token-harness 0.1.6 → 0.1.7

package/token-harness.mjs

@@ -1462,10 +1462,10 @@ function truncateUtf8(value3, maxBytes) {
   }
   return `${value3.slice(0, low).trimEnd()}${suffix}`;
 }
-function renderList(title, values, omitted) {
+function renderList(title2, values, omitted) {
   if (values.length === 0 && omitted === 0)
     return [];
-  const lines = [`## ${title}`];
+  const lines = [`## ${title2}`];
   for (const value3 of values)
     lines.push(`- ${value3}`);
   if (omitted > 0)
@@ -1879,6 +1879,26 @@ var init_compatibility_rows = __esm({
         fixture: "tests/fixtures/rows/rtk-claude-windows",
         verificationTier: "canary"
       },
+      {
+        harness: "claude",
+        harnessVersion: { minimum: "2.1.251", maximum: "2.1.251" },
+        provider: "rtk",
+        providerVersion: "0.44.0",
+        platform: { os: "windows", wsl: false, supported: true, limitation: null },
+        configSchema: "claude-settings-json-hooks-powershell",
+        fixture: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.44.0",
+        verificationTier: "canary"
+      },
+      {
+        harness: "claude",
+        harnessVersion: { minimum: "2.1.251", maximum: "2.1.251" },
+        provider: "rtk",
+        providerVersion: "0.48.0",
+        platform: { os: "windows", wsl: false, supported: true, limitation: null },
+        configSchema: "claude-settings-json-hooks-powershell",
+        fixture: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0",
+        verificationTier: "canary"
+      },
       {
         harness: "claude",
         harnessVersion: { minimum: "2.1.220", maximum: "2.1.220" },
@@ -2223,6 +2243,13 @@ var init_reports = __esm({
   }
 });
 
+// packages/core/dist/src/domain/setup.js
+var init_setup = __esm({
+  "packages/core/dist/src/domain/setup.js"() {
+    "use strict";
+  }
+});
+
 // packages/core/dist/src/domain/verification.js
 function contributesToProblems(check) {
   return check.status === "fail";
@@ -2827,9 +2854,9 @@ function providerRemovalOrder(ownership, candidates) {
       break;
     ordered.push(provider);
     for (const dependent of [...edges.get(provider) ?? []].sort((left, right) => left.localeCompare(right))) {
-      const next = (indegree.get(dependent) ?? 0) - 1;
-      indegree.set(dependent, next);
-      if (next === 0) {
+      const next2 = (indegree.get(dependent) ?? 0) - 1;
+      indegree.set(dependent, next2);
+      if (next2 === 0) {
         ready.push(dependent);
         ready.sort((left, right) => left.localeCompare(right));
       }
@@ -4298,10 +4325,10 @@ function parseJsonPointer(pointer) {
   for (let index = 0; index < pointer.length; index += 1) {
     const char = pointer[index];
     if (char === "\\") {
-      const next = pointer[index + 1];
-      if (next !== "." && next !== "\\")
+      const next2 = pointer[index + 1];
+      if (next2 !== "." && next2 !== "\\")
         return null;
-      current += next;
+      current += next2;
       index += 1;
       continue;
     }
@@ -4416,13 +4443,13 @@ function ensureParent(document2, segments) {
     if (!isJsonObject(current)) {
       return { ok: false, reason: `\`${segments.slice(0, index).join(".")}\` is not an object` };
     }
-    const next = current[segment];
-    if (next === void 0) {
+    const next2 = current[segment];
+    if (next2 === void 0) {
       current[segment] = {};
       current = current[segment];
       continue;
     }
-    current = next;
+    current = next2;
   }
   if (!isJsonObject(current)) {
     return { ok: false, reason: `\`${segments.slice(0, -1).join(".")}\` is not an object` };
@@ -4650,31 +4677,31 @@ function upsertMarkerBlock(input) {
     if (lookup.block.body === bodyText) {
       return { ok: true, text: input.text, bodyDigest: lookup.block.bodyDigest, changed: false };
     }
-    const next2 = [
+    const next3 = [
       ...lines.slice(0, lookup.block.beginLine + 1),
       ...bodyLines,
       ...lines.slice(lookup.block.endLine)
     ];
     return {
       ok: true,
-      text: `${hasBom ? BOM2 : ""}${joinLines(next2)}`,
+      text: `${hasBom ? BOM2 : ""}${joinLines(next3)}`,
       bodyDigest: digestText(bodyText),
       changed: true
     };
   }
-  const next = lines.map((line) => ({ ...line }));
-  const trailing = next.length === 0 ? eol : next[next.length - 1]?.eol ?? eol;
-  const last = next[next.length - 1];
+  const next2 = lines.map((line) => ({ ...line }));
+  const trailing = next2.length === 0 ? eol : next2[next2.length - 1]?.eol ?? eol;
+  const last = next2[next2.length - 1];
   if (last !== void 0 && last.eol === "")
     last.eol = eol;
-  if (next.length > 0)
-    next.push({ text: "", eol });
-  next.push({ text: fenceLine(input.fence.begin, input.syntax), eol });
-  next.push(...bodyLines);
-  next.push({ text: fenceLine(input.fence.end, input.syntax), eol: trailing });
+  if (next2.length > 0)
+    next2.push({ text: "", eol });
+  next2.push({ text: fenceLine(input.fence.begin, input.syntax), eol });
+  next2.push(...bodyLines);
+  next2.push({ text: fenceLine(input.fence.end, input.syntax), eol: trailing });
   return {
     ok: true,
-    text: `${hasBom ? BOM2 : ""}${joinLines(next)}`,
+    text: `${hasBom ? BOM2 : ""}${joinLines(next2)}`,
     bodyDigest: digestText(bodyText),
     changed: true
   };
@@ -6205,8 +6232,8 @@ function withoutTrailingCommas(text3) {
       let cursor = index + 1;
       while (cursor < text3.length && /\s/.test(text3[cursor]))
         cursor += 1;
-      const next = text3[cursor];
-      if (next === "}" || next === "]") {
+      const next2 = text3[cursor];
+      if (next2 === "}" || next2 === "]") {
         result2 += text3.slice(index + 1, cursor);
         index = cursor;
         continue;
@@ -6468,6 +6495,14 @@ var init_snapshots = __esm({
 function terminal(status) {
   return status !== "applied" && status !== "already-satisfied";
 }
+function initialSnapshots(snapshots) {
+  const firstByPath = /* @__PURE__ */ new Map();
+  for (const snapshot of snapshots) {
+    if (!firstByPath.has(snapshot.path))
+      firstByPath.set(snapshot.path, snapshot);
+  }
+  return [...firstByPath.values()];
+}
 async function verifyRestoration(fs, snapshots) {
   const unrestored = [];
   for (const snapshot of snapshots) {
@@ -6556,7 +6591,7 @@ async function executeTransaction(request) {
   };
   const rollback = async (cause) => {
     diagnostics.push(...cause);
-    const snapshots = request.snapshots.captured;
+    const snapshots = initialSnapshots(request.snapshots.captured);
     let restoreError = null;
     try {
       await request.snapshots.restoreAll(snapshots);
@@ -6690,7 +6725,7 @@ async function rollbackTransaction(request) {
       ]
     };
   }
-  const snapshots = journal.entries.flatMap((entry) => entry.snapshots);
+  const snapshots = initialSnapshots(journal.entries.flatMap((entry) => entry.snapshots));
   const diagnostics = [];
   let restoreError = null;
   try {
@@ -6793,6 +6828,7 @@ var init_src = __esm({
     init_process();
     init_redaction();
     init_reports();
+    init_setup();
     init_verification();
     init_version();
     init_envelope();
@@ -6831,7 +6867,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.6";
+    TOOL_VERSION = "0.1.7";
   }
 });
 
@@ -6847,10 +6883,10 @@ function parseValue(argv2, index) {
     const value3 = token.slice(equals + 1);
     return { value: value3 === "" ? null : value3, consumed: 0 };
   }
-  const next = argv2[index + 1];
-  if (next === void 0 || next.startsWith("-"))
+  const next2 = argv2[index + 1];
+  if (next2 === void 0 || next2.startsWith("-"))
     return { value: null, consumed: 0 };
-  return { value: next, consumed: 1 };
+  return { value: next2, consumed: 1 };
 }
 function parseArgs(argv2) {
   const args = {
@@ -7112,19 +7148,19 @@ function parse(argv2) {
       continue;
     }
     const inline = equals >= 0 ? token.slice(equals + 1) : null;
-    const next = inline ?? argv2[index + 1] ?? null;
-    if (next === null || next === "" || inline === null && next.startsWith("-")) {
+    const next2 = inline ?? argv2[index + 1] ?? null;
+    if (next2 === null || next2 === "" || inline === null && next2.startsWith("-")) {
       errors.push(`${name} requires a value`);
       continue;
     }
     if (inline === null)
       index += 1;
     if (name === "--benchmark-id")
-      args.benchmarkId = next;
+      args.benchmarkId = next2;
     else if (name === "--handoff-file")
-      args.handoffFile = next;
+      args.handoffFile = next2;
     else {
-      const parsed = Number(next);
+      const parsed = Number(next2);
       if (!Number.isInteger(parsed) || parsed <= 0) {
         errors.push("--max-handoff-bytes must be a positive integer");
       } else {
@@ -8790,19 +8826,19 @@ function parse2(argv2) {
       continue;
     }
     const inline = equals >= 0 ? token.slice(equals + 1) : null;
-    const next = inline ?? argv2[index + 1] ?? null;
-    if (next === null || next === "" || inline === null && next.startsWith("-")) {
+    const next2 = inline ?? argv2[index + 1] ?? null;
+    if (next2 === null || next2 === "" || inline === null && next2.startsWith("-")) {
       errors.push(`${name} requires a value`);
       continue;
     }
     if (inline === null)
       index += 1;
     if (name === "--benchmark-id")
-      args.benchmarkId = next;
+      args.benchmarkId = next2;
     else if (name === "--handoff-file")
-      args.handoffFile = next;
+      args.handoffFile = next2;
     else {
-      const parsed = Number(next);
+      const parsed = Number(next2);
       if (!Number.isInteger(parsed) || parsed <= 0) {
         errors.push("--max-handoff-bytes must be a positive integer");
       } else {
@@ -8960,10 +8996,10 @@ function valueAt(argv2, index) {
     const value3 = token.slice(equals + 1);
     return { value: value3.length > 0 ? value3 : null, consumed: 0 };
   }
-  const next = argv2[index + 1];
-  if (next === void 0 || next.startsWith("-"))
+  const next2 = argv2[index + 1];
+  if (next2 === void 0 || next2.startsWith("-"))
     return { value: null, consumed: 0 };
-  return { value: next, consumed: 1 };
+  return { value: next2, consumed: 1 };
 }
 function parseInteger(name, value3, minimum, diagnostics) {
   const parsed = Number(value3);
@@ -11690,24 +11726,27 @@ async function verify5(context) {
     },
     {
       id: "module-installed",
-      status: module ? "pass" : "fail",
-      summary: module ? "HarnessTrim extension module is installed" : "No HarnessTrim extension module was found in the Pi extension directories",
+      // The HarnessTrim extension is optional. `verify` answers whether existing integrations are
+      // healthy; it must not turn an installed Pi executable into a warning merely because the
+      // user never chose to integrate HarnessTrim with it.
+      status: module ? "pass" : "not-exercised",
+      summary: module ? "HarnessTrim extension module is installed" : "HarnessTrim is not configured on Pi, so there is no Pi integration to verify",
       achievedTier: module ? "config-only" : null,
       evidence: [],
-      remediation: module ? null : "Run `harnesstrim install pi --apply`"
+      remediation: null
     },
     {
       id: "mode-unreadable",
-      status: "info",
-      summary: "The effective reduction mode (HARNESSTRIM_MODE) defaults to dryrun and is not observable from the extension alone",
+      status: module ? "info" : "pass",
+      summary: module ? "The effective reduction mode (HARNESSTRIM_MODE) defaults to dryrun and is not observable from the extension alone" : "no HarnessTrim Pi mode applies because no extension is configured",
       achievedTier: null,
       evidence: [],
       remediation: null
     },
     {
       id: "canary-intercepted",
-      status: "not-exercised",
-      summary: "Pi exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter",
+      status: module ? "not-exercised" : "pass",
+      summary: module ? "Pi exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter" : "no HarnessTrim Pi canary applies because no extension is configured",
       achievedTier: null,
       evidence: [],
       remediation: null
@@ -12768,6 +12807,15 @@ function hookEntryFor(harnessId2, matcher) {
     hooks: [{ type: "command", command: `${RTK_HOOK_COMMAND_PREFIX} ${harnessId2}` }]
   };
 }
+function matcherCoversFamily2(matcher, family) {
+  if (matcher === family)
+    return true;
+  try {
+    return new RegExp(matcher).test(family);
+  } catch {
+    return false;
+  }
+}
 function planTargets(context, request) {
   const targets = /* @__PURE__ */ new Map();
   for (const owned of request.ownership) {
@@ -12787,12 +12835,32 @@ function planTargets(context, request) {
     const key = `${configPath}\0${point.eventName}\0${owned.scope.toolFamily}`;
     if (targets.has(key))
       continue;
-    targets.set(key, { scope: owned.scope, harness, eventName: point.eventName, configPath });
+    targets.set(key, {
+      scope: owned.scope,
+      harness,
+      eventName: point.eventName,
+      configPath
+    });
+  }
+  if (context.facts.os === "windows") {
+    for (const target of [...targets.values()]) {
+      if (target.harness.id !== CLAUDE3 || target.scope.toolFamily !== BASH)
+        continue;
+      if (!target.harness.toolFamilies.some((family) => family.id === POWERSHELL))
+        continue;
+      const key = `${target.configPath}\0${target.eventName}\0${POWERSHELL}`;
+      if (targets.has(key))
+        continue;
+      targets.set(key, {
+        ...target,
+        scope: { ...target.scope, toolFamily: POWERSHELL }
+      });
+    }
   }
   return [...targets.values()];
 }
-function alreadyRegistered(context, target, identifies) {
-  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.includes(target.scope.toolFamily) && config.commands.some((command) => identifies(command)));
+function alreadyRegistered(context, target, identifies, allowRegexCoverage) {
+  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.some((matcher) => allowRegexCoverage ? matcherCoversFamily2(matcher, target.scope.toolFamily) : matcher === target.scope.toolFamily) && config.commands.some((command) => identifies(command)));
 }
 function deterministicId(parts) {
   const digest = digestText(parts.join("\0"));
@@ -12930,7 +12998,7 @@ function buildRtkPlan(input) {
   const targetHarnesses = [...new Set(targets.map((target) => target.harness.id))];
   if (request.desiredState === "absent") {
     for (const target of targets) {
-      if (!alreadyRegistered(context, target, input.identifiesCommand))
+      if (!alreadyRegistered(context, target, input.identifiesCommand, false))
         continue;
       actions.push(removalAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
     }
@@ -12947,7 +13015,7 @@ function buildRtkPlan(input) {
       actions.push(install);
   }
   for (const target of targets) {
-    if (alreadyRegistered(context, target, input.identifiesCommand))
+    if (alreadyRegistered(context, target, input.identifiesCommand, true))
       continue;
     actions.push(hookAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
   }
@@ -12958,13 +13026,16 @@ function buildRtkPlan(input) {
     targetHarnesses: actions.length === 0 ? [] : targetHarnesses
   };
 }
-var RTK_HOOK_COMMAND_PREFIX, HOOK_LIST_HARNESSES;
+var RTK_HOOK_COMMAND_PREFIX, HOOK_LIST_HARNESSES, CLAUDE3, BASH, POWERSHELL;
 var init_rtk_plan = __esm({
   "packages/adapters/dist/src/providers/rtk-plan.js"() {
     "use strict";
     init_src();
     RTK_HOOK_COMMAND_PREFIX = "rtk hook";
     HOOK_LIST_HARNESSES = /* @__PURE__ */ new Set(["claude"]);
+    CLAUDE3 = "claude";
+    BASH = "Bash";
+    POWERSHELL = "PowerShell";
   }
 });
 
