@vibecodr/cli 1.0.0-rc.0 → 1.0.1

package/docs/commands.md

@@ -1,204 +1,256 @@
 # Commands
 
-This page documents the command surface implemented in the current repo.
+The Vibecodr CLI talks to two hosted endpoints. Every command targets exactly one of them:
+
+| Badge | Endpoint | Auth path |
+|---|---|---|
+| `H` | `tools.vibecodr.space` | device-code (`vibecodr start` / `vc-tools start`) -> durable Clerk API key in OS keychain (`@vibecodr/vc-tools` service) |
+| `M` | `openai.vibecodr.space/mcp` | CIMD/PKCE OAuth (`vibecodr login`) -> encrypted session in OS keychain (`@vibecodr/mcp` service) + AES-GCM session file |
+| `*` | both | command picks the credential by what it talks to; no shared bin state |
+
+The three bin entries — `vibecodr`, `vibecodr-mcp`, `vc-tools` — all resolve to the same dispatcher. The `vc-tools` bin sets `__VCR_INVOKED_AS=vc-tools` and routes every command through the legacy code path so output is byte-equivalent to `@vibecodr/vc-tools@0.1.4`. The `vibecodr` bin runs the MCP-gateway commands inline and cross-routes the hosted Agent Computer commands into the legacy code path. The `vibecodr-mcp` bin is the alias preserved from `@vibecodr/cli@0.2.x`.
 
 ## Global flags
 
 All commands accept:
 
-- `--profile <name>`
-- `--json`
-- `--verbose`
-- `--non-interactive`
+- `--profile <name>` (M)
+- `--json` (\*)
+- `--verbose` (\*)
+- `--non-interactive` (\*)
 
-Alternate MCP servers are profile-scoped, not runtime overrides. Use
-`vibecodr config profile create <name> --server-url <url>` and then login to
-that profile; stored tokens are bound to the server that issued them.
+The legacy `vc-tools` bin also accepts:
 
-## Commands
+- `--api-url <url>`
+- `--config-dir <path>`
+- `--credential <value>` / `--credential-file <path>` / `--credential-stdin`
+- `--token <value>` / `--token-file <path>` / `--token-stdin`
+- `--timeout-ms <n>` (1000..300000)
+- `--quiet` / `-q`
+- `--no-input`
+- `--no-color`
+- `--debug`
+- `--allow-insecure-local-api`
 
-### `login`
+Alternate MCP servers are profile-scoped, not runtime overrides. Use `vibecodr config profile create <name> --server-url <url>` and then login to that profile; stored tokens are bound to the server that issued them.
 
-Syntax:
+## Authentication
+
+### `vibecodr login` (M)
 
 `vibecodr login [--scope <oauth-scope>] [--registration auto|preregistered|cimd|dcr|manual] [--browser open|print] [--timeout-sec <n>]`
 
-Use this to authenticate the CLI itself.
+Authenticates this CLI against the MCP gateway via CIMD/PKCE. Prints the authorization URL by default; `--browser open` launches the browser automatically. Stores the encrypted session under the `@vibecodr/mcp` keyring service.
 
-Current default:
+### `vibecodr logout` (M)
 
-- `login` prints the authorization URL and waits for the loopback callback
-- `--browser open` opts into automatic browser launch
+`vibecodr logout [--all] [--no-revoke]`
 
-### `logout`
+Clears the MCP gateway session. Does not touch editor-owned auth or the hosted Agent Computer credential.
 
-Syntax:
+### `vibecodr status` (M)
 
-`vibecodr logout [--all] [--no-revoke]`
+`vibecodr status [--probe] [--show-installs]`
 
-Use this to clear CLI auth state. It does not touch editor-owned auth.
+Without `--probe`, reads only local state. `--show-installs` distinguishes configured, missing, and external managed installs.
 
-### `status`
+### `vibecodr whoami` (M)
 
-Syntax:
+`vibecodr whoami [--no-login]`
 
-`vibecodr status [--probe] [--show-installs]`
+Calls the protected `get_account_capabilities` MCP tool. Prints account identity, plan, CLI profile, server URL, and session state. Same refresh + interactive login retry path as `call`.
 
