memax-cli 0.1.0-alpha.9 → 0.1.0

package/dist/commands/setup.js

@@ -1,13 +1,29 @@
 import chalk from "chalk";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, } from "node:fs";
-import { join, dirname } from "node:path";
-import { homedir, platform } from "node:os";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { execSync } from "node:child_process";
-import { apiPost } from "../lib/api.js";
-import { loadConfig } from "../lib/config.js";
+import { createInterface } from "node:readline";
+import { commandExists, resolveMemaxBin, } from "./setup-types.js";
+import { ensureApiKey, ensureLocalAgentKey, setupMcpRemote, setupMcpOAuth, setupMcp, printMcpConfigs, removeMcpJson, removeMcpToml, } from "./setup-mcp.js";
+import { setupHooks, removeHooks } from "./setup-hooks.js";
+import { injectInstructions, removeInstructions, installSkills, removeSkills, } from "./setup-instructions.js";
+// --- Agent definitions ---
 function getAgents() {
     const home = homedir();
     const cwd = process.cwd();
+    // Helper: standard { type: "url", url, headers? } shape used by Cursor, Windsurf, OpenClaw
+    const stdUrlEntry = (url, headers) => ({
+        type: "url",
+        url,
+        ...(headers ? { headers } : {}),
+    });
+    // Helper: { type: "http", url, headers? } shape used by VS Code, Copilot CLI
+    const httpEntry = (url, headers) => ({
+        type: "http",
+        url,
+        ...(headers ? { headers } : {}),
+    });
     return [
         {
             name: "Claude Code",
@@ -18,6 +34,8 @@ function getAgents() {
             hasHooks: true,
             globalInstructionFile: join(home, ".claude", "CLAUDE.md"),
             detect: () => existsSync(join(home, ".claude")) || commandExists("claude"),
+            // Claude Code uses `claude mcp add` CLI, not JSON config — this is a fallback
+            remoteEntry: stdUrlEntry,
         },
         {
             name: "Cursor",
@@ -26,8 +44,9 @@ function getAgents() {
             format: "json-mcpServers",
             mcpKey: "mcpServers",
             hasHooks: false,
-            globalInstructionFile: null, // project-level .cursorrules only
+            globalInstructionFile: null,
             detect: () => existsSync(join(home, ".cursor")) || commandExists("cursor"),
+            remoteEntry: stdUrlEntry,
         },
         {
             name: "Windsurf",
@@ -36,9 +55,10 @@ function getAgents() {
             format: "json-mcpServers",
             mcpKey: "mcpServers",
             hasHooks: false,
-            globalInstructionFile: null, // project-level .windsurfrules only
+            globalInstructionFile: null,
             detect: () => existsSync(join(home, ".codeium", "windsurf")) ||
                 commandExists("windsurf"),
+            remoteEntry: stdUrlEntry,
         },
         {
             name: "Gemini CLI",
@@ -49,6 +69,11 @@ function getAgents() {
             hasHooks: true,
             globalInstructionFile: join(home, ".gemini", "GEMINI.md"),
             detect: () => existsSync(join(home, ".gemini")) || commandExists("gemini"),
+            // Gemini CLI uses httpUrl for streamable HTTP; url is its SSE field
+            remoteEntry: (url, headers) => ({
+                httpUrl: url,
+                ...(headers ? { headers } : {}),
+            }),
         },
         {
             name: "GitHub Copilot CLI",
@@ -57,8 +82,20 @@ function getAgents() {
             format: "json-mcpServers",
             mcpKey: "mcpServers",
             hasHooks: false,
-            globalInstructionFile: null, // uses .github/copilot-instructions.md (project-level)
+            globalInstructionFile: null,
             detect: () => existsSync(join(home, ".copilot")) || commandExists("gh copilot"),
+            // Copilot CLI requires type + url + tools for both remote and local servers
+            remoteEntry: (url, headers) => ({
+                type: "http",
+                url,
+                tools: [{ type: "function" }],
+                ...(headers ? { headers } : {}),
+            }),
+            localEntry: (command, args) => ({
+                command,
+                args,
+                tools: [{ type: "function" }],
+            }),
         },
         {
             name: "Copilot (VS Code)",
@@ -69,6 +106,8 @@ function getAgents() {
             hasHooks: false,
             globalInstructionFile: null,
             detect: () => existsSync(".vscode") || commandExists("code"),
+            // VS Code uses type: "http" for remote MCP servers
+            remoteEntry: httpEntry,
         },
         {
             name: "Codex CLI",
