@nostale/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ferdy Hasan Isma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,36 @@
+# @nostale/cli
+
+**NoStale** extracts knowledge from your codebase, indexes it, and generates PRD/TDD documents that stay in sync with every commit — no stale docs, no manual regeneration. Browse it from a web UI; ask it questions from the coding agent you already use, over MCP. This package is the installer CLI/TUI: it runs the setup wizard, supervises the wiki's services, and diagnoses a broken install.
+
+## Install
+
+```bash
+npm install -g @nostale/cli
+nostale setup
+```
+
+No prior clone of the [nostale](https://github.com/fetot/nostale) repo is needed — the wizard walks you through personal mode (no Docker, local file DB) or server mode (full `docker-compose` stack), writes your config, runs migrations, and in personal mode provisions your first account automatically.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `nostale setup` | Interactive wizard — choose personal or server mode, configure the LLM provider, start everything |
+| `nostale start` | Start services (personal mode) or the docker compose stack (server mode) |
+| `nostale stop` | Stop services / the docker compose stack |
+| `nostale status` | Show what's running |
+| `nostale config [subcommand]` | Reconfigure an existing install — providers, templates, MCP tokens, sources, generation toggle |
+| `nostale doctor` | Diagnose a broken installation |
+
+## Personal vs. server mode
+
+**Personal mode** runs the wiki as plain local processes (no Docker), storing data in a local libSQL file — the fastest way to try NoStale on your own machine. **Server mode** runs the full stack (including `sqld`) via Docker Compose, for a team sharing one wiki; images are pulled from GHCR, so it's zero-clone too. Either mode can be reconfigured later with `nostale config`, and `nostale doctor` helps diagnose whichever one you're running.
+
+## Learn more
+
+- Repository, issues, and full documentation: [github.com/fetot/nostale](https://github.com/fetot/nostale)
+- MCP integration, configuration reference, and FAQ: see the root [README](https://github.com/fetot/nostale#readme) (a dedicated docs site is planned)
+
+## License
+
+MIT

package/assets/docker-compose.server.yml

@@ -0,0 +1,70 @@
+services:
+  sqld:
+    # Pinned, not :latest — an unpinned mutable tag makes deployments non-reproducible and
+    # silently pulls a compromised/regressed upstream image (SECURITY-REVIEW-2026-07-10.md F-16).
+    # Bump deliberately; check https://github.com/tursodatabase/libsql/pkgs/container/libsql-server for newer tags.
+    image: ghcr.io/tursodatabase/libsql-server:v0.23.7
+    environment:
+      SQLD_NODE: primary
+      SQLD_AUTH_TOKEN: ${SQLD_AUTH_TOKEN:?SQLD_AUTH_TOKEN must be set — run `nostale setup` to generate one (see SECURITY-REVIEW-2026-07-10.md F-06)}
+    volumes:
+      - wiki_data:/var/lib/sqld
+    # No host port mapping: sibling services reach sqld over the internal Compose network by
+    # service name (http://sqld:8080) already — see the root docker-compose.yml for why.
+
+  wiki-api:
+    # M23: zero-clone server mode — pull the image release.yml's build-and-push job already
+    # publishes for this exact `@nostale/cli` version, instead of building from a local checkout
+    # (there is none, in a bundled install).
+    image: ghcr.io/fetot/nostale-wiki-api:${NOSTALE_VERSION}
+    environment:
+      LIBSQL_URL: http://sqld:8080
+      LIBSQL_AUTH_TOKEN: ${SQLD_AUTH_TOKEN:?SQLD_AUTH_TOKEN must be set — run `nostale setup` to generate one (see SECURITY-REVIEW-2026-07-10.md F-06)}
+      PORT: "3001"
+      NOSTALE_MODE: server
+      WIKI_WEB_ORIGIN: http://localhost:3000
+      BETTER_AUTH_URL: ${WIKI_API_PUBLIC_URL:-http://localhost:3001}
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET must be set — run \`nostale setup\` to generate one (see SECURITY-REVIEW-2026-07-10.md F-01)}
+      SETTINGS_ENCRYPTION_KEY: ${SETTINGS_ENCRYPTION_KEY}
+      WIKI_WORKER_SHARED_SECRET: ${WIKI_WORKER_SHARED_SECRET}
+    ports: ["3001:3001"]
+    depends_on: [sqld]
+
+  wiki-web:
+    # M18: optional Web UI, same `web` profile convention as the monorepo's docker-compose.yml.
