@epicai/legion 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## 1.0.2 — 2026-04-02
+
+### Changed
+- Setup wizard replaced credential onboarding with zero-credential live demo (Searchcode, PubMed, Robtex, Govbase) — developers see real data before touching any secrets
+- `@xenova/transformers` moved to optional peer dependency — eliminates 50 MB install for users not running local embeddings
+- PRIVACY.md added to published package
+
+### Fixed
+- Removed broken category drill-down that showed "Other (3137)" for uncategorized adapters
+
+---
+
+## 1.0.1 — 2026-04-02
+
+### Changed
+- Setup wizard replaced multi-level category drill-down with credential auto-wire — scans `~/.epic-ai/.env` and MCP client configs to pre-select adapters whose credentials are already present
+
+---
+
 ## 1.0.0 — 2026-04-02
 
 ### Added

package/dist/bin/setup.d.ts

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 /**
  * Epic AI® Legion — CLI Entry Point
- * `npx @epicai/legion` — setup wizard
- * `npx @epicai/legion --serve` — MCP server mode
- * `npx @epicai/legion add <name>` — add adapter
- * `npx @epicai/legion remove <name>` — remove adapter
- * `npx @epicai/legion health` — check adapter health
- * `npx @epicai/legion list` — list all adapters
+ * `legion` / `npx @epicai/legion`   — setup wizard
+ * `legion serve` / `--serve`        — MCP server mode
+ * `legion add <name>`               — add adapter and enter credentials
+ * `legion remove <name>`            — remove an adapter
+ * `legion health`                   — check adapter status
+ * `legion list`                     — show Curated + Custom adapters
+ * `legion search [term]`            — search all available adapters
+ * `legion configure`                — connect credentials and wire adapters
+ * `legion help`                     — show all commands
  *
  * Legion is an Intelligent Virtual Assistant (IVA) — the AI classifies intent,
  * selects adapters, calls them, and synthesizes a response through your local

package/dist/bin/setup.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 /**
  * Epic AI® Legion — CLI Entry Point
- * `npx @epicai/legion` — setup wizard
- * `npx @epicai/legion --serve` — MCP server mode
- * `npx @epicai/legion add <name>` — add adapter
- * `npx @epicai/legion remove <name>` — remove adapter
- * `npx @epicai/legion health` — check adapter health
- * `npx @epicai/legion list` — list all adapters
+ * `legion` / `npx @epicai/legion`   — setup wizard
+ * `legion serve` / `--serve`        — MCP server mode
+ * `legion add <name>`               — add adapter and enter credentials
+ * `legion remove <name>`            — remove an adapter
+ * `legion health`                   — check adapter status
+ * `legion list`                     — show Curated + Custom adapters
+ * `legion search [term]`            — search all available adapters
+ * `legion configure`                — connect credentials and wire adapters
+ * `legion help`                     — show all commands
  *
  * Legion is an Intelligent Virtual Assistant (IVA) — the AI classifies intent,
  * selects adapters, calls them, and synthesizes a response through your local
@@ -749,39 +752,244 @@ async function cmdHealth() {
     state.lastHealthCheck = new Date().toISOString();
     saveState(state);
 }
-async function cmdList(searchTerm) {
+// ─── Curated adapter IDs (mirrored here for list/search — keep in sync with wizard) ──
+const CURATED_IDS = [
+    'com-claude-mcp-pubmed-pubmed',
+    'govbase-mcp',
+    'searchcode',
+    'robtex',
+];
+// ─── legion list ────────────────────────────────────────────
+async function cmdList() {
     const pc = (await import('picocolors')).default;
     const all = await loadAllAdapters();
-    let filtered = all;
-    if (searchTerm) {
-        const term = searchTerm.toLowerCase();
-        filtered = all.filter(a => a.id.includes(term) || a.name.toLowerCase().includes(term) ||
-            (a.description || '').toLowerCase().includes(term) ||
-            (a.category || '').includes(term));
-    }
-    // Group by category
-    const categories = new Map();
-    for (const a of filtered) {
-        const cat = a.category || 'other';
-        if (!categories.has(cat))
-            categories.set(cat, []);
-        categories.get(cat).push(a);
+    const state = loadState();
+    // Curated tier
+    const curatedRows = CURATED_IDS.map(id => all.find(a => a.id === id)).filter(Boolean);
+    // Custom tier — in state but not curated
+    const customIds = Object.keys(state.adapters).filter(id => !CURATED_IDS.includes(id));
+    const customRows = customIds.map(id => all.find(a => a.id === id) || { id, name: id, type: 'unknown' });
+    console.log('');