@@ -79,6 +118,8 @@ function getAgents() {
             hasHooks: false,
             globalInstructionFile: join(home, ".codex", "AGENTS.md"),
             detect: () => existsSync(join(home, ".codex")) || commandExists("codex"),
+            // Codex TOML is handled separately; this is for JSON fallback reference
+            remoteEntry: stdUrlEntry,
         },
         {
             name: "OpenClaw",
@@ -87,8 +128,9 @@ function getAgents() {
             format: "json-mcpServers",
             mcpKey: "mcp.servers",
             hasHooks: false,
-            globalInstructionFile: null, // OpenClaw has its own memory system
+            globalInstructionFile: null,
             detect: () => existsSync(join(home, ".openclaw")) || commandExists("openclaw"),
+            remoteEntry: stdUrlEntry,
         },
         {
             name: "OpenCode",
@@ -97,8 +139,19 @@ function getAgents() {
             format: "json-mcpServers",
             mcpKey: "mcp",
             hasHooks: false,
-            globalInstructionFile: null, // project-level only
+            globalInstructionFile: null,
             detect: () => existsSync(join(cwd, ".opencode")) || commandExists("opencode"),
+            // OpenCode uses type: "remote" for remote, type: "local" for local
+            remoteEntry: (url, headers) => ({
+                type: "remote",
+                url,
+                ...(headers ? { headers } : {}),
+            }),
+            localEntry: (command, args) => ({
+                type: "local",
+                command,
+                args,
+            }),
         },
     ];
 }
@@ -110,22 +163,50 @@ export async function setupCommand(options) {
         printUsage();
         return;
     }
+    if (options.hub && options.agentSync) {
+        console.error(chalk.red("\n  --agent-sync cannot be combined with --hub because hub-scoped MCP keys are restricted to that hub only.\n"));
+        process.exit(1);
+    }
+    // Hub scoping requires API key mode — OAuth grants are configured during
+    // the consent screen, not at setup time.
+    if (options.hub && !options.apiKey) {
+        console.error(chalk.red("\n  --hub requires --api-key because hub scoping is configured per API key.\n  Use: memax setup --mcp --api-key --hub <id>\n"));
+        process.exit(1);
+    }
+    // Permission flags only apply to remote API key mode — reject in OAuth and local mode
+    const permissionFlags = [
+        options.readOnly && "--read-only",
+        options.allowDelete && "--allow-delete",
+        options.allowOrganize && "--allow-organize",
+        options.agentSync && "--agent-sync",
+    ].filter(Boolean);
+    if (permissionFlags.length > 0 && (!options.apiKey || options.local)) {
+        console.error(chalk.red(`\n  ${permissionFlags.join(", ")} only apply to remote API key mode.\n  Use: memax setup --mcp --api-key ${permissionFlags.join(" ")}\n`));
+        process.exit(1);
+    }
+    // --api-key is meaningless with --local
+    if (options.apiKey && options.local) {
+        console.error(chalk.red("\n  --api-key and --local are mutually exclusive.\n  Use --api-key for remote API key mode, or --local for local CLI mode.\n"));
+        process.exit(1);
+    }
     // --print: just output config JSON for manual copy/paste
     if (options.print) {
-        await printMcpConfigs(options.local ?? false);
+        await printMcpConfigs({
+            local: options.local ?? false,
+            apiKey: options.apiKey ?? false,
+            hub: options.hub,
+            readOnly: options.readOnly,
+            allowDelete: options.allowDelete,
+            allowOrganize: options.allowOrganize,
+            agentSync: options.agentSync,
+        });
         return;
     }
-    // Remote mode (default): need API key for auth
+    // Remote mode (default): OAuth auto-discovery (no API key in config)
+    // --api-key: use per-agent API keys (legacy mode, for CI/CD or agents without OAuth)
+    // --local: use local CLI binary (memax mcp serve)
     const useRemote = !options.local;
-    let apiKey;
-    if (useRemote && enableMcp) {
-        apiKey = await ensureApiKey();
-        if (!apiKey) {
-            console.error(chalk.red("\n  Could not create API key. Log in first: memax login\n" +
-                "  Or use --local for local MCP server.\n"));
-            process.exit(1);
-        }
-    }
+    const useApiKey = options.apiKey ?? false;
     // Local mode: need memax binary
     let memaxBin = null;
     if (!useRemote || enableHooks) {
@@ -160,8 +241,11 @@ export async function setupCommand(options) {
         return;
     }
