youmd 0.8.5 → 0.8.7

package/dist/lib/machine-bootstrap-prompt.js

@@ -55,6 +55,16 @@ function envAssignment(name, value, options = {}) {
         if (stringValue.startsWith("~/")) {
             return `${name}="$HOME${stringValue.slice(1).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
         }
+        if (stringValue === "$HOME")
+            return `${name}="$HOME"`;
+        if (stringValue.startsWith("$HOME/")) {
+            return `${name}="$HOME/${stringValue.slice("$HOME/".length).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
+        }
+        if (stringValue === "${HOME}")
+            return `${name}="$HOME"`;
+        if (stringValue.startsWith("${HOME}/")) {
+            return `${name}="$HOME/${stringValue.slice("${HOME}/".length).replace(/["\\$`]/g, (char) => `\\${char}`)}"`;
+        }
     }
     return `${name}=${shellQuote(stringValue)}`;
 }
@@ -79,10 +89,47 @@ DAYS="\${YOUMD_ACTIVE_DAYS:-30}"
 EXPAND_DAYS="\${YOUMD_EXPAND_ACTIVE_DAYS:-90}"
 LIMIT="\${YOUMD_PROJECT_LIMIT:-80}"
 HYDRATE_TIMEOUT="\${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}"
+MIN_YOUMD_VERSION="\${YOUMD_MIN_VERSION:-0.8.7}"
 mkdir -p "$ROOT"
 
 command_exists() { command -v "$1" >/dev/null 2>&1; }
 node_major() { node -e 'console.log(process.versions.node.split(".")[0])' 2>/dev/null || echo 0; }
+version_at_least() {
+  local current="\${1#v}"
+  local required="\${2#v}"
+  local IFS=.
+  local current_parts=($current)
+  local required_parts=($required)
+  local i current_value required_value
+  for i in 0 1 2; do
+    current_value="\${current_parts[$i]:-0}"
+    required_value="\${required_parts[$i]:-0}"
+    current_value="\${current_value%%[^0-9]*}"
+    required_value="\${required_value%%[^0-9]*}"
+    current_value="\${current_value:-0}"
+    required_value="\${required_value:-0}"
+    if ((10#$current_value > 10#$required_value)); then return 0; fi
+    if ((10#$current_value < 10#$required_value)); then return 1; fi
+  done
+  return 0
+}
+ensure_youmd_min_version() {
+  local installed
+  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  echo "[you.md] installed version: \${installed:-unknown}"
+  if [ -n "$installed" ] && version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
+    return 0
+  fi
+  echo "[you.md] installed youmd is older than required \${MIN_YOUMD_VERSION}; forcing GitHub source install"
+  curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
+  export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+  installed="$(youmd --version 2>/dev/null | tr -d '[:space:]' || true)"
+  echo "[you.md] installed version after forced source install: \${installed:-unknown}"
+  if [ -z "$installed" ] || ! version_at_least "$installed" "$MIN_YOUMD_VERSION"; then
+    echo "[you.md] youmd \${MIN_YOUMD_VERSION}+ is required for Secret Vault, agent bus, and fresh-machine restore. npm latest may still be behind; rerun after this commit is deployed or install from GitHub main." >&2
+    exit 1
+  fi
+}
 run_with_timeout() {
   seconds="$1"
   shift
@@ -165,13 +212,14 @@ ensure_github_auth() {
 
 bootstrap_prereqs
 
-echo "[you.md] installing runtime"
-curl -fsSL https://you.md/install.sh | bash
+echo "[you.md] installing runtime from GitHub main"
+curl -fsSL https://you.md/install.sh | YOUMD_INSTALL_CHANNEL=source YOUMD_SOURCE_REF=main bash
 export PATH="$HOME/.youmd/bin:$HOME/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
 if ! command_exists youmd; then
   echo "[you.md] youmd was installed but is not on PATH. Try a new Terminal, then rerun this command." >&2
   exit 1
 fi
+ensure_youmd_min_version
 
 if [ -n "\${YOUMD_API_KEY:-}" ]; then
   echo "[you.md] logging in with bootstrap key"
@@ -184,10 +232,12 @@ fi
 echo "[you.md] pulling identity bundle and syncing local brain"
 youmd pull
 youmd sync
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) authenticated, pulled identity, and started setup" || true
 
 echo "[you.md] installing resident realtime/identity/skillstack/project-context daemons early"
 youmd stack daemon install || true
 youmd stack daemon status || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) installed resident realtime/skillstack daemons" || true
 
