@nonbot/cli 0.10.14 → 0.10.16

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 What changed for the person running the CLI, newest first. Update with
 `npm i -g @nonbot/cli@latest`.
 
+## 0.10.16 (2026-11-11)
+
+- New: `nonbot mcp` shows the non.bot MCP in one place: its version and what's new since, every Claude app and config file it's set up in (and duplicates), a live start with its tool count by group, how much of each conversation its tool list uses, which tools your apps switch off, the token it uses (last four characters only), whether that token is valid and what it may do, and which tools Claude runs without asking. `--quick` skips the live start.
+- Typing `nonbot` alone now has a **help** option under update: click it (or press h) and the full command list prints right below; any other key exits. Outside a real terminal it never waits. `nonbot help` also works.
+- `nonbot doctor` opens with the gradient wordmark and reads as one tidy grid. It now starts the MCP too and shows the result ("170 tools in 281ms"), lists retired MCP servers on one row with `nonbot mcp clean`, and points at `nonbot mcp` for the full check.
+- A project's own `.mcp.json` is never started until you approve it once (`nonbot mcp test --include-project` shows the exact command and asks). The approval is remembered for that exact command only, so a repo that later changes it has to be approved again.
+- New: `nonbot mcp test` starts every configured copy and checks it answers; `nonbot mcp add` registers it in Claude Code; `nonbot mcp clean` removes retired MCP servers from the files they're in (it asks first, and keeps a backup of Claude Desktop's config).
+
+## 0.10.15 (2026-11-11)
+
+- New: `nonbot logout` signs you out on this machine and stops the daemon.
+- New: `nonbot update` installs the latest version. The daemon's update notice now points at it.
+- The daemon's startup list now says how to stop it (Ctrl-C in its window, or `nonbot daemon stop`) and how to sign out.
+- `nonbot doctor` is easier to read: grouped sections, bare version numbers, no wrapped lines, no rows for retired MCP servers, and a short list of commands at the end. If Run is switched off for your account, it now says so and links to where you switch it on, instead of showing "HTTP 403".
+- `nonbot doctor` now finds the non.bot MCP in a project's `.mcp.json` and in Claude Desktop, not only in `~/.claude.json`, and shows its version and how it is installed (npx, remote, global or a source checkout).
+- New: `nonbot update mcp` shows the non.bot MCP's version and updates it. A global install is updated with npm. The npx setup updates itself each time Claude Code starts it and the remote server is always current, so for those it tells you what to do instead of running anything.
+- The non.bot block wordmark is back with a shaded aqua → violet → orchid gradient, on the daemon and on the bare `nonbot` screen. The dot takes the same gradient as the letters beside it.
+- Typing `nonbot` alone shows the wordmark and a short start-here list (login · daemon · doctor · logout · update). `nonbot --help` is grouped, fits 80 columns, and no longer lists the commands only Claude Code runs.
+
 ## 0.10.14 (2026-11-11)
 
 - The README now lists what the daemon sends from your machine and who can read it.

package/LICENSE

@@ -6,24 +6,35 @@ This software (the "@nonbot/cli" package and all of its contents, the
 "Software") is the proprietary and confidential property of non.bot. It is
 published to the npm registry for the sole purpose of allowing authorized
 non.bot account holders to install and run it as the local host for the
-non.bot "Run" feature.
+non.bot "Run" feature. Publication on the npm registry, or on any mirror, cache
+or CDN that copies it, does not make the Software open source, does not place
+it in the public domain, and grants no right beyond the limited license below.
 
 PERMITTED USE
 
-Subject to your compliance with the non.bot Terms of Service, you are granted
-a limited, non-exclusive, non-transferable, revocable license to download,
-install, and execute unmodified copies of the Software on machines you control,
-solely to connect to and operate the non.bot service.
+Subject to your compliance with the non.bot Terms of Service
+(https://non.bot/terms-of-service), you are granted a limited, non-exclusive,
+non-transferable, non-sublicensable, revocable license to download, install,
+and execute unmodified copies of the Software on machines you control, solely
+to connect to and operate the non.bot service. This license ends automatically
+if you breach it or the Terms of Service, or when your non.bot account ends;
+you must then stop using the Software and delete every copy of it.
 
