buildwithnexus 0.7.1 → 0.7.3

package/dist/bin.js

@@ -9,27 +9,215 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/core/config.ts
-import dotenv from "dotenv";
+// src/core/dlp.ts
+import crypto from "crypto";
+import fs from "fs";
 import path from "path";
-import os from "os";
-function loadApiKeys() {
-  return {
-    anthropic: process.env.ANTHROPIC_API_KEY || void 0,
-    openai: process.env.OPENAI_API_KEY || void 0,
-    google: process.env.GOOGLE_API_KEY || void 0
-  };
+function shellEscape(value) {
+  if (value.includes("\0")) {
+    throw new DlpViolation("Null byte in shell argument");
+  }
+  return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-function hasAnyKey() {
-  return !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY || process.env.GOOGLE_API_KEY);
+function shellCommand(strings, ...values) {
+  let result = strings[0];
+  for (let i = 0; i < values.length; i++) {
+    result += shellEscape(values[i]) + strings[i + 1];
+  }
+  return result;
+}
+function redact(text) {
+  let result = text;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, "[REDACTED]");
+  }
+  return result;
+}
+function redactError(err) {
+  if (err instanceof Error) {
+    const safe = new Error(redact(err.message));
+    safe.name = err.name;
+    if (err.stack) safe.stack = redact(err.stack);
+    return safe;
+  }
+  return new Error(redact(String(err)));
+}
+function validateKeyValue(keyName, value) {
+  if (FORBIDDEN_KEY_CHARS.test(value)) {
+    throw new DlpViolation(
+      `${keyName} contains characters that are not permitted in API keys`
+    );
+  }
+  if (value.length < 10 || value.length > 256) {
+    throw new DlpViolation(
+      `${keyName} length out of expected range (10-256 characters)`
+    );
+  }
+  const validator = KEY_VALIDATORS[keyName];
+  if (validator && !validator.test(value)) {
+    throw new DlpViolation(
+      `${keyName} does not match the expected format for this key type`
+    );
+  }
+}
+function validateAllKeys(keys) {
+  const violations = [];
+  for (const [name, value] of Object.entries(keys)) {
+    if (!value) continue;
+    try {
+      validateKeyValue(name, value);
+    } catch (err) {
+      if (err instanceof DlpViolation) violations.push(err.message);
+    }
+  }
+  return violations;
+}
+function computeFileHmac(filePath, secret) {
+  const content = fs.readFileSync(filePath);
+  return crypto.createHmac("sha256", secret).update(content).digest("hex");
+}
+function sealKeysFile(keysPath, masterSecret) {
+  const hmac = computeFileHmac(keysPath, masterSecret);
+  fs.writeFileSync(HMAC_PATH, hmac, { mode: 384 });
+}
+function verifyKeysFile(keysPath, masterSecret) {
+  const keysExist = fs.existsSync(keysPath);
+  const hmacExist = fs.existsSync(HMAC_PATH);
+  if (!keysExist && !hmacExist) return true;
+  if (keysExist && !hmacExist) return false;
+  try {
+    const stored = fs.readFileSync(HMAC_PATH, "utf-8").trim();
+    const computed = computeFileHmac(keysPath, masterSecret);
+    return crypto.timingSafeEqual(
+      Buffer.from(stored, "hex"),
+      Buffer.from(computed, "hex")
+    );
+  } catch {
+    return false;
+  }
+}
+function audit(event, detail = "") {
+  try {
+    const dir = path.dirname(AUDIT_PATH);
+    if (!fs.existsSync(dir)) return;
+    if (fs.existsSync(AUDIT_PATH)) {
+      const stat = fs.statSync(AUDIT_PATH);
+      if (stat.size > MAX_AUDIT_SIZE) {
+        const rotated = AUDIT_PATH + ".1";
+        if (fs.existsSync(rotated)) fs.unlinkSync(rotated);
+        fs.renameSync(AUDIT_PATH, rotated);
+        try {
+          fs.chmodSync(rotated, 384);
+        } catch {
+        }
+      }
+    }
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} | ${event} | ${redact(detail)}
+`;
+    fs.appendFileSync(AUDIT_PATH, line, { mode: 384 });
+    try {
+      fs.chmodSync(AUDIT_PATH, 384);
+    } catch {
+    }
+  } catch {
+  }
+}
+var NEXUS_HOME, SECRET_PATTERNS, FORBIDDEN_KEY_CHARS, KEY_VALIDATORS, DlpViolation, HMAC_PATH, AUDIT_PATH, MAX_AUDIT_SIZE;
+var init_dlp = __esm({
+  "src/core/dlp.ts"() {
+    "use strict";
+    NEXUS_HOME = path.join(process.env.HOME || "~", ".buildwithnexus");
+    SECRET_PATTERNS = [
+      /sk-ant-api03-[A-Za-z0-9_-]{20,}/g,
+      // Anthropic API key
+      /sk-[A-Za-z0-9]{20,}/g,
+      // OpenAI API key
+      /AIza[A-Za-z0-9_-]{35}/g
+      // Google AI API key
+    ];
+    FORBIDDEN_KEY_CHARS = /[\n\r\t'"\\`${}();&|<>!#%^]/;
+    KEY_VALIDATORS = {
+      ANTHROPIC_API_KEY: /^sk-ant-[A-Za-z0-9_-]{20,}$/,
+      OPENAI_API_KEY: /^sk-[A-Za-z0-9_-]{20,}$/,
+      GOOGLE_API_KEY: /^AIza[A-Za-z0-9_-]{35,}$/,
+      NEXUS_MASTER_SECRET: /^[A-Za-z0-9_-]{20,64}$/
+    };
+    DlpViolation = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "DlpViolation";
+      }
+    };
+    HMAC_PATH = path.join(NEXUS_HOME, ".keys.hmac");
+    AUDIT_PATH = path.join(NEXUS_HOME, "audit.log");
+    MAX_AUDIT_SIZE = 10 * 1024 * 1024;
+  }
+});
+
+// src/core/secrets.ts
+import fs2 from "fs";
+import path2 from "path";
+import crypto2 from "crypto";
+function ensureHome() {
+  fs2.mkdirSync(NEXUS_HOME2, { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "images"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "configs"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "vm", "logs"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(NEXUS_HOME2, "ssh"), { recursive: true, mode: 448 });
+}
+function generateMasterSecret() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+function saveConfig(config) {
+  const { masterSecret: _secret, ...safeConfig } = config;
+  fs2.writeFileSync(CONFIG_PATH, JSON.stringify(safeConfig, null, 2), { mode: 384 });
+}
+function loadConfig() {
+  if (!fs2.existsSync(CONFIG_PATH)) return null;
+  return JSON.parse(fs2.readFileSync(CONFIG_PATH, "utf-8"));
+}
+function saveKeys(keys) {
+  const violations = validateAllKeys(keys);
+  if (violations.length > 0) {
+    throw new DlpViolation(`Key validation failed: ${violations.join("; ")}`);
+  }
+  const lines = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`);
+  fs2.writeFileSync(KEYS_PATH, lines.join("\n") + "\n", { mode: 384 });
+  sealKeysFile(KEYS_PATH, keys.NEXUS_MASTER_SECRET);
+  audit("keys_saved", `${Object.keys(keys).filter((k) => keys[k]).length} keys saved`);
+}
+function loadKeys() {
+  if (!fs2.existsSync(KEYS_PATH)) return null;
+  const content = fs2.readFileSync(KEYS_PATH, "utf-8");
+  const keys = {};
+  for (const line of content.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0) keys[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  const result = keys;
+  if (result.NEXUS_MASTER_SECRET && !verifyKeysFile(KEYS_PATH, result.NEXUS_MASTER_SECRET)) {
+    audit("keys_tampered", "HMAC mismatch on .env.keys");
+    throw new DlpViolation(
+      ".env.keys has been modified outside of buildwithnexus. Run 'buildwithnexus keys set' to re-enter your keys, or 'buildwithnexus destroy' to start fresh."
+    );
+  }
+  audit("keys_loaded", `${Object.keys(keys).length} keys loaded`);
+  return result;
 }
-function reloadEnv(envPath) {
-  const resolvedPath = envPath ?? path.join(os.homedir(), ".env.local");
-  dotenv.config({ path: resolvedPath, override: true });
+function maskKey(key) {
+  if (key.length <= 8) return "***";
+  const reveal = Math.min(4, Math.floor(key.length * 0.1));
+  return key.slice(0, reveal) + "..." + key.slice(-reveal);
 }
-var init_config = __esm({
-  "src/core/config.ts"() {
+var NEXUS_HOME2, CONFIG_PATH, KEYS_PATH;
+var init_secrets = __esm({
+  "src/core/secrets.ts"() {
     "use strict";
+    init_dlp();
+    NEXUS_HOME2 = process.env.NEXUS_HOME || path2.join(process.env.HOME || "~", ".buildwithnexus");
+    CONFIG_PATH = process.env.NEXUS_CONFIG_PATH || path2.join(NEXUS_HOME2, "config.json");
+    KEYS_PATH = process.env.NEXUS_KEYS_PATH || path2.join(NEXUS_HOME2, ".env.keys");
   }
 });
 
@@ -38,1682 +226,1823 @@ var init_command_exports = {};
 __export(init_command_exports, {
   deepAgentsInitCommand: () => deepAgentsInitCommand
 });
-import fs from "fs";
-import path2 from "path";
-import os2 from "os";
 import * as readline from "readline";
 async function deepAgentsInitCommand() {
-  const envPath = path2.join(os2.homedir(), ".env.local");
+  const inputHandler = new InputHandler();
+  ensureHome();
+  let existingKeys = null;
+  try {
+    existingKeys = loadKeys();
+  } catch {
+  }
+  if (existingKeys) {
+    console.log("\nKeys found in ~/.buildwithnexus/.env.keys:");
+    if (existingKeys.ANTHROPIC_API_KEY) {
+      console.log(`  ANTHROPIC_API_KEY: ${maskKey(existingKeys.ANTHROPIC_API_KEY)}`);
+    }
+    if (existingKeys.OPENAI_API_KEY) {
+      console.log(`  OPENAI_API_KEY: ${maskKey(existingKeys.OPENAI_API_KEY)}`);
+    }
+    if (existingKeys.GOOGLE_API_KEY) {
+      console.log(`  GOOGLE_API_KEY: ${maskKey(existingKeys.GOOGLE_API_KEY)}`);
+    }
+    const choice = await inputHandler.askQuestion(
+      "\nPress Enter to use cached keys, or type 'new' to reconfigure: "
+    );
+    if (choice.trim().toLowerCase() !== "new") {
+      process.env.ANTHROPIC_API_KEY = existingKeys.ANTHROPIC_API_KEY || "";
+      if (existingKeys.OPENAI_API_KEY) process.env.OPENAI_API_KEY = existingKeys.OPENAI_API_KEY;
+      if (existingKeys.GOOGLE_API_KEY) process.env.GOOGLE_API_KEY = existingKeys.GOOGLE_API_KEY;
+      console.log("Using cached keys.");
+      inputHandler.close();
+      return;
+    }
+  }
   console.log(
-    "Please provide your LLM API keys:\n(You can set these later by editing .env.local)\n"
+    "\nPlease provide your LLM API keys:\n(Stored securely in ~/.buildwithnexus/.env.keys)\n"
   );
-  const anthropicKey = await askQuestion(
+  const anthropicKey = await inputHandler.askQuestion(
     "ANTHROPIC_API_KEY (Claude - optional, press Enter to skip): "
   );
-  const openaiKey = await askQuestion(
+  const openaiKey = await inputHandler.askQuestion(
     "OPENAI_API_KEY (GPT - optional, press Enter to skip): "
   );
-  const googleKey = await askQuestion(
+  const googleKey = await inputHandler.askQuestion(
     "GOOGLE_API_KEY (Gemini - optional, press Enter to skip): "
   );
   if (!anthropicKey && !openaiKey && !googleKey) {
-    console.log("Error: At least one API key must be provided.");
+    const anthropicStatus = anthropicKey ? "provided" : "empty";
+    const openaiStatus = openaiKey ? "provided" : "empty";
+    const googleStatus = googleKey ? "provided" : "empty";
+    console.log(
+      `Error: API keys status: Anthropic [${anthropicStatus}], OpenAI [${openaiStatus}], Google [${googleStatus}]. Please provide at least one.`
+    );
+    inputHandler.close();
     return;
   }
-  const backendUrl = await askQuestion("Backend URL (http://localhost:4200): ") || "http://localhost:4200";
-  const dashboardPort = await askQuestion("Dashboard port (4201): ") || "4201";
-  const envContent = `# Nexus Configuration
-# Generated by buildwithnexus init
-
-# LLM API Keys
-${anthropicKey ? `ANTHROPIC_API_KEY=${anthropicKey}` : "# ANTHROPIC_API_KEY="}
-${openaiKey ? `OPENAI_API_KEY=${openaiKey}` : "# OPENAI_API_KEY="}
-${googleKey ? `GOOGLE_API_KEY=${googleKey}` : "# GOOGLE_API_KEY="}
-
-# Backend
-BACKEND_URL=${backendUrl}
-DASHBOARD_PORT=${dashboardPort}
-
-# Optional
-# LOG_LEVEL=debug
-`;
-  fs.writeFileSync(envPath, envContent, { mode: 384 });
-  reloadEnv(envPath);
-  console.log("Configuration saved to .env.local and loaded into environment.");
-}
-function setupInputHandling() {
-  return new Promise((resolve) => {
-    if (isSetup) {
-      resolve();
-      return;
-    }
-    isSetup = true;
-    if (process.stdin.isTTY) {
-      resolve();
-    } else {
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-        terminal: false
-      });
-      rl.on("line", (line) => {
-        inputLines.push(line);
-      });
-      rl.on("close", () => {
-        resolve();
-      });
-    }
-  });
-}
-async function askQuestion(prompt) {
-  await setupInputHandling();
-  if (process.stdin.isTTY) {
-    return new Promise((resolve) => {
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      rl.question(prompt, (answer) => {
-        rl.close();
-        resolve(answer);
-      });
-    });
-  } else {
-    process.stdout.write(prompt);
-    const answer = inputLines[lineIndex] || "";
-    lineIndex++;
-    console.log(answer);
-    return answer;
-  }
+  const masterSecret = generateMasterSecret();
+  const keys = {
+    ANTHROPIC_API_KEY: anthropicKey,
+    OPENAI_API_KEY: openaiKey || void 0,
+    GOOGLE_API_KEY: googleKey || void 0,
+    NEXUS_MASTER_SECRET: masterSecret
+  };
+  saveKeys(keys);
+  if (anthropicKey) process.env.ANTHROPIC_API_KEY = anthropicKey;
+  if (openaiKey) process.env.OPENAI_API_KEY = openaiKey;
+  if (googleKey) process.env.GOOGLE_API_KEY = googleKey;
+  console.log("Configuration saved to ~/.buildwithnexus/.env.keys and loaded into environment.");
+  inputHandler.close();
 }
-var inputLines, lineIndex, isSetup;
+var InputHandler;
 var init_init_command = __esm({
   "src/cli/init-command.ts"() {
     "use strict";
-    init_config();
-    inputLines = [];
-    lineIndex = 0;
-    isSetup = false;
+    init_secrets();
+    InputHandler = class {
+      inputLines = [];
+      lineIndex = 0;
+      isSetup = false;
+      rl = null;
+      setupInputHandling() {
+        return new Promise((resolve) => {
+          if (this.isSetup) {
+            resolve();
+            return;
+          }
+          this.isSetup = true;
+          if (process.stdin.isTTY) {
+            this.rl = readline.createInterface({
+              input: process.stdin,
+              output: process.stdout
+            });
+            resolve();
+          } else {
+            const rl = readline.createInterface({
+              input: process.stdin,
+              output: process.stdout,
+              terminal: false
+            });
+            rl.on("line", (line) => {
+              this.inputLines.push(line);
+            });
+            rl.on("close", () => {
+              resolve();
+            });
+          }
+        });
+      }
+      async askQuestion(prompt) {
+        await this.setupInputHandling();
+        if (process.stdin.isTTY) {
+          return new Promise((resolve) => {
+            this.rl.question(prompt, (answer) => {
+              resolve(answer);
+            });
+          });
+        } else {
+          process.stdout.write(prompt);
+          const answer = this.inputLines[this.lineIndex] || "";
+          this.lineIndex++;
+          console.log(answer);
+          return answer;
+        }
+      }
+      close() {
+        if (this.rl) {
+          this.rl.close();
+          this.rl = null;
+        }
+      }
+    };
   }
 });
 
-// src/ui/banner.ts
-var banner_exports = {};
-__export(banner_exports, {
-  showBanner: () => showBanner,
-  showCompletion: () => showCompletion,
-  showPhase: () => showPhase,
-  showSecurityPosture: () => showSecurityPosture
+// src/ui/logger.ts
+import chalk2 from "chalk";
+var log;
+var init_logger = __esm({
+  "src/ui/logger.ts"() {
+    "use strict";
+    log = {
+      step(msg) {
+        console.log(chalk2.cyan("  \u2192 ") + msg);
+      },
+      success(msg) {
+        console.log(chalk2.green("  \u2713 ") + msg);
+      },
+      error(msg) {
+        console.error(chalk2.red("  \u2717 ") + msg);
+      },
+      warn(msg) {
+        console.log(chalk2.yellow("  \u26A0 ") + msg);
+      },
+      dim(msg) {
+        console.log(chalk2.dim("    " + msg));
+      },
+      detail(label, value) {
+        console.log(chalk2.dim("    " + label + ": ") + value);
+      },
+      progress(current, total, label) {
+        const pct = Math.round(current / total * 100);
+        const filled = Math.round(current / total * 20);
+        const bar = chalk2.cyan("\u2588".repeat(filled)) + chalk2.dim("\u2591".repeat(20 - filled));
+        process.stdout.write(`\r  [${bar}] ${chalk2.bold(`${pct}%`)} ${chalk2.dim(label)}`);
+        if (current >= total) process.stdout.write("\n");
+      }
+    };
+  }
 });
-import chalk5 from "chalk";
-import { readFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function getVersion() {
-  try {
-    const __dirname2 = dirname(fileURLToPath2(import.meta.url));
-    const packagePath = join(__dirname2, "..", "package.json");
-    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
-    return packageJson.version;
-  } catch {
-    return true ? "0.7.1" : "0.0.0-unknown";
+
+// src/core/platform.ts
+import os2 from "os";
+function detectPlatform() {
+  const platform = os2.platform();
+  const arch = os2.arch();
+  if (platform === "darwin") {
+    return {
+      os: "mac",
+      arch: arch === "arm64" ? "arm64" : "x64",
+      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
+    };
   }
+  if (platform === "linux") {
+    return {
+      os: "linux",
+      arch: arch === "arm64" ? "arm64" : "x64",
+      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
+    };
+  }
+  if (platform === "win32") {
+    return {
+      os: "windows",
+      arch: "x64",
+      dockerPlatform: "linux/amd64"
+    };
+  }
+  throw new Error(`Unsupported platform: ${platform} ${arch}`);
 }
-function showBanner() {
-  console.log(BANNER);
-  console.log(chalk5.dim(`  v${getVersion()} \xB7 buildwithnexus.dev
-`));
-}
-function showPhase(phase, total, description) {
-  const progress = chalk5.cyan(`[${phase}/${total}]`);
-  console.log(`
-${progress} ${chalk5.bold(description)}`);
-}
-function showSecurityPosture() {
-  const lines = [
-    "",
-    chalk5.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
-    chalk5.bold("  \u2551  ") + chalk5.bold.green("Security Posture") + chalk5.bold("                                        \u2551"),
-    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Triple-nested isolation: Host \u2192 VM \u2192 Docker \u2192 KVM".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Network hardened: UFW deny-all, allow 22/80/443/4200".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" All databases encrypted at rest (AES-256-CBC)".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" API keys never embedded in VM \u2014 delivered via SCP".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" SSH-only communication (no exposed network ports)".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" DLP: secret detection, shell escaping, output redaction".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" HMAC integrity verification on all key files".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Docker: --read-only, no-new-privileges, cap-drop=ALL".padEnd(54)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.bold("  \u2551  ") + chalk5.dim("Full details: https://buildwithnexus.dev/security".padEnd(55)) + chalk5.bold("\u2551"),
-    chalk5.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
-    ""
-  ];
-  console.log(lines.join("\n"));
-}
-function showCompletion(urls) {
-  const lines = [
-    "",
-    chalk5.green("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
-    chalk5.green("  \u2551  ") + chalk5.bold.green("NEXUS Runtime is Live!") + chalk5.green("                                 \u2551"),
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.white(`Connect:    ${urls.ssh}`.padEnd(55)) + chalk5.green("\u2551")
-  ];
-  if (urls.remote) {
-    lines.push(chalk5.green("  \u2551  ") + chalk5.white(`Remote:     ${urls.remote}`.padEnd(55)) + chalk5.green("\u2551"));
+var init_platform = __esm({
+  "src/core/platform.ts"() {
+    "use strict";
   }
-  lines.push(
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.dim("Quick Start:".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus           - Interactive shell".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus brainstorm - Brainstorm ideas".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus status    - Check health".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
-    chalk5.green("  \u2551  ") + chalk5.dim("All commands:".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus stop/start/update/logs/ssh/destroy".padEnd(55)) + chalk5.green("\u2551"),
-    chalk5.green("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
-    ""
-  );
-  console.log(lines.join("\n"));
+});
+
+// src/core/utils.ts
+function backoffMs(attempt) {
+  return Math.min(3e3 * Math.pow(2, attempt), 3e4);
 }
-var BANNER;
-var init_banner = __esm({
-  "src/ui/banner.ts"() {
+var init_utils = __esm({
+  "src/core/utils.ts"() {
     "use strict";
-    BANNER = `
-  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
-  \u2551       ${chalk5.bold.cyan("B U I L D   W I T H   N E X U S")}        \u2551
-  \u2551                                              \u2551
-  \u2551      Autonomous Agent Orchestration          \u2551
-  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
-`;
   }
 });
 
