@getreka/cli 0.2.0 → 0.3.0

package/dist/commands/init.d.ts

@@ -6,4 +6,5 @@ export declare function initCommand(opts: {
     cloud?: boolean;
     key?: string;
     apiUrl?: string;
+    container?: string;
 }): Promise<void>;

package/dist/commands/init.js

@@ -39,44 +39,128 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.initCommand = initCommand;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
 const chalk_1 = __importDefault(require("chalk"));
 const api_1 = require("../api");
 const config_1 = require("../config");
-const MCP_TEMPLATE = `{
-  "mcpServers": {
-    "reka": {
-      "command": "npx",
-      "args": ["-y", "@getreka/mcp"],
-      "env": {
-        "REKA_API_KEY": "{{API_KEY}}"
-      }
-    }
-  }
-}`;
+const mcp_config_1 = require("../mcp-config");
+const mint_1 = require("../mint");
+const setup_files_1 = require("../setup-files");
+/*
+ * KEY MINTING MECHANISM (LB-3)
+ * ----------------------------
+ * Self-hosted rag-api uses deny-by-default API-key auth; keys live in
+ * data/keys.json inside the container and are loaded ONCE at startup
+ * (rag-api/src/middleware/auth.ts — no file watcher). POST /api/keys is
+ * admin-gated: it sits BEHIND authMiddleware (needs any valid key) and
+ * requireAdmin (loopback socket or X-Admin-Key). From the host, a Docker
+ * published port is never a loopback socket for the container, so the CLI
+ * cannot mint over plain HTTP.
+ *
+ * Resolution order when running `reka init`:
+ *   1. --key flag — used as-is.
+ *   2. Existing REKA_API_KEY in .mcp.json (verified via GET /api/whoami) —
+ *      keeps re-runs idempotent: no duplicate keys, no restarts.
+ *      Skipped with --force.
+ *   3. Docker mint: discover the rag-api container (default "reka-api",
+ *      override via --container or REKA_CONTAINER) and run
+ *        docker exec <container> node -e "<script>"
+ *      The script first POSTs http://127.0.0.1:<API_PORT>/api/keys from
+ *      INSIDE the container — that's a loopback socket, so requireAdmin
+ *      passes, and when ALLOW_ANONYMOUS=true (dev) authMiddleware passes
+ *      too; the key is registered in the live process immediately.
+ *      If that returns 401/403 (prod: keys configured, anonymous off), it
+ *      falls back to the same module the server uses:
+ *        const {generateKey}=require('./dist/middleware/auth');
+ *        generateKey('<project>','cli-init')
+ *      generateKey PERSISTS the hash to data/keys.json (saveKeys) and
+ *      returns the plaintext once — but only the exec'd process has it in
+ *      memory, so the CLI then runs `docker restart <container>`, waits
+ *      for /api/health, and verifies the key with an authed /api/whoami.
+ *   4. Interactive prompt, printing the docker-exec admin one-liner so an
+ *      operator can mint out-of-band.
+ */
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+function defaultMintDeps() {
+    return {
+        execFile: async (cmd, args) => {
+            const { stdout } = await execFile(cmd, args, { timeout: 60000 });
+            return { stdout };
+        },
+        httpGet: async (url, headers) => {
+            const axios = (await Promise.resolve().then(() => __importStar(require("axios")))).default;
+            const res = await axios.get(url, {
+                headers,
+                timeout: 10000,
+                validateStatus: () => true,
+            });
+            return { status: res.status };
+        },
+        prompt: (question) => {
+            if (!process.stdin.isTTY) {
+                return Promise.reject(new Error("No API key available and stdin is not a TTY."));
+            }
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            return new Promise((resolve) => rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer);
+            }));
+        },
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+        log: (msg) => console.log(chalk_1.default.yellow(`  ${msg}`)),
+    };
+}
 async function initCommand(opts) {
     const projectPath = opts.path || process.cwd();
     const projectName = opts.project || path.basename(projectPath);
-    // Demo mode: connect to public demo instance
+    // Demo mode: device authorization flow
     if (opts.demo) {
-        const demoUrl = "https://rag.akeryuu.com";
-        console.log("");
-        console.log(chalk_1.default.bold("  Connecting to Reka Demo..."));
+        const demoApiUrl = "https://rag.akeryuu.com";
