@naraya/cli 0.1.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,20 @@
+Naraya CLI — Proprietary License
+Copyright (c) 2026 PT. Naraya Teknologi Indonesia. All rights reserved.
+
+This software and its accompanying assets (including but not limited to system
+prompts, agent definitions, skills, and configuration) are the confidential and
+proprietary property of PT. Naraya Teknologi Indonesia ("Naraya").
+
+NO LICENSE IS GRANTED to copy, modify, distribute, sublicense, reverse engineer,
+decompile, disassemble, or create derivative works from any part of this
+software or its assets, in whole or in part, except as expressly authorized in
+writing by Naraya.
+
+Use of this software requires a valid Naraya account and API key and is governed
+by the Naraya Terms of Service. Access may be revoked at any time.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL NARAYA BE LIABLE
+FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,93 +1,184 @@
-# NaraCLI
-
-
-
-## Getting started
-
-To make it easy for you to get started with GitLab, here's a list of recommended next steps.
-
-Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)!
-
-## Add your files
-
-* [Create](https://docs.gitlab.com/user/project/repository/web_editor/#create-a-file) or [upload](https://docs.gitlab.com/user/project/repository/web_editor/#upload-a-file) files
-* [Add files using the command line](https://docs.gitlab.com/topics/git/add_files/#add-files-to-a-git-repository) or push an existing Git repository with the following command:
-
-```
-cd existing_repo
-git remote add origin https://gitlab.naraya.ai/adearman/naracli.git
-git branch -M main
-git push -uf origin main
-```
-
-## Integrate with your tools
-
-* [Set up project integrations](https://gitlab.naraya.ai/adearman/naracli/-/settings/integrations)
-
-## Collaborate with your team
-
-* [Invite team members and collaborators](https://docs.gitlab.com/user/project/members/)
-* [Create a new merge request](https://docs.gitlab.com/user/project/merge_requests/creating_merge_requests/)
-* [Automatically close issues from merge requests](https://docs.gitlab.com/user/project/issues/managing_issues/#closing-issues-automatically)
-* [Enable merge request approvals](https://docs.gitlab.com/user/project/merge_requests/approvals/)
-* [Set auto-merge](https://docs.gitlab.com/user/project/merge_requests/auto_merge/)
-
-## Test and Deploy
-
-Use the built-in continuous integration in GitLab.
-
-* [Get started with GitLab CI/CD](https://docs.gitlab.com/ci/quick_start/)
-* [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/user/application_security/sast/)
-* [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/topics/autodevops/requirements/)
-* [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/user/clusters/agent/)
-* [Set up protected environments](https://docs.gitlab.com/ci/environments/protected_environments/)
-
-***
-
-# Editing this README
-
-When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thanks to [makeareadme.com](https://www.makeareadme.com/) for this template.
-
-## Suggestions for a good README
-
-Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information.
-
-## Name
-Choose a self-explaining name for your project.
-
-## Description
-Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors.
-
-## Badges
-On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge.
-
-## Visuals
-Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method.
-
-## Installation
-Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection.
-
-## Usage
-Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README.
-
-## Support
-Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc.
-
-## Roadmap
-If you have ideas for releases in the future, it is a good idea to list them in the README.
-
-## Contributing
-State if you are open to contributions and what your requirements are for accepting them.
-
-For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self.
-
-You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser.
-
-## Authors and acknowledgment
-Show your appreciation to those who have contributed to the project.
-
-## License
-For open source projects, say how it is licensed.
-
-## Project status
-If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.
+# Naraya CLI
+
+> One sign-in, every model. A coding agent that delegates specialist work to focused subagents and brings evidence to every claim.
+
+[![Node](https://img.shields.io/badge/node-%E2%89%A522.19-blue)](https://nodejs.org) [![License: Proprietary](https://img.shields.io/badge/license-proprietary-red)](LICENSE) [![Version](https://img.shields.io/badge/version-0.4.0-blue)](package.json)
+
+Naraya CLI is an AI coding agent that:
+
+- Routes all model traffic through [router.naraya.ai](https://router.naraya.ai) with one API key — Claude, GPT, Gemini, DeepSeek, GLM, Kimi, MiniMax, Mistral, and more.
+- Ships a roster of focused subagents (`nara-build`, `nara-architect`, `nara-release`, `nara-review`, `nara-debug`, `nara-plan`, `nara-explore`, `nara-search`, `nara-fe`, `nara-droid`) — each with its own skills and references.
+- Provides a `delegate` tool that fans work out to subagents in parallel, sequential chains, or single focus — each in an isolated context window.
+
+---
+
+## Table of contents
+
+- [Install](#install)
+- [Quickstart](#quickstart)
+- [Usage](#usage)
+- [Subagents](#subagents)
+- [Skills](#skills)
+- [Support](#support)
+- [License](#license)
+
+---
+
+## Install
+
+```bash
+# Requires Node.js >= 22.19
+npm install -g @naraya/cli
+```
+
+Then sign in with your Naraya account:
+
+```bash
+naraya login
+```
+
+> Naraya CLI is proprietary software. Access requires a valid Naraya account and
+> API key — sign up at [router.naraya.ai](https://router.naraya.ai).
