opencode-bioresearcher 1.11.1 → 1.13.0

package/skills/bioresearcher-deep-research/references/report-template.md

@@ -67,6 +67,23 @@ the source of truth for citations]
 [queries that failed after retries, with reasons]
 ```
 
+## Map-first optional sections
+
+When the run used empirical cartography (SKILL.md Step 1.5), two OPTIONAL
+sections extend the mandatory structure. Both cite through the normal
+merged-ledger markers - cartography anchors are ordinary ledger records.
+
+- **Landscape** (inside Findings, after the selected aspects): one line per
+  discovered-but-unselected category, citing its cartography anchors -
+  acknowledged, not researched; the report must say so explicitly.
+- **Decision guide by question scenario** (after the findings/evidence
+  tables; DEFAULT-ON in map-first mode, skippable only if the user
+  declines): one compact table per user-confirmed question scenario -
+  scenario | recommended method sequence | tier | caveat - built only from
+  ledger-verified sources, with tiers labeled scope-relative.
+- Taxonomy disagreements between the field's own syntheses are reported in
+  Analysis Methodology or Findings - never silently resolved.
+
 ## Citation placement rules
 
 - Authored text uses semantic cite-key markers `[@pmid:...]`, groups

package/skills/bioresearcher-deep-research/references/tool-selection.md

@@ -5,10 +5,11 @@ Route a research question to the correct biomcp tool, then shape the call with
 
 ## Overview
 
-biomcp (npm `biomcp`, pinned `biomcp@1.4`) exposes 56 tools: 41 core plus 15
-environment-gated optional tools (3 database, 4 R analysis, 8 biowasm). This
-file routes question types to tools; per-domain parameter detail lives in the
-domain reference files.
+biomcp (npm `biomcp`, pinned `biomcp@1.6`) exposes 58 tools: 43 core plus 15
+environment-gated optional tools (3 database, 4 R analysis, 8 biowasm). The
+1.6 core set adds `journal_metrics` and `preprint_fulltext` to the article
+family. This file routes question types to tools; per-domain parameter
+detail lives in the domain reference files.
 
 > In MCP clients that prefix server tools (e.g. opencode with server name
 > 'biomcp'), tools appear as biomcp_article_search etc.
@@ -20,6 +21,8 @@ QUESTION TYPE
 ├─ Literature / papers / PubMed
 │   → article_search (query, source?, dateRange?, limit, offset)
 │   → article_get (id: PMID/PMCID/DOI, sections?, citation_mode?)
+│   → preprint_fulltext (bioRxiv/medRxiv preprint DOI, version?)   # on-demand full text; license disclosed
+│   → journal_metrics (journal name / NLM abbreviation / ISSN, limit <= 25)   # OpenAlex venue quality (2-yr citedness, h-index, i10, OA) before citing
 │   → details: references/article-literature.md
 │
 ├─ Clinical trials / NCT IDs
@@ -131,7 +134,7 @@ Question: "What evidence links BRAF V600E to melanoma drug resistance?"
 |---------|-------|-----|
 | `no_such_tool` for a db/analysis tool | feature not enabled, or enabled after server start (tools register at startup only) | set `DB_TYPE`/`ANALYSIS_R`/`ANALYSIS_BIOWASM` in the client env block, restart the client |
 | Tool error mentioning OncoKB token | `variant_oncokb` without `ONCOKB_TOKEN` | get a token (oncokb.org registration) and set it, or skip OncoKB |
-| gene_diseases returns an `_error` about DisGeNET | no `DISGENET_API_KEY` | the tool falls back to OpenTargets associations; add the key for DisGeNET data |
+| gene_diseases returns an `_error` row | BOTH DisGeNET and OpenTargets failed - not merely a missing key | without `DISGENET_API_KEY` the tool silently returns OpenTargets rows (source: "opentargets"); add the key for DisGeNET-grade associations |
 | variant_search returns nothing for "BRAF V600E" as `query` | compound free text is not a variant ID | use `gene="BRAF"`, `hgvsp="V600E"` as separate params (the tool also auto-splits a bare "GENE V600E" query, but explicit params are reliable) |
 | Trial pages repeat or skip | offset paging used on trial_search | use `page_token` cursor paging |
 

package/skills/bioresearcher-deep-research/references/utility-config.md

@@ -104,13 +104,13 @@ Check a feature's parameters in detail:
 | `no_such_tool` after enabling a feature | tools register at server start only | restart the client/session, then verify with `biomcp_configure` `{}` (`running_now`) |
 | set refused: "sensitive" | sensitive key class requires confirmation | re-send identical call with `confirm_sensitive: true` |
 | `cwd_refused` | server cwd is / or $HOME | use the client env block (error carries the translation) |
-| batch_get item row contains `_error` | that single ID failed (typo, unknown ID) | fix the ID and re-request just that item; other items succeeded |
+| batch_get item row contains `success: false` + `error` | that single ID failed (typo, unknown ID) | fix the ID and re-request just that item; the batch continues and other items succeeded |
 
 ## Integration notes
 
 - Smoke-test sequence for a fresh setup: `biomcp_configure` with `{}` ->
   confirm expected features `running_now` -> one cheap domain call.
