@prismer/sdk 1.7.3 → 1.7.4

package/dist/cli.js

@@ -1125,6 +1125,317 @@ var ENVIRONMENTS = {
   production: "https://prismer.cloud"
 };
 
+// src/aip.ts
+var import_aip_sdk = require("@prismer/aip-sdk");
+var import_aip_sdk2 = require("@prismer/aip-sdk");
+var import_aip_sdk3 = require("@prismer/aip-sdk");
+var import_aip_sdk4 = require("@prismer/aip-sdk");
+
+// src/encryption.ts
+function getSubtleCrypto() {
+  if (typeof globalThis.crypto?.subtle !== "undefined") {
+    return globalThis.crypto.subtle;
+  }
+  try {
+    const { webcrypto } = require("crypto");
+    return webcrypto.subtle;
+  } catch {
+    throw new Error("No SubtleCrypto available. Requires browser or Node.js 16+.");
+  }
+}
+function getRandomValues(arr) {
+  if (typeof globalThis.crypto?.getRandomValues !== "undefined") {
+    return globalThis.crypto.getRandomValues(arr);
+  }
+  try {
+    const { webcrypto } = require("crypto");
+    return webcrypto.getRandomValues(arr);
+  } catch {
+    throw new Error("No crypto.getRandomValues available.");
+  }
+}
+var subtle = () => getSubtleCrypto();
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_LENGTH = 16;
+var IV_LENGTH = 12;
+var KEY_LENGTH = 256;
+var _E2EEncryption = class _E2EEncryption {
+  constructor() {
+    this.masterKey = null;
+    this.keyPair = null;
+    this.sessionKeys = /* @__PURE__ */ new Map();
+    // conversationId → AES key
+    this.salt = null;
+    // ─── Pipeline Functions ──────────────────────────────────
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
+  }
+  /**
+   * Initialize encryption with user passphrase.
+   * Derives a master key via PBKDF2 and generates an ECDH key pair.
+   *
+   * @param passphrase - User passphrase for master key derivation
+   * @param salt - Optional Base64-encoded salt. If omitted, a random 16-byte salt is generated.
+   *               Store the salt (via exportSalt()) so you can re-derive the same master key later.
+   */
+  async init(passphrase, salt) {
+    this.salt = salt ? new Uint8Array(base64ToArrayBuffer(salt)) : getRandomValues(new Uint8Array(SALT_LENGTH));
+    const passphraseKey = await subtle().importKey(
+      "raw",
+      new TextEncoder().encode(passphrase),
+      "PBKDF2",
+      false,
+      ["deriveKey"]
+    );
+    this.masterKey = await subtle().deriveKey(
+      {
+        name: "PBKDF2",
+        salt: new Uint8Array(this.salt.buffer, this.salt.byteOffset, this.salt.byteLength).buffer,
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256"
+      },
+      passphraseKey,
+      { name: "AES-GCM", length: KEY_LENGTH },
+      false,
+      ["encrypt", "decrypt"]
+    );
+    this.keyPair = await subtle().generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveKey"]
+    );
+  }
+  /**
+   * Export the salt as Base64 string for persistent storage.
+   * You must store this and pass it back to init() to re-derive the same master key.
+   */
+  exportSalt() {
+    if (!this.salt) throw new Error("E2E not initialized. Call init() first.");
+    return arrayBufferToBase64(this.salt.buffer);
+  }
+  /**
+   * Export public key for sharing with conversation peers.
+   */
+  async exportPublicKey() {
+    if (!this.keyPair) throw new Error("E2E not initialized. Call init() first.");
+    return subtle().exportKey("jwk", this.keyPair.publicKey);
+  }
+  /**
+   * Derive a shared session key for a conversation using ECDH.
+   * Call this with each peer's public key.
+   */
+  async deriveSessionKey(conversationId, peerPublicKey) {
+    if (!this.keyPair) throw new Error("E2E not initialized. Call init() first.");
+    const importedPeerKey = await subtle().importKey(
+      "jwk",
+      peerPublicKey,
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    const sessionKey = await subtle().deriveKey(
+      { name: "ECDH", public: importedPeerKey },
+      this.keyPair.privateKey,
+      { name: "AES-GCM", length: KEY_LENGTH },
+      false,
+      ["encrypt", "decrypt"]
+    );
+    this.sessionKeys.set(conversationId, sessionKey);
+  }
+  /**
+   * Set a pre-shared session key for a conversation.
