noslopui 0.1.0 → 0.2.0

package/README.md

@@ -6,7 +6,7 @@ Connect your coding agent to [noslopUI](https://noslopui.com) — hand-crafted U
 npx noslopui@latest init
 ```
 
-That one command finds your agent, signs you in through the browser, adds the MCP server to your agent's **user-level** config, and installs the workflow skill. Restart your agent and ask it to build something.
+That one command finds the agents on your machine, signs you in once through the browser, adds the MCP server to each agent's **user-level** config, and installs the workflow skill. Restart your agents and ask one to build something.
 
 ## Why
 
@@ -14,46 +14,86 @@ Ask any agent for a landing page and you get the same page: gradient headline, p
 
 The MCP server is what your agent calls. The skill is what makes it think to call it at all when you say "build me a website" — so `init` installs both, and you can skip the skill with `--no-skill`.
 
+## Supported agents
+
+| Agent | `--agent` | Config it writes | Skill it installs |
+|---|---|---|---|
+| Claude Code | `claude-code` | `~/.claude.json` | `~/.claude/skills/noslopui/` |
+| Codex | `codex` | `~/.codex/config.toml` | `~/.agents/skills/noslopui/` |
+| Cursor | `cursor` | `~/.cursor/mcp.json` | `~/.agents/skills/noslopui/` |
+| VS Code (Copilot) | `vscode` | your user `mcp.json` ¹ | `~/.agents/skills/noslopui/` |
+| Devin Desktop | `devin` | `~/.config/devin/mcp_config.json` ² | `~/.codeium/windsurf/skills/noslopui/` |
+| Windsurf (Cascade) | `windsurf` | `~/.codeium/windsurf/mcp_config.json` | `~/.codeium/windsurf/skills/noslopui/` |
+| OpenCode | `opencode` | `~/.config/opencode/opencode.json` | `~/.agents/skills/noslopui/` |
+| Antigravity | `antigravity` | `~/.gemini/config/mcp_config.json` | `~/.gemini/config/skills/noslopui/` |
+
+¹ `%APPDATA%\Code\User\mcp.json` on Windows, `~/Library/Application Support/Code/User/mcp.json` on macOS, `~/.config/Code/User/mcp.json` on Linux.
+² `%APPDATA%\devin\mcp_config.json` on Windows. Windsurf became Devin Desktop in June 2026: its default agent (Devin Local) reads this file, the older Cascade agent reads the Windsurf one, so they're set up separately.
+
+Every path and field comes from that agent's own documentation. Several agents read the same skills folder, so one copy there serves all of them.
+
+Anything else that speaks MCP over HTTP can be connected by hand — add `https://noslopui.com/api/mcp` and sign in when it asks. Steps for each client: [noslopui.com/mcp](https://noslopui.com/mcp).
+
 ## Commands
 
+**Set up**
+
 | | |
 |---|---|
-| `npx noslopui init` | Set up an agent: sign in, add the server, install the skill |
+| `npx noslopui init` | Set up your agents: one sign-in, then the server and the skill for each |
 | `npx noslopui doctor` | Check what's set up, and say what to do about anything that isn't |
-| `npx noslopui login` | Get a fresh key for an agent that's already set up |
 | `npx noslopui update` | Re-download the skill |
+| `npx noslopui skill` | Install only the skill, for an agent you connected by hand (`--agent <id>`) |
 | `npx noslopui remove` | Take the noslopUI server back out |
 
-Options: `--agent <id>`, `--no-skill`, `--no-browser`, `--key <key>`, `-y/--yes`.
