token-harness 0.1.6 → 0.1.8

package/token-harness.mjs

@@ -1462,10 +1462,10 @@ function truncateUtf8(value3, maxBytes) {
   }
   return `${value3.slice(0, low).trimEnd()}${suffix}`;
 }
-function renderList(title, values, omitted) {
+function renderList(title2, values, omitted) {
   if (values.length === 0 && omitted === 0)
     return [];
-  const lines = [`## ${title}`];
+  const lines = [`## ${title2}`];
   for (const value3 of values)
     lines.push(`- ${value3}`);
   if (omitted > 0)
@@ -1879,6 +1879,26 @@ var init_compatibility_rows = __esm({
         fixture: "tests/fixtures/rows/rtk-claude-windows",
         verificationTier: "canary"
       },
+      {
+        harness: "claude",
+        harnessVersion: { minimum: "2.1.251", maximum: "2.1.251" },
+        provider: "rtk",
+        providerVersion: "0.44.0",
+        platform: { os: "windows", wsl: false, supported: true, limitation: null },
+        configSchema: "claude-settings-json-hooks-powershell",
+        fixture: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.44.0",
+        verificationTier: "canary"
+      },
+      {
+        harness: "claude",
+        harnessVersion: { minimum: "2.1.251", maximum: "2.1.251" },
+        provider: "rtk",
+        providerVersion: "0.48.0",
+        platform: { os: "windows", wsl: false, supported: true, limitation: null },
+        configSchema: "claude-settings-json-hooks-powershell",
+        fixture: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0",
+        verificationTier: "canary"
+      },
       {
         harness: "claude",
         harnessVersion: { minimum: "2.1.220", maximum: "2.1.220" },
@@ -2223,6 +2243,13 @@ var init_reports = __esm({
   }
 });
 
+// packages/core/dist/src/domain/setup.js
+var init_setup = __esm({
+  "packages/core/dist/src/domain/setup.js"() {
+    "use strict";
+  }
+});
+
 // packages/core/dist/src/domain/verification.js
 function contributesToProblems(check) {
   return check.status === "fail";
@@ -2827,9 +2854,9 @@ function providerRemovalOrder(ownership, candidates) {
       break;
     ordered.push(provider);
     for (const dependent of [...edges.get(provider) ?? []].sort((left, right) => left.localeCompare(right))) {
-      const next = (indegree.get(dependent) ?? 0) - 1;
-      indegree.set(dependent, next);
-      if (next === 0) {
+      const next2 = (indegree.get(dependent) ?? 0) - 1;
+      indegree.set(dependent, next2);
+      if (next2 === 0) {
         ready.push(dependent);
         ready.sort((left, right) => left.localeCompare(right));
       }
@@ -4298,10 +4325,10 @@ function parseJsonPointer(pointer) {
   for (let index = 0; index < pointer.length; index += 1) {
     const char = pointer[index];
     if (char === "\\") {
-      const next = pointer[index + 1];
-      if (next !== "." && next !== "\\")
+      const next2 = pointer[index + 1];
+      if (next2 !== "." && next2 !== "\\")
         return null;
-      current += next;
+      current += next2;
       index += 1;
       continue;
     }
@@ -4416,13 +4443,13 @@ function ensureParent(document2, segments) {
     if (!isJsonObject(current)) {
       return { ok: false, reason: `\`${segments.slice(0, index).join(".")}\` is not an object` };
     }
-    const next = current[segment];
-    if (next === void 0) {
+    const next2 = current[segment];
+    if (next2 === void 0) {
       current[segment] = {};
       current = current[segment];
       continue;
     }
-    current = next;
+    current = next2;
   }
   if (!isJsonObject(current)) {
     return { ok: false, reason: `\`${segments.slice(0, -1).join(".")}\` is not an object` };
@@ -4650,31 +4677,31 @@ function upsertMarkerBlock(input) {
     if (lookup.block.body === bodyText) {
       return { ok: true, text: input.text, bodyDigest: lookup.block.bodyDigest, changed: false };
     }
-    const next2 = [
+    const next3 = [
       ...lines.slice(0, lookup.block.beginLine + 1),
       ...bodyLines,
       ...lines.slice(lookup.block.endLine)
     ];
     return {
       ok: true,
-      text: `${hasBom ? BOM2 : ""}${joinLines(next2)}`,
+      text: `${hasBom ? BOM2 : ""}${joinLines(next3)}`,
       bodyDigest: digestText(bodyText),
       changed: true
     };
   }
-  const next = lines.map((line) => ({ ...line }));
-  const trailing = next.length === 0 ? eol : next[next.length - 1]?.eol ?? eol;
-  const last = next[next.length - 1];
+  const next2 = lines.map((line) => ({ ...line }));
+  const trailing = next2.length === 0 ? eol : next2[next2.length - 1]?.eol ?? eol;
+  const last = next2[next2.length - 1];
   if (last !== void 0 && last.eol === "")
     last.eol = eol;
-  if (next.length > 0)
-    next.push({ text: "", eol });
-  next.push({ text: fenceLine(input.fence.begin, input.syntax), eol });
-  next.push(...bodyLines);
-  next.push({ text: fenceLine(input.fence.end, input.syntax), eol: trailing });
+  if (next2.length > 0)
+    next2.push({ text: "", eol });
+  next2.push({ text: fenceLine(input.fence.begin, input.syntax), eol });
+  next2.push(...bodyLines);
+  next2.push({ text: fenceLine(input.fence.end, input.syntax), eol: trailing });
   return {
     ok: true,
-    text: `${hasBom ? BOM2 : ""}${joinLines(next)}`,
+    text: `${hasBom ? BOM2 : ""}${joinLines(next2)}`,
     bodyDigest: digestText(bodyText),
     changed: true
   };
@@ -6205,8 +6232,8 @@ function withoutTrailingCommas(text3) {
       let cursor = index + 1;
       while (cursor < text3.length && /\s/.test(text3[cursor]))
         cursor += 1;
-      const next = text3[cursor];
-      if (next === "}" || next === "]") {
+      const next2 = text3[cursor];
+      if (next2 === "}" || next2 === "]") {
         result2 += text3.slice(index + 1, cursor);
         index = cursor;
         continue;
@@ -6468,6 +6495,14 @@ var init_snapshots = __esm({
 function terminal(status) {
   return status !== "applied" && status !== "already-satisfied";
 }
+function initialSnapshots(snapshots) {
+  const firstByPath = /* @__PURE__ */ new Map();
+  for (const snapshot of snapshots) {
+    if (!firstByPath.has(snapshot.path))
+      firstByPath.set(snapshot.path, snapshot);
+  }
+  return [...firstByPath.values()];
+}
 async function verifyRestoration(fs, snapshots) {
   const unrestored = [];
   for (const snapshot of snapshots) {
@@ -6556,7 +6591,7 @@ async function executeTransaction(request) {
   };
   const rollback = async (cause) => {
     diagnostics.push(...cause);
-    const snapshots = request.snapshots.captured;
+    const snapshots = initialSnapshots(request.snapshots.captured);
     let restoreError = null;
     try {
       await request.snapshots.restoreAll(snapshots);
@@ -6690,7 +6725,7 @@ async function rollbackTransaction(request) {
       ]
     };
   }
-  const snapshots = journal.entries.flatMap((entry) => entry.snapshots);
+  const snapshots = initialSnapshots(journal.entries.flatMap((entry) => entry.snapshots));
   const diagnostics = [];
   let restoreError = null;
   try {
@@ -6793,6 +6828,7 @@ var init_src = __esm({
     init_process();
     init_redaction();
     init_reports();
+    init_setup();
     init_verification();
     init_version();
     init_envelope();
@@ -6831,7 +6867,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.6";
+    TOOL_VERSION = "0.1.8";
   }
 });
 
@@ -6847,10 +6883,10 @@ function parseValue(argv2, index) {
     const value3 = token.slice(equals + 1);
     return { value: value3 === "" ? null : value3, consumed: 0 };
   }
-  const next = argv2[index + 1];
-  if (next === void 0 || next.startsWith("-"))
+  const next2 = argv2[index + 1];
+  if (next2 === void 0 || next2.startsWith("-"))
     return { value: null, consumed: 0 };
-  return { value: next, consumed: 1 };
+  return { value: next2, consumed: 1 };
 }
 function parseArgs(argv2) {
   const args = {
@@ -7112,19 +7148,19 @@ function parse(argv2) {
       continue;
     }
     const inline = equals >= 0 ? token.slice(equals + 1) : null;
-    const next = inline ?? argv2[index + 1] ?? null;
-    if (next === null || next === "" || inline === null && next.startsWith("-")) {
+    const next2 = inline ?? argv2[index + 1] ?? null;
+    if (next2 === null || next2 === "" || inline === null && next2.startsWith("-")) {
       errors.push(`${name} requires a value`);
       continue;
     }
     if (inline === null)
       index += 1;
     if (name === "--benchmark-id")
-      args.benchmarkId = next;
+      args.benchmarkId = next2;
     else if (name === "--handoff-file")
-      args.handoffFile = next;
+      args.handoffFile = next2;
     else {
-      const parsed = Number(next);
+      const parsed = Number(next2);
       if (!Number.isInteger(parsed) || parsed <= 0) {
         errors.push("--max-handoff-bytes must be a positive integer");
       } else {
@@ -8790,19 +8826,19 @@ function parse2(argv2) {
       continue;
     }
     const inline = equals >= 0 ? token.slice(equals + 1) : null;
-    const next = inline ?? argv2[index + 1] ?? null;
-    if (next === null || next === "" || inline === null && next.startsWith("-")) {
+    const next2 = inline ?? argv2[index + 1] ?? null;
+    if (next2 === null || next2 === "" || inline === null && next2.startsWith("-")) {
       errors.push(`${name} requires a value`);
       continue;
     }
     if (inline === null)
       index += 1;
     if (name === "--benchmark-id")
-      args.benchmarkId = next;
+      args.benchmarkId = next2;
     else if (name === "--handoff-file")
-      args.handoffFile = next;
+      args.handoffFile = next2;
     else {
-      const parsed = Number(next);
+      const parsed = Number(next2);
       if (!Number.isInteger(parsed) || parsed <= 0) {
         errors.push("--max-handoff-bytes must be a positive integer");
       } else {
@@ -8960,10 +8996,10 @@ function valueAt(argv2, index) {
     const value3 = token.slice(equals + 1);
     return { value: value3.length > 0 ? value3 : null, consumed: 0 };
   }
-  const next = argv2[index + 1];
-  if (next === void 0 || next.startsWith("-"))
+  const next2 = argv2[index + 1];
+  if (next2 === void 0 || next2.startsWith("-"))
     return { value: null, consumed: 0 };
-  return { value: next, consumed: 1 };
+  return { value: next2, consumed: 1 };
 }
 function parseInteger(name, value3, minimum, diagnostics) {
   const parsed = Number(value3);
@@ -11690,24 +11726,27 @@ async function verify5(context) {
     },
     {
       id: "module-installed",
-      status: module ? "pass" : "fail",
-      summary: module ? "HarnessTrim extension module is installed" : "No HarnessTrim extension module was found in the Pi extension directories",
+      // The HarnessTrim extension is optional. `verify` answers whether existing integrations are
+      // healthy; it must not turn an installed Pi executable into a warning merely because the
+      // user never chose to integrate HarnessTrim with it.
+      status: module ? "pass" : "not-exercised",
+      summary: module ? "HarnessTrim extension module is installed" : "HarnessTrim is not configured on Pi, so there is no Pi integration to verify",
       achievedTier: module ? "config-only" : null,
       evidence: [],
-      remediation: module ? null : "Run `harnesstrim install pi --apply`"
+      remediation: null
     },
     {
       id: "mode-unreadable",
-      status: "info",
-      summary: "The effective reduction mode (HARNESSTRIM_MODE) defaults to dryrun and is not observable from the extension alone",
+      status: module ? "info" : "pass",
+      summary: module ? "The effective reduction mode (HARNESSTRIM_MODE) defaults to dryrun and is not observable from the extension alone" : "no HarnessTrim Pi mode applies because no extension is configured",
       achievedTier: null,
       evidence: [],
       remediation: null
     },
     {
       id: "canary-intercepted",
-      status: "not-exercised",
-      summary: "Pi exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter",
+      status: module ? "not-exercised" : "pass",
+      summary: module ? "Pi exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter" : "no HarnessTrim Pi canary applies because no extension is configured",
       achievedTier: null,
       evidence: [],
       remediation: null
@@ -12768,6 +12807,15 @@ function hookEntryFor(harnessId2, matcher) {
     hooks: [{ type: "command", command: `${RTK_HOOK_COMMAND_PREFIX} ${harnessId2}` }]
   };
 }
+function matcherCoversFamily2(matcher, family) {
+  if (matcher === family)
+    return true;
+  try {
+    return new RegExp(matcher).test(family);
+  } catch {
+    return false;
+  }
+}
 function planTargets(context, request) {
   const targets = /* @__PURE__ */ new Map();
   for (const owned of request.ownership) {
@@ -12787,12 +12835,32 @@ function planTargets(context, request) {
     const key = `${configPath}\0${point.eventName}\0${owned.scope.toolFamily}`;
     if (targets.has(key))
       continue;
-    targets.set(key, { scope: owned.scope, harness, eventName: point.eventName, configPath });
+    targets.set(key, {
+      scope: owned.scope,
+      harness,
+      eventName: point.eventName,
+      configPath
+    });
+  }
+  if (context.facts.os === "windows") {
+    for (const target of [...targets.values()]) {
+      if (target.harness.id !== CLAUDE3 || target.scope.toolFamily !== BASH)
+        continue;
+      if (!target.harness.toolFamilies.some((family) => family.id === POWERSHELL))
+        continue;
+      const key = `${target.configPath}\0${target.eventName}\0${POWERSHELL}`;
+      if (targets.has(key))
+        continue;
+      targets.set(key, {
+        ...target,
+        scope: { ...target.scope, toolFamily: POWERSHELL }
+      });
+    }
   }
   return [...targets.values()];
 }
-function alreadyRegistered(context, target, identifies) {
-  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.includes(target.scope.toolFamily) && config.commands.some((command) => identifies(command)));
+function alreadyRegistered(context, target, identifies, allowRegexCoverage) {
+  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.some((matcher) => allowRegexCoverage ? matcherCoversFamily2(matcher, target.scope.toolFamily) : matcher === target.scope.toolFamily) && config.commands.some((command) => identifies(command)));
 }
 function deterministicId(parts) {
   const digest = digestText(parts.join("\0"));
@@ -12930,7 +12998,7 @@ function buildRtkPlan(input) {
   const targetHarnesses = [...new Set(targets.map((target) => target.harness.id))];
   if (request.desiredState === "absent") {
     for (const target of targets) {
-      if (!alreadyRegistered(context, target, input.identifiesCommand))
+      if (!alreadyRegistered(context, target, input.identifiesCommand, false))
         continue;
       actions.push(removalAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
     }
@@ -12947,7 +13015,7 @@ function buildRtkPlan(input) {
       actions.push(install);
   }
   for (const target of targets) {
-    if (alreadyRegistered(context, target, input.identifiesCommand))
+    if (alreadyRegistered(context, target, input.identifiesCommand, true))
       continue;
     actions.push(hookAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
   }
@@ -12958,13 +13026,16 @@ function buildRtkPlan(input) {
     targetHarnesses: actions.length === 0 ? [] : targetHarnesses
   };
 }
-var RTK_HOOK_COMMAND_PREFIX, HOOK_LIST_HARNESSES;
+var RTK_HOOK_COMMAND_PREFIX, HOOK_LIST_HARNESSES, CLAUDE3, BASH, POWERSHELL;
 var init_rtk_plan = __esm({
   "packages/adapters/dist/src/providers/rtk-plan.js"() {
     "use strict";
     init_src();
     RTK_HOOK_COMMAND_PREFIX = "rtk hook";
     HOOK_LIST_HARNESSES = /* @__PURE__ */ new Set(["claude"]);
+    CLAUDE3 = "claude";
+    BASH = "Bash";
+    POWERSHELL = "PowerShell";
   }
 });
 