+   * Useful when the key is exchanged out-of-band or derived from a group key.
+   */
+  async setSessionKey(conversationId, rawKey) {
+    const key = await subtle().importKey(
+      "raw",
+      rawKey,
+      { name: "AES-GCM", length: KEY_LENGTH },
+      false,
+      ["encrypt", "decrypt"]
+    );
+    this.sessionKeys.set(conversationId, key);
+  }
+  /**
+   * Generate a random session key for a conversation.
+   * Returns the raw key bytes for sharing with peers.
+   */
+  async generateSessionKey(conversationId) {
+    const key = await subtle().generateKey(
+      { name: "AES-GCM", length: KEY_LENGTH },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    this.sessionKeys.set(conversationId, key);
+    return subtle().exportKey("raw", key);
+  }
+  /**
+   * Encrypt plaintext for a conversation.
+   * Returns base64-encoded ciphertext with prepended IV.
+   */
+  async encrypt(conversationId, plaintext) {
+    const key = this.sessionKeys.get(conversationId);
+    if (!key) throw new Error(`No session key for conversation ${conversationId}. Call deriveSessionKey() first.`);
+    const iv = getRandomValues(new Uint8Array(IV_LENGTH));
+    const encoded = new TextEncoder().encode(plaintext);
+    const ciphertext = await subtle().encrypt(
+      { name: "AES-GCM", iv },
+      key,
+      encoded
+    );
+    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+    combined.set(iv, 0);
+    combined.set(new Uint8Array(ciphertext), iv.length);
+    return arrayBufferToBase64(combined.buffer);
+  }
+  /**
+   * Decrypt ciphertext from a conversation.
+   * Expects base64-encoded data with prepended IV.
+   */
+  async decrypt(conversationId, ciphertext) {
+    const key = this.sessionKeys.get(conversationId);
+    if (!key) throw new Error(`No session key for conversation ${conversationId}. Call deriveSessionKey() first.`);
+    const combined = base64ToArrayBuffer(ciphertext);
+    const iv = combined.slice(0, IV_LENGTH);
+    const data = combined.slice(IV_LENGTH);
+    const decrypted = await subtle().decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(iv) },
+      key,
+      data
+    );
+    return new TextDecoder().decode(decrypted);
+  }
+  /**
+   * Check if a session key exists for a conversation.
+   */
+  hasSessionKey(conversationId) {
+    return this.sessionKeys.has(conversationId);
+  }
+  /**
+   * Remove session key for a conversation.
+   */
+  removeSessionKey(conversationId) {
+    this.sessionKeys.delete(conversationId);
+  }
+  /**
+   * Clear all keys and reset state.
+   */
+  destroy() {
+    this.masterKey = null;
+    this.keyPair = null;
+    this.sessionKeys.clear();
+    this.salt = null;
+    this.messageCount = 0;
+  }
+  /**
+   * High-level encrypt-for-send pipeline.
+   * Encrypts content, builds metadata, and handles key rotation.
+   *
+   * Returns { encryptedContent, metadata } ready to send.
+   */
+  async encryptForSend(conversationId, content) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    const needsRotation = this.shouldRotateKey();
+    const encryptedContent = await this.encrypt(conversationId, content);
+    this.messageCount++;
+    return {
+      encryptedContent,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        ...needsRotation && { keyRotationRequested: true }
+      }
+    };
+  }
+  /**
+   * High-level decrypt-on-receive pipeline.
+   * Decrypts content and validates metadata.
+   */
+  async decryptOnReceive(conversationId, encryptedContent, metadata) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    return this.decrypt(conversationId, encryptedContent);
+  }
+  /**
+   * High-level file encryption pipeline.
+   */
+  async encryptFile(conversationId, fileData) {
+    const base64Data = arrayBufferToBase64(fileData);
+    const encryptedData = await this.encrypt(conversationId, base64Data);
+    return {
+      encryptedData,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        fileEncrypted: true
+      }
+    };
+  }
+  /**
+   * High-level file decryption pipeline.
