@contextq/cli 0.3.0 → 0.5.0

package/README.md

@@ -41,7 +41,7 @@ Runs ContextQ memory on this machine with no account (local mode, contract: `doc
 
 ## `contextq init`
 
-Detects which agent surfaces the current directory and machine are set up for (Claude Code, Codex, Gemini CLI, Cursor, Copilot CLI — often several at once) and writes the wiring each one needs.
+Detects which agent surfaces the current directory and machine are set up for (Claude Code, Codex, Gemini CLI, Cursor, Copilot CLI, OpenCode — often several at once) and writes the wiring each one needs.
 
 | Option | Meaning |
 |---|---|
@@ -50,7 +50,7 @@ Detects which agent surfaces the current directory and machine are set up for (C
 | `--workspace <slug>` | Workspace the boot hook reads from. Defaults to the repo basename, sanitized. Lowercase letters, digits, `-` and `_`; must start with a letter or digit; 64 chars max. Case is folded to lowercase, since workspace slugs always are. |
 | `--agent <slug>` | Agent identity the session boots and checkpoints under. Same defaulting and same character rules as `--workspace`. |
 | `--embed-key` | Write the literal API key into `.mcp.json` instead of the `${CONTEXT_API_KEY}` placeholder. Opt-in on purpose: it trades a secret sitting on disk for not having to export the variable. |
-| `--surface <s>` | Force detection to exactly one of `claude-code`, `codex`, `gemini`, `cursor` or `copilot`, skipping autodetection. |
+| `--surface <s>` | Force detection to exactly one of `claude-code`, `codex`, `gemini`, `cursor`, `copilot` or `opencode`, skipping autodetection. |
 | `--no-plugin` | Wire Claude Code through `.mcp.json` even when Claude Code 2.1.281+ is installed. |
 | `-h`, `--help` | Show usage. |
 
@@ -74,14 +74,28 @@ It refuses, and changes nothing, when the file is not valid JSON, or when it sit
 
 Without the plugin, `init` writes a SessionStart hook to `.claude/settings.local.json` (Claude Code) and `.codex/hooks.json` (Codex, gitignored by `init`). The hook runs `npx -y --prefer-offline @contextq/cli hook boot --format <host>`, which reads the key from the credentials file `init` wrote (or `CONTEXT_API_KEY`), resolves the repo from the session's working directory, and asks `POST /api/agent/hooks/session-start` for the boot pack: the same endpoint and output the plugin hook uses. A refused key or an unreachable server prints one line saying so instead of nothing. `init` refuses, and changes nothing, when the hook file is not valid JSON or is tracked by git. Codex runs a project hook only after you trust it: start `codex` in the repo and approve it at the hook-trust prompt.
 
+### OpenCode: remote MCP in the user config
+
+OpenCode is detected when `~/.config/opencode/` exists (`$XDG_CONFIG_HOME/opencode/` when set). `init` adds a `contextq` remote server pointing at `<url>/mcp` to `~/.config/opencode/opencode.json`, with the key as a literal `Authorization` header and the file at mode 600. The shape follows the installed version: OpenCode 2 (`opencode --version` 2.x, or no `opencode` on PATH) gets `mcp.servers.contextq` with `oauth: false`, OpenCode 1.x gets `mcp.contextq` with `enabled: true`. A config that only exists as `opencode.jsonc` is left alone and reported, as is one that is git-tracked and not ignored. No boot hook is wired for OpenCode; memory reaches it through the MCP tools. Check with `opencode mcp list`.
+
 ### Gemini CLI, Cursor and Copilot CLI: user-level boot hooks
 
 Next to the MCP entry, `init` adds a session-start hook to the host's user-level config: `hooks.SessionStart` in `~/.gemini/settings.json`, `hooks.sessionStart` in `~/.cursor/hooks.json`, and its own `~/.copilot/hooks/contextq.json` (`$COPILOT_HOME/hooks/` when set). The hook runs `npx -y --prefer-offline @contextq/cli hook boot --format <host> --require-config`: it takes the repo from the session's working directory and stays silent in any repo without a `.contextq/config.json`, so one user-level hook serves every bound repo and nothing else. `init` writes that `.contextq/config.json` for the current repo when it is missing (commit it). The same refusals apply as for the MCP entry (invalid JSON, a git-tracked config). Cursor runs `sessionStart` without waiting for it, so the first turn may start before the pack arrives.
 
+For Copilot CLI, the same file also gets `sessionEnd` and `preCompact` hooks running `npx -y --prefer-offline @contextq/cli hook snapshot --format copilot --reason end|compact --require-config`. Each one posts a snapshot of the repo's git state (branch, HEAD, changed-path count, unpushed count, the last five commits and up to twenty changed paths) to `POST /api/agent/hooks/snapshot`, which stores it as a mechanical handoff the next session's boot pack shows. No transcript or message text is read or sent. `capture_scope` in `.contextq/config.json` gates it: `off` sends nothing, `metadata` (or any value other than `summary`/`auto`) drops the commit and path lists, and the default sends everything above. An existing `/contextq:handoff` SEED handoff is never overwritten by a snapshot.
+
 ### Codex: remote MCP in the project's `.codex/config.toml`
 
 `init --surface codex` (or a detected Codex) adds `[mcp_servers.contextq]` with `url = "<url>/mcp"` and an `[mcp_servers.contextq.http_headers]` table carrying `Authorization = "Bearer <key>"` to the repo's `.codex/config.toml`, appends `.codex/config.toml` to `.gitignore`, and sets the file to mode 600. Existing content is kept byte for byte and an existing `contextq` entry is left alone. It refuses, and changes nothing, when the file is not valid TOML, when `mcp_servers` is an inline table the new block cannot extend, or when the file is tracked by git. Codex reads a project config only in a trusted project: run `codex` once in the repo and accept the trust prompt, then `codex mcp list` shows `contextq`. If no surface ends up with an MCP connection, `init` says so and exits 1 instead of printing `Done`.
 
+## `contextq doctor`
+
+```bash
+contextq doctor [--json]
+```
+
+Proves a wired host actually receives memory, step by step: the configured API answers its health route, the key is found (only its length and prefix are ever printed) and accepted by the server, the repo's bound workspace from `.contextq/config.json` exists and reads, each wired host's MCP entry points at the same endpoint, each wired host's session-start boot hook is present, and one short note tagged `doctor` saves, recalls by search and deletes again (the delete is always attempted, even when recall fails). A detected but unwired host prints one `SKIP <host>` line instead of failures. Prints one `PASS`/`FAIL` line per step and exits 0 only when every step of every wired host passes; `--json` prints the same results as JSON. In a repo bound to local mode it checks the local server and its `ctq_local_` token instead of the cloud account.
+
 ## `contextq skills sync <dir>`
 
 Pulls this tenant's distilled procedures — the parametrized skills ContextQ mines from repeated, independently verified agent task patterns — into `<dir>` as standard Agent Skills folders, one `SKILL.md` per procedure.
@@ -94,6 +108,17 @@ Safe to re-run. An existing folder is matched by its own `metadata.cluster_key`
 
 It accepts `--workspace`, `--key` and `--url` with the same meanings as `init`.
 
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | Success. For `doctor`, every step of every wired host passed. |
+| 1 | Failure: bad arguments, a key the server refused or that could not be verified, an unreachable server, no MCP connection wired, a refused host config, or a failed `doctor` step. |
+| 3 | `local status` only: the local server is not running. |
+| 130 | Interrupted: Ctrl-C at a prompt, or the browser approval in `login` was cancelled. |
+
+The same table is printed at the end of `contextq --help`.
+
 ## Requirements
 
 Node 18 or newer, and a reachable ContextQ instance — the hosted one at `app.contextq.dev` or your own.

