@rolino/cli 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,9 +1,34 @@
 # @rolino/cli
 
+## 0.7.1
+
+### Patch Changes
+
+- c340405: Request the complete opt-in capability set during browser authorization so users can grant draft and scheduling access to local agents. Remote MCP setup now uses host-native configuration and standard OAuth client discovery instead of a fixed Rolino-managed client.
+  - @rolino/contracts@0.7.1
+  - @rolino/sdk@0.7.1
+  - @rolino/local-auth@0.7.1
+
+## 0.7.0
+
+### Minor Changes
+
+- f78e0ff: Prefer advertised Streamable HTTP MCP with client-owned OAuth, add explicit HTTP and STDIO transport selection, and keep local MCP as a fallback.
+- 358f37a: Expose additive safe Blog preparation, next-action, and quality summaries through the shared read contracts and existing clients.
+
+### Patch Changes
+
+- Updated dependencies [358f37a]
+  - @rolino/contracts@0.7.0
+  - @rolino/sdk@0.7.0
+  - @rolino/local-auth@0.7.0
+
 ## 0.6.0
 
 ### Minor Changes
 
+- Add matching backlink prospecting commands with safe JSON output and formula-safe contact CSV export. Rolino does not send email.
+
 - d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
 - 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
 - 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
@@ -93,6 +118,10 @@
 
 ### Minor Changes
 
+- Show additive safe Blog preparation and quality state in existing JSON reads.
+
+### Minor Changes
+
 - Add Blog image generation, exact local-file upload, image review, confirmed
   exact-bundle approval, future scheduling, and schedule cancellation commands
   with deterministic agent output, stable idempotency, safe errors, and

package/README.md

@@ -14,16 +14,17 @@ The supported installation keeps the CLI independent from MCP:
 npm install --global @rolino/cli
 ```
 
-Users who also want local MCP will install both packages explicitly:
+Users who need local STDIO MCP will install both packages explicitly:
 
 ```bash
 npm install --global @rolino/cli @rolino/mcp
 ```
 
-The CLI-only installation does not include `@rolino/mcp` or the MCP SDK. If a
-CLI-only user runs `rolino setup mcp`, the command explains how to install the
-separate MCP package and then retry. Rolino never downloads or installs MCP
-silently.
+The default `rolino setup mcp` mode checks the selected Rolino instance. It
+uses hosted Streamable HTTP when the instance advertises it. This mode does
+not need `@rolino/mcp`. If remote MCP is not available, the command uses local
+STDIO and explains how to install the separate MCP package. Rolino never
+downloads or installs MCP silently.
 
 Initial commands:
 
@@ -31,12 +32,24 @@ Initial commands:
 rolino auth login
 rolino auth status
 rolino auth logout
-rolino setup mcp --client codex [--scope user|project]
-rolino setup mcp --client claude-code [--scope user|project]
+rolino setup mcp --client codex [--transport auto|http|stdio] [--scope user|project]
+rolino setup mcp --client claude-code [--transport auto|http|stdio] [--scope user|project]
 rolino whoami
 rolino projects create --name NAME [--type PRODUCT|SERVICE|PERSONAL|COMPANY] [--website URL] [--description TEXT] [--idempotency-key KEY] --yes
 rolino projects list [--limit 50] [--cursor ID]
 rolino projects show PROJECT_ID
+rolino backlinks targets list --project PROJECT_ID
+rolino backlinks targets add --project PROJECT_ID --url URL --label LABEL
+rolino backlinks discover --project PROJECT_ID --limit 20
+rolino backlinks runs get --project PROJECT_ID --run RUN_ID
+rolino backlinks prospects list --project PROJECT_ID [--stage STAGE]
+rolino backlinks prospects get --project PROJECT_ID --prospect PROSPECT_ID
+rolino backlinks prospects approve --project PROJECT_ID --prospect PROSPECT_ID --expected-version VERSION
+rolino backlinks contacts research --project PROJECT_ID --prospect PROSPECT_ID
+rolino backlinks contacts list --project PROJECT_ID
+rolino backlinks contacts export --project PROJECT_ID --format csv
+rolino backlinks outreach update --project PROJECT_ID --prospect PROSPECT_ID --file DRAFT.json --expected-version VERSION
+rolino backlinks verify --project PROJECT_ID --prospect PROSPECT_ID --url PUBLIC_URL --expected-version VERSION
 rolino media list --project PROJECT_ID [--type IMAGE|VIDEO] [--query TEXT] [--limit 50] [--cursor ID]
 rolino media upload FILE_PATH --project PROJECT_ID --yes
 rolino posts create --project PROJECT_ID --caption TEXT [--platform INSTAGRAM|TIKTOK|YOUTUBE|BLUESKY|LINKEDIN|GOOGLE_BUSINESS_PROFILE] [--media ASSET_ID] --yes
@@ -70,10 +83,10 @@ rolino blog schedule cancel execute ARTICLE_ID --project PROJECT_ID --confirmati
 rolino doctor
 ```
 
