youmd 0.8.2 → 0.8.6

package/dist/lib/machine-bootstrap-prompt.js

@@ -45,10 +45,28 @@ exports.DEFAULT_FRESH_MACHINE_LIMIT = 80;
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\"'\"'`)}'`;
 }
-function envAssignment(name, value) {
+function envAssignment(name, value, options = {}) {
     if (value === undefined || value === null || `${value}`.trim() === "")
         return null;
-    return `${name}=${shellQuote(String(value))}`;
+    const stringValue = String(value);
+    if (options.expandHome) {
+        if (stringValue === "~")
+            return `${name}="$HOME"`;
+        if (stringValue.startsWith("~/")) {
+            return `${name}="$HOME${stringValue.slice(1).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
+        }
+        if (stringValue === "$HOME")
+            return `${name}="$HOME"`;
+        if (stringValue.startsWith("$HOME/")) {
+            return `${name}="$HOME/${stringValue.slice("$HOME/".length).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
+        }
+        if (stringValue === "${HOME}")
+            return `${name}="$HOME"`;
+        if (stringValue.startsWith("${HOME}/")) {
+            return `${name}="$HOME/${stringValue.slice("${HOME}/".length).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
+        }
+    }
+    return `${name}=${shellQuote(stringValue)}`;
 }
 function portableHomePath(value) {
     if (!value)
@@ -64,193 +82,356 @@ function portableHomePath(value) {
     return value;
 }
 function buildFreshMachineBootstrapScript() {
-    return [
-        "set -euo pipefail",
-        'ROOT="${YOUMD_CODE_ROOT:-$HOME/Desktop/CODE_YOU}"',
-        'DAYS="${YOUMD_ACTIVE_DAYS:-30}"',
-        'EXPAND_DAYS="${YOUMD_EXPAND_ACTIVE_DAYS:-90}"',
-        'LIMIT="${YOUMD_PROJECT_LIMIT:-80}"',
-        'HYDRATE_TIMEOUT="${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}"',
-        'run_with_timeout() {',
-        '  seconds="$1"',
-        "  shift",
-        '  if command -v gtimeout >/dev/null 2>&1; then',
-        '    gtimeout "$seconds" "$@"',
-        '  elif command -v timeout >/dev/null 2>&1; then',
-        '    timeout "$seconds" "$@"',
-        "  else",
-        '    "$@" &',
-        "    pid=$!",
-        '    ( sleep "$seconds"; if kill -0 "$pid" >/dev/null 2>&1; then echo "[you.md] timeout after ${seconds}s: $*" >&2; kill "$pid" >/dev/null 2>&1 || true; fi ) &',
-        "    watcher=$!",
-        '    wait "$pid"',
-        "    status=$?",
-        '    kill "$watcher" >/dev/null 2>&1 || true',
-        '    wait "$watcher" 2>/dev/null || true',
-        '    return "$status"',
-        "  fi",
-        "}",
-        'echo "[you.md] installing runtime"',
-        "curl -fsSL https://you.md/install.sh | bash",
-        'if [ -n "${YOUMD_API_KEY:-}" ]; then',
-        '  echo "[you.md] logging in with bootstrap key"',
-        '  youmd login --key "$YOUMD_API_KEY"',
-        "else",
-        '  echo "[you.md] no YOUMD_API_KEY set; starting interactive login"',
-        "  youmd login",
-        "fi",
-        'echo "[you.md] pulling identity bundle and syncing local brain"',
-        "youmd pull",
-        "youmd sync",
-        'echo "[you.md] restoring shared skills, stacks, and agent host config"',
-        "youmd machine setup",
-        "youmd skill install all",
-        "youmd skill sync",
-        "youmd mcp --install claude --auto || true",
-        "youmd mcp --install codex --auto || true",
-        "youmd skill link claude || true",
-        "youmd skill link codex || true",
-        'if command -v gh >/dev/null 2>&1; then',
-        "  gh auth status >/dev/null 2>&1 || gh auth login",
-        "else",
-        '  echo "[you.md] GitHub CLI missing; private repo clones may need gh installed"',
-        "fi",
-        "RECENT_ONLY_ARGS=()",
-        'if youmd machine --help 2>/dev/null | grep -q -- "--recent-only"; then',
-        "  RECENT_ONLY_ARGS=(--recent-only)",
-        "else",
-        '  echo "[you.md] installed CLI does not expose --recent-only yet; using noninteractive no-to-older-projects fallback"',
-        "fi",
-        "run_machine_projects_recent_only() {",
-        '  if [ "${#RECENT_ONLY_ARGS[@]}" -gt 0 ]; then',
