leedab 0.5.3 → 0.6.1

package/bin/onboard-cofounder.sh

@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+#
+# onboard-cofounder.sh — one-shot setup for a new LeedAB-OS contributor.
+#
+# Walks through:
+#   1. Verify git identity + branch
+#   2. Install dependencies (root + apps/console)
+#   3. Install pre-commit secret scanner hook
+#   4. Generate LEEDAB_ADMIN_TOKEN + write apps/console/.env.local
+#   5. Run typecheck + unit tests
+#   6. Run secret scanner over the tree
+#   7. Print next steps (start dev server, read MUIEZ-ONBOARDING.md / HANDOFF.md)
+#
+# Idempotent: safe to re-run. Won't overwrite an existing .env.local
+# without confirmation. Doesn't touch git config (cofounder sets their
+# own identity). Doesn't push or commit anything.
+#
+# Usage:
+#   bash bin/onboard-cofounder.sh
+
+set -euo pipefail
+
+# ── Colors ──────────────────────────────────────────────────────────────
+if [ -t 1 ]; then
+  GREEN='\033[0;32m'
+  YELLOW='\033[1;33m'
+  RED='\033[0;31m'
+  BLUE='\033[0;34m'
+  BOLD='\033[1m'
+  RESET='\033[0m'
+else
+  GREEN=''; YELLOW=''; RED=''; BLUE=''; BOLD=''; RESET=''
+fi
+
+step() { echo -e "\n${BLUE}${BOLD}── $1 ──${RESET}"; }
+ok()   { echo -e "  ${GREEN}✓${RESET} $1"; }
+warn() { echo -e "  ${YELLOW}⚠${RESET} $1"; }
+fail() { echo -e "  ${RED}✗${RESET} $1"; exit 1; }
+info() { echo -e "  $1"; }
+
+# ── Locate the repo root ───────────────────────────────────────────────
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+if [ ! -f package.json ] || [ ! -d apps/console ]; then
+  fail "This doesn't look like the LeedAB-OS root. Run from the repo root."
+fi
+
+# Track verification state — final status reflects whether anything failed.
+VERIFICATION_OK=1
+
+echo -e "${BOLD}LeedAB-OS cofounder onboarding${RESET}"
+echo -e "Working from: ${BLUE}$ROOT${RESET}"
+echo
+
+# ── Step 0: Preflight — required tools ─────────────────────────────────
+step "0. Preflight tool check"
+for tool in git node npm openssl; do
+  if ! command -v "$tool" > /dev/null 2>&1; then
+    fail "$tool not found in PATH — install it before re-running"
+  fi
+done
+# Node version: root package.json requires >=22.
+node_major=$(node -v | sed 's/^v\([0-9]*\).*/\1/')
+if [ -z "$node_major" ] || [ "$node_major" -lt 22 ]; then
+  fail "node $(node -v) found, but root package.json requires node >=22 — install Node 22+ and re-run"
+fi
+ok "git $(git --version | awk '{print $3}') · node $(node -v) · npm $(npm -v) · openssl present"
+
+# ── Step 1: Git identity + branch ───────────────────────────────────────
+step "1. Git identity + branch"
+git_name=$(git config user.name 2>/dev/null || echo "")
+git_email=$(git config user.email 2>/dev/null || echo "")
+git_branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+
+if [ -z "$git_name" ] || [ -z "$git_email" ]; then
+  warn "git user.name or user.email is unset"
+  info "Set them now (these stamp every commit):"
+  info "  git config user.name \"Your Real Name\""
+  info "  git config user.email \"you@leedab.example\""
+else
+  ok "git identity: $git_name <$git_email>"
+fi
+ok "branch: $git_branch"
+
+# ── Step 2: Dependencies (npm ci — strict, lockfile-driven) ────────────
+step "2. Install dependencies (root + apps/console)"
+info "Note: uses npm ci (strict lockfile install) so node_modules matches the committed lockfile exactly. Network required."
