@ggui-ai/cli 0.27.0 → 0.29.0

package/dist/cli.js

@@ -17,16 +17,17 @@ import { buildAgentRuntime, describeTunnelSession, DEV_HELP, launchBrowser, open
 import { createNullTunnelProvider, discoverTunnelProvider, } from './tunnel-provider.js';
 import { ManifestBlueprintProvider, resolveStorageFromConfig, buildNoCredentialsGguiSession, } from '@ggui-ai/mcp-server';
 import { InMemoryBlueprintProvider } from '@ggui-ai/mcp-server-core/in-memory';
+import { ZERO_CONFIG_ROUTE_BY_PROVIDER } from '@ggui-ai/protocol';
 import { createByokResolver } from './byok-resolver.js';
 import { isInstalledBlueprintPath } from './internal/artifact-install.js';
-import { DEFAULT_ROUTE_BY_PROVIDER, GENERATION_MODEL_ENV, describeGenerationBinding, probeGenerationBinding, resolveConfiguredRoute, } from './generation-probe.js';
+import { GENERATION_MODEL_ENV, describeGenerationBinding, probeGenerationBinding, resolveConfiguredRoute, } from './generation-probe.js';
 import { buildMcpServerBackend, pickFreePort } from './mcp-backend.js';
 import { FileSystemSeedPoolSource } from './filesystem-seed-pool-source.js';
 import { buildSeedPool } from '@ggui-ai/mcp-server-handlers';
 import { createThemeWriter } from './theme-writer.js';
 import { createThemeFileUploader } from './theme-file-uploader.js';
 import { getPersistentDir } from './paths.js';
-import { createPersistentVectorStore, layerPersistentSessionStores, } from './persistent-stores.js';
+import { createPersistentVectorStores, layerPersistentSessionStores, } from './persistent-stores.js';
 import { parseServeFlags, runServe, SERVE_HELP, } from './serve-command.js';
 import { runLoginCommand } from './auth-login.js';
 import { runLogoutCommand } from './auth-logout.js';
@@ -40,6 +41,7 @@ import { runCreateCommand } from './create-app-command.js';
 import { runPushCommand } from './push-command.js';
 import { runDeployCommand } from './deploy-command.js';
 import { runProviderKeyCommand } from './provider-key-command.js';
+import { localCliLoginSdkWarning } from './local-cli-login-sdk.js';
 const HELP = `ggui — open CLI for the ggui protocol
 
 Usage:
@@ -73,6 +75,8 @@ Commands:
                  --port <n>       Bind port (default: 6781, 0 = OS-assigned).
                  --host <addr>    Bind host (default: 127.0.0.1).
                  --mcp-only       Boot only MCP; skip agent supervision.
+                 --no-console     Serve no operator console: no admin token is
+                                  minted or printed (env GGUI_NO_CONSOLE=1).
 
