mover-os 4.7.7 → 4.7.9

package/src/dashboard/shortcut.js

@@ -0,0 +1,284 @@
+"use strict";
+
+// shortcut.js — cross-platform desktop launcher generator for Mover Studio.
+//
+// Produces a double-clickable launcher (named by the user, e.g. "My OS")
+// that opens the dashboard. The launcher invokes `node <install.js> open`
+// with ABSOLUTE paths baked in — a launcher opened from Finder / Explorer /
+// a desktop menu does NOT inherit the shell PATH, so `moveros` would not
+// resolve; baking node + entry makes it PATH-proof.
+//
+// Design split: the *content generators* are pure (string in → string out,
+// testable on any OS); `createShortcut()` is the thin writer that does FS +
+// (on Windows) a PowerShell call. Tests cover the generators directly.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { execFileSync } = require("child_process");
+
+// ── name handling ─────────────────────────────────────────────────────────
+
+// The display name the user chose (config.os_name), falling back to the
+// product default. Kept here so install + the `open` command + the dashboard
+// all resolve the same string.
+function studioName(config) {
+  const raw = config && (config.os_name || config.osName);
+  const n = String(raw == null ? "" : raw).trim();
+  return n || "Mover Studio";
+}
+
+// Filesystem-safe version of the name for the bundle / .desktop / .lnk file
+// name. Strips path separators, colons, and control chars; collapses spaces.
+function fileSafeName(name) {
+  return String(name || "Mover Studio")
+    .replace(/[\/\\:*?"<>|\u0000-\u001f]/g, "")
+    .replace(/\s+/g, " ")
+    .trim() || "Mover Studio";
+}
+
+function xmlEscape(s) {
+  return String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+// PowerShell single-quoted strings escape a literal quote by doubling it.
+function psEscape(s) {
+  return String(s).replace(/'/g, "''");
+}
+
+// ── macOS: a minimal .app bundle (no Terminal window) ─────────────────────
+
+function macLauncherScript({ nodeBin, entry }) {
+  // Resolve node AT LAUNCH. The baked path is tried first (fast, usually right),
+  // but a Finder-launched .app inherits only a minimal PATH and node version
+  // managers (nvm/fnm) relocate the binary on upgrade — so fall back to a
+  // login-shell lookup and the common install locations before giving up.
+  // (Baking the raw binary alone was brittle: an `nvm install 22` would orphan
+  // the launcher with no error.) Quoted paths tolerate spaces.
+  return [
+    "#!/bin/bash",
+    `NODE="${nodeBin}"`,
+    `[ -x "$NODE" ] || NODE="$(bash -lc 'command -v node' 2>/dev/null)"`,
+    `[ -x "$NODE" ] || for c in /usr/local/bin/node /opt/homebrew/bin/node "$HOME/.volta/bin/node"; do [ -x "$c" ] && NODE="$c" && break; done`,
+    `exec "$NODE" "${entry}" open`,
+    "",
+  ].join("\n");
+}
+
+function macInfoPlist({ name }) {
+  const safe = xmlEscape(name);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>${safe}</string>
+  <key>CFBundleDisplayName</key><string>${safe}</string>
+  <key>CFBundleIdentifier</key><string>dev.moveros.studio</string>
+  <key>CFBundleVersion</key><string>1.0</string>
+  <key>CFBundleShortVersionString</key><string>1.0</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleExecutable</key><string>launcher</string>
+  <key>LSUIElement</key><true/>
+</dict>
+</plist>
+`;
+}
+
+// ── Windows: a .bat (always works) + a .lnk via PowerShell (no console flash)
+
+function winBatLauncher({ nodeBin, entry }) {
+  // Trampoline: resolve node at launch (the baked path can go stale after an
+  // nvm-windows upgrade), then detach with `start "" /b`. NOTE: double-clicking
+  // a .bat shows a brief console host window — acceptable for the durable
+  // fallback; the .lnk (WindowStyle 7) is the no-flash primary. CRLF endings.
+  return [
+    "@echo off",
+    `set "NODE=${nodeBin}"`,
+    `if not exist "%NODE%" for /f "delims=" %%i in ('where node 2^>nul') do set "NODE=%%i"`,
+    `start "" /b "%NODE%" "${entry}" open`,
+    "",
+  ].join("\r\n");
+}
+
+// A PowerShell script body that creates a .lnk pointing at node with args,
+// hidden window (WindowStyle 7 = minimized — closest to "no flash" for a
+// console target). Icon optional.
