integral-mind 0.1.0

package/dist/cli.js

@@ -0,0 +1,945 @@
+#!/usr/bin/env node
+/**
+ * im — the Integral Mind CLI. Thin HTTP client: no database, no parsers.
+ *
+ * Exit codes:
+ *   0  success
+ *   1  runtime failure (network unreachable, server 5xx)
+ *   2  usage error (unknown command, bad flags, missing config)
+ *   3  authentication/authorization failure (401/403, bad or unscoped token)
+ *   4  not found (404)
+ *   5  validation rejected the input (400/422)
+ */
+import { realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { checkConfigPermissions, configPath, readConfigFile, resolveConfig, writeConfigFile, } from "./config.js";
+import { redactSecrets, summarizeFindings } from "./redact.js";
+import { ApiError, ImClient } from "./client.js";
+import { CANONICAL_DOC, DROP_IN_BLOCK } from "./docs.js";
+import { defaultSessionEndDeps, installClaudeHook, runClaudeSessionEnd, uninstallClaudeHook, } from "./hooks.js";
+export { EXIT } from "./exit.js";
+import { EXIT } from "./exit.js";
+import { runSyncCommand } from "./sync/cli.js";
+const USAGE = `im — Integral Mind CLI
+
+Usage:
+  im config set <url|token> <value>   Store connection settings (chmod 600)
+  im config show                      Show effective config and its sources
+  im push session [options]           Push a session envelope (redacted by default)
+  im push text <content> [options]    Capture plain text
+  im push file <path> [options]       Capture a file's contents as text
+  im push url <url> [options]         Capture a web page
+  im push youtube <url> [options]     Capture a YouTube video
+  im search <query> [options]         Hybrid search (filters: --type --after --before --code --sessions)
+  im sync <connector> [options]       Delta-sync a machine-local source (mempalace, obsidian, repo)
+  im sync connect|status|disconnect   Manage sync connections
+  im recent [options]                 List recently ingested sources
+  im stats                            Corpus statistics
+  im projects list|create <name>      Manage projects (admin token)
+  im sources list|reparse|delete      Manage sources (admin token)
+  im tokens list|generate|revoke      Manage MCP tokens (admin token)
+  im docs [--drop-in]                 Print the canonical manual (or the AGENTS.md block)\n  im hooks install|uninstall claude   Auto-push Claude Code sessions at session end
+
+push session options:
+  --file <path>      Read the envelope JSON from a file
+  --stdin            Read the envelope JSON from stdin
+  --text <t>         Build a text-fallback envelope instead of JSON
+  --agent <name>     Agent name for --text envelopes (default: cli)
+  --title <t>        Session title
+  --project <uuid>   Target project (default: your first project)
+  --no-redact        Skip secret redaction (NOT recommended)
+
+Common options:
+  --project <uuid>   Target project        --limit <n>   Result count
+  --title <t>        Source title          --json        Raw JSON output
+
+Environment:
+  INTEGRAL_MIND_URL, INTEGRAL_MIND_TOKEN override the config file.
+
+Exit codes: 0 ok · 1 runtime · 2 usage · 3 auth · 4 not found · 5 validation`;
+const EXIT_CODES_HELP = "Exit codes: 0 ok · 1 runtime · 2 usage · 3 auth · 4 not found · 5 validation";
+// Agent-grade per-command help: every entry has copy-paste examples and
+// exit-code semantics. Content mirrors the canonical manual (`im docs`).
+const COMMAND_HELP = {
+    config: `im config — store connection settings (file mode 0600)
+
+Usage:
+  im config set url <https://instance>
+  im config set token <imk_...>
+  im config show
+
+Examples:
+  im config set url https://span-vault.com
+  im config set token imk_abc123
+  INTEGRAL_MIND_URL and INTEGRAL_MIND_TOKEN env vars override the file.
+
+${EXIT_CODES_HELP}`,
+    push: `im push — store sources in your knowledge base
+
+Usage:
+  im push session (--file <envelope.json> | --stdin | --text <t>) [--agent a] [--title t] [--project uuid] [--no-redact]
+  im push text <content> [--title t] [--project uuid]
+  im push file <path> [--title t] [--project uuid]
+  im push url <url> [--title t] [--project uuid]
+  im push youtube <url> [--title t] [--project uuid]
+
+Examples:
+  im push session --file transcript.json
+  cat transcript.json | im push session --stdin
+  im push text "advisory locks coordinate blob GC" --title "GC note"
+  im push file ./notes/design.md
+
+Session pushes are redacted by default (typed [REDACTED:type]
+placeholders; summary on stderr); --no-redact bypasses. Pushes are
+idempotent by content hash. Run "im docs" for the envelope format.
