closeclaw 3.0.3 → 3.0.5

package/dist/cli.cjs

@@ -30,128 +30,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/config.ts
-var config_exports = {};
-__export(config_exports, {
-  getConfig: () => getConfig,
-  loadConfig: () => loadConfig
-});
-function getDefaults() {
-  return {
-    port: 4800,
-    host: "0.0.0.0",
-    dataDir: DEFAULT_DATA_DIR,
-    logLevel: "info",
-    github: {
-      appId: "",
-      privateKeyPath: "",
-      webhookSecret: "",
-      installationId: ""
-    }
-  };
-}
-function readConfigFile() {
-  if (!(0, import_node_fs.existsSync)(CONFIG_PATH)) {
-    const dir = (0, import_node_path.dirname)(CONFIG_PATH);
-    if (!(0, import_node_fs.existsSync)(dir)) {
-      (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    }
-    (0, import_node_fs.writeFileSync)(CONFIG_PATH, JSON.stringify(getDefaults(), null, 2), "utf-8");
-    return {};
-  }
-  try {
-    const raw = (0, import_node_fs.readFileSync)(CONFIG_PATH, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
-}
-function readEnvVars() {
-  const env = {};
-  if (process.env.PLATFORM_PORT) {
-    const port2 = parseInt(process.env.PLATFORM_PORT, 10);
-    if (!isNaN(port2)) env.port = port2;
-  }
-  if (process.env.PLATFORM_HOST) {
-    env.host = process.env.PLATFORM_HOST;
-  }
-  if (process.env.PLATFORM_DATA_DIR) {
-    env.dataDir = process.env.PLATFORM_DATA_DIR;
-  }
-  if (process.env.PLATFORM_LOG_LEVEL) {
-    const level = process.env.PLATFORM_LOG_LEVEL;
-    if (["debug", "info", "warn", "error"].includes(level)) {
-      env.logLevel = level;
-    }
-  }
-  const gh = {};
-  let hasGithub = false;
-  if (process.env.GITHUB_APP_ID) {
-    gh.appId = process.env.GITHUB_APP_ID;
-    hasGithub = true;
-  }
-  if (process.env.GITHUB_PRIVATE_KEY_PATH) {
-    gh.privateKeyPath = process.env.GITHUB_PRIVATE_KEY_PATH;
-    hasGithub = true;
-  }
-  if (process.env.GITHUB_WEBHOOK_SECRET) {
-    gh.webhookSecret = process.env.GITHUB_WEBHOOK_SECRET;
-    hasGithub = true;
-  }
-  if (process.env.GITHUB_INSTALLATION_ID) {
-    gh.installationId = process.env.GITHUB_INSTALLATION_ID;
-    hasGithub = true;
-  }
-  if (hasGithub) {
-    env.github = gh;
-  }
-  return env;
-}
-function deepMerge(target, ...sources) {
-  const result = { ...target };
-  for (const source of sources) {
-    if (source.port !== void 0) result.port = source.port;
-    if (source.host !== void 0) result.host = source.host;
-    if (source.dataDir !== void 0) result.dataDir = source.dataDir;
-    if (source.logLevel !== void 0) result.logLevel = source.logLevel;
-    if (source.github) {
-      result.github = {
-        ...result.github,
-        ...source.github
-      };
-    }
-  }
-  return result;
-}
-function loadConfig(cliFlags) {
-  const defaults = getDefaults();
-  const envVars = readEnvVars();
-  const fileConfig = readConfigFile();
-  _config = deepMerge(defaults, envVars, fileConfig, cliFlags || {});
-  if (!(0, import_node_fs.existsSync)(_config.dataDir)) {
-    (0, import_node_fs.mkdirSync)(_config.dataDir, { recursive: true });
-  }
-  return _config;
-}
-function getConfig() {
-  if (!_config) {
-    throw new Error("Config not loaded. Call loadConfig() first.");
-  }
-  return _config;
-}
-var import_node_fs, import_node_path, import_node_os, DEFAULT_DATA_DIR, CONFIG_PATH, _config;
-var init_config = __esm({
-  "src/config.ts"() {
-    "use strict";
-    import_node_fs = require("fs");
-    import_node_path = require("path");
-    import_node_os = require("os");
-    DEFAULT_DATA_DIR = (0, import_node_path.join)((0, import_node_os.homedir)(), ".closeclaw", "data");
-    CONFIG_PATH = (0, import_node_path.join)((0, import_node_os.homedir)(), ".closeclaw", "config.json");
-    _config = null;
-  }
-});
-
 // src/db/schema.ts
 var schema_exports = {};
 __export(schema_exports, {
@@ -471,15 +349,15 @@ __export(connection_exports, {
   initDatabase: () => initDatabase
 });
 function getDataDir() {
-  return process.env.PLATFORM_DATA_DIR || (0, import_node_path2.join)(process.env.HOME || "~", ".closeclaw", "data");
+  return process.env.PLATFORM_DATA_DIR || (0, import_node_path.join)(process.env.HOME || "~", ".closeclaw", "data");
 }
 function initDatabase(dataDir) {
   if (_db) return _db;
   const dir = dataDir || getDataDir();
-  if (!(0, import_node_fs2.existsSync)(dir)) {
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  if (!(0, import_node_fs.existsSync)(dir)) {
+    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
   }
-  const dbPath = (0, import_node_path2.join)(dir, "platform.db");
+  const dbPath = (0, import_node_path.join)(dir, "platform.db");
   _sqlite = new import_better_sqlite3.default(dbPath);
   _sqlite.pragma("journal_mode = WAL");
   _sqlite.pragma("synchronous = NORMAL");
@@ -505,14 +383,14 @@ function closeDatabase() {
     _db = null;
   }
 }
-var import_better_sqlite3, import_better_sqlite32, import_node_path2, import_node_fs2, _db, _sqlite;
+var import_better_sqlite3, import_better_sqlite32, import_node_path, import_node_fs, _db, _sqlite;
 var init_connection = __esm({
   "src/db/connection.ts"() {
     "use strict";
     import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
     import_better_sqlite32 = require("drizzle-orm/better-sqlite3");
-    import_node_path2 = require("path");
-    import_node_fs2 = require("fs");
+    import_node_path = require("path");
+    import_node_fs = require("fs");
     init_schema();
     _db = null;
     _sqlite = null;
@@ -539,10 +417,20 @@ function verifyLicense(key) {
     throw new Error("License key is required (set NODE_ENV=development to bypass)");
   }
   try {
+    const parts = key.split(".");
+    if (parts.length !== 3) throw new Error("Invalid JWT format");
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = JSON.parse(Buffer.from(headerB64, "base64url").toString());
+    if (header.alg !== "EdDSA") throw new Error(`Unsupported algorithm: ${header.alg}`);
     const publicKey = (0, import_node_crypto2.createPublicKey)(ED25519_PUBLIC_KEY_PEM);
-    const decoded = import_jsonwebtoken.default.verify(key, publicKey, {
-      algorithms: ["EdDSA"]
-    });
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signature = Buffer.from(signatureB64, "base64url");
+    const valid = (0, import_node_crypto2.verify)(null, Buffer.from(signingInput), publicKey, signature);
+    if (!valid) throw new Error("Invalid signature");
+    const decoded = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+    if (typeof decoded.exp === "number" && decoded.exp < Math.floor(Date.now() / 1e3)) {
+      throw new Error("License expired");
+    }
     if (!decoded.sub || typeof decoded.sub !== "string") {
       throw new Error("License missing 'sub' claim");
     }
@@ -570,10 +458,10 @@ function verifyLicense(key) {
     _devMode = false;
     return _license;
   } catch (err) {
-    if (err instanceof import_jsonwebtoken.default.TokenExpiredError) {
+    if (err instanceof jwt.TokenExpiredError) {
       throw new Error("License key has expired");
     }
-    if (err instanceof import_jsonwebtoken.default.JsonWebTokenError) {
+    if (err instanceof jwt.JsonWebTokenError) {
       throw new Error(`Invalid license key: ${err.message}`);
     }
     throw err;
@@ -589,8 +477,8 @@ function checkSeatLimit() {
   if (!_license) return false;
   if (_devMode) return true;
   const db = getSqlite();
-  const result = db.prepare("SELECT COUNT(*) as count FROM profiles").get();
-  return result.count <= _license.seats;
+  const result2 = db.prepare("SELECT COUNT(*) as count FROM profiles").get();
+  return result2.count <= _license.seats;
 }
 function getLicense() {
   return _license;
@@ -602,11 +490,10 @@ function _resetLicense() {
   _license = null;
   _devMode = false;
 }
-var import_jsonwebtoken, import_node_crypto2, ED25519_PUBLIC_KEY_PEM, _license, _devMode, DEV_LICENSE;
+var import_node_crypto2, ED25519_PUBLIC_KEY_PEM, _license, _devMode, DEV_LICENSE;
 var init_license = __esm({
   "src/license.ts"() {
     "use strict";
-    import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
     import_node_crypto2 = require("crypto");
     init_connection();
     ED25519_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
@@ -965,6 +852,273 @@ var init_migrate = __esm({
   }
 });
 
+// src/db/queries/profiles.ts
+var profiles_exports = {};
+__export(profiles_exports, {
+  countProfiles: () => countProfiles,
+  createProfile: () => createProfile,
+  getProfile: () => getProfile,
+  getProfileByEmail: () => getProfileByEmail,
+  getProfileById: () => getProfileById,
+  isSystemAdmin: () => isSystemAdmin,
+  updateProfile: () => updateProfile
+});
+function getProfile(userId) {
+  const db = getSqlite();
+  const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
+  if (!profile) return null;
+  const orgMemberships = db.prepare("SELECT org_id, role FROM org_members WHERE user_id = ?").all(userId);
+  const projectMemberships = db.prepare("SELECT project_id, role FROM project_members WHERE user_id = ?").all(userId);
+  const orgRoles = {};
+  for (const m of orgMemberships) {
+    orgRoles[m.org_id] = m.role;
+  }
+  const projectRoles = {};
+  for (const m of projectMemberships) {
+    projectRoles[m.project_id] = m.role;
+  }
+  return {
+    ...profile,
+    isSystemAdmin: profile.is_system_admin ?? false,
+    orgRoles,
+    projectRoles
+  };
+}
+function getProfileById(userId) {
+  const db = getSqlite();
+  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
+}
+function getProfileByEmail(email) {
+  const db = getSqlite();
+  return db.prepare("SELECT * FROM profiles WHERE email = ?").get(email);
+}
+function updateProfile(userId, data) {
+  const db = getSqlite();
+  const fields = { ...data, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+  const keys = Object.keys(fields);
+  const setClause = keys.map((k) => `${k} = ?`).join(", ");
+  const values = keys.map((k) => fields[k]);
+  db.prepare(`UPDATE profiles SET ${setClause} WHERE id = ?`).run(...values, userId);
+  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
+}
+function createProfile(data) {
+  const db = getSqlite();
+  const id = (0, import_node_crypto3.randomUUID)();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  db.prepare(
+    `INSERT INTO profiles (id, email, password_hash, full_name, display_name, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    data.email,
+    data.password_hash,
+    data.full_name || null,
+    data.display_name || null,
+    now,
+    now
+  );
+  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(id);
+}
+function countProfiles() {
+  const db = getSqlite();
+  const row = db.prepare("SELECT COUNT(*) as count FROM profiles").get();
+  return row.count;
+}
+function isSystemAdmin(userId) {
+  const db = getSqlite();
+  const row = db.prepare("SELECT is_system_admin FROM profiles WHERE id = ?").get(userId);
+  return row?.is_system_admin === 1;
+}
+var import_node_crypto3;
+var init_profiles = __esm({
+  "src/db/queries/profiles.ts"() {
+    "use strict";
+    init_connection();
+    import_node_crypto3 = require("crypto");
+  }
+});
+
+// src/auth/jwt.ts
+var jwt_exports = {};
+__export(jwt_exports, {
+  _resetSecret: () => _resetSecret,
+  generateJwtSecret: () => generateJwtSecret,
+  generateRefreshToken: () => generateRefreshToken,
+  signAccessToken: () => signAccessToken,
+  verifyAccessToken: () => verifyAccessToken
+});
+function generateJwtSecret(dataDir) {
+  if (_secret) return _secret;
+  const secretPath = (0, import_node_path2.join)(dataDir, "jwt.secret");
+  if ((0, import_node_fs2.existsSync)(secretPath)) {
+    _secret = (0, import_node_fs2.readFileSync)(secretPath, "utf-8").trim();
+    return _secret;
+  }
+  const dir = (0, import_node_path2.dirname)(secretPath);
+  if (!(0, import_node_fs2.existsSync)(dir)) {
+    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  }
+  _secret = (0, import_node_crypto4.randomBytes)(32).toString("hex");
+  (0, import_node_fs2.writeFileSync)(secretPath, _secret, { mode: 384 });
+  return _secret;
+}
+function getSecret() {
+  if (!_secret) {
+    throw new Error("JWT secret not initialized. Call generateJwtSecret(dataDir) first.");
+  }
+  return _secret;
+}
+function signAccessToken(payload) {
+  return import_jsonwebtoken.default.sign(payload, getSecret(), {
+    algorithm: "HS256",
+    expiresIn: "15m"
+  });
+}
+function verifyAccessToken(token) {
+  return import_jsonwebtoken.default.verify(token, getSecret(), {
+    algorithms: ["HS256"]
+  });
+}
+function generateRefreshToken() {
+  return (0, import_node_crypto4.randomBytes)(64).toString("hex");
+}
+function _resetSecret() {
+  _secret = null;
+}
+var import_jsonwebtoken, import_node_crypto4, import_node_fs2, import_node_path2, _secret;
+var init_jwt = __esm({
+  "src/auth/jwt.ts"() {
+    "use strict";
+    import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+    import_node_crypto4 = require("crypto");
+    import_node_fs2 = require("fs");
+    import_node_path2 = require("path");
+    _secret = null;
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  getConfig: () => getConfig,
+  loadConfig: () => loadConfig
+});
+function getDefaults() {
+  return {
+    port: 4800,
+    host: "0.0.0.0",
+    dataDir: DEFAULT_DATA_DIR,
+    logLevel: "info",
+    github: {
+      appId: "",
+      privateKeyPath: "",
+      webhookSecret: "",
+      installationId: ""
+    }
+  };
+}
+function readConfigFile() {
+  if (!(0, import_node_fs3.existsSync)(CONFIG_PATH)) {
+    const dir = (0, import_node_path3.dirname)(CONFIG_PATH);
