noslopui 0.1.0 → 0.3.0

package/dist/adapters/codex.js

@@ -0,0 +1,196 @@
+// Codex (the CLI, the IDE extension and the app share one config).
+//
+// User-level MCP servers live in `~/.codex/config.toml`, one table each:
+//
+//   [mcp_servers.noslopui]
+//   url = "https://noslopui.com/api/mcp"
+//   http_headers = { "Authorization" = "Bearer nsui_…" }
+//
+// Checked against learn.chatgpt.com/docs/extend/mcp (2026-09-21): `url`,
+// `http_headers` (a static map) and `bearer_token_env_var` are all supported.
+// We write the static header, like every other agent, so the key lives in the
+// config and nowhere else — an env var would have to be set in every shell
+// Codex is ever started from, which is exactly the fragility this tool exists
+// to remove.
+//
+// NO TOML PARSER. This package has zero runtime dependencies, so instead of
+// parsing the file we edit one table and leave every other byte as it was:
+// find `[mcp_servers.noslopui]` (and any `[mcp_servers.noslopui.*]`
+// sub-tables), replace our keys in it, keep any other key the user put there.
+// If our server appears in a form we don't recognise — an inline table under
+// `[mcp_servers]`, or a dotted key — we stop and say so, rather than guess.
+// Skills: Codex reads user-level skills from ~/.agents/skills
+// (learn.chatgpt.com/docs/build-skills).
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { backupFile, ConfigUnreadableError, writeTextFile } from '../lib/json-file.js';
+import { home, onPath, sharedSkillPath } from '../lib/paths.js';
+import { installSkillAt, removeSkillAt } from '../lib/skill-file.js';
+import { SERVER_NAME } from './json-adapter.js';
+/** `[mcp_servers.noslopui]` or one of its sub-tables, in any quoting TOML allows. */
+const OUR_HEADER = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*(?:${SERVER_NAME}|"${SERVER_NAME}"|'${SERVER_NAME}')\\s*(\\]|\\.)`);
+/** `[mcp_servers.noslopui.http_headers]` — replaced by our inline map, or TOML would see the key twice. */
+const OUR_HEADERS_SUBTABLE = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*["']?${SERVER_NAME}["']?\\s*\\.\\s*["']?http_headers["']?\\s*\\]`);
+const ANY_HEADER = /^\s*\[/;
+/** Our server declared some other way: `noslopui = {…}` or `mcp_servers.noslopui.url = …`. */
+const FOREIGN_FORM = new RegExp(`^\\s*(?:mcp_servers\\s*\\.\\s*)?["']?${SERVER_NAME}["']?\\s*(?:=|\\.)`);
+/** Keys we own inside our table; every other key the user wrote there is kept. */
+const OUR_KEYS = /^\s*(url|http_headers|bearer_token_env_var)\s*=/;
+const tomlString = (s) => `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+function parse(path) {
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        throw new ConfigUnreadableError(path, err);
+    }
+    const eol = raw.includes('\r\n') ? '\r\n' : '\n';
+    const lines = raw.split(/\r?\n/);
+    const blocks = [];
+    let open = null;
+    lines.forEach((line, i) => {
+        if (ANY_HEADER.test(line)) {
+            if (open !== null) {
+                blocks.push([open, i]);
+                open = null;
+            }
+            if (OUR_HEADER.test(line))
+                open = i;
+            return;
+        }
+        if (open === null && !line.trim().startsWith('#') && FOREIGN_FORM.test(line)) {
+            throw new ConfigUnreadableError(path, new Error(`"${SERVER_NAME}" is declared in a form this tool doesn't edit`));
+        }
+    });
+    if (open !== null)
+        blocks.push([open, lines.length]);
+    return { lines, eol, blocks };
+}
+function ourLines(parsed) {
+    return parsed.blocks.flatMap(([a, b]) => parsed.lines.slice(a, b));
+}
+export class CodexAdapter {
+    id = 'codex';
+    label = 'Codex';
+    configPath() {
+        return join(home(), '.codex', 'config.toml');
+    }
+    skillPath() {
+        return sharedSkillPath();
+    }
+    async detect() {
+        try {
+            return onPath('codex') || existsSync(join(home(), '.codex'));
+        }
+        catch {
+            return false;
+        }
+    }
+    async install(entry) {
+        const path = this.configPath();
+        const parsed = parse(path);
+        const backupPath = backupFile(path);
+        const lines = parsed?.lines ?? [];
+        const eol = parsed?.eol ?? '\n';
+        const blocks = parsed?.blocks ?? [];
