@ao_zorin/zocket 1.1.0 → 1.2.0

package/README.md

@@ -36,18 +36,23 @@ zocket init
 
 ```bash
 zocket init
-zocket start --host 127.0.0.1 --web-port 18001 --mcp-port 18002 --mode admin
+zocket start --host 127.0.0.1 --web-port 18001 --mcp-port 18002 --mcp-stream-port 18003 --mode admin
 ```
 
 Open `http://127.0.0.1:18001`.
 
-## Codex (streamable HTTP)
+## CLI / TUI
 
-Codex requires streamable HTTP on `127.0.0.1:18003/mcp`. The Node CLI does **SSE only** today.
-Until streamable HTTP is implemented in Node, run the companion Python service (separate package):
+Full CLI management:
+```bash
+zocket projects list
+zocket projects create myproj --description \"demo\"
+zocket secrets set myproj API_KEY abc123 --description \"example\"
+```
 
+Interactive TUI:
 ```bash
-python3 -m zocket mcp --transport streamable-http --mode admin --host 127.0.0.1 --port 18003
+zocket tui
 ```
 
 ## Docs

package/dist/zocket.js

@@ -3,11 +3,12 @@
 // src/cli.ts
 import { Command } from "commander";
 import { createServer } from "http";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
-import { dirname as dirname5 } from "path";
-import { randomBytes as randomBytes6 } from "crypto";
+import { mkdirSync as mkdirSync5 } from "fs";
+import { randomUUID } from "crypto";
 import { serve } from "@hono/node-server";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 
 // src/vault.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
@@ -58,6 +59,11 @@ var VaultService = class {
     mkdirSync(dirname(this.vaultPath), { recursive: true });
     writeFileSync(this.vaultPath, encrypt(Buffer.from(JSON.stringify(data)), this.key));
   }
+  ensureExists() {
+    if (!existsSync(this.vaultPath)) {
+      this.save({ version: 1, projects: {} });
+    }
+  }
   async withLock(fn) {
     mkdirSync(dirname(this.lockFile), { recursive: true });
     if (!existsSync(this.lockFile)) writeFileSync(this.lockFile, "");
@@ -302,12 +308,12 @@ function runCommand(command, env, policy, maxChars = 500) {
   r.exit_code = proc.status ?? 1;
   return r;
 }
-function runScript(lang, code, env, maxChars = 500) {
-  const ext = lang === "node" ? ".mjs" : ".py";
+function runScript(_lang, code, env, maxChars = 500) {
+  const ext = ".mjs";
   const tmpFile = join(tmpdir(), `zkt-${randomBytes3(8).toString("hex")}${ext}`);
   try {
     writeFileSync3(tmpFile, code, "utf8");
-    const bin = lang === "node" ? "node" : "python3";
+    const bin = "node";
     const proc = spawnSync(bin, [tmpFile], {
       env: { ...process.env, ...env },
       encoding: "utf8",
@@ -483,8 +489,8 @@ function envRefsIn(text) {
   const matches = [...text.matchAll(/\$\{?([A-Z_][A-Z0-9_]*)\}?/g)].map((m) => m[1]);
   return [...new Set(matches)];
 }
-function buildCtx(text, lang) {
-  return { text, envRefs: envRefsIn(text), hasNetwork: NETWORK_RE.test(text), lang };
+function buildCtx(text) {
+  return { text, envRefs: envRefsIn(text), hasNetwork: NETWORK_RE.test(text) };
 }
 var RULES = [
   // ── Critical ────────────────────────────────────────────────────────────
@@ -577,13 +583,6 @@ var RULES = [
     weight: W.MEDIUM,
     test: (c) => /\b(printenv|env)\b[^|]*>/.test(c.text)
   },
-  {
-    id: "PYTHON_SUBPROCESS_EXFIL",
-    description: "Python subprocess call invoking network tool (curl/wget/nc)",
-    severity: "medium",
-    weight: W.MEDIUM,
-    test: (c) => c.lang === "python" && /subprocess\.(run|Popen|call|check_output)\([^)]*\b(curl|wget|nc\b|netcat)\b/.test(c.text)
-  },
   // ── Low ──────────────────────────────────────────────────────────────────
   {
     id: "SINGLE_ENV_NETWORK",
@@ -648,9 +647,9 @@ var SecurityAnalyzer = class {
     const text = isBashC ? command[2] : command.join(" ");
     return this.analyze(buildCtx(text));
   }
-  analyzeScript(lang, code) {
+  analyzeScript(_lang, code) {
     if (this.cfg.mode === "off") return allow();
-    const ctx = buildCtx(code, lang);
+    const ctx = buildCtx(code);
     return this.analyze(ctx);
   }
   analyze(ctx) {
@@ -870,18 +869,18 @@ function buildCatalog(services) {
     },
     {
       name: "run_script",
-      summary: "Run an inline node/python script with project secrets injected as env vars. Prefer over multiple run_with_project_env calls.",
+      summary: "Run an inline node script with project secrets injected as env vars. Prefer over multiple run_with_project_env calls.",
       register: (server) => {
         server.tool(
           "run_script",
           [
-            "Run an inline script with project secrets available as environment variables.",
+            "Run an inline node script with project secrets available as environment variables.",
             "Use this instead of multiple run_with_project_env calls \u2014 write the full logic in one script.",
             "Filesystem is NOT shared between calls. Secret values never appear in this conversation."
           ].join(" "),
           {
             project: z.string().describe("Project name"),
-            lang: z.enum(["node", "python"]).describe("Script language"),
+            lang: z.enum(["node"]).describe("Script language"),
             code: z.string().min(1).describe("Full script source code"),
             max_chars: z.number().int().min(1).max(32e3).optional().describe("Max output chars (default ~500)"),
             confirm: z.boolean().optional().describe("Set to true to confirm execution of a medium-risk script after reviewing the warning")
@@ -1922,7 +1921,10 @@ function lockPath(home = zocketHome()) {
   return join3(home, "vault.lock");
 }
 
