nlm-memory 0.4.1 → 0.5.0

package/dist/install/claude-code.js

@@ -43,7 +43,7 @@ export function installClaudeCodeHooks(opts) {
     const installed = [];
     for (const spec of opts.hooks) {
         try {
-            const command = opts.buildHookCommand(opts.nodeExecPath, spec.script, "shadow");
+            const command = opts.buildHookCommand(opts.nodeExecPath, spec.script, "live");
             opts.addHook(opts.settingsPath, command, spec.event);
             const smoke = opts.smokeTestHookCommand(command, opts.hookLogPath);
             if (!smoke.ok) {

package/dist/install/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/install/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsB1C,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gFAAgF,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA8B;IAC9D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3E,MAAM,cAAc,GAAG,YAAY,IAAI,UAAU,CAAC;IAElD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,UAAU,CAAC,YAAY,CAAC,GAAG;YACzB,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;SAC/B,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;QAClC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;AAC5G,CAAC;AA4BD,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC;oBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClG,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAwC,CAAC;IAE/E,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC;QAChC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC;AACrF,CAAC"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/install/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsB1C,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gFAAgF,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA8B;IAC9D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3E,MAAM,cAAc,GAAG,YAAY,IAAI,UAAU,CAAC;IAElD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,UAAU,CAAC,YAAY,CAAC,GAAG;YACzB,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;SAC/B,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;QAClC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;AAC5G,CAAC;AA4BD,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC;oBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClG,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAwC,CAAC;IAE/E,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC;QAChC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC;AACrF,CAAC"}

package/dist/install/cursor.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `nlm connect cursor` / `nlm disconnect cursor` — registers or removes the
+ * Cursor adapter source in the NLM source registry.
+ *
+ * Unlike plugin-based runtimes (hermes-agent, codex), Cursor needs no file
+ * to be installed. NLM reads Cursor's existing state.vscdb directly. The
+ * connect operation only registers the source row so the daemon scans it.
+ */
+import type { SourceRegistry } from "../core/sources/source-registry.js";
+export interface ConnectCursorOptions {
+    readonly dbPath?: string;
+    readonly dryRun?: boolean;
+}
+export interface ConnectCursorReport {
+    readonly adapterDbPath: string;
+    readonly adapterExists: boolean;
+    readonly action: "created" | "enabled" | "already-active" | "dry-run";
+}
+export interface DisconnectCursorReport {
+    readonly action: "disabled" | "not-found" | "dry-run";
+}
+export declare function connectCursor(registry: SourceRegistry, opts?: ConnectCursorOptions): ConnectCursorReport;
+export declare function disconnectCursor(registry: SourceRegistry, opts?: {
+    dryRun?: boolean;
+}): DisconnectCursorReport;

package/dist/install/cursor.js

@@ -0,0 +1,43 @@
+/**
+ * `nlm connect cursor` / `nlm disconnect cursor` — registers or removes the
+ * Cursor adapter source in the NLM source registry.
+ *
+ * Unlike plugin-based runtimes (hermes-agent, codex), Cursor needs no file
+ * to be installed. NLM reads Cursor's existing state.vscdb directly. The
+ * connect operation only registers the source row so the daemon scans it.
+ */
+import { existsSync } from "node:fs";
+import { defaultDbPath } from "../core/adapters/cursor.js";
+export function connectCursor(registry, opts = {}) {
+    const adapterDbPath = opts.dbPath ?? defaultDbPath();
+    const adapterExists = existsSync(adapterDbPath);
+    if (opts.dryRun) {
+        return { adapterDbPath, adapterExists, action: "dry-run" };
+    }
+    const existing = registry.getByName("Cursor");
+    if (existing) {
+        if (existing.enabled && existing.pathOrUrl === adapterDbPath) {
+            return { adapterDbPath, adapterExists, action: "already-active" };
+        }
+        registry.update(existing.id, { enabled: true, pathOrUrl: adapterDbPath });
+        return { adapterDbPath, adapterExists, action: "enabled" };
+    }
+    registry.insert({
+        kind: "cursor",
+        name: "Cursor",
+        pathOrUrl: adapterDbPath,
+        runtimeLabel: "cursor/1.0",
+        enabled: adapterExists,
+    });
+    return { adapterDbPath, adapterExists, action: "created" };
+}
+export function disconnectCursor(registry, opts = {}) {
+    if (opts.dryRun)
+        return { action: "dry-run" };
+    const existing = registry.getByName("Cursor");
+    if (!existing)
+        return { action: "not-found" };
+    registry.update(existing.id, { enabled: false });
+    return { action: "disabled" };
+}
+//# sourceMappingURL=cursor.js.map

