origem 0.1.0

package/dist/index.js

@@ -0,0 +1,2376 @@
+#!/usr/bin/env node
+
+// ../origem-adapters/dist/utils.js
+function slugify(s) {
+  return s.toLowerCase().normalize("NFD").replace(/[̀-ͯ]/g, "").replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "item";
+}
+function byType(cards, type) {
+  return cards.filter((c2) => c2.type === type);
+}
+function tryJson(content) {
+  try {
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function hasFrontmatter(content) {
+  return /^---\s*\n[\s\S]*?\n---\s*(\n|$)/.test(content);
+}
+function yamlScalar(value) {
+  const v = value.replace(/\n/g, " ").trim();
+  return /[:#"'{}\[\],&*?|<>=!%@`]/.test(v) ? JSON.stringify(v) : v;
+}
+var DEFAULT_SECTIONS = [
+  { type: "instruction", title: "Instru\xE7\xF5es" },
+  { type: "spec", title: "Especifica\xE7\xF5es (requisitos)" },
+  { type: "boundary", title: "Limites (Sempre / Perguntar antes / Nunca)" },
+  { type: "rule", title: "Regras & Instru\xE7\xF5es" },
+  { type: "memory", title: "Mem\xF3rias & Contexto" },
+  { type: "knowledge", title: "Conhecimento" },
+  { type: "prompt", title: "Prompts" },
+  { type: "integration", title: "Integra\xE7\xF5es" }
+];
+function renderMarkdown(brain, sections = DEFAULT_SECTIONS) {
+  const lines = [];
+  lines.push(`# ${brain.brain.name}`);
+  if (brain.brain.description)
+    lines.push(`
+> ${brain.brain.description}`);
+  lines.push(`
+_Configura\xE7\xE3o gerada pelo Origem. Adote as regras, mem\xF3rias e conhecimento abaixo como contexto operacional._`);
+  for (const section of sections) {
+    const group = byType(brain.cards, section.type);
+    if (group.length === 0)
+      continue;
+    lines.push(`
+
+## ${section.title}`);
+    for (const card of group) {
+      const folder = card.folder ? ` _(${card.folder})_` : "";
+      lines.push(`
+### ${card.title}${folder}`);
+      if (card.tags?.length)
+        lines.push(`\`${card.tags.join("` `")}\``);
+      lines.push(`
+${card.content}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+
+// ../origem-adapters/dist/adapters.js
+var GENERIC_SECTIONS = [
+  { type: "instruction", title: "Instru\xE7\xF5es" },
+  { type: "spec", title: "Especifica\xE7\xF5es (requisitos)" },
+  { type: "boundary", title: "Limites (Sempre / Perguntar antes / Nunca)" },
+  { type: "rule", title: "Regras & Padr\xF5es" },
+  { type: "memory", title: "Mem\xF3rias & Contexto" },
+  { type: "knowledge", title: "Conhecimento" },
+  { type: "skill", title: "Skills / Capacidades" },
+  { type: "agent", title: "Subagentes" },
+  { type: "prompt", title: "Prompts & Comandos" },
+  { type: "integration", title: "Integra\xE7\xF5es" }
+];
+function toAgentsMd(brain) {
+  return [
+    {
+      target: "agents",
+      path: "AGENTS.md",
+      content: renderMarkdown(brain, GENERIC_SECTIONS),
+      risk: "safe",
+      strategy: "managed-block"
+    }
+  ];
+}
+var CLAUDE_SECTIONS = [
+  { type: "instruction", title: "Instru\xE7\xF5es" },
+  { type: "spec", title: "Especifica\xE7\xF5es (requisitos)" },
+  { type: "boundary", title: "Limites (Sempre / Perguntar antes / Nunca)" },
+  { type: "rule", title: "Regras & Padr\xF5es" },
+  { type: "memory", title: "Mem\xF3rias & Contexto" },
+  { type: "knowledge", title: "Conhecimento" },
+  { type: "integration", title: "Integra\xE7\xF5es" }
+];
+function toClaudeMd(brain) {
+  return [
+    {
+      target: "claude",
+      path: "CLAUDE.md",
+      content: renderMarkdown(brain, CLAUDE_SECTIONS),
+      risk: "safe",
+      strategy: "managed-block"
+    }
+  ];
+}
+function toGeminiMd(brain) {
+  return [
+    {
+      target: "gemini",
+      path: "GEMINI.md",
+      content: renderMarkdown(brain, GENERIC_SECTIONS),
+      risk: "safe",
+      strategy: "managed-block"
+    }
+  ];
+}
+function toCopilot(brain) {
+  return [
+    {
+      target: "copilot",
+      path: ".github/copilot-instructions.md",
+      content: renderMarkdown(brain, GENERIC_SECTIONS),
+      risk: "safe",
+      strategy: "managed-block"
+    }
+  ];
+}
+function toCursorRules(brain) {
+  const rules = byType(brain.cards, "rule");
+  if (rules.length === 0)
+    return [];
+  return rules.map((card) => {
+    const desc = card.title.replace(/\n/g, " ");
+    const content = `---
+description: ${desc}
+alwaysApply: true
+---
+
+${card.content}
+`;
+    return {
+      target: "cursor",
+      path: `.cursor/rules/${slugify(card.title)}.mdc`,
+      content,
+      risk: "safe",
+      strategy: "whole-file"
+    };
+  });
+}
+function toMcpJson(brain) {
+  const cards = byType(brain.cards, "mcp");
+  if (cards.length === 0)
+    return [];
+  const servers = {};
+  for (const card of cards) {
+    try {
+      const parsed = JSON.parse(card.content);
+      const inner = parsed.mcpServers ?? parsed;
+      if ("command" in inner || "url" in inner) {
+        servers[slugify(card.title)] = inner;
+      } else {
+        Object.assign(servers, inner);
+      }
+    } catch {
+    }
+  }
+  if (Object.keys(servers).length === 0)
+    return [];
+  const anyStdio = Object.values(servers).some((s) => s && typeof s === "object" && "command" in s);
+  const out = [
+    {
+      target: "mcp",
+      path: ".mcp.json",
+      content: JSON.stringify({ mcpServers: servers }, null, 2) + "\n",
+      risk: anyStdio ? "privileged" : "safe",
+      strategy: "merge-json"
+    }
+  ];
+  return out;
+}
+
+// ../origem-adapters/dist/claude-adapters.js
+function mergeSettings(base, add) {
+  for (const [k, v] of Object.entries(add)) {
+    const cur = base[k];
+    if (Array.isArray(v)) {
+      const prev = Array.isArray(cur) ? cur : [];
+      base[k] = Array.from(/* @__PURE__ */ new Set([...prev, ...v]));
+    } else if (v && typeof v === "object") {
+      const prev = cur && typeof cur === "object" && !Array.isArray(cur) ? cur : {};
+      base[k] = mergeSettings({ ...prev }, v);
+    } else {
+      base[k] = v;
+    }
+  }
+  return base;
+}
+function toClaudeSettings(brain) {
+  const cards = byType(brain.cards, "harness");
+  if (cards.length === 0)
+    return [];
+  let settings = {};
+  let parsedAny = false;
+  for (const card of cards) {
+    const json = tryJson(card.content);
+    if (json && typeof json === "object" && !Array.isArray(json)) {
+      settings = mergeSettings(settings, json);
+      parsedAny = true;
+    }
+  }
+  if (!parsedAny)
+    return [];
+  return [
+    {
+      target: "claude-settings",
+      path: ".claude/settings.json",
+      content: JSON.stringify(settings, null, 2) + "\n",
+      risk: "privileged",
+      strategy: "merge-json"
+    }
+  ];
+}
+function toClaudeSkills(brain) {
+  const cards = byType(brain.cards, "skill");
+  return cards.map((card) => {
+    const slug = slugify(card.title);
+    let content;
+    if (hasFrontmatter(card.content)) {
+      content = card.content.endsWith("\n") ? card.content : card.content + "\n";
+    } else {
+      const description = card.tags?.length ? card.tags.join(", ") : card.title;
+      content = `---
+name: ${yamlScalar(slug)}
+description: ${yamlScalar(description)}
+---
+
+# ${card.title}
+
+${card.content}
+`;
+    }
+    return {
+      target: "claude-skills",
+      path: `.claude/skills/${slug}/SKILL.md`,
+      content,
+      risk: "safe",
+      strategy: "whole-file"
+    };
+  });
+}
+function toClaudeCommands(brain) {
+  const cards = byType(brain.cards, "prompt");
+  return cards.map((card) => {
+    const slug = slugify(card.title);
+    let content;
+    if (hasFrontmatter(card.content)) {
+      content = card.content.endsWith("\n") ? card.content : card.content + "\n";
+    } else {
+      content = `---
+description: ${yamlScalar(card.title)}
+---
+
+${card.content}
+`;
+    }
+    return {
+      target: "claude-commands",
+      path: `.claude/commands/${slug}.md`,
+      content,
+      risk: "safe",
+      strategy: "whole-file"
+    };
+  });
+}
+function toClaudeAgents(brain) {
+  const cards = byType(brain.cards, "agent");
+  return cards.map((card) => {
+    const slug = slugify(card.title);
+    let content;
+    if (hasFrontmatter(card.content)) {
+      content = card.content.endsWith("\n") ? card.content : card.content + "\n";
+    } else {
+      const spec = tryJson(card.content) ?? {};
+      const description = spec.description ?? card.title;
+      const tools = Array.isArray(spec.tools) ? spec.tools.join(", ") : spec.tools;
+      const body = spec.prompt ?? (tryJson(card.content) ? "" : card.content);
+      const fm = [
+        `name: ${yamlScalar(slug)}`,
+        `description: ${yamlScalar(description)}`,
+        tools ? `tools: ${yamlScalar(tools)}` : null,
+        spec.model ? `model: ${yamlScalar(spec.model)}` : null
+      ].filter(Boolean).join("\n");
+      content = `---
+${fm}
+---
+
+${body}
+`;
+    }
+    return {
+      target: "claude-agents",
+      path: `.claude/agents/${slug}.md`,
+      content,
+      risk: "safe",
+      strategy: "whole-file"
+    };
+  });
+}
+
+// ../origem-adapters/dist/capabilities.js
+var ALL_DEGRADED = {
+  instruction: "native",
+  spec: "native",
+  boundary: "native",
+  rule: "native",
+  memory: "native",
+  knowledge: "native",
+  prompt: "degraded",
+  integration: "native",
+  skill: "degraded",
+  agent: "degraded",
+  harness: "none",
+  mcp: "none"
+};
+var TARGET_CAPABILITIES = [
+  {
+    id: "claude",
+    label: "Claude Code \xB7 CLAUDE.md",
+    path: "CLAUDE.md",
+    support: {
+      instruction: "native",
+      spec: "native",
+      // renderizado no CLAUDE.md
+      boundary: "native",
+      // renderizado no CLAUDE.md
+      rule: "native",
+      memory: "native",
+      knowledge: "native",
+      integration: "native",
+      prompt: "none",
+      // vira slash command (claude-commands)
+      skill: "none",
+      // vira SKILL.md (claude-skills)
+      agent: "none",
+      // vira subagente (claude-agents)
+      harness: "none",
+      // vira settings.json (claude-settings)
+      mcp: "none"
+      // vira .mcp.json
+    },
+    note: "Instru\xE7\xF5es can\xF4nicas. Prompt/skill/agent/harness/mcp viram arquivos pr\xF3prios do Claude."
