@ainecto/cli 0.8.1 → 0.10.0

package/README.md

@@ -3,7 +3,8 @@
 Published as `ainecto`, `@ainecto/mcp` and `@ainecto/cli` — the same code. Command: `ainecto`.
 
 **Once per machine:** `npx -y ainecto@latest setup` — signs you in through the browser (once), checks the
-connection, and connects Claude Code, Cursor, and Codex to AiNecto.
+connection, and connects Claude Code, Cursor, and Codex to the AiNecto server address
+(`https://ainecto.com/mcp`). Each agent then signs in to AiNecto by itself the first time it connects.
 
 Every AI session sees the same AiNecto tools. What a tool may change is decided by your AiNecto
 permissions on the workspace, project, or document it touches — the server refuses the rest. There are
@@ -14,6 +15,10 @@ no session roles (Design / Development / Test / Validation were removed in 0.8.0
 **Run `npx -y ainecto@latest setup` (use a long command timeout — at least 6 minutes: sign-in waits up
 to 5 minutes for the user). Then run `npx -y ainecto@latest doctor` and do what it says.**
 
+- `setup` registers the server address, so each agent signs in on its own the first time: Claude Code —
+  run `/mcp` in a session and sign in to `ainecto`; Cursor — sign in when `ainecto` asks in its MCP
+  settings; Codex — signs in while `setup` connects it (a browser tab opens and the sign-in link is
+  printed to stderr; if it did not finish, run `codex mcp login ainecto`).
 - To add AiNecto's working rules to a repository, run `npx -y ainecto@latest init` from its root. It
   does not ask for a role or a project.
 - **A server added during a session is not available in that session.** Keep working through the CLI:
@@ -29,6 +34,7 @@ to 5 minutes for the user). Then run `npx -y ainecto@latest doctor` and do what
 ```bash
 npx -y ainecto@latest setup              # sign in, check, connect Claude Code · Cursor · Codex
 npx -y ainecto@latest setup --dry-run    # show what it would do — no sign-in, no changes
+npx -y ainecto@latest setup --local      # connect through the local relay instead (see below)
 npx -y ainecto@latest setup --undo       # remove the connections setup made (sign-in stays)
 npx -y ainecto@latest status             # who is signed in, your AiNecto role, what is connected
 npx -y ainecto@latest doctor             # what is missing, and the one command that fixes each item
@@ -38,33 +44,62 @@ npx -y ainecto@latest doctor             # what is missing, and the one command
 `ainecto` entry, left untouched), `not installed`, or `failed`; if any client fails it says «partial» and
 exits 1:
 
-- Claude Code — `claude mcp add -s user ainecto -- npx -y @ainecto/mcp@<version>` (user scope).
-- Cursor — merges the same entry into `~/.cursor/mcp.json`, keeping your other servers.
-- Codex — `codex mcp add ainecto -- npx -y @ainecto/mcp@<version>`.
+- Claude Code — `claude mcp add --transport http -s user ainecto https://ainecto.com/mcp` (user scope).
+  Sign in with `/mcp` in a session.
+- Cursor — merges `"ainecto": { "url": "https://ainecto.com/mcp" }` into `~/.cursor/mcp.json`, keeping
+  your other servers. Cursor asks you to sign in from its MCP settings.
+- Codex — `codex mcp add ainecto --url https://ainecto.com/mcp`. Codex starts its sign-in right away
+  (a browser tab opens; `setup` passes Codex's output, with the sign-in link, through to stderr). If that
+  did not finish within 90 seconds, Codex shows as `failed` but stays connected — run
+  `codex mcp login ainecto` (re-running `setup` says the same).
 
-The entry is pinned to the CLI version that wrote it; re-run `setup` to move to a newer one (`doctor`
-tells you when one is available). Your AiNecto role (your job, set in AiNecto's account settings) is
-shown by `setup` and `status`; AI uses it to pitch explanations — it does not change permissions.
+With `--env dev` (or `--endpoint`) the address is that environment's. The server address has no version
+to pin: a server update reaches every agent at once. Entries an older `setup` wrote
+(`npx -y @ainecto/mcp@<version>`, with or without `--role`) are rewritten to the server address when you
+re-run `setup`; `setup --undo` removes either kind.
+
+`setup --local` registers the local relay instead — `npx -y @ainecto/mcp@<version>` (stdio, pinned to
+the CLI version), which uses this machine's one `ainecto` sign-in for every agent. Use it only when an
+agent cannot sign in to the server address by itself; running `setup` again without `--local` moves back
+to the server address.
+
+Your AiNecto role (your job, set in AiNecto's account settings) is shown by `setup` and `status`; AI uses
+it to pitch explanations — it does not change permissions.
 
 ## Set up a repository (optional)
 
