@contextq/cli 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,95 +1,122 @@
 #!/usr/bin/env node
-/**
- * contextq — one-command installer.
- *
- * `npx @contextq/cli init` detects which surface(s) are present -- Claude Code
- * project, Codex CLI project (T665), or neither (Desktop/Cowork) -- and
- * scaffolds the matching wiring: for Claude Code, .mcp.json + the contextq
- * SessionStart hook + .contextq/tasks/; for Codex, a `.codex/hooks.json`
- * SessionStart hook (see cli/src/session-hook.ts for why the two harnesses
- * share one command builder and one merge implementation). A repo can be
- * (and often is) both at once -- both get wired in the same run unless
- * `--surface` pins exactly one. Neither detected -> print the manual
- * 3-step connect guide instead. Idempotent throughout: re-running reports
- * "already configured" / "[skip]" for anything already wired and writes
- * nothing new.
- */
-import { basename } from 'node:path';
-import { detectSurface } from './detect.js';
-import { decideCredentialWrite, KEY_RE, readExistingCreds } from './platform-cred.js';
-import { wireMcpJson } from './mcp-config.js';
-import { wireCodexSessionHook, wireSessionHook } from './session-hook.js';
-import { initTasksDir } from './tasks-init.js';
-import { printDesktopGuide } from './desktop-guide.js';
-import { promptHidden } from './prompt.js';
-import { SLUG_PATTERN_DESCRIPTION, sanitizeSlugFallback, validateSlug } from './slug.js';
-import { syncSkills } from './skills-sync.js';
-const DEFAULT_URL = 'https://app.contextq.dev';
-function parseArgs(argv) {
-    const hasLeadingCommand = argv.length > 0 && !argv[0].startsWith('-');
-    const args = { command: hasLeadingCommand ? argv[0] : '', embedKey: false, help: false };
-    for (let i = hasLeadingCommand ? 1 : 0; i < argv.length; i++) {
-        const a = argv[i];
-        switch (a) {
-            case '--key':
-                args.key = argv[++i];
-                break;
-            case '--url':
-                args.url = argv[++i];
-                break;
-            case '--workspace':
-                args.workspace = argv[++i];
-                break;
-            case '--agent':
-                args.agent = argv[++i];
-                break;
-            case '--embed-key':
-                args.embedKey = true;
-                break;
-            case '--surface': {
-                const v = argv[++i];
-                if (v !== 'claude-code' && v !== 'codex') {
-                    throw new Error(`--surface value "${v}" is invalid -- allowed: claude-code, codex`);
-                }
-                args.surface = v;
-                break;
-            }
-            case '-h':
-            case '--help':
-                args.help = true;
-                break;
-            default:
-                throw new Error(`unknown argument: ${a}`);
-        }
-    }
-    return args;
-}
-function printHelp() {
-    console.log(`contextq — one-command installer for ContextQ
+var bt=Object.defineProperty;var s=(e,t)=>bt(e,"name",{value:t,configurable:!0});var M=(e,t)=>()=>(e&&(t=e(e=0)),t);var ye=(e,t)=>{for(var n in t)bt(e,n,{get:t[n],enumerable:!0})};import{chmodSync as We,copyFileSync as io,existsSync as be,mkdirSync as so,readFileSync as ao,writeFileSync as co}from"fs";import{homedir as lo}from"os";import{join as D}from"path";function ze(){let e=process.env.CTQ_CRED_DIR||process.env.CONTEXTQ_CRED_DIR;if(e)return e;let t=uo.map(po);return t.find(n=>be(D(n,"credentials")))??t[0]}function po(e){let t=lo();if(process.platform==="darwin")return D(t,"Library","Application Support",e);if(process.platform==="win32"){let o=process.env.APPDATA??D(t,"AppData","Roaming");return D(o,e)}let n=process.env.XDG_CONFIG_HOME??D(t,".config");return D(n,e)}function _(){return D(ze(),"credentials")}function Ze(){return be(_())}function go(e,t){return e.apiKey===t.apiKey&&e.apiUrl===t.apiUrl}function fo(){let e=new Date,t=s(n=>String(n).padStart(2,"0"),"pad");return`${e.getUTCFullYear()}${t(e.getUTCMonth()+1)}${t(e.getUTCDate())}T${t(e.getUTCHours())}${t(e.getUTCMinutes())}${t(e.getUTCSeconds())}Z`}function mo(){let e=_();if(!be(e))return null;let t=ze(),n=D(t,`credentials.bak-${fo()}`);return io(e,n),We(n,384),n}function xe(e,t){if(!be(t))return"";try{let n=ao(t,"utf-8");for(let o of n.split(`
+`))if(o.startsWith(`${e}=`))return o.slice(e.length+1).trim()}catch{}return""}function R(){let e=_(),t=xe("CTQ_API_KEY",e)||xe("CONTEXT_API_KEY",e),n=xe("CTQ_API_URL",e)||xe("CONTEXT_API_URL",e);return{apiKey:t,apiUrl:n}}function Tt(e){let t=ze(),n=_();so(t,{recursive:!0,mode:448}),We(t,448);let o=`CTQ_API_KEY=${e.apiKey}
+CTQ_API_URL=${e.apiUrl}
+CONTEXT_API_KEY=${e.apiKey}
+CONTEXT_API_URL=${e.apiUrl}
+`;return co(n,o,{mode:384}),We(n,384),n}function U(e){let t=R(),n=Ze(),o=s(r=>{if(!n)return Tt(r),{action:"created",backupPath:null};if(go(t,r))return{action:"skipped",backupPath:null};let i=mo();return Tt(r),{action:"rotated",backupPath:i}},"writeSafely");if(e.explicitKey){if(!T.test(e.explicitKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.explicitKey,i=o({apiKey:r,apiUrl:e.apiUrl}),c=i.action==="skipped"?`${Ge} credentials (unchanged)`:i.action==="rotated"?`${Rt} credentials (${_()}; previous saved to ${i.backupPath})`:`${At} credentials (${_()}, mode 600)`;return{apiKey:r,credLine:c,action:i.action,backupPath:i.backupPath}}if(n&&t.apiKey){let r=e.ambientVarName?`${Ge} credentials (already configured at ${_()}; env ${e.ambientVarName} ignored, pass --key to rotate)`:`${Ge} credentials (already configured at ${_()}; pass --key to rotate)`;return{apiKey:t.apiKey,credLine:r,action:"skipped",backupPath:null}}if(e.ambientKey){if(!T.test(e.ambientKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.ambientKey,i=o({apiKey:r,apiUrl:e.apiUrl}),c=i.action==="rotated"?`${Rt} credentials (${_()}; previous saved to ${i.backupPath})`:`${At} credentials (${_()}, mode 600)`;return{apiKey:r,credLine:c,action:i.action,backupPath:i.backupPath}}return{apiKey:"",credLine:"",action:null,backupPath:null}}var uo,T,At,Rt,Ge,B=M(()=>{"use strict";s(ze,"platformCredDir");uo=["contextq","ctq-brain"];s(po,"platformCredDirFor");s(_,"platformCredFile");s(Ze,"credsFileExists");s(go,"credsEqual");s(fo,"utcTimestamp");s(mo,"backupCredsFile");s(xe,"readEnvVal");s(R,"readExistingCreds");s(Tt,"writeCreds");T=/^sk_live_[0-9a-f]{40}$/,At="[create]",Rt="[rotate]",Ge="[skip] ";s(U,"decideCredentialWrite")});import{spawnSync as nt}from"child_process";import{existsSync as nr,readFileSync as or}from"fs";import{join as rr}from"path";function tn(e){return e[ot]||"claude"}function ir(e){let t=/(\d+)\.(\d+)\.(\d+)/.exec(e);return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}function sr(e,t){for(let n=0;n<3;n++)if(e[n]!==t[n])return e[n]>t[n];return!0}function nn(e){let t=rr(e,".mcp.json");if(!nr(t))return!1;try{return!!JSON.parse(or(t,"utf-8")).mcpServers?.contextq}catch{return!1}}function rt(e=process.env){let t=nt(tn(e),["--version"],{encoding:"utf-8",env:e});if(t.error||t.status!==0)return{reason:"the `claude` binary was not found on PATH"};let n=ir(t.stdout);return n?sr(n,en)?{version:n.join(".")}:{reason:`Claude Code ${n.join(".")} is older than ${en.join(".")}, the ContextQ plugin's floor (its function-hook module needs prompt.edit and ui.render AbovePrompt)`}:{reason:`could not read a version from \`claude --version\` (${t.stdout.trim()})`}}function ar(e){let t=e.split(`
+`).map(n=>n.trim()).filter(n=>n.startsWith("{"));for(let n=t.length-1;n>=0;n--)try{return JSON.parse(t[n])}catch{continue}return null}function cr(e){return`${e.replace(/\/$/,"")}/plugin/marketplace.json`}function Ee(e,t,n,o,r=process.env,i={}){let c=rt(r);if("reason"in c)return{status:"unavailable",reason:c.reason};let a=tn(r),d=nt(a,["plugin","marketplace","add",cr(i.marketplaceBase??t),"--scope","project"],{cwd:e,encoding:"utf-8",env:r});if(d.error||d.status!==0)return{status:"failed",reason:`\`claude plugin marketplace add\` exited ${d.status??"with an error"}`};let l=["plugin","install",O,"--scope","project","--json","--config",`apiKey=${n}`];t.replace(/\/$/,"")!==o.replace(/\/$/,"")&&l.push("--config",`apiUrl=${t}`);let u=nt(a,l,{cwd:e,encoding:"utf-8",env:r}),p=ar(u.stdout??"");if(!p)return{status:"failed",reason:`\`claude plugin install --json\` printed no result line (exit ${u.status??"error"})`};if(p.outcome!=="ok"||u.status!==0){let h=typeof p.failureCode=="string"?` [${p.failureCode}]`:"";return{status:"failed",reason:`${String(p.message??"install failed")}${h}`}}let g=String(p.message??"installed");return{status:"installed",message:g,alreadyInstalled:/already installed/i.test(g)}}function on(e){return e.noPlugin?{delegate:!1,reason:"--no-plugin: wiring Claude Code through .mcp.json"}:e.legacyMcpEntry?{delegate:!1,reason:".mcp.json already wires contextq -- keeping that path, not installing the plugin on top of it (both would register the same MCP server)"}:e.verifyStatus===401||e.verifyStatus===403?{delegate:!1,reason:`the server rejected this key (HTTP ${e.verifyStatus}) -- not handing it to the plugin, whose apiKey is stored machine-wide and would replace a working one; wiring .mcp.json instead`}:{delegate:!0}}var O,en,ot,Pe=M(()=>{"use strict";O="contextq@contextq-plugins",en=[2,1,281],ot="CONTEXTQ_CLAUDE_BIN";s(tn,"claudeBin");s(ir,"parseClaudeVersion");s(sr,"versionAtLeast");s(nn,"hasLegacyMcpEntry");s(rt,"detectClaude");s(ar,"lastJsonLine");s(cr,"marketplaceUrl");s(Ee,"installPlugin");s(on,"decidePluginDelegation")});function G(e,t){if(!lr.test(e))throw new Error(`${t} value "${e}" is not a valid slug -- allowed: ${Te}`);return e}function K(e){let t=e.toLowerCase().replace(/[^a-z0-9_-]+/g,"-").replace(/^[-_]+|[-_]+$/g,"");return t=t.slice(0,64),t=t.replace(/[-_]+$/g,""),t===""?"default":t}var lr,Te,Ae=M(()=>{"use strict";lr=/^[a-z0-9][a-z0-9_-]{0,63}$/,Te='lowercase letters, digits, "-", "_" (must start with a letter/digit, max 64 chars)';s(G,"validateSlug");s(K,"sanitizeSlugFallback")});var Cn={};ye(Cn,{DEFAULT_LOCAL_PORT:()=>xn,EDGE_PACKAGE:()=>pt,EDGE_SOURCE_ENV:()=>bn,EDGE_VERSION_PIN:()=>kn,LocalRuntimeError:()=>I,MIN_NODE_MAJOR:()=>re,STATE_DIR_ENV:()=>dt,checkNode:()=>Ue,defaultLocalStateDir:()=>H,preflight:()=>$n,provision:()=>Sn,start:()=>ce,status:()=>Ne,stop:()=>Hr});import{spawn as Pr,spawnSync as lt}from"child_process";import{chmodSync as Tr,closeSync as Ar,existsSync as W,mkdirSync as Rr,openSync as Or,readFileSync as De,rmSync as Ie,writeFileSync as wn}from"fs";import{homedir as Ir,platform as Nr}from"os";import{join as E}from"path";function H(e=process.env){if(e[dt])return e[dt];let t=Ir();if(Nr()==="darwin")return E(t,"Library","Application Support","contextq","local");let n=e.XDG_DATA_HOME&&e.XDG_DATA_HOME.trim()!==""?e.XDG_DATA_HOME:E(t,".local","share");return E(n,"contextq","local")}function ae(e){let t=e.version??kn,n=e.stateDir??H();return{stateDir:n,runtimeDir:e.runtimeDir??E(n,"runtime"),port:e.port??xn,version:t,source:e.packageSource??process.env[bn]??`${pt}@${t}`,nodeVersion:e.nodeVersion??process.versions.node,nodeBin:e.nodeBin??process.execPath,npmBin:e.npmBin??"npm",fetchImpl:e.fetchImpl??fetch,startTimeoutMs:e.startTimeoutMs??15e3}}function vn(e){return E(e.runtimeDir,`edge-${e.version}`)}function ie(e){return E(vn(e),"node_modules","@contextq","edge")}function Ue(e){let t=Number(e.split(".")[0]);if(!Number.isFinite(t)||t<re)throw new I(`ContextQ local mode needs Node ${re} or newer, and this is Node ${e}; install Node ${re}+ and run \`contextq local start\` again.`)}function ut(e){Rr(e,{recursive:!0,mode:448}),Tr(e,448)}function yn(e){let t=E(ie(e),"package.json");if(!W(t))return null;try{return JSON.parse(De(t,"utf8")).version}catch{return null}}function Sn(e={}){let t=ae(e);Ue(t.nodeVersion);let n=vn(t);if(yn(t)===t.version&&W(E(ie(t),"dist","cli.js")))return{dir:ie(t),installed:!1};ut(t.stateDir),ut(n),W(E(n,"package.json"))||wn(E(n,"package.json"),`${JSON.stringify({name:"contextq-local-runtime",private:!0},null,2)}
+`);let o=lt(t.npmBin,["install","--no-audit","--no-fund","--omit=dev","--install-links","--prefix",n,t.source],{encoding:"utf8",timeout:3e5});if(o.error||o.status!==0){let i=`${o.stderr??""}`.trim().split(`