package/dist/index.js

@@ -1,48 +1,53 @@
 #!/usr/bin/env node
-var bt=Object.defineProperty;var s=(e,t)=>bt(e,"name",{value:t,configurable:!0});var M=(e,t)=>()=>(e&&(t=e(e=0)),t);var ye=(e,t)=>{for(var n in t)bt(e,n,{get:t[n],enumerable:!0})};import{chmodSync as We,copyFileSync as io,existsSync as be,mkdirSync as so,readFileSync as ao,writeFileSync as co}from"fs";import{homedir as lo}from"os";import{join as D}from"path";function ze(){let e=process.env.CTQ_CRED_DIR||process.env.CONTEXTQ_CRED_DIR;if(e)return e;let t=uo.map(po);return t.find(n=>be(D(n,"credentials")))??t[0]}function po(e){let t=lo();if(process.platform==="darwin")return D(t,"Library","Application Support",e);if(process.platform==="win32"){let o=process.env.APPDATA??D(t,"AppData","Roaming");return D(o,e)}let n=process.env.XDG_CONFIG_HOME??D(t,".config");return D(n,e)}function _(){return D(ze(),"credentials")}function Ze(){return be(_())}function go(e,t){return e.apiKey===t.apiKey&&e.apiUrl===t.apiUrl}function fo(){let e=new Date,t=s(n=>String(n).padStart(2,"0"),"pad");return`${e.getUTCFullYear()}${t(e.getUTCMonth()+1)}${t(e.getUTCDate())}T${t(e.getUTCHours())}${t(e.getUTCMinutes())}${t(e.getUTCSeconds())}Z`}function mo(){let e=_();if(!be(e))return null;let t=ze(),n=D(t,`credentials.bak-${fo()}`);return io(e,n),We(n,384),n}function xe(e,t){if(!be(t))return"";try{let n=ao(t,"utf-8");for(let o of n.split(`
-`))if(o.startsWith(`${e}=`))return o.slice(e.length+1).trim()}catch{}return""}function R(){let e=_(),t=xe("CTQ_API_KEY",e)||xe("CONTEXT_API_KEY",e),n=xe("CTQ_API_URL",e)||xe("CONTEXT_API_URL",e);return{apiKey:t,apiUrl:n}}function Tt(e){let t=ze(),n=_();so(t,{recursive:!0,mode:448}),We(t,448);let o=`CTQ_API_KEY=${e.apiKey}
+var nn=Object.defineProperty;var a=(e,t)=>nn(e,"name",{value:t,configurable:!0});var C=(e,t)=>()=>(e&&(t=e(e=0)),t);var de=(e,t)=>{for(var n in t)nn(e,n,{get:t[n],enumerable:!0})};function on(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function Io(e){if(!e)return"unknown";let t=on(e);if(!t)return"unknown";let n=[...Oo].sort((o,r)=>r[0].length-o[0].length);for(let[o,r]of n)if(t===o||t.startsWith(`${o}-`))return r;return"unknown"}function No(e){if(!e)return;let t=on(e);return Ro.find(n=>n===t)}function rn(e={}){let t=e.env??(typeof process<"u"?process.env:{}),n=t.CLAUDE_CODE_SESSION_ID||void 0,o=a((s,i)=>({host:s,supportsFunctionHooks:s==="claude-code"&&t[Ao]==="1",...s==="claude-code"&&n?{sessionId:n}:{},via:i}),"finish");if(e.forcedHost)return o(e.forcedHost,"forced");let r=No(t[To]);return r?o(r,"env-override"):e.clientName!==void 0?o(Io(e.clientName),"client-info"):t.CLAUDECODE==="1"?o("claude-code","env"):o("unknown","none")}var To,Ao,Ro,Oo,sn=C(()=>{"use strict";To="CONTEXTQ_HOST",Ao="CLAUDE_CODE_ENABLE_FUNCTION_HOOKS",Ro=["claude-code","claude-desktop","codex","opencode","cyberine","muse","unknown"],Oo=[["claude-code","claude-code"],["claude-desktop","claude-desktop"],["claude-ai","claude-desktop"],["claude","claude-desktop"],["codex","codex"],["opencode","opencode"],["cyberine","cyberine"],["muse","muse"],["muse-code","muse"]];a(on,"normalizeName");a(Io,"hostFromClientName");a(No,"parseHostOverride");a(rn,"resolveHost")});import{chmodSync as Do,existsSync as qo,mkdirSync as Ho,readFileSync as Uo,writeFileSync as jo}from"fs";import{execFileSync as an}from"child_process";import{basename as Ko,dirname as cn,join as Ie}from"path";function ue(e,t,n){return X[e].configDir(t,n)}function ft(e,t,n){return Ie(ue(e,t,n),X[e].configFile)}function $(e){return`${e.replace(/\/+$/,"")}/mcp`}function pe(e){let t=cn(e);try{if(an("git",["-C",t,"rev-parse","--is-inside-work-tree"],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()!=="true")return!1}catch{return!1}try{return an("git",["-C",t,"check-ignore","-q","--",Ko(e)],{stdio:"ignore"}),!1}catch(n){return n.status===1}}function ln(e,t){let n=X[e],o=ft(e,t.homeDir,t.env),r=qo(o),s={};if(r){let c=Uo(o,"utf-8");try{let l=c.trim()===""?{}:JSON.parse(c);if(!l||typeof l!="object"||Array.isArray(l))throw new Error("top level is not an object");s=l}catch(l){return{surface:e,path:o,action:"refused",detail:`not valid JSON (${l.message}); left untouched`}}}let i=s.mcpServers??{};return typeof i!="object"||Array.isArray(i)?{surface:e,path:o,action:"refused",detail:"mcpServers is not an object; left untouched"}:i.contextq?{surface:e,path:o,action:"skipped",detail:"contextq server entry already present"}:pe(o)?{surface:e,path:o,action:"refused",detail:`sits in a git work tree and is not gitignored; writing the API key there would put it in a commit. Add it to that repo's .gitignore and re-run, or add the server by hand: ${n.label} -> ${$(t.apiUrl)}`}:(s.mcpServers={...i,contextq:n.entry($(t.apiUrl),t.apiKey)},Ho(cn(o),{recursive:!0}),jo(o,`${JSON.stringify(s,null,2)}
+`,{mode:384}),Do(o,384),{surface:e,path:o,action:r?"added":"created",detail:`contextq remote MCP (${$(t.apiUrl)}) with the API key in the header, file mode 600; check with \`${n.listCommand}\``})}var ee,X,Y=C(()=>{"use strict";ee=["gemini","cursor","copilot"],X={gemini:{label:"Gemini CLI",configDir:a(e=>Ie(e,".gemini"),"configDir"),configFile:"settings.json",entry:a((e,t)=>({httpUrl:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"gemini mcp list"},cursor:{label:"Cursor",configDir:a(e=>Ie(e,".cursor"),"configDir"),configFile:"mcp.json",entry:a((e,t)=>({url:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"cursor-agent mcp list"},copilot:{label:"Copilot CLI",configDir:a((e,t)=>t.COPILOT_HOME||Ie(e,".copilot"),"configDir"),configFile:"mcp-config.json",entry:a((e,t)=>({type:"http",url:e,headers:{Authorization:`Bearer ${t}`},tools:["*"]}),"entry"),listCommand:"copilot mcp list"}};a(ue,"hostConfigDir");a(ft,"hostMcpConfigPath");a($,"mcpEndpoint");a(pe,"gitTracksUnignored");a(ln,"wireHostMcp")});import{chmodSync as Lo,existsSync as gt,mkdirSync as Mo,readFileSync as Fo,writeFileSync as Jo}from"fs";import{execFileSync as Bo}from"child_process";import{dirname as Qo,join as ht}from"path";function mt(e,t){return ht(t.XDG_CONFIG_HOME||ht(e,".config"),"opencode")}function wt(e,t){return ht(mt(e,t),"opencode.json")}function dn(e="opencode"){try{let t=Bo(e,["--version"],{stdio:["ignore","pipe","ignore"],encoding:"utf-8",timeout:15e3}),n=/v?(\d+)\.\d+/.exec(t);return n?Number(n[1]):null}catch{return null}}function K(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:null}function yt(e){let t=K(e.mcp);return t?K(K(t.servers)?.contextq)??K(t.contextq):null}function un(e){let t=wt(e.homeDir,e.env),n=e.major!=null&&e.major<2?"v1":"v2",o=$(e.apiUrl),r=`add the server by hand: OpenCode -> ${o}`;if(!gt(t)&&gt(`${t}c`))return{path:`${t}c`,action:"refused",shape:n,detail:`only opencode.jsonc exists, which this installer does not rewrite; ${r}`};let s=gt(t),i={};if(s){let d=Fo(t,"utf-8");try{let u=d.trim()===""?{}:JSON.parse(d),f=K(u);if(!f)throw new Error("top level is not an object");i=f}catch(u){return{path:t,action:"refused",shape:n,detail:`not valid JSON (${u.message}); left untouched`}}}if(i.mcp!==void 0&&!K(i.mcp))return{path:t,action:"refused",shape:n,detail:"mcp is not an object; left untouched"};if(yt(i))return{path:t,action:"skipped",shape:n,detail:"contextq server entry already present"};if(pe(t))return{path:t,action:"refused",shape:n,detail:`sits in a git work tree and is not gitignored; writing the API key there would put it in a commit. Add it to that repo's .gitignore and re-run, or ${r}`};let c={Authorization:`Bearer ${e.apiKey}`},l=K(i.mcp)??{};if(n==="v2"){let d=K(l.servers)??{};i.mcp={...l,servers:{...d,contextq:{type:"remote",url:o,oauth:!1,headers:c}}}}else i.mcp={...l,contextq:{type:"remote",url:o,enabled:!0,headers:c}};return s||(i={$schema:"https://opencode.ai/config.json",...i}),Mo(Qo(t),{recursive:!0}),Jo(t,`${JSON.stringify(i,null,2)}
+`,{mode:384}),Lo(t,384),{path:t,action:s?"added":"created",shape:n,detail:`contextq remote MCP (${o}) in the OpenCode ${n} shape with the API key in the header, file mode 600; check with \`opencode mcp list\``}}var Ne=C(()=>{"use strict";Y();a(mt,"opencodeConfigDir");a(wt,"opencodeConfigPath");a(dn,"detectOpencodeMajor");a(K,"asObject");a(yt,"opencodeContextqEntry");a(un,"wireOpencodeMcp")});import{existsSync as fe}from"fs";import{execSync as Vo}from"child_process";import{homedir as pn}from"os";import{join as kt}from"path";function Xo(e){try{return Vo("git rev-parse --show-toplevel",{cwd:e,stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}function Yo(e){return fe(kt(e,".codex"))}function Go(e){return fe(kt(e,".codex"))}function ge(e,t={}){let n=Xo(e),o=n||e,{host:r}=rn(t.hostSignals);if(t.forcedSurface)return{surfaces:[t.forcedSurface],root:o,host:r};let c=fe(kt(e,".claude"))||!!n&&!(r!=="unknown"&&r!=="claude-code"),l=Yo(o)||Go(t.homeDir??pn()),d=[];c&&d.push("claude-code"),l&&d.push("codex");let u=t.homeDir??pn(),f=t.env??process.env;for(let p of ee)fe(ue(p,u,f))&&d.push(p);return fe(mt(u,f))&&d.push("opencode"),d.length===0&&d.push("desktop"),{surfaces:d,root:c||l?o:e,host:r}}var xt=C(()=>{"use strict";sn();Y();Ne();a(Xo,"gitRoot");a(Yo,"hasCodexProjectDir");a(Go,"hasCodexHome");a(ge,"detectSurface")});import{chmodSync as bt,copyFileSync as zo,existsSync as qe,mkdirSync as Wo,readFileSync as Zo,writeFileSync as er}from"fs";import{homedir as tr}from"os";import{join as L}from"path";function $t(){let e=process.env.CTQ_CRED_DIR||process.env.CONTEXTQ_CRED_DIR;if(e)return e;let t=nr.map(or);return t.find(n=>qe(L(n,"credentials")))??t[0]}function or(e){let t=tr();if(process.platform==="darwin")return L(t,"Library","Application Support",e);if(process.platform==="win32"){let o=process.env.APPDATA??L(t,"AppData","Roaming");return L(o,e)}let n=process.env.XDG_CONFIG_HOME??L(t,".config");return L(n,e)}function A(){return L($t(),"credentials")}function St(){return qe(A())}function rr(e,t){return e.apiKey===t.apiKey&&e.apiUrl===t.apiUrl}function sr(){let e=new Date,t=a(n=>String(n).padStart(2,"0"),"pad");return`${e.getUTCFullYear()}${t(e.getUTCMonth()+1)}${t(e.getUTCDate())}T${t(e.getUTCHours())}${t(e.getUTCMinutes())}${t(e.getUTCSeconds())}Z`}function ir(){let e=A();if(!qe(e))return null;let t=$t(),n=L(t,`credentials.bak-${sr()}`);return zo(e,n),bt(n,384),n}function De(e,t){if(!qe(t))return"";try{let n=Zo(t,"utf-8");for(let o of n.split(`
+`))if(o.startsWith(`${e}=`))return o.slice(e.length+1).trim()}catch{}return""}function N(){let e=A(),t=De("CTQ_API_KEY",e)||De("CONTEXT_API_KEY",e),n=De("CTQ_API_URL",e)||De("CONTEXT_API_URL",e);return{apiKey:t,apiUrl:n}}function fn(e){let t=$t(),n=A();Wo(t,{recursive:!0,mode:448}),bt(t,448);let o=`CTQ_API_KEY=${e.apiKey}
 CTQ_API_URL=${e.apiUrl}
 CONTEXT_API_KEY=${e.apiKey}
 CONTEXT_API_URL=${e.apiUrl}
-`;return co(n,o,{mode:384}),We(n,384),n}function U(e){let t=R(),n=Ze(),o=s(r=>{if(!n)return Tt(r),{action:"created",backupPath:null};if(go(t,r))return{action:"skipped",backupPath:null};let i=mo();return Tt(r),{action:"rotated",backupPath:i}},"writeSafely");if(e.explicitKey){if(!T.test(e.explicitKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.explicitKey,i=o({apiKey:r,apiUrl:e.apiUrl}),c=i.action==="skipped"?`${Ge} credentials (unchanged)`:i.action==="rotated"?`${Rt} credentials (${_()}; previous saved to ${i.backupPath})`:`${At} credentials (${_()}, mode 600)`;return{apiKey:r,credLine:c,action:i.action,backupPath:i.backupPath}}if(n&&t.apiKey){let r=e.ambientVarName?`${Ge} credentials (already configured at ${_()}; env ${e.ambientVarName} ignored, pass --key to rotate)`:`${Ge} credentials (already configured at ${_()}; pass --key to rotate)`;return{apiKey:t.apiKey,credLine:r,action:"skipped",backupPath:null}}if(e.ambientKey){if(!T.test(e.ambientKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.ambientKey,i=o({apiKey:r,apiUrl:e.apiUrl}),c=i.action==="rotated"?`${Rt} credentials (${_()}; previous saved to ${i.backupPath})`:`${At} credentials (${_()}, mode 600)`;return{apiKey:r,credLine:c,action:i.action,backupPath:i.backupPath}}return{apiKey:"",credLine:"",action:null,backupPath:null}}var uo,T,At,Rt,Ge,B=M(()=>{"use strict";s(ze,"platformCredDir");uo=["contextq","ctq-brain"];s(po,"platformCredDirFor");s(_,"platformCredFile");s(Ze,"credsFileExists");s(go,"credsEqual");s(fo,"utcTimestamp");s(mo,"backupCredsFile");s(xe,"readEnvVal");s(R,"readExistingCreds");s(Tt,"writeCreds");T=/^sk_live_[0-9a-f]{40}$/,At="[create]",Rt="[rotate]",Ge="[skip] ";s(U,"decideCredentialWrite")});import{spawnSync as nt}from"child_process";import{existsSync as nr,readFileSync as or}from"fs";import{join as rr}from"path";function tn(e){return e[ot]||"claude"}function ir(e){let t=/(\d+)\.(\d+)\.(\d+)/.exec(e);return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}function sr(e,t){for(let n=0;n<3;n++)if(e[n]!==t[n])return e[n]>t[n];return!0}function nn(e){let t=rr(e,".mcp.json");if(!nr(t))return!1;try{return!!JSON.parse(or(t,"utf-8")).mcpServers?.contextq}catch{return!1}}function rt(e=process.env){let t=nt(tn(e),["--version"],{encoding:"utf-8",env:e});if(t.error||t.status!==0)return{reason:"the `claude` binary was not found on PATH"};let n=ir(t.stdout);return n?sr(n,en)?{version:n.join(".")}:{reason:`Claude Code ${n.join(".")} is older than ${en.join(".")}, the ContextQ plugin's floor (its function-hook module needs prompt.edit and ui.render AbovePrompt)`}:{reason:`could not read a version from \`claude --version\` (${t.stdout.trim()})`}}function ar(e){let t=e.split(`
-`).map(n=>n.trim()).filter(n=>n.startsWith("{"));for(let n=t.length-1;n>=0;n--)try{return JSON.parse(t[n])}catch{continue}return null}function cr(e){return`${e.replace(/\/$/,"")}/plugin/marketplace.json`}function Ee(e,t,n,o,r=process.env,i={}){let c=rt(r);if("reason"in c)return{status:"unavailable",reason:c.reason};let a=tn(r),d=nt(a,["plugin","marketplace","add",cr(i.marketplaceBase??t),"--scope","project"],{cwd:e,encoding:"utf-8",env:r});if(d.error||d.status!==0)return{status:"failed",reason:`\`claude plugin marketplace add\` exited ${d.status??"with an error"}`};let l=["plugin","install",O,"--scope","project","--json","--config",`apiKey=${n}`];t.replace(/\/$/,"")!==o.replace(/\/$/,"")&&l.push("--config",`apiUrl=${t}`);let u=nt(a,l,{cwd:e,encoding:"utf-8",env:r}),p=ar(u.stdout??"");if(!p)return{status:"failed",reason:`\`claude plugin install --json\` printed no result line (exit ${u.status??"error"})`};if(p.outcome!=="ok"||u.status!==0){let h=typeof p.failureCode=="string"?` [${p.failureCode}]`:"";return{status:"failed",reason:`${String(p.message??"install failed")}${h}`}}let g=String(p.message??"installed");return{status:"installed",message:g,alreadyInstalled:/already installed/i.test(g)}}function on(e){return e.noPlugin?{delegate:!1,reason:"--no-plugin: wiring Claude Code through .mcp.json"}:e.legacyMcpEntry?{delegate:!1,reason:".mcp.json already wires contextq -- keeping that path, not installing the plugin on top of it (both would register the same MCP server)"}:e.verifyStatus===401||e.verifyStatus===403?{delegate:!1,reason:`the server rejected this key (HTTP ${e.verifyStatus}) -- not handing it to the plugin, whose apiKey is stored machine-wide and would replace a working one; wiring .mcp.json instead`}:{delegate:!0}}var O,en,ot,Pe=M(()=>{"use strict";O="contextq@contextq-plugins",en=[2,1,281],ot="CONTEXTQ_CLAUDE_BIN";s(tn,"claudeBin");s(ir,"parseClaudeVersion");s(sr,"versionAtLeast");s(nn,"hasLegacyMcpEntry");s(rt,"detectClaude");s(ar,"lastJsonLine");s(cr,"marketplaceUrl");s(Ee,"installPlugin");s(on,"decidePluginDelegation")});function G(e,t){if(!lr.test(e))throw new Error(`${t} value "${e}" is not a valid slug -- allowed: ${Te}`);return e}function K(e){let t=e.toLowerCase().replace(/[^a-z0-9_-]+/g,"-").replace(/^[-_]+|[-_]+$/g,"");return t=t.slice(0,64),t=t.replace(/[-_]+$/g,""),t===""?"default":t}var lr,Te,Ae=M(()=>{"use strict";lr=/^[a-z0-9][a-z0-9_-]{0,63}$/,Te='lowercase letters, digits, "-", "_" (must start with a letter/digit, max 64 chars)';s(G,"validateSlug");s(K,"sanitizeSlugFallback")});var Cn={};ye(Cn,{DEFAULT_LOCAL_PORT:()=>xn,EDGE_PACKAGE:()=>pt,EDGE_SOURCE_ENV:()=>bn,EDGE_VERSION_PIN:()=>kn,LocalRuntimeError:()=>I,MIN_NODE_MAJOR:()=>re,STATE_DIR_ENV:()=>dt,checkNode:()=>Ue,defaultLocalStateDir:()=>H,preflight:()=>$n,provision:()=>Sn,start:()=>ce,status:()=>Ne,stop:()=>Hr});import{spawn as Pr,spawnSync as lt}from"child_process";import{chmodSync as Tr,closeSync as Ar,existsSync as W,mkdirSync as Rr,openSync as Or,readFileSync as De,rmSync as Ie,writeFileSync as wn}from"fs";import{homedir as Ir,platform as Nr}from"os";import{join as E}from"path";function H(e=process.env){if(e[dt])return e[dt];let t=Ir();if(Nr()==="darwin")return E(t,"Library","Application Support","contextq","local");let n=e.XDG_DATA_HOME&&e.XDG_DATA_HOME.trim()!==""?e.XDG_DATA_HOME:E(t,".local","share");return E(n,"contextq","local")}function ae(e){let t=e.version??kn,n=e.stateDir??H();return{stateDir:n,runtimeDir:e.runtimeDir??E(n,"runtime"),port:e.port??xn,version:t,source:e.packageSource??process.env[bn]??`${pt}@${t}`,nodeVersion:e.nodeVersion??process.versions.node,nodeBin:e.nodeBin??process.execPath,npmBin:e.npmBin??"npm",fetchImpl:e.fetchImpl??fetch,startTimeoutMs:e.startTimeoutMs??15e3}}function vn(e){return E(e.runtimeDir,`edge-${e.version}`)}function ie(e){return E(vn(e),"node_modules","@contextq","edge")}function Ue(e){let t=Number(e.split(".")[0]);if(!Number.isFinite(t)||t<re)throw new I(`ContextQ local mode needs Node ${re} or newer, and this is Node ${e}; install Node ${re}+ and run \`contextq local start\` again.`)}function ut(e){Rr(e,{recursive:!0,mode:448}),Tr(e,448)}function yn(e){let t=E(ie(e),"package.json");if(!W(t))return null;try{return JSON.parse(De(t,"utf8")).version}catch{return null}}function Sn(e={}){let t=ae(e);Ue(t.nodeVersion);let n=vn(t);if(yn(t)===t.version&&W(E(ie(t),"dist","cli.js")))return{dir:ie(t),installed:!1};ut(t.stateDir),ut(n),W(E(n,"package.json"))||wn(E(n,"package.json"),`${JSON.stringify({name:"contextq-local-runtime",private:!0},null,2)}
-`);let o=lt(t.npmBin,["install","--no-audit","--no-fund","--omit=dev","--install-links","--prefix",n,t.source],{encoding:"utf8",timeout:3e5});if(o.error||o.status!==0){let i=`${o.stderr??""}`.trim().split(`
-`).slice(-3).join(" | ");throw new I(`could not install ${t.source} into ${n}${/E404|No matching version|ETARGET/.test(i)?" (that version is not published yet)":""}: ${i||o.error?.message||`npm exited ${o.status}`}`)}let r=yn(t);if(r!==t.version)throw new I(`installed ${pt} is ${r??"missing"}, but this CLI is pinned to ${t.version}; remove ${n} and run \`contextq local start\` again.`);return{dir:ie(t),installed:!0}}function $n(e={}){let t=ae(e);Ue(t.nodeVersion);let n=ie(t),o=lt(t.nodeBin,["--input-type=module","-e","import Database from 'better-sqlite3'; new Database(':memory:').prepare('select 1').get();"],{cwd:n,encoding:"utf8",timeout:3e4});if(o.status!==0){let i=`${o.stderr??""}`.trim().split(`
-`).find(c=>/Error|error/.test(c))??`exit ${o.status}`;throw new I(`better-sqlite3 does not load on this machine (${i.slice(0,200)}); local mode supports macOS arm64 and Linux x64 with Node ${re}+ and npm prebuilt binaries.`)}return lt(t.nodeBin,["--input-type=module","-e","import { createRequire } from 'node:module'; import Database from 'better-sqlite3'; createRequire(import.meta.url + '/../')('sqlite-vec').load(new Database(':memory:'));"],{cwd:n,encoding:"utf8",timeout:3e4}).status!==0?{vectorSearch:!1,warning:"sqlite-vec does not load here; local search runs keyword-only (FTS5)."}:{vectorSearch:!0}}function se(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}function Dr(e){let t=N(e).pid;if(!W(t))return null;let n=Number(De(t,"utf8").trim());return Number.isInteger(n)&&n>0?n:null}function Ur(e){let t=N(e).endpoint;if(!W(t))return null;try{return JSON.parse(De(t,"utf8"))}catch{return null}}async function Lr(e,t){try{let n=await e(`${t}/health`,{signal:AbortSignal.timeout(2e3)});return n.ok?await n.json():null}catch{return null}}async function Ne(e={}){let t=ae(e),n={running:!1,owned:!1,url:null,pid:null,edgeVersion:null,pinnedVersion:t.version,stateDir:t.stateDir},o=Dr(t.stateDir),r=Ur(t.stateDir);if(o===null)return{...n,note:"not started"};if(!se(o))return Ie(N(t.stateDir).pid,{force:!0}),{...n,note:`not running (removed a stale pidfile for pid ${o})`};if(!r||r.pid!==o)return{...n,pid:o,note:`pid ${o} is alive but has not published its endpoint`};let i=await Lr(t.fetchImpl,r.url);return!i||i.mode!=="local"||i.service!=="contextq-edge"?{...n,pid:o,url:r.url,note:`pid ${o} does not answer as a ContextQ local server at ${r.url}`}:{...n,running:!0,owned:!0,url:r.url,pid:o,edgeVersion:String(i.edgeVersion??"")||null}}async function Kr(e){let t=`http://127.0.0.1:${e.port}`;try{let n=await e.fetchImpl(`${t}/health`,{signal:AbortSignal.timeout(1500)});return(await n.json().catch(()=>null))?.service==="contextq-edge"?`another ContextQ local server (not started from ${e.stateDir})`:`a process that is not ContextQ (HTTP ${n.status})`}catch(n){return n.cause?.code==="ECONNREFUSED"?null:"a process that does not answer HTTP"}}async function ce(e={}){let t=ae(e);Ue(t.nodeVersion);let n=await Ne(e);if(n.running){if(n.edgeVersion&&n.edgeVersion!==t.version)throw new I(`the running local server is edge ${n.edgeVersion}, but this CLI is pinned to ${t.version}; run \`contextq local stop\` and start it again.`);return{...n,started:!1}}let o=await Kr(t);if(o)throw new I(`port ${t.port} on 127.0.0.1 is held by ${o}; it was left alone. Stop it or pass --port <n>.`);let{dir:r}=Sn(e),i=$n(e);ut(t.stateDir),Ie(N(t.stateDir).endpoint,{force:!0});let c=Or(N(t.stateDir).log,"a",384),a=Pr(t.nodeBin,[E(r,"dist","cli.js"),"serve","--state-dir",t.stateDir,"--port",String(t.port)],{detached:!0,stdio:["ignore",c,c]});if(Ar(c),a.pid===void 0)throw new I("could not start the local server process");wn(N(t.stateDir).pid,`${a.pid}
-`,{mode:384}),a.unref();let d=Date.now()+t.startTimeoutMs;for(;Date.now()<d;){let u=await Ne(e);if(u.running)return{...u,started:!0,...i.warning?{warning:i.warning}:{}};if(!se(a.pid))break;await new Promise(p=>setTimeout(p,200))}let l=W(N(t.stateDir).log)?De(N(t.stateDir).log,"utf8").trim().split(`
-`).slice(-3).join(" | "):"";throw se(a.pid)&&process.kill(a.pid,"SIGTERM"),Ie(N(t.stateDir).pid,{force:!0}),new I(`the local server did not come up within ${Math.round(t.startTimeoutMs/1e3)} s${l?`: ${l}`:""}`)}async function Hr(e={}){let t=ae(e),n=await Ne(e);if(!n.running||!n.owned||n.pid===null)return{stopped:!1,note:n.note??"not running"};process.kill(n.pid,"SIGTERM");let o=Date.now()+1e4;for(;Date.now()<o&&se(n.pid);)await new Promise(r=>setTimeout(r,100));return se(n.pid)?{stopped:!1,note:`pid ${n.pid} did not exit after SIGTERM; it was left running`}:(Ie(N(t.stateDir).pid,{force:!0}),{stopped:!0,note:`stopped pid ${n.pid}`})}var pt,kn,xn,re,dt,bn,I,N,Le=M(()=>{"use strict";pt="@contextq/edge",kn="0.2.0",xn=47321,re=22,dt="CONTEXTQ_LOCAL_STATE_DIR",bn="CONTEXTQ_EDGE_PACKAGE",I=class extends Error{static{s(this,"LocalRuntimeError")}constructor(t){super(t),this.name="LocalRuntimeError"}};s(H,"defaultLocalStateDir");s(ae,"resolve");N=s(e=>({pid:E(e,"edge.pid"),endpoint:E(e,"endpoint.json"),log:E(e,"edge.log")}),"paths");s(vn,"runtimeRoot");s(ie,"edgePackageDir");s(Ue,"checkNode");s(ut,"ensureDir");s(yn,"installedVersion");s(Sn,"provision");s($n,"preflight");s(se,"pidAlive");s(Dr,"readPid");s(Ur,"readEndpoint");s(Lr,"health");s(Ne,"status");s(Kr,"portHolder");s(ce,"start");s(Hr,"stop")});var ft={};ye(ft,{readJournal:()=>En,readPluginState:()=>j,reconfigurePlugin:()=>gt,restorePlugin:()=>Yr,supportsTerminalConfigure:()=>_n,syncPlatformCredentials:()=>Gr,writeJournal:()=>Q});import{spawnSync as jr}from"child_process";import{chmodSync as qr,existsSync as Mr,mkdirSync as Fr,readFileSync as Jr,renameSync as Br,writeFileSync as Vr}from"fs";import{dirname as Qr}from"path";function Xr(e){return e[ot]||"claude"}function X(e){return e.replace(/\/+$/,"")}function Ke(e,t,n){return jr(Xr(e),t,{encoding:"utf-8",env:e,input:n,timeout:6e4})}function _n(e=process.env){let t=Ke(e,["plugin","configure","--help"]);return!t.error&&t.status===0&&/--values-stdin/.test(t.stdout??"")}function j(e=process.env,t=O){let n=Ke(e,["plugin","list","--json"]),o;try{o=JSON.parse(n.stdout??"[]").find(d=>d.id===t)}catch{o=void 0}if(!o)return{installed:!1,scope:null,enabled:null,apiUrl:null,apiKeySet:!1};let r=Ke(e,["plugin","configure",t,"--json"]),i=null,c=!1;try{let a=JSON.parse(r.stdout??"{}");i=a.inputs?.apiUrl?X(a.inputs.apiUrl):null,c=Array.isArray(a.configured)&&a.configured.includes("apiKey")}catch{i=null}return{installed:!0,scope:o.scope??null,enabled:o.enabled??null,apiUrl:i,apiKeySet:c}}function Q(e,t){Fr(Qr(e),{recursive:!0,mode:448});let n=`${e}.tmp`;Vr(n,`${JSON.stringify(t,null,2)}
-`,{mode:384}),qr(n,384),Br(n,e)}function En(e){if(!Mr(e))return null;try{return JSON.parse(Jr(e,"utf-8"))}catch{return null}}function Pn(e,t,n){let o=Ke(e,["plugin","configure",t,"--values-stdin"],JSON.stringify({apiUrl:X(n.apiUrl),apiKey:n.apiKey}));return o.error?`could not run \`claude plugin configure\` (${o.error.message})`:o.status!==0?`\`claude plugin configure\` exited ${o.status}`:null}function gt(e){let t=e.env??process.env,n=e.pluginId??O,o=X(e.target.apiUrl);if(!_n(t))return{status:"failed",reason:"this Claude Code has no `claude plugin configure --values-stdin`; update it (`claude update`) or run `/plugin configure contextq` inside a session",state:null};let r=j(t,n);if(!r.installed)return{status:"failed",reason:`${n} is not installed in this Claude Code profile`,state:r};let i=s(()=>new Date().toISOString(),"now"),c={version:1,pluginId:n,startedAt:i(),updatedAt:i(),step:"backed_up",before:{apiUrl:r.apiUrl,scope:r.scope,enabled:r.enabled},target:{apiUrl:o},previousKeySource:e.previousKeySource??null};Q(e.journalPath,c);let a=Pn(t,n,e.target);if(a)return Q(e.journalPath,{...c,step:"failed",updatedAt:i(),error:a}),{status:"failed",reason:a,state:j(t,n)};Q(e.journalPath,{...c,step:"configured",updatedAt:i()});let d=j(t,n),l=[];if(d.apiUrl!==o&&l.push(`apiUrl is ${d.apiUrl??"unset"}, expected ${o}`),d.apiKeySet||l.push("apiKey is not set"),d.scope!==r.scope&&l.push(`scope changed from ${r.scope} to ${d.scope}`),d.enabled!==r.enabled&&l.push(`enabled changed from ${r.enabled} to ${d.enabled}`),l.length>0){let u=`the effective plugin config does not match the switch: ${l.join("; ")}`;return Q(e.journalPath,{...c,step:"failed",updatedAt:i(),error:u}),{status:"failed",reason:u,state:d}}return Q(e.journalPath,{...c,step:"verified",updatedAt:i()}),{status:r.apiUrl===o?"updated":"switched",state:d}}function Yr(e,t,n=process.env){let o=En(e);if(!o)return{status:"failed",reason:`no plugin switch journal at ${e}`,state:null};if(o.before.apiUrl&&X(t.apiUrl)!==o.before.apiUrl)return{status:"failed",reason:`the restore endpoint ${X(t.apiUrl)} is not the one recorded before the switch (${o.before.apiUrl})`,state:null};let r=Pn(n,o.pluginId,t);if(r)return{status:"failed",reason:r,state:j(n,o.pluginId)};let i=j(n,o.pluginId);return i.apiUrl!==X(t.apiUrl)||!i.apiKeySet?{status:"failed",reason:`restore did not take effect (apiUrl is ${i.apiUrl??"unset"})`,state:i}:(Q(e,{...o,step:"restored",updatedAt:new Date().toISOString()}),{status:"switched",state:i})}function Gr(e){if(!T.test(e.apiKey))return{written:!1,line:"[skip]  platform credentials (a local token stays in the local state dir)"};let t=U({explicitKey:e.apiKey,ambientVarName:null,ambientKey:"",apiUrl:X(e.apiUrl)});return{written:t.action!=="skipped",line:t.credLine}}var He=M(()=>{"use strict";Pe();B();s(Xr,"bin");s(X,"normalizeUrl");s(Ke,"run");s(_n,"supportsTerminalConfigure");s(j,"readPluginState");s(Q,"writeJournal");s(En,"readJournal");s(Pn,"applyConfig");s(gt,"reconfigurePlugin");s(Yr,"restorePlugin");s(Gr,"syncPlatformCredentials")});var le={};ye(le,{CLOUD_MARKETPLACE_BASE:()=>ht,appendBinding:()=>On,gitRoot:()=>An,readBinding:()=>Rn,runLocalInit:()=>ri,writeLocalBinding:()=>In});import{spawnSync as Wr}from"child_process";import{existsSync as zr,mkdirSync as Zr,readFileSync as Tn,renameSync as ei,writeFileSync as ti}from"fs";import{homedir as ni}from"os";import{basename as oi,join as z,resolve as mt}from"path";function An(e){let t=Wr("git",["-C",e,"rev-parse","--show-toplevel"],{encoding:"utf8"});if(t.status!==0)throw new Error(`${e} is not inside a git repository; run \`contextq init --local\` from the project repo`);let n=t.stdout.trim(),o=mt(ni());if(mt(n)===o||mt(n)===z(o,".claude"))throw new Error(`${n} is your home directory or ~/.claude, not a project repo; nothing was bound`);return n}function Rn(e){let t=z(e,".contextq","config.json");if(!zr(t))return null;try{return JSON.parse(Tn(t,"utf8"))}catch{throw new Error(`${t} is not valid JSON; fix or delete it first`)}}function On(e,t,n="contextq-cli"){let o=z(e,".contextq"),r=z(o,"config.json"),i=Rn(e),c=i??{},a=c._entries??[],d=c.write_seq??a.length,l=!1;for(let[p,g]of t){if(c[p]===g)continue;let h=d;d+=1,a.push({key:p,value:g,written_by:n,based_on:h,seq:d,ts:new Date().toISOString().replace(/\.\d{3}Z$/,"Z")}),c[p]=g,l=!0}if(!l)return"skipped";c.config_schema_version=Math.max(5,c.config_schema_version??5),c.write_seq=d,c._entries=a,Zr(o,{recursive:!0});let u=`${r}.tmp`;return ti(u,`${JSON.stringify(c,null,2)}
