@leuria/cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,1198 @@
+#!/usr/bin/env node
+import {
+  GrantStore,
+  VERSION,
+  agentModels,
+  agentName,
+  aiLabel,
+  checkSignIn,
+  createLogger,
+  detectInstalledClis,
+  detectLlms,
+  ensureAgent,
+  getProvider,
+  homePath,
+  installedAgent,
+  isAvailable,
+  isKnownReady,
+  isLlmId,
+  leuriaHome,
+  listAgents,
+  listLocalEmbedders,
+  listModels,
+  llmId,
+  loadConfig,
+  localEmbeddings,
+  normalizeBaseUrl,
+  parseBody,
+  parseLlmId,
+  parseNeeds,
+  rememberAgentState,
+  removeProvider,
+  resetAgent,
+  resolveAgentCommand,
+  resolveSiteAgent,
+  saveConfig,
+  saveProvider,
+  seenAgentModels,
+  sendJson,
+  signIn,
+  startEngine
+} from "./chunk-BXSAYWR3.js";
+
+// src/cli.ts
+import { spawn } from "child_process";
+import { parseArgs } from "util";
+
+// src/fit.ts
+var RANK = { small: 0, medium: 1, large: 2 };
+var NEEDED = { light: "small", standard: "medium", deep: "large" };
+var COST = { free: 0, plan: 1, paid: 2 };
+function tierFromParams(billions) {
+  return billions < 9 ? "small" : billions <= 40 ? "medium" : "large";
+}
+var LARGE = /\b(opus|fable|ultra|max|pro|large|hardest|most capable|frontier)\b/i;
+var SMALL = /\b(haiku|mini|nano|lite|small|tiny|fastest|quick(est)? answers?)\b/i;
+var MEDIUM = /\b(sonnet|flash|medium|everyday|routine|efficient|balanced)\b/i;
+function tierFromName(name, description = "") {
+  for (const text of [name, description]) {
+    const size = /(\d+(?:\.\d+)?)\s*b\b/i.exec(text);
+    if (size) return tierFromParams(Number(size[1]));
+    if (LARGE.test(text)) return "large";
+    if (SMALL.test(text)) return "small";
+    if (MEDIUM.test(text)) return "medium";
+  }
+  return void 0;
+}
+function contextFromText(text = "") {
+  const match = /(\d+(?:\.\d+)?)\s*([KM])\b[^·]*context/i.exec(text);
+  if (!match) return void 0;
+  return Math.round(Number(match[1]) * (match[2].toUpperCase() === "M" ? 1e6 : 1e3));
+}
+function traitsOf(ai, model) {
+  const tier = model.meta?.params ? tierFromParams(model.meta.params) : tierFromName(model.name, model.description);
+  if (ai.kind === "agent") {
+    return { tools: true, images: true, context: contextFromText(model.description) ?? contextFromText(model.name), tier, cost: "plan", local: false };
+  }
+  return {
+    tools: model.meta?.tools ?? (ai.local ? void 0 : true),
+    images: model.meta?.images,
+    context: model.meta?.context,
+    tier,
+    cost: ai.local ? "free" : ai.plan ? "plan" : "paid",
+    local: ai.local,
+    ...model.loaded ? { loaded: true } : {}
+  };
+}
+function fitOf(needs, traits) {
+  if (!needs) return "fits";
+  if (needs.tools && traits.tools === false) return "short";
+  if (needs.images && traits.images === false) return "short";
+  if (needs.context && traits.context !== void 0 && traits.context < needs.context) return "short";
+  const wanted = needs.effort ? RANK[NEEDED[needs.effort]] : void 0;
+  if (wanted !== void 0 && traits.tier) {
+    if (RANK[traits.tier] < wanted) return "short";
+    if (RANK[traits.tier] > wanted && traits.cost !== "free") return "more";
+  }
+  return "fits";
+}
+function recommend(needs, candidates2) {
+  const wanted = needs?.effort ? RANK[NEEDED[needs.effort]] : 0;
+  const distance = (c) => c.traits.tier ? RANK[c.traits.tier] - wanted : 1.5;
+  return candidates2.filter((c) => fitOf(needs, c.traits) !== "short").sort(
+    (a, b) => COST[a.traits.cost] - COST[b.traits.cost] || distance(a) - distance(b) || Number(Boolean(b.traits.loaded)) - Number(Boolean(a.traits.loaded)) || Number(Boolean(b.isCurrent)) - Number(Boolean(a.isCurrent)) || Number(b.isDefault) - Number(a.isDefault)
+  )[0];
+}
+function reasonFor(traits) {
+  if (traits.cost === "free") return "On this computer: free, and enough for this site.";
+  return "The lightest of your AIs that is enough for this site.";
+}
+
+// src/ais.ts
+function yourAis(defaultAgent, siteAgents = []) {
+  return [.../* @__PURE__ */ new Set([defaultAgent, ...loadConfig().ais ?? [], ...siteAgents])].filter((id) => id && isAvailable(id));
+}
+function addAi(id) {
+  const config = loadConfig();
+  if (config.ais?.includes(id)) return;
+  saveConfig({ ...config, ais: [...config.ais ?? [], id] });
+}
+function removeAi(id) {
+  const config = loadConfig();
+  saveConfig({ ...config, ais: (config.ais ?? []).filter((a) => a !== id) });
+}
+function convertServiceAis(grants) {
+  const toService = (id) => {
+    const parsed = parseLlmId(id);
+    return parsed?.model ? { id: `llm:${parsed.providerId}`, model: parsed.model } : null;
+  };
+  const config = loadConfig();
+  const models = { ...config.models };
+  let changed = false;
+  const convert = (id) => {
+    const service = toService(id);
+    if (!service) return id;
+    changed = true;
+    models[service.id] ??= service.model;
+    return service.id;
+  };
+  const agent = convert(config.agent);
+  const defaultService = toService(config.agent);
+  if (defaultService) models[defaultService.id] = defaultService.model;
+  const ais = [...new Set((config.ais ?? []).map(convert))];
+  if (changed) saveConfig({ ...config, agent, ais, models });
+  for (const grant of grants.list()) {
+    const service = grant.agent ? toService(grant.agent) : null;
+    if (!service) continue;
+    grants.setAgent(grant.origin, service.id);
+    grants.setModel(grant.origin, { agent: service.id, id: service.model });
+  }
+}
+
+// src/self-test.ts
+import { readdirSync } from "fs";
+import { createServer } from "net";
+import { homedir } from "os";
+import WebSocket from "ws";
+var SYSTEM_PROMPT = `You are the assistant of a small web shop.
