truecourse 0.1.11 → 0.1.12

package/cli.mjs

@@ -12185,957 +12185,1018 @@ var init_esm_debug3 = __esm({
   }
 });
 
-// tools/cli/src/commands/helpers.ts
-var helpers_exports = {};
-__export(helpers_exports, {
-  connectSocket: () => connectSocket,
-  ensureRepo: () => ensureRepo,
-  ensureServer: () => ensureServer,
-  getConfigPath: () => getConfigPath,
-  getServerUrl: () => getServerUrl,
-  readConfig: () => readConfig,
-  renderDiffResults: () => renderDiffResults,
-  renderDiffResultsSummary: () => renderDiffResultsSummary,
-  renderViolations: () => renderViolations,
-  renderViolationsSummary: () => renderViolationsSummary,
-  severityColor: () => severityColor,
-  severityIcon: () => severityIcon,
-  writeConfig: () => writeConfig
-});
+// tools/cli/src/commands/service/env.ts
 import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-function getConfigPath() {
-  return path.join(os.homedir(), ".truecourse", "config.json");
-}
-function readConfig() {
-  const configPath = getConfigPath();
-  try {
-    const raw = fs.readFileSync(configPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return { ...DEFAULT_CONFIG, ...parsed };
-  } catch {
-    return { ...DEFAULT_CONFIG };
+function parseEnvFile(filePath) {
+  const vars = {};
+  if (!fs.existsSync(filePath)) {
+    return vars;
   }
-}
-function writeConfig(partial) {
-  const configPath = getConfigPath();
-  const dir = path.dirname(configPath);
-  fs.mkdirSync(dir, { recursive: true });
-  const current = readConfig();
-  const merged = { ...current, ...partial };
-  fs.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
-}
-function getServerUrl() {
-  const port = process.env.PORT || DEFAULT_PORT;
-  return `http://localhost:${port}`;
-}
-async function ensureServer() {
-  const url2 = getServerUrl();
-  try {
-    const res = await fetch(`${url2}/api/health`);
-    if (!res.ok) {
-      throw new Error(`Server returned ${res.status}`);
+  const content = fs.readFileSync(filePath, "utf-8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = trimmed.slice(0, eqIndex).trim();
+    let value2 = trimmed.slice(eqIndex + 1).trim();
+    if (value2.startsWith('"') && value2.endsWith('"') || value2.startsWith("'") && value2.endsWith("'")) {
+      value2 = value2.slice(1, -1);
     }
-  } catch {
-    v2.error(
-      "Could not connect to TrueCourse server. Is it running?\n  Start it with: npx truecourse start"
-    );
-    process.exit(1);
-  }
-}
-async function ensureRepo() {
-  const url2 = getServerUrl();
-  const repoPath = process.cwd();
-  const res = await fetch(`${url2}/api/repos`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ path: repoPath })
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    let message = `Server returned ${res.status}`;
-    try {
-      const json = JSON.parse(body);
-      if (json.error) message = json.error;
-    } catch {
-      if (body) message = body;
+    if (key) {
+      vars[key] = value2;
     }
-    v2.error(message);
-    process.exit(1);
-  }
-  return await res.json();
-}
-function connectSocket(repoId) {
-  const url2 = getServerUrl();
-  const socket = lookup(url2, {
-    autoConnect: false,
-    reconnection: true,
-    reconnectionAttempts: 5,
-    transports: ["websocket", "polling"]
-  });
-  socket.connect();
-  socket.on("connect", () => {
-    socket.emit("joinRepo", repoId);
-  });
-  if (socket.connected) {
-    socket.emit("joinRepo", repoId);
   }
-  return socket;
-}
-function severityIcon(severity) {
-  const s = severity.toLowerCase();
-  if (s === "critical" || s === "high") return "\u2716";
-  if (s === "medium") return "\u26A0";
-  return "\u2139";
-}
-function severityColor(severity) {
-  const s = severity.toLowerCase();
-  if (s === "critical") return (t) => `\x1B[91m${t}\x1B[0m`;
-  if (s === "high") return (t) => `\x1B[31m${t}\x1B[0m`;
-  if (s === "medium") return (t) => `\x1B[33m${t}\x1B[0m`;
-  return (t) => `\x1B[36m${t}\x1B[0m`;
-}
-function buildTargetPath(v3) {
-  const parts2 = [];
-  if (v3.targetServiceName) parts2.push(v3.targetServiceName);
-  if (v3.targetDatabaseName) parts2.push(v3.targetDatabaseName);
-  if (v3.targetModuleName) parts2.push(v3.targetModuleName);
-  if (v3.targetMethodName) parts2.push(v3.targetMethodName);
-  if (v3.targetTable) parts2.push(`table: ${v3.targetTable}`);
-  return parts2.join(" :: ");
+  return vars;
 }
-function wrapText(text, indent, maxWidth) {
-  const words = text.split(/\s+/);
-  const lines = [];
-  let line = "";
-  for (const word of words) {
-    if (line && line.length + 1 + word.length > maxWidth) {
-      lines.push(line);
-      line = word;
-    } else {
-      line = line ? `${line} ${word}` : word;
-    }
+var init_env = __esm({
+  "tools/cli/src/commands/service/env.ts"() {
+    "use strict";
   }
-  if (line) lines.push(line);
-  return lines.map((l2, i) => i === 0 ? l2 : `${indent}${l2}`).join("\n");
+});
+
+// tools/cli/src/commands/service/macos.ts
+import fs2 from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { execSync } from "node:child_process";
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
-function renderViolations(violations) {
-  if (violations.length === 0) {
-    v2.info("No violations found. Run `truecourse analyze` first.");
-    return;
-  }
-  console.log("");
-  const counts = {};
-  for (const v3 of violations) {
-    const sev = v3.severity.toLowerCase();
-    counts[sev] = (counts[sev] || 0) + 1;
-    const icon = severityIcon(v3.severity);
-    const color = severityColor(v3.severity);
-    const label = v3.severity.toUpperCase();
-    const target = buildTargetPath(v3);
-    console.log(`  ${color(`${icon} ${label}`)}  ${v3.title}`);
-    if (target) {
-      console.log(`              ${target}`);
-    }
-    if (v3.fixPrompt) {
-      const indent = "              ";
-      console.log("");
-      console.log(`              Fix: ${wrapText(v3.fixPrompt, indent + "     ", 60)}`);
-    }
-    console.log("");
-  }
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  const parts2 = [];
-  for (const sev of ["critical", "high", "medium", "low", "info"]) {
-    if (counts[sev]) parts2.push(`${counts[sev]} ${sev}`);
+function buildPlist(serverPath, logPath, envVars) {
+  const stdoutPath = path.join(path.dirname(logPath), "truecourse.log");
+  const stderrPath = path.join(path.dirname(logPath), "truecourse.error.log");
+  let envSection = "";
+  if (Object.keys(envVars).length > 0) {
+    const entries = Object.entries(envVars).map(([k3, v3]) => `      <key>${escapeXml(k3)}</key>
+      <string>${escapeXml(v3)}</string>`).join("\n");
+    envSection = `
+    <key>EnvironmentVariables</key>
+    <dict>
+${entries}
+    </dict>`;
   }
-  console.log(`  ${violations.length} violations (${parts2.join(", ")})`);
-  console.log("");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${SERVICE_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${escapeXml(process.execPath)}</string>
+        <string>${escapeXml(serverPath)}</string>
+    </array>
+    <key>KeepAlive</key>
+    <true/>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${escapeXml(stdoutPath)}</string>
+    <key>StandardErrorPath</key>
+    <string>${escapeXml(stderrPath)}</string>${envSection}
+</dict>
+</plist>
+`;
 }
-function renderViolationsSummary(violations) {
-  if (violations.length === 0) {
-    v2.info("No violations found.");
-    return;
-  }
-  const counts = {};
-  for (const v3 of violations) {
-    const sev = v3.severity.toLowerCase();
-    counts[sev] = (counts[sev] || 0) + 1;
-  }
-  const parts2 = [];
-  for (const sev of ["critical", "high", "medium", "low", "info"]) {
-    if (counts[sev]) {
-      const color = severityColor(sev);
-      parts2.push(color(`${counts[sev]} ${sev}`));
-    }
+var SERVICE_LABEL, PLIST_DIR, PLIST_PATH, MacOSService;
+var init_macos = __esm({
+  "tools/cli/src/commands/service/macos.ts"() {
+    "use strict";
+    init_env();
+    SERVICE_LABEL = "com.truecourse.server";