 PROHIBITED WITHOUT PRIOR WRITTEN PERMISSION FROM non.bot
 
-  - Copying, redistributing, sublicensing, selling, or publishing the Software
-    or any portion of it;
+  - Copying, redistributing, sublicensing, selling, renting, or publishing the
+    Software or any portion of it;
   - Modifying, adapting, translating, or creating derivative works;
-  - Reverse-engineering, decompiling, or disassembling the Software except to
-    the limited extent such restriction is prohibited by applicable law;
-  - Using the Software, or any technique, method, or design embodied in it, to
-    build, train, or operate a competing product or service.
+  - Reverse-engineering, decompiling, or disassembling the Software, except to
+    the limited extent applicable law expressly permits despite this
+    restriction;
+  - Using the Software, or any technique, method, prompt, or design embodied in
+    it, to build, train, or operate a competing product or service;
+  - Using the Software, or any part or output of it, to train, fine-tune,
+    evaluate, or otherwise improve any machine-learning or artificial-
+    intelligence model, dataset, or system;
+  - Removing, obscuring, or altering any copyright, license, or proprietary
+    notice.
 
 NO PATENT OR OTHER IP LICENSE
 

package/README.md

@@ -58,10 +58,10 @@ nonbot daemon
 ```
 
 `nonbot doctor` is the one-stop health check and the first thing to run when something
-looks off. It reports your platform, login state, server reachability, the last daemon
-heartbeat, which provider CLIs are on `PATH`, which terminal will be launched and whether
-its launcher binary exists, the macOS Automation state for iTerm, and the MCP servers
-and skill bundles the agents expect.
+looks off. It reports your login, server reachability, whether the Run app is on for
+your account, the last daemon heartbeat, which agent CLIs are installed, which terminal
+Runs open in, the macOS Automation state for iTerm, and whether the `nonbot` MCP server
+is set up in Claude Code — then lists how to start, stop and sign out.
 
 Non-interactive login (for CI or scripting):
 
@@ -73,11 +73,19 @@ nonbot login --token "$NONBOT_PAT"
 
 ```
 nonbot login            Log in with a Personal Access Token
+nonbot logout           Sign out on this machine and stop the daemon
 nonbot daemon           Run the poll loop and launch terminals (the main command)
 nonbot run <id>         Launch a single Run by id, then exit
 nonbot status           Show login + daemon status
 nonbot doctor           Health check — platform, auth, server, providers, terminal, MCP
+nonbot mcp              The non.bot MCP: version, where it's set up, a live start, tools,
+                        your token's permissions (add --quick to skip starting it)
+nonbot mcp test         Start every configured copy of the MCP and check it answers
+nonbot mcp add          Register the MCP in Claude Code (claude mcp add … @nonbot/mcp)
+nonbot mcp clean        Remove retired MCP servers (portfolio-mcp, context-graph, jobshop-mcp)
 nonbot logs             Show recent local Run launches
+nonbot update           Install the latest version (npm i -g @nonbot/cli@latest)
+nonbot update mcp       Show the MCP's version and update it
 nonbot profiles         List configured accounts
 nonbot choir <session>  Coordinated-run engine — one agent per git worktree, merged back by hand
 nonbot run-mcp          Per-pane MCP server over stdio (launched by .mcp.json, not by hand)
@@ -95,7 +103,7 @@ nonbot --version        Print the version
 | `--profile <name>` | Use a named account instead of the default (works anywhere in the command) |
 | `daemon --install` / `--uninstall` | Run the daemon automatically at login (macOS launchd / Linux systemd user unit; not available on Windows) |
 | `daemon --cloud` | Containerized runner mode — see **Cloud runners** below |
-| `daemon stop` | Stop the local daemon; `--machine <id>` / `--all` stop daemons on other machines |
+| `daemon stop` | Stop the local daemon from another terminal (or press Ctrl-C in the daemon's own window); `--machine <id>` / `--all` stop daemons on other machines |
 
 ## Cost ceilings
 
@@ -133,7 +141,7 @@ daemon asks the npm registry for the latest `@nonbot/cli`. If it is newer than t
 running, it prints a single line:
 
 ```
-Update available: @nonbot/cli 0.9.13 → 0.9.14  (npm i -g @nonbot/cli)
+Update available: @nonbot/cli 0.9.13 → 0.9.14  (run: nonbot update)
 ```
 
 The probe has a 3-second timeout and any failure is silent. Set
@@ -181,6 +189,13 @@ are redacted. Redaction is pattern-based; treat a snapshot as terminal output.
 saved end-of-run output in the local history (`nonbot logs`). A cloud runner
 (`--cloud`) additionally registers its machine id and its allowed repository origins.
 
