zooid 0.12.0 → 0.14.0

package/dist/bin.js

@@ -5,28 +5,31 @@ import {
   MediaClient,
   SpawnRegistry,
   buildAcpRegistry,
+  contextEligibleAgents,
   createMatrixTransport,
   ensureDefaultChannel,
   ensureWorkforceSpace,
+  evaluateMatch,
   findConfigFile,
   findHttpTransport,
   findMatrixTransport,
   loadZooidConfig,
   mergeCliFlags,
   renderRegistration,
-  startDaemonSocketServer,
+  renderTemplate,
+  startAgentSocketServers,
   startWorkforcePublisher
-} from "./chunk-3Q4BPAZD.js";
+} from "./chunk-R5S26T7B.js";
 
 // src/bin.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve8 } from "path";
 import { cac } from "cac";
 
 // src/commands/dev.ts
 import chalk from "chalk";
 import { Listr } from "listr2";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname6, join as join12, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname7, join as join15, resolve as resolve4 } from "path";
 import { fileURLToPath } from "url";
 import { serve as serve2 } from "@hono/node-server";
 
@@ -83,6 +86,20 @@ function renderTuwunelToml(opts) {
     "allow_local_presence = true",
     'address = ["0.0.0.0"]',
     `port = [${TUWUNEL_INTERNAL_PORT}]`,
+    // NOT `suppress_push_when_active` ([[ZNC025]]). It reads Matrix presence,
+    // which is both too coarse and too slow for this: coarse because it is
+    // per-user, so reading room A kills the push for room B; slow because
+    // `currently_active` lingers for minutes after the last sync, so closing
+    // the tab and waiting for an agent to finish still delivers nothing —
+    // exactly the case this feature exists for. `public/sw.js` already does
+    // the suppression we actually want, precisely: it drops a push only when
+    // a *visible* window is on *that* room.
+    // DEV ONLY — disables an SSRF guard. Tuwunel is in Podman and the push
+    // gateway runs on the host, so the default ip_range_denylist (127/8,
+    // 10/8, 172.16/12, 192.168/16, ::1) silently drops every pusher delivery.
+    // Never set on a box: there the gateway is reached at the public
+    // hostname through Caddy.
+    "ip_range_denylist = []",
     ""
   ].join("\n");
 }
@@ -201,10 +218,10 @@ MATRIX_HS_TOKEN=${tokens.hsToken}
 }
 
 // src/daemon/start-daemon.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { mkdir, unlink } from "fs/promises";
+import { readFileSync as readFileSync6 } from "fs";
+import { mkdir } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname2, isAbsolute, join as join5, resolve } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "path";
 import { serve } from "@hono/node-server";
 
 // ../transport-http/src/server.ts
@@ -417,6 +434,37 @@ function createApp({
   return app;
 }
 
+// src/pi-extension-install.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join4, resolve } from "path";
+function resolvePiAgentDir(opts) {
+  const override = opts.env?.PI_CODING_AGENT_DIR;
+  if (override) {
+    return {
+      dir: isAbsolute(override) ? override : resolve(opts.agentWorkdir, override),
+      scope: "project"
+    };
+  }
+  return { dir: join4(opts.daemonHome, ".pi", "agent"), scope: "home" };
+}
+function installPiExtension(opts) {
+  if (!opts.createMissing && !existsSync2(opts.agentDir)) {
+    return { status: "skipped", reason: "no Pi home" };
+  }
+  const target = join4(opts.agentDir, "extensions", "zooid-tasks.js");
+  mkdirSync3(dirname2(target), { recursive: true });
+  const source = readFileSync2(opts.bundlePath);
+  if (existsSync2(target) && readFileSync2(target).equals(source)) return { status: "unchanged", target };
+  writeFileSync3(target, source);
+  return { status: "installed", target };
+}
+
+// ../pi-extension/src/index.ts
+import { createRequire } from "module";
+function resolvePiExtensionBundle() {
+  return createRequire(import.meta.url).resolve("@zooid/pi-extension/bundle");
+}
+
 // src/prepull-images.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -479,22 +527,163 @@ var defaultExec = async (cmd, args) => {
   }
 };
 
+// src/push-gateway/gateway.ts
+import { Hono as Hono2 } from "hono";
+import webpush from "web-push";
+
+// src/push-gateway/payload.ts
+var MAX_BODY = 140;
+var ZOOID_APP_ID = "dev.zooid.web";
+function truncate(s, max) {
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function buildPushPayload(n, device) {
+  const body = typeof n.content?.body === "string" ? truncate(n.content.body, MAX_BODY) : void 0;
+  const preview = typeof n.content?.last_message === "string" ? truncate(n.content.last_message, MAX_BODY) : void 0;
+  return {
+    event_id: n.event_id,
+    room_id: n.room_id,
+    room_name: n.room_name ?? n.room_id,
+    ...n.sender_display_name !== void 0 ? { sender_display_name: n.sender_display_name } : {},
+    type: n.type,
+    ...body !== void 0 ? { body } : {},
+    ...preview !== void 0 ? { preview } : {},
+    unread: n.counts?.unread ?? 0,
+    // Whether this makes a noise is a push-rule property the server evaluated,
+    // not a second decision made here (spec §12).
+    sound: device?.tweaks?.sound !== void 0
+  };
+}
+
+// src/push-gateway/gateway.ts
+function parseNotifyBody(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const notification = raw.notification;
+  if (!notification || typeof notification !== "object") return null;
+  const n = notification;
+  if (typeof n.event_id !== "string" || typeof n.room_id !== "string" || typeof n.type !== "string")
+    return null;
+  if (!Array.isArray(n.devices)) return null;
+  return n;
+}
+function pushGateway(opts) {
+  const app = new Hono2();
+  app.post("/_matrix/push/v1/notify", async (c) => {
+    const parsed = parseNotifyBody(await c.req.json().catch(() => null));
+    if (!parsed) {
+      console.warn("[push] notify: malformed body");
+      return c.json({ error: "malformed notification" }, 400);
+    }
+    console.log(
+      `[push] notify room=${parsed.room_id} type=${parsed.type} devices=${parsed.devices.length}`
+    );
+    let delivered = 0;
+    const rejected = [];
+    await Promise.all(
+      parsed.devices.map(async (device) => {
+        if (device.app_id !== ZOOID_APP_ID) return;
+        const endpoint = device.data?.endpoint;
+        const auth = device.data?.auth;
+        if (typeof endpoint !== "string" || typeof auth !== "string") return;
+        try {
+          await webpush.sendNotification(
+            { endpoint, keys: { p256dh: device.pushkey, auth } },
+            JSON.stringify(buildPushPayload(parsed, device)),
+            {
+              vapidDetails: { subject: opts.subject, ...opts.keys },
+              TTL: 60 * 60 * 12,
+              urgency: device.tweaks?.sound !== void 0 ? "high" : "normal"
+            }
+          );
+          delivered++;
+        } catch (err) {
+          const status = err.statusCode;
+          if (status === 404 || status === 410) rejected.push(device.pushkey);
+          else console.warn(`[push] delivery to ${device.pushkey} failed (${status ?? "?"}):`, err);
+        }
+      })
+    );
+    console.log(`[push] notify done: delivered=${delivered} rejected=${rejected.length}`);
+    return c.json({ rejected });
+  });
+  return app;
+}
+
+// src/push-gateway/vapid.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
+import webpush2 from "web-push";
+var VAPID_FILENAME = "vapid.json";
+function loadOrCreateVapidKeys(dataDir) {
+  const path = join5(dataDir, VAPID_FILENAME);
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    if (typeof parsed.publicKey === "string" && typeof parsed.privateKey === "string")
+      return { publicKey: parsed.publicKey, privateKey: parsed.privateKey };
+    console.warn(`[push] ${path} is malformed; generating a new VAPID keypair.`);
+  } catch {
+  }
+  const keys = webpush2.generateVAPIDKeys();
+  mkdirSync4(dataDir, { recursive: true });
+  writeFileSync4(path, JSON.stringify(keys, null, 2), { mode: 384 });
+  return keys;
+}
+
+// src/push-gateway/index.ts
+function mountPushGateway(app, opts) {
+  const keys = loadOrCreateVapidKeys(opts.dataDir);
+  app.route("/", pushGateway({ keys, subject: opts.subject }));
+  return { publicKey: keys.publicKey };
+}
+
 // src/daemon/sync-cursors.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 function makeSyncCursorStore(agentsDir) {
-  const fileFor = (agentName) => join4(agentsDir, agentName, "sync-since");
+  const fileFor = (agentName) => join6(agentsDir, agentName, "sync-since");
   return {
     loadSince(agentName) {
       try {
-        return readFileSync2(fileFor(agentName), "utf8").trim() || null;
+        return readFileSync4(fileFor(agentName), "utf8").trim() || null;
       } catch {
         return null;
       }
     },
     saveSince(agentName, since) {
-      mkdirSync3(join4(agentsDir, agentName), { recursive: true });
-      writeFileSync3(fileFor(agentName), since, "utf8");
+      mkdirSync5(join6(agentsDir, agentName), { recursive: true });
+      writeFileSync5(fileFor(agentName), since, "utf8");
+    }
+  };
+}
+
+// src/daemon/task-journal.ts
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, renameSync, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
+function makeTaskJournal(dataDir) {
+  const path = join7(dataDir, "tasks.json");
+  return {
+    load() {
+      try {
+        const value = JSON.parse(readFileSync5(path, "utf8"));
+        return value.version === 1 && Array.isArray(value.tasks) ? value.tasks : [];
+      } catch (error) {
+        if (error.code !== "ENOENT") console.warn("[tasks] journal unavailable; starting empty:", error);
+        return [];
+      }
+    },
+    save(tasks) {
+      mkdirSync6(dataDir, { recursive: true });
+      const temp = `${path}.tmp-${process.pid}`;
+      try {
+        writeFileSync6(temp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
+        renameSync(temp, path);
+      } catch (error) {
+        console.warn("[tasks] journal write failed:", error);
+        try {
+          unlinkSync(temp);
+        } catch {
+        }
+      }
     }
   };
 }
@@ -504,55 +693,425 @@ function shouldBindHttpListener(mode) {
   return mode !== "client";
 }
 