+`).slice(-3).join(" | ");throw new I(`could not install ${t.source} into ${n}${/E404|No matching version|ETARGET/.test(i)?" (that version is not published yet)":""}: ${i||o.error?.message||`npm exited ${o.status}`}`)}let r=yn(t);if(r!==t.version)throw new I(`installed ${pt} is ${r??"missing"}, but this CLI is pinned to ${t.version}; remove ${n} and run \`contextq local start\` again.`);return{dir:ie(t),installed:!0}}function $n(e={}){let t=ae(e);Ue(t.nodeVersion);let n=ie(t),o=lt(t.nodeBin,["--input-type=module","-e","import Database from 'better-sqlite3'; new Database(':memory:').prepare('select 1').get();"],{cwd:n,encoding:"utf8",timeout:3e4});if(o.status!==0){let i=`${o.stderr??""}`.trim().split(`
+`).find(c=>/Error|error/.test(c))??`exit ${o.status}`;throw new I(`better-sqlite3 does not load on this machine (${i.slice(0,200)}); local mode supports macOS arm64 and Linux x64 with Node ${re}+ and npm prebuilt binaries.`)}return lt(t.nodeBin,["--input-type=module","-e","import { createRequire } from 'node:module'; import Database from 'better-sqlite3'; createRequire(import.meta.url + '/../')('sqlite-vec').load(new Database(':memory:'));"],{cwd:n,encoding:"utf8",timeout:3e4}).status!==0?{vectorSearch:!1,warning:"sqlite-vec does not load here; local search runs keyword-only (FTS5)."}:{vectorSearch:!0}}function se(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}function Dr(e){let t=N(e).pid;if(!W(t))return null;let n=Number(De(t,"utf8").trim());return Number.isInteger(n)&&n>0?n:null}function Ur(e){let t=N(e).endpoint;if(!W(t))return null;try{return JSON.parse(De(t,"utf8"))}catch{return null}}async function Lr(e,t){try{let n=await e(`${t}/health`,{signal:AbortSignal.timeout(2e3)});return n.ok?await n.json():null}catch{return null}}async function Ne(e={}){let t=ae(e),n={running:!1,owned:!1,url:null,pid:null,edgeVersion:null,pinnedVersion:t.version,stateDir:t.stateDir},o=Dr(t.stateDir),r=Ur(t.stateDir);if(o===null)return{...n,note:"not started"};if(!se(o))return Ie(N(t.stateDir).pid,{force:!0}),{...n,note:`not running (removed a stale pidfile for pid ${o})`};if(!r||r.pid!==o)return{...n,pid:o,note:`pid ${o} is alive but has not published its endpoint`};let i=await Lr(t.fetchImpl,r.url);return!i||i.mode!=="local"||i.service!=="contextq-edge"?{...n,pid:o,url:r.url,note:`pid ${o} does not answer as a ContextQ local server at ${r.url}`}:{...n,running:!0,owned:!0,url:r.url,pid:o,edgeVersion:String(i.edgeVersion??"")||null}}async function Kr(e){let t=`http://127.0.0.1:${e.port}`;try{let n=await e.fetchImpl(`${t}/health`,{signal:AbortSignal.timeout(1500)});return(await n.json().catch(()=>null))?.service==="contextq-edge"?`another ContextQ local server (not started from ${e.stateDir})`:`a process that is not ContextQ (HTTP ${n.status})`}catch(n){return n.cause?.code==="ECONNREFUSED"?null:"a process that does not answer HTTP"}}async function ce(e={}){let t=ae(e);Ue(t.nodeVersion);let n=await Ne(e);if(n.running){if(n.edgeVersion&&n.edgeVersion!==t.version)throw new I(`the running local server is edge ${n.edgeVersion}, but this CLI is pinned to ${t.version}; run \`contextq local stop\` and start it again.`);return{...n,started:!1}}let o=await Kr(t);if(o)throw new I(`port ${t.port} on 127.0.0.1 is held by ${o}; it was left alone. Stop it or pass --port <n>.`);let{dir:r}=Sn(e),i=$n(e);ut(t.stateDir),Ie(N(t.stateDir).endpoint,{force:!0});let c=Or(N(t.stateDir).log,"a",384),a=Pr(t.nodeBin,[E(r,"dist","cli.js"),"serve","--state-dir",t.stateDir,"--port",String(t.port)],{detached:!0,stdio:["ignore",c,c]});if(Ar(c),a.pid===void 0)throw new I("could not start the local server process");wn(N(t.stateDir).pid,`${a.pid}
+`,{mode:384}),a.unref();let d=Date.now()+t.startTimeoutMs;for(;Date.now()<d;){let u=await Ne(e);if(u.running)return{...u,started:!0,...i.warning?{warning:i.warning}:{}};if(!se(a.pid))break;await new Promise(p=>setTimeout(p,200))}let l=W(N(t.stateDir).log)?De(N(t.stateDir).log,"utf8").trim().split(`
+`).slice(-3).join(" | "):"";throw se(a.pid)&&process.kill(a.pid,"SIGTERM"),Ie(N(t.stateDir).pid,{force:!0}),new I(`the local server did not come up within ${Math.round(t.startTimeoutMs/1e3)} s${l?`: ${l}`:""}`)}async function Hr(e={}){let t=ae(e),n=await Ne(e);if(!n.running||!n.owned||n.pid===null)return{stopped:!1,note:n.note??"not running"};process.kill(n.pid,"SIGTERM");let o=Date.now()+1e4;for(;Date.now()<o&&se(n.pid);)await new Promise(r=>setTimeout(r,100));return se(n.pid)?{stopped:!1,note:`pid ${n.pid} did not exit after SIGTERM; it was left running`}:(Ie(N(t.stateDir).pid,{force:!0}),{stopped:!0,note:`stopped pid ${n.pid}`})}var pt,kn,xn,re,dt,bn,I,N,Le=M(()=>{"use strict";pt="@contextq/edge",kn="0.2.0",xn=47321,re=22,dt="CONTEXTQ_LOCAL_STATE_DIR",bn="CONTEXTQ_EDGE_PACKAGE",I=class extends Error{static{s(this,"LocalRuntimeError")}constructor(t){super(t),this.name="LocalRuntimeError"}};s(H,"defaultLocalStateDir");s(ae,"resolve");N=s(e=>({pid:E(e,"edge.pid"),endpoint:E(e,"endpoint.json"),log:E(e,"edge.log")}),"paths");s(vn,"runtimeRoot");s(ie,"edgePackageDir");s(Ue,"checkNode");s(ut,"ensureDir");s(yn,"installedVersion");s(Sn,"provision");s($n,"preflight");s(se,"pidAlive");s(Dr,"readPid");s(Ur,"readEndpoint");s(Lr,"health");s(Ne,"status");s(Kr,"portHolder");s(ce,"start");s(Hr,"stop")});var ft={};ye(ft,{readJournal:()=>En,readPluginState:()=>j,reconfigurePlugin:()=>gt,restorePlugin:()=>Yr,supportsTerminalConfigure:()=>_n,syncPlatformCredentials:()=>Gr,writeJournal:()=>Q});import{spawnSync as jr}from"child_process";import{chmodSync as qr,existsSync as Mr,mkdirSync as Fr,readFileSync as Jr,renameSync as Br,writeFileSync as Vr}from"fs";import{dirname as Qr}from"path";function Xr(e){return e[ot]||"claude"}function X(e){return e.replace(/\/+$/,"")}function Ke(e,t,n){return jr(Xr(e),t,{encoding:"utf-8",env:e,input:n,timeout:6e4})}function _n(e=process.env){let t=Ke(e,["plugin","configure","--help"]);return!t.error&&t.status===0&&/--values-stdin/.test(t.stdout??"")}function j(e=process.env,t=O){let n=Ke(e,["plugin","list","--json"]),o;try{o=JSON.parse(n.stdout??"[]").find(d=>d.id===t)}catch{o=void 0}if(!o)return{installed:!1,scope:null,enabled:null,apiUrl:null,apiKeySet:!1};let r=Ke(e,["plugin","configure",t,"--json"]),i=null,c=!1;try{let a=JSON.parse(r.stdout??"{}");i=a.inputs?.apiUrl?X(a.inputs.apiUrl):null,c=Array.isArray(a.configured)&&a.configured.includes("apiKey")}catch{i=null}return{installed:!0,scope:o.scope??null,enabled:o.enabled??null,apiUrl:i,apiKeySet:c}}function Q(e,t){Fr(Qr(e),{recursive:!0,mode:448});let n=`${e}.tmp`;Vr(n,`${JSON.stringify(t,null,2)}
+`,{mode:384}),qr(n,384),Br(n,e)}function En(e){if(!Mr(e))return null;try{return JSON.parse(Jr(e,"utf-8"))}catch{return null}}function Pn(e,t,n){let o=Ke(e,["plugin","configure",t,"--values-stdin"],JSON.stringify({apiUrl:X(n.apiUrl),apiKey:n.apiKey}));return o.error?`could not run \`claude plugin configure\` (${o.error.message})`:o.status!==0?`\`claude plugin configure\` exited ${o.status}`:null}function gt(e){let t=e.env??process.env,n=e.pluginId??O,o=X(e.target.apiUrl);if(!_n(t))return{status:"failed",reason:"this Claude Code has no `claude plugin configure --values-stdin`; update it (`claude update`) or run `/plugin configure contextq` inside a session",state:null};let r=j(t,n);if(!r.installed)return{status:"failed",reason:`${n} is not installed in this Claude Code profile`,state:r};let i=s(()=>new Date().toISOString(),"now"),c={version:1,pluginId:n,startedAt:i(),updatedAt:i(),step:"backed_up",before:{apiUrl:r.apiUrl,scope:r.scope,enabled:r.enabled},target:{apiUrl:o},previousKeySource:e.previousKeySource??null};Q(e.journalPath,c);let a=Pn(t,n,e.target);if(a)return Q(e.journalPath,{...c,step:"failed",updatedAt:i(),error:a}),{status:"failed",reason:a,state:j(t,n)};Q(e.journalPath,{...c,step:"configured",updatedAt:i()});let d=j(t,n),l=[];if(d.apiUrl!==o&&l.push(`apiUrl is ${d.apiUrl??"unset"}, expected ${o}`),d.apiKeySet||l.push("apiKey is not set"),d.scope!==r.scope&&l.push(`scope changed from ${r.scope} to ${d.scope}`),d.enabled!==r.enabled&&l.push(`enabled changed from ${r.enabled} to ${d.enabled}`),l.length>0){let u=`the effective plugin config does not match the switch: ${l.join("; ")}`;return Q(e.journalPath,{...c,step:"failed",updatedAt:i(),error:u}),{status:"failed",reason:u,state:d}}return Q(e.journalPath,{...c,step:"verified",updatedAt:i()}),{status:r.apiUrl===o?"updated":"switched",state:d}}function Yr(e,t,n=process.env){let o=En(e);if(!o)return{status:"failed",reason:`no plugin switch journal at ${e}`,state:null};if(o.before.apiUrl&&X(t.apiUrl)!==o.before.apiUrl)return{status:"failed",reason:`the restore endpoint ${X(t.apiUrl)} is not the one recorded before the switch (${o.before.apiUrl})`,state:null};let r=Pn(n,o.pluginId,t);if(r)return{status:"failed",reason:r,state:j(n,o.pluginId)};let i=j(n,o.pluginId);return i.apiUrl!==X(t.apiUrl)||!i.apiKeySet?{status:"failed",reason:`restore did not take effect (apiUrl is ${i.apiUrl??"unset"})`,state:i}:(Q(e,{...o,step:"restored",updatedAt:new Date().toISOString()}),{status:"switched",state:i})}function Gr(e){if(!T.test(e.apiKey))return{written:!1,line:"[skip]  platform credentials (a local token stays in the local state dir)"};let t=U({explicitKey:e.apiKey,ambientVarName:null,ambientKey:"",apiUrl:X(e.apiUrl)});return{written:t.action!=="skipped",line:t.credLine}}var He=M(()=>{"use strict";Pe();B();s(Xr,"bin");s(X,"normalizeUrl");s(Ke,"run");s(_n,"supportsTerminalConfigure");s(j,"readPluginState");s(Q,"writeJournal");s(En,"readJournal");s(Pn,"applyConfig");s(gt,"reconfigurePlugin");s(Yr,"restorePlugin");s(Gr,"syncPlatformCredentials")});var le={};ye(le,{CLOUD_MARKETPLACE_BASE:()=>ht,appendBinding:()=>On,gitRoot:()=>An,readBinding:()=>Rn,runLocalInit:()=>ri,writeLocalBinding:()=>In});import{spawnSync as Wr}from"child_process";import{existsSync as zr,mkdirSync as Zr,readFileSync as Tn,renameSync as ei,writeFileSync as ti}from"fs";import{homedir as ni}from"os";import{basename as oi,join as z,resolve as mt}from"path";function An(e){let t=Wr("git",["-C",e,"rev-parse","--show-toplevel"],{encoding:"utf8"});if(t.status!==0)throw new Error(`${e} is not inside a git repository; run \`contextq init --local\` from the project repo`);let n=t.stdout.trim(),o=mt(ni());if(mt(n)===o||mt(n)===z(o,".claude"))throw new Error(`${n} is your home directory or ~/.claude, not a project repo; nothing was bound`);return n}function Rn(e){let t=z(e,".contextq","config.json");if(!zr(t))return null;try{return JSON.parse(Tn(t,"utf8"))}catch{throw new Error(`${t} is not valid JSON; fix or delete it first`)}}function On(e,t,n="contextq-cli"){let o=z(e,".contextq"),r=z(o,"config.json"),i=Rn(e),c=i??{},a=c._entries??[],d=c.write_seq??a.length,l=!1;for(let[p,g]of t){if(c[p]===g)continue;let h=d;d+=1,a.push({key:p,value:g,written_by:n,based_on:h,seq:d,ts:new Date().toISOString().replace(/\.\d{3}Z$/,"Z")}),c[p]=g,l=!0}if(!l)return"skipped";c.config_schema_version=Math.max(5,c.config_schema_version??5),c.write_seq=d,c._entries=a,Zr(o,{recursive:!0});let u=`${r}.tmp`;return ti(u,`${JSON.stringify(c,null,2)}
