@askthew/mcp-plugin 0.4.10 → 0.4.11

package/dist/cli.js

@@ -1,783 +1,315 @@
 #!/usr/bin/env node
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { createAskTheWMcpServer, runInitializeHandshake } from "./index.js";
-import { askTheWDataDir, ensureAskTheWDataDir, identityPath } from "./lib/paths.js";
-import { loadCliCredentials } from "./lib/free-tier-policy.js";
-import { describeFreeIdentity, tryRegisterFreeInstall } from "./lib/free-install-registration.js";
-import { ensureLocalIdentity, loadLocalIdentity, publicIdentity } from "./lib/local-identity.js";
-import { LocalStore } from "./lib/local-store.js";
-import { buildTelemetryPayload } from "./lib/telemetry.js";
-import { syncDryRun, uploadLocalStore } from "./lib/upgrade-sync.js";
-import { installPreCommitHook, localScopeKey, preCommitDecisionGap, stagedFiles, writeWeeklyDigest, } from "./lib/cli-actions.js";
-import { createHostConfigSnippet, defaultServerNameForTier, findInstallReceipts, formatInstallCommand, installBehaviorInstructions, installHostConfig, packageVersion, removeInstallReceipts, sendInstallHeartbeat, uninstallBehaviorInstructions, uninstallHostConfig, upgradePinnedHostConfig, writeInstallReceipt, } from "./install.js";
+import { spawn } from "node:child_process";
+import prompts from "prompts";
+import { AskTheWCloudClient, completeSignup, loadCloudToken, saveCloudToken, startSignup } from "./cloud-client.js";
+import { Outbox } from "./outbox.js";
+import { DEFAULT_SERVER_NAME, dataDirSummary, installHostConfig, packageVersion, writeBehaviorInstructions, writeInstallMetadata, } from "./install.js";
+import { runStdioServer } from "./index.js";
 function usage() {
     return [
-        "Ask The W Coding Agent Connector",
+        "Ask The W MCP",
         "",
         "Usage:",
-        "  askthew-mcp [stdio MCP server when stdin is piped]",
+        "  askthew-mcp",
+        "  askthew-mcp install --host <claude_code|codex|cursor> [--bind <paid-bind-token>] [--skip-auth]",
+        "  askthew-mcp bind [--allow-pending]",
+        "  askthew-mcp token rotate|revoke",
+        "  askthew-mcp export",
+        "  askthew-mcp delete-me --confirm",
         "  askthew-mcp --version",
-        "  askthew-mcp doctor [--server-entrypoint <path>]",
-        "  askthew-mcp install --host <claude_code|codex|cursor> --token <install-token> --api-url <url> [--server-name <name>] [--client-id <id>] [--client-label <label>] [--server-entrypoint <path>] [--dry-run] [--no-agent-instructions]",
-        "  askthew-mcp install --host <claude_code|codex|cursor> --free [--email <email>] [--api-url <url>] [--server-name <name>] [--server-entrypoint <path>] [--dry-run]",
-        "  askthew-mcp refresh --host <claude_code|codex|cursor> [--free] [--token <install-token>] [--api-url <url>] [--server-name <name>] [--server-entrypoint <path>] [--dry-run]",
-        "  askthew-mcp uninstall --host <claude_code|codex|cursor> [--server-name <name>] [--dry-run] [--keep-local-data] [--keep-auth] [--keep-agent-instructions]",
-        "  askthew-mcp upgrade --host <claude_code|codex|cursor> [--server-name <name>] [--version <version>] [--dry-run]",
-        "  askthew-mcp upgrade --browser",
-        "  askthew-mcp identify --email <email> [--no-telemetry]",
-        "  askthew-mcp identity status",
-        "  askthew-mcp auth login --email <email> [--no-telemetry]",
-        "  askthew-mcp auth logout | status",
-        "  askthew-mcp telemetry status | opt-out | opt-in | preview",
-        "  askthew-mcp local stats | reset --hard",
-        "  askthew-mcp install-hook --pre-commit",
-        "  askthew-mcp digest --weekly",
-        "  askthew-mcp sync upload [--token <workspace-install-token>] [--dry-run]",
-        "  askthew-mcp print-config --host <claude_code|codex|cursor> --token <install-token> --api-url <url> --server-name <name> [--client-id <id>] [--client-label <label>]",
     ].join("\n");
 }
-function parseInstallArgs(argv) {
-    let hostType;
-    let clientId = process.env.ASKTHEW_CLIENT_ID?.trim() || "";
-    let clientLabel = process.env.ASKTHEW_CLIENT_LABEL?.trim() || "";
-    let token = normalizeInstallToken(process.env.ASKTHEW_INSTALL_TOKEN) || "";
-    let apiUrl = process.env.ASKTHEW_API_URL?.trim() || "";
-    let serverName = process.env.ASKTHEW_SERVER_NAME?.trim() || "";
-    let serverNameExplicit = Boolean(serverName);
-    let dryRun = false;
-    let installAgentInstructions = true;
-    let free = false;
-    let email = process.env.ASKTHEW_EMAIL?.trim() || "";
-    let serverEntrypoint = process.env.ASKTHEW_SERVER_ENTRYPOINT?.trim() || "";
+function parseArgs(argv) {
+    const result = {};
     for (let index = 0; index < argv.length; index += 1) {
-        const argument = argv[index];
-        if (argument === "--dry-run") {
-            dryRun = true;
-            continue;
-        }
-        if (argument === "--no-agent-instructions") {
-            installAgentInstructions = false;
-            continue;
-        }
-        if (argument === "--free") {
-            free = true;
+        const arg = argv[index];
+        if (!arg.startsWith("--")) {
+            result._ = [String(result._ ?? ""), arg].filter(Boolean).join(" ");
             continue;
         }
         const next = argv[index + 1];
-        if (!next) {
-            throw new Error(`Missing value for ${argument}.`);
-        }
-        if (argument === "--host") {
-            if (next !== "claude_code" && next !== "codex" && next !== "cursor") {