   login        Sign into ggui.ai (device flow). Tokens stored in
                ~/.ggui/auth.json.
@@ -310,8 +314,8 @@ async function runServeCommand(args) {
             }
             if (!manifestDeclaresVectors && storage.vectors === undefined) {
                 try {
-                    const vectors = await createPersistentVectorStore(persistentDir);
-                    storage = { ...storage, vectors };
+                    const { vectors, index } = await createPersistentVectorStores(persistentDir);
+                    storage = { ...storage, vectors, index };
                 }
                 catch (err) {
                     process.stderr.write(`ggui serve: persistent vector store unavailable — using in-memory `
@@ -502,6 +506,12 @@ async function runServeCommand(args) {
     // the card (key missing).
     const baseUrlForCard = parsed.publicBaseUrl ?? `http://${parsed.host}:${effectivePort}`;
     const settingsUrl = `${baseUrlForCard}/settings`;
+    // ggui#1167 — `--no-console` (or `GGUI_NO_CONSOLE=1` / `true`, the env twin a
+    // supervisor sets without touching argv): serve no operator console.
+    // Resolved before the key probe because the no-credentials card points
+    // at the console's `/settings`, which this mode does not serve.
+    const envNoConsole = process.env['GGUI_NO_CONSOLE']?.trim();
+    const noConsole = parsed.noConsole || envNoConsole === '1' || envNoConsole === 'true';
     // No-credentials cards live for an hour from mint — long enough for
     // the operator to follow the Connect-Claude link, paste a key, and
     // re-prompt before the persisted GguiSession is GC'd.
@@ -544,11 +554,12 @@ async function runServeCommand(args) {
         // fall back to an empty one so the generator has a valid
         // `blueprints` dep regardless of manifest state.
         const blueprintsForGen = blueprintProvider ?? new InMemoryBlueprintProvider();
-        generationBinding = await probeGenerationBinding({
-            resolver: createByokResolver({ localCliLogin: parsed.localCliLogin }),
-            blueprints: blueprintsForGen,
-            ...(configuredRoute ? { configuredRoute } : {}),
-            onNoCredentials: (ctx, story) => {
+        // Without a console there is no `/settings` page for the card to link
+        // to, so under `--no-console` a key-less render fails with
+        // NO_CREDENTIALS instead (ggui#1167).
+        const onNoCredentials = noConsole
+            ? undefined
+            : (ctx, story) => {
                 const nowEpochMs = Date.parse(story.nowIso);
                 return buildNoCredentialsGguiSession({
                     sessionId: story.sessionId,
@@ -558,7 +569,12 @@ async function runServeCommand(args) {
                     expiresAt: nowEpochMs + NO_CREDENTIALS_CARD_TTL_MS,
                     settingsUrl,
                 });
-            },
+            };
+        generationBinding = await probeGenerationBinding({
+            resolver: createByokResolver({ localCliLogin: parsed.localCliLogin }),
+            blueprints: blueprintsForGen,
+            ...(configuredRoute ? { configuredRoute } : {}),
+            ...(onNoCredentials ? { onNoCredentials } : {}),
         });
     }
     catch (err) {
@@ -590,13 +606,13 @@ async function runServeCommand(args) {
             `  {\n` +
             `    "schema": "1",\n` +
             `    "generation": {\n` +
-            `      "model": "${generationBinding.provider}:${DEFAULT_ROUTE_BY_PROVIDER[generationBinding.provider].model}"\n` +
+            `      "model": "${generationBinding.provider}:${ZERO_CONFIG_ROUTE_BY_PROVIDER[generationBinding.provider].model}"\n` +
             `    }\n` +
             `  }\n` +
             `\n` +
             `Accepted forms:\n` +
-            `  - canonical: "anthropic:claude-haiku-4-5-20251001"\n` +
-            `  - LiteLLM:   "anthropic/claude-haiku-4-5"\n` +
+            `  - canonical: "anthropic:claude-haiku-5-5"\n` +
+            `  - LiteLLM:   "anthropic/claude-haiku-5-5"\n` +
             `\n` +
             `See docs/principles/model-string-convention.md.\n`);
         return 1;
@@ -607,6 +623,12 @@ async function runServeCommand(args) {
     if (parsed.localCliLogin && generationBinding.provider !== 'anthropic') {
         process.stderr.write(`ggui serve: --local-cli-login covers anthropic routes only; this server generates on ${generationBinding.provider}, so the flag has no effect.\n`);
     }
+    else if (parsed.localCliLogin) {
+        // ggui#1951: the login route runs on an optional peer; say so at boot.
+        const sdkWarning = await localCliLoginSdkWarning();
+        if (sdkWarning !== undefined)
+            process.stderr.write(sdkWarning);
+    }
     // Build seed pools from --seed-pool flags BEFORE composing the backend
     // factory. `buildSeedPool` is async (reads + indexes the directory
     // artifact) so it must run here in the async outer scope rather than
@@ -636,6 +658,7 @@ async function runServeCommand(args) {
                 host: parsed.host,
                 mcpOnly: parsed.mcpOnly,
                 devAllowAll: parsed.devAllowAll,
+                noConsole,
                 withholdResultMeta: parsed.withholdResultMeta,
                 publicDemo: parsed.publicDemo,
                 multiUser: parsed.multiUser,
@@ -658,6 +681,7 @@ async function runServeCommand(args) {
                 publicDemo: parsed.publicDemo,
                 multiUser: parsed.multiUser,
                 oauth: parsed.oauth,
+                ...(noConsole ? { noConsole: true } : {}),
                 ...(parsed.publicBaseUrl !== undefined
                     ? { publicBaseUrl: parsed.publicBaseUrl }
                     : {}),

package/dist/config-push.js

@@ -10,7 +10,7 @@ import process from 'node:process';
 import { dirname } from 'node:path';
 import { appPublicEnvSchema, appThemeSchema, canonicalOverlayHash, LOOPBACK_HOST_RE, } from '@ggui-ai/protocol';
 import { loadTheme, parseGguiJson } from '@ggui-ai/project-config/node';
-import { z } from 'zod';
+import * as z from 'zod';
 import { patchAppConfig } from './api-client.js';
 import { findGguiJson, readGadgetsFromGguiJson, readGguiJson, } from './internal/ggui-json.js';
 // ─────────────────────────────────────────────────────────────────────────────