+
+---
+
+## Quickstart
+
+```bash
+# 1. Sign in (one-time)
+naraya login
+
+# 2. Verify auth
+naraya status
+
+# 3. Launch the agent in the current project
+naraya
+```
+
+Inside the agent, press `/` for the command palette, `/agents` to list subagents, `/skills` to list skills.
+
+```bash
+# Quick subcommands without launching the TUI
+naraya login              # sign in to router.naraya.ai
+naraya logout             # wipe local credentials
+naraya status             # show auth + quota + current model
+naraya status --usd       # same, with USD cost equivalent
+```
+
+---
+
+## Usage
+
+### Interactive mode
+
+```bash
+naraya                        # launch in cwd
+naraya --model naraya/glm-5   # override default model for this session
+naraya --continue             # resume the last session
+```
+
+Slash commands inside the TUI:
+
+| Command | Effect |
+|---|---|
+| `/agents` | list subagents |
+| `/agent-model <name>` | change a subagent's model |
+| `/skill:<name> [args]` | load a skill |
+| `/skills` | list available skills |
+| `/help` | full command palette |
+
+### Headless / scripted
+
+```bash
+naraya -p "audit the auth module for OWASP top 10"   # single prompt, prints result, exits
+naraya -p --json <task>                              # machine-readable output
+```
+
+### Delegation patterns
+
+The agent delegates to specialists via the `delegate` tool. You do not invoke it directly — you phrase the request and the model decides.
+
+```ts
+// One focused specialist
+delegate { agent: "nara-droid", task: "..." }
+
+// Independent units in parallel
+delegate { tasks: [
+  { agent: "nara-search",  task: "research X" },
+  { agent: "nara-explore", task: "find usages of Y" },
+  { agent: "nara-plan",    task: "draft plan for Z" }
+]}
+
+// Sequential, {previous} injects the prior step's output
+delegate { chain: [
+  { agent: "nara-explore", task: "map the auth flow" },
+  { agent: "nara-plan",    task: "draft a plan based on {previous}" },
+  { agent: "nara-review",  task: "review the plan in {previous}" }
+]}
+```
+
+---
+
+## Subagents
+
+Naraya ships a roster of focused subagents. The model picks based on the **unit of work**, not the surface form.
+
+### Coordination
+
+| Agent | Purpose | When to use |
+|---|---|---|
+| `nara-build` | Implements features, bugfixes, refactors, releases | Top-level orchestrator. Default for "implement X", "fix Y", "refactor Z" |
+| `nara-architect` | System design, ADRs, component decomposition | Greenfield design, scaling decisions, API contracts, trade-offs. Read-only |
+| `nara-release` | Version sync, verification, deploy safety | Before any production push, store release, or schema migration |
+| `nara-review` | Multi-aspect code review (security, perf, a11y, API, tests) | Pre-merge review, audit, self-review. Does not fix |
+| `nara-debug` | 4-phase root-cause debugging | "X is broken", flaky tests, intermittent failures |
+
+### Investigation (read-only)
+
+| Agent | Purpose | When to use |
+|---|---|---|
+| `nara-plan` | Implementation plans, never edits code | Pair with `nara-build` for hand-off |
+| `nara-explore` | Fast codebase navigation | "Where is X defined?", "who calls Y?", quick map |
+| `nara-search` | Evidence-first research with citations | Library comparison, version migration, doc lookup |
+
+### Specialist (writes code in their domain)
+
+| Agent | Purpose | When to use |
+|---|---|---|
+| `nara-fe` | Frontend UI/UX (React, Vue, Svelte, Angular, CSS, Tailwind, a11y) | UI changes, component design, responsive, accessibility |
+| `nara-droid` | Native Android (Kotlin, Gradle, Compose, Room, Hilt, adb, APK/AAB) | Android tasks, build failures, release |
+
+If multiple roles apply, the model fans out to parallel subagents.
+
+---
+
+## Skills
+
+Naraya bundles a large pool of skills that any agent can load on demand via `/skill:<name>`. Highlights:
+
+| Skill | What it covers |
+|---|---|
+| `systematic-debugging` | 4-phase root-cause debugging |
+| `test-driven-development` | RED-GREEN-REFACTOR discipline |
+| `writing-plans` | Implementation plans with bite-sized tasks |
+| `security`, `auth-identity`, `compliance-governance` | Security review and compliance |
+| `architecture`, `api-design-patterns`, `distributed-systems` | System design |
+| `android-kotlin`, `compose-patterns`, `gradle-troubleshoot` | Android development |
+| `react-patterns`, `css-patterns` | Frontend |
+
+**Skills vs subagents:** a skill is a workflow / lens the agent applies inline. A subagent is a separate context that runs in parallel. Use skills for "do X the right way", subagents for "do X in isolation".