+   */
+  async decryptFile(conversationId, encryptedData) {
+    const base64Data = await this.decrypt(conversationId, encryptedData);
+    return base64ToArrayBuffer(base64Data);
+  }
+  /**
+   * Check if key rotation is needed (1000 messages or 24 hours).
+   */
+  shouldRotateKey() {
+    if (this.messageCount >= _E2EEncryption.KEY_ROTATION_THRESHOLD) {
+      return true;
+    }
+    if (Date.now() - this.lastRotation >= _E2EEncryption.KEY_ROTATION_INTERVAL_MS) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Perform key rotation: generate new ECDH keypair and reset counters.
+   * The caller is responsible for re-exchanging keys with peers.
+   */
+  async rotateKeys() {
+    this.keyPair = await subtle().generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      ["deriveKey"]
+    );
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
+    this.sessionKeys.clear();
+    return this.exportPublicKey();
+  }
+};
+_E2EEncryption.KEY_ROTATION_THRESHOLD = 1e3;
+_E2EEncryption.KEY_ROTATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var E2EEncryption = _E2EEncryption;
+function arrayBufferToBase64(buffer) {
+  if (typeof btoa !== "undefined") {
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (let i = 0; i < bytes.byteLength; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+  }
+  return Buffer.from(buffer).toString("base64");
+}
+function base64ToArrayBuffer(base64) {
+  if (typeof atob !== "undefined") {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+  }
+  const buf = Buffer.from(base64, "base64");
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
+
 // src/index.ts
 var AccountClient = class {
   constructor(_r) {
@@ -1607,11 +1918,11 @@ var EvolutionClient = class {
   }
   /** Delete a gene */
   async deleteGene(geneId) {
-    return this._r("DELETE", `/api/im/evolution/genes/${geneId}`);
+    return this._r("DELETE", `/api/im/evolution/genes/${encodeURIComponent(geneId)}`);
   }
   /** Publish a gene. Pass skipCanary=true to bypass canary validation (MVP/admin). */
   async publishGene(geneId, options) {
-    return this._r("POST", `/api/im/evolution/genes/${geneId}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
+    return this._r("POST", `/api/im/evolution/genes/${encodeURIComponent(geneId)}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
   }
   /** Import a published gene */
   async importGene(geneId) {
@@ -1697,6 +2008,14 @@ var EvolutionClient = class {
   async getSkillContent(slugOrId) {
     return this._r("GET", `/api/im/skills/${encodeURIComponent(slugOrId)}/content`);
   }
+  /** Create/submit a community skill */
+  async createSkill(input) {
+    return this._r("POST", "/api/im/skills", input);
+  }
+  /** Star a skill (increment community rating) */
+  async starSkill(skillId) {
+    return this._r("POST", `/api/im/skills/${encodeURIComponent(skillId)}/star`);
+  }
   /**
    * Install a skill and write SKILL.md to local filesystem.
    * Combines cloud install + local file sync for Claude Code / OpenClaw / OpenCode.
@@ -1759,8 +2078,8 @@ var EvolutionClient = class {
   async uninstallSkillLocal(slugOrId) {
     const result = await this.uninstallSkill(slugOrId);
     const removedPaths = [];
-    const safeSlug = slugOrId.replace(/[\/\\]/g, "").replace(/\.\./g, "");
-    if (!safeSlug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
+    const slug = safeSlug(slugOrId);
+    if (!slug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
     try {
       const fs2 = await import("fs");
       const path2 = await import("path");
@@ -1768,10 +2087,10 @@ var EvolutionClient = class {
       const home = os2.homedir();
       const pluginBase = process.env.PRISMER_PLUGIN_DIR || path2.join(home, ".claude", "plugins", "prismer");
       const dirs = [
-        path2.join(home, ".claude", "skills", safeSlug),
-        path2.join(home, ".openclaw", "skills", safeSlug),
-        path2.join(home, ".config", "opencode", "skills", safeSlug),
-        path2.join(pluginBase, "skills", safeSlug)
+        path2.join(home, ".claude", "skills", slug),
+        path2.join(home, ".openclaw", "skills", slug),
+        path2.join(home, ".config", "opencode", "skills", slug),
+        path2.join(pluginBase, "skills", slug)
       ];
       for (const dir of dirs) {
         try {
@@ -1881,6 +2200,9 @@ var EvolutionClient = class {