+    PLIST_DIR = path.join(os.homedir(), "Library", "LaunchAgents");
+    PLIST_PATH = path.join(PLIST_DIR, `${SERVICE_LABEL}.plist`);
+    MacOSService = class {
+      async install(serverPath, logPath) {
+        const envFile = path.join(os.homedir(), ".truecourse", ".env");
+        const envVars = parseEnvFile(envFile);
+        fs2.mkdirSync(PLIST_DIR, { recursive: true });
+        fs2.mkdirSync(path.dirname(logPath), { recursive: true });
+        const plist = buildPlist(serverPath, logPath, envVars);
+        fs2.writeFileSync(PLIST_PATH, plist, "utf-8");
+        execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
+      }
+      async uninstall() {
+        try {
+          execSync(`launchctl unload "${PLIST_PATH}"`, { stdio: "pipe" });
+        } catch {
+        }
+        if (fs2.existsSync(PLIST_PATH)) {
+          fs2.unlinkSync(PLIST_PATH);
+        }
+      }
+      async start() {
+        execSync(`launchctl start ${SERVICE_LABEL}`, { stdio: "pipe" });
+      }
+      async stop() {
+        execSync(`launchctl stop ${SERVICE_LABEL}`, { stdio: "pipe" });
+      }
+      async status() {
+        try {
+          const output = execSync(`launchctl list ${SERVICE_LABEL}`, {
+            stdio: ["pipe", "pipe", "pipe"],
+            encoding: "utf-8"
+          });
+          const pidMatch = output.match(/"PID"\s*=\s*(\d+)/);
+          if (pidMatch) {
+            return { running: true, pid: parseInt(pidMatch[1], 10) };
+          }
+          if (output.includes('"PID"')) {
+            return { running: true };
+          }
+          return { running: false };
+        } catch {
+          return { running: false };
+        }
+      }
+      async isInstalled() {
+        return fs2.existsSync(PLIST_PATH);
+      }
+    };
   }
-  console.log("");
-  console.log(`  ${violations.length} violations (${parts2.join(", ")})`);
-  console.log("");
-  v2.info("Run `truecourse list` to see full details.");
+});
+
+// tools/cli/src/commands/service/linux.ts
+import fs3 from "node:fs";
+import path2 from "node:path";
+import os2 from "node:os";
+import { execSync as execSync2 } from "node:child_process";
+function buildUnitFile(serverPath, logPath) {
+  const envFile = path2.join(os2.homedir(), ".truecourse", ".env");
+  const logDir = path2.dirname(logPath);
+  return `[Unit]
+Description=TrueCourse Server
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${process.execPath} ${serverPath}
+Restart=on-failure
+RestartSec=5
+EnvironmentFile=${envFile}
+StandardOutput=append:${path2.join(logDir, "truecourse.log")}
+StandardError=append:${path2.join(logDir, "truecourse.error.log")}
+
+[Install]
+WantedBy=default.target
+`;
 }
-function renderDiffResults(result) {
-  console.log("");
-  const modified = result.changedFiles.filter((f2) => f2.status === "modified").length;
-  const newFiles = result.changedFiles.filter((f2) => f2.status === "new").length;
-  const deleted = result.changedFiles.filter((f2) => f2.status === "deleted").length;
-  const fileParts = [];
-  if (modified) fileParts.push(`${modified} modified`);
-  if (newFiles) fileParts.push(`${newFiles} new`);
-  if (deleted) fileParts.push(`${deleted} deleted`);
-  console.log(`  Changed files: ${result.changedFiles.length} (${fileParts.join(", ")})`);
-  console.log("");
-  if (result.isStale) {
-    console.log(`  \x1B[33m\u26A0 Results may be stale \u2014 baseline analysis has changed.\x1B[0m`);
-    console.log("");
-  }
-  if (result.newViolations.length > 0) {
-    console.log(`  NEW ISSUES (${result.newViolations.length})`);
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    for (const v3 of result.newViolations) {
-      const icon = severityIcon(v3.severity);
-      const color = severityColor(v3.severity);
-      const label = v3.severity.toUpperCase();
-      const target = buildTargetPath(v3);
-      console.log(`  ${color(`${icon} ${label}`)}  ${v3.title}`);
-      if (target) {
-        console.log(`              ${target}`);
+var SERVICE_NAME, UNIT_DIR, UNIT_PATH, LinuxService;
+var init_linux = __esm({
+  "tools/cli/src/commands/service/linux.ts"() {
+    "use strict";
+    SERVICE_NAME = "truecourse";
+    UNIT_DIR = path2.join(os2.homedir(), ".config", "systemd", "user");
+    UNIT_PATH = path2.join(UNIT_DIR, `${SERVICE_NAME}.service`);
+    LinuxService = class {
+      async install(serverPath, logPath) {
+        fs3.mkdirSync(UNIT_DIR, { recursive: true });
+        fs3.mkdirSync(path2.dirname(logPath), { recursive: true });
+        const unit = buildUnitFile(serverPath, logPath);
+        fs3.writeFileSync(UNIT_PATH, unit, "utf-8");
+        execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
+        execSync2(`systemctl --user enable ${SERVICE_NAME}`, { stdio: "pipe" });
+      }
+      async uninstall() {
+        try {
+          execSync2(`systemctl --user stop ${SERVICE_NAME}`, { stdio: "pipe" });
+        } catch {
+        }
+        try {
+          execSync2(`systemctl --user disable ${SERVICE_NAME}`, { stdio: "pipe" });
+        } catch {
+        }
+        if (fs3.existsSync(UNIT_PATH)) {
+          fs3.unlinkSync(UNIT_PATH);
+        }
+        try {
+          execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
+        } catch {
+        }
       }
-      if (v3.fixPrompt) {
-        const indent = "              ";
-        console.log("");
-        console.log(`              Fix: ${wrapText(v3.fixPrompt, indent + "     ", 60)}`);
+      async start() {
+        execSync2(`systemctl --user start ${SERVICE_NAME}`, { stdio: "pipe" });
       }
-      console.log("");
-    }
-  } else {
-    console.log("  NEW ISSUES (0)");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    console.log("  None");
-    console.log("");
-  }
-  if (result.resolvedViolations.length > 0) {
-    console.log(`  RESOLVED (${result.resolvedViolations.length})`);
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    for (const v3 of result.resolvedViolations) {
-      const target = buildTargetPath(v3);
-      const color = severityColor(v3.severity);
-      const label = v3.severity.toUpperCase();
-      console.log(`  ${color(`\u2714 ${label}`)}  ${v3.title}`);
-      if (target) {
-        console.log(`              ${target}`);
+      async stop() {
+        execSync2(`systemctl --user stop ${SERVICE_NAME}`, { stdio: "pipe" });
       }
-      console.log("");
-    }
-  } else {
-    console.log("  RESOLVED (0)");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    console.log("  None");
-    console.log("");
+      async status() {
+        try {
+          const output = execSync2(
+            `systemctl --user show ${SERVICE_NAME} --property=ActiveState,MainPID`,
+            { stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" }
+          );
+          const activeMatch = output.match(/ActiveState=(\w+)/);
+          const pidMatch = output.match(/MainPID=(\d+)/);
+          const isActive = activeMatch?.[1] === "active";
+          const pid = pidMatch ? parseInt(pidMatch[1], 10) : void 0;
+          return { running: isActive, pid: isActive && pid ? pid : void 0 };
+        } catch {
+          return { running: false };
+        }
+      }
+      async isInstalled() {
+        return fs3.existsSync(UNIT_PATH);
+      }
+    };
   }
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  console.log(`  Summary: ${result.summary.newCount} new issues, ${result.summary.resolvedCount} resolved`);
-  console.log("");
-}
-function renderDiffResultsSummary(result) {
-  console.log("");
-  const modified = result.changedFiles.filter((f2) => f2.status === "modified").length;
-  const newFiles = result.changedFiles.filter((f2) => f2.status === "new").length;
-  const deleted = result.changedFiles.filter((f2) => f2.status === "deleted").length;
-  const fileParts = [];
-  if (modified) fileParts.push(`${modified} modified`);
-  if (newFiles) fileParts.push(`${newFiles} new`);
-  if (deleted) fileParts.push(`${deleted} deleted`);
