@nostale/cli 0.1.0

package/dist/lib/process-manager.js

@@ -0,0 +1,151 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { waitForHttp } from './http.js';
+import { migrationsDir, resolveServiceSource, wasmDir } from './install-root.js';
+import { LOG_DIR, PID_DIR } from './paths.js';
+// wiki-api/wiki-worker/mcp-server run from source via tsx (no build step for the apps
+// themselves), but they import compiled workspace packages through node_modules resolution —
+// tsx does not transpile those on the fly. Without a prior `tsc` build, wiki-api crashes on boot
+// with MODULE_NOT_FOUND for `@nostale/rag-core`. Bundled installs (M21) inline these packages
+// into the service bundle itself, so this only applies in dev mode.
+const WORKSPACE_PACKAGES = ['extractor', 'rag-core'];
+function ensureWorkspacePackagesBuilt(repoRoot) {
+    const unbuilt = WORKSPACE_PACKAGES.filter((pkg) => !existsSync(join(repoRoot, 'packages', pkg, 'dist', 'index.js')));
+    if (unbuilt.length === 0)
+        return;
+    execFileSync('npm', ['run', 'build', ...unbuilt.map((pkg) => `--workspace=@nostale/${pkg}`)], { cwd: repoRoot, stdio: 'inherit' });
+}
+// Personal mode runs sibling apps as plain child processes (no Docker) — each spawned directly,
+// assumes a Unix-like host (macOS/Linux). What actually gets spawned (bundled `node index.cjs`
+// vs. dev-mode `tsx src/index.ts`) is resolved per-call via resolveServiceSource (install-root.ts).
+export const SERVICES = [
+    { name: 'wiki-api', portEnvKey: 'WIKI_API_PORT' },
+    { name: 'wiki-worker', portEnvKey: 'WIKI_WORKER_PORT' },
+    { name: 'mcp-server', portEnvKey: 'MCP_SERVER_PORT' },
+    { name: 'wiki-web', portEnvKey: 'WIKI_WEB_PORT' },
+];
+/**
+ * M18 — wiki-web is the only service that can be opted out of via WIKI_WEB_ENABLED='0' (set by
+ * the wizard's "Install Web UI?" step). Missing/any-other-value means enabled (default Yes).
+ * Callers already read `.env` before calling into this module (status.ts/doctor.ts/stop.ts/
+ * start.ts/wizard.ts all do), so threading `env` through as a plain param avoids this module
+ * reading `.env` itself — no new layering violation, no duplicated on/off logic per caller.
+ */
+export function isServiceEnabled(name, env) {
+    if (name !== 'wiki-web')
+        return true;
+    return env.WIKI_WEB_ENABLED !== '0';
+}
+function ensureDirs() {
+    mkdirSync(PID_DIR, { recursive: true });
+    mkdirSync(LOG_DIR, { recursive: true });
+}
+function pidFile(name) {
+    return join(PID_DIR, `${name}.pid`);
+}
+function logFile(name) {
+    return join(LOG_DIR, `${name}.log`);
+}
+function readPid(name) {
+    const file = pidFile(name);
+    if (!existsSync(file))
+        return null;
+    const pid = Number(readFileSync(file, 'utf-8').trim());
+    return Number.isInteger(pid) ? pid : null;
+}
+export function isRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function statusService(name) {
+    const pid = readPid(name);
+    const running = pid !== null && isRunning(pid);
+    return { name, running, pid: running ? pid : null, disabled: false };
+}
+export function statusAll(env = {}) {
+    return SERVICES.map((s) => (isServiceEnabled(s.name, env) ? statusService(s.name) : { name: s.name, running: false, pid: null, disabled: true }));
+}
+/**
+ * Spawns and tracks a service given an already-resolved command (see resolveServiceSource in
+ * install-root.ts) — kept decoupled from that resolution so it stays trivially unit-testable
+ * with a fake source instead of a real InstallContext.
