@cortex-context/cli 0.0.12 → 0.0.14

package/dist/index.js

@@ -5617,7 +5617,7 @@ var require_dist = __commonJS({
         });
       };
     }
-    var prompts6 = require_prompts();
+    var prompts7 = require_prompts();
     var passOn = ["suggest", "format", "onState", "validate", "onRender", "type"];
     var noop = () => {
     };
@@ -5668,7 +5668,7 @@ var require_dist = __commonJS({
             var _question2 = question;
             name = _question2.name;
             type = _question2.type;
-            if (prompts6[type] === void 0) {
+            if (prompts7[type] === void 0) {
               throw new Error(`prompt type (${type}) is not defined`);
             }
             if (override2[question.name] !== void 0) {
@@ -5679,7 +5679,7 @@ var require_dist = __commonJS({
               }
             }
             try {
-              answer = prompt._injected ? getInjectedAnswer(prompt._injected, question.initial) : yield prompts6[type](question);
+              answer = prompt._injected ? getInjectedAnswer(prompt._injected, question.initial) : yield prompts7[type](question);
               answers[name] = answer = yield getFormattedAnswer(question, answer, true);
               quit = yield onSubmit(question, answer, answers);
             } catch (err) {
@@ -5711,7 +5711,7 @@ var require_dist = __commonJS({
     }
     module2.exports = Object.assign(prompt, {
       prompt,
-      prompts: prompts6,
+      prompts: prompts7,
       inject,
       override
     });
@@ -7798,7 +7798,7 @@ var require_prompts2 = __commonJS({
 var require_lib = __commonJS({
   "node_modules/prompts/lib/index.js"(exports2, module2) {
     "use strict";
-    var prompts6 = require_prompts2();
+    var prompts7 = require_prompts2();
     var passOn = ["suggest", "format", "onState", "validate", "onRender", "type"];
     var noop = () => {
     };
@@ -7830,7 +7830,7 @@ var require_lib = __commonJS({
           throw new Error("prompt message is required");
         }
         ({ name, type } = question);
-        if (prompts6[type] === void 0) {
+        if (prompts7[type] === void 0) {
           throw new Error(`prompt type (${type}) is not defined`);
         }
         if (override2[question.name] !== void 0) {
@@ -7841,7 +7841,7 @@ var require_lib = __commonJS({
           }
         }
         try {
-          answer = prompt._injected ? getInjectedAnswer(prompt._injected, question.initial) : await prompts6[type](question);
+          answer = prompt._injected ? getInjectedAnswer(prompt._injected, question.initial) : await prompts7[type](question);
           answers[name] = answer = await getFormattedAnswer(question, answer, true);
           quit = await onSubmit(question, answer, answers);
         } catch (err) {
@@ -7864,7 +7864,7 @@ var require_lib = __commonJS({
     function override(answers) {
       prompt._override = Object.assign({}, answers);
     }
-    module2.exports = Object.assign(prompt, { prompt, prompts: prompts6, inject, override });
+    module2.exports = Object.assign(prompt, { prompt, prompts: prompts7, inject, override });
   }
 });
 
@@ -18008,16 +18008,33 @@ function writeMcpConfig(mcpPath, config2) {
   (0, import_fs3.mkdirSync)((0, import_path3.dirname)(mcpPath), { recursive: true });
   (0, import_fs3.writeFileSync)(mcpPath, JSON.stringify(config2, null, 2) + "\n");
 }
-function injectCortexMcpServer(mcpPath, cortexUrl, cortexToken) {
+function injectCortexMcpServer(mcpPath, cortexUrl, cortexToken, target) {
   const config2 = readMcpConfig(mcpPath);
   const existed = "cortex" in config2.servers;
+  let cortexTokenEnv;
+  if (cortexToken) {
+    if (target === "vscode" || target === "claude") {
+      if (!config2.inputs) config2.inputs = [];
+      if (!config2.inputs.some((i) => i.id === "cortex_token")) {
+        config2.inputs.push({
+          id: "cortex_token",
+          type: "promptString",
+          description: "Cortex API Token (set during cortex-context server setup)",