+**Account**
 
-## Supported agents
+| | |
+|---|---|
+| `npx noslopui login` | Sign this CLI in, for the catalog commands below |
+| `npx noslopui login --agent <id>` | A fresh key for an agent that's already set up |
+| `npx noslopui whoami` | The account and plan this CLI is signed in to |
+| `npx noslopui logout` | Forget this CLI's sign-in |
+
+**Catalog**
+
+| | |
+|---|---|
+| `npx noslopui search <query>` | Search components and blocks (`--tag style:editorial`, `--framework`, `--limit`) |
+| `npx noslopui get <id>` | Print a component's code, or `--write src/Hero.tsx` (`--format tsx\|html\|vue`) |
+| `npx noslopui prompt <id>` | Print a component's AI-prompt version |
+| `npx noslopui design-systems [query]` | Search design systems (`--tag theme:dark`) |
+| `npx noslopui design-system <id>` | Print a DESIGN.md, or `--write DESIGN.md` |
+| `npx noslopui collections` | Your saved collections |
+| `npx noslopui collection <name>` | What's in one |
 
-**Claude Code.** That's the list.
+The catalog commands call the same MCP tools your agent does, with the same access: search and collections are free on every account; code, prompts and DESIGN.md files need a paid plan or the account's free trial. Output is only the thing you asked for, so `get <id> > Hero.tsx` works; `--json` gives the raw result.
 
-Other agents are added one at a time, and only after a real install has been done on a real machine, end to end — an agent named here is one we're claiming works. The server enforces the same list: asking for a key for an agent that hasn't passed gets refused, so an out-of-date copy of this CLI can't get one either.
+Options: `--agent <id>` (repeatable), `--no-skill`, `--no-browser`, `--key <key>`, `--json`, `--force`, `-y/--yes`.
 
 ## What it does to your machine
 
-It edits your agent's user-level config, and nothing else. Concretely, for Claude Code:
+It edits your agents' user-level config, and nothing else:
 
-- Adds one entry, `noslopui`, under `mcpServers` in `~/.claude.json`.
-- **Copies the file first.** The backup is written next to the original as `.claude.json.noslopui-backup-<timestamp>`, and its path is printed.
-- **Never touches another server's entry**, or any of the other state Claude Code keeps in that file.
+- Adds one entry, `noslopui`, to each agent you choose, in the file listed above.
+- **Copies the file first.** The backup sits next to the original as `<file>.noslopui-backup-<timestamp>`, and its path is printed.
+- **Never touches another server's entry**, or anything else in the file. Codex's `config.toml` is edited table by table: every line outside `[mcp_servers.noslopui]` is left byte for byte as it was.
 - **Never writes to a project config.** A key in a project file is a key that gets committed.
-- **Stops if the config doesn't parse.** It will not overwrite a file it couldn't read — that file is the only copy of your setup, and guessing at its contents would be worse than doing nothing.
-- Writes the skill to `~/.claude/skills/noslopui/SKILL.md`.
+- **Stops if the config doesn't parse**, or if the `noslopui` entry is written in a form it doesn't recognise. It will not overwrite a file it couldn't read — that file is the only copy of your setup.
+- Writes the skill to the folders listed above.
+- Saves the CLI's own sign-in in `~/.config/noslopui/credentials.json` (`%APPDATA%\noslopui\` on Windows), readable only by you.
 
-`remove` takes the entry back out and leaves everything else, including the skill unless you pass `--skill`. It does **not** revoke your key: the key belongs to your account, not to this machine. Revoke it at [noslopui.com/account](https://noslopui.com/account?tab=mcp).
+`remove` takes the entry back out and leaves everything else, including the skill unless you pass `--skill` — and even then it keeps a skill folder another configured agent still reads. It does **not** revoke your key: the key belongs to your account, not to this machine. Revoke it at [noslopui.com/account](https://noslopui.com/account?tab=mcp).
 
 ### If Claude Code is running
 
 `~/.claude.json` is also Claude Code's own state file, and a running Claude Code rewrites it from memory. Quit it before running `init`, or the entry can be overwritten seconds later. `doctor` re-reads the file rather than trusting the write, so it will tell you if that happened.
 
-## Your key
+## Your keys
 
-`init` issues one key per agent, named after the agent and this machine, so you can tell them apart and revoke one without breaking the others. The key is written to your agent's config and nowhere else — this tool never prints it in full, and never sends it anywhere except noslopui.com.