-`),ei(u,r),i?"updated":"created"}function In(e,t){return On(e,[["mode","local"],["workspace",t.workspace],["agent",t.agent]])}async function ri(e){let t=e.log??(x=>console.log(x)),n=e.env??process.env,o=An(e.cwd),r=oi(o),i=e.workspace?G(e.workspace.toLowerCase(),"--workspace"):K(r),c=e.agent?G(e.agent,"--agent"):K(r),a=e.runtime?.stateDir??H(n),d=await ce({...e.runtime,stateDir:a});d.warning&&t(`[warn]   ${d.warning}`),t(`${d.started?"[start]":"[skip] "}  local server at ${d.url} (edge ${d.edgeVersion})`);let l=Tn(z(a,"token"),"utf8").trim(),u=d.url,p=rt(n);if("reason"in p)t(`[info]   Claude Code plugin not wired: ${p.reason}. Install Claude Code 2.1.281+ and run \`contextq init --local\` again.`);else{let x=j(n);if(x.installed){let b=gt({target:{apiUrl:u,apiKey:l},journalPath:z(a,"plugin-config.backup.json"),previousKeySource:x.apiUrl&&x.apiUrl.startsWith("http://127.0.0.1")?"local-token":"platform-cred",env:n});if(b.status==="failed")throw new Error(`could not point the installed ${O} at the local server: ${b.reason}`);t(`${b.status==="switched"?"[rotate]":"[skip] "} ${O} -> ${u} (${b.status})`)}else{let b=Ee(o,u,l,ht,n,{marketplaceBase:e.marketplaceBase??ht});if(b.status!=="installed")throw new Error(`could not install ${O}: ${b.status==="unavailable",b.reason}`);t(`[add]    ${O} at project scope -> ${u}`)}}let g={authorization:`Bearer ${l}`},h=await fetch(`${u}/contexts?workspace=${encodeURIComponent(i)}&limit=1`,{headers:g}),f=await fetch(`${u}/hooks/session-start`,{method:"POST",headers:{...g,"content-type":"application/json"},body:JSON.stringify({agent:c,workspace:i})}),w=f.ok?(await f.json()).hookSpecificOutput?.additionalContext??"":"";if(!h.ok||!w.startsWith("ContextQ local mode"))throw new Error(`the local server did not answer a memory read and boot-lite (HTTP ${h.status}/${f.status}); run \`contextq local status\``);let k=(await h.json()).total??0;t(`[check]  local memory answers: ${k} note(s) in ${i}, boot-lite in local mode`);let y=In(o,{workspace:i,agent:c});t(`${y==="skipped"?"[skip] ":y==="created"?"[create]":"[add]  "} .contextq/config.json (mode=local workspace=${i} agent=${c})`),t(""),t("Local mode is on for this repo: memory stays on this machine, no account needed. Open a new Claude Code session here to use it."),t("Board, handoffs and sessions need an account; `contextq attach` adds one later and moves your memory with you.")}var ht,de=M(()=>{"use strict";Le();Pe();He();Ae();ht="https://app.contextq.dev";s(An,"gitRoot");s(Rn,"readBinding");s(On,"appendBinding");s(In,"writeLocalBinding");s(ri,"runLocalInit")});var Ln={};ye(Ln,{AttachError:()=>C,abortAttach:()=>fi,attachSwitch:()=>gi,attachTransfer:()=>ui,ensureLocalServer:()=>Qe,fingerprint:()=>wt,isSimulatedCrash:()=>pi,journalPath:()=>fe,reached:()=>ue,readJournal:()=>Ve,writeJournal:()=>$});import{createHash as ii,randomUUID as si}from"crypto";import{chmodSync as ai,existsSync as qe,mkdirSync as ci,readFileSync as yt,renameSync as li,rmSync as Me,writeFileSync as Dn}from"fs";import{dirname as di,join as Z}from"path";function ue(e,t){return Nn.indexOf(e.state)>=Nn.indexOf(t)}function fe(e){return Z(e,"attach-journal.json")}function Ve(e){let t=fe(e);if(!qe(t))return null;try{return JSON.parse(yt(t,"utf8"))}catch{throw new C(`${t} is not readable JSON; move it aside and run \`contextq attach --restart\``)}}function $(e,t){let n=fe(e);ci(di(n),{recursive:!0,mode:448});let o=`${n}.tmp`;Dn(o,`${JSON.stringify({...t,updatedAt:new Date().toISOString()},null,2)}
-`,{mode:384}),ai(o,384),li(o,n)}function wt(e){return ii("sha256").update(e,"utf8").digest("hex").slice(0,12)}function me(e){return e.replace(/\/+$/,"")}async function pe(e,t,n,o,r){let i=await e(`${t.url}${o}`,{method:n,headers:{authorization:`Bearer ${t.token}`,...r?{"content-type":"application/json"}:{}},body:r?JSON.stringify(r):void 0}),c=await i.text();if(!i.ok)throw new C(`the local server answered HTTP ${i.status} for ${n} ${o}: ${c.slice(0,200)}`);return JSON.parse(c)}async function Fe(e,t,n,o,r,i){let c=await e(`${t}${r}`,{method:o,headers:{authorization:`Bearer ${n}`,...i?{"content-type":"application/json"}:{}},body:i?JSON.stringify(i):void 0}),a=await c.text();return{status:c.status,text:a}}async function Qe(e){return{url:(await ce({...e.runtime,stateDir:e.stateDir})).url,token:yt(Z(e.stateDir,"token"),"utf8").trim()}}function Un(e,t){let n=R();if(!n.apiKey||me(n.apiUrl)!==e||wt(n.apiKey)!==t.keyFingerprint)throw new C(`the attach in progress belongs to another login (its key is no longer the stored credential for ${e}); run \`contextq attach --restart\` to start over`);return n.apiKey}async function ui(e){let t=e.log??(d=>console.log(d)),n=e.fetchImpl??fetch,o=e.stateDir??H(),r=me(e.cloudUrl),i=Ve(o);if(i&&e.restart){if(ue(i,"freezing"))throw new C("the attach already switched or is switching; finish it or run `contextq attach --abort` first");Me(fe(o),{force:!0}),i=null}if(i&&i.cloudUrl!==r)throw new C(`an attach to ${i.cloudUrl} is in progress; resume it with --url ${i.cloudUrl}, or run \`contextq attach --restart\``);i&&i.state==="login_pending"&&(i=null);let c=await Qe({stateDir:o,runtime:e.runtime}),a;if(i)a=Un(r,i),t(`[info]   resuming attach ${i.attachId} at ${i.state}`);else{i={version:1,attachId:si(),cloudUrl:r,tenantId:null,keyFingerprint:null,state:"login_pending",workspaceMap:{},acked:{},denied:{},leaveDenied:!!e.leaveDenied,consent:{ping:null},startedAt:new Date().toISOString(),updatedAt:new Date().toISOString()},$(o,i);try{a=await e.login();let d=await Fe(n,r,a,"GET","/api/workspaces");if(d.status!==200)throw new C(`${r} did not accept the approved key (HTTP ${d.status}); nothing was changed`)}catch(d){throw Me(fe(o),{force:!0}),d}U({explicitKey:a,ambientVarName:null,ambientKey:"",apiUrl:r}),i={...i,state:"authenticated",keyFingerprint:wt(a)},$(o,i),t(`[check]  signed in to ${r}`)}if(e.leaveDenied&&(i.leaveDenied=!0),!ue(i,"workspaces_mapped")){let{workspaces:d}=await pe(n,c,"GET","/workspaces");for(let l of d){if(l.contexts===0||i.workspaceMap[l.slug])continue;let u="global";if(l.slug!=="global"){let p=await Fe(n,r,a,"POST","/api/workspaces/ensure",{name:l.slug,slug:l.slug});if(p.status!==200&&p.status!==201)throw new C(`could not ensure workspace ${l.slug} on ${r} (HTTP ${p.status}); run \`contextq attach\` again to resume`);let g=JSON.parse(p.text);if(typeof g.tenantId=="number"){if(i.tenantId!==null&&i.tenantId!==g.tenantId)throw new C(`the account at ${r} is not the one this attach started with; run \`contextq attach --restart\``);i.tenantId=g.tenantId}u=g.slug}await pe(n,c,"PUT","/sync/workspace-map",{local:l.slug,cloud:u}),i.workspaceMap[l.slug]=u,$(o,i),t(`[map]    ${l.slug} -> ${u}`)}i.state="workspaces_mapped",$(o,i)}if(!ue(i,"transferred")||i.state==="transfer_blocked"){i.state="transferring",$(o,i);let d=Number.POSITIVE_INFINITY;for(;;){let l=await pe(n,c,"POST","/sync/push",{parentUrl:r,apiKey:a,...e.batchMaxContexts?{batchMaxContexts:e.batchMaxContexts}:{}});for(let p of l.refs)p.outcome==="accepted"&&typeof p.cloudId=="number"?(i.acked[p.ref]=p.cloudId,delete i.denied[p.ref]):(p.outcome==="denied"||p.outcome==="too_large")&&(i.denied[p.ref]=p.reason??p.outcome);if($(o,i),l.failures.length>0)throw new C(`the transfer stopped: ${l.failures[0].error}; run \`contextq attach\` again to resume (nothing is sent twice)`);if(l.pending-(i.leaveDenied?Object.keys(i.denied).length:0)<=0)break;if(l.pending>=d||Object.keys(i.denied).length>=l.pending){i.state="transfer_blocked",$(o,i);let p=Object.entries(i.denied).map(([g,h])=>`  ${g}: ${h}`).join(`
-`);throw new C(`${l.pending} note(s) were refused by ${r}:
-${p}
-Edit or delete them locally and run \`contextq attach\` again, or pass --leave-denied to keep them local-only`)}d=l.pending}i.state="transferred",$(o,i),t(`[push]   ${Object.keys(i.acked).length} note(s) are in ${r}`)}return i}function ge(e){return Z(e,"attach-binding-before.json")}function pi(e){return e instanceof Je}async function Be(e,t,n,o){await pe(e,t,"PUT","/sync/write-lock",{lock:n,...o?{attachedTo:o}:{}})}async function je(e,t,n,o,r){let{restorePlugin:i,readPluginState:c}=await Promise.resolve().then(()=>(He(),ft)),{appendBinding:a}=await Promise.resolve().then(()=>(de(),le)),d=e.fetchImpl??fetch,l=e.env??process.env,u=[],p=Z(o,"plugin-config.backup.json"),g=c(l);if(g.installed&&g.apiUrl&&me(g.apiUrl)!==me(n.url)&&qe(p)){let h=i(p,{apiUrl:n.url,apiKey:n.token},l);u.push(h.status==="failed"?`plugin NOT restored: ${h.reason}`:"plugin points at the local server again")}if(e.repoRoot&&qe(ge(o))){let h=JSON.parse(yt(ge(o),"utf8")),f=[];h.mode&&f.push(["mode",h.mode]),h.workspace&&f.push(["workspace",h.workspace]),f.length>0&&a(e.repoRoot,f),u.push("repo binding restored")}throw await Be(d,n,null),t.state="transferred",$(o,t),new C(`${r}; rolled back (${[...u,"local writes unlocked"].join(", ")}). Run \`contextq attach\` again to retry.`)}async function gi(e){let t=e.log??(f=>console.log(f)),n=e.fetchImpl??fetch,o=e.env??process.env,r=e.stateDir??H(),i=me(e.cloudUrl),{reconfigurePlugin:c,readPluginState:a}=await Promise.resolve().then(()=>(He(),ft)),{appendBinding:d,readBinding:l}=await Promise.resolve().then(()=>(de(),le)),u=Ve(r);if(!u||!ue(u,"transferred")||u.state==="transfer_blocked")throw new C("nothing is ready to switch: run the transfer first (`contextq attach`)");if(u.state==="attached")return u;let p=await Qe({stateDir:r,runtime:e.runtime}),g=Un(i,u),h=s(f=>{if(e.crashAfter===f)throw new Je(`simulated crash after ${f}`)},"crash");if(u.state==="switching"&&(t("[info]   an earlier attach stopped during the switch; redoing the switch (every step is idempotent)"),u.state="freezing",$(r,u)),u.state==="transferred"||u.state==="freezing"){u.consent={ping:e.pingConsent??u.consent.ping??!1},u.state="freezing",$(r,u),await Be(n,p,"attach"),h("freezing");let f=await pe(n,p,"POST","/sync/push",{parentUrl:i,apiKey:g});for(let y of f.refs)y.outcome==="accepted"&&typeof y.cloudId=="number"&&(u.acked[y.ref]=y.cloudId);let w=u.leaveDenied?Object.keys(u.denied).length:0;if((f.failures.length>0||f.pending>w)&&await je(e,u,p,r,`the final flush left ${f.pending} note(s) pending${f.failures[0]?` (${f.failures[0].error})`:""}`),u.state="switching",$(r,u),e.repoRoot&&!qe(ge(r))){let y=l(e.repoRoot),x={mode:y?.mode??null,workspace:y?.workspace??null};Dn(ge(r),`${JSON.stringify(x)}
-`,{mode:384})}if(a(o).installed){let y=c({target:{apiUrl:i,apiKey:g},journalPath:Z(r,"plugin-config.backup.json"),previousKeySource:"local-token",env:o});y.status==="failed"&&await je(e,u,p,r,`switching the plugin failed: ${y.reason}`),t(`[rotate] plugin -> ${i}`)}else t("[info]   no installed ContextQ plugin in this Claude Code profile; only the repo binding switches");if(h("switching"),e.repoRoot){let x=l(e.repoRoot)?.workspace??"global",b=u.workspaceMap[x]??x;d(e.repoRoot,[["mode","cloud"],["workspace",b]]);for(let m of["bound-host","local-ids.json"])Me(Z(e.repoRoot,".contextq","cache",m),{force:!0});t(`[bind]   .contextq/config.json -> mode=cloud workspace=${b}`)}u.state="verifying",$(r,u)}if(u.state==="verifying"){let f=e.repoRoot?l(e.repoRoot)?.workspace??"global":"global",w=await Fe(n,i,g,"POST","/api/agent/boot",{agent:"contextq-attach",workspace:f}),k=Object.values(u.acked)[0],y=k===void 0?{status:200,text:""}:await Fe(n,i,g,"GET",`/api/contexts/${k}`),x=w.status===200&&/"mode"\s*:\s*"local"/.test(w.text);(w.status!==200||x||y.status!==200)&&await je(e,u,p,r,`the cloud did not verify (boot HTTP ${w.status}${x?", still local":""}, read HTTP ${y.status})`),await Be(n,p,"attached",i),u.state="attached",$(r,u),Me(ge(r),{force:!0}),t(`[check]  ${i} answers boot and reads an imported note`)}return u}async function fi(e){let t=e.stateDir??H(),n=Ve(t);if(!n)return"no attach in progress";if(n.state==="attached")return"the attach already finished; nothing to abort";let o=await Qe({stateDir:t,runtime:e.runtime});if(["freezing","switching","verifying"].includes(n.state))try{await je(e,n,o,t,"aborted")}catch(r){return r.message}return await Be(e.fetchImpl??fetch,o,null),`attach left at ${n.state}; local writes are unlocked`}var C,Nn,Je,Kn=M(()=>{"use strict";Le();B();C=class extends Error{static{s(this,"AttachError")}constructor(t){super(t),this.name="AttachError"}},Nn=["login_pending","authenticated","workspaces_mapped","transferring","transfer_blocked","transferred","freezing","switching","verifying","attached"];s(ue,"reached");s(fe,"journalPath");s(Ve,"readJournal");s($,"writeJournal");s(wt,"fingerprint");s(me,"normalizeUrl");s(pe,"localJson");s(Fe,"cloudCall");s(Qe,"ensureLocalServer");s(Un,"storedKeyFor");s(ui,"attachTransfer");s(ge,"bindingFile");Je=class extends Error{static{s(this,"SimulatedCrash")}};s(pi,"isSimulatedCrash");s(Be,"setLock");s(je,"rollback");s(gi,"attachSwitch");s(fi,"abortAttach")});import{homedir as Hn}from"os";import{basename as jn}from"path";import{existsSync as ke}from"fs";import{execSync as to}from"child_process";import{homedir as Et}from"os";import{join as Ye}from"path";var Mn="CONTEXTQ_HOST";var Fn="CLAUDE_CODE_ENABLE_FUNCTION_HOOKS",Jn=["claude-code","claude-desktop","codex","opencode","cyberine","muse","unknown"],Bn=[["claude-code","claude-code"],["claude-desktop","claude-desktop"],["claude-ai","claude-desktop"],["claude","claude-desktop"],["codex","codex"],["opencode","opencode"],["cyberine","cyberine"],["muse","muse"],["muse-code","muse"]];function vt(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}s(vt,"normalizeName");function Vn(e){if(!e)return"unknown";let t=vt(e);if(!t)return"unknown";let n=[...Bn].sort((o,r)=>r[0].length-o[0].length);for(let[o,r]of n)if(t===o||t.startsWith(`${o}-`))return r;return"unknown"}s(Vn,"hostFromClientName");function Qn(e){if(!e)return;let t=vt(e);return Jn.find(n=>n===t)}s(Qn,"parseHostOverride");function St(e={}){let t=e.env??(typeof process<"u"?process.env:{}),n=t.CLAUDE_CODE_SESSION_ID||void 0,o=s((i,c)=>({host:i,supportsFunctionHooks:i==="claude-code"&&t[Fn]==="1",...i==="claude-code"&&n?{sessionId:n}:{},via:c}),"finish");if(e.forcedHost)return o(e.forcedHost,"forced");let r=Qn(t[Mn]);return r?o(r,"env-override"):e.clientName!==void 0?o(Vn(e.clientName),"client-info"):t.CLAUDECODE==="1"?o("claude-code","env"):o("unknown","none")}s(St,"resolveHost");import{chmodSync as Xn,existsSync as Yn,mkdirSync as Gn,readFileSync as Wn,writeFileSync as zn}from"fs";import{execFileSync as $t}from"child_process";import{basename as Zn,dirname as Ct,join as we}from"path";var Y=["gemini","cursor","copilot"],J={gemini:{label:"Gemini CLI",configDir:s(e=>we(e,".gemini"),"configDir"),configFile:"settings.json",entry:s((e,t)=>({httpUrl:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"gemini mcp list"},cursor:{label:"Cursor",configDir:s(e=>we(e,".cursor"),"configDir"),configFile:"mcp.json",entry:s((e,t)=>({url:e,headers:{Authorization:`Bearer ${t}`}}),"entry"),listCommand:"cursor-agent mcp list"},copilot:{label:"Copilot CLI",configDir:s((e,t)=>t.COPILOT_HOME||we(e,".copilot"),"configDir"),configFile:"mcp-config.json",entry:s((e,t)=>({type:"http",url:e,headers:{Authorization:`Bearer ${t}`},tools:["*"]}),"entry"),listCommand:"copilot mcp list"}};function te(e,t,n){return J[e].configDir(t,n)}s(te,"hostConfigDir");function eo(e,t,n){return we(te(e,t,n),J[e].configFile)}s(eo,"hostMcpConfigPath");function F(e){return`${e.replace(/\/+$/,"")}/mcp`}s(F,"mcpEndpoint");function Xe(e){let t=Ct(e);try{if($t("git",["-C",t,"rev-parse","--is-inside-work-tree"],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()!=="true")return!1}catch{return!1}try{return $t("git",["-C",t,"check-ignore","-q","--",Zn(e)],{stdio:"ignore"}),!1}catch(n){return n.status===1}}s(Xe,"gitTracksUnignored");function _t(e,t){let n=J[e],o=eo(e,t.homeDir,t.env),r=Yn(o),i={};if(r){let a=Wn(o,"utf-8");try{let d=a.trim()===""?{}:JSON.parse(a);if(!d||typeof d!="object"||Array.isArray(d))throw new Error("top level is not an object");i=d}catch(d){return{surface:e,path:o,action:"refused",detail:`not valid JSON (${d.message}); left untouched`}}}let c=i.mcpServers??{};return typeof c!="object"||Array.isArray(c)?{surface:e,path:o,action:"refused",detail:"mcpServers is not an object; left untouched"}:c.contextq?{surface:e,path:o,action:"skipped",detail:"contextq server entry already present"}:Xe(o)?{surface:e,path:o,action:"refused",detail:`sits in a git work tree and is not gitignored; writing the API key there would put it in a commit. Add it to that repo's .gitignore and re-run, or add the server by hand: ${n.label} -> ${F(t.apiUrl)}`}:(i.mcpServers={...c,contextq:n.entry(F(t.apiUrl),t.apiKey)},Gn(Ct(o),{recursive:!0}),zn(o,`${JSON.stringify(i,null,2)}
-`,{mode:384}),Xn(o,384),{surface:e,path:o,action:r?"added":"created",detail:`contextq remote MCP (${F(t.apiUrl)}) with the API key in the header, file mode 600; check with \`${n.listCommand}\``})}s(_t,"wireHostMcp");function no(e){try{return to("git rev-parse --show-toplevel",{cwd:e,stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}s(no,"gitRoot");function oo(e){return ke(Ye(e,".codex"))}s(oo,"hasCodexProjectDir");function ro(e){return ke(Ye(e,".codex"))}s(ro,"hasCodexHome");function Pt(e,t={}){let n=no(e),o=n||e,{host:r}=St(t.hostSignals);if(t.forcedSurface)return{surfaces:[t.forcedSurface],root:o,host:r};let a=ke(Ye(e,".claude"))||!!n&&!(r!=="unknown"&&r!=="claude-code"),d=oo(o)||ro(t.homeDir??Et()),l=[];a&&l.push("claude-code"),d&&l.push("codex");let u=t.homeDir??Et(),p=t.env??process.env;for(let g of Y)ke(te(g,u,p))&&l.push(g);return l.length===0&&l.push("desktop"),{surfaces:l,root:a||d?o:e,host:r}}s(Pt,"detectSurface");B();B();var Ot="the provided API key does not look valid (expected sk_live_<40 hex chars>)",ho="npx @contextq/cli init --key <sk_live_...>";function It(e){return e.status===401||e.status===403}s(It,"isRefused");function Nt(e,t){switch(e){case"explicit":return"The --key";case"ambient":return`The ${t??"environment"}`;case"stored":return`The stored (${_()})`;case"prompt":return"The typed";case"device":return"The browser-approved"}}s(Nt,"describe");async function Dt(e){let t=R(),n=Ze()?t.apiKey:"",o,r;if(e.explicitKey){if(!T.test(e.explicitKey))throw new Error(Ot);o=e.explicitKey,r="explicit"}else if(n)o=n,r="stored";else if(e.ambientKey){if(!T.test(e.ambientKey))throw new Error(Ot);o=e.ambientKey,r="ambient"}else if(e.interactive&&e.deviceLogin)o=await e.deviceLogin(),r="device";else{let a=e.interactive?await e.prompt("ContextQ API key (sk_live_...): "):"";if(!T.test(a))throw new Error("no valid API key available (expected sk_live_<40 hex chars>). Run `contextq login` from an interactive terminal to approve this machine in the browser, set CONTEXT_API_KEY, or pass --key.");o=a,r="prompt"}let i=await e.verify(o);if(It(i)){let a=`${Nt(r,e.ambientVarName)} API key was refused by ${e.apiUrl} (HTTP ${i.status})`;if(!e.interactive)throw new Error(`${a}; nothing was written. Re-run with a working key: ${ho}`);if(e.deviceLogin)console.log(`${a}. Approve this machine in the browser to replace it.`),o=await e.deviceLogin(),r="device";else{let d=await e.prompt(`${a}. Paste a new key (sk_live_...): `);if(!T.test(d))throw new Error(`${a}, and no valid replacement was entered; nothing was written.`);o=d,r="prompt"}if(i=await e.verify(o),It(i))throw new Error(`${Nt(r,null)} API key was refused by ${e.apiUrl} (HTTP ${i.status}); nothing was written.`)}if(r==="device"&&!i.ok){let a=i.status?`HTTP ${i.status}`:i.error??"unknown error";throw new Error(`could not verify the browser-approved key against ${e.apiUrl} (${a}); nothing was written. Run \`contextq login\` again once the server answers.`)}return{decision:U({explicitKey:r==="explicit"||r==="prompt"||r==="device"?o:void 0,ambientVarName:e.ambientVarName,ambientKey:e.ambientKey,apiUrl:e.apiUrl}),verify:i,source:r}}s(Dt,"resolveVerifiedCredentials");B();import{hostname as yo}from"os";var S=class extends Error{static{s(this,"DeviceLoginError")}code;constructor(t,n){super(n),this.name="DeviceLoginError",this.code=t}},wo=5,ko=5,xo=600;function bo(e,t){return new Promise((n,o)=>{if(t?.aborted)return o(new S("cancelled","login cancelled; nothing was written"));let r=setTimeout(()=>{t?.removeEventListener("abort",i),n()},e),i=s(()=>{clearTimeout(r),o(new S("cancelled","login cancelled; nothing was written"))},"onAbort");t?.addEventListener("abort",i,{once:!0})})}s(bo,"defaultSleep");async function Ut(e){try{return await e.json()}catch{return null}}s(Ut,"readJson");function Lt(e,t){return typeof e=="number"&&Number.isInteger(e)&&e>0?e:t}s(Lt,"positiveInt");async function ve(e){let t=e.fetchImpl??fetch,n=e.sleep??bo,o=e.now??Date.now,r=e.apiUrl.replace(/\/+$/,""),i=s(()=>new S("cancelled","login cancelled; nothing was written"),"cancelled"),c;try{c=await t(`${r}/api/auth/device/start`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({client_name:e.clientName??"@contextq/cli",hostname:e.hostname??yo()}),signal:e.signal})}catch(f){throw e.signal?.aborted?i():new S("unreachable",`could not reach ${r}/api/auth/device/start (${f.message})`)}let a=c.ok?await Ut(c):null,d=typeof a?.device_code=="string"?a.device_code:"",l=typeof a?.user_code=="string"?a.user_code:"";if(!d||!l)throw new S("protocol",`${r} did not start a device login (HTTP ${c.status}); is this a ContextQ server?`);let u=typeof a?.verification_uri_complete=="string"&&a.verification_uri_complete||typeof a?.verification_uri=="string"&&a.verification_uri||`${r}/link`,p=Lt(a?.expires_in,xo),g=Lt(a?.interval,ko);e.onPrompt({verificationUri:u,userCode:l,expiresInSeconds:p});let h=o()+p*1e3;for(;;){if(o()>=h)throw new S("expired_token","the approval window expired before this machine was approved; nothing was written");if(await n(g*1e3,e.signal),e.signal?.aborted)throw i();let f;try{f=await t(`${r}/api/auth/device/token`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({device_code:d}),signal:e.signal})}catch{if(e.signal?.aborted)throw i();continue}let w=await Ut(f);if(f.status===200){let y=w?.api_key;if(typeof y=="string"&&T.test(y))return y;throw new S("protocol","the token endpoint answered 200 without a well-formed API key; nothing was written")}let k=typeof w?.error=="string"?w.error:"";switch(k){case"authorization_pending":continue;case"slow_down":g+=wo;continue;case"access_denied":throw new S("access_denied","the request was denied in the browser; nothing was written");case"expired_token":throw new S("expired_token","the device code expired; run the command again");case"invalid_grant":throw new S("invalid_grant","the server rejected the device code; run the command again");default:if(f.status>=500||f.status===429)continue;throw new S("protocol",`unexpected answer from the token endpoint (HTTP ${f.status}${k?`, ${k}`:""})`)}}}s(ve,"deviceLogin");import{existsSync as vo,readFileSync as So,writeFileSync as $o}from"fs";import{execFileSync as Co}from"child_process";import{join as _o}from"path";function Eo(e,t){try{return Co("git",["check-ignore","-q","--",t],{cwd:e,stdio:"ignore"}),!0}catch(n){return n.status===1?!1:null}}s(Eo,"isPathGitIgnored");function Kt(e,t,n,o){let r=_o(e,".mcp.json"),i=vo(r),c={};if(i){let a=So(r,"utf-8");try{c=a.trim()===""?{}:JSON.parse(a)}catch(d){throw new Error(`.mcp.json exists but is not valid JSON (${d.message}) -- refusing to touch it`)}}if(c.mcpServers??={},c.mcpServers.contextq)return{path:r,action:"skipped",detail:"contextq server entry already present"};if(n){let a=Eo(e,".mcp.json");if(a===!1)throw new Error('.mcp.json is not covered by .gitignore in this repo -- refusing to write the raw API key into a file git would track. Add ".mcp.json" to .gitignore first, or re-run without --embed-key to use the safer ${CONTEXT_API_KEY} placeholder instead.');a===null&&console.log("[warn]  could not verify .mcp.json is gitignored (no git repo detected at this path) -- writing the raw key anyway.")}return c.mcpServers.contextq={command:"npx",args:["-y","@contextq/mcp"],env:{CONTEXT_API_URL:t,CONTEXT_API_KEY:n?o:"${CONTEXT_API_KEY}"}},$o(r,`${JSON.stringify(c,null,2)}
-`),{path:r,action:i?"added":"created",detail:`contextq server wired (key=${n?"embedded literal":"${CONTEXT_API_KEY} placeholder"})`}}s(Kt,"wireMcpJson");import{appendFileSync as Po,chmodSync as To,existsSync as Se,mkdirSync as Ao,readFileSync as qt,writeFileSync as Ro}from"fs";import{execFileSync as Mt}from"child_process";import{dirname as Oo,join as $e}from"path";import{parse as Ht,stringify as Io}from"smol-toml";var Ce=".codex/config.toml";function No(e){return $e(e,".codex","config.toml")}s(No,"codexConfigPath");function Do(e,t){if(!Se($e(e,".git")))return!1;try{return Mt("git",["-C",e,"ls-files","--error-unmatch","--",t],{stdio:"ignore"}),!0}catch{return!1}}s(Do,"gitTracked");function Uo(e,t){try{return Mt("git",["-C",e,"check-ignore","-q","--",t],{stdio:"ignore"}),!0}catch{return!1}}s(Uo,"gitIgnored");function Lo(e){if(!Se($e(e,".git"))||Uo(e,Ce))return;let t=$e(e,".gitignore"),n=Se(t)?qt(t,"utf-8"):"",o=n===""||n.endsWith(`
+`;return er(n,o,{mode:384}),bt(n,384),n}function M(e){let t=N(),n=St(),o=a(r=>{if(!n)return fn(r),{action:"created",backupPath:null};if(rr(t,r))return{action:"skipped",backupPath:null};let s=ir();return fn(r),{action:"rotated",backupPath:s}},"writeSafely");if(e.explicitKey){if(!I.test(e.explicitKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.explicitKey,s=o({apiKey:r,apiUrl:e.apiUrl}),i=s.action==="skipped"?`${vt} credentials (unchanged)`:s.action==="rotated"?`${hn} credentials (${A()}; previous saved to ${s.backupPath})`:`${gn} credentials (${A()}, mode 600)`;return{apiKey:r,credLine:i,action:s.action,backupPath:s.backupPath}}if(n&&t.apiKey){let r=e.ambientVarName?`${vt} credentials (already configured at ${A()}; env ${e.ambientVarName} ignored, pass --key to rotate)`:`${vt} credentials (already configured at ${A()}; pass --key to rotate)`;return{apiKey:t.apiKey,credLine:r,action:"skipped",backupPath:null}}if(e.ambientKey){if(!I.test(e.ambientKey))throw new Error("the provided API key does not look valid (expected sk_live_<40 hex chars>)");let r=e.ambientKey,s=o({apiKey:r,apiUrl:e.apiUrl}),i=s.action==="rotated"?`${hn} credentials (${A()}; previous saved to ${s.backupPath})`:`${gn} credentials (${A()}, mode 600)`;return{apiKey:r,credLine:i,action:s.action,backupPath:s.backupPath}}return{apiKey:"",credLine:"",action:null,backupPath:null}}var nr,I,gn,hn,vt,G=C(()=>{"use strict";a($t,"platformCredDir");nr=["contextq","ctq-brain"];a(or,"platformCredDirFor");a(A,"platformCredFile");a(St,"credsFileExists");a(rr,"credsEqual");a(sr,"utcTimestamp");a(ir,"backupCredsFile");a(De,"readEnvVal");a(N,"readExistingCreds");a(fn,"writeCreds");I=/^sk_live_[0-9a-f]{40}$/,gn="[create]",hn="[rotate]",vt="[skip] ";a(M,"decideCredentialWrite")});import{existsSync as fr,readFileSync as gr,writeFileSync as hr}from"fs";import{execFileSync as mr}from"child_process";import{join as wr}from"path";function yr(e,t){try{return mr("git",["check-ignore","-q","--",t],{cwd:e,stdio:"ignore"}),!0}catch(n){return n.status===1?!1:null}}function Ct(e){return wr(e,".mcp.json")}function bn(e,t,n,o){let r=Ct(e),s=fr(r),i={};if(s){let c=gr(r,"utf-8");try{i=c.trim()===""?{}:JSON.parse(c)}catch(l){throw new Error(`.mcp.json exists but is not valid JSON (${l.message}) -- refusing to touch it`)}}if(i.mcpServers??={},i.mcpServers.contextq)return{path:r,action:"skipped",detail:"contextq server entry already present"};if(n){let c=yr(e,".mcp.json");if(c===!1)throw new Error('.mcp.json is not covered by .gitignore in this repo -- refusing to write the raw API key into a file git would track. Add ".mcp.json" to .gitignore first, or re-run without --embed-key to use the safer ${CONTEXT_API_KEY} placeholder instead.');c===null&&console.log("[warn]  could not verify .mcp.json is gitignored (no git repo detected at this path) -- writing the raw key anyway.")}return i.mcpServers.contextq={command:"npx",args:["-y","@contextq/mcp"],env:{CONTEXT_API_URL:t,CONTEXT_API_KEY:n?o:"${CONTEXT_API_KEY}"}},hr(r,`${JSON.stringify(i,null,2)}
+`),{path:r,action:s?"added":"created",detail:`contextq server wired (key=${n?"embedded literal":"${CONTEXT_API_KEY} placeholder"})`}}var _t=C(()=>{"use strict";a(yr,"isPathGitIgnored");a(Ct,"mcpJsonPath");a(bn,"wireMcpJson")});import{appendFileSync as kr,chmodSync as xr,existsSync as Ue,mkdirSync as vr,readFileSync as Cn,writeFileSync as br}from"fs";import{execFileSync as _n}from"child_process";import{dirname as $r,join as je}from"path";import{parse as $n,stringify as Sr}from"smol-toml";function Et(e){return je(e,".codex","config.toml")}function Cr(e,t){if(!Ue(je(e,".git")))return!1;try{return _n("git",["-C",e,"ls-files","--error-unmatch","--",t],{stdio:"ignore"}),!0}catch{return!1}}function _r(e,t){try{return _n("git",["-C",e,"check-ignore","-q","--",t],{stdio:"ignore"}),!0}catch{return!1}}function Er(e){if(!Ue(je(e,".git"))||_r(e,Ke))return;let t=je(e,".gitignore"),n=Ue(t)?Cn(t,"utf-8"):"",o=n===""||n.endsWith(`
 `)?"":`
-`;Po(t,`${o}${Ce}
-`)}s(Lo,"ensureConfigGitignored");function Ko(e,t){return Io({mcp_servers:{contextq:{url:F(e),http_headers:{Authorization:`Bearer ${t}`}}}})}s(Ko,"codexMcpBlock");function jt(e){let t=e.mcp_servers;if(!(!t||typeof t!="object"||Array.isArray(t)))return t.contextq}s(jt,"contextqEntry");function Ft(e,t,n){let o=No(e),r=Se(o),i=r?qt(o,"utf-8"):"";if(r){let d;try{d=Ht(i)}catch(l){return{path:o,action:"refused",detail:`not valid TOML (${l.message.split(`
-`)[0]}); left untouched`}}if(jt(d)!==void 0)return{path:o,action:"skipped",detail:"mcp_servers.contextq already present"}}if(Do(e,Ce))return{path:o,action:"refused",detail:`is tracked by git; writing the API key there would put it in a commit. Untrack it (git rm --cached ${Ce}) and re-run, or add the server by hand: codex -> ${F(t)}`};let c=i===""?"":i.endsWith(`
+`;kr(t,`${o}${Ke}
+`)}function Pr(e,t){return Sr({mcp_servers:{contextq:{url:$(e),http_headers:{Authorization:`Bearer ${t}`}}}})}function Sn(e){let t=e.mcp_servers;if(!(!t||typeof t!="object"||Array.isArray(t)))return t.contextq}function En(e,t,n){let o=Et(e),r=Ue(o),s=r?Cn(o,"utf-8"):"";if(r){let l;try{l=$n(s)}catch(d){return{path:o,action:"refused",detail:`not valid TOML (${d.message.split(`
+`)[0]}); left untouched`}}if(Sn(l)!==void 0)return{path:o,action:"skipped",detail:"mcp_servers.contextq already present"}}if(Cr(e,Ke))return{path:o,action:"refused",detail:`is tracked by git; writing the API key there would put it in a commit. Untrack it (git rm --cached ${Ke}) and re-run, or add the server by hand: codex -> ${$(t)}`};let i=s===""?"":s.endsWith(`
 `)?`
 `:`
 
