dual-brain 4.6.0 → 4.7.1

package/install.mjs

@@ -4,18 +4,22 @@
  *
  * Usage:
  *   npx -y dual-brain              # auto-detect, configure, done
+ *   npx -y dual-brain update       # refresh hooks to latest package version
  *   npx dual-brain --force          # overwrite existing config
  *   npx dual-brain --dry-run        # detect only, don't install
  *   npx dual-brain --help
  */
-import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from 'fs';
-import https from 'https';
+import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { createInterface } from 'readline';
 import { dirname, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { spawnSync } from 'child_process';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const VERSION = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf8')).version;
+const VERSION_STAMP_FILE = '.claude/dual-brain.version.json';
+const UPDATE_CACHE_FILE = '.claude/dual-brain.update-check.json';
+const UPDATE_CACHE_TTL_MS = 60 * 60 * 1000;
 
 // ─── Replit Detection ──────────────────────────────────────────────────────
 
@@ -30,14 +34,9 @@ const flag = (f) => argv.includes(f);
 const force = flag('--force');
 const dryRun = flag('--dry-run');
 const jsonOut = flag('--json');
-const yesFlag = flag('--yes') || flag('-y');
-const noLaunch = flag('--no-launch');
 const positional = argv.filter(a => !a.startsWith('-'));
 const subcommand = positional[0] || null;
 
-const BRAND = `Data Tools — Dual Brain v${VERSION}`;
-const BRAND_SUBTITLE = 'Built on replit-tools by Steve Moraco';
-
 if (flag('--version') || flag('-v')) {
   console.log(`dual-brain v${VERSION}`);
   process.exit(0);
@@ -45,107 +44,47 @@ if (flag('--version') || flag('-v')) {
 
 if (flag('--help') || flag('-h')) {
   console.log(`
-  ${BRAND}
-  ${BRAND_SUBTITLE}
+  🧠 dual-brain v${VERSION} — Dual-provider orchestrator for Claude Code
 
   Usage:  npx -y dual-brain [command] [options]
 
-  Setup:
-    (none)       Start persistent chat (setup if needed)
+  ⌨️  Commands:
+    (none)       🧠 Auto-detect and install/update orchestrator
+    status       🟢 Open live control panel
+    auth         🔑 Show, login, or refresh provider auth
+    mode         🎛️  Show or switch profile
+    budget       💵 Set session/daily spend limits
+    explain      🧭 Explain last routing decision
+    update       🔄 Force re-install of latest hooks
     init         Alias for default install
-    start        Start persistent chat
-    chat         Alias for start
-    auth         Check and repair provider authentication
-    setup        Configure providers, hooks, and preferences
-    doctor       Check system health and report issues
-    reset        Clear all state files (keeps config/hooks)
-    repair       Fix corrupt files, stale locks, re-register hooks
-    --uninstall  Remove dual-brain hooks and state files
-
-  Status:
-    status       Open live control panel
-    health       Verify system health
-    budget       Show or set session/daily spend limits
-    cost         Activity and cost estimates
-    report       Generate session report
-
-  Routing:
-    mode         Show or switch profile
-    explain      Explain last routing decision
-    gate         Run quality gate
-    ledger       Routing outcome insights
-
-  GPT:
-    think        Dual-brain think (--question "..." [--round 2])
-    review       Dual-brain code review
-    dispatch     Dispatch work to GPT via Codex CLI
-
-  Vibe:
-    vibe         Decompose casual requests into structured work
-    plan         Generate execution plans (--utterance "...")
-    memory       Persistent preferences and work threads
-
-  Agents:
-    agent        Run a specialist agent template (explorer, security-review, test-writer, bug-hunter)
-    agents       List all available agent templates
-    chain        Run a built-in agent chain (explore-then-fix, review-and-test, audit-and-plan)
-    chains       List all available agent chains
-
-  Ship Captain:
-    do "<goal>"         Run full pipeline: agents → tests → gate → PR
-                      --yolo        Skip all confirmations
-                      --careful     Confirm every step
-                      --plan-only   Show plan without executing
-                      --no-pr       Skip PR creation
-    ship                Create branch, run tests, open PR
-    test-run            Discover and run project tests
-    diff                Show current changes summary
-    runs                List recent Ship Captain runs
-    resume              Resume last incomplete run
-
-  Dev:
-    test         Run self-tests
 
   Options:
     --force      Overwrite all existing config
     --dry-run    Detect environment only
     --json       Output detection as JSON
-    --no-launch  Install/setup only, do not open Claude
     --help       Show this help
 
-  Routing modes:
-    Auto (default) Adapts routing based on risk, health, outcomes
-    Balanced       Auto-routes, uses both providers evenly
-    Conservative   Fewer GPT dispatches, sticks to Claude
-    Aggressive     Maximizes both subscriptions, dual-brain for medium+
+  🎛️  Routing modes:
+    🤖 Auto (default) Adapts routing based on risk, health, outcomes
+    ⚖️  Balanced       Auto-routes, uses both providers evenly
+    🛡️  Conservative   Fewer GPT dispatches, sticks to Claude
+    🚀 Aggressive     Maximizes both subscriptions, dual-brain for medium+
 
-  Examples:
-    ${cmd('npx dual-brain')}                  # quick start
-    ${cmd('npx dual-brain setup')}            # configure providers and hooks
+  🚀 Examples:
+    ${cmd('npx dual-brain')}                  # install or update
     ${cmd('npx dual-brain status')}           # open control panel
+    ${cmd('npx dual-brain auth')}             # show Claude/Codex auth
+    ${cmd('npx dual-brain auth login')}       # sign in missing providers
+    ${cmd('npx dual-brain auth refresh')}     # refresh provider auth
     ${cmd('npx dual-brain mode cost-saver')}  # switch profile
     ${cmd('npx dual-brain budget 8 25')}      # \$8 session / \$25 daily
-    ${cmd('npx dual-brain think --question "should we use Redis?"')}
-    ${cmd('npx dual-brain vibe "fix login and update nav"')}
-    ${cmd('npx dual-brain agents')}                         # list agent templates
-    ${cmd('npx dual-brain agent explorer --question "where is auth handled?"')}
-    ${cmd('npx dual-brain agent security-review --scope src/auth --severity high')}
-    ${cmd('npx dual-brain chains')}                         # list available chains
-    ${cmd('npx dual-brain chain explore-then-fix --question "auth bug" --scope "src/auth"')}
+    ${cmd('npx dual-brain explain')}          # last routing decision
+    ${cmd('npx dual-brain update')}           # refresh installed hooks
   `);
   process.exit(0);
 }
 
-const SUBCOMMANDS = [
-  'init', 'setup', 'status', 'mode', 'budget', 'explain',
-  'review', 'think', 'health', 'report', 'gate',
-  'vibe', 'plan', 'cost', 'dispatch', 'memory',
-  'test', 'ledger', 'doctor', 'reset', 'repair',
-  'auth', 'start', 'chat',
-  'chain', 'chains',
-  'agent', 'agents',
-  'do', 'ship', 'test-run', 'diff', 'runs', 'resume',
-];
+const SUBCOMMANDS = ['init', 'status', 'auth', 'mode', 'budget', 'explain', 'update'];
 if (subcommand && !SUBCOMMANDS.includes(subcommand)) {
   console.error(`  Unknown command: ${subcommand}`);
   console.error(`  Run: ${cmd('npx dual-brain --help')}`);
@@ -174,54 +113,18 @@ function run(cmd, args, opts = {}) {
   });
 }
 
-function detectReplit() {
-  const isReplit = !!(process.env.REPL_ID || process.env.REPL_SLUG);
-  const hasReplitTools = existsSync(resolve(process.cwd(), '.replit-tools'));
-  return { isReplit, hasReplitTools };
-}
-
-// ─── Session Preferences + Auth Helpers ────────────────────────────────────
-
-const SESSION_PREFS_REL = '.claude/dual-brain.session.json';
-const DEFAULT_SESSION_PREFS = {
-  head_model: 'sonnet',
-  effort: 'medium',
-};
-
-function writeAtomicJson(targetPath, data) {
-  const tmpPath = `${targetPath}.tmp.${process.pid}`;
-  writeFileSync(tmpPath, JSON.stringify(data, null, 2) + '\n');
-  renameSync(tmpPath, targetPath);
-}
-
-function loadSessionPrefs(workspace) {
-  const prefsPath = join(workspace, SESSION_PREFS_REL);
-  try {
-    const raw = JSON.parse(readFileSync(prefsPath, 'utf8'));
-    return { ...DEFAULT_SESSION_PREFS, ...raw };
-  } catch {
-    return { ...DEFAULT_SESSION_PREFS };
+function compareVersions(a, b) {
+  const aParts = String(a || '').replace(/^v/i, '').split('.').map(n => parseInt(n, 10) || 0);
+  const bParts = String(b || '').replace(/^v/i, '').split('.').map(n => parseInt(n, 10) || 0);
+  const len = Math.max(aParts.length, bParts.length);
+  for (let i = 0; i < len; i++) {
+    const diff = (aParts[i] || 0) - (bParts[i] || 0);
+    if (diff !== 0) return diff;
   }
+  return 0;
 }
 
-function saveSessionPrefs(workspace, prefs) {
-  const claudeDir = join(workspace, '.claude');
-  mkdirSync(claudeDir, { recursive: true });
-  const prefsPath = join(workspace, SESSION_PREFS_REL);
-  writeAtomicJson(prefsPath, { ...DEFAULT_SESSION_PREFS, ...prefs });
-}
-
-function getClaudeCredentialPaths(workspace = process.cwd()) {
-  const configDir = process.env.CLAUDE_CONFIG_DIR;
-  const home = process.env.HOME || '';
-  return [
-    configDir ? join(configDir, '.credentials.json') : null,
-    join(home, '.claude', '.credentials.json'),
-    resolve(workspace, '.replit-tools', '.claude-persistent', '.credentials.json'),
-  ].filter(Boolean);
-}
-
-function safeParseJson(path) {
+function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
@@ -229,189 +132,106 @@ function safeParseJson(path) {
   }
 }
 
-function decodeJwtPayload(token) {
-  if (!token || typeof token !== 'string') return null;
-  const parts = token.split('.');
-  if (parts.length < 2) return null;
-  try {
-    return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-  } catch {
-    return null;
-  }
-}
-
-function computeExpiresInHours(expiresAtMs) {
-  if (!Number.isFinite(expiresAtMs)) return null;
-  return Math.round(((expiresAtMs - Date.now()) / 3_600_000) * 10) / 10;
+function writeJsonFile(path, value) {
+  writeFileSync(path, JSON.stringify(value, null, 2) + '\n');
 }
 
-function formatExpires(expiresInHours) {
-  if (expiresInHours == null) return 'unknown';
-  if (expiresInHours <= 0) return 'expired';
-  return `${Math.round(expiresInHours)}h remaining`;
+function getVersionStamp(workspace) {
+  return readJsonFile(join(workspace, VERSION_STAMP_FILE));
 }
 