-        '    youmd machine projects "$@"',
-        "  else",
-        '    youmd machine projects "$@" </dev/null',
-        "  fi",
-        "}",
-        'echo "[you.md] hydrating portfolio graph from You.md/GitHub before the 30-day local clone pass"',
-        'run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true',
-        'PROJECT_ARGS=(--root "$ROOT" --days "$DAYS" "${RECENT_ONLY_ARGS[@]}")',
-        'if [ -n "${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then',
-        '  PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")',
-        "fi",
-        'echo "[you.md] previewing graph-backed 30-day project setup plan (ACTIVE + Top Priority/Focusing only)"',
-        'run_machine_projects_recent_only "${PROJECT_ARGS[@]}" --dry-run || true',
-        'echo "[you.md] creating code workspace and cloning ACTIVE + Top Priority/Focusing 30-day project repos"',
-        'run_machine_projects_recent_only "${PROJECT_ARGS[@]}"',
-        'echo "[you.md] checking encrypted env-vault tooling without printing secrets"',
-        'youmd env backup --root "$ROOT" --preflight || true',
-        'if [ -z "${YOUMD_ENV_VAULT:-}" ]; then',
-        '  DEFAULT_ENV_VAULT_DIR="$HOME/Desktop/youmd-env-vault"',
-        '  if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then',
-        '    DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"',
-        '    if [ -n "$DETECTED_ENV_VAULT" ]; then',
-        '      export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"',
-        '      echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"',
-        "    fi",
-        "  fi",
-        "fi",
-        'if [ -n "${YOUMD_ENV_VAULT:-}" ]; then',
-        '  if [ ! -f "$YOUMD_ENV_VAULT" ]; then',
-        '    echo "[you.md] env vault path does not exist: $YOUMD_ENV_VAULT" >&2',
-        "    exit 1",
-        "  fi",
-        '  if [ -z "${ENV_VAULT_PASS:-}" ] && command -v security >/dev/null 2>&1; then',
-        '    KEYCHAIN_SERVICE="${YOUMD_ENV_VAULT_KEYCHAIN_SERVICE:-youmd-env-vault}"',
-        '    if ENV_VAULT_PASS_FROM_KEYCHAIN="$(security find-generic-password -a "${USER:-${LOGNAME:-houston}}" -s "$KEYCHAIN_SERVICE" -w 2>/dev/null)"; then',
-        '      export ENV_VAULT_PASS="$ENV_VAULT_PASS_FROM_KEYCHAIN"',
-        '      unset ENV_VAULT_PASS_FROM_KEYCHAIN',
-        '      echo "[you.md] loaded env-vault passphrase from macOS Keychain service: $KEYCHAIN_SERVICE"',
-        "    else",
-        '      echo "[you.md] no env-vault Keychain item found; restore will prompt for the passphrase"',
-        "    fi",
-        "  fi",
-        '  echo "[you.md] listing encrypted .env.local vault before restore"',
-        '  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --list',
-        '  echo "[you.md] restoring encrypted .env.local vault"',
-        '  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT"',
-        "else",
-        '  echo "[you.md] env vault not restored yet"',
-        '  echo "[you.md] On the old/source Mac, create the encrypted vault first:"',
-        '  echo "youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"',
-        '  echo "[you.md] Move the generated env-vault-*.tar.enc file to this Mac, then rerun this command with:"',
-        '  echo "YOUMD_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOUMD_REQUIRE_ENV_VAULT=1 <same command>"',
-        '  echo "[you.md] Or restore manually after clone:"',
-        '  echo "youmd env restore <vault> --root \\"$ROOT\\""',
-        '  if [ "${YOUMD_REQUIRE_ENV_VAULT:-}" = "1" ]; then',
-        '    echo "[you.md] strict proof requires YOUMD_ENV_VAULT; stopping before readiness is marked complete" >&2',
-        "    exit 1",
-        "  fi",
-        "fi",
-        'echo "[you.md] rehydrating portfolio graph with local README/project-context/env-key evidence"',
-        'run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true',
-        'echo "[you.md] auditing cloned project readiness"',
-        'youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true',
-        "FULL_PROJECT_SET_COMPLETE=0",
-        'EXPAND_TO_90="${YOUMD_EXPAND_TO_90_DAYS:-}"',
