amorphous-cli 0.1.7 → 0.1.9

package/README.md

@@ -1,6 +1,6 @@
 # amorphous-cli
 
-Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.
+Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users.
 
 ```bash
 npx amorphous-cli@latest setup

package/hooks/session-start.mjs

@@ -48,7 +48,7 @@ if (target === 'cursor') {
   process.stdout.write(
     `${JSON.stringify({
       additional_context:
-        'The Amorphous skill on this machine was just updated. Read ~/.agents/skills/amorphous/SKILL.md and follow it. Invoke the CLI as npx amorphous-cli@latest.',
+        'The Amorphous skill on this machine was just updated. Read ~/.agents/skills/amorphous/SKILL.md and follow it. Install the CLI with npm install -g amorphous-cli@latest and invoke it as amorphous-cli.',
     })}\n`,
   )
 } else {

package/lib/agent-contract.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { homedir } from 'node:os'
 import { CLI_VERSION } from './version.mjs'
 
-export const CONTRACT_VERSION = 7
+export const CONTRACT_VERSION = 10
 
 const skillRoot = join(dirname(fileURLToPath(import.meta.url)), '../skill/amorphous')
 

package/lib/api.mjs

@@ -2,24 +2,24 @@ import { cliAppFetchOrigin, cliAppHostHeader } from './config.mjs'
 import { ensureFreshSession } from './session.mjs'
 
 const FRIENDLY = {
-  'You already own 2 abstracts': 'You already own 2 abstracts. Run: npx amorphous-cli@latest list',
-  'This abstract already has 8 people': 'This abstract already has 8 people. Run: npx amorphous-cli@latest people',
+  'You already own 2 abstracts': 'You already own 2 abstracts. Run: amorphous-cli list',
+  'This abstract already has 8 people': 'This abstract already has 8 people. Run: amorphous-cli people',
   'User not found': 'No account with that email yet.',
-  'Grant failed': 'Could not invite. Run: npx amorphous-cli@latest people',
-  'Cannot revoke owner': "You can't remove the owner. Run: npx amorphous-cli@latest people",
-  'Cannot remove yourself': "You can't remove yourself. Run: npx amorphous-cli@latest people",
-  'Collection not found': 'Folder not found. Run: npx amorphous-cli@latest folder list',
-  Forbidden: "You don't have access. Run: npx amorphous-cli@latest list",
-  'Not Found': 'Not found. Run: npx amorphous-cli@latest list',
-  'Owner required': 'Only the owner can do that. Run: npx amorphous-cli@latest people',
-  'id required': 'Missing id. Run: npx amorphous-cli@latest list',
-  'userId required': 'Pass an email or id. Run: npx amorphous-cli@latest people',
-  'Invalid body': 'Invalid request. Run: npx amorphous-cli@latest pull',
-  'Name required': 'Name required. Run: npx amorphous-cli@latest rename --name <name>',
-  'Create failed': 'Could not create the abstract. Run: npx amorphous-cli@latest list',
-  'Publish failed': 'Could not publish. Run: npx amorphous-cli@latest push',
-  'File too large': 'That file is too large. Run: npx amorphous-cli@latest pull',
-  'Not logged in. Run: amorphous login <email>': 'Not signed in. Run: npx amorphous-cli@latest login',
+  'Grant failed': 'Could not invite. Run: amorphous-cli people',
+  'Cannot revoke owner': "You can't remove the owner. Run: amorphous-cli people",
+  'Cannot remove yourself': "You can't remove yourself. Run: amorphous-cli people",
+  'Collection not found': 'Folder not found. Run: amorphous-cli folder list',
+  Forbidden: "You don't have access. Run: amorphous-cli list",
+  'Not Found': 'Not found. Run: amorphous-cli list',
+  'Owner required': 'Only the owner can do that. Run: amorphous-cli people',
+  'id required': 'Missing id. Run: amorphous-cli list',
+  'userId required': 'Pass an email or id. Run: amorphous-cli people',
+  'Invalid body': 'Invalid request. Run: amorphous-cli pull',
+  'Name required': 'Name required. Run: amorphous-cli rename --name <name>',
+  'Create failed': 'Could not create the abstract. Run: amorphous-cli list',
+  'Publish failed': 'Could not publish. Run: amorphous-cli push',
+  'File too large': 'That file is too large. Run: amorphous-cli pull',
+  'Not logged in. Run: amorphous login <email>': 'Not signed in. Run: amorphous-cli login',
 }
 
 export function friendlyMessage(raw) {

package/lib/commands.mjs

@@ -7,6 +7,7 @@ import { homedir } from 'node:os'
 import { apiFetch } from './api.mjs'
 import { abstractsOrigin, appOrigin, projectMetaPath } from './config.mjs'
 import { recordsFromLocal, readProjectFiles, writeProjectFiles } from './files.mjs'
+import { startServe } from './serve.mjs'
 import { ALIASES, printHelp, wantsHelp } from './help.mjs'
 import { loginWithBrowser, loginWithMagicLink } from './login.mjs'
 
@@ -23,6 +24,7 @@ const BOOL_FLAGS = new Set([
   'open',
   'closed',
   'quiet',
+  'data',
 ])
 
 function parseFlags(args) {
@@ -75,7 +77,7 @@ function writeMeta(cwd, abstractId) {
 function requireMeta(cwd) {
   const meta = readMeta(cwd)
   if (!meta?.abstractId) {
-    throw new Error('No .amorphous.json here. Run npx amorphous-cli@latest create first.')
