner()} ${colors.warning("Connecting to backend...")}`);
+// src/core/docker.ts
+var docker_exports = {};
+__export(docker_exports, {
+  dockerExec: () => dockerExec,
+  imageExistsLocally: () => imageExistsLocally,
+  installDocker: () => installDocker,
+  isDockerInstalled: () => isDockerInstalled,
+  isNexusRunning: () => isNexusRunning,
+  pullImage: () => pullImage,
+  startBackend: () => startBackend,
+  startNexus: () => startNexus,
+  stopNexus: () => stopNexus
+});
+import { existsSync } from "fs";
+import { execa } from "execa";
+async function isDockerInstalled() {
+  try {
+    await execa("docker", ["info"]);
+    return true;
+  } catch {
+    return false;
   }
-  displayConnected(runId) {
-    console.log(`${STATUS_SYMBOLS.done} Connected \u2022 ${colors.muted(`run: ${runId}`)}`);
-    console.log("");
+}
+async function isDockerInstalledButNotRunning() {
+  try {
+    await execa("docker", ["--version"]);
+    return true;
+  } catch {
+    return false;
   }
-  displayStreamStart() {
-    console.log(chalk.bold(colors.accent("\u{1F4E1} Streaming Events")));
-    console.log("");
+}
+function dockerDesktopExists() {
+  return existsSync(DOCKER_DESKTOP_APP_PATH);
+}
+async function ensureHomebrew() {
+  try {
+    await execa("which", ["brew"]);
+    log.dim("Homebrew is already installed.");
+    return;
+  } catch {
   }
-  displayPlan(task, steps) {
-    console.log("");
-    const planHeader = colors.accent("Plan Breakdown");
-    const planLines = [];
-    steps.forEach((step, i) => {
-      planLines.push(`  ${STATUS_SYMBOLS.pending}  ${chalk.white(`Step ${i + 1}:`)} ${step}`);
+  log.step("Installing Homebrew...");
+  try {
+    await execa("/bin/bash", [
+      "-c",
+      "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    ], {
+      stdio: "inherit",
+      env: { ...process.env, NONINTERACTIVE: "1" }
     });
-    const planBox = this.makeDoubleBox(planHeader, planLines.join("\n"), 62, colors.accent);
-    console.log(planBox);
-    console.log("");
-  }
-  displayEvent(type, data) {
-    this.eventCount++;
-    const content = data["content"] || "";
-    if (type === "agent_working") {
-      const agent = data["agent"] || "Agent";
-      const agentTask = data["task"] || "";
-      console.log("");
-      console.log(`  ${colors.info("\u{1F464}")} ${colors.info(chalk.bold(agent))}`);
-      console.log(`     ${colors.muted("\u2192")} ${agentTask}`);
-      return;
-    }
-    if (type === "agent_result") {
-      const result = data["result"] || "";
-      let displayResult = result;
-      if (displayResult.length > 100) {
-        displayResult = displayResult.substring(0, 97) + "...";
-      }
-      console.log(`  ${STATUS_SYMBOLS.done} ${chalk.white(displayResult)}`);
-      return;
-    }
-    const eventConfig = {
-      thought: { icon: "\u{1F4AD}", color: colors.info },
-      action: { icon: "\u26A1", color: colors.warning },
-      observation: { icon: "\u2713", color: colors.success },
-      started: { icon: "\u25B6", color: colors.info },
-      done: { icon: "\u2728", color: colors.success },
-      execution_complete: { icon: "\u2728", color: colors.success },
-      error: { icon: "\u2716", color: colors.error }
-    };
-    const config = eventConfig[type] || { icon: "\u25CF", color: colors.muted };
-    let displayContent = content;
-    if (displayContent.length > 100) {
-      displayContent = displayContent.substring(0, 97) + "...";
-    }
-    console.log(`  ${config.icon} ${config.color(displayContent)}`);
-  }
-  displayResults(summary, todosCompleted) {
-    console.log("");
-    console.log(colors.success("\u2501".repeat(60)));
-    console.log(colors.success.bold("\u2728 Execution Complete"));
-    console.log("");
-    const lines = summary.split("\n");
-    for (const line of lines) {
-      console.log(`  ${colors.success("\u2502")} ${chalk.white(line)}`);
-    }
-    console.log("");
-    console.log(`  ${colors.muted(`${todosCompleted} subtask(s) completed`)}`);
-    console.log("");
-  }
-  displayError(error) {
-    console.log("");
-    console.log(colors.error("\u274C Error"));
-    console.log(colors.error(error));
-    console.log("");
-  }
-  displayComplete(duration) {
-    const seconds = (duration / 1e3).toFixed(1);
-    console.log("");
-    console.log(colors.success.bold(`\u2728 Complete in ${seconds}s`));
-    console.log(colors.muted(`${this.eventCount} event(s) streamed`));
-    console.log("");
+  } catch {
+    throw new Error(
+      'Failed to install Homebrew automatically.\n\n  Install Homebrew manually:\n    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"\n\n  Then re-run:\n    buildwithnexus init'
+    );
   }
-  displayBox(title, content) {
-    const box = this.makeRoundedBox(title, 60, colors.accent);
-    console.log(box);
-    const lines = content.split("\n");
-    for (const line of lines) {
-      const padded = line.substring(0, 56).padEnd(56);
-      console.log(`  ${padded}`);
-    }
-    console.log("");
+  try {
+    await execa("which", ["brew"]);
+  } catch {
+    const armPath = "/opt/homebrew/bin";
+    const intelPath = "/usr/local/bin";
+    process.env.PATH = `${armPath}:${intelPath}:${process.env.PATH}`;
+    log.dim("Added Homebrew paths to PATH for this session.");
   }
-  getElapsedTime() {
-    return Date.now() - this.taskStartTime;
+  try {
+    await execa("brew", ["--version"]);
+    log.success("Homebrew installed successfully.");
+  } catch {
+    throw new Error(
+      "Homebrew was installed but is not available on PATH.\n\n  Try opening a new terminal and re-running:\n    buildwithnexus init"
+    );
   }
-  displayModeBar(current) {
-    const modes = ["PLAN", "BUILD", "BRAINSTORM"];
-    const modeConfig = {
-      PLAN: { icon: "\u{1F4CB}", color: colors.info },
-      BUILD: { icon: "\u2699\uFE0F", color: colors.success },
-      BRAINSTORM: { icon: "\u{1F4A1}", color: chalk.blue }
-    };
-    const parts = modes.map((m) => {
-      const config = modeConfig[m];
-      const label = `${config.icon} ${m}`;
-      if (m === current) {
-        return config.color.bold(label);
-      }
-      return colors.muted(label);
-    });
-    console.log(parts.join(colors.muted("  \u2022  ")));
-    console.log(colors.muted("[s] switch mode"));
-    console.log("");
-  }
-  displayModeHeader(mode) {
-    const config = {
-      PLAN: {
-        icon: "\u{1F4CB}",
-        desc: "Break down and review steps",
-        color: colors.info
-      },
-      BUILD: {
-        icon: "\u2699\uFE0F",
-        desc: "Execute with live streaming",
-        color: colors.success
-      },
-      BRAINSTORM: {
-        icon: "\u{1F4A1}",
-        desc: "Free-form Q&A and exploration",
-        color: chalk.blue
+}
+async function installDocker(platform) {
+  const p = platform ?? detectPlatform();
+  switch (p.os) {
+    case "mac": {
+      if (await isDockerInstalled()) {
+        log.success("Docker is already running.");
+        return;
       }
-    };
-    const c = config[mode];
-    console.log("");
-    console.log(c.color.bold(`${c.icon} ${mode}`));
-    console.log(colors.muted(c.desc));
-    console.log("");
-  }
-  displaySuggestedMode(mode, task) {
-    const modeColor = {
-      PLAN: colors.info,
-      BUILD: colors.success,
-      BRAINSTORM: chalk.blue
-    };
-    const taskPreview = task.length > 45 ? task.substring(0, 42) + "..." : task;
-    console.log("");
-    console.log(
-      colors.muted("Suggested: ") + modeColor[mode].bold(mode) + colors.muted(` for "${taskPreview}"`)
-    );
-  }
-  displayBrainstormResponse(response) {
-    console.log("");
-    console.log(chalk.blue.bold("\u{1F4A1} Ideas & Analysis"));
-    console.log("");
-    const lines = response.split("\n");
-    for (const line of lines) {
-      if (line.trim()) {
-        console.log(`  ${chalk.white(line)}`);
+      if (dockerDesktopExists()) {
+        log.step(`Docker Desktop found at ${DOCKER_DESKTOP_APP_PATH} but not running. Attempting to start...`);
+        let launched = false;
+        log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
+        try {
+          await execa("open", [DOCKER_DESKTOP_APP_PATH]);
+          launched = true;
+          log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
+        } catch {
+          log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
+        }
+        if (!launched) {
+          log.dim("Trying: open -a Docker");
+          try {
+            await execa("open", ["-a", "Docker"]);
+            launched = true;
+            log.dim("Launch command succeeded via open -a Docker");
+          } catch {
+            log.warn("Both launch attempts failed.");
+          }
+        }
+        if (launched) {
+          log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
+          try {
+            await waitForDockerDaemon(12e4);
+            return;
+          } catch {
+            log.warn("Docker Desktop was launched but the daemon did not become ready in time.");
+          }
+        } else {
+          log.warn("Could not launch Docker Desktop. Will fall back to reinstalling via Homebrew.");
+        }
       } else {
-        console.log("");
+        log.step(`Docker Desktop not found at ${DOCKER_DESKTOP_APP_PATH}.`);
       }
+      log.step("Installing Docker Desktop via Homebrew...");
+      await ensureHomebrew();
+      try {
+        await execa("brew", ["install", "--cask", "docker"], {
+          stdio: "inherit",
+          timeout: 6e4
+        });
+      } catch (err) {
+        const e = err;
+        if (e.killed && e.signal === "SIGINT") {
+          throw new Error("Docker installation cancelled by user (Ctrl+C)");
+        }
+        if (e.timedOut) {
+          throw new Error(
+            "Docker installation via Homebrew timed out after 60 seconds.\n\n  The password prompt may be waiting for input. Try installing manually:\n    brew install --cask docker\n\n  After installing, re-run:\n    buildwithnexus init"
+          );
+        }
+        throw new Error(
+          "Failed to install Docker via Homebrew.\n\n  Try installing Docker Desktop manually:\n    https://www.docker.com/products/docker-desktop\n\n  After installing, re-run:\n    buildwithnexus init"
+        );
+      }
+      log.step("Launching Docker Desktop...");
+      let postInstallLaunched = false;
+      log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
+      try {
+        await execa("open", [DOCKER_DESKTOP_APP_PATH]);
+        postInstallLaunched = true;
+        log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
+      } catch {
+        log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
+      }
+      if (!postInstallLaunched) {
+        log.dim("Trying: open -a Docker");
+        try {
+          await execa("open", ["-a", "Docker"]);
+          postInstallLaunched = true;
+          log.dim("Launch command succeeded via open -a Docker");
+        } catch {
+          log.warn("Both launch attempts failed after install.");
+        }
+      }
+      if (!postInstallLaunched) {
+        throw new Error(
+          "Docker Desktop was installed but could not be started automatically.\n\n  Next steps:\n    1. Open Docker Desktop manually from your Applications folder\n    2. Wait for the whale icon to appear in the menu bar\n    3. Re-run: buildwithnexus init"
+        );
+      }
+      log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
+      await waitForDockerDaemon(12e4);
+      break;
     }
-    console.log("");
-  }
-  displayPermissionPrompt(message) {
-    return colors.accent.bold(message) + colors.muted(" (y/n)  ");
-  }
-  makeRoundedBox(title, width, borderColor) {
-    const lines = [];
-    const innerWidth = width - 4;
-    const titlePadded = ` ${title} `.padEnd(innerWidth).substring(0, innerWidth);
-    lines.push(borderColor("\u256D" + "\u2500".repeat(innerWidth) + "\u256E"));
-    lines.push(borderColor("\u2502") + chalk.bold(titlePadded) + borderColor("\u2502"));
-    lines.push(borderColor("\u2570" + "\u2500".repeat(innerWidth) + "\u256F"));
-    return lines.join("\n");
-  }
-  makeDoubleBox(title, content, width, borderColor) {
-    const lines = [];
-    const innerWidth = width - 4;
-    const titlePadded = ` ${title} `.padEnd(innerWidth).substring(0, innerWidth);
-    lines.push(borderColor("\u2554" + "\u2550".repeat(innerWidth) + "\u2557"));
-    lines.push(borderColor("\u2551") + chalk.bold(titlePadded) + borderColor("\u2551"));
-    lines.push(borderColor("\u2560" + "\u2550".repeat(innerWidth) + "\u2563"));
-    const contentLines = content.split("\n");
-    for (const line of contentLines) {
-      const padded = line.substring(0, innerWidth - 2).padEnd(innerWidth - 2);
-      lines.push(borderColor("\u2551") + "  " + padded + borderColor("\u2551"));
-    }
-    lines.push(borderColor("\u255A" + "\u2550".repeat(innerWidth) + "\u255D"));
-    return lines.join("\n");
-  }
-};
-var tui = new TUI();
-
-// src/cli/run-command.ts
-init_config();
-async function runCommand(task, options) {
-  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
-  tui.displayHeader(task, options.agent);
-  tui.displayConnecting();
-  try {
-    let healthOk = false;
-    try {
-      const healthResponse = await fetch(`${backendUrl}/health`);
-      healthOk = healthResponse.ok;
-    } catch {
-    }
-    if (!healthOk) {
-      console.error(
-        "Backend not responding. Start it with:\n   buildwithnexus server"
-      );
-      process.exit(1);
-    }
-    const keys = loadApiKeys();
-    const response = await fetch(`${backendUrl}/api/run`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        task,
-        agent_role: options.agent,
-        agent_goal: options.goal || "",
-        api_key: keys.anthropic || "",
-        openai_api_key: keys.openai || "",
-        google_api_key: keys.google || ""
-      })
-    });
-    if (!response.ok) {
-      console.error("Backend error");
-      console.error(await response.text());
-      process.exit(1);
+    case "linux": {
+      const linuxBinaryExists = await isDockerInstalledButNotRunning();
+      if (linuxBinaryExists) {
+        log.step("Docker is installed but the daemon is not running.");
+        log.step("Starting Docker daemon...");
+        try {
+          await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
+          log.dim("Started Docker daemon via systemctl.");
+        } catch {
+          try {
+            await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
+            log.dim("Started Docker daemon via service command.");
+          } catch {
+            throw new Error(
+              "Docker is installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
+            );
+          }
+        }
+        log.step("Waiting for Docker...");
+        await waitForDockerDaemon(3e4);
+        return;
+      }
+      log.step("Installing Docker...");
+      log.warn("This may require your sudo password.");
+      log.dim("Running official Docker install script from https://get.docker.com ...");
+      try {
+        const { stdout: script } = await execa("curl", ["-fsSL", "https://get.docker.com"]);
+        await execa("sudo", ["sh", "-c", script], { stdio: "inherit" });
+        log.success("Docker installed successfully.");
+      } catch {
+        throw new Error(
+          "Failed to install Docker on Linux.\n\n  Try installing manually:\n    curl -fsSL https://get.docker.com | sudo sh\n\n  After installing, re-run:\n    buildwithnexus init"
+        );
+      }
+      log.dim("Adding current user to docker group...");
+      try {
+        const user = (await execa("whoami")).stdout.trim();
+        await execa("sudo", ["usermod", "-aG", "docker", user]);
+        log.dim(`Added user '${user}' to docker group (may require re-login for effect).`);
+      } catch {
+        log.warn("Could not add user to docker group. You may need sudo for docker commands.");
+      }
+      log.step("Starting Docker daemon...");
+      try {
+        await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
+        log.dim("Started Docker daemon via systemctl.");
+      } catch {
+        try {
+          await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
+          log.dim("Started Docker daemon via service command.");
+        } catch {
+          throw new Error(
+            "Docker was installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
+          );
+        }
+      }
+      log.step("Waiting for Docker...");
+      await waitForDockerDaemon(3e4);
+      break;
     }
-    const { run_id } = await response.json();
-    tui.displayConnected(run_id);
-    tui.displayStreamStart();
-    const eventSourceUrl = `${backendUrl}/api/stream/${run_id}`;
-    try {
-      const response2 = await fetch(eventSourceUrl);
-      const reader = response2.body?.getReader();
-      const decoder = new TextDecoder();
-      if (!reader) {
-        throw new Error("No response body");
+    case "windows": {
+      const winBinaryExists = await isDockerInstalledButNotRunning();
+      if (winBinaryExists) {
+        log.step("Docker Desktop is installed but not running. Attempting to start...");
+        log.step("Launching Docker...");
+        try {
+          await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
+          log.dim("Docker Desktop launch command sent.");
+        } catch {
+          log.warn("Could not launch Docker Desktop automatically. It may need to be started manually.");
+        }
+        log.step("Waiting for Docker...");
+        try {
+          await waitForDockerDaemon(12e4);
+        } catch {
+          throw new Error(
+            "Docker Desktop did not start within 120 seconds.\n\n  Next steps:\n    1. Open Docker Desktop manually from the Start Menu\n    2. Wait for the whale icon to appear in the system tray\n    3. Re-run: buildwithnexus init"
+          );
+        }
+        return;
       }
-      let buffer = "";
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
-        buffer = lines.pop() || "";
-        for (const line of lines) {
-          if (line.startsWith("data: ")) {
-            try {
-              const data = JSON.parse(line.slice(6));
-              const type = data.type;
-              const content = data.data["content"] || "";
-              if (type === "done") {
-                tui.displayEvent(type, { content: "Task completed successfully" });
-                tui.displayComplete(tui.getElapsedTime());
-                process.exit(0);
-              } else if (type === "error") {
-                tui.displayError(content);
-                process.exit(1);
-              } else {
-                tui.displayEvent(type, { content });
-              }
-            } catch {
-            }
-          }
+      log.step("Installing Docker Desktop...");
+      let installed = false;
+      try {
+        await execa("choco", ["--version"]);
+        log.dim("Chocolatey detected. Installing Docker Desktop via choco...");
+        try {
+          await execa("choco", ["install", "docker-desktop", "-y"], { stdio: "inherit" });
+          installed = true;
+          log.success("Docker Desktop installed via Chocolatey.");
+        } catch {
+          log.warn("Chocolatey install failed. Falling back to direct download...");
         }
+      } catch {
+        log.dim("Chocolatey not found. Using direct download...");
       }
-    } catch (error) {
-      console.error(
-        "\nStream error. Make sure backend is running:\n   buildwithnexus server"
-      );
-      process.exit(1);
+      if (!installed) {
+        log.dim("Downloading Docker Desktop installer from docker.com...");
+        try {
+          await execa("powershell", [
+            "-Command",
+            "Invoke-WebRequest -Uri 'https://desktop.docker.com/win/main/amd64/Docker Desktop Installer.exe' -OutFile '$env:TEMP\\DockerInstaller.exe'; & '$env:TEMP\\DockerInstaller.exe' Install --quiet; Remove-Item '$env:TEMP\\DockerInstaller.exe' -Force -ErrorAction SilentlyContinue"
+          ], { stdio: "inherit" });
+          installed = true;
+          log.success("Docker Desktop installed via direct download.");
+        } catch {
+          throw new Error(
+            "Failed to install Docker Desktop on Windows.\n\n  Please install Docker Desktop manually:\n    1. Download from https://www.docker.com/products/docker-desktop\n    2. Run the installer and follow the prompts\n    3. Start Docker Desktop\n    4. Re-run: buildwithnexus init"
+          );
+        }
+      }
+      log.step("Launching Docker...");
+      try {
+        await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
+        log.dim("Docker Desktop launch command sent.");
+      } catch {
+        log.warn("Could not launch Docker Desktop automatically after install.");
+      }
+      log.step("Waiting for Docker...");
+      try {
+        await waitForDockerDaemon(12e4);
+      } catch {
+        throw new Error(
+          "Docker Desktop was installed but did not start within 120 seconds.\n\n  Next steps:\n    1. You may need to restart your computer for Docker to work\n    2. Open Docker Desktop from the Start Menu\n    3. Wait for the whale icon to appear in the system tray\n    4. Re-run: buildwithnexus init"
+        );
+      }
+      break;
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error("Error:", message);
-    process.exit(1);
+    default:
+      throw new Error(`Unsupported platform: ${p.os}`);
   }
 }
+async function waitForDockerDaemon(timeoutMs) {
+  const start = Date.now();
+  log.step("Waiting for Docker daemon...");
+  while (Date.now() - start < timeoutMs) {
+    try {
+      await execa("docker", ["info"]);
+      log.success("Docker daemon is ready");
+      return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 3e3));
+  }
+  throw new Error(
+    `Docker daemon did not become ready within ${Math.round(timeoutMs / 1e3)}s.
 
