@dashai/cli 0.18.3 → 0.19.0

package/dist/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import pc from 'picocolors';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, mkdtempSync, statSync } from 'fs';
-import { tmpdir, platform, homedir } from 'os';
-import { resolve, join, relative, dirname, basename, sep } from 'path';
+import { hostname, tmpdir, platform, homedir } from 'os';
+import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
 import { Command, Option } from 'commander';
@@ -236,10 +236,13 @@ function asEnvelope(v) {
   const env = v;
   const out2 = {};
   if (typeof env.code === "string") out2.code = env.code;
+  else if (typeof env.error === "string" && CODE_SHAPE.test(env.error)) out2.code = env.error;
   if (typeof env.message === "string") out2.message = env.message;
   if (typeof env.retriable === "boolean") out2.retriable = env.retriable;
   if (env.context && typeof env.context === "object") {
     out2.context = env.context;
+  } else if (env.details && typeof env.details === "object") {
+    out2.context = env.details;
   }
   return out2;
 }
@@ -512,7 +515,7 @@ async function getRuntimeLogs(installationId, opts = {}, options = {}) {
     options
   );
 }
-var ApiError;
+var ApiError, CODE_SHAPE;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     init_config();
@@ -532,6 +535,7 @@ var init_api_client = __esm({
         this.retriable = envelope?.retriable ?? status >= 500;
       }
     };
+    CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
   }
 });
 
@@ -1253,6 +1257,64 @@ var init_dev = __esm({
     PORT_PROBE_LIMIT = 10;
   }
 });
+async function selectWorkspace(opts) {
+  const workspaces = await apiRequest(
+    "GET",
+    "/api/workspaces",
+    void 0,
+    { baseUrl: opts.apiUrl, auth: { token: opts.apiToken } }
+  );
+  if (workspaces.length === 0) {
+    throw new Error(
+      "No workspaces found for your account. Create a workspace at the Dashwise dashboard first."
+    );
+  }
+  if (opts.flag !== void 0) {
+    return matchWorkspaceOrThrow(workspaces, opts.flag);
+  }
+  if (workspaces.length === 1) {
+    return workspaces[0];
+  }
+  if (opts.interactive && process.stdout.isTTY) {
+    const choice = await select({
+      message: "Which workspace should this module live in?",
+      options: workspaces.map((w) => ({
+        value: w.slug,
+        label: w.name,
+        hint: `slug=${w.slug}, id=${w.id}`
+      }))
+    });
+    if (isCancel(choice)) {
+      throw new Error("Aborted.");
+    }
+    const picked = workspaces.find((w) => w.slug === choice);
+    if (!picked) {
+      throw new Error(`Internal error: selection "${String(choice)}" did not match any workspace.`);
+    }
+    return picked;
+  }
+  const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
+  throw new Error(
+    `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
+${list}`
+  );
+}
+function matchWorkspaceOrThrow(workspaces, flag) {
+  const asNumber = Number.parseInt(flag, 10);
+  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
+  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
+  if (!match) {
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
+    throw new Error(`No workspace matching --workspace=${flag}. Available:
+${list}`);
+  }
+  return match;
+}
+var init_workspaces = __esm({
+  "src/lib/workspaces.ts"() {
+    init_api_client();
+  }
+});
 
 // src/lib/scaffold.ts
 function isDeployTarget(value) {
@@ -3752,64 +3814,6 @@ var init_scaffold = __esm({
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
-async function selectWorkspace(opts) {
-  const workspaces = await apiRequest(
-    "GET",
-    "/api/workspaces",
-    void 0,
-    { baseUrl: opts.apiUrl, auth: { token: opts.apiToken } }
-  );
-  if (workspaces.length === 0) {
-    throw new Error(
-      "No workspaces found for your account. Create a workspace at the Dashwise dashboard first."
-    );
-  }
-  if (opts.flag !== void 0) {
-    return matchWorkspaceOrThrow(workspaces, opts.flag);
-  }
-  if (workspaces.length === 1) {
-    return workspaces[0];
-  }
-  if (opts.interactive && process.stdout.isTTY) {
-    const choice = await select({
-      message: "Which workspace should this module live in?",
-      options: workspaces.map((w) => ({
-        value: w.slug,
-        label: w.name,
-        hint: `slug=${w.slug}, id=${w.id}`
-      }))
-    });
-    if (isCancel(choice)) {
-      throw new Error("Aborted.");
-    }
-    const picked = workspaces.find((w) => w.slug === choice);
-    if (!picked) {
-      throw new Error(`Internal error: selection "${String(choice)}" did not match any workspace.`);
-    }
-    return picked;
-  }
-  const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
-  throw new Error(
-    `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
-${list}`
-  );
-}
-function matchWorkspaceOrThrow(workspaces, flag) {
-  const asNumber = Number.parseInt(flag, 10);
-  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
-  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
-  if (!match) {
-    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
-    throw new Error(`No workspace matching --workspace=${flag}. Available:
-${list}`);
-  }
-  return match;
-}
-var init_workspaces = __esm({
-  "src/lib/workspaces.ts"() {
-    init_api_client();
-  }
-});
 async function moduleInitCommand(slugArg, options) {
   intro("Scaffolding a new Dashwise module");
   let slug = slugArg;
@@ -5357,22 +5361,81 @@ init_dev();
 
 // src/commands/login.ts
 init_api_client();
+
+// src/lib/device-code.ts
+init_api_client();
+var DEFAULT_TOKEN_NAME = "dashwise-cli";
+async function requestDeviceCode(args) {
+  return await apiRequest(
+    "POST",
+    "/api/auth/cli/device-code",
+    { name: args.name ?? DEFAULT_TOKEN_NAME },
+    { auth: "public", baseUrl: args.apiUrl }
+  );
+}
+async function pollForApproval(args) {
+  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = args.now ?? (() => Date.now());
+  const pollIntervalMs = Math.max(1e3, args.intervalSeconds * 1e3);
+  const deadline = now() + args.expiresInSeconds * 1e3;
+  while (now() < deadline) {
+    let res;
+    try {
+      res = await apiRequest(
+        "POST",
+        "/api/auth/cli/poll",
+        { deviceCode: args.deviceCode },
+        { auth: "public", baseUrl: args.apiUrl }
+      );
+    } catch (err) {
+      return { status: "error", message: err.message };
+    }
+    switch (res.status) {
+      case "pending":
+      case "slow_down":
+        await sleep4(pollIntervalMs);
+        continue;
+      case "denied":
+        return { status: "denied" };
+      case "expired":
+        return { status: "expired" };
+      case "approved":
+        if (!res.token || !res.tokenId) return { status: "no_token" };
+        return { status: "approved", token: res.token, tokenId: res.tokenId };
+    }
+  }
+  return { status: "timeout" };
+}
+async function fetchProfile(args) {
+  return await apiRequest("GET", "/api/auth/me", void 0, {
+    auth: { token: args.token },
+    baseUrl: args.apiUrl
+  });
+}
+function buildCliConfig(args) {
+  return {
+    apiUrl: args.apiUrl,
+    token: args.token,
+    tokenId: args.tokenId,
+    user: {
+      id: args.me.id,
+      email: args.me.email,
+      username: args.me.username,
+      firstName: args.me.first_name,
+      lastName: args.me.last_name
+    }
+  };
+}
+
+// src/commands/login.ts
 init_config();
 init_output();
-var DEFAULT_TOKEN_NAME = "dashwise-cli";
 async function loginCommand(options) {
   const apiUrl = (options.apiUrl ?? resolveApiUrl()).replace(/\/+$/, "");
   intro(`Logging into ${code(apiUrl)}`);
   let dc;
   try {
-    dc = await apiRequest(
-      "POST",
-      "/api/auth/cli/device-code",
-      {
-        name: options.name ?? DEFAULT_TOKEN_NAME
-      },
-      { auth: "public", baseUrl: apiUrl }
-    );
+    dc = await requestDeviceCode({ apiUrl, name: options.name ?? DEFAULT_TOKEN_NAME });
   } catch (err) {
     fail(formatApiError("Could not start login flow", err));
     return 1;
@@ -5412,85 +5475,50 @@ async function loginCommand(options) {
   }
   const sp = spinner();
   sp.start("Waiting for approval");
-  const overallDeadline = Date.now() + dc.expiresIn * 1e3;
-  let outcome = null;
-  const pollIntervalMs = Math.max(1e3, dc.interval * 1e3);
-  pollLoop: while (Date.now() < overallDeadline) {
-    let res;
-    try {
-      res = await apiRequest(
-        "POST",
-        "/api/auth/cli/poll",
-        { deviceCode: dc.deviceCode },
-        { auth: "public", baseUrl: apiUrl }
-      );
-    } catch (err) {
-      sp.stop(`Poll failed: ${err.message}`);
+  const outcome = await pollForApproval({
+    apiUrl,
+    deviceCode: dc.deviceCode,
+    intervalSeconds: dc.interval,
+    expiresInSeconds: dc.expiresIn
+  });
+  switch (outcome.status) {
+    case "error":
+      sp.stop(`Poll failed: ${outcome.message}`);
       fail("Poll failed mid-flight; you can re-run `dashwise login` to retry.");
       return 1;
-    }
-    switch (res.status) {
-      case "pending":
-      case "slow_down":
-        await sleep(pollIntervalMs);
-        continue pollLoop;
-      case "denied":
-        sp.stop("Login denied by user.");
-        cancel("Aborted.");
-        return 1;
-      case "expired":
-        sp.stop("Login code expired.");
-        fail("The code expired before approval. Run `dashwise login` again.");
-        return 1;
-      case "approved":
-        outcome = res;
-        break pollLoop;
-    }
-  }
-  if (!outcome) {
-    sp.stop("Timed out waiting for approval.");
-    fail("Login took too long to be approved. Run `dashwise login` again.");
-    return 1;
-  }
-  if (!outcome.token || !outcome.tokenId) {
-    sp.stop("Approval received but token missing from response.");
-    fail(
-      "Approval received but the backend did not return a token. Run `dashwise logout` then `dashwise login` to retry."