-// src/bin.ts
-init_init_command();
-import { program } from "commander";
-
-// src/cli/tui.ts
-import chalk from "chalk";
-var colors = {
-  accent: chalk.hex("#7D56F4"),
-  // Brand purple
-  success: chalk.hex("#00FF87"),
-  // Bright green
-  warning: chalk.hex("#FFB86C"),
-  // Amber
-  info: chalk.hex("#8BE9FD"),
-  // Cyan
-  muted: chalk.gray,
-  // Adaptive gray
-  error: chalk.red
-};
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var STATUS_SYMBOLS = {
-  done: colors.success("\u2714"),
-  active: colors.info("\u25C9"),
-  pending: colors.muted("\u25CB"),
-  error: colors.error("\u2716")
-};
-var TUI = class {
-  taskStartTime = 0;
-  eventCount = 0;
-  spinnerIndex = 0;
-  getSpinner() {
-    const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
-    this.spinnerIndex++;
-    return frame;
-  }
-  displayHeader(task, agent) {
-    console.clear();
-    const headerBox = this.makeRoundedBox(
-      colors.accent("\u{1F680} NEXUS - Autonomous Agent Orchestration"),
-      62,
-      colors.accent
-    );
-    console.log(headerBox);
-    console.log("");
-    console.log(colors.muted("Task") + colors.muted(":  ") + chalk.white(task));
-    console.log(colors.muted("Agent") + colors.muted(": ") + colors.info(agent));
-    console.log("");
-    this.taskStartTime = Date.now();
+// src/core/health.ts
+var health_exports = {};
+__export(health_exports, {
+  checkHealth: () => checkHealth,
+  waitForServer: () => waitForServer
+});
+async function checkHealth(vmRunning) {
+  const status = {
+    vmRunning,
+    sshReady: false,
+    dockerReady: false,
+    serverHealthy: false,
+    tunnelUrl: null,
+    dockerVersion: null,
+    serverVersion: null,
+    diskUsagePercent: null,
+    uptimeSeconds: null,
+    lastChecked: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (!vmRunning) return status;
+  status.sshReady = true;
+  try {
+    const { stdout, code } = await dockerExec("docker version --format '{{.Server.Version}}'");
+    status.dockerReady = code === 0 && stdout.trim().length > 0;
+    if (status.dockerReady) status.dockerVersion = stdout.trim();
+  } catch {
   }
-  displayConnecting() {
-    console.log(`${this.getSpinner()} ${colors.warning("Connecting to backend...")}`);
+  try {
+    const { stdout, code } = await dockerExec("curl -sf http://localhost:4200/health");
+    status.serverHealthy = code === 0 && stdout.includes("ok");
+    if (status.serverHealthy) {
+      try {
+        const parsed = JSON.parse(stdout);
+        if (typeof parsed.version === "string") status.serverVersion = parsed.version;
+      } catch {
+      }
+    }
+  } catch {
   }
-  displayConnected(runId) {
-    console.log(`${STATUS_SYMBOLS.done} Connected \u2022 ${colors.muted(`run: ${runId}`)}`);
-    console.log("");
+  try {
+    const { stdout } = await dockerExec("df / --output=pcent | tail -1 | tr -dc '0-9'");
+    const pct = parseInt(stdout.trim(), 10);
+    if (!isNaN(pct)) status.diskUsagePercent = pct;
+  } catch {
   }
-  displayStreamStart() {
-    console.log(chalk.bold(colors.accent("\u{1F4E1} Streaming Events")));
-    console.log("");
+  try {
+    const { stdout } = await dockerExec("awk '{print int($1)}' /proc/uptime 2>/dev/null");
+    const up = parseInt(stdout.trim(), 10);
+    if (!isNaN(up)) status.uptimeSeconds = up;
+  } catch {
   }
-  displayPlan(task, steps) {
-    console.log("");
-    const planHeader = colors.accent("Plan Breakdown");
-    const planLines = [];
-    steps.forEach((step, i) => {
-      planLines.push(`  ${STATUS_SYMBOLS.pending}  ${chalk.white(`Step ${i + 1}:`)} ${step}`);
-    });
-    const planBox = this.makeDoubleBox(planHeader, planLines.join("\n"), 62, colors.accent);
-    console.log(planBox);
-    console.log("");
+  try {
+    const { stdout } = await dockerExec("cat /home/nexus/.nexus/tunnel-url.txt 2>/dev/null");
+    if (stdout.includes("https://")) {
+      status.tunnelUrl = stdout.trim();
+    }
+  } catch {
   }
-  displayEvent(type, data) {
-    this.eventCount++;
-    const content = data["content"] || "";
-    if (type === "agent_working") {
-      const agent = data["agent"] || "Agent";
-      const agentTask = data["task"] || "";
-      console.log("");
-      console.log(`  ${colors.info("\u{1F464}")} ${colors.info(chalk.bold(agent))}`);
-      console.log(`     ${colors.muted("\u2192")} ${agentTask}`);
-      return;
+  return status;
+}
+async function waitForServer(timeoutMs = 9e5) {
+  const start = Date.now();
+  let lastLog = 0;
+  let attempt = 0;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const { stdout, code } = await dockerExec("curl -sf http://localhost:4200/health");
+      if (code === 0 && stdout.includes("ok")) return true;
+    } catch {
     }
-    if (type === "agent_result") {
-      const result = data["result"] || "";
-      let displayResult = result;
-      if (displayResult.length > 100) {
-        displayResult = displayResult.substring(0, 97) + "...";
+    const elapsed = Date.now() - start;
+    if (elapsed - lastLog >= 3e4) {
+      lastLog = elapsed;
+      try {
+        const { stdout } = await dockerExec("systemctl is-active nexus 2>/dev/null || echo 'starting...'");
+        process.stderr.write(`
+  [server ${Math.round(elapsed / 1e3)}s] ${stdout.trim().slice(0, 120)}
+`);
+      } catch {
       }
-      console.log(`  ${STATUS_SYMBOLS.done} ${chalk.white(displayResult)}`);
-      return;
-    }
-    const eventConfig = {
-      thought: { icon: "\u{1F4AD}", color: colors.info },
-      action: { icon: "\u26A1", color: colors.warning },
-      observation: { icon: "\u2713", color: colors.success },
-      started: { icon: "\u25B6", color: colors.info },
-      done: { icon: "\u2728", color: colors.success },
-      execution_complete: { icon: "\u2728", color: colors.success },
-      error: { icon: "\u2716", color: colors.error }
-    };
-    const config = eventConfig[type] || { icon: "\u25CF", color: colors.muted };
-    let displayContent = content;
-    if (displayContent.length > 100) {
-      displayContent = displayContent.substring(0, 97) + "...";
     }
-    console.log(`  ${config.icon} ${config.color(displayContent)}`);
+    const delay = backoffMs(attempt++);
+    const remaining = timeoutMs - (Date.now() - start);
+    if (remaining <= 0) break;
+    await new Promise((r) => setTimeout(r, Math.min(delay, remaining)));
   }
-  displayResults(summary, todosCompleted) {
-    console.log("");
-    console.log(colors.success("\u2501".repeat(60)));
-    console.log(colors.success.bold("\u2728 Execution Complete"));
-    console.log("");
-    const lines = summary.split("\n");
-    for (const line of lines) {
-      console.log(`  ${colors.success("\u2502")} ${chalk.white(line)}`);
-    }
-    console.log("");
-    console.log(`  ${colors.muted(`${todosCompleted} subtask(s) completed`)}`);
-    console.log("");
+  return false;
+}
+var init_health = __esm({
+  "src/core/health.ts"() {
+    "use strict";
+    init_docker();
+    init_utils();
   }
-  displayError(error) {
-    console.log("");
-    console.log(colors.error("\u274C Error"));
-    console.log(colors.error(error));
-    console.log("");
+});
+
+// src/core/docker.ts
+var docker_exports = {};
+__export(docker_exports, {
+  dockerExec: () => dockerExec,
+  imageExistsLocally: () => imageExistsLocally,
+  installDocker: () => installDocker,
+  isDockerInstalled: () => isDockerInstalled,
+  isNexusRunning: () => isNexusRunning,
+  launchNexus: () => launchNexus,
+  pullImage: () => pullImage,
+  startBackend: () => startBackend,
+  startNexus: () => startNexus,
+  stopNexus: () => stopNexus
+});
+import { existsSync } from "fs";
+import { execa } from "execa";
+async function isDockerInstalled() {
+  try {
+    await execa("docker", ["info"]);
+    return true;
+  } catch {
+    return false;
   }
-  displayComplete(duration) {
-    const seconds = (duration / 1e3).toFixed(1);
-    console.log("");
-    console.log(colors.success.bold(`\u2728 Complete in ${seconds}s`));
-    console.log(colors.muted(`${this.eventCount} event(s) streamed`));
-    console.log("");
+}
+async function isDockerInstalledButNotRunning() {
+  try {
+    await execa("docker", ["--version"]);
+    return true;
+  } catch {
+    return false;
   }
-  displayBox(title, content) {
-    const box = this.makeRoundedBox(title, 60, colors.accent);
-    console.log(box);
-    const lines = content.split("\n");
-    for (const line of lines) {
-      const padded = line.substring(0, 56).padEnd(56);
-      console.log(`  ${padded}`);
-    }
-    console.log("");
+}
+function dockerDesktopExists() {
+  return existsSync(DOCKER_DESKTOP_APP_PATH);
+}
+async function ensureHomebrew() {
+  try {
+    await execa("which", ["brew"]);
+    log.dim("Homebrew is already installed.");
+    return;
+  } catch {
   }
-  getElapsedTime() {
-    return Date.now() - this.taskStartTime;
-  }
-  displayModeBar(current) {
-    const modes = ["PLAN", "BUILD", "BRAINSTORM"];
-    const modeConfig = {
-      PLAN: { icon: "\u{1F4CB}", color: colors.info },
-      BUILD: { icon: "\u2699\uFE0F", color: colors.success },
-      BRAINSTORM: { icon: "\u{1F4A1}", color: chalk.blue }
-    };
-    const parts = modes.map((m) => {
-      const config = modeConfig[m];
-      const label = `${config.icon} ${m}`;
-      if (m === current) {
-        return config.color.bold(label);
-      }
-      return colors.muted(label);
+  log.step("Installing Homebrew...");
+  try {
+    await execa("/bin/bash", [
+      "-c",
+      "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    ], {
+      stdio: "inherit",
+      env: { ...process.env, NONINTERACTIVE: "1" }
     });
-    console.log(parts.join(colors.muted("  \u2022  ")));
-    console.log(colors.muted("[s] switch mode"));
-    console.log("");
+  } catch {
+    throw new Error(
+      'Failed to install Homebrew automatically.\n\n  Install Homebrew manually:\n    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"\n\n  Then re-run:\n    buildwithnexus init'
+    );
   }
-  displayModeHeader(mode) {
-    const config = {
-      PLAN: {
-        icon: "\u{1F4CB}",
-        desc: "Break down and review steps",
-        color: colors.info
-      },
-      BUILD: {
-        icon: "\u2699\uFE0F",
-        desc: "Execute with live streaming",
-        color: colors.success
-      },
-      BRAINSTORM: {
-        icon: "\u{1F4A1}",
-        desc: "Free-form Q&A and exploration",
-        color: chalk.blue
-      }
-    };
-    const c = config[mode];
-    console.log("");
-    console.log(c.color.bold(`${c.icon} ${mode}`));
-    console.log(colors.muted(c.desc));
-    console.log("");
+  try {
+    await execa("which", ["brew"]);
+  } catch {
+    const armPath = "/opt/homebrew/bin";
+    const intelPath = "/usr/local/bin";
+    process.env.PATH = `${armPath}:${intelPath}:${process.env.PATH}`;
+    log.dim("Added Homebrew paths to PATH for this session.");
   }
-  displaySuggestedMode(mode, task) {
-    const modeColor = {
-      PLAN: colors.info,
-      BUILD: colors.success,
-      BRAINSTORM: chalk.blue
-    };
-    const taskPreview = task.length > 45 ? task.substring(0, 42) + "..." : task;
-    console.log("");
-    console.log(
-      colors.muted("Suggested: ") + modeColor[mode].bold(mode) + colors.muted(` for "${taskPreview}"`)
+  try {
+    await execa("brew", ["--version"]);
+    log.success("Homebrew installed successfully.");
+  } catch {
+    throw new Error(
+      "Homebrew was installed but is not available on PATH.\n\n  Try opening a new terminal and re-running:\n    buildwithnexus init"
     );
   }
-  displayBrainstormResponse(response) {
-    console.log("");
-    console.log(chalk.blue.bold("\u{1F4A1} Ideas & Analysis"));
-    console.log("");
-    const lines = response.split("\n");
-    for (const line of lines) {
-      if (line.trim()) {
-        console.log(`  ${chalk.white(line)}`);
+}
+async function installDocker(platform) {
+  const p = platform ?? detectPlatform();
+  switch (p.os) {
+    case "mac": {
+      if (await isDockerInstalled()) {
+        log.success("Docker is already running.");
+        return;
+      }
+      if (dockerDesktopExists()) {
+        log.step(`Docker Desktop found at ${DOCKER_DESKTOP_APP_PATH} but not running. Attempting to start...`);
+        let launched = false;
+        log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
+        try {
+          await execa("open", [DOCKER_DESKTOP_APP_PATH]);
+          launched = true;
+          log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
+        } catch {
+          log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
+        }
+        if (!launched) {
+          log.dim("Trying: open -a Docker");
+          try {
+            await execa("open", ["-a", "Docker"]);
+            launched = true;
+            log.dim("Launch command succeeded via open -a Docker");
+          } catch {
+            log.warn("Both launch attempts failed.");
+          }
+        }
+        if (launched) {
+          log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
+          try {
+            await waitForDockerDaemon(12e4);
+            return;
+          } catch {
+            log.warn("Docker Desktop was launched but the daemon did not become ready in time.");
+          }
+        } else {
+          log.warn("Could not launch Docker Desktop. Will fall back to reinstalling via Homebrew.");
+        }
       } else {
-        console.log("");
+        log.step(`Docker Desktop not found at ${DOCKER_DESKTOP_APP_PATH}.`);
       }
-    }
-    console.log("");
-  }
-  displayPermissionPrompt(message) {
-    return colors.accent.bold(message) + colors.muted(" (y/n)  ");
-  }
-  makeRoundedBox(title, width, borderColor) {
-    const lines = [];
-    const innerWidth = width - 4;
-    const titlePadded = ` ${title} `.padEnd(innerWidth).substring(0, innerWidth);
-    lines.push(borderColor("\u256D" + "\u2500".repeat(innerWidth) + "\u256E"));
-    lines.push(borderColor("\u2502") + chalk.bold(titlePadded) + borderColor("\u2502"));
-    lines.push(borderColor("\u2570" + "\u2500".repeat(innerWidth) + "\u256F"));
-    return lines.join("\n");
-  }
-  makeDoubleBox(title, content, width, borderColor) {
-    const lines = [];
-    const innerWidth = width - 4;
-    const titlePadded = ` ${title} `.padEnd(innerWidth).substring(0, innerWidth);
-    lines.push(borderColor("\u2554" + "\u2550".repeat(innerWidth) + "\u2557"));
-    lines.push(borderColor("\u2551") + chalk.bold(titlePadded) + borderColor("\u2551"));
-    lines.push(borderColor("\u2560" + "\u2550".repeat(innerWidth) + "\u2563"));
-    const contentLines = content.split("\n");
-    for (const line of contentLines) {
-      const padded = line.substring(0, innerWidth - 2).padEnd(innerWidth - 2);
-      lines.push(borderColor("\u2551") + "  " + padded + borderColor("\u2551"));
-    }
-    lines.push(borderColor("\u255A" + "\u2550".repeat(innerWidth) + "\u255D"));
-    return lines.join("\n");
-  }
-};
-var tui = new TUI();
-
-// src/cli/run-command.ts
-init_config();
-async function runCommand(task, options) {
-  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
-  tui.displayHeader(task, options.agent);
-  tui.displayConnecting();
-  try {
-    let healthOk = false;
-    try {
-      const healthResponse = await fetch(`${backendUrl}/health`);
-      healthOk = healthResponse.ok;
-    } catch {
-    }
-    if (!healthOk) {
-      console.error(
-        "Backend not responding. Start it with:\n   buildwithnexus server"
-      );
-      process.exit(1);
-    }
-    const keys = loadApiKeys();
-    const response = await fetch(`${backendUrl}/api/run`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        task,
-        agent_role: options.agent,
-        agent_goal: options.goal || "",
-        api_key: keys.anthropic || "",
-        openai_api_key: keys.openai || "",
-        google_api_key: keys.google || ""
-      })
-    });
-    if (!response.ok) {
-      console.error("Backend error");
-      console.error(await response.text());
-      process.exit(1);
-    }
-    const { run_id } = await response.json();
-    tui.displayConnected(run_id);
-    tui.displayStreamStart();
-    const eventSourceUrl = `${backendUrl}/api/stream/${run_id}`;
-    try {
-      const response2 = await fetch(eventSourceUrl);
-      const reader = response2.body?.getReader();
-      const decoder = new TextDecoder();
-      if (!reader) {
-        throw new Error("No response body");
+      log.step("Installing Docker Desktop via Homebrew...");
+      await ensureHomebrew();
+      try {
+        await execa("brew", ["install", "--cask", "docker"], {
+          stdio: "inherit",
+          timeout: 6e4
+        });
+      } catch (err) {
+        const e = err;
+        if (e.killed && e.signal === "SIGINT") {
+          throw new Error("Docker installation cancelled by user (Ctrl+C)");
+        }
+        if (e.timedOut) {
+          throw new Error(
+            "Docker installation via Homebrew timed out after 60 seconds.\n\n  The password prompt may be waiting for input. Try installing manually:\n    brew install --cask docker\n\n  After installing, re-run:\n    buildwithnexus init"
+          );
+        }
+        throw new Error(
+          "Failed to install Docker via Homebrew.\n\n  Try installing Docker Desktop manually:\n    https://www.docker.com/products/docker-desktop\n\n  After installing, re-run:\n    buildwithnexus init"
+        );
       }
-      let buffer = "";
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
-        buffer = lines.pop() || "";
-        for (const line of lines) {
-          if (line.startsWith("data: ")) {
-            try {
-              const data = JSON.parse(line.slice(6));
-              const type = data.type;
-              const content = data.data["content"] || "";
-              if (type === "done") {
-                tui.displayEvent(type, { content: "Task completed successfully" });
-                tui.displayComplete(tui.getElapsedTime());
-                process.exit(0);
-              } else if (type === "error") {
-                tui.displayError(content);
-                process.exit(1);
-              } else {
-                tui.displayEvent(type, { content });
-              }
-            } catch {
-            }
-          }
+      log.step("Launching Docker Desktop...");
+      let postInstallLaunched = false;
+      log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
+      try {
+        await execa("open", [DOCKER_DESKTOP_APP_PATH]);
+        postInstallLaunched = true;
+        log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
+      } catch {
+        log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
+      }
+      if (!postInstallLaunched) {
+        log.dim("Trying: open -a Docker");
+        try {
+          await execa("open", ["-a", "Docker"]);
+          postInstallLaunched = true;
+          log.dim("Launch command succeeded via open -a Docker");
+        } catch {
+          log.warn("Both launch attempts failed after install.");
         }
       }
-    } catch (error) {
-      console.error(
-        "\nStream error. Make sure backend is running:\n   buildwithnexus server"
-      );
-      process.exit(1);
+      if (!postInstallLaunched) {
+        throw new Error(
+          "Docker Desktop was installed but could not be started automatically.\n\n  Next steps:\n    1. Open Docker Desktop manually from your Applications folder\n    2. Wait for the whale icon to appear in the menu bar\n    3. Re-run: buildwithnexus init"
+        );
+      }
+      log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
+      await waitForDockerDaemon(12e4);
+      break;
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error("Error:", message);
-    process.exit(1);
-  }
-}
-
-// src/cli/dashboard-command.ts
-import { spawn } from "child_process";
-import { fileURLToPath } from "url";
-import path3 from "path";
-var __dirname = path3.dirname(fileURLToPath(import.meta.url));
-async function dashboardCommand(options) {
-  const port = options.port || "4201";
-  console.log(`Starting Nexus Dashboard on http://localhost:${port}
-`);
-  const dashboardPath = path3.join(__dirname, "../deep-agents/dashboard/server.js");
-  const dashboard = spawn("node", [dashboardPath], {
-    env: { ...process.env, PORT: port },
-    stdio: "inherit"
-  });
-  dashboard.on("error", (err) => {
-    console.error("Failed to start dashboard:", err);
-    process.exit(1);
-  });
-  console.log(`Dashboard ready! Open: http://localhost:${port}`);
-  console.log("Press Ctrl+C to stop\n");
+    case "linux": {
+      const linuxBinaryExists = await isDockerInstalledButNotRunning();
+      if (linuxBinaryExists) {
+        log.step("Docker is installed but the daemon is not running.");
+        log.step("Starting Docker daemon...");
+        try {
+          await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
+          log.dim("Started Docker daemon via systemctl.");
+        } catch {
+          try {
+            await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
+            log.dim("Started Docker daemon via service command.");
+          } catch {
+            throw new Error(
+              "Docker is installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
+            );
+          }
+        }
+        log.step("Waiting for Docker...");
+        await waitForDockerDaemon(3e4);
+        return;
+      }
+      log.step("Installing Docker...");
+      log.warn("This may require your sudo password.");
+      log.dim("Running official Docker install script from https://get.docker.com ...");
+      try {
+        const { stdout: script } = await execa("curl", ["-fsSL", "https://get.docker.com"]);
+        await execa("sudo", ["sh", "-c", script], { stdio: "inherit" });
+        log.success("Docker installed successfully.");
+      } catch {
+        throw new Error(
+          "Failed to install Docker on Linux.\n\n  Try installing manually:\n    curl -fsSL https://get.docker.com | sudo sh\n\n  After installing, re-run:\n    buildwithnexus init"
+        );
+      }
+      log.dim("Adding current user to docker group...");
+      try {
+        const user = (await execa("whoami")).stdout.trim();
+        await execa("sudo", ["usermod", "-aG", "docker", user]);
+        log.dim(`Added user '${user}' to docker group (may require re-login for effect).`);
+      } catch {
+        log.warn("Could not add user to docker group. You may need sudo for docker commands.");
+      }
+      log.step("Starting Docker daemon...");
+      try {
+        await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
+        log.dim("Started Docker daemon via systemctl.");
+      } catch {
+        try {
+          await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
+          log.dim("Started Docker daemon via service command.");
+        } catch {
+          throw new Error(
+            "Docker was installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
+          );
+        }
+      }
+      log.step("Waiting for Docker...");
+      await waitForDockerDaemon(3e4);
+      break;
+    }
+    case "windows": {
+      const winBinaryExists = await isDockerInstalledButNotRunning();
+      if (winBinaryExists) {
+        log.step("Docker Desktop is installed but not running. Attempting to start...");
+        log.step("Launching Docker...");
+        try {
+          await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
+          log.dim("Docker Desktop launch command sent.");
+        } catch {
+          log.warn("Could not launch Docker Desktop automatically. It may need to be started manually.");
+        }
+        log.step("Waiting for Docker...");
+        try {
+          await waitForDockerDaemon(12e4);
+        } catch {
+          throw new Error(
+            "Docker Desktop did not start within 120 seconds.\n\n  Next steps:\n    1. Open Docker Desktop manually from the Start Menu\n    2. Wait for the whale icon to appear in the system tray\n    3. Re-run: buildwithnexus init"
+          );
+        }
+        return;
+      }
+      log.step("Installing Docker Desktop...");
+      let installed = false;
+      try {
+        await execa("choco", ["--version"]);
+        log.dim("Chocolatey detected. Installing Docker Desktop via choco...");
+        try {
+          await execa("choco", ["install", "docker-desktop", "-y"], { stdio: "inherit" });
+          installed = true;
+          log.success("Docker Desktop installed via Chocolatey.");
+        } catch {
+          log.warn("Chocolatey install failed. Falling back to direct download...");
+        }
+      } catch {
+        log.dim("Chocolatey not found. Using direct download...");
+      }
+      if (!installed) {
+        log.dim("Downloading Docker Desktop installer from docker.com...");
+        try {
+          await execa("powershell", [
+            "-Command",
+            "Invoke-WebRequest -Uri 'https://desktop.docker.com/win/main/amd64/Docker Desktop Installer.exe' -OutFile '$env:TEMP\\DockerInstaller.exe'; & '$env:TEMP\\DockerInstaller.exe' Install --quiet; Remove-Item '$env:TEMP\\DockerInstaller.exe' -Force -ErrorAction SilentlyContinue"
+          ], { stdio: "inherit" });
+          installed = true;
+          log.success("Docker Desktop installed via direct download.");
+        } catch {
+          throw new Error(
+            "Failed to install Docker Desktop on Windows.\n\n  Please install Docker Desktop manually:\n    1. Download from https://www.docker.com/products/docker-desktop\n    2. Run the installer and follow the prompts\n    3. Start Docker Desktop\n    4. Re-run: buildwithnexus init"
+          );
+        }
+      }
+      log.step("Launching Docker...");
+      try {
+        await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
+        log.dim("Docker Desktop launch command sent.");
+      } catch {
+        log.warn("Could not launch Docker Desktop automatically after install.");
+      }
+      log.step("Waiting for Docker...");
+      try {
+        await waitForDockerDaemon(12e4);
+      } catch {
+        throw new Error(
+          "Docker Desktop was installed but did not start within 120 seconds.\n\n  Next steps:\n    1. You may need to restart your computer for Docker to work\n    2. Open Docker Desktop from the Start Menu\n    3. Wait for the whale icon to appear in the system tray\n    4. Re-run: buildwithnexus init"
+        );
+      }
+      break;
+    }
+    default:
+      throw new Error(`Unsupported platform: ${p.os}`);
+  }
 }
+async function waitForDockerDaemon(timeoutMs) {
+  const start = Date.now();
+  log.step("Waiting for Docker daemon...");
+  while (Date.now() - start < timeoutMs) {
+    try {
+      await execa("docker", ["info"]);
+      log.success("Docker daemon is ready");
+      return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 3e3));
+  }
+  throw new Error(
+    `Docker daemon did not become ready within ${Math.round(timeoutMs / 1e3)}s.
 