-`,a=`${i}${c}${Ko(t,n)}`;try{let d=Ht(a);if(jt(d)===void 0)throw new Error("mcp_servers.contextq missing after merge")}catch(d){return{path:o,action:"refused",detail:`adding [mcp_servers.contextq] would not parse (${d.message.split(`
-`)[0]}), e.g. mcp_servers is an inline table; left untouched`}}return Ao(Oo(o),{recursive:!0}),Lo(e),Ro(o,a,{mode:384}),To(o,384),{path:o,action:r?"added":"created",detail:`contextq streamable HTTP MCP (${F(t)}) with the API key in http_headers, file mode 600, gitignored; Codex reads project config only in a trusted project, so run \`codex\` once here and accept the trust prompt, then check with \`codex mcp list\``}}s(Ft,"wireCodexMcp");import{chmodSync as Xo,existsSync as tt,mkdirSync as Yt,readFileSync as Yo,writeFileSync as Gt}from"fs";import{dirname as Wt,join as _e}from"path";import{appendFileSync as Ho,existsSync as ne,mkdirSync as jo,readFileSync as et,writeFileSync as qo}from"fs";import{execFileSync as Mo}from"child_process";import{join as L,relative as Fo}from"path";var Jo=/contextq-boot\.sh|contextq.*boot/;function Jt(e){return`'${e.split("'").join("'\\''")}'`}s(Jt,"shellQuote");var V="npx -y --prefer-offline @contextq/cli";function Bt(e,t,n,o=V){return`${o} hook boot --format ${n} --agent ${Jt(e)} --workspace ${Jt(t)}`}s(Bt,"buildBootCommand");function Bo(e,t){if(!ne(L(e,".git")))return!1;try{return Mo("git",["-C",e,"ls-files","--error-unmatch","--",Fo(e,t)],{stdio:"ignore"}),!0}catch{return!1}}s(Bo,"gitTracked");function Vt(e,t,n){let{path:o,dir:r,topLevelDefaults:i}=e,c=ne(o),a={};if(c){let l=et(o,"utf-8");try{a=l.trim()===""?{}:JSON.parse(l)}catch(u){return{path:o,action:"refused",detail:`not valid JSON (${u.message}); left untouched`}}if(!a||typeof a!="object"||Array.isArray(a))return{path:o,action:"refused",detail:"top level is not a JSON object; left untouched"}}if(i)for(let[l,u]of Object.entries(i))a[l]===void 0&&(a[l]=u);return a.hooks??={},a.hooks.SessionStart??=[],a.hooks.SessionStart.some(l=>(l?.hooks??[]).some(u=>typeof u.command=="string"&&Jo.test(u.command)))?{path:o,action:"skipped",detail:"SessionStart contextq-boot hook already present"}:e.root&&Bo(e.root,o)?{path:o,action:"refused",detail:"is tracked by git; a per-machine hook would be committed for every teammate. Untrack it and re-run"}:(a.hooks.SessionStart.push({hooks:[{type:"command",command:t}]}),jo(r,{recursive:!0}),qo(o,`${JSON.stringify(a,null,2)}
-`),{path:o,action:"wired",detail:n})}s(Vt,"mergeSessionStartHook");function Qt(e,t,n,o=V){let r=L(e,".claude","settings.local.json"),i=Bt(t,n,"claude",o);return Vt({path:r,dir:L(e,".claude"),root:e},i,`SessionStart boot hook wired (agent=${t}, workspace=${n}; runs \`${o} hook boot\`, key from the credentials file)`)}s(Qt,"wireSessionHook");function Vo(e){let t=L(e,".codex","config.toml");if(!ne(t))return!1;let n=et(t,"utf-8");return/^\s*\[{1,2}hooks(\.|\])/m.test(n)}s(Vo,"hasInlineHooksTable");function Qo(e,t){if(!ne(L(e,".git")))return;let n=L(e,".gitignore"),o=ne(n)?et(n,"utf-8"):"";if(new Set(o.split(`
-`).map(c=>c.trim())).has(t))return;let i=`
+`,c=`${s}${i}${Pr(t,n)}`;try{let l=$n(c);if(Sn(l)===void 0)throw new Error("mcp_servers.contextq missing after merge")}catch(l){return{path:o,action:"refused",detail:`adding [mcp_servers.contextq] would not parse (${l.message.split(`
+`)[0]}), e.g. mcp_servers is an inline table; left untouched`}}return vr($r(o),{recursive:!0}),Er(e),br(o,c,{mode:384}),xr(o,384),{path:o,action:r?"added":"created",detail:`contextq streamable HTTP MCP (${$(t)}) with the API key in http_headers, file mode 600, gitignored; Codex reads project config only in a trusted project, so run \`codex\` once here and accept the trust prompt, then check with \`codex mcp list\``}}var Ke,Pt=C(()=>{"use strict";Y();Ke=".codex/config.toml";a(Et,"codexConfigPath");a(Cr,"gitTracked");a(_r,"gitIgnored");a(Er,"ensureConfigGitignored");a(Pr,"codexMcpBlock");a(Sn,"contextqEntry");a(En,"wireCodexMcp")});import{appendFileSync as Tr,existsSync as he,mkdirSync as Ar,readFileSync as Tt,writeFileSync as Rr}from"fs";import{execFileSync as Or}from"child_process";import{join as F,relative as Ir}from"path";function Pn(e){return`'${e.split("'").join("'\\''")}'`}function Tn(e,t,n,o=J){return`${o} hook boot --format ${n} --agent ${Pn(e)} --workspace ${Pn(t)}`}function Dr(e,t){if(!he(F(e,".git")))return!1;try{return Or("git",["-C",e,"ls-files","--error-unmatch","--",Ir(e,t)],{stdio:"ignore"}),!0}catch{return!1}}function An(e,t,n){let{path:o,dir:r,topLevelDefaults:s}=e,i=he(o),c={};if(i){let d=Tt(o,"utf-8");try{c=d.trim()===""?{}:JSON.parse(d)}catch(u){return{path:o,action:"refused",detail:`not valid JSON (${u.message}); left untouched`}}if(!c||typeof c!="object"||Array.isArray(c))return{path:o,action:"refused",detail:"top level is not a JSON object; left untouched"}}if(s)for(let[d,u]of Object.entries(s))c[d]===void 0&&(c[d]=u);return c.hooks??={},c.hooks.SessionStart??=[],c.hooks.SessionStart.some(d=>(d?.hooks??[]).some(u=>typeof u.command=="string"&&Nr.test(u.command)))?{path:o,action:"skipped",detail:"SessionStart contextq-boot hook already present"}:e.root&&Dr(e.root,o)?{path:o,action:"refused",detail:"is tracked by git; a per-machine hook would be committed for every teammate. Untrack it and re-run"}:(c.hooks.SessionStart.push({hooks:[{type:"command",command:t}]}),Ar(r,{recursive:!0}),Rr(o,`${JSON.stringify(c,null,2)}
+`),{path:o,action:"wired",detail:n})}function Le(e){return F(e,".claude","settings.local.json")}function Me(e){return F(e,".codex","hooks.json")}function Rn(e,t,n,o=J){let r=Le(e),s=Tn(t,n,"claude",o);return An({path:r,dir:F(e,".claude"),root:e},s,`SessionStart boot hook wired (agent=${t}, workspace=${n}; runs \`${o} hook boot\`, key from the credentials file)`)}function qr(e){let t=F(e,".codex","config.toml");if(!he(t))return!1;let n=Tt(t,"utf-8");return/^\s*\[{1,2}hooks(\.|\])/m.test(n)}function Hr(e,t){if(!he(F(e,".git")))return;let n=F(e,".gitignore"),o=he(n)?Tt(n,"utf-8"):"";if(new Set(o.split(`
+`).map(i=>i.trim())).has(t))return;let s=`
 # .codex/hooks.json embeds a per-machine absolute path (the contextq boot
 # hook command) -- gitignored the same way .claude/settings.local.json is.
 # Each teammate who wants it needs to run \`npx contextq init\` themselves.
 ${t}
-`;Ho(n,i)}s(Qo,"ensureGitignored");function Xt(e,t,n,o=V){let r=L(e,".codex","hooks.json"),i=Bt(t,n,"codex",o),c="Codex requires this hook to be TRUSTED before it runs -- start `codex` in this repo and approve it at the hook-trust prompt (or review/trust via `/hooks` in a session)",a=Vo(e)?" -- WARNING: .codex/config.toml also declares an inline [hooks] table; Codex loads both hooks.json and the inline table and warns on every run. Prefer one representation per layer.":"",d=Vt({path:r,dir:L(e,".codex"),root:e,topLevelDefaults:{description:"ContextQ boot hook (managed by `npx contextq init` -- re-run the installer to update, do not hand-edit)"}},i,`SessionStart boot hook wired (agent=${t}, workspace=${n}). ${c}.${a}`);return d.action==="wired"&&Qo(e,".codex/hooks.json"),d}s(Xt,"wireCodexSessionHook");var Go=/contextq.*hook boot|contextq-boot\.sh/;function Wo(e,t=V){return`${t} hook boot --format ${e} --require-config`}s(Wo,"hostHookCommand");function zo(e,t,n){let o=te(e,t,n);return e==="gemini"?_e(o,"settings.json"):e==="cursor"?_e(o,"hooks.json"):_e(o,"hooks","contextq.json")}s(zo,"hostHookPath");function Zo(e){if(!tt(e))return{doc:{}};let t=Yo(e,"utf-8");try{let n=t.trim()===""?{}:JSON.parse(t);return!n||typeof n!="object"||Array.isArray(n)?{error:"top level is not a JSON object"}:{doc:n}}catch(n){return{error:`not valid JSON (${n.message})`}}}s(Zo,"readJsonObject");function er(e,t){let n=e.hooks??={};if(typeof n!="object"||Array.isArray(n))return;let o=n[t]??=[];return Array.isArray(o)?o:void 0}s(er,"eventList");function tr(e){return JSON.stringify(e).match(Go)!==null}s(tr,"alreadyWired");function zt(e,t){let n=zo(e,t.homeDir,t.env),o=tt(n),{doc:r,error:i}=Zo(n);if(!r)return{surface:e,path:n,action:"refused",detail:`${i}; left untouched`};let c=Wo(e,t.runner),a=e==="gemini"?"SessionStart":"sessionStart";e!=="gemini"&&(r.version??=1);let d=er(r,a);return d?tr(d)?{surface:e,path:n,action:"skipped",detail:"contextq boot hook already present"}:Xe(n)?{surface:e,path:n,action:"refused",detail:`sits in a git work tree and is not gitignored; add the SessionStart hook by hand: ${c}`}:(e==="gemini"?d.push({hooks:[{type:"command",name:"contextq-boot",command:c,timeout:3e4}]}):e==="cursor"?d.push({command:c,timeout:30}):d.push({type:"command",bash:c,timeoutSec:30}),Yt(Wt(n),{recursive:!0}),Gt(n,`${JSON.stringify(r,null,2)}
-`,{mode:384}),Xo(n,384),{surface:e,path:n,action:o?"added":"created",detail:`SessionStart boot hook (runs only in repos with a .contextq/config.json); ${e==="cursor"?"Cursor runs sessionStart without waiting, so the first turn may not see it":"the boot pack is injected at session start"}`}):{surface:e,path:n,action:"refused",detail:`hooks.${a} is not an array; left untouched`}}s(zt,"wireHostHook");function Zt(e,t,n){let o=_e(e,".contextq","config.json");return tt(o)?{path:o,action:"skipped",detail:"repo already bound -- left untouched"}:(Yt(Wt(o),{recursive:!0}),Gt(o,`${JSON.stringify({config_schema_version:5,workspace:t,agent:n,read_scope:"own+global"},null,2)}
-`),{path:o,action:"created",detail:`binds this repo to workspace ${t} for the host hooks; commit it so other machines share the binding`})}s(Zt,"ensureRepoConfig");Pe();B();Ae();import{execFileSync as dr}from"child_process";import{existsSync as rn,readFileSync as ur}from"fs";import{basename as sn,join as an}from"path";var st=["claude","codex","gemini","cursor","copilot"],pr="https://app.contextq.dev";function oe(e){let t=(e??"").trim();return!t||/^\$\{[^}]*\}$/.test(t)?"":t}s(oe,"usable");function gr(e){let t=R(),n=oe(e.CONTEXT_API_KEY)||oe(e.CTQ_API_KEY),o=n||t.apiKey,r=(n?oe(e.CONTEXT_API_URL)||oe(e.CTQ_API_URL):"")||t.apiUrl||oe(e.CONTEXT_API_URL)||pr;return{apiKey:o,apiUrl:r.replace(/\/+$/,"")}}s(gr,"resolveHookCreds");function fr(e,t){if(!t||t.trim()==="")return e;try{let n=JSON.parse(t);if(typeof n.cwd=="string"&&n.cwd)return n.cwd;if(Array.isArray(n.workspace_roots)&&typeof n.workspace_roots[0]=="string")return n.workspace_roots[0]}catch{return e}return e}s(fr,"sessionCwd");function it(e,t){try{return dr("git",["-C",e,...t],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}s(it,"git");function mr(e,t,n){let o=an(e,".contextq","config.json");if(rn(o))return ur(o,"utf-8");let r=K(sn(e));return JSON.stringify({workspace:(n||r).toLowerCase(),agent:t||r,read_scope:"own+global"})}s(mr,"hookConfig");function Re(e,t){return JSON.stringify(e==="cursor"?{additional_context:t}:e==="copilot"?{additionalContext:t}:{hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:t}})}s(Re,"formatForHost");async function cn(e){let t=fr(e.cwd,e.stdinText),n=it(t,["rev-parse","--show-toplevel"]);if(!n||e.requireConfig&&!rn(an(n,".contextq","config.json")))return"";let{apiKey:o,apiUrl:r}=gr(e.env);if(!o)return Re(e.format,"ContextQ: no API key found (CONTEXT_API_KEY or the credentials file `npx @contextq/cli init` writes), so no memory was loaded this session. Fix: run npx @contextq/cli init in this repo.");let i=new URLSearchParams({config:mr(n,e.agent,e.workspace),agent_slug:e.agent??"",project:sn(n),git_root:n,branch:it(n,["branch","--show-current"]),head_sha:it(n,["rev-parse","--short","HEAD"]),goal:"",board:"",token_budget:"3000"}),c=e.fetchImpl??fetch,a=0,d="";try{let l=await c(`${r}/api/agent/hooks/session-start`,{method:"POST",headers:{Authorization:`Bearer ${o}`,Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:i.toString(),signal:AbortSignal.timeout(e.timeoutMs??1e4)});a=l.status,d=await l.text()}catch{a=0}if(a===401||a===403)return Re(e.format,`ContextQ: ${r} refused the stored API key (HTTP ${a}): it is expired, revoked or wrong, so no memory was loaded and nothing will be saved this session. Fix: npx @contextq/cli init --key <new sk_live_ key>, or run init from a terminal to be prompted.`);if(a===0||a>=500)return Re(e.format,`ContextQ: ${r} is unreachable or failing (HTTP ${a}), so no memory was loaded this session. The key was not checked; memory resumes when the server answers again.`);if(a<200||a>=300||d.trim()==="")return"";try{let u=JSON.parse(d).hookSpecificOutput?.additionalContext;return typeof u!="string"||u===""?"":Re(e.format,u)}catch{return""}}s(cn,"runHookBoot");async function ln(e=500){return process.stdin.isTTY?"":new Promise(t=>{let n="",o=s(()=>{process.stdin.removeAllListeners("data"),process.stdin.removeAllListeners("end"),process.stdin.pause(),t(n)},"done"),r=setTimeout(o,e);process.stdin.setEncoding("utf8"),process.stdin.on("data",i=>{n+=i}),process.stdin.on("end",()=>{clearTimeout(r),o()})})}s(ln,"readStdinIfPiped");import{appendFileSync as hr,existsSync as dn,readFileSync as yr}from"fs";import{execFileSync as wr}from"child_process";import{join as at}from"path";var kr=[".contextq/tasks/TASKS.md",".contextq/tasks/tasks/T*.md",".contextq/tasks/.render*",".contextq/tasks/status.log"];function xr(e){try{return wr("git",["-C",e,"ls-files","--error-unmatch","--",".contextq/tasks/TASKS.md"],{stdio:"ignore"}),!0}catch{return!1}}s(xr,"manifestTracked");function un(e){let t=at(e,".gitignore");if(!dn(at(e,".git")))return{path:t,action:"skipped",detail:"not a git repo -- no board render to keep out of commits"};if(xr(e))return{path:at(e,".contextq","tasks","TASKS.md"),action:"skipped",detail:"this repo tracks a git-sourced board -- left untouched"};let n=dn(t)?yr(t,"utf-8"):"",o=new Set(n.split(`
-`).map(c=>c.trim())),r=kr.filter(c=>!o.has(c));if(r.length===0)return{path:t,action:"skipped",detail:"board render already gitignored"};let i=n===""||n.endsWith(`
+`;Tr(n,s)}function On(e,t,n,o=J){let r=Me(e),s=Tn(t,n,"codex",o),i="Codex requires this hook to be TRUSTED before it runs -- start `codex` in this repo and approve it at the hook-trust prompt (or review/trust via `/hooks` in a session)",c=qr(e)?" -- WARNING: .codex/config.toml also declares an inline [hooks] table; Codex loads both hooks.json and the inline table and warns on every run. Prefer one representation per layer.":"",l=An({path:r,dir:F(e,".codex"),root:e,topLevelDefaults:{description:"ContextQ boot hook (managed by `npx contextq init` -- re-run the installer to update, do not hand-edit)"}},s,`SessionStart boot hook wired (agent=${t}, workspace=${n}). ${i}.${c}`);return l.action==="wired"&&Hr(e,".codex/hooks.json"),l}var Nr,J,Fe=C(()=>{"use strict";Nr=/contextq-boot\.sh|contextq.*boot/;a(Pn,"shellQuote");J="npx -y --prefer-offline @contextq/cli";a(Tn,"buildBootCommand");a(Dr,"gitTracked");a(An,"mergeSessionStartHook");a(Le,"claudeHookPath");a(Me,"codexHookPath");a(Rn,"wireSessionHook");a(qr,"hasInlineHooksTable");a(Hr,"ensureGitignored");a(On,"wireCodexSessionHook")});import{chmodSync as Ur,existsSync as At,mkdirSync as Dn,readFileSync as jr,writeFileSync as qn}from"fs";import{dirname as Hn,join as Je}from"path";function Mr(e,t=J){return`${t} hook boot --format ${e} --require-config`}function Fr(e,t,n=J){return`${n} hook snapshot --format ${e} --reason ${t} --require-config`}function Jr(e){return e==="copilot"?[{event:"sessionEnd",reason:"end"},{event:"preCompact",reason:"compact"}]:[]}function Be(e,t,n){let o=ue(e,t,n);return e==="gemini"?Je(o,"settings.json"):e==="cursor"?Je(o,"hooks.json"):Je(o,"hooks","contextq.json")}function Br(e){if(!At(e))return{doc:{}};let t=jr(e,"utf-8");try{let n=t.trim()===""?{}:JSON.parse(t);return!n||typeof n!="object"||Array.isArray(n)?{error:"top level is not a JSON object"}:{doc:n}}catch(n){return{error:`not valid JSON (${n.message})`}}}function In(e,t){let n=e.hooks??={};if(typeof n!="object"||Array.isArray(n))return;let o=n[t]??=[];return Array.isArray(o)?o:void 0}function Nn(e,t=Kr){return JSON.stringify(e).match(t)!==null}function Un(e,t){let n=Be(e,t.homeDir,t.env),o=At(n),{doc:r,error:s}=Br(n);if(!r)return{surface:e,path:n,action:"refused",detail:`${s}; left untouched`};let i=Mr(e,t.runner),c=e==="gemini"?"SessionStart":"sessionStart";e!=="gemini"&&(r.version??=1);let l=In(r,c);if(!l)return{surface:e,path:n,action:"refused",detail:`hooks.${c} is not an array; left untouched`};let d=Nn(l),u=[];for(let{event:g,reason:h}of Jr(e)){let w=In(r,g);if(!w)return{surface:e,path:n,action:"refused",detail:`hooks.${g} is not an array; left untouched`};Nn(w,Lr)||u.push({list:w,reason:h,event:g})}if(d&&u.length===0)return{surface:e,path:n,action:"skipped",detail:"contextq hooks already present"};if(pe(n))return{surface:e,path:n,action:"refused",detail:`sits in a git work tree and is not gitignored; add the SessionStart hook by hand: ${i}`};d||(e==="gemini"?l.push({hooks:[{type:"command",name:"contextq-boot",command:i,timeout:3e4}]}):e==="cursor"?l.push({command:i,timeout:30}):l.push({type:"command",bash:i,timeoutSec:30}));for(let g of u)g.list.push({type:"command",bash:Fr(e,g.reason,t.runner),timeoutSec:30});Dn(Hn(n),{recursive:!0}),qn(n,`${JSON.stringify(r,null,2)}
+`,{mode:384}),Ur(n,384);let f=`SessionStart boot hook (runs only in repos with a .contextq/config.json); ${e==="cursor"?"Cursor runs sessionStart without waiting, so the first turn may not see it":"the boot pack is injected at session start"}`,p=u.length>0?`${u.map(g=>g.event).join(" + ")} snapshot hook (git state only, no transcript; respects capture_scope)`:"";return{surface:e,path:n,action:o?"added":"created",detail:[d?"":f,p].filter(Boolean).join("; ")}}function jn(e,t,n){let o=Je(e,".contextq","config.json");return At(o)?{path:o,action:"skipped",detail:"repo already bound -- left untouched"}:(Dn(Hn(o),{recursive:!0}),qn(o,`${JSON.stringify({config_schema_version:5,workspace:t,agent:n,read_scope:"own+global"},null,2)}
+`),{path:o,action:"created",detail:`binds this repo to workspace ${t} for the host hooks; commit it so other machines share the binding`})}var Kr,Lr,Rt=C(()=>{"use strict";Y();Fe();Kr=/contextq.*hook boot|contextq-boot\.sh/,Lr=/contextq.*hook snapshot/;a(Mr,"hostHookCommand");a(Fr,"hostSnapshotCommand");a(Jr,"snapshotEvents");a(Be,"hostHookPath");a(Br,"readJsonObject");a(In,"eventList");a(Nn,"alreadyWired");a(Un,"wireHostHook");a(jn,"ensureRepoConfig")});import{spawnSync as Ot}from"child_process";import{existsSync as Qr,readFileSync as Vr}from"fs";import{join as Xr}from"path";function Ln(e){return e[It]||"claude"}function Yr(e){let t=/(\d+)\.(\d+)\.(\d+)/.exec(e);return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}function Gr(e,t){for(let n=0;n<3;n++)if(e[n]!==t[n])return e[n]>t[n];return!0}function Mn(e){let t=Xr(e,".mcp.json");if(!Qr(t))return!1;try{return!!JSON.parse(Vr(t,"utf-8")).mcpServers?.contextq}catch{return!1}}function Nt(e=process.env){let t=Ot(Ln(e),["--version"],{encoding:"utf-8",env:e});if(t.error||t.status!==0)return{reason:"the `claude` binary was not found on PATH"};let n=Yr(t.stdout);return n?Gr(n,Kn)?{version:n.join(".")}:{reason:`Claude Code ${n.join(".")} is older than ${Kn.join(".")}, the ContextQ plugin's floor (its function-hook module needs prompt.edit and ui.render AbovePrompt)`}:{reason:`could not read a version from \`claude --version\` (${t.stdout.trim()})`}}function zr(e){let t=e.split(`
+`).map(n=>n.trim()).filter(n=>n.startsWith("{"));for(let n=t.length-1;n>=0;n--)try{return JSON.parse(t[n])}catch{continue}return null}function Wr(e){return`${e.replace(/\/$/,"")}/plugin/marketplace.json`}function Qe(e,t,n,o,r=process.env,s={}){let i=Nt(r);if("reason"in i)return{status:"unavailable",reason:i.reason};let c=Ln(r),l=Ot(c,["plugin","marketplace","add",Wr(s.marketplaceBase??t),"--scope","project"],{cwd:e,encoding:"utf-8",env:r});if(l.error||l.status!==0)return{status:"failed",reason:`\`claude plugin marketplace add\` exited ${l.status??"with an error"}`};let d=["plugin","install",_,"--scope","project","--json","--config",`apiKey=${n}`];t.replace(/\/$/,"")!==o.replace(/\/$/,"")&&d.push("--config",`apiUrl=${t}`);let u=Ot(c,d,{cwd:e,encoding:"utf-8",env:r}),f=zr(u.stdout??"");if(!f)return{status:"failed",reason:`\`claude plugin install --json\` printed no result line (exit ${u.status??"error"})`};if(f.outcome!=="ok"||u.status!==0){let g=typeof f.failureCode=="string"?` [${f.failureCode}]`:"";return{status:"failed",reason:`${String(f.message??"install failed")}${g}`}}let p=String(f.message??"installed");return{status:"installed",message:p,alreadyInstalled:/already installed/i.test(p)}}function Fn(e){return e.noPlugin?{delegate:!1,reason:"--no-plugin: wiring Claude Code through .mcp.json"}:e.legacyMcpEntry?{delegate:!1,reason:".mcp.json already wires contextq -- keeping that path, not installing the plugin on top of it (both would register the same MCP server)"}:e.verifyStatus===401||e.verifyStatus===403?{delegate:!1,reason:`the server rejected this key (HTTP ${e.verifyStatus}) -- not handing it to the plugin, whose apiKey is stored machine-wide and would replace a working one; wiring .mcp.json instead`}:{delegate:!0}}var _,Kn,It,me=C(()=>{"use strict";_="contextq@contextq-plugins",Kn=[2,1,281],It="CONTEXTQ_CLAUDE_BIN";a(Ln,"claudeBin");a(Yr,"parseClaudeVersion");a(Gr,"versionAtLeast");a(Mn,"hasLegacyMcpEntry");a(Nt,"detectClaude");a(zr,"lastJsonLine");a(Wr,"marketplaceUrl");a(Qe,"installPlugin");a(Fn,"decidePluginDelegation")});function te(e,t){if(!Zr.test(e))throw new Error(`${t} value "${e}" is not a valid slug -- allowed: ${Ve}`);return e}function B(e){let t=e.toLowerCase().replace(/[^a-z0-9_-]+/g,"-").replace(/^[-_]+|[-_]+$/g,"");return t=t.slice(0,64),t=t.replace(/[-_]+$/g,""),t===""?"default":t}var Zr,Ve,Xe=C(()=>{"use strict";Zr=/^[a-z0-9][a-z0-9_-]{0,63}$/,Ve='lowercase letters, digits, "-", "_" (must start with a letter/digit, max 64 chars)';a(te,"validateSlug");a(B,"sanitizeSlugFallback")});import{execFileSync as es}from"child_process";import{existsSync as Jn,readFileSync as ts}from"fs";import{basename as Bn,join as Qn}from"path";function we(e){let t=(e??"").trim();return!t||/^\$\{[^}]*\}$/.test(t)?"":t}function ke(e){let t=N(),n=we(e.CONTEXT_API_KEY)||we(e.CTQ_API_KEY),o=n||t.apiKey,r=(n?we(e.CONTEXT_API_URL)||we(e.CTQ_API_URL):"")||t.apiUrl||we(e.CONTEXT_API_URL)||ns;return{apiKey:o,apiUrl:r.replace(/\/+$/,"")}}function Dt(e,t){if(!t||t.trim()==="")return e;try{let n=JSON.parse(t);if(typeof n.cwd=="string"&&n.cwd)return n.cwd;if(Array.isArray(n.workspace_roots)&&typeof n.workspace_roots[0]=="string")return n.workspace_roots[0]}catch{return e}return e}function q(e,t){try{return es("git",["-C",e,...t],{stdio:["ignore","pipe","ignore"],encoding:"utf-8"}).trim()}catch{return""}}function qt(e,t,n){let o=Qn(e,".contextq","config.json");if(Jn(o))return ts(o,"utf-8");let r=B(Bn(e));return JSON.stringify({workspace:(n||r).toLowerCase(),agent:t||r,read_scope:"own+global"})}function Ye(e,t){return JSON.stringify(e==="cursor"?{additional_context:t}:e==="copilot"?{additionalContext:t}:{hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:t}})}async function Vn(e){let t=Dt(e.cwd,e.stdinText),n=q(t,["rev-parse","--show-toplevel"]);if(!n||e.requireConfig&&!Jn(Qn(n,".contextq","config.json")))return"";let{apiKey:o,apiUrl:r}=ke(e.env);if(!o)return Ye(e.format,"ContextQ: no API key found (CONTEXT_API_KEY or the credentials file `npx @contextq/cli login` or `init` writes), so no memory was loaded this session. Fix: run npx @contextq/cli login once on this machine.");let s=new URLSearchParams({config:qt(n,e.agent,e.workspace),agent_slug:e.agent??"",project:Bn(n),git_root:n,branch:q(n,["branch","--show-current"]),head_sha:q(n,["rev-parse","--short","HEAD"]),goal:"",board:"",token_budget:"3000"}),i=e.fetchImpl??fetch,c=0,l="";try{let d=await i(`${r}/api/agent/hooks/session-start`,{method:"POST",headers:{Authorization:`Bearer ${o}`,Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:s.toString(),signal:AbortSignal.timeout(e.timeoutMs??1e4)});c=d.status,l=await d.text()}catch{c=0}if(c===401||c===403)return Ye(e.format,`ContextQ: ${r} refused the stored API key (HTTP ${c}): it is expired, revoked or wrong, so no memory was loaded and nothing will be saved this session. Fix: npx @contextq/cli init --key <new sk_live_ key>, or run init from a terminal to be prompted.`);if(c===0||c>=500)return Ye(e.format,`ContextQ: ${r} is unreachable or failing (HTTP ${c}), so no memory was loaded this session. The key was not checked; memory resumes when the server answers again.`);if(c<200||c>=300||l.trim()==="")return"";try{let u=JSON.parse(l).hookSpecificOutput?.additionalContext;return typeof u!="string"||u===""?"":Ye(e.format,u)}catch{return""}}async function Ht(e=500){return process.stdin.isTTY?"":new Promise(t=>{let n="",o=a(()=>{process.stdin.removeAllListeners("data"),process.stdin.removeAllListeners("end"),process.stdin.pause(),t(n)},"done"),r=setTimeout(o,e);process.stdin.setEncoding("utf8"),process.stdin.on("data",s=>{n+=s}),process.stdin.on("end",()=>{clearTimeout(r),o()})})}var ye,ns,Ge=C(()=>{"use strict";G();Xe();ye=["claude","codex","gemini","cursor","copilot"],ns="https://app.contextq.dev";a(we,"usable");a(ke,"resolveHookCreds");a(Dt,"sessionCwd");a(q,"git");a(qt,"hookConfig");a(Ye,"formatForHost");a(Vn,"runHookBoot");a(Ht,"readStdinIfPiped")});var uo={};de(uo,{DEFAULT_LOCAL_PORT:()=>so,EDGE_PACKAGE:()=>Jt,EDGE_SOURCE_ENV:()=>io,EDGE_VERSION_PIN:()=>ro,LocalRuntimeError:()=>D,MIN_NODE_MAJOR:()=>xe,STATE_DIR_ENV:()=>Mt,checkNode:()=>et,defaultLocalStateDir:()=>U,preflight:()=>lo,provision:()=>co,start:()=>Se,status:()=>oe,stop:()=>Os});import{spawn as vs,spawnSync as Lt}from"child_process";import{chmodSync as bs,closeSync as $s,existsSync as ne,mkdirSync as Ss,openSync as Cs,readFileSync as Ze,rmSync as We,writeFileSync as oo}from"fs";import{homedir as _s,platform as Es}from"os";import{join as R}from"path";function U(e=process.env){if(e[Mt])return e[Mt];let t=_s();if(Es()==="darwin")return R(t,"Library","Application Support","contextq","local");let n=e.XDG_DATA_HOME&&e.XDG_DATA_HOME.trim()!==""?e.XDG_DATA_HOME:R(t,".local","share");return R(n,"contextq","local")}function $e(e){let t=e.version??ro,n=e.stateDir??U();return{stateDir:n,runtimeDir:e.runtimeDir??R(n,"runtime"),port:e.port??so,version:t,source:e.packageSource??process.env[io]??`${Jt}@${t}`,nodeVersion:e.nodeVersion??process.versions.node,nodeBin:e.nodeBin??process.execPath,npmBin:e.npmBin??"npm",fetchImpl:e.fetchImpl??fetch,startTimeoutMs:e.startTimeoutMs??15e3}}function ao(e){return R(e.runtimeDir,`edge-${e.version}`)}function ve(e){return R(ao(e),"node_modules","@contextq","edge")}function et(e){let t=Number(e.split(".")[0]);if(!Number.isFinite(t)||t<xe)throw new D(`ContextQ local mode needs Node ${xe} or newer, and this is Node ${e}; install Node ${xe}+ and run \`contextq local start\` again.`)}function Ft(e){Ss(e,{recursive:!0,mode:448}),bs(e,448)}function no(e){let t=R(ve(e),"package.json");if(!ne(t))return null;try{return JSON.parse(Ze(t,"utf8")).version}catch{return null}}function co(e={}){let t=$e(e);et(t.nodeVersion);let n=ao(t);if(no(t)===t.version&&ne(R(ve(t),"dist","cli.js")))return{dir:ve(t),installed:!1};Ft(t.stateDir),Ft(n),ne(R(n,"package.json"))||oo(R(n,"package.json"),`${JSON.stringify({name:"contextq-local-runtime",private:!0},null,2)}