+
+${EXIT_CODES_HELP}`,
+    search: `im search — hybrid search returning cited evidence chunks (no LLM)
+
+Usage:
+  im search <query> [--limit n] [--project uuid] [--type t]... [--after date] [--before date] [--code] [--sessions] [--json]
+
+Examples:
+  im search "failover postmortem"
+  im search "advisory locks" --limit 3 --json
+  im search "retry budget" --type session --type text   # only these source types
+  im search "interlock fix" --after 2026-06-01          # ingested on/after (inclusive)
+  im search "interlock fix" --before 2026-07-01         # ingested before (exclusive)
+  im search "quorum fence" --sessions                   # sessions + summaries only
+  im search "token verification" --code    # synced repos only; cites path:lines
+
+Filters combine. --sessions calls the dedicated session_search primitive
+(rows carry session type + push date); --code calls code_search. Both
+accept --after/--before but not --type, and are mutually exclusive.
+
+${EXIT_CODES_HELP}`,
+    recent: `im recent — list newest sources
+
+Usage:
+  im recent [--limit n] [--project uuid] [--json]
+
+Example:
+  im recent --limit 10
+
+${EXIT_CODES_HELP}`,
+    stats: `im stats — corpus statistics
+
+Usage:
+  im stats [--json]
+
+Example:
+  im stats --json
+
+${EXIT_CODES_HELP}`,
+    sync: `im sync — delta-sync machine-local sources into your knowledge base
+
+Usage:
+  im sync mempalace [--palace <label>] [--full]
+  im sync obsidian [--label <name>] [--full]
+  im sync repo [--label <name>] [--full]
+  im sync connect mempalace --label <name> --path <palace-dir> [--layout project_per_palace|project_per_wing]
+  im sync connect obsidian --vault <vault-dir> [--label <name>] [--project <uuid>]
+  im sync connect repo --path <repo-dir> [--label <name>] [--project <uuid>]
+  im sync status
+  im sync disconnect <mempalace|obsidian|repo> <label>
+
+Examples:
+  im sync connect mempalace --label personal --path ~/.mempalace/palace
+  im sync mempalace                 # delta sync: only changed items push
+  im sync connect obsidian --vault ~/vaults/Brain
+  im sync obsidian                  # edited notes re-sync; renames tracked
+  im sync connect repo --path ~/projects/my-app
+  im sync repo                      # after a commit, only changed files re-index
+  im sync status
+
+Per-connector delta state lives under ~/.config/integral-mind/sync/; a
+repeat run with no local changes pushes nothing. connect reuses an
+existing server-side registration with the same label, so reconnecting
+after a reinstall never duplicates sources.
+
+${EXIT_CODES_HELP}`,
+    hooks: `im hooks — Claude Code session auto-push
+
+Usage:
+  im hooks install claude      Wire the SessionEnd hook into ~/.claude/settings.json
+  im hooks uninstall claude    Remove it (other hooks untouched)
+
+Examples:
+  im hooks install claude
+  im hooks uninstall claude
+
+Install is idempotent. At session end the transcript is reshaped into
+the session envelope, redacted, and pushed; failures never block the
+Claude session (see ~/.local/state/integral-mind/hooks.log).
+
+${EXIT_CODES_HELP}`,
+    projects: `im projects — manage projects (requires an admin-scoped token)
+
+Usage:
+  im projects list [--json]
+  im projects create <name> [--json]
+
+Examples:
+  im projects list
+  im projects create "Planescape Campaign"
+
+${EXIT_CODES_HELP}`,
+    sources: `im sources — manage sources (requires an admin-scoped token)
+
+Usage:
+  im sources list [--project uuid] [--limit n] [--json]
+  im sources reparse <source-id>
+  im sources delete <source-id> [--force]
+
+Examples:
+  im sources list --limit 20
+  im sources reparse 3fa85f64-5717-4562-b3fc-2c963f66afa6
+  im sources delete 3fa85f64-5717-4562-b3fc-2c963f66afa6          # prompts
+  im sources delete 3fa85f64-5717-4562-b3fc-2c963f66afa6 --force  # scripted
+
+delete permanently removes the source, its chunks, and its summaries;
+without --force it asks you to type "yes" on stdin first.
