youmd 0.8.6 → 0.8.7

package/dist/lib/machine-bootstrap-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-bootstrap-prompt.d.ts","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAC/D,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAwCD,wBAAgB,gCAAgC,IAAI,MAAM,CAkVzD;AAED,wBAAgB,iCAAiC,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CAapG;AAED,wBAAgB,gCAAgC,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CAyDnG"}
+{"version":3,"file":"machine-bootstrap-prompt.d.ts","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAC/D,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,iCAAiC,KAAK,CAAC;AACpD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAwCD,wBAAgB,gCAAgC,IAAI,MAAM,CAgWzD;AAED,wBAAgB,iCAAiC,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CAapG;AAED,wBAAgB,gCAAgC,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CAyDnG"}

package/dist/lib/machine-bootstrap-prompt.js

@@ -89,7 +89,7 @@ DAYS="\${YOUMD_ACTIVE_DAYS:-30}"
 EXPAND_DAYS="\${YOUMD_EXPAND_ACTIVE_DAYS:-90}"
 LIMIT="\${YOUMD_PROJECT_LIMIT:-80}"
 HYDRATE_TIMEOUT="\${YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS:-180}"
-MIN_YOUMD_VERSION="\${YOUMD_MIN_VERSION:-0.8.6}"
+MIN_YOUMD_VERSION="\${YOUMD_MIN_VERSION:-0.8.7}"
 mkdir -p "$ROOT"
 