     console.log(chalk.bold("\n  Memax Setup\n"));
-    if (useRemote) {
-        console.log(chalk.gray("  Mode: remote server (recommended)\n"));
+    if (useRemote && useApiKey) {
+        console.log(chalk.gray("  Mode: remote server (API key)\n"));
+    }
+    else if (useRemote) {
+        console.log(chalk.gray("  Mode: remote server (OAuth)\n"));
     }
     else {
         console.log(chalk.gray("  Mode: local CLI\n"));
@@ -169,16 +253,38 @@ export async function setupCommand(options) {
     const results = [];
     for (const agent of agents) {
         const changes = [];
-        // MCP setup
+        // MCP setup — OAuth (default), API key (--api-key), or local (--local)
         if (enableMcp) {
             try {
-                if (useRemote) {
-                    setupMcpRemote(agent, apiKey);
+                if (useRemote && useApiKey) {
+                    // Legacy API key mode — creates per-agent key with agent_name
+                    const agentKey = await ensureApiKey(options.hub, agent.id, {
+                        readOnly: options.readOnly,
+                        allowDelete: options.allowDelete,
+                        allowOrganize: options.allowOrganize,
+                        agentSync: options.agentSync,
+                    });
+                    if (!agentKey) {
+                        console.error(chalk.red(`  ✗ ${agent.name}: Could not create API key. Run: memax login`));
+                        continue;
+                    }
+                    setupMcpRemote(agent, agentKey);
+                    changes.push("MCP server (API key)");
+                }
+                else if (useRemote) {
+                    // OAuth mode (default) — no API key in config, agent auto-discovers auth
+                    setupMcpOAuth(agent);
+                    changes.push("MCP server (OAuth)");
                 }
                 else {
+                    const localAgentKey = await ensureLocalAgentKey(agent.id);
+                    if (!localAgentKey) {
+                        console.error(chalk.red(`  ✗ ${agent.name}: Could not provision local agent key. Run: memax login`));
+                        continue;
+                    }
                     setupMcp(agent, memaxBin);
+                    changes.push("MCP server (local agent auth)");
                 }
-                changes.push(useRemote ? "MCP server (remote)" : "MCP server (local)");
             }
             catch (err) {
                 console.log(chalk.red(`  ✗ ${agent.name}: MCP setup failed — ${err.message}`));
@@ -203,6 +309,16 @@ export async function setupCommand(options) {
             catch (err) {
                 console.log(chalk.red(`  ✗ ${agent.name}: Instruction injection failed — ${err.message}`));
             }
+            // Install memax skills for agents that support skill directories
+            try {
+                const skillCount = await installSkills(agent);
+                if (skillCount > 0) {
+                    changes.push(`${skillCount} skill${skillCount > 1 ? "s" : ""} installed`);
+                }
+            }
+            catch (err) {
+                console.log(chalk.red(`  ✗ ${agent.name}: Skill install failed — ${err.message}`));
+            }
         }
         if (changes.length > 0) {
             results.push({ agent: agent.name, changes });
@@ -223,8 +339,8 @@ export async function setupCommand(options) {
     console.log(chalk.gray("\n  MCP tools available to all configured agents:"));
     console.log(chalk.gray("    • memax_recall — semantic search your knowledge"));
     console.log(chalk.gray("    • memax_push   — save knowledge from sessions"));
-    console.log(chalk.gray("    • memax_get    — read full note by ID"));
-    console.log(chalk.gray("    • memax_search — browse notes by category"));
+    console.log(chalk.gray("    • memax_get    — read full memory by ID"));
+    console.log(chalk.gray("    • memax_list   — browse memories"));
     if (enableHooks) {
         const hookAgents = results.filter((r) => r.changes.includes("Context injection hook"));
         if (hookAgents.length > 0) {
@@ -232,8 +348,32 @@ export async function setupCommand(options) {
             console.log(chalk.gray("  Every prompt gets relevant context injected automatically."));
         }
     }
-    console.log(chalk.gray("\n  Restart your agents for changes to take effect.\n"));
+    console.log(chalk.gray("\n  Restart your agents for changes to take effect."));
+    // Offer to restore configs from cloud if this looks like a new device
+    if (enableInstructions || options.all) {
+        try {