+
+For project-specific guidance, add an `AGENTS.md` to your repository — the agent reads it automatically.
+
+---
+
+## Support
+
+- **Account, billing, API keys:** [router.naraya.ai](https://router.naraya.ai)
+- **Sign-in issues:** run `naraya logout` then `naraya login` to refresh your session.
+
+---
+
+## License
+
+Proprietary. Copyright © 2026 PT. Naraya Teknologi Indonesia. All rights reserved. See [LICENSE](LICENSE).

package/bin/naraya-native.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import D from"node:os";import p from"node:path";import f from"node:fs";import"node:crypto";import{AuthStorage as te,ModelRegistry as ne,SessionManager as se,createAgentSession as ae,initTheme as q,getMarkdownTheme as re,getSelectListTheme as oe}from"@earendil-works/pi-coding-agent";import{fileURLToPath as ie}from"node:url";import{TUI as ce,Container as b,Editor as Be,Text as x,Markdown as _e,ProcessTerminal as le,KeybindingsManager as de,TUI_KEYBINDINGS as me,setKeybindings as $e}from"@earendil-works/pi-tui";import{readClipboardImage as ue}from"../src/clipboard.mjs";import"../src/splash.mjs";const F=p.join(D.homedir(),".naraya","native-debug.log"),$=e=>{try{f.appendFileSync(F,`${new Date().toISOString()} ${e}
+`)}catch{}};try{f.rmSync(F,{force:!0})}catch{}process.on("uncaughtException",e=>{$(`UNCAUGHT ${e?.stack??e}`)}),process.on("unhandledRejection",e=>{$(`UNHANDLED ${e?.stack??e}`)});const c="\x1B[38;2;45;123;255m",pe="\x1B[48;2;45;123;255m",he="\x1B[38;2;10;29;77m",ge="\x1B[48;2;10;29;77m",T="\x1B[38;2;255;140;40m",Ne="\x1B[38;2;111;191;115m",B="\x1B[2m",k="\x1B[1m",s="\x1B[0m",fe=/\x1b\[[0-9;]*m/g,m=e=>e.replace(fe,"").length,Ue=(()=>{try{const e=p.dirname(p.dirname(ie(import.meta.url)));return JSON.parse(f.readFileSync(p.join(e,"package.json"),"utf8")).version??"dev"}catch{return"dev"}})(),w=["_____________BB___","___BBB_______BBB__","_BBBBBB______BBBBB","_BBBBBBBB____BBBBB","B_BBBBBBBB___BBBBB","BB_BBBBBBBB__BBBNN","BBB_BBBBBBB__BBNNN","BBBB__BBB____BNNNN","BBBBBB_____BBBNNNN","BBBBBB___BBBBBNNNN","BBBBB___BBBBBBNNNN","BBBBB___BBBBBBNNNN","BBBBB____BBBBBNNNN","BBBBB______BBBNNN_","BBBBB_______BBNN__","_BBBB________B____","__BBB_____________","____B_____________"],M=e=>e==="B"?c:e==="N"?he:"",ye=e=>e==="B"?pe:e==="N"?ge:"";function Ye(){const e=[];for(let t=0;t<w.length;t+=2){let n="";for(let r=0;r<w[t].length;r++){const a=w[t][r],o=w[t+1]?.[r]??"_";a==="_"&&o==="_"?n+=" ":a!=="_"&&o==="_"?n+=`${M(a)}\u2580${s}`:a==="_"&&o!=="_"?n+=`${M(o)}\u2584${s}`:a===o?n+=`${M(a)}\u2588${s}`:n+=`${M(a)}${ye(o)}\u2580${s}`}e.push(n)}return e}const j=(e,t)=>e+" ".repeat(Math.max(0,t-m(e)));function Ke(e,t){const n=Math.max(...e.map(m),0),r=Math.max(...t.map(m),0),a=Math.max(e.length,t.length),o=Math.floor((a-e.length)/2),_=Math.floor((a-t.length)/2);return Array.from({length:a},(N,l)=>`${j(e[l-o]??"",n)}  ${j(t[l-_]??"",r)}`)}const E=p.join(D.homedir(),".naraya","agent"),G=p.join(E,"models.json");let U;try{U=JSON.parse(f.readFileSync(G,"utf8"))}catch{console.error("Run `naraya login` first."),process.exit(1)}const y=U.providers?.naraya??{},be=(y.models??[]).map(e=>e.id),h=process.env.NARAYA_MODEL??be[0],xe=(y.models??[]).find(e=>e.id===h)?.name??h;h||(console.error("No naraya models \u2014 run `naraya login`."),process.exit(1));const Y=te.create(p.join(E,"auth.json")),K=ne.create(Y,G),P=K.find("naraya",h);P||(console.error(`Model naraya/${h} not found.