mover-os 4.7.6 → 4.7.8

package/install.js

@@ -944,8 +944,30 @@ async function downloadPayload(key) {
   // The ordering of -tvzf and -tzf output is identical (tar walks the
   // archive in the same order), so we zip them by line index for the
   // type/path correlation.
-  const pathsListing = execSync(`tar -tzf "${tarPath}"`, { encoding: 'utf8' });
-  const verboseListing = execSync(`tar -tvzf "${tarPath}"`, { encoding: 'utf8' });
+  // v4.7.9 (S4 ship-blocker): tar preflight. Both listing calls were outside
+  // any try/catch, so on a Windows box without tar on PATH the raw spawn threw
+  // `Error: spawnSync /bin/sh ENOENT` (or `'tar' is not recognized`) with no
+  // hint about what the user must install. Check tar is present first, then
+  // wrap the listings so a genuinely corrupt payload reports differently from a
+  // missing-tar host. cmdExists() is the same probe used elsewhere in install.
+  if (!cmdExists('tar')) {
+    throw new Error(
+      "tar is required to install Mover OS but was not found on PATH. " +
+      "Install tar and re-run (Git Bash and WSL both ship it; on bare Windows run `choco install tartool` " +
+      "or use the bsdtar bundled with Windows 10+ by adding C:\\\\Windows\\\\System32 to PATH)."
+    );
+  }
+  let pathsListing, verboseListing;
+  try {
+    pathsListing = execSync(`tar -tzf "${tarPath}"`, { encoding: 'utf8' });
+    verboseListing = execSync(`tar -tvzf "${tarPath}"`, { encoding: 'utf8' });
+  } catch (e) {
+    throw new Error(
+      `tar could not read the downloaded payload at ${tarPath}. ` +
+      "The download is likely corrupt or incomplete — delete that file and re-run. " +
+      `(tar reported: ${e.message})`
+    );
+  }
   const pathLines = pathsListing.split('\n').filter(Boolean);
   const verboseLines = verboseListing.split('\n').filter(Boolean);
   const badPaths = [];
@@ -988,6 +1010,41 @@ async function downloadPayload(key) {
   // Clean up tarball
   try { fs.unlinkSync(tarPath); } catch {}
 
+  // v4.7.9 (S5 ship-blocker): post-extract assert. A silently-truncated tarball
+  // can pass the listing/type checks above yet extract to nothing useful. If the
+  // canonical payload root (~/.mover/src/workflows) is absent after extraction,
+  // every downstream installer would copy from nonexistent dirs and the install
+  // would "succeed" while shipping no workflows. Fail loudly here instead.
+  const extractedWorkflows = path.join(moverDir, "src", "workflows");
+  if (!fs.existsSync(extractedWorkflows)) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} is missing — the download is corrupt or incomplete. ` +
+      `Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+  // Existence alone is too weak: a tarball carrying just an empty src/workflows/
+  // dir passes the check above, then installWorkflows() finds zero .md files and
+  // returns 0 commands while the install reports success — the exact silent-empty
+  // failure S5 exists to stop. Require at least one workflow .md to be present.
+  let extractedWfCount = 0;
+  try {
+    // Require a real .md FILE — not just any entry ending in ".md". A corrupt
+    // payload containing a directory literally named "x.md" would otherwise pass.
+    extractedWfCount = fs.readdirSync(extractedWorkflows, { withFileTypes: true })
+      .filter((d) => d.isFile() && d.name.endsWith(".md")).length;
+  } catch (e) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} is unreadable (${e.message}) — ` +
+      `the download is corrupt or incomplete. Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+  if (extractedWfCount === 0) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} contains no workflow (.md) files — ` +
+      `the download is corrupt or incomplete. Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+
   return moverDir;
 }
 
@@ -1052,7 +1109,9 @@ const CLI_COMMANDS = {
   update:    { desc: "Comprehensive update — agents, rules, skills", alias: ["-u"] },
   uninstall: { desc: "Remove Mover OS from vault and agents",     alias: [] },
   doctor:   { desc: "Health check across all installed agents",  alias: [] },
-  pulse:    { desc: "Terminal dashboard — energy, tasks, streaks",alias: [] },
+  pulse:    { desc: "Browser dashboard — Suggested Now, patterns, drift (use --terminal for TUI)",alias: ["dashboard"] },
+  open:     { desc: "Open the dashboard in your browser (starts it in the background if needed)", alias: [] },
+  menu:     { desc: "Classic terminal launcher (install, update, doctor…)", alias: [] },
   // warm removed — hooks + rules + /morning already handle session priming
   capture:  { desc: "Quick capture — tasks, links, ideas",       alias: [] },
   who:      { desc: "Entity memory lookup",                      alias: [] },
@@ -1085,6 +1144,7 @@ function parseArgs() {
     if (a === "--json") { opts.json = true; continue; }
     if (a === "--quiet" || a === "-q") { opts.quiet = true; continue; }
     if (a === "--dry-run") { opts.dryRun = true; continue; }
+    if (a === "--no-open") { opts.noOpen = true; continue; }
     if (a === "--help" || a === "-h") {
       ln();
       ln(`  ${bold("moveros")} ${dim("— the Mover OS companion CLI")}`);
@@ -1104,9 +1164,10 @@ function parseArgs() {
       ln(`    --json          Structured JSON output (for status command)`);
       ln(`    --quiet, -q     Minimal output, one value per line`);
       ln(`    --dry-run       Show what would change without doing it`);
+      ln(`    --no-open       Skip the browser launch (automation / headless)`);
       ln(`    --update, -u    Quick update (backward compat)`);
       ln();
-      ln(`  ${dim("Run")} moveros ${dim("with no args for interactive menu")}`);
+      ln(`  ${dim("Run")} moveros ${dim("with no args to open the dashboard — installs on first run")}`);
       ln();
       process.exit(0);
     }
@@ -2381,9 +2442,11 @@ Stuck: /debug-resistance
 // ─── Claude Code hooks (settings.json) ──────────────────────────────────────
 // ─── Codex hook config generator ────────────────────────────────────────────
 // v4.7.5: Codex hooks invoked through mover-hook-adapter.js for schema
-// translation. MVP scope: session-start, engine-protection, git-safety,
-// plan-sync-reminder, dirty-tree-guard (no session-log-reminder under Codex
-// — that script is Claude-transcript-specific).
+// translation.
+//
+// v4.7.8: expanded coverage — was 5 hooks across 4 events, now 13 hooks across
+// 5 events. Brings Codex to Claude Code parity on every event Codex supports.
+// PermissionRequest deferred until adapter handles nested decision schema.
 //
 // IMPORTANT: Codex runs hook commands through cmd.exe on Windows, which does
 // NOT expand $HOME. We resolve absolute paths at install time so the same
@@ -2413,6 +2476,28 @@ function generateCodexHooks() {
                 command: `node ${adapter} codex SessionStart ${hookDir}/session-start.sh" resume`,
                 timeout: 15,
               },
+              {
+                // v4.7.8: Engine Health surface on session boot — matches the
+                // PreCompact-equivalent hook Claude Code runs.
+                type: "command",
+                command: `node ${adapter} codex SessionStart ${hookDir}/engine-health.sh" full`,
+                timeout: 15,
+              },
+            ],
+          },
+        ],
+        // v4.7.8 NEW: per-prompt enforcement (Single Test reminder, friction floor)
+        UserPromptSubmit: [
+          {
+            hooks: [
+              {
+                type: "command",
+                command: `node ${adapter} codex UserPromptSubmit ${hookDir}/user-prompt-enforce.sh"`,
+                // v4.7.8 audit fix: 4s undercut adapter's 4500ms fallback (mover-hook-adapter.js:65),
+                // host would SIGTERM adapter before its internal timeout fired. 5s gives the
+                // adapter room to surface its own timeout error cleanly.
+                timeout: 5,
+              },
             ],
           },
         ],
@@ -2438,6 +2523,25 @@ function generateCodexHooks() {
             ],
           },
         ],
+        // v4.7.8: PermissionRequest event. Schema verified against
+        // https://developers.openai.com/codex/hooks — Codex expects nested
+        // {decision:{behavior,message?}} shape, which engine-permission-request.sh
+        // already emits. Adapter (mover-hook-adapter.js v4.7.8) recognizes the
+        // shape via isPermissionBehavior and passes through with allowlisting.
+        // Strategy.md and Identity_Prime.md pass through to manual dialog;
+        // Daily Notes and non-Engine files auto-allow.
+        PermissionRequest: [
+          {
+            matcher: "Edit|Write|apply_patch",
+            hooks: [
+              {
+                type: "command",
+                command: `node ${adapter} codex PermissionRequest ${hookDir}/engine-permission-request.sh"`,
+                timeout: 5,
+              },
+            ],
+          },
+        ],
         PostToolUse: [
           {
             matcher: "Edit|Write|apply_patch",
@@ -2447,16 +2551,50 @@ function generateCodexHooks() {
                 command: `node ${adapter} codex PostToolUse ${hookDir}/plan-sync-reminder.sh"`,
                 timeout: 5,
               },
+              {
+                // v4.7.8: auto-commit Engine edits. Multi-agent safe via flock
+                // (see engine-auto-commit.sh:62-89). Silent on non-Engine files.
+                type: "command",
+                command: `node ${adapter} codex PostToolUse ${hookDir}/engine-auto-commit.sh"`,
+                timeout: 10,
+              },
             ],
           },
         ],
         Stop: [
           {
+            // v4.7.8: 6 sequential hooks. Order matters — cheap/important first
+            // so they complete before any per-event budget exhausts.
             hooks: [
               {
                 type: "command",
                 command: `node ${adapter} codex Stop ${hookDir}/dirty-tree-guard.sh"`,
-                timeout: 10,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/session-log-reminder.sh"`,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/context-staleness.sh"`,
+                timeout: 5,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/iteration-check.sh"`,
+                timeout: 5,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/engine-health.sh" summary`,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/clock.sh"`,
+                timeout: 2,
               },
             ],
           },
@@ -2550,64 +2688,121 @@ function generateGeminiHooks() {
 }
 