+if [ -d node_modules ]; then
+  ok "root node_modules exists (skipping — delete + re-run to refresh)"
+else
+  info "running 'npm ci' at root..."
+  if npm ci --silent; then
+    ok "root deps installed"
+  else
+    VERIFICATION_OK=0
+    warn "root npm ci FAILED — check network + lockfile drift"
+  fi
+fi
+
+if [ -d apps/console/node_modules ]; then
+  ok "apps/console node_modules exists"
+else
+  info "running 'npm ci' in apps/console/..."
+  if (cd apps/console && npm ci --silent); then
+    ok "apps/console deps installed"
+  else
+    VERIFICATION_OK=0
+    warn "apps/console npm ci FAILED — check network + lockfile drift"
+  fi
+fi
+
+# ── Step 2.5: Build dist/ (required for bin/leedab.js) ──────────────────
+step "2.5 Build dist/ (compile TS to JS for the leedab CLI)"
+info "running 'npm run build' at root (tsc + copy-templates)..."
+if npm run build > /dev/null 2>&1; then
+  if [ -f dist/gateway.js ] && [ -f dist/openclaw.js ]; then
+    ok "dist/ built — bin/leedab.js will resolve its imports"
+  else
+    VERIFICATION_OK=0
+    warn "npm run build succeeded but dist/gateway.js or dist/openclaw.js missing — check tsconfig paths"
+  fi
+else
+  VERIFICATION_OK=0
+  warn "npm run build FAILED — bin/leedab.js will die on first run with ERR_MODULE_NOT_FOUND"
+fi
+
+# ── Step 3: Pre-commit hook ─────────────────────────────────────────────
+step "3. Install pre-commit secret-scanner hook"
+info "Side effect: sets repo-local 'core.hooksPath' → .githooks/ (does not touch global git config)."
+if [ -f .githooks/install.sh ]; then
+  if bash .githooks/install.sh; then
+    ok "pre-commit hook installed"
+  else
+    warn ".githooks/install.sh exited non-zero — run manually"
+  fi
+else
+  warn ".githooks/install.sh not found — secret-scanner won't run on commit"
+fi
+
+# ── Step 4: LEEDAB_ADMIN_TOKEN + .env.local ────────────────────────────
+step "4. Generate LEEDAB_ADMIN_TOKEN + write apps/console/.env.local"
+ENV_FILE="apps/console/.env.local"
+
+if [ -f "$ENV_FILE" ]; then
+  if grep -q '^LEEDAB_ADMIN_TOKEN=' "$ENV_FILE"; then
+    ok "LEEDAB_ADMIN_TOKEN already set in $ENV_FILE (file untouched)"
+    info "to rotate: openssl rand -hex 32, replace LEEDAB_ADMIN_TOKEN= line manually, restart console"
+  else
+    warn "$ENV_FILE exists but missing LEEDAB_ADMIN_TOKEN"
+    if [ -t 0 ]; then
+      printf "  Append LEEDAB_ADMIN_TOKEN to existing $ENV_FILE? [y/N] "
+      read -r confirm
+    else
+      confirm="n"
+      info "(non-interactive run — refusing to modify existing $ENV_FILE; append the line manually)"
+    fi
+    if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then
+      TOKEN=$(openssl rand -hex 32)
+      {
+        echo ""
+        echo "# Added by bin/onboard-cofounder.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+        echo "LEEDAB_ADMIN_TOKEN=$TOKEN"
+      } >> "$ENV_FILE"
+      unset TOKEN
+      ok "appended LEEDAB_ADMIN_TOKEN to existing $ENV_FILE (perms unchanged)"
+    fi
+  fi
+else
+  TOKEN=$(openssl rand -hex 32)
+  cat > "$ENV_FILE" <<EOF
+# Local console env. Gitignored via .env.*
+# Generated by bin/onboard-cofounder.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
+# Required for license / vault / team / providers / channels / contacts /
+# routing / workspace / preferences mutation routes.
+# To rotate: openssl rand -hex 32, replace below, restart console.