+    if (!(0, import_node_fs3.existsSync)(dir)) {
+      (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+    }
+    (0, import_node_fs3.writeFileSync)(CONFIG_PATH, JSON.stringify(getDefaults(), null, 2), "utf-8");
+    return {};
+  }
+  try {
+    const raw = (0, import_node_fs3.readFileSync)(CONFIG_PATH, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function readEnvVars() {
+  const env = {};
+  if (process.env.PLATFORM_PORT) {
+    const port2 = parseInt(process.env.PLATFORM_PORT, 10);
+    if (!isNaN(port2)) env.port = port2;
+  }
+  if (process.env.PLATFORM_HOST) {
+    env.host = process.env.PLATFORM_HOST;
+  }
+  if (process.env.PLATFORM_DATA_DIR) {
+    env.dataDir = process.env.PLATFORM_DATA_DIR;
+  }
+  if (process.env.PLATFORM_LOG_LEVEL) {
+    const level = process.env.PLATFORM_LOG_LEVEL;
+    if (["debug", "info", "warn", "error"].includes(level)) {
+      env.logLevel = level;
+    }
+  }
+  const gh = {};
+  let hasGithub = false;
+  if (process.env.GITHUB_APP_ID) {
+    gh.appId = process.env.GITHUB_APP_ID;
+    hasGithub = true;
+  }
+  if (process.env.GITHUB_PRIVATE_KEY_PATH) {
+    gh.privateKeyPath = process.env.GITHUB_PRIVATE_KEY_PATH;
+    hasGithub = true;
+  }
+  if (process.env.GITHUB_WEBHOOK_SECRET) {
+    gh.webhookSecret = process.env.GITHUB_WEBHOOK_SECRET;
+    hasGithub = true;
+  }
+  if (process.env.GITHUB_INSTALLATION_ID) {
+    gh.installationId = process.env.GITHUB_INSTALLATION_ID;
+    hasGithub = true;
+  }
+  if (hasGithub) {
+    env.github = gh;
+  }
+  return env;
+}
+function deepMerge(target, ...sources) {
+  const result2 = { ...target };
+  for (const source of sources) {
+    if (source.port !== void 0) result2.port = source.port;
+    if (source.host !== void 0) result2.host = source.host;
+    if (source.dataDir !== void 0) result2.dataDir = source.dataDir;
+    if (source.logLevel !== void 0) result2.logLevel = source.logLevel;
+    if (source.github) {
+      result2.github = {
+        ...result2.github,
+        ...source.github
+      };
+    }
+  }
+  return result2;
+}
+function loadConfig(cliFlags) {
+  const defaults = getDefaults();
+  const envVars = readEnvVars();
+  const fileConfig = readConfigFile();
+  _config = deepMerge(defaults, envVars, fileConfig, cliFlags || {});
+  if (!(0, import_node_fs3.existsSync)(_config.dataDir)) {
+    (0, import_node_fs3.mkdirSync)(_config.dataDir, { recursive: true });
+  }
+  return _config;
+}
+function getConfig() {
+  if (!_config) {
+    throw new Error("Config not loaded. Call loadConfig() first.");
+  }
+  return _config;
+}
+var import_node_fs3, import_node_path3, import_node_os, DEFAULT_DATA_DIR, CONFIG_PATH, _config;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    import_node_fs3 = require("fs");
+    import_node_path3 = require("path");
+    import_node_os = require("os");
+    DEFAULT_DATA_DIR = (0, import_node_path3.join)((0, import_node_os.homedir)(), ".closeclaw", "data");
+    CONFIG_PATH = (0, import_node_path3.join)((0, import_node_os.homedir)(), ".closeclaw", "config.json");
+    _config = null;
+  }
+});
+
 // src/services/openclaw-manager.ts
 var openclaw_manager_exports = {};
 __export(openclaw_manager_exports, {
@@ -1148,54 +1302,6 @@ var init_openclaw_manager = __esm({
   }
 });
 
-// src/auth/jwt.ts
-function generateJwtSecret(dataDir) {
-  if (_secret) return _secret;
-  const secretPath = (0, import_node_path3.join)(dataDir, "jwt.secret");
-  if ((0, import_node_fs3.existsSync)(secretPath)) {
-    _secret = (0, import_node_fs3.readFileSync)(secretPath, "utf-8").trim();
-    return _secret;
-  }
-  const dir = (0, import_node_path3.dirname)(secretPath);
-  if (!(0, import_node_fs3.existsSync)(dir)) {
-    (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
-  }
-  _secret = (0, import_node_crypto3.randomBytes)(32).toString("hex");
-  (0, import_node_fs3.writeFileSync)(secretPath, _secret, { mode: 384 });
-  return _secret;
-}
-function getSecret() {
-  if (!_secret) {
-    throw new Error("JWT secret not initialized. Call generateJwtSecret(dataDir) first.");
-  }
-  return _secret;
-}
-function signAccessToken(payload) {
-  return import_jsonwebtoken2.default.sign(payload, getSecret(), {
-    algorithm: "HS256",
-    expiresIn: "15m"
-  });
-}
-function verifyAccessToken(token) {
-  return import_jsonwebtoken2.default.verify(token, getSecret(), {
-    algorithms: ["HS256"]
-  });
-}
-function generateRefreshToken() {
-  return (0, import_node_crypto3.randomBytes)(64).toString("hex");
-}
-var import_jsonwebtoken2, import_node_crypto3, import_node_fs3, import_node_path3, _secret;
-var init_jwt = __esm({
-  "src/auth/jwt.ts"() {
-    "use strict";
-    import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
-    import_node_crypto3 = require("crypto");
-    import_node_fs3 = require("fs");
-    import_node_path3 = require("path");
-    _secret = null;
-  }
-});
-
 // src/auth/ws-auth.ts
 function authenticateConnection(req) {
   const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
@@ -1256,8 +1362,8 @@ function getCached(key) {
   }
   return entry.result;
 }
-function setCache(key, result) {
-  accessCache.set(key, { result, expiresAt: Date.now() + CACHE_TTL });
+function setCache(key, result2) {
+  accessCache.set(key, { result: result2, expiresAt: Date.now() + CACHE_TTL });
 }
 function invalidateUserCache(userId) {
   for (const key of accessCache.keys()) {
@@ -1275,14 +1381,14 @@ function getOrgAccess(userId, orgId) {
     "SELECT role FROM org_members WHERE org_id = ? AND user_id = ?"
   ).get(orgId, userId);
   if (!member) {
-    const result2 = { allowed: false };
-    setCache(cacheKey, result2);
-    return result2;
+    const result3 = { allowed: false };
+    setCache(cacheKey, result3);
+    return result3;
   }
   const orgRole = member.role === "owner" || member.role === "admin" ? "admin" : "member";
-  const result = { allowed: true, orgRole };
-  setCache(cacheKey, result);
-  return result;
+  const result2 = { allowed: true, orgRole };
+  setCache(cacheKey, result2);
+  return result2;
 }
 function getProjectAccess(userId, projectId) {
   const cacheKey = `${userId}:proj:${projectId}`;
@@ -1293,28 +1399,28 @@ function getProjectAccess(userId, projectId) {
     "SELECT org_id FROM projects WHERE id = ?"
   ).get(projectId);
   if (!project) {
-    const result2 = { allowed: false };
-    setCache(cacheKey, result2);
-    return result2;
+    const result3 = { allowed: false };
+    setCache(cacheKey, result3);
+    return result3;
   }
   const orgAccess = getOrgAccess(userId, project.org_id);
   if (orgAccess.orgRole === "admin") {
-    const result2 = { allowed: true, orgRole: "admin", projectRole: "project_lead" };
-    setCache(cacheKey, result2);
-    return result2;
+    const result3 = { allowed: true, orgRole: "admin", projectRole: "project_lead" };
+    setCache(cacheKey, result3);
+    return result3;
   }
   const projectMember = db.prepare(
     "SELECT role FROM project_members WHERE project_id = ? AND user_id = ?"
   ).get(projectId, userId);
   if (!projectMember) {
-    const result2 = { allowed: false, orgRole: orgAccess.orgRole };
-    setCache(cacheKey, result2);
-    return result2;
+    const result3 = { allowed: false, orgRole: orgAccess.orgRole };
+    setCache(cacheKey, result3);
+    return result3;
   }
   const projectRole = projectMember.role === "lead" || projectMember.role === "project_lead" ? "project_lead" : "member";
-  const result = { allowed: true, orgRole: orgAccess.orgRole, projectRole };
-  setCache(cacheKey, result);
-  return result;
+  const result2 = { allowed: true, orgRole: orgAccess.orgRole, projectRole };
+  setCache(cacheKey, result2);
+  return result2;
 }
 function requireOrgAccess(userId, orgId) {
   const access = getOrgAccess(userId, orgId);
@@ -1539,11 +1645,11 @@ async function routeMessage(conn, raw) {
   }
   log.ws("in", conn.clientId, msg);
   if (type === "subscribe") {
-    const result = await subscribe(conn, msg.scope, msg.projectId, msg.taskId);
-    if (result.ok) {
+    const result2 = await subscribe(conn, msg.scope, msg.projectId, msg.taskId);
+    if (result2.ok) {
       sendResponse(conn, id, { ok: true });
     } else {
-      sendError(conn, id, "SUBSCRIBE_FAILED", result.error || "Subscription failed");
+      sendError(conn, id, "SUBSCRIBE_FAILED", result2.error || "Subscription failed");
     }
     return;
   }
@@ -1566,15 +1672,15 @@ async function routeMessage(conn, raw) {
     }
   }
   try {
-    const result = await handler({ conn, requestId: id, data: msg.data || {} });
-    if (idempotencyKey && result.ok) {
+    const result2 = await handler({ conn, requestId: id, data: msg.data || {} });
+    if (idempotencyKey && result2.ok) {
       idempotencyCache.set(idempotencyKey, {
-        response: result,
+        response: result2,
         expiresAt: Date.now() + 3e5
         // 5 min
       });
     }
-    sendResponse(conn, id, result);
+    sendResponse(conn, id, result2);
   } catch (err) {
     if (err instanceof AccessDenied) {
       sendError(conn, id, err.code, err.message);
@@ -1584,13 +1690,13 @@ async function routeMessage(conn, raw) {
     }
   }
 }
-function sendResponse(conn, id, result) {
+function sendResponse(conn, id, result2) {
   if (conn.ws.readyState !== 1) return;
   const msg = {
     id,
     type: "response",
-    ok: result.ok,
-    ...result.ok ? { data: result.data } : { error: result.error }
+    ok: result2.ok,
+    ...result2.ok ? { data: result2.data } : { error: result2.error }
   };
   log.ws("out", conn.clientId, msg);
   conn.ws.send(JSON.stringify(msg));
@@ -1781,9 +1887,9 @@ function buildTaskPrompt(task, project) {
   const comments2 = task.comments;
   if (comments2?.length) {
     lines.push("## Existing Comments");
-    for (const c of comments2) {
-      const who = c.is_ai_message ? "AI" : "Human";
-      lines.push(`**${who}:** ${c.content}`, "");
+    for (const c2 of comments2) {
+      const who = c2.is_ai_message ? "AI" : "Human";
+      lines.push(`**${who}:** ${c2.content}`, "");
     }
   }
   const checklists2 = task.checklists;
@@ -2379,7 +2485,7 @@ function upsertPullRequest(data) {
     );
     return db.prepare("SELECT * FROM pull_requests WHERE id = ?").get(existing.id);
   }
-  const id = (0, import_node_crypto4.randomUUID)();
+  const id = (0, import_node_crypto5.randomUUID)();
   db.prepare(
     `INSERT INTO pull_requests (id, project_id, task_id, github_pr_number, github_pr_url, title, state, author, branch, merged_at, closed_at, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
@@ -2445,7 +2551,7 @@ function saveTaskBranches(taskId, branches) {
   );
   const insertAll = db.transaction((rows) => {
     for (const b of rows) {
-      insert.run((0, import_node_crypto4.randomUUID)(), taskId, b.projectRepoId, b.branchName, b.sourceBranch, now, now);
+      insert.run((0, import_node_crypto5.randomUUID)(), taskId, b.projectRepoId, b.branchName, b.sourceBranch, now, now);
     }
   });
   insertAll(branches);
@@ -2494,7 +2600,7 @@ function upsertProjectRepo(data) {
     );
     return db.prepare("SELECT * FROM project_repos WHERE id = ?").get(existing.id);
   }
-  const id = (0, import_node_crypto4.randomUUID)();
+  const id = (0, import_node_crypto5.randomUUID)();
   db.prepare(
     `INSERT INTO project_repos (id, project_id, repo_owner, repo_name, repo_url, label, installation_id, default_branch, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
@@ -2527,7 +2633,7 @@ function getTaskActivity(taskId, limit = 50) {
 }
 function createTaskActivity(data) {
   const db = getSqlite();
-  const id = (0, import_node_crypto4.randomUUID)();
+  const id = (0, import_node_crypto5.randomUUID)();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.prepare(
     `INSERT INTO task_activity (id, task_id, project_id, event_type, description, metadata, created_at)
@@ -2543,12 +2649,12 @@ function createTaskActivity(data) {
   );
   return db.prepare("SELECT * FROM task_activity WHERE id = ?").get(id);
 }
-var import_node_crypto4;
+var import_node_crypto5;
 var init_github2 = __esm({
   "src/db/queries/github.ts"() {
     "use strict";
     init_connection();
-    import_node_crypto4 = require("crypto");
+    import_node_crypto5 = require("crypto");
   }
 });
 
@@ -2824,7 +2930,7 @@ function getTaskForAgent(taskId) {
 }
 function createTask(data) {
   const db = getSqlite();
-  const id = (0, import_node_crypto5.randomUUID)();
+  const id = (0, import_node_crypto6.randomUUID)();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.prepare(
     `INSERT INTO tasks (id, project_id, parent_task_id, task_number, title, description, status, side, priority, story_points, due_date, start_date, position, created_at, updated_at)
@@ -2930,8 +3036,8 @@ function updatePositionOptimistic(taskId, status, position, expectedUpdatedAt, e
     if (typeof v === "boolean") return v ? 1 : 0;
     return v;
   });
-  const result = db.prepare(`UPDATE tasks SET ${setClause} WHERE id = ? AND updated_at = ?`).run(...values, taskId, expectedUpdatedAt);
-  return result.changes > 0;
+  const result2 = db.prepare(`UPDATE tasks SET ${setClause} WHERE id = ? AND updated_at = ?`).run(...values, taskId, expectedUpdatedAt);
+  return result2.changes > 0;
 }
 function getNextTaskNumber(projectId) {
   const db = getSqlite();
@@ -3027,12 +3133,12 @@ function recordColumnTransition(taskId, oldStatus, newStatus) {
     "UPDATE tasks SET column_entered_at = ?, column_times = ? WHERE id = ?"