+// src/daemon/trigger-scheduler.ts
+import { Cron } from "croner";
+
+// src/daemon/trigger-runner.ts
+async function fireTrigger(deps) {
+  const { name, as, message, agentUserId, resolveRoom, ensureBot, sendMessage } = deps;
+  try {
+    const roomId = await resolveRoom(message.room);
+    if (!roomId) {
+      console.warn(`[trigger:${name}] cannot resolve room ${message.room} \u2014 skipping`);
+      return;
+    }
+    await ensureBot(as, roomId);
+    await sendMessage({
+      roomId,
+      asUserId: as,
+      content: {
+        msgtype: "m.text",
+        body: message.text,
+        // Structural mention: routes deterministically AND disarms the raw-body
+        // fallback in extractMentions, which only fires when nothing matched.
+        "m.mentions": { user_ids: [agentUserId] }
+      }
+    });
+  } catch (err) {
+    console.warn(`[trigger:${name}] failed:`, err.message);
+  }
+}
+
+// src/daemon/trigger-scheduler.ts
+function validateCron(name, expr) {
+  try {
+    new Cron(expr, { paused: true }).stop();
+  } catch (err) {
+    throw new Error(`triggers.${name}.schedule: ${err.message}`);
+  }
+}
+function startTriggerScheduler(deps) {
+  const { triggers, agentUserIds, resolveRoom, ensureBot, sendMessage } = deps;
+  const jobs = [];
+  for (const [name, trigger] of Object.entries(triggers)) {
+    if (!trigger.schedule) continue;
+    const job = new Cron(trigger.schedule, () => {
+      for (const message of trigger.messages) {
+        const agentUserId = agentUserIds[message.mention];
+        if (!agentUserId) {
+          console.warn(`[trigger:${name}] unknown agent "${message.mention}" \u2014 skipping`);
+          continue;
+        }
+        void fireTrigger({ name, as: trigger.as, message, agentUserId, resolveRoom, ensureBot, sendMessage });
+      }
+    });
+    jobs.push(job);
+  }
+  return {
+    async stop() {
+      for (const job of jobs) job.stop();
+    }
+  };
+}
+
+// src/daemon/webhook-verify.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FRESHNESS_S = 300;
+function safeEqual(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  return ab.length === bb.length && timingSafeEqual2(ab, bb);
+}
+function hmacHex(secret, baseString) {
+  return createHmac("sha256", secret).update(baseString).digest("hex");
+}
+function verifyGithub(input) {
+  const header = input.headers["x-hub-signature-256"];
+  if (!header) return { ok: false };
+  const [scheme, sig] = header.split("=");
+  if (scheme !== "sha256" || !sig) return { ok: false };
+  const expected = hmacHex(input.secret, input.rawBody);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifyStripe(input) {
+  const header = input.headers["stripe-signature"];
+  if (!header) return { ok: false };
+  const parts = Object.fromEntries(
+    header.split(",").map((p) => p.split("=", 2)).filter(([, v]) => v !== void 0)
+  );
+  const ts = parts.t;
+  const sig = parts.v1;
+  if (!ts || !sig) return { ok: false };
+  if (!isFresh(ts)) return { ok: false };
+  const expected = hmacHex(input.secret, `${ts}.${input.rawBody}`);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifySlack(input) {
+  const header = input.headers["x-slack-signature"];
+  const ts = input.headers["x-slack-request-timestamp"];
+  if (!header || !ts) return { ok: false };
+  if (!header.startsWith("v0=")) return { ok: false };
+  const sig = header.slice("v0=".length);
+  if (!isFresh(ts)) return { ok: false };
+  const expected = hmacHex(input.secret, `v0:${ts}:${input.rawBody}`);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifyStandard(input) {
+  const header = input.headers["webhook-signature"];
+  const id = input.headers["webhook-id"];
+  const ts = input.headers["webhook-timestamp"];
+  if (!header || !id || !ts) return { ok: false };
+  if (!isFresh(ts)) return { ok: false };
+  const candidate = header.split(" ").map((p) => p.startsWith("v1,") ? p.slice("v1,".length) : void 0).find((v) => v !== void 0);
+  if (!candidate) return { ok: false };
+  const expected = createHmac("sha256", input.secret).update(`${id}.${ts}.${input.rawBody}`).digest("base64");
+  return safeEqual(candidate, expected) ? { ok: true } : { ok: false };
+}
+function isFresh(tsRaw) {
+  const ts = Number(tsRaw);
+  if (!Number.isFinite(ts)) return false;
+  const nowS = Date.now() / 1e3;
+  return Math.abs(nowS - ts) <= FRESHNESS_S;
+}
+var VERIFIERS = {
+  github: verifyGithub,
+  stripe: verifyStripe,
+  slack: verifySlack,
+  standard: verifyStandard
+};
+function verifySignature(provider, input) {
+  try {
+    return VERIFIERS[provider](input);
+  } catch {
+    return { ok: false };
+  }
+}
+async function verifyCustomSignature(verifier, input) {
+  if (typeof verifier !== "function") return { ok: false };
+  try {
+    const result = await verifier(input);
+    if (result === true) return { ok: true };
+    if (result === false || result === null || typeof result !== "object") return { ok: false };
+    if (result.ok !== true) return { ok: false };
+    return typeof result.deliveryId === "string" ? { ok: true, deliveryId: result.deliveryId } : { ok: true };
+  } catch {
+    return { ok: false };
+  }
+}
+
+// src/daemon/delivery-cache.ts
+var DeliveryCache = class {
+  ttlMs;
+  expiryById = /* @__PURE__ */ new Map();
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  get size() {
+    return this.expiryById.size;
+  }
+  /** Returns true if `id` was already seen (and still within its TTL). */
+  seen(id) {
+    this.evictExpired();
+    const now = Date.now();
+    const expiry = this.expiryById.get(id);
+    if (expiry !== void 0 && expiry > now) return true;
+    this.expiryById.set(id, now + this.ttlMs);
+    return false;
+  }
+  evictExpired() {
+    const now = Date.now();
+    for (const [id, expiry] of this.expiryById) {
+      if (expiry <= now) this.expiryById.delete(id);
+    }
+  }
+};
+
+// src/daemon/webhook-routes.ts
+var MAX_BODY2 = 1e6;
+var MAX_OUTPUT_CHARS = 6e4;
+var TRUNCATION_MARKER = "\n\n\u2026 (truncated)";
+var DELIVERY_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var EVENT_HEADER_BY_PROVIDER = {
+  github: "x-github-event"
+};
+var DELIVERY_ID_HEADER_BY_PROVIDER = {
+  github: "x-github-delivery",
+  standard: "webhook-id"
+};
+var RELEVANT_HEADERS = [
+  "x-hub-signature-256",
+  "x-github-event",
+  "x-github-delivery",
+  "stripe-signature",
+  "x-slack-signature",
+  "x-slack-request-timestamp",
+  "webhook-signature",
+  "webhook-id",
+  "webhook-timestamp"
+];
+function headersOf(c, all) {
+  const out = {};
+  if (all) {
+    c.req.raw.headers.forEach((value, key) => {
+      out[key.toLowerCase()] = value;
+    });
+    return out;
+  }
+  for (const h of RELEVANT_HEADERS) out[h] = c.req.header(h);
+  return out;
+}
+function definedHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function renderPayload(raw) {
+  let pretty;
+  try {
+    pretty = JSON.stringify(JSON.parse(raw), null, 2);
+  } catch {
+    pretty = raw;
+  }
+  if (pretty.length <= MAX_OUTPUT_CHARS) return pretty;
+  return pretty.slice(0, MAX_OUTPUT_CHARS) + TRUNCATION_MARKER;
+}
+async function handleDelivery(deps, name, trigger, raw, headers, cache, customDeliveryId) {
+  try {
+    const webhook = trigger.webhook;
+    if (!webhook) return;
+    const idHeader = DELIVERY_ID_HEADER_BY_PROVIDER[webhook.provider];
+    const deliveryId = customDeliveryId ?? (idHeader ? headers[idHeader] : void 0);
+    if (deliveryId !== void 0 && cache.seen(`${name}:${deliveryId}`)) return;
+    const eventHeader = EVENT_HEADER_BY_PROVIDER[webhook.provider];
+    const event = eventHeader ? headers[eventHeader] : void 0;
+    let body;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      body = void 0;
+    }
+    const ctx = {
+      event,
+      body,
+      headers: definedHeaders(headers),
+      output: renderPayload(raw)
+    };
+    for (const message of trigger.messages) {
+      if (message.match !== void 0 && !evaluateMatch(message.match, ctx)) continue;
+      const agentUserId = deps.agentUserIds[message.mention];
+      if (!agentUserId) {
+        console.warn(`[webhook:${name}] unknown agent "${message.mention}" \u2014 skipping`);
+        continue;
+      }
+      await fireTrigger({
+        name,
+        as: trigger.as,
+        message: { ...message, text: renderTemplate(message.text, ctx) },
+        agentUserId,
+        resolveRoom: deps.resolveRoom,
+        ensureBot: deps.ensureBot,
+        sendMessage: deps.sendMessage
+      });
+    }
+  } catch (err) {
+    console.warn(`[webhook:${name}] failed:`, err.message);
+  }
+}
+var WEBHOOK_ROUTE_PREFIX = "/_zooid/webhooks";
+function mountWebhookRoutes(app, deps) {
+  const cache = new DeliveryCache(DELIVERY_CACHE_TTL_MS);
+  const receive = async (c) => {
+    const name = c.req.param("name");
+    const trigger = deps.triggers[name];
+    const raw = await c.req.text();
+    if (raw.length > MAX_BODY2) return c.text("too large", 413);
+    if (!trigger?.webhook) return c.text("unauthorized", 401);
+    const webhook = trigger.webhook;
+    const headers = headersOf(c, webhook.provider === "custom");
+    let customDeliveryId;
+    if (webhook.provider === "custom") {
+      const v = await verifyCustomSignature(deps.customVerifiers?.[name], {
+        rawBody: raw,
+        headers: definedHeaders(headers),
+        secret: webhook.secret
+      });
+      if (!v.ok) return c.text("unauthorized", 401);
+      customDeliveryId = v.deliveryId;
+    } else {
+      const v = verifySignature(webhook.provider, {
+        rawBody: raw,
+        headers,
+        secret: webhook.secret
+      });
+      if (!v.ok) return c.text("unauthorized", 401);
+    }
+    void handleDelivery(deps, name, trigger, raw, headers, cache, customDeliveryId);
+    return c.text("accepted", 202);
+  };
+  app.post(`${WEBHOOK_ROUTE_PREFIX}/:name`, receive);
+}
+
+// src/daemon/load-custom-verifiers.ts
+import { pathToFileURL } from "url";
+async function loadCustomVerifiers(triggers) {
+  const out = {};
+  for (const [name, trigger] of Object.entries(triggers)) {
+    const path = trigger.webhook?.provider === "custom" ? trigger.webhook.verify : void 0;
+    if (!path) continue;
+    let mod;
+    try {
+      mod = await import(pathToFileURL(path).href);
+    } catch (err) {
+      throw new Error(
+        `triggers.${name}.webhook.verify: cannot load ${path} \u2014 ${err.message}`
+      );
+    }
+    const fn = mod.default ?? mod.verify;
+    if (typeof fn !== "function") {
+      throw new Error(
+        `triggers.${name}.webhook.verify: ${path} must export a function as \`default\` (or as \`verify\`), got ${typeof fn}`
+      );
+    }
+    out[name] = fn;
+  }
+  return out;
+}
+
+// src/daemon/trigger-rooms.ts
+async function joinTriggerRooms(deps) {
+  const { triggers, resolveRoom, ensureBot } = deps;
+  const seen = /* @__PURE__ */ new Set();
+  for (const trigger of Object.values(triggers)) {
+    for (const message of trigger.messages) {
+      const key = `${trigger.as}\0${message.room}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const roomId = await resolveRoom(message.room);
