teamwork-os 2.0.2

package/bin/teamos.js

@@ -0,0 +1,3389 @@
+#!/usr/bin/env node
+
+// packages/cli/dist/args.js
+function parseArgs(argv) {
+  const positionals = [];
+  const flags = {};
+  let passthrough = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (passthrough) {
+      positionals.push(arg);
+      continue;
+    }
+    if (arg === "--") {
+      passthrough = true;
+      continue;
+    }
+    if (!arg.startsWith("-") || arg === "-") {
+      positionals.push(arg);
+      continue;
+    }
+    const body = arg.startsWith("--") ? arg.slice(2) : arg.slice(1);
+    const eq = body.indexOf("=");
+    if (eq > 0) {
+      flags[body.slice(0, eq)] = body.slice(eq + 1);
+      continue;
+    }
+    if (body.startsWith("no-") && body.length > 3) {
+      flags[body.slice(3)] = false;
+      continue;
+    }
+    const next = argv[i + 1];
+    if (next !== void 0 && (!next.startsWith("-") || next === "-")) {
+      flags[body] = next;
+      i++;
+    } else {
+      flags[body] = true;
+    }
+  }
+  return { positionals, flags };
+}
+function stringFlag(args, name) {
+  const v = args.flags[name];
+  return typeof v === "string" ? v : void 0;
+}
+function boolFlag(args, name) {
+  const v = args.flags[name];
+  if (v === void 0)
+    return false;
+  if (typeof v === "boolean")
+    return v;
+  const lowered = v.trim().toLowerCase();
+  return lowered !== "false" && lowered !== "0" && lowered !== "no";
+}
+function intFlag(args, name, opts) {
+  const raw = args.flags[name];
+  if (raw === void 0)
+    return void 0;
+  if (typeof raw !== "string" || !/^-?\d+$/.test(raw.trim())) {
+    return { error: `--${name} must be an integer (got ${JSON.stringify(raw)})` };
+  }
+  const n = Number(raw.trim());
+  if (n < opts.min || n > opts.max) {
+    return { error: `--${name} must be between ${opts.min} and ${opts.max} (got ${n})` };
+  }
+  return n;
+}
+
+// packages/cli/dist/context.js
+import fs2 from "node:fs";
+
+// packages/shared/dist/env-file.js
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function parseEnvFile(raw) {
+  const entries = [];
+  for (const rawLine of raw.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).trim();
+    if (!KEY_RE.test(key))
+      continue;
+    entries.push({ key, value: stripQuotes(line.slice(eq + 1).trim()) });
+  }
+  return entries;
+}
+function stripQuotes(raw) {
+  if (raw.length >= 2) {
+    if (raw.startsWith("'") && raw.endsWith("'")) {
+      return raw.slice(1, -1).replace(/'\\''/g, "'");
+    }
+    if (raw.startsWith('"') && raw.endsWith('"')) {
+      return raw.slice(1, -1);
+    }
+  }
+  return raw;
+}
+function formatEnvLine(key, value) {
+  if (!KEY_RE.test(key)) {
+    throw new Error(`Invalid env key (must match ${KEY_RE.source}): ${key}`);
+  }
+  const escaped = value.replace(/'/g, "'\\''");
+  return `${key}='${escaped}'`;
+}
+function formatEnvFile(entries) {
+  if (entries.length === 0)
+    return "";
+  return entries.map(({ key, value }) => formatEnvLine(key, value)).join("\n") + "\n";
+}
+function isShellSafe(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0 || trimmed.startsWith("#"))
+    return true;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1)
+    return true;
+  const key = trimmed.slice(0, eq).trim();
+  if (!KEY_RE.test(key))
+    return false;
+  const value = trimmed.slice(eq + 1);
+  if (value.length === 0)
+    return true;
+  if (value.startsWith("'") && value.endsWith("'") && value.length >= 2)
+    return true;
+  if (value.startsWith('"') && value.endsWith('"') && value.length >= 2)
+    return true;
+  return !/[\s'"`$\\|&;<>()*?#!]/.test(value);
+}
+function auditEnvFile(raw) {
+  const issues = [];
+  const lines = raw.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!isShellSafe(line)) {
+      issues.push({
+        lineNumber: i + 1,
+        line,
+        reason: "value is not POSIX-shell-source-able (unquoted whitespace or special chars)"
+      });
+    }
+  }
+  return issues;
+}
+
+// packages/shared/dist/cron.js
+function parseField(field, min, max) {
+  const values = [];
+  const inBounds = (v) => v >= min && v <= max;
+  const parts = field.split(",");
+  for (const part of parts) {
+    if (part === "*") {
+      for (let i = min; i <= max; i++)
+        values.push(i);
+    } else if (part.startsWith("*/")) {
+      const step = parseInt(part.slice(2), 10);
+      if (isNaN(step) || step <= 0)
+        return null;
+      for (let i = min; i <= max; i += step)
+        values.push(i);
+    } else if (part.includes("/")) {
+      const [rangePart, stepStr] = part.split("/");
+      const step = parseInt(stepStr, 10);
+      if (isNaN(step) || step <= 0)
+        return null;
+      if (rangePart === "*") {
+        for (let i = min; i <= max; i += step)
+          values.push(i);
+      } else if (rangePart.includes("-")) {
+        const [startStr, endStr] = rangePart.split("-");
+        const start = parseInt(startStr, 10);
+        const end = parseInt(endStr, 10);
+        if (isNaN(start) || isNaN(end))
+          return null;
+        if (!inBounds(start) || !inBounds(end) || start > end)
+          return null;
+        for (let i = start; i <= end; i += step)
+          values.push(i);
+      } else {
+        const start = parseInt(rangePart, 10);
+        if (isNaN(start) || !inBounds(start))
+          return null;
+        for (let i = start; i <= max; i += step)
+          values.push(i);
+      }
+    } else if (part.includes("-")) {
+      const [startStr, endStr] = part.split("-");
+      const start = parseInt(startStr, 10);
+      const end = parseInt(endStr, 10);
+      if (isNaN(start) || isNaN(end))
+        return null;
+      if (!inBounds(start) || !inBounds(end) || start > end)
+        return null;
+      for (let i = start; i <= end; i++)
+        values.push(i);
+    } else {
+      const v = parseInt(part, 10);
+      if (isNaN(v) || !inBounds(v))
+        return null;
+      values.push(v);
+    }
+  }
+  return [...new Set(values)].sort((a, b) => a - b);
+}
+function parseCron(expression) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5)
+    return null;
+  const [minuteField, hourField, domField, monthField, dowField] = fields;
+  const minutes = parseField(minuteField, 0, 59);
+  const hours = parseField(hourField, 0, 23);
+  const daysOfMonth = parseField(domField, 1, 31);
+  const months = parseField(monthField, 1, 12);
+  let daysOfWeek = parseField(dowField, 0, 7);
+  if (daysOfWeek) {
+    daysOfWeek = [...new Set(daysOfWeek.map((d) => d === 7 ? 0 : d))].sort((a, b) => a - b);
+  }
+  if (!minutes || !hours || !daysOfMonth || !months || !daysOfWeek)
+    return null;
+  return { minutes, hours, daysOfMonth, months, daysOfWeek };
+}
+function isValidCronExpression(expression) {
+  return parseCron(expression) !== null;
+}
+function isValidTimezone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// packages/shared/dist/jobs.js
+var JOB_PRIORITIES = ["critical", "high", "normal", "low"];
+function toJobPriority(value) {
+  const s = typeof value === "string" ? value : "";
+  return JOB_PRIORITIES.includes(s) ? s : "normal";
+}
+
+// packages/shared/dist/model-aliases.js
+var MODEL_ALIASES = ["low", "medium", "high", "elite", "legendary"];
+var DEFAULT_MODEL_ALIASES = {
+  legendary: { model: "claude-fable-5", effortLevel: "xhigh" },
+  elite: { model: "claude-opus-5", effortLevel: "xhigh" },
+  high: { model: "claude-opus-5", effortLevel: "medium" },
+  medium: { model: "claude-sonnet-5", effortLevel: "medium" },
+  low: { model: "claude-haiku-4-5-20251001" }
+};
+var MODEL_ALIAS_LABELS = {
+  legendary: "Legendary",
+  elite: "Elite",
+  high: "High",
+  medium: "Medium",
+  low: "Low"
+};
+function formatModelAliasTarget(target) {
+  const model = target.model.replace(/^claude-/, "");
+  return target.effortLevel ? `${model} @ ${target.effortLevel}` : model;
+}
+var MODEL_ALIAS_OPTIONS = [
+  "legendary",
+  "elite",
+  "high",
+  "medium",
+  "low"
+].map((value) => {
+  const alias = value;
+  return {
+    value: alias,
+    label: `${MODEL_ALIAS_LABELS[alias]} \xB7 ${formatModelAliasTarget(DEFAULT_MODEL_ALIASES[alias])}`
+  };
+});
+
+// packages/shared/dist/claude-jsonl/normalize.js
+var MAX_TOOL_RESULT_BYTES = 64 * 1024;
+
+// packages/shared/dist/migrate/plan.js
+var TIMEOUT_SEC_MIN = 10;
+var TIMEOUT_SEC_MAX = 6 * 60 * 60;
+var TIMEOUT_SEC_DEFAULT = 900;
+var RETENTION_DAYS_MIN = 1;
+var RETENTION_DAYS_MAX = 3650;
+var RETRY_COUNT_MAX = 3;
+var RETRY_DELAY_MIN = 60;
+var RETRY_DELAY_MAX = 3600;
+var NAME_MAX_LEN = 256;
+var DESCRIPTION_MAX_LEN = 2048;
+var ENV_MAX_ENTRIES = 64;
+var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
+var PERSONA_MAX_LEN = 64 * 1024;
+var SPEND_CAP_MAX_USD = 1e5;
+var SAFE_ID = /^[\w-]{1,128}$/;
+var REASON_MAX_LEN = 512;
+var MASKED_VALUE = "<hidden>";
+var STATE_KEYS = /* @__PURE__ */ new Map([
+  ["lastRun", "run history starts empty in the new home"],
+  ["lastStatus", "run history starts empty in the new home"],
+  ["lastFailureReason", "run history starts empty in the new home"],
+  ["lastSkipReason", "run history starts empty in the new home"],
+  ["retryAttempts", "runner-owned counter; resets per cycle"],
+  ["consecutiveSkips", "runner-owned counter; resets on first run"],
+  ["activeSessionId", "points at a session in the legacy sessions DB"],
+  ["pausedReason", "the import sets its own pause reason"]
+]);
+var DROPPED_JOB_KEYS = /* @__PURE__ */ new Map([
+  ["scheduleHuman", "a derived label; the new scheduler renders it from the cron expression"],
+  ["tags", "job tags have no equivalent \u2014 the rebuilt Job carries no taxonomy"],
+  ["skipIfRunning", "per-job serialization is now unconditional: the scheduler never overlaps two runs of one job"],
+  ["claudeAiMcp", "a toggle for one hosted MCP server; the rebuilt Job declares the servers it wants by name in mcpServers, so there is no boolean to carry"],
+  [
+    "profile",
+    "named a legacy engine profile whose settings live outside the job file (and outside --from/jobs/), so there is nothing here to read them from. The rebuilt Job carries its own runtime identity \u2014 set model / persona / pluginDirs / mcpServers on the job by hand"
+  ],
+  ["dependsOn", "job chaining is not in the rebuild"],
+  ["jobTriggers", "job chaining is not in the rebuild"],
+  ["outputs", "job chaining is not in the rebuild"],
+  ["inputs", "job chaining is not in the rebuild"],
+  ["triggers", "webhook triggers are not in the rebuild"],
+  [
+    "engineOverrides",
+    "the rebuilt Job carries model / pluginDirs / mcpServers itself, but this legacy override block is not mapped field by field \u2014 re-enter what you still want on the job"
+  ],
+  ["remoteHost", "remote execution is not in the rebuild"],
+  ["autonomy", "the autonomy ladder is not in the rebuild"],
+  ["memory", "the memory subsystem is not in the rebuild"]
+]);
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isEmptyish(v) {
+  if (v === void 0 || v === null || v === "")
+    return true;
+  if (Array.isArray(v))
+    return v.length === 0;
+  if (typeof v === "object")
+    return Object.keys(v).length === 0;
+  return false;
+}
+function summarize(v) {
+  if (v === void 0)
+    return "undefined";
+  if (typeof v === "string")
+    return v.length > 60 ? `${JSON.stringify(v.slice(0, 57))}\u2026` : JSON.stringify(v);
+  const s = JSON.stringify(v) ?? String(v);
+  return s.length > 60 ? `${s.slice(0, 57)}\u2026` : s;
+}
+function describeShape(v) {
+  if (v === void 0)
+    return "undefined";
+  if (v === null)
+    return "null";
+  if (typeof v === "number" || typeof v === "boolean")
+    return String(v);
+  if (typeof v === "string")
+    return `string, ${v.length} char(s) \u2014 value withheld`;
+  if (Array.isArray(v))
+    return `array, ${v.length} item(s) \u2014 values withheld`;
+  if (typeof v === "object")
+    return `object, ${Object.keys(v).length} key(s) \u2014 values withheld`;
+  return `${typeof v} \u2014 value withheld`;
+}
+function clampInt(value, min, max) {
+  const rounded = Math.trunc(value);
+  if (rounded < min)
+    return { value: min, clamped: true };
+  if (rounded > max)
+    return { value: max, clamped: true };
+  return { value: rounded, clamped: rounded !== value };
+}
+function placeholderPersona(employee) {
+  return `You are the "${employee}" agent, imported from the legacy teamwork-os org. Replace this text with the persona you actually want.`.slice(0, PERSONA_MAX_LEN);
+}
+function mapPreflight(raw, items) {
+  if (!Array.isArray(raw)) {
+    if (raw !== void 0) {
+      items.push({ kind: "dropped", from: "preflight", value: summarize(raw), note: "not an array" });
+    }
+    return void 0;
+  }
+  const out = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") {
+      items.push({ kind: "dropped", from: "preflight[]", value: summarize(entry), note: "not an object" });
+      continue;
+    }
+    const e = entry;
+    const name = str(e.name);
+    const url = str(e.url);
+    const filePath = str(e.path);
+    if (e.kind === "env" && name)
+      out.push({ kind: "env", name });
+    else if (e.kind === "file" && filePath)
+      out.push({ kind: "file", path: filePath });
+    else if (e.kind === "http" && url) {
+      const timeoutMs = typeof e.timeoutMs === "number" && e.timeoutMs > 0 ? Math.trunc(e.timeoutMs) : void 0;
+      out.push(timeoutMs !== void 0 ? { kind: "http", url, timeoutMs } : { kind: "http", url });
+    } else {
+      items.push({
+        kind: "dropped",
+        from: "preflight[]",
+        value: summarize(entry),
+        note: "unsupported check kind \u2014 the rebuild supports env / file / http"
+      });
+    }
+  }
+  if (out.length > 0) {
+    items.push({ kind: "mapped", from: "preflight", to: "preflight", value: `${out.length} check(s)` });
+  }
+  return out.length > 0 ? out : void 0;
+}
+function mapEnv(raw, items, warnings) {
+  if (raw === void 0 || raw === null)
+    return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    items.push({ kind: "dropped", from: "env", value: describeShape(raw), note: "not an object" });
+    return void 0;
+  }
+  const entries = Object.entries(raw);
+  if (entries.length === 0) {
+    items.push({ kind: "dropped", from: "env", value: "{}", note: "empty" });
+    return void 0;
+  }
+  const out = {};
+  let kept = 0;
+  for (const [key, value] of entries) {
+    if (typeof value !== "string" || !ENV_KEY_RE.test(key)) {
+      items.push({ kind: "dropped", from: `env.${key.slice(0, 64)}`, note: "unusable key or non-string value" });
+      continue;
+    }
+    if (kept >= ENV_MAX_ENTRIES) {
+      items.push({ kind: "dropped", from: `env.${key.slice(0, 64)}`, note: `over the ${ENV_MAX_ENTRIES}-entry limit` });
+      continue;
+    }
+    out[key] = value;
+    kept++;
+    items.push({ kind: "mapped", from: `env.${key}`, to: `env.${key}`, value: MASKED_VALUE });
+  }
+  if (kept > 0) {
+    warnings.push(`carries ${kept} env var(s); values were copied but are never printed \u2014 verify them with \`teamos jobs show\``);
+  }
+  return kept > 0 ? out : void 0;
+}
+function planJob(source, pauseAll, existingJobIds) {
+  const raw = source.raw;
+  const items = [];
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const take = (key) => {
+    seen.add(key);
+    return raw[key];
+  };
+  const id = str(take("id"));
+  if (!id || !SAFE_ID.test(id)) {
+    return { rejected: `id ${summarize(raw.id)} is missing or not filename-safe (letters, numbers, hyphens, underscores)` };
+  }
+  if (existingJobIds.has(id)) {
+    warnings.push(`a job named "${id}" already exists in the target home \u2014 this import OVERWRITES it. Re-running the same import looks exactly like this; confirm it is not an unrelated job that happens to share the id.`);
+  }
+  const prompt = str(take("prompt"));
+  const command = str(take("command"));
+  if (prompt && command) {
