@ggui-ai/cli 0.27.0 → 0.28.0

package/dist/cli.js

@@ -17,9 +17,10 @@ import { buildAgentRuntime, describeTunnelSession, DEV_HELP, launchBrowser, open
 import { createNullTunnelProvider, discoverTunnelProvider, } from './tunnel-provider.js';
 import { ManifestBlueprintProvider, resolveStorageFromConfig, buildNoCredentialsGguiSession, } from '@ggui-ai/mcp-server';
 import { InMemoryBlueprintProvider } from '@ggui-ai/mcp-server-core/in-memory';
+import { ZERO_CONFIG_ROUTE_BY_PROVIDER } from '@ggui-ai/protocol';
 import { createByokResolver } from './byok-resolver.js';
 import { isInstalledBlueprintPath } from './internal/artifact-install.js';
-import { DEFAULT_ROUTE_BY_PROVIDER, GENERATION_MODEL_ENV, describeGenerationBinding, probeGenerationBinding, resolveConfiguredRoute, } from './generation-probe.js';
+import { GENERATION_MODEL_ENV, describeGenerationBinding, probeGenerationBinding, resolveConfiguredRoute, } from './generation-probe.js';
 import { buildMcpServerBackend, pickFreePort } from './mcp-backend.js';
 import { FileSystemSeedPoolSource } from './filesystem-seed-pool-source.js';
 import { buildSeedPool } from '@ggui-ai/mcp-server-handlers';
@@ -73,6 +74,8 @@ Commands:
                  --port <n>       Bind port (default: 6781, 0 = OS-assigned).
                  --host <addr>    Bind host (default: 127.0.0.1).
                  --mcp-only       Boot only MCP; skip agent supervision.
+                 --no-console     Serve no operator console: no admin token is
+                                  minted or printed (env GGUI_NO_CONSOLE=1).
 
