diff --git a/.beads/metadata.json b/.beads/metadata.json
index b3b8e87..045df93 100644
--- a/.beads/metadata.json
+++ b/.beads/metadata.json
@@ -1,9 +1,7 @@
 {
   "database": "dolt",
   "backend": "dolt",
-  "dolt_mode": "server",
-  "dolt_server_host": "127.0.0.1",
-  "dolt_server_port": 3308,
-  "dolt_database": "beads_buddy-cli",
+  "dolt_mode": "embedded",
+  "dolt_database": "beads_buddy_cli",
   "project_id": "8c1fd894-7662-4bbc-80fb-80bb8c683a61"
-}
\ No newline at end of file
+}
diff --git a/AGENTS.md b/AGENTS.md
index bb8d450..ffdc341 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,7 +36,8 @@ buddy <command>                # Global (after self:install)
 ## Architecture
 
 ```
-bin/buddy                    # Entry point
+bin/buddy                    # Entry point (sh wrapper; unsets PHPRC, execs bin/buddy.php)
+bin/buddy.php                # PHP application bootstrap
 src/
 ├── Application.php          # Symfony Console application bootstrap
 ├── Commands/                # Command classes organized by resource
diff --git a/bin/buddy b/bin/buddy
index 8aefd22..bd16da1 100755
--- a/bin/buddy
+++ b/bin/buddy
@@ -1,43 +1,26 @@
-#!/usr/bin/env php
-<?php
-
-declare(strict_types=1);
-
-// Override script name for clean help output (e.g., "buddy help" instead of "/path/to/buddy help").
-// Symfony Console reads $_SERVER['PHP_SELF'] directly in Command::getProcessedHelp() with no
-// official API to customize it. This workaround is acknowledged by Symfony maintainers as
-// "good enough" (see: https://github.com/symfony/symfony/issues/18524).
-$_SERVER['PHP_SELF'] = 'buddy';
-$_SERVER['argv'][0] = 'buddy';
-
-// Find autoloader
-$autoloadPaths = [
-    __DIR__ . '/../vendor/autoload.php',           // Local development
-    __DIR__ . '/../../../autoload.php',            // Installed as dependency
-];
-
-$autoloader = null;
-foreach ($autoloadPaths as $path) {
-    if (file_exists($path)) {
-        $autoloader = $path;
-        break;
-    }
-}
-
-if ($autoloader === null) {
-    fwrite(STDERR, "Could not find autoloader. Run 'composer install' first.\n");
-    exit(1);
-}
-
-require $autoloader;
-
-// Load .env files from current directory and all parent directories
-$cwd = getcwd();
-if ($cwd !== false) {
-    BuddyCli\Services\EnvLoader::loadRecursive($cwd);
-}
-
-use BuddyCli\Application;
-
-$app = new Application();
-$app->run();
+#!/bin/sh
+# buddy-cli launcher
+#
+# Unsets PHPRC before invoking PHP so that host-application php.ini files
+# (notably LocalWP's per-site config, which pins openssl.cafile / curl.cainfo
+# to a wp-includes ca-bundle.crt scoped to one WP install) cannot break our
+# HTTPS requests with "cURL error 77: error setting certificate verify
+# locations". buddy-cli has no reason to honor a host-app php.ini.
+unset PHPRC
+
+# Resolve symlinks to locate buddy.php next to the real launcher.
+# Needed because `buddy self:install` and `composer global require` both
+# install buddy as a symlink in a PATH dir; $0 then points at the symlink,
+# not at the package's bin/ where buddy.php lives. macOS readlink lacks -f,
+# so walk the symlink chain manually (POSIX).
