youmd 0.8.0 → 0.8.5

package/scripts/env-vault/README.md

@@ -28,6 +28,9 @@ top of `backup.sh` and add the matching entry to `AGENT_AUTH_MAP` in
 # via CLI (preferred — ships in the npm package)
 youmd env backup
 
+# Check local encryption tooling and env discovery without writing a vault:
+youmd env backup --preflight
+
 # or directly via bash (from the youmd repo root)
 cd /Users/houstongolden/Desktop/CODE_2025/youmd
 bash cli/scripts/env-vault/backup.sh
@@ -52,8 +55,13 @@ Do NOT transfer via unencrypted email or public Slack.
 
 ```bash
 # Install dependencies first (e.g. Node, pnpm, etc.), then:
+youmd env restore /path/to/env-vault-<date>.tar.<ext> --list
 youmd env restore /path/to/env-vault-<date>.tar.<ext>
 
+# Fresh-machine restore after repos have been cloned into CODE_YOU:
+youmd env restore /path/to/env-vault-<date>.tar.<ext> --root ~/Desktop/CODE_YOU --list --map-existing --existing-only --skip-agent-auth
+youmd env restore /path/to/env-vault-<date>.tar.<ext> --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
+
 # If files already exist on the new Mac:
 youmd env restore --force /path/to/env-vault-<date>.tar.<ext>
 
@@ -63,10 +71,15 @@ bash cli/scripts/env-vault/restore.sh --force /path/to/env-vault-<date>.tar.<ext
 ```
 
 The script:
-1. Creates `<CODE_2025>/<project>/.env.local` for each project.
-2. Restores agent-auth files to their absolute home paths (`~/.codex/auth.json`, `~/.cursor/mcp.json`, `~/.claude.json`), creating parent directories as needed.
+1. Lists vault contents without writing files when `--list` is provided.
+2. Creates `<CODE_2025>/<project>/.env.local` for each project during restore.
+3. Restores agent-auth files to their absolute home paths (`~/.codex/auth.json`, `~/.cursor/mcp.json`, `~/.claude.json`), creating parent directories as needed.
+4. With `--map-existing`, maps archived project folder names onto existing target-root dirs by normalized name, e.g. `foldermd` -> `folder-md`.
+5. With `--existing-only`, skips archived projects that do not already have a mapped target dir. This prevents fresh-machine restores from creating stale duplicate folders.
+6. With `--skip-agent-auth`, restores only project `.env.local` files and leaves the new machine's active Claude/Codex/Cursor auth files untouched.
 
 Existing files are backed up to `<path>.bak.<timestamp>` before overwrite (or silently overwritten with `--force`).
+List mode prints project env target paths, variable names/counts, and agent-auth file presence only. It never prints secret values.
 
 ---
 
@@ -101,12 +114,16 @@ and are exposed as first-class CLI commands:
 
 ```bash
 youmd env backup                # back up all .env.local files
+youmd env backup --preflight    # verify tooling/discovery without writing
 youmd env backup --root <dir>   # custom search root
 youmd env backup --out <dir>    # custom output dir
 
 youmd env restore <vault>       # restore from an encrypted vault
+youmd env restore <vault> --list # list vault contents without writing
 youmd env restore --force       # overwrite existing .env.local files
 youmd env restore --root <dir>  # restore into a custom root
+youmd env restore <vault> --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
+                                # safe fresh-machine restore into cloned project dirs
 ```
 
 The CLI wrapper delegates directly to these bash scripts via `spawnSync` with
@@ -121,6 +138,7 @@ your terminal unchanged.
 
 | Flag | Default | Description |
 |------|---------|-------------|
+| `--preflight` | off | Verify encryption tooling/discovery without writing a vault |
 | `--root <dir>` | `~/Desktop/CODE_2025` | Where to discover `.env.local` files |
 | `--out <dir>` | `youmd/.env-vault/` | Where to write encrypted vault + manifest |
 
@@ -128,6 +146,7 @@ your terminal unchanged.
 