+  },
+  {
+    id: "claude-settings",
+    label: "Claude Code \xB7 settings.json",
+    path: ".claude/settings.json",
+    support: onlyNative("harness"),
+    note: "Permiss\xF5es, env, hooks e modelo. Privilegiado (executa na m\xE1quina)."
+  },
+  {
+    id: "claude-skills",
+    label: "Claude Code \xB7 Agent Skills",
+    path: ".claude/skills/<nome>/SKILL.md",
+    support: onlyNative("skill")
+  },
+  {
+    id: "claude-commands",
+    label: "Claude Code \xB7 Slash commands",
+    path: ".claude/commands/<nome>.md",
+    support: onlyNative("prompt")
+  },
+  {
+    id: "claude-agents",
+    label: "Claude Code \xB7 Subagentes",
+    path: ".claude/agents/<nome>.md",
+    support: onlyNative("agent")
+  },
+  {
+    id: "mcp",
+    label: "MCP servers \xB7 .mcp.json",
+    path: ".mcp.json",
+    support: onlyNative("mcp"),
+    note: "Port\xE1vel em conceito; o CAMINHO varia por ferramenta (Cursor: .cursor/mcp.json, VS Code: .vscode/mcp.json)."
+  },
+  {
+    id: "agents",
+    label: "AGENTS.md (Codex, Windsurf, Zed, Aider\u2026)",
+    path: "AGENTS.md",
+    support: ALL_DEGRADED,
+    note: "Padr\xE3o convergido de instru\xE7\xF5es. Sem conceito nativo de skills/subagentes \u2192 viram documenta\xE7\xE3o."
+  },
+  {
+    id: "gemini",
+    label: "Gemini CLI \xB7 GEMINI.md",
+    path: "GEMINI.md",
+    support: ALL_DEGRADED
+  },
+  {
+    id: "copilot",
+    label: "GitHub Copilot \xB7 instructions",
+    path: ".github/copilot-instructions.md",
+    support: ALL_DEGRADED
+  },
+  {
+    id: "cursor",
+    label: "Cursor \xB7 rules",
+    path: ".cursor/rules/*.mdc",
+    support: {
+      ...ALL_DEGRADED,
+      instruction: "degraded",
+      // nosso adapter de cursor só emite `rule`
+      spec: "none",
+      boundary: "none",
+      memory: "none",
+      knowledge: "none",
+      prompt: "none",
+      integration: "none",
+      skill: "none",
+      agent: "none"
+    },
+    note: "Nosso adapter gera s\xF3 regras (.mdc). Cursor tamb\xE9m l\xEA AGENTS.md e .cursor/mcp.json (roadmap)."
+  }
+];
+function onlyNative(type) {
+  const base = {
+    instruction: "none",
+    spec: "none",
+    boundary: "none",
+    harness: "none",
+    rule: "none",
+    memory: "none",
+    knowledge: "none",
+    prompt: "none",
+    skill: "none",
+    agent: "none",
+    mcp: "none",
+    integration: "none"
+  };
+  base[type] = "native";
+  return base;
+}
+
+// ../origem-adapters/dist/index.js
+var ADAPTERS = {
+  agents: toAgentsMd,
+  claude: toClaudeMd,
+  gemini: toGeminiMd,
+  copilot: toCopilot,
+  cursor: toCursorRules,
+  mcp: toMcpJson,
+  "claude-settings": toClaudeSettings,
+  "claude-skills": toClaudeSkills,
+  "claude-commands": toClaudeCommands,
+  "claude-agents": toClaudeAgents
+};
+var ALL_TARGETS = Object.keys(ADAPTERS);
+var CLAUDE_TARGETS = [
+  "claude",
+  "claude-settings",
+  "claude-skills",
+  "claude-commands",
+  "claude-agents",
+  "mcp"
+];
+function adapt(brain, targets = ALL_TARGETS) {
+  const out = [];
+  for (const target of targets) {
+    const fn = ADAPTERS[target];
+    if (fn)
+      out.push(...fn(brain));
+  }
+  return out;
+}
+
+// src/signing.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+function signPayload(payload, secret) {
+  return createHmac("sha256", secret).update(stableStringify(payload)).digest("hex");
+}
+function verifyPayload(payload, signature, secret) {
+  try {
+    const a = Buffer.from(signPayload(payload, secret), "hex");
+    const b = Buffer.from(signature, "hex");
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function configPath() {
+  return join(homedir(), ".origem", "config.json");
+}
+function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return {};
+  try {
+    return JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(patch) {
+  const p = configPath();
+  const dir = dirname(p);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const next = { ...readConfig(), ...patch };
+  writeFileSync(p, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(dir, 448);
+    chmodSync(p, 384);
+  } catch {
+  }
+  return p;
+}
+
+// src/lock.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+var LOCK_DIR = ".origem";
+var LOCK_FILE = join2(LOCK_DIR, "lock.json");
+function lockPath(baseDir) {
+  return join2(baseDir, LOCK_FILE);
+}
+function readLock(baseDir) {
+  const p = lockPath(baseDir);
+  if (!existsSync2(p)) return null;
+  try {
+    return JSON.parse(readFileSync2(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeLock(baseDir, lock) {
+  const p = lockPath(baseDir);
+  mkdirSync2(dirname2(p), { recursive: true });
+  writeFileSync2(p, JSON.stringify(lock, null, 2) + "\n", "utf8");
+}
+function deleteLock(baseDir) {
+  const dir = join2(baseDir, LOCK_DIR);
+  if (existsSync2(dir)) rmSync(dir, { recursive: true, force: true });
+}
+
+// src/ui.ts
+import { createInterface } from "node:readline";
+var c = {
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`
+};
+var color = c;
+function info(msg) {
+  console.log(msg);
+}
+function warn(msg) {
+  console.warn(c.yellow(`\u26A0 ${msg}`));
+}
+function err(msg) {
+  console.error(c.red(`\u2717 ${msg}`));
+}
+function ok(msg) {
+  console.log(c.green(`\u2713 ${msg}`));
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise(
+      (resolve) => rl.question(`${question} ${c.dim("[y/N]")} `, resolve)
+    );
+    return /^s|sim|y|yes$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
+// src/http.ts
+var DEFAULT_API = "https://origem-ai.web.app";
+async function fetchBrain(apiUrl, key) {
+  const base = apiUrl.replace(/\/$/, "");
+  const url = `${base}/pull?k=${encodeURIComponent(key)}&format=json`;
+  let res;
+  try {
+    res = await fetch(url);
+  } catch (e) {
+    throw new Error(`N\xE3o consegui conectar em ${base}: ${e.message}`);
+  }
+  if (res.status === 401) {
+    throw new Error("Token inv\xE1lido, expirado ou revogado. Gere um novo link no Origem.");
+  }
+  if (res.status === 403) {
+    throw new Error("Token sem permiss\xE3o de leitura.");
+  }
+  if (!res.ok) {
+    throw new Error(`Falha ao puxar o Brain (HTTP ${res.status}).`);
+  }
+  const payload = await res.json();
+  const secret = process.env.ORIGEM_SIGNING_SECRET;
+  if (payload.signature) {
+    if (!secret) {
+      warn(
+        "O payload vem assinado, mas ORIGEM_SIGNING_SECRET n\xE3o est\xE1 definido \u2014 n\xE3o \xE9 poss\xEDvel verificar a origem. Config privilegiada ser\xE1 bloqueada."
+      );
+      payload.__unverified = true;
+    } else {
+      const { signature, ...rest } = payload;
+      if (!verifyPayload(rest, signature, secret)) {
+        throw new Error(
+          "Assinatura inv\xE1lida \u2014 o Brain pode ter sido adulterado. Abortando."
+        );
+      }
+    }
+  } else if (secret) {
+    warn(
+      "ORIGEM_SIGNING_SECRET est\xE1 definido, mas o payload N\xC3O vem assinado. Config privilegiada ser\xE1 bloqueada."
+    );
+    payload.__unverified = true;
+  }
+  return payload;
+}
+function resolveApiUrl(flag) {
+  const fromLock = readLock(process.cwd())?.apiUrl || void 0;
+  return (flag || process.env.ORIGEM_API_URL || fromLock || readConfig().apiUrl || DEFAULT_API).replace(/\/$/, "");
+}
+function resolveKey(flag) {
+  const key = flag || process.env.ORIGEM_TOKEN || readConfig().token || "";
+  if (!key) {
+    throw new Error(
+      "Token ausente. Rode `origem login --key <token>` uma vez (grava em ~/.origem/config.json), ou passe --key / ORIGEM_TOKEN. Gere o link em 'Conectar com IA' no app Origem."
+    );
+  }
+  return key;
+}
+async function probeToken(apiUrl, key) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl}/run?k=${encodeURIComponent(key)}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sessionId: "origem-login-probe", event: "poll", pullCommand: false }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (e) {
+    throw new Error(`N\xE3o consegui falar com ${apiUrl}: ${e.message}`);
+  }
+  if (res.status === 401) throw new Error("Token inv\xE1lido, expirado ou revogado.");
+  if (res.status === 403) {
+    throw new Error(
+      "Token sem escopo de escrita. O watch e o hook precisam de um link de escrita (ingest\xE3o)."