-                throw new Error(`Unsupported host "${next}". Expected claude_code, codex, or cursor.`);
-            }
-            hostType = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--client-id") {
-            clientId = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--client-label") {
-            clientLabel = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--token") {
-            token = normalizeInstallToken(next);
-            index += 1;
+        if (!next || next.startsWith("--")) {
+            result[arg] = true;
             continue;
         }
-        if (argument === "--api-url") {
-            apiUrl = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--server-name") {
-            serverName = next;
-            serverNameExplicit = true;
-            index += 1;
-            continue;
-        }
-        if (argument === "--email") {
-            email = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--server-entrypoint") {
-            serverEntrypoint = next;
-            index += 1;
-            continue;
-        }
-        throw new Error(`Unknown argument: ${argument}`);
-    }
-    if (!hostType) {
-        throw new Error("Missing required --host argument.");
-    }
-    if (!free && !token) {
-        throw new Error("Missing required --token argument.");
+        result[arg] = next;
+        index += 1;
     }
-    if (!apiUrl) {
-        apiUrl = "https://app.askthew.com";
-    }
-    if (!serverName) {
-        serverName = defaultServerNameForTier(free);
-    }
-    return {
-        hostType,
-        clientId: clientId || undefined,
-        clientLabel: clientLabel || undefined,
-        token,
-        apiUrl,
-        serverName,
-        serverNameExplicit,
-        dryRun,
-        installAgentInstructions,
-        free,
-        email: email || undefined,
-        serverEntrypoint: serverEntrypoint ? path.resolve(serverEntrypoint) : undefined,
-    };
+    return result;
 }
-function normalizeInstallToken(token) {
-    return String(token ?? "").trim().replace(/^['"]/, "").replace(/['"]$/, "");
+function stringArg(args, name) {
+    const value = args[name];
+    return typeof value === "string" ? value.trim() : "";
 }
-function detectLoginEmail() {
-    for (const value of [
-        process.env.ASKTHEW_EMAIL,
-        process.env.GIT_AUTHOR_EMAIL,
-        process.env.GIT_COMMITTER_EMAIL,
-        process.env.EMAIL,
-    ]) {
-        const email = String(value ?? "").trim();
-        if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
-            return email;
-    }
-    try {
-        const email = execFileSync("git", ["config", "user.email"], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-        }).trim();
-        if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
-            return email;
-    }
-    catch {
-        return "";
-    }
-    return "";
+function boolArg(args, name) {
+    return args[name] === true;
 }
-function loginCommandHint() {
-    const email = detectLoginEmail();
-    return email
-        ? `askthew-mcp identify --email ${email}`
-        : "askthew-mcp identify --email <your-email>";
+function requireHost(value) {
+    if (value === "claude_code" || value === "codex" || value === "cursor")
+        return value;
+    throw new Error("Missing or invalid --host. Expected claude_code, codex, or cursor.");
 }
-function installIdentityEmail(optionsEmail) {
-    return optionsEmail?.trim() || detectLoginEmail() || undefined;
+function apiUrl(args) {
+    return stringArg(args, "--api-url") || process.env.ASKTHEW_API_URL?.trim() || "https://app.askthew.com";
 }
-async function main() {
-    const [command, ...argv] = process.argv.slice(2);
-    if (command === "--help" || command === "-h" || command === "help") {
-        console.log(usage());
-        return;
-    }
-    if (command === "--version" || command === "-v" || command === "version") {
-        console.log(packageVersion());
-        return;
-    }
-    if (command === "doctor") {
-        await runDoctorCommand(argv);
-        return;
-    }
-    if (command === "print-config") {
-        const options = parseInstallArgs(argv);
-        const snippet = createHostConfigSnippet(options);
-        console.log(snippet.json);
-        return;
-    }
-    if (command === "install") {
-        console.error(`Downloading @askthew/mcp-plugin@${packageVersion()}...`);
-        const options = parseInstallArgs(argv);
-        let freeIdentity = null;
-        if (options.free && !options.dryRun) {
-            freeIdentity = ensureLocalIdentity({
-                emailClaim: installIdentityEmail(options.email),
-                apiUrl: options.apiUrl,
-            });
-        }
-        const result = installHostConfig(options);
-        const instructions = options.installAgentInstructions
-            ? installBehaviorInstructions({
-                hostType: options.hostType,
-                dryRun: options.dryRun,
-            })
-            : null;
-        const receipt = result.wroteFile
-            ? writeInstallReceipt({
-                hostType: options.hostType,
-                serverName: options.serverName,
-                settingsPath: result.settingsPath,
-                cwd: process.cwd(),
-                instructionPaths: instructions?.paths ?? [],
-                serverEntrypoint: options.serverEntrypoint,
-                packageVersion: packageVersion(),