@@ -13158,7 +13229,7 @@ async function detect7(context) {
      * module `rtk init -g --opencode` installs globally, which this build has no action for. Saying
      * so here is what stops the resolver assigning a scope nothing can produce.
      */
-    assignableHarnesses: [CLAUDE3],
+    assignableHarnesses: [CLAUDE4],
     evidence: evidenceItems,
     warnings
   };
@@ -13477,14 +13548,14 @@ async function plan2(context, request) {
     installationChannels: MANIFEST7.installationChannels
   });
 }
-var RTK2, CLAUDE3, OPENCODE3, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
+var RTK2, CLAUDE4, OPENCODE3, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
 var init_rtk = __esm({
   "packages/adapters/dist/src/providers/rtk.js"() {
     "use strict";
     init_src();
     init_rtk_plan();
     RTK2 = providerId("rtk");
-    CLAUDE3 = harnessId("claude");
+    CLAUDE4 = harnessId("claude");
     OPENCODE3 = harnessId("opencode");
     MANIFEST7 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
@@ -13498,31 +13569,26 @@ var init_rtk = __esm({
         {
           capability: "shell.command.rewrite",
           mode: "exclusive",
-          harnesses: [CLAUDE3],
-          // The surface the Phase 2.5 spike actually watched: a `PreToolUse` hook matching
-          // `Bash`. `PowerShell` is deliberately absent — the spike ran the identical command
-          // through it and RTK's counter did not move, which is the coverage gap `doctor`
-          // reports as `tool-family-not-covered`. Claiming it here would make the resolver
-          // hand RTK a scope it demonstrably does not serve.
+          harnesses: [CLAUDE4],
+          // The portable resolver surface remains Bash. Windows PowerShell coverage is added by
+          // the planner only on Windows, because ProviderManifest capabilities are not platform-scoped.
+          // The native processor and that Windows-only plan path are covered by the live fixture below.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
-          // RFC 0003 §Rule wants the evidence recorded at a version. The reference is the
-          // hook the Phase 2.5 spike read, not a line of RTK's source: what was demonstrated
-          // is that the harness routes commands through it, which is the claim being made.
           evidence: {
-            sourceReference: "docs/spikes/2.5-live-verification-log.md",
-            upstreamVersion: "0.42.0"
+            sourceReference: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0/README.md",
+            upstreamVersion: "0.48.0"
           }
         },
         {
           capability: "shell.output.reduce",
           mode: "exclusive",
-          harnesses: [CLAUDE3],
-          // Same surface: RTK rewrites the command at `PreToolUse` and the rewritten command is
-          // what filters the output, so both capabilities are served from one interception point.
+          harnesses: [CLAUDE4],
+          // Same portable Bash surface. On Windows the planner adds PowerShell as a platform-only
+          // companion matcher; the live fixture below proves the same native processor handles both.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
           evidence: {
-            sourceReference: "docs/spikes/2.5-live-verification-log.md",
-            upstreamVersion: "0.42.0"
+            sourceReference: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0/README.md",
+            upstreamVersion: "0.48.0"
           }
         },
         /**
@@ -13577,8 +13643,8 @@ var init_rtk = __esm({
       ],
       harnesses: [
         {
-          harness: CLAUDE3,
-          testedVersions: { minimum: "2.0.0", maximum: "2.1.212" },
+          harness: CLAUDE4,
+          testedVersions: { minimum: "2.0.0", maximum: "2.1.251" },
           verificationTier: "canary"
         },
         {
@@ -13648,7 +13714,7 @@ var init_rtk = __esm({
       },
       delegatedInstallReviews: null
     };
-    TESTED_VERSIONS2 = { minimum: "0.40.0", maximum: "0.44.0" };
+    TESTED_VERSIONS2 = { minimum: "0.44.0", maximum: "0.48.0" };
     VERSION_PATTERN7 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
     HOOK_COMMAND_PATTERN2 = /(^|[\\/\s"'])rtk(\.exe)?([\s"']|$)/i;
     PLUGIN_MODULE_PATTERN3 = /(^|[\\/])rtk\.(ts|js|mjs|cjs|mts|cts)$/i;
@@ -13679,7 +13745,7 @@ var init_contract2 = __esm({
 function listProviderAdapters() {
   return PROVIDER_ADAPTERS;
 }
-var PROVIDER_ADAPTERS;
+var cliHarnessTrimAdapter, PROVIDER_ADAPTERS;
 var init_providers = __esm({
   "packages/adapters/dist/src/providers/index.js"() {
     "use strict";
@@ -13688,7 +13754,18 @@ var init_providers = __esm({
     init_contract2();
     init_rtk();
     init_harnesstrim();
-    PROVIDER_ADAPTERS = [rtkAdapter, harnesstrimAdapter];
+    cliHarnessTrimAdapter = {
+      ...harnesstrimAdapter,
+      plansWithoutOwnership: false,
+      plan: (context, request) => {
+        const ownedHarnesses = new Set(request.ownership.map((entry) => entry.scope.harness));
+        return harnesstrimAdapter.plan(context, {
+          ...request,
+          harnesses: request.harnesses.filter((harness) => ownedHarnesses.has(harness.id))
+        });
+      }
+    };
+    PROVIDER_ADAPTERS = [rtkAdapter, cliHarnessTrimAdapter];
   }
 });
 
@@ -13787,15 +13864,15 @@ async function runBudget(context) {
     diagnostics: report.harnesses.flatMap((item) => item.diagnostics)
   });
 }
-var CLAUDE4, CODEX3, BUDGET_HARNESSES;
+var CLAUDE5, CODEX3, BUDGET_HARNESSES;
 var init_budget2 = __esm({
   "apps/cli/dist/src/commands/budget.js"() {
     "use strict";
     init_src3();
     init_src();
-    CLAUDE4 = harnessId("claude");
+    CLAUDE5 = harnessId("claude");
     CODEX3 = harnessId("codex");
-    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE4, CODEX3]);
+    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE5, CODEX3]);
   }
 });
 
@@ -14048,6 +14125,7 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
     profile: null,
     reservePercent: null,
     nativePolicy: false,
+    verbose: false,
     yes: false
   };
   let command = null;
@@ -14083,6 +14161,8 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
         options.yes = true;
       if (name === "--native-policy")
         options.nativePolicy = true;
+      if (name === "--verbose")
+        options.verbose = true;
       continue;
     }
     if (!VALUE_FLAGS.has(name)) {
@@ -14096,8 +14176,8 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
     }
     let value3 = inlineValue;
     if (value3 === null) {
-      const next = argv2[index + 1];
-      if (next === void 0 || next.startsWith("-")) {
+      const next2 = argv2[index + 1];
+      if (next2 === void 0 || next2.startsWith("-")) {
         diagnostics.push(diagnostic({
           severity: "error",
           code: "flag-missing-value",
@@ -14106,7 +14186,7 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
         }));
         continue;
       }
-      value3 = next;
+      value3 = next2;
       index += 1;
     }
     if (value3 === "") {
@@ -14324,6 +14404,7 @@ var init_argv = __esm({
       "optimize",
       "plan",
       "rollback",
+      "setup",
       "status",
       "uninstall",
       "update",
@@ -14348,7 +14429,7 @@ var init_argv = __esm({
       "--profile",
       "--reserve"
     ]);
-    BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--json", "--native-policy", "--yes"]);
+    BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--json", "--native-policy", "--verbose", "--yes"]);
   }
 });
 
@@ -14494,7 +14575,7 @@ async function claudeInstructionFiles(context) {
   const results = [];
   for (const candidate of candidates) {
     const item = await fileObservation(context, {
-      harnessId: CLAUDE5,
+      harnessId: CLAUDE6,
       path: candidate.path,
       scope: candidate.scope,
       loadedBytes: null
@@ -14565,7 +14646,7 @@ async function runContext(context) {
   if (codex !== void 0 && codex.state !== "absent") {
     report.instructions.push(...await codexInstructionFiles(context, codex));
   }
-  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE5);
+  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE6);
   if (claude !== void 0 && claude.state !== "absent") {
     report.instructions.push(...await claudeInstructionFiles(context));
   }
@@ -14611,15 +14692,15 @@ async function runContext(context) {
     diagnostics: [...report.harnesses.flatMap((item) => item.diagnostics), ...hierarchyDiagnostics]
   });
 }
-var CLAUDE5, CODEX4, CONTEXT_HARNESSES;
+var CLAUDE6, CODEX4, CONTEXT_HARNESSES;
 var init_context_cost2 = __esm({
   "apps/cli/dist/src/commands/context-cost.js"() {
     "use strict";
     init_src3();
     init_src();
-    CLAUDE5 = harnessId("claude");
+    CLAUDE6 = harnessId("claude");
     CODEX4 = harnessId("codex");
-    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE5, CODEX4]);
+    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE6, CODEX4]);
   }
 });
 
@@ -14640,7 +14721,7 @@ function stringArray(value3) {
   return array(value3).filter((item) => typeof item === "string");
 }
 function normalizedHarness(value3) {
-  return value3 === "claude" ? CLAUDE6 : value3 === "codex" ? CODEX5 : null;
+  return value3 === "claude" ? CLAUDE7 : value3 === "codex" ? CODEX5 : null;
 }
 function totals(row2) {
   const inputTokens = number(row2["inputTokens"]);
@@ -14948,7 +15029,7 @@ async function runHistory(context) {
   const filterHarness = context.harness;
   const daily = dailyRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => left.period.localeCompare(right.period));
   const sessions = sessionRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => (left.lastActivity ?? "").localeCompare(right.lastActivity ?? ""));
-  const harnesses = [CLAUDE6, CODEX5].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
+  const harnesses = [CLAUDE7, CODEX5].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
   const report = {
     ...blankReport(context, window.windowStart, window.windowEnd, "available", version3, []),
     daily,
@@ -14961,15 +15042,15 @@ async function runHistory(context) {
     data: report
   });
 }
-var SUPPORTED_CCUSAGE_MAJOR, CLAUDE6, CODEX5, HISTORY_HARNESSES;
+var SUPPORTED_CCUSAGE_MAJOR, CLAUDE7, CODEX5, HISTORY_HARNESSES;
 var init_history2 = __esm({
   "apps/cli/dist/src/commands/history.js"() {
     "use strict";
     init_src();
     SUPPORTED_CCUSAGE_MAJOR = 20;
-    CLAUDE6 = harnessId("claude");
+    CLAUDE7 = harnessId("claude");
     CODEX5 = harnessId("codex");
-    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE6, CODEX5]);
+    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE7, CODEX5]);
   }
 });
 