-    );
-    return 1;
+    case "denied":
+      sp.stop("Login denied by user.");
+      cancel("Aborted.");
+      return 1;
+    case "expired":
+      sp.stop("Login code expired.");
+      fail("The code expired before approval. Run `dashwise login` again.");
+      return 1;
+    case "timeout":
+      sp.stop("Timed out waiting for approval.");
+      fail("Login took too long to be approved. Run `dashwise login` again.");
+      return 1;
+    case "no_token":
+      sp.stop("Approval received but token missing from response.");
+      fail(
+        "Approval received but the backend did not return a token. Run `dashwise logout` then `dashwise login` to retry."
+      );
+      return 1;
   }
   let me;
   try {
-    me = await apiRequest("GET", "/api/auth/me", void 0, {
-      auth: { token: outcome.token },
-      baseUrl: apiUrl
-    });
+    me = await fetchProfile({ apiUrl, token: outcome.token });
   } catch (err) {
     sp.stop("Approval accepted but profile fetch failed.");
     fail(formatApiError("Could not load user profile", err));
     return 1;
   }
-  const cfg = {
-    apiUrl,
-    token: outcome.token,
-    tokenId: outcome.tokenId,
-    user: {
-      id: me.id,
-      email: me.email,
-      username: me.username,
-      firstName: me.first_name,
-      lastName: me.last_name
-    }
-  };
-  writeConfig(cfg);
+  writeConfig(buildCliConfig({ apiUrl, token: outcome.token, tokenId: outcome.tokenId, me }));
   sp.stop("Approved.");
   success(`Logged in as ${code(me.email)}`);
   outro("You can now run `dashwise profile`, `dashwise workspace list`, etc.");
   return 0;
 }
-function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
-}
 function formatSeconds(seconds) {
   if (seconds < 60) return `${seconds}s`;
   const minutes = Math.round(seconds / 60);
@@ -5503,156 +5531,1214 @@ function formatApiError(prefix, err) {
   if (err instanceof Error) return `${prefix}: ${err.message}`;
   return `${prefix}: ${String(err)}`;
 }
-
-// src/commands/logout.ts
-init_api_client();
-init_config();
-init_output();
-async function logoutCommand() {
-  let cfg;
-  try {
-    cfg = readConfig();
-  } catch {
-    deleteConfig();
-    success("Cleared a corrupted local credential file.");
-    return 0;
+
+// src/commands/logout.ts
+init_api_client();
+init_config();
+init_output();
+async function logoutCommand() {
+  let cfg;
+  try {
+    cfg = readConfig();
+  } catch {
+    deleteConfig();
+    success("Cleared a corrupted local credential file.");
+    return 0;
+  }
+  if (!cfg) {
+    info("Already logged out (no saved credentials).");
+    return 0;
+  }
+  try {
+    await apiRequest(
+      "DELETE",
+      `/api/auth/cli-tokens/${cfg.tokenId}`,
+      void 0,
+      { auth: { token: cfg.token }, baseUrl: cfg.apiUrl }
+    );
+  } catch (err) {
+    warn(
+      `Could not revoke the server-side token (${err.message}). Local credentials cleared anyway.`
+    );
+  }
+  deleteConfig();
+  success(`Logged out ${code(cfg.user.email)}`);
+  return 0;
+}
+
+// src/commands/profile.ts
+init_api_client();
+init_config();
+init_output();
+async function profileCommand(options = {}) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let me = null;
+  let refreshError = null;
+  try {
+    me = await apiRequest("GET", "/api/auth/me");
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." } }));
+      } else {
+        fail("Saved token is no longer valid. Run `dashwise login` again.");
+      }
+      return 1;
+    }
+    refreshError = err.message;
+    if (!options.json) {
+      warn(
+        `Could not refresh profile from the server (${refreshError}). Showing cached values.`
+      );
+    }
+  }
+  if (me) {
+    const refreshed = {
+      ...cfg,
+      user: {
+        id: me.id,
+        email: me.email,
+        username: me.username,
+        firstName: me.first_name,
+        lastName: me.last_name
+      }
+    };
+    writeConfig(refreshed);
+  }
+  const u = me ?? toMe(cfg.user);
+  let workspaces = [];
+  let workspaceError = null;
+  try {
+    const fetched = await apiRequest(
+      "GET",
+      "/api/workspaces"
+    );
+    workspaces = Array.isArray(fetched) ? fetched : [];
+  } catch (err) {
+    workspaceError = err.message;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        user: {
+          id: u.id,
+          username: u.username,
+          email: u.email,
+          first_name: u.first_name,
+          last_name: u.last_name
+        },
+        default_workspace: cfg.workspaceSlug ?? null,
+        workspaces,
+        api_url: cfg.apiUrl,
+        ...refreshError ? { profile_refresh_error: refreshError } : {},
+        ...workspaceError ? { workspaces_error: workspaceError } : {}
+      })
+    );
+    return 0;
+  }
+  out("");
+  kv("User ID", `${u.id}`);
+  kv("Username", u.username);
+  kv("Email", u.email);
+  kv("Name", `${u.first_name} ${u.last_name}`.trim() || dim("(not set)"));
+  out("");
+  if (workspaceError) {
+    warn(
+      `Could not list workspaces (${workspaceError}). Try \`dashwise workspace list\`.`
+    );
+  } else if (workspaces.length === 0) {
+    info("No workspaces yet.");
+  } else {
+    kv("Workspaces", `${workspaces.length}`);
+    for (const w of workspaces) {
+      const slug = w.slug ?? `id:${w.id}`;
+      const role = w.role ?? w.permissions ?? "";
+      const star = cfg.workspaceSlug === slug ? code(" (default)") : "";
+      out(`  - ${slug}${role ? dim(` [${role}]`) : ""}${star}  ${dim(w.name)}`);
+    }
+  }
+  out("");
+  kv("API URL", cfg.apiUrl);
+  return 0;
+}
+function toMe(cached) {
+  return {
+    id: cached.id,
+    email: cached.email,
+    username: cached.username,
+    first_name: cached.firstName,
+    last_name: cached.lastName,
+    is_staff: false,
+    is_active: true,
+    date_joined: ""
+  };
+}
+
+// src/commands/mcp.ts
+init_api_client();
+init_config();
+var SESSION_HEADER = "mcp-session-id";
+var PROTOCOL_HEADER = "MCP-Protocol-Version";
+var ACCEPT = "application/json, text/event-stream";
+var PROXY_TOOLS_LIST_ID = "dashwise-cli:tools-list";
+var PROXY_REINITIALIZE_ID = "dashwise-cli:reinitialize";
+function defaultEndpointLabel() {
+  const raw = hostname() || "unknown";
+  const cleaned = raw.replace(/\.local$/i, "").replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
+  return cleaned.length > 0 ? cleaned : "unknown";
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const segments = parsed.pathname.split("/");
+    if (segments.length > 0) segments[segments.length - 1] = "\u2026";
+    return `${parsed.origin}${segments.join("/")}`;
+  } catch {
+    return "<invalid url>";
+  }
+}
+function inspectElement(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const frame = value;
+  const id = typeof frame.id === "string" || typeof frame.id === "number" ? frame.id : null;
+  const method = typeof frame.method === "string" ? frame.method : void 0;
+  let toolName;
+  if (method === "tools/call" && frame.params && typeof frame.params === "object") {
+    const name = frame.params.name;
+    if (typeof name === "string") toolName = name;
+  }
+  return { id, method, toolName };
+}
+function inspectFrame(text4) {
+  let value;
+  try {
+    value = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (Array.isArray(value)) {
+    const elements = value.map(inspectElement).filter((e) => e !== null);
+    return {