-            })
-            : null;
-        const heartbeatSent = result.wroteFile && !options.free
-            ? await sendInstallHeartbeat(options).catch(() => false)
-            : false;
-        console.log(result.wroteFile ? "Ask The W plugin install complete." : "Ask The W plugin dry run complete.");
-        console.log(`Settings path: ${result.settingsPath}`);
-        if (instructions) {
-            console.log(`${options.dryRun ? "Would update agent instructions" : "Agent instructions"}: ${instructions.paths?.join(", ") ?? instructions.path}`);
-        }
-        if (receipt) {
-            console.log(`Install receipt: ${receipt.hostType}/${receipt.serverName} at ${receipt.cwd}`);
-        }
-        else if (options.dryRun) {
-            console.log(`Would write install receipt: ${options.hostType}/${options.serverName} at ${process.cwd()}`);
-        }
-        console.log(`Install command: ${formatInstallCommand(options)}`);
-        if (result.wroteFile) {
-            if (freeIdentity) {
-                const registration = await tryRegisterFreeInstall({
-                    identity: freeIdentity,
-                    deviceLabel: options.clientLabel ?? `${options.hostType} free install`,
-                    repo: {
-                        repoName: process.env.ASKTHEW_REPO_NAME,
-                        repoRoot: process.env.ASKTHEW_REPO_ROOT,
-                        hostType: options.hostType,
-                    },
-                    options: { apiUrl: options.apiUrl },
-                });
-                console.log(registration.ok ? "Free install identity registered with Ask The W." : "Free install identity saved locally; cloud registration will retry later.");
-            }
-            console.log(options.free
-                ? "Free local mode installed. Restart or reload your coding app; captures and decisions will write to ~/.askthew/store.sqlite."
-                : heartbeatSent
-                    ? "Ask The W install heartbeat sent. Refresh the app to confirm the plugin shows Installed."
-                    : "Ask The W install heartbeat could not be sent yet. Restart or reload your coding app, then refresh Ask The W.");
-        }
-        console.log(`Next step: ${result.nextStep}`);
-        if (!result.wroteFile) {
-            console.log("");
-            console.log("Planned host config:");
-            console.log(result.json);
-        }
-        return;
-    }
-    if (command === "refresh") {
-        await runRefreshCommand(argv);
-        return;
-    }
-    if (command === "identify") {
-        await runIdentifyCommand(argv);
-        return;
-    }
-    if (command === "identity") {
-        await runIdentityCommand(argv);
-        return;
-    }
-    if (command === "uninstall") {
-        await runUninstallCommand(argv);
-        return;
-    }
-    if (command === "auth") {
-        await runAuthCommand(argv);
-        return;
-    }
-    if (command === "telemetry") {
-        await runTelemetryCommand(argv);
-        return;
-    }
-    if (command === "local") {
-        await runLocalCommand(argv);
-        return;
-    }
-    if (command === "install-hook") {
-        await runInstallHookCommand(argv);
-        return;
-    }
-    if (command === "hook-check") {
-        await runHookCheckCommand(argv);
-        return;
-    }
-    if (command === "digest") {
-        await runDigestCommand(argv);
-        return;
-    }
-    if (command === "sync") {
-        await runSyncCommand(argv);
-        return;
-    }
-    if (command === "upgrade") {
-        await runUpgradeCommand(argv);
-        return;
-    }
-    if (command) {
-        throw new Error(`Unknown command "${command}".\n\n${usage()}`);
-    }
-    if (process.stdin.isTTY) {
-        console.log(usage());
-        return;
-    }
-    const server = createAskTheWMcpServer();
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+async function readEmail() {
+    const response = await prompts({
+        type: "text",
+        name: "email",
+        message: "Email for your Ask The W code",
+        validate: (value) => (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value) ? true : "Enter a valid email."),
+    });
+    if (!response.email)
+        throw new Error("Signup cancelled.");
+    return String(response.email);
 }
-async function runUninstallCommand(argv) {
-    let hostType;
-    let serverName = process.env.ASKTHEW_SERVER_NAME?.trim() || undefined;
-    let serverNameExplicit = Boolean(serverName);
-    let dryRun = false;
-    let keepLocalData = false;
-    let keepAuth = false;
-    let keepAgentInstructions = false;
-    for (let index = 0; index < argv.length; index += 1) {
-        const argument = argv[index];
-        if (argument === "--dry-run") {
-            dryRun = true;
-            continue;
-        }
-        if (argument === "--keep-local-data") {
-            keepLocalData = true;
-            continue;
-        }
-        if (argument === "--keep-auth") {
-            keepAuth = true;
-            continue;
-        }
-        if (argument === "--keep-agent-instructions") {
-            keepAgentInstructions = true;
-            continue;
-        }
-        const next = argv[index + 1];
-        if (!next)
-            throw new Error(`Missing value for ${argument}.`);
-        if (argument === "--host") {
-            if (next !== "claude_code" && next !== "codex" && next !== "cursor") {