-Interactive login uses standard OAuth Authorization Code with PKCE S256. It
-opens the configured Rolino instance, requests the exact \`/api/v1\` resource,
-uses the fixed \`http://127.0.0.1:48391/oauth/callback\` redirect, and obtains
-explicit workspace approval.
+Interactive login uses standard OAuth Authorization Code with PKCE S256. It
+opens the configured Rolino instance, requests the exact \`/api/v1\` resource,
+uses the fixed \`http://127.0.0.1:48391/oauth/callback\` redirect, and obtains
+explicit workspace approval.
 The approval screen always includes identity and workspace reads and lets the
 user independently opt into project creation, draft writing, confirmed
 scheduling, confirmed immediate publishing, and read-only SEO Intelligence.
@@ -89,26 +102,35 @@ with evidence. It cannot create a final draft in the same action.
 Optional permissions start off,
 and existing credentials never gain a newly selected permission. Revoke and
 reauthorize an existing connection to grant project creation or `seo:read`.
-Existing grants never receive `seo:read` automatically. OAuth tokens never
-pass through a browser URL. The CLI stores a short-lived access token and a
-rotating refresh token by host, issuer, client, and resource in the
-operating-system configuration directory. It does not read or migrate the old
-interactive credential, so the first use after this cutover requires sign-in;
+Existing grants never receive `seo:read` automatically. OAuth tokens never
+pass through a browser URL. The CLI stores a short-lived access token and a
+rotating refresh token by host, issuer, client, and resource in the
+operating-system configuration directory. It does not read or migrate the old
+interactive credential, so the first use after this cutover requires sign-in;
 `ROLINO_CONFIG_DIR` overrides that location. `auth logout` revokes the calling
-workspace grant and OAuth refresh token before deleting its local copy.
+workspace grant and OAuth refresh token before deleting its local copy.
 
 The terminal waits five minutes for browser approval. If that request expires,
 close the old approval page and run `rolino auth login` again; refreshing the
 page cannot restart the closed loopback listener.
 
-`setup mcp` finds the built Rolino stdio server, previews the exact token-free
-configuration, and asks before changing anything. User scope is the default.
+`setup mcp` checks `/api/v1/meta` and prefers hosted Streamable HTTP when it is
+available. Remote setup writes the `/mcp` URL and OAuth mode, does not start a
+local MCP process, and does not reuse `rolino auth login`. For Codex, it leaves
+OAuth client registration and the loopback callback to Codex so Codex can use
+Rolino's advertised Client ID Metadata Document support. Run `codex mcp login
+rolino` after remote Codex setup. Use `--transport http` to
+require remote MCP or `--transport stdio` to require the local package and its
+shared CLI OAuth session. The command previews the exact token-free
+configuration and asks before changing anything. User scope is the default.
 Codex configuration is written to `CODEX_HOME/config.toml` or
 `~/.codex/config.toml`; Claude Code user scope is applied through its official
 CLI. Project scope writes `.codex/config.toml` or `.mcp.json` in the current
 directory. Existing file-backed configuration is backed up with a
-`.rolino-backup` suffix. Use `--dry-run` to preview in scripts and `--yes` to
-provide explicit non-interactive consent; `--agent` never implies consent.
+`.rolino-backup` suffix. Use `--dry-run` to preview in scripts and `--yes` to
+provide explicit non-interactive consent; `--agent` never implies consent.
+An orphan Rolino-managed marker left by an earlier removal is repaired without
+changing unrelated Codex settings.
 