     return this._r("POST", "/api/im/evolution/sync", body);
   }
 };
+function safeSlug(input) {
+  return input.replace(/[\/\\]/g, "").replace(/\.\./g, "").replace(/\0/g, "");
+}
 function guessMimeType(fileName) {
   const ext = fileName.split(".").pop()?.toLowerCase() || "";
   const map = {
@@ -3285,6 +3607,52 @@ function register3(parent, getIMClient2, _getAPIClient) {
       handleError(err);
     }
   });
+  evolve.command("publish <gene-id>").description("Publish a private gene to the evolution network").option("--skip-canary", "skip canary phase and publish directly").option("--json", "output raw JSON response").action(async (geneId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.evolution.publishGene(geneId, { skipCanary: opts.skipCanary });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      printResult(res, `Gene ${geneId} published${opts.skipCanary ? " (skipped canary)" : " (canary phase)"}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  evolve.command("fork <gene-id>").description("Fork a public gene with optional modifications").option("--strategy <steps...>", "override strategy steps").option("--json", "output raw JSON response").action(async (geneId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.evolution.forkGene({
+        gene_id: geneId,
+        modifications: opts.strategy ? { strategy: opts.strategy } : void 0
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      printResult(res);
+      const data = res.data;
+      const newId = data?.id ?? data?.gene_id ?? "unknown";
+      process.stdout.write(`Forked gene ${geneId} \u2192 ${newId}
+`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  evolve.command("delete <gene-id>").description("Delete a gene you own").option("--json", "output raw JSON response").action(async (geneId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.evolution.deleteGene(geneId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      printResult(res, `Gene ${geneId} deleted`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
   evolve.command("import <gene-id>").description("Import a published gene into your collection").option("--json", "output raw JSON response").action(async (geneId, opts) => {
     const client = getIMClient2();
     try {
@@ -4619,7 +4987,7 @@ function readConfig() {
 }
 function writeConfig(config) {
   ensureConfigDir();
-  fs.writeFileSync(CONFIG_PATH, TOML.stringify(config), "utf-8");
+  fs.writeFileSync(CONFIG_PATH, TOML.stringify(config), { encoding: "utf-8", mode: 384 });
 }
 function setNestedValue(obj, dotPath, value) {
   const parts = dotPath.split(".");
@@ -4635,7 +5003,7 @@ function getIMClient() {
   const cfg = readConfig();
   const token = cfg?.auth?.im_token;
   if (!token) {
-    console.error('No IM token. Run "prismer register" first.');
+    console.error('No IM token. Run "prismer setup --agent" or "prismer register <username>" first.');
     process.exit(1);
   }
   const env = cfg?.default?.environment || "production";
@@ -4646,7 +5014,7 @@ function getAPIClient() {
   const cfg = readConfig();
   const apiKey = cfg?.default?.api_key;
   if (!apiKey) {
-    console.error('No API key. Run "prismer init <api-key>" first.');
+    console.error('No API key. Run "prismer setup" to sign in and get your key.');
     process.exit(1);
   }
   const env = cfg?.default?.environment || "production";
@@ -4655,20 +5023,191 @@ function getAPIClient() {
 }
 var program = new import_commander.Command();
 program.name("prismer").description("Prismer Cloud SDK CLI").version(cliVersion);
-program.command("init <api-key>").description("Store API key in ~/.prismer/config.toml").action((apiKey) => {
-  const config = readConfig();
+async function verifyAndSaveKey(config, apiKey) {
+  if (!apiKey) {
+    console.error("No key provided.");
+    process.exit(1);
+  }
+  if (!apiKey.startsWith("sk-prismer-")) {
+    console.error("Invalid key format. API keys start with sk-prismer-");
+    console.error("Get your key at: https://prismer.cloud/setup");
+    process.exit(1);
+  }
+  const baseUrl = config.default?.base_url || "https://prismer.cloud";
+  try {
+    const res = await fetch(`${baseUrl}/api/version`, {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.status === 401) {
+      console.error("API key is invalid or expired.");
+      console.error("Get a new key at: https://prismer.cloud/setup");
+      process.exit(1);
+    }