 GITHUB_READY=0
 if ensure_github_auth; then
@@ -205,9 +255,11 @@ youmd mcp --install claude --auto || true
 youmd mcp --install codex --auto || true
 youmd skill link claude || true
 youmd skill link codex || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored shared skills/stacks and MCP config" || true
 
 if [ "$GITHUB_READY" != "1" ]; then
   echo "[you.md] GitHub auth is still missing; project clone pass skipped. Rerun after gh auth login."
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: GitHub auth required before private project clone" || true
   exit 2
 fi
 
@@ -235,34 +287,50 @@ echo "[you.md] previewing graph-backed 30-day project setup plan (ACTIVE + Top P
 run_machine_projects_recent_only "\${PROJECT_ARGS[@]}" --dry-run || true
 echo "[you.md] creating code workspace and cloning ACTIVE + Top Priority/Focusing 30-day project repos"
 run_machine_projects_recent_only "\${PROJECT_ARGS[@]}"
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) finished 30-day active/focused project clone pass into $ROOT" || true
 
 echo "[you.md] checking encrypted env-vault tooling without printing secrets"
 youmd env backup --root "$ROOT" --preflight || true
+SECRET_VAULT_RESTORED=0
+ALLOW_LOCAL_ENV_VAULT_FALLBACK="\${YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK:-0}"
 if [ -z "\${YOUMD_ENV_VAULT:-}" ] && [ "\${YOUMD_SECRET_VAULT_PULL:-1}" = "1" ]; then
   SECRET_VAULT_DIR="\${YOUMD_SECRET_VAULT_DIR:-$HOME/.youmd/secret-vault}"
-  echo "[you.md] checking You.md Secret Vault for the latest encrypted env vault"
-  if SECRET_VAULT_PATH="$(youmd env vault pull --out "$SECRET_VAULT_DIR" --print-path 2>/dev/null)"; then
-    if [ -n "$SECRET_VAULT_PATH" ] && [ -f "$SECRET_VAULT_PATH" ]; then
-      export YOUMD_ENV_VAULT="$SECRET_VAULT_PATH"
-      echo "[you.md] using You.md Secret Vault snapshot: $YOUMD_ENV_VAULT"
-    fi
+  echo "[you.md] registering this Mac as a trusted Secret Vault device"
+  youmd env vault device-register || true
+  echo "[you.md] checking You.md Secret Vault for the latest encrypted env vault and trusted-device envelope"
+  if youmd env vault pull --out "$SECRET_VAULT_DIR" --restore --root "$ROOT" --map-existing --existing-only --skip-agent-auth; then
+    SECRET_VAULT_RESTORED=1
+    echo "[you.md] restored env vault through trusted-device Secret Vault"
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault through trusted-device Secret Vault" || true
   else
-    echo "[you.md] account-backed Secret Vault not available yet; falling back to local/iCloud vault discovery"
+    echo "[you.md] account-backed Secret Vault restore is waiting for a trusted-device share"
+    echo "[you.md] source Mac action: youmd env vault share"
+    echo "[you.md] new Mac retry: youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) registered Secret Vault device and is waiting for source Mac trusted-device share" || true
   fi
 fi
-if [ -z "\${YOUMD_ENV_VAULT:-}" ]; then
-  for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
-    if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
-      DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
-      if [ -n "$DETECTED_ENV_VAULT" ]; then
-        export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
-        echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
-        break
+if [ "$SECRET_VAULT_RESTORED" != "1" ] && [ -z "\${YOUMD_ENV_VAULT:-}" ]; then
+  if [ "$ALLOW_LOCAL_ENV_VAULT_FALLBACK" = "1" ]; then
+    echo "[you.md] opt-in local/iCloud passphrase vault fallback enabled"
+    for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
+      if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
+        DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
+        if [ -n "$DETECTED_ENV_VAULT" ]; then
+          export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
+          echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
+          break
+        fi
       fi
-    fi
-  done
+    done
+  else
+    echo "[you.md] local/iCloud passphrase vault fallback disabled by default"
+    echo "[you.md] set YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 or YOUMD_ENV_VAULT=/path/to/env-vault only if you intentionally want the older passphrase flow"
+  fi
 fi
-if [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
+if [ "$SECRET_VAULT_RESTORED" = "1" ]; then
+  :
+elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
+  echo "[you.md] using explicit/opt-in local encrypted vault fallback"
   if [ ! -f "$YOUMD_ENV_VAULT" ]; then
     echo "[you.md] env vault path does not exist: $YOUMD_ENV_VAULT" >&2
     exit 1
@@ -274,26 +342,34 @@ if [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
       unset ENV_VAULT_PASS_FROM_KEYCHAIN
       echo "[you.md] loaded env-vault passphrase from macOS Keychain service: $KEYCHAIN_SERVICE"
     else
-      echo "[you.md] no env-vault Keychain item found; restore will prompt for the passphrase"
+      echo "[you.md] no env-vault Keychain item found; explicit local fallback may prompt for the passphrase"
     fi
   fi
   echo "[you.md] listing encrypted .env.local vault before restore"
   youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --list --map-existing --existing-only --skip-agent-auth
   echo "[you.md] restoring encrypted .env.local vault into existing cloned project dirs"
   youmd env restore "$YOUMD_ENV_VAULT" --root "$ROOT" --map-existing --existing-only --skip-agent-auth
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault into existing project dirs" || true
 else
   echo "[you.md] env vault not restored yet"
   echo "[you.md] On the old/source Mac, create the encrypted vault first:"
   echo "youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
-  echo "[you.md] Or create a transferable local copy without account sync:"
+  echo "[you.md] Then share local decrypt access to registered trusted Macs:"
+  echo "youmd env vault share"
+  echo "[you.md] Then retry on this Mac:"
+  echo "youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+  echo "[you.md] This strict fresh-machine flow intentionally does not ask for a local vault passphrase on the new Mac by default."
+  echo "[you.md] Optional fallback: create a transferable local copy without account sync:"
   echo "youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
-  echo "[you.md] The setup command also auto-detects vaults in local Desktop and iCloud Desktop: ~/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault"
+  echo "[you.md] Local/iCloud auto-detect is opt-in only. Rerun with:"
+  echo "YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Move the generated env-vault-*.tar.enc file to this Mac, then rerun this command with:"
   echo "YOUMD_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Or restore manually after clone:"
   echo "youmd env restore <vault> --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
   if [ "\${YOUMD_REQUIRE_ENV_VAULT:-}" = "1" ]; then
-    echo "[you.md] strict proof requires YOUMD_ENV_VAULT; stopping before readiness is marked complete" >&2