+      id: null,
+      method: void 0,
+      toolName: void 0,
+      isBatch: true,
+      elements
+    };
+  }
+  const single = inspectElement(value);
+  if (!single) return null;
+  return { ...single, isBatch: false, elements: [single] };
+}
+function readOnlyToolsFrom(text4) {
+  let value;
+  try {
+    value = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const result = value.result;
+  if (!result || typeof result !== "object") return null;
+  const tools = result.tools;
+  if (!Array.isArray(tools)) return null;
+  const out2 = /* @__PURE__ */ new Set();
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object") continue;
+    const t = tool;
+    const name = typeof t.name === "string" ? t.name : null;
+    const annotations = t.annotations;
+    if (name && annotations && typeof annotations === "object" && annotations.readOnlyHint === true) {
+      out2.add(name);
+    }
+  }
+  return out2;
+}
+function isReadOnlyRefusal(id, toolName, knownReadTools) {
+  const reason = knownReadTools === null ? `Refused: \`dashwise mcp --read-only\` could not read this server's tool list, so it cannot tell reads from writes and refuses everything. Reconnect without --read-only to use "${toolName}".` : `Refused: "${toolName}" is not a read-only tool and this session was started with \`dashwise mcp --read-only\`. Reconnect without the flag to use it.`;
+  return {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      isError: true,
+      content: [{ type: "text", text: reason }]
+    }
+  };
+}
+function transportErrorFrame(id, message) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    // -32000 is the JSON-RPC "implementation-defined server error" band. A
+    // dead pipe with NO frame is the one outcome worth avoiding above all
+    // others: it leaves Claude Code waiting forever on a request that will
+    // never be answered (`cli-mcp-command.md` §4.4).
+    error: { code: -32e3, message }
+  };
+}
+function startMcpProxy(opts) {
+  const stdin = opts.stdin ?? process.stdin;
+  const stdout = opts.stdout ?? process.stdout;
+  const log2 = opts.log ?? ((line) => process.stderr.write(`${line}
+`));
+  const doFetch = opts.fetchImpl ?? globalThis.fetch;
+  const reconnectMs = opts.reconnectMs ?? 2e3;
+  const verbose = opts.verbose === true;
+  const readOnly = opts.readOnly === true;
+  let session = opts.session;
+  let sessionId = null;
+  let protocolVersion = null;
+  let readTools = null;
+  let reauthAttempt = null;
+  let reauthSpent = false;
+  let stopped = false;
+  let exitCode = 0;
+  let streamTimer = null;
+  let streamAbort = null;
+  let streamUnavailable = false;
+  let streamStarted = false;
+  let resolveDone;
+  const done = new Promise((resolve13) => {
+    resolveDone = resolve13;
+  });
+  const trace = (line) => {
+    if (verbose) log2(line);
+  };
+  const emit = (payload) => {
+    stdout.write(`${JSON.stringify(payload)}
+`);
+  };
+  const emitFrame = (text4, source) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(text4);
+    } catch {
+      log2(
+        `Discarded a non-JSON response from ${redactUrl(session.connectUrl)} (${source}); stdout carries MCP frames only.`
+      );
+      trace(`discarded ${Buffer.byteLength(text4, "utf8")} bytes of non-JSON`);
+      return;
+    }
+    const looksJsonRpc = Array.isArray(parsed) ? parsed.every(
+      (e) => e !== null && typeof e === "object" && "jsonrpc" in e
+    ) : parsed !== null && typeof parsed === "object" && "jsonrpc" in parsed;
+    if (!looksJsonRpc) {
+      log2(
+        `Discarded a JSON response from ${redactUrl(session.connectUrl)} that is not JSON-RPC (${source}).`
+      );
+      return;
+    }
+    if (text4.includes("\n") || text4.includes("\r")) {
+      trace("reflowed a multi-line frame onto one line (stdio is line-delimited)");
+      stdout.write(`${text4.replace(/[\r\n]+/g, " ")}
+`);
+      return;
+    }
+    stdout.write(`${text4}
+`);
+  };
+  const requestHeaders = (isInitialize) => {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: ACCEPT
+    };
+    if (sessionId) headers["Mcp-Session-Id"] = sessionId;
+    if (protocolVersion && !isInitialize) {
+      headers[PROTOCOL_HEADER] = protocolVersion;
+    }
+    return headers;
+  };
+  const attemptReauth = () => {
+    if (reauthAttempt !== null && !reauthSpent) return reauthAttempt;
+    if (reauthSpent || !opts.reauth) return Promise.resolve(false);
+    const reauth = opts.reauth;
+    reauthAttempt = (async () => {
+      log2("The session key expired or was rotated \u2014 re-authenticating once.");
+      try {
+        session = await reauth();
+        sessionId = null;
+        return true;
+      } catch (err) {
+        log2(`Re-authentication failed: ${err.message}`);
+        return false;
+      } finally {
+        reauthSpent = true;
+      }
+    })();
+    return reauthAttempt;
+  };
+  const reinitialize = async () => {
+    const frame = JSON.stringify({
+      jsonrpc: "2.0",
+      id: PROXY_REINITIALIZE_ID,
+      method: "initialize",
+      params: {
+        // Echo what was negotiated the first time, so the server is not asked
+        // to renegotiate a version the client upstream has already committed
+        // to. The floor is only reached if we never saw a handshake at all.
+        protocolVersion: protocolVersion ?? "2024-11-05",
+        capabilities: {},
+        clientInfo: { name: "dashwise-cli", version: "0" }
+      }
+    });
+    try {
+      const res = await post(frame, true);
+      if (!res || !res.ok) {
+        trace(`re-initialize refused (HTTP ${res?.status ?? "none"}).`);
+        return false;
+      }
+      captureTransportState(res, await res.text());
+      return sessionId !== null;
+    } catch (err) {
+      trace(`re-initialize failed: ${err.message}`);
+      return false;
+    }
+  };
+  const post = async (text4, isInitialize) => {
+    if (stopped) return null;
+    return doFetch(session.connectUrl, {
+      method: "POST",
+      headers: requestHeaders(isInitialize),
+      body: text4
+    });
+  };
+  const captureTransportState = (res, bodyText) => {
+    const returned = res.headers.get(SESSION_HEADER);
+    if (returned) sessionId = returned;
+    if (protocolVersion === null) {
+      try {
+        const parsed = JSON.parse(bodyText);
+        const result = parsed.result;
+        const negotiated = result?.protocolVersion;
+        if (typeof negotiated === "string") protocolVersion = negotiated;
+      } catch {
+      }
+    }
+    const learned = readOnlyToolsFrom(bodyText);
+    if (learned !== null) readTools = learned;
+  };
+  const relay = async (text4, frame) => {
+    const isInitialize = frame?.method === "initialize";
+    let res;
+    try {
+      res = await post(text4, isInitialize);
+    } catch (err) {
+      const message = err.message;
+      log2(`Transport error talking to ${redactUrl(session.connectUrl)}: ${message}`);
+      emit(transportErrorFrame(frame?.id ?? null, `Transport error: ${message}`));
+      return { kind: "failed" };
+    }
+    if (res === null) return { kind: "failed" };
+    if (res.status === 401 && opts.reauth) {
+      const fresh = await attemptReauth();
+      if (!fresh) {
+        emit(
+          transportErrorFrame(
+            frame?.id ?? null,
+            "Re-authentication failed; the Dashwise session could not be renewed."