+    );
+  }
+  if (res.status === 404) {
+    throw new Error(
+      `Esta API n\xE3o tem o endpoint /run (HTTP 404). Ela precisa estar publicada com o m\xF3dulo de runs.`
+    );
+  }
+  if (!res.ok) throw new Error(`Falha na verifica\xE7\xE3o (HTTP ${res.status}).`);
+}
+
+// src/fsutil.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmdirSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+var MB_START = "<!-- origem:managed:start -->";
+var MB_END = "<!-- origem:managed:end -->";
+function sha256(s) {
+  return createHash("sha256").update(s).digest("hex");
+}
+function readText(abs) {
+  try {
+    return readFileSync3(abs, "utf8");
+  } catch {
+    return null;
+  }
+}
+function resolveTarget(scope, relPath) {
+  if (scope === "project") return join3(process.cwd(), relPath);
+  const home = homedir2();
+  if (relPath === "CLAUDE.md") return join3(home, ".claude", "CLAUDE.md");
+  if (relPath.startsWith(".claude/")) return join3(home, relPath);
+  return null;
+}
+function ensureDir(abs) {
+  mkdirSync3(dirname3(abs), { recursive: true });
+}
+function wrapBlock(content) {
+  const body = content.replace(/\n+$/, "");
+  return `${MB_START}
+<!-- Gerado pelo Origem (origem apply). N\xE3o edite dentro do bloco. -->
+${body}
+${MB_END}
+`;
+}
+function applyManagedBlock(existing, content) {
+  const block = wrapBlock(content);
+  if (existing == null) return block;
+  const start = existing.indexOf(MB_START);
+  const end = existing.indexOf(MB_END);
+  if (start !== -1 && end !== -1 && end > start) {
+    const before = existing.slice(0, start);
+    const after = existing.slice(end + MB_END.length).replace(/^\n/, "");
+    return `${before}${block}${after}`;
+  }
+  const sep = existing.endsWith("\n") ? "\n" : "\n\n";
+  return `${existing}${sep}${block}`;
+}
+function extractManagedBlock(existing) {
+  const start = existing.indexOf(MB_START);
+  const end = existing.indexOf(MB_END);
+  if (start === -1 || end === -1 || end <= start) return null;
+  return existing.slice(start, end + MB_END.length);
+}
+function deepMergeJson(base, add) {
+  for (const [k, v] of Object.entries(add)) {
+    const cur = base[k];
+    if (Array.isArray(v)) {
+      const prev = Array.isArray(cur) ? cur : [];
+      base[k] = Array.from(/* @__PURE__ */ new Set([...prev, ...v]));
+    } else if (v && typeof v === "object") {
+      const prev = cur && typeof cur === "object" && !Array.isArray(cur) ? cur : {};
+      base[k] = deepMergeJson({ ...prev }, v);
+    } else {
+      base[k] = v;
+    }
+  }
+  return base;
+}
+function normBody(s) {
+  return s.replace(/^\n+/, "").replace(/\n+$/, "");
+}
+function managedHash(strategy, content) {
+  if (strategy === "merge-json") {
+    return sha256(stableStringify(JSON.parse(content)));
+  }
+  return sha256(strategy === "managed-block" ? normBody(content) : content);
+}
+function diskManagedHash(abs, strategy, jsonKeys) {
+  const existing = readText(abs);
+  if (existing == null) return null;
+  if (strategy === "whole-file") return sha256(existing);
+  if (strategy === "managed-block") {
+    const block = extractManagedBlock(existing);
+    return block == null ? null : sha256(unwrapBlock(block));
+  }
+  try {
+    const json = JSON.parse(existing);
+    const owned = {};
+    for (const k of jsonKeys ?? []) if (k in json) owned[k] = json[k];
+    return sha256(stableStringify(owned));
+  } catch {
+    return null;
+  }
+}
+function unwrapBlock(block) {
+  return block.replace(MB_START, "").replace(MB_END, "").replace(/^\s*<!-- Gerado pelo Origem[^\n]*-->\n?/, "").replace(/^\n+/, "").replace(/\n+$/, "");
+}
+function writeTarget(abs, strategy, content) {
+  ensureDir(abs);
+  if (strategy === "whole-file") {
+    writeFileSync3(abs, content, "utf8");
+    return { hash: sha256(content) };
+  }
+  if (strategy === "managed-block") {
+    const merged2 = applyManagedBlock(readText(abs), content);
+    writeFileSync3(abs, merged2, "utf8");
+    return { hash: sha256(normBody(content)) };
+  }
+  const incoming = JSON.parse(content);
+  const existing = readText(abs);
+  const base = existing ? JSON.parse(existing) : {};
+  const merged = deepMergeJson(base, structuredClone(incoming));
+  writeFileSync3(abs, JSON.stringify(merged, null, 2) + "\n", "utf8");
+  return { hash: sha256(stableStringify(incoming)), jsonKeys: Object.keys(incoming) };
+}
+function removeTarget(abs, strategy, jsonKeys) {
+  const existing = readText(abs);
+  if (existing == null) return;
+  if (strategy === "whole-file") {
+    unlinkSync(abs);
+    pruneEmptyDirs(dirname3(abs));
+    return;
+  }
+  if (strategy === "managed-block") {
+    const start = existing.indexOf(MB_START);
+    const end = existing.indexOf(MB_END);
+    if (start === -1 || end === -1) return;
+    const rest = (existing.slice(0, start) + existing.slice(end + MB_END.length)).replace(/\n{3,}/g, "\n\n").trim();
+    if (rest === "") unlinkSync(abs);
+    else writeFileSync3(abs, rest + "\n", "utf8");
+    return;
+  }
+  try {
+    const json = JSON.parse(existing);
+    for (const k of jsonKeys ?? []) delete json[k];
+    if (Object.keys(json).length === 0) unlinkSync(abs);
+    else writeFileSync3(abs, JSON.stringify(json, null, 2) + "\n", "utf8");
+  } catch {
+  }
+}
+function pruneEmptyDirs(dir) {
+  for (let d = dir; d && d !== dirname3(d); d = dirname3(d)) {
+    if (!existsSync3(d)) continue;
+    try {
+      rmdirSync(d);
+    } catch {
+      break;
+    }
+  }
+}
+
+// src/commands.ts
+function buildPlan(brain, scope, targets, lock) {
+  const outputs = adapt(brain, targets);
+  const byPath = new Map((lock?.files ?? []).map((f) => [f.path, f]));
+  const items = [];
+  const skipped = [];
+  for (const output of outputs) {
+    const abs = resolveTarget(scope, output.path);
+    if (!abs) {
+      skipped.push(output);
+      continue;
+    }
+    const strategy = output.strategy ?? "whole-file";
+    const risk = output.risk ?? "safe";
+    const newHash = managedHash(strategy, output.content);
+    const prev = byPath.get(output.path);
+    const action = !prev ? "create" : prev.hash !== newHash ? "update" : "unchanged";
+    const diskHash = diskManagedHash(abs, strategy, prev?.jsonKeys);
+    const driftedLocally = !!prev && diskHash !== null && diskHash !== prev.hash;
+    items.push({ output, abs, strategy, risk, action, newHash, driftedLocally });
+  }
+  return { items, skipped };
+}
+function actionLabel(a) {
+  if (a === "create") return color.green("criar   ");
+  if (a === "update") return color.yellow("atualizar");
+  return color.dim("ok      ");
+}
+function printPlan(items, skipped) {
+  info(color.bold("\nPlano:"));
+  for (const it of items) {
+    const risk = it.risk === "privileged" ? color.red(" [privilegiado]") : "";
+    const drift = it.driftedLocally ? color.yellow(" (editado localmente)") : "";
+    info(`  ${actionLabel(it.action)}  ${it.output.path}${risk}${drift}`);
+  }
+  for (const s of skipped) {
+    info(`  ${color.dim("pular   ")}  ${s.path} ${color.dim("(n\xE3o se aplica a este escopo)")}`);
+  }
+}
+async function runApply(opts) {
+  const { brain, scope, targets, dryRun, yes } = opts;
+  const baseDir = process.cwd();
+  const lock = readLock(baseDir);
+  const { items, skipped } = buildPlan(brain, scope, targets, lock);
+  const unverified = !!brain.__unverified;
+  const toWrite = items.filter((i) => i.action !== "unchanged");
+  const privileged = toWrite.filter((i) => i.risk === "privileged");
+  const currentPaths = new Set(items.map((i) => i.output.path));
+  const orphans = (lock?.files ?? []).filter((f) => !currentPaths.has(f.path));
+  printPlan(items, skipped);
+  if (orphans.length) {
+    info(color.bold("\nRemover (n\xE3o est\xE3o mais no Brain):"));
+    for (const o of orphans) info(`  ${color.red("remover ")}  ${o.path}`);
+  }
+  if (dryRun) {
+    info(color.dim("\n(dry-run \u2014 nada foi escrito.)"));
+    return;
+  }
+  let allowPrivileged = privileged.length === 0;
+  if (privileged.length > 0) {
+    if (unverified) {
+      warn(
+        "Config privilegiada bloqueada: o payload n\xE3o p\xF4de ser verificado (assinatura ausente/ inv\xE1lida)."
+      );
+      allowPrivileged = false;
+    } else if (yes) {
+      allowPrivileged = true;
+    } else if (!process.stdin.isTTY) {
+      warn("Sem terminal interativo \u2014 pulando config privilegiada. Use --yes para aplicar.");
+      allowPrivileged = false;
+    } else {
+      info(color.bold("\n\u26A0 Config privilegiada (executa comandos/segredos na sua m\xE1quina):"));
+      for (const p of privileged) info(`  \u2022 ${p.output.path}`);
+      allowPrivileged = await confirm("Aplicar tamb\xE9m esses arquivos privilegiados?");
+    }
+  }
+  for (const o of orphans) {
+    const abs = resolveTarget(scope, o.path);
+    if (abs) removeTarget(abs, o.strategy, o.jsonKeys);
+  }
+  const nextEntries = new Map(
+    (lock?.files ?? []).filter((f) => currentPaths.has(f.path)).map((f) => [f.path, f])
+  );
+  let written = 0;
+  for (const it of items) {
+    const isPriv = it.risk === "privileged";
+    if (it.action !== "unchanged" && (!isPriv || allowPrivileged)) {
+      const res = writeTarget(it.abs, it.strategy, it.output.content);
+      nextEntries.set(it.output.path, {
+        path: it.output.path,
+        target: it.output.target,
+        strategy: it.strategy,
+        risk: it.risk,
+        hash: res.hash,
+        jsonKeys: res.jsonKeys
+      });
+      written++;
+    }
+  }
+  writeLock(baseDir, {
+    version: 1,
+    brainId: brain.brain.id ?? null,
+    brainName: brain.brain.name ?? null,
+    revision: brain.origem?.revision ?? null,
+    apiUrl: brain.__apiUrl ?? "",
+    scope,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files: [...nextEntries.values()]
+  });
+  ok(
+    `Aplicado: ${written} arquivo(s) escrito(s), ${orphans.length} removido(s). Estado em ${color.cyan(".origem/lock.json")}.`
+  );
+  if (!allowPrivileged && privileged.length > 0) {
+    warn(`${privileged.length} arquivo(s) privilegiado(s) N\xC3O aplicado(s).`);
+  }
+}
+function runStatus(brain, scope, targets) {
+  const baseDir = process.cwd();
+  const lock = readLock(baseDir);
+  if (!lock) {
+    info("N\xE3o inicializado neste diret\xF3rio. Rode `origem apply`.");
+    return;
+  }
+  const remoteRev = brain.origem?.revision ?? null;
+  const localRev = lock.revision;
+  info(color.bold(`Brain: ${lock.brainName ?? lock.brainId ?? "?"}`));
+  info(
+    `Revis\xE3o local: ${localRev ?? "?"} \xB7 remota: ${remoteRev ?? "?"} ` + (remoteRev !== null && localRev !== remoteRev ? color.yellow("(desatualizado \u2014 rode `origem apply`)") : color.green("(em dia)"))
+  );
+  const { items } = buildPlan(brain, scope, targets, lock);
+  info(color.bold("\nArquivos:"));
+  for (const it of items) {
+    const parts = [];
+    if (it.action !== "unchanged") parts.push(color.yellow(it.action));
+    if (it.driftedLocally) parts.push(color.yellow("editado localmente"));
+    if (parts.length === 0) parts.push(color.green("em dia"));
+    info(`  ${it.output.path} \u2014 ${parts.join(", ")}`);
+  }
+}
+function runRemove(scope) {
+  const baseDir = process.cwd();
+  const lock = readLock(baseDir);
+  if (!lock) {
+    info("Nada para remover (sem .origem/lock.json).");
+    return;
+  }
+  for (const f of lock.files) {
+    const abs = resolveTarget(scope, f.path);
+    if (abs) removeTarget(abs, f.strategy, f.jsonKeys);
+  }
+  deleteLock(baseDir);
+  ok(`Removidos ${lock.files.length} arquivo(s) do Origem e limpo o lock.`);
+}
+
+// src/hook.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "node:fs";
+import { join as join4, dirname as dirname4 } from "node:path";
+import { tmpdir } from "node:os";
+var STATE_DIR = join4(tmpdir(), "origem-hook");
+function stateFile(sessionId) {
+  return join4(STATE_DIR, `${sessionId.replace(/[^\w.-]/g, "_")}.json`);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const c2 of process.stdin) chunks.push(Buffer.from(c2));
+  const raw = Buffer.concat(chunks).toString("utf8").trim();
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function hookStart() {
+  const input = await readStdin();
+  if (!input.session_id) return;
+  try {
+    mkdirSync4(STATE_DIR, { recursive: true });
+    writeFileSync4(stateFile(input.session_id), JSON.stringify({ startedAt: Date.now() }));
+  } catch {
+  }
+}
+function turnDuration(sessionId) {
+  try {
+    const raw = readFileSync4(stateFile(sessionId), "utf8");
+    const { startedAt } = JSON.parse(raw);
+    if (typeof startedAt !== "number") return void 0;
+    const ms = Date.now() - startedAt;
+    return ms >= 0 && ms < 864e5 ? ms : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function hookStop(opts) {
+  const input = await readStdin();
+  const sessionId = input.session_id;
+  if (!sessionId) return;
+  const body = {
+    sessionId,
+    event: opts.finish ? "finish" : "turn",
+    message: input.last_assistant_message ?? ""
+  };
+  if (input.stop_reason) body.stopReason = input.stop_reason;
+  if (input.cwd) body.cwd = input.cwd;
+  if (process.env.ORIGEM_TRIGGER) body.trigger = process.env.ORIGEM_TRIGGER;
+  const durationMs = turnDuration(sessionId);
+  if (durationMs !== void 0) body.durationMs = durationMs;
+  let data;
+  try {
+    const res = await fetch(`${opts.apiUrl}/run?k=${encodeURIComponent(opts.key)}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      // Um turno não pode ficar refém do Origem: se demorar, desiste e deixa parar.
