@wastedcode/memex 0.1.1 → 0.1.2

package/dist/index.js

@@ -12,6 +12,7 @@ import { logsCommand } from './cli/commands/logs.js';
 import { listCommand } from './cli/commands/list.js';
 import { chownCommand } from './cli/commands/chown.js';
 import { statusCommand } from './cli/commands/status.js';
+import { setupTokenCommand } from './cli/commands/setup-token.js';
 const program = new Command();
 program
     .name('memex')
@@ -29,6 +30,7 @@ program.addCommand(logsCommand);
 program.addCommand(listCommand);
 program.addCommand(chownCommand);
 program.addCommand(statusCommand);
+program.addCommand(setupTokenCommand);
 program.parseAsync().catch((err) => {
     console.error(err.message ?? err);
     process.exit(1);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,mEAAmE,CAAC;KAChF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,mEAAmE,CAAC;KAChF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAEtC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/errors.js

@@ -41,8 +41,10 @@ export class NoCredentialsError extends MemexError {
     constructor(wikiId) {
         super(`No credentials configured for wiki '${wikiId}'.\n` +
             'Set credentials with:\n' +
-            `  memex login ${wikiId}          (OAuth)\n` +
-            `  memex config ${wikiId} --set-key  (API key)`, 'NO_CREDENTIALS', 400);
+            `  memex setup-token <token>               (global, all wikis)\n` +
+            `  memex login ${wikiId} --token <token>    (per-wiki)\n` +
+            `  memex login ${wikiId}                    (copy ~/.claude credentials)\n` +
+            '\nGenerate a token by running: claude setup-token', 'NO_CREDENTIALS', 400);
     }
 }
 export class ForbiddenError extends MemexError {

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IACA;IAHT,YACE,OAAe,EACR,IAAY,EACZ,aAAqB,GAAG;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAc;QAG/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,MAAM,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,MAAM,kBAAkB,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,KAAa;QACvB,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C;QACE,KAAK,CACH,4DAA4D;YAC5D,YAAY;YACZ,iDAAiD;YACjD,2DAA2D;YAC3D,mEAAmE,EACnE,kBAAkB,EAClB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,MAAc;QACxB,KAAK,CACH,uCAAuC,MAAM,MAAM;YACnD,yBAAyB;YACzB,iBAAiB,MAAM,qBAAqB;YAC5C,kBAAkB,MAAM,uBAAuB,EAC/C,gBAAgB,EAChB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,MAAc;QACxB,KAAK,CAAC,0BAA0B,MAAM,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD;QACE,KAAK,CACH,mCAAmC;YACnC,4BAA4B,EAC5B,oBAAoB,EACpB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IACA;IAHT,YACE,OAAe,EACR,IAAY,EACZ,aAAqB,GAAG;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAc;QAG/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,MAAM,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,MAAM,kBAAkB,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,KAAa;QACvB,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C;QACE,KAAK,CACH,4DAA4D;YAC5D,YAAY;YACZ,iDAAiD;YACjD,2DAA2D;YAC3D,mEAAmE,EACnE,kBAAkB,EAClB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,MAAc;QACxB,KAAK,CACH,uCAAuC,MAAM,MAAM;YACnD,yBAAyB;YACzB,iEAAiE;YACjE,iBAAiB,MAAM,kCAAkC;YACzD,iBAAiB,MAAM,oDAAoD;YAC3E,mDAAmD,EACnD,gBAAgB,EAChB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,MAAc;QACxB,KAAK,CAAC,0BAA0B,MAAM,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD;QACE,KAAK,CACH,mCAAmC;YACnC,4BAA4B,EAC5B,oBAAoB,EACpB,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/standalone/memex.mjs

@@ -253,8 +253,11 @@ var init_errors = __esm({
         super(
           `No credentials configured for wiki '${wikiId}'.
 Set credentials with:
-  memex login ${wikiId}          (OAuth)
-  memex config ${wikiId} --set-key  (API key)`,
+  memex setup-token <token>               (global, all wikis)
+  memex login ${wikiId} --token <token>    (per-wiki)
+  memex login ${wikiId}                    (copy ~/.claude credentials)
+
+Generate a token by running: claude setup-token`,
           "NO_CREDENTIALS",
           400
         );
@@ -568,36 +571,37 @@ Chronological record of knowledge base activity.