+`),ei(u,r),i?"updated":"created"}function In(e,t){return On(e,[["mode","local"],["workspace",t.workspace],["agent",t.agent]])}async function ri(e){let t=e.log??(x=>console.log(x)),n=e.env??process.env,o=An(e.cwd),r=oi(o),i=e.workspace?G(e.workspace.toLowerCase(),"--workspace"):K(r),c=e.agent?G(e.agent,"--agent"):K(r),a=e.runtime?.stateDir??H(n),d=await ce({...e.runtime,stateDir:a});d.warning&&t(`[warn]   ${d.warning}`),t(`${d.started?"[start]":"[skip] "}  local server at ${d.url} (edge ${d.edgeVersion})`);let l=Tn(z(a,"token"),"utf8").trim(),u=d.url,p=rt(n);if("reason"in p)t(`[info]   Claude Code plugin not wired: ${p.reason}. Install Claude Code 2.1.281+ and run \`contextq init --local\` again.`);else{let x=j(n);if(x.installed){let b=gt({target:{apiUrl:u,apiKey:l},journalPath:z(a,"plugin-config.backup.json"),previousKeySource:x.apiUrl&&x.apiUrl.startsWith("http://127.0.0.1")?"local-token":"platform-cred",env:n});if(b.status==="failed")throw new Error(`could not point the installed ${O} at the local server: ${b.reason}`);t(`${b.status==="switched"?"[rotate]":"[skip] "} ${O} -> ${u} (${b.status})`)}else{let b=Ee(o,u,l,ht,n,{marketplaceBase:e.marketplaceBase??ht});if(b.status!=="installed")throw new Error(`could not install ${O}: ${b.status==="unavailable",b.reason}`);t(`[add]    ${O} at project scope -> ${u}`)}}let g={authorization:`Bearer ${l}`},h=await fetch(`${u}/contexts?workspace=${encodeURIComponent(i)}&limit=1`,{headers:g}),f=await fetch(`${u}/hooks/session-start`,{method:"POST",headers:{...g,"content-type":"application/json"},body:JSON.stringify({agent:c,workspace:i})}),w=f.ok?(await f.json()).hookSpecificOutput?.additionalContext??"":"";if(!h.ok||!w.startsWith("ContextQ local mode"))throw new Error(`the local server did not answer a memory read and boot-lite (HTTP ${h.status}/${f.status}); run \`contextq local status\``);let k=(await h.json()).total??0;t(`[check]  local memory answers: ${k} note(s) in ${i}, boot-lite in local mode`);let y=In(o,{workspace:i,agent:c});t(`${y==="skipped"?"[skip] ":y==="created"?"[create]":"[add]  "} .contextq/config.json (mode=local workspace=${i} agent=${c})`),t(""),t("Local mode is on for this repo: memory stays on this machine, no account needed. Open a new Claude Code session here to use it."),t("Board, handoffs and sessions need an account; `contextq attach` adds one later and moves your memory with you.")}var ht,de=M(()=>{"use strict";Le();Pe();He();Ae();ht="https://app.contextq.dev";s(An,"gitRoot");s(Rn,"readBinding");s(On,"appendBinding");s(In,"writeLocalBinding");s(ri,"runLocalInit")});var Ln={};ye(Ln,{AttachError:()=>C,abortAttach:()=>fi,attachSwitch:()=>gi,attachTransfer:()=>ui,ensureLocalServer:()=>Qe,fingerprint:()=>wt,isSimulatedCrash:()=>pi,journalPath:()=>fe,reached:()=>ue,readJournal:()=>Ve,writeJournal:()=>$});import{createHash as ii,randomUUID as si}from"crypto";import{chmodSync as ai,existsSync as qe,mkdirSync as ci,readFileSync as yt,renameSync as li,rmSync as Me,writeFileSync as Dn}from"fs";import{dirname as di,join as Z}from"path";function ue(e,t){return Nn.indexOf(e.state)>=Nn.indexOf(t)}function fe(e){return Z(e,"attach-journal.json")}function Ve(e){let t=fe(e);if(!qe(t))return null;try{return JSON.parse(yt(t,"utf8"))}catch{throw new C(`${t} is not readable JSON; move it aside and run \`contextq attach --restart\``)}}function $(e,t){let n=fe(e);ci(di(n),{recursive:!0,mode:448});let o=`${n}.tmp`;Dn(o,`${JSON.stringify({...t,updatedAt:new Date().toISOString()},null,2)}
+`,{mode:384}),ai(o,384),li(o,n)}function wt(e){return ii("sha256").update(e,"utf8").digest("hex").slice(0,12)}function me(e){return e.replace(/\/+$/,"")}async function pe(e,t,n,o,r){let i=await e(`${t.url}${o}`,{method:n,headers:{authorization:`Bearer ${t.token}`,...r?{"content-type":"application/json"}:{}},body:r?JSON.stringify(r):void 0}),c=await i.text();if(!i.ok)throw new C(`the local server answered HTTP ${i.status} for ${n} ${o}: ${c.slice(0,200)}`);return JSON.parse(c)}async function Fe(e,t,n,o,r,i){let c=await e(`${t}${r}`,{method:o,headers:{authorization:`Bearer ${n}`,...i?{"content-type":"application/json"}:{}},body:i?JSON.stringify(i):void 0}),a=await c.text();return{status:c.status,text:a}}async function Qe(e){return{url:(await ce({...e.runtime,stateDir:e.stateDir})).url,token:yt(Z(e.stateDir,"token"),"utf8").trim()}}function Un(e,t){let n=R();if(!n.apiKey||me(n.apiUrl)!==e||wt(n.apiKey)!==t.keyFingerprint)throw new C(`the attach in progress belongs to another login (its key is no longer the stored credential for ${e}); run \`contextq attach --restart\` to start over`);return n.apiKey}async function ui(e){let t=e.log??(d=>console.log(d)),n=e.fetchImpl??fetch,o=e.stateDir??H(),r=me(e.cloudUrl),i=Ve(o);if(i&&e.restart){if(ue(i,"freezing"))throw new C("the attach already switched or is switching; finish it or run `contextq attach --abort` first");Me(fe(o),{force:!0}),i=null}if(i&&i.cloudUrl!==r)throw new C(`an attach to ${i.cloudUrl} is in progress; resume it with --url ${i.cloudUrl}, or run \`contextq attach --restart\``);i&&i.state==="login_pending"&&(i=null);let c=await Qe({stateDir:o,runtime:e.runtime}),a;if(i)a=Un(r,i),t(`[info]   resuming attach ${i.attachId} at ${i.state}`);else{i={version:1,attachId:si(),cloudUrl:r,tenantId:null,keyFingerprint:null,state:"login_pending",workspaceMap:{},acked:{},denied:{},leaveDenied:!!e.leaveDenied,consent:{ping:null},startedAt:new Date().toISOString(),updatedAt:new Date().toISOString()},$(o,i);try{a=await e.login();let d=await Fe(n,r,a,"GET","/api/workspaces");if(d.status!==200)throw new C(`${r} did not accept the approved key (HTTP ${d.status}); nothing was changed`)}catch(d){throw Me(fe(o),{force:!0}),d}U({explicitKey:a,ambientVarName:null,ambientKey:"",apiUrl:r}),i={...i,state:"authenticated",keyFingerprint:wt(a)},$(o,i),t(`[check]  signed in to ${r}`)}if(e.leaveDenied&&(i.leaveDenied=!0),!ue(i,"workspaces_mapped")){let{workspaces:d}=await pe(n,c,"GET","/workspaces");for(let l of d){if(l.contexts===0||i.workspaceMap[l.slug])continue;let u="global";if(l.slug!=="global"){let p=await Fe(n,r,a,"POST","/api/workspaces/ensure",{name:l.slug,slug:l.slug});if(p.status!==200&&p.status!==201)throw new C(`could not ensure workspace ${l.slug} on ${r} (HTTP ${p.status}); run \`contextq attach\` again to resume`);let g=JSON.parse(p.text);if(typeof g.tenantId=="number"){if(i.tenantId!==null&&i.tenantId!==g.tenantId)throw new C(`the account at ${r} is not the one this attach started with; run \`contextq attach --restart\``);i.tenantId=g.tenantId}u=g.slug}await pe(n,c,"PUT","/sync/workspace-map",{local:l.slug,cloud:u}),i.workspaceMap[l.slug]=u,$(o,i),t(`[map]    ${l.slug} -> ${u}`)}i.state="workspaces_mapped",$(o,i)}if(!ue(i,"transferred")||i.state==="transfer_blocked"){i.state="transferring",$(o,i);let d=Number.POSITIVE_INFINITY;for(;;){let l=await pe(n,c,"POST","/sync/push",{parentUrl:r,apiKey:a,...e.batchMaxContexts?{batchMaxContexts:e.batchMaxContexts}:{}});for(let p of l.refs)p.outcome==="accepted"&&typeof p.cloudId=="number"?(i.acked[p.ref]=p.cloudId,delete i.denied[p.ref]):(p.outcome==="denied"||p.outcome==="too_large")&&(i.denied[p.ref]=p.reason??p.outcome);if($(o,i),l.failures.length>0)throw new C(`the transfer stopped: ${l.failures[0].error}; run \`contextq attach\` again to resume (nothing is sent twice)`);if(l.pending-(i.leaveDenied?Object.keys(i.denied).length:0)<=0)break;if(l.pending>=d||Object.keys(i.denied).length>=l.pending){i.state="transfer_blocked",$(o,i);let p=Object.entries(i.denied).map(([g,h])=>`  ${g}: ${h}`).join(`
+`);throw new C(`${l.pending} note(s) were refused by ${r}:
+${p}
+Edit or delete them locally and run \`contextq attach\` again, or pass --leave-denied to keep them local-only`)}d=l.pending}i.state="transferred",$(o,i),t(`[push]   ${Object.keys(i.acked).length} note(s) are in ${r}`)}return i}function ge(e){return Z(e,"attach-binding-before.json")}function pi(e){return e instanceof Je}async function Be(e,t,n,o){await pe(e,t,"PUT","/sync/write-lock",{lock:n,...o?{attachedTo:o}:{}})}async function je(e,t,n,o,r){let{restorePlugin:i,readPluginState:c}=await Promise.resolve().then(()=>(He(),ft)),{appendBinding:a}=await Promise.resolve().then(()=>(de(),le)),d=e.fetchImpl??fetch,l=e.env??process.env,u=[],p=Z(o,"plugin-config.backup.json"),g=c(l);if(g.installed&&g.apiUrl&&me(g.apiUrl)!==me(n.url)&&qe(p)){let h=i(p,{apiUrl:n.url,apiKey:n.token},l);u.push(h.status==="failed"?`plugin NOT restored: ${h.reason}`:"plugin points at the local server again")}if(e.repoRoot&&qe(ge(o))){let h=JSON.parse(yt(ge(o),"utf8")),f=[];h.mode&&f.push(["mode",h.mode]),h.workspace&&f.push(["workspace",h.workspace]),f.length>0&&a(e.repoRoot,f),u.push("repo binding restored")}throw await Be(d,n,null),t.state="transferred",$(o,t),new C(`${r}; rolled back (${[...u,"local writes unlocked"].join(", ")}). Run \`contextq attach\` again to retry.`)}async function gi(e){let t=e.log??(f=>console.log(f)),n=e.fetchImpl??fetch,o=e.env??process.env,r=e.stateDir??H(),i=me(e.cloudUrl),{reconfigurePlugin:c,readPluginState:a}=await Promise.resolve().then(()=>(He(),ft)),{appendBinding:d,readBinding:l}=await Promise.resolve().then(()=>(de(),le)),u=Ve(r);if(!u||!ue(u,"transferred")||u.state==="transfer_blocked")throw new C("nothing is ready to switch: run the transfer first (`contextq attach`)");if(u.state==="attached")return u;let p=await Qe({stateDir:r,runtime:e.runtime}),g=Un(i,u),h=s(f=>{if(e.crashAfter===f)throw new Je(`simulated crash after ${f}`)},"crash");if(u.state==="switching"&&(t("[info]   an earlier attach stopped during the switch; redoing the switch (every step is idempotent)"),u.state="freezing",$(r,u)),u.state==="transferred"||u.state==="freezing"){u.consent={ping:e.pingConsent??u.consent.ping??!1},u.state="freezing",$(r,u),await Be(n,p,"attach"),h("freezing");let f=await pe(n,p,"POST","/sync/push",{parentUrl:i,apiKey:g});for(let y of f.refs)y.outcome==="accepted"&&typeof y.cloudId=="number"&&(u.acked[y.ref]=y.cloudId);let w=u.leaveDenied?Object.keys(u.denied).length:0;if((f.failures.length>0||f.pending>w)&&await je(e,u,p,r,`the final flush left ${f.pending} note(s) pending${f.failures[0]?` (${f.failures[0].error})`:""}`),u.state="switching",$(r,u),e.repoRoot&&!qe(ge(r))){let y=l(e.repoRoot),x={mode:y?.mode??null,workspace:y?.workspace??null};Dn(ge(r),`${JSON.stringify(x)}
+`,{mode:384})}if(a(o).installed){let y=c({target:{apiUrl:i,apiKey:g},journalPath:Z(r,"plugin-config.backup.json"),previousKeySource:"local-token",env:o});y.status==="failed"&&await je(e,u,p,r,`switching the plugin failed: ${y.reason}`),t(`[rotate] plugin -> ${i}`)}else t("[info]   no installed ContextQ plugin in this Claude Code profile; only the repo binding switches");if(h("switching"),e.repoRoot){let x=l(e.repoRoot)?.workspace??"global",b=u.workspaceMap[x]??x;d(e.repoRoot,[["mode","cloud"],["workspace",b]]);for(let m of["bound-host","local-ids.json"])Me(Z(e.repoRoot,".contextq","cache",m),{force:!0});t(`[bind]   .contextq/config.json -> mode=cloud workspace=${b}`)}u.state="verifying",$(r,u)}if(u.state==="verifying"){let f=e.repoRoot?l(e.repoRoot)?.workspace??"global":"global",w=await Fe(n,i,g,"POST","/api/agent/boot",{agent:"contextq-attach",workspace:f}),k=Object.values(u.acked)[0],y=k===void 0?{status:200,text:""}:await Fe(n,i,g,"GET",`/api/contexts/${k}`),x=w.status===200&&/"mode"\s*:\s*"local"/.test(w.text);(w.status!==200||x||y.status!==200)&&await je(e,u,p,r,`the cloud did not verify (boot HTTP ${w.status}${x?", still local":""}, read HTTP ${y.status})`),await Be(n,p,"attached",i),u.state="attached",$(r,u),Me(ge(r),{force:!0}),t(`[check]  ${i} answers boot and reads an imported note`)}return u}async function fi(e){let t=e.stateDir??H(),n=Ve(t);if(!n)return"no attach in progress";if(n.state==="attached")return"the attach already finished; nothing to abort";let o=await Qe({stateDir:t,runtime:e.runtime});if(["freezing","switching","verifying"].includes(n.state))try{await je(e,n,o,t,"aborted")}catch(r){return r.message}return await Be(e.fetchImpl??fetch,o,null),`attach left at ${n.state}; local writes are unlocked`}var C,Nn,Je,Kn=M(()=>{"use strict";Le();B();C=class extends Error{static{s(this,"AttachError")}constructor(t){super(t),this.name="AttachError"}},Nn=["login_pending","authenticated","workspaces_mapped","transferring","transfer_blocked","transferred","freezing","switching","verifying","attached"];s(ue,"reached");s(fe,"journalPath");s(Ve,"readJournal");s($,"writeJournal");s(wt,"fingerprint");s(me,"normalizeUrl");s(pe,"localJson");s(Fe,"cloudCall");s(Qe,"ensureLocalServer");s(Un,"storedKeyFor");s(ui,"attachTransfer");s(ge,"bindingFile");Je=class extends Error{static{s(this,"SimulatedCrash")}};s(pi,"isSimulatedCrash");s(Be,"setLock");s(je,"rollback");s(gi,"attachSwitch");s(fi,"abortAttach")});import{homedir as Hn}from"os";import{basename as jn}from"path";import{existsSync as ke}from"fs";import{execSync as to}from"child_process";import{homedir as Et}from"os";import{join as Ye}from"path";var Mn="CONTEXTQ_HOST";var Fn="CLAUDE_CODE_ENABLE_FUNCTION_HOOKS",Jn=["claude-code","claude-desktop","codex","opencode","cyberine","muse","unknown"],Bn=[["claude-code","claude-code"],["claude-desktop","claude-desktop"],["claude-ai","claude-desktop"],["claude","claude-desktop"],["codex","codex"],["opencode","opencode"],["cyberine","cyberine"],["muse","muse"],["muse-code","muse"]];function vt(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}s(vt,"normalizeName");function Vn(e){if(!e)return"unknown";let t=vt(e);if(!t)return"unknown";let n=[...Bn].sort((o,r)=>r[0].length-o[0].length);for(let[o,r]of n)if(t===o||t.startsWith(`${o}-`))return r;return"unknown"}s(Vn,"hostFromClientName");function Qn(e){if(!e)return;let t=vt(e);return Jn.find(n=>n===t)}s(Qn,"parseHostOverride");function St(e={}){let t=e.env??