+`);let o=Lt(t.npmBin,["install","--no-audit","--no-fund","--omit=dev","--install-links","--prefix",n,t.source],{encoding:"utf8",timeout:3e5});if(o.error||o.status!==0){let s=`${o.stderr??""}`.trim().split(`
+`).slice(-3).join(" | ");throw new D(`could not install ${t.source} into ${n}${/E404|No matching version|ETARGET/.test(s)?" (that version is not published yet)":""}: ${s||o.error?.message||`npm exited ${o.status}`}`)}let r=no(t);if(r!==t.version)throw new D(`installed ${Jt} is ${r??"missing"}, but this CLI is pinned to ${t.version}; remove ${n} and run \`contextq local start\` again.`);return{dir:ve(t),installed:!0}}function lo(e={}){let t=$e(e);et(t.nodeVersion);let n=ve(t),o=Lt(t.nodeBin,["--input-type=module","-e","import Database from 'better-sqlite3'; new Database(':memory:').prepare('select 1').get();"],{cwd:n,encoding:"utf8",timeout:3e4});if(o.status!==0){let s=`${o.stderr??""}`.trim().split(`
+`).find(i=>/Error|error/.test(i))??`exit ${o.status}`;throw new D(`better-sqlite3 does not load on this machine (${s.slice(0,200)}); local mode supports macOS arm64 and Linux x64 with Node ${xe}+ and npm prebuilt binaries.`)}return Lt(t.nodeBin,["--input-type=module","-e","import { createRequire } from 'node:module'; import Database from 'better-sqlite3'; createRequire(import.meta.url + '/../')('sqlite-vec').load(new Database(':memory:'));"],{cwd:n,encoding:"utf8",timeout:3e4}).status!==0?{vectorSearch:!1,warning:"sqlite-vec does not load here; local search runs keyword-only (FTS5)."}:{vectorSearch:!0}}function be(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}function Ps(e){let t=H(e).pid;if(!ne(t))return null;let n=Number(Ze(t,"utf8").trim());return Number.isInteger(n)&&n>0?n:null}function Ts(e){let t=H(e).endpoint;if(!ne(t))return null;try{return JSON.parse(Ze(t,"utf8"))}catch{return null}}async function As(e,t){try{let n=await e(`${t}/health`,{signal:AbortSignal.timeout(2e3)});return n.ok?await n.json():null}catch{return null}}async function oe(e={}){let t=$e(e),n={running:!1,owned:!1,url:null,pid:null,edgeVersion:null,pinnedVersion:t.version,stateDir:t.stateDir},o=Ps(t.stateDir),r=Ts(t.stateDir);if(o===null)return{...n,note:"not started"};if(!be(o))return We(H(t.stateDir).pid,{force:!0}),{...n,note:`not running (removed a stale pidfile for pid ${o})`};if(!r||r.pid!==o)return{...n,pid:o,note:`pid ${o} is alive but has not published its endpoint`};let s=await As(t.fetchImpl,r.url);return!s||s.mode!=="local"||s.service!=="contextq-edge"?{...n,pid:o,url:r.url,note:`pid ${o} does not answer as a ContextQ local server at ${r.url}`}:{...n,running:!0,owned:!0,url:r.url,pid:o,edgeVersion:String(s.edgeVersion??"")||null}}async function Rs(e){let t=`http://127.0.0.1:${e.port}`;try{let n=await e.fetchImpl(`${t}/health`,{signal:AbortSignal.timeout(1500)});return(await n.json().catch(()=>null))?.service==="contextq-edge"?`another ContextQ local server (not started from ${e.stateDir})`:`a process that is not ContextQ (HTTP ${n.status})`}catch(n){return n.cause?.code==="ECONNREFUSED"?null:"a process that does not answer HTTP"}}async function Se(e={}){let t=$e(e);et(t.nodeVersion);let n=await oe(e);if(n.running){if(n.edgeVersion&&n.edgeVersion!==t.version)throw new D(`the running local server is edge ${n.edgeVersion}, but this CLI is pinned to ${t.version}; run \`contextq local stop\` and start it again.`);return{...n,started:!1}}let o=await Rs(t);if(o)throw new D(`port ${t.port} on 127.0.0.1 is held by ${o}; it was left alone. Stop it or pass --port <n>.`);let{dir:r}=co(e),s=lo(e);Ft(t.stateDir),We(H(t.stateDir).endpoint,{force:!0});let i=Cs(H(t.stateDir).log,"a",384),c=vs(t.nodeBin,[R(r,"dist","cli.js"),"serve","--state-dir",t.stateDir,"--port",String(t.port)],{detached:!0,stdio:["ignore",i,i]});if($s(i),c.pid===void 0)throw new D("could not start the local server process");oo(H(t.stateDir).pid,`${c.pid}
+`,{mode:384}),c.unref();let l=Date.now()+t.startTimeoutMs;for(;Date.now()<l;){let u=await oe(e);if(u.running)return{...u,started:!0,...s.warning?{warning:s.warning}:{}};if(!be(c.pid))break;await new Promise(f=>setTimeout(f,200))}let d=ne(H(t.stateDir).log)?Ze(H(t.stateDir).log,"utf8").trim().split(`
+`).slice(-3).join(" | "):"";throw be(c.pid)&&process.kill(c.pid,"SIGTERM"),We(H(t.stateDir).pid,{force:!0}),new D(`the local server did not come up within ${Math.round(t.startTimeoutMs/1e3)} s${d?`: ${d}`:""}`)}async function Os(e={}){let t=$e(e),n=await oe(e);if(!n.running||!n.owned||n.pid===null)return{stopped:!1,note:n.note??"not running"};process.kill(n.pid,"SIGTERM");let o=Date.now()+1e4;for(;Date.now()<o&&be(n.pid);)await new Promise(r=>setTimeout(r,100));return be(n.pid)?{stopped:!1,note:`pid ${n.pid} did not exit after SIGTERM; it was left running`}:(We(H(t.stateDir).pid,{force:!0}),{stopped:!0,note:`stopped pid ${n.pid}`})}var Jt,ro,so,xe,Mt,io,D,H,Ce=C(()=>{"use strict";Jt="@contextq/edge",ro="0.2.0",so=47321,xe=22,Mt="CONTEXTQ_LOCAL_STATE_DIR",io="CONTEXTQ_EDGE_PACKAGE",D=class extends Error{static{a(this,"LocalRuntimeError")}constructor(t){super(t),this.name="LocalRuntimeError"}};a(U,"defaultLocalStateDir");a($e,"resolve");H=a(e=>({pid:R(e,"edge.pid"),endpoint:R(e,"endpoint.json"),log:R(e,"edge.log")}),"paths");a(ao,"runtimeRoot");a(ve,"edgePackageDir");a(et,"checkNode");a(Ft,"ensureDir");a(no,"installedVersion");a(co,"provision");a(lo,"preflight");a(be,"pidAlive");a(Ps,"readPid");a(Ts,"readEndpoint");a(As,"health");a(oe,"status");a(Rs,"portHolder");a(Se,"start");a(Os,"stop")});var Qt={};de(Qt,{readJournal:()=>fo,readPluginState:()=>Q,reconfigurePlugin:()=>Bt,restorePlugin:()=>Ms,supportsTerminalConfigure:()=>po,syncPlatformCredentials:()=>Fs,writeJournal:()=>z});import{spawnSync as Is}from"child_process";import{chmodSync as Ns,existsSync as Ds,mkdirSync as qs,readFileSync as Hs,renameSync as Us,writeFileSync as js}from"fs";import{dirname as Ks}from"path";function Ls(e){return e[It]||"claude"}function W(e){return e.replace(/\/+$/,"")}function tt(e,t,n){return Is(Ls(e),t,{encoding:"utf-8",env:e,input:n,timeout:6e4})}function po(e=process.env){let t=tt(e,["plugin","configure","--help"]);return!t.error&&t.status===0&&/--values-stdin/.test(t.stdout??"")}function Q(e=process.env,t=_){let n=tt(e,["plugin","list","--json"]),o;try{o=JSON.parse(n.stdout??"[]").find(l=>l.id===t)}catch{o=void 0}if(!o)return{installed:!1,scope:null,enabled:null,apiUrl:null,apiKeySet:!1};let r=tt(e,["plugin","configure",t,"--json"]),s=null,i=!1;try{let c=JSON.parse(r.stdout??"{}");s=c.inputs?.apiUrl?W(c.inputs.apiUrl):null,i=Array.isArray(c.configured)&&c.configured.includes("apiKey")}catch{s=null}return{installed:!0,scope:o.scope??null,enabled:o.enabled??null,apiUrl:s,apiKeySet:i}}function z(e,t){qs(Ks(e),{recursive:!0,mode:448});let n=`${e}.tmp`;js(n,`${JSON.stringify(t,null,2)}
+`,{mode:384}),Ns(n,384),Us(n,e)}function fo(e){if(!Ds(e))return null;try{return JSON.parse(Hs(e,"utf-8"))}catch{return null}}function go(e,t,n){let o=tt(e,["plugin","configure",t,"--values-stdin"],JSON.stringify({apiUrl:W(n.apiUrl),apiKey:n.apiKey}));return o.error?`could not run \`claude plugin configure\` (${o.error.message})`:o.status!==0?`\`claude plugin configure\` exited ${o.status}`:null}function Bt(e){let t=e.env??process.env,n=e.pluginId??_,o=W(e.target.apiUrl);if(!po(t))return{status:"failed",reason:"this Claude Code has no `claude plugin configure --values-stdin`; update it (`claude update`) or run `/plugin configure contextq` inside a session",state:null};let r=Q(t,n);if(!r.installed)return{status:"failed",reason:`${n} is not installed in this Claude Code profile`,state:r};let s=a(()=>new Date().toISOString(),"now"),i={version:1,pluginId:n,startedAt:s(),updatedAt:s(),step:"backed_up",before:{apiUrl:r.apiUrl,scope:r.scope,enabled:r.enabled},target:{apiUrl:o},previousKeySource:e.previousKeySource??null};z(e.journalPath,i);let c=go(t,n,e.target);if(c)return z(e.journalPath,{...i,step:"failed",updatedAt:s(),error:c}),{status:"failed",reason:c,state:Q(t,n)};z(e.journalPath,{...i,step:"configured",updatedAt:s()});let l=Q(t,n),d=[];if(l.apiUrl!==o&&d.push(`apiUrl is ${l.apiUrl??"unset"}, expected ${o}`),l.apiKeySet||d.push("apiKey is not set"),l.scope!==r.scope&&d.push(`scope changed from ${r.scope} to ${l.scope}`),l.enabled!==r.enabled&&d.push(`enabled changed from ${r.enabled} to ${l.enabled}`),d.length>0){let u=`the effective plugin config does not match the switch: ${d.join("; ")}`;return z(e.journalPath,{...i,step:"failed",updatedAt:s(),error:u}),{status:"failed",reason:u,state:l}}return z(e.journalPath,{...i,step:"verified",updatedAt:s()}),{status:r.apiUrl===o?"updated":"switched",state:l}}function Ms(e,t,n=process.env){let o=fo(e);if(!o)return{status:"failed",reason:`no plugin switch journal at ${e}`,state:null};if(o.before.apiUrl&&W(t.apiUrl)!==o.before.apiUrl)return{status:"failed",reason:`the restore endpoint ${W(t.apiUrl)} is not the one recorded before the switch (${o.before.apiUrl})`,state:null};let r=go(n,o.pluginId,t);if(r)return{status:"failed",reason:r,state:Q(n,o.pluginId)};let s=Q(n,o.pluginId);return s.apiUrl!==W(t.apiUrl)||!s.apiKeySet?{status:"failed",reason:`restore did not take effect (apiUrl is ${s.apiUrl??"unset"})`,state:s}:(z(e,{...o,step:"restored",updatedAt:new Date().toISOString()}),{status:"switched",state:s})}function Fs(e){if(!I.test(e.apiKey))return{written:!1,line:"[skip]  platform credentials (a local token stays in the local state dir)"};let t=M({explicitKey:e.apiKey,ambientVarName:null,ambientKey:"",apiUrl:W(e.apiUrl)});return{written:t.action!=="skipped",line:t.credLine}}var nt=C(()=>{"use strict";me();G();a(Ls,"bin");a(W,"normalizeUrl");a(tt,"run");a(po,"supportsTerminalConfigure");a(Q,"readPluginState");a(z,"writeJournal");a(fo,"readJournal");a(go,"applyConfig");a(Bt,"reconfigurePlugin");a(Ms,"restorePlugin");a(Fs,"syncPlatformCredentials")});var _e={};de(_e,{CLOUD_MARKETPLACE_BASE:()=>Xt,appendBinding:()=>wo,gitRoot:()=>mo,readBinding:()=>ot,runLocalInit:()=>zs,writeLocalBinding:()=>yo});import{spawnSync as Js}from"child_process";import{existsSync as Bs,mkdirSync as Qs,readFileSync as ho,renameSync as Vs,writeFileSync as Xs}from"fs";import{homedir as Ys}from"os";import{basename as Gs,join as re,resolve as Vt}from"path";function mo(e){let t=Js("git",["-C",e,"rev-parse","--show-toplevel"],{encoding:"utf8"});if(t.status!==0)throw new Error(`${e} is not inside a git repository; run \`contextq init --local\` from the project repo`);let n=t.stdout.trim(),o=Vt(Ys());if(Vt(n)===o||Vt(n)===re(o,".claude"))throw new Error(`${n} is your home directory or ~/.claude, not a project repo; nothing was bound`);return n}function ot(e){let t=re(e,".contextq","config.json");if(!Bs(t))return null;try{return JSON.parse(ho(t,"utf8"))}catch{throw new Error(`${t} is not valid JSON; fix or delete it first`)}}function wo(e,t,n="contextq-cli"){let o=re(e,".contextq"),r=re(o,"config.json"),s=ot(e),i=s??{},c=i._entries??[],l=i.write_seq??c.length,d=!1;for(let[f,p]of t){if(i[f]===p)continue;let g=l;l+=1,c.push({key:f,value:p,written_by:n,based_on:g,seq:l,ts:new Date().toISOString().replace(/\.\d{3}Z$/,"Z")}),i[f]=p,d=!0}if(!d)return"skipped";i.config_schema_version=Math.max(5,i.config_schema_version??5),i.write_seq=l,i._entries=c,Qs(o,{recursive:!0});let u=`${r}.tmp`;return Xs(u,`${JSON.stringify(i,null,2)}
+`),Vs(u,r),s?"updated":"created"}function yo(e,t){return wo(e,[["mode","local"],["workspace",t.workspace],["agent",t.agent]])}async function zs(e){let t=e.log??(v=>console.log(v)),n=e.env??process.env,o=mo(e.cwd),r=Gs(o),s=e.workspace?te(e.workspace.toLowerCase(),"--workspace"):B(r),i=e.agent?te(e.agent,"--agent"):B(r),c=e.runtime?.stateDir??U(n),l=await Se({...e.runtime,stateDir:c});l.warning&&t(`[warn]   ${l.warning}`),t(`${l.started?"[start]":"[skip] "}  local server at ${l.url} (edge ${l.edgeVersion})`);let d=ho(re(c,"token"),"utf8").trim(),u=l.url,f=Nt(n);if("reason"in f)t(`[info]   Claude Code plugin not wired: ${f.reason}. Install Claude Code 2.1.281+ and run \`contextq init --local\` again.`);else{let v=Q(n);if(v.installed){let k=Bt({target:{apiUrl:u,apiKey:d},journalPath:re(c,"plugin-config.backup.json"),previousKeySource:v.apiUrl&&v.apiUrl.startsWith("http://127.0.0.1")?"local-token":"platform-cred",env:n});if(k.status==="failed")throw new Error(`could not point the installed ${_} at the local server: ${k.reason}`);t(`${k.status==="switched"?"[rotate]":"[skip] "} ${_} -> ${u} (${k.status})`)}else{let k=Qe(o,u,d,Xt,n,{marketplaceBase:e.marketplaceBase??Xt});if(k.status!=="installed")throw new Error(`could not install ${_}: ${k.status==="unavailable",k.reason}`);t(`[add]    ${_} at project scope -> ${u}`)}}let p={authorization:`Bearer ${d}`},g=await fetch(`${u}/contexts?workspace=${encodeURIComponent(s)}&limit=1`,{headers:p}),h=await fetch(`${u}/hooks/session-start`,{method:"POST",headers:{...p,"content-type":"application/json"},body:JSON.stringify({agent:i,workspace:s})}),w=h.ok?(await h.json()).hookSpecificOutput?.additionalContext??"":"";if(!g.ok||!w.startsWith("ContextQ local mode"))throw new Error(`the local server did not answer a memory read and boot-lite (HTTP ${g.status}/${h.status}); run \`contextq local status\``);let x=(await g.json()).total??0;t(`[check]  local memory answers: ${x} note(s) in ${s}, boot-lite in local mode`);let y=yo(o,{workspace:s,agent:i});t(`${y==="skipped"?"[skip] ":y==="created"?"[create]":"[add]  "} .contextq/config.json (mode=local workspace=${s} agent=${i})`),t(""),t("Local mode is on for this repo: memory stays on this machine, no account needed. Open a new Claude Code session here to use it."),t("Board, handoffs and sessions need an account; `contextq attach` adds one later and moves your memory with you.")}var Xt,se=C(()=>{"use strict";Ce();me();nt();Xe();Xt="https://app.contextq.dev";a(mo,"gitRoot");a(ot,"readBinding");a(wo,"appendBinding");a(yo,"writeLocalBinding");a(zs,"runLocalInit")});var bo={};de(bo,{AttachError:()=>T,abortAttach:()=>ai,attachSwitch:()=>ii,attachTransfer:()=>ri,ensureLocalServer:()=>ut,fingerprint:()=>Gt,isSimulatedCrash:()=>si,journalPath:()=>Ae,reached:()=>Ee,readJournal:()=>dt,writeJournal:()=>P});import{createHash as Ws,randomUUID as Zs}from"crypto";import{chmodSync as ei,existsSync as st,mkdirSync as ti,readFileSync as Yt,renameSync as ni,rmSync as it,writeFileSync as xo}from"fs";import{dirname as oi,join as ie}from"path";function Ee(e,t){return ko.indexOf(e.state)>=ko.indexOf(t)}function Ae(e){return ie(e,"attach-journal.json")}function dt(e){let t=Ae(e);if(!st(t))return null;try{return JSON.parse(Yt(t,"utf8"))}catch{throw new T(`${t} is not readable JSON; move it aside and run \`contextq attach --restart\``)}}function P(e,t){let n=Ae(e);ti(oi(n),{recursive:!0,mode:448});let o=`${n}.tmp`;xo(o,`${JSON.stringify({...t,updatedAt:new Date().toISOString()},null,2)}
+`,{mode:384}),ei(o,384),ni(o,n)}function Gt(e){return Ws("sha256").update(e,"utf8").digest("hex").slice(0,12)}function Re(e){return e.replace(/\/+$/,"")}async function Pe(e,t,n,o,r){let s=await e(`${t.url}${o}`,{method:n,headers:{authorization:`Bearer ${t.token}`,...r?{"content-type":"application/json"}:{}},body:r?JSON.stringify(r):void 0}),i=await s.text();if(!s.ok)throw new T(`the local server answered HTTP ${s.status} for ${n} ${o}: ${i.slice(0,200)}`);return JSON.parse(i)}async function at(e,t,n,o,r,s){let i=await e(`${t}${r}`,{method:o,headers:{authorization:`Bearer ${n}`,...s?{"content-type":"application/json"}:{}},body:s?JSON.stringify(s):void 0}),c=await i.text();return{status:i.status,text:c}}async function ut(e){return{url:(await Se({...e.runtime,stateDir:e.stateDir})).url,token:Yt(ie(e.stateDir,"token"),"utf8").trim()}}function vo(e,t){let n=N();if(!n.apiKey||Re(n.apiUrl)!==e||Gt(n.apiKey)!==t.keyFingerprint)throw new T(`the attach in progress belongs to another login (its key is no longer the stored credential for ${e}); run \`contextq attach --restart\` to start over`);return n.apiKey}async function ri(e){let t=e.log??(l=>console.log(l)),n=e.fetchImpl??fetch,o=e.stateDir??U(),r=Re(e.cloudUrl),s=dt(o);if(s&&e.restart){if(Ee(s,"freezing"))throw new T("the attach already switched or is switching; finish it or run `contextq attach --abort` first");it(Ae(o),{force:!0}),s=null}if(s&&s.cloudUrl!==r)throw new T(`an attach to ${s.cloudUrl} is in progress; resume it with --url ${s.cloudUrl}, or run \`contextq attach --restart\``);s&&s.state==="login_pending"&&(s=null);let i=await ut({stateDir:o,runtime:e.runtime}),c;if(s)c=vo(r,s),t(`[info]   resuming attach ${s.attachId} at ${s.state}`);else{s={version:1,attachId:Zs(),cloudUrl:r,tenantId:null,keyFingerprint:null,state:"login_pending",workspaceMap:{},acked:{},denied:{},leaveDenied:!!e.leaveDenied,consent:{ping:null},startedAt:new Date().toISOString(),updatedAt:new Date().toISOString()},P(o,s);try{c=await e.login();let l=await at(n,r,c,"GET","/api/workspaces");if(l.status!==200)throw new T(`${r} did not accept the approved key (HTTP ${l.status}); nothing was changed`)}catch(l){throw it(Ae(o),{force:!0}),l}M({explicitKey:c,ambientVarName:null,ambientKey:"",apiUrl:r}),s={...s,state:"authenticated",keyFingerprint:Gt(c)},P(o,s),t(`[check]  signed in to ${r}`)}if(e.leaveDenied&&(s.leaveDenied=!0),!Ee(s,"workspaces_mapped")){let{workspaces:l}=await Pe(n,i,"GET","/workspaces");for(let d of l){if(d.contexts===0||s.workspaceMap[d.slug])continue;let u="global";if(d.slug!=="global"){let f=await at(n,r,c,"POST","/api/workspaces/ensure",{name:d.slug,slug:d.slug});if(f.status!==200&&f.status!==201)throw new T(`could not ensure workspace ${d.slug} on ${r} (HTTP ${f.status}); run \`contextq attach\` again to resume`);let p=JSON.parse(f.text);if(typeof p.tenantId=="number"){if(s.tenantId!==null&&s.tenantId!==p.tenantId)throw new T(`the account at ${r} is not the one this attach started with; run \`contextq attach --restart\``);s.tenantId=p.tenantId}u=p.slug}await Pe(n,i,"PUT","/sync/workspace-map",{local:d.slug,cloud:u}),s.workspaceMap[d.slug]=u,P(o,s),t(`[map]    ${d.slug} -> ${u}`)}s.state="workspaces_mapped",P(o,s)}if(!Ee(s,"transferred")||s.state==="transfer_blocked"){s.state="transferring",P(o,s);let l=Number.POSITIVE_INFINITY;for(;;){let d=await Pe(n,i,"POST","/sync/push",{parentUrl:r,apiKey:c,...e.batchMaxContexts?{batchMaxContexts:e.batchMaxContexts}:{}});for(let f of d.refs)f.outcome==="accepted"&&typeof f.cloudId=="number"?(s.acked[f.ref]=f.cloudId,delete s.denied[f.ref]):(f.outcome==="denied"||f.outcome==="too_large")&&(s.denied[f.ref]=f.reason??f.outcome);if(P(o,s),d.failures.length>0)throw new T(`the transfer stopped: ${d.failures[0].error}; run \`contextq attach\` again to resume (nothing is sent twice)`);if(d.pending-(s.leaveDenied?Object.keys(s.denied).length:0)<=0)break;if(d.pending>=l||Object.keys(s.denied).length>=d.pending){s.state="transfer_blocked",P(o,s);let f=Object.entries(s.denied).map(([p,g])=>`  ${p}: ${g}`).join(`
+`);throw new T(`${d.pending} note(s) were refused by ${r}:
+${f}
+Edit or delete them locally and run \`contextq attach\` again, or pass --leave-denied to keep them local-only`)}l=d.pending}s.state="transferred",P(o,s),t(`[push]   ${Object.keys(s.acked).length} note(s) are in ${r}`)}return s}function Te(e){return ie(e,"attach-binding-before.json")}function si(e){return e instanceof ct}async function lt(e,t,n,o){await Pe(e,t,"PUT","/sync/write-lock",{lock:n,...o?{attachedTo:o}:{}})}async function rt(e,t,n,o,r){let{restorePlugin:s,readPluginState:i}=await Promise.resolve().then(()=>(nt(),Qt)),{appendBinding:c}=await Promise.resolve().then(()=>(se(),_e)),l=e.fetchImpl??fetch,d=e.env??process.env,u=[],f=ie(o,"plugin-config.backup.json"),p=i(d);if(p.installed&&p.apiUrl&&Re(p.apiUrl)!==Re(n.url)&&st(f)){let g=s(f,{apiUrl:n.url,apiKey:n.token},d);u.push(g.status==="failed"?`plugin NOT restored: ${g.reason}`:"plugin points at the local server again")}if(e.repoRoot&&st(Te(o))){let g=JSON.parse(Yt(Te(o),"utf8")),h=[];g.mode&&h.push(["mode",g.mode]),g.workspace&&h.push(["workspace",g.workspace]),h.length>0&&c(e.repoRoot,h),u.push("repo binding restored")}throw await lt(l,n,null),t.state="transferred",P(o,t),new T(`${r}; rolled back (${[...u,"local writes unlocked"].join(", ")}). Run \`contextq attach\` again to retry.`)}async function ii(e){let t=e.log??(h=>console.log(h)),n=e.fetchImpl??fetch,o=e.env??process.env,r=e.stateDir??U(),s=Re(e.cloudUrl),{reconfigurePlugin:i,readPluginState:c}=await Promise.resolve().then(()=>(nt(),Qt)),{appendBinding:l,readBinding:d}=await Promise.resolve().then(()=>(se(),_e)),u=dt(r);if(!u||!Ee(u,"transferred")||u.state==="transfer_blocked")throw new T("nothing is ready to switch: run the transfer first (`contextq attach`)");if(u.state==="attached")return u;let f=await ut({stateDir:r,runtime:e.runtime}),p=vo(s,u),g=a(h=>{if(e.crashAfter===h)throw new ct(`simulated crash after ${h}`)},"crash");if(u.state==="switching"&&(t("[info]   an earlier attach stopped during the switch; redoing the switch (every step is idempotent)"),u.state="freezing",P(r,u)),u.state==="transferred"||u.state==="freezing"){u.consent={ping:e.pingConsent??u.consent.ping??!1},u.state="freezing",P(r,u),await lt(n,f,"attach"),g("freezing");let h=await Pe(n,f,"POST","/sync/push",{parentUrl:s,apiKey:p});for(let y of h.refs)y.outcome==="accepted"&&typeof y.cloudId=="number"&&(u.acked[y.ref]=y.cloudId);let w=u.leaveDenied?Object.keys(u.denied).length:0;if((h.failures.length>0||h.pending>w)&&await rt(e,u,f,r,`the final flush left ${h.pending} note(s) pending${h.failures[0]?` (${h.failures[0].error})`:""}`),u.state="switching",P(r,u),e.repoRoot&&!st(Te(r))){let y=d(e.repoRoot),v={mode:y?.mode??null,workspace:y?.workspace??null};xo(Te(r),`${JSON.stringify(v)}
+`,{mode:384})}if(c(o).installed){let y=i({target:{apiUrl:s,apiKey:p},journalPath:ie(r,"plugin-config.backup.json"),previousKeySource:"local-token",env:o});y.status==="failed"&&await rt(e,u,f,r,`switching the plugin failed: ${y.reason}`),t(`[rotate] plugin -> ${s}`)}else t("[info]   no installed ContextQ plugin in this Claude Code profile; only the repo binding switches");if(g("switching"),e.repoRoot){let v=d(e.repoRoot)?.workspace??"global",k=u.workspaceMap[v]??v;l(e.repoRoot,[["mode","cloud"],["workspace",k]]);for(let m of["bound-host","local-ids.json"])it(ie(e.repoRoot,".contextq","cache",m),{force:!0});t(`[bind]   .contextq/config.json -> mode=cloud workspace=${k}`)}u.state="verifying",P(r,u)}if(u.state==="verifying"){let h=e.repoRoot?d(e.repoRoot)?.workspace??"global":"global",w=await at(n,s,p,"POST","/api/agent/boot",{agent:"contextq-attach",workspace:h}),x=Object.values(u.acked)[0],y=x===void 0?{status:200,text:""}:await at(n,s,p,"GET",`/api/contexts/${x}`),v=w.status===200&&/"mode"\s*:\s*"local"/.test(w.text);(w.status!==200||v||y.status!==200)&&await rt(e,u,f,r,`the cloud did not verify (boot HTTP ${w.status}${v?", still local":""}, read HTTP ${y.status})`),await lt(n,f,"attached",s),u.state="attached",P(r,u),it(Te(r),{force:!0}),t(`[check]  ${s} answers boot and reads an imported note`)}return u}async function ai(e){let t=e.stateDir??U(),n=dt(t);if(!n)return"no attach in progress";if(n.state==="attached")return"the attach already finished; nothing to abort";let o=await ut({stateDir:t,runtime:e.runtime});if(["freezing","switching","verifying"].includes(n.state))try{await rt(e,n,o,t,"aborted")}catch(r){return r.message}return await lt(e.fetchImpl??fetch,o,null),`attach left at ${n.state}; local writes are unlocked`}var T,ko,ct,$o=C(()=>{"use strict";Ce();G();T=class extends Error{static{a(this,"AttachError")}constructor(t){super(t),this.name="AttachError"}},ko=["login_pending","authenticated","workspaces_mapped","transferring","transfer_blocked","transferred","freezing","switching","verifying","attached"];a(Ee,"reached");a(Ae,"journalPath");a(dt,"readJournal");a(P,"writeJournal");a(Gt,"fingerprint");a(Re,"normalizeUrl");a(Pe,"localJson");a(at,"cloudCall");a(ut,"ensureLocalServer");a(vo,"storedKeyFor");a(ri,"attachTransfer");a(Te,"bindingFile");ct=class extends Error{static{a(this,"SimulatedCrash")}};a(si,"isSimulatedCrash");a(lt,"setLock");a(rt,"rollback");a(ii,"attachSwitch");a(ai,"abortAttach")});var Co={};de(Co,{formatHuman:()=>bi,runDoctor:()=>vi});import{randomUUID as ci}from"crypto";import{existsSync as li,readFileSync as di}from"fs";import{homedir as ui}from"os";import{join as Wt}from"path";import{parse as pi}from"smol-toml";function j(e){try{return di(e,"utf-8")}catch{return null}}function pt(e){let t=e.startsWith("sk_live_")?"sk_live_":e.startsWith("ctq_local_")?"ctq_local_":null;return t?`prefix="${t}" length=${e.length}`:`unrecognized format length=${e.length}`}async function Z(e,t,n,o){let r;try{r=await fetch(t,{method:e,headers:{...n?{Authorization:`Bearer ${n}`}:{},...o!==void 0?{"content-type":"application/json"}:{}},...o!==void 0?{body:JSON.stringify(o)}:{},signal:AbortSignal.timeout(fi)})}catch(s){throw new Error(`could not reach ${t} (${s.message})`)}return{status:r.status,text:await r.text()}}function ce(e){try{return e.trim()===""?null:JSON.parse(e)}catch{return null}}function So(e,t){if(!e)return"";let n=e[t];if(typeof n=="string")return n;let o=e._entries;if(!Array.isArray(o))return"";let r=null;for(let s of o){if(s?.key!==t||typeof s.value!="string")continue;let i=typeof s.seq=="number"?s.seq:0;(!r||i>=r.seq)&&(r={seq:i,value:s.value})}return r?.value??""}function gi(e){for(let t of e){let n=j(t);if(!n)continue;let o=/hook boot[^"\n]*--workspace\s+'?([a-z0-9][a-z0-9_-]{0,63})'?/i.exec(n);if(o)return o[1]}return""}async function hi(e,t,n,o){let{root:r}=ge(e),s=null,i;try{s=ot(r)}catch(g){i=g.message}let c=[Le(r),Me(r),...["gemini","cursor","copilot"].map(g=>Be(g,n,t))],l=(o||So(s,"workspace")||gi(c)).toLowerCase();if(So(s,"mode")==="local"){let g=U(t),h=await oe({stateDir:g}),w=Wt(g,"token"),x=li(w)?(j(w)??"").trim():"";return{mode:"local",apiUrl:h.running&&h.url?h.url:"",apiKey:x,keySource:x?"local token file":"none",workspace:l,bindingError:i,root:r}}let{apiKey:d,apiUrl:u}=ke(t),f=u||ae,p=t.CONTEXT_API_KEY??t.CTQ_API_KEY?`env ${t.CONTEXT_API_KEY?"CONTEXT_API_KEY":"CTQ_API_KEY"}`:d?"credential file":"none";return{mode:"cloud",apiUrl:f,apiKey:d,keySource:p,workspace:l,bindingError:i,root:r}}function zt(e){let t=j(e);return t===null?{present:!1,reason:`no hook file at ${e}`}:t.includes("contextq")&&t.includes("hook boot")?{present:!0,reason:`contextq boot hook present in ${e}`}:{present:!1,reason:`${e} exists but holds no contextq boot hook`}}function mi(e,t,n,o){let r=ft(e,t,n),s=j(r);if(s===null)return{pass:!1,detail:`no MCP entry: ${r} has no contextq server`};let i=ce(s);if(!i||typeof i!="object"||!i.mcpServers||typeof i.mcpServers!="object")return{pass:!1,detail:`${r} is not valid JSON or has no mcpServers object`};let c=i.mcpServers.contextq;if(!c||typeof c!="object")return{pass:!1,detail:`no MCP entry: ${r} has no contextq server`};let l=c.httpUrl??c.url;return l===$(o)?{pass:!0,detail:`contextq entry in ${r} points at ${$(o)}`}:{pass:!1,detail:`contextq entry in ${r} points at ${typeof l=="string"?l:"an unknown URL"}, not ${$(o)}`}}function wi(e,t,n){let o=wt(e,t),r=j(o),s=r===null?null:ce(r),i=s&&typeof s=="object"?yt(s):null;return i?i.url===$(n)?{pass:!0,missing:!1,detail:`contextq entry in ${o} points at ${$(n)}`}:{pass:!1,missing:!1,detail:`contextq entry in ${o} points at ${typeof i.url=="string"?i.url:"an unknown URL"}, not ${$(n)}`}:{pass:!1,missing:!0,detail:`no contextq server in ${o}`}}function yi(e,t){let n=j(Wt(e,".claude","settings.json"));if(n!==null&&n.includes(_))return{pass:!0,detail:`${_} enabled at project scope (endpoint lives in Claude Code's store)`,viaPlugin:!0};let o=Ct(e),r=j(o);if(r===null)return{pass:!1,detail:`no MCP entry: ${o} has no contextq server`,viaPlugin:!1};let c=ce(r)?.mcpServers?.contextq;if(!c||typeof c!="object")return{pass:!1,detail:`no MCP entry: ${o} has no contextq server`,viaPlugin:!1};let l=c.env,d=c.url??l?.CONTEXT_API_URL;if(typeof d=="string"&&(d===t||/^\$\{[^}]*\}$/.test(d))){let u=d===t?`points at ${t}`:"uses a ${VAR} placeholder (key and URL resolve from the environment or credential file)";return{pass:!0,detail:`contextq entry in ${o} ${u}`,viaPlugin:!1}}return{pass:!1,detail:`contextq entry in ${o} points at ${typeof d=="string"?d:"an unknown URL"}, not ${t}`,viaPlugin:!1}}function ki(e,t){let n=Et(e),o=j(n);if(o===null)return{pass:!1,detail:`no MCP entry: ${n} has no mcp_servers.contextq`};let r;try{r=pi(o)}catch(c){return{pass:!1,detail:`${n} is not valid TOML (${c.message.split(`