-- `doctor` CLI complements this: `npx -y biomcp@1.4 doctor` (exit 0 = clear);
+- `doctor` CLI complements this: `npx -y biomcp@1.6 doctor` (exit 0 = clear);
   `--client opencode` emits a paste-ready client entry.
 - Multi-entity literature pulls (e.g. 10 PMIDs from article_search) belong in
   ONE `batch_get` call, not 10 article_get calls.

package/skills/bioresearcher-deep-research/references/worker-protocol.md

@@ -38,6 +38,18 @@ EXECUTION RULE: Do NOT read or inspect evidence-ledger.py or other skill scripts
   startup (via `${CLAUDE_PLUGIN_ROOT}`); the orchestrator sends ONLY the
   filled-in template below.
 
+## Cartographer workers (map-first mode)
+
+Cartography axes use the SAME worker contract (rules 1-9, file protocol,
+completion gate) with two substitutions: the deliverable is a CATEGORY MAP
+(`reports/<TOPIC>/category_map_<axis>.md`: one subsection per anchored
+category - name, one-line description, 1-3 anchor markers, maturity signals,
+surfacing queries - plus a Query Log and Evidence Gaps) instead of an aspect
+report, and the focus name is `cartography_<axis>`. The dispatch prompt
+template, axis archetypes, anti-pinning contract, and anchoring rule live in
+`references/cartography.md`. Tier A workers read that file too when the
+assigned focus starts with `cartography_`.
+
 ## File protocol
 
 - Output files (exactly TWO - together they are the self-contained
@@ -132,7 +144,10 @@ EXECUTION RULE: Do NOT read or inspect evidence-ledger.py or other skill scripts
       `python3 <SKILL_DIR>/scripts/evidence-ledger.py add <file> --stdin`,
       substituting the SKILL_DIR value from your prompt LITERALLY - it is a
       path string, NOT an environment variable (`$SKILL_DIR` in a shell
-      resolves to nothing and breaks the call). Pass records via a shell heredoc
+      resolves to nothing and breaks the call). Anchor every shell command
+      to the workspace root (`cd <workspace root> && python3 <SKILL_DIR>/...`)
+      so relative report paths resolve regardless of the shell's starting
+      directory. Pass records via a shell heredoc
       or with an array/JSONL file (`add <file> @<batch.json>`):
       ```bash
       python3 <SKILL_DIR>/scripts/evidence-ledger.py add reports/<TOPIC>/evidence/<YOUR-FOCUS>.jsonl --stdin << 'EOF'

package/skills/bioresearcher-onboard/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: bioresearcher-onboard
+description: "Bootstraps a project-local biomcp MCP server runtime in .bioresearcher-runtime/: downloads portable Node.js 22 (if missing), vendors biomcp with fast mirror support (official or npmmirror), configures optional features (R, Biowasm, SQLite), and registers the server in OpenCode, Claude Code, Cursor, ZCode, Pi, CodeBuddy, or WorkBuddy. Use when biomcp is not installed, when biomedical tools are missing, or on requests like setup bioresearcher, install biomcp, or onboard."
