aimeat 2.6.1 → 2.7.0

package/dist/src/cli/connect/clients/index.js

@@ -0,0 +1,148 @@
+/**
+ * @file index.ts
+ * @description `aimeat connect client <id>` — one command that points a chat client at this node:
+ *   it authorizes a dedicated agent into its own connector home, writes the client's MCP config,
+ *   and leaves a launcher that supplies the token at run time. The point is that talking to AIMEAT
+ *   from a client of your choice should be one command, not a page of manual steps.
+ * @structure
+ *   - CLIENTS — the adapter registry (goose, claude-code, cursor, vscode, claude-desktop).
+ *   - runConnectClient() — resolve client, ensure credential, apply adapter, report.
+ *   - resolveTarget() — flags + defaults into a ClientTarget (home, workdir, server name, surface).
+ * @usage Dispatched from src/index-connect.ts on `aimeat connect client <id> [flags]`.
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — Initial creation: one-command client connect.
+ */
+import { existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { gooseAdapter } from './goose.js';
+import { cursorAdapter, vscodeAdapter } from './cursor-vscode.js';
+import { claudeCodeAdapter, claudeDesktopAdapter } from './claude.js';
+export const CLIENTS = [
+    gooseAdapter, claudeCodeAdapter, cursorAdapter, vscodeAdapter, claudeDesktopAdapter,
+];
+const DEFAULT_NODE_URL = 'https://aimeat.io';
+const SURFACES = ['appdev', 'agent', 'service', 'admin'];
+/** Strip a trailing slash so `${nodeUrl}/v1/mcp` never doubles it. */
+function normalizeUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+/**
+ * Each client gets its OWN connector home holding exactly one agent. Two reasons, both learned the
+ * hard way: a home with two credentials makes every tool call demand an `agent_name`, and sharing a
+ * home with an existing fleet means one client's re-auth can disturb agents it knows nothing about.
+ */
+function defaultHome(clientId) {
+    return join(homedir(), `.aimeat-${clientId}`);
+}
+/** The agent writes files where it is launched, so give it somewhere that is not a source repo. */
+function defaultWorkdir() {
+    return join(homedir(), 'aimeat-work');
+}
+function tokenFileIn(home) {
+    const dir = join(home, 'tokens');
+    if (!existsSync(dir))
+        return null;
+    const file = readdirSync(dir).find((n) => n.endsWith('.token'));
+    return file ? join(dir, file) : null;
+}
+function resolveTarget(client, flags) {
+    const nodeUrl = normalizeUrl(flags.url ?? DEFAULT_NODE_URL);
+    const home = flags.home ?? defaultHome(client.id);
+    const agent = flags.agent ?? client.id;
+    const surface = SURFACES.includes(flags.surface)
+        ? flags.surface
+        : undefined;
+    return {
+        nodeUrl,
+        mcpUrl: `${nodeUrl}/v1/mcp`,
+        agent,
+        owner: flags.owner ?? '',
+        home,
+        tokenFile: tokenFileIn(home) ?? join(home, 'tokens', `${agent}@${flags.owner ?? 'owner'}.token`),
+        serverName: flags.name ?? 'aimeat',
+        workdir: flags.workdir ?? defaultWorkdir(),
+        surface,
+    };
+}
+function usage() {
+    const ids = CLIENTS.map((c) => c.id).join(' | ');
+    return [
+        `Usage: aimeat connect client <${ids}> [options]`,
+        '',
+        '  --url <node-url>     AIMEAT node (default https://aimeat.io)',
+        '  --owner <handle>     Your owner handle (prompted when omitted)',
+        '  --agent <name>       Agent name to create (default: the client id)',
+        '  --workdir <path>     Where the client starts (default ~/aimeat-work)',
+        '  --home <path>        Connector home for this client (default ~/.aimeat-<client>)',
+        '  --surface <role>     appdev | agent | service | admin (default: the full toolset)',
+        '  --name <server>      Name the MCP server gets in the client config (default: aimeat)',
+        '  --reuse              Skip device authorization and use the credential already in --home',
+    ].join('\n');
+}
+/**
+ * Run the one-command connect. Device authorization happens FIRST and inside the client's own
+ * home, so a failed or cancelled login never leaves a config pointing at an agent that does not
+ * exist.