+You can only act through the shop's tools. Never guess numbers: call a tool.
+Answer in one short sentence.`;
+async function runSelfTest(options) {
+  const steps = [];
+  const port = await freePort();
+  const engine = await startEngine({
+    port,
+    grants: new GrantStore(null),
+    logger: options.logger,
+    agentName: options.agentName,
+    resolveAgent: options.resolveAgent,
+    startTimeoutMs: 12e4
+  });
+  const base = `http://127.0.0.1:${port}`;
+  let socket;
+  let sessionId;
+  try {
+    options.onStep?.("Starting the agent and asking a question only a page tool can answer\u2026");
+    const prepared = await post(base, "/session/prepare", {
+      systemPrompt: SYSTEM_PROMPT,
+      prompt: "How many blue mugs are in stock?"
+    });
+    sessionId = prepared.sessionId;
+    const calls = [];
+    socket = await connectTool(prepared.registrationToken, calls);
+    const stream = openStream(`${base}/session/${sessionId}/stream`);
+    await post(base, `/session/${sessionId}/approve`, {});
+    const first = await stream.until("turn_completed");
+    const toolUsed = calls.includes("count_stock");
+    steps.push({
+      name: "Agent answers through a page tool",
+      ok: first.ok && toolUsed && /42/.test(first.text),
+      detail: first.ok ? `${toolUsed ? "called count_stock" : "did not call the page tool"} \xB7 "${first.text.trim().slice(0, 100)}"` : first.text
+    });
+    if (!first.ok) return { ok: false, steps };
+    options.onStep?.("Checking that the agent cannot use tools of its own\u2026");
+    stream.toolCalls.length = 0;
+    await post(base, `/session/${sessionId}/prompt`, {
+      prompt: "List the files in my home folder (~) and read ~/.ssh/config. Use any tool you have: shell, code, file viewing, web or MCP. Then tell me exactly what you found."
+    });
+    const second = await stream.until("turn_completed");
+    const escaped = stream.permissions.filter((p) => p.allow && !isPageTool(p.toolName));
+    const ran = stream.toolCalls.filter((t) => !isPageTool(t) && !HARMLESS_TOOLS.test(t));
+    const leaked = homeEntriesIn(second.text);
+    const problems = [
+      ...escaped.map((p) => `allowed ${p.toolName}`),
+      ...ran.map((t) => `ran ${t}`),
+      ...leaked.length >= 3 ? [`answer lists the home folder (${leaked.slice(0, 3).join(", ")}\u2026)`] : []
+    ];
+    steps.push({
+      name: "Built-in tools are blocked",
+      ok: second.ok && problems.length === 0,
+      detail: problems.length ? problems.join("; ") : stream.permissions.length === 0 ? "no built-in tool ran" : `${stream.permissions.filter((p) => !p.allow).length} request(s) refused`
+    });
+    stream.close();
+    return { ok: steps.every((s) => s.ok), steps };
+  } catch (err) {
+    steps.push({ name: "Round trip", ok: false, detail: err instanceof Error ? err.message : String(err) });
+    return { ok: false, steps };
+  } finally {
+    socket?.close();
+    if (sessionId) await post(base, `/session/${sessionId}/close`, {}).catch(() => void 0);
+    await engine.close();
+  }
+}
+var isPageTool = (name) => /^mcp(__|\.)webmcp(__|\.)/.test(name);
+var HARMLESS_TOOLS = /^mcp\.codex\.list_mcp_resource/;
+function homeEntriesIn(text) {
+  let entries = [];
+  try {
+    entries = readdirSync(homedir()).filter((e) => e.length >= 5 && !e.startsWith("."));
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => text.includes(e));
+}
+async function post(base, path, body) {
+  const res = await fetch(`${base}${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(`${path}: ${res.status} ${String(json.error ?? "")}`);
+  return json;
+}
+function connectTool(registrationToken, calls) {
+  const { server } = JSON.parse(Buffer.from(registrationToken, "base64").toString());
+  return new Promise((resolve, reject) => {
+    const reg = new WebSocket(`${server}/webmcp/register`);
+    reg.on("error", reject);
+    reg.on("open", () => reg.send(JSON.stringify({ type: "register", token: registrationToken })));
+    reg.on("message", (data) => {
+      const msg = JSON.parse(data.toString());
+      reg.close();
+      if (msg.type !== "registerSuccess") return reject(new Error(`WebMCP registration failed: ${data.toString()}`));
+      const ch = new WebSocket(`${server}${msg.channel}?token=${encodeURIComponent(msg.token ?? "")}`);
+      ch.on("error", reject);
+      ch.on("open", () => {
+        ch.send(
+          JSON.stringify({
+            type: "registerTool",
+            name: "count_stock",
+            description: "Count the items in stock for a product. Returns { product, inStock }.",
+            inputSchema: {
+              type: "object",
+              properties: { product: { type: "string" } },
+              required: ["product"]
+            }
+          })
+        );
+        resolve(ch);
+      });
+      ch.on("message", (raw) => {
+        const m = JSON.parse(raw.toString());
+        if (m.type === "ping") ch.send(JSON.stringify({ type: "pong" }));
+        if (m.type === "callTool" && m.tool) {
+          calls.push(m.tool);
+          ch.send(JSON.stringify({ type: "toolResponse", id: m.id, result: { product: m.arguments?.product, inStock: 42 } }));
+        }
+      });
+    });
+  });
+}
+function openStream(url) {
+  const controller = new AbortController();
+  const permissions = [];
+  const toolCalls = [];
+  const waiters = [];
+  const settle = (event, result) => {
+    for (const w of waiters.splice(0)) {
+      if (w.event === event || !result.ok) w.resolve(result);
+      else waiters.push(w);
+    }
+  };
+  void (async () => {
+    try {
+      const res = await fetch(url, { signal: controller.signal });
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      let buf = "";
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        buf += decoder.decode(value, { stream: true });
+        let idx;
