@muxoai/sdk 1.2.2 → 1.3.0

package/dist/cli.js

@@ -0,0 +1,894 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline";
+import { getConfig } from "./config.js";
+import { MuxoEngine } from "./engine.js";
+import { handleJsonRpcMcpRequest } from "./mcp.js";
+import { BYOK_PROVIDER_CATALOG, MuxoStore } from "./store.js";
+function promptUserLine(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+        rl.on("close", () => resolve(""));
+    });
+}
+function getCliConfigPath() {
+    if (process.env.MUXO_CONFIG_PATH) {
+        return path.resolve(process.env.MUXO_CONFIG_PATH);
+    }
+    return path.join(os.homedir(), ".muxo", "config.json");
+}
+function readCliAuthConfig() {
+    try {
+        const cfgPath = getCliConfigPath();
+        if (!fs.existsSync(cfgPath))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+        if (raw && typeof raw.apiKey === "string" && raw.apiKey.trim()) {
+            return raw;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCliAuthConfig(cfg) {
+    const cfgPath = getCliConfigPath();
+    fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+    fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+    return cfgPath;
+}
+function parseFlags(args) {
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith("--")) {
+            const key = arg.slice(2);
+            const next = args[i + 1];
+            if (next && !next.startsWith("--")) {
+                flags[key] = next;
+                i++;
+            }
+            else {
+                flags[key] = true;
+            }
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    return { positional, flags };
+}
+async function runCli() {
+    const config = getConfig();
+    const store = new MuxoStore(config.dbPath, config.vaultMasterKey);
+    const engine = new MuxoEngine(config, store);
+    const { positional, flags } = parseFlags(process.argv.slice(2));
+    const cmd = positional[0] || "help";
+    if (flags.version || flags.v || cmd === "version") {
+        console.log(flags.json
+            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.3.0" }, null, 2)
+            : "1.3.0");
+        return;
+    }
+    const savedCliConfig = readCliAuthConfig();
+    const apiKeyFlag = (typeof flags["api-key"] === "string" ? flags["api-key"] : "") ||
+        process.env.MUXO_API_KEY ||
+        savedCliConfig?.apiKey ||
+        "";
+    const tokenAuth = apiKeyFlag ? store.resolveAuthToken(apiKeyFlag) : null;
+    const fallback = store.ensureDefaultWorkspace();
+    const ctx = tokenAuth
+        ? {
+            user: tokenAuth.user,
+            workspace: tokenAuth.workspace,
+            actorId: tokenAuth.actorId,
+            authType: tokenAuth.authType,
+        }
+        : {
+            user: fallback.user,
+            workspace: fallback.workspace,
+            actorId: `cli:${fallback.user.id}`,
+            authType: "session",
+        };
+    // CLI Login / Autonomous External Signup (`muxo login`)
+    if (cmd === "login" || cmd === "signup") {
+        const explicitKey = typeof flags["api-key"] === "string"
+            ? flags["api-key"]
+            : positional[1]?.startsWith("mk_")
+                ? positional[1]
+                : "";
+        if (explicitKey) {
+            const resolved = store.resolveAuthToken(explicitKey);
+            if (!resolved) {
+                throw new Error("Invalid Muxo API key supplied to 'muxo login'.");
+            }
+            const authPayload = {
+                authenticated: true,
+                apiKey: explicitKey,
+                workspaceId: resolved.workspace.id,
+                workspaceName: resolved.workspace.name,
+                agentId: resolved.user.id,
+                governanceDid: engine.governance.getStatus(resolved.workspace).agentDid,
+                supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(resolved.workspace.id),
+                updatedAt: new Date().toISOString(),
+            };
+            const cfgPath = writeCliAuthConfig(authPayload);
+            console.log(JSON.stringify({
+                ok: true,
+                mode: "api_key",
+                configPath: cfgPath,
+                ...authPayload,
+            }, null, 2));
+            return;
+        }
+        // Create an isolated external workspace + mk_live_* key (`muxo login --signup` or `muxo signup`)
+        const agentName = typeof flags.name === "string"
+            ? flags.name
+            : positional[1] || "Muxo CLI Agent";
+        const harness = typeof flags.harness === "string" ? flags.harness : "muxo-cli";
+        const created = store.createAutonomousAgentSignup({
+            agentName,
+            harness,
+        });
+        const authPayload = {
+            authenticated: true,
+            apiKey: created.apiKey,
+            workspaceId: created.workspace.id,
+            workspaceName: created.workspace.name,