   ).run(now, JSON.stringify(columnTimes), taskId);
 }
-var import_node_crypto5;
+var import_node_crypto6;
 var init_tasks = __esm({
   "src/db/queries/tasks.ts"() {
     "use strict";
     init_connection();
-    import_node_crypto5 = require("crypto");
+    import_node_crypto6 = require("crypto");
   }
 });
 
@@ -3096,7 +3202,7 @@ function getActivity(taskId, limit = 50) {
 }
 function createActivity(data) {
   const db = getSqlite();
-  const id = (0, import_node_crypto6.randomUUID)();
+  const id = (0, import_node_crypto7.randomUUID)();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.prepare(
     `INSERT INTO activity_log (id, task_id, project_id, user_id, action, field, old_value, new_value, metadata, is_ai_action, ai_agent_id, created_at)
@@ -3127,7 +3233,7 @@ function createActivities(entries) {
   const insertMany = db.transaction((rows) => {
     for (const e of rows) {
       insert.run(
-        (0, import_node_crypto6.randomUUID)(),
+        (0, import_node_crypto7.randomUUID)(),
         e.task_id || null,
         e.project_id || null,
         e.user_id || null,
@@ -3142,19 +3248,19 @@ function createActivities(entries) {
   });
   insertMany(entries);
 }
-var import_node_crypto6;
+var import_node_crypto7;
 var init_activity = __esm({
   "src/db/queries/activity.ts"() {
     "use strict";
     init_connection();
-    import_node_crypto6 = require("crypto");
+    import_node_crypto7 = require("crypto");
   }
 });
 
 // src/db/queries/projects.ts
 function createProject(data) {
   const db = getSqlite();
-  const id = (0, import_node_crypto7.randomUUID)();
+  const id = (0, import_node_crypto8.randomUUID)();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.prepare(
     `INSERT INTO projects (id, org_id, name, slug, prefix, description, color, icon, created_by, agent_id, agent_instructions, created_at, updated_at)
@@ -3235,7 +3341,7 @@ function getProjectMembers(projectId) {
 }
 function addProjectMember(data) {
   const db = getSqlite();
-  const id = (0, import_node_crypto7.randomUUID)();
+  const id = (0, import_node_crypto8.randomUUID)();
   db.prepare(
     `INSERT INTO project_members (id, project_id, user_id, role) VALUES (?, ?, ?, ?)`
   ).run(id, data.project_id, data.user_id, data.role || "member");
@@ -3299,12 +3405,12 @@ function getProjectOrgId(projectId) {
   const row = db.prepare("SELECT org_id FROM projects WHERE id = ?").get(projectId);
   return row?.org_id || null;
 }
-var import_node_crypto7;
+var import_node_crypto8;
 var init_projects = __esm({
   "src/db/queries/projects.ts"() {
     "use strict";
     init_connection();
-    import_node_crypto7 = require("crypto");
+    import_node_crypto8 = require("crypto");
   }
 });
 
@@ -3549,10 +3655,10 @@ var init_tasks2 = __esm({
               const prompt = buildTaskPrompt(task, project);
               try {
                 if (openclaw.isHealthy()) {
-                  const result = await openclaw.dispatchTask(project.agent_id, taskId, prompt);
+                  const result2 = await openclaw.dispatchTask(project.agent_id, taskId, prompt);
                   updateTask(taskId, {
                     ai_typing: true,
-                    ai_run_id: result?.runId || null,
+                    ai_run_id: result2?.runId || null,
                     ai_dispatched_by: conn.userId
                   });
                   log.info("ai", `Auto-dispatched ${taskId} -> ${project.agent_id} (by ${conn.userId})`);
@@ -3638,92 +3744,6 @@ var init_tasks2 = __esm({
   }
 });
 
-// src/db/queries/profiles.ts
-var profiles_exports = {};
-__export(profiles_exports, {
-  countProfiles: () => countProfiles,
-  createProfile: () => createProfile,
-  getProfile: () => getProfile,
-  getProfileByEmail: () => getProfileByEmail,
-  getProfileById: () => getProfileById,
-  isSystemAdmin: () => isSystemAdmin,
-  updateProfile: () => updateProfile
-});
-function getProfile(userId) {
-  const db = getSqlite();
-  const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
-  if (!profile) return null;
-  const orgMemberships = db.prepare("SELECT org_id, role FROM org_members WHERE user_id = ?").all(userId);
-  const projectMemberships = db.prepare("SELECT project_id, role FROM project_members WHERE user_id = ?").all(userId);
-  const orgRoles = {};
-  for (const m of orgMemberships) {
-    orgRoles[m.org_id] = m.role;
-  }
-  const projectRoles = {};
-  for (const m of projectMemberships) {
-    projectRoles[m.project_id] = m.role;
-  }
-  return {
-    ...profile,
-    isSystemAdmin: profile.is_system_admin ?? false,
-    orgRoles,
-    projectRoles
-  };
-}
-function getProfileById(userId) {
-  const db = getSqlite();
-  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
-}
-function getProfileByEmail(email) {
-  const db = getSqlite();
-  return db.prepare("SELECT * FROM profiles WHERE email = ?").get(email);
-}
-function updateProfile(userId, data) {
-  const db = getSqlite();
-  const fields = { ...data, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
-  const keys = Object.keys(fields);
-  const setClause = keys.map((k) => `${k} = ?`).join(", ");
-  const values = keys.map((k) => fields[k]);
-  db.prepare(`UPDATE profiles SET ${setClause} WHERE id = ?`).run(...values, userId);
-  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
-}
-function createProfile(data) {
-  const db = getSqlite();
-  const id = (0, import_node_crypto8.randomUUID)();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.prepare(
-    `INSERT INTO profiles (id, email, password_hash, full_name, display_name, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    id,
-    data.email,
-    data.password_hash,
-    data.full_name || null,
-    data.display_name || null,
-    now,
-    now
-  );
-  return db.prepare("SELECT * FROM profiles WHERE id = ?").get(id);
-}
-function countProfiles() {
-  const db = getSqlite();
-  const row = db.prepare("SELECT COUNT(*) as count FROM profiles").get();
-  return row.count;
-}
-function isSystemAdmin(userId) {
-  const db = getSqlite();
-  const row = db.prepare("SELECT is_system_admin FROM profiles WHERE id = ?").get(userId);
-  return row?.is_system_admin === 1;
-}
-var import_node_crypto8;
-var init_profiles = __esm({
-  "src/db/queries/profiles.ts"() {
-    "use strict";
-    init_connection();
-    import_node_crypto8 = require("crypto");
-  }
-});
-
 // src/db/queries/orgs.ts
 function createOrg(data) {
   const db = getSqlite();
@@ -3883,8 +3903,8 @@ var init_projects2 = __esm({
           return { ok: true, data: [] };
         }
         try {
-          const result = await openclaw.rpc("agents.list", {});
-          return { ok: true, data: result || [] };
+          const result2 = await openclaw.rpc("agents.list", {});
+          return { ok: true, data: result2 || [] };
         } catch (err) {
           log.error("projects", "Failed to list agents from OpenClaw", err);
           return { ok: true, data: [] };
@@ -5131,8 +5151,8 @@ async function dispatchToAgent(agentId, taskId, message) {
   if (!openclaw.isHealthy()) {
     throw new Error("AI agent system is unavailable");
   }
-  const result = await openclaw.dispatchTask(agentId, taskId, message);
-  return { runId: result?.runId };
+  const result2 = await openclaw.dispatchTask(agentId, taskId, message);
+  return { runId: result2?.runId };
 }
 function setupAgentEventForwarding() {
   openclaw.onEvent("*", (event) => {
@@ -5349,9 +5369,9 @@ async function adminRpc(userId, orgId, method, params = {}) {
     return { ok: false, error: { code: "OPENCLAW_UNAVAILABLE", message: "OpenClaw gateway is not connected" } };
   }
   try {
-    const result = await openclaw.rpc(method, params);
+    const result2 = await openclaw.rpc(method, params);
     log.oc("out", { method });
-    return { ok: true, data: result };
+    return { ok: true, data: result2 };
   } catch (err) {
     log.error("admin", `RPC ${method} failed`, err);
     return { ok: false, error: { code: "RPC_FAILED", message: err.message || `RPC ${method} failed` } };
@@ -5571,13 +5591,13 @@ var init_github3 = __esm({
             repo.installation_id,
             `/repos/${repo.repo_owner}/${repo.repo_name}/branches?per_page=100`
           );
-          const result = branches.map((b) => ({
+          const result2 = branches.map((b) => ({
             name: b.name,
             sha: b.commit?.sha,
             protected: b.protected
           }));
           const enriched = await Promise.all(
-            result.slice(0, 30).map(async (branch) => {
+            result2.slice(0, 30).map(async (branch) => {
               try {
                 const commit = await githubApi(
                   repo.installation_id,
@@ -5593,7 +5613,7 @@ var init_github3 = __esm({
               }
             })
           );
-          const remaining = result.slice(30).map((b) => ({
+          const remaining = result2.slice(30).map((b) => ({
             ...b,
             lastCommitDate: null,
             lastCommitMessage: null
@@ -6025,11 +6045,11 @@ var init_agent_bridge = __esm({
     init_projects();
     init_profiles();
     agentBridge = new import_hono.Hono();
-    agentBridge.post("/internal/task-update", async (c) => {
+    agentBridge.post("/internal/task-update", async (c2) => {
       try {
-        const { task_id, status, ai_plan, ai_plan_status, comment, side } = await c.req.json();
+        const { task_id, status, ai_plan, ai_plan_status, comment, side } = await c2.req.json();
         if (!task_id) {
-          return c.json({ ok: false, error: "task_id required" }, 400);
+          return c2.json({ ok: false, error: "task_id required" }, 400);
         }
         log.internal("POST", `/internal/task-update task=${task_id}`);
         const updates = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
@@ -6051,7 +6071,7 @@ var init_agent_bridge = __esm({
             log.db("tasks", "UPDATE", task_id);
           } catch (err) {
             log.error("internal", "Task update failed", err);
-            return c.json({ ok: false, error: err.message }, 500);
+            return c2.json({ ok: false, error: err.message }, 500);
           }
         }
         if (comment) {
@@ -6079,39 +6099,39 @@ var init_agent_bridge = __esm({
             changes: updates
           });
         }
-        return c.json({ ok: true });
+        return c2.json({ ok: true });
       } catch (err) {
         log.error("internal", "task-update error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/task-get", async (c) => {
+    agentBridge.post("/internal/task-get", async (c2) => {
       try {
-        const { task_id } = await c.req.json();
+        const { task_id } = await c2.req.json();
         if (!task_id) {
-          return c.json({ ok: false, error: "task_id required" }, 400);
+          return c2.json({ ok: false, error: "task_id required" }, 400);
         }
         log.internal("POST", `/internal/task-get task=${task_id}`);
         const task = getTaskForAgent(task_id);
         if (!task) {
-          return c.json({ ok: false, error: "Task not found" }, 500);
+          return c2.json({ ok: false, error: "Task not found" }, 500);
         }
-        return c.json({ ok: true, task });
+        return c2.json({ ok: true, task });
       } catch (err) {
         log.error("internal", "task-get error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/git-list-branches", async (c) => {
+    agentBridge.post("/internal/git-list-branches", async (c2) => {
       try {
-        const { task_id } = await c.req.json();
-        if (!task_id) return c.json({ ok: false, error: "task_id required" }, 400);
+        const { task_id } = await c2.req.json();
+        if (!task_id) return c2.json({ ok: false, error: "task_id required" }, 400);
         log.internal("POST", `/internal/git-list-branches task=${task_id}`);
         const taskBranches2 = getTaskBranchesWithRepo(task_id);
         if (!taskBranches2 || taskBranches2.length === 0) {
-          return c.json({ ok: true, branches: [] });
+          return c2.json({ ok: true, branches: [] });
         }
-        const result = [];
+        const result2 = [];
         for (const tb of taskBranches2) {
           const repo = tb.project_repos;
           if (!repo?.installation_id) continue;
@@ -6120,7 +6140,7 @@ var init_agent_bridge = __esm({
               repo.installation_id,
               `/repos/${repo.repo_owner}/${repo.repo_name}/branches?per_page=100`
             );
-            result.push({
+            result2.push({
               repo_label: repo.label,
               repo_owner: repo.repo_owner,
               repo_name: repo.repo_name,
@@ -6130,35 +6150,35 @@ var init_agent_bridge = __esm({
             log.error("internal", `Failed to list branches for ${repo.repo_owner}/${repo.repo_name}`, err);
           }
         }
-        return c.json({ ok: true, repos: result });
+        return c2.json({ ok: true, repos: result2 });
       } catch (err) {
         log.error("internal", "git-list-branches error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/git-create-branch", async (c) => {
+    agentBridge.post("/internal/git-create-branch", async (c2) => {
       try {
-        const { task_id } = await c.req.json();
-        if (!task_id) return c.json({ ok: false, error: "task_id required" }, 400);
+        const { task_id } = await c2.req.json();
+        if (!task_id) return c2.json({ ok: false, error: "task_id required" }, 400);
         log.internal("POST", `/internal/git-create-branch task=${task_id}`);
         const task = getTask(task_id);
-        if (!task) return c.json({ ok: false, error: "Task not found" }, 404);
+        if (!task) return c2.json({ ok: false, error: "Task not found" }, 404);
         await createBranchesForTask(task_id, task.project_id);
-        return c.json({ ok: true });
+        return c2.json({ ok: true });
       } catch (err) {
         log.error("internal", "git-create-branch error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/git-create-pr", async (c) => {
+    agentBridge.post("/internal/git-create-pr", async (c2) => {
       try {
-        const { task_id } = await c.req.json();
-        if (!task_id) return c.json({ ok: false, error: "task_id required" }, 400);
+        const { task_id } = await c2.req.json();
+        if (!task_id) return c2.json({ ok: false, error: "task_id required" }, 400);
         log.internal("POST", `/internal/git-create-pr task=${task_id}`);
         const task = getTaskForAgent(task_id);
-        if (!task) return c.json({ ok: false, error: "Task not found" }, 404);
+        if (!task) return c2.json({ ok: false, error: "Task not found" }, 404);
         const branches = getTaskBranchesWithRepo(task_id);
-        if (!branches || branches.length === 0) return c.json({ ok: false, error: "No branches configured for this task" }, 400);
+        if (!branches || branches.length === 0) return c2.json({ ok: false, error: "No branches configured for this task" }, 400);
         const project = getProject(task.project_id);
         const results = [];
         for (const tb of branches) {
@@ -6245,22 +6265,22 @@ ${task.ai_plan}`);
             log.error("internal", `Failed to create PR for ${repo.repo_owner}/${repo.repo_name}`, err);
           }
         }
-        return c.json({ ok: true, results });
+        return c2.json({ ok: true, results });
       } catch (err) {
         log.error("internal", "git-create-pr error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/git-push", async (c) => {
+    agentBridge.post("/internal/git-push", async (c2) => {
       try {
-        const { task_id, message } = await c.req.json();
