nlm-memory 0.4.2 → 0.5.1

package/README.md

@@ -2,9 +2,9 @@
 
 > Local-first memory OS for AI operators — one corpus across every runtime you use.
 
-`nlm-memory` indexes every session from Claude Code, Codex, OpenCode, Hermes, Aider, and pi into a single searchable store on your machine. Three properties no competitor ships together:
+`nlm-memory` indexes every session from Claude Code, Codex, OpenCode, Cursor, Windsurf, Hermes, Aider, and pi into a single searchable store on your machine. Three properties no competitor ships together:
 
-1. **Cross-runtime reach.** Claude Code, Codex, and OpenCode ship today. Hermes, pi, and Aider follow the same adapter pattern. One index, every tool — not one per runtime.
+1. **Cross-runtime reach.** One index spans every adapter — not one per runtime.
 2. **Editable timeline.** Sessions can be superseded, retired, or marked aborted. Memory is non-linear: patch history retroactively. No other memory layer lets you do this.
 3. **97.2% R@5 baseline.** On a 14-month corpus, keyword recall surfaces the right session in the top 5 on 97.2% of evaluator queries. No fine-tuning, no cloud, no account.
 
@@ -15,81 +15,119 @@ Everything stays on your machine. No telemetry, no account required beyond your
 ## Requirements
 
 - **Node 20+**
-- **[Ollama](https://ollama.com)** running locally with `nomic-embed-text` pulled:
+- **[Ollama](https://ollama.com)** running locally with `nomic-embed-text` pulled for semantic search:
   ```sh
   ollama pull nomic-embed-text
   ```
-- **A classifier** — [DeepSeek](https://platform.deepseek.com) is recommended (fast, cheap, ~$0.002/session). Set `DEEPSEEK_API_KEY` in `~/.nlm/.env`. Ollama works offline with `NLM_CLASSIFIER=ollama`.
+- **A classifier** — pick during setup:
+  - **DeepSeek cloud** (recommended for speed) — fast, cheap (~$0.002/session). Sends up to 30K chars of each session transcript to `api.deepseek.com`.
+  - **Ollama local** — fully offline. Slower; uses whichever chat model you select from your local pull list.
 
 ---
 
 ## Install
 
 ```sh
-npm install -g github:pbmagnet4/nlm-memory-ts
-nlm migrate
-nlm install
+npm install -g nlm-memory
+nlm setup
 ```
 
-`nlm install` writes a macOS LaunchAgent that starts the daemon on login and keeps it running. Open **http://localhost:3940/ui** — done.
+`nlm setup` is the interactive first-run wizard. It asks you to pick your classifier, model, and which runtimes to connect (Claude Code, Codex, Hermes), then installs the daemon. After it finishes, open **http://localhost:3940/ui** — done.
+
+### Platform support
+
+| Platform | Daemon | Notes |
+|---|---|---|
+| **macOS** | LaunchAgent at `~/Library/LaunchAgents/com.github.pbmagnet4.nlm-memory.plist` | Auto-starts on login |
+| **Linux** | systemd user unit at `~/.config/systemd/user/nlm.service` | Run `loginctl enable-linger $USER` on headless servers so the daemon survives logout |
+| **Windows** | Manual `nlm start` for now | Hook + MCP install paths are platform-aware; daemon supervisor lands in the next release |
 
 To stop or remove:
 ```sh
-launchctl stop com.github.pbmagnet4.nlm-memory   # stop without uninstalling
-nlm uninstall                                    # remove the LaunchAgent entirely
+nlm uninstall   # remove the daemon supervisor on your platform
 ```
 
 ---
 
-## Wire to your AI agents (MCP)
+## How recall works
 
-Add to `~/.mcp.json` (or your editor's MCP config):
+Once installed, NLM runs as a quiet background daemon. Two ways your AI agents get to it:
 