 command_exists() { command -v "$1" >/dev/null 2>&1; }
@@ -292,6 +292,7 @@ youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname
 echo "[you.md] checking encrypted env-vault tooling without printing secrets"
 youmd env backup --root "$ROOT" --preflight || true
 SECRET_VAULT_RESTORED=0
+ALLOW_LOCAL_ENV_VAULT_FALLBACK="\${YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK:-0}"
 if [ -z "\${YOUMD_ENV_VAULT:-}" ] && [ "\${YOUMD_SECRET_VAULT_PULL:-1}" = "1" ]; then
   SECRET_VAULT_DIR="\${YOUMD_SECRET_VAULT_DIR:-$HOME/.youmd/secret-vault}"
   echo "[you.md] registering this Mac as a trusted Secret Vault device"
@@ -302,25 +303,34 @@ if [ -z "\${YOUMD_ENV_VAULT:-}" ] && [ "\${YOUMD_SECRET_VAULT_PULL:-1}" = "1" ];
     echo "[you.md] restored env vault through trusted-device Secret Vault"
     youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) restored encrypted env vault through trusted-device Secret Vault" || true
   else
-    echo "[you.md] account-backed Secret Vault restore not available yet; falling back to local/iCloud vault discovery"
-    echo "[you.md] if this Mac was just registered, run this on the source Mac: youmd env vault share"
+    echo "[you.md] account-backed Secret Vault restore is waiting for a trusted-device share"
+    echo "[you.md] source Mac action: youmd env vault share"
+    echo "[you.md] new Mac retry: youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) registered Secret Vault device and is waiting for source Mac trusted-device share" || true
   fi
 fi
 if [ "$SECRET_VAULT_RESTORED" != "1" ] && [ -z "\${YOUMD_ENV_VAULT:-}" ]; then
-  for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
-    if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
-      DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
-      if [ -n "$DETECTED_ENV_VAULT" ]; then
-        export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
-        echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
-        break
+  if [ "$ALLOW_LOCAL_ENV_VAULT_FALLBACK" = "1" ]; then
+    echo "[you.md] opt-in local/iCloud passphrase vault fallback enabled"
+    for DEFAULT_ENV_VAULT_DIR in "$HOME/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault" "$HOME/Library/Mobile Documents/com~apple~CloudDocs/youmd-env-vault"; do
+      if [ -d "$DEFAULT_ENV_VAULT_DIR" ]; then
+        DETECTED_ENV_VAULT="$(find "$DEFAULT_ENV_VAULT_DIR" -maxdepth 1 -type f \\( -name "env-vault-*.tar.enc" -o -name "env-vault-*.tar.age" -o -name "env-vault-*.tar.gpg" \\) -print 2>/dev/null | sort | tail -n 1 || true)"
+        if [ -n "$DETECTED_ENV_VAULT" ]; then
+          export YOUMD_ENV_VAULT="$DETECTED_ENV_VAULT"
+          echo "[you.md] using detected env vault: $YOUMD_ENV_VAULT"
+          break
+        fi
       fi
-    fi
-  done
+    done
+  else
+    echo "[you.md] local/iCloud passphrase vault fallback disabled by default"
+    echo "[you.md] set YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 or YOUMD_ENV_VAULT=/path/to/env-vault only if you intentionally want the older passphrase flow"
+  fi
 fi
 if [ "$SECRET_VAULT_RESTORED" = "1" ]; then
   :
 elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
+  echo "[you.md] using explicit/opt-in local encrypted vault fallback"
   if [ ! -f "$YOUMD_ENV_VAULT" ]; then
     echo "[you.md] env vault path does not exist: $YOUMD_ENV_VAULT" >&2
     exit 1
@@ -332,7 +342,7 @@ elif [ -n "\${YOUMD_ENV_VAULT:-}" ]; then
       unset ENV_VAULT_PASS_FROM_KEYCHAIN
       echo "[you.md] loaded env-vault passphrase from macOS Keychain service: $KEYCHAIN_SERVICE"
     else
-      echo "[you.md] no env-vault Keychain item found; restore will prompt for the passphrase"
+      echo "[you.md] no env-vault Keychain item found; explicit local fallback may prompt for the passphrase"
     fi
   fi
   echo "[you.md] listing encrypted .env.local vault before restore"
@@ -346,16 +356,20 @@ else
   echo "youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
   echo "[you.md] Then share local decrypt access to registered trusted Macs:"
   echo "youmd env vault share"
-  echo "[you.md] Or create a transferable local copy without account sync:"
+  echo "[you.md] Then retry on this Mac:"
+  echo "youmd env vault pull --restore --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
+  echo "[you.md] This strict fresh-machine flow intentionally does not ask for a local vault passphrase on the new Mac by default."
+  echo "[you.md] Optional fallback: create a transferable local copy without account sync:"
   echo "youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault"
-  echo "[you.md] The setup command also auto-detects vaults in local Desktop and iCloud Desktop: ~/Library/Mobile Documents/com~apple~CloudDocs/Desktop/youmd-env-vault"
+  echo "[you.md] Local/iCloud auto-detect is opt-in only. Rerun with:"
+  echo "YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1 YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Move the generated env-vault-*.tar.enc file to this Mac, then rerun this command with:"
   echo "YOUMD_ENV_VAULT=/path/to/env-vault-YYYYMMDDTHHMMZ.tar.enc YOUMD_REQUIRE_ENV_VAULT=1 <same command>"
   echo "[you.md] Or restore manually after clone:"
   echo "youmd env restore <vault> --root \\"$ROOT\\" --map-existing --existing-only --skip-agent-auth"
   if [ "\${YOUMD_REQUIRE_ENV_VAULT:-}" = "1" ]; then
-    echo "[you.md] strict proof requires Secret Vault restore or YOUMD_ENV_VAULT; stopping before readiness is marked complete" >&2
-    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: strict env vault restore still required; source Mac may need youmd env vault share" || true
+    echo "[you.md] strict proof is waiting for trusted-device Secret Vault share or an explicitly provided local vault; stopping before readiness is marked complete" >&2