+          )
+        );
+        exitCode = 1;
+        stop();
+        return { kind: "failed" };
+      }
+      res = await post(text4, isInitialize);
+      if (res === null) return { kind: "failed" };
+    }
+    const bodyText = await res.text();
+    if (!res.ok) {
+      const detail = res.status === 401 ? "the endpoint key is no longer valid (expired, rotated by another `dashwise mcp`, or revoked)" : `HTTP ${res.status}`;
+      log2(`Refused by ${redactUrl(session.connectUrl)}: ${detail}`);
+      emit(transportErrorFrame(frame?.id ?? null, `Dashwise MCP server: ${detail}`));
+      if (res.status === 401) {
+        exitCode = 1;
+        stop();
+      }
+      return { kind: "failed" };
+    }
+    captureTransportState(res, bodyText);
+    if (res.status === 202 || bodyText.trim().length === 0) {
+      return { kind: "empty" };
+    }
+    return { kind: "body", text: bodyText };
+  };
+  const learnReadOnlyTools = async () => {
+    if (!readOnly || readTools !== null || stopped) return;
+    const probe = JSON.stringify({
+      jsonrpc: "2.0",
+      id: PROXY_TOOLS_LIST_ID,
+      method: "tools/list",
+      params: {}
+    });
+    try {
+      const res = await post(probe, false);
+      if (!res || !res.ok) {
+        trace("read-only guard: tools/list probe was refused; failing closed.");
+        return;
+      }
+      const text4 = await res.text();
+      captureTransportState(res, text4);
+      const learned = readOnlyToolsFrom(text4);
+      trace(`read-only guard: ${learned?.size ?? 0} read-only tools learned from tools/list.`);
+    } catch (err) {
+      trace(
+        `read-only guard: tools/list probe failed (${err.message}); failing closed.`
+      );
+    }
+  };
+  const handleLine = async (line) => {
+    const text4 = line.trim();
+    if (text4.length === 0) return;
+    const frame = inspectFrame(text4);
+    trace(
+      `\u2192 ${frame?.method ?? (frame?.isBatch ? "batch" : "frame")} (${Buffer.byteLength(text4, "utf8")} bytes)`
+    );
+    const refusable = readOnly ? (frame?.elements ?? []).filter(
+      (e) => e.toolName !== void 0 && !readTools?.has(e.toolName)
+    ) : [];
+    if (refusable.length > 0) {
+      const names = refusable.map((e) => e.toolName).join(", ");
+      trace(
+        `read-only guard refused ${names}${frame?.isBatch ? " (whole batch)" : ""}`
+      );
+      if (frame?.isBatch) {
+        const replies = frame.elements.filter((e) => e.id !== null).map(
+          (e) => isReadOnlyRefusal(e.id, e.toolName ?? "(batch)", readTools)
+        );
+        if (replies.length > 0) emit(replies);
+      } else {
+        emit(isReadOnlyRefusal(frame.id, refusable[0].toolName, readTools));
+      }
+      return;
+    }
+    const outcome = await relay(text4, frame);
+    if (outcome.kind === "failed") return;
+    if (outcome.kind === "body") {
+      trace(`\u2190 response (${Buffer.byteLength(outcome.text, "utf8")} bytes)`);
+      emitFrame(outcome.text, "POST response");
+    }
+    if (frame?.method === "initialize") {
+      await learnReadOnlyTools();
+    } else if (frame?.method === "notifications/initialized") {
+      openServerStream();
+    }
+  };
+  const scheduleStreamRetry = () => {
+    if (stopped || streamUnavailable) return;
+    streamTimer = setTimeout(() => {
+      streamTimer = null;
+      void runServerStream();
+    }, reconnectMs);
+  };
+  const runServerStream = async () => {
+    if (stopped || streamUnavailable) return;
+    streamAbort = new AbortController();
+    let res;
+    try {
+      res = await doFetch(session.connectUrl, {
+        method: "GET",
+        headers: {
+          Accept: "text/event-stream",
+          ...sessionId ? { "Mcp-Session-Id": sessionId } : {},
+          ...protocolVersion ? { [PROTOCOL_HEADER]: protocolVersion } : {}
+        },
+        signal: streamAbort.signal
+      });
+    } catch (err) {
+      if (stopped) return;
+      trace(`server stream: ${err.message}; retrying.`);
+      scheduleStreamRetry();
+      return;
+    }
+    if (res.status === 405 || res.status === 404) {
+      streamUnavailable = true;
+      trace(
+        `server stream: this server has no server-initiated stream (HTTP ${res.status}); not retrying.`
+      );
+      return;
+    }
+    if (res.status === 401) {
+      const fresh = await attemptReauth();
+      if (fresh) {
+        if (await reinitialize()) {
+          streamUnavailable = false;
+          streamStarted = false;
+          trace("server stream: re-authenticated and re-initialized; reopening.");
+          openServerStream();
+          return;
+        }
+        trace("server stream: re-authenticated but could not re-initialize.");
+      }
+      streamUnavailable = true;
+      log2(
+        `Server stream refused by ${redactUrl(session.connectUrl)}: the session could not be renewed (the endpoint key expired, was rotated, or was revoked).`
+      );
+      emit(
+        transportErrorFrame(
+          null,
+          "Dashwise MCP server: the session could not be renewed; the server stream is closed."
+        )
+      );
+      exitCode = 1;
+      stop();
+      return;
+    }
+    if (!res.ok || !res.body) {
+      streamUnavailable = true;
+      trace(
+        `server stream: HTTP ${res.status}${res.body ? "" : " with no body"}; not retrying.`
+      );
+      return;
+    }
+    trace("server stream: open.");
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer2 = "";
+    try {
+      for (; ; ) {
+        const { done: finished, value } = await reader.read();
+        if (finished) break;
+        buffer2 += decoder.decode(value, { stream: true });
+        let sep2 = buffer2.indexOf("\n\n");
+        while (sep2 !== -1) {
+          const event = buffer2.slice(0, sep2);
+          buffer2 = buffer2.slice(sep2 + 2);
+          const payload = eventData(event);
+          if (payload !== null) emitFrame(payload, "server stream");
+          sep2 = buffer2.indexOf("\n\n");
+        }
+      }
+    } catch (err) {
+      if (!stopped) trace(`server stream dropped: ${err.message}`);
+    }
+    if (!stopped) {
+      trace("server stream closed; reconnecting.");
+      scheduleStreamRetry();
+    }
+  };
+  const openServerStream = () => {
+    if (streamStarted || stopped) return;
+    streamStarted = true;
+    void runServerStream();
+  };
+  let pending = Promise.resolve();
+  let buffer = "";
+  const onData = (chunk) => {
+    buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    let nl = buffer.indexOf("\n");
+    while (nl !== -1) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      pending = pending.then(() => handleLine(line));
+      nl = buffer.indexOf("\n");
+    }
+  };
+  const onEnd = () => {
+    void pending.then(() => {
+      stop();
+    });
+  };
+  stdin.on("data", onData);
+  stdin.on("end", onEnd);
+  stdin.on("close", onEnd);
+  if (typeof stdin.resume === "function") {
+    stdin.resume();
+  }
+  function stop() {
+    if (stopped) return;
+    stopped = true;
+    if (streamTimer) {
+      clearTimeout(streamTimer);
+      streamTimer = null;
+    }
+    if (streamAbort) {
+      streamAbort.abort();
+      streamAbort = null;
+    }
+    stdin.off("data", onData);
+    stdin.off("end", onEnd);
+    stdin.off("close", onEnd);
+    if (typeof stdin.pause === "function") {
+      stdin.pause();
+    }
+    resolveDone(exitCode);
+  }
+  return {
+    stop,
+    isRunning: () => !stopped,
+    done
+  };
+}
+function eventData(event) {
+  const parts = [];
+  for (const line of event.split("\n")) {
+    if (!line.startsWith("data:")) continue;
+    const chunk = line.slice(5);
+    parts.push(chunk.startsWith(" ") ? chunk.slice(1) : chunk);
+  }
+  if (parts.length === 0) return null;
+  const payload = parts.join("\n").trim();