   login        Sign into ggui.ai (device flow). Tokens stored in
                ~/.ggui/auth.json.
@@ -502,6 +505,12 @@ async function runServeCommand(args) {
     // the card (key missing).
     const baseUrlForCard = parsed.publicBaseUrl ?? `http://${parsed.host}:${effectivePort}`;
     const settingsUrl = `${baseUrlForCard}/settings`;
+    // ggui#1167 — `--no-console` (or `GGUI_NO_CONSOLE=1` / `true`, the env twin a
+    // supervisor sets without touching argv): serve no operator console.
+    // Resolved before the key probe because the no-credentials card points
+    // at the console's `/settings`, which this mode does not serve.
+    const envNoConsole = process.env['GGUI_NO_CONSOLE']?.trim();
+    const noConsole = parsed.noConsole || envNoConsole === '1' || envNoConsole === 'true';
     // No-credentials cards live for an hour from mint — long enough for
     // the operator to follow the Connect-Claude link, paste a key, and
     // re-prompt before the persisted GguiSession is GC'd.
@@ -544,11 +553,12 @@ async function runServeCommand(args) {
         // fall back to an empty one so the generator has a valid
         // `blueprints` dep regardless of manifest state.
         const blueprintsForGen = blueprintProvider ?? new InMemoryBlueprintProvider();
-        generationBinding = await probeGenerationBinding({
-            resolver: createByokResolver({ localCliLogin: parsed.localCliLogin }),
-            blueprints: blueprintsForGen,
-            ...(configuredRoute ? { configuredRoute } : {}),
-            onNoCredentials: (ctx, story) => {
+        // Without a console there is no `/settings` page for the card to link
+        // to, so under `--no-console` a key-less render fails with
+        // NO_CREDENTIALS instead (ggui#1167).
+        const onNoCredentials = noConsole
+            ? undefined
+            : (ctx, story) => {
                 const nowEpochMs = Date.parse(story.nowIso);
                 return buildNoCredentialsGguiSession({
                     sessionId: story.sessionId,
@@ -558,7 +568,12 @@ async function runServeCommand(args) {
                     expiresAt: nowEpochMs + NO_CREDENTIALS_CARD_TTL_MS,
                     settingsUrl,
                 });
-            },
+            };
+        generationBinding = await probeGenerationBinding({
+            resolver: createByokResolver({ localCliLogin: parsed.localCliLogin }),
+            blueprints: blueprintsForGen,
+            ...(configuredRoute ? { configuredRoute } : {}),
+            ...(onNoCredentials ? { onNoCredentials } : {}),
         });
     }
     catch (err) {
@@ -590,13 +605,13 @@ async function runServeCommand(args) {
             `  {\n` +
             `    "schema": "1",\n` +
             `    "generation": {\n` +
-            `      "model": "${generationBinding.provider}:${DEFAULT_ROUTE_BY_PROVIDER[generationBinding.provider].model}"\n` +
+            `      "model": "${generationBinding.provider}:${ZERO_CONFIG_ROUTE_BY_PROVIDER[generationBinding.provider].model}"\n` +
             `    }\n` +
             `  }\n` +
             `\n` +
             `Accepted forms:\n` +
-            `  - canonical: "anthropic:claude-haiku-4-5-20251001"\n` +
-            `  - LiteLLM:   "anthropic/claude-haiku-4-5"\n` +
+            `  - canonical: "anthropic:claude-haiku-5-5"\n` +
+            `  - LiteLLM:   "anthropic/claude-haiku-5-5"\n` +
             `\n` +
             `See docs/principles/model-string-convention.md.\n`);
         return 1;
@@ -636,6 +651,7 @@ async function runServeCommand(args) {
                 host: parsed.host,
                 mcpOnly: parsed.mcpOnly,
                 devAllowAll: parsed.devAllowAll,
+                noConsole,
                 withholdResultMeta: parsed.withholdResultMeta,
                 publicDemo: parsed.publicDemo,
                 multiUser: parsed.multiUser,
@@ -658,6 +674,7 @@ async function runServeCommand(args) {
                 publicDemo: parsed.publicDemo,
                 multiUser: parsed.multiUser,
                 oauth: parsed.oauth,
+                ...(noConsole ? { noConsole: true } : {}),
                 ...(parsed.publicBaseUrl !== undefined
                     ? { publicBaseUrl: parsed.publicBaseUrl }
                     : {}),

package/dist/generation-probe.d.ts

@@ -19,8 +19,9 @@
  *      key via `/settings`, the resolver picks it up on the next
  *      `ggui_render`.
  *   3. **No-key default** — when the boot scan finds nothing, we
- *      STILL return a binding (provider=`anthropic`, model=
- *      `claude-haiku-4-5`). Generation stays wired; the
+ *      STILL return a binding: the Anthropic row of
+ *      `ZERO_CONFIG_ROUTE_BY_PROVIDER` from `@ggui-ai/protocol`, which
+ *      is the open-source default. Generation stays wired; the
  *      no-credentials path now produces a Connect-Claude card
  *      render via {@link GenerationDeps.onNoCredentials}
  *      instead of the broken `codeReady:false` placeholder.
@@ -42,28 +43,6 @@
  */
 import type { BlueprintProvider, GenerationDeps, HandlerContext, LlmProvider, LlmRoute, GguiSession } from '@ggui-ai/mcp-server';
 import type { ByokKeyResolution, ByokResolver } from './byok-resolver.js';
-/**
- * Locked default model per provider for the OSS first-run path.
- *
- * These are the "sensible default for an operator who exported
- * `ANTHROPIC_API_KEY` without thinking about which model" — NOT
- * benchmark-tuned recommendations. A later slice wires
- * `ggui.json#generation.model` so operators can pick explicitly;
- * until then these keep the zero-config path honest.
- *
- * Notably absent: `bedrock`. AWS credentials flow through the SDK
- * chain, which the OSS BYOK resolver doesn't cover — the hosted runtime
- * binds Bedrock through its own `GenerationDeps` at the hosted
- * surface.
- */
-/**
- * Locked default route per provider, as a typed {@link LlmRoute}.
- * Model strings are bare wire-canonical IDs (registry KEY ==
- * what the provider's API expects on the wire) — there is no
- * transformation step downstream. `dispatchGeneration` sends
- * `route.model` verbatim.
- */
-export declare const DEFAULT_ROUTE_BY_PROVIDER: Readonly<Record<Exclude<LlmProvider, 'bedrock'>, LlmRoute>>;
 /**
  * Priority order for BYOK provider probing. The first provider
  * whose credentials resolve wins. Anthropic first is deliberate —
@@ -125,7 +104,7 @@ export interface ProbeGenerationBindingOptions {
      *   - `configuredRoute.provider` becomes the boot-scan provider
      *     (overriding the priority chain).
      *   - `configuredRoute.model` is what flows to the dispatch path
-     *     (overriding `DEFAULT_ROUTE_BY_PROVIDER[provider]`).
+     *     (overriding `ZERO_CONFIG_ROUTE_BY_PROVIDER[provider]` from `@ggui-ai/protocol`).
      *
      * Absent → fall back to today's behavior: walk the priority chain,
      * use the per-provider default. The CLI hard-fails BEFORE reaching