@@ -13158,7 +13229,7 @@ async function detect7(context) {
      * module `rtk init -g --opencode` installs globally, which this build has no action for. Saying
      * so here is what stops the resolver assigning a scope nothing can produce.
      */
-    assignableHarnesses: [CLAUDE3],
+    assignableHarnesses: [CLAUDE4],
     evidence: evidenceItems,
     warnings
   };
@@ -13477,14 +13548,14 @@ async function plan2(context, request) {
     installationChannels: MANIFEST7.installationChannels
   });
 }
-var RTK2, CLAUDE3, OPENCODE3, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
+var RTK2, CLAUDE4, OPENCODE3, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
 var init_rtk = __esm({
   "packages/adapters/dist/src/providers/rtk.js"() {
     "use strict";
     init_src();
     init_rtk_plan();
     RTK2 = providerId("rtk");
-    CLAUDE3 = harnessId("claude");
+    CLAUDE4 = harnessId("claude");
     OPENCODE3 = harnessId("opencode");
     MANIFEST7 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
@@ -13498,31 +13569,26 @@ var init_rtk = __esm({
         {
           capability: "shell.command.rewrite",
           mode: "exclusive",
-          harnesses: [CLAUDE3],
-          // The surface the Phase 2.5 spike actually watched: a `PreToolUse` hook matching
-          // `Bash`. `PowerShell` is deliberately absent — the spike ran the identical command
-          // through it and RTK's counter did not move, which is the coverage gap `doctor`
-          // reports as `tool-family-not-covered`. Claiming it here would make the resolver
-          // hand RTK a scope it demonstrably does not serve.
+          harnesses: [CLAUDE4],
+          // The portable resolver surface remains Bash. Windows PowerShell coverage is added by
+          // the planner only on Windows, because ProviderManifest capabilities are not platform-scoped.
+          // The native processor and that Windows-only plan path are covered by the live fixture below.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
-          // RFC 0003 §Rule wants the evidence recorded at a version. The reference is the
-          // hook the Phase 2.5 spike read, not a line of RTK's source: what was demonstrated
-          // is that the harness routes commands through it, which is the claim being made.
           evidence: {
-            sourceReference: "docs/spikes/2.5-live-verification-log.md",
-            upstreamVersion: "0.42.0"
+            sourceReference: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0/README.md",
+            upstreamVersion: "0.48.0"
           }
         },
         {
           capability: "shell.output.reduce",
           mode: "exclusive",
-          harnesses: [CLAUDE3],
-          // Same surface: RTK rewrites the command at `PreToolUse` and the rewritten command is
-          // what filters the output, so both capabilities are served from one interception point.
+          harnesses: [CLAUDE4],
+          // Same portable Bash surface. On Windows the planner adds PowerShell as a platform-only
+          // companion matcher; the live fixture below proves the same native processor handles both.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
           evidence: {
-            sourceReference: "docs/spikes/2.5-live-verification-log.md",
-            upstreamVersion: "0.42.0"
+            sourceReference: "tests/fixtures/rows/rtk-claude-windows-2.1.251-0.48.0/README.md",
+            upstreamVersion: "0.48.0"
           }
         },
         /**
@@ -13577,8 +13643,8 @@ var init_rtk = __esm({
       ],
       harnesses: [
         {
-          harness: CLAUDE3,
-          testedVersions: { minimum: "2.0.0", maximum: "2.1.212" },
+          harness: CLAUDE4,
+          testedVersions: { minimum: "2.0.0", maximum: "2.1.251" },
           verificationTier: "canary"
         },
         {
@@ -13648,7 +13714,7 @@ var init_rtk = __esm({
       },
       delegatedInstallReviews: null
     };
-    TESTED_VERSIONS2 = { minimum: "0.40.0", maximum: "0.44.0" };
+    TESTED_VERSIONS2 = { minimum: "0.44.0", maximum: "0.48.0" };
     VERSION_PATTERN7 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
     HOOK_COMMAND_PATTERN2 = /(^|[\\/\s"'])rtk(\.exe)?([\s"']|$)/i;
     PLUGIN_MODULE_PATTERN3 = /(^|[\\/])rtk\.(ts|js|mjs|cjs|mts|cts)$/i;
@@ -13679,7 +13745,7 @@ var init_contract2 = __esm({
 function listProviderAdapters() {
   return PROVIDER_ADAPTERS;
 }
-var PROVIDER_ADAPTERS;
+var cliHarnessTrimAdapter, PROVIDER_ADAPTERS;
 var init_providers = __esm({
   "packages/adapters/dist/src/providers/index.js"() {
     "use strict";
@@ -13688,7 +13754,18 @@ var init_providers = __esm({
     init_contract2();
     init_rtk();
     init_harnesstrim();
-    PROVIDER_ADAPTERS = [rtkAdapter, harnesstrimAdapter];
+    cliHarnessTrimAdapter = {
+      ...harnesstrimAdapter,
+      plansWithoutOwnership: false,
+      plan: (context, request) => {
+        const ownedHarnesses = new Set(request.ownership.map((entry) => entry.scope.harness));
+        return harnesstrimAdapter.plan(context, {
+          ...request,
+          harnesses: request.harnesses.filter((harness) => ownedHarnesses.has(harness.id))
+        });
+      }
+    };
+    PROVIDER_ADAPTERS = [rtkAdapter, cliHarnessTrimAdapter];
   }
 });
 
@@ -13787,15 +13864,15 @@ async function runBudget(context) {
     diagnostics: report.harnesses.flatMap((item) => item.diagnostics)
   });
 }
-var CLAUDE4, CODEX3, BUDGET_HARNESSES;
+var CLAUDE5, CODEX3, BUDGET_HARNESSES;
 var init_budget2 = __esm({
   "apps/cli/dist/src/commands/budget.js"() {
     "use strict";
     init_src3();
     init_src();
-    CLAUDE4 = harnessId("claude");
+    CLAUDE5 = harnessId("claude");
     CODEX3 = harnessId("codex");
-    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE4, CODEX3]);
+    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE5, CODEX3]);
   }
 });
 
@@ -14048,6 +14125,7 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
     profile: null,
     reservePercent: null,
     nativePolicy: false,
+    verbose: false,
     yes: false
   };
   let command = null;
@@ -14083,6 +14161,8 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
         options.yes = true;
       if (name === "--native-policy")
         options.nativePolicy = true;
+      if (name === "--verbose")
+        options.verbose = true;
       continue;
     }
     if (!VALUE_FLAGS.has(name)) {
@@ -14096,8 +14176,8 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
     }
     let value3 = inlineValue;
     if (value3 === null) {
-      const next = argv2[index + 1];
-      if (next === void 0 || next.startsWith("-")) {
+      const next2 = argv2[index + 1];
+      if (next2 === void 0 || next2.startsWith("-")) {
         diagnostics.push(diagnostic({
           severity: "error",
           code: "flag-missing-value",
@@ -14106,7 +14186,7 @@ function parseArgv(argv2, plannedCommands = PLANNED_COMMANDS) {
         }));
         continue;
       }
-      value3 = next;
+      value3 = next2;
       index += 1;
     }
     if (value3 === "") {
@@ -14324,6 +14404,7 @@ var init_argv = __esm({
       "optimize",
       "plan",
       "rollback",
+      "setup",
       "status",
       "uninstall",
       "update",
@@ -14348,7 +14429,7 @@ var init_argv = __esm({
       "--profile",
       "--reserve"
     ]);
-    BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--json", "--native-policy", "--yes"]);
+    BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--json", "--native-policy", "--verbose", "--yes"]);
   }
 });
 
@@ -14494,7 +14575,7 @@ async function claudeInstructionFiles(context) {
   const results = [];
   for (const candidate of candidates) {
     const item = await fileObservation(context, {
-      harnessId: CLAUDE5,
+      harnessId: CLAUDE6,
       path: candidate.path,
       scope: candidate.scope,
       loadedBytes: null
@@ -14565,7 +14646,7 @@ async function runContext(context) {
   if (codex !== void 0 && codex.state !== "absent") {
     report.instructions.push(...await codexInstructionFiles(context, codex));
   }
-  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE5);
+  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE6);
   if (claude !== void 0 && claude.state !== "absent") {
     report.instructions.push(...await claudeInstructionFiles(context));
   }
@@ -14611,15 +14692,15 @@ async function runContext(context) {
     diagnostics: [...report.harnesses.flatMap((item) => item.diagnostics), ...hierarchyDiagnostics]
   });
 }
-var CLAUDE5, CODEX4, CONTEXT_HARNESSES;
+var CLAUDE6, CODEX4, CONTEXT_HARNESSES;
 var init_context_cost2 = __esm({
   "apps/cli/dist/src/commands/context-cost.js"() {
     "use strict";
     init_src3();
     init_src();
-    CLAUDE5 = harnessId("claude");
+    CLAUDE6 = harnessId("claude");
     CODEX4 = harnessId("codex");
-    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE5, CODEX4]);
+    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE6, CODEX4]);
   }
 });
 
@@ -14640,7 +14721,7 @@ function stringArray(value3) {
   return array(value3).filter((item) => typeof item === "string");
 }
 function normalizedHarness(value3) {
-  return value3 === "claude" ? CLAUDE6 : value3 === "codex" ? CODEX5 : null;
+  return value3 === "claude" ? CLAUDE7 : value3 === "codex" ? CODEX5 : null;
 }
 function totals(row2) {
   const inputTokens = number(row2["inputTokens"]);
@@ -14948,7 +15029,7 @@ async function runHistory(context) {
   const filterHarness = context.harness;
   const daily = dailyRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => left.period.localeCompare(right.period));
   const sessions = sessionRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => (left.lastActivity ?? "").localeCompare(right.lastActivity ?? ""));
-  const harnesses = [CLAUDE6, CODEX5].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
+  const harnesses = [CLAUDE7, CODEX5].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
   const report = {
     ...blankReport(context, window.windowStart, window.windowEnd, "available", version3, []),
     daily,
@@ -14961,15 +15042,15 @@ async function runHistory(context) {
     data: report
   });
 }
-var SUPPORTED_CCUSAGE_MAJOR, CLAUDE6, CODEX5, HISTORY_HARNESSES;
+var SUPPORTED_CCUSAGE_MAJOR, CLAUDE7, CODEX5, HISTORY_HARNESSES;
 var init_history2 = __esm({
   "apps/cli/dist/src/commands/history.js"() {
     "use strict";
     init_src();
     SUPPORTED_CCUSAGE_MAJOR = 20;
-    CLAUDE6 = harnessId("claude");
+    CLAUDE7 = harnessId("claude");
     CODEX5 = harnessId("codex");
-    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE6, CODEX5]);
+    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE7, CODEX5]);
   }
 });
 
@@ -14993,7 +15074,7 @@ function contextEvidence(context, harness) {
   const hasUnknownTools = harness.mcpServers.some((server) => server.toolCount === null);
   const evidence2 = [];
   let score = 0;
-  if (harness.projectDocMaxBytes !== null && harness.projectDocMaxBytes > 0) {
+  if (harness.projectDocMaxBytes !== null && harness.projectDocMaxBytes > 0 && instructionBytes > 0) {
     const ratio = instructionBytes / harness.projectDocMaxBytes;
     if (ratio >= 0.75)
       score = Math.max(score, 2);
@@ -16473,7 +16554,7 @@ async function runBenchmarkFinish(context) {
     diagnostics: [...budgetResult.diagnostics, ...historyResult.diagnostics]
   });
 }
-var CLAUDE7, CODEX7, CAPTURE_HARNESSES;
+var CLAUDE8, CODEX7, CAPTURE_HARNESSES;
 var init_benchmark_capture = __esm({
   "apps/cli/dist/src/commands/benchmark-capture.js"() {
     "use strict";
@@ -16481,9 +16562,9 @@ var init_benchmark_capture = __esm({
     init_budget2();
     init_context_cost2();
     init_history2();
-    CLAUDE7 = harnessId("claude");
+    CLAUDE8 = harnessId("claude");
     CODEX7 = harnessId("codex");
-    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE7, CODEX7]);
+    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE8, CODEX7]);
   }
 });
 
@@ -17363,129 +17444,486 @@ var init_rollback = __esm({
   }
 });
 