+`init` issues one key per agent, named after the agent and this machine, so you can tell them apart on the account page and revoke one without breaking the others — plus one for the CLI itself if it isn't signed in yet. Keys are written to each agent's config and nowhere else; this tool never prints one in full, and never sends it anywhere except noslopui.com.
 
-`--key <key>` skips the browser and uses a key you already made on the account page, for CI or a machine with no browser.
+`--key <key>` skips the browser and uses a key you already made on the account page, for CI or a machine with no browser. `NOSLOPUI_API_KEY` does the same for the catalog commands.
 
 ## The skill
 
@@ -72,7 +112,7 @@ npm run typecheck
 
 `NOSLOPUI_ORIGIN` points the CLI at a different server, which is how the flow is exercised against a local one.
 
-Adding an agent is one module implementing `Adapter` (`src/adapters/types.ts`), one line in the registry, and a real install before it goes in the list.
+Adding an agent is its facts in `src/adapters/json-agents.ts` (or its own module, if its config isn't JSON), one line in the registry, the same id in the server's `CLI_AGENTS`, and a row in `test/agents.test.ts`.
 
 ## Licence
 

package/SKILL.md

@@ -14,15 +14,15 @@ AI-generated) UI components, full page examples, and portable Design Systems.
 2. **Search the whole catalog on fit.** A design system is a set of rules, not an inventory of parts: any component can be built in any system, so nothing is off-limits once one is chosen.
 3. **Never substitute a catalog component for one the user explicitly saved** in a collection. Their pick was a decision, not an oversight.
 4. **Ask about their brand before building** — logo, brand colours, typeface, real photography. Put their values into the system's tokens (their colour replaces `accent`) and keep the system's rules.
-5. **Check for a collection first:** call `list_collections`. If one fits the request, build from it. If none fits, or no key is configured, don't guess a collection — shortlist two or three design systems with `search_design_systems` and let the user pick.
+5. **Check for a collection first:** call `list_collections`. If one fits the request, build from it. If none fits, don't guess a collection — shortlist two or three design systems with `search_design_systems` and let the user pick.
 6. **If a gated tool says the trial has ended or the fair-use limit is reached, tell the user and stop** — don't retry, and don't swap in something generated from scratch.
 
-Setup, if a tool says no key is configured: the user creates an API key at
-`noslopui.com/account` (MCP tab) and adds it to this MCP server's config as an
-`Authorization: Bearer <key>` header. Search, metadata and design-system token
-tools work without one. Code, prompts and DESIGN.md files need a key on a paid
-plan or inside the account's free 3-day trial, which the first such call
-starts.
+Setup, if the noslopUI tools aren't available: the user runs
+`npx noslopui@latest init`, or adds `https://noslopui.com/api/mcp` in their
+agent and signs in when it asks (steps for each agent: `noslopui.com/mcp`).
+Every call runs as the user's account. Search, metadata and collections are
+free on every account. Code, prompts and DESIGN.md files need a paid plan or
+the account's free 3-day trial, which the first such call starts.
 
 ---
 
@@ -32,10 +32,6 @@ starts.
 
 - A relevant collection exists → **Path A**. The user already did the choosing.
 - No collection, or nothing relevant → **Path B**.
-- It says no key is configured → **Path B**, without calling `get_collection`
-  (it needs the same key, and a guessed collection name finds nothing). Tell the
-  user once that code and DESIGN.md files will need a key — see Setup above —
-  and carry on with everything that works without one.
 
 Several collections and no obvious match → ask. Don't guess between two curated
 sets.
@@ -232,8 +228,8 @@ get_component_code({ id })                                         -> { id, name
 get_component_prompt({ id })                                        -> { id, name, promptText }   [gated: paid or trial]
 ```
 
-The key rides on the connection (the `Authorization` header), so no tool needs
-an `apiKey` argument. Every search, metadata and collection tool is free on
+The account rides on the connection (a key or a sign-in, sent as the
+`Authorization` header), so no tool takes a credential argument. Every search, metadata and collection tool is free on
 every account; `get_design_system_file`, `get_component_code` and
 `get_component_prompt` need the account on a paid plan or inside its free
 3-day trial.