-// src/cli/interactive.ts
-import * as readline2 from "readline";
-import chalk2 from "chalk";
+  Please ensure Docker is running, then re-run:
+    buildwithnexus init`
+  );
+}
+async function imageExistsLocally(image, tag) {
+  const ref = `${image}:${tag}`;
+  try {
+    await execa("docker", ["image", "inspect", ref]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pullImage(image, tag) {
+  const ref = `${image}:${tag}`;
+  log.step(`Pulling image ${ref}...`);
+  try {
+    await execa("docker", ["pull", ref], { stdio: "inherit" });
+    log.success(`Image ${ref} pulled`);
+  } catch (err) {
+    log.error(`Failed to pull image ${ref}`);
+    throw err;
+  }
+}
+async function startNexus(keys, config) {
+  log.step("Starting NEXUS container...");
+  try {
+    await execa("docker", [
+      "run",
+      "-d",
+      "--name",
+      CONTAINER_NAME,
+      "-e",
+      `ANTHROPIC_API_KEY=${keys.anthropic}`,
+      "-e",
+      `OPENAI_API_KEY=${keys.openai}`,
+      "-p",
+      `${config.port}:${config.port}`,
+      "buildwithnexus/nexus:latest"
+    ]);
+    log.success(`NEXUS container started on port ${config.port}`);
+  } catch (err) {
+    log.error("Failed to start NEXUS container");
+    throw err;
+  }
+}
+async function stopNexus() {
+  log.step("Stopping NEXUS container...");
+  try {
+    await execa("docker", ["rm", "-f", CONTAINER_NAME]);
+    log.success("NEXUS container stopped and removed");
+  } catch (err) {
+    log.error("Failed to stop NEXUS container");
+    throw err;
+  }
+}
+async function dockerExec(command) {
+  try {
+    const { stdout, stderr } = await execa("docker", ["exec", CONTAINER_NAME, "sh", "-c", command]);
+    return { stdout, stderr, code: 0 };
+  } catch (err) {
+    const e = err;
+    return { stdout: e.stdout ?? "", stderr: e.stderr ?? "", code: e.exitCode ?? 1 };
+  }
+}
+async function startBackend() {
+  const { spawn: spawn2 } = await import("child_process");
+  const os5 = await import("os");
+  const path11 = await import("path");
+  const nexusDir = path11.join(os5.homedir(), "Projects", "nexus");
+  log.step(`Starting Nexus backend from ${nexusDir}...`);
+  const child = spawn2("python", ["-m", "src.deep_agents_server"], {
+    cwd: nexusDir,
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env }
+  });
+  child.unref();
+  log.success("Nexus backend process started");
+}
+async function launchNexus(keys, config, opts) {
+  const { healthTimeoutMs = 6e4, stopExisting = true } = opts ?? {};
+  if (stopExisting && await isNexusRunning()) {
+    await stopNexus();
+  }
+  await startNexus(keys, config);
+  if (healthTimeoutMs <= 0) return true;
+  const { waitForServer: waitForServer2 } = await Promise.resolve().then(() => (init_health(), health_exports));
+  return waitForServer2(healthTimeoutMs);
+}
+async function isNexusRunning() {
+  try {
+    const { stdout } = await execa("docker", [
+      "ps",
+      "--filter",
+      `name=^/${CONTAINER_NAME}$`,
+      "--format",
+      "{{.Names}}"
+    ]);
+    return stdout.trim() === CONTAINER_NAME;
+  } catch {
+    return false;
+  }
+}
+var CONTAINER_NAME, DOCKER_DESKTOP_APP_PATH;
+var init_docker = __esm({
+  "src/core/docker.ts"() {
+    "use strict";
+    init_logger();
+    init_platform();
+    CONTAINER_NAME = "nexus";
+    DOCKER_DESKTOP_APP_PATH = "/Applications/Docker.app";
+  }
+});
 