 | Flag | Default | Description |
 |------|---------|-------------|
+| `--list` | off | List vault contents without writing files |
 | `--root <dir>` | `~/Desktop/CODE_2025` | Where to restore project `.env.local` files |
 | `--force` | off | Overwrite existing `.env.local` instead of skipping |
 

package/scripts/env-vault/backup.sh

@@ -4,7 +4,7 @@
 # echoes, logs, or writes any secret VALUE. Only variable NAMES, counts, and
 # file paths appear in plaintext output.
 #
-# Usage: bash backup.sh [--root <search-root>] [--out <output-dir>]
+# Usage: bash backup.sh [--preflight] [--root <search-root>] [--out <output-dir>]
 # Defaults:
 #   search-root: /Users/houstongolden/Desktop/CODE_2025
 #   output-dir:  /Users/houstongolden/Desktop/CODE_2025/youmd/.env-vault
@@ -14,6 +14,7 @@ set -euo pipefail
 # ── configurable defaults ──────────────────────────────────────────────────────
 SEARCH_ROOT="${ENV_VAULT_ROOT:-/Users/houstongolden/Desktop/CODE_2025}"
 OUTPUT_DIR="${ENV_VAULT_OUT:-/Users/houstongolden/Desktop/CODE_2025/youmd/.env-vault}"
+PREFLIGHT=false
 
 # ── agent-auth secret files ────────────────────────────────────────────────────
 # Absolute paths to hard agent-auth secrets that must travel with the vault.
@@ -28,6 +29,7 @@ AGENT_SECRET_FILES=(
 # ── parse flags ────────────────────────────────────────────────────────────────
 while [[ $# -gt 0 ]]; do
   case $1 in
+    --preflight) PREFLIGHT=true; shift ;;
     --root)  SEARCH_ROOT="$2"; shift 2 ;;
     --out)   OUTPUT_DIR="$2";  shift 2 ;;
     *) echo "Unknown flag: $1" >&2; exit 1 ;;
@@ -66,11 +68,32 @@ done < <(find "${SEARCH_ROOT}" -maxdepth 2 -name ".env.local" -print0 2>/dev/nul
 
 if [[ ${#ENV_FILES[@]} -eq 0 ]]; then
   echo "No .env.local files found under ${SEARCH_ROOT}" >&2
+  if [[ "${PREFLIGHT}" == "true" ]]; then
+    echo "Preflight only: encryption tooling is available, but no .env.local files were found."
+    exit 0
+  fi
   exit 1
 fi
 
 echo "Found ${#ENV_FILES[@]} .env.local file(s)."
 
+if [[ "${PREFLIGHT}" == "true" ]]; then
+  echo "Output dir: ${OUTPUT_DIR}"
+  echo "Agent-auth candidates:"
+  for ENTRY in "${AGENT_SECRET_FILES[@]}"; do
+    SRC_PATH="${ENTRY%%:*}"
+    ARCHIVE_NAME="${ENTRY##*:}"
+    if [[ -f "${SRC_PATH}" ]]; then
+      FILE_BYTES=$(wc -c < "${SRC_PATH}" | tr -d ' ')
+      echo "  present: agent-auth/${ARCHIVE_NAME} (${FILE_BYTES} bytes)"
+    else
+      echo "  missing: agent-auth/${ARCHIVE_NAME}"
+    fi
+  done
+  echo "Preflight only: no vault written and no secret values printed."
+  exit 0
+fi
+
 # ── build plaintext manifest (names + counts, NO values) ─────────────────────
 mkdir -p "${OUTPUT_DIR}"
 UTC_DATE="$(date -u +%Y-%m-%dT%H%MZ)"