 // src/daemon/auth.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "node:fs";
 import { join as join3 } from "node:path";
-var AuthManager;
+var GLOBAL_TOKEN_PATH, AuthManager;
 var init_auth = __esm({
   "src/daemon/auth.ts"() {
     "use strict";
     init_constants();
     init_errors();
+    GLOBAL_TOKEN_PATH = join3(DATA_DIR, ".oauth-token");
     AuthManager = class {
-      constructor(wikisDir = WIKIS_DIR, globalApiKey) {
+      constructor(wikisDir = WIKIS_DIR) {
         this.wikisDir = wikisDir;
-        this.globalApiKey = globalApiKey;
+        this.globalOAuthToken = this.loadGlobalToken();
       }
       wikisDir;
-      globalApiKey;
+      globalOAuthToken;
       /**
        * Resolve credentials for a wiki, returning environment variables
        * to set on the claude child process.
        *
        * Priority:
-       *   1. Per-wiki API key file (.claude/api-key)
+       *   1. Per-wiki OAuth token file (.claude/oauth-token)
        *   2. Per-wiki OAuth credentials (.claude/.credentials.json exists)
-       *   3. Global ANTHROPIC_API_KEY from daemon environment
+       *   3. Global OAuth token (from `memex setup-token`)
        */
       resolveCredentials(wikiId) {
         const claudeDir = this.configDir(wikiId);
-        const apiKeyPath = join3(claudeDir, "api-key");
-        if (existsSync3(apiKeyPath)) {
-          const key = readFileSync2(apiKeyPath, "utf-8").trim();
-          if (key) {
+        const tokenPath = join3(claudeDir, "oauth-token");
+        if (existsSync3(tokenPath)) {
+          const token = readFileSync2(tokenPath, "utf-8").trim();
+          if (token) {
             return {
-              ANTHROPIC_API_KEY: key,
+              CLAUDE_CODE_OAUTH_TOKEN: token,
               CLAUDE_CONFIG_DIR: claudeDir
             };
           }
@@ -608,22 +612,38 @@ var init_auth = __esm({
             CLAUDE_CONFIG_DIR: claudeDir
           };
         }
-        if (this.globalApiKey) {
+        if (this.globalOAuthToken) {
           return {
-            ANTHROPIC_API_KEY: this.globalApiKey,
+            CLAUDE_CODE_OAUTH_TOKEN: this.globalOAuthToken,
             CLAUDE_CONFIG_DIR: claudeDir
           };
         }
         throw new NoCredentialsError(wikiId);
       }
       /**
-       * Store an API key for a wiki.
+       * Store and activate a global OAuth token (from `claude setup-token`).
+       * This is the daemon-wide fallback used when a wiki has no per-wiki credentials.
+       */
+      setGlobalToken(token) {
+        const trimmed = token.trim();
+        mkdirSync3(DATA_DIR, { recursive: true });
+        writeFileSync2(GLOBAL_TOKEN_PATH, trimmed, { mode: 384 });
+        this.globalOAuthToken = trimmed;
+      }
+      /**
+       * Check if a global OAuth token is configured.
        */
-      setApiKey(wikiId, key) {
+      hasGlobalToken() {
+        return !!this.globalOAuthToken;
+      }
+      /**
+       * Store an OAuth token for a specific wiki.
+       */
+      setWikiToken(wikiId, token) {
         const claudeDir = this.configDir(wikiId);
         mkdirSync3(claudeDir, { recursive: true, mode: 448 });
-        const apiKeyPath = join3(claudeDir, "api-key");
-        writeFileSync2(apiKeyPath, key.trim(), { mode: 384 });
+        const tokenPath = join3(claudeDir, "oauth-token");
+        writeFileSync2(tokenPath, token.trim(), { mode: 384 });
       }
       /**
        * Get the CLAUDE_CONFIG_DIR path for a wiki.