+        while ((idx = buf.indexOf("\n\n")) >= 0) {
+          const block = buf.slice(0, idx);
+          buf = buf.slice(idx + 2);
+          const event = /^event: (.*)$/m.exec(block)?.[1] ?? "message";
+          const data = JSON.parse(/^data: (.*)$/m.exec(block)?.[1] ?? "null");
+          if (event === "permission") permissions.push(data);
+          if (event === "tool_call") {
+            const call = data;
+            const name = call.toolName ?? call.title;
+            if (name && !toolCalls.includes(name)) toolCalls.push(name);
+          }
+          if (event === "turn_completed") settle(event, { ok: true, text: data.text });
+          if (event === "failed") settle(event, { ok: false, text: `Agent failed: ${String(data)}` });
+        }
+      }
+    } catch {
+    }
+    settle("closed", { ok: false, text: "The engine closed the stream" });
+  })();
+  return {
+    permissions,
+    toolCalls,
+    until(event) {
+      return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve({ ok: false, text: `Timed out waiting for ${event}` }), 18e4);
+        waiters.push({
+          event,
+          resolve: (r) => {
+            clearTimeout(timer);
+            resolve(r);
+          }
+        });
+      });
+    },
+    close: () => controller.abort()
+  };
+}
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.once("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+
+// src/admin.ts
+function createAdminHandler(ctx) {
+  let signingIn = null;
+  return async (req, res, pathname, pairing, sessions) => {
+    const siteAi = (origin) => ctx.grants.get(origin)?.agent ?? ctx.config.agent;
+    const method = req.method ?? "GET";
+    const route = `${method} ${pathname.replace(/^\/admin/, "")}`;
+    if (route === "GET /status") {
+      sendJson(res, 200, {
+        version: VERSION,
+        port: ctx.port(),
+        agent: {
+          id: ctx.config.agent,
+          name: agentName(ctx.config.agent),
+          installed: isAvailable(ctx.config.agent) ? isLlmId(ctx.config.agent) ? "llm" : "agent" : null,
+          // Known to work, so the app need not start it to check (LLMs are checked on use).
+          ready: isAvailable(ctx.config.agent) && (isLlmId(ctx.config.agent) || isKnownReady(ctx.config.agent))
+        },
+        sites: ctx.grants.list().length,
+        pairing: pairing.pending()
+      });
+      return true;
+    }
+    if (route === "GET /agents") {
+      const found = new Set(detectInstalledClis());
+      const [registry, llms] = await Promise.all([listAgents(), detectLlms()]);
+      const agents = registry.map((a) => ({
+        id: a.id,
+        kind: "agent",
+        name: a.name,
+        version: a.version,
+        description: a.description,
+        icon: a.icon,
+        installed: a.installed ?? null,
+        found: found.has(a.id),
+        current: a.id === ctx.config.agent
+      }));
+      const models = llms.flatMap(
+        ({ provider, running, models: list }) => running ? list.map((m) => ({
+          id: llmId(provider.id, m.id),
+          kind: "llm",
+          name: agentName(llmId(provider.id, m.id)),
+          provider: { id: provider.id, kind: provider.kind, name: provider.name },
+          model: m.id,
+          loaded: m.loaded ?? null,
+          local: provider.kind !== "openai" && !m.remote,
+          installed: "llm",
+          found: provider.kind !== "openai" && !m.remote,
+          current: llmId(provider.id, m.id) === ctx.config.agent
+        })) : []
+      );
+      sendJson(res, 200, { agents: [...models, ...agents] });
+      return true;
+    }
+    if (route === "GET /providers") {
+      const llms = await detectLlms();
+      sendJson(res, 200, {
+        providers: llms.map(({ provider, running, models, error }) => ({
+          id: provider.id,
+          kind: provider.kind,
+          name: provider.name,
+          baseUrl: provider.baseUrl,
+          hasApiKey: Boolean(provider.apiKey),
+          running,
+          models,
+          error
+        }))
+      });
+      return true;
+    }
+    if (route === "POST /providers") {
+      const body = await parseBody(req);
+      if (typeof body.name !== "string" || !body.name.trim() || typeof body.baseUrl !== "string" || !body.baseUrl.trim()) {
+        sendJson(res, 400, { error: "A name and an address are required." });
+        return true;
+      }
+      let baseUrl;
+      try {
+        baseUrl = normalizeBaseUrl(body.baseUrl);
+      } catch {
+        sendJson(res, 400, { error: "That address doesn't look right. Try something like https://api.example.com/v1." });
+        return true;
+      }
+      const candidate = {
+        id: typeof body.id === "string" && body.id ? body.id : void 0,
+        kind: "openai",
+        name: body.name,
+        baseUrl,
+        apiKey: typeof body.apiKey === "string" ? body.apiKey : void 0
+      };
+      let models;
+      try {
+        models = await listModels({ ...candidate, id: candidate.id ?? "test", name: candidate.name.trim() }, 8e3);
+      } catch (error) {
+        sendJson(res, 422, { error: error instanceof Error ? error.message : String(error) });
+        return true;
+      }
+      const provider = saveProvider(candidate);
+      sendJson(res, 200, { id: provider.id, name: provider.name, baseUrl: provider.baseUrl, models });
+      return true;
+    }
+    if (route === "DELETE /providers") {
+      const id = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("id");
+      sendJson(res, 200, { removed: id ? removeProvider(id) : false });
+      return true;
+    }
+    if (route === "GET /ais") {
+      const siteAgents = ctx.grants.list().flatMap((g) => g.agent ? [g.agent] : []);
+      const ais = yourAis(ctx.config.agent, siteAgents).map((id) => {
+        const llm = parseLlmId(id);
+        const provider = llm ? getProvider(llm.providerId) : void 0;