 function generateClaudeSettings() {
+  // v4.7.9 (S3 ship-blocker): resolve absolute, forward-slash hook paths at
+  // install time instead of the literal `$HOME`. On Windows, Claude Code runs
+  // Stop/PreToolUse hooks through cmd.exe, which does NOT expand `$HOME` — so
+  // `bash "$HOME/.claude/hooks/X.sh"` resolved to a nonexistent literal path
+  // and EVERY guardrail hook (engine-protection, git-safety, session-start…)
+  // was silently dead on Windows. This is the SAME fix already proven in
+  // generateCodexHooks/generateGeminiHooks (see comment above generateCodexHooks):
+  // forward slashes work for `bash` on macOS/Linux/Windows, and an absolute
+  // path removes the cmd.exe `$HOME` dependency. The settings-merge dedup
+  // (basename-based, see line ~3372) is unaffected because it compares the
+  // hook script basename, which is identical for `$HOME/...` and absolute paths.
+  const home = os.homedir();
+  const fwd = (p) => p.split(path.sep).join("/");
+  const hooksRoot = fwd(path.join(home, ".claude", "hooks"));
   return JSON.stringify(
     {
       hooks: {
-        Stop: [
+        // ── SessionStart ── full P0-P5 load on startup|clear|resume, volatile reload on
+        //    compact. engine-health runs AFTER session-start and self-dedups: on `full`,
+        //    session-start.sh emits the staleness summary INLINE and drops a fresh
+        //    `mover_health_emitted` marker, so the trailing engine-health.sh exits 0; on
+        //    compact/precompact there is no fresh full-marker so it emits. (See the dedup
+        //    guard in engine-health.sh — added with the inline emission in 95ed8b40.)
+        SessionStart: [
           {
+            matcher: "startup|clear|resume",
             hooks: [
-              { type: "command", command: 'bash "$HOME/.claude/hooks/session-log-reminder.sh"', timeout: 10 },
-              { type: "command", command: 'bash "$HOME/.claude/hooks/dirty-tree-guard.sh"', timeout: 10 },
-              { type: "command", command: 'bash "$HOME/.claude/hooks/context-staleness.sh"', timeout: 5 },
+              { type: "command", command: `bash "${hooksRoot}/session-start.sh" full`, timeout: 30 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 20 },
             ],
           },
+          {
+            matcher: "compact",
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/session-start.sh" volatile`, timeout: 15 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 20 },
+            ],
+          },
+        ],
+        // ── UserPromptSubmit ── per-prompt anti-drift enforcement (the [MOVER] status line).
+        //    memory-recall.sh / skill-recall.sh are DELIBERATELY NOT wired here: the memory
+        //    & recall engine ships DORMANT for new installs (opt-in). Do not "fix" this by
+        //    adding them — that absence is intentional, unlike user-prompt-enforce.sh which
+        //    was an oversight this generator missed when v4.7.8 added it (wired for Codex +
+        //    Gemini but not Claude). Reconciled in v4.8.0.
+        UserPromptSubmit: [
+          {
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/user-prompt-enforce.sh"`, timeout: 5 }],
+          },
         ],
         PreToolUse: [
           {
             matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/engine-protection.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/engine-protection.sh"`, timeout: 5 }],
           },
           {
             matcher: "Bash",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/git-safety.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/git-safety.sh"`, timeout: 5 }],
           },
         ],
         PostToolUse: [
           {
             matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/plan-sync-reminder.sh"', timeout: 5 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/plan-sync-reminder.sh"`, timeout: 5 },
+              { type: "command", command: `bash "${hooksRoot}/engine-auto-commit.sh"`, timeout: 10 },
+            ],
           },
         ],
-        PreCompact: [
+        Stop: [
           {
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/pre-compact-backup.sh"', timeout: 15 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/session-log-reminder.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/dirty-tree-guard.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/context-staleness.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/iteration-check.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" summary`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/clock.sh"`, timeout: 2 },
+            ],
           },
         ],
-        SessionEnd: [
+        SubagentStart: [
           {
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-end.sh"', timeout: 10 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/subagent-context.sh"`, timeout: 5 }],
           },
         ],
-        PermissionRequest: [
+        SubagentStop: [
           {
-            matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/engine-permission-request.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/subagent-validate.sh"`, timeout: 5 }],
           },
         ],
-        SessionStart: [
+        PreCompact: [
           {
-            matcher: "startup|clear",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-start.sh" full', timeout: 5 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/pre-compact-backup.sh"`, timeout: 30 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 10 },
+            ],
           },
+        ],
+        // SessionEnd: memory-index-session.js DELIBERATELY omitted (dormant memory engine).
+        SessionEnd: [
           {
-            matcher: "compact",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-start.sh" volatile', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/session-end.sh"`, timeout: 10 }],
+          },
+        ],
+        PermissionRequest: [
+          {
+            matcher: "Write|Edit",
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/engine-permission-request.sh"`, timeout: 5 }],
           },
         ],
         ConfigChange: [
           {
             matcher: "user_settings",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/config-guard.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/config-guard.sh"`, timeout: 5 }],
           },
         ],
       },
@@ -2883,6 +3078,70 @@ function installTemplateFiles(bundleDir, vaultPath) {
   return { count, hashes };
 }
 