+            const { syncAgentMemoryCommand } = await import("./agent-configs.js");
+            const rl = createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const restore = await new Promise((resolve) => {
+                rl.question(chalk.gray("\n  Restore agent configs from Memax cloud? [Y/n] "), (answer) => {
+                    rl.close();
+                    resolve(answer.trim().toLowerCase() !== "n");
+                });
+            });
+            if (restore) {
+                await syncAgentMemoryCommand({ skipConflicts: true });
+            }
+        }
+        catch {
+            // Sync not available (not logged in, etc.) — skip silently
+        }
+    }
+    console.log();
 }
+// --- Teardown command ---
 export async function teardownCommand(options) {
     const allAgents = getAgents();
     const onlySet = options.only
@@ -248,13 +388,19 @@ export async function teardownCommand(options) {
             // Claude Code uses its own CLI
             if (agent.id === "claude-code") {
                 if (commandExists("claude")) {
-                    try {
-                        execSync("claude mcp remove memax", { stdio: "pipe" });
-                        console.log(chalk.gray(`  Removed MCP from ${agent.name}`));
-                        removed = true;
-                    }
-                    catch {
-                        // Not installed
+                    // Remove from both user and project scope to clean up old
+                    // (pre-scope) and new (user-scoped) installs
+                    for (const scope of ["--scope user", ""]) {
+                        try {
+                            execSync(`claude mcp remove memax ${scope}`.trim(), {
+                                stdio: "pipe",
+                            });
+                            console.log(chalk.gray(`  Removed MCP from ${agent.name}${scope ? " (user scope)" : " (project scope)"}`));
+                            removed = true;
+                        }
+                        catch {
+                            // Not installed in this scope
+                        }
                     }
                 }
                 if (agent.hasHooks && existsSync(agent.configPath)) {
@@ -285,6 +431,10 @@ export async function teardownCommand(options) {
                 console.log(chalk.gray(`  Removed instructions from ${agent.name}`));
                 removed = true;
             }
+            if (removeSkills(agent)) {
+                console.log(chalk.gray(`  Removed skills from ${agent.name}`));
+                removed = true;
+            }
         }
         catch {
             // Skip agents we can't clean up
@@ -296,482 +446,7 @@ export async function teardownCommand(options) {
     }
     console.log(chalk.green("\n  Memax integrations removed.\n  Restart your agents for changes to take effect.\n"));
 }
-// --- Remote MCP setup ---
-async function ensureApiKey() {
-    try {
-        const result = await apiPost("/v1/auth/api-keys", {
-            name: "mcp-setup",
-            expires_in_days: 0, // no expiry
-        });
-        return result.key;
-    }
-    catch {
-        return undefined;
-    }
-}
-function getApiUrl() {
-    return loadConfig().api_url;
-}
-function setupMcpRemote(agent, apiKey) {
-    const mcpUrl = `${getApiUrl()}/mcp`;
-    // Claude Code uses its own CLI
-    if (agent.id === "claude-code") {
-        if (!commandExists("claude")) {
-            throw new Error("claude CLI not found in PATH");
-        }
-        try {
-            execSync("claude mcp remove memax", { stdio: "pipe" });
-        }
-        catch {
-            // Not installed yet
-        }
-        // Claude Code HTTP transport
-        execSync(`claude mcp add memax --transport http ${mcpUrl} --header "Authorization: Bearer ${apiKey}"`, { stdio: "pipe" });
-        return;
-    }
-    // Codex TOML
-    if (agent.format === "toml") {
-        mkdirSync(dirname(agent.configPath), { recursive: true });
-        let content = "";
-        if (existsSync(agent.configPath)) {
-            content = readFileSync(agent.configPath, "utf-8");
-        }
-        content = content.replace(/\[mcp_servers\.memax\][\s\S]*?(?=\n\[|$)/, "");
-        content = content.trim();
-        if (content)
-            content += "\n\n";
-        content += `[mcp_servers.memax]\ntype = "url"\nurl = "${mcpUrl}"\n\n[mcp_servers.memax.headers]\nAuthorization = "Bearer ${apiKey}"\n`;
-        writeFileSync(agent.configPath, content);
-        return;
-    }
-    // JSON-based agents
-    mkdirSync(dirname(agent.configPath), { recursive: true });
-    let config = {};