+    return { rejected: `${id}: both prompt and command are set \u2014 the rebuilt Job is one or the other, so a human has to choose` };
+  }
+  if (!prompt && !command) {
+    return { rejected: `${id}: neither prompt nor command has content` };
+  }
+  const kind = prompt ? "prompt" : "shell";
+  items.push({
+    kind: "mapped",
+    from: kind,
+    to: kind,
+    value: `${kind} job, ${(prompt ?? command ?? "").length} chars`
+  });
+  const inert = kind === "prompt" ? "command" : "prompt";
+  if (raw[inert] !== void 0) {
+    items.push({ kind: "dropped", from: inert, value: summarize(raw[inert]), note: "empty in the legacy record; this is a " + kind + " job" });
+  }
+  const schedule = typeof take("schedule") === "string" ? raw.schedule : "";
+  if (!isValidCronExpression(schedule)) {
+    return { rejected: `${id}: schedule ${summarize(schedule)} does not parse as 5-field cron` };
+  }
+  items.push({ kind: "mapped", from: "schedule", to: "schedule", value: schedule, note: "copied verbatim \u2014 not normalized" });
+  const timezone = str(take("timezone"));
+  if (timezone !== void 0 && !isValidTimezone(timezone)) {
+    return { rejected: `${id}: timezone ${summarize(timezone)} is not an IANA zone Intl can resolve` };
+  }
+  if (timezone) {
+    items.push({ kind: "mapped", from: "timezone", to: "timezone", value: timezone });
+  } else {
+    items.push({
+      kind: "defaulted",
+      from: "(none)",
+      to: "timezone",
+      value: "absent",
+      note: "legacy schedules were host-local wall clock; an absent timezone means exactly that in the new scheduler"
+    });
+  }
+  const scheduleHuman = str(take("scheduleHuman"));
+  const name = (str(take("name")) ?? id).slice(0, NAME_MAX_LEN);
+  const description = str(take("description"))?.slice(0, DESCRIPTION_MAX_LEN);
+  items.push({ kind: "mapped", from: "name", to: "name", value: name });
+  if (description)
+    items.push({ kind: "mapped", from: "description", to: "description", value: `${description.length} chars` });
+  const legacyEnabled = take("enabled") !== false;
+  const enabled = pauseAll ? false : legacyEnabled;
+  items.push({
+    kind: "mapped",
+    from: "enabled",
+    to: "enabled",
+    value: String(enabled),
+    note: pauseAll ? `--pause-all: imported disabled (was ${legacyEnabled})` : void 0
+  });
+  const rawTimeout = take("timeout");
+  let timeoutSec = TIMEOUT_SEC_DEFAULT;
+  if (typeof rawTimeout === "number" && Number.isFinite(rawTimeout) && rawTimeout > 0) {
+    const { value, clamped } = clampInt(rawTimeout, TIMEOUT_SEC_MIN, TIMEOUT_SEC_MAX);
+    timeoutSec = value;
+    items.push({
+      kind: "mapped",
+      from: "timeout",
+      to: "timeoutSec",
+      value: String(value),
+      note: clamped ? `legacy value ${rawTimeout} clamped to the ${TIMEOUT_SEC_MIN}\u2013${TIMEOUT_SEC_MAX}s range` : void 0
+    });
+    if (clamped) {
+      warnings.push(`timeout ${rawTimeout} was out of range and became ${value}s \u2014 confirm that is the budget you want`);
+    }
+  } else {
+    items.push({
+      kind: "defaulted",
+      from: "timeout",
+      to: "timeoutSec",
+      value: String(TIMEOUT_SEC_DEFAULT),
+      note: rawTimeout === void 0 ? "absent in the legacy record" : `unusable legacy value ${summarize(rawTimeout)}`
+    });
+  }
+  const rawRetention = take("logRetention");
+  let retentionDays;
+  if (typeof rawRetention === "number" && Number.isFinite(rawRetention) && rawRetention > 0) {
+    const { value, clamped } = clampInt(rawRetention, RETENTION_DAYS_MIN, RETENTION_DAYS_MAX);
+    retentionDays = value;
+    items.push({
+      kind: "mapped",
+      from: "logRetention",
+      to: "retentionDays",
+      value: String(value),
+      note: clamped ? `legacy value ${rawRetention} clamped` : void 0
+    });
+  } else if (rawRetention !== void 0) {
+    items.push({ kind: "dropped", from: "logRetention", value: summarize(rawRetention), note: "unusable value" });
+  }
+  const employee = str(take("employee"));
+  const legacyProfile = str(take("profile"));
+  let persona;
+  if (employee) {
+    persona = placeholderPersona(employee);
+    items.push({
+      kind: "mapped",
+      from: "employee",
+      to: "persona",
+      value: employee,
+      note: "the org/employee subsystem is not in the rebuild; the name seeds a PLACEHOLDER persona on the job \u2014 it is appended to every turn, so replace it or delete it"
+    });
+    warnings.push(`legacy employee "${employee}" became a PLACEHOLDER \`persona\` on this job, which is appended to the system prompt on every turn \u2014 replace it with the text you want, or remove the field`);
+  } else if (raw.employee !== void 0) {
+    items.push({
+      kind: "dropped",
+      from: "employee",
+      value: summarize(raw.employee),
+      note: "not a usable employee name, so it seeds no persona"
+    });
+  }
+  if (raw.profile !== void 0) {
+    items.push({
+      kind: "dropped",
+      from: "profile",
+      value: summarize(raw.profile),
+      note: DROPPED_JOB_KEYS.get("profile")
+    });
+    if (legacyProfile) {
+      warnings.push(`named the legacy engine profile "${legacyProfile}"; its settings are NOT imported (they live outside the job file) \u2014 set model / persona / pluginDirs / mcpServers on this job by hand if the run needs them`);
+    }
+  }
+  const rawSpendCap = take("maxCostUsd");
+  let spendCapUsd;
+  if (typeof rawSpendCap === "number" && Number.isFinite(rawSpendCap) && rawSpendCap > 0) {
+    spendCapUsd = Math.min(rawSpendCap, SPEND_CAP_MAX_USD);
+    items.push({
+      kind: "mapped",
+      from: "maxCostUsd",
+      to: "spendCapUsd",
+      value: String(spendCapUsd),
+      note: spendCapUsd !== rawSpendCap ? `legacy value ${rawSpendCap} capped at ${SPEND_CAP_MAX_USD}` : void 0
+    });
+  } else if (rawSpendCap !== void 0) {
+    items.push({
+      kind: "dropped",
+      from: "maxCostUsd",
+      value: summarize(rawSpendCap),
+      note: "unusable value \u2014 a spend cap has to be a positive number of USD, so this job gets none"
+    });
+  }
+  const rawRetryCount = take("retryCount");
+  let retryCount;
+  if (typeof rawRetryCount === "number" && Number.isFinite(rawRetryCount) && rawRetryCount > 0) {
+    const { value, clamped } = clampInt(rawRetryCount, 0, RETRY_COUNT_MAX);
+    retryCount = value;
+    items.push({ kind: "mapped", from: "retryCount", to: "retryCount", value: String(value), note: clamped ? "clamped to 0\u20133" : void 0 });
+  } else if (rawRetryCount !== void 0) {
+    items.push({ kind: "mapped", from: "retryCount", to: "retryCount", value: "0", note: "no stall retries" });
+  }
+  const rawRetryDelay = take("retryDelay");
+  let retryDelay;
+  if (retryCount !== void 0 && retryCount > 0 && typeof rawRetryDelay === "number" && Number.isFinite(rawRetryDelay)) {
+    const { value, clamped } = clampInt(rawRetryDelay, RETRY_DELAY_MIN, RETRY_DELAY_MAX);
+    retryDelay = value;
+    items.push({ kind: "mapped", from: "retryDelay", to: "retryDelay", value: String(value), note: clamped ? "clamped to 60\u20133600s" : void 0 });
+  } else if (rawRetryDelay !== void 0) {
+    items.push({
+      kind: "dropped",
+      from: "retryDelay",
+      value: summarize(rawRetryDelay),
+      note: "inert without retryCount > 0"
+    });
+  }
+  const rawPriority = take("priority");
+  let priority;
+  if (rawPriority !== void 0) {
+    priority = toJobPriority(rawPriority);
+    items.push({
+      kind: "mapped",
+      from: "priority",
+      to: "priority",
+      value: priority,
+      note: priority === "normal" && rawPriority !== "normal" ? `unrecognized value ${summarize(rawPriority)} \u2192 normal` : void 0
+    });
+  }
+  const selfImprove = take("selfImprove") === true ? true : void 0;
+  if (raw.selfImprove !== void 0) {
+    items.push({ kind: "mapped", from: "selfImprove", to: "selfImprove", value: String(selfImprove === true) });
+  }
+  const ignorePauses = take("ignorePauses") === true ? true : void 0;
+  if (raw.ignorePauses !== void 0) {
+    items.push({ kind: "mapped", from: "ignorePauses", to: "ignorePauses", value: String(ignorePauses === true) });
+  }
+  const cwd = str(take("cwd"));
+  if (cwd)
+    items.push({ kind: "mapped", from: "cwd", to: "cwd", value: cwd });
+  const preflight = mapPreflight(take("preflight"), items);
+  const env = mapEnv(take("env"), items, warnings);
+  const createdAt = str(take("createdAt")) ?? (/* @__PURE__ */ new Date(0)).toISOString();
+  items.push({ kind: "mapped", from: "createdAt", to: "createdAt", value: createdAt });
+  const catchUp = "run-once";
+  items.push({
+    kind: "defaulted",
+    from: "(none)",
+    to: "catchUp",
+    value: catchUp,
+    note: "matches the legacy missed-run behavior (exactly one catch-up)"
+  });
+  if (raw.skipIfRunning === false) {
+    warnings.push("legacy skipIfRunning was false (overlapping runs allowed); the new scheduler never overlaps two runs of one job");
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (seen.has(key))
+      continue;
+    const stateReason = STATE_KEYS.get(key);
+    if (stateReason) {
+      items.push({ kind: "state", from: key, value: summarize(value), note: stateReason });
+      continue;
+    }
+    const droppedReason = DROPPED_JOB_KEYS.get(key);
+    if (droppedReason) {
+      items.push({
+        kind: "dropped",
+        from: key,
+        value: summarize(value),
+        note: isEmptyish(value) ? `${droppedReason} (was empty)` : droppedReason
+      });
+      continue;
+    }
+    items.push({
+      kind: "unrecognized",
+      from: key,
+      value: describeShape(value),
+      note: "this importer has no rule for this key \u2014 review it by hand (the value is withheld: an unknown key may hold a credential)"
+    });
+  }
+  if (scheduleHuman) {
+    items.push({
+      kind: "dropped",
+      from: "scheduleHuman",
+      value: scheduleHuman,
+      note: `${DROPPED_JOB_KEYS.get("scheduleHuman")} \u2014 verify it still describes "${schedule}"`
+    });
+  }
+  const job = {
+    id,
+    name,
+    ...description !== void 0 ? { description } : {},
+    schedule,
+    ...timezone !== void 0 ? { timezone } : {},
+    enabled,
+    ...prompt !== void 0 ? { prompt } : {},
+    ...command !== void 0 ? { command } : {},
+    ...cwd !== void 0 ? { cwd } : {},
+    timeoutSec,
+    ...persona !== void 0 ? { persona } : {},
+    ...spendCapUsd !== void 0 ? { spendCapUsd } : {},
+    ...env !== void 0 ? { env } : {},
+    ...retentionDays !== void 0 ? { retentionDays } : {},
+    catchUp,
+    ...priority !== void 0 ? { priority } : {},
+    ...selfImprove !== void 0 ? { selfImprove } : {},
+    ...retryCount !== void 0 && retryCount > 0 ? { retryCount } : {},
+    ...retryDelay !== void 0 ? { retryDelay } : {},
+    ...ignorePauses !== void 0 ? { ignorePauses } : {},
+    ...preflight !== void 0 ? { preflight } : {},
+    createdAt,
+    lastRun: null,
+    lastStatus: null,
+    ...pauseAll ? { pausedReason: "imported paused by `teamos migrate --pause-all` for the parallel run" } : {}
+  };
+  return {
+    plan: {
+      id,
+      sourceFile: source.file,
+      kind,
+      job,
+      items,
+      warnings
+    }
+  };
+}
+var DROPPED_SETTINGS_SECTIONS = /* @__PURE__ */ new Map([
+  ["org", "the org/employee subsystem is not in the rebuild"],
+  ["orgDefaults", "the org/employee subsystem is not in the rebuild"],
+  ["pipeline", "the pipeline/workflow subsystem is not in the rebuild"],
+  ["pipelineFeatures", "the pipeline/workflow subsystem is not in the rebuild"],
+  ["appearance", "the lean dashboard has one theme; no appearance settings"],
+  ["schedulerSettings", "the plan-tier / run-budget optimizer is not in the rebuild"],
+  ["ollama", "the Ollama engine is not in the rebuild (Claude CLI only)"],
+  ["memorySteward", "the memory subsystem is not in the rebuild"],
+  ["continuousImprovement", "the autonomy subsystem is not in the rebuild"],
+  ["supervisor", "the autonomy subsystem is not in the rebuild"],
+  ["heartbeat", "the autonomy subsystem is not in the rebuild"],
+  ["prAutoFix", "the autonomy subsystem is not in the rebuild"],
+  ["compilePages", "the memory subsystem is not in the rebuild"],
+  ["autoEnrich", "the org/enrichment subsystem is not in the rebuild"],
+  ["autoEnrichIntervalMinutes", "the org/enrichment subsystem is not in the rebuild"],
+  ["autoTuneTimeouts", "timeout auto-tuning is not in the rebuild"],
+  ["syncDir", "the sync-directory feature is not in the rebuild"]
+]);
+var DROPPED_ENGINE_KEYS = /* @__PURE__ */ new Map([
+  ["default", "the Claude CLI is the only engine"],
+  ["defaultEffortLevel", "no effort-level knob in the rebuilt engine"],
+  ["allowOverage", "no overage policy in the rebuilt engine"],
+  ["pool", "the session pool is not in the rebuild"],
+  ["ollama", "the Ollama engine is not in the rebuild"]
+]);
+var DROPPED_SLACK_KEYS = /* @__PURE__ */ new Map([
+  ["botMcpName", "the connector talks to Slack directly; no bot-MCP indirection"],
+  ["threadResume", "a thread is one session by construction now \u2014 always resumed, no toggle"],
+  ["threadResumeMaxTurns", "no per-thread turn ceiling in the rebuilt connector"],
+  ["threadResumeIdleHours", "no idle expiry in the rebuilt connector"],
+  ["streamReplies", "replies never stream; the progress card carries status and the sealed answer"],
+  ["heartbeat", "the progress card replaces the heartbeat message"],
+  ["autoCompactEnabled", "no auto-compaction in the rebuilt connector"],
+  ["autoCompactThresholdTokens", "no auto-compaction in the rebuilt connector"],
+  ["responderEmployee", "the org/employee subsystem is not in the rebuild"]
+]);
+var DROPPED_MAINTENANCE_KEYS = /* @__PURE__ */ new Map([
+  ["enabled", "the retention sweep always runs"],
+  ["safetyIntervalSecs", "no safety sweep in the rebuild"],
+  ["maintenanceIntervalSecs", "the retention sweep runs daily, not on an interval knob"],
+  ["diskWarningThresholdMb", "no disk-threshold alerting in the rebuild"],
+  ["dbWarningThresholdMb", "no db-threshold alerting in the rebuild"]
+]);
+function planSettings(legacy, current, now) {
+  const items = [];
+  const warnings = [];
+  const pauseEntries = [];
+  if (!legacy) {
+    return {
+      plan: { settings: current, items: [{ kind: "defaulted", from: "(no legacy settings.json)", to: "settings", value: "target settings unchanged" }], warnings },
+      pauseEntries
+    };
+  }
+  const next = {
+    server: current.server,
+    retention: { ...current.retention },
+    engine: { ...current.engine },
+    channels: { directory: { ...current.channels.directory } },
+    scheduler: { ...current.scheduler },
+    slack: { ...current.slack }
+  };
+  const seen = /* @__PURE__ */ new Set();
+  const take = (key) => {
+    seen.add(key);
+    return legacy[key];
+  };
+  const mcj = take("maxConcurrentJobs");
+  if (typeof mcj === "number" && Number.isFinite(mcj) && mcj > 0) {
+    const { value, clamped } = clampInt(mcj, 1, 32);
+    next.scheduler.maxConcurrentJobs = value;
+    items.push({ kind: "mapped", from: "maxConcurrentJobs", to: "scheduler.maxConcurrentJobs", value: String(value), note: clamped ? "clamped to 1\u201332" : void 0 });
+  } else if (mcj !== void 0) {
+    items.push({ kind: "dropped", from: "maxConcurrentJobs", value: summarize(mcj), note: "unusable value" });
+  }
+  const engine = take("engine");
+  if (engine && typeof engine === "object" && !Array.isArray(engine)) {
+    for (const [key, value] of Object.entries(engine)) {
+      const path11 = `engine.${key}`;
+      if (key === "defaultModel" && typeof value === "string") {
+        next.engine.defaultModel = value;
+        items.push({ kind: "mapped", from: path11, to: "engine.defaultModel", value: value === "" ? "(CLI default)" : value });
+      } else if (key === "maxRetries" && typeof value === "number" && Number.isFinite(value) && value >= 0) {