-                throw new Error(`Unsupported host "${next}". Expected claude_code, codex, or cursor.`);
-            }
-            hostType = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--server-name") {
-            serverName = next;
-            serverNameExplicit = true;
-            index += 1;
-            continue;
-        }
-        throw new Error(`Unknown argument: ${argument}`);
-    }
-    if (!hostType) {
-        throw new Error("Usage: askthew-mcp uninstall --host <claude_code|codex|cursor> [--server-name <name>]");
-    }
-    const receipts = findInstallReceipts({ hostType, serverName });
-    const config = uninstallHostConfig({
-        hostType,
-        serverName: serverNameExplicit ? serverName : undefined,
-        dryRun,
-        cwds: Array.from(new Set([process.cwd(), ...receipts.map((receipt) => receipt.cwd)])),
+async function readCode() {
+    const response = await prompts({
+        type: "text",
+        name: "code",
+        message: "Six-digit Ask The W code",
+        validate: (value) => (/^\d{6}$/.test(value) ? true : "Enter the 6-digit code."),
     });
-    const instructionCwds = Array.from(new Set([process.cwd(), ...receipts.map((receipt) => receipt.cwd)]));
-    const instructionPaths = keepAgentInstructions
-        ? []
-        : instructionCwds.flatMap((cwd) => uninstallBehaviorInstructions({ hostType, dryRun, cwd }).paths);
-    const dataDir = askTheWDataDir();
-    const hadLocalData = fs.existsSync(dataDir);
-    const authFile = identityPath();
-    const hadAuth = fs.existsSync(authFile);
-    const removedReceipts = dryRun ? receipts.length : removeInstallReceipts({ hostType, serverName });
-    if (!keepLocalData && !dryRun) {
-        fs.rmSync(dataDir, { recursive: true, force: true });
-    }
-    if (!keepAuth && !dryRun) {
-        if (fs.existsSync(authFile))
-            fs.rmSync(authFile, { force: true });
-    }
-    console.log(dryRun ? "Ask The W plugin uninstall dry run complete." : "Ask The W plugin uninstall complete.");
-    console.log(`Settings path: ${config.settingsPath}`);
-    console.log(config.removedServer
-        ? `${dryRun ? "Would remove" : "Removed"} MCP server "${config.removedServerName}".`
-        : config.foundConfigFile
-            ? `No MCP server "${config.removedServerName}" found in host config.`
-            : "No host config file found.");
-    if (!keepAgentInstructions) {
-        console.log(instructionPaths.length > 0
-            ? `Agent instructions ${dryRun ? "would be removed from" : "removed from"}: ${Array.from(new Set(instructionPaths)).join(", ")}`
-            : "No Ask The W agent instruction blocks found.");
-    }
-    console.log(removedReceipts > 0
-        ? `${dryRun ? "Would remove" : "Removed"} ${removedReceipts} install receipt${removedReceipts === 1 ? "" : "s"}.`
-        : "No install receipts found.");
-    console.log(keepLocalData
-        ? "Local data kept."
-        : hadLocalData
-            ? `${dryRun ? "Local data would be removed" : "Local data removed"}.`
-            : "No local data directory found.");
-    console.log(keepAuth
-        ? "Auth tokens kept."
-        : hadAuth
-            ? `${dryRun ? "Local identity would be removed" : "Local identity removed"}.`
-            : "No local identity found.");
-    if (dryRun) {
-        console.log("");
-        console.log(config.json);
-    }
+    if (!response.code)
+        throw new Error("Signup cancelled.");
+    return String(response.code);
 }
-async function runRefreshCommand(argv) {
-    const parsed = parseInstallArgs(["--free", ...argv]);
-    const isPaidRefresh = Boolean(parsed.token && !argv.includes("--free"));
-    const options = {
-        ...parsed,
-        free: !isPaidRefresh,
-        serverName: parsed.serverNameExplicit
-            ? parsed.serverName
-            : defaultServerNameForTier(!isPaidRefresh),
-    };
-    const existingIdentity = loadLocalIdentity();
-    let freeIdentity = existingIdentity;
-    if (options.free && !options.dryRun && !freeIdentity) {
-        freeIdentity = ensureLocalIdentity({
-            emailClaim: options.email,
-            apiUrl: options.apiUrl,
-        });
-    }
-    const uninstall = uninstallHostConfig({
-        hostType: options.hostType,
-        serverName: options.serverName,
-        dryRun: options.dryRun,
+async function exchangePaidBindToken(input) {
+    const response = await fetch(`${input.apiUrl.replace(/\/+$/, "")}/api/v1/agent/paid/install-token/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            paid_bind_token: input.paidBindToken,
+            client_hint: input.hostType,
+        }),
     });
-    const removedInstructions = uninstallBehaviorInstructions({
-        hostType: options.hostType,
-        dryRun: options.dryRun,
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || !body?.ok || !body.token || !body.install_id) {
+        throw new Error(String(body?.message ?? body?.code ?? "Paid install token exchange failed."));
+    }
+    saveCloudToken({
+        token: body.token,
+        install_id: body.install_id,
+        tier: "paid",
+        workspace_id: body.workspace_id ?? null,
+        token_purpose: "device",
+        api_url: input.apiUrl,
     });
-    const install = installHostConfig(options);
-    const installedInstructions = options.installAgentInstructions
-        ? installBehaviorInstructions({
-            hostType: options.hostType,
-            dryRun: options.dryRun,