-// src/cli/intent-classifier.ts
-var PLAN_KEYWORDS = [
-  "design",
-  "plan",
-  "architect",
-  "structure",
-  "outline",
-  "roadmap",
-  "strategy",
-  "organize",
-  "breakdown",
-  "scope",
-  "model",
-  "schema"
-];
-var BUILD_KEYWORDS = [
-  "build",
-  "create",
-  "make",
-  "write",
-  "implement",
-  "code",
-  "generate",
-  "add",
-  "fix",
-  "update",
-  "deploy",
-  "run",
-  "start",
-  "launch",
-  "install",
-  "set up",
-  "setup",
-  "refactor",
-  "migrate"
-];
-var BRAINSTORM_KEYWORDS = [
-  "what",
-  "should",
-  "idea",
-  "ideas",
-  "think",
-  "consider",
-  "suggest",
-  "brainstorm",
-  "explore",
-  "wonder",
-  "might",
-  "could",
-  "would",
-  "how about",
-  "what if",
-  "options",
-  "alternatives",
-  "thoughts"
-];
-function classifyIntent(task) {
-  const lower = task.toLowerCase().trim();
-  let planScore = 0;
-  let buildScore = 0;
-  let brainstormScore = 0;
-  for (const kw of PLAN_KEYWORDS) {
-    if (lower.includes(kw)) planScore++;
+// src/ui/banner.ts
+var banner_exports = {};
+__export(banner_exports, {
+  showCompletion: () => showCompletion,
+  showPhase: () => showPhase,
+  showSecurityPosture: () => showSecurityPosture
+});
+import chalk5 from "chalk";
+function showPhase(phase, total, description) {
+  const progress = chalk5.cyan(`[${phase}/${total}]`);
+  console.log(`
+${progress} ${chalk5.bold(description)}`);
+}
+function showSecurityPosture() {
+  const lines = [
+    "",
+    chalk5.bold("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
+    chalk5.bold("  \u2551  ") + chalk5.bold.green("Security Posture") + chalk5.bold("                                        \u2551"),
+    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Triple-nested isolation: Host \u2192 VM \u2192 Docker \u2192 KVM".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Network hardened: UFW deny-all, allow 22/80/443/4200".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" All databases encrypted at rest (AES-256-CBC)".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" API keys never embedded in VM \u2014 delivered via SCP".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" SSH-only communication (no exposed network ports)".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" DLP: secret detection, shell escaping, output redaction".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" HMAC integrity verification on all key files".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2551  ") + chalk5.green("\u2713") + chalk5.white(" Docker: --read-only, no-new-privileges, cap-drop=ALL".padEnd(54)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.bold("  \u2551  ") + chalk5.dim("Full details: https://buildwithnexus.dev/security".padEnd(55)) + chalk5.bold("\u2551"),
+    chalk5.bold("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
+    ""
+  ];
+  console.log(lines.join("\n"));
+}
+function showCompletion(urls) {
+  const lines = [
+    "",
+    chalk5.green("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"),
+    chalk5.green("  \u2551  ") + chalk5.bold.green("NEXUS Runtime is Live!") + chalk5.green("                                 \u2551"),
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.white(`Connect:    ${urls.ssh}`.padEnd(55)) + chalk5.green("\u2551")
+  ];
+  if (urls.remote) {
+    lines.push(chalk5.green("  \u2551  ") + chalk5.white(`Remote:     ${urls.remote}`.padEnd(55)) + chalk5.green("\u2551"));
   }
-  for (const kw of BUILD_KEYWORDS) {
-    if (lower.includes(kw)) buildScore++;
+  lines.push(
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.dim("Quick Start:".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus           - Interactive shell".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus brainstorm - Brainstorm ideas".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus status    - Check health".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"),
+    chalk5.green("  \u2551  ") + chalk5.dim("All commands:".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u2551  ") + chalk5.white("  buildwithnexus stop/start/update/logs/ssh/destroy".padEnd(55)) + chalk5.green("\u2551"),
+    chalk5.green("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"),
+    ""
+  );
+  console.log(lines.join("\n"));
+}
+var init_banner = __esm({
+  "src/ui/banner.ts"() {
+    "use strict";
+  }
+});
+
+// src/bin.ts
+init_init_command();
+import { program } from "commander";
+
+// src/cli/tui.ts
+import chalk from "chalk";
+import stringWidth from "string-width";
+var colors = {
+  accent: chalk.hex("#7D56F4"),
+  // Brand purple
+  success: chalk.hex("#00FF87"),
+  // Bright green
+  warning: chalk.hex("#FFB86C"),
+  // Amber
+  info: chalk.hex("#8BE9FD"),
+  // Cyan
+  muted: chalk.gray,
+  // Adaptive gray
+  error: chalk.red
+};
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var STATUS_SYMBOLS = {
+  done: colors.success("\u2714"),
+  active: colors.info("\u25C9"),
+  pending: colors.muted("\u25CB"),
+  error: colors.error("\u2716")
+};
+var TUI = class {
+  taskStartTime = 0;
+  eventCount = 0;
+  spinnerIndex = 0;
+  getSpinner() {
+    const frame = SPINNER_FRAMES[this.spinnerIndex % SPINNER_FRAMES.length];
+    this.spinnerIndex++;
+    return frame;
   }
-  for (const kw of BRAINSTORM_KEYWORDS) {
-    if (lower.includes(kw)) brainstormScore++;
+  displayHeader(task, agent) {
+    console.clear();
+    const headerBox = this.makeRoundedBox(
+      colors.accent("\u{1F680} NEXUS - Autonomous Agent Orchestration"),
+      62,
+      colors.accent
+    );
+    console.log(headerBox);
+    console.log("");
+    console.log(colors.muted("Task") + colors.muted(":  ") + chalk.white(task));
+    console.log(colors.muted("Agent") + colors.muted(": ") + colors.info(agent));
+    console.log("");
+    this.taskStartTime = Date.now();
   }
-  const wordCount = lower.split(/\s+/).length;
-  if (wordCount > 12 && planScore === buildScore && buildScore === brainstormScore) {
-    return "plan";
+  displayConnecting() {
+    console.log(`${this.getSpinner()} ${colors.warning("Connecting to backend...")}`);
   }
-  if (brainstormScore > planScore && brainstormScore > buildScore) return "brainstorm";
-  if (buildScore > planScore && buildScore > brainstormScore) return "build";
-  if (planScore > 0) return "plan";
-  return wordCount > 6 ? "plan" : "build";
-}
-
-// src/cli/interactive.ts
-init_config();
-async function interactiveMode() {
-  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
-  console.log(chalk2.cyan("\n\u{1F527} Configure API Keys\n"));
-  const { deepAgentsInitCommand: deepAgentsInitCommand2 } = await Promise.resolve().then(() => (init_init_command(), init_command_exports));
-  await deepAgentsInitCommand2();
-  reloadEnv();
-  if (!hasAnyKey()) {
-    console.error("Error: At least one API key is required to use buildwithnexus.");
-    process.exit(1);
+  displayConnected(runId) {
+    console.log(`${STATUS_SYMBOLS.done} Connected \u2022 ${colors.muted(`run: ${runId}`)}`);
+    console.log("");
   }
-  const keys = loadApiKeys();
-  console.log(chalk2.green("\n\u2713 Keys configured!"));
-  console.log(chalk2.gray(`  Anthropic: ${keys.anthropic ? "\u2713" : "\u2717"}`));
-  console.log(chalk2.gray(`  OpenAI: ${keys.openai ? "\u2713" : "\u2717"}`));
-  console.log(chalk2.gray(`  Google: ${keys.google ? "\u2713" : "\u2717"}
-`));
-  try {
-    const response = await fetch(`${backendUrl}/health`);
-    if (!response.ok) {
-      console.error(chalk2.red("\u274C Backend not running. Start it with: buildwithnexus server"));
-      process.exit(1);
-    }
-  } catch {
-    console.error(chalk2.red("\u274C Cannot connect to backend at " + backendUrl));
-    process.exit(1);
+  displayStreamStart() {
+    console.log(chalk.bold(colors.accent("\u{1F4E1} Streaming Events")));
+    console.log("");
   }
-  const rl = readline2.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
-  console.clear();
-  console.log(chalk2.gray("Welcome! Describe what you want the AI agents to do."));
-  console.log(chalk2.gray('Type "exit" to quit.\n'));
-  while (true) {
-    const task = await ask(chalk2.bold.blue("\u{1F4DD} Task: "));
-    if (task.toLowerCase() === "exit") {
-      console.log(chalk2.yellow("\nGoodbye! \u{1F44B}\n"));
-      rl.close();
-      process.exit(0);
-    }
-    if (!task.trim()) {
-      console.log(chalk2.red("Please enter a task.\n"));
-      continue;
-    }
-    const suggestedMode = classifyIntent(task).toUpperCase();
-    tui.displaySuggestedMode(suggestedMode, task);
-    const currentMode = await selectMode(suggestedMode, ask);
-    await runModeLoop(currentMode, task, backendUrl, rl, ask);
+  displayPlan(task, steps) {
+    console.log("");
+    const planHeader = colors.accent("Plan Breakdown");
+    const planLines = [];
+    steps.forEach((step, i) => {
+      planLines.push(`  ${STATUS_SYMBOLS.pending}  ${chalk.white(`Step ${i + 1}:`)} ${step}`);
+    });
+    const planBox = this.makeDoubleBox(planHeader, planLines.join("\n"), 62, colors.accent);
+    console.log(planBox);
     console.log("");
   }
-}
-async function selectMode(suggested, ask) {
-  const modeColor = {
-    PLAN: chalk2.cyan,
-    BUILD: chalk2.green,
-    BRAINSTORM: chalk2.blue
-  };
-  console.log("");
-  console.log(
-    chalk2.gray("Press ") + chalk2.bold("Enter") + chalk2.gray(" to use ") + modeColor[suggested](suggested) + chalk2.gray(" or type ") + chalk2.bold("plan") + chalk2.gray("/") + chalk2.bold("build") + chalk2.gray("/") + chalk2.bold("brainstorm") + chalk2.gray(" to switch: ")
-  );
-  const answer = await ask(chalk2.gray("> "));
-  const lower = answer.trim().toLowerCase();
-  if (lower === "p" || lower === "plan") return "PLAN";
-  if (lower === "b" || lower === "build") return "BUILD";
-  if (lower === "br" || lower === "brainstorm") return "BRAINSTORM";
-  return suggested;
-}
-async function runModeLoop(mode, task, backendUrl, rl, ask) {
-  let currentMode = mode;
-  while (true) {
-    console.clear();
-    printAppHeader();
-    tui.displayModeBar(currentMode);
-    tui.displayModeHeader(currentMode);
-    if (currentMode === "PLAN") {
-      const next = await planModeLoop(task, backendUrl, rl, ask);
-      if (next === "BUILD") {
-        currentMode = "BUILD";
-        continue;
-      }
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
-      }
+  displayEvent(type, data) {
+    this.eventCount++;
+    const content = data["content"] || "";
+    if (type === "agent_working") {
+      const agent = data["agent"] || "Agent";
+      const agentTask = data["task"] || "";
+      console.log("");
+      console.log(`  ${colors.info("\u{1F464}")} ${colors.info(chalk.bold(agent))}`);
+      console.log(`     ${colors.muted("\u2192")} ${agentTask}`);
       return;
     }
-    if (currentMode === "BUILD") {
-      const next = await buildModeLoop(task, backendUrl, rl, ask);
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
+    if (type === "agent_result") {
+      const result = data["result"] || "";
+      let displayResult = result;
+      if (displayResult.length > 100) {
+        displayResult = displayResult.substring(0, 97) + "...";
       }
+      console.log(`  ${STATUS_SYMBOLS.done} ${chalk.white(displayResult)}`);
       return;
     }
-    if (currentMode === "BRAINSTORM") {
-      const next = await brainstormModeLoop(task, backendUrl, rl, ask);
-      if (next === "switch") {
-        currentMode = await promptModeSwitch(currentMode, ask);
-        continue;
-      }
-      return;
+    const eventConfig = {
+      thought: { icon: "\u{1F4AD}", color: colors.info },
+      action: { icon: "\u26A1", color: colors.warning },
+      observation: { icon: "\u2713", color: colors.success },
+      started: { icon: "\u25B6", color: colors.info },
+      done: { icon: "\u2728", color: colors.success },
+      execution_complete: { icon: "\u2728", color: colors.success },
+      error: { icon: "\u2716", color: colors.error }
+    };
+    const config = eventConfig[type] || { icon: "\u25CF", color: colors.muted };
+    let displayContent = content;
+    if (displayContent.length > 100) {
+      displayContent = displayContent.substring(0, 97) + "...";
     }
+    console.log(`  ${config.icon} ${config.color(displayContent)}`);
   }
-}
-function printAppHeader() {
-  console.log(chalk2.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  console.log(
-    chalk2.cyan("\u2551") + chalk2.bold.white("        \u{1F680} Nexus - Autonomous Agent Orchestration             ") + chalk2.cyan("\u2551")
-  );
-  console.log(chalk2.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
-  console.log("");
-}
-async function promptModeSwitch(current, ask) {
-  const others = ["PLAN", "BUILD", "BRAINSTORM"].filter((m) => m !== current);
-  console.log("");
-  console.log(
-    chalk2.gray("Switch to: ") + others.map((m, i) => chalk2.bold(`[${i + 1}] ${m}`)).join(chalk2.gray("  ")) + chalk2.gray("  [Enter to stay in ") + chalk2.bold(current) + chalk2.gray("]")
-  );
-  const answer = await ask(chalk2.gray("> "));
-  const n = parseInt(answer.trim(), 10);
-  if (n === 1) return others[0];
-  if (n === 2) return others[1];
-  return current;
-}
-async function planModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Task:"), chalk2.white(task));
-  console.log("");
-  console.log(chalk2.yellow("\u23F3 Fetching plan from backend..."));
-  let steps = [];
-  const keys = loadApiKeys();
-  try {
-    const response = await fetch(`${backendUrl}/api/run`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" })
-    });
-    if (!response.ok) {
-      console.error(chalk2.red("Backend error \u2014 cannot fetch plan."));
-      return "cancel";
-    }
-    const { run_id } = await response.json();
-    tui.displayConnected(run_id);
-    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-    const reader = streamResponse.body?.getReader();
-    const decoder = new TextDecoder();
-    if (!reader) throw new Error("No response body");
-    let buffer = "";
-    let planReceived = false;
-    outer: while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.startsWith("data: ")) continue;
-        try {
-          const parsed = JSON.parse(line.slice(6));
-          if (parsed.type === "plan") {
-            steps = parsed.data["steps"] || [];
-            planReceived = true;
-            break outer;
-          } else if (parsed.type === "error") {
-            const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
-            tui.displayError(errorMsg);
-            return "cancel";
-          }
-        } catch {
-        }
-      }
-    }
-    reader.cancel();
-    if (!planReceived || steps.length === 0) {
-      console.log(chalk2.yellow("No plan received from backend."));
-      steps = ["(no steps returned \u2014 execute anyway?)"];
+  displayResults(summary, todosCompleted) {
+    console.log("");
+    console.log(colors.success("\u2501".repeat(60)));
+    console.log(colors.success.bold("\u2728 Execution Complete"));
+    console.log("");
+    const lines = summary.split("\n");
+    for (const line of lines) {
+      console.log(`  ${colors.success("\u2502")} ${chalk.white(line)}`);
     }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk2.red("Error: " + msg));
-    return "cancel";
+    console.log("");
+    console.log(`  ${colors.muted(`${todosCompleted} subtask(s) completed`)}`);
+    console.log("");
   }
-  displayPlanSteps(steps);
-  while (true) {
-    console.log(chalk2.gray("Options: ") + chalk2.bold("[Y]") + chalk2.gray(" Execute  ") + chalk2.bold("[e]") + chalk2.gray(" Edit step  ") + chalk2.bold("[s]") + chalk2.gray(" Switch mode  ") + chalk2.bold("[Esc/n]") + chalk2.gray(" Cancel"));
-    const answer = (await ask(tui.displayPermissionPrompt("Execute this plan?"))).trim().toLowerCase();
-    if (answer === "" || answer === "y") {
-      return "BUILD";
-    }
-    if (answer === "n" || answer === "\x1B") {
-      console.log(chalk2.yellow("\nExecution cancelled.\n"));
-      return "cancel";
-    }
-    if (answer === "e" || answer === "edit") {
-      steps = await editPlanSteps(steps, ask);
-      displayPlanSteps(steps);
-      continue;
-    }
-    if (answer === "s" || answer === "switch") {
-      return "switch";
-    }
+  displayError(error) {
+    console.log("");
+    console.log(colors.error("\u274C Error"));
+    console.log(colors.error(error));
+    console.log("");
   }
-}
-function displayPlanSteps(steps) {
-  console.log("");
-  console.log(chalk2.bold.cyan("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  console.log(chalk2.bold.cyan("\u2502") + chalk2.bold.white("  \u{1F4CB} Execution Plan                                      ") + chalk2.bold.cyan("\u2502"));
-  console.log(chalk2.bold.cyan("\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  steps.forEach((step, i) => {
-    const label = `  Step ${i + 1}: `;
-    const maxContentWidth = 57 - label.length;
-    const truncated = step.length > maxContentWidth ? step.substring(0, maxContentWidth - 3) + "..." : step;
-    const line = label + truncated;
-    const padded = line.padEnd(57);
-    console.log(chalk2.bold.cyan("\u2502") + chalk2.white(padded) + chalk2.bold.cyan("\u2502"));
-  });
-  console.log(chalk2.bold.cyan("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-  console.log("");
-}
-async function editPlanSteps(steps, ask) {
-  console.log(chalk2.gray("Enter step number to edit, or press Enter to finish editing:"));
-  const numStr = await ask(chalk2.bold("Step #: "));
-  const n = parseInt(numStr.trim(), 10);
-  if (!isNaN(n) && n >= 1 && n <= steps.length) {
-    console.log(chalk2.gray(`Current: ${steps[n - 1]}`));
-    const updated = await ask(chalk2.bold("New text: "));
-    if (updated.trim()) steps[n - 1] = updated.trim();
+  displayComplete(duration) {
+    const seconds = (duration / 1e3).toFixed(1);
+    console.log("");
+    console.log(colors.success.bold(`\u2728 Complete in ${seconds}s`));
+    console.log(colors.muted(`${this.eventCount} event(s) streamed`));
+    console.log("");
+  }
+  displayBox(title, content) {
+    const box = this.makeRoundedBox(title, 60, colors.accent);
+    console.log(box);
+    const lines = content.split("\n");
+    for (const line of lines) {
+      const padded = line.substring(0, 56).padEnd(56);
+      console.log(`  ${padded}`);
+    }
+    console.log("");
   }
-  return steps;
-}
-async function buildModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Task:"), chalk2.white(task));
-  tui.displayConnecting();
-  const keys = loadApiKeys();
-  try {
-    const response = await fetch(`${backendUrl}/api/run`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ task, agent_role: "engineer", agent_goal: "", api_key: keys.anthropic || "", openai_api_key: keys.openai || "", google_api_key: keys.google || "" })
+  getElapsedTime() {
+    return Date.now() - this.taskStartTime;
+  }
+  displayModeBar(current) {
+    const modes = ["PLAN", "BUILD", "BRAINSTORM"];
+    const modeConfig = {
+      PLAN: { icon: "\u{1F4CB}", color: colors.info },
+      BUILD: { icon: "\u2699\uFE0F", color: colors.success },
+      BRAINSTORM: { icon: "\u{1F4A1}", color: chalk.blue }
+    };
+    const parts = modes.map((m) => {
+      const config = modeConfig[m];
+      const label = `${config.icon} ${m}`;
+      if (m === current) {
+        return config.color.bold(label);
+      }
+      return colors.muted(label);
     });
-    if (!response.ok) {
-      console.error(chalk2.red("Backend error"));
-      return "done";
-    }
-    const { run_id } = await response.json();
-    tui.displayConnected(run_id);
-    console.log(chalk2.bold.green("\u2699\uFE0F  Executing..."));
-    tui.displayStreamStart();
-    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-    const reader = streamResponse.body?.getReader();
-    const decoder = new TextDecoder();
-    if (!reader) throw new Error("No response body");
-    let buffer = "";
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.startsWith("data: ")) continue;
-        try {
-          const parsed = JSON.parse(line.slice(6));
-          const type = parsed.type;
-          if (type === "execution_complete") {
-            const summary = parsed.data["summary"] || "";
-            const count = parsed.data["todos_completed"] || 0;
-            tui.displayResults(summary, count);
-            tui.displayComplete(tui.getElapsedTime());
-            break;
-          } else if (type === "done") {
-            tui.displayEvent(type, { content: "Task completed successfully" });
-            tui.displayComplete(tui.getElapsedTime());
-            break;
-          } else if (type === "error") {
-            const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
-            tui.displayError(errorMsg);
-            break;
-          } else if (type !== "plan") {
-            tui.displayEvent(type, parsed.data);
-          }
-        } catch {
-        }
+    console.log(parts.join(colors.muted("  \u2022  ")));
+    console.log(colors.muted("[s] switch mode"));
+    console.log("");
+  }
+  displayModeHeader(mode) {
+    const config = {
+      PLAN: {
+        icon: "\u{1F4CB}",
+        desc: "Break down and review steps",
+        color: colors.info
+      },
+      BUILD: {
+        icon: "\u2699\uFE0F",
+        desc: "Execute with live streaming",
+        color: colors.success
+      },
+      BRAINSTORM: {
+        icon: "\u{1F4A1}",
+        desc: "Free-form Q&A and exploration",
+        color: chalk.blue
       }
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk2.red("Error: " + msg));
+    };
+    const c = config[mode];
+    console.log("");
+    console.log(c.color.bold(`${c.icon} ${mode}`));
+    console.log(colors.muted(c.desc));
+    console.log("");
   }
-  console.log("");
-  console.log(
-    chalk2.gray("Options: ") + chalk2.bold("[Enter]") + chalk2.gray(" Done  ") + chalk2.bold("[s]") + chalk2.gray(" Switch mode")
-  );
-  const answer = (await ask(chalk2.bold("> "))).trim().toLowerCase();
-  if (answer === "s" || answer === "switch") return "switch";
-  return "done";
-}
-async function brainstormModeLoop(task, backendUrl, rl, ask) {
-  console.log(chalk2.bold("Starting topic:"), chalk2.white(task));
-  console.log(chalk2.gray('Ask follow-up questions. Type "done" to exit, "switch" to change mode.\n'));
-  let currentQuestion = task;
-  while (true) {
-    console.log(chalk2.bold.blue("\u{1F4A1} Thinking..."));
-    try {
-      const keys = loadApiKeys();
-      const response = await fetch(`${backendUrl}/api/run`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          task: currentQuestion,
-          agent_role: "brainstorm",
-          agent_goal: "Generate ideas, considerations, and suggestions. Be concise and helpful.",
-          api_key: keys.anthropic || "",
-          openai_api_key: keys.openai || "",
-          google_api_key: keys.google || ""
-        })
-      });
-      if (response.ok) {
-        const { run_id } = await response.json();
-        const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`);
-        const reader = streamResponse.body?.getReader();
-        const decoder = new TextDecoder();
-        if (reader) {
-          let buffer = "";
-          let responseText = "";
-          outer: while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split("\n");
-            buffer = lines.pop() || "";
-            for (const line of lines) {
-              if (!line.startsWith("data: ")) continue;
-              try {
-                const parsed = JSON.parse(line.slice(6));
-                const type = parsed.type;
-                const data = parsed.data;
-                if (type === "done" || type === "execution_complete") {
-                  const summary = data["summary"] || "";
-                  if (summary) responseText = summary;
-                  break outer;
-                } else if (type === "error") {
-                  const errorMsg = data["error"] || data["content"] || "Unknown error";
-                  responseText += errorMsg + "\n";
-                  break outer;
-                } else if (type === "thought" || type === "observation") {
-                  const content = data["content"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "agent_response" || type === "agent_result") {
-                  const content = data["content"] || data["result"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "action") {
-                  const content = data["content"] || "";
-                  if (content) responseText += content + "\n";
-                } else if (type === "agent_working") {
-                } else if (type !== "plan") {
-                  const content = data["content"] || data["response"] || "";
-                  if (content) responseText += content + "\n";
-                }
-              } catch {
-              }
-            }
-          }
-          reader.cancel();
-          if (responseText.trim()) {
-            tui.displayBrainstormResponse(responseText.trim());
-          } else {
-            console.log(chalk2.gray("(No response received from agent)"));
-          }
-        }
+  displaySuggestedMode(mode, task) {
+    const modeColor = {
+      PLAN: colors.info,
+      BUILD: colors.success,
+      BRAINSTORM: chalk.blue
+    };
+    const taskPreview = task.length > 45 ? task.substring(0, 42) + "..." : task;
+    console.log("");
+    console.log(
+      colors.muted("Suggested: ") + modeColor[mode].bold(mode) + colors.muted(` for "${taskPreview}"`)
+    );
+  }
+  displayBrainstormResponse(response) {
+    console.log("");
+    console.log(chalk.blue.bold("\u{1F4A1} Ideas & Analysis"));
+    console.log("");
+    const lines = response.split("\n");
+    for (const line of lines) {
+      if (line.trim()) {
+        console.log(`  ${chalk.white(line)}`);
       } else {
-        console.log(chalk2.red("Could not reach backend for brainstorm response."));
+        console.log("");
       }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(chalk2.red("Error: " + msg));
     }
-    const followUp = await ask(chalk2.bold.blue("\u{1F4AC} You: "));
-    const lower = followUp.trim().toLowerCase();
-    if (lower === "done" || lower === "exit") return "done";
-    if (lower === "switch") return "switch";
-    if (!followUp.trim()) continue;
-    currentQuestion = followUp.trim();
+    console.log("");
   }
-}
-
-// src/cli.ts
-import { Command as Command15 } from "commander";
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-
-// src/commands/install.ts
-import { Command } from "commander";
-import { execa as execa2 } from "execa";
-
-// src/ui/spinner.ts
-import ora from "ora";
-import chalk3 from "chalk";
-function createSpinner(text) {
-  return ora({ text, color: "cyan", spinner: "dots" });
-}
-function succeed(spinner, text) {
-  spinner.succeed(chalk3.green(text));
-}
-function fail(spinner, text) {
-  spinner.fail(chalk3.red(text));
-}
-
-// src/ui/logger.ts
-import chalk4 from "chalk";
-var log = {
-  step(msg) {
-    console.log(chalk4.cyan("  \u2192 ") + msg);
-  },
-  success(msg) {
-    console.log(chalk4.green("  \u2713 ") + msg);
-  },
-  error(msg) {
-    console.error(chalk4.red("  \u2717 ") + msg);
-  },
-  warn(msg) {
-    console.log(chalk4.yellow("  \u26A0 ") + msg);
-  },
-  dim(msg) {
-    console.log(chalk4.dim("    " + msg));
-  },
-  detail(label, value) {
-    console.log(chalk4.dim("    " + label + ": ") + value);
-  },
-  progress(current, total, label) {
-    const pct = Math.round(current / total * 100);
-    const filled = Math.round(current / total * 20);
-    const bar = chalk4.cyan("\u2588".repeat(filled)) + chalk4.dim("\u2591".repeat(20 - filled));
-    process.stdout.write(`\r  [${bar}] ${chalk4.bold(`${pct}%`)} ${chalk4.dim(label)}`);
-    if (current >= total) process.stdout.write("\n");
+  displayPermissionPrompt(message) {
+    return colors.accent.bold(message) + colors.muted(" (y/n)  ");
   }
-};
-
-// src/core/platform.ts
-import os3 from "os";
-function detectPlatform() {
-  const platform = os3.platform();
-  const arch = os3.arch();
-  if (platform === "darwin") {
-    return {
-      os: "mac",
-      arch: arch === "arm64" ? "arm64" : "x64",
-      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
-    };
+  padToWidth(text, targetWidth) {
+    const visibleWidth = stringWidth(text);
+    const padding = Math.max(0, targetWidth - visibleWidth);
+    return text + " ".repeat(padding);
   }
-  if (platform === "linux") {
-    return {
-      os: "linux",
-      arch: arch === "arm64" ? "arm64" : "x64",
-      dockerPlatform: arch === "arm64" ? "linux/arm64" : "linux/amd64"
-    };
+  truncateToWidth(text, maxWidth) {
+    let result = "";
+    let width = 0;
+    for (const char of text) {
+      const charWidth = stringWidth(char);
+      if (width + charWidth > maxWidth) break;
+      result += char;
+      width += charWidth;
+    }
+    return result;
   }
-  if (platform === "win32") {
-    return {
-      os: "windows",
-      arch: "x64",
-      dockerPlatform: "linux/amd64"
-    };
+  makeRoundedBox(title, width, borderColor) {
+    const lines = [];
+    const innerWidth = width - 4;
+    const titleText = ` ${title} `;
+    const titleTruncated = this.truncateToWidth(titleText, innerWidth);
+    const titlePadded = this.padToWidth(titleTruncated, innerWidth);
+    lines.push(borderColor("\u256D" + "\u2500".repeat(innerWidth) + "\u256E"));
+    lines.push(borderColor("\u2502") + chalk.bold(titlePadded) + borderColor("\u2502"));
+    lines.push(borderColor("\u2570" + "\u2500".repeat(innerWidth) + "\u256F"));
+    return lines.join("\n");
   }
-  throw new Error(`Unsupported platform: ${platform} ${arch}`);
-}
+  makeDoubleBox(title, content, width, borderColor) {
+    const lines = [];
+    const innerWidth = width - 4;
+    const titleText = ` ${title} `;
+    const titleTruncated = this.truncateToWidth(titleText, innerWidth);
+    const titlePadded = this.padToWidth(titleTruncated, innerWidth);
+    lines.push(borderColor("\u2554" + "\u2550".repeat(innerWidth) + "\u2557"));
+    lines.push(borderColor("\u2551") + chalk.bold(titlePadded) + borderColor("\u2551"));
+    lines.push(borderColor("\u2560" + "\u2550".repeat(innerWidth) + "\u2563"));
+    const contentLines = content.split("\n");
+    for (const line of contentLines) {
+      const contentWidth = innerWidth - 2;
+      const truncated = this.truncateToWidth(line, contentWidth);
+      const padded = this.padToWidth(truncated, contentWidth);
+      lines.push(borderColor("\u2551") + "  " + padded + borderColor("\u2551"));
+    }
+    lines.push(borderColor("\u255A" + "\u2550".repeat(innerWidth) + "\u255D"));
+    return lines.join("\n");
+  }
+};
+var tui = new TUI();
 