+// S1: install a single Markdown workflow to a Claude-style destination with the
+// config-first vault-resolution transform applied. Claude Code normally
+// hard-links workflows so editing src/ propagates live to ~/.claude/commands,
+// but the bare-git-rev-parse Pre-Flight block (see fixVaultResolution) must be
+// rewritten to a config-first resolver, and we MUST NOT mutate the shared inode.
+// So: if the body contains the bare block, write a transformed COPY (live-edit
+// hard-link is traded for a correct Pre-Flight on those files only); every other
+// workflow keeps the hard link. The transform is idempotent, so re-running is
+// safe. Shared by the fresh-install path (installWorkflows) AND the /update path
+// (direct update.md sync + smart-update loop) so updated workflows get the same
+// correct Pre-Flight as fresh installs.
+//
+// `presetContent` (optional): write/transform THIS string instead of reading
+// srcPath from disk — used by the smart-update conflict path, where the body to
+// install is an in-memory auto-merge result that may differ from the source file.
+//
+// Gap-3 fail-loud contract: if the body MATCHED the bare block (i.e. it NEEDS
+// the transform) we MUST emit the corrected copy. If reading/transforming throws
+// for a body that needs the fix, we DO NOT silently fall back to linkOrCopy
+// (which would ship the known-broken Pre-Flight) — the error propagates. Bodies
+// that don't match fall through safely: return false so the caller linkOrCopies.
+//
+// Returns true when a transformed copy was written; false when the file does not
+// need the transform and should be hard-linked/copied verbatim by the caller.
+function writeWorkflowTransformed(srcPath, destPath, presetContent) {
+  let raw;
+  if (presetContent !== undefined) {
+    raw = presetContent;
+  } else {
+    // A read failure on a real source file is a hard error: we cannot prove the
+    // file doesn't need the transform, so we must not silently linkOrCopy it.
+    raw = fs.readFileSync(srcPath, "utf8");
+  }
+  let fixed;
+  try {
+    fixed = fixVaultResolution(raw);
+  } catch (e) {
+    // Transform itself threw. If the body needs the fix, fail loud; else no-op.
+    if (workflowNeedsVaultFix(raw)) {
+      throw new Error(`Vault-resolution transform failed for ${path.basename(destPath)}: ${e.message}`);
+    }
+    return false;
+  }
+  if (fixed === raw) {
+    // No bare block (or already fixed). If preset content was supplied we still
+    // own the write; otherwise the caller hard-links/copies the source verbatim.
+    if (presetContent !== undefined) {
+      fs.mkdirSync(path.dirname(destPath), { recursive: true });
+      fs.writeFileSync(destPath, fixed, "utf8");
+      return true;
+    }
+    return false;
+  }
+  // Defensive: if the transform claims to have changed the body but the bare
+  // block somehow survives, refuse to ship it rather than emit a broken file.
+  if (workflowNeedsVaultFix(fixed)) {
+    throw new Error(`Vault-resolution transform did not remove the bare git-rev-parse block in ${path.basename(destPath)}`);
+  }
+  fs.mkdirSync(path.dirname(destPath), { recursive: true });
+  if (fs.existsSync(destPath)) fs.unlinkSync(destPath);
+  fs.writeFileSync(destPath, fixed, "utf8");
+  return true;
+}
+
 function installWorkflows(bundleDir, destDir, selectedWorkflows) {
   const srcDir = path.join(bundleDir, "src", "workflows");
   if (!fs.existsSync(srcDir)) return 0;
@@ -2892,8 +3151,14 @@ function installWorkflows(bundleDir, destDir, selectedWorkflows) {
   let count = 0;
   for (const file of srcFiles) {
     if (selectedWorkflows && !selectedWorkflows.has(file)) continue;
-    if (linkOrCopy(path.join(srcDir, file), path.join(destDir, file))) {
-      savePristineCopy("workflows", path.join(srcDir, file));
+    const srcPath = path.join(srcDir, file);
+    const destPath = path.join(destDir, file);
+    // Gap-3: writeWorkflowTransformed throws if a workflow that NEEDS the
+    // Pre-Flight fix fails to transform — we surface that instead of shipping
+    // the broken source via linkOrCopy. Only unmatched workflows fall through.
+    const wrote = writeWorkflowTransformed(srcPath, destPath);
+    if (wrote || linkOrCopy(srcPath, destPath)) {
+      savePristineCopy("workflows", srcPath);
       count++;
     }
   }
@@ -3059,6 +3324,49 @@ function parseWorkflowMd(filePath) {
   return { name, description, body, filePath };
 }
 