(typeof process<"u"?process.env:{}),n=t.CLAUDE_CODE_SESSION_ID||void 0,o=s((i,c)=>({host:i,supportsFunctionHooks:i==="claude-code"&&t[Fn]==="1",...i==="claude-code"&&n?{sessionId:n}:{},via:c}),"finish");if(e.forcedHost)return o(e.forcedHost,"forced");let r=Qn(t[Mn]);return r?o(r,"env-override"):e.clientName!==void 0?o(Vn(e.clientName),"client-info"):t.CLAUDECODE==="1"?o("claude-code","env"):o("unknown","none")}s(St,"resolveHost");import{chmodSync as Xn,existsSync as Yn,mkdirSync as Gn,readFileSync as Wn,writeFileSync as zn}from"fs";import{execFileSync as $t}from"child_process";import{basename as Zn,dirname as Ct,join as we}from"path";var Y=["gemini","cursor","copilot"],J={gemini:{label:"Gemini CLI",configDir:s(e=>we(e,".gemini"),"configDir"),configFile:"settings.json",entry:s((e,t)=>({httpUrl:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"gemini mcp list"},cursor:{label:"Cursor",configDir:s(e=>we(e,".cursor"),"configDir"),configFile:"mcp.json",entry:s((e,t)=>({url:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"cursor-agent mcp list"},copilot:{label:"Copilot CLI",configDir:s((e,t)=>t.COPILOT_HOME||we(e,".copilot"),"configDir"),configFile:"mcp-config.json",entry:s((e,t)=>({type:"http",url:e,headers:{Authorization:`Bearer ${t}`},tools:["*"]}),"entry"),listCommand:"copilot mcp list"}};function te(e,t,n){return J[e].configDir(t,n)}s(te,"hostConfigDir");function eo(e,t,n){return we(te(e,t,n),J[e].configFile)}s(eo,"hostMcpConfigPath");function F(e){return`${e.replace(/\/+$/,"")}/mcp`}s(F,"mcpEndpoint");function Xe(e){let t=Ct(e);try{if($t("git",["-C",t,"rev-parse","--is-inside-work-tree"],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()!=="true")return!1}catch{return!1}try{return $t("git",["-C",t,"check-ignore","-q","--",Zn(e)],{stdio:"ignore"}),!1}catch(n){return n.status===1}}s(Xe,"gitTracksUnignored");function _t(e,t){let n=J[e],o=eo(e,t.homeDir,t.env),r=Yn(o),i={};if(r){let a=Wn(o,"utf-8");try{let d=a.trim()===""?{}:JSON.parse(a);if(!d||typeof d!="object"||Array.isArray(d))throw new Error("top level is not an object");i=d}catch(d){return{surface:e,path:o,action:"refused",detail:`not valid JSON (${d.message}); left untouched`}}}let c=i.mcpServers??{};return typeof c!="object"||Array.isArray(c)?{surface:e,path:o,action:"refused",detail:"mcpServers is not an object; left untouched"}:c.contextq?{surface:e,path:o,action:"skipped",detail:"contextq server entry already present"}:Xe(o)?{surface:e,path:o,action:"refused",detail:`sits in a git work tree and is not gitignored; writing the API key there would put it in a commit. Add it to that repo's .gitignore and re-run, or add the server by hand: ${n.label} -> ${F(t.apiUrl)}`}:(i.mcpServers={...c,contextq:n.entry(F(t.apiUrl),t.apiKey)},Gn(Ct(o),{recursive:!0}),zn(o,`${JSON.stringify(i,null,2)}
+`,{mode:384}),Xn(o,384),{surface:e,path:o,action:r?"added":"created",detail:`contextq remote MCP (${F(t.apiUrl)}) with the API key in the header, file mode 600; check with \`${n.listCommand}\``})}s(_t,"wireHostMcp");function no(e){try{return to("git rev-parse --show-toplevel",{cwd:e,stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}s(no,"gitRoot");function oo(e){return ke(Ye(e,".codex"))}s(oo,"hasCodexProjectDir");function ro(e){return ke(Ye(e,".codex"))}s(ro,"hasCodexHome");function Pt(e,t={}){let n=no(e),o=n||e,{host:r}=St(t.hostSignals);if(t.forcedSurface)return{surfaces:[t.forcedSurface],root:o,host:r};let a=ke(Ye(e,".claude"))||!!n&&!(r!=="unknown"&&r!=="claude-code"),d=oo(o)||ro(t.homeDir??Et()),l=[];a&&l.push("claude-code"),d&&l.push("codex");let u=t.homeDir??Et(),p=t.env??process.env;for(let g of Y)ke(te(g,u,p))&&l.push(g);return l.length===0&&l.push("desktop"),{surfaces:l,root:a||d?o:e,host:r}}s(Pt,"detectSurface");B();B();var Ot="the provided API key does not look valid (expected sk_live_<40 hex chars>)",ho="npx @contextq/cli init --key <sk_live_...>";function It(e){return e.status===401||e.status===403}s(It,"isRefused");function Nt(e,t){switch(e){case"explicit":return"The --key";case"ambient":return`The ${t??"environment"}`;case"stored":return`The stored (${_()})`;case"prompt":return"The typed";case"device":return"The browser-approved"}}s(Nt,"describe");async function Dt(e){let t=R(),n=Ze()?t.apiKey:"",o,r;if(e.explicitKey){if(!T.test(e.explicitKey))throw new Error(Ot);o=e.explicitKey,r="explicit"}else if(n)o=n,r="stored";else if(e.ambientKey){if(!T.test(e.ambientKey))throw new Error(Ot);o=e.ambientKey,r="ambient"}else if(e.interactive&&e.deviceLogin)o=await e.deviceLogin(),r="device";else{let a=e.interactive?await e.prompt("ContextQ API key (sk_live_...): "):"";if(!T.test(a))throw new Error("no valid API key available (expected sk_live_<40 hex chars>). Run `contextq login` from an interactive terminal to approve this machine in the browser, set CONTEXT_API_KEY, or pass --key.");o=a,r="prompt"}let i=await e.verify(o);if(It(i)){let a=`${Nt(r,e.ambientVarName)} API key was refused by ${e.apiUrl} (HTTP ${i.status})`;if(!e.interactive)throw new Error(`${a}; nothing was written. Re-run with a working key: ${ho}`);if(e.deviceLogin)console.log(`${a}. Approve this machine in the browser to replace it.`),o=await e.deviceLogin(),r="device";else{let d=await e.prompt(`${a}. Paste a new key (sk_live_...): `);if(!T.test(d))throw new Error(`${a}, and no valid replacement was entered; nothing was written.`);o=d,r="prompt"}if(i=await e.verify(o),It(i))throw new Error(`${Nt(r,null)} API key was refused by ${e.apiUrl} (HTTP ${i.status}); nothing was written.`)}if(r==="device"&&!i.ok){let a=i.status?`HTTP ${i.status}`:i.error??"unknown error";throw new Error(`could not verify the browser-approved key against ${e.apiUrl} (${a}); nothing was written. Run \`contextq login\` again once the server answers.`)}return{decision:U({explicitKey:r==="explicit"||r==="prompt"||r==="device"?o:void 0,ambientVarName:e.ambientVarName,ambientKey:e.ambientKey,apiUrl:e.apiUrl}),verify:i,source:r}}s(Dt,"resolveVerifiedCredentials");B();import{hostname as yo}from"os";var S=class extends Error{static{s(this,"DeviceLoginError")}code;constructor(t,n){super(n),this.name="DeviceLoginError",this.code=t}},wo=5,ko=5,xo=600;function bo(e,t){return new Promise((n,o)=>{if(t?.aborted)return o(new S("cancelled","login cancelled; nothing was written"));let r=setTimeout(()=>{t?.removeEventListener("abort",i),n()},e),i=s(()=>{clearTimeout(r),o(new S("cancelled","login cancelled; nothing was written"))},"onAbort");t?.addEventListener("abort",i,{once:!0})})}s(bo,"defaultSleep");async function Ut(e){try{return await e.json()}catch{return null}}s(Ut,"readJson");function Lt(e,t){return typeof e=="number"&&Number.isInteger(e)&&e>0?e:t}s(Lt,"positiveInt");async function ve(e){let t=e.fetchImpl??fetch,n=e.sleep??bo,o=e.now??Date.now,r=e.apiUrl.replace(/\/+$/,""),i=s(()=>new S("cancelled","login cancelled; nothing was written"),"cancelled"),c;try{c=await t(`${r}/api/auth/device/start`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({client_name:e.clientName??"@contextq/cli",hostname:e.hostname??yo()}),signal:e.signal})}catch(f){throw e.signal?.aborted?i():new S("unreachable",`could not reach ${r}/api/auth/device/start (${f.message})`)}let a=c.ok?await Ut(c):null,d=typeof a?.device_code=="string"?a.device_code:"",l=typeof a?.user_code=="string"?a.user_code:"";if(!d||!l)throw new S("protocol",`${r} did not start a device login (HTTP ${c.status}); is this a ContextQ server?`);let u=typeof a?.verification_uri_complete=="string"&&a.verification_uri_complete||typeof a?.verification_uri=="string"&&a.verification_uri||`${r}/link`,p=Lt(a?.expires_in,xo),g=Lt(a?.interval,ko);e.onPrompt({verificationUri:u,userCode:l,expiresInSeconds:p});let h=o()+p*1e3;for(;;){if(o()>=h)throw new S("expired_token","the approval window expired before this machine was approved; nothing was written");if(await n(g*1e3,e.signal),e.signal?.aborted)throw i();let f;try{f=await t(`${r}/api/auth/device/token`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({device_code:d}),signal:e.signal})}catch{if(e.signal?.aborted)throw i();continue}let w=await Ut(f);if(f.status===200){let y=w?.api_key;if(typeof y=="string"&&T.test(y))return y;throw new S("protocol","the token endpoint answered 200 without a well-formed API key; nothing was written")}let k=typeof w?.error=="string"?w.error:"";switch(k){case"authorization_pending":continue;case"slow_down":g+=wo;continue;case"access_denied":throw new S("access_denied","the request was denied in the browser; nothing was written");case"expired_token":throw new S("expired_token","the device code expired; run the command again");case"invalid_grant":throw new S("invalid_grant","the server rejected the device code; run the command again");default:if(f.status>=500||f.status===429)continue;throw new S("protocol",`unexpected answer from the token endpoint (HTTP ${f.status}${k?`, ${k}`:""})`)}}}s(ve,"deviceLogin");import{existsSync as vo,readFileSync as So,writeFileSync as $o}from"fs";import{execFileSync as Co}from"child_process";import{join as _o}from"path";function Eo(e,t){try{return Co("git",["check-ignore","-q","--",t],{cwd:e,stdio:"ignore"}),!0}catch(n){return n.status===1?!1:null}}s(Eo,"isPathGitIgnored");function Kt(e,t,n,o){let r=_o(e,".mcp.json"),i=vo(r),c={};if(i){let a=So(r,"utf-8");try{c=a.trim()===""?{}:JSON.parse(a)}catch(d){throw new Error(`.mcp.json exists but is not valid JSON (${d.message}) -- refusing to touch it`)}}if(c.mcpServers??={},c.mcpServers.contextq)return{path:r,action:"skipped",detail:"contextq server entry already present"};if(n){let a=Eo(e,".mcp.json");if(a===!1)throw new Error('.mcp.json is not covered by .gitignore in this repo -- refusing to write the raw API key into a file git would track. Add ".mcp.json" to .gitignore first, or re-run without --embed-key to use the safer ${CONTEXT_API_KEY} placeholder instead.');a===null&&console.log("[warn]  could not verify .mcp.json is gitignored (no git repo detected at this path) -- writing the raw key anyway.")}return c.mcpServers.contextq={command:"npx",args:["-y","@contextq/mcp"],env:{CONTEXT_API_URL:t,CONTEXT_API_KEY:n?o:"${CONTEXT_API_KEY}"}},$o(r,`${JSON.stringify(c,null,2)}
+`),{path:r,action:i?"added":"created",detail:`contextq server wired (key=${n?"embedded literal":"${CONTEXT_API_KEY} placeholder"})`}}s(Kt,"wireMcpJson");import{appendFileSync as Po,chmodSync as To,existsSync as Se,mkdirSync as Ao,readFileSync as qt,writeFileSync as Ro}from"fs";import{execFileSync as Mt}from"child_process";import{dirname as Oo,join as $e}from"path";import{parse as Ht,stringify as Io}from"smol-toml";var Ce=".codex/config.toml";function No(e){return $e(e,".codex","config.toml")}s(No,"codexConfigPath");function Do(e,t){if(!Se($e(e,".git")))return!1;try{return Mt("git",["-C",e,"ls-files","--error-unmatch","--",t],{stdio:"ignore"}),!0}catch{return!1}}s(Do,"gitTracked");function Uo(e,t){try{return Mt("git",["-C",e,"check-ignore","-q","--",t],{stdio:"ignore"}),!0}catch{return!1}}s(Uo,"gitIgnored");function Lo(e){if(!Se($e(e,".git"))||Uo(e,Ce))return;let t=$e(e,".gitignore"),n=Se(t)?qt(t,"utf-8"):"",o=n===""||n.endsWith(`
+`)?"":`
+`;Po(t,`${o}${Ce}
+`)}s(Lo,"ensureConfigGitignored");function Ko(e,t){return Io({mcp_servers:{contextq:{url:F(e),http_headers:{Authorization:`Bearer ${t}`}}}})}s(Ko,"codexMcpBlock");function jt(e){let t=e.mcp_servers;if(!(!t||typeof t!="object"||Array.isArray(t)))return t.contextq}s(jt,"contextqEntry");function Ft(e,t,n){let o=No(e),r=Se(o),i=r?qt(o,"utf-8"):"";if(r){let d;try{d=Ht(i)}catch(l){return{path:o,action:"refused",detail:`not valid TOML (${l.message.split(`