+    console.log("API key verified \u2713");
+  } catch (err) {
+    console.warn(`Could not verify key (${err.message}). Saving anyway.`);
+  }
   if (!config.default) config.default = {};
   config.default.api_key = apiKey;
   if (!config.default.environment) config.default.environment = "production";
-  if (config.default.base_url === void 0) config.default.base_url = "";
   writeConfig(config);
-  console.log("API key saved to ~/.prismer/config.toml");
+  console.log("");
+  console.log("Saved to ~/.prismer/config.toml");
+  console.log("You can now use: CLI commands, MCP tools, Claude Code plugin, and all SDKs.");
+}
+function openBrowser(url) {
+  const { execFile } = require("child_process");
+  if (process.platform === "darwin") {
+    execFile("open", [url], (err) => {
+      if (err) console.warn("Could not open browser. Please open the URL above manually.");
+    });
+  } else if (process.platform === "win32") {
+    execFile("cmd.exe", ["/c", "start", "", url], (err) => {
+      if (err) console.warn("Could not open browser. Please open the URL above manually.");
+    });
+  } else {
+    execFile("xdg-open", [url], (err) => {
+      if (err) console.warn("Could not open browser. Please open the URL above manually.");
+    });
+  }
+}
+async function runSetup(opts, apiKey) {
+  const config = readConfig();
+  if (!config.default) config.default = {};
+  const baseUrl = config.default.base_url || "https://prismer.cloud";
+  if (!opts.force && config.default.api_key?.startsWith("sk-prismer-")) {
+    const masked = config.default.api_key.slice(0, 12) + "..." + config.default.api_key.slice(-4);
+    console.log(`Already configured: ${masked}`);
+    console.log("");
+    console.log("To reconfigure, run: prismer setup --force");
+    console.log("To check status:     prismer status");
+    return;
+  }
+  if (apiKey) {
+    await verifyAndSaveKey(config, apiKey);
+    return;
+  }
+  if (opts.agent) {
+    if (!opts.force && config.auth?.im_token) {
+      console.log("Already registered as agent (IM token exists).");
+      console.log("For API key access, run: prismer setup");
+      return;
+    }
+    const username = `agent-${Date.now().toString(36)}`;
+    try {
+      const res = await fetch(`${baseUrl}/api/im/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ username, displayName: username, type: "agent" })
+      });
+      const data = await res.json();
+      if (!data.ok) throw new Error(data.error?.message || "Registration failed");
+      if (!config.auth) config.auth = {};
+      config.auth.im_token = data.data?.token;
+      config.auth.im_user_id = data.data?.imUserId || data.data?.userId;
+      config.auth.im_username = data.data?.username || username;
+      writeConfig(config);
+      console.log("Agent registered with free credits \u2713");
+      console.log(`  Username: ${config.auth.im_username}`);
+      console.log(`  User ID:  ${config.auth.im_user_id}`);
+      console.log("");
+      console.log("For full API access, sign in: prismer setup");
+    } catch (err) {
+      console.error(`Agent registration failed: ${err.message}`);
+      console.error("Try signing in instead: prismer setup");
+      process.exit(1);
+    }
+    return;
+  }
+  if (opts.manual) {
+    const setupUrl = `${baseUrl}/setup?utm_source=cli&utm_medium=manual`;
+    console.log("Opening browser to sign in...");
+    console.log(`  ${setupUrl}`);
+    console.log("");
+    openBrowser(setupUrl);
+    console.log("After signing in, copy the API key from the page and paste it below.");
+    console.log("");
+    const readline = require("readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("Paste your API key: ", (key) => {
+      rl.close();
+      verifyAndSaveKey(config, key.trim()).catch((err) => {
+        console.error(`Setup failed: ${err.message}`);
+        process.exit(1);
+      });
+    });
+    return;
+  }
+  const http = require("http");
+  const crypto2 = require("crypto");
+  const state = crypto2.randomBytes(16).toString("hex");
+  let resolved = false;
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url, `http://localhost`);
+    if (url.pathname === "/callback") {
+      const key = url.searchParams.get("key");
+      const returnedState = url.searchParams.get("state");
+      res.writeHead(200, { "Content-Type": "text/html" });
+      if (!key || !returnedState || returnedState !== state) {