+// v4.7.9 (S1 ship-blocker): workflow Pre-Flight blocks resolve the vault root
+// with a bare `git rev-parse --show-toplevel`. A LIVE vault is NOT a git repo,
+// so that command exits non-zero and the agent never learns VAULT_ROOT — every
+// subsequent `{VAULT_ROOT}/...` read silently fails. The canonical resolution
+// (mirrored from resolveVaultPath) reads ~/.mover/config.json `vaultPath`
+// FIRST, then falls back to git, then walks up for 02_Areas/Engine. This
+// transform rewrites the bare fenced block at INSTALL time so we never mutate
+// the shared-inode source .md (Claude path uses copy-with-transform; the
+// converted agents already write copies). Idempotent: returns body unchanged
+// if the bare block isn't present (already fixed, or a workflow that doesn't
+// resolve the vault this way).
+const VAULT_RESOLVE_SNIPPET = [
+  "```bash",
+  "# Resolve VAULT_ROOT — config first (a live vault is NOT a git repo).",
+  'VAULT_ROOT="$(node -e \'try{console.log(JSON.parse(require("fs").readFileSync(require("os").homedir()+"/.mover/config.json","utf8")).vaultPath||"")}catch(e){}\' 2>/dev/null)"',
+  '[ -z "$VAULT_ROOT" ] && VAULT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"',
+  'if [ -z "$VAULT_ROOT" ]; then d="$PWD"; while [ "$d" != "/" ]; do [ -d "$d/02_Areas/Engine" ] && VAULT_ROOT="$d" && break; d="$(dirname "$d")"; done; fi',
+  'echo "$VAULT_ROOT"',
+  "```",
+].join("\n");
+
+// Match the exact bare Pre-Flight block:  ```bash\n git rev-parse --show-toplevel \n```
+// Tolerate surrounding blank lines / trailing whitespace inside the fence. Built
+// fresh on each call (no shared lastIndex) so .test() is stateless across callers.
+function bareVaultBlockRe() {
+  return /```bash\s*\n[ \t]*git rev-parse --show-toplevel[ \t]*\n```/;
+}
+
+// True when `body` still ships the bare git-rev-parse Pre-Flight block — i.e. it
+// NEEDS the config-first rewrite. Used by the install paths to decide between a
+// transformed copy and a verbatim hard-link, and to enforce the Gap-3 fail-loud
+// contract (a body that needs the fix must never ship untransformed).
+function workflowNeedsVaultFix(body) {
+  if (typeof body !== "string") return false;
+  return bareVaultBlockRe().test(body);
+}
+
+function fixVaultResolution(body) {
+  if (typeof body !== "string") return body;
+  if (!workflowNeedsVaultFix(body)) return body;
+  return body.replace(bareVaultBlockRe(), VAULT_RESOLVE_SNIPPET);
+}
+
 // Gemini CLI: .md → .toml
 function mdToToml(wf) {
   const desc = wf.description.replace(/"/g, '\\"');
@@ -3125,6 +3433,10 @@ function installWorkflowsConverted(bundleDir, destDir, format, selectedWorkflows
   for (const file of fs.readdirSync(srcDir).filter((f) => f.endsWith(".md"))) {
     if (selectedWorkflows && !selectedWorkflows.has(file)) continue;
     const wf = parseWorkflowMd(path.join(srcDir, file));
+    // S1: config-first vault resolution. Safe — these agents always get a
+    // freshly-written copy (no shared inode), so transforming the body here
+    // only changes the emitted file, never the source .md.
+    wf.body = fixVaultResolution(wf.body);
     const converted = conv.fn(wf);
     if (conv.dir) {
       // Directory-based output (e.g., Codex: morning/SKILL.md)
@@ -3279,51 +3591,182 @@ function installHooksForClaude(bundleDir, vaultPath) {
     try {
       const existing = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
       if (!existing.hooks) existing.hooks = {};
-      // Merge each hook event (Stop, PreToolUse, PreCompact)
+
+      // Gap-3 (S3 update path): repair existing Windows-broken hook commands.
+      // A pre-v4.7.9 install wrote `bash "$HOME/.claude/hooks/X.sh" [args]` (the
+      // form cmd.exe can't expand). The basename-only dedup below treats that as
+      // "already present" and would neither add the corrected command NOR fix the
+      // old one — leaving the hook dead on Windows forever. So FIRST rewrite any
+      // existing command that targets one of OUR hook scripts via a $HOME/~/
+      // relative path into the exact absolute-forward-slash form generateClaudeSettings
+      // now emits (matched on the script + trailing-arg tail so the two
+      // session-start variants map to their correct full/volatile replacements).
+      // After rewriting in place, the dedup sees the new form and won't duplicate.
+      const canonicalCmds = [];
+      for (const entries of Object.values(newHooks)) {
+        for (const grp of entries) for (const h of grp.hooks) canonicalCmds.push(h.command);
+      }
+      // Normalized tail signature: `<script>.sh<rest>` with quotes stripped and
+      // backslashes normalized, so a QUOTED canonical command and an UNQUOTED (or
+      // backslash-pathed) old command map to the SAME key. `<rest>` keeps the
+      // trailing arg (` full` / ` volatile`) so the two session-start variants
+      // stay distinct. Matching on the basename (after the last slash, either
+      // direction) means $HOME / %USERPROFILE% / ~ / absolute prefixes all collapse
+      // to the same signature.
+      const tailSig = (cmd) => {
+        if (typeof cmd !== "string") return null;
+        const norm = cmd.replace(/["']/g, "").replace(/\\/g, "/");
+        const m = norm.match(/([^\/\s]+\.sh)(.*)$/);
+        return m ? (m[1] + m[2]).trim() : null;
+      };
+      const canonicalByTail = new Map();
+      for (const cmd of canonicalCmds) {
+        const t = tailSig(cmd);
+        if (t) canonicalByTail.set(t, cmd);
+      }
+      // An "old form" is a command pointing at a .claude/hooks/<script>.sh via a
+      // HOME-relative prefix ($HOME, %USERPROFILE%, or ~), in either slash
+      // direction, quoted or not. Absolute paths and non-Mover commands are NOT
+      // old forms (so they're left untouched).
+      const isOldHomeForm = (cmd) =>
+        typeof cmd === "string" &&
+        /\.claude[\\/]+hooks[\\/]+[^"\\/]*\.sh/.test(cmd) &&
+        /(\$HOME|\$\{HOME\}|%USERPROFILE%|(^|["'\s])~[\\/])/.test(cmd);
+      const rewriteCmd = (cmd) => {
+        if (!isOldHomeForm(cmd)) return cmd;
+        const t = tailSig(cmd);
+        const canon = t && canonicalByTail.get(t);
+        return canon || cmd; // only rewrite scripts we actually own/emit
+      };
+      for (const event of Object.keys(existing.hooks)) {
+        const groups = existing.hooks[event];
+        if (!Array.isArray(groups)) continue;
+        for (const grp of groups) {
+          if (!grp || !Array.isArray(grp.hooks)) continue;
+          for (const h of grp.hooks) {
+            if (h && typeof h.command === "string") h.command = rewriteCmd(h.command);
+          }
+        }
+      }
+
+      // Merge each hook event (Stop, PreToolUse, PreCompact).
+      // Dedup runs AFTER the old-form rewrite above, so a repaired command is now
+      // seen as present and is not re-added.
+      //
+      // v4.7.9: HOOK-LEVEL dedup keyed on a signature = script basename + trailing
+      // args (quotes stripped, slash direction normalized). Three fixes over the
+      // old basename-only check:
+      //   • Dedup per individual hook, not per group: a new group is appended with
+      //     only the hooks the event is MISSING. The old code (and an interim
+      //     group-level version) re-added an entire multi-hook group — e.g. Stop's
+      //     3 hooks — whenever any single hook was absent, duplicating the ones
+      //     already present.
+      //   • Include the trailing arg in the signature so `session-start.sh full`
+      //     and `session-start.sh volatile` are distinct (multi-group event safe).
+      //   • Strip ALL quotes from both sides so `…session-start.sh" full` matches
+      //     `session-start.sh full` (the old single-quote .replace left the needle
+      //     unmatchable → duplicates).
+      const cmdSig = (cmd) => {
+        if (typeof cmd !== "string") return "";
+        const m = cmd.match(/([^\\/"]+\.sh)("?.*)$/);
+        const tail = m ? m[1] + m[2] : cmd;
+        return tail.replace(/["']/g, "").replace(/\\/g, "/").trim();
+      };
       for (const [event, entries] of Object.entries(newHooks)) {
         if (!existing.hooks[event]) {
           existing.hooks[event] = entries;
         } else {
-          // Check if our hooks are already registered (by command substring).
-          // v4.7.6: split on both / and \\ so the basename extraction works on
-          // Windows where command paths use backslashes. The forward-slash-only
-          // split returned the entire command string on Windows, which never
-          // matched the substring check, leading to duplicate hooks accumulating
-          // on every install.
-          const existingCmds = JSON.stringify(existing.hooks[event]);
-          const alreadyHas = entries[0].hooks.every(
-            (h) => existingCmds.includes(h.command.split(/[\\/]/).pop().replace('"', ""))
-          );
-          if (!alreadyHas) {
-            existing.hooks[event].push(...entries);
+          const existingSigs = new Set();
+          for (const grp of existing.hooks[event]) {
+            if (grp && Array.isArray(grp.hooks)) for (const h of grp.hooks) existingSigs.add(cmdSig(h.command));
+          }
+          for (const grp of entries) {
+            // Keep only hooks whose signature isn't already registered for this event.
+            const missing = (grp.hooks || []).filter((h) => !existingSigs.has(cmdSig(h.command)));
+            if (missing.length === 0) continue; // every hook in this group already present
+            // Append a group carrying only the missing hooks (preserve matcher if any).
+            const toAdd = grp.matcher !== undefined
+              ? { matcher: grp.matcher, hooks: missing }
+              : { hooks: missing };
+            existing.hooks[event].push(toAdd);
+            for (const h of missing) existingSigs.add(cmdSig(h.command));
           }
         }
       }
+      // v4.7.7: set skillListingBudgetFraction so Mover OS users don't see
+      // skill descriptions truncated by Claude Code's default 1% budget.
+      // Per Claude Code's own /doctor output, Mover's ~63 skills need 2.5%
+      // of context; 0.03 (3%) gives that exact size + small headroom for
+      // user-added skills, without doubling the cost like 0.05 would.
+      //
+      // TRADEOFF: each session uses ~4,000 more system-prompt tokens than
+      // Claude Code's default 1%. That marginally accelerates autocompaction
+      // (~2% sooner) and rate-limit ticker. The benefit (full skill
+      // descriptions available, no truncation message) outweighs the cost
+      // for users who installed Mover OS specifically for the skill packs.
+      //
+      // Only set if not already configured — respect explicit user choice.
+      // To opt out: manually set "skillListingBudgetFraction": 0.01 in your
+      // ~/.claude/settings.json after install.
+      if (existing.skillListingBudgetFraction === undefined) {
+        existing.skillListingBudgetFraction = 0.03;
+      }
       fs.writeFileSync(settingsPath, JSON.stringify(existing, null, 2), "utf8");
     } catch {
       // Corrupt settings — backup before overwrite
       const backupPath = settingsPath + ".bak";
       try { fs.copyFileSync(settingsPath, backupPath); } catch {}
       ln(`  ${yellow("!")} Settings file corrupt — backed up to settings.json.bak, writing fresh`);
-      fs.writeFileSync(settingsPath, generateClaudeSettings(), "utf8");
+      // Fresh write also sets the budget — combine generated hooks with the
+      // skill budget setting so a fresh install doesn't trigger truncation.
+      const fresh = JSON.parse(generateClaudeSettings());
+      fresh.skillListingBudgetFraction = 0.03;
+      fs.writeFileSync(settingsPath, JSON.stringify(fresh, null, 2), "utf8");
     }
   } else {
-    fs.writeFileSync(settingsPath, generateClaudeSettings(), "utf8");
+    // Fresh install — write hooks AND the skill listing budget together.
+    const fresh = JSON.parse(generateClaudeSettings());
+    fresh.skillListingBudgetFraction = 0.03;
+    fs.writeFileSync(settingsPath, JSON.stringify(fresh, null, 2), "utf8");
   }
 