package/dist/install/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/install/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAkB3D,MAAM,UAAU,aAAa,CAC3B,QAAwB,EACxB,OAA6B,EAAE;IAE/B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAEhD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,aAAa;QACxB,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAwB,EACxB,OAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/install/nlm-dir-perms.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Idempotent permission hardening for ~/.nlm/.
+ *
+ * Recursively sets owner-only perms on the daemon's working directory:
+ *   directories → 0o700
+ *   files       → 0o600
+ *
+ * Run at every `nlm setup`, `nlm install`, and `nlm start` so installs
+ * predating v0.4.2 (when explicit chmod was added) self-heal on next
+ * launch. No-op on Windows — ACLs are the POSIX equivalent and out of
+ * scope here.
+ */
+export interface PermsHardenResult {
+    readonly nlmDir: string;
+    readonly filesHardened: number;
+    readonly dirsHardened: number;
+    readonly skipped: number;
+}
+export declare function hardenNlmDirPermissions(nlmDir?: string): PermsHardenResult;

package/dist/install/nlm-dir-perms.js

@@ -0,0 +1,43 @@
+/**
+ * Idempotent permission hardening for ~/.nlm/.
+ *
+ * Recursively sets owner-only perms on the daemon's working directory:
+ *   directories → 0o700
+ *   files       → 0o600
+ *
+ * Run at every `nlm setup`, `nlm install`, and `nlm start` so installs
+ * predating v0.4.2 (when explicit chmod was added) self-heal on next
+ * launch. No-op on Windows — ACLs are the POSIX equivalent and out of
+ * scope here.
+ */
+import { chmodSync, existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function hardenNlmDirPermissions(nlmDir = join(homedir(), ".nlm")) {
+    const result = { nlmDir, filesHardened: 0, dirsHardened: 0, skipped: 0 };
+    if (process.platform === "win32")
+        return result;
+    if (!existsSync(nlmDir))
+        return result;
+    walk(nlmDir, result);
+    return result;
+}
+function walk(path, r) {
+    try {
+        const s = statSync(path);
+        if (s.isDirectory()) {
+            chmodSync(path, 0o700);
+            r.dirsHardened += 1;
+            for (const name of readdirSync(path))
+                walk(join(path, name), r);
+        }
+        else if (s.isFile()) {
+            chmodSync(path, 0o600);
+            r.filesHardened += 1;
+        }
+    }
+    catch {
+        r.skipped += 1;
+    }
+}
+//# sourceMappingURL=nlm-dir-perms.js.map

package/dist/install/nlm-dir-perms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nlm-dir-perms.js","sourceRoot":"","sources":["../../src/install/nlm-dir-perms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,MAAM,UAAU,uBAAuB,CACrC,SAAiB,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;IAExC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,SAAS,IAAI,CAAC,IAAY,EAAE,CAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/install/ollama.d.ts