-```json
-{
-  "mcpServers": {
-    "nlm-memory": {
-      "command": "node",
-      "args": ["<path-to-global-npm>/lib/node_modules/nlm-memory/dist/cli/nlm.js", "mcp"]
-    }
-  }
-}
-```
+### 1. Hooks (Claude Code) — automatic context injection
 
-Find the path with `npm root -g` — the full path is `$(npm root -g)/nlm-memory/dist/cli/nlm.js`.
+`nlm connect claude-code` installs five hooks into `~/.claude/settings.json`:
 
-Or use the runtime-specific connect commands:
+- **UserPromptSubmit / SessionStart** — before each turn, NLM scores the prompt against your past sessions and silently prepends a pointer block listing the 0–3 most likely-relevant prior sessions. The model sees them as conversational context.
+- **Stop** — after the model responds, NLM scans the response for citations of surfaced session IDs to measure useful-hit rate.
+- **PreCompact / SubagentStart** — link conversations across compactions and subagent dispatches so threads stay coherent.
+
+Default mode is **live** (recall injected into prompts). Switch to **shadow** (log-only, no injection) by setting `NLM_HOOK_MODE=shadow` in your hook commands.
+
+### 2. MCP — explicit tools any agent can call
 
 ```sh
-nlm connect claude-code      # writes to ~/.mcp.json + installs hooks
+nlm connect claude-code      # writes ~/.mcp.json + installs hooks
 nlm connect codex            # installs as a Codex marketplace plugin
-nlm connect hermes           # writes to ~/.hermes/config.yaml (MCP)
+nlm connect hermes           # writes ~/.hermes/config.yaml (MCP)
 nlm connect hermes-agent     # installs as a NousResearch Hermes plugin (hooks + MCP)
 ```
 
-Once wired, agents can call `recall_sessions` (search past conversations) and `recall_facts` (pull structured facts like decisions and project state) automatically.
+Once wired, agents can call `recall_sessions` (search past conversations), `recall_facts` (decisions/open questions/project state), `get_session` (pull a full session), `get_fact_history` (how a decision evolved), and `cite_session` (explicitly mark a session as referenced).
+
+For container-hosted agents that can't use stdio MCP, the daemon also exposes Streamable-HTTP MCP at `POST /mcp`. Use the auto-generated `NLM_MCP_TOKEN` from `~/.nlm/.env` as a bearer.
 
 ---
 
-## What's inside
+## What's inside the UI
+
+Open `http://localhost:3940/ui` after the daemon starts.
 
 | Page | What it shows |
 |---|---|
 | **Live** | Sessions being written in real time, recent reads and decisions |
 | **Pulse** | System health — coherence, runtimes, stale entities, recent sessions |
-| **River** | Full session timeline with density controls |
-| **Thread** | Per-entity conversation history |
-| **Search** | Keyword, semantic, or hybrid recall |
+| **River** | Full session timeline with density controls and supersedence visualization |
+| **Thread** | Per-entity conversation history with runtime filters |
+| **Search** | Keyword, semantic, or hybrid recall with match snippets |
 | **Recall** | Adoption telemetry — is the memory system actually being used? |
 | **Settings** | Sources, providers, classifier, data backup/restore |
 
 ---
 
+## Security
+
+NLM is local-first by design. The daemon:
+
+- Binds to `127.0.0.1` only — never `0.0.0.0`.
+- Enforces Host + Origin checks on `/api/*` to block DNS rebinding and cross-origin drive-by.
+- Generates a 256-bit `NLM_MCP_TOKEN` on first run and persists to `~/.nlm/.env` (mode `0600`). All non-browser API requests (hooks, MCP container clients) authenticate with `Authorization: Bearer ${NLM_MCP_TOKEN}`.
+- Recursively enforces `0700` on `~/.nlm/` and `0600` on its contents on every start.
+- Sends nothing outbound except:
+  - Ollama (`localhost:11434`) for embeddings + local classifier
+  - DeepSeek API (`api.deepseek.com`) — only when classifier is set to DeepSeek
+  - Your AI runtime transcript files (read-only)
+
+No telemetry. No vendor calls. No account.
+
+Report vulnerabilities via [SECURITY.md](SECURITY.md).
+
+---
+
+## Upgrading from v0.4.x
+
+```sh
+npm update -g nlm-memory
+```
+
+Old installs have `NLM_HOOK_MODE=shadow` hardcoded in `~/.claude/settings.json` — shadow mode is silent, so re-run `nlm hook install` to switch to live recall injection. Permissions and `NLM_MCP_TOKEN` self-heal on the next `nlm start`.
+
+---
+
 ## How it differs from mem0 and graphiti
 