@@ -16473,7 +16554,7 @@ async function runBenchmarkFinish(context) {
     diagnostics: [...budgetResult.diagnostics, ...historyResult.diagnostics]
   });
 }
-var CLAUDE7, CODEX7, CAPTURE_HARNESSES;
+var CLAUDE8, CODEX7, CAPTURE_HARNESSES;
 var init_benchmark_capture = __esm({
   "apps/cli/dist/src/commands/benchmark-capture.js"() {
     "use strict";
@@ -16481,9 +16562,9 @@ var init_benchmark_capture = __esm({
     init_budget2();
     init_context_cost2();
     init_history2();
-    CLAUDE7 = harnessId("claude");
+    CLAUDE8 = harnessId("claude");
     CODEX7 = harnessId("codex");
-    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE7, CODEX7]);
+    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE8, CODEX7]);
   }
 });
 
@@ -17363,118 +17444,484 @@ var init_rollback = __esm({
   }
 });
 
-// apps/cli/dist/src/commands/update.js
-function transactionIdFor2(seed, at) {
-  const digest = digestText(`${seed} ${at}`);
-  return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 13);
-}
-function emptyExecution(outcome2) {
-  return {
-    planId: null,
-    transactionId: null,
-    fromStoredPlan: false,
-    outcome: outcome2,
-    results: [],
-    unrestored: [],
-    receiptId: null
+// apps/cli/dist/src/commands/verify.js
+async function runVerify(context) {
+  const diagnostics = [];
+  const results = [];
+  if (context.adapters === null) {
+    return commandResult({
+      command: "verify",
+      exitCode: EXIT_CODES.ok,
+      data: { receiptId: null, appliedAt: null, results: [], healthyAtDeclaredTier: true },
+      diagnostics: [
+        diagnostic({
+          severity: "info",
+          code: "nothing-to-verify",
+          message: "No harness was inspected, so there is nothing to verify",
+          remediation: null
+        })
+      ]
+    });
+  }
+  const detectionContext = {
+    fs: context.adapters.fs,
+    runner: context.adapters.runner,
+    facts: context.platform,
+    paths: context.adapters.paths,
+    projectRoot: context.projectRoot
+  };
+  const harnessConfigs = [];
+  const presentHarnesses = [];
+  for (const adapter of listHarnessAdapters()) {
+    if (context.harness !== null && adapter.manifest.id !== context.harness)
+      continue;
+    const detection = await adapter.detect(detectionContext);
+    if (detection.state === "absent")
+      continue;
+    presentHarnesses.push(adapter.manifest.id);
+    const verification = await adapter.verify(detectionContext);
+    for (const check of verification.checks) {
+      if (check.status === "pass")
+        continue;
+      diagnostics.push(diagnostic({
+        severity: check.status === "fail" ? "warning" : "info",
+        code: `harness-${check.id}`,
+        message: `${adapter.manifest.displayName}: ${check.summary}`,
+        remediation: check.remediation
+      }));
+    }
+    const inspection = await adapter.inspect(detectionContext);
+    harnessConfigs.push(...inspection.summaries);
+    diagnostics.push(...inspection.diagnostics);
+  }
+  const managedIntegrations2 = await readManagedIntegrations(context);
+  const providerContext = {
+    ...detectionContext,
+    harnessConfigs,
+    now: context.now,
+    localDatabase: context.adapters.localDatabase,
+    projectIdFor: context.adapters.projectIdFor
+  };
+  for (const adapter of listProviderAdapters()) {
+    if (context.provider !== null && adapter.manifest.id !== context.provider)
+      continue;
+    const detection = await adapter.detect(providerContext);
+    if (detection.state === "absent")
+      continue;
+    const verification = await adapter.verify(providerContext);
+    diagnostics.push(...verification.diagnostics);
+    const harnesses = detection.configuredHarnesses.length > 0 ? detection.configuredHarnesses : (
+      // Installed but wired to nothing: still worth a row, on every present harness, because
+      // "installed and not connected here" is the finding.
+      presentHarnesses
+    );
+    for (const harnessId2 of harnesses) {
+      const declaredTier = adapter.manifest.harnesses.find((entry) => entry.harness === harnessId2)?.verificationTier ?? verification.declaredTier;
+      results.push({
+        providerId: adapter.manifest.id,
+        harnessId: harnessId2,
+        status: statusFor(verification.achievedTier, declaredTier),
+        declaredTier,
+        managedByTokenHarness: managedIntegrations2.has(`${adapter.manifest.id}\0${harnessId2}`),
+        providerManagedByTokenHarness: detection.managedByTokenHarness,
+        checks: verification.checks
+      });
+    }
+  }
+  const receipts = context.metrics === null ? [] : await readReceipts(context);
+  const latest = receipts[0] ?? null;
+  const failures = results.flatMap((result2) => result2.checks.filter(contributesToProblems));
+  const report = {
+    receiptId: latest?.receiptId ?? null,
+    appliedAt: latest?.appliedAt ?? null,
+    results,
+    healthyAtDeclaredTier: failures.length === 0
   };
+  return commandResult({
+    command: "verify",
+    exitCode: failures.length === 0 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+    data: report,
+    diagnostics
+  });
 }
-async function managedIntegrations(context) {
-  const empty2 = { integrations: [], legacyOwnershipUnknown: false };
+async function readManagedIntegrations(context) {
+  const managed = /* @__PURE__ */ new Set();
   if (context.adapters === null || context.stateRoot === null)
-    return empty2;
+    return managed;
   const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
   if (await context.adapters.fs.stat(journalRoot) === null)
-    return empty2;
+    return managed;
+  const projectId = context.adapters.projectIdFor(context.projectRoot);
   const store = new FileJournalStore({
     fs: context.adapters.fs,
     journalRoot,
     backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
   });
-  const seen = /* @__PURE__ */ new Set();
-  const result2 = [];
-  let legacyOwnershipUnknown = false;
   for (const journal of await store.list()) {
-    if (journal.outcome !== "committed")
+    if (journal.outcome !== "committed" || journal.projectId !== projectId)
       continue;
-    if (journal.managedIntegrations === void 0 && journal.ownership.length > 0) {
-      legacyOwnershipUnknown = true;
-    }
     for (const integration of journal.managedIntegrations ?? []) {
-      const key = `${integration.providerId}\0${integration.harnessId}`;
-      if (seen.has(key))
-        continue;
-      seen.add(key);
-      result2.push(integration);
+      managed.add(`${integration.providerId}\0${integration.harnessId}`);
     }
   }
-  return { integrations: result2, legacyOwnershipUnknown };
-}
-function upgradeAction(input) {
-  const digest = digestText(`${input.providerId} update ${input.channel} ${input.target}`);
-  return {
-    kind: "package-manager-install",
-    id: digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 9),
-    // The same class the install action uses, for the same reason: an installed package is not
-    // reversed by restoring a file.
-    riskClass: "delegated",
-    requiresNetwork: input.requiresNetwork,
-    requiresElevation: input.requiresElevation,
-    affectedPaths: [],
-    affectedProcesses: [input.channel],
-    preconditions: [
-      `${input.channel} is available on this machine`,
-      `${input.packageName} is installed at ${input.installed}`
-    ],
-    postconditions: [`${input.packageName} reports ${input.target}`],
-    /**
-     * `package-inventory` where the channel can report what is installed, `none` otherwise.
-     *
-     * An update replaces a binary. Rolling the transaction back restores files and leaves the new
-     * version in place, so the executor's receipt is not boilerplate here — it is the difference
-     * between the machine being restored and the *configuration* being restored. With an
-     * inventory-capturing channel the rollback also reinstalls the previous version, and the
-     * receipt says per package whether that reinstall took.
-     */
-    rollbackData: channelCanReportInventory(input.channel) ? "package-inventory" : "none",
-    explanation: `Update ${input.packageName} from ${input.installed} to ${input.target} through ${input.channel}`,
-    packageManager: input.channel,
-    packageName: input.packageName,
-    // Pinned to the exact version the channel reported, not left open. An unpinned upgrade would
-    // install whatever is newest at execution time, which is not the version the dry run showed.
-    version: input.target
-  };
+  return managed;
 }
-async function runUpdate(context) {
-  const diagnostics = [];
-  const report = { providers: [], network: [], execution: null };
-  const finish3 = (exitCode, data) => commandResult({
-    command: "update",
-    exitCode,
-    // RFC 0006: `data` is null when the status is `error`, and the human renderer must read the
-    // same object it serializes — the defect `apply` already had to fix.
-    data: statusForExitCode(exitCode) === "error" ? null : data,
-    diagnostics
-  });
-  if (context.adapters === null) {
-    diagnostics.push(diagnostic({
-      severity: "error",
-      code: "unsupported-environment",
-      message: "No platform adapters are available, so no channel can be consulted",
-      remediation: null
-    }));
-    return finish3(EXIT_CODES["unsupported-environment"], null);
+async function readReceipts(context) {
+  const store = context.metrics;
+  if (store?.listReceipts === void 0)
+    return [];
+  try {
+    return await store.listReceipts();
+  } catch {
+    return [];
   }
-  const adapters = context.adapters;
-  const providerAdapters = listProviderAdapters().filter((adapter) => context.provider === null || adapter.manifest.id === context.provider);
-  const managedState = await managedIntegrations(context);
-  const managed = managedState.integrations;
-  const managedHarnessIds = new Set(managed.map((entry) => entry.harnessId));
-  const harnessVersions = /* @__PURE__ */ new Map();
-  if (managedHarnessIds.size > 0) {
-    const harnessContext = {
-      fs: adapters.fs,
-      runner: adapters.runner,
+}
+function statusFor(achieved, declared) {
+  const order = ["presence", "config-only", "canary", "live-receipt"];
+  if (achieved === null)
+    return "not-applicable";
+  const reached = order.indexOf(achieved);
+  const promised = order.indexOf(declared);
+  if (reached < 0 || promised < 0)
+    return "not-applicable";
+  return reached >= promised ? "healthy" : "degraded";
+}
+var init_verify = __esm({
+  "apps/cli/dist/src/commands/verify.js"() {
+    "use strict";
+    init_src3();
+    init_src();
+  }
+});
+
+// apps/cli/dist/src/commands/setup.js
+function uniqueDiagnostics(groups) {
+  const seen = /* @__PURE__ */ new Set();
+  return groups.flatMap((group) => group.filter((entry) => {
+    const key = `${entry.severity}\0${entry.code}\0${entry.message}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  }));
+}
+async function runSetup(context, operations = DEFAULT_OPERATIONS) {
+  const doctor = await operations.doctor(context);
+  const detectedHarnesses = (doctor.data?.harnesses ?? []).filter((harness) => harness.state !== "absent" && (context.harness !== null ? harness.harnessId === context.harness : harness.harnessId === "claude" || harness.harnessId === "codex"));
+  const baseDoctor = doctor.data;
+  if (baseDoctor === null) {
+    return commandResult({
+      command: "setup",
+      exitCode: doctor.exitCode,
+      diagnostics: doctor.diagnostics
+    });
+  }
+  if (detectedHarnesses.length === 0) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES.ok,
+      data: {
+        stage: "needs-harness",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: null,
+          description: "Install and sign in to Claude Code or Codex, then run setup again."
+        }
+      },
+      diagnostics: doctor.diagnostics
+    });
+  }
+  if (doctor.exitCode !== EXIT_CODES.ok || baseDoctor.problemCount > 0) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES["problems-found"],
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness doctor --verbose",
+          description: "Review the detected problem before changing configuration."
+        }
+      },
+      diagnostics: doctor.diagnostics
+    });
+  }
+  const presentIds = new Set(detectedHarnesses.map((harness) => harness.harnessId));
+  const hasActiveProvider = baseDoctor.providers.some((provider) => provider.state === "configured" && provider.configuredHarnesses.some((harness) => presentIds.has(harness)));
+  if (hasActiveProvider) {
+    const activeHarness = context.harness ?? detectedHarnesses.find((harness) => baseDoctor.providers.some((provider) => provider.configuredHarnesses.includes(harness.harnessId)))?.harnessId ?? null;
+    const observationContext = { ...context, harness: activeHarness };
+    const [verify9, budget2] = await Promise.all([
+      operations.verify(observationContext),
+      operations.budget(observationContext)
+    ]);
+    const healthy2 = verify9.data?.healthyAtDeclaredTier === true;
+    return commandResult({
+      command: "setup",
+      exitCode: healthy2 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+      data: {
+        stage: healthy2 ? "ready" : "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: verify9.data,
+        budget: budget2.data,
+        nextStep: healthy2 ? {
+          command: "token-harness ui",
+          description: "Open the dashboard to see status, allowance, and advice."
+        } : {
+          command: "token-harness verify --verbose",
+          description: "Review the failed integration check."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, verify9.diagnostics, budget2.diagnostics])
+    });
+  }
+  const preferredHarness = context.harness ?? detectedHarnesses.find((harness) => harness.harnessId === "codex")?.harnessId ?? detectedHarnesses[0]?.harnessId ?? null;
+  const setupContext = { ...context, harness: preferredHarness };
+  const plan3 = await operations.plan(setupContext);
+  if (plan3.data === null || plan3.exitCode !== EXIT_CODES.ok || plan3.data.actions.length === 0 || !plan3.data.persisted) {
+    return commandResult({
+      command: "setup",
+      exitCode: plan3.exitCode === EXIT_CODES.ok ? EXIT_CODES["problems-found"] : plan3.exitCode,
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness plan --verbose",
+          description: "Review why no safe automatic configuration is available."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics])
+    });
+  }
+  if (!context.confirmed) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES.ok,
+      data: {
+        stage: "ready-to-configure",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness setup --yes",
+          description: "Apply the reviewed, reversible configuration."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics])
+    });
+  }
+  const applied = await operations.apply({
+    ...setupContext,
+    planId: plan3.data.planId,
+    confirmed: true
+  });
+  if (applied.data?.outcome !== "committed" && applied.data?.outcome !== "nothing-to-do") {
+    return commandResult({
+      command: "setup",
+      exitCode: applied.exitCode,
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: applied.data,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness verify --verbose",
+          description: "Review the configuration result before continuing."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics, applied.diagnostics])
+    });
+  }
+  const [verify8, budget] = await Promise.all([
+    operations.verify(setupContext),
+    operations.budget(setupContext)
+  ]);
+  const healthy = verify8.data?.healthyAtDeclaredTier === true;