-// src/core/docker.ts
-import { existsSync } from "fs";
-import { execa } from "execa";
-var CONTAINER_NAME = "nexus";
-var DOCKER_DESKTOP_APP_PATH = "/Applications/Docker.app";
-async function isDockerInstalled() {
-  try {
-    await execa("docker", ["info"]);
-    return true;
-  } catch {
-    return false;
+// src/core/config.ts
+import dotenv from "dotenv";
+import path3 from "path";
+import os from "os";
+function loadApiKeys() {
+  const keyNames = [
+    ["ANTHROPIC_API_KEY", "anthropic"],
+    ["OPENAI_API_KEY", "openai"],
+    ["GOOGLE_API_KEY", "google"]
+  ];
+  const result = {};
+  for (const [envName, key] of keyNames) {
+    const raw = process.env[envName];
+    if (raw !== void 0) {
+      if (raw.trim() === "") {
+        console.warn(`WARNING: ${envName} is set but empty - it will be treated as unconfigured`);
+        result[key] = void 0;
+      } else {
+        result[key] = raw;
+      }
+    } else {
+      result[key] = void 0;
+    }
   }
+  return result;
 }
-async function isDockerInstalledButNotRunning() {
+function hasAnyKey() {
+  return !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY || process.env.GOOGLE_API_KEY);
+}
+function validateBackendUrl(url) {
+  let parsed;
   try {
-    await execa("docker", ["--version"]);
-    return true;
+    parsed = new URL(url);
   } catch {
-    return false;
+    return { valid: false, error: `Invalid backend URL: ${url}` };
   }
+  const hostname = parsed.hostname;
+  const isLocal = hostname === "localhost" || hostname === "127.0.0.1";
+  if (parsed.protocol === "https:") {
+    return { valid: true };
+  }
+  if (isLocal) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error: "WARNING: Backend URL is not localhost and not HTTPS. API keys will be transmitted in plaintext. Use SSH tunnel or HTTPS endpoint."
+  };
 }
-function dockerDesktopExists() {
-  return existsSync(DOCKER_DESKTOP_APP_PATH);
+
+// src/core/api.ts
+function buildRunPayload(task, agentRole, agentGoal, keys) {
+  const k = keys ?? loadApiKeys();
+  return {
+    task,
+    agent_role: agentRole,
+    agent_goal: agentGoal,
+    api_key: k.anthropic || "",
+    openai_api_key: k.openai || "",
+    google_api_key: k.google || ""
+  };
 }
-async function ensureHomebrew() {
-  try {
-    await execa("which", ["brew"]);
-    log.dim("Homebrew is already installed.");
-    return;
-  } catch {
-  }
-  log.step("Installing Homebrew...");
-  try {
-    await execa("/bin/bash", [
-      "-c",
-      "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-    ], {
-      stdio: "inherit",
-      env: { ...process.env, NONINTERACTIVE: "1" }
-    });
+async function httpPost(httpPort, path11, body, timeoutMs = 6e4) {
+  const res = await fetch(`http://localhost:${httpPort}${path11}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (!res.ok) throw new Error(`Server returned ${res.status}`);
+  const text = await res.text();
+  try {
+    const parsed = JSON.parse(text);
+    return parsed.response ?? parsed.message ?? text;
   } catch {
-    throw new Error(
-      'Failed to install Homebrew automatically.\n\n  Install Homebrew manually:\n    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"\n\n  Then re-run:\n    buildwithnexus init'
-    );
+    return text;
   }
+}
+async function httpGet(httpPort, path11, timeoutMs = 1e4) {
   try {
-    await execa("which", ["brew"]);
+    const res = await fetch(`http://localhost:${httpPort}${path11}`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const text = await res.text();
+    return { ok: res.ok, text };
   } catch {
-    const armPath = "/opt/homebrew/bin";
-    const intelPath = "/usr/local/bin";
-    process.env.PATH = `${armPath}:${intelPath}:${process.env.PATH}`;
-    log.dim("Added Homebrew paths to PATH for this session.");
+    return { ok: false, text: "" };
   }
+}
+async function checkServerHealth(target, timeoutMs = 1e4) {
+  const url = typeof target === "number" ? `http://localhost:${target}/health` : `${target}/health`;
   try {
-    await execa("brew", ["--version"]);
-    log.success("Homebrew installed successfully.");
+    const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    return res.ok;
   } catch {
-    throw new Error(
-      "Homebrew was installed but is not available on PATH.\n\n  Try opening a new terminal and re-running:\n    buildwithnexus init"
-    );
+    return false;
   }
 }
-async function installDocker(platform) {
-  const p = platform ?? detectPlatform();
-  switch (p.os) {
-    case "mac": {
-      if (await isDockerInstalled()) {
-        log.success("Docker is already running.");
-        return;
-      }
-      if (dockerDesktopExists()) {
-        log.step(`Docker Desktop found at ${DOCKER_DESKTOP_APP_PATH} but not running. Attempting to start...`);
-        let launched = false;
-        log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
-        try {
-          await execa("open", [DOCKER_DESKTOP_APP_PATH]);
-          launched = true;
-          log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
-        } catch {
-          log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
-        }
-        if (!launched) {
-          log.dim("Trying: open -a Docker");
-          try {
-            await execa("open", ["-a", "Docker"]);
-            launched = true;
-            log.dim("Launch command succeeded via open -a Docker");
-          } catch {
-            log.warn("Both launch attempts failed.");
-          }
-        }
-        if (launched) {
-          log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
-          try {
-            await waitForDockerDaemon(12e4);
-            return;
-          } catch {
-            log.warn("Docker Desktop was launched but the daemon did not become ready in time.");
-          }
-        } else {
-          log.warn("Could not launch Docker Desktop. Will fall back to reinstalling via Homebrew.");
-        }
-      } else {
-        log.step(`Docker Desktop not found at ${DOCKER_DESKTOP_APP_PATH}.`);
-      }
-      log.step("Installing Docker Desktop via Homebrew...");
-      await ensureHomebrew();
-      try {
-        await execa("brew", ["install", "--cask", "docker"], {
-          stdio: "inherit",
-          timeout: 6e4
-        });
-      } catch (err) {
-        const e = err;
-        if (e.killed && e.signal === "SIGINT") {
-          throw new Error("Docker installation cancelled by user (Ctrl+C)");
-        }
-        if (e.timedOut) {
-          throw new Error(
-            "Docker installation via Homebrew timed out after 60 seconds.\n\n  The password prompt may be waiting for input. Try installing manually:\n    brew install --cask docker\n\n  After installing, re-run:\n    buildwithnexus init"
-          );
-        }
-        throw new Error(
-          "Failed to install Docker via Homebrew.\n\n  Try installing Docker Desktop manually:\n    https://www.docker.com/products/docker-desktop\n\n  After installing, re-run:\n    buildwithnexus init"
-        );
-      }
-      log.step("Launching Docker Desktop...");
-      let postInstallLaunched = false;
-      log.dim(`Trying: open ${DOCKER_DESKTOP_APP_PATH}`);
+
+// src/core/sse-parser.ts
+async function* parseSSEStream(reader) {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+    for (const line of lines) {
+      if (!line.startsWith("data: ")) continue;
       try {
-        await execa("open", [DOCKER_DESKTOP_APP_PATH]);
-        postInstallLaunched = true;
-        log.dim(`Launch command succeeded via ${DOCKER_DESKTOP_APP_PATH}`);
-      } catch {
-        log.warn(`Could not launch via ${DOCKER_DESKTOP_APP_PATH} \u2014 trying fallback...`);
-      }
-      if (!postInstallLaunched) {
-        log.dim("Trying: open -a Docker");
-        try {
-          await execa("open", ["-a", "Docker"]);
-          postInstallLaunched = true;
-          log.dim("Launch command succeeded via open -a Docker");
-        } catch {
-          log.warn("Both launch attempts failed after install.");
-        }
+        const parsed = JSON.parse(line.slice(6));
+        yield parsed;
+      } catch (e) {
+        if (process.env.LOG_LEVEL === "debug") console.error("SSE parse error:", e);
       }
-      if (!postInstallLaunched) {
-        throw new Error(
-          "Docker Desktop was installed but could not be started automatically.\n\n  Next steps:\n    1. Open Docker Desktop manually from your Applications folder\n    2. Wait for the whale icon to appear in the menu bar\n    3. Re-run: buildwithnexus init"
-        );
-      }
-      log.step("Docker Desktop is starting up. Waiting for the daemon to be ready (up to 120s)...");
-      await waitForDockerDaemon(12e4);
-      break;
     }
-    case "linux": {
-      const linuxBinaryExists = await isDockerInstalledButNotRunning();
-      if (linuxBinaryExists) {
-        log.step("Docker is installed but the daemon is not running.");
-        log.step("Starting Docker daemon...");
-        try {
-          await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
-          log.dim("Started Docker daemon via systemctl.");
-        } catch {
-          try {
-            await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
-            log.dim("Started Docker daemon via service command.");
-          } catch {
-            throw new Error(
-              "Docker is installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
-            );
-          }
-        }
-        log.step("Waiting for Docker...");
-        await waitForDockerDaemon(3e4);
-        return;
-      }
-      log.step("Installing Docker...");
-      log.warn("This may require your sudo password.");
-      log.dim("Running official Docker install script from https://get.docker.com ...");
-      try {
-        const { stdout: script } = await execa("curl", ["-fsSL", "https://get.docker.com"]);
-        await execa("sudo", ["sh", "-c", script], { stdio: "inherit" });
-        log.success("Docker installed successfully.");
-      } catch {
-        throw new Error(
-          "Failed to install Docker on Linux.\n\n  Try installing manually:\n    curl -fsSL https://get.docker.com | sudo sh\n\n  After installing, re-run:\n    buildwithnexus init"
-        );
-      }
-      log.dim("Adding current user to docker group...");
-      try {
-        const user = (await execa("whoami")).stdout.trim();
-        await execa("sudo", ["usermod", "-aG", "docker", user]);
-        log.dim(`Added user '${user}' to docker group (may require re-login for effect).`);
-      } catch {
-        log.warn("Could not add user to docker group. You may need sudo for docker commands.");
-      }
-      log.step("Starting Docker daemon...");
-      try {
-        await execa("sudo", ["systemctl", "start", "docker"], { stdio: "inherit" });
-        log.dim("Started Docker daemon via systemctl.");
-      } catch {
-        try {
-          await execa("sudo", ["service", "docker", "start"], { stdio: "inherit" });
-          log.dim("Started Docker daemon via service command.");
-        } catch {
-          throw new Error(
-            "Docker was installed but the daemon could not be started.\n\n  Try starting it manually:\n    sudo systemctl start docker\n\n  Then re-run:\n    buildwithnexus init"
-          );
-        }
-      }
-      log.step("Waiting for Docker...");
-      await waitForDockerDaemon(3e4);
-      break;
+  }
+}
+
+// src/cli/run-command.ts
+async function runCommand(task, options) {
+  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
+  const urlCheck = validateBackendUrl(backendUrl);
+  if (!urlCheck.valid) {
+    console.error(`
+${urlCheck.error}`);
+    process.exit(1);
+  }
+  tui.displayHeader(task, options.agent);
+  tui.displayConnecting();
+  try {
+    if (!await checkServerHealth(backendUrl)) {
+      console.error(
+        "Backend not responding. Start it with:\n   buildwithnexus server"
+      );
+      process.exit(1);
     }
-    case "windows": {
-      const winBinaryExists = await isDockerInstalledButNotRunning();
-      if (winBinaryExists) {
-        log.step("Docker Desktop is installed but not running. Attempting to start...");
-        log.step("Launching Docker...");
-        try {
-          await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
-          log.dim("Docker Desktop launch command sent.");
-        } catch {
-          log.warn("Could not launch Docker Desktop automatically. It may need to be started manually.");
-        }
-        log.step("Waiting for Docker...");
-        try {
-          await waitForDockerDaemon(12e4);
-        } catch {
-          throw new Error(
-            "Docker Desktop did not start within 120 seconds.\n\n  Next steps:\n    1. Open Docker Desktop manually from the Start Menu\n    2. Wait for the whale icon to appear in the system tray\n    3. Re-run: buildwithnexus init"
-          );
-        }
-        return;
-      }
-      log.step("Installing Docker Desktop...");
-      let installed = false;
-      try {
-        await execa("choco", ["--version"]);
-        log.dim("Chocolatey detected. Installing Docker Desktop via choco...");
-        try {
-          await execa("choco", ["install", "docker-desktop", "-y"], { stdio: "inherit" });
-          installed = true;
-          log.success("Docker Desktop installed via Chocolatey.");
-        } catch {
-          log.warn("Chocolatey install failed. Falling back to direct download...");
-        }
-      } catch {
-        log.dim("Chocolatey not found. Using direct download...");
-      }
-      if (!installed) {
-        log.dim("Downloading Docker Desktop installer from docker.com...");
-        try {
-          await execa("powershell", [
-            "-Command",
-            "Invoke-WebRequest -Uri 'https://desktop.docker.com/win/main/amd64/Docker Desktop Installer.exe' -OutFile '$env:TEMP\\DockerInstaller.exe'; & '$env:TEMP\\DockerInstaller.exe' Install --quiet; Remove-Item '$env:TEMP\\DockerInstaller.exe' -Force -ErrorAction SilentlyContinue"
-          ], { stdio: "inherit" });
-          installed = true;
-          log.success("Docker Desktop installed via direct download.");
-        } catch {
-          throw new Error(
-            "Failed to install Docker Desktop on Windows.\n\n  Please install Docker Desktop manually:\n    1. Download from https://www.docker.com/products/docker-desktop\n    2. Run the installer and follow the prompts\n    3. Start Docker Desktop\n    4. Re-run: buildwithnexus init"
-          );
-        }
-      }
-      log.step("Launching Docker...");
-      try {
-        await execa("powershell", ["-Command", "Start-Process 'Docker Desktop'"], { stdio: "inherit" });
-        log.dim("Docker Desktop launch command sent.");
-      } catch {
-        log.warn("Could not launch Docker Desktop automatically after install.");
+    const payload = buildRunPayload(task, options.agent, options.goal || "");
+    const response = await fetch(`${backendUrl}/api/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!response.ok) {
+      console.error("Backend error");
+      console.error(await response.text());
+      process.exit(1);
+    }
+    const { run_id } = await response.json();
+    tui.displayConnected(run_id);
+    tui.displayStreamStart();
+    const eventSourceUrl = `${backendUrl}/api/stream/${run_id}`;
+    try {
+      const response2 = await fetch(eventSourceUrl);
+      const reader = response2.body?.getReader();
+      if (!reader) {
+        throw new Error("No response body");
       }
-      log.step("Waiting for Docker...");
-      try {
-        await waitForDockerDaemon(12e4);
-      } catch {
-        throw new Error(
-          "Docker Desktop was installed but did not start within 120 seconds.\n\n  Next steps:\n    1. You may need to restart your computer for Docker to work\n    2. Open Docker Desktop from the Start Menu\n    3. Wait for the whale icon to appear in the system tray\n    4. Re-run: buildwithnexus init"
-        );
+      for await (const parsed of parseSSEStream(reader)) {
+        const type = parsed.type;
+        const eventContent = parsed.data["content"] || "";
+        if (type === "done") {
+          tui.displayEvent(type, { content: "Task completed successfully" });
+          tui.displayComplete(tui.getElapsedTime());
+          process.exit(0);
+        } else if (type === "error") {
+          tui.displayError(eventContent);
+          process.exit(1);
+        } else {
+          tui.displayEvent(type, { content: eventContent });
+        }
       }
-      break;
+    } catch (error) {
+      console.error(
+        "\nStream error. Make sure backend is running:\n   buildwithnexus server"
+      );
+      process.exit(1);
     }
-    default:
-      throw new Error(`Unsupported platform: ${p.os}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error("Error:", message);
+    process.exit(1);
   }
 }
-async function waitForDockerDaemon(timeoutMs) {
-  const start = Date.now();
-  log.step("Waiting for Docker daemon...");
-  while (Date.now() - start < timeoutMs) {
+
+// src/cli/dashboard-command.ts
+import { spawn } from "child_process";
+import { fileURLToPath } from "url";
+import path4 from "path";
+var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+async function dashboardCommand(options) {
+  const port = options.port || "4201";
+  console.log(`Starting Nexus Dashboard on http://localhost:${port}
+`);
+  const dashboardPath = path4.join(__dirname, "../deep-agents/dashboard/server.js");
+  const dashboard = spawn("node", [dashboardPath], {
+    env: { ...process.env, PORT: port },
+    stdio: "inherit"
+  });
+  dashboard.on("error", (err) => {
+    console.error("Failed to start dashboard:", err);
+    process.exit(1);
+  });
+  console.log(`Dashboard ready! Open: http://localhost:${port}`);
+  console.log("Press Ctrl+C to stop\n");
+}
+
+// src/cli/interactive.ts
+import * as readline2 from "readline";
+import chalk3 from "chalk";
+
+// src/cli/intent-classifier.ts
+var PLAN_KEYWORDS = [
+  "design",
+  "plan",
+  "architect",
+  "structure",
+  "outline",
+  "roadmap",
+  "strategy",
+  "organize",
+  "breakdown",
+  "scope",
+  "model",
+  "schema"
+];
+var BUILD_KEYWORDS = [
+  "build",
+  "create",
+  "make",
+  "write",
+  "implement",
+  "code",
+  "generate",
+  "add",
+  "fix",
+  "update",
+  "deploy",
+  "run",
+  "start",
+  "launch",
+  "install",
+  "set up",
+  "setup",
+  "refactor",
+  "migrate"
+];
+var BRAINSTORM_KEYWORDS = [
+  "what",
+  "should",
+  "idea",
+  "ideas",
+  "think",
+  "consider",
+  "suggest",
+  "brainstorm",
+  "explore",
+  "wonder",
+  "might",
+  "could",
+  "would",
+  "how about",
+  "what if",
+  "options",
+  "alternatives",
+  "thoughts"
+];
+function classifyIntent(task) {
+  const lower = task.toLowerCase().trim();
+  let planScore = 0;
+  let buildScore = 0;
+  let brainstormScore = 0;
+  for (const kw of PLAN_KEYWORDS) {
+    if (lower.includes(kw)) planScore++;
+  }
+  for (const kw of BUILD_KEYWORDS) {
+    if (lower.includes(kw)) buildScore++;
+  }
+  for (const kw of BRAINSTORM_KEYWORDS) {
+    if (lower.includes(kw)) brainstormScore++;
+  }
+  const wordCount = lower.split(/\s+/).length;
+  if (wordCount > 12 && planScore === buildScore && buildScore === brainstormScore) {
+    return "plan";
+  }
+  if (brainstormScore > planScore && brainstormScore > buildScore) return "brainstorm";
+  if (buildScore > planScore && buildScore > brainstormScore) return "build";
+  if (planScore > 0) return "plan";
+  return wordCount > 6 ? "plan" : "build";
+}
+
+// src/cli/interactive.ts
+init_secrets();
+init_docker();
+
+// src/core/version.ts
+var resolvedVersion = true ? "0.7.3" : pkg.version;
+
+// src/cli/interactive.ts
+var appVersion = resolvedVersion;
+async function interactiveMode() {
+  const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
+  const urlCheck = validateBackendUrl(backendUrl);
+  if (!urlCheck.valid) {
+    console.error(chalk3.red(`
+${urlCheck.error}`));
+    process.exit(1);
+  }
+  if (!hasAnyKey()) {
     try {
-      await execa("docker", ["info"]);
-      log.success("Docker daemon is ready");
-      return;
+      const storedKeys = loadKeys();
+      if (storedKeys) {
+        if (storedKeys.ANTHROPIC_API_KEY) process.env.ANTHROPIC_API_KEY = storedKeys.ANTHROPIC_API_KEY;
+        if (storedKeys.OPENAI_API_KEY) process.env.OPENAI_API_KEY = storedKeys.OPENAI_API_KEY;
+        if (storedKeys.GOOGLE_API_KEY) process.env.GOOGLE_API_KEY = storedKeys.GOOGLE_API_KEY;
+      }
     } catch {
     }
-    await new Promise((r) => setTimeout(r, 3e3));
   }
-  throw new Error(
-    `Docker daemon did not become ready within ${Math.round(timeoutMs / 1e3)}s.
-
-  Please ensure Docker is running, then re-run:
-    buildwithnexus init`
-  );
-}
-async function imageExistsLocally(image, tag) {
-  const ref = `${image}:${tag}`;
-  try {
-    await execa("docker", ["image", "inspect", ref]);
-    return true;
-  } catch {
+  if (!hasAnyKey()) {
+    console.log(chalk3.cyan("\n\u{1F527} Configure API Keys\n"));
+    const { deepAgentsInitCommand: deepAgentsInitCommand2 } = await Promise.resolve().then(() => (init_init_command(), init_command_exports));
+    await deepAgentsInitCommand2();
+    if (!hasAnyKey()) {
+      console.error("Error: At least one API key is required to use buildwithnexus.");
+      process.exit(1);
+    }
+  }
+  const keys = loadApiKeys();
+  console.log(chalk3.green("\n\u2713 Keys configured!"));
+  console.log(chalk3.gray(`  Anthropic: ${keys.anthropic ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  OpenAI: ${keys.openai ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  Google: ${keys.google ? "\u2713" : "\u2717"}`));
+  console.log(chalk3.gray(`  (Run 'da-init' to reconfigure)
+`));
+  async function waitForBackend() {
+    for (let i = 0; i < 5; i++) {
+      await new Promise((resolve) => setTimeout(resolve, 2e3));
+      if (await checkServerHealth(backendUrl)) return true;
+    }
     return false;
   }
-}
-async function pullImage(image, tag) {
-  const ref = `${image}:${tag}`;
-  log.step(`Pulling image ${ref}...`);
-  try {
-    await execa("docker", ["pull", ref], { stdio: "inherit" });
-    log.success(`Image ${ref} pulled`);
-  } catch (err) {
-    log.error(`Failed to pull image ${ref}`);
-    throw err;
+  if (!await checkServerHealth(backendUrl)) {
+    console.log(chalk3.yellow("\u26A0\uFE0F  Backend not accessible, attempting to start..."));
+    await startBackend();