+ */
+export async function runConnectClient(clientId, flags) {
+    if (!clientId || clientId === 'help' || flags.help === 'true') {
+        console.log(usage());
+        return;
+    }
+    const client = CLIENTS.find((c) => c.id === clientId);
+    if (!client) {
+        console.error(`Unknown client "${clientId}".`);
+        console.error(usage());
+        process.exit(1);
+    }
+    const target = resolveTarget(client, flags);
+    if (!existsSync(target.home))
+        mkdirSync(target.home, { recursive: true });
+    // config.ts captures AIMEAT_HOME at module load, so it must be set before anything under
+    // connect/ is imported — hence the dynamic imports below.
+    process.env.AIMEAT_HOME = target.home;
+    const existingToken = tokenFileIn(target.home);
+    if (existingToken && flags.reuse !== 'true') {
+        console.log(`An agent credential already exists in ${target.home}.`);
+        console.log('Reusing it. Pass --reuse to silence this, or --home <path> to authorize a separate one.\n');
+    }
+    if (!existingToken) {
+        const { runAuth } = await import('../auth.js');
+        await runAuth({ url: target.nodeUrl, owner: flags.owner, agent: target.agent });
+    }
+    const token = tokenFileIn(target.home);
+    if (!token) {
+        console.error('\nNo credential was stored, so nothing was written to the client config.');
+        console.error('Re-run once the device authorization completes.');
+        process.exit(1);
+    }
+    target.tokenFile = token;
+    // `{agent}@{owner}.token` — split on the FIRST '@' so an owner handle containing one survives.
+    const stem = token.split(/[\\/]/).pop().replace(/\.token$/, '');
+    const at = stem.indexOf('@');
+    if (at > 0) {
+        target.agent = stem.slice(0, at);
+        target.owner = stem.slice(at + 1);
+    }
+    const result = await client.apply(target);
+    console.log('');
+    console.log(`${client.label} is connected to ${target.nodeUrl} as ${target.agent}@${target.owner}.`);
+    console.log(`  MCP endpoint : ${client.transport === 'http' ? target.mcpUrl : 'local connector (stdio)'}`);
+    console.log(`  Tool surface : ${target.surface ?? 'full'}`);
+    console.log(`  Working dir  : ${target.workdir}`);
+    for (const f of result.written)
+        console.log(`  wrote        : ${f}`);
+    for (const b of result.backedUp)
+        console.log(`  backup       : ${b}`);
+    if (result.manual) {
+        console.log('');
+        console.log(result.manual);
+    }
+    if (result.nextSteps.length) {
+        console.log('');
+        for (const line of result.nextSteps)
+            console.log(`  ${line}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/src/cli/connect/clients/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cli/connect/clients/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,CAAC,MAAM,OAAO,GAAoB;IACpC,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB;CACtF,CAAC;AAEF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAElE,sEAAsE;AACtE,SAAS,YAAY,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc;IACnB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB,EAAE,KAA6B;IACvE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAkC,CAAC;QACvE,CAAC,CAAC,KAAK,CAAC,OAAkC;QAC1C,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACH,OAAO;QACP,MAAM,EAAE,GAAG,OAAO,SAAS;QAC3B,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,IAAI;QACJ,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC;QAChG,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,cAAc,EAAE;QAC1C,OAAO;KACV,CAAC;AACN,CAAC;AAED,SAAS,KAAK;IACV,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO;QACH,iCAAiC,GAAG,aAAa;QACjD,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,oFAAoF;QACpF,qFAAqF;QACrF,wFAAwF;QACxF,2FAA2F;KAC9F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAA4B,EAAE,KAA6B;IAC9F,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrB,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,mBAAmB,QAAQ,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,yFAAyF;IACzF,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;IAEtC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,yCAAyC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,+FAA+F;IAC/F,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAEpF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,oBAAoB,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IACnE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;AACL,CAAC"}

package/dist/src/cli/connect/clients/launcher.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @file launcher.ts
+ * @description Generates the two small scripts a connected client needs, so a token never has to
+ *   live inside a config file: a LAUNCHER that exports the agent token and starts the client in a
+ *   sane working directory, and a HEADERS HELPER that prints an Authorization header on stdout for
+ *   clients that can call one (Claude Code's `headersHelper`).