+**When you run `nonbot mcp` or `nonbot update mcp`:** your token goes to non.bot to
+check it is valid and read its permissions and which apps are on; the CLI asks the npm
+registry for `@nonbot/mcp`'s versions and fetches the mcp.non.bot home page to read
+its version. `nonbot mcp` (not `--quick`) also starts the MCP the way Claude does,
+which makes the MCP's own requests to non.bot. The token is shown only as its last
+four characters.
+
 To show a neutral name instead of the host name, set `NONBOT_MACHINE_NAME` before
 starting the daemon (up to 64 characters):
 

package/dist/commands/daemon.js

@@ -572,6 +572,8 @@ export async function runDaemonCommand(args = [], options = {}, deps = {}) {
         ['LISTENING', `${hostUrl}/api/cli/activations/pending`],
         ['PROFILE', profileName],
         ['LANDING', terminalLabel],
+        ['STOP', 'Ctrl-C in this window  ·  or  nonbot daemon stop  from another terminal'],
+        ['SIGN OUT', 'nonbot logout  ·  signs out on this machine and stops the daemon'],
     ];
     const LABEL_WIDTH = 9;
     for (const [k, v] of ctxRows) {

package/dist/commands/doctor.js

@@ -3,66 +3,19 @@ import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { loadAuth } from '../lib/auth.js';
+import { scanMcpConfigs, describeNonbotMcp, LEGACY_MCP_NAMES } from '../lib/mcp-config.js';
+import { nonbotMcpStatuses, mcpRow } from '../lib/mcp-status.js';
+import { launchSpecOf } from '../lib/mcp-config.js';
+import { probeMcp } from '../lib/mcp-probe.js';
+import { mayStartEntry } from '../lib/mcp-trust.js';
 import { resolveTerminal } from '../lib/terminal.js';
 import { VERSION } from '../version.js';
-import { header, statusRow, errorBlock } from '../lib/output.js';
+import { header, statusRow, errorBlock, isTTY, ANSI, wordmarkArt, WORDMARK_WIDTH } from '../lib/output.js';
 const HEARTBEAT_FRESH_MS = 35_000;
 const PROVIDER_CLIS = ['claude', 'codex', 'gemini'];
-const NONBOT_MCP_ADD_HINT = 'claude mcp add nonbot -e NON_BOT_API_TOKEN=pat_<token> -- npx -y @nonbot/mcp';
-const EXPECTED_MCPS = [
-    {
-        name: 'nonbot',
-        required: true,
-        present: '@nonbot/mcp',
-        absent: `not configured in ~/.claude.json — ${NONBOT_MCP_ADD_HINT}`,
-    },
-    {
-        name: 'portfolio-mcp',
-        required: false,
-        present: 'legacy — superseded by @nonbot/mcp',
-        absent: 'optional — not configured (legacy, superseded by @nonbot/mcp)',
-    },
-    {
-        name: 'context-graph',
-        required: false,
-        present: 'legacy — superseded by @nonbot/mcp',
-        absent: 'optional — not configured (legacy, superseded by @nonbot/mcp)',
-    },
-    {
-        name: 'jobshop-mcp',
-        required: false,
-        present: 'optional — JobShop is hidden for launch',
-        absent: 'optional — not configured (JobShop is hidden for launch)',
-    },
-];
+export const NONBOT_MCP_ADD_HINT = 'claude mcp add nonbot -- npx -y @nonbot/mcp';
+const LEGACY_MCPS = LEGACY_MCP_NAMES;
 const EXPECTED_SKILLS = [];
-function readConfiguredMcpNames() {
-    const out = new Set();
-    try {
-        const path = join(homedir(), '.claude.json');
-        if (!existsSync(path))
-            return out;
-        const json = JSON.parse(readFileSync(path, 'utf-8'));
-        const projects = json?.projects && typeof json.projects === 'object' ? json.projects : null;
-        if (projects) {
-            for (const proj of Object.values(projects)) {
-                const servers = proj?.mcpServers;
-                if (servers && typeof servers === 'object') {
-                    for (const name of Object.keys(servers))
-                        out.add(name);
-                }
-            }
-        }
-        const top = json?.mcpServers;
-        if (top && typeof top === 'object') {
-            for (const name of Object.keys(top))
-                out.add(name);
-        }