package/scripts/env-vault/restore.sh

@@ -1,9 +1,11 @@
 #!/usr/bin/env bash
 # env-vault/restore.sh — restores .env.local files AND agent-auth secrets from
 # an encrypted vault created by backup.sh. NEVER prints, echoes, or logs any
-# secret VALUES. Only prints which file paths were restored or skipped.
+# secret VALUES. Restore prints which file paths were restored or skipped; list
+# mode prints target paths plus variable names/counts only.
 #
-# Usage: bash restore.sh [--force] [--root <target-root>] <vault-file>
+# Usage: bash restore.sh [--list] [--force] [--map-existing] [--existing-only]
+#        [--skip-agent-auth] [--root <target-root>] <vault-file>
 #   vault-file: path to env-vault-*.tar.age / .tar.gpg / .tar.enc
 #   --force:    overwrite existing files without backing them up
 #   --root:     destination root for .env.local files
@@ -29,14 +31,22 @@ AGENT_AUTH_MAP=(
 # ── defaults ──────────────────────────────────────────────────────────────────
 TARGET_ROOT="${ENV_VAULT_RESTORE_ROOT:-/Users/houstongolden/Desktop/CODE_2025}"
 FORCE=false
+LIST_ONLY=false
+MAP_EXISTING=false
+EXISTING_ONLY=false
+SKIP_AGENT_AUTH=false
 VAULT_FILE=""
 
 # ── parse args ─────────────────────────────────────────────────────────────────
 while [[ $# -gt 0 ]]; do
   case $1 in
-    --force)  FORCE=true; shift ;;
-    --root)   TARGET_ROOT="$2"; shift 2 ;;
-    -*)       echo "Unknown flag: $1" >&2; exit 1 ;;
+    --list)            LIST_ONLY=true; shift ;;
+    --force)           FORCE=true; shift ;;
+    --map-existing)    MAP_EXISTING=true; shift ;;
+    --existing-only)   EXISTING_ONLY=true; shift ;;
+    --skip-agent-auth) SKIP_AGENT_AUTH=true; shift ;;
+    --root)            TARGET_ROOT="$2"; shift 2 ;;
+    -*)                echo "Unknown flag: $1" >&2; exit 1 ;;
     *)
       if [[ -z "${VAULT_FILE}" ]]; then
         VAULT_FILE="$1"
@@ -49,7 +59,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 if [[ -z "${VAULT_FILE}" ]]; then
-  echo "Usage: bash restore.sh [--force] [--root <path>] <vault-file>" >&2
+  echo "Usage: bash restore.sh [--list] [--force] [--map-existing] [--existing-only] [--skip-agent-auth] [--root <path>] <vault-file>" >&2
   echo "  vault-file: env-vault-*.tar.age | .tar.gpg | .tar.enc" >&2
   exit 1
 fi
@@ -77,8 +87,53 @@ fi
 echo "Encryption tool: ${ENC_TOOL}"
 echo "Vault file:      ${VAULT_FILE}"
 echo "Target root:     ${TARGET_ROOT}"
+echo "Project mapping: map-existing=${MAP_EXISTING} existing-only=${EXISTING_ONLY}"
+echo "Agent auth:      $([[ "${SKIP_AGENT_AUTH}" == "true" ]] && echo "skip" || echo "restore")"
 echo ""
 
+normalize_project_name() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]//g'
+}
+
+map_project_name() {
+  local archive_name="$1"
+  local exact_dir="${TARGET_ROOT}/${archive_name}"
+  if [[ "${MAP_EXISTING}" != "true" ]]; then
+    printf '%s\n' "${archive_name}"
+    return 0
+  fi
+  if [[ -d "${exact_dir}" ]]; then
+    printf '%s\n' "${archive_name}"
+    return 0
+  fi
+
+  local wanted
+  wanted="$(normalize_project_name "${archive_name}")"
+  local matches=()
+  local candidate
+  while IFS= read -r -d '' candidate; do
+    local base
+    base="$(basename "${candidate}")"
+    if [[ "$(normalize_project_name "${base}")" == "${wanted}" ]]; then
+      matches+=("${base}")
+    fi
+  done < <(find "${TARGET_ROOT}" -mindepth 1 -maxdepth 1 -type d -print0 2>/dev/null || true)
+
+  if [[ "${#matches[@]}" -eq 1 ]]; then
+    printf '%s\n' "${matches[0]}"
+    return 0
+  fi
+  if [[ "${#matches[@]}" -gt 1 ]]; then
+    echo "WARN: multiple existing dirs match vault project '${archive_name}': ${matches[*]} — skipping" >&2
+    return 1
+  fi
+  if [[ "${EXISTING_ONLY}" == "true" ]]; then
+    echo "WARN: no existing dir for vault project '${archive_name}' under ${TARGET_ROOT} — skipping" >&2
+    return 1
+  fi
+  printf '%s\n' "${archive_name}"
+}
+
 # ── decrypt into a temp dir ────────────────────────────────────────────────────
 WORK_DIR="$(mktemp -d)"
 TAR_PATH="${WORK_DIR}/vault.tar"
@@ -119,6 +174,58 @@ EXTRACT_DIR="${WORK_DIR}/extracted"
 mkdir -p "${EXTRACT_DIR}"
 tar -xf "${TAR_PATH}" -C "${EXTRACT_DIR}"
 