+ * @structure
+ *   - writeLauncher() — `<home>/launch-<client>.ps1` + `.sh`, chmod +x on POSIX.
+ *   - writeHeadersHelper() — `<home>/auth-header.ps1` + `.sh`, prints `Authorization: Bearer <token>`.
+ * @usage Called by clients/*.ts via the shared connect flow.
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — Initial creation: one-command client connect.
+ */
+import type { ClientTarget } from './types.js';
+/**
+ * Write the launcher pair for one client. The launcher reads the token from the connector home at
+ * run time (so a re-authenticated agent is picked up with no config edit), sets the working
+ * directory, and execs the client's own command.
+ *
+ * Returns the path of the script that is actually usable on this platform first.
+ */
+export declare function writeLauncher(target: ClientTarget, clientId: string, command: string, args?: string[]): string[];
+/**
+ * Write the headers-helper pair. Claude Code runs this at connection time and merges its stdout
+ * into the request headers, which keeps the token out of ~/.claude.json entirely and picks up a
+ * refreshed token automatically.
+ */
+export declare function writeHeadersHelper(target: ClientTarget): {
+    ps1: string;
+    sh: string;
+    preferred: string;
+};
+//# sourceMappingURL=launcher.d.ts.map

package/dist/src/cli/connect/clients/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../../../../../src/cli/connect/clients/launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAsCpH;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAwBvG"}

package/dist/src/cli/connect/clients/launcher.js

@@ -0,0 +1,94 @@
+/**
+ * @file launcher.ts
+ * @description Generates the two small scripts a connected client needs, so a token never has to
+ *   live inside a config file: a LAUNCHER that exports the agent token and starts the client in a
+ *   sane working directory, and a HEADERS HELPER that prints an Authorization header on stdout for
+ *   clients that can call one (Claude Code's `headersHelper`).
+ * @structure
+ *   - writeLauncher() — `<home>/launch-<client>.ps1` + `.sh`, chmod +x on POSIX.
+ *   - writeHeadersHelper() — `<home>/auth-header.ps1` + `.sh`, prints `Authorization: Bearer <token>`.
+ * @usage Called by clients/*.ts via the shared connect flow.
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — Initial creation: one-command client connect.
+ */
+import { chmodSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** True on Windows, where the .ps1 variant is the one that gets used. */
+const isWindows = process.platform === 'win32';
+/**
+ * Write the launcher pair for one client. The launcher reads the token from the connector home at
+ * run time (so a re-authenticated agent is picked up with no config edit), sets the working
+ * directory, and execs the client's own command.
+ *
+ * Returns the path of the script that is actually usable on this platform first.