+        const axios = (await Promise.resolve().then(() => __importStar(require("axios")))).default;
+        console.log(chalk_1.default.bold("\n  Connecting to Reka Demo...\n"));
         try {
-            const demoClient = (0, api_1.createClient)((0, config_1.loadConfig)({
-                api: { url: demoUrl },
-                project: { name: projectName, path: projectPath },
-            }));
-            const { data } = await demoClient.post("/api/keys", {
-                projectName: `demo-${projectName}`,
-                label: `demo-${Date.now()}`,
-            });
-            writeMcpConfig(projectPath, data.key, opts.force, demoUrl);
-            console.log(chalk_1.default.green(`  ✓ Connected to demo at ${demoUrl}`));
-            console.log(chalk_1.default.green(`  ✓ .mcp.json written`));
-            console.log("");
-            console.log("  Open your AI assistant — it now has memory via the Reka demo.");
-            console.log(chalk_1.default.yellow("  Note: demo data may be reset periodically."));
-            console.log("");
+            // Step 1: Create device session
+            const { data: device } = await axios.post(`${demoApiUrl}/api/auth/device`);
+            // Step 2: Open browser
+            console.log(`  Your verification code: ${chalk_1.default.bold.cyan(device.userCode)}`);
+            console.log(`  Opening browser to sign in...\n`);
+            try {
+                const open = (await Promise.resolve().then(() => __importStar(require("open")))).default;
+                await open(device.verificationUrl);
+            }
+            catch {
+                console.log(`  Open this URL in your browser:`);
+                console.log(`  ${chalk_1.default.cyan(device.verificationUrl)}\n`);
+            }
+            // Step 3: Poll for completion
+            const ora = (await Promise.resolve().then(() => __importStar(require("ora")))).default;
+            const spinner = ora("  Waiting for authentication...").start();
+            const deadline = Date.now() + device.expiresIn * 1000;
+            while (Date.now() < deadline) {
+                await new Promise((r) => setTimeout(r, device.interval * 1000));
+                const { data: poll } = await axios.get(`${demoApiUrl}/api/auth/poll?device_code=${device.deviceCode}`);
+                if (poll.status === "completed") {
+                    spinner.succeed("Authenticated!");
+                    writeMcpConfig(projectPath, poll.apiKey, opts.force, poll.apiUrl);
+                    console.log(chalk_1.default.green(`  ✓ Project: ${poll.projectName}`));
+                    console.log(chalk_1.default.green(`  ✓ .mcp.json written`));
+                    console.log("");
+                    console.log("  Your AI assistant now has memory. Open it and start asking!");
+                    console.log(chalk_1.default.yellow("  Note: demo data may be reset periodically."));
+                    console.log("");
+                    return;
+                }
+                if (poll.status === "expired") {
+                    spinner.fail("Authentication expired. Run the command again.");
+                    return;
+                }
+            }
+            spinner.fail("Authentication timed out. Run the command again.");
         }
         catch (err) {
             const msg = err.response?.data?.error || err.message;
@@ -85,45 +169,91 @@ async function initCommand(opts) {
         }
         return;
     }
-    // Cloud mode: coming soon
+    // Cloud mode: no hosted offering — be honest about what exists
     if (opts.cloud) {
         console.log("");
-        console.log(chalk_1.default.bold("  Reka Cloud — coming soon"));
+        console.log(chalk_1.default.bold("  Reka Cloud — there is no hosted Reka today"));
+        console.log("");
+        console.log("  Reka is self-hosted: your code and memory stay on your machines.");
+        console.log("  A self-hosted Team license (multi-user, support) is planned,");
+        console.log("  gated on real adoption of the open release.");
         console.log("");
-        console.log("  Managed RAG with zero infrastructure. Hybrid and fully managed options.");
-        console.log(`  Join the waitlist: ${chalk_1.default.cyan("https://getreka.dev")}`);
+        console.log(`  Interested in the Team tier? Tell us: ${chalk_1.default.cyan("https://getreka.dev")}`);
         console.log("");