+    throw new Error('No .amorphous.json here. Run amorphous-cli create first.')
   }
   return meta.abstractId
 }
@@ -330,20 +332,45 @@ async function cmdPush(cwd, rest) {
   const { flags } = parseFlags(rest)
   if (flags.help) return printHelp('push')
   const id = requireMeta(cwd)
-  const localRecords = recordsFromLocal(cwd)
-  const { refused } = await apiFetch(`/api/abstracts/${id}/records`, {
-    method: 'POST',
-    body: JSON.stringify({ records: localRecords }),
-  })
-  if (refused?.length) {
-    console.error(`Skipped (already live): ${refused.join(', ')}. Run: npx amorphous-cli@latest pull`)
+  if (flags.data) {
+    const localRecords = recordsFromLocal(cwd)
+    const { refused } = await apiFetch(`/api/abstracts/${id}/records`, {
+      method: 'POST',
+      body: JSON.stringify({ records: localRecords }),
+    })
+    if (refused?.length) {
+      console.error(`Skipped (already live): ${refused.join(', ')}. Run: amorphous-cli pull`)
+    }
   }
   const { html, css, js } = readProjectFiles(cwd)
   await apiFetch(`/api/abstracts/${id}/push`, {
     method: 'POST',
     body: JSON.stringify({ html, css, js }),
   })
-  console.log('Pushed.')
+  console.log(flags.data ? 'Pushed source and records.' : 'Pushed source.')
+}
+
+async function cmdServe(cwd, rest) {
+  const { flags } = parseFlags(rest)
+  if (flags.help) return printHelp('serve')
+  const id = requireMeta(cwd)
+  const port = flags.port ? Number(flags.port) : 0
+  if (flags.port && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+    throw new Error('Use --port <number>.')
+  }
+  const running = await startServe({
+    cwd,
+    abstractId: id,
+    port,
+    json: jsonMode(flags),
+  })
+  await new Promise((resolve) => {
+    const stop = () => {
+      running.close().then(resolve, resolve)
+    }
+    process.once('SIGINT', stop)
+    process.once('SIGTERM', stop)
+  })
 }
 
 function urlsFor(id) {
@@ -737,6 +764,8 @@ export async function runCommand(argv, cwd = process.cwd()) {
       return cmdOpen(cwd, rest)
     case 'preview':
       return cmdPreview(cwd, rest)
+    case 'serve':
+      return cmdServe(cwd, rest)
     case 'publish':
       return cmdPublish(cwd, rest)
     case 'live':
@@ -770,6 +799,6 @@ export async function runCommand(argv, cwd = process.cwd()) {
       if (rest[0] === 'member') return cmdSpaceMember(rest.slice(1))
       throw new Error('Use folder instead.')
     default:
-      throw new Error(`Unknown command “${raw}”. Run npx amorphous-cli@latest --help.`)
+      throw new Error(`Unknown command “${raw}”. Run amorphous-cli --help.`)
   }
 }

package/lib/config.mjs

@@ -72,6 +72,36 @@ export function abstractsOrigin() {
   return process.env.ABSTRACTS_ORIGIN || HOSTED.abstractsOrigin
 }
 
+/** Local Herd HTTPS: hit Nuxt on loopback with the abstracts Host header (no TLS). */
+export function cliAbstractsFetchOrigin() {
+  if (process.env.AMORPHOUS_CLI_ABSTRACTS_URL) {
+    return process.env.AMORPHOUS_CLI_ABSTRACTS_URL.replace(/\/$/, '')
+  }
+  const origin = abstractsOrigin()
+  try {
+    const u = new URL(origin)
+    if (u.protocol === 'https:' && (u.hostname.endsWith('.test') || u.hostname === 'localhost')) {
+      const port = process.env.AMORPHOUS_DEV_PORT || '3847'
+      return `http://127.0.0.1:${port}`
+    }
+  } catch {
+    /* ignore */
+  }
+  return origin.replace(/\/$/, '')
+}
+
+export function cliAbstractsHostHeader() {
+  const origin = abstractsOrigin()
+  const fetchOrigin = cliAbstractsFetchOrigin()
+  if (!fetchOrigin.startsWith('http://127.0.0.1')) return {}
+  try {
+    const u = new URL(origin)
+    return { Host: u.host }
+  } catch {
+    return {}
+  }
+}
+
 export function supabaseUrl() {
   return process.env.SUPABASE_URL || HOSTED.supabaseUrl
 }

package/lib/files.mjs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 
@@ -47,4 +48,45 @@ export function recordsFromLocal(cwd) {
   ]
 }
 
+export function writeLocalRecords(cwd, rows) {
+  writeNdjson(
+    join(cwd, 'data.ndjson'),
+    rows.filter((r) => r.visibility !== 'private'),
+  )
+  writeNdjson(
+    join(cwd, 'private.ndjson'),
+    rows.filter((r) => r.visibility === 'private'),
+  )
+}
+