+`)[0]}); left untouched`}}let i=r.mcp_servers?.contextq;return!i||typeof i!="object"?{pass:!1,detail:`no MCP entry: ${n} has no mcp_servers.contextq`}:i.url===$(t)?{pass:!0,detail:`mcp_servers.contextq in ${n} points at ${$(t)}`}:{pass:!1,detail:`mcp_servers.contextq in ${n} points at ${typeof i.url=="string"?i.url:"an unknown URL"}, not ${$(t)}`}}function xi(e){let t=j(Wt(e,".claude","settings.json"));if(t!==null&&t.includes(_))return{pass:!0,detail:`${_} carries the lifecycle hooks`,viaPlugin:!0};let n=zt(Le(e));return{pass:n.present,detail:n.reason,viaPlugin:!1}}async function vi(e){let t=e.cwd??process.cwd(),n=e.homeDir??ui(),o=e.env??process.env,{surfaces:r}=ge(t),s=r.filter(p=>p!=="desktop"),i=await hi(t,o,n,e.workspace),c=[],l=a(p=>c.push(p),"push");if(!i.apiUrl)l({host:null,step:"endpoint",status:"fail",detail:"the repo is bound to local mode but the local server is not running",fix:"contextq local start"});else try{let p=await Z("GET",`${i.apiUrl.replace(/\/+$/,"")}/health`,"");p.status===200?l({host:null,step:"endpoint",status:"pass",detail:`${i.apiUrl} answers its health route (HTTP 200)`}):l({host:null,step:"endpoint",status:"fail",detail:`${i.apiUrl}/health answered HTTP ${p.status}`,fix:i.mode==="local"?"contextq local start":`check that the server is up and --url points at it (now: ${i.apiUrl})`})}catch(p){l({host:null,step:"endpoint",status:"fail",detail:p.message,fix:i.mode==="local"?"contextq local start":`check that the server is up and --url points at it (now: ${i.apiUrl})`})}let d=!1;if(!i.apiKey)l({host:null,step:"credential",status:"fail",detail:i.mode==="local"?"no local token found in the edge state dir":"no API key found in CONTEXT_API_KEY/CTQ_API_KEY or the credential file",fix:i.mode==="local"?"contextq local start":"contextq init (or contextq login) to approve this machine"});else{let p=i.mode==="local"?`${i.apiUrl}/workspaces`:`${i.apiUrl.replace(/\/+$/,"")}/api/workspaces`;try{let g=await Z("GET",p,i.apiKey);g.status===200?(d=!0,l({host:null,step:"credential",status:"pass",detail:`key ${pt(i.apiKey)} from ${i.keySource} accepted by the server`})):g.status===401||g.status===403?l({host:null,step:"credential",status:"fail",detail:`the server refused the key ${pt(i.apiKey)} (HTTP ${g.status})`,fix:"contextq init --key <new key> (or contextq login) to replace it"}):l({host:null,step:"credential",status:"fail",detail:`checking the key ${pt(i.apiKey)} failed (HTTP ${g.status})`,fix:i.mode==="local"?"contextq local start":`check that the server is up (now: ${i.apiUrl})`})}catch(g){l({host:null,step:"credential",status:"fail",detail:`could not check the key ${pt(i.apiKey)}: ${g.message}`,fix:i.mode==="local"?"contextq local start":`check that the server is up (now: ${i.apiUrl})`})}}let u=!1;if(i.bindingError)l({host:null,step:"workspace",status:"fail",detail:`.contextq/config.json: ${i.bindingError}`,fix:"fix or delete .contextq/config.json, then contextq init --workspace <slug>"});else if(!i.workspace)l({host:null,step:"workspace",status:"fail",detail:`no workspace bound: ${i.root} has no workspace in .contextq/config.json and no wired boot hook names one`,fix:"contextq init --workspace <slug>, or contextq doctor --workspace <slug>"});else if(!d)l({host:null,step:"workspace",status:"skip",detail:`blocked by the credential step; workspace "${i.workspace}" not checked`});else{let p=i.apiUrl.replace(/\/+$/,"");try{let g=i.mode==="local"?`${p}/workspaces`:`${p}/api/workspaces`,h=await Z("GET",g,i.apiKey);if(h.status!==200)l({host:null,step:"workspace",status:"fail",detail:`listing workspaces failed (HTTP ${h.status})`,fix:"fix the credential step above first"});else{let w=ce(h.text),x=Array.isArray(w)?w:Array.isArray(w?.workspaces)?w.workspaces:[];if(!new Set(x.map(v=>typeof v?.slug=="string"?v.slug.toLowerCase():"")).has(i.workspace))u=!0,l({host:null,step:"workspace",status:"pass",detail:`workspace "${i.workspace}" does not exist yet; the first save creates it (check the slug if you expected existing memory there)`});else{let v=i.mode==="local"?`${p}/contexts?workspace=${encodeURIComponent(i.workspace)}&limit=1`:`${p}/api/contexts?workspace=${encodeURIComponent(i.workspace)}&limit=1`,k=await Z("GET",v,i.apiKey);k.status===200?(u=!0,l({host:null,step:"workspace",status:"pass",detail:`workspace "${i.workspace}" exists and the key can read it`})):l({host:null,step:"workspace",status:"fail",detail:`workspace "${i.workspace}" exists but the key cannot read it (HTTP ${k.status})`,fix:"check the key has read scope for this workspace, or run contextq init --key <new key>"})}}}catch(g){l({host:null,step:"workspace",status:"fail",detail:g.message,fix:i.mode==="local"?"contextq local start":`check that the server is up (now: ${i.apiUrl})`})}}for(let p of s){if(p==="opencode"){let w=wi(n,o,i.apiUrl||ae);if(w.missing){l({host:p,step:"",status:"skip",detail:"not wired",fix:"contextq init --surface opencode"});continue}l(w.pass?{host:p,step:"mcp config",status:"pass",detail:w.detail}:{host:p,step:"mcp config",status:"fail",detail:w.detail,fix:"contextq init --surface opencode"}),l({host:p,step:"boot hook",status:"skip",detail:"contextq init wires no OpenCode boot hook; memory reaches OpenCode through the MCP tools"});continue}let g,h;if(p==="claude-code")g=yi(i.root,i.apiUrl||ae),h=xi(i.root);else if(p==="codex"){g=ki(i.root,i.apiUrl||ae);let w=zt(Me(i.root));h={pass:w.present,detail:w.reason}}else{g=mi(p,n,o,i.apiUrl||ae);let w=zt(Be(p,n,o));h={pass:w.present,detail:w.reason}}if(!g.pass&&!h.pass){l({host:p,step:"",status:"skip",detail:"not wired",fix:`contextq init --surface ${p}`});continue}g.pass?l({host:p,step:"mcp config",status:"pass",detail:g.detail}):l({host:p,step:"mcp config",status:"fail",detail:g.detail,fix:`contextq init --surface ${p}`}),h.pass?l({host:p,step:"boot hook",status:"pass",detail:h.detail}):l({host:p,step:"boot hook",status:"fail",detail:h.detail,fix:`contextq init --surface ${p}`})}if(!d||!u)l({host:null,step:"round trip",status:"skip",detail:`blocked by ${d?"the workspace step":"the credential step"}; no probe note was saved`});else{let p=i.apiUrl.replace(/\/+$/,""),g=`doctor-probe-${ci().slice(0,8)}`,h=null,w=null;try{let k=i.mode==="local"?{workspace:i.workspace,type:"reference",name:`doctor probe ${g}`,content:`doctor round-trip probe ${g} -- safe to delete`,tags:["doctor"]}:{name:`doctor probe ${g}`,description:`contextq doctor round-trip probe ${g}`,content:`doctor round-trip probe ${g} -- safe to delete`,type:"reference",workspace:i.workspace,tags:["doctor"]},m=await Z("POST",i.mode==="local"?`${p}/contexts`:`${p}/api/contexts`,i.apiKey,k);if(m.status===200||m.status===201){let b=ce(m.text);typeof b?.id=="number"||typeof b?.id=="string"?h=b.id:typeof b?.ref=="string"?h=b.ref:w="the server answered 200 but returned no id or ref"}else w=`save failed (HTTP ${m.status}): ${m.text.slice(0,160)}`}catch(k){w=`save failed: ${k.message}`}let x=!1;if(h!==null)try{let k=await Z("POST",i.mode==="local"?`${p}/search`:`${p}/api/search`,i.apiKey,{query:g,workspace:i.workspace,limit:5});if(k.status===200){let m=ce(k.text);x=(Array.isArray(m?.results)?m.results:[]).some(S=>JSON.stringify(S).includes(g))}}catch{x=!1}let y=null,v=i.mode!=="local";if(h!==null&&v)try{let k=i.mode==="local"?`${p}/contexts/${encodeURIComponent(String(h))}`:`${p}/api/contexts/${encodeURIComponent(String(h))}`,m=await Z("DELETE",k,i.apiKey);m.status!==200&&m.status!==204&&(y=`delete failed (HTTP ${m.status}); note ${String(h)} left in workspace "${i.workspace}"`)}catch(k){y=`delete failed: ${k.message}; note ${String(h)} left in workspace "${i.workspace}"`}if(w!==null)l({host:null,step:"round trip",status:"fail",detail:w,fix:"fix the credential and workspace steps above first"});else if(x)l(y!==null?{host:null,step:"round trip",status:"fail",detail:`saved and recalled, but ${y}`,fix:i.mode==="local"?"the local server has no note-delete API; remove the probe note after it gains one":"delete the probe note by hand, then re-run contextq doctor"}:v?{host:null,step:"round trip",status:"pass",detail:`saved one note tagged doctor into "${i.workspace}", recalled it by search, then deleted it`}:{host:null,step:"round trip",status:"pass",detail:`saved one note tagged doctor into "${i.workspace}" and recalled it by search; the local server has no delete route, so note ${String(h)} stays`});else{let k=y?` ${y}`:" (the probe note was deleted afterwards)";l({host:null,step:"round trip",status:"fail",detail:`recall failed: the saved probe note was not returned by search for "${g}".${k}`,fix:"check search is healthy (ES optional, PG tsvector fallback), then re-run contextq doctor"})}}let f=c.every(p=>p.status!=="fail");return{mode:i.mode,apiUrl:i.apiUrl||ae,workspace:i.workspace,lines:c,ok:f}}function bi(e){return e.lines.map(t=>{if(t.status==="skip")return t.host?t.fix?`SKIP ${t.host}: ${t.detail} (run ${t.fix})`:`SKIP ${t.host} ${t.step}: ${t.detail}`:`SKIP ${t.step}: ${t.detail}`;let n=t.host?`${t.host} `:"";return t.status==="pass"?`PASS ${n}${t.step} (${t.detail})`:`FAIL ${n}${t.step}: ${t.detail}. Fix: ${t.fix??"see above"}`})}var ae,fi,_o=C(()=>{"use strict";xt();Ge();_t();Pt();Y();Rt();se();Ce();Fe();me();Ne();ae="https://app.contextq.dev",fi=8e3;a(j,"readText");a(pt,"describeKey");a(Z,"http");a(ce,"parseJson");a(So,"bindingValue");a(gi,"workspaceFromHooks");a(hi,"resolveTarget");a(zt,"checkHookFile");a(mi,"checkMcpEntry");a(wi,"checkOpencodeMcp");a(yi,"checkClaudeMcp");a(ki,"checkCodexMcp");a(xi,"checkClaudeHook");a(vi,"runDoctor");a(bi,"formatHuman")});xt();G();import{homedir as Zt}from"os";import{basename as Eo}from"path";G();var mn="the provided API key does not look valid (expected sk_live_<40 hex chars>)",ar="npx @contextq/cli init --key <sk_live_...>";function wn(e){return e.status===401||e.status===403}a(wn,"isRefused");function yn(e,t){switch(e){case"explicit":return"The --key";case"ambient":return`The ${t??"environment"}`;case"stored":return`The stored (${A()})`;case"prompt":return"The typed";case"device":return"The browser-approved"}}a(yn,"describe");async function kn(e){let t=N(),n=St()?t.apiKey:"",o,r;if(e.explicitKey){if(!I.test(e.explicitKey))throw new Error(mn);o=e.explicitKey,r="explicit"}else if(n)o=n,r="stored";else if(e.ambientKey){if(!I.test(e.ambientKey))throw new Error(mn);o=e.ambientKey,r="ambient"}else if(e.interactive&&e.deviceLogin)o=await e.deviceLogin(),r="device";else{let c=e.interactive?await e.prompt("ContextQ API key (sk_live_...): "):"";if(!I.test(c))throw new Error("no valid API key available (expected sk_live_<40 hex chars>). Run `contextq login` from an interactive terminal to approve this machine in the browser, set CONTEXT_API_KEY, or pass --key.");o=c,r="prompt"}let s=await e.verify(o);if(wn(s)){let c=`${yn(r,e.ambientVarName)} API key was refused by ${e.apiUrl} (HTTP ${s.status})`;if(!e.interactive)throw new Error(`${c}; nothing was written. Re-run with a working key: ${ar}`);if(e.deviceLogin)console.log(`${c}. Approve this machine in the browser to replace it.`),o=await e.deviceLogin(),r="device";else{let l=await e.prompt(`${c}. Paste a new key (sk_live_...): `);if(!I.test(l))throw new Error(`${c}, and no valid replacement was entered; nothing was written.`);o=l,r="prompt"}if(s=await e.verify(o),wn(s))throw new Error(`${yn(r,null)} API key was refused by ${e.apiUrl} (HTTP ${s.status}); nothing was written.`)}if(r==="device"&&!s.ok){let c=s.status?`HTTP ${s.status}`:s.error??"unknown error";throw new Error(`could not verify the browser-approved key against ${e.apiUrl} (${c}); nothing was written. Run \`contextq login\` again once the server answers.`)}return{decision:M({explicitKey:r==="explicit"||r==="prompt"||r==="device"?o:void 0,ambientVarName:e.ambientVarName,ambientKey:e.ambientKey,apiUrl:e.apiUrl}),verify:s,source:r}}a(kn,"resolveVerifiedCredentials");G();import{hostname as cr}from"os";var E=class extends Error{static{a(this,"DeviceLoginError")}code;constructor(t,n){super(n),this.name="DeviceLoginError",this.code=t}},lr=5,dr=5,ur=600;function pr(e,t){return new Promise((n,o)=>{if(t?.aborted)return o(new E("cancelled","login cancelled; nothing was written"));let r=setTimeout(()=>{t?.removeEventListener("abort",s),n()},e),s=a(()=>{clearTimeout(r),o(new E("cancelled","login cancelled; nothing was written"))},"onAbort");t?.addEventListener("abort",s,{once:!0})})}a(pr,"defaultSleep");async function xn(e){try{return await e.json()}catch{return null}}a(xn,"readJson");function vn(e,t){return typeof e=="number"&&Number.isInteger(e)&&e>0?e:t}a(vn,"positiveInt");async function He(e){let t=e.fetchImpl??fetch,n=e.sleep??pr,o=e.now??Date.now,r=e.apiUrl.replace(/\/+$/,""),s=a(()=>new E("cancelled","login cancelled; nothing was written"),"cancelled"),i;try{i=await t(`${r}/api/auth/device/start`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({client_name:e.clientName??"@contextq/cli",hostname:e.hostname??cr()}),signal:e.signal})}catch(h){throw e.signal?.aborted?s():new E("unreachable",`could not reach ${r}/api/auth/device/start (${h.message})`)}let c=i.ok?await xn(i):null,l=typeof c?.device_code=="string"?c.device_code:"",d=typeof c?.user_code=="string"?c.user_code:"";if(!l||!d)throw new E("protocol",`${r} did not start a device login (HTTP ${i.status}); is this a ContextQ server?`);let u=typeof c?.verification_uri_complete=="string"&&c.verification_uri_complete||typeof c?.verification_uri=="string"&&c.verification_uri||`${r}/link`,f=vn(c?.expires_in,ur),p=vn(c?.interval,dr);e.onPrompt({verificationUri:u,userCode:d,expiresInSeconds:f});let g=o()+f*1e3;for(;;){if(o()>=g)throw new E("expired_token","the approval window expired before this machine was approved; nothing was written");if(await n(p*1e3,e.signal),e.signal?.aborted)throw s();let h;try{h=await t(`${r}/api/auth/device/token`,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({device_code:l}),signal:e.signal})}catch{if(e.signal?.aborted)throw s();continue}let w=await xn(h);if(h.status===200){let y=w?.api_key;if(typeof y=="string"&&I.test(y))return y;throw new E("protocol","the token endpoint answered 200 without a well-formed API key; nothing was written")}let x=typeof w?.error=="string"?w.error:"";switch(x){case"authorization_pending":continue;case"slow_down":p+=lr;continue;case"access_denied":throw new E("access_denied","the request was denied in the browser; nothing was written");case"expired_token":throw new E("expired_token","the device code expired; run the command again");case"invalid_grant":throw new E("invalid_grant","the server rejected the device code; run the command again");default:if(h.status>=500||h.status===429)continue;throw new E("protocol",`unexpected answer from the token endpoint (HTTP ${h.status}${x?`, ${x}`:""})`)}}}a(He,"deviceLogin");_t();Y();Ne();Pt();Rt();me();Fe();Ge();Ge();import{existsSync as os}from"fs";import{basename as rs,join as ss}from"path";var Ut=["end","compact"];function is(e){let t;try{t=JSON.parse(e).capture_scope}catch{return"metadata"}if(t==null)return"summary";let n=String(t).trim().toLowerCase();return n===""||n==="summary"||n==="auto"?"summary":n==="off"?"off":"metadata"}a(is,"localCaptureScope");function as(e){if(!e||e.trim()==="")return"";try{let t=JSON.parse(e),n=[t.sessionId,t.session_id,t.conversation_id].find(o=>typeof o=="string"&&o!=="");return typeof n=="string"?n.replace(/[^a-zA-Z0-9]/g,"").slice(0,12):""}catch{return""}}a(as,"hostSessionSuffix");function cs(e){return String(e.split(`
+`).filter(t=>t.trim()!=="").length)}a(cs,"countLines");async function Xn(e){let t=Dt(e.cwd,e.stdinText),n=q(t,["rev-parse","--show-toplevel"]);if(!n)return{outcome:"skipped",detail:"not inside a git repository"};if(e.requireConfig&&!os(ss(n,".contextq","config.json")))return{outcome:"skipped",detail:"repo has no .contextq/config.json"};let o=qt(n),r=is(o);if(r==="off")return{outcome:"skipped",detail:"capture_scope is off"};let{apiKey:s,apiUrl:i}=ke(e.env);if(!s)return{outcome:"skipped",detail:"no API key (run npx @contextq/cli init or login)"};let c=q(n,["status","--porcelain"]),l=new URLSearchParams({config:o,reason:e.reason,final:e.reason==="end"?"1":"0",project:rs(n),git_root:n,branch:q(n,["branch","--show-current"]),head_sha:q(n,["rev-parse","--short","HEAD"]),dirty_count:cs(c),session_suffix:as(e.stdinText),synthesis_status:"degraded",synthesis_reason:`no_synthesis_on_${e.format}`}),d=q(n,["rev-list","--count","@{upstream}..HEAD"]);/^\d+$/.test(d)&&l.set("upstream_delta",d),r==="summary"&&(l.set("recent_commits",q(n,["log","--oneline","-5"])),l.set("changed_paths",c.split(`
+`).slice(0,20).join(`
+`)));let u=e.fetchImpl??fetch;try{let f=await u(`${i}/api/agent/hooks/snapshot`,{method:"POST",headers:{Authorization:`Bearer ${s}`,Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:l.toString(),signal:AbortSignal.timeout(e.timeoutMs??1e4)});return await f.text(),f.status===204?{outcome:"skipped",detail:"server kept a better handoff or capture is off",status:f.status}:f.status>=200&&f.status<300?{outcome:"sent",detail:`snapshot (${e.reason}) saved`,status:f.status}:{outcome:"failed",detail:`${i} answered HTTP ${f.status}`,status:f.status}}catch(f){return{outcome:"failed",detail:`${i} unreachable (${f.message})`}}}a(Xn,"runHookSnapshot");import{appendFileSync as ls,existsSync as Yn,readFileSync as ds}from"fs";import{execFileSync as us}from"child_process";import{join as jt}from"path";var ps=[".contextq/tasks/TASKS.md",".contextq/tasks/tasks/T*.md",".contextq/tasks/.render*",".contextq/tasks/status.log"];function fs(e){try{return us("git",["-C",e,"ls-files","--error-unmatch","--",".contextq/tasks/TASKS.md"],{stdio:"ignore"}),!0}catch{return!1}}a(fs,"manifestTracked");function Gn(e){let t=jt(e,".gitignore");if(!Yn(jt(e,".git")))return{path:t,action:"skipped",detail:"not a git repo -- no board render to keep out of commits"};if(fs(e))return{path:jt(e,".contextq","tasks","TASKS.md"),action:"skipped",detail:"this repo tracks a git-sourced board -- left untouched"};let n=Yn(t)?ds(t,"utf-8"):"",o=new Set(n.split(`
+`).map(i=>i.trim())),r=ps.filter(i=>!o.has(i));if(r.length===0)return{path:t,action:"skipped",detail:"board render already gitignored"};let s=n===""||n.endsWith(`
 `)?"":`
-`;return hr(t,`${i}${r.join(`
+`;return ls(t,`${s}${r.join(`
 `)}
-`),{path:t,action:"created",detail:"gitignored the task board render (.contextq/tasks/TASKS.md is a read-only copy of the cloud board, never committed)"}}s(un,"initTasksDir");function pn(e){console.log(`
+`),{path:t,action:"created",detail:"gitignored the task board render (.contextq/tasks/TASKS.md is a read-only copy of the cloud board, never committed)"}}a(Gn,"initTasksDir");function zn(e){console.log(`
 No git repo or existing Claude Code project found here, so there is nothing on
 disk to scaffold. For Claude Desktop, Cowork, or any other MCP-capable client
 that reads a manually-edited config file, connect ContextQ in 3 steps:
@@ -71,10 +76,10 @@ There is no auto-connect for Desktop/Cowork today -- these clients only read
 their config file on start, so step 2 has to be a manual paste. Re-run
 "npx @contextq/cli init" inside a git repo (or an existing Claude Code project) to
 get the automatic .mcp.json + hook + task-manifest scaffolding instead.
-`)}s(pn,"printDesktopGuide");async function gn(e){return process.stdin.isTTY?new Promise(t=>{let n=process.stdin,o=process.stdout;o.write(e);let r="",i=s(c=>{let a=c.toString("utf8");switch(a){case`
-`:case"\r":case"":n.setRawMode?.(!1),n.pause(),n.removeListener("data",i),o.write(`
+`)}a(zn,"printDesktopGuide");async function Wn(e){return process.stdin.isTTY?new Promise(t=>{let n=process.stdin,o=process.stdout;o.write(e);let r="",s=a(i=>{let c=i.toString("utf8");switch(c){case`
+`:case"\r":case"":n.setRawMode?.(!1),n.pause(),n.removeListener("data",s),o.write(`
 `),t(r.trim());break;case"":o.write(`
-`),process.exit(130);break;case"\x7F":case"\b":r.length>0&&(r=r.slice(0,-1),o.write("\b \b"));break;default:r+=a,o.write("*")}},"onData");n.setRawMode?.(!0),n.resume(),n.setEncoding("utf8"),n.on("data",i)}):""}s(gn,"promptHidden");Ae();import{existsSync as ct,mkdirSync as fn,readdirSync as br,readFileSync as mn,statSync as vr,writeFileSync as Sr}from"fs";import{join as Oe}from"path";function $r(e,t){let n=new RegExp(`^ {2}${t}: "((?:[^"\\\\]|\\\\.)*)"$`,"m"),o=e.match(n);return o?o[1].replace(/\\(.)/g,"$1"):null}s($r,"extractFrontmatterMetadataValue");function Cr(e){return $r(e,"cluster_key")}s(Cr,"extractClusterKey");function _r(e){if(!ct(e))return[];let t=[];for(let n of br(e)){let o=Oe(e,n);if(!vr(o).isDirectory())continue;let r=Oe(o,"SKILL.md");if(!ct(r))continue;let i=mn(r,"utf-8"),c=Cr(i);c&&t.push({folder:n,clusterKey:c})}return t}s(_r,"scanLocalSkills");function Er(e,t){return e.replace(/^name: .+$/m,`name: ${t}`)}s(Er,"withFrontmatterName");async function hn(e){fn(e.dir,{recursive:!0});let t=_r(e.dir),n=new Map(t.map(a=>[a.clusterKey,a.folder])),o=new Set(t.map(a=>a.folder)),r=await e.fetchSkills(),i={written:[],updated:[],unchanged:[],orphans:[]},c=new Set;for(let a of r){c.add(a.clusterKey);let l=n.get(a.clusterKey);l||(l=o.has(a.slug)?`${a.slug}-c${a.contextId}`:a.slug,o.add(l),n.set(a.clusterKey,l));let u=l===a.slug?a.markdown:Er(a.markdown,l),p=Oe(e.dir,l),g=Oe(p,"SKILL.md"),h=ct(g)?mn(g,"utf-8"):null;if(h===u){i.unchanged.push(l);continue}fn(p,{recursive:!0}),Sr(g,u,"utf-8"),i[h===null?"written":"updated"].push(l)}for(let a of t)c.has(a.clusterKey)||i.orphans.push(a.folder);return i}s(hn,"syncSkills");var q="https://app.contextq.dev";function mi(e){let t=e.length>0&&!e[0].startsWith("-"),n={command:t?e[0]:"",embedKey:!1,noPlugin:!1,help:!1,local:!1};for(let o=t?1:0;o<e.length;o++){let r=e[o];switch(r){case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;case"--workspace":n.workspace=e[++o];break;case"--agent":n.agent=e[++o];break;case"--embed-key":n.embedKey=!0;break;case"--no-plugin":n.noPlugin=!0;break;case"--local":n.local=!0;break;case"--port":{let i=e[++o]??"",c=/^\d+$/.test(i)?Number(i):NaN;if(!Number.isInteger(c)||c<1||c>65535)throw new Error(`invalid port "${i}"; use a number from 1 to 65535`);n.port=c;break}case"--surface":{let i=e[++o];if(i!=="claude-code"&&i!=="codex"&&!Y.includes(i))throw new Error(`--surface value "${i}" is invalid -- allowed: claude-code, codex, ${Y.join(", ")}`);n.surface=i;break}case"-h":case"--help":n.help=!0;break;default:throw new Error(`unknown argument: ${r}`)}}return n}s(mi,"parseArgs");function he(){console.log(`contextq \u2014 one-command installer for ContextQ
+`),process.exit(130);break;case"\x7F":case"\b":r.length>0&&(r=r.slice(0,-1),o.write("\b \b"));break;default:r+=c,o.write("*")}},"onData");n.setRawMode?.(!0),n.resume(),n.setEncoding("utf8"),n.on("data",s)}):""}a(Wn,"promptHidden");Xe();import{existsSync as Kt,mkdirSync as Zn,readdirSync as gs,readFileSync as eo,statSync as hs,writeFileSync as ms}from"fs";import{join as ze}from"path";function ws(e,t){let n=new RegExp(`^ {2}${t}: "((?:[^"\\\\]|\\\\.)*)"$`,"m"),o=e.match(n);return o?o[1].replace(/\\(.)/g,"$1"):null}a(ws,"extractFrontmatterMetadataValue");function ys(e){return ws(e,"cluster_key")}a(ys,"extractClusterKey");function ks(e){if(!Kt(e))return[];let t=[];for(let n of gs(e)){let o=ze(e,n);if(!hs(o).isDirectory())continue;let r=ze(o,"SKILL.md");if(!Kt(r))continue;let s=eo(r,"utf-8"),i=ys(s);i&&t.push({folder:n,clusterKey:i})}return t}a(ks,"scanLocalSkills");function xs(e,t){return e.replace(/^name: .+$/m,`name: ${t}`)}a(xs,"withFrontmatterName");async function to(e){Zn(e.dir,{recursive:!0});let t=ks(e.dir),n=new Map(t.map(c=>[c.clusterKey,c.folder])),o=new Set(t.map(c=>c.folder)),r=await e.fetchSkills(),s={written:[],updated:[],unchanged:[],orphans:[]},i=new Set;for(let c of r){i.add(c.clusterKey);let d=n.get(c.clusterKey);d||(d=o.has(c.slug)?`${c.slug}-c${c.contextId}`:c.slug,o.add(d),n.set(c.clusterKey,d));let u=d===c.slug?c.markdown:xs(c.markdown,d),f=ze(e.dir,d),p=ze(f,"SKILL.md"),g=Kt(p)?eo(p,"utf-8"):null;if(g===u){s.unchanged.push(d);continue}Zn(f,{recursive:!0}),ms(p,u,"utf-8"),s[g===null?"written":"updated"].push(d)}for(let c of t)i.has(c.clusterKey)||s.orphans.push(c.folder);return s}a(to,"syncSkills");var V="https://app.contextq.dev";function $i(e){let t=e.length>0&&!e[0].startsWith("-"),n={command:t?e[0]:"",embedKey:!1,noPlugin:!1,help:!1,local:!1};for(let o=t?1:0;o<e.length;o++){let r=e[o];switch(r){case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;case"--workspace":n.workspace=e[++o];break;case"--agent":n.agent=e[++o];break;case"--embed-key":n.embedKey=!0;break;case"--no-plugin":n.noPlugin=!0;break;case"--local":n.local=!0;break;case"--port":{let s=e[++o]??"",i=/^\d+$/.test(s)?Number(s):NaN;if(!Number.isInteger(i)||i<1||i>65535)throw new Error(`invalid port "${s}"; use a number from 1 to 65535`);n.port=i;break}case"--surface":{let s=e[++o];if(s!=="claude-code"&&s!=="codex"&&s!=="opencode"&&!ee.includes(s))throw new Error(`--surface value "${s}" is invalid -- allowed: claude-code, codex, ${ee.join(", ")}, opencode`);n.surface=s;break}case"-h":case"--help":n.help=!0;break;default:throw new Error(`unknown argument: ${r}`)}}return n}a($i,"parseArgs");function Oe(){console.log(`contextq \u2014 one-command installer for ContextQ
 