-        console.log("  In the meantime, self-hosted works great:");
+        console.log("  Get started self-hosted today:");
         console.log(`    ${chalk_1.default.bold("docker-compose up -d")}`);
         console.log(`    ${chalk_1.default.bold(`npx @getreka/cli init --project ${projectName}`)}`);
         console.log("");
         return;
     }
-    // Self-hosted: generate key via local API
+    // Self-hosted
+    const apiUrl = opts.apiUrl || process.env.REKA_API_URL || "http://localhost:3100";
+    const container = opts.container || process.env.REKA_CONTAINER || "reka-api";
+    console.log(`\n  Initializing Reka for project ${chalk_1.default.bold(projectName)}...\n`);
+    // 1. Resolve API key: --key → existing .mcp.json key → docker mint → prompt
+    const existingKey = (0, mcp_config_1.extractExistingKey)(opts.force ? {} : (0, setup_files_1.readMcpConfig)(projectPath), projectName);
+    let mintResult;
+    try {
+        mintResult = await (0, mint_1.resolveApiKey)({
+            projectName,
+            apiUrl,
+            container,
+            key: opts.key,
+            existingKey,
+            force: opts.force,
+        }, defaultMintDeps());
+    }
+    catch (err) {
+        console.log(chalk_1.default.red(`\n  Failed to obtain an API key: ${err.message}`));
+        console.log(chalk_1.default.yellow(`  Is the Reka API running? Start with: docker-compose up -d\n`));
+        process.exitCode = 1;
+        return;
+    }
+    const sourceLabel = {
+        flag: "from --key",
+        existing: "reused from .mcp.json",
+        minted: `minted via container "${container}"`,
+        prompt: "entered manually",
+    }[mintResult.source];
+    console.log(chalk_1.default.green(`  ✓ API key ${sourceLabel}: ${mintResult.key.slice(0, 20)}...`));
+    if (mintResult.restarted) {
+        console.log(chalk_1.default.green(`  ✓ Container "${container}" restarted to load the key`));
+    }
+    // 2. Write project files (.mcp.json + CLAUDE.md + permissions)
+    const entry = (0, setup_files_1.buildRagEntry)({
+        apiUrl,
+        projectName,
+        projectPath,
+        apiKey: mintResult.key,
+    });
+    const { changes } = (0, setup_files_1.applyProjectFiles)({
+        projectPath,
+        projectName,
+        entry,
+        force: opts.force,
+    });
+    for (const change of changes) {
+        console.log(chalk_1.default.green(`  ✓ ${change}`));
+    }
+    // 3. Index status check (non-fatal)
     const config = (0, config_1.loadConfig)({
-        api: { url: opts.apiUrl || "http://localhost:3100" },
+        api: { url: apiUrl, key: mintResult.key },
         project: { name: projectName, path: projectPath },
     });
     const client = (0, api_1.createClient)(config);
-    console.log(`\n  Generating API key for project ${chalk_1.default.bold(projectName)}...`);
     try {
-        const { data } = await client.post("/api/keys", {
-            projectName,
-            label: `init-${Date.now()}`,
-        });
-        const apiKey = data.key;
-        writeMcpConfig(projectPath, apiKey, opts.force);
-        console.log(chalk_1.default.green(`  ✓ API key created: ${apiKey.slice(0, 20)}...`));
-        console.log(chalk_1.default.green(`  ✓ .mcp.json written`));
-        console.log("");
-        console.log("  Your AI assistant now has memory. Try asking it about your codebase!");
-        console.log("");
+        const { data } = await client.get(`/api/index/status/${projectName}_codebase`);
+        console.log(chalk_1.default.green(`  ✓ Index status: ${data.status || "unknown"} (${data.vectorCount ?? "N/A"} vectors)`));
     }
-    catch (err) {
-        const msg = err.response?.data?.error || err.message;
-        console.log(chalk_1.default.red(`\n  Failed to generate key: ${msg}`));
-        console.log(chalk_1.default.yellow(`  Is the Reka API running? Start with: docker-compose up -d\n`));
+    catch {
+        console.log(chalk_1.default.yellow(`  ! Not indexed yet — run \`reka index\` (or the index_codebase tool) to enable search.`));
     }
+    console.log("");
+    console.log("  Next steps:");
+    console.log("    1. Restart Claude Code to load the MCP server");
+    console.log("    2. Index the codebase if you haven't: reka index");
+    console.log("    3. Use context_briefing before code changes");
+    console.log("");
 }
 function writeMcpConfig(projectPath, apiKey, force, apiUrl) {
     const mcpPath = path.join(projectPath, ".mcp.json");