+export function insertLocalRecord(cwd, row) {
+  const body = { ...(row && typeof row === 'object' ? row : {}) }
+  if (body.visibility && body.visibility !== 'shared' && body.visibility !== 'private') {
+    return { status: 400, message: 'Invalid visibility' }
+  }
+  body.visibility = body.visibility === 'private' ? 'private' : 'shared'
+  if (!body.id) body.id = randomUUID()
+  const rows = recordsFromLocal(cwd)
+  if (rows.some((r) => r.id === body.id)) return { status: 409, message: 'Conflict' }
+  rows.push(body)
+  writeLocalRecords(cwd, rows)
+  return { status: 200, row: body }
+}
+
+export function replaceLocalRecord(cwd, id, row) {
+  const rows = recordsFromLocal(cwd)
+  const index = rows.findIndex((r) => r.id === id)
+  if (index < 0) return { status: 404, message: 'Not Found' }
+  const existing = rows[index]
+  const next = {
+    ...(existing && typeof existing === 'object' ? existing : {}),
+    ...(row && typeof row === 'object' ? row : {}),
+    id,
+    visibility: existing.visibility,
+  }
+  rows[index] = next
+  writeLocalRecords(cwd, rows)
+  return { status: 200, row: next }
+}
+
 export { FILES }

package/lib/help.mjs

@@ -7,6 +7,7 @@ export const ROOT_HELP = `Amorphous
   create                        New abstract
   open [abstract]               Open URL
   preview [abstract]            Preview URL (draft)
+  serve                         Serve this folder locally
   pull                          Pull draft and records to this folder
   push                          Push local files
   publish [--live]              Publish a version; --live is Go live
@@ -28,7 +29,7 @@ export const ROOT_HELP = `Amorphous
   folder people                 People on a folder
   rename --name                 Rename
 
-Run npx amorphous-cli@latest <command> --help for flags. Pass --json where you need machine output.
+Run amorphous-cli <command> --help for flags. Pass --json where you need machine output.
 `
 
 export const COMMAND_HELP = {
@@ -64,13 +65,19 @@ Print the Open URL.`,
 
 Print the Preview URL (draft).`,
 
+  serve: `serve [--port <n>] [--json]
+
+Serve this folder on 127.0.0.1 and reload when index.html, styles.css, or app.js changes.
+Records start local, in this folder. The page can switch to prod, which reads and writes the abstract's records.`,
+
   pull: `pull
 
 Pull the draft and records into this directory.`,
 
-  push: `push
+  push: `push [--data]
 
-Push local index.html, styles.css, app.js, and records.`,
+Push local index.html, styles.css, and app.js.
+--data also merges records from this folder. A record changed both here and on the abstract is refused.`,
 
   publish: `publish [--live]
 

package/lib/login.mjs

@@ -70,7 +70,7 @@ async function loginViaMailpit(supabase, email, redirectTo, sinceMs) {
 async function readCode(email) {
   if (!process.stdin.isTTY) {
     throw new Error(
-      `Code sent to ${email}. Read it from that inbox, then run: npx amorphous-cli@latest login ${email} --code <code>`,
+      `Code sent to ${email}. Read it from that inbox, then run: amorphous-cli login ${email} --code <code>`,
     )
   }
   const rl = createInterface({ input: process.stdin, output: process.stderr })

package/lib/serve.mjs

@@ -0,0 +1,360 @@
+import { createServer } from 'node:http'
+import { existsSync, readFileSync, watch } from 'node:fs'
+import { join } from 'node:path'
+import { apiFetch } from './api.mjs'
+import { cliAbstractsFetchOrigin, cliAbstractsHostHeader } from './config.mjs'
+import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord } from './files.mjs'
+
+const BAR_CSS = `#amorphous-serve{position:fixed;z-index:2147483646;left:12px;bottom:12px;display:flex;gap:6px;align-items:center;padding:4px 6px 4px 10px;border-radius:999px;background:#18181b;color:#fff;font:500 12px/1 system-ui,-apple-system,sans-serif}
+#amorphous-serve button{border:0;border-radius:999px;padding:4px 8px;font:inherit;color:#a1a1aa;background:transparent;cursor:pointer}
+#amorphous-serve button[aria-pressed="true"]{background:#fff;color:#18181b}`
+
+function stripScriptTags(html) {
+  return String(html || '').replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+}
+
+function readCookie(req, name) {