+ */
+export function startService(name, source, port, env, opts = {}) {
+    ensureDirs();
+    const existing = statusService(name);
+    if (existing.running && existing.pid !== null)
+        return existing.pid;
+    const { cmd, args, cwd } = source;
+    // Explicit restrictive mode — the default 0o644 left service logs (which can contain sensitive
+    // output) world-readable (SECURITY-REVIEW-2026-07-10.md F-14). The mode only applies at
+    // creation, so chmod unconditionally too in case an older log file was left looser.
+    const logPath = logFile(name);
+    const logFd = openSync(logPath, 'a', 0o600);
+    chmodSync(logPath, 0o600);
+    const spawnEnv = { ...process.env, ...env, PORT: String(port) };
+    // Bundled mode inlined tree-sitter-wasms and rag-core's `.sql` migrations into the service
+    // bundle rather than leaving them on disk relative to the package — packages/extractor's
+    // parser and rag-core's migrate.ts each need an explicit pointer to where the bundler actually
+    // copied their assets (M21).
+    if (opts.wasmDir)
+        spawnEnv.NOSTALE_WASM_DIR = opts.wasmDir;
+    if (opts.migrationsDir)
+        spawnEnv.NOSTALE_MIGRATIONS_DIR = opts.migrationsDir;
+    const child = spawn(cmd, args, {
+        cwd,
+        env: spawnEnv,
+        detached: true,
+        stdio: ['ignore', logFd, logFd],
+    });
+    child.unref();
+    writeFileSync(pidFile(name), String(child.pid));
+    return child.pid;
+}
+/** Returns whether a running process was actually found and signaled. */
+export function stopService(name) {
+    const status = statusService(name);
+    rmSync(pidFile(name), { force: true });
+    if (!status.running || status.pid === null)
+        return false;
+    process.kill(status.pid, 'SIGTERM');
+    return true;
+}
+export function stopAll(env = {}) {
+    return SERVICES.filter((s) => isServiceEnabled(s.name, env)).map((s) => ({ name: s.name, stopped: stopService(s.name) }));
+}
+/**
+ * wiki-api runs rag-core's migrations on boot; wiki-worker/mcp-server/wiki-web query that same
+ * file: DB immediately on their own boot with no migration of their own. Starting them before
+ * wiki-api's migration finishes races an empty schema (crashes with "no such table"). Bring
+ * wiki-api up and healthy first, then the rest — used by both `nostale setup` (restart: true,
+ * so config changes take effect) and `nostale start` (restart: false, idempotent no-op on
+ * already-running services).
+ */
+export async function startAllPersonal(install, env, ports, opts = {}) {
+    const restart = opts.restart ?? true;
+    const wikiApi = SERVICES.find((s) => s.name === 'wiki-api');
+    if (!wikiApi)
+        throw new Error('wiki-api missing from SERVICES');
+    // Bundled services inline their workspace package deps via esbuild (M21) — nothing to build.
+    if (install.mode === 'dev')
+        ensureWorkspacePackagesBuilt(install.repoRoot);
+    const bundledAssetOpts = install.mode === 'bundled' ? { wasmDir: wasmDir(), migrationsDir: migrationsDir() } : {};
+    const spawnOne = (service, port) => startService(service.name, resolveServiceSource(install, service.name, port), port, env, bundledAssetOpts);
+    const started = [];
+    if (restart)
+        stopService(wikiApi.name);
+    started.push({ name: wikiApi.name, pid: spawnOne(wikiApi, ports[wikiApi.name]) });
+    await waitForHttp(`http://localhost:${ports[wikiApi.name]}`);
+    for (const service of SERVICES.filter((s) => s.name !== 'wiki-api' && isServiceEnabled(s.name, env))) {
+        if (restart)
+            stopService(service.name);
+        started.push({ name: service.name, pid: spawnOne(service, ports[service.name]) });
+    }
+    return started;
+}

package/dist/lib/repo-root.js

@@ -0,0 +1,34 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+export class RepoRootNotFoundError extends Error {
+    constructor() {
+        super('Could not find the NoStale repo root. Run `nostale setup` from inside a clone of the `nostale` repo (or a subdirectory of it).');
+        this.name = 'RepoRootNotFoundError';
+    }
+}
+/**
+ * apps/cli manages sibling apps (wiki-api, wiki-worker, wiki-web, mcp-server) as local child
+ * processes for personal mode — it operates on a `nostale` monorepo checkout rather than a
+ * bundled standalone binary, so it must locate that checkout's root from cwd.