+    echo "[you.md] strict proof is waiting for trusted-device Secret Vault share or an explicitly provided local vault; stopping before readiness is marked complete" >&2
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: waiting for trusted-device Secret Vault share or explicit local vault fallback" || true
     exit 1
   fi
 fi
@@ -301,6 +377,7 @@ echo "[you.md] rehydrating portfolio graph with local README/project-context/env
 run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$DAYS" --limit "$LIMIT" || true
 echo "[you.md] auditing cloned project readiness"
 youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) synced machine readiness proof for $ROOT" || true
 FULL_PROJECT_SET_COMPLETE=0
 EXPAND_TO_90="\${YOUMD_EXPAND_TO_90_DAYS:-}"
 if [ -z "$EXPAND_TO_90" ] && [ "\${YOUMD_SKIP_90_DAY_EXPANSION_PROMPT:-}" != "1" ] && [ -t 0 ]; then
@@ -319,6 +396,7 @@ case "$EXPAND_TO_90" in
     run_machine_projects_recent_only "\${EXPAND_PROJECT_ARGS[@]}"
     run_with_timeout "$HYDRATE_TIMEOUT" youmd project portfolio-hydrate --root "$ROOT" --days "$EXPAND_DAYS" --limit "$LIMIT" || true
     youmd machine verify --root "$ROOT" --max-projects "$LIMIT" --write-report --sync-report || true
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) expanded to active/focused \${EXPAND_DAYS}-day project set and synced proof" || true
     FULL_PROJECT_SET_COMPLETE=1
     ;;
   *)
@@ -350,8 +428,10 @@ youmd stack daemon status || true
 youmd status
 if [ "$FULL_PROJECT_SET_COMPLETE" = "1" ]; then
   echo "[you.md] fresh-machine full \${EXPAND_DAYS}-day project setup complete: $ROOT"
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete: full \${EXPAND_DAYS}-day active/focused setup at $ROOT" || true
 else
   echo "[you.md] fresh-machine \${DAYS}-day setup pass complete; \${EXPAND_DAYS}-day expansion is still open: $ROOT"
+  youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) complete for \${DAYS}-day active/focused pass at $ROOT; \${EXPAND_DAYS}-day expansion still open" || true
 fi`;
 }
 function buildFreshMachineBootstrapCommand(options = {}) {
@@ -385,7 +465,7 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "",
         authLine,
         "",
-        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd env vault list`, `youmd env vault pull`, `youmd machine prompt`, `youmd machine verify`, and `youmd project portfolio-hydrate` as needed. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, macOS Keychain/passphrase entry, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
+        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd env vault list`, `youmd env vault device-register`, `youmd env vault pull --restore`, `youmd machine prompt`, `youmd machine verify`, `youmd project portfolio-hydrate`, and `youmd agent status` as needed. Use `youmd agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac Secret Vault share if the trusted-device envelope has not been created yet, local vault passphrase/Keychain only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
         "",
         "Exact setup command:",
         "",
@@ -402,15 +482,16 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "- install/configure MCP for Claude Code and Codex",
         "- restore shared agent skills, stack config, Claude/Codex links, and agent host config",
         "- use the installed You.md CLI behind the scenes for status, skill sync, Secret Vault pull, portfolio graph hydration, machine verification, and You Agent context routing instead of making Houston manually drive those steps",
+        "- publish setup milestones through `youmd agent send` so Houston's source Mac and realtime daemon can see the Mac mini come online without clipboard babysitting",
         "- hydrate the portfolio graph from You.md + authenticated GitHub before cloning",
         `- preview the graph-backed plan, create ${root}, and clone only projects marked ACTIVE plus Top Priority/Focusing from the last ${days} days first`,
         `- ask whether to expand to all ACTIVE plus Top Priority/Focusing projects from the last ${expandDays} days before calling the full project clone set complete`,
-        "- check env-vault tooling, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, otherwise auto-detect the newest local Desktop or iCloud Desktop `youmd-env-vault/env-vault-*` file if `YOUMD_ENV_VAULT` is not set, list the encrypted vault, try macOS Keychain service `youmd-env-vault` for the passphrase, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, then rehydrate local project/env evidence",
+        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, or stop with the exact source-Mac `youmd env vault share` action instead of asking for a passphrase on the new Mac. Local/iCloud passphrase fallback runs only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided. After env handling, rehydrate local project/env evidence.",
         "- write and sync a secret-safe machine proof report, with optional bounded install/check/server proof flags",
         "- bound portfolio hydration with `YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS` so large restored roots do not wedge setup",
         "",
         `Project source: You.md portfolio graph + authenticated GitHub recent repos, capped at ${limit} tracked projects before local audit evidence is merged. When the graph exists, new-computer setup clones only projects with status ACTIVE and focus Top Priority/Focusing; inactive, unsorted, on-ice, abandoned, killed, and unreviewed GitHub-only repos are skipped unless --include-inactive is explicitly used. First pass is ${days} days with out-of-window projects skipped; the ${expandDays}-day pass is explicit.`,
-        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once. That uploads only encrypted archive bytes plus a safe manifest to You.md Secret Vault, so a trusted new Mac can pull it after login. Local fallback: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to `~/Desktop/youmd-env-vault/` or the iCloud Desktop `youmd-env-vault/` on the new machine, then run this command. The command checks Secret Vault first, then auto-detects the newest local vault; you can also override with `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. If macOS Keychain contains service `youmd-env-vault` for the current user, restore uses it automatically; otherwise it prompts. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
+        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `youmd env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. If the envelope is missing, the command stops and sends a machine-sync status telling the source Mac to run `youmd env vault share`. Local fallback is opt-in only: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to the new machine, then rerun with `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or explicit `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
         "",
         "After the command finishes, report:",
         "- the `youmd status` sync state",