-    if (existsSync(agent.configPath)) {
-        try {
-            config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        }
-        catch {
-            // Start fresh
-        }
-    }
-    const servers = (getNestedKey(config, agent.mcpKey) ?? {});
-    // Copilot CLI uses "http", others use "url" or no type field
-    const mcpType = agent.id === "copilot" ? "http" : "url";
-    servers.memax = {
-        type: mcpType,
-        url: mcpUrl,
-        headers: {
-            Authorization: `Bearer ${apiKey}`,
-        },
-    };
-    setNestedKey(config, agent.mcpKey, servers);
-    writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-}
-async function printMcpConfigs(local) {
-    const apiUrl = getApiUrl();
-    console.log(chalk.bold("\n  Memax MCP Configuration\n"));
-    if (local) {
-        const bin = resolveMemaxBin();
-        const cmd = bin ? bin.command : "memax";
-        const args = bin ? [...bin.args, "mcp", "serve"] : ["mcp", "serve"];
-        console.log(chalk.gray("  Mode: local (stdio)\n"));
-        console.log(chalk.white("  For most agents (Claude Code, Cursor, Gemini, etc.):\n"));
-        console.log(JSON.stringify({
-            mcpServers: {
-                memax: { command: cmd, args },
-            },
-        }, null, 2)
-            .split("\n")
-            .map((l) => "  " + l)
-            .join("\n"));
-    }
-    else {
-        let apiKey;
-        try {
-            apiKey = await ensureApiKey();
-        }
-        catch {
-            // Not logged in
-        }
-        const keyDisplay = apiKey ?? "mxk_your_api_key_here";
-        const mcpUrl = `${apiUrl}/mcp`;
-        console.log(chalk.gray("  Mode: remote server (recommended)\n"));
-        console.log(chalk.white("  For Claude Code:\n"));
-        console.log(chalk.gray(`  claude mcp add memax --transport http ${mcpUrl} --header "Authorization: Bearer ${keyDisplay}"`));
-        console.log(chalk.white("\n  For Cursor, Copilot, Gemini, Windsurf:\n"));
-        console.log(JSON.stringify({
-            mcpServers: {
-                memax: {
-                    type: "url",
-                    url: mcpUrl,
-                    headers: {
-                        Authorization: `Bearer ${keyDisplay}`,
-                    },
-                },
-            },
-        }, null, 2)
-            .split("\n")
-            .map((l) => "  " + l)
-            .join("\n"));
-        console.log(chalk.white("\n  For Codex CLI (~/.codex/config.toml):\n"));
-        console.log(chalk.gray(`  [mcp_servers.memax]`));
-        console.log(chalk.gray(`  type = "url"`));
-        console.log(chalk.gray(`  url = "${mcpUrl}"`));
-        console.log(chalk.gray(`\n  [mcp_servers.memax.headers]`));
-        console.log(chalk.gray(`  Authorization = "Bearer ${keyDisplay}"`));
-        if (apiKey) {
-            console.log(chalk.yellow("\n  API key created: mcp-setup"));
-            console.log(chalk.gray("  Manage keys: memax auth list-keys"));
-        }
-        else {
-            console.log(chalk.yellow("\n  Not logged in — replace mxk_your_api_key_here with a real key."));
-            console.log(chalk.gray("  Run: memax login && memax auth create-key --name mcp"));
-        }
-    }
-    console.log();
-}
-// --- Local MCP setup per agent ---
-function setupMcp(agent, bin) {
-    // Claude Code has its own CLI for MCP management
-    if (agent.id === "claude-code") {
-        setupMcpClaudeCode(bin);
-        return;
-    }
-    mkdirSync(dirname(agent.configPath), { recursive: true });
-    if (agent.format === "toml") {
-        setupMcpToml(agent, bin);
-        return;
-    }
-    // JSON-based agents
-    let config = {};
-    if (existsSync(agent.configPath)) {
-        try {
-            config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        }
-        catch {
-            // Start fresh
-        }
-    }
-    const servers = (getNestedKey(config, agent.mcpKey) ?? {});
-    servers.memax = {
-        command: bin.command,
-        args: [...bin.args, "mcp", "serve"],
-    };
-    setNestedKey(config, agent.mcpKey, servers);
-    writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-}
-function setupMcpClaudeCode(bin) {
-    // Claude Code uses its own CLI for MCP — settings.json mcpServers is ignored
-    if (!commandExists("claude")) {
-        throw new Error("claude CLI not found in PATH");
-    }
-    // Remove existing first (idempotent)
-    try {
-        execSync("claude mcp remove memax", { stdio: "pipe" });
-    }
-    catch {
-        // Not installed yet — fine
-    }
-    // claude mcp add <name> -- <command> [args...]