+
+${EXIT_CODES_HELP}`,
+    tokens: `im tokens — manage MCP tokens (requires an admin-scoped token)
+
+Usage:
+  im tokens list [--json]
+  im tokens generate --name <name> --scopes <capture,search[,admin]> [--json]
+  im tokens revoke <token-id> [--force]
+
+Examples:
+  im tokens list
+  im tokens generate --name ci-agent --scopes capture,search
+  im tokens revoke 3fa85f64-5717-4562-b3fc-2c963f66afa6 --force
+
+generate prints the plaintext token ONCE — store it immediately; only a
+hash is kept server-side. revoke is immediate and permanent; without
+--force it asks you to type "yes" on stdin first.
+
+${EXIT_CODES_HELP}`,
+    docs: `im docs — print the canonical manual
+
+Usage:
+  im docs             Full manual (setup, commands, envelope, exit codes)
+  im docs --drop-in   ~10-line block for AGENTS.md / CLAUDE.md
+
+Example:
+  im docs --drop-in >> AGENTS.md
+
+${EXIT_CODES_HELP}`,
+};
+function maybeCommandHelp(command, args, stdio) {
+    // Only tokens before a `--` terminator count as help requests, so literal
+    // "-h"/"--help" payloads stay storable: `im push text -- -h`.
+    const terminator = args.indexOf("--");
+    const scanned = terminator === -1 ? args : args.slice(0, terminator);
+    if (!scanned.includes("--help") && !scanned.includes("-h"))
+        return false;
+    stdio.out(COMMAND_HELP[command] ?? USAGE);
+    return true;
+}
+export async function main(argv, env = process.env, stdio = { out: console.log, err: console.error }, readStdin = defaultReadStdin, readLine = defaultReadLine) {
+    const [command, ...rest] = argv;
+    try {
+        switch (command) {
+            case undefined:
+            case "help":
+            case "--help":
+            case "-h":
+                stdio.out(USAGE);
+                return command === undefined ? EXIT.USAGE : EXIT.OK;
+            case "config":
+                return await runConfig(rest, env, stdio);
+            case "push":
+                return await runPush(rest, env, stdio, readStdin);
+            case "search":
+                return await runSearch(rest, env, stdio);
+            case "sync": {
+                if (maybeCommandHelp("sync", rest, stdio))
+                    return EXIT.OK;
+                return await runSyncCommand(rest, env, stdio);
+            }
+            case "recent":
+                return await runRecent(rest, env, stdio);
+            case "stats":
+                return await runStats(rest, env, stdio);
+            case "projects":
+                return await runProjects(rest, env, stdio);
+            case "sources":
+                return await runSources(rest, env, stdio, readLine);
+            case "tokens":
+                return await runTokens(rest, env, stdio, readLine);
+            case "hooks":
+                return await runHooks(rest, env, stdio, readStdin);
+            case "docs": {
+                if (maybeCommandHelp("docs", rest, stdio))
+                    return EXIT.OK;
+                let dropIn = false;
+                try {
+                    const parsed = parseArgs({ args: rest, options: { "drop-in": { type: "boolean" } } });
+                    dropIn = parsed.values["drop-in"] === true;
+                }
+                catch {
+                    stdio.err("Usage: im docs [--drop-in]");
+                    return EXIT.USAGE;
+                }
+                stdio.out(dropIn ? DROP_IN_BLOCK : CANONICAL_DOC);
+                return EXIT.OK;
+            }
+            default:
+                stdio.err(`Unknown command: ${command}\n`);
+                stdio.out(USAGE);
+                return EXIT.USAGE;
+        }
+    }
+    catch (err) {
+        return reportError(err, stdio);
+    }
+}
+async function client(env, stdio) {
+    const resolved = await resolveConfig(env);
+    if ("error" in resolved) {
+        stdio.err(resolved.error);
+        return EXIT.USAGE;
+    }
+    const warning = await checkConfigPermissions(env);
+    if (warning)
+        stdio.err(warning);
+    return new ImClient(resolved);
+}
+async function runConfig(args, env, stdio) {
+    if (maybeCommandHelp("config", args, stdio))
+        return EXIT.OK;
+    const [sub, key, value] = args;
+    if (sub === "show") {
+        const file = await readConfigFile(env);
+        const url = env.INTEGRAL_MIND_URL ?? file.url;
+        const token = env.INTEGRAL_MIND_TOKEN ?? file.token;
+        stdio.out(`config file: ${configPath(env)}`);
+        stdio.out(`url:   ${url ?? "(unset)"}${env.INTEGRAL_MIND_URL ? " (from env)" : ""}`);
+        stdio.out(`token: ${token ? `…${token.slice(-4)}` : "(unset)"}${env.INTEGRAL_MIND_TOKEN ? " (from env)" : ""}`);