package/dist/generation-probe.d.ts

@@ -19,8 +19,9 @@
  *      key via `/settings`, the resolver picks it up on the next
  *      `ggui_render`.
  *   3. **No-key default** — when the boot scan finds nothing, we
- *      STILL return a binding (provider=`anthropic`, model=
- *      `claude-haiku-4-5`). Generation stays wired; the
+ *      STILL return a binding: the Anthropic row of
+ *      `ZERO_CONFIG_ROUTE_BY_PROVIDER` from `@ggui-ai/protocol`, which
+ *      is the open-source default. Generation stays wired; the
  *      no-credentials path now produces a Connect-Claude card
  *      render via {@link GenerationDeps.onNoCredentials}
  *      instead of the broken `codeReady:false` placeholder.
@@ -42,28 +43,6 @@
  */
 import type { BlueprintProvider, GenerationDeps, HandlerContext, LlmProvider, LlmRoute, GguiSession } from '@ggui-ai/mcp-server';
 import type { ByokKeyResolution, ByokResolver } from './byok-resolver.js';
-/**
- * Locked default model per provider for the OSS first-run path.
- *
- * These are the "sensible default for an operator who exported
- * `ANTHROPIC_API_KEY` without thinking about which model" — NOT
- * benchmark-tuned recommendations. A later slice wires
- * `ggui.json#generation.model` so operators can pick explicitly;
- * until then these keep the zero-config path honest.
- *
- * Notably absent: `bedrock`. AWS credentials flow through the SDK
- * chain, which the OSS BYOK resolver doesn't cover — the hosted runtime
- * binds Bedrock through its own `GenerationDeps` at the hosted
- * surface.
- */
-/**
- * Locked default route per provider, as a typed {@link LlmRoute}.
- * Model strings are bare wire-canonical IDs (registry KEY ==
- * what the provider's API expects on the wire) — there is no
- * transformation step downstream. `dispatchGeneration` sends
- * `route.model` verbatim.
- */
-export declare const DEFAULT_ROUTE_BY_PROVIDER: Readonly<Record<Exclude<LlmProvider, 'bedrock'>, LlmRoute>>;
 /**
  * Priority order for BYOK provider probing. The first provider
  * whose credentials resolve wins. Anthropic first is deliberate —
@@ -125,7 +104,7 @@ export interface ProbeGenerationBindingOptions {
      *   - `configuredRoute.provider` becomes the boot-scan provider
      *     (overriding the priority chain).
      *   - `configuredRoute.model` is what flows to the dispatch path
-     *     (overriding `DEFAULT_ROUTE_BY_PROVIDER[provider]`).
+     *     (overriding `ZERO_CONFIG_ROUTE_BY_PROVIDER[provider]` from `@ggui-ai/protocol`).
      *
      * Absent → fall back to today's behavior: walk the priority chain,
      * use the per-provider default. The CLI hard-fails BEFORE reaching

package/dist/generation-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAMlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA2F5B;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAUR"}
+{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA2F5B;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAUR"}

package/dist/generation-probe.js

@@ -1,32 +1,5 @@
-import { parseAnyLlmRoute } from '@ggui-ai/protocol';
+import { parseAnyLlmRoute, ZERO_CONFIG_ROUTE_BY_PROVIDER } from '@ggui-ai/protocol';
 import { createUiGenerator } from '@ggui-ai/ui-gen';
-/**
- * Locked default model per provider for the OSS first-run path.
- *
- * These are the "sensible default for an operator who exported
- * `ANTHROPIC_API_KEY` without thinking about which model" — NOT
- * benchmark-tuned recommendations. A later slice wires
- * `ggui.json#generation.model` so operators can pick explicitly;
- * until then these keep the zero-config path honest.
- *
- * Notably absent: `bedrock`. AWS credentials flow through the SDK
- * chain, which the OSS BYOK resolver doesn't cover — the hosted runtime
- * binds Bedrock through its own `GenerationDeps` at the hosted
- * surface.
- */
-/**
- * Locked default route per provider, as a typed {@link LlmRoute}.
- * Model strings are bare wire-canonical IDs (registry KEY ==
- * what the provider's API expects on the wire) — there is no
- * transformation step downstream. `dispatchGeneration` sends
- * `route.model` verbatim.
- */
-export const DEFAULT_ROUTE_BY_PROVIDER = {
-    anthropic: { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' },
-    openai: { provider: 'openai', model: 'gpt-5.6-luna' },
-    google: { provider: 'google', model: 'gemini-3.5-flash-lite' },
-    openrouter: { provider: 'openrouter', model: 'anthropic/claude-haiku-4.5' },
-};
 /**
  * Priority order for BYOK provider probing. The first provider
  * whose credentials resolve wins. Anthropic first is deliberate —
@@ -110,7 +83,7 @@ export async function probeGenerationBinding(opts) {
     const defaultProvider = configured && configured.provider !== 'bedrock'
         ? configured.provider
         : bootHit?.provider ?? 'anthropic';
-    const defaultRoute = configured ?? DEFAULT_ROUTE_BY_PROVIDER[defaultProvider];
+    const defaultRoute = configured ?? ZERO_CONFIG_ROUTE_BY_PROVIDER[defaultProvider];
     const defaultModel = defaultRoute.model;
     // Full-harness wire-up: `createUiGenerator` runs the same
     // multi-turn coding agent + self-check loop the bench validates;

package/dist/internal/ggui-json.js

@@ -17,7 +17,7 @@
 import { existsSync, readFileSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { strictGadgetDescriptorSchema, } from '@ggui-ai/protocol';
-import { z } from 'zod';
+import * as z from 'zod';
 /** Canonical filename — duplicated from `@ggui-ai/project-config` so
  * this helper stays free of that dependency. The constant lives in one
  * place per package; updates ride along on a project-config bump. */

package/dist/local-cli-login-sdk.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `--local-cli-login` generates through the Claude Agent SDK, which
+ * `@ggui-ai/ui-gen` declares as an optional peer (ggui#1951): its
+ * native binary is about 300 MB, so a plain `@ggui-ai/cli` install
+ * does not carry it. `ggui serve` checks at boot and warns with the
+ * install lines, instead of letting the first generation on the login
+ * route be the one that finds out.
+ *
+ * A warning, not a refusal: the login route only runs when no Anthropic
+ * key resolves, so a server with a key never needs the SDK.
+ */
+import { ensureClaudeAgentSdk } from '@ggui-ai/ui-gen';
+/**
+ * The boot warning for a missing SDK, or `undefined` when it loads.
+ * Any other load failure rejects unchanged. `check` is for tests.
+ */
+export declare function localCliLoginSdkWarning(check?: typeof ensureClaudeAgentSdk): Promise<string | undefined>;
+//# sourceMappingURL=local-cli-login-sdk.d.ts.map

