youmd 0.8.11 → 0.8.13

package/dist/lib/machine-bootstrap-prompt.js

@@ -83,13 +83,13 @@ function portableHomePath(value) {
 }
 function buildFreshMachineBootstrapScript() {
     return `set -euo pipefail
-export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
-ROOT="\${YOUMD_CODE_ROOT:-$HOME/Desktop/CODE_YOU}"
-DAYS="\${YOUMD_ACTIVE_DAYS:-30}"
-EXPAND_DAYS="\${YOUMD_EXPAND_ACTIVE_DAYS:-90}"
-LIMIT="\${YOUMD_PROJECT_LIMIT:-80}"
-HYDRATE_TIMEOUT="\${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}"
-MIN_YOUMD_VERSION="\${YOUMD_MIN_VERSION:-0.8.11}"
+export PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+ROOT="\${YOU_CODE_ROOT:-\${YOUMD_CODE_ROOT:-$HOME/Desktop/CODE_YOU}}"
+DAYS="\${YOU_ACTIVE_DAYS:-\${YOUMD_ACTIVE_DAYS:-30}}"
+EXPAND_DAYS="\${YOU_EXPAND_ACTIVE_DAYS:-\${YOUMD_EXPAND_ACTIVE_DAYS:-90}}"
+LIMIT="\${YOU_PROJECT_LIMIT:-\${YOUMD_PROJECT_LIMIT:-80}}"
+HYDRATE_TIMEOUT="\${YOU_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-\${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}}"
+MIN_YOUMD_VERSION="\${YOU_MIN_VERSION:-\${YOUMD_MIN_VERSION:-0.8.12}}"
 mkdir -p "$ROOT"
 
 command_exists() { command -v "$1" >/dev/null 2>&1; }
@@ -115,18 +115,18 @@ version_at_least() {
 }
 ensure_youmd_min_version() {
   local installed
-  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  installed="$(you --version 2>/dev/null | tr -d '[:space:]' || true)"
   echo "[you.md] installed version: \${installed:-unknown}"
   if [ -n "$installed" ] && version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
     return 0
   fi
-  echo "[you.md] installed youmd is older than required \${MIN_YOUMD_VERSION}; forcing GitHub source install"
-  curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
-  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
-  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  echo "[you.md] installed you is older than required \${MIN_YOUMD_VERSION}; forcing GitHub source install"
+  curl -fsSL https://you.md/install.sh | YOU_INSTALL_CHANNEL=source YOU_SOURCE_REF=main bash
+  export PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  installed="$(you --version 2>/dev/null | tr -d '[:space:]' || true)"
   echo "[you.md] installed version after forced source install: \${installed:-unknown}"
   if [ -z "$installed" ] || ! version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
-    echo "[you.md] youmd \${MIN_YOUMD_VERSION}+ is required for Secret Vault, agent bus, agent stack inventory, and fresh-machine restore. npm latest may still be behind; rerun after this commit is deployed or install from GitHub main." >&2
+    echo "[you.md] you \${MIN_YOUMD_VERSION}+ is required for Secret Vault, agent bus, agent stack inventory, and fresh-machine restore. npm latest may still be behind; rerun after this commit is deployed or install from GitHub main." >&2
     exit 1
   fi
 }
@@ -150,14 +150,14 @@ run_with_timeout() {
   fi
 }
 run_agent_stack_inventory() {
-  INVENTORY_DIR="\${YOUMD_AGENT_STACK_INVENTORY_DIR:-$HOME/.youmd/agent-stack-inventory}"
+  INVENTORY_DIR="\${YOU_AGENT_STACK_INVENTORY_DIR:-\${YOUMD_AGENT_STACK_INVENTORY_DIR:-$HOME/.you/agent-stack-inventory}}"
   mkdir -p "$INVENTORY_DIR"
   echo "[you.md] running local/global agent stack inventory into $INVENTORY_DIR"
-  if youmd skill inventory --out-dir "$INVENTORY_DIR" --sync; then
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) generated agent stack inventory at $INVENTORY_DIR" || true
+  if you skill inventory --out-dir "$INVENTORY_DIR" --register-catalog --sync; then
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) generated agent stack inventory at $INVENTORY_DIR" || true
   else
-    echo "[you.md] agent stack inventory did not complete; continuing setup so sync can self-heal, then rerun: youmd skill inventory --out-dir $INVENTORY_DIR --sync"
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) could not complete agent stack inventory yet; rerun after shared skill sync" || true
+    echo "[you.md] agent stack inventory did not complete; continuing setup so sync can self-heal, then rerun: you skill inventory --out-dir $INVENTORY_DIR --register-catalog --sync"
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) could not complete agent stack inventory yet; rerun after shared skill sync" || true
   fi
 }
 