`),process.exit(1));const{session:I}=await ae({cwd:process.cwd(),agentDir:E,model:P,thinkingLevel:"off",authStorage:Y,modelRegistry:K,tools:["read","grep","find","ls","edit","write","bash"],sessionManager:se.create(process.cwd())});try{$e(new de(me))}catch{}try{q("naraya",!0)}catch{try{q("dark",!0)}catch{}}const we=re(),Me={borderColor:e=>`${c}${e}${s}`,selectList:oe()};let V=!1,J=!1,z=0,H=0,u=null;async function Se(){try{const e=await fetch(`${y.baseUrl}/me`,{headers:{authorization:`Bearer ${y.apiKey}`},signal:AbortSignal.timeout(3e3)});if(!e.ok)return;const t=await e.json(),n=Number(t.quota?.limit??0),r=Number(t.quota?.remaining??0),a=o=>o>=1e6?`${(o/1e6).toFixed(1).replace(/\.0$/,"")}M`:Number(o).toLocaleString("id-ID");u={email:t.account?.email??"",plan:t.account?.plan??"",saldo:`Rp ${Number(t.credit?.available??0).toLocaleString("id-ID",{maximumFractionDigits:0})}`,usd:t.credit?.usd_equivalent?`$${t.credit.usd_equivalent}`:"",kuota:n>0?`${a(r)} / ${a(n)}`:"fair-use",models:Array.isArray(t.models)?t.models.length:0}}catch{}}const Ae={render(e){const t=Math.min(48,Math.max(40,e-2)),n=t-4,r=(d,L)=>{const ee=Math.max(1,n-m(d)-m(L));return`${d}${" ".repeat(ee)}${L}`},a=y?`${B} v${process.env.NARAYA_VERSION??"dev"}${s}${c}`:"",o=` ${k}NARAYA${s}${a}${c} `,_=`${c}\u256D\u2500${o}${"\u2500".repeat(Math.max(0,t-m(o)-3))}\u256E${s}`,N=`${c}\u2570${"\u2500".repeat(Math.max(0,t-2))}\u256F${s}`,l=d=>`${c}\u2502${s} ${d}${" ".repeat(Math.max(0,n-m(d)))} ${c}\u2502${s}`;return u?[_,l(r(`${k}${u.email}${s}`,`${B}${u.plan}${s}`)),l(r(`${c}Saldo${s} ${u.saldo}`,`${B}${u.usd}${s}`)),l(r(`${c}Kuota${s} ${u.kuota}`,`${B}${u.models} model${s}`)),N,""]:[_,l(`${B}memuat akun\u2026${s}`),N,""]}},Ce={render(e){const t=process.cwd(),n=`${c}\u25C6 ${xe}${s}`,r=Math.max(1,e-m(t)-m(n)),a=`${B}${t}${s}${" ".repeat(r)}${n}`,o=d=>d<1e3?`${d}`:`${(d/1e3).toFixed(1).replace(/\.0$/,"")}k`,_=`${B}\u2191${o(z)} \u2193${o(H)} tokens${s}`,N=`${V?T:B}\u26A1 auto-approve ${V?"ON":"OFF"} \xB7 Ctrl+Alt+A${s}`,l=`${J?T:B}\u2702\uFE0F truncate ${J?"ON":"OFF"} \xB7 Ctrl+Alt+O${s}`;return["\u2500".repeat(e),a,_,N,l]}},i=new ce(new le,!1),W=()=>{try{i.stop()}catch{}try{I.dispose?.()}catch{}process.exit(0)};process.on("SIGINT",W);const X=new b,g=new b,Q=new b,Z=new b;X.addChild(Ae),Z.addChild(Ce);let R=null,O="",S=!1;const A=new Map;let C=0;async function Te(e){$(`submit text=${JSON.stringify((e??"").slice(0,40))} busy=${S}`);let t=(e??"").trim();if(!t&&A.size===0||S){$("submit skipped (empty/busy)");return}const n=[];t=t.replace(/\[🖼 Image #(\d+)\]/g,(a,o)=>{const _=A.get(Number(o));if(_)try{n.push({type:"image",data:f.readFileSync(_.path).toString("base64"),mimeType:_.mimeType})}catch{}return""}).replace(/\s{2,}/g," ").trim(),A.clear(),C=0;const r=n.length?`${B}\u{1F4CE} ${n.length} gambar${s}  `:"";g.addChild(new x(`${r}${k}\u203A${s} ${t||"(gambar)"}`,1,0)),O="",R=new _e("",1,0,we),g.addChild(R),i.requestRender(),S=!0;try{await I.prompt(t||"Describe this image.",n.length?{images:n}:void 0)}catch(a){$(`prompt error ${a?.stack??a}`),g.addChild(new x(`${T}[error]${s} ${a?.message??a}`,1,0))}finally{S=!1,i.requestRender()}}class ke extends Be{handleInput(t){if($(`handleInput ${JSON.stringify(t.slice(0,10))} len=${t.length}`),t===""){W();return}if(t==="\r"||t===`