+    profiles: ["web"]
+    image: ghcr.io/fetot/nostale-wiki-web:${NOSTALE_VERSION}
+    environment:
+      WIKI_API_BASE: http://wiki-api:3001
+    ports: ["3000:3000"]
+    depends_on: [wiki-api]
+
+  wiki-worker:
+    image: ghcr.io/fetot/nostale-wiki-worker:${NOSTALE_VERSION}
+    environment:
+      LIBSQL_URL: http://sqld:8080
+      LIBSQL_AUTH_TOKEN: ${SQLD_AUTH_TOKEN:?SQLD_AUTH_TOKEN must be set — run `nostale setup` to generate one (see SECURITY-REVIEW-2026-07-10.md F-06)}
+      PORT: "3002"
+      SETTINGS_ENCRYPTION_KEY: ${SETTINGS_ENCRYPTION_KEY}
+      WIKI_WORKER_SHARED_SECRET: ${WIKI_WORKER_SHARED_SECRET}
+      LLM_PROVIDER: ${LLM_PROVIDER:-anthropic}
+      LLM_API_KEY: ${LLM_API_KEY:-}
+      LLM_BASE_URL: ${LLM_BASE_URL:-}
+    # No host port mapping — only wiki-api calls wiki-worker, over the internal Compose network.
+    depends_on: [sqld]
+
+  mcp-server:
+    image: ghcr.io/fetot/nostale-mcp-server:${NOSTALE_VERSION}
+    environment:
+      LIBSQL_URL: http://sqld:8080
+      LIBSQL_AUTH_TOKEN: ${SQLD_AUTH_TOKEN:?SQLD_AUTH_TOKEN must be set — run `nostale setup` to generate one (see SECURITY-REVIEW-2026-07-10.md F-06)}
+      PORT: "3100"
+      SETTINGS_ENCRYPTION_KEY: ${SETTINGS_ENCRYPTION_KEY}
+      LLM_PROVIDER: ${LLM_PROVIDER:-anthropic}
+      LLM_API_KEY: ${LLM_API_KEY:-}
+      LLM_BASE_URL: ${LLM_BASE_URL:-}
+    ports: ["3100:3100"]
+    depends_on: [sqld]
+
+volumes:
+  wiki_data:

package/dist/commands/config/generation.js

@@ -0,0 +1,23 @@
+/**
+ * `nostale config generation` — the M17 auto-generate-docs toggle via wiki-api's
+ * `GET/PUT /projects/:project/generation-settings`. Use `apiGet`/`apiPut` from
+ * `../../lib/http.js`.
+ */
+import { promptConfirm, promptText, printInfo, printStep } from '../../tui/prompts.js';
+import { resolveApiConfig } from '../../lib/api-config.js';
+import { apiGet, apiPut } from '../../lib/http.js';
+export async function run(installDir) {
+    const { wikiApiBase, origin } = resolveApiConfig(installDir);
+    const project = await promptText('Project key');
+    const path = `/projects/${encodeURIComponent(project)}/generation-settings`;
+    const current = await apiGet(wikiApiBase, origin, path);
+    printInfo(`Auto-generate PRD/TDD documents: ${current.autoGenerateDocs ? 'on' : 'off'}`);
+    const next = await promptConfirm('Auto-generate PRD/TDD documents with an LLM after each sync?', current.autoGenerateDocs);
+    if (next === current.autoGenerateDocs) {
+        printInfo('No change.');
+        return;
+    }
+    await apiPut(wikiApiBase, origin, path, { autoGenerateDocs: next });
+    const confirmed = await apiGet(wikiApiBase, origin, path);
+    printStep(`Auto-generate PRD/TDD documents is now: ${confirmed.autoGenerateDocs ? 'on' : 'off'}`);
+}

package/dist/commands/config/providers.js

@@ -0,0 +1,138 @@
+/**
+ * `nostale config providers` — manage `llm_provider_configs` via wiki-api's
+ * `GET/POST /settings/providers`. Use `apiGet`/`apiPost` from `../../lib/http.js`.