-        'if [ -z "$EXPAND_TO_90" ] && [ "${YOUMD_SKIP_90_DAY_EXPANSION_PROMPT:-}" != "1" ] && [ -t 0 ]; then',
-        '  printf "\\n[you.md] expand to all active projects from the last ${EXPAND_DAYS} days before calling setup complete? [y/N] "',
-        '  read -r EXPAND_TO_90',
-        "fi",
-        'case "$EXPAND_TO_90" in',
-        '  y|Y|yes|YES|1|true|TRUE)',
-        '    echo "[you.md] expanding workspace to active ${EXPAND_DAYS}-day project set"',
-        '    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true',
-        '    EXPAND_PROJECT_ARGS=(--root "$ROOT" --days "$EXPAND_DAYS" "${RECENT_ONLY_ARGS[@]}")',
-        '    if [ -n "${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then',
-        '      EXPAND_PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")',
-        "    fi",
-        '    run_machine_projects_recent_only "${EXPAND_PROJECT_ARGS[@]}" --dry-run || true',
-        '    run_machine_projects_recent_only "${EXPAND_PROJECT_ARGS[@]}"',
-        '    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true',
-        '    youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true',
-        "    FULL_PROJECT_SET_COMPLETE=1",
-        '    ;;',
-        '  *)',
-        '    echo "[you.md] stopped after the ${DAYS}-day active project setup; ${EXPAND_DAYS}-day expansion remains intentionally open."',
-        '    ;;',
-        "esac",
-        'if [ "${YOUMD_RUN_CHECKS:-}" = "1" ]; then',
-        '  echo "[you.md] running bounded package checks"',
-        '  youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --run-checks --max-check-projects "${YOUMD_MAX_CHECK_PROJECTS:-8}" --check-timeout-ms "${YOUMD_CHECK_TIMEOUT_MS:-120000}" --write-report --sync-report || true',
-        "else",
-        '  echo "[you.md] bounded package checks skipped; set YOUMD_RUN_CHECKS=1 to run lint/typecheck/test/build caps"',
-        "fi",
-        'if [ "${YOUMD_INSTALL_DEPS:-}" = "1" ] || [ "${YOUMD_PROBE_SERVERS:-}" = "1" ]; then',
-        '  echo "[you.md] running bounded clean-host install/server proof"',
-        '  VERIFY_ARGS=(--root "$ROOT" --max-projects "$LIMIT")',
-        '  if [ "${YOUMD_INSTALL_DEPS:-}" = "1" ]; then',
-        '    VERIFY_ARGS+=(--install-deps --max-install-projects "${YOUMD_MAX_INSTALL_PROJECTS:-4}" --install-timeout-ms "${YOUMD_INSTALL_TIMEOUT_MS:-180000}")',
-        "  fi",
-        '  if [ "${YOUMD_PROBE_SERVERS:-}" = "1" ]; then',
-        '    VERIFY_ARGS+=(--probe-servers --max-server-projects "${YOUMD_MAX_SERVER_PROJECTS:-3}" --server-timeout-ms "${YOUMD_SERVER_TIMEOUT_MS:-45000}" --server-start-port "${YOUMD_SERVER_START_PORT:-4310}")',
-        "  fi",
-        '  youmd machine verify "${VERIFY_ARGS[@]}" --write-report --sync-report || true',
-        "else",
-        '  echo "[you.md] clean-host install/server proof skipped; set YOUMD_INSTALL_DEPS=1 and YOUMD_PROBE_SERVERS=1 to install deps and smoke-probe local dev servers"',
-        "fi",
-        'echo "[you.md] installing resident identity/skillstack/project-context daemons"',
-        "youmd stack daemon install || true",
-        "youmd stack daemon status || true",
-        "youmd status",
-        'if [ "$FULL_PROJECT_SET_COMPLETE" = "1" ]; then',
-        '  echo "[you.md] fresh-machine full ${EXPAND_DAYS}-day project setup complete: $ROOT"',
-        "else",
-        '  echo "[you.md] fresh-machine ${DAYS}-day setup pass complete; ${EXPAND_DAYS}-day expansion is still open: $ROOT"',
-        "fi",
-    ].join("\n");
+    return `set -euo pipefail
+export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+ROOT="\${YOUMD_CODE_ROOT:-$HOME/Desktop/CODE_YOU}"
+DAYS="\${YOUMD_ACTIVE_DAYS:-30}"
+EXPAND_DAYS="\${YOUMD_EXPAND_ACTIVE_DAYS:-90}"
+LIMIT="\${YOUMD_PROJECT_LIMIT:-80}"
+HYDRATE_TIMEOUT="\${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}"
+MIN_YOUMD_VERSION="\${YOUMD_MIN_VERSION:-0.8.6}"
+mkdir -p "$ROOT"
+
+command_exists() { command -v "$1" >/dev/null 2>&1; }
+node_major() { node -e 'console.log(process.versions.node.split(".")[0])' 2>/dev/null || echo 0; }
+version_at_least() {
+  local current="\${1#v}"
+  local required="\${2#v}"
+  local IFS=.