@@ -169,7 +169,7 @@ bootstrap_prereqs() {
   fi
   if [ -x /opt/homebrew/bin/brew ]; then eval "$(/opt/homebrew/bin/brew shellenv)" || true; fi
   if [ -x /usr/local/bin/brew ]; then eval "$(/usr/local/bin/brew shellenv)" || true; fi
-  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  export PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
 
   if command_exists brew; then
     MAJOR="$(node_major)"
@@ -183,7 +183,7 @@ bootstrap_prereqs() {
     command_exists bun || brew install bun || brew install oven-sh/bun/bun || true
   fi
 
-  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  export PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
   command_exists corepack && corepack enable || true
   if command_exists corepack && ! command_exists pnpm; then
     corepack prepare pnpm@latest --activate || true
@@ -224,131 +224,137 @@ ensure_github_auth() {
 bootstrap_prereqs
 
 echo "[you.md] installing runtime from GitHub main"
-curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
-export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
-if ! command_exists youmd; then
-  echo "[you.md] youmd was installed but is not on PATH. Try a new Terminal, then rerun this command." >&2
+curl -fsSL https://you.md/install.sh | YOU_INSTALL_CHANNEL=source YOU_SOURCE_REF=main bash
+export PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+if ! command_exists you; then
+  echo "[you.md] you was installed but is not on PATH. Try a new Terminal, then rerun this command." >&2
   exit 1
 fi
 ensure_youmd_min_version
+echo "[you.md] proving canonical ~/.you home migration"
+you machine migrate-home --yes || true
 
-if [ -n "\${YOUMD_API_KEY:-}" ]; then
+YOU_BOOTSTRAP_API_KEY="\${YOU_API_KEY:-\${YOUMD_API_KEY:-}}"
+if [ -n "$YOU_BOOTSTRAP_API_KEY" ]; then
   echo "[you.md] logging in with bootstrap key"
-  youmd login --key "$YOUMD_API_KEY"
+  you login --key "$YOU_BOOTSTRAP_API_KEY"
 else
-  echo "[you.md] no YOUMD_API_KEY set; starting interactive login"
-  youmd login
+  echo "[you.md] no YOU_API_KEY set; starting interactive login"
+  you login
 fi
 
 echo "[you.md] pulling identity bundle and syncing local brain"
-youmd pull
-youmd sync
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) authenticated, pulled identity, and started setup" || true
+you pull
+you sync
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) authenticated, pulled identity, and started setup" || true
 
 echo "[you.md] installing resident realtime/identity/skillstack/project-context daemons early"
-youmd stack daemon install || true
-youmd stack daemon status || true
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) installed resident realtime/skillstack daemons" || true
+you stack daemon install || true
+you stack daemon status || true
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) installed resident realtime/skillstack daemons" || true
 
 GITHUB_READY=0
 if ensure_github_auth; then
   GITHUB_READY=1
-elif [ "\${YOUMD_REQUIRE_GITHUB_AUTH:-1}" = "1" ]; then
+elif [ "\${YOU_REQUIRE_GITHUB_AUTH:-\${YOUMD_REQUIRE_GITHUB_AUTH:-1}}" = "1" ]; then
   echo "[you.md] stopping after You.md identity/daemon setup because GitHub auth is required for private repos." >&2
   exit 2
 fi
 
 echo "[you.md] restoring shared skills, stacks, and agent host config"
-youmd machine setup || echo "[you.md] machine setup reported a warning; continuing to skills/MCP so the next run can self-heal"
-youmd skill install all || true
-youmd skill sync || true
-youmd mcp --install claude --auto || true
-youmd mcp --install codex --auto || true
-youmd skill link claude || true
-youmd skill link codex || true
+you machine setup || echo "[you.md] machine setup reported a warning; continuing to skills/MCP so the next run can self-heal"
+you skill install all || true
+you skill sync || true
+you mcp --install claude --auto || true
+you mcp --install codex --auto || true
+you skill link claude || true
+you skill link codex || true
 run_agent_stack_inventory
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored shared skills/stacks and MCP config" || true
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored shared skills/stacks and MCP config" || true
 
 if [ "$GITHUB_READY" != "1" ]; then
   echo "[you.md] GitHub auth is still missing; project clone pass skipped. Rerun after gh auth login."
-  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: GitHub auth required before private project clone" || true
+  you agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: GitHub auth required before private project clone" || true
   exit 2
 fi
 