-        })
-        : null;
-    const receipt = install.wroteFile
-        ? writeInstallReceipt({
-            hostType: options.hostType,
-            serverName: options.serverName,
-            settingsPath: install.settingsPath,
-            cwd: process.cwd(),
-            instructionPaths: installedInstructions?.paths ?? [],
-            serverEntrypoint: options.serverEntrypoint,
-            packageVersion: packageVersion(),
-        })
-        : null;
-    if (options.free && freeIdentity && !options.dryRun) {
-        await tryRegisterFreeInstall({
-            identity: freeIdentity,
-            deviceLabel: options.clientLabel ?? `${options.hostType} free refresh`,
-            repo: {
-                repoName: process.env.ASKTHEW_REPO_NAME,
-                repoRoot: process.env.ASKTHEW_REPO_ROOT,
-                hostType: options.hostType,
-            },
-            options: { apiUrl: options.apiUrl },
+    return body;
+}
+async function authenticateInstall(input) {
+    if (input.bindToken) {
+        return exchangePaidBindToken({
+            paidBindToken: input.bindToken,
+            hostType: input.hostType,
+            apiUrl: input.apiUrl,
         });
     }
-    console.log(options.dryRun ? "Ask The W plugin refresh dry run complete." : "Ask The W plugin refresh complete.");
-    console.log(`Plugin package version: ${packageVersion()}`);
-    console.log(`Settings path: ${install.settingsPath}`);
-    console.log(`Removed instructions: ${removedInstructions.paths.join(", ") || "none"}`);
-    if (installedInstructions) {
-        console.log(`Installed instructions: ${installedInstructions.paths.join(", ") || installedInstructions.path}`);
-    }
-    if (receipt) {
-        console.log(`Install receipt: ${receipt.hostType}/${receipt.serverName} at ${receipt.cwd}`);
-    }
-    if (options.free) {
-        console.log(freeIdentity
-            ? `Local identity preserved: ${freeIdentity.installId}`
-            : "Local identity would be created on a non-dry-run refresh.");
-        console.log("Local data preserved: ~/.askthew/store.sqlite");
-    }
-    else {
-        const heartbeatSent = install.wroteFile
-            ? await sendInstallHeartbeat(options).catch(() => false)
-            : false;
-        console.log(heartbeatSent ? "Paid workspace heartbeat sent." : "Paid workspace heartbeat not sent yet.");
-    }
-    console.log(`Next step: ${install.nextStep}`);
-    if (options.dryRun) {
-        console.log("");
-        console.log(uninstall.json);
-        console.log("");
-        console.log(install.json);
-    }
-}
-async function runDoctorCommand(argv) {
-    const serverEntrypoint = argValue(argv, "--server-entrypoint")?.trim();
-    const result = await runInitializeHandshake({
-        entrypoint: serverEntrypoint ? path.resolve(serverEntrypoint) : undefined,
+    const email = await readEmail();
+    const started = await startSignup({
+        email,
+        apiUrl: input.apiUrl,
+        clientHint: input.hostType,
+    });
+    if (!started?.ok)
+        throw new Error(String(started?.message ?? started?.code ?? "Could not send signup code."));
+    const code = await readCode();
+    const completed = await completeSignup({
+        email,
+        code,
+        apiUrl: input.apiUrl,
+        clientHint: input.hostType,
+        tokenPurpose: "device",
     });
-    const expectedVersion = packageVersion();
-    if (result.serverInfoVersion !== expectedVersion) {
-        throw new Error(`MCP initialize version mismatch: package.json=${expectedVersion} serverInfo.version=${result.serverInfoVersion ?? "missing"}`);
+    if (!completed?.ok) {
+        throw new Error(String(completed?.message ?? completed?.code ?? "Could not verify signup code."));
     }
-    console.log("Ask The W MCP doctor passed.");
-    console.log(`Package version: ${expectedVersion}`);
-    console.log(`serverInfo.version: ${result.serverInfoVersion}`);
+    return completed;
 }
-async function runUpgradeCommand(argv) {
-    if (argv.includes("--browser")) {
-        console.log("Open https://askthew.com/plugin to manage workspace upgrades.");
-        return;
-    }
-    let hostType = process.env.ASKTHEW_HOST_TYPE?.trim();
-    if (hostType !== "claude_code" && hostType !== "codex" && hostType !== "cursor") {
-        hostType = undefined;
+async function installCommand(argv) {
+    const args = parseArgs(argv);
+    const hostType = requireHost(stringArg(args, "--host"));
+    const baseUrl = apiUrl(args);
+    const bindToken = stringArg(args, "--bind") || undefined;
+    const skipAuth = boolArg(args, "--skip-auth");
+    const dryRun = boolArg(args, "--dry-run");
+    let workspaceId;
+    if (!skipAuth && !dryRun) {
+        const auth = await authenticateInstall({ hostType, bindToken, apiUrl: baseUrl });
+        workspaceId = auth.workspace_id ?? null;
+    }
+    else if (!dryRun && !loadCloudToken()) {
+        throw new Error("--skip-auth requires an existing ~/.askthew/cloud-token.json.");
     }
-    let serverName = process.env.ASKTHEW_SERVER_NAME?.trim() || undefined;
-    let serverNameExplicit = Boolean(serverName);
-    let version = process.env.ASKTHEW_PIN?.trim() || packageVersion();
-    let dryRun = false;
-    for (let index = 0; index < argv.length; index += 1) {
-        const argument = argv[index];
-        if (argument === "--dry-run") {
-            dryRun = true;
-            continue;
-        }