+        next.engine.maxRetries = clampInt(value, 0, 10).value;
+        items.push({ kind: "mapped", from: path11, to: "engine.maxRetries", value: String(next.engine.maxRetries) });
+      } else if (key === "retryBaseDelayMs" && typeof value === "number" && Number.isFinite(value) && value > 0) {
+        next.engine.retryBaseDelayMs = clampInt(value, 1, 6e4).value;
+        items.push({ kind: "mapped", from: path11, to: "engine.retryBaseDelayMs", value: String(next.engine.retryBaseDelayMs) });
+      } else if (key === "noProgressTimeoutMs" && typeof value === "number" && Number.isFinite(value) && value >= 0) {
+        next.engine.noProgressTimeoutMs = clampInt(value, 0, 6 * 60 * 60 * 1e3).value;
+        items.push({ kind: "mapped", from: path11, to: "engine.noProgressTimeoutMs", value: String(next.engine.noProgressTimeoutMs) });
+      } else {
+        const reason = DROPPED_ENGINE_KEYS.get(key);
+        items.push(reason ? { kind: "dropped", from: path11, value: summarize(value), note: reason } : { kind: "unrecognized", from: path11, value: describeShape(value), note: "no rule for this key \u2014 review by hand (value withheld)" });
+      }
+    }
+  }
+  const maintenance = take("maintenance");
+  if (maintenance && typeof maintenance === "object" && !Array.isArray(maintenance)) {
+    for (const [key, value] of Object.entries(maintenance)) {
+      const path11 = `maintenance.${key}`;
+      if (key === "sessionRetentionDays" && typeof value === "number" && Number.isFinite(value) && value > 0) {
+        const { value: days, clamped } = clampInt(value, RETENTION_DAYS_MIN, RETENTION_DAYS_MAX);
+        next.retention.days = days;
+        items.push({ kind: "mapped", from: path11, to: "retention.days", value: String(days), note: clamped ? "clamped" : void 0 });
+      } else {
+        const reason = DROPPED_MAINTENANCE_KEYS.get(key);
+        items.push(reason ? { kind: "dropped", from: path11, value: summarize(value), note: reason } : { kind: "unrecognized", from: path11, value: describeShape(value), note: "no rule for this key \u2014 review by hand (value withheld)" });
+      }
+    }
+  }
+  const slack = take("slack");
+  if (slack && typeof slack === "object" && !Array.isArray(slack)) {
+    for (const [key, value] of Object.entries(slack)) {
+      const path11 = `slack.${key}`;
+      if (key === "channelCwd" && value && typeof value === "object" && !Array.isArray(value)) {
+        let mapped = 0;
+        for (const [channel, cwd] of Object.entries(value)) {
+          if (typeof cwd !== "string" || cwd.length === 0 || channel.length === 0) {
+            items.push({ kind: "dropped", from: `${path11}.${channel.slice(0, 64)}`, note: "unusable channel or path" });
+            continue;
+          }
+          next.channels.directory[channel] = cwd;
+          mapped++;
+          items.push({ kind: "mapped", from: `${path11}.${channel}`, to: `channels.directory.${channel}`, value: cwd });
+        }
+        if (mapped > 0) {
+          warnings.push(`${mapped} channel\u2192cwd mapping(s) landed in channels.directory \u2014 every path must exist on this host or the connector falls back to the teamwork home`);
+        }
+      } else if (key === "requireMention" && typeof value === "boolean") {
+        next.slack.requireMention = value;
+        items.push({ kind: "mapped", from: path11, to: "slack.requireMention", value: String(value) });
+      } else if (key === "ackReaction" && typeof value === "string") {
+        next.slack.ackEmoji = value;
+        items.push({ kind: "mapped", from: path11, to: "slack.ackEmoji", value: value === "" ? "(ack disabled)" : value });
+      } else if (key === "includeChannelHistory" && typeof value === "boolean") {
+        next.slack.historyLimit = value ? current.slack.historyLimit : 0;
+        items.push({
+          kind: "mapped",
+          from: path11,
+          to: "slack.historyLimit",
+          value: String(next.slack.historyLimit),
+          note: value ? "history priming stays on; the rebuild expresses it as a message count" : "false \u2192 0 messages of history"
+        });
+      } else {
+        const reason = DROPPED_SLACK_KEYS.get(key);
+        items.push(reason ? { kind: "dropped", from: path11, value: summarize(value), note: reason } : { kind: "unrecognized", from: path11, value: describeShape(value), note: "no rule for this key \u2014 review by hand (value withheld)" });
+      }
+    }
+  }
+  const globalPause = take("globalPause");
+  if (globalPause && typeof globalPause === "object" && !Array.isArray(globalPause)) {
+    for (const [key, value] of Object.entries(globalPause)) {
+      const path11 = `globalPause.${key}`;
+      const section = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+      if (key === "auth" && section) {
+        if (section.enabled === true) {
+          const reason = (str(section.source) ?? "auth pause carried over from the legacy home").slice(0, REASON_MAX_LEN);
+          pauseEntries.push({ source: "auth", reason, since: str(section.detectedAt) ?? now });
+          items.push({ kind: "mapped", from: path11, to: "scheduler pause (auth)", value: reason });
+          warnings.push("the legacy home was auth-paused; the new home imports that pause. NO CLI command clears it \u2014 the gateway's OAuth probe (cron/auth-pause.ts, which re-reads the Claude Code credential every minute while paused) clears it on its own once the credential reads healthy. `teamos jobs resume <id>` un-pauses one JOB and does not touch this; the scheduler-level resume route clears only the manual pause, deliberately, so an operator cannot mask an expired credential.");
+        } else {
+          items.push({ kind: "mapped", from: path11, to: "scheduler pause (auth)", value: "not paused", note: "nothing to carry" });
+        }
+      } else if (key === "manual" && section) {
+        if (section.enabled === true) {
+          const reason = (str(section.reason) ?? "manual pause carried over from the legacy home").slice(0, REASON_MAX_LEN);
+          pauseEntries.push({ source: "manual", reason, since: str(section.since) ?? now });
+          items.push({ kind: "mapped", from: path11, to: "scheduler pause (manual)", value: reason });
+        } else {
+          items.push({ kind: "mapped", from: path11, to: "scheduler pause (manual)", value: "not paused", note: "nothing to carry" });
+        }
+      } else if (key === "schedules") {
+        items.push({
+          kind: "dropped",
+          from: path11,
+          value: Array.isArray(value) ? `${value.length} window(s)` : summarize(value),
+          note: "scheduled pause windows are not in the rebuild \u2014 the surviving pause sources are manual and auth"
+        });
+        if (Array.isArray(value) && value.length > 0) {
+          warnings.push(`${value.length} legacy pause window(s) (e.g. quiet hours) are NOT carried over \u2014 jobs will fire during them`);
+        }
+      } else {
+        items.push({ kind: "unrecognized", from: path11, value: describeShape(value), note: "no rule for this key \u2014 review by hand (value withheld)" });
+      }
+    }
+  }
+  for (const [key, value] of Object.entries(legacy)) {
+    if (seen.has(key))
+      continue;
+    const reason = DROPPED_SETTINGS_SECTIONS.get(key);
+    items.push(reason ? { kind: "dropped", from: key, value: summarize(value), note: reason } : { kind: "unrecognized", from: key, value: describeShape(value), note: "no rule for this key \u2014 review by hand (value withheld)" });
+  }
+  return { plan: { settings: next, items, warnings }, pauseEntries };
+}
+function planMigration(inputs) {
+  const existingJobIds = new Set(inputs.target.existingJobIds);
+  const jobs = [];
+  const rejected = [...inputs.unreadable ?? []].sort((a, b) => a.file.localeCompare(b.file));
+  const sorted = [...inputs.jobs].sort((a, b) => a.file.localeCompare(b.file));
+  for (const source of sorted) {
+    const result = planJob(source, inputs.pauseAll, existingJobIds);
+    if ("rejected" in result)
+      rejected.push({ file: source.file, reason: result.rejected });
+    else
+      jobs.push(result.plan);
+  }
+  const { plan: settings, pauseEntries } = planSettings(inputs.settings, inputs.target.settings, inputs.now);
+  return {
+    jobs,
+    settings,
+    pauseEntries,
+    rejected,
+    pauseAll: inputs.pauseAll,
+    now: inputs.now
+  };
+}
+
+// packages/shared/dist/migrate/render.js
+var KIND_LABEL = {
+  mapped: "mapped",
+  defaulted: "default",
+  state: "not imported",
+  dropped: "DROPPED",
+  unrecognized: "UNKNOWN KEY"
+};
+function itemLine(item) {
+  const arrow = item.to ? ` \u2192 ${item.to}` : "";
+  const value = item.value !== void 0 ? ` = ${item.value}` : "";
+  const note = item.note ? `  (${item.note})` : "";
+  return `${KIND_LABEL[item.kind].padEnd(12)} ${item.from}${arrow}${value}${note}`;
+}
+function byKind(items, kinds) {
+  return items.filter((i) => kinds.includes(i.kind));
+}
+function foldedIdentity(job) {
+  const out = [];
+  if (job.job.persona !== void 0)
+    out.push("persona (PLACEHOLDER \u2014 replace it)");
+  if (job.job.spendCapUsd !== void 0)
+    out.push(`spendCapUsd=${job.job.spendCapUsd}`);
+  return out;
+}
+function counts(plan) {
+  const all = [...plan.jobs.flatMap((j) => j.items), ...plan.settings.items];
+  const out = { mapped: 0, defaulted: 0, state: 0, dropped: 0, unrecognized: 0 };
+  for (const item of all)
+    out[item.kind]++;
+  return out;
+}
+function renderPlan(plan, opts) {
+  const lines = [];
+  const n = counts(plan);
+  lines.push("teamos migrate \u2014 DRY RUN (nothing has been written)");
+  lines.push(`  from: ${opts.from}`);
+  lines.push(`  to:   ${opts.to}`);
+  lines.push(`  ${plan.jobs.length} job(s), ${plan.rejected.length} rejected` + (plan.pauseAll ? "  [--pause-all: every job imported disabled]" : ""));
+  lines.push("");
+  for (const job of plan.jobs) {
+    const identity = foldedIdentity(job);
+    lines.push(`\u2500\u2500 job ${job.id}  (${job.sourceFile}, ${job.kind} job)`);
+    lines.push(`   schedule "${job.job.schedule}"${job.job.timezone ? ` in ${job.job.timezone}` : " (host local)"} \u2014 carried verbatim`);
+    lines.push(`   enabled=${job.job.enabled}  timeoutSec=${job.job.timeoutSec}  runtime: ${identity.length > 0 ? identity.join(", ") : "engine defaults"}`);
+    for (const item of job.items)
+      lines.push(`   ${itemLine(item)}`);
+    for (const warning of job.warnings)
+      lines.push(`   ! ${warning}`);
+    lines.push("");
+  }
+  if (plan.rejected.length > 0) {
+    lines.push("\u2500\u2500 rejected (NOT imported)");
+    for (const r of plan.rejected)
+      lines.push(`   ${r.file}: ${r.reason}`);
+    lines.push("");
+  }
+  lines.push("\u2500\u2500 settings");
+  for (const item of plan.settings.items)
+    lines.push(`   ${itemLine(item)}`);
+  for (const warning of plan.settings.warnings)
+    lines.push(`   ! ${warning}`);
+  lines.push("");
+  if (plan.pauseEntries.length > 0) {
+    lines.push("\u2500\u2500 scheduler pause state");
+    for (const e of plan.pauseEntries)
+      lines.push(`   ${e.source}: ${e.reason} (since ${e.since})`);
+    lines.push("");
+  }
+  lines.push(`totals: ${n.mapped} mapped, ${n.defaulted} defaulted, ${n.state} runtime-state skipped, ${n.dropped} dropped, ${n.unrecognized} unrecognized`);
+  lines.push("Run again with --apply to write it.");
+  return lines.join("\n");
+}
+function mdTable(items, columns) {
+  if (items.length === 0)
+    return ["_none_", ""];
+  const rows = [`| ${columns.join(" | ")} |`, "|---|---|---|"];
+  for (const item of items) {
+    const target = item.to ?? "\u2014";
+    const detail = [item.value, item.note].filter(Boolean).join(" \u2014 ");
+    rows.push(`| \`${item.from}\` | ${target === "\u2014" ? "\u2014" : `\`${target}\``} | ${detail.replace(/\|/g, "\\|")} |`);
+  }
+  rows.push("");
+  return rows;
+}
+function renderReport(plan, opts) {
+  const n = counts(plan);
+  const lines = [];
+  lines.push("# teamwork-os migration report");
+  lines.push("");
+  lines.push(`- generated: ${plan.now}`);
+  lines.push(`- source home: \`${opts.from}\``);
+  lines.push(`- target home: \`${opts.to}\``);
+  lines.push(`- flags: ${[plan.pauseAll ? "--pause-all" : "", opts.force ? "--force" : ""].filter(Boolean).join(" ") || "(none)"}`);
+  lines.push(`- totals: ${n.mapped} mapped, ${n.defaulted} defaulted, ${n.state} runtime-state skipped, ${n.dropped} dropped, ${n.unrecognized} unrecognized`);
+  if (opts.applied.noop) {
+    lines.push("- **no changes**: every target file already matched this plan.");
+  }
+  lines.push("");
+  lines.push("## Files");
+  lines.push("");
+  for (const f of opts.applied.files)
+    lines.push(`- \`${f.path}\` \u2014 ${f.outcome}`);
+  lines.push("");
+  lines.push("## Jobs");
+  lines.push("");
+  for (const job of plan.jobs) {
+    lines.push(`### \`${job.id}\` (${job.kind} job)`);
+    lines.push("");
+    lines.push(`Source: \`${job.sourceFile}\`. Schedule \`${job.job.schedule}\`${job.job.timezone ? ` in \`${job.job.timezone}\`` : " (host-local wall clock)"} \u2014 carried across verbatim, validated with the scheduler's own parser.`);
+    lines.push("");
+    const identity = foldedIdentity(job);
+    if (identity.length > 0) {
+      lines.push(`Runtime identity folded onto the job: ${identity.join(", ")}.`);
+      lines.push("");
+    }
+    lines.push("**Mapped**");
+    lines.push("");
+    lines.push(...mdTable(byKind(job.items, ["mapped", "defaulted"]), ["legacy field", "new field", "value / note"]));
+    lines.push("**Dropped / not imported**");
+    lines.push("");
+    lines.push(...mdTable(byKind(job.items, ["dropped", "state", "unrecognized"]), ["legacy field", "new field", "reason"]));
+    if (job.warnings.length > 0) {
+      lines.push("**Check before enabling**");
+      lines.push("");
+      for (const w of job.warnings)
+        lines.push(`- ${w}`);
+      lines.push("");
+    }
+  }
+  if (plan.rejected.length > 0) {
+    lines.push("## Rejected jobs (nothing was written for these)");
+    lines.push("");
+    for (const r of plan.rejected)
+      lines.push(`- \`${r.file}\` \u2014 ${r.reason}`);
+    lines.push("");
+  }
+  lines.push("## Settings");
+  lines.push("");
+  lines.push("**Mapped**");
+  lines.push("");
+  lines.push(...mdTable(byKind(plan.settings.items, ["mapped", "defaulted"]), ["legacy key", "new key", "value / note"]));
+  lines.push("**Dropped**");
+  lines.push("");
+  lines.push(...mdTable(byKind(plan.settings.items, ["dropped", "state", "unrecognized"]), ["legacy key", "new key", "reason"]));
+  if (plan.pauseEntries.length > 0) {
+    lines.push("**Scheduler pause state carried over**");
+    lines.push("");
+    for (const e of plan.pauseEntries)
+      lines.push(`- \`${e.source}\` \u2014 ${e.reason} (since ${e.since})`);
+    lines.push("");
+  }
+  lines.push("## Verification checklist");
+  lines.push("");
+  const checklist = [
+    "`teamos jobs list` shows every job in the table above, with the same enabled state this report records.",
+    "For each job, `teamos jobs show <id>` prints the same `schedule` string as its legacy file \u2014 compare them character by character.",
+    "Next-run times (`teamos jobs show <id>`) land at the wall-clock time the legacy `scheduleHuman` label described.",
+    "Every path in `channels.directory` exists on this host.",
+    "No imported job names a `model`, so every one runs on `engine.defaultModel`. Set `model` on a job that needs a specific one.",
+    "Any job that carried env vars has the right values \u2014 this report never prints them.",
+    'DST: a `0 2 * * *`-shaped job used to be SKIPPED on the spring-forward day and now fires at 03:00 instead; a `*/N` job used to re-fire across the repeated hour on the fall-back day and now fires once. See "Behavior changes to accept before you resume" in docs/cutover.md.'