package/dist/generation-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAMlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA2F5B;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAUR"}
+{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA2F5B;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAUR"}

package/dist/generation-probe.js

@@ -1,32 +1,5 @@
-import { parseAnyLlmRoute } from '@ggui-ai/protocol';
+import { parseAnyLlmRoute, ZERO_CONFIG_ROUTE_BY_PROVIDER } from '@ggui-ai/protocol';
 import { createUiGenerator } from '@ggui-ai/ui-gen';
-/**
- * Locked default model per provider for the OSS first-run path.
- *
- * These are the "sensible default for an operator who exported
- * `ANTHROPIC_API_KEY` without thinking about which model" — NOT
- * benchmark-tuned recommendations. A later slice wires
- * `ggui.json#generation.model` so operators can pick explicitly;
- * until then these keep the zero-config path honest.
- *
- * Notably absent: `bedrock`. AWS credentials flow through the SDK
- * chain, which the OSS BYOK resolver doesn't cover — the hosted runtime
- * binds Bedrock through its own `GenerationDeps` at the hosted
- * surface.
- */
-/**
- * Locked default route per provider, as a typed {@link LlmRoute}.
- * Model strings are bare wire-canonical IDs (registry KEY ==
- * what the provider's API expects on the wire) — there is no
- * transformation step downstream. `dispatchGeneration` sends
- * `route.model` verbatim.
- */
-export const DEFAULT_ROUTE_BY_PROVIDER = {
-    anthropic: { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' },
-    openai: { provider: 'openai', model: 'gpt-5.6-luna' },
-    google: { provider: 'google', model: 'gemini-3.5-flash-lite' },
-    openrouter: { provider: 'openrouter', model: 'anthropic/claude-haiku-4.5' },
-};
 /**
  * Priority order for BYOK provider probing. The first provider
  * whose credentials resolve wins. Anthropic first is deliberate —
@@ -110,7 +83,7 @@ export async function probeGenerationBinding(opts) {
     const defaultProvider = configured && configured.provider !== 'bedrock'
         ? configured.provider
         : bootHit?.provider ?? 'anthropic';
-    const defaultRoute = configured ?? DEFAULT_ROUTE_BY_PROVIDER[defaultProvider];
+    const defaultRoute = configured ?? ZERO_CONFIG_ROUTE_BY_PROVIDER[defaultProvider];
     const defaultModel = defaultRoute.model;
     // Full-harness wire-up: `createUiGenerator` runs the same
     // multi-turn coding agent + self-check loop the bench validates;