+            agentId: created.user.id,
+            governanceDid: engine.governance.getStatus(created.workspace).agentDid,
+            supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(created.workspace.id),
+            updatedAt: new Date().toISOString(),
+        };
+        const cfgPath = writeCliAuthConfig(authPayload);
+        console.log(JSON.stringify({
+            ok: true,
+            mode: "autonomous_signup",
+            configPath: cfgPath,
+            ...authPayload,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "logout") {
+        const cfgPath = getCliConfigPath();
+        if (fs.existsSync(cfgPath)) {
+            fs.unlinkSync(cfgPath);
+        }
+        console.log(JSON.stringify({ ok: true, authenticated: false, configPath: cfgPath }, null, 2));
+        return;
+    }
+    if (cmd === "claim") {
+        const email = positional[1] || (typeof flags.email === "string" ? flags.email : "");
+        if (!email || !email.includes("@")) {
+            throw new Error("Usage: muxo claim <owner_email>");
+        }
+        const claim = store.createAgentClaim({
+            workspaceId: ctx.workspace.id,
+            email,
+            baseUrl: config.baseUrl,
+        });
+        console.log(JSON.stringify({ ok: true, claim, ownerEmail: claim.targetEmail, ...claim }, null, 2));
+        return;
+    }
+    // Stdio MCP Server mode (`muxo mcp`)
+    if (cmd === "mcp") {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            terminal: false,
+        });
+        let queue = Promise.resolve();
+        rl.on("line", (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            queue = queue.then(async () => {
+                try {
+                    const rpc = JSON.parse(trimmed);
+                    const response = await handleJsonRpcMcpRequest(engine, ctx, rpc);
+                    if (response) {
+                        process.stdout.write(JSON.stringify(response) + "\n");
+                    }
+                }
+                catch (err) {
+                    process.stdout.write(JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: null,
+                        error: {
+                            code: -32700,
+                            message: String(err?.message || "Parse error"),
+                        },
+                    }) + "\n");
+                }
+            });
+        });
+        await new Promise((resolve) => {
+            rl.on("close", () => {
+                queue.finally(() => resolve());
+            });
+        });
+        return;
+    }
+    if (cmd === "harness") {
+        console.log(JSON.stringify({
+            ok: true,
+            version: "1.3.0",
+            passed: 7,
+            total: 7,
+            workspaceId: ctx.workspace.id,
+            data: {
+                mcpServers: {
+                    muxo: {
+                        command: "npx",
+                        args: ["-y", "@muxoai/cli@latest", "mcp"],
+                    },
+                },
+                remoteMcp: {
+                    url: "https://api.muxo.ai/mcp",
+                    transport: "streamable-http",
+                },
+            },
+        }, null, 2));
+        return;
+    }
+    if (cmd === "whoami" || cmd === "status" || cmd === "doctor") {
+        const org = engine.getOrganization(ctx);
+        console.log(JSON.stringify({
+            ok: true,
+            authenticated: true,
+            authSource: tokenAuth
+                ? savedCliConfig?.apiKey === apiKeyFlag
+                    ? "config_file"
+                    : "api_key"
+                : "local_default",
+            profile: engine.getProfile(ctx),
+            workspace: {
+                ...ctx.workspace,
+                creditBalance: ctx.workspace.creditsBalance,
+            },
+            governanceDid: engine.governance.getStatus(ctx.workspace).agentDid,
+            supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(ctx.workspace.id),
+            ...org,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "search") {
+        const query = positional.slice(1).join(" ") || flags.query || "";
+        const lane = flags.lane || "all";
+        const res = await engine.searchTools({
+            query,
+            lane,
+            limit: flags.limit ? Number(flags.limit) : 20,
+        });
+        if (flags.json || !process.stdout.isTTY) {
+            console.log(JSON.stringify({ ok: true, count: res.total, ...res }, null, 2));
+            return;
+        }
+        console.log(`\nFound ${res.total} tools matching '${query || "*"}' (lane: ${lane}):\n`);
+        for (const t of res.tools) {
+            console.log(`  • ${t.slug.padEnd(38)} [${t.lane.padEnd(16)}] (${t.riskLevel}, ${t.creditCost} cr)`);
+            console.log(`    ${t.description.slice(0, 100)}`);
+        }
+        return;
+    }
+    if (cmd === "inspect") {