   return count;
 }
 
-// ─── Multi-agent hook installer (v4.7.5) ────────────────────────────────────
-// Copies the MVP hook set (5 enforcement hooks + adapter + shared lib) to the
-// agent's hook directory and writes its hook config. Used by Codex and Gemini.
+// ─── Multi-agent hook installer (v4.7.5 + v4.7.8 expansion) ─────────────────
+// Copies the MVP hook set + adapter + shared lib to the agent's hook directory
+// and writes its hook config. Used by Codex and Gemini.
+//
+// v4.7.8: expanded from 5 → 12 hook scripts to bring Codex to Claude Code
+// parity on UserPromptSubmit (per-prompt anti-drift), PostToolUse
+// engine-auto-commit, and Stop multi-script coverage (session-log-reminder,
+// context-staleness, iteration-check, engine-health, clock).
+//
+// PermissionRequest deferred: engine-permission-request.sh emits a nested
+// decision shape that mover-hook-adapter.js:isValidOutput rejects. Wiring it
+// would silently drop the decision. Adapter extension required first.
 const MVP_HOOK_SCRIPTS = [
+  // SessionStart (2)
   "session-start.sh",
+  "engine-health.sh", // also fires under Stop
+  // UserPromptSubmit (1) — v4.7.8 NEW: per-prompt enforcement injection
+  "user-prompt-enforce.sh",
+  // PreToolUse (2)
   "engine-protection.sh",
   "git-safety.sh",
+  // PermissionRequest (1) — v4.7.8 NEW: nested decision-shape via adapter
+  "engine-permission-request.sh",
+  // PostToolUse (2)
   "plan-sync-reminder.sh",
+  "engine-auto-commit.sh", // v4.7.8 NEW: micro-commit Engine edits
+  // Stop (6) — v4.7.8 NEW: session-log-reminder, context-staleness, iteration-check, clock
   "dirty-tree-guard.sh",
-  "mover-lib.sh", // sourced by the others
+  "session-log-reminder.sh",
+  "context-staleness.sh",
+  "iteration-check.sh",
+  "clock.sh",
+  // Shared library (sourced by the others)
+  "mover-lib.sh",
 ];
 
 // Section-aware TOML upsert. Sets [section] key = value, preserving comments,
@@ -3468,6 +3911,21 @@ function installHooksForCodex(bundleDir) {
   const configToml = path.join(codexDir, "config.toml");
   upsertTomlKey(configToml, "features", "codex_hooks", "true");
 
+  // v4.7.8: Stash a marker so the post-install summary can show the
+  // one-time "trust hooks in Codex IDE" hint. Codex IDE prompts users to
+  // review/trust newly installed or modified hooks (security feature —
+  // hooks run outside the sandbox). There is NO config-level bypass per
+  // https://developers.openai.com/codex/hooks. CLI uses hooks.json
+  // directly without the trust gate, so Mover OS works fine via CLI.
+  // The trust prompt only affects users running Codex IDE.
+  try {
+    fs.writeFileSync(
+      path.join(codexDir, ".mover-hook-install-stamp"),
+      new Date().toISOString() + "\n",
+      "utf8"
+    );
+  } catch {}
+
   return count;
 }
 