+          password: true
+        });
+      }
+      cortexTokenEnv = "${input:cortex_token}";
+    } else {
+      cortexTokenEnv = "${env:CORTEX_API_TOKEN}";
+    }
+  }
   config2.servers["cortex"] = {
     type: "stdio",
     command: "npx",
     args: ["-y", "@cortex-context/cli", "mcp-serve"],
     env: {
       CORTEX_URL: cortexUrl,
-      ...cortexToken ? { CORTEX_API_TOKEN: cortexToken } : {}
+      ...cortexTokenEnv ? { CORTEX_API_TOKEN: cortexTokenEnv } : {}
     }
   };
   writeMcpConfig(mcpPath, config2);
@@ -18133,7 +18150,7 @@ function configureClaudeDesktop(cortexUrl, cortexToken) {
     args: ["-y", "@cortex-context/cli", "mcp-serve"],
     env: {
       CORTEX_URL: cortexUrl,
-      ...cortexToken ? { CORTEX_API_TOKEN: cortexToken } : {}
+      ...cortexToken ? { CORTEX_API_TOKEN: "${env:CORTEX_API_TOKEN}" } : {}
     }
   };
   (0, import_fs3.writeFileSync)(configPath, JSON.stringify(config2, null, 2) + "\n");
@@ -18295,6 +18312,10 @@ async function deployLocalStack(workspacePath, opts = {}) {
   if (!(0, import_fs5.existsSync)(destPath)) {
     (0, import_fs5.cpSync)(templatePath, destPath);
   }
+  const envPath = (0, import_path5.join)(workspacePath, ".env");
+  const envContent = `CORTEX_API_TOKEN=${opts.token ?? ""}
+`;
+  (0, import_fs5.writeFileSync)(envPath, envContent, { encoding: "utf-8" });
   const imageTag = opts.embeddings ? "latest-embeddings" : "latest";
   const cortexImage = `ghcr.io/rodrigoroldan/cortex-context:${imageTag}`;
   try {
@@ -18321,6 +18342,66 @@ ${stderr.trim()}` : ""}`
     };
   }
 }
+async function upgradeLocalStack(workspacePath, opts = {}) {
+  const composePath = (0, import_path5.join)(workspacePath, "docker-compose.local.yml");
+  if (!(0, import_fs5.existsSync)(composePath)) {
+    return {
+      upgraded: false,
+      error: `docker-compose.local.yml not found in ${workspacePath}. Run: cortex-context server`
+    };
+  }
+  const imageTag = opts.embeddings ? "latest-embeddings" : "latest";
+  const cortexImage = `ghcr.io/rodrigoroldan/cortex-context:${imageTag}`;
+  const composeCmd = `docker compose --project-name cortex-local -f "${composePath}"`;
+  try {
+    (0, import_child_process.execSync)(`${composeCmd} pull cortex-api`, {
+      cwd: workspacePath,
+      stdio: ["inherit", "inherit", "pipe"],
+      env: { ...process.env, CORTEX_IMAGE: cortexImage }
+    });
+  } catch (err) {
+    const stderr = err instanceof Error && "stderr" in err ? err.stderr?.toString() ?? "" : "";
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      upgraded: false,
+      error: `docker compose pull failed: ${msg}${stderr ? `
+${stderr.trim()}` : ""}`
+    };
+  }
+  try {
+    (0, import_child_process.execSync)(`${composeCmd} up -d --force-recreate cortex-api`, {
+      cwd: workspacePath,
+      stdio: ["inherit", "inherit", "pipe"],
+      env: { ...process.env, CORTEX_IMAGE: cortexImage }
+    });
+  } catch (err) {
+    const stderr = err instanceof Error && "stderr" in err ? err.stderr?.toString() ?? "" : "";
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      upgraded: false,
+      error: `docker compose up failed: ${msg}${stderr ? `
+${stderr.trim()}` : ""}`
+    };
+  }
+  return { upgraded: true };
+}
+function restartCortexApi(workspacePath) {
+  const composePath = (0, import_path5.join)(workspacePath, "docker-compose.local.yml");
+  if (!(0, import_fs5.existsSync)(composePath))
+    return { restarted: false, error: "docker-compose.local.yml not found" };
+  try {
+    (0, import_child_process.execSync)(
+      `docker compose --project-name cortex-local -f "${composePath}" restart cortex-api`,
+      { cwd: workspacePath, stdio: "ignore" }
+    );
+    return { restarted: true };
+  } catch (err) {
+    return {
+      restarted: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 function isDockerAvailable() {
   try {
     (0, import_child_process.execSync)("docker --version", { stdio: "ignore" });
