ghost-dragon 4.2.1

package/src/commands/wyrm.ts

@@ -0,0 +1,269 @@
+/**
+ * dragon wyrm — Wyrm AI Memory System bridge.
+ *
+ *   dragon wyrm status        — health + stats from the running HTTP API
+ *   dragon wyrm serve         — start the Wyrm HTTP API on :3333
+ *   dragon wyrm mcp           — start the Wyrm MCP server over stdio
+ *   dragon wyrm projects      — list registered projects
+ *   dragon wyrm scan <path>   — discover git projects under <path>
+ *   dragon wyrm search <q>    — search across all memory
+ *   dragon wyrm quests        — list active quests
+ *   dragon wyrm maintenance   — vacuum + archive the database
+ *
+ * Endpoints + binary paths match Wyrm v5.x (packages/mcp-server). The
+ * earlier shape (`/api/health`, `npx wyrm`, `wyrm-deploy`) was written
+ * against a v3-era layout that no longer exists.
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { getProductPath } from '../config.js'
+import { run, label, success, error, info, warn, table } from '../utils.js'
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+import chalk from 'chalk'
+
+function wyrmUrl(config: DragonConfig): string {
+  const port = config.products.wyrm?.port || 3333
+  return `http://127.0.0.1:${port}`
+}
+
+// The Wyrm HTTP server enforces Bearer auth. The raw key is shown once
+// at `wyrm-setup` time and expected to be exported as WYRM_API_KEY. We
+// also accept a key stashed in ~/.wyrm/api-key for convenience.
+function wyrmToken(): string | null {
+  if (process.env.WYRM_API_KEY) return process.env.WYRM_API_KEY.trim()
+  const f = join(homedir(), '.wyrm', 'api-key')
+  if (existsSync(f)) {
+    try { return readFileSync(f, 'utf-8').trim() } catch { /* fall through */ }
+  }
+  return null
+}
+
+async function wyrmFetch<T = any>(url: string, init: RequestInit = {}, timeoutMs = 5000): Promise<T> {
+  const token = wyrmToken()
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    ...(init.headers as Record<string, string> ?? {}),
+  }
+  if (token) headers['Authorization'] = `Bearer ${token}`
+  if (init.body && !headers['Content-Type']) headers['Content-Type'] = 'application/json'
+
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const res = await fetch(url, { ...init, headers, signal: controller.signal })
+    if (res.status === 401) {
+      throw new Error('401 unauthorized — set WYRM_API_KEY (`wyrm-setup` prints one on first run)')
+    }
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`)
+    return res.json() as Promise<T>
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+// Resolve the runtime entry. Prefer the built file in the installed
+// monorepo over `npx`, because Wyrm has no root package.json and
+// `npx wyrm` will try to fetch from the public registry.
+function wyrmEntry(path: string, name: 'http-server' | 'index'): string | null {
+  const candidates = [
+    join(path, 'packages', 'mcp-server', 'dist', `${name}.js`),
+    join(path, 'dist', `${name}.js`),
+  ]
+  return candidates.find(existsSync) ?? null
+}
+
+export function registerWyrmCommands(program: Command, config: DragonConfig) {
+  const wyrm = program
+    .command('wyrm')
+    .description('Wyrm — persistent AI memory (HTTP API + MCP server)')
+
+  // --- status ---
+  wyrm
+    .command('status')
+    .description('Check Wyrm server health & stats')
+    .action(async () => {
+      const url = wyrmUrl(config)
+      console.log(label('Wyrm'), `Probing ${chalk.dim(url)}\n`)
+      try {
+        const health = await wyrmFetch<any>(`${url}/health`)
+        let stats: any = {}
+        try { stats = await wyrmFetch<any>(`${url}/stats`) } catch { /* stats may need auth */ }
+        console.log(`  Server:    ${chalk.green('● online')}  ${chalk.dim(`v${health.version ?? '?'}`)}`)
+        console.log(`  Projects:  ${stats.projects ?? chalk.dim('—')}`)
+        console.log(`  Sessions:  ${stats.sessions ?? chalk.dim('—')}`)
+        console.log(`  Quests:    ${stats.quests ?? chalk.dim('—')}`)
+        if (stats.data_entries !== undefined) {
+          console.log(`  Data Lake: ${stats.data_entries} entries`)
+        }
+        console.log()
+        success('Wyrm is running')
+      } catch (e: any) {
+        error(`Wyrm not reachable — ${e.message}`)
+        info(`Start it with: ${chalk.green('dragon wyrm serve')}`)
+        process.exitCode = 1
+      }
+    })
+
+  // --- serve (HTTP API) ---
+  wyrm
+    .command('serve')
+    .description('Start the Wyrm HTTP API server')
+    .option('-p, --port <port>', 'Port number', '3333')
+    .action(async (opts) => {
+      const path = getProductPath(config, 'wyrm')
+      const entry = wyrmEntry(path, 'http-server')
+      if (!entry) {