+    youmd agent send --channel machine-sync --kind status "fresh machine \$(hostname) stopped: waiting for trusted-device Secret Vault share or explicit local vault fallback" || true
     exit 1
   fi
 fi
@@ -451,7 +465,7 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "",
         authLine,
         "",
-        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd env vault list`, `youmd env vault device-register`, `youmd env vault pull --restore`, `youmd machine prompt`, `youmd machine verify`, `youmd project portfolio-hydrate`, and `youmd agent status` as needed. Use `youmd agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac vault sharing/passphrase entry if the trusted-device envelope has not been created yet, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
+        "Behind-the-scenes operating rule: use the You.md CLI and You Agent yourself before asking Houston to do anything. Run deterministic commands like `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`, `youmd skill install all`, `youmd skill sync`, `youmd env vault list`, `youmd env vault device-register`, `youmd env vault pull --restore`, `youmd machine prompt`, `youmd machine verify`, `youmd project portfolio-hydrate`, and `youmd agent status` as needed. Use `youmd agent send --channel machine-sync --kind status \"...\"` to report setup milestones back to Houston's other trusted Macs over the realtime agent bus. Use `you` / `youmd chat` only when you need the You Agent to synthesize or route context, then turn its output into concrete shell actions. Interrupt Houston only for true human-gated steps: GitHub browser auth, source-Mac Secret Vault share if the trusted-device envelope has not been created yet, local vault passphrase/Keychain only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or an explicit choice such as the 90-day expansion.",
         "",
         "Exact setup command:",
         "",
@@ -472,12 +486,12 @@ function buildFreshMachineBootstrapPrompt(options = {}) {
         "- hydrate the portfolio graph from You.md + authenticated GitHub before cloning",
         `- preview the graph-backed plan, create ${root}, and clone only projects marked ACTIVE plus Top Priority/Focusing from the last ${days} days first`,
         `- ask whether to expand to all ACTIVE plus Top Priority/Focusing projects from the last ${expandDays} days before calling the full project clone set complete`,
-        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, otherwise auto-detect the newest local Desktop or iCloud Desktop `youmd-env-vault/env-vault-*` file if `YOUMD_ENV_VAULT` is not set, then rehydrate local project/env evidence",
+        "- check env-vault tooling, register this Mac as a trusted Secret Vault device, pull the latest account-backed You.md Secret Vault encrypted snapshot when available, unwrap the vault passphrase locally through a trusted-device key envelope, restore env files into existing cloned project dirs with `--map-existing --existing-only --skip-agent-auth`, or stop with the exact source-Mac `youmd env vault share` action instead of asking for a passphrase on the new Mac. Local/iCloud passphrase fallback runs only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or `YOUMD_ENV_VAULT` is explicitly provided. After env handling, rehydrate local project/env evidence.",
         "- write and sync a secret-safe machine proof report, with optional bounded install/check/server proof flags",
         "- bound portfolio hydration with `YOUMD_PORTFOLIO_HYDRATE_TIMEOUT_SECONDS` so large restored roots do not wedge setup",
         "",
         `Project source: You.md portfolio graph + authenticated GitHub recent repos, capped at ${limit} tracked projects before local audit evidence is merged. When the graph exists, new-computer setup clones only projects with status ACTIVE and focus Top Priority/Focusing; inactive, unsorted, on-ice, abandoned, killed, and unreviewed GitHub-only repos are skipped unless --include-inactive is explicitly used. First pass is ${days} days with out-of-window projects skipped; the ${expandDays}-day pass is explicit.`,
-        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `youmd env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. Local fallback: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to `~/Desktop/youmd-env-vault/` or the iCloud Desktop `youmd-env-vault/` on the new machine, then run this command. The command checks Secret Vault first, then auto-detects the newest local vault; you can also override with `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
+        "Secret rule: .env.local values are never embedded here. Best path: on the old/source Mac, run `youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault` once, then after the new Mac registers itself run `youmd env vault share` on the source Mac. That uploads only encrypted archive bytes plus safe manifest metadata, and stores only per-device encrypted passphrase envelopes. A trusted new Mac pulls the encrypted snapshot after login and decrypts locally with its private device key; raw env values never hit the browser, chat, or You.md servers. If the envelope is missing, the command stops and sends a machine-sync status telling the source Mac to run `youmd env vault share`. Local fallback is opt-in only: run `youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault`, move the generated `env-vault-*.tar.enc` file to the new machine, then rerun with `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1` or explicit `YOUMD_ENV_VAULT=/path/to/env-vault-*.tar.enc`. The restore path lists variable names/counts and target paths only, never values, maps old folder names onto cloned dirs, and skips agent auth config so it does not clobber the new machine's active Claude/Codex login.",
         "",
         "After the command finishes, report:",
         "- the `youmd status` sync state",