+    // Curated
+    console.log(`  ${pc.bold('Curated')}  ${pc.dim(`(${curatedRows.length})`)}  ${pc.dim('— open data, no credentials required')}`);
+    console.log('');
+    for (const a of curatedRows) {
+        const toolCount = a.rest?.toolCount || a.mcp?.toolCount || 0;
+        const typeLabel = a.type === 'mcp' ? pc.dim('MCP') : a.type === 'both' ? pc.dim('REST+MCP') : pc.dim('REST');
+        console.log(`    ${pc.cyan(a.id.padEnd(35))} ${typeLabel}  ${String(toolCount).padStart(3)} tools   ${pc.dim((a.description || '').slice(0, 50))}`);
     }
     console.log('');
-    console.log(`  Epic AI® Legion — ${filtered.length} adapters${searchTerm ? ` matching "${searchTerm}"` : ''}`);
+    // Custom
+    console.log(`  ${pc.bold('Custom')}   ${pc.dim(`(${customRows.length})`)}  ${pc.dim('— your APIs and credentials')}`);
     console.log('');
-    for (const [cat, adapters] of Array.from(categories.entries()).sort((a, b) => b[1].length - a[1].length)) {
-        console.log(`  ${pc.cyan(cat)} (${adapters.length})`);
-        for (const a of adapters.slice(0, 10)) {
-            const tools = a.rest?.toolCount ? `${a.rest.toolCount} tools` : '';
-            const type = a.type === 'mcp' ? pc.dim('MCP') : a.type === 'both' ? pc.dim('REST+MCP') : pc.dim('REST');
-            console.log(`    ${a.id.padEnd(35)} ${type}  ${tools}`);
+    if (customRows.length === 0) {
+        console.log(`    ${pc.dim('None yet — run:')} ${pc.cyan('legion configure')}`);
+    }
+    else {
+        for (const a of customRows) {
+            const toolCount = a.rest?.toolCount || 0;
+            const typeLabel = a.type === 'mcp' ? pc.dim('MCP') : a.type === 'both' ? pc.dim('REST+MCP') : pc.dim('REST');
+            console.log(`    ${pc.cyan(a.id.padEnd(35))} ${typeLabel}  ${String(toolCount).padStart(3)} tools   ${pc.dim((a.description || '').slice(0, 50))}`);
         }
-        if (adapters.length > 10) {
-            console.log(`    ${pc.dim(`... and ${adapters.length - 10} more`)}`);
+    }
+    console.log('');
+}
+// ─── legion search ──────────────────────────────────────────
+async function cmdSearch(term) {
+    const pc = (await import('picocolors')).default;
+    const all = await loadAllAdapters();
+    const state = loadState();
+    if (!term) {
+        // No term — show curated tier + hint
+        const curatedRows = CURATED_IDS.map(id => all.find(a => a.id === id)).filter(Boolean);
+        console.log('');
+        console.log(`  ${pc.bold('Curated adapters')}  ${pc.dim('— vetted, open data, no credentials required')}`);
+        console.log('');
+        for (const a of curatedRows) {
+            const toolCount = a.rest?.toolCount || a.mcp?.toolCount || 0;
+            console.log(`    ${pc.cyan(a.id.padEnd(35))} ${String(toolCount).padStart(3)} tools   ${pc.dim((a.description || '').slice(0, 60))}`);
         }
         console.log('');
+        console.log(`  ${pc.dim(`Search all ${all.length} available adapters:`)}  ${pc.cyan('legion search <term>')}`);
+        console.log('');
+        return;
+    }
+    const t = term.toLowerCase();
+    const results = all.filter(a => a.id.includes(t) ||
+        a.name.toLowerCase().includes(t) ||
+        (a.description || '').toLowerCase().includes(t) ||
+        (a.category || '').includes(t));
+    if (results.length === 0) {
+        console.log(`\n  No adapters matched "${term}". Try a broader term.\n`);
+        return;
+    }
+    // Sort: curated first, then custom (in state), then rest
+    const customInState = new Set(Object.keys(state.adapters));
+    const sorted = [
+        ...results.filter(a => CURATED_IDS.includes(a.id)),
+        ...results.filter(a => !CURATED_IDS.includes(a.id) && customInState.has(a.id)),
+        ...results.filter(a => !CURATED_IDS.includes(a.id) && !customInState.has(a.id)),
+    ];
+    const shown = sorted.slice(0, 20);
+    console.log('');
+    console.log(`  ${pc.bold(`${results.length} adapters`)} matching "${term}"${results.length > 20 ? pc.dim(' (showing top 20)') : ''}`);
+    console.log('');
+    for (const a of shown) {
+        const toolCount = a.rest?.toolCount || a.mcp?.toolCount || 0;
+        const tag = CURATED_IDS.includes(a.id)
+            ? pc.green('curated')
+            : customInState.has(a.id)
+                ? pc.cyan('configured')
+                : pc.dim('available');
+        console.log(`    ${pc.cyan(a.id.padEnd(35))} ${String(toolCount).padStart(3)} tools  [${tag}]`);
+        if (a.description)
+            console.log(`    ${pc.dim((' ').repeat(35))} ${pc.dim(a.description.slice(0, 70))}`);
+        console.log('');
+    }
+    const unconfigured = shown.filter(a => !CURATED_IDS.includes(a.id) && !customInState.has(a.id));