+if [[ "${LIST_ONLY}" == "true" ]]; then
+  ENV_COUNT=0
+  AGENT_PRESENT=0
+  AGENT_MISSING=0
+
+  echo "Vault contents (secret-safe inventory):"
+  while IFS= read -r -d '' ENV_FILE; do
+    REL_PATH="${ENV_FILE#${EXTRACT_DIR}/}"
+    ARCHIVE_PROJECT_NAME="$(dirname "${REL_PATH}")"
+    if ! PROJECT_NAME="$(map_project_name "${ARCHIVE_PROJECT_NAME}")"; then
+      echo "  env: ${ARCHIVE_PROJECT_NAME}/.env.local -> SKIPPED (no safe target)"
+      (( ENV_COUNT++ )) || true
+      continue
+    fi
+    DEST="${TARGET_ROOT}/${PROJECT_NAME}/.env.local"
+    VAR_COUNT=$(grep -cE '^[A-Za-z_][A-Za-z0-9_]*=' "${ENV_FILE}" 2>/dev/null || true)
+    VAR_NAMES=$(grep -oE '^[A-Za-z_][A-Za-z0-9_]*' "${ENV_FILE}" 2>/dev/null \
+                | grep -v '^$' | sort | paste -sd ',' - || true)
+    if [[ "${ARCHIVE_PROJECT_NAME}" == "${PROJECT_NAME}" ]]; then
+      echo "  env: ${PROJECT_NAME}/.env.local -> ${DEST} (${VAR_COUNT} variable(s) [${VAR_NAMES}])"
+    else
+      echo "  env: ${ARCHIVE_PROJECT_NAME}/.env.local -> ${DEST} (${VAR_COUNT} variable(s) [${VAR_NAMES}])"
+    fi
+    (( ENV_COUNT++ )) || true
+  done < <(find "${EXTRACT_DIR}" -name ".env.local" -print0)
+
+  AGENT_AUTH_SRC="${EXTRACT_DIR}/agent-auth"
+  echo "  agent-auth:"
+  if [[ "${SKIP_AGENT_AUTH}" == "true" ]]; then
+    echo "    skipped by --skip-agent-auth"
+  else
+    for ENTRY in "${AGENT_AUTH_MAP[@]}"; do
+    ARCHIVE_NAME="${ENTRY%%:*}"
+    DEST_PATH="${ENTRY##*:}"
+    SRC_FILE="${AGENT_AUTH_SRC}/${ARCHIVE_NAME}"
+    if [[ -f "${SRC_FILE}" ]]; then
+      FILE_BYTES=$(wc -c < "${SRC_FILE}" | tr -d ' ')
+      echo "    present: agent-auth/${ARCHIVE_NAME} -> ${DEST_PATH} (${FILE_BYTES} bytes)"
+      (( AGENT_PRESENT++ )) || true
+    else
+      echo "    missing: agent-auth/${ARCHIVE_NAME}"
+      (( AGENT_MISSING++ )) || true
+    fi
+    done
+  fi
+
+  echo ""
+  echo "List summary: ${ENV_COUNT} .env.local file(s), ${AGENT_PRESENT} agent-auth file(s) present, ${AGENT_MISSING} agent-auth file(s) missing."
+  echo "No files were written and no secret values were printed."
+  exit 0
+fi
+
 # ── restore each .env.local ───────────────────────────────────────────────────
 RESTORED=0
 SKIPPED=0
@@ -127,7 +234,12 @@ BACKED_UP=0
 while IFS= read -r -d '' ENV_FILE; do
   # ENV_FILE is relative to EXTRACT_DIR, e.g. ./project-name/.env.local
   REL_PATH="${ENV_FILE#${EXTRACT_DIR}/}"   # project-name/.env.local
-  PROJECT_NAME="$(dirname "${REL_PATH}")"   # project-name
+  ARCHIVE_PROJECT_NAME="$(dirname "${REL_PATH}")"   # project-name
+  if ! PROJECT_NAME="$(map_project_name "${ARCHIVE_PROJECT_NAME}")"; then
+    echo "  SKIPPED (no existing mapped target): ${ARCHIVE_PROJECT_NAME}/.env.local"
+    (( SKIPPED++ )) || true
+    continue
+  fi
   DEST="${TARGET_ROOT}/${PROJECT_NAME}/.env.local"
   DEST_DIR="$(dirname "${DEST}")"
 