+function winLnkPowerShell({ lnkPath, targetPath, args, workdir, iconPath }) {
+  const lines = [
+    `$ws = New-Object -ComObject WScript.Shell;`,
+    `$s = $ws.CreateShortcut('${psEscape(lnkPath)}');`,
+    `$s.TargetPath = '${psEscape(targetPath)}';`,
+  ];
+  if (args) lines.push(`$s.Arguments = '${psEscape(args)}';`);
+  lines.push(`$s.WorkingDirectory = '${psEscape(workdir)}';`);
+  lines.push(`$s.WindowStyle = 7;`);
+  if (iconPath) lines.push(`$s.IconLocation = '${psEscape(iconPath)}';`);
+  lines.push(`$s.Save();`);
+  return lines.join("\n") + "\n";
+}
+
+// ── Linux: a .desktop entry ───────────────────────────────────────────────
+
+function linuxDesktopEntry({ name, nodeBin, entry, iconPath }) {
+  const icon = iconPath ? `Icon=${iconPath}\n` : "";
+  // A desktop-entry value is a SINGLE line — strip ALL control chars (CR/LF and
+  // other C0/DEL), not just LF, so a stray char can't inject or corrupt lines.
+  const safeName = String(name).replace(/[\x00-\x1f\x7f]/g, " ").trim() || "Mover Studio";
+  // `bash -lc` loads the login PATH so an nvm/fnm-managed node resolves even
+  // though a .desktop launcher doesn't inherit an interactive shell; the baked
+  // path is tried first for speed.
+  const exec = `bash -lc 'NODE="${nodeBin}"; [ -x "$NODE" ] || NODE="$(command -v node)"; exec "$NODE" "${entry}" open'`;
+  return `[Desktop Entry]
+Type=Application
+Name=${safeName}
+Comment=Open your Mover OS dashboard
+Exec=${exec}
+${icon}Terminal=false
+Categories=Utility;Office;
+`;
+}
+
+// Resolve the REAL Windows Desktop folder. OneDrive "Known Folder Move" (the
+// Win11 consumer default) redirects Desktop to ~/OneDrive/Desktop, so a naive
+// ~/Desktop would drop the shortcut where the user never sees it. Ask Windows
+// for the actual path; fall back to ~/Desktop if PowerShell is unavailable.
+function resolveWindowsDesktop(home) {
+  try {
+    const out = execFileSync(
+      "powershell",
+      ["-NoProfile", "-NonInteractive", "-Command", "[Environment]::GetFolderPath('Desktop')"],
+      { encoding: "utf8" }
+    ).trim();
+    if (out && fs.existsSync(out)) return out;
+  } catch (_) { /* fall through to the default */ }
+  return path.join(home, "Desktop");
+}
+
+// ── writer ────────────────────────────────────────────────────────────────
+
+// Create the launcher for the current platform. Returns { created: string[],
+// platform, skipped?: reason }. Never throws on a single-platform failure —
+// returns a skipped reason so install can continue.
+function createShortcut({ name, nodeBin, entry, iconPath, platform, homeDir, desktopDir } = {}) {
+  const plat = platform || process.platform;
+  const home = homeDir || os.homedir();
+  const display = studioName({ os_name: name });
+  const fname = fileSafeName(display);
+  const created = [];
+
+  try {
+    if (plat === "darwin") {
+      const appDir = path.join(home, "Applications", `${fname}.app`);
+      const macosDir = path.join(appDir, "Contents", "MacOS");
+      fs.mkdirSync(macosDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(appDir, "Contents", "Info.plist"),
+        macInfoPlist({ name: display }),
+        "utf8"
+      );
+      const launcher = path.join(macosDir, "launcher");
+      fs.writeFileSync(launcher, macLauncherScript({ nodeBin, entry }), "utf8");
+      fs.chmodSync(launcher, 0o755);
+      created.push(appDir);
+      // The checkbox promises a DESKTOP shortcut; the .app lives in
+      // ~/Applications (Spotlight/Launchpad home). A Desktop symlink makes the
+      // promise literally true — Finder double-clicks straight through it.
+      // Best-effort: a missing Desktop dir never fails the launcher.
+      try {
+        const desktop = desktopDir || path.join(home, "Desktop");
+        if (fs.existsSync(desktop)) {
+          const linkPath = path.join(desktop, `${fname}.app`);
+          // Refresh ONLY a symlink. unlinkSync deletes regular files too (it
+          // only refuses directories), so an unconditional unlink would destroy
+          // a user's real file that happens to carry this name (terra catch).
+          // The lstat->unlink pair is not atomic; a local process racing this
+          // exact window could still lose a swapped-in file. Accepted: POSIX
+          // offers no unlink-if-symlink, rename-over clobbers unconditionally,
+          // and a hostile same-user process can delete files directly anyway.
