zooid 0.6.1 → 0.7.1

package/dist/bin.js

@@ -0,0 +1,1891 @@
+#!/usr/bin/env node
+import {
+  ApprovalCorrelator,
+  MatrixClient,
+  SpawnRegistry,
+  buildAcpRegistry,
+  createMatrixTransport,
+  ensureWorkforceSpace,
+  findConfigFile,
+  findHttpTransport,
+  findMatrixTransport,
+  loadZooidConfig,
+  mergeCliFlags,
+  renderRegistration,
+  startDaemonSocketServer,
+  startWorkforcePublisher
+} from "./chunk-SUPTPSN3.js";
+
+// src/bin.ts
+import { resolve as resolve5 } from "path";
+import { cac } from "cac";
+
+// src/commands/dev.ts
+import chalk from "chalk";
+import { Listr } from "listr2";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname6, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { serve as serve2 } from "@hono/node-server";
+
+// src/bootstrap/admin.ts
+async function ensureAdminUser(opts) {
+  const r = await fetch(`${opts.homeserver}/_matrix/client/v3/register`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      auth: { type: "m.login.dummy" },
+      username: opts.username,
+      password: opts.password,
+      inhibit_login: true
+    })
+  });
+  if (r.ok) {
+    const j2 = await r.json();
+    return { created: true, userId: j2.user_id };
+  }
+  const j = await r.json();
+  if (j.errcode === "M_USER_IN_USE") {
+    const host = new URL(opts.homeserver).hostname;
+    return { created: false, userId: `@${opts.username}:${host}` };
+  }
+  throw new Error(
+    `register ${opts.username}: ${r.status} ${j.errcode ?? ""} ${j.error ?? ""}`.trim()
+  );
+}
+
+// src/bootstrap/configs.ts
+import { mkdirSync, writeFileSync } from "fs";
+var TUWUNEL_INTERNAL_PORT = 8448;
+function renderTuwunelToml(opts) {
+  return [
+    "[global]",
+    `server_name = "${opts.serverName}"`,
+    'database_path = "/var/lib/tuwunel/db"',
+    'media_path = "/var/lib/tuwunel/media"',
+    'appservice_dir = "/var/lib/tuwunel/registrations"',
+    "allow_registration = true",
+    "yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true",
+    "allow_local_presence = true",
+    'address = ["0.0.0.0"]',
+    `port = [${TUWUNEL_INTERNAL_PORT}]`,
+    ""
+  ].join("\n");
+}
+function writeBootstrapConfigs(opts) {
+  const { paths, serverName, asToken, hsToken, senderLocalpart, userNamespace } = opts;
+  mkdirSync(paths.dbDir, { recursive: true });
+  mkdirSync(paths.mediaDir, { recursive: true });
+  mkdirSync(paths.registrationsDir, { recursive: true });
+  writeFileSync(paths.tuwunelTomlPath, renderTuwunelToml({ serverName }));
+  const yaml = renderRegistration({
+    id: "zooid",
+    url: `http://host.docker.internal:9099`,
+    homeserver: `http://localhost:${TUWUNEL_INTERNAL_PORT}`,
+    asToken,
+    hsToken,
+    senderLocalpart,
+    userNamespace,
+    // BotPool.bootstrap creates `#alias:<server>` rooms when missing — the
+    // AS needs an aliases namespace to legally claim them.
+    aliasNamespace: `#.*:${serverName}`,
+    // zooid dev shares @.*:<server_name> between bots and the predefined
+    // admin human, so the AS cannot claim the namespace exclusively.
+    exclusive: false
+  });
+  writeFileSync(paths.appserviceYamlPath, yaml);
+}
+
+// src/bootstrap/data-layout.ts
+import { join } from "path";
+function resolveDataLayout(dataRoot) {
+  const agentsDir = join(dataRoot, "agents");
+  return {
+    dataRoot,
+    matrixDir: join(dataRoot, "matrix"),
+    logsDir: join(dataRoot, "logs"),
+    agentsDir,
+    agentDir: (id) => join(agentsDir, id)
+  };
+}
+
+// src/bootstrap/derive.ts
+var NAMESPACE_RE = /^@\.\*:([A-Za-z0-9.-]+)$/;
+function deriveHomeserverShape(matrix, agentUserIds) {
+  const url = new URL(matrix.homeserver);
+  const host = url.hostname;
+  const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+  const m = NAMESPACE_RE.exec(matrix.user_namespace);
+  if (!m) {
+    throw new Error(
+      `user_namespace ${matrix.user_namespace}: expected the simple form '@.*:<server_name>'`
+    );
+  }
+  const serverName = m[1];
+  for (const userId of agentUserIds) {
+    if (!userId.endsWith(`:${serverName}`)) {
+      throw new Error(
+        `server_name mismatch: agent ${userId} does not end with :${serverName}`
+      );
+    }
+  }
+  return { host, port, serverName };
+}
+
+// src/bootstrap/paths.ts
+import { join as join2 } from "path";
+function resolvePaths(dataDir) {
+  const configDir = join2(dataDir, "config");
+  const registrationsDir = join2(configDir, "registrations");
+  return {
+    dataDir,
+    dbDir: join2(dataDir, "db"),
+    mediaDir: join2(dataDir, "media"),
+    configDir,
+    registrationsDir,
+    tuwunelTomlPath: join2(configDir, "tuwunel.toml"),
+    appserviceYamlPath: join2(registrationsDir, "zooid.yaml"),
+    envPath: join2(configDir, ".env")
+  };
+}
+
+// src/bootstrap/tokens.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname } from "path";
+var AS_RE = /^MATRIX_AS_TOKEN=(.+)$/m;
+var HS_RE = /^MATRIX_HS_TOKEN=(.+)$/m;
+function genToken(prefix) {
+  return `${prefix}-${randomBytes(24).toString("hex")}`;
+}
+function readTokens(envPath) {
+  if (!existsSync(envPath)) return null;
+  const text = readFileSync(envPath, "utf8");
+  const as = text.match(AS_RE)?.[1];
+  const hs = text.match(HS_RE)?.[1];
+  if (!as && !hs) return null;
+  if (!as || !hs) {
+    throw new Error(
+      `${envPath}: missing MATRIX_AS_TOKEN or MATRIX_HS_TOKEN. Delete the file to regenerate, or restore the missing value.`
+    );
+  }
+  return { asToken: as, hsToken: hs };
+}
+function ensureTokens(envPath) {
+  const existing = readTokens(envPath);
+  if (existing) return existing;
+  const tokens = { asToken: genToken("as"), hsToken: genToken("hs") };
+  mkdirSync2(dirname(envPath), { recursive: true });
+  const previous = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+  const next = previous.trimEnd() + (previous ? "\n" : "") + `MATRIX_AS_TOKEN=${tokens.asToken}
+MATRIX_HS_TOKEN=${tokens.hsToken}
+`;
+  writeFileSync2(envPath, next, { mode: 384 });
+  return tokens;
+}
+
+// src/daemon/start-daemon.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { mkdir, unlink } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+import { serve } from "@hono/node-server";
+
+// ../transport-http/src/server.ts
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { timingSafeEqual, randomUUID } from "crypto";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function isAuthorized(token, header) {
+  if (!header || !header.startsWith("Bearer ")) return false;
+  const provided = header.slice("Bearer ".length);
+  if (provided.length !== token.length) return false;
+  return timingSafeEqual(Buffer.from(provided), Buffer.from(token));
+}
+function parsePromptBody(raw) {
+  if (!raw || typeof raw !== "object") return { error: "body must be a JSON object" };
+  const obj = raw;
+  if (typeof obj.prompt !== "string" || obj.prompt.length === 0) {
+    return { error: "missing or empty prompt" };
+  }
+  return { prompt: obj.prompt };
+}
+async function readJson(c) {
+  const raw = await c.req.text();
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { error: "body must be valid JSON" };
+  }
+}
+function parseDecisionBody(raw) {
+  if (!raw || typeof raw !== "object") return { error: "body must be a JSON object" };
+  const obj = raw;
+  if (obj.decision !== "allow" && obj.decision !== "cancel") {
+    return { error: 'decision must be "allow" or "cancel"' };
+  }
+  if (obj.decision === "allow" && typeof obj.option_id !== "string") {
+    return { error: 'option_id is required when decision is "allow"' };
+  }
+  return {
+    decision: obj.decision,
+    option_id: typeof obj.option_id === "string" ? obj.option_id : void 0
+  };
+}
+function approvalRequestFrame(handle) {
+  return JSON.stringify({
+    type: "approval.request",
+    approval_id: handle.approvalId,
+    session_id: handle.sessionId,
+    tool_call_id: handle.toolCallId,
+    options: handle.options
+  });
+}
+function createApp({
+  agents,
+  approvals,
+  token,
+  keepaliveMs = 3e4
+}) {
+  const app = new Hono();
+  const streams = /* @__PURE__ */ new Map();
+  agents.onEvent = (_name, event) => {