package/dist/adapters/claude-code.js

@@ -17,130 +17,30 @@
 // is open while this runs, it can overwrite our entry when it next saves.
 // That's why install tells the user to quit Claude Code first, and why
 // `doctor` re-checks rather than trusting that the write stuck.
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { delimiter, dirname, join } from 'node:path';
-import { backupFile, detectIndent, readJsonFile, writeJsonFile } from '../lib/json-file.js';
-/** The name the server appears under. Also what the user types: `/mcp__noslopui__build_ui`. */
-export const SERVER_NAME = 'noslopui';
-const SKILL_DIR_NAME = 'noslopui';
-function onPath(binary) {
-    const paths = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
-    const suffixes = process.platform === 'win32' ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
-    for (const dir of paths) {
-        for (const suffix of suffixes) {
-            try {
-                if (existsSync(join(dir, binary + suffix)))
-                    return true;
-            }
-            catch {
-                // An unreadable PATH entry is not our problem; keep looking.
-            }
-        }
-    }
-    return false;
-}
-export class ClaudeCodeAdapter {
-    id = 'claude-code';
-    label = 'Claude Code';
-    configPath() {
-        return join(homedir(), '.claude.json');
+import { join } from 'node:path';
+import { JsonConfigAdapter, SERVER_NAME } from './json-adapter.js';
+import { home } from '../lib/paths.js';
+import { installSkillAt } from '../lib/skill-file.js';
+export { SERVER_NAME };
+export class ClaudeCodeAdapter extends JsonConfigAdapter {
+    constructor() {
+        super({
+            id: 'claude-code',
+            label: 'Claude Code',
+            configPath: () => join(home(), '.claude.json'),
+            container: 'mcpServers',
+            urlField: 'url',
+            fixed: { type: 'http' },
+            detectPaths: () => [join(home(), '.claude.json'), join(home(), '.claude')],
+            detectBinaries: ['claude'],
+            skillPath: () => join(home(), '.claude', 'skills', 'noslopui', 'SKILL.md'),
+            readBackHint: 'If Claude Code is running, quit it and run this again.',
+        });
     }
     skillPath() {
-        return join(homedir(), '.claude', 'skills', SKILL_DIR_NAME, 'SKILL.md');
-    }
-    async detect() {
-        try {
-            return onPath('claude') || existsSync(this.configPath()) || existsSync(join(homedir(), '.claude'));
-        }
-        catch {
-            return false;
-        }
-    }
-    async install(entry) {
-        const path = this.configPath();
-        const config = readJsonFile(path) ?? {};
-        const backupPath = backupFile(path);
-        const servers = (typeof config.mcpServers === 'object' && config.mcpServers !== null && !Array.isArray(config.mcpServers)
-            ? config.mcpServers
-            : {});
-        const replacedExisting = SERVER_NAME in servers;
-        // Spread the existing entry so anything Claude Code (or the user) added to
-        // it that we don't know about survives the update.
-        const existing = (typeof servers[SERVER_NAME] === 'object' && servers[SERVER_NAME] !== null ? servers[SERVER_NAME] : {});
-        const existingHeaders = (typeof existing.headers === 'object' && existing.headers !== null ? existing.headers : {});
-        servers[SERVER_NAME] = {
-            ...existing,
-            type: 'http',
-            url: entry.url,
-            headers: { ...existingHeaders, Authorization: `Bearer ${entry.key}` },
-        };
-        config.mcpServers = servers;
-        writeJsonFile(path, config, { indent: existsSync(path) ? detectIndent(path) : 2 });
-        // Read back: this file has another writer, so a successful write is not
-        // the same as a config that says what we think it says.