+          try { if (fs.lstatSync(linkPath).isSymbolicLink()) fs.unlinkSync(linkPath); } catch (_) { /* absent — nothing to clear */ }
+          if (!fs.existsSync(linkPath)) { fs.symlinkSync(appDir, linkPath); created.push(linkPath); }
+        }
+      } catch (_) { /* desktop optional */ }
+      return { created, platform: plat };
+    }
+
+    if (plat === "win32") {
+      const desktop = desktopDir || resolveWindowsDesktop(home);
+      // The durable trampoline lives in a STABLE dir (survives node upgrades);
+      // the .lnk on the Desktop just points at it. If PowerShell is blocked we
+      // drop the .bat straight on the Desktop as the (still durable) fallback.
+      const launcherDir = path.join(home, ".mover", "launcher");
+      fs.mkdirSync(launcherDir, { recursive: true });
+      const batPath = path.join(launcherDir, `${fname}.bat`);
+      fs.writeFileSync(batPath, winBatLauncher({ nodeBin, entry }), "utf8");
+      created.push(batPath);
+
+      const lnkPath = path.join(desktop, `${fname}.lnk`);
+      let lnkOk = false;
+      try {
+        const ps = winLnkPowerShell({ lnkPath, targetPath: batPath, workdir: launcherDir, iconPath });
+        execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], {
+          stdio: "ignore",
+        });
+        if (fs.existsSync(lnkPath)) { created.push(lnkPath); lnkOk = true; }
+      } catch (_) { /* PowerShell blocked — fall back to a Desktop .bat below */ }
+      if (!lnkOk) {
+        try {
+          const deskBat = path.join(desktop, `${fname}.bat`);
+          fs.writeFileSync(deskBat, winBatLauncher({ nodeBin, entry }), "utf8");
+          created.push(deskBat);
+        } catch (_) { /* Desktop may not exist (headless) — the stable .bat still works */ }
+      }
+      return { created, platform: plat };
+    }
+
+    if (plat === "linux") {
+      const appsDir = path.join(home, ".local", "share", "applications");
+      fs.mkdirSync(appsDir, { recursive: true });
+      const content = linuxDesktopEntry({ name: display, nodeBin, entry, iconPath });
+      const appFile = path.join(appsDir, "mover-studio.desktop");
+      fs.writeFileSync(appFile, content, "utf8");
+      fs.chmodSync(appFile, 0o755);
+      created.push(appFile);
+      // Best-effort copy to the Desktop too (may not exist on headless boxes).
+      const desktop = desktopDir || path.join(home, "Desktop");
+      try {
+        if (fs.existsSync(desktop)) {
+          const deskFile = path.join(desktop, `${fname}.desktop`);
+          fs.writeFileSync(deskFile, content, "utf8");
+          fs.chmodSync(deskFile, 0o755);
+          // GNOME 3.28+ shows an untrusted .desktop on the Desktop as a plain
+          // text file until "Allow Launching" is granted. Mark it trusted so it
+          // is double-clickable. Best-effort: gio may be absent on non-GNOME.
+          try {
+            execFileSync("gio", ["set", deskFile, "metadata::trusted", "true"], { stdio: "ignore" });
+          } catch (_) { /* non-GNOME or gio missing — menu entry still works */ }
+          created.push(deskFile);
+        }
+      } catch (_) { /* desktop optional */ }
+      return { created, platform: plat };
+    }
+
+    return { created, platform: plat, skipped: `unsupported platform: ${plat}` };
+  } catch (err) {
+    return { created, platform: plat, skipped: `shortcut write failed: ${err.message}` };
+  }
+}
+
+module.exports = {
+  studioName,
+  fileSafeName,
+  xmlEscape,
+  psEscape,
+  macLauncherScript,
+  macInfoPlist,
+  winBatLauncher,
+  winLnkPowerShell,
+  linuxDesktopEntry,
+  createShortcut,
+};

package/src/dashboard/static/setup-poc.html

@@ -0,0 +1,306 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Mover OS · Setup</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Archivo:wght@400;500;600&family=Newsreader:opsz,wght@6..72,400;6..72,500&display=swap" rel="stylesheet">
+<!-- Shared Mover OS tokens (same palette as the dashboard) so /setup is
+     native, not alien. Canonical values live in styles/v6/v3.css. -->
+<link rel="stylesheet" href="/assets/mover-system.css">
+<style>
+  /* page layout + class skinning — colours come from mover-system.css tokens */
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--m-bg); color: var(--m-ink);
+    font: 15px/1.6 var(--m-sans); -webkit-font-smoothing: antialiased; }
+  body::before { /* faint warm wash, matches the app's atmosphere */
+    content: ""; position: fixed; inset: 0; z-index: -1; pointer-events: none;