+      signal: AbortSignal.timeout(8e3)
+    });
+    data = await res.json();
+    if (!res.ok) {
+      if (!opts.quiet) process.stderr.write(`origem: ${data.error ?? `HTTP ${res.status}`}
+`);
+      return;
+    }
+  } catch (e) {
+    if (!opts.quiet) process.stderr.write(`origem: ${e.message}
+`);
+    return;
+  }
+  const command = data.command;
+  if (!command) return;
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "Stop",
+      continue: true,
+      continueReason: command.prompt
+    },
+    // Texto que entra no contexto do Claude — em inglês, como todo prompt.
+    systemMessage: `Origem \xB7 command from the site${command.specTitle ? ` \xB7 spec "${command.specTitle}"` : ""}${command.stage ? ` \xB7 stage ${command.stage}` : ""}`
+  };
+  process.stdout.write(JSON.stringify(output));
+}
+function shellQuote(v) {
+  return `'${v.replace(/'/g, `'\\''`)}'`;
+}
+var HOOK_ENTRIES = (bin, args) => ({
+  hooks: {
+    UserPromptSubmit: [
+      { hooks: [{ type: "command", command: `${bin} hook start`, timeout: 5 }] }
+    ],
+    Stop: [
+      {
+        hooks: [
+          {
+            type: "command",
+            command: `${bin} hook stop${args}`,
+            timeout: 15,
+            statusMessage: "Reportando ao Origem\u2026"
+          }
+        ]
+      }
+    ],
+    // Sem isto o run fica "running" pra sempre: nada avisaria que a sessão
+    // acabou. Se ela for retomada, o próximo turno reabre o run sozinho.
+    SessionEnd: [
+      {
+        hooks: [{ type: "command", command: `${bin} hook stop --finish --quiet${args}`, timeout: 10 }]
+      }
+    ]
+  }
+});
+async function hookInstall(opts) {
+  const file = opts.local ? "settings.local.json" : "settings.json";
+  const target = join4(process.cwd(), ".claude", file);
+  const args = (opts.key ? ` --key ${shellQuote(opts.key)}` : "") + (opts.apiUrl ? ` --api-url ${shellQuote(opts.apiUrl)}` : "");
+  const snippet = HOOK_ENTRIES(opts.bin, args);
+  info(`${color.bold("Vai escrever em:")} ${target}`);
+  info(JSON.stringify(snippet, null, 2));
+  info(
+    color.yellow(
+      "\nIsto \xE9 config privilegiada: os hooks rodam um comando na sua m\xE1quina a cada\nturno, e o `stop` pode CONTINUAR a sess\xE3o com um prompt vindo do site.\nQuem escrever na fila do Brain dirige esta sess\xE3o."
+    )
+  );
+  if (opts.key && !opts.local) {
+    info(
+      color.yellow(
+        "O token vai ficar GRAVADO neste arquivo. Se ele for versionado, use --local\n(.claude/settings.local.json, ignorado pelo git) ou exporte ORIGEM_TOKEN."
+      )
+    );
+  }
+  if (!opts.yes && !await confirm("Instalar os hooks?")) {
+    warn("Nada foi escrito.");
+    return;
+  }
+  let existing = {};
+  if (existsSync4(target)) {
+    try {
+      existing = JSON.parse(readFileSync4(target, "utf8"));
+    } catch {
+      throw new Error(`${target} existe mas n\xE3o \xE9 JSON v\xE1lido \u2014 corrija antes de instalar.`);
+    }
+  }
+  const merged = mergeHooks(existing, snippet.hooks);
+  mkdirSync4(dirname4(target), { recursive: true });
+  writeFileSync4(target, `${JSON.stringify(merged, null, 2)}
+`);
+  ok(`Hooks instalados em ${target}`);
+  if (opts.key || opts.apiUrl) {
+    const p = saveConfig({
+      ...opts.key ? { token: opts.key } : {},
+      ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+    });
+    info(color.dim(`Credenciais tamb\xE9m gravadas em ${p} \u2014 \`origem watch\` j\xE1 roda sem flag.`));
+  }
+  if (!opts.key) {
+    info(
+      color.dim(
+        "Sem --key: o hook usa ORIGEM_TOKEN do ambiente do processo do Claude Code.\nNuma sess\xE3o j\xE1 aberta isso n\xE3o pega \u2014 reinicie o Claude com a vari\xE1vel exportada,\nou reinstale com --key."
+      )
+    );
+  }
+}
+function hookIdentity(command) {
+  if (!command) return null;
+  const stripped = command.replace(/\s+--key\s+(?:'(?:[^']|'\\'')*'|"[^"]*"|\S+)/g, "").replace(/\s+--api-url\s+(?:'(?:[^']|'\\'')*'|"[^"]*"|\S+)/g, "").trim();
+  return /\bhook\s+(start|stop)\b/.test(stripped) ? stripped : null;
+}
+function mergeHooks(settings, add) {
+  const current = settings.hooks ?? {};
+  const next = { ...current };
+  for (const [event, entries] of Object.entries(add)) {
+    const existing = Array.isArray(next[event]) ? [...next[event]] : [];
+    const incoming = new Set(
+      entries.flatMap((m) => (m.hooks ?? []).map((h) => hookIdentity(h.command))).filter(Boolean)
+    );
+    const kept = existing.filter(
+      (m) => !(m.hooks ?? []).some((h) => incoming.has(hookIdentity(h.command)))
+    );
+    next[event] = [...kept, ...entries];
+  }
+  return { ...settings, hooks: next };
+}
+
+// src/watch.ts
+import { spawn } from "node:child_process";
+import { accessSync, constants, existsSync as existsSync5, readdirSync } from "node:fs";
+import { hostname, homedir as homedir3 } from "node:os";
+import { join as join5 } from "node:path";
+var WATCHER_ID = `watch:${hostname()}`;
+function isExecutable(p) {
+  try {
+    accessSync(p, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function versionOf(dir) {
+  const m = dir.match(/(\d+(?:\.\d+)*)/);
+  return m ? m[1].split(".").map(Number) : [];
+}
+function newerFirst(a, b) {
+  const va = versionOf(a);
+  const vb = versionOf(b);
+  for (let i = 0; i < Math.max(va.length, vb.length); i++) {
+    const d = (vb[i] ?? 0) - (va[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+function candidates() {
+  const home = homedir3();
+  const out = [];
+  for (const dir of (process.env.PATH ?? "").split(":")) {
+    if (dir) out.push(join5(dir, "claude"));
+  }
+  out.push(join5(home, ".claude", "local", "claude"));
+  const extRoots = [
+    join5(home, ".vscode", "extensions"),
+    join5(home, ".vscode-insiders", "extensions"),
+    join5(home, ".cursor", "extensions"),
+    join5(home, ".windsurf", "extensions")
+  ];
+  for (const root of extRoots) {
+    if (!existsSync5(root)) continue;
+    let dirs;
+    try {
+      dirs = readdirSync(root).filter((d) => d.startsWith("anthropic.claude-code-"));
+    } catch {
+      continue;
+    }
+    for (const d of dirs.sort(newerFirst)) {
+      out.push(join5(root, d, "resources", "native-binary", "claude"));
+    }
+  }
+  out.push("/opt/homebrew/bin/claude", "/usr/local/bin/claude");
+  return out;
+}
+function resolveClaudeBin(flag) {
+  if (flag) return flag;
+  const cached = readConfig().claudeBin;
+  if (cached && isExecutable(cached)) return cached;
+  const found = candidates().find(isExecutable);
+  if (!found) {
+    throw new Error(
+      "N\xE3o achei o bin\xE1rio do Claude Code. Passe --claude <caminho> (no VS Code fica em ~/.vscode/extensions/anthropic.claude-code-*/resources/native-binary/claude)."
+    );
+  }
+  saveConfig({ claudeBin: found });
+  return found;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function poll(opts) {
+  const res = await fetch(`${opts.apiUrl}/run?k=${encodeURIComponent(opts.key)}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ sessionId: WATCHER_ID, event: "poll" }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const data = await res.json();
+  if (!res.ok) throw new Error(data.error ?? `HTTP ${res.status}`);
+  return data.command ?? null;
+}
+function runClaude(bin, opts, prompt, resumeId) {
+  const args = resumeId ? ["-r", resumeId, "-p", prompt] : ["-p", prompt];
+  if (opts.permissionMode) args.push("--permission-mode", opts.permissionMode);
+  return new Promise((resolve) => {
+    const child = spawn(bin, args, {
+      cwd: opts.cwd,
+      stdio: "inherit",
+      // O hook da sessão filha lê isto e reporta a origem do run. Sem isso todo
+      // run apareceria como "Claude Code", sem distinguir o que veio do plantão.
+      env: { ...process.env, ORIGEM_TRIGGER: "origem watch" }
+    });
+    child.on("error", (e) => {
+      warn(e.message);
+      resolve(1);
+    });
+    child.on("close", (code) => resolve(code ?? 0));
+  });
+}
+async function runWatch(opts) {
+  const bin = resolveClaudeBin(opts.claudeBin);
+  info(`${color.bold("origem watch")} \u2014 plant\xE3o local`);
+  info(`  fila:      ${opts.apiUrl}/run`);
+  info(`  diret\xF3rio: ${opts.cwd}`);
+  info(`  claude:    ${bin}`);
+  info(opts.once ? "  modo:      uma passada" : `  intervalo: ${Math.round(opts.intervalMs / 1e3)}s`);
+  info(
+    color.yellow(
+      "\nEnquanto isto roda, quem escrever na fila do Brain FAZ o Claude Code rodar\nnesta m\xE1quina, neste diret\xF3rio. O que trafega \xE9 prompt, e as permiss\xF5es do\nprojeto continuam valendo \u2014 mas o gatilho passa a ser remoto."