+        const replacedExisting = blocks.length > 0;
+        // Keys the user added to our main table (enabled, tool_timeout_sec, …)
+        // and any sub-table other than http_headers survive the rewrite.
+        const kept = [];
+        const keptSubtables = [];
+        for (const [a, b] of blocks) {
+            const header = lines[a] ?? '';
+            const body = lines.slice(a + 1, b);
+            if (OUR_HEADERS_SUBTABLE.test(header))
+                continue;
+            if (/\]\s*(#.*)?$/.test(header) && new RegExp(`${SERVER_NAME}["']?\\s*\\]`).test(header)) {
+                kept.push(...body.filter((l) => !OUR_KEYS.test(l)));
+            }
+            else {
+                keptSubtables.push(header, ...body);
+            }
+        }
+        while (kept.length && !kept[kept.length - 1].trim())
+            kept.pop();
+        const block = [
+            `[mcp_servers.${SERVER_NAME}]`,
+            `url = ${tomlString(entry.url)}`,
+            `http_headers = { "Authorization" = ${tomlString(`Bearer ${entry.key}`)} }`,
+            ...kept,
+            '',
+            ...keptSubtables,
+        ];
+        while (block.length && !block[block.length - 1].trim())
+            block.pop();
+        let out;
+        if (blocks.length) {
+            const first = blocks[0][0];
+            const inBlocks = (i) => blocks.some(([a, b]) => i >= a && i < b);
+            out = [...lines.slice(0, first).filter((_, i) => !inBlocks(i)), ...block, '', ...lines.slice(first).filter((_, j) => !inBlocks(first + j))];
+        }
+        else {
+            const body = [...lines];
+            while (body.length && !body[body.length - 1].trim())
+                body.pop();
+            out = body.length ? [...body, '', ...block] : [...block];
+        }
+        while (out.length && !out[out.length - 1].trim())
+            out.pop();
+        writeTextFile(path, out.join(eol) + eol);
+        const after = await this.status();
+        if (!after.installed || after.url !== entry.url || !after.hasKey) {
+            throw new Error(`The entry was written to ${path} but reading it back didn't show it.`);
+        }
+        return { configPath: path, backupPath, method: 'config-file', replacedExisting };
+    }
+    async status() {
+        const path = this.configPath();
+        const parsed = parse(path);
+        if (!parsed || !parsed.blocks.length)
+            return { installed: false, configPath: path, url: null, hasKey: false };
+        const text = ourLines(parsed).join('\n');
+        const url = text.match(/^\s*url\s*=\s*"([^"]*)"/m)?.[1] ?? null;
+        const hasKey = /"?Authorization"?\s*=\s*"Bearer\s+\S+"/i.test(text) || /^\s*bearer_token_env_var\s*=/m.test(text);
+        let problem;
+        if (!url)
+            problem = 'The entry has no url.';
+        else if (!hasKey)
+            problem = 'The entry has no Authorization header, so Codex will be asked to sign in ("codex mcp login noslopui").';
+        return { installed: true, configPath: path, url, hasKey, ...(problem ? { problem } : {}) };
+    }
+    async configuredKey() {
+        try {
+            const parsed = parse(this.configPath());
+            if (!parsed)
+                return null;
+            return ourLines(parsed).join('\n').match(/"?Authorization"?\s*=\s*"Bearer\s+([^"\s]+)"/i)?.[1] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async uninstall() {
+        const path = this.configPath();
+        const parsed = parse(path);
+        if (!parsed || !parsed.blocks.length)
+            return false;
+        backupFile(path);
+        const inBlocks = (i) => parsed.blocks.some(([a, b]) => i >= a && i < b);
+        const out = parsed.lines.filter((_, i) => !inBlocks(i));
+        // Collapse the blank lines our table leaves behind.
+        const tidy = out.filter((l, i) => l.trim() || (out[i - 1]?.trim() ?? '') !== '');
+        while (tidy.length && !tidy[tidy.length - 1].trim())
+            tidy.pop();
+        writeTextFile(path, tidy.length ? tidy.join(parsed.eol) + parsed.eol : '');
+        return true;
+    }
+    async installSkill(markdown) {
+        return installSkillAt(this.skillPath(), markdown);
+    }
+    async removeSkill() {
+        return removeSkillAt(this.skillPath());
+    }
+}