+    background: radial-gradient(70% 50% at 82% 0%, var(--m-gold-glow), transparent 60%);
+    opacity: 0.5; }
+  .wrap { max-width: 680px; margin: 0 auto; padding: 32px 22px 116px; }
+  header { display: flex; align-items: center; justify-content: space-between;
+    padding: 4px 0 22px; border-bottom: 1px solid var(--m-line); margin-bottom: 26px; }
+  .brand { font-family: var(--m-serif); font-size: 23px; color: var(--m-ink); }
+  .brand small { font-family: var(--m-sans); color: var(--m-ink-3); font-size: 12px;
+    margin-left: 11px; letter-spacing: .04em; }
+  .status { display: flex; align-items: center; gap: 8px; color: var(--m-ink-2);
+    font-size: 12px; font-variant-numeric: tabular-nums; }
+  .dot { width: 8px; height: 8px; border-radius: 50%; background: #4a4742; }
+  .dot:not(.off) { background: var(--m-good); box-shadow: 0 0 8px rgba(169,191,130,0.55); }
+  .dot.off { background: #4a4742; box-shadow: none; }
+  .card { background: var(--m-card); border: 1px solid var(--m-line); border-radius: 16px;
+    padding: 18px 20px; margin: 14px 0;
+    box-shadow: 0 1px 0 rgba(255,240,214,0.05) inset, 0 30px 60px -34px rgba(0,0,0,0.9);
+    animation: rise .24s var(--m-ease); }
+  .q { font-family: var(--m-serif); font-size: 21px; line-height: 1.4; color: var(--m-ink); }
+  .a { color: var(--m-ink-2); font-size: 14px; margin-top: 6px; }
+  .perm { border-color: var(--m-gold-line); }
+  .perm .lbl { color: var(--m-gold-2); font-size: 10px; text-transform: uppercase;
+    letter-spacing: .14em; margin-bottom: 8px; }
+  .row { display: flex; gap: 10px; margin-top: 16px; }
+  button { font: inherit; border: 1px solid var(--m-line-2); background: rgba(255,240,214,0.03);
+    color: var(--m-ink); padding: 10px 17px; border-radius: 11px; cursor: pointer;
+    transition: border-color .15s, background .15s; }
+  button:hover:not(:disabled) { border-color: var(--m-gold-line); }
+  button.primary { background: linear-gradient(180deg, var(--m-gold-2), var(--m-gold));
+    color: var(--m-on-gold); border-color: transparent; font-weight: 600;
+    box-shadow: 0 0 24px -8px var(--m-gold-glow); }
+  button:disabled { opacity: .4; cursor: default; box-shadow: none; }
+  .composer { position: fixed; left: 0; right: 0; bottom: 0;
+    background: linear-gradient(transparent, var(--m-bg) 34%); padding: 18px 22px; }
+  .composer .inner { max-width: 680px; margin: 0 auto; display: flex; gap: 10px; }
+  textarea { flex: 1; background: var(--m-bg-2); border: 1px solid var(--m-line-2);
+    border-radius: 12px; color: var(--m-ink); padding: 13px; font: inherit; resize: none; height: 50px; }
+  textarea:focus { outline: none; border-color: var(--m-gold-line); }
+  @keyframes rise { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } }
+  /* Thinking indicator — the wait sells the product: it's not loading, it's
+     reading you. A live gold orb + rotating perceptive verbs. */
+  .thinking { display: flex; align-items: center; gap: 14px; }
+  .thinking .orb { position: relative; width: 22px; height: 22px; flex: none; }
+  .thinking .orb span { position: absolute; inset: 0; border-radius: 50%;
+    border: 1.5px solid var(--m-gold-line); animation: ripple 1.9s var(--m-ease) infinite; }
+  .thinking .orb span:nth-child(2) { animation-delay: .63s; }
+  .thinking .orb span:nth-child(3) { animation-delay: 1.26s; }
+  .thinking .orb::after { content: ""; position: absolute; inset: 7px; border-radius: 50%;
+    background: var(--m-gold); box-shadow: 0 0 12px -1px var(--m-gold-glow);
+    animation: breathe 1.9s var(--m-ease) infinite; }
+  .thinking .verb { font-family: var(--m-serif); font-size: 18px; color: var(--m-gold-2); }
+  .thinking .verb em { font-style: normal; opacity: .55; animation: dots 1.4s ease-in-out infinite; }
+  .thinking .verb.swap { animation: fade .7s var(--m-ease); }
+  @keyframes ripple { from { transform: scale(.5); opacity: .85; } to { transform: scale(1.4); opacity: 0; } }
+  @keyframes breathe { 0%,100% { opacity: .5; transform: scale(.82); } 50% { opacity: 1; transform: scale(1.1); } }
+  @keyframes dots { 0%,100% { opacity: .25; } 50% { opacity: .7; } }
+  @keyframes fade { from { opacity: 0; transform: translateY(2px); } to { opacity: 1; transform: none; } }
+  @media (prefers-reduced-motion: reduce) {
+    .thinking .orb span, .thinking .orb::after, .thinking .verb em, .thinking .verb.swap { animation: none; }
+    .thinking .orb::after { opacity: .85; }
+  }
+  /* Synthesis loader + value prophecy (D5) — the payoff moment: the system builds