-    const allArgs = [...bin.args, "mcp", "serve"];
-    const cmd = `claude mcp add memax -- ${bin.command} ${allArgs.join(" ")}`;
-    try {
-        execSync(cmd, { stdio: "pipe" });
-    }
-    catch (err) {
-        throw new Error(`claude mcp add failed: ${err.message}`);
-    }
-}
-function setupMcpToml(agent, bin) {
-    // Codex uses TOML — append or update the memax section
-    let content = "";
-    if (existsSync(agent.configPath)) {
-        content = readFileSync(agent.configPath, "utf-8");
-    }
-    // Remove existing memax section if present
-    content = content.replace(/\[mcp_servers\.memax\][\s\S]*?(?=\n\[|$)/, "");
-    const args = [...bin.args, "mcp", "serve"].map((a) => `"${a}"`).join(", ");
-    content = content.trim();
-    if (content)
-        content += "\n\n";
-    content += `[mcp_servers.memax]\ncommand = "${bin.command}"\nargs = [${args}]\n`;
-    writeFileSync(agent.configPath, content);
-}
-// --- Hook setup ---
-function setupHooks(agent, bin) {
-    if (agent.id === "claude-code") {
-        setupClaudeCodeHooks(agent, bin);
-    }
-    else if (agent.id === "gemini") {
-        setupGeminiHooks(agent, bin);
-    }
-}
-function setupClaudeCodeHooks(agent, bin) {
-    const hookScript = writeHookScript(bin);
-    let config = {};
-    if (existsSync(agent.configPath)) {
-        try {
-            config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        }
-        catch {
-            // Start fresh
-        }
-    }
-    const hooks = (config.hooks ?? {});
-    // Remove existing memax hooks
-    if (hooks["UserPromptSubmit"]) {
-        hooks["UserPromptSubmit"] = hooks["UserPromptSubmit"].filter((h) => !h.hooks?.some((hh) => hh.command?.includes("memax")));
-    }
-    hooks["UserPromptSubmit"] = [
-        ...(hooks["UserPromptSubmit"] ?? []),
-        {
-            matcher: "",
-            hooks: [{ type: "command", command: hookScript, timeout: 30 }],
-        },
-    ];
-    config.hooks = hooks;
-    writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-}
-function setupGeminiHooks(agent, bin) {
-    const hookScript = writeHookScript(bin);
-    let config = {};
-    if (existsSync(agent.configPath)) {
-        try {
-            config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        }
-        catch {
-            // Start fresh
-        }
-    }
-    const hooks = (config.hooks ?? {});
-    // Remove existing memax hooks from both old ("Startup") and correct event
-    for (const event of ["Startup", "BeforeAgent"]) {
-        if (hooks[event]) {
-            hooks[event] = hooks[event].filter((h) => !h.hooks?.some((hh) => hh.command?.includes("memax")));
-            if (hooks[event].length === 0)
-                delete hooks[event];
-        }
-    }
-    // BeforeAgent fires after user submits a prompt — equivalent to Claude Code's PrePromptSubmit
-    hooks["BeforeAgent"] = [
-        ...(hooks["BeforeAgent"] ?? []),
-        {
-            matcher: "",
-            hooks: [{ type: "command", command: hookScript, timeout: 30 }],
-        },
-    ];
-    config.hooks = hooks;
-    writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-}
-// --- Teardown helpers ---
-function removeMcpJson(agent) {
-    if (!existsSync(agent.configPath))
-        return false;
-    try {
-        const config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        const servers = getNestedKey(config, agent.mcpKey);
-        if (!servers?.memax)
-            return false;
-        delete servers.memax;
-        if (Object.keys(servers).length === 0)
-            deleteNestedKey(config, agent.mcpKey);
-        writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-        console.log(chalk.gray(`  Removed MCP from ${agent.name}`));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function removeMcpToml(agent) {
-    if (!existsSync(agent.configPath))
-        return false;
-    let content = readFileSync(agent.configPath, "utf-8");
-    const before = content;
-    content = content.replace(/\[mcp_servers\.memax\][\s\S]*?(?=\n\[|$)/, "");
-    if (content === before)
-        return false;
-    writeFileSync(agent.configPath, content.trim() + "\n");
-    console.log(chalk.gray(`  Removed MCP from ${agent.name}`));
-    return true;
-}
-function removeHooks(agent) {
-    if (!existsSync(agent.configPath))
-        return false;
-    try {
-        const config = JSON.parse(readFileSync(agent.configPath, "utf-8"));
-        const hooks = config.hooks;
-        if (!hooks)
-            return false;
-        let removed = false;