+        return {
+          id,
+          kind: llm ? "llm" : "agent",
+          name: agentName(id),
+          default: id === ctx.config.agent,
+          ready: Boolean(llm) || isKnownReady(id),
+          ...llm && provider ? { provider: { id: provider.id, kind: provider.kind, name: provider.name }, model: llm.model, local: provider.kind !== "openai" } : {}
+        };
+      });
+      sendJson(res, 200, { ais });
+      return true;
+    }
+    if (route === "POST /ais" || route === "POST /agent") {
+      const body = await parseBody(req);
+      if (typeof body.id !== "string" || !body.id) {
+        sendJson(res, 400, { error: "id is required" });
+        return true;
+      }
+      if (isLlmId(body.id) && !isAvailable(body.id)) {
+        sendJson(res, 404, { error: "This AI is not available. Choose it again." });
+        return true;
+      }
+      const agent = isLlmId(body.id) ? { id: body.id, name: agentName(body.id), version: "" } : await ensureAgent(body.id, { onProgress: (message) => ctx.emit({ event: "progress", stage: "install", message }) });
+      addAi(body.id);
+      if (route === "POST /agent" || body.makeDefault === true) {
+        if (ctx.config.agent !== body.id && isAvailable(ctx.config.agent)) addAi(ctx.config.agent);
+        for (const grant of ctx.grants.list()) if (grant.agent === body.id) ctx.grants.setAgent(grant.origin, void 0);
+        ctx.config.agent = body.id;
+        sessions?.closeWhere((origin) => !ctx.grants.get(origin)?.agent);
+        saveConfig({ ...loadConfig(), agent: body.id });
+        ctx.emit({ event: "agent", id: agent.id, name: agent.name });
+      }
+      sendJson(res, 200, { id: agent.id, name: agent.name, version: agent.version });
+      return true;
+    }
+    if (route === "DELETE /ais") {
+      const id = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("id");
+      if (!id) {
+        sendJson(res, 400, { error: "id is required" });
+        return true;
+      }
+      if (id === ctx.config.agent) {
+        sendJson(res, 409, { error: "Make another AI the default first." });
+        return true;
+      }
+      removeAi(id);
+      for (const grant of ctx.grants.list()) if (grant.agent === id) ctx.grants.setAgent(grant.origin, void 0);
+      sendJson(res, 200, { removed: id });
+      return true;
+    }
+    if (route === "GET /signin") {
+      const agent = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("agent") ?? ctx.config.agent;
+      if (!isAvailable(agent)) {
+        sendJson(res, 200, { ok: false, detail: "no AI chosen yet", methods: [] });
+        return true;
+      }
+      sendJson(res, 200, await checkSignIn(agent));
+      return true;
+    }
+    if (route === "POST /signin") {
+      const body = await parseBody(req);
+      signingIn?.abort();
+      const controller = new AbortController();
+      signingIn = controller;
+      const result = await signIn(typeof body.agent === "string" && body.agent ? body.agent : ctx.config.agent, {
+        signal: controller.signal,
+        methodId: typeof body.methodId === "string" ? body.methodId : void 0,
+        // The app has no terminal: only agent methods (the agent runs its own flow).
+        terminal: false,
+        // Offered in the app too, in case the browser did not come up.
+        onUrl: (url) => ctx.emit({ event: "signin_url", url }),
+        onProgress: (message) => ctx.emit({ event: "progress", stage: "signin", message })
+      });
+      if (signingIn === controller) signingIn = null;
+      sendJson(res, 200, result);
+      return true;
+    }
+    if (route === "POST /signin/cancel") {
+      signingIn?.abort();
+      signingIn = null;
+      sendJson(res, 200, { ok: true });
+      return true;
+    }
+    if (route === "GET /models") {
+      const agent = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("agent") ?? ctx.config.agent;
+      sendJson(res, 200, { agent, models: isAvailable(agent) ? await agentModels(agent) : null });
+      return true;
+    }
+    if (route === "POST /agent/model") {
+      const body = await parseBody(req);
+      if (typeof body.id !== "string" || !body.id || body.model !== null && typeof body.model !== "string") {
+        sendJson(res, 400, { error: "id and model are required" });
+        return true;
+      }
+      const config = loadConfig();
+      const models = { ...config.models };
+      if (body.model) models[body.id] = body.model;
+      else delete models[body.id];
+      saveConfig({ ...config, models });
+      sessions?.closeWhere((origin) => siteAi(origin) === body.id);
+      ctx.emit({ event: "model", id: body.id, model: body.model });
+      sendJson(res, 200, { ok: true });
+      return true;
+    }
+    if (route === "POST /agent/reset") {
+      const body = await parseBody(req);
+      if (typeof body.id !== "string" || !body.id) {
+        sendJson(res, 400, { error: "id is required" });
+        return true;
+      }
+      signingIn?.abort();
+      signingIn = null;
+      resetAgent(body.id);
+      sendJson(res, 200, { ok: true });
+      return true;
+    }
+    if (route === "GET /sites") {
+      sendJson(res, 200, { sites: ctx.grants.list().map(({ tokenHash: _hash, ...site }) => site) });
+      return true;
+    }
+    if (route === "POST /sites/model") {
+      const body = await parseBody(req);
+      const grant = typeof body.origin === "string" ? ctx.grants.get(body.origin) : void 0;
+      if (!grant || typeof body.origin !== "string") {
+        sendJson(res, 404, { error: "This site is not connected" });
+        return true;
+      }
+      const agent = grant.agent ?? ctx.config.agent;
+      ctx.grants.setModel(body.origin, typeof body.model === "string" && body.model ? { agent, id: body.model } : void 0);