@@ -4068,6 +4526,8 @@ function preflight() {
 // ─── CLI Command Handlers (stubs — implemented progressively) ────────────────
 const CLI_HANDLERS = {
   pulse:    async (opts) => { await cmdPulse(opts); },
+  dashboard: async (opts) => { await cmdPulse(opts); }, // alias — opens browser dashboard
+  open:     async (opts) => { await cmdOpen(opts); },
   // warm removed
   capture:  async (opts) => { await cmdCapture(opts); },
   who:      async (opts) => { await cmdWho(opts); },
@@ -4200,6 +4660,89 @@ async function cmdDoctor(opts) {
     statusLine(allOk ? "ok" : "warn", `  ${reg.name}`, checks.join(", "));
   }
 
+  // ── Claude Code skill listing budget (v4.7.7) ────────────────────────
+  // Claude Code 2.1.x truncates skill descriptions when the total exceeds
+  // skillListingBudgetFraction (default 0.01 = 1% of context, ~2K tokens).
+  // Users with 50+ skills installed see the "X descriptions dropped" message.
+  // This is a Claude Code feature, not a Mover OS bug — but Mover users hit
+  // it because we ship many skills. Help the user diagnose + tune.
+  barLn();
+  barLn(dim("  Claude Code:"));
+  const claudeSkillsDir = path.join(home, ".claude", "skills");
+  if (fs.existsSync(claudeSkillsDir)) {
+    const skillCount = fs.readdirSync(claudeSkillsDir).filter(n => !n.startsWith(".")).length;
+    statusLine(
+      skillCount > 70 ? "warn" : "ok",
+      "  Skill count",
+      `${skillCount} in ~/.claude/skills/`
+    );
+    if (skillCount > 50) {
+      // Try to read settings.json to report current value.
+      let currentFraction = null;
+      try {
+        const s = JSON.parse(fs.readFileSync(path.join(home, ".claude", "settings.json"), "utf8"));
+        if (typeof s.skillListingBudgetFraction === "number") currentFraction = s.skillListingBudgetFraction;
+      } catch {}
+      const fracDisplay = currentFraction === null ? "unset (Claude Code default 0.01)" : String(currentFraction);
+      barLn(dim(`    Skill listing budget: ${fracDisplay}`));
+      if (currentFraction === null || currentFraction < 0.025) {
+        barLn(dim(`    With ${skillCount} skills, Claude Code's default 1% budget truncates`));
+        barLn(dim(`    less-used skill descriptions ("X descriptions dropped" message).`));
+        barLn(dim(`    'moveros install' sets skillListingBudgetFraction: 0.03 (3%) to fit`));
+        barLn(dim(`    Mover's manifest. Trade: ~4K extra tokens per session, all skills`));
+        barLn(dim(`    visible. To opt back to 1% default: edit ~/.claude/settings.json.`));
+      } else {
+        barLn(dim(`    Budget covers ~${Math.floor(currentFraction * 100 * 25)} skills before truncation. Run /skills`));
+        barLn(dim(`    in Claude Code to disable specific skills.`));
+      }
+    }
+  }
+  // CLAUDE.md size check — Claude Code flags > 40K as "Large CLAUDE.md".
+  const claudeMd = path.join(home, ".claude", "CLAUDE.md");
+  if (fs.existsSync(claudeMd)) {
+    const claudeMdSize = fs.statSync(claudeMd).size;
+    statusLine(
+      claudeMdSize > 40000 ? "warn" : "ok",
+      "  CLAUDE.md size",
+      `${claudeMdSize.toLocaleString()} chars` + (claudeMdSize > 40000 ? " (Claude Code flags >40K)" : "")
+    );
+  }
+
+  // ── Codex CLI / MCP plugin conflict check (v4.7.8) ────────────────────
+  // Unauthenticated MCP plugins in ~/.codex/config.toml cause codex exec to
+  // hang or exit empty on complex prompts (the Vercel "claude-plugins-official"
+  // plugin is the most common offender — it requires Bearer auth that's never
+  // set, so the MCP transport errors and blocks the LLM response path).
+  // We don't auto-disable user plugins, just surface the issue.
+  const codexConfig = path.join(home, ".codex", "config.toml");
+  if (fs.existsSync(codexConfig)) {
+    barLn();
+    barLn(dim("  Codex:"));
+    const codexToml = fs.readFileSync(codexConfig, "utf8");
+    // Find all [plugins."NAME"] sections with enabled = true
+    const pluginRe = /\[plugins\."([^"]+)"\]\s*\nenabled\s*=\s*true/g;
+    const enabledPlugins = [];
+    let m;
+    while ((m = pluginRe.exec(codexToml)) !== null) enabledPlugins.push(m[1]);
+    // Known plugins that require auth and break Codex CLI when unauthenticated.
+    // Add more here as users report similar issues.
+    const KNOWN_BROKEN_AUTH = new Set([
+      "vercel@claude-plugins-official",
+    ]);
+    const broken = enabledPlugins.filter(p => KNOWN_BROKEN_AUTH.has(p));
+    if (broken.length > 0) {
+      statusLine("warn", "  MCP plugin auth", `${broken.length} plugin(s) likely unauthenticated`);
+      for (const p of broken) {
+        barLn(dim(`    [plugins."${p}"] enabled=true — auth not configured`));
+      }
+      barLn(dim(`    Symptom: codex exec hangs or returns empty on complex prompts.`));
+      barLn(dim(`    Fix: edit ~/.codex/config.toml, flip enabled=false for the above plugins`));
+      barLn(dim(`    (or configure the missing auth). Mover OS does NOT auto-disable plugins.`));
+    } else if (enabledPlugins.length > 0) {
+      statusLine("ok", "  MCP plugin auth", `${enabledPlugins.length} plugin(s), none flagged`);
+    }
+  }
+
   // Engine Git
   barLn();
   const engineGit = fs.existsSync(path.join(engineDir, ".git"));
@@ -4222,8 +4765,58 @@ async function cmdDoctor(opts) {
   barLn(dim("  Fix any issues above, then run /mover-check in your AI agent for deeper validation."));
 }
 