-        if (!task_id) return c.json({ ok: false, error: "task_id required" }, 400);
-        if (!message) return c.json({ ok: false, error: "message (commit message) required" }, 400);
+        const { task_id, message } = await c2.req.json();
+        if (!task_id) return c2.json({ ok: false, error: "task_id required" }, 400);
+        if (!message) return c2.json({ ok: false, error: "message (commit message) required" }, 400);
         log.internal("POST", `/internal/git-push task=${task_id}`);
         const task = getTask(task_id);
-        if (!task) return c.json({ ok: false, error: "Task not found" }, 404);
+        if (!task) return c2.json({ ok: false, error: "Task not found" }, 404);
         const branches = getTaskBranchesWithRepo(task_id);
-        if (branches.length === 0) return c.json({ ok: false, error: "No branches configured for this task" }, 400);
+        if (branches.length === 0) return c2.json({ ok: false, error: "No branches configured for this task" }, 400);
         let dispatcher = null;
         if (task.ai_dispatched_by) {
           dispatcher = getProfileById(task.ai_dispatched_by);
@@ -6344,20 +6364,20 @@ ${task.ai_plan}`);
             log.error("internal", `git-push failed for ${repoLabel}`, err);
           }
         }
-        return c.json({ ok: true, results });
+        return c2.json({ ok: true, results });
       } catch (err) {
         log.error("internal", "git-push error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
-    agentBridge.post("/internal/git-pr-status", async (c) => {
+    agentBridge.post("/internal/git-pr-status", async (c2) => {
       try {
-        const { task_id } = await c.req.json();
-        if (!task_id) return c.json({ ok: false, error: "task_id required" }, 400);
+        const { task_id } = await c2.req.json();
+        if (!task_id) return c2.json({ ok: false, error: "task_id required" }, 400);
         log.internal("POST", `/internal/git-pr-status task=${task_id}`);
         const branches = getTaskBranchesWithRepo(task_id);
         if (!branches || branches.length === 0) {
-          return c.json({ ok: true, branches: [], summary: "No branches configured" });
+          return c2.json({ ok: true, branches: [], summary: "No branches configured" });
         }
         const results = branches.map((tb) => {
           const repo = tb.project_repos;
@@ -6400,14 +6420,14 @@ ${task.ai_plan}`);
         const readyToMerge = results.some(
           (r) => r.pr_number && r.merge_readiness.ci_passed && r.merge_readiness.approved && r.merge_readiness.no_conflicts && r.merge_readiness.up_to_date
         );
-        return c.json({
+        return c2.json({
           ok: true,
           branches: results,
           summary: readyToMerge ? "Ready to merge" : results.some((r) => r.pr_number) ? "PR open -- not ready" : "No PR yet"
         });
       } catch (err) {
         log.error("internal", "git-pr-status error", err);
-        return c.json({ ok: false, error: err.message }, 500);
+        return c2.json({ ok: false, error: err.message }, 500);
       }
     });
   }
@@ -6450,10 +6470,10 @@ var init_middleware = __esm({
     "use strict";
     import_factory = require("hono/factory");
     init_jwt();
-    authMiddleware = (0, import_factory.createMiddleware)(async (c, next) => {
-      const authHeader = c.req.header("Authorization");
+    authMiddleware = (0, import_factory.createMiddleware)(async (c2, next) => {
+      const authHeader = c2.req.header("Authorization");
       if (!authHeader?.startsWith("Bearer ")) {
-        return c.json(
+        return c2.json(
           { error: "Missing or invalid authorization header", code: "UNAUTHORIZED" },
           401
         );
@@ -6461,10 +6481,10 @@ var init_middleware = __esm({
       const token = authHeader.slice(7);
       try {
         const payload = verifyAccessToken(token);
-        c.set("userId", payload.sub);
-        c.set("email", payload.email);
+        c2.set("userId", payload.sub);
+        c2.set("email", payload.email);
       } catch {
-        return c.json(
+        return c2.json(
           { error: "Invalid or expired token", code: "UNAUTHORIZED" },
           401
         );
@@ -6524,14 +6544,14 @@ var init_routes = __esm({
       preferences: import_zod5.z.record(import_zod5.z.unknown()).optional()
     });
     auth = new import_hono2.Hono();
-    auth.post("/signup", async (c) => {
-      const body = await c.req.json().catch(() => null);
+    auth.post("/signup", async (c2) => {
+      const body = await c2.req.json().catch(() => null);
       if (!body) {
-        return c.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
+        return c2.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
       }
       const parsed = signupSchema.safeParse(body);
       if (!parsed.success) {
-        return c.json(
+        return c2.json(
           { error: parsed.error.issues[0].message, code: "VALIDATION_ERROR" },
           400
         );
@@ -6540,7 +6560,7 @@ var init_routes = __esm({
       const db = getSqlite();
       const existing = db.prepare("SELECT id FROM profiles WHERE email = ?").get(email);
       if (existing) {
-        return c.json({ error: "Email already registered", code: "CONFLICT" }, 409);
+        return c2.json({ error: "Email already registered", code: "CONFLICT" }, 409);
       }
       const passwordHash = await hashPassword(password);
       const userCount = db.prepare("SELECT COUNT(*) as count FROM profiles").get();
@@ -6554,20 +6574,20 @@ var init_routes = __esm({
       const accessToken = signAccessToken({ sub: id, email });
       const refreshToken = createRefreshTokenRow(id);
       const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(id);
-      return c.json({
+      return c2.json({
         access_token: accessToken,
         refresh_token: refreshToken,
         profile: sanitizeProfile(profile)
       }, 201);
     });
-    auth.post("/login", async (c) => {
-      const body = await c.req.json().catch(() => null);
+    auth.post("/login", async (c2) => {
+      const body = await c2.req.json().catch(() => null);
       if (!body) {
-        return c.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
+        return c2.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
       }
       const parsed = loginSchema.safeParse(body);
       if (!parsed.success) {
-        return c.json(
+        return c2.json(
           { error: parsed.error.issues[0].message, code: "VALIDATION_ERROR" },
           400
         );
@@ -6576,28 +6596,28 @@ var init_routes = __esm({
       const db = getSqlite();
       const profile = db.prepare("SELECT * FROM profiles WHERE email = ?").get(email);
       if (!profile) {
-        return c.json({ error: "Invalid email or password", code: "UNAUTHORIZED" }, 401);
+        return c2.json({ error: "Invalid email or password", code: "UNAUTHORIZED" }, 401);
       }
       const valid = await verifyPassword(profile.password_hash, password);
       if (!valid) {
-        return c.json({ error: "Invalid email or password", code: "UNAUTHORIZED" }, 401);
+        return c2.json({ error: "Invalid email or password", code: "UNAUTHORIZED" }, 401);
       }
       const accessToken = signAccessToken({ sub: profile.id, email });
       const refreshToken = createRefreshTokenRow(profile.id);
-      return c.json({
+      return c2.json({
         access_token: accessToken,
         refresh_token: refreshToken,
         profile: sanitizeProfile(profile)
       });
     });
-    auth.post("/refresh", async (c) => {
-      const body = await c.req.json().catch(() => null);
+    auth.post("/refresh", async (c2) => {
+      const body = await c2.req.json().catch(() => null);
       if (!body) {
-        return c.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
+        return c2.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
       }
       const parsed = refreshSchema.safeParse(body);
       if (!parsed.success) {
-        return c.json(
+        return c2.json(
           { error: parsed.error.issues[0].message, code: "VALIDATION_ERROR" },
           400
         );
@@ -6608,45 +6628,45 @@ var init_routes = __esm({
         "SELECT * FROM refresh_tokens WHERE token = ?"
       ).get(refresh_token);
       if (!tokenRow) {
-        return c.json({ error: "Invalid refresh token", code: "UNAUTHORIZED" }, 401);
+        return c2.json({ error: "Invalid refresh token", code: "UNAUTHORIZED" }, 401);
       }
       if (new Date(tokenRow.expires_at) < /* @__PURE__ */ new Date()) {
         db.prepare("DELETE FROM refresh_tokens WHERE id = ?").run(tokenRow.id);
-        return c.json({ error: "Refresh token expired", code: "UNAUTHORIZED" }, 401);
+        return c2.json({ error: "Refresh token expired", code: "UNAUTHORIZED" }, 401);
       }
       const userId = tokenRow.user_id;
       const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
       if (!profile) {
         db.prepare("DELETE FROM refresh_tokens WHERE id = ?").run(tokenRow.id);
-        return c.json({ error: "User not found", code: "UNAUTHORIZED" }, 401);
+        return c2.json({ error: "User not found", code: "UNAUTHORIZED" }, 401);
       }
       db.prepare("DELETE FROM refresh_tokens WHERE id = ?").run(tokenRow.id);
       const newAccessToken = signAccessToken({ sub: userId, email: profile.email });
       const newRefreshToken = createRefreshTokenRow(userId);
-      return c.json({
+      return c2.json({
         access_token: newAccessToken,
         refresh_token: newRefreshToken,
         profile: sanitizeProfile(profile)
       });
     });
-    auth.get("/me", authMiddleware, async (c) => {
-      const userId = c.get("userId");
+    auth.get("/me", authMiddleware, async (c2) => {
+      const userId = c2.get("userId");
       const db = getSqlite();
       const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
       if (!profile) {
-        return c.json({ error: "Profile not found", code: "NOT_FOUND" }, 404);
+        return c2.json({ error: "Profile not found", code: "NOT_FOUND" }, 404);
       }
-      return c.json({ data: sanitizeProfile(profile) });
+      return c2.json({ data: sanitizeProfile(profile) });
     });
-    auth.patch("/me", authMiddleware, async (c) => {
-      const userId = c.get("userId");
-      const body = await c.req.json().catch(() => null);
+    auth.patch("/me", authMiddleware, async (c2) => {
+      const userId = c2.get("userId");
+      const body = await c2.req.json().catch(() => null);
       if (!body) {
-        return c.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
+        return c2.json({ error: "Invalid JSON body", code: "VALIDATION_ERROR" }, 400);
       }
       const parsed = updateProfileSchema2.safeParse(body);
       if (!parsed.success) {
-        return c.json(
+        return c2.json(
           { error: parsed.error.issues[0].message, code: "VALIDATION_ERROR" },
           400
         );
@@ -6671,29 +6691,29 @@ var init_routes = __esm({
         values.push(key === "preferences" ? JSON.stringify(value) : value);
       }
       if (setClauses.length === 0) {
-        return c.json({ error: "No valid fields to update", code: "VALIDATION_ERROR" }, 400);
+        return c2.json({ error: "No valid fields to update", code: "VALIDATION_ERROR" }, 400);
       }
       setClauses.push("updated_at = ?");
       values.push((/* @__PURE__ */ new Date()).toISOString());
       values.push(userId);
       db.prepare(`UPDATE profiles SET ${setClauses.join(", ")} WHERE id = ?`).run(...values);
       const profile = db.prepare("SELECT * FROM profiles WHERE id = ?").get(userId);
-      return c.json({ data: sanitizeProfile(profile) });
+      return c2.json({ data: sanitizeProfile(profile) });
     });
     routes_default = auth;
   }
 });
 
 // src/lib/errors.ts
-function errorResponse(c, statusCode, message, code) {
-  return c.json({ error: { message, code: code ?? "ERROR" } }, statusCode);
+function errorResponse(c2, statusCode, message, code) {
+  return c2.json({ error: { message, code: code ?? "ERROR" } }, statusCode);
 }
-function handleError(c, err) {
+function handleError(c2, err) {
   if (err instanceof AppError) {
-    return errorResponse(c, err.statusCode, err.message, err.code);
+    return errorResponse(c2, err.statusCode, err.message, err.code);
   }
   console.error("Unhandled error:", err);
-  return errorResponse(c, 500, "Internal server error", "INTERNAL_ERROR");
+  return errorResponse(c2, 500, "Internal server error", "INTERNAL_ERROR");
 }
 var AppError;
 var init_errors = __esm({
@@ -6812,12 +6832,12 @@ function extractTaskReference(text2) {
     taskNumber: parseInt(parts[1], 10)
   };
 }
-async function handlePullRequestEvent(c, payload) {
+async function handlePullRequestEvent(c2, payload) {
   const action = payload.action;
   const pr = payload.pull_request;
   const repo = payload.repository;
   if (!pr || !repo) {
-    return c.json({ message: "Invalid payload" }, 200);
+    return c2.json({ message: "Invalid payload" }, 200);
   }
   const repoOwner = repo.owner?.login;
   const repoName = repo.name;
@@ -6841,7 +6861,7 @@ async function handlePullRequestEvent(c, payload) {
   }
   if (!projectId) {
     log.debug("github", `No matching project for ${repoOwner}/${repoName}`);
-    return c.json({ message: "No matching project found" }, 200);
+    return c2.json({ message: "No matching project found" }, 200);
   }
   const project = { id: projectId, prefix: projectPrefix };
   const searchText = [pr.title || "", pr.body || "", pr.head?.ref || ""].join(" ");
@@ -6911,7 +6931,7 @@ async function handlePullRequestEvent(c, payload) {
     );
   } catch (err) {
     log.error("github", "Failed to upsert pull request", err);
-    return c.json({ message: "Failed to process webhook" }, 200);
+    return c2.json({ message: "Failed to process webhook" }, 200);
   }
   log.db("pull_requests", "UPSERT", `PR #${pr.number} (${action}) for project ${project.id}`);
   const branchRef = pr.head?.ref;
@@ -6979,25 +6999,25 @@ async function handlePullRequestEvent(c, payload) {
   if (projectId) {
     broadcastToProject(projectId, "task.updated", { taskId, changes: { pr_event: action } });
   }
-  return c.json({ message: "Webhook processed" }, 200);
+  return c2.json({ message: "Webhook processed" }, 200);
 }
-async function handleCheckRunEvent(c, payload) {
+async function handleCheckRunEvent(c2, payload) {
   const action = payload.action;
   const checkRun = payload.check_run;
   const repo = payload.repository;
   if (!checkRun || !repo || action !== "completed") {
-    return c.json({ message: "Check run ignored" }, 200);
+    return c2.json({ message: "Check run ignored" }, 200);
   }
   log.info("github", `Check run ${checkRun.name}: ${checkRun.conclusion} on ${repo.full_name}`);
   const headSha = checkRun.head_sha;
-  if (!headSha) return c.json({ message: "No head_sha" }, 200);
+  if (!headSha) return c2.json({ message: "No head_sha" }, 200);
   const db = getSqlite();
   const prRecord = db.prepare(
     "SELECT task_id, project_id FROM pull_requests WHERE head_sha = ? LIMIT 1"
   ).get(headSha);
   if (!prRecord?.task_id) {
     log.debug("github", `No PR/task found for check run SHA ${headSha.substring(0, 7)}`);
-    return c.json({ message: "No matching task" }, 200);
+    return c2.json({ message: "No matching task" }, 200);
   }
   const taskId = prRecord.task_id;
   const projectId = prRecord.project_id;
@@ -7005,11 +7025,11 @@ async function handleCheckRunEvent(c, payload) {
     "SELECT id, ci_checks, merge_readiness FROM task_branches WHERE task_id = ?"