+    const ready = await waitForBackend();
+    if (!ready) {
+      console.error(chalk3.red("\u274C Backend failed to start. Run: buildwithnexus server"));
+      process.exit(1);
+    }
+  }
+  const rl = readline2.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+  console.clear();
+  console.log(chalk3.gray("Welcome! Describe what you want the AI agents to do."));
+  console.log(chalk3.gray('Type "exit" to quit.\n'));
+  while (true) {
+    const task = await ask(chalk3.bold.blue("\u{1F4DD} Task: "));
+    if (task.toLowerCase() === "exit") {
+      console.log(chalk3.yellow("\nGoodbye! \u{1F44B}\n"));
+      rl.close();
+      process.exit(0);
+    }
+    if (!task.trim()) {
+      console.log(chalk3.red("Please enter a task.\n"));
+      continue;
+    }
+    const suggestedMode = classifyIntent(task).toUpperCase();
+    tui.displaySuggestedMode(suggestedMode, task);
+    const currentMode = await selectMode(suggestedMode, ask);
+    await runModeLoop(currentMode, task, backendUrl, ask);
+    console.log("");
   }
 }
-async function startNexus(keys, config) {
-  log.step("Starting NEXUS container...");
-  try {
-    await execa("docker", [
-      "run",
-      "-d",
-      "--name",
-      CONTAINER_NAME,
-      "-e",
-      `ANTHROPIC_API_KEY=${keys.anthropic}`,
-      "-e",
-      `OPENAI_API_KEY=${keys.openai}`,
-      "-p",
-      `${config.port}:${config.port}`,
-      "buildwithnexus/nexus:latest"
-    ]);
-    log.success(`NEXUS container started on port ${config.port}`);
-  } catch (err) {
-    log.error("Failed to start NEXUS container");
-    throw err;
+async function selectMode(suggested, ask) {
+  const modeColor = {
+    PLAN: chalk3.cyan,
+    BUILD: chalk3.green,
+    BRAINSTORM: chalk3.blue
+  };
+  console.log("");
+  console.log(
+    chalk3.gray("Press ") + chalk3.bold("Enter") + chalk3.gray(" to use ") + modeColor[suggested](suggested) + chalk3.gray(" or choose a mode:")
+  );
+  console.log(
+    chalk3.gray("  ") + chalk3.cyan.bold("[1] PLAN") + chalk3.gray(" (p)   design & break down steps") + chalk3.gray("\n  ") + chalk3.green.bold("[2] BUILD") + chalk3.gray(" (b)  execute with live streaming") + chalk3.gray("\n  ") + chalk3.blue.bold("[3] BRAINSTORM") + chalk3.gray(" (bs)  free-form explore & Q&A")
+  );
+  const answer = await ask(chalk3.gray("> "));
+  const lower = answer.trim().toLowerCase();
+  if (lower === "1" || lower === "p" || lower === "plan") return "PLAN";
+  if (lower === "2" || lower === "b" || lower === "build") return "BUILD";
+  if (lower === "3" || lower === "bs" || lower === "br" || lower === "brainstorm") return "BRAINSTORM";
+  return suggested;
+}
+async function runModeLoop(mode, task, backendUrl, ask) {
+  let currentMode = mode;
+  while (true) {
+    console.clear();
+    printAppHeader();
+    tui.displayModeBar(currentMode);
+    tui.displayModeHeader(currentMode);
+    if (currentMode === "PLAN") {
+      const next = await planModeLoop(task, backendUrl, ask);
+      if (next === "BUILD") {
+        currentMode = "BUILD";
+        continue;
+      }
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
+      return;
+    }
+    if (currentMode === "BUILD") {
+      const next = await buildModeLoop(task, backendUrl, ask);
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
+      return;
+    }
+    if (currentMode === "BRAINSTORM") {
+      const next = await brainstormModeLoop(task, backendUrl, ask);
+      if (next === "switch") {
+        currentMode = await promptModeSwitch(currentMode, ask);
+        continue;
+      }
+      return;
+    }
   }
 }
-async function stopNexus() {
-  log.step("Stopping NEXUS container...");
-  try {
-    await execa("docker", ["rm", "-f", CONTAINER_NAME]);
-    log.success("NEXUS container stopped and removed");
-  } catch (err) {
-    log.error("Failed to stop NEXUS container");
-    throw err;
-  }
+function printAppHeader() {
+  console.log(chalk3.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  console.log(
+    chalk3.cyan("\u2551") + chalk3.bold.white("        Nexus - Autonomous Agent Orchestration                ") + chalk3.cyan("\u2551")
+  );
+  const versionLine = `        v${appVersion}`;
+  console.log(
+    chalk3.cyan("\u2551") + chalk3.dim(versionLine.padEnd(60)) + chalk3.cyan("\u2551")
+  );
+  console.log(chalk3.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  console.log("");
 }
-async function dockerExec(command) {
-  try {
-    const { stdout, stderr } = await execa("docker", ["exec", CONTAINER_NAME, "sh", "-c", command]);
-    return { stdout, stderr, code: 0 };
-  } catch (err) {
-    const e = err;
-    return { stdout: e.stdout ?? "", stderr: e.stderr ?? "", code: e.exitCode ?? 1 };
-  }
+async function promptModeSwitch(current, ask) {
+  const others = ["PLAN", "BUILD", "BRAINSTORM"].filter((m) => m !== current);
+  console.log("");
+  console.log(
+    chalk3.gray("Switch to: ") + others.map((m, i) => chalk3.bold(`[${i + 1}] ${m}`)).join(chalk3.gray("  ")) + chalk3.gray("  [Enter to stay in ") + chalk3.bold(current) + chalk3.gray("]")
+  );
+  const answer = await ask(chalk3.gray("> "));
+  const n = parseInt(answer.trim(), 10);
+  if (n === 1) return others[0];
+  if (n === 2) return others[1];
+  return current;
 }
-async function isNexusRunning() {
+async function planModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Task:"), chalk3.white(task));
+  console.log("");
+  console.log(chalk3.yellow("\u23F3 Fetching plan from backend..."));
+  let steps = [];
   try {
-    const { stdout } = await execa("docker", [
-      "ps",
-      "--filter",
-      `name=^/${CONTAINER_NAME}$`,
-      "--format",
-      "{{.Names}}"
-    ]);
-    return stdout.trim() === CONTAINER_NAME;
-  } catch {
-    return false;
-  }
-}
-
-// src/commands/install.ts
-var installCommand = new Command("install").description("Install Docker and configure system prerequisites").action(async () => {
-  const spinner = createSpinner("");
-  log.step("Checking Docker installation...");
-  const alreadyInstalled = await isDockerInstalled();
-  if (alreadyInstalled) {
-    try {
-      const { stdout } = await execa2("docker", ["--version"]);
-      log.success(`Docker is already installed and running: ${stdout.trim()}`);
-    } catch {
-      log.success("Docker is already installed and running.");
+    const response = await fetch(`${backendUrl}/api/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(buildRunPayload(task, "engineer", "")),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (!response.ok) {
+      console.error(chalk3.red("Backend error \u2014 cannot fetch plan."));
+      return "cancel";
+    }
+    const { run_id } = await response.json();
+    tui.displayConnected(run_id);
+    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+    const reader = streamResponse.body?.getReader();
+    if (!reader) throw new Error("No response body");
+    let planReceived = false;
+    for await (const parsed of parseSSEStream(reader)) {
+      if (parsed.type === "plan") {
+        steps = parsed.data["steps"] || [];
+        planReceived = true;
+        reader.cancel();
+        break;
+      } else if (parsed.type === "error") {
+        const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
+        tui.displayError(errorMsg);
+        reader.cancel();
+        return "cancel";
+      }
+    }
+    if (!planReceived || steps.length === 0) {
+      console.log(chalk3.yellow("No plan received from backend."));
+      steps = ["(no steps returned \u2014 execute anyway?)"];
     }
-    return;
-  }
-  const platform = detectPlatform();
-  log.step(`Installing Docker for ${platform.os} (${platform.arch})...`);
-  try {
-    await installDocker(platform);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log.error(`Docker installation failed: ${msg}`);
-    process.exit(1);
-  }
-  spinner.text = "Verifying Docker installation...";
-  spinner.start();
-  const verified = await isDockerInstalled();
-  if (!verified) {
-    fail(spinner, "Docker installation could not be verified");
-    log.error(
-      "Docker was installed but is not responding.\n\n  Please ensure Docker is running, then verify with:\n    docker --version\n\n  Once Docker is running, you can proceed with:\n    buildwithnexus init"
-    );
-    process.exit(1);
-  }
-  try {
-    const { stdout } = await execa2("docker", ["--version"]);
-    succeed(spinner, `Docker verified: ${stdout.trim()}`);
-  } catch {
-    succeed(spinner, "Docker is installed and running");
-  }
-  log.success("\nDocker setup complete! You can now run:\n\n  buildwithnexus init\n");
-});
-
-// src/commands/init.ts
-init_banner();
-import { Command as Command2 } from "commander";
-import chalk7 from "chalk";
-
-// src/ui/prompts.ts
-import { confirm, password } from "@inquirer/prompts";
-import chalk6 from "chalk";
-
-// src/core/dlp.ts
-import crypto from "crypto";
-import fs2 from "fs";
-import path4 from "path";
-var NEXUS_HOME = path4.join(process.env.HOME || "~", ".buildwithnexus");
-var SECRET_PATTERNS = [
-  /sk-ant-api03-[A-Za-z0-9_-]{20,}/g,
-  // Anthropic API key
-  /sk-[A-Za-z0-9]{20,}/g,
-  // OpenAI API key
-  /AIza[A-Za-z0-9_-]{35}/g
-  // Google AI API key
-];
-var FORBIDDEN_KEY_CHARS = /[\n\r\t'"\\`${}();&|<>!#%^]/;
-var KEY_VALIDATORS = {
-  ANTHROPIC_API_KEY: /^sk-ant-[A-Za-z0-9_-]{20,}$/,
-  OPENAI_API_KEY: /^sk-[A-Za-z0-9_-]{20,}$/,
-  GOOGLE_API_KEY: /^AIza[A-Za-z0-9_-]{35,}$/,
-  NEXUS_MASTER_SECRET: /^[A-Za-z0-9_-]{20,64}$/
-};
-function shellEscape(value) {
-  if (value.includes("\0")) {
-    throw new DlpViolation("Null byte in shell argument");
+    console.error(chalk3.red("Error: " + msg));
+    return "cancel";
   }
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-function shellCommand(strings, ...values) {
-  let result = strings[0];
-  for (let i = 0; i < values.length; i++) {
-    result += shellEscape(values[i]) + strings[i + 1];
+  displayPlanSteps(steps);
+  while (true) {
+    console.log(chalk3.gray("Options: ") + chalk3.bold("[Y]") + chalk3.gray(" Execute  ") + chalk3.bold("[e]") + chalk3.gray(" Edit step  ") + chalk3.bold("[s]") + chalk3.gray(" Switch mode  ") + chalk3.bold("[Esc/n]") + chalk3.gray(" Cancel"));
+    const answer = (await ask(tui.displayPermissionPrompt("Execute this plan?"))).trim().toLowerCase();
+    if (answer === "" || answer === "y") {
+      return "BUILD";
+    }
+    if (answer === "n" || answer === "\x1B") {
+      console.log(chalk3.yellow("\nExecution cancelled.\n"));
+      return "cancel";
+    }
+    if (answer === "e" || answer === "edit") {
+      steps = await editPlanSteps(steps, ask);
+      displayPlanSteps(steps);
+      continue;
+    }
+    if (answer === "s" || answer === "switch") {
+      return "switch";
+    }
   }
-  return result;
 }
-function redact(text) {
-  let result = text;
-  for (const pattern of SECRET_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, "[REDACTED]");
-  }
-  return result;
+function displayPlanSteps(steps) {
+  console.log("");
+  console.log(chalk3.bold.cyan("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  console.log(chalk3.bold.cyan("\u2502") + chalk3.bold.white("  \u{1F4CB} Execution Plan                                      ") + chalk3.bold.cyan("\u2502"));
+  console.log(chalk3.bold.cyan("\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  steps.forEach((step, i) => {
+    const label = `  Step ${i + 1}: `;
+    const maxContentWidth = 57 - label.length;
+    const truncated = step.length > maxContentWidth ? step.substring(0, maxContentWidth - 3) + "..." : step;
+    const line = label + truncated;
+    const padded = line.padEnd(57);
+    console.log(chalk3.bold.cyan("\u2502") + chalk3.white(padded) + chalk3.bold.cyan("\u2502"));
+  });
+  console.log(chalk3.bold.cyan("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  console.log("");
 }
-function redactError(err) {
-  if (err instanceof Error) {
-    const safe = new Error(redact(err.message));
-    safe.name = err.name;
-    if (err.stack) safe.stack = redact(err.stack);
-    return safe;
+async function editPlanSteps(steps, ask) {
+  console.log(chalk3.gray("Enter step number to edit, or press Enter to finish editing:"));
+  const numStr = await ask(chalk3.bold("Step #: "));
+  const n = parseInt(numStr.trim(), 10);
+  if (!isNaN(n) && n >= 1 && n <= steps.length) {
+    console.log(chalk3.gray(`Current: ${steps[n - 1]}`));
+    const updated = await ask(chalk3.bold("New text: "));
+    if (updated.trim()) steps[n - 1] = updated.trim();
   }
-  return new Error(redact(String(err)));
+  return steps;
 }
-var DlpViolation = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DlpViolation";
-  }
-};
-function validateKeyValue(keyName, value) {
-  if (FORBIDDEN_KEY_CHARS.test(value)) {
-    throw new DlpViolation(
-      `${keyName} contains characters that are not permitted in API keys`
-    );
-  }
-  if (value.length < 10 || value.length > 256) {
-    throw new DlpViolation(
-      `${keyName} length out of expected range (10-256 characters)`
-    );
-  }
-  const validator = KEY_VALIDATORS[keyName];
-  if (validator && !validator.test(value)) {
-    throw new DlpViolation(
-      `${keyName} does not match the expected format for this key type`
-    );
+async function buildModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Task:"), chalk3.white(task));
+  tui.displayConnecting();
+  try {
+    const response = await fetch(`${backendUrl}/api/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(buildRunPayload(task, "engineer", "")),
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (!response.ok) {
+      console.error(chalk3.red("Backend error"));
+      return "done";
+    }
+    const { run_id } = await response.json();
+    tui.displayConnected(run_id);
+    console.log(chalk3.bold.green("\u2699\uFE0F  Executing..."));
+    tui.displayStreamStart();
+    const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+    const reader = streamResponse.body?.getReader();
+    if (!reader) throw new Error("No response body");
+    for await (const parsed of parseSSEStream(reader)) {
+      const type = parsed.type;
+      if (type === "execution_complete") {
+        const summary = parsed.data["summary"] || "";
+        const count = parsed.data["todos_completed"] || 0;
+        tui.displayResults(summary, count);
+        tui.displayComplete(tui.getElapsedTime());
+        break;
+      } else if (type === "done") {
+        tui.displayEvent(type, { content: "Task completed successfully" });
+        tui.displayComplete(tui.getElapsedTime());
+        break;
+      } else if (type === "error") {
+        const errorMsg = parsed.data["error"] || parsed.data["content"] || "Unknown error";
+        tui.displayError(errorMsg);
+        break;
+      } else if (type !== "plan") {
+        tui.displayEvent(type, parsed.data);
+      }
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(chalk3.red("Error: " + msg));
   }
+  console.log("");
+  console.log(
+    chalk3.gray("Options: ") + chalk3.bold("[Enter]") + chalk3.gray(" Done  ") + chalk3.bold("[s]") + chalk3.gray(" Switch mode")
+  );
+  const answer = (await ask(chalk3.bold("> "))).trim().toLowerCase();
+  if (answer === "s" || answer === "switch") return "switch";
+  return "done";
 }
-function validateAllKeys(keys) {
-  const violations = [];
-  for (const [name, value] of Object.entries(keys)) {
-    if (!value) continue;
+async function brainstormModeLoop(task, backendUrl, ask) {
+  console.log(chalk3.bold("Starting topic:"), chalk3.white(task));
+  console.log(chalk3.gray('Ask follow-up questions. Type "done" to exit, "switch" to change mode.\n'));
+  let currentQuestion = task;
+  while (true) {
+    console.log(chalk3.bold.blue("\u{1F4A1} Thinking..."));
     try {
-      validateKeyValue(name, value);
+      const response = await fetch(`${backendUrl}/api/run`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(buildRunPayload(
+          currentQuestion,
+          "brainstorm",
+          "Generate ideas, considerations, and suggestions. Be concise and helpful."
+        )),
+        signal: AbortSignal.timeout(12e4)
+      });
+      if (response.ok) {
+        const { run_id } = await response.json();
+        const streamResponse = await fetch(`${backendUrl}/api/stream/${run_id}`, { signal: AbortSignal.timeout(12e4) });
+        const reader = streamResponse.body?.getReader();
+        if (reader) {
+          let responseText = "";
+          for await (const parsed of parseSSEStream(reader)) {
+            const type = parsed.type;
+            const data = parsed.data;
+            if (type === "done" || type === "execution_complete") {
+              const summary = data["summary"] || "";
+              if (summary) responseText = summary;
+              break;
+            } else if (type === "error") {
+              const errorMsg = data["error"] || data["content"] || "Unknown error";
+              responseText += errorMsg + "\n";
+              break;
+            } else if (type === "thought" || type === "observation") {
+              const content = data["content"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "agent_response" || type === "agent_result") {
+              const content = data["content"] || data["result"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "action") {
+              const content = data["content"] || "";
+              if (content) responseText += content + "\n";
+            } else if (type === "agent_working") {
+            } else if (type !== "plan") {
+              const content = data["content"] || data["response"] || "";
+              if (content) responseText += content + "\n";
+            }
+          }
+          if (responseText.trim()) {
+            tui.displayBrainstormResponse(responseText.trim());
+          } else {
+            console.log(chalk3.gray("(No response received from agent)"));
+          }
+        }
+      } else {
+        console.log(chalk3.red("Could not reach backend for brainstorm response."));
+      }
     } catch (err) {
-      if (err instanceof DlpViolation) violations.push(err.message);
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(chalk3.red("Error: " + msg));
     }
+    const followUp = await ask(chalk3.bold.blue("\u{1F4AC} You: "));
+    const lower = followUp.trim().toLowerCase();
+    if (lower === "done" || lower === "exit") return "done";
+    if (lower === "switch") return "switch";
+    if (!followUp.trim()) continue;
+    currentQuestion = followUp.trim();
   }
-  return violations;
 }
-var HMAC_PATH = path4.join(NEXUS_HOME, ".keys.hmac");
-function computeFileHmac(filePath, secret) {
-  const content = fs2.readFileSync(filePath);
-  return crypto.createHmac("sha256", secret).update(content).digest("hex");
+
+// src/commands/install.ts
+import { Command } from "commander";
+import { execa as execa2 } from "execa";
+
+// src/ui/spinner.ts
+import ora from "ora";
+import chalk4 from "chalk";
+function createSpinner(text) {
+  return ora({ text, color: "cyan", spinner: "dots" });
 }
-function sealKeysFile(keysPath, masterSecret) {
-  const hmac = computeFileHmac(keysPath, masterSecret);
-  fs2.writeFileSync(HMAC_PATH, hmac, { mode: 384 });
+function succeed(spinner, text) {
+  spinner.succeed(chalk4.green(text));
 }
-function verifyKeysFile(keysPath, masterSecret) {
-  const keysExist = fs2.existsSync(keysPath);
-  const hmacExist = fs2.existsSync(HMAC_PATH);
-  if (!keysExist && !hmacExist) return true;
-  if (keysExist && !hmacExist) return false;
-  try {
-    const stored = fs2.readFileSync(HMAC_PATH, "utf-8").trim();
-    const computed = computeFileHmac(keysPath, masterSecret);
-    return crypto.timingSafeEqual(
-      Buffer.from(stored, "hex"),
-      Buffer.from(computed, "hex")
-    );
-  } catch {
-    return false;
-  }
+function fail(spinner, text) {
+  spinner.fail(chalk4.red(text));
 }
-var AUDIT_PATH = path4.join(NEXUS_HOME, "audit.log");
-var MAX_AUDIT_SIZE = 10 * 1024 * 1024;
-function audit(event, detail = "") {
-  try {
-    const dir = path4.dirname(AUDIT_PATH);
-    if (!fs2.existsSync(dir)) return;
-    if (fs2.existsSync(AUDIT_PATH)) {
-      const stat = fs2.statSync(AUDIT_PATH);
-      if (stat.size > MAX_AUDIT_SIZE) {
-        const rotated = AUDIT_PATH + ".1";
-        if (fs2.existsSync(rotated)) fs2.unlinkSync(rotated);
-        fs2.renameSync(AUDIT_PATH, rotated);
-        try {
-          fs2.chmodSync(rotated, 384);
-        } catch {
-        }
-      }
-    }
-    const line = `${(/* @__PURE__ */ new Date()).toISOString()} | ${event} | ${redact(detail)}
-`;
-    fs2.appendFileSync(AUDIT_PATH, line, { mode: 384 });
+
+// src/commands/install.ts
+init_logger();
+init_platform();
+init_docker();
+var installCommand = new Command("install").description("Install Docker and configure system prerequisites").action(async () => {
+  const spinner = createSpinner("");
+  log.step("Checking Docker installation...");
+  const alreadyInstalled = await isDockerInstalled();
+  if (alreadyInstalled) {
     try {
-      fs2.chmodSync(AUDIT_PATH, 384);
+      const { stdout } = await execa2("docker", ["--version"]);
+      log.success(`Docker is already installed and running: ${stdout.trim()}`);
     } catch {
+      log.success("Docker is already installed and running.");
     }
+    return;
+  }
+  const platform = detectPlatform();
+  log.step(`Installing Docker for ${platform.os} (${platform.arch})...`);
+  try {
+    await installDocker(platform);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error(`Docker installation failed: ${msg}`);
+    process.exit(1);
+  }
+  spinner.text = "Verifying Docker installation...";
+  spinner.start();
+  const verified = await isDockerInstalled();
+  if (!verified) {
+    fail(spinner, "Docker installation could not be verified");
+    log.error(
+      "Docker was installed but is not responding.\n\n  Please ensure Docker is running, then verify with:\n    docker --version\n\n  Once Docker is running, you can proceed with:\n    buildwithnexus init"
+    );
+    process.exit(1);
+  }
+  try {
+    const { stdout } = await execa2("docker", ["--version"]);
+    succeed(spinner, `Docker verified: ${stdout.trim()}`);
   } catch {
+    succeed(spinner, "Docker is installed and running");
   }
-}
+  log.success("\nDocker setup complete! You can now run:\n\n  buildwithnexus init\n");
+});
+
+// src/commands/init.ts
+init_banner();
+import { Command as Command2 } from "commander";
+import chalk7 from "chalk";
+init_logger();
 