-function getClaudeAuthStatus() {
-  const defaults = {
-    valid: false,
-    expiresInHours: null,
-    hasRefreshToken: false,
-    email: null,
-    credPath: null,
+function writeVersionStamp(workspace) {
+  const target = join(workspace, VERSION_STAMP_FILE);
+  const now = new Date().toISOString();
+  const existing = readJsonFile(target);
+  const stamp = {
+    version: VERSION,
+    installed_at: existing?.installed_at || now,
+    updated_at: now,
   };
-
-  for (const credPath of getClaudeCredentialPaths(process.cwd())) {
-    const cred = safeParseJson(credPath);
-    const oauth = cred?.claudeAiOauth;
-    if (!oauth) continue;
-
-    const expiresAtMs = typeof oauth.expiresAt === 'number'
-      ? oauth.expiresAt
-      : oauth.expiresAt
-        ? Date.parse(oauth.expiresAt)
-        : NaN;
-    const expiresInHours = computeExpiresInHours(expiresAtMs);
-    const valid = Number.isFinite(expiresAtMs) ? expiresAtMs > Date.now() : false;
-
-    let subscription = null;
-    try {
-      const authOut = run('claude', ['auth', 'status', '--json']);
-      if (authOut.status === 0) {
-        const info = JSON.parse(authOut.stdout.trim());
-        subscription = info.subscriptionType || null;
-      }
-    } catch {}
-    if (!subscription) subscription = oauth.subscriptionType || null;
-
-    return {
-      valid,
-      expiresInHours,
-      hasRefreshToken: !!oauth.refreshToken,
-      email: oauth.email || oauth.account?.email || cred.email || null,
-      subscription,
-      credPath,
-    };
-  }
-
-  return defaults;
+  writeJsonFile(target, stamp);
+  return stamp;
 }
 
-function getCodexAuthStatus() {
-  const authPath = join(process.env.HOME || '', '.codex', 'auth.json');
-  const auth = safeParseJson(authPath);
-  const tokens = auth?.tokens || auth;
-  const accessToken = tokens?.access_token;
-  const refreshToken = tokens?.refresh_token;
-  const payload = decodeJwtPayload(accessToken);
-  const expiresAtMs = payload?.exp ? payload.exp * 1000 : NaN;
-  const expiresInHours = computeExpiresInHours(expiresAtMs);
-
-  return {
-    valid: Number.isFinite(expiresAtMs) ? expiresAtMs > Date.now() : false,
-    expiresInHours,
-    hasRefreshToken: !!refreshToken,
-    email: payload?.email || auth?.email || auth?.user?.email || null,
-  };
+function getUpdateCache(workspace) {
+  const cache = readJsonFile(join(workspace, UPDATE_CACHE_FILE));
+  if (!cache?.checked_at) return null;
+  const age = Date.now() - Date.parse(cache.checked_at);
+  if (!Number.isFinite(age) || age < 0 || age > UPDATE_CACHE_TTL_MS) return null;
+  return cache;
 }
 
-function postForm(url, body) {
-  return new Promise((resolve, reject) => {
-    const payload = Buffer.from(new URLSearchParams(body).toString(), 'utf8');
-    const req = https.request(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/x-www-form-urlencoded',
-        'Content-Length': payload.length,
-      },
-      timeout: 8000,
-    }, (res) => {
-      const chunks = [];
-      res.on('data', (chunk) => chunks.push(chunk));
-      res.on('end', () => {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
-          try {
-            resolve(JSON.parse(raw));
-          } catch (err) {
-            reject(err);
-          }
-        } else {
-          reject(new Error(`HTTP ${res.statusCode || 0}`));
-        }
-      });
-    });
-    req.on('timeout', () => req.destroy(new Error('Request timeout')));
-    req.on('error', reject);
-    req.write(payload);
-    req.end();
+function writeUpdateCache(workspace, result) {
+  writeJsonFile(join(workspace, UPDATE_CACHE_FILE), {
+    checked_at: new Date().toISOString(),
+    ...result,
   });
 }
 
-async function refreshClaudeToken(credPath) {
+function checkForUpdate(workspace, { force = false } = {}) {
+  const installedStamp = getVersionStamp(workspace);
+  const installed = installedStamp?.version || VERSION;
+
+  if (!force) {
+    const cached = getUpdateCache(workspace);
+    if (cached && cached.installed === installed) {
+      return {
+        updateAvailable: !!cached.updateAvailable,
+        installed: cached.installed,
+        latest: cached.latest || installed,
+        checkedAt: cached.checked_at,
+      };
+    }
+  }
+
   try {
-    const cred = safeParseJson(credPath);
-    const oauth = cred?.claudeAiOauth;
-    if (!oauth?.refreshToken) return { success: false, expiresInHours: null };
-
-    const refreshed = await postForm('https://console.anthropic.com/v1/oauth/token', {
-      grant_type: 'refresh_token',
-      refresh_token: oauth.refreshToken,
-      client_id: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+    const result = spawnSync('npm', ['view', 'dual-brain', 'version', '--json'], {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 5000,
     });
+    if (result.status !== 0 || !result.stdout.trim()) {
+      return null;
+    }
 
-    const nextOauth = {
-      ...oauth,
-      accessToken: refreshed.access_token || oauth.accessToken,
-      refreshToken: refreshed.refresh_token || oauth.refreshToken,
-      tokenType: refreshed.token_type || oauth.tokenType,
-      scopes: refreshed.scope || oauth.scopes,
-      expiresAt: Date.now() + ((refreshed.expires_in || 0) * 1000),
-    };
-    const updated = { ...cred, claudeAiOauth: nextOauth };
-    writeAtomicJson(credPath, updated);
+    const latestRaw = JSON.parse(result.stdout);
+    const latest = Array.isArray(latestRaw) ? latestRaw[latestRaw.length - 1] : latestRaw;
+    if (!latest) return null;
 
-    return {
-      success: true,
-      expiresInHours: computeExpiresInHours(nextOauth.expiresAt),
-    };
+    const updateAvailable = compareVersions(latest, installed) > 0;
+    const payload = { updateAvailable, installed, latest };
+    writeUpdateCache(workspace, payload);
+    return payload;
   } catch {
-    return { success: false, expiresInHours: null };
+    return null;
   }
 }
 
-async function refreshCodexToken() {
-  try {
-    const authPath = join(process.env.HOME || '', '.codex', 'auth.json');
-    const auth = safeParseJson(authPath);
-    const tokens = auth?.tokens || auth;
-    const refreshToken = tokens?.refresh_token;
-    if (!refreshToken) return { success: false, expiresInHours: null };
-
-    const refreshed = await postForm('https://auth.openai.com/oauth/token', {
-      grant_type: 'refresh_token',
-      refresh_token: refreshToken,
-      client_id: 'app_EMoamEEZ73f0CkXaXp7hrann',
+function performUpdate(workspace, env, mode) {
+  return install(workspace, env, mode);
+}
+
+function promptForUpdate(updateInfo) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(`Update available: v${updateInfo.installed} → v${updateInfo.latest}. Press [u] to update or Enter to continue. `, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase() === 'u');
     });
+  });
+}
 
-    const updatedTokens = {
-      ...tokens,
-      access_token: refreshed.access_token || tokens.access_token,
-      refresh_token: refreshed.refresh_token || tokens.refresh_token,
-      id_token: refreshed.id_token || tokens.id_token,
-      token_type: refreshed.token_type || tokens.token_type,
-      scope: refreshed.scope || tokens.scope,
-    };
-    const updated = auth?.tokens ? { ...auth, tokens: updatedTokens } : updatedTokens;
-    writeAtomicJson(authPath, updated);
+function isLoggedInStatus(result) {
+  const out = ((result?.stdout || '') + (result?.stderr || '')).toLowerCase();
+  if (/\b(not\s+logged\s+in|unauthenticated|logged\s+out|no\s+auth)\b/.test(out)) return false;
+  return result?.status === 0 ||
+    /\b(logged\s+in|authenticated|signed\s+in|valid\s+session)\b/.test(out);
+}
 
-    const payload = decodeJwtPayload(updatedTokens.access_token);
-    return {
-      success: true,
-      expiresInHours: payload?.exp ? computeExpiresInHours(payload.exp * 1000) : null,
-    };
-  } catch {
-    return { success: false, expiresInHours: null };
-  }
+function detectReplit() {
+  const isReplit = !!(process.env.REPL_ID || process.env.REPL_SLUG);
+  const hasReplitTools = existsSync(resolve(process.cwd(), '.replit-tools'));
+  return { isReplit, hasReplitTools };
 }
 
 function detectClaude() {
@@ -455,7 +275,7 @@ function detectClaude() {
 }
 
 function detectCodex() {
-  const result = { installed: false, version: null, authed: false, path: null };
+  const result = { installed: false, version: null, authed: false, path: null, authMethod: null };
 
   const which = run('which', ['codex']);
   if (which.status === 0 && which.stdout.trim()) {
@@ -480,12 +300,17 @@ function detectCodex() {
     if (ver.status === 0) result.version = ver.stdout.trim().split('\n')[0];
 
     const login = run(result.path, ['login', 'status']);
-    const out = ((login.stdout || '') + (login.stderr || '')).toLowerCase();
-    if (login.status === 0 || out.includes('logged in') || out.includes('authenticated')) {
+    if (isLoggedInStatus(login)) {
       result.authed = true;
+      result.authMethod = 'oauth';
     }
   }
 
+  if (!result.authed && process.env.OPENAI_API_KEY) {
+    result.authed = true;
+    result.authMethod = 'api_key_env';
+  }
+
   return result;
 }
 
@@ -509,49 +334,324 @@ function detectEnvironment() {
   };
 }
 
-function runtimeInstalled(workspace = process.cwd()) {
-  return existsSync(resolve(workspace, '.replit-tools'));
-}
+// ─── NPM Token Persistence ────────────────────────────────────────────────
 
-function providerReadiness(env) {
-  const issues = [];
-  if (!env.claude.installed) issues.push('Claude CLI not found.');
-  else if (!env.claude.authed) issues.push('Claude CLI not authenticated.');
+const NPM_PERSIST = resolve(process.cwd(), '.replit-tools', '.npm-persistent', '.npmrc');
+const NPMRC_HOME = join(process.env.HOME || '', '.npmrc');
 
-  if (!env.codex.installed) issues.push('Codex CLI not found.');
-  else if (!env.codex.authed) issues.push('Codex CLI not authenticated.');
+function restoreNpmToken() {
+  if (existsSync(NPMRC_HOME)) return;
+  if (!existsSync(NPM_PERSIST)) return;
+  try {
+    const content = readFileSync(NPM_PERSIST, 'utf8');
+    if (content.includes('_authToken')) {
+      writeFileSync(NPMRC_HOME, content);
+    }
+  } catch {}
+}
 
-  return { ready: issues.length === 0, issues };
+// ─── Auth Self-Healing ─────────────────────────────────────────────────────
+
+function healClaudeAuth(env) {
+  if (env.claude.authed) return env;
+  const refreshScript = resolve(process.cwd(), '.replit-tools', 'scripts', 'claude-auth-refresh.sh');
+  if (existsSync(refreshScript)) {
+    const result = run('bash', [refreshScript, '--auto']);
+    const out = ((result.stdout || '') + (result.stderr || '')).toLowerCase();
+    if (out.includes('refreshed') || out.includes('success')) {
+      env.claude.authed = true;
+      console.log('  🔄 Claude token refreshed via data-tools');
+    }
+  }
+  return env;
 }
 
-function readInputLine(prompt) {
-  process.stdout.write(prompt);
-  return new Promise((resolve) => {
-    process.stdin.setEncoding('utf8');
-    process.stdin.once('data', (chunk) => resolve(chunk.trim()));
-    process.stdin.resume();
-  }).finally(() => {
-    process.stdin.pause();
-  });
+function healCodexAuth(env) {
+  if (env.codex.authed) return env;
+  if (!env.codex.installed || !env.codex.path) return env;
+
+  // Try restoring persisted credentials from data-tools
+  if (restoreCodexCredentials()) {
+    const login = run(env.codex.path, ['login', 'status']);
+    if (isLoggedInStatus(login)) {
+      env.codex.authed = true;
+      env.codex.authMethod = 'restored_persistent';
+      console.log('  🔄 Codex credentials restored from data-tools');
+      return env;
+    }
+  }
+
+  if (process.env.OPENAI_API_KEY) {
+    const pipe = spawnSync(env.codex.path, ['login', '--with-api-key'], {
+      input: process.env.OPENAI_API_KEY,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 10000,
+    });
+    if (pipe.status === 0) {
+      env.codex.authed = true;
+      env.codex.authMethod = 'api_key_env';
+      saveCodexCredentials();
+      console.log('  🔄 Codex authenticated via OPENAI_API_KEY');
+      return env;
+    }
+  }
+
+  return env;
 }
 