+    const stream = streams.get(event.sessionId);
+    if (!stream) return;
+    void stream.writeSSE({ data: JSON.stringify(event) });
+  };
+  agents.onApprovalRequest = async (name, req) => {
+    const handle = approvals.register(name, req.sessionId, req, {
+      timeoutMs: agents.getApprovalTimeoutMs(name)
+    });
+    return handle.decisionPromise;
+  };
+  approvals.on("registered", (handle) => {
+    const stream = streams.get(handle.sessionId);
+    if (!stream) return;
+    void stream.writeSSE({ data: approvalRequestFrame(handle) });
+  });
+  approvals.on("timeout", ({ approvalId, sessionId }) => {
+    const stream = streams.get(sessionId);
+    if (!stream) return;
+    void stream.writeSSE({
+      data: JSON.stringify({ type: "approval.timeout", approval_id: approvalId, session_id: sessionId })
+    });
+  });
+  function checkAgent(c, name) {
+    if (!agents.hasAgent(name)) {
+      return c.json({ error: "unknown agent" }, 404);
+    }
+    return null;
+  }
+  function attachKeepalive(sse) {
+    if (!keepaliveMs || keepaliveMs <= 0) return null;
+    const timer = setInterval(() => {
+      void sse.writeSSE({ data: "", event: "keepalive" }).catch(() => {
+      });
+    }, keepaliveMs);
+    timer.unref?.();
+    return timer;
+  }
+  app.post("/agents/:name/sessions", async (c) => {
+    if (!isAuthorized(token, c.req.header("authorization"))) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const name = c.req.param("name");
+    const reject = checkAgent(c, name);
+    if (reject) return reject;
+    const parsed = await readJson(c);
+    if (parsed && typeof parsed === "object" && "error" in parsed) {
+      return c.json({ error: parsed.error }, 400);
+    }
+    const body = parsePromptBody(parsed);
+    if ("error" in body) return c.json({ error: body.error }, 400);
+    const threadId = randomUUID();
+    return streamSSE(c, async (sse) => {
+      let sessionId = null;
+      let keepalive = null;
+      try {
+        sessionId = await agents.ensureSession(name, threadId);
+        streams.set(sessionId, sse);
+        keepalive = attachKeepalive(sse);
+        await sse.writeSSE({
+          data: JSON.stringify({ type: "session.start", session_id: sessionId })
+        });
+        await sse.writeSSE({ data: JSON.stringify({ type: "turn.start" }) });
+        const result = await agents.prompt(name, {
+          threadId,
+          content: [{ type: "text", text: body.prompt }]
+        });
+        await sse.writeSSE({
+          data: JSON.stringify({ type: "turn.end", stop_reason: result.stopReason })
+        });
+      } catch (err) {
+        await sse.writeSSE({
+          data: JSON.stringify({
+            type: "turn.end",
+            stop_reason: "error",
+            error: err.message
+          })
+        });
+      } finally {
+        if (keepalive) clearInterval(keepalive);
+        if (sessionId) {
+          approvals.cancelSession(sessionId);
+          if (streams.get(sessionId) === sse) {
+            streams.delete(sessionId);
+          }
+        }
+      }
+    });
+  });
+  app.get("/agents/:name/sessions/:id/events", async (c) => {
+    if (!isAuthorized(token, c.req.header("authorization"))) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const name = c.req.param("name");
+    const reject = checkAgent(c, name);
+    if (reject) return reject;
+    const id = c.req.param("id");
+    if (!UUID_RE.test(id)) {
+      return c.json({ error: "session id must be a UUID" }, 400);
+    }
+    if (!streams.has(id)) {
+      return c.json({ error: "no in-flight session" }, 404);
+    }
+    return streamSSE(c, async (sse) => {
+      streams.set(id, sse);
+      const keepalive = attachKeepalive(sse);
+      for (const handle of approvals.listPending(id)) {
+        await sse.writeSSE({ data: approvalRequestFrame(handle) });
+      }
+      try {
+        while (streams.get(id) === sse) {
+          await new Promise((r) => setTimeout(r, 250));
+        }
+      } finally {
+        if (keepalive) clearInterval(keepalive);
+      }
+    });
+  });
+  app.post("/agents/:name/sessions/:sid/approvals/:approval_id", async (c) => {
+    if (!isAuthorized(token, c.req.header("authorization"))) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const name = c.req.param("name");
+    const reject = checkAgent(c, name);
+    if (reject) return reject;
+    const sid = c.req.param("sid");
+    const approvalId = c.req.param("approval_id");
+    const parsed = await readJson(c);
+    if (parsed && typeof parsed === "object" && "error" in parsed) {
+      return c.json({ error: parsed.error }, 400);
+    }
+    const body = parseDecisionBody(parsed);
+    if ("error" in body) return c.json({ error: body.error }, 400);
+    const decision = body.decision === "cancel" ? { decision: "cancel" } : { decision: "allow", optionId: body.option_id };
+    const ok = approvals.resolve(sid, approvalId, decision);
+    if (!ok) return c.json({ error: "unknown approval" }, 404);
+    return c.json({ ok: true });
+  });
+  app.post("/agents/:name/sessions/:sid/cancel", async (c) => {
+    if (!isAuthorized(token, c.req.header("authorization"))) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const name = c.req.param("name");
+    const reject = checkAgent(c, name);
+    if (reject) return reject;
+    const sid = c.req.param("sid");
+    approvals.cancelSession(sid);
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+// src/prepull-images.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var pExecFile = promisify(execFile);
+async function prepullImages(registry, opts) {
+  if (opts.skip || opts.runtime === "local") return;
+  const exec = opts.exec ?? defaultExec;
+  const log = opts.log ?? ((l) => console.log(l));
+  const images = /* @__PURE__ */ new Set();
+  for (const name of registry.agentNames()) {
+    const img = registry.resolveSpawnImage(name);
+    if (img) images.add(img);
+  }
+  const toPull = [];
+  let cached = 0;
+  if (opts.refresh) {
+    toPull.push(...images);
+  } else {
+    await Promise.all(
+      [...images].map(async (img) => {
+        const r = await exec(opts.engine, ["image", "inspect", img]);
+        if (r.code === 0) cached++;
+        else toPull.push(img);
+      })
+    );
+  }
+  log(
+    `[zooid] image prepull: ${images.size} unique images (${cached} cached, ${toPull.length} to pull)`
+  );
+  if (toPull.length === 0) return;
+  await Promise.all(
+    toPull.map(async (img) => {
+      log(`[zooid]   ${img}  pulling\u2026`);
+      const start = Date.now();
+      const r = await exec(opts.engine, ["pull", img]);
+      const secs = ((Date.now() - start) / 1e3).toFixed(1);
+      if (r.code !== 0) {
+        throw new Error(
+          `image prepull failed for ${img}:
+${r.stderr.trim() || "(no stderr)"}`
+        );
+      }
+      log(`[zooid]   ${img}  \u2713 ${secs}s`);
+    })
+  );
+}
+var defaultExec = async (cmd, args) => {
+  try {
+    const { stdout, stderr } = await pExecFile(cmd, args, {
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return { code: 0, stdout, stderr };
+  } catch (err) {
+    const e = err;
+    return {
+      code: typeof e.code === "number" ? e.code : 1,
+      stdout: e.stdout ?? "",
+      stderr: e.stderr ?? String(e)
+    };
+  }
+};
+
+// src/daemon/start-daemon.ts
+function listenAsync(server) {
+  return new Promise((resolve6) => {
+    const check = () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") resolve6(addr.port);
+      else setImmediate(check);
+    };
+    check();
+  });
+}
+function closeAsync(server) {
+  return new Promise((resolve6) => {
+    server.close(() => resolve6());
+  });
+}
+async function startDaemon(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const found = opts.configPath ? { path: opts.configPath } : findConfigFile(cwd);
+  if (!found) throw new Error("zooid.yaml is required");
+  const configDir = dirname2(found.path);
+  const base = loadZooidConfig(readFileSync2(found.path, "utf8"), { configDir });
+  const config = mergeCliFlags(base, opts.cliFlags ?? {});
+  const approvals = new ApprovalCorrelator();