 - **Unit of memory:** whole sessions with extracted markers (decisions, open questions, entities), not individual facts or graph edges.
 - **Audience:** you querying your own past work, not an embedded SDK for app developers.
-- **Cross-runtime:** one corpus across Claude Code, Codex, OpenCode, Hermes, and more. Competitors target one runtime.
+- **Cross-runtime:** one corpus across Claude Code, Codex, OpenCode, Cursor, Windsurf, Hermes, and more. Competitors target one runtime.
 - **Editable timeline:** sessions can be superseded, retired, aborted. No other tool lets you retrofit memory — a record from 6 months ago can be corrected today.
 - **Local-only:** no hosted offering, no telemetry, no vendor dependency.
 
@@ -104,11 +142,11 @@ npm install        # install dependencies
 npm run build      # compile dist/ — commit the result, it ships in the repo
 npm run dev        # hot-reload daemon
 npm run ui:dev     # hot-reload UI at localhost:5173 (proxies /api to :3940)
-npm test           # unit + integration tests
+npm test           # 601 tests across 62 files
 npm run typecheck
 ```
 
-`dist/` is committed to the repo so `npm install -g github:…` works without a build step on the user's machine. Rebuild and commit `dist/` whenever you change `src/`.
+`dist/` is committed to the repo so the global install works without a build step on the user's machine. Rebuild and commit `dist/` whenever you change `src/`.
 
 Database lives at `~/.nlm/canonical.sqlite`. Override with `NLM_DB_PATH`.
 

package/dist/cli/nlm.js

@@ -26,8 +26,9 @@ import { fileURLToPath } from "node:url";
 import { dirname, resolve, join } from "node:path";
 import { homedir } from "node:os";
 import { mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { Command } from "commander";
+import pkg from "../../package.json" with { type: "json" };
 import { serve } from "@hono/node-server";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { FactRecallService } from "../core/recall-facts/fact-recall-service.js";
@@ -45,9 +46,13 @@ import { OllamaClient } from "../llm/ollama-client.js";
 import { autoloadEnv } from "../llm/env-autoload.js";
 import { addHook, buildHookCommand, removeHook, smokeTestHookCommand } from "../core/hook/claude-settings.js";
 import { codexBinaryAvailable, connectCodex, disconnectCodex, pluginScriptsDir, } from "../install/codex.js";
-import { connectClaudeCode, disconnectClaudeCode, installClaudeCodeHooks } from "../install/claude-code.js";
+import { connectClaudeCode, disconnectClaudeCode, installClaudeCodeHooks, mcpConfigPath } from "../install/claude-code.js";
+import { hardenNlmDirPermissions } from "../install/nlm-dir-perms.js";
+import { ensureMcpToken } from "../install/ollama.js";
+import { connectCursor, disconnectCursor } from "../install/cursor.js";
 import { connectHermes, disconnectHermes, hermesConfigPath } from "../install/hermes.js";
 import { connectHermesAgent, disconnectHermesAgent, hermesAgentPluginDir } from "../install/hermes-agent.js";
+import { connectWindsurf, disconnectWindsurf } from "../install/windsurf.js";
 import { runSetup } from "../install/setup.js";
 import { runParity } from "./classify-parity.js";
 import { reembedCorpus } from "../core/embedding/embed-backfill.js";
@@ -149,13 +154,20 @@ const program = new Command();
 program
     .name("nlm")
     .description("Local-first memory operating system for AI operators")
-    .version("0.3.0");
+    .version(pkg.version);
 program
     .command("start")
     .description("Boot the HTTP server + ingest scheduler")
     .option("--no-scheduler", "HTTP only; skip the ingest tick loop")
     .option("--interval-min <n>", "scheduler tick interval (min, default 30)", (v) => Number.parseInt(v, 10), 30)
     .action(async (opts) => {