+        error(`No built Wyrm at ${path}`)
+        info(`Run: ${chalk.green('dragon install wyrm')} first`)
+        process.exit(2)
+      }
+      console.log(label('Wyrm'), `Starting HTTP API on :${opts.port}…\n`)
+      const code = await run('node', [entry], path, { env: { ...process.env, WYRM_PORT: String(opts.port) } })
+      if (code !== 0) error(`Server exited with code ${code}`)
+    })
+
+  // --- mcp (stdio) ---
+  wyrm
+    .command('mcp')
+    .description('Start the Wyrm MCP server over stdio')
+    .action(async () => {
+      const path = getProductPath(config, 'wyrm')
+      const entry = wyrmEntry(path, 'index')
+      if (!entry) {
+        error(`No built Wyrm at ${path}`)
+        info(`Run: ${chalk.green('dragon install wyrm')} first`)
+        process.exit(2)
+      }
+      // Don't print a label — MCP clients read JSON-RPC from stdout.
+      const code = await run('node', [entry], path)
+      if (code !== 0) error(`MCP server exited with code ${code}`)
+    })
+
+  // --- projects ---
+  wyrm
+    .command('projects')
+    .description('List registered projects')
+    .action(async () => {
+      const url = wyrmUrl(config)
+      try {
+        const data = await wyrmFetch<any>(`${url}/projects`)
+        const list = data.projects ?? data ?? []
+        if (Array.isArray(list) && list.length) {
+          table(list.map((p: any) => ({
+            Name:     p.name ?? p.id ?? '—',
+            Path:     p.path ?? '—',
+            Language: p.language ?? '—',
+            Sessions: String(p.session_count ?? p.sessions ?? 0),
+          })))
+        } else {
+          info('No projects registered. Run: dragon wyrm scan <path>')
+        }
+      } catch (e: any) {
+        error(`Failed: ${e.message}`)
+        process.exitCode = 1
+      }
+    })
+
+  // --- scan ---
+  wyrm
+    .command('scan <path>')
+    .description('Scan directory for git projects')
+    .action(async (scanPath) => {
+      const url = wyrmUrl(config)
+      console.log(label('Wyrm'), `Scanning ${chalk.dim(scanPath)}…\n`)
+      try {
+        const data = await wyrmFetch<any>(`${url}/projects/scan`, {
+          method: 'POST',
+          body:   JSON.stringify({ path: scanPath }),
+        })
+        success(`Found ${data.projects_found ?? data.found ?? 0} project(s)`)
+      } catch (e: any) {
+        error(`Failed: ${e.message}`)
+        process.exitCode = 1
+      }
+    })
+
+  // --- search ---
+  wyrm
+    .command('search <query>')
+    .description('Search across all memory')
+    .action(async (query) => {
+      const url = wyrmUrl(config)
+      try {
+        const data = await wyrmFetch<any>(`${url}/search?q=${encodeURIComponent(query)}`)
+        const results = data.results ?? data ?? []
+        if (Array.isArray(results) && results.length) {
+          for (const r of results) {
+            const snippet = (r.content ?? r.snippet ?? '').slice(0, 120)
+            console.log(`  ${chalk.green(r.project ?? 'global')} ${chalk.dim('—')} ${snippet}`)
+          }
+          console.log(chalk.dim(`\n  ${results.length} result(s)`))
+        } else {
+          info('No results')
+        }
+      } catch (e: any) {
+        error(`Failed: ${e.message}`)
+        process.exitCode = 1
+      }
+    })
+
+  // --- quests ---
+  wyrm
+    .command('quests')
+    .description('List active quests/tasks')
+    .option('-a, --all', 'Include completed quests')
+    .action(async (opts) => {
+      const url = wyrmUrl(config)
+      try {
+        const data = await wyrmFetch<any>(`${url}/quests${opts.all ? '?all=1' : ''}`)
+        const quests = data.quests ?? data ?? []
+        if (Array.isArray(quests) && quests.length) {
+          for (const q of quests) {
+            const icon = q.status === 'completed' ? chalk.green('✓') : chalk.dim('○')
+            console.log(`  ${icon} ${q.title ?? q.name ?? q.id} ${chalk.dim(q.project ?? '')}`)
+          }
+        } else {
+          info('No active quests')
+        }
+      } catch (e: any) {
+        error(`Failed: ${e.message}`)
+        process.exitCode = 1
+      }
+    })
+
+  // --- maintenance ---
+  wyrm
+    .command('maintenance')
+    .description('Run database maintenance (vacuum, archive)')
+    .action(async () => {
+      const url = wyrmUrl(config)
+      console.log(label('Wyrm'), 'Running maintenance…\n')
+      try {
+        const data = await wyrmFetch<any>(`${url}/maintenance`, { method: 'POST' })
+        success(data.message ?? 'Maintenance complete')
+      } catch (e: any) {
+        error(`Failed: ${e.message}`)
+        process.exitCode = 1
+      }
+    })
+
+  // Default action — short summary instead of dumping help.