package/dist/lib/machine-bootstrap-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,4EA0RC;AAED,8EAaC;AAED,4EAwDC;AAlZD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwRN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC9E,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAClF,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACnE,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9F,aAAa,CAAC,yBAAyB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,qJAAqJ,CAAC;IACzK,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,4PAA4P;QAC5P,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,itBAAitB;QACjtB,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,iOAAiO;QACjO,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,yeAAye;QACze,6GAA6G;QAC7G,uHAAuH;QACvH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,ujCAAujC;QACvjC,EAAE;QACF,qCAAqC;QACrC,iCAAiC;QACjC,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,gNAAgN;KACjN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,4EAgWC;AAED,8EAaC;AAED,4EAyDC;AAjeD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACtD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC5G,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8VN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC9E,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAClF,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACnE,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9F,aAAa,CAAC,yBAAyB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,qJAAqJ,CAAC;IACzK,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,4PAA4P;QAC5P,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,2mCAA2mC;QAC3mC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,iOAAiO;QACjO,kKAAkK;QAClK,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,kpBAAkpB;QAClpB,6GAA6G;QAC7G,uHAAuH;QACvH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,osCAAosC;QACpsC,EAAE;QACF,qCAAqC;QACrC,iCAAiC;QACjC,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,gNAAgN;KACjN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/lib/realtime-sync.d.ts