+  const raw = req.headers.cookie || ''
+  const match = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(raw)
+  return match ? decodeURIComponent(match[1]) : ''
+}
+
+function recordsMode(req, url) {
+  const query = url.searchParams.get('records')
+  if (query === 'prod' || query === 'local') return query
+  const cookie = readCookie(req, 'amorphous_records')
+  return cookie === 'prod' ? 'prod' : 'local'
+}
+
+async function readJson(req) {
+  const chunks = []
+  for await (const chunk of req) chunks.push(chunk)
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (!text) return {}
+  return JSON.parse(text)
+}
+
+function send(res, status, body, headers = {}) {
+  const payload = body == null ? '' : typeof body === 'string' ? body : JSON.stringify(body)
+  res.writeHead(status, {
+    'Cache-Control': 'no-store',
+    ...headers,
+    ...(payload && typeof body !== 'string' ? { 'Content-Type': 'application/json; charset=utf-8' } : {}),
+  })
+  res.end(payload)
+}
+
+function pageHtml(html, mode) {
+  const pressed = (value) => (mode === value ? ' aria-pressed="true"' : '')
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<link rel="stylesheet" href="/styles.css">
+<style>${BAR_CSS}</style>
+</head>
+<body>
+<div id="amorphous-root">${stripScriptTags(html)}</div>
+<div id="amorphous-serve" data-mode="${mode}">
+  <span>Records</span>
+  <button type="button" data-set="local"${pressed('local')}>Local</button>
+  <button type="button" data-set="prod"${pressed('prod')}>Prod</button>
+</div>
+<script>
+window.amorphous = {
+  login() {},
+  async me() {
+    const res = await fetch('/__amorphous/me')
+    if (!res.ok || res.status === 204) return null
+    const text = await res.text()
+    if (!text) return null
+    return JSON.parse(text)
+  },
+  async names(ids) {
+    const res = await fetch('/__amorphous/names', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ids })
+    })
+    if (!res.ok) return { names: {} }
+    return res.json()
+  },
+  data: {
+    async find() {
+      const res = await fetch('/__amorphous/data')
+      if (!res.ok) return []
+      const payload = await res.json()
+      return payload.records || []
+    },
+    async insert(row) {
+      const body = { ...row }
+      if (!body.id && crypto.randomUUID) body.id = crypto.randomUUID()
+      const res = await fetch('/__amorphous/data', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      })
+      if (!res.ok) throw new Error('insert failed: ' + res.status)
+      return body
+    },
+    async replace(id, row) {
+      const res = await fetch('/__amorphous/data/' + encodeURIComponent(id), {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(row)
+      })
+      if (!res.ok) throw new Error('replace failed: ' + res.status)
+      return row
+    }
+  }
+}
+document.getElementById('amorphous-serve').addEventListener('click', function (event) {
+  var mode = event.target && event.target.getAttribute('data-set')
+  if (!mode) return
+  fetch('/__amorphous/mode', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ mode: mode })
+  }).then(function () { location.reload() })
+})
+new EventSource('/__amorphous/events').addEventListener('reload', function () {
+  location.reload()
+})
+</script>
+<script src="/app.js"></script>
+</body>
+</html>`
+}
+
+function passFromResponse(res) {
+  const list = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+  const lines = list.length ? list : [res.headers.get('set-cookie') || '']
+  for (const line of lines) {
+    const match = /(?:^|,\s*)am_pass=([^;]+)/.exec(line)
+    if (match) return `am_pass=${match[1]}`
+  }
+  return null
+}
+
+export async function mintAbstractPass(abstractId) {
+  const data = await apiFetch(`/api/abstracts/${abstractId}/code`, { method: 'POST', body: '{}' })
+  const code = data?.code
+  if (!code) throw new Error('Could not open the abstract records.')
+  const res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}?code=${encodeURIComponent(code)}`, {
+    redirect: 'manual',
+    headers: { ...cliAbstractsHostHeader() },
+  })
+  const cookie = passFromResponse(res)
+  if (!cookie) throw new Error('Could not open the abstract records.')