-    }
-    catch {
-    }
-    return out;
-}
 function isSkillInstalled(skillName) {
     const base = join(homedir(), '.claude');
     const candidates = [];
@@ -136,7 +89,12 @@ function probe(cmd, args, interpret = (out) => ({
 function defaultCheckBinary(bin) {
     if (bin.startsWith('mcp:')) {
         const name = bin.slice('mcp:'.length);
-        return { installed: readConfiguredMcpNames().has(name) };
+        const scan = scanMcpConfigs();
+        if (name === 'nonbot') {
+            const first = scan.nonbot[0];
+            return first ? { installed: true, version: describeNonbotMcp(first) } : { installed: false };
+        }
+        return scan.names.has(name) ? { installed: true, version: scan.where.get(name) } : { installed: false };
     }
     if (bin.startsWith('skill:')) {
         const name = bin.slice('skill:'.length);
@@ -160,6 +118,15 @@ function defaultCheckBinary(bin) {
         return { installed: false };
     }
 }
+export function bareVersion(raw) {
+    if (!raw)
+        return '';
+    const first = raw.split('\n')[0].trim();
+    const m = first.match(/\d+(?:\.\d+)+[0-9A-Za-z.+-]*/);
+    if (m)
+        return m[0];
+    return first.length > 40 ? first.slice(0, 39) + '…' : first;
+}
 export async function runDoctorCommand(args = [], deps = {}) {
     void args;
     const log = deps.log ?? ((s) => process.stdout.write(s));
@@ -169,46 +136,50 @@ export async function runDoctorCommand(args = [], deps = {}) {
     const now = deps.now ?? (() => Date.now());
     const checkBinary = deps.checkBinary ?? defaultCheckBinary;
     let exitCode = 0;
-    log(header('non.bot doctor', `v${VERSION}  ·  ${process.platform}/${process.arch}`) + '\n');
-    log('\n');
+    const row = (sig, label, detail = '') => log(statusRow(sig, label, detail, { labelWidth: LABEL_WIDTH }) + '\n');
+    const errRow = (sig, label, detail = '') => errLog(statusRow(sig, label, detail, { labelWidth: LABEL_WIDTH, stream: process.stderr }) + '\n');
+    const hint = (text) => log(' '.repeat(HINT_INDENT) + paintDim(text) + '\n');
+    const section = (title) => log('\n' + paintSection(title) + '\n');
+    const cols = deps.columns ?? process.stdout.columns ?? 0;
+    const sub = `doctor  ·  v${VERSION}  ·  ${process.platform}/${process.arch}`;
+    if (cols === 0 || cols >= WORDMARK_WIDTH + 4) {
+        log('\n' + wordmarkArt({ indent: '  ' }) + '\n\n');
+        log(`  ${paintDim(sub)}\n`);
+    }
+    else {
+        log(header('non.bot doctor', `v${VERSION}  ·  ${process.platform}/${process.arch}`) + '\n');
+    }
     const auth = await loader();
     if (!auth) {
+        log('\n');
         log(errorBlock('Not logged in', 'Run `nonbot login` to authenticate.'));
         return 1;
     }
-    log(statusRow('✓', 'Auth', `logged in as ${auth.email}`) + '\n');
-    let serverOk = false;
+    section('ACCOUNT');
+    row('✓', 'Signed in', auth.email);
+    const headers = {
+        Authorization: `Bearer ${auth.pat}`,
+        'X-Requested-With': 'ConradPM-Native',
+        'X-CLI-Version': VERSION,
+    };
     try {
-        const res = await fetchImpl(`${auth.baseUrl}/api/auth/me`, {
-            headers: {
-                Authorization: `Bearer ${auth.pat}`,
-                'X-Requested-With': 'ConradPM-Native',
-                'X-CLI-Version': VERSION,
-            },
-        });
+        const res = await fetchImpl(`${auth.baseUrl}/api/auth/me`, { headers });
         if (res.ok) {
-            serverOk = true;
-            log(statusRow('✓', 'Server reachable', `${auth.baseUrl} · PAT valid`) + '\n');
+            row('✓', 'Server', `${auth.baseUrl.replace(/^https?:\/\//, '')} · token accepted`);
         }
         else if (res.status === 401) {
-            errLog(statusRow('✗', 'Server', `PAT rejected (HTTP 401) — re-run: nonbot login`, { stream: process.stderr }) + '\n');