+  ];
+  if (plan.jobs.some((j) => j.job.persona !== void 0)) {
+    checklist.push("One or more jobs got a PLACEHOLDER `persona` seeded from a legacy `employee` name (named in the job sections above). It is appended to the system prompt on every turn \u2014 replace the text or delete the field.");
+  }
+  if (plan.jobs.some((j) => j.warnings.some((w) => w.includes("legacy engine profile")))) {
+    checklist.push("One or more jobs named a legacy engine profile whose settings this import cannot read. Re-enter what those runs need \u2014 `model`, `persona`, `pluginDirs`, `mcpServers` \u2014 on the job itself.");
+  }
+  if (plan.jobs.some((j) => j.warnings.some((w) => w.includes("skipIfRunning")))) {
+    checklist.push("One or more jobs allowed overlapping runs (`skipIfRunning: false`). The new scheduler never overlaps two runs of one job \u2014 confirm nothing depended on that.");
+  }
+  if (plan.jobs.some((j) => j.warnings.some((w) => w.includes("already exists in the target home")))) {
+    checklist.push("A legacy job id collided with a job already in the target home (named in that job's section above). Confirm it is the same job and not an unrelated one that happens to share the id.");
+  }
+  if (plan.settings.warnings.some((w) => w.includes("pause window"))) {
+    checklist.push("Legacy quiet-hours pause windows are gone: decide whether any job needs `ignorePauses` or a narrower schedule.");
+  }
+  if (plan.pauseAll) {
+    checklist.push("Jobs are imported disabled. Enable them one at a time with `teamos jobs resume <id>` once the parallel run looks right.");
+  }
+  for (const c of checklist)
+    lines.push(`- [ ] ${c}`);
+  lines.push("");
+  lines.push("Run history, `lastRun`, and failure state are deliberately absent: the new home starts fresh.");
+  lines.push("");
+  return lines.join("\n");
+}
+
+// packages/shared/dist/settings-defaults.js
+var DEFAULT_SETTINGS = {
+  server: {
+    bindHost: "127.0.0.1",
+    allowedHosts: []
+  },
+  retention: {
+    days: 14
+  },
+  scheduler: {
+    maxConcurrentJobs: 3
+  },
+  engine: {
+    defaultModel: "",
+    maxRetries: 2,
+    retryBaseDelayMs: 1e3,
+    // 25 min of silence before the no-stdout watchdog kills the spawn.
+    noProgressTimeoutMs: 15e5
+  },
+  channels: {
+    directory: {},
+    mcp: {}
+  },
+  slack: {
+    enabled: true,
+    // Empty = no persona on Slack turns, which is the pre-persona behavior:
+    // the spawn gets no --append-system-prompt at all.
+    persona: "",
+    progress: "minimal",
+    requireMention: true,
+    reactionTriggers: ["robot_face"],
+    ackEmoji: "eyes",
+    doneEmoji: "white_check_mark",
+    errorEmoji: "x",
+    historyLimit: 20,
+    allowUnmappedChannels: false,
+    dmAllowlist: [],
+    // The deny universe for claude.ai account connectors — see
+    // SlackSettings.knownConnectors. Deny mode can only subtract a name it
+    // knows, so an unlisted connector is inherited by every deny-mode
+    // channel. Listing an absent connector is a harmless no-op, so this
+    // default deliberately over-lists.
+    //
+    // claude_ai_Slack is here for a specific reason: it posts to Slack AS THE
+    // OPERATOR. Shipping it in the deny universe makes it denied by default in
+    // every deny-mode channel, so impersonation requires a deliberate grant.
+    knownConnectors: [
+      "claude_ai_Gmail",
+      "claude_ai_Google_Calendar",
+      "claude_ai_Google_Drive",
+      "claude_ai_Krisp",
+      "claude_ai_Notion",
+      "claude_ai_Slack",
+      "claude_ai_Supabase",
+      "claude_ai_Vercel"
+    ]
+  }
+};
+
+// packages/cli/dist/client.js
+import fs from "node:fs";
+
+// packages/cli/dist/paths.js
+import os from "node:os";
+import path from "node:path";
+function teamworkHomeDir(env = process.env) {
+  const raw = env.TEAMWORK_HOME;
+  if (raw && path.isAbsolute(raw))
+    return raw;
+  return path.join(os.homedir(), ".teamwork");
+}
+var envFilePath = (env) => path.join(teamworkHomeDir(env), ".env");
+var logsDir = (env) => path.join(teamworkHomeDir(env), "logs");
+var launchAgentsDir = () => path.join(os.homedir(), "Library", "LaunchAgents");
+
+// packages/cli/dist/client.js
+var SESSION_COOKIE_NAME = "__Host-session";
+function readAuthToken(env = process.env, warn = (m) => console.error(m)) {
+  const fromEnv = env.AUTH_TOKEN?.trim();
+  if (fromEnv)
+    return fromEnv;
+  const file = envFilePath(env);
+  let raw;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+  } catch (err) {
+    const code2 = err.code;
+    if (code2 !== "ENOENT") {
+      warn(`teamos: could not read the teamwork env file (${code2 ?? "unknown"}); continuing unauthenticated`);
+    }
+    return null;
+  }
+  const value = parseEnvFile(raw).find((e) => e.key === "AUTH_TOKEN")?.value.trim();
+  return value && value.length > 0 ? value : null;
+}
+function extractSessionCookie(setCookie) {
+  if (!setCookie)
+    return null;
+  const m = new RegExp(`${SESSION_COOKIE_NAME}=([^;]+)`).exec(setCookie);
+  return m ? m[1] : null;
+}
+var GatewayClient = class {
+  base;
+  timeoutMs;
+  warn;
+  token;
+  cookie = null;
+  constructor(opts) {
+    this.base = `http://${opts.host ?? "127.0.0.1"}:${opts.port}`;
+    this.timeoutMs = opts.timeoutMs ?? 1e4;
+    this.warn = opts.warn ?? ((m) => console.error(m));
+    this.token = opts.authToken;
+  }
+  resolveToken() {
+    if (this.token === void 0)
+      this.token = readAuthToken(process.env, this.warn);
+    return this.token;
+  }
+  /** Exchange AUTH_TOKEN for a session cookie. Returns null on any failure,
+   * having already explained the failure on stderr. */
+  async login(token) {
+    let res;
+    try {
+      res = await fetch(`${this.base}/api/auth/login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token }),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (err) {
+      this.warn(`teamos: login request failed: ${errText(err)}`);
+      return null;
+    }
+    if (res.status === 204)
+      return null;
+    if (!res.ok) {
+      this.warn(res.status === 401 ? "teamos: the gateway rejected AUTH_TOKEN \u2014 the CLI and the gateway disagree on the token" : `teamos: gateway login returned HTTP ${res.status}`);
+      return null;
+    }
+    const cookie = extractSessionCookie(res.headers.get("set-cookie"));
+    if (!cookie) {
+      this.warn("teamos: gateway login succeeded but returned no session cookie");
+      return null;
+    }
+    return cookie;
+  }
+  async send(path11, init, cookie) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...init.headers
+    };
+    if (cookie)
+      headers.Cookie = `${SESSION_COOKIE_NAME}=${cookie}`;
+    try {
+      const res = await fetch(`${this.base}${path11}`, {
+        ...init,
+        headers,
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (err) {
+      return { ok: false, status: 0, data: null, error: errText(err) };
+    }
+  }
+  /**
+   * Make an API request, logging in first when AUTH_TOKEN is configured.
+   *
+   * A 401 on a request that already carried a cookie triggers exactly one
+   * re-login and retry — that covers a gateway restart under a rotated
+   * AUTH_TOKEN mid-process. A second 401 is returned to the caller rather than
+   * retried, so a genuine credential mismatch fails fast instead of looping.
+   */
+  async request(path11, init = {}) {
+    const token = this.resolveToken();
+    if (!token)
+      return this.send(path11, init, null);
+    if (this.cookie === null)
+      this.cookie = await this.login(token);
+    const first = await this.send(path11, init, this.cookie);
+    if (first.status !== 401 || this.cookie === null)
+      return first;
+    this.cookie = await this.login(token);
+    return this.send(path11, init, this.cookie);
+  }
+  get(path11) {
+    return this.request(path11, { method: "GET" });
+  }
+  post(path11, body) {
+    return this.request(path11, {
+      method: "POST",
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+  }
+  put(path11, body) {
+    return this.request(path11, { method: "PUT", body: JSON.stringify(body) });
+  }
+  delete(path11) {
+    return this.request(path11, { method: "DELETE" });
+  }
+};
+function errText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function describeFailure(res, base) {
+  if (res.status === 0) {
+    return `Gateway unreachable at ${base} (${res.error ?? "no response"}). Is it running? Try: teamos status`;
+  }
+  if (res.status === 401) {
+    return "Unauthorized \u2014 the gateway has AUTH_TOKEN set and the CLI could not authenticate.";
+  }
+  const detail = res.data !== null && typeof res.data === "object" && typeof res.data.error === "string" ? res.data.error : null;
+  return detail ? `HTTP ${res.status}: ${detail}` : `HTTP ${res.status}`;
+}
+
+// packages/cli/dist/context.js
+var EXIT_OK = 0;
+var EXIT_FAILURE = 1;
+var EXIT_USAGE = 2;
+var DEFAULT_PORT = 7463;
+function resolvePort(args, env = process.env, warn = (m) => console.error(m)) {
+  const fromFlag = args.flags.port;
+  if (fromFlag !== void 0) {
+    if (typeof fromFlag !== "string" || !isPort(fromFlag)) {
+      return { error: `--port must be a TCP port between 1 and 65535 (got ${JSON.stringify(fromFlag)})` };
+    }
+    return Number(fromFlag);
+  }
+  return configuredPort(env, warn);
+}
+function configuredPort(env = process.env, warn = (m) => console.error(m)) {
+  const fromEnv = env.PORT;
+  if (fromEnv !== void 0 && fromEnv.trim() !== "") {
+    if (isPort(fromEnv))
+      return Number(fromEnv);
+    warn(`teamos: PORT in the environment is not a valid port (${JSON.stringify(fromEnv)}); ignoring it`);
+  }
+  const fromFile = readPortFromEnvFile(env, warn);
+  if (fromFile !== null)
+    return fromFile;
+  return DEFAULT_PORT;
+}
+function isPort(raw) {
+  const trimmed = raw.trim();
+  if (!/^\d+$/.test(trimmed))
+    return false;
+  const n = Number(trimmed);
+  return n >= 1 && n <= 65535;
+}
+function readPortFromEnvFile(env, warn) {
+  let raw;
+  try {
+    raw = fs2.readFileSync(envFilePath(env), "utf8");
+  } catch (err) {
+    const code2 = err.code;
+    if (code2 !== "ENOENT") {
+      warn(`teamos: could not read the teamwork env file for PORT (${code2 ?? "unknown"}); using the default`);
+    }
+    return null;
+  }
+  const value = parseEnvFile(raw).find((e) => e.key === "PORT")?.value;
+  if (value === void 0)
+    return null;
+  if (!isPort(value)) {
+    warn(`teamos: PORT in the teamwork env file is not a valid port (${JSON.stringify(value)}); using the default`);
+    return null;
+  }
+  return Number(value);
+}
+function makeClient(port, err) {
+  return new GatewayClient({ port, warn: err });
+}
+
+// packages/cli/dist/commands/deploy.js
+import { execFile as execFile3 } from "node:child_process";
+import fs6 from "node:fs";
+import path5 from "node:path";
+import { promisify as promisify3 } from "node:util";
+
+// packages/cli/dist/repo.js
+import fs3 from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+var ROOT_PACKAGE_NAME = "teamwork-os";
+function findRoot(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 12; i++) {
+    const manifest = path2.join(dir, "package.json");
+    if (fs3.existsSync(manifest)) {
+      try {
+        const parsed = JSON.parse(fs3.readFileSync(manifest, "utf8"));
+        if (parsed.name === ROOT_PACKAGE_NAME)
+          return dir;
+      } catch {
+      }
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return null;
+}
+var cached = null;
+function repoRoot() {
+  if (cached !== null)
+    return cached;
+  const here = path2.dirname(fileURLToPath(import.meta.url));
+  cached = findRoot(here) ?? path2.resolve(here, "..", "..", "..");
+  return cached;
+}
+
+// packages/cli/dist/commands/lifecycle.js
+import { execFile as execFile2, spawn } from "node:child_process";
+import fs5 from "node:fs";
+import path4 from "node:path";
+import { promisify as promisify2 } from "node:util";
+
+// packages/cli/dist/launchd.js
+import { execFile } from "node:child_process";
+import fs4 from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var GATEWAY_LABEL = "com.teamwork-os.gateway";
+var WATCHDOG_LABEL = "com.teamwork-os.watchdog";
+var KNOWN_GATEWAY_LABELS = Object.freeze([
+  GATEWAY_LABEL,
+  "com.claude-teamwork.gateway",
+  "com.claude-cron.dashboard"
+]);
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function shq(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function gatewayWrapperPath(home) {
+  return path3.join(home, "launch-gateway.sh");
+}
+function watchdogScriptPath(home) {
+  return path3.join(home, "teamos-watchdog.sh");
+}
+function stopSentinelPath(home) {
+  return path3.join(home, "results", "gateway-stopped");
+}
+function renderGatewayWrapper(opts) {
+  const entry = path3.join(opts.repoRoot, "packages", "gateway", "dist", "index.js");
+  return `#!/bin/bash
+# Generated by \`teamos install\`. Edits are overwritten on the next install.
+set -euo pipefail
+
+export HOME=${shq(os2.homedir())}
+export TEAMWORK_HOME=${shq(opts.teamworkHome)}
+export NODE_ENV="\${NODE_ENV:-production}"
+export PORT="\${PORT:-${opts.port}}"
+export PATH="$(dirname ${shq(opts.nodeBin)}):/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"
+
+cd ${shq(opts.repoRoot)}
+
+if [ ! -f ${shq(entry)} ]; then
+  echo "gateway not built: ${entry} is missing. Run: npm run build" >&2
+  exit 78
+fi
+
+exec ${shq(opts.nodeBin)} ${shq(entry)} --static
+`;
+}
+function renderGatewayPlist(opts) {
+  const logs = path3.join(opts.teamworkHome, "logs");
+  return renderPlist({
+    label: GATEWAY_LABEL,
+    programArguments: ["/bin/bash", gatewayWrapperPath(opts.teamworkHome)],
+    environment: {
+      PORT: String(opts.port),
+      TEAMWORK_HOME: opts.teamworkHome,
+      NODE_ENV: "production"
+    },
+    stdoutPath: path3.join(logs, "gateway-launchd.log"),
+    stderrPath: path3.join(logs, "gateway-launchd-error.log"),
+    runAtLoad: true,
+    // KeepAlive only on a *failed* exit: a deliberate `teamos stop` exits 0
+    // and must stay stopped, whereas a crash must come back.
+    keepAliveOnCrashOnly: true,
+    throttleInterval: 5
+  });
+}
+var WATCHDOG_DEFAULT_INTERVAL_SEC = 60;
+var WATCHDOG_DEFAULT_FAILURE_THRESHOLD = 3;
+function renderWatchdogScript(opts) {
+  const stateFile = path3.join(opts.teamworkHome, "results", "watchdog-failures");
+  const label = opts.gatewayLabel ?? GATEWAY_LABEL;
+  const logFile = path3.join(opts.teamworkHome, "logs", "watchdog.log");
+  const sentinel = stopSentinelPath(opts.teamworkHome);
+  return `#!/bin/bash
+# Generated by \`teamos install\`. Edits are overwritten on the next install.
+#
+# Probe the gateway's auth-exempt health endpoint. Kickstart the gateway only
+# after ${opts.failureThreshold} consecutive failures, so a transient stall or an
+# in-progress deploy restart is never mistaken for a dead gateway.
+set -uo pipefail
+
+STATE=${shq(stateFile)}
+LOG=${shq(logFile)}
+STOPPED=${shq(sentinel)}
+URL="http://127.0.0.1:${opts.port}/api/health"
+THRESHOLD=${opts.failureThreshold}
+# Quoted like every other interpolated string here. The label reaches this
+# through \`gatewayLabel\`, which comes from findManagedLabel scanning loaded
+# services \u2014 a name this file does not control, so it is escaped rather than
+# trusted to contain no shell metacharacters.
+LABEL=${shq(label)}
+
+mkdir -p "$(dirname "$STATE")" "$(dirname "$LOG")"
+
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$LOG"; }
+
+# A deliberate \`teamos stop\` leaves this marker. Probing past it would read an
+# intentionally-down gateway as a wedged one and kickstart it back, undoing the
+# stop every ${opts.intervalSec * opts.failureThreshold}s. Clear the failure streak too, so the
+# gateway is judged fresh once \`teamos start\` removes the marker.
+if [ -e "$STOPPED" ]; then
+  echo 0 > "$STATE"
+  exit 0
+fi
+
+if curl --silent --show-error --fail --max-time 10 "$URL" > /dev/null 2>&1; then
+  # Any success clears the streak. Without this a gateway that flaps once an
+  # hour would eventually accumulate its way to a spurious restart.
+  echo 0 > "$STATE"
+  exit 0
+fi
+
+FAILURES=$(cat "$STATE" 2>/dev/null || echo 0)
+case "$FAILURES" in (*[!0-9]*|'') FAILURES=0 ;; esac
+FAILURES=$((FAILURES + 1))
+echo "$FAILURES" > "$STATE"
+log "health probe failed ($FAILURES/$THRESHOLD)"
+
+if [ "$FAILURES" -lt "$THRESHOLD" ]; then
+  exit 0
+fi
+
+# Reset before kickstarting: the next probe should judge the NEW process on
+# its own merits, and a stuck counter would kick every single interval.
+echo 0 > "$STATE"
+UID_NUM=$(id -u)
+log "kickstarting $LABEL after $THRESHOLD consecutive failures"
+${opts.launchctlBin ?? "/bin/launchctl"} kickstart -k "gui/\${UID_NUM}/\${LABEL}" >> "$LOG" 2>&1 || log "kickstart failed"
+`;
+}
+function renderWatchdogPlist(opts) {
+  const logs = path3.join(opts.teamworkHome, "logs");
+  return renderPlist({
+    label: WATCHDOG_LABEL,
+    programArguments: ["/bin/bash", watchdogScriptPath(opts.teamworkHome)],
+    environment: { TEAMWORK_HOME: opts.teamworkHome },
+    stdoutPath: path3.join(logs, "watchdog-launchd.log"),
+    stderrPath: path3.join(logs, "watchdog-launchd-error.log"),
+    runAtLoad: true,
+    // The watchdog is a one-shot probe, not a daemon: it must NOT be kept
+    // alive, or launchd would respawn it in a tight loop the instant it exits.