@@ -162,7 +274,10 @@ AGENT_BACKED_UP=0
 
 AGENT_AUTH_SRC="${EXTRACT_DIR}/agent-auth"
 
-if [[ -d "${AGENT_AUTH_SRC}" ]]; then
+if [[ "${SKIP_AGENT_AUTH}" == "true" ]]; then
+  echo "Skipping agent-auth restore because --skip-agent-auth was provided."
+  echo ""
+elif [[ -d "${AGENT_AUTH_SRC}" ]]; then
   echo "Restoring agent-auth files…"
   for ENTRY in "${AGENT_AUTH_MAP[@]}"; do
     ARCHIVE_NAME="${ENTRY%%:*}"

package/scripts/skillstack-sync/README.md

@@ -28,7 +28,9 @@ Cross-machine sync toolkit for Houston Golden's agent skill/stack setup.
 
 ### Complementary sync planes
 
-- **Identity plane:** `youmd sync` (Convex ↔ local profile, memories, preferences). Automated via `com.youmd.identity-sync` daemon.
+- **Realtime identity/project plane:** `youmd sync --live --daemon` subscribes to Convex websocket updates, mints only a short-lived sync session token, materializes identity files and installed You.md skills locally, and triggers bounded shared stack/project-context syncs. It never prints or returns raw `.env.local` values.
+- **Identity repair plane:** `youmd sync --daemon` (Convex ↔ local profile, memories, preferences). Automated via `com.youmd.identity-sync` daemon as a timer-based fallback. Daemon mode refreshes local files/skills and skips unsafe lossy pushes instead of forcing over richer server data.
+- **Project-context plane:** `youmd stack context-sync` safely commits and syncs only `AGENTS.md`, `CLAUDE.md`, `project-context/`, and `.claude/` in curated Houston-owned repos. It refuses to merge remote app-code changes.
 - **Env-vault plane:** `cli/scripts/env-vault/restore.sh` for secrets (manual, invoked on new machine); also available as `youmd env restore <vault>`.
 
 ---
@@ -38,10 +40,12 @@ Cross-machine sync toolkit for Houston Golden's agent skill/stack setup.
 ```
 cli/scripts/skillstack-sync/
 ├── sync.sh                         Core syncer (bash 3.2 compatible)
-├── install-daemons.sh              Installs both LaunchAgents
+├── install-daemons.sh              Installs all resident LaunchAgents
 ├── bootstrap-new-mac.sh            New machine setup script
+├── com.youmd.realtime-sync.plist   LaunchAgent: runs `youmd sync --live --daemon` as a resident websocket syncer
 ├── com.youmd.skillstack-sync.plist LaunchAgent: runs `youmd stack sync` every 5 min
-├── com.youmd.identity-sync.plist   LaunchAgent: runs `youmd sync` every 5 min
+├── com.youmd.identity-sync.plist   LaunchAgent: runs `youmd sync --daemon` every 5 min
+├── com.youmd.context-sync.plist    LaunchAgent: runs `youmd stack context-sync` every 15 min
 └── README.md                       This file
 ```
 