+            errRow('✗', 'Server', 'token rejected (HTTP 401) — sign in again: nonbot login');
             exitCode = 1;
         }
         else {
-            log(statusRow('⚠', 'Server', `returned HTTP ${res.status} for /api/auth/me`) + '\n');
+            row('⚠', 'Server', `${auth.baseUrl} answered HTTP ${res.status}`);
         }
     }
     catch (e) {
-        log(statusRow('⚠', 'Server', `Could not reach ${auth.baseUrl}: ${e.message}`) + '\n');
+        row('⚠', 'Server', `Could not reach ${auth.baseUrl} (${e.message})`);
     }
     try {
-        const res = await fetchImpl(`${auth.baseUrl}/api/cli/daemon-status`, {
-            headers: {
-                Authorization: `Bearer ${auth.pat}`,
-                'X-Requested-With': 'ConradPM-Native',
-                'X-CLI-Version': VERSION,
-            },
-        });
+        const res = await fetchImpl(`${auth.baseUrl}/api/cli/daemon-status`, { headers });
         if (res.ok) {
             const body = (await res.json());
             const last = body.lastSeenAt ?? body.lastHeartbeatAt;
@@ -216,86 +187,172 @@ export async function runDoctorCommand(args = [], deps = {}) {
                 (typeof last === 'number' && now() - last <= HEARTBEAT_FRESH_MS);
             if (fresh) {
                 const detail = typeof last === 'number'
-                    ? `last heartbeat ${Math.round((now() - last) / 1000)}s ago`
-                    : 'connected';
-                log(statusRow('✓', 'Daemon running', detail) + '\n');
+                    ? `running · last heartbeat ${Math.round((now() - last) / 1000)}s ago`
+                    : 'running';
+                row('✓', 'Daemon', detail);
             }
             else {
-                log(statusRow('✗', 'Daemon not running', 'no recent heartbeat — start with: nonbot daemon') + '\n');
+                row('✗', 'Daemon', 'not running — start it: nonbot daemon');
             }
         }
         else if (res.status === 401) {
-            log(statusRow('⚠', 'Daemon status unknown', '(auth rejected)') + '\n');
+            row('⚠', 'Daemon', 'status unknown (auth rejected)');
+        }
+        else if (res.status === 403) {
+            let gate = {};
+            try {
+                gate = (await res.json());
+            }
+            catch {
+            }
+            const storeUrl = `${auth.baseUrl}/whygraph/store?tab=apps&app=${gate.app ?? 'run'}`;
+            if (gate.error === 'app_disabled') {
+                row('✗', 'Run app', 'switched off — the daemon gets no runs');
+                hint(`turn it on: ${storeUrl}`);
+            }
+            else if (gate.error === 'app_not_installed') {
+                row('✗', 'Run app', 'not added — the daemon gets no runs until it is');
+                hint(`add it: ${storeUrl}`);
+            }
+            else {
+                row('⚠', 'Daemon', 'status unknown (HTTP 403)');
+            }
         }
         else {
-            log(statusRow('⚠', 'Daemon status unknown', `(HTTP ${res.status})`) + '\n');
+            row('⚠', 'Daemon', `status unknown (HTTP ${res.status})`);
         }
     }
     catch (e) {
-        log(statusRow('⚠', 'Daemon status unknown', e.message) + '\n');
+        row('⚠', 'Daemon', `status unknown (${e.message})`);
     }
-    for (const bin of PROVIDER_CLIS) {
-        const r = checkBinary(bin);
-        if (r.installed) {
-            log(statusRow('✓', bin, r.version ? `(${r.version})` : '') + '\n');
-        }
-        else {
-            log(statusRow('⚠', bin, 'not on PATH') + '\n');
-        }
+    section('AGENTS');
+    const providers = PROVIDER_CLIS.map((bin) => ({ bin, r: checkBinary(bin) }));
+    const anyProvider = providers.some((p) => p.r.installed);
+    const ordered = [...providers.filter((p) => p.r.installed), ...providers.filter((p) => !p.r.installed)];
+    for (const { bin, r } of ordered) {
+        if (r.installed)