@@ -18711,7 +18792,8 @@ async function initCommand(options) {
       const mcpStatus = injectCortexMcpServer(
         detected.mcpPath,
         cortexUrl,
-        cortexToken
+        cortexToken,
+        detected.target
       );
       if (mcpStatus.added) {
         console.log(source_default.green(`  \u2713 ${label} \u2014 Cortex server added`));
@@ -28113,6 +28195,7 @@ async function serveCommand() {
 var import_os4 = require("os");
 var import_fs12 = require("fs");
 var import_path13 = require("path");
+var import_crypto = require("crypto");
 var import_prompts3 = __toESM(require_prompts3());
 var CORTEX_URL2 = "http://localhost:8082";
 var NEO4J_URL = "http://localhost:7474";
@@ -28233,7 +28316,73 @@ async function serverCommand(options) {
     process.exit(0);
   }
   console.log("");
-  console.log(source_default.bold("  Step 3: Starting Cortex stack"));
+  console.log(source_default.bold("  Step 3: API Token"));
+  console.log(
+    source_default.dim("  Optionally secure write endpoints with a Bearer token.")
+  );
+  console.log(
+    source_default.dim("  Leave open (no token) for purely local/private use.")
+  );
+  console.log("");
+  const generatedToken = (0, import_crypto.randomBytes)(24).toString("hex");
+  const { tokenChoice } = await (0, import_prompts3.default)(
+    {
+      type: "select",
+      name: "tokenChoice",
+      message: "API token:",
+      choices: [
+        {
+          title: "Generate random token " + source_default.dim("(recommended)"),
+          value: "generate"
+        },
+        { title: "Enter my own token", value: "custom" },
+        {
+          title: "No token " + source_default.dim("(open access \u2014 local only)"),
+          value: "none"
+        }
+      ],
+      initial: 0
+    },
+    {
+      onCancel: () => {
+        console.log(source_default.yellow("\n  Aborted."));
+        process.exit(0);
+      }
+    }
+  );
+  let serverToken = "";
+  if (!tokenChoice || tokenChoice === "none") {
+    console.log(
+      source_default.dim("  \u2139  No token \u2014 API is open (suitable for local use only)")
+    );
+  } else if (tokenChoice === "generate") {
+    serverToken = generatedToken;
+    console.log(source_default.green("  \u2713 Random token generated"));
+  } else {
+    const { customToken } = await (0, import_prompts3.default)(
+      {
+        type: "password",
+        name: "customToken",
+        message: "Enter your token:",
+        validate: (v) => v.trim().length >= 8 || "Token must be at least 8 characters"
+      },
+      {
+        onCancel: () => {
+          console.log(source_default.yellow("\n  Aborted."));
+          process.exit(0);
+        }
+      }
+    );
+    serverToken = customToken?.trim() ?? "";
+    if (!serverToken) {
+      console.log(source_default.dim("  \u2139  Empty \u2014 API is open"));
+    } else {
+      console.log(source_default.green("  \u2713 Token saved"));
+    }
+  }
+  writeConfig({ url: CORTEX_URL2, token: serverToken });
+  console.log("");
+  console.log(source_default.bold("  Step 4: Starting Cortex stack"));
   const sysctlFix = tryFixLxcSysctl();
   if (sysctlFix.applied) {
     console.log(
@@ -28257,7 +28406,8 @@ async function serverCommand(options) {
   console.log(source_default.dim("  $ docker compose up -d"));
   console.log("");
   const startResult = await deployLocalStack(workDir, {
-    embeddings: options.embeddings ?? false
+    embeddings: options.embeddings ?? false,
+    token: serverToken
   });
   console.log("");
   if (!startResult.started) {
@@ -28306,7 +28456,7 @@ async function serverCommand(options) {
   }
   console.log(source_default.green("  \u2713 Containers started"));
   console.log("");
-  console.log(source_default.bold("  Step 4: Waiting for Cortex API..."));
+  console.log(source_default.bold("  Step 5: Waiting for Cortex API..."));
   const healthSpinner = ora(
     "  Polling http://localhost:8082/health (up to 2 min)..."