+     the Engine from THEIR answers (live checklist), then names what it can now drive. */
+  .synth-h { font-family: var(--m-serif); font-size: 18px; color: var(--m-gold-2); margin-bottom: 14px; }
+  .synth-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 10px; }
+  .synth-list li { display: flex; align-items: center; gap: 12px; color: var(--m-ink-3); font-size: 15px;
+    transition: color .35s var(--m-ease); }
+  .synth-list li.on { color: var(--m-ink); }
+  .synth-list li.done { color: var(--m-ink-2); }
+  .synth-list .tick { width: 17px; height: 17px; border-radius: 50%; border: 1.5px solid var(--m-line-2);
+    flex: none; position: relative; transition: border-color .3s, background .3s; }
+  .synth-list li.on .tick { border-color: var(--m-gold); border-top-color: transparent;
+    box-shadow: 0 0 10px -2px var(--m-gold-glow); animation: spin .8s linear infinite; }
+  .synth-list li.done .tick { border-color: var(--m-gold); background: var(--m-gold); animation: none; }
+  .synth-list li.done .tick::after { content: ""; position: absolute; left: 5.5px; top: 2px; width: 4px; height: 8px;
+    border: solid var(--m-on-gold); border-width: 0 1.6px 1.6px 0; transform: rotate(45deg); }
+  @keyframes spin { to { transform: rotate(360deg); } }
+  .prophecy { border-color: var(--m-gold-line); }
+  .proph-eyebrow { font-family: var(--m-sans); font-size: 10px; text-transform: uppercase; letter-spacing: .15em;
+    color: var(--m-gold-2); margin-bottom: 10px; }
+  .proph-body { font-family: var(--m-serif); font-size: 20px; line-height: 1.45; color: var(--m-ink); }
+  @media (prefers-reduced-motion: reduce) { .synth-list li.on .tick { animation: none; } }
+  /* Boot flow — D7 connect · D3 import · D4 recommend */
+  .drop-h, .rec-h { font-family: var(--m-serif); font-size: 18px; color: var(--m-gold-2); }
+  .drop-sub { color: var(--m-ink-2); font-size: 13px; margin: 6px 0 14px; }
+  .dropzone { border: 1.5px dashed var(--m-line-2); border-radius: 12px; padding: 26px; text-align: center;
+    color: var(--m-ink-3); font-size: 14px; cursor: pointer; transition: border-color .15s, color .15s, background .15s; }
+  .dropzone:hover, .dropzone.over { border-color: var(--m-gold-line); color: var(--m-ink-2); background: rgba(227,196,137,0.04); }
+  .droplist { color: var(--m-ink-2); font-size: 12px; margin-top: 10px; min-height: 1px; }
+  .rec-list { list-style: none; margin: 12px 0 0; padding: 0; display: flex; flex-direction: column; gap: 11px; }
+  .rec-list li { display: flex; flex-direction: column; gap: 2px; }
+  .rec-name { font-family: var(--m-serif); font-size: 15px; color: var(--m-ink); }
+  .rec-why { color: var(--m-ink-3); font-size: 12.5px; }
+  .conn-row { display: flex; align-items: center; gap: 9px; margin-top: 8px; color: var(--m-ink-2); font-size: 14px; }
+  .conn-row .ok { color: var(--m-good); } .conn-row .no { color: var(--m-ink-3); }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <header>
+    <div class="brand">Mover OS<small>Setup · local</small></div>
+    <div class="status"><span class="dot off" id="dot"></span><span id="st">connecting…</span></div>
+  </header>
+  <div id="feed"></div>
+</div>
+<div class="composer"><div class="inner">
+  <textarea id="inp" placeholder="Your answer…" disabled></textarea>
+  <button class="primary" id="send" disabled>Send</button>
+  <button id="end" disabled>End</button>
+</div></div>
+<script>
+const feed=document.getElementById('feed'), inp=document.getElementById('inp'),
+      sendBtn=document.getElementById('send'), endBtn=document.getElementById('end'),
+      dot=document.getElementById('dot'), st=document.getElementById('st');
+let token=null, sessionId=null, es=null, busy=false, completed=false;
+
+function card(cls){ const d=document.createElement('div'); d.className='card '+(cls||''); feed.appendChild(d); window.scrollTo(0,document.body.scrollHeight); return d; }
+function setBusy(b){ busy=b; sendBtn.disabled=b||!sessionId; inp.disabled=b||!sessionId; }
+function status(t,on){ st.textContent=t; dot.className='dot'+(on?'':' off'); }
+async function post(p,body){ const r=await fetch(p,{method:'POST',headers:{'Content-Type':'application/json','X-Mover-Token':token},body:JSON.stringify(body)}); return r.json(); }
+
+// Thinking indicator — perceptive, "getting to know you" verbs. The cold-start
+// wait (~30-60s on the first question) is where the promise lands: the screen
+// shouldn't look dead, it should look like the system is reading you.