package/dist/index.js

@@ -10,13 +10,12 @@ const api_1 = require("./api");
 const status_1 = require("./commands/status");
 const init_1 = require("./commands/init");
 const index_1 = require("./commands/index");
-const search_1 = require("./commands/search");
 const models_1 = require("./commands/models");
 const program = new commander_1.Command();
 program
     .name("reka")
     .description("Reka — Memory your AI can trust")
-    .version("0.1.0")
+    .version("0.3.0")
     .option("--api-url <url>", "RAG API URL")
     .option("--api-key <key>", "API key")
     .option("--project <name>", "Project name");
@@ -28,11 +27,20 @@ program
     .option("-p, --path <path>", "Project path")
     .option("-f, --force", "Overwrite existing .mcp.json")
     .option("--demo", "Connect to the Reka demo instance")
-    .option("--cloud", "Connect to Reka Cloud (coming soon)")
-    .option("--key <key>", "API key for cloud or demo")
+    .option("--cloud", "Info on hosted Reka (none today; self-hosted Team license planned)")
+    .option("--key <key>", "Use an existing API key instead of minting one")
+    .option("--container <name>", "rag-api Docker container used to mint keys (default: reka-api, env REKA_CONTAINER)")
     .option("--api-url <url>", "RAG API URL (default: http://localhost:3100)")
     .action(async (opts) => {
-    await (0, init_1.initCommand)(opts);
+    // Global options with the same name (--project, --api-url, --api-key)
+    // are captured by the program, not the subcommand — merge them in.
+    const globals = program.opts();
+    await (0, init_1.initCommand)({
+        ...opts,
+        project: opts.project ?? globals.project,
+        apiUrl: opts.apiUrl ?? globals.apiUrl,
+        key: opts.key ?? globals.apiKey,
+    });
 });
 // reka status
 program
@@ -53,17 +61,6 @@ program
     const client = (0, api_1.createClient)(config);
     await (0, index_1.indexCommand)(client, config, { path: indexPath, ...opts });
 });
-// reka search <query>
-program
-    .command("search <query>")
-    .description("Search indexed codebase")
-    .option("-l, --limit <n>", "Number of results", "5")
-    .option("-t, --type <type>", "Collection type (codebase, docs, memory)")
-    .action(async (query, opts) => {
-    const config = (0, config_1.loadConfig)(getOverrides());
-    const client = (0, api_1.createClient)(config);
-    await (0, search_1.searchCommand)(client, config, query, opts);
-});
 // reka models
 const models = program.command("models").description("Manage model providers");
 models