-// src/cli/dashboard-command.ts
-import { spawn } from "child_process";
-import { fileURLToPath } from "url";
-import path3 from "path";
-var __dirname = path3.dirname(fileURLToPath(import.meta.url));
-async function dashboardCommand(options) {
-  const port = options.port || "4201";
-  console.log(`Starting Nexus Dashboard on http://localhost:${port}
-`);
-  const dashboardPath = path3.join(__dirname, "../deep-agents/dashboard/server.js");
-  const dashboard = spawn("node", [dashboardPath], {
-    env: { ...process.env, PORT: port },
-    stdio: "inherit"
-  });
-  dashboard.on("error", (err) => {
-    console.error("Failed to start dashboard:", err);
-    process.exit(1);
-  });
-  console.log(`Dashboard ready! Open: http://localhost:${port}`);
-  console.log("Press Ctrl+C to stop\n");
+  Please ensure Docker is running, then re-run:
+    buildwithnexus init`
+  );
 }
-
-// src/cli/interactive.ts
-import * as readline2 from "readline";
-import chalk2 from "chalk";
-
-// src/cli/intent-classifier.ts
-var PLAN_KEYWORDS = [
-  "design",
-  "plan",
-  "architect",
-  "structure",
-  "outline",
-  "roadmap",
-  "strategy",
-  "organize",
-  "breakdown",
-  "scope",
-  "model",
-  "schema"
-];
-var BUILD_KEYWORDS = [
-  "build",
-  "create",
-  "make",
-  "write",
-  "implement",
-  "code",
-  "generate",
-  "add",
-  "fix",
-  "update",
-  "deploy",
-  "run",
-  "start",
-  "launch",
-  "install",
-  "set up",
-  "setup",
-  "refactor",
-  "migrate"
-];
-var BRAINSTORM_KEYWORDS = [
-  "what",
-  "should",
-  "idea",
-  "ideas",
-  "think",
-  "consider",
-  "suggest",
-  "brainstorm",
-  "explore",
-  "wonder",
-  "might",
-  "could",
-  "would",
-  "how about",
-  "what if",
-  "options",
-  "alternatives",
-  "thoughts"
-];
-function classifyIntent(task) {
-  const lower = task.toLowerCase().trim();
-  let planScore = 0;
-  let buildScore = 0;
-  let brainstormScore = 0;
-  for (const kw of PLAN_KEYWORDS) {
-    if (lower.includes(kw)) planScore++;
+async function imageExistsLocally(image, tag) {
+  const ref = `${image}:${tag}`;
+  try {
+    await execa("docker", ["image", "inspect", ref]);
+    return true;
+  } catch {
+    return false;
   }
-  for (const kw of BUILD_KEYWORDS) {
-    if (lower.includes(kw)) buildScore++;
+}
+async function pullImage(image, tag) {
+  const ref = `${image}:${tag}`;
+  log.step(`Pulling image ${ref}...`);
+  try {
+    await execa("docker", ["pull", ref], { stdio: "inherit" });
+    log.success(`Image ${ref} pulled`);
+  } catch (err) {
+    log.error(`Failed to pull image ${ref}`);
+    throw err;
   }
-  for (const kw of BRAINSTORM_KEYWORDS) {
-    if (lower.includes(kw)) brainstormScore++;
+}
+async function startNexus(keys, config) {
+  log.step("Starting NEXUS container...");
+  try {
+    await execa("docker", [
+      "run",
+      "-d",
+      "--name",
+      CONTAINER_NAME,
+      "-e",
+      `ANTHROPIC_API_KEY=${keys.anthropic}`,
+      "-e",
+      `OPENAI_API_KEY=${keys.openai}`,
+      "-p",
+      `${config.port}:${config.port}`,
+      "buildwithnexus/nexus:latest"
+    ]);
+    log.success(`NEXUS container started on port ${config.port}`);
+  } catch (err) {
+    log.error("Failed to start NEXUS container");
+    throw err;
   }
-  const wordCount = lower.split(/\s+/).length;
-  if (wordCount > 12 && planScore === buildScore && buildScore === brainstormScore) {
-    return "plan";
+}
+async function stopNexus() {
+  log.step("Stopping NEXUS container...");
+  try {
+    await execa("docker", ["rm", "-f", CONTAINER_NAME]);
+    log.success("NEXUS container stopped and removed");
+  } catch (err) {
+    log.error("Failed to stop NEXUS container");
+    throw err;
   }
-  if (brainstormScore > planScore && brainstormScore > buildScore) return "brainstorm";
-  if (buildScore > planScore && buildScore > brainstormScore) return "build";
-  if (planScore > 0) return "plan";
-  return wordCount > 6 ? "plan" : "build";
 }
-
-// src/cli/interactive.ts
-init_config();
-async function interactiveMode() {
-  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
-  console.log(chalk2.cyan("\n\u{1F527} Configure API Keys\n"));
-  const { deepAgentsInitCommand: deepAgentsInitCommand2 } = await Promise.resolve().then(() => (init_init_command(), init_command_exports));
-  await deepAgentsInitCommand2();
-  reloadEnv();
-  if (!hasAnyKey()) {
-    console.error("Error: At least one API key is required to use buildwithnexus.");
-    process.exit(1);
+async function dockerExec(command) {
+  try {
+    const { stdout, stderr } = await execa("docker", ["exec", CONTAINER_NAME, "sh", "-c", command]);
+    return { stdout, stderr, code: 0 };
+  } catch (err) {
+    const e = err;
+    return { stdout: e.stdout ?? "", stderr: e.stderr ?? "", code: e.exitCode ?? 1 };
   }
-  const keys = loadApiKeys();
-  console.log(chalk2.green("\n\u2713 Keys configured!"));
-  console.log(chalk2.gray(`  Anthropic: ${keys.anthropic ? "\u2713" : "\u2717"}`));
-  console.log(chalk2.gray(`  OpenAI: ${keys.openai ? "\u2713" : "\u2717"}`));
-  console.log(chalk2.gray(`  Google: ${keys.google ? "\u2713" : "\u2717"}
-`));
+}
+async function startBackend() {
+  const { spawn: spawn2 } = await import("child_process");
+  const os5 = await import("os");
+  const path11 = await import("path");
+  const nexusDir = path11.join(os5.homedir(), "Projects", "nexus");
+  log.step(`Starting Nexus backend from ${nexusDir}...`);
+  const child = spawn2("python", ["-m", "src.deep_agents_server"], {
+    cwd: nexusDir,
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env }
+  });
+  child.unref();
+  log.success("Nexus backend process started");
+}
+async function isNexusRunning() {
   try {
-    const response = await fetch(`${backendUrl}/health`);
-    if (!response.ok) {
-      console.error(chalk2.red("\u274C Backend not running. Start it with: buildwithnexus server"));
-      process.exit(1);
-    }
+    const { stdout } = await execa("docker", [
+      "ps",
+      "--filter",
+      `name=^/${CONTAINER_NAME}$`,
+      "--format",
+      "{{.Names}}"
+    ]);
+    return stdout.trim() === CONTAINER_NAME;
   } catch {
-    console.error(chalk2.red("\u274C Cannot connect to backend at " + backendUrl));
-    process.exit(1);
+    return false;
   }
-  const rl = readline2.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
-  console.clear();
-  console.log(chalk2.gray("Welcome! Describe what you want the AI agents to do."));
-  console.log(chalk2.gray('Type "exit" to quit.\n'));
-  while (true) {
-    const task = await ask(chalk2.bold.blue("\u{1F4DD} Task: "));
-    if (task.toLowerCase() === "exit") {
-      console.log(chalk2.yellow("\nGoodbye! \u{1F44B}\n"));
-      rl.close();
-      process.exit(0);
-    }
-    if (!task.trim()) {
-      console.log(chalk2.red("Please enter a task.\n"));
-      continue;
-    }
-    const suggestedMode = classifyIntent(task).toUpperCase();
-    tui.displaySuggestedMode(suggestedMode, task);
-    const currentMode = await selectMode(suggestedMode, ask);
-    await runModeLoop(currentMode, task, backendUrl, rl, ask);
-    console.log("");
+}
+var CONTAINER_NAME, DOCKER_DESKTOP_APP_PATH;
+var init_docker = __esm({
+  "src/core/docker.ts"() {
+    "use strict";
+    init_logger();
+    init_platform();
+    CONTAINER_NAME = "nexus";
+    DOCKER_DESKTOP_APP_PATH = "/Applications/Docker.app";
   }
+});
+
+// src/ui/banner.ts
+var banner_exports = {};
+__export(banner_exports, {
+  showCompletion: () => showCompletion,
+  showPhase: () => showPhase,
+  showSecurityPosture: () => showSecurityPosture
+});
+import chalk5 from "chalk";
+function showPhase(phase, total, description) {
+  const progress = chalk5.cyan(`[${phase}/${total}]`);
+  console.log(`
+${progress} ${chalk5.bold(description)}`);
 }
-async function selectMode(suggested, ask) {
-  const modeColor = {
-    PLAN: chalk2.cyan,
-    BUILD: chalk2.green,
-    BRAINSTORM: chalk2.blue
-  };
-  console.log("");
-  console.log(
-    chalk2.gray("Press ") + chalk2.bold("Enter") + chalk2.gray(" to use ") + modeColor[suggested](suggested) + chalk2.gray(" or type ") + chalk2.bold("plan") + chalk2.gray("/") + chalk2.bold("build") + chalk2.gray("/") + chalk2.bold("brainstorm") + chalk2.gray(" to switch: ")
+function showSecurityPosture() {
+  const lines = [
+    "",
+    chalk5.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
+    chalk5.bold("  \u2551  ") + chalk5.bold.green("Security Posture") + chalk5.bold("                                        \u2551"),
+    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Triple-nested isolation: Host \u2192 VM \u2192 Docker \u2192 KVM".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Network hardened: UFW deny-all, allow 22/80/443/4200".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" All databases encrypted at rest (AES-256-CBC)".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" API keys never embedded in VM \u2014 delivered via SCP".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" SSH-only communication (no exposed network ports)".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" DLP: secret detection, shell escaping, output redaction".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" HMAC integrity verification on all key files".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Docker: --read-only, no-new-privileges, cap-drop=ALL".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.bold("  \u2551  ") + chalk5.dim("Full details: https://buildwithnexus.dev/security".padEnd(55)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
+    ""
+  ];
+  console.log(lines.join("\n"));
+}
+function showCompletion(urls) {
+  const lines = [
+    "",
+    chalk5.green("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
+    chalk5.green("  \u2551  ") + chalk5.bold.green("NEXUS Runtime is Live!") + chalk5.green("                                 \u2551"),
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.white(`Connect:    ${urls.ssh}`.padEnd(55)) + chalk5.green("\u2551")
+  ];
+  if (urls.remote) {
+    lines.push(chalk5.green("  \u2551  ") + chalk5.white(`Remote:     ${urls.remote}`.padEnd(55)) + chalk5.green("\u2551"));
+  }
+  lines.push(
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.dim("Quick Start:".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus           - Interactive shell".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus brainstorm - Brainstorm ideas".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus status    - Check health".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.dim("All commands:".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus stop/start/update/logs/ssh/destroy".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
+    ""
   );
-  const answer = await ask(chalk2.gray("> "));
-  const lower = answer.trim().toLowerCase();
-  if (lower === "p" || lower === "plan") return "PLAN";
-  if (lower === "b" || lower === "build") return "BUILD";
-  if (lower === "br" || lower === "brainstorm") return "BRAINSTORM";
-  return suggested;
+  console.log(lines.join("\n"));
 }
-async function runModeLoop(mode, task, backendUrl, rl, ask) {
-  let currentMode = mode;
-  while (true) {
+var init_banner = __esm({
+  "src/ui/banner.ts"() {
+    "use strict";
+  }
+});
+
+// src/bin.ts
+init_init_command();
+import { program } from "commander";
+
+// src/cli/tui.ts
+import chalk from "chalk";
+import stringWidth from "string-width";
+var colors = {
+  accent: chalk.hex("#7D56F4"),
+  // Brand purple
+  success: chalk.hex("#00FF87"),
+  // Bright green
+  warning: chalk.hex("#FFB86C"),
+  // Amber
+  info: chalk.hex("#8BE9FD"),
+  // Cyan
+  muted: chalk.gray,
+  // Adaptive gray
+  error: chalk.red
+};
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var STATUS_SYMBOLS = {
+  done: colors.success("\u2714"),
+  active: colors.info("\u25C9"),
+  pending: colors.muted("\u25CB"),
+  error: colors.error("\u2716")
+};
+var TUI = class {
+  taskStartTime = 0;
+  eventCount = 0;
+  spinnerIndex = 0;
+  getSpinner() {
+    const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
+    this.spinnerIndex++;
+    return frame;
+  }
+  displayHeader(task, agent) {
     console.clear();
-    printAppHeader();
-    tui.displayModeBar(currentMode);
-    tui.displayModeHeader(currentMode);
-    if (currentMode === "PLAN") {
-      const next = await planModeLoop(task, backendUrl, rl, ask);
-      if (next === "BUILD") {
-        currentMode = "BUILD";
-        continue;
-      }
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
-      }
+    const headerBox = this.makeRoundedBox(
+      colors.accent("\u{1F680} NEXUS - Autonomous Agent Orchestration"),
+      62,
+      colors.accent
+    );
+    console.log(headerBox);
+    console.log("");
+    console.log(colors.muted("Task") + colors.muted(":  ") + chalk.white(task));
+    console.log(colors.muted("Agent") + colors.muted(": ") + colors.info(agent));
+    console.log("");
+    this.taskStartTime = Date.now();
+  }
+  displayConnecting() {
+    console.log(`${this.getSpinner()} ${colors.warning("Connecting to backend...")}`);
+  }
+  displayConnected(runId) {
+    console.log(`${STATUS_SYMBOLS.done} Connected \u2022 ${colors.muted(`run: ${runId}`)}`);
+    console.log("");
+  }
+  displayStreamStart() {
+    console.log(chalk.bold(colors.accent("\u{1F4E1} Streaming Events")));
+    console.log("");
+  }
+  displayPlan(task, steps) {
+    console.log("");
+    const planHeader = colors.accent("Plan Breakdown");
+    const planLines = [];
+    steps.forEach((step, i) => {
+      planLines.push(`  ${STATUS_SYMBOLS.pending}  ${chalk.white(`Step ${i + 1}:`)} ${step}`);
+    });
+    const planBox = this.makeDoubleBox(planHeader, planLines.join("\n"), 62, colors.accent);
+    console.log(planBox);
+    console.log("");
+  }
+  displayEvent(type, data) {
+    this.eventCount++;
+    const content = data["content"] || "";
+    if (type === "agent_working") {
+      const agent = data["agent"] || "Agent";
+      const agentTask = data["task"] || "";
+      console.log("");
+      console.log(`  ${colors.info("\u{1F464}")} ${colors.info(chalk.bold(agent))}`);
+      console.log(`     ${colors.muted("\u2192")} ${agentTask}`);
       return;
     }
-    if (currentMode === "BUILD") {
-      const next = await buildModeLoop(task, backendUrl, rl, ask);
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
+    if (type === "agent_result") {
+      const result = data["result"] || "";
+      let displayResult = result;
+      if (displayResult.length > 100) {
+        displayResult = displayResult.substring(0, 97) + "...";
       }
+      console.log(`  ${STATUS_SYMBOLS.done} ${chalk.white(displayResult)}`);
       return;
     }
-    if (currentMode === "BRAINSTORM") {
-      const next = await brainstormModeLoop(task, backendUrl, rl, ask);
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
-      }
-      return;
+    const eventConfig = {
+      thought: { icon: "\u{1F4AD}", color: colors.info },
+      action: { icon: "\u26A1", color: colors.warning },
+      observation: { icon: "\u2713", color: colors.success },
+      started: { icon: "\u25B6", color: colors.info },
+      done: { icon: "\u2728", color: colors.success },
+      execution_complete: { icon: "\u2728", color: colors.success },
+      error: { icon: "\u2716", color: colors.error }
+    };
+    const config = eventConfig[type] || { icon: "\u25CF", color: colors.muted };
+    let displayContent = content;
+    if (displayContent.length > 100) {
+      displayContent = displayContent.substring(0, 97) + "...";
     }
+    console.log(`  ${config.icon} ${config.color(displayContent)}`);
   }
-}
-function printAppHeader() {
-  console.log(chalk2.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  console.log(
-    chalk2.cyan("\u2551") + chalk2.bold.white("        \u{1F680} Nexus - Autonomous Agent Orchestration             ") + chalk2.cyan("\u2551")
-  );
-  console.log(chalk2.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
-  console.log("");
-}
-async function promptModeSwitch(current, ask) {
-  const others = ["PLAN", "BUILD", "BRAINSTORM"].filter((m) => m !== current);
-  console.log("");
-  console.log(
-    chalk2.gray("Switch to: ") + others.map((m, i) => chalk2.bold(`[${i + 1}] ${m}`)).join(chalk2.gray("  ")) + chalk2.gray("  [Enter to stay in ") + chalk2.bold(current) + chalk2.gray("]")
-  );
-  const answer = await ask(chalk2.gray("> "));
-  const n = parseInt(answer.trim(), 10);
-  if (n === 1) return others[0];
-  if (n === 2) return others[1];
-  return current;
-}
-async function planModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Task:"), chalk2.white(task));
-  console.log("");
-  console.log(chalk2.yellow("\u23F3 Fetching plan from backend..."));
-  let steps = [];
-  const keys = loadApiKeys();
-  try {
-    const response = await fetch(`${backendUrl}/api/run`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" })
-    });
-    if (!response.ok) {
-      console.error(chalk2.red("Backend error \u2014 cannot fetch plan."));
-      return "cancel";
-    }
-    const { run_id } = await response.json();
-    tui.displayConnected(run_id);
-    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-    const reader = streamResponse.body?.getReader();
-    const decoder = new TextDecoder();
-    if (!reader) throw new Error("No response body");
-    let buffer = "";
-    let planReceived = false;
-    outer: while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.startsWith("data: ")) continue;
-        try {
-          const parsed = JSON.parse(line.slice(6));
-          if (parsed.type === "plan") {