+LEEDAB_ADMIN_TOKEN=$TOKEN
+
+# Uncomment + fill these as needed (see apps/console/.env.example):
+# ANTHROPIC_API_KEY=
+# LEEDAB_LICENSE_PUBKEY=
+# LEEDAB_VAULT_KEY=
+# LEEDAB_PROSPECT_REPO_PATH=
+EOF
+  chmod 600 "$ENV_FILE"
+  unset TOKEN
+  ok "created $ENV_FILE with LEEDAB_ADMIN_TOKEN, chmod 600 (newly-created file only)"
+fi
+
+# ── Step 5: Typecheck + unit tests ──────────────────────────────────────
+step "5. Typecheck + unit tests"
+TEST_LOG=$(mktemp -t leedab-onboard-tests.XXXXXX)
+
+info "running 'npx tsc --noEmit' in apps/console..."
+if (cd apps/console && npx tsc --noEmit > /dev/null 2>&1); then
+  ok "typecheck clean"
+else
+  VERIFICATION_OK=0
+  warn "typecheck FAILED — run 'cd apps/console && npx tsc --noEmit' to see errors"
+fi
+
+info "running 'npm run test:unit' in apps/console..."
+if (cd apps/console && npm run test:unit > "$TEST_LOG" 2>&1); then
+  TEST_COUNT=$(grep -E '^ℹ tests' "$TEST_LOG" | head -1 | awk '{print $3}')
+  ok "unit tests pass (${TEST_COUNT:-?})"
+else
+  VERIFICATION_OK=0
+  warn "unit tests FAILED — log saved at $TEST_LOG"
+fi
+
+# ── Step 6: Secret scanner ──────────────────────────────────────────────
+step "6. Full-tree secret scanner"
+if [ -f bin/scan-secrets-tree.sh ]; then
+  if bash bin/scan-secrets-tree.sh > /dev/null 2>&1; then
+    ok "no secrets found in tree"
+  else
+    VERIFICATION_OK=0
+    warn "secret scanner found something — run 'bash bin/scan-secrets-tree.sh' to see"
+  fi
+else
+  warn "bin/scan-secrets-tree.sh not found"
+fi
+
+# ── Step 7: Next steps ──────────────────────────────────────────────────
+step "7. Next steps"
+cat <<EOF
+
+  ${BOLD}You're set up.${RESET} What to do next:
+
+  1. ${BOLD}Read MUIEZ-ONBOARDING.md${RESET} (~10 min) — the 30-min orientation
+  2. ${BOLD}Read HANDOFF.md${RESET} (~15 min) — the post-codex security branch + Tarheel deploy plan
+  3. ${BOLD}Read CONTRIBUTING.md${RESET} (~5 min) — standard dev workflows
+  4. ${BOLD}Open the LeedAB Brain vault${RESET} in Obsidian, read .claude/WELCOME.md (~5 min)
+  5. ${BOLD}Start the dev server:${RESET}
+       cd apps/console && npm run dev
+     Then open http://127.0.0.1:3100 — the wizard prompts you for the
+     admin token (already in your .env.local) + license key.
+
+  ${BOLD}Repos to clone separately${RESET} (Mina sends invites):
+  • LeedAB Brain (Obsidian vault) — Mina + Muiez canonical, Sync-distributed
+  • LeedAB-OS — you're already here
+
+  ${BOLD}Standup command${RESET} (in the LeedAB Brain dir):
+       /leedab-standup    # rolling 24h activity across all repos
+
+  ${BOLD}Token references${RESET}:
+  • Your admin token lives in apps/console/.env.local (chmod 600)
+  • To grep: grep '^LEEDAB_ADMIN_TOKEN=' apps/console/.env.local | cut -d= -f2-
+  • Vault reference: LeedAB Brain/_secrets/leedab-os-admin-token.md
+
+  ${BOLD}If anything feels broken${RESET}: Telegram Mina. Don't push uncertain
+  changes — every shared-repo push warrants a heads-up per team rules.