package/dist/adapters/index.js

@@ -1,10 +1,21 @@
-// The adapter registry.
+// The adapter registry — every agent `npx noslopui init` can set up.
 //
-// One entry today. Every other agent stays out of this list until it has been
-// installed for real, end to end, on a real machine — an agent that appears
-// here is an agent we're promising works.
+// The server keeps the same list (CLI_AGENTS in the website's lib/cli-auth.ts)
+// and refuses a key for any agent not on it, so the two change together.
+// Order is the order they're offered in.
 import { ClaudeCodeAdapter } from './claude-code.js';
-export const ADAPTERS = [new ClaudeCodeAdapter()];
+import { CodexAdapter } from './codex.js';
+import { antigravity, cursor, devin, opencode, vscode, windsurf } from './json-agents.js';
+export const ADAPTERS = [
+    new ClaudeCodeAdapter(),
+    new CodexAdapter(),
+    cursor(),
+    vscode(),
+    devin(),
+    windsurf(),
+    opencode(),
+    antigravity(),
+];
 export function adapterById(id) {
     return ADAPTERS.find((a) => a.id === id);
 }

package/dist/adapters/json-adapter.js

@@ -0,0 +1,135 @@
+// The shared shape of every agent whose MCP config is a JSON file.
+//
+// Seven of the eight agents keep their servers in a JSON object keyed by
+// server name; they differ only in where the file is, what the object is
+// called (`mcpServers`, `servers`, `mcp`), and which fields a remote server
+// takes (`url` or `serverUrl`, plus `type: "http"`, `transport: "http"` or
+// `type: "remote"`). Each adapter states those facts and nothing else; the
+// rules for editing a file we don't own live here once, in `lib/json-file.ts`
+// underneath:
+//
+//   · back up before the first write, merge, never touch another entry
+//   · keep fields on our own entry that we didn't put there
+//   · write atomically, and stop cold on a file that doesn't parse
+//   · read the entry back — several of these files have another writer
+import { existsSync } from 'node:fs';
+import { backupFile, detectIndent, readJsonFile, writeJsonFile } from '../lib/json-file.js';
+import { installSkillAt, removeSkillAt } from '../lib/skill-file.js';
+import { onPath } from '../lib/paths.js';
+/** The name the server appears under in every agent. */
+export const SERVER_NAME = 'noslopui';
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+export class JsonConfigAdapter {
+    spec;
+    id;
+    label;
+    constructor(spec) {
+        this.spec = spec;
+        this.id = spec.id;
+        this.label = spec.label;
+    }
+    configPath() {
+        return this.spec.configPath();
+    }
+    skillPath() {
+        return this.spec.skillPath();
+    }
+    async detect() {
+        try {
+            if ((this.spec.detectBinaries ?? []).some(onPath))
+                return true;
+            return this.spec.detectPaths().some((p) => existsSync(p));
+        }
+        catch {
+            return false;
+        }
+    }
+    async install(entry) {
+        const path = this.configPath();
+        const config = readJsonFile(path) ?? {};
+        const backupPath = backupFile(path);
+        const servers = isObject(config[this.spec.container]) ? config[this.spec.container] : {};
+        const replacedExisting = SERVER_NAME in servers;
+        // Spread the existing entry so anything the agent (or the user) added to
+        // it that we don't know about survives the update.
+        const existing = isObject(servers[SERVER_NAME]) ? servers[SERVER_NAME] : {};
+        const existingHeaders = isObject(existing.headers) ? existing.headers : {};
+        // The other spelling of the url field would be read instead of ours by an
+        // agent that accepts both, so it goes.