@@ -645,9 +665,17 @@ var init_auth = __esm({
        */
       hasCredentials(wikiId) {
         const claudeDir = this.configDir(wikiId);
-        const apiKeyPath = join3(claudeDir, "api-key");
+        const tokenPath = join3(claudeDir, "oauth-token");
         const credsPath = join3(claudeDir, ".credentials.json");
-        return existsSync3(apiKeyPath) || existsSync3(credsPath) || !!this.globalApiKey;
+        return existsSync3(tokenPath) || existsSync3(credsPath) || !!this.globalOAuthToken;
+      }
+      // ── Private ────────────────────────────────────────────────────────────
+      loadGlobalToken() {
+        if (existsSync3(GLOBAL_TOKEN_PATH)) {
+          const token = readFileSync2(GLOBAL_TOKEN_PATH, "utf-8").trim();
+          if (token) return token;
+        }
+        return void 0;
       }
     };
   }
@@ -968,6 +996,9 @@ var init_runner = __esm({
         if (credEnv["CLAUDE_CONFIG_DIR"]) {
           env["CLAUDE_CONFIG_DIR"] = `${WORKSPACE_MOUNT}/.claude`;
         }
+        if (credEnv["CLAUDE_CODE_OAUTH_TOKEN"]) {
+          env["CLAUDE_CODE_OAUTH_TOKEN"] = credEnv["CLAUDE_CODE_OAUTH_TOKEN"];
+        }
         return new Promise((resolve) => {
           const child = spawn(wrapped.command, wrapped.args, {
             env,
@@ -1245,7 +1276,8 @@ var init_routes = __esm({
           { method: "DELETE", pattern: /^\/wikis\/(?<id>[^/]+)$/, handler: this.destroyWiki.bind(this) },
           { method: "PUT", pattern: /^\/wikis\/(?<id>[^/]+)\/config$/, handler: this.updateConfig.bind(this) },
           { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/chown$/, handler: this.chownWiki.bind(this) },
-          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/api-key$/, handler: this.setApiKey.bind(this) },
+          { method: "POST", pattern: /^\/auth\/token$/, handler: this.setGlobalToken.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/token$/, handler: this.setWikiToken.bind(this) },
           { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/credentials$/, handler: this.setCredentials.bind(this) },
           { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/jobs$/, handler: this.submitJob.bind(this) },
           { method: "GET", pattern: /^\/wikis\/(?<id>[^/]+)\/jobs\/(?<jobId>\d+)$/, handler: this.getJob.bind(this) },
@@ -1355,16 +1387,31 @@ var init_routes = __esm({
         return { status: 200, body: { ok: true, data: wiki } };
       }
       // ── Auth ─────────────────────────────────────────────────────────────────
-      async setApiKey(params, body, ctx) {
+      async setGlobalToken(_params, body, _ctx) {
+        const b = requireBody(body);
+        const token = b.token;
+        if (!token || typeof token !== "string") {
+          throw new ValidationError("token (string) is required");
+        }
+        if (!token.startsWith("sk-ant-oat01-")) {
+          throw new ValidationError("Token must be a Claude OAuth token (sk-ant-oat01-...)");
+        }
+        this.auth.setGlobalToken(token);
+        return { status: 200, body: { ok: true } };
+      }
+      async setWikiToken(params, body, ctx) {
         const wikiId = params["id"];
         this.requireWiki(wikiId, ctx.callerUid);
         const b = requireBody(body);
-        const key = b.key;
-        if (!key || typeof key !== "string") {
-          throw new ValidationError("API key is required");
+        const token = b.token;
+        if (!token || typeof token !== "string") {
+          throw new ValidationError("token (string) is required");
         }
-        this.auth.setApiKey(wikiId, key);
-        this.db.logAudit(wikiId, "wiki.api_key_set");
+        if (!token.startsWith("sk-ant-oat01-")) {
+          throw new ValidationError("Token must be a Claude OAuth token (sk-ant-oat01-...)");
+        }
+        this.auth.setWikiToken(wikiId, token);
+        this.db.logAudit(wikiId, "wiki.oauth_token_set");
         return { status: 200, body: { ok: true } };