 RECENT_ONLY_ARGS=()
-if youmd machine --help 2>/dev/null | grep -q -- "--recent-only"; then
+if you machine --help 2>/dev/null | grep -q -- "--recent-only"; then
   RECENT_ONLY_ARGS=(--recent-only)
 else
   echo "[you.md] installed CLI does not expose --recent-only yet; using noninteractive no-to-older-projects fallback"
 fi
 run_machine_projects_recent_only() {
   if [ "\${#RECENT_ONLY_ARGS[@]}" -gt 0 ]; then
-    youmd machine projects "$@"
+    you machine projects "$@"
   else
-    youmd machine projects "$@" </dev/null
+    you machine projects "$@" </dev/null
   fi
 }
 
 echo "[you.md] hydrating portfolio graph from You.md/GitHub before the 30-day local clone pass"
-run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
+run_with_timeout "$HYDRATE_TIMEOUT" you project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
 PROJECT_ARGS=(--root "$ROOT" --days "$DAYS" "\${RECENT_ONLY_ARGS[@]}")
-if [ -n "\${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then
-  PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")
+MAX_CLONE_PROJECTS="\${YOU_MAX_CLONE_PROJECTS:-\${YOUMD_MAX_CLONE_PROJECTS:-}}"
+if [ -n "$MAX_CLONE_PROJECTS" ]; then
+  PROJECT_ARGS+=(--max-clone-projects "$MAX_CLONE_PROJECTS")
 fi
 echo "[you.md] previewing graph-backed 30-day project setup plan (ACTIVE + Top Priority/Focusing only)"
 run_machine_projects_recent_only "\${PROJECT_ARGS[@]}" --dry-run || true
 echo "[you.md] creating code workspace and cloning ACTIVE + Top Priority/Focusing 30-day project repos"
 run_machine_projects_recent_only "\${PROJECT_ARGS[@]}"
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) finished 30-day active/focused project clone pass into $ROOT" || true
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) finished 30-day active/focused project clone pass into $ROOT" || true
 