+            row('✓', bin, bareVersion(r.version));
+        else if (anyProvider)
+            row('ℹ', bin, 'not installed (optional)');
+        else
+            row('⚠', bin, 'not on PATH');
     }
+    if (!anyProvider)
+        hint('Runs need one of these — install Claude Code: npm i -g @anthropic-ai/claude-code');
+    section('TERMINAL');
     const profile = resolveTerminal(undefined);
     const { cmd } = profile.launch('/tmp/nonbot-doctor-probe.sh');
     const launcher = checkBinary(cmd);
     if (launcher.installed) {
-        log(statusRow('✓', 'Terminal', `${profile.displayName} (launches via "${cmd}")`) + '\n');
+        row('✓', 'Opens runs in', `${profile.displayName} (via ${cmd})`);
     }
     else {
-        log(statusRow('⚠', 'Terminal', `${profile.displayName} — launcher "${cmd}" not found on PATH`) + '\n');
+        row('⚠', 'Terminal', `${profile.displayName} — launcher "${cmd}" not found on PATH`);
     }
     if (process.platform === 'win32') {
         const bash = checkBinary('bash');
-        if (bash.installed) {
-            log(statusRow('✓', 'Windows via WSL or Git Bash', 'bash found on PATH — Run scripts are #!/bin/bash') + '\n');
-        }
-        else {
-            log(statusRow('⚠', 'Windows via WSL or Git Bash', 'bash not found on PATH — install WSL or Git Bash; Run scripts are #!/bin/bash') + '\n');
-        }
+        if (bash.installed)
+            row('✓', 'bash', 'found · Windows via WSL or Git Bash — runs are #!/bin/bash');
+        else
+            row('⚠', 'bash', 'not found · Windows via WSL or Git Bash — runs are #!/bin/bash');
     }
     if (process.platform === 'darwin') {
         const running = checkBinary('iterm-running');
-        if (running.installed) {
-            log(statusRow('✓', 'iTerm running', '') + '\n');
+        if (!running.installed) {
+            row('ℹ', 'iTerm', 'not running — only needed if runs open in iTerm');
         }
         else {
-            log(statusRow('⚠', 'iTerm not running', 'to start iTerm:  open -a iTerm') + '\n');
-        }
-        const appl = checkBinary('iterm-applescript');
-        if (appl.installed) {
-            log(statusRow('✓', 'iTerm AppleScript reachable', appl.version ?? '') + '\n');
-        }
-        else {
-            log(statusRow('⚠', 'iTerm AppleScript', appl.version ? `probe failed: ${appl.version}` : 'probe failed') + '\n');
-            log('      ' + 'System Settings → Privacy & Security → Automation → allow your terminal to control iTerm.' + '\n');
+            const appl = checkBinary('iterm-applescript');
+            if (appl.installed) {
+                const v = bareVersion(appl.version);
+                row('✓', 'iTerm', v ? `${v} · AppleScript OK` : 'AppleScript OK');
+            }
+            else {
+                row('⚠', 'iTerm', appl.version ? `AppleScript blocked: ${appl.version}` : 'AppleScript blocked');
+                hint('System Settings → Privacy & Security → Automation → allow your terminal to control iTerm');
+            }
         }
     }
-    for (const mcp of EXPECTED_MCPS) {
-        const r = checkBinary(`mcp:${mcp.name}`);
-        if (r.installed) {
-            log(statusRow('✓', `MCP ${mcp.name}`, mcp.present) + '\n');
-        }
-        else {
-            log(statusRow(mcp.required ? '⚠' : 'ℹ', `MCP ${mcp.name}`, mcp.absent) + '\n');
+    section('MCP');
+    const statusSource = deps.nonbotMcp ?? (deps.checkBinary ? null : () => nonbotMcpStatuses({ fetchImpl: deps.fetchImpl }));
+    const statuses = statusSource ? await statusSource().catch(() => []) : null;
+    const nonbotMcp = statuses ? { installed: statuses.length > 0 } : checkBinary('mcp:nonbot');
+    if (statuses && statuses.length > 0) {
+        const primary = statuses.find((s) => s.entry.scope && s.entry.scope !== 'desktop') ?? statuses[0];
+        const r = mcpRow(primary);