-// src/cli.ts
+// src/keys.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
+import { dirname as dirname5 } from "path";
+import { randomBytes as randomBytes6 } from "crypto";
 function loadOrCreateKey(keyFile) {
   if (existsSync5(keyFile)) {
     const raw = readFileSync5(keyFile, "utf8").trim();
@@ -1933,13 +1935,175 @@ function loadOrCreateKey(keyFile) {
   writeFileSync5(keyFile, key.toString("hex"), { mode: 384 });
   return key;
 }
-async function cmdStart(opts) {
+
+// src/tui.ts
+import readline from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+async function promptMenu(rl, title, options) {
+  output.write(`
+${title}
+`);
+  options.forEach((opt, i) => output.write(`  ${i + 1}) ${opt}
+`));
+  const answer = await rl.question("> ");
+  const idx = Number(answer.trim()) - 1;
+  return Number.isFinite(idx) && idx >= 0 && idx < options.length ? idx : -1;
+}
+async function promptInput(rl, label, fallback = "") {
+  const ans = await rl.question(`${label}${fallback ? ` (${fallback})` : ""}: `);
+  return ans.trim() || fallback;
+}
+async function promptConfirm(rl, label) {
+  const ans = await rl.question(`${label} [y/N]: `);
+  return ans.trim().toLowerCase() === "y";
+}
+async function pickProject(rl, vault) {
+  const rows = await vault.listProjects();
+  if (!rows.length) {
+    output.write("No projects\n");
+    return null;
+  }
+  const idx = await promptMenu(rl, "Select project", rows.map((r) => `${r.name} (${r.secret_count})`));
+  if (idx < 0) return null;
+  return rows[idx].name;
+}
+async function showProjects(vault) {
+  const rows = await vault.listProjects();
+  if (!rows.length) {
+    output.write("No projects\n");
+    return;
+  }
+  rows.forEach((r) => {
+    output.write(`${r.name}	${r.secret_count}	${r.folder_path ?? ""}
+`);
+  });
+}
+async function showSecrets(vault, project, showValues) {
+  const rows = await vault.listSecrets(project);
+  if (!rows.length) {
+    output.write("No secrets\n");
+    return;
+  }
+  for (const r of rows) {
+    if (showValues) {
+      const v = await vault.getSecretValue(project, r.key);
+      output.write(`${r.key}	${v}	${r.description ?? ""}
+`);
+    } else {
+      output.write(`${r.key}	${r.description ?? ""}
+`);
+    }
+  }
+}
+async function runTui(services) {
+  const rl = readline.createInterface({ input, output });
+  const { vault } = services;
+  try {
+    while (true) {
+      const main = await promptMenu(rl, "Zocket TUI", [
+        "Projects",
+        "Secrets",
+        "Exit"
+      ]);
+      if (main === 2) break;
+      if (main === 0) {
+        const idx = await promptMenu(rl, "Projects", [
+          "List",
+          "Create",
+          "Delete",
+          "Set folder path",
+          "Set allowed domains",
+          "Back"
+        ]);
+        if (idx === 5) continue;
+        if (idx === 0) await showProjects(vault);
+        if (idx === 1) {
+          const name = await promptInput(rl, "Project name");
+          const desc = await promptInput(rl, "Description", "");
+          const folder = await promptInput(rl, "Folder path", "");
+          await vault.createProject(name, desc);
+          if (folder) await vault.setFolder(name, folder);
+          output.write("Project created\n");
+        }
+        if (idx === 2) {
+          const name = await pickProject(rl, vault);
+          if (!name) continue;
+          if (await promptConfirm(rl, `Delete ${name}?`)) {
+            await vault.deleteProject(name);
+            output.write("Project deleted\n");
+          }
+        }
+        if (idx === 3) {
+          const name = await pickProject(rl, vault);
+          if (!name) continue;
+          const path = await promptInput(rl, "Folder path (empty to clear)", "");
+          await vault.setFolder(name, path || void 0);
+          output.write("Folder updated\n");
+        }
+        if (idx === 4) {
+          const name = await pickProject(rl, vault);
+          if (!name) continue;
+          const domains = await promptInput(rl, "Allowed domains (comma-separated, empty to clear)", "");
+          const value = domains ? domains.split(",").map((s) => s.trim()).filter(Boolean) : null;
+          await vault.setAllowedDomains(name, value);
+          output.write("Allowed domains updated\n");
+        }
+      }
+      if (main === 1) {
+        const project = await pickProject(rl, vault);
+        if (!project) continue;
+        const idx = await promptMenu(rl, `Secrets for ${project}`, [
+          "List (no values)",
+          "List (with values)",
+          "Add or update",
+          "Get value",
+          "Delete",
+          "Back"
+        ]);
+        if (idx === 5) continue;
+        if (idx === 0) await showSecrets(vault, project, false);
+        if (idx === 1) await showSecrets(vault, project, true);
+        if (idx === 2) {
+          const key = await promptInput(rl, "Key (UPPERCASE)", "");
+          const value = await promptInput(rl, "Value", "");
+          const desc = await promptInput(rl, "Description", "");
+          await vault.setSecret(project, key, value, desc);
+          output.write("Secret saved\n");
+        }
+        if (idx === 3) {
+          const key = await promptInput(rl, "Key", "");
+          const value = await vault.getSecretValue(project, key);
+          output.write(`${value}
+`);
+        }
+        if (idx === 4) {
+          const key = await promptInput(rl, "Key", "");
+          if (await promptConfirm(rl, `Delete ${key}?`)) {
+            await vault.deleteSecret(project, key);
+            output.write("Secret deleted\n");
+          }
+        }
+      }
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+// src/cli.ts
+function createServices() {
   const home = zocketHome();
-  mkdirSync4(home, { recursive: true });
+  mkdirSync5(home, { recursive: true });
   const key = loadOrCreateKey(keyPath());
   const vault = new VaultService(vaultPath(), lockPath(), key);
+  vault.ensureExists();
   const config = new ConfigStore(configPath());
   const audit = new AuditLogger(auditPath());
+  config.ensureExists();
+  return { vault, config, audit };
+}
+async function cmdStart(opts) {
+  const { vault, config, audit } = createServices();
   const cfg = config.ensureExists();
   const mode = opts.mode === "admin" ? "admin" : "metadata";
   const services = { vault, config, audit, mode };
@@ -1976,19 +2140,169 @@ async function cmdStart(opts) {
   });
   mcpHttp.listen(opts.mcpPort, opts.host, () => {
     console.log(`[zocket] mcp    http://${opts.host}:${opts.mcpPort}/sse  (mode: ${mode}, loading: ${cfg.mcp_loading})`);
+  });
+  const streamableSessions = /* @__PURE__ */ new Map();
+  const streamableHttp = createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+    if (url.pathname !== "/mcp") {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    let parsedBody = void 0;
+    if (method === "POST") {
+      let raw = "";
+      for await (const chunk of req) {
+        raw += chunk;
+      }
+      if (raw.trim().length > 0) {
+        try {
+          parsedBody = JSON.parse(raw);
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: { code: -32700, message: "Parse error" },
+            id: null
+          }));
+          return;
+        }
+      }
+    }
+    const header = req.headers["mcp-session-id"];
+    const sessionId = Array.isArray(header) ? header[0] : header;
+    let transport;
+    if (sessionId && streamableSessions.has(sessionId)) {
+      transport = streamableSessions.get(sessionId);
+    } else if (!sessionId && method === "POST" && parsedBody && isInitializeRequest(parsedBody)) {
+      transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+        onsessioninitialized: (sid) => {
+          if (transport) streamableSessions.set(sid, transport);
+        }
+      });
+      transport.onclose = () => {
+        const sid = transport?.sessionId;
+        if (sid && streamableSessions.has(sid)) streamableSessions.delete(sid);
+      };
+      const mcpServer = createMcpServer(services, { loading: cfg.mcp_loading });
+      mcpServer.connect(transport).catch((e) => {
+        console.error("[zocket] MCP streamable connect error:", e);
+      });
+    } else {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Bad Request: No valid session ID provided" },
+        id: null
+      }));
+      return;
+    }
+    try {
+      await transport.handleRequest(req, res, parsedBody);
+    } catch (e) {
+      console.error("[zocket] MCP streamable request error:", e);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null
+        }));
+      }
+    }
+  });
+  streamableHttp.listen(opts.mcpStreamPort, opts.host, () => {
+    console.log(`[zocket] mcp    http://${opts.host}:${opts.mcpStreamPort}/mcp  (streamable-http)`);
     console.log(`[zocket] ready  \u2014 vault: ${vaultPath()}`);
   });
 }
 function buildCli() {
   const program = new Command("zocket").description("Local encrypted vault + MCP server for AI agent workflows").version("1.0.0");
-  program.command("start").description("Start web panel and MCP SSE server").option("--host <host>", "Bind host", "127.0.0.1").option("--web-port <port>", "Web panel port", "18001").option("--mcp-port <port>", "MCP SSE port", "18002").option("--mode <mode>", "MCP mode (metadata|admin)", "admin").action(async (opts) => {
+  program.command("init").description("Initialize vault and config").action(async () => {
+    createServices();
+    console.log(`[zocket] initialized \u2014 vault: ${vaultPath()}`);
+  });
+  program.command("start").description("Start web panel + MCP SSE + MCP Streamable HTTP servers").option("--host <host>", "Bind host", "127.0.0.1").option("--web-port <port>", "Web panel port", "18001").option("--mcp-port <port>", "MCP SSE port", "18002").option("--mcp-stream-port <port>", "MCP Streamable HTTP port", "18003").option("--mode <mode>", "MCP mode (metadata|admin)", "admin").action(async (opts) => {
     await cmdStart({
       host: opts.host,
       webPort: parseInt(opts.webPort, 10),
       mcpPort: parseInt(opts.mcpPort, 10),
+      mcpStreamPort: parseInt(opts.mcpStreamPort, 10),
       mode: opts.mode
     });
   });
+  const projects = program.command("projects").description("Manage projects");
+  projects.command("list").action(async () => {
+    const { vault } = createServices();
+    const rows = await vault.listProjects();
+    if (!rows.length) {
+      console.log("No projects");
+      return;
+    }
+    for (const r of rows) {
+      console.log(`${r.name}	${r.secret_count}	${r.folder_path ?? ""}`);
+    }
+  });
+  projects.command("create <name>").option("--description <text>", "Description", "").option("--folder <path>", "Folder path", "").action(async (name, opts) => {
+    const { vault } = createServices();
+    await vault.createProject(name, opts.description ?? "");
+    if (opts.folder) await vault.setFolder(name, opts.folder);
+    console.log("Project created:", name);
+  });
+  projects.command("delete <name>").action(async (name) => {
+    const { vault } = createServices();
+    await vault.deleteProject(name);
+    console.log("Project deleted:", name);
+  });
+  projects.command("set-folder <name> [path]").description('Set or clear folder path (use "-" to clear)').action(async (name, path) => {
+    const { vault } = createServices();
+    const value = path && path !== "-" ? path : void 0;
+    await vault.setFolder(name, value);
+    console.log("Folder updated:", name);
+  });
+  projects.command("set-domains <name> [domains]").description('Set or clear allowed domains (comma-separated, use "-" to clear)').action(async (name, domains) => {
+    const { vault } = createServices();
+    const value = domains && domains !== "-" ? domains.split(",").map((s) => s.trim()).filter(Boolean) : null;
+    await vault.setAllowedDomains(name, value);
+    console.log("Domains updated:", name);
+  });
+  const secrets = program.command("secrets").description("Manage secrets");
+  secrets.command("list <project>").option("--show-values", "Include secret values", false).action(async (project, opts) => {
+    const { vault } = createServices();
+    const rows = await vault.listSecrets(project);
+    if (!rows.length) {
+      console.log("No secrets");
+      return;
+    }
+    for (const r of rows) {
+      if (opts.showValues) {
+        const v = await vault.getSecretValue(project, r.key);
+        console.log(`${r.key}	${v}	${r.description ?? ""}`);
+      } else {
+        console.log(`${r.key}	${r.description ?? ""}`);
+      }
+    }
+  });
+  secrets.command("get <project> <key>").action(async (project, key) => {
+    const { vault } = createServices();
+    const v = await vault.getSecretValue(project, key);
+    console.log(v);
+  });
+  secrets.command("set <project> <key> <value>").option("--description <text>", "Description", "").action(async (project, key, value, opts) => {
+    const { vault } = createServices();
+    await vault.setSecret(project, key, value, opts.description ?? "");
+    console.log("Secret saved:", key);
+  });
+  secrets.command("delete <project> <key>").action(async (project, key) => {
+    const { vault } = createServices();
+    await vault.deleteSecret(project, key);
+    console.log("Secret deleted:", key);
+  });
+  program.command("tui").description("Interactive terminal UI for full management").action(async () => {
+    const { vault, config, audit } = createServices();
+    await runTui({ vault, config, audit });
+  });
   return program;
 }
 