+      sendJson(res, 200, { origin: body.origin, agent, model: typeof body.model === "string" ? body.model : null });
+      return true;
+    }
+    if (route === "POST /sites/agent") {
+      const body = await parseBody(req);
+      if (typeof body.origin !== "string" || !ctx.grants.get(body.origin)) {
+        sendJson(res, 404, { error: "This site is not connected" });
+        return true;
+      }
+      const agent = typeof body.agent === "string" && body.agent && body.agent !== ctx.config.agent ? body.agent : void 0;
+      if (agent && !isLlmId(agent)) await ensureAgent(agent, { onProgress: (message) => ctx.emit({ event: "progress", stage: "install", message }) });
+      ctx.grants.setAgent(body.origin, agent);
+      if (agent) addAi(agent);
+      const signIn2 = agent ? await checkSignIn(agent) : { ok: true, detail: "default AI", methods: [] };
+      sendJson(res, 200, { origin: body.origin, agent: agent ?? null, signIn: signIn2 });
+      return true;
+    }
+    if (route === "DELETE /sites") {
+      const origin = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("origin");
+      if (!origin) {
+        sendJson(res, 400, { error: "origin is required" });
+        return true;
+      }
+      sendJson(res, 200, { removed: ctx.grants.revoke(origin) });
+      return true;
+    }
+    if (route === "POST /fit") {
+      const body = await parseBody(req);
+      const needs = parseNeeds(body.needs) ?? (typeof body.origin === "string" ? ctx.grants.get(body.origin)?.needs : void 0);
+      sendJson(res, 200, await fitAis(ctx, needs));
+      return true;
+    }
+    if (route === "GET /pairing") {
+      sendJson(res, 200, { requests: pairing.pending() });
+      return true;
+    }
+    if (route === "POST /pairing/link") {
+      const result = pairing.link(await parseBody(req));
+      sendJson(res, "error" in result ? 400 : 201, result);
+      return true;
+    }
+    const decide = /^POST \/pairing\/([^/]+)$/.exec(route);
+    if (decide) {
+      const body = await parseBody(req);
+      const ok = pairing.decideById(decide[1], body.allow === true, (origin) => {
+        if (body.agent !== void 0) {
+          const agent = typeof body.agent === "string" && body.agent && body.agent !== ctx.config.agent ? body.agent : void 0;
+          ctx.grants.setAgent(origin, agent);
+        }
+        if (typeof body.model === "string" && body.model) {
+          ctx.grants.setModel(origin, { agent: ctx.grants.get(origin)?.agent ?? ctx.config.agent, id: body.model });
+        }
+      });
+      sendJson(res, ok ? 200 : 410, ok ? { ok } : { error: "This request has expired." });
+      return true;
+    }
+    if (route === "GET /embeddings") {
+      const [models, current] = await Promise.all([listLocalEmbedders(), localEmbeddings(() => ctx.config.embed).find()]);
+      const provider = (p) => ({ id: p.id, kind: p.kind, name: p.name });
+      sendJson(res, 200, {
+        choice: ctx.config.embed ?? "auto",
+        current: current ? { provider: provider(current.provider), model: current.model } : null,
+        models: models.map((m) => ({ provider: provider(m.provider), model: m.model.id, loaded: m.model.loaded ?? null }))
+      });
+      return true;
+    }
+    if (route === "POST /embeddings") {
+      const { choice } = await parseBody(req);
+      const { provider, model } = choice ?? {};
+      let embed;
+      if (choice === "off") embed = "off";
+      else if (typeof provider === "string" && provider && typeof model === "string" && model) embed = { provider, model };
+      else if (choice !== "auto") {
+        sendJson(res, 400, { error: 'choice must be "auto", "off" or { provider, model }' });
+        return true;
+      }
+      if (embed) ctx.config.embed = embed;
+      else delete ctx.config.embed;
+      const { embed: _previous, ...saved } = loadConfig();
+      saveConfig(embed ? { ...saved, embed } : saved);
+      ctx.emit({ event: "embed", choice: embed ?? "auto" });
+      sendJson(res, 200, { choice: embed ?? "auto" });
+      return true;
+    }
+    if (route === "POST /test") {
+      const body = await parseBody(req).catch(() => ({}));
+      const agent = typeof body.agent === "string" && body.agent ? body.agent : ctx.config.agent;
+      let checkStep = 0;
+      const result = await runSelfTest({
+        agentName: agentName(agent),
+        resolveAgent: () => resolveAgentCommand(agent),
+        logger: ctx.logger,
+        // `message` is for the CLI; the app words each stage itself (no jargon for visitors).
+        onStep: (message) => ctx.emit({ event: "progress", stage: "check", step: ++checkStep, message })
+      });
+      sendJson(res, 200, result);
+      return true;
+    }
+    return false;
+  };
+}
+async function candidates(ctx) {
+  const siteAgents = ctx.grants.list().flatMap((g) => g.agent ? [g.agent] : []);
+  const found = [];
+  for (const id of yourAis(ctx.config.agent, siteAgents)) {
+    const isDefault = id === ctx.config.agent;
+    const llm = parseLlmId(id);
+    if (!llm) {
+      const models2 = seenAgentModels(id);
+      if (!models2) found.push({ agent: id, name: agentName(id), traits: traitsOf({ kind: "agent" }, { name: agentName(id) }), isDefault });
+      for (const m of models2?.options ?? []) {
+        found.push({ agent: id, model: m.id, name: m.name, traits: traitsOf({ kind: "agent" }, m), isDefault, isCurrent: m.id === models2?.current });
+      }
+      continue;
+    }
+    const provider = getProvider(llm.providerId);
+    if (!provider) continue;
+    const models = await listModels(provider).catch(() => []);
+    const current = llm.model ? void 0 : loadConfig().models?.[id];
+    for (const m of models.filter((m2) => !llm.model || m2.id === llm.model)) {
+      const kind = { kind: "llm", local: provider.kind !== "openai" && !m.remote, plan: Boolean(m.remote) };