-Without `--probe`, this reads only local state.
+### `vc-tools start` / `vc-tools setup` (H)
 
-### `whoami`
+`vc-tools start [--api-url <url>] [--browser open|print] [--credential ...] [--token ...] [--no-input]`
 
-Syntax:
+`setup` is an alias for `start`. Walks device-code login against `api.vibecodr.space`, shows the matching approval code, waits for the user to approve in-browser, stores a durable Clerk API key under the `@vibecodr/vc-tools` keyring service (visible in the user's Clerk-managed API keys list as `"vc-tools Agent Computer"`), then returns the hosted MCP connection details an agent needs.
 
-`vibecodr whoami [--no-login]`
+### `vc-tools auth diagnose` / `vc-tools auth export-agent-env` (H)
 
-Shows the connected Vibecodr account and plan by calling the protected
-`get_account_capabilities` MCP tool. It uses the same refresh and interactive
-login retry path as `call`, but prints only account identity, plan, CLI profile,
-server URL, and session state.
+`auth diagnose` reports local credential health and which surface owns the active session. `auth export-agent-env` emits `VC_TOOLS_*` environment variables so an isolated agent shell can pick up the cached credential.
 
-### `tools`
+## Agent client installation (*)
 
-Syntax:
+### `vibecodr install <client>` / `vibecodr uninstall <client>`
 
-`vibecodr tools [<tool-name>] [--search <text>] [--schema] [--no-login]`
+`vibecodr install <codex|cursor|vscode|windsurf|claude-desktop|claude-code> [--scope user|project] [--path <dir>] [--name <server-name>] [--open-client] [--overwrite] [--dry-run]`
 
-This always reads the live tool catalog from the MCP server.
+Adds (or removes) the hosted Vibecodr MCP server to the client's MCP catalog. `codex`, `vscode`, and `claude-code` prefer their own CLI shim (`codex mcp add`, `code --add-mcp`, `claude mcp add`) and fall back to writing the client's config file. `cursor`, `windsurf`, `claude-desktop` always write the client's config file directly. Records the install in `installs.json` so `uninstall` can find it.
 
-### `call`
+### `vc-tools connect` / `vc-tools agent connect` (H)
 
-Syntax:
+`vc-tools connect --client <codex|cursor|vscode|windsurf|claude-desktop|claude-code> [--print] [--name <server-name>] [--install] [--overwrite]`
 
-`vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--timeout-sec <n>] [--no-login] [--confirm]`
+Prints (`--print`) or installs (`--install`) the MCP connection details for the hosted Agent Computer. The `vc-tools agent connect` form is the legacy spelling; both reach the same code path.
+
+## Hosted browser (H)
+
+### `vc-tools browser <subcommand>`
+
+- `browser read <https-url> [--out ./proof] [--no-wait] [--details]`
+- `browser screenshot <https-url> [--format png|jpg] [--out ./proof] [--no-wait] [--details]`
+- `browser render <https-url> [--out ./proof] [--no-wait] [--details]`
+- `browser pdf <https-url> [--out ./proof] [--no-wait] [--details]`
+- `browser crawl <https-url> [--max-pages n] [--max-depth n] [--out ./proof]`
+- `browser snapshot <https-url> [--instructions <text>] [--out ./proof]`
+- `browser ask <https-url> --instructions <text>`
+
+Public HTTPS URLs only. Localhost, private network ranges, URL credentials, and internal hostnames are blocked before any hosted work is submitted. `--no-wait` returns immediately with a `jobId` you can follow via `vc-tools work follow`. `--details` includes capability metadata in the response.
+
+## Hosted computer (H)
 
-`--interactive` currently supports top-level scalar object fields.
+### `vc-tools computer <subcommand>`
 
-For `quick_publish_creation` with `payload.importMode: "direct_files"`, pass file paths as normal slash-separated project paths such as `src/main.tsx` or `src/server/binding-proof.js`. Do not pre-encode slashes as `%2F`; the hosted MCP gateway encodes each URL segment when it writes files to Vibecodr.
+- `computer run <command> [--out ./proof] [--no-wait]`
+- `computer test <command> [--out ./proof] [--no-wait]`
+- `computer status`
 