+ */
+export function findRepoRoot(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 20; i++) {
+        const pkgPath = join(dir, 'package.json');
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                if (pkg.name === 'nostale' && Array.isArray(pkg.workspaces))
+                    return dir;
+            }
+            catch {
+                // malformed package.json along the way — keep walking up
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new RepoRootNotFoundError();
+}

package/dist/lib/wizard.js

@@ -0,0 +1,267 @@
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { promptConfirm, promptPassword, promptSelect, promptText, printInfo, printStep } from '../tui/prompts.js';
+import { readEnvFile, writeEnvFile, generateEncryptionKey } from './env-writer.js';
+import { waitForHttp } from './http.js';
+import { bundledServiceEntry, cliPackageRoot, cliVersion, installDir } from './install-root.js';
+import { envFilePath, DATA_DIR, DEFAULT_DB_PATH, DEFAULT_WORK_DIR } from './paths.js';
+import { pickPort } from './ports.js';
+import { startAllPersonal } from './process-manager.js';
+async function askLlmConfig(existing) {
+    const provider = await promptSelect('LLM provider', [
+        { label: 'Anthropic', value: 'anthropic' },
+        { label: 'OpenAI-compatible (self-hosted / proxy)', value: 'openai_compatible' },
+    ]);
+    const apiKey = await promptPassword('LLM API key', { defaultValue: existing.LLM_API_KEY });
+    const baseUrl = provider === 'openai_compatible'
+        ? await promptText('LLM base URL', { defaultValue: existing.LLM_BASE_URL || 'http://localhost:11434/v1' })
+        : '';
+    const defaultModel = provider === 'openai_compatible' ? 'gpt-4o' : 'claude-sonnet-4-5';
+    const model = await promptText('LLM model', { defaultValue: existing.LLM_MODEL || defaultModel });
+    return { LLM_PROVIDER: provider, LLM_API_KEY: apiKey, LLM_BASE_URL: baseUrl, LLM_MODEL: model };
+}
+/**
+ * M17 first-run question, right after askLlmConfig — default Yes only if a real key was just
+ * provided in this same wizard run (defaulting to a setting that immediately fails for lack of
+ * a key would be worse than defaulting to No).
+ */
+async function askAutoGenerateDocs(llm) {
+    const enabled = await promptConfirm('Auto-generate PRD/TDD documents with an LLM after each sync?', Boolean(llm.LLM_API_KEY));
+    return enabled ? '1' : '0';
+}
+/**
+ * Bundled installs have no `apps/wiki-api/src/auth.ts` on disk for `@better-auth/cli` to read
+ * (it was inlined by esbuild, M21) — wiki-api's own compiled entry gets a `--migrate-only` mode
+ * instead (M22) that runs the same migration programmatically. Dev mode is untouched: it still
+ * shells out to the CLI against the real source file.
+ */
+function runBetterAuthMigrate(install, env) {
+    const spawnEnv = { ...process.env, ...env };
+    if (install.mode === 'bundled') {
+        execFileSync(process.execPath, [bundledServiceEntry('wiki-api'), '--migrate-only'], { env: spawnEnv, stdio: 'inherit' });
+        return;
+    }
+    execFileSync('npx', ['@better-auth/cli', 'migrate', '-y'], { cwd: join(install.repoRoot, 'apps/wiki-api'), env: spawnEnv, stdio: 'inherit' });
+}
+async function provisionFirstUser(wikiApiBase, origin) {
+    const email = await promptText('Your email (for the first NoStale account)');
+    const password = await promptPassword('Choose a password');
+    printStep('Provisioning your account');
+    // BetterAuth rejects sign-up without an Origin header matching trustedOrigins, even for
+    // same-machine, non-browser callers like this CLI.
+    const response = await fetch(`${wikiApiBase}/api/auth/sign-up/email`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', origin },
+        body: JSON.stringify({ email, password, name: email.split('@')[0] }),
+    });
+    if (response.ok) {
+        printInfo(`Account ${email} created — sign in at the wiki-web URL below.`);
+        return;
+    }
+    const body = await response.json().catch(() => ({}));
+    printInfo(`Could not auto-provision (${response.status}): ${body.message ?? 'unknown error'} — sign up manually instead.`);
+}
+/**
+ * M18 — lets personal/server mode skip installing wiki-web (e.g. MCP-only or CLI-only usage).