@@ -47,8 +47,25 @@ export declare function waitForOllamaServer(maxAttempts?: number, intervalMs?: n
  */
 export declare function pullEmbeddingModel(): OllamaResult;
 export type ClassifierChoice = "deepseek" | "ollama-offline";
+export interface ClassifierConfigInput {
+    readonly choice: ClassifierChoice;
+    readonly model?: string;
+    readonly apiKey?: string;
+}
 /**
  * Write classifier config to ~/.nlm/.env. Merges into the existing file —
  * only the lines we manage are updated; anything the user added by hand stays.
+ *
+ * Manages three keys: DEEPSEEK_API_KEY, NLM_CLASSIFIER, NLM_CLASSIFIER_MODEL.
+ * Backwards-compatible: passing positional (choice, apiKey) still works.
+ */
+export declare function writeClassifierConfig(choiceOrInput: ClassifierChoice | ClassifierConfigInput, apiKey?: string): void;
+/**
+ * Generate and persist an NLM_MCP_TOKEN if one isn't already set. Returns
+ * the token that's active for this process. Called during setup and on
+ * `nlm start` so installs that pre-date token-gated /api/* still get
+ * Bearer-protected without operator intervention.
+ *
+ * Token is hex-encoded crypto.randomBytes — 64 chars, 256 bits of entropy.
  */
-export declare function writeClassifierConfig(choice: ClassifierChoice, apiKey?: string): void;
+export declare function ensureMcpToken(): string;

package/dist/install/ollama.js

@@ -11,10 +11,11 @@
  *   Linux  — official install.sh / systemctl / detached spawn
  *   Windows — winget install / detached spawn
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join } from "node:path";
 import { spawnSync, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 export const EMBEDDING_MODEL = "nomic-embed-text";
 const OS = platform();
 // ── Detection ─────────────────────────────────────────────────────────────
@@ -154,25 +155,82 @@ export function pullEmbeddingModel() {
 /**
  * Write classifier config to ~/.nlm/.env. Merges into the existing file —
  * only the lines we manage are updated; anything the user added by hand stays.
+ *
+ * Manages three keys: DEEPSEEK_API_KEY, NLM_CLASSIFIER, NLM_CLASSIFIER_MODEL.
+ * Backwards-compatible: passing positional (choice, apiKey) still works.
  */
-export function writeClassifierConfig(choice, apiKey) {
+export function writeClassifierConfig(choiceOrInput, apiKey) {
+    const input = typeof choiceOrInput === "string"
+        ? { choice: choiceOrInput, ...(apiKey !== undefined ? { apiKey } : {}) }
+        : choiceOrInput;
     const envPath = join(homedir(), ".nlm", ".env");
-    mkdirSync(join(homedir(), ".nlm"), { recursive: true });
+    const nlmDir = join(homedir(), ".nlm");
+    mkdirSync(nlmDir, { recursive: true, mode: 0o700 });
+    chmodSync(nlmDir, 0o700);
     const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
     const kept = existing
         .split("\n")
-        .filter((l) => !l.startsWith("DEEPSEEK_API_KEY=") && !l.startsWith("NLM_CLASSIFIER="))
+        .filter((l) => !l.startsWith("DEEPSEEK_API_KEY=") &&
+        !l.startsWith("NLM_CLASSIFIER=") &&
+        !l.startsWith("NLM_CLASSIFIER_MODEL="))
         .join("\n")
         .replace(/\n{3,}/g, "\n\n")
         .trim();
     const additions = [];
-    if (choice === "deepseek" && apiKey) {
-        // Strip newlines that clipboard paste can introduce.
-        const sanitized = apiKey.replace(/[\r\n]/g, "").trim();
-        additions.push(`DEEPSEEK_API_KEY=${sanitized}`);
+    if (input.choice === "deepseek") {
+        additions.push("NLM_CLASSIFIER=deepseek");
+        if (input.apiKey) {
+            // Strip newlines that clipboard paste can introduce.
+            const sanitized = input.apiKey.replace(/[\r\n]/g, "").trim();
+            additions.push(`DEEPSEEK_API_KEY=${sanitized}`);
+        }
     }
-    if (choice === "ollama-offline")
+    if (input.choice === "ollama-offline")
         additions.push("NLM_CLASSIFIER=ollama");
-    writeFileSync(envPath, [kept, ...additions].filter(Boolean).join("\n") + "\n", "utf8");
+    if (input.model)
+        additions.push(`NLM_CLASSIFIER_MODEL=${input.model}`);
+    writeFileSync(envPath, [kept, ...additions].filter(Boolean).join("\n") + "\n", { mode: 0o600 });
+    chmodSync(envPath, 0o600);
+}
+const TOKEN_BYTES = 32;
+/**
+ * Generate and persist an NLM_MCP_TOKEN if one isn't already set. Returns
+ * the token that's active for this process. Called during setup and on
+ * `nlm start` so installs that pre-date token-gated /api/* still get
+ * Bearer-protected without operator intervention.
+ *
+ * Token is hex-encoded crypto.randomBytes — 64 chars, 256 bits of entropy.
+ */
+export function ensureMcpToken() {
+    const existing = process.env["NLM_MCP_TOKEN"];
+    if (existing)
+        return existing;
+    const token = randomBytes(TOKEN_BYTES).toString("hex");
+    const envPath = join(homedir(), ".nlm", ".env");
+    const nlmDir = join(homedir(), ".nlm");
+    mkdirSync(nlmDir, { recursive: true, mode: 0o700 });
+    chmodSync(nlmDir, 0o700);
+    const fileExisting = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+    // Idempotent re-read: another setup run could have written the token
+    // between our env check and now. Prefer the persisted value.
+    for (const line of fileExisting.split("\n")) {
+        if (line.startsWith("NLM_MCP_TOKEN=")) {
+            const persisted = line.slice("NLM_MCP_TOKEN=".length).trim();
+            if (persisted) {
+                process.env["NLM_MCP_TOKEN"] = persisted;
+                return persisted;
+            }
+        }
+    }
+    const kept = fileExisting
+        .split("\n")
+        .filter((l) => !l.startsWith("NLM_MCP_TOKEN="))
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    writeFileSync(envPath, [kept, `NLM_MCP_TOKEN=${token}`].filter(Boolean).join("\n") + "\n", { mode: 0o600 });
+    chmodSync(envPath, 0o600);
+    process.env["NLM_MCP_TOKEN"] = token;
+    return token;
 }
 //# sourceMappingURL=ollama.js.map

