youmd 0.8.2 → 0.8.5

package/scripts/skillstack-sync/bootstrap-new-mac.sh

@@ -10,6 +10,7 @@
 # Usage: bash bootstrap-new-mac.sh
 
 set -euo pipefail
+export PATH="${HOME}/.youmd/bin:${HOME}/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:${PATH}"
 
 AGENT_SHARED="${HOME}/.agent-shared"
 SCISTACK="${HOME}/.claude/scistack"
@@ -33,6 +34,34 @@ warn() {
   echo "     WARN: $*"
 }
 
+ensure_github_auth() {
+  if ! command -v gh >/dev/null 2>&1; then
+    warn "GitHub CLI is missing. Install it with Homebrew first: brew install gh"
+    return 1
+  fi
+
+  if gh auth status >/dev/null 2>&1; then
+    info "GitHub auth ready."
+    return 0
+  fi
+
+  warn "GitHub auth is required before private skill/stack repos can clone."
+  if [ -t 0 ]; then
+    gh auth login -h github.com -p https -s repo || true
+  fi
+
+  if gh auth status >/dev/null 2>&1; then
+    info "GitHub auth ready."
+    return 0
+  fi
+
+  warn "GitHub auth still is not complete."
+  warn "Open a normal Terminal and run:"
+  warn "  $(command -v gh || echo gh) auth login -h github.com -p https -s repo"
+  warn "Then rerun: youmd machine setup"
+  return 1
+}
+
 # ---------------------------------------------------------------------------
 step "1. Install youmd CLI"
 # ---------------------------------------------------------------------------
@@ -47,6 +76,8 @@ fi
 # ---------------------------------------------------------------------------
 step "2. Clone agent-shared repo → ${AGENT_SHARED}"
 # ---------------------------------------------------------------------------
+ensure_github_auth
+
 if [ -d "${AGENT_SHARED}/.git" ]; then
   info "Already present: ${AGENT_SHARED} — skipping clone."
 else

package/scripts/skillstack-sync/com.youmd.realtime-sync.plist

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.youmd.realtime-sync</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/zsh</string>
+        <string>-lc</string>
+        <string>youmd sync --live --daemon</string>
+    </array>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>StandardOutPath</key>
+    <string>__HOME__/.youmd/logs/realtime-sync.out.log</string>
+
+    <key>StandardErrorPath</key>
+    <string>__HOME__/.youmd/logs/realtime-sync.err.log</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>__HOME__</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    </dict>
+</dict>
+</plist>

package/scripts/skillstack-sync/install-daemons.sh

@@ -12,7 +12,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 LAUNCH_AGENTS_DIR="${HOME}/Library/LaunchAgents"
 LOG_DIR="${HOME}/.youmd/logs"
 
-PLISTS="com.youmd.skillstack-sync com.youmd.identity-sync com.youmd.context-sync"
+PLISTS="com.youmd.realtime-sync com.youmd.skillstack-sync com.youmd.identity-sync com.youmd.context-sync"
 
 echo "==> Creating log directory: ${LOG_DIR}"
 mkdir -p "${LOG_DIR}"
@@ -58,6 +58,8 @@ echo "================================================================"
 echo "Resident You.md daemons installed and running."
 echo ""
 echo "Log files:"
+echo "  ${LOG_DIR}/realtime-sync.out.log   (Convex websocket sync stdout)"
+echo "  ${LOG_DIR}/realtime-sync.err.log   (Convex websocket sync stderr)"
 echo "  ${LOG_DIR}/skillstack-sync.log      (combined sync log)"
 echo "  ${LOG_DIR}/skillstack-sync.out.log  (daemon stdout)"
 echo "  ${LOG_DIR}/skillstack-sync.err.log  (daemon stderr)"
@@ -68,6 +70,7 @@ echo "  ${LOG_DIR}/context-sync.out.log     (daemon stdout)"
 echo "  ${LOG_DIR}/context-sync.err.log     (daemon stderr)"
 echo ""
 echo "Check daemon status:"
+echo "  launchctl list com.youmd.realtime-sync"
 echo "  launchctl list com.youmd.skillstack-sync"
 echo "  launchctl list com.youmd.identity-sync"
 echo "  launchctl list com.youmd.context-sync"

package/skills/machine-bootstrap.md

@@ -34,12 +34,14 @@ You.md is the brain. The new machine should become a runnable local agent workst
    for Claude Code or Codex on the new machine, generate it first:
 