+const THINK_VERBS=["Listening","Reading you","Connecting threads","Forming a picture","Taking it in","Joining the dots","Turning it over","Sizing it up","Piecing it together","Sketching you in","Reading between the lines","Weighing it","Filing that away","Getting to know you","Mulling it over","Squaring it up"];
+let thinkingEl=null, thinkTimer=null, lastVerb=-1;
+function nextVerb(){ let i; do{ i=Math.floor(Math.random()*THINK_VERBS.length); }while(i===lastVerb&&THINK_VERBS.length>1); lastVerb=i; return THINK_VERBS[i]; }
+function paintVerb(){ if(!thinkingEl)return; const v=thinkingEl.querySelector('.verb'); v.innerHTML=nextVerb()+'<em>…</em>'; v.classList.remove('swap'); void v.offsetWidth; v.classList.add('swap'); }
+function showThinking(){ if(thinkingEl)return; thinkingEl=card('thinking'); thinkingEl.innerHTML='<div class="orb"><span></span><span></span><span></span></div><div class="verb"></div>'; paintVerb(); thinkTimer=setInterval(paintVerb,2300); window.scrollTo(0,document.body.scrollHeight); }
+function hideThinking(){ if(thinkTimer){clearInterval(thinkTimer);thinkTimer=null;} if(thinkingEl){thinkingEl.remove();thinkingEl=null;} }
+
+// D5 — synthesis loader + value prophecy (Mobbin BitePal/Brilliant pattern). When the
+// interview agent emits [[SETUP_COMPLETE]], stop asking and show the system building the
+// Engine from THEIR answers (live checklist), then name the outcome it can now drive.
+const SYNTH_STEPS=["Reading your answers","Writing your Identity","Setting your Strategy","Mapping your leverage","Drafting tomorrow's plan"];
+function runSynthesis(prophecy){
+  completed=true; hideThinking(); setBusy(true); endBtn.disabled=true; status('building your Engine',true);
+  const c=card('synth'); c.innerHTML='<div class="synth-h">Building your Engine</div><ul class="synth-list"></ul>';
+  const ul=c.querySelector('.synth-list');
+  SYNTH_STEPS.forEach(s=>{ const li=document.createElement('li'); const t=document.createElement('span'); t.className='tick'; const lbl=document.createElement('span'); lbl.textContent=s; li.appendChild(t); li.appendChild(lbl); ul.appendChild(li); });
+  const items=[...ul.children]; let i=0;
+  const step=()=>{ if(i>0){ items[i-1].classList.remove('on'); items[i-1].classList.add('done'); }
+    if(i<items.length){ items[i].classList.add('on'); i++; window.scrollTo(0,document.body.scrollHeight); setTimeout(step,780); }
+    else setTimeout(()=>revealProphecy(prophecy),460); };
+  step();
+}
+function revealProphecy(text){
+  const c=card('prophecy');
+  const eb=document.createElement('div'); eb.className='proph-eyebrow'; eb.textContent='Your Engine is ready';
+  const body=document.createElement('div'); body.className='proph-body'; body.textContent=(text||'Everything you told me is captured. Your Engine is ready.').slice(0,600);
+  c.appendChild(eb); c.appendChild(body);
+  status('setup complete',true); window.scrollTo(0,document.body.scrollHeight);
+  finalizeEngine(text); // A engine preview, then D4 recs, then the CTA
+}
+// A — preview the Engine the system seeded from the interview (dry-run, sandboxed on
+// this machine; the real write happens only on a fresh install). Honest receipt for the
+// synthesis loader: shows the actual files prepared, never claims a write that didn't run.