+`){const n=this.getText();this.setText(""),Te(n);return}if(t==="\x1Bv"||t==="\x1BV"){const n=ue();if(n){C+=1,A.set(C,n);const r=this.getText(),a=r&&!r.endsWith(" ")?" ":"";this.setText(`${r}${a}[\u{1F5BC} Image #${C}] `),i.requestRender()}return}super.handleInput(t)}}const v=new ke(i,Me,{placeholder:"Pesan ke Naraya \u2014 Enter kirim \xB7 Alt+V tempel gambar \xB7 Ctrl+C keluar"});Q.addChild(v),I.subscribe(e=>{if($(`event ${e.type}${e.assistantMessageEvent?.type?"/"+e.assistantMessageEvent.type:""}`),e.type==="message_update"&&e.assistantMessageEvent?.type==="text_delta")O+=e.assistantMessageEvent.delta,R?.setText(O),i.requestRender();else if(e.type==="tool_execution_start")g.addChild(new x(`${B}\u2699 ${e.toolName??"tool"}\u2026${s}`,1,0)),i.requestRender();else if(e.type==="turn_end"){const t=e.message?.usage;t&&(z+=t.input??0,H+=t.output??0),i.requestRender()}}),i.addChild(X),i.addChild(g),i.addChild(Q),i.addChild(Z),i.setFocus(v),i.start(),$(`started; focus=${i.focusedComponent===v?"editor":"other"} isTTY=${process.stdin.isTTY}`),g.addChild(new x(`${Ne}\u2713${s} Naraya native \u2014 naraya/${h}. Ketik pesan, Enter kirim.`,1,0)),Se().then(()=>i.requestRender());

package/bin/naraya.mjs

@@ -1,143 +1,2 @@
 #!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { seed } from "../src/seed.mjs";
-
-const NARAYA_DIR = path.join(os.homedir(), ".naraya", "agent");
-
-// Subcommand dispatch — handled before pi resolution so these never depend on
-// the agent binary or an existing models.json.
-const sub = process.argv[2];
-if (sub === "login" || sub === "logout" || sub === "status") {
-  // `--base <url>` (or NARAYA_BASE) selects the gateway, robust across shells.
-  const { resolveBase } = await import("../src/config.mjs");
-  const base = resolveBase(process.argv);
-  if (sub === "login") {
-    const { login } = await import("../src/login.mjs");
-    await login(NARAYA_DIR, base);
-  } else if (sub === "logout") {
-    fs.rmSync(path.join(NARAYA_DIR, "models.json"), { force: true });
-    console.log("Signed out. Revoke the 'Naraya CLI' key in your dashboard.");
-  } else {
-    const { status } = await import("../src/status.mjs");
-    await status(NARAYA_DIR, base, { usd: process.argv.includes("--usd") });
-  }
-  process.exit(0);
-}
-
-// Resolve pi's bin from our own pinned dependency, never from PATH. The package
-// is ESM-only (exports has no "require" condition), so use import.meta.resolve
-// to find its main entry, walk up to the package root, then read bin from disk.
-function piPackageRoot() {
-  let dir = path.dirname(fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent")));
-  while (!fs.existsSync(path.join(dir, "package.json"))) {
-    const up = path.dirname(dir);
-    if (up === dir) throw new Error("could not locate @earendil-works/pi-coding-agent package root");
-    dir = up;
-  }
-  return dir;
-}
-const piRoot = piPackageRoot();
-const piPkgPath = path.join(piRoot, "package.json");
-const piPkg = JSON.parse(fs.readFileSync(piPkgPath, "utf8"));
-const piBinField = piPkg.bin;
-const piBinRel = typeof piBinField === "string" ? piBinField : piBinField.pi;
-const piBin = path.join(piRoot, piBinRel);
-
-// White-label the engine: pi reads `piConfig.name` from its own package.json and
-// uses it as the app name + window title (otherwise "pi"/"π"). Set it to Naraya
-// so the terminal title is "Naraya - …" instead of "π - …". This is pi's own
-// white-label mechanism; the patch is idempotent. Best-effort: a read-only
-// install just keeps the default title.
-const APP = "Naraya";
-function ensureRebrand() {
-  try {
-    if (piPkg.piConfig?.name === APP) return;
-    piPkg.piConfig = { ...(piPkg.piConfig ?? {}), name: APP };
-    fs.writeFileSync(piPkgPath, JSON.stringify(piPkg, null, 2));
-  } catch {
-    /* read-only dependency — title stays default, everything else still works */
-  }
-}
-ensureRebrand();
-
-// Seed bundled skills + extensions into the agent config dir (managed files only).