package/dist/install/ollama.js.map

@@ -1 +1 @@
-{"version":3,"file":"ollama.js","sourceRoot":"","sources":["../../src/install/ollama.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;AAOtB,6EAA6E;AAE7E,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB;IACjC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,UAAU,CAAC,0BAA0B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wFAAwF;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,sDAAsD;QACtD,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,gEAAgE,CAAC,EAAE;YAClG,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,eAAe,EAAE,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,6CAA6C,EAAE,CAAC;AACzG,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,kBAAkB,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,mFAAmF;QACnF,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3E,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;YACvC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAW,GAAG,EAAE,EAChB,UAAU,GAAG,IAAI;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,mBAAmB,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,yEAAyE;IACzE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC;AAMD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAwB,EAAE,MAAe;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;SACrF,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,qDAAqD;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,SAAS,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB;QAAE,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAEzE,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACzF,CAAC"}
+{"version":3,"file":"ollama.js","sourceRoot":"","sources":["../../src/install/ollama.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;AAOtB,6EAA6E;AAE7E,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB;IACjC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,UAAU,CAAC,0BAA0B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wFAAwF;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,sDAAsD;QACtD,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,gEAAgE,CAAC,EAAE;YAClG,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,eAAe,EAAE,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,6CAA6C,EAAE,CAAC;AACzG,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,kBAAkB,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,mFAAmF;QACnF,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3E,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;YACvC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAW,GAAG,EAAE,EAChB,UAAU,GAAG,IAAI;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,mBAAmB,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,yEAAyE;IACzE,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAuD,EACvD,MAAe;IAEf,MAAM,KAAK,GACT,OAAO,aAAa,KAAK,QAAQ;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACxE,CAAC,CAAC,aAAa,CAAC;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEzB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAClC,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAChC,CAAC,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CACzC;SACA,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,qDAAqD;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,SAAS,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,KAAK;QAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAEvE,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEzB,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;gBACzC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,YAAY;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/install/setup.d.ts