+        row(r.sigil, 'Installed', r.detail);
+        if (r.hint)
+            hint(r.hint);
+        const startSource = deps.mcpStart ??
+            (deps.checkBinary
+                ? null
+                : async (entry) => {
+                    const spec = launchSpecOf(entry);
+                    if (!spec)
+                        return { state: 'unknown' };
+                    if (!mayStartEntry(entry, spec))
+                        return { state: 'unapproved' };
+                    return { state: 'started', result: await probeMcp(spec, { fetchImpl: deps.fetchImpl, fallbackBearer: auth.pat, timeoutMs: 20_000 }) };
+                });
+        if (startSource) {
+            const s = await startSource(primary.entry).catch(() => ({ state: 'unknown' }));
+            if (s.state === 'started' && s.result.ok) {
+                const took = s.result.ms < 1000 ? `${s.result.ms}ms` : `${(s.result.ms / 1000).toFixed(1)}s`;
+                const v = s.result.serverVersion;
+                const differs = v && primary.installed && v !== primary.installed ? ` · but reports v${v}` : '';
+                row(differs ? '⚠' : '✓', 'Starts', `${s.result.tools.length} tools in ${took}${differs}`);
+            }
+            else if (s.state === 'started') {
+                row('✗', 'Starts', s.result.error ?? 'it did not answer');
+                hint('see it fail: nonbot mcp test');
+            }
+            else if (s.state === 'unapproved') {
+                row('ℹ', 'Starts', `not started — ${primary.entry.source} is a project file`);
+                hint('approve it once: nonbot mcp test --include-project');
+            }
+            else {
+                row('ℹ', 'Starts', 'not checked — could not read how it is launched');
+            }
         }
     }
+    else if (nonbotMcp.installed) {
+        const how = nonbotMcp.version ?? 'configured (@nonbot/mcp)';
+        row(/pinned/.test(how) ? '⚠' : '✓', 'Installed', how);
+    }
+    else {
+        row('⚠', 'Not set up', 'runs cannot report back without the non.bot MCP');
+        hint('add it: nonbot mcp add');
+    }
+    const legacy = LEGACY_MCPS.map((name) => ({ name, r: checkBinary(`mcp:${name}`) })).filter((l) => l.r.installed);
+    if (legacy.length) {
+        const files = [...new Set(legacy.map((l) => l.r.version).filter((v) => !!v))];
+        row('ℹ', 'Retired', `${legacy.map((l) => l.name).join(', ')}${files.length === 1 ? ` in ${files[0]}` : ''} · remove: nonbot mcp clean`);
+    }
     for (const name of EXPECTED_SKILLS) {
         const r = checkBinary(`skill:${name}`);
-        if (r.installed) {
-            log(statusRow('✓', `Skill ${name}`, '') + '\n');
-        }
-        else {
-            log(statusRow('⚠', `Skill ${name}`, 'not installed under ~/.claude/skills/') + '\n');
-        }
+        if (r.installed)
+            row('✓', `Skill ${name}`);
+        else
+            row('⚠', `Skill ${name}`, 'not installed under ~/.claude/skills/');
     }
-    void serverOk;
+    section('COMMANDS');
+    log(commandRow('nonbot daemon', 'start listening for runs'));
+    log(commandRow('Ctrl-C', 'stop it · from another terminal: nonbot daemon stop'));
+    log(commandRow('nonbot mcp', 'the full MCP check'));
+    log(commandRow('nonbot logout', 'sign out and stop the daemon'));
     return exitCode;
 }
+const LABEL_WIDTH = 14;
+const HINT_INDENT = 3 + 1 + 2 + LABEL_WIDTH + 1;
+function paintDim(s) {
+    return isTTY(process.stdout) ? `${ANSI.dim}${s}${ANSI.reset}` : s;
+}
+function paintSection(title) {
+    return isTTY(process.stdout) ? `   ${ANSI.bold}${title}${ANSI.reset}` : `   ${title}`;
+}
+function commandRow(cmd, what) {
+    const padded = cmd.padEnd(LABEL_WIDTH + 1, ' ');
+    if (!isTTY(process.stdout))
+        return `      ${padded}${what}\n`;
+    return `      ${ANSI.cyan}${padded}${ANSI.reset}${ANSI.dim}${what}${ANSI.reset}\n`;
+}