 echo "[you.md] checking encrypted env-vault tooling without printing secrets"
-youmd env backup --root "$ROOT" --preflight || true
+you env backup --root "$ROOT" --preflight || true
 SECRET_VAULT_RESTORED=0
-ALLOW_LOCAL_ENV_VAULT_FALLBACK="\${YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK:-0}"
-if [ -z "\${YOUMD_ENV_VAULT:-}" ] && [ "\${YOUMD_SECRET_VAULT_PULL:-1}" = "1" ]; then
-  SECRET_VAULT_DIR="\${YOUMD_SECRET_VAULT_DIR:-$HOME/.youmd/secret-vault}"
+ENV_VAULT_PATH="\${YOU_ENV_VAULT:-\${YOUMD_ENV_VAULT:-}}"
+ALLOW_LOCAL_ENV_VAULT_FALLBACK="\${YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK:-\${YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK:-0}}"
+if [ -z "$ENV_VAULT_PATH" ] && [ "\${YOU_SECRET_VAULT_PULL:-\${YOUMD_SECRET_VAULT_PULL:-1}}" = "1" ]; then
+  SECRET_VAULT_DIR="\${YOU_SECRET_VAULT_DIR:-\${YOUMD_SECRET_VAULT_DIR:-$HOME/.you/secret-vault}}"
   echo "[you.md] registering this Mac as a trusted Secret Vault device"
-  youmd env vault device-register || true
+  you env vault device-register || true
   echo "[you.md] checking You.md Secret Vault for the latest encrypted env vault and trusted-device envelope"
-  if youmd env vault pull --out "$SECRET_VAULT_DIR" --restore --root "$ROOT" --map-existing --existing-only --skip-agent-auth; then
+  if you env vault pull --out "$SECRET_VAULT_DIR" --restore --root "$ROOT" --map-existing --existing-only --skip-agent-auth; then
     SECRET_VAULT_RESTORED=1
     echo "[you.md] restored env vault through trusted-device Secret Vault"
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault through trusted-device Secret Vault" || true
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault through trusted-device Secret Vault" || true
   else
     echo "[you.md] account-backed Secret Vault restore is waiting for a trusted-device share"
-    echo "[you.md] source Mac action: youmd env vault share"
-    echo "[you.md] new Mac retry: youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) registered Secret Vault device and is waiting for source Mac trusted-device share" || true
+    echo "[you.md] source Mac action: you env vault share"
+    echo "[you.md] new Mac retry: you env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) registered Secret Vault device and is waiting for source Mac trusted-device share" || true
   fi
 fi
-if [ "$SECRET_VAULT_RESTORED" != "1" ] && [ -z "\${YOUMD_ENV_VAULT:-}" ]; then
+if [ "$SECRET_VAULT_RESTORED" != "1" ] && [ -z "$ENV_VAULT_PATH" ]; then
   if [ "$ALLOW_LOCAL_ENV_VAULT_FALLBACK" = "1" ]; then
     echo "[you.md] opt-in local/iCloud passphrase vault fallback enabled"
     for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
       if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
         DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
         if [ -n "$DETECTED_ENV_VAULT" ]; then
-          export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
-          echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
+          ENV_VAULT_PATH="$DETECTED_ENV_VAULT"
+          export YOU_ENV_VAULT="$ENV_VAULT_PATH"
+          echo "[you.md] using detected env vault: $ENV_VAULT_PATH"
           break
         fi
       fi
     done
   else
     echo "[you.md] local/iCloud passphrase vault fallback disabled by default"
-    echo "[you.md] set YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 or YOUMD_ENV_VAULT=/path/to/env-vault only if you intentionally want the older passphrase flow"
+    echo "[you.md] set YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 or YOU_ENV_VAULT=/path/to/env-vault only if you intentionally want the older passphrase flow"
   fi
 fi
 if [ "$SECRET_VAULT_RESTORED" = "1" ]; then
   :
-elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
+elif [ -n "$ENV_VAULT_PATH" ]; then
   echo "[you.md] using explicit/opt-in local encrypted vault fallback"
-  if [ ! -f "$YOUMD_ENV_VAULT" ]; then
-    echo "[you.md] env vault path does not exist: $YOUMD_ENV_VAULT" >&2
+  if [ ! -f "$ENV_VAULT_PATH" ]; then
+    echo "[you.md] env vault path does not exist: $ENV_VAULT_PATH" >&2
     exit 1
   fi
   if [ -z "\${ENV_VAULT_PASS:-}" ] && command_exists security; then
-    KEYCHAIN_SERVICE="\${YOUMD_ENV_VAULT_KEYCHAIN_SERVICE:-youmd-env-vault}"
+    KEYCHAIN_SERVICE="\${YOU_ENV_VAULT_KEYCHAIN_SERVICE:-\${YOUMD_ENV_VAULT_KEYCHAIN_SERVICE:-you-env-vault}}"
     if ENV_VAULT_PASS_FROM_KEYCHAIN="$(security find-generic-password -a "\${USER:-\${LOGNAME:-houston}}" -s "$KEYCHAIN_SERVICE" -w 2>/dev/null)"; then
       export ENV_VAULT_PASS="$ENV_VAULT_PASS_FROM_KEYCHAIN"
       unset ENV_VAULT_PASS_FROM_KEYCHAIN
@@ -358,112 +364,112 @@ elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
     fi
   fi
   echo "[you.md] listing encrypted .env.local vault before restore"
-  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --list --map-existing --existing-only --skip-agent-auth
+  you env restore "$ENV_VAULT_PATH" --root "$ROOT" --list --map-existing --existing-only --skip-agent-auth
   echo "[you.md] restoring encrypted .env.local vault into existing cloned project dirs"
-  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --map-existing --existing-only --skip-agent-auth
-  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault into existing project dirs" || true
+  you env restore "$ENV_VAULT_PATH" --root "$ROOT" --map-existing --existing-only --skip-agent-auth
+  you agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault into existing project dirs" || true
 else
   echo "[you.md] env vault not restored yet"
   echo "[you.md] On the old/source Mac, create the encrypted vault first:"
-  echo "youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
+  echo "you env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
   echo "[you.md] Then share local decrypt access to registered trusted Macs:"
-  echo "youmd env vault share"
+  echo "you env vault share"
   echo "[you.md] Then retry on this Mac:"
-  echo "youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+  echo "you env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
   echo "[you.md] This strict fresh-machine flow intentionally does not ask for a local vault passphrase on the new Mac by default."
   echo "[you.md] Optional fallback: create a transferable local copy without account sync:"
-  echo "youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
+  echo "you env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
   echo "[you.md] Local/iCloud auto-detect is opt-in only. Rerun with:"
-  echo "YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
+  echo "YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 YOU_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Move the generated env-vault-*.tar.enc file to this Mac, then rerun this command with:"
-  echo "YOUMD_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
+  echo "YOU_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOU_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Or restore manually after clone:"
-  echo "youmd env restore <vault> --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
-  if [ "\${YOUMD_REQUIRE_ENV_VAULT:-}" = "1" ]; then
+  echo "you env restore <vault> --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+  if [ "\${YOU_REQUIRE_ENV_VAULT:-\${YOUMD_REQUIRE_ENV_VAULT:-}}" = "1" ]; then
     echo "[you.md] strict proof is waiting for trusted-device Secret Vault share or an explicitly provided local vault; stopping before readiness is marked complete" >&2
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: waiting for trusted-device Secret Vault share or explicit local vault fallback" || true
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: waiting for trusted-device Secret Vault share or explicit local vault fallback" || true
     exit 1
   fi
 fi
 echo "[you.md] reconciling identity/skills after env-vault and source-Mac updates"
-youmd pull || true
-youmd sync || true
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) reconciled You.md bundle after env-vault handling" || true
+you pull || true
+you sync || true
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) reconciled You.md bundle after env-vault handling" || true
 echo "[you.md] rehydrating portfolio graph with local README/project-context/env-key evidence"