@@ -32,6 +32,14 @@ export type RealtimeSyncHead = {
         brainDumps?: number;
         machineProofs?: number;
     };
+    agentBus?: {
+        status?: "active" | "idle" | string;
+        channelCount?: number;
+        recentCount?: number;
+        latestMessageAt?: number | null;
+        messages?: RealtimeAgentMessage[];
+        secretValuesExposed?: false;
+    };
     repoMirror?: {
         repoFullName?: string | null;
         commitSha?: string | null;
@@ -52,6 +60,9 @@ export type RealtimeSyncHead = {
         flow?: string;
         available?: boolean;
         snapshotCount?: number;
+        trustedDeviceCount?: number;
+        keyEnvelopeCount?: number;
+        latestSnapshotEnvelopeCount?: number;
         id?: string | null;
         label?: string | null;
         createdAt?: number | null;
@@ -74,11 +85,41 @@ export type RealtimeSyncHead = {
     };
 };
 export declare const REALTIME_SYNC_STATUS_PATH: string;
+export declare const REALTIME_AGENT_INBOX_PATH: string;
+export type RealtimeAgentMessage = {
+    id?: string;
+    messageId: string;
+    channel: string;
+    kind: string;
+    body: string;
+    sourceHost?: string | null;
+    sourceAgent: string;
+    sourceRuntime?: string | null;
+    targetHost?: string | null;
+    targetAgent?: string | null;
+    metadata?: unknown;
+    createdAt: number;
+    secretValuesExposed: false;
+};
+export type RealtimeAgentBusStatus = {
+    state: "active" | "idle" | "unknown";
+    summary: string;
+    channelCount: number;
+    recentCount: number;
+    latestMessageAt?: number | null;
+    messages: RealtimeAgentMessage[];
+    inboxPath: string;
+    sendCommand: string;
+    secretValuesExposed: false;
+};
 export type RealtimeSecretVaultStatus = {
     state: "ready" | "missing" | "scope-missing" | "unknown";
-    flow: "account-backed-encrypted-snapshot";
+    flow: "account-backed-encrypted-snapshot+trusted-device-envelopes";
     available: boolean;
     snapshotCount: number;
+    trustedDeviceCount: number;
+    keyEnvelopeCount: number;
+    latestSnapshotEnvelopeCount: number;
     summary: string;
     latestSnapshot?: {
         id?: string | null;
@@ -98,6 +139,8 @@ export type RealtimeSecretVaultStatus = {
         sourceHost?: string | null;
         sourceRoot?: string | null;
     };
+    deviceRegisterCommand: string;
+    shareCommand: string;
     pullCommand: string;
     restoreCommand: string;
     secretValuesExposed: false;
@@ -113,16 +156,19 @@ export type RealtimeSyncStatusFile = {
         latestInstalledAt?: number | null;
     };
     portfolio?: RealtimeSyncHead["portfolio"];
+    agentBus: RealtimeAgentBusStatus;
     repoMirror?: RealtimeSyncHead["repoMirror"];
     github?: RealtimeSyncHead["github"];
     secretVault: RealtimeSecretVaultStatus;
     secretValuesExposed: false;
 };
 export declare function describeRealtimeSecretVault(head: RealtimeSyncHead | null | undefined): RealtimeSecretVaultStatus;
+export declare function describeRealtimeAgentBus(head: RealtimeSyncHead | null | undefined): RealtimeAgentBusStatus;
 export declare function realtimeSyncHeadSignature(head: RealtimeSyncHead | null | undefined): string;
 export declare function summarizeRealtimeSyncHead(head: RealtimeSyncHead): string;
 export declare function buildRealtimeSyncStatusFile(head: RealtimeSyncHead): RealtimeSyncStatusFile;
 export declare function writeRealtimeSyncStatusFile(head: RealtimeSyncHead): void;
 export declare function readRealtimeSyncStatusFile(): RealtimeSyncStatusFile | null;
+export declare function writeRealtimeAgentInboxFile(head: RealtimeSyncHead): void;
 export declare function shouldRunBoundedSync(lastRunAt: number, now: number, minIntervalMs: number): boolean;
 //# sourceMappingURL=realtime-sync.d.ts.map