 Draft creation and update never schedule or publish. Updates change only the
 fields supplied; omitted media, destinations, captions, and provider settings

package/dist/bin.cjs

@@ -34,7 +34,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "@rolino/cli",
-  version: "0.6.0",
+  version: "0.7.1",
   description: "Agent-friendly command-line interface for Rolino",
   type: "module",
   license: "MIT",
@@ -91,9 +91,9 @@ var package_default = {
     dev: "tsx src/bin.ts"
   },
   dependencies: {
-    "@rolino/contracts": "0.6.0",
-    "@rolino/local-auth": "0.6.0",
-    "@rolino/sdk": "0.6.0",
+    "@rolino/contracts": "0.7.1",
+    "@rolino/local-auth": "0.7.1",
+    "@rolino/sdk": "0.7.1",
     commander: "^15.0.0",
     open: "^11.0.0"
   },
@@ -106,24 +106,21 @@ var package_default = {
 };
 
 // src/cli.ts
-var import_contracts = require("@rolino/contracts");
+var import_contracts2 = require("@rolino/contracts");
 var import_sdk = require("@rolino/sdk");
 
 // src/browser-login.ts
 var import_node_crypto = require("crypto");
 var import_node_http = require("http");
+var import_contracts = require("@rolino/contracts");
 var import_local_auth = require("@rolino/local-auth");
 var import_open = __toESM(require("open"), 1);
 var OAUTH_CALLBACK_PORT = 48391;
 var OAUTH_CALLBACK_PATH = "/oauth/callback";
 var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
-var DEFAULT_SCOPES = [
+var AUTHORIZATION_REQUEST_SCOPES = [
   "offline_access",
-  "identity:read",
-  "projects:read",
-  "posts:read",
-  "integrations:read",
-  "calendar:read"
+  ...import_contracts.AGENT_CAPABILITIES
 ];
 function escapeHtml(value) {
   return value.replace(/[&<>"']/g, (character) => ({
@@ -163,7 +160,7 @@ function createBrowserAuthorizationRequest(baseUrl) {
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", configuration.clientId);
   url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", DEFAULT_SCOPES.join(" "));
+  url.searchParams.set("scope", AUTHORIZATION_REQUEST_SCOPES.join(" "));
   url.searchParams.set("resource", configuration.resource);
   url.searchParams.set("state", state);
   url.searchParams.set("code_challenge", codeChallenge);
@@ -202,7 +199,7 @@ async function exchangeAuthorizationCode(options) {
     accessTokenExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString(),
     refreshToken: payload.refresh_token,
     refreshTokenExpiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3).toISOString(),
-    scopes: typeof payload.scope === "string" ? payload.scope.split(/\s+/).filter(Boolean) : [...DEFAULT_SCOPES]
+    scopes: typeof payload.scope === "string" ? payload.scope.split(/\s+/).filter(Boolean) : [...AUTHORIZATION_REQUEST_SCOPES]
   };
 }
 async function loginWithBrowser(options) {
@@ -649,12 +646,18 @@ function removeExistingCodexEntry(source, newline) {
   return kept.join(newline).trimEnd();
 }
 function codexBlock(server, newline) {
+  const configuration = server.transport === "http" ? [
+    `url = ${tomlString(server.url)}`,
+    `auth = ${tomlString(server.auth)}`
+  ] : [
+    `command = ${tomlString(server.command)}`,
+    `args = [${server.args.map(tomlString).join(", ")}]`,
+    `env = { ROLINO_URL = ${tomlString(server.env.ROLINO_URL)} }`
+  ];
   return [
     CODEX_BEGIN,
     "[mcp_servers.rolino]",
-    `command = ${tomlString(server.command)}`,
-    `args = [${server.args.map(tomlString).join(", ")}]`,
-    `env = { ROLINO_URL = ${tomlString(server.env.ROLINO_URL)} }`,
+    ...configuration,
     CODEX_END
   ].join(newline);
 }
@@ -663,13 +666,12 @@ function updateCodexConfig(source, server) {
   const block = codexBlock(server, newline);
   const begin = source.indexOf(CODEX_BEGIN);
   const end = source.indexOf(CODEX_END);
-  if (begin === -1 !== (end === -1) || begin !== -1 && end < begin) {
-    throw new TypeError("Codex config contains an incomplete Rolino-managed block.");
-  }
   let unmanagedSource = source;
-  if (begin !== -1) {
+  if (begin !== -1 && end !== -1 && end > begin) {
     const after = end + CODEX_END.length;
     unmanagedSource = `${source.slice(0, begin)}${source.slice(after)}`;
+  } else if (begin !== -1 || end !== -1) {