   ).all(taskId);
   if (!taskBranches2 || taskBranches2.length === 0) {
-    return c.json({ message: "No task branches" }, 200);
+    return c2.json({ message: "No task branches" }, 200);
   }
   const tb = taskBranches2[0];
   const ciChecks = tb.ci_checks ? typeof tb.ci_checks === "string" ? JSON.parse(tb.ci_checks) : tb.ci_checks : [];
-  const existingIdx = ciChecks.findIndex((c2) => c2.name === checkRun.name);
+  const existingIdx = ciChecks.findIndex((c3) => c3.name === checkRun.name);
   const checkData = {
     name: checkRun.name,
     status: checkRun.status,
@@ -7025,7 +7045,7 @@ async function handleCheckRunEvent(c, payload) {
   } else {
     ciChecks.push(checkData);
   }
-  const allPassed = ciChecks.length > 0 && ciChecks.every((c2) => c2.conclusion === "success" || c2.conclusion === "neutral" || c2.conclusion === "skipped");
+  const allPassed = ciChecks.length > 0 && ciChecks.every((c3) => c3.conclusion === "success" || c3.conclusion === "neutral" || c3.conclusion === "skipped");
   const existingMergeReadiness = tb.merge_readiness ? typeof tb.merge_readiness === "string" ? JSON.parse(tb.merge_readiness) : tb.merge_readiness : {};
   db.prepare(
     "UPDATE task_branches SET ci_checks = ?, merge_readiness = ? WHERE id = ?"
@@ -7055,17 +7075,17 @@ async function handleCheckRunEvent(c, payload) {
     }).catch(() => {
     });
   }
-  return c.json({ message: "Check run processed" }, 200);
+  return c2.json({ message: "Check run processed" }, 200);
 }
-async function handleCheckSuiteEvent(c, payload) {
+async function handleCheckSuiteEvent(c2, payload) {
   const action = payload.action;
   const suite = payload.check_suite;
   const repo = payload.repository;
   if (!suite || !repo || action !== "completed") {
-    return c.json({ message: "Check suite ignored" }, 200);
+    return c2.json({ message: "Check suite ignored" }, 200);
   }
   if (suite.conclusion !== "success") {
-    return c.json({ message: "Suite not successful" }, 200);
+    return c2.json({ message: "Suite not successful" }, 200);
   }
   log.info("github", `Check suite passed on ${repo.full_name}, branch: ${suite.head_branch}`);
   const db = getSqlite();
@@ -7073,7 +7093,7 @@ async function handleCheckSuiteEvent(c, payload) {
     "SELECT id, github_pr_number, task_id, project_id, is_draft FROM pull_requests WHERE head_sha = ? AND is_draft = 1 LIMIT 1"
   ).get(suite.head_sha);
   if (!prRecord) {
-    return c.json({ message: "No draft PR to convert" }, 200);
+    return c2.json({ message: "No draft PR to convert" }, 200);
   }
   const repoOwner = repo.owner?.login;
   const repoName = repo.name;
@@ -7107,22 +7127,22 @@ async function handleCheckSuiteEvent(c, payload) {
       log.error("github", `Failed to mark PR #${prRecord.github_pr_number} as ready`, err);
     }
   }
-  return c.json({ message: "Check suite processed" }, 200);
+  return c2.json({ message: "Check suite processed" }, 200);
 }
-async function handlePullRequestReviewEvent(c, payload) {
+async function handlePullRequestReviewEvent(c2, payload) {
   const action = payload.action;
   const review = payload.review;
   const pr = payload.pull_request;
   const repo = payload.repository;
   if (!review || !pr || !repo || action !== "submitted") {
-    return c.json({ message: "Review ignored" }, 200);
+    return c2.json({ message: "Review ignored" }, 200);
   }
   const reviewState = review.state;
   const reviewer = review.user?.login;
   const commitId = review.commit_id;
   log.info("github", `Review by ${reviewer}: ${reviewState} on PR #${pr.number}`);
   const branchRef = pr.head?.ref;
-  if (!branchRef) return c.json({ message: "No branch ref" }, 200);
+  if (!branchRef) return c2.json({ message: "No branch ref" }, 200);
   const db = getSqlite();
   const taskBranch = db.prepare(
     `SELECT tb.id, tb.task_id, tb.review_statuses, tb.merge_readiness, pr2.project_id
@@ -7132,7 +7152,7 @@ async function handlePullRequestReviewEvent(c, payload) {
   ).get(branchRef);
   if (!taskBranch) {
     log.debug("github", `No task_branch for branch ${branchRef}`);
-    return c.json({ message: "No matching task branch" }, 200);
+    return c2.json({ message: "No matching task branch" }, 200);
   }
   const taskId = taskBranch.task_id;
   const projectId = taskBranch.project_id;
@@ -7172,15 +7192,15 @@ async function handlePullRequestReviewEvent(c, payload) {
     }).catch(() => {
     });
   }
-  return c.json({ message: "Review processed" }, 200);
+  return c2.json({ message: "Review processed" }, 200);
 }
-async function handlePushEvent(c, payload) {
+async function handlePushEvent(c2, payload) {
   const ref = payload.ref;
   const repo = payload.repository;
   const commits = payload.commits || [];
   const forced = payload.forced || false;
   if (!ref || !repo) {
-    return c.json({ message: "Invalid push payload" }, 200);
+    return c2.json({ message: "Invalid push payload" }, 200);
   }
   const branchName = ref.replace("refs/heads/", "");
   const repoOwner = repo.owner?.login || repo.owner?.name;
@@ -7190,7 +7210,7 @@ async function handlePushEvent(c, payload) {
     `Push to ${repo.full_name}/${branchName}: ${commits.length} commit(s)${forced ? " [FORCE PUSH]" : ""}`
   );
   if (commits.length === 0) {
-    return c.json({ message: "Push with no commits" }, 200);
+    return c2.json({ message: "Push with no commits" }, 200);
   }
   const db = getSqlite();
   const taskBranch = db.prepare(
@@ -7201,7 +7221,7 @@ async function handlePushEvent(c, payload) {
   ).get(branchName);
   if (!taskBranch) {
     log.debug("github", `No task_branch found for branch ${branchName}`);
-    return c.json({ message: "No matching task branch" }, 200);
+    return c2.json({ message: "No matching task branch" }, 200);
   }
   const taskId = taskBranch.task_id;
   const projectId = taskBranch.project_id;
@@ -7228,7 +7248,7 @@ async function handlePushEvent(c, payload) {
   params.push(taskBranch.id);
   db.prepare(updateSql).run(...params);
   log.db("task_branches", "UPDATE", taskBranch.id);
-  const commitMessages = commits.map((c2) => c2.message?.split("\n")[0] || "").join(", ");
+  const commitMessages = commits.map((c3) => c3.message?.split("\n")[0] || "").join(", ");
   createTaskActivity({
     task_id: taskId,
     project_id: projectId,
@@ -7238,11 +7258,11 @@ async function handlePushEvent(c, payload) {
       branch_name: branchName,
       commit_count: commits.length,
       forced,
-      commits: commits.slice(0, 10).map((c2) => ({
-        sha: c2.id?.substring(0, 7),
-        message: c2.message?.split("\n")[0],
-        author: c2.author?.username || c2.author?.name,
-        timestamp: c2.timestamp
+      commits: commits.slice(0, 10).map((c3) => ({
+        sha: c3.id?.substring(0, 7),
+        message: c3.message?.split("\n")[0],
+        author: c3.author?.username || c3.author?.name,
+        timestamp: c3.timestamp
       })),
       files_touched: Array.from(allFilesTouched).slice(0, 20)
     }
@@ -7283,13 +7303,13 @@ async function handlePushEvent(c, payload) {
     }, true).catch(() => {
     });
   }
-  return c.json({ message: "Push processed" }, 200);
+  return c2.json({ message: "Push processed" }, 200);
 }
-async function handleWorkflowJobEvent(c, payload) {
+async function handleWorkflowJobEvent(c2, payload) {
   const action = payload.action;
   const job = payload.workflow_job;
   const repo = payload.repository;
-  if (!job || !repo) return c.json({ message: "Invalid workflow_job" }, 200);
+  if (!job || !repo) return c2.json({ message: "Invalid workflow_job" }, 200);
   const steps = (job.steps || []).map((s) => ({
     name: s.name,
     status: s.status,
@@ -7298,7 +7318,7 @@ async function handleWorkflowJobEvent(c, payload) {
     completed_at: s.completed_at
   }));
   const headBranch = job.head_branch;
-  if (!headBranch) return c.json({ message: "No head branch" }, 200);
+  if (!headBranch) return c2.json({ message: "No head branch" }, 200);
   const db = getSqlite();
   const taskBranch = db.prepare(
     `SELECT tb.id, tb.task_id, pr2.project_id
@@ -7306,7 +7326,7 @@ async function handleWorkflowJobEvent(c, payload) {
      LEFT JOIN project_repos pr2 ON pr2.id = tb.repo_id
      WHERE tb.branch_name = ? LIMIT 1`
   ).get(headBranch);
-  if (!taskBranch) return c.json({ message: "No matching task branch" }, 200);
+  if (!taskBranch) return c2.json({ message: "No matching task branch" }, 200);
   const taskId = taskBranch.task_id;
   const projectId = taskBranch.project_id;
   const deployStatus = action === "completed" ? job.conclusion === "success" ? "success" : "failure" : "in_progress";
@@ -7326,14 +7346,14 @@ async function handleWorkflowJobEvent(c, payload) {
   if (projectId) {
     broadcastToProject(projectId, "task.updated", { taskId, changes: { deploy_steps: steps } });
   }
-  return c.json({ message: "Workflow job processed" }, 200);
+  return c2.json({ message: "Workflow job processed" }, 200);
 }
-async function handleDeploymentStatusEvent(c, payload) {
+async function handleDeploymentStatusEvent(c2, payload) {
   const deploymentStatus = payload.deployment_status;
   const deployment = payload.deployment;
   const repo = payload.repository;
   if (!deploymentStatus || !deployment || !repo) {
-    return c.json({ message: "Invalid deployment_status" }, 200);
+    return c2.json({ message: "Invalid deployment_status" }, 200);
   }
   const environment = deployment.environment;
   const state = deploymentStatus.state;
@@ -7350,7 +7370,7 @@ async function handleDeploymentStatusEvent(c, payload) {
   ).get(ref);
   if (!taskBranch) {
     log.debug("github", `No task_branch for deployment ref ${ref}`);
-    return c.json({ message: "No matching task branch" }, 200);
+    return c2.json({ message: "No matching task branch" }, 200);
   }
   const taskId = taskBranch.task_id;
   const projectId = taskBranch.project_id;
@@ -7426,17 +7446,17 @@ async function handleDeploymentStatusEvent(c, payload) {
     }
     broadcastToProject(projectId, "task.updated", { taskId, changes: { deploy: { environment, state } } });
   }
-  return c.json({ message: "Deployment status processed" }, 200);
+  return c2.json({ message: "Deployment status processed" }, 200);
 }
-async function handleDeploymentProtectionRuleEvent(c, payload) {
+async function handleDeploymentProtectionRuleEvent(c2, payload) {
   const action = payload.action;
   const environment = payload.environment;
   const deployment = payload.deployment;
   const repo = payload.repository;
-  if (!environment || !repo) return c.json({ message: "Invalid protection rule" }, 200);
+  if (!environment || !repo) return c2.json({ message: "Invalid protection rule" }, 200);
   log.info("github", `Deploy protection: ${action} for ${environment} on ${repo.full_name}`);
   const ref = deployment?.ref;
-  if (!ref) return c.json({ message: "No ref" }, 200);
+  if (!ref) return c2.json({ message: "No ref" }, 200);
   const db = getSqlite();
   const taskBranch = db.prepare(
     `SELECT tb.id, tb.task_id, pr2.project_id
@@ -7444,7 +7464,7 @@ async function handleDeploymentProtectionRuleEvent(c, payload) {
      LEFT JOIN project_repos pr2 ON pr2.id = tb.repo_id
      WHERE tb.branch_name = ? LIMIT 1`
   ).get(ref);
-  if (!taskBranch) return c.json({ message: "No matching task branch" }, 200);
+  if (!taskBranch) return c2.json({ message: "No matching task branch" }, 200);
   const taskId = taskBranch.task_id;
   const projectId = taskBranch.project_id;
   const reviewers = (payload.reviewers || []).map((r) => r.reviewer?.login).filter(Boolean);
@@ -7467,29 +7487,29 @@ async function handleDeploymentProtectionRuleEvent(c, payload) {
   if (projectId) {
     broadcastToProject(projectId, "task.updated", { taskId, changes: { deploy_approval: approvals } });
   }
-  return c.json({ message: "Protection rule processed" }, 200);
+  return c2.json({ message: "Protection rule processed" }, 200);
 }
-async function handleIssueCommentEvent(c, payload) {
+async function handleIssueCommentEvent(c2, payload) {
   const action = payload.action;
   const comment = payload.comment;
   const issue = payload.issue;
   const repo = payload.repository;
   if (action !== "created" || !comment || !issue || !repo) {
-    return c.json({ message: "Issue comment ignored" }, 200);
+    return c2.json({ message: "Issue comment ignored" }, 200);
   }
-  if (!issue.pull_request) return c.json({ message: "Not a PR comment" }, 200);
+  if (!issue.pull_request) return c2.json({ message: "Not a PR comment" }, 200);
   const prNumber = issue.number;
   const repoOwner = repo.owner?.login;
   const repoName = repo.name;
   const author = comment.user?.login;
   const body = comment.body;
-  if (comment.performed_via_github_app) return c.json({ message: "Bot comment skipped" }, 200);
+  if (comment.performed_via_github_app) return c2.json({ message: "Bot comment skipped" }, 200);
   log.info("github", `PR comment by ${author} on #${prNumber} in ${repoOwner}/${repoName}`);
   const db = getSqlite();
   const prRecord = db.prepare(