+    if (unconfigured.length > 0) {
+        console.log(`  ${pc.dim('Add one:')}  ${pc.cyan(`legion add ${unconfigured[0].id}`)}`);
+        console.log('');
+    }
+}
+// ─── legion configure ───────────────────────────────────────
+async function cmdConfigure() {
+    const p = await import('@clack/prompts');
+    const pc = (await import('picocolors')).default;
+    console.log('');
+    p.intro(pc.bgCyan(pc.black(' Legion Configure — Connect Your APIs ')));
+    const all = await loadAllAdapters();
+    // Step 1: Where to look for credentials
+    const scanTargets = await p.multiselect({
+        message: 'Where should Legion look for existing credentials?',
+        options: [
+            { value: 'epic-ai', label: '~/.epic-ai/.env', hint: 'Legion\'s credential store' },
+            { value: 'home', label: '~/.env', hint: 'home directory env file' },
+            { value: 'cwd', label: '.env in current directory', hint: `${process.cwd()}/.env` },
+        ],
+        initialValues: ['epic-ai'],
+        required: true,
+    });
+    if (p.isCancel(scanTargets)) {
+        p.cancel('Cancelled.');
+        process.exit(0);
+    }
+    // Step 2: Scan and match
+    const s = p.spinner();
+    s.start('Scanning for credentials');
+    const foundCreds = {};
+    if (scanTargets.includes('epic-ai')) {
+        Object.assign(foundCreds, loadCredentials());
+    }
+    if (scanTargets.includes('home')) {
+        const p2 = join(homedir(), '.env');
+        if (existsSync(p2)) {
+            const lines = readFileSync(p2, 'utf-8').split('\n');
+            for (const line of lines) {
+                const eq = line.indexOf('=');
+                if (eq > 0)
+                    foundCreds[line.slice(0, eq)] = line.slice(eq + 1);
+            }
+        }
+    }
+    if (scanTargets.includes('cwd')) {
+        const p3 = join(process.cwd(), '.env');
+        if (existsSync(p3)) {
+            const lines = readFileSync(p3, 'utf-8').split('\n');
+            for (const line of lines) {
+                const eq = line.indexOf('=');
+                if (eq > 0)
+                    foundCreds[line.slice(0, eq)] = line.slice(eq + 1);
+            }
+        }
+    }
+    s.stop('Scan complete');
+    // Match credentials to adapters
+    const matched = [];
+    for (const adapter of all) {
+        if (CURATED_IDS.includes(adapter.id))
+            continue; // skip curated — already configured
+        const envKey = adapter.rest?.envKey;
+        if (envKey && foundCreds[envKey]) {
+            matched.push({ adapter, key: envKey });
+        }
+        else if (adapter.mcp?.envKeys) {
+            for (const k of adapter.mcp.envKeys) {
+                if (foundCreds[k]) {
+                    matched.push({ adapter, key: k });
+                    break;
+                }
+            }
+        }
     }
+    if (matched.length === 0) {
+        p.log.info('No matching credentials found in scanned locations.');
+    }
+    else {
+        p.note(matched.map(m => `  ${pc.green(m.key.padEnd(30))} → ${pc.cyan(m.adapter.name)}`).join('\n'), `Found ${matched.length} credential${matched.length !== 1 ? 's' : ''}`);
+        // Step 3: Confirm which to wire
+        const toWire = await p.multiselect({
+            message: 'Wire these adapters?',
+            options: matched.map(m => ({
+                value: m.adapter.id,
+                label: m.adapter.name,
+                hint: `${m.key} → ${m.adapter.description?.slice(0, 50) || m.adapter.id}`,
+            })),
+            initialValues: matched.map(m => m.adapter.id),
+            required: false,
+        });
+        if (p.isCancel(toWire)) {
+            p.cancel('Cancelled.');
+            process.exit(0);
+        }
+        // Step 4: Write to state and config
+        const state = loadState();
+        const config = loadConfig() || { selectedAdapters: [], secretsProvider: 'manual', aiClient: 'unknown' };
+        for (const id of toWire) {
+            const m = matched.find(x => x.adapter.id === id);
+            // Copy credential to ~/.epic-ai/.env if it came from elsewhere
+            writeCredential(m.key, foundCreds[m.key]);
+            state.adapters[id] = { type: m.adapter.type || 'unknown', status: 'configured', toolCount: m.adapter.rest?.toolCount || 0, lastVerified: null };
+            if (!config.selectedAdapters.includes(id))
+                config.selectedAdapters.push(id);
+        }
+        saveState(state);
+        saveConfig(config);
+        if (toWire.length > 0) {
+            p.log.success(`${toWire.length} adapter${toWire.length !== 1 ? 's' : ''} configured.`);
+        }
+    }
+    // Step 5: Add more manually?