   ).start();
@@ -28332,9 +28482,22 @@ async function serverCommand(options) {
   console.log(source_default.cyan(`    Neo4j UI    \u2192 ${NEO4J_URL}`));
   console.log(source_default.dim("    Neo4j login \u2192 neo4j / cortex-local"));
   console.log("");
-  console.log(source_default.bold("  Next steps:"));
-  console.log(source_default.dim("  1. Initialize your workspace:"));
-  console.log(source_default.cyan(`       cortex-context init --url ${CORTEX_URL2}`));
+  if (serverToken) {
+    console.log(source_default.bold("  \u{1F511} API Token (save this!):"));
+    console.log(source_default.bold.yellow(`     ${serverToken}`));
+    console.log("");
+    console.log(source_default.bold("  Next steps:"));
+    console.log(source_default.dim("  1. Initialize your workspace:"));
+    console.log(
+      source_default.cyan(
+        `       cortex-context init --url ${CORTEX_URL2} --token ${serverToken}`
+      )
+    );
+  } else {
+    console.log(source_default.bold("  Next steps:"));
+    console.log(source_default.dim("  1. Initialize your workspace:"));
+    console.log(source_default.cyan(`       cortex-context init --url ${CORTEX_URL2}`));
+  }
   console.log(source_default.dim("  2. Check connectivity:"));
   console.log(source_default.cyan("       cortex-context doctor"));
   console.log("");
@@ -28488,8 +28651,8 @@ async function uninstallCommand(options) {
   if (!options.keepHook && hasHook) {
     const hookPath = (0, import_path14.join)(workspacePath, ".git", "hooks", "post-commit");
     try {
-      const { readFileSync: readFileSync8 } = await import("fs");
-      const hookContent = readFileSync8(hookPath, "utf-8");
+      const { readFileSync: readFileSync9 } = await import("fs");
+      const hookContent = readFileSync9(hookPath, "utf-8");
       if (hookContent.includes("cortex-context")) {
         (0, import_fs13.unlinkSync)(hookPath);
         console.log(source_default.green("  \u2713 .git/hooks/post-commit \u2014 removed"));
@@ -28556,7 +28719,11 @@ async function resetCommand(options) {
   console.log("");
   console.log(source_default.bold("  \u25C6 Cortex Context \u2014 Reset Graph"));
   console.log("");
-  console.log(source_default.yellow("  \u26A0  This will delete ALL nodes and relationships from the graph."));
+  console.log(
+    source_default.yellow(
+      "  \u26A0  This will delete ALL nodes and relationships from the graph."