+ *
+ * `GET /settings/providers` never returns the API key at all. `LlmProviderConfig`
+ * (packages/rag-core/src/types.ts) has no `apiKey`/`apiKeyEncrypted` field, and
+ * `mapLlmProviderConfigRow` (store-libsql.ts) only copies id/provider/label/baseUrl/
+ * defaultModel/isActive/createdByUserId/createdAt/updatedAt off the row — so there is
+ * nothing to redact defensively here, the key structurally cannot round-trip.
+ *
+ * `upsertLlmProviderConfig` upserts by the (provider, label) natural key (008_llm_provider_configs_unique.sql)
+ * — POSTing the same provider+label again updates that row in place rather than creating a
+ * new one. Edit/Deactivate below rely on this: they re-POST with the target's existing
+ * provider+label, so the mutation lands on the same row.
+ */
+import { resolveApiConfig } from '../../lib/api-config.js';
+import { apiGet, apiPost } from '../../lib/http.js';
+import { promptSelect, promptText, promptPassword, promptConfirm, printStep, printInfo } from '../../tui/prompts.js';
+function formatProvider(p) {
+    const status = p.isActive ? 'active' : 'inactive';
+    return `  ${p.id}  ${p.provider}/${p.label}  model=${p.defaultModel}  [${status}]`;
+}
+async function fetchProviders(wikiApiBase, origin) {
+    return apiGet(wikiApiBase, origin, '/settings/providers');
+}
+async function listProviders(wikiApiBase, origin) {
+    const providers = await fetchProviders(wikiApiBase, origin);
+    printStep('LLM providers');
+    if (providers.length === 0) {
+        printInfo('(none yet)');
+    }
+    else {
+        for (const p of providers)
+            printInfo(formatProvider(p));
+    }
+    return providers;
+}
+/**
+ * Shared by Add and Edit — Add prompts every field; Edit fixes `provider`/`label` (the
+ * natural key the backend upserts on, per 008_llm_provider_configs_unique.sql) to the
+ * existing row's values so the mutation updates it in place instead of creating a new row
+ * under a different key, and only prompts for the genuinely mutable fields.
+ */
+async function askProviderFields(existing) {
+    let provider;
+    let label;
+    if (existing) {
+        provider = existing.provider;
+        label = existing.label;
+    }
+    else {
+        provider = await promptSelect('Provider', [
+            { label: 'Anthropic', value: 'anthropic' },
+            { label: 'OpenAI-compatible (self-hosted / proxy)', value: 'openai_compatible' },
+        ]);
+        label = await promptText('Label');
+    }
+    const apiKey = await promptPassword(existing ? 'API key (required again — the existing key is never returned, so it cannot be pre-filled)' : 'API key');
+    const baseUrl = provider === 'openai_compatible'
+        ? await promptText('Base URL', { defaultValue: existing?.baseUrl ?? 'http://localhost:11434/v1' })
+        : undefined;
+    const defaultModel = await promptText('Default model', {
+        defaultValue: existing?.defaultModel ?? (provider === 'anthropic' ? 'claude-sonnet-4-5' : 'gpt-4o'),
+    });
+    return { provider, label, apiKey, baseUrl, defaultModel };
+}
+async function addProvider(wikiApiBase, origin) {
+    printStep('Add a provider');
+    const fields = await askProviderFields();
+    const { id } = await apiPost(wikiApiBase, origin, '/settings/providers', { ...fields, isActive: true });
+    const after = await listProviders(wikiApiBase, origin);
+    const created = after.find((p) => p.id === id);
+    printInfo(created ? `Confirmed: provider ${id} ("${created.label}") is active.` : `Warning: provider ${id} not found in list after creation.`);
+}
+async function editProvider(wikiApiBase, origin) {
+    const providers = await fetchProviders(wikiApiBase, origin);
+    if (providers.length === 0) {
+        printInfo('No providers yet — add one first.');