-            steps = parsed.data["steps"] || [];
-            planReceived = true;
-            break outer;
-          } else if (parsed.type === "error") {
-            const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
-            tui.displayError(errorMsg);
-            return "cancel";
-          }
-        } catch {
-        }
-      }
+  displayResults(summary, todosCompleted) {
+    console.log("");
+    console.log(colors.success("\u2501".repeat(60)));
+    console.log(colors.success.bold("\u2728 Execution Complete"));
+    console.log("");
+    const lines = summary.split("\n");
+    for (const line of lines) {
+      console.log(`  ${colors.success("\u2502")} ${chalk.white(line)}`);
     }
-    reader.cancel();
-    if (!planReceived || steps.length === 0) {
-      console.log(chalk2.yellow("No plan received from backend."));
-      steps = ["(no steps returned \u2014 execute anyway?)"];
+    console.log("");
+    console.log(`  ${colors.muted(`${todosCompleted} subtask(s) completed`)}`);
+    console.log("");
+  }
+  displayError(error) {
+    console.log("");
+    console.log(colors.error("\u274C Error"));
+    console.log(colors.error(error));
+    console.log("");
+  }
+  displayComplete(duration) {
+    const seconds = (duration / 1e3).toFixed(1);
+    console.log("");
+    console.log(colors.success.bold(`\u2728 Complete in ${seconds}s`));
+    console.log(colors.muted(`${this.eventCount} event(s) streamed`));
+    console.log("");
+  }
+  displayBox(title, content) {
+    const box = this.makeRoundedBox(title, 60, colors.accent);
+    console.log(box);
+    const lines = content.split("\n");
+    for (const line of lines) {
+      const padded = line.substring(0, 56).padEnd(56);
+      console.log(`  ${padded}`);
     }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk2.red("Error: " + msg));
-    return "cancel";
+    console.log("");
   }
-  displayPlanSteps(steps);
-  while (true) {
-    console.log(chalk2.gray("Options: ") + chalk2.bold("[Y]") + chalk2.gray(" Execute  ") + chalk2.bold("[e]") + chalk2.gray(" Edit step  ") + chalk2.bold("[s]") + chalk2.gray(" Switch mode  ") + chalk2.bold("[Esc/n]") + chalk2.gray(" Cancel"));
-    const answer = (await ask(tui.displayPermissionPrompt("Execute this plan?"))).trim().toLowerCase();
-    if (answer === "" || answer === "y") {
-      return "BUILD";
+  getElapsedTime() {
+    return Date.now() - this.taskStartTime;
+  }
+  displayModeBar(current) {
+    const modes = ["PLAN", "BUILD", "BRAINSTORM"];
+    const modeConfig = {
+      PLAN: { icon: "\u{1F4CB}", color: colors.info },
+      BUILD: { icon: "\u2699\uFE0F", color: colors.success },
+      BRAINSTORM: { icon: "\u{1F4A1}", color: chalk.blue }
+    };
+    const parts = modes.map((m) => {
+      const config = modeConfig[m];
+      const label = `${config.icon} ${m}`;
+      if (m === current) {
+        return config.color.bold(label);
+      }
+      return colors.muted(label);
+    });
+    console.log(parts.join(colors.muted("  \u2022  ")));
+    console.log(colors.muted("[s] switch mode"));
+    console.log("");
+  }
+  displayModeHeader(mode) {
+    const config = {
+      PLAN: {
+        icon: "\u{1F4CB}",
+        desc: "Break down and review steps",
+        color: colors.info
+      },
+      BUILD: {
+        icon: "\u2699\uFE0F",
+        desc: "Execute with live streaming",
+        color: colors.success
+      },
+      BRAINSTORM: {
+        icon: "\u{1F4A1}",
+        desc: "Free-form Q&A and exploration",
+        color: chalk.blue
+      }
+    };
+    const c = config[mode];
+    console.log("");
+    console.log(c.color.bold(`${c.icon} ${mode}`));
+    console.log(colors.muted(c.desc));
+    console.log("");
+  }
+  displaySuggestedMode(mode, task) {
+    const modeColor = {
+      PLAN: colors.info,
+      BUILD: colors.success,
+      BRAINSTORM: chalk.blue
+    };
+    const taskPreview = task.length > 45 ? task.substring(0, 42) + "..." : task;
+    console.log("");
+    console.log(
+      colors.muted("Suggested: ") + modeColor[mode].bold(mode) + colors.muted(` for "${taskPreview}"`)
+    );
+  }
+  displayBrainstormResponse(response) {
+    console.log("");
+    console.log(chalk.blue.bold("\u{1F4A1} Ideas & Analysis"));
+    console.log("");
+    const lines = response.split("\n");
+    for (const line of lines) {
+      if (line.trim()) {
+        console.log(`  ${chalk.white(line)}`);
+      } else {
+        console.log("");
+      }
     }
-    if (answer === "n" || answer === "\x1B") {
-      console.log(chalk2.yellow("\nExecution cancelled.\n"));
-      return "cancel";
+    console.log("");
+  }
+  displayPermissionPrompt(message) {
+    return colors.accent.bold(message) + colors.muted(" (y/n)  ");
+  }
+  padToWidth(text, targetWidth) {
+    const visibleWidth = stringWidth(text);
+    const padding = Math.max(0, targetWidth - visibleWidth);
+    return text + " ".repeat(padding);
+  }
+  truncateToWidth(text, maxWidth) {
+    let result = "";
+    let width = 0;
+    for (const char of text) {
+      const charWidth = stringWidth(char);
+      if (width + charWidth > maxWidth) break;
+      result += char;
+      width += charWidth;
     }
-    if (answer === "e" || answer === "edit") {
-      steps = await editPlanSteps(steps, ask);
-      displayPlanSteps(steps);
-      continue;
+    return result;
+  }
+  makeRoundedBox(title, width, borderColor) {
+    const lines = [];
+    const innerWidth = width - 4;
+    const titleText = ` ${title} `;
+    const titleTruncated = this.truncateToWidth(titleText, innerWidth);
+    const titlePadded = this.padToWidth(titleTruncated, innerWidth);
+    lines.push(borderColor("\u256D" + "\u2500".repeat(innerWidth) + "\u256E"));
+    lines.push(borderColor("\u2502") + chalk.bold(titlePadded) + borderColor("\u2502"));
+    lines.push(borderColor("\u2570" + "\u2500".repeat(innerWidth) + "\u256F"));
+    return lines.join("\n");
+  }
+  makeDoubleBox(title, content, width, borderColor) {
+    const lines = [];
+    const innerWidth = width - 4;
+    const titleText = ` ${title} `;
+    const titleTruncated = this.truncateToWidth(titleText, innerWidth);
+    const titlePadded = this.padToWidth(titleTruncated, innerWidth);
+    lines.push(borderColor("\u2554" + "\u2550".repeat(innerWidth) + "\u2557"));
+    lines.push(borderColor("\u2551") + chalk.bold(titlePadded) + borderColor("\u2551"));
+    lines.push(borderColor("\u2560" + "\u2550".repeat(innerWidth) + "\u2563"));
+    const contentLines = content.split("\n");
+    for (const line of contentLines) {
+      const contentWidth = innerWidth - 2;
+      const truncated = this.truncateToWidth(line, contentWidth);
+      const padded = this.padToWidth(truncated, contentWidth);
+      lines.push(borderColor("\u2551") + "  " + padded + borderColor("\u2551"));
     }
-    if (answer === "s" || answer === "switch") {
-      return "switch";
+    lines.push(borderColor("\u255A" + "\u2550".repeat(innerWidth) + "\u255D"));
+    return lines.join("\n");
+  }
+};
+var tui = new TUI();
+
+// src/core/config.ts
+import dotenv from "dotenv";
+import path3 from "path";
+import os from "os";
+function loadApiKeys() {
+  const keyNames = [
+    ["ANTHROPIC_API_KEY", "anthropic"],
+    ["OPENAI_API_KEY", "openai"],
+    ["GOOGLE_API_KEY", "google"]
+  ];
+  const result = {};
+  for (const [envName, key] of keyNames) {
+    const raw = process.env[envName];
+    if (raw !== void 0) {
+      if (raw.trim() === "") {
+        console.warn(`WARNING: ${envName} is set but empty - it will be treated as unconfigured`);
+        result[key] = void 0;
+      } else {
+        result[key] = raw;
+      }
+    } else {
+      result[key] = void 0;
     }
   }
+  return result;
 }
-function displayPlanSteps(steps) {
-  console.log("");
-  console.log(chalk2.bold.cyan("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  console.log(chalk2.bold.cyan("\u2502") + chalk2.bold.white("  \u{1F4CB} Execution Plan                                      ") + chalk2.bold.cyan("\u2502"));
-  console.log(chalk2.bold.cyan("\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  steps.forEach((step, i) => {
-    const label = `  Step ${i + 1}: `;
-    const maxContentWidth = 57 - label.length;
-    const truncated = step.length > maxContentWidth ? step.substring(0, maxContentWidth - 3) + "..." : step;
-    const line = label + truncated;
-    const padded = line.padEnd(57);
-    console.log(chalk2.bold.cyan("\u2502") + chalk2.white(padded) + chalk2.bold.cyan("\u2502"));
-  });
-  console.log(chalk2.bold.cyan("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-  console.log("");
+function hasAnyKey() {
+  return !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY || process.env.GOOGLE_API_KEY);
 }
-async function editPlanSteps(steps, ask) {
-  console.log(chalk2.gray("Enter step number to edit, or press Enter to finish editing:"));
-  const numStr = await ask(chalk2.bold("Step #: "));
-  const n = parseInt(numStr.trim(), 10);
-  if (!isNaN(n) && n >= 1 && n <= steps.length) {
-    console.log(chalk2.gray(`Current: ${steps[n - 1]}`));
-    const updated = await ask(chalk2.bold("New text: "));
-    if (updated.trim()) steps[n - 1] = updated.trim();
+function validateBackendUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { valid: false, error: `Invalid backend URL: ${url}` };
+  }
+  const hostname = parsed.hostname;
+  const isLocal = hostname === "localhost" || hostname === "127.0.0.1";
+  if (parsed.protocol === "https:") {
+    return { valid: true };
+  }
+  if (isLocal) {
+    return { valid: true };
   }
-  return steps;
+  return {
+    valid: false,
+    error: "WARNING: Backend URL is not localhost and not HTTPS. API keys will be transmitted in plaintext. Use SSH tunnel or HTTPS endpoint."
+  };
 }
-async function buildModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Task:"), chalk2.white(task));
+
+// src/cli/run-command.ts
+async function runCommand(task, options) {
+  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
+  const urlCheck = validateBackendUrl(backendUrl);
+  if (!urlCheck.valid) {
+    console.error(`
+${urlCheck.error}`);
+    process.exit(1);
+  }
+  tui.displayHeader(task, options.agent);
   tui.displayConnecting();
-  const keys = loadApiKeys();
   try {
+    let healthOk = false;
+    try {
+      const healthResponse = await fetch(`${backendUrl}/health`);
+      healthOk = healthResponse.ok;
+    } catch {
+    }
+    if (!healthOk) {
+      console.error(
+        "Backend not responding. Start it with:\n   buildwithnexus server"
+      );
+      process.exit(1);
+    }
+    const keys = loadApiKeys();
     const response = await fetch(`${backendUrl}/api/run`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" })
+      body: JSON.stringify({
+        task,
+        agent_role: options.agent,
+        agent_goal: options.goal || "",
+        api_key: keys.anthropic || "",
+        openai_api_key: keys.openai || "",
+        google_api_key: keys.google || ""
+      })
     });
     if (!response.ok) {
-      console.error(chalk2.red("Backend error"));
-      return "done";
+      console.error("Backend error");
+      console.error(await response.text());
+      process.exit(1);
     }
     const { run_id } = await response.json();
     tui.displayConnected(run_id);
-    console.log(chalk2.bold.green("\u2699\uFE0F  Executing..."));
     tui.displayStreamStart();
-    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-    const reader = streamResponse.body?.getReader();
-    const decoder = new TextDecoder();
-    if (!reader) throw new Error("No response body");
-    let buffer = "";
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.startsWith("data: ")) continue;
-        try {
-          const parsed = JSON.parse(line.slice(6));
-          const type = parsed.type;
-          if (type === "execution_complete") {
-            const summary = parsed.data["summary"] || "";
-            const count = parsed.data["todos_completed"] || 0;
-            tui.displayResults(summary, count);
-            tui.displayComplete(tui.getElapsedTime());
-            break;
-          } else if (type === "done") {
-            tui.displayEvent(type, { content: "Task completed successfully" });
-            tui.displayComplete(tui.getElapsedTime());
-            break;
-          } else if (type === "error") {
-            const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
-            tui.displayError(errorMsg);
-            break;
-          } else if (type !== "plan") {
-            tui.displayEvent(type, parsed.data);
-          }
-        } catch {
-        }
-      }
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk2.red("Error: " + msg));
-  }
-  console.log("");
-  console.log(
-    chalk2.gray("Options: ") + chalk2.bold("[Enter]") + chalk2.gray(" Done  ") + chalk2.bold("[s]") + chalk2.gray(" Switch mode")
-  );
-  const answer = (await ask(chalk2.bold("> "))).trim().toLowerCase();
-  if (answer === "s" || answer === "switch") return "switch";
-  return "done";
-}
-async function brainstormModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Starting topic:"), chalk2.white(task));
-  console.log(chalk2.gray('Ask follow-up questions. Type "done" to exit, "switch" to change mode.\n'));
-  let currentQuestion = task;
-  while (true) {
-    console.log(chalk2.bold.blue("\u{1F4A1} Thinking..."));
+    const eventSourceUrl = `${backendUrl}/api/stream/${run_id}`;
     try {
-      const keys = loadApiKeys();
-      const response = await fetch(`${backendUrl}/api/run`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          task: currentQuestion,
-          agent_role: "brainstorm",
-          agent_goal: "Generate ideas, considerations, and suggestions. Be concise and helpful.",
-          api_key: keys.anthropic || "",
-          openai_api_key: keys.openai || "",
-          google_api_key: keys.google || ""
-        })
-      });
-      if (response.ok) {
-        const { run_id } = await response.json();
-        const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-        const reader = streamResponse.body?.getReader();
-        const decoder = new TextDecoder();
-        if (reader) {
-          let buffer = "";
-          let responseText = "";
-          outer: while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split("\n");
-            buffer = lines.pop() || "";
-            for (const line of lines) {
-              if (!line.startsWith("data: ")) continue;
-              try {
-                const parsed = JSON.parse(line.slice(6));
-                const type = parsed.type;
-                const data = parsed.data;
-                if (type === "done" || type === "execution_complete") {
-                  const summary = data["summary"] || "";
-                  if (summary) responseText = summary;
-                  break outer;
-                } else if (type === "error") {
-                  const errorMsg = data["error"] || data["content"] || "Unknown error";
-                  responseText += errorMsg + "\n";
-                  break outer;
-                } else if (type === "thought" || type === "observation") {
-                  const content = data["content"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "agent_response" || type === "agent_result") {
-                  const content = data["content"] || data["result"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "action") {
-                  const content = data["content"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "agent_working") {
-                } else if (type !== "plan") {
-                  const content = data["content"] || data["response"] || "";
-                  if (content) responseText += content + "\n";
-                }
-              } catch {
-              }
-            }
-          }
-          reader.cancel();
-          if (responseText.trim()) {
-            tui.displayBrainstormResponse(responseText.trim());
-          } else {
-            console.log(chalk2.gray("(No response received from agent)"));
-          }
+      const response2 = await fetch(eventSourceUrl);
+      const reader = response2.body?.getReader();
+      if (!reader) {
+        throw new Error("No response body");
+      }
+      for await (const parsed of parseSSEStream(reader)) {
+        const type = parsed.type;
+        const eventContent = parsed.data["content"] || "";
+        if (type === "done") {
+          tui.displayEvent(type, { content: "Task completed successfully" });
+          tui.displayComplete(tui.getElapsedTime());
+          process.exit(0);
+        } else if (type === "error") {
+          tui.displayError(eventContent);
+          process.exit(1);
+        } else {
+          tui.displayEvent(type, { content: eventContent });
         }
-      } else {
-        console.log(chalk2.red("Could not reach backend for brainstorm response."));
       }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(chalk2.red("Error: " + msg));
+    } catch (error) {
+      console.error(
+        "\nStream error. Make sure backend is running:\n   buildwithnexus server"
+      );
+      process.exit(1);
     }
-    const followUp = await ask(chalk2.bold.blue("\u{1F4AC} You: "));
-    const lower = followUp.trim().toLowerCase();
-    if (lower === "done" || lower === "exit") return "done";
-    if (lower === "switch") return "switch";
-    if (!followUp.trim()) continue;
-    currentQuestion = followUp.trim();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error("Error:", message);
+    process.exit(1);
   }
 }
 