+        return EXIT.OK;
+    }
+    if (sub === "set" && (key === "url" || key === "token") && value) {
+        const path = await writeConfigFile({ [key]: value }, env);
+        stdio.out(`Saved ${key} to ${path}`);
+        return EXIT.OK;
+    }
+    stdio.err("Usage: im config set <url|token> <value> | im config show");
+    return EXIT.USAGE;
+}
+async function runPush(args, env, stdio, readStdin) {
+    if (maybeCommandHelp("push", args, stdio))
+        return EXIT.OK;
+    const [kind, ...rest] = args;
+    switch (kind) {
+        case "session":
+            return runPushSession(rest, env, stdio, readStdin);
+        case "text":
+        case "url":
+        case "youtube":
+        case "file":
+            return runPushCapture(kind, rest, env, stdio);
+        default:
+            stdio.err("Usage: im push <session|text|file|url|youtube> …");
+            return EXIT.USAGE;
+    }
+}
+async function runPushSession(args, env, stdio, readStdin) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            file: { type: "string" },
+            stdin: { type: "boolean" },
+            text: { type: "string" },
+            agent: { type: "string" },
+            title: { type: "string" },
+            project: { type: "string" },
+            "no-redact": { type: "boolean" },
+            json: { type: "boolean" },
+        },
+    });
+    let envelope;
+    if (values.text) {
+        envelope = {
+            agent: values.agent ?? "cli",
+            ...(values.title ? { title: values.title } : {}),
+            text: values.text,
+        };
+    }
+    else {
+        const raw = values.file
+            ? await readFile(values.file, "utf8")
+            : values.stdin
+                ? await readStdin()
+                : null;
+        if (raw === null) {
+            stdio.err("push session needs --file <envelope.json>, --stdin, or --text <content>");
+            return EXIT.USAGE;
+        }
+        try {
+            envelope = JSON.parse(raw);
+        }
+        catch {
+            stdio.err("Envelope is not valid JSON");
+            return EXIT.VALIDATION;
+        }
+        if (values.title)
+            envelope.title = values.title;
+    }
+    if (!values["no-redact"]) {
+        const findings = redactEnvelopeInPlace(envelope);
+        stdio.err(summarizeFindings(findings));
+    }
+    else {
+        stdio.err("redaction: SKIPPED (--no-redact)");
+    }
+    if (values.project)
+        envelope.project_id = values.project;
+    const im = await client(env, stdio);
+    if (typeof im === "number")
+        return im;
+    const result = await im.pushSession(envelope);
+    if (values.json) {
+        stdio.out(JSON.stringify(result, null, 2));
+    }
+    else {
+        stdio.out(`${result.deduplicated ? "Already known" : "Pushed"} session ${String(result.source_id)} (status: ${String(result.status)})`);
+    }
+    return EXIT.OK;
+}
+export function redactEnvelopeInPlace(envelope) {
+    const totals = new Map();
+    const scrub = (value) => {
+        const { text, findings } = redactSecrets(value);
+        for (const f of findings)
+            totals.set(f.type, (totals.get(f.type) ?? 0) + f.count);
+        return text;
+    };
+    if (typeof envelope.text === "string")
+        envelope.text = scrub(envelope.text);
+    if (typeof envelope.title === "string")
+        envelope.title = scrub(envelope.title);
+    if (Array.isArray(envelope.messages)) {
+        for (const message of envelope.messages) {
+            if (typeof message === "object" &&
+                message !== null &&
+                typeof message.content === "string") {
+                message.content = scrub(message.content);
+            }
+        }
+    }
+    return [...totals.entries()]
+        .map(([type, count]) => ({ type, count }))
+        .sort((a, b) => a.type.localeCompare(b.type));
+}
+async function runPushCapture(kind, args, env, stdio) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            title: { type: "string" },
+            project: { type: "string" },
+            json: { type: "boolean" },
+        },
+    });
+    const [subject] = positionals;
+    if (!subject) {
+        stdio.err(`Usage: im push ${kind} <${kind === "file" ? "path" : kind}> [--title] [--project]`);
+        return EXIT.USAGE;
+    }
+    let type = kind === "file" ? "text" : kind;
+    let content = subject;
+    let title = values.title;
+    if (kind === "file") {
+        // Thin client: file contents are captured as a text source; the
+        // dedicated multipart file type stays a webapp feature for now.