-run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
+run_with_timeout "$HYDRATE_TIMEOUT" you project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
 echo "[you.md] auditing cloned project readiness"
-youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
-youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) synced machine readiness proof for $ROOT" || true
+you machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+you agent send --channel machine-sync --kind status "fresh machine \$(hostname) synced machine readiness proof for $ROOT" || true
 FULL_PROJECT_SET_COMPLETE=0
-EXPAND_TO_90="\${YOUMD_EXPAND_TO_90_DAYS:-}"
-if [ -z "$EXPAND_TO_90" ] && [ "\${YOUMD_SKIP_90_DAY_EXPANSION_PROMPT:-}" != "1" ] && [ -t 0 ]; then
+EXPAND_TO_90="\${YOU_EXPAND_TO_90_DAYS:-\${YOUMD_EXPAND_TO_90_DAYS:-}}"
+if [ -z "$EXPAND_TO_90" ] && [ "\${YOU_SKIP_90_DAY_EXPANSION_PROMPT:-\${YOUMD_SKIP_90_DAY_EXPANSION_PROMPT:-}}" != "1" ] && [ -t 0 ]; then
   printf "\\n[you.md] expand to all active projects from the last \${EXPAND_DAYS} days before calling setup complete? [y/N] "
   read -r EXPAND_TO_90
 fi
 case "$EXPAND_TO_90" in
   y|Y|yes|YES|1|true|TRUE)
     echo "[you.md] expanding workspace to active \${EXPAND_DAYS}-day project set"
-    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
+    run_with_timeout "$HYDRATE_TIMEOUT" you project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
     EXPAND_PROJECT_ARGS=(--root "$ROOT" --days "$EXPAND_DAYS" "\${RECENT_ONLY_ARGS[@]}")
-    if [ -n "\${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then
-      EXPAND_PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")
+    if [ -n "$MAX_CLONE_PROJECTS" ]; then
+      EXPAND_PROJECT_ARGS+=(--max-clone-projects "$MAX_CLONE_PROJECTS")
     fi
     run_machine_projects_recent_only "\${EXPAND_PROJECT_ARGS[@]}" --dry-run || true
     run_machine_projects_recent_only "\${EXPAND_PROJECT_ARGS[@]}"
-    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
-    youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) expanded to active/focused \${EXPAND_DAYS}-day project set and synced proof" || true
+    run_with_timeout "$HYDRATE_TIMEOUT" you project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
+    you machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+    you agent send --channel machine-sync --kind status "fresh machine \$(hostname) expanded to active/focused \${EXPAND_DAYS}-day project set and synced proof" || true
     FULL_PROJECT_SET_COMPLETE=1
     ;;
   *)
     echo "[you.md] stopped after the \${DAYS}-day active project setup; \${EXPAND_DAYS}-day expansion remains intentionally open."
     ;;
 esac
-if [ "\${YOUMD_RUN_CHECKS:-}" = "1" ]; then
+if [ "\${YOU_RUN_CHECKS:-\${YOUMD_RUN_CHECKS:-}}" = "1" ]; then
   echo "[you.md] running bounded package checks"
-  youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --run-checks --max-check-projects "\${YOUMD_MAX_CHECK_PROJECTS:-8}" --check-timeout-ms "\${YOUMD_CHECK_TIMEOUT_MS:-120000}" --write-report --sync-report || true
+  you machine verify --root "$ROOT" --max-projects "$LIMIT" --run-checks --max-check-projects "\${YOU_MAX_CHECK_PROJECTS:-\${YOUMD_MAX_CHECK_PROJECTS:-8}}" --check-timeout-ms "\${YOU_CHECK_TIMEOUT_MS:-\${YOUMD_CHECK_TIMEOUT_MS:-120000}}" --write-report --sync-report || true
 else
-  echo "[you.md] bounded package checks skipped; set YOUMD_RUN_CHECKS=1 to run lint/typecheck/test/build caps"
+  echo "[you.md] bounded package checks skipped; set YOU_RUN_CHECKS=1 to run lint/typecheck/test/build caps"
 fi
-if [ "\${YOUMD_INSTALL_DEPS:-}" = "1" ] || [ "\${YOUMD_PROBE_SERVERS:-}" = "1" ]; then
+if [ "\${YOU_INSTALL_DEPS:-\${YOUMD_INSTALL_DEPS:-}}" = "1" ] || [ "\${YOU_PROBE_SERVERS:-\${YOUMD_PROBE_SERVERS:-}}" = "1" ]; then
   echo "[you.md] running bounded clean-host install/server proof"
   VERIFY_ARGS=(--root "$ROOT" --max-projects "$LIMIT")
-  if [ "\${YOUMD_INSTALL_DEPS:-}" = "1" ]; then
-    VERIFY_ARGS+=(--install-deps --max-install-projects "\${YOUMD_MAX_INSTALL_PROJECTS:-4}" --install-timeout-ms "\${YOUMD_INSTALL_TIMEOUT_MS:-180000}")
+  if [ "\${YOU_INSTALL_DEPS:-\${YOUMD_INSTALL_DEPS:-}}" = "1" ]; then
+    VERIFY_ARGS+=(--install-deps --max-install-projects "\${YOU_MAX_INSTALL_PROJECTS:-\${YOUMD_MAX_INSTALL_PROJECTS:-4}}" --install-timeout-ms "\${YOU_INSTALL_TIMEOUT_MS:-\${YOUMD_INSTALL_TIMEOUT_MS:-180000}}")
   fi
-  if [ "\${YOUMD_PROBE_SERVERS:-}" = "1" ]; then
-    VERIFY_ARGS+=(--probe-servers --max-server-projects "\${YOUMD_MAX_SERVER_PROJECTS:-3}" --server-timeout-ms "\${YOUMD_SERVER_TIMEOUT_MS:-45000}" --server-start-port "\${YOUMD_SERVER_START_PORT:-4310}")
+  if [ "\${YOU_PROBE_SERVERS:-\${YOUMD_PROBE_SERVERS:-}}" = "1" ]; then
+    VERIFY_ARGS+=(--probe-servers --max-server-projects "\${YOU_MAX_SERVER_PROJECTS:-\${YOUMD_MAX_SERVER_PROJECTS:-3}}" --server-timeout-ms "\${YOU_SERVER_TIMEOUT_MS:-\${YOUMD_SERVER_TIMEOUT_MS:-45000}}" --server-start-port "\${YOU_SERVER_START_PORT:-\${YOUMD_SERVER_START_PORT:-4310}}")
   fi
-  youmd machine verify "\${VERIFY_ARGS[@]}" --write-report --sync-report || true
+  you machine verify "\${VERIFY_ARGS[@]}" --write-report --sync-report || true
 else
-  echo "[you.md] clean-host install/server proof skipped; set YOUMD_INSTALL_DEPS=1 and YOUMD_PROBE_SERVERS=1 to install deps and smoke-probe local dev servers"
+  echo "[you.md] clean-host install/server proof skipped; set YOU_INSTALL_DEPS=1 and YOU_PROBE_SERVERS=1 to install deps and smoke-probe local dev servers"
 fi
 echo "[you.md] confirming resident realtime/identity/skillstack/project-context daemons"
-youmd stack daemon install || true
-youmd stack daemon status || true
+you stack daemon install || true
+you stack daemon status || true
 run_agent_stack_inventory
 echo "[you.md] running final one-command machine sync/proof consolidation"
-youmd machine sync-now --root "$ROOT" --max-projects "$LIMIT" || true
-youmd status
+you machine sync-now --root "$ROOT" --max-projects "$LIMIT" || true
+you status
 if [ "$FULL_PROJECT_SET_COMPLETE" = "1" ]; then
   echo "[you.md] fresh-machine full \${EXPAND_DAYS}-day project setup complete: $ROOT"
-  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete: full \${EXPAND_DAYS}-day active/focused setup at $ROOT" || true
+  you agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete: full \${EXPAND_DAYS}-day active/focused setup at $ROOT" || true
 else
   echo "[you.md] fresh-machine \${DAYS}-day setup pass complete; \${EXPAND_DAYS}-day expansion is still open: $ROOT"
-  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete for \${DAYS}-day active/focused pass at $ROOT; \${EXPAND_DAYS}-day expansion still open" || true
+  you agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete for \${DAYS}-day active/focused pass at $ROOT; \${EXPAND_DAYS}-day expansion still open" || true
 fi`;
 }
 function buildFreshMachineBootstrapCommand(options = {}) {
     const assignments = [
-        envAssignment("YOUMD_API_KEY", options.apiKey),
-        envAssignment("YOUMD_CODE_ROOT", portableHomePath(options.root), { expandHome: true }),
-        envAssignment("YOUMD_ACTIVE_DAYS", options.days ?? exports.DEFAULT_FRESH_MACHINE_DAYS),
-        envAssignment("YOUMD_PROJECT_LIMIT", options.limit ?? exports.DEFAULT_FRESH_MACHINE_LIMIT),
-        envAssignment("YOUMD_MAX_CLONE_PROJECTS", options.maxCloneProjects),
-        envAssignment("YOUMD_ENV_VAULT", portableHomePath(options.envVaultPath), { expandHome: true }),
-        envAssignment("YOUMD_REQUIRE_ENV_VAULT", options.requireEnvVault ? "1" : undefined),
+        envAssignment("YOU_API_KEY", options.apiKey),
+        envAssignment("YOU_CODE_ROOT", portableHomePath(options.root), { expandHome: true }),
+        envAssignment("YOU_ACTIVE_DAYS", options.days ?? exports.DEFAULT_FRESH_MACHINE_DAYS),
+        envAssignment("YOU_PROJECT_LIMIT", options.limit ?? exports.DEFAULT_FRESH_MACHINE_LIMIT),
+        envAssignment("YOU_MAX_CLONE_PROJECTS", options.maxCloneProjects),
+        envAssignment("YOU_ENV_VAULT", portableHomePath(options.envVaultPath), { expandHome: true }),
+        envAssignment("YOU_REQUIRE_ENV_VAULT", options.requireEnvVault ? "1" : undefined),
     ].filter((value) => Boolean(value));
-    const pathPrefix = `PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"`;