-Known mutating tools require explicit confirmation through `--confirm`. The CLI redacts secret, token, source, descriptor, and inline file-content fields from displayed arguments and results while preserving safe operator handles and counters such as `artifactId`, `jobId`, `requestId`, `traceId`, `errorCode`, `credentialType`, `tokenCount`, and `tokenKind`; the MCP gateway remains the authority boundary for OAuth, owner checks, confirmation, and output shaping.
+`run` and `test` submit bounded commands to the hosted sandbox container (Sandbox or ProSandbox class depending on plan). Public HTTP(S) network is enabled for sandbox tests; private/metadata networks remain blocked.
 
-Use `--timeout-sec <n>` when a protected tool is expected to run longer than the default client wait, such as a build-backed publish retry. This changes only the local MCP transport timeout and is not forwarded as a server tool argument.
+## Hosted work + proof (H)
 
-Use `vibecodr call get_account_capabilities --json` to read the live model-safe plan snapshot before promising hosted tool work. The gateway returns Quick Checks, Agent Browser, Sandbox, Crawl, and Artifact Shelf limits when the platform API exposes them.
+### `vc-tools work <subcommand>`
 
-### `upload`
+- `work list`
+- `work follow <jobId> [--no-wait] [--timeout-sec <n>]`
+- `work show <jobId>`
+- `work cancel <jobId>`
+- `work submit <command-spec>`
 
-Syntax:
+### `vc-tools proof <subcommand>`
 
-`vibecodr upload --zip <path> [--idempotency-key <key>] [--root-hint <path>] [--entry-hint <path>] [--timeout-sec <n>] [--no-login]`
+- `proof list [--limit <n>] [--cursor <c>]`
+- `proof get <artifactId>`
+- `proof save <artifactId> --out <path>`
+- `proof download <artifactId> --out <path>`
+- `proof delete <artifactId>`
 
-`vibecodr upload --image <path> [--kind cover_image|avatar_image] [--content-type <mime>] [--timeout-sec <n>] [--no-login]`
+Artifact output is workspace-bounded: downloaded bytes can only be written to files you intentionally target inside the current workspace. Use `--out ./artifacts`, `--out ./artifacts/report.pdf`, or `cd` to the intended workspace and use `--out .`.
 
-Stages a local ZIP or image through Vibecodr's API-owned upload session flow. The CLI asks the MCP gateway for a short-lived direct R2 PUT URL, uploads the bytes directly to R2, completes server-side verification, and prints safe identifiers only.
+### `vc-tools jobs <subcommand>` / `vc-tools artifacts <subcommand>`
 
-ZIP uploads print a `quickPublishPayload` snippet using `payload.importMode: "staged_upload"`. The snippet asks Vibecodr to use the async staged-upload import path so larger projects can move to the heavy import lane automatically instead of making the CLI guess. Cover image uploads print a `thumbnailStagedUpload` snippet that can be passed to publish metadata tools. Avatar image uploads print an `avatarStagedUpload` identifier for avatar promotion flows.
+`jobs list|status|cancel` and `artifacts list|get|delete` are lower-level surfaces over the same underlying entities; prefer `work` and `proof` for the common flows.
 
-Cover images support PNG, JPEG, WebP, and AVIF. Avatar images support PNG, JPEG, WebP, and GIF.
+## Plan + usage (H)
 
-Staged upload MCP setup and completion calls use a longer client-side wait by default so large ZIP verification does not fail only because the local CLI stopped waiting. Use `--timeout-sec <n>` only when a slower network needs a different local wait; this value is transport behavior and is not forwarded as a server tool argument.
+### `vc-tools usage` / `vc-tools limits`
 
-The presigned URL is a bearer credential and is never printed in command output. Legacy `zip_import` / `fileBase64` remains a compatibility path for small payloads, not the preferred CLI path for whole repos or launch images.
+`vc-tools usage [--json]` (and the `limits` alias) reports the account's plan name, monthly and daily credit counters, current concurrent runs, and remaining headroom. The hosted worker is the authority; the CLI does not cache quotas.
 