    ```bash
-   youmd machine prompt --root ~/Desktop/CODE_YOU --days 90
+   youmd machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
    ```
 
    If the web dashboard minted a scoped bootstrap key, the generated prompt may
    include `YOUMD_API_KEY`. Treat that prompt as secret-bearing local setup
    material and do not paste it into public chats, tickets, or docs.
+   Fresh-machine bootstrap keys must include the `vault` scope so the trusted
+   device can pull encrypted Secret Vault snapshots after login.
    For bounded proof runs on a clean local root, add
    `--max-clone-projects 2` or set `YOUMD_MAX_CLONE_PROJECTS=2`; omit that cap
    on the real new machine.
@@ -70,31 +72,40 @@ You.md is the brain. The new machine should become a runnable local agent workst
 
 6. Hydrate the portfolio graph from You.md/GitHub records before cloning, then
    preview the graph-backed setup plan before creating the desktop code workspace
-   and syncing active projects:
+   and syncing truly active 30-day projects first:
+
+   ```bash
+   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
+   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
+   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
+   ```
+
+7. Ask whether Houston wants to expand the workspace to all active projects
+   from the last 90 days before calling the full project clone set complete:
 
    ```bash
    youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 90 --limit 80
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --dry-run
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 90
+   youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only --dry-run
+   youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only
    ```
 
-7. If GitHub auth is missing, help the user log in and rerun only the project
+8. If GitHub auth is missing, help the user log in and rerun only the project
    clone step:
 
    ```bash
    gh auth login
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 90
+   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
    ```
 
-8. After projects are cloned and any encrypted env vault is restored, hydrate the
+9. After projects are cloned and any encrypted env vault is restored, hydrate the
    portfolio graph again so local README, project-context, git, PR, and env-key
    evidence becomes visible to future agents:
 
    ```bash
-   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 90 --limit 80
+   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
    ```
 
-9. Run the secret-safe readiness audit and sync the proof summary:
+10. Run the secret-safe readiness audit and sync the proof summary:
 
    ```bash
    youmd machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --write-report --sync-report
@@ -107,7 +118,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
    summary to the You.md machine dashboard. It does not read secret values,
    upload raw logs, or launch every dev server.
 
-10. Only when Houston explicitly wants deeper local proof or the clean host has
+11. Only when Houston explicitly wants deeper local proof or the clean host has
     enough time/CPU, run bounded package checks and dev-server probes:
 
    ```bash
@@ -119,11 +130,34 @@ You.md is the brain. The new machine should become a runnable local agent workst
    and dev-server probes are capped by default; tune with
    `--max-install-projects`, `--max-server-projects`, and timeout flags.
 
+## Behind-the-Scenes Agent Operation
+
+- Use the You.md CLI and You Agent yourself before asking Houston to do manual
+  work. Prefer deterministic commands for setup and proof:
+  `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`,
+  `youmd machine prompt`, `youmd machine setup`,
+  `youmd skill install all`, `youmd skill sync`,
+  `youmd env vault list`, `youmd env vault pull`,
+  `youmd project portfolio-hydrate`, and `youmd machine verify`.
+- Use `you` / `youmd chat` when you need the You Agent to synthesize context,
+  route a natural-language request, or produce the setup artifact, then turn the
+  result into concrete shell actions.
+- Do not stop to ask "what next?" after each setup phase. Continue through the
+  command, verify the result, and report concise proof.
+- Interrupt Houston only for true human-gated steps: GitHub browser auth,
+  macOS Keychain/passphrase entry, npm OTP, OS permissions, or the explicit
+  90-day project expansion choice.
+- If the installed CLI is stale, run the curl installer/update path first, then
+  retry the You.md command. Tell Houston when npm publish is needed for
+  `npx youmd@latest` or npm fallback installs.
+
 ## Project Bootstrap Rules
 