package/dist/mcp-config.d.ts

@@ -0,0 +1,49 @@
+/**
+ * .mcp.json server-entry normalization.
+ *
+ * Target server name is "rag" (matches what the docs and the reka plugin
+ * expect). Historic inits wrote "reka" (old CLI) or "<project>-rag"
+ * (mcp-server setup_project), so init detects those, merges them into a
+ * single "rag" entry, and never duplicates on re-run.
+ */
+export interface McpServerEntry {
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    [key: string]: unknown;
+}
+export interface McpConfig {
+    mcpServers?: Record<string, McpServerEntry>;
+    [key: string]: unknown;
+}
+export declare const TARGET_SERVER_NAME = "rag";
+export declare function isRekaMcpEntry(entry: McpServerEntry | undefined): boolean;
+/**
+ * Names that may hold a legacy Reka entry, in merge order
+ * (oldest first — later entries win env conflicts, new entry wins last).
+ */
+export declare function candidateNames(projectName: string): string[];
+/**
+ * Returns the names of existing entries that are Reka MCP servers and
+ * should be folded into the single "rag" entry.
+ */
+export declare function findRekaCandidates(config: McpConfig, projectName: string): string[];
+/**
+ * Extracts a previously-configured API key from candidate entries
+ * (most authoritative first: rag → <project>-rag → reka).
+ */
+export declare function extractExistingKey(config: McpConfig, projectName: string): string | undefined;
+export interface MergeResult {
+    config: McpConfig;
+    /** Legacy entry names that were removed/renamed into "rag". */
+    removed: string[];
+}
+/**
+ * Pure merge: folds legacy Reka entries into a single "rag" entry.
+ * - command/args always come from `newEntry` (that's the upgrade path)
+ * - env is merged: legacy values are preserved unless `newEntry.env`
+ *   overwrites them
+ * - non-Reka servers are left untouched
+ * - idempotent: applying twice yields the same config
+ */
+export declare function mergeRagServer(config: McpConfig, projectName: string, newEntry: McpServerEntry): MergeResult;