-function isRunningFromNpxCache() {
-  const scriptPath = fileURLToPath(import.meta.url);
-  return scriptPath.includes('/.npm/_npx/') || scriptPath.includes('\\.npm\\_npx\\');
+function prompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => rl.question(question, ans => { rl.close(); resolve(ans.trim()); }));
 }
 
-function warnIfUpdateAvailable() {
-  if (!isRunningFromNpxCache()) return;
-  const pkg = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf8'));
-  const packageName = pkg.name || 'dual-brain';
-  const latest = run('npm', ['view', packageName, 'version']);
-  if (latest.status !== 0) return;
-  const newest = latest.stdout.trim().split('\n').pop();
-  if (newest && newest !== VERSION) {
+async function authGuidance(env) {
+  if (env.claude.authed && env.codex.authed) return env;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return env;
+
+  console.log('');
+  console.log('  ┌────────────────────────────────────────────┐');
+  console.log('  │  🔑 Auth Setup                             │');
+  console.log('  └────────────────────────────────────────────┘');
+
+  if (!env.claude.authed) {
     console.log('');
-    console.log(`  Update available: ${cmd('npx -y dual-brain@latest')}`);
+    console.log('  🟠 Claude — not authenticated');
+    if (env.isReplit) {
+      console.log('    Run in your terminal:  ! claude login');
+      console.log('    It will give you a URL + code to paste in your browser.');
+    } else {
+      console.log('    Run: claude login');
+    }
+  }
+
+  if (!env.codex.authed) {
     console.log('');
+    console.log('  🟢 Codex — not authenticated');
+    if (!env.codex.installed) {
+      console.log('    Install first: npm i -g @openai/codex');
+      console.log('');
+    }
+
+    if (env.codex.installed && env.codex.path) {
+      console.log('');
+      console.log('    Sign in with your ChatGPT subscription (no API key needed):');
+      console.log('');
+
+      const answer = await prompt('  Press Enter to start device auth (or "skip" to skip): ');
+      if (answer.toLowerCase() === 'skip') {
+        console.log('  ⏭️  Skipped — GPT features disabled until Codex is authed');
+      } else {
+        console.log('');
+        if (runCodexDeviceAuth(env.codex.path)) {
+          env.codex.authed = true;
+          env.codex.authMethod = 'device_auth';
+          console.log('');
+          console.log('  ✅ Codex authenticated! (credentials saved for next session)');
+        } else {
+          console.log('');
+          console.log('  ❌ Auth failed — try again with: codex login --device-auth');
+        }
+      }
+    }
+  }
+
+  console.log('');
+  return env;
+}
+
+// ─── Codex Credential Persistence ──────────────────────────────────────────
+
+const CODEX_HOME = join(process.env.HOME || '', '.codex');
+const CODEX_PERSIST = resolve(process.cwd(), '.replit-tools', '.codex-persistent');
+
+function saveCodexCredentials() {
+  const authFile = join(CODEX_HOME, 'auth.json');
+  if (!existsSync(authFile)) return false;
+  try {
+    const auth = readFileSync(authFile, 'utf8');
+    if (!auth.trim() || auth.trim() === '{}') return false;
+    mkdirSync(CODEX_PERSIST, { recursive: true });
+    const persisted = join(CODEX_PERSIST, 'auth.json');
+    writeFileSync(persisted, auth, { mode: 0o600 });
+    try { chmodSync(persisted, 0o600); } catch {}
+    return true;
+  } catch { return false; }
+}
+
+function restoreCodexCredentials() {
+  const persistedAuth = join(CODEX_PERSIST, 'auth.json');
+  const targetAuth = join(CODEX_HOME, 'auth.json');
+  if (existsSync(targetAuth)) return false;
+  if (!existsSync(persistedAuth)) return false;
+  try {
+    const auth = readFileSync(persistedAuth, 'utf8');
+    if (!auth.trim() || auth.trim() === '{}') return false;
+    mkdirSync(CODEX_HOME, { recursive: true });
+    writeFileSync(targetAuth, auth, { mode: 0o600 });
+    try { chmodSync(targetAuth, 0o600); } catch {}
+    return true;
+  } catch { return false; }
+}
+
+function parseDateValue(value) {
+  if (!value) return null;
+  if (typeof value === 'number') {
+    const ms = value > 1e12 ? value : value * 1000;
+    const d = new Date(ms);
+    return Number.isNaN(d.getTime()) ? null : d;
+  }
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
+
+function formatExpiry(value) {
+  const d = parseDateValue(value);
+  if (!d) return 'unknown';
+  const iso = d.toISOString();
+  return d.getTime() <= Date.now() ? `${iso} (expired)` : iso;
+}
+
+function formatTimestamp(value) {
+  const d = parseDateValue(value);
+  return d ? d.toISOString() : 'unknown';
+}
+
+function relPath(p) {
+  if (!p) return 'unknown';
+  const cwd = resolve(process.cwd());
+  const full = resolve(p);
+  if (full.startsWith(cwd + '/')) return full.slice(cwd.length + 1);
+  const home = process.env.HOME || '';
+  if (home && full.startsWith(home + '/')) return `~/${full.slice(home.length + 1)}`;
+  return full;
+}
+
+function readJsonIfExists(file) {
+  if (!file || !existsSync(file)) return null;
+  try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function claudeCredentialCandidates() {
+  return [
+    join(process.env.HOME || '', '.claude', '.credentials.json'),
+    join(process.env.HOME || '', '.claude', 'credentials.json'),
+    resolve(process.cwd(), '.replit-tools', '.claude-persistent', '.credentials.json'),
+  ];
+}
+
+function getClaudeAuthDetails() {
+  const detected = detectClaude();
+  const status = detected.installed ? run('claude', ['auth', 'status']) : null;
+  let method = 'none';
+  let storage = null;
+  let expiry = null;
+
+  for (const file of claudeCredentialCandidates()) {
+    const cred = readJsonIfExists(file);
+    if (!cred) continue;
+    if (cred.claudeAiOauth) {
+      method = 'oauth';
+      storage = file;
+      expiry = cred.claudeAiOauth.expiresAt || null;
+      break;
+    }
+    if (cred.apiKey || cred.oauth_token) {
+      method = cred.apiKey ? 'api_key' : 'oauth_token';
+      storage = file;
+      break;
+    }
+  }
+
+  const statusText = ((status?.stdout || '') + (status?.stderr || '')).trim();
+  return {
+    provider: 'claude',
+    installed: detected.installed,
+    version: detected.version,
+    authed: detected.authed,
+    method,
+    expiry,
+    expiryText: formatExpiry(expiry),
+    storage,
+    storageText: relPath(storage),
+    statusText,
+  };
+}
+
+function getCodexAuthDetails() {
+  const detected = detectCodex();
+  const status = (detected.installed && detected.path) ? run(detected.path, ['login', 'status']) : null;
+  const authFile = join(CODEX_HOME, 'auth.json');
+  const persisted = join(CODEX_PERSIST, 'auth.json');
+  const activeFile = existsSync(authFile) ? authFile : existsSync(persisted) ? persisted : null;
+  const auth = readJsonIfExists(activeFile);
+
+  let method = detected.authMethod || 'none';
+  if (auth?.auth_mode === 'chatgpt') method = 'chatgpt_device_auth';
+  else if (auth?.auth_mode === 'api_key') method = 'api_key';
+  else if (!detected.authed && process.env.OPENAI_API_KEY) method = 'api_key_env';
+
+  const lastRefresh = auth?.last_refresh || null;
+  const statusText = ((status?.stdout || '') + (status?.stderr || '')).trim();
+  return {
+    provider: 'codex',
+    installed: detected.installed,
+    version: detected.version,
+    authed: detected.authed,
+    method,
+    expiry: null,
+    expiryText: 'n/a',
+    lastRefresh,
+    lastRefreshText: formatTimestamp(lastRefresh),
+    storage: activeFile,
+    storageText: relPath(activeFile),
+    statusText,
+    path: detected.path,
+  };
+}
+
+function getAuthState() {
+  return {
+    claude: getClaudeAuthDetails(),
+    codex: getCodexAuthDetails(),
+  };
+}
+
+function printAuthStatusBox(state) {
+  const c = state.claude;
+  const x = state.codex;
+  const cIcon = c.authed ? '✅' : c.installed ? '⚠️' : '❌';
+  const xIcon = x.authed ? '✅' : x.installed ? '⚠️' : '❌';
+
+  console.log('');
+  console.log(`  ${br('╔', '╗')}`);
+  console.log(`  ${ln(`🔑 Auth Status`)}`);
+  console.log(`  ${sep()}`);
+  console.log(`  ${ln(`🟠 Claude ${cIcon}  ${c.authed ? 'authenticated' : c.installed ? 'not authenticated' : 'not installed'}`)}`);
+  console.log(`  ${ln(`   Method:   ${c.method}`)}`);
+  console.log(`  ${ln(`   Expiry:   ${c.expiryText}`)}`);
+  console.log(`  ${ln(`   Storage:  ${c.storageText}`)}`);
+  console.log(`  ${sep()}`);
+  console.log(`  ${ln(`🟢 Codex  ${xIcon}  ${x.authed ? 'authenticated' : x.installed ? 'not authenticated' : 'not installed'}`)}`);
+  console.log(`  ${ln(`   Method:   ${x.method}`)}`);
+  console.log(`  ${ln(`   Expiry:   ${x.expiryText}`)}`);
+  console.log(`  ${ln(`   Storage:  ${x.storageText}`)}`);
+  if (x.lastRefresh) console.log(`  ${ln(`   Refreshed:${x.lastRefreshText}`)}`);
+  console.log(`  ${br('╚', '╝')}`);
+  console.log('');
+}
+
+function runCodexDeviceAuth(codexPath) {
+  if (!codexPath) return false;
+  const result = spawnSync(codexPath, ['login', '--device-auth'], {
+    stdio: 'inherit',
+    timeout: 900000,
+  });
+  if (result.status === 0) {
+    saveCodexCredentials();
+    return true;
   }
+  return false;
 }
 
 // ─── Mode Resolution ────────────────────────────────────────────────────────
@@ -618,7 +718,7 @@ function generateSettings(workspace) {
     ],
     PostToolUse: [
       {
-        matcher: 'Agent|Bash|Write|Edit',
+        matcher: '',
         hooks: [{ type: 'command', command: 'node .claude/hooks/cost-logger.mjs' }],
       },
     ],
@@ -667,6 +767,8 @@ function generateGitignoreEntries(workspace) {
     '.claude/hooks/decision-ledger.jsonl',
     '.claude/.launched',
     '.claude/dual-brain.memory.json',
+    '.claude/dual-brain.version.json',
+    '.claude/dual-brain.update-check.json',
   ];
   let existing = '';
   try { existing = readFileSync(join(workspace, '.gitignore'), 'utf8'); } catch {}
@@ -691,8 +793,6 @@ function install(workspace, env, mode) {
     'summary-checkpoint.mjs', 'decision-ledger.mjs', 'control-panel.mjs',
     'risk-classifier.mjs', 'failure-detector.mjs',
     'vibe-router.mjs', 'plan-generator.mjs', 'vibe-memory.mjs',
-    'agent-templates.mjs', 'agent-chains.mjs',
-    'ship-captain.mjs', 'ship-gate.mjs', 'confirmation-policy.mjs',
   ];
   for (const h of HOOKS) cpSync(join(__dirname, 'hooks', h), join(target, 'hooks', h));
   actions.push(`✓ ${HOOKS.length} hook scripts`);
@@ -734,21 +834,10 @@ function install(workspace, env, mode) {
     actions.push('✓ .gitignore updated');
   }
 