-### `pulse-setup`
+### `vc-tools grants <subcommand>`
+
+- `grants list`
+- `grants refresh`
+
+Inspects scoped grants the worker issues to bind a tool call to a plan + capability set.
+
+### `vc-tools retention` / `vc-tools scheduled-qa`
+
+`retention` shows or sets the account's proof-retention policy. `scheduled-qa` shows or schedules recurring QA runs (rate-limited per plan).
+
+### `vc-tools plans [--details]`
+
+Prints the plan packaging matrix (Free / Creator / Pro). With `--details`, includes per-capability limits and the tool-credit breakdown.
+
+### `vc-tools dashboard`
+
+Prints the URL of the hosted supervision dashboard. Does not open a browser; that is left to the caller.
+
+## MCP gateway tooling (M)
+
+### `vibecodr tools` / `vibecodr tools test`
+
+`vibecodr tools [<tool-name>] [--search <text>] [--schema] [--no-login]`
+
+Lists the live MCP tool catalog from `openai.vibecodr.space/mcp`. With `<tool-name>`, prints the schema for that tool. `--schema` includes the full JSON schema. `tools test <tool-name>` runs the gateway's `validators` against a sample input.
+
+### `vibecodr call <tool-name>`
+
+`vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--timeout-sec <n>] [--no-login] [--confirm]`
 
-Syntax:
+Invokes the named MCP tool. `--interactive` supports top-level scalar object fields; richer schemas should use `--input-json` or `--input-file`. `--confirm` is required for known mutating tools. The CLI redacts source, descriptor, token, secret, and inline file-content fields from displayed arguments and results while preserving safe operator handles (`artifactId`, `jobId`, `requestId`, `traceId`, `errorCode`, `credentialType`, `tokenCount`, `tokenKind`). The gateway remains the authority boundary for OAuth, owner scoping, confirmation policy, and output shaping. `--timeout-sec <n>` changes only the local MCP transport timeout and is not forwarded as a server tool argument.
 
-`vibecodr pulse-setup [--json] [--descriptor-setup-json <json> | --descriptor-setup-file <path>]`
+For `quick_publish_creation` with `payload.importMode: "direct_files"`, pass file paths as normal slash-separated project paths (`src/main.tsx`, `src/server/binding-proof.js`). Do not pre-encode slashes as `%2F`; the hosted gateway encodes each URL segment when it writes files to Vibecodr.
 
-Calls the live `get_pulse_setup_guidance` MCP tool. Pass a `PulseDescriptorSetupProjection` through `--descriptor-setup-json` or `--descriptor-setup-file` when you have one; the CLI forwards it as `descriptorSetup` and verifies the MCP response evaluated that descriptor. Without a descriptor projection, the command returns general Pulse setup rules and must not be treated as proof that a specific Pulse needs or does not need backend setup.
+### `vibecodr upload`
 
-The CLI does not maintain separate Pulse setup copy; it reads MCP output derived from the API projection owned by `PulseDescriptor`.
+`vibecodr upload --zip <path>` or `vibecodr upload --image <path> [--kind cover_image|avatar_image]`
 
-The returned guidance should stay capability-shaped: `env.fetch` is Vibecodr policy-mediated fetch, `env.secrets.bearer/header/query/verifyHmac` are policy-bound secret helpers, `env.webhooks.verify("stripe")` is the first certified provider helper rather than the whole webhook model, non-Stripe signed webhooks use generic HMAC format presets such as `github-sha256`, `shopify-hmac-sha256`, and `slack-v0` until fixture-backed helpers exist, `env.connections.use(provider).fetch` is provider-scoped connected-account access, `env.log` is structured logging, `env.request` is sanitized request access, `env.runtime` is safe correlation metadata, and `env.waitUntil` is best-effort after-response work. The CLI must not introduce separate cleanup, platform-binding, dispatch, raw-token, raw-authorization, or physical-storage guidance.
+Direct-to-R2 staged uploads (no base64 payloads). Hosted gateway returns a presigned R2 PUT URL, the CLI streams the file, then the gateway records the upload metadata. Image uploads accept the kind discriminator.
 