+  return cookie
+}
+
+async function proxyAbstract(abstractId, path, init, session) {
+  const headers = {
+    ...cliAbstractsHostHeader(),
+    ...(init.headers || {}),
+  }
+  if (session.cookie) headers.Cookie = session.cookie
+  let res
+  try {
+    res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}${path}`, {
+      method: init.method || 'GET',
+      headers,
+      body: init.body,
+      redirect: 'manual',
+    })
+  } catch {
+    return new Response(JSON.stringify({ message: 'Could not reach the abstract.' }), {
+      status: 502,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+  if (res.status === 401 && session.cookie && !init.retried) {
+    session.cookie = null
+    session.cookie = await session.mint()
+    return proxyAbstract(abstractId, path, { ...init, retried: true }, session)
+  }
+  return res
+}
+
+export function startServe(options) {
+  const cwd = options.cwd
+  const abstractId = options.abstractId
+  const host = options.host || '127.0.0.1'
+  const session = {
+    cookie: null,
+    failed: false,
+    mint: options.mintPass || (() => mintAbstractPass(abstractId)),
+  }
+  const clients = new Set()
+  let reloadTimer = null
+
+  function notifyReload() {
+    clearTimeout(reloadTimer)
+    reloadTimer = setTimeout(() => {
+      for (const client of clients) client.write('event: reload\ndata: 1\n\n')
+    }, 60)
+  }
+
+  const watchers = []
+  for (const name of ['index.html', 'styles.css', 'app.js']) {
+    const path = join(cwd, name)
+    if (!existsSync(path)) continue
+    watchers.push(watch(path, notifyReload))
+  }
+
+  async function ensurePass() {
+    if (session.cookie) return session.cookie
+    if (session.failed) return null
+    try {
+      session.cookie = await session.mint()
+      return session.cookie
+    } catch {
+      session.failed = true
+      return null
+    }
+  }
+
+  async function prod(path, init) {
+    if (options.prodFetch) return options.prodFetch(abstractId, path, init, session)
+    const cookie = await ensurePass()
+    if (!cookie && init.auth !== false) {
+      return new Response(JSON.stringify({ message: 'Not signed in. Run: amorphous-cli login' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+    const res = await proxyAbstract(abstractId, path, { ...init, headers: { ...(init.headers || {}), Cookie: cookie || '' } }, session)
+    const text = await res.text()
+    return new Response(text, { status: res.status, headers: { 'Content-Type': res.headers.get('content-type') || 'application/json' } })
+  }
+
+  const server = createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url || '/', 'http://127.0.0.1')
+      if (req.method === 'GET' && url.pathname === '/') {
+        const mode = recordsMode(req, url)
+        const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }
+        if (url.searchParams.get('records') === 'local' || url.searchParams.get('records') === 'prod') {
+          headers['Set-Cookie'] = `amorphous_records=${mode}; Path=/; SameSite=Lax`
+        }
+        send(res, 200, pageHtml(readProjectFiles(cwd).html, mode), headers)
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/styles.css') {
+        send(res, 200, readProjectFiles(cwd).css, { 'Content-Type': 'text/css; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/app.js') {
+        send(res, 200, readProjectFiles(cwd).js, { 'Content-Type': 'text/javascript; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/__amorphous/events') {
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+        })
+        res.write(':\n\n')
+        clients.add(res)
+        req.on('close', () => clients.delete(res))
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/mode') {
+        const body = await readJson(req)
+        const mode = body.mode === 'prod' ? 'prod' : 'local'
+        send(res, 204, null, { 'Set-Cookie': `amorphous_records=${mode}; Path=/; SameSite=Lax` })
+        return
+      }
+      const mode = recordsMode(req, url)
+      if (req.method === 'GET' && url.pathname === '/__amorphous/me') {
+        const upstream = await prod('/api/me', { method: 'GET', auth: false })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/names') {
+        const body = await readJson(req)
+        const upstream = await prod('/api/names', {
+          method: 'POST',
+          auth: false,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ ids: Array.isArray(body.ids) ? body.ids : [] }),
+        })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (url.pathname === '/__amorphous/data' || url.pathname.startsWith('/__amorphous/data/')) {
+        if (mode === 'prod') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const path = req.method === 'PUT' ? `/api/data/${encodeURIComponent(recordId)}` : '/api/data'
+          const init = { method: req.method, auth: true }
+          if (req.method === 'POST' || req.method === 'PUT') {
+            init.headers = { 'Content-Type': 'application/json' }
+            init.body = JSON.stringify(await readJson(req))
+          }
+          const upstream = await prod(path, init)
+          const text = await upstream.text()
+          send(res, upstream.status, text, { 'Content-Type': 'application/json; charset=utf-8' })
+          return
+        }
+        if (req.method === 'GET') {
+          send(res, 200, { records: recordsFromLocal(cwd) })
+          return
+        }
+        if (req.method === 'POST') {
+          const result = insertLocalRecord(cwd, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+        if (req.method === 'PUT') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const result = replaceLocalRecord(cwd, recordId, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+      }