+    keepAliveOnCrashOnly: false,
+    startInterval: opts.intervalSec
+  });
+}
+function renderPlist(spec) {
+  const args = spec.programArguments.map((a) => `        <string>${xmlEscape(a)}</string>`).join("\n");
+  const env = Object.entries(spec.environment).map(([k, v]) => `        <key>${xmlEscape(k)}</key>
+        <string>${xmlEscape(v)}</string>`).join("\n");
+  const keepAlive = spec.keepAliveOnCrashOnly ? "    <key>KeepAlive</key>\n    <dict>\n        <key>SuccessfulExit</key>\n        <false/>\n    </dict>\n" : "";
+  const throttle = spec.throttleInterval === void 0 ? "" : `    <key>ThrottleInterval</key>
+    <integer>${spec.throttleInterval}</integer>
+`;
+  const startInterval = spec.startInterval === void 0 ? "" : `    <key>StartInterval</key>
+    <integer>${spec.startInterval}</integer>
+`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${xmlEscape(spec.label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${args}
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+${env}
+    </dict>
+${keepAlive}    <key>RunAtLoad</key>
+    <${spec.runAtLoad ? "true" : "false"}/>
+    <key>StandardOutPath</key>
+    <string>${xmlEscape(spec.stdoutPath)}</string>
+    <key>StandardErrorPath</key>
+    <string>${xmlEscape(spec.stderrPath)}</string>
+${throttle}${startInterval}    <key>ProcessType</key>
+    <string>Standard</string>
+</dict>
+</plist>
+`;
+}
+function plistPath(agentsDir, label) {
+  return path3.join(agentsDir, `${label}.plist`);
+}
+function buildKickstartArgs(uid, label) {
+  return ["kickstart", "-k", `gui/${uid}/${label}`];
+}
+function buildKillArgs(uid, label, signal = "SIGTERM") {
+  return ["kill", signal, `gui/${uid}/${label}`];
+}
+function buildBootstrapArgs(uid, plist) {
+  return ["bootstrap", `gui/${uid}`, plist];
+}
+function buildBootoutArgs(uid, label) {
+  return ["bootout", `gui/${uid}/${label}`];
+}
+function currentUid() {
+  return process.getuid?.() ?? null;
+}
+function isDarwin() {
+  return process.platform === "darwin";
+}
+async function findManagedLabel(agentsDir = launchAgentsDir(), warn = (m) => console.error(m)) {
+  if (!isDarwin())
+    return null;
+  for (const label of KNOWN_GATEWAY_LABELS) {
+    if (!fs4.existsSync(plistPath(agentsDir, label)))
+      continue;
+    try {
+      const { stdout } = await execFileAsync("/bin/launchctl", ["list", label]);
+      if (stdout.includes(label))
+        return label;
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        warn("teamos: launchctl not found; cannot detect a launchd-managed gateway");
+        return null;
+      }
+    }
+  }
+  return null;
+}
+async function bootstrap(plist) {
+  const uid = currentUid();
+  if (uid === null)
+    throw new Error("launchctl bootstrap requires a POSIX uid");
+  await execFileAsync("/bin/launchctl", buildBootstrapArgs(uid, plist));
+}
+async function bootout(label) {
+  const uid = currentUid();
+  if (uid === null)
+    throw new Error("launchctl bootout requires a POSIX uid");
+  await execFileAsync("/bin/launchctl", buildBootoutArgs(uid, label));
+}
+
+// packages/cli/dist/commands/lifecycle.js
+var execFileAsync2 = promisify2(execFile2);
+function planLifecycle(facts) {
+  const { intent, managedLabel, listeningPid } = facts;
+  if (intent === "start") {
+    if (listeningPid !== null) {
+      return { kind: "noop", reason: `already running (pid ${listeningPid})` };
+    }
+    return managedLabel ? { kind: "kickstart", label: managedLabel } : { kind: "spawn" };
+  }
+  if (intent === "stop") {
+    if (managedLabel)
+      return { kind: "stop-managed", label: managedLabel };
+    if (listeningPid !== null)
+      return { kind: "signal", pid: listeningPid };
+    return { kind: "noop", reason: "not running" };
+  }
+  if (managedLabel)
+    return { kind: "kickstart", label: managedLabel };
+  return { kind: "spawn" };
+}
+async function findListeningPid(port, warn = (m) => console.error(m)) {
+  try {
+    const { stdout } = await execFileAsync2("lsof", ["-ti", `tcp:${port}`, "-sTCP:LISTEN"]);
+    const first = stdout.trim().split("\n")[0];
+    if (!first)
+      return null;
+    const pid = Number.parseInt(first, 10);
+    return Number.isNaN(pid) ? null : pid;
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      warn(`teamos: lsof not found; cannot detect a listener on :${port}`);
+    }
+    return null;
+  }
+}
+function markStopped(err) {
+  const sentinel = stopSentinelPath(teamworkHomeDir());
+  try {
+    fs5.mkdirSync(path4.dirname(sentinel), { recursive: true });
+    fs5.writeFileSync(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+  } catch (e) {
+    err(`teamos: could not write the stop marker ${sentinel}: ${e.message}`);
+    err("       The watchdog may kickstart the gateway back. Stop it with: teamos uninstall");
+  }
+}
+function clearStopped() {
+  try {
+    fs5.rmSync(stopSentinelPath(teamworkHomeDir()), { force: true });
+  } catch {
+  }
+}
+async function waitForHealthy(ctx, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await ctx.client.get("/api/health");
+    if (res.ok)
+      return true;
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  return false;
+}
+async function waitForExit(pid, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      process.kill(pid, 0);
+    } catch {
+      return true;
+    }
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  return false;
+}
+function gatewayEntry() {
+  return path4.join(repoRoot(), "packages", "gateway", "dist", "index.js");
+}
+async function startCommand(ctx) {
+  return runLifecycle(ctx, "start");
+}
+async function stopCommand(ctx) {
+  return runLifecycle(ctx, "stop");
+}
+async function restartCommand(ctx) {
+  return runLifecycle(ctx, "restart");
+}
+async function runLifecycle(ctx, intent) {
+  const [managedLabel, listeningPid] = await Promise.all([
+    findManagedLabel(void 0, ctx.err),
+    findListeningPid(ctx.port, ctx.err)
+  ]);
+  const action = planLifecycle({ intent, managedLabel, listeningPid });
+  if (intent !== "stop")
+    clearStopped();
+  switch (action.kind) {
+    case "noop":
+      ctx.out(`Gateway: ${action.reason}.`);
+      return EXIT_OK;
+    case "kickstart": {
+      const uid = currentUid();
+      if (uid === null) {
+        ctx.err("teamos: launchctl requires a POSIX uid; cannot manage the service on this platform");
+        return EXIT_FAILURE;
+      }
+      const args = buildKickstartArgs(uid, action.label);
+      ctx.out(`Restarting via launchd: launchctl ${args.join(" ")}`);
+      try {
+        await execFileAsync2("/bin/launchctl", args);
+      } catch (err) {
+        ctx.err(`teamos: launchctl kickstart failed: ${err.message}`);
+        return EXIT_FAILURE;
+      }
+      const healthy = await waitForHealthy(ctx, 3e4);
+      ctx.out(healthy ? "Gateway: running." : "Gateway did not answer within 30s \u2014 check the launchd error log.");
+      return healthy ? EXIT_OK : EXIT_FAILURE;
+    }
+    case "stop-managed": {
+      const uid = currentUid();
+      if (uid === null) {
+        ctx.err("teamos: launchctl requires a POSIX uid; cannot manage the service on this platform");
+        return EXIT_FAILURE;
+      }
+      markStopped(ctx.err);
+      const args = buildKillArgs(uid, action.label);
+      ctx.out(`Stopping via launchd: launchctl ${args.join(" ")}`);
+      try {
+        await execFileAsync2("/bin/launchctl", args);
+      } catch (err) {
+        ctx.err(`teamos: launchctl kill failed: ${err.message}`);
+        clearStopped();
+        return EXIT_FAILURE;
+      }
+      if (listeningPid !== null && !await waitForExit(listeningPid, 1e4)) {
+        ctx.err(`teamos: pid ${listeningPid} did not exit within 10s; the service may still be running.`);
+        return EXIT_FAILURE;
+      }
+      ctx.out("Gateway: stopped. It stays down (the watchdog is paused) until: teamos start");
+      return EXIT_OK;
+    }
+    case "signal": {
+      markStopped(ctx.err);
+      ctx.out(`Stopping gateway (pid ${action.pid})\u2026`);
+      try {
+        process.kill(action.pid, "SIGTERM");
+      } catch (err) {
+        ctx.err(`teamos: could not signal pid ${action.pid}: ${err.message}`);
+        return EXIT_FAILURE;
+      }
+      const exited = await waitForExit(action.pid, 1e4);
+      if (!exited) {
+        ctx.err(`teamos: pid ${action.pid} did not exit within 10s; escalating to SIGKILL`);
+        try {
+          process.kill(action.pid, "SIGKILL");
+        } catch {
+        }
+      }
+      ctx.out("Gateway: stopped.");
+      return EXIT_OK;
+    }
+    case "spawn": {
+      const entry = gatewayEntry();
+      if (!fs5.existsSync(entry)) {
+        ctx.err(`teamos: gateway is not built (${entry} is missing). Run: npm run build`);
+        return EXIT_FAILURE;
+      }
+      if (intent === "restart" && listeningPid !== null) {
+        ctx.out(`Stopping gateway (pid ${listeningPid})\u2026`);
+        try {
+          process.kill(listeningPid, "SIGTERM");
+        } catch {
+        }
+        if (!await waitForExit(listeningPid, 1e4)) {
+          ctx.err(`teamos: pid ${listeningPid} did not exit; refusing to spawn a second gateway on :${ctx.port}`);
+          return EXIT_FAILURE;
+        }
+      }
+      const child = spawn(process.execPath, [entry, "--static"], {
+        cwd: repoRoot(),
+        env: { ...process.env, PORT: String(ctx.port) },
+        detached: true,
+        stdio: "ignore"
+      });
+      child.on("error", (err) => ctx.err(`teamos: gateway spawn failed: ${err.message}`));
+      child.unref();
+      ctx.out("Starting gateway\u2026");
+      const healthy = await waitForHealthy(ctx, 3e4);
+      if (!healthy) {
+        ctx.err("teamos: gateway did not become healthy within 30s.");
+        return EXIT_FAILURE;
+      }
+      ctx.out(`Gateway: running on :${ctx.port}.`);
+      return EXIT_OK;
+    }
+    default: {
+      const unreachable = action;
+      ctx.err(`teamos: unhandled lifecycle action ${JSON.stringify(unreachable)}`);
+      return EXIT_FAILURE;
+    }
+  }
+}
+
+// packages/cli/dist/commands/deploy.js
+var execFileAsync3 = promisify3(execFile3);
+function isFullyCurrent(state) {
+  return state.incomingCount === 0 && state.headCommit !== null && state.runningCommit !== null && state.runningCommit === state.headCommit;
+}
+function describeDeployReason(state) {
+  if (state.incomingCount > 0) {
+    return `${state.incomingCount} incoming commit(s) to deploy.`;
+  }
+  if (state.runningCommit === null) {
+    return "Level with the remote; the running gateway's revision is unknown \u2014 rebuilding and restarting to be sure.";
+  }
+  if (state.headCommit !== null && state.runningCommit !== state.headCommit) {
+    return `Level with the remote, but the gateway is running ${state.runningCommit.slice(0, 7)} and HEAD is ${state.headCommit.slice(0, 7)} \u2014 redeploying the checked-out code.`;
+  }
+  return "Already fully current \u2014 rebuilding and restarting anyway (pass --skip-if-current to skip).";
+}
+function isGitCheckout(root) {
+  return fs6.existsSync(path5.join(root, ".git"));
+}
+function describeNotACheckout(root) {
+  return [
+    `teamos: ${root} is not a git checkout \u2014 deploy fetches, pulls, and rebuilds a cloned working tree.`,
+    "For an npm-installed teamwork-os, update with: npm install -g teamwork-os@latest && teamos restart"
+  ].join("\n");
+}
+async function git(args) {
+  try {
+    const { stdout, stderr } = await execFileAsync3("git", args, { cwd: repoRoot() });
+    return { ok: true, stdout, stderr };
+  } catch (err) {
+    const e = err;
+    return { ok: false, stdout: e.stdout ?? "", stderr: e.stderr ?? e.message ?? "git failed" };
+  }
+}
+async function run(cmd, args, ctx) {
+  try {
+    const { stdout, stderr } = await execFileAsync3(cmd, args, { cwd: repoRoot(), maxBuffer: 32 * 1024 * 1024 });
+    if (stdout.trim())
+      ctx.out(stdout.trimEnd());
+    if (stderr.trim())
+      ctx.err(stderr.trimEnd());
+    return true;
+  } catch (err) {
+    const e = err;
+    if (e.stdout?.trim())
+      ctx.out(e.stdout.trimEnd());
+    ctx.err(e.stderr?.trim() || e.message || `${cmd} failed`);
+    return false;
+  }
+}
+async function deployCommand(ctx) {
+  const branch = stringFlag(ctx.args, "branch") ?? "main";
+  const dryRun = boolFlag(ctx.args, "dry-run");
+  const skipIfCurrent = boolFlag(ctx.args, "skip-if-current");
+  const root = repoRoot();
+  if (!isGitCheckout(root)) {
+    ctx.err(describeNotACheckout(root));
+    return EXIT_FAILURE;
+  }
+  const dirty = await git(["status", "--porcelain"]);
+  if (dirty.ok && dirty.stdout.trim().length > 0) {
+    ctx.err("teamos: the working tree has uncommitted changes \u2014 refusing to deploy.");
+    ctx.err(dirty.stdout.trimEnd());
+    return EXIT_FAILURE;
+  }
+  const fetched = await git(["fetch", "origin", branch]);
+  if (!fetched.ok) {
+    ctx.err(`teamos: git fetch origin ${branch} failed \u2014 cannot determine deploy state.`);
+    ctx.err(fetched.stderr.trimEnd());
+    return EXIT_FAILURE;
+  }
+  const log = await git(["log", `HEAD..origin/${branch}`, "--oneline"]);
+  const incoming = log.ok ? log.stdout.trim().split("\n").filter((l) => l.length > 0) : [];
+  const headRes = await git(["rev-parse", "HEAD"]);
+  const headCommit = headRes.ok && /^[0-9a-f]{40}$/.test(headRes.stdout.trim()) ? headRes.stdout.trim() : null;
+  const health = await ctx.client.get("/api/health");
+  const rawCommit = health.ok ? health.data?.commit : null;
+  const runningCommit = typeof rawCommit === "string" && /^[0-9a-f]{40}$/.test(rawCommit) ? rawCommit : null;
+  const state = { incomingCount: incoming.length, runningCommit, headCommit };
+  if (skipIfCurrent && isFullyCurrent(state)) {
+    ctx.out(`Already up to date and the gateway is on the checked-out commit (${headCommit.slice(0, 7)}) \u2014 nothing to deploy.`);
+    return EXIT_OK;
+  }
+  ctx.out(describeDeployReason(state));
+  for (const line of incoming)
+    ctx.out(`  ${line}`);
+  if (dryRun) {
+    ctx.out("\n--dry-run: stopping before pull, build, and restart.");