+    unmanagedSource = source.split(/\r?\n/).filter((line) => line.trim() !== CODEX_BEGIN && line.trim() !== CODEX_END).join(newline);
   }
   const withoutRolino = removeExistingCodexEntry(unmanagedSource, newline);
   return `${withoutRolino ? `${withoutRolino}${newline}${newline}` : ""}${block}${newline}`;
@@ -694,7 +696,12 @@ function updateClaudeProjectConfig(source, server) {
     ...parsed,
     mcpServers: {
       ...currentServers,
-      rolino: { type: "stdio", ...server }
+      rolino: server.transport === "http" ? { type: "http", url: server.url } : {
+        type: "stdio",
+        command: server.command,
+        args: server.args,
+        env: server.env
+      }
     }
   }, null, 2)}
 `;
@@ -726,6 +733,7 @@ async function setupCodex(options, server) {
     backupPath,
     changed,
     dryRun: options.dryRun ?? false,
+    transport: server.transport,
     server
   };
 }
@@ -746,6 +754,7 @@ async function setupClaudeCode(options, server) {
       backupPath,
       changed,
       dryRun: options.dryRun ?? false,
+      transport: server.transport,
       server
     };
   }
@@ -758,6 +767,7 @@ async function setupClaudeCode(options, server) {
       backupPath: null,
       changed: true,
       dryRun: true,
+      transport: server.transport,
       server
     };
   }
@@ -771,7 +781,12 @@ async function setupClaudeCode(options, server) {
     "mcp",
     "add-json",
     "rolino",
-    JSON.stringify({ type: "stdio", ...server }),
+    JSON.stringify(server.transport === "http" ? { type: "http", url: server.url } : {
+      type: "stdio",
+      command: server.command,
+      args: server.args,
+      env: server.env
+    }),
     "--scope",
     "user"
   ], options);
@@ -787,14 +802,51 @@ async function setupClaudeCode(options, server) {
     backupPath: null,
     changed: true,
     dryRun: false,
+    transport: server.transport,
     server
   };
 }
+function remoteMcpUrl(baseUrl) {
+  return new URL("mcp", `${baseUrl.replace(/\/$/, "")}/`).toString();
+}
+async function advertisedRemoteMcp(options) {
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  try {
+    const response = await fetchImplementation(
+      new URL("api/v1/meta", `${options.baseUrl.replace(/\/$/, "")}/`),
+      {
+        headers: { accept: "application/json" },
+        signal: AbortSignal.timeout(5e3)
+      }
+    );
+    if (!response.ok) return false;
+    const payload = await response.json();
+    return payload.data?.mcp?.streamableHttp === true;
+  } catch {
+    return false;
+  }
+}
+async function resolveTransport(options) {
+  const requested = options.transport ?? "stdio";
+  if (requested === "stdio") return "stdio";
+  if (await advertisedRemoteMcp(options)) return "http";
+  if (requested === "http") {
+    throw new TypeError(
+      "This Rolino instance does not advertise Streamable HTTP MCP. Use --transport stdio, or enable and verify remote MCP on the server."
+    );
+  }
+  return "stdio";
+}
 async function setupMcp(options) {
-  const serverPath = await resolveServerPath(options);
-  const server = {
+  const transport = await resolveTransport(options);
+  const server = transport === "http" ? {
+    transport: "http",
+    url: remoteMcpUrl(options.baseUrl),
+    auth: "oauth"
+  } : {
+    transport: "stdio",
     command: options.nodePath,
-    args: [serverPath],
+    args: [await resolveServerPath(options)],
     env: { ROLINO_URL: options.baseUrl }
   };
   return options.client === "codex" ? setupCodex(options, server) : setupClaudeCode(options, server);
@@ -825,40 +877,40 @@ function outputFormat(value) {
   throw new import_commander.InvalidArgumentError("Output must be human, json, or jsonl.");
 }
 function postStatus(value) {
-  const parsed = import_contracts.PostStatusSchema.safeParse(value.toUpperCase());
+  const parsed = import_contracts2.PostStatusSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError(
-    `Status must be one of ${import_contracts.PostStatusSchema.options.join(", ")}.`
+    `Status must be one of ${import_contracts2.PostStatusSchema.options.join(", ")}.`
   );
 }
 function seoOpportunityKind(value) {