+
+EOF
+
+if [ "$VERIFICATION_OK" -eq 1 ]; then
+  ok "onboarding complete — verification clean"
+else
+  echo
+  warn "onboarding finished with verification failures (see warnings above)"
+  warn "fix those before opening a PR; re-run this script to re-verify"
+  exit 1
+fi

package/bin/onboard-customer.sh

@@ -0,0 +1,303 @@
+#!/usr/bin/env bash
+#
+# bin/onboard-customer.sh — provision a fresh customer brain + manifest.
+#
+# Takes a slug + industry + display name and produces:
+#   1. clients/<slug>/manifest.json    (LeedAB-OS-side, in this repo)
+#   2. context/customers/<slug>/playbook.md (LeedAB-OS-side)
+#   3. ~/leedab-brains/<slug>/         (per-customer Obsidian vault, git-init'd)
+#      — instantiated from _schema/customer-brain-template/
+#
+# Usage:
+#   bin/onboard-customer.sh <slug> <industry> "<display name>" [tier]
+#
+# Examples:
+#   bin/onboard-customer.sh acme-coffee hospitality "Acme Coffee Roasters"
+#   bin/onboard-customer.sh wattle-legal professional "Wattle Legal" starter
+#
+# Industry → default agent roster mapping mirrors apps/console/lib/solutions/
+# parse-brief.ts. New industries default to a generic SMB roster.
+#
+# Per-target idempotency: re-runs create only missing artefacts. Each of
+# the three targets (manifest / playbook / brain) is checked independently;
+# anything that already exists is skipped with a logged note. --force
+# overwrites everything regardless. --dry prints the plan without writing.
+
+set -euo pipefail
+
+# ─── Args ────────────────────────────────────────────────────────────────────
+DRY=0
+FORCE=0
+ARGS=()
+for a in "$@"; do
+  case "$a" in
+    --dry)   DRY=1 ;;
+    --force) FORCE=1 ;;
+    *)       ARGS+=("$a") ;;
+  esac
+done
+
+if [ "${#ARGS[@]}" -lt 3 ]; then
+  echo "Usage: $0 <slug> <industry> \"<display name>\" [tier] [--dry] [--force]" >&2
+  echo "" >&2
+  echo "Industries with defaults: logistics, hospitality, retail, trades, professional" >&2
+  echo "Tier: leave blank for prospect (license_key=null), or set 'logistics-pro' / 'starter' / 'founder'" >&2
+  exit 1
+fi
+
+SLUG="${ARGS[0]}"
+INDUSTRY="${ARGS[1]}"
+DISPLAY_NAME="${ARGS[2]}"
+TIER="${ARGS[3]:-null}"
+
+# ─── Validate slug ───────────────────────────────────────────────────────────
+if ! [[ "$SLUG" =~ ^[a-z0-9]([a-z0-9-]{0,58}[a-z0-9])?$ ]]; then
+  echo "ERROR: slug must be lowercase alphanumeric + hyphens, 1-60 chars, no leading/trailing hyphen" >&2
+  exit 2
+fi
+
+# ─── Locate repo root ────────────────────────────────────────────────────────
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
+
+if [ ! -d "$REPO_ROOT/_schema/customer-brain-template" ]; then
+  echo "ERROR: _schema/customer-brain-template not found at $REPO_ROOT/_schema" >&2
+  exit 3
+fi
+
+# ─── Resolve agent roster from industry ──────────────────────────────────────
+case "$INDUSTRY" in
+  logistics)
+    DEFAULT_TIER="logistics-pro"
+    AGENTS='["coo","concierge","ops","procurement","cx","finance","sales"]'
+    ;;
+  hospitality)
+    DEFAULT_TIER="null"
+    AGENTS='["coo","concierge","cx","marketing","content","campaigns","people","ops","finance"]'
+    ;;
+  retail)
+    DEFAULT_TIER="null"
+    AGENTS='["coo","concierge","cx","marketing","campaigns","ops","procurement","finance"]'
+    ;;
+  trades|construction)
+    DEFAULT_TIER="null"
+    AGENTS='["coo","concierge","sales","finance","ops","cx","procurement"]'
+    ;;
+  professional)
+    DEFAULT_TIER="null"
+    AGENTS='["coo","concierge","sales","marketing","content","email","finance","people","compliance","legal","cx"]'
+    ;;
+  *)
+    DEFAULT_TIER="null"
+    AGENTS='["coo","concierge","ops","cx","sales","marketing","finance"]'
+    ;;
+esac
+
+# Honour explicit tier arg over the default.