+  const daemonSockPath = opts.agentsDir ? join3(opts.agentsDir, "..", "run", "context.sock") : join3(tmpdir(), `zooid-context-${process.pid}.sock`);
+  await mkdir(dirname2(daemonSockPath), { recursive: true }).catch(() => {
+  });
+  const contextSpawnRegistry = new SpawnRegistry();
+  let contextSocket = null;
+  try {
+    contextSocket = await startDaemonSocketServer({
+      sockPath: daemonSockPath,
+      registry: contextSpawnRegistry
+    });
+  } catch (err) {
+    console.warn("[context] daemon socket startup failed; zooid-context MCP disabled:", err);
+  }
+  const dataDir = opts.agentsDir ? dirname2(opts.agentsDir) : void 0;
+  const registry = buildAcpRegistry(config, {
+    approvals,
+    onTap: opts.onTap,
+    agentsDir: opts.agentsDir,
+    contextSpawnRegistry: contextSocket ? contextSpawnRegistry : void 0,
+    daemonSockPath: contextSocket ? daemonSockPath : void 0,
+    configDir,
+    dataDir,
+    daemonHome: process.env.HOME
+  });
+  const agentNames = Object.keys(config.agents);
+  if (config.runtime !== "local") {
+    await prepullImages(registry, {
+      engine: config.runtime === "podman" ? "podman" : "docker",
+      runtime: config.runtime,
+      skip: opts.noPrepull ?? process.env.ZOOID_NO_PREPULL === "1",
+      refresh: opts.refreshImages ?? process.env.ZOOID_REFRESH_IMAGES === "1",
+      log: opts.prepullLog
+    });
+  }
+  console.log(
+    `[context] socket=${daemonSockPath} status=${contextSocket ? "listening" : "disabled"} agents={${agentNames.map((n) => `${n}:${registry.hasContextSpawn(n) ? "yes" : "no"}`).join(", ")}}`
+  );
+  let server = null;
+  let stopped = false;
+  let resolveStopped;
+  const whenStopped = new Promise((r) => {
+    resolveStopped = r;
+  });
+  const matrix = findMatrixTransport(config);
+  let port;
+  if (matrix) {
+    const client = new MatrixClient({
+      homeserver: matrix.transport.homeserver,
+      asToken: matrix.transport.as_token
+    });
+    const bindings = [];
+    for (const a of Object.values(config.agents)) {
+      if (a.matrix?.transport !== matrix.name) continue;
+      const binding = {
+        name: a.name,
+        userId: a.matrix.user_id,
+        rooms: a.matrix.rooms,
+        trigger: a.matrix.trigger
+      };
+      if (a.matrix.display_name !== void 0) binding.displayName = a.matrix.display_name;
+      bindings.push(binding);
+    }
+    const transport = createMatrixTransport({
+      agents: registry,
+      approvals,
+      client,
+      bindings,
+      hsToken: matrix.transport.hs_token,
+      adminUserId: opts.adminUserId
+    });
+    const requestedPort = matrix.transport.port ?? 8080;
+    server = serve({ fetch: transport.app.fetch, port: requestedPort, hostname: "0.0.0.0" });
+    port = await listenAsync(server);
+    const serverName = matrix.transport.user_namespace.split(":").slice(1).join(":").replace(/\\?\)?$/, "") || new URL(matrix.transport.homeserver).hostname;
+    const asUserId = `@${matrix.transport.sender_localpart}:${serverName}`;
+    const spaceLocalpart = matrix.transport.space ?? "dev";
+    let spaceRoomId;
+    try {
+      spaceRoomId = await ensureWorkforceSpace({
+        client,
+        asUserId,
+        serverName,
+        spaceLocalpart,
+        preset: "public_chat"
+      });
+      console.log(`[matrix] ensured workforce space #${spaceLocalpart}:${serverName} \u2192 ${spaceRoomId}`);
+    } catch (err) {
+      console.warn("[matrix] workforce space provisioning failed:", err);
+    }
+    await transport.bootstrap({ spaceRoomId, asUserId });
+    if (spaceRoomId) {
+      try {
+        const publisher = await startWorkforcePublisher({
+          client,
+          spaceRoomId,
+          asUserId,
+          getAgents: () => bindings
+        });
+        console.log(`[matrix] published eco.zoon.workforce (${bindings.length} agents)`);
+        void publisher;
+      } catch (err) {
+        console.warn("[matrix] workforce roster publication failed:", err);
+      }
+    }
+  } else {
+    const http = findHttpTransport(config);
+    if (!http) throw new Error("no transport declared in zooid.yaml");
+    const token = process.env.ZOOID_TOKEN;
+    if (!token) throw new Error("ZOOID_TOKEN is required for http transport");
+    const app = createApp({ agents: registry, approvals, token });
+    server = serve({ fetch: app.fetch, port: http.transport.port, hostname: "0.0.0.0" });
+    port = await listenAsync(server);
+  }
+  const stop = async () => {
+    if (stopped) return whenStopped;
+    stopped = true;
+    try {
+      if (server) await closeAsync(server);
+    } catch {
+    }
+    try {
+      await registry.stopAll();
+    } catch (err) {
+      console.error("stopAll:", err);
+    }
+    try {
+      if (contextSocket) await contextSocket.close();
+      await unlink(daemonSockPath).catch(() => {
+      });
+    } catch {
+    }
+    resolveStopped();
+  };
+  if (opts.installSignalHandlers !== false) {
+    const handler = (sig) => {
+      console.log(`received ${sig}, stopping agents...`);
+      void stop().then(() => process.exit(0));
+    };
+    process.on("SIGINT", () => handler("SIGINT"));
+    process.on("SIGTERM", () => handler("SIGTERM"));
+  }
+  return { port, agentNames, stop, whenStopped };
+}
+
+// src/services/tuwunel.ts
+import { spawn } from "child_process";
+var DEFAULT_IMAGE = "ghcr.io/matrix-construct/tuwunel:latest";
+function buildRunArgs(opts) {
+  const image = opts.image ?? DEFAULT_IMAGE;
+  return [
+    "run",
+    "--rm",
+    "--name",
+    opts.name,
+    "-p",
+    `${opts.hostPort}:8448`,
+    "-v",
+    `${opts.paths.dbDir}:/var/lib/tuwunel/db`,
+    "-v",
+    `${opts.paths.mediaDir}:/var/lib/tuwunel/media`,
+    "-v",
+    `${opts.paths.tuwunelTomlPath}:/etc/tuwunel/tuwunel.toml:ro`,
+    "-v",
+    `${opts.paths.registrationsDir}:/var/lib/tuwunel/registrations:ro`,
+    "-e",
+    "TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml",
+    image
+  ];
+}
+var TuwunelService = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  child = null;
+  start() {
+    this.child = spawn(this.opts.engine, buildRunArgs(this.opts), {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return this.child;
+  }
+  async stop() {
+    if (this.child && this.child.exitCode === null) {
+      this.child.kill("SIGTERM");
+      await new Promise((resolve6) => {
+        this.child.on("exit", () => resolve6());
+      });
+    }
+    this.child = null;
+    await execEngine(this.opts.engine, ["stop", this.opts.name]).catch(() => {
+    });
+  }
+  async waitHealthy(opts) {
+    const deadline = Date.now() + opts.timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        const r = await fetch(`${opts.url}/_matrix/client/versions`);
+        if (r.ok) return;
+      } catch {
+      }
+      await new Promise((resolve6) => setTimeout(resolve6, 500));
+    }
+    throw new Error(
+      `Tuwunel did not become healthy at ${opts.url} in ${opts.timeoutMs}ms`
+    );
+  }
+};
+function execEngine(engine, args) {
+  return new Promise((resolve6, reject) => {
+    const child = spawn(engine, args, { stdio: "pipe" });
+    let stderr = "";
+    child.stderr.on("data", (b) => stderr += String(b));
+    child.on("exit", (code) => {
+      if (code === 0) resolve6();
+      else reject(new Error(`${engine} ${args.join(" ")} failed: ${stderr.trim()}`));
+    });
+    child.on("error", reject);
+  });
+}
+
+// src/web/resolve.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, join as join4, resolve } from "path";
+var ENV_OVERRIDE = "ZOOID_DEV_WEB_ROOT_OVERRIDE";
+function resolveWebRoot(cliRoot) {
+  const override = process.env[ENV_OVERRIDE];
+  if (override && existsSync2(join4(override, "index.html"))) return resolve(override);
+  const published = join4(cliRoot, "dist", "web");
+  if (existsSync2(join4(published, "index.html"))) return published;
+  const fromSource = webSourcePackage(cliRoot);
+  if (fromSource && existsSync2(join4(fromSource, "dist", "index.html"))) {
+    return join4(fromSource, "dist");
+  }
+  throw new Error(
+    `@zoon/web build not found.