-// ─── moveros pulse ──────────────────────────────────────────────────────────
+// ─── moveros pulse / dashboard ───────────────────────────────────────────────
+// Default: opens browser dashboard at http://127.0.0.1:3737. Use `--terminal` for legacy TUI.
 async function cmdPulse(opts) {
+  const rest = opts.rest || [];
+  const wantTerminal = rest.includes("--terminal");
+  if (!wantTerminal) {
+    const vault = resolveVaultPath(opts.vault);
+    if (!vault) return;
+    try {
+      const dash = require("./src/dashboard");
+      await dash.run({
+        vault,
+        version: (() => { try { return require("./package.json").version; } catch { return "unknown"; } })(),
+        rest
+      });
+      return;
+    } catch (err) {
+      console.error(dim(`  dashboard module error: ${err.message}`));
+      console.error(dim("  falling back to terminal pulse — fix or run with --terminal explicitly"));
+    }
+  }
+  await cmdPulseTerminal(opts);
+}
+
+// ─── moveros open ────────────────────────────────────────────────────────────
+// Ensure the dashboard is running in the background, then open it in the
+// browser and exit. Used by the desktop launcher (shortcut.js → `node
+// install.js open`) and by anyone who wants the dashboard without holding a
+// terminal open. `pulse` is the foreground equivalent.
+async function cmdOpen(opts, { soft = false, route = "" } = {}) {
+  const vault = resolveVaultPath(opts.vault);
+  if (!vault) {
+    console.error(dim("  Could not resolve vault. Run `moveros doctor` to diagnose."));
+    return;
+  }
+  try {
+    const dash = require("./src/dashboard");
+    await dash.open({
+      vault,
+      version: (() => { try { return require("./package.json").version; } catch { return "unknown"; } })(),
+      rest: opts.rest || [],
+      soft,
+      noOpen: !!opts.noOpen,
+      route,
+    });
+  } catch (err) {
+    console.error(dim(`  dashboard module error: ${err.message}`));
+    console.error(dim("  open it manually with: moveros pulse"));
+  }
+}
+
+async function cmdPulseTerminal(opts) {
   const vault = resolveVaultPath(opts.vault);
   if (!vault) {
     // handled by requireVault()
@@ -4557,7 +5150,32 @@ async function cmdSync(opts) {
   for (const c of candidates) {
     if (fs.existsSync(path.join(c, "src", "workflows"))) { bundleDir = c; break; }
   }
-  if (!bundleDir) { barLn(yellow("  Can't find Mover OS source. Run from the bundle directory.")); return; }
+  // v4.7.9 (S6 ship-blocker): download fallback. `moveros sync` was disk-only —
+  // it resolved bundleDir from cwd / vault-bundle / __dirname and bailed if none
+  // had src/. npm-global installs have NO src/ on disk (the CLI is just the
+  // published install.js), so every npm-global user hit "Can't find Mover OS
+  // source" and could never sync. Mirror cmdUpdateComprehensive: if a license
+  // key is available, download the payload to ~/.mover and use that as the
+  // source. Only bail when there is no disk source AND no key to download with.
+  if (!bundleDir) {
+    const key = opts.key || cfg.licenseKey;
+    if (key) {
+      const dlSp = spinner("Downloading Mover OS");
+      try {
+        bundleDir = await downloadPayload(key);
+        dlSp.stop(green("Downloaded"));
+        barLn();
+      } catch (err) {
+        dlSp.stop(red("Download failed"));
+        barLn(yellow(`  ${err.message}`));
+        return;
+      }
+    } else {
+      barLn(yellow("  Can't find Mover OS source on disk, and no license key to download it."));
+      barLn(dim("  Run from the bundle directory, or set a license key (moveros install) so sync can fetch the payload."));
+      return;
+    }
+  }
 
   // Compare source hash vs installed for each agent
   const srcRulesHash = (() => {
@@ -5520,7 +6138,7 @@ async function cmdHelp(opts) {
         `                ${dim("moveros capture --task \"Fix the login bug\"")}`,
         "",
         `  ${cyan("who")}         Entity lookup — search People, Orgs, Places`,
-        `                ${dim("moveros who \"Ishaaq\" → everything you know about them")}`,
+        `                ${dim("moveros who \"Sarah\" → everything you know about them")}`,
         "",
         `  ${cyan("prayer")}      Mosque timetable — next prayer in your status line`,
         `                ${dim("Paste or fetch. Shows countdown. Optional.")}`,
@@ -5756,7 +6374,7 @@ async function cmdMainMenu() {
 
   // Context filter: hide irrelevant commands
   const contextFilter = (cmd) => {
-    if (!hasVault && ["pulse", "replay", "diff", "sync", "capture", "who", "context", "backup", "restore", "doctor"].includes(cmd)) return false;
+    if (!hasVault && ["pulse", "open", "replay", "diff", "sync", "capture", "who", "context", "backup", "restore", "doctor"].includes(cmd)) return false;
     if (!hasPrayer && cmd === "prayer") return false;
     return true;
   };
@@ -5970,6 +6588,19 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     barLn();
     if (totalChanged > 0) {
       barLn(dim("  Restart your AI session to load updated rules and skills."));
+      // v4.7.8: If Codex hooks were just installed/updated, point users at
+      // the IDE trust step. Codex IDE shows new/modified hooks as "needs
+      // review" — a security feature. CLI fires hooks fine without trust.
+      try {
+        const codexStamp = path.join(os.homedir(), ".codex", ".mover-hook-install-stamp");
+        if (selectedIds.includes("codex") && fs.existsSync(codexStamp)) {
+          const stampedAt = new Date(fs.readFileSync(codexStamp, "utf8").trim()).getTime();
+          if (Date.now() - stampedAt < 5 * 60 * 1000) {
+            barLn(dim("  Codex IDE: open Settings → Hooks, click Trust on the new entries."));
+            barLn(dim("    (One-time per hook change. CLI fires them without the trust gate.)"));
+          }
+        }
+      } catch {}
       barLn();
     }
     const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
@@ -6061,7 +6692,14 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     for (const dir of cmdDirs) {
       const dest = path.join(dir, "update.md");
       if (fs.existsSync(dir)) {
-        fs.copyFileSync(updateSrc, dest);
+        // Gap-1: apply the config-first vault-resolution transform here too —
+        // update.md itself ships the bare git-rev-parse Pre-Flight, and this
+        // direct sync would otherwise copy the known-broken block verbatim.
+        // writeWorkflowTransformed returns false only for bodies that DON'T need
+        // the fix; update.md always does, so the copy fallback never runs for it.
+        if (!writeWorkflowTransformed(updateSrc, dest)) {
+          fs.copyFileSync(updateSrc, dest);
+        }
       }
     }
     statusLine("ok", "/update", "workflow synced");
@@ -6101,7 +6739,12 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
       switch (result.action) {
         case "install":
         case "safe-overwrite":
-          linkOrCopy(srcFile, destFile);
+          // Gap-1: same config-first transform as the fresh-install path. The
+          // smart-update loop previously linkOrCopy'd the raw source, shipping the
+          // bare git-rev-parse Pre-Flight on update. writeWorkflowTransformed
+          // emits a corrected copy for matched files and returns false (→ linkOrCopy)
+          // for the rest, preserving the live-edit hard link where it's safe.
+          if (!writeWorkflowTransformed(srcFile, destFile)) linkOrCopy(srcFile, destFile);
           savePristineCopy("workflows", srcFile);
           updated.push(file);
           break;
@@ -6115,7 +6758,7 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
           const backupDir = path.join(home, ".mover", "backups", `pre-update-${new Date().toISOString().slice(0, 10)}`);
           fs.mkdirSync(backupDir, { recursive: true });
           if (fs.existsSync(destFile)) fs.copyFileSync(destFile, path.join(backupDir, file));
-          linkOrCopy(srcFile, destFile);
+          if (!writeWorkflowTransformed(srcFile, destFile)) linkOrCopy(srcFile, destFile);
           savePristineCopy("workflows", srcFile);
           updated.push(file);
           break;
@@ -6123,7 +6766,10 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
         case "conflict": {
           const mergeResult = tryAutoMerge("workflows", srcFile, destFile);
           if (mergeResult.success) {
-            fs.writeFileSync(destFile, mergeResult.content, "utf8");
+            // Transform the MERGED body before writing: an auto-merge can carry the
+            // bare block over from the user's old copy, so a verbatim write would
+            // re-ship the broken Pre-Flight. presetContent feeds the in-memory merge.
+            writeWorkflowTransformed(srcFile, destFile, mergeResult.content);
             savePristineCopy("workflows", srcFile);
             autoMerged.push(file);
           } else {
@@ -6322,6 +6968,17 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   barLn();
   if (updated.length > 0 || autoMerged.length > 0) {
     barLn(dim("  Restart your AI session to load updated rules and skills."));
+    // v4.7.8: Codex IDE hook-trust hint (same logic as install path above).
+    try {
+      const codexStamp = path.join(os.homedir(), ".codex", ".mover-hook-install-stamp");
+      if (selectedIds.includes("codex") && fs.existsSync(codexStamp)) {
+        const stampedAt = new Date(fs.readFileSync(codexStamp, "utf8").trim()).getTime();
+        if (Date.now() - stampedAt < 5 * 60 * 1000) {
+          barLn(dim("  Codex IDE: open Settings → Hooks, click Trust on the new entries."));
+          barLn(dim("    (One-time per hook change. CLI fires them without the trust gate.)"));
+        }
+      }
+    } catch {}
     barLn();
   }
   const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
@@ -6370,17 +7027,34 @@ async function main() {
   let bundleDir = path.resolve(__dirname);
   const startTime = Date.now();
 