-  return actions;
-}
-
-// ─── Quick Start Block ───────────────────────────────────────────────────────
+  const stamp = writeVersionStamp(workspace);
+  actions.push(`✓ version stamp (v${stamp.version})`);
 
-function printQuickStart() {
-  console.log('');
-  console.log(`  ${BRAND}`);
-  console.log('');
-  console.log('  Quick start:');
-  console.log('    npx dual-brain do "fix the login bug"    ← one command to PR');
-  console.log('    npx dual-brain setup                     ← configure providers');
-  console.log('    npx dual-brain doctor                    ← check system health');
-  console.log('    npx dual-brain help                      ← full command list');
-  console.log('');
+  return actions;
 }
 
 // ─── Status Report ──────────────────────────────────────────────────────────
@@ -757,14 +846,22 @@ function printReport(env, mode, actions, isDryRun) {
   const lines = [];
 
   lines.push(br('╔', '╗'));
-  lines.push(ln(BRAND));
-  lines.push(ln(BRAND_SUBTITLE));
+  lines.push(ln(`🧠 Dual-Brain v${VERSION}`));
   lines.push(sep());
-  lines.push(ln(`Workspace: ${env.workspace}`));
+
+  const cAuth = env.claude.authed ? '✅' : env.claude.installed ? '⚠️' : '❌';
+  const xAuth = env.codex.authed ? '✅' : env.codex.installed ? '⚠️' : '❌';
+  lines.push(ln(`  🟠 Claude ${cAuth}   🟢 Codex ${xAuth}`));
+
+  if (env.isReplit) {
+    lines.push(ln(`  🌀 Replit${env.hasReplitTools ? ' + replit-tools' : ''}`));
+  }
 
   if (actions) {
     lines.push(sep());
     for (const a of actions) lines.push(ln(`  ${a}`));
+    lines.push(sep());
+    lines.push(ln('✅ Installed — launching session manager...'));
   } else if (isDryRun) {
     lines.push(sep());
     lines.push(ln('Dry run — no files written'));
@@ -851,6 +948,132 @@ function launchPanel() {
   }
 }
 
+// ─── Subcommand: auth ──────────────────────────────────────────────────────
+
+function cmdAuthStatus() {
+  const state = getAuthState();
+  if (jsonOut) {
+    console.log(JSON.stringify({ version: VERSION, auth: state }, null, 2));
+    return;
+  }
+  printAuthStatusBox(state);
+  console.log(`  Login:   ${cmd('npx dual-brain auth login')}`);
+  console.log(`  Refresh: ${cmd('npx dual-brain auth refresh')}`);
+  console.log('');
+}
+
+function cmdAuthLogin() {
+  const state = getAuthState();
+
+  console.log('');
+  if (!state.claude.authed) {
+    if (!state.claude.installed) {
+      console.log('  🟠 Claude is not installed.');
+    } else {
+      console.log('  🟠 Claude needs login.');
+      console.log(`    Run: ${cmd('claude login')}`);
+      console.log('    Claude uses its own browser/device flow from the CLI.');
+    }
+    console.log('');
+  }
+
+  if (!state.codex.authed) {
+    if (!state.codex.installed || !state.codex.path) {
+      console.log('  🟢 Codex is not installed.');
+      console.log('    Install first: npm i -g @openai/codex');
+      console.log('');
+    } else if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      console.log('  🟢 Codex login requires an interactive terminal.');
+      console.log(`    Run: ${cmd('codex login --device-auth')}`);
+      console.log('');
+    } else {
+      console.log('  🟢 Starting Codex device auth...');
+      console.log('');
+      if (runCodexDeviceAuth(state.codex.path)) {
+        console.log('');
+        console.log('  ✅ Codex authenticated and credentials saved.');
+      } else {
+        console.log('');
+        console.log(`  ❌ Codex auth failed. Retry with: ${cmd('codex login --device-auth')}`);
+      }
+      console.log('');
+    }
+  }
+
+  if (state.claude.authed && state.codex.authed) {
+    console.log('  ✅ Claude and Codex are already authenticated.');
+    console.log('');
+    return;
+  }
+
+  const finalState = getAuthState();
+  if (finalState.claude.authed && finalState.codex.authed) {
+    printAuthStatusBox(finalState);
+    return;
+  }
+
+  printAuthStatusBox(finalState);
+}
+
+function cmdAuthRefresh() {
+  let env = detectEnvironment();
+  let codexRefreshed = false;
+
+  console.log('');
+  console.log('  🔄 Refreshing provider auth...');
+  console.log('');
+
+  env = { ...env, claude: { ...env.claude, authed: false } };
+  env = healClaudeAuth(env);
+
+  if (env.codex.installed && env.codex.path && process.stdin.isTTY && process.stdout.isTTY) {
+    console.log('  🟢 Codex device auth refresh');
+    console.log('');
+    codexRefreshed = runCodexDeviceAuth(env.codex.path);
+    if (codexRefreshed) {
+      env.codex.authed = true;
+      env.codex.authMethod = 'device_auth';
+      console.log('');
+      console.log('  ✅ Codex auth refreshed and credentials saved.');
+      console.log('');
+    } else {
+      console.log('');
+      console.log(`  ❌ Codex refresh failed. Retry with: ${cmd('codex login --device-auth')}`);
+      console.log('');
+    }
+  } else {
+    env = { ...env, codex: { ...env.codex, authed: false } };
+    env = healCodexAuth(env);
+  }
+
+  if (env.claude.installed && !env.claude.authed) {
+    console.log(`  🟠 Claude refresh unavailable here. Run: ${cmd('claude login')}`);
+    console.log('');
+  }
+  if (env.codex.installed && !env.codex.authed && !codexRefreshed) {
+    console.log(`  🟢 Codex refresh incomplete. Run: ${cmd('codex login --device-auth')}`);
+    console.log('');
+  }
+
+  const finalState = getAuthState();
+  if (jsonOut) {
+    console.log(JSON.stringify({ version: VERSION, auth: finalState }, null, 2));
+    return;
+  }
+  printAuthStatusBox(finalState);
+}
+
+function cmdAuth() {
+  const action = positional[1] || 'status';
+  if (action === 'status')  { cmdAuthStatus(); return; }
+  if (action === 'login')   { cmdAuthLogin(); return; }
+  if (action === 'refresh') { cmdAuthRefresh(); return; }
+
+  console.error(`  Unknown auth command: ${action}`);
+  console.error(`  Run: ${cmd('npx dual-brain auth [status|login|refresh]')}`);
+  process.exit(1);
+}
+
 // ─── Subcommand: mode ──────────────────────────────────────────────────────
 
 function cmdMode() {
@@ -1056,1223 +1279,58 @@ function cmdExplain() {
   console.log('');
 }
 
-// ─── Subcommand: doctor ───────────────────────────────────────────────────
-
-function cmdDoctor() {
-  const workspace = resolve(process.cwd());
-  const claudeDir = join(workspace, '.claude');
-  const hooksDir = join(claudeDir, 'hooks');
-  const results = [];
+// ─── Main ───────────────────────────────────────────────────────────────────
 
-  // 1. Hook installation check
-  const settingsPath = join(claudeDir, 'settings.json');
-  const DUAL_BRAIN_CMDS = [
-    'node .claude/hooks/enforce-tier.mjs',
-    'node .claude/hooks/cost-logger.mjs',
-  ];
-  if (existsSync(settingsPath)) {
-    try {
-      const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
-      const registeredCmds = [];
-      if (settings.hooks) {
-        for (const entries of Object.values(settings.hooks)) {
-          for (const entry of entries) {
-            for (const h of (entry.hooks || [])) {
-              if (DUAL_BRAIN_CMDS.includes(h.command)) registeredCmds.push(h.command);
-            }
-          }
-        }
-      }
-      const missing = DUAL_BRAIN_CMDS.filter(c => !registeredCmds.includes(c));
-      if (missing.length === 0) {
-        results.push({ name: 'Hook registration', status: 'pass', detail: `${DUAL_BRAIN_CMDS.length}/${DUAL_BRAIN_CMDS.length} hooks registered` });
-      } else {
-        results.push({ name: 'Hook registration', status: 'fail', detail: `Missing: ${missing.map(c => c.split('/').pop()).join(', ')}`, fix: 'Run: npx dual-brain repair' });
-      }
-    } catch (err) {
-      results.push({ name: 'Hook registration', status: 'fail', detail: `settings.json parse error: ${err.message}`, fix: 'Run: npx dual-brain repair' });
-    }
-  } else {
-    results.push({ name: 'Hook registration', status: 'fail', detail: 'settings.json not found', fix: 'Run: npx dual-brain' });
+async function main() {
+  if (subcommand === 'status') {
+    launchPanel();
+    return;
   }
+  if (subcommand === 'auth')    { cmdAuth();    return; }
+  if (subcommand === 'mode')    { cmdMode();    return; }
+  if (subcommand === 'budget')  { cmdBudget();  return; }
+  if (subcommand === 'explain') { cmdExplain(); return; }
 