-        const after = await this.status();
-        if (!after.installed || after.url !== entry.url || !after.hasKey) {
-            throw new Error(`The entry was written to ${path} but reading it back didn't show it. If Claude Code is running, quit it and run this again.`);
-        }
-        return { configPath: path, backupPath, method: 'config-file', replacedExisting };
-    }
-    async status() {
-        const path = this.configPath();
-        const config = readJsonFile(path);
-        if (!config)
-            return { installed: false, configPath: path, url: null, hasKey: false };
-        const servers = config.mcpServers;
-        const entry = servers?.[SERVER_NAME];
-        if (!entry)
-            return { installed: false, configPath: path, url: null, hasKey: false };
-        const url = typeof entry.url === 'string' ? entry.url : null;
-        const headers = (entry.headers ?? {});
-        const auth = typeof headers.Authorization === 'string' ? headers.Authorization : '';
-        const hasKey = /^Bearer\s+\S+/i.test(auth);
-        let problem;
-        if (!url)
-            problem = 'The entry has no url.';
-        else if (!hasKey)
-            problem = 'The entry has no Authorization header, so gated tools will be refused.';
-        else if (entry.type !== 'http')
-            problem = `The entry's type is "${String(entry.type)}", expected "http".`;
-        return { installed: true, configPath: path, url, hasKey, ...(problem ? { problem } : {}) };
-    }
-    async uninstall() {
-        const path = this.configPath();
-        const config = readJsonFile(path);
-        if (!config)
-            return false;
-        const servers = config.mcpServers;
-        if (!servers || !(SERVER_NAME in servers))
-            return false;
-        backupFile(path);
-        delete servers[SERVER_NAME];
-        writeJsonFile(path, config, { indent: detectIndent(path) });
-        return true;
+        return join(home(), '.claude', 'skills', 'noslopui', 'SKILL.md');
     }
     async installSkill(markdown) {
-        const path = this.skillPath();
-        if (existsSync(path)) {
-            try {
-                if (readFileSync(path, 'utf8') === markdown)
-                    return { path, changed: false };
-            }
-            catch {
-                // Unreadable but present: fall through and replace it.
-            }
-        }
-        mkdirSync(dirname(path), { recursive: true });
-        writeFileSync(path, markdown, 'utf8');
-        return { path, changed: true };
-    }
-    async removeSkill() {
-        const path = this.skillPath();
-        if (!existsSync(path))
-            return false;
-        // Only our own folder, and only because we created it.
-        rmSync(dirname(path), { recursive: true, force: true });
-        return true;
+        return installSkillAt(this.skillPath(), markdown);
     }
 }

package/dist/adapters/codex.js

@@ -0,0 +1,196 @@
+// Codex (the CLI, the IDE extension and the app share one config).
+//
+// User-level MCP servers live in `~/.codex/config.toml`, one table each:
+//
+//   [mcp_servers.noslopui]
+//   url = "https://noslopui.com/api/mcp"
+//   http_headers = { "Authorization" = "Bearer nsui_…" }
+//
+// Checked against learn.chatgpt.com/docs/extend/mcp (2026-09-21): `url`,
+// `http_headers` (a static map) and `bearer_token_env_var` are all supported.
+// We write the static header, like every other agent, so the key lives in the
+// config and nowhere else — an env var would have to be set in every shell
+// Codex is ever started from, which is exactly the fragility this tool exists
+// to remove.
+//
+// NO TOML PARSER. This package has zero runtime dependencies, so instead of
+// parsing the file we edit one table and leave every other byte as it was:
+// find `[mcp_servers.noslopui]` (and any `[mcp_servers.noslopui.*]`
+// sub-tables), replace our keys in it, keep any other key the user put there.
+// If our server appears in a form we don't recognise — an inline table under
+// `[mcp_servers]`, or a dotted key — we stop and say so, rather than guess.
+// Skills: Codex reads user-level skills from ~/.agents/skills
+// (learn.chatgpt.com/docs/build-skills).