+        content = await readFile(subject, "utf8");
+        title ??= basename(subject);
+    }
+    const im = await client(env, stdio);
+    if (typeof im === "number")
+        return im;
+    const result = await im.callTool("capture", {
+        content,
+        type,
+        ...(title ? { title } : {}),
+        ...(values.project ? { project_id: values.project } : {}),
+    });
+    if (values.json) {
+        stdio.out(JSON.stringify(result, null, 2));
+    }
+    else {
+        stdio.out(`Captured ${String(result.type)} source ${String(result.source_id)} (status: ${String(result.status)})`);
+    }
+    return EXIT.OK;
+}
+async function runSearch(args, env, stdio) {
+    if (maybeCommandHelp("search", args, stdio))
+        return EXIT.OK;
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            limit: { type: "string" },
+            project: { type: "string" },
+            type: { type: "string", multiple: true },
+            after: { type: "string" },
+            before: { type: "string" },
+            code: { type: "boolean" },
+            sessions: { type: "boolean" },
+            json: { type: "boolean" },
+        },
+    });
+    const query = positionals.join(" ").trim();
+    if (!query) {
+        stdio.err("Usage: im search <query> [--limit n] [--project uuid] [--type t]... [--after date] [--before date] [--code] [--sessions]");
+        return EXIT.USAGE;
+    }
+    if (values.code && values.sessions) {
+        stdio.err("--code and --sessions are mutually exclusive");
+        return EXIT.USAGE;
+    }
+    if ((values.code || values.sessions) && values.type?.length) {
+        stdio.err(`--type cannot be combined with ${values.code ? "--code" : "--sessions"}`);
+        return EXIT.USAGE;
+    }
+    const im = await client(env, stdio);
+    if (typeof im === "number")
+        return im;
+    if (values.code)
+        return runCodeSearch(im, query, values, stdio);
+    if (values.sessions)
+        return runSessionSearch(im, query, values, stdio);
+    const result = (await im.callTool("search", {
+        query,
+        ...(values.limit ? { limit: Number(values.limit) } : {}),
+        ...(values.project ? { project_id: values.project } : {}),
+        ...(values.type?.length ? { source_types: values.type } : {}),
+        ...(values.after ? { after: values.after } : {}),
+        ...(values.before ? { before: values.before } : {}),
+    }));
+    const rows = result.results ?? [];
+    if (values.json) {
+        stdio.out(JSON.stringify(rows, null, 2));
+        return EXIT.OK;
+    }
+    if (rows.length === 0) {
+        stdio.out(`No results for "${query}".`);
+        return EXIT.OK;
+    }
+    for (const [i, row] of rows.entries()) {
+        stdio.out(`${i + 1}. [${row.source_title ?? row.source_id.slice(0, 8)} · chunk ${row.idx} · score ${row.score.toFixed(3)} · chars ${row.char_start}–${row.char_end}]`);
+        stdio.out(`   ${row.text.slice(0, 300).replaceAll("\n", "\n   ")}`);
+    }
+    return EXIT.OK;
+}
+async function runCodeSearch(im, query, values, stdio) {
+    const result = (await im.callTool("code_search", {
+        query,
+        ...(values.limit ? { limit: Number(values.limit) } : {}),
+        ...(values.project ? { project_id: values.project } : {}),
+        ...(values.after ? { after: values.after } : {}),
+        ...(values.before ? { before: values.before } : {}),
+    }));
+    const rows = result.results ?? [];
+    if (values.json) {
+        stdio.out(JSON.stringify(rows, null, 2));
+        return EXIT.OK;
+    }
+    if (rows.length === 0) {
+        stdio.out(`No code results for "${query}". Index a repo with \`im sync repo\`.`);
+        return EXIT.OK;
+    }
+    for (const [i, row] of rows.entries()) {
+        const location = `${row.path ?? row.source_title ?? row.source_id.slice(0, 8)}:${row.line_start ?? "?"}-${row.line_end ?? "?"}`;
+        stdio.out(`${i + 1}. [${location} · score ${row.score.toFixed(3)}]`);
+        stdio.out(`   ${row.text.slice(0, 300).replaceAll("\n", "\n   ")}`);
+    }
+    return EXIT.OK;
+}
+async function runSessionSearch(im, query, values, stdio) {
+    const result = (await im.callTool("session_search", {
+        query,
+        ...(values.limit ? { limit: Number(values.limit) } : {}),
+        ...(values.project ? { project_id: values.project } : {}),
+        ...(values.after ? { after: values.after } : {}),
+        ...(values.before ? { before: values.before } : {}),
+    }));
+    const rows = result.results ?? [];
+    if (values.json) {
+        stdio.out(JSON.stringify(rows, null, 2));
+        return EXIT.OK;
+    }