+  // ── Bare `moveros` — smart default (decided before the branded header so
+  //    launching the dashboard is instant, with no logo animation in the way).
+  //    Configured machine → open Mover Studio (soft: won't stack tabs on a
+  //    reflexive re-run). Fresh machine → fall through to the installer, which
+  //    lands the user on the dashboard's onboarding route when it finishes.
+  //    `moveros menu` restores the classic interactive launcher. ──
+  if (!opts.command) {
+    const configuredVault = resolveVaultPath(opts.vault);
+    if (configuredVault) {
+      recordCliUsage("open");
+      await cmdOpen(opts, { soft: true });
+      if (!opts.noOpen) ln(dim("  Tools: moveros menu · moveros doctor · moveros update"));
+      return;
+    }
+    opts.command = "install"; // no vault yet → first run goes straight to install
+  }
+
   // ── TUI: Enter alternate screen ──
   enterAltScreen();
 
   // ── Intro: Logo plays once ──
   await printHeader();
 
-  // ── Route: no command → interactive menu (persistent loop) ──
-  const lightCommands = ["pulse", "capture", "who", "diff", "sync", "replay", "context", "settings", "backup", "restore", "doctor", "prayer", "help", "uninstall", "test"];
+  const lightCommands = ["pulse", "dashboard", "open", "capture", "who", "diff", "sync", "replay", "context", "settings", "backup", "restore", "doctor", "prayer", "help", "uninstall", "test"];
 
-  if (!opts.command) {
-    // Interactive loop — stay open like a real app
+  // ── `moveros menu` → classic interactive launcher (persistent loop) ──
+  if (opts.command === "menu") {
+    opts.command = "";
     while (true) {
       clearContent();
       ln(compactHeader());
@@ -7140,21 +7814,23 @@ async function main() {
   // ── Next steps (animated slide-in) ──
   ln(gray("  ─────────────────────────────────────────────"));
   ln();
+  // Funnel v2 (owner spec): the dashboard IS the front door. Lead with
+  // moveros; Obsidian is the file viewer, /setup the terminal alternative.
   await slideIn([
     `  ${bold("Next steps")}`,
     "",
-    `  ${cyan("1")}  Open your vault in ${bold("Obsidian")}`,
-    `     ${dim("This is where you view and browse your files")}`,
+    `  ${cyan("1")}  Run ${bold("moveros")}`,
+    `     ${dim("Opens your dashboard; setup starts there, a few plain questions")}`,
     "",
-    `  ${cyan("2")}  Open the vault folder in your AI agent`,
-    `     ${dim("Installed: " + agentNames.join(", "))}`,
+    `  ${cyan("2")}  Open your vault in ${bold("Obsidian")} ${dim("(optional)")}`,
+    `     ${dim("For viewing and browsing your files. Not required to start.")}`,
     "",
   ]);
-  ln(`  ${cyan("3")}  Enable the Obsidian theme`);
+  ln(`  ${cyan("3")}  Enable the Obsidian theme ${dim("(if using Obsidian)")}`);
   ln(`     ${dim("Settings → Appearance → CSS snippets → minimal-theme")}`);
   ln();
-  ln(`  ${cyan("4")}  Run ${bold("/setup")}`);
-  ln(`     ${dim("Builds your Identity, Strategy, and Goals")}`);
+  ln(`  ${cyan("4")}  Prefer the terminal? Run ${bold("/setup")} in your agent instead`);
+  ln(`     ${dim("The same setup, full depth: Identity, Strategy, Goals, projects")}`);
   ln();
   ln(gray("  ─────────────────────────────────────────────"));
   ln();
@@ -7167,13 +7843,30 @@ async function main() {
   ln();
   ln(`  ${bold("CLI commands")}  ${dim("(run from any terminal)")}`);
   ln();
-  ln(`  ${green("▸")} ${bold("moveros pulse")}     ${dim("Dashboard — energy, tasks, streaks")}`);
+  ln(`  ${green("▸")} ${bold("moveros")}           ${dim("Open your dashboard")}`);
   ln(`  ${green("▸")} ${bold("moveros doctor")}    ${dim("Health check across all agents")}`);
   ln(`  ${green("▸")} ${bold("moveros capture")}   ${dim("Quick inbox — tasks, links, ideas")}`);
   ln(`  ${green("▸")} ${bold("moveros prayer")}    ${dim("Set up prayer time reminders")}`);
   ln(`  ${green("▸")} ${bold("moveros update")}    ${dim("Update agents, rules, and skills")}`);
-  ln(`  ${green("▸")} ${bold("moveros")}           ${dim("Full menu with all commands")}`);
+  ln(`  ${green("▸")} ${bold("moveros menu")}      ${dim("All commands (classic launcher)")}`);
   ln();
+
+  // ── Land on the dashboard's onboarding route (the payoff) ──
+  // Engine is still templates pre-/setup, so force the cold-start Onboarding
+  // cascade explicitly (?onboarding=1). TTY-only + best-effort: a dashboard
+  // hiccup never fails or blocks the install. `--no-open` opts out (automation).
+  if (!opts.noOpen && process.stdout.isTTY) {
+    ln(gray("  ─────────────────────────────────────────────"));
+    ln();
+    try {
+      const dash = require("./src/dashboard");
+      await dash.open({ vault: vaultPath, version: VERSION, rest: [], soft: false, route: "/?onboarding=1" });
+      ln(`  ${dim("Opening onboarding in your browser. Next: run")} ${bold("/setup")} ${dim("in your AI agent.")}`);
+    } catch (err) {
+      ln(`  ${dim("Your dashboard is ready — open it anytime with")} ${bold("moveros")}.`);
+    }
+    ln();
+  }
 }
 
 main().catch((err) => {