+        const { url: _url, serverUrl: _serverUrl, ...rest } = existing;
+        servers[SERVER_NAME] = {
+            ...rest,
+            ...(this.spec.fixed ?? {}),
+            [this.spec.urlField]: entry.url,
+            headers: { ...existingHeaders, Authorization: `Bearer ${entry.key}` },
+        };
+        config[this.spec.container] = servers;
+        writeJsonFile(path, config, { indent: existsSync(path) ? detectIndent(path) : 2 });
+        // Read back: a successful write is not the same as a config that says
+        // what we think it says, when something else may rewrite the file.
+        const after = await this.status();
+        if (!after.installed || after.url !== entry.url || !after.hasKey) {
+            throw new Error(`The entry was written to ${path} but reading it back didn't show it.${this.spec.readBackHint ? ` ${this.spec.readBackHint}` : ''}`);
+        }
+        return { configPath: path, backupPath, method: 'config-file', replacedExisting };
+    }
+    async status() {
+        const path = this.configPath();
+        const config = readJsonFile(path);
+        const servers = config && isObject(config[this.spec.container]) ? config[this.spec.container] : null;
+        const entry = servers && isObject(servers[SERVER_NAME]) ? servers[SERVER_NAME] : null;
+        if (!entry)
+            return { installed: false, configPath: path, url: null, hasKey: false };
+        const raw = entry[this.spec.urlField];
+        const url = typeof raw === 'string' ? raw : null;
+        const headers = isObject(entry.headers) ? entry.headers : {};
+        const auth = typeof headers.Authorization === 'string' ? headers.Authorization : '';
+        const hasKey = /^Bearer\s+\S+/i.test(auth);
+        let problem;
+        if (!url)
+            problem = `The entry has no "${this.spec.urlField}".`;
+        else if (!hasKey)
+            problem = 'The entry has no Authorization header, so the agent will be asked to sign in.';
+        else {
+            for (const [field, value] of Object.entries(this.spec.fixed ?? {})) {
+                if (entry[field] !== value) {
+                    problem = `The entry's ${field} is "${String(entry[field])}", expected "${String(value)}".`;
+                    break;
+                }
+            }
+        }
+        return { installed: true, configPath: path, url, hasKey, ...(problem ? { problem } : {}) };
+    }
+    async configuredKey() {
+        try {
+            const config = readJsonFile(this.configPath());
+            const servers = config && isObject(config[this.spec.container]) ? config[this.spec.container] : null;
+            const entry = servers && isObject(servers[SERVER_NAME]) ? servers[SERVER_NAME] : null;
+            const headers = entry && isObject(entry.headers) ? entry.headers : {};
+            const auth = typeof headers.Authorization === 'string' ? headers.Authorization : '';
+            return auth.match(/^Bearer\s+(\S+)$/i)?.[1] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async uninstall() {
+        const path = this.configPath();
+        const config = readJsonFile(path);
+        const servers = config && isObject(config[this.spec.container]) ? config[this.spec.container] : null;
+        if (!config || !servers || !(SERVER_NAME in servers))
+            return false;
+        backupFile(path);
+        delete servers[SERVER_NAME];
+        writeJsonFile(path, config, { indent: detectIndent(path) });
+        return true;
+    }
+    async installSkill(markdown) {
+        const path = this.skillPath();
+        return path ? installSkillAt(path, markdown) : null;
+    }
+    async removeSkill() {
+        const path = this.skillPath();
+        return path ? removeSkillAt(path) : false;
+    }
+}