+if [ "$TIER" = "null" ]; then
+  TIER="$DEFAULT_TIER"
+fi
+
+# ─── Paths ───────────────────────────────────────────────────────────────────
+MANIFEST_DIR="$REPO_ROOT/clients/$SLUG"
+MANIFEST_FILE="$MANIFEST_DIR/manifest.json"
+CONTEXT_DIR="$REPO_ROOT/context/customers/$SLUG"
+PLAYBOOK_FILE="$CONTEXT_DIR/playbook.md"
+BRAIN_DIR="${LEEDAB_BRAINS_ROOT:-$HOME/leedab-brains}/$SLUG"
+
+DATE_ISO=$(date +%Y-%m-%d)
+
+# ─── Plan output (always shown, dry or not) ──────────────────────────────────
+echo "──────────────────────────────────────────────"
+echo " ONBOARD CUSTOMER PLAN"
+echo "──────────────────────────────────────────────"
+printf "  slug:          %s\n" "$SLUG"
+printf "  display_name:  %s\n" "$DISPLAY_NAME"
+printf "  industry:      %s\n" "$INDUSTRY"
+printf "  tier:          %s\n" "$TIER"
+printf "  agents:        %s\n" "$AGENTS"
+echo ""
+echo " Will write:"
+echo "   $MANIFEST_FILE"
+echo "   $PLAYBOOK_FILE"
+echo "   $BRAIN_DIR/  (full schema)"
+echo ""
+
+if [ "$DRY" -eq 1 ]; then
+  echo "(dry run — no files written)"
+  exit 0
+fi
+
+# ─── Per-target collision policy ─────────────────────────────────────────────
+# Each target is independently checked. Existing targets are skipped with
+# a logged note unless --force is passed. This lets the script repair a
+# partial provisioning (e.g. brain created but playbook missing) without
+# clobbering already-curated artefacts.
+SKIP_MANIFEST=0
+SKIP_PLAYBOOK=0
+SKIP_BRAIN=0
+if [ "$FORCE" -eq 0 ]; then
+  [ -f "$MANIFEST_FILE" ] && SKIP_MANIFEST=1
+  [ -f "$PLAYBOOK_FILE" ] && SKIP_PLAYBOOK=1
+  [ -d "$BRAIN_DIR" ]     && SKIP_BRAIN=1
+fi
+
+if [ "$SKIP_MANIFEST" -eq 1 ] && [ "$SKIP_PLAYBOOK" -eq 1 ] && [ "$SKIP_BRAIN" -eq 1 ]; then
+  echo "All three targets already exist — nothing to do."
+  echo "  manifest: $MANIFEST_FILE"
+  echo "  playbook: $PLAYBOOK_FILE"
+  echo "  brain:    $BRAIN_DIR"
+  echo ""
+  echo "Pass --force to overwrite, or remove individual targets to re-provision them."
