@xmemo/client 0.4.142 → 0.4.144

package/README.md

@@ -41,6 +41,8 @@ xmemo setup gemini
 xmemo setup gemini --dry-run
 xmemo setup antigravity
 xmemo setup antigravity --dry-run
+xmemo mcp add antigravity2
+xmemo mcp add antigravity2 --write
 xmemo doctor
 xmemo discovery show
 xmemo setup
@@ -195,6 +197,25 @@ gemini      ~/.gemini/GEMINI.md
 antigravity ~/.gemini/antigravity/MEMORY.md
 ```
 
+Antigravity 2.0 currently uses the lower-level MCP writer because its stable
+user config path is separate from the original Antigravity profile. Preview the
+generated OAuth-first config with:
+
+```bash
+xmemo mcp add antigravity2 --url https://xmemo.dev
+```
+
+Write it to the default Antigravity 2.0 config path with:
+
+```bash
+xmemo mcp add antigravity2 --url https://xmemo.dev --write
+```
+
+The generated config uses `https://xmemo.dev/mcp`, contains no bearer token, and
+expects Antigravity 2.0 to complete MCP OAuth in the browser on first use.
+`XMEMO_AGENT_INSTANCE_ID` is generated and stored as a stable non-secret local
+installation identifier when `--write` is used.
+
 ## MCP setup
 
 List supported client generators:
@@ -211,6 +232,7 @@ cursor      ~/.cursor/mcp.json
 copilot     ~/.copilot/mcp-config.json
 gemini      ~/.gemini/settings.json
 antigravity ~/.gemini/antigravity/mcp_config.json
+antigravity2 ~/.antigravity2/mcp.json
 ```
 
 For clients without a verified user-scoped write path, generate a read-only
@@ -221,7 +243,8 @@ xmemo mcp config --client generic --base-url "https://your-private-service.examp
 ```
 
 Codex, Cursor, Copilot CLI, Gemini CLI, and Antigravity have write-capable setup
-helpers.
+helpers. Antigravity 2.0 is write-capable through `xmemo mcp add antigravity2
+--write`.
 Other client writes should only be added after their official user-scoped config
 format is verified.
 
@@ -394,6 +417,44 @@ directly, for example with `--url` or `--config` in advanced/multi-client setup.
 The CLI refuses to overwrite an existing `XMemo`, `memory_os`, or `memory-os`
 MCP server entry. Edit the config manually if you need to rotate the endpoint.
 
+### Antigravity 2.0
+
+Recommended Antigravity 2.0 setup:
+
+```bash
+xmemo mcp add antigravity2 --write
+```
+
+Use a dry preview first if you want to inspect the exact JSON before writing:
+
+```bash
+xmemo mcp add antigravity2
+```
+
+Antigravity 2.0 uses a separate config path from the original Antigravity
+profile. The default write target is `~/.antigravity2/mcp.json`; on Windows the
+server-side config contract also documents `%APPDATA%\\Antigravity 2.0\\mcp.json`
+as the Antigravity 2.0 user config location. Pass `--config <path>` when you
+want to write to a specific file.
+
+The generated `XMemo` entry uses hosted HTTP MCP:
+
+```json
+{
+  "mcpServers": {
+    "XMemo": {
+      "type": "http",
+      "url": "https://xmemo.dev/mcp"
+    }
+  }
+}
+```
+
+No token value is written. Restart Antigravity 2.0 after setup and complete the
+MCP OAuth browser flow on first use. If you use `--write`, the CLI also prepares
+a stable non-secret `XMEMO_AGENT_INSTANCE_ID` for this local Antigravity 2.0
+install so XMemo can attribute activity consistently without embedding secrets.