package/dist/local-cli-login-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-cli-login-sdk.d.ts","sourceRoot":"","sources":["../src/local-cli-login-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAA8B,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEnF;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,GAAE,OAAO,oBAA2C,GACxD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}

package/dist/local-cli-login-sdk.js

@@ -0,0 +1,27 @@
+/**
+ * `--local-cli-login` generates through the Claude Agent SDK, which
+ * `@ggui-ai/ui-gen` declares as an optional peer (ggui#1951): its
+ * native binary is about 300 MB, so a plain `@ggui-ai/cli` install
+ * does not carry it. `ggui serve` checks at boot and warns with the
+ * install lines, instead of letting the first generation on the login
+ * route be the one that finds out.
+ *
+ * A warning, not a refusal: the login route only runs when no Anthropic
+ * key resolves, so a server with a key never needs the SDK.
+ */
+import { ClaudeAgentSdkMissingError, ensureClaudeAgentSdk } from '@ggui-ai/ui-gen';
+/**
+ * The boot warning for a missing SDK, or `undefined` when it loads.
+ * Any other load failure rejects unchanged. `check` is for tests.
+ */
+export async function localCliLoginSdkWarning(check = ensureClaudeAgentSdk) {
+    try {
+        await check();
+        return undefined;
+    }
+    catch (err) {
+        if (!(err instanceof ClaudeAgentSdkMissingError))
+            throw err;
+        return `ggui serve: --local-cli-login generates through the Claude Agent SDK. ${err.message}\n`;
+    }
+}

package/dist/mcp-backend.d.ts

@@ -1,5 +1,5 @@
 import { type BlueprintProvider, type DiscoveredPrimitiveCatalog, type GadgetDescriptor, type GenerationDeps, type LoadedTheme, type McpServerMount, type McpUiDisplayMode, type OperatorConfig, type ResolvedStorageStores, type ShortCodeIndex, type ThemeFileUploader, type ThemeWriter } from "@ggui-ai/mcp-server";
-import { type BlueprintPool } from "@ggui-ai/mcp-server-handlers/renders";
+import { type BlueprintPool, type InstalledBlueprintsProvider } from "@ggui-ai/mcp-server-handlers/renders";
 import type { ThemeConfig, UiManifest } from "@ggui-ai/project-config";
 import type { UiRegistry } from "@ggui-ai/ui-registry";
 import type { ServeBackend } from "./serve-command.js";
@@ -305,6 +305,13 @@ export interface BuildMcpServerBackendOptions {
      * Surface = `--admin-token <token>` CLI flag.
      */
     readonly adminToken?: string;
+    /**
+     * ggui#1167 — serve no operator console. The `console` option is not
+     * passed to `createGguiServer`, so no console route is mounted and no
+     * admin token is minted (`adminToken` is `null`). Surface =
+     * `--no-console` / `GGUI_NO_CONSOLE=1`.
+     */
+    readonly noConsole?: boolean;
     /**
      * Server-rendered public welcome page at `/`. Identifies who runs
      * the server (operator block, hidden when nothing configured)
@@ -352,6 +359,13 @@ export interface BuildMcpServerBackendOptions {
      */
     readonly defaultDisplayMode?: McpUiDisplayMode;
 }
+/**
+ * Await the install walks still in flight on `provider`, for at most
+ * `withinMs`. Resolves either way and never rejects (`drain()` never does);
+ * the timer is unref'd, so it never holds the process open on its own. No
+ * provider (no installed blueprints) resolves at once.
+ */
+export declare function drainWithin(provider: Pick<InstalledBlueprintsProvider, "drain"> | undefined, withinMs: number): Promise<void>;
 /**
  * Pick a free localhost TCP port by letting the OS assign one on a
  * throwaway listener. Close the listener immediately and return the

package/dist/mcp-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA2lBtF"}
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EAEtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAIlB,KAAK,2BAA2B,EAEjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,IAAI,CAAC,2BAA2B,EAAE,OAAO,CAAC,GAAG,SAAS,EAChE,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA0mBtF"}