-// src/cli.ts
-import { Command as Command15 } from "commander";
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-
-// src/commands/install.ts
-import { Command } from "commander";
-import { execa as execa2 } from "execa";
-
-// src/ui/spinner.ts
-import ora from "ora";
-import chalk3 from "chalk";
-function createSpinner(text) {
-  return ora({ text, color: "cyan", spinner: "dots" });
-}
-function succeed(spinner, text) {
-  spinner.succeed(chalk3.green(text));
-}
-function fail(spinner, text) {
-  spinner.fail(chalk3.red(text));
+// src/cli/dashboard-command.ts
+import { spawn } from "child_process";
+import { fileURLToPath } from "url";
+import path4 from "path";
+var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+async function dashboardCommand(options) {
+  const port = options.port || "4201";
+  console.log(`Starting Nexus Dashboard on http://localhost:${port}
+`);
+  const dashboardPath = path4.join(__dirname, "../deep-agents/dashboard/server.js");
+  const dashboard = spawn("node", [dashboardPath], {
+    env: { ...process.env, PORT: port },
+    stdio: "inherit"
+  });
+  dashboard.on("error", (err) => {
+    console.error("Failed to start dashboard:", err);
+    process.exit(1);
+  });
+  console.log(`Dashboard ready! Open: http://localhost:${port}`);
+  console.log("Press Ctrl+C to stop\n");
 }
 