+    )
+  );
   console.log(source_default.dim(`  Server: ${url}`));
   console.log("");
   const confirmed = options.yes || await (0, import_prompts5.default)({
@@ -28584,7 +28751,9 @@ async function resetCommand(options) {
   } catch (err) {
     process.stdout.write("\n");
     console.error(
-      source_default.red(`  \u2717 Network error: ${err instanceof Error ? err.message : String(err)}`)
+      source_default.red(
+        `  \u2717 Network error: ${err instanceof Error ? err.message : String(err)}`
+      )
     );
     process.exit(1);
   }
@@ -28603,11 +28772,258 @@ async function resetCommand(options) {
   console.log(source_default.dim("  Run `cortex-context sync` to re-ingest the graph."));
 }
 
-// src/cli.ts
+// src/commands/token.ts
+var import_crypto2 = require("crypto");
 var import_fs14 = require("fs");
 var import_path15 = require("path");
+var import_os5 = require("os");
+var import_prompts6 = __toESM(require_prompts3());
+var CORTEX_DIR = (0, import_path15.join)((0, import_os5.homedir)(), ".cortex-context");
+var ENV_FILE = (0, import_path15.join)(CORTEX_DIR, ".env");
+async function applyTokenRestart() {
+  if (!isDockerAvailable()) return;
+  console.log(
+    source_default.dim("  Restarting cortex-api container to apply new token...")
+  );
+  const result = restartCortexApi(CORTEX_DIR);
+  if (!result.restarted) {
+    console.log(
+      source_default.yellow(
+        `  \u26A0  Could not restart container: ${result.error ?? "unknown error"}`
+      )
+    );
+    console.log(
+      source_default.dim(
+        "    docker compose -f ~/.cortex-context/docker-compose.local.yml restart cortex-api"
+      )
+    );
+    return;
+  }
+  const config2 = readConfig();
+  const url = config2.url ?? "http://localhost:8082";
+  console.log(source_default.dim(`  Waiting for Cortex API at ${url}...`));
+  const { healthy } = await waitForCortexHealth(url, 6e4);
+  if (healthy) {
+    console.log(source_default.green("  \u2713 Container restarted and healthy"));
+  } else {
+    console.log(
+      source_default.yellow(
+        "  \u26A0  Container restarted but did not become healthy within 60s"
+      )
+    );
+  }
+}
+function readEnvToken() {
+  if (!(0, import_fs14.existsSync)(ENV_FILE)) return "";
+  const content = (0, import_fs14.readFileSync)(ENV_FILE, "utf-8");
+  const match = content.match(/^CORTEX_API_TOKEN=(.*)$/m);
+  return match?.[1]?.trim() ?? "";
+}
+function writeEnvToken(token) {
+  (0, import_fs14.mkdirSync)(CORTEX_DIR, { recursive: true });
+  if (!(0, import_fs14.existsSync)(ENV_FILE)) {
+    (0, import_fs14.writeFileSync)(ENV_FILE, `CORTEX_API_TOKEN=${token}
+`, "utf-8");
+    return;
+  }
+  const content = (0, import_fs14.readFileSync)(ENV_FILE, "utf-8");
+  const updated = content.includes("CORTEX_API_TOKEN=") ? content.replace(/^CORTEX_API_TOKEN=.*$/m, `CORTEX_API_TOKEN=${token}`) : content + `CORTEX_API_TOKEN=${token}
+`;
+  (0, import_fs14.writeFileSync)(ENV_FILE, updated, "utf-8");
+}
+async function tokenCommand(options) {
+  console.log("");
+  console.log(source_default.bold("  \u25C6 Cortex Context \u2014 API Token"));
+  console.log("");
+  if (options.set !== void 0) {
+    const newToken = options.set.trim();
+    if (!newToken) {
+      console.log(
+        source_default.yellow(
+          "  Clearing token \u2014 API will accept all requests (open access)."