-  console.log(`  Changed files: ${result.changedFiles.length} (${fileParts.join(", ")})`);
-  console.log("");
-  if (result.isStale) {
-    console.log(`  \x1B[33m\u26A0 Results may be stale \u2014 baseline analysis has changed.\x1B[0m`);
-    console.log("");
+});
+
+// tools/cli/src/commands/service/windows.ts
+import { execSync as execSync3 } from "node:child_process";
+var SERVICE_NAME2, WindowsService;
+var init_windows = __esm({
+  "tools/cli/src/commands/service/windows.ts"() {
+    "use strict";
+    SERVICE_NAME2 = "TrueCourse";
+    WindowsService = class {
+      svc;
+      async getNodeWindows() {
+        try {
+          return __require("node-windows");
+        } catch {
+          throw new Error(
+            "node-windows is required for background service on Windows.\nInstall it with: npm install -g node-windows"
+          );
+        }
+      }
+      async install(serverPath, logPath) {
+        const nw = await this.getNodeWindows();
+        const { Service } = nw;
+        return new Promise((resolve2, reject) => {
+          const svc = new Service({
+            name: SERVICE_NAME2,
+            description: "TrueCourse Server",
+            script: serverPath,
+            nodeOptions: [],
+            env: [{
+              name: "TRUECOURSE_LOG_DIR",
+              value: logPath
+            }]
+          });
+          svc.on("install", () => {
+            svc.start();
+            resolve2();
+          });
+          svc.on("error", (err) => reject(err));
+          svc.install();
+        });
+      }
+      async uninstall() {
+        const nw = await this.getNodeWindows();
+        const { Service } = nw;
+        return new Promise((resolve2, reject) => {
+          const svc = new Service({
+            name: SERVICE_NAME2,
+            script: ""
+            // Not needed for uninstall
+          });
+          svc.on("uninstall", () => resolve2());
+          svc.on("error", (err) => reject(err));
+          svc.uninstall();
+        });
+      }
+      async start() {
+        execSync3(`sc.exe start ${SERVICE_NAME2}`, { stdio: "pipe" });
+      }
+      async stop() {
+        execSync3(`sc.exe stop ${SERVICE_NAME2}`, { stdio: "pipe" });
+      }
+      async status() {
+        try {
+          const output = execSync3(`sc.exe query ${SERVICE_NAME2}`, {
+            stdio: ["pipe", "pipe", "pipe"],
+            encoding: "utf-8"
+          });
+          const running = output.includes("RUNNING");
+          const pidMatch = output.match(/PID\s*:\s*(\d+)/);
+          return {
+            running,
+            pid: pidMatch ? parseInt(pidMatch[1], 10) : void 0
+          };
+        } catch {
+          return { running: false };
+        }
+      }
+      async isInstalled() {
+        try {
+          execSync3(`sc.exe query ${SERVICE_NAME2}`, { stdio: "pipe" });
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    };
+  }
+});
+
+// tools/cli/src/commands/service/platform.ts
+function getPlatform() {
+  switch (process.platform) {
+    case "darwin":
+      return new MacOSService();
+    case "linux":
+      return new LinuxService();
+    case "win32":
+      return new WindowsService();
+    default:
+      throw new Error(
+        `Unsupported platform: ${process.platform}. Background service mode supports macOS, Linux, and Windows.`
+      );
   }
-  console.log(`  Summary: ${result.summary.newCount} new issues, ${result.summary.resolvedCount} resolved`);
-  console.log("");
-  v2.info("Run `truecourse list --diff` to see full details.");
 }
-var DEFAULT_PORT, DEFAULT_CONFIG;
-var init_helpers = __esm({
-  "tools/cli/src/commands/helpers.ts"() {
+var init_platform = __esm({
+  "tools/cli/src/commands/service/platform.ts"() {
     "use strict";
-    init_dist2();
-    init_esm_debug3();
-    DEFAULT_PORT = 3001;
-    DEFAULT_CONFIG = { runMode: "console" };
+    init_macos();
+    init_linux();
+    init_windows();
   }
 });
 
-// node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
-var import_index = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  // deprecated old name
-  Command,
-  Argument,
-  Option,
-  Help
-} = import_index.default;
-
-// tools/cli/src/index.ts
-init_dist2();
-import fs7 from "node:fs";
-import path8 from "node:path";
-import os6 from "node:os";
-
-// tools/cli/src/commands/setup.ts
-init_dist2();
-import fs2 from "node:fs";
-import path2 from "node:path";
-import os2 from "node:os";
-var DEFAULT_MODELS = {
-  anthropic: "claude-sonnet-4-20250514",
-  openai: "gpt-5.3-codex"
-};
-function buildEnvContents(config) {
-  const lines = [
-    "# TrueCourse Environment Configuration",
-    `# Generated by truecourse setup on ${(/* @__PURE__ */ new Date()).toISOString()}`,
-    ""
-  ];
-  if (config.provider) {
-    lines.push(`LLM_PROVIDER=${config.provider}`);
-  }
-  if (config.model) {
-    lines.push(`LLM_MODEL=${config.model}`);
-  }
-  if (config.anthropicKey) {
-    lines.push(`ANTHROPIC_API_KEY=${config.anthropicKey}`);
-  }
-  if (config.openaiKey) {
-    lines.push(`OPENAI_API_KEY=${config.openaiKey}`);
-  }
-  if (config.langfusePublicKey && config.langfuseSecretKey) {
-    lines.push("");
-    lines.push("# Langfuse Tracing");
-    lines.push(`LANGFUSE_PUBLIC_KEY=${config.langfusePublicKey}`);
-    lines.push(`LANGFUSE_SECRET_KEY=${config.langfuseSecretKey}`);
-  }
-  lines.push("");
-  return lines.join("\n");
+// tools/cli/src/commands/service/logs.ts
+import fs4 from "node:fs";
+import path3 from "node:path";
+import os3 from "node:os";
+import { spawn } from "node:child_process";
+function getLogDir() {
+  return path3.join(os3.homedir(), ".truecourse", "logs");
 }
-async function runSetup() {
-  we("Welcome to TrueCourse");
-  const provider = await de({
-    message: "Which LLM provider would you like to use?",
-    options: [
-      { value: "anthropic", label: "Anthropic (Claude)" },
-      { value: "openai", label: "OpenAI (GPT)" },
-      { value: "skip", label: "Skip for now" }
-    ]
-  });
-  if (BD(provider)) {
-    ve("Setup cancelled.");
-    process.exit(0);
-  }
-  const config = {};
-  if (provider === "anthropic" || provider === "openai") {
-    config.provider = provider;
-  }
-  if (provider === "anthropic") {
-    const anthropicKey = await ue({
-      message: "Enter your Anthropic API key:",
-      placeholder: "sk-ant-...",
-      validate(value2) {
-        if (!value2 || value2.trim().length === 0) {
-          return "API key is required";
-        }
-      }
-    });
-    if (BD(anthropicKey)) {
-      ve("Setup cancelled.");
-      process.exit(0);
-    }
-    config.anthropicKey = anthropicKey;
-  }
-  if (provider === "openai") {
-    const openaiKey = await ue({
-      message: "Enter your OpenAI API key:",
-      placeholder: "sk-...",
-      validate(value2) {
-        if (!value2 || value2.trim().length === 0) {
-          return "API key is required";
-        }
-      }
-    });
-    if (BD(openaiKey)) {
-      ve("Setup cancelled.");
-      process.exit(0);
+function getLogPath() {
+  return path3.join(getLogDir(), "truecourse.log");
+}
+function rotateLogs(logDir) {
+  const logFile = path3.join(logDir, "truecourse.log");
+  if (!fs4.existsSync(logFile)) return;
+  const stats = fs4.statSync(logFile);
+  if (stats.size < MAX_LOG_SIZE) return;
+  for (let i = MAX_LOG_FILES; i >= 1; i--) {
+    const older = path3.join(logDir, `truecourse.log.${i}`);
+    if (i === MAX_LOG_FILES) {
+      if (fs4.existsSync(older)) fs4.unlinkSync(older);
+    } else {
+      const newer = path3.join(logDir, `truecourse.log.${i + 1}`);
+      if (fs4.existsSync(older)) fs4.renameSync(older, newer);
     }
-    config.openaiKey = openaiKey;
   }
-  if (provider === "anthropic" || provider === "openai") {
-    const defaultModel = DEFAULT_MODELS[provider];
-    const model = await ue({
-      message: `Enter the model to use (default: ${defaultModel}):`,
-      placeholder: defaultModel
-    });
-    if (BD(model)) {
-      ve("Setup cancelled.");