+  const changed = applied.data?.results.some((result2) => result2.status === "applied") === true;
+  return commandResult({
+    command: "setup",
+    exitCode: healthy ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+    data: {
+      stage: healthy ? "ready" : "attention",
+      changed,
+      doctor: baseDoctor,
+      plan: plan3.data,
+      apply: applied.data,
+      verify: verify8.data,
+      budget: budget.data,
+      nextStep: healthy ? {
+        command: "token-harness ui",
+        description: "Open the dashboard to see status, allowance, and advice."
+      } : {
+        command: "token-harness verify --verbose",
+        description: "Review the failed integration check."
+      }
+    },
+    diagnostics: uniqueDiagnostics([
+      doctor.diagnostics,
+      plan3.diagnostics,
+      applied.diagnostics,
+      verify8.diagnostics,
+      budget.diagnostics
+    ])
+  });
+}
+var DEFAULT_OPERATIONS;
+var init_setup2 = __esm({
+  "apps/cli/dist/src/commands/setup.js"() {
+    "use strict";
+    init_src();
+    init_apply();
+    init_budget2();
+    init_doctor();
+    init_plan2();
+    init_verify();
+    DEFAULT_OPERATIONS = {
+      doctor: runDoctor,
+      plan: runPlan,
+      apply: runApply,
+      verify: runVerify,
+      budget: runBudget
+    };
+  }
+});
+
+// apps/cli/dist/src/commands/update.js
+function transactionIdFor2(seed, at) {
+  const digest = digestText(`${seed} ${at}`);
+  return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 13);
+}
+function emptyExecution(outcome2) {
+  return {
+    planId: null,
+    transactionId: null,
+    fromStoredPlan: false,
+    outcome: outcome2,
+    results: [],
+    unrestored: [],
+    receiptId: null
+  };
+}
+async function managedIntegrations(context) {
+  const empty2 = { integrations: [], legacyOwnershipUnknown: false };
+  if (context.adapters === null || context.stateRoot === null)
+    return empty2;
+  const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
+  if (await context.adapters.fs.stat(journalRoot) === null)
+    return empty2;
+  const store = new FileJournalStore({
+    fs: context.adapters.fs,
+    journalRoot,
+    backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const result2 = [];
+  let legacyOwnershipUnknown = false;
+  for (const journal of await store.list()) {
+    if (journal.outcome !== "committed")
+      continue;
+    if (journal.managedIntegrations === void 0 && journal.ownership.length > 0) {
+      legacyOwnershipUnknown = true;
+    }
+    for (const integration of journal.managedIntegrations ?? []) {
+      const key = `${integration.providerId}\0${integration.harnessId}`;
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      result2.push(integration);
+    }
+  }
+  return { integrations: result2, legacyOwnershipUnknown };
+}
+function upgradeAction(input) {
+  const digest = digestText(`${input.providerId} update ${input.channel} ${input.target}`);
+  return {
+    kind: "package-manager-install",
+    id: digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 9),
+    // The same class the install action uses, for the same reason: an installed package is not
+    // reversed by restoring a file.
+    riskClass: "delegated",
+    requiresNetwork: input.requiresNetwork,
+    requiresElevation: input.requiresElevation,
+    affectedPaths: [],
+    affectedProcesses: [input.channel],
+    preconditions: [
+      `${input.channel} is available on this machine`,
+      `${input.packageName} is installed at ${input.installed}`
+    ],
+    postconditions: [`${input.packageName} reports ${input.target}`],
+    /**
+     * `package-inventory` where the channel can report what is installed, `none` otherwise.
+     *
+     * An update replaces a binary. Rolling the transaction back restores files and leaves the new
+     * version in place, so the executor's receipt is not boilerplate here — it is the difference
+     * between the machine being restored and the *configuration* being restored. With an
+     * inventory-capturing channel the rollback also reinstalls the previous version, and the
+     * receipt says per package whether that reinstall took.
+     */
+    rollbackData: channelCanReportInventory(input.channel) ? "package-inventory" : "none",
+    explanation: `Update ${input.packageName} from ${input.installed} to ${input.target} through ${input.channel}`,
+    packageManager: input.channel,
+    packageName: input.packageName,
+    // Pinned to the exact version the channel reported, not left open. An unpinned upgrade would
+    // install whatever is newest at execution time, which is not the version the dry run showed.
+    version: input.target
+  };
+}
+async function runUpdate(context) {
+  const diagnostics = [];
+  const report = { providers: [], network: [], execution: null };
+  const finish3 = (exitCode, data) => commandResult({
+    command: "update",
+    exitCode,
+    // RFC 0006: `data` is null when the status is `error`, and the human renderer must read the
+    // same object it serializes — the defect `apply` already had to fix.
+    data: statusForExitCode(exitCode) === "error" ? null : data,
+    diagnostics
+  });
+  if (context.adapters === null) {
+    diagnostics.push(diagnostic({
+      severity: "error",
+      code: "unsupported-environment",
+      message: "No platform adapters are available, so no channel can be consulted",
+      remediation: null
+    }));
+    return finish3(EXIT_CODES["unsupported-environment"], null);
+  }
+  const adapters = context.adapters;
+  const providerAdapters = listProviderAdapters().filter((adapter) => context.provider === null || adapter.manifest.id === context.provider);
+  const managedState = await managedIntegrations(context);
+  const managed = managedState.integrations;
+  const managedHarnessIds = new Set(managed.map((entry) => entry.harnessId));
+  const harnessVersions = /* @__PURE__ */ new Map();
+  if (managedHarnessIds.size > 0) {
+    const harnessContext = {
+      fs: adapters.fs,
+      runner: adapters.runner,
       facts: context.platform,
       paths: adapters.paths,
       projectRoot: context.projectRoot
@@ -17654,210 +18101,60 @@ async function runUpdate(context) {
     }));
     return finish3(EXIT_CODES["unsupported-environment"], null);
   }
-  const fs = adapters.fs;
-  const startedAt = context.now();
-  const transactionId = transactionIdFor2(actions.map((action) => action.id).join(" "), startedAt);
-  const creation = TransactionSnapshotStore.create({
-    fs,
-    backupRoot: fs.join(context.stateRoot, "backups"),
-    transactionId,
-    projectRoot: context.projectRoot,
-    now: context.now
-  });
-  if (!creation.ok) {
-    diagnostics.push(...creation.diagnostics);
-    return finish3(EXIT_CODES["unsupported-environment"], null);
-  }
-  const transaction = await executeTransaction({
-    transactionId,
-    planId: null,
-    projectId: adapters.projectIdFor(context.projectRoot),
-    projectRoot: context.projectRoot,
-    actions,
-    fs,
-    snapshots: creation.store,
-    journal: new FileJournalStore({
-      fs,
-      journalRoot: fs.join(context.stateRoot, "journals"),
-      backupRoot: fs.join(context.stateRoot, "backups")
-    }),
-    runner: adapters.runner,
-    now: context.now
-  });
-  diagnostics.push(...transaction.diagnostics);
-  report.execution = {
-    planId: null,
-    transactionId,
-    fromStoredPlan: false,
-    // Mapped the way `apply` maps it: `in-progress` is not a terminal outcome a report may
-    // carry, and anything that is not one of the three known ends is a rejection.
-    outcome: transaction.journal.outcome === "committed" ? "committed" : transaction.journal.outcome === "rolled-back" ? "rolled-back" : transaction.journal.outcome === "dirty" ? "dirty" : "rejected",
-    results: transaction.journal.entries.map((entry) => ({
-      actionId: entry.actionId,
-      kind: entry.kind,
-      status: entry.status,
-      path: null
-    })),
-    unrestored: transaction.unrestored,
-    receiptId: transaction.journal.outcome === "committed" ? transactionId : null
-  };
-  return finish3(transaction.exitCode, report);
-}
-var init_update = __esm({
-  "apps/cli/dist/src/commands/update.js"() {
-    "use strict";
-    init_src();
-    init_src3();
-  }
-});
-
-// apps/cli/dist/src/commands/verify.js
-async function runVerify(context) {
-  const diagnostics = [];
-  const results = [];
-  if (context.adapters === null) {
-    return commandResult({
-      command: "verify",
-      exitCode: EXIT_CODES.ok,
-      data: { receiptId: null, appliedAt: null, results: [], healthyAtDeclaredTier: true },
-      diagnostics: [
-        diagnostic({
-          severity: "info",
-          code: "nothing-to-verify",
-          message: "No harness was inspected, so there is nothing to verify",
-          remediation: null
-        })
-      ]
-    });
-  }
-  const detectionContext = {
-    fs: context.adapters.fs,
-    runner: context.adapters.runner,
-    facts: context.platform,
-    paths: context.adapters.paths,
-    projectRoot: context.projectRoot
-  };
-  const harnessConfigs = [];
-  const presentHarnesses = [];
-  for (const adapter of listHarnessAdapters()) {
-    if (context.harness !== null && adapter.manifest.id !== context.harness)
-      continue;
-    const detection = await adapter.detect(detectionContext);
-    if (detection.state === "absent")
-      continue;
-    presentHarnesses.push(adapter.manifest.id);
-    const verification = await adapter.verify(detectionContext);
-    for (const check of verification.checks) {
-      if (check.status === "pass")
-        continue;
-      diagnostics.push(diagnostic({
-        severity: check.status === "fail" ? "warning" : "info",
-        code: `harness-${check.id}`,
-        message: `${adapter.manifest.displayName}: ${check.summary}`,
-        remediation: check.remediation
-      }));
-    }
-    const inspection = await adapter.inspect(detectionContext);
-    harnessConfigs.push(...inspection.summaries);
-    diagnostics.push(...inspection.diagnostics);
-  }
-  const managedIntegrations2 = await readManagedIntegrations(context);
-  const providerContext = {
-    ...detectionContext,
-    harnessConfigs,
-    now: context.now,
-    localDatabase: context.adapters.localDatabase,
-    projectIdFor: context.adapters.projectIdFor
-  };
-  for (const adapter of listProviderAdapters()) {
-    if (context.provider !== null && adapter.manifest.id !== context.provider)
-      continue;
-    const detection = await adapter.detect(providerContext);
-    if (detection.state === "absent")
-      continue;
-    const verification = await adapter.verify(providerContext);
-    diagnostics.push(...verification.diagnostics);
-    const harnesses = detection.configuredHarnesses.length > 0 ? detection.configuredHarnesses : (
-      // Installed but wired to nothing: still worth a row, on every present harness, because
-      // "installed and not connected here" is the finding.
-      presentHarnesses
-    );
-    for (const harnessId2 of harnesses) {
-      const declaredTier = adapter.manifest.harnesses.find((entry) => entry.harness === harnessId2)?.verificationTier ?? verification.declaredTier;
-      results.push({
-        providerId: adapter.manifest.id,
-        harnessId: harnessId2,
-        status: statusFor(verification.achievedTier, declaredTier),
-        declaredTier,
-        managedByTokenHarness: managedIntegrations2.has(`${adapter.manifest.id}\0${harnessId2}`),
-        providerManagedByTokenHarness: detection.managedByTokenHarness,
-        checks: verification.checks
-      });
-    }
-  }
-  const receipts = context.metrics === null ? [] : await readReceipts(context);
-  const latest = receipts[0] ?? null;
-  const failures = results.flatMap((result2) => result2.checks.filter(contributesToProblems));
-  const report = {
-    receiptId: latest?.receiptId ?? null,
-    appliedAt: latest?.appliedAt ?? null,
-    results,
-    healthyAtDeclaredTier: failures.length === 0
-  };
-  return commandResult({
-    command: "verify",
-    exitCode: failures.length === 0 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
-    data: report,
-    diagnostics
-  });
-}
-async function readManagedIntegrations(context) {
-  const managed = /* @__PURE__ */ new Set();
-  if (context.adapters === null || context.stateRoot === null)
-    return managed;
-  const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
-  if (await context.adapters.fs.stat(journalRoot) === null)
-    return managed;
-  const projectId = context.adapters.projectIdFor(context.projectRoot);
-  const store = new FileJournalStore({
-    fs: context.adapters.fs,
-    journalRoot,
-    backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
-  });
-  for (const journal of await store.list()) {
-    if (journal.outcome !== "committed" || journal.projectId !== projectId)
-      continue;
-    for (const integration of journal.managedIntegrations ?? []) {
-      managed.add(`${integration.providerId}\0${integration.harnessId}`);
-    }
-  }
-  return managed;
-}
-async function readReceipts(context) {
-  const store = context.metrics;
-  if (store?.listReceipts === void 0)
-    return [];
-  try {
-    return await store.listReceipts();
-  } catch {
-    return [];
+  const fs = adapters.fs;
+  const startedAt = context.now();
+  const transactionId = transactionIdFor2(actions.map((action) => action.id).join(" "), startedAt);
+  const creation = TransactionSnapshotStore.create({
+    fs,
+    backupRoot: fs.join(context.stateRoot, "backups"),
+    transactionId,
+    projectRoot: context.projectRoot,
+    now: context.now
+  });
+  if (!creation.ok) {
+    diagnostics.push(...creation.diagnostics);
+    return finish3(EXIT_CODES["unsupported-environment"], null);
   }
+  const transaction = await executeTransaction({
+    transactionId,
+    planId: null,
+    projectId: adapters.projectIdFor(context.projectRoot),
+    projectRoot: context.projectRoot,
+    actions,
+    fs,
+    snapshots: creation.store,
+    journal: new FileJournalStore({
+      fs,
+      journalRoot: fs.join(context.stateRoot, "journals"),
+      backupRoot: fs.join(context.stateRoot, "backups")
+    }),
+    runner: adapters.runner,
+    now: context.now
+  });
+  diagnostics.push(...transaction.diagnostics);
+  report.execution = {
+    planId: null,
+    transactionId,
+    fromStoredPlan: false,
+    // Mapped the way `apply` maps it: `in-progress` is not a terminal outcome a report may
+    // carry, and anything that is not one of the three known ends is a rejection.
+    outcome: transaction.journal.outcome === "committed" ? "committed" : transaction.journal.outcome === "rolled-back" ? "rolled-back" : transaction.journal.outcome === "dirty" ? "dirty" : "rejected",
+    results: transaction.journal.entries.map((entry) => ({
+      actionId: entry.actionId,
+      kind: entry.kind,
+      status: entry.status,
+      path: null
+    })),
+    unrestored: transaction.unrestored,
+    receiptId: transaction.journal.outcome === "committed" ? transactionId : null
+  };
+  return finish3(transaction.exitCode, report);
 }
-function statusFor(achieved, declared) {
-  const order = ["presence", "config-only", "canary", "live-receipt"];
-  if (achieved === null)
-    return "not-applicable";
-  const reached = order.indexOf(achieved);
-  const promised = order.indexOf(declared);
-  if (reached < 0 || promised < 0)
-    return "not-applicable";
-  return reached >= promised ? "healthy" : "degraded";
-}
-var init_verify = __esm({
-  "apps/cli/dist/src/commands/verify.js"() {
+var init_update = __esm({
+  "apps/cli/dist/src/commands/update.js"() {
     "use strict";
-    init_src3();
     init_src();
+    init_src3();
   }
 });
 