 Usage:
   npx @contextq/cli login [--url <url>]
@@ -82,6 +87,7 @@ Usage:
   npx @contextq/cli init [options]
   npx @contextq/cli init --local [--workspace <slug>] [--agent <slug>] [--port <n>]
   npx @contextq/cli attach [--url <url>] [--restart] [--leave-denied] [--abort] [--key-stdin]
+  npx @contextq/cli doctor [--json] [--workspace <slug>]
 
 API key: \`login\` prints a link and a code; approve this machine in the browser and the
 key is fetched, checked against the server and saved (mode 600), never typed or pasted.
@@ -92,12 +98,12 @@ never written.
 Options:
   --key <sk_live_...>   Pass or rotate the key on the command line (visible in shell
                          history; prefer the prompt or the env var)
-  --url <url>            ContextQ API URL (default: ${q})
+  --url <url>            ContextQ API URL (default: ${V})
   --workspace <slug>     Workspace slug for the contextq boot hook (default: repo basename,
-                         sanitized). Allowed: ${Te}. Case is folded to
+                         sanitized). Allowed: ${Ve}. Case is folded to
                          lowercase automatically (workspace slugs are always lowercase).
   --agent <slug>         Agent slug for the contextq boot hook (default: repo basename,
-                         sanitized). Allowed: ${Te}.
+                         sanitized). Allowed: ${Ve}.
   --embed-key            Write the literal API key into .mcp.json instead of the
                          safer \${CONTEXT_API_KEY} placeholder (opt-in: convenience
                          vs. a secret sitting on disk)
@@ -106,11 +112,13 @@ Options:
                          plugin at project scope instead, which carries the MCP server and
                          the lifecycle hooks and keeps the key in Claude Code's own store.
   --surface <s>          Force surface detection to exactly one of: claude-code, codex,
-                         gemini, cursor, copilot. Skips autodetection entirely (default:
+                         gemini, cursor, copilot, opencode. Skips autodetection entirely (default:
                          autodetect all -- a machine can be, and often is, several at once).
                          gemini, cursor and copilot get the remote MCP server in their
                          user-level config (~/.gemini/settings.json, ~/.cursor/mcp.json,
                          ~/.copilot/mcp-config.json) with the key in the header, mode 600.
+                         opencode gets it in ~/.config/opencode/opencode.json, in the
+                         OpenCode 2 shape (mcp.servers) or the 1.x shape for an OpenCode 1 install.
   -h, --help             Show this help
 