+        const slug = positional[1];
+        if (!slug)
+            throw new Error("Usage: muxo inspect <tool_slug>");
+        const tool = await engine.inspectTool(slug);
+        console.log(JSON.stringify(tool, null, 2));
+        return;
+    }
+    if (cmd === "connections") {
+        const status = await engine.connectionStatus(ctx, {
+            provider: positional[1],
+            syncLive: flags.sync !== "false",
+        });
+        console.log(JSON.stringify(status, null, 2));
+        return;
+    }
+    if (cmd === "connect" || cmd === "link") {
+        const provider = positional[1];
+        if (!provider)
+            throw new Error(`Usage: muxo ${cmd} <provider> [--wait] [--timeout 30]`);
+        const res = await engine.startConnection(ctx, {
+            provider,
+            lane: flags.lane,
+            callbackUrl: typeof flags.callback === "string" ? flags.callback : undefined,
+        });
+        const connection = { ...res, provider: res.providerSlug };
+        if (flags.wait) {
+            const timeoutSeconds = flags.timeout ? Number(flags.timeout) : 15;
+            const waited = await engine.waitForConnection(ctx, {
+                provider,
+                timeoutSeconds,
+            });
+            console.log(JSON.stringify({ ok: true, connection, ...res, waitResult: waited }, null, 2));
+            return;
+        }
+        console.log(JSON.stringify({ ok: true, connection, ...res }, null, 2));
+        return;
+    }
+    if (cmd === "wait") {
+        const provider = positional[1];
+        if (!provider)
+            throw new Error("Usage: muxo wait <provider> [--timeout 15]");
+        if (flags["simulate-callback"]) {
+            await engine.handleOAuthCallback({
+                workspaceId: ctx.workspace.id,
+                provider,
+                status: "active",
+            });
+        }
+        const timeoutSeconds = flags.timeout ? Number(flags.timeout) : 15;
+        const waited = await engine.waitForConnection(ctx, {
+            provider,
+            timeoutSeconds,
+        });
+        console.log(JSON.stringify({ ok: true, ...waited }, null, 2));
+        return;
+    }
+    if (cmd === "plan") {
+        const toolSlug = positional[1];
+        if (!toolSlug)
+            throw new Error("Usage: muxo plan <tool_slug> [--input '{...}']");
+        const input = flags.input ? JSON.parse(String(flags.input)) : {};
+        const reason = flags.reason ? String(flags.reason) : "Planned via Muxo CLI";
+        const planned = await engine.planAction(ctx, { toolSlug, input, reason });
+        console.log(JSON.stringify(planned, null, 2));
+        return;
+    }
+    if (cmd === "approve") {
+        const planId = positional[1];
+        if (!planId)
+            throw new Error("Usage: muxo approve <plan_id>");
+        const approved = engine.approvePlan(ctx, planId, "approved");
+        console.log(JSON.stringify(approved, null, 2));
+        return;
+    }
+    if (cmd === "run") {
+        const planId = positional[1];
+        if (!planId)
+            throw new Error("Usage: muxo run <plan_id>");
+        const plan = engine.getPlan(ctx, planId);
+        const result = await engine.executePlanForRisk(ctx, planId, plan.riskLevel);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (cmd === "exec" || cmd === "provision") {
+        let toolSlug = positional[1];
+        if (!toolSlug)
+            throw new Error(`Usage: muxo ${cmd} <tool_slug> [--input '{...}'] [--approve]`);
+        if (cmd === "provision" && !toolSlug.includes(".")) {
+            const searched = await engine.searchTools({
+                query: toolSlug,
+                lane: "stripe_projects",
+                limit: 10,
+            });
+            const createTool = searched.tools.find((t) => t.slug.startsWith(`resource.${toolSlug.toLowerCase()}.create_`)) ||
+                searched.tools.find((t) => t.slug.startsWith(`resource.${toolSlug.toLowerCase()}.`)) ||
+                searched.tools[0];
+            if (createTool) {
+                toolSlug = createTool.slug;
+            }
+        }
+        const input = flags.input ? JSON.parse(String(flags.input)) : {};
+        const planned = await engine.planAction(ctx, {
+            toolSlug,
+            input,
+            reason: `Direct CLI ${cmd}`,
+        });
+        if (planned.plan.approvalStatus === "pending_approval") {
+            if (flags.approve || cmd === "provision") {
+                engine.approvePlan(ctx, planned.plan.id, "approved");
+            }
+            else {
+                console.log(JSON.stringify({
+                    ok: false,
+                    status: "pending_approval",
+                    plan: planned.plan,
+                    hint: `Pass --approve or run 'muxo approve ${planned.plan.id}' to authorize this ${planned.plan.riskLevel} operation.`,