package/dist/lib/realtime-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-sync.d.ts","sourceRoot":"","sources":["../../src/lib/realtime-sync.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,GAAG,IAAI,CAAC;IACT,iBAAiB,CAAC,EAAE;QAClB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,CAAC;QACxD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,KAAK,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,yBAAyB,QAAiE,CAAC;AAExG,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;IACzD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,uCAAuC,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxE,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,WAAW,EAAE,yBAAyB,CAAC;IACvC,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,yBAAyB,CAmFhH;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAgC3F;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CASxE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAiB1F;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAOxE;AAED,wBAAgB,0BAA0B,IAAI,sBAAsB,GAAG,IAAI,CAS1E;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAET"}
+{"version":3,"file":"realtime-sync.d.ts","sourceRoot":"","sources":["../../src/lib/realtime-sync.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;QACpC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAClC,mBAAmB,CAAC,EAAE,KAAK,CAAC;KAC7B,CAAC;IACF,UAAU,CAAC,EAAE;QACX,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,GAAG,IAAI,CAAC;IACT,iBAAiB,CAAC,EAAE;QAClB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,CAAC;QACxD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,2BAA2B,CAAC,EAAE,MAAM,CAAC;QACrC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,KAAK,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,yBAAyB,QAAiE,CAAC;AACxG,eAAO,MAAM,yBAAyB,QAA+D,CAAC;AAEtG,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;IACzD,IAAI,EAAE,4DAA4D,CAAC;IACnE,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B,EAAE,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,uCAAuC,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxE,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,WAAW,EAAE,yBAAyB,CAAC;IACvC,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAOF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,yBAAyB,CA2GhH;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,sBAAsB,CA4B1G;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAmD3F;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAUxE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAkB1F;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAQxE;AAED,wBAAgB,0BAA0B,IAAI,sBAAsB,GAAG,IAAI,CAS1E;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAgBxE;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAET"}