+    const addMore = await p.confirm({ message: 'Add adapters manually?', initialValue: false });
+    if (!p.isCancel(addMore) && addMore) {
+        const name = await p.text({ message: 'Adapter ID (run "legion search <term>" to find one):' });
+        if (!p.isCancel(name) && name) {
+            await cmdAdd(name);
+        }
+    }
+    p.outro(`${pc.green('Done.')} Run ${pc.cyan('legion list')} to see your configured adapters.`);
+}
+// ─── legion help ────────────────────────────────────────────
+async function cmdHelp() {
+    const pc = (await import('picocolors')).default;
+    console.log('');
+    console.log(`  ${pc.bold('Epic AI® Legion')} — Intelligent Virtual Assistant (IVA)`);
+    console.log('');
+    console.log(`  ${pc.bold('Commands:')}`);
+    console.log('');
+    console.log(`    ${pc.cyan('legion')}                       run the setup wizard`);
+    console.log(`    ${pc.cyan('legion query "<question>"')}    route a question to your adapters via your AI client`);
+    console.log(`    ${pc.cyan('legion list')}                  show Curated + Custom adapters`);
+    console.log(`    ${pc.cyan('legion search [term]')}         search all available adapters`);
+    console.log(`    ${pc.cyan('legion add <id>')}              add an adapter and enter credentials`);
+    console.log(`    ${pc.cyan('legion remove <id>')}           remove an adapter`);
+    console.log(`    ${pc.cyan('legion configure')}             connect your APIs and credentials`);
+    console.log(`    ${pc.cyan('legion health')}                check adapter status`);
+    console.log(`    ${pc.cyan('legion serve')}                 start as MCP server (used by AI clients)`);
+    console.log(`    ${pc.cyan('legion help')}                  show this help`);
+    console.log('');
+    console.log(`  ${pc.dim('Docs:')}  https://legion.epic-ai.io`);
+    console.log('');
 }
 // ─── Setup Wizard ───────────────────────────────────────────
 async function runSetupWizard() {
@@ -918,314 +1126,107 @@ async function runSetupWizard() {
         p.log.success(`Using ${system.localBackend} on port ${system.localPort}`);
         configuredClients.push('local');
     }
-    // Step 3: Secrets provider
-    const secretsChoice = await p.select({
-        message: 'Where are your API and MCP credentials stored?',
-        options: [
-            { value: 'vault', label: 'HashiCorp Vault' },
-            { value: 'aws-sm', label: 'AWS Secrets Manager' },
-            { value: 'azure-kv', label: 'Azure Key Vault' },
-            { value: '1password', label: '1Password CLI' },
-            { value: 'doppler', label: 'Doppler' },
-            { value: 'env', label: 'Environment variables', hint: 'already exported in shell' },
-            { value: 'manual', label: 'I\'ll enter them manually' },
-        ],
-    });
-    if (p.isCancel(secretsChoice)) {
-        p.cancel('Setup cancelled.');
-        process.exit(0);
-    }
-    let vaultAddr = '';
-    let vaultToken = '';
-    let vaultConnected = false;
-    if (secretsChoice === 'vault') {
-        const envAddr = process.env.VAULT_ADDR;
-        const envToken = process.env.VAULT_TOKEN;
-        if (envAddr && envToken) {
-            p.log.success(`Detected VAULT_ADDR=${envAddr}`);
-            vaultAddr = envAddr;
-            vaultToken = envToken;
-        }
-        else {
-            const addr = await p.text({
-                message: 'Vault address',
-                placeholder: 'https://vault.example.com:8200',
-                validate: (v) => { if (!v)
-                    return 'Required'; if (!v.startsWith('http'))
-                    return 'Must start with http:// or https://'; },
-            });
-            if (p.isCancel(addr)) {
-                p.cancel('Setup cancelled.');
-                process.exit(0);
-            }
-            const token = await p.password({ message: 'Vault token', validate: (v) => { if (!v)
-                    return 'Required'; } });
-            if (p.isCancel(token)) {
-                p.cancel('Setup cancelled.');
-                process.exit(0);
-            }
-            vaultAddr = addr;
-            vaultToken = token;
-        }
-        s.start('Connecting to Vault');
-        try {
-            const controller = new AbortController();
-            const t = setTimeout(() => controller.abort(), 5000);
-            const resp = await fetch(`${vaultAddr}/v1/sys/health`, { headers: { 'X-Vault-Token': vaultToken }, signal: controller.signal });
-            clearTimeout(t);
-            if (resp.ok) {
-                vaultConnected = true;
-                s.stop(`Connected to Vault at ${vaultAddr}`);
-                writeCredential('VAULT_ADDR', vaultAddr);
-                writeCredential('VAULT_TOKEN', vaultToken);
-            }
-            else {
-                s.stop(`Vault returned ${resp.status} — check your token`);
-            }
-        }
-        catch {
-            s.stop(`Cannot reach Vault at ${vaultAddr}`);
-        }
-    }
-    if (secretsChoice === '1password') {
-        try {
-            execSync('op --version', { stdio: 'pipe' });
-            p.log.success('1Password CLI detected');
-        }
-        catch {
-            p.log.warning('1Password CLI not found — install from https://1password.com/downloads/command-line');
-        }
-    }
-    if (secretsChoice === 'doppler') {
-        try {
-            execSync('doppler --version', { stdio: 'pipe' });
-            p.log.success('Doppler CLI detected');
-        }
-        catch {
-            p.log.warning('Doppler CLI not found — install from https://docs.doppler.com/docs/install-cli');
-        }
-    }
-    // Step 4: Auto-wire adapters from credentials
-    const selectedAdapterIds = [];
-    const existingCreds = loadCredentials();
-    // Match adapters whose required env keys are already present
-    const autoMatched = [];
-    for (const adapter of allAdapters) {
-        const restKey = adapter.rest?.envKey;
-        const mcpKeys = adapter.mcp?.envKeys || [];
-        const allKeys = [...(restKey ? [restKey] : []), ...mcpKeys];
-        if (allKeys.length > 0 && allKeys.every(k => !!existingCreds[k])) {
-            autoMatched.push(adapter);
-        }
-    }
-    if (autoMatched.length > 0) {
-        p.note(autoMatched.map(a => `${pc.green('✓')} ${a.name || a.id}`).join('\n'), `${autoMatched.length} adapter${autoMatched.length !== 1 ? 's' : ''} matched from your credentials`);
-        selectedAdapterIds.push(...autoMatched.map(a => a.id));
-    }
-    else {
-        p.log.info('No adapters matched from credentials — use ' + pc.cyan('npx @epicai/legion add <name>') + ' to connect adapters.');
-    }
-    // Optional: search for additional adapters
-    const addMore = await p.confirm({
-        message: 'Search for additional adapters to configure?',
-        initialValue: false,
-    });
-    if (!p.isCancel(addMore) && addMore) {
-        let searching = true;
-        while (searching) {
-            const searchTerm = await p.text({
-                message: 'Search adapters (name or keyword)',
-                placeholder: 'e.g. grafana, paypal, github',
-            });
-            if (p.isCancel(searchTerm) || !searchTerm)
-                break;
-            const term = searchTerm.toLowerCase();
-            const matches = allAdapters.filter(a => !selectedAdapterIds.includes(a.id) && (a.id.includes(term) ||
-                (a.name || '').toLowerCase().includes(term) ||
-                (a.description || '').toLowerCase().includes(term) ||
-                (a.category || '').includes(term)));
-            if (matches.length === 0) {
-                p.log.warning(`No adapters found for "${searchTerm}"`);
-            }
-            else {
-                const options = matches.slice(0, 50).map(a => ({
-                    value: a.id,
-                    label: a.name || a.id,
-                    hint: a.description?.slice(0, 60),
-                }));
-                const picked = await p.multiselect({
-                    message: `${matches.length} match${matches.length !== 1 ? 'es' : ''} — select to add`,
-                    options,
-                    required: false,
-                });
-                if (!p.isCancel(picked)) {
-                    selectedAdapterIds.push(...picked);
-                }
-            }
-            const cont = await p.confirm({ message: 'Search for more?', initialValue: false });
-            if (p.isCancel(cont) || !cont)
-                searching = false;
-        }
-    }
-    // Step 5: Credentials
-    if (selectedAdapterIds.length > 0) {
-        if (secretsChoice === 'vault' && vaultConnected) {
-            s.start('Pulling credentials from Vault');
-            let pulled = 0;
-            for (const adapterId of selectedAdapterIds) {
-                try {
-                    const controller = new AbortController();
-                    const t = setTimeout(() => controller.abort(), 3000);
-                    const resp = await fetch(`${vaultAddr}/v1/secret/data/${adapterId}`, {
-                        headers: { 'X-Vault-Token': vaultToken },
-                        signal: controller.signal,
-                    });
-                    clearTimeout(t);
-                    if (resp.ok) {
-                        const data = await resp.json();
-                        const secrets = data?.data?.data;
-                        if (secrets) {
-                            for (const [k, v] of Object.entries(secrets)) {
-                                writeCredential(k, v);
-                            }
-                            pulled++;
-                        }
-                    }
-                }
-                catch { /* skip */ }
-            }
-            s.stop(`Pulled credentials for ${pulled} of ${selectedAdapterIds.length} adapters`);
-        }
-        else if (secretsChoice === '1password') {
-            s.start('Pulling credentials from 1Password');
-            let pulled = 0;
-            for (const adapterId of selectedAdapterIds) {
-                try {
-                    const result = execSync(`op item get "${adapterId}" --format json 2>/dev/null`, { encoding: 'utf-8', timeout: 5000 });
-                    const item = JSON.parse(result);
-                    const fields = item.fields || [];
-                    for (const field of fields) {
-                        if (field.value && field.label) {
-                            const envKey = `${adapterId.toUpperCase().replace(/-/g, '_')}_${field.label.toUpperCase().replace(/\s+/g, '_')}`;
-                            writeCredential(envKey, field.value);
-                        }
-                    }
-                    pulled++;
-                }
-                catch { /* skip */ }
-            }
-            s.stop(`Pulled credentials for ${pulled} of ${selectedAdapterIds.length} adapters`);
-        }
-        else if (secretsChoice === 'doppler') {
-            s.start('Pulling credentials from Doppler');
-            try {
-                const result = execSync('doppler secrets download --no-file --format json 2>/dev/null', { encoding: 'utf-8', timeout: 10000 });
-                const secrets = JSON.parse(result);
-                for (const [k, v] of Object.entries(secrets)) {
-                    if (typeof v === 'string')
-                        writeCredential(k, v);
-                }
-                s.stop('Credentials pulled from Doppler');
-            }
-            catch {
-                s.stop('Doppler pull failed — configure with: doppler setup');
-            }
-        }
-        else if (secretsChoice === 'manual') {
-            for (const adapterId of selectedAdapterIds) {
-                const adapter = allAdapters.find(a => a.id === adapterId);
-                if (!adapter)
-                    continue;
-                const envKey = adapter.rest?.envKey || `${adapterId.toUpperCase().replace(/-/g, '_')}_API_KEY`;
-                const key = await p.password({ message: `${envKey} for ${adapter.name || adapterId}` });
-                if (!p.isCancel(key) && key) {
-                    writeCredential(envKey, key);
-                }
-            }
-        }
-        else if (secretsChoice === 'env') {
-            p.log.info('Using credentials from environment variables');
-        }
-        // Step 6: Install stdio dependencies
-        for (const adapterId of selectedAdapterIds) {
-            const adapter = allAdapters.find(a => a.id === adapterId);
-            if (!adapter?.mcp?.packageName || adapter.mcp.transport !== 'stdio')
-                continue;
-            s.start(`Installing ${adapter.name || adapterId}`);
-            try {
-                execSync(`npm install -g --ignore-scripts ${adapter.mcp.packageName}`, { stdio: 'pipe', timeout: 60000 });
-                // Verify artifact integrity
-                try {
-                    const { ArtifactVerifier } = await import('../trust/ArtifactVerifier.js');
-                    const verifier = new ArtifactVerifier({ verifyDigests: true });
-                    const pkgPath = execSync(`npm root -g`, { encoding: 'utf-8', timeout: 5000 }).trim();
-                    const mainFile = join(pkgPath, adapter.mcp.packageName, 'package.json');
-                    const result = await verifier.verify(adapter.mcp.packageName, mainFile);
-                    if (!result.valid) {
-                        s.stop(`${pc.red('✗')} ${adapter.name || adapterId} — integrity check failed`);
-                    }
-                    else {
-                        s.stop(`${pc.green('✓')} ${adapter.name || adapterId} installed — verified`);
-                    }
-                }
-                catch {
-                    s.stop(`${pc.green('✓')} ${adapter.name || adapterId} installed`);
-                }
-            }
-            catch {
-                s.stop(`${pc.yellow('!')} ${adapter.name || adapterId} — run manually: npm install -g ${adapter.mcp.packageName}`);
-            }
-        }
-        // Step 7: Verify
-        s.start('Verifying connections');
-        const creds = loadCredentials();
-        let verified = 0;
-        const results = [];
-        for (const adapterId of selectedAdapterIds) {
-            const adapter = allAdapters.find(a => a.id === adapterId);
-            if (!adapter)
-                continue;
-            const hasKey = adapter.rest?.envKey ? !!creds[adapter.rest.envKey] : false;
-            if (hasKey) {
-                verified++;
-                results.push(`${pc.green('✓')} ${adapter.name || adapterId}  ${adapter.rest?.toolCount || 0} tools`);
-            }
-            else {
-                results.push(`${pc.yellow('○')} ${adapter.name || adapterId}  credentials needed`);
-            }
-        }
-        s.stop('Verification complete');
-        if (results.length > 0) {
-            p.note(results.join('\n'), `${verified} of ${selectedAdapterIds.length} adapters ready`);
-        }
-    }
-    // Step 8: Save state and config
+    // Step 3: Auto-configure all curated (vetted zero-credential) adapters
+    // IMPORTANT: Only add adapters to CURATED after manual vetting — confirm they
+    // return real data, contain no adult/inappropriate content, and are stable.