-### `pulse-publish`
+## Pulse (M)
 
-Syntax:
+### `vibecodr pulse-setup`
 
-`vibecodr pulse-publish --name <name> (--code <source> | --code-file <path>) [--descriptor-json <json> | --descriptor-file <path>] [--slug <slug>] [--visibility public|unlisted|private] --confirm`
+`vibecodr pulse-setup [--descriptor-setup-json <json> | --descriptor-setup-file <path>]`
 
-Calls `publish_standalone_pulse`. Standalone Pulse source/metadata visibility defaults to private. Private visibility does not add runtime authentication to the public Pulse URL. The CLI does not echo source code or descriptors in successful output.
+Walks live Pulse setup (provider connections, secret bindings, Stripe-first webhook helper). Without args, prompts interactively.
 
-### `pulse`
+### `vibecodr pulse-publish`
 
-Syntax:
+`vibecodr pulse-publish --name <name> (--code <source> | --code-file <path>) --confirm`
 
-- `vibecodr pulse list [--limit <n>] [--offset <n>]`
-- `vibecodr pulse get <pulse-id>`
-- `vibecodr pulse status <pulse-id>`
-- `vibecodr pulse run <pulse-id> [--input-json <json> | --input-file <path>] --confirm`
-- `vibecodr pulse archive <pulse-id> --confirm`
-- `vibecodr pulse restore <pulse-id> --confirm`
-- `vibecodr pulse create --name <name> (--code <source> | --code-file <path>) --confirm`
-- `vibecodr pulse deploy --name <name> (--code <source> | --code-file <path>) --confirm`
+Publishes a standalone Pulse with private source/metadata visibility by default. Runtime URL is public HTTP unless the Pulse code rejects callers. `--confirm` is required.
 
-`create` and `deploy` are aliases for the standalone publish flow. `run`, `archive`, and `restore` require explicit confirmation. `delete` is intentionally unavailable; archive a Pulse instead. `logs` are not exposed through the hardened lifecycle surface yet.
+### `vibecodr pulse <subcommand>`
 
-The CLI forwards lifecycle calls to MCP tools owned by the hosted gateway: `list_pulses`, `get_pulse`, `get_pulse_status`, `run_pulse`, `archive_pulse`, and `restore_pulse`. These server tools are hidden from default discovery but callable by exact name for owner recovery and CLI use.
+- `pulse list`
+- `pulse get <pulseId>`
+- `pulse status <pulseId>`
+- `pulse run <pulseId>`
+- `pulse archive <pulseId> --confirm`
+- `pulse restore <pulseId> --confirm`
+- `pulse create --confirm`
+- `pulse deploy <pulseId>`
 
-### `doctor`
+Convenience wrappers over the gateway's Pulse lifecycle. `create` and `deploy` are aliases for the create-and-publish sequence; prefer the explicit form when scripting.
 
-Syntax:
+## Convenience (*)
 
-`vibecodr doctor [--client <client>]`
+### `vc-tools try` (H)
 
-Supported client probes now:
+`vc-tools try [--out ./proof]`
 
-- `codex`
-- `cursor`
-- `vscode`
-- `windsurf`
+Runs a small browser + computer + proof + usage check end-to-end to verify the account, the credential, and the hosted plumbing.
 
-### `config`
+### `vibecodr doctor` / `vc-tools doctor` (*)
 
-Syntax:
+`vibecodr doctor [--json]` walks local health: secret store availability, browser launcher, network reachability, MCP gateway handshake, hosted worker handshake.
 
-- `vibecodr config path`
-- `vibecodr config show`
-- `vibecodr config set <key> <value>`
-- `vibecodr config unset <key>`
-- `vibecodr config profile list`
-- `vibecodr config profile create <name> [--server-url <url>]`
-- `vibecodr config profile use <name>`
-- `vibecodr config profile delete <name> [--force]`
+`vc-tools doctor` does the same plus device-code surface checks.
 
-### `install`
+### `vibecodr config` / `vc-tools config` (*)
 
-Syntax:
+`config` reads and writes the CLI's profile catalog. Sub-surfaces include profile create, profile select, profile list, get, set.
 