+    const pathPrefix = `PATH="$HOME/.you/bin:$HOME/.you/npm-global/bin:$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"`;
     return `${[pathPrefix, ...assignments].join(" ")} bash -lc ${shellQuote(buildFreshMachineBootstrapScript())}`;
 }
 function buildFreshMachineBootstrapPrompt(options = {}) {
@@ -484,7 +490,7 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "",
         authLine,
         "",
-        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd skill inventory`, `youmd env vault list`, `youmd env vault device-register`, `youmd env vault pull --restore`, `youmd machine prompt`, `youmd machine verify`, `youmd project portfolio-hydrate`, and `youmd agent status` as needed. Use `youmd agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac Secret Vault share if the trusted-device envelope has not been created yet, local vault passphrase/Keychain only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
+        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `you status`, `you whoami`, `you pull`, `you sync`, `you skill install all`, `you skill sync`, `you skill inventory`, `you env vault list`, `you env vault device-register`, `you env vault pull --restore`, `you machine prompt`, `you machine verify`, `you project portfolio-hydrate`, and `you agent status` as needed. Use `you agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `you chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac Secret Vault share if the trusted-device envelope has not been created yet, local vault passphrase/Keychain only when `YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOU_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
         "",
         "Exact setup command:",
         "",
@@ -495,27 +501,28 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "What it will do:",
         "- check/install the local prerequisites first: Homebrew, Node 22/npm, git, GitHub CLI, bun, and pnpm/corepack",
         "- install You.md from the curl runtime and force the You.md/Homebrew/Node 22 paths into this setup shell",
+        "- prove the canonical `~/.you` home migration while preserving legacy `~/.youmd` fallback",
         "- authenticate and pull/sync your identity bundle",
         "- install resident realtime sync daemons early so identity/skill/project-context sync is not deferred until the end",
         "- require GitHub CLI auth before private shared-skill/project repos clone; if browser auth fails inside Claude/Codex, it prints the exact Terminal command to run and stops cleanly",
         "- install/configure MCP for Claude Code and Codex",
         "- restore shared agent skills, stack config, Claude/Codex links, and agent host config",
-        "- generate a secret-safe local/global agent stack inventory under `~/.youmd/agent-stack-inventory` after shared skills are restored and again near final proof",
+        "- generate a secret-safe local/global agent stack inventory under `~/.you/agent-stack-inventory` after shared skills are restored and again near final proof",
         "- use the installed You.md CLI behind the scenes for status, skill sync, Secret Vault pull, portfolio graph hydration, machine verification, and You Agent context routing instead of making Houston manually drive those steps",
-        "- publish setup milestones through `youmd agent send` so Houston's source Mac and realtime daemon can see the Mac mini come online without clipboard babysitting",
+        "- publish setup milestones through `you agent send` so Houston's source Mac and realtime daemon can see the Mac mini come online without clipboard babysitting",
         "- hydrate the portfolio graph from You.md + authenticated GitHub before cloning",
         `- preview the graph-backed plan, create ${root}, and clone only projects marked ACTIVE plus Top Priority/Focusing from the last ${days} days first`,
         `- ask whether to expand to all ACTIVE plus Top Priority/Focusing projects from the last ${expandDays} days before calling the full project clone set complete`,
-        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, or stop with the exact source-Mac `youmd env vault share` action instead of asking for a passphrase on the new Mac. Local/iCloud passphrase fallback runs only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided. After env handling, rehydrate local project/env evidence.",
-        "- reconcile `youmd pull && youmd sync` after env-vault handling so source-Mac bundle updates, new trusted-device envelopes, shared skills, and machine proof state do not leave this Mac showing `remote ahead`",
+        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, or stop with the exact source-Mac `you env vault share` action instead of asking for a passphrase on the new Mac. Local/iCloud passphrase fallback runs only when `YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOU_ENV_VAULT` is explicitly provided. After env handling, rehydrate local project/env evidence.",
+        "- reconcile `you pull && you sync` after env-vault handling so source-Mac bundle updates, new trusted-device envelopes, shared skills, and machine proof state do not leave this Mac showing `remote ahead`",
         "- write and sync a secret-safe machine proof report, with optional bounded install/check/server proof flags",
-        "- bound portfolio hydration with `YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS` so large restored roots do not wedge setup",
+        "- bound portfolio hydration with `YOU_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS` so large restored roots do not wedge setup",
         "",
         `Project source: You.md portfolio graph + authenticated GitHub recent repos, capped at ${limit} tracked projects before local audit evidence is merged. When the graph exists, new-computer setup clones only projects with status ACTIVE and focus Top Priority/Focusing; inactive, unsorted, on-ice, abandoned, killed, and unreviewed GitHub-only repos are skipped unless --include-inactive is explicitly used. First pass is ${days} days with out-of-window projects skipped; the ${expandDays}-day pass is explicit.`,
-        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `youmd env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. If the envelope is missing, the command stops and sends a machine-sync status telling the source Mac to run `youmd env vault share`. Local fallback is opt-in only: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to the new machine, then rerun with `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or explicit `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
+        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `you env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `you env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. If the envelope is missing, the command stops and sends a machine-sync status telling the source Mac to run `you env vault share`. Local fallback is opt-in only: run `you env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to the new machine, then rerun with `YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or explicit `YOU_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
         "",
         "After the command finishes, report:",
-        "- the `youmd status` sync state",
+        "- the `you status` sync state",
         `- the \`${root}\` project count`,
         "- whether the encrypted env vault restored",
         "- whether Claude/Codex MCP config was installed",
@@ -523,7 +530,7 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "- the synced machine proof status",
         "- whether I should expand to the 90-day active project set if I have not answered yet",
         "",
-        "Done-ness rule: for real fresh-computer proof, set YOUMD_REQUIRE_ENV_VAULT=1 or pass --require-env-vault so the command fails instead of pretending setup is complete when the encrypted env vault is missing.",
+        "Done-ness rule: for real fresh-computer proof, set YOU_REQUIRE_ENV_VAULT=1 or pass --require-env-vault so the command fails instead of pretending setup is complete when the encrypted env vault is missing.",
     ].join("\n");
 }
 //# sourceMappingURL=machine-bootstrap-prompt.js.map