-        const next = argv[index + 1];
-        if (!next)
-            throw new Error(`Missing value for ${argument}.`);
-        if (argument === "--host") {
-            if (next !== "claude_code" && next !== "codex" && next !== "cursor") {
-                throw new Error(`Unsupported host "${next}". Expected claude_code, codex, or cursor.`);
-            }
-            hostType = next;
-            index += 1;
-            continue;
-        }
-        if (argument === "--server-name") {
-            serverName = next;
-            serverNameExplicit = true;
-            index += 1;
-            continue;
-        }
-        if (argument === "--version" || argument === "--pin") {
-            version = next;
-            index += 1;
-            continue;
+    try {
+        const config = installHostConfig({
+            hostType,
+            apiUrl: baseUrl,
+            serverName: DEFAULT_SERVER_NAME,
+            dryRun,
+        });
+        const instructions = writeBehaviorInstructions({ hostType, dryRun });
+        if (!dryRun) {
+            writeInstallMetadata({
+                hostType,
+                apiUrl: baseUrl,
+                tier: bindToken ? "paid" : "free",
+                workspaceId,
+            });
         }
-        throw new Error(`Unknown argument: ${argument}`);
+        console.log(`Ask The W installed for ${hostType}.`);
+        console.log(`MCP config: ${config.settingsPath}`);
+        console.log(`Agent instructions: ${instructions.filePath}`);
+        console.log("Restart your coding agent so it loads the new MCP server and instructions.");
     }
-    if (!hostType) {
-        throw new Error("Usage: askthew-mcp upgrade --host <claude_code|codex|cursor> [--server-name <name>] [--version <version>] [--dry-run]");
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown install failure.";
+        console.error(`Install reached auth, but writing local config failed: ${message}`);
+        console.error(`Your token is still saved under ${dataDirSummary()}.`);
+        console.error(`Retry local writes with: askthew-mcp install --host ${hostType} --skip-auth`);
+        process.exitCode = 1;
     }
-    const packageSpec = version.startsWith("@askthew/mcp-plugin@")
-        ? version
-        : `@askthew/mcp-plugin@${version}`;
-    if (!dryRun) {
-        const handshake = await runInitializeHandshake();
-        if (handshake.serverInfoVersion !== packageVersion()) {
-            throw new Error(`Refusing to upgrade pinned host config: MCP initialize returned ${handshake.serverInfoVersion ?? "missing"} but package.json is ${packageVersion()}.`);
-        }
+}
+function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        const child = spawn(command, args, { detached: true, stdio: "ignore" });
+        child.unref();
     }
-    const receipts = findInstallReceipts({
-        hostType,
-        serverName: serverNameExplicit ? serverName : undefined,
-    });
-    const result = upgradePinnedHostConfig({
-        hostType,
-        serverName: serverNameExplicit ? serverName : undefined,
-        packageSpec,
-        dryRun,
-        cwds: Array.from(new Set([process.cwd(), ...receipts.map((receipt) => receipt.cwd)])),
-    });
-    console.log(dryRun ? "Ask The W plugin upgrade dry run complete." : "Ask The W plugin upgrade complete.");
-    console.log(`Settings path: ${result.settingsPath}`);
-    console.log(`Pinned package: ${result.packageSpec}`);
-    console.log(result.upgradedServer
-        ? `${dryRun ? "Would update" : "Updated"} MCP server pin${result.upgradedServerNames.length ? `: ${result.upgradedServerNames.join(", ")}` : "."}`
-        : result.foundConfigFile
-            ? "No Ask The W MCP server pins needed an update."
-            : "No host config file found.");
-    if (dryRun && result.json) {
-        console.log("");
-        console.log(result.json);
+    catch {
+        // Printing the URL is enough for headless terminals.
     }
 }
-function argValue(argv, name) {
-    const index = argv.indexOf(name);
-    return index >= 0 ? argv[index + 1] : undefined;
+async function bindCommand(argv) {
+    const args = parseArgs(argv);
+    const allowPending = boolArg(args, "--allow-pending");
+    const client = new AskTheWCloudClient({ apiUrl: apiUrl(args) });
+    if (!client.hasToken())
+        throw new Error("Run askthew-mcp install first.");
+    const outbox = new Outbox();
+    if (outbox.pendingCount() > 0) {
+        await outbox.flush(client);
+    }
+    if (outbox.pendingCount() > 0 && !allowPending) {
+        const response = await prompts({
+            type: "confirm",
+            name: "ok",
+            message: `${outbox.pendingCount()} captures have not synced yet. Bind anyway?`,
+            initial: false,
+        });
+        if (!response.ok)
+            throw new Error("Bind cancelled while captures are pending.");
+    }
+    const started = await client.request("/paid/bind/start", { method: "POST", body: "{}" });
+    const body = started.body;
+    if (!started.ok || body.ok === false) {
+        throw new Error(String(body.message ?? body.code ?? "Could not start paid binding."));
+    }
+    const codeDisplay = String(body.code_display ?? "");
+    const url = String(body.url ?? "");
+    console.log(`Open this URL: ${url}`);
+    console.log(`Confirm this terminal code in the browser: ${codeDisplay}`);
+    if (url)
+        openBrowser(url);
+    for (let attempt = 0; attempt < 120; attempt += 1) {