+ */
+export function writeLauncher(target, clientId, command, args = []) {
+    const argLine = args.length ? ` ${args.join(' ')}` : '';
+    const ps1 = join(target.home, `launch-${clientId}.ps1`);
+    const sh = join(target.home, `launch-${clientId}.sh`);
+    writeFileSync(ps1, [
+        `# Starts ${clientId} with the AIMEAT agent "${target.agent}@${target.owner}" attached.`,
+        `# Generated by: aimeat connect client ${clientId}`,
+        `$ErrorActionPreference = 'Stop'`,
+        `$env:AIMEAT_HOME = '${target.home}'`,
+        `$tokenFile = '${target.tokenFile}'`,
+        `if (-not (Test-Path $tokenFile)) { Write-Error "No token at $tokenFile. Run: aimeat connect client ${clientId}"; exit 1 }`,
+        `$env:AIMEAT_AGENT_TOKEN = (Get-Content $tokenFile -Raw).Trim()`,
+        `$workdir = '${target.workdir}'`,
+        `if (-not (Test-Path $workdir)) { New-Item -ItemType Directory -Force $workdir | Out-Null }`,
+        `Set-Location $workdir`,
+        `${command}${argLine} @args`,
+        '',
+    ].join('\r\n'), 'utf8');
+    writeFileSync(sh, [
+        '#!/usr/bin/env bash',
+        `# Starts ${clientId} with the AIMEAT agent "${target.agent}@${target.owner}" attached.`,
+        `# Generated by: aimeat connect client ${clientId}`,
+        'set -euo pipefail',
+        `export AIMEAT_HOME="${target.home.replace(/\\/g, '/')}"`,
+        `TOKEN_FILE="${target.tokenFile.replace(/\\/g, '/')}"`,
+        `[ -f "$TOKEN_FILE" ] || { echo "No token at $TOKEN_FILE. Run: aimeat connect client ${clientId}" >&2; exit 1; }`,
+        'export AIMEAT_AGENT_TOKEN="$(tr -d "\\r\\n" < "$TOKEN_FILE")"',
+        `mkdir -p "${target.workdir.replace(/\\/g, '/')}"`,
+        `cd "${target.workdir.replace(/\\/g, '/')}"`,
+        `exec ${command}${argLine} "$@"`,
+        '',
+    ].join('\n'), 'utf8');
+    // eslint-disable-next-line aimeat/no-silent-catch -- Windows has no exec bit; the .ps1 is the usable script there and a failed chmod changes nothing.
+    try {
+        chmodSync(sh, 0o755);
+    }
+    catch { /* no exec bit on this platform */ }
+    return isWindows ? [ps1, sh] : [sh, ps1];
+}
+/**
+ * Write the headers-helper pair. Claude Code runs this at connection time and merges its stdout
+ * into the request headers, which keeps the token out of ~/.claude.json entirely and picks up a
+ * refreshed token automatically.
+ */
+export function writeHeadersHelper(target) {
+    const ps1 = join(target.home, 'auth-header.ps1');
+    const sh = join(target.home, 'auth-header.sh');
+    writeFileSync(ps1, [
+        '# Prints the AIMEAT Authorization header for an MCP client that asks for one.',
+        '# Generated by: aimeat connect client',
+        `$t = (Get-Content '${target.tokenFile}' -Raw).Trim()`,
+        `Write-Output "Authorization: Bearer $t"`,
+        '',
+    ].join('\r\n'), 'utf8');
+    writeFileSync(sh, [
+        '#!/usr/bin/env bash',
+        '# Prints the AIMEAT Authorization header for an MCP client that asks for one.',
+        '# Generated by: aimeat connect client',
+        'set -euo pipefail',
+        `echo "Authorization: Bearer $(tr -d '\\r\\n' < "${target.tokenFile.replace(/\\/g, '/')}")"`,
+        '',
+    ].join('\n'), 'utf8');
+    // eslint-disable-next-line aimeat/no-silent-catch -- same as above: no exec bit on Windows, the .ps1 variant is what gets used.