+      send(res, 404, { message: 'Not found' })
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        send(res, 400, { message: 'Invalid request' })
+        return
+      }
+      send(res, 500, { message: error instanceof Error ? error.message : 'Request failed' })
+    }
+  })
+
+  const ready = new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(options.port || 0, host, () => {
+      server.removeListener('error', reject)
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : options.port
+      const url = `http://${host}:${port}/`
+      resolve({ url, port })
+    })
+  })
+
+  return ready.then((info) => {
+    if (!options.silent) {
+      if (options.json) console.log(JSON.stringify({ url: info.url }))
+      else console.log(info.url)
+    }
+    return {
+      ...info,
+      close() {
+        clearTimeout(reloadTimer)
+        for (const watcher of watchers) watcher.close()
+        for (const client of clients) client.end()
+        return new Promise((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()))
+        })
+      },
+    }
+  })
+}

package/lib/serve.test.mjs

@@ -0,0 +1,123 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { startServe } from './serve.mjs'
+
+function project() {
+  const cwd = mkdtempSync(join(tmpdir(), 'amorphous-serve-'))
+  writeFileSync(join(cwd, 'index.html'), '<main><script>alert(1)</script><p id="who">Hi</p></main>')
+  writeFileSync(join(cwd, 'styles.css'), 'main{color:black}')
+  writeFileSync(join(cwd, 'app.js'), 'document.title = "served"')
+  writeFileSync(join(cwd, 'data.ndjson'), '')
+  writeFileSync(join(cwd, 'private.ndjson'), '')
+  return cwd
+}
+
+function cookieFrom(res) {
+  const line = res.headers.get('set-cookie') || ''
+  const match = /amorphous_records=(local|prod)/.exec(line)
+  return match ? `amorphous_records=${match[1]}` : ''
+}
+
+test('serve reloads local source and keeps prod records off disk', async () => {
+  const cwd = project()
+  const calls = []
+  const running = await startServe({
+    cwd,
+    abstractId: '00000000-0000-4000-8000-000000000001',
+    silent: true,
+    prodFetch: async (_id, path, init) => {
+      calls.push({ path, method: init.method, body: init.body })
+      if (path === '/api/data' && init.method === 'GET') {
+        return new Response(JSON.stringify({ records: [{ id: 'live', visibility: 'shared', text: 'remote' }] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      if (path === '/api/data' && init.method === 'POST') {
+        return new Response(JSON.stringify({ ok: true }), { status: 200 })
+      }
+      if (path === '/api/me') {
+        return new Response(JSON.stringify({ id: 'user-1', name: 'Ada' }), { status: 200 })
+      }
+      return new Response(JSON.stringify({ names: { 'user-1': 'Ada' } }), { status: 200 })
+    },
+  })
+
+  try {
+    const page = await fetch(running.url)
+    const html = await page.text()
+    assert.match(html, /id="who"/)
+    assert.doesNotMatch(html, /alert\(1\)/)
+    assert.match(html, /data-set="local" aria-pressed="true"/)
+    assert.match(html, /data-set="prod"/)
+    assert.equal(await (await fetch(`${running.url}styles.css`)).text(), 'main{color:black}')
+    assert.equal(await (await fetch(`${running.url}app.js`)).text(), 'document.title = "served"')
+
+    const inserted = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'note' }),
+    })
+    assert.equal(inserted.status, 200)
+    const found = await (await fetch(`${running.url}__amorphous/data`)).json()
+    assert.deepEqual(found.records, [{ id: 'local-1', text: 'note', visibility: 'shared' }])
+
+    const replaced = await fetch(`${running.url}__amorphous/data/local-1`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text: 'edited' }),
+    })
+    assert.equal(replaced.status, 200)
+    assert.match(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /"text":"edited"/)
+    assert.equal(calls.filter((call) => call.path === '/api/data').length, 0)
+
+    const again = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'nope' }),
+    })
+    assert.equal(again.status, 409)
+
+    const switched = await fetch(`${running.url}__amorphous/mode`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'prod' }),
+    })
+    const jar = cookieFrom(switched)
+    assert.equal(jar, 'amorphous_records=prod')
+    const live = await (
+      await fetch(`${running.url}__amorphous/data`, { headers: { Cookie: jar } })
+    ).json()
+    assert.equal(live.records[0].text, 'remote')
+    const pushed = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Cookie: jar },
+      body: JSON.stringify({ id: 'from-prod', text: 'up' }),
+    })
+    assert.equal(pushed.status, 200)
+    assert.doesNotMatch(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /from-prod/)
+    assert.equal(calls.filter((call) => call.method === 'POST' && call.path === '/api/data').length, 1)
+
+    const me = await (await fetch(`${running.url}__amorphous/me`)).json()
+    assert.equal(me.name, 'Ada')
+
+    const events = await fetch(`${running.url}__amorphous/events`)
+    const reader = events.body.getReader()
+    const first = await reader.read()
+    assert.match(Buffer.from(first.value).toString(), /:/)
+    writeFileSync(join(cwd, 'styles.css'), 'main{color:white}')
+    let chunk = ''
+    const deadline = Date.now() + 2000
+    while (!chunk.includes('reload') && Date.now() < deadline) {
+      const next = await reader.read()
+      chunk += Buffer.from(next.value).toString()