     "SELECT task_id, project_id FROM pull_requests WHERE github_pr_number = ? LIMIT 1"
   ).get(prNumber);
-  if (!prRecord?.task_id) return c.json({ message: "No linked task" }, 200);
+  if (!prRecord?.task_id) return c2.json({ message: "No linked task" }, 200);
   const commentId = `${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.prepare(
@@ -7511,7 +7531,7 @@ ${body}`,
       task_id: prRecord.task_id
     });
   }
-  return c.json({ message: "Issue comment processed" }, 200);
+  return c2.json({ message: "Issue comment processed" }, 200);
 }
 var import_hono3, import_zod6, github, deliveryCache, DELIVERY_TTL_MS, connectRepoSchema2, github_default;
 var init_github4 = __esm({
@@ -7542,13 +7562,13 @@ var init_github4 = __esm({
       github_repo_owner: import_zod6.z.string().min(1),
       github_repo_name: import_zod6.z.string().min(1)
     });
-    github.patch("/projects/:projectId/github", authMiddleware, async (c) => {
+    github.patch("/projects/:projectId/github", authMiddleware, async (c2) => {
       try {
-        const projectId = c.req.param("projectId");
-        const body = await c.req.json();
+        const projectId = c2.req.param("projectId");
+        const body = await c2.req.json();
         const parsed = connectRepoSchema2.safeParse(body);
         if (!parsed.success) {
-          return errorResponse(c, 400, parsed.error.issues[0].message, "VALIDATION_ERROR");
+          return errorResponse(c2, 400, parsed.error.issues[0].message, "VALIDATION_ERROR");
         }
         const db = getSqlite();
         const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -7565,83 +7585,83 @@ var init_github4 = __esm({
         );
         const project = db.prepare("SELECT * FROM projects WHERE id = ?").get(projectId);
         if (!project) {
-          return errorResponse(c, 404, "Project not found", "NOT_FOUND");
+          return errorResponse(c2, 404, "Project not found", "NOT_FOUND");
         }
-        return c.json({ data: project });
+        return c2.json({ data: project });
       } catch (err) {
-        return handleError(c, err);
+        return handleError(c2, err);
       }
     });
-    github.get("/projects/:projectId/pull-requests", authMiddleware, async (c) => {
+    github.get("/projects/:projectId/pull-requests", authMiddleware, async (c2) => {
       try {
-        const projectId = c.req.param("projectId");
-        const taskId = c.req.query("task_id");
+        const projectId = c2.req.param("projectId");
+        const taskId = c2.req.query("task_id");
         const data = getPullRequests(projectId, taskId);
-        return c.json({ data: data || [] });
+        return c2.json({ data: data || [] });
       } catch (err) {
-        return handleError(c, err);
+        return handleError(c2, err);
       }
     });
-    github.get("/tasks/:taskId/pull-requests", authMiddleware, async (c) => {
+    github.get("/tasks/:taskId/pull-requests", authMiddleware, async (c2) => {
       try {
-        const taskId = c.req.param("taskId");
+        const taskId = c2.req.param("taskId");
         const data = getTaskPullRequests(taskId);
-        return c.json({ data: data || [] });
+        return c2.json({ data: data || [] });
       } catch (err) {
-        return handleError(c, err);
+        return handleError(c2, err);
       }
     });
-    github.post("/github/webhook", async (c) => {
+    github.post("/github/webhook", async (c2) => {
       try {
-        const rawBody = await c.req.text();
-        const signatureHeader = c.req.header("x-hub-signature-256");
+        const rawBody = await c2.req.text();
+        const signatureHeader = c2.req.header("x-hub-signature-256");
         if (!verifyWebhookSignature(rawBody, signatureHeader)) {
           log.warn("github", "Webhook signature verification failed");
-          return c.json({ error: "Invalid signature" }, 401);
+          return c2.json({ error: "Invalid signature" }, 401);
         }
         const payload = JSON.parse(rawBody);
-        const event = c.req.header("x-github-event");
-        const deliveryId = c.req.header("x-github-delivery");
+        const event = c2.req.header("x-github-event");
+        const deliveryId = c2.req.header("x-github-delivery");
         log.info("github", `Webhook received: ${event} (delivery: ${deliveryId})`);
         if (event === "ping") {
-          return c.json({ message: "pong" }, 200);
+          return c2.json({ message: "pong" }, 200);
         }
         if (isDeliveryDuplicate(deliveryId)) {
           log.debug("github", `Skipping duplicate delivery: ${deliveryId}`);
-          return c.json({ message: "Duplicate delivery ignored" }, 200);
+          return c2.json({ message: "Duplicate delivery ignored" }, 200);
         }
         if (event === "pull_request") {
-          return await handlePullRequestEvent(c, payload);
+          return await handlePullRequestEvent(c2, payload);
         }
         if (event === "push") {
-          return await handlePushEvent(c, payload);
+          return await handlePushEvent(c2, payload);
         }
         if (event === "check_run") {
-          return await handleCheckRunEvent(c, payload);
+          return await handleCheckRunEvent(c2, payload);
         }
         if (event === "check_suite") {
-          return await handleCheckSuiteEvent(c, payload);
+          return await handleCheckSuiteEvent(c2, payload);
         }
         if (event === "pull_request_review") {
-          return await handlePullRequestReviewEvent(c, payload);
+          return await handlePullRequestReviewEvent(c2, payload);
         }
         if (event === "workflow_job") {
-          return await handleWorkflowJobEvent(c, payload);
+          return await handleWorkflowJobEvent(c2, payload);
         }
         if (event === "deployment_status") {
-          return await handleDeploymentStatusEvent(c, payload);
+          return await handleDeploymentStatusEvent(c2, payload);
         }
         if (event === "deployment_protection_rule") {
-          return await handleDeploymentProtectionRuleEvent(c, payload);
+          return await handleDeploymentProtectionRuleEvent(c2, payload);
         }
         if (event === "issue_comment") {
-          return await handleIssueCommentEvent(c, payload);
+          return await handleIssueCommentEvent(c2, payload);
         }
         log.debug("github", `Ignoring event: ${event}`);
-        return c.json({ message: "Event ignored" }, 200);
+        return c2.json({ message: "Event ignored" }, 200);
       } catch (err) {
         log.error("github", "Webhook processing error", err);
-        return c.json({ message: "Webhook error" }, 200);
+        return c2.json({ message: "Webhook error" }, 200);
       }
     });
     github_default = github;
@@ -7719,7 +7739,7 @@ var init_index = __esm({
     }
     app.get(
       "/health",
-      (c) => c.json({
+      (c2) => c2.json({
         status: "ok",
         service: "closeclaw",
         connections: getConnectionCount(),
@@ -7730,31 +7750,31 @@ var init_index = __esm({
     app.route("/api", github_default);
     app.route("", agentBridge);
     attachmentRoutes = new import_hono4.Hono();
-    attachmentRoutes.post("/api/attachments/upload", authMiddleware, async (c) => {
-      const body = await c.req.parseBody();
+    attachmentRoutes.post("/api/attachments/upload", authMiddleware, async (c2) => {
+      const body = await c2.req.parseBody();
       const file = body["file"];
       const taskId = body["task_id"];
       if (!taskId || !file || typeof file === "string") {
-        return c.json({ error: "task_id and file required" }, 400);
+        return c2.json({ error: "task_id and file required" }, 400);
       }
       const arrayBuffer = await file.arrayBuffer();
       const buffer = Buffer.from(arrayBuffer);
       const { filePath, fileSize } = await saveFile(taskId, file.name, buffer);
       const attachment = createAttachment({
         task_id: taskId,
-        uploaded_by: c.get("userId"),
+        uploaded_by: c2.get("userId"),
         file_name: file.name,
         file_path: filePath,
         file_type: file.type || void 0,
         file_size: fileSize
       });
-      return c.json({ ok: true, data: attachment }, 201);
+      return c2.json({ ok: true, data: attachment }, 201);
     });
-    attachmentRoutes.get("/api/attachments/:taskId/:filename", authMiddleware, (c) => {
-      const taskId = c.req.param("taskId");
-      const filename = c.req.param("filename");
+    attachmentRoutes.get("/api/attachments/:taskId/:filename", authMiddleware, (c2) => {
+      const taskId = c2.req.param("taskId");
+      const filename = c2.req.param("filename");
       const fullPath = getFilePath(`${taskId}/${filename}`);
-      if (!fullPath) return c.json({ error: "File not found" }, 404);
+      if (!fullPath) return c2.json({ error: "File not found" }, 404);
       const stats = (0, import_node_fs6.statSync)(fullPath);
       const stream = (0, import_node_fs6.createReadStream)(fullPath);
       return new Response(import_node_stream.Readable.toWeb(stream), {
@@ -7801,19 +7821,43 @@ var import_node_fs7 = require("fs");
 var import_node_path6 = require("path");
 var import_node_child_process3 = require("child_process");
 var import_node_readline = require("readline");
+var c = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  cyan: "\x1B[36m",
+  magenta: "\x1B[35m",
+  white: "\x1B[37m"
+};
+var PASS = `${c.green}PASS${c.reset}`;
+var FAIL = `${c.red}FAIL${c.reset}`;
+var WARN = `${c.yellow}WARN${c.reset}`;
+var SKIP = `${c.dim}SKIP${c.reset}`;
+var INFO = `${c.cyan}INFO${c.reset}`;
+function step(num, total, label) {
+  console.log(`
+  ${c.cyan}[${num}/${total}]${c.reset} ${c.bold}${label}${c.reset}`);
+}
+function result(status, detail) {
+  console.log(`        ${status}  ${detail}`);
+}
 var HOME = process.env.HOME || process.env.USERPROFILE || "~";
 var PID_FILE = (0, import_node_path6.join)(HOME, ".closeclaw", "platform.pid");
+var LICENSE_FILE = (0, import_node_path6.join)(HOME, ".closeclaw", "license.key");
+var CONFIG_DIR = (0, import_node_path6.join)(HOME, ".closeclaw");
+var DATA_DIR = (0, import_node_path6.join)(HOME, ".closeclaw", "data");
 function readPkgVersion() {
   try {
     const candidates = [
       (0, import_node_path6.join)(__dirname, "..", "package.json"),
-      (0, import_node_path6.join)(__dirname, "package.json"),
-      (0, import_node_path6.join)(process.cwd(), "package.json")
+      (0, import_node_path6.join)(__dirname, "package.json")
     ];
     for (const p of candidates) {
       if ((0, import_node_fs7.existsSync)(p)) {
-        const pkg = JSON.parse((0, import_node_fs7.readFileSync)(p, "utf-8"));
-        return pkg.version ?? "unknown";
+        return JSON.parse((0, import_node_fs7.readFileSync)(p, "utf-8")).version ?? "unknown";
       }
     }
     return "unknown";
@@ -7822,16 +7866,12 @@ function readPkgVersion() {
   }
 }
 function writePid() {
-  const dir = (0, import_node_path6.join)(HOME, ".closeclaw");
-  if (!(0, import_node_fs7.existsSync)(dir)) {
-    (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
-  }
+  (0, import_node_fs7.mkdirSync)(CONFIG_DIR, { recursive: true });
   (0, import_node_fs7.writeFileSync)(PID_FILE, String(process.pid), "utf-8");
 }
 function readPid() {
   try {
-    const raw = (0, import_node_fs7.readFileSync)(PID_FILE, "utf-8").trim();
-    const pid = Number(raw);
+    const pid = Number((0, import_node_fs7.readFileSync)(PID_FILE, "utf-8").trim());
     return Number.isFinite(pid) ? pid : null;
   } catch {
     return null;
@@ -7845,14 +7885,6 @@ function isProcessAlive(pid) {
     return false;
   }
 }
-function checkNodeVersion() {
-  const [major] = process.versions.node.split(".").map(Number);
-  if (major < 22) {
-    console.warn(
-      `\x1B[33m[warn] Node.js >= 22 is required (you have ${process.versions.node}). Things may break.\x1B[0m`
-    );
-  }
-}
 function whichSync(bin) {
   try {
     return (0, import_node_child_process3.execSync)(`which ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim() || null;
@@ -7860,187 +7892,346 @@ function whichSync(bin) {
     return null;
   }
 }
+function ask(question) {
+  const rl = (0, import_node_readline.createInterface)({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
 function promptPassword(prompt) {
   return new Promise((resolve, reject) => {
-    const rl = (0, import_node_readline.createInterface)({ input: process.stdin, output: process.stdout });
-    if (process.stdin.isTTY) {
-      process.stdout.write(prompt);
-      const raw = process.stdin;
-      raw.setRawMode?.(true);
-      raw.resume();
-      raw.setEncoding("utf-8");
-      let password = "";
-      const onData = (char) => {
-        if (char === "\n" || char === "\r" || char === "") {
-          raw.setRawMode?.(false);
-          raw.pause();
-          raw.removeListener("data", onData);
-          rl.close();
-          process.stdout.write("\n");
-          resolve(password);