-  const parsed = import_contracts.SeoOpportunityKindSchema.safeParse(value.toUpperCase());
+  const parsed = import_contracts2.SeoOpportunityKindSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
-  throw new import_commander.InvalidArgumentError(`SEO kind must be one of ${import_contracts.SeoOpportunityKindSchema.options.join(", ")}.`);
+  throw new import_commander.InvalidArgumentError(`SEO kind must be one of ${import_contracts2.SeoOpportunityKindSchema.options.join(", ")}.`);
 }
 function seoExpectedImpact(value) {
-  const parsed = import_contracts.SeoExpectedImpactSchema.safeParse(value.toUpperCase());
+  const parsed = import_contracts2.SeoExpectedImpactSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError("SEO impact must be HIGH, MEDIUM, or LOW.");
 }
 function seoReportCompleteness(value) {
-  const parsed = import_contracts.SeoReportCompletenessSchema.safeParse(value.toUpperCase());
+  const parsed = import_contracts2.SeoReportCompletenessSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError("Report status must be COMPLETE or PARTIAL.");
 }
 function projectType(value) {
-  const parsed = import_contracts.ProjectTypeSchema.safeParse(value.toUpperCase());
+  const parsed = import_contracts2.ProjectTypeSchema.safeParse(value.toUpperCase());
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError(
-    `Type must be one of ${import_contracts.ProjectTypeSchema.options.join(", ")}.`
+    `Type must be one of ${import_contracts2.ProjectTypeSchema.options.join(", ")}.`
   );
 }
 function publishingProvider(value) {
   const normalized = value.toUpperCase();
-  const parsed = import_contracts.PublishingProviderSchema.safeParse(normalized);
+  const parsed = import_contracts2.PublishingProviderSchema.safeParse(normalized);
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError(
-    `Platform must be one of ${import_contracts.PublishingProviderSchema.options.join(", ")}.`
+    `Platform must be one of ${import_contracts2.PublishingProviderSchema.options.join(", ")}.`
   );
 }
 function collectPublishingProvider(value, previous) {
@@ -869,10 +921,10 @@ function collectString(value, previous) {
 }
 function deliveryOptionsProvider(value) {
   const normalized = value.toUpperCase();
-  const parsed = import_contracts.ProviderDeliveryOptionsProviderSchema.safeParse(normalized);
+  const parsed = import_contracts2.ProviderDeliveryOptionsProviderSchema.safeParse(normalized);
   if (parsed.success) return parsed.data;
   throw new import_commander.InvalidArgumentError(
-    `Provider must be one of ${import_contracts.ProviderDeliveryOptionsProviderSchema.options.join(", ")}.`
+    `Provider must be one of ${import_contracts2.ProviderDeliveryOptionsProviderSchema.options.join(", ")}.`
   );
 }
 function tiktokPostMode(value) {
@@ -910,7 +962,7 @@ function yesOrNo(value) {
 function youtubeSettings(options) {
   const hasYouTubeOptions = options.youtubeTitle !== void 0 || options.youtubeCategoryId !== void 0 || options.youtubePrivacy !== void 0 || options.youtubeMadeForKids !== void 0 || options.youtubeSyntheticMedia === true || options.youtubeNotifySubscribers === false || (options.youtubeTag?.length ?? 0) > 0;
   if (!hasYouTubeOptions) return null;
-  return import_contracts.YouTubePostSettingsSchema.parse({
+  return import_contracts2.YouTubePostSettingsSchema.parse({
     title: options.youtubeTitle,
     categoryId: options.youtubeCategoryId,
     privacyStatus: options.youtubePrivacy,
@@ -935,6 +987,10 @@ function mcpScope(value) {
   if (value === "user" || value === "project") return value;
   throw new import_commander.InvalidArgumentError("MCP setup scope must be user or project.");
 }
+function mcpTransport(value) {
+  if (value === "auto" || value === "http" || value === "stdio") return value;
+  throw new import_commander.InvalidArgumentError("MCP transport must be auto, http, or stdio.");
+}
 function isoDateTime(value) {
   const date = new Date(value);
   if (Number.isNaN(date.getTime())) {
@@ -995,13 +1051,21 @@ function requireBlogExecutionConsent(options) {
   throw new TypeError("This Blog execute command requires explicit consent. Review the confirmed operation and pass --yes.");