+  local current_parts=($current)
+  local required_parts=($required)
+  local i current_value required_value
+  for i in 0 1 2; do
+    current_value="\${current_parts[$i]:-0}"
+    required_value="\${required_parts[$i]:-0}"
+    current_value="\${current_value%%[^0-9]*}"
+    required_value="\${required_value%%[^0-9]*}"
+    current_value="\${current_value:-0}"
+    required_value="\${required_value:-0}"
+    if ((10#$current_value > 10#$required_value)); then return 0; fi
+    if ((10#$current_value < 10#$required_value)); then return 1; fi
+  done
+  return 0
+}
+ensure_youmd_min_version() {
+  local installed
+  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  echo "[you.md] installed version: \${installed:-unknown}"
+  if [ -n "$installed" ] && version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
+    return 0
+  fi
+  echo "[you.md] installed youmd is older than required \${MIN_YOUMD_VERSION}; forcing GitHub source install"
+  curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
+  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  echo "[you.md] installed version after forced source install: \${installed:-unknown}"
+  if [ -z "$installed" ] || ! version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
+    echo "[you.md] youmd \${MIN_YOUMD_VERSION}+ is required for Secret Vault, agent bus, and fresh-machine restore. npm latest may still be behind; rerun after this commit is deployed or install from GitHub main." >&2
+    exit 1
+  fi
+}
+run_with_timeout() {
+  seconds="$1"
+  shift
+  if command_exists gtimeout; then
+    gtimeout "$seconds" "$@"
+  elif command_exists timeout; then
+    timeout "$seconds" "$@"
+  else
+    "$@" &
+    pid=$!
+    ( sleep "$seconds"; if kill -0 "$pid" >/dev/null 2>&1; then echo "[you.md] timeout after \${seconds}s: $*" >&2; kill "$pid" >/dev/null 2>&1 || true; fi ) &
+    watcher=$!
+    wait "$pid"
+    status=$?
+    kill "$watcher" >/dev/null 2>&1 || true
+    wait "$watcher" 2>/dev/null || true
+    return "$status"
+  fi
+}
+
+bootstrap_prereqs() {
+  echo "[you.md] checking local prerequisites: Homebrew, Node 22/npm, git, gh, bun, pnpm"
+  if [ "$(uname -s 2>/dev/null || echo unknown)" = "Darwin" ] && ! command_exists brew; then
+    echo "[you.md] Homebrew missing; installing it first so the rest of setup can stay boring"
+    NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || true
+  fi
+  if [ -x /opt/homebrew/bin/brew ]; then eval "$(/opt/homebrew/bin/brew shellenv)" || true; fi
+  if [ -x /usr/local/bin/brew ]; then eval "$(/usr/local/bin/brew shellenv)" || true; fi
+  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+  if command_exists brew; then
+    MAJOR="$(node_major)"
+    if ! command_exists node || [ "$MAJOR" -lt 20 ] || [ "$MAJOR" -ge 23 ]; then
+      echo "[you.md] installing Node 22 for modern Next/Convex projects"
+      brew install node@22 || brew install node || true
+      brew link --overwrite --force node@22 || true
+    fi
+    command_exists git || brew install git || true
+    command_exists gh || brew install gh || true
+    command_exists bun || brew install bun || brew install oven-sh/bun/bun || true
+  fi
+
+  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  command_exists corepack && corepack enable || true
+  if command_exists corepack && ! command_exists pnpm; then
+    corepack prepare pnpm@latest --activate || true
+  fi
+
+  for required in node npm git; do
+    if ! command_exists "$required"; then
+      echo "[you.md] required tool missing after bootstrap: $required" >&2
+      exit 1
+    fi
+  done
+}
+
+ensure_github_auth() {
+  if ! command_exists gh; then
+    echo "[you.md] GitHub CLI is missing, so private repo clone/setup cannot continue yet." >&2
+    return 1
+  fi
+  if gh auth status >/dev/null 2>&1; then
+    echo "[you.md] GitHub auth is ready"
+    return 0
+  fi
+  echo "[you.md] GitHub auth is required before private skill/project repos can clone."
+  if [ -t 0 ]; then
+    gh auth login -h github.com -p https -s repo || true
+  fi
+  if gh auth status >/dev/null 2>&1; then
+    echo "[you.md] GitHub auth is ready"
+    return 0
+  fi
+  echo "[you.md] GitHub auth still is not complete."