+  Tried: ${published}
+  Tried: ${fromSource ?? "(no monorepo source)"}
+Run \`pnpm -C zoon/packages/web build\` (or set ${ENV_OVERRIDE} to a built dist).`
+  );
+}
+function webSourcePackage(cliRoot) {
+  const workspaceRoot = dirname3(dirname3(dirname3(cliRoot)));
+  const candidate = join4(workspaceRoot, "zoon", "packages", "web");
+  return existsSync2(join4(candidate, "package.json")) ? candidate : null;
+}
+
+// src/web/static.ts
+import { readFileSync as readFileSync3, statSync } from "fs";
+import { extname, join as join5, normalize } from "path";
+import { Hono as Hono2 } from "hono";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+function isAssetPath(p) {
+  return p.startsWith("/assets/") || /\.[a-z0-9]+$/i.test(p);
+}
+function webStatic(opts) {
+  const app = new Hono2();
+  app.get("/config.json", (c) => c.json({ homeserver_url: opts.homeserverUrl }));
+  app.get("*", (c) => {
+    const url = new URL(c.req.url);
+    const requested = decodeURIComponent(url.pathname);
+    const wantFile = requested === "/" ? "/index.html" : requested;
+    const safe = normalize(wantFile).replace(/^(\.\.[/\\])+/g, "");
+    const filePath = join5(opts.webRoot, safe);
+    if (!filePath.startsWith(opts.webRoot)) return c.notFound();
+    try {
+      const stat = statSync(filePath);
+      if (stat.isFile()) {
+        const body = readFileSync3(filePath);
+        const ct = MIME[extname(filePath)] ?? "application/octet-stream";
+        return c.body(body, 200, { "content-type": ct });
+      }
+    } catch {
+    }
+    if (isAssetPath(requested)) return c.notFound();
+    const indexBytes = readFileSync3(join5(opts.webRoot, "index.html"));
+    return c.body(indexBytes, 200, {
+      "content-type": MIME[".html"]
+    });
+  });
+  return app;
+}
+
+// src/web/watch.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync3, statSync as statSync2 } from "fs";
+import { join as join6 } from "path";
+async function startWebWatch(opts) {
+  const distPath = join6(opts.webPackageDir, "dist");
+  const indexPath = join6(distPath, "index.html");
+  const timeoutMs = opts.firstBuildTimeoutMs ?? 6e4;
+  const spawnTime = Date.now();
+  const child = spawn2(
+    "pnpm",
+    ["-C", opts.webPackageDir, "exec", "vite", "build", "--watch"],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  let buffered = "";
+  const onData = (chunk) => {
+    buffered += chunk.toString("utf8");
+  };
+  child.stdout?.on("data", onData);
+  child.stderr?.on("data", onData);
+  let attached = false;
+  const attachStdio = () => {
+    if (attached) return;
+    attached = true;
+    child.stdout?.off("data", onData);
+    child.stderr?.off("data", onData);
+    if (buffered) process.stdout.write(buffered);
+    buffered = "";
+    child.stdout?.pipe(process.stdout);
+    child.stderr?.pipe(process.stderr);
+  };
+  let exited = false;
+  child.once("exit", () => {
+    exited = true;
+  });
+  while (Date.now() - spawnTime < timeoutMs) {
+    if (exited) {
+      attachStdio();
+      throw new Error(`vite build --watch exited before first build (code ${child.exitCode})`);
+    }
+    if (existsSync3(indexPath)) {
+      const m = statSync2(indexPath).mtimeMs;
+      if (m >= spawnTime - 500) return makeHandle();
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  attachStdio();
+  await stopChild(child);
+  throw new Error(`vite build --watch did not produce ${indexPath} within ${timeoutMs}ms`);
+  function makeHandle() {
+    return {
+      distPath,
+      attachStdio,
+      stop: () => stopChild(child)
+    };
+  }
+}
+async function stopChild(child) {
+  if (child.exitCode !== null) return;
+  child.kill("SIGTERM");
+  await new Promise((resolve6) => {
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      resolve6();
+    };
+    child.once("exit", finish);
+    setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      finish();
+    }, 2e3);
+  });
+}
+
+// src/observability/paths.ts
+import { mkdir as mkdir2, readdir, rm, symlink, unlink as unlink2 } from "fs/promises";
+import { join as join7 } from "path";
+function localDateSlug(d) {
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+}
+var DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+function resolveLogPaths({ dataDir, now }) {
+  const slug = localDateSlug(now ?? /* @__PURE__ */ new Date());
+  const logsDir = join7(dataDir, "logs");
+  const dayDir = join7(logsDir, slug);
+  return {
+    dataDir,
+    logsDir,
+    dayDir,
+    daySlug: slug,
+    todayLink: join7(logsDir, "today"),
+    tuwunelLog: join7(dayDir, "tuwunel.log"),
+    daemonLog: join7(dayDir, "daemon.log"),
+    devLog: join7(dayDir, "dev.log"),
+    agentLog: (n) => join7(dayDir, `agent-${n}.log`),
+    agentTap: (n) => join7(dayDir, `agent-${n}.acp.jsonl`)
+  };
+}
+async function ensureDayFolder(p) {
+  await mkdir2(p.dayDir, { recursive: true });
+  try {
+    await unlink2(p.todayLink);
+  } catch {
+  }
+  await symlink(p.daySlug, p.todayLink);
+}
+async function pruneOldDays(opts) {
+  if (opts.retainDays <= 0) return [];
+  const logsDir = join7(opts.dataDir, "logs");
+  let entries;
+  try {
+    entries = await readdir(logsDir);
+  } catch {
+    return [];
+  }
+  const today = opts.now ?? /* @__PURE__ */ new Date();
+  const cutoff = new Date(
+    today.getFullYear(),
+    today.getMonth(),
+    today.getDate() - opts.retainDays + 1
+  ).getTime();
+  const removed = [];
+  for (const name of entries) {
+    if (!DAY_RE.test(name)) continue;
+    const [y, m, d] = name.split("-").map(Number);
+    const t = new Date(y, m - 1, d).getTime();
+    if (t < cutoff) {
+      await rm(join7(logsDir, name), { recursive: true, force: true });
+      removed.push(name);
+    }
+  }
+  return removed;
+}
+
+// src/observability/file-sink.ts
+import { createWriteStream } from "fs";
+import { mkdir as mkdir3 } from "fs/promises";
+import { dirname as dirname4 } from "path";
+var TRUNC_MARKER = "\u2026[truncated]";
+var JsonlSink = class {
+  constructor(path, opts = {}) {
+    this.path = path;
+    this.maxStringLen = opts.maxStringLen ?? 4096;
+    this.readyPromise = (async () => {
+      await mkdir3(dirname4(this.path), { recursive: true });
+      this.stream = createWriteStream(this.path, { flags: "a" });
+    })();
+  }
+  stream = null;
+  maxStringLen;
+  readyPromise;
+  async write(obj) {
+    await this.readyPromise;
+    const capped = capStrings(obj, this.maxStringLen);
+    const line = JSON.stringify(capped) + "\n";
+    return new Promise((resolve6, reject) => {
+      this.stream.write(line, (err) => err ? reject(err) : resolve6());
+    });
+  }
+  async close() {
+    await this.readyPromise;
+    return new Promise((resolve6) => {
+      this.stream.end(() => resolve6());
+    });
+  }
+};
+function capStrings(v, max) {
+  if (typeof v === "string") {
+    return v.length <= max ? v : v.slice(0, max) + TRUNC_MARKER;
+  }
+  if (Array.isArray(v)) return v.map((x) => capStrings(x, max));
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const [k, val] of Object.entries(v)) out[k] = capStrings(val, max);
+    return out;
+  }
+  return v;
+}
+var DEFAULT_VARIANTS = /* @__PURE__ */ new Set([
+  "tool_call",
+  "tool_call_update",
+  "plan",
+  "available_commands_update",
+  "current_mode_update",
+  "user_message_chunk"
+]);
+function shouldCaptureUpdate(verbosity, variant) {
+  if (verbosity === "verbose") return true;
+  if (verbosity === "verbose-thoughts") {