+function finalizeEngine(workText){
+  post('/api/session/finalize',{sessionId,dryRun:true}).then(r=>{
+    if(r&&r.ok&&r.fileCount){
+      const c=card('rec');
+      const h=document.createElement('div'); h.className='rec-h'; h.textContent='Seeded from your answers'; c.appendChild(h);
+      const sub=document.createElement('div'); sub.className='drop-sub'; sub.style.margin='6px 0 0';
+      sub.textContent=r.fileCount+' Engine files prepared: '+(r.files||[]).map(f=>(f.path||'').split('/').pop().replace('.md','')).filter(Boolean).join(', ')+'.';
+      c.appendChild(sub);
+    }
+  }).catch(()=>{}).finally(()=>fetchRec(workText));
+}
+// D4 — recommendation card off the interview, keyed on the prophecy text.
+function fetchRec(workText){
+  post('/api/setup/recommend',{profile:{work:workText||''}}).then(r=>{
+    if(r&&r.ok){
+      const recs=(r.recommended||[]).slice(0,5);
+      if(r.installAll||recs.length){
+        const c=card('rec');
+        const h=document.createElement('div'); h.className='rec-h'; h.textContent=r.installAll?'Recommended: the full core toolkit':'Skills matched to your work'; c.appendChild(h);
+        if(!r.installAll){ const ul=document.createElement('ul'); ul.className='rec-list';
+          recs.forEach(x=>{ const li=document.createElement('li'); const n=document.createElement('span'); n.className='rec-name'; n.textContent=x.label||x.skill;
+            const w=document.createElement('span'); w.className='rec-why'; w.textContent=x.reason||''; li.appendChild(n); li.appendChild(w); ul.appendChild(li); });
+          c.appendChild(ul); }
+      }
+    }
+    finalCta();
+  }).catch(()=>finalCta());
+}
+function finalCta(){
+  const c=card();
+  const row=document.createElement('div'); row.className='row';
+  const cta=document.createElement('button'); cta.className='primary'; cta.textContent='Open your dashboard';
+  cta.onclick=async()=>{ try{ if(es)es.close(); await post('/api/session/end',{sessionId}); }catch(_){} location.href='/'; };
+  row.appendChild(cta); c.appendChild(row); window.scrollTo(0,document.body.scrollHeight);
+}
+
+async function boot(){
+  const h=await (await fetch('/api/health')).json(); token=h.token;
+  // D7 — confirm a runnable agent before starting; else show the connect step.
+  let det=null; try{ det=await (await fetch('/api/agents/detect')).json(); }catch(_){}
+  const claude=det&&det.agents&&det.agents.find(a=>a.id==='claude-code');
+  if(!claude||!claude.runnable){ showConnect(det); return; }
+  startSession();
+}
+function showConnect(det){
+  const c=card('perm');
+  c.innerHTML='<div class="lbl">Connect your agent</div><div class="q">Mover OS runs setup through your own AI agent.</div>';
+  ((det&&det.agents)||[]).forEach(a=>{ const r=document.createElement('div'); r.className='conn-row';
+    r.innerHTML='<span class="'+(a.runnable?'ok':'no')+'">'+(a.runnable?'●':'○')+'</span> '+a.name+' — '+(a.runnable?'ready':(a.present?'installed, not connected':'not installed')); c.appendChild(r); });
+  const row=document.createElement('div'); row.className='row';
+  const retry=document.createElement('button'); retry.className='primary'; retry.textContent='Retry';
+  retry.onclick=()=>{ c.remove(); boot(); };
+  row.appendChild(retry); c.appendChild(row);
+}
+async function startSession(){
+  const r=await post('/api/session/start',{agent:'claude-code'});
+  if(!r.ok){ status('start failed: '+r.error,false); return; }
+  sessionId=r.sessionId; status('session live',true); endBtn.disabled=false;
+  es=new EventSource('/api/session/events?id='+encodeURIComponent(sessionId));
+  es.onmessage=(m)=>{ let ev; try{ev=JSON.parse(m.data)}catch(_){return} handle(ev); };
+  es.onerror=()=>status('stream dropped',false);
+  offerImport();
+}
+function offerImport(){
+  setBusy(true); // lock the composer until the interview actually starts
+  const c=card('drop');
+  c.innerHTML='<div class="drop-h">Bring your existing notes?</div>'
+    +'<div class="drop-sub">Drop exports from Apple Notes, Google Keep, Obsidian, or plain text. They stay on your machine, used only to skip questions the system can already answer.</div>'