package/dist/mcp-backend.js

@@ -40,7 +40,7 @@ import { listThemes } from "@ggui-ai/design/themes";
 import { compileUiOnDemand } from "@ggui-ai/dev-stack";
 import { createLocalEmbeddingProvider } from "@ggui-ai/embedding-local";
 import { RUNTIME_BUNDLE_URL_PATH } from "@ggui-ai/iframe-runtime/server";
-import { createGguiServer, FileSystemCodeStore, FixedWindowRateLimiter, InMemoryAuthAdapter, InMemoryQuotaStore, InMemoryShortCodeIndex, selectEmailSenderFromEnv, } from "@ggui-ai/mcp-server";
+import { createGguiServer, FileSystemCodeStore, FixedWindowRateLimiter, InMemoryAuthAdapter, InMemoryQuotaStore, InMemoryShortCodeIndex, selectEmailSenderFromEnv, DEFAULT_CLOSE_GRACE_MS, } from "@ggui-ai/mcp-server";
 import { InMemoryAppMetadataStore, InMemoryBlueprintIndex, InMemoryVectorStore, } from "@ggui-ai/mcp-server-core/in-memory";
 import { PlaintextFileProviderKeyStore } from "@ggui-ai/mcp-server-core/plaintext";
 import { createInstalledBlueprintsProvider, createStderrCacheTraceSink, installedBlueprintIntent, setCacheTraceSink, } from "@ggui-ai/mcp-server-handlers/renders";
@@ -50,6 +50,23 @@ import { createServer as createNetServer } from "node:net";
 import { join } from "node:path";
 import { getCodeCacheDir, getCredentialsFile, getEmbeddingCacheDir } from "./paths.js";
 import { readOrMintHexSecret } from "./persistent-secrets.js";
+/**
+ * Await the install walks still in flight on `provider`, for at most
+ * `withinMs`. Resolves either way and never rejects (`drain()` never does);
+ * the timer is unref'd, so it never holds the process open on its own. No
+ * provider (no installed blueprints) resolves at once.
+ */
+export async function drainWithin(provider, withinMs) {
+    if (provider === undefined)
+        return;
+    let timer;
+    const elapsed = new Promise((resolve) => {
+        timer = setTimeout(resolve, withinMs);
+        timer.unref();
+    });
+    await Promise.race([provider.drain(), elapsed]);
+    clearTimeout(timer);
+}
 /**
  * Pick a free localhost TCP port by letting the OS assign one on a
  * throwaway listener. Close the listener immediately and return the
@@ -292,14 +309,14 @@ export function buildMcpServerBackend(opts) {
     // here on the absent-storage path; threaded back as `vectors` to
     // `createGguiServer` so server + provider share state.
     const vectorStore = storage.vectors ?? new InMemoryVectorStore();
-    // Blueprint identity index — minted here so the install bridge's
-    // provider deps and the server share ONE instance (the server's
-    // ref-equality guard enforces this, same as `vectorStore`). The index
-    // is rebuildable from vector-store metadata and self-heals at the read
-    // site, so an in-memory index is safe even alongside a persistent
-    // `storage.vectors`; a persistent index can be threaded later via the
-    // same seam.
-    const blueprintIndex = new InMemoryBlueprintIndex();
+    // Blueprint identity index, ONE instance for the install bridge's
+    // provider deps and the server (the server's ref-equality guard
+    // enforces this, same as `vectorStore`). It persists exactly when the
+    // vectors do: storage that persists vectors hands its index beside them
+    // (`storage.index`). An in-memory index over persistent vectors comes
+    // back empty after every restart, and the install walk then registers
+    // each installed blueprint again as a new row (ggui#1907).
+    const blueprintIndex = storage.index ?? new InMemoryBlueprintIndex();
     // Construct the marketplace-install bridge BEFORE `createGguiServer`
     // so we can fold it into `opts.generation.installedBlueprints` below.
     // Per design lock (project_slices_5_6_7_plan.md), the provider
@@ -472,38 +489,44 @@ export function buildMcpServerBackend(opts) {
         // field; flag flips on `oauth: true` defaults (in-memory storage,
         // built-in paste-key consent page).
         ...(opts.oauth ? { oauth: true } : {}),
-        console: {
-            sessionCookie: true,
-            ...(opts.adminToken !== undefined ? { adminToken: opts.adminToken } : {}),
-            // First-run onboarding redirect. When neither the credentials
-            // file (`~/.ggui/credentials.json`) nor any provider env var
-            // (ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY /
-            // OPENROUTER_API_KEY) is present, send `GET /` to the
-            // **admin** onboarding flow — the operator running `ggui serve`
-            // IS the admin on first-run, so they need the operator-key
-            // plane (`/admin/llm-keys`) and the assistant-connection card
-            // surfaced there. Cookie-gated end-user `/settings` is for a
-            // *separate* user paired with the server later, not the
-            // first-run operator. Once any key is configured, the next
-            // visit serves the SPA normally. Scoped to the root path;
-            // deep links bypass the redirect.
-            landingRedirect: () => {
-                try {
-                    const credsFileExists = existsSync(getCredentialsFile());
-                    const anyEnvKey = !!process.env.ANTHROPIC_API_KEY ||
-                        !!process.env.OPENAI_API_KEY ||
-                        !!process.env.GOOGLE_API_KEY ||
-                        !!process.env.OPENROUTER_API_KEY;
-                    if (!credsFileExists && !anyEnvKey) {
-                        return "/admin-login?next=%2Fadmin%2Fllm-keys";
-                    }
-                    return null;
-                }
-                catch {
-                    return null;
-                }
-            },
-        },
+        // ggui#1167 — `--no-console` mounts no console and so mints no admin
+        // token: the server is an MCP endpoint only, with no operator bearer.
+        ...(opts.noConsole
+            ? {}
+            : {
+                console: {
+                    sessionCookie: true,
+                    ...(opts.adminToken !== undefined ? { adminToken: opts.adminToken } : {}),
+                    // First-run onboarding redirect. When neither the credentials
+                    // file (`~/.ggui/credentials.json`) nor any provider env var
+                    // (ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY /
+                    // OPENROUTER_API_KEY) is present, send `GET /` to the
+                    // **admin** onboarding flow — the operator running `ggui serve`
+                    // IS the admin on first-run, so they need the operator-key
+                    // plane (`/admin/llm-keys`) and the assistant-connection card
+                    // surfaced there. Cookie-gated end-user `/settings` is for a
+                    // *separate* user paired with the server later, not the
+                    // first-run operator. Once any key is configured, the next
+                    // visit serves the SPA normally. Scoped to the root path;
+                    // deep links bypass the redirect.
+                    landingRedirect: () => {
+                        try {
+                            const credsFileExists = existsSync(getCredentialsFile());
+                            const anyEnvKey = !!process.env.ANTHROPIC_API_KEY ||
+                                !!process.env.OPENAI_API_KEY ||
+                                !!process.env.GOOGLE_API_KEY ||
+                                !!process.env.OPENROUTER_API_KEY;
+                            if (!credsFileExists && !anyEnvKey) {
+                                return "/admin-login?next=%2Fadmin%2Fllm-keys";
+                            }
+                            return null;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                },
+            }),
         // Public welcome page at `/` — operator identification + public
         // deep-link surfaces + operator-login affordance. Resolved from
         // `ggui.json#operator` + `ggui.json#app.name` by serve-command.ts;
@@ -643,7 +666,16 @@ export function buildMcpServerBackend(opts) {
             }
             return addr.port;
         },
-        close: () => server.close(),
+        close: async () => {
+            await server.close();
+            // A walk can outlive the request that started it, and a persistent
+            // index means one cut between a blueprint's vector write and its
+            // index write leaves a vector with no binding. Wait for the walks
+            // once no request can start a new one (the server is closed), for
+            // at most the server's own close grace: past it, the cut is what a
+            // stop without a drain would have done (ggui#1907).
+            await drainWithin(installedBlueprintsProvider, DEFAULT_CLOSE_GRACE_MS);
+        },
         toolCount: server.toolCount,
         serverName: "ggui-mcp-server",
         serverVersion: opts.cliVersion,