package/docs/AI_AUTODEPLOY.md

@@ -6,22 +6,22 @@ This is the file you can send to an AI coding agent so it can deploy zocket end-
 
 If this repo is already present locally:
 ```bash
-python3 scripts/ai-autodeploy.py --repo-url https://github.com/your-org/zocket.git --repo-ref main
+bash scripts/install-zocket.sh --source local
 ```
 
-If only the file is available, the script will clone the repo and run the platform installer.
+If only the file is available, the script will fetch and run the platform installer:
+```bash
+curl -fsSL https://raw.githubusercontent.com/aozorin/zocket/main/scripts/install-zocket.sh | bash
+```
 
 ## Agent task prompt (copy/paste)
 
 ```text
 Deploy zocket on this machine with secure defaults:
 1) Detect OS and shell.
-2) Run scripts/ai-autodeploy.py with:
-   --lang en
-   --web-port 18001
-   --mcp-port 18002
-   --mcp-mode metadata
-   --autostart user (Linux/macOS) or enabled startup task (Windows)
+2) Run installer:
+   - Linux/macOS: curl -fsSL https://raw.githubusercontent.com/aozorin/zocket/main/scripts/install-zocket.sh | bash
+   - Windows: irm https://raw.githubusercontent.com/aozorin/zocket/main/scripts/install-zocket.ps1 | iex
 3) Verify:
    - web panel on http://127.0.0.1:18001
    - MCP SSE endpoint on http://127.0.0.1:18002/sse (Claude Code)
@@ -33,11 +33,7 @@ Deploy zocket on this machine with secure defaults:
 ## Optional production profile (Linux system services)
 