+    return DEFAULT_VARIANTS.has(variant) || variant === "agent_thought_chunk";
+  }
+  return DEFAULT_VARIANTS.has(variant);
+}
+
+// src/observability/capture-agent.ts
+function wireAgentCapture(opts) {
+  const sink = new JsonlSink(opts.paths.agentTap(opts.agent));
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const pending = [];
+  const onTap = (event) => {
+    if (event.kind === "session_update") {
+      const variant = event.update.sessionUpdate ?? "unknown";
+      if (!shouldCaptureUpdate(opts.verbosity, variant)) return;
+    }
+    const matrix = opts.matrixContext();
+    const envelope = {
+      ts: now().toISOString(),
+      agent: opts.agent,
+      session_id: event.sessionId,
+      turn_id: event.turnId,
+      kind: event.kind
+    };
+    if (matrix) envelope.matrix = matrix;
+    if (event.kind === "session_update") envelope.notification = event.update;
+    else if (event.kind === "turn_started") envelope.prompt_text = event.promptText;
+    else if (event.kind === "turn_completed") envelope.stop_reason = event.stopReason;
+    pending.push(sink.write(envelope));
+  };
+  return {
+    onTap,
+    close: async () => {
+      await Promise.all(pending);
+      await sink.close();
+    }
+  };
+}
+
+// src/observability/capture-tuwunel.ts
+import { createWriteStream as createWriteStream2 } from "fs";
+import { mkdir as mkdir4 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+function captureChildToFile(child, path) {
+  return (async () => {
+    await mkdir4(dirname5(path), { recursive: true });
+    const stream = createWriteStream2(path, { flags: "a" });
+    if (child.stdout) child.stdout.on("data", (b) => stream.write(b));
+    if (child.stderr) child.stderr.on("data", (b) => stream.write(b));
+    await new Promise((resolve6) => {
+      child.on("exit", () => stream.end(() => resolve6()));
+    });
+  })();
+}
+
+// src/commands/dev-cascade.ts
+function buildShutdown(layers) {
+  let started = null;
+  return () => {
+    if (started) return started;
+    started = (async () => {
+      const order = [
+        "stopUi",
+        "stopWebWatch",
+        "stopCaptures",
+        "stopDaemon",
+        "stopTuwunel",
+        "finalizeTuwunelCapture"
+      ];
+      for (const step of order) {
+        try {
+          await layers[step]?.();
+        } catch (err) {
+          console.error(`${step}:`, err);
+        }
+      }
+    })();
+    return started;
+  };
+}
+
+// src/commands/dev.ts
+var CLI_ROOT = (() => {
+  let dir = dirname6(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 8; i++) {
+    const pkgPath = resolve2(dir, "package.json");
+    if (existsSync4(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+        if (pkg.name === "zooid" || pkg.name === "@zooid/cli") return dir;
+      } catch {
+      }
+    }
+    const parent = dirname6(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("cli root not found (no @zooid/cli package.json above " + import.meta.url + ")");
+})();
+async function runDev(flags) {
+  const cwd = flags.cwd ?? process.cwd();
+  const found = findConfigFile(cwd);
+  if (!found) throw new Error(`zooid.yaml not found in ${cwd}`);
+  loadEnvFiles(cwd);
+  const dataRoot = resolve2(cwd, flags.dataDir);
+  const layout = resolveDataLayout(dataRoot);
+  const paths = resolvePaths(layout.matrixDir);
+  const logPaths = resolveLogPaths({ dataDir: layout.dataRoot });
+  const tokens = ensureTokens(paths.envPath);
+  process.env.MATRIX_AS_TOKEN = tokens.asToken;
+  process.env.MATRIX_HS_TOKEN = tokens.hsToken;
+  const rawYaml = readFileSync4(found.path, "utf8");
+  const preview = loadZooidConfig(rawYaml, { configDir: dirname6(found.path) });
+  const matrix = findMatrixTransport(preview);
+  if (!matrix) {
+    throw new Error("zooid.yaml: zooid dev requires at least one matrix transport");
+  }
+  const agentUserIds = Object.values(preview.agents).filter((a) => a.matrix?.transport === matrix.name).map((a) => a.matrix.user_id);
+  const shape = deriveHomeserverShape(matrix.transport, agentUserIds);
+  const port = flags.hostPort ?? shape.port;
+  const homeserver = `http://localhost:${port}`;
+  await ensureDayFolder(logPaths);
+  await pruneOldDays({ dataDir: layout.dataRoot, retainDays: 14 });
+  const ctx = { logPaths, tokens };
+  const tasks = new Listr(
+    [
+      {
+        title: "Write tuwunel.toml + appservice.yaml",
+        task: () => {
+          if (!ctx.tokens) throw new Error("tokens not ready");
+          writeBootstrapConfigs({
+            paths,
+            serverName: shape.serverName,
+            asToken: ctx.tokens.asToken,
+            hsToken: ctx.tokens.hsToken,
+            senderLocalpart: matrix.transport.sender_localpart,
+            userNamespace: matrix.transport.user_namespace
+          });
+        }
+      },
+      {
+        title: `Start Tuwunel container (${flags.engine})`,
+        task: () => {
+          ctx.svc = new TuwunelService({
+            name: "zooid-tuwunel",
+            hostPort: port,
+            paths,
+            engine: flags.engine
+          });
+          const child = ctx.svc.start();
+          ctx.tuwunelCaptureDone = captureChildToFile(child, logPaths.tuwunelLog);
+        }
+      },
+      {
+        title: "Wait for Tuwunel /_matrix/client/versions",
+        task: async () => {
+          if (!ctx.svc) throw new Error("service not started");
+          await ctx.svc.waitHealthy({ url: homeserver, timeoutMs: 6e4 });
+        }
+      },
+      {
+        title: `Register admin user @${flags.adminUser}:${shape.serverName}`,
+        task: async (_, t) => {
+          const r = await ensureAdminUser({
+            homeserver,
+            username: flags.adminUser,
+            password: flags.adminPassword
+          });
+          t.title = r.created ? `Registered admin: ${r.userId}` : `Admin already exists: ${r.userId}`;
+        }
+      },
+      {
+        title: "Start daemon",
+        task: async (_ctx, t) => {
+          const captures = {};
+          for (const name of Object.keys(preview.agents)) {
+            captures[name] = wireAgentCapture({
+              agent: name,
+              paths: logPaths,
+              verbosity: "default",
+              // Matrix cross-link is a follow-up — wire to transport-matrix's
+              // most-recent (room_id, event_id) per session in a later cycle.
+              matrixContext: () => null
+            });
+          }
+          ctx.captures = captures;
+          ctx.daemon = await startDaemon({
+            configPath: found.path,
+            cwd,
+            installSignalHandlers: false,
+            adminUserId: `@${flags.adminUser}:${shape.serverName}`,
+            agentsDir: layout.agentsDir,
+            onTap: (agentName, event) => captures[agentName]?.onTap(event),
+            prepullLog: (line) => {
+              t.output = line.replace(/^\[zooid\]\s+/, "").trim();
+            }
+          });
+        }
+      },
+      ...flags.watchWeb ? [
+        {
+          title: "Start @zoon/web watcher (vite build --watch)",
+          task: async () => {
+            const pkgDir = typeof flags.watchWeb === "string" ? resolve2(flags.watchWeb) : webSourcePackage(CLI_ROOT);
+            if (!pkgDir) {
+              const defaultPath = dirname6(dirname6(dirname6(CLI_ROOT))) + "/zoon/packages/web";
+              throw new Error(
+                `--watch-web: @zoon/web not found at ${defaultPath}.