-  // 2. Config validity
-  const orchPath = join(claudeDir, 'orchestrator.json');
-  if (existsSync(orchPath)) {
-    try {
-      const config = JSON.parse(readFileSync(orchPath, 'utf8'));
-      const requiredKeys = ['subscriptions', 'tiers', 'providers', 'budgets'];
-      const missing = requiredKeys.filter(k => !config[k]);
-      if (missing.length === 0) {
-        results.push({ name: 'Config validity', status: 'pass', detail: 'orchestrator.json valid, all required keys present' });
-      } else {
-        results.push({ name: 'Config validity', status: 'warn', detail: `Missing keys: ${missing.join(', ')}`, fix: 'Run: npx dual-brain --force' });
-      }
-    } catch (err) {
-      results.push({ name: 'Config validity', status: 'fail', detail: `orchestrator.json corrupt: ${err.message}`, fix: 'Run: npx dual-brain repair' });
-    }
-  } else {
-    results.push({ name: 'Config validity', status: 'fail', detail: 'orchestrator.json not found', fix: 'Run: npx dual-brain' });
-  }
-
-  // 3. Auth status
-  const claude = detectClaude();
-  if (claude.authed) {
-    results.push({ name: 'Claude CLI', status: 'pass', detail: 'installed and authenticated' });
-  } else if (claude.installed) {
-    results.push({ name: 'Claude CLI', status: 'warn', detail: 'installed but not authenticated' });
-  } else {
-    results.push({ name: 'Claude CLI', status: 'warn', detail: 'not found' });
-  }
-
-  const codexResult = detectCodex();
-  if (codexResult.authed) {
-    results.push({ name: 'Codex CLI', status: 'pass', detail: 'installed and authenticated' });
-  } else if (codexResult.installed) {
-    results.push({ name: 'Codex CLI', status: 'warn', detail: 'installed but not authenticated' });
-  } else {
-    results.push({ name: 'Codex CLI', status: 'warn', detail: 'not found (GPT features disabled)' });
-  }
-
-  // 4. State file health
-  const stateCheckFiles = [
-    { path: join(hooksDir, '.burst-state'), label: '.burst-state', format: 'json' },
-    { path: join(hooksDir, 'burst-state.json'), label: 'burst-state.json', format: 'json' },
-    { path: join(hooksDir, '.drift-warned'), label: '.drift-warned', format: 'any' },
-    { path: join(claudeDir, 'dual-brain.profile.json'), label: 'dual-brain.profile.json', format: 'json' },
-    { path: join(hooksDir, 'decision-ledger.jsonl'), label: 'decision-ledger.jsonl', format: 'jsonl' },
-  ];
-
-  // Add any usage-*.jsonl files
-  try {
-    for (const f of readdirSync(hooksDir)) {
-      if (f.startsWith('usage-') && f.endsWith('.jsonl')) {
-        stateCheckFiles.push({ path: join(hooksDir, f), label: f, format: 'jsonl' });
-      }
-    }
-  } catch {}
-
-  let stateHealthy = 0, stateWarns = 0, stateFails = 0;
-  const stateIssues = [];
-
-  for (const sf of stateCheckFiles) {
-    if (!existsSync(sf.path)) continue;
-    try {
-      const raw = readFileSync(sf.path, 'utf8');
-      if (sf.format === 'json') {
-        JSON.parse(raw);
-        stateHealthy++;
-      } else if (sf.format === 'jsonl') {
-        const lines = raw.split('\n').filter(Boolean);
-        let badLines = 0;
-        for (const line of lines) {
-          try { JSON.parse(line); } catch { badLines++; }
-        }
-        if (badLines > 0) {
-          stateWarns++;
-          stateIssues.push(`${sf.label}: ${badLines}/${lines.length} unparseable lines`);
-        } else {
-          stateHealthy++;
-        }
-      } else {
-        stateHealthy++;
-      }
-    } catch (err) {
-      stateFails++;
-      stateIssues.push(`${sf.label}: corrupt (${err.message})`);
-    }
-  }
-
-  // Check for stale locks
-  let staleLocks = 0;
-  for (const dir of [hooksDir, claudeDir]) {
-    try {
-      for (const f of readdirSync(dir)) {
-        if (f.endsWith('.lock')) {
-          try {
-            const st = statSync(join(dir, f));
-            if (Date.now() - st.mtimeMs > 30_000) staleLocks++;
-          } catch {}
-        }
-      }
-    } catch {}
-  }
-
-  if (staleLocks > 0) {
-    stateIssues.push(`${staleLocks} stale lock file(s)`);
-    stateWarns++;
-  }
-
-  if (stateFails > 0) {
-    results.push({ name: 'State files', status: 'fail', detail: stateIssues.join('; '), fix: 'Run: npx dual-brain repair' });
-  } else if (stateWarns > 0) {
-    results.push({ name: 'State files', status: 'warn', detail: stateIssues.join('; '), fix: 'Run: npx dual-brain repair' });
-  } else {
-    results.push({ name: 'State files', status: 'pass', detail: `${stateHealthy} file(s) healthy` });
-  }
-
-  // 5. Error channel
-  const errorsFile = join(hooksDir, 'errors.jsonl');
-  if (existsSync(errorsFile)) {
-    try {
-      const raw = readFileSync(errorsFile, 'utf8');
-      const lines = raw.split('\n').filter(Boolean);
-      const entries = [];
-      for (const line of lines) {
-        try { entries.push(JSON.parse(line)); } catch {}
-      }
-
-      const cutoff24h = Date.now() - 24 * 60 * 60 * 1000;
-      const recent = entries.filter(e => e.timestamp && Date.parse(e.timestamp) >= cutoff24h);
-
-      if (recent.length === 0) {
-        results.push({ name: 'Error channel', status: 'pass', detail: 'no errors in last 24h' });
-      } else {
-        const last3 = recent.slice(-3);
-        const detail = `${recent.length} error(s) in last 24h`;
-        results.push({ name: 'Error channel', status: 'warn', detail, errors: last3 });
-      }
-    } catch {
-      results.push({ name: 'Error channel', status: 'warn', detail: 'errors.jsonl unreadable' });
-    }
-  } else {
-    results.push({ name: 'Error channel', status: 'pass', detail: 'no errors.jsonl (clean)' });
-  }
-
-  // Output
-  const passCount = results.filter(r => r.status === 'pass').length;
-  const warnCount = results.filter(r => r.status === 'warn').length;
-  const failCount = results.filter(r => r.status === 'fail').length;
-
-  console.log('');
-  console.log(`  🩺 dual-brain v${VERSION} — doctor`);
-  console.log('  ' + '─'.repeat(50));
-
-  for (const r of results) {
-    const icon = r.status === 'pass' ? '✓' : r.status === 'warn' ? '⚠' : '✗';
-    console.log(`  ${icon} ${r.name}: ${r.detail}`);
-    if (r.fix) console.log(`    → ${r.fix}`);
-    if (r.errors) {
-      for (const e of r.errors) {
-        const ts = e.timestamp ? e.timestamp.slice(11, 19) : '??:??:??';
-        console.log(`    ${ts} [${e.hook || '?'}] ${e.error || '?'}`);
-      }
-    }
-  }
-
-  console.log('  ' + '─'.repeat(50));
-  if (failCount > 0) {
-    console.log(`  ✗ Needs repair: ${failCount} issue(s) require attention`);
-  } else if (warnCount > 0) {
-    console.log(`  ⚠ Warnings: ${warnCount} — system functional but has issues`);
-  } else {
-    console.log(`  ✓ Healthy: all ${passCount} checks passed`);
-  }
-  console.log('');
-}
-
-// ─── Subcommand: reset ────────────────────────────────────────────────────
-
-function cmdReset() {
-  const workspace = resolve(process.cwd());
-  const claudeDir = join(workspace, '.claude');
-  const hooksDir = join(claudeDir, 'hooks');
-
-  // Collect state files (NOT config, hooks, or profile)
-  const STATE_FIXED = [
-    join(hooksDir, 'usage.jsonl'),
-    join(hooksDir, 'decision-ledger.jsonl'),
-    join(hooksDir, 'failure-ledger.json'),
-    join(hooksDir, '.burst-state'),
-    join(hooksDir, 'burst-state.json'),
-    join(hooksDir, '.drift-warned'),
-    join(hooksDir, '.budget-alerted'),
-    join(hooksDir, 'errors.jsonl'),
-    join(hooksDir, 'summary-checkpoint.json'),
-    join(claudeDir, '.launched'),
-  ];
-
-  const toDelete = [];
-  for (const f of STATE_FIXED) {
-    if (existsSync(f)) toDelete.push(f);
-  }
-
-  // Scan for date-stamped files and lock files
-  try {
-    for (const f of readdirSync(hooksDir)) {
-      if (f.startsWith('usage-') && f.endsWith('.jsonl')) toDelete.push(join(hooksDir, f));
-      if (f.startsWith('usage-summary-') && f.endsWith('.json')) toDelete.push(join(hooksDir, f));
-      if (f.endsWith('.lock')) toDelete.push(join(hooksDir, f));
-    }
-  } catch {}
-  try {
-    for (const f of readdirSync(claudeDir)) {
-      if (f.endsWith('.lock')) toDelete.push(join(claudeDir, f));
-    }
-  } catch {}
-
-  const unique = [...new Set(toDelete)].filter(f => existsSync(f));
-
-  if (unique.length === 0) {
-    console.log('');
-    console.log('  🔄 Nothing to reset — no state files found.');
-    console.log('');
-    return;
-  }
-
-  // Require --force or confirmation
-  if (!force) {
-    console.log('');
-    console.log(`  🔄 dual-brain reset — will delete ${unique.length} state file(s):`);
-    console.log('');
-    for (const f of unique) {
-      const rel = f.startsWith(workspace) ? f.slice(workspace.length + 1) : f;
-      console.log(`    ${rel}`);
-    }
-    console.log('');
-    console.log('  Preserved: orchestrator.json, settings.json, hooks, profile, CLAUDE.md');
-    console.log('');
-    console.log(`  To confirm: ${cmd('npx dual-brain reset --force')}`);
-    console.log('');
-    return;
-  }
-
-  let removed = 0;
-  const errors = [];
-  for (const f of unique) {
-    try {
-      unlinkSync(f);
-      removed++;
-    } catch (err) {
-      errors.push(`  ⚠ Could not remove ${f.split('/').pop()}: ${err.message}`);
-    }
-  }
-
-  console.log('');
-  console.log(`  🔄 dual-brain v${VERSION} — reset`);
-  console.log('  ' + '─'.repeat(40));
-  console.log(`  ✓ Removed ${removed} state file(s)`);
-  for (const e of errors) console.log(e);
-  console.log('');
-  console.log('  Preserved: orchestrator.json, settings.json, hooks, profile, CLAUDE.md');
-  console.log('  State will rebuild automatically on next session.');
-  console.log('');
-}
-
-// ─── Subcommand: repair ───────────────────────────────────────────────────
-
-function cmdRepair() {
-  const workspace = resolve(process.cwd());
-  const claudeDir = join(workspace, '.claude');
-  const hooksDir = join(claudeDir, 'hooks');
-  const actions = [];
-
-  // 1. Remove stale lock files (older than 30 seconds)
-  let staleLocks = 0;
-  for (const dir of [hooksDir, claudeDir]) {
-    try {
-      for (const f of readdirSync(dir)) {
-        if (!f.endsWith('.lock')) continue;
-        const lockPath = join(dir, f);
-        try {
-          const st = statSync(lockPath);
-          if (Date.now() - st.mtimeMs > 30_000) {
-            unlinkSync(lockPath);
-            staleLocks++;
-          }
-        } catch {}
-      }
-    } catch {}
-  }
-  if (staleLocks > 0) {
-    actions.push(`✓ Removed ${staleLocks} stale lock file(s)`);
-  } else {