+    try {
+        chmodSync(sh, 0o755);
+    }
+    catch { /* no exec bit on this platform */ }
+    return { ps1, sh, preferred: isWindows ? ps1 : sh };
+}
+//# sourceMappingURL=launcher.js.map

package/dist/src/cli/connect/clients/launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../../../../src/cli/connect/clients/launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,yEAAyE;AACzE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,QAAgB,EAAE,OAAe,EAAE,OAAiB,EAAE;IACtG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,KAAK,CAAC,CAAC;IAEtD,aAAa,CAAC,GAAG,EAAE;QACf,YAAY,QAAQ,2BAA2B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,aAAa;QACxF,yCAAyC,QAAQ,EAAE;QACnD,iCAAiC;QACjC,uBAAuB,MAAM,CAAC,IAAI,GAAG;QACrC,iBAAiB,MAAM,CAAC,SAAS,GAAG;QACpC,sGAAsG,QAAQ,aAAa;QAC3H,gEAAgE;QAChE,eAAe,MAAM,CAAC,OAAO,GAAG;QAChC,4FAA4F;QAC5F,uBAAuB;QACvB,GAAG,OAAO,GAAG,OAAO,QAAQ;QAC5B,EAAE;KACL,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAExB,aAAa,CAAC,EAAE,EAAE;QACd,qBAAqB;QACrB,YAAY,QAAQ,2BAA2B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,aAAa;QACxF,yCAAyC,QAAQ,EAAE;QACnD,mBAAmB;QACnB,uBAAuB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG;QACzD,eAAe,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG;QACtD,uFAAuF,QAAQ,kBAAkB;QACjH,+DAA+D;QAC/D,aAAa,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG;QAClD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG;QAC5C,QAAQ,OAAO,GAAG,OAAO,OAAO;QAChC,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAEtB,sJAAsJ;IACtJ,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAE/C,aAAa,CAAC,GAAG,EAAE;QACf,+EAA+E;QAC/E,uCAAuC;QACvC,sBAAsB,MAAM,CAAC,SAAS,gBAAgB;QACtD,yCAAyC;QACzC,EAAE;KACL,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAExB,aAAa,CAAC,EAAE,EAAE;QACd,qBAAqB;QACrB,+EAA+E;QAC/E,uCAAuC;QACvC,mBAAmB;QACnB,mDAAmD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK;QAC5F,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAEtB,gIAAgI;IAChI,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IAC1E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxD,CAAC"}

package/dist/src/cli/connect/clients/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @file types.ts
+ * @description Shared contract for `aimeat connect client <id>` — the one command that points a
+ *   chat client (Goose, Claude Code, Cursor, VS Code, Claude Desktop) at this node's MCP surface.
+ *   Each client is one adapter: where its config lives, how an MCP server is spelled in it, and how
+ *   its user launches it afterwards.
+ * @structure
+ *   - ClientTarget — the resolved node + agent a client is being pointed at.
+ *   - WriteResult — what the adapter did, so the caller can report it truthfully.
+ *   - ClientAdapter — the per-client contract (id, label, configPath, apply, launchHint).
+ * @usage Implemented by clients/goose.ts, claude-code.ts, cursor.ts, vscode.ts, claude-desktop.ts.
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — Initial creation: one-command client connect.
+ */
+/** The node + agent identity a client is being connected to. */
+export interface ClientTarget {
+    /** Node base URL, e.g. `https://aimeat.io` (no trailing slash). */
+    nodeUrl: string;
+    /** Streamable-HTTP MCP endpoint, e.g. `https://aimeat.io/v1/mcp`. */
+    mcpUrl: string;
+    /** Agent name inside the dedicated connector home, e.g. `goose`. */
+    agent: string;
+    /** Owner handle the agent belongs to. */
+    owner: string;
+    /** Dedicated connector home holding exactly this one agent's credential. */
+    home: string;
+    /** Absolute path to the agent's token file inside `home`. */
+    tokenFile: string;
+    /**
+     * Name the MCP server gets in the client's config. Defaults to `aimeat`; a second node
+     * is connected as `aimeat-<something>` so the two never overwrite each other.