@@ -19,6 +19,10 @@ export interface SetupOptions {
     readonly launchAgentLabel: string;
     readonly launchAgentPlist: string;
     readonly buildPlist: (nodeExec: string, binPath: string) => string;
+    readonly linuxSystemdUnitName: string;
+    readonly linuxSystemdUnitPath: string;
+    readonly buildSystemdUnit: (nodeExec: string, binPath: string) => string;
+    readonly linuxSystemdUserAvailable: () => boolean;
     readonly claudeSettingsPath: string;
     readonly allHooks: ReadonlyArray<{
         event: ClaudeHookEvent;

package/dist/install/setup.js

@@ -12,15 +12,41 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir, platform } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, log, multiselect, outro, password, select, spinner, } from "@clack/prompts";
 import { connectClaudeCode } from "./claude-code.js";
 import { connectHermes } from "./hermes.js";
 import { codexBinaryAvailable, connectCodex, pluginScriptsDir } from "./codex.js";
 import { defaultDbPath as openCodeDefaultDbPath } from "../core/adapters/opencode.js";
-import { EMBEDDING_MODEL, embeddingModelPresent, installOllama, ollamaBinaryAvailable, ollamaServerRunning, pullEmbeddingModel, startOllamaServer, waitForOllamaServer, writeClassifierConfig, } from "./ollama.js";
+import { EMBEDDING_MODEL, embeddingModelPresent, ensureMcpToken, installOllama, ollamaBinaryAvailable, ollamaServerRunning, pullEmbeddingModel, startOllamaServer, waitForOllamaServer, writeClassifierConfig, } from "./ollama.js";
 import { installClaudeCodeHooks } from "./claude-code.js";
+import { hardenNlmDirPermissions } from "./nlm-dir-perms.js";
 const OS = platform();
+// Embedding-only tags shouldn't be offered as classifier models — they
+// can't run chat completions and the call would fail at first ingest.
+const EMBEDDING_MODEL_PREFIXES = ["nomic-embed", "mxbai-embed", "snowflake-arctic-embed", "bge-"];
+async function fetchOllamaChatModels(timeoutMs = 5000) {
+    const baseUrl = process.env["NLM_OLLAMA_URL"] ?? "http://localhost:11434";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(`${baseUrl}/api/tags`, { signal: controller.signal });
+        if (!res.ok)
+            return [];
+        const data = (await res.json());
+        return (data.models ?? [])
+            .map((m) => m.name)
+            .filter((n) => typeof n === "string")
+            .filter((n) => !EMBEDDING_MODEL_PREFIXES.some((p) => n.startsWith(p)))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 function detectRuntimes() {
     const claudeProjectsPath = process.env["NLM_CLAUDE_PROJECTS_PATH"]
         ?? join(homedir(), ".claude", "projects");
@@ -151,18 +177,28 @@ export async function runSetup(opts) {
     if (ollamaBinaryAvailable() && embeddingModelPresent()) {
         log.success(`Ollama ready — ${EMBEDDING_MODEL} present`);
     }
-    // ── Step 3: classifier API key ────────────────────────────────────────
-    const wantKey = await confirm({ message: "Add a classifier API key? (enables accurate session tagging; DeepSeek is ~$0.002/session)" });
-    if (isCancel(wantKey)) {
+    // ── Step 3: classifier (provider + model + key) ───────────────────────
+    const wantConfigure = await confirm({
+        message: "Configure the session classifier? (controls how new sessions are tagged)",
+    });
+    if (isCancel(wantConfigure)) {
         cancel("Setup cancelled.");
         process.exit(0);
     }
-    if (wantKey) {
+    if (wantConfigure) {
         const classifierChoice = await select({
-            message: "Which classifier?",
+            message: "Which classifier provider?",
             options: [
-                { value: "deepseek", label: "DeepSeek", hint: "recommended — fast, cheap, needs DEEPSEEK_API_KEY" },
-                { value: "ollama-offline", label: "Ollama (offline)", hint: "free, no API key, slower and less accurate" },
+                {
+                    value: "deepseek",
+                    label: "DeepSeek (cloud)",
+                    hint: "fast, cheap (~$0.002/session). Transcripts are sent to api.deepseek.com.",