+    )
+  );
+  if (opts.permissionMode === "bypassPermissions") {
+    warn("--permission-mode bypassPermissions desliga TODA checagem. N\xE3o use com fila remota.");
+  }
+  if (!opts.dryRun && !opts.once && !opts.yes && !await confirm("\nIniciar o plant\xE3o?")) {
+    warn("Cancelado.");
+    return;
+  }
+  let stop = false;
+  process.on("SIGINT", () => {
+    stop = true;
+    info("\nEncerrando o plant\xE3o\u2026");
+  });
+  let quiet = 0;
+  while (!stop) {
+    let command = null;
+    try {
+      command = await poll(opts);
+      quiet = 0;
+    } catch (e) {
+      quiet++;
+      if (opts.once) throw e;
+      if (quiet <= 3) warn(`${e.message} \u2014 tentando de novo`);
+      await sleep(Math.min(opts.intervalMs * quiet, 6e4));
+      continue;
+    }
+    if (!command) {
+      if (opts.once) {
+        info("Fila vazia.");
+        return;
+      }
+      await sleep(opts.intervalMs);
+      continue;
+    }
+    const alvo = command.targetSessionId ? `retomando a sess\xE3o ${command.targetSessionId}` : "sess\xE3o nova";
+    ok(`Comando recebido (${alvo})`);
+    info(`  ${color.dim(command.prompt)}`);
+    if (opts.dryRun) {
+      info(color.dim("  --dry-run: n\xE3o executei."));
+      if (opts.once) return;
+      await sleep(opts.intervalMs);
+      continue;
+    }
+    const code = await runClaude(bin, opts, command.prompt, command.targetSessionId);
+    if (code === 0) ok("Comando conclu\xEDdo.");
+    else warn(`Claude Code saiu com c\xF3digo ${code}.`);
+    if (opts.once) return;
+  }
+}
+
+// src/auth.ts
+import { rmSync as rmSync2, existsSync as existsSync6 } from "node:fs";
+async function runLogin(opts) {
+  const key = opts.key || process.env.ORIGEM_TOKEN;
+  if (!key) {
+    throw new Error("Passe --key <token>. Gere o link de escrita em 'Conectar com IA' no Origem.");
+  }
+  info(`Verificando o token em ${color.cyan(opts.apiUrl)}\u2026`);
+  await probeToken(opts.apiUrl, key);
+  const p = saveConfig({ token: key, apiUrl: opts.apiUrl });
+  ok(`Token v\xE1lido, com escopo de escrita. Gravado em ${p} (0600).`);
+  info(color.dim("Agora `origem watch` roda sem flag nenhuma."));
+}
+function runLogout() {
+  const p = configPath();
+  if (!existsSync6(p)) {
+    warn("Nada gravado.");
+    return;
+  }
+  const { claudeBin } = readConfig();
+  rmSync2(p);
+  if (claudeBin) saveConfig({ claudeBin });
+  ok(`Credenciais removidas de ${p}.`);
+}
+
+// src/connect.ts
+import * as crypto from "node:crypto";
+import { createServer } from "node:http";
+import { spawn as spawn2 } from "node:child_process";
+import { hostname as hostname2 } from "node:os";
+import { basename } from "node:path";
+
+// src/skill.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join6 } from "node:path";
+var SKILL_PATH = join6(".claude", "skills", "origem", "SKILL.md");
+var SKILL_MD = `---
+name: origem
+description: Sincroniza e inspeciona o harness deste reposit\xF3rio, que \xE9 gerenciado pelo Origem. Use quando o usu\xE1rio pedir para atualizar/sincronizar/puxar o harness ou a config da IA, perguntar de onde v\xEAm CLAUDE.md ou .claude/*, quiser saber se a config local divergiu do Origem, ou pedir para mudar uma regra, skill, subagente ou permiss\xE3o de forma permanente.
+---
+
+# Harness gerenciado pelo Origem
+
+Os arquivos de configura\xE7\xE3o deste reposit\xF3rio \u2014 \`CLAUDE.md\`, \`.claude/settings.json\`,
+\`.claude/skills/\`, \`.claude/agents/\`, \`.claude/commands/\` e \`.mcp.json\` \u2014 n\xE3o foram
+escritos \xE0 m\xE3o aqui. Eles s\xE3o materializados a partir de um harness guardado no Origem,
+e o invent\xE1rio do que foi escrito est\xE1 em \`.origem/lock.json\`.
+
+## O que isso muda no seu comportamento
+
+**Mudan\xE7a permanente vai para o Origem, n\xE3o para o arquivo.** Se o usu\xE1rio pedir uma regra
+nova, uma skill nova, uma permiss\xE3o diferente ou qualquer coisa que deva valer nas pr\xF3ximas
+sess\xF5es, editar o arquivo local funciona at\xE9 o pr\xF3ximo \`origem connect\` \u2014 e some ali.
+Diga isso ao usu\xE1rio e ofere\xE7a registrar a mudan\xE7a no Origem.
+
+**Um arquivo listado no lock \xE9 territ\xF3rio do Origem.** Antes de editar \`CLAUDE.md\` ou
+qualquer coisa sob \`.claude/\`, confira \`.origem/lock.json\`. Arquivos fora dessa lista s\xE3o
+do projeto e voc\xEA edita normalmente.
+
+## Comandos
+
+| Comando | O que faz |
+|---|---|
+| \`npx origem status\` | Mostra o que mudaria e se h\xE1 edi\xE7\xE3o local divergente. \xC9 a leitura segura \u2014 n\xE3o escreve nada. |
+| \`npx origem connect\` | Autoriza (navegador), puxa a vers\xE3o mais nova e reescreve os arquivos. \xC9 tamb\xE9m o comando de sincronizar. |
+| \`npx origem apply\` | Reaplica com a credencial j\xE1 gravada, sem passar pelo navegador. |
+| \`npx origem apply --dry-run\` | S\xF3 imprime o plano. |
+| \`npx origem remove\` | Reverte tudo que o Origem escreveu, usando o lock. |
+| \`npx origem propose\` | Sugere uma mudan\xE7a no harness. **N\xE3o escreve nada** \u2014 fica pendente at\xE9 a pessoa aceitar no site. |
+| \`npx origem spec\` | Mostra os specs abertos e em que est\xE1gio cada um est\xE1. |
+| \`npx origem doctor\` | Compara o harness com este reposit\xF3rio e aponta o que divergiu. |
+| \`npx origem bootstrap\` | L\xEA o reposit\xF3rio e prop\xF5e um harness inteiro (para projeto sem harness). |
+
+## No come\xE7o de uma tarefa
+
+Rode \`npx origem spec\`. Se houver spec aberto relacionado ao que o usu\xE1rio pediu, use os
+crit\xE9rios de aceite dele como defini\xE7\xE3o de pronto, e diga em que est\xE1gio o trabalho est\xE1.
+Se n\xE3o houver, siga normalmente \u2014 trabalho avulso \xE9 leg\xEDtimo.
+
+## Quando o comando que voc\xEA rodou falhar por n\xE3o existir
+
+Rode \`npx origem doctor\`. Ele compara o que o harness afirma com o que o reposit\xF3rio
+declara e costuma encontrar a causa (script renomeado, gerenciador de pacotes errado).
+Corrigir o harness evita que o pr\xF3ximo turno tropece no mesmo lugar.
+
+## Quando propor uma mudan\xE7a
+
+Se durante a sess\xE3o o usu\xE1rio corrigir voc\xEA sobre a mesma coisa mais de uma vez, ou estabelecer
+uma conven\xE7\xE3o que deve valer nas pr\xF3ximas sess\xF5es, proponha:
+
+\`\`\`
+npx origem propose \\
+  --type rule \\
+  --title "Terraform: apply \xE9 sempre manual" \\
+  --why "O usu\xE1rio me corrigiu 3x sobre isto nesta sess\xE3o." \\
+  --content "Nunca rode \`terraform apply\` sem mostrar o plan antes."
+\`\`\`
+
+Compartimentos v\xE1lidos: \`instruction\`, \`rule\`, \`boundary\`, \`memory\`, \`knowledge\`,
+\`skill\`, \`agent\`, \`prompt\`, \`harness\`, \`mcp\`, \`integration\`.
+
+Regras para propor bem:
+- **\`--why\` \xE9 o que a pessoa l\xEA para decidir.** Cite o que aconteceu na sess\xE3o, n\xE3o uma
+  justificativa gen\xE9rica.
+- Proponha **uma coisa por vez**. Duas regras juntas viram uma decis\xE3o dif\xEDcil.
+- N\xE3o proponha o que j\xE1 est\xE1 no harness \u2014 leia antes.
+- Para alterar uma pe\xE7a existente, passe \`--card <id>\` em vez de criar uma nova.
+
+## Quando o usu\xE1rio pedir para sincronizar
+
+Rode \`npx origem status\` primeiro e mostre o resultado. Se houver edi\xE7\xE3o local dentro de um
+bloco gerenciado, avise **antes** de aplicar \u2014 o apply sobrescreve esse bloco.
+
+## Limites
+
+N\xE3o edite \`.origem/lock.json\` na m\xE3o: ele \xE9 o invent\xE1rio que o \`origem remove\` usa para
+saber o que reverter, e um lock inconsistente deixa arquivos \xF3rf\xE3os no projeto.