+     */
+    serverName: string;
+    /** Working directory the client should start in (agents write files where they are launched). */
+    workdir: string;
+    /** Optional purpose-scoped surface. Undefined = the full toolset. */
+    surface?: 'appdev' | 'agent' | 'service' | 'admin';
+}
+/** What an adapter actually did — the caller reports these, it never assumes. */
+export interface WriteResult {
+    /** Files created or modified, absolute paths. */
+    written: string[];
+    /** Backup copies taken before modifying an existing file. */
+    backedUp: string[];
+    /** Lines to print under "next steps", already client-specific. */
+    nextSteps: string[];
+    /** Set when the adapter could not write and the user must act manually. */
+    manual?: string;
+}
+/** One chat client's integration. */
+export interface ClientAdapter {
+    /** Stable id used on the command line, e.g. `goose`. */
+    id: string;
+    /** Human label for output, e.g. `Goose`. */
+    label: string;
+    /** Transport this client uses to reach the node. */
+    transport: 'http' | 'stdio';
+    /** Where this client keeps the config we edit, on the current platform. */
+    configPath(): string;
+    /** Point the client at the node. Must merge, never clobber other servers. */
+    apply(target: ClientTarget): Promise<WriteResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/cli/connect/clients/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/cli/connect/clients/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,gEAAgE;AAChE,MAAM,WAAW,YAAY;IACzB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;CACtD;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IACxB,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC1B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,UAAU,IAAI,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACrD"}

package/dist/src/cli/connect/clients/types.js

@@ -0,0 +1,16 @@
+/**
+ * @file types.ts
+ * @description Shared contract for `aimeat connect client <id>` — the one command that points a
+ *   chat client (Goose, Claude Code, Cursor, VS Code, Claude Desktop) at this node's MCP surface.
+ *   Each client is one adapter: where its config lives, how an MCP server is spelled in it, and how
+ *   its user launches it afterwards.
+ * @structure
+ *   - ClientTarget — the resolved node + agent a client is being pointed at.
+ *   - WriteResult — what the adapter did, so the caller can report it truthfully.
+ *   - ClientAdapter — the per-client contract (id, label, configPath, apply, launchHint).
+ * @usage Implemented by clients/goose.ts, claude-code.ts, cursor.ts, vscode.ts, claude-desktop.ts.
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — Initial creation: one-command client connect.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/cli/connect/clients/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/cli/connect/clients/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/src/generated/api-types.d.ts

@@ -2321,6 +2321,7 @@ export interface paths {
          * @description PROVENANCE VISIBILITY FOLLOWS THE CONTENT. A record resolves for anyone - anonymous callers included - exactly while some item pointing at it is itself publicly readable: a public memory record (which is how workspace records, agent faces and WebMCP manifests are stored too) or a published, unparked, unhidden, code-free app. Publish the content and the record resolves; make it private again and this returns to the identical 404, with nothing to remember to do. There is no stored visibility flag on the record and no way for a caller to set one. The owner can always resolve their own records.
          *     Returns an IDENTICAL 404 for "no such record", "that record is not yours" and "its content is not public" - different answers would turn this into an oracle for which ids exist on this node.
          *     `AIMEAT_AI_PROVENANCE_DETAIL=minimal` reduces what a NON-owner is served to the four required fields plus the disclosure block. It never reduces what is stored, and the owner always sees the whole record.
+         *     CONTENT NEGOTIATED. A visible AI label's "how this was made" link lands here, so a PERSON arrives at this URL. A client that ranks `text/html` above `application/json` - a browser - gets a readable page carrying the record's own disclosure sentence, its fields, the content fingerprint and the correction route. Everything else, including curl, `fetch()` and agents, gets the JSON below unchanged. The 404 is identical in both formats for the same three cases; the HTML variant takes no argument about the record and so has nothing to differ on.
          */
         get: operations["aiProvenanceResolve"];
         put?: never;
@@ -15008,6 +15009,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/connections/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Publish to a connected account
+         * @description Two ways in. `connection_id` publishes to an account the CALLER connected, which needs no delegation because the publisher and the account holder are the same person. `app_id` + `action` publishes through a delegation an app owner granted over a shared channel.
+         *
+         *     The attempt is recorded BEFORE anything leaves the node, keyed by a hash of publisher, connection, file and caption. A repeat of the same request returns the FIRST attempt's outcome with `replay: true` and starts no second publish.