       }
       async setCredentials(params, body, ctx) {
@@ -1659,7 +1706,7 @@ async function startDaemon() {
   namespace.checkCapabilities();
   namespace.ensureDirectories();
   const scaffold = new WikiScaffold(WIKIS_DIR);
-  const auth = new AuthManager(WIKIS_DIR, process.env["ANTHROPIC_API_KEY"]);
+  const auth = new AuthManager(WIKIS_DIR);
   const runner = new ClaudeRunner(namespace, auth, db, WIKIS_DIR);
   const queue = new QueueManager(db, runner, AUTO_LINT_INTERVAL);
   const routes = new RouteHandler(db, scaffold, namespace, queue, auth);
@@ -1699,7 +1746,7 @@ var init_daemon = __esm({
 });
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/cli/commands/serve.ts
 import { Command } from "commander";
@@ -1844,8 +1891,11 @@ var MemexClient = class {
   chownWiki(wikiId, uid) {
     return this.request("POST", `/wikis/${wikiId}/chown`, { uid });
   }
-  setApiKey(wikiId, key) {
-    return this.request("POST", `/wikis/${wikiId}/api-key`, { key });
+  setGlobalToken(token) {
+    return this.request("POST", "/auth/token", { token });
+  }
+  setWikiToken(wikiId, token) {
+    return this.request("POST", `/wikis/${wikiId}/token`, { token });
   }
   setCredentials(wikiId, credentials) {
     return this.request("POST", `/wikis/${wikiId}/credentials`, { credentials });
@@ -1958,7 +2008,7 @@ import { createInterface as createInterface2 } from "node:readline";
 import { execFileSync as execFileSync2 } from "node:child_process";
 init_constants();
 import { join as join5 } from "node:path";
-var configCommand = new Command4("config").description("Configure a wiki").argument("<wikiId>", "Wiki to configure").option("--edit", "Open .claude.md in $EDITOR").option("--set-key", "Set the API key for this wiki").option("--model <model>", "Set the default model (e.g., sonnet, opus, haiku)").option("--allowed-tools <tools>", "Set allowed tools (comma-separated, e.g., WebSearch,WebFetch)").option("--list-tools", "Show available tools and current configuration").action(async (wikiId, opts) => {
+var configCommand = new Command4("config").description("Configure a wiki").argument("<wikiId>", "Wiki to configure").option("--edit", "Open .claude.md in $EDITOR").option("--set-token", "Set an OAuth token for this wiki (from `claude setup-token`)").option("--model <model>", "Set the default model (e.g., sonnet, opus, haiku)").option("--allowed-tools <tools>", "Set allowed tools (comma-separated, e.g., WebSearch,WebFetch)").option("--list-tools", "Show available tools and current configuration").action(async (wikiId, opts) => {
   const client = new MemexClient();
   const wikiResp = await client.getWiki(wikiId);
   if (!wikiResp.ok) {
@@ -1977,14 +2027,20 @@ var configCommand = new Command4("config").description("Configure a wiki").argum
     }
     return;
   }
-  if (opts.setKey) {
-    const key = await promptSecret("API key: ");
-    const resp = await client.setApiKey(wikiId, key);
+  if (opts.setToken) {
+    const token = await promptSecret("OAuth token (from `claude setup-token`): ");
+    if (!token.startsWith("sk-ant-oat01-")) {
+      console.error(`Error: Token must start with 'sk-ant-oat01-'.`);
+      console.error(`
+Generate one by running: claude setup-token`);
+      process.exit(1);
+    }
+    const resp = await client.setWikiToken(wikiId, token);
     if (!resp.ok) {
       console.error(`Error: ${resp.error}`);
       process.exit(1);
     }
-    console.log(`API key set for '${wikiId}'`);
+    console.log(`OAuth token set for '${wikiId}'`);
     return;
   }
   if (opts.listTools) {
@@ -2070,27 +2126,36 @@ import { readFileSync as readFileSync5, existsSync as existsSync6 } from "node:f
 import { join as join6 } from "node:path";
 import { homedir } from "node:os";
 var DEFAULT_CREDS_PATH = join6(homedir(), ".claude", ".credentials.json");