package/dist/mcp-config.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * .mcp.json server-entry normalization.
+ *
+ * Target server name is "rag" (matches what the docs and the reka plugin
+ * expect). Historic inits wrote "reka" (old CLI) or "<project>-rag"
+ * (mcp-server setup_project), so init detects those, merges them into a
+ * single "rag" entry, and never duplicates on re-run.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TARGET_SERVER_NAME = void 0;
+exports.isRekaMcpEntry = isRekaMcpEntry;
+exports.candidateNames = candidateNames;
+exports.findRekaCandidates = findRekaCandidates;
+exports.extractExistingKey = extractExistingKey;
+exports.mergeRagServer = mergeRagServer;
+exports.TARGET_SERVER_NAME = "rag";
+/** Packages that identify an entry as a Reka MCP server. */
+const REKA_MCP_PACKAGES = /@getreka\/mcp|@crowley\/rag-mcp/;
+function isRekaMcpEntry(entry) {
+    if (!entry)
+        return false;
+    const haystack = [entry.command || "", ...(entry.args || [])].join(" ");
+    return REKA_MCP_PACKAGES.test(haystack);
+}
+/**
+ * Names that may hold a legacy Reka entry, in merge order
+ * (oldest first — later entries win env conflicts, new entry wins last).
+ */
+function candidateNames(projectName) {
+    return ["reka", `${projectName}-rag`, exports.TARGET_SERVER_NAME];
+}
+/**
+ * Returns the names of existing entries that are Reka MCP servers and
+ * should be folded into the single "rag" entry.
+ */
+function findRekaCandidates(config, projectName) {
+    const servers = config.mcpServers || {};
+    return candidateNames(projectName).filter((name) => isRekaMcpEntry(servers[name]));
+}
+/**
+ * Extracts a previously-configured API key from candidate entries
+ * (most authoritative first: rag → <project>-rag → reka).
+ */
+function extractExistingKey(config, projectName) {
+    const servers = config.mcpServers || {};
+    for (const name of [...candidateNames(projectName)].reverse()) {
+        const entry = servers[name];
+        if (isRekaMcpEntry(entry) && entry?.env?.REKA_API_KEY) {
+            return entry.env.REKA_API_KEY;
+        }
+    }
+    return undefined;
+}
+/**
+ * Pure merge: folds legacy Reka entries into a single "rag" entry.
+ * - command/args always come from `newEntry` (that's the upgrade path)
+ * - env is merged: legacy values are preserved unless `newEntry.env`
+ *   overwrites them
+ * - non-Reka servers are left untouched
+ * - idempotent: applying twice yields the same config
+ */
+function mergeRagServer(config, projectName, newEntry) {
+    const result = { ...config, mcpServers: { ...config.mcpServers } };
+    const servers = result.mcpServers;
+    const candidates = findRekaCandidates(result, projectName);
+    const mergedEnv = {};
+    for (const name of candidates) {
+        Object.assign(mergedEnv, servers[name].env || {});
+        delete servers[name];
+    }
+    Object.assign(mergedEnv, newEntry.env || {});
+    servers[exports.TARGET_SERVER_NAME] = { ...newEntry, env: mergedEnv };
+    return {
+        config: result,
+        removed: candidates.filter((n) => n !== exports.TARGET_SERVER_NAME),
+    };
+}

package/dist/mint.d.ts

@@ -0,0 +1,64 @@
+/**
+ * API-key resolution for `reka init` (LB-3).
+ *
+ * Resolution order:
+ *   1. --key flag
+ *   2. key already present in .mcp.json (verified against /api/whoami;
+ *      skipped with --force)
+ *   3. mint via the local rag-api Docker container (see init.ts for the
+ *      full mechanism notes)
+ *   4. interactive prompt, with a pointer to the docker-exec admin path
+ *
+ * All side effects (docker exec, HTTP, stdin) are injected via MintDeps so
+ * the fallback order is unit-testable.
+ */
+export interface MintDeps {
+    /** Run a command without a shell; rejects on non-zero exit. */
+    execFile(cmd: string, args: string[]): Promise<{
+        stdout: string;
+    }>;
+    /** GET url with headers; resolves { status } or rejects on network error. */
+    httpGet(url: string, headers?: Record<string, string>): Promise<{
+        status: number;
+    }>;
+    prompt(question: string): Promise<string>;
+    sleep(ms: number): Promise<void>;
+    log(message: string): void;
+}
+export interface MintOptions {
+    projectName: string;
+    apiUrl: string;
+    /** rag-api container name (--container / REKA_CONTAINER / "reka-api"). */
+    container: string;
+    /** --key flag value. */
+    key?: string;
+    /** Key found in an existing .mcp.json entry. */
+    existingKey?: string;
+    /** --force: ignore the existing key and mint a fresh one. */
+    force?: boolean;
+}
+export interface MintResult {
+    key: string;
+    source: "flag" | "existing" | "minted" | "prompt";
+    /** keys.json id — needed to revoke the key later. */
+    keyId?: string;
+    /** True when the container had to be restarted to load the new key. */
+    restarted?: boolean;
+}
+/**
+ * Script executed inside the container via `docker exec <name> node -e`.
+ * Tries the live admin endpoint first (key becomes valid immediately);
+ * falls back to the offline auth module (requires a container restart).
+ * Prints a single JSON line: {"key":"rk_...","id":"...","live":bool}.
+ */
+export declare function buildMintScript(projectName: string): string;
+/** Extracts the {"key":...} JSON line from mixed stdout (logger noise). */
+export declare function parseMintOutput(stdout: string): {
+    key: string;
+    id?: string;
+    live: boolean;
+} | null;
+/** true = valid, false = rejected, null = API unreachable. */
+export declare function verifyKey(apiUrl: string, key: string, deps: Pick<MintDeps, "httpGet">): Promise<boolean | null>;
+export declare function dockerMintHint(container: string, projectName: string): string;
+export declare function resolveApiKey(opts: MintOptions, deps: MintDeps): Promise<MintResult>;