+    if (rows.length === 0) {
+        stdio.out(`No session results for "${query}". Push one with \`im push session\`.`);
+        return EXIT.OK;
+    }
+    for (const [i, row] of rows.entries()) {
+        stdio.out(`${i + 1}. [${row.source_title ?? row.source_id.slice(0, 8)} · ${row.source_type} · ${row.ingested_at.slice(0, 10)} · score ${row.score.toFixed(3)}]`);
+        stdio.out(`   ${row.text.slice(0, 300).replaceAll("\n", "\n   ")}`);
+    }
+    return EXIT.OK;
+}
+async function runRecent(args, env, stdio) {
+    if (maybeCommandHelp("recent", args, stdio))
+        return EXIT.OK;
+    const { values } = parseArgs({
+        args,
+        options: {
+            limit: { type: "string" },
+            project: { type: "string" },
+            json: { type: "boolean" },
+        },
+    });
+    const im = await client(env, stdio);
+    if (typeof im === "number")
+        return im;
+    const result = (await im.callTool("browse_recent", {
+        ...(values.limit ? { limit: Number(values.limit) } : {}),
+        ...(values.project ? { project_id: values.project } : {}),
+    }));
+    const sources = result.sources ?? [];
+    if (values.json) {
+        stdio.out(JSON.stringify(sources, null, 2));
+        return EXIT.OK;
+    }
+    if (sources.length === 0) {
+        stdio.out("No sources yet. Push one with `im push`.");
+        return EXIT.OK;
+    }
+    for (const s of sources) {
+        stdio.out(`• ${s.title ?? "(untitled)"} — ${s.type}, ${s.char_count.toLocaleString()} chars, ${s.parse_status}, ${s.ingested_at}`);
+    }
+    return EXIT.OK;
+}
+async function runStats(args, env, stdio) {
+    if (maybeCommandHelp("stats", args, stdio))
+        return EXIT.OK;
+    const { values } = parseArgs({ args, options: { json: { type: "boolean" } } });
+    const im = await client(env, stdio);
+    if (typeof im === "number")
+        return im;
+    const result = await im.callTool("stats", {});
+    if (values.json) {
+        stdio.out(JSON.stringify(result, null, 2));
+        return EXIT.OK;
+    }
+    stdio.out(`${String(result.source_count)} sources · ${String(result.chunk_count)} chunks · ${String(result.project_count)} projects`);
+    stdio.out(`Total AI cost: $${(Number(result.total_cost_cents ?? 0) / 100).toFixed(4)} · last ingested: ${String(result.last_ingested_at ?? "(never)")}`);
+    return EXIT.OK;
+}
+/**
+ * Confirmation gate for destructive admin commands: --force skips it;
+ * otherwise the user must type "yes" on stdin. Reads a single line (not
+ * until EOF), so an interactive prompt returns as soon as Enter is hit.
+ * Returns true to proceed.
+ */
+async function confirmDestructive(prompt, force, stdio, readLine) {
+    if (force)
+        return true;
+    stdio.err(`${prompt}\nType "yes" to confirm (or re-run with --force):`);
+    const answer = (await readLine()).trim().toLowerCase();
+    if (answer === "yes")
+        return true;
+    stdio.err("Aborted — nothing was changed.");
+    return false;
+}
+async function runProjects(args, env, stdio) {
+    if (maybeCommandHelp("projects", args, stdio))
+        return EXIT.OK;
+    const [sub, ...rest] = args;
+    if (sub === "list") {
+        const { values } = parseArgs({ args: rest, options: { json: { type: "boolean" } } });
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("GET", "/api/admin/projects");
+        if (values.json) {
+            stdio.out(JSON.stringify(result.projects, null, 2));
+            return EXIT.OK;
+        }
+        if (result.projects.length === 0) {
+            stdio.out("No projects yet. Create one with `im projects create <name>`.");
+            return EXIT.OK;
+        }
+        for (const p of result.projects) {
+            stdio.out(`• ${p.name} — ${p.id} · ${p.source_count} sources${p.archived ? " · archived" : ""}${p.tags.length ? ` · tags: ${p.tags.join(", ")}` : ""}`);
+        }
+        return EXIT.OK;
+    }
+    if (sub === "create") {
+        const { values, positionals } = parseArgs({
+            args: rest,
+            allowPositionals: true,
+            options: { json: { type: "boolean" } },
+        });
+        const name = positionals.join(" ").trim();
+        if (!name) {
+            stdio.err("Usage: im projects create <name>");
+            return EXIT.USAGE;
+        }
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("POST", "/api/admin/projects", { name });
+        if (values.json)
+            stdio.out(JSON.stringify(result.project, null, 2));
+        else
+            stdio.out(`Created project "${result.project.name}" (${result.project.id})`);
+        return EXIT.OK;
+    }