 ```bash
-python3 scripts/ai-autodeploy.py \
-  --repo-url https://github.com/your-org/zocket.git \
-  --repo-ref main \
-  --autostart system \
-  --zocket-home /var/lib/zocket
+bash scripts/install-zocket.sh --source git --repo-url https://github.com/aozorin/zocket.git --repo-ref main --autostart system --zocket-home /var/lib/zocket
 ```
 
 ## Post-deploy checklist for agent

package/docs/GIT_NPM_RELEASE.md

@@ -1,4 +1,4 @@
-# Git + npm + Python Release Guide
+# Git + npm Release Guide
 
 ## 1) Initialize git project
 
@@ -17,15 +17,7 @@ git push -u origin main
 bash scripts/release-check.sh
 ```
 
-## 3) Publish Python package (PyPI)
-
-```bash
-python3 -m pip install --upgrade build twine
-python3 -m build
-twine upload dist/*
-```
-
-## 4) Publish npm package
+## 3) Publish npm package
 
 Update metadata in `package.json`:
 - `name`
@@ -39,15 +31,14 @@ npm login
 npm publish --access public
 ```
 
-## 5) Tag release
+## 4) Tag release
 
 ```bash
 git tag -a v1.0.0 -m "zocket v1.0.0"
 git push origin v1.0.0
 ```
 
-## 6) Optional GitHub Release artifacts
+## 5) Optional GitHub Release artifacts
 
 Upload:
-- Python wheels/sdist from `dist/`
 - npm package tarball from `npm pack`

package/docs/INSTALL.md

@@ -1,16 +1,15 @@
 # Install Guide (Windows / Linux / macOS)
 
-This guide installs **zocket** as:
+This guide installs **zocket** (Node.js) as:
 - local web panel on `127.0.0.1:18001`
 - MCP SSE server on `127.0.0.1:18002/sse` (Claude Code)
 - MCP streamable HTTP server on `127.0.0.1:18003/mcp` (Codex)
-- optional MCP stdio server for local CLI use
 
 ## 1) Quick Install (recommended)
 
 ### Linux and macOS
 ```bash
-curl -fsSL https://raw.githubusercontent.com/your-org/zocket/main/scripts/install-zocket.sh | bash
+curl -fsSL https://raw.githubusercontent.com/aozorin/zocket/main/scripts/install-zocket.sh | bash
 ```
 
 If you run from a local clone:
@@ -20,7 +19,7 @@ bash scripts/install-zocket.sh --source local
 
 ### Windows (PowerShell)
 ```powershell
-irm https://raw.githubusercontent.com/your-org/zocket/main/scripts/install-zocket.ps1 | iex
+irm https://raw.githubusercontent.com/aozorin/zocket/main/scripts/install-zocket.ps1 | iex
 ```
 
 If you run from a local clone:
@@ -32,16 +31,15 @@ powershell -ExecutionPolicy Bypass -File .\scripts\install-zocket.ps1 -Source Lo
 
 ### Debian/Ubuntu and Debian-based
 Installer auto-installs:
-- `python3`
-- `python3-venv`
-- `python3-pip`
+- `nodejs`
+- `npm`
 - `git`
 - `curl`
 
 Equivalent manual install:
 ```bash
 sudo apt-get update
-sudo apt-get install -y python3 python3-venv python3-pip git curl
+sudo apt-get install -y nodejs npm git curl
 ```
 
 ### Other Linux distros
@@ -52,22 +50,21 @@ Installer supports:
 - `apk` (Alpine)
 
 If your distro is unsupported, install manually:
-- Python `>=3.10`
-- `pip`
-- `venv`
+- Node.js `>=18`
+- `npm`
 - `git`
 
 ## 3) macOS details
 
 Installer uses Homebrew when dependencies are missing:
 ```bash
-brew install python git curl
+brew install node git curl
 ```
 
 ## 4) Windows details
 
 Requirements:
-- Python 3.10+ (recommended from `python.org` or `winget`)
+- Node.js 18+ (recommended from `nodejs.org` or `winget`)
 - Git for Windows
 
 Autostart (enabled by default):
@@ -75,10 +72,8 @@ Autostart (enabled by default):
 powershell -ExecutionPolicy Bypass -File .\scripts\install-zocket.ps1
 ```
 
-This creates scheduled tasks:
-- `ZocketWeb`
-- `ZocketMcpSse`
-- `ZocketMcpStreamable`
+This creates scheduled task:
+- `Zocket`
 