+    +'<div class="dropzone" id="dz">Drop files here, or click to choose</div>'
+    +'<input type="file" id="dzin" multiple hidden>'
+    +'<div class="droplist" id="dl"></div>'
+    +'<div class="row"><button class="primary" id="imp" disabled>Import</button><button id="skip">Skip</button></div>';
+  const dz=c.querySelector('#dz'), inp2=c.querySelector('#dzin'), dl=c.querySelector('#dl'), imp=c.querySelector('#imp'), skip=c.querySelector('#skip');
+  let picked=[];
+  const refresh=()=>{ dl.textContent=picked.length?('Ready: '+picked.map(f=>f.name).join(', ')):''; imp.disabled=!picked.length; };
+  dz.onclick=()=>inp2.click();
+  inp2.onchange=()=>{ picked=[...inp2.files]; refresh(); };
+  dz.ondragover=(e)=>{ e.preventDefault(); dz.classList.add('over'); };
+  dz.ondragleave=()=>dz.classList.remove('over');
+  dz.ondrop=(e)=>{ e.preventDefault(); dz.classList.remove('over'); picked=[...e.dataTransfer.files]; refresh(); };
+  skip.onclick=()=>{ c.remove(); beginInterview(); };
+  imp.onclick=async()=>{
+    imp.disabled=true; skip.disabled=true; imp.textContent='Reading…';
+    const files=[]; for(const f of picked){ try{ files.push({name:f.name, content:await f.text()}); }catch(_){} }
+    try{ const r=await post('/api/session/ingest',{sessionId,files}); if(r&&r.injected) status('imported '+(r.chars||0)+' chars',true); }catch(_){}
+    c.remove(); beginInterview();
+  };
+}
+function beginInterview(){
+  setBusy(true); showThinking();
+  post('/api/session/send',{sessionId,text:'Begin the setup interview. Ask your first question.'});
+}
+
+function handle(ev){
+  if(ev.kind==='assistant'){
+    hideThinking();
+    const SENT='[[SETUP_COMPLETE]]';
+    if(ev.text.indexOf(SENT)>=0){
+      const parts=ev.text.split(SENT); const pre=(parts[0]||'').trim(); const prophecy=parts.slice(1).join(' ').trim();
+      if(pre){ const c=card(); const q=document.createElement('div'); q.className='q'; q.textContent=pre; c.appendChild(q); }
+      runSynthesis(prophecy); return;
+    }
+    const c=card(); const q=document.createElement('div'); q.className='q'; q.textContent=ev.text; c.appendChild(q);
+  }
+  else if(ev.kind==='result'){ hideThinking(); if(!completed){ setBusy(false); inp.focus(); } }
+  else if(ev.kind==='permission'){
+    hideThinking();
+    const id=ev.requestId; const c=card('perm');
+    c.innerHTML='<div class="lbl">Permission requested</div>';
+    const q=document.createElement('div'); q.className='q'; q.textContent=(JSON.stringify(ev.request)||'').slice(0,240); c.appendChild(q);
+    const row=document.createElement('div'); row.className='row';
+    const allow=document.createElement('button'); allow.className='primary'; allow.textContent='Allow';
+    const deny=document.createElement('button'); deny.textContent='Deny';
+    // Don't optimistically resolve: disable + show a pending note so a wrong
+    // control_response shape can't look "answered" (Codex MF3). The session
+    // proceeding (next event) is the real confirmation.
+    const decide=(d)=>{ allow.disabled=true; deny.disabled=true; const note=document.createElement('span'); note.className='a'; note.style.marginLeft='8px'; note.textContent=d+' sent…'; row.appendChild(note); post('/api/session/approve',{sessionId,requestId:id,decision:d}); };
+    allow.onclick=()=>decide('allow');
+    deny.onclick=()=>decide('deny');
+    row.appendChild(allow); row.appendChild(deny); c.appendChild(row);
+  }
+  else if(ev.kind==='closed'||ev.kind==='error'){ hideThinking(); status('session ended',false); setBusy(true); endBtn.disabled=true; if(es)es.close(); }
+}
+
+sendBtn.onclick=async()=>{ const t=inp.value.trim(); if(!t||busy)return; const c=card(); const a=document.createElement('div'); a.className='a'; a.textContent='You: '+t; c.appendChild(a); inp.value=''; setBusy(true); showThinking(); await post('/api/session/send',{sessionId,text:t}); };
+inp.addEventListener('keydown',e=>{ if(e.key==='Enter'&&!e.shiftKey){e.preventDefault();sendBtn.click();} });
+endBtn.onclick=async()=>{ if(es)es.close(); await post('/api/session/end',{sessionId}); status('ended',false); setBusy(true); endBtn.disabled=true; };
+boot();
+</script>
+</body>
+</html>