+                }, null, 2));
+                return;
+            }
+        }
+        const result = await engine.executePlanForRisk(ctx, planned.plan.id, planned.plan.riskLevel);
+        const latestSettlement = result.receipt.supplierSettlement || null;
+        console.log(JSON.stringify({
+            ok: true,
+            ...result,
+            receipt: {
+                ...result.receipt,
+                verified: store.verifyReceipt(result.receipt),
+            },
+            settlement: latestSettlement,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "resources") {
+        console.log(JSON.stringify(store.listResources(ctx.workspace.id), null, 2));
+        return;
+    }
+    if (cmd === "env" && positional[1] === "pull") {
+        const outFile = String(flags.out || ".env.muxo");
+        const workdirSecrets = await engine.stripeProjects
+            .pullEnvVarsFromWorkdir()
+            .catch(() => ({}));
+        const vaultSecrets = store.getDecryptedWorkspaceEnv(ctx.workspace.id);
+        const merged = { ...workdirSecrets, ...vaultSecrets };
+        const lines = [
+            `# Muxo Provisioned Environment (${ctx.workspace.slug})`,
+            ...Object.entries(merged).map(([k, v]) => `${k}=${JSON.stringify(v)}`),
+            "",
+        ];
+        const resolvedPath = path.resolve(process.cwd(), outFile);
+        fs.writeFileSync(resolvedPath, lines.join("\n"), { mode: 0o600 });
+        const keys = Object.keys(merged);
+        console.log(JSON.stringify({
+            ok: true,
+            outputFile: resolvedPath,
+            keysWritten: keys,
+            keys,
+            keyCount: keys.length,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "receipts") {
+        const receiptId = positional[1];
+        if (receiptId) {
+            console.log(JSON.stringify(engine.getReceipt(ctx, receiptId), null, 2));
+        }
+        else {
+            console.log(JSON.stringify(store.listReceipts(ctx.workspace.id, 20), null, 2));
+        }
+        return;
+    }
+    if (cmd === "billing" || cmd === "topup") {
+        const sub = cmd === "topup" ? "topup" : positional[1] || "status";
+        if (sub === "topup") {
+            const credits = Math.max(1, Number(flags.credits || (cmd === "topup" ? positional[1] : positional[2]) || 1000));
+            const usdPaid = (credits * 0.01).toFixed(2);
+            const refId = `cli_topup_${Date.now()}`;
+            const updated = store.addWorkspaceCredits({
+                workspaceId: ctx.workspace.id,
+                credits,
+                referenceId: refId,
+                description: `User purchased +${credits.toLocaleString()} Muxo Credits ($${usdPaid} USD -> Muxo Master Wallet)`,
+            });
+            console.log(JSON.stringify({
+                ok: true,
+                creditsAdded: credits,
+                usdPaid: Number(usdPaid),
+                creditsBalance: updated.creditsBalance,
+                creditBalance: updated.creditsBalance,
+                settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+            }, null, 2));
+            return;
+        }
+        if (sub === "upgrade") {
+            const updated = store.upgradeWorkspaceToStarter({
+                workspaceId: ctx.workspace.id,
+                referenceId: `cli_upgrade_${Date.now()}`,
+                bonusCredits: 1000,
+            });
+            console.log(JSON.stringify({
+                ok: true,
+                upgraded: true,
+                tier: updated.tier,
+                monthlyActionsLimit: updated.monthlyActionsLimit,
+                creditsAdded: 1000,
+                creditsBalance: updated.creditsBalance,
+                creditBalance: updated.creditsBalance,
+                workspace: updated,
+                settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+            }, null, 2));
+            return;
+        }
+        if (sub === "checkout") {
+            const kind = flags.kind === "starter_subscription" || positional[2] === "starter"
+                ? "starter_subscription"
+                : "credit_topup";
+            const credits = flags.credits ? Number(flags.credits) : 1000;
+            const session = await engine.stripeBilling.createCheckoutSession({
+                workspace: ctx.workspace,
+                customerEmail: ctx.user.email,
+                kind,
+                credits,
+                returnBaseUrl: config.baseUrl,
+            });
+            console.log(JSON.stringify({ ok: true, kind, ...session }, null, 2));
+            return;
+        }
+        if (sub === "verify") {
+            const sessionId = positional[2] || String(flags.session || "");
+            if (!sessionId)
+                throw new Error("Usage: muxo billing verify <session_id>");
+            const verified = await engine.stripeBilling.verifyAndFulfillCheckoutSession(sessionId);