package/dist/lib/machine-bootstrap-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,4EAmXC;AAED,8EAaC;AAED,4EA4DC;AAvfD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACtD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC5G,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiXN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC9E,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAClF,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACnE,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9F,aAAa,CAAC,yBAAyB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,qJAAqJ,CAAC;IACzK,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,gSAAgS;QAChS,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,ooCAAooC;QACpoC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,gKAAgK;QAChK,iOAAiO;QACjO,kKAAkK;QAClK,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,kpBAAkpB;QAClpB,iNAAiN;QACjN,6GAA6G;QAC7G,uHAAuH;QACvH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,osCAAosC;QACpsC,EAAE;QACF,qCAAqC;QACrC,iCAAiC;QACjC,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,yDAAyD;QACzD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,gNAAgN;KACjN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,4EAyXC;AAED,8EAaC;AAED,4EA6DC;AA9fD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACtD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC5G,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuXN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC;QAC5C,aAAa,CAAC,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACpF,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC5E,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAChF,aAAa,CAAC,wBAAwB,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACjE,aAAa,CAAC,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5F,aAAa,CAAC,uBAAuB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KAClF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,8LAA8L,CAAC;IAClN,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,gSAAgS;QAChS,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,gmCAAgmC;QAChmC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,2FAA2F;QAC3F,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,8JAA8J;QAC9J,iOAAiO;QACjO,gKAAgK;QAChK,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,4oBAA4oB;QAC5oB,6MAA6M;QAC7M,6GAA6G;QAC7G,qHAAqH;QACrH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,wrCAAwrC;QACxrC,EAAE;QACF,qCAAqC;QACrC,+BAA+B;QAC/B,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,yDAAyD;QACzD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,8MAA8M;KAC/M,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/lib/machine-verify.d.ts