package/dist/persistent-stores.d.ts

@@ -1,4 +1,4 @@
-import type { GguiSessionStore, GguiSessionStreamBuffer, VectorStore } from '@ggui-ai/mcp-server-core';
+import type { BlueprintIndex, GguiSessionStore, GguiSessionStreamBuffer, VectorStore } from '@ggui-ai/mcp-server-core';
 import type { ResolvedStorageStores } from '@ggui-ai/mcp-server';
 /** The persistent session store and the live channel's stream buffer, opened together. */
 export interface PersistentSessionStores {
@@ -26,7 +26,18 @@ export declare function createPersistentSessionStores(persistentDir: string): Pr
  * unavailable; the caller falls back to the in-memory defaults.
  */
 export declare function layerPersistentSessionStores(storage: ResolvedStorageStores, persistentDir: string): Promise<ResolvedStorageStores>;
-export declare function createPersistentVectorStore(persistentDir: string): Promise<VectorStore>;
+/**
+ * `ggui serve`'s persistent layer for blueprints: the vector store and its
+ * blueprint identity index, in one `vectors.sqlite`, both or neither. An
+ * in-memory index beside persistent vectors comes back empty after every
+ * restart, and the install walk then registers each installed blueprint
+ * again as a new row (ggui#1907). Throws when SQLite is unavailable; the
+ * caller falls back to the in-memory defaults.
+ */
+export declare function createPersistentVectorStores(persistentDir: string): Promise<{
+    readonly vectors: VectorStore;
+    readonly index: BlueprintIndex;
+}>;
 /**
  * Compute the auto-default `keysFile` path. Returns `undefined` when
  * the caller wants ephemeral pairing (the operator already passed

package/dist/persistent-stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistent-stores.d.ts","sourceRoot":"","sources":["../src/persistent-stores.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAalC;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAIhC;AAED,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7D"}
+{"version":3,"file":"persistent-stores.d.ts","sourceRoot":"","sources":["../src/persistent-stores.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAalC;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC,CAU5E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/persistent-stores.js

@@ -54,12 +54,22 @@ export async function layerPersistentSessionStores(storage, persistentDir) {
     const { renderStore, streamBuffer } = await createPersistentSessionStores(persistentDir);
     return { ...storage, renderStore, streamBuffer };
 }
-export async function createPersistentVectorStore(persistentDir) {
+/**
+ * `ggui serve`'s persistent layer for blueprints: the vector store and its
+ * blueprint identity index, in one `vectors.sqlite`, both or neither. An
+ * in-memory index beside persistent vectors comes back empty after every
+ * restart, and the install walk then registers each installed blueprint
+ * again as a new row (ggui#1907). Throws when SQLite is unavailable; the
+ * caller falls back to the in-memory defaults.
+ */
+export async function createPersistentVectorStores(persistentDir) {
     mkdirSync(persistentDir, { recursive: true });
-    const { SqliteVectorStore } = await import('@ggui-ai/mcp-server-core/sqlite');
-    return new SqliteVectorStore({
-        filename: join(persistentDir, 'vectors.sqlite'),
-    });
+    const { SqliteBlueprintIndex, SqliteVectorStore } = await import('@ggui-ai/mcp-server-core/sqlite');
+    const filename = join(persistentDir, 'vectors.sqlite');
+    return {
+        vectors: new SqliteVectorStore({ filename }),
+        index: new SqliteBlueprintIndex({ filename }),
+    };
 }
 /**
  * Compute the auto-default `keysFile` path. Returns `undefined` when