+      if (!roomId) {
+        console.warn(`[trigger] cannot resolve room ${message.room} \u2014 skipping join`);
+        continue;
+      }
+      await ensureBot(trigger.as, roomId);
+    }
+  }
+}
+
 // src/daemon/start-daemon.ts
 function listenAsync(server) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     const check = () => {
       const addr = server.address();
-      if (addr && typeof addr === "object") resolve7(addr.port);
+      if (addr && typeof addr === "object") resolve9(addr.port);
       else setImmediate(check);
     };
     check();
   });
 }
 function closeAsync(server) {
-  return new Promise((resolve7) => {
-    server.close(() => resolve7());
+  return new Promise((resolve9) => {
+    server.close(() => resolve9());
   });
 }
+function localpart(userId) {
+  const m = /^@([^:]+):/.exec(userId);
+  if (!m) throw new Error(`bad user id: ${userId}`);
+  return m[1];
+}
 async function startDaemon(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const found = opts.configPath ? { path: opts.configPath } : findConfigFile(cwd);
   if (!found) throw new Error("zooid.yaml is required");
-  const configDir = dirname2(found.path);
-  const base = loadZooidConfig(readFileSync3(found.path, "utf8"), { configDir });
+  const configDir = dirname3(found.path);
+  const base = loadZooidConfig(readFileSync6(found.path, "utf8"), { configDir, validateCron });
   const config = mergeCliFlags(base, opts.cliFlags ?? {});
   const approvals = new ApprovalCorrelator();
-  const daemonSockPath = opts.agentsDir ? join5(opts.agentsDir, "..", "run", "context.sock") : join5(tmpdir(), `zooid-context-${process.pid}.sock`);
-  await mkdir(dirname2(daemonSockPath), { recursive: true }).catch(() => {
+  const runDir = opts.agentsDir ? join8(opts.agentsDir, "..", "run") : join8(tmpdir(), `zooid-context-${process.pid}`);
+  await mkdir(runDir, { recursive: true }).catch(() => {
   });
   const contextSpawnRegistry = new SpawnRegistry();
-  let contextSocket = null;
-  try {
-    contextSocket = await startDaemonSocketServer({
-      sockPath: daemonSockPath,
-      registry: contextSpawnRegistry
-    });
-  } catch (err) {
-    console.warn("[context] daemon socket startup failed; zooid-context MCP disabled:", err);
-  }
-  const dataDir = opts.agentsDir ? dirname2(opts.agentsDir) : void 0;
+  const contextSockets = await startAgentSocketServers({
+    runDir,
+    registry: contextSpawnRegistry,
+    agentNames: contextEligibleAgents(config)
+  });
+  const dataDir = opts.agentsDir ? dirname3(opts.agentsDir) : void 0;
   const registry = buildAcpRegistry(config, {
     approvals,
     onTap: opts.onTap,
     agentsDir: opts.agentsDir,
-    contextSpawnRegistry: contextSocket ? contextSpawnRegistry : void 0,
-    daemonSockPath: contextSocket ? daemonSockPath : void 0,
+    contextSpawnRegistry,
+    daemonSockPaths: contextSockets.paths,
     configDir,
     dataDir,
     daemonHome: process.env.HOME
   });
   const agentNames = Object.keys(config.agents);
+  const piAgents = agentNames.filter(
+    (name) => config.agents[name].acp?.preset === "pi"
+  );
+  if (piAgents.length > 0) {
+    const bundlePath = resolvePiExtensionBundle();
+    const installed = /* @__PURE__ */ new Set();
+    for (const name of piAgents) {
+      const { dir, scope } = resolvePiAgentDir({
+        agentWorkdir: resolve2(configDir, config.agents[name].workdir),
+        daemonHome: process.env.HOME ?? "",
+        env: process.env
+      });
+      if (installed.has(dir)) continue;
+      installed.add(dir);
+      const result = installPiExtension({
+        agentDir: dir,
+        bundlePath,
+        createMissing: scope === "project"
+      });
+      const where = result.target ? ` extension=${result.target}` : "";
+      const why = result.reason ? ` reason=${result.reason}` : "";
+      console.log(`[pi] agent=${name}${where} status=${result.status}${why}`);
+    }
+  }
   if (config.runtime !== "local") {
     await prepullImages(registry, {
       engine: config.runtime === "podman" ? "podman" : "docker",
@@ -562,11 +1121,13 @@ async function startDaemon(opts = {}) {
       log: opts.prepullLog
     });
   }
-  console.log(
-    `[context] socket=${daemonSockPath} status=${contextSocket ? "listening" : "disabled"} agents={${agentNames.map((n) => `${n}:${registry.hasContextSpawn(n) ? "yes" : "no"}`).join(", ")}}`
-  );
+  console.log(`[context] runDir=${runDir}`);
+  for (const name of agentNames) {
+    console.log(`[context] agent=${name} socket=${contextSockets.paths[name] ?? "(disabled)"}`);
+  }
   let server = null;
   let syncLoops;
+  let triggers;
   let stopped = false;
   let resolveStopped;
   const whenStopped = new Promise((r) => {
@@ -574,6 +1135,7 @@ async function startDaemon(opts = {}) {
   });
   const matrix = findMatrixTransport(config);
   let port;
+  let vapidPublicKey;
   if (matrix) {
     const mode = matrix.transport.mode ?? "appservice";
     if (mode === "client" && !opts.agentsDir) {
@@ -600,7 +1162,7 @@ async function startDaemon(opts = {}) {
         trigger: a.matrix.trigger
       };
       if (a.matrix.display_name !== void 0) binding.displayName = a.matrix.display_name;
-      const workspaceDir = isAbsolute(a.workdir) ? a.workdir : resolve(configDir, a.workdir);
+      const workspaceDir = isAbsolute2(a.workdir) ? a.workdir : resolve2(configDir, a.workdir);
       binding.workspaceDir = workspaceDir;
       binding.agentWorkspacePath = isContainerRuntime ? "/workspace" : workspaceDir;
       bindings.push(binding);
@@ -617,6 +1179,7 @@ async function startDaemon(opts = {}) {
       adminUserId: opts.adminUserId,
       botUserId: asUserId,
       media: mediaClient,
+      taskJournal: dataDir ? makeTaskJournal(dataDir) : void 0,
       mode,
       loadSince: (uid) => {
         const name = nameByUserId.get(uid);
@@ -627,16 +1190,55 @@ async function startDaemon(opts = {}) {
         if (name && cursors) cursors.saveSince(name, since);
       }
     });
+    contextSpawnRegistry.setTaskActions(transport.taskActions);
+    let spaceRoomId;
+    const agentUserIds = Object.fromEntries(bindings.map((b) => [b.name, b.userId]));
+    const resolveRoom = async (r) => r.startsWith("!") ? r : await client.resolveAlias(r);
+    const ensureBot = async (mxid, roomId) => {
+      await client.registerBot(localpart(mxid)).catch(() => {
+      });
+      if (spaceRoomId) {
+        await client.invite({ roomId: spaceRoomId, asUserId, targetUserId: mxid }).catch(() => {
+        });
+        await client.joinRoom(spaceRoomId, mxid).catch(() => {
+        });
+      }
+      await client.joinRoom(roomId, mxid);
+    };
     if (shouldBindHttpListener(mode)) {
       const requestedPort = matrix.transport.port ?? 9e3;
-      server = serve({ fetch: transport.app.fetch, port: requestedPort, hostname: "0.0.0.0" });
+      if (dataDir) {
+        vapidPublicKey = mountPushGateway(transport.app, {
+          dataDir,
+          subject: `https://${serverName}`
+        }).publicKey;
+      }
+      const webhookTriggers = Object.entries(config.triggers).filter(([, t]) => t.webhook);
+      if (webhookTriggers.length > 0) {
+        const customVerifiers = await loadCustomVerifiers(config.triggers);
+        mountWebhookRoutes(transport.app, {
+          triggers: config.triggers,
+          customVerifiers,
+          agentUserIds,
+          resolveRoom,
+          ensureBot,
+          sendMessage: (m) => client.sendMessage(m)
+        });
+        for (const [name] of webhookTriggers) {
+          console.log(`[webhook] POST ${WEBHOOK_ROUTE_PREFIX}/${name}`);
+        }
+      }
+      server = serve({
+        fetch: transport.app.fetch,
+        port: requestedPort,
+        hostname: "0.0.0.0"
+      });
       port = await listenAsync(server);
     } else {
       port = 0;
     }
     const spaceLocalpart = matrix.transport.space ?? "dev";
     const adminUserIds = opts.adminUserId ? [opts.adminUserId] : [];
-    let spaceRoomId;
     try {
       spaceRoomId = await ensureWorkforceSpace({
         client,
@@ -647,11 +1249,36 @@ async function startDaemon(opts = {}) {
         admins: adminUserIds,
         joinRule: opts.publicWorkforceSpace ? "public" : "invite"
       });
-      console.log(`[matrix] ensured workforce space #${spaceLocalpart}:${serverName} \u2192 ${spaceRoomId}`);
+      console.log(
+        `[matrix] ensured workforce space #${spaceLocalpart}:${serverName} \u2192 ${spaceRoomId}`
+      );
     } catch (err) {
       console.warn("[matrix] workforce space provisioning failed:", err);
     }
     await transport.bootstrap({ spaceRoomId, asUserId, adminUserIds });
+    if (Object.keys(config.triggers).length > 0) {
+      await joinTriggerRooms({ triggers: config.triggers, resolveRoom, ensureBot });
+      console.log(
+        `[trigger] joined rooms for ${Object.keys(config.triggers).length} trigger(s)`
+      );
+      triggers = startTriggerScheduler({
+        triggers: config.triggers,
+        agentUserIds,
+        resolveRoom,
+        ensureBot,
+        sendMessage: (m) => client.sendMessage(m)
+      });
+      const scheduled = Object.values(config.triggers).filter((t) => t.schedule).length;
+      if (scheduled > 0) console.log(`[trigger] scheduled ${scheduled} trigger(s)`);
+      if (!shouldBindHttpListener(mode)) {
+        const webhooks = Object.values(config.triggers).filter((t) => t.webhook).length;
+        if (webhooks > 0) {
+          console.warn(
+            `[webhook] ${webhooks} webhook trigger(s) configured, but pull mode binds no inbound listener \u2014 these will never fire.`
+          );
+        }
+      }
+    }
     syncLoops = transport.syncLoops;
     if (syncLoops?.length) {
       for (const loop of syncLoops) void loop.run();
@@ -689,12 +1316,20 @@ async function startDaemon(opts = {}) {
     const token = process.env.ZOOID_TOKEN;
     if (!token) throw new Error("ZOOID_TOKEN is required for http transport");
     const app = createApp({ agents: registry, approvals, token });
-    server = serve({ fetch: app.fetch, port: http.transport.port, hostname: "0.0.0.0" });
+    server = serve({
+      fetch: app.fetch,
+      port: http.transport.port,
+      hostname: "0.0.0.0"
+    });
     port = await listenAsync(server);
   }
   const stop = async () => {
     if (stopped) return whenStopped;
     stopped = true;
+    try {
+      await triggers?.stop();
+    } catch {
+    }
     try {
       if (syncLoops) for (const loop of syncLoops) loop.stop();
     } catch {
@@ -709,9 +1344,7 @@ async function startDaemon(opts = {}) {
       console.error("stopAll:", err);
     }
     try {
-      if (contextSocket) await contextSocket.close();
-      await unlink(daemonSockPath).catch(() => {
-      });
+      await contextSockets.close();
     } catch {
     }
     resolveStopped();
@@ -724,7 +1357,7 @@ async function startDaemon(opts = {}) {
     process.on("SIGINT", () => handler("SIGINT"));
     process.on("SIGTERM", () => handler("SIGTERM"));
   }
-  return { port, agentNames, stop, whenStopped };
+  return { port, agentNames, vapidPublicKey, stop, whenStopped };
 }
 