package/dist/mcp-backend.d.ts

@@ -305,6 +305,13 @@ export interface BuildMcpServerBackendOptions {
      * Surface = `--admin-token <token>` CLI flag.
      */
     readonly adminToken?: string;
+    /**
+     * ggui#1167 — serve no operator console. The `console` option is not
+     * passed to `createGguiServer`, so no console route is mounted and no
+     * admin token is minted (`adminToken` is `null`). Surface =
+     * `--no-console` / `GGUI_NO_CONSOLE=1`.
+     */
+    readonly noConsole?: boolean;
     /**
      * Server-rendered public welcome page at `/`. Identifies who runs
      * the server (operator block, hidden when nothing configured)

package/dist/mcp-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA2lBtF"}
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CAimBtF"}

package/dist/mcp-backend.js

@@ -472,38 +472,44 @@ export function buildMcpServerBackend(opts) {
         // field; flag flips on `oauth: true` defaults (in-memory storage,
         // built-in paste-key consent page).
         ...(opts.oauth ? { oauth: true } : {}),
-        console: {
-            sessionCookie: true,
-            ...(opts.adminToken !== undefined ? { adminToken: opts.adminToken } : {}),
-            // First-run onboarding redirect. When neither the credentials
-            // file (`~/.ggui/credentials.json`) nor any provider env var
-            // (ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY /
-            // OPENROUTER_API_KEY) is present, send `GET /` to the
-            // **admin** onboarding flow — the operator running `ggui serve`
-            // IS the admin on first-run, so they need the operator-key
-            // plane (`/admin/llm-keys`) and the assistant-connection card
-            // surfaced there. Cookie-gated end-user `/settings` is for a
-            // *separate* user paired with the server later, not the
-            // first-run operator. Once any key is configured, the next
-            // visit serves the SPA normally. Scoped to the root path;
-            // deep links bypass the redirect.
-            landingRedirect: () => {
-                try {
-                    const credsFileExists = existsSync(getCredentialsFile());
-                    const anyEnvKey = !!process.env.ANTHROPIC_API_KEY ||
-                        !!process.env.OPENAI_API_KEY ||
-                        !!process.env.GOOGLE_API_KEY ||
-                        !!process.env.OPENROUTER_API_KEY;
-                    if (!credsFileExists && !anyEnvKey) {
-                        return "/admin-login?next=%2Fadmin%2Fllm-keys";
-                    }
-                    return null;
-                }
-                catch {
-                    return null;
-                }
-            },
-        },
+        // ggui#1167 — `--no-console` mounts no console and so mints no admin
+        // token: the server is an MCP endpoint only, with no operator bearer.
+        ...(opts.noConsole
+            ? {}
+            : {
+                console: {
+                    sessionCookie: true,
+                    ...(opts.adminToken !== undefined ? { adminToken: opts.adminToken } : {}),
+                    // First-run onboarding redirect. When neither the credentials
+                    // file (`~/.ggui/credentials.json`) nor any provider env var
+                    // (ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY /
+                    // OPENROUTER_API_KEY) is present, send `GET /` to the
+                    // **admin** onboarding flow — the operator running `ggui serve`
+                    // IS the admin on first-run, so they need the operator-key
+                    // plane (`/admin/llm-keys`) and the assistant-connection card
+                    // surfaced there. Cookie-gated end-user `/settings` is for a
+                    // *separate* user paired with the server later, not the
+                    // first-run operator. Once any key is configured, the next
+                    // visit serves the SPA normally. Scoped to the root path;
+                    // deep links bypass the redirect.
+                    landingRedirect: () => {
+                        try {
+                            const credsFileExists = existsSync(getCredentialsFile());
+                            const anyEnvKey = !!process.env.ANTHROPIC_API_KEY ||
+                                !!process.env.OPENAI_API_KEY ||
+                                !!process.env.GOOGLE_API_KEY ||
+                                !!process.env.OPENROUTER_API_KEY;
+                            if (!credsFileExists && !anyEnvKey) {
+                                return "/admin-login?next=%2Fadmin%2Fllm-keys";
+                            }
+                            return null;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                },
+            }),
         // Public welcome page at `/` — operator identification + public
         // deep-link surfaces + operator-login affordance. Resolved from
         // `ggui.json#operator` + `ggui.json#app.name` by serve-command.ts;