+  return payload.length > 0 ? payload : null;
+}
+
+// src/lib/mcp-scope.ts
+var MCP_SCOPES_MAX_ITEMS = 64;
+var MAX_ID = 2147483647;
+var SCOPE_PATTERN = /^datahub:(?:(table|app)=([1-9][0-9]{0,9})|(workspace)):([crud]{1,4})$/;
+var MCP_GOVERNANCE_WORKSPACE_READ_SCOPE = "governance:workspace:r";
+var GRAMMAR_HINT = "Expected datahub:table=<id>:<ops>, datahub:app=<id>:<ops>, datahub:workspace:<ops> or governance:workspace:r, where <ops> is one to four of c, r, u and d, each at most once.";
+function isMcpScope(raw) {
+  if (typeof raw !== "string") return false;
+  if (raw === MCP_GOVERNANCE_WORKSPACE_READ_SCOPE) return true;
+  const match = SCOPE_PATTERN.exec(raw);
+  if (!match) return false;
+  const idText = match[2];
+  const opsText = match[4];
+  if (new Set(opsText).size !== opsText.length) return false;
+  if (idText !== void 0) {
+    const id = Number(idText);
+    if (!Number.isSafeInteger(id) || id > MAX_ID) return false;
+  }
+  return true;
+}
+function checkMcpScopes(scopes, flag = "--scope") {
+  if (scopes.length > MCP_SCOPES_MAX_ITEMS) {
+    return {
+      ok: false,
+      message: `At most ${MCP_SCOPES_MAX_ITEMS} ${flag} grants fit one session; got ${scopes.length}.`
+    };
+  }
+  const bad = scopes.findIndex((scope) => !isMcpScope(scope));
+  if (bad !== -1) {
+    return {
+      ok: false,
+      message: `${flag} ${JSON.stringify(scopes[bad])} is not a scope. ${GRAMMAR_HINT}`
+    };
+  }
+  return { ok: true };
+}
+
+// src/commands/mcp.ts
+init_output();
+function fileExists(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function whereOnWindows(cmd, env, isFile) {
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  for (const dir of (env.PATH ?? env.Path ?? "").split(";")) {
+    if (!dir) continue;
+    for (const ext of extensions) {
+      const candidate = win32.join(dir, `${cmd}${ext.toLowerCase()}`);
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  return void 0;
+}
+function spawnTarget(cmd, args, opts = {}) {
+  const direct = { command: cmd, args, shell: false };
+  if ((opts.platform ?? process.platform) !== "win32") return direct;
+  const found = whereOnWindows(cmd, opts.env ?? process.env, opts.isFile ?? fileExists);
+  if (found === void 0 || !/\.(cmd|bat)$/i.test(found)) return direct;
+  const unsafe = args.find((arg) => /["%\r\n]/.test(arg));
+  if (unsafe !== void 0) {
+    return {
+      refused: `cannot pass ${JSON.stringify(unsafe)} to ${found}: cmd.exe would act on the quote, % or line break in it.`
+    };
+  }
+  return { command: [found, ...args].map((part) => `"${part}"`).join(" "), args: [], shell: true };
+}
+
+// src/commands/mcp.ts
+init_workspaces();
+var SCOPES_NOT_APPLIED = "This Dashwise server minted the session but did not confirm any scopes, so the key is NOT narrowed. The session was not started, and its revocation was requested. Update the backend, or run without --scope.";
+var REVOKE_TIMEOUT_MS = 2e3;
+async function openCliSession(args) {
+  const res = await apiRequest("POST", "/api/mcp-endpoints/cli-session", {
+    workspace: args.workspaceId,
+    label: args.label,
+    // Only when the flag was given: a body without the key is what every
+    // backend accepts, and one before `--scope` refuses the key as unknown.
+    ...args.scopes !== void 0 ? { scopes: args.scopes } : {}
+  });
+  return {
+    connectUrl: res.connect_url,
+    endpointId: res.endpoint_id,
+    expiresAt: res.expires_at,
+    name: res.name,
+    scopes: res.scopes
+  };
+}
+function describeScopes(scopes) {
+  if (scopes === null || scopes === void 0) {
+    return "Scopes: none \u2014 this key reaches what your account can in this workspace (narrow it with --scope).";
+  }
+  if (scopes.length === 0) return "Scopes: deny-all \u2014 no data tool is available to this key.";
+  return `Scopes (as stored by the server): ${scopes.join(", ")}.`;
+}
+async function revokeSession(endpointId) {
+  const attempt = apiRequest("POST", `/api/mcp-endpoints/${endpointId}/revoke`).then(
+    () => true,
+    () => false
+  );
+  const timeout = new Promise(
+    (resolve13) => setTimeout(() => resolve13(false), REVOKE_TIMEOUT_MS).unref()
+  );
+  await Promise.race([attempt, timeout]);
+}
+function describeSessionError(err, apiUrl, scopes) {
+  if (!(err instanceof ApiError)) return err.message;
+  if (err.status === 0) {
+    return `Could not reach the Dashwise backend at ${apiUrl}: ${err.message}`;
+  }
+  if (err.status === 401) {
+    return "Your saved credentials are no longer valid. Run `dashwise login` again.";
+  }
+  if (err.code === "SCOPE_EXCEEDS_CREATOR_ACCESS") {
+    const scope = typeof err.context?.scope === "string" ? err.context.scope : void 0;
+    const lead = scope ? `--scope ${scope} reaches beyond your own access in this workspace` : "A --scope grant reaches beyond your own access in this workspace";
+    return `${lead}; a scope can only narrow what you can already do. ${err.message}`;
+  }
+  if (err.code === "SCOPE_MALFORMED") {
+    const index = typeof err.context?.index === "number" ? err.context.index : void 0;
+    const grant = index !== void 0 ? scopes?.[index] : void 0;
+    return grant !== void 0 ? `The server does not accept --scope ${grant}: ${err.message}` : `The server refused --scope: ${err.message}`;
+  }
+  if (scopes !== void 0 && err.status === 400 && /\bscopes\b/.test(err.message)) {
+    return `The server refused the scopes field (${err.message}). A Dashwise backend older than --scope answers this way; update it, or run without --scope.`;
+  }
+  return err.message;
+}
+async function resolveWorkspace(apiUrl, apiToken, flag) {
+  const cfg = readConfig();
+  const wanted = flag ?? cfg?.workspaceSlug;
+  return selectWorkspace({
+    apiUrl,
+    apiToken,
+    ...wanted !== void 0 ? { flag: wanted } : {},
+    // Never interactive: this command's stdout is a protocol channel and its
+    // stdin belongs to the MCP client. A prompt here would deadlock a client
+    // that launched us as a subprocess.
+    interactive: false
+  });
+}
+async function mcpCommand(options = {}) {
+  const scopes = options.scopes;
+  if (scopes !== void 0) {
+    const checked = checkMcpScopes(scopes);
+    if (!checked.ok) {
+      fail(checked.message);
+      return 1;
+    }
   }
+  const cfg = readConfig();
   if (!cfg) {
-    info("Already logged out (no saved credentials).");
-    return 0;
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
   }
+  const apiUrl = resolveApiUrl();
+  let workspace2;
   try {
-    await apiRequest(
-      "DELETE",
-      `/api/auth/cli-tokens/${cfg.tokenId}`,
-      void 0,
-      { auth: { token: cfg.token }, baseUrl: cfg.apiUrl }
-    );
+    workspace2 = await resolveWorkspace(apiUrl, cfg.token, options.workspace);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const label = options.endpointName ?? defaultEndpointLabel();
+  let session;
+  try {
+    session = await openCliSession({
+      workspaceId: workspace2.id,
+      label,
+      ...scopes !== void 0 ? { scopes } : {}
+    });
   } catch (err) {
+    fail(describeSessionError(err, apiUrl, scopes));
+    return 1;
+  }
+  if (scopes !== void 0 && !Array.isArray(session.scopes)) {
+    await revokeSession(session.endpointId);
+    fail(SCOPES_NOT_APPLIED);
+    return 1;
+  }
+  info(
+    `Dashwise MCP \u2014 workspace ${workspace2.slug}, endpoint #${session.endpointId} (${session.name}).`
+  );
+  info(`Session key expires ${dim(session.expiresAt)}.`);
+  info(describeScopes(session.scopes));
+  if (options.readOnly) {
     warn(
-      `Could not revoke the server-side token (${err.message}). Local credentials cleared anyway.`
+      "Read-only: write tools are refused by this proxy (a client-side guard, not a server-enforced scope \u2014 for that, use --scope)."