package/dist/adapters/json-agents.js

@@ -0,0 +1,88 @@
+// Every agent whose MCP config is a JSON file, apart from Claude Code (which
+// has its own module for its history). Each entry is only facts, and each fact
+// is from that vendor's own documentation, checked 2026-09-21:
+//
+//   Cursor       cursor.com/docs/context/mcp, …/context/skills
+//   VS Code      code.visualstudio.com/docs/copilot/customization/mcp-servers, …/agent-skills
+//   Devin        docs.devin.ai/cli/extensibility/mcp/configuration, …/skills
+//   Windsurf     docs.devin.ai/desktop/cascade/mcp (the legacy Cascade agent)
+//   OpenCode     opencode.ai/docs/config, …/mcp-servers, …/skills
+//   Antigravity  antigravity.google/docs/mcp
+//
+// Windsurf shipped as Devin Desktop in June 2026 and now has two agents with
+// two config files: Devin Local (the default for new tabs, and the Devin CLI)
+// reads the Devin CLI's config; the legacy Cascade agent still reads
+// ~/.codeium/windsurf/mcp_config.json. They're two adapters, so each is
+// detected, written and checked on its own. Both read skills from
+// ~/.codeium/windsurf/skills, so they share one copy.
+import { join } from 'node:path';
+import { JsonConfigAdapter } from './json-adapter.js';
+import { appData, home, sharedSkillPath, vscodeUserDir, xdgConfig } from '../lib/paths.js';
+const devinConfigDir = () => (process.platform === 'win32' ? join(appData(), 'devin') : join(xdgConfig(), 'devin'));
+const windsurfSkillPath = () => join(home(), '.codeium', 'windsurf', 'skills', 'noslopui', 'SKILL.md');
+export const cursor = () => new JsonConfigAdapter({
+    id: 'cursor',
+    label: 'Cursor',
+    configPath: () => join(home(), '.cursor', 'mcp.json'),
+    container: 'mcpServers',
+    urlField: 'url',
+    detectPaths: () => [join(home(), '.cursor')],
+    detectBinaries: ['cursor'],
+    skillPath: sharedSkillPath,
+});
+export const vscode = () => new JsonConfigAdapter({
+    id: 'vscode',
+    label: 'VS Code',
+    configPath: () => join(vscodeUserDir(), 'mcp.json'),
+    container: 'servers',
+    urlField: 'url',
+    fixed: { type: 'http' },
+    detectPaths: () => [vscodeUserDir()],
+    detectBinaries: ['code'],
+    skillPath: sharedSkillPath,
+});
+export const devin = () => new JsonConfigAdapter({
+    id: 'devin',
+    label: 'Devin Desktop',
+    configPath: () => join(devinConfigDir(), 'mcp_config.json'),
+    container: 'mcpServers',
+    urlField: 'url',
+    fixed: { transport: 'http' },
+    detectPaths: () => [devinConfigDir()],
+    detectBinaries: ['devin'],
+    skillPath: windsurfSkillPath,
+});
+export const windsurf = () => new JsonConfigAdapter({
+    id: 'windsurf',
+    label: 'Windsurf (Cascade)',
+    configPath: () => join(home(), '.codeium', 'windsurf', 'mcp_config.json'),
+    container: 'mcpServers',
+    urlField: 'serverUrl',
+    detectPaths: () => [join(home(), '.codeium', 'windsurf')],
+    detectBinaries: ['windsurf'],
+    skillPath: windsurfSkillPath,
+});
+export const opencode = () => new JsonConfigAdapter({
+    id: 'opencode',
+    label: 'OpenCode',
+    // OpenCode also reads opencode.jsonc. We only ever write the .json file:
+    // a .jsonc may carry comments that a JSON round trip would delete, and
+    // the reader refuses a file it can't parse rather than rewrite it.
+    configPath: () => join(xdgConfig(), 'opencode', 'opencode.json'),
+    container: 'mcp',
+    urlField: 'url',
+    fixed: { type: 'remote', enabled: true },
+    detectPaths: () => [join(xdgConfig(), 'opencode')],
+    detectBinaries: ['opencode'],
+    skillPath: sharedSkillPath,
+});
+export const antigravity = () => new JsonConfigAdapter({
+    id: 'antigravity',
+    label: 'Antigravity',
+    configPath: () => join(home(), '.gemini', 'config', 'mcp_config.json'),
+    container: 'mcpServers',
+    urlField: 'serverUrl',
+    detectPaths: () => [join(home(), '.gemini', 'config'), join(home(), '.gemini', 'antigravity')],
+    detectBinaries: ['antigravity'],
+    skillPath: () => join(home(), '.gemini', 'config', 'skills', 'noslopui', 'SKILL.md'),
+});