+  echo "[you.md] Open a normal Terminal on this Mac and run:"
+  echo "  $(command -v gh || echo gh) auth login -h github.com -p https -s repo"
+  echo "[you.md] Then rerun this same setup prompt/command."
+  return 1
+}
+
+bootstrap_prereqs
+
+echo "[you.md] installing runtime from GitHub main"
+curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
+export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+if ! command_exists youmd; then
+  echo "[you.md] youmd was installed but is not on PATH. Try a new Terminal, then rerun this command." >&2
+  exit 1
+fi
+ensure_youmd_min_version
+
+if [ -n "\${YOUMD_API_KEY:-}" ]; then
+  echo "[you.md] logging in with bootstrap key"
+  youmd login --key "$YOUMD_API_KEY"
+else
+  echo "[you.md] no YOUMD_API_KEY set; starting interactive login"
+  youmd login
+fi
+
+echo "[you.md] pulling identity bundle and syncing local brain"
+youmd pull
+youmd sync
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) authenticated, pulled identity, and started setup" || true
+
+echo "[you.md] installing resident realtime/identity/skillstack/project-context daemons early"
+youmd stack daemon install || true
+youmd stack daemon status || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) installed resident realtime/skillstack daemons" || true
+
+GITHUB_READY=0
+if ensure_github_auth; then
+  GITHUB_READY=1
+elif [ "\${YOUMD_REQUIRE_GITHUB_AUTH:-1}" = "1" ]; then
+  echo "[you.md] stopping after You.md identity/daemon setup because GitHub auth is required for private repos." >&2
+  exit 2
+fi
+
+echo "[you.md] restoring shared skills, stacks, and agent host config"
+youmd machine setup || echo "[you.md] machine setup reported a warning; continuing to skills/MCP so the next run can self-heal"
+youmd skill install all || true
+youmd skill sync || true
+youmd mcp --install claude --auto || true
+youmd mcp --install codex --auto || true
+youmd skill link claude || true
+youmd skill link codex || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored shared skills/stacks and MCP config" || true
+
+if [ "$GITHUB_READY" != "1" ]; then
+  echo "[you.md] GitHub auth is still missing; project clone pass skipped. Rerun after gh auth login."
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: GitHub auth required before private project clone" || true
+  exit 2
+fi
+
+RECENT_ONLY_ARGS=()
+if youmd machine --help 2>/dev/null | grep -q -- "--recent-only"; then
+  RECENT_ONLY_ARGS=(--recent-only)
+else
+  echo "[you.md] installed CLI does not expose --recent-only yet; using noninteractive no-to-older-projects fallback"
+fi
+run_machine_projects_recent_only() {
+  if [ "\${#RECENT_ONLY_ARGS[@]}" -gt 0 ]; then
+    youmd machine projects "$@"
+  else
+    youmd machine projects "$@" </dev/null
+  fi
+}
+
+echo "[you.md] hydrating portfolio graph from You.md/GitHub before the 30-day local clone pass"
+run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
+PROJECT_ARGS=(--root "$ROOT" --days "$DAYS" "\${RECENT_ONLY_ARGS[@]}")
+if [ -n "\${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then
+  PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")
+fi
+echo "[you.md] previewing graph-backed 30-day project setup plan (ACTIVE + Top Priority/Focusing only)"
+run_machine_projects_recent_only "\${PROJECT_ARGS[@]}" --dry-run || true
+echo "[you.md] creating code workspace and cloning ACTIVE + Top Priority/Focusing 30-day project repos"
+run_machine_projects_recent_only "\${PROJECT_ARGS[@]}"
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) finished 30-day active/focused project clone pass into $ROOT" || true
+
+echo "[you.md] checking encrypted env-vault tooling without printing secrets"
+youmd env backup --root "$ROOT" --preflight || true
+SECRET_VAULT_RESTORED=0
+if [ -z "\${YOUMD_ENV_VAULT:-}" ] && [ "\${YOUMD_SECRET_VAULT_PULL:-1}" = "1" ]; then
+  SECRET_VAULT_DIR="\${YOUMD_SECRET_VAULT_DIR:-$HOME/.youmd/secret-vault}"
+  echo "[you.md] registering this Mac as a trusted Secret Vault device"
+  youmd env vault device-register || true
+  echo "[you.md] checking You.md Secret Vault for the latest encrypted env vault and trusted-device envelope"
+  if youmd env vault pull --out "$SECRET_VAULT_DIR" --restore --root "$ROOT" --map-existing --existing-only --skip-agent-auth; then
+    SECRET_VAULT_RESTORED=1
+    echo "[you.md] restored env vault through trusted-device Secret Vault"
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault through trusted-device Secret Vault" || true
+  else
+    echo "[you.md] account-backed Secret Vault restore not available yet; falling back to local/iCloud vault discovery"
+    echo "[you.md] if this Mac was just registered, run this on the source Mac: youmd env vault share"