 ```bash
 npx -y ainecto@latest init               # .ainecto/HARNESS.md, an AGENTS.md block (and CLAUDE.md if present), .ainecto/config.json
-npx -y ainecto@latest init --mcp         # also .mcp.json (Claude Code) and .cursor/mcp.json (Cursor)
+npx -y ainecto@latest init --mcp         # also .mcp.json (Claude Code) and .cursor/mcp.json (Cursor), with the server address
+npx -y ainecto@latest init --mcp --local # the same files with the local relay instead
 npx -y ainecto@latest init --dry-run     # the same plan, nothing written
 npx -y ainecto@latest init --undo        # remove what init wrote
+npx -y ainecto@latest init --agent tester  # name the agent working in this folder (see below)
 ```
 
+- `--agent <name>` names the agent that works in this folder. It writes the name to
+  `.ainecto/agent.local` (keep it out of git) and puts it in `.mcp.json`, `.cursor/mcp.json` and
+  `.codex/config.toml` — the server address entries get the header `X-AiNecto-Agent-Name`, the local relay
+  gets `--agent <name>`. Re-running `init` keeps the name. `ainecto tools call …` run in this folder sends
+  the same name. The server checks the name; a name it refuses stops `init` before any file is written.
+  `.codex/config.toml` is written only when it does not exist yet (or init wrote it); Codex reads it only in
+  a trusted project.
+
 - `init` fetches the rules from the server — `--dry-run` too, so the plan is the real one. If it cannot
   (not signed in, offline), it says which files would get this package's default text instead.
 - If this machine is not signed in yet, `init` opens the browser once (`--dry-run` never does). The
   sign-in URL is printed first (with `--json`, as one JSON line on stderr: `{"event":"login_url","url":…}`).
 - It stops when run from a sub-folder of a git repository, and tells you the root.
-- **Repositories set up by 0.7.x** (`.mcp.json` with `--role`): re-run `npx -y ainecto@latest init`.
-  It rewrites the existing `ainecto` entry without `--role`, pinned to this version, and drops the old
-  `project` field from `.ainecto/config.json` (unless you changed it). Until then the old entry keeps
-  working: `--role` is accepted and ignored. Old flags (`--role`, `--project`, `--project-name`,
-  `--yes`) are ignored with a one-line note.
+- `--mcp` writes the server address, like `setup`: `.mcp.json` gets
+  `"ainecto": { "type": "http", "url": "https://ainecto.com/mcp" }` (Claude Code needs the `type`) and
+  `.cursor/mcp.json` gets `"ainecto": { "url": "https://ainecto.com/mcp" }`. Each agent signs in by
+  itself the first time. `--local` writes the pinned local relay instead (see Connector Mode).
+- **Repositories set up earlier** (`.mcp.json` with `npx -y @ainecto/mcp…`, with or without `--role`):
+  re-run `npx -y ainecto@latest init`. It rewrites the existing `ainecto` entry to the server address
+  (or, with `--local`, to the relay pinned to this version without `--role`), and drops the old
+  `project` field from `.ainecto/config.json` (unless you changed it). An `ainecto` entry pointing
+  somewhere else is left alone. Until then the old entry keeps working: `--role` is accepted and
+  ignored. Old flags (`--role`, `--project`, `--project-name`, `--yes`) are ignored with a one-line note.
 
 ## Commands
 
@@ -167,14 +202,15 @@ The package doubles as a stdio-to-HTTP proxy for the resolved `/mcp` endpoint. I
 local file references. It uses this machine's one sign-in (`ainecto setup`, `ainecto auth login`, or
 the sign-in `ainecto init` performs) and never opens a browser on its own.
 
-This is the entry `setup` and `init --mcp` write — you normally do not add it by hand:
+This is the entry `setup --local` and `init --mcp --local` write — you normally do not add it by hand
+(without `--local` they write the server address instead, as above):
 
 ```json
 {
   "mcpServers": {
     "ainecto": {
       "command": "npx",
-      "args": ["-y", "@ainecto/mcp@0.8.1"]
+      "args": ["-y", "@ainecto/mcp@0.10.0"]
     }
   }
 }
@@ -187,18 +223,20 @@ hiding it — `ainecto doctor` checks this.
 
 ### MCP Registry
 
-`server.json` is the Registry entry `io.github.codelives/ainecto` (same as `package.json#mcpName`). It
-lists only the npm package `@ainecto/mcp` — the bridge `setup` and `init --mcp` write. Registry
+`server.json` is the Registry entry `com.ainecto/mcp` (same as `package.json#mcpName`). It
+lists the server address `https://ainecto.com/mcp` (remote, streamable HTTP — what `setup` registers) and
+the npm package `@ainecto/mcp` (the bridge `setup --local` and `init --mcp --local` write). Registry
 publication requires the npm version it references to carry that `mcpName`, so publish npm first.
 Registration is done by a person:
 
 1. `npm run release -- --otp=<code>` (below) so that `@ainecto/mcp@<version>` is on npm.
-2. GitHub org namespace login as a `codelives` org **Owner** — a classic PAT with only `read:org`
-   works where the browser login did not: `MCP_GITHUB_TOKEN=<pat> mcp-publisher login github`.
+2. Domain login for `ainecto.com` (HTTP: `https://ainecto.com/.well-known/mcp-registry-auth` must
+   serve the public key; the private key is in the macOS keychain):
+   `mcp-publisher login http --domain ainecto.com --private-key "$(security find-generic-password -s codelive-mcp-registry -a ainecto.com -w)"`.
 3. `mcp-publisher publish` from this folder.
 
-Listing `https://ainecto.com/mcp` as a remote here, or a `com.ainecto/*` name, would need ainecto.com
-domain auth (`mcp-publisher login dns|http --domain ainecto.com`) and is not part of this release.
+Up to 0.8.1 the entry was `io.github.codelives/ainecto` (package only); it is marked deprecated after
+the first `com.ainecto/mcp` publish. Details in `docs/mcp-registry-registration.md`.
 
 ## Development