+    // Self-heal perms on every daemon start. Idempotent. Covers upgrade
+    // path from pre-v0.4.2 installs where ~/.nlm contents were world-readable.
+    hardenNlmDirPermissions();
+    // Generate NLM_MCP_TOKEN if missing so /api/* gets Bearer-protected for
+    // non-browser callers. Idempotent: re-reads persisted token first.
+    autoloadEnv();
+    ensureMcpToken();
     const { store, facts, sources, providers, recall, factRecall, embedder, classifier } = buildStack();
     const { existsSync } = await import("node:fs");
     const hasMcpToken = Boolean(process.env["NLM_MCP_TOKEN"]);
@@ -387,6 +399,37 @@ program
 });
 const LAUNCH_AGENT_LABEL = "com.github.pbmagnet4.nlm-memory";
 const LAUNCH_AGENT_PLIST = join(homedir(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`);
+const LINUX_SYSTEMD_UNIT_NAME = "nlm.service";
+const LINUX_SYSTEMD_UNIT_PATH = join(homedir(), ".config", "systemd", "user", LINUX_SYSTEMD_UNIT_NAME);
+function buildSystemdUnit(nodeExec, nlmJs) {
+    const logDir = join(homedir(), ".nlm", "logs");
+    return `[Unit]
+Description=NLM Memory — local AI session memory daemon
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${nodeExec} ${nlmJs} start
+WorkingDirectory=${homedir()}
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:${logDir}/daemon-out.log
+StandardError=append:${logDir}/daemon-err.log
+
+[Install]
+WantedBy=default.target
+`;
+}
+// systemd user instance needs XDG_RUNTIME_DIR (a real user session) and
+// systemctl --user to respond. Both are missing on headless servers without
+// loginctl enable-linger and in many minimal containers.
+function linuxSystemdUserAvailable() {
+    if (process.platform !== "linux")
+        return false;
+    if (!process.env["XDG_RUNTIME_DIR"])
+        return false;
+    return spawnSync("systemctl", ["--user", "--version"], { encoding: "utf8" }).status === 0;
+}
 function buildPlist(nodeExec, nlmJs) {
     const logDir = join(homedir(), ".nlm", "logs");
     return `<?xml version="1.0" encoding="UTF-8"?>
@@ -424,38 +467,91 @@ function buildPlist(nodeExec, nlmJs) {
 }
 program
     .command("install")
-    .description("Install the macOS LaunchAgent so nlm-memory auto-starts on login")
+    .description("Install the auto-start daemon (LaunchAgent on macOS, systemd user unit on Linux)")
     .action(() => {
-    if (process.platform !== "darwin") {
-        console.error("nlm install: only macOS is supported. On Linux, add `nlm start` to your init system manually.");
-        process.exit(1);
-    }
-    const uid = process.getuid?.();
-    if (uid === undefined) {
-        console.error("nlm install: could not determine UID");
-        process.exit(1);
-    }
-    mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
-    writeFileSync(LAUNCH_AGENT_PLIST, buildPlist(process.execPath, __filename), "utf8");
-    console.error(`nlm: wrote ${LAUNCH_AGENT_PLIST}`);
-    try {
-        execFileSync("launchctl", ["bootout", `gui/${uid}`, LAUNCH_AGENT_LABEL], { stdio: "ignore" });
+    // Harden before installing the daemon so the persisted unit owner-
+    // checks succeed against locked-down ~/.nlm logs.
+    hardenNlmDirPermissions();
+    if (process.platform === "darwin") {
+        const uid = process.getuid?.();
+        if (uid === undefined) {
+            console.error("nlm install: could not determine UID");
+            process.exit(1);
+        }
+        mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
+        writeFileSync(LAUNCH_AGENT_PLIST, buildPlist(process.execPath, __filename), "utf8");
+        console.error(`nlm: wrote ${LAUNCH_AGENT_PLIST}`);
+        try {
+            execFileSync("launchctl", ["bootout", `gui/${uid}`, LAUNCH_AGENT_LABEL], { stdio: "ignore" });