+  fi
+fi
+if [ "$SECRET_VAULT_RESTORED" != "1" ] && [ -z "\${YOUMD_ENV_VAULT:-}" ]; then
+  for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
+    if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
+      DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
+      if [ -n "$DETECTED_ENV_VAULT" ]; then
+        export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
+        echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
+        break
+      fi
+    fi
+  done
+fi
+if [ "$SECRET_VAULT_RESTORED" = "1" ]; then
+  :
+elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
+  if [ ! -f "$YOUMD_ENV_VAULT" ]; then
+    echo "[you.md] env vault path does not exist: $YOUMD_ENV_VAULT" >&2
+    exit 1
+  fi
+  if [ -z "\${ENV_VAULT_PASS:-}" ] && command_exists security; then
+    KEYCHAIN_SERVICE="\${YOUMD_ENV_VAULT_KEYCHAIN_SERVICE:-youmd-env-vault}"
+    if ENV_VAULT_PASS_FROM_KEYCHAIN="$(security find-generic-password -a "\${USER:-\${LOGNAME:-houston}}" -s "$KEYCHAIN_SERVICE" -w 2>/dev/null)"; then
+      export ENV_VAULT_PASS="$ENV_VAULT_PASS_FROM_KEYCHAIN"
+      unset ENV_VAULT_PASS_FROM_KEYCHAIN
+      echo "[you.md] loaded env-vault passphrase from macOS Keychain service: $KEYCHAIN_SERVICE"
+    else
+      echo "[you.md] no env-vault Keychain item found; restore will prompt for the passphrase"
+    fi
+  fi
+  echo "[you.md] listing encrypted .env.local vault before restore"
+  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --list --map-existing --existing-only --skip-agent-auth
+  echo "[you.md] restoring encrypted .env.local vault into existing cloned project dirs"
+  youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --map-existing --existing-only --skip-agent-auth
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault into existing project dirs" || true
+else
+  echo "[you.md] env vault not restored yet"
+  echo "[you.md] On the old/source Mac, create the encrypted vault first:"
+  echo "youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
+  echo "[you.md] Then share local decrypt access to registered trusted Macs:"
+  echo "youmd env vault share"
+  echo "[you.md] Or create a transferable local copy without account sync:"
+  echo "youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
+  echo "[you.md] The setup command also auto-detects vaults in local Desktop and iCloud Desktop: ~/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault"
+  echo "[you.md] Move the generated env-vault-*.tar.enc file to this Mac, then rerun this command with:"
+  echo "YOUMD_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
+  echo "[you.md] Or restore manually after clone:"
+  echo "youmd env restore <vault> --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+  if [ "\${YOUMD_REQUIRE_ENV_VAULT:-}" = "1" ]; then
+    echo "[you.md] strict proof requires Secret Vault restore or YOUMD_ENV_VAULT; stopping before readiness is marked complete" >&2
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: strict env vault restore still required; source Mac may need youmd env vault share" || true
+    exit 1
+  fi
+fi
+echo "[you.md] rehydrating portfolio graph with local README/project-context/env-key evidence"
+run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
+echo "[you.md] auditing cloned project readiness"
+youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) synced machine readiness proof for $ROOT" || true
+FULL_PROJECT_SET_COMPLETE=0
+EXPAND_TO_90="\${YOUMD_EXPAND_TO_90_DAYS:-}"
+if [ -z "$EXPAND_TO_90" ] && [ "\${YOUMD_SKIP_90_DAY_EXPANSION_PROMPT:-}" != "1" ] && [ -t 0 ]; then
+  printf "\\n[you.md] expand to all active projects from the last \${EXPAND_DAYS} days before calling setup complete? [y/N] "
+  read -r EXPAND_TO_90
+fi
+case "$EXPAND_TO_90" in
+  y|Y|yes|YES|1|true|TRUE)
+    echo "[you.md] expanding workspace to active \${EXPAND_DAYS}-day project set"
+    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
+    EXPAND_PROJECT_ARGS=(--root "$ROOT" --days "$EXPAND_DAYS" "\${RECENT_ONLY_ARGS[@]}")
+    if [ -n "\${YOUMD_MAX_CLONE_PROJECTS:-}" ]; then
+      EXPAND_PROJECT_ARGS+=(--max-clone-projects "$YOUMD_MAX_CLONE_PROJECTS")
+    fi
+    run_machine_projects_recent_only "\${EXPAND_PROJECT_ARGS[@]}" --dry-run || true
+    run_machine_projects_recent_only "\${EXPAND_PROJECT_ARGS[@]}"
+    run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
+    youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) expanded to active/focused \${EXPAND_DAYS}-day project set and synced proof" || true
+    FULL_PROJECT_SET_COMPLETE=1
+    ;;
+  *)
+    echo "[you.md] stopped after the \${DAYS}-day active project setup; \${EXPAND_DAYS}-day expansion remains intentionally open."