package/dist/provider-key-command.js

@@ -11,7 +11,7 @@
 /* eslint-disable no-console */
 import process from 'node:process';
 import { parseAnyLlmRoute } from '@ggui-ai/protocol';
-import { z } from 'zod';
+import * as z from 'zod';
 import { setAppProviderKey } from './api-client.js';
 import { findGguiJson, readGguiJson } from './internal/ggui-json.js';
 // ─────────────────────────────────────────────────────────────────────────────

package/dist/serve-command.d.ts

@@ -57,6 +57,16 @@ export interface ParsedServeFlags {
      * warning when this flag is set.
      */
     devAllowAll: boolean;
+    /**
+     * ggui#1167 — serve no operator console. No console routes are
+     * mounted and no console admin token is minted, so nothing prints an
+     * operator bearer (`admin token →`, `ADMIN_TOKEN`). For a server a
+     * tool launches as an MCP endpoint only, where nobody logs in to a
+     * console. Env twin: `GGUI_NO_CONSOLE=1`, resolved by the CLI.
+     * Independent of `--mcp-only`, which skips agent supervision and
+     * still serves the console.
+     */
+    noConsole: boolean;
     /**
      * Override the public base URL used to compose `mcpApps.wsUrl`
      * and `runtime.url`. Without this, the URLs derive from
@@ -356,6 +366,13 @@ export interface ServeBannerInputs {
      * returned null (no env var + no credentials-file entry).
      */
     readonly noLlmKey?: boolean;
+    /**
+     * ggui#1167 — the server serves no console (`--no-console`). The
+     * banner then advertises no landing page, and a key-less boot names
+     * only the env vars to export: there is no `/settings` page and no
+     * admin token to point at.
+     */
+    readonly noConsole?: boolean;
     /**
      * Embedding model id surfaced for the local RAG layer. When set,
      * the banner shows a `rag` line so operators see which model is
@@ -537,5 +554,5 @@ export interface RunServeOptions {
  * {@link describeServeBanner} / {@link describeAgentStatus}.
  */
 export declare function runServe(opts: RunServeOptions): Promise<number>;
-export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-user         Multi-user posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --local-cli-login      Generate with the Claude login already on this\n                         machine (the one `claude` uses) when no\n                         ANTHROPIC_API_KEY is set, instead of an API key.\n                         Anthropic routes only; a real key always wins. Your\n                         Claude plan's terms and usage limits apply, and\n                         generation is about 2x slower (2.2x at the median)\n                         than with an API key. For your own use: refused with\n                         --multi-user and --public-demo.\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (RAG corpus)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-user: every request scopes to one `builder` app id.\n";
+export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-user         Multi-user posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --local-cli-login      Generate with the Claude login already on this\n                         machine (the one `claude` uses) when no\n                         ANTHROPIC_API_KEY is set, instead of an API key.\n                         Anthropic routes only; a real key always wins. Your\n                         Claude plan's terms and usage limits apply, and\n                         generation is about 2x slower (2.2x at the median)\n                         than with an API key. For your own use: refused with\n                         --multi-user and --public-demo. Needs\n                         @anthropic-ai/claude-agent-sdk installed beside\n                         ggui (not installed with it); boot says how.\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (blueprint cache \u2014 vectors + their identity index)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-user: every request scopes to one `builder` app id.\n";
 //# sourceMappingURL=serve-command.d.ts.map

package/dist/serve-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA+LzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,2tUA8LtB,CAAC"}
+{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAoMzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA4JrE;AAED,eAAO,MAAM,UAAU,65UAgMtB,CAAC"}