+
 ## Release model
 
 This repository is the source for the `@xmemo/client` npm package. Releases

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmemo/client",
-  "version": "0.4.142",
+  "version": "0.4.144",
   "description": "Privacy-first CLI and MCP setup helper for XMemo.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -11,7 +11,7 @@ const PACKAGE_NAME = '@xmemo/client';
 const FALLBACK_PACKAGE_NAME = '@yonro/xmemo-client';
 const COMMAND_NAME = 'xmemo';
 const LEGACY_COMMAND_NAME = 'memory-os';
-const CLI_VERSION = '0.4.142';
+const CLI_VERSION = '0.4.143';
 const DEFAULT_SERVICE_URL = 'https://xmemo.dev';
 const TOKEN_ENV_VAR = 'XMEMO_KEY';
 const LEGACY_TOKEN_ENV_VAR = 'MEMORY_OS_MCP_TOKEN';
@@ -311,36 +311,53 @@ function defaultIo() {
 }
 
 function writeHelp(io) {
-  writeLine(io.stdout, `${PRODUCT_NAME} CLI (${PACKAGE_NAME})`);
-  writeLine(io.stdout, `Fallback npm package: ${FALLBACK_PACKAGE_NAME}; legacy command alias: ${LEGACY_COMMAND_NAME}`);
+  writeLine(io.stdout, `======================================================================`);
+  writeLine(io.stdout, ` 🧠  ${PRODUCT_NAME} CLI (Version ${CLI_VERSION}) — Cloud Memory Orchestration Utility`);
+  writeLine(io.stdout, `======================================================================`);
+  writeLine(io.stdout, `Official package: ${PACKAGE_NAME} | Legacy command: ${LEGACY_COMMAND_NAME}`);
   writeLine(io.stdout, '');
-  writeLine(io.stdout, 'Usage:');
-  writeLine(io.stdout, `  ${COMMAND_NAME} update [--dry-run] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} doctor [--base-url <https://api.example.com>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} discovery show [--base-url <https://api.example.com>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} setup <codex|cursor|copilot|gemini|antigravity> [--url <https://api.example.com>] [--dry-run] [--no-profile] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} login [--from-stdin] [--base-url <url>] [--timeout-ms <ms>] [--http-timeout-ms <ms>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} auth status [--verify] [--base-url <url>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} status [--url <https://api.example.com>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} token status [--verify]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} token add --from-stdin`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} token set --from-stdin [--allow-plaintext]`);
+  writeLine(io.stdout, '💡 CORE ONBOARDING & SETUP COMMANDS:');
+  writeLine(io.stdout, `  ${COMMAND_NAME} setup --all [--write] [--profile]`);
+  writeLine(io.stdout, `      Auto-detects all local client installations (Cursor, VS Code, Continue, Trae, etc.).`);
+  writeLine(io.stdout, `      Merges XMemo MCP configs. Pass --profile to auto-inject workspace prompt rules.`);
+  writeLine(io.stdout, `      *Dry-run by default unless --write (or --yes/-y) is specified for safety.*`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, `  ${COMMAND_NAME} setup <client-id> [--url <url>] [--no-profile] [--json]`);
+  writeLine(io.stdout, `      Runs interactive setup wizard for a single client (e.g. cursor, gemini, antigravity).`);
+  writeLine(io.stdout, `      Detects active workspace to auto-inject project-scoped instruction rules.`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, `  ${COMMAND_NAME} login [--from-stdin] [--base-url <url>]`);
+  writeLine(io.stdout, `      Starts secure OAuth2 browser-based device login flow to register the CLI.`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, '🛡️  DIAGNOSTICS & SYSTEM AUDIT:');
+  writeLine(io.stdout, `  ${COMMAND_NAME} doctor [--base-url <url>] [--json]`);
+  writeLine(io.stdout, `      Performs structural diagnostics (Node version, Cloud connectivity, API compatibility, security).`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, `  ${COMMAND_NAME} status [--url <url>] [--json]`);