-      process.exit(0);
+  fs4.renameSync(logFile, path3.join(logDir, "truecourse.log.1"));
+}
+function rotateErrorLogs(logDir) {
+  const logFile = path3.join(logDir, "truecourse.error.log");
+  if (!fs4.existsSync(logFile)) return;
+  const stats = fs4.statSync(logFile);
+  if (stats.size < MAX_LOG_SIZE) return;
+  for (let i = MAX_LOG_FILES; i >= 1; i--) {
+    const older = path3.join(logDir, `truecourse.error.log.${i}`);
+    if (i === MAX_LOG_FILES) {
+      if (fs4.existsSync(older)) fs4.unlinkSync(older);
+    } else {
+      const newer = path3.join(logDir, `truecourse.error.log.${i + 1}`);
+      if (fs4.existsSync(older)) fs4.renameSync(older, newer);
     }
-    config.model = model?.trim() || defaultModel;
   }
-  const useLangfuse = await me({
-    message: "Would you like to enable Langfuse tracing?",
-    initialValue: false
-  });
-  if (BD(useLangfuse)) {
-    ve("Setup cancelled.");
-    process.exit(0);
+  fs4.renameSync(logFile, path3.join(logDir, "truecourse.error.log.1"));
+}
+function tailLogs() {
+  const logFile = getLogPath();
+  if (!fs4.existsSync(logFile)) {
+    console.log("No log file found. Is the service running?");
+    console.log(`Expected at: ${logFile}`);
+    return;
   }
-  if (useLangfuse) {
-    const langfusePublicKey = await ue({
-      message: "Enter your Langfuse public key:",
-      placeholder: "pk-lf-...",
-      validate(value2) {
-        if (!value2 || value2.trim().length === 0) {
-          return "Public key is required";
-        }
-      }
-    });
-    if (BD(langfusePublicKey)) {
-      ve("Setup cancelled.");
-      process.exit(0);
+  if (process.platform === "win32") {
+    const content = fs4.readFileSync(logFile, "utf-8");
+    const lines = content.split("\n");
+    const tail = lines.slice(-50);
+    for (const line of tail) {
+      process.stdout.write(line + "\n");
     }
-    const langfuseSecretKey = await ue({
-      message: "Enter your Langfuse secret key:",
-      placeholder: "sk-lf-...",
-      validate(value2) {
-        if (!value2 || value2.trim().length === 0) {
-          return "Secret key is required";
-        }
+    let lastSize = fs4.statSync(logFile).size;
+    fs4.watchFile(logFile, { interval: 500 }, () => {
+      const newSize = fs4.statSync(logFile).size;
+      if (newSize > lastSize) {
+        const fd = fs4.openSync(logFile, "r");
+        const buf = Buffer.alloc(newSize - lastSize);
+        fs4.readSync(fd, buf, 0, buf.length, lastSize);
+        fs4.closeSync(fd);
+        process.stdout.write(buf.toString("utf-8"));
+        lastSize = newSize;
       }
     });
-    if (BD(langfuseSecretKey)) {
-      ve("Setup cancelled.");
+  } else {
+    const tail = spawn("tail", ["-f", "-n", "50", logFile], {
+      stdio: "inherit"
+    });
+    const cleanup = () => {
+      tail.kill("SIGTERM");
+    };
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+    tail.on("close", () => {
       process.exit(0);
-    }
-    config.langfusePublicKey = langfusePublicKey;
-    config.langfuseSecretKey = langfuseSecretKey;
+    });
   }
-  const configDir = path2.join(os2.homedir(), ".truecourse");
-  fs2.mkdirSync(configDir, { recursive: true });
-  const envPath = path2.join(configDir, ".env");
-  fs2.writeFileSync(envPath, buildEnvContents(config), "utf-8");
-  v2.success(`Configuration saved to ${envPath}`);
-  const runMode = await de({
-    message: "How would you like to run TrueCourse?",
-    options: [
-      { value: "console", label: "Console (keep terminal open)" },
-      { value: "service", label: "Background service (runs automatically, no terminal needed)" }
-    ]
-  });
-  if (BD(runMode)) {
-    ve("Setup cancelled.");
-    process.exit(0);
+}
+var MAX_LOG_SIZE, MAX_LOG_FILES;
+var init_logs = __esm({
+  "tools/cli/src/commands/service/logs.ts"() {
+    "use strict";
+    MAX_LOG_SIZE = 10 * 1024 * 1024;
+    MAX_LOG_FILES = 5;
   }
-  const { writeConfig: writeConfig2 } = await Promise.resolve().then(() => (init_helpers(), helpers_exports));
-  writeConfig2({ runMode });
-  if (runMode === "service") {
-    v2.info("Background service selected. Run `truecourse start` to install and start the service.");
+});
+
+// tools/cli/src/commands/start.ts
+var start_exports = {};
+__export(start_exports, {
+  runStart: () => runStart
+});
+import { spawn as spawn2 } from "node:child_process";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+function getServerPath() {
+  return path4.join(__dirname, "server.mjs");
+}
+async function healthcheck() {
+  const url2 = getServerUrl();
+  for (let i = 0; i < 30; i++) {
+    try {
+      const res = await fetch(`${url2}/api/health`);
+      if (res.ok) return true;
+    } catch {
+    }
+    await new Promise((r2) => setTimeout(r2, 500));
   }
-  v2.info("Embedded PostgreSQL will start automatically when the server runs.");
-  v2.info("Database migrations are applied on server startup.");
-  fe("Setup complete!");
+  return false;
 }
-
-// tools/cli/src/commands/start.ts
-init_dist2();
-init_helpers();
-import { spawn as spawn2 } from "node:child_process";
-import path6 from "node:path";
-import { fileURLToPath } from "node:url";
-
-// tools/cli/src/commands/service/macos.ts
-import fs4 from "node:fs";
-import path3 from "node:path";
-import os3 from "node:os";
-import { execSync } from "node:child_process";
-
-// tools/cli/src/commands/service/env.ts
-import fs3 from "node:fs";
-function parseEnvFile(filePath) {
-  const vars = {};
-  if (!fs3.existsSync(filePath)) {
-    return vars;
+async function startServiceMode(openBrowser) {
+  const platform = getPlatform();
+  const serverPath = getServerPath();
+  const logDir = getLogDir();
+  const logPath = getLogPath();
+  const url2 = getServerUrl();
+  const { running } = await platform.status();
+  if (running) {
+    v2.info(`TrueCourse is already running at ${url2}`);
+    return;
   }
-  const content = fs3.readFileSync(filePath, "utf-8");
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eqIndex = trimmed.indexOf("=");
-    if (eqIndex === -1) continue;
-    const key = trimmed.slice(0, eqIndex).trim();
-    let value2 = trimmed.slice(eqIndex + 1).trim();
-    if (value2.startsWith('"') && value2.endsWith('"') || value2.startsWith("'") && value2.endsWith("'")) {
-      value2 = value2.slice(1, -1);
+  const installed = await platform.isInstalled();
+  if (installed) {
+    rotateLogs(logDir);
+    rotateErrorLogs(logDir);
+    v2.step("Starting background service...");
+    await platform.start();
+  } else {
+    rotateLogs(logDir);
+    rotateErrorLogs(logDir);
+    v2.step("Installing and starting background service...");
+    await platform.install(serverPath, logPath);
+  }
+  const healthy = await healthcheck();
+  if (healthy) {
+    v2.success(`TrueCourse is running at ${url2}`);
+    if (openBrowser) openInBrowser(url2);
+  } else {
+    v2.warn("Service started but server hasn't responded yet.");
+    v2.info("Check logs with: truecourse service logs");
+  }
+}
+function startConsoleMode() {
+  const serverPath = getServerPath();
+  v2.step("Starting server (embedded PostgreSQL starts automatically)...");
+  const serverProcess = spawn2(
+    process.execPath,
+    [serverPath],
+    {
+      stdio: "inherit",
+      env: { ...process.env }
     }
-    if (key) {
-      vars[key] = value2;
+  );
+  serverProcess.on("error", (error) => {
+    v2.error(`Failed to start server: ${error.message}`);
+    process.exit(1);
+  });
+  serverProcess.on("close", (code) => {
+    if (code !== null && code !== 0) {
+      process.exit(code);
+    }
+  });
+  const cleanup = () => {
+    serverProcess.kill("SIGTERM");
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+}
+async function runStart({ openBrowser = true } = {}) {
+  we("Starting TrueCourse");
+  const config = readConfig();
+  if (config.runMode === "service") {
+    try {
+      await startServiceMode(openBrowser);
+    } catch (error) {
+      v2.error(`Service mode failed: ${error.message}`);