-var loginCommand = new Command5("login").description("Copy Claude credentials into a wiki").argument("<wikiId>", "Wiki to authenticate").option("--credentials <path>", "Path to .credentials.json", DEFAULT_CREDS_PATH).option("--api-key <key>", "Use an API key instead of OAuth credentials").action(async (wikiId, opts) => {
+var loginCommand = new Command5("login").description("Copy Claude credentials into a wiki").argument("<wikiId>", "Wiki to authenticate").option("--credentials <path>", "Path to .credentials.json", DEFAULT_CREDS_PATH).option("--token <token>", "Use an OAuth token from `claude setup-token`").action(async (wikiId, opts) => {
   const client = new MemexClient();
   const wikiResp = await client.getWiki(wikiId);
   if (!wikiResp.ok) {
     console.error(`Error: ${wikiResp.error}`);
     process.exit(1);
   }
-  if (opts.apiKey) {
-    const resp2 = await client.setApiKey(wikiId, opts.apiKey);
+  if (opts.token) {
+    if (!opts.token.startsWith("sk-ant-oat01-")) {
+      console.error(`Error: Token must start with 'sk-ant-oat01-'.`);
+      console.error(`
+Generate one by running: claude setup-token`);
+      process.exit(1);
+    }
+    const resp2 = await client.setWikiToken(wikiId, opts.token);
     if (!resp2.ok) {
       console.error(`Error: ${resp2.error}`);
       process.exit(1);
     }
-    console.log(`API key stored for wiki '${wikiId}'.`);
+    console.log(`OAuth token stored for wiki '${wikiId}'.`);
     return;
   }
   const credsPath = opts.credentials;
   if (!existsSync6(credsPath)) {
     console.error(`Error: Credentials file not found: ${credsPath}`);
     console.error(`
-Run 'claude auth login' first, or pass --credentials <path>`);
+Options:`);
+    console.error(`  1. Run 'claude auth login' first, then re-run this command`);
+    console.error(`  2. Run 'claude setup-token' and use: memex login ${wikiId} --token <token>`);
+    console.error(`  3. Set globally: memex setup-token <token>`);
     process.exit(1);
   }
   const credentials = readFileSync5(credsPath, "utf-8");
@@ -2380,8 +2445,42 @@ function padRow2(id, type, status, created) {
   return `${id.padEnd(8)} ${type.padEnd(10)} ${status.padEnd(12)} ${created}`;
 }
 
+// src/cli/commands/setup-token.ts
+import { Command as Command13 } from "commander";
+var TOKEN_PREFIX = "sk-ant-oat01-";
+var setupTokenCommand = new Command13("setup-token").description("Store a long-lived OAuth token from `claude setup-token` for all wikis").argument("<token>", "OAuth token (sk-ant-oat01-...)").option("--wiki <wikiId>", "Store for a specific wiki only (instead of globally)").action(async (token, opts) => {
+  if (!token.startsWith(TOKEN_PREFIX)) {
+    console.error(`Error: Token must start with '${TOKEN_PREFIX}'.`);
+    console.error(`
+Generate one by running: claude setup-token`);
+    process.exit(1);
+  }
+  const client = new MemexClient();
+  if (opts.wiki) {
+    const wikiResp = await client.getWiki(opts.wiki);
+    if (!wikiResp.ok) {
+      console.error(`Error: ${wikiResp.error}`);
+      process.exit(1);
+    }
+    const resp = await client.setWikiToken(opts.wiki, token);
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    console.log(`OAuth token stored for wiki '${opts.wiki}'.`);
+  } else {
+    const resp = await client.setGlobalToken(token);
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    console.log("Global OAuth token stored.");
+    console.log("All wikis without per-wiki credentials will use this token.");
+  }
+});
+
 // src/index.ts
-var program = new Command13();
+var program = new Command14();
 program.name("memex").description("Isolated, queued claude -p runtime for persistent knowledge bases").version("0.1.0");
 program.addCommand(serveCommand);
 program.addCommand(createCommand);
@@ -2395,6 +2494,7 @@ program.addCommand(logsCommand);
 program.addCommand(listCommand);
 program.addCommand(chownCommand);
 program.addCommand(statusCommand);
+program.addCommand(setupTokenCommand);
 program.parseAsync().catch((err) => {
   console.error(err.message ?? err);
   process.exit(1);