package/dist/lib/machine-bootstrap-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,4EAkVC;AAED,8EAaC;AAED,4EAyDC;AAndD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACtD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC5G,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgVN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC9E,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAClF,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACnE,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9F,aAAa,CAAC,yBAAyB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,qJAAqJ,CAAC;IACzK,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,4PAA4P;QAC5P,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,u/BAAu/B;QACv/B,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,iOAAiO;QACjO,kKAAkK;QAClK,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,6gBAA6gB;QAC7gB,6GAA6G;QAC7G,uHAAuH;QACvH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,urCAAurC;QACvrC,EAAE;QACF,qCAAqC;QACrC,iCAAiC;QACjC,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,gNAAgN;KACjN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"machine-bootstrap-prompt.js","sourceRoot":"","sources":["../../src/lib/machine-bootstrap-prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,4EAgWC;AAED,8EAaC;AAED,4EAyDC;AAjeD,uCAAyB;AAEZ,QAAA,0BAA0B,GAAG,oBAAoB,CAAC;AAClD,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AACvC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAY9C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,KAAkC,EAClC,UAAoC,EAAE;IAEtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,WAAW,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QAClD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC7F,CAAC;QACD,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACtD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC5G,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,UAAU,CAAC;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gCAAgC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8VN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,WAAW,GAAG;QAClB,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;QAC9E,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;QAClF,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;QACnE,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9F,aAAa,CAAC,yBAAyB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,qJAAqJ,CAAC;IACzK,OAAO,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,gCAAgC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAwC,EAAE;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,kCAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kCAA0B,CAAC;IACxD,MAAM,UAAU,GAAG,yCAAiC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAA2B,CAAC;IAC3D,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sFAAsF,CAAC;IAE3F,OAAO;QACL,2DAA2D;QAC3D,EAAE;QACF,4PAA4P;QAC5P,EAAE;QACF,yIAAyI;QACzI,EAAE;QACF,QAAQ;QACR,EAAE;QACF,2mCAA2mC;QAC3mC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,kBAAkB;QAClB,+GAA+G;QAC/G,0GAA0G;QAC1G,mDAAmD;QACnD,qHAAqH;QACrH,qLAAqL;QACrL,mDAAmD;QACnD,wFAAwF;QACxF,iOAAiO;QACjO,kKAAkK;QAClK,iFAAiF;QACjF,2CAA2C,IAAI,oFAAoF,IAAI,aAAa;QACpJ,2FAA2F,UAAU,0DAA0D;QAC/J,kpBAAkpB;QAClpB,6GAA6G;QAC7G,uHAAuH;QACvH,EAAE;QACF,yFAAyF,KAAK,uUAAuU,IAAI,kDAAkD,UAAU,wBAAwB;QAC7f,osCAAosC;QACpsC,EAAE;QACF,qCAAqC;QACrC,iCAAiC;QACjC,WAAW,IAAI,kBAAkB;QACjC,4CAA4C;QAC5C,iDAAiD;QACjD,mCAAmC;QACnC,uFAAuF;QACvF,EAAE;QACF,gNAAgN;KACjN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youmd",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Identity context protocol for the agent internet — an MCP where the context is you. CLI for the You.md platform.",
   "bin": {
     "you": "dist/you.js",

package/skills/machine-bootstrap.md

@@ -156,9 +156,10 @@ You.md is the brain. The new machine should become a runnable local agent workst
 - Do not stop to ask "what next?" after each setup phase. Continue through the
   command, verify the result, and report concise proof.
 - Interrupt Houston only for true human-gated steps: GitHub browser auth,
-  source-Mac Secret Vault share/passphrase entry if no trusted-device envelope
-  exists yet, npm OTP, OS permissions, or the explicit 90-day project expansion
-  choice.
+  source-Mac Secret Vault share if no trusted-device envelope exists yet, local
+  vault passphrase/Keychain only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1`
+  or `YOUMD_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or the
+  explicit 90-day project expansion choice.
 - If the installed CLI is stale, run the curl installer/update path first, then
   retry the You.md command. Tell Houston when npm publish is needed for
   `npx youmd@latest` or npm fallback installs.