-        for (const event of Object.keys(hooks)) {
-            const before = hooks[event].length;
-            hooks[event] = hooks[event].filter((h) => !h.command?.includes("memax") &&
-                !h.hooks?.some((hh) => hh.command?.includes("memax")));
-            if (hooks[event].length < before)
-                removed = true;
-            if (hooks[event].length === 0)
-                delete hooks[event];
-        }
-        if (Object.keys(hooks).length === 0)
-            delete config.hooks;
-        if (removed) {
-            writeFileSync(agent.configPath, JSON.stringify(config, null, 2) + "\n");
-            console.log(chalk.gray(`  Removed hooks from ${agent.name}`));
-        }
-        return removed;
-    }
-    catch {
-        return false;
-    }
-}
-function resolveMemaxBin() {
-    // 1. Global install — use absolute path so agents find it without shell PATH
-    if (commandExists("memax")) {
-        try {
-            const which = platform() === "win32" ? "where memax" : "which memax";
-            const absPath = execSync(which, { encoding: "utf-8", stdio: "pipe" })
-                .trim()
-                .split("\n")[0];
-            if (absPath) {
-                return { command: absPath, args: [], shell: absPath };
-            }
-        }
-        catch {
-            // fall through
-        }
-        return { command: "memax", args: [], shell: "memax" };
-    }
-    // 2. Local repo build (faster than npx, always up-to-date during dev)
-    const localBuild = join(process.cwd(), "packages", "cli", "dist", "index.js");
-    if (existsSync(localBuild)) {
-        return {
-            command: "node",
-            args: [localBuild],
-            shell: `node ${localBuild}`,
-        };
-    }
-    // 3. npx as last resort (slow startup — agents may timeout on first run)
-    try {
-        execSync("npx --yes memax-cli --version", {
-            encoding: "utf-8",
-            timeout: 15000,
-            stdio: "pipe",
-        });
-        return {
-            command: "npx",
-            args: ["-y", "memax-cli"],
-            shell: "npx -y memax-cli",
-        };
-    }
-    catch {
-        // npx failed
-    }
-    return null;
-}
-function commandExists(cmd) {
-    try {
-        const which = platform() === "win32" ? "where" : "which";
-        execSync(`${which} ${cmd}`, { stdio: "pipe" });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-// Nested key helpers for configs like openclaw's "mcp.servers"
-function getNestedKey(obj, key) {
-    const parts = key.split(".");
-    let current = obj;
-    for (const part of parts) {
-        if (current == null || typeof current !== "object")
-            return undefined;
-        current = current[part];
-    }
-    return current;
-}
-function setNestedKey(obj, key, value) {
-    const parts = key.split(".");
-    let current = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-        if (!(parts[i] in current) || typeof current[parts[i]] !== "object") {
-            current[parts[i]] = {};
-        }
-        current = current[parts[i]];
-    }
-    current[parts[parts.length - 1]] = value;
-}
-function deleteNestedKey(obj, key) {
-    const parts = key.split(".");
-    let current = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-        if (!(parts[i] in current) || typeof current[parts[i]] !== "object")
-            return;
-        current = current[parts[i]];
-    }
-    delete current[parts[parts.length - 1]];
-}
-// --- Instruction injection ---
-const MEMAX_INSTRUCTION_BLOCK = `
-<!-- memax:start -->
-## Memax — Persistent Memory
-
-You have access to Memax, a persistent cloud knowledge hub shared across all your AI agents.
-Use it proactively — don't wait for the user to ask.
-
-**At session start:** Use memax_recall to check for relevant context about the current project or task.
-**During work:** When you discover important decisions, architecture details, debugging solutions,
-or useful context — use memax_push to save them for future sessions.
-**At session end:** Summarize key decisions, learnings, or context worth remembering and push them.
-
-**What to remember:** Architecture decisions, API conventions, deployment processes, debugging
-solutions, team preferences, project-specific knowledge. If you'd want to know it in a future
-session, push it now.
-
-**What NOT to remember:** Ephemeral task details, file contents (they're in git), obvious things.
-
-Available tools: memax_recall (search), memax_push (save), memax_get (read full note),
-memax_search (browse), memax_forget (delete outdated memories).