package/dist/lib/realtime-sync.js

@@ -33,18 +33,21 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REALTIME_SYNC_STATUS_PATH = void 0;
+exports.REALTIME_AGENT_INBOX_PATH = exports.REALTIME_SYNC_STATUS_PATH = void 0;
 exports.describeRealtimeSecretVault = describeRealtimeSecretVault;
+exports.describeRealtimeAgentBus = describeRealtimeAgentBus;
 exports.realtimeSyncHeadSignature = realtimeSyncHeadSignature;
 exports.summarizeRealtimeSyncHead = summarizeRealtimeSyncHead;
 exports.buildRealtimeSyncStatusFile = buildRealtimeSyncStatusFile;
 exports.writeRealtimeSyncStatusFile = writeRealtimeSyncStatusFile;
 exports.readRealtimeSyncStatusFile = readRealtimeSyncStatusFile;
+exports.writeRealtimeAgentInboxFile = writeRealtimeAgentInboxFile;
 exports.shouldRunBoundedSync = shouldRunBoundedSync;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 exports.REALTIME_SYNC_STATUS_PATH = path.join(os.homedir(), ".youmd", "realtime-sync-status.json");
+exports.REALTIME_AGENT_INBOX_PATH = path.join(os.homedir(), ".youmd", "agent-bus", "inbox.json");
 function shortSha(value) {
     if (!value)
         return null;
@@ -59,6 +62,8 @@ function describeRealtimeSecretVault(head) {
             : vault
                 ? "missing"
                 : "unknown";
+    const deviceRegisterCommand = "youmd env vault device-register";
+    const shareCommand = "youmd env vault share";
     const pullCommand = "youmd env vault pull --out ~/.youmd/secret-vault";
     const restoreCommand = "youmd env vault pull --restore --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth";
     if (state === "ready") {
@@ -66,12 +71,17 @@ function describeRealtimeSecretVault(head) {
         const vars = vault?.variableCount ?? 0;
         const source = vault?.sourceHost ? ` from ${vault.sourceHost}` : "";
         const hash = shortSha(vault?.sha256);
+        const trustedDevices = vault?.trustedDeviceCount ?? 0;
+        const latestEnvelopes = vault?.latestSnapshotEnvelopeCount ?? 0;
         return {
             state,
-            flow: "account-backed-encrypted-snapshot",
+            flow: "account-backed-encrypted-snapshot+trusted-device-envelopes",
             available: true,
             snapshotCount: vault?.snapshotCount ?? 1,
-            summary: `Secret Vault ready: ${projects} projects / ${vars} vars${source}${hash ? ` / ${hash}` : ""}`,
+            trustedDeviceCount: trustedDevices,
+            keyEnvelopeCount: vault?.keyEnvelopeCount ?? latestEnvelopes,
+            latestSnapshotEnvelopeCount: latestEnvelopes,
+            summary: `Secret Vault ready: ${projects} projects / ${vars} vars${source} / ${latestEnvelopes}/${trustedDevices} device envelopes${hash ? ` / ${hash}` : ""}`,
             latestSnapshot: {
                 id: vault?.id ?? null,
                 label: vault?.label ?? null,
@@ -90,6 +100,8 @@ function describeRealtimeSecretVault(head) {
                 sourceHost: vault?.sourceHost ?? null,
                 sourceRoot: vault?.sourceRoot ?? null,
             },
+            deviceRegisterCommand,
+            shareCommand,
             pullCommand,
             restoreCommand,
             secretValuesExposed: false,
@@ -98,10 +110,15 @@ function describeRealtimeSecretVault(head) {
     if (state === "scope-missing") {
         return {
             state,
-            flow: "account-backed-encrypted-snapshot",
+            flow: "account-backed-encrypted-snapshot+trusted-device-envelopes",
             available: false,
             snapshotCount: 0,
+            trustedDeviceCount: 0,
+            keyEnvelopeCount: 0,
+            latestSnapshotEnvelopeCount: 0,
             summary: "Secret Vault unknown: current realtime key lacks vault scope",
+            deviceRegisterCommand,
+            shareCommand,
             pullCommand,
             restoreCommand,
             secretValuesExposed: false,
@@ -110,10 +127,15 @@ function describeRealtimeSecretVault(head) {
     if (state === "missing") {
         return {
             state,
-            flow: "account-backed-encrypted-snapshot",
+            flow: "account-backed-encrypted-snapshot+trusted-device-envelopes",
             available: false,
             snapshotCount: vault?.snapshotCount ?? 0,
-            summary: "Secret Vault missing: upload encrypted snapshot from the source Mac with `youmd env vault push`",
+            trustedDeviceCount: vault?.trustedDeviceCount ?? 0,
+            keyEnvelopeCount: vault?.keyEnvelopeCount ?? 0,
+            latestSnapshotEnvelopeCount: vault?.latestSnapshotEnvelopeCount ?? 0,
+            summary: "Secret Vault missing: upload encrypted snapshot from the source Mac with `youmd env vault push`, then register/share trusted devices",
+            deviceRegisterCommand,
+            shareCommand,
             pullCommand,
             restoreCommand,
             secretValuesExposed: false,
@@ -121,15 +143,47 @@ function describeRealtimeSecretVault(head) {
     }
     return {
         state,
-        flow: "account-backed-encrypted-snapshot",
+        flow: "account-backed-encrypted-snapshot+trusted-device-envelopes",
         available: false,
         snapshotCount: 0,
+        trustedDeviceCount: 0,
+        keyEnvelopeCount: 0,
+        latestSnapshotEnvelopeCount: 0,