+`)[0]}); left untouched`}}if(jt(d)!==void 0)return{path:o,action:"skipped",detail:"mcp_servers.contextq already present"}}if(Do(e,Ce))return{path:o,action:"refused",detail:`is tracked by git; writing the API key there would put it in a commit. Untrack it (git rm --cached ${Ce}) and re-run, or add the server by hand: codex -> ${F(t)}`};let c=i===""?"":i.endsWith(`
+`)?`
+`:`
+
+`,a=`${i}${c}${Ko(t,n)}`;try{let d=Ht(a);if(jt(d)===void 0)throw new Error("mcp_servers.contextq missing after merge")}catch(d){return{path:o,action:"refused",detail:`adding [mcp_servers.contextq] would not parse (${d.message.split(`
+`)[0]}), e.g. mcp_servers is an inline table; left untouched`}}return Ao(Oo(o),{recursive:!0}),Lo(e),Ro(o,a,{mode:384}),To(o,384),{path:o,action:r?"added":"created",detail:`contextq streamable HTTP MCP (${F(t)}) with the API key in http_headers, file mode 600, gitignored; Codex reads project config only in a trusted project, so run \`codex\` once here and accept the trust prompt, then check with \`codex mcp list\``}}s(Ft,"wireCodexMcp");import{chmodSync as Xo,existsSync as tt,mkdirSync as Yt,readFileSync as Yo,writeFileSync as Gt}from"fs";import{dirname as Wt,join as _e}from"path";import{appendFileSync as Ho,existsSync as ne,mkdirSync as jo,readFileSync as et,writeFileSync as qo}from"fs";import{execFileSync as Mo}from"child_process";import{join as L,relative as Fo}from"path";var Jo=/contextq-boot\.sh|contextq.*boot/;function Jt(e){return`'${e.split("'").join("'\\''")}'`}s(Jt,"shellQuote");var V="npx -y --prefer-offline @contextq/cli";function Bt(e,t,n,o=V){return`${o} hook boot --format ${n} --agent ${Jt(e)} --workspace ${Jt(t)}`}s(Bt,"buildBootCommand");function Bo(e,t){if(!ne(L(e,".git")))return!1;try{return Mo("git",["-C",e,"ls-files","--error-unmatch","--",Fo(e,t)],{stdio:"ignore"}),!0}catch{return!1}}s(Bo,"gitTracked");function Vt(e,t,n){let{path:o,dir:r,topLevelDefaults:i}=e,c=ne(o),a={};if(c){let l=et(o,"utf-8");try{a=l.trim()===""?{}:JSON.parse(l)}catch(u){return{path:o,action:"refused",detail:`not valid JSON (${u.message}); left untouched`}}if(!a||typeof a!="object"||Array.isArray(a))return{path:o,action:"refused",detail:"top level is not a JSON object; left untouched"}}if(i)for(let[l,u]of Object.entries(i))a[l]===void 0&&(a[l]=u);return a.hooks??={},a.hooks.SessionStart??=[],a.hooks.SessionStart.some(l=>(l?.hooks??[]).some(u=>typeof u.command=="string"&&Jo.test(u.command)))?{path:o,action:"skipped",detail:"SessionStart contextq-boot hook already present"}:e.root&&Bo(e.root,o)?{path:o,action:"refused",detail:"is tracked by git; a per-machine hook would be committed for every teammate. Untrack it and re-run"}:(a.hooks.SessionStart.push({hooks:[{type:"command",command:t}]}),jo(r,{recursive:!0}),qo(o,`${JSON.stringify(a,null,2)}
+`),{path:o,action:"wired",detail:n})}s(Vt,"mergeSessionStartHook");function Qt(e,t,n,o=V){let r=L(e,".claude","settings.local.json"),i=Bt(t,n,"claude",o);return Vt({path:r,dir:L(e,".claude"),root:e},i,`SessionStart boot hook wired (agent=${t}, workspace=${n}; runs \`${o} hook boot\`, key from the credentials file)`)}s(Qt,"wireSessionHook");function Vo(e){let t=L(e,".codex","config.toml");if(!ne(t))return!1;let n=et(t,"utf-8");return/^\s*\[{1,2}hooks(\.|\])/m.test(n)}s(Vo,"hasInlineHooksTable");function Qo(e,t){if(!ne(L(e,".git")))return;let n=L(e,".gitignore"),o=ne(n)?et(n,"utf-8"):"";if(new Set(o.split(`
+`).map(c=>c.trim())).has(t))return;let i=`
+# .codex/hooks.json embeds a per-machine absolute path (the contextq boot
+# hook command) -- gitignored the same way .claude/settings.local.json is.
+# Each teammate who wants it needs to run \`npx contextq init\` themselves.
+${t}
+`;Ho(n,i)}s(Qo,"ensureGitignored");function Xt(e,t,n,o=V){let r=L(e,".codex","hooks.json"),i=Bt(t,n,"codex",o),c="Codex requires this hook to be TRUSTED before it runs -- start `codex` in this repo and approve it at the hook-trust prompt (or review/trust via `/hooks` in a session)",a=Vo(e)?" -- WARNING: .codex/config.toml also declares an inline [hooks] table; Codex loads both hooks.json and the inline table and warns on every run. Prefer one representation per layer.":"",d=Vt({path:r,dir:L(e,".codex"),root:e,topLevelDefaults:{description:"ContextQ boot hook (managed by `npx contextq init` -- re-run the installer to update, do not hand-edit)"}},i,`SessionStart boot hook wired (agent=${t}, workspace=${n}). ${c}.${a}`);return d.action==="wired"&&Qo(e,".codex/hooks.json"),d}s(Xt,"wireCodexSessionHook");var Go=/contextq.*hook boot|contextq-boot\.sh/;function Wo(e,t=V){return`${t} hook boot --format ${e} --require-config`}s(Wo,"hostHookCommand");function zo(e,t,n){let o=te(e,t,n);return e==="gemini"?_e(o,"settings.json"):e==="cursor"?_e(o,"hooks.json"):_e(o,"hooks","contextq.json")}s(zo,"hostHookPath");function Zo(e){if(!tt(e))return{doc:{}};let t=Yo(e,"utf-8");try{let n=t.trim()===""?{}:JSON.parse(t);return!n||typeof n!="object"||Array.isArray(n)?{error:"top level is not a JSON object"}:{doc:n}}catch(n){return{error:`not valid JSON (${n.message})`}}}s(Zo,"readJsonObject");function er(e,t){let n=e.hooks??={};if(typeof n!="object"||Array.isArray(n))return;let o=n[t]??=[];return Array.isArray(o)?o:void 0}s(er,"eventList");function tr(e){return JSON.stringify(e).match(Go)!==null}s(tr,"alreadyWired");function zt(e,t){let n=zo(e,t.homeDir,t.env),o=tt(n),{doc:r,error:i}=Zo(n);if(!r)return{surface:e,path:n,action:"refused",detail:`${i}; left untouched`};let c=Wo(e,t.runner),a=e==="gemini"?"SessionStart":"sessionStart";e!=="gemini"&&(r.version??=1);let d=er(r,a);return d?tr(d)?{surface:e,path:n,action:"skipped",detail:"contextq boot hook already present"}:Xe(n)?{surface:e,path:n,action:"refused",detail:`sits in a git work tree and is not gitignored; add the SessionStart hook by hand: ${c}`}:(e==="gemini"?d.push({hooks:[{type:"command",name:"contextq-boot",command:c,timeout:3e4}]}):e==="cursor"?d.push({command:c,timeout:30}):d.push({type:"command",bash:c,timeoutSec:30}),Yt(Wt(n),{recursive:!0}),Gt(n,`${JSON.stringify(r,null,2)}
+`,{mode:384}),Xo(n,384),{surface:e,path:n,action:o?"added":"created",detail:`SessionStart boot hook (runs only in repos with a .contextq/config.json); ${e==="cursor"?"Cursor runs sessionStart without waiting, so the first turn may not see it":"the boot pack is injected at session start"}`}):{surface:e,path:n,action:"refused",detail:`hooks.${a} is not an array; left untouched`}}s(zt,"wireHostHook");function Zt(e,t,n){let o=_e(e,".contextq","config.json");return tt(o)?{path:o,action:"skipped",detail:"repo already bound -- left untouched"}:(Yt(Wt(o),{recursive:!0}),Gt(o,`${JSON.stringify({config_schema_version:5,workspace:t,agent:n,read_scope:"own+global"},null,2)}
+`),{path:o,action:"created",detail:`binds this repo to workspace ${t} for the host hooks; commit it so other machines share the binding`})}s(Zt,"ensureRepoConfig");Pe();B();Ae();import{execFileSync as dr}from"child_process";import{existsSync as rn,readFileSync as ur}from"fs";import{basename as sn,join as an}from"path";var st=["claude","codex","gemini","cursor","copilot"],pr="https://app.contextq.dev";function oe(e){let t=(e??"").trim();return!t||/^\$\{[^}]*\}$/.test(t)?"":t}s(oe,"usable");function gr(e){let t=R(),n=oe(e.CONTEXT_API_KEY)||oe(e.CTQ_API_KEY),o=n||t.apiKey,r=(n?oe(e.CONTEXT_API_URL)||oe(e.CTQ_API_URL):"")||t.apiUrl||oe(e.CONTEXT_API_URL)||pr;return{apiKey:o,apiUrl:r.replace(/\/+$/,"")}}s(gr,"resolveHookCreds");function fr(e,t){if(!t||t.trim()==="")return e;try{let n=JSON.parse(t);if(typeof n.cwd=="string"&&n.cwd)return n.cwd;if(Array.isArray(n.workspace_roots)&&typeof n.workspace_roots[0]=="string")return n.workspace_roots[0]}catch{return e}return e}s(fr,"sessionCwd");function it(e,t){try{return dr("git",["-C",e,...t],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}s(it,"git");function mr(e,t,n){let o=an(e,".contextq","config.json");if(rn(o))return ur(o,"utf-8");let r=K(sn(e));return JSON.stringify({workspace:(n||r).toLowerCase(),agent:t||r,read_scope:"own+global"})}s(mr,"hookConfig");function Re(e,t){return JSON.stringify(e==="cursor"?{additional_context:t}:e==="copilot"?{additionalContext:t}:{hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:t}})}s(Re,"formatForHost");async function cn(e){let t=fr(e.cwd,e.stdinText),n=it(t,["rev-parse","--show-toplevel"]);if(!n||e.requireConfig&&!rn(an(n,".contextq","config.json")))return"";let{apiKey:o,apiUrl:r}=gr(e.env);if(!o)return Re(e.format,"ContextQ: no API key found (CONTEXT_API_KEY or the credentials file `npx @contextq/cli init` writes), so no memory was loaded this session. Fix: run npx @contextq/cli init in this repo.");let i=new URLSearchParams({config:mr(n,e.agent,e.workspace),agent_slug:e.agent??"",project:sn(n),git_root:n,branch:it(n,["branch","--show-current"]),head_sha:it(n,["rev-parse","--short","HEAD"]),goal:"",board:"",token_budget:"3000"}),c=e.fetchImpl??fetch,a=0,d="";try{let l=await c(`${r}/api/agent/hooks/session-start`,{method:"POST",headers:{Authorization:`Bearer ${o}`,Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:i.toString(),signal:AbortSignal.timeout(e.timeoutMs??1e4)});a=l.status,d=await l.text()}catch{a=0}if(a===401||a===403)return Re(e.format,`ContextQ: ${r} refused the stored API key (HTTP ${a}): it is expired, revoked or wrong, so no memory was loaded and nothing will be saved this session. Fix: npx @contextq/cli init --key <new sk_live_ key>, or run init from a terminal to be prompted.`);if(a===0||a>=500)return Re(e.format,`ContextQ: ${r} is unreachable or failing (HTTP ${a}), so no memory was loaded this session. The key was not checked; memory resumes when the server answers again.`);if(a<200||a>=300||d.trim()==="")return"";try{let u=JSON.parse(d).hookSpecificOutput?.additionalContext;return typeof u!="string"||u===""?"":Re(e.format,u)}catch{return""}}s(cn,"runHookBoot");async function ln(e=500){return process.stdin.isTTY?"":new Promise(t=>{let n="",o=s(()=>{process.stdin.removeAllListeners("data"),process.stdin.removeAllListeners("end"),process.stdin.pause(),t(n)},"done"),r=setTimeout(o,e);process.stdin.setEncoding("utf8"),process.stdin.on("data",i=>{n+=i}),process.stdin.on("end",()=>{clearTimeout(r),o()})})}s(ln,"readStdinIfPiped");import{appendFileSync as hr,existsSync as dn,readFileSync as yr}from"fs";import{execFileSync as wr}from"child_process";import{join as at}from"path";var kr=[".contextq/tasks/TASKS.md",".contextq/tasks/tasks/T*.md",".contextq/tasks/.render*",".contextq/tasks/status.log"];function xr(e){try{return wr("git",["-C",e,"ls-files","--error-unmatch","--",".contextq/tasks/TASKS.md"],{stdio:"ignore"}),!0}catch{return!1}}s(xr,"manifestTracked");function un(e){let t=at(e,".gitignore");if(!dn(at(e,".git")))return{path:t,action:"skipped",detail:"not a git repo -- no board render to keep out of commits"};if(xr(e))return{path:at(e,".contextq","tasks","TASKS.md"),action:"skipped",detail:"this repo tracks a git-sourced board -- left untouched"};let n=dn(t)?yr(t,"utf-8"):"",o=new Set(n.split(`
+`).map(c=>c.trim())),r=kr.filter(c=>!o.has(c));if(r.length===0)return{path:t,action:"skipped",detail:"board render already gitignored"};let i=n===""||n.endsWith(`
+`)?"":`
+`;return hr(t,`${i}${r.join(`
+`)}
+`),{path:t,action:"created",detail:"gitignored the task board render (.contextq/tasks/TASKS.md is a read-only copy of the cloud board, never committed)"}}s(un,"initTasksDir");function pn(e){console.log(`
+No git repo or existing Claude Code project found here, so there is nothing on
+disk to scaffold. For Claude Desktop, Cowork, or any other MCP-capable client
+that reads a manually-edited config file, connect ContextQ in 3 steps:
+
+  1. Open the ContextQ dashboard -> Settings -> API keys -> create a key
+     ${e}/dashboard/api-keys
+
+  2. Add this to your client's MCP config file (e.g. claude_desktop_config.json):
+
+     {
+       "mcpServers": {
+         "contextq": {
+           "command": "npx",
+           "args": ["-y", "@contextq/mcp"],
+           "env": {
+             "CONTEXT_API_URL": "${e}",
+             "CONTEXT_API_KEY": "<your key from step 1>"
+           }
+         }
+       }
+     }
+
+  3. Restart the client so it picks up the new MCP server.