+            console.log(JSON.stringify({ ok: true, ...verified }, null, 2));
+            return;
+        }
+        const freshWs = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+        console.log(JSON.stringify({
+            ok: true,
+            tier: freshWs.tier,
+            creditsBalance: freshWs.creditsBalance,
+            creditBalance: freshWs.creditsBalance,
+            monthlyActionsUsed: freshWs.monthlyActionsUsed,
+            monthlyActionsLimit: freshWs.monthlyActionsLimit,
+            byokKeys: store.listByokKeys(ctx.workspace.id),
+            settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+            recentLedger: store.listLedgerEntries(ctx.workspace.id, 25),
+        }, null, 2));
+        return;
+    }
+    if (cmd === "byok" || cmd === "keys") {
+        const remoteUrl = typeof flags.url === "string" ? flags.url.replace(/\/+$/, "") : "";
+        const sub = positional[1] || "list";
+        if (sub === "set" || sub === "add" || sub === "prompt") {
+            let provider = (positional[2] || String(flags.provider || "")).trim().toLowerCase();
+            if (!provider) {
+                provider = (await promptUserLine("Enter provider slug (openai, anthropic, openrouter, gemini, composio, stripe, supermemory, firecrawl, exa): ")).toLowerCase();
+            }
+            if (!provider) {
+                throw new Error("Usage: muxo byok set <provider> [<api_key>]");
+            }
+            let secretKey = positional[3] ||
+                (typeof flags.key === "string" ? flags.key : "") ||
+                (typeof flags["secret-key"] === "string" ? flags["secret-key"] : "");
+            if (!secretKey) {
+                secretKey = await promptUserLine(`Enter API key for ${provider} (stored encrypted with AES-256-GCM in Muxo Vault): `);
+            }
+            if (!secretKey) {
+                throw new Error(`API key is required for provider '${provider}'.`);
+            }
+            if (remoteUrl) {
+                const res = await fetch(`${remoteUrl}/api/v1/byok`, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        ...(apiKeyFlag ? { Authorization: `Bearer ${apiKeyFlag}` } : {}),
+                    },
+                    body: JSON.stringify({ provider, secretKey }),
+                });
+                console.log(JSON.stringify(await res.json(), null, 2));
+                return;
+            }
+            const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+            console.log(JSON.stringify({
+                ok: true,
+                action: "saved",
+                key: record,
+                fundingMode: record.category === "supplier" ? "byok (0 credit cost)" : "llm_router",
+            }, null, 2));
+            return;
+        }
+        if (sub === "delete" || sub === "remove" || sub === "rm") {
+            const provider = (positional[2] || String(flags.provider || "")).trim().toLowerCase();
+            if (!provider)
+                throw new Error("Usage: muxo byok delete <provider>");
+            if (remoteUrl) {
+                const res = await fetch(`${remoteUrl}/api/v1/byok/${encodeURIComponent(provider)}`, {
+                    method: "DELETE",
+                    headers: apiKeyFlag ? { Authorization: `Bearer ${apiKeyFlag}` } : {},
+                });
+                console.log(JSON.stringify(await res.json(), null, 2));
+                return;
+            }
+            store.deleteByokKey(ctx.workspace.id, provider);
+            console.log(JSON.stringify({
+                ok: true,
+                action: "deleted",
+                provider,
+                keys: store.listByokKeys(ctx.workspace.id),
+            }, null, 2));
+            return;
+        }
+        if (remoteUrl) {
+            const res = await fetch(`${remoteUrl}/api/v1/byok`, {
+                headers: apiKeyFlag ? { Authorization: `Bearer ${apiKeyFlag}` } : {},
+            });
+            console.log(JSON.stringify(await res.json(), null, 2));
+            return;
+        }
+        console.log(JSON.stringify({
+            ok: true,
+            keys: store.listByokKeys(ctx.workspace.id),
+            supportedProviders: BYOK_PROVIDER_CATALOG,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "do" || cmd === "ask" || cmd === "nl") {
+        const remoteUrl = typeof flags.url === "string" ? flags.url.replace(/\/+$/, "") : "";
+        let promptText = positional.slice(1).join(" ").trim() ||
+            (typeof flags.prompt === "string" ? flags.prompt : "");
+        if (!promptText) {
+            promptText = await promptUserLine("What would you like Muxo to do? ");
+        }
+        if (!promptText) {
+            throw new Error('Usage: muxo do "<natural language instruction>"');
+        }
+        // If user requested --byok and has no BYOK key for the requested provider, optionally prompt