+    return EXIT_OK;
+  }
+  if (incoming.length > 0) {
+    ctx.out("\n\u2500\u2500 git pull --ff-only \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    if (!await run("git", ["pull", "--ff-only", "origin", branch], ctx)) {
+      ctx.err("teamos: fast-forward pull failed \u2014 the deploy host has diverged from the remote. Aborting.");
+      return EXIT_FAILURE;
+    }
+  }
+  ctx.out("\n\u2500\u2500 npm install \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (!await run("npm", ["install", "--no-audit", "--no-fund"], ctx)) {
+    ctx.err("teamos: dependency install failed \u2014 aborting before the build.");
+    return EXIT_FAILURE;
+  }
+  ctx.out("\n\u2500\u2500 npm run build \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (!await run("npm", ["run", "build"], ctx)) {
+    ctx.err("teamos: build failed \u2014 the running gateway was left untouched.");
+    return EXIT_FAILURE;
+  }
+  ctx.out("\n\u2500\u2500 restart \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const code2 = await restartCommand(ctx);
+  if (code2 !== EXIT_OK)
+    return code2;
+  ctx.out("\nDeploy complete.");
+  return EXIT_OK;
+}
+
+// packages/cli/dist/commands/env.js
+import fs7 from "node:fs";
+import path6 from "node:path";
+
+// packages/cli/dist/format.js
+function cell(value) {
+  if (value === null || value === void 0)
+    return "\u2014";
+  if (typeof value === "boolean")
+    return value ? "yes" : "no";
+  return String(value);
+}
+function table(headers, rows) {
+  const body = rows.map((r) => r.map(cell));
+  const widths = headers.map((h, i) => Math.max(h.length, ...body.map((r) => (r[i] ?? "").length), 0));
+  const line = (cells) => cells.map((c, i) => i === cells.length - 1 ? c : c.padEnd(widths[i])).join("  ").trimEnd();
+  return [line(headers), line(widths.map((w) => "\u2500".repeat(w))), ...body.map(line)].join("\n");
+}
+function keyValues(pairs) {
+  const width = Math.max(...pairs.map(([k]) => k.length), 0);
+  return pairs.map(([k, v]) => `${`${k}:`.padEnd(width + 1)} ${cell(v)}`).join("\n");
+}
+function truncate(value, max) {
+  if (max <= 1 || value.length <= max)
+    return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+function relativeTime(iso, now = Date.now()) {
+  if (!iso)
+    return "\u2014";
+  const t = Date.parse(iso);
+  if (Number.isNaN(t))
+    return "\u2014";
+  const deltaSec = Math.round((now - t) / 1e3);
+  const future = deltaSec < 0;
+  const abs = Math.abs(deltaSec);
+  const unit = abs < 60 ? `${abs}s` : abs < 3600 ? `${Math.floor(abs / 60)}m` : abs < 86400 ? `${Math.floor(abs / 3600)}h` : `${Math.floor(abs / 86400)}d`;
+  return future ? `in ${unit}` : `${unit} ago`;
+}
+
+// packages/cli/dist/commands/env.js
+var KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function maskValue(value) {
+  if (value.length === 0)
+    return "(empty)";
+  if (value.length <= 8)
+    return `${"*".repeat(value.length)} (len=${value.length})`;
+  return `${value.slice(0, 2)}${"*".repeat(6)}${value.slice(-2)} (len=${value.length})`;
+}
+function readEntries(file) {
+  try {
+    return parseEnvFile(fs7.readFileSync(file, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return [];
+    throw err;
+  }
+}
+function writeEntries(file, entries) {
+  fs7.mkdirSync(path6.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs7.writeFileSync(tmp, formatEnvFile(entries), { mode: 384 });
+  fs7.renameSync(tmp, file);
+  fs7.chmodSync(file, 384);
+}
+function splitAssignment(raw) {
+  const eq = raw.indexOf("=");
+  if (eq <= 0)
+    return null;
+  return { key: raw.slice(0, eq), value: raw.slice(eq + 1) };
+}
+function applyEntryChange(entries, key, value) {
+  const next = entries.filter((e) => e.key !== key);
+  const existed = next.length !== entries.length;
+  if (value === null)
+    return { entries: next, changed: existed };
+  const previous = entries.find((e) => e.key === key);
+  if (previous && previous.value === value)
+    return { entries: [...entries], changed: false };
+  if (existed) {
+    const at = entries.findIndex((e) => e.key === key);
+    next.splice(at, 0, { key, value });
+  } else {
+    next.push({ key, value });
+  }
+  return { entries: next, changed: true };
+}
+async function envCommand(ctx) {
+  const [sub, ...rest] = ctx.rest;
+  const file = envFilePath();
+  switch (sub) {
+    case void 0:
+    case "list": {
+      const entries = readEntries(file);
+      if (entries.length === 0) {
+        ctx.out("No environment variables set.");
+        return EXIT_OK;
+      }
+      const reveal = boolFlag(ctx.args, "values");
+      if (reveal) {
+        ctx.err("teamos: printing raw values \u2014 avoid this in a shared terminal or a recorded session.");
+      }
+      ctx.out(table(["KEY", "VALUE"], entries.map((e) => [e.key, reveal ? e.value : maskValue(e.value)])));
+      return EXIT_OK;
+    }
+    case "get": {
+      const key = rest[0];
+      if (!key) {
+        ctx.err("Usage: teamos env get <KEY>");
+        return EXIT_USAGE;
+      }
+      const entry = readEntries(file).find((e) => e.key === key);
+      if (!entry) {
+        ctx.err(`teamos: ${key} is not set`);
+        return EXIT_FAILURE;
+      }
+      ctx.out(entry.value);
+      return EXIT_OK;
+    }
+    case "set": {
+      const assignment = rest[0];
+      if (!assignment) {
+        ctx.err("Usage: teamos env set KEY=VALUE");
+        return EXIT_USAGE;
+      }
+      const parsed = splitAssignment(assignment);
+      if (!parsed) {
+        ctx.err(`Usage: teamos env set KEY=VALUE (got ${JSON.stringify(assignment)})`);
+        return EXIT_USAGE;
+      }
+      if (!KEY_RE2.test(parsed.key)) {
+        ctx.err(`teamos: ${JSON.stringify(parsed.key)} is not a valid environment variable name`);
+        return EXIT_USAGE;
+      }
+      const { entries, changed } = applyEntryChange(readEntries(file), parsed.key, parsed.value);
+      writeEntries(file, entries);
+      ctx.out(changed ? `Set ${parsed.key}.` : `${parsed.key} already had that value.`);
+      return EXIT_OK;
+    }
+    case "unset": {
+      const key = rest[0];
+      if (!key) {
+        ctx.err("Usage: teamos env unset <KEY>");
+        return EXIT_USAGE;
+      }
+      const { entries, changed } = applyEntryChange(readEntries(file), key, null);
+      if (!changed) {
+        ctx.err(`teamos: ${key} is not set`);
+        return EXIT_FAILURE;
+      }
+      writeEntries(file, entries);
+      ctx.out(`Unset ${key}.`);
+      return EXIT_OK;
+    }
+    case "audit": {
+      let raw;
+      try {
+        raw = fs7.readFileSync(file, "utf8");
+      } catch (err) {
+        if (err.code === "ENOENT") {
+          ctx.out("No env file \u2014 nothing to audit.");
+          return EXIT_OK;
+        }
+        throw err;
+      }
+      const unsafe = auditEnvFile(raw);
+      if (unsafe.length === 0) {
+        ctx.out("Every line would survive a POSIX `source`.");
+        return EXIT_OK;
+      }
+      ctx.out(`${unsafe.length} line(s) would break \`source\`:`);
+      for (const line of unsafe) {
+        ctx.out(`  line ${line.lineNumber}: ${line.reason}`);
+      }
+      ctx.out("Fix with: teamos env normalize");
+      return EXIT_FAILURE;
+    }
+    case "normalize": {
+      const entries = readEntries(file);
+      if (entries.length === 0) {
+        ctx.out("No env file \u2014 nothing to normalize.");
+        return EXIT_OK;
+      }
+      const before = fs7.readFileSync(file, "utf8");
+      const after = formatEnvFile(entries);
+      if (before === after) {
+        ctx.out("Already in canonical form.");
+        return EXIT_OK;
+      }
+      writeEntries(file, entries);
+      ctx.out(`Rewrote ${entries.length} entries in canonical form.`);
+      return EXIT_OK;
+    }
+    default:
+      ctx.err(`Unknown env subcommand: ${sub}
+Usage: teamos env <list|get|set|unset|audit|normalize>`);
+      return EXIT_USAGE;
+  }
+}
+
+// packages/cli/dist/commands/install.js
+import fs8 from "node:fs";
+import path7 from "node:path";
+function renderInstallArtifacts(opts) {
+  const gatewayOpts = {
+    agentsDir: opts.agentsDir,
+    teamworkHome: opts.teamworkHome,
+    repoRoot: opts.repoRoot,
+    port: opts.port,
+    nodeBin: opts.nodeBin
+  };
+  const watchdogOpts = {
+    ...gatewayOpts,
+    intervalSec: opts.intervalSec,
+    failureThreshold: opts.failureThreshold
+  };
+  return [
+    {
+      path: gatewayWrapperPath(opts.teamworkHome),
+      contents: renderGatewayWrapper(gatewayOpts),
+      mode: 493
+    },
+    {
+      path: watchdogScriptPath(opts.teamworkHome),
+      contents: renderWatchdogScript(watchdogOpts),
+      mode: 493
+    },
+    {
+      path: plistPath(opts.agentsDir, GATEWAY_LABEL),
+      contents: renderGatewayPlist(gatewayOpts),
+      mode: 420
+    },
+    {
+      path: plistPath(opts.agentsDir, WATCHDOG_LABEL),
+      contents: renderWatchdogPlist(watchdogOpts),
+      mode: 420
+    }
+  ];
+}
+async function installCommand(ctx) {
+  const agentsDir = stringFlag(ctx.args, "agents-dir") ?? launchAgentsDir();
+  const dryRun = boolFlag(ctx.args, "dry-run");
+  if (!isDarwin() && !dryRun) {
+    ctx.err("teamos: launchd services are macOS-only. On Linux, run the gateway under systemd.");
+    return EXIT_FAILURE;
+  }
+  const interval = intFlag(ctx.args, "watchdog-interval", { min: 10, max: 3600 });
+  if (interval !== void 0 && typeof interval === "object") {
+    ctx.err(`teamos: ${interval.error}`);
+    return EXIT_USAGE;
+  }
+  const threshold = intFlag(ctx.args, "watchdog-failures", { min: 1, max: 20 });
+  if (threshold !== void 0 && typeof threshold === "object") {
+    ctx.err(`teamos: ${threshold.error}`);
+    return EXIT_USAGE;
+  }
+  const intervalSec = interval ?? WATCHDOG_DEFAULT_INTERVAL_SEC;
+  const failureThreshold = threshold ?? WATCHDOG_DEFAULT_FAILURE_THRESHOLD;
+  const artifacts = renderInstallArtifacts({
+    agentsDir,
+    teamworkHome: teamworkHomeDir(),
+    repoRoot: repoRoot(),
+    port: ctx.port,
+    // process.execPath, not `node` on PATH: launchd's PATH is not the
+    // operator's, and an nvm-managed node is invisible to it.
+    nodeBin: process.execPath,
+    intervalSec,
+    failureThreshold
+  });
+  if (dryRun) {
+    for (const a of artifacts) {
+      ctx.out(`\u2500\u2500 ${a.path} (mode ${a.mode.toString(8)}) \u2500\u2500`);
+      ctx.out(a.contents);
+    }
+    return EXIT_OK;
+  }
+  for (const a of artifacts) {
+    fs8.mkdirSync(path7.dirname(a.path), { recursive: true });
+    fs8.writeFileSync(a.path, a.contents, { mode: a.mode });
+    fs8.chmodSync(a.path, a.mode);
+    ctx.out(`Wrote ${a.path}`);
+  }
+  fs8.mkdirSync(path7.join(teamworkHomeDir(), "logs"), { recursive: true });
+  fs8.mkdirSync(path7.join(teamworkHomeDir(), "results"), { recursive: true });
+  for (const label of [GATEWAY_LABEL, WATCHDOG_LABEL]) {
+    const plist = plistPath(agentsDir, label);
+    try {
+      await bootout(label);
+    } catch {
+    }
+    try {
+      await bootstrap(plist);
+      ctx.out(`Loaded ${label}`);
+    } catch (err) {
+      ctx.err(`teamos: could not load ${label}: ${err.message}`);
+      return EXIT_FAILURE;
+    }
+  }
+  ctx.out("");
+  ctx.out(`Gateway will start at login and restart on crash (port ${ctx.port}).`);
+  ctx.out(`Watchdog probes /api/health every ${intervalSec}s and kickstarts the gateway after ${failureThreshold} consecutive failures (~${intervalSec * failureThreshold}s of downtime).`);
+  return EXIT_OK;
+}
+async function uninstallCommand(ctx) {
+  const agentsDir = stringFlag(ctx.args, "agents-dir") ?? launchAgentsDir();
+  if (!isDarwin()) {
+    ctx.err("teamos: launchd services are macOS-only; nothing to uninstall.");
+    return EXIT_FAILURE;
+  }
+  let removed = 0;
+  for (const label of [WATCHDOG_LABEL, GATEWAY_LABEL]) {
+    try {
+      await bootout(label);
+      ctx.out(`Unloaded ${label}`);
+    } catch {
+    }
+    const plist = plistPath(agentsDir, label);
+    if (fs8.existsSync(plist)) {
+      fs8.rmSync(plist);
+      ctx.out(`Removed ${plist}`);
+      removed++;
+    }
+  }
+  for (const script of [gatewayWrapperPath(teamworkHomeDir()), watchdogScriptPath(teamworkHomeDir())]) {
+    if (fs8.existsSync(script)) {
+      fs8.rmSync(script);
+      ctx.out(`Removed ${script}`);
+    }
+  }
+  ctx.out(removed === 0 ? "Nothing was installed." : "Uninstalled. Logs under ~/.teamwork/logs were left in place.");
+  return EXIT_OK;
+}
+
+// packages/cli/dist/commands/jobs.js
+import fs9 from "node:fs";
+var RUNS_LIMIT = { min: 1, max: 200 };
+function fail(ctx, res) {
+  ctx.err(describeFailure(res, ctx.client.base));
+  return EXIT_FAILURE;
+}
+function readJsonInput(source) {
+  let raw;
+  if (source === "-") {
+    try {
+      raw = fs9.readFileSync(0, "utf8");
+    } catch (err) {
+      return { ok: false, error: `could not read stdin: ${err.message}` };
+    }
+  } else if (source.trimStart().startsWith("{")) {
+    raw = source;
+  } else {
+    try {
+      raw = fs9.readFileSync(source, "utf8");
+    } catch (err) {
+      return { ok: false, error: `could not read ${source}: ${err.message}` };
+    }
+  }
+  try {
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      return { ok: false, error: "job definition must be a JSON object" };
+    }
+    return { ok: true, value };
+  } catch (err) {
+    return { ok: false, error: `job definition is not valid JSON: ${err.message}` };
+  }
+}
+async function jobsCommand(ctx) {
+  const [sub, ...rest] = ctx.rest;
+  switch (sub) {
+    case void 0:
+    case "list": {
+      const res = await ctx.client.get("/api/jobs");
+      if (!res.ok)
+        return fail(ctx, res);
+      const jobs = Array.isArray(res.data) ? res.data : [];
+      if (jobs.length === 0) {
+        ctx.out("No jobs configured.");
+        return EXIT_OK;
+      }
+      ctx.out(table(["ID", "ENABLED", "SCHEDULE", "LAST", "LAST RUN", "NEXT RUN"], jobs.map((j) => [
+        j.id,
+        j.enabled,
+        // No schedule is a real, supported state (a manual job), not
+        // missing data — `—` would read as "the gateway didn't say".