+        }
+        catch {
+            // not loaded yet — expected on first install
+        }
+        execFileSync("launchctl", ["bootstrap", `gui/${uid}`, LAUNCH_AGENT_PLIST]);
+        console.error("nlm: daemon installed and started.");
+        console.error(`  UI:       http://localhost:${port()}/ui`);
+        console.error(`  To stop:  launchctl stop ${LAUNCH_AGENT_LABEL}`);
+        console.error("  To remove: nlm uninstall");
+        return;
     }
-    catch {
-        // not loaded yet — expected on first install
+    if (process.platform === "linux") {
+        if (!linuxSystemdUserAvailable()) {
+            console.error("nlm install: systemd user instance not available.");
+            console.error("  XDG_RUNTIME_DIR missing or `systemctl --user` did not respond.");
+            console.error("  Common on headless servers without an active user session.");
+            console.error("  Start manually with: nlm start &");
+            console.error("  Or enable lingering so user units run without login:");
+            console.error("    sudo loginctl enable-linger $USER");
+            console.error("  Then re-run: nlm install");
+            process.exit(1);
+        }
+        mkdirSync(dirname(LINUX_SYSTEMD_UNIT_PATH), { recursive: true });
+        mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
+        writeFileSync(LINUX_SYSTEMD_UNIT_PATH, buildSystemdUnit(process.execPath, __filename), "utf8");
+        console.error(`nlm: wrote ${LINUX_SYSTEMD_UNIT_PATH}`);
+        execFileSync("systemctl", ["--user", "daemon-reload"]);
+        execFileSync("systemctl", ["--user", "enable", "--now", LINUX_SYSTEMD_UNIT_NAME]);
+        console.error("nlm: daemon installed and started.");
+        console.error(`  UI:        http://localhost:${port()}/ui`);
+        console.error(`  Status:    systemctl --user status ${LINUX_SYSTEMD_UNIT_NAME}`);
+        console.error(`  To stop:   systemctl --user stop ${LINUX_SYSTEMD_UNIT_NAME}`);
+        console.error("  To remove: nlm uninstall");
+        console.error("  Headless? Run `sudo loginctl enable-linger $USER` so the daemon survives logout.");
+        return;
     }
-    execFileSync("launchctl", ["bootstrap", `gui/${uid}`, LAUNCH_AGENT_PLIST]);
-    console.error("nlm: daemon installed and started.");
-    console.error(`  UI:       http://localhost:${port()}/ui`);
-    console.error(`  To stop:  launchctl stop ${LAUNCH_AGENT_LABEL}`);
-    console.error("  To remove: nlm uninstall");
+    console.error("nlm install: only macOS and Linux (systemd) are supported.");
+    console.error("  On Windows, run `nlm start` manually or via Task Scheduler.");
+    process.exit(1);
 });
 program
     .command("uninstall")
-    .description("Remove the macOS LaunchAgent")
+    .description("Remove the auto-start daemon (LaunchAgent on macOS, systemd user unit on Linux)")
     .action(() => {
+    if (process.platform === "linux") {
+        // Stop + disable, then remove the unit. Idempotent: ignore "not loaded"
+        // errors so re-running uninstall on a half-removed state still finishes.
+        try {
+            execFileSync("systemctl", ["--user", "disable", "--now", LINUX_SYSTEMD_UNIT_NAME], { stdio: "pipe" });
+            console.error(`nlm: stopped and disabled ${LINUX_SYSTEMD_UNIT_NAME}`);
+        }
+        catch {
+            // Unit wasn't loaded — fine, proceed to file cleanup.
+        }
+        if (existsSync(LINUX_SYSTEMD_UNIT_PATH)) {
+            rmSync(LINUX_SYSTEMD_UNIT_PATH);
+            console.error(`nlm: removed ${LINUX_SYSTEMD_UNIT_PATH}`);
+        }
+        try {
+            execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+        }
+        catch {