+  writeLine(io.stdout, `      Probes and audits XMemo core service endpoints, readiness states, and network health.`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, '📋 MCP & CREDENTIAL MANAGEMENT:');
   writeLine(io.stdout, `  ${COMMAND_NAME} mcp list`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} mcp config --client <codex|cursor|copilot-cli|gemini-cli|antigravity|generic> [--base-url <url>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} mcp proxy [--port ${DEFAULT_PROXY_PORT}]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} mcp profile codex [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} profile install <codex|cursor|gemini|antigravity> [--target <path>] [--dry-run|--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} profile uninstall <codex|cursor|gemini|antigravity> [--target <path>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} mcp add <${supportedMcpClientIds().join('|')}> [--url <https://api.example.com>] [--write] [--config <path>]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} smoke --client codex [--config <path>] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} env example [--shell bash|powershell|cmd] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} privacy`);
+  writeLine(io.stdout, `      Lists all natively supported client integrations and configurations.`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, `  ${COMMAND_NAME} mcp config --client <client-id> [--base-url <url>] [--json]`);
+  writeLine(io.stdout, `      Generates and outputs raw MCP config snippet templates without writing to files.`);
   writeLine(io.stdout, '');
-  writeLine(io.stdout, `Default service URL: ${DEFAULT_SERVICE_URL}; use --url or XMEMO_URL for private deployments.`);
-  writeLine(io.stdout, '`login --timeout-ms` controls the full browser approval window; HTTP calls use `--http-timeout-ms`.');
+  writeLine(io.stdout, `  ${COMMAND_NAME} mcp add <client-id> [--write] [--config <path>]`);
+  writeLine(io.stdout, `      Directly adds XMemo MCP server config snippet to the specified client settings file.`);
   writeLine(io.stdout, '');
-  writeLine(io.stdout, 'Privacy defaults: no telemetry, no token in project files, and no token is sent by `status`, `doctor`, or `discovery`.');
-  writeLine(io.stdout, '`login` and `token add` store credentials only in the user-scoped XMemo CLI config directory.');
+  writeLine(io.stdout, `  ${COMMAND_NAME} profile install <client-id> [--target <path>] [--dry-run]`);
+  writeLine(io.stdout, `      Injects/updates instruction rules prompt in target workspace rules files (Cursor/Gemini).`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, `  ${COMMAND_NAME} token status [--verify] | ${COMMAND_NAME} token add --from-stdin`);
+  writeLine(io.stdout, `      Checks local static credential states or manually saves XMEMO_KEY for key-auth fallbacks.`);
+  writeLine(io.stdout, '');
+  writeLine(io.stdout, '🔐 SECURITY & PRIVACY BY DESIGN:');
+  writeLine(io.stdout, '  - ZERO Telemetry: We never collect private workspace data or usage metrics.');
+  writeLine(io.stdout, '  - Git Protection: API tokens are kept securely in system environment variables (XMEMO_KEY)');
+  writeLine(io.stdout, '    or in user-scoped credentials.json file. They are never written to project configs.');
+  writeLine(io.stdout, '  - AST Merge Safety: Config writes only touch and append the XMemo keys, preserving all other servers.');
+  writeLine(io.stdout, '======================================================================');
 }
 
 async function updateCommand(args, io) {
@@ -2587,23 +2604,27 @@ async function mergeAntigravityMcpConfig(configPath, mcpUrl, identity) {
   await bestEffortChmod(configPath, 0o600);
 }
 
-function antigravityIdeJsonServerConfig(mcpUrl) {
+function antigravityIdeJsonServerConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     type: 'http',
-    url: mcpUrl