     );
   }
-  deleteConfig();
-  success(`Logged out ${code(cfg.user.email)}`);
-  return 0;
+  let ownedEndpointId = session.endpointId;
+  const proxy = startMcpProxy({
+    session,
+    reauth: async () => {
+      const fresh = await openCliSession({
+        workspaceId: workspace2.id,
+        label,
+        ...scopes !== void 0 ? { scopes } : {}
+      });
+      if (scopes !== void 0 && !Array.isArray(fresh.scopes)) {
+        await revokeSession(fresh.endpointId);
+        throw new Error(SCOPES_NOT_APPLIED);
+      }
+      ownedEndpointId = fresh.endpointId;
+      return fresh;
+    },
+    ...options.readOnly !== void 0 ? { readOnly: options.readOnly } : {},
+    ...options.verbose !== void 0 ? { verbose: options.verbose } : {}
+  });
+  const shutdown = () => proxy.stop();
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  try {
+    const exitCode = await proxy.done;
+    await revokeSession(ownedEndpointId);
+    return exitCode;
+  } finally {
+    process.off("SIGINT", shutdown);
+    process.off("SIGTERM", shutdown);
+  }
+}
+function claudeMcpAddArgv(args) {
+  const argv = [
+    "mcp",
+    "add",
+    args.serverName,
+    "--scope",
+    args.scope,
+    "--",
+    "dashwise",
+    "mcp",
+    "--workspace",
+    args.workspaceSlug
+  ];
+  for (const grant of args.grantScopes ?? []) argv.push("--scope", grant);
+  if (args.readOnly) argv.push("--read-only");
+  if (args.endpointName) argv.push("--endpoint-name", args.endpointName);
+  return argv;
+}
+async function mcpAddCommand(options = {}) {
+  const serverName = options.name ?? "dashwise";
+  const scope = options.scope ?? "local";
+  if (options.grantScopes !== void 0) {
+    const checked = checkMcpScopes(options.grantScopes, "--grant-scope");
+    if (!checked.ok) {
+      fail(checked.message);
+      return 1;
+    }
+  }
+  let workspaceSlug = options.workspace;
+  if (workspaceSlug === void 0) {
+    const cfg = readConfig();
+    if (!cfg) {
+      fail("Not logged in. Run `dashwise login` first, or pass --workspace <slug>.");
+      return 1;
+    }
+    try {
+      workspaceSlug = (await resolveWorkspace(resolveApiUrl(), cfg.token, void 0)).slug;
+    } catch (err) {
+      fail(err.message);
+      return 1;
+    }
+  }
+  const argv = claudeMcpAddArgv({
+    serverName,
+    scope,
+    workspaceSlug,
+    ...options.readOnly !== void 0 ? { readOnly: options.readOnly } : {},
+    ...options.endpointName !== void 0 ? { endpointName: options.endpointName } : {},
+    ...options.grantScopes !== void 0 ? { grantScopes: options.grantScopes } : {}
+  });
+  const printable = `claude ${argv.join(" ")}`;
+  info("Registering the Dashwise MCP server with Claude Code:");
+  out(printable);
+  const target = spawnTarget("claude", argv);
+  if ("refused" in target) {
+    fail(`Could not run \`claude\`: ${target.refused} Run the command above yourself.`);
+    return 1;
+  }
+  return await new Promise((resolve13) => {
+    const child = spawn(target.command, target.args, { shell: target.shell, stdio: "inherit" });
+    let settled = false;
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      if (err.code === "ENOENT") {
+        fail(
+          `Claude Code is not on your PATH, so nothing was registered. Run the command above once ${code("claude")} is installed.`
+        );
+        resolve13(1);
+        return;
+      }
+      fail(`Could not run \`claude\`: ${err.message}`);
+      resolve13(1);
+    });
+    child.on("close", (codeOut) => {
+      if (settled) return;
+      settled = true;
+      resolve13(codeOut ?? 1);
+    });
+  });
 }
 
-// src/commands/profile.ts
-init_api_client();
+// src/commands/agent.ts
 init_config();
 init_output();
-async function profileCommand(options = {}) {
-  const cfg = readConfig();
-  if (!cfg) {
-    if (options.json) {
-      out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
-    } else {
-      fail("Not logged in. Run `dashwise login` first.");
-    }
-    return 1;
+var PLUGIN_NAME = "dashwise";
+var MARKETPLACE_NAME = "dashwise";
+var DEFAULT_MARKETPLACE_SOURCE = "Intuize/dashwise-cli";
+var defaultRunner = (cmd, args, opts) => new Promise((resolve13) => {
+  const target = spawnTarget(cmd, args);
+  if ("refused" in target) {
+    resolve13({ code: null, stdout: "", stderr: target.refused, missing: false });
+    return;
   }
-  let me = null;
-  let refreshError = null;
+  const child = spawn(target.command, target.args, {
+    shell: target.shell,
+    stdio: opts.capture ? ["ignore", "pipe", "pipe"] : "inherit"
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+  let settled = false;
+  child.on("error", (err) => {
+    if (settled) return;
+    settled = true;
+    resolve13({
+      code: null,
+      stdout,
+      stderr: stderr || err.message,
+      missing: err.code === "ENOENT"
+    });
+  });
+  child.on("close", (exitCode) => {
+    if (settled) return;
+    settled = true;
+    resolve13({ code: exitCode, stdout, stderr, missing: false });
+  });
+});
+function parsePluginList(text4) {
+  let parsed;
   try {
-    me = await apiRequest("GET", "/api/auth/me");
-  } catch (err) {
-    if (err instanceof ApiError && err.status === 401) {
-      if (options.json) {
-        out(JSON.stringify({ ok: false, error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." } }));
-      } else {
-        fail("Saved token is no longer valid. Run `dashwise login` again.");
+    parsed = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  const list = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.plugins) ? parsed.plugins : null;
+  if (!list) return null;
+  return list.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const e = entry;
+    if (typeof e.id !== "string") return [];
+    return [
+      {
+        id: e.id,
+        ...typeof e.version === "string" ? { version: e.version } : {},
+        ...typeof e.scope === "string" ? { scope: e.scope } : {},
+        ...typeof e.enabled === "boolean" ? { enabled: e.enabled } : {}
       }
-      return 1;
-    }
-    refreshError = err.message;
-    if (!options.json) {
-      warn(
-        `Could not refresh profile from the server (${refreshError}). Showing cached values.`
+    ];
+  });
+}
+function parseMarketplaceList(text4) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  return parsed.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const e = entry;
+    if (typeof e.name !== "string") return [];
+    const where = [e.repo, e.url, e.path, e.source].find((v) => typeof v === "string");
+    return [{ name: e.name, ...typeof where === "string" ? { source: where } : {} }];
+  });
+}
+function manualSteps(source) {
+  return [
+    `claude plugin marketplace add ${source}`,
+    `claude plugin install ${PLUGIN_NAME}@${MARKETPLACE_NAME}`
+  ];
+}
+async function agentSetupCommand(options = {}, deps = {}) {
+  const run = deps.run ?? defaultRunner;
+  const loggedIn = deps.loggedIn ?? isLoggedIn;
+  const json = options.json === true;
+  const source = options.marketplace ?? DEFAULT_MARKETPLACE_SOURCE;
+  const pluginId = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
+  const report = {
+    ok: false,
+    action: options.status ? "status" : "setup",
+    claude: { found: false },
+    marketplace: { name: MARKETPLACE_NAME, source, configured: null },
+    plugin: { id: pluginId, installed: null },
+    steps: []
+  };
+  const finish = (exitCode) => {
+    report.ok = exitCode === 0;
+    if (json) out(JSON.stringify(report, null, 2));
+    return exitCode;
+  };
+  const say = (line) => {
+    if (!json) info(line);
+  };
+  const version = await run("claude", ["--version"], { capture: true });
+  if (version.missing && options.status) {
+    report.next = ["Install Claude Code, then run `dashwise agent setup`."];
+    if (!json) {