 Disable autostart:
 ```powershell
@@ -87,128 +82,53 @@ powershell -ExecutionPolicy Bypass -File .\scripts\install-zocket.ps1 -EnableAut
 
 ## 5) NPM package usage
 
-This repo now includes an npm wrapper package.
-
 Global install from npm:
 ```bash
-npm i -g @zocket/cli
-zocket setup
-```
-
-Or install from your git repo (example):
-```bash
-npm i -g github:your-org/zocket
-```
-
-First-run setup:
-```bash
-zocket setup
+npm i -g @ao_zorin/zocket
 ```
 
 Then use normal CLI:
 ```bash
 zocket init
-zocket web --host 127.0.0.1 --port 18001
-zocket mcp --transport sse --mode metadata --host 127.0.0.1 --port 18002
-zocket mcp --transport streamable-http --mode metadata --host 127.0.0.1 --port 18003
+zocket start --host 127.0.0.1 --web-port 18001 --mcp-port 18002 --mcp-stream-port 18003 --mode admin
 ```
 
 ## 6) Systemd hardening on Linux (production)
 
 If you install with `--autostart system`, the installer creates and enables:
-- `zocket-web.service` (web panel on 18001)
-- `zocket-mcp-sse.service` (Claude Code, 18002)
-- `zocket-mcp-http.service` (Codex, 18003)
+- `zocket.service` (web + SSE + streamable HTTP)
 
 Check:
 ```bash
-systemctl status zocket-web.service --no-pager
-systemctl status zocket-mcp-sse.service --no-pager
-systemctl status zocket-mcp-http.service --no-pager
+systemctl status zocket.service --no-pager
 ```
 
 ### Linux user-level autostart (no root)
 ```bash
-systemctl --user enable --now zocket-web.service
-systemctl --user enable --now zocket-mcp-sse.service
-systemctl --user enable --now zocket-mcp-http.service
-systemctl --user status zocket-web.service --no-pager
-systemctl --user status zocket-mcp-sse.service --no-pager
-systemctl --user status zocket-mcp-http.service --no-pager
+systemctl --user enable --now zocket.service
+systemctl --user status zocket.service --no-pager
 ```
 
 ### macOS launchd autostart (installed by script)
 Installer creates and loads:
-- `~/Library/LaunchAgents/dev.zocket.web.plist`
-- `~/Library/LaunchAgents/dev.zocket.mcp-sse.plist`
-- `~/Library/LaunchAgents/dev.zocket.mcp-streamable.plist`
-
-If you need to install manually, use:
-
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>Label</key><string>dev.zocket.web</string>
-    <key>ProgramArguments</key>
-    <array>
-      <string>/Users/YOUR_USER/.local/share/zocket/venv/bin/python3</string>
-      <string>-m</string><string>zocket</string>
-      <string>web</string><string>--host</string><string>127.0.0.1</string>
-      <string>--port</string><string>18001</string>
-    </array>
-    <key>EnvironmentVariables</key>
-    <dict>
-      <key>ZOCKET_HOME</key><string>/Users/YOUR_USER/.zocket</string>
-    </dict>
-    <key>RunAtLoad</key><true/>
-    <key>KeepAlive</key><true/>
-  </dict>
-</plist>
-```
-
-SSE MCP (`dev.zocket.mcp-sse.plist`):
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>Label</key><string>dev.zocket.mcp-sse</string>
-    <key>ProgramArguments</key>
-    <array>
-      <string>/Users/YOUR_USER/.local/share/zocket/venv/bin/python3</string>
-      <string>-m</string><string>zocket</string>
-      <string>mcp</string><string>--transport</string><string>sse</string>
-      <string>--mode</string><string>metadata</string>
-      <string>--host</string><string>127.0.0.1</string>
-      <string>--port</string><string>18002</string>
-    </array>
-    <key>EnvironmentVariables</key>
-    <dict>
-      <key>ZOCKET_HOME</key><string>/Users/YOUR_USER/.zocket</string>
-    </dict>
-    <key>RunAtLoad</key><true/>
-    <key>KeepAlive</key><true/>
-  </dict>
-</plist>
-```
+- `~/Library/LaunchAgents/dev.zocket.plist`
 
-Streamable HTTP MCP (`dev.zocket.mcp-streamable.plist`):
+Manual example:
 ```xml
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <key>Label</key><string>dev.zocket.mcp-streamable</string>
+    <key>Label</key><string>dev.zocket</string>
     <key>ProgramArguments</key>
     <array>
-      <string>/Users/YOUR_USER/.local/share/zocket/venv/bin/python3</string>
-      <string>-m</string><string>zocket</string>
-      <string>mcp</string><string>--transport</string><string>streamable-http</string>
-      <string>--mode</string><string>metadata</string>
+      <string>/usr/local/bin/zocket</string>
+      <string>start</string>
       <string>--host</string><string>127.0.0.1</string>
-      <string>--port</string><string>18003</string>
+      <string>--web-port</string><string>18001</string>
+      <string>--mcp-port</string><string>18002</string>
+      <string>--mcp-stream-port</string><string>18003</string>
+      <string>--mode</string><string>admin</string>
     </array>
     <key>EnvironmentVariables</key>
     <dict>
@@ -220,11 +140,9 @@ Streamable HTTP MCP (`dev.zocket.mcp-streamable.plist`):
 </plist>
 ```
 
-Load services:
+Load service:
 ```bash
-launchctl load ~/Library/LaunchAgents/dev.zocket.web.plist
-launchctl load ~/Library/LaunchAgents/dev.zocket.mcp-sse.plist
-launchctl load ~/Library/LaunchAgents/dev.zocket.mcp-streamable.plist
+launchctl load ~/Library/LaunchAgents/dev.zocket.plist
 ```
 
 ### Windows autostart (Task Scheduler)
@@ -234,13 +152,9 @@ powershell -ExecutionPolicy Bypass -File .\scripts\install-zocket.ps1 -EnableAut
 ```
 
 Or create manually:
-- task `ZocketWeb` on logon
-- task `ZocketMcpSse` on logon
-- task `ZocketMcpStreamable` on logon
-- actions:
-  - `python -m zocket web --host 127.0.0.1 --port 18001`
-  - `python -m zocket mcp --transport sse --mode metadata --host 127.0.0.1 --port 18002`
-  - `python -m zocket mcp --transport streamable-http --mode metadata --host 127.0.0.1 --port 18003`
+- task `Zocket` on logon
+- action:
+  - `zocket start --host 127.0.0.1 --web-port 18001 --mcp-port 18002 --mcp-stream-port 18003 --mode admin`
 
 ## 7) First web open
 
@@ -255,5 +169,5 @@ Open `http://127.0.0.1:18001` and choose one:
 curl -I http://127.0.0.1:18001/login
 curl -I http://127.0.0.1:18002/sse
 curl -I http://127.0.0.1:18003/mcp
-zocket mcp --transport stdio --mode metadata
+zocket start --host 127.0.0.1 --web-port 18001 --mcp-port 18002 --mcp-stream-port 18003 --mode admin
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ao_zorin/zocket",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Local encrypted vault + web panel + MCP server for AI agent workflows",
   "type": "module",
   "bin": {

package/scripts/install-zocket.ps1

@@ -1,9 +1,8 @@
 Param(
-  [ValidateSet("Auto", "Local", "Git", "PyPI")]
+  [ValidateSet("Auto", "Local", "Git", "Npm")]
   [string]$Source = "Auto",
-  [string]$RepoUrl = "https://github.com/your-org/zocket.git",
+  [string]$RepoUrl = "https://github.com/aozorin/zocket.git",
   [string]$RepoRef = "main",
-  [string]$InstallRoot = "$env:LOCALAPPDATA\zocket",
   [string]$ZocketHome = "$env:USERPROFILE\.zocket",
   [ValidateSet("en", "ru")]
   [string]$Lang = "en",
@@ -11,105 +10,64 @@ Param(
   [int]$McpPort = 18002,
   [int]$McpStreamPort = 18003,
   [ValidateSet("metadata", "admin")]
-  [string]$McpMode = "metadata",
+  [string]$McpMode = "admin",
   [bool]$EnableAutostart = $true
 )
 
 $ErrorActionPreference = "Stop"
 
-function Resolve-Python {
-  if (Get-Command py -ErrorAction SilentlyContinue) {
-    return @{Cmd = "py"; Prefix = @("-3")}
-  }
-  if (Get-Command python -ErrorAction SilentlyContinue) {
-    return @{Cmd = "python"; Prefix = @()}
+function Ensure-Dir([string]$Path) {
+  if (-not (Test-Path -LiteralPath $Path)) {
+    New-Item -ItemType Directory -Path $Path | Out-Null
   }
-  throw "Python 3.10+ not found. Install Python and rerun."
 }
 
-function Run-Step([string]$Cmd, [string[]]$Args) {
-  & $Cmd @Args
-  if ($LASTEXITCODE -ne 0) {
-    throw "Command failed: $Cmd $($Args -join ' ')"
+function Ensure-Node {
+  if (-not (Get-Command node -ErrorAction SilentlyContinue)) {
+    throw "Node.js not found. Install Node.js 18+ and rerun."
   }
-}
-
-function Ensure-Dir([string]$Path) {
-  if (-not (Test-Path -LiteralPath $Path)) {
-    New-Item -ItemType Directory -Path $Path | Out-Null
+  if (-not (Get-Command npm -ErrorAction SilentlyContinue)) {
+    throw "npm not found. Install Node.js 18+ (includes npm) and rerun."
   }
 }
 