 // src/services/tuwunel.ts
@@ -769,9 +1402,24 @@ var TuwunelService = class {
   }
   async stop() {
     if (this.child && this.child.exitCode === null) {
-      this.child.kill("SIGTERM");
-      await new Promise((resolve7) => {
-        this.child.on("exit", () => resolve7());
+      const child = this.child;
+      child.kill("SIGTERM");
+      await new Promise((resolve9) => {
+        let done = false;
+        const finish = () => {
+          if (done) return;
+          done = true;
+          clearTimeout(timer);
+          resolve9();
+        };
+        const timer = setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+          finish();
+        }, 5e3);
+        child.once("exit", finish);
       });
     }
     this.child = null;
@@ -788,7 +1436,7 @@ var TuwunelService = class {
           `Tuwunel container exited before serving HTTP (exit=${state.exitCode}${state.error ? `, error=${state.error}` : ""}). Check the engine logs (\`${this.opts.engine} logs ${this.opts.name}\`).`
         );
       }
-      await new Promise((resolve7) => setTimeout(resolve7, 500));
+      await new Promise((resolve9) => setTimeout(resolve9, 500));
     }
     while (Date.now() < deadline) {
       try {
@@ -796,7 +1444,7 @@ var TuwunelService = class {
         if (r.ok) return;
       } catch {
       }
-      await new Promise((resolve7) => setTimeout(resolve7, 500));
+      await new Promise((resolve9) => setTimeout(resolve9, 500));
     }
     const finalState = await this.inspectState().catch(() => null);
     const detail = finalState ? ` (container status=${finalState.status}${finalState.exitCode !== void 0 ? `, exit=${finalState.exitCode}` : ""})` : "";
@@ -829,12 +1477,12 @@ var TuwunelService = class {
   }
 };
 function execEngine(engine, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn(engine, args, { stdio: "pipe" });
     let stderr = "";
     child.stderr.on("data", (b) => stderr += String(b));
     child.on("exit", (code) => {
-      if (code === 0) resolve7();
+      if (code === 0) resolve9();
       else reject(new Error(`${engine} ${args.join(" ")} failed: ${stderr.trim()}`));
     });
     child.on("error", reject);
@@ -842,20 +1490,20 @@ function execEngine(engine, args) {
 }
 