+        if (flags.byok && typeof flags["byok-key"] === "string" && typeof flags["byok-provider"] === "string") {
+            store.setByokKey(ctx.workspace.id, String(flags["byok-provider"]), String(flags["byok-key"]));
+        }
+        const planOnly = flags["plan-only"] === true || flags.plan === true;
+        const autoApprove = flags["no-approve"] ? false : true;
+        const fundingMode = flags.byok || flags.funding === "byok"
+            ? "byok"
+            : flags.funding === "muxo_funded"
+                ? "muxo_funded"
+                : undefined;
+        if (remoteUrl) {
+            const res = await fetch(`${remoteUrl}/api/v1/do`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...(apiKeyFlag ? { Authorization: `Bearer ${apiKeyFlag}` } : {}),
+                },
+                body: JSON.stringify({
+                    prompt: promptText,
+                    autoApprove,
+                    dryRun: planOnly,
+                }),
+            });
+            console.log(JSON.stringify(await res.json(), null, 2));
+            return;
+        }
+        const result = await engine.doNaturalLanguage(ctx, {
+            prompt: promptText,
+            autoApprove,
+            planOnly,
+            fundingMode,
+        });
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (cmd === "tui" || cmd === "setup" || cmd === "interactive") {
+        const remoteUrl = typeof flags.url === "string" ? flags.url.replace(/\/+$/, "") : "";
+        if (remoteUrl && (flags.json || flags["non-interactive"] || flags.once)) {
+            const res = await fetch(`${remoteUrl}/api/v1/billing/status`, {
+                headers: apiKeyFlag ? { Authorization: `Bearer ${apiKeyFlag}` } : {},
+            });
+            const statusData = (await res.json());
+            console.log(JSON.stringify({
+                ok: true,
+                tui: "ready",
+                mode: "tui_snapshot",
+                workspace: statusData.workspace,
+                byokKeys: statusData.byokKeys || [],
+                supportedByokProviders: Object.keys(BYOK_PROVIDER_CATALOG),
+            }, null, 2));
+            return;
+        }
+        const freshWs = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+        const byokKeys = store.listByokKeys(ctx.workspace.id);
+        const conns = store.listConnections(ctx.workspace.id);
+        const resources = store.listResources(ctx.workspace.id);
+        const gov = engine.governance.getStatus(freshWs);
+        if (flags.json || flags["non-interactive"] || flags.once) {
+            console.log(JSON.stringify({
+                ok: true,
+                tui: "ready",
+                mode: "tui_snapshot",
+                workspace: {
+                    id: freshWs.id,
+                    name: freshWs.name,
+                    slug: freshWs.slug,
+                    tier: freshWs.tier,
+                    creditsBalance: freshWs.creditsBalance,
+                    monthlyActionsUsed: freshWs.monthlyActionsUsed,
+                    monthlyActionsLimit: freshWs.monthlyActionsLimit,
+                },
+                governanceDid: gov.agentDid,
+                byokKeys,
+                activeConnections: conns.filter((c) => c.status === "active").length,
+                activeResources: resources.filter((r) => r.status === "active").length,
+                supportedByokProviders: Object.keys(BYOK_PROVIDER_CATALOG),
+            }, null, 2));
+            return;
+        }
+        const printBanner = () => {
+            const wsNow = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+            const keysNow = store.listByokKeys(ctx.workspace.id);
+            const hasSupplierByok = keysNow.some((k) => k.category === "supplier");
+            console.log("\n┌──────────────────────────────────────────────────────────────────────────┐");
+            console.log("│ ⚡ MUXO INTERACTIVE TUI — Execution, Cloud Infra, Memory & Governance    │");
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log(`│ Workspace : ${wsNow.name.padEnd(28)} Tier    : ${wsNow.tier.toUpperCase().padEnd(16)}│`);
+            console.log(`│ Credits   : ${String(wsNow.creditsBalance).padEnd(28)} Funding : ${(hasSupplierByok ? "BYOK (0 cr)" : "muxo_funded").padEnd(16)}│`);
+            console.log(`│ BYOK Keys : ${String(keysNow.length).padEnd(28)} DID     : ${gov.agentDid.slice(0, 16)}│`);
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log("│ [1] ✨ Run in Plain English (Natural Language Router: muxo do)           │");
+            console.log("│ [2] 🔑 Configure BYOK API Key (OpenAI, Anthropic, Composio, Stripe...)   │");
+            console.log("│ [3] 💳 Billing: Top Up +1,000 Credits or Upgrade to Starter Plan         │");
+            console.log("│ [4] 🔗 Connect OAuth App (GitHub, Gmail, Slack, Notion, Linear)          │");
+            console.log("│ [5] ☁️  Provision Cloud Database (Turso SQLite, Neon Postgres, Redis)    │");