+ * Persisted as WIKI_WEB_ENABLED ('1'/'0'), same boolean-ish convention as AUTO_GENERATE_DOCS.
+ */
+async function askInstallWebUi(existing) {
+    const install = await promptConfirm('Install Web UI?', existing.WIKI_WEB_ENABLED !== '0');
+    return install ? '1' : '0';
+}
+async function runPersonalSetup(install, envPath, existing) {
+    const installWebUi = await askInstallWebUi(existing);
+    const llm = await askLlmConfig(existing);
+    const autoGenerateDocs = await askAutoGenerateDocs(llm);
+    const useTurso = await promptConfirm('Use Turso Cloud instead of a local database file?', Boolean(existing.LIBSQL_AUTH_TOKEN));
+    let libsqlUrl = `file:${DEFAULT_DB_PATH}`;
+    let libsqlAuthToken = '';
+    if (useTurso) {
+        libsqlUrl = await promptText('Turso database URL', { defaultValue: existing.LIBSQL_URL });
+        libsqlAuthToken = await promptPassword('Turso auth token', { defaultValue: existing.LIBSQL_AUTH_TOKEN });
+    }
+    printStep('Picking free ports');
+    const taken = new Set();
+    const wikiWebPort = await pickPort(Number(existing.WIKI_WEB_PORT) || 3000, taken);
+    taken.add(wikiWebPort);
+    const wikiApiPort = await pickPort(Number(existing.WIKI_API_PORT) || 3001, taken);
+    taken.add(wikiApiPort);
+    const wikiWorkerPort = await pickPort(Number(existing.WIKI_WORKER_PORT) || 3002, taken);
+    taken.add(wikiWorkerPort);
+    const mcpServerPort = await pickPort(Number(existing.MCP_SERVER_PORT) || 3100, taken);
+    taken.add(mcpServerPort);
+    printInfo(`wiki-web=${wikiWebPort} wiki-api=${wikiApiPort} wiki-worker=${wikiWorkerPort} mcp-server=${mcpServerPort}`);
+    const wikiApiBase = `http://localhost:${wikiApiPort}`;
+    const vars = {
+        NOSTALE_MODE: 'personal',
+        LIBSQL_URL: libsqlUrl,
+        LIBSQL_AUTH_TOKEN: libsqlAuthToken,
+        SETTINGS_ENCRYPTION_KEY: existing.SETTINGS_ENCRYPTION_KEY || generateEncryptionKey(),
+        // Shared secret wiki-worker requires on every request (docs/13 finding #2) — both processes
+        // read the same .env, so generating it once here wires it to wiki-api and wiki-worker alike.
+        WIKI_WORKER_SHARED_SECRET: existing.WIKI_WORKER_SHARED_SECRET || generateEncryptionKey(),
+        // BetterAuth session-signing secret — without it, auth.ts falls back to a publicly-known
+        // default (SECURITY-REVIEW-2026-07-10.md F-01).