+        return;
+    }
+    const id = await promptSelect('Which provider do you want to edit?', providers.map((p) => ({ label: `${p.label} (${p.provider}) — ${p.id}`, value: p.id })));
+    const target = providers.find((p) => p.id === id);
+    printStep(`Edit "${target.label}"`);
+    const fields = await askProviderFields(target);
+    await apiPost(wikiApiBase, origin, '/settings/providers', { ...fields, isActive: target.isActive });
+    const after = await listProviders(wikiApiBase, origin);
+    const updated = after.find((p) => p.id === target.id);
+    printInfo(updated ? `Confirmed: ${target.id} ("${updated.label}") now uses model ${updated.defaultModel}.` : `Warning: provider ${target.id} not found after edit.`);
+}
+async function deactivateProvider(wikiApiBase, origin) {
+    const providers = await fetchProviders(wikiApiBase, origin);
+    const active = providers.filter((p) => p.isActive);
+    if (active.length === 0) {
+        printInfo('No active providers to deactivate.');
+        return;
+    }
+    const id = await promptSelect('Which provider do you want to deactivate?', active.map((p) => ({ label: `${p.label} (${p.provider}) — ${p.id}`, value: p.id })));
+    const target = active.find((p) => p.id === id);
+    const confirmed = await promptConfirm(`Deactivate "${target.label}"?`, false);
+    if (!confirmed) {
+        printInfo('Cancelled.');
+        return;
+    }
+    const apiKey = await promptPassword(`Re-enter the API key for "${target.label}" (required by this endpoint, never stored/returned)`);
+    await apiPost(wikiApiBase, origin, '/settings/providers', {
+        provider: target.provider,
+        label: target.label,
+        apiKey,
+        baseUrl: target.baseUrl ?? undefined,
+        defaultModel: target.defaultModel,
+        isActive: false,
+    });
+    const after = await listProviders(wikiApiBase, origin);
+    const updated = after.find((p) => p.id === target.id);
+    printInfo(updated && !updated.isActive ? `Confirmed: ${target.id} ("${updated.label}") is now inactive.` : `Warning: provider ${target.id} still active after deactivation.`);
+}
+export async function run(installDir) {
+    const { wikiApiBase, origin } = resolveApiConfig(installDir);
+    for (;;) {
+        const action = await promptSelect('Providers — what would you like to do?', [
+            { label: 'List providers', value: 'list' },
+            { label: 'Add a provider', value: 'add' },
+            { label: 'Edit a provider', value: 'edit' },
+            { label: 'Deactivate a provider', value: 'deactivate' },
+            { label: 'Done', value: 'done' },
+        ]);
+        if (action === 'done')
+            return;
+        if (action === 'list')
+            await listProviders(wikiApiBase, origin);
+        else if (action === 'add')
+            await addProvider(wikiApiBase, origin);
+        else if (action === 'edit')
+            await editProvider(wikiApiBase, origin);
+        else if (action === 'deactivate')
+            await deactivateProvider(wikiApiBase, origin);
+    }
+}

package/dist/commands/config/sources.js

@@ -0,0 +1,145 @@
+/**
+ * `nostale config sources` — manage repo + document-folder/upload sources (M15/M16) via
+ * wiki-api's `GET/PUT /projects/:project/repo-state` and `GET/POST /projects/:project/sources`,
+ * plus triggering `POST /projects/:project/sync`. Use `apiGet`/`apiPost`/`apiPut` from
+ * `../../lib/http.js`.
+ *
+ * Field-per-sourceType logic mirrors `apps/wiki-web/app/pages/settings/sources/index.vue`:
+ * `local_path` only needs `localPath`; `github_app`/`deploy_key` need `gitUrl` plus their own
+ * one extra field (`githubAppInstallationId` / `deployKeySecretRef`). `webhookSecret` is never
+ * fetched/prompted — wiki-api omits it from GET responses on purpose.