-// apps/cli/dist/src/commands/update.js
-function transactionIdFor2(seed, at) {
-  const digest = digestText(`${seed} ${at}`);
-  return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 13);
-}
-function emptyExecution(outcome2) {
-  return {
-    planId: null,
-    transactionId: null,
-    fromStoredPlan: false,
-    outcome: outcome2,
-    results: [],
-    unrestored: [],
-    receiptId: null
+// apps/cli/dist/src/commands/verify.js
+async function runVerify(context) {
+  const diagnostics = [];
+  const results = [];
+  if (context.adapters === null) {
+    return commandResult({
+      command: "verify",
+      exitCode: EXIT_CODES.ok,
+      data: { receiptId: null, appliedAt: null, results: [], healthyAtDeclaredTier: true },
+      diagnostics: [
+        diagnostic({
+          severity: "info",
+          code: "nothing-to-verify",
+          message: "No harness was inspected, so there is nothing to verify",
+          remediation: null
+        })
+      ]
+    });
+  }
+  const detectionContext = {
+    fs: context.adapters.fs,
+    runner: context.adapters.runner,
+    facts: context.platform,
+    paths: context.adapters.paths,
+    projectRoot: context.projectRoot
+  };
+  const harnessConfigs = [];
+  const presentHarnesses = [];
+  for (const adapter of listHarnessAdapters()) {
+    if (context.harness !== null && adapter.manifest.id !== context.harness)
+      continue;
+    const detection = await adapter.detect(detectionContext);
+    if (detection.state === "absent")
+      continue;
+    presentHarnesses.push(adapter.manifest.id);
+    const verification = await adapter.verify(detectionContext);
+    for (const check of verification.checks) {
+      if (check.status === "pass")
+        continue;
+      diagnostics.push(diagnostic({
+        severity: check.status === "fail" ? "warning" : "info",
+        code: `harness-${check.id}`,
+        message: `${adapter.manifest.displayName}: ${check.summary}`,
+        remediation: check.remediation
+      }));
+    }
+    const inspection = await adapter.inspect(detectionContext);
+    harnessConfigs.push(...inspection.summaries);
+    diagnostics.push(...inspection.diagnostics);
+  }
+  const managedIntegrations2 = await readManagedIntegrations(context);
+  const providerContext = {
+    ...detectionContext,
+    harnessConfigs,
+    now: context.now,
+    localDatabase: context.adapters.localDatabase,
+    projectIdFor: context.adapters.projectIdFor
+  };
+  for (const adapter of listProviderAdapters()) {
+    if (context.provider !== null && adapter.manifest.id !== context.provider)
+      continue;
+    const detection = await adapter.detect(providerContext);
+    if (detection.state === "absent")
+      continue;
+    const verification = await adapter.verify(providerContext);
+    diagnostics.push(...verification.diagnostics);
+    const harnesses = detection.configuredHarnesses.length > 0 ? detection.configuredHarnesses : (
+      // Installed but wired to nothing: still worth a row, on every present harness, because
+      // "installed and not connected here" is the finding.
+      presentHarnesses
+    );
+    for (const harnessId2 of harnesses) {
+      const declaredTier = adapter.manifest.harnesses.find((entry) => entry.harness === harnessId2)?.verificationTier ?? verification.declaredTier;
+      results.push({
+        providerId: adapter.manifest.id,
+        harnessId: harnessId2,
+        status: statusFor(verification.achievedTier, declaredTier),
+        declaredTier,
+        managedByTokenHarness: managedIntegrations2.has(`${adapter.manifest.id}\0${harnessId2}`),
+        providerManagedByTokenHarness: detection.managedByTokenHarness,
+        checks: verification.checks
+      });
+    }
+  }
+  const receipts = context.metrics === null ? [] : await readReceipts(context);
+  const latest = receipts[0] ?? null;
+  const failures = results.flatMap((result2) => result2.checks.filter(contributesToProblems));
+  const report = {
+    receiptId: latest?.receiptId ?? null,
+    appliedAt: latest?.appliedAt ?? null,
+    results,
+    healthyAtDeclaredTier: failures.length === 0
   };
+  return commandResult({
+    command: "verify",
+    exitCode: failures.length === 0 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+    data: report,
+    diagnostics
+  });
 }
-async function managedIntegrations(context) {
-  const empty2 = { integrations: [], legacyOwnershipUnknown: false };
+async function readManagedIntegrations(context) {
+  const managed = /* @__PURE__ */ new Set();
   if (context.adapters === null || context.stateRoot === null)
-    return empty2;
+    return managed;
   const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
   if (await context.adapters.fs.stat(journalRoot) === null)
-    return empty2;
+    return managed;
+  const projectId = context.adapters.projectIdFor(context.projectRoot);
   const store = new FileJournalStore({
     fs: context.adapters.fs,
     journalRoot,
     backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
   });
-  const seen = /* @__PURE__ */ new Set();
-  const result2 = [];
-  let legacyOwnershipUnknown = false;
   for (const journal of await store.list()) {
-    if (journal.outcome !== "committed")
+    if (journal.outcome !== "committed" || journal.projectId !== projectId)
       continue;
-    if (journal.managedIntegrations === void 0 && journal.ownership.length > 0) {
-      legacyOwnershipUnknown = true;
-    }
     for (const integration of journal.managedIntegrations ?? []) {
-      const key = `${integration.providerId}\0${integration.harnessId}`;
-      if (seen.has(key))
-        continue;
-      seen.add(key);
-      result2.push(integration);
+      managed.add(`${integration.providerId}\0${integration.harnessId}`);
     }
   }
-  return { integrations: result2, legacyOwnershipUnknown };
+  return managed;
 }
-function upgradeAction(input) {
-  const digest = digestText(`${input.providerId} update ${input.channel} ${input.target}`);
-  return {
-    kind: "package-manager-install",
-    id: digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 9),
-    // The same class the install action uses, for the same reason: an installed package is not
-    // reversed by restoring a file.
-    riskClass: "delegated",
-    requiresNetwork: input.requiresNetwork,
-    requiresElevation: input.requiresElevation,
-    affectedPaths: [],
-    affectedProcesses: [input.channel],
-    preconditions: [
-      `${input.channel} is available on this machine`,
-      `${input.packageName} is installed at ${input.installed}`
-    ],
-    postconditions: [`${input.packageName} reports ${input.target}`],
-    /**
-     * `package-inventory` where the channel can report what is installed, `none` otherwise.
-     *
-     * An update replaces a binary. Rolling the transaction back restores files and leaves the new
-     * version in place, so the executor's receipt is not boilerplate here — it is the difference
-     * between the machine being restored and the *configuration* being restored. With an
-     * inventory-capturing channel the rollback also reinstalls the previous version, and the
-     * receipt says per package whether that reinstall took.
-     */
-    rollbackData: channelCanReportInventory(input.channel) ? "package-inventory" : "none",
-    explanation: `Update ${input.packageName} from ${input.installed} to ${input.target} through ${input.channel}`,
-    packageManager: input.channel,
-    packageName: input.packageName,
-    // Pinned to the exact version the channel reported, not left open. An unpinned upgrade would
-    // install whatever is newest at execution time, which is not the version the dry run showed.
-    version: input.target
-  };
+async function readReceipts(context) {
+  const store = context.metrics;
+  if (store?.listReceipts === void 0)
+    return [];
+  try {
+    return await store.listReceipts();
+  } catch {
+    return [];
+  }
 }
-async function runUpdate(context) {
-  const diagnostics = [];
-  const report = { providers: [], network: [], execution: null };
-  const finish3 = (exitCode, data) => commandResult({
-    command: "update",
-    exitCode,
-    // RFC 0006: `data` is null when the status is `error`, and the human renderer must read the
-    // same object it serializes — the defect `apply` already had to fix.
-    data: statusForExitCode(exitCode) === "error" ? null : data,
-    diagnostics
-  });
-  if (context.adapters === null) {
-    diagnostics.push(diagnostic({
-      severity: "error",
-      code: "unsupported-environment",
-      message: "No platform adapters are available, so no channel can be consulted",
-      remediation: null
-    }));
-    return finish3(EXIT_CODES["unsupported-environment"], null);
+function statusFor(achieved, declared) {
+  const order = ["presence", "config-only", "canary", "live-receipt"];
+  if (achieved === null)
+    return "not-applicable";
+  const reached = order.indexOf(achieved);
+  const promised = order.indexOf(declared);
+  if (reached < 0 || promised < 0)
+    return "not-applicable";
+  return reached >= promised ? "healthy" : "degraded";
+}
+var init_verify = __esm({
+  "apps/cli/dist/src/commands/verify.js"() {
+    "use strict";
+    init_src3();
+    init_src();
   }
-  const adapters = context.adapters;
-  const providerAdapters = listProviderAdapters().filter((adapter) => context.provider === null || adapter.manifest.id === context.provider);
-  const managedState = await managedIntegrations(context);
-  const managed = managedState.integrations;
-  const managedHarnessIds = new Set(managed.map((entry) => entry.harnessId));
-  const harnessVersions = /* @__PURE__ */ new Map();
-  if (managedHarnessIds.size > 0) {
-    const harnessContext = {
-      fs: adapters.fs,
-      runner: adapters.runner,
-      facts: context.platform,
-      paths: adapters.paths,
-      projectRoot: context.projectRoot
+});
+
+// apps/cli/dist/src/commands/setup.js
+function uniqueDiagnostics(groups) {
+  const seen = /* @__PURE__ */ new Set();
+  return groups.flatMap((group) => group.filter((entry) => {
+    const key = `${entry.severity}\0${entry.code}\0${entry.message}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  }));
+}
+async function runSetup(context, operations = DEFAULT_OPERATIONS) {
+  const doctor = await operations.doctor(context);
+  const detectedHarnesses = (doctor.data?.harnesses ?? []).filter((harness) => harness.state !== "absent" && (context.harness !== null ? harness.harnessId === context.harness : harness.harnessId === "claude" || harness.harnessId === "codex"));
+  const baseDoctor = doctor.data;
+  if (baseDoctor === null) {
+    return commandResult({
+      command: "setup",
+      exitCode: doctor.exitCode,
+      diagnostics: doctor.diagnostics
+    });
+  }
+  if (detectedHarnesses.length === 0) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES.ok,
+      data: {
+        stage: "needs-harness",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: null,
+          description: "Install and sign in to Claude Code or Codex, then run setup again."
+        }
+      },
+      diagnostics: doctor.diagnostics
+    });
+  }
+  const setupHarnessIds = new Set(detectedHarnesses.map((harness) => harness.harnessId));
+  const hasBrokenSetupIntegration = detectedHarnesses.some((harness) => harness.state === "broken") || baseDoctor.providers.some((provider) => provider.state === "broken" && provider.configuredHarnesses.some((harness) => setupHarnessIds.has(harness)));
+  if (hasBrokenSetupIntegration) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES["problems-found"],
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness doctor --verbose",
+          description: "Review the broken active integration before changing configuration."
+        }
+      },
+      diagnostics: doctor.diagnostics
+    });
+  }
+  const presentIds = new Set(detectedHarnesses.map((harness) => harness.harnessId));
+  const hasActiveProvider = baseDoctor.providers.some((provider) => provider.state === "configured" && provider.configuredHarnesses.some((harness) => presentIds.has(harness)));
+  if (hasActiveProvider) {
+    const activeHarness = context.harness ?? detectedHarnesses.find((harness) => baseDoctor.providers.some((provider) => provider.configuredHarnesses.includes(harness.harnessId)))?.harnessId ?? null;
+    const observationContext = { ...context, harness: activeHarness };
+    const [verify9, budget2] = await Promise.all([
+      operations.verify(observationContext),
+      operations.budget(observationContext)
+    ]);
+    const healthy2 = verify9.data?.healthyAtDeclaredTier === true;
+    return commandResult({
+      command: "setup",
+      exitCode: healthy2 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+      data: {
+        stage: healthy2 ? "ready" : "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: null,
+        apply: null,
+        verify: verify9.data,
+        budget: budget2.data,
+        nextStep: healthy2 ? {
+          command: "token-harness ui",
+          description: "Open the dashboard once to review status; then use your coding agent normally."
+        } : {
+          command: "token-harness verify --verbose",
+          description: "Review the failed integration check."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, verify9.diagnostics, budget2.diagnostics])
+    });
+  }
+  const preferredHarness = context.harness ?? detectedHarnesses.find((harness) => harness.harnessId === "codex")?.harnessId ?? detectedHarnesses[0]?.harnessId ?? null;
+  const setupContext = { ...context, harness: preferredHarness };
+  const plan3 = await operations.plan(setupContext);
+  if (plan3.data === null || plan3.exitCode !== EXIT_CODES.ok || plan3.data.actions.length === 0 || !plan3.data.persisted) {
+    return commandResult({
+      command: "setup",
+      exitCode: plan3.exitCode === EXIT_CODES.ok ? EXIT_CODES["problems-found"] : plan3.exitCode,
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness plan --verbose",
+          description: "Review why no safe automatic configuration is available."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics])
+    });
+  }
+  if (!context.confirmed) {
+    return commandResult({
+      command: "setup",
+      exitCode: EXIT_CODES.ok,
+      data: {
+        stage: "ready-to-configure",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: null,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness setup --yes",
+          description: "Apply the reviewed, reversible configuration."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics])
+    });
+  }
+  const applied = await operations.apply({
+    ...setupContext,
+    planId: plan3.data.planId,
+    confirmed: true
+  });
+  if (applied.data?.outcome !== "committed" && applied.data?.outcome !== "nothing-to-do") {
+    return commandResult({
+      command: "setup",
+      exitCode: applied.exitCode,
+      data: {
+        stage: "attention",
+        changed: false,
+        doctor: baseDoctor,
+        plan: plan3.data,
+        apply: applied.data,
+        verify: null,
+        budget: null,
+        nextStep: {
+          command: "token-harness verify --verbose",
+          description: "Review the configuration result before continuing."
+        }
+      },
+      diagnostics: uniqueDiagnostics([doctor.diagnostics, plan3.diagnostics, applied.diagnostics])
+    });
+  }
+  const [verify8, budget] = await Promise.all([
+    operations.verify(setupContext),
+    operations.budget(setupContext)
+  ]);
+  const healthy = verify8.data?.healthyAtDeclaredTier === true;
+  const changed = applied.data?.results.some((result2) => result2.status === "applied") === true;
+  return commandResult({
+    command: "setup",
+    exitCode: healthy ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+    data: {
+      stage: healthy ? "ready" : "attention",
+      changed,
+      doctor: baseDoctor,
+      plan: plan3.data,
+      apply: applied.data,
+      verify: verify8.data,
+      budget: budget.data,
+      nextStep: healthy ? {
+        command: "token-harness ui",
+        description: "Open the dashboard once to review status; then use your coding agent normally."
+      } : {
+        command: "token-harness verify --verbose",
+        description: "Review the failed integration check."
+      }
+    },
+    diagnostics: uniqueDiagnostics([
+      doctor.diagnostics,
+      plan3.diagnostics,
+      applied.diagnostics,
+      verify8.diagnostics,
+      budget.diagnostics
+    ])
+  });
+}
+var DEFAULT_OPERATIONS;
+var init_setup2 = __esm({
+  "apps/cli/dist/src/commands/setup.js"() {
+    "use strict";
+    init_src();
+    init_apply();
+    init_budget2();
+    init_doctor();
+    init_plan2();
+    init_verify();
+    DEFAULT_OPERATIONS = {
+      doctor: runDoctor,
+      plan: runPlan,
+      apply: runApply,
+      verify: runVerify,
+      budget: runBudget
     };
-    for (const harness of listHarnessAdapters()) {
-      if (!managedHarnessIds.has(harness.manifest.id))
+  }
+});
+
+// apps/cli/dist/src/commands/update.js
+function transactionIdFor2(seed, at) {
+  const digest = digestText(`${seed} ${at}`);
+  return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 13);
+}
+function emptyExecution(outcome2) {
+  return {
+    planId: null,