+    }
+    assert.match(chunk, /reload/)
+    reader.cancel()
+  } finally {
+    await running.close()
+  }
+})

package/lib/session.mjs

@@ -58,7 +58,7 @@ async function withCredentialLock(dir, fn) {
         /* the other process released it */
       }
       if (Date.now() - started > LOCK_WAIT_MS) {
-        throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
+        throw new Error('Not signed in. Run: amorphous-cli login')
       }
       await sleep(25)
     }
@@ -115,11 +115,11 @@ export async function ensureFreshSession(options = {}) {
     const now = options.now ?? Date.now()
     const session = loadSession()
     if (!session?.access_token) {
-      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
+      throw new Error('Not signed in. Run: amorphous-cli login')
     }
     if (!options.force && !sessionNeedsRefresh(session, now)) return session
     if (!session.refresh_token) {
-      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
+      throw new Error('Not signed in. Run: amorphous-cli login')
     }
     const refresh = options.refresh ?? refreshWithSupabase
     try {
@@ -135,7 +135,7 @@ export async function ensureFreshSession(options = {}) {
       ) {
         return again
       }
-      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
+      throw new Error('Not signed in. Run: amorphous-cli login')
     }
   })
 }
@@ -148,7 +148,7 @@ export function accessToken() {
 export function authHeaders(extra = {}) {
   const token = accessToken()
   if (!token) {
-    throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
+    throw new Error('Not signed in. Run: amorphous-cli login')
   }
   return {
     Authorization: `Bearer ${token}`,

package/lib/tool-result.test.mjs

@@ -2,14 +2,14 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { toolText } from './tool-result.mjs'
 
-const NUDGE = 'Run: npx amorphous-cli@latest setup'
+const NUDGE = 'Run: npm install -g amorphous-cli@latest && amorphous-cli setup'
 
 test('a successful command keeps stderr the model must see', () => {
   assert.equal(toolText('[{"id":"a"}]', `${NUDGE}\n`, 0), `[{"id":"a"}]\n${NUDGE}`)
 })
 
 test('a failed command returns the error text', () => {
-  assert.equal(toolText('', 'Not signed in. Run: npx amorphous-cli@latest login\n', 1), 'Not signed in. Run: npx amorphous-cli@latest login')
+  assert.equal(toolText('', 'Not signed in. Run: amorphous-cli login\n', 1), 'Not signed in. Run: amorphous-cli login')
 })
 
 test('empty success is ok', () => {

package/lib/update-check.mjs

@@ -8,7 +8,7 @@ import { userSkillDirs } from './agent-contract.mjs'
 import { CLI_VERSION } from './version.mjs'
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000
-const NUDGE = 'Run: npx amorphous-cli@latest setup\n'
+const NUDGE = 'Run: npm install -g amorphous-cli@latest && amorphous-cli setup\n'
 
 function parseVersion(v) {
   if (typeof v !== 'string') return null

package/lib/update-check.test.mjs

@@ -14,7 +14,7 @@ import {
   startUpdateCheck,
 } from './update-check.mjs'
 
-const NUDGE = 'Run: npx amorphous-cli@latest setup\n'
+const NUDGE = 'Run: npm install -g amorphous-cli@latest && amorphous-cli setup\n'
 
 test('compareVersions', () => {
   assert.equal(compareVersions('1.0.0', '1.0.0'), 0)
@@ -252,7 +252,7 @@ test('non-setup refreshes a stale skill when registry matches', async () => {
   await update.finish()
   assert.equal(err, '')
   assert.equal(readFileSync(join(d0, '.amorphous-version'), 'utf8').trim(), CLI_VERSION)
-  assert.match(readFileSync(join(d0, 'SKILL.md'), 'utf8'), /npx amorphous-cli@latest/)
+  assert.match(readFileSync(join(d0, 'SKILL.md'), 'utf8'), /npm install -g amorphous-cli@latest/)
 })
 
 test('a newer registry is not copied over the installed skill', async () => {
@@ -291,6 +291,6 @@ test('integration help skips update check file', () => {
     encoding: 'utf8',
   })
   assert.equal(r.status, 0)
-  assert.ok(!r.stderr.includes('Run: npx amorphous-cli@latest setup'))
+  assert.ok(!r.stderr.includes('Run: npm install -g amorphous-cli@latest && amorphous-cli setup'))
   assert.throws(() => readFileSync(cacheFile(home)), { code: 'ENOENT' })
 })

package/mcp.mjs

@@ -84,11 +84,13 @@ await serveStdio(() => {
     {
       title: 'Push the abstract',
       description:
-        'Upload the local abstract and merge records. A record changed both here and on the live abstract is refused; edit it and push again.',
-      inputSchema: z.object({}),
+        'Upload the local source. Set data to also merge records from this folder. A record changed both here and on the live abstract is refused; edit it and push again.',
+      inputSchema: z.object({
+        data: z.boolean().optional().describe('Also merge records from this folder'),
+      }),
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     },
-    async () => call(['push']),
+    async ({ data }) => call(data ? ['push', '--data'] : ['push']),
   )
 
   server.registerTool(

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "amorphous-cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "mcpName": "io.github.amorphous-one/amorphous",
-  "description": "Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.",
+  "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",
   "bin": {
     "amorphous-cli": "index.mjs",

package/skill/amorphous/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: amorphous
-description: Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own. Use when someone wants an abstract other people can open, or wants to invite people, publish, or change an abstract.