@@ -90,7 +94,7 @@ GIT_USER_EMAIL="houston@bamf.ai"                    # commit email (default)
 The preferred way is via the CLI:
 
 ```bash
-youmd stack daemon install    # installs both LaunchAgents
+youmd stack daemon install    # installs all resident LaunchAgents
 youmd stack daemon status     # check loaded/not-loaded
 youmd stack daemon uninstall  # remove plists from ~/Library/LaunchAgents/
 ```
@@ -101,16 +105,20 @@ Or run the raw script directly:
 bash cli/scripts/skillstack-sync/install-daemons.sh
 ```
 
-Installs two LaunchAgents that fire every 300 seconds (5 minutes):
+Installs four LaunchAgents:
+- `com.youmd.realtime-sync` → runs `youmd sync --live --daemon`
 - `com.youmd.skillstack-sync` → runs `youmd stack sync`
-- `com.youmd.identity-sync` → runs `youmd sync`
+- `com.youmd.identity-sync` → runs `youmd sync --daemon`
+- `com.youmd.context-sync` → runs `youmd stack context-sync`
 
 Check status:
 ```bash
 youmd stack daemon status
 # or directly:
 launchctl list com.youmd.skillstack-sync
+launchctl list com.youmd.realtime-sync
 launchctl list com.youmd.identity-sync
+launchctl list com.youmd.context-sync
 ```
 
 Check logs:
@@ -118,6 +126,7 @@ Check logs:
 tail -f ~/.youmd/logs/skillstack-sync.log
 tail -f ~/.youmd/logs/skillstack-sync.out.log
 tail -f ~/.youmd/logs/identity-sync.out.log
+tail -f ~/.youmd/logs/context-sync.log
 ```
 
 ### Uninstall daemons
@@ -130,27 +139,43 @@ Or manually:
 ```bash
 launchctl unload ~/Library/LaunchAgents/com.youmd.skillstack-sync.plist
 launchctl unload ~/Library/LaunchAgents/com.youmd.identity-sync.plist
+launchctl unload ~/Library/LaunchAgents/com.youmd.context-sync.plist
 rm ~/Library/LaunchAgents/com.youmd.skillstack-sync.plist
 rm ~/Library/LaunchAgents/com.youmd.identity-sync.plist
+rm ~/Library/LaunchAgents/com.youmd.context-sync.plist
 ```
 
 ---
 
 ## New Mac setup
 
+Preferred path: open the You.md Machine tab on an authenticated source computer,
+copy the fresh-machine Claude/Codex setup prompt, and paste it into Claude Code
+or Codex on the new Mac. That generated prompt checks/install Homebrew, Node 22,
+GitHub CLI, bun, and pnpm; authenticates You.md; requires GitHub auth before
+private clones; clones only setup-eligible active projects into
+`~/Desktop/CODE_YOU`; restores env files with `--map-existing --existing-only
+--skip-agent-auth`; and installs resident daemons.
+
+Fallback manual path:
+
 ```bash
 # 1. Install youmd CLI
 curl -fsSL https://you.md/install.sh | bash
 
-# 2. Clone this repo (youmd)
+# 2. Authenticate GitHub before private stack/project clones
+gh auth login -h github.com -p https -s repo
+
+# 3. Clone this repo (youmd)
 git clone https://github.com/houstongolden/youmd ~/Desktop/CODE_2025/youmd
 
-# 3. Run bootstrap (clones agent-shared + scistack)
+# 4. Run bootstrap (clones agent-shared + scistack)
 bash ~/Desktop/CODE_2025/youmd/cli/scripts/skillstack-sync/bootstrap-new-mac.sh
 
-# 4. Restore secrets from env-vault (manual step — see env-vault/README)
+# 5. Restore project env files from env-vault (manual step — see env-vault/README)
+youmd env restore <vault> --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 
-# 5. Activate daemons
+# 6. Activate daemons
 youmd stack daemon install
 ```
 

package/scripts/skillstack-sync/bootstrap-new-mac.sh

@@ -10,6 +10,7 @@
 # Usage: bash bootstrap-new-mac.sh
 
 set -euo pipefail
+export PATH="${HOME}/.youmd/bin:${HOME}/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:${PATH}"
 