-const pkgRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-seed(path.join(pkgRoot, "assets"), NARAYA_DIR);
-
-// Default to a quiet startup so pi's own header ("pi v0.79.1", resources list)
-// is suppressed and only the Naraya banner shows. Merge (don't clobber) the
-// user's settings; leave it alone if they've set it explicitly.
-function ensureQuietStartup() {
-  const p = path.join(NARAYA_DIR, "settings.json");
-  let s = {};
-  try { s = JSON.parse(fs.readFileSync(p, "utf8")); } catch { /* none yet */ }
-  if (s.quietStartup === undefined) {
-    s.quietStartup = true;
-    fs.mkdirSync(NARAYA_DIR, { recursive: true });
-    fs.writeFileSync(p, JSON.stringify(s, null, 2));
-  }
-}
-ensureQuietStartup();
-
-// Brand the system prompt so the model reaches for the bundled Nara skills.
-const appendSystem = path.join(pkgRoot, "assets", "APPEND-SYSTEM.md");
-
-// Default to the Naraya provider and restrict Ctrl+P model cycling to Naraya
-// models, so the experience is Naraya-only unless the user explicitly overrides.
-// Guarded on a configured `naraya` provider so we never inject an
-// unknown-provider error before `naraya login` has written models.json.
-function narayaDefaults(argv) {
-  let hasNaraya = false;
-  try {
-    const cfg = JSON.parse(fs.readFileSync(path.join(NARAYA_DIR, "models.json"), "utf8"));
-    hasNaraya = Boolean(cfg.providers?.naraya);
-  } catch {
-    /* no models.json yet — let pi handle provider resolution */
-  }
-  if (!hasNaraya) return [];
-  const extra = [];
-  if (!argv.includes("--provider")) extra.push("--provider", "naraya");
-  if (!argv.includes("--models")) extra.push("--models", "naraya/*");
-  return extra;
-}
-
-const userArgs = process.argv.slice(2);
-
-// Require sign-in before launching the agent. Skip the gate for informational
-// flags that work without a provider (version/help/model listing).
-const INFO_FLAGS = ["--version", "-v", "--help", "-h", "--list-models", "--models"];
-const isInfoOnly = userArgs.some((a) => INFO_FLAGS.includes(a));
-if (!isInfoOnly && !fs.existsSync(path.join(NARAYA_DIR, "models.json"))) {
-  console.error("Run `naraya login` first.");
-  process.exit(1);
-}
-
-// Show ONLY the bundled Nara skills: pi otherwise discovers skills from the cwd,
-// any ancestor `.agents/skills`, and global dirs, leaking unrelated skills into
-// the picker. Disable all discovery, then load just our seeded skills dir (which
-// also picks up anything the user drops in ~/.naraya/agent/skills).
-const skillArgs = userArgs.includes("--no-skills")
-  ? []
-  : ["--no-skills", "--skill", path.join(NARAYA_DIR, "skills")];
-
-const piArgs = [piBin, "--append-system-prompt", appendSystem, ...skillArgs, ...narayaDefaults(userArgs), ...userArgs];
-
-const child = spawn(process.execPath, piArgs, {
-  stdio: "inherit",
-  // PI_OFFLINE silences the "pi update available / pi.dev" startup banner (a
-  // startup network op); model calls happen at runtime and are unaffected.
-  // Set BOTH agent-dir env names: pi reads `<APP_NAME>_CODING_AGENT_DIR`, which
-  // becomes NARAYA_CODING_AGENT_DIR once the rebrand patch applies, but stays
-  // PI_CODING_AGENT_DIR if the patch couldn't write — so set both.