+    transactionId: null,
+    fromStoredPlan: false,
+    outcome: outcome2,
+    results: [],
+    unrestored: [],
+    receiptId: null
+  };
+}
+async function managedIntegrations(context) {
+  const empty2 = { integrations: [], legacyOwnershipUnknown: false };
+  if (context.adapters === null || context.stateRoot === null)
+    return empty2;
+  const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
+  if (await context.adapters.fs.stat(journalRoot) === null)
+    return empty2;
+  const store = new FileJournalStore({
+    fs: context.adapters.fs,
+    journalRoot,
+    backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const result2 = [];
+  let legacyOwnershipUnknown = false;
+  for (const journal of await store.list()) {
+    if (journal.outcome !== "committed")
+      continue;
+    if (journal.managedIntegrations === void 0 && journal.ownership.length > 0) {
+      legacyOwnershipUnknown = true;
+    }
+    for (const integration of journal.managedIntegrations ?? []) {
+      const key = `${integration.providerId}\0${integration.harnessId}`;
+      if (seen.has(key))
         continue;
-      const detection = await harness.detect(harnessContext);
-      harnessVersions.set(harness.manifest.id, detection.version);
+      seen.add(key);
+      result2.push(integration);
     }
   }
+  return { integrations: result2, legacyOwnershipUnknown };
+}
+function upgradeAction(input) {
+  const digest = digestText(`${input.providerId} update ${input.channel} ${input.target}`);
+  return {
+    kind: "package-manager-install",
+    id: digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 9),
+    riskClass: "delegated",
+    requiresNetwork: input.requiresNetwork,
+    requiresElevation: input.requiresElevation,
+    affectedPaths: [],
+    affectedProcesses: [input.channel],
+    preconditions: [
+      `${input.channel} is available on this machine`,
+      `${input.packageName} is installed at ${input.installed}`
+    ],
+    postconditions: [`${input.packageName} reports ${input.target}`],
+    rollbackData: channelCanReportInventory(input.channel) ? "package-inventory" : "none",
+    explanation: `Update ${input.packageName} from ${input.installed} to ${input.target} through ${input.channel}`,
+    packageManager: input.channel,
+    packageName: input.packageName,
+    version: input.target
+  };
+}
+async function runUpdate(context) {
+  const diagnostics = [];
+  const report = { providers: [], network: [], execution: null };
+  const finish3 = (exitCode, data) => commandResult({
+    command: "update",
+    exitCode,
+    data: statusForExitCode(exitCode) === "error" ? null : data,
+    diagnostics
+  });
+  if (context.adapters === null) {
+    diagnostics.push(diagnostic({
+      severity: "error",
+      code: "unsupported-environment",
+      message: "No platform adapters are available, so no channel can be consulted",
+      remediation: null
+    }));
+    return finish3(EXIT_CODES["unsupported-environment"], null);
+  }
+  const adapters = context.adapters;
+  const providerAdapters = listProviderAdapters().filter((adapter) => context.provider === null || adapter.manifest.id === context.provider);
+  const managedState = await managedIntegrations(context);
+  const managed = managedState.integrations;
+  const harnessAdapters = listHarnessAdapters();
+  const managedHarnessIds = new Set(managed.map((entry) => entry.harnessId));
+  if (managedState.legacyOwnershipUnknown) {
+    for (const harness of harnessAdapters)
+      managedHarnessIds.add(harness.manifest.id);
+  }
+  const harnessContext = {
+    fs: adapters.fs,
+    runner: adapters.runner,
+    facts: context.platform,
+    paths: adapters.paths,
+    projectRoot: context.projectRoot
+  };
+  const harnessVersions = /* @__PURE__ */ new Map();
+  for (const harness of harnessAdapters) {
+    if (!managedHarnessIds.has(harness.manifest.id))
+      continue;
+    const detection = await harness.detect(harnessContext);
+    harnessVersions.set(harness.manifest.id, detection.version);
+  }
+  const recoveryHarnessConfigs = managedState.legacyOwnershipUnknown ? (await Promise.all(harnessAdapters.map(async (harness) => (await harness.inspect(harnessContext)).summaries))).flat() : [];
   const pins = context.stateRoot === null ? { pins: /* @__PURE__ */ new Map(), unhonoredProjectPinPath: null, diagnostics: [] } : await readPins({
     fs: adapters.fs,
     stateRoot: context.stateRoot,
@@ -17498,7 +17936,7 @@ async function runUpdate(context) {
     facts: context.platform,
     paths: adapters.paths,
     projectRoot: context.projectRoot,
-    harnessConfigs: [],
+    harnessConfigs: recoveryHarnessConfigs,
     now: context.now,
     localDatabase: adapters.localDatabase,
     projectIdFor: adapters.projectIdFor
@@ -17561,22 +17999,18 @@ async function runUpdate(context) {
       report.providers.push(row2);
       continue;
     }
-    const managedHarnesses = managed.filter((entry) => entry.providerId === adapter.manifest.id);
-    let updateAdmitted = !managedState.legacyOwnershipUnknown;
+    const compatibilityHarnessIds = new Set(managed.filter((entry) => entry.providerId === adapter.manifest.id).map((entry) => entry.harnessId));
     if (managedState.legacyOwnershipUnknown) {
-      blockedUpdates.push({
-        providerId: adapter.manifest.id,
-        target: query.version,
-        harnessId: "legacy-owned-state",
-        missing: "a committed pre-attribution journal owns configuration but does not identify its provider and harness"
-      });
+      for (const harnessId2 of detection.configuredHarnesses)
+        compatibilityHarnessIds.add(harnessId2);
     }
-    for (const integration of managedHarnesses) {
+    let updateAdmitted = true;
+    for (const harnessId2 of compatibilityHarnessIds) {
       const admission = admitManagedMutation(context.compatibilityRows ?? COMPATIBILITY_ROWS, {
         provider: adapter.manifest.id,
         providerVersion: query.version,
-        harness: integration.harnessId,
-        harnessVersion: harnessVersions.get(integration.harnessId) ?? null,
+        harness: harnessId2,
+        harnessVersion: harnessVersions.get(harnessId2) ?? null,
         os: context.platform.os,
         wsl: context.platform.isWsl
       });
@@ -17585,8 +18019,9 @@ async function runUpdate(context) {
       updateAdmitted = false;
       blockedUpdates.push({
         providerId: adapter.manifest.id,
+        installed: detection.version,
         target: query.version,
-        harnessId: integration.harnessId,
+        harnessId: harnessId2,
         missing: admission.missing
       });
     }
@@ -17608,20 +18043,25 @@ async function runUpdate(context) {
     }));
   }
   report.network = [...destinations].sort();
-  const blockedIsOutcome = blockedUpdates.length > 0 && actions.length === 0;
   for (const blocked of blockedUpdates) {
     diagnostics.push(diagnostic({
-      severity: blockedIsOutcome ? "error" : "warning",
+      severity: "info",
       code: "managed-update-blocked",
-      message: `update refuses ${blocked.providerId} ${blocked.target} on managed ${blocked.harnessId}: ${blocked.missing}`,
-      remediation: "Record a compatibility row and fixture for the target version before updating this managed integration"
+      message: `${blocked.providerId} ${blocked.target} is available but is not validated for ${blocked.harnessId}; keeping ${blocked.installed ?? "the installed version"}`,
+      remediation: "No action is required; Token Harness will allow the update after this combination has reviewed compatibility evidence"
+    }));
+    diagnostics.push(diagnostic({
+      severity: "info",
+      code: "managed-update-blocked-detail",
+      message: `${blocked.providerId} ${blocked.target} compatibility evidence is missing: ${blocked.missing}`,
+      remediation: null
     }));
   }
   if (pins.unhonoredProjectPinPath !== null) {
   }
   if (actions.length === 0 && blockedUpdates.length > 0) {
-    report.execution = emptyExecution("rejected");
-    return finish3(EXIT_CODES["unsupported-environment"], report);
+    report.execution = emptyExecution("nothing-to-do");
+    return finish3(EXIT_CODES.ok, report);
   }
   if (actions.length === 0) {
     report.execution = emptyExecution("nothing-to-do");
@@ -17638,7 +18078,6 @@ async function runUpdate(context) {
     diagnostics.push(diagnostic({
       severity: "error",
       code: "confirmation-required",
-      // In the message and not only in `data`: exit 8 is an `error` status, so `data` is null.
       message: `Would update ${summary}`,
       remediation: "Re-run with `--yes` to apply it"
     }));
@@ -17664,200 +18103,48 @@ async function runUpdate(context) {
     projectRoot: context.projectRoot,
     now: context.now
   });
-  if (!creation.ok) {
-    diagnostics.push(...creation.diagnostics);
-    return finish3(EXIT_CODES["unsupported-environment"], null);
-  }
-  const transaction = await executeTransaction({
-    transactionId,
-    planId: null,
-    projectId: adapters.projectIdFor(context.projectRoot),
-    projectRoot: context.projectRoot,
-    actions,
-    fs,
-    snapshots: creation.store,
-    journal: new FileJournalStore({
-      fs,
-      journalRoot: fs.join(context.stateRoot, "journals"),
-      backupRoot: fs.join(context.stateRoot, "backups")
-    }),
-    runner: adapters.runner,
-    now: context.now
-  });
-  diagnostics.push(...transaction.diagnostics);
-  report.execution = {
-    planId: null,
-    transactionId,
-    fromStoredPlan: false,
-    // Mapped the way `apply` maps it: `in-progress` is not a terminal outcome a report may
-    // carry, and anything that is not one of the three known ends is a rejection.
-    outcome: transaction.journal.outcome === "committed" ? "committed" : transaction.journal.outcome === "rolled-back" ? "rolled-back" : transaction.journal.outcome === "dirty" ? "dirty" : "rejected",
-    results: transaction.journal.entries.map((entry) => ({
-      actionId: entry.actionId,
-      kind: entry.kind,
-      status: entry.status,
-      path: null
-    })),
-    unrestored: transaction.unrestored,
-    receiptId: transaction.journal.outcome === "committed" ? transactionId : null
-  };
-  return finish3(transaction.exitCode, report);
-}
-var init_update = __esm({
-  "apps/cli/dist/src/commands/update.js"() {
-    "use strict";
-    init_src();
-    init_src3();
-  }
-});
-
-// apps/cli/dist/src/commands/verify.js
-async function runVerify(context) {
-  const diagnostics = [];
-  const results = [];
-  if (context.adapters === null) {
-    return commandResult({
-      command: "verify",
-      exitCode: EXIT_CODES.ok,
-      data: { receiptId: null, appliedAt: null, results: [], healthyAtDeclaredTier: true },
-      diagnostics: [
-        diagnostic({
-          severity: "info",
-          code: "nothing-to-verify",
-          message: "No harness was inspected, so there is nothing to verify",
-          remediation: null
-        })
-      ]
-    });
-  }
-  const detectionContext = {
-    fs: context.adapters.fs,
-    runner: context.adapters.runner,
-    facts: context.platform,
-    paths: context.adapters.paths,
-    projectRoot: context.projectRoot
-  };
-  const harnessConfigs = [];
-  const presentHarnesses = [];
-  for (const adapter of listHarnessAdapters()) {
-    if (context.harness !== null && adapter.manifest.id !== context.harness)
-      continue;
-    const detection = await adapter.detect(detectionContext);
-    if (detection.state === "absent")
-      continue;
-    presentHarnesses.push(adapter.manifest.id);
-    const verification = await adapter.verify(detectionContext);
-    for (const check of verification.checks) {
-      if (check.status === "pass")
-        continue;
-      diagnostics.push(diagnostic({
-        severity: check.status === "fail" ? "warning" : "info",
-        code: `harness-${check.id}`,
-        message: `${adapter.manifest.displayName}: ${check.summary}`,
-        remediation: check.remediation
-      }));
-    }
-    const inspection = await adapter.inspect(detectionContext);
-    harnessConfigs.push(...inspection.summaries);
-    diagnostics.push(...inspection.diagnostics);
-  }
-  const managedIntegrations2 = await readManagedIntegrations(context);
-  const providerContext = {
-    ...detectionContext,
-    harnessConfigs,
-    now: context.now,
-    localDatabase: context.adapters.localDatabase,
-    projectIdFor: context.adapters.projectIdFor
-  };
-  for (const adapter of listProviderAdapters()) {
-    if (context.provider !== null && adapter.manifest.id !== context.provider)
-      continue;
-    const detection = await adapter.detect(providerContext);
-    if (detection.state === "absent")
-      continue;
-    const verification = await adapter.verify(providerContext);
-    diagnostics.push(...verification.diagnostics);
-    const harnesses = detection.configuredHarnesses.length > 0 ? detection.configuredHarnesses : (
-      // Installed but wired to nothing: still worth a row, on every present harness, because
-      // "installed and not connected here" is the finding.
-      presentHarnesses
-    );
-    for (const harnessId2 of harnesses) {
-      const declaredTier = adapter.manifest.harnesses.find((entry) => entry.harness === harnessId2)?.verificationTier ?? verification.declaredTier;
-      results.push({
-        providerId: adapter.manifest.id,
-        harnessId: harnessId2,
-        status: statusFor(verification.achievedTier, declaredTier),
-        declaredTier,
-        managedByTokenHarness: managedIntegrations2.has(`${adapter.manifest.id}\0${harnessId2}`),
-        providerManagedByTokenHarness: detection.managedByTokenHarness,
-        checks: verification.checks
-      });
-    }
-  }
-  const receipts = context.metrics === null ? [] : await readReceipts(context);
-  const latest = receipts[0] ?? null;
-  const failures = results.flatMap((result2) => result2.checks.filter(contributesToProblems));
-  const report = {
-    receiptId: latest?.receiptId ?? null,
-    appliedAt: latest?.appliedAt ?? null,
-    results,
-    healthyAtDeclaredTier: failures.length === 0
-  };
-  return commandResult({
-    command: "verify",
-    exitCode: failures.length === 0 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
-    data: report,
-    diagnostics
-  });
-}
-async function readManagedIntegrations(context) {
-  const managed = /* @__PURE__ */ new Set();
-  if (context.adapters === null || context.stateRoot === null)
-    return managed;
-  const journalRoot = context.adapters.fs.join(context.stateRoot, "journals");
-  if (await context.adapters.fs.stat(journalRoot) === null)
-    return managed;
-  const projectId = context.adapters.projectIdFor(context.projectRoot);
-  const store = new FileJournalStore({
-    fs: context.adapters.fs,
-    journalRoot,
-    backupRoot: context.adapters.fs.join(context.stateRoot, "backups")
-  });
-  for (const journal of await store.list()) {
-    if (journal.outcome !== "committed" || journal.projectId !== projectId)
-      continue;
-    for (const integration of journal.managedIntegrations ?? []) {
-      managed.add(`${integration.providerId}\0${integration.harnessId}`);
-    }
-  }
-  return managed;
-}
-async function readReceipts(context) {
-  const store = context.metrics;
-  if (store?.listReceipts === void 0)
-    return [];
-  try {
-    return await store.listReceipts();
-  } catch {
-    return [];
+  if (!creation.ok) {
+    diagnostics.push(...creation.diagnostics);
+    return finish3(EXIT_CODES["unsupported-environment"], null);
   }
+  const transaction = await executeTransaction({
+    transactionId,
+    planId: null,
+    projectId: adapters.projectIdFor(context.projectRoot),
+    projectRoot: context.projectRoot,
+    actions,
+    fs,
+    snapshots: creation.store,
+    journal: new FileJournalStore({
+      fs,
+      journalRoot: fs.join(context.stateRoot, "journals"),
+      backupRoot: fs.join(context.stateRoot, "backups")
+    }),
+    runner: adapters.runner,
+    now: context.now
+  });
+  diagnostics.push(...transaction.diagnostics);
+  report.execution = {
+    planId: null,
+    transactionId,
+    fromStoredPlan: false,
+    outcome: transaction.journal.outcome === "committed" ? "committed" : transaction.journal.outcome === "rolled-back" ? "rolled-back" : transaction.journal.outcome === "dirty" ? "dirty" : "rejected",
+    results: transaction.journal.entries.map((entry) => ({
+      actionId: entry.actionId,
+      kind: entry.kind,
+      status: entry.status,
+      path: null
+    })),
+    unrestored: transaction.unrestored,
+    receiptId: transaction.journal.outcome === "committed" ? transactionId : null
+  };
+  return finish3(transaction.exitCode, report);
 }
-function statusFor(achieved, declared) {
-  const order = ["presence", "config-only", "canary", "live-receipt"];
-  if (achieved === null)
-    return "not-applicable";
-  const reached = order.indexOf(achieved);
-  const promised = order.indexOf(declared);
-  if (reached < 0 || promised < 0)
-    return "not-applicable";
-  return reached >= promised ? "healthy" : "degraded";
-}
-var init_verify = __esm({
-  "apps/cli/dist/src/commands/verify.js"() {
+var init_update = __esm({
+  "apps/cli/dist/src/commands/update.js"() {
     "use strict";
-    init_src3();
     init_src();
+    init_src3();
   }
 });
 