+        j.schedule ? truncate(j.schedule, 20) : "manual",
+        j.lastStatus,
+        relativeTime(j.lastRun),
+        relativeTime(j.nextRun)
+      ])));
+      return EXIT_OK;
+    }
+    case "show": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, "teamos jobs show <id>");
+      const res = await ctx.client.get(`/api/jobs/${encodeURIComponent(id)}`);
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(JSON.stringify(res.data, null, 2));
+      return EXIT_OK;
+    }
+    case "create": {
+      const source = rest[0] ?? stringFlag(ctx.args, "file");
+      if (!source)
+        return usage(ctx, `teamos jobs create <file.json|-|'{"id":\u2026}'>`);
+      const input = readJsonInput(source);
+      if (!input.ok) {
+        ctx.err(`teamos: ${input.error}`);
+        return EXIT_USAGE;
+      }
+      const res = await ctx.client.post("/api/jobs", input.value);
+      if (!res.ok)
+        return fail(ctx, res);
+      const id = res.data?.id;
+      ctx.out(`Created job ${id ?? "(unnamed)"}.`);
+      return EXIT_OK;
+    }
+    case "update": {
+      const id = rest[0];
+      const source = rest[1] ?? stringFlag(ctx.args, "file");
+      if (!id || !source)
+        return usage(ctx, "teamos jobs update <id> <file.json|-|'{\u2026}'>");
+      const input = readJsonInput(source);
+      if (!input.ok) {
+        ctx.err(`teamos: ${input.error}`);
+        return EXIT_USAGE;
+      }
+      const res = await ctx.client.put(`/api/jobs/${encodeURIComponent(id)}`, input.value);
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(`Updated job ${id}.`);
+      return EXIT_OK;
+    }
+    case "delete": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, "teamos jobs delete <id>");
+      const res = await ctx.client.delete(`/api/jobs/${encodeURIComponent(id)}`);
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(`Deleted job ${id}.`);
+      return EXIT_OK;
+    }
+    case "run": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, "teamos jobs run <id>");
+      const res = await ctx.client.post(`/api/jobs/${encodeURIComponent(id)}/run`);
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(`Dispatched job ${id}. Follow it with: teamos jobs show ${id}`);
+      return EXIT_OK;
+    }
+    case "pause": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, 'teamos jobs pause <id> [--reason "..."]');
+      const reason = stringFlag(ctx.args, "reason");
+      const res = await ctx.client.post(`/api/jobs/${encodeURIComponent(id)}/pause`, reason === void 0 ? {} : { reason });
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(`Paused job ${id}.`);
+      return EXIT_OK;
+    }
+    case "resume": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, "teamos jobs resume <id>");
+      const res = await ctx.client.post(`/api/jobs/${encodeURIComponent(id)}/resume`);
+      if (!res.ok)
+        return fail(ctx, res);
+      ctx.out(`Resumed job ${id}.`);
+      return EXIT_OK;
+    }
+    case "runs": {
+      const id = rest[0];
+      if (!id)
+        return usage(ctx, "teamos jobs runs <id> [--limit N]");
+      const limit = intFlag(ctx.args, "limit", RUNS_LIMIT);
+      if (limit !== void 0 && typeof limit === "object") {
+        ctx.err(`teamos: ${limit.error}`);
+        return EXIT_USAGE;
+      }
+      const qs = limit === void 0 ? "" : `?limit=${limit}`;
+      const res = await ctx.client.get(`/api/jobs/${encodeURIComponent(id)}/runs${qs}`);
+      if (!res.ok)
+        return fail(ctx, res);
+      const runs = res.data?.runs ?? [];
+      if (runs.length === 0) {
+        ctx.out(`No recorded runs for ${id}.`);
+        return EXIT_OK;
+      }
+      ctx.out(table(["WHEN", "STATUS", "DURATION", "RUN ID"], runs.map((r) => [
+        relativeTime(r.timestamp),
+        r.status,
+        r.durationSeconds === void 0 ? "\u2014" : `${Math.round(r.durationSeconds)}s`,
+        r.resultFile ? r.resultFile.replace(/\.result$/, "") : "\u2014"
+      ])));
+      return EXIT_OK;
+    }
+    case "trace": {
+      const id = rest[0];
+      const runId = rest[1];
+      if (!id || !runId)
+        return usage(ctx, "teamos jobs trace <id> <run-id>");
+      const res = await ctx.client.get(`/api/jobs/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/trace`);
+      if (!res.ok) {
+        if (res.status === 404) {
+          ctx.err(`teamos: no engine trace for run ${runId}. Shell jobs produce no trace; list runs with: teamos jobs runs ${id}`);
+          return EXIT_FAILURE;
+        }
+        return fail(ctx, res);
+      }
+      ctx.out(JSON.stringify(res.data, null, 2));
+      return EXIT_OK;
+    }
+    default:
+      return usage(ctx, "teamos jobs <list|show|create|update|delete|run|pause|resume|runs|trace>", `Unknown jobs subcommand: ${sub}`);
+  }
+}
+function usage(ctx, line, prefix) {
+  if (prefix)
+    ctx.err(prefix);
+  ctx.err(`Usage: ${line}`);
+  return EXIT_USAGE;
+}
+
+// packages/cli/dist/commands/logs.js
+import fs10 from "node:fs";
+import path8 from "node:path";
+var DEFAULT_LINES = 50;
+function resolveLogPath(dir, name) {
+  if (name.includes("/") || name.includes("\\") || name === "." || name === "..") {
+    return { error: `log name must not contain a path (got ${JSON.stringify(name)})` };
+  }
+  const withExt = name.endsWith(".log") ? name : `${name}.log`;
+  const resolved = path8.resolve(dir, withExt);
+  if (!resolved.startsWith(path8.resolve(dir) + path8.sep)) {
+    return { error: `log name resolves outside the logs directory (got ${JSON.stringify(name)})` };
+  }
+  return resolved;
+}
+function lastLines(content, count) {
+  const lines = content.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "")
+    lines.pop();
+  return count >= lines.length ? lines : lines.slice(lines.length - count);
+}
+async function logsCommand(ctx) {
+  const dir = logsDir();
+  const name = ctx.rest[0];
+  if (!name) {
+    let entries;
+    try {
+      entries = fs10.readdirSync(dir).filter((f) => f.endsWith(".log")).sort();
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        ctx.out(`No logs directory yet at ${dir}.`);
+        return EXIT_OK;
+      }
+      throw err;
+    }
+    if (entries.length === 0) {
+      ctx.out(`No logs in ${dir}.`);
+      return EXIT_OK;
+    }
+    ctx.out(table(["LOG", "SIZE"], entries.map((f) => {
+      const size = fs10.statSync(path8.join(dir, f)).size;
+      return [f.replace(/\.log$/, ""), formatBytes(size)];
+    })));
+    ctx.out("\nTail one with: teamos logs <name> [--lines N] [--follow]");
+    return EXIT_OK;
+  }
+  const resolved = resolveLogPath(dir, name);
+  if (typeof resolved !== "string") {
+    ctx.err(`teamos: ${resolved.error}`);
+    return EXIT_USAGE;
+  }
+  const linesFlag = intFlag(ctx.args, "lines", { min: 1, max: 1e5 });
+  if (linesFlag !== void 0 && typeof linesFlag === "object") {
+    ctx.err(`teamos: ${linesFlag.error}`);
+    return EXIT_USAGE;
+  }
+  const count = linesFlag ?? DEFAULT_LINES;
+  let content;
+  try {
+    content = fs10.readFileSync(resolved, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      ctx.err(`teamos: no log named ${name} in ${dir}. List them with: teamos logs`);
+      return EXIT_FAILURE;
+    }
+    throw err;
+  }
+  for (const line of lastLines(content, count))
+    ctx.out(line);
+  if (!boolFlag(ctx.args, "follow"))
+    return EXIT_OK;
+  let offset = Buffer.byteLength(content, "utf8");
+  ctx.out(`
+\u2014 following ${path8.basename(resolved)} (Ctrl-C to stop) \u2014`);
+  for (; ; ) {
+    await new Promise((r) => setTimeout(r, 500));
+    let size;
+    try {
+      size = fs10.statSync(resolved).size;
+    } catch {
+      continue;
+    }
+    if (size < offset) {
+      ctx.out("\u2014 log truncated, following the new file \u2014");
+      offset = 0;
+    }
+    if (size === offset)
+      continue;
+    const fd = fs10.openSync(resolved, "r");
+    try {
+      const buf = Buffer.alloc(size - offset);
+      fs10.readSync(fd, buf, 0, buf.length, offset);
+      offset = size;
+      const text = buf.toString("utf8");
+      for (const line of text.split("\n")) {
+        if (line.length > 0)
+          ctx.out(line);
+      }
+    } finally {
+      fs10.closeSync(fd);
+    }
+  }
+}
+function formatBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+// packages/cli/dist/commands/migrate.js
+import fs11 from "node:fs";
+import path9 from "node:path";
+var USAGE = `teamos migrate --from <legacy-home> [--to <new-home>] [flags]
+
+Import a legacy teamwork-os home (jobs + settings) into the rebuilt stack.
+Prints the full plan and writes nothing unless --apply is given.
+
+  --from <dir>    Legacy $TEAMWORK_HOME to read (required)
+  --to <dir>      Target home to write (default: $TEAMWORK_HOME, then ~/.teamwork)
+  --apply         Write the plan. Without it this is a dry run.
+  --force         Apply even though the target already holds job files.
+  --pause-all     Import every job disabled \u2014 the parallel-run posture.
+`;
+function serialize(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function serializeBare(value) {
+  return JSON.stringify(value, null, 2);
+}
+function readJsonFile(file) {
+  try {
+    return { ok: true, value: JSON.parse(fs11.readFileSync(file, "utf8")) };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+function readLegacyJobs(legacyHome) {
+  const dir = path9.join(legacyHome, "jobs");
+  let names;
+  try {
+    names = fs11.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+  } catch (e) {
+    return { ok: false, error: `cannot read ${dir}: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  const jobs = [];
+  const unreadable = [];
+  for (const name of names) {
+    const full = path9.join(dir, name);
+    let entry;
+    try {
+      entry = fs11.lstatSync(full);
+    } catch (e) {
+      unreadable.push({ file: `jobs/${name}`, reason: `cannot stat \u2014 ${e instanceof Error ? e.message : String(e)}` });
+      continue;
+    }
+    if (!entry.isFile()) {
+      unreadable.push({
+        file: `jobs/${name}`,
+        reason: entry.isSymbolicLink() ? "a symlink, not a regular file \u2014 it would import content from outside --from" : "not a regular file"
+      });
+      continue;
+    }
+    const read = readJsonFile(full);
+    if (!read.ok || !read.value || typeof read.value !== "object" || Array.isArray(read.value)) {
+      unreadable.push({ file: `jobs/${name}`, reason: read.ok ? "not a JSON object" : `unreadable \u2014 ${read.error}` });
+      continue;
+    }
+    jobs.push({ file: `jobs/${name}`, raw: read.value });
+  }
+  return { ok: true, jobs, unreadable };
+}
+function mergeTargetSettings(parsed) {
+  const base = structuredClone(DEFAULT_SETTINGS);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return base;
+  for (const [section, value] of Object.entries(parsed)) {
+    if (!(section in base))
+      continue;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      continue;
+    base[section] = { ...base[section], ...value };
+  }
+  return base;
+}
+function listExisting(dir, suffix = ".json") {
+  try {
+    return fs11.readdirSync(dir).filter((n) => n.endsWith(suffix)).map((n) => n.slice(0, -suffix.length)).sort();
+  } catch {
+    return [];
+  }
+}
+function buildWrites(plan, targetHome) {
+  const writes = [];
+  for (const job of plan.jobs) {
+    writes.push({
+      path: path9.join(targetHome, "jobs", `${job.id}.json`),
+      contents: serialize(job.job),
+      mode: PROMPT_BEARING_MODE
+    });
+  }
+  writes.push({ path: path9.join(targetHome, "results", "settings.json"), contents: serializeBare(plan.settings.settings) });
+  if (plan.pauseEntries.length > 0) {
+    writes.push({
+      path: path9.join(targetHome, "results", "scheduler-state.json"),
+      contents: serializeBare({ entries: plan.pauseEntries })
+    });
+  }
+  return writes;
+}
+function outcomeFor(write) {
+  try {
+    return fs11.readFileSync(write.path, "utf8") === write.contents ? "unchanged" : "updated";
+  } catch {
+    return "created";
+  }
+}
+function writeAtomic(file, contents, mode) {
+  fs11.mkdirSync(path9.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
+  fs11.writeFileSync(tmp, contents, mode !== void 0 ? { mode } : void 0);
+  fs11.renameSync(tmp, file);
+}
+var PROMPT_BEARING_MODE = 384;
+async function migrateCommand(ctx) {
+  const { args, out, err } = ctx;
+  if (ctx.rest[0] === "help" || boolFlag(args, "help")) {
+    out(USAGE);
+    return EXIT_OK;
+  }
+  const from = stringFlag(args, "from");
+  if (!from) {
+    err("teamos migrate: --from <legacy-home> is required\n");
+    err(USAGE);
+    return EXIT_USAGE;
+  }
+  const legacyHome = path9.resolve(from);
+  const targetHome = path9.resolve(stringFlag(args, "to") ?? teamworkHomeDir());
+  if (legacyHome === targetHome) {
+    err("teamos migrate: --from and --to are the same directory; an import must have two homes");
+    return EXIT_USAGE;
+  }
+  const apply = boolFlag(args, "apply");
+  const force = boolFlag(args, "force");
+  const pauseAll = boolFlag(args, "pause-all");
+  const legacyJobs = readLegacyJobs(legacyHome);
+  if (!legacyJobs.ok) {
+    err(`teamos migrate: ${legacyJobs.error}`);
+    return EXIT_FAILURE;
+  }
+  for (const problem of legacyJobs.unreadable)
+    err(`teamos migrate: skipping ${problem.file}: ${problem.reason}`);
+  const legacySettingsPath = path9.join(legacyHome, "results", "settings.json");
+  let legacySettings = null;
+  if (fs11.existsSync(legacySettingsPath)) {
+    const read = readJsonFile(legacySettingsPath);
+    if (!read.ok) {
+      err(`teamos migrate: cannot parse ${legacySettingsPath}: ${read.error}`);
+      return EXIT_FAILURE;
+    }
+    if (read.value && typeof read.value === "object" && !Array.isArray(read.value)) {
+      legacySettings = read.value;
+    } else {
+      err(`teamos migrate: ${legacySettingsPath} is not a JSON object; settings are not imported`);
+    }
+  } else {
+    err(`teamos migrate: no ${legacySettingsPath}; settings are not imported`);
+  }
+  if (legacyJobs.jobs.length === 0 && legacySettings === null) {
+    err(`teamos migrate: nothing to import from ${legacyHome}` + (legacyJobs.unreadable.length > 0 ? ` \u2014 ${legacyJobs.unreadable.length} job file(s) were unreadable (listed above) and there are no settings` : ""));
+    return EXIT_FAILURE;
+  }
+  const targetSettingsRead = readJsonFile(path9.join(targetHome, "results", "settings.json"));
+  const targetSettings = mergeTargetSettings(targetSettingsRead.ok ? targetSettingsRead.value : null);
+  const existingJobIds = listExisting(path9.join(targetHome, "jobs"));
+  const plan = planMigration({
+    jobs: legacyJobs.jobs,
+    unreadable: legacyJobs.unreadable,
+    settings: legacySettings,
+    target: { existingJobIds, settings: targetSettings },
+    pauseAll,
+    now: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (!apply) {
+    out(renderPlan(plan, { from: legacyHome, to: targetHome }));
+    if (existingJobIds.length > 0) {
+      out("");
+      out(`note: ${existingJobIds.length} job file(s) already in the target home \u2014 an --apply will need --force unless the plan matches them exactly.`);
+    }
+    return EXIT_OK;
+  }
+  const writes = buildWrites(plan, targetHome);
+  const outcomes = writes.map((w) => ({ path: w.path, outcome: outcomeFor(w) }));
+  const noop = outcomes.every((o) => o.outcome === "unchanged");
+  if (!force && !noop && existingJobIds.length > 0) {
+    err(`teamos migrate: ${targetHome} already holds ${existingJobIds.length} job file(s) (${existingJobIds.slice(0, 5).join(", ")}${existingJobIds.length > 5 ? ", \u2026" : ""}).`);
+    err("Re-run with --force to overwrite them, or point --to at an empty home.");
+    return EXIT_FAILURE;
+  }
+  if (noop) {
+    out(`teamos migrate: no changes \u2014 ${targetHome} already matches this plan (${writes.length} file(s) verified).`);
+  } else {
+    for (const write of writes)
+      writeAtomic(write.path, write.contents, write.mode);
+  }
+  const reportPath = path9.join(targetHome, "migration-report.md");
+  const report = renderReport(plan, { from: legacyHome, to: targetHome, applied: { files: outcomes, noop }, force });
+  writeAtomic(reportPath, report);
+  if (!noop) {
+    const created = outcomes.filter((o) => o.outcome === "created").length;
+    const updated = outcomes.filter((o) => o.outcome === "updated").length;
+    out(`teamos migrate: applied to ${targetHome} \u2014 ${plan.jobs.length} job(s), ${created} file(s) created, ${updated} updated.`);
+    if (plan.rejected.length > 0)
+      out(`  ${plan.rejected.length} legacy job(s) were NOT imported \u2014 see the report.`);
+    if (plan.pauseAll)
+      out("  every job was imported disabled (--pause-all).");
+  }
+  out(`Report: ${reportPath}`);
+  return EXIT_OK;
+}
+
+// packages/cli/dist/commands/model.js
+var SIBLING_FAMILY_PREFIXES = {
+  "claude-fable-": ["claude-mythos-"],
+  "claude-mythos-": ["claude-fable-"]
+};
+function familyPrefixOf(model) {
+  return /^(claude-[a-z]+-)/.exec(model)?.[1] ?? null;
+}
+function rungFamilyPrefixes(table2) {
+  const out = {};
+  for (const rung of MODEL_ALIASES) {
+    const prefix = familyPrefixOf(table2[rung].model);
+    out[rung] = prefix ? [prefix, ...SIBLING_FAMILY_PREFIXES[prefix] ?? []] : [];
+  }
+  return out;
+}
+function familyLabel(prefix) {
+  return prefix.replace(/^claude-/, "").replace(/-$/, "");
+}
+function parseCreatedAt(value) {
+  const ms = new Date(value).getTime();
+  return Number.isNaN(ms) ? null : ms;
+}
+function detectModelUpdates(apiModels, table2 = DEFAULT_MODEL_ALIASES) {
+  const byId = new Map(apiModels.map((m) => [m.id, m]));
+  const rungPrefixes = rungFamilyPrefixes(table2);
+  const allKnownPrefixes = Array.from(new Set(Object.values(rungPrefixes).flat()));
+  const candidates = [];
+  let newestKnownMs = null;
+  for (const rung of MODEL_ALIASES) {
+    const currentModel = table2[rung].model;
+    const currentEntry = byId.get(currentModel);
+    if (!currentEntry)
+      continue;
+    const currentCreatedMs = parseCreatedAt(currentEntry.created_at);
+    if (currentCreatedMs === null)
+      continue;
+    newestKnownMs = newestKnownMs === null ? currentCreatedMs : Math.max(newestKnownMs, currentCreatedMs);
+    const prefixes = rungPrefixes[rung];
+    if (prefixes.length === 0)
+      continue;
+    const newer = apiModels.filter((m) => m.id !== currentModel && prefixes.some((p) => m.id.startsWith(p))).map((m) => ({ model: m, createdMs: parseCreatedAt(m.created_at) })).filter((entry) => entry.createdMs !== null).filter((entry) => entry.createdMs > currentCreatedMs).sort((a, b) => b.createdMs - a.createdMs);
+    const best = newer[0];
+    if (!best)
+      continue;
+    const matchedPrefix = prefixes.find((p) => best.model.id.startsWith(p)) ?? prefixes[0];
+    candidates.push({
+      rung,
+      family: familyLabel(matchedPrefix),
+      currentModel,
+      currentCreatedAt: currentEntry.created_at,
+      newModel: best.model.id,
+      newModelDisplayName: best.model.display_name,
+      newCreatedAt: best.model.created_at
+    });
+  }
+  const floorMs = newestKnownMs;
+  const unrecognized = floorMs === null ? [] : apiModels.filter((m) => !allKnownPrefixes.some((p) => m.id.startsWith(p))).filter((m) => {
+    const ms = parseCreatedAt(m.created_at);
+    return ms !== null && ms > floorMs;
+  }).map((m) => ({ id: m.id, display_name: m.display_name, created_at: m.created_at }));
+  return { candidates, unrecognized };
+}
+async function fetchAllAnthropicModels(opts) {
+  const fetchFn = opts.fetchImpl ?? fetch;
+  const baseUrl = opts.baseUrl ?? "https://api.anthropic.com/v1/models";
+  const models = [];
+  let afterId;
+  let pageIndex = 0;
+  for (; ; ) {
+    const url = new URL(baseUrl);
+    if (afterId)
+      url.searchParams.set("after_id", afterId);
+    const urlStr = url.toString();
+    const res = await fetchFn(urlStr, {
+      headers: {
+        "x-api-key": opts.apiKey,
+        "anthropic-version": "2023-06-01"
+      }
+    });
+    if (!res.ok) {
+      throw new Error(`Anthropic /v1/models request failed on page ${pageIndex} (${urlStr}): ${res.status} ${res.statusText}`);
+    }
+    let page;
+    try {
+      page = await res.json();
+    } catch (err) {
+      throw new Error(`Anthropic /v1/models returned an unparseable body on page ${pageIndex} (${urlStr}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    models.push(...page.data);
+    if (!page.has_more)
+      break;
+    if (!page.last_id) {
+      throw new Error(`Anthropic /v1/models page ${pageIndex} (${urlStr}) reported has_more=true but no last_id to continue from \u2014 refusing to silently truncate the catalog.`);
+    }
+    afterId = page.last_id;
+    pageIndex += 1;
+  }
+  return models;
+}
+var MODEL_MONITOR_API_KEY_ENV_VAR = "MODEL_MONITOR_ANTHROPIC_API_KEY";
+async function checkForModelUpdates(opts) {
+  const apiKey = opts?.apiKey ?? process.env["MODEL_MONITOR_ANTHROPIC_API_KEY"];
+  if (!apiKey) {
+    throw new Error(`${MODEL_MONITOR_API_KEY_ENV_VAR} is not set in the job environment \u2014 cannot query the Anthropic Models API.`);
+  }
+  const apiModels = await fetchAllAnthropicModels({ apiKey, fetchImpl: opts?.fetchImpl });
+  return detectModelUpdates(apiModels, DEFAULT_MODEL_ALIASES);
+}
+var USAGE2 = `teamos model <subcommand>
+
+Inspect the capability-alias model ladder (packages/shared/src/model-aliases.ts).