-        } else if (char === "") {
-          raw.setRawMode?.(false);
-          rl.close();
-          reject(new Error("Aborted"));
-        } else if (char === "\x7F" || char === "\b") {
-          if (password.length > 0) {
-            password = password.slice(0, -1);
-            process.stdout.write("\b \b");
-          }
-        } else {
-          password += char;
-          process.stdout.write("*");
-        }
-      };
-      raw.on("data", onData);
-    } else {
+    if (!process.stdin.isTTY) {
+      const rl = (0, import_node_readline.createInterface)({ input: process.stdin, output: process.stdout });
       rl.question(prompt, (answer) => {
         rl.close();
         resolve(answer);
       });
+      return;
     }
+    process.stdout.write(prompt);
+    const raw = process.stdin;
+    raw.setRawMode?.(true);
+    raw.resume();
+    raw.setEncoding("utf-8");
+    let password = "";
+    const onData = (ch) => {
+      if (ch === "\n" || ch === "\r" || ch === "") {
+        raw.setRawMode?.(false);
+        raw.pause();
+        raw.removeListener("data", onData);
+        process.stdout.write("\n");
+        resolve(password);
+      } else if (ch === "") {
+        raw.setRawMode?.(false);
+        reject(new Error("Aborted"));
+      } else if (ch === "\x7F" || ch === "\b") {
+        if (password.length > 0) {
+          password = password.slice(0, -1);
+          process.stdout.write("\b \b");
+        }
+      } else {
+        password += ch;
+        process.stdout.write("*");
+      }
+    };
+    raw.on("data", onData);
   });
 }
+function getSavedLicenseKey() {
+  try {
+    return (0, import_node_fs7.readFileSync)(LICENSE_FILE, "utf-8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function saveLicenseKey(key) {
+  (0, import_node_fs7.mkdirSync)(CONFIG_DIR, { recursive: true });
+  (0, import_node_fs7.writeFileSync)(LICENSE_FILE, key, { mode: 384 });
+}
+async function commandOnboard() {
+  const version = readPkgVersion();
+  const TOTAL_STEPS = 7;
+  console.log("");
+  console.log(`  ${c.cyan}${c.bold}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557${c.reset}`);
+  console.log(`  ${c.cyan}${c.bold}\u2551         CloseClaw \u2014 Setup Wizard          \u2551${c.reset}`);
+  console.log(`  ${c.cyan}${c.bold}\u2551              v${version.padEnd(28)}\u2551${c.reset}`);
+  console.log(`  ${c.cyan}${c.bold}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D${c.reset}`);
+  step(1, TOTAL_STEPS, "License Key");
+  let licenseKey = getSavedLicenseKey();
+  if (licenseKey) {
+    result(PASS, `Found saved key at ${c.dim}~/.closeclaw/license.key${c.reset}`);
+    result(INFO, `Key: ${c.dim}${licenseKey.substring(0, 30)}...${c.reset}`);
+  } else {
+    result(INFO, "No license key found.");
+    const key = await ask(`        Enter your license key (or 'dev' for development mode): `);
+    if (key === "dev" || key === "development") {
+      process.env.NODE_ENV = "development";
+      result(WARN, "Development mode \u2014 no license required");
+    } else if (key) {
+      licenseKey = key;
+      saveLicenseKey(key);
+      result(PASS, `License key saved to ${c.dim}~/.closeclaw/license.key${c.reset}`);
+    } else {
+      result(FAIL, "No key provided. Get one from your administrator.");
+      process.exit(1);
+    }
+  }
+  if (licenseKey && process.env.NODE_ENV !== "development") {
+    try {
+      const licenseMod = await Promise.resolve().then(() => (init_license(), license_exports));
+      const verify = licenseMod.verifyLicense || licenseMod.default;
+      if (typeof verify === "function") {
+        const payload = verify(licenseKey);
+        if (payload) {
+          result(PASS, `Licensed to: ${c.bold}${payload.sub}${c.reset}`);
+          result(INFO, `Tier: ${payload.tier} | Seats: ${payload.seats} | Expires: ${new Date(payload.exp * 1e3).toLocaleDateString()}`);
+        }
+      }
+    } catch (err) {
+      result(FAIL, `Invalid license key: ${err.message}`);
+      result(INFO, "Enter 'dev' to use development mode, or get a valid key.");
+      process.exit(1);
+    }
+  }
+  step(2, TOTAL_STEPS, "Node.js");
+  const nodeVersion = process.versions.node;
+  const [major] = nodeVersion.split(".").map(Number);
+  if (major >= 22) {
+    result(PASS, `Node.js ${c.bold}v${nodeVersion}${c.reset}`);
+  } else {
+    result(WARN, `Node.js v${nodeVersion} \u2014 ${c.yellow}v22+ recommended${c.reset}`);
+  }
+  step(3, TOTAL_STEPS, "Data Directory");
+  const dataDir = process.env.PLATFORM_DATA_DIR || DATA_DIR;
+  if ((0, import_node_fs7.existsSync)(dataDir)) {
+    const dbExists = (0, import_node_fs7.existsSync)((0, import_node_path6.join)(dataDir, "platform.db"));
+    result(PASS, `${c.dim}${dataDir}${c.reset}`);
+    if (dbExists) {
+      const size = (0, import_node_fs7.statSync)((0, import_node_path6.join)(dataDir, "platform.db")).size;
+      result(INFO, `Database exists (${(size / 1024).toFixed(0)} KB)`);
+    } else {
+      result(INFO, "Fresh install \u2014 database will be created on first start");
+    }
+  } else {
+    (0, import_node_fs7.mkdirSync)(dataDir, { recursive: true });
+    result(PASS, `Created ${c.dim}${dataDir}${c.reset}`);
+  }
+  step(4, TOTAL_STEPS, "Database");
+  try {
+    const { initDatabase: initDatabase2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
+    initDatabase2(dataDir);
+    result(PASS, "SQLite initialized (WAL mode)");
+    const { runMigrations: runMigrations2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
+    runMigrations2();
+    result(PASS, "Schema up to date");
+    const { countProfiles: countProfiles2 } = await Promise.resolve().then(() => (init_profiles(), profiles_exports));
+    const userCount = countProfiles2();
+    if (userCount === 0) {
+      result(INFO, "No users yet \u2014 first signup will be admin");
+    } else {
+      result(INFO, `${userCount} user${userCount > 1 ? "s" : ""} registered`);
+    }
+    const { closeDatabase: closeDatabase2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
+    closeDatabase2();
+  } catch (err) {
+    result(FAIL, `Database error: ${err.message}`);
+    process.exit(1);
+  }
+  step(5, TOTAL_STEPS, "Auth");
+  const secretPath = (0, import_node_path6.join)(dataDir, "jwt.secret");
+  if ((0, import_node_fs7.existsSync)(secretPath)) {
+    result(PASS, `JWT secret exists at ${c.dim}${secretPath}${c.reset}`);
+  } else {
+    try {
+      const { generateJwtSecret: generateJwtSecret2 } = await Promise.resolve().then(() => (init_jwt(), jwt_exports));
+      generateJwtSecret2(dataDir);
+      result(PASS, "JWT secret generated");
+    } catch (err) {
+      result(FAIL, `Could not generate JWT secret: ${err.message}`);
+      process.exit(1);
+    }
+  }
+  step(6, TOTAL_STEPS, "OpenClaw");
+  const openclawPath = whichSync("openclaw");
+  if (openclawPath) {
+    result(PASS, `Found at ${c.dim}${openclawPath}${c.reset}`);
+    try {
+      const ver = (0, import_node_child_process3.execSync)(`${openclawPath} --version 2>/dev/null || echo unknown`, { encoding: "utf-8" }).trim();
+      result(INFO, `Version: ${ver}`);
+    } catch {
+    }
+    try {
+      const plugins = (0, import_node_child_process3.execSync)(`${openclawPath} plugins list 2>/dev/null || true`, { encoding: "utf-8" });
+      if (plugins.includes("platform-tools")) {
+        result(PASS, "platform-tools plugin installed");
+      } else {
+        result(WARN, "platform-tools plugin not installed");
+        const pluginDir = (0, import_node_path6.join)(__dirname, "..", "packages", "platform-tools");
+        const altDir = (0, import_node_path6.join)(__dirname, "..", "..", "platform-tools");
+        const resolved = (0, import_node_fs7.existsSync)((0, import_node_path6.join)(pluginDir, "package.json")) ? pluginDir : (0, import_node_fs7.existsSync)((0, import_node_path6.join)(altDir, "package.json")) ? altDir : null;
+        if (resolved) {
+          try {
+            (0, import_node_child_process3.execSync)(`${openclawPath} plugins install -l "${resolved}"`, { stdio: "pipe" });
+            result(PASS, "platform-tools auto-installed");
+          } catch {
+            result(WARN, `Auto-install failed. Run manually: ${c.dim}openclaw plugins install @prajwalshete/platform-tools${c.reset}`);
+          }
+        } else {
+          result(INFO, `Install manually: ${c.dim}openclaw plugins install @prajwalshete/platform-tools${c.reset}`);
+        }
+      }
+    } catch {
+    }
+    try {
+      const net = await import("net");
+      const running = await new Promise((resolve) => {
+        const sock = net.createConnection({ port: 18789, host: "127.0.0.1", timeout: 2e3 });
+        sock.on("connect", () => {
+          sock.destroy();
+          resolve(true);
+        });
+        sock.on("error", () => resolve(false));
+        sock.on("timeout", () => {
+          sock.destroy();
+          resolve(false);
+        });
+      });
+      if (running) {
+        result(PASS, "Gateway running on port 18789");
+      } else {
+        result(WARN, `Gateway not running. Start with: ${c.dim}openclaw gateway${c.reset}`);
+      }
+    } catch {
+    }
+  } else {
+    result(SKIP, "OpenClaw not installed (AI features will be disabled)");
+    result(INFO, `Install: ${c.dim}npm install -g openclaw && openclaw onboard${c.reset}`);
+  }
+  step(7, TOTAL_STEPS, "Ready!");
+  console.log("");
+  console.log(`  ${c.green}${c.bold}Setup complete.${c.reset} Start the server with:`);
+  console.log("");
+  if (licenseKey) {
+    console.log(`    ${c.cyan}closeclaw start${c.reset}`);
+  } else {
+    console.log(`    ${c.cyan}closeclaw start${c.reset}  ${c.dim}(dev mode)${c.reset}`);
+  }
+  console.log("");
+  console.log(`  Then open ${c.bold}http://localhost:3001${c.reset} in your browser.`);
+  console.log(`  First signup becomes admin.`);
+  console.log("");
+  const startNow = await ask(`  Start the server now? ${c.dim}(Y/n)${c.reset} `);
+  if (!startNow || startNow.toLowerCase() === "y" || startNow.toLowerCase() === "yes") {
+    console.log("");
+    const startArgs = [];
+    if (licenseKey) startArgs.push("--key", licenseKey);
+    await commandStart(startArgs);
+  }
+}
 async function commandStart(args) {
   const { values } = (0, import_node_util2.parseArgs)({
     args,
     options: {
       port: { type: "string", short: "p", default: process.env.PORT || "3001" },
       host: { type: "string", short: "h", default: process.env.HOST || "0.0.0.0" },
-      key: { type: "string", short: "k", default: process.env.PLATFORM_LICENSE_KEY || "" },
-      "data-dir": { type: "string", short: "d", default: process.env.PLATFORM_DATA_DIR || (0, import_node_path6.join)(HOME, ".closeclaw", "data") },
+      key: { type: "string", short: "k", default: "" },
+      "data-dir": { type: "string", short: "d", default: process.env.PLATFORM_DATA_DIR || DATA_DIR },
       domain: { type: "string", default: process.env.PLATFORM_DOMAIN || "" }
     },
     strict: true
   });
   const port2 = Number(values.port);
   const host2 = values.host;
-  const licenseKey = values.key;
+  let licenseKey = values.key || getSavedLicenseKey() || "";
   const dataDir = values["data-dir"];
   const domain = values.domain;
-  checkNodeVersion();
-  console.log("[closeclaw] Starting Platform V3...");
-  console.log(`[closeclaw] Data directory: ${dataDir}`);
   process.env.PORT = String(port2);
   process.env.HOST = host2;
   if (licenseKey) process.env.PLATFORM_LICENSE_KEY = licenseKey;
   process.env.PLATFORM_DATA_DIR = dataDir;
   if (domain) process.env.PLATFORM_DOMAIN = domain;
-  let loadConfig2;
-  try {
-    const configMod = await Promise.resolve().then(() => (init_config(), config_exports));
-    loadConfig2 = configMod.loadConfig || configMod.default;
-    if (typeof loadConfig2 === "function") {
-      loadConfig2();
-    }
-  } catch {
+  if (!(0, import_node_fs7.existsSync)(dataDir) || !(0, import_node_fs7.existsSync)((0, import_node_path6.join)(dataDir, "jwt.secret"))) {
+    console.log(`
+  ${c.yellow}Not onboarded yet.${c.reset} Run ${c.cyan}closeclaw onboard${c.reset} first.
+`);
+    process.exit(1);
   }
   const isDev = process.env.NODE_ENV === "development" || process.env.NODE_ENV === "dev";
-  if (!isDev) {
+  if (!isDev && licenseKey) {
     try {
       const licenseMod = await Promise.resolve().then(() => (init_license(), license_exports));
       const verify = licenseMod.verifyLicense || licenseMod.default;
-      if (typeof verify === "function") {
-        const valid = await verify(licenseKey);
-        if (!valid) {
-          console.error("[closeclaw] Invalid license key. Use --key to provide a valid key, or set NODE_ENV=development.");
-          process.exit(1);
-        }
-        console.log("[closeclaw] License verified");
-      }
-    } catch {
+      if (typeof verify === "function") verify(licenseKey);
+    } catch (err) {
+      console.error(`  ${c.red}License error:${c.reset} ${err.message}`);
+      console.error(`  Run ${c.cyan}closeclaw onboard${c.reset} to update your key.