@@ -18430,9 +18717,11 @@ function renderDoctorReport(report, context) {
     lines.push(...notable);
   }
   const unwired = report.providers.filter((provider) => provider.state !== "absent" && provider.configuredHarnesses.length === 0);
+  const installedProviders = report.providers.some((provider) => provider.state !== "absent");
   lines.push("");
   lines.push("NEXT");
   const suggestions = report.providers.every((provider) => provider.state === "absent") || unwired.length > 0 ? [["token-harness plan", "see what would change \u2014 writes nothing"]] : [
+    ...installedProviders ? [["token-harness update", "check RTK/HarnessTrim for newer versions"]] : [],
     ["token-harness verify", "check the pipeline actually intercepts"],
     ["token-harness metrics --since 7d", "see what it saved"]
   ];
@@ -19096,6 +19385,355 @@ var init_verify2 = __esm({
   }
 });
 
+// apps/cli/dist/src/render/simple.js
+function title(state) {
+  return [`TOKEN HARNESS - ${state.toUpperCase()}`, ""];
+}
+function next(command, description) {
+  return [
+    "",
+    "NEXT STEP",
+    command === null ? `  ${truncate(description, MAX_WIDTH - 2)}` : `  ${command}`,
+    ...command === null ? [] : [`  ${truncate(description, MAX_WIDTH - 2)}`]
+  ];
+}
+function changeLine(changed, detail2) {
+  return [
+    "",
+    "CHANGES",
+    `  ${changed ? detail2 ?? "Configuration changed." : "Nothing changed."}`
+  ];
+}
+function harnessName(id) {
+  if (id === "claude")
+    return "Claude Code";
+  if (id === "codex")
+    return "Codex";
+  if (id === "opencode")
+    return "OpenCode";
+  if (id === "pi")
+    return "Pi";
+  if (id === "hermes")
+    return "Hermes";
+  return id;
+}
+function providerName(id) {
+  if (id === "rtk")
+    return "RTK";
+  if (id === "harnesstrim")
+    return "HarnessTrim";
+  return id;
+}
+function normalWork() {
+  return "Use your coding agent normally; configured optimizers run automatically.";
+}
+function usefulEvidence(evidence2) {
+  const useful = evidence2.find((item) => !/^0B known loaded of /i.test(item.summary) && !/^0 MCP servers/i.test(item.summary) && !/^0B of instruction candidates/i.test(item.summary));
+  return useful?.summary ?? evidence2[0]?.summary ?? null;
+}
+function renderSimpleDoctor(report) {
+  const present = report.harnesses.filter((item) => item.state !== "absent");
+  const active = report.providers.filter((item) => item.state === "configured" && item.configuredHarnesses.length > 0);
+  const broken = present.some((item) => item.state === "broken") || report.providers.some((item) => item.state === "broken");
+  const newerThanTested = [...present, ...report.providers].some((item) => item.versionVerdict === "unknown-newer");
+  const state = broken ? "attention needed" : newerThanTested ? "ready with limitations" : present.length > 0 ? "ready" : "setup needed";
+  const lines = [...title(state), "WHAT WORKS"];
+  if (present.length === 0)
+    lines.push("  No supported coding harness was found.");
+  for (const item of present) {
+    lines.push(`  ${harnessName(item.harnessId)}: ${item.state}${item.version ? ` (${item.version})` : ""}`);
+  }
+  if (active.length === 0)
+    lines.push("  Optimization provider: none active");
+  for (const item of active) {
+    const connected = item.configuredHarnesses.map(harnessName).join(", ");
+    lines.push(truncate(`  ${providerName(item.providerId)}: active on ${connected}`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  if (broken) {
+    lines.push(...next("token-harness doctor --verbose", "Review the integration that needs attention."));
+  } else if (present.length === 0 || active.length === 0) {
+    lines.push(...next("token-harness setup", "Finish the guided setup."));
+  } else if (newerThanTested) {
+    lines.push(...next("token-harness verify", "You can keep working; verify the active integrations when convenient."));
+  } else {
+    lines.push(...next(null, normalWork()));
+  }
+  return document(lines);
+}
+function renderSimpleSetup(report, context) {
+  const state = report.stage === "ready" ? "ready" : report.stage === "attention" ? "attention needed" : "setup needed";
+  const lines = [...title(state), "DETECTED"];
+  const harnesses = report.doctor.harnesses.filter((item) => item.state !== "absent");
+  if (harnesses.length === 0)
+    lines.push("  Claude Code/Codex: not found");
+  for (const item of harnesses) {
+    lines.push(`  ${harnessName(item.harnessId)}: ${item.state}${item.version ? ` (${item.version})` : ""}`);
+  }
+  const active = report.doctor.providers.filter((item) => item.configuredHarnesses.length > 0);
+  if (active.length === 0)
+    lines.push("  Optimization provider: not active");
+  for (const provider of active) {
+    lines.push(truncate(`  ${providerName(provider.providerId)}: active on ${provider.configuredHarnesses.map(harnessName).join(", ")}`, MAX_WIDTH));
+  }
+  if (report.plan !== null && report.apply === null && report.plan.actions.length > 0) {
+    lines.push("", "SAFE PLAN");
+    for (const action of report.plan.actions) {
+      const path = primaryActionPath(action);
+      lines.push(truncate(`  ${actionLabel(action.kind)}${path === null ? "" : ` - ${displayPath(path, context.home)}`}`, MAX_WIDTH));
+    }
+  }
+  lines.push(...changeLine(report.changed, report.apply?.results.some((item) => item.status === "applied") ? "Safe configuration applied and checked." : void 0));
+  lines.push(...next(report.nextStep.command, report.stage === "ready" && report.nextStep.command === "token-harness ui" ? "Open the dashboard once to review status; after that use your coding agent normally." : report.nextStep.description));
+  return document(lines);
+}
+function renderVerboseSetup(report, context) {
+  const lines = ["SETUP TECHNICAL DETAILS", "", "DETECTION"];
+  for (const harness of report.doctor.harnesses) {
+    lines.push(truncate(`  ${harness.harnessId}: state ${harness.state}, version ${harness.version ?? "unknown"}, verdict ${harness.versionVerdict ?? "unknown"}`, MAX_WIDTH));
+    if (harness.configPath !== null)
+      lines.push(truncate(`    config ${displayPath(harness.configPath, context.home)}`, MAX_WIDTH));
+  }
+  for (const provider of report.doctor.providers) {
+    lines.push(truncate(`  ${provider.providerId}: state ${provider.state}, version ${provider.version ?? "unknown"}, wired ${provider.configuredHarnesses.join(", ") || "none"}`, MAX_WIDTH));
+  }
+  if (report.plan !== null) {
+    lines.push("", `PLAN ${report.plan.planId ?? "not produced"}`);
+    lines.push(`  persisted: ${String(report.plan.persisted)}`);
+    lines.push(`  actions: ${report.plan.actions.length}`);
+    lines.push(`  conflicts: ${report.plan.conflicts.length}`);
+    for (const action of report.plan.actions) {
+      lines.push(truncate(`  ${action.id}: ${action.kind} - ${action.explanation}`, MAX_WIDTH));
+    }
+  }
+  if (report.apply !== null) {
+    lines.push("", `TRANSACTION ${report.apply.transactionId ?? "none"}`);
+    lines.push(`  outcome: ${report.apply.outcome}`);
+    for (const result2 of report.apply.results) {
+      lines.push(truncate(`  ${result2.actionId}: ${result2.status}`, MAX_WIDTH));
+    }
+  }
+  if (report.verify !== null) {
+    lines.push("", "VERIFICATION");
+    lines.push(`  healthy at declared tier: ${String(report.verify.healthyAtDeclaredTier)}`);
+    for (const result2 of report.verify.results) {
+      lines.push(`  ${result2.providerId} on ${result2.harnessId}: ${result2.status}`);
+      for (const check of result2.checks) {
+        lines.push(truncate(`    ${check.id}: ${check.status} - ${check.summary}`, MAX_WIDTH));
+      }
+    }
+  }
+  if (report.budget !== null) {
+    lines.push("", "ALLOWANCE SOURCES");
+    for (const harness of report.budget.harnesses) {
+      if (harness.windows.length === 0)
+        lines.push(`  ${harness.harnessId}: ${harness.state}`);
+      for (const window of harness.windows) {
+        lines.push(truncate(`  ${harness.harnessId}/${window.scope}: ${window.source}, ${window.confidence}`, MAX_WIDTH));
+      }
+    }
+  }
+  lines.push("", ...renderSimpleSetup(report, context).trimEnd().split("\n"));
+  return document(lines);
+}
+function formatReset(resetsAt) {
+  return resetsAt === null ? "reset unknown" : `resets ${resetsAt}`;
+}
+function renderSimpleBudget(report) {
+  const observed = report.harnesses.filter((item) => item.state === "observed");
+  const lines = [
+    ...title(observed.length > 0 ? "allowance available" : "allowance unavailable"),
+    "ALLOWANCE"
+  ];
+  for (const harness of report.harnesses) {
+    if (harness.windows.length === 0) {
+      lines.push(`  ${harnessName(harness.harnessId)}: ${harness.state}`);
+      continue;
+    }
+    for (const window of harness.windows) {
+      const label = window.bucketName ?? window.scope;
+      const remaining = window.remainingPercent === null ? "unknown" : `${window.remainingPercent}% left`;
+      lines.push(truncate(`  ${harnessName(harness.harnessId)} ${label}: ${remaining}, ${formatReset(window.resetsAt)}`, MAX_WIDTH));
+    }
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next(observed.length > 0 ? "token-harness optimize" : "token-harness setup", observed.length > 0 ? "Get advice for the task you are about to start." : "Check the local installation and connections."));
+  return document(lines);
+}
+function renderSimpleContext(report) {
+  const lines = [...title("context checked"), "CONTEXT"];
+  lines.push(`  Instruction files: ${report.instructions.length}`);
+  lines.push(`  Known loaded instructions: ${formatCount(report.knownLoadedInstructionBytes)} bytes`);
+  for (const harness of report.harnesses) {
+    lines.push(truncate(`  ${harnessName(harness.harnessId)}: ${harness.state}, model ${harness.model ?? "unknown"}, ${harness.mcpServers.length} MCP servers`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next("token-harness optimize", "Turn these observations into one recommendation."));
+  return document(lines);
+}
+function renderSimpleMcp(report) {
+  const attention = report.harnesses.some((harness) => harness.assessments.some((item) => item.usability === "attention"));
+  const lines = [...title(attention ? "attention needed" : "mcp checked"), "MCP"];
+  for (const harness of report.harnesses) {
+    lines.push(`  ${harnessName(harness.harnessId)}: ${harness.servers.length} servers, ${harness.knownToolCount} known tools`);
+  }
+  lines.push(...changeLine(false));
+  lines.push(...next(attention ? "token-harness mcp --verbose" : "token-harness optimize", attention ? "Review the server that needs attention." : "See whether context can be simplified for the next task."));
+  return document(lines);
+}
+function renderSimpleOptimize(report) {
+  const advice = report.harnesses.filter((item) => item.state !== "absent");
+  const lines = [
+    ...title(advice.length > 0 ? "recommendation ready" : "setup needed"),
+    "RECOMMENDATION"
+  ];
+  if (advice.length === 0)
+    lines.push("  No supported harness could be assessed.");
+  for (const harness of advice) {
+    const recommendation = harness.recommendations.find((item) => item.priority === "first") ?? harness.recommendations.find((item) => item.priority === "next");
+    lines.push(truncate(`  ${harnessName(harness.harnessId)}: ${recommendation?.action ?? "No change recommended."}`, MAX_WIDTH));
+    const evidence2 = recommendation === void 0 ? null : usefulEvidence(recommendation.evidence);
+    if (evidence2)
+      lines.push(truncate(`    Why: ${evidence2}`, MAX_WIDTH));
+  }
+  lines.push(...changeLine(false));
+  const canPlan = advice.some((item) => item.recommendedEffort !== item.currentEffort || item.recommendedVerbosity !== item.currentVerbosity);
+  lines.push(...next(canPlan ? "token-harness plan --native-policy" : null, canPlan ? "Review the reversible recommended policy change." : "No change is required now. " + normalWork()));
+  return document(lines);
+}
+function renderSimplePlan(report, context) {
+  const lines = [
+    ...title(report.conflicts.length > 0 ? "blocked" : report.actions.length > 0 ? "plan ready" : "already configured")
+  ];
+  if (report.conflicts.length > 0) {
+    lines.push("BLOCKED BY");
+    for (const conflict of report.conflicts)
+      lines.push(truncate(`  ${conflict.code}: ${conflict.detail[0] ?? conflict.scope}`, MAX_WIDTH));
+  } else {
+    lines.push("WOULD CHANGE");
+    if (report.actions.length === 0)
+      lines.push("  Nothing.");
+    for (const action of report.actions) {
+      const path = primaryActionPath(action);
+      const shownPath = path === null ? "" : ` - ${truncatePath(displayPath(path, context.home), 34)}`;
+      lines.push(truncate(`  ${actionLabel(action.kind)}${shownPath}`, MAX_WIDTH));
+    }
+    lines.push(`  Network: ${report.network.length === 0 ? "none" : report.network.join(", ")}`);
+    lines.push(`  Backups: ${report.backups.files}`);
+  }
+  lines.push(...changeLine(false));
+  if (report.conflicts.length > 0)
+    lines.push(...next("token-harness plan --verbose", "Review the conflict and its safe resolution."));
+  else if (report.actions.length > 0 && report.persisted && report.planId !== null)
+    lines.push(...next(`token-harness apply --plan ${report.planId} --yes`, "Apply exactly this stored plan."));
+  else if (report.actions.length === 0)
+    lines.push(...report.pipelineId === null ? next("token-harness setup", "Check detection and finish guided setup.") : next(null, normalWork()));
+  else
+    lines.push(...next("token-harness ui", "Open the dashboard to review the current state."));
+  return document(lines);
+}
+function renderSimpleApply(report, command) {
+  const changed = report.outcome === "committed" && report.results.some((item) => item.status === "applied");
+  const okay = report.outcome === "committed" || report.outcome === "nothing-to-do";
+  const lines = [...title(okay ? "complete" : report.outcome), "RESULT"];
+  const appliedCount = report.results.filter((item) => item.status === "applied").length;
+  lines.push(`  ${appliedCount} actions applied`);
+  if (command === "uninstall" && report.outcome === "committed" && appliedCount === 0) {
+    lines.push("  Removed nothing: no owned entry was recognised.");
+  }
+  lines.push(`  Transaction: ${report.transactionId ?? "none"}`);
+  lines.push(...changeLine(changed, command === "uninstall" ? "Owned configuration removed." : command === "rollback" ? "Previous configuration restored." : "Configuration applied and committed."));
+  const confirmationCommand = command === "apply" && report.planId !== null ? `token-harness apply --plan ${report.planId} --yes` : `token-harness ${command} --yes`;
+  lines.push(...next(okay ? "token-harness verify" : report.outcome === "confirmation-required" ? confirmationCommand : `token-harness ${command} --verbose`, okay ? "Check that the integration works; a successful verify is the end of setup." : report.outcome === "confirmation-required" ? "Apply the reviewed change." : "Review the technical result."));
+  return document(lines);
+}
+function renderSimpleVerify(report) {
+  const lines = [
+    ...title(report.healthyAtDeclaredTier ? "working" : "attention needed"),
+    "INTEGRATIONS"
+  ];
+  if (report.results.length === 0)
+    lines.push("  Nothing is configured to verify yet.");
+  for (const item of report.results)
+    lines.push(truncate(`  ${providerName(item.providerId)} on ${harnessName(item.harnessId)}: ${item.status}`, MAX_WIDTH));
+  lines.push(...changeLine(false));
+  lines.push(...next(report.healthyAtDeclaredTier ? null : "token-harness verify --verbose", report.healthyAtDeclaredTier ? normalWork() : "Review the failed check and suggested fix."));
+  return document(lines);
+}
+function renderSimpleStatus(report) {
+  const lines = [...title(report.problemCount === 0 ? "healthy" : "attention needed"), "ACTIVE"];
+  if (report.pipelines.length === 0)
+    lines.push("  No Token Harness pipeline is active.");
+  for (const pipeline of report.pipelines) {
+    const providers = [...new Set(pipeline.owners.map((owner) => owner.owner))];
+    lines.push(truncate(`  ${harnessName(pipeline.harness)}: ${providers.map(providerName).join(" -> ") || "no provider"}`, MAX_WIDTH));
+  }
+  lines.push(`  Drift: ${report.drift.length === 0 ? "none" : report.drift.length}`);
+  lines.push(...changeLine(false));
+  lines.push(...next(report.problemCount === 0 ? report.pipelines.length === 0 ? "token-harness setup" : null : "token-harness status --verbose", report.problemCount === 0 ? report.pipelines.length === 0 ? "Finish the guided setup." : normalWork() : "Review the drift before making changes."));
+  return document(lines);
+}
+function renderSimpleMetrics(report) {
+  const lines = [...title("savings checked"), "SAVINGS"];
+  const measured = report.classes.filter((item) => item.saved !== null);
+  if (measured.length === 0)
+    lines.push("  No comparable savings recorded yet.");
+  for (const item of measured)
+    lines.push(`  ${item.class}: ${formatCount(item.saved ?? 0)} ${item.unit ?? ""} saved`);
+  lines.push(`  Errors: ${report.errors}`);
+  lines.push(...changeLine(false));
+  lines.push(...next(null, "Measurement is complete. Use optimize before a task only when you want fresh advice."));
+  return document(lines);
+}
+function renderSimpleHistory(report) {
+  const lines = [...title("history checked"), "LOCAL USAGE"];
+  if (report.harnesses.length === 0)
+    lines.push(`  ${report.source.name}: ${report.source.state}`);
+  for (const item of report.harnesses)
+    lines.push(`  ${harnessName(item.harnessId)}: ${formatCount(item.totalTokens)} tokens, trend ${item.burnTrend.state}`);
+  lines.push(...changeLine(false));
+  lines.push(...next(null, "History is informational. Run token-harness optimize when you want task-specific advice."));
+  return document(lines);
+}
+function updateStatus(item) {
+  if (item.verdict === "current")
+    return `${item.installed ?? "installed"} is current`;
+  if (item.verdict === "pinned")
+    return `kept at ${item.pin ?? item.installed ?? "installed"} (pinned)`;
+  if (item.verdict === "blocked-unreviewed")
+    return `${item.available ?? "newer version"} available; keeping ${item.installed ?? "installed"} until validated`;
+  if (item.verdict === "upgradable")
+    return `${item.installed ?? "installed"} -> ${item.available ?? "newer version"} ready`;
+  if (item.verdict === "not-installed")
+    return "not installed";
+  if (item.verdict === "no-channel")
+    return "installed; no supported update channel";
+  if (item.verdict === "unavailable")
+    return "installed; update check unavailable";
+  return "installed; update status unknown";
+}
+function renderSimpleUpdate(report) {
+  const execution = report.execution;
+  const changed = execution?.outcome === "committed" && execution.results.some((item) => item.status === "applied");
+  const lines = [...title(changed ? "updated" : "update checked"), "PROVIDERS"];
+  if (report.providers.length === 0)
+    lines.push("  No provider was detected.");
+  for (const item of report.providers)
+    lines.push(truncate(`  ${providerName(item.providerId)}: ${updateStatus(item)}`, MAX_WIDTH));
+  lines.push(...changeLine(changed, "Provider update applied."));
+  const pending = report.providers.some((item) => item.verdict === "upgradable");
+  const deferred = report.providers.some((item) => item.verdict === "blocked-unreviewed");
+  lines.push(...next(pending && execution?.outcome === "confirmation-required" ? "token-harness update --yes" : changed ? "token-harness verify" : null, pending && execution?.outcome === "confirmation-required" ? "Apply the reviewed provider update." : changed ? "Check that the updated integrations still work." : deferred ? "No action required. The installed versions stay active until newer ones are validated." : normalWork()));
+  return document(lines);
+}
+var init_simple = __esm({
+  "apps/cli/dist/src/render/simple.js"() {
+    "use strict";
+    init_src();
+    init_layout();
+  }
+});
+
 // apps/cli/dist/src/render/index.js
 function planRendering(report, result2, context) {
   const conflictCodes = new Set(report.conflicts.map((conflict) => conflict.code));
@@ -19104,6 +19742,13 @@ function planRendering(report, result2, context) {
     stderrDiagnostics: result2.diagnostics.filter((entry) => !conflictCodes.has(entry.code))
   };
 }
+function planRenderingSimple(report, result2, context) {
+  const conflictCodes = new Set(report.conflicts.map((conflict) => conflict.code));
+  return {
+    report: renderSimplePlan(report, context),
+    stderrDiagnostics: result2.diagnostics.filter((entry) => !conflictCodes.has(entry.code))
+  };
+}
 function renderHuman(result2, context) {
   const data = result2.data;
   if (data === null)
@@ -19112,11 +19757,45 @@ function renderHuman(result2, context) {
     report,
     stderrDiagnostics: result2.diagnostics
   });
+  if (context.verbose !== true) {
+    switch (result2.command) {
+      case "apply":
+      case "rollback":
+      case "uninstall":
+        return plain(renderSimpleApply(data, result2.command));
+      case "budget":
+        return plain(renderSimpleBudget(data));
+      case "context":
+        return plain(renderSimpleContext(data));
+      case "doctor":
+        return plain(renderSimpleDoctor(data));
+      case "history":
+        return plain(renderSimpleHistory(data));
+      case "mcp":
+        return plain(renderSimpleMcp(data));
+      case "metrics":
+        return plain(renderSimpleMetrics(data));
+      case "optimize":
+        return plain(renderSimpleOptimize(data));
+      case "plan":
+        return planRenderingSimple(data, result2, context);
+      case "setup":
+        return plain(renderSimpleSetup(data, context));
+      case "status":
+        return plain(renderSimpleStatus(data));
+      case "update":
+        return plain(renderSimpleUpdate(data));
+      case "verify":
+        return plain(renderSimpleVerify(data));
+    }
+  }
   switch (result2.command) {
     case "apply":
     case "rollback":
     case "uninstall":
       return plain(renderApplyReport(data, context, result2.command));
+    case "setup":
+      return plain(renderVerboseSetup(data, context));
     case "benchmark":
       return plain(renderBenchmarkReport(data, context));
     case "benchmark-matrix":
@@ -19169,6 +19848,7 @@ var init_render = __esm({
     init_status2();
     init_update2();
     init_verify2();
+    init_simple();
     init_layout();
   }
 });
@@ -19181,81 +19861,65 @@ var ROOT_USAGE, COMMAND_USAGE;
 var init_usage = __esm({
   "apps/cli/dist/src/usage.js"() {
     "use strict";
-    ROOT_USAGE = `token-harness \u2014 maximize useful Claude Code and Codex subscription capacity
+    ROOT_USAGE = `token-harness \u2014 simple Claude Code and Codex efficiency
 