-  env: {
-    ...process.env,
-    PI_CODING_AGENT_DIR: NARAYA_DIR,
-    NARAYA_CODING_AGENT_DIR: NARAYA_DIR,
-    PI_OFFLINE: "1",
-  },
-});
-child.on("exit", (code) => process.exit(code ?? 0));
+import{spawn as A}from"node:child_process";import{fileURLToPath as u,pathToFileURL as k}from"node:url";import r from"node:fs";import i from"node:path";import v from"node:os";import{seed as N,seedEntries as R}from"../src/seed.mjs";const o=i.join(v.homedir(),".naraya","agent"),n=process.argv[2];if(n==="login"||n==="logout"||n==="status"||n==="pentest"||n==="mcp"){const{resolveBase:e}=await import("../src/config.mjs"),s=e(process.argv);if(n==="login"){const{login:t}=await import("../src/login.mjs");await t(o,s)}else if(n==="logout")r.rmSync(i.join(o,"models.json"),{force:!0}),console.log("Signed out. Revoke the 'Naraya CLI' key in your dashboard.");else if(n==="status"){const{status:t}=await import("../src/status.mjs");await t(o,s,{usd:process.argv.includes("--usd")})}else if(n==="pentest"){const{pentestCLI:t}=await import("../dist/pentest/cli.js");await t(process.argv)}else if(n==="mcp"){const{mcpCLI:t,ensureBundledMcpServers:a}=await import("../src/mcp-cli.mjs");a(),await t(process.argv)}process.exit(0)}function P(){let e=i.dirname(u(import.meta.resolve("@earendil-works/pi-coding-agent")));for(;!r.existsSync(i.join(e,"package.json"));){const s=i.dirname(e);if(s===e)throw new Error("could not locate @earendil-works/pi-coding-agent package root");e=s}return e}const y=P(),g=i.join(y,"package.json"),p=JSON.parse(r.readFileSync(g,"utf8")),f=p.bin,O=typeof f=="string"?f:f.pi,T=i.join(y,O),h="Naraya";function x(){try{if(p.piConfig?.name===h)return;p.piConfig={...p.piConfig??{},name:h},r.writeFileSync(g,JSON.stringify(p,null,2))}catch{}}x();const m=i.dirname(i.dirname(u(import.meta.url))),S=i.join(m,"assets");if(r.existsSync(S))N(S,o);else{const{readPack:e}=await import("../src/assets-pack.mjs");R(e(i.join(m,"dist","assets.pack.gz")),o)}function I(){const e=i.join(o,"settings.json");let s={};try{s=JSON.parse(r.readFileSync(e,"utf8"))}catch{}let t=!1;s.quietStartup===void 0&&(s.quietStartup=!0,t=!0),s.narayaThemeApplied||(s.theme="naraya",s.narayaThemeApplied=!0,t=!0),s.retry===void 0&&(s.retry={enabled:!0,maxRetries:10,baseDelayMs:1e3},t=!0),t&&(r.mkdirSync(o,{recursive:!0}),r.writeFileSync(e,JSON.stringify(s,null,2)))}I();const b=i.join(o,"SYSTEM.md"),F=i.join(o,"APPEND-SYSTEM.md");function _(e){let s=!1;try{s=!!JSON.parse(r.readFileSync(i.join(o,"models.json"),"utf8")).providers?.naraya}catch{}if(!s)return[];const t=[];return e.includes("--provider")||t.push("--provider","naraya"),e.includes("--models")||t.push("--models","naraya/*"),t}const l=process.argv.slice(2),B=["--version","-v","--help","-h","--list-models","--models"],d=l.some(e=>B.includes(e));if(!d)if(process.stdout.isTTY){const{splash:e}=await import("../src/splash.mjs"),s=await e();if(!s.ok)if(s.reason==="login"||s.reason==="expired"){const{resolveBase:t}=await import("../src/config.mjs"),{login:a}=await import("../src/login.mjs");try{await a(o,t(process.argv))}catch(c){console.error(`Login gagal: ${c.message}`),process.exit(1)}}else process.exit(1)}else r.existsSync(i.join(o,"models.json"))||(console.error("Run `naraya login` first."),process.exit(1));if(!d)try{const e=i.join(o,"models.json"),t=JSON.parse(r.readFileSync(e,"utf8")).providers?.naraya;if(t?.apiKey&&t?.baseUrl){const a=await fetch(`${t.baseUrl}/models`,{headers:{authorization:`Bearer ${t.apiKey}`},signal:AbortSignal.timeout(3e3)});if(a.ok){const c=(await a.json()).data;if(Array.isArray(c)&&c.length>0){const{writeModelsConfig:j}=await import("../src/config.mjs");j(o,t.apiKey,c,t.baseUrl)}}}}catch{}if(!d)try{const{ensureBundledMcpServers:e}=await import("../src/mcp-cli.mjs");e()}catch{}if(!d&&process.stdout.isTTY)try{const{printBanner:e}=await import("../src/banner.mjs");await e()}catch{}const w=i.join(o,"skills"),D=l.includes("--no-skills")?[]:r.existsSync(w)?["--no-skills","--skill",w]:["--no-skills"],C=k(i.join(i.dirname(u(import.meta.url)),"undici-timeout.mjs")).href,E=l.includes("--system-prompt")?[]:["--system-prompt",b],Y=["--import",C,T,...E,"--append-system-prompt",F,...D,..._(l),...l],L=A(process.execPath,Y,{stdio:"inherit",env:{...process.env,PI_CODING_AGENT_DIR:o,NARAYA_CODING_AGENT_DIR:o,PI_OFFLINE:"1",NARAYA_PKG_ROOT:m,NARAYA_VERSION:(()=>{try{return JSON.parse(r.readFileSync(i.join(m,"package.json"),"utf8")).version??""}catch{return""}})()}});L.on("exit",async e=>{if(process.stdout.isTTY&&!d)try{const{printBye:s}=await import("../src/goodbye.mjs");s()}catch{}process.exit(e??0)});

package/bin/undici-timeout.mjs

@@ -0,0 +1 @@
+import{setGlobalDispatcher as e,Agent as t}from"undici";e(new t({headersTimeout:0,bodyTimeout:0,keepAliveTimeout:6e4,keepAliveMaxTimeout:6e5,connect:{timeout:3e4}}));

package/dist/mcp/config-loader.js

@@ -0,0 +1,32 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function loadMcpConfig(projectDir, globalDir) {
+    const globalPath = path.join(globalDir, "mcp.json");
+    const projectPath = path.join(projectDir, ".mcp.json");