+`);
+      process.exit(1);
     }
-  } else {
-    console.log("[closeclaw] Development mode -- skipping license check");
+  }
+  try {
+    const configMod = await Promise.resolve().then(() => (init_config(), config_exports));
+    (configMod.loadConfig || configMod.default)?.();
+  } catch {
   }
   const { initDatabase: initDatabase2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
   initDatabase2(dataDir);
-  console.log("[closeclaw] Database initialized");
   const { runMigrations: runMigrations2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
   runMigrations2();
-  console.log("[closeclaw] Migrations complete");
+  const { generateJwtSecret: generateJwtSecret2 } = await Promise.resolve().then(() => (init_jwt(), jwt_exports));
+  generateJwtSecret2(dataDir);
   const openclawPath = whichSync("openclaw");
   if (openclawPath) {
-    try {
-      const pluginDir = (0, import_node_path6.join)(__dirname, "..", "packages", "platform-tools");
-      const altPluginDir = (0, import_node_path6.join)(__dirname, "..", "..", "platform-tools");
-      const resolvedPluginDir = (0, import_node_fs7.existsSync)((0, import_node_path6.join)(pluginDir, "package.json")) ? pluginDir : (0, import_node_fs7.existsSync)((0, import_node_path6.join)(altPluginDir, "package.json")) ? altPluginDir : null;
-      if (resolvedPluginDir) {
-        const pluginCheck = (0, import_node_child_process3.execSync)(`${openclawPath} plugins list 2>/dev/null || true`, { encoding: "utf-8" });
-        if (!pluginCheck.includes("platform-tools")) {
-          console.log("[closeclaw] Installing platform-tools plugin into OpenClaw...");
-          (0, import_node_child_process3.execSync)(`${openclawPath} plugins install -l "${resolvedPluginDir}"`, { stdio: "inherit" });
-          console.log("[closeclaw] platform-tools plugin installed");
-        } else {
-          console.log("[closeclaw] platform-tools plugin already installed");
-        }
-      }
-    } catch (err) {
-      console.warn("[closeclaw] Could not auto-install platform-tools plugin:", err.message);
-    }
     const { isGatewayRunning: isGatewayRunning2, startGateway: startGateway2, registerShutdownHook: registerShutdownHook2 } = await Promise.resolve().then(() => (init_openclaw_manager(), openclaw_manager_exports));
     registerShutdownHook2();
-    const alreadyRunning = await isGatewayRunning2();
-    if (!alreadyRunning) {
-      console.log("[closeclaw] OpenClaw found -- starting gateway...");
+    const running = await isGatewayRunning2();
+    if (!running) {
+      console.log(`  ${c.dim}Starting OpenClaw gateway...${c.reset}`);
       await startGateway2();
-    } else {
-      console.log("[closeclaw] OpenClaw gateway already running");
     }
-  } else {
-    console.log("[closeclaw] OpenClaw not found in PATH -- skipping gateway");
   }
   await Promise.resolve().then(() => (init_index(), index_exports));
   writePid();
   const version = readPkgVersion();
   const localUrl = `http://localhost:${port2}`;
-  const networkUrl = host2 === "0.0.0.0" ? `http://<host-ip>:${port2}` : `http://${host2}:${port2}`;
-  const publicUrl = domain ? `https://${domain}` : null;
   console.log("");
-  console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  console.log(`  \u2502  Platform V3 \u2014 v${version.padEnd(30)}\u2502`);
-  console.log("  \u2502                                             \u2502");
-  console.log(`  \u2502  Local:   ${localUrl.padEnd(34)}\u2502`);
-  console.log(`  \u2502  Network: ${networkUrl.padEnd(34)}\u2502`);
-  if (publicUrl) {
-    console.log(`  \u2502  Public:  ${publicUrl.padEnd(34)}\u2502`);
-  }
-  console.log(`  \u2502  PID:     ${String(process.pid).padEnd(34)}\u2502`);
+  console.log(`  ${c.green}${c.bold}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557${c.reset}`);
+  console.log(`  ${c.green}${c.bold}\u2551  CloseClaw v${version.padEnd(31)}\u2551${c.reset}`);
+  console.log(`  ${c.green}${c.bold}\u2551                                           \u2551${c.reset}`);
+  console.log(`  ${c.green}${c.bold}\u2551${c.reset}  ${c.cyan}${localUrl.padEnd(40)}${c.reset}${c.green}${c.bold}\u2551${c.reset}`);
+  console.log(`  ${c.green}${c.bold}\u2551${c.reset}  ${c.dim}PID: ${String(process.pid).padEnd(36)}${c.reset}${c.green}${c.bold}\u2551${c.reset}`);
   if (openclawPath) {
-    console.log(`  \u2502  OpenClaw: port ${String(18789).padEnd(27)}\u2502`);
+    console.log(`  ${c.green}${c.bold}\u2551${c.reset}  ${c.dim}OpenClaw: port 18789${" ".repeat(21)}${c.reset}${c.green}${c.bold}\u2551${c.reset}`);
   }
-  console.log("  \u2502                                             \u2502");
-  console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
+  console.log(`  ${c.green}${c.bold}\u2551                                           \u2551${c.reset}`);
+  console.log(`  ${c.green}${c.bold}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D${c.reset}`);
   console.log("");
 }
 async function commandStop() {
   const pid = readPid();
   if (!pid) {
-    console.log("[closeclaw] No PID file found. Server may not be running.");
+    console.log("  Server is not running.");
     process.exit(1);
   }
   if (!isProcessAlive(pid)) {
-    console.log(`[closeclaw] Process ${pid} is not running. Cleaning up stale PID file.`);
+    console.log(`  Process ${pid} is not running. Cleaning up.`);
     try {
       (0, import_node_fs7.unlinkSync)(PID_FILE);
     } catch {
     }
     process.exit(0);
   }
-  console.log(`[closeclaw] Stopping server (PID ${pid})...`);
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch (err) {
-    console.error(`[closeclaw] Failed to stop process: ${err.message}`);
-    process.exit(1);
-  }
+  console.log(`  Stopping server (PID ${pid})...`);
+  process.kill(pid, "SIGTERM");
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
     if (!isProcessAlive(pid)) break;
     await new Promise((r) => setTimeout(r, 250));
   }
   if (isProcessAlive(pid)) {
-    console.warn("[closeclaw] Process did not exit in time, sending SIGKILL...");
     try {
       process.kill(pid, "SIGKILL");
     } catch {
@@ -8050,14 +8241,13 @@ async function commandStop() {
     (0, import_node_fs7.unlinkSync)(PID_FILE);
   } catch {
   }
-  console.log("[closeclaw] Server stopped.");
+  console.log("  Server stopped.");
 }
 async function commandStatus() {
   const pid = readPid();
   if (!pid || !isProcessAlive(pid)) {
-    console.log("[closeclaw] Status: stopped");
+    console.log(`  ${c.red}Status: stopped${c.reset}`);
     if (pid) {
-      console.log(`[closeclaw] Stale PID file references process ${pid}`);
       try {
         (0, import_node_fs7.unlinkSync)(PID_FILE);
       } catch {
@@ -8072,160 +8262,138 @@ async function commandStatus() {
     healthy = res.ok;
   } catch {
   }
-  console.log(`[closeclaw] Status: running`);
-  console.log(`[closeclaw] PID:    ${pid}`);
-  console.log(`[closeclaw] Port:   ${port2}`);
-  console.log(`[closeclaw] Health: ${healthy ? "ok" : "unreachable"}`);
+  console.log(`  ${c.green}Status: running${c.reset}`);
+  console.log(`  PID:    ${pid}`);
+  console.log(`  Port:   ${port2}`);
+  console.log(`  Health: ${healthy ? c.green + "ok" + c.reset : c.red + "unreachable" + c.reset}`);
   try {
     const stat = (0, import_node_fs7.statSync)(PID_FILE);
-    const uptimeMs = Date.now() - stat.mtimeMs;
-    const uptimeSec = Math.floor(uptimeMs / 1e3);
-    const hours = Math.floor(uptimeSec / 3600);
-    const minutes = Math.floor(uptimeSec % 3600 / 60);
-    const seconds = uptimeSec % 60;
-    console.log(`[closeclaw] Uptime: ${hours}h ${minutes}m ${seconds}s`);
+    const sec = Math.floor((Date.now() - stat.mtimeMs) / 1e3);
+    console.log(`  Uptime: ${Math.floor(sec / 3600)}h ${Math.floor(sec % 3600 / 60)}m ${sec % 60}s`);
   } catch {
   }
 }
 async function commandResetPassword(args) {
-  const { values } = (0, import_node_util2.parseArgs)({
-    args,
-    options: {
-      email: { type: "string", short: "e" }
-    },
-    strict: true
-  });
-  const email = values.email;
-  if (!email) {
-    console.error("[closeclaw] --email is required");
-    console.error("Usage: platform reset-password --email user@example.com");
+  const { values } = (0, import_node_util2.parseArgs)({ args, options: { email: { type: "string", short: "e" } }, strict: true });
+  if (!values.email) {
+    console.error("  --email required");
     process.exit(1);
   }
-  const dataDir = process.env.PLATFORM_DATA_DIR || (0, import_node_path6.join)(HOME, ".closeclaw", "data");
   const { initDatabase: initDatabase2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
-  initDatabase2(dataDir);
+  initDatabase2(DATA_DIR);
   const { runMigrations: runMigrations2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
   runMigrations2();
   const { getProfileByEmail: getProfileByEmail2, updateProfile: updateProfile2 } = await Promise.resolve().then(() => (init_profiles(), profiles_exports));
-  const profile = getProfileByEmail2(email);
+  const profile = getProfileByEmail2(values.email);
   if (!profile) {
-    console.error(`[closeclaw] No user found with email: ${email}`);
+    console.error(`  No user: ${values.email}`);
     process.exit(1);
   }
-  const password = await promptPassword("New password: ");
+  const password = await promptPassword("  New password: ");
   if (!password || password.length < 8) {
-    console.error("[closeclaw] Password must be at least 8 characters.");
+    console.error("  Min 8 characters.");
     process.exit(1);
   }
-  const confirm = await promptPassword("Confirm password: ");
+  const confirm = await promptPassword("  Confirm: ");
   if (password !== confirm) {
-    console.error("[closeclaw] Passwords do not match.");
+    console.error("  Passwords don't match.");
     process.exit(1);
   }
   const { hashPassword: hashPassword2 } = await Promise.resolve().then(() => (init_passwords(), passwords_exports));
-  const hash = await hashPassword2(password);
-  updateProfile2(profile.id, { password_hash: hash });
-  console.log(`[closeclaw] Password updated for ${email}`);
+  updateProfile2(profile.id, { password_hash: await hashPassword2(password) });
+  console.log(`  Password updated for ${values.email}`);
   const { closeDatabase: closeDatabase2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
   closeDatabase2();
 }
 async function commandExport(args) {
-  const { values } = (0, import_node_util2.parseArgs)({
-    args,
-    options: {
-      output: { type: "string", short: "o", default: "platform-backup.db" }
-    },
-    strict: true
-  });
-  const output = values.output;
-  const dataDir = process.env.PLATFORM_DATA_DIR || (0, import_node_path6.join)(HOME, ".closeclaw", "data");
-  const dbPath = (0, import_node_path6.join)(dataDir, "platform.db");
+  const { values } = (0, import_node_util2.parseArgs)({ args, options: { output: { type: "string", short: "o", default: "closeclaw-backup.db" } }, strict: true });
+  const dbPath = (0, import_node_path6.join)(DATA_DIR, "platform.db");
   if (!(0, import_node_fs7.existsSync)(dbPath)) {
-    console.error(`[closeclaw] Database not found at ${dbPath}`);
+    console.error(`  Database not found at ${dbPath}`);
     process.exit(1);
   }
   const Database2 = (await import("better-sqlite3")).default;
   const db = new Database2(dbPath, { readonly: true });
   try {
-    await db.backup(output);
-    console.log(`[closeclaw] Database exported to ${output}`);
-  } catch (err) {
-    console.error(`[closeclaw] Export failed: ${err.message}`);
-    process.exit(1);
+    await db.backup(values.output);
+    console.log(`  Exported to ${values.output}`);
   } finally {
     db.close();
   }
 }
-function commandVersion() {
-  const version = readPkgVersion();
-  console.log(`platform v${version}`);
-}
 function printUsage() {
   console.log(`
-platform - V3 server management CLI
-
-Usage:
-  platform <command> [options]
-
-Commands:
-  start             Start the platform server
-    --port, -p      HTTP port (default: 3001)
-    --host, -h      Bind host (default: 0.0.0.0)
-    --key, -k       License key
-    --data-dir, -d  Data directory (default: ~/.closeclaw/data)
-    --domain        Public domain name
+  ${c.bold}closeclaw${c.reset} \u2014 AI-powered project management platform
 
-  stop              Stop the running server
+  ${c.bold}Usage:${c.reset}
+    closeclaw ${c.cyan}<command>${c.reset} [options]
 
-  status            Show server status
+  ${c.bold}Commands:${c.reset}
+    ${c.cyan}onboard${c.reset}           Interactive setup wizard (run this first)
+    ${c.cyan}start${c.reset}             Start the server
+      --port, -p      Port (default: 3001)
+      --key, -k       License key (or saved from onboard)
+      --domain        Public domain for auto-SSL
+    ${c.cyan}stop${c.reset}              Stop the server
+    ${c.cyan}status${c.reset}            Show server status
+    ${c.cyan}reset-password${c.reset}    Reset a user's password
+      --email, -e     User email
+    ${c.cyan}export${c.reset}            Backup the database
+      --output, -o    Output file
+    ${c.cyan}version${c.reset}           Print version
 
-  reset-password    Reset a user's password
-    --email, -e     User email (required)
-
-  export            Export database backup
-    --output, -o    Output file path (default: platform-backup.db)
-
-  version           Print version
-  help              Show this help
+  ${c.bold}Getting started:${c.reset}
+    ${c.dim}$ closeclaw onboard${c.reset}
 `);
 }
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
-  const commandArgs = args.slice(1);
+  const rest = args.slice(1);
   switch (command) {
+    case "onboard":
+      return commandOnboard();
     case "start":
-      await commandStart(commandArgs);
-      break;
+      return commandStart(rest);
     case "stop":
-      await commandStop();
-      break;
+      return commandStop();
     case "status":
-      await commandStatus();
-      break;
+      return commandStatus();
     case "reset-password":
-      await commandResetPassword(commandArgs);
-      break;
+      return commandResetPassword(rest);
     case "export":
-      await commandExport(commandArgs);
-      break;
+      return commandExport(rest);
     case "version":
     case "--version":
     case "-v":
-      commandVersion();
+      console.log(`  closeclaw v${readPkgVersion()}`);
       break;
     case "help":
     case "--help":
-    case void 0:
       printUsage();
       break;
+    case void 0:
+      console.log(`
+  ${c.bold}CloseClaw${c.reset} v${readPkgVersion()}
+`);
+      if (!(0, import_node_fs7.existsSync)((0, import_node_path6.join)(DATA_DIR, "jwt.secret"))) {
+        console.log(`  ${c.yellow}First time?${c.reset} Run ${c.cyan}closeclaw onboard${c.reset} to get started.
+`);
+      } else {
+        console.log(`  Run ${c.cyan}closeclaw start${c.reset} to launch the server.
+`);
+        printUsage();
+      }
+      break;
     default:
-      console.error(`Unknown command: ${command}`);
+      console.error(`  Unknown command: ${command}`);
       printUsage();
       process.exit(1);
   }
 }
 main().catch((err) => {
-  console.error("[closeclaw] Fatal error:", err);
+  console.error(`
+  ${c.red}Fatal:${c.reset} ${err.message}
+`);
   process.exit(1);
 });