 - Use repo directory names from GitHub URLs. `https://github.com/houstongolden/foldermd` becomes `foldermd`.
-- Default to projects active in the last 90 days plus projects marked active/current in You.md.
-- Ask before including older, archived, paused, or dormant projects.
+- Default to projects active in the last 30 days and marked active plus Top
+  Priority/Focusing in You.md. Ask before expanding to the 90-day active set.
+- Ask before including older, archived, paused, inactive, on-ice, abandoned,
+  killed, dormant, or unsorted projects.
 - Create the workspace root on the Desktop if it is missing. `CODE_YOU` is the default fresh-machine root.
 - Use the You.md Portfolio Graph as the strategic source of truth, then merge
   authenticated GitHub recent-repo data and local bundle project records so repo
@@ -133,7 +167,9 @@ You.md is the brain. The new machine should become a runnable local agent workst
   local bundle plus authenticated GitHub scan and say so.
 - Clone with `gh repo clone owner/repo <target>` when `gh` is authenticated; otherwise fall back to `git clone`.
 - Skip non-empty directories instead of overwriting them.
-- Never print secrets. If `.env.local` files are needed, use the shared encrypted env backup/restore path or a password manager.
+- Never print secrets. If `.env.local` files are needed, use You.md Secret Vault
+  or the shared encrypted env backup/restore path. Never paste raw env values
+  into chat.
 - After cloning, initialize missing per-repo agent context with `youmd skill init-project` from inside that repo.
 
 ## Secret-Safe Env Transfer
@@ -146,26 +182,59 @@ Audit local project env coverage before backup:
 youmd env backup --root ~/Desktop/CODE_2025 --preflight
 ```
 
-Create an encrypted archive from the old machine in an interactive macOS terminal:
+Primary path: from the old/source machine, create an encrypted archive and push
+only the ciphertext plus safe manifest metadata to You.md Secret Vault:
+
+```bash
+youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
+youmd env vault list
+```
+
+The passphrase is still local/trusted-device material. If the new machine needs
+headless restore, store the passphrase in macOS Keychain once from a normal
+trusted Terminal. Input is silent and the value is not printed:
+
+```bash
+read -rs "PW?You.md vault passphrase: " && \
+security add-generic-password -a "$USER" -s youmd-env-vault -w "$PW" -U && \
+unset PW && echo "stored in Keychain"
+```
+
+On the new machine, pull the latest encrypted account snapshot and restore into
+already-cloned project directories without clobbering local agent auth:
+
+```bash
+youmd env vault pull --out ~/.youmd/secret-vault
+youmd env vault pull --restore --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
+```
+
+Fallback path: create an encrypted archive from the old machine in an
+interactive macOS terminal and transfer the encrypted file by iCloud, AirDrop,
+USB, or private password-manager attachment:
 
 ```bash
 open ~/.agent-shared/bin/env-backup-interactive.command
+youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
 ```
 
 On the new machine, list the encrypted archive by path only before restore:
 
 ```bash
 ~/.agent-shared/bin/env-secure-restore.sh --archive ~/Desktop/env-local-backup.tar.gz.gpg --list
-youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --list
-youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU
+youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --list --map-existing --existing-only --skip-agent-auth
+youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 ```
 
+If a headless agent reports that Keychain service `youmd-env-vault` is missing,
+do not make it guess. Print the Keychain command above, have Houston run it once
+on the trusted device, then rerun only the restore/setup command.
+
 ## Useful Variants
 
 Dry-run the project layout:
 
 ```bash
-youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --dry-run
+youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
 ```
 
 Create directories only, without cloning:
@@ -201,13 +270,13 @@ youmd machine projects --root ~/Desktop/CODE_YOU --yes
 Generate the copy/paste prompt for a new Claude Code or Codex terminal:
 
 ```bash
-youmd machine prompt --root ~/Desktop/CODE_YOU --days 90 --limit 80
+youmd machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
 ```
 
 Generate the same prompt but cap clones for a clean-host proof run:
 
 ```bash
-youmd machine prompt --root /tmp/youmd-clean-host-CODE_YOU --days 90 --limit 80 --max-clone-projects 2
+youmd machine prompt --root /tmp/youmd-clean-host-CODE_YOU --days 30 --limit 80 --max-clone-projects 2 --require-env-vault
 ```
 
 Fetch the secret-safe project graph directly: