@getmegabrain/cli 0.1.5 → 0.1.6

package/dist/device-auth.js

@@ -38,28 +38,40 @@ function tryOpenBrowser(url) {
     }
 }
 const POLL_INTERVAL_MS = 2000;
-export async function login(log = console.log) {
+/**
+ * Begin a device-auth attempt without blocking: returns the code + verification URL to show
+ * the user immediately, and a `completed` promise that polls until it is approved. The
+ * `megabrain science` daemon uses this to render the code in the browser while it waits;
+ * `login()` (below) is the terminal wrapper that also prints it and opens the browser.
+ */
+export async function startDeviceAuth() {
     const { code, verificationUrl, expiresIn } = await createDeviceAuthCode();
+    const deadline = Date.now() + expiresIn * 1000;
+    const completed = (async () => {
+        while (Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, POLL_INTERVAL_MS));
+            const result = await pollDeviceAuthCode(code);
+            if (result.status === 'approved') {
+                return { token: result.token, userId: result.userId, userEmail: result.userEmail };
+            }
+            if (result.status === 'denied')
+                throw new Error('Sign-in was denied.');
+            if (result.status === 'expired') {
+                throw new Error('Sign-in code expired. Run `megabrain login` again.');
+            }
+            // 'pending' — keep polling.
+        }
+        throw new Error('Sign-in timed out. Run `megabrain login` again.');
+    })();
+    return { code, verificationUrl, expiresIn, completed };
+}
+export async function login(log = console.log) {
+    const { code, verificationUrl, completed } = await startDeviceAuth();
     log('');
     log(`  Confirm this code:  ${code}`);
     log(`  Sign in at:         ${verificationUrl}`);
     log('');
     log('  Opening your browser…');
     tryOpenBrowser(verificationUrl);
-    const deadline = Date.now() + expiresIn * 1000;
-    while (Date.now() < deadline) {
-        await new Promise(resolve => setTimeout(resolve, POLL_INTERVAL_MS));
-        const result = await pollDeviceAuthCode(code);
-        if (result.status === 'approved') {
-            return { token: result.token, userId: result.userId, userEmail: result.userEmail };
-        }
-        if (result.status === 'denied') {
-            throw new Error('Sign-in was denied.');
-        }
-        if (result.status === 'expired') {
-            throw new Error('Sign-in code expired. Run `megabrain login` again.');
-        }
-        // 'pending' — keep polling.
-    }
-    throw new Error('Sign-in timed out. Run `megabrain login` again.');
+    return completed;
 }

package/dist/index.js

@@ -8,6 +8,7 @@ import { writeOpenCodeConfig } from './opencode-config.js';
 import { fetchGatewayModelIds } from './models.js';
 import { ensureOpencodeBinary } from './opencode.js';
 import { parseCloudForkArgs, isValidSessionId, downloadSessionExport } from './cloud-fork.js';
+import { runScience, runScienceUrl } from './science/index.js';
 async function signIn() {
     console.log('Signing in to MegaBrain…');
     const { token, userId, userEmail } = await login();
@@ -93,6 +94,14 @@ async function main() {
         case 'whoami':
             runWhoami();
             return;
+        case 'science':
+            if (process.argv[3] === 'url') {
+                await runScienceUrl();
+            }
+            else {
+                await runScience();
+            }
+            return;
         default: {
             const args = process.argv.slice(2);
             const { cloudFork, sessionId } = parseCloudForkArgs(args);

package/dist/science/index.js

@@ -0,0 +1,77 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { MEGABRAIN_CONFIG_DIR } from '../paths.js';
+import { startScienceServer } from './server.js';
+/**
+ * `megabrain science` — start the local daemon that serves the workbench on localhost, and
+ * `megabrain science url` — print a fresh single-use sign-in link for the running daemon.
+ * See docs/megabrain-science/reference/claude-science-flow.md §0 (architecture) and §1.1.
+ */
+const RUNTIME_FILE = path.join(MEGABRAIN_CONFIG_DIR, 'science-daemon.json');
+function writeRuntime(rt) {
+    fs.mkdirSync(MEGABRAIN_CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(RUNTIME_FILE, JSON.stringify(rt), { mode: 0o600 });
+}
+function readRuntime() {
+    try {
+        return JSON.parse(fs.readFileSync(RUNTIME_FILE, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    const command = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open';
+    const args = platform === 'win32' ? ['', url] : [url];
+    try {
+        const child = spawn(command, args, {
+            shell: platform === 'win32',
+            stdio: 'ignore',
+            detached: true,
+        });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // The printed URL is the fallback.
+    }
+}
+/** Start the daemon, print + open the first sign-in link, and run until interrupted. */
+export async function runScience() {
+    const { server, port, nonces, kernels, origin } = await startScienceServer();
+    writeRuntime({ port, pid: process.pid });
+    const url = `${origin()}/?nonce=${nonces.create()}`;
+    console.log('\n  MegaBrain Science is running.');
+    console.log(`  Open this link to sign in (works once, expires in 3 minutes):\n\n    ${url}\n`);
+    console.log('  Run `megabrain science url` for a fresh link. Ctrl+C to stop.\n');
+    openBrowser(url);
+    const shutdown = () => {
+        fs.rmSync(RUNTIME_FILE, { force: true });
+        kernels.stopAll();
+        server.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
+/** Ask the running daemon for a fresh sign-in URL and print it. */
+export async function runScienceUrl() {
+    const rt = readRuntime();
+    if (!rt) {
+        throw new Error('MegaBrain Science is not running. Start it with `megabrain science`.');
+    }
+    let res;
+    try {
+        res = await fetch(`http://127.0.0.1:${rt.port}/internal/mint`, { method: 'POST' });
+    }
+    catch {
+        throw new Error('MegaBrain Science is not running. Start it with `megabrain science`.');
+    }
+    if (!res.ok)
+        throw new Error(`Could not mint a sign-in link (HTTP ${res.status}).`);
+    const { url } = (await res.json());
+    console.log(`\n  ${url}\n`);
+    openBrowser(url);
+}

package/dist/science/kernel-protocol.js

@@ -0,0 +1,7 @@
+/**
+ * Kernel Protocol — the transport-agnostic contract the local kernel speaks (ported from the
+ * retired Electron app's `shared/kernel-protocol.ts`). The daemon writes KernelRequest lines
+ * to the kernel's stdin and reads KernelFrame lines from its stdout (newline-delimited JSON).
+ * State persists across cells for the process lifetime — the "kernel shared with the agent".
+ */
+export {};

package/dist/science/kernel.js

@@ -0,0 +1,117 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/**
+ * The local Python kernel — MegaBrain Science's differentiator (#274, reference §0/§1.2). The
+ * agent's model runs in the cloud (via the Gateway), but code executes HERE, on the user's
+ * machine, in a long-lived process whose namespace persists across cells. Raw data never
+ * leaves the machine; only code and chosen results do.
+ *
+ * `KernelBridge` spawns `python3 -u kernel_driver.py` and speaks the Kernel Protocol over
+ * newline-delimited JSON on stdio, streaming frames to subscribers. `KernelManager` keeps one
+ * bridge per session. This is the piece kept from the retired Electron app; the launcher is
+ * pluggable so an SSH/HPC runtime can replace `spawn` later without touching the protocol.
+ */
+export const KERNEL_DRIVER_PATH = fileURLToPath(new URL('./kernel_driver.py', import.meta.url));
+const PYTHON_BIN = process.env.MB_PYTHON_BIN ?? 'python3';
+export class KernelBridge {
+    driverPath;
+    child = null;
+    buffer = '';
+    handlers = new Set();
+    cellCounter = 0;
+    constructor(driverPath = KERNEL_DRIVER_PATH) {
+        this.driverPath = driverPath;
+    }
+    onFrame(handler) {
+        this.handlers.add(handler);
+        return () => this.handlers.delete(handler);
+    }
+    start() {
+        if (this.child)
+            return;
+        this.emit({ type: 'status', state: 'starting' });
+        if (!existsSync(this.driverPath)) {
+            this.emit({
+                type: 'status',
+                state: 'error',
+                error: `kernel driver missing: ${this.driverPath}`,
+            });
+            return;
+        }
+        const child = spawn(PYTHON_BIN, ['-u', this.driverPath], { stdio: ['pipe', 'pipe', 'pipe'] });
+        this.child = child;
+        child.stdout.on('data', (c) => this.onStdout(c));
+        child.stderr.on('data', (c) => this.emit({ type: 'status', state: 'error', error: c.toString('utf8') }));
+        child.on('error', err => this.emit({ type: 'status', state: 'error', error: `kernel failed to start: ${err.message}` }));
+        child.on('exit', code => {
+            this.child = null;
+            this.emit({ type: 'status', state: 'error', error: `kernel exited (code ${code})` });
+        });
+    }
+    /** Run a cell; returns the assigned cellId so callers can correlate frames. */
+    execute(code) {
+        if (!this.child)
+            this.start();
+        this.cellCounter += 1;
+        const cellId = `cell-${this.cellCounter}`;
+        this.send({ type: 'execute', cellId, code });
+        return cellId;
+    }
+    send(request) {
+        if (!this.child)
+            this.start();
+        this.child?.stdin.write(`${JSON.stringify(request)}\n`);
+    }
+    restart() {
+        this.stop();
+        this.buffer = '';
+        this.start();
+    }
+    stop() {
+        this.child?.kill();
+        this.child = null;
+    }
+    onStdout(chunk) {
+        this.buffer += chunk.toString('utf8');
+        let nl = this.buffer.indexOf('\n');
+        while (nl !== -1) {
+            const line = this.buffer.slice(0, nl).trim();
+            this.buffer = this.buffer.slice(nl + 1);
+            if (line) {
+                try {
+                    this.emit(JSON.parse(line));
+                }
+                catch {
+                    this.emit({ type: 'stream', cellId: '', kind: 'stdout', data: line });
+                }
+            }
+            nl = this.buffer.indexOf('\n');
+        }
+    }
+    emit(frame) {
+        for (const h of this.handlers)
+            h(frame);
+    }
+}
+/** One kernel per session, started on demand. */
+export class KernelManager {
+    bridges = new Map();
+    get(sessionId) {
+        let bridge = this.bridges.get(sessionId);
+        if (!bridge) {
+            bridge = new KernelBridge();
+            bridge.start();
+            this.bridges.set(sessionId, bridge);
+        }
+        return bridge;
+    }
+    restart(sessionId) {
+        this.bridges.get(sessionId)?.restart();
+    }
+    stopAll() {
+        for (const bridge of this.bridges.values())
+            bridge.stop();
+        this.bridges.clear();
+    }
+}

package/dist/science/kernel_driver.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""MegaBrain Science — local Python kernel driver.
+
+Implements the Kernel Protocol over newline-delimited JSON on stdio. The Electron
+main process (KernelSupervisor) spawns this with `python3 -u kernel_driver.py`,
+writes KernelRequest lines to stdin, and reads KernelFrame lines from stdout.
+
+State (the exec namespace) persists across cells for the process lifetime, which
+is what makes the kernel "shared with the agent": variables and imports set in one
+cell are visible in the next.
+"""
+
+import contextlib
+import io
+import json
+import sys
+import traceback
+
+# Persistent namespace shared across all cells in this session.
+NAMESPACE: dict = {"__name__": "__mb_science__"}
+
+
+def emit(frame: dict) -> None:
+    sys.stdout.write(json.dumps(frame) + "\n")
+    sys.stdout.flush()
+
+
+def run_cell(cell_id: str, code: str) -> None:
+    emit({"type": "status", "cellId": cell_id, "state": "busy"})
+    stdout, stderr = io.StringIO(), io.StringIO()
+    try:
+        with contextlib.redirect_stdout(stdout), contextlib.redirect_stderr(stderr):
+            # Compile as a module body so top-level expressions still assign/print
+            # normally; the persistent NAMESPACE keeps state between cells.
+            exec(compile(code, f"<{cell_id}>", "exec"), NAMESPACE)
+    except Exception:  # noqa: BLE001 - surface any user error as a stderr stream
+        stderr.write(traceback.format_exc())
+
+    out, err = stdout.getvalue(), stderr.getvalue()
+    if out:
+        emit({"type": "stream", "cellId": cell_id, "kind": "stdout", "data": out})
+    if err:
+        emit({"type": "stream", "cellId": cell_id, "kind": "stderr", "data": err})
+    emit({"type": "status", "cellId": cell_id, "state": "idle"})
+
+
+def emit_snapshot() -> None:
+    import platform
+
+    try:
+        import importlib.metadata as md
+
+        packages = sorted(f"{d.metadata['Name']}=={d.version}" for d in md.distributions())
+    except Exception:  # noqa: BLE001 - environment listing is best-effort
+        packages = []
+
+    emit(
+        {
+            "type": "snapshot",
+            "env": {
+                "language": "python",
+                "version": platform.python_version(),
+                "platform": platform.platform(),
+                "packages": packages,
+            },
+        }
+    )
+
+
+def main() -> None:
+    emit({"type": "status", "state": "idle"})
+    for raw in sys.stdin:
+        line = raw.strip()
+        if not line:
+            continue
+        try:
+            request = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+
+        kind = request.get("type")
+        if kind == "execute":
+            run_cell(request.get("cellId", ""), request.get("code", ""))
+        elif kind == "snapshot":
+            emit_snapshot()
+        elif kind == "interrupt":
+            # Cooperative interrupt is a follow-up; ack for now.
+            emit({"type": "status", "state": "idle"})
+        # "restart" is handled by the supervisor by killing/respawning us.
+
+
+if __name__ == "__main__":
+    main()

package/dist/science/nonce.js

@@ -0,0 +1,53 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * Single-use, short-lived nonces for the browser sign-in hand-off.
+ *
+ * The `megabrain science` daemon prints a `http://127.0.0.1:PORT/?nonce=…` URL and opens it
+ * in the browser. Opening that link is what authorizes *this* browser to drive *this* local
+ * daemon — so a random other process on the machine can't. The nonce works once and expires a
+ * few minutes after it was printed; `megabrain science url` mints a fresh one. See
+ * docs/megabrain-science/reference/claude-science-flow.md §1.1 (screen 01).
+ */
+const NONCE_TTL_MS = 3 * 60 * 1000; // 3 minutes, matching the printed hint.
+export class NonceStore {
+    now;
+    ttlMs;
+    nonces = new Map();
+    constructor(now = Date.now, ttlMs = NONCE_TTL_MS) {
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    /** Mint a fresh nonce and return it (URL-safe hex). */
+    create() {
+        this.sweep();
+        const nonce = randomBytes(20).toString('hex');
+        this.nonces.set(nonce, { createdAt: this.now(), used: false });
+        return nonce;
+    }
+    /**
+     * Validate and consume a nonce. Single-use: a second claim of the same nonce returns
+     * 'used'. Returns 'unknown' for a nonce we never issued (or already swept), 'expired'
+     * past the TTL.
+     */
+    claim(nonce) {
+        const entry = this.nonces.get(nonce);
+        if (!entry)
+            return 'unknown';
+        if (this.now() - entry.createdAt > this.ttlMs) {
+            this.nonces.delete(nonce);
+            return 'expired';
+        }
+        if (entry.used)
+            return 'used';
+        entry.used = true;
+        return 'ok';
+    }
+    /** Drop expired entries so the map doesn't grow unbounded across `url` re-mints. */
+    sweep() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [nonce, entry] of this.nonces) {
+            if (entry.createdAt < cutoff)
+                this.nonces.delete(nonce);
+        }
+    }
+}

package/dist/science/pages.js

@@ -0,0 +1,295 @@
+/**
+ * Server-rendered HTML for the sign-in hand-off. Mirrors the Claude Science screens
+ * (docs/megabrain-science/reference/claude-science-flow.md §1.1), MegaBrain-branded. These
+ * are deliberately dependency-free inline pages — the rich session UI (reused
+ * `cloud-agent-next`) mounts on the shell later; this is just the auth entry.
+ */
+function shell(title, body) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${title}</title>
+    <style>
+      :root { color-scheme: light dark; }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0; min-height: 100vh; display: grid; place-items: center;
+        font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+        background: #fafafa; color: #111;
+      }
+      @media (prefers-color-scheme: dark) { body { background: #0a0a0a; color: #ededed; } }
+      .card {
+        width: min(92vw, 420px); padding: 40px 36px; border-radius: 20px; text-align: center;
+        background: #fff; box-shadow: 0 1px 3px rgba(0,0,0,.06), 0 12px 40px rgba(0,0,0,.08);
+      }
+      @media (prefers-color-scheme: dark) { .card { background: #161616; box-shadow: none; border: 1px solid #262626; } }
+      .mark { width: 56px; height: 56px; margin: 0 auto 20px; border-radius: 14px;
+        background: linear-gradient(135deg, #e8623a, #c8492a); display: grid; place-items: center;
+        color: #fff; font-weight: 700; font-size: 20px; }
+      h1 { font-size: 22px; margin: 0 0 6px; letter-spacing: -.01em; }
+      .beta { font-size: 12px; color: #888; margin-bottom: 24px; }
+      p { color: #555; margin: 0 0 24px; }
+      @media (prefers-color-scheme: dark) { p { color: #a3a3a3; } }
+      code { background: rgba(0,0,0,.06); padding: 1px 6px; border-radius: 5px; font-size: .9em; }
+      @media (prefers-color-scheme: dark) { code { background: rgba(255,255,255,.1); } }
+      a.btn, button.btn {
+        display: block; width: 100%; padding: 12px 16px; margin-top: 10px; border-radius: 12px;
+        font: inherit; font-weight: 600; cursor: pointer; border: 1px solid transparent;
+        text-decoration: none; text-align: center;
+      }
+      .btn-primary { background: #111; color: #fff; }
+      @media (prefers-color-scheme: dark) { .btn-primary { background: #ededed; color: #111; } }
+      .btn-ghost { background: transparent; border-color: #d4d4d4; color: inherit; }
+      @media (prefers-color-scheme: dark) { .btn-ghost { border-color: #333; } }
+      .status { margin-top: 18px; font-size: 13px; color: #888; min-height: 1.5em; }
+      .status a { color: inherit; }
+    </style>
+  </head>
+  <body>
+    <div class="card">${body}</div>
+  </body>
+</html>`;
+}
+/** Screen 01 — the nonce landing that authorizes this browser for this daemon. */
+export function nonceLandingPage(nonce) {
+    return shell('Sign in — MegaBrain Science', `<div class="mark">MB</div>
+     <h1>Sign in to MegaBrain Science</h1>
+     <p>Click below to finish signing in on this browser. This link works once, and expires
+        3 minutes after it was printed — if the button fails, run
+        <code>megabrain science url</code> for a fresh link.</p>
+     <a class="btn btn-primary" href="/login?nonce=${encodeURIComponent(nonce)}">Sign in</a>`);
+}
+/** Shown when a nonce link is reused/expired/unknown. */
+export function nonceInvalidPage() {
+    return shell('Link expired — MegaBrain Science', `<div class="mark">MB</div>
+     <h1>This link has expired</h1>
+     <p>Sign-in links work once and expire after 3 minutes. Run
+        <code>megabrain science url</code> in your terminal for a fresh link.</p>`);
+}
+/** Screen 02 — the login card (MegaBrain OAuth / paste code). */
+export function loginPage() {
+    return shell('MegaBrain Science', `<div class="mark">MB</div>
+     <h1>MegaBrain Science</h1>
+     <div class="beta">Beta</div>
+     <button class="btn btn-primary" id="signin">Sign in with MegaBrain</button>
+     <button class="btn btn-ghost" id="paste">Paste code instead</button>
+     <div class="status" id="status"></div>
+     <script>
+       const statusEl = document.getElementById('status');
+       async function start() {
+         document.getElementById('signin').disabled = true;
+         statusEl.textContent = 'Starting sign-in…';
+         const res = await fetch('/api/signin', { method: 'POST' });
+         if (!res.ok) { statusEl.textContent = 'Could not start sign-in. Try again.'; return; }
+         const { verificationUrl, code } = await res.json();
+         statusEl.innerHTML = 'Confirm code <code>' + code + '</code> at <a href="' +
+           verificationUrl + '" target="_blank" rel="noreferrer">' + verificationUrl + '</a>';
+         poll();
+       }
+       async function poll() {
+         const res = await fetch('/api/auth/status');
+         const s = await res.json();
+         if (s.signedIn) { statusEl.textContent = 'Signed in. Opening…'; location.href = '/'; return; }
+         setTimeout(poll, 2000);
+       }
+       document.getElementById('signin').addEventListener('click', start);
+       // The code is minted server-side and shown here, so "paste" starts the same flow.
+       document.getElementById('paste').addEventListener('click', start);
+     </script>`);
+}
+function esc(s) {
+    return s.replace(/[&<>"']/g, c => c === '&' ? '&amp;' : c === '<' ? '&lt;' : c === '>' ? '&gt;' : c === '"' ? '&quot;' : '&#39;');
+}
+/**
+ * Home — Projects + Recent sessions (#270). A thin server-rendered placeholder that reads the
+ * daemon's workspace API; the reused cloud-agent-next UI replaces the markup later, but the
+ * `/api/*` contract it exercises here is the durable part.
+ */
+export function homePage(userEmail) {
+    return shell('MegaBrain Science', `<div class="mark">MB</div>
+     <h1>MegaBrain Science</h1>
+     <div class="beta">${esc(userEmail)}</div>
+     <div style="text-align:left;margin-top:8px">
+       <div style="display:flex;justify-content:space-between;align-items:center">
+         <strong>Projects</strong>
+         <button class="btn btn-ghost" style="width:auto;padding:6px 12px;margin:0" id="new">+ New project</button>
+       </div>
+       <div id="projects" class="status">Loading…</div>
+       <strong style="display:block;margin-top:20px">Recent sessions</strong>
+       <div id="recent" class="status"></div>
+     </div>
+     <button class="btn btn-ghost" id="out" style="margin-top:20px">Sign out</button>
+     <script>
+       async function load() {
+         const [projects, recent] = await Promise.all([
+           fetch('/api/projects').then(r => r.json()),
+           fetch('/api/sessions/recent').then(r => r.json()),
+         ]);
+         document.getElementById('projects').innerHTML = projects.length
+           ? projects.map(p => '<a href="/projects/' + p.id + '" style="display:block;color:inherit">' +
+               p.name + ' · ' + p.sessionCount + ' session(s)</a>').join('')
+           : 'No projects yet.';
+         document.getElementById('recent').innerHTML = recent.length
+           ? recent.map(s => '<a href="/projects/' + s.projectId + '/frames/' + s.id +
+               '" style="display:block;color:inherit">' + s.title + '</a>').join('')
+           : 'No sessions yet.';
+       }
+       document.getElementById('new').addEventListener('click', async () => {
+         const name = prompt('Project name:'); if (!name) return;
+         const p = await fetch('/api/projects', { method: 'POST',
+           headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name }) }).then(r => r.json());
+         location.href = '/projects/' + p.id;
+       });
+       document.getElementById('out').addEventListener('click', async () => {
+         await fetch('/api/signout', { method: 'POST' }); location.href = '/login';
+       });
+       load();
+     </script>`);
+}
+/** A single project: its sessions + New session (#271). Placeholder markup, real API. */
+export function projectPage(projectId) {
+    return shell('Project — MegaBrain Science', `<div class="mark">MB</div>
+     <h1 id="title">Project</h1>
+     <div style="text-align:left">
+       <div style="display:flex;justify-content:space-between;align-items:center">
+         <strong>Sessions</strong>
+         <button class="btn btn-ghost" style="width:auto;padding:6px 12px;margin:0" id="new">+ New</button>
+       </div>
+       <div id="sessions" class="status">Loading…</div>
+     </div>
+     <a class="btn btn-ghost" href="/" style="margin-top:20px">← Home</a>
+     <script>
+       const pid = ${JSON.stringify(projectId)};
+       async function load() {
+         const p = await fetch('/api/projects/' + pid).then(r => r.json());
+         if (p.project) document.getElementById('title').textContent = p.project.name;
+         document.getElementById('sessions').innerHTML = (p.sessions || []).length
+           ? p.sessions.map(s => '<a href="/projects/' + pid + '/frames/' + s.id +
+               '" style="display:block;color:inherit">' + s.title + '</a>').join('')
+           : 'No sessions yet.';
+       }
+       document.getElementById('new').addEventListener('click', async () => {
+         const s = await fetch('/api/projects/' + pid + '/sessions', { method: 'POST',
+           headers: { 'content-type': 'application/json' }, body: JSON.stringify({ title: 'New session' }) }).then(r => r.json());
+         location.href = '/projects/' + pid + '/frames/' + s.id;
+       });
+       load();
+     </script>`);
+}
+/**
+ * `/start` — the 5-step first-run onboarding wizard (reference §1.3, #286): scientific-web
+ * egress → connectors & skills → research profile → first task. Server-rendered; persists via
+ * `/api/onboarding` and creates the first project/session on "Start".
+ */
+export function startWizardPage(d) {
+    const checks = (items, on, group) => items
+        .map(i => `<label style="display:flex;justify-content:space-between;gap:12px;padding:8px 0;border-bottom:1px solid rgba(128,128,128,.15)">
+             <span>${esc(i)}</span>
+             <input type="checkbox" data-group="${group}" value="${esc(i)}" ${on.includes(i) ? 'checked' : ''} />
+           </label>`)
+        .join('');
+    const TASKS = [
+        [
+            'Map the recent literature of your subfield',
+            'Pull the last year of papers, extract key quantitative findings, and write a structured review with citations and a suggested next experiment.',
+        ],
+        [
+            'Run a first-pass analysis on a dataset you already have',
+            'Point the agent at your data — it runs QC and a first analysis pass and returns figures plus a written summary.',
+        ],
+        [
+            'Turn a workflow you repeat by hand into a reusable pipeline',
+            'Describe the steps you do manually — the agent builds a documented, rerunnable pipeline and demonstrates it end-to-end.',
+        ],
+    ];
+    const taskCards = TASKS.map(([t, sub], i) => `<label style="display:block;text-align:left;border:1px solid rgba(128,128,128,.25);border-radius:12px;padding:12px;margin:8px 0;cursor:pointer">
+         <input type="radio" name="task" value="${esc(t)}" ${i === 0 ? 'checked' : ''} />
+         <strong>${esc(t)}</strong><br /><span class="status">${esc(sub)}</span>
+       </label>`).join('');
+    return shell('Set up — MegaBrain Science', `<div style="text-align:left">
+       <section data-step="0"><h1>Connect to the scientific web</h1>
+         <p>Choose which sources the agent can pull papers, sequences, and structures from.</p>
+         ${checks(d.networkCategories, d.network, 'network')}</section>
+       <section data-step="1" hidden><h1>Connectors &amp; skills</h1>
+         <p>Work directly with databases, research tools, and open science models.</p>
+         ${checks(d.connectorCatalog, d.connectors, 'connectors')}</section>
+       <section data-step="2" hidden><h1>What do you work on?</h1>
+         <p>Describe your field, methods, and current project.</p>
+         <textarea id="profile" rows="5" style="width:100%" placeholder="e.g. I'm a postdoc doing single-cell RNA-seq on zebrafish heart regeneration — mostly Seurat + our own Nextflow pipelines.">${esc(d.profile)}</textarea></section>
+       <section data-step="3" hidden><h1>Where should we start?</h1>
+         <p>Pick a first task, or describe your own.</p>${taskCards}
+         <input id="customTask" style="width:100%;margin-top:8px" placeholder="Describe your own first task (optional)" /></section>
+       <div style="display:flex;justify-content:space-between;margin-top:20px">
+         <button class="btn btn-ghost" style="width:auto;padding:8px 16px;margin:0" id="back">Back</button>
+         <span class="status" id="dots"></span>
+         <button class="btn btn-primary" style="width:auto;padding:8px 16px;margin:0" id="next">Continue</button>
+       </div>
+     </div>
+     <script>
+       const steps = [...document.querySelectorAll('section[data-step]')];
+       let i = 0;
+       const gather = g => [...document.querySelectorAll('input[data-group="' + g + '"]:checked')].map(e => e.value);
+       function render() {
+         steps.forEach((s, n) => (s.hidden = n !== i));
+         document.getElementById('back').style.visibility = i === 0 ? 'hidden' : 'visible';
+         document.getElementById('next').textContent = i === steps.length - 1 ? 'Start' : 'Continue';
+         document.getElementById('dots').textContent = (i + 1) + ' / ' + steps.length;
+       }
+       document.getElementById('back').addEventListener('click', () => { if (i > 0) { i--; render(); } });
+       document.getElementById('next').addEventListener('click', async () => {
+         if (i < steps.length - 1) { i++; render(); return; }
+         const profile = document.getElementById('profile').value;
+         await fetch('/api/onboarding', { method: 'PUT', headers: { 'content-type': 'application/json' },
+           body: JSON.stringify({ network: gather('network'), connectors: gather('connectors'), profile, onboarded: true }) });
+         const task = document.getElementById('customTask').value.trim() ||
+           (document.querySelector('input[name="task"]:checked') || {}).value || '';
+         const r = await fetch('/api/onboarding/start', { method: 'POST', headers: { 'content-type': 'application/json' },
+           body: JSON.stringify({ task, profile }) }).then(r => r.json());
+         location.href = '/projects/' + r.projectId + '/frames/' + r.sessionId;
+       });
+       render();
+     </script>`);
+}
+/**
+ * A working session with a live local-kernel REPL (#274/#277). The transcript + composer
+ * (reused cloud-agent-next) replaces this markup later; the kernel SSE + execute contract it
+ * exercises is the durable part — compute runs locally, streamed over Server-Sent Events.
+ */
+export function sessionPage(projectId, sessionId) {
+    const sid = JSON.stringify(sessionId);
+    return shell('Session — MegaBrain Science', `<div style="text-align:left">
+       <h1 id="title" style="font-size:18px">Session</h1>
+       <div class="status" id="kstate">kernel: starting…</div>
+       <div id="out" style="font:12px/1.5 ui-monospace,Menlo,monospace;white-space:pre-wrap;background:rgba(128,128,128,.08);border-radius:10px;padding:12px;min-height:80px;max-height:40vh;overflow:auto"></div>
+       <textarea id="code" rows="4" spellcheck="false" style="width:100%;margin-top:10px;font:12px/1.5 ui-monospace,Menlo,monospace" placeholder="print(6 * 7)"></textarea>
+       <div style="display:flex;gap:8px;margin-top:8px">
+         <button class="btn btn-primary" style="width:auto;padding:8px 16px;margin:0" id="run">Run ⌘⏎</button>
+         <button class="btn btn-ghost" style="width:auto;padding:8px 16px;margin:0" id="restart">Restart kernel</button>
+         <a class="btn btn-ghost" style="width:auto;padding:8px 16px;margin:0" href="/projects/${esc(projectId)}">← Project</a>
+       </div>
+     </div>
+     <script>
+       const sid = ${sid};
+       const out = document.getElementById('out');
+       fetch('/api/sessions/' + sid).then(r => r.json()).then(s => {
+         if (s && s.title) document.getElementById('title').textContent = s.title;
+       });
+       const es = new EventSource('/api/sessions/' + sid + '/kernel/stream');
+       es.onmessage = e => {
+         const f = JSON.parse(e.data);
+         if (f.type === 'status') document.getElementById('kstate').textContent = 'kernel: ' + f.state + (f.error ? ' — ' + f.error : '');
+         else if (f.type === 'stream') { out.textContent += f.data; out.scrollTop = out.scrollHeight; }
+       };
+       async function run() {
+         const code = document.getElementById('code').value;
+         if (!code.trim()) return;
+         out.textContent += '>>> ' + code + '\\n';
+         await fetch('/api/sessions/' + sid + '/kernel/execute', { method:'POST', headers:{'content-type':'application/json'}, body: JSON.stringify({ code }) });
+       }
+       document.getElementById('run').addEventListener('click', run);
+       document.getElementById('code').addEventListener('keydown', e => { if ((e.metaKey||e.ctrlKey) && e.key==='Enter') { e.preventDefault(); run(); } });
+       document.getElementById('restart').addEventListener('click', () => fetch('/api/sessions/' + sid + '/kernel/restart', { method:'POST' }));
+     </script>`);
+}

package/dist/science/server.js

@@ -0,0 +1,306 @@
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { readCredentials, writeCredentials, clearCredentials } from '../credentials.js';
+import { startDeviceAuth } from '../device-auth.js';
+import { NonceStore } from './nonce.js';
+import { homePage, loginPage, nonceInvalidPage, nonceLandingPage, projectPage, sessionPage, startWizardPage, } from './pages.js';
+import { FEATURED_CONNECTORS, NETWORK_CATEGORIES, WorkspaceStore } from './store.js';
+import { KernelManager } from './kernel.js';
+/**
+ * The `megabrain science` local daemon's HTTP server. Serves the sign-in hand-off on
+ * localhost (docs/megabrain-science/reference/claude-science-flow.md §1.1) and, once signed
+ * in, a placeholder app shell where the reused session UI will mount. Two trust layers:
+ *   1. a single-use nonce authorizes a browser to drive this daemon (a printed localhost URL),
+ *   2. MegaBrain device-auth authenticates the account (reused from the CLI).
+ */
+const COOKIE = 'mb_sci';
+const PREFERRED_PORT = 8765;
+export async function startScienceServer(host = '127.0.0.1') {
+    const nonces = new NonceStore();
+    const trusted = new Set();
+    const store = new WorkspaceStore();
+    const kernels = new KernelManager();
+    let pending = null;
+    const isSignedIn = () => readCredentials() !== null;
+    const readBody = (req) => new Promise(resolve => {
+        let raw = '';
+        req.on('data', chunk => {
+            raw += chunk;
+            if (raw.length > 1_000_000)
+                req.destroy(); // guard against oversized bodies
+        });
+        req.on('end', () => {
+            try {
+                resolve(raw ? JSON.parse(raw) : {});
+            }
+            catch {
+                resolve({});
+            }
+        });
+        req.on('error', () => resolve({}));
+    });
+    const str = (v) => (typeof v === 'string' ? v : undefined);
+    const cookieId = (req) => {
+        const raw = req.headers.cookie ?? '';
+        for (const part of raw.split(';')) {
+            const [k, v] = part.trim().split('=');
+            if (k === COOKIE && v)
+                return v;
+        }
+        return null;
+    };
+    const isTrusted = (req) => {
+        const id = cookieId(req);
+        return id !== null && trusted.has(id);
+    };
+    const html = (res, body, status = 200) => {
+        res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+        res.end(body);
+    };
+    const json = (res, body, status = 200) => {
+        res.writeHead(status, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(body));
+    };
+    const redirect = (res, location) => {
+        res.writeHead(302, { location });
+        res.end();
+    };
+    const server = createServer(async (req, res) => {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? host}`);
+        const path = url.pathname;
+        const method = req.method ?? 'GET';
+        const seg = path.split('/').filter(Boolean);
+        // ── Sign-in hand-off ───────────────────────────────────────────────
+        if (path === '/' && url.searchParams.has('nonce')) {
+            const result = nonces.claim(url.searchParams.get('nonce') ?? '');
+            if (result !== 'ok')
+                return html(res, nonceInvalidPage(), 410);
+            const id = randomBytes(18).toString('hex');
+            trusted.add(id);
+            res.setHeader('set-cookie', `${COOKIE}=${id}; HttpOnly; SameSite=Lax; Path=/`);
+            return html(res, nonceLandingPage(url.searchParams.get('nonce') ?? ''));
+        }
+        if (path === '/') {
+            if (!isTrusted(req))
+                return html(res, nonceInvalidPage(), 401);
+            const creds = readCredentials();
+            if (!creds)
+                return redirect(res, '/login');
+            // First run: send new accounts through the onboarding wizard before Home.
+            if (!store.getSettings().onboarded)
+                return redirect(res, '/start');
+            return html(res, homePage(creds.userEmail));
+        }
+        if (path === '/login' && method === 'GET') {
+            if (!isTrusted(req))
+                return html(res, nonceInvalidPage(), 401);
+            return isSignedIn() ? redirect(res, '/') : html(res, loginPage());
+        }
+        if (path === '/start' && method === 'GET') {
+            if (!isTrusted(req))
+                return html(res, nonceInvalidPage(), 401);
+            if (!isSignedIn())
+                return redirect(res, '/login');
+            const s = store.getSettings();
+            return html(res, startWizardPage({
+                networkCategories: [...NETWORK_CATEGORIES],
+                connectorCatalog: [...FEATURED_CONNECTORS],
+                network: s.network,
+                connectors: s.connectors,
+                profile: s.profile,
+            }));
+        }
+        // ── Workbench pages (trusted + signed in) ───────────────────────────
+        if (seg[0] === 'projects' && method === 'GET') {
+            if (!isTrusted(req))
+                return html(res, nonceInvalidPage(), 401);
+            if (!isSignedIn())
+                return redirect(res, '/login');
+            if (seg.length === 2)
+                return html(res, projectPage(seg[1] ?? ''));
+            if (seg.length === 4 && seg[2] === 'frames') {
+                return html(res, sessionPage(seg[1] ?? '', seg[3] ?? ''));
+            }
+        }
+        // ── Auth API (browser-driven, gated on the local-trust cookie) ──────
+        if (path === '/api/signin' && method === 'POST') {
+            if (!isTrusted(req))
+                return json(res, { error: 'untrusted' }, 401);
+            if (isSignedIn())
+                return json(res, { signedIn: true });
+            const respond = (p) => json(res, { verificationUrl: p.verificationUrl, code: p.code });
+            if (pending)
+                return respond(pending);
+            void startDeviceAuth()
+                .then(p => {
+                pending = p;
+                p.completed
+                    .then(creds => writeCredentials(creds))
+                    .catch(() => {
+                    /* denied / expired — the browser can retry, which mints a new code */
+                })
+                    .finally(() => {
+                    pending = null;
+                });
+                respond(p);
+            })
+                .catch(() => json(res, { error: 'start-failed' }, 502));
+            return;
+        }
+        if (path === '/api/auth/status' && method === 'GET') {
+            const creds = readCredentials();
+            return json(res, { signedIn: creds !== null, userEmail: creds?.userEmail ?? null });
+        }
+        if (path === '/api/signout' && method === 'POST') {
+            clearCredentials();
+            return json(res, { ok: true });
+        }
+        // ── Onboarding API (#286). Signed-in only. ──────────────────────────
+        if (path === '/api/onboarding') {
+            if (!isSignedIn())
+                return json(res, { error: 'signed-out' }, 401);
+            if (method === 'GET')
+                return json(res, store.getSettings());
+            if (method === 'PUT') {
+                const b = await readBody(req);
+                const arr = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : undefined;
+                return json(res, store.updateSettings({
+                    network: arr(b.network),
+                    connectors: arr(b.connectors),
+                    skills: arr(b.skills),
+                    profile: str(b.profile),
+                    onboarded: typeof b.onboarded === 'boolean' ? b.onboarded : undefined,
+                }));
+            }
+        }
+        if (path === '/api/onboarding/start' && method === 'POST') {
+            if (!isSignedIn())
+                return json(res, { error: 'signed-out' }, 401);
+            const b = await readBody(req);
+            const task = str(b.task)?.trim() ?? '';
+            const profile = str(b.profile)?.trim() ?? '';
+            store.updateSettings({ onboarded: true, ...(profile ? { profile } : {}) });
+            const project = store.createProject({
+                name: profile ? profile.slice(0, 60) : 'My research',
+                agentContext: profile,
+            });
+            const session = store.createSession({
+                projectId: project.id,
+                title: task || 'New session',
+                summary: task,
+            });
+            return json(res, { projectId: project.id, sessionId: session?.id ?? null }, 201);
+        }
+        // ── Local kernel (#274). Per-session Python process; SSE for live frames. ──
+        if (seg[0] === 'api' && seg[1] === 'sessions' && seg[2] && seg[3] === 'kernel') {
+            if (!isSignedIn())
+                return json(res, { error: 'signed-out' }, 401);
+            const sid = seg[2];
+            if (seg[4] === 'stream' && method === 'GET') {
+                res.writeHead(200, {
+                    'content-type': 'text/event-stream',
+                    'cache-control': 'no-cache',
+                    connection: 'keep-alive',
+                });
+                const off = kernels
+                    .get(sid)
+                    .onFrame(frame => res.write(`data: ${JSON.stringify(frame)}\n\n`));
+                req.on('close', off);
+                return;
+            }
+            if (seg[4] === 'execute' && method === 'POST') {
+                const b = await readBody(req);
+                const cellId = kernels.get(sid).execute(str(b.code) ?? '');
+                store.touchSession(sid);
+                return json(res, { cellId });
+            }
+            if (seg[4] === 'restart' && method === 'POST') {
+                kernels.restart(sid);
+                return json(res, { ok: true });
+            }
+        }
+        // ── Workspace API (projects/sessions, #270/#271). Signed-in only. ────
+        if (path.startsWith('/api/projects') || path.startsWith('/api/sessions')) {
+            if (!isSignedIn())
+                return json(res, { error: 'signed-out' }, 401);
+            if (path === '/api/projects' && method === 'GET')
+                return json(res, store.listProjects());
+            if (path === '/api/projects' && method === 'POST') {
+                const b = await readBody(req);
+                const name = str(b.name);
+                if (!name)
+                    return json(res, { error: 'name-required' }, 400);
+                return json(res, store.createProject({
+                    name,
+                    description: str(b.description),
+                    agentContext: str(b.agentContext),
+                }), 201);
+            }
+            if (seg[0] === 'api' && seg[1] === 'projects' && seg[2]) {
+                const pid = seg[2];
+                if (seg.length === 3 && method === 'GET') {
+                    const project = store.getProject(pid);
+                    return project
+                        ? json(res, { project, sessions: store.listSessions(pid) })
+                        : json(res, { error: 'not-found' }, 404);
+                }
+                if (seg.length === 3 && method === 'PATCH') {
+                    const b = await readBody(req);
+                    const updated = store.updateProject(pid, {
+                        name: str(b.name),
+                        description: str(b.description),
+                        agentContext: str(b.agentContext),
+                    });
+                    return updated ? json(res, updated) : json(res, { error: 'not-found' }, 404);
+                }
+                if (seg.length === 4 && seg[3] === 'sessions' && method === 'POST') {
+                    const b = await readBody(req);
+                    const session = store.createSession({
+                        projectId: pid,
+                        title: str(b.title),
+                        summary: str(b.summary),
+                    });
+                    return session ? json(res, session, 201) : json(res, { error: 'not-found' }, 404);
+                }
+            }
+            if (path === '/api/sessions/recent' && method === 'GET') {
+                return json(res, store.recentSessions());
+            }
+            if (seg[0] === 'api' && seg[1] === 'sessions' && seg[2] && method === 'GET') {
+                const session = store.getSession(seg[2]);
+                return session ? json(res, session) : json(res, { error: 'not-found' }, 404);
+            }
+            return json(res, { error: 'not-found' }, 404);
+        }
+        // Mint a fresh sign-in URL for `megabrain science url` (localhost-only, like the daemon
+        // itself — any local terminal can ask for a link; the account auth still gates access).
+        if (path === '/internal/mint' && method === 'POST') {
+            const origin = `http://${host}:${port}`;
+            return json(res, { url: `${origin}/?nonce=${nonces.create()}` });
+        }
+        res.writeHead(404, { 'content-type': 'text/plain' });
+        res.end('Not found');
+    });
+    const port = await listen(server, host, PREFERRED_PORT);
+    const origin = () => `http://${host}:${port}`;
+    return { server, port, nonces, kernels, origin };
+}
+/** Bind the preferred port, falling back to an OS-assigned one if it's taken. */
+function listen(server, host, preferred) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            if (err.code === 'EADDRINUSE') {
+                server.listen(0, host);
+                return;
+            }
+            reject(err);
+        };
+        server.on('error', onError);
+        server.on('listening', () => {
+            server.off('error', onError);
+            const address = server.address();
+            resolve(typeof address === 'object' && address ? address.port : preferred);
+        });
+        server.listen(preferred, host);
+    });
+}

package/dist/science/store.js

@@ -0,0 +1,160 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { MEGABRAIN_CONFIG_DIR } from '../paths.js';
+/** Scientific-web egress categories offered in onboarding step "Connect to the scientific web". */
+export const NETWORK_CATEGORIES = [
+    'NCBI / NIH',
+    'Genomics & biology',
+    'Proteomics',
+    'Literature & citations',
+    'Clinical & pharma',
+];
+/** Featured research connectors offered in onboarding step "Connectors & skills". */
+export const FEATURED_CONNECTORS = [
+    'BioMart',
+    'bioRxiv',
+    'Cancer Models',
+    'CellGuide',
+    'PubMed',
+    'OpenAlex',
+];
+function defaultSettings() {
+    return {
+        onboarded: false,
+        network: [...NETWORK_CATEGORIES],
+        connectors: [...FEATURED_CONNECTORS],
+        skills: [],
+        profile: '',
+    };
+}
+const STORE_FILE = path.join(MEGABRAIN_CONFIG_DIR, 'science-workspace.json');
+function id(prefix) {
+    return `${prefix}_${randomBytes(8).toString('hex')}`;
+}
+export class WorkspaceStore {
+    file;
+    now;
+    data;
+    constructor(file = STORE_FILE, now = () => new Date().toISOString()) {
+        this.file = file;
+        this.now = now;
+        this.data = this.load();
+    }
+    load() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.file, 'utf8'));
+            return {
+                projects: parsed.projects ?? [],
+                sessions: parsed.sessions ?? [],
+                settings: parsed.settings,
+            };
+        }
+        catch {
+            return { projects: [], sessions: [] };
+        }
+    }
+    save() {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        // Atomic write so a crash mid-save can't corrupt the workspace.
+        const tmp = `${this.file}.${randomBytes(4).toString('hex')}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(this.data, null, 2), { mode: 0o600 });
+        fs.renameSync(tmp, this.file);
+    }
+    // ── Projects ─────────────────────────────────────────────────────────
+    listProjects() {
+        return this.data.projects
+            .map(p => {
+            const sessions = this.data.sessions.filter(s => s.projectId === p.id);
+            const lastActivity = sessions.reduce((max, s) => (s.updatedAt > max ? s.updatedAt : max), p.updatedAt);
+            return { ...p, sessionCount: sessions.length, lastActivity };
+        })
+            .sort((a, b) => b.lastActivity.localeCompare(a.lastActivity));
+    }
+    getProject(projectId) {
+        return this.data.projects.find(p => p.id === projectId) ?? null;
+    }
+    createProject(input) {
+        const ts = this.now();
+        const project = {
+            id: id('proj'),
+            name: input.name.trim() || 'Untitled project',
+            description: input.description?.trim() ?? '',
+            agentContext: input.agentContext?.trim() ?? '',
+            createdAt: ts,
+            updatedAt: ts,
+        };
+        this.data.projects.push(project);
+        this.save();
+        return project;
+    }
+    updateProject(projectId, patch) {
+        const project = this.data.projects.find(p => p.id === projectId);
+        if (!project)
+            return null;
+        if (patch.name !== undefined)
+            project.name = patch.name.trim() || project.name;
+        if (patch.description !== undefined)
+            project.description = patch.description.trim();
+        if (patch.agentContext !== undefined)
+            project.agentContext = patch.agentContext.trim();
+        project.updatedAt = this.now();
+        this.save();
+        return project;
+    }
+    // ── Sessions ─────────────────────────────────────────────────────────
+    listSessions(projectId) {
+        return this.data.sessions
+            .filter(s => s.projectId === projectId)
+            .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+    }
+    recentSessions(limit = 10) {
+        return [...this.data.sessions]
+            .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))
+            .slice(0, limit);
+    }
+    getSession(sessionId) {
+        return this.data.sessions.find(s => s.id === sessionId) ?? null;
+    }
+    createSession(input) {
+        if (!this.getProject(input.projectId))
+            return null;
+        const ts = this.now();
+        const session = {
+            id: id('sess'),
+            projectId: input.projectId,
+            title: input.title?.trim() || 'New session',
+            summary: input.summary?.trim() ?? '',
+            createdAt: ts,
+            updatedAt: ts,
+        };
+        this.data.sessions.push(session);
+        this.save();
+        return session;
+    }
+    /** Bump a session's activity timestamp (and optionally its summary/title). */
+    touchSession(sessionId, patch) {
+        const session = this.data.sessions.find(s => s.id === sessionId);
+        if (!session)
+            return null;
+        if (patch?.title !== undefined)
+            session.title = patch.title.trim() || session.title;
+        if (patch?.summary !== undefined)
+            session.summary = patch.summary.trim();
+        session.updatedAt = this.now();
+        this.save();
+        return session;
+    }
+    // ── Onboarding settings ──────────────────────────────────────────────
+    getSettings() {
+        return { ...defaultSettings(), ...this.data.settings };
+    }
+    updateSettings(patch) {
+        const next = { ...this.getSettings(), ...patch };
+        if (patch.profile !== undefined)
+            next.profile = patch.profile.trim();
+        this.data.settings = next;
+        this.save();
+        return next;
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@getmegabrain/cli",
-  "version": "0.1.5",
-  "description": "MegaBrain CLI — sign in once, then code from your terminal via OpenCode wired to the MegaBrain Gateway.",
+  "version": "0.1.6",
+  "description": "MegaBrain CLI — sign in once, then code from your terminal via OpenCode wired to the MegaBrain Gateway, or run `megabrain science` for the local research workbench.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "postbuild": "chmod +x dist/index.js",
+    "postbuild": "node scripts/copy-assets.mjs && chmod +x dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsgo --noEmit",
     "test": "vitest run --passWithNoTests",