+    stdio.err("Usage: im projects <list|create> …");
+    return EXIT.USAGE;
+}
+async function runSources(args, env, stdio, readLine) {
+    if (maybeCommandHelp("sources", args, stdio))
+        return EXIT.OK;
+    const [sub, ...rest] = args;
+    if (sub === "list") {
+        const { values } = parseArgs({
+            args: rest,
+            options: {
+                project: { type: "string" },
+                limit: { type: "string" },
+                json: { type: "boolean" },
+            },
+        });
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const query = new URLSearchParams();
+        if (values.project)
+            query.set("project_id", values.project);
+        if (values.limit)
+            query.set("limit", values.limit);
+        const qs = query.size > 0 ? `?${query.toString()}` : "";
+        const result = await im.request("GET", `/api/admin/sources${qs}`);
+        if (values.json) {
+            stdio.out(JSON.stringify(result.sources, null, 2));
+            return EXIT.OK;
+        }
+        if (result.sources.length === 0) {
+            stdio.out("No sources found.");
+            return EXIT.OK;
+        }
+        for (const s of result.sources) {
+            stdio.out(`• ${s.title ?? "(untitled)"} — ${s.id} · ${s.type} · ${s.parse_status} · ${s.char_count.toLocaleString()} chars · ${s.ingested_at}`);
+        }
+        return EXIT.OK;
+    }
+    if (sub === "reparse") {
+        const { values, positionals } = parseArgs({
+            args: rest,
+            allowPositionals: true,
+            options: { json: { type: "boolean" } },
+        });
+        const [id] = positionals;
+        if (!id) {
+            stdio.err("Usage: im sources reparse <source-id>");
+            return EXIT.USAGE;
+        }
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("POST", `/api/admin/sources/${encodeURIComponent(id)}/reparse`);
+        if (result.warning)
+            stdio.err(`Warning: ${result.warning}`);
+        if (values.json)
+            stdio.out(JSON.stringify(result.source, null, 2));
+        else
+            stdio.out(`Re-parsing ${result.source.title ?? "(untitled)"} (${result.source.id}) — status: ${result.source.parse_status}`);
+        return EXIT.OK;
+    }
+    if (sub === "delete") {
+        const { values, positionals } = parseArgs({
+            args: rest,
+            allowPositionals: true,
+            options: { force: { type: "boolean" }, json: { type: "boolean" } },
+        });
+        const [id] = positionals;
+        if (!id) {
+            stdio.err("Usage: im sources delete <source-id> [--force]");
+            return EXIT.USAGE;
+        }
+        const proceed = await confirmDestructive(`This permanently deletes source ${id}, its chunks, and its summaries.`, values.force === true, stdio, readLine);
+        if (!proceed)
+            return EXIT.USAGE;
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("DELETE", `/api/admin/sources/${encodeURIComponent(id)}`);
+        if (values.json)
+            stdio.out(JSON.stringify(result.deleted, null, 2));
+        else
+            stdio.out(`Deleted ${result.deleted.title ?? "(untitled)"} (${result.deleted.id})`);
+        return EXIT.OK;
+    }
+    stdio.err("Usage: im sources <list|reparse|delete> …");
+    return EXIT.USAGE;
+}
+async function runTokens(args, env, stdio, readLine) {
+    if (maybeCommandHelp("tokens", args, stdio))
+        return EXIT.OK;
+    const [sub, ...rest] = args;
+    if (sub === "list") {
+        const { values } = parseArgs({ args: rest, options: { json: { type: "boolean" } } });
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("GET", "/api/admin/tokens");
+        if (values.json) {
+            stdio.out(JSON.stringify(result.tokens, null, 2));
+            return EXIT.OK;
+        }
+        if (result.tokens.length === 0) {
+            stdio.out("No tokens. Generate one with `im tokens generate`.");
+            return EXIT.OK;
+        }
+        for (const t of result.tokens) {
+            stdio.out(`• ${t.name} — …${t.last_four} · ${t.id} · scopes: ${t.scopes.join(",")}${t.revoked_at ? " · REVOKED" : t.last_used_at ? ` · last used ${t.last_used_at}` : " · never used"}`);
+        }
+        return EXIT.OK;
+    }
+    if (sub === "generate") {
+        const { values } = parseArgs({
+            args: rest,
+            options: {
+                name: { type: "string" },
+                scopes: { type: "string" },
+                json: { type: "boolean" },
+            },
+        });
+        const scopes = (values.scopes ?? "")