@@ -18430,9 +18727,11 @@ function renderDoctorReport(report, context) {
     lines.push(...notable);
   }
   const unwired = report.providers.filter((provider) => provider.state !== "absent" && provider.configuredHarnesses.length === 0);
+  const installedProviders = report.providers.some((provider) => provider.state !== "absent");
   lines.push("");
   lines.push("NEXT");
   const suggestions = report.providers.every((provider) => provider.state === "absent") || unwired.length > 0 ? [["token-harness plan", "see what would change \u2014 writes nothing"]] : [
+    ...installedProviders ? [["token-harness update", "check RTK/HarnessTrim for newer versions"]] : [],
     ["token-harness verify", "check the pipeline actually intercepts"],
     ["token-harness metrics --since 7d", "see what it saved"]
   ];
@@ -19096,6 +19395,316 @@ var init_verify2 = __esm({
   }
 });
 
+// apps/cli/dist/src/render/simple.js
+function title(state) {
+  return [`TOKEN HARNESS - ${state.toUpperCase()}`, ""];
+}
+function next(command, description) {
+  return [
+    "",
+    "NEXT STEP",
+    command === null ? `  ${truncate(description, MAX_WIDTH - 2)}` : `  ${command}`,
+    ...command === null ? [] : [`  ${truncate(description, MAX_WIDTH - 2)}`]
+  ];
+}
+function changeLine(changed, detail2) {
+  return [
+    "",
+    "CHANGES",
+    `  ${changed ? detail2 ?? "Configuration changed." : "Nothing changed."}`
+  ];
+}
+function harnessName(id) {
+  if (id === "claude")
+    return "Claude Code";
+  if (id === "codex")
+    return "Codex";
+  if (id === "opencode")
+    return "OpenCode";
+  return id;
+}
+function renderSimpleDoctor(report) {
+  const present = report.harnesses.filter((item) => item.state !== "absent");
+  const active = report.providers.filter((item) => item.state === "configured" && item.configuredHarnesses.length > 0);
+  const state = report.problemCount > 0 ? "attention needed" : present.length > 0 ? "ready" : "setup needed";
+  const lines = [...title(state), "WHAT WORKS"];
+  if (present.length === 0)
+    lines.push("  No supported coding harness was found.");
+  for (const item of report.harnesses) {
+    const stateText = item.state === "absent" ? "not found" : item.state;
+    lines.push(`  ${harnessName(item.harnessId)}: ${stateText}${item.version ? ` (${item.version})` : ""}`);
+  }
+  if (report.providers.length === 0)
+    lines.push("  Providers: none detected");
+  for (const item of report.providers) {
+    const connected = item.configuredHarnesses.map(harnessName).join(", ");
+    lines.push(truncate(`  ${item.providerId}: ${connected === "" ? item.state : `active on ${connected}`}`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  if (report.problemCount > 0) {
+    lines.push(...next("token-harness doctor --verbose", "Review the technical findings."));
+  } else if (present.length === 0 || active.length === 0) {
+    lines.push(...next("token-harness setup", "Finish the guided setup."));
+  } else {
+    lines.push(...next("token-harness ui", "Open the dashboard."));
+  }
+  return document(lines);
+}
+function renderSimpleSetup(report, context) {
+  const state = report.stage === "ready" ? "ready" : report.stage === "attention" ? "attention needed" : "setup needed";
+  const lines = [...title(state), "DETECTED"];
+  const harnesses = report.doctor.harnesses.filter((item) => item.state !== "absent");
+  if (harnesses.length === 0)
+    lines.push("  Claude Code/Codex: not found");
+  for (const item of harnesses) {
+    lines.push(`  ${harnessName(item.harnessId)}: ${item.state}${item.version ? ` (${item.version})` : ""}`);
+  }
+  const active = report.doctor.providers.filter((item) => item.configuredHarnesses.length > 0);
+  if (active.length === 0)
+    lines.push("  Optimization provider: not active");
+  for (const provider of active) {
+    lines.push(truncate(`  ${provider.providerId}: active on ${provider.configuredHarnesses.map(harnessName).join(", ")}`, MAX_WIDTH));
+  }
+  if (report.plan !== null && report.apply === null && report.plan.actions.length > 0) {
+    lines.push("", "SAFE PLAN");
+    for (const action of report.plan.actions) {
+      const path = primaryActionPath(action);
+      lines.push(truncate(`  ${actionLabel(action.kind)}${path === null ? "" : ` - ${displayPath(path, context.home)}`}`, MAX_WIDTH));
+    }
+  }
+  lines.push(...changeLine(report.changed, report.apply?.results.some((item) => item.status === "applied") ? "Safe configuration applied and checked." : void 0));
+  lines.push(...next(report.nextStep.command, report.nextStep.description));
+  return document(lines);
+}
+function renderVerboseSetup(report, context) {
+  const lines = ["SETUP TECHNICAL DETAILS", "", "DETECTION"];
+  for (const harness of report.doctor.harnesses) {
+    lines.push(truncate(`  ${harness.harnessId}: state ${harness.state}, version ${harness.version ?? "unknown"}, verdict ${harness.versionVerdict ?? "unknown"}`, MAX_WIDTH));
+    if (harness.configPath !== null)
+      lines.push(truncate(`    config ${displayPath(harness.configPath, context.home)}`, MAX_WIDTH));
+  }
+  for (const provider of report.doctor.providers) {
+    lines.push(truncate(`  ${provider.providerId}: state ${provider.state}, version ${provider.version ?? "unknown"}, wired ${provider.configuredHarnesses.join(", ") || "none"}`, MAX_WIDTH));
+  }
+  if (report.plan !== null) {
+    lines.push("", `PLAN ${report.plan.planId ?? "not produced"}`);
+    lines.push(`  persisted: ${String(report.plan.persisted)}`);
+    lines.push(`  actions: ${report.plan.actions.length}`);
+    lines.push(`  conflicts: ${report.plan.conflicts.length}`);
+    for (const action of report.plan.actions) {
+      lines.push(truncate(`  ${action.id}: ${action.kind} - ${action.explanation}`, MAX_WIDTH));
+    }
+  }
+  if (report.apply !== null) {
+    lines.push("", `TRANSACTION ${report.apply.transactionId ?? "none"}`);
+    lines.push(`  outcome: ${report.apply.outcome}`);
+    for (const result2 of report.apply.results) {
+      lines.push(truncate(`  ${result2.actionId}: ${result2.status}`, MAX_WIDTH));
+    }
+  }
+  if (report.verify !== null) {
+    lines.push("", "VERIFICATION");
+    lines.push(`  healthy at declared tier: ${String(report.verify.healthyAtDeclaredTier)}`);
+    for (const result2 of report.verify.results) {
+      lines.push(`  ${result2.providerId} on ${result2.harnessId}: ${result2.status}`);
+      for (const check of result2.checks) {
+        lines.push(truncate(`    ${check.id}: ${check.status} - ${check.summary}`, MAX_WIDTH));
+      }
+    }
+  }
+  if (report.budget !== null) {
+    lines.push("", "ALLOWANCE SOURCES");
+    for (const harness of report.budget.harnesses) {
+      if (harness.windows.length === 0)
+        lines.push(`  ${harness.harnessId}: ${harness.state}`);
+      for (const window of harness.windows) {
+        lines.push(truncate(`  ${harness.harnessId}/${window.scope}: ${window.source}, ${window.confidence}`, MAX_WIDTH));
+      }
+    }
+  }
+  lines.push("", ...renderSimpleSetup(report, context).trimEnd().split("\n"));
+  return document(lines);
+}
+function formatReset(resetsAt) {
+  return resetsAt === null ? "reset unknown" : `resets ${resetsAt}`;
+}
+function renderSimpleBudget(report) {
+  const observed = report.harnesses.filter((item) => item.state === "observed");
+  const lines = [
+    ...title(observed.length > 0 ? "allowance available" : "allowance unavailable"),
+    "ALLOWANCE"
+  ];
+  for (const harness of report.harnesses) {
+    if (harness.windows.length === 0) {
+      lines.push(`  ${harnessName(harness.harnessId)}: ${harness.state}`);
+      continue;
+    }
+    for (const window of harness.windows) {
+      const label = window.bucketName ?? window.scope;
+      const remaining = window.remainingPercent === null ? "unknown" : `${window.remainingPercent}% left`;
+      lines.push(truncate(`  ${harnessName(harness.harnessId)} ${label}: ${remaining}, ${formatReset(window.resetsAt)}`, MAX_WIDTH));
+    }
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next(observed.length > 0 ? "token-harness optimize" : "token-harness setup", observed.length > 0 ? "See the best action for the current allowance." : "Check the local installation and connections."));
+  return document(lines);
+}
+function renderSimpleContext(report) {
+  const lines = [...title("context checked"), "CONTEXT"];
+  lines.push(`  Instruction files: ${report.instructions.length}`);
+  lines.push(`  Known loaded instructions: ${formatCount(report.knownLoadedInstructionBytes)} bytes`);
+  for (const harness of report.harnesses) {
+    lines.push(truncate(`  ${harnessName(harness.harnessId)}: ${harness.state}, model ${harness.model ?? "unknown"}, ${harness.mcpServers.length} MCP servers`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next("token-harness optimize", "Turn these observations into one recommendation."));
+  return document(lines);
+}
+function renderSimpleMcp(report) {
+  const attention = report.harnesses.some((harness) => harness.assessments.some((item) => item.usability === "attention"));
+  const lines = [...title(attention ? "attention needed" : "mcp checked"), "MCP"];
+  for (const harness of report.harnesses) {
+    lines.push(`  ${harnessName(harness.harnessId)}: ${harness.servers.length} servers, ${harness.knownToolCount} known tools`);
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next(attention ? "token-harness mcp --verbose" : "token-harness optimize", attention ? "Review the server that needs attention." : "See whether context can be simplified."));
+  return document(lines);
+}
+function renderSimpleOptimize(report) {
+  const advice = report.harnesses.filter((item) => item.state !== "absent");
+  const lines = [
+    ...title(advice.length > 0 ? "recommendation ready" : "setup needed"),
+    "RECOMMENDATION"
+  ];
+  if (advice.length === 0)
+    lines.push("  No supported harness could be assessed.");
+  for (const harness of advice) {
+    const recommendation = harness.recommendations.find((item) => item.priority === "first") ?? harness.recommendations[0];
+    lines.push(truncate(`  ${harnessName(harness.harnessId)}: ${recommendation?.action ?? "No change recommended."}`, MAX_WIDTH));
+    const evidence2 = recommendation?.evidence[0]?.summary;
+    if (evidence2)
+      lines.push(truncate(`    Why: ${evidence2}`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  const canPlan = advice.some((item) => item.recommendedEffort !== item.currentEffort || item.recommendedVerbosity !== item.currentVerbosity);
+  lines.push(...next(canPlan ? "token-harness plan --native-policy" : "token-harness ui", canPlan ? "Review the reversible recommended policy change." : "Keep the dashboard open for the next decision."));
+  return document(lines);
+}
+function renderSimplePlan(report, context) {
+  const lines = [
+    ...title(report.conflicts.length > 0 ? "blocked" : report.actions.length > 0 ? "plan ready" : "already configured")