+                },
+                {
+                    value: "ollama-offline",
+                    label: "Ollama (local)",
+                    hint: "private — runs on this machine via your local Ollama. Slower; needs a chat model pulled.",
+                },
             ],
         });
         if (isCancel(classifierChoice)) {
@@ -170,24 +206,71 @@ export async function runSetup(opts) {
             process.exit(0);
         }
         if (classifierChoice === "deepseek") {
+            log.info("Heads up: DeepSeek classification sends up to 30K chars of each session transcript to api.deepseek.com.");
+            log.info("  Anything in a transcript (pasted keys, client names, internal URLs) leaves this machine.");
+            log.info("  Pick Ollama (local) above if that's not acceptable.");
+            const model = await select({
+                message: "Which DeepSeek model?",
+                options: [
+                    { value: "deepseek-v4-flash", label: "deepseek-v4-flash", hint: "recommended — fast + cheap, ~$0.002/session" },
+                    { value: "deepseek-v4-pro", label: "deepseek-v4-pro", hint: "higher quality, ~10× cost" },
+                    { value: "deepseek-chat", label: "deepseek-chat", hint: "legacy chat model" },
+                ],
+            });
+            if (isCancel(model)) {
+                cancel("Setup cancelled.");
+                process.exit(0);
+            }
             const key = await password({ message: "DeepSeek API key (get one at platform.deepseek.com):" });
             if (isCancel(key)) {
                 cancel("Setup cancelled.");
                 process.exit(0);
             }
-            if (key && key.trim()) {
-                writeClassifierConfig("deepseek", key.trim());
-                log.success("DeepSeek API key saved to ~/.nlm/.env");
+            const apiKey = key && key.trim() ? key.trim() : undefined;
+            writeClassifierConfig(apiKey !== undefined
+                ? { choice: "deepseek", model: model, apiKey }
+                : { choice: "deepseek", model: model });
+            if (apiKey) {
+                log.success(`DeepSeek (${model}) configured — credentials saved to ~/.nlm/.env`);
             }
             else {
-                log.warn("No key entered — set DEEPSEEK_API_KEY in ~/.nlm/.env later.");
+                log.warn(`DeepSeek (${model}) configured — set DEEPSEEK_API_KEY in ~/.nlm/.env before running.`);
             }
         }
         else {
-            writeClassifierConfig("ollama-offline");
-            log.success("Classifier set to Ollama offline (saved to ~/.nlm/.env)");
+            const ollamaModels = await fetchOllamaChatModels();
+            let modelValue = "phi4-mini:latest";
+            if (ollamaModels.length > 0) {
+                const model = await select({
+                    message: "Which Ollama chat model?",
+                    options: ollamaModels.map((m) => ({
+                        value: m,
+                        label: m,
+                        hint: m === "phi4-mini:latest" ? "recommended default — small, fast" : undefined,
+                    })),
+                });
+                if (isCancel(model)) {
+                    cancel("Setup cancelled.");
+                    process.exit(0);
+                }
+                modelValue = model;
+            }
+            else {
+                log.warn("No Ollama chat models detected. Defaulting to phi4-mini:latest.");
+                log.warn("  Pull a model with: ollama pull phi4-mini  (or any chat model you prefer)");
+            }
+            writeClassifierConfig({ choice: "ollama-offline", model: modelValue });
+            log.success(`Ollama classifier (${modelValue}) saved to ~/.nlm/.env`);
         }
     }
+    // ── Step 3.5: HTTP API auth token ─────────────────────────────────────
+    // Generate a token if one isn't set so /api/* gets Bearer-protected for
+    // non-browser callers (curl, port-forwarded clients). The UI still works