package/dist/mint.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * API-key resolution for `reka init` (LB-3).
+ *
+ * Resolution order:
+ *   1. --key flag
+ *   2. key already present in .mcp.json (verified against /api/whoami;
+ *      skipped with --force)
+ *   3. mint via the local rag-api Docker container (see init.ts for the
+ *      full mechanism notes)
+ *   4. interactive prompt, with a pointer to the docker-exec admin path
+ *
+ * All side effects (docker exec, HTTP, stdin) are injected via MintDeps so
+ * the fallback order is unit-testable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildMintScript = buildMintScript;
+exports.parseMintOutput = parseMintOutput;
+exports.verifyKey = verifyKey;
+exports.dockerMintHint = dockerMintHint;
+exports.resolveApiKey = resolveApiKey;
+const PROJECT_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+const KEY_LABEL = "cli-init";
+/**
+ * Script executed inside the container via `docker exec <name> node -e`.
+ * Tries the live admin endpoint first (key becomes valid immediately);
+ * falls back to the offline auth module (requires a container restart).
+ * Prints a single JSON line: {"key":"rk_...","id":"...","live":bool}.
+ */
+function buildMintScript(projectName) {
+    const project = JSON.stringify(projectName);
+    const label = JSON.stringify(KEY_LABEL);
+    return [
+        "(async () => {",
+        "  const port = process.env.API_PORT || process.env.PORT || 3100;",
+        "  try {",
+        "    const r = await fetch('http://127.0.0.1:' + port + '/api/keys', {",
+        "      method: 'POST',",
+        "      headers: { 'Content-Type': 'application/json' },",
+        `      body: JSON.stringify({ projectName: ${project}, label: ${label} }),`,
+        "    });",
+        "    if (r.ok) {",
+        "      const d = await r.json();",
+        "      if (d.key) {",
+        "        console.log(JSON.stringify({ key: d.key, id: d.id, live: true }));",
+        "        return;",
+        "      }",
+        "    }",
+        "  } catch {}",
+        "  const { generateKey } = require('./dist/middleware/auth');",
+        `  const e = generateKey(${project}, ${label});`,
+        "  console.log(JSON.stringify({ key: e.key, id: e.id, live: false }));",
+        "})();",
+    ].join("\n");
+}
+/** Extracts the {"key":...} JSON line from mixed stdout (logger noise). */
+function parseMintOutput(stdout) {
+    for (const line of stdout.split("\n").reverse()) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("{"))
+            continue;
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed.key === "string" && parsed.key.startsWith("rk_")) {
+                return { key: parsed.key, id: parsed.id, live: !!parsed.live };
+            }
+        }
+        catch {
+            // not our line
+        }
+    }
+    return null;
+}
+/** true = valid, false = rejected, null = API unreachable. */
+async function verifyKey(apiUrl, key, deps) {
+    try {
+        const { status } = await deps.httpGet(`${apiUrl}/api/whoami`, {
+            "X-Api-Key": key,
+        });
+        return status === 200;
+    }
+    catch {
+        return null;
+    }
+}
+async function waitForHealth(apiUrl, deps, attempts = 60) {
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const { status } = await deps.httpGet(`${apiUrl}/api/health`);
+            if (status === 200)
+                return true;
+        }
+        catch {
+            // still starting
+        }
+        await deps.sleep(1000);
+    }
+    return false;
+}
+async function containerRunning(container, deps) {
+    try {
+        const { stdout } = await deps.execFile("docker", [
+            "inspect",
+            "-f",
+            "{{.State.Running}}",
+            container,
+        ]);
+        return stdout.trim() === "true";
+    }
+    catch {
+        return false;
+    }
+}
+function dockerMintHint(container, projectName) {
+    return (`docker exec ${container} node -e "const {generateKey}=require('./dist/middleware/auth'); ` +
+        `console.log(generateKey('${projectName}','${KEY_LABEL}').key)" ` +
+        `&& docker restart ${container}`);
+}
+async function mintViaDocker(opts, deps) {
+    if (!PROJECT_NAME_RE.test(opts.projectName)) {
+        deps.log(`Project name "${opts.projectName}" contains characters unsafe for key minting.`);
+        return null;
+    }
+    if (!(await containerRunning(opts.container, deps))) {
+        deps.log(`Container "${opts.container}" not found or not running (override with --container or REKA_CONTAINER).`);
+        return null;
+    }
+    let output;
+    try {
+        const { stdout } = await deps.execFile("docker", [
+            "exec",
+            opts.container,
+            "node",
+            "-e",
+            buildMintScript(opts.projectName),
+        ]);
+        output = parseMintOutput(stdout);
+    }
+    catch (err) {
+        deps.log(`Key minting failed: ${err?.message || err}`);
+        return null;
+    }
+    if (!output) {
+        deps.log("Key minting returned no key.");
+        return null;
+    }
+    let restarted = false;
+    if (!output.live) {
+        // Key persisted to data/keys.json but the running server only loads
+        // keys at startup — restart to activate it.
+        deps.log(`Restarting ${opts.container} to load the new key (keys are read at startup)...`);
+        try {
+            await deps.execFile("docker", ["restart", opts.container]);
+            restarted = true;
+        }
+        catch (err) {
+            deps.log(`Container restart failed: ${err?.message || err}`);
+            return null;
+        }
+        if (!(await waitForHealth(opts.apiUrl, deps))) {
+            deps.log("API did not come back healthy after restart.");
+            return null;
+        }
+    }
+    const valid = await verifyKey(opts.apiUrl, output.key, deps);
+    if (valid === false) {
+        deps.log("Minted key was rejected by the API — falling back.");
+        return null;
+    }
+    return { key: output.key, source: "minted", keyId: output.id, restarted };
+}
+async function resolveApiKey(opts, deps) {
+    // 1. Explicit flag always wins.
+    if (opts.key) {
+        return { key: opts.key, source: "flag" };
+    }
+    // 2. Reuse the key already in .mcp.json (idempotent re-runs must not
+    //    mint a new key every time). --force skips reuse.
+    if (opts.existingKey && !opts.force) {
+        const valid = await verifyKey(opts.apiUrl, opts.existingKey, deps);
+        if (valid !== false) {
+            if (valid === null) {
+                deps.log("API unreachable — keeping the existing key unverified.");
+            }
+            return { key: opts.existingKey, source: "existing" };
+        }
+        deps.log("Existing key in .mcp.json was rejected — minting a new one.");
+    }
+    // 3. Mint via the local rag-api container.
+    const minted = await mintViaDocker(opts, deps);
+    if (minted)
+        return minted;
+    // 4. Interactive prompt with a pointer to the docker-exec admin path.
+    const answer = (await deps.prompt(`Paste an API key for project "${opts.projectName}" ` +
+        `(admins can mint one with:\n  ${dockerMintHint(opts.container, opts.projectName)}\n): `)).trim();
+    if (!answer) {
+        throw new Error("No API key provided.");
+    }
+    return { key: answer, source: "prompt" };
+}