+  wyrm.action(() => {
+    const tokened = wyrmToken() !== null
+    console.log()
+    console.log(`  ${label('Wyrm')}  ${chalk.dim('persistent AI memory · HTTP :3333 · MCP stdio')}`)
+    console.log()
+    console.log(`  ${chalk.dim('dragon wyrm status')}   ${chalk.dim('— server health + stats')}`)
+    console.log(`  ${chalk.dim('dragon wyrm serve')}    ${chalk.dim('— start the HTTP API')}`)
+    console.log(`  ${chalk.dim('dragon wyrm mcp')}      ${chalk.dim('— start the MCP server (stdio)')}`)
+    console.log()
+    if (!tokened) {
+      warn('WYRM_API_KEY not set — auth-protected endpoints will 401')
+      info(`Print one with: ${chalk.green('cd ~/Git\\ Projects/Wyrm/packages/mcp-server && node dist/setup.js')}`)
+    }
+    console.log()
+  })
+}

package/src/config.ts

@@ -0,0 +1,93 @@
+/**
+ * Dragon CLI configuration
+ * Stores product paths & settings in ~/.dragon/config.json
+ */
+
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'fs'
+import { homedir } from 'os'
+import { join } from 'path'
+
+export interface DragonConfig {
+  products: {
+    scale:   { path: string; url?: string }
+    wyrm:    { path: string; port?: number }
+    pentest: { path: string; controlPort?: number; controlUiPort?: number }
+    keep:    { path: string }
+    net:     { path: string; apiPort?: number; uiPort?: number }
+  }
+  defaults: {
+    editor: string
+  }
+  /** Dragon assistant (account.ghosts.lk) auth for the hosted portal tool. */
+  auth?: {
+    apiBase?: string   // override the assistant origin (default https://account.ghosts.lk)
+    token?: string     // bearer personal-access-token (device-flow; forward-compatible)
+    session?: string   // gp_session cookie value — works against prod today
+    email?: string     // last verified identity, for display only
+  }
+  /** The agent's reasoning brain (tools always run locally; this is the model). */
+  brain?: {
+    provider?: 'claude' | 'openai' | 'local' | 'ghost' | 'worker' | 'custom' | 'router'   // default 'claude'
+    model?: string          // override hosted model id (claude/openai)
+    localModel?: string      // Ollama model tag, e.g. 'qwen2.5-coder:7b'
+    localBaseURL?: string    // default http://localhost:11434/v1
+    ghostModel?: string      // DragonSpark tag (default 'dragonspark')
+    ghostBaseURL?: string    // default http://localhost:11434/v1
+    customBaseURL?: string   // any OpenAI-compatible endpoint (OpenRouter/vLLM/LM Studio)
+    customModel?: string     // model id for the custom endpoint
+    keys?: { anthropic?: string; openai?: string }   // env vars take precedence
+    // Ghost Router (provider 'router') role overrides — Ollama tags:
+    routerWorkhorse?: string // tool/agent turns (default 'mistral-nemo')
+    routerReasoner?: string  // hard reasoning, no tools (default 'vibethinker')
+    routerCheap?: string     // simple chat (default 'qwen2.5:1.5b')
+  }
+  /** Extra MCP servers wired into the agent (`dragon mcp add`). */
+  mcpServers?: Record<string, { command: string; args?: string[]; env?: Record<string, string> }>
+}
+
+const CONFIG_DIR = join(homedir(), '.dragon')
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json')
+
+const DEFAULT_CONFIG: DragonConfig = {
+  products: {
+    scale:   { path: '' },
+    wyrm:    { path: '', port: 3333 },
+    pentest: { path: '', controlPort: 4091, controlUiPort: 4090 },
+    keep:    { path: '' },
+    net:     { path: '', apiPort: 4080, uiPort: 4081 },
+  },
+  defaults: {
+    editor: process.env.EDITOR || 'code',
+  },
+}
+
+export function loadConfig(): DragonConfig {
+  if (!existsSync(CONFIG_FILE)) {
+    return DEFAULT_CONFIG
+  }
+  try {
+    const raw = readFileSync(CONFIG_FILE, 'utf-8')
+    const merged = { ...DEFAULT_CONFIG, ...JSON.parse(raw) }
+    // Deep-merge products so new keys appear with defaults
+    merged.products = { ...DEFAULT_CONFIG.products, ...(merged.products || {}) }
+    return merged
+  } catch {
+    return DEFAULT_CONFIG
+  }
+}
+
+export function saveConfig(config: DragonConfig): void {
+  // The config may hold a bearer token / session — lock it down on EVERY write
+  // path (not just after login), so it's never briefly world-readable.