-    actions.push('⊘ No stale locks found');
-  }
-
-  // 2. Repair corrupt JSONL files
-  const jsonlFiles = [
-    join(hooksDir, 'decision-ledger.jsonl'),
-    join(hooksDir, 'errors.jsonl'),
-    join(hooksDir, 'usage.jsonl'),
-  ];
-  try {
-    for (const f of readdirSync(hooksDir)) {
-      if (f.startsWith('usage-') && f.endsWith('.jsonl')) {
-        jsonlFiles.push(join(hooksDir, f));
-      }
-    }
-  } catch {}
-
-  let repairedJsonl = 0;
-  for (const filePath of [...new Set(jsonlFiles)]) {
-    if (!existsSync(filePath)) continue;
-    try {
-      const raw = readFileSync(filePath, 'utf8');
-      const lines = raw.split('\n').filter(Boolean);
-      let badCount = 0;
-      const goodLines = [];
-      for (const line of lines) {
-        try {
-          JSON.parse(line);
-          goodLines.push(line);
-        } catch {
-          badCount++;
-        }
-      }
-      if (badCount > 0) {
-        const tmp = filePath + '.tmp.' + process.pid;
-        writeFileSync(tmp, goodLines.length > 0 ? goodLines.join('\n') + '\n' : '');
-        renameSync(tmp, filePath);
-        repairedJsonl++;
-        actions.push(`✓ ${filePath.split('/').pop()}: removed ${badCount} corrupt line(s), kept ${goodLines.length}`);
-      }
-    } catch (err) {
-      actions.push(`⚠ ${filePath.split('/').pop()}: could not repair (${err.message})`);
-    }
-  }
-  if (repairedJsonl === 0) {
-    actions.push('⊘ No corrupt JSONL files found');
-  }
-
-  // 3. Re-validate and fix orchestrator.json formatting
-  const orchPath = join(claudeDir, 'orchestrator.json');
-  if (existsSync(orchPath)) {
-    try {
-      const raw = readFileSync(orchPath, 'utf8');
-      const config = JSON.parse(raw);
-      const pretty = JSON.stringify(config, null, 2) + '\n';
-      if (raw !== pretty) {
-        const tmp = orchPath + '.tmp.' + process.pid;
-        writeFileSync(tmp, pretty);
-        renameSync(tmp, orchPath);
-        actions.push('✓ orchestrator.json: re-formatted');
-      } else {
-        actions.push('⊘ orchestrator.json: already well-formatted');
-      }
-    } catch (err) {
-      actions.push(`✗ orchestrator.json: invalid JSON — ${err.message}`);
-      actions.push('  → Run: npx dual-brain --force (to regenerate from template)');
-    }
-  } else {
-    actions.push('✗ orchestrator.json: not found — run: npx dual-brain');
-  }
-
-  // 4. Re-run hook registration (ensure hooks are in settings.json)
-  if (existsSync(join(claudeDir, 'settings.json')) || existsSync(orchPath)) {
-    try {
-      const settings = generateSettings(workspace);
-      const tmp = join(claudeDir, 'settings.json.tmp.' + process.pid);
-      writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
-      renameSync(tmp, join(claudeDir, 'settings.json'));
-      actions.push('✓ settings.json: hooks re-registered');
-    } catch (err) {
-      actions.push(`⚠ settings.json: could not re-register hooks (${err.message})`);
-    }
-  }
-
-  // Print report
-  console.log('');
-  console.log(`  🔧 dual-brain v${VERSION} — repair`);
-  console.log('  ' + '─'.repeat(40));
-  for (const a of actions) {
-    console.log(`  ${a}`);
-  }
-  console.log('');
-}
-
-// ─── Uninstall ─────────────────────────────────────────────────────────────
-
-function cmdUninstall() {
-  const workspace = resolve(process.cwd());
-  const claudeDir = join(workspace, '.claude');
-  const hooksDir = join(claudeDir, 'hooks');
-  const actions = [];
-
-  // 1. Remove dual-brain hooks from settings.json
-  const settingsPath = join(claudeDir, 'settings.json');
-  if (existsSync(settingsPath)) {
-    try {
-      const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
-      const DUAL_BRAIN_CMDS = [
-        'node .claude/hooks/enforce-tier.mjs',
-        'node .claude/hooks/cost-logger.mjs',
-      ];
-
-      if (settings.hooks) {
-        let removedCount = 0;
-        for (const event of Object.keys(settings.hooks)) {
-          const before = settings.hooks[event].length;
-          settings.hooks[event] = settings.hooks[event].filter(entry =>
-            !entry.hooks?.some(h => DUAL_BRAIN_CMDS.includes(h.command))
-          );
-          removedCount += before - settings.hooks[event].length;
-
-          // Clean up empty arrays
-          if (settings.hooks[event].length === 0) {
-            delete settings.hooks[event];
-          }
-        }
-
-        // Clean up empty hooks object
-        if (Object.keys(settings.hooks).length === 0) {
-          delete settings.hooks;
-        }
-
-        writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-        if (removedCount > 0) {
-          actions.push(`✓ Removed ${removedCount} hook(s) from settings.json`);
-        } else {
-          actions.push('⊘ No dual-brain hooks found in settings.json');
-        }
-      } else {
-        actions.push('⊘ No hooks section in settings.json');
-      }
-    } catch (err) {
-      actions.push(`⚠ Could not parse settings.json: ${err.message}`);
-    }
-  } else {
-    actions.push('⊘ No settings.json found');
-  }
-
-  // 2. Remove state files
-  const stateFiles = [
-    join(claudeDir, 'dual-brain.profile.json'),
-    join(claudeDir, 'dual-brain.memory.json'),
-    join(claudeDir, '.launched'),
-  ];
-
-  // Add date-stamped usage files and summary files
-  const today = new Date().toISOString().slice(0, 10);
-  stateFiles.push(join(hooksDir, 'usage.jsonl'));
-  stateFiles.push(join(hooksDir, `usage-${today}.jsonl`));
-  stateFiles.push(join(hooksDir, 'decision-ledger.jsonl'));
-  stateFiles.push(join(hooksDir, '.drift-warned'));
-  stateFiles.push(join(hooksDir, '.budget-alerted'));
-
-  // Scan for any usage-*.jsonl and usage-summary-*.json files
-  try {
-    const files = readdirSync(hooksDir);
-    for (const f of files) {
-      if (f.startsWith('usage-') && f.endsWith('.jsonl')) {
-        stateFiles.push(join(hooksDir, f));
-      }
-      if (f.startsWith('usage-summary-') && f.endsWith('.json')) {
-        stateFiles.push(join(hooksDir, f));
-      }
-      if (f === 'burst-state.json' || f === 'failure-ledger.json') {
-        stateFiles.push(join(hooksDir, f));
-      }
-    }
-  } catch {}
-
-  // Deduplicate
-  const uniqueFiles = [...new Set(stateFiles)];
-
-  let removedFiles = 0;
-  for (const f of uniqueFiles) {
-    try {
-      if (existsSync(f)) {
-        unlinkSync(f);
-        removedFiles++;
-      }
-    } catch {}
-  }
-
-  if (removedFiles > 0) {
-    actions.push(`✓ Removed ${removedFiles} state file(s)`);
-  } else {
-    actions.push('⊘ No state files to remove');
-  }
-
-  // 3. Print summary
-  console.log('');
-  console.log(`  🧠 dual-brain v${VERSION} — uninstall`);
-  console.log('  ' + '─'.repeat(40));
-  for (const a of actions) {
-    console.log(`  ${a}`);
-  }
-  console.log('');
-  console.log('  Hook scripts in .claude/hooks/ were left in place');
-  console.log('  (they are part of the npm package, not your repo).');
-  console.log('');
-  console.log('  To reinstall: npx -y dual-brain');
-  console.log('');
-}
-
-// ─── Hook Delegation ───────────────────────────────────────────────────────
-
-const HOOK_COMMANDS = {
-  review:   'dual-brain-review.mjs',
-  think:    'dual-brain-think.mjs',
-  health:   'health-check.mjs',
-  report:   'session-report.mjs',
-  gate:     'quality-gate.mjs',
-  vibe:     'vibe-router.mjs',
-  plan:     'plan-generator.mjs',
-  cost:     'cost-report.mjs',
-  dispatch: 'gpt-work-dispatcher.mjs',
-  memory:   'vibe-memory.mjs',
-  test:     'test-orchestrator.mjs',
-  ledger:   'decision-ledger.mjs',
-  chains:   'agent-chains.mjs',
-};
-
-function resolveHookScript(hookFile) {
-  const workspace = resolve(process.cwd());
-  const installed = join(workspace, '.claude', 'hooks', hookFile);
-  const bundled = join(__dirname, 'hooks', hookFile);
-  return existsSync(installed) ? installed : existsSync(bundled) ? bundled : null;
-}
-
-function delegateToHook(hookFile) {
-  const script = resolveHookScript(hookFile);
-
-  if (!script) {
-    console.error(`  Hook not found: ${hookFile}`);
-    console.error(`  Run: ${cmd('npx dual-brain')} to install hooks first.`);
-    process.exit(1);
-  }
-
-  // Pass through all args after the subcommand
-  const extraArgs = process.argv.slice(3);
-  const { status } = spawnSync(process.execPath, [script, ...extraArgs], {
-    stdio: 'inherit',
-    cwd: resolve(process.cwd()),
-  });
-  process.exit(status || 0);
-}
-
-function delegateToHookWithArgs(hookFile, args) {
-  const script = resolveHookScript(hookFile);
-
-  if (!script) {
-    console.error(`  Hook not found: ${hookFile}`);
-    console.error(`  Run: ${cmd('npx dual-brain')} to install hooks first.`);
-    process.exit(1);
-  }
-
-  const { status } = spawnSync(process.execPath, [script, ...args], {
-    stdio: 'inherit',
-    cwd: resolve(process.cwd()),
-  });
-  process.exit(status || 0);
-}
-
-// ─── Main ───────────────────────────────────────────────────────────────────
-
-// ─── Replit-Tools Check ────────────────────────────────────────────────────
-
-async function checkReplitTools() {
-  // Only run this check when actually on Replit
-  if (!IS_REPLIT) return;
-
-  // Check if replit-tools is installed
-  const hasReplitTools = existsSync(resolve(process.cwd(), '.replit-tools'));
-  if (hasReplitTools) return;
-
-  const yesFlag = flag('--yes') || flag('-y');
-
-  console.log('');
-  console.log('  ━━━ replit-tools Required ━━━');
-  console.log('');
-  console.log('  dual-brain is built on data-tools/replit-tools by Steve Moraco.');
-  console.log('  replit-tools provides persistent auth, session management, and');
-  console.log('  container survival that dual-brain depends on.');
-  console.log('');
-
-  let install = yesFlag;
-
-  if (!install) {
-    process.stdout.write('  Install now? [Y/n] ');
-
-    if (process.stdin.isTTY) {
-      install = await new Promise((resolve) => {
-        process.stdin.setEncoding('utf8');
-        process.stdin.once('data', (chunk) => {
-          const answer = chunk.trim().toLowerCase();
-          // Default yes: empty input (just Enter) or explicit y/yes
-          resolve(answer === '' || answer === 'y' || answer === 'yes');
-        });
-        process.stdin.resume();
-      });
-      process.stdin.pause();
-    } else {
-      // Non-TTY: default to yes
-      console.log('');
-      install = true;
-    }
-  }
+  // Restore npm token if missing (for publish access)
+  restoreNpmToken();
 