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        if (!values.name || scopes.length === 0) {
+            stdio.err("Usage: im tokens generate --name <name> --scopes <capture,search[,admin]>");
+            return EXIT.USAGE;
+        }
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("POST", "/api/admin/tokens", { name: values.name, scopes });
+        if (values.json) {
+            stdio.out(JSON.stringify(result.token, null, 2));
+            return EXIT.OK;
+        }
+        stdio.out(result.token.plaintext);
+        stdio.err(`Generated token "${result.token.name}" (${result.token.id}, scopes: ${result.token.scopes.join(",")}).\n` +
+            "The plaintext above is shown ONCE — store it now; only a hash is kept.");
+        return EXIT.OK;
+    }
+    if (sub === "revoke") {
+        const { values, positionals } = parseArgs({
+            args: rest,
+            allowPositionals: true,
+            options: { force: { type: "boolean" }, json: { type: "boolean" } },
+        });
+        const [id] = positionals;
+        if (!id) {
+            stdio.err("Usage: im tokens revoke <token-id> [--force]");
+            return EXIT.USAGE;
+        }
+        const proceed = await confirmDestructive(`This immediately and permanently revokes token ${id}; anything using it loses access.`, values.force === true, stdio, readLine);
+        if (!proceed)
+            return EXIT.USAGE;
+        const im = await client(env, stdio);
+        if (typeof im === "number")
+            return im;
+        const result = await im.request("DELETE", `/api/admin/tokens/${encodeURIComponent(id)}`);
+        if (values.json)
+            stdio.out(JSON.stringify(result.revoked, null, 2));
+        else
+            stdio.out(`Revoked token ${result.revoked.id}`);
+        return EXIT.OK;
+    }
+    stdio.err("Usage: im tokens <list|generate|revoke> …");
+    return EXIT.USAGE;
+}
+async function runHooks(args, env, stdio, readStdin) {
+    if (maybeCommandHelp("hooks", args, stdio))
+        return EXIT.OK;
+    const [action, target] = args;
+    if (action === "claude-session-end") {
+        // Invoked by Claude Code, never interactively. Always exits 0.
+        return await runClaudeSessionEnd(await readStdin(), defaultSessionEndDeps(env));
+    }
+    if (action === "install" && target === "claude") {
+        const outcome = await installClaudeHook(env);
+        stdio.out(outcome === "installed"
+            ? "Installed the Claude Code SessionEnd hook. Sessions push automatically from now on."
+            : "Claude Code SessionEnd hook already installed — nothing to do.");
+        return EXIT.OK;
+    }
+    if (action === "uninstall" && target === "claude") {
+        const outcome = await uninstallClaudeHook(env);
+        stdio.out(outcome === "uninstalled"
+            ? "Removed the Claude Code SessionEnd hook."
+            : "No Claude Code SessionEnd hook found — nothing to do.");
+        return EXIT.OK;
+    }
+    stdio.err("Usage: im hooks <install|uninstall> claude");
+    return EXIT.USAGE;
+}
+function reportError(err, stdio) {
+    if (err instanceof ApiError) {
+        stdio.err(`Error (${err.code}): ${err.message}`);
+        if (err.status === 401 || err.status === 403)
+            return EXIT.AUTH;
+        if (err.status === 404)
+            return EXIT.NOT_FOUND;
+        if (err.status === 400 || err.status === 409 || err.status === 422)
+            return EXIT.VALIDATION;
+        return EXIT.RUNTIME;
+    }
+    stdio.err(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    return EXIT.RUNTIME;
+}
+async function defaultReadStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+/**
+ * Read a single line from stdin — used by confirmation prompts, where
+ * waiting for EOF (defaultReadStdin) would hang an interactive terminal
+ * after the user presses Enter. Works for piped input too (`echo yes |`).
+ */
+async function defaultReadLine() {
+    const rl = createInterface({ input: process.stdin });
+    try {
+        for await (const line of rl)
+            return line;
+        return "";
+    }
+    finally {
+        rl.close();
+    }
+}
+// Run main() only when this module is the executed entrypoint — including
+// npm bin shims, where argv[1] is a symlink (im or integral-mind) that
+// realpaths to this file. Importing the module (tests) never triggers it.
+const isDirectRun = (() => {
+    if (!process.argv[1])
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+    }
+    catch {
+        return false;
+    }
+})();
+if (isDirectRun) {
+    main(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    });
+}
+//# sourceMappingURL=cli.js.map