+            // systemd unavailable — file already removed, nothing more to do.
+        }
+        console.error("nlm: uninstalled. Run `nlm install` to reinstall.");
+        return;
+    }
     if (process.platform !== "darwin") {
-        console.error("nlm uninstall: only macOS is supported.");
+        console.error("nlm uninstall: only macOS and Linux (systemd) are supported.");
         process.exit(1);
     }
     const uid = process.getuid?.();
@@ -527,7 +623,7 @@ const hook = program
     .description("Manage the Claude Code NLM hooks");
 hook
     .command("install")
-    .description("Add the NLM hooks (recall + session-end + stop) to ~/.claude/settings.json (shadow mode)")
+    .description("Add the NLM hooks (recall + session-end + stop) to ~/.claude/settings.json (live mode)")
     .action(() => {
     const path = claudeSettingsPath();
     const hookLogPath = process.env["NLM_HOOK_LOG"] ?? join(homedir(), ".nlm", "hook-log.jsonl");
@@ -537,7 +633,7 @@ hook
     // partial failure is the bug class we shipped #161 to prevent.
     const installed = [];
     for (const spec of ALL_HOOKS) {
-        const command = buildHookCommand(process.execPath, spec.script, "shadow");
+        const command = buildHookCommand(process.execPath, spec.script, "live");
         addHook(path, command, spec.event);
         const smoke = smokeTestHookCommand(command, hookLogPath);
         if (!smoke.ok) {
@@ -557,14 +653,14 @@ hook
         }
         installed.push(spec);
     }
-    console.error(`nlm: NLM hooks installed in ${path} (shadow mode):`);
+    console.error(`nlm: NLM hooks installed in ${path} (live mode):`);
     for (const spec of installed) {
         console.error(`  - ${spec.event} → ${spec.label}-hook`);
     }
     console.error("  Smoke tests passed — all hooks appended synthetic entries to hook-log.jsonl.");
-    console.error("  Recall hooks log to ~/.nlm/hook-log.jsonl and inject nothing in shadow mode.");
+    console.error("  Recall hooks inject prior-session context on UserPromptSubmit and log to ~/.nlm/hook-log.jsonl.");
     console.error("  Session-end hook cleans up ~/.nlm/hook-state/<session>.json on session close.");
-    console.error("  To go live later: change NLM_HOOK_MODE=shadow to live for the recall hook.");
+    console.error("  To run silently for calibration (no injection): set NLM_HOOK_MODE=shadow in the command.");
     console.error("  To remove: nlm hook uninstall");
 });
 hook
@@ -637,7 +733,7 @@ connect
     .action((opts) => {
     if (opts.dryRun) {
         console.error("nlm connect claude-code (dry run):");
-        console.error(`  write [mcpServers.nlm-memory] to ${join(homedir(), ".mcp.json")}`);
+        console.error(`  write [mcpServers.nlm-memory] to ${mcpConfigPath()}`);
         if (opts.withHooks)
             console.error("  install 6 Claude Code hooks");
         return;
@@ -702,6 +798,54 @@ connect
     }
     console.error("  Also run: nlm connect hermes  (to wire the MCP server)");
 });
+connect
+    .command("cursor")
+    .description("Register Cursor as an nlm source (reads state.vscdb directly — no files installed)")
+    .option("--db-path <path>", "override path to globalStorage/state.vscdb")
+    .option("--dry-run", "print what would happen without changing files")
+    .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+        const registry = new SourceRegistry(store.rawDb());
+        const report = connectCursor(registry, {
+            ...(opts.dbPath ? { dbPath: opts.dbPath } : {}),
+            dryRun: Boolean(opts.dryRun),
+        });
+        if (opts.dryRun) {
+            console.error(`nlm connect cursor (dry run): register source at ${report.adapterDbPath}${report.adapterExists ? "" : " (not found yet)"}`);
+            return;
+        }