 // src/web/resolve.ts
-import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname3, join as join7, resolve as resolve2 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname4, join as join10, resolve as resolve3 } from "path";
 
 // src/web/fetch.ts
-import { mkdirSync as mkdirSync4, renameSync, rmSync, existsSync as existsSync2, readdirSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync7, renameSync as renameSync2, rmSync, existsSync as existsSync3, readdirSync, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
 import { createHash, randomUUID as randomUUID2 } from "crypto";
 import * as tar from "tar";
 var PKG = "@zooid/web";
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 async function fetchWebBundle(opts) {
-  const target = join6(opts.cacheDir, opts.version);
-  if (existsSync2(join6(target, "index.html"))) return target;
-  if (existsSync2(target)) rmSync(target, { recursive: true, force: true });
+  const target = join9(opts.cacheDir, opts.version);
+  if (existsSync3(join9(target, "index.html"))) return target;
+  if (existsSync3(target)) rmSync(target, { recursive: true, force: true });
   const f = opts.fetch ?? globalThis.fetch;
   const registry = (opts.registryUrl ?? DEFAULT_REGISTRY).replace(/\/$/, "");
   let tgz;
@@ -882,11 +1530,11 @@ async function fetchWebBundle(opts) {
   Cause: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const tmp = join6(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
-  mkdirSync4(tmp, { recursive: true });
-  const tgzPath = join6(tmp, ".bundle.tgz");
+  const tmp = join9(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
+  mkdirSync7(tmp, { recursive: true });
+  const tgzPath = join9(tmp, ".bundle.tgz");
   try {
-    writeFileSync4(tgzPath, tgz);
+    writeFileSync7(tgzPath, tgz);
     await tar.extract({
       file: tgzPath,
       cwd: tmp,
@@ -895,17 +1543,17 @@ async function fetchWebBundle(opts) {
       filter: (p) => p === "package/dist" || p.startsWith("package/dist/")
     });
     rmSync(tgzPath);
-    if (!existsSync2(join6(tmp, "index.html"))) {
+    if (!existsSync3(join9(tmp, "index.html"))) {
       throw new Error(`${PKG}@${opts.version} tarball has no dist/index.html`);
     }
-    renameSync(tmp, target);
+    renameSync2(tmp, target);
   } catch (err) {
     rmSync(tmp, { recursive: true, force: true });
     throw err;
   }
   for (const entry of readdirSync(opts.cacheDir)) {
     if (entry !== opts.version) {
-      rmSync(join6(opts.cacheDir, entry), { recursive: true, force: true });
+      rmSync(join9(opts.cacheDir, entry), { recursive: true, force: true });
     }
   }
   return target;
@@ -915,10 +1563,10 @@ async function fetchWebBundle(opts) {
 var ENV_OVERRIDE = "ZOOID_DEV_WEB_ROOT_OVERRIDE";
 async function ensureWebRoot(opts) {
   const override = process.env[ENV_OVERRIDE];
-  if (override && existsSync3(join7(override, "index.html"))) return resolve2(override);
+  if (override && existsSync4(join10(override, "index.html"))) return resolve3(override);
   const fromSource = webSourcePackage(opts.cliRoot);
-  if (fromSource && existsSync3(join7(fromSource, "dist", "index.html"))) {
-    return join7(fromSource, "dist");
+  if (fromSource && existsSync4(join10(fromSource, "dist", "index.html"))) {
+    return join10(fromSource, "dist");
   }
   if (!opts.version) {
     throw new Error(
@@ -931,17 +1579,17 @@ Set ${ENV_OVERRIDE} to a built dist, or run from the monorepo.`
   return fetchBundleFn({ version: opts.version, cacheDir: opts.cacheDir });
 }
 function webSourcePackage(cliRoot) {
-  const workspaceRoot = dirname3(dirname3(dirname3(cliRoot)));
-  const candidate = join7(workspaceRoot, "zooid-clients", "packages", "web");
-  return existsSync3(join7(candidate, "package.json")) ? candidate : null;
+  const workspaceRoot = dirname4(dirname4(dirname4(cliRoot)));
+  const candidate = join10(workspaceRoot, "zooid-clients", "packages", "web");
+  return existsSync4(join10(candidate, "package.json")) ? candidate : null;
 }
 
 // src/web/pin.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join11 } from "path";
 function readZoonWebPin(cliRoot) {
   try {
-    const pkg = JSON.parse(readFileSync4(join8(cliRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join11(cliRoot, "package.json"), "utf8"));
     return pkg.zooid?.webVersion;
   } catch {
     return void 0;
@@ -949,9 +1597,9 @@ function readZoonWebPin(cliRoot) {
 }
 
 // src/web/static.ts
-import { readFileSync as readFileSync5, statSync } from "fs";
-import { extname, join as join9, normalize } from "path";
-import { Hono as Hono2 } from "hono";
+import { readFileSync as readFileSync8, statSync } from "fs";
+import { extname, join as join12, normalize } from "path";
+import { Hono as Hono3 } from "hono";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript; charset=utf-8",
@@ -969,26 +1617,33 @@ function isAssetPath(p) {
   return p.startsWith("/assets/") || /\.[a-z0-9]+$/i.test(p);
 }
 function webStatic(opts) {
-  const app = new Hono2();
-  app.get("/config.json", (c) => c.json({ homeserver_url: opts.homeserverUrl }));
+  const app = new Hono3();
+  app.get(
+    "/config.json",
+    (c) => c.json({
+      homeserver_url: opts.homeserverUrl,
+      ...opts.pushGatewayUrl ? { push_gateway_url: opts.pushGatewayUrl } : {},
+      ...opts.vapidPublicKey ? { vapid_public_key: opts.vapidPublicKey } : {}
+    })
+  );
   app.get("*", (c) => {
     const url = new URL(c.req.url);
     const requested = decodeURIComponent(url.pathname);
     const wantFile = requested === "/" ? "/index.html" : requested;
     const safe = normalize(wantFile).replace(/^(\.\.[/\\])+/g, "");
-    const filePath = join9(opts.webRoot, safe);
+    const filePath = join12(opts.webRoot, safe);
     if (!filePath.startsWith(opts.webRoot)) return c.notFound();
     try {
       const stat = statSync(filePath);
       if (stat.isFile()) {
-        const body = readFileSync5(filePath);
+        const body = readFileSync8(filePath);
         const ct = MIME[extname(filePath)] ?? "application/octet-stream";
         return c.body(body, 200, { "content-type": ct });
       }
     } catch {
     }
     if (isAssetPath(requested)) return c.notFound();
-    const indexBytes = readFileSync5(join9(opts.webRoot, "index.html"));
+    const indexBytes = readFileSync8(join12(opts.webRoot, "index.html"));
     return c.body(indexBytes, 200, {
       "content-type": MIME[".html"]
     });
@@ -998,11 +1653,11 @@ function webStatic(opts) {
 
 // src/web/watch.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
+import { join as join13 } from "path";
 async function startWebWatch(opts) {
-  const distPath = join10(opts.webPackageDir, "dist");
-  const indexPath = join10(distPath, "index.html");
+  const distPath = join13(opts.webPackageDir, "dist");
+  const indexPath = join13(distPath, "index.html");
   const timeoutMs = opts.firstBuildTimeoutMs ?? 6e4;
   const spawnTime = Date.now();
   const child = spawn2(
@@ -1036,7 +1691,7 @@ async function startWebWatch(opts) {
       attachStdio();
       throw new Error(`vite build --watch exited before first build (code ${child.exitCode})`);
     }
-    if (existsSync4(indexPath)) {
+    if (existsSync5(indexPath)) {
       const m = statSync2(indexPath).mtimeMs;
       if (m >= spawnTime - 500) return makeHandle();
     }
@@ -1056,12 +1711,12 @@ async function startWebWatch(opts) {
 async function stopChild(child) {
   if (child.exitCode !== null) return;
   child.kill("SIGTERM");
-  await new Promise((resolve7) => {
+  await new Promise((resolve9) => {
     let done = false;
     const finish = () => {
       if (done) return;
       done = true;
-      resolve7();
+      resolve9();
     };
     child.once("exit", finish);
     setTimeout(() => {
@@ -1075,8 +1730,8 @@ async function stopChild(child) {
 }
 