-// src/ui/logger.ts
-import chalk4 from "chalk";
-var log = {
-  step(msg) {
-    console.log(chalk4.cyan("  \u2192 ") + msg);
-  },
-  success(msg) {
-    console.log(chalk4.green("  \u2713 ") + msg);
-  },
-  error(msg) {
-    console.error(chalk4.red("  \u2717 ") + msg);
-  },
-  warn(msg) {
-    console.log(chalk4.yellow("  \u26A0 ") + msg);
-  },
-  dim(msg) {
-    console.log(chalk4.dim("    " + msg));
-  },
-  detail(label, value) {
-    console.log(chalk4.dim("    " + label + ": ") + value);
-  },
-  progress(current, total, label) {
-    const pct = Math.round(current / total * 100);
-    const filled = Math.round(current / total * 20);
-    const bar = chalk4.cyan("\u2588".repeat(filled)) + chalk4.dim("\u2591".repeat(20 - filled));
-    process.stdout.write(`\r  [${bar}] ${chalk4.bold(`${pct}%`)} ${chalk4.dim(label)}`);
-    if (current >= total) process.stdout.write("\n");
-  }
-};
-
-// src/core/platform.ts
-import os3 from "os";
-function detectPlatform() {
-  const platform = os3.platform();
-  const arch = os3.arch();
-  if (platform === "darwin") {
-    return {
-      os: "mac",
-      arch: arch === "arm64" ? "arm64" : "x64",
-      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
-    };
-  }
-  if (platform === "linux") {
-    return {
-      os: "linux",
-      arch: arch === "arm64" ? "arm64" : "x64",
-      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
-    };
-  }
-  if (platform === "win32") {
-    return {
-      os: "windows",
-      arch: "x64",
-      dockerPlatform: "linux/amd64"
-    };
-  }
-  throw new Error(`Unsupported platform: ${platform} ${arch}`);
-}
+// src/cli/interactive.ts
+import * as readline2 from "readline";
+import chalk3 from "chalk";
 