 AGENT_SHARED="${HOME}/.agent-shared"
 SCISTACK="${HOME}/.claude/scistack"
@@ -33,6 +34,34 @@ warn() {
   echo "     WARN: $*"
 }
 
+ensure_github_auth() {
+  if ! command -v gh >/dev/null 2>&1; then
+    warn "GitHub CLI is missing. Install it with Homebrew first: brew install gh"
+    return 1
+  fi
+
+  if gh auth status >/dev/null 2>&1; then
+    info "GitHub auth ready."
+    return 0
+  fi
+
+  warn "GitHub auth is required before private skill/stack repos can clone."
+  if [ -t 0 ]; then
+    gh auth login -h github.com -p https -s repo || true
+  fi
+
+  if gh auth status >/dev/null 2>&1; then
+    info "GitHub auth ready."
+    return 0
+  fi
+
+  warn "GitHub auth still is not complete."
+  warn "Open a normal Terminal and run:"
+  warn "  $(command -v gh || echo gh) auth login -h github.com -p https -s repo"
+  warn "Then rerun: youmd machine setup"
+  return 1
+}
+
 # ---------------------------------------------------------------------------
 step "1. Install youmd CLI"
 # ---------------------------------------------------------------------------
@@ -47,6 +76,8 @@ fi
 # ---------------------------------------------------------------------------
 step "2. Clone agent-shared repo → ${AGENT_SHARED}"
 # ---------------------------------------------------------------------------
+ensure_github_auth
+
 if [ -d "${AGENT_SHARED}/.git" ]; then
   info "Already present: ${AGENT_SHARED} — skipping clone."
 else

package/scripts/skillstack-sync/capture-agent-config.sh

@@ -85,6 +85,7 @@ capture_plist() {
 }
 capture_plist "com.youmd.skillstack-sync"
 capture_plist "com.youmd.identity-sync"
+capture_plist "com.youmd.context-sync"
 capture_plist "com.houstongolden.agent-runtime-guard"
 
 if ! is_dry; then

package/scripts/skillstack-sync/com.youmd.context-sync.plist

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.youmd.context-sync</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/zsh</string>
+        <string>-lc</string>
+        <string>youmd stack context-sync</string>
+    </array>
+
+    <key>StartInterval</key>
+    <integer>900</integer>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <false/>
+
+    <key>StandardOutPath</key>
+    <string>__HOME__/.youmd/logs/context-sync.out.log</string>
+
+    <key>StandardErrorPath</key>
+    <string>__HOME__/.youmd/logs/context-sync.err.log</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>__HOME__</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    </dict>
+</dict>
+</plist>

package/scripts/skillstack-sync/com.youmd.identity-sync.plist

@@ -9,7 +9,7 @@
     <array>
         <string>/bin/zsh</string>
         <string>-lc</string>
-        <string>youmd sync</string>
+        <string>youmd sync --daemon</string>
     </array>
 
     <key>StartInterval</key>
@@ -31,6 +31,8 @@
     <dict>
         <key>HOME</key>
         <string>__HOME__</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/com.youmd.realtime-sync.plist

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.youmd.realtime-sync</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/zsh</string>
+        <string>-lc</string>
+        <string>youmd sync --live --daemon</string>
+    </array>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>StandardOutPath</key>
+    <string>__HOME__/.youmd/logs/realtime-sync.out.log</string>
+
+    <key>StandardErrorPath</key>
+    <string>__HOME__/.youmd/logs/realtime-sync.err.log</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>__HOME__</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    </dict>
+</dict>
+</plist>

package/scripts/skillstack-sync/com.youmd.skillstack-sync.plist

@@ -32,7 +32,7 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>