+self=$0
+while [ -L "$self" ]; do
+	link=$(readlink "$self")
+	case "$link" in
+		/*) self=$link ;;
+		*) self=$(dirname "$self")/$link ;;
+	esac
+done
+dir=$(cd "$(dirname "$self")" && pwd)
+
+exec php "$dir/buddy.php" "$@"
diff --git a/bin/buddy.php b/bin/buddy.php
new file mode 100755
index 0000000..8aefd22
--- /dev/null
+++ b/bin/buddy.php
@@ -0,0 +1,43 @@
+#!/usr/bin/env php
+<?php
+
+declare(strict_types=1);
+
+// Override script name for clean help output (e.g., "buddy help" instead of "/path/to/buddy help").
+// Symfony Console reads $_SERVER['PHP_SELF'] directly in Command::getProcessedHelp() with no
+// official API to customize it. This workaround is acknowledged by Symfony maintainers as
+// "good enough" (see: https://github.com/symfony/symfony/issues/18524).
+$_SERVER['PHP_SELF'] = 'buddy';
+$_SERVER['argv'][0] = 'buddy';
+
+// Find autoloader
+$autoloadPaths = [
+    __DIR__ . '/../vendor/autoload.php',           // Local development
+    __DIR__ . '/../../../autoload.php',            // Installed as dependency
+];
+
+$autoloader = null;
+foreach ($autoloadPaths as $path) {
+    if (file_exists($path)) {
+        $autoloader = $path;
+        break;
+    }
+}
+
+if ($autoloader === null) {
+    fwrite(STDERR, "Could not find autoloader. Run 'composer install' first.\n");
+    exit(1);
+}
+
+require $autoloader;
+
+// Load .env files from current directory and all parent directories
+$cwd = getcwd();
+if ($cwd !== false) {
+    BuddyCli\Services\EnvLoader::loadRecursive($cwd);
+}
+
+use BuddyCli\Application;
+
+$app = new Application();
+$app->run();
diff --git a/tests/Integration/Commands/AuthCommandsTest.php b/tests/Integration/Commands/AuthCommandsTest.php
index 04c0492..1b4f6b1 100644
--- a/tests/Integration/Commands/AuthCommandsTest.php
+++ b/tests/Integration/Commands/AuthCommandsTest.php
@@ -67,7 +67,7 @@ public function testLoginNoBrowserOutputsUrl(): void
         // Run login in background process and capture initial output
         $port = 18090 + rand(0, 100);
         $cmd = sprintf(
-            'cd %s && timeout 2 php bin/buddy login --client-id=test-id --client-secret=test-secret --no-browser --port=%d 2>&1 || true',
+            'cd %s && timeout 2 php bin/buddy.php login --client-id=test-id --client-secret=test-secret --no-browser --port=%d 2>&1 || true',
             escapeshellarg(dirname(__DIR__, 3)),
             $port
         );
@@ -86,7 +86,7 @@ public function testLoginTestModeStartsServer(): void
         // Run login --test in background
         $port = 18190 + rand(0, 100);
         $cmd = sprintf(
-            'cd %s && timeout 2 php bin/buddy login --test --port=%d 2>&1 || true',
+            'cd %s && timeout 2 php bin/buddy.php login --test --port=%d 2>&1 || true',
             escapeshellarg(dirname(__DIR__, 3)),
             $port
         );
@@ -110,7 +110,7 @@ public function testLoginTestModeHandlesCallback(): void
         ];
 
         $cmd = sprintf(
-            'cd %s && php bin/buddy login --test --port=%d',
+            'cd %s && php bin/buddy.php login --test --port=%d',
             escapeshellarg(dirname(__DIR__, 3)),
             $port
         );
@@ -148,7 +148,7 @@ public function testLoginPortUnavailable(): void
         try {
             // Try to run login on same port
             $cmd = sprintf(
-                'cd %s && php bin/buddy login --client-id=test-id --client-secret=test-secret --port=%d 2>&1',
+                'cd %s && php bin/buddy.php login --client-id=test-id --client-secret=test-secret --port=%d 2>&1',
                 escapeshellarg(dirname(__DIR__, 3)),
                 $port
             );