+
+There is no auto-connect for Desktop/Cowork today -- these clients only read
+their config file on start, so step 2 has to be a manual paste. Re-run
+"npx @contextq/cli init" inside a git repo (or an existing Claude Code project) to
+get the automatic .mcp.json + hook + task-manifest scaffolding instead.
+`)}s(pn,"printDesktopGuide");async function gn(e){return process.stdin.isTTY?new Promise(t=>{let n=process.stdin,o=process.stdout;o.write(e);let r="",i=s(c=>{let a=c.toString("utf8");switch(a){case`
+`:case"\r":case"":n.setRawMode?.(!1),n.pause(),n.removeListener("data",i),o.write(`
+`),t(r.trim());break;case"":o.write(`
+`),process.exit(130);break;case"\x7F":case"\b":r.length>0&&(r=r.slice(0,-1),o.write("\b \b"));break;default:r+=a,o.write("*")}},"onData");n.setRawMode?.(!0),n.resume(),n.setEncoding("utf8"),n.on("data",i)}):""}s(gn,"promptHidden");Ae();import{existsSync as ct,mkdirSync as fn,readdirSync as br,readFileSync as mn,statSync as vr,writeFileSync as Sr}from"fs";import{join as Oe}from"path";function $r(e,t){let n=new RegExp(`^ {2}${t}: "((?:[^"\\\\]|\\\\.)*)"$`,"m"),o=e.match(n);return o?o[1].replace(/\\(.)/g,"$1"):null}s($r,"extractFrontmatterMetadataValue");function Cr(e){return $r(e,"cluster_key")}s(Cr,"extractClusterKey");function _r(e){if(!ct(e))return[];let t=[];for(let n of br(e)){let o=Oe(e,n);if(!vr(o).isDirectory())continue;let r=Oe(o,"SKILL.md");if(!ct(r))continue;let i=mn(r,"utf-8"),c=Cr(i);c&&t.push({folder:n,clusterKey:c})}return t}s(_r,"scanLocalSkills");function Er(e,t){return e.replace(/^name: .+$/m,`name: ${t}`)}s(Er,"withFrontmatterName");async function hn(e){fn(e.dir,{recursive:!0});let t=_r(e.dir),n=new Map(t.map(a=>[a.clusterKey,a.folder])),o=new Set(t.map(a=>a.folder)),r=await e.fetchSkills(),i={written:[],updated:[],unchanged:[],orphans:[]},c=new Set;for(let a of r){c.add(a.clusterKey);let l=n.get(a.clusterKey);l||(l=o.has(a.slug)?`${a.slug}-c${a.contextId}`:a.slug,o.add(l),n.set(a.clusterKey,l));let u=l===a.slug?a.markdown:Er(a.markdown,l),p=Oe(e.dir,l),g=Oe(p,"SKILL.md"),h=ct(g)?mn(g,"utf-8"):null;if(h===u){i.unchanged.push(l);continue}fn(p,{recursive:!0}),Sr(g,u,"utf-8"),i[h===null?"written":"updated"].push(l)}for(let a of t)c.has(a.clusterKey)||i.orphans.push(a.folder);return i}s(hn,"syncSkills");var q="https://app.contextq.dev";function mi(e){let t=e.length>0&&!e[0].startsWith("-"),n={command:t?e[0]:"",embedKey:!1,noPlugin:!1,help:!1,local:!1};for(let o=t?1:0;o<e.length;o++){let r=e[o];switch(r){case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;case"--workspace":n.workspace=e[++o];break;case"--agent":n.agent=e[++o];break;case"--embed-key":n.embedKey=!0;break;case"--no-plugin":n.noPlugin=!0;break;case"--local":n.local=!0;break;case"--port":{let i=e[++o]??"",c=/^\d+$/.test(i)?Number(i):NaN;if(!Number.isInteger(c)||c<1||c>65535)throw new Error(`invalid port "${i}"; use a number from 1 to 65535`);n.port=c;break}case"--surface":{let i=e[++o];if(i!=="claude-code"&&i!=="codex"&&!Y.includes(i))throw new Error(`--surface value "${i}" is invalid -- allowed: claude-code, codex, ${Y.join(", ")}`);n.surface=i;break}case"-h":case"--help":n.help=!0;break;default:throw new Error(`unknown argument: ${r}`)}}return n}s(mi,"parseArgs");function he(){console.log(`contextq \u2014 one-command installer for ContextQ
 
 Usage:
+  npx @contextq/cli login [--url <url>]
+  npx @contextq/cli local start|status|stop [--port <n>] [--state-dir <dir>]
   npx @contextq/cli init [options]
+  npx @contextq/cli init --local [--workspace <slug>] [--agent <slug>] [--port <n>]
+  npx @contextq/cli attach [--url <url>] [--restart] [--leave-denied] [--abort] [--key-stdin]
+
+API key: \`login\` prints a link and a code; approve this machine in the browser and the
+key is fetched, checked against the server and saved (mode 600), never typed or pasted.
+With no key stored, init runs the same browser approval from an interactive terminal, or
+reads CONTEXT_API_KEY / CTQ_API_KEY from the environment. A refused or unverified key is
+never written.
 
 Options:
-  --key <sk_live_...>   API key (else CONTEXT_API_KEY/CTQ_API_KEY env, else prompt)
-  --url <url>            ContextQ API URL (default: ${DEFAULT_URL})
+  --key <sk_live_...>   Pass or rotate the key on the command line (visible in shell
+                         history; prefer the prompt or the env var)
+  --url <url>            ContextQ API URL (default: ${q})
   --workspace <slug>     Workspace slug for the contextq boot hook (default: repo basename,
-                         sanitized). Allowed: ${SLUG_PATTERN_DESCRIPTION}. Case is folded to
+                         sanitized). Allowed: ${Te}. Case is folded to
                          lowercase automatically (workspace slugs are always lowercase).
   --agent <slug>         Agent slug for the contextq boot hook (default: repo basename,
-                         sanitized). Allowed: ${SLUG_PATTERN_DESCRIPTION}.
+                         sanitized). Allowed: ${Te}.
   --embed-key            Write the literal API key into .mcp.json instead of the
                          safer \${CONTEXT_API_KEY} placeholder (opt-in: convenience
                          vs. a secret sitting on disk)
-  --surface <s>          Force surface detection to exactly one of: claude-code, codex.
-                         Skips autodetection entirely (default: autodetect both --
-                         a repo can be, and often is, both at once).
+  --no-plugin            Wire Claude Code through .mcp.json even when a \`claude\` binary
+                         (2.1.281+) is on PATH. By default init installs the ContextQ
+                         plugin at project scope instead, which carries the MCP server and
+                         the lifecycle hooks and keeps the key in Claude Code's own store.
+  --surface <s>          Force surface detection to exactly one of: claude-code, codex,
+                         gemini, cursor, copilot. Skips autodetection entirely (default:
+                         autodetect all -- a machine can be, and often is, several at once).
+                         gemini, cursor and copilot get the remote MCP server in their
+                         user-level config (~/.gemini/settings.json, ~/.cursor/mcp.json,
+                         ~/.copilot/mcp-config.json) with the key in the header, mode 600.
   -h, --help             Show this help
 
 Usage:
   npx @contextq/cli skills sync <dir> [options]
 
-Pulls this tenant's distilled procedures (T376) as standard Agent Skills
+Pulls this tenant's distilled procedures as standard Agent Skills
 folders (<dir>/<slug>/SKILL.md). Safe to re-run: an existing folder is
 matched by its own metadata.cluster_key and rewritten in place, never
 duplicated; a folder whose context no longer resolves is reported as an
@@ -101,321 +128,6 @@ Options:
   --key <sk_live_...>   API key (else CONTEXT_API_KEY/CTQ_API_KEY env, else the
                          credential file written by \`contextq init\`)
   --url <url>            ContextQ API URL (else the credential file, else
-                         CONTEXT_API_URL/CTQ_API_URL env, default: ${DEFAULT_URL})
-`);
-}
-function relative(root, path) {
-    return path.startsWith(`${root}/`) ? path.slice(root.length + 1) : path;
-}
-function label(action) {
-    const known = {
-        created: '[create]',
-        added: '[add]  ',
-        wired: '[create]',
-        rotated: '[rotate]',
-        skipped: '[skip] ',
-        verified: '[check]',
-        failed: '[check]',
-    };
-    return known[action] ?? `[${action}]`;
-}
-/**
- * T474: the installer used to wire .mcp.json / the SessionStart hook / the
- * task manifest and declare success without ever confirming the key + URL it
- * just wrote actually authenticate against the server. Ping a cheap
- * read-scoped endpoint so a typo'd key or URL fails loudly here instead of
- * surfacing later as "the MCP tools aren't showing up".
- */
-async function verifyConnection(apiUrl, apiKey) {
-    try {
-        const res = await fetch(`${apiUrl.replace(/\/$/, '')}/api/workspaces`, {
-            headers: { Authorization: `Bearer ${apiKey}` },
-        });
-        return { ok: res.status === 200, status: res.status };
-    }
-    catch (err) {
-        return { ok: false, error: err.message };
-    }
-}
-async function runInit(args) {
-    const cwd = process.cwd();
-    const { surfaces, root } = detectSurface(cwd, { forcedSurface: args.surface });
-    console.log('ContextQ init');
-    console.log('=============');
-    if (surfaces.length === 1 && surfaces[0] === 'desktop') {
-        console.log(`Surface detected: desktop/other (no git repo, .claude/, or .codex/ found at ${cwd})`);
-        printDesktopGuide(args.url ?? DEFAULT_URL);
-        return;
-    }
-    console.log(`Surface(s) detected: ${surfaces.join(', ')} (root: ${root})`);
-    const existing = readExistingCreds();
-    const apiUrl = args.url || existing.apiUrl || process.env.CONTEXT_API_URL || DEFAULT_URL;
-    // T676: a demo run with only an AMBIENT env var set (direnv-exported
-    // CONTEXT_API_KEY from some repo's .env.local, say) used to be treated
-    // exactly like an explicit --key, silently overwriting a pre-existing
-    // machine-wide credential file with no backup. decideCredentialWrite()
-    // (platform-cred.ts) now requires --key for rotation, backs up before any
-    // real overwrite, and no-ops when nothing would change -- see its doc
-    // comment for the full branch table.
-    const ambientVarName = process.env.CONTEXT_API_KEY
-        ? 'CONTEXT_API_KEY'
-        : process.env.CTQ_API_KEY
-            ? 'CTQ_API_KEY'
-            : null;
-    const ambientKey = ambientVarName ? process.env[ambientVarName] : '';
-    let decision = decideCredentialWrite({ explicitKey: args.key, ambientVarName, ambientKey, apiUrl });
-    if (decision.action === null) {
-        // No --key, no ambient env var, and no existing file -- the only case
-        // decideCredentialWrite() can't resolve on its own.
-        const typed = await promptHidden('ContextQ API key (sk_live_...): ');
-        if (!KEY_RE.test(typed)) {
-            throw new Error('no valid API key available (expected sk_live_<40 hex chars>). Pass --key, set ' +
-                'CONTEXT_API_KEY, or re-run from an interactive terminal.');
-        }
-        decision = decideCredentialWrite({ explicitKey: typed, ambientVarName: null, ambientKey: '', apiUrl });
-    }
-    const apiKey = decision.apiKey;
-    console.log(decision.credLine);
-    // T656: --agent/--workspace (and the basename(root) fallback) end up
-    // interpolated into a shell command written to the SessionStart hook (see
-    // wireSessionHook below) -- validate/sanitize BEFORE that, on top of the
-    // shell-quoting session-hook.ts itself applies as defense in depth. An
-    // explicit flag value that doesn't fit the slug pattern is a hard error
-    // (no silent truncation); the basename(root) fallback is sanitized
-    // instead, since the user never typed it.