-<!-- memax:end -->
-`.trim();
-function injectInstructions(filePath) {
-    mkdirSync(dirname(filePath), { recursive: true });
-    let content = "";
-    if (existsSync(filePath)) {
-        content = readFileSync(filePath, "utf-8");
-    }
-    // Remove existing memax block (idempotent)
-    content = content.replace(/\n?<!-- memax:start -->[\s\S]*?<!-- memax:end -->\n?/, "");
-    // Append the block
-    content = content.trimEnd() + "\n\n" + MEMAX_INSTRUCTION_BLOCK + "\n";
-    writeFileSync(filePath, content);
-}
-function removeInstructions(filePath) {
-    if (!existsSync(filePath))
-        return false;
-    const content = readFileSync(filePath, "utf-8");
-    const cleaned = content.replace(/\n?<!-- memax:start -->[\s\S]*?<!-- memax:end -->\n?/, "");
-    if (cleaned === content)
-        return false;
-    writeFileSync(filePath, cleaned.trimEnd() + "\n");
-    return true;
-}
-function writeHookScript(bin) {
-    const hooksDir = join(homedir(), ".memax", "hooks");
-    mkdirSync(hooksDir, { recursive: true });
-    const isWindows = platform() === "win32";
-    const scriptName = isWindows ? "context-inject.cmd" : "context-inject.sh";
-    const scriptPath = join(hooksDir, scriptName);
-    if (isWindows) {
-        writeFileSync(scriptPath, WIN_HOOK.replace(/\$MEMAX/g, bin.shell));
-    }
-    else {
-        writeFileSync(scriptPath, UNIX_HOOK.replace(/\$MEMAX/g, bin.shell));
-        chmodSync(scriptPath, 0o755);
-    }
-    return scriptPath;
-}
+// --- Usage ---
 function printUsage() {
     const agents = getAgents();
     const detected = agents.filter((a) => a.detect());
@@ -789,8 +464,11 @@ function printUsage() {
     console.log(chalk.gray("    memax setup --instructions      Inject memax usage instructions into agent configs"));
     console.log(chalk.gray("    memax setup --all               MCP + hooks + instructions"));
     console.log(chalk.gray("    memax setup --mcp --local       Use local CLI instead of remote server"));
+    console.log(chalk.gray("    memax setup --mcp --api-key     Use API keys instead of OAuth (CI/CD)"));
     console.log(chalk.gray("    memax setup --print        Print MCP config to copy/paste"));
     console.log(chalk.gray("    memax setup --mcp --only claude-code,cursor"));
+    console.log(chalk.gray("    memax setup --mcp --read-only"));
+    console.log(chalk.gray("    memax setup --mcp --hub memax-team --allow-organize"));
     console.log(chalk.gray("    memax teardown             Remove all integrations\n"));
     console.log(chalk.gray("  Supported agents:"));
     for (const a of agents) {
@@ -801,25 +479,29 @@ function printUsage() {
     }
     console.log();
 }
-const UNIX_HOOK = `#!/bin/bash
-# Memax context injection — installed by: memax setup --hooks
-set -e
-INPUT=$(cat)
-PROMPT=$(echo "$INPUT" | jq -r '.prompt // empty')
-CWD=$(echo "$INPUT" | jq -r '.cwd // empty')
-if [ -z "$PROMPT" ] || [ \${#PROMPT} -lt 10 ]; then exit 0; fi
-case "$PROMPT" in [Yy]|[Yy]es|[Nn]|[Nn]o|ok|OK|sure|Sure|thanks|Thanks|y|n) exit 0 ;; esac
-if [ -n "$CWD" ]; then cd "$CWD" 2>/dev/null || true; fi
-CONTEXT=$($MEMAX recall "$PROMPT" --hook --limit 5 --max-tokens 3000 2>/dev/null) || exit 0
-if [ -n "$CONTEXT" ] && [ "$CONTEXT" != "<memax-context>" ]; then echo "$CONTEXT"; fi
-exit 0
-`;
-const WIN_HOOK = `@echo off
-REM Memax context injection — installed by: memax setup --hooks
-set /p INPUT=
-for /f "tokens=*" %%a in ('echo %INPUT% ^| jq -r ".prompt // empty"') do set PROMPT=%%a
-if "%PROMPT%"=="" exit /b 0
-$MEMAX recall "%PROMPT%" --hook --limit 5 --max-tokens 3000 2>nul
-exit /b 0
-`;
+export function registerSetupCommands(program) {
+    program
+        .command("setup")
+        .description("Set up AI agent integrations (auto-detects installed agents)")
+        .option("--mcp", "Enable MCP server (agent tools)")
+        .option("--hooks", "Enable context injection hooks")
+        .option("--instructions", "Inject memax instructions into agent config files")
+        .option("--all", "Enable MCP + hooks + instructions")
+        .option("--local", "Use local stdio MCP instead of remote server")
+        .option("--api-key", "Use per-agent API keys instead of OAuth (for CI/CD or agents without OAuth support)")
+        .option("--print", "Print MCP config JSON to copy/paste (no changes made)")
+        .option("--only <agents>", "Only configure these agents (comma-separated)")
+        .option("--skip <agents>", "Skip these agents (comma-separated)")
+        .option("--hub <id>", "Scope MCP key to a specific hub")
+        .option("--read-only", "Create remote MCP keys without write access")
+        .option("--allow-delete", "Allow remote MCP keys to delete memories")
+        .option("--allow-organize", "Allow remote MCP keys to organize topics and run dreams")
+        .option("--agent-sync", "Allow remote MCP keys to sync agent configs and sessions")
+        .action(setupCommand);
+    program
+        .command("teardown")
+        .description("Remove Memax integrations from agents")
+        .option("--only <agents>", "Only remove from these agents (comma-separated)")
+        .action(teardownCommand);
+}
 //# sourceMappingURL=setup.js.map