@@ -125,6 +125,25 @@ export interface MachineAgentStackInventoryProof {
         secretValuesExposed: false;
     };
 }
+export interface MachineDaemonProof {
+    status: "ready" | "warn";
+    loaded: number;
+    total: number;
+    legacyLoaded: number;
+    warnings: string[];
+    labels: Array<{
+        label: string;
+        legacyLabel?: string;
+        name: string;
+        loaded: boolean;
+        legacyLoaded: boolean;
+        lastActivityAt?: string;
+        warning?: string;
+    }>;
+    security: {
+        secretValuesExposed: false;
+    };
+}
 export interface MachineVerificationProof {
     schemaVersion: 1;
     generatedAt: string;
@@ -137,6 +156,7 @@ export interface MachineVerificationProof {
     checks?: MachineRunChecksReport;
     servers?: MachineServerProbeReport;
     agentStackInventory?: MachineAgentStackInventoryProof;
+    daemons: MachineDaemonProof;
     summary: {
         status: "ready" | "warn" | "failed";
         scanned: number;
@@ -146,6 +166,9 @@ export interface MachineVerificationProof {
         installPassed: number;
         checksPassed: number;
         serversPassed: number;
+        daemonsLoaded: number;
+        daemonsTotal: number;
+        legacyDaemonsLoaded: number;
         failures: number;
         warnings: string[];
     };
@@ -154,6 +177,7 @@ export interface MachineVerificationProofWriteResult {
     latestPath: string;
     archivedPath: string;
 }
+export declare function buildMachineDaemonProof(): MachineDaemonProof;
 export declare function defaultAgentStackInventoryDir(): string;
 export declare function loadLatestAgentStackInventoryProof(outDir?: string): MachineAgentStackInventoryProof | null;
 export declare function inspectMachineProject(projectDir: string): MachineProjectReadiness;