-First time here
-  1  token-harness doctor        what is on this machine        writes nothing
-  2  token-harness budget        quota remaining                writes nothing
-  3  token-harness context       static context cost            writes nothing
-  4  token-harness mcp           MCP audit                     writes nothing
-  5  token-harness history       local usage history            writes nothing
-  6  token-harness optimize      quota-aware advice             writes nothing
-  7  token-harness plan          what would change              writes nothing
-  8  token-harness apply --yes   make those changes             WRITES
-  9  token-harness verify        is it actually intercepting    writes nothing
- 10  token-harness metrics       what it saved                  writes nothing
- 11  token-harness benchmark     compare paired task receipts   writes nothing
- 12  token-harness benchmark-start  snapshot task start         writes state
- 13  token-harness benchmark-finish close task receipt          writes state
- 14  token-harness benchmark-matrix aggregate empirical pairs   writes nothing
+New here? Run one command
+  token-harness setup
 
-  Steps 1 through 7 are safe to run right now. Nothing changes until step 8.
+It detects what is installed, checks what works, and prepares only supported
+changes. It ends with one next step. Nothing changes without an explicit
+--yes.
 
 Usage
   token-harness <command> [flags]
-  token-harness help <command>
 
-Commands, in the order you would use them
-  doctor      What is installed, what is wired up, what is worth knowing
-  budget      Read Claude/Codex usage windows with explicit source/confidence
-  context     Audit instruction bytes, effective config, MCP servers and tools
-  mcp         Show the focused native MCP/server/tool inventory
-  history     Read local Claude/Codex usage history through ccusage
-  plan        Compute what would change, file by file. Changes nothing
-  apply       Run that plan inside a transaction that can be rolled back
-  verify      Check the pipeline actually intercepts, at its declared tier
-  metrics     Report what was saved, labelled with how it was measured
-  benchmark   Compare baseline/optimized task receipts with quality gates
-  benchmark-start
-              Snapshot quota/policy before one benchmark task into local state
-  benchmark-finish
-              Close that capture with quota-after and an explicit quality gate
-  benchmark-matrix
-              Aggregate complete local pairs by class and evidence
-  optimize    Combine quota and context evidence into read-only policy advice
-  status      Report applied pipelines, drift, and importer modes
-  update      Update installed providers to what their channel offers
-  rollback    Restore the files a transaction changed, as they were before
-  uninstall   Remove what Token Harness set up, leaving everything else
+Everyday commands
+  setup       Guided detection, safe configuration, and verification
+  ui          Open the local dashboard in your browser
+  optimize    Show the best evidence-based action for the current task
+  status      Show active harnesses, providers, and configuration health
 
-Flags
-  --json               Emit one machine-readable envelope on stdout
+Advanced commands
+  doctor      Full installation and connection check
+  budget      Claude/Codex subscription usage windows
+  context     Instruction, model, and context-cost observations
+  mcp         MCP server and tool inventory
+  history     Local usage history through an installed ccusage
+  plan        Prepare an exact, reversible change without applying it
+  apply       Apply a reviewed plan
+  verify      Check that configured integrations work
+  metrics     Show measured savings
+  update      Check or update installed providers
+  rollback    Restore the previous configuration
+  uninstall   Remove only configuration Token Harness owns
+  benchmark, benchmark-start, benchmark-finish, benchmark-matrix
+              Compare real task results for advanced evaluation
+
+Useful flags
+  --verbose            Show technical details instead of the short summary
+  --json               Emit the complete machine-readable result
+  --yes                Confirm a configuration-changing operation
   --harness <id>       Restrict the operation to one harness
   --provider <id>      Restrict the operation to one provider
   --project <dir>      Use that project instead of the current directory
-  --since <window>     Report from this point: a duration like 7d, or a date
-  --until <window>     Report up to this point; defaults to now
-  --plan <id>          Apply a previously computed plan by id
-  --baseline <file>     Baseline task benchmark receipt JSON
-  --optimized <file>    Optimized task benchmark receipt JSON
-  --benchmark-id <id>    Safe local id for benchmark start/finish
-  --variant <name>       Benchmark variant: baseline or optimized
-  --quality <result>     Finish quality gate: passed or failed
-  --attempts <count>     Total attempts used to complete the task
-  --failed-attempts <n> Failed attempts before the final outcome
-  --task <class>        Optimizer task: mechanical, standard, hard, critical
-  --profile <name>      Optimizer profile: economy, balanced, quality, custom
-  --reserve <percent>   Keep this percent of observed allowance in reserve
-  --native-policy       Add reversible native Codex policy edits to plan
-  --yes                Grant the confirmation a mutating command requires
-  --version            Print the version and exit 0
-  --help               Print usage and exit 0
+  --help               Show help for a command
+  --version            Print the version
 
-Only apply, update, rollback and uninstall change harness/provider
-configuration, and none of them do without --yes. Metrics and benchmark
-capture may write only Token Harness's own local state. Exit codes and JSON
-are specified in RFC 0006.`;
+Run token-harness <command> --help for advanced flags and safety details.`;
     COMMAND_USAGE = {
+      setup: `token-harness setup \u2014 guided onboarding in one command
+
+Usage
+  token-harness setup [--yes] [--verbose] [--json] [--project <dir>]
+
+Without --yes, setup detects Claude Code/Codex, checks existing providers, and
+prepares any supported reversible configuration. It changes no harness/provider
+configuration and ends with one next step.
+
+Run the suggested token-harness setup --yes only after reviewing the short plan.
+It applies that stored plan transactionally, verifies the result, reads allowance
+when available, and points to the local dashboard. Token Harness never installs
+Claude Code or Codex and never spends model quota during setup.`,
       "benchmark-start": `token-harness benchmark-start \u2014 snapshot one task before it runs
 
 Usage
@@ -19560,14 +20224,14 @@ function formatDiagnostics(diagnostics) {
   if (errors.length === 0 && warnings.length === 0)
     return "";
   const lines = [];
-  for (const [title, group] of [
+  for (const [title2, group] of [
     ["ERRORS", errors],
     ["WARNINGS", warnings]
   ]) {
     if (group.length === 0)
       continue;
     lines.push("");
-    lines.push(title);
+    lines.push(title2);
     for (const entry of group)
       lines.push(diagnosticLine(entry));
   }
@@ -19649,6 +20313,7 @@ async function run(options) {
   const renderContext = {
     toolVersion,
     home: options.home,
+    verbose: false,
     decorate: shouldDecorate({
       stdoutIsTty: options.stdoutIsTty ?? false,
       noColor: env["NO_COLOR"] !== void 0,
@@ -19688,6 +20353,7 @@ async function run(options) {
       diagnostics: invocation.diagnostics
     }), options, renderContext, json);
   }
+  renderContext.verbose = invocation.options.verbose;
   const environmentDiagnostics = options.environmentDiagnostics ?? [];
   if (environmentDiagnostics.some((entry) => entry.severity === "error")) {
     return emit(commandResult({
@@ -19762,6 +20428,7 @@ var init_run = __esm({
     init_optimize();
     init_plan2();
     init_rollback();
+    init_setup2();
     init_status();
     init_update();
     init_verify();
@@ -19783,6 +20450,7 @@ var init_run = __esm({
       optimize: runOptimize,
       plan: runPlan,
       rollback: runRollback,
+      setup: runSetup,
       status: runStatus,
       uninstall: runUninstall,
       update: runUpdate,
@@ -19792,12 +20460,272 @@ var init_run = __esm({
   }
 });
 