+            console.log("│ [q] Exit TUI                                                             │");
+            console.log("└──────────────────────────────────────────────────────────────────────────┘");
+        };
+        printBanner();
+        const choice = (await promptUserLine("\nSelect an option [1-5, q] (or type any natural language command): ")).trim();
+        if (!choice || choice.toLowerCase() === "q" || choice.toLowerCase() === "exit") {
+            console.log("Exited Muxo TUI.");
+            return;
+        }
+        if (choice === "1") {
+            const nlPrompt = await promptUserLine("Ask Muxo in plain English: ");
+            if (nlPrompt) {
+                const res = await engine.doNaturalLanguage(ctx, { prompt: nlPrompt, autoApprove: true });
+                console.log(JSON.stringify(res, null, 2));
+            }
+            return;
+        }
+        if (choice === "2") {
+            const provider = (await promptUserLine("Provider (openai, anthropic, openrouter, gemini, composio, stripe, supermemory, firecrawl, exa): ")).toLowerCase();
+            const secretKey = await promptUserLine(`Paste API key for ${provider}: `);
+            if (provider && secretKey) {
+                const saved = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                console.log(JSON.stringify({ ok: true, saved }, null, 2));
+            }
+            return;
+        }
+        if (choice === "3") {
+            const action = (await promptUserLine("Type 'upgrade' for Starter Plan or credit amount (default 1000): ")).toLowerCase();
+            if (action === "upgrade") {
+                const up = store.upgradeWorkspaceToStarter({
+                    workspaceId: ctx.workspace.id,
+                    referenceId: `tui_upgrade_${Date.now()}`,
+                    bonusCredits: 1000,
+                });
+                console.log(JSON.stringify({ ok: true, upgraded: true, workspace: up }, null, 2));
+            }
+            else {
+                const cr = Math.max(100, Number(action) || 1000);
+                const up = store.addWorkspaceCredits({
+                    workspaceId: ctx.workspace.id,
+                    credits: cr,
+                    referenceId: `tui_topup_${Date.now()}`,
+                    description: `TUI credit top-up (+${cr} credits)`,
+                });
+                console.log(JSON.stringify({ ok: true, creditsAdded: cr, creditsBalance: up.creditsBalance }, null, 2));
+            }
+            return;
+        }
+        if (choice === "4") {
+            const provider = (await promptUserLine("OAuth Provider (github, gmail, slack, notion, linear): ")) || "github";
+            const conn = await engine.startConnection(ctx, { provider });
+            console.log(JSON.stringify({ ok: true, connection: conn }, null, 2));
+            return;
+        }
+        if (choice === "5") {
+            const dbPrompt = (await promptUserLine("Database to provision (e.g. 'Provision Turso database my-app-db'): ")) || "Provision Turso database my-app-db";
+            const res = await engine.doNaturalLanguage(ctx, { prompt: dbPrompt, autoApprove: true });
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        // Otherwise treat whatever they typed as a natural language command!
+        const res = await engine.doNaturalLanguage(ctx, { prompt: choice, autoApprove: true });
+        console.log(JSON.stringify(res, null, 2));
+        return;
+    }
+    if (cmd === "memory") {
+        const sub = positional[1];
+        if (sub === "add") {
+            const content = positional.slice(2).join(" ") || String(flags.content || "");
+            if (!content)
+                throw new Error("Usage: muxo memory add <text>");
+            const entry = await engine.addWorkspaceMemory(ctx, {
+                content,
+                title: flags.title ? String(flags.title) : content.slice(0, 60),
+            });
+            console.log(JSON.stringify({ ok: true, memory: entry }, null, 2));
+            return;
+        }
+        const query = sub === "recall" || sub === "search"
+            ? positional.slice(2).join(" ") || flags.query || undefined
+            : positional.slice(1).join(" ") || flags.query || undefined;
+        const recall = await engine.getMemoryOverview(ctx, query);
+        console.log(JSON.stringify({
+            ok: true,
+            ...recall,
+            localMemories: recall.recentMemories,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "governance") {
+        const status = engine.governance.getGovernanceStatus(ctx.workspace);
+        const summary = engine.governance.getStatus(ctx.workspace);
+        console.log(JSON.stringify({
+            ok: true,
+            did: summary.agentDid,
+            chainValid: summary.auditChainIntegrity,
+            ringName: "Ring 2 (Standard)",