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 })
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 })
+  try { chmodSync(CONFIG_FILE, 0o600) } catch { /* best-effort on odd filesystems */ }
+}
+
+export function getProductPath(config: DragonConfig, product: keyof DragonConfig['products']): string {
+  const p = config.products[product].path
+  if (!p) {
+    throw new Error(`${product} path not configured. Run: dragon init`)
+  }
+  return p
+}

package/src/index.ts

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * Dragon CLI — Unified management for Ghost Protocol products.
+ *
+ *   dragon list      — print the stack + live install / running state
+ *   dragon up        — clone + install every product (fresh-machine bootstrap)
+ *   dragon install   — install one product
+ *   dragon update    — git pull every product
+ *   dragon serve     — boot the dragon stack daemons
+ *   dragon down      — stop everything
+ *   dragon doctor    — quick health check across the stack
+ *
+ *   dragon pentest|osint|memory|keep|wyrm|scale  — per-product CLIs
+ */
+
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { C } from './utils.js'
+import { brandHeader } from './ui.js'
+import { loadConfig } from './config.js'
+import { registerScaleCommands }   from './commands/scale.js'
+import { registerWyrmCommands }    from './commands/wyrm.js'
+import { registerPentestCommands } from './commands/pentest.js'
+import { registerKeepCommands }    from './commands/keep.js'
+import { registerOsintCommands }   from './commands/osint.js'
+import { registerMemoryCommands }  from './commands/memory.js'
+import { registerServeCommands }   from './commands/serve.js'
+import { registerAlertsCommands }  from './commands/alerts.js'
+import { registerAiCommands }      from './commands/ai.js'
+import { registerChatCommands }    from './commands/chat.js'
+import { registerLoginCommands }   from './commands/login.js'
+import { registerConfigCommands }  from './commands/config.js'
+import { registerDoctorCommands }  from './commands/doctor.js'
+import { registerMcpCommands }     from './commands/mcp.js'
+import { registerMaintenanceCommands } from './commands/maintenance.js'
+import { registerTuiCommands }      from './commands/tui.js'
+import { registerBillingCommands } from './commands/billing.js'
+import { registerLifecycleCommands } from './commands/lifecycle.js'
+import { registerGlobalCommands }  from './commands/global.js'
+
+const VERSION = '4.2.1'
+
+// Ops-console brand splash — framed panel + chrome wordmark (see src/ui.ts).