-`vibecodr install <codex|cursor|vscode|windsurf|claude-desktop> [--scope user|project] [--path <dir>] [--name <server-name>] [--open-client] [--overwrite] [--dry-run]`
+### `vc-tools inspect` (H)
 
-Install config only. Runtime auth remains CLI-owned or editor-owned depending on where the server is used.
+`vc-tools inspect --json`
 
-Claude Desktop does not load remote HTTP MCP servers natively, so the installer writes the documented `mcp-remote` stdio proxy entry (`{ command: "npx", args: ["mcp-remote", <url>] }`). Node.js / npx must be on PATH for the proxy to launch. Users can alternatively add the MCP URL via Settings -> Connectors -> Add custom connector in the desktop app.
+Emits the goal-coverage map (which hosted capabilities are local-verified vs hosted-required vs production-smoked). Used by the release-readiness check.
 
-Platform support matrix:
-- **macOS**: writes to `~/Library/Application Support/Claude/claude_desktop_config.json`.
-- **Windows**: writes to `%APPDATA%\Claude\claude_desktop_config.json`.
-- **Linux**: Anthropic does not ship an official Claude Desktop build for Linux. The installer writes to `${XDG_CONFIG_HOME:-$HOME/.config}/Claude/claude_desktop_config.json`, the path used by community repackages. If you are not running such a build, install Claude Code and use `vibecodr install codex` / equivalent instead.
+## Legacy bin aliases
 
-### `uninstall`
+`vibecodr-mcp <command> ...` and `vc-tools <command> ...` are bin entries that route into the same dispatcher.
 
-Syntax:
+- `vibecodr-mcp` produces output byte-equivalent to `@vibecodr/cli@0.2.11` for every MCP-gateway command.
+- `vc-tools` produces output byte-equivalent to `@vibecodr/vc-tools@0.1.4` for every hosted Agent Computer command.
 
-`vibecodr uninstall <codex|cursor|vscode|windsurf|claude-desktop> [--scope user|project] [--path <dir>] [--name <server-name>] [--dry-run]`
+If you have scripts that call either binary, no changes are required.
 
-## Exit codes
+## Output and exit codes
 
-- `0` success
-- `1` runtime or doctor check failure
-- `2` usage error
-- `3` config or filesystem error
-- `4` auth required but unavailable in current mode
-- `5` auth failed
-- `6` network failure
-- `7` protocol or discovery failure
-- `8` tool failure
-- `9` unsupported client or missing required executable
-- `10` install or uninstall conflict
-- `11` secure credential store unavailable
-- `12` cancellation or auth timeout
+All commands return non-zero on failure. Stable codes:
 
-## Current note
+| Code | Meaning |
+|---|---|
+| 0 | success |
+| 2 | usage / input validation |
+| 3 | auth / session |
+| 4 | quota / plan limit |
+| 5 | local config / storage |
+| 6 | install / uninstall conflict |
+| 7 | runtime / hosted failure |
 
-The commands above are implemented now. The main remaining product constraint is VS Code user-scope uninstall, because there is still no documented removal surface that this repo can safely automate without inventing one.
+`--json` shape is `{ ok: true, data, warnings }` on success and `{ ok: false, error: { code, message, status, details } }` on failure. Volatile fields (`requestId`, `traceId`, timestamps) appear in `data` / `error.details` but are filtered out of the §14 output-baseline regression contract.