+license: Apache-2.0
+compatibility: "Unix-like shells (Linux, macOS) and Windows (PowerShell, cmd.exe); OpenCode, Claude Code, Cursor, ZCode, Pi Coding Agent, CodeBuddy, WorkBuddy"
+metadata:
+  version: "1.2.0"
+  source: "bioresearcher-skills"
+allowed-tools: Bash Read Write Edit
+---
+
+# BioMCP Project-Local Onboarding
+
+This skill sets up a self-contained, project-local BioMCP runtime in your
+working directory under `.bioresearcher-runtime/`.
+
+## What it does
+
+- Checks if the host has Node.js >= 22.13. If missing, downloads a pinned,
+  cryptographically verified portable Node.js LTS binary into
+  `.bioresearcher-runtime/node/` (zero global installation, does not touch `~`
+  or `/usr/local`).
+- Auto-detects network conditions (official distribution vs. fast npmmirror in
+  mainland China).
+- Installs `biomcp` locally into `.bioresearcher-runtime/node_modules/` with
+  sub-100ms startup latency and offline resilience.
+- Configures optional features (R analysis, Biowasm genomics, SQLite database)
+  and registers the server in your harness configuration (`opencode.json`
+  under the canonical `mcp.servers.biomcp` key, `.mcp.json`, etc.) without
+  overwriting existing settings.
+- Verifies the configuration using the built-in diagnostic doctor.
+
+## Steps
+
+Follow the steps below in order.
+
+### Step 1: Run Stage 0 Bootstrap
+
+Execute the bootstrap script corresponding to your operating system.
+
+**For Unix-like shells (Linux, macOS, Git Bash):**
+
+```bash
+bash skills/bioresearcher-onboard/scripts/bootstrap.sh
+```
+
+**For Windows (PowerShell):**
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File skills\bioresearcher-onboard\scripts\bootstrap.ps1
+```
+
+The script automatically:
+1. Reuses your host Node.js if version >= 22.13 is available.
+2. If missing, downloads and verifies the official portable Node.js archive into
+   `.bioresearcher-runtime/node/`.
+3. Installs `biomcp@1.6.0` into `.bioresearcher-runtime/node_modules/`.
+4. Updates your harness configuration (`opencode.json` or `.mcp.json`) with
+   absolute executable paths.
+
+### Step 2: Configure Optional Features (Optional)
+
+By default, the core biomedical tools (PubMed/literature, clinical trials,
+genes, variants, drugs, diseases, patents) and built-in SQLite are installed.
+
+If the user needs specialized capabilities, pass the corresponding flags to the
+bootstrap script or set environment variables before running:
+
+- **R / Bioconductor Analysis** (DESeq2, edgeR, limma; requires ~2 GB RAM):
+  Pass `--with-r` to install the `webr@0.6` peer dependency and enable R
+  analysis in `.biomcp.json`.
+- **Biowasm Analysis** (SAM/BAM/BED/BCF genomics tools):
+  Pass `--with-biowasm` to enable Biowasm in `.biomcp.json`.
+- **Local SQLite Database**:
+  Pass `--sqlite-path=<path_to_db>` (e.g. `--sqlite-path=data/research.db`).
+- **Client Override**:
+  Pass `--client=opencode`, `--client=claude-code`, `--client=cursor`,
+  `--client=zcode`, `--client=pi`, `--client=codebuddy`, or
+  `--client=workbuddy` if auto-detection should be overridden.
+
+Example with R analysis and SQLite enabled:
+
+```bash
+bash skills/bioresearcher-onboard/scripts/bootstrap.sh --with-r --sqlite-path=data/research.db
+```
+
+### Step 3: In-Session Feature Reconfiguration
+
+Once BioMCP is registered and running, you do not need to hand-edit
+configuration files. Use the built-in `biomcp_configure` tool to inspect or
+adjust features dynamically:
+
+- Inspect feature status:
+  `biomcp_configure(action="status")`
+- Enable or disable features:
+  `biomcp_configure(action="set", values={"features.analysis_r.enabled": true})`
+- Configure SQLite database:
+  `biomcp_configure(action="set", values={"features.database.enabled": true, "features.database.type": "sqlite", "features.database.sqlite_path": "data/research.db"}, confirm_sensitive=true)`
+
+### Step 4: Restart the Harness
+
+MCP servers are spawned at client startup. Instruct the user to restart their
+agent session or IDE to activate the newly connected BioMCP tools:
+
+- **OpenCode**: Restart the session or open a new terminal session.