+    const CURATED = [
+        {
+            id: 'com-claude-mcp-pubmed-pubmed',
+            name: 'PubMed',
+            desc: 'Search 36 million biomedical research papers',
+            tools: 7,
+            demoQuery: 'Recent clinical trials on GLP-1 drugs for obesity',
+            exampleQuery: 'legion query "recent clinical trials on GLP-1 drugs for obesity"',
+        },
+        {
+            id: 'govbase-mcp',
+            name: 'Govbase',
+            desc: 'Government data — legislators, bills, committees',
+            tools: 10,
+            demoQuery: 'Who chairs the Senate Armed Services Committee?',
+            exampleQuery: 'legion query "who chairs the Senate Armed Services Committee?"',
+        },
+        {
+            id: 'searchcode',
+            name: 'Searchcode',
+            desc: 'Search 75 billion lines of open source code',
+            tools: 6,
+            demoQuery: 'Open source implementations of rate limiting in Go',
+            exampleQuery: 'legion query "open source implementations of rate limiting in Go"',
+        },
+        {
+            id: 'robtex',
+            name: 'Robtex',
+            desc: 'Network intelligence — DNS, IP, ASN lookups',
+            tools: 45,
+            demoQuery: 'DNS records and ASN for cloudflare.com',
+            exampleQuery: 'legion query "DNS records and ASN for cloudflare.com"',
+        },
+    ];
+    const s2 = p.spinner();
+    s2.start('Connecting curated data sources');
     const state = loadState();
-    for (const id of selectedAdapterIds) {
-        const adapter = allAdapters.find(a => a.id === id);
-        state.adapters[id] = {
-            type: adapter?.type || 'unknown',
+    const curatedAdapterEntries = CURATED.map(c => allAdapters.find(a => a.id === c.id)).filter(Boolean);
+    for (const c of CURATED) {
+        const adapter = allAdapters.find(a => a.id === c.id);
+        state.adapters[c.id] = {
+            type: adapter?.type || 'mcp',
             status: 'configured',
-            toolCount: adapter?.rest?.toolCount || 0,
+            toolCount: c.tools,
             lastVerified: null,
         };
     }
     saveState(state);
     saveConfig({
-        selectedAdapters: selectedAdapterIds,
-        secretsProvider: secretsChoice,
+        selectedAdapters: CURATED.map(c => c.id),
+        secretsProvider: 'manual',
         aiClient: configuredClients.join(','),
         localBackend: system.localBackend || undefined,
     });
-    // Outro
+    s2.stop('Curated data sources connected');
+    p.note(CURATED.map(c => `${pc.green('✓')} ${c.name.padEnd(14)} ${String(c.tools).padStart(2)} tools   ${pc.dim(c.desc)}`).join('\n'), `Curated (${CURATED.length}) — no credentials required`);
+    // Step 4: Routing demo — prove intelligence in-process, no network calls
+    const { ToolPreFilter } = await import('../federation/ToolPreFilter.js');
+    function buildDemoTools(adapters) {
+        const tools = [];
+        for (const adapter of adapters) {
+            const toolNames = adapter.rest?.toolNames || adapter.mcp?.toolNames || [];
+            if (toolNames.length === 0) {
+                tools.push({ name: `${adapter.id}:default`, description: `${adapter.name} — ${adapter.description || adapter.id}`, parameters: { type: 'object', properties: {} }, server: adapter.id, tier: 'orchestrated' });
+            }
+            else {
+                for (const t of toolNames) {
+                    tools.push({ name: `${adapter.id}:${t}`, description: `${adapter.name} — ${t.replace(/_/g, ' ')}`, parameters: { type: 'object', properties: {} }, server: adapter.id, tier: 'orchestrated' });
+                }
+            }
+        }
+        return tools;
+    }
+    const demoFilter = new ToolPreFilter();
+    demoFilter.index(buildDemoTools(curatedAdapterEntries));
+    const routingLines = [];
+    for (const c of CURATED) {
+        const matches = await demoFilter.select(c.demoQuery, { maxTools: 3, maxPerServer: 2 });