-// src/core/docker.ts
-import { existsSync } from "fs";
-import { execa } from "execa";
-var CONTAINER_NAME = "nexus";
-var DOCKER_DESKTOP_APP_PATH = "/Applications/Docker.app";
-async function isDockerInstalled() {
-  try {
-    await execa("docker", ["info"]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isDockerInstalledButNotRunning() {
-  try {
-    await execa("docker", ["--version"]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function dockerDesktopExists() {
-  return existsSync(DOCKER_DESKTOP_APP_PATH);
-}
-async function ensureHomebrew() {
-  try {
-    await execa("which", ["brew"]);
-    log.dim("Homebrew is already installed.");
-    return;
-  } catch {
+// src/cli/intent-classifier.ts
+var PLAN_KEYWORDS = [
+  "design",
+  "plan",
+  "architect",
+  "structure",
+  "outline",
+  "roadmap",
+  "strategy",
+  "organize",
+  "breakdown",
+  "scope",
+  "model",
+  "schema"
+];
+var BUILD_KEYWORDS = [
+  "build",
+  "create",
+  "make",
+  "write",
+  "implement",
+  "code",
+  "generate",
+  "add",
+  "fix",
+  "update",
+  "deploy",
+  "run",
+  "start",
+  "launch",
+  "install",
+  "set up",
+  "setup",
+  "refactor",
+  "migrate"
+];
+var BRAINSTORM_KEYWORDS = [
+  "what",
+  "should",
+  "idea",
+  "ideas",
+  "think",
+  "consider",
+  "suggest",
+  "brainstorm",
+  "explore",
+  "wonder",
+  "might",
+  "could",
+  "would",
+  "how about",
+  "what if",
+  "options",
+  "alternatives",
+  "thoughts"
+];
+function classifyIntent(task) {
+  const lower = task.toLowerCase().trim();
+  let planScore = 0;
+  let buildScore = 0;
+  let brainstormScore = 0;
+  for (const kw of PLAN_KEYWORDS) {
+    if (lower.includes(kw)) planScore++;
   }
-  log.step("Installing Homebrew...");
-  try {
-    await execa("/bin/bash", [
-      "-c",
-      "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-    ], {
-      stdio: "inherit",
-      env: { ...process.env, NONINTERACTIVE: "1" }
-    });
-  } catch {
-    throw new Error(
-      'Failed to install Homebrew automatically.\n\n  Install Homebrew manually:\n    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"\n\n  Then re-run:\n    buildwithnexus init'
-    );
+  for (const kw of BUILD_KEYWORDS) {
+    if (lower.includes(kw)) buildScore++;
   }
-  try {
-    await execa("which", ["brew"]);
-  } catch {
-    const armPath = "/opt/homebrew/bin";
-    const intelPath = "/usr/local/bin";
-    process.env.PATH = `${armPath}:${intelPath}:${process.env.PATH}`;
-    log.dim("Added Homebrew paths to PATH for this session.");
+  for (const kw of BRAINSTORM_KEYWORDS) {
+    if (lower.includes(kw)) brainstormScore++;
   }
-  try {
-    await execa("brew", ["--version"]);
-    log.success("Homebrew installed successfully.");
-  } catch {
-    throw new Error(
-      "Homebrew was installed but is not available on PATH.\n\n  Try opening a new terminal and re-running:\n    buildwithnexus init"
-    );
+  const wordCount = lower.split(/\s+/).length;
+  if (wordCount > 12 && planScore === buildScore && buildScore === brainstormScore) {
+    return "plan";
   }
+  if (brainstormScore > planScore && brainstormScore > buildScore) return "brainstorm";
+  if (buildScore > planScore && buildScore > brainstormScore) return "build";
+  if (planScore > 0) return "plan";
+  return wordCount > 6 ? "plan" : "build";
 }
-async function installDocker(platform) {
-  const p = platform ?? detectPlatform();
-  switch (p.os) {
-    case "mac": {
-      if (await isDockerInstalled()) {
-        log.success("Docker is already running.");
-        return;
-      }
-      if (dockerDesktopExists()) {
-        log.step(`Docker Desktop found at ${DOCKER_DESKTOP_APP_PATH} but not running. Attempting to start...`);
-        let launched = false;
-        log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
-        try {
-          await execa("open", [DOCKER_DESKTOP_APP_PATH]);
-          launched = true;
-          log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
-        } catch {
-          log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
-        }
-        if (!launched) {
-          log.dim("Trying: open -a Docker");
-          try {
-            await execa("open", ["-a", "Docker"]);
-            launched = true;
-            log.dim("Launch command succeeded via open -a Docker");
-          } catch {
-            log.warn("Both launch attempts failed.");
-          }
-        }
-        if (launched) {
-          log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
-          try {
-            await waitForDockerDaemon(12e4);
-            return;
-          } catch {
-            log.warn("Docker Desktop was launched but the daemon did not become ready in time.");
-          }
-        } else {
-          log.warn("Could not launch Docker Desktop. Will fall back to reinstalling via Homebrew.");
-        }
-      } else {
-        log.step(`Docker Desktop not found at ${DOCKER_DESKTOP_APP_PATH}.`);
-      }
-      log.step("Installing Docker Desktop via Homebrew...");
-      await ensureHomebrew();
-      try {
-        await execa("brew", ["install", "--cask", "docker"], {
-          stdio: "inherit",
-          timeout: 6e4
-        });
-      } catch (err) {
-        const e = err;
-        if (e.killed && e.signal === "SIGINT") {
-          throw new Error("Docker installation cancelled by user (Ctrl+C)");
-        }
-        if (e.timedOut) {
-          throw new Error(
-            "Docker installation via Homebrew timed out after 60 seconds.\n\n  The password prompt may be waiting for input. Try installing manually:\n    brew install --cask docker\n\n  After installing, re-run:\n    buildwithnexus init"
-          );
-        }
-        throw new Error(
-          "Failed to install Docker via Homebrew.\n\n  Try installing Docker Desktop manually:\n    https://www.docker.com/products/docker-desktop\n\n  After installing, re-run:\n    buildwithnexus init"
-        );
-      }
-      log.step("Launching Docker Desktop...");
-      let postInstallLaunched = false;
-      log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
-      try {
-        await execa("open", [DOCKER_DESKTOP_APP_PATH]);
-        postInstallLaunched = true;
-        log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
-      } catch {
-        log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
-      }
-      if (!postInstallLaunched) {
-        log.dim("Trying: open -a Docker");
-        try {
-          await execa("open", ["-a", "Docker"]);
-          postInstallLaunched = true;
-          log.dim("Launch command succeeded via open -a Docker");
-        } catch {
-          log.warn("Both launch attempts failed after install.");
-        }
-      }
-      if (!postInstallLaunched) {
-        throw new Error(
-          "Docker Desktop was installed but could not be started automatically.\n\n  Next steps:\n    1. Open Docker Desktop manually from your Applications folder\n    2. Wait for the whale icon to appear in the menu bar\n    3. Re-run: buildwithnexus init"
-        );
-      }
-      log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
-      await waitForDockerDaemon(12e4);
-      break;
-    }
-    case "linux": {
-      const linuxBinaryExists = await isDockerInstalledButNotRunning();
-      if (linuxBinaryExists) {
-        log.step("Docker is installed but the daemon is not running.");
-        log.step("Starting Docker daemon...");
-        try {
-          await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
-          log.dim("Started Docker daemon via systemctl.");
-        } catch {
-          try {
-            await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
-            log.dim("Started Docker daemon via service command.");
-          } catch {
-            throw new Error(
-              "Docker is installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
-            );
-          }
-        }
-        log.step("Waiting for Docker...");
-        await waitForDockerDaemon(3e4);
-        return;
-      }
-      log.step("Installing Docker...");
-      log.warn("This may require your sudo password.");
-      log.dim("Running official Docker install script from https://get.docker.com ...");
-      try {
-        const { stdout: script } = await execa("curl", ["-fsSL", "https://get.docker.com"]);
-        await execa("sudo", ["sh", "-c", script], { stdio: "inherit" });
-        log.success("Docker installed successfully.");
-      } catch {
-        throw new Error(
-          "Failed to install Docker on Linux.\n\n  Try installing manually:\n    curl -fsSL https://get.docker.com | sudo sh\n\n  After installing, re-run:\n    buildwithnexus init"
-        );
-      }
-      log.dim("Adding current user to docker group...");
-      try {
-        const user = (await execa("whoami")).stdout.trim();
-        await execa("sudo", ["usermod", "-aG", "docker", user]);
-        log.dim(`Added user '${user}' to docker group (may require re-login for effect).`);
-      } catch {
-        log.warn("Could not add user to docker group. You may need sudo for docker commands.");
-      }
-      log.step("Starting Docker daemon...");
+
+// src/cli/interactive.ts
+init_secrets();
+
+// src/core/sse-parser.ts
+async function* parseSSEStream2(reader) {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+    for (const line of lines) {
+      if (!line.startsWith("data: ")) continue;
       try {
-        await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
-        log.dim("Started Docker daemon via systemctl.");
-      } catch {
-        try {
-          await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
-          log.dim("Started Docker daemon via service command.");
-        } catch {
-          throw new Error(
-            "Docker was installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
-          );
-        }
+        const parsed = JSON.parse(line.slice(6));
+        yield parsed;
+      } catch (e) {
+        if (process.env.LOG_LEVEL === "debug") console.error("SSE parse error:", e);
       }
-      log.step("Waiting for Docker...");
-      await waitForDockerDaemon(3e4);
-      break;
     }
-    case "windows": {
-      const winBinaryExists = await isDockerInstalledButNotRunning();
-      if (winBinaryExists) {
-        log.step("Docker Desktop is installed but not running. Attempting to start...");
-        log.step("Launching Docker...");
-        try {
-          await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
-          log.dim("Docker Desktop launch command sent.");
-        } catch {
-          log.warn("Could not launch Docker Desktop automatically. It may need to be started manually.");
-        }
-        log.step("Waiting for Docker...");
-        try {
-          await waitForDockerDaemon(12e4);
-        } catch {
-          throw new Error(
-            "Docker Desktop did not start within 120 seconds.\n\n  Next steps:\n    1. Open Docker Desktop manually from the Start Menu\n    2. Wait for the whale icon to appear in the system tray\n    3. Re-run: buildwithnexus init"
-          );
-        }
-        return;
-      }
-      log.step("Installing Docker Desktop...");
-      let installed = false;
-      try {
-        await execa("choco", ["--version"]);
-        log.dim("Chocolatey detected. Installing Docker Desktop via choco...");
-        try {
-          await execa("choco", ["install", "docker-desktop", "-y"], { stdio: "inherit" });
-          installed = true;
-          log.success("Docker Desktop installed via Chocolatey.");
-        } catch {
-          log.warn("Chocolatey install failed. Falling back to direct download...");
-        }
-      } catch {
-        log.dim("Chocolatey not found. Using direct download...");
-      }
-      if (!installed) {
-        log.dim("Downloading Docker Desktop installer from docker.com...");
-        try {
-          await execa("powershell", [
-            "-Command",
-            "Invoke-WebRequest -Uri 'https://desktop.docker.com/win/main/amd64/Docker Desktop Installer.exe' -OutFile '$env:TEMP\\DockerInstaller.exe'; & '$env:TEMP\\DockerInstaller.exe' Install --quiet; Remove-Item '$env:TEMP\\DockerInstaller.exe' -Force -ErrorAction SilentlyContinue"
-          ], { stdio: "inherit" });
-          installed = true;
-          log.success("Docker Desktop installed via direct download.");
-        } catch {
-          throw new Error(
-            "Failed to install Docker Desktop on Windows.\n\n  Please install Docker Desktop manually:\n    1. Download from https://www.docker.com/products/docker-desktop\n    2. Run the installer and follow the prompts\n    3. Start Docker Desktop\n    4. Re-run: buildwithnexus init"
-          );
-        }
+  }
+}
+
+// src/cli/interactive.ts
+init_docker();
+var appVersion = true ? "0.7.2" : pkg.version;
+async function interactiveMode() {
+  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
+  const urlCheck = validateBackendUrl(backendUrl);
+  if (!urlCheck.valid) {
+    console.error(chalk3.red(`
+${urlCheck.error}`));
+    process.exit(1);
+  }
+  if (!hasAnyKey()) {
+    try {
+      const storedKeys = loadKeys();
+      if (storedKeys) {
+        if (storedKeys.ANTHROPIC_API_KEY) process.env.ANTHROPIC_API_KEY = storedKeys.ANTHROPIC_API_KEY;
+        if (storedKeys.OPENAI_API_KEY) process.env.OPENAI_API_KEY = storedKeys.OPENAI_API_KEY;
+        if (storedKeys.GOOGLE_API_KEY) process.env.GOOGLE_API_KEY = storedKeys.GOOGLE_API_KEY;
       }
-      log.step("Launching Docker...");
+    } catch {
+    }
+  }
+  if (!hasAnyKey()) {
+    console.log(chalk3.cyan("\n\u{1F527} Configure API Keys\n"));
+    const { deepAgentsInitCommand: deepAgentsInitCommand2 } = await Promise.resolve().then(() => (init_init_command(), init_command_exports));
+    await deepAgentsInitCommand2();
+    if (!hasAnyKey()) {
+      console.error("Error: At least one API key is required to use buildwithnexus.");
+      process.exit(1);
+    }
+  }
+  const keys = loadApiKeys();
+  console.log(chalk3.green("\n\u2713 Keys configured!"));
+  console.log(chalk3.gray(`  Anthropic: ${keys.anthropic ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  OpenAI: ${keys.openai ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  Google: ${keys.google ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  (Run 'da-init' to reconfigure)
+`));
+  async function waitForBackend() {
+    for (let i = 0; i < 5; i++) {
+      await new Promise((resolve) => setTimeout(resolve, 2e3));
       try {
-        await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
-        log.dim("Docker Desktop launch command sent.");
+        const retryResponse = await fetch(`${backendUrl}/health`, { signal: AbortSignal.timeout(1e4) });
+        if (retryResponse.ok) return true;
       } catch {
-        log.warn("Could not launch Docker Desktop automatically after install.");
       }
-      log.step("Waiting for Docker...");
-      try {
-        await waitForDockerDaemon(12e4);
-      } catch {
-        throw new Error(
-          "Docker Desktop was installed but did not start within 120 seconds.\n\n  Next steps:\n    1. You may need to restart your computer for Docker to work\n    2. Open Docker Desktop from the Start Menu\n    3. Wait for the whale icon to appear in the system tray\n    4. Re-run: buildwithnexus init"
-        );
+    }
+    return false;
+  }
+  try {
+    const response = await fetch(`${backendUrl}/health`, { signal: AbortSignal.timeout(1e4) });
+    if (!response.ok) {
+      console.log(chalk3.yellow("\u26A0\uFE0F  Backend not responding, starting..."));
+      await startBackend();
+      const ready = await waitForBackend();
+      if (!ready) {
+        console.error(chalk3.red("\u274C Backend failed to start. Run: buildwithnexus server"));
+        process.exit(1);
       }
-      break;
     }
-    default:
-      throw new Error(`Unsupported platform: ${p.os}`);
+  } catch {
+    console.log(chalk3.yellow("\u26A0\uFE0F  Backend not accessible, attempting to start..."));
+    await startBackend();
+    const ready = await waitForBackend();
+    if (!ready) {
+      console.error(chalk3.red("\u274C Backend failed to start. Run: buildwithnexus server"));
+      process.exit(1);
+    }
+  }
+  const rl = readline2.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+  console.clear();
+  console.log(chalk3.gray("Welcome! Describe what you want the AI agents to do."));
+  console.log(chalk3.gray('Type "exit" to quit.\n'));
+  while (true) {
+    const task = await ask(chalk3.bold.blue("\u{1F4DD} Task: "));
+    if (task.toLowerCase() === "exit") {
+      console.log(chalk3.yellow("\nGoodbye! \u{1F44B}\n"));
+      rl.close();
+      process.exit(0);
+    }
+    if (!task.trim()) {
+      console.log(chalk3.red("Please enter a task.\n"));
+      continue;
+    }
+    const suggestedMode = classifyIntent(task).toUpperCase();
+    tui.displaySuggestedMode(suggestedMode, task);
+    const currentMode = await selectMode(suggestedMode, ask);
+    await runModeLoop(currentMode, task, backendUrl, ask);
+    console.log("");
   }
 }
-async function waitForDockerDaemon(timeoutMs) {
-  const start = Date.now();
-  log.step("Waiting for Docker daemon...");
-  while (Date.now() - start < timeoutMs) {
-    try {
-      await execa("docker", ["info"]);
-      log.success("Docker daemon is ready");
+async function selectMode(suggested, ask) {
+  const modeColor = {
+    PLAN: chalk3.cyan,
+    BUILD: chalk3.green,
+    BRAINSTORM: chalk3.blue
+  };
+  console.log("");
+  console.log(
+    chalk3.gray("Press ") + chalk3.bold("Enter") + chalk3.gray(" to use ") + modeColor[suggested](suggested) + chalk3.gray(" or choose a mode:")
+  );
+  console.log(
+    chalk3.gray("  ") + chalk3.cyan.bold("[1] PLAN") + chalk3.gray(" (p)   design & break down steps") + chalk3.gray("\n  ") + chalk3.green.bold("[2] BUILD") + chalk3.gray(" (b)  execute with live streaming") + chalk3.gray("\n  ") + chalk3.blue.bold("[3] BRAINSTORM") + chalk3.gray(" (bs)  free-form explore & Q&A")
+  );
+  const answer = await ask(chalk3.gray("> "));
+  const lower = answer.trim().toLowerCase();
+  if (lower === "1" || lower === "p" || lower === "plan") return "PLAN";
+  if (lower === "2" || lower === "b" || lower === "build") return "BUILD";
+  if (lower === "3" || lower === "bs" || lower === "br" || lower === "brainstorm") return "BRAINSTORM";
+  return suggested;
+}
+async function runModeLoop(mode, task, backendUrl, ask) {
+  let currentMode = mode;
+  while (true) {
+    console.clear();
+    printAppHeader();
+    tui.displayModeBar(currentMode);
+    tui.displayModeHeader(currentMode);
+    if (currentMode === "PLAN") {
+      const next = await planModeLoop(task, backendUrl, ask);
+      if (next === "BUILD") {
+        currentMode = "BUILD";
+        continue;
+      }
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
+      return;
+    }
+    if (currentMode === "BUILD") {
+      const next = await buildModeLoop(task, backendUrl, ask);
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
+      return;
+    }
+    if (currentMode === "BRAINSTORM") {
+      const next = await brainstormModeLoop(task, backendUrl, ask);
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
       return;
-    } catch {
     }
-    await new Promise((r) => setTimeout(r, 3e3));
   }
-  throw new Error(
-    `Docker daemon did not become ready within ${Math.round(timeoutMs / 1e3)}s.
-
-  Please ensure Docker is running, then re-run:
-    buildwithnexus init`
+}
+function printAppHeader() {
+  console.log(chalk3.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  console.log(
+    chalk3.cyan("\u2551") + chalk3.bold.white("        Nexus - Autonomous Agent Orchestration                ") + chalk3.cyan("\u2551")
+  );
+  const versionLine = `        v${appVersion}`;
+  console.log(
+    chalk3.cyan("\u2551") + chalk3.dim(versionLine.padEnd(60)) + chalk3.cyan("\u2551")
   );
+  console.log(chalk3.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  console.log("");
 }
-async function imageExistsLocally(image, tag) {
-  const ref = `${image}:${tag}`;
-  try {
-    await execa("docker", ["image", "inspect", ref]);
-    return true;
-  } catch {
-    return false;
-  }
+async function promptModeSwitch(current, ask) {
+  const others = ["PLAN", "BUILD", "BRAINSTORM"].filter((m) => m !== current);
+  console.log("");
+  console.log(
+    chalk3.gray("Switch to: ") + others.map((m, i) => chalk3.bold(`[${i + 1}] ${m}`)).join(chalk3.gray("  ")) + chalk3.gray("  [Enter to stay in ") + chalk3.bold(current) + chalk3.gray("]")
+  );
+  const answer = await ask(chalk3.gray("> "));
+  const n = parseInt(answer.trim(), 10);
+  if (n === 1) return others[0];
+  if (n === 2) return others[1];
+  return current;
 }
-async function pullImage(image, tag) {
-  const ref = `${image}:${tag}`;
-  log.step(`Pulling image ${ref}...`);
+async function planModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Task:"), chalk3.white(task));
+  console.log("");
+  console.log(chalk3.yellow("\u23F3 Fetching plan from backend..."));
+  let steps = [];
+  const keys = loadApiKeys();
   try {
-    await execa("docker", ["pull", ref], { stdio: "inherit" });
-    log.success(`Image ${ref} pulled`);
+    const response = await fetch(`${backendUrl}/api/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (!response.ok) {
+      console.error(chalk3.red("Backend error \u2014 cannot fetch plan."));
+      return "cancel";
+    }
+    const { run_id } = await response.json();
+    tui.displayConnected(run_id);
+    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+    const reader = streamResponse.body?.getReader();
+    if (!reader) throw new Error("No response body");
+    let planReceived = false;
+    for await (const parsed of parseSSEStream2(reader)) {
+      if (parsed.type === "plan") {
+        steps = parsed.data["steps"] || [];
+        planReceived = true;
+        reader.cancel();
+        break;
+      } else if (parsed.type === "error") {
+        const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
+        tui.displayError(errorMsg);
+        reader.cancel();
+        return "cancel";
+      }
+    }
+    if (!planReceived || steps.length === 0) {
+      console.log(chalk3.yellow("No plan received from backend."));
+      steps = ["(no steps returned \u2014 execute anyway?)"];
+    }
   } catch (err) {
-    log.error(`Failed to pull image ${ref}`);
-    throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(chalk3.red("Error: " + msg));
+    return "cancel";
+  }
+  displayPlanSteps(steps);
+  while (true) {
+    console.log(chalk3.gray("Options: ") + chalk3.bold("[Y]") + chalk3.gray(" Execute  ") + chalk3.bold("[e]") + chalk3.gray(" Edit step  ") + chalk3.bold("[s]") + chalk3.gray(" Switch mode  ") + chalk3.bold("[Esc/n]") + chalk3.gray(" Cancel"));
+    const answer = (await ask(tui.displayPermissionPrompt("Execute this plan?"))).trim().toLowerCase();
+    if (answer === "" || answer === "y") {
+      return "BUILD";
+    }
+    if (answer === "n" || answer === "\x1B") {
+      console.log(chalk3.yellow("\nExecution cancelled.\n"));
+      return "cancel";
+    }
+    if (answer === "e" || answer === "edit") {
+      steps = await editPlanSteps(steps, ask);
+      displayPlanSteps(steps);
+      continue;
+    }
+    if (answer === "s" || answer === "switch") {
+      return "switch";
+    }
   }
 }
-async function startNexus(keys, config) {
-  log.step("Starting NEXUS container...");
+function displayPlanSteps(steps) {
+  console.log("");
+  console.log(chalk3.bold.cyan("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  console.log(chalk3.bold.cyan("\u2502") + chalk3.bold.white("  \u{1F4CB} Execution Plan                                      ") + chalk3.bold.cyan("\u2502"));
+  console.log(chalk3.bold.cyan("\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  steps.forEach((step, i) => {
+    const label = `  Step ${i + 1}: `;
+    const maxContentWidth = 57 - label.length;
+    const truncated = step.length > maxContentWidth ? step.substring(0, maxContentWidth - 3) + "..." : step;
+    const line = label + truncated;
+    const padded = line.padEnd(57);
+    console.log(chalk3.bold.cyan("\u2502") + chalk3.white(padded) + chalk3.bold.cyan("\u2502"));
+  });
+  console.log(chalk3.bold.cyan("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  console.log("");
+}
+async function editPlanSteps(steps, ask) {
+  console.log(chalk3.gray("Enter step number to edit, or press Enter to finish editing:"));
+  const numStr = await ask(chalk3.bold("Step #: "));
+  const n = parseInt(numStr.trim(), 10);
+  if (!isNaN(n) && n >= 1 && n <= steps.length) {
+    console.log(chalk3.gray(`Current: ${steps[n - 1]}`));
+    const updated = await ask(chalk3.bold("New text: "));
+    if (updated.trim()) steps[n - 1] = updated.trim();
+  }
+  return steps;
+}
+async function buildModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Task:"), chalk3.white(task));
+  tui.displayConnecting();
+  const keys = loadApiKeys();
   try {
-    await execa("docker", [
-      "run",
-      "-d",
-      "--name",
-      CONTAINER_NAME,
-      "-e",
-      `ANTHROPIC_API_KEY=${keys.anthropic}`,
-      "-e",
-      `OPENAI_API_KEY=${keys.openai}`,
-      "-p",
-      `${config.port}:${config.port}`,
-      "buildwithnexus/nexus:latest"
-    ]);
-    log.success(`NEXUS container started on port ${config.port}`);
+    const response = await fetch(`${backendUrl}/api/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (!response.ok) {
+      console.error(chalk3.red("Backend error"));
+      return "done";
+    }
+    const { run_id } = await response.json();
+    tui.displayConnected(run_id);
+    console.log(chalk3.bold.green("\u2699\uFE0F  Executing..."));
+    tui.displayStreamStart();
+    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+    const reader = streamResponse.body?.getReader();
+    if (!reader) throw new Error("No response body");
+    for await (const parsed of parseSSEStream2(reader)) {
+      const type = parsed.type;
+      if (type === "execution_complete") {
+        const summary = parsed.data["summary"] || "";
+        const count = parsed.data["todos_completed"] || 0;
+        tui.displayResults(summary, count);
+        tui.displayComplete(tui.getElapsedTime());
+        break;
+      } else if (type === "done") {
+        tui.displayEvent(type, { content: "Task completed successfully" });
+        tui.displayComplete(tui.getElapsedTime());
+        break;
+      } else if (type === "error") {
+        const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
+        tui.displayError(errorMsg);
+        break;
+      } else if (type !== "plan") {
+        tui.displayEvent(type, parsed.data);
+      }
+    }
   } catch (err) {
-    log.error("Failed to start NEXUS container");
-    throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(chalk3.red("Error: " + msg));
+  }
+  console.log("");
+  console.log(
+    chalk3.gray("Options: ") + chalk3.bold("[Enter]") + chalk3.gray(" Done  ") + chalk3.bold("[s]") + chalk3.gray(" Switch mode")
+  );
+  const answer = (await ask(chalk3.bold("> "))).trim().toLowerCase();
+  if (answer === "s" || answer === "switch") return "switch";
+  return "done";
+}
+async function brainstormModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Starting topic:"), chalk3.white(task));
+  console.log(chalk3.gray('Ask follow-up questions. Type "done" to exit, "switch" to change mode.\n'));
+  let currentQuestion = task;
+  while (true) {
+    console.log(chalk3.bold.blue("\u{1F4A1} Thinking..."));
+    try {
+      const keys = loadApiKeys();
+      const response = await fetch(`${backendUrl}/api/run`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          task: currentQuestion,
+          agent_role: "brainstorm",
+          agent_goal: "Generate ideas, considerations, and suggestions. Be concise and helpful.",
+          api_key: keys.anthropic || "",
+          openai_api_key: keys.openai || "",
+          google_api_key: keys.google || ""
+        }),
+        signal: AbortSignal.timeout(12e4)
+      });
+      if (response.ok) {
+        const { run_id } = await response.json();
+        const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+        const reader = streamResponse.body?.getReader();
+        if (reader) {
+          let responseText = "";
+          for await (const parsed of parseSSEStream2(reader)) {
+            const type = parsed.type;
+            const data = parsed.data;
+            if (type === "done" || type === "execution_complete") {
+              const summary = data["summary"] || "";
+              if (summary) responseText = summary;
+              break;
+            } else if (type === "error") {
+              const errorMsg = data["error"] || data["content"] || "Unknown error";
+              responseText += errorMsg + "\n";
+              break;
+            } else if (type === "thought" || type === "observation") {
+              const content = data["content"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "agent_response" || type === "agent_result") {
+              const content = data["content"] || data["result"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "action") {
+              const content = data["content"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "agent_working") {
+            } else if (type !== "plan") {
+              const content = data["content"] || data["response"] || "";
+              if (content) responseText += content + "\n";
+            }
+          }
+          if (responseText.trim()) {
+            tui.displayBrainstormResponse(responseText.trim());
+          } else {
+            console.log(chalk3.gray("(No response received from agent)"));
+          }
+        }
+      } else {
+        console.log(chalk3.red("Could not reach backend for brainstorm response."));
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(chalk3.red("Error: " + msg));
+    }
+    const followUp = await ask(chalk3.bold.blue("\u{1F4AC} You: "));
+    const lower = followUp.trim().toLowerCase();
+    if (lower === "done" || lower === "exit") return "done";
+    if (lower === "switch") return "switch";
+    if (!followUp.trim()) continue;
+    currentQuestion = followUp.trim();
   }
 }
-async function stopNexus() {
-  log.step("Stopping NEXUS container...");
-  try {
-    await execa("docker", ["rm", "-f", CONTAINER_NAME]);
-    log.success("NEXUS container stopped and removed");
-  } catch (err) {
-    log.error("Failed to stop NEXUS container");
-    throw err;
-  }
+
+// src/commands/install.ts
+import { Command } from "commander";
+import { execa as execa2 } from "execa";
+
+// src/ui/spinner.ts
+import ora from "ora";
+import chalk4 from "chalk";
+function createSpinner(text) {
+  return ora({ text, color: "cyan", spinner: "dots" });
 }
-async function dockerExec(command) {
-  try {
-    const { stdout, stderr } = await execa("docker", ["exec", CONTAINER_NAME, "sh", "-c", command]);
-    return { stdout, stderr, code: 0 };
-  } catch (err) {
-    const e = err;
-    return { stdout: e.stdout ?? "", stderr: e.stderr ?? "", code: e.exitCode ?? 1 };
-  }
+function succeed(spinner, text) {
+  spinner.succeed(chalk4.green(text));
 }
-async function isNexusRunning() {
-  try {
-    const { stdout } = await execa("docker", [
-      "ps",
-      "--filter",
-      `name=^/${CONTAINER_NAME}$`,
-      "--format",
-      "{{.Names}}"
-    ]);
-    return stdout.trim() === CONTAINER_NAME;
-  } catch {
-    return false;
-  }
+function fail(spinner, text) {
+  spinner.fail(chalk4.red(text));
 }
 