+ */
+import { apiGet, apiPost, apiPut } from '../../lib/http.js';
+import { resolveApiConfig } from '../../lib/api-config.js';
+import { printInfo, printStep, promptSelect, promptText } from '../../tui/prompts.js';
+async function fetchRepoState(wikiApiBase, origin, project) {
+    try {
+        return await apiGet(wikiApiBase, origin, `/projects/${project}/repo-state`);
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchDocumentSources(wikiApiBase, origin, project) {
+    try {
+        return await apiGet(wikiApiBase, origin, `/projects/${project}/sources`);
+    }
+    catch {
+        return [];
+    }
+}
+function printRepoState(state) {
+    if (!state) {
+        printInfo('Code repo: not configured yet.');
+        return;
+    }
+    printInfo(`Code repo: ${state.sourceType}`);
+    if (state.gitUrl)
+        printInfo(`  Git URL: ${state.gitUrl}`);
+    if (state.localPath)
+        printInfo(`  Local path: ${state.localPath}`);
+    if (state.githubAppInstallationId)
+        printInfo(`  GitHub App installation ID: ${state.githubAppInstallationId}`);
+    if (state.deployKeySecretRef)
+        printInfo(`  Deploy key secret ref: ${state.deployKeySecretRef}`);
+    printInfo(`  Default branch: ${state.defaultBranch}`);
+    printInfo(`  Latest known commit: ${state.latestKnownCommit ?? 'none'}`);
+    printInfo(`  Last synced commit: ${state.lastSyncedCommit ?? 'none'}`);
+    printInfo(`  Last synced at: ${state.lastSyncedAt ?? 'never'}`);
+}
+function printDocumentSources(sources) {
+    if (sources.length === 0) {
+        printInfo('Document sources: none registered.');
+        return;
+    }
+    printInfo('Document sources:');
+    for (const source of sources) {
+        const label = source.sourceType === 'document_folder' ? source.folderPath : 'uploaded files';
+        printInfo(`  [${source.sourceType}] ${label} — last synced: ${source.lastSyncedAt ?? 'never'}`);
+    }
+}
+async function viewState(wikiApiBase, origin, project) {
+    printStep(`Current state for "${project}"`);
+    const [repoState, documentSources] = await Promise.all([
+        fetchRepoState(wikiApiBase, origin, project),
+        fetchDocumentSources(wikiApiBase, origin, project),
+    ]);
+    printRepoState(repoState);
+    printDocumentSources(documentSources);
+}
+/** Prompts only the fields relevant to `sourceType`, mirroring the Web UI's conditional form. */
+async function promptRepoFields(sourceType) {
+    if (sourceType === 'local_path') {
+        const localPath = await promptText('Local path (mounted into wiki-worker)');
+        return { gitUrl: null, githubAppInstallationId: null, deployKeySecretRef: null, localPath };
+    }
+    const gitUrl = await promptText('Git URL');
+    if (sourceType === 'github_app') {
+        const githubAppInstallationId = await promptText('GitHub App installation ID');
+        return { gitUrl, githubAppInstallationId, deployKeySecretRef: null, localPath: null };
+    }
+    const deployKeySecretRef = await promptText('Deploy key secret reference');
+    return { gitUrl, githubAppInstallationId: null, deployKeySecretRef, localPath: null };
+}
+async function registerRepo(wikiApiBase, origin, project) {
+    printStep('Register/update code repo');
+    const sourceType = await promptSelect('Source type', [
+        { label: 'local_path (worker reads a mounted directory directly)', value: 'local_path' },
+        { label: 'deploy_key (SSH deploy key, read-only)', value: 'deploy_key' },
+        { label: 'github_app (GitHub App installation)', value: 'github_app' },
+    ]);
+    const fields = await promptRepoFields(sourceType);
+    const defaultBranch = await promptText('Default branch', { defaultValue: 'main' });
+    const result = await apiPut(wikiApiBase, origin, `/projects/${project}/repo-state`, {
+        project,
+        sourceType,
+        ...fields,
+        defaultBranch,
+    });
+    printInfo('Saved.');
+    printRepoState(result);
+}
+async function registerFolder(wikiApiBase, origin, project) {
+    printStep('Register a document folder');