+    url: mcpUrl,
+    headers: {
+      [AGENT_ID_HEADER]: identity.agentId,
+      [AGENT_INSTANCE_HEADER]: identity.agentInstanceId
+    }
   };
 }
 
-function antigravityIdeJsonConfig(mcpUrl) {
+function antigravityIdeJsonConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     mcpServers: {
-      [MCP_SERVER_NAME]: antigravityIdeJsonServerConfig(mcpUrl)
+      [MCP_SERVER_NAME]: antigravityIdeJsonServerConfig(mcpUrl, identity)
     }
   };
 }
 
-function antigravityIdeJsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity-ide')) {
-  return `${JSON.stringify(antigravityIdeJsonConfig(mcpUrl), null, 2)}\n`;
+function antigravityIdeJsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity')) {
+  return `${JSON.stringify(antigravityIdeJsonConfig(mcpUrl, identity), null, 2)}\n`;
 }
 
 async function mergeAntigravityIdeMcpConfig(configPath, mcpUrl, identity) {
@@ -2623,29 +2644,33 @@ async function mergeAntigravityIdeMcpConfig(configPath, mcpUrl, identity) {
     throw new UsageError(`MCP config already contains mcpServers.${existingName}. Edit ${configPath} manually to avoid duplicate server definitions.`);
   }
 
-  parsed.mcpServers[MCP_SERVER_NAME] = antigravityIdeJsonServerConfig(mcpUrl);
+  parsed.mcpServers[MCP_SERVER_NAME] = antigravityIdeJsonServerConfig(mcpUrl, identity);
   await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });
   await fs.writeFile(configPath, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
   await bestEffortChmod(configPath, 0o600);
 }
 
-function antigravity2JsonServerConfig(mcpUrl) {
+function antigravity2JsonServerConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     type: 'http',
-    url: mcpUrl
+    url: mcpUrl,
+    headers: {
+      [AGENT_ID_HEADER]: identity.agentId,
+      [AGENT_INSTANCE_HEADER]: identity.agentInstanceId
+    }
   };
 }
 
-function antigravity2JsonConfig(mcpUrl) {
+function antigravity2JsonConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     mcpServers: {
-      [MCP_SERVER_NAME]: antigravity2JsonServerConfig(mcpUrl)
+      [MCP_SERVER_NAME]: antigravity2JsonServerConfig(mcpUrl, identity)
     }
   };
 }
 
-function antigravity2JsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity2')) {
-  return `${JSON.stringify(antigravity2JsonConfig(mcpUrl), null, 2)}\n`;
+function antigravity2JsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity')) {
+  return `${JSON.stringify(antigravity2JsonConfig(mcpUrl, identity), null, 2)}\n`;
 }
 
 async function mergeAntigravity2McpConfig(configPath, mcpUrl, identity) {
@@ -2665,13 +2690,13 @@ async function mergeAntigravity2McpConfig(configPath, mcpUrl, identity) {
     throw new UsageError(`MCP config already contains mcpServers.${existingName}. Edit ${configPath} manually to avoid duplicate server definitions.`);
   }
 
-  parsed.mcpServers[MCP_SERVER_NAME] = antigravity2JsonServerConfig(mcpUrl);
+  parsed.mcpServers[MCP_SERVER_NAME] = antigravity2JsonServerConfig(mcpUrl, identity);
   await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });
   await fs.writeFile(configPath, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
   await bestEffortChmod(configPath, 0o600);
 }
 
-function antigravityCliJsonServerConfig(mcpUrl, identity = envReferenceIdentity('antigravity-cli')) {
+function antigravityCliJsonServerConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     httpUrl: mcpUrl,
     headers: {
@@ -2681,7 +2706,7 @@ function antigravityCliJsonServerConfig(mcpUrl, identity = envReferenceIdentity(
   };
 }
 
-function antigravityCliJsonConfig(mcpUrl, identity = envReferenceIdentity('antigravity-cli')) {
+function antigravityCliJsonConfig(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return {
     mcpServers: {
       [MCP_SERVER_NAME]: antigravityCliJsonServerConfig(mcpUrl, identity)
@@ -2689,7 +2714,7 @@ function antigravityCliJsonConfig(mcpUrl, identity = envReferenceIdentity('antig
   };
 }
 