+// apps/cli/dist/src/ui.js
+function parseUiArgs(argv2) {
+  const options = { help: false, json: false, open: true, port: 0 };
+  for (let index = 0; index < argv2.length; index += 1) {
+    const token = argv2[index];
+    if (token === "--help")
+      options.help = true;
+    else if (token === "--json")
+      options.json = true;
+    else if (token === "--no-open")
+      options.open = false;
+    else if (token === "--port") {
+      const raw = argv2[index + 1];
+      const port = Number(raw);
+      if (raw === void 0 || !Number.isInteger(port) || port < 1 || port > 65535) {
+        return { ok: false, message: "--port requires an integer from 1 to 65535" };
+      }
+      options.port = port;
+      index += 1;
+    } else {
+      return { ok: false, message: `Unknown ui option ${JSON.stringify(token)}` };
+    }
+  }
+  return { ok: true, options };
+}
+function nameOf(id) {
+  if (id === "claude")
+    return "Claude Code";
+  if (id === "codex")
+    return "Codex";
+  if (id === "opencode")
+    return "OpenCode";
+  if (id === "pi")
+    return "Pi";
+  if (id === "hermes")
+    return "Hermes";
+  return id;
+}
+function providerName2(id) {
+  if (id === "harnesstrim")
+    return "HarnessTrim";
+  if (id === "rtk")
+    return "RTK";
+  return id;
+}
+function usefulReason(evidence2) {
+  const useful = evidence2.find((item) => !/^0B known loaded of /i.test(item.summary) && !/^0 MCP servers/i.test(item.summary) && !/^0B of instruction candidates/i.test(item.summary));
+  return useful?.summary ?? evidence2[0]?.summary ?? null;
+}
+function buildDashboardModel(input) {
+  const present = input.doctor.harnesses.filter((item) => item.state !== "absent");
+  const connectedProviders = input.doctor.providers.filter((item) => item.configuredHarnesses.length > 0);
+  const configuredProviders = connectedProviders.filter((item) => item.state === "configured");
+  const relevantHarnessIds = /* @__PURE__ */ new Set();
+  for (const provider of connectedProviders) {
+    for (const harness of provider.configuredHarnesses)
+      relevantHarnessIds.add(harness);
+  }
+  for (const item of input.budget.harnesses) {
+    if (item.windows.length > 0)
+      relevantHarnessIds.add(item.harnessId);
+  }
+  for (const pipeline of input.status.pipelines)
+    relevantHarnessIds.add(pipeline.harness);
+  const relevantHarnesses = present.filter((harness) => relevantHarnessIds.has(harness.harnessId));
+  const broken = relevantHarnesses.some((item) => item.state === "broken") || connectedProviders.some((item) => item.state === "broken");
+  const newerThanTested = relevantHarnesses.some((item) => item.versionVerdict === "unknown-newer") || connectedProviders.some((item) => item.versionVerdict === "unknown-newer");
+  const state = present.length === 0 ? "setup-needed" : broken || input.status.problemCount > 0 ? "action-needed" : configuredProviders.length === 0 ? "setup-needed" : newerThanTested ? "limited" : "ready";
+  const rankedRecommendations = input.optimize.harnesses.filter((harness) => harness.state !== "absent" && relevantHarnessIds.has(harness.harnessId)).flatMap((harness) => harness.recommendations.map((item) => ({
+    harness: harness.harnessId,
+    priority: item.priority,
+    action: item.action,
+    reason: usefulReason(item.evidence)
+  }))).sort((left, right) => {
+    const rank = { first: 0, next: 1, optional: 2 };
+    return rank[left.priority] - rank[right.priority];
+  });
+  const recommendation = rankedRecommendations.find((item) => item.priority !== "optional");
+  const harnesses = relevantHarnesses.map((harness) => {
+    const providerIds = configuredProviders.filter((provider) => provider.configuredHarnesses.includes(harness.harnessId)).map((provider) => provider.providerId);
+    const budget = input.budget.harnesses.find((item) => item.harnessId === harness.harnessId);
+    const health = harness.state === "broken" ? "attention" : harness.versionVerdict === "unknown-newer" ? "limited" : "active";
+    const statusLabel = health === "attention" ? "Needs attention" : health === "limited" ? "Works \xB7 newer than tested" : providerIds.length > 0 ? "Optimized" : "Available";
+    return {
+      id: harness.harnessId,
+      name: nameOf(harness.harnessId),
+      health,
+      statusLabel,
+      version: harness.version,
+      providers: providerIds.map(providerName2),
+      allowance: (budget?.windows ?? []).map((window) => ({
+        label: window.bucketName ?? window.scope,
+        remainingPercent: window.remainingPercent,
+        resetsAt: window.resetsAt,
+        confidence: window.confidence
+      }))
+    };
+  });
+  const otherHarnesses = present.filter((harness) => !relevantHarnessIds.has(harness.harnessId)).map((harness) => ({ name: nameOf(harness.harnessId), version: harness.version }));
+  const providers = configuredProviders.map((provider) => ({
+    id: provider.providerId,
+    name: providerName2(provider.providerId),
+    harnesses: provider.configuredHarnesses.map(nameOf)
+  }));
+  const copy = state === "ready" ? {
+    statusLabel: "READY",
+    headline: "Everything important is connected.",
+    summary: "Token Harness is already active through your configured integrations. This dashboard is for status and guidance; it is not a launcher.",
+    nextStep: {
+      command: null,
+      title: "Use your coding agent normally",
+      description: "Open Claude Code, Codex, or OpenCode exactly as you normally do. RTK and HarnessTrim run automatically where they are configured."
+    }
+  } : state === "limited" ? {
+    statusLabel: "READY WITH LIMITATIONS",
+    headline: "You can keep working.",
+    summary: "An active integration uses a version newer than the tested range. Token Harness will keep working read-only and stay conservative about changes.",
+    nextStep: {
+      command: "token-harness verify",
+      title: "Verify the active integrations",
+      description: "Keep using your coding agents normally. Run this check when you want evidence that the configured interception still works."
+    }
+  } : state === "action-needed" ? {
+    statusLabel: "ACTION NEEDED",
+    headline: "One active integration needs attention.",
+    summary: "Do not change providers yet. Review the live pipeline or configuration issue first; your other working integrations can remain untouched.",
+    nextStep: {
+      command: input.status.problemCount > 0 ? "token-harness status --verbose" : "token-harness doctor --verbose",
+      title: "Review the specific problem",
+      description: "The detailed command is only for the integration that needs attention. It is not part of the normal daily workflow."
+    }
+  } : {
+    statusLabel: "SETUP NEEDED",
+    headline: "Finish the one-time setup.",
+    summary: "A supported coding agent was not found with an active optimization provider yet.",
+    nextStep: {
+      command: "token-harness setup",
+      title: "Continue guided setup",
+      description: "Token Harness will detect what is available and propose only supported changes."
+    }
+  };
+  return {
+    generatedAt: input.generatedAt,
+    state,
+    statusLabel: copy.statusLabel,
+    headline: copy.headline,
+    summary: copy.summary,
+    harnesses,
+    otherHarnesses,
+    providers,
+    recommendation: recommendation === void 0 ? null : {
+      action: `${nameOf(recommendation.harness)}: ${recommendation.action}`,
+      reason: recommendation.reason
+    },
+    nextStep: copy.nextStep
+  };
+}
+function uiAsset(path, model) {
+  if (path === "/")
+    return { status: 200, contentType: "text/html; charset=utf-8", body: DASHBOARD_HTML };
+  if (path === "/app.css")
+    return { status: 200, contentType: "text/css; charset=utf-8", body: DASHBOARD_CSS };
+  if (path === "/app.js")
+    return { status: 200, contentType: "text/javascript; charset=utf-8", body: DASHBOARD_JS };
+  if (path === "/api/status")
+    return {
+      status: 200,
+      contentType: "application/json; charset=utf-8",
+      body: JSON.stringify(model)
+    };
+  return { status: 404, contentType: "text/plain; charset=utf-8", body: "Not found\n" };
+}
+var UI_USAGE, DASHBOARD_HTML, DASHBOARD_CSS, DASHBOARD_JS;
+var init_ui = __esm({
+  "apps/cli/dist/src/ui.js"() {
+    "use strict";
+    UI_USAGE = `token-harness ui \u2014 open the local status and guidance dashboard
+
+Usage
+  token-harness ui [--no-open] [--port <number>] [--json]
+
+The dashboard listens only on 127.0.0.1 and is read-only.
+It does not send data anywhere and cannot change configuration.
+It shows what is active, what needs attention, and what to do next. When the setup is ready,
+keep using Claude Code, Codex, or OpenCode normally \u2014 Token Harness does not replace their
+launch commands. Close the local dashboard server with Ctrl+C.`;
+    DASHBOARD_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>Token Harness</title>
+  <link rel="stylesheet" href="/app.css">
+</head>
+<body>
+  <a class="skip" href="#main">Skip to dashboard</a>
+  <header class="topbar">
+    <div class="brand"><span class="mark" aria-hidden="true">TH</span><span>Token Harness</span></div>
+    <button id="refresh" class="secondary-button" type="button">Refresh</button>
+  </header>
+  <main id="main">
+    <section class="hero" aria-labelledby="headline">
+      <div id="status" class="status-chip">CHECKING</div>
+      <h1 id="headline">Checking your setup...</h1>
+      <p id="summary" class="hero-copy">Reading local status and guidance.</p>
+      <p id="updated" class="timestamp" aria-live="polite"></p>
+    </section>
+
+    <section class="action-card" aria-labelledby="next-title">
+      <div class="action-copy">
+        <p class="eyebrow">WHAT TO DO NOW</p>
+        <h2 id="next-title">Checking the next step...</h2>
+        <p id="description" class="supporting"></p>
+      </div>
+      <div id="command-row" class="command-row" hidden>
+        <code id="command"></code>
+        <button id="copy" class="primary-button" type="button">Copy command</button>
+      </div>
+    </section>
+
+    <section class="section" aria-labelledby="active-title">
+      <div class="section-heading">
+        <div><p class="eyebrow">ACTIVE SETUP</p><h2 id="active-title">What is working</h2></div>
+        <p class="section-note">Only active or relevant tools are shown here.</p>
+      </div>
+      <div id="harnesses" class="harness-grid" aria-live="polite"></div>
+    </section>
+
+    <section id="recommendation-panel" class="recommendation-card" aria-labelledby="recommendation-title" hidden>
+      <p class="eyebrow">USEFUL NOW</p>
+      <h2 id="recommendation-title">Recommendation</h2>
+      <p id="recommendation" class="recommendation-action"></p>
+      <p id="reason" class="supporting"></p>
+    </section>
+
+    <section id="providers-panel" class="compact-panel" aria-labelledby="providers-title" hidden>
+      <div><p class="eyebrow">ACTIVE OPTIMIZERS</p><h2 id="providers-title">Providers</h2></div>
+      <ul id="providers" class="provider-list"></ul>
+    </section>
+
+    <details id="other-panel" class="details-panel" hidden>
+      <summary id="other-summary">Other detected tools</summary>
+      <ul id="other-harnesses" class="secondary-list"></ul>
+    </details>
+
+    <p id="error" class="error" role="alert"></p>
+  </main>
+  <footer>
+    <strong>Local and read-only.</strong> You can close this page whenever you want. Configured optimizers keep working through their normal harness integrations.
+  </footer>
+  <script src="/app.js" defer></script>
+</body>
+</html>`;
+    DASHBOARD_CSS = `:root{font-family:Inter,ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;font-synthesis:none;--bg:#f6f8fb;--surface:#ffffff;--surface-2:#f1f5f9;--text:#111827;--muted:#5b6472;--subtle:#7b8492;--border:#dce2ea;--accent:#0f766e;--accent-strong:#115e59;--accent-soft:#ccfbf1;--warning:#92400e;--warning-soft:#fef3c7;--danger:#b42318;--danger-soft:#fee4e2;--shadow:0 14px 34px rgba(15,23,42,.08);--focus:#2563eb}*{box-sizing:border-box}html{background:var(--bg)}body{margin:0;min-height:100vh;background:linear-gradient(180deg,rgba(15,118,110,.045),transparent 240px),var(--bg);color:var(--text);font-size:16px;line-height:1.5}button{font:inherit}button:focus-visible,a:focus-visible,summary:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:absolute;left:-999px;top:1rem;z-index:10;background:var(--text);color:var(--surface);padding:.6rem .8rem;border-radius:8px}.skip:focus{left:1rem}.topbar,main,footer{width:min(1040px,calc(100% - 32px));margin-inline:auto}.topbar{height:68px;display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border)}.brand{display:flex;align-items:center;gap:.7rem;font-weight:800;letter-spacing:-.01em}.mark{display:grid;place-items:center;width:36px;height:36px;border-radius:10px;background:var(--accent);color:#fff;font:800 13px ui-monospace,SFMono-Regular,Consolas,monospace}.secondary-button,.primary-button{min-height:44px;border-radius:10px;padding:0 1rem;font-weight:750;cursor:pointer}.secondary-button{border:1px solid var(--border);background:var(--surface);color:var(--text)}.secondary-button:hover{background:var(--surface-2)}.primary-button{border:1px solid var(--accent-strong);background:var(--accent);color:#fff}.primary-button:hover{background:var(--accent-strong)}button:disabled{cursor:wait;opacity:.62}.hero{padding:54px 0 28px;max-width:780px}.status-chip{display:inline-flex;align-items:center;min-height:28px;padding:0 .65rem;border-radius:999px;background:var(--accent-soft);color:var(--accent-strong);font-size:.76rem;font-weight:850;letter-spacing:.08em}.status-chip.limited{background:var(--warning-soft);color:var(--warning)}.status-chip.action-needed{background:var(--danger-soft);color:var(--danger)}.status-chip.setup-needed{background:var(--surface-2);color:var(--muted)}.hero h1{margin:14px 0 10px;font-size:clamp(2.05rem,5vw,3.65rem);line-height:1.04;letter-spacing:-.045em}.hero-copy{margin:0;max-width:720px;color:var(--muted);font-size:1.08rem}.timestamp{margin:12px 0 0;color:var(--subtle);font-size:.82rem}.action-card{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:24px;align-items:center;padding:24px;border:1px solid color-mix(in srgb,var(--accent) 28%,var(--border));border-radius:18px;background:var(--surface);box-shadow:var(--shadow)}.eyebrow{margin:0 0 6px;color:var(--accent-strong);font-size:.72rem;font-weight:850;letter-spacing:.11em}.action-card h2,.section h2,.recommendation-card h2,.compact-panel h2{margin:0;font-size:1.18rem;letter-spacing:-.015em}.supporting{margin:7px 0 0;color:var(--muted)}.command-row{display:flex;align-items:center;gap:10px;max-width:100%}.command-row code{display:block;max-width:440px;padding:12px 14px;border:1px solid var(--border);border-radius:10px;background:var(--surface-2);color:var(--text);font:650 .88rem ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere}.section{padding-top:34px}.section-heading{display:flex;align-items:end;justify-content:space-between;gap:24px;margin-bottom:14px}.section-note{margin:0;color:var(--subtle);font-size:.86rem}.harness-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,300px),1fr));gap:12px}.harness-card{min-width:0;padding:18px;border:1px solid var(--border);border-radius:16px;background:var(--surface)}.harness-top{display:flex;align-items:flex-start;justify-content:space-between;gap:12px}.harness-card h3{margin:0;font-size:1.06rem}.health{display:inline-flex;align-items:center;gap:7px;flex:0 0 auto;color:var(--accent-strong);font-size:.76rem;font-weight:800}.health::before{content:"";width:8px;height:8px;border-radius:50%;background:var(--accent)}.health.limited{color:var(--warning)}.health.limited::before{background:var(--warning)}.health.attention{color:var(--danger)}.health.attention::before{background:var(--danger)}.harness-meta{margin:5px 0 0;color:var(--muted);font-size:.86rem}.provider-line{margin:13px 0 0;font-size:.9rem}.provider-line strong{font-weight:800}.allowance{margin-top:16px;padding-top:14px;border-top:1px solid