 // src/observability/paths.ts
-import { mkdir as mkdir2, readdir, rm, symlink, unlink as unlink2 } from "fs/promises";
-import { join as join11 } from "path";
+import { mkdir as mkdir2, readdir, rm, symlink, unlink } from "fs/promises";
+import { join as join14 } from "path";
 function localDateSlug(d) {
   const y = d.getFullYear();
   const m = String(d.getMonth() + 1).padStart(2, "0");
@@ -1086,32 +1741,32 @@ function localDateSlug(d) {
 var DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
 function resolveLogPaths({ dataDir, now }) {
   const slug = localDateSlug(now ?? /* @__PURE__ */ new Date());
-  const logsDir = join11(dataDir, "logs");
-  const dayDir = join11(logsDir, slug);
+  const logsDir = join14(dataDir, "logs");
+  const dayDir = join14(logsDir, slug);
   return {
     dataDir,
     logsDir,
     dayDir,
     daySlug: slug,
-    todayLink: join11(logsDir, "today"),
-    tuwunelLog: join11(dayDir, "tuwunel.log"),
-    daemonLog: join11(dayDir, "daemon.log"),
-    devLog: join11(dayDir, "dev.log"),
-    agentLog: (n) => join11(dayDir, `agent-${n}.log`),
-    agentTap: (n) => join11(dayDir, `agent-${n}.acp.jsonl`)
+    todayLink: join14(logsDir, "today"),
+    tuwunelLog: join14(dayDir, "tuwunel.log"),
+    daemonLog: join14(dayDir, "daemon.log"),
+    devLog: join14(dayDir, "dev.log"),
+    agentLog: (n) => join14(dayDir, `agent-${n}.log`),
+    agentTap: (n) => join14(dayDir, `agent-${n}.acp.jsonl`)
   };
 }
 async function ensureDayFolder(p) {
   await mkdir2(p.dayDir, { recursive: true });
   try {
-    await unlink2(p.todayLink);
+    await unlink(p.todayLink);
   } catch {
   }
   await symlink(p.daySlug, p.todayLink);
 }
 async function pruneOldDays(opts) {
   if (opts.retainDays <= 0) return [];
-  const logsDir = join11(opts.dataDir, "logs");
+  const logsDir = join14(opts.dataDir, "logs");
   let entries;
   try {
     entries = await readdir(logsDir);
@@ -1130,7 +1785,7 @@ async function pruneOldDays(opts) {
     const [y, m, d] = name.split("-").map(Number);
     const t = new Date(y, m - 1, d).getTime();
     if (t < cutoff) {
-      await rm(join11(logsDir, name), { recursive: true, force: true });
+      await rm(join14(logsDir, name), { recursive: true, force: true });
       removed.push(name);
     }
   }
@@ -1140,14 +1795,14 @@ async function pruneOldDays(opts) {
 // src/observability/file-sink.ts
 import { createWriteStream } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 var TRUNC_MARKER = "\u2026[truncated]";
 var JsonlSink = class {
   constructor(path, opts = {}) {
     this.path = path;
     this.maxStringLen = opts.maxStringLen ?? 4096;
     this.readyPromise = (async () => {
-      await mkdir3(dirname4(this.path), { recursive: true });
+      await mkdir3(dirname5(this.path), { recursive: true });
       this.stream = createWriteStream(this.path, { flags: "a" });
     })();
   }
@@ -1159,14 +1814,14 @@ var JsonlSink = class {
     await this.readyPromise;
     const capped = capStrings(obj, this.maxStringLen);
     const line = JSON.stringify(capped) + "\n";
-    return new Promise((resolve7, reject) => {
-      this.stream.write(line, (err) => err ? reject(err) : resolve7());
+    return new Promise((resolve9, reject) => {
+      this.stream.write(line, (err) => err ? reject(err) : resolve9());
     });
   }
   async close() {
     await this.readyPromise;
-    return new Promise((resolve7) => {
-      this.stream.end(() => resolve7());
+    return new Promise((resolve9) => {
+      this.stream.end(() => resolve9());
     });
   }
 };
@@ -1234,15 +1889,15 @@ function wireAgentCapture(opts) {
 // src/observability/capture-tuwunel.ts
 import { createWriteStream as createWriteStream2 } from "fs";
 import { mkdir as mkdir4 } from "fs/promises";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 function captureChildToFile(child, path) {
   return (async () => {
-    await mkdir4(dirname5(path), { recursive: true });
+    await mkdir4(dirname6(path), { recursive: true });
     const stream = createWriteStream2(path, { flags: "a" });
     if (child.stdout) child.stdout.on("data", (b) => stream.write(b));
     if (child.stderr) child.stderr.on("data", (b) => stream.write(b));
-    await new Promise((resolve7) => {
-      child.on("exit", () => stream.end(() => resolve7()));
+    await new Promise((resolve9) => {
+      child.on("exit", () => stream.end(() => resolve9()));
     });
   })();
 }
@@ -1275,17 +1930,17 @@ function buildShutdown(layers) {
 
 // src/commands/dev.ts
 var CLI_ROOT = (() => {
-  let dir = dirname6(fileURLToPath(import.meta.url));
+  let dir = dirname7(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
-    const pkgPath = resolve3(dir, "package.json");
-    if (existsSync5(pkgPath)) {
+    const pkgPath = resolve4(dir, "package.json");
+    if (existsSync6(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
         if (pkg.name === "zooid" || pkg.name === "@zooid/cli") return dir;
       } catch {
       }
     }
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1296,15 +1951,15 @@ async function runDev(flags) {
   const found = findConfigFile(cwd);
   if (!found) throw new Error(`zooid.yaml not found in ${cwd}`);
   loadEnvFiles(cwd);
-  const dataRoot = resolve3(cwd, flags.dataDir);
+  const dataRoot = resolve4(cwd, flags.dataDir);
   const layout = resolveDataLayout(dataRoot);
   const paths = resolvePaths(layout.matrixDir);
   const logPaths = resolveLogPaths({ dataDir: layout.dataRoot });
   const tokens = ensureTokens(paths.envPath);
   process.env.MATRIX_AS_TOKEN = tokens.asToken;
   process.env.MATRIX_HS_TOKEN = tokens.hsToken;
-  const rawYaml = readFileSync6(found.path, "utf8");
-  const preview = loadZooidConfig(rawYaml, { configDir: dirname6(found.path) });
+  const rawYaml = readFileSync9(found.path, "utf8");
+  const preview = loadZooidConfig(rawYaml, { configDir: dirname7(found.path) });
   const matrix = findMatrixTransport(preview);
   if (!matrix) {
     throw new Error("zooid.yaml: zooid dev requires at least one matrix transport");
@@ -1399,9 +2054,9 @@ async function runDev(flags) {
         {
           title: "Start @zooid/web watcher (vite build --watch)",
           task: async () => {
-            const pkgDir = typeof flags.watchWeb === "string" ? resolve3(flags.watchWeb) : webSourcePackage(CLI_ROOT);
+            const pkgDir = typeof flags.watchWeb === "string" ? resolve4(flags.watchWeb) : webSourcePackage(CLI_ROOT);
             if (!pkgDir) {
-              const defaultPath = dirname6(dirname6(dirname6(CLI_ROOT))) + "/zooid-clients/packages/web";
+              const defaultPath = dirname7(dirname7(dirname7(CLI_ROOT))) + "/zooid-clients/packages/web";
               throw new Error(
                 `--watch-web: @zooid/web not found at ${defaultPath}.
 Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
@@ -1416,13 +2071,26 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
         task: async (_, t) => {
           const webRoot = ctx.webWatch?.distPath ?? await ensureWebRoot({
             cliRoot: CLI_ROOT,
-            cacheDir: join12(layout.dataRoot, "web"),
+            cacheDir: join15(layout.dataRoot, "web"),
             version: readZoonWebPin(CLI_ROOT),
             onProgress: (msg) => {
               t.output = msg;
             }
           });
-          const app = webStatic({ webRoot, homeserverUrl: homeserver });
+          const app = webStatic({
+            webRoot,
+            homeserverUrl: homeserver,
+            ...ctx.daemon?.vapidPublicKey ? {
+              // Tuwunel runs in a container; `localhost` here would
+              // resolve to the container, not the daemon. Same shorthand
+              // as the AS registration url
+              // (bootstrap/registration-url.ts). This URL is stored in
+              // the pusher and fetched by the homeserver — the browser
+              // never requests it.
+              pushGatewayUrl: `http://host.docker.internal:${ctx.daemon.port}/_matrix/push/v1/notify`,
+              vapidPublicKey: ctx.daemon.vapidPublicKey
+            } : {}
+          });
           ctx.uiServer = serve2({ fetch: app.fetch, port: flags.uiPort });
         }
       }
@@ -1455,13 +2123,25 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
     }
   });
   if (flags.installSignalHandlers !== false) {
-    const handler = async () => {
-      process.stdout.write(chalk.dim("\nStopping\u2026\n"));
-      await shutdown();
-      process.exit(0);
+    let interrupts = 0;
+    const onSignal = () => {
+      interrupts += 1;
+      if (interrupts === 1) {
+        process.stdout.write(chalk.dim("\nStopping\u2026\n"));
+        void shutdown().then(() => process.exit(0));
+        return;
+      }
+      if (interrupts === 2) {
+        process.stdout.write(
+          chalk.dim("Still stopping \u2014 press Ctrl-C again to force quit.\n")
+        );
+        return;
+      }
+      process.stdout.write(chalk.dim("Forced.\n"));
+      process.exit(130);
     };
-    process.on("SIGINT", () => void handler());
-    process.on("SIGTERM", () => void handler());
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
   }
   process.stdout.write(
     [
@@ -1483,8 +2163,8 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
 }
 function loadEnvFiles(cwd) {
   for (const name of [".env.local", ".env"]) {
-    const path = resolve3(cwd, name);
-    if (!existsSync5(path)) continue;
+    const path = resolve4(cwd, name);
+    if (!existsSync6(path)) continue;
     try {
       process.loadEnvFile(path);
     } catch (err) {
@@ -1494,9 +2174,9 @@ function loadEnvFiles(cwd) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync8, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join14, resolve as resolve4 } from "path";
+import { dirname as dirname8, join as join17, resolve as resolve5 } from "path";
 