+         *
+         *     Two 200 responses are waiting states rather than successes: `held` is moderation and `queued` is a spent provider allowance. Neither is an error, because reporting them as one teaches a caller to retry, and retrying makes both worse.
+         */
+        post: operations["publishToConnection"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/connections/callback": {
         parameters: {
             query?: never;
@@ -18782,6 +18807,10 @@ export interface components {
             provider?: string;
             /** @description For synthesized content, where the material came from. */
             sources?: {
+                /**
+                 * Format: uri
+                 * @description http or https ONLY, checked at the door. A declaration carrying any other scheme is refused with a validation error rather than minted.
+                 */
                 url: string;
                 title?: string;
                 /** Format: date-time */
@@ -18840,7 +18869,10 @@ export interface components {
                 upstreamMarks?: "yes" | "no" | "unknown";
             };
             sources?: {
-                /** Format: uri */
+                /**
+                 * Format: uri
+                 * @description http or https ONLY. Zod's URL validation accepts `javascript:` and `data:` because they parse, so the scheme is checked separately. A source is a place a reader can go and look.
+                 */
                 url: string;
                 title?: string;
                 /** Format: date-time */
@@ -18860,8 +18892,17 @@ export interface components {
             /** @description Computed by the node, never hand-written by a caller. */
             disclosure?: {
                 required: boolean;
-                /** @enum {string} */
-                reason: "art50_1_interaction" | "art50_2_synthetic_output" | "art50_4_deepfake" | "art50_4_public_interest" | "policy" | "none";
+                /**
+                 * @description Why a visible disclosure is (or is not) owed. Three of these are easy to confuse:
+                 *
+                 *     `art50_4_public_interest` — the content IS stated to inform the public on a matter of public interest, so Article 50(4)'s text limb applies.
+                 *
+                 *     `art50_4_precautionary` — nobody stated whether it is. The node labels anyway (over-labelling is the safe direction), but the record does not borrow a statutory basis to justify a precaution.
+                 *
+                 *     `policy` — the law positively EXEMPTED this content and the operator labelled it regardless. Distinct from `precautionary`, where applicability was never established rather than decided.
+                 * @enum {string}
+                 */
+                reason: "art50_1_interaction" | "art50_2_synthetic_output" | "art50_4_deepfake" | "art50_4_public_interest" | "art50_4_precautionary" | "policy" | "none";
                 short: {
                     [key: string]: string;
                 };
@@ -47412,6 +47453,79 @@ export interface operations {
             };
         };
     };
+    publishToConnection: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Publish to your own connected account. Mutually exclusive with app_id. */
+                    connection_id?: string;
+                    /** @description With `action`, publish through a delegation over someone's shared channel. */
+                    app_id?: string;
+                    /** @example publish-video */
+                    action?: string;
+                    /** @description A file you have in storage. Omit for a text-only post. */
+                    storage_key?: string;
+                    caption?: string;
+                    /** @description Provider options (title, description, visibility, privacyStatus, alt). A delegation's fixed values are merged OVER these, so a delegated app cannot retarget what the channel owner decided. */
+                    params?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Published, replayed, held for moderation, or queued behind a full allowance. Check `attempt.status` and `replay` rather than the status code. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            /** @description Where it landed at the provider. Absent when nothing was published. */
+                            url?: string;
+                            replay?: boolean;
+                            attempt?: {
+                                id?: string;
+                                /** @enum {string} */
+                                status?: "in_flight" | "held" | "queued" | "done" | "failed" | "rejected";
+                                externalRef?: string | null;
+                                error?: string | null;
+                            };
+                        };
+                    };
+                };
+            };
+            /** @description The gate refused: no delegation, the delegation is disabled, a per-publisher cap is spent, or the account needs reconnecting. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description No such connection, or no such stored file. A connection belonging to someone else is this same 404. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The provider refused. `REJECTED` is permanent and must not be retried; `PUBLISH_FAILED` is transport-shaped and may be. */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     connectionCallback: {
         parameters: {
             query?: {