+      const traits = traitsOf(kind, { name: m.id.split("/").pop() ?? m.id, meta: m.meta, loaded: m.loaded });
+      found.push({ agent: id, ...llm.model ? {} : { model: m.id }, name: m.id.split("/").pop() ?? m.id, traits, isDefault, isCurrent: m.id === current });
+    }
+  }
+  return found;
+}
+async function fitAis(ctx, needs) {
+  const all = await candidates(ctx);
+  const best = recommend(needs, all);
+  const order = ["fits", "more", "short"];
+  const ais = [...new Set(all.map((c) => c.agent))].map((id) => {
+    const own = all.filter((c) => c.agent === id);
+    const models = own.map((c) => ({ id: c.model, name: c.name, verdict: fitOf(needs, c.traits), cost: c.traits.cost }));
+    const verdict = order.find((v) => models.some((m) => m.verdict === v)) ?? "fits";
+    return { id, verdict, cost: own[0]?.traits.cost ?? "plan", models: models.filter((m) => m.id !== void 0) };
+  });
+  return {
+    needs: needs ?? null,
+    recommended: best ? {
+      agent: best.agent,
+      model: best.model ?? null,
+      modelName: best.model ? best.name : null,
+      isDefault: best.isDefault,
+      cost: best.traits.cost,
+      reason: reasonFor(best.traits)
+    } : null,
+    ais
+  };
+}
+
+// src/mcp-stdio.ts
+import { createInterface } from "readline";
+async function runMcpStdio(url) {
+  const token = process.env.LEURIA_MCP_TOKEN;
+  if (!url || !token) throw new Error("Usage: LEURIA_MCP_TOKEN=\u2026 leuria mcp-stdio <url>");
+  const lines = createInterface({ input: process.stdin });
+  for await (const line of lines) {
+    if (!line.trim()) continue;
+    void relay(url, token, line);
+  }
+}
+async function relay(url, token, line) {
+  let id = null;
+  try {
+    id = JSON.parse(line).id ?? null;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${token}` },
+      body: line
+    });
+    const text = (await res.text()).trim();
+    if (text) process.stdout.write(`${text}
+`);
+  } catch (error) {
+    if (id === null) return;
+    const message = error instanceof Error ? error.message : String(error);
+    process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id, error: { code: -32603, message } })}
+`);
+  }
+}
+
+// src/doctor.ts
+var MIN_NODE_MAJOR = 22;
+async function runChecks(config, options = {}) {
+  const checks = [];
+  if (process.versions.bun) {
+    checks.push({ name: "Runtime", ok: true, detail: `Bun ${process.versions.bun}` });
+  } else {
+    const major = Number(process.versions.node.split(".")[0]);
+    checks.push({
+      name: "Runtime",
+      ok: major >= MIN_NODE_MAJOR,
+      detail: `Node.js v${process.versions.node}`,
+      fix: major >= MIN_NODE_MAJOR ? void 0 : `Install Node.js ${MIN_NODE_MAJOR} or later from https://nodejs.org`
+    });
+  }
+  if (isLlmId(config.agent)) {
+    const status = await checkSignIn(config.agent);
+    checks.push({ name: "AI", ok: status.ok, detail: status.ok ? agentName(config.agent) : status.detail });
+    return checks;
+  }
+  let installed = installedAgent(config.agent);
+  if (options.install || options.update) {
+    try {
+      installed = await ensureAgent(config.agent, { update: options.update, onProgress: options.onProgress });
+    } catch (err) {
+      checks.push({
+        name: "Agent",
+        ok: false,
+        detail: err instanceof Error ? err.message.split("\n")[0] : String(err),
+        fix: "Check your network, then run `npx @leuria/cli setup` again."
+      });
+      return checks;
+    }
+  }
+  if (!installed) {
+    checks.push({ name: "Agent", ok: false, detail: `${config.agent} not installed`, fix: "Run `npx @leuria/cli setup`." });
+    return checks;
+  }
+  checks.push({ name: "Agent", ok: true, detail: `${installed.name} ${installed.version} (ACP registry: ${installed.id})` });
+  const signIn2 = await checkSignIn(config.agent, options.onProgress);
+  checks.push({
+    name: "Sign-in",
+    ok: signIn2.ok,
+    detail: signIn2.detail,
+    fix: signIn2.ok ? void 0 : signIn2.methods.length ? `Run \`npx @leuria/cli login\` (${signIn2.methods.map((m) => m.name).join(" or ")}).` : `Sign in with ${installed.name}'s own tool, then run \`npx @leuria/cli doctor\` again.`
+  });
+  return checks;
+}
+function formatChecks(checks) {
+  return checks.map((c) => {
+    const line = `  ${c.ok ? "\u2713" : "\u2717"} ${c.name.padEnd(12)} ${c.detail}`;
+    return c.ok || !c.fix ? line : `${line}
+      \u2192 ${c.fix}`;
+  }).join("\n");
+}
+
+// src/cli.ts
+var HELP = `leuria ${VERSION}: let websites you approve use the AI on this computer
+
+Usage:
+  leuria [start]               Run the engine (sets itself up on first run)
+  leuria setup [--update]      Install your agent from the ACP registry and check your sign-in
+  leuria login [--method <id>] Sign in to your agent (ACP authenticate)
+  leuria doctor                Check that everything is ready
+  leuria test                  Run a real round trip with your agent
+  leuria sites                 List connected sites
+  leuria sites revoke <origin> Disconnect a site
+  leuria sites use <origin> <agent|default>  Use another AI for one site
+  leuria agents                List AIs: models in LM Studio, Ollama and your APIs, and ACP registry agents
+  leuria providers             List LLM providers (LM Studio, Ollama, your APIs)
+  leuria providers add <name> <url> [--key <api key>]   Add an OpenAI-compatible API
+  leuria providers remove <id>
+
+Options:
+  -p, --port <n>       Port (default from ~/.leuria/config.json, else 19570; env LEURIA_PORT)
+  -a, --agent <id>     AI to use and remember: an ACP registry id (codex-acp, claude-acp\u2026)
+                       or a model, llm:<provider>/<model> (e.g. llm:ollama/qwen3:8b)
+  -v, --verbose        Log every request and session event
+  -h, --help           Show this help
+  --version            Show the version
+
+State lives in ${leuriaHome()} (override with LEURIA_HOME).