-    let agent;
-    if (args.agent) {
-        agent = validateSlug(args.agent, '--agent');
-    }
-    else {
-        agent = sanitizeSlugFallback(basename(root));
-    }
-    let workspace;
-    if (args.workspace) {
-        // Workspace slugs are always lowercase in this product (CLAUDE.md) --
-        // folding case is a documented convention, not a silent rewrite, so an
-        // explicit --workspace that differs from the API only by case is
-        // lowercased and then validated (never lowercased AWAY a genuine
-        // charset violation). --agent gets no such courtesy: it has no
-        // documented lowercase-only convention, so an explicit --agent value
-        // is validated as typed.
-        const lowered = args.workspace.toLowerCase();
-        workspace = validateSlug(lowered, '--workspace');
-        if (lowered !== args.workspace) {
-            console.log(`[info]   --workspace lowercased to match slug convention: "${args.workspace}" -> "${lowered}"`);
-        }
-    }
-    else {
-        workspace = sanitizeSlugFallback(basename(root));
-    }
-    console.log(`[info]   agent=${agent} workspace=${workspace}`);
-    let mcpResult;
-    if (surfaces.includes('claude-code')) {
-        mcpResult = wireMcpJson(root, apiUrl, args.embedKey, apiKey);
-        console.log(`${label(mcpResult.action)} ${relative(root, mcpResult.path)} (${mcpResult.detail})`);
-        const hookResult = wireSessionHook(root, agent, workspace);
-        console.log(`${label(hookResult.action)} ${relative(root, hookResult.path)} (${hookResult.detail})`);
-        const tasksResult = initTasksDir(root);
-        console.log(`${label(tasksResult.action)} ${relative(root, tasksResult.path)} (${tasksResult.detail})`);
-    }
-    if (surfaces.includes('codex')) {
-        console.log('');
-        console.log('[info]   Codex hooks -- assumptions this install makes:');
-        console.log('         - Sandbox/approval: the boot hook makes an outbound HTTP call to the ContextQ');
-        console.log('           API. Verified empirically (codex-cli 0.146.0, `codex exec --sandbox');
-        console.log('           workspace-write`, no approval flag): a TRUSTED hook\'s outbound call is NOT');
-        console.log('           gated by sandbox_mode/approval_policy the way model-issued shell commands');
-        console.log('           are -- the real gate is hook TRUST (see the note below), not the sandbox.');
-        console.log('           Once trusted, this should work under any sandbox_mode/approval_policy combo.');
-        console.log('           If it still produces no injected context, `codex doctor` shows current sandbox');
-        console.log('           + approval state as a starting point for diagnosis.');
-        console.log('         - Native Memories: Codex ships its own Memories feature (off by default). If you');
-        console.log('           turn it on, set memories.disable_on_external_context = true in config.toml (or');
-        console.log('           its older alias no_memories_if_mcp_or_web_search) -- otherwise a session that');
-        console.log('           used MCP tools (including ContextQ\'s own MCP server) still feeds Codex\'s native');
-        console.log('           memory extraction too, duplicating what ContextQ already captures.');
-        console.log('');
-        const codexHookResult = wireCodexSessionHook(root, agent, workspace);
-        console.log(`${label(codexHookResult.action)} ${relative(root, codexHookResult.path)} (${codexHookResult.detail})`);
-    }
-    const verifyResult = await verifyConnection(apiUrl, apiKey);
-    if (verifyResult.ok) {
-        console.log(`${label('verified')} connection to ${apiUrl} (GET /api/workspaces -> 200)`);
-    }
-    else {
-        const detail = verifyResult.status ? `HTTP ${verifyResult.status}` : verifyResult.error ?? 'unknown error';
-        console.log(`${label('failed')} connection to ${apiUrl} (${detail}) -- check your API key and --url`);
-        if (verifyResult.status === 401 || verifyResult.status === 403) {
-            process.exitCode = 1;
-        }
-    }
-    if (mcpResult && !args.embedKey && mcpResult.action !== 'skipped') {
-        console.log('');
-        console.log('NOTE: .mcp.json references ${CONTEXT_API_KEY} -- Claude Code expands that from');
-        console.log('its OWN process environment, not from the credential file just written.');
-        console.log('Export it in your shell profile before starting Claude Code:');
-        console.log('  export CONTEXT_API_KEY=<your key>');
-        console.log('...or re-run with --embed-key to write the literal key into .mcp.json instead.');
-    }
-    console.log('');
-    const doneSurfaces = surfaces.filter((s) => s !== 'desktop');
-    const doneNote = doneSurfaces
-        .map((s) => (s === 'claude-code' ? 'a new Claude Code session' : 'a new `codex` run'))
-        .join(' / start ');
-    console.log(`Done. Open ${doneNote} in this repo to pick up the wiring.`);
-    // Claude Code 2.1.268+ can install the same MCP server as a plugin, which
-    // collects the API key through the manifest's userConfig (secure storage,
-    // never settings.json) instead of needing CONTEXT_API_KEY exported into the
-    // shell. This installer still exists for Codex, Desktop, CI, and the
-    // contextq SessionStart hook, none of which the plugin covers -- so point
-    // at it rather than replacing this path.
-    if (surfaces.includes('claude-code')) {
-        console.log('');
-        console.log('Claude Code 2.1.268+ can install the MCP half of this as a plugin instead,');
-        console.log('with no CONTEXT_API_KEY to export:');
-        console.log('  claude plugin marketplace add https://app.contextq.dev/plugin/marketplace.json');
-        console.log('  claude plugin install contextq@contextq-plugins --config apiKey=<your key>');
-        console.log('See docs/mcp-setup.md. This installer stays the path for Codex and CI.');
-    }
-}
-/**
- * Separate from parseArgs() on purpose: `skills sync <dir>` has a
- * subcommand + a required positional argument, a shape parseArgs()'s
- * single-command-token model doesn't fit. Dispatched from main() before
- * parseArgs() ever sees the argv.
- */
-function parseSkillsSyncArgs(argv) {
-    const positional = [];
-    const args = {};
-    for (let i = 0; i < argv.length; i++) {
-        const a = argv[i];
-        switch (a) {
-            case '--workspace':
-                args.workspace = argv[++i];
-                break;
-            case '--key':
-                args.key = argv[++i];
-                break;
-            case '--url':
-                args.url = argv[++i];
-                break;
-            default:
-                if (a.startsWith('-')) {
-                    throw new Error(`unknown argument: ${a}`);
-                }
-                positional.push(a);
-        }
-    }
-    if (positional.length === 0) {
-        throw new Error('missing <dir> argument -- usage: contextq skills sync <dir>');
-    }
-    if (positional.length > 1) {
-        throw new Error(`unexpected extra argument: ${positional[1]}`);
-    }
-    return { ...args, dir: positional[0] };
-}
-/**
- * Resolve credentials the SAME way `contextq init`'s verifyConnection() call
- * does (explicit flag > ambient env var > the credential file `init`
- * already wrote) but read-only -- `skills sync` never writes credentials,
- * it only needs something to authenticate with.
- */
-function resolveApiCreds(args) {
-    const existing = readExistingCreds();
-    const apiUrl = args.url || existing.apiUrl || process.env.CONTEXT_API_URL || process.env.CTQ_API_URL || DEFAULT_URL;
-    const apiKey = args.key || process.env.CONTEXT_API_KEY || process.env.CTQ_API_KEY || existing.apiKey;
-    if (!apiKey) {
-        throw new Error('no API key available -- pass --key, set CONTEXT_API_KEY, or run `contextq init` first to write the credential file');
-    }
-    return { apiUrl, apiKey };
-}
-/**
- * `format=json` (not the default `zip`) so this never needs an unzip
- * dependency in the published `contextq` npm package -- the bulk export
- * route (src/routes/agent.ts) supports both from the same query.
- */
-async function fetchSkillsFromApi(apiUrl, apiKey, workspace) {
-    const url = new URL('/api/agent/skills/export', apiUrl.replace(/\/$/, '') + '/');
-    url.searchParams.set('format', 'json');
-    if (workspace)
-        url.searchParams.set('workspace', workspace);
-    const res = await fetch(url, { headers: { Authorization: `Bearer ${apiKey}` } });
-    if (!res.ok) {
-        throw new Error(`GET ${url.pathname}${url.search} -> HTTP ${res.status}`);
-    }
-    const body = (await res.json());
-    return body.skills;
-}
-async function runSkillsSync(args) {
-    console.log('contextq skills sync');
-    console.log('=====================');
-    const { apiUrl, apiKey } = resolveApiCreds(args);
-    console.log(`[info]   syncing to ${args.dir}${args.workspace ? ` (workspace: ${args.workspace})` : ''}`);
-    const result = await syncSkills({
-        dir: args.dir,
-        fetchSkills: () => fetchSkillsFromApi(apiUrl, apiKey, args.workspace),
-    });
-    for (const f of result.written)
-        console.log(`${label('created')} ${f}/SKILL.md`);
-    for (const f of result.updated)
-        console.log(`${label('added')} ${f}/SKILL.md (rewritten in place)`);
-    console.log(`[info]   ${result.written.length} written, ${result.updated.length} updated, ${result.unchanged.length} unchanged`);
-    if (result.orphans.length > 0) {
-        console.log(`[warn]   ${result.orphans.length} orphaned folder(s) -- left on disk, not deleted:`);
-        for (const f of result.orphans)
-            console.log(`         ${f}/ (its context no longer resolves)`);
-    }
-}
-async function main() {
-    const argv = process.argv.slice(2);
-    if (argv[0] === 'skills') {
-        if (argv[1] === '-h' || argv[1] === '--help') {
-            printHelp();
-            return;
-        }
-        if (argv[1] !== 'sync') {
-            console.error(`contextq: unknown "skills" subcommand "${argv[1] ?? ''}" -- expected "sync"`);
-            printHelp();
-            process.exitCode = 1;
-            return;
-        }
-        try {
-            const skillsArgs = parseSkillsSyncArgs(argv.slice(2));
-            await runSkillsSync(skillsArgs);
-        }
-        catch (err) {
-            console.error(`contextq: ${err.message}`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    let args;
-    try {
-        args = parseArgs(argv);
-    }
-    catch (err) {
-        console.error(`contextq: ${err.message}`);
-        printHelp();
-        process.exitCode = 1;
-        return;
-    }
-    if (args.help || !args.command) {
-        printHelp();
-        return;
-    }
-    if (args.command !== 'init') {
-        console.error(`contextq: unknown command "${args.command}"`);
-        printHelp();
-        process.exitCode = 1;
-        return;
-    }
-    try {
-        await runInit(args);
-    }
-    catch (err) {
-        console.error(`contextq: ${err.message}`);
-        process.exitCode = 1;
-    }
-}
-main();
-//# sourceMappingURL=index.js.map
+                         CONTEXT_API_URL/CTQ_API_URL env, default: ${q})
+`)}s(he,"printHelp");function ee(e,t){return t.startsWith(`${e}/`)?t.slice(e.length+1):t}s(ee,"relative");function A(e){return{created:"[create]",added:"[add]  ",wired:"[create]",rotated:"[rotate]",skipped:"[skip] ",verified:"[check]",failed:"[check]",refused:"[refuse]"}[e]??`[${e}]`}s(A,"label");async function qn(e,t){try{let n=await fetch(`${e.replace(/\/$/,"")}/api/workspaces`,{headers:{Authorization:`Bearer ${t}`}});return{ok:n.status===200,status:n.status}}catch(n){return{ok:!1,error:n.message}}}s(qn,"verifyConnection");function kt(e){console.log(""),console.log("Approve this machine in your browser:"),console.log(`  ${e.verificationUri}`),console.log(`  code: ${e.userCode}`),console.log(`Waiting for approval (expires in ${Math.max(1,Math.round(e.expiresInSeconds/60))} min, Ctrl-C to cancel)...`)}s(kt,"printDevicePrompt");function xt(e){let t=new AbortController,n=s(()=>t.abort(),"onSigint");return process.once("SIGINT",n),e(t.signal).finally(()=>process.removeListener("SIGINT",n))}s(xt,"withSigintAbort");async function hi(e){let t=R(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||q;console.log(`ContextQ login (${n})`);let o=await xt(c=>ve({apiUrl:n,signal:c,onPrompt:kt})),r=await qn(n,o);if(!r.ok){let c=r.status?`HTTP ${r.status}`:r.error??"unknown error";throw new Error(`could not verify the approved key against ${n} (${c}); nothing was written`)}let i=U({explicitKey:o,ambientVarName:null,ambientKey:"",apiUrl:n});console.log("Approved."),console.log(i.credLine),console.log(`[check]  connected to ${n}`)}s(hi,"runLogin");async function yi(e){let t=process.cwd(),{surfaces:n,root:o}=Pt(t,{forcedSurface:e.surface});if(console.log("ContextQ init"),console.log("============="),n.length===1&&n[0]==="desktop"){console.log(`Surface detected: desktop/other (no git repo, .claude/, or .codex/ found at ${t})`),pn(e.url??q);return}console.log(`Surface(s) detected: ${n.join(", ")} (root: ${o})`);let r=R(),i=e.url||r.apiUrl||process.env.CONTEXT_API_URL||q,c=process.env.CONTEXT_API_KEY?"CONTEXT_API_KEY":process.env.CTQ_API_KEY?"CTQ_API_KEY":null,a=c?process.env[c]:"",{decision:d,verify:l}=await Dt({explicitKey:e.key,ambientVarName:c,ambientKey:a,apiUrl:i,interactive:!!process.stdin.isTTY,verify:s(m=>qn(i,m),"verify"),prompt:gn,deviceLogin:s(()=>xt(m=>ve({apiUrl:i,signal:m,onPrompt:kt})),"deviceLogin")}),u=d.apiKey;if(console.log(d.credLine),!l.ok){let m=l.status?