 // src/ui/prompts.ts
+init_dlp();
+import { confirm, password } from "@inquirer/prompts";
+import chalk6 from "chalk";
 async function promptInitConfig() {
   console.log(chalk6.bold("\n  API Keys\n"));
   const anthropicKey = await password({
@@ -1768,66 +2097,14 @@ async function promptInitConfig() {
   };
 }
 
-// src/core/secrets.ts
-import fs3 from "fs";
-import path5 from "path";
-import crypto2 from "crypto";
-var NEXUS_HOME2 = process.env.NEXUS_HOME || path5.join(process.env.HOME || "~", ".buildwithnexus");
-var CONFIG_PATH = process.env.NEXUS_CONFIG_PATH || path5.join(NEXUS_HOME2, "config.json");
-var KEYS_PATH = process.env.NEXUS_KEYS_PATH || path5.join(NEXUS_HOME2, ".env.keys");
-function ensureHome() {
-  fs3.mkdirSync(NEXUS_HOME2, { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "images"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "configs"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "vm", "logs"), { recursive: true, mode: 448 });
-  fs3.mkdirSync(path5.join(NEXUS_HOME2, "ssh"), { recursive: true, mode: 448 });
-}
-function generateMasterSecret() {
-  return crypto2.randomBytes(32).toString("base64url");
-}
-function saveConfig(config) {
-  const { masterSecret: _secret, ...safeConfig } = config;
-  fs3.writeFileSync(CONFIG_PATH, JSON.stringify(safeConfig, null, 2), { mode: 384 });
-}
-function loadConfig() {
-  if (!fs3.existsSync(CONFIG_PATH)) return null;
-  return JSON.parse(fs3.readFileSync(CONFIG_PATH, "utf-8"));
-}
-function saveKeys(keys) {
-  const violations = validateAllKeys(keys);
-  if (violations.length > 0) {
-    throw new DlpViolation(`Key validation failed: ${violations.join("; ")}`);
-  }
-  const lines = Object.entries(keys).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`);
-  fs3.writeFileSync(KEYS_PATH, lines.join("\n") + "\n", { mode: 384 });
-  sealKeysFile(KEYS_PATH, keys.NEXUS_MASTER_SECRET);
-  audit("keys_saved", `${Object.keys(keys).filter((k) => keys[k]).length} keys saved`);
-}
-function loadKeys() {
-  if (!fs3.existsSync(KEYS_PATH)) return null;
-  const content = fs3.readFileSync(KEYS_PATH, "utf-8");
-  const keys = {};
-  for (const line of content.split("\n")) {
-    const eq = line.indexOf("=");
-    if (eq > 0) keys[line.slice(0, eq)] = line.slice(eq + 1);
-  }
-  const result = keys;
-  if (result.NEXUS_MASTER_SECRET && !verifyKeysFile(KEYS_PATH, result.NEXUS_MASTER_SECRET)) {
-    audit("keys_tampered", "HMAC mismatch on .env.keys");
-    throw new DlpViolation(
-      ".env.keys has been modified outside of buildwithnexus. Run 'buildwithnexus keys set' to re-enter your keys, or 'buildwithnexus destroy' to start fresh."
-    );
-  }
-  audit("keys_loaded", `${Object.keys(keys).length} keys loaded`);
-  return result;
-}
-function maskKey(key) {
-  if (key.length <= 8) return "***";
-  const reveal = Math.min(4, Math.floor(key.length * 0.1));
-  return key.slice(0, reveal) + "..." + key.slice(-reveal);
-}
+// src/commands/init.ts
+init_platform();
+init_secrets();
+init_docker();
 
 // src/core/tunnel.ts
+init_docker();
+init_dlp();
 var CLOUDFLARED_VERSION = "2024.12.2";
 var CLOUDFLARED_SHA256 = {
   amd64: "40ec9a0f5b58e3b04183aaf01c4ddd4dbc6af39b0f06be4b7ce8b1011d0a07ab",
@@ -1871,6 +2148,7 @@ async function startTunnel() {
 }
 
 // src/commands/init.ts
+init_dlp();
 async function withSpinner(spinner, label, fn) {
   spinner.text = label;
   spinner.start();
@@ -1878,32 +2156,11 @@ async function withSpinner(spinner, label, fn) {
   succeed(spinner, label);
   return result;
 }
-async function waitForHealthy(port, timeoutMs = 12e4) {
-  const start = Date.now();
-  let attempt = 0;
-  const backoffMs = (n) => Math.min(2e3 * Math.pow(2, n), 1e4);
-  while (Date.now() - start < timeoutMs) {
-    try {
-      const res = await fetch(`http://localhost:${port}/health`);
-      if (res.ok) {
-        const body = await res.text();
-        if (body.includes("ok")) return true;
-      }
-    } catch {
-    }
-    const delay = backoffMs(attempt++);
-    const remaining = timeoutMs - (Date.now() - start);
-    if (remaining <= 0) break;
-    await new Promise((r) => setTimeout(r, Math.min(delay, remaining)));
-  }
-  return false;
-}
 var phases = [
   // Phase 1 — Configuration (~30s)
   {
     name: "Configuration",
     run: async (ctx) => {
-      showBanner();
       const platform = detectPlatform();
       log.detail("Platform", `${platform.os} ${platform.arch}`);
       const userConfig = await promptInitConfig();
@@ -1978,19 +2235,16 @@ var phases = [
     name: "Launch",
     run: async (ctx, spinner) => {
       const { config, keys } = ctx;
-      const alreadyRunning = await isNexusRunning();
-      if (alreadyRunning) {
-        await withSpinner(spinner, "Stopping existing NEXUS container...", () => stopNexus());
-      }
       await withSpinner(
         spinner,
         "Starting NEXUS container...",
-        () => startNexus(
+        () => launchNexus(
           {
             anthropic: keys.ANTHROPIC_API_KEY,
             openai: keys.OPENAI_API_KEY || ""
           },
-          { port: config.httpPort }
+          { port: config.httpPort },
+          { healthTimeoutMs: 0, stopExisting: true }
         )
       );
       ctx.containerStarted = true;
@@ -2003,7 +2257,8 @@ var phases = [
       const { config } = ctx;
       spinner.text = `Waiting for NEXUS server on port ${config.httpPort}...`;
       spinner.start();
-      const healthy = await waitForHealthy(config.httpPort);
+      const { waitForServer: waitForServer2 } = await Promise.resolve().then(() => (init_health(), health_exports));
+      const healthy = await waitForServer2(12e4);
       if (!healthy) {
         fail(spinner, "Server failed to start within 120s");
         log.warn("Check logs: docker logs nexus");
@@ -2086,39 +2341,9 @@ var initCommand = new Command2("init").description("Scaffold and launch a new NE
 
 // src/commands/start.ts
 import { Command as Command3 } from "commander";
-
-// src/core/health.ts
-async function waitForServer(timeoutMs = 9e5) {
-  const start = Date.now();
-  let lastLog = 0;
-  let attempt = 0;
-  const backoffMs = (n) => Math.min(3e3 * Math.pow(2, n), 3e4);
-  while (Date.now() - start < timeoutMs) {
-    try {
-      const { stdout, code } = await dockerExec("curl -sf http://localhost:4200/health");
-      if (code === 0 && stdout.includes("ok")) return true;
-    } catch {
-    }
-    const elapsed = Date.now() - start;
-    if (elapsed - lastLog >= 3e4) {
-      lastLog = elapsed;
-      try {
-        const { stdout } = await dockerExec("systemctl is-active nexus 2>/dev/null || echo 'starting...'");
-        process.stderr.write(`
-  [server ${Math.round(elapsed / 1e3)}s] ${stdout.trim().slice(0, 120)}
-`);
-      } catch {
-      }
-    }
-    const delay = backoffMs(attempt++);
-    const remaining = timeoutMs - (Date.now() - start);
-    if (remaining <= 0) break;
-    await new Promise((r) => setTimeout(r, Math.min(delay, remaining)));
-  }
-  return false;
-}
-
-// src/commands/start.ts
+init_logger();
+init_secrets();
+init_docker();
 var startCommand = new Command3("start").description("Start the NEXUS runtime").action(async () => {
   const config = loadConfig();
   if (!config) {
@@ -2133,16 +2358,17 @@ var startCommand = new Command3("start").description("Start the NEXUS runtime").
   spinner.start();
   await pullImage("buildwithnexus/nexus", "latest");
   succeed(spinner, "Image ready");
+  const keys = loadKeys();
+  if (!keys) {
+    log.error("No API keys found. Run: buildwithnexus init");
+    process.exit(1);
+  }
   spinner = createSpinner("Starting NEXUS container...");
   spinner.start();
-  await startNexus(
-    { anthropic: config.anthropicKey, openai: config.openaiKey },
+  const ok = await launchNexus(
+    { anthropic: keys.ANTHROPIC_API_KEY, openai: keys.OPENAI_API_KEY || "" },
     { port: config.httpPort }
   );
-  succeed(spinner, "Container started");
-  spinner = createSpinner("Waiting for NEXUS server...");
-  spinner.start();
-  const ok = await waitForServer(6e4);
   if (ok) {
     succeed(spinner, "NEXUS server running");
   } else {
@@ -2163,12 +2389,11 @@ var startCommand = new Command3("start").description("Start the NEXUS runtime").
 