+      v2.info("Falling back to console mode. Reconfigure with: truecourse setup");
+      startConsoleMode();
     }
+  } else {
+    startConsoleMode();
   }
-  return vars;
 }
+var __dirname;
+var init_start = __esm({
+  "tools/cli/src/commands/start.ts"() {
+    "use strict";
+    init_dist2();
+    init_helpers();
+    init_platform();
+    init_logs();
+    __dirname = path4.dirname(fileURLToPath(import.meta.url));
+  }
+});
 
-// tools/cli/src/commands/service/macos.ts
-var SERVICE_LABEL = "com.truecourse.server";
-var PLIST_DIR = path3.join(os3.homedir(), "Library", "LaunchAgents");
-var PLIST_PATH = path3.join(PLIST_DIR, `${SERVICE_LABEL}.plist`);
-function escapeXml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+// tools/cli/src/commands/helpers.ts
+var helpers_exports = {};
+__export(helpers_exports, {
+  connectSocket: () => connectSocket,
+  ensureRepo: () => ensureRepo,
+  ensureServer: () => ensureServer,
+  getConfigPath: () => getConfigPath,
+  getServerUrl: () => getServerUrl,
+  openInBrowser: () => openInBrowser,
+  readConfig: () => readConfig,
+  renderDiffResults: () => renderDiffResults,
+  renderDiffResultsSummary: () => renderDiffResultsSummary,
+  renderViolations: () => renderViolations,
+  renderViolationsSummary: () => renderViolationsSummary,
+  severityColor: () => severityColor,
+  severityIcon: () => severityIcon,
+  writeConfig: () => writeConfig
+});
+import { exec } from "node:child_process";
+import fs5 from "node:fs";
+import path5 from "node:path";
+import os4 from "node:os";
+function getConfigPath() {
+  return path5.join(os4.homedir(), ".truecourse", "config.json");
 }
-function buildPlist(serverPath, logPath, envVars) {
-  const stdoutPath = path3.join(path3.dirname(logPath), "truecourse.log");
-  const stderrPath = path3.join(path3.dirname(logPath), "truecourse.error.log");
-  let envSection = "";
-  if (Object.keys(envVars).length > 0) {
-    const entries = Object.entries(envVars).map(([k3, v3]) => `      <key>${escapeXml(k3)}</key>
-      <string>${escapeXml(v3)}</string>`).join("\n");
-    envSection = `
-    <key>EnvironmentVariables</key>
-    <dict>
-${entries}
-    </dict>`;
+function readConfig() {
+  const configPath = getConfigPath();
+  try {
+    const raw = fs5.readFileSync(configPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return { ...DEFAULT_CONFIG, ...parsed };
+  } catch {
+    return { ...DEFAULT_CONFIG };
   }
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>${SERVICE_LABEL}</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>${escapeXml(process.execPath)}</string>
-        <string>${escapeXml(serverPath)}</string>
-    </array>
-    <key>KeepAlive</key>
-    <true/>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>StandardOutPath</key>
-    <string>${escapeXml(stdoutPath)}</string>
-    <key>StandardErrorPath</key>
-    <string>${escapeXml(stderrPath)}</string>${envSection}
-</dict>
-</plist>
-`;
 }
-var MacOSService = class {
-  async install(serverPath, logPath) {
-    const envFile = path3.join(os3.homedir(), ".truecourse", ".env");
-    const envVars = parseEnvFile(envFile);
-    fs4.mkdirSync(PLIST_DIR, { recursive: true });
-    fs4.mkdirSync(path3.dirname(logPath), { recursive: true });
-    const plist = buildPlist(serverPath, logPath, envVars);
-    fs4.writeFileSync(PLIST_PATH, plist, "utf-8");
-    execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
-  }
-  async uninstall() {
+function writeConfig(partial) {
+  const configPath = getConfigPath();
+  const dir = path5.dirname(configPath);
+  fs5.mkdirSync(dir, { recursive: true });
+  const current = readConfig();
+  const merged = { ...current, ...partial };
+  fs5.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+}
+function getServerUrl() {
+  const port = process.env.PORT || DEFAULT_PORT;
+  return `http://localhost:${port}`;
+}
+async function ensureServer() {
+  const url2 = getServerUrl();
+  try {
+    const res = await fetch(`${url2}/api/health`);
+    if (!res.ok) throw new Error(`Server returned ${res.status}`);
+    return false;
+  } catch {
+    const { runStart: runStart2 } = await Promise.resolve().then(() => (init_start(), start_exports));
+    await runStart2({ openBrowser: false });
     try {
-      execSync(`launchctl unload "${PLIST_PATH}"`, { stdio: "pipe" });
+      const res = await fetch(`${url2}/api/health`);
+      if (!res.ok) throw new Error();
     } catch {
+      v2.error("Server failed to start. Check logs with: truecourse service logs");
+      process.exit(1);
     }
-    if (fs4.existsSync(PLIST_PATH)) {
-      fs4.unlinkSync(PLIST_PATH);
-    }
-  }
-  async start() {
-    execSync(`launchctl start ${SERVICE_LABEL}`, { stdio: "pipe" });
-  }
-  async stop() {
-    execSync(`launchctl stop ${SERVICE_LABEL}`, { stdio: "pipe" });
+    return true;
   }
-  async status() {
+}
+async function ensureRepo() {
+  const url2 = getServerUrl();
+  const repoPath = process.cwd();
+  const res = await fetch(`${url2}/api/repos`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ path: repoPath })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    let message = `Server returned ${res.status}`;
     try {
-      const output = execSync(`launchctl list ${SERVICE_LABEL}`, {
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf-8"
-      });
-      const pidMatch = output.match(/"PID"\s*=\s*(\d+)/);
-      if (pidMatch) {
-        return { running: true, pid: parseInt(pidMatch[1], 10) };
-      }
-      if (output.includes('"PID"')) {
-        return { running: true };
-      }
-      return { running: false };
+      const json = JSON.parse(body);
+      if (json.error) message = json.error;
     } catch {
-      return { running: false };
+      if (body) message = body;
+    }
+    v2.error(message);
+    process.exit(1);
+  }
+  return await res.json();
+}
+function connectSocket(repoId) {
+  const url2 = getServerUrl();
+  const socket = lookup(url2, {
+    autoConnect: false,
+    reconnection: true,
+    reconnectionAttempts: 5,
+    transports: ["websocket", "polling"]
+  });
+  socket.connect();
+  socket.on("connect", () => {
+    socket.emit("joinRepo", repoId);
+  });
+  if (socket.connected) {
+    socket.emit("joinRepo", repoId);
+  }
+  return socket;
+}
+function severityIcon(severity) {
+  const s = severity.toLowerCase();
+  if (s === "critical" || s === "high") return "\u2716";
+  if (s === "medium") return "\u26A0";
+  return "\u2139";
+}
+function severityColor(severity) {
+  const s = severity.toLowerCase();
+  if (s === "critical") return (t) => `\x1B[91m${t}\x1B[0m`;
+  if (s === "high") return (t) => `\x1B[31m${t}\x1B[0m`;
+  if (s === "medium") return (t) => `\x1B[33m${t}\x1B[0m`;
+  return (t) => `\x1B[36m${t}\x1B[0m`;
+}
+function buildTargetPath(v3) {
+  const parts2 = [];
+  if (v3.targetServiceName) parts2.push(v3.targetServiceName);
+  if (v3.targetDatabaseName) parts2.push(v3.targetDatabaseName);
+  if (v3.targetModuleName) parts2.push(v3.targetModuleName);
+  if (v3.targetMethodName) parts2.push(v3.targetMethodName);
+  if (v3.targetTable) parts2.push(`table: ${v3.targetTable}`);
+  return parts2.join(" :: ");
+}
+function wrapText(text, indent, maxWidth) {
+  const words = text.split(/\s+/);
+  const lines = [];
+  let line = "";
+  for (const word of words) {
+    if (line && line.length + 1 + word.length > maxWidth) {
+      lines.push(line);
+      line = word;
+    } else {
+      line = line ? `${line} ${word}` : word;
     }
   }
-  async isInstalled() {
-    return fs4.existsSync(PLIST_PATH);
-  }
-};
-
-// tools/cli/src/commands/service/linux.ts
-import fs5 from "node:fs";
-import path4 from "node:path";
-import os4 from "node:os";
-import { execSync as execSync2 } from "node:child_process";
-var SERVICE_NAME = "truecourse";
-var UNIT_DIR = path4.join(os4.homedir(), ".config", "systemd", "user");
-var UNIT_PATH = path4.join(UNIT_DIR, `${SERVICE_NAME}.service`);
-function buildUnitFile(serverPath, logPath) {