package/dist/setup-files.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Project-file writes for `reka init` — parity with the mcp-server
+ * `setup_project` tool: .mcp.json, CLAUDE.md RAG section, and
+ * .claude/settings.local.json permissions. All writes are idempotent.
+ */
+import { McpConfig, McpServerEntry } from "./mcp-config";
+export interface SetupResult {
+    changes: string[];
+}
+export declare function readMcpConfig(projectPath: string): McpConfig;
+export declare function buildRagEntry(opts: {
+    apiUrl: string;
+    projectName: string;
+    projectPath: string;
+    apiKey: string;
+}): McpServerEntry;
+export declare function applyProjectFiles(opts: {
+    projectPath: string;
+    projectName: string;
+    entry: McpServerEntry;
+    /** --force: discard the existing .mcp.json instead of merging into it. */
+    force?: boolean;
+}): SetupResult;

package/dist/setup-files.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Project-file writes for `reka init` — parity with the mcp-server
+ * `setup_project` tool: .mcp.json, CLAUDE.md RAG section, and
+ * .claude/settings.local.json permissions. All writes are idempotent.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readMcpConfig = readMcpConfig;
+exports.buildRagEntry = buildRagEntry;
+exports.applyProjectFiles = applyProjectFiles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const mcp_config_1 = require("./mcp-config");
+function readMcpConfig(projectPath) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(projectPath, ".mcp.json"), "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function buildRagEntry(opts) {
+    return {
+        command: "npx",
+        args: ["-y", "@getreka/mcp@latest"],
+        env: {
+            REKA_API_URL: opts.apiUrl,
+            PROJECT_NAME: opts.projectName,
+            PROJECT_PATH: opts.projectPath,
+            REKA_API_KEY: opts.apiKey,
+        },
+    };
+}
+/** Same content as mcp-server setup_project writes. */
+const RAG_SECTION = `\n## RAG Integration
+
+You MUST call \`context_briefing\` before making any code changes.
+This single tool performs all RAG lookups in parallel (recall, search, patterns, ADRs, graph).
+
+Example: \`context_briefing(task: "describe your change", files: ["path/to/file.ts"])\`
+
+After completing significant changes:
+- \`remember\` — save important context for future sessions
+- \`record_adr\` — document architectural decisions
+`;
+function applyProjectFiles(opts) {
+    const { projectPath, projectName, entry, force } = opts;
+    const changes = [];
+    // 1. .mcp.json — merge/rename legacy entries into a single "rag" entry
+    const existing = force ? {} : readMcpConfig(projectPath);
+    const { config, removed } = (0, mcp_config_1.mergeRagServer)(existing, projectName, entry);
+    fs.writeFileSync(path.join(projectPath, ".mcp.json"), JSON.stringify(config, null, 2) + "\n", "utf-8");
+    changes.push(removed.length
+        ? `.mcp.json — "${mcp_config_1.TARGET_SERVER_NAME}" server written (merged legacy: ${removed.join(", ")})`
+        : `.mcp.json — "${mcp_config_1.TARGET_SERVER_NAME}" server written`);
+    // 2. CLAUDE.md — add RAG section (same content/idempotency as setup_project)
+    const claudeMdPath = path.join(projectPath, "CLAUDE.md");
+    let claudeMd = "";
+    try {
+        claudeMd = fs.readFileSync(claudeMdPath, "utf-8");
+    }
+    catch {
+        // File doesn't exist
+    }
+    if (claudeMd.includes("## RAG")) {
+        changes.push("CLAUDE.md — RAG section already exists, skipped");
+    }
+    else {
+        claudeMd = claudeMd
+            ? claudeMd.trimEnd() + "\n" + RAG_SECTION
+            : `# CLAUDE.md\n${RAG_SECTION}`;
+        fs.writeFileSync(claudeMdPath, claudeMd);
+        changes.push("CLAUDE.md — added RAG Integration section");
+    }
+    // 3. .claude/settings.local.json — allow the MCP server's tools
+    const claudeDir = path.join(projectPath, ".claude");
+    const settingsPath = path.join(claudeDir, "settings.local.json");
+    let settings = {};
+    try {
+        settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+    }
+    catch {
+        // File doesn't exist or invalid JSON
+    }
+    if (!settings.permissions)
+        settings.permissions = {};
+    if (!settings.permissions.allow)
+        settings.permissions.allow = [];
+    const mcpPermission = `mcp__${mcp_config_1.TARGET_SERVER_NAME}__*`;
+    if (settings.permissions.allow.includes(mcpPermission)) {
+        changes.push(".claude/settings.local.json — permission already exists, skipped");
+    }
+    else {
+        settings.permissions.allow.push(mcpPermission);
+        if (!fs.existsSync(claudeDir))
+            fs.mkdirSync(claudeDir, { recursive: true });
+        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+        changes.push(`.claude/settings.local.json — added \`${mcpPermission}\` permission`);
+    }
+    return { changes };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getreka/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Reka CLI — manage self-hosted RAG infrastructure for AI coding agents",
   "bin": {
     "reka": "dist/index.js"
@@ -22,20 +22,24 @@
   "scripts": {
     "build": "tsc",
     "dev": "ts-node src/index.ts",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "axios": "^1.7.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
+    "open": "^11.0.0",
     "ora": "^5.4.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.14.0",
+    "ts-node": "^10.9.2",
     "typescript": "^5.5.0",
-    "ts-node": "^10.9.2"
+    "vitest": "^4.0.18"
   },
   "engines": {
     "node": ">=18"

package/dist/commands/search.d.ts

@@ -1,6 +0,0 @@
-import { AxiosInstance } from "axios";
-import { RekaConfig } from "../config";
-export declare function searchCommand(client: AxiosInstance, config: RekaConfig, query: string, opts: {
-    limit?: string;
-    type?: string;
-}): Promise<void>;

package/dist/commands/search.js

@@ -1,48 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.searchCommand = searchCommand;
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const api_1 = require("../api");
-async function searchCommand(client, config, query, opts) {
-    const limit = parseInt(opts.limit || "5", 10);
-    const spinner = (0, ora_1.default)("Searching...").start();
-    try {
-        const { data } = await client.post("/api/search", {
-            query,
-            limit,
-            collection: opts.type || "codebase",
-        });
-        spinner.stop();
-        const results = data.results || data;
-        if (!results || results.length === 0) {
-            console.log(chalk_1.default.yellow("\n  No results found.\n"));
-            return;
-        }
-        console.log(chalk_1.default.bold(`\n  ${results.length} results for "${query}"\n`));
-        for (const [i, r] of results.entries()) {
-            const score = r.score
-                ? chalk_1.default.gray(`(${(r.score * 100).toFixed(0)}%)`)
-                : "";
-            const filePath = r.metadata?.filePath || r.metadata?.file_path || "";
-            const lines = r.metadata?.startLine
-                ? `:${r.metadata.startLine}-${r.metadata.endLine || ""}`
-                : "";
-            console.log(`  ${chalk_1.default.blue(`${i + 1}.`)} ${chalk_1.default.bold(filePath)}${lines} ${score}`);
-            // Show snippet (first 3 lines)
-            if (r.content || r.text) {
-                const text = (r.content || r.text);
-                const snippet = text.split("\n").slice(0, 3).join("\n");
-                console.log(chalk_1.default.gray(`     ${snippet.replace(/\n/g, "\n     ")}`));
-            }
-            console.log("");
-        }
-    }
-    catch (err) {
-        spinner.fail(`Search failed: ${(0, api_1.formatError)(err)}`);
-        process.exit(1);
-    }
-}