 Usage:
@@ -128,6 +136,20 @@ Options:
   --key <sk_live_...>   API key (else CONTEXT_API_KEY/CTQ_API_KEY env, else the
                          credential file written by \`contextq init\`)
   --url <url>            ContextQ API URL (else the credential file, else
-                         CONTEXT_API_URL/CTQ_API_URL env, default: ${q})
-`)}s(he,"printHelp");function ee(e,t){return t.startsWith(`${e}/`)?t.slice(e.length+1):t}s(ee,"relative");function A(e){return{created:"[create]",added:"[add]  ",wired:"[create]",rotated:"[rotate]",skipped:"[skip] ",verified:"[check]",failed:"[check]",refused:"[refuse]"}[e]??`[${e}]`}s(A,"label");async function qn(e,t){try{let n=await fetch(`${e.replace(/\/$/,"")}/api/workspaces`,{headers:{Authorization:`Bearer ${t}`}});return{ok:n.status===200,status:n.status}}catch(n){return{ok:!1,error:n.message}}}s(qn,"verifyConnection");function kt(e){console.log(""),console.log("Approve this machine in your browser:"),console.log(`  ${e.verificationUri}`),console.log(`  code: ${e.userCode}`),console.log(`Waiting for approval (expires in ${Math.max(1,Math.round(e.expiresInSeconds/60))} min, Ctrl-C to cancel)...`)}s(kt,"printDevicePrompt");function xt(e){let t=new AbortController,n=s(()=>t.abort(),"onSigint");return process.once("SIGINT",n),e(t.signal).finally(()=>process.removeListener("SIGINT",n))}s(xt,"withSigintAbort");async function hi(e){let t=R(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||q;console.log(`ContextQ login (${n})`);let o=await xt(c=>ve({apiUrl:n,signal:c,onPrompt:kt})),r=await qn(n,o);if(!r.ok){let c=r.status?`HTTP ${r.status}`:r.error??"unknown error";throw new Error(`could not verify the approved key against ${n} (${c}); nothing was written`)}let i=U({explicitKey:o,ambientVarName:null,ambientKey:"",apiUrl:n});console.log("Approved."),console.log(i.credLine),console.log(`[check]  connected to ${n}`)}s(hi,"runLogin");async function yi(e){let t=process.cwd(),{surfaces:n,root:o}=Pt(t,{forcedSurface:e.surface});if(console.log("ContextQ init"),console.log("============="),n.length===1&&n[0]==="desktop"){console.log(`Surface detected: desktop/other (no git repo, .claude/, or .codex/ found at ${t})`),pn(e.url??q);return}console.log(`Surface(s) detected: ${n.join(", ")} (root: ${o})`);let r=R(),i=e.url||r.apiUrl||process.env.CONTEXT_API_URL||q,c=process.env.CONTEXT_API_KEY?"CONTEXT_API_KEY":process.env.CTQ_API_KEY?"CTQ_API_KEY":null,a=c?process.env[c]:"",{decision:d,verify:l}=await Dt({explicitKey:e.key,ambientVarName:c,ambientKey:a,apiUrl:i,interactive:!!process.stdin.isTTY,verify:s(m=>qn(i,m),"verify"),prompt:gn,deviceLogin:s(()=>xt(m=>ve({apiUrl:i,signal:m,onPrompt:kt})),"deviceLogin")}),u=d.apiKey;if(console.log(d.credLine),!l.ok){let m=l.status?`HTTP ${l.status}`:l.error??"unknown error";console.log(`[warn]   could not verify the key against ${i} (${m}); it was kept, re-run init once the server answers`)}let p;e.agent?p=G(e.agent,"--agent"):p=K(jn(o));let g;if(e.workspace){let m=e.workspace.toLowerCase();g=G(m,"--workspace"),m!==e.workspace&&console.log(`[info]   --workspace lowercased to match slug convention: "${e.workspace}" -> "${m}"`)}else g=K(jn(o));console.log(`[info]   agent=${p} workspace=${g}`);let h=process.env.CONTEXTQ_HOOK_RUNNER||V,f,w=!1,k=[],y=!1;if(n.includes("claude-code")){let m=on({noPlugin:e.noPlugin,legacyMcpEntry:nn(o),verifyStatus:l.status});if(!m.delegate)console.log(`[info]   ${m.reason}`);else{let v=Ee(o,i,u,q);v.status==="installed"?(w=!0,k.push("claude-code"),console.log(`${A(v.alreadyInstalled?"skipped":"added")} .claude/settings.json (${O} at project scope -- ${v.message})`)):console.log(`[info]   plugin install ${v.status}: ${v.reason} -- falling back to .mcp.json wiring`)}if(!w){f=Kt(o,i,e.embedKey,u),console.log(`${A(f.action)} ${ee(o,f.path)} (${f.detail})`),k.push("claude-code");let v=Qt(o,p,g,h);console.log(`${A(v.action)} ${ee(o,v.path)} (${v.detail})`),v.action==="refused"&&(process.exitCode=1)}let P=un(o);console.log(`${A(P.action)} ${ee(o,P.path)} (${P.detail})`)}if(n.includes("codex")){console.log(""),console.log("[info]   Codex hooks -- assumptions this install makes:"),console.log("         - Sandbox/approval: the boot hook makes an outbound HTTP call to the ContextQ"),console.log("           API. Verified empirically (codex-cli 0.146.0, `codex exec --sandbox"),console.log("           workspace-write`, no approval flag): a TRUSTED hook's outbound call is NOT"),console.log("           gated by sandbox_mode/approval_policy the way model-issued shell commands"),console.log("           are -- the real gate is hook TRUST (see the note below), not the sandbox."),console.log("           Once trusted, this should work under any sandbox_mode/approval_policy combo."),console.log("           If it still produces no injected context, `codex doctor` shows current sandbox"),console.log("           + approval state as a starting point for diagnosis."),console.log("         - Native Memories: Codex ships its own Memories feature (off by default). If you"),console.log("           turn it on, set memories.disable_on_external_context = true in config.toml (or"),console.log("           its older alias no_memories_if_mcp_or_web_search) -- otherwise a session that"),console.log("           used MCP tools (including ContextQ's own MCP server) still feeds Codex's native"),console.log("           memory extraction too, duplicating what ContextQ already captures."),console.log("");let m=Xt(o,p,g,h);if(console.log(`${A(m.action)} ${ee(o,m.path)} (${m.detail})`),m.action==="refused"&&(process.exitCode=1),!l.ok)console.log("[info]   Codex MCP: not wired -- the key did not verify, and it would be written into .codex/config.toml");else{let P=Ft(o,i,u);console.log(`${A(P.action)} ${ee(o,P.path)} (${P.detail})`),P.action==="refused"?process.exitCode=1:k.push("codex")}}for(let m of Y){if(!n.includes(m))continue;if(!l.ok){console.log(`[info]   ${J[m].label}: not wired -- the key did not verify, and it would be written into the host config`);continue}let P=_t(m,{homeDir:Hn(),env:process.env,apiUrl:i,apiKey:u});console.log(`${A(P.action)} ${P.path} (${J[m].label}: ${P.detail})`),P.action==="refused"?process.exitCode=1:k.push(m);let v=zt(m,{homeDir:Hn(),env:process.env,runner:h});console.log(`${A(v.action)} ${v.path} (${J[m].label}: ${v.detail})`),v.action==="refused"?process.exitCode=1:y=!0}if(l.ok)console.log(`${A("verified")} connection to ${i} (GET /api/workspaces -> 200)`);else{let m=l.status?`HTTP ${l.status}`:l.error??"unknown error";console.log(`${A("failed")} connection to ${i} (${m}) -- check your API key and --url`),(l.status===401||l.status===403)&&(process.exitCode=1)}if(f&&!e.embedKey&&f.action!=="skipped"&&(console.log(""),console.log("NOTE: .mcp.json references ${CONTEXT_API_KEY}. When that variable is unset, the"),console.log(`current @contextq/mcp reads the key from ${_()} instead.`),console.log('If `npx @contextq/mcp` still logs "Auth: NONE", export it before starting Claude Code:'),console.log("  export CONTEXT_API_KEY=<your key>"),console.log("...or re-run with --embed-key to write the literal key into .mcp.json instead.")),y){let m=Zt(o,g,p);console.log(`${A(m.action)} ${ee(o,m.path)} (${m.detail})`)}console.log("");let x={"claude-code":"a new Claude Code session",codex:"a new `codex` run",gemini:"a new `gemini` session",cursor:"a new Cursor or `cursor-agent` session",copilot:"a new `copilot` session"},b=n.filter(m=>m!=="desktop"&&k.includes(m)).map(m=>x[m]).join(" / start ");b?console.log(`Done. Open ${b} in this repo to pick up the wiring.`):(console.log("Nothing was wired: no surface got a ContextQ MCP connection. Fix what is reported above and re-run."),process.exitCode=1),w?(console.log(""),console.log("Next: in that Claude Code session, run /contextq:init to bind this repo to a workspace"),console.log("and project. Until it writes .contextq/config.json, the plugin's MCP tools work but its"),console.log("SessionStart/PreCompact/SessionEnd hooks stay silent and say so.")):n.includes("claude-code")&&(console.log(""),console.log("Claude Code 2.1.281+ can carry all of this as a plugin instead -- MCP server and"),console.log("lifecycle hooks, key in Claude Code's own store. Re-run init without --no-plugin after"),console.log("removing the contextq entry from .mcp.json, rather than installing the plugin on top:"),console.log("both would register the same MCP server. See https://app.contextq.dev/install.md."))}s(yi,"runInit");function wi(e){let t=[],n={};for(let o=0;o<e.length;o++){let r=e[o];switch(r){case"--workspace":n.workspace=e[++o];break;case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;default:if(r.startsWith("-"))throw new Error(`unknown argument: ${r}`);t.push(r)}}if(t.length===0)throw new Error("missing <dir> argument -- usage: contextq skills sync <dir>");if(t.length>1)throw new Error(`unexpected extra argument: ${t[1]}`);return{...n,dir:t[0]}}s(wi,"parseSkillsSyncArgs");function ki(e){let t=R(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||process.env.CTQ_API_URL||q,o=e.key||process.env.CONTEXT_API_KEY||process.env.CTQ_API_KEY||t.apiKey;if(!o)throw new Error("no API key available -- pass --key, set CONTEXT_API_KEY, or run `contextq init` first to write the credential file");return{apiUrl:n,apiKey:o}}s(ki,"resolveApiCreds");async function xi(e,t,n){let o=new URL("/api/agent/skills/export",e.replace(/\/$/,"")+"/");o.searchParams.set("format","json"),n&&o.searchParams.set("workspace",n);let r=await fetch(o,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new Error(`GET ${o.pathname}${o.search} -> HTTP ${r.status}`);return(await r.json()).skills}s(xi,"fetchSkillsFromApi");async function bi(e){console.log("contextq skills sync"),console.log("=====================");let{apiUrl:t,apiKey:n}=ki(e);console.log(`[info]   syncing to ${e.dir}${e.workspace?` (workspace: ${e.workspace})`:""}`);let o=await hn({dir:e.dir,fetchSkills:s(()=>xi(t,n,e.workspace),"fetchSkills")});for(let r of o.written)console.log(`${A("created")} ${r}/SKILL.md`);for(let r of o.updated)console.log(`${A("added")} ${r}/SKILL.md (rewritten in place)`);if(console.log(`[info]   ${o.written.length} written, ${o.updated.length} updated, ${o.unchanged.length} unchanged`),o.orphans.length>0){console.log(`[warn]   ${o.orphans.length} orphaned folder(s) -- left on disk, not deleted:`);for(let r of o.orphans)console.log(`         ${r}/ (its context no longer resolves)`)}}s(bi,"runSkillsSync");function vi(e){let t="claude",n=!1,o,r;for(let i=0;i<e.length;i++){let c=e[i],a=e[i+1];if(c==="--format"&&a){if(!st.includes(a))throw new Error(`--format must be one of: ${st.join(", ")}`);t=a,i++}else if(c==="--agent"&&a)o=a,i++;else if(c==="--workspace"&&a)r=a,i++;else if(c==="--require-config")n=!0;else throw new Error(`unknown "hook boot" argument "${c}"`)}return{format:t,agent:o,workspace:r,requireConfig:n}}s(vi,"parseHookBootArgs");async function Si(e){try{let t=vi(e),n=await cn({cwd:process.env.CLAUDE_PROJECT_DIR||process.cwd(),env:process.env,stdinText:await ln(),...t});n&&process.stdout.write(`${n}
-`)}catch(t){console.error(`contextq hook boot: ${t.message}`)}}s(Si,"runHookBootCommand");async function $i(e){let t={url:q,restart:!1,leaveDenied:!1,abort:!1,keyStdin:!1,ping:void 0};for(let i=0;i<e.length;i++){let c=e[i];if(c==="--url")t.url=e[++i]??"";else if(c==="--restart")t.restart=!0;else if(c==="--leave-denied")t.leaveDenied=!0;else if(c==="--abort")t.abort=!0;else if(c==="--key-stdin")t.keyStdin=!0;else if(c==="--ping")t.ping=!0;else if(c==="--no-ping")t.ping=!1;else{console.error(`contextq: unknown option "${c}" for attach; usage: contextq attach [--url <url>] [--restart] [--leave-denied] [--abort] [--key-stdin] [--ping|--no-ping]`),process.exitCode=1;return}}let n=await Promise.resolve().then(()=>(Kn(),Ln)),{gitRoot:o}=await Promise.resolve().then(()=>(de(),le)),r=null;try{r=o(process.cwd())}catch{r=null}try{if(t.abort){console.log(await n.abortAttach({cloudUrl:t.url,repoRoot:r}));return}console.log(`ContextQ attach -> ${t.url}`),await n.attachTransfer({cloudUrl:t.url,restart:t.restart,leaveDenied:t.leaveDenied,login:t.keyStdin?async()=>{let c=[];for await(let d of process.stdin)c.push(d);let a=Buffer.concat(c).toString("utf8").trim();if(!T.test(a))throw new Error("--key-stdin expects one sk_live_ key on stdin");return a}:()=>xt(c=>ve({apiUrl:t.url,signal:c,onPrompt:kt}))});let i=await n.attachSwitch({cloudUrl:t.url,repoRoot:r,pingConsent:t.ping});console.log(""),console.log(`Attached: ${Object.keys(i.acked).length} note(s) now live in your ContextQ account at ${t.url}.`),console.log("The local copy and its keys stay on this machine, read-only. Open a new Claude Code session to use the cloud memory, board and handoffs.")}catch(i){console.error(`contextq: ${i.message}`),process.exitCode=1}}s($i,"runAttachCommand");async function Ci(e){let t=await Promise.resolve().then(()=>(Le(),Cn)),n=e[0],o={};for(let r=1;r<e.length;r++)if(e[r]==="--port"){let i=e[++r]??"",c=/^\d+$/.test(i)?Number(i):NaN;if(!Number.isInteger(c)||c<1||c>65535){console.error(`contextq: invalid port "${i}"; use a number from 1 to 65535`),process.exitCode=1;return}o.port=c}else if(e[r]==="--state-dir")o.stateDir=e[++r];else{console.error(`contextq: unknown option "${e[r]}" for "local ${n??""}"`),process.exitCode=1;return}try{if(n==="start"){let r=await t.start(o);r.warning&&console.log(`[warn]   ${r.warning}`),console.log(`${r.started?"[start]":"[skip] "}  ContextQ local server ${r.started?"started":"already running"} at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion})`),console.log(`[info]   state: ${r.stateDir}`)}else if(n==="status"){let r=await t.status(o);r.running?console.log(`running at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion}${r.edgeVersion!==r.pinnedVersion?`, pinned ${r.pinnedVersion}`:""})`):(console.log(`not running: ${r.note??"not started"}`),process.exitCode=3),console.log(`state: ${r.stateDir}`)}else if(n==="stop"){let r=await t.stop(o);console.log(r.stopped?`[stop]   ${r.note}`:`[skip]   ${r.note}`)}else console.error("contextq: usage: contextq local start|status|stop [--port <n>] [--state-dir <dir>]"),process.exitCode=1}catch(r){console.error(`contextq: ${r.message}`),process.exitCode=1}}s(Ci,"runLocalCommand");async function _i(){let e=process.argv.slice(2);if(e[0]==="hook"){if(e[1]!=="boot"){console.error(`contextq: unknown "hook" subcommand "${e[1]??""}" -- expected "boot"`),process.exitCode=1;return}await Si(e.slice(2));return}if(e[0]==="attach"){await $i(e.slice(1));return}if(e[0]==="local"){await Ci(e.slice(1));return}if(e[0]==="skills"){if(e[1]==="-h"||e[1]==="--help"){he();return}if(e[1]!=="sync"){console.error(`contextq: unknown "skills" subcommand "${e[1]??""}" -- expected "sync"`),he(),process.exitCode=1;return}try{let n=wi(e.slice(2));await bi(n)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=1}return}let t;try{t=mi(e)}catch(n){console.error(`contextq: ${n.message}`),he(),process.exitCode=1;return}if(t.help||!t.command){he();return}if(t.command==="login"){try{await hi(t)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=n instanceof S&&n.code==="cancelled"?130:1}return}if(t.command!=="init"){console.error(`contextq: unknown command "${t.command}"`),he(),process.exitCode=1;return}try{if(t.local){if(t.key||t.url||t.embedKey||t.noPlugin||t.surface)throw new Error("--local takes only --workspace, --agent and --port: it needs no key, URL or surface");let{runLocalInit:n}=await Promise.resolve().then(()=>(de(),le));await n({cwd:process.cwd(),workspace:t.workspace,agent:t.agent,runtime:t.port?{port:t.port}:void 0});return}await yi(t)}catch(n){console.error(`contextq: ${n.message}`),process.exitCode=1}}s(_i,"main");_i();
+                         CONTEXT_API_URL/CTQ_API_URL env, default: ${V})
+
+Exit codes:
+  0    success (doctor: every step passed)
+  1    failure: bad arguments, a refused or unverified key, an unreachable server,
+       no MCP connection wired, or a failed doctor step
+  3    local status: the local server is not running
+  130  interrupted: Ctrl-C at a prompt, or the browser approval was cancelled
+`)}a(Oe,"printHelp");function le(e,t){return t.startsWith(`${e}/`)?t.slice(e.length+1):t}a(le,"relative");function O(e){return{created:"[create]",added:"[add]  ",wired:"[create]",rotated:"[rotate]",skipped:"[skip] ",verified:"[check]",failed:"[check]",refused:"[refuse]"}[e]??`[${e}]`}a(O,"label");async function Po(e,t){try{let n=await fetch(`${e.replace(/\/$/,"")}/api/workspaces`,{headers:{Authorization:`Bearer ${t}`}});return{ok:n.status===200,status:n.status}}catch(n){return{ok:!1,error:n.message}}}a(Po,"verifyConnection");function en(e){console.log(""),console.log("Approve this machine in your browser:"),console.log(`  ${e.verificationUri}`),console.log(`  code: ${e.userCode}`),console.log(`Waiting for approval (expires in ${Math.max(1,Math.round(e.expiresInSeconds/60))} min, Ctrl-C to cancel)...`)}a(en,"printDevicePrompt");function tn(e){let t=new AbortController,n=a(()=>t.abort(),"onSigint");return process.once("SIGINT",n),e(t.signal).finally(()=>process.removeListener("SIGINT",n))}a(tn,"withSigintAbort");async function Si(e){let t=N(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||V;console.log(`ContextQ login (${n})`);let o=await tn(i=>He({apiUrl:n,signal:i,onPrompt:en})),r=await Po(n,o);if(!r.ok){let i=r.status?`HTTP ${r.status}`:r.error??"unknown error";throw new Error(`could not verify the approved key against ${n} (${i}); nothing was written`)}let s=M({explicitKey:o,ambientVarName:null,ambientKey:"",apiUrl:n});console.log("Approved."),console.log(s.credLine),console.log(`[check]  connected to ${n}`)}a(Si,"runLogin");async function Ci(e){let t=process.cwd(),{surfaces:n,root:o}=ge(t,{forcedSurface:e.surface});if(console.log("ContextQ init"),console.log("============="),n.length===1&&n[0]==="desktop"){console.log(`Surface detected: desktop/other (no git repo, .claude/, or .codex/ found at ${t})`),zn(e.url??V);return}console.log(`Surface(s) detected: ${n.join(", ")} (root: ${o})`);let r=N(),s=e.url||r.apiUrl||process.env.CONTEXT_API_URL||V,i=process.env.CONTEXT_API_KEY?"CONTEXT_API_KEY":process.env.CTQ_API_KEY?"CTQ_API_KEY":null,c=i?process.env[i]:"",{decision:l,verify:d}=await kn({explicitKey:e.key,ambientVarName:i,ambientKey:c,apiUrl:s,interactive:!!process.stdin.isTTY,verify:a(m=>Po(s,m),"verify"),prompt:Wn,deviceLogin:a(()=>tn(m=>He({apiUrl:s,signal:m,onPrompt:en})),"deviceLogin")}),u=l.apiKey;if(console.log(l.credLine),!d.ok){let m=d.status?`HTTP ${d.status}`:d.error??"unknown error";console.log(`[warn]   could not verify the key against ${s} (${m}); it was kept, re-run init once the server answers`)}let f;e.agent?f=te(e.agent,"--agent"):f=B(Eo(o));let p;if(e.workspace){let m=e.workspace.toLowerCase();p=te(m,"--workspace"),m!==e.workspace&&console.log(`[info]   --workspace lowercased to match slug convention: "${e.workspace}" -> "${m}"`)}else p=B(Eo(o));console.log(`[info]   agent=${f} workspace=${p}`);let g=process.env.CONTEXTQ_HOOK_RUNNER||J,h,w=!1,x=[],y=!1;if(n.includes("claude-code")){let m=Fn({noPlugin:e.noPlugin,legacyMcpEntry:Mn(o),verifyStatus:d.status});if(!m.delegate)console.log(`[info]   ${m.reason}`);else{let S=Qe(o,s,u,V);S.status==="installed"?(w=!0,x.push("claude-code"),console.log(`${O(S.alreadyInstalled?"skipped":"added")} .claude/settings.json (${_} at project scope -- ${S.message})`)):console.log(`[info]   plugin install ${S.status}: ${S.reason} -- falling back to .mcp.json wiring`)}if(!w){h=bn(o,s,e.embedKey,u),console.log(`${O(h.action)} ${le(o,h.path)} (${h.detail})`),x.push("claude-code");let S=Rn(o,f,p,g);console.log(`${O(S.action)} ${le(o,S.path)} (${S.detail})`),S.action==="refused"&&(process.exitCode=1)}let b=Gn(o);console.log(`${O(b.action)} ${le(o,b.path)} (${b.detail})`)}if(n.includes("codex")){console.log(""),console.log("[info]   Codex hooks -- assumptions this install makes:"),console.log("         - Sandbox/approval: the boot hook makes an outbound HTTP call to the ContextQ"),console.log("           API. Verified empirically (codex-cli 0.146.0, `codex exec --sandbox"),console.log("           workspace-write`, no approval flag): a TRUSTED hook's outbound call is NOT"),console.log("           gated by sandbox_mode/approval_policy the way model-issued shell commands"),console.log("           are -- the real gate is hook TRUST (see the note below), not the sandbox."),console.log("           Once trusted, this should work under any sandbox_mode/approval_policy combo."),console.log("           If it still produces no injected context, `codex doctor` shows current sandbox"),console.log("           + approval state as a starting point for diagnosis."),console.log("         - Native Memories: Codex ships its own Memories feature (off by default). If you"),console.log("           turn it on, set memories.disable_on_external_context = true in config.toml (or"),console.log("           its older alias no_memories_if_mcp_or_web_search) -- otherwise a session that"),console.log("           used MCP tools (including ContextQ's own MCP server) still feeds Codex's native"),console.log("           memory extraction too, duplicating what ContextQ already captures."),console.log("");let m=On(o,f,p,g);if(console.log(`${O(m.action)} ${le(o,m.path)} (${m.detail})`),m.action==="refused"&&(process.exitCode=1),!d.ok)console.log("[info]   Codex MCP: not wired -- the key did not verify, and it would be written into .codex/config.toml");else{let b=En(o,s,u);console.log(`${O(b.action)} ${le(o,b.path)} (${b.detail})`),b.action==="refused"?process.exitCode=1:x.push("codex")}}for(let m of ee){if(!n.includes(m))continue;if(!d.ok){console.log(`[info]   ${X[m].label}: not wired -- the key did not verify, and it would be written into the host config`);continue}let b=ln(m,{homeDir:Zt(),env:process.env,apiUrl:s,apiKey:u});console.log(`${O(b.action)} ${b.path} (${X[m].label}: ${b.detail})`),b.action==="refused"?process.exitCode=1:x.push(m);let S=Un(m,{homeDir:Zt(),env:process.env,runner:g});console.log(`${O(S.action)} ${S.path} (${X[m].label}: ${S.detail})`),S.action==="refused"?process.exitCode=1:y=!0}if(n.includes("opencode"))if(!d.ok)console.log("[info]   OpenCode: not wired -- the key did not verify, and it would be written into the host config");else{let m=un({homeDir:Zt(),env:process.env,apiUrl:s,apiKey:u,major:dn()});console.log(`${O(m.action)} ${m.path} (OpenCode: ${m.detail})`),m.action==="refused"?process.exitCode=1:x.push("opencode")}if(d.ok)console.log(`${O("verified")} connection to ${s} (GET /api/workspaces -> 200)`);else{let m=d.status?`HTTP ${d.status}`:d.error??"unknown error";console.log(`${O("failed")} connection to ${s} (${m}) -- check your API key and --url`),(d.status===401||d.status===403)&&(process.exitCode=1)}if(h&&!e.embedKey&&h.action!=="skipped"&&(console.log(""),console.log("NOTE: .mcp.json references ${CONTEXT_API_KEY}. When that variable is unset, the"),console.log(`current @contextq/mcp reads the key from ${A()} instead.`),console.log('If `npx @contextq/mcp` still logs "Auth: NONE", export it before starting Claude Code:'),console.log("  export CONTEXT_API_KEY=<your key>"),console.log("...or re-run with --embed-key to write the literal key into .mcp.json instead.")),y){let m=jn(o,p,f);console.log(`${O(m.action)} ${le(o,m.path)} (${m.detail})`)}console.log("");let v={"claude-code":"a new Claude Code session",codex:"a new `codex` run",gemini:"a new `gemini` session",cursor:"a new Cursor or `cursor-agent` session",copilot:"a new `copilot` session",opencode:"a new `opencode` session"},k=n.filter(m=>m!=="desktop"&&x.includes(m)).map(m=>v[m]).join(" / start ");k?console.log(`Done. Open ${k} in this repo to pick up the wiring.`):(console.log("Nothing was wired: no surface got a ContextQ MCP connection. Fix what is reported above and re-run."),process.exitCode=1),w?(console.log(""),console.log("Next: in that Claude Code session, run /contextq:init to bind this repo to a workspace"),console.log("and project. Until it writes .contextq/config.json, the plugin's MCP tools work but its"),console.log("SessionStart/PreCompact/SessionEnd hooks stay silent and say so.")):n.includes("claude-code")&&(console.log(""),console.log("Claude Code 2.1.281+ can carry all of this as a plugin instead -- MCP server and"),console.log("lifecycle hooks, key in Claude Code's own store. Re-run init without --no-plugin after"),console.log("removing the contextq entry from .mcp.json, rather than installing the plugin on top:"),console.log("both would register the same MCP server. See https://app.contextq.dev/install.md."))}a(Ci,"runInit");function _i(e){let t=[],n={};for(let o=0;o<e.length;o++){let r=e[o];switch(r){case"--workspace":n.workspace=e[++o];break;case"--key":n.key=e[++o];break;case"--url":n.url=e[++o];break;default:if(r.startsWith("-"))throw new Error(`unknown argument: ${r}`);t.push(r)}}if(t.length===0)throw new Error("missing <dir> argument -- usage: contextq skills sync <dir>");if(t.length>1)throw new Error(`unexpected extra argument: ${t[1]}`);return{...n,dir:t[0]}}a(_i,"parseSkillsSyncArgs");function Ei(e){let t=N(),n=e.url||t.apiUrl||process.env.CONTEXT_API_URL||process.env.CTQ_API_URL||V,o=e.key||process.env.CONTEXT_API_KEY||process.env.CTQ_API_KEY||t.apiKey;if(!o)throw new Error("no API key available -- pass --key, set CONTEXT_API_KEY, or run `contextq init` first to write the credential file");return{apiUrl:n,apiKey:o}}a(Ei,"resolveApiCreds");async function Pi(e,t,n){let o=new URL("/api/agent/skills/export",e.replace(/\/$/,"")+"/");o.searchParams.set("format","json"),n&&o.searchParams.set("workspace",n);let r=await fetch(o,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new Error(`GET ${o.pathname}${o.search} -> HTTP ${r.status}`);return(await r.json()).skills}a(Pi,"fetchSkillsFromApi");async function Ti(e){console.log("contextq skills sync"),console.log("=====================");let{apiUrl:t,apiKey:n}=Ei(e);console.log(`[info]   syncing to ${e.dir}${e.workspace?` (workspace: ${e.workspace})`:""}`);let o=await to({dir:e.dir,fetchSkills:a(()=>Pi(t,n,e.workspace),"fetchSkills")});for(let r of o.written)console.log(`${O("created")} ${r}/SKILL.md`);for(let r of o.updated)console.log(`${O("added")} ${r}/SKILL.md (rewritten in place)`);if(console.log(`[info]   ${o.written.length} written, ${o.updated.length} updated, ${o.unchanged.length} unchanged`),o.orphans.length>0){console.log(`[warn]   ${o.orphans.length} orphaned folder(s) -- left on disk, not deleted:`);for(let r of o.orphans)console.log(`         ${r}/ (its context no longer resolves)`)}}a(Ti,"runSkillsSync");function Ai(e){let t="claude",n=!1,o,r;for(let s=0;s<e.length;s++){let i=e[s],c=e[s+1];if(i==="--format"&&c){if(!ye.includes(c))throw new Error(`--format must be one of: ${ye.join(", ")}`);t=c,s++}else if(i==="--agent"&&c)o=c,s++;else if(i==="--workspace"&&c)r=c,s++;else if(i==="--require-config")n=!0;else throw new Error(`unknown "hook boot" argument "${i}"`)}return{format:t,agent:o,workspace:r,requireConfig:n}}a(Ai,"parseHookBootArgs");async function Ri(e){try{let t=Ai(e),n=await Vn({cwd:process.env.CLAUDE_PROJECT_DIR||process.cwd(),env:process.env,stdinText:await Ht(),...t});n&&process.stdout.write(`${n}
+`)}catch(t){console.error(`contextq hook boot: ${t.message}`)}}a(Ri,"runHookBootCommand");function Oi(e){let t="copilot",n="end",o=!1;for(let r=0;r<e.length;r++){let s=e[r],i=e[r+1];if(s==="--format"&&i){if(!ye.includes(i))throw new Error(`--format must be one of: ${ye.join(", ")}`);t=i,r++}else if(s==="--reason"&&i){if(!Ut.includes(i))throw new Error(`--reason must be one of: ${Ut.join(", ")}`);n=i,r++}else if(s==="--require-config")o=!0;else throw new Error(`unknown "hook snapshot" argument "${s}"`)}return{format:t,reason:n,requireConfig:o}}a(Oi,"parseHookSnapshotArgs");async function Ii(e){try{let t=Oi(e),n=await Xn({cwd:process.cwd(),env:process.env,stdinText:await Ht(),...t});n.outcome==="failed"&&console.error(`contextq hook snapshot: ${n.detail}; this session's snapshot was not saved`)}catch(t){console.error(`contextq hook snapshot: ${t.message}`)}}a(Ii,"runHookSnapshotCommand");async function Ni(e){let t={url:V,restart:!1,leaveDenied:!1,abort:!1,keyStdin:!1,ping:void 0};for(let s=0;s<e.length;s++){let i=e[s];if(i==="--url")t.url=e[++s]??"";else if(i==="--restart")t.restart=!0;else if(i==="--leave-denied")t.leaveDenied=!0;else if(i==="--abort")t.abort=!0;else if(i==="--key-stdin")t.keyStdin=!0;else if(i==="--ping")t.ping=!0;else if(i==="--no-ping")t.ping=!1;else{console.error(`contextq: unknown option "${i}" for attach; usage: contextq attach [--url <url>] [--restart] [--leave-denied] [--abort] [--key-stdin] [--ping|--no-ping]`),process.exitCode=1;return}}let n=await Promise.resolve().then(()=>($o(),bo)),{gitRoot:o}=await Promise.resolve().then(()=>(se(),_e)),r=null;try{r=o(process.cwd())}catch{r=null}try{if(t.abort){console.log(await n.abortAttach({cloudUrl:t.url,repoRoot:r}));return}console.log(`ContextQ attach -> ${t.url}`),await n.attachTransfer({cloudUrl:t.url,restart:t.restart,leaveDenied:t.leaveDenied,login:t.keyStdin?async()=>{let i=[];for await(let l of process.stdin)i.push(l);let c=Buffer.concat(i).toString("utf8").trim();if(!I.test(c))throw new Error("--key-stdin expects one sk_live_ key on stdin");return c}:()=>tn(i=>He({apiUrl:t.url,signal:i,onPrompt:en}))});let s=await n.attachSwitch({cloudUrl:t.url,repoRoot:r,pingConsent:t.ping});console.log(""),console.log(`Attached: ${Object.keys(s.acked).length} note(s) now live in your ContextQ account at ${t.url}.`),console.log("The local copy and its keys stay on this machine, read-only. Open a new Claude Code session to use the cloud memory, board and handoffs.")}catch(s){console.error(`contextq: ${s.message}`),process.exitCode=1}}a(Ni,"runAttachCommand");async function Di(e){let t=!1,n;for(let i=0;i<e.length;i++){let c=e[i];if(c==="--json")t=!0;else if(c==="--workspace"&&e[i+1])n=e[++i];else if(c==="-h"||c==="--help"){console.log(`Usage:
+  npx @contextq/cli doctor [--json] [--workspace <slug>]
+
+Checks, for every detected and wired host, that the configured API answers,
+the key is accepted, the bound workspace reads, the host MCP entry points at
+the same endpoint, the boot hook is wired, and a probe note round-trips.
+Prints one PASS/FAIL line per step (SKIP when a detected host is not wired)
+and exits 0 only when everything passes. --json prints the same as JSON.`);return}else{console.error(`contextq: unknown option "${c}" for "doctor"; usage: contextq doctor [--json] [--workspace <slug>]`),process.exitCode=1;return}}let{runDoctor:o,formatHuman:r}=await Promise.resolve().then(()=>(_o(),Co)),s=await o({workspace:n});if(t)console.log(JSON.stringify({ok:s.ok,mode:s.mode,apiUrl:s.apiUrl,workspace:s.workspace,results:s.lines},null,2));else for(let i of r(s))console.log(i);s.ok||(process.exitCode=1)}a(Di,"runDoctorCommand");async function qi(e){let t=await Promise.resolve().then(()=>(Ce(),uo)),n=e[0],o={};for(let r=1;r<e.length;r++)if(e[r]==="--port"){let s=e[++r]??"",i=/^\d+$/.test(s)?Number(s):NaN;if(!Number.isInteger(i)||i<1||i>65535){console.error(`contextq: invalid port "${s}"; use a number from 1 to 65535`),process.exitCode=1;return}o.port=i}else if(e[r]==="--state-dir")o.stateDir=e[++r];else{console.error(`contextq: unknown option "${e[r]}" for "local ${n??""}"`),process.exitCode=1;return}try{if(n==="start"){let r=await t.start(o);r.warning&&console.log(`[warn]   ${r.warning}`),console.log(`${r.started?"[start]":"[skip] "}  ContextQ local server ${r.started?"started":"already running"} at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion})`),console.log(`[info]   state: ${r.stateDir}`)}else if(n==="status"){let r=await t.status(o);r.running?console.log(`running at ${r.url} (pid ${r.pid}, edge ${r.edgeVersion}${r.edgeVersion!==r.pinnedVersion?`, pinned ${r.pinnedVersion}`:""})`):(console.log(`not running: ${r.note??"not started"}`),process.exitCode=3),console.log(`state: ${r.stateDir}`)}else if(n==="stop"){let r=await t.stop(o);console.log(r.stopped?`[stop]   ${r.note}`:`[skip]   ${r.note}`)}else console.error("contextq: usage: contextq local start|status|stop [--port <n>] [--state-dir <dir>]"),process.exitCode=1}catch(r){console.error(`contextq: ${r.message}`),process.exitCode=1}}a(qi,"runLocalCommand");function Hi(e){let t=["CTQ_API_KEY","CTQ_API_URL"].filter(n=>{let o=n==="CTQ_API_KEY"?"CONTEXT_API_KEY":"CONTEXT_API_URL";return!!e[n]&&!e[o]});return t.length===0?null:`contextq: ${t.join(" and ")} ${t.length===1?"is":"are"} deprecated; set CONTEXT_API_KEY / CONTEXT_API_URL instead (the old names still work for now).`}a(Hi,"deprecatedEnvNotice");async function Ui(){let e=process.argv.slice(2);if(e[0]==="hook"){if(e[1]==="boot"){await Ri(e.slice(2));return}if(e[1]==="snapshot"){await Ii(e.slice(2));return}console.error(`contextq: unknown "hook" subcommand "${e[1]??""}" -- expected "boot" or "snapshot"`),process.exitCode=1;return}let t=Hi(process.env);if(t&&console.error(t),e[0]==="attach"){await Ni(e.slice(1));return}if(e[0]==="local"){await qi(e.slice(1));return}if(e[0]==="doctor"){await Di(e.slice(1));return}if(e[0]==="skills"){if(e[1]==="-h"||e[1]==="--help"){Oe();return}if(e[1]!=="sync"){console.error(`contextq: unknown "skills" subcommand "${e[1]??""}" -- expected "sync"`),Oe(),process.exitCode=1;return}try{let o=_i(e.slice(2));await Ti(o)}catch(o){console.error(`contextq: ${o.message}`),process.exitCode=1}return}let n;try{n=$i(e)}catch(o){console.error(`contextq: ${o.message}`),Oe(),process.exitCode=1;return}if(n.help||!n.command){Oe();return}if(n.command==="login"){try{await Si(n)}catch(o){console.error(`contextq: ${o.message}`),process.exitCode=o instanceof E&&o.code==="cancelled"?130:1}return}if(n.command!=="init"){console.error(`contextq: unknown command "${n.command}"`),Oe(),process.exitCode=1;return}try{if(n.local){if(n.key||n.url||n.embedKey||n.noPlugin||n.surface)throw new Error("--local takes only --workspace, --agent and --port: it needs no key, URL or surface");let{runLocalInit:o}=await Promise.resolve().then(()=>(se(),_e));await o({cwd:process.cwd(),workspace:n.workspace,agent:n.agent,runtime:n.port?{port:n.port}:void 0});return}await Ci(n)}catch(o){console.error(`contextq: ${o.message}`),process.exitCode=1}}a(Ui,"main");Ui();export{Hi as deprecatedEnvNotice};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contextq/cli",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "One-command installer for ContextQ -- wires the MCP server, the contextq SessionStart boot hook, and the task manifest into a project (or prints a manual connect guide for Desktop/Cowork).",
   "type": "module",
   "bin": {