+    // because browsers send Origin and we exempt loopback origins.
+    const token = ensureMcpToken();
+    if (token === process.env["NLM_MCP_TOKEN"] && token.length === 64) {
+        log.success("HTTP API auth token saved to ~/.nlm/.env (NLM_MCP_TOKEN)");
+    }
     // ── Step 4: migrations ────────────────────────────────────────────────
     const ms = spinner();
     ms.start("Running database migrations");
@@ -202,6 +285,13 @@ export async function runSetup(opts) {
         log.error(`${e instanceof Error ? e.message : String(e)}`);
         process.exit(1);
     }
+    // ── Step 4.5: harden ~/.nlm permissions ────────────────────────────────
+    // Idempotent. Covers upgrade from pre-v0.4.2 installs where files were
+    // written without explicit chmod, leaving secrets world-readable.
+    const perms = hardenNlmDirPermissions();
+    if (perms.filesHardened + perms.dirsHardened > 0) {
+        log.success(`Hardened perms on ${perms.dirsHardened} dirs and ${perms.filesHardened} files in ${perms.nlmDir}`);
+    }
     // ── Step 5: daemon ────────────────────────────────────────────────────
     if (OS === "darwin") {
         const installDaemon = await confirm({ message: "Install macOS LaunchAgent (auto-start on login)?" });
@@ -233,9 +323,38 @@ export async function runSetup(opts) {
         }
     }
     else if (OS === "linux") {
-        log.info("Linux daemon: add `nlm start` to your init system to auto-start on boot.");
-        log.info("  systemd example:  sudo systemctl enable --now nlm  (after creating a unit file)");
-        log.info("  Quick start now:  nlm start &");
+        if (opts.linuxSystemdUserAvailable()) {
+            const installDaemon = await confirm({ message: "Install systemd user unit (auto-start on login)?" });
+            if (isCancel(installDaemon)) {
+                cancel("Setup cancelled.");
+                process.exit(0);
+            }
+            if (installDaemon) {
+                const ds = spinner();
+                ds.start("Installing systemd user unit");
+                try {
+                    mkdirSync(dirname(opts.linuxSystemdUnitPath), { recursive: true });
+                    mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
+                    writeFileSync(opts.linuxSystemdUnitPath, opts.buildSystemdUnit(opts.nodeExecPath, opts.nlmBinPath), "utf8");
+                    execFileSync("systemctl", ["--user", "daemon-reload"]);
+                    execFileSync("systemctl", ["--user", "enable", "--now", opts.linuxSystemdUnitName]);
+                    ds.stop("systemd user unit installed — daemon running");
+                    log.info(`  Status:  systemctl --user status ${opts.linuxSystemdUnitName}`);
+                    log.info("  Headless? Run `sudo loginctl enable-linger $USER` so the daemon survives logout.");
+                }
+                catch (e) {
+                    ds.stop("systemd install failed");
+                    log.error(`${e instanceof Error ? e.message : String(e)}`);
+                    log.warn("Run `nlm install` manually later, or start now with: nlm start &");
+                }
+            }
+        }
+        else {
+            log.info("systemd user instance not available (no XDG_RUNTIME_DIR or `systemctl --user`).");
+            log.info("  Common on headless servers — start manually with: nlm start &");
+            log.info("  Or enable lingering, then re-run `nlm install`:");
+            log.info("    sudo loginctl enable-linger $USER");
+        }
     }
     else if (OS === "win32") {
         log.info("Windows daemon: run `nlm start` at login via Task Scheduler.");
@@ -324,6 +443,10 @@ export async function runSetup(opts) {
             case "pi":
                 log.success("pi.dev: session scanning enabled (passive — no extra config needed)");
                 break;
+            default: {
+                const _ = id;
+                log.warn(`Unknown runtime: ${_} — skipping.`);
+            }
         }
     }
     // ── Summary ───────────────────────────────────────────────────────────