+  exit 0
+fi
+
+# ─── Write manifest (skip if exists, unless --force) ─────────────────────────
+if [ "$SKIP_MANIFEST" -eq 1 ]; then
+  echo "↷ skipped $MANIFEST_FILE (already exists — pass --force to overwrite)"
+else
+  mkdir -p "$MANIFEST_DIR"
+  TIER_JSON='null'
+  if [ "$TIER" != "null" ]; then
+    TIER_JSON="\"$TIER\""
+  fi
+  cat > "$MANIFEST_FILE" <<JSON
+{
+  "schema_version": "1.0",
+  "client_id": "$SLUG",
+  "display_name": "$DISPLAY_NAME",
+  "industry": "$INDUSTRY",
+  "tier": $TIER_JSON,
+  "license_key": null,
+  "status": "prospect",
+  "agents": $AGENTS,
+  "overrides": {},
+  "playbook_files": ["context/customers/$SLUG/playbook.md"],
+  "template_ids": null
+}
+JSON
+  echo "✓ wrote $MANIFEST_FILE"
+fi
+
+# ─── Write playbook (skip if exists, unless --force) ─────────────────────────
+if [ "$SKIP_PLAYBOOK" -eq 1 ]; then
+  echo "↷ skipped $PLAYBOOK_FILE (already exists — pass --force to overwrite)"
+else
+  mkdir -p "$CONTEXT_DIR"
+  cat > "$PLAYBOOK_FILE" <<MD
+# $DISPLAY_NAME — customer playbook
+
+> Provisioned $DATE_ISO via \`bin/onboard-customer.sh\`. Industry: **$INDUSTRY**. Tier: **$TIER**.
+
+## Profile
+
+- **Industry:** $INDUSTRY
+- **Stage:** prospect (license_key null)
+- **Brain:** \`~/leedab-brains/$SLUG/\`
+
+## Style + tone
+
+(replace this stub — what does $DISPLAY_NAME's voice sound like?)
+
+## Operational hooks
+
+(replace this stub — what's their stack, who's the primary contact, what triggers escalation?)
+
+## Champion
+
+The Champion at $DISPLAY_NAME hasn't been designated yet. Set this during the kickoff call and update \`00_Org/champion-profile.md\` in the brain.
+MD
+  echo "✓ wrote $PLAYBOOK_FILE"
+fi
+
+# ─── Provision brain (skip if exists, unless --force) ────────────────────────
+TEMPLATE="$REPO_ROOT/_schema/customer-brain-template"
+if [ "$SKIP_BRAIN" -eq 1 ]; then
+  echo "↷ skipped $BRAIN_DIR (already exists — pass --force to overwrite)"
+else
+  if [ "$FORCE" -eq 1 ] && [ -d "$BRAIN_DIR" ]; then
+    rm -rf "$BRAIN_DIR"
+  fi
+  mkdir -p "$(dirname "$BRAIN_DIR")"
+  cp -R "$TEMPLATE" "$BRAIN_DIR"
+
+# Substitute placeholders in the brain
+# Use perl for cross-platform sed-with-binary-safety. (BSD sed in-place
+# differs from GNU sed; perl is consistent.)
+  perl -pi -e "s/\\{\\{DISPLAY_NAME\\}\\}/$DISPLAY_NAME/g" \
+    "$BRAIN_DIR/CLAUDE.md" "$BRAIN_DIR/README.md" "$BRAIN_DIR/.gitignore" \
+    "$BRAIN_DIR/_secrets/README.md" "$BRAIN_DIR/_inbox/champion-day-0.md" \
+    "$BRAIN_DIR/01_Customers/engagement.md"
+  perl -pi -e "s/\\{\\{CLIENT_ID\\}\\}/$SLUG/g" \
+    "$BRAIN_DIR/CLAUDE.md" "$BRAIN_DIR/README.md" "$BRAIN_DIR/_inbox/champion-day-0.md" \
+    "$BRAIN_DIR/01_Customers/engagement.md"
+  perl -pi -e "s/\\{\\{INDUSTRY\\}\\}/$INDUSTRY/g" \
+    "$BRAIN_DIR/CLAUDE.md" "$BRAIN_DIR/README.md" \
+    "$BRAIN_DIR/01_Customers/engagement.md"
+  perl -pi -e "s/\\{\\{TIER\\}\\}/$TIER/g" \
+    "$BRAIN_DIR/CLAUDE.md" "$BRAIN_DIR/README.md" "$BRAIN_DIR/_inbox/champion-day-0.md"
+  perl -pi -e "s/\\{\\{PROVISIONED_DATE\\}\\}/$DATE_ISO/g" \
+    "$BRAIN_DIR/CLAUDE.md" "$BRAIN_DIR/README.md" "$BRAIN_DIR/_inbox/champion-day-0.md" \
+    "$BRAIN_DIR/01_Customers/engagement.md"
+
+  echo "✓ provisioned brain at $BRAIN_DIR"
+
+  # ─── Initialise git in the brain ───────────────────────────────────────────
+  (
+    cd "$BRAIN_DIR"
+    git init -q
+    git add -A
+    git commit -q -m "init: $DISPLAY_NAME brain (provisioned $DATE_ISO)" 2>/dev/null || true
+  )
+  echo "✓ git init'd brain at $BRAIN_DIR"
+fi
+
+# ─── Seed industry-shaped workflows into _Workflows/ ─────────────────────────
+# Two paths:
+#   1. Dev server reachable: use the HTTP /api/templates/regenerate endpoint
+#      (also exercises the route + cache layers, useful for verification).