-  const envFile = path4.join(os4.homedir(), ".truecourse", ".env");
-  const logDir = path4.dirname(logPath);
-  return `[Unit]
-Description=TrueCourse Server
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=${process.execPath} ${serverPath}
-Restart=on-failure
-RestartSec=5
-EnvironmentFile=${envFile}
-StandardOutput=append:${path4.join(logDir, "truecourse.log")}
-StandardError=append:${path4.join(logDir, "truecourse.error.log")}
-
-[Install]
-WantedBy=default.target
-`;
+  if (line) lines.push(line);
+  return lines.map((l2, i) => i === 0 ? l2 : `${indent}${l2}`).join("\n");
 }
-var LinuxService = class {
-  async install(serverPath, logPath) {
-    fs5.mkdirSync(UNIT_DIR, { recursive: true });
-    fs5.mkdirSync(path4.dirname(logPath), { recursive: true });
-    const unit = buildUnitFile(serverPath, logPath);
-    fs5.writeFileSync(UNIT_PATH, unit, "utf-8");
-    execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
-    execSync2(`systemctl --user enable ${SERVICE_NAME}`, { stdio: "pipe" });
-  }
-  async uninstall() {
-    try {
-      execSync2(`systemctl --user stop ${SERVICE_NAME}`, { stdio: "pipe" });
-    } catch {
-    }
-    try {
-      execSync2(`systemctl --user disable ${SERVICE_NAME}`, { stdio: "pipe" });
-    } catch {
-    }
-    if (fs5.existsSync(UNIT_PATH)) {
-      fs5.unlinkSync(UNIT_PATH);
+function renderViolations(violations) {
+  if (violations.length === 0) {
+    v2.info("No violations found. Run `truecourse analyze` first.");
+    return;
+  }
+  console.log("");
+  const counts = {};
+  for (const v3 of violations) {
+    const sev = v3.severity.toLowerCase();
+    counts[sev] = (counts[sev] || 0) + 1;
+    const icon = severityIcon(v3.severity);
+    const color = severityColor(v3.severity);
+    const label = v3.severity.toUpperCase();
+    const target = buildTargetPath(v3);
+    console.log(`  ${color(`${icon} ${label}`)}  ${v3.title}`);
+    if (target) {
+      console.log(`              ${target}`);
     }
-    try {
-      execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
-    } catch {
+    if (v3.fixPrompt) {
+      const indent = "              ";
+      console.log("");
+      console.log(`              Fix: ${wrapText(v3.fixPrompt, indent + "     ", 60)}`);
     }
+    console.log("");
   }
-  async start() {
-    execSync2(`systemctl --user start ${SERVICE_NAME}`, { stdio: "pipe" });
-  }
-  async stop() {
-    execSync2(`systemctl --user stop ${SERVICE_NAME}`, { stdio: "pipe" });
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const parts2 = [];
+  for (const sev of ["critical", "high", "medium", "low", "info"]) {
+    if (counts[sev]) parts2.push(`${counts[sev]} ${sev}`);
   }
-  async status() {
-    try {
-      const output = execSync2(
-        `systemctl --user show ${SERVICE_NAME} --property=ActiveState,MainPID`,
-        { stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" }
-      );
-      const activeMatch = output.match(/ActiveState=(\w+)/);
-      const pidMatch = output.match(/MainPID=(\d+)/);
-      const isActive = activeMatch?.[1] === "active";
-      const pid = pidMatch ? parseInt(pidMatch[1], 10) : void 0;
-      return { running: isActive, pid: isActive && pid ? pid : void 0 };
-    } catch {
-      return { running: false };
-    }
+  console.log(`  ${violations.length} violations (${parts2.join(", ")})`);
+  console.log("");
+}
+function renderViolationsSummary(violations) {
+  if (violations.length === 0) {
+    v2.info("No violations found.");
+    return;
   }
-  async isInstalled() {
-    return fs5.existsSync(UNIT_PATH);
+  const counts = {};
+  for (const v3 of violations) {
+    const sev = v3.severity.toLowerCase();
+    counts[sev] = (counts[sev] || 0) + 1;
   }
-};
-
-// tools/cli/src/commands/service/windows.ts
-import { execSync as execSync3 } from "node:child_process";
-var SERVICE_NAME2 = "TrueCourse";
-var WindowsService = class {
-  svc;
-  async getNodeWindows() {
-    try {
-      return __require("node-windows");
-    } catch {
-      throw new Error(
-        "node-windows is required for background service on Windows.\nInstall it with: npm install -g node-windows"
-      );
+  const parts2 = [];
+  for (const sev of ["critical", "high", "medium", "low", "info"]) {
+    if (counts[sev]) {
+      const color = severityColor(sev);
+      parts2.push(color(`${counts[sev]} ${sev}`));
     }
   }
-  async install(serverPath, logPath) {
-    const nw = await this.getNodeWindows();
-    const { Service } = nw;
-    return new Promise((resolve2, reject) => {
-      const svc = new Service({
-        name: SERVICE_NAME2,
-        description: "TrueCourse Server",
-        script: serverPath,
-        nodeOptions: [],
-        env: [{
-          name: "TRUECOURSE_LOG_DIR",
-          value: logPath
-        }]
-      });
-      svc.on("install", () => {
-        svc.start();
-        resolve2();
-      });
-      svc.on("error", (err) => reject(err));
-      svc.install();
-    });
-  }
-  async uninstall() {
-    const nw = await this.getNodeWindows();
-    const { Service } = nw;
-    return new Promise((resolve2, reject) => {
-      const svc = new Service({
-        name: SERVICE_NAME2,
-        script: ""
-        // Not needed for uninstall
-      });
-      svc.on("uninstall", () => resolve2());
-      svc.on("error", (err) => reject(err));
-      svc.uninstall();
-    });
-  }
-  async start() {
-    execSync3(`sc.exe start ${SERVICE_NAME2}`, { stdio: "pipe" });
-  }
-  async stop() {
-    execSync3(`sc.exe stop ${SERVICE_NAME2}`, { stdio: "pipe" });
+  console.log("");
+  console.log(`  ${violations.length} violations (${parts2.join(", ")})`);
+  console.log("");
+  v2.info("Run `truecourse list` to see full details.");
+}
+function renderDiffResults(result) {
+  console.log("");
+  const modified = result.changedFiles.filter((f2) => f2.status === "modified").length;
+  const newFiles = result.changedFiles.filter((f2) => f2.status === "new").length;
+  const deleted = result.changedFiles.filter((f2) => f2.status === "deleted").length;
+  const fileParts = [];
+  if (modified) fileParts.push(`${modified} modified`);
+  if (newFiles) fileParts.push(`${newFiles} new`);
+  if (deleted) fileParts.push(`${deleted} deleted`);
+  console.log(`  Changed files: ${result.changedFiles.length} (${fileParts.join(", ")})`);
+  console.log("");
+  if (result.isStale) {
+    console.log(`  \x1B[33m\u26A0 Results may be stale \u2014 baseline analysis has changed.\x1B[0m`);
+    console.log("");
   }
-  async status() {
-    try {
-      const output = execSync3(`sc.exe query ${SERVICE_NAME2}`, {
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf-8"
-      });
-      const running = output.includes("RUNNING");
-      const pidMatch = output.match(/PID\s*:\s*(\d+)/);
-      return {
-        running,
-        pid: pidMatch ? parseInt(pidMatch[1], 10) : void 0
-      };
-    } catch {
-      return { running: false };
+  if (result.newViolations.length > 0) {
+    console.log(`  NEW ISSUES (${result.newViolations.length})`);
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    for (const v3 of result.newViolations) {
+      const icon = severityIcon(v3.severity);
+      const color = severityColor(v3.severity);
+      const label = v3.severity.toUpperCase();
+      const target = buildTargetPath(v3);
+      console.log(`  ${color(`${icon} ${label}`)}  ${v3.title}`);
+      if (target) {
+        console.log(`              ${target}`);
+      }
+      if (v3.fixPrompt) {
+        const indent = "              ";
+        console.log("");
+        console.log(`              Fix: ${wrapText(v3.fixPrompt, indent + "     ", 60)}`);
+      }
+      console.log("");
     }
+  } else {
+    console.log("  NEW ISSUES (0)");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("  None");
+    console.log("");
   }
-  async isInstalled() {
-    try {
-      execSync3(`sc.exe query ${SERVICE_NAME2}`, { stdio: "pipe" });
-      return true;
-    } catch {
-      return false;