+description: Make whatever you want, yourself, with your own agent, or with others. Use when someone wants an abstract other people can open, or wants to invite people, publish, or change an abstract.
 ---
 
-Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.
+Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users.
 
 ## Files
 
@@ -32,17 +32,20 @@ A private record belongs to the signed-in person who wrote it. The abstract does
 
 ## Loop
 
-Call the CLI as `npx amorphous-cli@latest <command>`. If a command prints `Run: npx amorphous-cli@latest setup`, run that line, then repeat the command.
+Install the CLI once with `npm install -g amorphous-cli@latest`, then call it as `amorphous-cli <command>`. If a command prints `Run: npm install -g amorphous-cli@latest && amorphous-cli setup`, run that line, then repeat the command.
 
-1. If you are not signed in, run `npx amorphous-cli@latest login`. Show the person the link it prints and ask them to finish in the browser. Do not ask for an email or a code.
-2. `npx amorphous-cli@latest create --name "..."` in a folder, or `npx amorphous-cli@latest pull` when `.amorphous.json` is already there.
+1. If you are not signed in, run `amorphous-cli login`. Show the person the link it prints and ask them to finish in the browser. Do not ask for an email or a code.
+2. `amorphous-cli create --name "..."` in a folder, or `amorphous-cli pull` when `.amorphous.json` is already there.
 3. Edit the files to match what they asked for. `me` and `names` are how the abstract knows who is here.
-4. `npx amorphous-cli@latest push`
-5. `npx amorphous-cli@latest preview` and open that URL.
-6. `npx amorphous-cli@latest publish --live`
-7. `npx amorphous-cli@latest invite <email> use` or `edit` or `view`. It prints a link and does not send an email. Give them that link. They open it and sign in with that email.
+4. `amorphous-cli serve` and open that URL. It reloads when the files change. Records on that page start in this folder. Switch the page to prod to read and write the abstract's records.
+5. `amorphous-cli push` sends the source. `amorphous-cli push --data` also sends the records in this folder.
+6. `amorphous-cli preview` and open that URL.
+7. `amorphous-cli publish --live`
+8. `amorphous-cli invite <email> use` or `edit` or `view`. It prints a link and does not send an email. Give them that link. They open it and sign in with that email.
 
-`npx amorphous-cli@latest visibility anyone` lets anyone view and write shared records. `npx amorphous-cli@latest visibility members` keeps the abstract to invited people.
+`amorphous-cli visibility anyone` lets anyone view and write shared records. `amorphous-cli visibility members` keeps the abstract to invited people.
+
+Do not make a public abstract that lets anyone keep adding shared records, such as an open list. Those records stay on the abstract and use up its storage. Keep shared records to a set you replace, or keep the abstract to invited people.
 
 A person's access is view, use, or edit. Member tiers, scores, and roles inside an abstract are records on that abstract.
 

package/skill/amorphous/assets/app.js

@@ -1,26 +1,8 @@
 const who = document.getElementById('who')
-const list = document.getElementById('items')
-const form = document.getElementById('add')
 
 async function refresh() {
   const me = await amorphous.me()
-  who.textContent = me ? me.name : 'Sign in to take part'
-  const rows = await amorphous.data.find()
-  list.replaceChildren()
-  for (const row of rows) {
-    const li = document.createElement('li')
-    li.textContent = typeof row.text === 'string' ? row.text : ''
-    list.appendChild(li)
-  }
+  who.textContent = me ? me.name : 'Sign in'
 }
 
-form.addEventListener('submit', async (event) => {
-  event.preventDefault()
-  const text = new FormData(form).get('text')
-  if (typeof text !== 'string' || !text.trim()) return
-  await amorphous.data.insert({ text: text.trim() })
-  form.reset()
-  await refresh()
-})
-
 refresh()

package/skill/amorphous/assets/index.html

@@ -1,8 +1,3 @@
 <main>
   <p id="who"></p>
-  <ul id="items"></ul>
-  <form id="add">
-    <input name="text" required placeholder="Add something">
-    <button type="submit">Add</button>
-  </form>
 </main>

package/skill/amorphous/assets/styles.css

@@ -9,23 +9,3 @@ main {
 #who {
   color: #52525b;
 }
-
-ul {
-  padding-left: 1.1rem;
-}
-
-form {
-  display: flex;
-  gap: 0.5rem;
-  margin-top: 1rem;
-}
-
-input {
-  flex: 1;
-  font: inherit;
-  padding: 0.4rem 0.55rem;
-}
-
-button {
-  font: inherit;
-}