+        const topId = matches[0]?.server;
+        const routed = topId === c.id;
+        const arrow = routed ? pc.green('→') : pc.yellow('→');
+        const adapterLabel = routed ? pc.green(c.name) : pc.yellow(topId || '?');
+        routingLines.push(`  ${pc.dim(`"${c.demoQuery.slice(0, 48)}${c.demoQuery.length > 48 ? '…' : ''}"`)}`);
+        routingLines.push(`  ${arrow} ${adapterLabel}`);
+        routingLines.push('');
+    }
+    p.note(routingLines.join('\n').trimEnd(), 'Routing intelligence');
+    // Step 5: Outro — hand off to shell
     p.note([
-        `Add adapters:     ${pc.cyan('npx @epicai/legion add <name>')}`,
-        `Remove adapters:  ${pc.cyan('npx @epicai/legion remove <name>')}`,
-        `Health check:     ${pc.cyan('npx @epicai/legion health')}`,
-        `Update adapters:  ${pc.cyan('npx @epicai/legion update')}`,
-        `List adapters:    ${pc.cyan('npx @epicai/legion list')}`,
-    ].join('\n'), 'Manage your adapters');
-    p.outro(`${pc.green('Legion is ready.')} Your credentials never leave this machine.`);
+        pc.bold('Try these yourself:'),
+        '',
+        ...CURATED.map(c => `  ${pc.cyan(c.exampleQuery)}`),
+    ].join('\n'), 'Test it');
+    p.note([
+        `  ${pc.cyan('legion configure')}   connect your APIs and credentials`,
+        `  ${pc.cyan('legion help')}        see all commands`,
+    ].join('\n'), 'When you\'re ready to connect your own APIs');
+    p.outro(`${pc.green('Legion is ready.')} Your data never leaves this machine.`);
 }
 // ─── Main router ────────────────────────────────────────────
 async function main() {
@@ -1238,14 +1239,14 @@ async function main() {
     switch (command) {
         case 'add':
             if (!args[1]) {
-                console.error('Usage: npx @epicai/legion add <adapter-name>');
+                console.error('Usage: legion add <adapter-id>  (run "legion search <term>" to find one)');
                 process.exit(1);
             }
             await cmdAdd(args[1]);
             break;
         case 'remove':
             if (!args[1]) {
-                console.error('Usage: npx @epicai/legion remove <adapter-name>');
+                console.error('Usage: legion remove <adapter-id>');
                 process.exit(1);
             }
             await cmdRemove(args[1]);
@@ -1254,7 +1255,24 @@ async function main() {
             await cmdHealth();
             break;
         case 'list':
-            await cmdList(args[1]);
+            await cmdList();
+            break;
+        case 'search':
+            await cmdSearch(args[1]);
+            break;
+        case 'configure':
+            await cmdConfigure();
+            break;
+        case 'help':
+        case '--help':
+        case '-h':
+            await cmdHelp();
+            break;
+        case 'query':
+            console.log('\n  legion query routes through your AI client (Claude Code, Cursor, etc.)');
+            console.log('  Start Legion as an MCP server: legion serve');
+            console.log('  Then ask your AI client: "use legion_query to find..."');
+            console.log('\n  Run: legion help\n');
             break;
         case 'serve':
             await startMcpServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epicai/legion",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Epic AI® Legion — 35,020 tools. One self-hosted MCP server. Intelligent Virtual Assistant (IVA) integration layer for AI agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -121,6 +121,9 @@
     "vitest": "^3.0.0"
   },
   "scripts": {
+    "release:patch": "npm run build && npm version patch && npm publish --access public",
+    "release:minor": "npm run build && npm version minor && npm publish --access public",
+    "release:major": "npm run build && npm version major && npm publish --access public",
     "build": "tsc",
     "postbuild": "npx tsx ../epic-ai/src/fabrique/generate-adapter-catalog.ts",
     "pretest": "tsc",