package/dist/serve-command.d.ts

@@ -57,6 +57,16 @@ export interface ParsedServeFlags {
      * warning when this flag is set.
      */
     devAllowAll: boolean;
+    /**
+     * ggui#1167 — serve no operator console. No console routes are
+     * mounted and no console admin token is minted, so nothing prints an
+     * operator bearer (`admin token →`, `ADMIN_TOKEN`). For a server a
+     * tool launches as an MCP endpoint only, where nobody logs in to a
+     * console. Env twin: `GGUI_NO_CONSOLE=1`, resolved by the CLI.
+     * Independent of `--mcp-only`, which skips agent supervision and
+     * still serves the console.
+     */
+    noConsole: boolean;
     /**
      * Override the public base URL used to compose `mcpApps.wsUrl`
      * and `runtime.url`. Without this, the URLs derive from
@@ -356,6 +366,13 @@ export interface ServeBannerInputs {
      * returned null (no env var + no credentials-file entry).
      */
     readonly noLlmKey?: boolean;
+    /**
+     * ggui#1167 — the server serves no console (`--no-console`). The
+     * banner then advertises no landing page, and a key-less boot names
+     * only the env vars to export: there is no `/settings` page and no
+     * admin token to point at.
+     */
+    readonly noConsole?: boolean;
     /**
      * Embedding model id surfaced for the local RAG layer. When set,
      * the banner shows a `rag` line so operators see which model is

package/dist/serve-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA+LzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,2tUA8LtB,CAAC"}
+{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAoMzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA4JrE;AAED,eAAO,MAAM,UAAU,2tUA8LtB,CAAC"}