-  console.log('');
+  let env = detectEnvironment();
+  const startupUpdateInfo = (subcommand === 'update' || dryRun || jsonOut)
+    ? null
+    : checkForUpdate(env.workspace);
 
-  if (install) {
-    console.log('  Installing replit-tools...');
+  if (
+    startupUpdateInfo?.updateAvailable &&
+    process.stdin.isTTY &&
+    process.stdout.isTTY &&
+    !process.env.CI
+  ) {
     console.log('');
-    const result = spawnSync('npx', ['-y', 'replit-tools'], { stdio: 'inherit', shell: true });
+    const shouldUpdate = await promptForUpdate(startupUpdateInfo);
     console.log('');
-    if (result.status !== 0) {
-      console.log('  ⚠  replit-tools install exited with a non-zero status.');
-      console.log('  Continuing with dual-brain install anyway.');
-      console.log('');
-    } else {
-      // Re-check that replit-tools is now present
-      if (existsSync(resolve(process.cwd(), '.replit-tools'))) {
-        console.log('  ✓ replit-tools installed successfully.');
-      } else {
-        console.log('  replit-tools may need a shell reload. Continuing with dual-brain install.');
+    if (shouldUpdate) {
+      env = healClaudeAuth(env);
+      env = healCodexAuth(env);
+      const updateMode = resolveMode(env);
+      const updateActions = performUpdate(env.workspace, env, updateMode);
+      printReport(env, updateMode, updateActions);
+      if (process.stdin.isTTY && process.stdout.isTTY && !process.env.CI) {
+        launchPanel();
       }
-      console.log('');
-    }
-  } else {
-    console.log('  dual-brain will work with reduced functionality. Some features');
-    console.log('  (persistent state, session resume, auth survival) require replit-tools.');
-    console.log('');
-  }
-}
-
-// ─── Auth Command ──────────────────────────────────────────────────────────
-
-async function cmdAuth() {
-  console.log('');
-  console.log(`  ${BRAND} — Auth Status`);
-  console.log('  ──────────────────────────────────────────────────');
-
-  const claude = getClaudeAuthStatus();
-  if (claude.valid) {
-    const email = claude.email ? ` — ${claude.email}` : '';
-    const sub = claude.subscription ? ` (${claude.subscription})` : '';
-    console.log(`  ✓ Claude: authenticated (${Math.round(claude.expiresInHours)}h remaining)${email}${sub}`);
-  } else if (claude.hasRefreshToken) {
-    console.log('  ⟳ Claude: expired — attempting refresh...');
-    const r = await refreshClaudeToken(claude.credPath);
-    console.log(r.success ? `  ✓ Claude: refreshed (${Math.round(r.expiresInHours)}h remaining)` : '  ✗ Claude: refresh failed — run: claude login');
-  } else {
-    console.log(`  ✗ Claude: ${claude.credPath ? 'expired' : 'not configured'} — run: claude login`);
-  }
-
-  const codex = getCodexAuthStatus();
-  if (codex.valid) {
-    const email = codex.email ? ` — ${codex.email}` : '';
-    console.log(`  ✓ Codex:  authenticated (${Math.round(codex.expiresInHours)}h remaining)${email}`);
-  } else if (codex.hasRefreshToken) {
-    console.log('  ⟳ Codex:  expired — attempting refresh...');
-    const r = await refreshCodexToken();
-    console.log(r.success ? `  ✓ Codex:  refreshed (${Math.round(r.expiresInHours)}h remaining)` : '  ✗ Codex:  refresh failed — run: codex login');
-  } else {
-    console.log('  ✗ Codex:  not configured — run: codex login');
-    console.log('           (GPT lane will be disabled)');
-  }
-
-  if (IS_REPLIT) {
-    console.log('');
-    console.log('  Replit tip: If login shows localhost errors, use browser-based auth');
-    console.log('  or run the login command from a local machine and copy credentials.');
-  }
-  console.log('');
-}
-
-// ─── Preflight Auth ────────────────────────────────────────────────────────
-
-async function preflightAuth() {
-  const claude = getClaudeAuthStatus();
-  const codex = getCodexAuthStatus();
-  let claudeOk = claude.valid;
-  let codexOk = codex.valid;
-
-  if (!claudeOk && claude.hasRefreshToken) {
-    const r = await refreshClaudeToken(claude.credPath);
-    claudeOk = r.success;
-    if (r.success) console.log(`  ⟳ Claude auth refreshed (${Math.round(r.expiresInHours)}h)`);
-  }
-  if (!codexOk && codex.hasRefreshToken) {
-    const r = await refreshCodexToken();
-    codexOk = r.success;
-    if (r.success) console.log(`  ⟳ Codex auth refreshed (${Math.round(r.expiresInHours)}h)`);
-  }
-
-  if (!claudeOk) {
-    console.log('');
-    console.log('  ✗ Claude auth required. Run: claude login');
-    if (IS_REPLIT) console.log('    (Use browser flow — localhost callbacks may not work)');
-    console.log('');
-    return false;
-  }
-  if (!codexOk) console.log('  ⚠ Codex not authenticated — GPT lane disabled (Claude-only mode)');
-  return true;
-}
-
-// ─── Session Wizard ────────────────────────────────────────────────────────
-
-function recommendModel() {
-  const claude = getClaudeAuthStatus();
-  const codex = getCodexAuthStatus();
-  if (claude.subscription === 'max' && codex.valid) return { model: 'sonnet', reason: 'Both $100 subs — sonnet for chat, opus auto-escalates for thinking' };
-  if (claude.subscription === 'max') return { model: 'sonnet', reason: '$100 Claude Max — sonnet balances speed + quality' };
-  if (claude.subscription === 'pro') return { model: 'haiku', reason: '$20 Claude Pro — haiku conserves limited credits' };
-  return { model: 'sonnet', reason: 'Default — good balance of speed and capability' };
-}
-
-async function askLine(prompt) {
-  if (!process.stdin.isTTY || yesFlag || process.env.CI) return '';
-  process.stdout.write(prompt);
-  const answer = await new Promise(resolve => {
-    process.stdin.setEncoding('utf8');
-    process.stdin.once('data', chunk => resolve(chunk.trim().toLowerCase()));
-    process.stdin.resume();
-  });
-  process.stdin.pause();
-  return answer;
-}
-
-async function runSessionWizard(workspace) {
-  const rec = recommendModel();
-  const claude = getClaudeAuthStatus();
-  const codex = getCodexAuthStatus();
-
-  console.log('');
-  console.log(`  ${BRAND}`);
-  console.log(`  ${BRAND_SUBTITLE}`);
-  console.log('');
-
-  const parts = [];
-  if (claude.subscription) parts.push(`Claude ${claude.subscription}`);
-  if (codex.valid) parts.push('Codex Pro');
-  if (parts.length) {
-    console.log(`  Detected: ${parts.join(' + ')}`);
-    console.log(`  Recommendation: ${rec.reason}`);
-    console.log('');
-  }
-
-  console.log('  Head session model:');
-  console.log('    [s] Sonnet — fast, cost-effective, great for most work');
-  console.log('    [o] Opus  — slower, smarter, best for complex architecture');
-  console.log('    [h] Haiku — fastest, cheapest, good for simple tasks');
-  const modelKey = await askLine(`  Choice [${rec.model === 'haiku' ? 'h' : 's'}]: `);
-  let model = rec.model === 'haiku' ? 'haiku' : 'sonnet';
-  if (modelKey === 'o' || modelKey === 'opus') model = 'opus';
-  else if (modelKey === 'h' || modelKey === 'haiku') model = 'haiku';
-  else if (modelKey === 's' || modelKey === 'sonnet') model = 'sonnet';
-
-  if (model === 'opus' && process.stdin.isTTY) {
-    console.log('  ⚠  Opus uses ~5x more credits than Sonnet.');
-    const confirm = await askLine('  Continue with Opus? [y/N] ');
-    if (confirm !== 'y' && confirm !== 'yes') { model = 'sonnet'; console.log('  Switched to Sonnet.'); }
-  }
-
-  console.log('');
-  console.log('  Effort level:');
-  console.log('    [l] Low    — faster responses, less thorough');
-  console.log('    [m] Medium — balanced (default)');
-  console.log('    [h] High   — thorough, slower, more expensive');
-  const effortKey = await askLine('  Choice [m]: ');
-  let effort = 'medium';
-  if (effortKey === 'l' || effortKey === 'low') effort = 'low';
-  else if (effortKey === 'h' || effortKey === 'high') effort = 'high';
-
-  const prefs = { head_model: model, effort, created_at: new Date().toISOString(), updated_at: new Date().toISOString() };
-  saveSessionPrefs(workspace, prefs);
-  console.log('');
-  console.log(`  Saved: ${model} / ${effort} effort`);
-  console.log('  Change anytime: npx dual-brain start --model opus --effort high');
-  return prefs;
-}
-
-// ─── Session Launcher ──────────────────────────────────────────────────────
-
-function launchClaudeSession(workspace, prefs) {
-  const model = prefs.head_model || 'sonnet';
-  const args = [];
-  const helpOut = run('claude', ['--help']);
-  const helpText = (helpOut.stdout || '') + (helpOut.stderr || '');
-  if (helpText.includes('--model')) args.push('--model', model);
-  if (helpText.includes('--resume') || helpText.includes('-c')) args.push('-c');
-
-  console.log('');
-  console.log(`  Launching ${model} session...`);
-  console.log('  (Work agents auto-route: haiku/sonnet/opus by task tier)');
-  console.log('');
-
-  const result = spawnSync('claude', args, {
-    stdio: 'inherit',
-    cwd: workspace,
-    env: { ...process.env, DUAL_BRAIN_HEAD_MODEL: model, DUAL_BRAIN_HEAD_EFFORT: prefs.effort || 'medium', DUAL_BRAIN_WORKSPACE: workspace },
-  });
-  process.exit(result.status ?? 0);
-}
-
-// ─── Ensure Setup + Launch ─────────────────────────────────────────────────
-
-async function ensureAndLaunch() {
-  const workspace = resolve(process.cwd());
-  if (!dryRun && !jsonOut) await checkReplitTools();
-
-  const alreadySetUp = existsSync(join(workspace, '.claude', 'hooks'))
-    || existsSync(join(workspace, '.claude', 'settings.json'));
-  if (!alreadySetUp || force) {
-    const env = detectEnvironment();
-    const mode = resolveMode(env);
-    install(env.workspace, env, mode);
-  }
-
-  const authOk = await preflightAuth();
-  if (!authOk) { console.log('  Fix auth first, then run: npx dual-brain'); process.exit(1); }
-
-  const cliModel = argv.find((a, i) => argv[i - 1] === '--model');
-  const cliEffort = argv.find((a, i) => argv[i - 1] === '--effort');
-  let prefs = loadSessionPrefs(workspace);
-
-  if (!prefs.created_at && !noLaunch) prefs = await runSessionWizard(workspace);
-  if (cliModel) prefs.head_model = cliModel;
-  if (cliEffort) prefs.effort = cliEffort;
-
-  if (noLaunch) { printQuickStart(); return; }
-  launchClaudeSession(workspace, prefs);
-}
-
-// ─── Doctor with Auth ──────────────────────────────────────────────────────
-
-async function cmdDoctorWithAuth() {
-  cmdDoctor();
-  console.log('  Auth Status:');
-  const claude = getClaudeAuthStatus();
-  if (claude.valid) {
-    const email = claude.email ? ` — ${claude.email}` : '';
-    const sub = claude.subscription ? ` (${claude.subscription})` : '';
-    console.log(`    ✓ Claude: ${Math.round(claude.expiresInHours)}h remaining${email}${sub}`);
-  } else {
-    console.log('    ✗ Claude: not authenticated — run: npx dual-brain auth');
-  }
-  const codex = getCodexAuthStatus();
-  if (codex.valid) {
-    const email = codex.email ? ` — ${codex.email}` : '';
-    console.log(`    ✓ Codex:  ${Math.round(codex.expiresInHours)}h remaining${email}`);
-  } else {
-    console.log('    ✗ Codex:  not authenticated — run: npx dual-brain auth');
-  }
-  console.log('');
-}
-
-// ─── Main ───────────────────────────────────────────────────────────────────
-
-async function main() {
-  if (flag('--uninstall')) { cmdUninstall(); return; }
-
-  if (subcommand === 'status') {
-    launchPanel();
-    return;
-  }
-  if (subcommand === 'mode')    { cmdMode();    return; }
-  if (subcommand === 'budget')  { cmdBudget();  return; }
-  if (subcommand === 'explain') { cmdExplain(); return; }
-  if (subcommand === 'doctor')  { await cmdDoctorWithAuth(); return; }
-  if (subcommand === 'reset')   { cmdReset();   return; }
-  if (subcommand === 'repair')  { cmdRepair();  return; }
-  if (subcommand === 'auth')    { await cmdAuth(); return; }
-  if (subcommand === 'start' || subcommand === 'chat') {
-    await ensureAndLaunch(); return;
-  }
-
-  // agent <template> [flags] → agent-templates.mjs --run <template> [flags]
-  if (subcommand === 'agent') {
-    const templateName = positional[1];
-    if (!templateName) {
-      // No template name — fall through to list
-      delegateToHookWithArgs('agent-templates.mjs', ['--list']);
       return;
     }
-    const extraFlags = process.argv.slice(4); // skip node, install.mjs, 'agent', <template>
-    delegateToHookWithArgs('agent-templates.mjs', ['--run', templateName, ...extraFlags]);
-    return;
   }
 
-  // agents → agent-templates.mjs --list
-  if (subcommand === 'agents') {
-    delegateToHookWithArgs('agent-templates.mjs', ['--list']);
-    return;
-  }
+  // Auth self-healing: try to fix expired/missing auth silently
+  env = healClaudeAuth(env);
+  env = healCodexAuth(env);
 
-  // chain <name> [flags] → agent-chains.mjs --run <name> [flags]
-  if (subcommand === 'chain') {
-    const chainName = positional[1];
-    if (!chainName) {
-      // No chain name given — fall through to list
-      delegateToHookWithArgs('agent-chains.mjs', ['--list']);
-      return;
-    }
-    const extraFlags = process.argv.slice(4); // skip node, install.mjs, 'chain', <name>
-    delegateToHookWithArgs('agent-chains.mjs', ['--run', chainName, ...extraFlags]);
-    return;
-  }
-
-  // chains → agent-chains.mjs --list
-  if (subcommand === 'chains') {
-    delegateToHookWithArgs('agent-chains.mjs', ['--list']);
-    return;
+  // Interactive auth guidance if still not authed
+  if (!env.claude.authed || !env.codex.authed) {
+    env = await authGuidance(env);
   }
 