+      out("Claude Code: not installed (no `claude` on your PATH)");
+      info(`Once it is, ${code("dashwise agent setup")} installs the Dashwise plugin.`);
+    }
+    return finish(0);
+  }
+  if (version.missing) {
+    report.manual_steps = manualSteps(source);
+    if (!json) {
+      warn("Claude Code (`claude`) is not on your PATH, so nothing was installed.");
+      info("Once Claude Code is installed, these two commands add the Dashwise plugin:");
+      for (const line of report.manual_steps) out(line);
+      info(
+        `Or inside Claude Code: ${code(`/plugin marketplace add ${source}`)}, then ${code(`/plugin install ${pluginId}`)}.`
       );
     }
+    return finish(0);
   }
-  if (me) {
-    const refreshed = {
-      ...cfg,
-      user: {
-        id: me.id,
-        email: me.email,
-        username: me.username,
-        firstName: me.first_name,
-        lastName: me.last_name
-      }
+  if (version.code !== 0) {
+    report.error = `claude --version exited ${version.code}: ${version.stderr.trim()}`;
+    if (!json)
+      fail(
+        `Could not run \`claude --version\`: ${version.stderr.trim() || `exit ${version.code}`}`
+      );
+    return finish(1);
+  }
+  report.claude = { found: true, version: version.stdout.trim() };
+  say(`Claude Code found (${report.claude.version}).`);
+  const listed = await run("claude", ["plugin", "list", "--json"], { capture: true });
+  const plugins = listed.code === 0 ? parsePluginList(listed.stdout) : null;
+  if (plugins) {
+    const ours = plugins.find((p) => p.id.toLowerCase() === pluginId.toLowerCase());
+    const others = plugins.filter((p) => p !== ours && p.id.toLowerCase().startsWith(`${PLUGIN_NAME}@`)).map((p) => p.id);
+    report.plugin = {
+      id: pluginId,
+      installed: ours !== void 0,
+      ...ours?.version !== void 0 ? { version: ours.version } : {},
+      ...ours?.scope !== void 0 ? { scope: ours.scope } : {},
+      ...ours?.enabled !== void 0 ? { enabled: ours.enabled } : {},
+      ...others.length > 0 ? { others } : {}
     };
-    writeConfig(refreshed);
-  }
-  const u = me ?? toMe(cfg.user);
-  let workspaces = [];
-  let workspaceError = null;
-  try {
-    const fetched = await apiRequest(
-      "GET",
-      "/api/workspaces"
-    );
-    workspaces = Array.isArray(fetched) ? fetched : [];
-  } catch (err) {
-    workspaceError = err.message;
   }
-  if (options.json) {
-    out(
-      JSON.stringify({
-        ok: true,
-        user: {
-          id: u.id,
-          username: u.username,
-          email: u.email,
-          first_name: u.first_name,
-          last_name: u.last_name
-        },
-        default_workspace: cfg.workspaceSlug ?? null,
-        workspaces,
-        api_url: cfg.apiUrl,
-        ...refreshError ? { profile_refresh_error: refreshError } : {},
-        ...workspaceError ? { workspaces_error: workspaceError } : {}
-      })
-    );
-    return 0;
+  const markets = await run("claude", ["plugin", "marketplace", "list", "--json"], {
+    capture: true
+  });
+  const marketplaces = markets.code === 0 ? parseMarketplaceList(markets.stdout) : null;
+  const existing = marketplaces?.find((m) => m.name === MARKETPLACE_NAME);
+  if (marketplaces) {
+    report.marketplace.configured = existing !== void 0;
+    if (existing?.source !== void 0) report.marketplace.configured_source = existing.source;
+  }
+  if (options.status) {
+    if (!json) printStatus(report);
+    if (plugins === null) {
+      report.error = `claude plugin list --json gave nothing this command can read (exit ${listed.code}).`;
+      if (!json) fail(report.error);
+      return finish(1);
+    }
+    return finish(0);
+  }
+  if (report.plugin.installed === true) {
+    if (!json) {
+      success(
+        `${pluginId} is already installed${report.plugin.version ? ` (${report.plugin.version})` : ""}.`
+      );
+      info(`To update it: ${code(`claude plugin update ${pluginId}`)}, then restart Claude Code.`);
+    }
+    return finish(0);
   }
-  out("");
-  kv("User ID", `${u.id}`);
-  kv("Username", u.username);
-  kv("Email", u.email);
-  kv("Name", `${u.first_name} ${u.last_name}`.trim() || dim("(not set)"));
-  out("");
-  if (workspaceError) {
-    warn(
-      `Could not list workspaces (${workspaceError}). Try \`dashwise workspace list\`.`
+  if (existing) {
+    say(
+      `The ${MARKETPLACE_NAME} marketplace is already configured` + (existing.source ? ` (from ${existing.source}).` : ".")
     );
-  } else if (workspaces.length === 0) {
-    info("No workspaces yet.");
-  } else {
-    kv("Workspaces", `${workspaces.length}`);
-    for (const w of workspaces) {
-      const slug = w.slug ?? `id:${w.id}`;
-      const role = w.role ?? w.permissions ?? "";
-      const star = cfg.workspaceSlug === slug ? code(" (default)") : "";
-      out(`  - ${slug}${role ? dim(` [${role}]`) : ""}${star}  ${dim(w.name)}`);
+    if (options.marketplace !== void 0 && existing.source !== void 0 && existing.source !== source) {
+      if (!json) {
+        warn(
+          `--marketplace ${source} was not used: a marketplace named ${MARKETPLACE_NAME} already points at ${existing.source}. To switch, run ${code(`claude plugin marketplace remove ${MARKETPLACE_NAME}`)} and try again.`
+        );
+      }
     }
+  } else {
+    const added = await step(run, ["plugin", "marketplace", "add", source], json, report);
+    if (added !== 0) return failed(report, source, json, finish, added);
+    report.marketplace.configured = true;
+    report.marketplace.configured_source = source;
+  }
+  const installed = await step(run, ["plugin", "install", pluginId], json, report);
+  if (installed !== 0) return failed(report, source, json, finish, installed);
+  report.plugin.installed = true;
+  report.next = ["Restart Claude Code so it loads the plugin."];
+  if (!loggedIn())
+    report.next.push("Run `dashwise login` once, so the plugin\u2019s MCP server can start.");
+  if (!json) {
+    success(`Installed ${pluginId}.`);
+    for (const line of report.next) info(line);
+  }
+  return finish(0);
+}
+async function step(run, args, json, report) {
+  const printable = `claude ${args.join(" ")}`;
+  if (!json) info(`Running: ${printable}`);
+  const result = await run("claude", args, { capture: json });
+  const exitCode = result.code ?? 1;
+  report.steps.push({ command: printable, exit_code: result.code });
+  if (exitCode !== 0 && json)
+    report.error = result.stderr.trim() || `${printable} exited ${exitCode}`;
+  return exitCode;
+}
+function failed(report, source, json, finish, exitCode) {
+  report.manual_steps = manualSteps(source);
+  if (!json) {
+    const last = report.steps[report.steps.length - 1];
+    fail(
+      `\`${last?.command}\` failed (exit ${last?.exit_code ?? "none"}). Nothing after it was run.`
+    );
+    info("To finish by hand:");
+    for (const line of report.manual_steps) out(line);
   }
-  out("");
-  kv("API URL", cfg.apiUrl);
-  return 0;
+  return finish(exitCode);
 }
-function toMe(cached) {
-  return {
-    id: cached.id,
-    email: cached.email,
-    username: cached.username,
-    first_name: cached.firstName,
-    last_name: cached.lastName,
-    is_staff: false,
-    is_active: true,
-    date_joined: ""
-  };
+function printStatus(report) {
+  out(`Claude Code: ${report.claude.version ?? "found"}`);
+  const m = report.marketplace;
+  out(
+    `Marketplace ${m.name}: ` + (m.configured === null ? "could not tell" : m.configured ? `configured${m.configured_source ? ` (${m.configured_source})` : ""}` : `not configured (setup would add ${m.source})`)
+  );
+  const p = report.plugin;
+  const detail = [
+    p.version,
+    p.scope && `${p.scope} scope`,
+    p.enabled === false ? "disabled" : p.enabled ? "enabled" : void 0
+  ].filter(Boolean).join(", ");