package/dist/serve-command.js

@@ -23,6 +23,7 @@ export function parseServeFlags(args) {
         host: DEFAULT_SERVE_HOST,
         mcpOnly: false,
         devAllowAll: false,
+        noConsole: false,
         withholdResultMeta: false,
         publicDemo: false,
         multiUser: false,
@@ -60,6 +61,10 @@ export function parseServeFlags(args) {
             out.mcpOnly = true;
             continue;
         }
+        if (arg === '--no-console') {
+            out.noConsole = true;
+            continue;
+        }
         if (arg === '--withhold-result-meta') {
             out.withholdResultMeta = true;
             continue;
@@ -214,7 +219,7 @@ export function describeServeBanner(input) {
         // signal that closes the first-run story. Landing page lives at `/`
         // by default when `ggui serve` is the entry point (see
         // `cli.ts::buildMcpServerBackend`).
-        `  open      →  ${httpUrl}/`,
+        ...(input.noConsole ? [] : [`  open      →  ${httpUrl}/`]),
         `  mcp       →  ${httpUrl}/mcp`,
         `  health    →  ${httpUrl}/ggui/health`,
         `  tools     →  ${input.toolCount} registered`,
@@ -241,7 +246,12 @@ export function describeServeBanner(input) {
         // both bearers are obvious in the boot banner.
         lines.push(`  admin token →  ${input.adminToken}   (console /keys gate — paste at /admin-login)`);
     }
-    if (input.noLlmKey) {
+    if (input.noLlmKey && input.noConsole) {
+        // ggui#1167 — no console, so no /settings page and no admin token:
+        // the only way to add a key is the environment.
+        lines.push(`  ⚠ no LLM key configured. export ANTHROPIC_API_KEY /`, `        OPENAI_API_KEY / GOOGLE_API_KEY / OPENROUTER_API_KEY`, `        before re-running.`);
+    }
+    else if (input.noLlmKey) {
         // First-run nudge — without an LLM key, ggui_render falls back to
         // the Connect-Claude card and the iframe never bootstraps. Surface
         // the /settings URL alongside admin-token so the operator can paste
@@ -408,6 +418,7 @@ export async function runServe(opts) {
             : {}),
         ...(backend.adminToken ? { adminToken: backend.adminToken } : {}),
         ...(opts.noLlmKey ? { noLlmKey: true } : {}),
+        ...(opts.flags.noConsole ? { noConsole: true } : {}),
         ...(backend.embeddingModel ? { embeddingModel: backend.embeddingModel } : {}),
         ...(opts.flags.browserOrigins.length > 0
             ? { browserOrigins: opts.flags.browserOrigins }
@@ -419,12 +430,14 @@ export async function runServe(opts) {
     // to the admin onboarding flow at `/admin-login?next=/admin/llm-keys`,
     // so the URL bar lands on the right page without the CLI needing
     // to know which target to pick. Skipped for: `--no-open`, non-TTY
-    // (CI / supervised / piped), `--mcp-only` (no UI surface to open).
+    // (CI / supervised / piped), `--mcp-only` (no UI surface to open),
+    // `--no-console` (no console to open, ggui#1167).
     // Errors are swallowed — the banner already shows the URL so the
     // operator can copy/paste if launchBrowser fails (xdg-open missing,
     // etc.).
     const shouldAutoOpenServe = !opts.flags.noOpen
         && !opts.flags.mcpOnly
+        && !opts.flags.noConsole
         && opts.stdout === process.stdout
         && process.stdout.isTTY === true;
     if (shouldAutoOpenServe) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.27.0",
-  "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
+  "version": "0.28.0",
+  "description": "The `ggui` CLI — run the GGUI protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
     "cli",
@@ -37,22 +37,22 @@
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.28.2",
     "zod": "^4.3.6",
-    "@ggui-ai/agent-runtime": "0.27.0",
-    "@ggui-ai/artifact-manifest": "0.27.0",
-    "@ggui-ai/dev-stack": "0.27.0",
-    "@ggui-ai/design": "0.27.0",
-    "@ggui-ai/gadget-signing": "0.27.0",
-    "@ggui-ai/mcp-server": "0.27.0",
-    "@ggui-ai/project-config": "0.27.0",
-    "@ggui-ai/preview-a2ui": "0.27.0",
-    "@ggui-ai/protocol": "0.27.0",
-    "@ggui-ai/registry-core": "0.27.0",
-    "@ggui-ai/embedding-local": "0.27.0",
-    "@ggui-ai/mcp-server-handlers": "0.27.0",
-    "@ggui-ai/iframe-runtime": "0.27.0",
-    "@ggui-ai/ui-gen": "0.27.0",
-    "@ggui-ai/ui-registry": "0.27.0",
-    "@ggui-ai/mcp-server-core": "0.27.0"
+    "@ggui-ai/agent-runtime": "0.28.0",
+    "@ggui-ai/artifact-manifest": "0.28.0",
+    "@ggui-ai/design": "0.28.0",
+    "@ggui-ai/gadget-signing": "0.28.0",
+    "@ggui-ai/dev-stack": "0.28.0",
+    "@ggui-ai/embedding-local": "0.28.0",
+    "@ggui-ai/mcp-server": "0.28.0",
+    "@ggui-ai/mcp-server-core": "0.28.0",
+    "@ggui-ai/mcp-server-handlers": "0.28.0",
+    "@ggui-ai/project-config": "0.28.0",
+    "@ggui-ai/protocol": "0.28.0",
+    "@ggui-ai/registry-core": "0.28.0",
+    "@ggui-ai/iframe-runtime": "0.28.0",
+    "@ggui-ai/preview-a2ui": "0.28.0",
+    "@ggui-ai/ui-gen": "0.28.0",
+    "@ggui-ai/ui-registry": "0.28.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",