+`;
+function installOrigemSkill(baseDir, lock) {
+  const fromHarness = (lock?.files ?? []).some(
+    (f) => f.path.replace(/\\/g, "/") === SKILL_PATH.replace(/\\/g, "/")
+  );
+  if (fromHarness) {
+    info(color.dim(`skill do Origem: veio do pr\xF3prio harness, mantida como est\xE1`));
+    return;
+  }
+  const abs = join6(baseDir, SKILL_PATH);
+  if (existsSync7(abs) && readFileSync5(abs, "utf8") === SKILL_MD) {
+    info(color.dim(`skill do Origem j\xE1 atualizada em ${SKILL_PATH}`));
+    return;
+  }
+  mkdirSync5(dirname5(abs), { recursive: true });
+  writeFileSync5(abs, SKILL_MD, "utf8");
+  ok(`skill do Origem instalada em ${SKILL_PATH}`);
+}
+
+// src/connect.ts
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function newPkce() {
+  const verifier = base64url(crypto.randomBytes(32));
+  const challenge = base64url(crypto.createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+async function resolveEndpoints(apiUrl) {
+  const base = apiUrl.replace(/\/$/, "");
+  const pretty = {
+    register: `${base}/oauth/register`,
+    authorize: `${base}/oauth/authorize`,
+    token: `${base}/oauth/token`
+  };
+  const direct = {
+    register: `${base}/oauthRegister`,
+    authorize: `${base}/oauthAuthorize`,
+    token: `${base}/oauthToken`
+  };
+  for (const candidate of [pretty, direct]) {
+    try {
+      const res = await fetch(candidate.register, {
+        method: "OPTIONS",
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (res.status !== 404) return candidate;
+    } catch {
+    }
+  }
+  throw new Error(
+    `N\xE3o encontrei os endpoints OAuth em ${base}. Confira a URL da API (--api-url ou ORIGEM_API_URL) e se ela est\xE1 publicada com o m\xF3dulo de OAuth.`
+  );
+}
+function page(title, body, accent) {
+  return `<!doctype html><meta charset="utf-8"><title>Origem \u2014 ${title}</title><div style="font-family:system-ui,-apple-system,sans-serif;max-width:30rem;margin:5rem auto;padding:0 1.5rem;line-height:1.6"><div style="width:2.25rem;height:2.25rem;border-radius:.6rem;background:${accent};margin-bottom:1.25rem"></div><h1 style="font-size:1.2rem;margin:0 0 .5rem">${title}</h1><p style="color:#666;margin:0">${body}</p></div>`;
+}
+async function startCallbackServer(state) {
+  let settle = null;
+  let fail = null;
+  const waitForCode = new Promise((resolve, reject) => {
+    settle = resolve;
+    fail = reject;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const gotState = url.searchParams.get("state");
+    if (error) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(page("Autoriza\xE7\xE3o negada", "Pode fechar esta aba e voltar ao terminal.", "#b3392e"));
+      fail?.(new Error(`Autoriza\xE7\xE3o negada (${error}).`));
+      return;
+    }
+    if (!code || gotState !== state) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(page("Retorno inv\xE1lido", "Recomece com `origem connect`.", "#b3392e"));
+      fail?.(new Error("Retorno do navegador inv\xE1lido (state n\xE3o confere)."));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(page("Conectado", "Pode fechar esta aba \u2014 o resto acontece no terminal.", "#2540d8"));
+    settle?.({ code });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const timer = setTimeout(() => {
+    fail?.(new Error("Tempo esgotado esperando a autoriza\xE7\xE3o no navegador (5 min)."));
+  }, CALLBACK_TIMEOUT_MS);
+  timer.unref?.();
+  return {
+    port: server.address().port,
+    waitForCode,
+    close: () => {
+      clearTimeout(timer);
+      server.close();
+    }
+  };
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    const child = spawn2(cmd, [url], {
+      stdio: "ignore",
+      detached: true,
+      shell: process.platform === "win32"
+    });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+async function registerClient(endpoint, redirectUri) {
+  const res = await fetch(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: `origem CLI \u2014 ${basename(process.cwd())} (${hostname2()})`,
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) {
+    throw new Error(`N\xE3o consegui registrar o cliente OAuth (HTTP ${res.status}).`);
+  }
+  const data = await res.json();
+  if (!data.client_id) throw new Error("Registro OAuth devolveu resposta sem client_id.");
+  return data;
+}
+async function exchangeCode(endpoint, input) {
+  const res = await fetch(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: input.code,
+      code_verifier: input.verifier,
+      client_id: input.clientId,
+      redirect_uri: input.redirectUri
+    }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.access_token) {
+    throw new Error(
+      `Troca do c\xF3digo falhou (HTTP ${res.status}): ${data.error_description || data.error || "resposta sem access_token"}`
+    );
+  }
+  if (!(data.scope ?? "").split(/\s+/).includes("write")) {
+    warn(
+      "O token veio sem escopo de escrita \u2014 a sess\xE3o n\xE3o vai conseguir reportar turnos. Refa\xE7a o connect e confirme a permiss\xE3o na tela de autoriza\xE7\xE3o."
+    );
+  }
+  return data.access_token;
+}
+async function runConnect(opts) {
+  const apiUrl = opts.apiUrl.replace(/\/$/, "");
+  const { verifier, challenge } = newPkce();
+  const state = base64url(crypto.randomBytes(16));
+  const endpoints = await resolveEndpoints(apiUrl);
+  const server = await startCallbackServer(state);
+  const redirectUri = `http://127.0.0.1:${server.port}/callback`;
+  let token;
+  try {
+    const client = await registerClient(endpoints.register, redirectUri);
+    const authorizeUrl = new URL(endpoints.authorize);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", client.client_id);
+    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("scope", "read write");
+    info(`${color.cyan("\u2192")} abrindo o navegador para autorizar\u2026  ${color.dim(redirectUri)}`);
+    info(color.dim(`   se nada abrir, cole no navegador:
+   ${authorizeUrl.toString()}`));
+    openBrowser(authorizeUrl.toString());
+    const { code } = await server.waitForCode;
+    token = await exchangeCode(endpoints.token, {
+      code,
+      verifier,
+      clientId: client.client_id,
+      redirectUri
+    });
+  } finally {
+    server.close();
+  }
+  saveConfig({ token, apiUrl });
+  ok("autorizado \u2014 credencial gravada em ~/.origem/config.json (0600)");
+  const brain = await fetchBrain(apiUrl, token);
+  brain.__apiUrl = apiUrl;
+  info(
+    `${color.cyan("\u2192")} harness ${color.bold(brain.brain?.name ?? "(sem nome)")} \u2014 ${brain.cards?.length ?? 0} pe\xE7as`
+  );
+  await runApply({
+    brain,
+    scope: opts.scope,
+    targets: opts.targets,
+    dryRun: false,
+    yes: opts.yes
+  });
+  installOrigemSkill(process.cwd(), readLock(process.cwd()));
+  if (opts.noHooks) {
+    info(color.dim("hooks pulados (--no-hooks): a sess\xE3o n\xE3o vai reportar turnos ao Origem."));
+  } else {
+    info("");
+    await hookInstall({
+      yes: opts.yes,
+      bin: opts.bin,
+      key: token,
+      apiUrl,
+      local: true
+      // .claude/settings.local.json é ignorado pelo git — o token não vaza
+    });
+  }
+  info("");
+  ok(color.bold("ligado."));
+  info(color.dim("rode `origem connect` de novo a qualquer momento para sincronizar."));
+}
+
+// src/propose.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+var PROPOSABLE = [
+  "instruction",
+  "rule",
+  "boundary",
+  "memory",
+  "knowledge",
+  "skill",
+  "agent",
+  "prompt",
+  "harness",
+  "mcp",
+  "integration"
+];
+async function runPropose(opts) {
+  if (!PROPOSABLE.includes(opts.type)) {
+    throw new Error(`--type inv\xE1lido: ${opts.type}. Use um de: ${PROPOSABLE.join(", ")}`);
+  }
+  if (!opts.rationale?.trim()) {
+    throw new Error("--why \xE9 obrigat\xF3rio: diga por que est\xE1 propondo (\xE9 o que a pessoa l\xEA pra decidir).");
+  }
+  const content = opts.file ? readFileSync6(opts.file, "utf8") : opts.content ?? "";
+  if (!content.trim()) {
+    throw new Error("Conte\xFAdo vazio. Passe --content <texto> ou --file <caminho>.");
+  }
+  const base = opts.apiUrl.replace(/\/$/, "");
+  const res = await fetch(`${base}/propose?k=${encodeURIComponent(opts.key)}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      cardId: opts.cardId ?? null,
+      type: opts.type,
+      title: opts.title,
+      content,
+      rationale: opts.rationale,
+      sessionId: opts.sessionId ?? process.env.CLAUDE_SESSION_ID ?? null
+    }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (res.status === 403) throw new Error("Token sem escopo de escrita \u2014 refa\xE7a o `origem connect`.");
+  if (res.status === 429) throw new Error(data.error ?? "Rate limit ou fila de propostas cheia.");
+  if (!res.ok || !data.proposalId) {
+    throw new Error(data.error ?? `Falha ao propor (HTTP ${res.status}).`);
+  }
+  ok(`proposta enviada: ${color.bold(opts.title)}`);
+  info(color.dim("Ela fica pendente at\xE9 ser aceita no Origem \u2014 nada foi escrito no harness."));
+}
+
+// src/spec.ts
+var STAGES = ["requisito", "design", "implementacao", "verificacao"];
+async function runSpec(opts) {
+  const base = opts.apiUrl.replace(/\/$/, "");
+  const res = await fetch(`${base}/specs?k=${encodeURIComponent(opts.key)}`, {
+    signal: AbortSignal.timeout(15e3)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (res.status === 401) throw new Error("Token inv\xE1lido \u2014 refa\xE7a o `origem connect`.");
+  if (!res.ok) throw new Error(data.error ?? `Falha ao ler os specs (HTTP ${res.status}).`);
+  const specs = data.specs ?? [];
+  if (specs.length === 0) {
+    ok("nenhum spec aberto \u2014 o trabalho desta sess\xE3o \xE9 avulso.");
+    return;
+  }
+  for (const s of specs) {
+    const at = STAGES.indexOf(s.stage);
+    const trail = STAGES.map(
+      (stage, i) => i < at ? `${color.green("\u2713")} ${stage}` : i === at ? color.bold(`\u25D0 ${stage}`) : color.dim(`\xB7 ${stage}`)
+    ).join("  ");
+    info(`
+${color.bold(s.title)}  ${color.dim(`(${s.id})`)}`);
+    info(`  ${trail}`);
+    if (s.content.trim()) {
+      info("");
+      for (const line of s.content.split("\n")) info(`  ${line}`);
+    }
+  }
+  info(
+    color.dim(
+      `
+${specs.length} spec(s) aberto(s). Ao concluir um est\xE1gio, reporte com \`origem hook stop\` (o hook j\xE1 faz isso) \u2014 o board avan\xE7a sozinho.`
+    )
+  );
+}
+
+// src/repo.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync } from "node:fs";
+import { basename as basename2, extname, join as join7, relative } from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "out",
+  "coverage",
+  "vendor",
+  "target",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".turbo",
+  ".cache"
+]);
+var DOC_EXT = /* @__PURE__ */ new Set([".md", ".mdx"]);
+var MAX_FILE_CHARS = 2e4;
+function read(path) {
+  try {
+    return readFileSync7(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function walk(dir, base, depth = 0, out = []) {
+  if (depth > 3 || out.length > 4e3) return out;
+  let entries;
+  try {
+    entries = readdirSync2(dir);
+  } catch {
+    return out;
+  }
+  for (const name of entries) {
+    if (name.startsWith(".") && name !== ".github") continue;
+    if (SKIP_DIRS.has(name)) continue;
+    const full = join7(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) walk(full, base, depth + 1, out);
+    else out.push(relative(base, full));
+  }
+  return out;
+}
+function readRepo(baseDir) {
+  const files = walk(baseDir, baseDir);
+  const scripts = [];
+  const languages = /* @__PURE__ */ new Set();
+  const pkgRaw = read(join7(baseDir, "package.json"));
+  if (pkgRaw) {
+    try {
+      const pkg = JSON.parse(pkgRaw);
+      for (const [name, command] of Object.entries(pkg.scripts ?? {})) {
+        scripts.push({ name, command, from: "package.json" });
+      }
+    } catch {
+    }
+  }
+  const makefile = read(join7(baseDir, "Makefile"));
+  if (makefile) {
+    for (const line of makefile.split("\n")) {
+      const m = /^([a-zA-Z][\w-]*):(?!=)/.exec(line);
+      if (m) scripts.push({ name: m[1], command: `make ${m[1]}`, from: "Makefile" });
+    }
+  }
+  const pyproject = read(join7(baseDir, "pyproject.toml"));
+  if (pyproject) languages.add("python");
+  for (const f of files) {
+    const ext = extname(f);
+    if (ext === ".ts" || ext === ".tsx") languages.add("typescript");
+    else if (ext === ".js" || ext === ".jsx") languages.add("javascript");
+    else if (ext === ".py") languages.add("python");
+    else if (ext === ".go") languages.add("go");
+    else if (ext === ".rs") languages.add("rust");
+    else if (ext === ".tf") languages.add("terraform");
+    else if (ext === ".java") languages.add("java");
+    else if (ext === ".cs") languages.add("csharp");
+  }
+  const packageManager = existsSync8(join7(baseDir, "pnpm-lock.yaml")) ? "pnpm" : existsSync8(join7(baseDir, "yarn.lock")) ? "yarn" : existsSync8(join7(baseDir, "bun.lockb")) ? "bun" : existsSync8(join7(baseDir, "package-lock.json")) ? "npm" : null;
+  const docs = files.filter((f) => DOC_EXT.has(extname(f)) && (!f.includes("/") || f.startsWith("docs/"))).slice(0, 12).map((f) => ({ path: f, content: (read(join7(baseDir, f)) ?? "").slice(0, MAX_FILE_CHARS) })).filter((d) => d.content.trim());
+  return {
+    name: basename2(baseDir),
+    scripts,
+    packageManager,
+    languages: [...languages],
+    docs,
+    hasCi: files.some((f) => f.startsWith(".github/workflows/")),
+    hasIac: files.some((f) => extname(f) === ".tf" || f.includes("bicep"))
+  };
+}
+function recentCommitSubjects(baseDir, n = 40) {
+  try {
+    const out = execFileSync("git", ["log", `-${n}`, "--pretty=%s"], {
+      cwd: baseDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return out.split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+// src/doctor.ts
+function harnessText(brain) {
+  return (brain.cards ?? []).map((c2) => `${c2.title}
+${c2.content ?? ""}`).join("\n").toLowerCase();
+}
+function detectDrift(brain, repo) {
+  const text = harnessText(brain);
+  const findings = [];
+  const declared = new Set(repo.scripts.map((s) => s.name));
+  const mentionedScripts = [
+    ...text.matchAll(/\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?([a-z][\w:-]*)/g)
+  ].map((m) => m[1]).filter((n) => !["install", "ci", "add", "i", "exec", "dlx", "create"].includes(n));
+  for (const name of new Set(mentionedScripts)) {
+    if (declared.size === 0) break;
+    if (declared.has(name)) continue;
+    findings.push({
+      severity: "critical",
+      message: `O harness manda rodar "${name}", que n\xE3o existe no projeto.`,
+      detail: `Dispon\xEDveis: ${[...declared].slice(0, 12).join(", ") || "(nenhum)"}`
+    });
+  }
+  const testScript = repo.scripts.find((s) => /^(test|tests|check|verify)$/.test(s.name));
+  if (testScript && !/\btest/.test(text)) {
+    findings.push({
+      severity: "critical",
+      message: "O projeto tem comando de teste e o harness n\xE3o menciona nenhum.",
+      detail: `${testScript.from}: ${testScript.name} \u2192 ${testScript.command}`
+    });
+  }
+  if (repo.packageManager) {
+    const others = ["npm", "pnpm", "yarn", "bun"].filter((p) => p !== repo.packageManager);
+    const wrong = others.filter((p) => new RegExp(`\\b${p}\\s+(run|install|test|add)\\b`).test(text));
+    if (wrong.length > 0 && !new RegExp(`\\b${repo.packageManager}\\b`).test(text)) {
+      findings.push({
+        severity: "warning",
+        message: `O harness usa ${wrong.join("/")}, mas o lockfile \xE9 de ${repo.packageManager}.`,
+        detail: "Rodar o gerenciador errado reescreve o lock e quebra o CI."