+Ensure-Node
+
 $repoRoot = Split-Path -Parent $PSScriptRoot
 if ($Source -eq "Auto") {
-  if (Test-Path -LiteralPath (Join-Path $repoRoot "pyproject.toml")) {
+  if (Test-Path -LiteralPath (Join-Path $repoRoot "package.json")) {
     $Source = "Local"
   } else {
-    $Source = "Git"
+    $Source = "Npm"
   }
 }
 
-Ensure-Dir $InstallRoot
-$srcDir = Join-Path $InstallRoot "src"
-
-$pkgSource = $null
 if ($Source -eq "Local") {
-  $pkgSource = $repoRoot
+  npm i -g $repoRoot
 } elseif ($Source -eq "Git") {
-  if (Test-Path -LiteralPath (Join-Path $srcDir ".git")) {
-    Run-Step "git" @("-C", $srcDir, "fetch", "--all", "--tags")
-    Run-Step "git" @("-C", $srcDir, "checkout", $RepoRef)
-    Run-Step "git" @("-C", $srcDir, "pull", "--ff-only")
-  } else {
-    if (Test-Path -LiteralPath $srcDir) {
-      Remove-Item -LiteralPath $srcDir -Recurse -Force
-    }
-    Run-Step "git" @("clone", "--depth", "1", "--branch", $RepoRef, $RepoUrl, $srcDir)
-  }
-  $pkgSource = $srcDir
+  npm i -g "git+$RepoUrl#$RepoRef"
 } else {
-  $pkgSource = "zocket"
+  npm i -g @ao_zorin/zocket
 }
 
-$py = Resolve-Python
-$venvDir = Join-Path $InstallRoot "venv"
-$venvPy = Join-Path $venvDir "Scripts\python.exe"
-$zocketExe = Join-Path $venvDir "Scripts\zocket.exe"
-
-Run-Step $py.Cmd ($py.Prefix + @("-m", "venv", $venvDir))
-Run-Step $venvPy @("-m", "pip", "install", "--upgrade", "pip", "setuptools", "wheel")
-
-if ($Source -eq "PyPI") {
-  Run-Step $venvPy @("-m", "pip", "install", "--upgrade", $pkgSource)
-} else {
-  Run-Step $venvPy @("-m", "pip", "install", "--upgrade", $pkgSource)
+$zocketBin = (Get-Command zocket).Source
+if (-not $zocketBin) {
+  throw "zocket binary not found after install"
 }
 
 Ensure-Dir $ZocketHome
 $env:ZOCKET_HOME = $ZocketHome
 
-if (-not (Test-Path -LiteralPath (Join-Path $ZocketHome "vault.enc"))) {
-  Run-Step $zocketExe @("init")
-}
-Run-Step $zocketExe @("config", "set-language", $Lang)
+& $zocketBin init | Out-Null
 
 if ($EnableAutostart) {
-  $webTask = "ZocketWeb"
-  $mcpSseTask = "ZocketMcpSse"
-  $mcpStreamTask = "ZocketMcpStreamable"
-
-  $webCmd = "`"$venvPy`" -m zocket web --host 127.0.0.1 --port $WebPort"
-  $mcpSseCmd = "`"$venvPy`" -m zocket mcp --transport sse --mode $McpMode --host 127.0.0.1 --port $McpPort"
-  $mcpStreamCmd = "`"$venvPy`" -m zocket mcp --transport streamable-http --mode $McpMode --host 127.0.0.1 --port $McpStreamPort"
-
-  schtasks /Create /F /SC ONLOGON /RL LIMITED /TN $webTask /TR $webCmd | Out-Null
-  schtasks /Create /F /SC ONLOGON /RL LIMITED /TN $mcpSseTask /TR $mcpSseCmd | Out-Null
-  schtasks /Create /F /SC ONLOGON /RL LIMITED /TN $mcpStreamTask /TR $mcpStreamCmd | Out-Null
+  $taskName = "Zocket"
+  $cmd = "\"$zocketBin\" start --host 127.0.0.1 --web-port $WebPort --mcp-port $McpPort --mcp-stream-port $McpStreamPort --mode $McpMode"
+  schtasks /Create /F /SC ONLOGON /RL LIMITED /TN $taskName /TR $cmd | Out-Null
 }
 
 Write-Output "zocket installed successfully."
-Write-Output "venv: $venvDir"
-Write-Output "zocket: $zocketExe"
+Write-Output "zocket: $zocketBin"
 Write-Output "ZOCKET_HOME=$ZocketHome"
 Write-Output "web panel: http://127.0.0.1:$WebPort"
 Write-Output "mcp sse:   http://127.0.0.1:$McpPort/sse"

package/scripts/install-zocket.sh

@@ -4,16 +4,15 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_MODE="${SOURCE_MODE:-auto}"         # auto|local|git|pypi
-REPO_URL="${REPO_URL:-https://github.com/your-org/zocket.git}"
+SOURCE_MODE="${SOURCE_MODE:-auto}"         # auto|local|git|npm
+REPO_URL="${REPO_URL:-https://github.com/aozorin/zocket.git}"
 REPO_REF="${REPO_REF:-main}"
-INSTALL_ROOT="${INSTALL_ROOT:-$HOME/.local/share/zocket}"
 ZOCKET_HOME_DIR="${ZOCKET_HOME_DIR:-$HOME/.zocket}"
-LANGUAGE="${LANGUAGE:-en}"                 # en|ru
+LANGUAGE="${LANGUAGE:-en}"                 # en|ru (used by UI; config set via web)
 WEB_PORT="${WEB_PORT:-18001}"
 MCP_PORT="${MCP_PORT:-18002}"
 MCP_STREAM_PORT="${MCP_STREAM_PORT:-18003}"
-MCP_MODE="${MCP_MODE:-metadata}"           # metadata|admin
+MCP_MODE="${MCP_MODE:-admin}"              # metadata|admin
 AUTOSTART="${AUTOSTART:-user}"             # user|system|none
 SERVICE_USER="${SERVICE_USER:-zocketd}"
 
@@ -22,10 +21,9 @@ usage() {
 Usage: $(basename "$0") [options]
 
 Options:
-  --source <auto|local|git|pypi>
+  --source <auto|local|git|npm>
   --repo-url <git-url>
   --repo-ref <branch-or-tag>
-  --install-root <path>
   --zocket-home <path>
   --lang <en|ru>
   --web-port <port>
@@ -45,7 +43,6 @@ while [[ $# -gt 0 ]]; do
     --source) SOURCE_MODE="$2"; shift 2 ;;
     --repo-url) REPO_URL="$2"; shift 2 ;;
     --repo-ref) REPO_REF="$2"; shift 2 ;;
-    --install-root) INSTALL_ROOT="$2"; shift 2 ;;
     --zocket-home) ZOCKET_HOME_DIR="$2"; shift 2 ;;
     --lang) LANGUAGE="$2"; shift 2 ;;
     --web-port) WEB_PORT="$2"; shift 2 ;;
@@ -71,54 +68,100 @@ run_sudo() {
   fi
 }
 