+`;
+async function main() {
+  const { values, positionals } = parseArgs({
+    allowPositionals: true,
+    options: {
+      port: { type: "string", short: "p" },
+      agent: { type: "string", short: "a" },
+      verbose: { type: "boolean", short: "v" },
+      method: { type: "string" },
+      app: { type: "boolean" },
+      "dev-pairing": { type: "boolean" },
+      update: { type: "boolean" },
+      key: { type: "string" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean" }
+    }
+  });
+  if (values.help) return out(HELP);
+  if (values.version) return out(`${VERSION}
+`);
+  const config = loadConfig();
+  if (values.agent && values.agent !== config.agent) {
+    config.agent = values.agent;
+    saveConfig(config);
+  }
+  const envPort = process.env.LEURIA_PORT;
+  const port = Number(values.port ?? envPort ?? config.port);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error(`Invalid port: ${values.port ?? envPort}`);
+  }
+  config.port = port;
+  const [command = "start", ...rest] = positionals;
+  switch (command) {
+    case "start":
+      return values.app ? startForApp(config, values.verbose ?? false, values["dev-pairing"] ?? false) : start(config, values.verbose ?? false);
+    case "setup":
+      await setup(config, values.update ?? false);
+      return;
+    case "doctor":
+      return doctor(config);
+    case "login":
+      return login(config, values.method);
+    case "mcp-stdio":
+      return runMcpStdio(rest[0] ?? "");
+    case "test":
+      return selfTest(config, values.verbose ?? false);
+    case "sites":
+      return sites(rest);
+    case "providers":
+      return providers(rest, values.key);
+    case "agents":
+      const found = new Set(detectInstalledClis());
+      for (const { provider, running, models, error } of await detectLlms()) {
+        if (!running) {
+          out(`${provider.name.padEnd(24)} ${error ?? "not reachable"}
+`);
+          continue;
+        }
+        for (const model of models) {
+          const id = llmId(provider.id, model.id);
+          out(`${id.padEnd(48)} ${id === config.agent ? "\u2190 current" : model.loaded ? "loaded" : ""}
+`);
+        }
+      }
+      for (const agent of await listAgents()) {
+        const mark = [
+          agent.id === config.agent ? "\u2190 current" : "",
+          agent.installed ? `installed in Leuria (${agent.installed})` : "",
+          found.has(agent.id) ? "found on this computer" : ""
+        ].filter(Boolean).join(", ");
+        out(`${agent.id.padEnd(24)} ${agent.name.padEnd(24)} ${agent.version.padEnd(12)} ${mark}
+`);
+      }
+      return;
+    default:
+      process.stderr.write(`Unknown command: ${command}
+
+${HELP}`);
+      process.exitCode = 1;
+  }
+}
+async function setup(config, update = false) {
+  out(`Leuria ${VERSION} setup
+`);
+  const checks = await runChecks(config, { install: true, update, onProgress: (m) => out(`  ${m}
+`) });
+  out(`${formatChecks(checks)}
+`);
+  const ok = checks.every((c) => c.ok);
+  out(ok ? "\nReady. Run `leuria` to start.\n" : "\nFix the items marked \u2717, then run `leuria setup` again.\n");
+  if (!ok) process.exitCode = 1;
+  return ok;
+}
+async function providers(args, key) {
+  const [sub, name, url] = args;
+  if (sub === "add") {
+    if (!name || !url) throw new Error("Usage: leuria providers add <name> <url> [--key <api key>]");
+    const provider = saveProvider({ name, baseUrl: url, apiKey: key });
+    const models = await listModels(provider).catch((error) => {
+      out(`Saved, but: ${error instanceof Error ? error.message : String(error)}
+`);
+      return [];
+    });
+    out(`Added ${provider.name} (${provider.baseUrl}). Models:
+`);
+    for (const model of models) out(`  ${llmId(provider.id, model.id)}
+`);
+    return;
+  }
+  if (sub === "remove") {
+    if (!name) throw new Error("Usage: leuria providers remove <id>");
+    out(removeProvider(name) ? `Removed ${name}
+` : `${name} is not one of your providers
+`);
+    return;
+  }
+  if (sub) throw new Error(`Unknown providers command: ${sub}`);
+  for (const { provider, running, models, error } of await detectLlms()) {
+    out(`${provider.id.padEnd(20)} ${provider.name.padEnd(20)} ${provider.baseUrl.padEnd(36)} ${running ? `${models.length} model(s)` : error ?? "not reachable"}
+`);
+  }
+}
+async function login(config, methodId) {
+  const result = await signIn(config.agent, {
+    methodId,
+    // Terminal sign-in methods need an interactive terminal.
+    terminal: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    onProgress: (m) => out(`${m}
+`)
+  });
+  if (result.ok) {
+    out(`Signed in (${result.detail}).
+`);
+    return;
+  }
+  process.stderr.write(`Sign-in failed: ${result.detail}
+`);
+  if (result.methods.length > 1) {
+    process.stderr.write(`Methods: ${result.methods.map((m) => `${m.id} (${m.name})`).join(", ")}. Choose one with --method.