+  ];
+  if (report.conflicts.length > 0) {
+    lines.push("BLOCKED BY");
+    for (const conflict of report.conflicts)
+      lines.push(truncate(`  ${conflict.code}: ${conflict.detail[0] ?? conflict.scope}`, MAX_WIDTH));
+  } else {
+    lines.push("WOULD CHANGE");
+    if (report.actions.length === 0)
+      lines.push("  Nothing.");
+    for (const action of report.actions) {
+      const path = primaryActionPath(action);
+      const shownPath = path === null ? "" : ` - ${truncatePath(displayPath(path, context.home), 34)}`;
+      lines.push(truncate(`  ${actionLabel(action.kind)}${shownPath}`, MAX_WIDTH));
+    }
+    lines.push(`  Network: ${report.network.length === 0 ? "none" : report.network.join(", ")}`);
+    lines.push(`  Backups: ${report.backups.files}`);
+  }
+  lines.push(...changeLine(false));
+  if (report.conflicts.length > 0)
+    lines.push(...next("token-harness plan --verbose", "Review the conflict and its safe resolution."));
+  else if (report.actions.length > 0 && report.persisted && report.planId !== null)
+    lines.push(...next(`token-harness apply --plan ${report.planId} --yes`, "Apply exactly this stored plan."));
+  else if (report.actions.length === 0)
+    lines.push(...next("token-harness setup", "Check detection and finish guided setup."));
+  else
+    lines.push(...next("token-harness ui", "Open the dashboard."));
+  return document(lines);
+}
+function renderSimpleApply(report, command) {
+  const changed = report.outcome === "committed" && report.results.some((item) => item.status === "applied");
+  const okay = report.outcome === "committed" || report.outcome === "nothing-to-do";
+  const lines = [...title(okay ? "complete" : report.outcome), "RESULT"];
+  const appliedCount = report.results.filter((item) => item.status === "applied").length;
+  lines.push(`  ${appliedCount} actions applied`);
+  if (command === "uninstall" && report.outcome === "committed" && appliedCount === 0) {
+    lines.push("  Removed nothing: no owned entry was recognised.");
+  }
+  lines.push(`  Transaction: ${report.transactionId ?? "none"}`);
+  lines.push(...changeLine(changed, command === "uninstall" ? "Owned configuration removed." : command === "rollback" ? "Previous configuration restored." : "Configuration applied and committed."));
+  const confirmationCommand = command === "apply" && report.planId !== null ? `token-harness apply --plan ${report.planId} --yes` : `token-harness ${command} --yes`;
+  lines.push(...next(okay ? "token-harness verify" : report.outcome === "confirmation-required" ? confirmationCommand : `token-harness ${command} --verbose`, okay ? "Check that the integration works." : report.outcome === "confirmation-required" ? "Apply the reviewed change." : "Review the technical result."));
+  return document(lines);
+}
+function renderSimpleVerify(report) {
+  const lines = [
+    ...title(report.healthyAtDeclaredTier ? "working" : "attention needed"),
+    "INTEGRATIONS"
+  ];
+  if (report.results.length === 0)
+    lines.push("  Nothing is configured to verify yet.");
+  for (const item of report.results)
+    lines.push(truncate(`  ${item.providerId} on ${harnessName(item.harnessId)}: ${item.status}`, MAX_WIDTH));
+  lines.push(...changeLine(false));
+  lines.push(...next(report.healthyAtDeclaredTier ? "token-harness ui" : "token-harness verify --verbose", report.healthyAtDeclaredTier ? "Open the dashboard." : "Review the failed check and suggested fix."));
+  return document(lines);
+}
+function renderSimpleStatus(report) {
+  const lines = [...title(report.problemCount === 0 ? "healthy" : "attention needed"), "ACTIVE"];
+  if (report.pipelines.length === 0)
+    lines.push("  No Token Harness pipeline is active.");
+  for (const pipeline of report.pipelines) {
+    const providers = [...new Set(pipeline.owners.map((owner) => owner.owner))];
+    lines.push(truncate(`  ${harnessName(pipeline.harness)}: ${providers.join(" -> ") || "no provider"}`, MAX_WIDTH));
+  }
+  lines.push(`  Drift: ${report.drift.length === 0 ? "none" : report.drift.length}`);
+  lines.push(...changeLine(false));
+  lines.push(...next(report.problemCount === 0 ? report.pipelines.length === 0 ? "token-harness setup" : "token-harness ui" : "token-harness status --verbose", report.problemCount === 0 ? report.pipelines.length === 0 ? "Finish the guided setup." : "Open the dashboard." : "Review the drift before making changes."));
+  return document(lines);
+}
+function renderSimpleMetrics(report) {
+  const lines = [...title("savings checked"), "SAVINGS"];
+  const measured = report.classes.filter((item) => item.saved !== null);
+  if (measured.length === 0)
+    lines.push("  No comparable savings recorded yet.");
+  for (const item of measured)
+    lines.push(`  ${item.class}: ${formatCount(item.saved ?? 0)} ${item.unit ?? ""} saved`);
+  lines.push(`  Errors: ${report.errors}`);
+  lines.push(...changeLine(false));
+  lines.push(...next("token-harness optimize", "Get the next evidence-based recommendation."));
+  return document(lines);
+}
+function renderSimpleHistory(report) {
+  const lines = [...title("history checked"), "LOCAL USAGE"];
+  if (report.harnesses.length === 0)
+    lines.push(`  ${report.source.name}: ${report.source.state}`);
+  for (const item of report.harnesses)
+    lines.push(`  ${harnessName(item.harnessId)}: ${formatCount(item.totalTokens)} tokens, trend ${item.burnTrend.state}`);
+  lines.push(...changeLine(false));
+  lines.push(...next("token-harness optimize", "Use the history in the next recommendation."));
+  return document(lines);
+}
+function renderSimpleUpdate(report) {
+  const execution = report.execution;
+  const changed = execution?.outcome === "committed" && execution.results.some((item) => item.status === "applied");
+  const lines = [...title(changed ? "updated" : "update checked"), "PROVIDERS"];
+  if (report.providers.length === 0)
+    lines.push("  No provider was detected.");
+  for (const item of report.providers)
+    lines.push(truncate(`  ${item.providerId}: ${item.verdict}`, MAX_WIDTH));
+  lines.push(...changeLine(changed, "Provider update applied."));
+  const pending = report.providers.some((item) => item.verdict === "upgradable");
+  lines.push(...next(pending && execution?.outcome === "confirmation-required" ? "token-harness update --yes" : "token-harness verify", pending && execution?.outcome === "confirmation-required" ? "Apply the reviewed provider update." : "Check that integrations still work."));
+  return document(lines);
+}
+var init_simple = __esm({
+  "apps/cli/dist/src/render/simple.js"() {
+    "use strict";
+    init_src();
+    init_layout();
+  }
+});
+
 // apps/cli/dist/src/render/index.js
 function planRendering(report, result2, context) {
   const conflictCodes = new Set(report.conflicts.map((conflict) => conflict.code));
@@ -19104,6 +19713,13 @@ function planRendering(report, result2, context) {
     stderrDiagnostics: result2.diagnostics.filter((entry) => !conflictCodes.has(entry.code))
   };
 }
+function planRenderingSimple(report, result2, context) {
+  const conflictCodes = new Set(report.conflicts.map((conflict) => conflict.code));
+  return {
+    report: renderSimplePlan(report, context),
+    stderrDiagnostics: result2.diagnostics.filter((entry) => !conflictCodes.has(entry.code))
+  };
+}
 function renderHuman(result2, context) {
   const data = result2.data;
   if (data === null)
@@ -19112,11 +19728,45 @@ function renderHuman(result2, context) {
     report,
     stderrDiagnostics: result2.diagnostics
   });
+  if (context.verbose !== true) {
+    switch (result2.command) {
+      case "apply":
+      case "rollback":
+      case "uninstall":
+        return plain(renderSimpleApply(data, result2.command));
+      case "budget":
+        return plain(renderSimpleBudget(data));
+      case "context":
+        return plain(renderSimpleContext(data));
+      case "doctor":
+        return plain(renderSimpleDoctor(data));
+      case "history":
+        return plain(renderSimpleHistory(data));
+      case "mcp":
+        return plain(renderSimpleMcp(data));
+      case "metrics":
+        return plain(renderSimpleMetrics(data));
+      case "optimize":
+        return plain(renderSimpleOptimize(data));
+      case "plan":
+        return planRenderingSimple(data, result2, context);
+      case "setup":
+        return plain(renderSimpleSetup(data, context));
+      case "status":
+        return plain(renderSimpleStatus(data));
+      case "update":
+        return plain(renderSimpleUpdate(data));
+      case "verify":
+        return plain(renderSimpleVerify(data));
+    }
+  }
   switch (result2.command) {
     case "apply":
     case "rollback":
     case "uninstall":
       return plain(renderApplyReport(data, context, result2.command));
+    case "setup":
+      return plain(renderVerboseSetup(data, context));
     case "benchmark":
       return plain(renderBenchmarkReport(data, context));
     case "benchmark-matrix":
@@ -19169,6 +19819,7 @@ var init_render = __esm({
     init_status2();
     init_update2();
     init_verify2();
+    init_simple();
     init_layout();
   }
 });
@@ -19181,81 +19832,65 @@ var ROOT_USAGE, COMMAND_USAGE;
 var init_usage = __esm({
   "apps/cli/dist/src/usage.js"() {
     "use strict";
-    ROOT_USAGE = `token-harness \u2014 maximize useful Claude Code and Codex subscription capacity
+    ROOT_USAGE = `token-harness \u2014 simple Claude Code and Codex efficiency
 
-First time here
-  1  token-harness doctor        what is on this machine        writes nothing
-  2  token-harness budget        quota remaining                writes nothing
-  3  token-harness context       static context cost            writes nothing
-  4  token-harness mcp           MCP audit                     writes nothing
-  5  token-harness history       local usage history            writes nothing
-  6  token-harness optimize      quota-aware advice             writes nothing
-  7  token-harness plan          what would change              writes nothing
-  8  token-harness apply --yes   make those changes             WRITES
-  9  token-harness verify        is it actually intercepting    writes nothing
- 10  token-harness metrics       what it saved                  writes nothing
- 11  token-harness benchmark     compare paired task receipts   writes nothing
- 12  token-harness benchmark-start  snapshot task start         writes state
- 13  token-harness benchmark-finish close task receipt          writes state
- 14  token-harness benchmark-matrix aggregate empirical pairs   writes nothing
+New here? Run one command
+  token-harness setup
 
-  Steps 1 through 7 are safe to run right now. Nothing changes until step 8.
+It detects what is installed, checks what works, and prepares only supported
+changes. It ends with one next step. Nothing changes without an explicit
+--yes.
 