+    ;;
+esac
+if [ "\${YOUMD_RUN_CHECKS:-}" = "1" ]; then
+  echo "[you.md] running bounded package checks"
+  youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --run-checks --max-check-projects "\${YOUMD_MAX_CHECK_PROJECTS:-8}" --check-timeout-ms "\${YOUMD_CHECK_TIMEOUT_MS:-120000}" --write-report --sync-report || true
+else
+  echo "[you.md] bounded package checks skipped; set YOUMD_RUN_CHECKS=1 to run lint/typecheck/test/build caps"
+fi
+if [ "\${YOUMD_INSTALL_DEPS:-}" = "1" ] || [ "\${YOUMD_PROBE_SERVERS:-}" = "1" ]; then
+  echo "[you.md] running bounded clean-host install/server proof"
+  VERIFY_ARGS=(--root "$ROOT" --max-projects "$LIMIT")
+  if [ "\${YOUMD_INSTALL_DEPS:-}" = "1" ]; then
+    VERIFY_ARGS+=(--install-deps --max-install-projects "\${YOUMD_MAX_INSTALL_PROJECTS:-4}" --install-timeout-ms "\${YOUMD_INSTALL_TIMEOUT_MS:-180000}")
+  fi
+  if [ "\${YOUMD_PROBE_SERVERS:-}" = "1" ]; then
+    VERIFY_ARGS+=(--probe-servers --max-server-projects "\${YOUMD_MAX_SERVER_PROJECTS:-3}" --server-timeout-ms "\${YOUMD_SERVER_TIMEOUT_MS:-45000}" --server-start-port "\${YOUMD_SERVER_START_PORT:-4310}")
+  fi
+  youmd machine verify "\${VERIFY_ARGS[@]}" --write-report --sync-report || true
+else
+  echo "[you.md] clean-host install/server proof skipped; set YOUMD_INSTALL_DEPS=1 and YOUMD_PROBE_SERVERS=1 to install deps and smoke-probe local dev servers"
+fi
+echo "[you.md] confirming resident realtime/identity/skillstack/project-context daemons"
+youmd stack daemon install || true
+youmd stack daemon status || true
+youmd status
+if [ "$FULL_PROJECT_SET_COMPLETE" = "1" ]; then
+  echo "[you.md] fresh-machine full \${EXPAND_DAYS}-day project setup complete: $ROOT"
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete: full \${EXPAND_DAYS}-day active/focused setup at $ROOT" || true
+else
+  echo "[you.md] fresh-machine \${DAYS}-day setup pass complete; \${EXPAND_DAYS}-day expansion is still open: $ROOT"
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete for \${DAYS}-day active/focused pass at $ROOT; \${EXPAND_DAYS}-day expansion still open" || true
+fi`;
 }
 function buildFreshMachineBootstrapCommand(options = {}) {
     const assignments = [
         envAssignment("YOUMD_API_KEY", options.apiKey),
-        envAssignment("YOUMD_CODE_ROOT", portableHomePath(options.root)),
+        envAssignment("YOUMD_CODE_ROOT", portableHomePath(options.root), { expandHome: true }),
         envAssignment("YOUMD_ACTIVE_DAYS", options.days ?? exports.DEFAULT_FRESH_MACHINE_DAYS),
         envAssignment("YOUMD_PROJECT_LIMIT", options.limit ?? exports.DEFAULT_FRESH_MACHINE_LIMIT),
         envAssignment("YOUMD_MAX_CLONE_PROJECTS", options.maxCloneProjects),
-        envAssignment("YOUMD_ENV_VAULT", portableHomePath(options.envVaultPath)),
+        envAssignment("YOUMD_ENV_VAULT", portableHomePath(options.envVaultPath), { expandHome: true }),
         envAssignment("YOUMD_REQUIRE_ENV_VAULT", options.requireEnvVault ? "1" : undefined),
     ].filter((value) => Boolean(value));
-    return `${assignments.join(" ")} bash -lc ${shellQuote(buildFreshMachineBootstrapScript())}`;
+    const pathPrefix = `PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"`;
+    return `${[pathPrefix, ...assignments].join(" ")} bash -lc ${shellQuote(buildFreshMachineBootstrapScript())}`;
 }
 function buildFreshMachineBootstrapPrompt(options = {}) {
     const root = portableHomePath(options.root) ?? exports.DEFAULT_FRESH_MACHINE_ROOT;
@@ -270,6 +451,8 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "",
         authLine,
         "",
+        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd env vault list`, `youmd env vault device-register`, `youmd env vault pull --restore`, `youmd machine prompt`, `youmd machine verify`, `youmd project portfolio-hydrate`, and `youmd agent status` as needed. Use `youmd agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac vault sharing/passphrase entry if the trusted-device envelope has not been created yet, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
+        "",
         "Exact setup command:",
         "",
         "```bash",
@@ -277,19 +460,24 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "```",
         "",
         "What it will do:",