+        await new Promise((resolve) => setTimeout(resolve, 5000));
+        const status = await client.request(`/paid/bind/status?code_display=${encodeURIComponent(codeDisplay)}`, { method: "GET" });
+        const statusBody = status.body;
+        if (status.ok && statusBody.status === "completed") {
+            console.log("Ask The W install is now bound to the workspace.");
+            return;
+        }
+    }
+    throw new Error("Timed out waiting for workspace binding.");
 }
-export async function runAuthCommand(argv, deps = {}) {
-    const log = deps.log ?? console.log;
-    const registerInstall = deps.registerFreeInstall ?? tryRegisterFreeInstall;
-    const [subcommand] = argv;
-    if (subcommand === "status") {
-        const identity = loadLocalIdentity();
-        log(identity
-            ? `Identified local free install ${identity.installId}${identity.emailClaim ? ` with email claim ${identity.emailClaim}` : ""}. Email claim is unverified until upgrade.`
-            : `No local identity yet. Run \`askthew-mcp identify --email <your-email>\`, or install with \`--free --email <your-email>\`.`);
+async function tokenCommand(argv) {
+    const [action] = argv;
+    const client = new AskTheWCloudClient();
+    if (action === "rotate") {
+        const result = await client.request("/token/rotate", { method: "POST", body: "{}" });
+        const body = result.body;
+        if (!result.ok || body.ok === false)
+            throw new Error(String(body.message ?? body.code ?? "Token rotate failed."));
+        const tokenFile = loadCloudToken();
+        if (tokenFile && typeof body.token === "string") {
+            saveCloudToken({ ...tokenFile, token: body.token });
+        }
+        console.log("Ask The W token rotated. Restart your coding agent.");
         return;
     }
-    if (subcommand === "logout") {
-        const file = identityPath();
-        if (fs.existsSync(file))
-            fs.rmSync(file);
-        log("Removed Ask The W local free install identity.");
+    if (action === "revoke") {
+        const result = await client.request("/token/revoke", { method: "POST", body: "{}" });
+        const body = result.body;
+        if (!result.ok || body.ok === false)
+            throw new Error(String(body.message ?? body.code ?? "Token revoke failed."));
+        console.log("Current Ask The W token revoked.");
         return;
     }
-    if (subcommand !== "login") {
-        throw new Error("Usage: askthew-mcp auth login --email <email> [--no-telemetry] | askthew-mcp auth logout | status");
-    }
-    ensureAskTheWDataDir();
-    const email = argValue(argv, "--email")?.trim();
-    if (!email)
-        throw new Error("Missing --email.");
-    const noTelemetry = argv.includes("--no-telemetry");
-    const identity = ensureLocalIdentity({ emailClaim: email, telemetryOptOut: noTelemetry });
-    const registration = await registerInstall({
-        identity,
-        deviceLabel: "askthew-mcp",
-    });
-    log(`Local free install identified as ${identity.installId}.`);
-    log(`Email claim: ${identity.emailClaim ?? "none"} (unverified until upgrade).`);
-    log(`Claim code: ${identity.claimCode}`);
-    log(registration.ok ? "Registered install with Ask The W." : "Saved locally; cloud registration will retry later.");
-    log("No email code is required for free local capture.");
-    return;
+    throw new Error("Usage: askthew-mcp token rotate|revoke");
 }
-async function runIdentifyCommand(argv) {
-    const email = argValue(argv, "--email")?.trim() || detectLoginEmail();
-    const noTelemetry = argv.includes("--no-telemetry");
-    if (!email)
-        throw new Error("Missing --email.");
-    const identity = ensureLocalIdentity({ emailClaim: email, telemetryOptOut: noTelemetry });
-    const registration = await tryRegisterFreeInstall({
-        identity,
-        deviceLabel: "askthew-mcp",
-    });
-    console.log(`Local free install identified as ${identity.installId}.`);
-    console.log(`Email claim: ${identity.emailClaim ?? "none"} (unverified until upgrade).`);
-    console.log(`Claim code: ${identity.claimCode}`);
-    console.log(registration.ok ? "Registered install with Ask The W." : "Saved locally; cloud registration will retry later.");
+async function exportCommand() {
+    const client = new AskTheWCloudClient();
+    const result = await client.request("/export", { method: "GET" });
+    if (!result.ok) {
+        const body = result.body;
+        throw new Error(String(body.message ?? body.code ?? "Export failed."));
+    }
+    console.log(JSON.stringify(result.body, null, 2));
 }
-async function runIdentityCommand(argv) {
-    const [subcommand] = argv;
-    if (subcommand !== "status") {
-        throw new Error("Usage: askthew-mcp identity status");
-    }
-    const identity = loadLocalIdentity();
-    if (!identity) {
-        console.log("No local free install identity yet.");
-        return;
-    }
-    console.log(describeFreeIdentity(publicIdentity(identity)));
-    console.log("Email claims are attribution only; upgrade/import requires local possession proof.");
+async function deleteMeCommand(argv) {
+    const args = parseArgs(argv);
+    if (!boolArg(args, "--confirm")) {
+        throw new Error("Refusing to delete without --confirm.");
+    }
+    const tokenFile = loadCloudToken();
+    if (tokenFile?.tier === "paid") {