+      });
+    }
+  }
+  if (repo.hasIac && !/\b(nunca|never|terraform|aprova|confirm)/.test(text)) {
+    findings.push({
+      severity: "warning",
+      message: "O reposit\xF3rio tem infraestrutura como c\xF3digo e o harness n\xE3o declara limites.",
+      detail: "Um `apply` sem gate \xE9 a diferen\xE7a entre um erro e um incidente."
+    });
+  }
+  for (const lang of repo.languages.slice(0, 3)) {
+    if (!text.includes(lang)) {
+      findings.push({
+        severity: "warning",
+        message: `O projeto \xE9 ${lang} e o harness n\xE3o menciona a linguagem.`,
+        detail: "Sem isso, conven\xE7\xF5es de estilo e ferramentas ficam por conta do palpite."
+      });
+      break;
+    }
+  }
+  return findings;
+}
+async function runDoctor(opts) {
+  const brain = await fetchBrain(opts.apiUrl, opts.key);
+  const repo = readRepo(process.cwd());
+  info(
+    `${color.bold(repo.name)} \u2014 ${repo.languages.join(", ") || "linguagem indefinida"}${repo.packageManager ? ` \xB7 ${repo.packageManager}` : ""} \xB7 ${repo.scripts.length} comando(s)`
+  );
+  info(color.dim(`harness: ${brain.brain?.name ?? "?"} \u2014 ${brain.cards?.length ?? 0} pe\xE7as
+`));
+  const findings = detectDrift(brain, repo);
+  if (findings.length === 0) {
+    ok("nenhum drift entre o harness e o reposit\xF3rio.");
+    return;
+  }
+  for (const f of findings) {
+    if (f.severity === "critical") {
+      console.error(`${color.red("\u2717 cr\xEDtico")}  ${f.message}`);
+    } else {
+      warn(f.message);
+    }
+    info(color.dim(`            ${f.detail}`));
+  }
+  info(
+    color.dim(
+      `
+${findings.length} achado(s). Corrija no Origem (a mudan\xE7a vale nas pr\xF3ximas sess\xF5es) ou proponha com \`origem propose\`.`
+    )
+  );
+}
+
+// src/bootstrap.ts
+function buildEntries(repo, commits) {
+  const entries = [];
+  const pm = repo.packageManager ?? "npm";
+  const build = repo.scripts.find((s) => /^(build|compile)$/.test(s.name));
+  const test = repo.scripts.find((s) => /^(test|tests|check|verify)$/.test(s.name));
+  const dev = repo.scripts.find((s) => /^(dev|start|serve)$/.test(s.name));
+  const identity = [
+    `# ${repo.name}`,
+    "",
+    repo.languages.length ? `Projeto em ${repo.languages.join(", ")}.` : "",
+    repo.packageManager ? `Gerenciador de pacotes: **${repo.packageManager}** \u2014 use este, n\xE3o outro.` : "",
+    "",
+    "## Comandos",
+    ""
+  ];
+  const cmd = (label, s) => s ? `- **${label}:** \`${s.from === "Makefile" ? s.command : `${pm} run ${s.name}`}\`` : "";
+  identity.push(cmd("build", build), cmd("testes", test), cmd("dev", dev));
+  const others = repo.scripts.filter((s) => ![build, test, dev].includes(s)).slice(0, 8).map((s) => `- \`${s.from === "Makefile" ? s.command : `${pm} run ${s.name}`}\` \u2014 ${s.command}`);
+  if (others.length) identity.push("", "### Outros", "", ...others);
+  entries.push({
+    type: "instruction",
+    title: `${repo.name} \u2014 vis\xE3o e comandos`,
+    content: identity.filter(Boolean).join("\n"),
+    tags: ["bootstrap"]
+  });
+  const boundaries = [];
+  if (repo.hasIac) {
+    boundaries.push(
+      "- Nunca rode `terraform apply` sem mostrar o plan e obter confirma\xE7\xE3o.",
+      "- Sempre pe\xE7a confirma\xE7\xE3o antes de qualquer opera\xE7\xE3o que destrua recurso."
+    );
+  }
+  if (repo.packageManager) {
+    boundaries.push(
+      `- Nunca rode outro gerenciador que n\xE3o \`${repo.packageManager}\` \u2014 reescreve o lockfile e quebra o CI.`
+    );
+  }
+  if (repo.hasCi) {
+    boundaries.push("- Perguntar antes de alterar workflows em `.github/workflows/`.");
+  }
+  if (boundaries.length) {
+    entries.push({
+      type: "boundary",
+      title: "Limites do projeto",
+      content: ["Sempre / Perguntar antes / Nunca:", "", ...boundaries].join("\n"),
+      tags: ["bootstrap"]
+    });
+  }
+  const conventional = commits.filter((c2) => /^(feat|fix|chore|docs|refactor|test)(\(.+\))?!?:/.test(c2));
+  if (commits.length >= 10 && conventional.length / commits.length > 0.6) {
+    entries.push({
+      type: "rule",
+      title: "Conven\xE7\xE3o de commits",
+      content: [
+        `Este reposit\xF3rio usa Conventional Commits \u2014 ${conventional.length} dos ${commits.length} commits recentes seguem o padr\xE3o.`,
+        "",
+        "Formato: `tipo(escopo): descri\xE7\xE3o`, ex.: `fix(auth): corrige refresh do token`."
+      ].join("\n"),
+      tags: ["bootstrap"]
+    });
+  }
+  for (const doc of repo.docs.slice(0, 6)) {
+    entries.push({
+      type: "knowledge",
+      title: doc.path,
+      content: doc.content,
+      tags: ["bootstrap", "docs"]
+    });
+  }
+  return entries;
+}
+async function runBootstrap(opts) {
+  const baseDir = process.cwd();
+  const repo = readRepo(baseDir);
+  const commits = recentCommitSubjects(baseDir);
+  const entries = buildEntries(repo, commits);
+  info(
+    `${color.bold(repo.name)} \u2014 ${repo.languages.join(", ") || "linguagem indefinida"}${repo.packageManager ? ` \xB7 ${repo.packageManager}` : ""}`
+  );
+  info(`${repo.scripts.length} comando(s) \xB7 ${repo.docs.length} doc(s) \xB7 ${commits.length} commits lidos
+`);
+  info(color.bold("Vai propor:"));
+  for (const e of entries) {
+    const preview = e.content.split("\n").find((l) => l.trim() && !l.startsWith("#")) ?? "";
+    info(`  ${color.cyan(e.type.padEnd(12))} ${e.title}`);
+    info(color.dim(`               ${preview.slice(0, 76)}`));
+  }
+  if (opts.dryRun) {
+    info(color.dim("\n--dry-run: nada foi enviado."));
+    return;
+  }
+  if (!opts.yes && !await confirm(`
+Enviar ${entries.length} proposta(s)?`)) {
+    warn("Nada foi enviado.");
+    return;
+  }
+  const base = opts.apiUrl.replace(/\/$/, "");
+  const res = await fetch(`${base}/ingest?k=${encodeURIComponent(opts.key)}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ source: repo.name, entries }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (res.status === 403) throw new Error("Token sem escopo de escrita \u2014 refa\xE7a o `origem connect`.");
+  if (!res.ok) throw new Error(data.error ?? `Falha ao propor (HTTP ${res.status}).`);
+  ok(`${data.proposed} pe\xE7a(s) propostas como um lote.`);
+  info(color.dim("Aceite ou descarte o lote no Origem \u2014 nada foi escrito no harness ainda."));
+}
+
+// src/index.ts
+var HELP = `${color.bold("origem")} \u2014 materializa um Brain do Origem na config da sua IA.
+
+${color.bold("Uso:")}
+  origem connect  [op\xE7\xF5es]     Conecta este reposit\xF3rio a um harness (autoriza no
+                               navegador, aplica em disco, instala skill + hooks).
+                               Rodar de novo sincroniza.