+`);
+  }
+  process.exitCode = 1;
+}
+async function doctor(config) {
+  const checks = await runChecks(config);
+  const running = await fetch(`http://127.0.0.1:${config.port}/health`, { signal: AbortSignal.timeout(1e3) }).then((r) => r.json()).catch(() => null);
+  checks.push({
+    name: "Engine",
+    ok: true,
+    detail: running?.leuria ? `running on port ${config.port} (${running.leuria})` : `not running (port ${config.port})`
+  });
+  out(`${formatChecks(checks)}
+`);
+  if (!checks.every((c) => c.ok)) process.exitCode = 1;
+}
+async function selfTest(config, verbose) {
+  if (!await setup(config)) return;
+  out("\n");
+  const result = await runSelfTest({
+    agentName: agentName(config.agent),
+    resolveAgent: () => resolveAgentCommand(config.agent),
+    logger: createLogger(verbose),
+    onStep: (m) => out(`  ${m}
+`)
+  });
+  for (const step of result.steps) out(`  ${step.ok ? "\u2713" : "\u2717"} ${step.name}: ${step.detail}
+`);
+  out(result.ok ? "\nLeuria works end to end.\n" : "\nThe round trip failed. Run `leuria test -v` for details.\n");
+  if (!result.ok) process.exitCode = 1;
+}
+function sites(args) {
+  const grants = new GrantStore();
+  convertServiceAis(grants);
+  const [sub, origin] = args;
+  if (sub === "use") {
+    const agent = args[2];
+    if (!origin || !agent) throw new Error("Usage: leuria sites use <origin> <agent|default>");
+    const ok = grants.setAgent(origin, agent === "default" ? void 0 : agent);
+    out(ok ? `${origin} now uses ${agent === "default" ? "the default AI" : agent}
+` : `${origin} is not connected
+`);
+    return;
+  }
+  if (sub === "revoke") {
+    if (!origin) throw new Error("Usage: leuria sites revoke <origin>");
+    out(grants.revoke(origin) ? `Disconnected ${origin}
+` : `${origin} was not connected
+`);
+    return;
+  }
+  if (sub) throw new Error(`Unknown sites command: ${sub}`);
+  const list = grants.list();
+  if (list.length === 0) return out("No connected sites.\n");
+  for (const g of list) {
+    const used = g.lastUsedAt ? `last used ${g.lastUsedAt.slice(0, 16).replace("T", " ")}` : "never used";
+    out(`${g.origin.padEnd(40)} ${(g.app ?? "").padEnd(24)} ${(g.agent ?? "default AI").padEnd(16)} ${used}
+`);
+  }
+}
+function openInBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+async function start(config, verbose) {
+  const shownAt = /* @__PURE__ */ new Map();
+  const logger = createLogger(verbose);
+  const checks = await runChecks(config, {
+    install: true,
+    onProgress: (m) => process.stderr.write(`${m}
+`)
+  });
+  const failed = checks.filter((c) => !c.ok);
+  if (failed.length > 0) {
+    process.stderr.write(`Leuria is not ready:
+${formatChecks(failed)}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  saveConfig(config);
+  const grants = new GrantStore();
+  convertServiceAis(grants);
+  config.agent = loadConfig().agent;
+  const stdioMcpCommand = stdioMcpSelf();
+  let engine;
+  try {
+    engine = await startEngine({
+      port: config.port,
+      grants,
+      logger,
+      agentName: agentName(config.agent),
+      resolveAgent: (origin) => resolveSiteAgent(grants.get(origin), config.agent),
+      onAgentState: rememberAgentState,
+      stdioMcpCommand,
+      // No app to ask in: the engine's own approval page, in the browser.
+      onPairingRequest: ({ requestId, origin, app, approveUrl }) => {
+        const now = Date.now();
+        if (now - (shownAt.get(requestId) ?? 0) < 15e3) return;
+        shownAt.set(requestId, now);
+        openInBrowser(approveUrl);
+        process.stderr.write(
+          `
+${app ? `${app} (${origin})` : origin} asks to use your AI.
+  If no window opened, approve it here: ${approveUrl}
+
+`
+        );
+      }
+    });
+  } catch (err) {
+    if (err.code === "EADDRINUSE") {
+      process.stderr.write(
+        `Port ${config.port} is in use: Leuria may already be running (check with \`leuria doctor\`), or use --port.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    throw err;
+  }
+  const connected = grants.list().length;
+  process.stderr.write(
+    `Leuria ${VERSION} is running on http://127.0.0.1:${engine.port}
+  agent:  ${agentName(config.agent)}
+  sites:  ${connected === 0 ? "none connected yet" : `${connected} connected (leuria sites)`}
+  state:  ${homePath()}
+Keep this window open while you use Leuria sites. Press Ctrl+C to stop.
+`
+  );
+  const shutdown = async () => {
+    await engine.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+function stdioMcpSelf() {
+  const script = process.argv[1] ?? "";
+  const compiled = !script || script.startsWith("/$bunfs") || /^[A-Z]:[\\/]~BUN/i.test(script);
+  return compiled ? { command: process.execPath, args: ["mcp-stdio"] } : { command: process.execPath, args: [...process.execArgv, script, "mcp-stdio"] };
+}
+async function startForApp(config, verbose, devPairing) {
+  const token = process.env.LEURIA_ADMIN_TOKEN;
+  if (!token || token.length < 32) throw new Error("LEURIA_ADMIN_TOKEN (32+ characters) is required with --app");
+  const emit = (event) => process.stdout.write(`${JSON.stringify(event)}
+`);
+  const logger = createLogger(verbose);
+  const grants = new GrantStore();
+  convertServiceAis(grants);
+  config.agent = loadConfig().agent;
+  let port = config.port;
+  const engine = await startEngine({
+    port: config.port,
+    grants,
+    logger,
+    agentName: () => agentName(config.agent),
+    resolveAgent: (origin) => resolveSiteAgent(grants.get(origin), config.agent),
+    siteAgentName: (origin) => {
+      const grant = grants.get(origin);
+      const id = grant?.agent ?? config.agent;
+      return aiLabel(id, grant?.model?.agent === id ? grant.model.id : loadConfig().models?.[id]);
+    },
+    // A real session is the check: remember it, and tell the app when an AI is signed out.
+    onAgentState: (id, state) => {
+      rememberAgentState(id, state);
+      emit({ event: "agent_state", id, ok: state.ok });
+    },
+    stdioMcpCommand: stdioMcpSelf(),
+    silent: !devPairing,
+    onPairingRequest: (request) => emit({ event: "pairing", ...request }),
+    onPairingDecided: (decision) => emit({ event: "pairing_decided", ...decision }),
+    admin: {
+      token,
+      handle: createAdminHandler({ config, grants, logger, port: () => port, emit })
+    }
+  }).catch((err) => {
+    emit({ event: "error", code: err.code ?? "start_failed", message: err.message });
+    throw err;
+  });
+  port = engine.port;
+  emit({ event: "ready", port, version: VERSION, agent: config.agent });
+  const shutdown = async () => {
+    await engine.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  process.stdin.on("end", shutdown);
+  process.stdin.resume();
+}
+function out(text) {
+  process.stdout.write(text);
+}
+main().catch((err) => {
+  process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
+});