`HTTP ${l.status}`:l.error??"unknown error";console.log(`[warn]   could not verify the key against ${i} (${m}); it was kept, re-run init once the server answers`)}let p;e.agent?p=G(e.agent,"--agent"):p=K(jn(o));let g;if(e.workspace){let m=e.workspace.toLowerCase();g=G(m,"--workspace"),m!==e.workspace&&console.log(`[info]   --workspace lowercased to match slug convention: "${e.workspace}" -> "${m}"`)}else g=K(jn(o));console.log(`[info]   agent=${p} workspace=${g}`);let h=process.env.CONTEXTQ_HOOK_RUNNER||V,f,w=!1,k=[],y=!1;if(n.includes("claude-code")){let m=on({noPlugin:e.noPlugin,legacyMcpEntry:nn(o),verifyStatus:l.status});if(!m.delegate)console.log(`[info]   ${m.reason}`);else{let v=Ee(o,i,u,q);v.status==="installed"?(w=!0,k.push("claude-code"),console.log(`${A(v.alreadyInstalled?"skipped":"added")} .claude/settings.json (${O} at project scope -- ${v.message})`)):console.log(`[info]   plugin install ${v.status}: ${v.reason} -- falling back to .mcp.json wiring`)}if(!w){f=Kt(o,i,e.embedKey,u),console.log(`${A(f.action)} ${ee(o,f.path)} (${f.detail})`),k.push("claude-code");let v=Qt(o,p,g,h);console.log(`${A(v.action)} ${ee(o,v.path)} (${v.detail})`),v.action==="refused"&&(process.exitCode=1)}let P=un(o);console.log(`${A(P.action)} ${ee(o,P.path)} (${P.detail})`)}if(n.includes("codex")){console.log(""),console.log("[info]   Codex hooks -- assumptions this install makes:"),console.log("         - Sandbox/approval: the boot hook makes an outbound HTTP call to the ContextQ"),console.log("           API. Verified empirically (codex-cli 0.146.0, `codex exec --sandbox"),console.log("           workspace-write`, no approval flag): a TRUSTED hook's outbound call is NOT"),console.log("           gated by sandbox_mode/approval_policy the way model-issued shell commands"),console.log("           are -- the real gate is hook TRUST (see the note below), not the sandbox."),console.log("           Once trusted, this should work under any sandbox_mode/approval_policy combo."),console.log("           If it still produces no injected context, `codex doctor` shows current sandbox"),console.log("           + approval state as a starting point for diagnosis."),console.log("         - Native Memories: Codex ships its own Memories feature (off by default). If you"),console.log("           turn it on, set memories.disable_on_external_context = true in config.toml (or"),console.log("           its older alias no_memories_if_mcp_or_web_search) -- otherwise a session that"),console.log("           used MCP tools (including ContextQ's own MCP server) still feeds Codex's native"),console.log("           memory extraction too, duplicating what ContextQ already captures."),console.log("");let m=Xt(o,p,g,h);if(console.log(`${A(m.action)} ${ee(o,m.path)} (${m.detail})`),m.action==="refused"&&(process.exitCode=1),!l.ok)console.log("[info]   Codex MCP: not wired -- the key did not verify, and it would be written into .codex/config.toml");else{let P=Ft(o,i,u);console.log(`${A(P.action)} ${ee(o,P.path)} (${P.detail})`),P.action==="refused"?process.exitCode=1:k.push("codex")}}for(let m of Y){if(!n.includes(m))continue;if(!l.ok){console.log(`[info]   ${J[m].label}: not wired -- the key did not verify, and it would be written into the host config`);continue}let P=_t(m,{homeDir:Hn(),env:process.env,apiUrl:i,apiKey:u});console.log(`${A(P.action)} ${P.path} (${J[m].label}: ${P.detail})`),P.action==="refused"?process.exitCode=1:k.push(m);let v=zt(m,{homeDir:Hn(),env:process.env,runner:h});console.log(`${A(v.action)} ${v.path} (${J[m].label}: ${v.detail})`),v.action==="refused"?process.exitCode=1:y=!0}if(l.ok)console.log(`${A("verified")} connection to ${i} (GET /api/workspaces -> 200)`);else{let m=l.status?`HTTP ${l.status}`:l.error??"unknown error";console.log(`${A("failed")} connection to ${i} (${m}) -- check your API key and --url`),(l.status===401||l.status===403)&&(process.exitCode=1)}if(f&&!e.embedKey&&f.action!=="skipped"&&(console.log(""),console.log("NOTE: .mcp.json references ${CONTEXT_API_KEY}. When that variable is unset, the"),console.log(`current @contextq/mcp reads the key from ${_()} instead.`),console.log('If `npx @contextq/mcp` still logs "Auth: NONE", export it before starting Claude Code:'),console.log("  export CONTEXT_API_KEY=<your key>"),console.log("...or re-run with --embed-key to write the literal key into .mcp.json instead.")),y){let m=Zt(o,g,p);console.log(`${A(m.action)} ${ee(o,m.path)} (${m.detail})`)}console.log("");let x={"claude-code":"a new Claude Code session",codex:"a new `codex` run",gemini:"a new `gemini` session",cursor:"a new Cursor or `cursor-agent` session",copilot:"a new `copilot` session"},b=n.filter(m=>m!=="desktop"&&k.includes(m)).map(m=>x[m]).join(" / start ");b?console.log(`Done. Open ${b} in this repo to pick up the wiring.`):(console.log("Nothing was wired: no surface got a ContextQ MCP connection. Fix what is reported above and re-run."),process.exitCode=1),w?(console.log(""),console.log("Next: in that Claude Code session, run /contextq:init to bind this repo to a workspace"),console.log("and project. Until it writes .contextq/config.json, the plugin's MCP tools work but its"),console.log("SessionStart/PreCompact/SessionEnd hooks stay silent and say so.")):n.includes("claude-code")&&(console.log(""),console.log("Claude Code 2.1.281+ can carry all of this as a plugin instead -- MCP server and"),console.log("lifecycle hooks, key in Claude Code's own store. Re-run init without --no-plugin after"),console.log("removing the contextq entry from .mcp.json, rather than installing the plugin on top:"),console.log("both would register the same MCP server. See https://app.contextq.dev/install.md."))}s(yi,"runInit");function wi(e){let t=[],n={};for(let o=0;o<e.length;o++){let r=e[o];switch(r){case"--workspace":n.workspace=e[++o];break;case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;default:if(r.startsWith("-"))throw new Error(`unknown argument: ${r}`);t.push(r)}}if(t.length===0)throw new Error("missing <dir> argument -- usage: contextq skills sync <dir>");if(t.length>1)throw new Error(`unexpected extra argument: ${t[1]}`);return{...n,dir:t[0]}}s(wi,"parseSkillsSyncArgs");function ki(e){let t=R(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||process.env.CTQ_API_URL||q,o=e.key||process.env.CONTEXT_API_KEY||process.env.CTQ_API_KEY||t.apiKey;if(!o)throw new Error("no API key available -- pass --key, set CONTEXT_API_KEY, or run `contextq init` first to write the credential file");return{apiUrl:n,apiKey:o}}s(ki,"resolveApiCreds");async function xi(e,t,n){let o=new URL("/api/agent/skills/export",e.replace(/\/$/,"")+"/");o.searchParams.set("format","json"),n&&o.searchParams.set("workspace",n);let r=await fetch(o,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new Error(`GET ${o.pathname}${o.search} -> HTTP ${r.status}`);return(await r.json()).skills}s(xi,"fetchSkillsFromApi");async function bi(e){console.log("contextq skills sync"),console.log("=====================");let{apiUrl:t,apiKey:n}=ki(e);console.log(`[info]   syncing to ${e.dir}${e.workspace?` (workspace: ${e.workspace})`:""}`);let o=await hn({dir:e.dir,fetchSkills:s(()=>xi(t,n,e.workspace),"fetchSkills")});for(let r of o.written)console.log(`${A("created")} ${r}/SKILL.md`);for(let r of o.updated)console.log(`${A("added")} ${r}/SKILL.md (rewritten in place)`);if(console.log(`[info]   ${o.written.length} written, ${o.updated.length} updated, ${o.unchanged.length} unchanged`),o.orphans.length>0){console.log(`[warn]   ${o.orphans.length} orphaned folder(s) -- left on disk, not deleted:`);for(let r of o.orphans)console.log(`         ${r}/ (its context no longer resolves)`)}}s(bi,"runSkillsSync");function vi(e){let t="claude",n=!1,o,r;for(let i=0;i<e.length;i++){let c=e[i],a=e[i+1];if(c==="--format"&&a){if(!st.includes(a))throw new Error(`--format must be one of: ${st.join(", ")}`);t=a,i++}else if(c==="--agent"&&a)o=a,i++;else if(c==="--workspace"&&a)r=a,i++;else if(c==="--require-config")n=!0;else throw new Error(`unknown "hook boot" argument "${c}"`)}return{format:t,agent:o,workspace:r,requireConfig:n}}s(vi,"parseHookBootArgs");async function Si(e){try{let t=vi(e),n=await cn({cwd:process.env.CLAUDE_PROJECT_DIR||process.cwd(),env:process.env,stdinText:await ln(),...t});n&&process.stdout.write(`${n}
+`)}catch(t){console.error(`contextq hook boot: ${t.message}`)}}s(Si,"runHookBootCommand");async function $i(e){let t={url:q,restart:!1,leaveDenied:!1,abort:!1,keyStdin:!1,ping:void 0};for(let i=0;i<e.length;i++){let c=e[i];if(c==="--url")t.url=e[++i]??"";else if(c==="--restart")t.restart=!0;else if(c==="--leave-denied")t.leaveDenied=!0;else if(c==="--abort")t.abort=!0;else if(c==="--key-stdin")t.keyStdin=!0;else if(c==="--ping")t.ping=!0;else if(c==="--no-ping")t.ping=!1;else{console.error(`contextq: unknown option "${c}" for attach; usage: contextq attach [--url <url>] [--restart] [--leave-denied] [--abort] [--key-stdin] [--ping|--no-ping]`),process.exitCode=1;return}}let n=await Promise.resolve().then(()=>(Kn(),Ln)),{gitRoot:o}=await Promise.resolve().then(()=>(de(),le)),r=null;try{r=o(process.cwd())}catch{r=null}try{if(t.abort){console.log(await n.abortAttach({cloudUrl:t.url,repoRoot:r}));return}console.log(`ContextQ attach -> ${t.url}`),await n.attachTransfer({cloudUrl:t.url,restart:t.restart,leaveDenied:t.leaveDenied,login:t.keyStdin?async()=>{let c=[];for await(let d of process.stdin)c.push(d);let a=Buffer.concat(c).toString("utf8").trim();if(!T.test(a))throw new Error("--key-stdin expects one sk_live_ key on stdin");return a}:()=>xt(c=>ve({apiUrl:t.url,signal:c,onPrompt:kt}))});let i=await n.attachSwitch({cloudUrl:t.url,repoRoot:r,pingConsent:t.ping});console.log(""),console.log(`Attached: ${Object.keys(i.acked).length} note(s) now live in your ContextQ account at ${t.url}.`),console.log("The local copy and its keys stay on this machine, read-only. Open a new Claude Code session to use the cloud memory, board and handoffs.")}catch(i){console.error(`contextq: ${i.message}`),process.exitCode=1}}s($i,"runAttachCommand");async function Ci(e){let t=await Promise.resolve().then(()=>(Le(),Cn)),n=e[0],o={};for(let r=1;r<e.length;r++)if(e[r]==="--port"){let i=e[++r]??"",c=/^\d+$/.test(i)?Number(i):NaN;if(!Number.isInteger(c)||c<1||c>65535){console.error(`contextq: invalid port "${i}"; use a number from 1 to 65535`),process.exitCode=1;return}o.port=c}else if(e[r]==="--state-dir")o.stateDir=e[++r];else{console.error(`contextq: unknown option "${e[r]}" for "local ${n??""}"`),process.exitCode=1;return}try{if(n==="start"){let r=await t.start(o);r.warning&&console.log(`[warn]   ${r.warning}`),console.log(`${r.started?"[start]":"[skip] "}  ContextQ local server ${r.started?"started":"already running"} at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion})`),console.log(`[info]   state: ${r.stateDir}`)}else if(n==="status"){let r=await t.status(o);r.running?console.log(`running at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion}${r.edgeVersion!==r.pinnedVersion?`, pinned ${r.pinnedVersion}`:""})`):(console.log(`not running: ${r.note??"not started"}`),process.exitCode=3),console.log(`state: ${r.stateDir}`)}else if(n==="stop"){let r=await t.stop(o);console.log(r.stopped?`[stop]   ${r.note}`:`[skip]   ${r.note}`)}else console.error("contextq: usage: contextq local start|status|stop [--port <n>] [--state-dir <dir>]"),process.exitCode=1}catch(r){console.error(`contextq: ${r.message}`),process.exitCode=1}}s(Ci,"runLocalCommand");async function _i(){let e=process.argv.slice(2);if(e[0]==="hook"){if(e[1]!=="boot"){console.error(`contextq: unknown "hook" subcommand "${e[1]??""}" -- expected "boot"`),process.exitCode=1;return}await Si(e.slice(2));return}if(e[0]==="attach"){await $i(e.slice(1));return}if(e[0]==="local"){await Ci(e.slice(1));return}if(e[0]==="skills"){if(e[1]==="-h"||e[1]==="--help"){he();return}if(e[1]!=="sync"){console.error(`contextq: unknown "skills" subcommand "${e[1]??""}" -- expected "sync"`),he(),process.exitCode=1;return}try{let n=wi(e.slice(2));await bi(n)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=1}return}let t;try{t=mi(e)}catch(n){console.error(`contextq: ${n.message}`),he(),process.exitCode=1;return}if(t.help||!t.command){he();return}if(t.command==="login"){try{await hi(t)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=n instanceof S&&n.code==="cancelled"?130:1}return}if(t.command!=="init"){console.error(`contextq: unknown command "${t.command}"`),he(),process.exitCode=1;return}try{if(t.local){if(t.key||t.url||t.embedKey||t.noPlugin||t.surface)throw new Error("--local takes only --workspace, --agent and --port: it needs no key, URL or surface");let{runLocalInit:n}=await Promise.resolve().then(()=>(de(),le));await n({cwd:process.cwd(),workspace:t.workspace,agent:t.agent,runtime:t.port?{port:t.port}:void 0});return}await yi(t)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=1}}s(_i,"main");_i();