package/docs/legacy/CHANGELOG-mcp-cli.md

@@ -0,0 +1,85 @@
+# @vibecodr/cli 0.1.x / 0.2.x changelog (pre-merge)
+
+This is the changelog for the legacy `@vibecodr/cli@0.2.x` and `0.1.x` lines — the MCP-gateway-only CLI that became part of the merged `@vibecodr/cli@1.0.0` in May 2026. The 1.0.x entries live in [`/CHANGELOG.md`](../../CHANGELOG.md).
+
+The other half of the merge — `@vibecodr/vc-tools@0.1.x` — kept its own changelog inside its own repo; that history is preserved in the archived [`BradenHartsell/vc-tools`](https://github.com/BradenHartsell/vc-tools) repository.
+
+## 0.2.11
+
+- add `vibecodr call --timeout-sec <n>` as a local MCP transport timeout for long-running protected tool calls such as build-backed publish retries
+- keep `--timeout-sec` out of server tool arguments so hosted MCP schemas remain authoritative
+
+## 0.2.6
+
+- publish a fresh CLI version so GitHub and npm carry the same current release marker
+
+## 0.2.5
+
+- refresh release lockfile coverage before publishing the CLI
+
+## 0.2.4
+
+- clarify staged ZIP upload output so larger projects can move into Vibecodr's async heavy import lane automatically
+- keep worker-gateway integration fixtures aligned with pulse compute quota fields
+
+## 0.2.2
+
+- show command-specific help for nested `vibecodr pulse <command> --help|-h|-help` requests
+
+## 0.2.1
+
+- preserve encrypted offline sessions when refresh fails because the authorization server is temporarily unavailable
+- continue clearing stored auth on OAuth `invalid_grant` so revoked or expired refresh tokens fail closed
+
+## 0.2.0
+
+- rename the npm package to `@vibecodr/cli` while keeping `vibecodr` as the primary executable and `vibecodr-mcp` as a compatibility alias
+- add the hardened `pulse` lifecycle command group for list/get/status/run/archive/restore plus create/deploy aliases
+- redact source, descriptor, token, secret, and inline file-content fields from CLI-displayed MCP arguments and results
+- require explicit confirmation for known mutating MCP tools when invoked through the generic `call` command
+
+## 0.1.8
+
+- report the actual package version in MCP client metadata instead of a stale hardcoded value
+- publish the CLI after redeploying the hosted Vibecodr MCP gateway
+
+## 0.1.7
+
+- add the `pulse-setup` command for live Pulse setup guidance
+- align CLI Pulse setup docs with the gateway runtime contract for policy-bound secrets, Stripe-first webhook helper guidance, generic HMAC presets, and provider-scoped connections
+- refresh release-lock coverage for current in-range MCP SDK, keyring, and Node type packages before publishing
+
+## 0.1.6
+
+- make printed OAuth authorization URLs the default login behavior
+- keep automatic browser launch available behind `--browser open`
+- keep secret-store delete best-effort when keyring entry loading fails during cleanup
+
+## 0.1.5
+
+- replace the Windows browser launcher with `rundll32 url.dll,FileProtocolHandler` so OAuth URLs open in the default browser instead of File Explorer
+- make `doctor` use the same browser-launcher availability check as runtime auth
+
+## 0.1.4
+
+- replace the Windows browser launcher with `explorer.exe` so OAuth URLs are passed through intact
+
+## 0.1.3
+
+- fix Windows command detection by resolving `where.exe` from the real system path
+- make `status --show-installs` verify file-backed installs instead of blindly trusting the manifest
+
+## 0.1.2
+
+- fix Windows browser auto-open by launching the actual command shell instead of assuming `cmd` is on PATH
+- make `doctor` validate the real browser launcher path instead of hardcoding Windows success
+
+## 0.1.1
+
+- add `vibecodr` as a first-class executable alias
+- fix Windows login persistence by storing encrypted session blobs on disk with a small OS-keyring-backed encryption key
+- keep `vibecodr-mcp` as a compatibility alias
+
+## 0.1.0
+
+- Initial Phase 0 scaffold for the direct Vibecodr MCP CLI.