+  if (result.resolvedViolations.length > 0) {
+    console.log(`  RESOLVED (${result.resolvedViolations.length})`);
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    for (const v3 of result.resolvedViolations) {
+      const target = buildTargetPath(v3);
+      const color = severityColor(v3.severity);
+      const label = v3.severity.toUpperCase();
+      console.log(`  ${color(`\u2714 ${label}`)}  ${v3.title}`);
+      if (target) {
+        console.log(`              ${target}`);
+      }
+      console.log("");
     }
+  } else {
+    console.log("  RESOLVED (0)");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("  None");
+    console.log("");
   }
-};
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Summary: ${result.summary.newCount} new issues, ${result.summary.resolvedCount} resolved`);
+  console.log("");
+}
+function renderDiffResultsSummary(result) {
+  console.log("");
+  const modified = result.changedFiles.filter((f2) => f2.status === "modified").length;
+  const newFiles = result.changedFiles.filter((f2) => f2.status === "new").length;
+  const deleted = result.changedFiles.filter((f2) => f2.status === "deleted").length;
+  const fileParts = [];
+  if (modified) fileParts.push(`${modified} modified`);
+  if (newFiles) fileParts.push(`${newFiles} new`);
+  if (deleted) fileParts.push(`${deleted} deleted`);
+  console.log(`  Changed files: ${result.changedFiles.length} (${fileParts.join(", ")})`);
+  console.log("");
+  if (result.isStale) {
+    console.log(`  \x1B[33m\u26A0 Results may be stale \u2014 baseline analysis has changed.\x1B[0m`);
+    console.log("");
+  }
+  console.log(`  Summary: ${result.summary.newCount} new issues, ${result.summary.resolvedCount} resolved`);
+  console.log("");
+  v2.info("Run `truecourse list --diff` to see full details.");
+}
+function openInBrowser(url2) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  exec(`${cmd} ${url2}`);
+}
+var DEFAULT_PORT, DEFAULT_CONFIG;
+var init_helpers = __esm({
+  "tools/cli/src/commands/helpers.ts"() {
+    "use strict";
+    init_dist2();
+    init_esm_debug3();
+    DEFAULT_PORT = 3001;
+    DEFAULT_CONFIG = { runMode: "console" };
+  }
+});
 
-// tools/cli/src/commands/service/platform.ts
-function getPlatform() {
-  switch (process.platform) {
-    case "darwin":
-      return new MacOSService();
-    case "linux":
-      return new LinuxService();
-    case "win32":
-      return new WindowsService();
-    default:
-      throw new Error(
-        `Unsupported platform: ${process.platform}. Background service mode supports macOS, Linux, and Windows.`
-      );
+// node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
+var import_index = __toESM(require_commander(), 1);
+var {
+  program,
+  createCommand,
+  createArgument,
+  createOption,
+  CommanderError,
+  InvalidArgumentError,
+  InvalidOptionArgumentError,
+  // deprecated old name
+  Command,
+  Argument,
+  Option,
+  Help
+} = import_index.default;
+
+// tools/cli/src/index.ts
+init_dist2();
+import fs7 from "node:fs";
+import path8 from "node:path";
+import os6 from "node:os";
+
+// tools/cli/src/commands/setup.ts
+init_dist2();
+import fs6 from "node:fs";
+import path6 from "node:path";
+import os5 from "node:os";
+var DEFAULT_MODELS = {
+  anthropic: "claude-sonnet-4-20250514",
+  openai: "gpt-5.3-codex"
+};
+function buildEnvContents(config) {
+  const lines = [
+    "# TrueCourse Environment Configuration",
+    `# Generated by truecourse setup on ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    ""
+  ];
+  if (config.provider) {
+    lines.push(`LLM_PROVIDER=${config.provider}`);
   }
-}
-
-// tools/cli/src/commands/service/logs.ts
-import fs6 from "node:fs";
-import path5 from "node:path";
-import os5 from "node:os";
-import { spawn } from "node:child_process";
-var MAX_LOG_SIZE = 10 * 1024 * 1024;
-var MAX_LOG_FILES = 5;
-function getLogDir() {
-  return path5.join(os5.homedir(), ".truecourse", "logs");
-}
-function getLogPath() {
-  return path5.join(getLogDir(), "truecourse.log");
-}
-function rotateLogs(logDir) {
-  const logFile = path5.join(logDir, "truecourse.log");
-  if (!fs6.existsSync(logFile)) return;
-  const stats = fs6.statSync(logFile);
-  if (stats.size < MAX_LOG_SIZE) return;
-  for (let i = MAX_LOG_FILES; i >= 1; i--) {
-    const older = path5.join(logDir, `truecourse.log.${i}`);
-    if (i === MAX_LOG_FILES) {
-      if (fs6.existsSync(older)) fs6.unlinkSync(older);
-    } else {
-      const newer = path5.join(logDir, `truecourse.log.${i + 1}`);
-      if (fs6.existsSync(older)) fs6.renameSync(older, newer);
-    }
+  if (config.model) {
+    lines.push(`LLM_MODEL=${config.model}`);
   }
-  fs6.renameSync(logFile, path5.join(logDir, "truecourse.log.1"));
-}
-function rotateErrorLogs(logDir) {
-  const logFile = path5.join(logDir, "truecourse.error.log");
-  if (!fs6.existsSync(logFile)) return;
-  const stats = fs6.statSync(logFile);
-  if (stats.size < MAX_LOG_SIZE) return;
-  for (let i = MAX_LOG_FILES; i >= 1; i--) {
-    const older = path5.join(logDir, `truecourse.error.log.${i}`);
-    if (i === MAX_LOG_FILES) {
-      if (fs6.existsSync(older)) fs6.unlinkSync(older);
-    } else {
-      const newer = path5.join(logDir, `truecourse.error.log.${i + 1}`);
-      if (fs6.existsSync(older)) fs6.renameSync(older, newer);
-    }
+  if (config.anthropicKey) {
+    lines.push(`ANTHROPIC_API_KEY=${config.anthropicKey}`);
+  }
+  if (config.openaiKey) {
+    lines.push(`OPENAI_API_KEY=${config.openaiKey}`);
+  }
+  if (config.langfusePublicKey && config.langfuseSecretKey) {
+    lines.push("");
+    lines.push("# Langfuse Tracing");
+    lines.push(`LANGFUSE_PUBLIC_KEY=${config.langfusePublicKey}`);
+    lines.push(`LANGFUSE_SECRET_KEY=${config.langfuseSecretKey}`);
   }
-  fs6.renameSync(logFile, path5.join(logDir, "truecourse.error.log.1"));
+  lines.push("");
+  return lines.join("\n");
 }
-function tailLogs() {
-  const logFile = getLogPath();
-  if (!fs6.existsSync(logFile)) {
-    console.log("No log file found. Is the service running?");
-    console.log(`Expected at: ${logFile}`);
-    return;
+async function runSetup() {
+  we("Welcome to TrueCourse");
+  const provider = await de({
+    message: "Which LLM provider would you like to use?",
+    options: [
+      { value: "anthropic", label: "Anthropic (Claude)" },
+      { value: "openai", label: "OpenAI (GPT)" },
+      { value: "skip", label: "Skip for now" }
+    ]
+  });
+  if (BD(provider)) {
+    ve("Setup cancelled.");
+    process.exit(0);
   }
-  if (process.platform === "win32") {
-    const content = fs6.readFileSync(logFile, "utf-8");
-    const lines = content.split("\n");
-    const tail = lines.slice(-50);
-    for (const line of tail) {
-      process.stdout.write(line + "\n");
-    }
-    let lastSize = fs6.statSync(logFile).size;
-    fs6.watchFile(logFile, { interval: 500 }, () => {
-      const newSize = fs6.statSync(logFile).size;
-      if (newSize > lastSize) {
-        const fd = fs6.openSync(logFile, "r");
-        const buf = Buffer.alloc(newSize - lastSize);
-        fs6.readSync(fd, buf, 0, buf.length, lastSize);
-        fs6.closeSync(fd);
-        process.stdout.write(buf.toString("utf-8"));
-        lastSize = newSize;
+  const config = {};
+  if (provider === "anthropic" || provider === "openai") {
+    config.provider = provider;
+  }
+  if (provider === "anthropic") {
+    const anthropicKey = await ue({
+      message: "Enter your Anthropic API key:",
+      placeholder: "sk-ant-...",
+      validate(value2) {
+        if (!value2 || value2.trim().length === 0) {
+          return "API key is required";
+        }
       }
     });
-  } else {
-    const tail = spawn("tail", ["-f", "-n", "50", logFile], {
-      stdio: "inherit"
-    });
-    const cleanup = () => {
-      tail.kill("SIGTERM");
-    };
-    process.on("SIGINT", cleanup);
-    process.on("SIGTERM", cleanup);
-    tail.on("close", () => {
+    if (BD(anthropicKey)) {
+      ve("Setup cancelled.");