 // src/commands/install.ts
+init_logger();
+init_platform();
+init_docker();
 var installCommand = new Command("install").description("Install Docker and configure system prerequisites").action(async () => {
   const spinner = createSpinner("");
   log.step("Checking Docker installation...");
@@ -1568,152 +1902,12 @@ var installCommand = new Command("install").description("Install Docker and conf
 init_banner();
 import { Command as Command2 } from "commander";
 import chalk7 from "chalk";
+init_logger();
 
 // src/ui/prompts.ts
+init_dlp();
 import { confirm, password } from "@inquirer/prompts";
 import chalk6 from "chalk";
-
-// src/core/dlp.ts
-import crypto from "crypto";
-import fs2 from "fs";
-import path4 from "path";
-var NEXUS_HOME = path4.join(process.env.HOME || "~", ".buildwithnexus");
-var SECRET_PATTERNS = [
-  /sk-ant-api03-[A-Za-z0-9_-]{20,}/g,
-  // Anthropic API key
-  /sk-[A-Za-z0-9]{20,}/g,
-  // OpenAI API key
-  /AIza[A-Za-z0-9_-]{35}/g
-  // Google AI API key
-];
-var FORBIDDEN_KEY_CHARS = /[\n\r\t'"\\`${}();&|<>!#%^]/;
-var KEY_VALIDATORS = {
-  ANTHROPIC_API_KEY: /^sk-ant-[A-Za-z0-9_-]{20,}$/,
-  OPENAI_API_KEY: /^sk-[A-Za-z0-9_-]{20,}$/,
-  GOOGLE_API_KEY: /^AIza[A-Za-z0-9_-]{35,}$/,
-  NEXUS_MASTER_SECRET: /^[A-Za-z0-9_-]{20,64}$/
-};
-function shellEscape(value) {
-  if (value.includes("\0")) {
-    throw new DlpViolation("Null byte in shell argument");
-  }
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-function shellCommand(strings, ...values) {
-  let result = strings[0];
-  for (let i = 0; i < values.length; i++) {
-    result += shellEscape(values[i]) + strings[i + 1];
-  }
-  return result;
-}
-function redact(text) {
-  let result = text;
-  for (const pattern of SECRET_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, "[REDACTED]");
-  }
-  return result;
-}
-function redactError(err) {
-  if (err instanceof Error) {
-    const safe = new Error(redact(err.message));
-    safe.name = err.name;
-    if (err.stack) safe.stack = redact(err.stack);
-    return safe;
-  }
-  return new Error(redact(String(err)));
-}
-var DlpViolation = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DlpViolation";
-  }
-};
-function validateKeyValue(keyName, value) {
-  if (FORBIDDEN_KEY_CHARS.test(value)) {
-    throw new DlpViolation(
-      `${keyName} contains characters that are not permitted in API keys`
-    );
-  }
-  if (value.length < 10 || value.length > 256) {
-    throw new DlpViolation(
-      `${keyName} length out of expected range (10-256 characters)`
-    );
-  }
-  const validator = KEY_VALIDATORS[keyName];
-  if (validator && !validator.test(value)) {
-    throw new DlpViolation(
-      `${keyName} does not match the expected format for this key type`
-    );
-  }
-}
-function validateAllKeys(keys) {
-  const violations = [];
-  for (const [name, value] of Object.entries(keys)) {
-    if (!value) continue;
-    try {
-      validateKeyValue(name, value);
-    } catch (err) {
-      if (err instanceof DlpViolation) violations.push(err.message);
-    }
-  }
-  return violations;
-}
-var HMAC_PATH = path4.join(NEXUS_HOME, ".keys.hmac");
-function computeFileHmac(filePath, secret) {
-  const content = fs2.readFileSync(filePath);
-  return crypto.createHmac("sha256", secret).update(content).digest("hex");
-}
-function sealKeysFile(keysPath, masterSecret) {
-  const hmac = computeFileHmac(keysPath, masterSecret);
-  fs2.writeFileSync(HMAC_PATH, hmac, { mode: 384 });
-}
-function verifyKeysFile(keysPath, masterSecret) {
-  const keysExist = fs2.existsSync(keysPath);
-  const hmacExist = fs2.existsSync(HMAC_PATH);
-  if (!keysExist && !hmacExist) return true;
-  if (keysExist && !hmacExist) return false;
-  try {
-    const stored = fs2.readFileSync(HMAC_PATH, "utf-8").trim();
-    const computed = computeFileHmac(keysPath, masterSecret);
-    return crypto.timingSafeEqual(
-      Buffer.from(stored, "hex"),
-      Buffer.from(computed, "hex")
-    );
-  } catch {
-    return false;
-  }
-}
-var AUDIT_PATH = path4.join(NEXUS_HOME, "audit.log");
-var MAX_AUDIT_SIZE = 10 * 1024 * 1024;
-function audit(event, detail = "") {
-  try {
-    const dir = path4.dirname(AUDIT_PATH);
-    if (!fs2.existsSync(dir)) return;
-    if (fs2.existsSync(AUDIT_PATH)) {
-      const stat = fs2.statSync(AUDIT_PATH);
-      if (stat.size > MAX_AUDIT_SIZE) {
-        const rotated = AUDIT_PATH + ".1";
-        if (fs2.existsSync(rotated)) fs2.unlinkSync(rotated);
-        fs2.renameSync(AUDIT_PATH, rotated);
-        try {
-          fs2.chmodSync(rotated, 384);
-        } catch {
-        }
-      }
-    }
-    const line = `${(/* @__PURE__ */ new Date()).toISOString()} | ${event} | ${redact(detail)}
-`;
-    fs2.appendFileSync(AUDIT_PATH, line, { mode: 384 });
-    try {
-      fs2.chmodSync(AUDIT_PATH, 384);
-    } catch {
-    }
-  } catch {
-  }
-}
-
-// src/ui/prompts.ts
 async function promptInitConfig() {
   console.log(chalk6.bold("\n  API Keys\n"));
   const anthropicKey = await password({
@@ -1768,66 +1962,14 @@ async function promptInitConfig() {
   };
 }
 
-// src/core/secrets.ts
-import fs3 from "fs";
-import path5 from "path";
-import crypto2 from "crypto";
-var NEXUS_HOME2 = process.env.NEXUS_HOME || path5.join(process.env.HOME || "~", ".buildwithnexus");
-var CONFIG_PATH = process.env.NEXUS_CONFIG_PATH || path5.join(NEXUS_HOME2, "config.json");
-var KEYS_PATH = process.env.NEXUS_KEYS_PATH || path5.join(NEXUS_HOME2, ".env.keys");
-function ensureHome() {
-  fs3.mkdirSync(NEXUS_HOME2, { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "images"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "configs"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "logs"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "ssh"), { recursive: true, mode: 448 });
-}
-function generateMasterSecret() {
-  return crypto2.randomBytes(32).toString("base64url");
-}
-function saveConfig(config) {
-  const { masterSecret: _secret, ...safeConfig } = config;
-  fs3.writeFileSync(CONFIG_PATH, JSON.stringify(safeConfig, null, 2), { mode: 384 });
-}
-function loadConfig() {
-  if (!fs3.existsSync(CONFIG_PATH)) return null;
-  return JSON.parse(fs3.readFileSync(CONFIG_PATH, "utf-8"));
-}
-function saveKeys(keys) {
-  const violations = validateAllKeys(keys);
-  if (violations.length > 0) {
-    throw new DlpViolation(`Key validation failed: ${violations.join("; ")}`);
-  }
-  const lines = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`);
-  fs3.writeFileSync(KEYS_PATH, lines.join("\n") + "\n", { mode: 384 });
-  sealKeysFile(KEYS_PATH, keys.NEXUS_MASTER_SECRET);
-  audit("keys_saved", `${Object.keys(keys).filter((k) => keys[k]).length} keys saved`);
-}
-function loadKeys() {
-  if (!fs3.existsSync(KEYS_PATH)) return null;
-  const content = fs3.readFileSync(KEYS_PATH, "utf-8");
-  const keys = {};
-  for (const line of content.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq > 0) keys[line.slice(0, eq)] = line.slice(eq + 1);
-  }
-  const result = keys;
-  if (result.NEXUS_MASTER_SECRET && !verifyKeysFile(KEYS_PATH, result.NEXUS_MASTER_SECRET)) {
-    audit("keys_tampered", "HMAC mismatch on .env.keys");
-    throw new DlpViolation(
-      ".env.keys has been modified outside of buildwithnexus. Run 'buildwithnexus keys set' to re-enter your keys, or 'buildwithnexus destroy' to start fresh."
-    );
-  }
-  audit("keys_loaded", `${Object.keys(keys).length} keys loaded`);
-  return result;
-}
-function maskKey(key) {
-  if (key.length <= 8) return "***";
-  const reveal = Math.min(4, Math.floor(key.length * 0.1));
-  return key.slice(0, reveal) + "..." + key.slice(-reveal);
-}
+// src/commands/init.ts
+init_platform();
+init_secrets();
+init_docker();
 
 // src/core/tunnel.ts
+init_docker();
+init_dlp();
 var CLOUDFLARED_VERSION = "2024.12.2";
 var CLOUDFLARED_SHA256 = {
   amd64: "40ec9a0f5b58e3b04183aaf01c4ddd4dbc6af39b0f06be4b7ce8b1011d0a07ab",
@@ -1871,6 +2013,7 @@ async function startTunnel() {
 }
 
 // src/commands/init.ts
+init_dlp();
 async function withSpinner(spinner, label, fn) {
   spinner.text = label;
   spinner.start();
@@ -1903,7 +2046,6 @@ var phases = [
   {
     name: "Configuration",
     run: async (ctx) => {
-      showBanner();
       const platform = detectPlatform();
       log.detail("Platform", `${platform.os} ${platform.arch}`);
       const userConfig = await promptInitConfig();
@@ -2086,8 +2228,12 @@ var initCommand = new Command2("init").description("Scaffold and launch a new NE
 
 // src/commands/start.ts
 import { Command as Command3 } from "commander";
+init_logger();
+init_secrets();
+init_docker();
 
 // src/core/health.ts
+init_docker();
 async function waitForServer(timeoutMs = 9e5) {
   const start = Date.now();
   let lastLog = 0;
@@ -2135,8 +2281,13 @@ var startCommand = new Command3("start").description("Start the NEXUS runtime").
   succeed(spinner, "Image ready");
   spinner = createSpinner("Starting NEXUS container...");
   spinner.start();
+  const keys = loadKeys();
+  if (!keys) {
+    fail(spinner, "No API keys found. Run: buildwithnexus init");
+    process.exit(1);
+  }
   await startNexus(
-    { anthropic: config.anthropicKey, openai: config.openaiKey },
+    { anthropic: keys.ANTHROPIC_API_KEY, openai: keys.OPENAI_API_KEY || "" },
     { port: config.httpPort }
   );
   succeed(spinner, "Container started");
@@ -2163,6 +2314,7 @@ var startCommand = new Command3("start").description("Start the NEXUS runtime").
 