-install_python_linux() {
+install_node_linux() {
   if have_cmd apt-get; then
     run_sudo apt-get update
-    run_sudo apt-get install -y python3 python3-venv python3-pip git curl
+    run_sudo apt-get install -y nodejs npm git curl
     return
   fi
   if have_cmd dnf; then
-    run_sudo dnf install -y python3 python3-pip python3-virtualenv git curl
+    run_sudo dnf install -y nodejs npm git curl
     return
   fi
   if have_cmd yum; then
-    run_sudo yum install -y python3 python3-pip git curl
+    run_sudo yum install -y nodejs npm git curl
     return
   fi
   if have_cmd pacman; then
-    run_sudo pacman -Sy --noconfirm python python-pip git curl
+    run_sudo pacman -Sy --noconfirm nodejs npm git curl
     return
   fi
   if have_cmd zypper; then
-    run_sudo zypper install -y python3 python3-pip python3-virtualenv git curl
+    run_sudo zypper install -y nodejs npm git curl
     return
   fi
   if have_cmd apk; then
-    run_sudo apk add --no-cache python3 py3-pip py3-virtualenv git curl
+    run_sudo apk add --no-cache nodejs npm git curl
     return
   fi
-  echo "Unsupported Linux package manager. Install Python 3.10+, pip, and venv manually." >&2
+  echo "Unsupported Linux package manager. Install Node.js 18+ and npm manually." >&2
   exit 1
 }
 
-install_python_macos() {
+install_node_macos() {
   if ! have_cmd brew; then
     echo "Homebrew not found. Install Homebrew first: https://brew.sh" >&2
     exit 1
   fi
-  brew install python git curl
+  brew install node git curl
 }
 
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+if ! have_cmd node || ! have_cmd npm; then
+  echo "node/npm not found, installing dependencies..."
+  case "$OS" in
+    linux*) install_node_linux ;;
+    darwin*) install_node_macos ;;
+    *)
+      echo "Unsupported OS for this installer: $OS" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+if [[ "$SOURCE_MODE" == "auto" ]]; then
+  if [[ -f "${REPO_ROOT}/package.json" ]]; then
+    SOURCE_MODE="local"
+  else
+    SOURCE_MODE="npm"
+  fi
+fi
+
+case "$SOURCE_MODE" in
+  local)
+    npm i -g "${REPO_ROOT}"
+    ;;
+  git)
+    npm i -g "git+${REPO_URL}#${REPO_REF}"
+    ;;
+  npm)
+    npm i -g @ao_zorin/zocket
+    ;;
+  *)
+    echo "Invalid source mode: $SOURCE_MODE" >&2
+    exit 2
+    ;;
+ esac
+
+ZOCKET_BIN="$(command -v zocket || true)"
+if [[ -z "${ZOCKET_BIN}" ]]; then
+  echo "zocket binary not found after install" >&2
+  exit 1
+fi
+
+export ZOCKET_HOME="${ZOCKET_HOME_DIR}"
+mkdir -p "${ZOCKET_HOME_DIR}"
+"${ZOCKET_BIN}" init >/dev/null
+
 write_systemd_unit() {
   local unit_path="$1"
   local exec_start="$2"
   local svc_user="$3"
   local svc_group="$4"
   local zocket_home="$5"
-  local extra_rw="${6:-}"
   run_sudo tee "${unit_path}" >/dev/null <<EOF
 [Unit]
-Description=Zocket $(basename "${unit_path%.service}")
+Description=Zocket service
 After=network-online.target
 Wants=network-online.target
 
@@ -138,7 +181,7 @@ ProtectKernelTunables=true
 ProtectControlGroups=true
 LockPersonality=true
 MemoryDenyWriteExecute=true
-ReadWritePaths=${zocket_home} ${extra_rw}
+ReadWritePaths=${zocket_home}
 
 [Install]
 WantedBy=multi-user.target
@@ -152,7 +195,7 @@ write_systemd_user_unit() {
   mkdir -p "$(dirname "${unit_path}")"
   cat > "${unit_path}" <<EOF
 [Unit]
-Description=Zocket $(basename "${unit_path%.service}")
+Description=Zocket service
 After=default.target
 
 [Service]
@@ -198,140 +241,33 @@ EOF
 EOF
 }
 
-OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-if ! have_cmd python3; then
-  echo "python3 not found, installing dependencies..."
-  case "$OS" in
-    linux*) install_python_linux ;;
-    darwin*) install_python_macos ;;
-    *)
-      echo "Unsupported OS for this installer: $OS" >&2
-      exit 1
-      ;;
-  esac
-fi
-
-if ! have_cmd git; then
-  echo "git not found, installing..."
-  case "$OS" in
-    linux*) install_python_linux ;;
-    darwin*) install_python_macos ;;
-    *) echo "Install git manually and rerun." >&2; exit 1 ;;
-  esac
-fi
-
-if [[ "$SOURCE_MODE" == "auto" ]]; then
-  if [[ -f "${REPO_ROOT}/pyproject.toml" ]]; then
-    SOURCE_MODE="local"
-  else
-    SOURCE_MODE="git"
-  fi
-fi
-
-PKG_SOURCE=""
-SRC_DIR="${INSTALL_ROOT}/src"
-
-mkdir -p "${INSTALL_ROOT}"
-
-if [[ "$SOURCE_MODE" == "local" ]]; then
-  PKG_SOURCE="${REPO_ROOT}"
-elif [[ "$SOURCE_MODE" == "git" ]]; then
-  if [[ -d "${SRC_DIR}/.git" ]]; then
-    git -C "${SRC_DIR}" fetch --all --tags
-    git -C "${SRC_DIR}" checkout "${REPO_REF}"
-    git -C "${SRC_DIR}" pull --ff-only
-  else
-    rm -rf "${SRC_DIR}"
-    git clone --depth 1 --branch "${REPO_REF}" "${REPO_URL}" "${SRC_DIR}"
-  fi
-  PKG_SOURCE="${SRC_DIR}"
-elif [[ "$SOURCE_MODE" == "pypi" ]]; then
-  PKG_SOURCE="zocket"
-else
-  echo "Invalid source mode: $SOURCE_MODE" >&2
-  exit 2
-fi
-
-VENV_DIR="${INSTALL_ROOT}/venv"
-PY_BIN="${VENV_DIR}/bin/python3"
-ZOCKET_BIN="${VENV_DIR}/bin/zocket"
-
-python3 -m venv "${VENV_DIR}"
-"${PY_BIN}" -m pip install --upgrade pip setuptools wheel
-
-if [[ "$SOURCE_MODE" == "pypi" ]]; then
-  "${PY_BIN}" -m pip install --upgrade "${PKG_SOURCE}"
-else
-  "${PY_BIN}" -m pip install --upgrade "${PKG_SOURCE}"
-fi
-
-mkdir -p "$HOME/.local/bin"
-ln -sf "${ZOCKET_BIN}" "$HOME/.local/bin/zocket"
-
-export ZOCKET_HOME="${ZOCKET_HOME_DIR}"
-mkdir -p "${ZOCKET_HOME_DIR}"
-
-if [[ ! -f "${ZOCKET_HOME_DIR}/vault.enc" ]]; then
-  "${ZOCKET_BIN}" init
-fi
-
-"${ZOCKET_BIN}" config set-language "${LANGUAGE}" >/dev/null
+EXEC_START="${ZOCKET_BIN} start --host 127.0.0.1 --web-port ${WEB_PORT} --mcp-port ${MCP_PORT} --mcp-stream-port ${MCP_STREAM_PORT} --mode ${MCP_MODE}"
 