+  out(
+    `Plugin ${p.id}: ` + (p.installed === null ? "could not tell" : p.installed ? `installed${detail ? ` (${detail})` : ""}` : "not installed")
+  );
+  if (p.others?.length) out(`Also installed from other marketplaces: ${p.others.join(", ")}`);
 }
 
 // src/commands/workspace.ts
@@ -7618,7 +8704,7 @@ async function pollBuild(buildId, moduleId, slug, options) {
         `/api/modules/${moduleId}/builds/${buildId}`
       );
     } catch {
-      await sleep2(intervalMs);
+      await sleep(intervalMs);
       continue;
     }
     if (!options.json && build.status !== lastStatus) {
@@ -7647,14 +8733,14 @@ async function pollBuild(buildId, moduleId, slug, options) {
       }
       return 1;
     }
-    await sleep2(intervalMs);
+    await sleep(intervalMs);
   }
   warn(
     `Still building after ${options.timeoutSec ?? 360}s \u2014 the build is likely still running. Re-run ${code("dashwise module publish")} to check, or inspect build ${code(`#${buildId}`)}.`
   );
   return 0;
 }
-function sleep2(ms) {
+function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 function formatBytes2(n) {
@@ -10861,7 +11947,7 @@ async function runTail(moduleId, options) {
     } catch (err) {
       info(dim(`(tail poll error: ${err.message})`));
     }
-    await sleep3(POLL_INTERVAL_MS);
+    await sleep2(POLL_INTERVAL_MS);
   }
 }
 function buildTailParams(options) {
@@ -10974,7 +12060,7 @@ function formatRow(row) {
 function formatTimestamp(iso) {
   return iso.slice(0, 19).replace("T", " ");
 }
-function sleep3(ms) {
+function sleep2(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
@@ -11323,7 +12409,7 @@ async function runFollow(installationId, label, opts, auth) {
           return mapLogsError(err, false);
         }
         info(dim(`(follow: transient error \u2014 ${err.message})`));
-        await sleep4(POLL_INTERVAL_MS3, () => stopped);
+        await sleep3(POLL_INTERVAL_MS3, () => stopped);
         firstPoll = false;
         continue;
       }
@@ -11346,7 +12432,7 @@ async function runFollow(installationId, label, opts, auth) {
         }
       }
       firstPoll = false;
-      await sleep4(POLL_INTERVAL_MS3, () => stopped);
+      await sleep3(POLL_INTERVAL_MS3, () => stopped);
     }
   } finally {
     process.off("SIGINT", onSigint);
@@ -11439,7 +12525,7 @@ function mapLogsError(err, json) {
   else fail(message);
   return 1;
 }
-async function sleep4(ms, aborted) {
+async function sleep3(ms, aborted) {
   const slice = 100;
   let waited = 0;
   while (waited < ms && !aborted()) {
@@ -11479,6 +12565,84 @@ program.command("profile").description("Show the current user, default workspace
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+var mcp = program.command("mcp").description(
+  "Run a local MCP server for a workspace, so Claude can read and write your data (`dashwise mcp` runs `serve`; see `dashwise mcp serve --help`), or register it with Claude Code (`add`)."
+);
+var collect = (value, previous) => [
+  ...previous ?? [],
+  value
+];
+mcp.command("serve", { isDefault: true }).description(
+  "Run the local MCP server (the default). The key is exchanged at startup and held in memory \u2014 it never reaches a config file or your shell history."
+).option(
+  "--workspace <slug>",
+  "Workspace to connect (default: `dashwise workspace use`)."
+).option(
+  "--scope <grant>",
+  "Narrow this session's key, enforced by the server. Repeatable; grants add up. `datahub:table=<id>:<ops>`, `datahub:app=<id>:<ops>`, `datahub:workspace:<ops>` (ops: one to four of c r u d) or `governance:workspace:r`. Each must be within your own access. Omitted: the key reaches what your account can.",
+  collect
+).option(
+  "--read-only",
+  "Refuse write tools. A CLIENT-SIDE GUARD: this proxy declines the call and the server is not told. It prevents accidents; it is not a fence. For a server-enforced limit, use --scope (for example `--scope datahub:workspace:r`)."
+).option(
+  "--endpoint-name <label>",
+  "Label for this machine's endpoint (default: your hostname). Each run gets its own endpoint, named `dashwise-cli@<label>#<id>` \u2014 the server adds the short id so concurrent sessions on one machine are told apart in the endpoints panel, where an admin can revoke one of them. The session lasts 24 hours and is revoked automatically on exit."
+).option(
+  "--verbose",
+  "Log frame types and sizes to stderr. Never frame bodies, never the key."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await mcpCommand({
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.scope !== void 0 ? { scopes: cmdOpts.scope } : {},
+      ...cmdOpts.readOnly !== void 0 ? { readOnly: cmdOpts.readOnly } : {},
+      ...cmdOpts.endpointName !== void 0 ? { endpointName: cmdOpts.endpointName } : {},
+      ...cmdOpts.verbose !== void 0 ? { verbose: cmdOpts.verbose } : {}
+    });
+  }
+);
+mcp.command("add").description(
+  "Register `dashwise mcp` with Claude Code by shelling out to `claude mcp add`. Prints the exact command it runs, so it can be copied when `claude` is absent."
+).option("--workspace <slug>", "Workspace to bake into the registration.").option(
+  "--read-only",
+  "Register the read-only form (client-side guard; see `dashwise mcp serve --help`)."
+).option("--endpoint-name <label>", "Label for this machine's endpoint.").option(
+  "--name <server-name>",
+  "Name Claude Code shows for the server (default: dashwise)."
+).addOption(
+  new Option(
+    "--scope <scope>",
+    "Claude Code's config scope \u2014 where the registration is saved. Not the key's reach: for that, --grant-scope."
+  ).choices(["local", "project", "user"]).default("local")
+).option(
+  "--grant-scope <grant>",
+  "Narrow the registered server's key, enforced by the server: written into the registration as `dashwise mcp --scope <grant>`. Repeatable; grants add up. Same grammar as `dashwise mcp serve --scope`.",
+  collect
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await mcpAddCommand({
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.readOnly !== void 0 ? { readOnly: cmdOpts.readOnly } : {},
+      ...cmdOpts.endpointName !== void 0 ? { endpointName: cmdOpts.endpointName } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.scope !== void 0 ? { scope: cmdOpts.scope } : {},
+      ...cmdOpts.grantScope !== void 0 ? { grantScopes: cmdOpts.grantScope } : {}
+    });
+  }
+);
+var agent = program.command("agent").description("Set up a coding agent to work with Dashwise (`dashwise agent setup`).");
+agent.command("setup").description(
+  "Install the Dashwise plugin into Claude Code \u2014 its skills, the `dashwise` MCP server and the secrets guard \u2014 by running `claude plugin marketplace add` and `claude plugin install`. Without Claude Code, prints the two commands instead."
+).option(
+  "--marketplace <source>",
+  `Marketplace to add: owner/repo, a git URL, a local path or a URL (default: ${DEFAULT_MARKETPLACE_SOURCE}).`
+).option("--status", "Report what is installed, and change nothing.").option("--json", "Print one JSON object on stdout instead of progress lines.").action(async (cmdOpts) => {
+  process.exitCode = await agentSetupCommand({
+    ...cmdOpts.marketplace !== void 0 ? { marketplace: cmdOpts.marketplace } : {},
+    ...cmdOpts.status !== void 0 ? { status: cmdOpts.status } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
 var workspace = program.command("workspace").description("Workspace context commands.");
 workspace.command("list").description("List accessible workspaces.").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
   process.exitCode = await workspaceListCommand({
@@ -12226,7 +13390,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.18.3";
+  return "0.19.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);