+        res.end('<html><head><meta name="referrer" content="no-referrer"></head><body style="font-family:system-ui;text-align:center;padding:60px"><h2>Setup failed</h2><p>Invalid or missing parameters. Please try again.</p></body></html>');
+        return;
+      }
+      if (!key.startsWith("sk-prismer-")) {
+        res.end('<html><head><meta name="referrer" content="no-referrer"></head><body style="font-family:system-ui;text-align:center;padding:60px"><h2>Invalid key</h2><p>The key format is unexpected. Please try again.</p></body></html>');
+        return;
+      }
+      res.end('<html><head><meta name="referrer" content="no-referrer"></head><body style="font-family:system-ui;text-align:center;padding:60px"><h2>Done!</h2><p>API key received. You can close this tab.</p></body></html>');
+      resolved = true;
+      verifyAndSaveKey(config, key).then(() => {
+        server.close();
+        process.exit(0);
+      }).catch((err) => {
+        console.error(`Setup failed: ${err.message}`);
+        server.close();
+        process.exit(1);
+      });
+    } else {
+      res.writeHead(404);
+      res.end("Not found");
+    }
+  });
+  server.listen(0, "127.0.0.1", () => {
+    const port = server.address().port;
+    const callbackUrl = `http://127.0.0.1:${port}/callback`;
+    const setupUrl = `${baseUrl}/setup?callback=${encodeURIComponent(callbackUrl)}&state=${state}&utm_source=cli&utm_medium=auto`;
+    console.log("Opening browser to sign in...");
+    console.log("");
+    openBrowser(setupUrl);
+    console.log("Waiting for authentication...");
+    console.log("(If the browser didn't open, visit this URL manually:)");
+    console.log(`  ${setupUrl}`);
+    console.log("");
+    setTimeout(() => {
+      if (!resolved) {
+        console.error("Timed out waiting for authentication (5 min).");
+        console.error("");
+        console.error("Alternatives:");
+        console.error("  prismer setup --manual    Paste key manually");
+        console.error("  prismer setup --agent     Register as agent (free credits, no browser)");
+        server.close();
+        process.exit(1);
+      }
+    }, 5 * 60 * 1e3);
+  });
+}
+program.command("setup [api-key]").description("Set up Prismer \u2014 sign in via browser, register as agent, or provide your API key").option("--manual", "Paste API key manually instead of browser auto-flow").option("--agent", "Register as agent with free credits (no browser, for CI/scripts)").option("--force", "Reconfigure even if already set up").action(async (apiKey, opts) => {
+  await runSetup(opts, apiKey);
+});
+program.command("init [api-key]").description('Alias for "prismer setup" (deprecated, use setup instead)').option("--manual", "Paste API key manually").option("--agent", "Register as agent with free credits").option("--force", "Reconfigure even if already set up").action(async (apiKey, opts) => {
+  console.log('Note: "prismer init" is deprecated. Use "prismer setup" instead.');
+  console.log("");
+  await runSetup(opts, apiKey);
 });
 program.command("register <username>").description("Register an IM identity and store the token").option("--type <type>", "Identity type: agent or human", "agent").option("--display-name <name>", "Display name").option("--agent-type <agentType>", "Agent type: assistant, specialist, orchestrator, tool, bot").option("--capabilities <caps>", "Comma-separated capabilities").option("--endpoint <url>", "Webhook endpoint URL").option("--webhook-secret <secret>", "Webhook HMAC secret").action(async (username, opts) => {
   const config = readConfig();
   const apiKey = config.default?.api_key;
   if (!apiKey) {
-    console.error('No API key. Run "prismer init <api-key>" first.');
+    console.error('No API key. Run "prismer setup" first.');
     process.exit(1);
   }
   const client = new PrismerClient({
@@ -4766,7 +5305,7 @@ program.command("status").description("Show current config and live info").actio
 var configCmd = program.command("config").description("Manage config file");
 configCmd.command("show").description("Print config file").action(() => {
   if (!fs.existsSync(CONFIG_PATH)) {
-    console.log('No config file. Run "prismer init <api-key>" to create one.');
+    console.log('No config file. Run "prismer setup" to create one.');
     return;
   }
   console.log(fs.readFileSync(CONFIG_PATH, "utf-8"));