package/dist/serve-command.js

@@ -23,6 +23,7 @@ export function parseServeFlags(args) {
         host: DEFAULT_SERVE_HOST,
         mcpOnly: false,
         devAllowAll: false,
+        noConsole: false,
         withholdResultMeta: false,
         publicDemo: false,
         multiUser: false,
@@ -60,6 +61,10 @@ export function parseServeFlags(args) {
             out.mcpOnly = true;
             continue;
         }
+        if (arg === '--no-console') {
+            out.noConsole = true;
+            continue;
+        }
         if (arg === '--withhold-result-meta') {
             out.withholdResultMeta = true;
             continue;
@@ -214,7 +219,7 @@ export function describeServeBanner(input) {
         // signal that closes the first-run story. Landing page lives at `/`
         // by default when `ggui serve` is the entry point (see
         // `cli.ts::buildMcpServerBackend`).
-        `  open      →  ${httpUrl}/`,
+        ...(input.noConsole ? [] : [`  open      →  ${httpUrl}/`]),
         `  mcp       →  ${httpUrl}/mcp`,
         `  health    →  ${httpUrl}/ggui/health`,
         `  tools     →  ${input.toolCount} registered`,
@@ -241,7 +246,12 @@ export function describeServeBanner(input) {
         // both bearers are obvious in the boot banner.
         lines.push(`  admin token →  ${input.adminToken}   (console /keys gate — paste at /admin-login)`);
     }
-    if (input.noLlmKey) {
+    if (input.noLlmKey && input.noConsole) {
+        // ggui#1167 — no console, so no /settings page and no admin token:
+        // the only way to add a key is the environment.
+        lines.push(`  ⚠ no LLM key configured. export ANTHROPIC_API_KEY /`, `        OPENAI_API_KEY / GOOGLE_API_KEY / OPENROUTER_API_KEY`, `        before re-running.`);
+    }
+    else if (input.noLlmKey) {
         // First-run nudge — without an LLM key, ggui_render falls back to
         // the Connect-Claude card and the iframe never bootstraps. Surface
         // the /settings URL alongside admin-token so the operator can paste
@@ -408,6 +418,7 @@ export async function runServe(opts) {
             : {}),
         ...(backend.adminToken ? { adminToken: backend.adminToken } : {}),
         ...(opts.noLlmKey ? { noLlmKey: true } : {}),
+        ...(opts.flags.noConsole ? { noConsole: true } : {}),
         ...(backend.embeddingModel ? { embeddingModel: backend.embeddingModel } : {}),
         ...(opts.flags.browserOrigins.length > 0
             ? { browserOrigins: opts.flags.browserOrigins }
@@ -419,12 +430,14 @@ export async function runServe(opts) {
     // to the admin onboarding flow at `/admin-login?next=/admin/llm-keys`,
     // so the URL bar lands on the right page without the CLI needing
     // to know which target to pick. Skipped for: `--no-open`, non-TTY
-    // (CI / supervised / piped), `--mcp-only` (no UI surface to open).
+    // (CI / supervised / piped), `--mcp-only` (no UI surface to open),
+    // `--no-console` (no console to open, ggui#1167).
     // Errors are swallowed — the banner already shows the URL so the
     // operator can copy/paste if launchBrowser fails (xdg-open missing,
     // etc.).
     const shouldAutoOpenServe = !opts.flags.noOpen
         && !opts.flags.mcpOnly
+        && !opts.flags.noConsole
         && opts.stdout === process.stdout
         && process.stdout.isTTY === true;
     if (shouldAutoOpenServe) {
@@ -521,7 +534,9 @@ Options:
                          Claude plan's terms and usage limits apply, and
                          generation is about 2x slower (2.2x at the median)
                          than with an API key. For your own use: refused with
-                         --multi-user and --public-demo.
+                         --multi-user and --public-demo. Needs
+                         @anthropic-ai/claude-agent-sdk installed beside
+                         ggui (not installed with it); boot says how.
   --public-base-url <u>  Override the public base URL used to compose
                          iframe-runtime + shortCode URLs. Set this to a
                          tunnel URL (https://<random>.trycloudflare.com)
@@ -592,7 +607,7 @@ Persistent storage (default-on; opt-out via --ephemeral):
       ├── ws-token-secret.hex       (HMAC, 0600)
       ├── short-codes.sqlite        (signed render-URL resolution)
       ├── sessions.sqlite            (GguiSessionStore — renders + event history)
-      ├── vectors.sqlite            (RAG corpus)
+      ├── vectors.sqlite            (blueprint cache — vectors + their identity index)
       └── keys.json                 (paired bearers)
 
   Override the dir with \`GGUI_PERSISTENT_DIR\`. Pass \`--ephemeral\` to

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.27.0",
-  "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
+  "version": "0.29.0",
+  "description": "The `ggui` CLI — run the GGUI protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
     "cli",
@@ -36,28 +36,28 @@
     "@huggingface/transformers": "^3.0.0",
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.28.2",
-    "zod": "^4.3.6",
-    "@ggui-ai/agent-runtime": "0.27.0",
-    "@ggui-ai/artifact-manifest": "0.27.0",
-    "@ggui-ai/dev-stack": "0.27.0",
-    "@ggui-ai/design": "0.27.0",
-    "@ggui-ai/gadget-signing": "0.27.0",
-    "@ggui-ai/mcp-server": "0.27.0",
-    "@ggui-ai/project-config": "0.27.0",
-    "@ggui-ai/preview-a2ui": "0.27.0",
-    "@ggui-ai/protocol": "0.27.0",
-    "@ggui-ai/registry-core": "0.27.0",
-    "@ggui-ai/embedding-local": "0.27.0",
-    "@ggui-ai/mcp-server-handlers": "0.27.0",
-    "@ggui-ai/iframe-runtime": "0.27.0",
-    "@ggui-ai/ui-gen": "0.27.0",
-    "@ggui-ai/ui-registry": "0.27.0",
-    "@ggui-ai/mcp-server-core": "0.27.0"
+    "zod": "^4.6.6",
+    "@ggui-ai/dev-stack": "0.29.0",
+    "@ggui-ai/gadget-signing": "0.29.0",
+    "@ggui-ai/agent-runtime": "0.29.0",
+    "@ggui-ai/embedding-local": "0.29.0",
+    "@ggui-ai/artifact-manifest": "0.29.0",
+    "@ggui-ai/design": "0.29.0",
+    "@ggui-ai/mcp-server-handlers": "0.29.0",
+    "@ggui-ai/project-config": "0.29.0",
+    "@ggui-ai/preview-a2ui": "0.29.0",
+    "@ggui-ai/mcp-server-core": "0.29.0",
+    "@ggui-ai/protocol": "0.29.0",
+    "@ggui-ai/mcp-server": "0.29.0",
+    "@ggui-ai/iframe-runtime": "0.29.0",
+    "@ggui-ai/registry-core": "0.29.0",
+    "@ggui-ai/ui-registry": "0.29.0",
+    "@ggui-ai/ui-gen": "0.29.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   },
   "repository": {
     "type": "git",