-  // ─── Ship Captain commands ─────────────────────────────────────────────────
-
-  // do "<goal>" → ship-captain.mjs --goal "<goal>" [remaining flags]
-  if (subcommand === 'do') {
-    const goal = positional[1] || '';
-    if (!goal) {
-      console.error('  Usage: npx dual-brain do "<goal>"');
-      process.exit(1);
-    }
-    // Collect remaining flags (everything after the goal string)
-    const extraFlags = process.argv.slice(4).filter(a => a.startsWith('-'));
-    delegateToHookWithArgs('ship-captain.mjs', ['--goal', goal, ...extraFlags]);
-    return;
-  }
-
-  // ship → ship-gate.mjs --ship [remaining flags]
-  if (subcommand === 'ship') {
-    const extraFlags = process.argv.slice(3).filter(a => a.startsWith('-'));
-    delegateToHookWithArgs('ship-gate.mjs', ['--ship', ...extraFlags]);
-    return;
-  }
-
-  // test-run → ship-gate.mjs --test-only
-  if (subcommand === 'test-run') {
-    const extraFlags = process.argv.slice(3).filter(a => a.startsWith('-'));
-    delegateToHookWithArgs('ship-gate.mjs', ['--test-only', ...extraFlags]);
-    return;
-  }
-
-  // diff → ship-gate.mjs --diff-only
-  if (subcommand === 'diff') {
-    delegateToHookWithArgs('ship-gate.mjs', ['--diff-only']);
-    return;
-  }
-
-  // runs → list recent Ship Captain runs from .claude/runs/
-  if (subcommand === 'runs') {
-    const workspace = resolve(process.cwd());
-    const runsDir = join(workspace, '.claude', 'runs');
-    if (!existsSync(runsDir)) {
-      console.log('');
-      console.log('  No Ship Captain runs found.');
-      console.log(`  Run: ${cmd('npx dual-brain do "<goal>"')} to start your first run.`);
-      console.log('');
-      return;
-    }
-    let files;
-    try {
-      files = readdirSync(runsDir).filter(f => f.endsWith('.json')).sort().reverse();
-    } catch {
-      files = [];
-    }
-    if (files.length === 0) {
-      console.log('');
-      console.log('  No run records found in .claude/runs/');
-      console.log('');
-      return;
-    }
-    const rows = [];
-    for (const f of files) {
-      try {
-        const rec = JSON.parse(readFileSync(join(runsDir, f), 'utf8'));
-        const id = rec.id || f.replace('.json', '');
-        const goal = (rec.goal || '').slice(0, 35);
-        const status = rec.status || '?';
-        const steps = Array.isArray(rec.steps) ? rec.steps.length : (rec.step_count || '?');
-        const dur = rec.duration_ms != null ? `${(rec.duration_ms / 1000).toFixed(1)}s` : rec.duration || '?';
-        const date = rec.started_at ? rec.started_at.slice(0, 16).replace('T', ' ') : (rec.date || '?');
-        rows.push({ id, goal, status, steps, dur, date });
-      } catch {}
-    }
-    if (rows.length === 0) {
-      console.log('  No readable run records.');
-      return;
-    }
-    const colW = { id: 14, goal: 37, status: 10, steps: 6, dur: 8, date: 16 };
-    const header = [
-      'ID'.padEnd(colW.id), 'GOAL'.padEnd(colW.goal), 'STATUS'.padEnd(colW.status),
-      'STEPS'.padStart(colW.steps), 'DUR'.padStart(colW.dur), 'DATE'.padEnd(colW.date),
-    ].join('  ');
-    console.log('');
-    console.log(`  Ship Captain Runs (${rows.length})`);
-    console.log('  ' + '─'.repeat(header.length));
-    console.log('  ' + header);
-    console.log('  ' + '─'.repeat(header.length));
-    for (const r of rows) {
-      const line = [
-        String(r.id).padEnd(colW.id), String(r.goal).padEnd(colW.goal),
-        String(r.status).padEnd(colW.status), String(r.steps).padStart(colW.steps),
-        String(r.dur).padStart(colW.dur), String(r.date).padEnd(colW.date),
-      ].join('  ');
-      console.log('  ' + line);
-    }
-    console.log('');
-    return;
-  }
-
-  // resume → find most recent incomplete/failed run, offer to re-execute from the failed step
-  if (subcommand === 'resume') {
-    const workspace = resolve(process.cwd());
-    const runsDir = join(workspace, '.claude', 'runs');
-    if (!existsSync(runsDir)) {
-      console.log('');
-      console.log("  No runs found. Start with: npx dual-brain do '<goal>'");
-      console.log('');
-      return;
-    }
-    let files;
-    try {
-      files = readdirSync(runsDir).filter(f => f.endsWith('.json')).sort().reverse();
-    } catch {
-      files = [];
-    }
-    if (files.length === 0) {
-      console.log('');
-      console.log("  No runs found. Start with: npx dual-brain do '<goal>'");
-      console.log('');
-      return;
-    }
-
-    // Load the most recent run record
-    let rec = null;
-    let recFile = null;
-    try {
-      recFile = files[0];
-      rec = JSON.parse(readFileSync(join(runsDir, recFile), 'utf8'));
-    } catch {}
-
-    if (!rec) {
-      console.log('');
-      console.log("  No runs found. Start with: npx dual-brain do '<goal>'");
-      console.log('');
-      return;
-    }
-
-    const INCOMPLETE_STATUSES = ['failed', 'error', 'partial', 'running', 'pending', 'incomplete', 'aborted'];
-    const steps = Array.isArray(rec.steps) ? rec.steps : [];
-    const isCompleted = (rec.status || '').toLowerCase() === 'completed';
-    const allDone = steps.length > 0 && steps.every(s =>
-      s.status === 'done' || s.status === 'complete' || s.status === 'skipped'
-    );
-
-    if (isCompleted && (allDone || steps.length === 0)) {
-      const goal = rec.goal || '(unknown)';
-      console.log('');
-      console.log('  Last run completed successfully.');
-      console.log(`  Start a new one with: npx dual-brain do '${goal}'`);
-      console.log('');
-      return;
-    }
-
-    // Run has failed/aborted/incomplete — print summary
-    const done = steps.filter(s => s.status === 'done' || s.status === 'complete').length;
-    const failedSteps = steps.filter(s => s.status === 'failed' || s.status === 'error');
-    const incompleteIdx = steps.findIndex(s =>
-      s.status !== 'done' && s.status !== 'complete' && s.status !== 'skipped'
-    );
-    const resumeFromIdx = incompleteIdx >= 0 ? incompleteIdx : steps.length;
-
-    console.log('');
-    console.log('  Last Run State');
-    console.log('  ' + '─'.repeat(50));
-    console.log(`  ID:       ${rec.id || recFile.replace('.json', '')}`);
-    console.log(`  Goal:     ${rec.goal || '(unknown)'}`);
-    console.log(`  Status:   ${rec.status || '(unknown)'}`);
-    if (steps.length > 0) {
-      console.log(`  Steps:    ${done}/${steps.length} done, ${failedSteps.length} failed`);
-      const failedStep = failedSteps[0];
-      if (failedStep) {
-        const fi = steps.indexOf(failedStep);
-        const fname = failedStep.task || failedStep.name || failedStep.label || `step ${fi}`;
-        console.log(`  Failed:   ${fname}`);
-        if (failedStep.error) console.log(`  Error:    ${failedStep.error}`);
-      }
-    }
-    if (rec.started_at) console.log(`  Started:  ${rec.started_at.slice(0, 16).replace('T', ' ')}`);
-    if (rec.error) console.log(`  Error:    ${rec.error}`);
-    console.log('');
-
-    const isResumable = INCOMPLETE_STATUSES.includes((rec.status || '').toLowerCase()) && rec.goal;
-
-    if (!isResumable) {
-      console.log("  Use npx dual-brain do '<goal>' to start fresh");
-      console.log('');
-      return;
-    }
-
-    const stepNum = resumeFromIdx + 1;
-    const totalSteps = steps.length || '?';
-    console.log(`  Resume from step ${stepNum}/${totalSteps}? [Y/n]`);
-
-    const yesFlag = flag('--yes') || flag('-y');
-
-    if (!yesFlag && process.stdin.isTTY) {
-      const { createInterface } = await import('readline');
-      const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const answer = await new Promise((res) => {
-        rl.question('  > ', (a) => { rl.close(); res(a.trim()); });
-      });
-      if (answer !== '' && !/^y(es)?$/i.test(answer)) {
-        console.log('');
-        console.log(`  Use npx dual-brain do '${rec.goal}' to start fresh`);
-        console.log('');
-        return;
-      }
-    }
-
-    // Reconstruct flags from stored options in the run record
-    const storedOpts = rec.options || {};
-
-    // Dynamically import and invoke ship-captain's executeShipCaptain
-    const captainPath = resolveHookScript('ship-captain.mjs');
-    if (!captainPath) {
-      console.error('  ship-captain.mjs not found. Run: npx dual-brain to reinstall hooks.');
-      process.exit(1);
-    }
-    const { executeShipCaptain } = await import(captainPath);
-    await executeShipCaptain(rec.goal, {
-      yes: yesFlag || storedOpts.yes || false,
-      yolo: storedOpts.yolo || false,
-      careful: storedOpts.careful || false,
-      noPr: storedOpts.noPr || false,
-      mode: storedOpts.mode || null,
-      resumeFrom: resumeFromIdx,
-      resumedFromId: rec.id,
-    });
-    return;
-  }
-
-  // Delegate hook-backed commands
-  if (subcommand && HOOK_COMMANDS[subcommand]) {
-    delegateToHook(HOOK_COMMANDS[subcommand]);
-    return;
-  }
-
-  // ── Bare invocation (no subcommand): setup if needed, then launch ──
-  if (!subcommand) {
-    await ensureAndLaunch();
-    return;
-  }
-
-  if (subcommand === 'setup') {
-    if (!dryRun && !jsonOut) await checkReplitTools();
-    const env = detectEnvironment();
-    const mode = resolveMode(env);
-    const needsGuidance = printGuidedAuth(env);
-    if (needsGuidance && process.stdin.isTTY && process.stdout.isTTY && !process.env.CI) {
-      await waitForAuth(env);
-      Object.assign(mode, resolveMode(env));
-    }
-    const actions = install(env.workspace, env, mode);
-    printReport(env, mode, actions);
-    printQuickStart();
-    return;
-  }
-
-  // ── replit-tools check — first thing before auth detection or install ──
-  if (!dryRun && !jsonOut) {
-    await checkReplitTools();
-  }
-
-  const env = detectEnvironment();
+  // Re-resolve mode after healing
   const mode = resolveMode(env);
 
   if (dryRun || jsonOut) {
@@ -2284,17 +1342,30 @@ async function main() {
     process.exit(0);
   }
 
-  // Guided auth: print instructions if a provider is missing/not authed
-  // and offer to wait (interactive only)
-  const needsGuidance = printGuidedAuth(env);
-  if (needsGuidance && process.stdin.isTTY && process.stdout.isTTY && !process.env.CI) {
-    await waitForAuth(env);
-    Object.assign(mode, resolveMode(env));
+  if (subcommand === 'update') {
+    const actions = performUpdate(env.workspace, env, mode);
+    printReport(env, mode, actions);
+    process.exit(0);
+  }
+
+  // Check for replit-tools on Replit
+  if (env.isReplit && !env.hasReplitTools) {
+    console.log('');
+    console.log('  ⚠️  replit-tools not found — recommended for Replit environments.');
+    console.log('  Dual-brain works best alongside replit-tools for persistent auth,');
+    console.log('  session management, and shell integration.');
+    console.log('');
+    console.log(`  Install: ${cmd('npx -y data-tools')}`);
+    console.log('');
   }
 
   const actions = install(env.workspace, env, mode);
   printReport(env, mode, actions);
-  printQuickStart();
+
+  // After install, launch the session manager (interactive TTY only)
+  if (process.stdin.isTTY && process.stdout.isTTY && !process.env.CI) {
+    launchPanel();
+  }
 }
 
 main();