+    let globalConfig = { mcpServers: {} };
+    let projectConfig = { mcpServers: {} };
+    try {
+        if (fs.existsSync(globalPath)) {
+            globalConfig = JSON.parse(fs.readFileSync(globalPath, "utf8"));
+        }
+    }
+    catch {
+        // Ignore malformed global config
+    }
+    try {
+        if (fs.existsSync(projectPath)) {
+            projectConfig = JSON.parse(fs.readFileSync(projectPath, "utf8"));
+        }
+    }
+    catch {
+        // Ignore malformed project config
+    }
+    // Merge: project wins on conflict
+    const merged = {
+        mcpServers: {
+            ...globalConfig.mcpServers,
+            ...projectConfig.mcpServers
+        }
+    };
+    return merged;
+}

package/dist/mcp/lifecycle.js

@@ -0,0 +1,90 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { createTransport } from "./transport.js";
+export class McpManager {
+    config;
+    servers = new Map();
+    projectDir;
+    constructor(config, projectDir) {
+        this.config = config;
+        this.projectDir = projectDir;
+    }
+    async start() {
+        const serverEntries = Object.entries(this.config.mcpServers ?? {});
+        for (const [name, serverConfig] of serverEntries) {
+            await this.startServer(name, serverConfig);
+        }
+    }
+    async startServer(name, config) {
+        try {
+            const transport = await createTransport(config, this.projectDir);
+            const client = new Client({ name: "naraya-cli", version: "0.2.4" }, { capabilities: {} });
+            const connection = {
+                client,
+                transport,
+                config,
+                tools: [],
+                status: "connecting"
+            };
+            this.servers.set(name, connection);
+            await client.connect(transport);
+            connection.status = "connected";
+            // Discover tools
+            const toolsResult = await client.listTools();
+            connection.tools = toolsResult.tools ?? [];
+        }
+        catch (err) {
+            const connection = this.servers.get(name);
+            if (connection) {
+                connection.status = "failed";
+                connection.error = err.message;
+            }
+            console.error(`[MCP] Failed to start server '${name}': ${err.message}`);
+        }
+    }
+    async stop() {
+        for (const [name, conn] of this.servers.entries()) {
+            try {
+                if (conn.status === "connected") {
+                    await conn.client.close();
+                }
+                conn.status = "disconnected";
+            }
+            catch (err) {
+                console.error(`[MCP] Error stopping server '${name}': ${err.message}`);
+            }
+        }
+        this.servers.clear();
+    }
+    getServerStatus() {
+        const result = {};
+        for (const [name, conn] of this.servers.entries()) {
+            result[name] = {
+                status: conn.status,
+                toolCount: conn.tools.length,
+                error: conn.error
+            };
+        }
+        return result;
+    }
+    async callTool(serverName, toolName, params) {
+        const conn = this.servers.get(serverName);
+        if (!conn) {
+            throw new Error(`MCP server '${serverName}' not found`);
+        }
+        if (conn.status !== "connected") {
+            throw new Error(`MCP server '${serverName}' is not connected (status: ${conn.status})`);
+        }
+        return await conn.client.callTool({ name: toolName, arguments: params });
+    }
+    getTools() {
+        const result = [];
+        for (const [serverName, conn] of this.servers.entries()) {
+            if (conn.status === "connected") {
+                for (const tool of conn.tools) {
+                    result.push({ serverName, tool });
+                }
+            }
+        }
+        return result;
+    }
+}

package/dist/mcp/tool-mapper.js

@@ -0,0 +1,31 @@
+export function mapMcpToolToPi(serverName, mcpTool) {
+    const toolName = `mcp__${serverName}__${mcpTool.name}`;
+    const label = `${serverName}: ${mcpTool.name}`;
+    const description = mcpTool.description ?? `MCP tool: ${mcpTool.name}`;
+    return {
+        name: toolName,
+        label,
+        description,
+        parameters: mcpTool.inputSchema ?? { type: "object", properties: {} }
+    };
+}
+export function mapMcpResultToPi(result) {
+    const content = result.content ?? [];
+    return {
+        content: content.map((c) => {
+            if (c.type === "text")
+                return { type: "text", text: c.text };
+            if (c.type === "image")
+                return { type: "image", data: c.data, mimeType: c.mimeType };
+            return { type: "text", text: JSON.stringify(c) };
+        }),
+        details: {}
+    };
+}
+export function mapMcpErrorToPi(err) {
+    return {
+        content: [{ type: "text", text: `MCP error: ${err.message}` }],
+        isError: true,
+        details: {}
+    };
+}