+
+  check-updates   Query the Anthropic Models API for same-family models newer
+                  than the current ladder, plus any unrecognized new families.
+                  Prints a JSON report; see docs/model-adoption-playbook.md for
+                  what to do with it. Needs ${MODEL_MONITOR_API_KEY_ENV_VAR} in
+                  the environment.
+`;
+async function modelCommand(ctx) {
+  const [sub] = ctx.rest;
+  switch (sub) {
+    case "check-updates": {
+      let report;
+      try {
+        report = await checkForModelUpdates();
+      } catch (err) {
+        ctx.err(`teamos model check-updates: ${err instanceof Error ? err.message : String(err)}`);
+        return EXIT_FAILURE;
+      }
+      ctx.out(JSON.stringify(report, null, 2));
+      return EXIT_OK;
+    }
+    case void 0:
+    case "help":
+      ctx.out(USAGE2);
+      return EXIT_OK;
+    default:
+      ctx.err(`Unknown model subcommand: ${sub}
+Usage: teamos model <check-updates>`);
+      return EXIT_USAGE;
+  }
+}
+
+// packages/cli/dist/commands/sessions.js
+var VALID_STATUSES = /* @__PURE__ */ new Set(["idle", "running", "error", "waiting", "interrupted"]);
+async function sessionsCommand(ctx) {
+  const [sub, ...rest] = ctx.rest;
+  switch (sub) {
+    case void 0:
+    case "list": {
+      const limit = intFlag(ctx.args, "limit", { min: 1, max: 200 });
+      if (limit !== void 0 && typeof limit === "object") {
+        ctx.err(`teamos: ${limit.error}`);
+        return EXIT_USAGE;
+      }
+      const status = stringFlag(ctx.args, "status");
+      if (status !== void 0 && !VALID_STATUSES.has(status)) {
+        ctx.err(`teamos: --status must be one of ${[...VALID_STATUSES].join(", ")} (got ${JSON.stringify(status)})`);
+        return EXIT_USAGE;
+      }
+      const params = new URLSearchParams();
+      params.set("limit", String(limit ?? 25));
+      if (status)
+        params.set("status", status);
+      const res = await ctx.client.get(`/api/sessions?${params.toString()}`);
+      if (!res.ok) {
+        ctx.err(describeFailure(res, ctx.client.base));
+        return EXIT_FAILURE;
+      }
+      const body = res.data ?? {};
+      const sessions = body.sessions ?? [];
+      if (sessions.length === 0) {
+        ctx.out("No sessions.");
+        return EXIT_OK;
+      }
+      ctx.out(table(["ID", "STATUS", "UPDATED", "CWD"], sessions.map((s) => [
+        s.id ? truncate(s.id, 24) : "\u2014",
+        s.status,
+        relativeTime(s.updatedAt ?? s.createdAt),
+        s.cwd ? truncate(s.cwd, 48) : "\u2014"
+      ])));
+      if (typeof body.total === "number" && body.total > sessions.length) {
+        ctx.out(`
+Showing ${sessions.length} of ${body.total}. Raise the window with --limit.`);
+      }
+      return EXIT_OK;
+    }
+    case "show": {
+      const id = rest[0];
+      if (!id) {
+        ctx.err("Usage: teamos sessions show <id>");
+        return EXIT_USAGE;
+      }
+      const res = await ctx.client.get(`/api/sessions/${encodeURIComponent(id)}`);
+      if (!res.ok) {
+        ctx.err(describeFailure(res, ctx.client.base));
+        return EXIT_FAILURE;
+      }
+      ctx.out(JSON.stringify(res.data, null, 2));
+      return EXIT_OK;
+    }
+    case "stop": {
+      const id = rest[0];
+      if (!id) {
+        ctx.err("Usage: teamos sessions stop <id>");
+        return EXIT_USAGE;
+      }
+      const res = await ctx.client.post(`/api/sessions/${encodeURIComponent(id)}/stop`);
+      if (!res.ok) {
+        ctx.err(describeFailure(res, ctx.client.base));
+        return EXIT_FAILURE;
+      }
+      ctx.out(`Interrupted session ${id} and dropped its queued turns.`);
+      return EXIT_OK;
+    }
+    default:
+      ctx.err(`Unknown sessions subcommand: ${sub}
+Usage: teamos sessions <list|show|stop>`);
+      return EXIT_USAGE;
+  }
+}
+
+// packages/cli/dist/commands/settings.js
+function buildPatch(dottedPath, value) {
+  const segments = dottedPath.split(".").filter((s) => s.length > 0);
+  if (segments.length === 0)
+    throw new Error("empty settings path");
+  const root = {};
+  let cursor = root;
+  for (let i = 0; i < segments.length - 1; i++) {
+    const next = {};
+    cursor[segments[i]] = next;
+    cursor = next;
+  }
+  cursor[segments[segments.length - 1]] = value;
+  return root;
+}
+function readPath(source, dottedPath) {
+  const segments = dottedPath.split(".").filter((s) => s.length > 0);
+  let cursor = source;
+  for (const seg of segments) {
+    if (cursor === null || typeof cursor !== "object")
+      return void 0;
+    cursor = cursor[seg];
+  }
+  return cursor;
+}
+function coerceValue(raw) {
+  const trimmed = raw.trim();
+  if (trimmed === "true")
+    return true;
+  if (trimmed === "false")
+    return false;
+  if (trimmed === "null")
+    return null;
+  if (/^-?\d+(\.\d+)?$/.test(trimmed))
+    return Number(trimmed);
+  if (trimmed.startsWith("[") || trimmed.startsWith("{")) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+    }
+  }
+  return raw;
+}
+async function settingsCommand(ctx) {
+  const [sub, ...rest] = ctx.rest;
+  switch (sub) {
+    case void 0:
+    case "get": {
+      const res = await ctx.client.get("/api/settings");
+      if (!res.ok) {
+        ctx.err(describeFailure(res, ctx.client.base));
+        return EXIT_FAILURE;
+      }
+      const path11 = rest[0];
+      if (!path11) {
+        ctx.out(JSON.stringify(res.data, null, 2));
+        return EXIT_OK;
+      }
+      const value = readPath(res.data, path11);
+      if (value === void 0) {
+        ctx.err(`teamos: no settings value at ${path11}`);
+        return EXIT_FAILURE;
+      }
+      ctx.out(typeof value === "string" ? value : JSON.stringify(value, null, 2));
+      return EXIT_OK;
+    }
+    case "set": {
+      const path11 = rest[0];
+      const raw = rest[1];
+      if (!path11 || raw === void 0) {
+        ctx.err("Usage: teamos settings set <dotted.path> <value>");
+        return EXIT_USAGE;
+      }
+      if (!path11.includes(".")) {
+        ctx.err(`teamos: settings paths are dotted, e.g. retention.days or server.bindHost (got ${JSON.stringify(path11)})`);
+        return EXIT_USAGE;
+      }
+      const patch = buildPatch(path11, coerceValue(raw));
+      const res = await ctx.client.put("/api/settings", patch);
+      if (!res.ok) {
+        ctx.err(describeFailure(res, ctx.client.base));
+        return EXIT_FAILURE;
+      }
+      const stored = readPath(res.data, path11);
+      ctx.out(`${path11} = ${JSON.stringify(stored)}`);
+      return EXIT_OK;
+    }
+    default:
+      ctx.err(`Unknown settings subcommand: ${sub}
+Usage: teamos settings <get|set>`);
+      return EXIT_USAGE;
+  }
+}
+
+// packages/cli/dist/version.js
+import fs12 from "node:fs";
+import path10 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function cliVersion() {
+  const dir = path10.dirname(fileURLToPath2(import.meta.url));
+  try {
+    const parsed = JSON.parse(fs12.readFileSync(path10.join(dir, "..", "package.json"), "utf8"));
+    return typeof parsed.version === "string" ? parsed.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// packages/cli/dist/commands/status.js
+async function healthCommand(ctx) {
+  const res = await ctx.client.get("/api/health");
+  if (!res.ok) {
+    ctx.err(describeFailure(res, ctx.client.base));
+    return EXIT_FAILURE;
+  }
+  ctx.out(JSON.stringify(res.data, null, 2));
+  return EXIT_OK;
+}
+function launchdLine(label, port, configured) {
+  if (label === null)
+    return "not managed (started manually)";
+  if (port === configured)
+    return label;
+  return `${label} \u2014 host-level, and it manages :${configured}, not the :${port} queried here`;
+}
+async function statusCommand(ctx) {
+  const configured = configuredPort(process.env, () => {
+  });
+  const health = await ctx.client.get("/api/health");
+  if (!health.ok) {
+    ctx.out("Gateway: stopped");
+    ctx.out(`  Port:  ${ctx.port}`);
+    ctx.out(`  Home:  ${teamworkHomeDir()}`);
+    const label2 = await findManagedLabel(void 0, ctx.err);
+    if (label2) {
+      ctx.out(ctx.port === configured ? `  launchd: ${label2} is loaded but the gateway is not answering \u2014 check the launchd error log` : `  launchd: ${launchdLine(label2, ctx.port, configured)}`);
+    }
+    ctx.err(describeFailure(health, ctx.client.base));
+    return EXIT_FAILURE;
+  }
+  const body = health.data ?? {};
+  ctx.out("Gateway: running");
+  const label = await findManagedLabel(void 0, ctx.err);
+  ctx.out(keyValues([
+    ["  Port", ctx.port],
+    ["  Version", body.version],
+    ["  Commit", body.commit ? body.commit.slice(0, 7) : null],
+    ["  Uptime", body.uptime === void 0 ? null : formatUptime(body.uptime)],
+    ["  Home", teamworkHomeDir()],
+    ["  launchd", launchdLine(label, ctx.port, configured)]
+  ]));
+  const [jobs, sessions, scheduler] = await Promise.all([
+    ctx.client.get("/api/jobs"),
+    ctx.client.get("/api/sessions?limit=1"),
+    ctx.client.get("/api/scheduler")
+  ]);
+  if (jobs.ok && Array.isArray(jobs.data)) {
+    const list = jobs.data;
+    const enabled = list.filter((j) => j.enabled).length;
+    const running = list.filter((j) => j.lastStatus === "running" || j.lastStatus === "retrying").length;
+    const lastRun = list.map((j) => j.lastRun).filter((v) => typeof v === "string").sort().at(-1);
+    ctx.out(`  Jobs:     ${list.length} total, ${enabled} enabled, ${running} running (last run ${relativeTime(lastRun)})`);
+  } else if (jobs.status !== 0) {
+    ctx.out(`  Jobs:     unavailable (${describeFailure(jobs, ctx.client.base)})`);
+  }
+  if (sessions.ok && sessions.data !== null && typeof sessions.data === "object") {
+    const total = sessions.data.total;
+    ctx.out(`  Sessions: ${total ?? "unknown"} total`);
+  }
+  if (scheduler.ok && scheduler.data !== null && typeof scheduler.data === "object") {
+    const s = scheduler.data;
+    const parts = [s.paused ? "PAUSED" : "active"];
+    if (typeof s.inFlight === "number")
+      parts.push(`${s.inFlight} in flight`);
+    if (typeof s.queued === "number")
+      parts.push(`${s.queued} queued`);
+    ctx.out(`  Scheduler: ${parts.join(", ")}`);
+  }
+  return EXIT_OK;
+}
+function formatUptime(seconds) {
+  const s = Math.floor(seconds);
+  if (s < 60)
+    return `${s}s`;
+  if (s < 3600)
+    return `${Math.floor(s / 60)}m ${s % 60}s`;
+  if (s < 86400)
+    return `${Math.floor(s / 3600)}h ${Math.floor(s % 3600 / 60)}m`;
+  return `${Math.floor(s / 86400)}d ${Math.floor(s % 86400 / 3600)}h`;
+}
+
+// packages/cli/dist/cli.js
+var USAGE3 = `teamos \u2014 teamwork-os control CLI
+
+Usage: teamos <command> [subcommand] [args] [--flags]
+
+Gateway
+  status                     Gateway liveness, version, launchd state, subsystem counts
+  health                     Raw GET /api/health
+  version                    Print the CLI version
+
+Lifecycle (launchd-aware on macOS)
+  start                      Start the gateway (kickstart when launchd manages it)
+  stop                       Stop the gateway
+  restart                    Restart the gateway
+  install                    Render + load the gateway and watchdog LaunchAgents
+  uninstall                  Unload and remove them
+  deploy                     Fetch, fast-forward, install, build, restart
+
+Configuration
+  env list|get|set|unset|audit|normalize
+  settings get [path] | settings set <dotted.path> <value>
+  model check-updates
+
+Work
+  jobs list|show|create|update|delete|run|pause|resume|runs|trace
+  sessions list|show|stop
+  logs [name] [--lines N] [--follow]
+
+Migration
+  migrate --from <legacy-home> [--to <home>] [--apply] [--force] [--pause-all]
+
+Common flags
+  --port N                   Gateway port (default: PORT, then the teamwork env file, then 7463)
+  --help                     This text
+
+Exit codes: 0 success, 1 the operation failed, 2 the invocation was wrong.
+`;
+async function run2(argv, out = console.log, err = console.error) {
+  const args = parseArgs(argv);
+  const [command, ...rest] = args.positionals;
+  if (command === void 0) {
+    err(USAGE3);
+    return EXIT_USAGE;
+  }
+  if (command === "help" || command === "--help" || args.flags.help === true) {
+    out(USAGE3);
+    return EXIT_OK;
+  }
+  if (command === "version" || command === "--version" || command === "-v") {
+    out(cliVersion());
+    return EXIT_OK;
+  }
+  const port = resolvePort(args, process.env, err);
+  if (typeof port === "object") {
+    err(`teamos: ${port.error}`);
+    return EXIT_USAGE;
+  }
+  const ctx = { args, rest, port, client: makeClient(port, err), out, err };
+  try {
+    switch (command) {
+      case "status":
+        return await statusCommand(ctx);
+      case "health":
+        return await healthCommand(ctx);
+      case "env":
+        return await envCommand(ctx);
+      case "settings":
+        return await settingsCommand(ctx);
+      case "model":
+        return await modelCommand(ctx);
+      case "jobs":
+        return await jobsCommand(ctx);
+      case "sessions":
+        return await sessionsCommand(ctx);
+      case "logs":
+        return await logsCommand(ctx);
+      case "migrate":
+        return await migrateCommand(ctx);
+      case "start":
+        return await startCommand(ctx);
+      case "stop":
+        return await stopCommand(ctx);
+      case "restart":
+        return await restartCommand(ctx);
+      case "install":
+        return await installCommand(ctx);
+      case "uninstall":
+        return await uninstallCommand(ctx);
+      case "deploy":
+        return await deployCommand(ctx);
+      default:
+        err(`Unknown command: ${command}
+`);
+        err(USAGE3);
+        return EXIT_USAGE;
+    }
+  } catch (e) {
+    err(`teamos: ${e instanceof Error ? e.message : String(e)}`);
+    return EXIT_FAILURE;
+  }
+}
+
+// packages/cli/dist/index.js
+var code = await run2(process.argv.slice(2));
+process.exitCode = code;