+- **Claude Code**: Start a new session (`claude`).
+- **Cursor / VS Code**: Reload the window or restart the application.
+- **ZCode**: Reload the workspace or start a new ADE session.
+- **Pi Coding Agent**: Start a new agent session (`pi`).
+- **CodeBuddy**: Reload the window or restart the CLI session.
+- **WorkBuddy**: Restart the application or switch workspace.
+
+After restarting, verify connectivity by asking the agent to search for a gene
+or article (e.g., `gene_search(query="BRAF")`).

package/skills/bioresearcher-onboard/scripts/bootstrap.ps1

@@ -0,0 +1,96 @@
+# Stage 0 Zero-Dependency PowerShell Bootstrap for bioresearcher-onboard (Windows)
+# Checks for existing Node >= 22.13; if missing, downloads pinned portable
+# Node.js LTS into .bioresearcher-runtime\node, verifies SHA256, and hands off
+# execution to onboard.mjs.
+$ErrorActionPreference = "Stop"
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RuntimeRoot = if ($env:BIORESEARCHER_RUNTIME_DIR) { $env:BIORESEARCHER_RUNTIME_DIR } else { Join-Path (Get-Location).Path ".bioresearcher-runtime" }
+$NodeDir = Join-Path $RuntimeRoot "node"
+$NodeExe = Join-Path $NodeDir "node.exe"
+
+$NodeVer = "v22.14.0"
+
+# 1. Probe if host already satisfies Node >= 22.13
+if (Get-Command node -ErrorAction SilentlyContinue) {
+    try {
+        $check = node -e "var v=process.versions.node.split('.');process.exit((v[0]>22||(v[0]==22&&v[1]>=13))?0:1)"
+        if ($LASTEXITCODE -eq 0) {
+            Write-Host "[bioresearcher-onboard] Found host $(node -v) on PATH"
+            & node "$ScriptDir\onboard.mjs" @args
+            exit $LASTEXITCODE
+        }
+    } catch {}
+}
+
+# If already vendored in working directory, reuse directly
+if (Test-Path $NodeExe) {
+    $env:PATH = "$NodeDir;$env:PATH"
+    & "$NodeExe" "$ScriptDir\onboard.mjs" @args
+    exit $LASTEXITCODE
+}
+
+Write-Host "[bioresearcher-onboard] Host Node >= 22.13 not found. Bootstrapping portable Node.js $NodeVer into .bioresearcher-runtime\..."
+
+# 2. Architecture Detection
+$Arch = if ([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture -eq [System.Runtime.InteropServices.Architecture]::Arm64) {
+    "arm64"
+} else {
+    "x64"
+}
+
+# 3. Mirror Selection Probe (2-second integer timeout)
+$MirrorBase = "https://nodejs.org/dist/$NodeVer"
+$NpmRegistry = "https://registry.npmjs.org"
+try {
+    $req = [System.Net.WebRequest]::Create("https://nodejs.org/dist/")
+    $req.Timeout = 2000
+    $res = $req.GetResponse()
+    $res.Close()
+} catch {
+    Write-Host "[bioresearcher-onboard] nodejs.org unreachable; using npmmirror.com fast mirror"
+    $MirrorBase = "https://npmmirror.com/mirrors/node/$NodeVer"
+    $NpmRegistry = "https://registry.npmmirror.com"
+}
+
+$File = "node-$NodeVer-win-$Arch.zip"
+$DownloadUrl = "$MirrorBase/$File"
+
+$Checksums = @{
+    "x64"   = "55b639295920b219bb2acbcfa00f90393a2789095b7323f79475c9f34795f217"
+    "arm64" = "2d71f5f9b2fffa33baa108c07d74b0d24e0c3dd8f441d567772ae0e3dd4b1a22"
+}
+$ExpectedSha = $Checksums[$Arch]
+
+New-Item -ItemType Directory -Force -Path $RuntimeRoot | Out-Null
+$TmpArchive = Join-Path $RuntimeRoot "node.zip"
+
+Write-Host "[bioresearcher-onboard] Downloading $File..."