+  origem spec                  Mostra os specs abertos e em que est\xE1gio est\xE3o
+  origem doctor                Compara o harness com este reposit\xF3rio (drift)
+  origem bootstrap             L\xEA o reposit\xF3rio e prop\xF5e um harness inteiro
+  origem propose  [op\xE7\xF5es]     Sugere uma mudan\xE7a no harness (fica pendente at\xE9
+                               ser aceita no site; n\xE3o escreve nada)
+  origem apply    [op\xE7\xF5es]     Puxa o Brain e escreve os arquivos de config
+  origem status   [op\xE7\xF5es]     Mostra o que mudaria e se h\xE1 edi\xE7\xF5es locais
+  origem remove   [op\xE7\xF5es]     Reverte tudo que o Origem escreveu (usa o lock)
+  origem login    --key <t>    Grava token + API em ~/.origem/config.json (0600)
+  origem logout                Remove as credenciais gravadas
+  origem watch    [op\xE7\xF5es]     Plant\xE3o local: executa comandos da fila mesmo sem sess\xE3o aberta
+  origem hook install          Instala os hooks que ligam a sess\xE3o ao Origem
+  origem hook start            (uso interno) marca o in\xEDcio do turno
+  origem hook stop             (uso interno) reporta o turno e busca comando
+  origem help                  Esta ajuda
+
+${color.bold("Op\xE7\xF5es:")}
+  -k, --key <token>     Token de capacidade (ou env ORIGEM_TOKEN)
+      --api-url <url>   Base da API (ou env ORIGEM_API_URL)
+      --scope <s>       project (padr\xE3o) | user (~/.claude)
+      --dry-run         S\xF3 mostra o plano; n\xE3o escreve
+  -y, --yes             Aplica config privilegiada sem perguntar
+      --targets a,b     Alvos espec\xEDficos (ex: claude,claude-settings,mcp)
+      --all             Todos os alvos (AGENTS.md, Cursor, Gemini, Copilot\u2026)
+      --finish          (hook stop) fecha o run em vez de s\xF3 reportar o turno
+      --quiet           (hook stop) n\xE3o escreve erro no stderr
+      --bin <cmd>       (hook install) comando gravado no settings.json
+      --local           (hook install) grava em .claude/settings.local.json
+      --once            (watch) uma passada s\xF3 e sai (bom pra cron)
+      --no-hooks        (connect) n\xE3o instala os hooks de sess\xE3o
+      --type <t>        (propose) compartimento: rule, boundary, memory, skill\u2026
+      --title <t>       (propose) t\xEDtulo da pe\xE7a
+      --content <t>     (propose) conte\xFAdo, ou use --file <caminho>
+      --why <t>         (propose) por que est\xE1 propondo \u2014 obrigat\xF3rio
+      --card <id>       (propose) altera uma pe\xE7a existente em vez de criar
+      --interval <s>    (watch) segundos entre consultas \xE0 fila (padr\xE3o 5)
+      --claude <path>   (watch) bin\xE1rio do Claude Code (padr\xE3o: descobre sozinho)
+      --cwd <dir>       (watch) diret\xF3rio onde executar (padr\xE3o: o atual)
+      --permission-mode (watch) repassado ao Claude Code
+
+${color.bold("Alvos padr\xE3o (Claude Code):")} ${CLAUDE_TARGETS.join(", ")}
+${color.bold("Todos:")} ${ALL_TARGETS.join(", ")}
+
+${color.bold("Come\xE7ando:")} \`origem connect\` \xE9 o \xFAnico comando necess\xE1rio \u2014 ele autoriza no
+navegador (OAuth + PKCE, sem token colado), grava a credencial, materializa o harness
+e instala a skill. \`login\`/\`apply\`/\`hook install\` continuam dispon\xEDveis pra quem
+precisa dos passos separados.
+
+${color.bold("Controle pelo site:")} com os hooks instalados, cada turno \xE9 reportado ao
+Origem e a resposta pode trazer o pr\xF3ximo prompt da fila \u2014 a sess\xE3o continua sozinha.
+O que trafega \xE9 PROMPT, nunca shell: quem decide o que roda \xE9 a permiss\xE3o do Claude.
+
+${color.bold("Confian\xE7a:")} arquivos privilegiados (settings.json com hooks/env, .mcp.json
+com command) exigem confirma\xE7\xE3o. Defina ORIGEM_SIGNING_SECRET pra exigir assinatura.
+`;
+function parseArgs(argv) {
+  const cmd = argv[0] && !argv[0].startsWith("-") ? argv[0] : "help";
+  const flags = {
+    scope: "project",
+    dryRun: false,
+    yes: false,
+    finish: false,
+    quiet: false,
+    bin: "origem",
+    local: false,
+    interval: 5,
+    once: false,
+    noHooks: false
+  };
+  let rest = argv.slice(cmd === argv[0] ? 1 : 0);
+  if (cmd === "hook" && rest[0] && !rest[0].startsWith("-")) {
+    flags.sub = rest[0];
+    rest = rest.slice(1);
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    switch (a) {
+      case "-k":
+      case "--key":
+        flags.key = rest[++i];
+        break;
+      case "--api-url":
+        flags.apiUrl = rest[++i];
+        break;
+      case "--scope": {
+        const s = rest[++i];
+        if (s !== "project" && s !== "user") throw new Error(`--scope inv\xE1lido: ${s}`);
+        flags.scope = s;
+        break;
+      }
+      case "--dry-run":
+        flags.dryRun = true;
+        break;
+      case "-y":
+      case "--yes":
+        flags.yes = true;
+        break;
+      case "--targets":
+        flags.targets = rest[++i].split(",").map((t) => t.trim());
+        break;
+      case "--all":
+        flags.targets = ALL_TARGETS;
+        break;
+      case "--finish":
+        flags.finish = true;
+        break;
+      case "--quiet":
+        flags.quiet = true;
+        break;
+      case "--bin":
+        flags.bin = rest[++i];
+        break;
+      case "--local":
+        flags.local = true;
+        break;
+      case "--interval": {
+        const n = Number(rest[++i]);
+        if (!Number.isFinite(n) || n < 2) throw new Error("--interval deve ser >= 2 (segundos)");
+        flags.interval = n;
+        break;
+      }
+      case "--once":
+        flags.once = true;
+        break;
+      case "--no-hooks":
+        flags.noHooks = true;
+        break;
+      case "--type":
+        flags.type = rest[++i];
+        break;
+      case "--title":
+        flags.title = rest[++i];
+        break;
+      case "--content":
+        flags.content = rest[++i];
+        break;
+      case "--file":
+        flags.file = rest[++i];
+        break;
+      case "--why":
+        flags.why = rest[++i];
+        break;
+      case "--card":
+        flags.cardId = rest[++i];
+        break;
+      case "--session":
+        flags.sessionId = rest[++i];
+        break;
+      case "--claude":
+        flags.claudeBin = rest[++i];
+        break;
+      case "--cwd":
+        flags.cwd = rest[++i];
+        break;
+      case "--permission-mode":
+        flags.permissionMode = rest[++i];
+        break;
+      default:
+        throw new Error(`Op\xE7\xE3o desconhecida: ${a}`);
+    }
+  }
+  return { cmd, flags };
+}
+async function main() {
+  const { cmd, flags } = parseArgs(process.argv.slice(2));
+  if (cmd === "help" || cmd === "--help" || cmd === "-h") {
+    info(HELP);
+    return;
+  }
+  const targets = flags.targets ?? CLAUDE_TARGETS;
+  switch (cmd) {
+    case "connect": {
+      await runConnect({
+        apiUrl: resolveApiUrl(flags.apiUrl),
+        scope: flags.scope,
+        // `targets` já traz o default (CLAUDE_TARGETS); passar flags.targets aqui
+        // faria o apply cair no "todos os alvos" e escrever GEMINI.md, .cursor/…
+        targets,
+        yes: flags.yes,
+        noHooks: flags.noHooks,
+        bin: flags.bin
+      });
+      break;
+    }
+    case "propose": {
+      if (!flags.type || !flags.title) {
+        throw new Error("Use: origem propose --type <compartimento> --title <t\xEDtulo> --content <texto> --why <motivo>");
+      }
+      await runPropose({
+        apiUrl: resolveApiUrl(flags.apiUrl),
+        key: resolveKey(flags.key),
+        type: flags.type,
+        title: flags.title,
+        content: flags.content,
+        file: flags.file,
+        rationale: flags.why ?? "",
+        cardId: flags.cardId,
+        sessionId: flags.sessionId
+      });
+      break;
+    }
+    case "spec": {
+      await runSpec({ apiUrl: resolveApiUrl(flags.apiUrl), key: resolveKey(flags.key) });
+      break;
+    }
+    case "doctor": {
+      await runDoctor({ apiUrl: resolveApiUrl(flags.apiUrl), key: resolveKey(flags.key) });
+      break;
+    }
+    case "bootstrap": {
+      await runBootstrap({
+        apiUrl: resolveApiUrl(flags.apiUrl),
+        key: resolveKey(flags.key),
+        yes: flags.yes,
+        dryRun: flags.dryRun
+      });
+      break;
+    }
+    case "apply": {
+      const apiUrl = resolveApiUrl(flags.apiUrl);
+      const brain = await fetchBrain(apiUrl, resolveKey(flags.key));
+      brain.__apiUrl = apiUrl;
+      await runApply({ brain, scope: flags.scope, targets, dryRun: flags.dryRun, yes: flags.yes });
+      break;
+    }
+    case "status": {
+      const apiUrl = resolveApiUrl(flags.apiUrl);
+      const brain = await fetchBrain(apiUrl, resolveKey(flags.key));
+      runStatus(brain, flags.scope, targets);
+      break;
+    }
+    case "remove": {
+      runRemove(flags.scope);
+      break;
+    }
+    case "login": {
+      await runLogin({ key: flags.key, apiUrl: resolveApiUrl(flags.apiUrl) });
+      break;
+    }
+    case "logout": {
+      runLogout();
+      break;
+    }
+    case "watch": {
+      await runWatch({
+        apiUrl: resolveApiUrl(flags.apiUrl),
+        key: resolveKey(flags.key),
+        intervalMs: flags.interval * 1e3,
+        cwd: flags.cwd ?? process.cwd(),
+        claudeBin: flags.claudeBin,
+        dryRun: flags.dryRun,
+        yes: flags.yes,
+        once: flags.once,
+        permissionMode: flags.permissionMode
+      });
+      break;
+    }
+    case "hook": {
+      if (flags.sub === "install") {
+        await hookInstall({
+          yes: flags.yes,
+          bin: flags.bin,
+          key: flags.key,
+          apiUrl: flags.apiUrl,
+          local: flags.local
+        });
+        break;
+      }
+      try {
+        if (flags.sub === "start") {
+          await hookStart();
+        } else if (flags.sub === "stop") {
+          await hookStop({
+            apiUrl: resolveApiUrl(flags.apiUrl),
+            key: resolveKey(flags.key),
+            finish: flags.finish,
+            quiet: flags.quiet
+          });
+        } else {
+          err("Use: origem hook install | origem hook start | origem hook stop");
+          process.exitCode = 1;
+        }
+      } catch (e) {
+        if (!flags.quiet) process.stderr.write(`origem: ${e.message}
+`);
+      }
+      break;
+    }
+    default:
+      err(`Comando desconhecido: ${cmd}`);
+      info(HELP);
+      process.exitCode = 1;
+  }
+}
+main().catch((e) => {
+  err(e.message);
+  process.exitCode = 1;
+});