 }
 function formatMcpSetupPreview(result) {
+  const connection = result.server.transport === "http" ? [
+    `Transport: Streamable HTTP`,
+    `Endpoint: ${result.server.url}`,
+    "Authentication: OAuth in the MCP client"
+  ] : [
+    "Transport: local STDIO",
+    `Command: ${result.server.command}`,
+    `Arguments: ${result.server.args.join(" ")}`,
+    `Rolino URL: ${result.server.env.ROLINO_URL}`
+  ];
   return [
     `Client: ${result.client === "codex" ? "Codex" : "Claude Code"}`,
     `Scope: ${result.scope}`,
     `Target: ${result.target}`,
-    `Command: ${result.server.command}`,
-    `Arguments: ${result.server.args.join(" ")}`,
-    `Rolino URL: ${result.server.env.ROLINO_URL}`,
+    ...connection,
     "No token will be written to MCP configuration."
   ].join("\n");
 }
@@ -1087,7 +1151,7 @@ function errorForOutput(error) {
 function tiktokSettings(options) {
   const hasTikTokOptions = options.tiktokMode !== void 0 || options.tiktokVisibility !== void 0 || options.tiktokComments !== void 0 || options.tiktokDuet !== void 0 || options.tiktokStitch !== void 0 || options.tiktokCommercialContent !== void 0 || options.tiktokPromotesOwnBrand !== void 0 || options.tiktokPromotesThirdParty !== void 0 || options.tiktokAiGenerated !== void 0 || options.tiktokCoverTimestampMs !== void 0 || options.tiktokSettingsReviewed === true;
   if (!hasTikTokOptions) return void 0;
-  return import_contracts.TikTokDraftSettingsSchema.parse({
+  return import_contracts2.TikTokDraftSettingsSchema.parse({
     postMode: options.tiktokMode,
     privacyLevel: options.tiktokVisibility,
     allowComment: options.tiktokComments,
@@ -1231,7 +1295,7 @@ async function runCli(argv = process.argv, overrides = {}) {
       global,
       runtime,
       async action(context, client) {
-        const parsed = import_contracts.ProjectCreateInputSchema.safeParse({
+        const parsed = import_contracts2.ProjectCreateInputSchema.safeParse({
           name: local.name,
           type: local.type,
           websiteUrl: local.website,
@@ -1464,7 +1528,7 @@ async function runCli(argv = process.argv, overrides = {}) {
     });
   });
   const setup = program.command("setup").description("Configure local agent tools for Rolino");
-  setup.command("mcp").description("Configure the Rolino stdio MCP server for a supported client").requiredOption("--client <client>", "codex or claude-code", mcpClient).option("--scope <scope>", "user or project", mcpScope, "user").option("--server-path <path>", "absolute or working-directory-relative MCP server path").option("--dry-run", "show the intended configuration without writing it").option("--yes", "apply without an interactive confirmation").option("--force", "replace an existing Claude Code user-scoped Rolino server").action(async (local) => {
+  setup.command("mcp").description("Configure Rolino MCP with Streamable HTTP or local STDIO").requiredOption("--client <client>", "codex or claude-code", mcpClient).option("--scope <scope>", "user or project", mcpScope, "user").option("--transport <transport>", "auto, http, or stdio", mcpTransport, "auto").option("--server-path <path>", "absolute or working-directory-relative MCP server path").option("--dry-run", "show the intended configuration without writing it").option("--yes", "apply without an interactive confirmation").option("--force", "replace an existing Claude Code user-scoped Rolino server").action(async (local) => {
     const global = program.opts();
     commandExitCode = await execute({
       command: "setup mcp",
@@ -1477,7 +1541,8 @@ async function runCli(argv = process.argv, overrides = {}) {
           cwd: runtime.cwd,
           env: runtime.env,
           nodePath: runtime.nodePath,
-          cliEntryPath: runtime.cliEntryPath
+          cliEntryPath: runtime.cliEntryPath,
+          fetch: runtime.fetch
         };
         const preview = await setupMcp({ ...setupOptions, dryRun: true });
         let result = preview;
@@ -1504,11 +1569,12 @@ async function runCli(argv = process.argv, overrides = {}) {
             `${state} Rolino MCP for ${clientLabel}.`,