 // src/commands/stop.ts
 import { Command as Command4 } from "commander";
+init_logger();
 import { execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -2220,6 +2372,9 @@ var stopCommand = new Command4("stop").description("Gracefully shut down the NEX
 });
 
 // src/commands/status.ts
+init_logger();
+init_secrets();
+init_docker();
 import { Command as Command5 } from "commander";
 import chalk8 from "chalk";
 async function checkHttpHealth(port) {
@@ -2294,10 +2449,14 @@ var statusCommand = new Command5("status").description("Check NEXUS runtime heal
 });
 
 // src/commands/doctor.ts
+init_logger();
+init_platform();
+init_docker();
+init_secrets();
 import { Command as Command6 } from "commander";
 import chalk9 from "chalk";
-import fs4 from "fs";
-import path6 from "path";
+import fs3 from "fs";
+import path5 from "path";
 var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime environment").action(async () => {
   const platform = detectPlatform();
   const check = (ok) => ok ? chalk9.green("\u2713") : chalk9.red("\u2717");
@@ -2313,7 +2472,7 @@ var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime e
   } else {
     console.log(`  ${check(false)}  Docker not installed`);
   }
-  const keyExists = fs4.existsSync(path6.join(NEXUS_HOME2, "ssh", "id_nexus_vm"));
+  const keyExists = fs3.existsSync(path5.join(NEXUS_HOME2, "ssh", "id_nexus_vm"));
   console.log(`  ${check(keyExists)}  SSH key`);
   const config = loadConfig();
   console.log(`  ${check(!!config)}  Configuration`);
@@ -2345,6 +2504,7 @@ var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime e
 });
 
 // src/commands/logs.ts
+init_logger();
 import { Command as Command7 } from "commander";
 import { execa as execa3 } from "execa";
 var logsCommand = new Command7("logs").description("View NEXUS server logs").action(async () => {
@@ -2378,16 +2538,19 @@ var logsCommand = new Command7("logs").description("View NEXUS server logs").act
 
 // src/commands/update.ts
 import { Command as Command8 } from "commander";
-import path7 from "path";
-import fs5 from "fs";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import path6 from "path";
+import fs4 from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+init_logger();
+init_secrets();
+init_docker();
 import { execa as execa4 } from "execa";
 function getReleaseTarball() {
-  const dir = path7.dirname(fileURLToPath3(import.meta.url));
-  const tarballPath = path7.join(dir, "nexus-release.tar.gz");
-  if (fs5.existsSync(tarballPath)) return tarballPath;
-  const rootPath = path7.resolve(dir, "..", "dist", "nexus-release.tar.gz");
-  if (fs5.existsSync(rootPath)) return rootPath;
+  const dir = path6.dirname(fileURLToPath2(import.meta.url));
+  const tarballPath = path6.join(dir, "nexus-release.tar.gz");
+  if (fs4.existsSync(tarballPath)) return tarballPath;
+  const rootPath = path6.resolve(dir, "..", "dist", "nexus-release.tar.gz");
+  if (fs4.existsSync(rootPath)) return rootPath;
   throw new Error("nexus-release.tar.gz not found. Reinstall buildwithnexus to get the latest release.");
 }
 var updateCommand = new Command8("update").description("Update NEXUS to the latest bundled release and restart").action(async () => {
@@ -2438,9 +2601,12 @@ var updateCommand = new Command8("update").description("Update NEXUS to the late
 // src/commands/destroy.ts
 import { Command as Command9 } from "commander";
 import chalk10 from "chalk";
-import fs6 from "fs";
+import fs5 from "fs";
 import { input } from "@inquirer/prompts";
-import path8 from "path";
+init_logger();
+init_secrets();
+init_docker();
+import path7 from "path";
 var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and all data").option("--force", "Skip confirmation").action(async (opts) => {
   const config = loadConfig();
   if (!opts.force) {
@@ -2467,9 +2633,9 @@ var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and al
     }
     await stopNexus();
   }
-  const sshConfigPath = path8.join(process.env.HOME || "~", ".ssh", "config");
-  if (fs6.existsSync(sshConfigPath)) {
-    const content = fs6.readFileSync(sshConfigPath, "utf-8");
+  const sshConfigPath = path7.join(process.env.HOME || "~", ".ssh", "config");
+  if (fs5.existsSync(sshConfigPath)) {
+    const content = fs5.readFileSync(sshConfigPath, "utf-8");
     const lines = content.split("\n");
     const filtered = [];
     let skip = false;
@@ -2482,14 +2648,17 @@ var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and al
       skip = false;
       filtered.push(line);
     }
-    fs6.writeFileSync(sshConfigPath, filtered.join("\n"));
+    fs5.writeFileSync(sshConfigPath, filtered.join("\n"));
   }
-  fs6.rmSync(NEXUS_HOME2, { recursive: true, force: true });
+  fs5.rmSync(NEXUS_HOME2, { recursive: true, force: true });
   succeed(spinner, "NEXUS runtime destroyed");
   log.dim("Run 'buildwithnexus init' to set up again");
 });
 
 // src/commands/keys.ts
+init_logger();
+init_secrets();
+init_dlp();
 import { Command as Command10 } from "commander";
 import { password as password2 } from "@inquirer/prompts";
 import chalk11 from "chalk";
@@ -2548,6 +2717,8 @@ keysCommand.command("set <key>").description("Set or update an API key (e.g. ANT
 });
 
 // src/commands/ssh.ts
+init_logger();
+init_docker();
 import { Command as Command11 } from "commander";
 import { execa as execa5 } from "execa";
 var sshCommand = new Command11("ssh").description("Open an interactive shell inside the NEXUS container").action(async () => {
@@ -2561,9 +2732,13 @@ var sshCommand = new Command11("ssh").description("Open an interactive shell ins
 });
 
 // src/commands/brainstorm.ts
+init_logger();
 import { Command as Command12 } from "commander";
 import chalk12 from "chalk";
 import { input as input2 } from "@inquirer/prompts";
+init_secrets();
+init_docker();
+init_dlp();
 var COS_PREFIX = chalk12.bold.cyan("  Chief of Staff");
 var YOU_PREFIX = chalk12.bold.white("  You");
 var DIVIDER = chalk12.dim("  " + "\u2500".repeat(56));
@@ -2682,9 +2857,13 @@ var brainstormCommand = new Command12("brainstorm").description("Brainstorm an i
 });
 
 // src/commands/ninety-nine.ts
+init_logger();
 import { Command as Command13 } from "commander";
 import chalk13 from "chalk";
 import { input as input3 } from "@inquirer/prompts";
+init_secrets();
+init_docker();
+init_dlp();
 var AGENT_PREFIX = chalk13.bold.green("  99 \u276F");
 var YOU_PREFIX2 = chalk13.bold.white("  You");
 var DIVIDER2 = chalk13.dim("  " + "\u2500".repeat(56));
@@ -2872,15 +3051,20 @@ var ninetyNineCommand = new Command13("99").description("AI pair-programming ses
 });
 
 // src/commands/shell.ts
+init_logger();
 import { Command as Command14 } from "commander";
 import chalk16 from "chalk";
+init_secrets();
+init_docker();
+init_dlp();
 
 // src/ui/repl.ts
+init_secrets();
 import readline3 from "readline";
-import fs7 from "fs";
-import path9 from "path";
+import fs6 from "fs";
+import path8 from "path";
 import chalk14 from "chalk";
-var HISTORY_FILE = path9.join(NEXUS_HOME2, "shell_history");
+var HISTORY_FILE = path8.join(NEXUS_HOME2, "shell_history");
 var MAX_HISTORY = 1e3;
 var Repl = class {
   rl = null;
@@ -2896,17 +3080,17 @@ var Repl = class {
   }
   loadHistory() {
     try {
-      if (fs7.existsSync(HISTORY_FILE)) {
-        this.history = fs7.readFileSync(HISTORY_FILE, "utf-8").split("\n").filter(Boolean).slice(-MAX_HISTORY);
+      if (fs6.existsSync(HISTORY_FILE)) {
+        this.history = fs6.readFileSync(HISTORY_FILE, "utf-8").split("\n").filter(Boolean).slice(-MAX_HISTORY);
       }
     } catch {
     }
   }
   saveHistory() {
     try {
-      const dir = path9.dirname(HISTORY_FILE);
-      fs7.mkdirSync(dir, { recursive: true });
-      fs7.writeFileSync(HISTORY_FILE, this.history.slice(-MAX_HISTORY).join("\n") + "\n", { mode: 384 });
+      const dir = path8.dirname(HISTORY_FILE);
+      fs6.mkdirSync(dir, { recursive: true });
+      fs6.writeFileSync(HISTORY_FILE, this.history.slice(-MAX_HISTORY).join("\n") + "\n", { mode: 384 });
     } catch {
     }
   }
@@ -3002,6 +3186,9 @@ var Repl = class {
 };
 
 // src/core/event-stream.ts
+init_docker();
+init_secrets();
+init_dlp();
 import chalk15 from "chalk";
 var ROLE_COLORS = {
   "Chief of Staff": chalk15.bold.cyan,
@@ -3116,8 +3303,8 @@ var EventStream = class {
 };
 
 // src/commands/shell.ts
-async function httpPost(httpPort, path12, body) {
-  const res = await fetch(`http://localhost:${httpPort}${path12}`, {
+async function httpPost(httpPort, path11, body) {
+  const res = await fetch(`http://localhost:${httpPort}${path11}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body),
@@ -3132,9 +3319,9 @@ async function httpPost(httpPort, path12, body) {
     return text;
   }
 }
-async function httpGet(httpPort, path12) {
+async function httpGet(httpPort, path11) {
   try {
-    const res = await fetch(`http://localhost:${httpPort}${path12}`, {
+    const res = await fetch(`http://localhost:${httpPort}${path11}`, {
       signal: AbortSignal.timeout(1e4)
     });
     const text = await res.text();
@@ -3551,49 +3738,19 @@ var shellCommand2 = new Command14("shell").description("Launch the interactive N
   }
 });
 
-// src/cli.ts
-function getVersionStatic() {
-  try {
-    const __dirname2 = dirname2(fileURLToPath4(import.meta.url));
-    const packagePath = join2(__dirname2, "..", "package.json");
-    const packageJson = JSON.parse(readFileSync2(packagePath, "utf-8"));
-    return packageJson.version;
-  } catch {
-    return true ? "0.7.1" : "0.0.0-unknown";
-  }
-}
-var cli = new Command15().name("buildwithnexus").description("Auto-scaffold and launch a fully autonomous NEXUS runtime").version(getVersionStatic());
-cli.addCommand(installCommand);
-cli.addCommand(initCommand);
-cli.addCommand(startCommand);
-cli.addCommand(stopCommand);
-cli.addCommand(statusCommand);
-cli.addCommand(doctorCommand);
-cli.addCommand(logsCommand);
-cli.addCommand(updateCommand);
-cli.addCommand(destroyCommand);
-cli.addCommand(keysCommand);
-cli.addCommand(sshCommand);
-cli.addCommand(brainstormCommand);
-cli.addCommand(ninetyNineCommand);
-cli.addCommand(shellCommand2);
-cli.action(() => {
-  cli.help();
-});
-
 // src/core/update-notifier.ts
-import fs8 from "fs";
-import path10 from "path";
-import os4 from "os";
+import fs7 from "fs";
+import path9 from "path";
+import os3 from "os";
 import https from "https";
 import chalk17 from "chalk";
 var PACKAGE_NAME = "buildwithnexus";
 var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
-var STATE_DIR = path10.join(os4.homedir(), ".buildwithnexus");
-var STATE_FILE = path10.join(STATE_DIR, ".update-check.json");
+var STATE_DIR = path9.join(os3.homedir(), ".buildwithnexus");
+var STATE_FILE = path9.join(STATE_DIR, ".update-check.json");
 function readState() {
   try {
-    const raw = fs8.readFileSync(STATE_FILE, "utf-8");
+    const raw = fs7.readFileSync(STATE_FILE, "utf-8");
     return JSON.parse(raw);
   } catch {
     return { lastCheck: 0, latestVersion: null };
@@ -3601,8 +3758,8 @@ function readState() {
 }
 function writeState(state) {
   try {
-    fs8.mkdirSync(STATE_DIR, { recursive: true, mode: 448 });
-    fs8.writeFileSync(STATE_FILE, JSON.stringify(state), { mode: 384 });
+    fs7.mkdirSync(STATE_DIR, { recursive: true, mode: 448 });
+    fs7.writeFileSync(STATE_FILE, JSON.stringify(state), { mode: 384 });
   } catch {
   }
 }
@@ -3674,18 +3831,34 @@ function printUpdateBanner(current, latest) {
   process.stderr.write(msg + "\n");
 }
 
+// src/core/models.ts
+var MODELS = {
+  OPUS: "claude-opus-4-6",
+  SONNET: "claude-sonnet-4-6-20250929",
+  HAIKU: "claude-haiku-4-5-20251001",
+  DEFAULT: "claude-sonnet-4-6-20250929"
+};
+
 // src/bin.ts
 import dotenv2 from "dotenv";
-import os5 from "os";
-import path11 from "path";
-var homeEnvPath = path11.join(os5.homedir(), ".env.local");
+import os4 from "os";
+import path10 from "path";
+var homeEnvPath = path10.join(os4.homedir(), ".env.local");
 dotenv2.config({ path: homeEnvPath });
-var version = true ? "0.7.1" : "0.5.17";
+var version = true ? "0.7.2" : pkg.version;
 checkForUpdates(version);
 program.name("buildwithnexus").description("Nexus - AI-Powered Task Execution").version(version);
 program.command("da-init").description("Initialize Nexus (set up API keys and .env.local)").action(deepAgentsInitCommand);
-program.command("run <task>").description("Run a task with Nexus").option("-a, --agent <name>", "Agent role (engineer, researcher, etc)", "engineer").option("-g, --goal <goal>", "Agent goal").option("-m, --model <model>", "LLM model", "claude-sonnet-4-20250514").action(runCommand);
+program.command("run <task>").description("Run a task with Nexus").option("-a, --agent <name>", "Agent role (engineer, researcher, etc)", "engineer").option("-g, --goal <goal>", "Agent goal").option("-m, --model <model>", "LLM model", MODELS.DEFAULT).action(runCommand);
 program.command("dashboard").description("Start the Nexus dashboard server").option("-p, --port <port>", "Dashboard port", "4201").action(dashboardCommand);
+program.command("server").description("Start the Nexus backend server").action(async () => {
+  const { startBackend: startBackend2 } = await Promise.resolve().then(() => (init_docker(), docker_exports));
+  await startBackend2();
+  const chalk18 = (await import("chalk")).default;
+  console.log(chalk18.green("Backend server started. Press Ctrl+C to stop."));
+  await new Promise(() => {
+  });
+});
 program.command("da-status").description("Check Nexus backend status").action(async () => {
   const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
   try {
@@ -3703,12 +3876,20 @@ program.command("da-status").description("Check Nexus backend status").action(as
     console.log("   cd ~/Projects/nexus && python -m src.deep_agents_server");
   }
 });
-for (const cmd of cli.commands) {
-  const name = cmd.name();
-  if (!["da-init", "run", "dashboard", "da-status"].includes(name)) {
-    program.addCommand(cmd);
-  }
-}
+program.addCommand(installCommand);
+program.addCommand(initCommand);
+program.addCommand(startCommand);
+program.addCommand(stopCommand);
+program.addCommand(statusCommand);
+program.addCommand(doctorCommand);
+program.addCommand(logsCommand);
+program.addCommand(updateCommand);
+program.addCommand(destroyCommand);
+program.addCommand(keysCommand);
+program.addCommand(sshCommand);
+program.addCommand(brainstormCommand);
+program.addCommand(ninetyNineCommand);
+program.addCommand(shellCommand2);
 if (!process.argv.slice(2).length) {
   interactiveMode().catch((err) => {
     console.error(err);
@@ -3717,3 +3898,6 @@ if (!process.argv.slice(2).length) {
 } else {
   program.parse();
 }
+export {
+  version
+};