+Pass an explicit path: --watch-web=/path/to/zoon/packages/web`
+              );
+            }
+            ctx.webWatch = await startWebWatch({ webPackageDir: pkgDir });
+          }
+        }
+      ] : [],
+      {
+        title: `Serve @zoon/web on http://localhost:${flags.uiPort}`,
+        task: () => {
+          const webRoot = ctx.webWatch?.distPath ?? resolveWebRoot(CLI_ROOT);
+          const app = webStatic({ webRoot, homeserverUrl: homeserver });
+          ctx.uiServer = serve2({ fetch: app.fetch, port: flags.uiPort });
+        }
+      }
+    ],
+    { concurrent: false, exitOnError: true }
+  );
+  await tasks.run();
+  ctx.webWatch?.attachStdio();
+  const shutdown = buildShutdown({
+    stopUi: async () => {
+      const s = ctx.uiServer;
+      if (!s) return;
+      await new Promise((r) => s.close(() => r()));
+    },
+    stopDaemon: async () => {
+      await ctx.daemon?.stop();
+    },
+    stopTuwunel: async () => {
+      await ctx.svc?.stop();
+    },
+    stopWebWatch: async () => {
+      await ctx.webWatch?.stop();
+    },
+    stopCaptures: async () => {
+      if (!ctx.captures) return;
+      await Promise.all(Object.values(ctx.captures).map((c) => c.close()));
+    },
+    finalizeTuwunelCapture: async () => {
+      if (ctx.tuwunelCaptureDone) await ctx.tuwunelCaptureDone;
+    }
+  });
+  if (flags.installSignalHandlers !== false) {
+    const handler = async () => {
+      process.stdout.write(chalk.dim("\nStopping\u2026\n"));
+      await shutdown();
+      process.exit(0);
+    };
+    process.on("SIGINT", () => void handler());
+    process.on("SIGTERM", () => void handler());
+  }
+  process.stdout.write(
+    [
+      "",
+      chalk.bold("Tuwunel is up.") + ` ${homeserver}`,
+      chalk.bold("UI:        ") + ` http://localhost:${flags.uiPort}`,
+      `  ${chalk.cyan("admin user:")} ${flags.adminUser} / ${flags.adminPassword}`,
+      `  ${chalk.cyan("data dir:")} ${layout.dataRoot}`,
+      ...ctx.webWatch ? [`  ${chalk.cyan("web watcher:")} live (vite build --watch on @zoon/web)`] : [],
+      "",
+      chalk.dim("Press Ctrl-C to stop."),
+      ""
+    ].join("\n")
+  );
+  if (flags.foreground !== false) {
+    await ctx.daemon.whenStopped;
+  }
+  return { stop: shutdown };
+}
+function loadEnvFiles(cwd) {
+  for (const name of [".env.local", ".env"]) {
+    const path = resolve2(cwd, name);
+    if (!existsSync4(path)) continue;
+    try {
+      process.loadEnvFile(path);
+    } catch (err) {
+      console.warn(`[zooid dev] failed to load ${name}: ${err.message}`);
+    }
+  }
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname7, join as join9, resolve as resolve3 } from "path";
+
+// src/commands/init/generators.ts
+function generateZooidYaml(opts) {
+  const acpBlock = opts.preset === "opencode" ? `    acp: { preset: opencode }` : `    acp:
+      preset: ${opts.preset}
+      model: ${opts.model}`;
+  return `runtime: local
+
+transports:
+  matrix:
+    homeserver: http://localhost:8448
+    port: 9099
+
+agents:
+  zooid-assistant:
+${acpBlock}
+    matrix:
+      display_name: 'Zooid Assistant'
+      rooms: ['#zooid']
+`;
+}
+function generateAgentsMd() {
+  return `# zooid-assistant
+
+You are the zooid setup assistant. Your job is to help the operator get a workforce running, add agents, and configure zooid for their use case.
+
+## Resources
+
+- Zooid documentation: https://zooid.dev/docs/
+- Use your web fetch tool to read documentation pages when answering questions.
+
+## Stack facts
+
+- **Tuwunel** is a lightweight Rust Matrix homeserver (Conduit fork) backed by RocksDB. Single binary, low resource floor \u2014 not "heavy" for typical workforces.
+- **Logs land on disk** in \`./data/\` inside this zooid home dir: tuwunel logs, the daemon, and each agent's ACP stream. Use \`zooid logs <source>\` to tail them (sources: \`tuwunel\`, \`daemon\`, \`dev\`, \`agent-<name>\`, \`agent-<name>.acp\`). Debugging is mostly "read the log file" \u2014 don't tell the operator it's opaque.
+
+## Behavior
+
+- Be terse. Give the answer; link to the doc page; stop.
+- When the operator asks how to do something, prefer to fetch the relevant docs section over guessing from training data.
+- When the operator asks you to *configure* something, propose a yaml edit and let them apply it. Don't write files directly unless they ask.
+`;
+}
+function generateClaudeMd() {
+  return `@AGENTS.md
+`;
+}
+function generateClaudeSettings() {
+  return JSON.stringify(
+    {
+      permissions: {
+        allow: ["WebFetch(domain:zooid.dev)"]
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function generateOpencodeJson(opts) {
+  if (opts.provider === "custom") {
+    return JSON.stringify(
+      {
+        $schema: "https://opencode.ai/config.json",
+        model: "TODO/your-model",
+        provider: { TODO: { options: {} } }
+      },
+      null,
+      2
+    ) + "\n";
+  }
+  const cfg = {
+    $schema: "https://opencode.ai/config.json",
+    model: `${opts.provider}/${opts.model}`,
+    provider: {
+      [opts.provider]: {
+        options: { apiKey: `{env:${opts.apiKeyEnvVar}}` }
+      }
+    },
+    permission: { webfetch: "allow" }
+  };
+  return JSON.stringify(cfg, null, 2) + "\n";
+}
+function generateEnv(opts) {
+  return `${opts.envVar}=${opts.value}
+`;
+}
+function generateGitignore() {
+  return [".env", "node_modules/", "data/", ""].join("\n");
+}
+function generateOpencodeReadme() {
+  return `See https://opencode.ai/config for the full opencode.json schema, including
+provider-specific options and per-tool permissions.
+`;
+}
+
+// src/commands/init/registry.ts
+var SIMPLE_PRESETS = [
+  {
+    preset: "claude",
+    models: ["claude-sonnet-4-6", "claude-opus-4-7", "claude-haiku-4-5"],
+    subscriptionLabel: "Claude subscription (Pro / Max / Team / Enterprise)",
+    apiKeyEnvVar: "ANTHROPIC_API_KEY",
+    apiKeyPromptLabel: "Anthropic",
+    credentialDir: ".claude"
+  },
+  {
+    preset: "codex",
+    models: ["gpt-5.5"],
+    subscriptionLabel: "ChatGPT subscription (Plus / Pro / Team)",
+    apiKeyEnvVar: "OPENAI_API_KEY",
+    apiKeyPromptLabel: "OpenAI",
+    credentialDir: ".codex"
+  }
+];
+var OPENCODE_PROVIDERS = [
+  {
+    id: "opencode-go",
+    label: "opencode-go",
+    description: "$10/mo subscription \u2014 Kimi, GLM, MiniMax",
+    models: ["kimi-k2.6", "kimi-k2.5", "glm-5.1", "glm-5", "minimax-m2.7"],
+    apiKeyEnvVar: "OPENCODE_API_KEY"
+  },
+  {
+    id: "opencode",
+    label: "opencode (Zen)",
+    description: "free tier \u2014 curated models",
+    models: ["kimi-k2.5-free", "glm-4.7-free", "minimax-m2.1-free"],
+    apiKeyEnvVar: "OPENCODE_API_KEY"
+  },
+  {
+    id: "anthropic",
+    label: "Anthropic",
+    description: "Claude via direct Anthropic API",
+    models: ["claude-sonnet-4-6", "claude-opus-4-7", "claude-haiku-4-5"],
+    apiKeyEnvVar: "ANTHROPIC_API_KEY"
+  },
+  {
+    id: "openrouter",
+    label: "OpenRouter",
+    description: "many providers via OpenRouter",
+    models: ["anthropic/claude-sonnet-4-6", "zhipuai/glm-5", "moonshot/kimi-k2.6"],
+    apiKeyEnvVar: "OPENROUTER_API_KEY"
+  }
+];
+function findSimplePreset(name) {
+  return SIMPLE_PRESETS.find((p) => p.preset === name);
+}
+function findOpencodeProvider(id) {
+  return OPENCODE_PROVIDERS.find((p) => p.id === id);
+}
+
+// src/commands/init/sniff.ts
+import { existsSync as existsSync5 } from "fs";
+import { homedir } from "os";
+import { join as join8 } from "path";
+function sniffCredentials(preset, home = homedir()) {
+  const meta = findSimplePreset(preset);
+  if (!meta) return { found: false };
+  const full = join8(home, meta.credentialDir);
+  if (existsSync5(full)) return { found: true, path: full };
+  return { found: false };
+}
+
+// src/commands/init.ts
+var IGNORED_PREEXISTING = /* @__PURE__ */ new Set([
+  ".",
+  "..",
+  ".git",
+  ".DS_Store",
+  "node_modules",
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+]);
+async function runInit(opts) {