+        BETTER_AUTH_SECRET: existing.BETTER_AUTH_SECRET || generateEncryptionKey(),
+        ...llm,
+        WIKI_API_PORT: String(wikiApiPort),
+        WIKI_WORKER_PORT: String(wikiWorkerPort),
+        MCP_SERVER_PORT: String(mcpServerPort),
+        WIKI_WEB_PORT: String(wikiWebPort),
+        BETTER_AUTH_URL: wikiApiBase,
+        WIKI_WEB_ORIGIN: `http://localhost:${wikiWebPort}`,
+        WIKI_API_BASE: wikiApiBase,
+        WIKI_WORKER_URL: `http://localhost:${wikiWorkerPort}`,
+        WIKI_WORKER_WORKDIR: existing.WIKI_WORKER_WORKDIR || DEFAULT_WORK_DIR,
+        ASK_WIKI_RATE_LIMIT: existing.ASK_WIKI_RATE_LIMIT || '5',
+        AUTO_GENERATE_DOCS: autoGenerateDocs,
+        WIKI_WEB_ENABLED: installWebUi,
+    };
+    mkdirSync(DATA_DIR, { recursive: true });
+    writeEnvFile(envPath, vars);
+    printStep('Wrote .env for personal mode');
+    printStep('Starting services (no Docker) — wiki-api first, others once its migration finishes');
+    const ports = {
+        'wiki-api': wikiApiPort,
+        'wiki-worker': wikiWorkerPort,
+        'mcp-server': mcpServerPort,
+        'wiki-web': wikiWebPort,
+    };
+    const started = await startAllPersonal(install, vars, ports);
+    for (const s of started)
+        printInfo(`${s.name} started on :${ports[s.name]} (pid ${s.pid})`);
+    const healthy = await waitForHttp(wikiApiBase);
+    if (!healthy) {
+        printInfo('wiki-api did not respond in time — check `nostale status` and ~/.nostale/logs/wiki-api.log');
+        return;
+    }
+    printStep('Provisioning BetterAuth schema');
+    runBetterAuthMigrate(install, vars);
+    if (await promptConfirm('Create the first NoStale account now?')) {
+        await provisionFirstUser(wikiApiBase, vars.WIKI_WEB_ORIGIN);
+    }
+    printStep('Done');
+    if (installWebUi === '1')
+        printInfo(`wiki-web:    http://localhost:${wikiWebPort}`);
+    else
+        printInfo('wiki-web:    disabled — manage everything via `nostale config`.');
+    printInfo(`wiki-api:    ${wikiApiBase}`);
+    printInfo(`mcp-server:  http://localhost:${mcpServerPort}`);
+    printInfo('Check status anytime: `nostale status` — stop with `nostale stop` — reconfigure with `nostale config`.');
+}
+/**
+ * Bundled installs have no repo checkout to hold a docker-compose.yml, so `nostale setup` (server
+ * mode) writes the CLI's own image-based variant to `~/.nostale/docker-compose.yml` (M23) — every
+ * service pulls `ghcr.io/.../nostale-<service>:<version>` instead of building from source, with
+ * `<version>` substituted from this install's own package.json (kept in lockstep with the GHCR
+ * tags a release publishes, see docs/14-npm-standalone-distribution.md's release contract).
+ */
+function writeServerComposeFile(targetDir) {
+    const template = readFileSync(join(cliPackageRoot(), 'assets/docker-compose.server.yml'), 'utf-8');
+    const rendered = template.replaceAll('${NOSTALE_VERSION}', cliVersion());
+    const target = join(targetDir, 'docker-compose.yml');
+    writeFileSync(target, rendered);
+    return target;
+}
+async function runServerSetup(install, envPath, existing) {
+    const installWebUi = await askInstallWebUi(existing);
+    const llm = await askLlmConfig(existing);
+    const autoGenerateDocs = await askAutoGenerateDocs(llm);
+    // Both the dev-mode and bundled-mode compose files hardcode LIBSQL_URL to the sqld container,
+    // so Turso Cloud isn't an option here (it is in personal mode).
+    const wikiApiPublicUrl = await promptText('Public URL for wiki-api (used by BetterAuth)', {
+        defaultValue: existing.WIKI_API_PUBLIC_URL || 'http://localhost:3001',
+    });
+    const vars = {
+        NOSTALE_MODE: 'server',
+        SETTINGS_ENCRYPTION_KEY: existing.SETTINGS_ENCRYPTION_KEY || generateEncryptionKey(),
+        WIKI_WORKER_SHARED_SECRET: existing.WIKI_WORKER_SHARED_SECRET || generateEncryptionKey(),
+        BETTER_AUTH_SECRET: existing.BETTER_AUTH_SECRET || generateEncryptionKey(),
+        // docker-compose.yml now requires this (SECURITY-REVIEW-2026-07-10.md F-06) — an empty
+        // token left sqld accepting unauthenticated connections on the internal network.