+        const suffix = report.adapterExists ? "" : " (DB not found — will activate when Cursor is installed)";
+        console.error(`nlm: Cursor source ${report.action} → ${report.adapterDbPath}${suffix}`);
+    }
+    finally {
+        store.close();
+    }
+});
+connect
+    .command("windsurf")
+    .description("Register Windsurf as an nlm source (reads state.vscdb files directly — no files installed)")
+    .option("--user-dir <path>", "override path to Windsurf User directory")
+    .option("--dry-run", "print what would happen without changing files")
+    .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+        const registry = new SourceRegistry(store.rawDb());
+        const report = connectWindsurf(registry, {
+            ...(opts.userDir ? { userDir: opts.userDir } : {}),
+            dryRun: Boolean(opts.dryRun),
+        });
+        if (opts.dryRun) {
+            console.error(`nlm connect windsurf (dry run): register source at ${report.userDir}${report.dirExists ? "" : " (not found yet)"}`);
+            return;
+        }
+        const suffix = report.dirExists ? "" : " (User dir not found — will activate when Windsurf is installed)";
+        console.error(`nlm: Windsurf source ${report.action} → ${report.userDir}${suffix}`);
+    }
+    finally {
+        store.close();
+    }
+});
 const disconnect = program
     .command("disconnect")
     .description("Disconnect nlm-memory from an AI coding runtime");
@@ -791,6 +935,48 @@ disconnect
         ? `nlm: removed plugin directory ${report.destDir}`
         : `nlm: no plugin directory found at ${report.destDir}`);
 });
+disconnect
+    .command("cursor")
+    .description("Disable the Cursor source in the nlm registry (leaves Cursor untouched)")
+    .option("--dry-run", "print what would happen without changing files")
+    .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+        const registry = new SourceRegistry(store.rawDb());
+        const report = disconnectCursor(registry, { dryRun: Boolean(opts.dryRun) });
+        if (opts.dryRun) {
+            console.error("nlm disconnect cursor (dry run): disable Cursor source in registry");
+            return;
+        }
+        console.error(report.action === "disabled"
+            ? "nlm: Cursor source disabled"
+            : "nlm: no Cursor source found in registry");
+    }
+    finally {
+        store.close();
+    }
+});
+disconnect
+    .command("windsurf")
+    .description("Disable the Windsurf source in the nlm registry (leaves Windsurf untouched)")
+    .option("--dry-run", "print what would happen without changing files")
+    .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+        const registry = new SourceRegistry(store.rawDb());
+        const report = disconnectWindsurf(registry, { dryRun: Boolean(opts.dryRun) });
+        if (opts.dryRun) {
+            console.error("nlm disconnect windsurf (dry run): disable Windsurf source in registry");
+            return;
+        }
+        console.error(report.action === "disabled"
+            ? "nlm: Windsurf source disabled"
+            : "nlm: no Windsurf source found in registry");
+    }
+    finally {
+        store.close();
+    }
+});
 program
     .command("setup")
     .description("Interactive first-run setup: detect runtimes, wire MCP + hooks, start daemon")
@@ -804,6 +990,10 @@ program
         launchAgentLabel: LAUNCH_AGENT_LABEL,
         launchAgentPlist: LAUNCH_AGENT_PLIST,
         buildPlist,
+        linuxSystemdUnitName: LINUX_SYSTEMD_UNIT_NAME,
+        linuxSystemdUnitPath: LINUX_SYSTEMD_UNIT_PATH,
+        buildSystemdUnit,
+        linuxSystemdUserAvailable,
         claudeSettingsPath: claudeSettingsPath(),
         allHooks: ALL_HOOKS,
         addHook,