+        )
+      );
+    }
+    writeConfig({ token: newToken });
+    writeEnvToken(newToken);
+    console.log(
+      source_default.green(newToken ? "  \u2713 Token updated" : "  \u2713 Token cleared")
+    );
+    console.log("");
+    await applyTokenRestart();
+    console.log("");
+    return;
+  }
+  if (options.rotate) {
+    const { confirm } = await (0, import_prompts6.default)(
+      {
+        type: "confirm",
+        name: "confirm",
+        message: "Generate a new random token? (requires container restart to apply)",
+        initial: true
+      },
+      {
+        onCancel: () => {
+          console.log(source_default.yellow("\n  Aborted."));
+          process.exit(0);
+        }
+      }
+    );
+    if (!confirm) {
+      console.log(source_default.dim("  Aborted."));
+      console.log("");
+      return;
+    }
+    const newToken = (0, import_crypto2.randomBytes)(24).toString("hex");
+    writeConfig({ token: newToken });
+    writeEnvToken(newToken);
+    console.log(source_default.green("  \u2713 New token generated and saved"));
+    console.log("");
+    console.log(source_default.bold("  \u{1F511} New Token:"));
+    console.log(source_default.bold.yellow(`     ${newToken}`));
+    console.log("");
+    const config3 = readConfig();
+    console.log(
+      source_default.dim("  Re-initialize your workspace to update MCP config:")
+    );
+    console.log(
+      source_default.cyan(
+        `    cortex-context init --url ${config3.url ?? "http://localhost:8082"} --token ${newToken}`
+      )
+    );
+    console.log("");
+    await applyTokenRestart();
+    console.log("");
+    return;
+  }
+  const config2 = readConfig();
+  const currentToken = config2.token ?? readEnvToken();
+  if (!currentToken) {
+    console.log(
+      source_default.yellow("  \u26A0  No token configured \u2014 API is in open access mode")
+    );
+    console.log(source_default.dim("  Generate one:  cortex-context token --rotate"));
+    console.log(
+      source_default.dim("  Set one:       cortex-context token --set <value>")
+    );
+  } else if (options.show) {
+    console.log(source_default.bold(`  Token: ${source_default.yellow(currentToken)}`));
+  } else {
+    const masked = currentToken.length > 8 ? currentToken.slice(0, 4) + "\u2022".repeat(currentToken.length - 8) + currentToken.slice(-4) : "\u2022".repeat(currentToken.length);
+    console.log(source_default.dim(`  Token: ${masked}`));
+    console.log(source_default.dim("  Use --show to reveal the full token"));
+  }
+  console.log("");
+}
+
+// src/commands/upgrade.ts
+var import_path16 = require("path");
+var import_os6 = require("os");
+var import_fs15 = require("fs");
+async function upgradeCommand(options) {
+  console.log("");
+  console.log(source_default.bold.cyan("  \u25C6 Cortex Context \u2014 Upgrade"));
+  console.log(
+    source_default.dim(
+      "  Pulls the latest backend image and recreates the cortex-api container."
+    )
+  );
+  console.log("");
+  if (!isDockerAvailable()) {
+    console.error(source_default.red("  \u2717 Docker is not available on $PATH."));
+    console.log(
+      source_default.dim("    Install Docker or ensure it is running, then retry.")