+  const dir = resolve3(opts.dir);
+  mkdirSync3(dir, { recursive: true });
+  if (!opts.force) {
+    const blocking = readdirSync(dir).filter((n) => !IGNORED_PREEXISTING.has(n));
+    if (blocking.length > 0) {
+      throw new Error(
+        `${dir} is non-empty (use --force to allow scaffolding into it). Conflicting entries: ${blocking.join(", ")}`
+      );
+    }
+  }
+  const writes = [];
+  if (opts.preset === "claude" || opts.preset === "codex") {
+    if (!opts.model) throw new Error(`--model is required for preset ${opts.preset}`);
+    if (!opts.auth) throw new Error("--auth (subscription|api-key) is required for claude/codex");
+    const meta = findSimplePreset(opts.preset);
+    writes.push({
+      path: "zooid.yaml",
+      content: generateZooidYaml({ preset: opts.preset, model: opts.model })
+    });
+    writes.push({ path: "agents/zooid-assistant/AGENTS.md", content: generateAgentsMd() });
+    if (opts.preset === "claude") {
+      writes.push({
+        path: "agents/zooid-assistant/CLAUDE.md",
+        content: generateClaudeMd()
+      });
+      writes.push({
+        path: "agents/zooid-assistant/.claude/settings.json",
+        content: generateClaudeSettings()
+      });
+    }
+    if (opts.auth === "api-key") {
+      if (!opts.apiKey) throw new Error("--api-key is required when --auth=api-key");
+      writes.push({
+        path: ".env",
+        content: generateEnv({ envVar: meta.apiKeyEnvVar, value: opts.apiKey })
+      });
+    }
+  } else if (opts.preset === "opencode") {
+    if (!opts.provider) throw new Error("--provider is required for opencode");
+    const isCustom = opts.provider === "custom";
+    const providerMeta = isCustom ? void 0 : findOpencodeProvider(opts.provider);
+    if (!isCustom && !providerMeta) throw new Error(`unknown opencode provider: ${opts.provider}`);
+    if (!isCustom && !opts.model) throw new Error("--model is required (paired with --provider)");
+    if (!isCustom && !opts.apiKey) throw new Error("--api-key is required for opencode");
+    writes.push({ path: "zooid.yaml", content: generateZooidYaml({ preset: "opencode" }) });
+    writes.push({ path: "agents/zooid-assistant/AGENTS.md", content: generateAgentsMd() });
+    writes.push({
+      path: "agents/zooid-assistant/opencode.json",
+      content: generateOpencodeJson({
+        provider: opts.provider,
+        model: opts.model,
+        apiKeyEnvVar: providerMeta?.apiKeyEnvVar
+      })
+    });
+    if (isCustom) {
+      writes.push({
+        path: "agents/zooid-assistant/opencode.json.README",
+        content: generateOpencodeReadme()
+      });
+    } else {
+      writes.push({
+        path: ".env",
+        content: generateEnv({ envVar: providerMeta.apiKeyEnvVar, value: opts.apiKey })
+      });
+    }
+  } else {
+    throw new Error(`unknown preset: ${String(opts.preset)}`);
+  }
+  writes.push({ path: ".gitignore", content: generateGitignore() });
+  for (const w of writes) {
+    const full = join9(dir, w.path);
+    const exists = existsSync6(full);
+    if (exists && !opts.overwrite) {
+      console.warn(`\u26A0 ${w.path} exists; left as-is (use --force --overwrite to replace)`);
+      continue;
+    }
+    mkdirSync3(dirname7(full), { recursive: true });
+    writeFileSync3(full, w.content);
+    console.log(`\u2713 Created ${w.path}`);
+  }
+  if ((opts.preset === "claude" || opts.preset === "codex") && opts.auth === "subscription") {
+    const s = sniffCredentials(opts.preset);
+    if (s.found) {
+      console.log(`\u2713 Found ${opts.preset} config at ${s.path}`);
+    } else {
+      console.warn(
+        `\u26A0 No ${opts.preset} config detected \u2014 run \`${opts.preset}\` to log in before \`zooid dev\``
+      );
+    }
+  }
+  console.log("\nNext: zooid dev");
+}
+
+// src/commands/init/prompts.ts
+import { select, password } from "@inquirer/prompts";
+async function resolveOptions(flags) {
+  const interactive = flags.interactive !== false && Boolean(process.stdin.isTTY);
+  const ask = (prompt, fallback) => {
+    if (!interactive) return Promise.reject(new Error(fallback()));
+    return prompt();
+  };
+  const preset = flags.preset ?? await ask(
+    () => select({
+      message: "Which agent should zooid-assistant use?",
+      choices: [
+        { name: "claude (Claude Code)", value: "claude" },
+        { name: "codex (OpenAI Codex)", value: "codex" },
+        { name: "opencode", value: "opencode" }
+      ]
+    }),
+    () => "--preset is required (claude | codex | opencode)"
+  );
+  if (preset === "opencode") {
+    const provider = flags.provider ?? await ask(
+      () => select({
+        message: "Which provider?",
+        choices: [
+          ...OPENCODE_PROVIDERS.map((p) => ({
+            name: `${p.label}  (${p.description})`,
+            value: p.id
+          })),
+          { name: "custom (write your own opencode.json block)", value: "custom" }
+        ]
+      }),
+      () => "--provider is required for opencode"
+    );
+    if (provider === "custom") {
+      return {
+        dir: flags.dir,
+        preset,
+        provider,
+        force: flags.force,
+        overwrite: flags.overwrite
+      };
+    }
+    const meta2 = findOpencodeProvider(provider);
+    if (!meta2) throw new Error(`unknown opencode provider: ${provider}`);
+    const model2 = flags.model ?? await ask(
+      () => select({
+        message: "Which model?",
+        choices: meta2.models.map((m) => ({ name: m, value: m }))
+      }),
+      () => "--model is required"
+    );
+    const apiKey2 = flags.apiKey ?? await ask(
+      () => password({ message: `${meta2.label} API key:` }),
+      () => "--api-key is required"
+    );
+    return {
+      dir: flags.dir,
+      preset,
+      provider,
+      model: model2,
+      apiKey: apiKey2,
+      force: flags.force,
+      overwrite: flags.overwrite
+    };
+  }
+  const meta = findSimplePreset(preset);
+  if (!meta) throw new Error(`unknown preset: ${preset}`);
+  const auth = flags.auth ?? await ask(
+    () => select({
+      message: "How do you authenticate?",
+      choices: [
+        { name: `My ${meta.subscriptionLabel}`, value: "subscription" },
+        { name: `I'll provide an API key`, value: "api-key" }
+      ]
+    }),
+    () => "--auth is required (subscription | api-key)"
+  );
+  const model = flags.model ?? await ask(
+    () => select({
+      message: "Which model?",
+      choices: meta.models.map((m) => ({ name: m, value: m }))
+    }),
+    () => "--model is required"
+  );
+  const apiKey = auth === "api-key" ? flags.apiKey ?? await ask(
+    () => password({ message: `${meta.apiKeyPromptLabel} API key:` }),
+    () => "--api-key is required when --auth=api-key"
+  ) : void 0;
+  return {
+    dir: flags.dir,
+    preset,
+    auth,
+    model,
+    apiKey,
+    force: flags.force,
+    overwrite: flags.overwrite
+  };
+}
+
+// src/commands/logs.ts
+import { readFile, readdir as readdir2, readlink } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { join as join10 } from "path";
+var KNOWN_SOURCES = ["tuwunel", "daemon", "dev"];
+async function runLogs(flags) {
+  const writer = flags.writer ?? ((s) => process.stdout.write(s));
+  if (flags.subcommand === "prune") {
+    const removed = await pruneOldDays({
+      dataDir: flags.dataDir,
+      retainDays: flags.keep ?? 14,
+      now: flags.now
+    });
+    writer(`pruned ${removed.length} day(s): ${removed.join(", ")}
+`);
+    return;
+  }
+  const day = flags.day ?? await resolveTodaySlug(flags.dataDir);
+  if (!day) {
+    writer("no logs yet\n");
+    return;
+  }
+  const dayDir = join10(flags.dataDir, "logs", day);
+  if (!existsSync7(dayDir)) {
+    writer(`no logs for ${day}
+`);
+    return;
+  }
+  if (flags.turn) {
+    await dumpByTurn(dayDir, flags.turn, writer);
+    return;
+  }
+  if (!flags.source) {
+    const entries = await readdir2(dayDir);
+    const sources = /* @__PURE__ */ new Set();
+    for (const e of entries) {