 if [[ "$AUTOSTART" == "user" && "$OS" == linux* ]]; then
   USER_UNIT_DIR="$HOME/.config/systemd/user"
-  write_systemd_user_unit "${USER_UNIT_DIR}/zocket-web.service" \
-    "${PY_BIN} -m zocket web --host 127.0.0.1 --port ${WEB_PORT}" \
-    "${ZOCKET_HOME_DIR}"
-  write_systemd_user_unit "${USER_UNIT_DIR}/zocket-mcp-sse.service" \
-    "${PY_BIN} -m zocket mcp --transport sse --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_PORT}" \
-    "${ZOCKET_HOME_DIR}"
-  write_systemd_user_unit "${USER_UNIT_DIR}/zocket-mcp-http.service" \
-    "${PY_BIN} -m zocket mcp --transport streamable-http --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_STREAM_PORT}" \
-    "${ZOCKET_HOME_DIR}"
+  write_systemd_user_unit "${USER_UNIT_DIR}/zocket.service" "${EXEC_START}" "${ZOCKET_HOME_DIR}"
   systemctl --user daemon-reload
-  systemctl --user enable --now zocket-web.service zocket-mcp-sse.service zocket-mcp-http.service >/dev/null
+  systemctl --user enable --now zocket.service >/dev/null
 fi
 
 if [[ "$AUTOSTART" == "system" && "$OS" == linux* ]]; then
-  write_systemd_unit "/etc/systemd/system/zocket-web.service" \
-    "${PY_BIN} -m zocket web --host 127.0.0.1 --port ${WEB_PORT}" \
-    "${SERVICE_USER}" "${SERVICE_USER}" "${ZOCKET_HOME_DIR}" "/tmp"
-  write_systemd_unit "/etc/systemd/system/zocket-mcp-sse.service" \
-    "${PY_BIN} -m zocket mcp --transport sse --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_PORT}" \
-    "${SERVICE_USER}" "${SERVICE_USER}" "${ZOCKET_HOME_DIR}"
-  write_systemd_unit "/etc/systemd/system/zocket-mcp-http.service" \
-    "${PY_BIN} -m zocket mcp --transport streamable-http --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_STREAM_PORT}" \
-    "${SERVICE_USER}" "${SERVICE_USER}" "${ZOCKET_HOME_DIR}"
+  write_systemd_unit "/etc/systemd/system/zocket.service" "${EXEC_START}" "${SERVICE_USER}" "${SERVICE_USER}" "${ZOCKET_HOME_DIR}"
   run_sudo systemctl daemon-reload
-  run_sudo systemctl enable --now zocket-web.service zocket-mcp-sse.service zocket-mcp-http.service >/dev/null
+  run_sudo systemctl enable --now zocket.service >/dev/null
 fi
 
 if [[ "$AUTOSTART" != "none" && "$OS" == darwin* ]]; then
   PLIST_DIR="$HOME/Library/LaunchAgents"
-  install_launchd "dev.zocket.web" \
-    "${PY_BIN} -m zocket web --host 127.0.0.1 --port ${WEB_PORT}" \
-    "${ZOCKET_HOME_DIR}" "${PLIST_DIR}"
-  install_launchd "dev.zocket.mcp-sse" \
-    "${PY_BIN} -m zocket mcp --transport sse --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_PORT}" \
-    "${ZOCKET_HOME_DIR}" "${PLIST_DIR}"
-  install_launchd "dev.zocket.mcp-streamable" \
-    "${PY_BIN} -m zocket mcp --transport streamable-http --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_STREAM_PORT}" \
-    "${ZOCKET_HOME_DIR}" "${PLIST_DIR}"
-  launchctl unload "${PLIST_DIR}/dev.zocket.web.plist" >/dev/null 2>&1 || true
-  launchctl unload "${PLIST_DIR}/dev.zocket.mcp-sse.plist" >/dev/null 2>&1 || true
-  launchctl unload "${PLIST_DIR}/dev.zocket.mcp-streamable.plist" >/dev/null 2>&1 || true
-  launchctl load "${PLIST_DIR}/dev.zocket.web.plist"
-  launchctl load "${PLIST_DIR}/dev.zocket.mcp-sse.plist"
-  launchctl load "${PLIST_DIR}/dev.zocket.mcp-streamable.plist"
+  install_launchd "dev.zocket" "${EXEC_START}" "${ZOCKET_HOME_DIR}" "${PLIST_DIR}"
+  launchctl unload "${PLIST_DIR}/dev.zocket.plist" >/dev/null 2>&1 || true
+  launchctl load "${PLIST_DIR}/dev.zocket.plist"
 fi
 
 cat <<EOF
 zocket installed successfully.
 
-Runtime:
-  venv:      ${VENV_DIR}
-  zocket:    ${ZOCKET_BIN}
-  ZOCKET_HOME=${ZOCKET_HOME_DIR}
+zocket:    ${ZOCKET_BIN}
+ZOCKET_HOME=${ZOCKET_HOME_DIR}
 
 Default ports:
   web panel: http://127.0.0.1:${WEB_PORT}
@@ -339,8 +275,5 @@ Default ports:
   MCP HTTP:  http://127.0.0.1:${MCP_STREAM_PORT}/mcp
 
 Next steps:
-  1) Open web: ${ZOCKET_BIN} web --host 127.0.0.1 --port ${WEB_PORT}
-  2) MCP SSE (Claude Code): ${ZOCKET_BIN} mcp --transport sse --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_PORT}
-  3) MCP Streamable (Codex): ${ZOCKET_BIN} mcp --transport streamable-http --mode ${MCP_MODE} --host 127.0.0.1 --port ${MCP_STREAM_PORT}
-  4) MCP stdio: ${ZOCKET_BIN} mcp --transport stdio --mode ${MCP_MODE}
+  1) Start now: ${EXEC_START}
 EOF