             `Scope: ${result.scope}`,
             `Target: ${result.target}`,
+            `Transport: ${result.transport === "http" ? "Streamable HTTP" : "local STDIO"}`,
             ...result.backupPath && !result.dryRun ? [`Backup: ${result.backupPath}`] : [],
             `Rolino URL: ${client.baseUrl}`,
             "No token was written to MCP configuration."
           ].join("\n"),
-          result.client === "codex" ? ["codex mcp list", "rolino auth login"] : ["claude mcp get rolino", "rolino auth login"]
+          result.client === "codex" ? result.transport === "http" ? ["codex mcp login rolino", "codex mcp list"] : ["rolino auth login", "codex mcp list"] : result.transport === "http" ? ["claude mcp get rolino", "Complete OAuth when Claude prompts you"] : ["rolino auth login", "claude mcp get rolino"]
         );
       }
     });
@@ -2105,7 +2171,7 @@ This moves eligible editorial dates only. It does not schedule, publish, or unpu
   blogArticles.command("update").argument("<article-id>").requiredOption("--project <project-id>", "exact Rolino project ID").requiredOption("--input <json-file>", "complete Blog draft JSON file").option("--yes", "confirm the draft save").action(async (articleId, local) => {
     const global = program.opts();
     commandExitCode = await execute({ command: "blog articles update", global, runtime, async action(context, client) {
-      const draft = import_contracts.AgentBlogDraftUpdateSchema.parse(JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.resolve)(runtime.cwd, local.input), "utf8")));
+      const draft = import_contracts2.AgentBlogDraftUpdateSchema.parse(JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.resolve)(runtime.cwd, local.input), "utf8")));
       await requireWriteConsent({ yes: local.yes, global, runtime, preview: `Save a new immutable Blog draft revision?
 Project: ${local.project}
 Article: ${articleId}
@@ -2247,6 +2313,106 @@ Revision: ${local.revision}` });
       writeSuccess(context, data, JSON.stringify(data, null, 2));
     } });
   });
+  const backlinks = program.command("backlinks").description("Review backlink prospects and public contact drafts. Rolino never sends email.");
+  const backlinkTargets = backlinks.command("targets");
+  backlinkTargets.command("list").requiredOption("--project <project-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks targets list", global, runtime, async action(context, client) {
+      const data = await client.backlinks.targets.list(local.project, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkTargets.command("add").requiredOption("--project <project-id>").requiredOption("--url <url>").requiredOption("--label <label>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks targets add", global, runtime, async action(context, client) {
+      const data = await client.backlinks.targets.add(local.project, { url: local.url, label: local.label }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinks.command("discover").requiredOption("--project <project-id>").option("--limit <number>", "maximum saved prospects", Number, 20).option("--idempotency-key <key>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks discover", global, runtime, async action(context, client) {
+      const data = await client.backlinks.discoveries.start(local.project, { limit: local.limit }, local.idempotencyKey ?? context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkRuns = backlinks.command("runs");
+  backlinkRuns.command("get").requiredOption("--project <project-id>").requiredOption("--run <run-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks runs get", global, runtime, async action(context, client) {
+      const data = await client.backlinks.discoveries.get(local.project, local.run, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkProspects = backlinks.command("prospects");
+  backlinkProspects.command("list").requiredOption("--project <project-id>").option("--stage <stage>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects list", global, runtime, async action(context, client) {
+      const stage = local.stage ? import_contracts2.BacklinkProspectStageSchema.parse(local.stage.toUpperCase()) : void 0;