-function antigravityCliJsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity-cli')) {
+function antigravityCliJsonSnippet(mcpUrl, identity = envReferenceIdentity('antigravity')) {
   return `${JSON.stringify(antigravityCliJsonConfig(mcpUrl, identity), null, 2)}\n`;
 }
 
@@ -2812,27 +2837,28 @@ function geminiJsonSnippet(mcpUrl, identity = envReferenceIdentity('gemini-cli')
 }
 
 async function agentIdentity(clientId, env) {
+  const targetClientId = (clientId === 'antigravity-ide' || clientId === 'antigravity2' || clientId === 'antigravity-cli') ? 'antigravity' : clientId;
   const configuredInstanceId = env[AGENT_INSTANCE_ENV_VAR];
   if (configuredInstanceId) {
     return {
-      agentId: clientId,
+      agentId: targetClientId,
       agentInstanceId: configuredInstanceId,
       path: `${AGENT_INSTANCE_ENV_VAR} environment variable`
     };
   }
 
-  const identityPath = agentInstanceIdentityPath(env, clientId);
+  const identityPath = agentInstanceIdentityPath(env, targetClientId);
   const existing = await readAgentInstanceIdentity(identityPath);
   if (existing) {
-    return { agentId: clientId, agentInstanceId: existing, path: identityPath };
+    return { agentId: targetClientId, agentInstanceId: existing, path: identityPath };
   }
 
-  const generated = `xmemo-${clientId}-${randomUUID()}`;
+  const generated = `xmemo-${targetClientId}-${randomUUID()}`;
   await fs.mkdir(path.dirname(identityPath), { recursive: true, mode: 0o700 });
   await bestEffortChmod(path.dirname(identityPath), 0o700);
-  await fs.writeFile(identityPath, `${JSON.stringify({ version: 1, agentId: clientId, agentInstanceId: generated }, null, 2)}\n`, { mode: 0o600 });
+  await fs.writeFile(identityPath, `${JSON.stringify({ version: 1, agentId: targetClientId, agentInstanceId: generated }, null, 2)}\n`, { mode: 0o600 });
   await bestEffortChmod(identityPath, 0o600);
-  return { agentId: clientId, agentInstanceId: generated, path: identityPath };
+  return { agentId: targetClientId, agentInstanceId: generated, path: identityPath };
 }
 
 async function readAgentInstanceIdentity(identityPath) {
@@ -2850,8 +2876,9 @@ function agentInstanceIdentityPath(env, clientId) {
 }
 
 function envReferenceIdentity(clientId) {
+  const targetClientId = (clientId === 'antigravity-ide' || clientId === 'antigravity2' || clientId === 'antigravity-cli') ? 'antigravity' : clientId;
   return {
-    agentId: clientId,
+    agentId: targetClientId,
     agentInstanceId: `\${${AGENT_INSTANCE_ENV_VAR}}`,
     path: `${AGENT_INSTANCE_ENV_VAR} environment variable`
   };
@@ -2921,7 +2948,7 @@ function defaultGeminiConfigPath(env) {
 
 function defaultAntigravityConfigPath(env) {
   const home = env.USERPROFILE || env.HOME || os.homedir();
-  return path.join(home, '.gemini', 'antigravity', 'mcp_config.json');
+  return path.join(home, '.gemini', 'config', 'mcp_config.json');
 }
 
 function defaultAntigravityIdeConfigPath(env) {
@@ -2931,12 +2958,12 @@ function defaultAntigravityIdeConfigPath(env) {
 
 function defaultAntigravity2ConfigPath(env) {
   const home = env.USERPROFILE || env.HOME || os.homedir();
-  return path.join(home, '.antigravity2', 'mcp.json');
+  return path.join(home, '.gemini', 'config', 'mcp_config.json');
 }
 
 function defaultAntigravityCliConfigPath(env) {
   const home = env.USERPROFILE || env.HOME || os.homedir();
-  return path.join(home, '.antigravity', 'settings.json');
+  return path.join(home, '.gemini', 'config', 'mcp_config.json');
 }
 
 function defaultCopilotConfigPath(env) {
@@ -3122,7 +3149,8 @@ async function runProcess(command, args, io, { stream = true } = {}) {
   const spawnFn = io.spawn ?? spawn;
   return await new Promise((resolve, reject) => {
     const child = spawnFn(command, args, {
-      stdio: ['ignore', 'pipe', 'pipe']
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: os.platform() === 'win32'
     });
     let stdout = '';
     let stderr = '';