 // src/commands/init/generators.ts
 function generateZooidYaml(opts) {
@@ -1677,20 +2357,20 @@ function findPiProvider(id) {
 }
 
 // src/commands/init/sniff.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 import { homedir } from "os";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 function sniffCredentials(preset, home = homedir()) {
   const rel = preset === "pi" ? PI_AUTH_FILE : findSimplePreset(preset)?.credentialDir;
   if (!rel) return { found: false };
-  const full = join13(home, rel);
-  if (existsSync6(full)) return { found: true, path: full };
+  const full = join16(home, rel);
+  if (existsSync7(full)) return { found: true, path: full };
   return { found: false };
 }
 function sniffPiDefaults(home = homedir()) {
-  const source = join13(home, PI_SETTINGS_FILE);
+  const source = join16(home, PI_SETTINGS_FILE);
   try {
-    const raw = JSON.parse(readFileSync7(source, "utf8"));
+    const raw = JSON.parse(readFileSync10(source, "utf8"));
     const provider = raw.defaultProvider;
     const model = raw.defaultModel;
     if (typeof provider !== "string" || !provider) return void 0;
@@ -1714,8 +2394,8 @@ var IGNORED_PREEXISTING = /* @__PURE__ */ new Set([
   "yarn.lock"
 ]);
 async function runInit(opts) {
-  const dir = resolve4(opts.dir);
-  mkdirSync5(dir, { recursive: true });
+  const dir = resolve5(opts.dir);
+  mkdirSync8(dir, { recursive: true });
   if (!opts.force) {
     const blocking = readdirSync2(dir).filter((n) => !IGNORED_PREEXISTING.has(n));
     if (blocking.length > 0) {
@@ -1811,14 +2491,14 @@ async function runInit(opts) {
   }
   writes.push({ path: ".gitignore", content: generateGitignore() });
   for (const w of writes) {
-    const full = join14(dir, w.path);
-    const exists = existsSync7(full);
+    const full = join17(dir, w.path);
+    const exists = existsSync8(full);
     if (exists && !opts.overwrite) {
       console.warn(`\u26A0 ${w.path} exists; left as-is (use --force --overwrite to replace)`);
       continue;
     }
-    mkdirSync5(dirname7(full), { recursive: true });
-    writeFileSync5(full, w.content);
+    mkdirSync8(dirname8(full), { recursive: true });
+    writeFileSync8(full, w.content);
     console.log(`\u2713 Created ${w.path}`);
   }
   if ((opts.preset === "claude" || opts.preset === "codex") && opts.auth === "subscription") {
@@ -1843,10 +2523,10 @@ async function runInit(opts) {
     }
     const s = sniffCredentials("pi", opts.home);
     if (opts.auth === "subscription" && s.found) {
-      const authSource = join14(opts.home ?? homedir2(), PI_AUTH_FILE);
-      const linkPath = join14(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
-      if (!existsSync7(linkPath)) {
-        mkdirSync5(dirname7(linkPath), { recursive: true });
+      const authSource = join17(opts.home ?? homedir2(), PI_AUTH_FILE);
+      const linkPath = join17(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
+      if (!existsSync8(linkPath)) {
+        mkdirSync8(dirname8(linkPath), { recursive: true });
         symlinkSync(authSource, linkPath);
       }
       console.log(
@@ -1978,8 +2658,8 @@ async function resolveOptions(flags) {
 
 // src/commands/logs.ts
 import { readFile, readdir as readdir2, readlink } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { join as join18 } from "path";
 var KNOWN_SOURCES = ["tuwunel", "daemon", "dev"];
 async function runLogs(flags) {
   const writer = flags.writer ?? ((s) => process.stdout.write(s));
@@ -1998,8 +2678,8 @@ async function runLogs(flags) {
     writer("no logs yet\n");
     return;
   }
-  const dayDir = join15(flags.dataDir, "logs", day);
-  if (!existsSync8(dayDir)) {
+  const dayDir = join18(flags.dataDir, "logs", day);
+  if (!existsSync9(dayDir)) {
     writer(`no logs for ${day}
 `);
     return;
@@ -2019,7 +2699,7 @@ async function runLogs(flags) {
     return;
   }
   const path = resolveSourcePath(dayDir, flags.source);
-  if (!existsSync8(path)) {
+  if (!existsSync9(path)) {
     writer(`no such source: ${flags.source}
 `);
     return;
@@ -2027,7 +2707,7 @@ async function runLogs(flags) {
   writer(await readFile(path, "utf8"));
 }
 async function resolveTodaySlug(dataDir) {
-  const link = join15(dataDir, "logs", "today");
+  const link = join18(dataDir, "logs", "today");
   try {
     return await readlink(link);
   } catch {
@@ -2036,18 +2716,18 @@ async function resolveTodaySlug(dataDir) {
 }
 function resolveSourcePath(dayDir, source) {
   if (source.startsWith("agent-")) {
-    if (source.endsWith(".acp")) return join15(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
-    return join15(dayDir, `${source}.log`);
+    if (source.endsWith(".acp")) return join18(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
+    return join18(dayDir, `${source}.log`);
   }
   if (KNOWN_SOURCES.includes(source))
-    return join15(dayDir, `${source}.log`);
-  return join15(dayDir, source);
+    return join18(dayDir, `${source}.log`);
+  return join18(dayDir, source);
 }
 async function dumpByTurn(dayDir, turnId, writer) {
   const entries = await readdir2(dayDir);
   const taps = entries.filter((e) => e.endsWith(".acp.jsonl")).sort();
   for (const f of taps) {
-    const text = await readFile(join15(dayDir, f), "utf8");
+    const text = await readFile(join18(dayDir, f), "utf8");
     for (const line of text.split("\n")) {
       if (!line) continue;
       try {
@@ -2061,14 +2741,14 @@ async function dumpByTurn(dayDir, turnId, writer) {
 