package/package.json

@@ -1,69 +1,74 @@
-{
-  "name": "@vibecodr/cli",
-  "version": "1.0.0-rc.0",
-  "description": "The official Vibecodr CLI: hosted browser, hosted computer, capsule uploads, Pulse operations, and agent-client MCP setup under one command.",
-  "license": "Apache-2.0",
-  "type": "module",
-  "bin": {
-    "vibecodr": "dist/bin/vibecodr-mcp.js",
-    "vibecodr-mcp": "dist/bin/vibecodr-mcp.js",
-    "vc-tools": "dist/bin/vc-tools.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "MIGRATION.md",
-    "docs"
-  ],
-  "engines": {
-    "node": ">=22 <26"
-  },
-  "keywords": [
-    "vibecodr",
-    "cli",
-    "mcp",
-    "model-context-protocol",
-    "agent-computer",
-    "browser-automation",
-    "cloudflare",
-    "sandbox"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/BradenHartsell/Vibecodr-CLI.git"
-  },
-  "bugs": {
-    "url": "https://github.com/BradenHartsell/Vibecodr-CLI/issues"
-  },
-  "homepage": "https://vibecodr.space/vc-tools",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "check": "npm run check:cli && npm run check:worker",
-    "check:cli": "tsc -p tsconfig.json --noEmit",
-    "check:worker": "tsc -p tsconfig.worker.json --noEmit",
-    "test": "node --import tsx --test test/**/*.test.ts",
-    "test:live-smoke": "node --import tsx --test test/live-smoke.smoke.ts",
-    "test:integration:worker": "node --import tsx --test test/worker-gateway.integration.test.ts",
-    "verify:artifact": "node scripts/check-pack-artifact.mjs",
-    "verify": "npm run check && npm run build && npm test && npm run verify:artifact"
-  },
-  "dependencies": {
-    "@iarna/toml": "^2.2.5",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "@napi-rs/keyring": "^1.3.0"
-  },
-  "devDependencies": {
-    "@cloudflare/puppeteer": "^1.1.0",
-    "@cloudflare/sandbox": "^0.10.0",
-    "@cloudflare/workers-types": "^4.20260511.1",
-    "@types/node": "^24.7.2",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "wrangler": "^4.90.0"
-  }
-}
+{
+  "name": "@vibecodr/cli",
+  "version": "1.0.1",
+  "description": "The official Vibecodr CLI: hosted browser, hosted computer, capsule uploads, Pulse operations, and agent-client MCP setup under one command.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "vibecodr": "dist/bin/vibecodr-mcp.js",
+    "vibecodr-mcp": "dist/bin/vibecodr-mcp.js",
+    "vc-tools": "dist/bin/vc-tools.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "MIGRATION.md",
+    "docs",
+    "preinstall-check.mjs"
+  ],
+  "engines": {
+    "node": ">=22 <26"
+  },
+  "keywords": [
+    "vibecodr",
+    "cli",
+    "mcp",
+    "model-context-protocol",
+    "agent-computer",
+    "browser-automation",
+    "cloudflare",
+    "sandbox"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BradenHartsell/Vibecodr-CLI.git"
+  },
+  "bugs": {
+    "url": "https://github.com/BradenHartsell/Vibecodr-CLI/issues"
+  },
+  "homepage": "https://vibecodr.space/vc-tools",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "preinstall": "node preinstall-check.mjs",
+    "build": "tsc -p tsconfig.build.json",
+    "check": "npm run check:cli && npm run check:worker",
+    "check:cli": "tsc -p tsconfig.json --noEmit",
+    "check:worker": "tsc -p tsconfig.worker.json --noEmit",
+    "test": "node --import tsx --test test/**/*.test.ts",
+    "test:live-smoke": "node --import tsx --test test/live-smoke.smoke.ts",
+    "test:upgrade-smoke": "node --import tsx --test test/upgrade-path.smoke.ts",
+    "test:pulse-smoke": "node --import tsx --test test/pulse-e2e.smoke.ts",
+    "test:integration:worker": "node --import tsx --test test/worker-gateway.integration.test.ts",
+    "verify:artifact": "node scripts/check-pack-artifact.mjs",
+    "verify:release": "node scripts/check-release-readiness.mjs",
+    "verify": "npm run check && npm run build && npm test && npm run verify:artifact && npm run verify:release"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@napi-rs/keyring": "^1.3.0"
+  },
+  "devDependencies": {
+    "@cloudflare/puppeteer": "^1.1.0",
+    "@cloudflare/sandbox": "^0.10.0",
+    "@cloudflare/workers-types": "^4.20260511.1",
+    "@types/node": "^24.7.2",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "wrangler": "^4.90.0"
+  }
+}