+    );
+    process.exit(1);
+  }
+  const workDir = options.dir ?? (0, import_path16.join)((0, import_os6.homedir)(), ".cortex-context");
+  const composePath = (0, import_path16.join)(workDir, "docker-compose.local.yml");
+  if (!(0, import_fs15.existsSync)(composePath)) {
+    console.error(
+      source_default.red(`  \u2717 docker-compose.local.yml not found in ${workDir}`)
+    );
+    console.log(
+      source_default.dim("    The local Cortex stack has not been set up yet. Run:")
+    );
+    console.log(source_default.cyan("      cortex-context server"));
+    console.log("");
+    process.exit(1);
+  }
+  const imageTag = options.embeddings ? "latest-embeddings" : "latest";
+  const cortexImage = `ghcr.io/rodrigoroldan/cortex-context:${imageTag}`;
+  console.log(source_default.dim(`  Target image: ${cortexImage}`));
+  console.log(source_default.dim(`  Compose dir:  ${workDir}`));
+  console.log("");
+  console.log(source_default.bold("  Step 1 \u2014 Pulling latest image..."));
+  if (options.pullOnly) {
+    const { execSync: execSync3 } = await import("child_process");
+    try {
+      execSync3(
+        `docker compose --project-name cortex-local -f "${composePath}" pull cortex-api`,
+        {
+          cwd: workDir,
+          stdio: ["inherit", "inherit", "pipe"],
+          env: { ...process.env, CORTEX_IMAGE: cortexImage }
+        }
+      );
+      console.log("");
+      console.log(
+        source_default.green("  \u2713 Image pulled successfully (--pull-only mode)")
+      );
+      console.log(
+        source_default.dim(
+          "    Run without --pull-only to recreate the container with the new image."
+        )
+      );
+      console.log("");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(source_default.red(`  \u2717 Pull failed: ${msg}`));
+      process.exit(1);
+    }
+    return;
+  }
+  const result = await upgradeLocalStack(workDir, {
+    embeddings: options.embeddings
+  });
+  if (!result.upgraded) {
+    console.error(source_default.red(`  \u2717 Upgrade failed: ${result.error}`));
+    process.exit(1);
+  }
+  console.log("");
+  console.log(source_default.bold("  Step 2 \u2014 Waiting for Cortex API to be healthy..."));
+  const config2 = readConfig();
+  const cortexUrl = config2.url ?? "http://localhost:8082";
+  const { healthy } = await waitForCortexHealth(cortexUrl, 12e4);
+  console.log("");
+  if (healthy) {
+    console.log(source_default.green("  \u2713 Cortex API is healthy"));
+    console.log("");
+    console.log(source_default.bold("  \u25C6 Upgrade complete!"));
+    console.log(source_default.dim(`    API running at ${cortexUrl}`));
+    console.log("");
+  } else {
+    console.log(
+      source_default.yellow(
+        "  \u26A0  Container is up but did not become healthy within 120s"
+      )
+    );
+    console.log(source_default.dim("    Check container logs:"));
+    console.log(
+      source_default.cyan(
+        `    docker compose -f ${workDir}/docker-compose.local.yml logs cortex-api`
+      )
+    );
+    console.log("");
+    process.exit(1);
+  }
+}
+
+// src/cli.ts
+var import_fs16 = require("fs");
+var import_path17 = require("path");
 var pkg = JSON.parse(
-  (0, import_fs14.readFileSync)((0, import_path15.join)(__dirname, "..", "package.json"), "utf-8")
+  (0, import_fs16.readFileSync)((0, import_path17.join)(__dirname, "..", "package.json"), "utf-8")
 );
 function createCli() {
   const program3 = new Command();
@@ -28655,6 +29071,21 @@ function createCli() {
   program3.command("reset").description(
     "Wipe all nodes and relationships from the Cortex Knowledge Graph (irreversible)"
   ).option("-y, --yes", "Skip confirmation prompt").action(resetCommand);
+  program3.command("token").description(
+    "Show or manage the Cortex API token for the local stack (~/.cortex-context/.env)"
+  ).option("--show", "Reveal the full token (default shows masked)").option("--rotate", "Generate a new random token and save it").option(
+    "--set <value>",
+    "Set a specific token value (empty string clears auth)"
+  ).action(tokenCommand);
+  program3.command("upgrade").description(
+    "Pull the latest Cortex backend image and restart the local stack"
+  ).option(
+    "--dir <path>",
+    "Directory with docker-compose.local.yml (defaults to ~/.cortex-context)"
+  ).option("--embeddings", "Use the embeddings-enabled image variant").option(
+    "--pull-only",
+    "Pull the latest image without recreating the container"
+  ).action(upgradeCommand);
   return program3;
 }