 // src/commands/stop.ts
 import { Command as Command4 } from "commander";
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
+import { execa as execa3 } from "execa";
+init_logger();
 async function containerExists() {
   try {
-    const { stdout } = await execFileAsync("docker", [
+    const { stdout } = await execa3("docker", [
       "ps",
       "-a",
       "--filter",
@@ -2183,7 +2408,7 @@ async function containerExists() {
 }
 async function isContainerRunning() {
   try {
-    const { stdout } = await execFileAsync("docker", [
+    const { stdout } = await execa3("docker", [
       "ps",
       "--filter",
       "name=^nexus$",
@@ -2207,10 +2432,10 @@ var stopCommand = new Command4("stop").description("Gracefully shut down the NEX
   try {
     if (await isContainerRunning()) {
       spinner.text = "Stopping container...";
-      await execFileAsync("docker", ["stop", "nexus"]);
+      await execa3("docker", ["stop", "nexus"]);
     }
     spinner.text = "Removing container...";
-    await execFileAsync("docker", ["rm", "nexus"]);
+    await execa3("docker", ["rm", "nexus"]);
     succeed(spinner, "NEXUS container stopped and removed");
   } catch (err) {
     fail(spinner, "Failed to stop NEXUS container");
@@ -2220,6 +2445,9 @@ var stopCommand = new Command4("stop").description("Gracefully shut down the NEX
 });
 
 // src/commands/status.ts
+init_logger();
+init_secrets();
+init_docker();
 import { Command as Command5 } from "commander";
 import chalk8 from "chalk";
 async function checkHttpHealth(port) {
@@ -2294,10 +2522,14 @@ var statusCommand = new Command5("status").description("Check NEXUS runtime heal
 });
 
 // src/commands/doctor.ts
+init_logger();
+init_platform();
+init_docker();
+init_secrets();
 import { Command as Command6 } from "commander";
 import chalk9 from "chalk";
-import fs4 from "fs";
-import path6 from "path";
+import fs3 from "fs";
+import path5 from "path";
 var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime environment").action(async () => {
   const platform = detectPlatform();
   const check = (ok) => ok ? chalk9.green("\u2713") : chalk9.red("\u2717");
@@ -2313,7 +2545,7 @@ var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime e
   } else {
     console.log(`  ${check(false)}  Docker not installed`);
   }
-  const keyExists = fs4.existsSync(path6.join(NEXUS_HOME2, "ssh", "id_nexus_vm"));
+  const keyExists = fs3.existsSync(path5.join(NEXUS_HOME2, "ssh", "id_nexus_vm"));
   console.log(`  ${check(keyExists)}  SSH key`);
   const config = loadConfig();
   console.log(`  ${check(!!config)}  Configuration`);
@@ -2345,12 +2577,13 @@ var doctorCommand = new Command6("doctor").description("Diagnose NEXUS runtime e
 });
 
 // src/commands/logs.ts
+init_logger();
 import { Command as Command7 } from "commander";
-import { execa as execa3 } from "execa";
+import { execa as execa4 } from "execa";
 var logsCommand = new Command7("logs").description("View NEXUS server logs").action(async () => {
   let containerExists2 = false;
   try {
-    const { stdout } = await execa3("docker", [
+    const { stdout } = await execa4("docker", [
       "ps",
       "-a",
       "--filter",
@@ -2367,7 +2600,7 @@ var logsCommand = new Command7("logs").description("View NEXUS server logs").act
     log.error("NEXUS container not found. Start with: buildwithnexus start");
     process.exit(1);
   }
-  const proc = execa3("docker", ["logs", "-f", "nexus"], {
+  const proc = execa4("docker", ["logs", "-f", "nexus"], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -2378,16 +2611,19 @@ var logsCommand = new Command7("logs").description("View NEXUS server logs").act
 
 // src/commands/update.ts
 import { Command as Command8 } from "commander";
-import path7 from "path";
-import fs5 from "fs";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { execa as execa4 } from "execa";
+import path6 from "path";
+import fs4 from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+init_logger();
+init_secrets();
+init_docker();
+import { execa as execa5 } from "execa";
 function getReleaseTarball() {
-  const dir = path7.dirname(fileURLToPath3(import.meta.url));
-  const tarballPath = path7.join(dir, "nexus-release.tar.gz");
-  if (fs5.existsSync(tarballPath)) return tarballPath;
-  const rootPath = path7.resolve(dir, "..", "dist", "nexus-release.tar.gz");
-  if (fs5.existsSync(rootPath)) return rootPath;
+  const dir = path6.dirname(fileURLToPath2(import.meta.url));
+  const tarballPath = path6.join(dir, "nexus-release.tar.gz");
+  if (fs4.existsSync(tarballPath)) return tarballPath;
+  const rootPath = path6.resolve(dir, "..", "dist", "nexus-release.tar.gz");
+  if (fs4.existsSync(rootPath)) return rootPath;
   throw new Error("nexus-release.tar.gz not found. Reinstall buildwithnexus to get the latest release.");
 }
 var updateCommand = new Command8("update").description("Update NEXUS to the latest bundled release and restart").action(async () => {
@@ -2403,7 +2639,7 @@ var updateCommand = new Command8("update").description("Update NEXUS to the late
   let spinner = createSpinner("Uploading release tarball...");
   spinner.start();
   const tarballPath = getReleaseTarball();
-  await execa4("docker", ["cp", tarballPath, "nexus:/tmp/nexus-release.tar.gz"]);
+  await execa5("docker", ["cp", tarballPath, "nexus:/tmp/nexus-release.tar.gz"]);
   succeed(spinner, "Tarball uploaded");
   spinner = createSpinner("Stopping NEXUS server...");
   spinner.start();
@@ -2438,9 +2674,12 @@ var updateCommand = new Command8("update").description("Update NEXUS to the late
 // src/commands/destroy.ts
 import { Command as Command9 } from "commander";
 import chalk10 from "chalk";
-import fs6 from "fs";
+import fs5 from "fs";
 import { input } from "@inquirer/prompts";
-import path8 from "path";
+init_logger();
+init_secrets();
+init_docker();
+import path7 from "path";
 var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and all data").option("--force", "Skip confirmation").action(async (opts) => {
   const config = loadConfig();
   if (!opts.force) {
@@ -2467,9 +2706,9 @@ var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and al
     }
     await stopNexus();
   }
-  const sshConfigPath = path8.join(process.env.HOME || "~", ".ssh", "config");
-  if (fs6.existsSync(sshConfigPath)) {
-    const content = fs6.readFileSync(sshConfigPath, "utf-8");
+  const sshConfigPath = path7.join(process.env.HOME || "~", ".ssh", "config");
+  if (fs5.existsSync(sshConfigPath)) {
+    const content = fs5.readFileSync(sshConfigPath, "utf-8");
     const lines = content.split("\n");
     const filtered = [];
     let skip = false;
@@ -2482,14 +2721,17 @@ var destroyCommand = new Command9("destroy").description("Remove NEXUS VM and al
       skip = false;
       filtered.push(line);
     }
-    fs6.writeFileSync(sshConfigPath, filtered.join("\n"));
+    fs5.writeFileSync(sshConfigPath, filtered.join("\n"));
   }
-  fs6.rmSync(NEXUS_HOME2, { recursive: true, force: true });
+  fs5.rmSync(NEXUS_HOME2, { recursive: true, force: true });
   succeed(spinner, "NEXUS runtime destroyed");
   log.dim("Run 'buildwithnexus init' to set up again");
 });
 
 // src/commands/keys.ts
+init_logger();
+init_secrets();
+init_dlp();
 import { Command as Command10 } from "commander";
 import { password as password2 } from "@inquirer/prompts";
 import chalk11 from "chalk";
@@ -2548,8 +2790,10 @@ keysCommand.command("set <key>").description("Set or update an API key (e.g. ANT
 });
 
 // src/commands/ssh.ts
+init_logger();
+init_docker();
 import { Command as Command11 } from "commander";
-import { execa as execa5 } from "execa";
+import { execa as execa6 } from "execa";
 var sshCommand = new Command11("ssh").description("Open an interactive shell inside the NEXUS container").action(async () => {
   const running = await isNexusRunning();
   if (!running) {
@@ -2557,13 +2801,17 @@ var sshCommand = new Command11("ssh").description("Open an interactive shell ins
     process.exit(1);
   }
   log.dim("Opening shell in NEXUS container...");
-  await execa5("docker", ["exec", "-it", "nexus", "/bin/bash"], { stdio: "inherit" });
+  await execa6("docker", ["exec", "-it", "nexus", "/bin/bash"], { stdio: "inherit" });
 });
 
 // src/commands/brainstorm.ts
+init_logger();
 import { Command as Command12 } from "commander";
 import chalk12 from "chalk";
 import { input as input2 } from "@inquirer/prompts";
+init_secrets();
+init_docker();
+init_dlp();
 var COS_PREFIX = chalk12.bold.cyan("  Chief of Staff");
 var YOU_PREFIX = chalk12.bold.white("  You");
 var DIVIDER = chalk12.dim("  " + "\u2500".repeat(56));
@@ -2601,13 +2849,7 @@ var brainstormCommand = new Command12("brainstorm").description("Brainstorm an i
     }
     const spinner = createSpinner("Connecting to NEXUS...");
     spinner.start();
-    let healthOk = false;
-    try {
-      const healthRes = await fetch(`http://localhost:${config.httpPort}/health`);
-      const healthText = await healthRes.text();
-      healthOk = healthRes.ok && healthText.includes("ok");
-    } catch {
-    }
+    const healthOk = await checkServerHealth(config.httpPort);
     if (!healthOk) {
       fail(spinner, "NEXUS server is not healthy");
       log.warn("Check status: buildwithnexus status");
@@ -2682,9 +2924,13 @@ var brainstormCommand = new Command12("brainstorm").description("Brainstorm an i
 });
 
 // src/commands/ninety-nine.ts
+init_logger();
 import { Command as Command13 } from "commander";
 import chalk13 from "chalk";
 import { input as input3 } from "@inquirer/prompts";
+init_secrets();
+init_docker();
+init_dlp();
 var AGENT_PREFIX = chalk13.bold.green("  99 \u276F");
 var YOU_PREFIX2 = chalk13.bold.white("  You");
 var DIVIDER2 = chalk13.dim("  " + "\u2500".repeat(56));
@@ -2872,15 +3118,20 @@ var ninetyNineCommand = new Command13("99").description("AI pair-programming ses
 });
 
 // src/commands/shell.ts
+init_logger();
 import { Command as Command14 } from "commander";
 import chalk16 from "chalk";
+init_secrets();
+init_docker();
+init_dlp();
 
 // src/ui/repl.ts
+init_secrets();
 import readline3 from "readline";
-import fs7 from "fs";
-import path9 from "path";
+import fs6 from "fs";
+import path8 from "path";
 import chalk14 from "chalk";
-var HISTORY_FILE = path9.join(NEXUS_HOME2, "shell_history");
+var HISTORY_FILE = path8.join(NEXUS_HOME2, "shell_history");
 var MAX_HISTORY = 1e3;
 var Repl = class {
   rl = null;
@@ -2896,17 +3147,17 @@ var Repl = class {
   }
   loadHistory() {
     try {
-      if (fs7.existsSync(HISTORY_FILE)) {
-        this.history = fs7.readFileSync(HISTORY_FILE, "utf-8").split("\n").filter(Boolean).slice(-MAX_HISTORY);
+      if (fs6.existsSync(HISTORY_FILE)) {
+        this.history = fs6.readFileSync(HISTORY_FILE, "utf-8").split("\n").filter(Boolean).slice(-MAX_HISTORY);
       }
     } catch {
     }
   }
   saveHistory() {
     try {
-      const dir = path9.dirname(HISTORY_FILE);
-      fs7.mkdirSync(dir, { recursive: true });
-      fs7.writeFileSync(HISTORY_FILE, this.history.slice(-MAX_HISTORY).join("\n") + "\n", { mode: 384 });
+      const dir = path8.dirname(HISTORY_FILE);
+      fs6.mkdirSync(dir, { recursive: true });
+      fs6.writeFileSync(HISTORY_FILE, this.history.slice(-MAX_HISTORY).join("\n") + "\n", { mode: 384 });
     } catch {
     }
   }
@@ -3002,6 +3253,9 @@ var Repl = class {
 };
 
 // src/core/event-stream.ts
+init_docker();
+init_secrets();
+init_dlp();
 import chalk15 from "chalk";
 var ROLE_COLORS = {
   "Chief of Staff": chalk15.bold.cyan,
@@ -3116,33 +3370,6 @@ var EventStream = class {
 };
 
 // src/commands/shell.ts
-async function httpPost(httpPort, path12, body) {
-  const res = await fetch(`http://localhost:${httpPort}${path12}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(6e4)
-  });
-  if (!res.ok) throw new Error(`Server returned ${res.status}`);
-  const text = await res.text();
-  try {
-    const parsed = JSON.parse(text);
-    return parsed.response ?? parsed.message ?? text;
-  } catch {
-    return text;
-  }
-}
-async function httpGet(httpPort, path12) {
-  try {
-    const res = await fetch(`http://localhost:${httpPort}${path12}`, {
-      signal: AbortSignal.timeout(1e4)
-    });
-    const text = await res.text();
-    return { ok: res.ok, text };
-  } catch {
-    return { ok: false, text: "" };
-  }
-}
 async function sendMessage2(httpPort, message) {
   return httpPost(httpPort, "/message", { message, source: "shell" });
 }
@@ -3376,12 +3603,12 @@ var shellCommand2 = new Command14("shell").description("Launch the interactive N
       name: "logs",
       description: "Show recent container logs",
       handler: async () => {
-        const { execa: execa6 } = await import("execa");
+        const { execa: execa7 } = await import("execa");
         console.log("");
         console.log(chalk16.bold("  Recent Logs:"));
         console.log(chalk16.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
         try {
-          const { stdout } = await execa6("docker", ["logs", "--tail", "30", "nexus"]);
+          const { stdout } = await execa7("docker", ["logs", "--tail", "30", "nexus"]);
           for (const line of redact(stdout).split("\n")) {
             console.log(chalk16.dim("  " + line));
           }
@@ -3395,10 +3622,10 @@ var shellCommand2 = new Command14("shell").description("Launch the interactive N
       name: "exec",
       description: "Drop into the container shell for debugging/inspection",
       handler: async () => {
-        const { execa: execa6 } = await import("execa");
+        const { execa: execa7 } = await import("execa");
         eventStream.stop();
         try {
-          await execa6("docker", ["exec", "-it", "nexus", "/bin/sh"], { stdio: "inherit" });
+          await execa7("docker", ["exec", "-it", "nexus", "/bin/sh"], { stdio: "inherit" });
         } catch {
         }
         eventStream.start();
@@ -3551,49 +3778,19 @@ var shellCommand2 = new Command14("shell").description("Launch the interactive N
   }
 });
 
-// src/cli.ts
-function getVersionStatic() {
-  try {
-    const __dirname2 = dirname2(fileURLToPath4(import.meta.url));
-    const packagePath = join2(__dirname2, "..", "package.json");
-    const packageJson = JSON.parse(readFileSync2(packagePath, "utf-8"));
-    return packageJson.version;
-  } catch {
-    return true ? "0.7.1" : "0.0.0-unknown";
-  }
-}
-var cli = new Command15().name("buildwithnexus").description("Auto-scaffold and launch a fully autonomous NEXUS runtime").version(getVersionStatic());
-cli.addCommand(installCommand);
-cli.addCommand(initCommand);
-cli.addCommand(startCommand);
-cli.addCommand(stopCommand);
-cli.addCommand(statusCommand);
-cli.addCommand(doctorCommand);
-cli.addCommand(logsCommand);
-cli.addCommand(updateCommand);
-cli.addCommand(destroyCommand);
-cli.addCommand(keysCommand);
-cli.addCommand(sshCommand);
-cli.addCommand(brainstormCommand);
-cli.addCommand(ninetyNineCommand);
-cli.addCommand(shellCommand2);
-cli.action(() => {
-  cli.help();
-});
-
 // src/core/update-notifier.ts
-import fs8 from "fs";
-import path10 from "path";
-import os4 from "os";
+import fs7 from "fs";
+import path9 from "path";
+import os3 from "os";
 import https from "https";
 import chalk17 from "chalk";
 var PACKAGE_NAME = "buildwithnexus";
 var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
-var STATE_DIR = path10.join(os4.homedir(), ".buildwithnexus");
-var STATE_FILE = path10.join(STATE_DIR, ".update-check.json");
+var STATE_DIR = path9.join(os3.homedir(), ".buildwithnexus");
+var STATE_FILE = path9.join(STATE_DIR, ".update-check.json");
 function readState() {
   try {
-    const raw = fs8.readFileSync(STATE_FILE, "utf-8");
+    const raw = fs7.readFileSync(STATE_FILE, "utf-8");
     return JSON.parse(raw);
   } catch {
     return { lastCheck: 0, latestVersion: null };
@@ -3601,8 +3798,8 @@ function readState() {
 }
 function writeState(state) {
   try {
-    fs8.mkdirSync(STATE_DIR, { recursive: true, mode: 448 });
-    fs8.writeFileSync(STATE_FILE, JSON.stringify(state), { mode: 384 });
+    fs7.mkdirSync(STATE_DIR, { recursive: true, mode: 448 });
+    fs7.writeFileSync(STATE_FILE, JSON.stringify(state), { mode: 384 });
   } catch {
   }
 }
@@ -3674,18 +3871,34 @@ function printUpdateBanner(current, latest) {
   process.stderr.write(msg + "\n");
 }
 
+// src/core/models.ts
+var MODELS = {
+  OPUS: "claude-opus-4-6",
+  SONNET: "claude-sonnet-4-6-20250929",
+  HAIKU: "claude-haiku-4-5-20251001",
+  DEFAULT: "claude-sonnet-4-6-20250929"
+};
+
 // src/bin.ts
 import dotenv2 from "dotenv";
-import os5 from "os";
-import path11 from "path";
-var homeEnvPath = path11.join(os5.homedir(), ".env.local");
+import os4 from "os";
+import path10 from "path";
+var homeEnvPath = path10.join(os4.homedir(), ".env.local");
 dotenv2.config({ path: homeEnvPath });
-var version = true ? "0.7.1" : "0.5.17";
+var version = resolvedVersion;
 checkForUpdates(version);
 program.name("buildwithnexus").description("Nexus - AI-Powered Task Execution").version(version);
 program.command("da-init").description("Initialize Nexus (set up API keys and .env.local)").action(deepAgentsInitCommand);
-program.command("run <task>").description("Run a task with Nexus").option("-a, --agent <name>", "Agent role (engineer, researcher, etc)", "engineer").option("-g, --goal <goal>", "Agent goal").option("-m, --model <model>", "LLM model", "claude-sonnet-4-20250514").action(runCommand);
+program.command("run <task>").description("Run a task with Nexus").option("-a, --agent <name>", "Agent role (engineer, researcher, etc)", "engineer").option("-g, --goal <goal>", "Agent goal").option("-m, --model <model>", "LLM model", MODELS.DEFAULT).action(runCommand);
 program.command("dashboard").description("Start the Nexus dashboard server").option("-p, --port <port>", "Dashboard port", "4201").action(dashboardCommand);
+program.command("server").description("Start the Nexus backend server").action(async () => {
+  const { startBackend: startBackend2 } = await Promise.resolve().then(() => (init_docker(), docker_exports));
+  await startBackend2();
+  const chalk18 = (await import("chalk")).default;
+  console.log(chalk18.green("Backend server started. Press Ctrl+C to stop."));
+  await new Promise(() => {
+  });
+});
 program.command("da-status").description("Check Nexus backend status").action(async () => {
   const backendUrl = process.env.BACKEND_URL || "http://localhost:4200";
   try {
@@ -3703,12 +3916,20 @@ program.command("da-status").description("Check Nexus backend status").action(as
     console.log("   cd ~/Projects/nexus && python -m src.deep_agents_server");
   }
 });
-for (const cmd of cli.commands) {
-  const name = cmd.name();
-  if (!["da-init", "run", "dashboard", "da-status"].includes(name)) {
-    program.addCommand(cmd);
-  }
-}
+program.addCommand(installCommand);
+program.addCommand(initCommand);
+program.addCommand(startCommand);
+program.addCommand(stopCommand);
+program.addCommand(statusCommand);
+program.addCommand(doctorCommand);
+program.addCommand(logsCommand);
+program.addCommand(updateCommand);
+program.addCommand(destroyCommand);
+program.addCommand(keysCommand);
+program.addCommand(sshCommand);
+program.addCommand(brainstormCommand);
+program.addCommand(ninetyNineCommand);
+program.addCommand(shellCommand2);
 if (!process.argv.slice(2).length) {
   interactiveMode().catch((err) => {
     console.error(err);
@@ -3717,3 +3938,6 @@ if (!process.argv.slice(2).length) {
 } else {
   program.parse();
 }
+export {
+  version
+};