+      const data = await client.backlinks.prospects.list(local.project, { stage }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkProspects.command("get").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects get", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.get(local.project, local.prospect, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkProspects.command("approve").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--expected-version <number>", "current optimistic version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks prospects approve", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.updateStage(local.project, local.prospect, { stage: "APPROVED", expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  const backlinkContacts = backlinks.command("contacts");
+  backlinkContacts.command("research").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts research", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.researchContact(local.project, local.prospect, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkContacts.command("list").requiredOption("--project <project-id>").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts list", global, runtime, async action(context, client) {
+      const data = await client.backlinks.contacts.list(local.project, { limit: 50 }, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinkContacts.command("export").requiredOption("--project <project-id>").option("--format <format>", "json or csv", "csv").action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks contacts export", global, runtime, async action(context, client) {
+      const data = await client.backlinks.contacts.list(local.project, { limit: 50 }, { requestId: context.requestId });
+      if (local.format !== "csv") return writeSuccess(context, data, JSON.stringify(data, null, 2));
+      const cell = (value) => {
+        let text = String(value ?? "").replace(/[\r\n]+/g, " ");
+        if (/^[=+\-@\t]/.test(text)) text = `'${text}`;
+        return `"${text.replaceAll('"', '""')}"`;
+      };
+      const csv = ["prospectId,name,role,email,sourceUrl,checkedAt", ...data.items.map((item) => [item.prospectId, item.name, item.role, item.email, item.sourceUrl, item.checkedAt].map(cell).join(","))].join("\n");
+      context.stdout.write(`${csv}
+`);
+    } });
+  });
+  const backlinkOutreach = backlinks.command("outreach");
+  backlinkOutreach.command("update").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--file <file>").requiredOption("--expected-version <number>", "current draft version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks outreach update", global, runtime, async action(context, client) {
+      const payload = JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.resolve)(runtime.cwd, local.file), "utf8"));
+      const data = await client.backlinks.prospects.updateOutreach(local.project, local.prospect, { ...payload, expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
+  backlinks.command("verify").requiredOption("--project <project-id>").requiredOption("--prospect <prospect-id>").requiredOption("--url <url>").requiredOption("--expected-version <number>", "current prospect version", Number).action(async (local) => {
+    const global = program.opts();
+    commandExitCode = await execute({ command: "backlinks verify", global, runtime, async action(context, client) {
+      const data = await client.backlinks.prospects.verify(local.project, local.prospect, { url: local.url, expectedVersion: local.expectedVersion }, context.requestId, { requestId: context.requestId });
+      writeSuccess(context, data, JSON.stringify(data, null, 2));
+    } });
+  });
   const seo = program.command("seo").description("Read authorized SEO opportunities and weekly reports");
   const seoOpportunities = seo.command("opportunities").description("Read accepted SEO opportunities");
   seoOpportunities.command("list").description("List bounded SEO opportunities").requiredOption("--project <project-id>", "exact Rolino project ID").option("--limit <number>", "maximum opportunities to return", (value) => {