+        SQLD_AUTH_TOKEN: existing.SQLD_AUTH_TOKEN || generateEncryptionKey(),
+        LLM_PROVIDER: llm.LLM_PROVIDER,
+        LLM_API_KEY: llm.LLM_API_KEY,
+        LLM_BASE_URL: llm.LLM_BASE_URL,
+        WIKI_API_PUBLIC_URL: wikiApiPublicUrl,
+        AUTO_GENERATE_DOCS: autoGenerateDocs,
+        WIKI_WEB_ENABLED: installWebUi,
+        // Compose auto-loads .env from its cwd, so COMPOSE_PROFILES here activates the `web` profile
+        // for every future `docker compose` invocation (ps/down/up), not just this setup run — that's
+        // what makes `nostale status`/`nostale stop`'s unflagged `docker compose ps`/`down` calls
+        // correctly include/exclude wiki-web without those files needing to know about profiles at all.
+        COMPOSE_PROFILES: installWebUi === '1' ? 'web' : '',
+    };
+    const dir = installDir(install);
+    // Personal mode's mkdirSync(DATA_DIR) happens to create ~/.nostale too (recursive: true), but
+    // server mode has no equivalent call — harmless in dev mode (repoRoot already exists from the
+    // clone) but a fresh bundled install has no ~/.nostale yet at all (M23).
+    mkdirSync(dir, { recursive: true });
+    writeEnvFile(envPath, vars);
+    printStep('Wrote .env for server mode');
+    // Dev mode reuses the monorepo's own docker-compose.yml (build: context: ., unchanged) — only
+    // a bundled install needs one written out, since there's no checkout to hold it (M23).
+    if (install.mode === 'bundled') {
+        writeServerComposeFile(dir);
+        printStep(`Wrote docker-compose.yml (image-based, v${cliVersion()}) to ${dir}`);
+    }
+    printStep('Starting docker compose stack');
+    const composeArgs = installWebUi === '1' ? ['compose', '--profile', 'web', 'up', '-d'] : ['compose', 'up', '-d'];
+    try {
+        execFileSync('docker', composeArgs, { cwd: dir, stdio: 'inherit' });
+    }
+    catch (err) {
+        printInfo(`Failed to run \`docker compose up -d\`: ${err.message}`);
+        printInfo('Install Docker Engine + Compose plugin, then re-run `nostale setup`.');
+        return;
+    }
+    printStep('Waiting for wiki-api container to come up');
+    const healthy = await waitForHttp(wikiApiPublicUrl);
+    if (!healthy) {
+        printInfo('wiki-api did not respond in time — check `docker compose logs wiki-api`.');
+        return;
+    }
+    printStep('Provisioning BetterAuth schema');
+    for (let attempt = 1; attempt <= 5; attempt++) {
+        try {
+            execFileSync('docker', ['compose', 'exec', '-T', 'wiki-api', 'npx', '@better-auth/cli', 'migrate', '-y'], {
+                cwd: dir,
+                stdio: 'inherit',
+            });
+            break;
+        }
+        catch (err) {
+            if (attempt === 5)
+                printInfo(`BetterAuth migration failed after retries: ${err.message}`);
+            else
+                await new Promise((resolve) => setTimeout(resolve, 2000));
+        }
+    }
+    printStep('Done');
+    if (installWebUi === '1')
+        printInfo('wiki-web:  http://localhost:3000 — open it and sign up for the first account.');
+    else
+        printInfo('wiki-web:  disabled — manage everything via `nostale config`.');
+    printInfo(`wiki-api:  ${wikiApiPublicUrl}`);
+    printInfo('Check the stack: `docker compose ps` — reconfigure with `nostale config`.');
+}
+export async function runWizard(install) {
+    if (!process.stdin.isTTY) {
+        console.error('`nostale setup`/`nostale config` need an interactive terminal (Ink TUI) — run them directly in a shell, not piped or in CI.');
+        process.exitCode = 1;
+        return;
+    }
+    const envPath = envFilePath(installDir(install));
+    const existing = readEnvFile(envPath);
+    printStep('NoStale setup');
+    const defaultMode = existing.NOSTALE_MODE || 'personal';
+    const mode = await promptSelect('Mode', [
+        { label: `Personal (no Docker, local file DB)${defaultMode === 'personal' ? ' — current' : ''}`, value: 'personal' },
+        { label: `Server (Docker Compose, full sqld stack)${defaultMode === 'server' ? ' — current' : ''}`, value: 'server' },