+Invoke-WebRequest -Uri $DownloadUrl -OutFile $TmpArchive -UseBasicParsing
+
+# 4. Checksum verification
+$ActualSha = (Get-FileHash -Path $TmpArchive -Algorithm SHA256).Hash.ToLower()
+if ($ActualSha -ne $ExpectedSha) {
+    Remove-Item -Force $TmpArchive -ErrorAction SilentlyContinue
+    Write-Error "SHA256 checksum verification failed for $File.`nExpected: $ExpectedSha`nActual:   $ActualSha"
+    exit 1
+}
+
+# 5. Extract and flatten layout
+$TmpExtract = Join-Path $RuntimeRoot "node-extract-tmp"
+if (Test-Path $TmpExtract) { Remove-Item -Recurse -Force $TmpExtract }
+New-Item -ItemType Directory -Force -Path $TmpExtract | Out-Null
+Expand-Archive -Path $TmpArchive -DestinationPath $TmpExtract -Force
+Remove-Item -Force $TmpArchive
+
+New-Item -ItemType Directory -Force -Path $NodeDir | Out-Null
+$ExtractedFolder = Get-ChildItem -Path $TmpExtract | Select-Object -First 1
+Get-ChildItem -Path $ExtractedFolder.FullName | Move-Item -Destination $NodeDir -Force
+Remove-Item -Recurse -Force $TmpExtract
+
+Write-Host "[bioresearcher-onboard] Portable Node.js ready: $(& $NodeExe -v)"
+
+# 6. Hand off to Stage 1
+$env:PATH = "$NodeDir;$env:PATH"
+$env:NPM_CONFIG_REGISTRY = $NpmRegistry
+& "$NodeExe" "$ScriptDir\onboard.mjs" @args
+exit $LASTEXITCODE

package/skills/bioresearcher-onboard/scripts/bootstrap.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Stage 0 Zero-Dependency Bootstrap for bioresearcher-onboard.
+# Checks for existing Node >= 22.13; if missing, downloads pinned portable
+# Node.js LTS into .bioresearcher-runtime/node, verifies SHA256, and hands off
+# execution to onboard.mjs.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+RUNTIME_ROOT="${BIORESEARCHER_RUNTIME_DIR:-$PWD/.bioresearcher-runtime}"
+NODE_DIR="$RUNTIME_ROOT/node"
+NODE_BIN="$NODE_DIR/bin/node"
+
+NODE_REQ_MAJ=22
+NODE_REQ_MIN=13
+NODE_VER="v22.14.0"
+
+# 1. Probe if host already satisfies Node >= 22.13
+if command -v node >/dev/null 2>&1; then
+  if node -e "var v=process.versions.node.split('.');process.exit((v[0]>$NODE_REQ_MAJ||(v[0]==$NODE_REQ_MAJ&&v[1]>=$NODE_REQ_MIN))?0:1)" 2>/dev/null; then
+    echo "[bioresearcher-onboard] Found host $(node -v) at $(command -v node)"
+    exec node "$SCRIPT_DIR/onboard.mjs" "$@"
+  fi
+fi
+
+# If already vendored in working directory, reuse directly
+if [ -x "$NODE_BIN" ]; then
+  export PATH="$NODE_DIR/bin:$PATH"
+  exec "$NODE_BIN" "$SCRIPT_DIR/onboard.mjs" "$@"
+fi
+
+echo "[bioresearcher-onboard] Host Node >= 22.13 not found. Bootstrapping portable Node.js $NODE_VER into .bioresearcher-runtime/..."