-        "- install You.md from the curl runtime",
+        "- check/install the local prerequisites first: Homebrew, Node 22/npm, git, GitHub CLI, bun, and pnpm/corepack",
+        "- install You.md from the curl runtime and force the You.md/Homebrew/Node 22 paths into this setup shell",
         "- authenticate and pull/sync your identity bundle",
+        "- install resident realtime sync daemons early so identity/skill/project-context sync is not deferred until the end",
+        "- require GitHub CLI auth before private shared-skill/project repos clone; if browser auth fails inside Claude/Codex, it prints the exact Terminal command to run and stops cleanly",
         "- install/configure MCP for Claude Code and Codex",
-        "- restore shared agent skills, stack config, Claude/Codex links, and resident sync daemons",
+        "- restore shared agent skills, stack config, Claude/Codex links, and agent host config",
+        "- use the installed You.md CLI behind the scenes for status, skill sync, Secret Vault pull, portfolio graph hydration, machine verification, and You Agent context routing instead of making Houston manually drive those steps",
+        "- publish setup milestones through `youmd agent send` so Houston's source Mac and realtime daemon can see the Mac mini come online without clipboard babysitting",
         "- hydrate the portfolio graph from You.md + authenticated GitHub before cloning",
         `- preview the graph-backed plan, create ${root}, and clone only projects marked ACTIVE plus Top Priority/Focusing from the last ${days} days first`,
         `- ask whether to expand to all ACTIVE plus Top Priority/Focusing projects from the last ${expandDays} days before calling the full project clone set complete`,
-        "- check env-vault tooling, auto-detect the newest `~/Desktop/youmd-env-vault/env-vault-*` file if `YOUMD_ENV_VAULT` is not set, list the encrypted vault, try macOS Keychain service `youmd-env-vault` for the passphrase, restore only after the list passes, then rehydrate local project/env evidence",
+        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, otherwise auto-detect the newest local Desktop or iCloud Desktop `youmd-env-vault/env-vault-*` file if `YOUMD_ENV_VAULT` is not set, then rehydrate local project/env evidence",
         "- write and sync a secret-safe machine proof report, with optional bounded install/check/server proof flags",
         "- bound portfolio hydration with `YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS` so large restored roots do not wedge setup",
         "",
         `Project source: You.md portfolio graph + authenticated GitHub recent repos, capped at ${limit} tracked projects before local audit evidence is merged. When the graph exists, new-computer setup clones only projects with status ACTIVE and focus Top Priority/Focusing; inactive, unsorted, on-ice, abandoned, killed, and unreviewed GitHub-only repos are skipped unless --include-inactive is explicitly used. First pass is ${days} days with out-of-window projects skipped; the ${expandDays}-day pass is explicit.`,
-        "Secret rule: .env.local values are never embedded here. On the old/source Mac, create a vault with `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to `~/Desktop/youmd-env-vault/` on the new machine, then run this command. The command auto-detects the newest vault there; you can also override with `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. If macOS Keychain contains service `youmd-env-vault` for the current user, restore uses it automatically; otherwise it prompts. The restore path lists variable names/counts and target paths only, never values.",
+        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `youmd env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. Local fallback: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to `~/Desktop/youmd-env-vault/` or the iCloud Desktop `youmd-env-vault/` on the new machine, then run this command. The command checks Secret Vault first, then auto-detects the newest local vault; you can also override with `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
         "",
         "After the command finishes, report:",
         "- the `youmd status` sync state",