+    const folderPath = await promptText('Folder path (mounted into wiki-worker)');
+    await apiPost(wikiApiBase, origin, `/projects/${project}/sources`, { sourceType: 'document_folder', folderPath });
+    printInfo('Registered.');
+    printDocumentSources(await fetchDocumentSources(wikiApiBase, origin, project));
+}
+async function syncNow(wikiApiBase, origin, project) {
+    printStep('Syncing…');
+    const result = await apiPost(wikiApiBase, origin, `/projects/${project}/sync`, {});
+    printInfo(result.codeSync ? 'Code repo synced.' : 'Code repo: no sync performed (not configured, or nothing new).');
+    if (result.documentSyncs.length === 0) {
+        printInfo('Document sources: none synced.');
+    }
+    else {
+        for (const sync of result.documentSyncs) {
+            const label = sync.sourceType === 'document_folder' ? sync.folderPath : 'uploaded files';
+            printInfo(`  [${sync.sourceType}] ${label}: ${sync.result.documentsIngested} document(s), ${sync.result.chunksIngested} chunk(s) ingested.`);
+        }
+    }
+}
+export async function run(installDir) {
+    const { wikiApiBase, origin } = resolveApiConfig(installDir);
+    const project = await promptText('Project key');
+    for (;;) {
+        const choice = await promptSelect(`Sources for "${project}"`, [
+            { label: 'View current state', value: 'view' },
+            { label: 'Register/update code repo', value: 'repo' },
+            { label: 'Register a document folder', value: 'folder' },
+            { label: 'Sync now', value: 'sync' },
+            { label: 'Done', value: 'done' },
+        ]);
+        if (choice === 'done')
+            return;
+        if (choice === 'view')
+            await viewState(wikiApiBase, origin, project);
+        if (choice === 'repo')
+            await registerRepo(wikiApiBase, origin, project);
+        if (choice === 'folder')
+            await registerFolder(wikiApiBase, origin, project);
+        if (choice === 'sync')
+            await syncNow(wikiApiBase, origin, project);
+    }
+}

package/dist/commands/config/templates.js

@@ -0,0 +1,117 @@
+/**
+ * `nostale config templates` — CRUD `document_templates` via wiki-api's
+ * `GET/POST /settings/templates`. `upsertDocumentTemplate` (packages/rag-core/src/store-libsql.ts)
+ * keys its upsert on `(project, docKind, name)`, so "edit" is just re-posting the same
+ * project+docKind+name with changed fields — no separate PATCH endpoint needed.
+ */
+import { resolveApiConfig } from '../../lib/api-config.js';
+import { apiGet, apiPost } from '../../lib/http.js';
+import { promptText, promptSelect, promptConfirm, printStep, printInfo } from '../../tui/prompts.js';
+function describe(t) {
+    const scope = t.project ?? 'global';
+    const status = t.isActive ? '' : ' (inactive)';
+    return `${scope} / ${t.docKind} / ${t.name}${status} — ${t.sections.length} section(s)`;
+}
+async function fetchAll(ctx) {
+    return apiGet(ctx.wikiApiBase, ctx.origin, '/settings/templates');
+}
+/** Prompts for an optional project filter, fetches, prints. Returns the fetched list. */
+async function listTemplates(ctx) {
+    const project = await promptText('Project to scope to (empty = all)');
+    const path = project ? `/settings/templates?project=${encodeURIComponent(project)}` : '/settings/templates';
+    const templates = await apiGet(ctx.wikiApiBase, ctx.origin, path);
+    printStep(`${templates.length} template(s)`);
+    for (const t of templates)
+        printInfo(describe(t));
+    return templates;
+}
+/** Lists, then lets the user pick one by id. Returns null if the list is empty. */
+async function pickTemplate(ctx) {
+    const templates = await fetchAll(ctx);
+    if (templates.length === 0) {
+        printInfo('No templates yet.');
+        return null;
+    }
+    const id = await promptSelect('Which template?', templates.map((t) => ({ label: describe(t), value: t.id })));
+    return templates.find((t) => t.id === id) ?? null;
+}
+async function buildSections(existing = []) {
+    if (existing.length > 0) {