+
+# 2. OS and Architecture Detection
+OS_RAW="$(uname -s)"
+case "$OS_RAW" in
+  Linux*)  OS="linux" ;;
+  Darwin*) OS="darwin" ;;
+  *) echo "Error: Unsupported operating system $OS_RAW. Windows users should run bootstrap.ps1." >&2; exit 1 ;;
+esac
+
+# Linux C library gate
+if [ "$OS" = "linux" ]; then
+  if ldd /bin/ls 2>&1 | grep -qi "musl"; then
+    echo "Error: Alpine/musl Linux detected. Official Node prebuilts require glibc." >&2
+    echo "Please install Node >= 22.13 via your system package manager (e.g. apk add nodejs)." >&2
+    exit 1
+  fi
+fi
+
+ARCH_RAW="$(uname -m)"
+case "$ARCH_RAW" in
+  x86_64|amd64) ARCH="x64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Error: Unsupported CPU architecture $ARCH_RAW." >&2; exit 1 ;;
+esac
+
+# macOS Rosetta detection: probe true hardware arch
+if [ "$OS" = "darwin" ]; then
+  if [ "$(sysctl -in sysctl.proc_translated 2>/dev/null || echo 0)" = "1" ]; then
+    ARCH="arm64"
+  fi
+fi
+
+# 3. Mirror Selection Probe (1.2s timeout)
+if curl -s -I --connect-timeout 1.0 --max-time 1.2 "https://nodejs.org/dist/" >/dev/null 2>&1; then
+  MIRROR_BASE="https://nodejs.org/dist/${NODE_VER}"
+  NPM_REGISTRY="https://registry.npmjs.org"
+else
+  echo "[bioresearcher-onboard] nodejs.org unreachable or timed out; using npmmirror.com fast mirror"
+  MIRROR_BASE="https://npmmirror.com/mirrors/node/${NODE_VER}"
+  NPM_REGISTRY="https://registry.npmmirror.com"
+fi
+
+FILE="node-${NODE_VER}-${OS}-${ARCH}.tar.gz"
+DOWNLOAD_URL="${MIRROR_BASE}/${FILE}"
+
+# Pinned SHA256 checksums from official Node.js SHASUMS256.txt
+case "${OS}-${ARCH}" in
+  linux-x64)    EXPECTED_SHA="9d942932535988091034dc94cc5f42b6dc8784d6366df3a36c4c9ccb3996f0c2" ;;
+  linux-arm64)  EXPECTED_SHA="8cf30ff7250f9463b53c18f89c6c606dfda70378215b2c905d0a9a8b08bd45e0" ;;
+  darwin-x64)   EXPECTED_SHA="6698587713ab565a94a360e091df9f6d91c8fadda6d00f0cf6526e9b40bed250" ;;
+  darwin-arm64) EXPECTED_SHA="e9404633bc02a5162c5c573b1e2490f5fb44648345d64a958b17e325729a5e42" ;;
+  *) echo "Error: Missing checksum for target ${OS}-${ARCH}." >&2; exit 1 ;;
+esac
+
+mkdir -p "$RUNTIME_ROOT"
+TMP_ARCHIVE="$RUNTIME_ROOT/node.tar.gz"
+
+echo "[bioresearcher-onboard] Downloading $FILE..."
+curl -f -s -L --retry 2 -o "$TMP_ARCHIVE" "$DOWNLOAD_URL"
+
+# 4. Checksum verification
+if command -v sha256sum >/dev/null 2>&1; then
+  ACTUAL_SHA="$(sha256sum "$TMP_ARCHIVE" | awk '{print $1}')"
+elif command -v shasum >/dev/null 2>&1; then
+  ACTUAL_SHA="$(shasum -a 256 "$TMP_ARCHIVE" | awk '{print $1}')"
+else
+  ACTUAL_SHA=""
+fi
+
+if [ -n "$ACTUAL_SHA" ] && [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+  echo "Error: SHA256 checksum verification failed for $FILE." >&2
+  echo "Expected: $EXPECTED_SHA" >&2
+  echo "Actual:   $ACTUAL_SHA" >&2
+  rm -f "$TMP_ARCHIVE"
+  exit 1
+fi
+
+# 5. Extract and prune
+mkdir -p "$NODE_DIR"
+tar -xzf "$TMP_ARCHIVE" -C "$NODE_DIR" --strip-components=1
+rm -f "$TMP_ARCHIVE"
+
+# Remove non-runtime artifacts (saves ~49 MB)
+rm -rf "$NODE_DIR/include" "$NODE_DIR/share" "$NODE_DIR"/*.md "$NODE_DIR"/LICENSE
+
+# macOS Gatekeeper quarantine removal
+if [ "$OS" = "darwin" ]; then
+  xattr -dr com.apple.quarantine "$NODE_DIR" 2>/dev/null || true
+fi
+
+echo "[bioresearcher-onboard] Portable Node.js ready: $("$NODE_BIN" -v)"
+
+# 6. Hand off to Stage 1
+export PATH="$NODE_DIR/bin:$PATH"
+export NPM_CONFIG_REGISTRY="$NPM_REGISTRY"
+exec "$NODE_BIN" "$SCRIPT_DIR/onboard.mjs" "$@"