var(--border)}.quota{margin-top:12px}.quota:first-child{margin-top:0}.quota-row{display:flex;justify-content:space-between;gap:16px;margin-bottom:6px;font-size:.88rem}.quota-row strong{font-variant-numeric:tabular-nums}.track{height:7px;border-radius:999px;background:var(--surface-2);overflow:hidden}.fill{height:100%;border-radius:inherit;background:var(--accent)}.quota-meta{margin:5px 0 0;color:var(--subtle);font-size:.76rem}.no-allowance{margin:14px 0 0;color:var(--subtle);font-size:.82rem}.recommendation-card,.compact-panel,.details-panel{margin-top:14px;border:1px solid var(--border);border-radius:16px;background:var(--surface)}.recommendation-card{padding:20px}.recommendation-action{margin:9px 0 0;font-weight:760}.compact-panel{display:flex;align-items:center;justify-content:space-between;gap:20px;padding:16px 18px}.provider-list,.secondary-list{margin:0;padding:0;list-style:none}.provider-list{display:flex;flex-wrap:wrap;justify-content:flex-end;gap:8px}.provider-list li{padding:7px 9px;border:1px solid var(--border);border-radius:9px;background:var(--surface-2);font-size:.82rem}.details-panel{padding:0 16px}.details-panel summary{min-height:48px;display:flex;align-items:center;cursor:pointer;color:var(--muted);font-weight:750}.secondary-list{padding:0 0 14px}.secondary-list li{padding:7px 0;border-top:1px solid var(--border);color:var(--muted);font-size:.86rem}.error{color:var(--danger);font-weight:700}footer{padding:28px 0 42px;color:var(--subtle);font-size:.82rem}footer strong{color:var(--muted)}[hidden]{display:none!important}@media(prefers-color-scheme:dark){:root{--bg:#0b1118;--surface:#111923;--surface-2:#17212d;--text:#f3f6fa;--muted:#b2bdc9;--subtle:#8996a4;--border:#273443;--accent:#2dd4bf;--accent-strong:#99f6e4;--accent-soft:#123d39;--warning:#fbbf24;--warning-soft:#422f12;--danger:#ff8a80;--danger-soft:#44201f;--shadow:0 16px 38px rgba(0,0,0,.22);--focus:#60a5fa}.primary-button{color:#062a27}.mark{color:#062a27}.action-card{border-color:#28514d}}@media(max-width:760px){.topbar,main,footer{width:min(100% - 24px,1040px)}.hero{padding:38px 0 22px}.action-card{grid-template-columns:1fr;gap:16px;padding:19px}.command-row{align-items:stretch;flex-direction:column}.command-row code{max-width:none}.command-row .primary-button{width:100%}.section{padding-top:28px}.section-heading{align-items:flex-start;flex-direction:column;gap:3px}.compact-panel{align-items:flex-start;flex-direction:column}.provider-list{justify-content:flex-start}.topbar{height:62px}}@media(max-width:390px){.hero h1{font-size:2rem}.harness-card{padding:15px}.harness-top{align-items:flex-start;flex-direction:column;gap:6px}}@media(prefers-reduced-motion:reduce){*{scroll-behavior:auto!important;transition:none!important;animation:none!important}}`;
+    DASHBOARD_JS = `const byId=(id)=>document.getElementById(id);const setText=(id,value)=>{const node=byId(id);if(node)node.textContent=value};function formatReset(value){return value?'Resets '+new Date(value).toLocaleString():'Reset time unavailable'}function renderHarness(item){const card=document.createElement('article');card.className='harness-card';const top=document.createElement('div');top.className='harness-top';const title=document.createElement('h3');title.textContent=item.name;const health=document.createElement('span');health.className='health '+item.health;health.textContent=item.statusLabel;top.append(title,health);card.append(top);const meta=document.createElement('p');meta.className='harness-meta';meta.textContent=item.version?'Version '+item.version:'Version unavailable';card.append(meta);if(item.providers.length){const provider=document.createElement('p');provider.className='provider-line';const strong=document.createElement('strong');strong.textContent=item.providers.join(', ');provider.append(strong,document.createTextNode(' active automatically'));card.append(provider)}if(item.allowance.length){const allowance=document.createElement('div');allowance.className='allowance';for(const quota of item.allowance){const box=document.createElement('div');box.className='quota';const row=document.createElement('div');row.className='quota-row';const label=document.createElement('span');label.textContent=quota.label;const value=document.createElement('strong');value.textContent=quota.remainingPercent===null?'Unknown':quota.remainingPercent+'% left';row.append(label,value);const track=document.createElement('div');track.className='track';track.setAttribute('role','progressbar');track.setAttribute('aria-label',item.name+' '+quota.label);track.setAttribute('aria-valuemin','0');track.setAttribute('aria-valuemax','100');if(quota.remainingPercent!==null){track.setAttribute('aria-valuenow',String(quota.remainingPercent));track.setAttribute('aria-valuetext',quota.remainingPercent+'% remaining')}const fill=document.createElement('div');fill.className='fill';fill.style.width=(quota.remainingPercent===null?0:Math.max(0,Math.min(100,quota.remainingPercent)))+'%';track.append(fill);const detail=document.createElement('p');detail.className='quota-meta';detail.textContent=formatReset(quota.resetsAt)+(quota.confidence==='authoritative'?' \xB7 verified allowance':' \xB7 '+quota.confidence);box.append(row,track,detail);allowance.append(box)}card.append(allowance)}else{const empty=document.createElement('p');empty.className='no-allowance';empty.textContent='Allowance data is not available for this harness.';card.append(empty)}return card}function render(model){document.body.dataset.state=model.state;const status=byId('status');status.textContent=model.statusLabel;status.className='status-chip '+model.state;setText('headline',model.headline);setText('summary',model.summary);setText('updated','Updated '+new Date(model.generatedAt).toLocaleString());setText('next-title',model.nextStep.title);setText('description',model.nextStep.description);const commandRow=byId('command-row');if(model.nextStep.command){setText('command',model.nextStep.command);commandRow.hidden=false}else{setText('command','');commandRow.hidden=true}const harnesses=byId('harnesses');harnesses.replaceChildren();if(model.harnesses.length===0){const empty=document.createElement('p');empty.className='supporting';empty.textContent='No active optimized harness is available yet.';harnesses.append(empty)}for(const item of model.harnesses)harnesses.append(renderHarness(item));const recommendationPanel=byId('recommendation-panel');if(model.recommendation){setText('recommendation',model.recommendation.action);setText('reason',model.recommendation.reason||'This recommendation is based on the currently observable local signals.');recommendationPanel.hidden=false}else{recommendationPanel.hidden=true}const providersPanel=byId('providers-panel');const providers=byId('providers');providers.replaceChildren();if(model.providers.length){for(const item of model.providers){const node=document.createElement('li');node.textContent=item.name+' \xB7 '+item.harnesses.join(', ');providers.append(node)}providersPanel.hidden=false}else{providersPanel.hidden=true}const otherPanel=byId('other-panel');const other=byId('other-harnesses');other.replaceChildren();if(model.otherHarnesses.length){setText('other-summary','Other detected tools ('+model.otherHarnesses.length+')');for(const item of model.otherHarnesses){const node=document.createElement('li');node.textContent=item.name+(item.version?' \xB7 '+item.version:'')+' \xB7 detected, not active in the optimized setup';other.append(node)}otherPanel.hidden=false}else{otherPanel.hidden=true}setText('error','')}async function load(){const refresh=byId('refresh');refresh.disabled=true;refresh.textContent='Refreshing\u2026';try{const response=await fetch('/api/status',{cache:'no-store'});if(!response.ok)throw new Error('Dashboard data is unavailable');render(await response.json())}catch(error){setText('error',error instanceof Error?error.message:String(error))}finally{refresh.disabled=false;refresh.textContent='Refresh'}}byId('refresh').addEventListener('click',load);byId('copy').addEventListener('click',async()=>{const command=byId('command').textContent||'';try{await navigator.clipboard.writeText(command);setText('updated','Command copied')}catch{setText('updated','Copy unavailable \u2014 select the command manually')}});load();setInterval(()=>{if(!document.hidden)load()},30000);`;
+  }
+});
+
 // apps/cli/dist/src/main.js
 var main_exports = {};
 __export(main_exports, {
   main: () => main
 });
 import process5 from "node:process";
+import { createServer } from "node:http";
 async function runAsDatabaseReader(argv2) {
   if (argv2[0] !== SQLITE_CHILD_FLAG)
     return false;
@@ -19815,15 +20743,24 @@ async function runAsDatabaseReader(argv2) {
 async function main(argv2) {
   if (await runAsDatabaseReader(argv2))
     return;
+  const uiInvocation = argv2[0] === "ui" ? parseUiArgs(argv2.slice(1)) : null;
+  if (uiInvocation !== null && !uiInvocation.ok) {
+    process5.stderr.write(`${uiInvocation.message}
+Run token-harness ui --help for usage.
+`);
+    process5.exitCode = EXIT_CODES["usage-error"];
+    return;
+  }
+  if (uiInvocation?.ok === true && uiInvocation.options.help) {
+    process5.stdout.write(`${UI_USAGE}
+`);
+    process5.exitCode = EXIT_CODES.ok;
+    return;
+  }
   const resolution = resolveHostEnvironment();
   const fs = resolution.ok ? new NodeFileSystem(resolution.environment.facts) : null;
   const attribution = resolution.ok && fs !== null ? await resolveAttributionSalt(fs, resolution.environment.paths.state) : { salt: null, diagnostics: [] };
-  const exitCode = await run({
-    argv: argv2,
-    streams: {
-      out: (text3) => process5.stdout.write(text3),
-      err: (text3) => process5.stderr.write(text3)
-    },
+  const baseOptions = {
     // On failure `facts` is null only when the operating system itself is
     // unsupported. An unresolvable state directory still has honest facts to
     // report, and `run` uses them for the runtime-floor check before refusing.
@@ -19872,15 +20809,188 @@ async function main(argv2) {
     }) : null,
     env: process5.env,
     stdoutIsTty: process5.stdout.isTTY === true
+  };
+  if (uiInvocation?.ok === true) {
+    process5.exitCode = await runUi(uiInvocation.options, baseOptions);
+    return;
+  }
+  const exitCode = await run({
+    ...baseOptions,
+    argv: argv2,
+    streams: {
+      out: (text3) => process5.stdout.write(text3),
+      err: (text3) => process5.stderr.write(text3)
+    }
   });
   process5.exitCode = exitCode;
 }
+async function readJsonReport(command, baseOptions) {
+  let stdout = "";
+  let stderr = "";
+  const exitCode = await run({
+    ...baseOptions,
+    argv: [command, "--json"],
+    streams: {
+      out: (text3) => {
+        stdout += text3;
+      },
+      err: (text3) => {
+        stderr += text3;
+      }
+    }
+  });
+  let envelope;
+  try {
+    envelope = JSON.parse(stdout);
+  } catch {
+    throw new Error(stderr.trim() || `${command} did not return a valid report`);
+  }
+  if (envelope.data === null) {
+    throw new Error(envelope.diagnostics[0]?.message ?? `${command} could not inspect this computer`);
+  }
+  return { exitCode, data: envelope.data };
+}
+async function collectDashboard(baseOptions) {
+  const [doctor, status, budget, optimize] = await Promise.all([
+    readJsonReport("doctor", baseOptions),
+    readJsonReport("status", baseOptions),
+    readJsonReport("budget", baseOptions),
+    readJsonReport("optimize", baseOptions)
+  ]);
+  return buildDashboardModel({
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    doctor: doctor.data,
+    status: status.data,
+    budget: budget.data,
+    optimize: optimize.data
+  });
+}
+async function openDashboard(url, baseOptions) {
+  const adapters = baseOptions.adapters;
+  const platform = baseOptions.platform;
+  if (adapters === null || adapters === void 0 || platform === null)
+    return false;
+  const request = platform.os === "windows" ? { executable: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] } : platform.os === "macos" ? { executable: "open", args: [url] } : { executable: "xdg-open", args: [url] };
+  const result2 = await adapters.runner.run({
+    ...request,
+    cwd: baseOptions.cwd,
+    env: Object.fromEntries(["DISPLAY", "WAYLAND_DISPLAY", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS"].flatMap((name) => process5.env[name] === void 0 ? [] : [[name, process5.env[name]]])),
+    timeoutMs: 5e3,
+    maxOutputBytes: 4096
+  });
+  return result2.failure === null && result2.exitCode === 0;
+}
+async function runUi(options, baseOptions) {
+  let initial;
+  try {
+    initial = await collectDashboard(baseOptions);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      process5.stdout.write(serializeEnvelope(toEnvelope(commandResult({
+        command: "ui",
+        exitCode: EXIT_CODES["unsupported-environment"],
+        diagnostics: [
+          diagnostic({
+            severity: "error",
+            code: "dashboard-unavailable",
+            message,
+            remediation: "Run token-harness doctor --verbose"
+          })
+        ]
+      }), TOOL_VERSION)));
+    } else {
+      process5.stderr.write(`Token Harness dashboard could not start: ${message}
+`);
+    }
+    return EXIT_CODES["unsupported-environment"];
+  }
+  if (options.json) {
+    const exitCode = initial.state === "action-needed" ? EXIT_CODES["problems-found"] : EXIT_CODES.ok;
+    process5.stdout.write(serializeEnvelope(toEnvelope(commandResult({ command: "ui", exitCode, data: initial }), TOOL_VERSION)));
+    return exitCode;
+  }
+  let cached = initial;
+  let cachedAt = Date.now();
+  const server = createServer(async (request, response) => {
+    const host = request.headers.host ?? "";
+    const sameSite = request.headers["sec-fetch-site"] !== "cross-site";
+    const localHost = host.startsWith("127.0.0.1:") || host.startsWith("localhost:");
+    if (!sameSite || !localHost) {
+      response.writeHead(403, { ...UI_SECURITY_HEADERS, "Content-Type": "text/plain" });
+      response.end("Forbidden\n");
+      return;
+    }
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      response.writeHead(405, {
+        ...UI_SECURITY_HEADERS,
+        Allow: "GET, HEAD",
+        "Content-Type": "text/plain"
+      });
+      response.end("Method not allowed\n");
+      return;
+    }
+    let model = cached;
+    if (request.url === "/api/status") {
+      if (Date.now() - cachedAt > 5e3) {
+        try {
+          cached = await collectDashboard(baseOptions);
+          cachedAt = Date.now();
+          model = cached;
+        } catch {
+          response.writeHead(503, {
+            ...UI_SECURITY_HEADERS,
+            "Content-Type": "application/json; charset=utf-8"
+          });
+          response.end('{"error":"Dashboard data is temporarily unavailable"}');
+          return;
+        }
+      }
+    }
+    const asset = uiAsset(request.url ?? "/", model);
+    response.writeHead(asset.status, {
+      ...UI_SECURITY_HEADERS,
+      "Content-Type": asset.contentType
+    });
+    response.end(request.method === "HEAD" ? void 0 : asset.body);
+  });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port, "127.0.0.1", () => resolve());
+    });
+  } catch (error) {
+    process5.stderr.write(`Token Harness dashboard could not listen locally: ${error instanceof Error ? error.message : String(error)}
+`);
+    return EXIT_CODES["internal-error"];
+  }
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+  const url = `http://127.0.0.1:${port}/`;
+  process5.stdout.write(`Token Harness dashboard is ready: ${url}
+Close it with Ctrl+C.
+`);
+  if (options.open && !await openDashboard(url, baseOptions)) {
+    process5.stdout.write(`Open this address in your browser: ${url}
+`);
+  }
+  return EXIT_CODES.ok;
+}
+var UI_SECURITY_HEADERS;
 var init_main = __esm({
   "apps/cli/dist/src/main.js"() {
     "use strict";
     init_src();
     init_src2();
     init_run();
+    init_ui();
+    init_version2();
+    UI_SECURITY_HEADERS = {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    };
   }
 });