 // src/commands/start.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 async function runStart(flags) {
   if (flags.printToken) {
     process.stdout.write(`${randomBytes2(32).toString("hex")}
 `);
     return;
   }
-  const dataRoot = resolve5(process.cwd(), flags.dataDir ?? "./data");
+  const dataRoot = resolve6(process.cwd(), flags.dataDir ?? "./data");
   const layout = resolveDataLayout(dataRoot);
   const handle = await startDaemon({
     cliFlags: flags,
@@ -2081,9 +2761,17 @@ async function runStart(flags) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname8 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname9, join as join19, resolve as resolve7 } from "path";
 import chalk2 from "chalk";
+function readVapidPublicKey(dataDir) {
+  try {
+    const parsed = JSON.parse(readFileSync11(join19(dataDir, VAPID_FILENAME), "utf8"));
+    return typeof parsed.publicKey === "string" ? parsed.publicKey : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function probe(url, timeoutMs = 2e3) {
   try {
     const r = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
@@ -2098,16 +2786,18 @@ async function collectStatus(opts) {
     status: tuwunelUp ? "up" : "down",
     url: opts.tuwunelUrl
   };
+  const vapidPublicKey = opts.dataDir ? readVapidPublicKey(opts.dataDir) : void 0;
   const found = findConfigFile(opts.cwd);
   if (!found) {
     return {
       tuwunel,
       daemon: { status: "unknown", reason: "no zooid.yaml" },
-      agents: []
+      agents: [],
+      ...vapidPublicKey ? { vapidPublicKey } : {}
     };
   }
-  const cfg = loadZooidConfig(readFileSync8(found.path, "utf8"), {
-    configDir: dirname8(found.path)
+  const cfg = loadZooidConfig(readFileSync11(found.path, "utf8"), {
+    configDir: dirname9(found.path)
   });
   const matrixEntry = Object.entries(cfg.transports).find(
     ([, t]) => t.type === "matrix"
@@ -2128,7 +2818,8 @@ async function collectStatus(opts) {
   return {
     tuwunel,
     daemon: { status: daemonUp ? "up" : "down", url: daemonUrl },
-    agents
+    agents,
+    ...vapidPublicKey ? { vapidPublicKey } : {}
   };
 }
 async function runStatus(flags) {
@@ -2137,8 +2828,8 @@ async function runStatus(flags) {
   if (port === void 0) {
     const found = findConfigFile(cwd);
     if (found) {
-      const cfg = loadZooidConfig(readFileSync8(found.path, "utf8"), {
-        configDir: dirname8(found.path)
+      const cfg = loadZooidConfig(readFileSync11(found.path, "utf8"), {
+        configDir: dirname9(found.path)
       });
       const matrix = findMatrixTransport(cfg);
       if (matrix) {
@@ -2148,7 +2839,8 @@ async function runStatus(flags) {
     }
   }
   const tuwunelUrl = `http://localhost:${port ?? 8448}`;
-  const s = await collectStatus({ cwd, tuwunelUrl });
+  const dataDir = resolve7(cwd, flags.dataDir ?? "./data");
+  const s = await collectStatus({ cwd, tuwunelUrl, dataDir });
   const fmt = (st) => st === "up" ? chalk2.green("up") : st === "down" ? chalk2.red("down") : chalk2.yellow("unknown");
   process.stdout.write(
     [
@@ -2157,14 +2849,29 @@ async function runStatus(flags) {
       ...s.agents.map(
         (a) => `  agent: ${a.name} (${a.userId}, trigger: ${a.trigger})`
       ),
+      ...s.vapidPublicKey ? [`vapid public key: ${s.vapidPublicKey}`] : [],
       ""
     ].join("\n")
   );
 }
 
+// src/version.ts
+import { readFileSync as readFileSync12 } from "fs";
+function readCliVersion(url = import.meta.url) {
+  try {
+    const manifest = new URL("../package.json", url);
+    const raw = JSON.parse(readFileSync12(manifest, "utf8"));
+    if (typeof raw.version === "string" && raw.version) return raw.version;
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+var CLI_VERSION = readCliVersion();
+
 // src/bin.ts
 var cli = cac("zooid");
-cli.command("start", "Run the daemon (production entry-point)").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--runtime <local|docker|podman>", "Agent runtime").option("--image <ref>", "Agent container image").option("--print-token", "Print a 32-byte hex token and exit").action(async (flags) => {
+cli.command("start", "Run the daemon (production entry-point)").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--runtime <local|docker|podman>", "Agent runtime").option("--image <ref>", "Agent container image").option("--print-token", "Print a 32-byte hex token and exit").example("$ zooid start --data ./data").example("$ zooid start --runtime docker --image ghcr.io/zooid-ai/agent:latest").action(async (flags) => {
   await runStart({
     dataDir: flags.data,
     runtime: flags.runtime,
@@ -2175,7 +2882,7 @@ cli.command("start", "Run the daemon (production entry-point)").option("--data <
 cli.command("dev", "Tuwunel + daemon + UI for local development").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--engine <docker|podman>", "Container engine", { default: "docker" }).option("--ui-port <n>", "UI HTTP port", { default: 5173 }).option("--admin-user <name>", "Admin username", { default: "admin" }).option("--admin-password <pw>", "Admin password", { default: "admin" }).option(
   "--watch-web [path]",
   "Run vite build --watch on @zooid/web. Path defaults to sibling ../zooid-clients/packages/web."
-).action(async (flags) => {
+).example("$ zooid dev").example("$ zooid dev --engine podman --ui-port 5174").action(async (flags) => {
   await runDev({
     dataDir: flags.data,
     engine: flags.engine,
@@ -2188,30 +2895,30 @@ cli.command("dev", "Tuwunel + daemon + UI for local development").option("--data
 cli.command(
   "logs [source]",
   'Read captured logs. source=tuwunel|daemon|dev|agent-<name>[.acp], or "prune" to delete old days'
-).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).action(async (source, flags) => {
+).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).example("$ zooid logs daemon").example("$ zooid logs agent-support.acp --turn 3f9c1a --day 2026-09-06").example("$ zooid logs prune --keep 7").action(async (source, flags) => {
   if (source === "prune") {
     await runLogs({
-      dataDir: resolve6(process.cwd(), flags.data),
+      dataDir: resolve8(process.cwd(), flags.data),
       subcommand: "prune",
       keep: Number(flags.keep)
     });
     return;
   }
   await runLogs({
-    dataDir: resolve6(process.cwd(), flags.data),
+    dataDir: resolve8(process.cwd(), flags.data),
     source,
     day: flags.day,
     turn: flags.turn,
     follow: Boolean(flags.follow)
   });
 });
-cli.command("status", "Print Tuwunel + daemon health").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--port <n>", "Tuwunel host port (defaults to zooid.yaml)").action(async (flags) => {
+cli.command("status", "Print Tuwunel + daemon health").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--port <n>", "Tuwunel host port (defaults to zooid.yaml)").example("$ zooid status").action(async (flags) => {
   await runStatus({
     dataDir: flags.data,
     port: flags.port !== void 0 ? Number(flags.port) : void 0
   });
 });
-cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or named) directory").option("--preset <name>", "claude | codex | opencode | pi").option("--auth <mode>", "subscription | api-key (claude/codex/pi only)").option("--model <id>", "Model identifier").option("--provider <id>", "opencode provider: opencode-go | opencode | anthropic | openrouter | custom; pi provider: openrouter | anthropic | openai").option("--api-key <value>", "API key (api-key path; opencode always)").option("--force", "Allow scaffolding into a non-empty directory").option("--overwrite", "With --force, overwrite existing files").option("--no-interactive", "Disable prompts; require all flags up front").action(async (dir, flags) => {
+cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or named) directory").option("--preset <name>", "claude | codex | opencode | pi").option("--auth <mode>", "subscription | api-key (claude/codex/pi only)").option("--model <id>", "Model identifier").option("--provider <id>", "opencode provider: opencode-go | opencode | anthropic | openrouter | custom; pi provider: openrouter | anthropic | openai").option("--api-key <value>", "API key (api-key path; opencode always)").option("--force", "Allow scaffolding into a non-empty directory").option("--overwrite", "With --force, overwrite existing files").option("--no-interactive", "Disable prompts; require all flags up front").example("$ zooid init").example("$ zooid init my-workforce --preset opencode --provider anthropic").example("$ zooid init --preset claude --auth api-key --api-key sk-... --no-interactive").action(async (dir, flags) => {
   const resolved = await resolveOptions({
     dir: dir ?? process.cwd(),
     preset: flags.preset,
@@ -2225,7 +2932,39 @@ cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or nam
   });
   await runInit(resolved);
 });
-cli.help();
-cli.version("0.0.1");
-cli.parse();
+cli.command("help [command]", "Display help for zooid, or for a specific command").example("$ zooid help").example("$ zooid help init").action((commandName) => {
+  if (!commandName) {
+    cli.globalCommand.outputHelp();
+    return;
+  }
+  const target = cli.commands.find((c) => c.isMatched(commandName));
+  if (!target) {
+    console.error(`Unknown command: ${commandName}
+`);
+    cli.globalCommand.outputHelp();
+    process.exitCode = 1;
+    return;
+  }
+  target.outputHelp();
+});
+cli.help((sections) => {
+  sections.push({
+    title: "Docs",
+    body: "  https://zooid.dev/docs"
+  });
+  return sections;
+});
+cli.version(CLI_VERSION);
+cli.on("command:*", () => {
+  console.error(`Unknown command: ${cli.args.join(" ")}
+`);
+  cli.outputHelp();
+  process.exitCode = 1;
+});
+if (process.argv.slice(2).length === 0) {
+  cli.outputHelp();
+  process.exitCode = 1;
+} else {
+  cli.parse();
+}
 //# sourceMappingURL=bin.js.map