+    ]);
+    if (mode === 'personal')
+        await runPersonalSetup(install, envPath, existing);
+    else
+        await runServerSetup(install, envPath, existing);
+}

package/dist/tui/prompts.js

@@ -0,0 +1,54 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { render, Box, Text } from 'ink';
+import TextInput from 'ink-text-input';
+import SelectInput from 'ink-select-input';
+function PromptText({ message, defaultValue, mask, onSubmit, }) {
+    const [value, setValue] = useState('');
+    return (_jsxs(Box, { children: [_jsx(Text, { color: "cyan", children: "? " }), _jsxs(Text, { bold: true, children: [message, " "] }), _jsx(TextInput, { value: value, onChange: setValue, mask: mask ? '*' : undefined, onSubmit: onSubmit })] }));
+}
+/** Renders one Ink prompt, resolves on submit, unmounts — one small render per question. */
+export async function promptText(message, opts = {}) {
+    const label = opts.defaultValue ? `${message} (${opts.defaultValue})` : message;
+    return new Promise((resolve) => {
+        const { unmount, waitUntilExit } = render(_jsx(PromptText, { message: label, mask: opts.mask, onSubmit: (value) => {
+                unmount();
+                resolve(value.trim() === '' ? (opts.defaultValue ?? '') : value.trim());
+            } }));
+        void waitUntilExit();
+    });
+}
+export function promptPassword(message, opts = {}) {
+    return promptText(message, { ...opts, mask: true });
+}
+function PromptSelect({ message, choices, onSubmit, }) {
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, color: "cyan", children: ["? ", message] }), _jsx(SelectInput, { items: choices, onSelect: (item) => onSubmit(item.value) })] }));
+}
+export async function promptSelect(message, choices) {
+    return new Promise((resolve) => {
+        const { unmount, waitUntilExit } = render(_jsx(PromptSelect, { message: message, choices: choices, onSubmit: (value) => {
+                unmount();
+                resolve(value);
+            } }));
+        void waitUntilExit();
+    });
+}
+export async function promptConfirm(message, defaultValue = true) {
+    const choices = defaultValue
+        ? [
+            { label: 'Yes', value: 'yes' },
+            { label: 'No', value: 'no' },
+        ]
+        : [
+            { label: 'No', value: 'no' },
+            { label: 'Yes', value: 'yes' },
+        ];
+    const answer = await promptSelect(message, choices);
+    return answer === 'yes';
+}
+export function printStep(message) {
+    console.log(`\n> ${message}`);
+}
+export function printInfo(message) {
+    console.log(`  ${message}`);
+}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@nostale/cli",
+  "version": "0.1.0",
+  "description": "NoStale installer CLI/TUI — setup wizard, local process supervisor, doctor",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "nostale": "./dist/index.js"
+  },
+  "homepage": "https://github.com/fetot/nostale/tree/main/apps/cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fetot/nostale.git",
+    "directory": "apps/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/fetot/nostale/issues"
+  },
+  "keywords": [
+    "wiki",
+    "documentation",
+    "prd",
+    "tdd",
+    "mcp",
+    "model-context-protocol",
+    "ast",
+    "codebase-extraction",
+    "cli"
+  ],
+  "author": "Ferdy Hasan Isma",
+  "engines": {
+    "node": ">=22"
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "files": [
+    "dist",
+    "services",
+    "assets",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc && tsx scripts/bundle-services.ts",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts",
+    "test": "tsx --test"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@libsql/client": "^0.17.4",
+    "better-auth": "^1.6.23",
+    "commander": "^15.0.0",
+    "ink": "^7.1.0",
+    "ink-select-input": "^6.2.0",
+    "ink-text-input": "^6.0.0",
+    "officeparser": "^7.2.3",
+    "pdf-parse": "^2.4.5",
+    "react": "^19.2.7"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "@types/react": "^19.2.0",
+    "esbuild": "^0.28.1",
+    "tsx": "^4.19.2",
+    "typescript": "^7.0.2"
+  }
+}