         summary: "Secret Vault not observed yet: realtime daemon has not received a vault-scoped sync head",
+        deviceRegisterCommand,
+        shareCommand,
         pullCommand,
         restoreCommand,
         secretValuesExposed: false,
     };
 }
+function describeRealtimeAgentBus(head) {
+    const bus = head?.agentBus;
+    const messages = (bus?.messages ?? [])
+        .filter((message) => {
+        return Boolean(message &&
+            typeof message.messageId === "string" &&
+            typeof message.body === "string" &&
+            message.secretValuesExposed === false);
+    })
+        .slice(-12);
+    const latest = bus?.latestMessageAt ?? (messages.length ? messages[messages.length - 1]?.createdAt : null);
+    const state = bus?.status === "active" || messages.length ? "active" : bus ? "idle" : "unknown";
+    const latestLabel = latest ? new Date(latest).toISOString() : "none yet";
+    return {
+        state,
+        summary: state === "unknown"
+            ? "Agent bus not observed yet"
+            : `${messages.length} recent agent message${messages.length === 1 ? "" : "s"} / latest ${latestLabel}`,
+        channelCount: bus?.channelCount ?? new Set(messages.map((message) => message.channel)).size,
+        recentCount: bus?.recentCount ?? messages.length,
+        latestMessageAt: latest,
+        messages,
+        inboxPath: exports.REALTIME_AGENT_INBOX_PATH,
+        sendCommand: 'youmd agent send "hello from this Mac"',
+        secretValuesExposed: false,
+    };
+}
 function realtimeSyncHeadSignature(head) {
     if (!head)
         return "none";
@@ -146,12 +200,31 @@ function realtimeSyncHeadSignature(head) {
             names: head.skills?.names ?? [],
         },
         portfolio: head.portfolio ?? null,
+        agentBus: {
+            status: head.agentBus?.status ?? null,
+            latestMessageAt: head.agentBus?.latestMessageAt ?? null,
+            recentCount: head.agentBus?.recentCount ?? 0,
+            messages: (head.agentBus?.messages ?? []).map((message) => ({
+                messageId: message.messageId,
+                channel: message.channel,
+                kind: message.kind,
+                body: message.body,
+                sourceHost: message.sourceHost ?? null,
+                sourceAgent: message.sourceAgent,
+                targetHost: message.targetHost ?? null,
+                targetAgent: message.targetAgent ?? null,
+                createdAt: message.createdAt,
+            })),
+        },
         repoMirror: head.repoMirror ?? null,
         github: head.github ?? null,
         encryptedEnvVault: {
             status: head.encryptedEnvVault?.status ?? null,
             available: head.encryptedEnvVault?.available ?? false,
             snapshotCount: head.encryptedEnvVault?.snapshotCount ?? 0,
+            trustedDeviceCount: head.encryptedEnvVault?.trustedDeviceCount ?? 0,
+            keyEnvelopeCount: head.encryptedEnvVault?.keyEnvelopeCount ?? 0,
+            latestSnapshotEnvelopeCount: head.encryptedEnvVault?.latestSnapshotEnvelopeCount ?? 0,
             id: head.encryptedEnvVault?.id ?? null,
             createdAt: head.encryptedEnvVault?.createdAt ?? null,
             fileName: head.encryptedEnvVault?.fileName ?? null,
@@ -171,8 +244,9 @@ function summarizeRealtimeSyncHead(head) {
     const skills = `${head.skills?.installedCount ?? 0} skills`;
     const projects = `${head.portfolio?.projects ?? 0} projects`;
     const tasks = `${head.portfolio?.tasks ?? 0} tasks`;
+    const agentMessages = `${head.agentBus?.recentCount ?? 0} agent msgs`;
     const vault = describeRealtimeSecretVault(head).summary;
-    return `${bundle}, ${skills}, ${projects}, ${tasks}, ${vault}`;
+    return `${bundle}, ${skills}, ${projects}, ${tasks}, ${agentMessages}, ${vault}`;
 }
 function buildRealtimeSyncStatusFile(head) {
     return {
@@ -186,6 +260,7 @@ function buildRealtimeSyncStatusFile(head) {
             latestInstalledAt: head.skills?.latestInstalledAt ?? null,
         },
         portfolio: head.portfolio,
+        agentBus: describeRealtimeAgentBus(head),
         repoMirror: head.repoMirror,
         github: head.github,
         secretVault: describeRealtimeSecretVault(head),
@@ -195,6 +270,7 @@ function buildRealtimeSyncStatusFile(head) {
 function writeRealtimeSyncStatusFile(head) {
     fs.mkdirSync(path.dirname(exports.REALTIME_SYNC_STATUS_PATH), { recursive: true, mode: 0o700 });
     fs.writeFileSync(exports.REALTIME_SYNC_STATUS_PATH, JSON.stringify(buildRealtimeSyncStatusFile(head), null, 2), { mode: 0o600 });
+    writeRealtimeAgentInboxFile(head);
 }
 function readRealtimeSyncStatusFile() {
     try {
@@ -209,6 +285,15 @@ function readRealtimeSyncStatusFile() {
         return null;
     }
 }
+function writeRealtimeAgentInboxFile(head) {
+    const agentBus = describeRealtimeAgentBus(head);
+    fs.mkdirSync(path.dirname(exports.REALTIME_AGENT_INBOX_PATH), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(exports.REALTIME_AGENT_INBOX_PATH, JSON.stringify({
+        schemaVersion: "you-md/realtime-agent-bus-inbox/v1",
+        generatedAt: Date.now(),
+        ...agentBus,
+    }, null, 2), { mode: 0o600 });
+}
 function shouldRunBoundedSync(lastRunAt, now, minIntervalMs) {
     return lastRunAt === 0 || now - lastRunAt >= minIntervalMs;
 }