+        printInfo(`Existing sections: ${existing.map((s) => s.key).join(', ')}`);
+        if (await promptConfirm('Keep existing sections as-is?', true))
+            return existing;
+    }
+    const sections = [];
+    while (await promptConfirm(sections.length === 0 ? 'Add a section?' : 'Add another section?', sections.length === 0)) {
+        const key = await promptText('  Section key');
+        const title = await promptText('  Section title');
+        const guidance = await promptText('  Section guidance');
+        const required = await promptConfirm('  Required?', true);
+        sections.push({ key, title, guidance, required });
+    }
+    return sections;
+}
+/** Shared create+edit flow: prompts every field, pre-filled from `existing` when editing. */
+async function upsertTemplate(ctx, existing) {
+    const project = await promptText('Project (empty for global)', { defaultValue: existing?.project ?? '' });
+    const docKindChoices = existing?.docKind === 'tdd' ? ['tdd', 'prd'] : ['prd', 'tdd'];
+    const docKind = await promptSelect('Doc kind', docKindChoices.map((k) => ({ label: k.toUpperCase(), value: k })));
+    const name = await promptText('Name', { defaultValue: existing?.name });
+    const sections = await buildSections(existing?.sections ?? []);
+    const systemPromptOverride = await promptText('System prompt override (empty for none)', {
+        defaultValue: existing?.systemPromptOverride ?? '',
+    });
+    const isActive = await promptConfirm('Active?', existing?.isActive ?? true);
+    await apiPost(ctx.wikiApiBase, ctx.origin, '/settings/templates', {
+        project: project || null,
+        docKind,
+        name,
+        sections,
+        systemPromptOverride: systemPromptOverride || null,
+        isActive,
+    });
+    const saved = (await fetchAll(ctx)).find((t) => t.project === (project || null) && t.docKind === docKind && t.name === name);
+    printStep(saved ? `Saved: ${describe(saved)}` : 'Saved, but could not confirm by re-fetch.');
+}
+async function deactivateTemplate(ctx) {
+    const template = await pickTemplate(ctx);
+    if (!template)
+        return;
+    if (!(await promptConfirm(`Deactivate "${template.name}"?`, false)))
+        return;
+    await apiPost(ctx.wikiApiBase, ctx.origin, '/settings/templates', {
+        project: template.project,
+        docKind: template.docKind,
+        name: template.name,
+        sections: template.sections,
+        systemPromptOverride: template.systemPromptOverride,
+        isActive: false,
+    });
+    const saved = (await fetchAll(ctx)).find((t) => t.id === template.id);
+    printStep(saved && !saved.isActive ? `Deactivated: ${describe(saved)}` : 'Deactivate did not take effect — check wiki-api logs.');
+}
+export async function run(installDir) {
+    const ctx = resolveApiConfig(installDir);
+    for (;;) {
+        const action = await promptSelect('Templates', [
+            { label: 'List templates', value: 'list' },
+            { label: 'Create a template', value: 'create' },
+            { label: 'Edit a template', value: 'edit' },
+            { label: 'Deactivate a template', value: 'deactivate' },
+            { label: 'Back', value: 'back' },
+        ]);
+        if (action === 'back')
+            return;
+        if (action === 'list')
+            await listTemplates(ctx);
+        if (action === 'create')
+            await upsertTemplate(ctx);
+        if (action === 'deactivate')
+            await deactivateTemplate(ctx);
+        if (action === 'edit') {
+            const template = await pickTemplate(ctx);
+            if (template)
+                await upsertTemplate(ctx, template);
+        }
+    }
+}

package/dist/commands/config/tokens.js

@@ -0,0 +1,83 @@
+/**
+ * `nostale config tokens` — generate/list/revoke `mcp_access_tokens` via wiki-api's
+ * `GET/POST /settings/mcp-tokens` and `POST /settings/mcp-tokens/:id/revoke`. Use
+ * `apiGet`/`apiPost` from `../../lib/http.js`. Note: a freshly created token is returned once in
+ * the POST response body only — print it to the user immediately, it is never retrievable again.