+        console.error("This install is workspace-bound. Install-scoped data will be deleted; workspace data is retained.");
+    }
+    const client = new AskTheWCloudClient();
+    const result = await client.request("/me", { method: "DELETE" });
+    const body = result.body;
+    if (!result.ok || body.ok === false)
+        throw new Error(String(body.message ?? body.code ?? "Delete failed."));
+    console.log(JSON.stringify(body, null, 2));
 }
-async function runTelemetryCommand(argv) {
-    const [subcommand] = argv;
-    const credentials = loadCliCredentials();
-    if (!credentials)
-        throw new Error("No local identity. Run `askthew-mcp identify --email <your-email>` first.");
-    if (subcommand === "status") {
-        console.log(`Telemetry: ${credentials.telemetryOptOut ? "off" : "on"}`);
+async function main() {
+    const [command, ...argv] = process.argv.slice(2);
+    if (!command) {
+        await runStdioServer();
         return;
     }
-    if (subcommand === "opt-out" || subcommand === "opt-in") {
-        ensureLocalIdentity({ telemetryOptOut: subcommand === "opt-out" });
-        console.log(`Telemetry: ${subcommand === "opt-out" ? "off" : "on"}`);
+    if (command === "--help" || command === "-h" || command === "help") {
+        console.log(usage());
         return;
     }
-    if (subcommand === "preview") {
-        const store = LocalStore.open();
-        console.log(JSON.stringify(buildTelemetryPayload({ store, credentials }), null, 2));
+    if (command === "--version" || command === "-v" || command === "version") {
+        console.log(packageVersion());
         return;
     }
-    throw new Error("Usage: askthew-mcp telemetry status | opt-out | opt-in | preview");
-}
-async function runLocalCommand(argv) {
-    const [subcommand, flag] = argv;
-    const store = LocalStore.open();
-    if (subcommand === "stats") {
-        console.log(JSON.stringify(store.stats(), null, 2));
+    if (command === "install") {
+        await installCommand(argv);
         return;
     }
-    if (subcommand === "reset" && flag === "--hard") {
-        const dir = ensureAskTheWDataDir();
-        fs.rmSync(dir, { recursive: true, force: true });
-        console.log("Local Ask The W data removed.");
+    if (command === "bind") {
+        await bindCommand(argv);
         return;
     }
-    throw new Error("Usage: askthew-mcp local stats | reset --hard");
-}
-async function runInstallHookCommand(argv) {
-    if (!argv.includes("--pre-commit")) {
-        throw new Error("Usage: askthew-mcp install-hook --pre-commit");
-    }
-    const hookPath = installPreCommitHook();
-    console.log(`Ask The W pre-commit hook installed: ${hookPath}`);
-}
-async function runHookCheckCommand(argv) {
-    if (!argv.includes("--pre-commit")) {
-        throw new Error("Usage: askthew-mcp hook-check --pre-commit");
-    }
-    const store = LocalStore.open();
-    const gap = preCommitDecisionGap({ store, stagedFiles: stagedFiles(), scopeKey: localScopeKey() });
-    if (gap.missing) {
-        console.log('Ask The W: this change has no decision attached, draft one?');
-        console.log("Run: npx -y --prefer-online --package @askthew/mcp-plugin@latest askthew-mcp digest --weekly or ask your agent to call promote_signal_to_decision.");
-    }
-}
-async function runDigestCommand(argv) {
-    if (!argv.includes("--weekly")) {
-        throw new Error("Usage: askthew-mcp digest --weekly");
+    if (command === "token") {
+        await tokenCommand(argv);
+        return;
     }
-    const store = LocalStore.open();
-    const filePath = writeWeeklyDigest({ store });
-    console.log(`Weekly decision digest written: ${filePath}`);
-}
-async function runSyncCommand(argv) {
-    if (argv[0] !== "upload")
-        throw new Error("Usage: askthew-mcp sync upload [--token <workspace-install-token>] [--dry-run]");
-    const credentials = loadCliCredentials();
-    if (!credentials)
-        throw new Error("No local identity. Run `askthew-mcp identify --email <your-email>` first.");
-    const store = LocalStore.open();
-    if (argv.includes("--dry-run")) {
-        console.log(JSON.stringify(syncDryRun(store), null, 2));
+    if (command === "export") {
+        await exportCommand();
         return;
     }
-    const syncToken = argValue(argv, "--token")?.trim() || process.env.ASKTHEW_INSTALL_TOKEN?.trim();
-    if (!syncToken) {
-        throw new Error("Missing workspace install token. Pass `--token <workspace-install-token>` after upgrading.");
+    if (command === "delete-me") {
+        await deleteMeCommand(argv);
+        return;
     }
-    console.log(JSON.stringify(await uploadLocalStore({ store, credentials, syncToken }), null, 2));
-}
-const isDirectCliExecution = Boolean(process.argv[1]) &&
-    (() => {
-        const cliPath = fileURLToPath(import.meta.url);
-        const invokedPath = path.resolve(process.argv[1]);
-        try {
-            return fs.realpathSync(invokedPath) === fs.realpathSync(cliPath);
-        }
-        catch {
-            return invokedPath === cliPath;
-        }
-    })();
-if (isDirectCliExecution) {
-    main().catch((error) => {
-        if (error instanceof Error) {
-            console.error(error.message);
-        }
-        else {
-            console.error("Ask The W plugin failed to start.", error);
-        }
-        process.exit(1);
-    });
+    throw new Error(`Unknown command: ${command}\n\n${usage()}`);
 }
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+});