+            ...status,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "serve") {
+        const { createMuxoServer } = await import("./server.js");
+        const port = flags.port ? Number(flags.port) : config.port;
+        const baseUrl = `http://localhost:${port}`;
+        const srvConfig = { ...config, port, baseUrl };
+        const { server } = createMuxoServer(srvConfig);
+        await new Promise((resolve) => {
+            server.listen(port, () => {
+                console.log(`\n⚡ Muxo Platform running at ${baseUrl}`);
+                console.log(`   ├─ Web Console:     ${baseUrl}/`);
+                console.log(`   ├─ Landing Page:    ${baseUrl}/landing`);
+                console.log(`   ├─ MCP Server:      ${baseUrl}/mcp`);
+                console.log(`   ├─ OAuth Callback:  ${baseUrl}/oauth/callback`);
+                console.log(`   └─ Agent Skill:     ${baseUrl}/skill.md\n`);
+            });
+            process.on("SIGINT", () => {
+                server.close(() => resolve());
+            });
+            process.on("SIGTERM", () => {
+                server.close(() => resolve());
+            });
+        });
+        return;
+    }
+    // Natural Language fallback: if user passed plain English directly (`muxo "Audit https://muxo.ai for SEO"`)
+    if (cmd !== "help" && !flags.help && !flags.h && positional.length > 0) {
+        const promptText = positional.join(" ").trim();
+        const result = await engine.doNaturalLanguage(ctx, {
+            prompt: promptText,
+            autoApprove: flags["no-approve"] ? false : true,
+            planOnly: flags["plan-only"] === true || flags.plan === true,
+            fundingMode: flags.byok || flags.funding === "byok"
+                ? "byok"
+                : flags.funding === "muxo_funded"
+                    ? "muxo_funded"
+                    : undefined,
+        });
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`
+Muxo CLI — Human & LLM Friendly Execution, Infrastructure, BYOK & Governance Platform
+
+Natural Language & Interactive TUI:
+  muxo do "<instruction>"                      Execute any goal in plain English (LLM/semantic router -> plan -> execute)
+  muxo ask "<instruction>" [--plan-only]       Alias for 'muxo do' (pass --plan-only to inspect plan before running)
+  muxo tui                                     Launch interactive Terminal UI dashboard (BYOK, Billing, OAuth, Infra)
+  muxo byok [list|set|delete] [<provider>]     Manage BYOK API keys in AES-256-GCM Vault (0 credit cost when active)
+
+Core Commands:
+  muxo login [--api-key <key> | --signup]      Sign in or create an autonomous workspace (~/.muxo/config.json)
+  muxo logout                                  Remove saved CLI authentication config
+  muxo claim <owner_email>                     Generate a human owner claim link for this workspace
+  muxo whoami                                  Show workspace profile, plan, DID, and credit balance
+  muxo search <query> [--lane <lane>]          Search across Instant, Composio Apps, Stripe Projects & Billing
+  muxo inspect <tool_slug>                     Inspect tool schema, risk level, and credit cost
+  muxo connections [--sync true|false]         List Composio OAuth & Stripe Projects provider connections
+  muxo link <provider> [--wait]                Start OAuth handoff for a service and optionally wait
+  muxo connect <provider> [--wait]             Alias for 'muxo link'
+  muxo wait <provider> [--timeout 15]          Poll until a pending OAuth connection handoff becomes active
+  muxo plan <tool_slug> --input '{...}'        Create a governed execution plan (accepts natural language too)
+  muxo approve <plan_id>                       Approve a pending high-risk plan
+  muxo run <plan_id>                           Execute an approved plan and issue a signed receipt
+  muxo exec <tool_slug> --input '{...}'        Plan and execute in one step (pass --approve for high-risk)
+  muxo resources                               List provisioned Stripe Projects infrastructure resources
+  muxo env pull [--out .env.muxo]              Decrypt and write provisioned credentials to local .env
+  muxo receipts [<receipt_id>]                 List or cryptographically verify execution receipts
+  muxo billing [status|topup|upgrade|checkout] Manage credits, upgrade to Starter, or inspect settlements
+  muxo memory [<query>]                        Recall Supermemory v5 workspace brain & hybrid memories
+  muxo governance                              Inspect Microsoft Agent Governance Ed25519 DID & audit chain
+  muxo serve [--port 4310]                     Start unified HTTP Console, Landing, OAuth Callback & MCP server
+  muxo mcp                                     Run stdio MCP server (20 canonical tools)
+`);
+}
+runCli().catch((err) => {
+    console.error("Error:", err?.message || err);
+    process.exit(1);
+});