+ */
+import { resolveApiConfig } from '../../lib/api-config.js';
+import { apiGet, apiPost } from '../../lib/http.js';
+import { promptSelect, promptText, promptConfirm, printStep, printInfo } from '../../tui/prompts.js';
+function formatToken(t) {
+    const status = t.revokedAt ? `revoked ${t.revokedAt}` : 'active';
+    const lastUsed = t.lastUsedAt ?? 'never';
+    return `  ${t.id}  "${t.label ?? '(no label)'}"  [${status}]  last used: ${lastUsed}`;
+}
+async function listTokens(wikiApiBase, origin) {
+    const tokens = await apiGet(wikiApiBase, origin, '/settings/mcp-tokens');
+    printStep('MCP access tokens');
+    if (tokens.length === 0) {
+        printInfo('(none yet)');
+    }
+    else {
+        for (const t of tokens)
+            printInfo(formatToken(t));
+    }
+    return tokens;
+}
+async function generateToken(wikiApiBase, origin) {
+    printStep('Generate a new MCP access token');
+    const label = await promptText('Label (optional)');
+    const { id, token } = await apiPost(wikiApiBase, origin, '/settings/mcp-tokens', {
+        label: label || undefined,
+    });
+    const bar = '='.repeat(64);
+    console.log(`\n${bar}`);
+    console.log('  NEW MCP ACCESS TOKEN — copy it now, it will NOT be shown again:');
+    console.log('');
+    console.log(`  ${token}`);
+    console.log('');
+    console.log(`  id: ${id}`);
+    console.log(bar + '\n');
+    // Confirm the mutation actually landed server-side (can't confirm the raw token — it's
+    // one-time-only by design — but we can confirm the new token id shows up as active).
+    const tokens = await listTokens(wikiApiBase, origin);
+    const created = tokens.find((t) => t.id === id);
+    printInfo(created ? `Confirmed: token ${id} is active.` : `Warning: token ${id} not found in list after creation.`);
+}
+async function revokeToken(wikiApiBase, origin) {
+    const tokens = await apiGet(wikiApiBase, origin, '/settings/mcp-tokens');
+    const active = tokens.filter((t) => !t.revokedAt);
+    if (active.length === 0) {
+        printInfo('No active tokens to revoke.');
+        return;
+    }
+    const id = await promptSelect('Which token do you want to revoke?', active.map((t) => ({ label: `${t.label ?? '(no label)'} — ${t.id}`, value: t.id })));
+    const confirmed = await promptConfirm(`Revoke token ${id}? This cannot be undone.`, false);
+    if (!confirmed) {
+        printInfo('Cancelled.');
+        return;
+    }
+    await apiPost(wikiApiBase, origin, `/settings/mcp-tokens/${id}/revoke`);
+    const after = await apiGet(wikiApiBase, origin, '/settings/mcp-tokens');
+    const revoked = after.find((t) => t.id === id);
+    printInfo(revoked?.revokedAt ? `Confirmed: token ${id} revoked at ${revoked.revokedAt}.` : `Warning: token ${id} does not show as revoked.`);
+}
+export async function run(installDir) {
+    const { wikiApiBase, origin } = resolveApiConfig(installDir);
+    for (;;) {
+        const action = await promptSelect('MCP Tokens — what would you like to do?', [
+            { label: 'List tokens', value: 'list' },
+            { label: 'Generate a new token', value: 'generate' },
+            { label: 'Revoke a token', value: 'revoke' },
+            { label: 'Done', value: 'done' },
+        ]);
+        if (action === 'done')
+            return;
+        if (action === 'list')
+            await listTokens(wikiApiBase, origin);
+        else if (action === 'generate')
+            await generateToken(wikiApiBase, origin);
+        else if (action === 'revoke')
+            await revokeToken(wikiApiBase, origin);
+    }
+}