package/dist/commands/logout.js

@@ -0,0 +1,78 @@
+import { spawnSync as nodeSpawnSync } from 'node:child_process';
+import { loadAuth, clearAuth, getActiveProfile } from '../lib/auth.js';
+import { readPidFile, stopDaemonLocally } from '../lib/daemon-lifecycle.js';
+import { header, statusRow } from '../lib/output.js';
+function defaultDaemonRunning() {
+    const pid = readPidFile();
+    if (pid !== null) {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+        }
+    }
+    try {
+        const r = nodeSpawnSync('tmux', ['has-session', '-t', 'nonbot'], {
+            encoding: 'utf-8',
+            timeout: 2000,
+            windowsHide: true,
+        });
+        return r.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runLogoutCommand(args = [], deps = {}) {
+    void args;
+    const log = deps.log ?? ((s) => process.stdout.write(s));
+    const errLog = deps.errLog ?? ((s) => process.stderr.write(s));
+    const loader = deps.loadAuth ?? loadAuth;
+    const clear = deps.clearAuth ?? clearAuth;
+    const daemonRunning = deps.daemonRunning ?? defaultDaemonRunning;
+    const stopDaemon = deps.stopDaemon ?? ((l, e) => stopDaemonLocally({ log: l, errLog: e }));
+    const profile = getActiveProfile();
+    log(header('non.bot logout', profile === 'default' ? '' : `profile ${profile}`) + '\n\n');
+    const auth = await loader();
+    const running = daemonRunning();
+    if (!auth && !running) {
+        log(statusRow('✓', 'Already signed out', 'nothing saved on this machine, no daemon running') + '\n');
+        return 0;
+    }
+    let exitCode = 0;
+    if (auth) {
+        try {
+            await clear();
+            log(statusRow('✓', 'Signed out', `${auth.email} · token removed from this machine`) + '\n');
+        }
+        catch (e) {
+            errLog(statusRow('✗', 'Sign-out failed', `could not remove the saved token: ${e.message}`, { stream: process.stderr }) + '\n');
+            exitCode = 1;
+        }
+    }
+    else {
+        log(statusRow('✓', 'Signed out', 'no token was saved on this machine') + '\n');
+    }
+    if (running) {
+        const said = [];
+        const code = await stopDaemon((s) => said.push(s), (s) => said.push(s));
+        if (code === 0) {
+            log(statusRow('✓', 'Daemon stopped', '') + '\n');
+        }
+        else {
+            const why = said.join(' ').replace(/\s+/g, ' ').replace(/^[✓✗⚠]\s*/, '').trim();
+            errLog(statusRow('⚠', 'Daemon still running', why || 'stop it with Ctrl-C in its window', { stream: process.stderr }) + '\n');
+            exitCode = 1;
+        }
+    }
+    else {
+        log(statusRow('✓', 'Daemon', 'was not running') + '\n');
+    }
+    if (auth) {
+        log('\n');
+        log(statusRow('ℹ', 'Token', `still exists on non.bot — delete it for good at ${auth.baseUrl}/settings/connections`) + '\n');
+        log(statusRow('ℹ', 'Sign back in', 'nonbot login') + '\n');
+    }
+    return exitCode;
+}