+const HEADER = brandHeader(VERSION)
+
+const program = new Command()
+
+program
+  .name('dragon')
+  .description('Ghost Protocol — unified stack control')
+  .version(VERSION, '-v, --version')
+  .option('--debug', 'print full stack traces on error')
+  .addHelpText('beforeAll', `\n${HEADER}`)
+  .addHelpText('afterAll',
+    `\n  ${chalk.dim('Tip:')} run ${chalk.green('dragon list')} to see what's installed,` +
+    `\n       ${chalk.green('dragon up')} to bootstrap a fresh machine.\n`)
+
+const config = loadConfig()
+
+registerScaleCommands(program, config)
+registerWyrmCommands(program, config)
+registerPentestCommands(program, config)
+registerKeepCommands(program, config)
+registerOsintCommands(program, config)
+registerMemoryCommands(program, config)
+registerServeCommands(program, config)
+registerAlertsCommands(program, config)
+registerAiCommands(program, config)
+registerChatCommands(program, config)
+registerLoginCommands(program, config)
+registerConfigCommands(program, config)
+registerDoctorCommands(program, config)
+registerMcpCommands(program, config)
+registerMaintenanceCommands(program, config)
+registerTuiCommands(program, config)
+registerBillingCommands(program, config)
+registerLifecycleCommands(program, config)
+registerGlobalCommands(program, config)
+
+// ── Global error safety net — never dump a raw stack on the operator. ──
+const DEBUG = process.argv.includes('--debug') || !!process.env.DRAGON_DEBUG
+function fatal(label: string, err: unknown): never {
+  const msg = err instanceof Error ? err.message : String(err)
+  process.stderr.write(`\n  ${C.critical('⚠')} ${label}: ${msg}\n`)
+  if (DEBUG && err instanceof Error && err.stack) process.stderr.write(C.faint(err.stack) + '\n')
+  else process.stderr.write(C.faint('  run with --debug (or DRAGON_DEBUG=1) for the full trace\n'))
+  process.exit(1)
+}
+process.on('uncaughtException', (e) => fatal('unexpected error', e))
+process.on('unhandledRejection', (e) => fatal('unhandled rejection', e))
+
+program.parseAsync().catch((e) => fatal('command failed', e))

package/src/manifest.ts

@@ -0,0 +1,104 @@
+/**
+ * Dragon Stack manifest loader.
+ *
+ * Reads dragon-manifest.toml at install time so `dragon up`,
+ * `dragon update`, `dragon install`, `dragon stop --all` know the
+ * full product portfolio.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import { readFileSync, existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export interface ManifestProduct {
+  key: string
+  name: string
+  repo: string
+  dir: string
+  stack: 'operator' | 'commercial' | 'daemon' | 'library'
+  kind: 'rust' | 'node' | 'python' | 'monorepo' | 'docker'
+  install: string[]
+  start?: string
+  stop?: string
+  port?: number
+  requires?: string[]
+}
+
+export interface Manifest {
+  manifest_version: string
+  default_root: string
+  product: ManifestProduct[]
+}
+
+// Minimal TOML reader — handles the subset we use here so the CLI
+// doesn't take on a TOML dep. Spec: `[[product]]` arrays, `key = "value"`
+// strings, `key = ["a", "b"]` string arrays, `key = 123` numbers,
+// comment lines starting with `#`.
+function parseToml(text: string): Manifest {
+  const out: any = { product: [] }
+  let cur: any | null = null
+  let inArray = false
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.replace(/#.*$/, '').trim()
+    if (!line) continue
+    if (line === '[[product]]') {
+      inArray = true
+      cur = {}
+      out.product.push(cur)
+      continue
+    }
+    if (line.startsWith('[') && line.endsWith(']')) {
+      inArray = false
+      cur = null
+      continue
+    }
+    const eq = line.indexOf('=')
+    if (eq < 0) continue
+    const key = line.slice(0, eq).trim()
+    let val: any = line.slice(eq + 1).trim()
+    if (val.startsWith('[') && val.endsWith(']')) {
+      val = val
+        .slice(1, -1)
+        .split(',')
+        .map((s: string) => s.trim().replace(/^"|"$/g, ''))
+        .filter(Boolean)
+    } else if (val.startsWith('"') && val.endsWith('"')) {
+      val = val.slice(1, -1)
+    } else if (!isNaN(Number(val))) {
+      val = Number(val)
+    }
+    if (inArray && cur) cur[key] = val
+    else out[key] = val
+  }
+  return out as Manifest
+}
+
+const SELF_DIR = fileURLToPath(new URL('..', import.meta.url))
+const CANDIDATES = [
+  join(homedir(), '.dragon', 'manifest.toml'),
+  resolve(SELF_DIR, '..', 'dragon-manifest.toml'),
+  resolve(homedir(), 'Git Projects', 'dragon-cli', 'dragon-manifest.toml'),
+]
+
+export function loadManifest(): Manifest {
+  for (const p of CANDIDATES) {
+    if (existsSync(p)) {
+      return parseToml(readFileSync(p, 'utf-8'))
+    }
+  }
+  throw new Error(
+    `dragon-manifest.toml not found. Looked in:\n  ${CANDIDATES.join('\n  ')}`,
+  )
+}
+
+export function resolveRoot(m: Manifest): string {
+  const r = m.default_root.replace(/^~/, homedir())
+  return r
+}
+
+export function productPath(m: Manifest, p: ManifestProduct): string {
+  return join(resolveRoot(m), p.dir)
+}