 Usage
   token-harness <command> [flags]
-  token-harness help <command>
 
-Commands, in the order you would use them
-  doctor      What is installed, what is wired up, what is worth knowing
-  budget      Read Claude/Codex usage windows with explicit source/confidence
-  context     Audit instruction bytes, effective config, MCP servers and tools
-  mcp         Show the focused native MCP/server/tool inventory
-  history     Read local Claude/Codex usage history through ccusage
-  plan        Compute what would change, file by file. Changes nothing
-  apply       Run that plan inside a transaction that can be rolled back
-  verify      Check the pipeline actually intercepts, at its declared tier
-  metrics     Report what was saved, labelled with how it was measured
-  benchmark   Compare baseline/optimized task receipts with quality gates
-  benchmark-start
-              Snapshot quota/policy before one benchmark task into local state
-  benchmark-finish
-              Close that capture with quota-after and an explicit quality gate
-  benchmark-matrix
-              Aggregate complete local pairs by class and evidence
-  optimize    Combine quota and context evidence into read-only policy advice
-  status      Report applied pipelines, drift, and importer modes
-  update      Update installed providers to what their channel offers
-  rollback    Restore the files a transaction changed, as they were before
-  uninstall   Remove what Token Harness set up, leaving everything else
+Everyday commands
+  setup       Guided detection, safe configuration, and verification
+  ui          Open the local dashboard in your browser
+  optimize    Show the best evidence-based action for the current task
+  status      Show active harnesses, providers, and configuration health
 
-Flags
-  --json               Emit one machine-readable envelope on stdout
+Advanced commands
+  doctor      Full installation and connection check
+  budget      Claude/Codex subscription usage windows
+  context     Instruction, model, and context-cost observations
+  mcp         MCP server and tool inventory
+  history     Local usage history through an installed ccusage
+  plan        Prepare an exact, reversible change without applying it
+  apply       Apply a reviewed plan
+  verify      Check that configured integrations work
+  metrics     Show measured savings
+  update      Check or update installed providers
+  rollback    Restore the previous configuration
+  uninstall   Remove only configuration Token Harness owns
+  benchmark, benchmark-start, benchmark-finish, benchmark-matrix
+              Compare real task results for advanced evaluation
+
+Useful flags
+  --verbose            Show technical details instead of the short summary
+  --json               Emit the complete machine-readable result
+  --yes                Confirm a configuration-changing operation
   --harness <id>       Restrict the operation to one harness
   --provider <id>      Restrict the operation to one provider
   --project <dir>      Use that project instead of the current directory
-  --since <window>     Report from this point: a duration like 7d, or a date
-  --until <window>     Report up to this point; defaults to now
-  --plan <id>          Apply a previously computed plan by id
-  --baseline <file>     Baseline task benchmark receipt JSON
-  --optimized <file>    Optimized task benchmark receipt JSON
-  --benchmark-id <id>    Safe local id for benchmark start/finish
-  --variant <name>       Benchmark variant: baseline or optimized
-  --quality <result>     Finish quality gate: passed or failed
-  --attempts <count>     Total attempts used to complete the task
-  --failed-attempts <n> Failed attempts before the final outcome
-  --task <class>        Optimizer task: mechanical, standard, hard, critical
-  --profile <name>      Optimizer profile: economy, balanced, quality, custom
-  --reserve <percent>   Keep this percent of observed allowance in reserve
-  --native-policy       Add reversible native Codex policy edits to plan
-  --yes                Grant the confirmation a mutating command requires
-  --version            Print the version and exit 0
-  --help               Print usage and exit 0
+  --help               Show help for a command
+  --version            Print the version
 
-Only apply, update, rollback and uninstall change harness/provider
-configuration, and none of them do without --yes. Metrics and benchmark
-capture may write only Token Harness's own local state. Exit codes and JSON
-are specified in RFC 0006.`;
+Run token-harness <command> --help for advanced flags and safety details.`;
     COMMAND_USAGE = {
+      setup: `token-harness setup \u2014 guided onboarding in one command
+
+Usage
+  token-harness setup [--yes] [--verbose] [--json] [--project <dir>]
+
+Without --yes, setup detects Claude Code/Codex, checks existing providers, and
+prepares any supported reversible configuration. It changes no harness/provider
+configuration and ends with one next step.
+
+Run the suggested token-harness setup --yes only after reviewing the short plan.
+It applies that stored plan transactionally, verifies the result, reads allowance
+when available, and points to the local dashboard. Token Harness never installs
+Claude Code or Codex and never spends model quota during setup.`,
       "benchmark-start": `token-harness benchmark-start \u2014 snapshot one task before it runs
 
 Usage
@@ -19560,14 +20195,14 @@ function formatDiagnostics(diagnostics) {
   if (errors.length === 0 && warnings.length === 0)
     return "";
   const lines = [];
-  for (const [title, group] of [
+  for (const [title2, group] of [
     ["ERRORS", errors],
     ["WARNINGS", warnings]
   ]) {
     if (group.length === 0)
       continue;
     lines.push("");
-    lines.push(title);
+    lines.push(title2);
     for (const entry of group)
       lines.push(diagnosticLine(entry));
   }
@@ -19649,6 +20284,7 @@ async function run(options) {
   const renderContext = {
     toolVersion,
     home: options.home,
+    verbose: false,
     decorate: shouldDecorate({
       stdoutIsTty: options.stdoutIsTty ?? false,
       noColor: env["NO_COLOR"] !== void 0,
@@ -19688,6 +20324,7 @@ async function run(options) {
       diagnostics: invocation.diagnostics
     }), options, renderContext, json);
   }
+  renderContext.verbose = invocation.options.verbose;
   const environmentDiagnostics = options.environmentDiagnostics ?? [];
   if (environmentDiagnostics.some((entry) => entry.severity === "error")) {
     return emit(commandResult({
@@ -19762,6 +20399,7 @@ var init_run = __esm({
     init_optimize();
     init_plan2();
     init_rollback();
+    init_setup2();
     init_status();
     init_update();
     init_verify();
@@ -19783,6 +20421,7 @@ var init_run = __esm({
       optimize: runOptimize,
       plan: runPlan,
       rollback: runRollback,
+      setup: runSetup,
       status: runStatus,
       uninstall: runUninstall,
       update: runUpdate,
@@ -19792,12 +20431,156 @@ var init_run = __esm({
   }
 });
 