package/dist/adapters/types.js

@@ -1,8 +1,8 @@
 // The shape every agent adapter fills in.
 //
 // Adding an agent is meant to be this file's worth of work and nothing else:
-// one module implementing `Adapter`, one entry in the registry, one row in the
-// project's Phase 0 table, and one real install before it's offered on the
-// site. Deliberately small, because the interesting part of supporting a new
-// agent is finding out how it actually behaves, not writing code.
+// the facts about its config (most agents are one entry in json-agents.ts),
+// one entry in the registry, the same id in the server's CLI_AGENTS, and a
+// fixture test. The interesting part of supporting a new agent is finding out
+// from its own docs where it keeps things, not writing code.
 export {};

package/dist/commands/account.js

@@ -0,0 +1,49 @@
+// `noslopui whoami` and `noslopui logout` — the CLI's own session.
+import { origin, whoami as fetchAccount } from '../lib/api.js';
+import { clearSession, readSession, sessionPath } from '../lib/session.js';
+import { color, hint, ok, say, warn } from '../lib/ui.js';
+export async function whoami(options) {
+    const session = readSession();
+    if (!session) {
+        if (options.json)
+            say(JSON.stringify({ signedIn: false }));
+        else {
+            say();
+            warn('Not signed in.');
+            hint('Run "npx noslopui login".');
+            say();
+        }
+        return 1;
+    }
+    const account = await fetchAccount(session.key);
+    if (options.json) {
+        say(JSON.stringify({ signedIn: true, ...account }, null, 2));
+        return 0;
+    }
+    const plan = account.plan === 'paid'
+        ? 'paid plan'
+        : account.plan === 'trial'
+            ? account.trialEndsAt
+                ? `free trial, ends ${new Date(account.trialEndsAt).toLocaleDateString()}`
+                : 'free trial, not started yet — the first unlock starts it'
+            : 'free — search and collections; code and DESIGN.md files need a plan';
+    say();
+    ok(`${color.bold(account.email ?? 'Signed in')} · ${plan}`);
+    hint(session.savedAt === 'env' ? 'key from NOSLOPUI_API_KEY' : `key saved in ${sessionPath()}`);
+    say();
+    return 0;
+}
+export async function logout() {
+    say();
+    if (clearSession()) {
+        ok('Signed out on this machine.');
+        hint(`The key still exists on your account — revoke it at ${origin()}/account?tab=mcp if this machine shouldn't have it.`);
+    }
+    else {
+        warn('Not signed in, so nothing to do.');
+    }
+    if (process.env.NOSLOPUI_API_KEY)
+        hint('NOSLOPUI_API_KEY is still set in this shell.');
+    say();
+    return 0;
+}