       process.exit(0);
-    });
-  }
-}
-
-// tools/cli/src/commands/start.ts
-var __dirname = path6.dirname(fileURLToPath(import.meta.url));
-function getServerPath() {
-  return path6.join(__dirname, "server.mjs");
-}
-async function healthcheck() {
-  const url2 = getServerUrl();
-  for (let i = 0; i < 30; i++) {
-    try {
-      const res = await fetch(`${url2}/api/health`);
-      if (res.ok) return true;
-    } catch {
     }
-    await new Promise((r2) => setTimeout(r2, 500));
+    config.anthropicKey = anthropicKey;
   }
-  return false;
-}
-async function startServiceMode() {
-  const platform = getPlatform();
-  const serverPath = getServerPath();
-  const logDir = getLogDir();
-  const logPath = getLogPath();
-  const url2 = getServerUrl();
-  const { running } = await platform.status();
-  if (running) {
-    v2.info(`TrueCourse is already running at ${url2}`);
-    return;
+  if (provider === "openai") {
+    const openaiKey = await ue({
+      message: "Enter your OpenAI API key:",
+      placeholder: "sk-...",
+      validate(value2) {
+        if (!value2 || value2.trim().length === 0) {
+          return "API key is required";
+        }
+      }
+    });
+    if (BD(openaiKey)) {
+      ve("Setup cancelled.");
+      process.exit(0);
+    }
+    config.openaiKey = openaiKey;
   }
-  const installed = await platform.isInstalled();
-  if (installed) {
-    rotateLogs(logDir);
-    rotateErrorLogs(logDir);
-    v2.step("Starting background service...");
-    await platform.start();
-  } else {
-    rotateLogs(logDir);
-    rotateErrorLogs(logDir);
-    v2.step("Installing and starting background service...");
-    await platform.install(serverPath, logPath);
+  if (provider === "anthropic" || provider === "openai") {
+    const defaultModel = DEFAULT_MODELS[provider];
+    const model = await ue({
+      message: `Enter the model to use (default: ${defaultModel}):`,
+      placeholder: defaultModel
+    });
+    if (BD(model)) {
+      ve("Setup cancelled.");
+      process.exit(0);
+    }
+    config.model = model?.trim() || defaultModel;
   }
-  const healthy = await healthcheck();
-  if (healthy) {
-    v2.success(`TrueCourse is running at ${url2}`);
-  } else {
-    v2.warn("Service started but server hasn't responded yet.");
-    v2.info("Check logs with: truecourse service logs");
+  const useLangfuse = await me({
+    message: "Would you like to enable Langfuse tracing?",
+    initialValue: false
+  });
+  if (BD(useLangfuse)) {
+    ve("Setup cancelled.");
+    process.exit(0);
   }
-}
-function startConsoleMode() {
-  const serverPath = getServerPath();
-  v2.step("Starting server (embedded PostgreSQL starts automatically)...");
-  const serverProcess = spawn2(
-    process.execPath,
-    [serverPath],
-    {
-      stdio: "inherit",
-      env: { ...process.env }
+  if (useLangfuse) {
+    const langfusePublicKey = await ue({
+      message: "Enter your Langfuse public key:",
+      placeholder: "pk-lf-...",
+      validate(value2) {
+        if (!value2 || value2.trim().length === 0) {
+          return "Public key is required";
+        }
+      }
+    });
+    if (BD(langfusePublicKey)) {
+      ve("Setup cancelled.");
+      process.exit(0);
     }
-  );
-  serverProcess.on("error", (error) => {
-    v2.error(`Failed to start server: ${error.message}`);
-    process.exit(1);
-  });
-  serverProcess.on("close", (code) => {
-    if (code !== null && code !== 0) {
-      process.exit(code);
+    const langfuseSecretKey = await ue({
+      message: "Enter your Langfuse secret key:",
+      placeholder: "sk-lf-...",
+      validate(value2) {
+        if (!value2 || value2.trim().length === 0) {
+          return "Secret key is required";
+        }
+      }
+    });
+    if (BD(langfuseSecretKey)) {
+      ve("Setup cancelled.");
+      process.exit(0);
     }
+    config.langfusePublicKey = langfusePublicKey;
+    config.langfuseSecretKey = langfuseSecretKey;
+  }
+  const configDir = path6.join(os5.homedir(), ".truecourse");
+  fs6.mkdirSync(configDir, { recursive: true });
+  const envPath = path6.join(configDir, ".env");
+  fs6.writeFileSync(envPath, buildEnvContents(config), "utf-8");
+  v2.success(`Configuration saved to ${envPath}`);
+  const runMode = await de({
+    message: "How would you like to run TrueCourse?",
+    options: [
+      { value: "console", label: "Console (keep terminal open)" },
+      { value: "service", label: "Background service (runs automatically, no terminal needed)" }
+    ]
   });
-  const cleanup = () => {
-    serverProcess.kill("SIGTERM");
-  };
-  process.on("SIGINT", cleanup);
-  process.on("SIGTERM", cleanup);
-}
-async function runStart() {
-  we("Starting TrueCourse");
-  const config = readConfig();
-  if (config.runMode === "service") {
-    try {
-      await startServiceMode();
-    } catch (error) {
-      v2.error(`Service mode failed: ${error.message}`);
-      v2.info("Falling back to console mode. Reconfigure with: truecourse setup");
-      startConsoleMode();
-    }
-  } else {
-    startConsoleMode();
+  if (BD(runMode)) {
+    ve("Setup cancelled.");
+    process.exit(0);
+  }
+  const { writeConfig: writeConfig2 } = await Promise.resolve().then(() => (init_helpers(), helpers_exports));
+  writeConfig2({ runMode });
+  if (runMode === "service") {
+    v2.info("Background service selected. Run `truecourse start` to install and start the service.");
   }
+  v2.info("Embedded PostgreSQL will start automatically when the server runs.");
+  v2.info("Database migrations are applied on server startup.");
+  fe("Setup complete!");
 }
 
+// tools/cli/src/index.ts
+init_start();
+
 // tools/cli/src/commands/add.ts
 init_dist2();
 init_helpers();
@@ -13172,7 +13233,8 @@ async function runAdd() {
       message: "Would you like to install Claude Code skills?"
     });
     if (BD(installSkills)) {
-      fe(`Open ${repoUrl}`);
+      openInBrowser(repoUrl);
+      fe("Opened in browser");
       return;
     }
     if (installSkills) {
@@ -13189,7 +13251,8 @@ async function runAdd() {
         v2.message("  - truecourse-fix      (apply fixes)");
       }
     }
-    fe(`Open ${repoUrl}`);
+    openInBrowser(repoUrl);
+    fe("Opened in browser");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
@@ -13209,7 +13272,7 @@ init_helpers();
 var TIMEOUT_MS = 15 * 60 * 1e3;
 async function runAnalyze() {
   we("Analyzing repository");
-  await ensureServer();
+  const firstRun = await ensureServer();
   const repo = await ensureRepo();
   v2.step(`Repository: ${repo.name}`);
   const serverUrl = getServerUrl();
@@ -13273,9 +13336,11 @@ async function runAnalyze() {
     }
     const violations = await res.json();
     renderViolationsSummary(violations);
-    const repoUrl = `${serverUrl}/repos/${repo.id}`;
-    const link = `\x1B[4m\x1B[38;5;75m${repoUrl}\x1B[0m`;
-    fe(`Open ${link} to see violations and architecture diagrams in the UI`);
+    if (firstRun) {
+      const repoUrl = `${serverUrl}/repos/${repo.id}`;
+      openInBrowser(repoUrl);
+    }
+    fe("Analysis complete");
   } catch (err) {
     spinner.stop("Analysis failed");
     const message = err instanceof Error ? err.message : String(err);
@@ -13367,9 +13432,11 @@ async function runListDiff() {
 
 // tools/cli/src/commands/service/index.ts
 init_dist2();
+init_platform();
+init_logs();
+init_helpers();
 import path7 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-init_helpers();
 var __dirname2 = path7.dirname(fileURLToPath3(import.meta.url));
 function getServerPath2() {
   return path7.join(__dirname2, "..", "server.mjs");
@@ -13525,6 +13592,7 @@ function registerServiceCommand(program3) {
 
 // tools/cli/src/index.ts
 init_helpers();
+init_platform();
 var program2 = new Command();
 program2.name("truecourse").version("0.1.0").description("TrueCourse CLI - Setup and manage your TrueCourse instance");
 program2.command("setup").description("Run the setup wizard to configure TrueCourse").action(async () => {