+// apps/cli/dist/src/ui.js
+function parseUiArgs(argv2) {
+  const options = { help: false, json: false, open: true, port: 0 };
+  for (let index = 0; index < argv2.length; index += 1) {
+    const token = argv2[index];
+    if (token === "--help")
+      options.help = true;
+    else if (token === "--json")
+      options.json = true;
+    else if (token === "--no-open")
+      options.open = false;
+    else if (token === "--port") {
+      const raw = argv2[index + 1];
+      const port = Number(raw);
+      if (raw === void 0 || !Number.isInteger(port) || port < 1 || port > 65535) {
+        return { ok: false, message: "--port requires an integer from 1 to 65535" };
+      }
+      options.port = port;
+      index += 1;
+    } else {
+      return { ok: false, message: `Unknown ui option ${JSON.stringify(token)}` };
+    }
+  }
+  return { ok: true, options };
+}
+function nameOf(id) {
+  if (id === "claude")
+    return "Claude Code";
+  if (id === "codex")
+    return "Codex";
+  if (id === "opencode")
+    return "OpenCode";
+  return id;
+}
+function buildDashboardModel(input) {
+  const present = input.doctor.harnesses.filter((item) => item.state !== "absent");
+  const configured = input.doctor.providers.filter((item) => item.state === "configured" && item.configuredHarnesses.length > 0);
+  const hasProblems = input.doctor.problemCount > 0 || input.status.problemCount > 0;
+  const state = hasProblems ? "attention" : present.length === 0 || configured.length === 0 ? "setup-needed" : "ready";
+  const recommendation = input.optimize.harnesses.flatMap((harness) => harness.recommendations.map((item) => ({
+    harness: harness.harnessId,
+    priority: item.priority,
+    action: item.action,
+    reason: item.evidence[0]?.summary ?? null
+  }))).sort((left, right) => {
+    const rank = { first: 0, next: 1, optional: 2 };
+    return rank[left.priority] - rank[right.priority];
+  })[0];
+  const nextStep = state === "setup-needed" ? { command: "token-harness setup", description: "Finish the guided setup." } : state === "attention" ? {
+    command: "token-harness doctor --verbose",
+    description: "Review the detected problem before changing anything."
+  } : {
+    command: "token-harness optimize",
+    description: "Refresh advice for the task you are about to start."
+  };
+  return {
+    generatedAt: input.generatedAt,
+    state,
+    headline: state === "ready" ? "Your coding harnesses are connected." : state === "attention" ? "One or more checks need attention." : "Finish setup to activate Token Harness.",
+    harnesses: input.doctor.harnesses.map((harness) => {
+      const budget = input.budget.harnesses.find((item) => item.harnessId === harness.harnessId);
+      return {
+        id: harness.harnessId,
+        name: nameOf(harness.harnessId),
+        state: harness.state,
+        version: harness.version,
+        providers: input.doctor.providers.filter((provider) => provider.configuredHarnesses.includes(harness.harnessId)).map((provider) => provider.providerId),
+        allowance: (budget?.windows ?? []).map((window) => ({
+          label: window.bucketName ?? window.scope,
+          remainingPercent: window.remainingPercent,
+          resetsAt: window.resetsAt,
+          confidence: window.confidence
+        }))
+      };
+    }),
+    providers: input.doctor.providers.map((provider) => ({
+      id: provider.providerId,
+      state: provider.state,
+      harnesses: provider.configuredHarnesses.map(nameOf)
+    })),
+    recommendation: recommendation === void 0 ? null : {
+      action: `${nameOf(recommendation.harness)}: ${recommendation.action}`,
+      reason: recommendation.reason
+    },
+    nextStep
+  };
+}
+function uiAsset(path, model) {
+  if (path === "/")
+    return { status: 200, contentType: "text/html; charset=utf-8", body: DASHBOARD_HTML };
+  if (path === "/app.css")
+    return { status: 200, contentType: "text/css; charset=utf-8", body: DASHBOARD_CSS };
+  if (path === "/app.js")
+    return { status: 200, contentType: "text/javascript; charset=utf-8", body: DASHBOARD_JS };
+  if (path === "/api/status")
+    return {
+      status: 200,
+      contentType: "application/json; charset=utf-8",
+      body: JSON.stringify(model)
+    };
+  return { status: 404, contentType: "text/plain; charset=utf-8", body: "Not found\n" };
+}
+var UI_USAGE, DASHBOARD_HTML, DASHBOARD_CSS, DASHBOARD_JS;
+var init_ui = __esm({
+  "apps/cli/dist/src/ui.js"() {
+    "use strict";
+    UI_USAGE = `token-harness ui \u2014 open a simple local dashboard
+
+Usage
+  token-harness ui [--no-open] [--port <number>] [--json]
+
+The dashboard listens only on 127.0.0.1 and reads the same reports as the CLI.
+It does not send data anywhere and cannot change configuration. Close it with
+Ctrl+C. Use --json for one complete dashboard snapshot without starting a server.`;
+    DASHBOARD_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="dark">
+  <title>Token Harness</title>
+  <link rel="stylesheet" href="/app.css">
+</head>
+<body>
+  <a class="skip" href="#main">Skip to dashboard</a>
+  <header><div class="brand"><span class="mark">TH</span><span>Token Harness</span></div><button id="refresh" type="button">Refresh</button></header>
+  <main id="main">
+    <section class="hero" aria-labelledby="headline"><p class="eyebrow">LOCAL STATUS</p><h1 id="headline">Checking your harnesses...</h1><p id="updated" class="muted" aria-live="polite"></p></section>
+    <section id="harnesses" class="grid" aria-label="Harness status"></section>
+    <section class="panel recommendation"><p class="eyebrow">RECOMMENDATION</p><h2 id="recommendation">Waiting for observations...</h2><p id="reason" class="muted"></p></section>
+    <section class="panel next"><div><p class="eyebrow">NEXT STEP</p><code id="command">token-harness setup</code><p id="description" class="muted"></p></div><button id="copy" type="button">Copy command</button></section>
+    <section class="panel"><p class="eyebrow">PROVIDERS</p><div id="providers" class="provider-list"></div></section>
+    <p id="error" class="error" role="alert"></p>
+  </main>
+  <footer>Private by design. Served only from this computer.</footer>
+  <script src="/app.js" defer></script>
+</body>
+</html>`;
+    DASHBOARD_CSS = `:root{font-family:Inter,ui-sans-serif,system-ui,-apple-system,sans-serif;color:#f8fafc;background:#0f172a;font-synthesis:none}*{box-sizing:border-box}body{margin:0;min-height:100vh;background:radial-gradient(circle at 90% 0,#172554 0,transparent 32rem),#0f172a}button{min-height:44px;border:1px solid #475569;border-radius:10px;background:#1e293b;color:#f8fafc;padding:0 1rem;font:inherit;font-weight:700;cursor:pointer}button:hover{background:#334155}button:focus-visible,a:focus-visible{outline:3px solid #38bdf8;outline-offset:3px}.skip{position:absolute;left:-999px;top:1rem;color:#fff}.skip:focus{left:1rem}header,main,footer{width:min(1120px,calc(100% - 2rem));margin-inline:auto}header{height:76px;display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid #334155}.brand{display:flex;align-items:center;gap:.75rem;font-weight:800}.mark{display:grid;place-items:center;width:38px;height:38px;border-radius:10px;background:#22c55e;color:#052e16;font:800 14px ui-monospace,monospace}.hero{padding:4.5rem 0 2rem}.eyebrow{margin:0 0 .65rem;color:#22c55e;font:700 .75rem ui-monospace,monospace;letter-spacing:.12em}.hero h1{max-width:760px;margin:0 0 .8rem;font-size:clamp(2rem,5vw,4.4rem);line-height:1.02;letter-spacing:-.045em}.muted{color:#94a3b8;line-height:1.6}.grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem}.panel,.card{border:1px solid #334155;border-radius:16px;background:#172033;padding:1.4rem;box-shadow:0 16px 40px #02061733}.card-top,.next{display:flex;align-items:flex-start;justify-content:space-between;gap:1rem}.badge{border-radius:999px;padding:.35rem .65rem;background:#334155;color:#cbd5e1;font:700 .72rem ui-monospace,monospace}.badge.ready{background:#14532d;color:#bbf7d0}.badge.attention{background:#713f12;color:#fef3c7}.card h2,.panel h2{margin:.15rem 0;font-size:1.25rem}.meta{margin:.35rem 0 1.2rem;color:#94a3b8}.quota{margin-top:1rem}.quota-row{display:flex;justify-content:space-between;gap:1rem;margin-bottom:.45rem;font-size:.9rem}.quota-meta{margin:.45rem 0 0;color:#64748b;font-size:.78rem}.track{height:8px;border-radius:999px;background:#334155;overflow:hidden}.fill{height:100%;background:#22c55e;border-radius:inherit}.recommendation{margin-top:1rem}.next{margin-top:1rem;align-items:center}.next code{display:block;color:#e2e8f0;font-size:1rem;overflow-wrap:anywhere}.provider-list{display:flex;flex-wrap:wrap;gap:.65rem}.provider{border:1px solid #475569;border-radius:10px;padding:.65rem .8rem;color:#cbd5e1}.panel{margin-top:1rem}.error{color:#fecaca}.empty{color:#94a3b8}footer{padding:2.5rem 0;color:#64748b;font-size:.85rem}@media(max-width:720px){.grid{grid-template-columns:1fr}.hero{padding-top:3rem}.next{align-items:stretch;flex-direction:column}.next button{width:100%}}@media(prefers-reduced-motion:reduce){*{scroll-behavior:auto!important}}`;
+    DASHBOARD_JS = `const byId=(id)=>document.getElementById(id);const text=(id,value)=>{byId(id).textContent=value};function badgeState(state){return state==='configured'||state==='detected'?'ready':state==='broken'?'attention':''}function render(model){text('headline',model.headline);text('updated','Updated '+new Date(model.generatedAt).toLocaleString());const harnesses=byId('harnesses');harnesses.replaceChildren();for(const item of model.harnesses){const card=document.createElement('article');card.className='card';const top=document.createElement('div');top.className='card-top';const heading=document.createElement('h2');heading.textContent=item.name;const badge=document.createElement('span');badge.className='badge '+badgeState(item.state);badge.textContent=item.state;top.append(heading,badge);card.append(top);const meta=document.createElement('p');meta.className='meta';meta.textContent=(item.version?'Version '+item.version+' \xB7 ':'')+(item.providers.length?item.providers.join(', ')+' active':'no provider active');card.append(meta);if(item.allowance.length===0){const empty=document.createElement('p');empty.className='empty';empty.textContent='Allowance unavailable';card.append(empty)}for(const quota of item.allowance){const box=document.createElement('div');box.className='quota';const row=document.createElement('div');row.className='quota-row';const label=document.createElement('span');label.textContent=quota.label;const value=document.createElement('strong');value.textContent=quota.remainingPercent===null?'Unknown':quota.remainingPercent+'% left';row.append(label,value);const track=document.createElement('div');track.className='track';track.setAttribute('role','progressbar');track.setAttribute('aria-label',item.name+' '+quota.label);track.setAttribute('aria-valuemin','0');track.setAttribute('aria-valuemax','100');if(quota.remainingPercent!==null){track.setAttribute('aria-valuenow',String(quota.remainingPercent));track.setAttribute('aria-valuetext',quota.remainingPercent+'% remaining')}const fill=document.createElement('div');fill.className='fill';fill.style.width=(quota.remainingPercent===null?0:Math.max(0,Math.min(100,quota.remainingPercent)))+'%';track.append(fill);const reset=document.createElement('p');reset.className='quota-meta';reset.textContent=(quota.resetsAt?'Resets '+new Date(quota.resetsAt).toLocaleString():'Reset unknown')+' \xB7 '+quota.confidence;box.append(row,track,reset);card.append(box)}harnesses.append(card)}text('recommendation',model.recommendation?model.recommendation.action:'No recommendation yet.');text('reason',model.recommendation?.reason||'More observations are needed before Token Harness recommends a change.');text('command',model.nextStep.command);text('description',model.nextStep.description);const providers=byId('providers');providers.replaceChildren();if(model.providers.length===0){const empty=document.createElement('span');empty.className='empty';empty.textContent='No provider detected';providers.append(empty)}for(const item of model.providers){const node=document.createElement('span');node.className='provider';node.textContent=item.id+' \xB7 '+(item.harnesses.length?'active on '+item.harnesses.join(', '):item.state);providers.append(node)}text('error','')}async function load(){byId('refresh').disabled=true;try{const response=await fetch('/api/status',{cache:'no-store'});if(!response.ok)throw new Error('Dashboard data is unavailable');render(await response.json())}catch(error){text('error',error instanceof Error?error.message:String(error))}finally{byId('refresh').disabled=false}}byId('refresh').addEventListener('click',load);byId('copy').addEventListener('click',async()=>{await navigator.clipboard.writeText(byId('command').textContent||'');text('updated','Command copied')});load();setInterval(()=>{if(!document.hidden)load()},30000);`;
+  }
+});
+
 // apps/cli/dist/src/main.js
 var main_exports = {};
 __export(main_exports, {
   main: () => main
 });
 import process5 from "node:process";
+import { createServer } from "node:http";
 async function runAsDatabaseReader(argv2) {
   if (argv2[0] !== SQLITE_CHILD_FLAG)
     return false;
@@ -19815,15 +20598,24 @@ async function runAsDatabaseReader(argv2) {
 async function main(argv2) {
   if (await runAsDatabaseReader(argv2))
     return;
+  const uiInvocation = argv2[0] === "ui" ? parseUiArgs(argv2.slice(1)) : null;
+  if (uiInvocation !== null && !uiInvocation.ok) {
+    process5.stderr.write(`${uiInvocation.message}
+Run token-harness ui --help for usage.
+`);
+    process5.exitCode = EXIT_CODES["usage-error"];
+    return;
+  }
+  if (uiInvocation?.ok === true && uiInvocation.options.help) {
+    process5.stdout.write(`${UI_USAGE}
+`);
+    process5.exitCode = EXIT_CODES.ok;
+    return;
+  }
   const resolution = resolveHostEnvironment();
   const fs = resolution.ok ? new NodeFileSystem(resolution.environment.facts) : null;
   const attribution = resolution.ok && fs !== null ? await resolveAttributionSalt(fs, resolution.environment.paths.state) : { salt: null, diagnostics: [] };
-  const exitCode = await run({
-    argv: argv2,
-    streams: {
-      out: (text3) => process5.stdout.write(text3),
-      err: (text3) => process5.stderr.write(text3)
-    },
+  const baseOptions = {
     // On failure `facts` is null only when the operating system itself is
     // unsupported. An unresolvable state directory still has honest facts to
     // report, and `run` uses them for the runtime-floor check before refusing.
@@ -19872,15 +20664,188 @@ async function main(argv2) {
     }) : null,
     env: process5.env,
     stdoutIsTty: process5.stdout.isTTY === true
+  };
+  if (uiInvocation?.ok === true) {
+    process5.exitCode = await runUi(uiInvocation.options, baseOptions);
+    return;
+  }
+  const exitCode = await run({
+    ...baseOptions,
+    argv: argv2,
+    streams: {
+      out: (text3) => process5.stdout.write(text3),
+      err: (text3) => process5.stderr.write(text3)
+    }
   });
   process5.exitCode = exitCode;
 }
+async function readJsonReport(command, baseOptions) {
+  let stdout = "";
+  let stderr = "";
+  const exitCode = await run({
+    ...baseOptions,
+    argv: [command, "--json"],
+    streams: {
+      out: (text3) => {
+        stdout += text3;
+      },
+      err: (text3) => {
+        stderr += text3;
+      }
+    }
+  });
+  let envelope;
+  try {
+    envelope = JSON.parse(stdout);
+  } catch {
+    throw new Error(stderr.trim() || `${command} did not return a valid report`);
+  }
+  if (envelope.data === null) {
+    throw new Error(envelope.diagnostics[0]?.message ?? `${command} could not inspect this computer`);
+  }
+  return { exitCode, data: envelope.data };
+}
+async function collectDashboard(baseOptions) {
+  const [doctor, status, budget, optimize] = await Promise.all([
+    readJsonReport("doctor", baseOptions),
+    readJsonReport("status", baseOptions),
+    readJsonReport("budget", baseOptions),
+    readJsonReport("optimize", baseOptions)
+  ]);
+  return buildDashboardModel({
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    doctor: doctor.data,
+    status: status.data,
+    budget: budget.data,
+    optimize: optimize.data
+  });
+}
+async function openDashboard(url, baseOptions) {
+  const adapters = baseOptions.adapters;
+  const platform = baseOptions.platform;
+  if (adapters === null || adapters === void 0 || platform === null)
+    return false;
+  const request = platform.os === "windows" ? { executable: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] } : platform.os === "macos" ? { executable: "open", args: [url] } : { executable: "xdg-open", args: [url] };
+  const result2 = await adapters.runner.run({
+    ...request,
+    cwd: baseOptions.cwd,
+    env: Object.fromEntries(["DISPLAY", "WAYLAND_DISPLAY", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS"].flatMap((name) => process5.env[name] === void 0 ? [] : [[name, process5.env[name]]])),
+    timeoutMs: 5e3,
+    maxOutputBytes: 4096
+  });
+  return result2.failure === null && result2.exitCode === 0;
+}
+async function runUi(options, baseOptions) {
+  let initial;
+  try {
+    initial = await collectDashboard(baseOptions);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      process5.stdout.write(serializeEnvelope(toEnvelope(commandResult({
+        command: "ui",
+        exitCode: EXIT_CODES["unsupported-environment"],
+        diagnostics: [
+          diagnostic({
+            severity: "error",
+            code: "dashboard-unavailable",
+            message,
+            remediation: "Run token-harness doctor --verbose"
+          })
+        ]
+      }), TOOL_VERSION)));
+    } else {
+      process5.stderr.write(`Token Harness dashboard could not start: ${message}
+`);
+    }
+    return EXIT_CODES["unsupported-environment"];
+  }
+  if (options.json) {
+    const exitCode = initial.state === "attention" ? EXIT_CODES["problems-found"] : EXIT_CODES.ok;
+    process5.stdout.write(serializeEnvelope(toEnvelope(commandResult({ command: "ui", exitCode, data: initial }), TOOL_VERSION)));
+    return exitCode;
+  }
+  let cached = initial;
+  let cachedAt = Date.now();
+  const server = createServer(async (request, response) => {
+    const host = request.headers.host ?? "";
+    const sameSite = request.headers["sec-fetch-site"] !== "cross-site";
+    const localHost = host.startsWith("127.0.0.1:") || host.startsWith("localhost:");
+    if (!sameSite || !localHost) {
+      response.writeHead(403, { ...UI_SECURITY_HEADERS, "Content-Type": "text/plain" });
+      response.end("Forbidden\n");
+      return;
+    }
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      response.writeHead(405, {
+        ...UI_SECURITY_HEADERS,
+        Allow: "GET, HEAD",
+        "Content-Type": "text/plain"
+      });
+      response.end("Method not allowed\n");
+      return;
+    }
+    let model = cached;
+    if (request.url === "/api/status") {
+      if (Date.now() - cachedAt > 5e3) {
+        try {
+          cached = await collectDashboard(baseOptions);
+          cachedAt = Date.now();
+          model = cached;
+        } catch {
+          response.writeHead(503, {
+            ...UI_SECURITY_HEADERS,
+            "Content-Type": "application/json; charset=utf-8"
+          });
+          response.end('{"error":"Dashboard data is temporarily unavailable"}');
+          return;
+        }
+      }
+    }
+    const asset = uiAsset(request.url ?? "/", model);
+    response.writeHead(asset.status, {
+      ...UI_SECURITY_HEADERS,
+      "Content-Type": asset.contentType
+    });
+    response.end(request.method === "HEAD" ? void 0 : asset.body);
+  });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port, "127.0.0.1", () => resolve());
+    });
+  } catch (error) {
+    process5.stderr.write(`Token Harness dashboard could not listen locally: ${error instanceof Error ? error.message : String(error)}
+`);
+    return EXIT_CODES["internal-error"];
+  }
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+  const url = `http://127.0.0.1:${port}/`;
+  process5.stdout.write(`Token Harness dashboard is ready: ${url}
+Close it with Ctrl+C.
+`);
+  if (options.open && !await openDashboard(url, baseOptions)) {
+    process5.stdout.write(`Open this address in your browser: ${url}
+`);
+  }
+  return EXIT_CODES.ok;
+}
+var UI_SECURITY_HEADERS;
 var init_main = __esm({
   "apps/cli/dist/src/main.js"() {
     "use strict";
     init_src();
     init_src2();
     init_run();
+    init_ui();
+    init_version2();
+    UI_SECURITY_HEADERS = {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    };
   }
 });