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { backupFile, ConfigUnreadableError, writeTextFile } from '../lib/json-file.js';
+import { home, onPath, sharedSkillPath } from '../lib/paths.js';
+import { installSkillAt, removeSkillAt } from '../lib/skill-file.js';
+import { SERVER_NAME } from './json-adapter.js';
+/** `[mcp_servers.noslopui]` or one of its sub-tables, in any quoting TOML allows. */
+const OUR_HEADER = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*(?:${SERVER_NAME}|"${SERVER_NAME}"|'${SERVER_NAME}')\\s*(\\]|\\.)`);
+/** `[mcp_servers.noslopui.http_headers]` — replaced by our inline map, or TOML would see the key twice. */
+const OUR_HEADERS_SUBTABLE = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*["']?${SERVER_NAME}["']?\\s*\\.\\s*["']?http_headers["']?\\s*\\]`);
+const ANY_HEADER = /^\s*\[/;
+/** Our server declared some other way: `noslopui = {…}` or `mcp_servers.noslopui.url = …`. */
+const FOREIGN_FORM = new RegExp(`^\\s*(?:mcp_servers\\s*\\.\\s*)?["']?${SERVER_NAME}["']?\\s*(?:=|\\.)`);
+/** Keys we own inside our table; every other key the user wrote there is kept. */
+const OUR_KEYS = /^\s*(url|http_headers|bearer_token_env_var)\s*=/;
+const tomlString = (s) => `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+function parse(path) {
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        throw new ConfigUnreadableError(path, err);
+    }
+    const eol = raw.includes('\r\n') ? '\r\n' : '\n';
+    const lines = raw.split(/\r?\n/);
+    const blocks = [];
+    let open = null;
+    lines.forEach((line, i) => {
+        if (ANY_HEADER.test(line)) {
+            if (open !== null) {
+                blocks.push([open, i]);
+                open = null;
+            }
+            if (OUR_HEADER.test(line))
+                open = i;
+            return;
+        }
+        if (open === null && !line.trim().startsWith('#') && FOREIGN_FORM.test(line)) {
+            throw new ConfigUnreadableError(path, new Error(`"${SERVER_NAME}" is declared in a form this tool doesn't edit`));
+        }
+    });
+    if (open !== null)
+        blocks.push([open, lines.length]);
+    return { lines, eol, blocks };
+}
+function ourLines(parsed) {
+    return parsed.blocks.flatMap(([a, b]) => parsed.lines.slice(a, b));
+}
+export class CodexAdapter {
+    id = 'codex';
+    label = 'Codex';
+    configPath() {
+        return join(home(), '.codex', 'config.toml');
+    }
+    skillPath() {
+        return sharedSkillPath();
+    }
+    async detect() {
+        try {
+            return onPath('codex') || existsSync(join(home(), '.codex'));
+        }
+        catch {
+            return false;
+        }
+    }
+    async install(entry) {
+        const path = this.configPath();
+        const parsed = parse(path);
+        const backupPath = backupFile(path);
+        const lines = parsed?.lines ?? [];
+        const eol = parsed?.eol ?? '\n';
+        const blocks = parsed?.blocks ?? [];
+        const replacedExisting = blocks.length > 0;
+        // Keys the user added to our main table (enabled, tool_timeout_sec, …)
+        // and any sub-table other than http_headers survive the rewrite.