+#   2. Dev server not up: fall back to the offline CLI seeder
+#      (bin/seed-workflows.mjs) so provisioning still seeds workflows
+#      day-1. No HTTP, no Next.js server needed.
+if curl -sf -m 2 "http://127.0.0.1:3200/api/usage" > /dev/null 2>&1; then
+  SEED_RES=$(curl -sf -X POST -m 30 "http://127.0.0.1:3200/api/templates/regenerate?client=$SLUG" 2>/dev/null || echo "")
+  if [ -n "$SEED_RES" ]; then
+    SEED_COUNT=$(echo "$SEED_RES" | python3 -c "import sys,json; print(json.load(sys.stdin).get('written', 0))" 2>/dev/null || echo "?")
+    echo "✓ seeded $SEED_COUNT industry workflow(s) into $BRAIN_DIR/_Workflows/ (via dev server)"
+  else
+    echo "⚠ workflow seeder reachable but errored — falling back to offline CLI"
+    if node --experimental-strip-types "$REPO_ROOT/bin/seed-workflows.mjs" "$SLUG" "$INDUSTRY" 2>&1 | grep -E "^(✓|⚠|✗)"; then
+      :  # output already shown
+    else
+      echo "⚠ offline CLI also failed — run: node --experimental-strip-types $REPO_ROOT/bin/seed-workflows.mjs $SLUG $INDUSTRY"
+    fi
+  fi
+else
+  echo "⚠ dev server not on :3200 — using offline CLI seeder"
+  if node --experimental-strip-types "$REPO_ROOT/bin/seed-workflows.mjs" "$SLUG" "$INDUSTRY" 2>&1 | grep -E "^(✓|⚠|✗)"; then
+    :  # output already shown
+  else
+    echo "⚠ offline CLI failed — run: node --experimental-strip-types $REPO_ROOT/bin/seed-workflows.mjs $SLUG $INDUSTRY"
+  fi
+fi
+
+# ─── Next steps ──────────────────────────────────────────────────────────────
+echo ""
+echo "──────────────────────────────────────────────"
+echo " NEXT STEPS"
+echo "──────────────────────────────────────────────"
+echo ""
+echo "  1. Add to demo switcher (apps/console/app/components/DemoSwitcher.tsx)"
+echo "     — emoji + colour for $SLUG so you can flip to it on screen-shares."
+echo ""
+echo "  2. Smoke the manifest:"
+echo "     curl -s 'http://127.0.0.1:3200/api/pack?client=$SLUG' | python3 -m json.tool | head -10"
+echo ""
+echo "  3. (Customer install) When this prospect converts to paying:"
+echo "     a. Mint a license key via the agentmind backend"
+echo "     b. Set status='active' + license_key=<key> in $MANIFEST_FILE"
+echo "     c. Set up Obsidian Sync on the customer's Mac Mini pointing at $BRAIN_DIR"
+echo ""
+echo "  4. Brief the Champion: send them the URL to $BRAIN_DIR/_inbox/champion-day-0.md"
+echo ""
+echo "Done."