+      if (e.endsWith(".log")) sources.add(e.replace(/\.log$/, ""));
+      if (e.endsWith(".acp.jsonl")) sources.add(e.replace(/\.acp\.jsonl$/, ".acp"));
+    }
+    writer([...sources].sort().join("\n") + "\n");
+    return;
+  }
+  const path = resolveSourcePath(dayDir, flags.source);
+  if (!existsSync7(path)) {
+    writer(`no such source: ${flags.source}
+`);
+    return;
+  }
+  writer(await readFile(path, "utf8"));
+}
+async function resolveTodaySlug(dataDir) {
+  const link = join10(dataDir, "logs", "today");
+  try {
+    return await readlink(link);
+  } catch {
+    return null;
+  }
+}
+function resolveSourcePath(dayDir, source) {
+  if (source.startsWith("agent-")) {
+    if (source.endsWith(".acp")) return join10(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
+    return join10(dayDir, `${source}.log`);
+  }
+  if (KNOWN_SOURCES.includes(source))
+    return join10(dayDir, `${source}.log`);
+  return join10(dayDir, source);
+}
+async function dumpByTurn(dayDir, turnId, writer) {
+  const entries = await readdir2(dayDir);
+  const taps = entries.filter((e) => e.endsWith(".acp.jsonl")).sort();
+  for (const f of taps) {
+    const text = await readFile(join10(dayDir, f), "utf8");
+    for (const line of text.split("\n")) {
+      if (!line) continue;
+      try {
+        const obj = JSON.parse(line);
+        if (obj.turn_id === turnId) writer(line + "\n");
+      } catch {
+      }
+    }
+  }
+}
+
+// src/commands/start.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { resolve as resolve4 } from "path";
+async function runStart(flags) {
+  if (flags.printToken) {
+    process.stdout.write(`${randomBytes2(32).toString("hex")}
+`);
+    return;
+  }
+  const dataRoot = resolve4(process.cwd(), flags.dataDir ?? "./data");
+  const layout = resolveDataLayout(dataRoot);
+  const handle = await startDaemon({
+    cliFlags: flags,
+    installSignalHandlers: true,
+    agentsDir: layout.agentsDir
+  });
+  console.log(`zooid listening on http://localhost:${handle.port}`);
+  for (const name of handle.agentNames) console.log(`  agent: ${name}`);
+  await handle.whenStopped;
+}
+
+// src/commands/status.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname8 } from "path";
+import chalk2 from "chalk";
+async function probe(url, timeoutMs = 2e3) {
+  try {
+    const r = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    return r.status > 0;
+  } catch {
+    return false;
+  }
+}
+async function collectStatus(opts) {
+  const tuwunelUp = await probe(`${opts.tuwunelUrl}/_matrix/client/versions`);
+  const tuwunel = {
+    status: tuwunelUp ? "up" : "down",
+    url: opts.tuwunelUrl
+  };
+  const found = findConfigFile(opts.cwd);
+  if (!found) {
+    return {
+      tuwunel,
+      daemon: { status: "unknown", reason: "no zooid.yaml" },
+      agents: []
+    };
+  }
+  const cfg = loadZooidConfig(readFileSync5(found.path, "utf8"), {
+    configDir: dirname8(found.path)
+  });
+  const matrixEntry = Object.entries(cfg.transports).find(
+    ([, t]) => t.type === "matrix"
+  );
+  const daemonPort = matrixEntry?.[1]?.port ?? 8080;
+  const daemonUrl = `http://localhost:${daemonPort}`;
+  const daemonUp = await probe(daemonUrl);
+  const agents = [];
+  for (const a of Object.values(cfg.agents)) {
+    if (a.matrix) {
+      agents.push({
+        name: a.name,
+        userId: a.matrix.user_id,
+        trigger: a.matrix.trigger
+      });
+    }
+  }
+  return {
+    tuwunel,
+    daemon: { status: daemonUp ? "up" : "down", url: daemonUrl },
+    agents
+  };
+}
+async function runStatus(flags) {
+  const cwd = flags.cwd ?? process.cwd();
+  let port = flags.port;
+  if (port === void 0) {
+    const found = findConfigFile(cwd);
+    if (found) {
+      const cfg = loadZooidConfig(readFileSync5(found.path, "utf8"), {
+        configDir: dirname8(found.path)
+      });
+      const matrix = findMatrixTransport(cfg);
+      if (matrix) {
+        const userIds = Object.values(cfg.agents).filter((a) => a.matrix?.transport === matrix.name).map((a) => a.matrix.user_id);
+        port = deriveHomeserverShape(matrix.transport, userIds).port;
+      }
+    }
+  }
+  const tuwunelUrl = `http://localhost:${port ?? 8448}`;
+  const s = await collectStatus({ cwd, tuwunelUrl });
+  const fmt = (st) => st === "up" ? chalk2.green("up") : st === "down" ? chalk2.red("down") : chalk2.yellow("unknown");
+  process.stdout.write(
+    [
+      `tuwunel  ${fmt(s.tuwunel.status)}  ${s.tuwunel.url}`,
+      `daemon   ${fmt(s.daemon.status)}  ${"url" in s.daemon ? s.daemon.url : s.daemon.reason}`,
+      ...s.agents.map(
+        (a) => `  agent: ${a.name} (${a.userId}, trigger: ${a.trigger})`
+      ),
+      ""
+    ].join("\n")
+  );
+}
+
+// src/bin.ts
+var cli = cac("zooid");
+cli.command("start", "Run the daemon (production entry-point)").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--runtime <local|docker|podman>", "Agent runtime").option("--image <ref>", "Agent container image").option("--print-token", "Print a 32-byte hex token and exit").action(async (flags) => {
+  await runStart({
+    dataDir: flags.data,
+    runtime: flags.runtime,
+    image: flags.image,
+    printToken: flags.printToken
+  });
+});
+cli.command("dev", "Tuwunel + daemon + UI for local development").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--engine <docker|podman>", "Container engine", { default: "docker" }).option("--ui-port <n>", "UI HTTP port", { default: 5173 }).option("--admin-user <name>", "Admin username", { default: "admin" }).option("--admin-password <pw>", "Admin password", { default: "admin" }).option(
+  "--watch-web [path]",
+  "Run vite build --watch on @zoon/web. Path defaults to sibling ../zoon/packages/web."
+).action(async (flags) => {
+  await runDev({
+    dataDir: flags.data,
+    engine: flags.engine,
+    uiPort: Number(flags.uiPort),
+    adminUser: flags.adminUser,
+    adminPassword: flags.adminPassword,
+    watchWeb: flags.watchWeb
+  });
+});
+cli.command(
+  "logs [source]",
+  'Read captured logs. source=tuwunel|daemon|dev|agent-<name>[.acp], or "prune" to delete old days'
+).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).action(async (source, flags) => {
+  if (source === "prune") {
+    await runLogs({
+      dataDir: resolve5(process.cwd(), flags.data),
+      subcommand: "prune",
+      keep: Number(flags.keep)
+    });
+    return;
+  }
+  await runLogs({
+    dataDir: resolve5(process.cwd(), flags.data),
+    source,
+    day: flags.day,
+    turn: flags.turn,
+    follow: Boolean(flags.follow)
+  });
+});
+cli.command("status", "Print Tuwunel + daemon health").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--port <n>", "Tuwunel host port (defaults to zooid.yaml)").action(async (flags) => {
+  await runStatus({
+    dataDir: flags.data,
+    port: flags.port !== void 0 ? Number(flags.port) : void 0
+  });
+});
+cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or named) directory").option("--preset <name>", "claude | codex | opencode").option("--auth <mode>", "subscription | api-key (claude/codex only)").option("--model <id>", "Model identifier").option("--provider <id>", "opencode provider: opencode-go | opencode | anthropic | openrouter | custom").option("--api-key <value>", "API key (api-key path; opencode always)").option("--force", "Allow scaffolding into a non-empty directory").option("--overwrite", "With --force, overwrite existing files").option("--no-interactive", "Disable prompts; require all flags up front").action(async (dir, flags) => {
+  const resolved = await resolveOptions({
+    dir: dir ?? process.cwd(),
+    preset: flags.preset,
+    auth: flags.auth,
+    model: flags.model,
+    provider: flags.provider,
+    apiKey: flags.apiKey,
+    force: Boolean(flags.force),
+    overwrite: Boolean(flags.overwrite),
+    interactive: flags.interactive
+  });
+  await runInit(resolved);
+});
+cli.help();
+cli.version("0.0.1");
+cli.parse();
+//# sourceMappingURL=bin.js.map