+        const kept = [];
+        const keptSubtables = [];
+        for (const [a, b] of blocks) {
+            const header = lines[a] ?? '';
+            const body = lines.slice(a + 1, b);
+            if (OUR_HEADERS_SUBTABLE.test(header))
+                continue;
+            if (/\]\s*(#.*)?$/.test(header) && new RegExp(`${SERVER_NAME}["']?\\s*\\]`).test(header)) {
+                kept.push(...body.filter((l) => !OUR_KEYS.test(l)));
+            }
+            else {
+                keptSubtables.push(header, ...body);
+            }
+        }
+        while (kept.length && !kept[kept.length - 1].trim())
+            kept.pop();
+        const block = [
+            `[mcp_servers.${SERVER_NAME}]`,
+            `url = ${tomlString(entry.url)}`,
+            `http_headers = { "Authorization" = ${tomlString(`Bearer ${entry.key}`)} }`,
+            ...kept,
+            '',
+            ...keptSubtables,
+        ];
+        while (block.length && !block[block.length - 1].trim())
+            block.pop();
+        let out;
+        if (blocks.length) {
+            const first = blocks[0][0];
+            const inBlocks = (i) => blocks.some(([a, b]) => i >= a && i < b);
+            out = [...lines.slice(0, first).filter((_, i) => !inBlocks(i)), ...block, '', ...lines.slice(first).filter((_, j) => !inBlocks(first + j))];
+        }
+        else {
+            const body = [...lines];
+            while (body.length && !body[body.length - 1].trim())
+                body.pop();
+            out = body.length ? [...body, '', ...block] : [...block];
+        }
+        while (out.length && !out[out.length - 1].trim())
+            out.pop();
+        writeTextFile(path, out.join(eol) + eol);
+        const after = await this.status();
+        if (!after.installed || after.url !== entry.url || !after.hasKey) {
+            throw new Error(`The entry was written to ${path} but reading it back didn't show it.`);
+        }
+        return { configPath: path, backupPath, method: 'config-file', replacedExisting };
+    }
+    async status() {
+        const path = this.configPath();
+        const parsed = parse(path);
+        if (!parsed || !parsed.blocks.length)
+            return { installed: false, configPath: path, url: null, hasKey: false };
+        const text = ourLines(parsed).join('\n');
+        const url = text.match(/^\s*url\s*=\s*"([^"]*)"/m)?.[1] ?? null;
+        const hasKey = /"?Authorization"?\s*=\s*"Bearer\s+\S+"/i.test(text) || /^\s*bearer_token_env_var\s*=/m.test(text);
+        let problem;
+        if (!url)
+            problem = 'The entry has no url.';
+        else if (!hasKey)
+            problem = 'The entry has no Authorization header, so Codex will be asked to sign in ("codex mcp login noslopui").';
+        return { installed: true, configPath: path, url, hasKey, ...(problem ? { problem } : {}) };
+    }
+    async configuredKey() {
+        try {
+            const parsed = parse(this.configPath());
+            if (!parsed)
+                return null;
+            return ourLines(parsed).join('\n').match(/"?Authorization"?\s*=\s*"Bearer\s+([^"\s]+)"/i)?.[1] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async uninstall() {
+        const path = this.configPath();
+        const parsed = parse(path);
+        if (!parsed || !parsed.blocks.length)
+            return false;
+        backupFile(path);
+        const inBlocks = (i) => parsed.blocks.some(([a, b]) => i >= a && i < b);
+        const out = parsed.lines.filter((_, i) => !inBlocks(i));
+        // Collapse the blank lines our table leaves behind.
+        const tidy = out.filter((l, i) => l.trim() || (out[i - 1]?.trim() ?? '') !== '');
+        while (tidy.length && !tidy[tidy.length - 1].trim())
+            tidy.pop();
+        writeTextFile(path, tidy.length ? tidy.join(parsed.eol) + parsed.eol : '');
+        return true;
+    }
+    async installSkill(markdown) {
+        return installSkillAt(this.skillPath(), markdown);
+    }
+    async removeSkill() {
+        return removeSkillAt(this.skillPath());
+    }
+}

package/dist/adapters/index.js

@@ -1,10 +1,21 @@
-// The adapter registry.
+// The adapter registry — every agent `npx noslopui init` can set up.
 //
-// One entry today. Every other agent stays out of this list until it has been
-// installed for real, end to end, on a real machine — an agent that appears
-// here is an agent we're promising works.
+// The server keeps the same list (CLI_AGENTS in the website's lib/cli-auth.ts)
+// and refuses a key for any agent not on it, so the two change together.
+// Order is the order they're offered in.
 import { ClaudeCodeAdapter } from './claude-code.js';
-export const ADAPTERS = [new ClaudeCodeAdapter()];
+import { CodexAdapter } from './codex.js';
+import { antigravity, cursor, devin, opencode, vscode, windsurf } from './json-agents.js';
+export const ADAPTERS = [
+    new ClaudeCodeAdapter(),
+    new CodexAdapter(),
+    cursor(),
+    vscode(),
+    devin(),
+    windsurf(),
+    opencode(),
+    antigravity(),
+];
 export function adapterById(id) {
     return ADAPTERS.find((a) => a.id === id);
 }