opalserve 3.1.0 → 3.2.0

package/README.md

@@ -22,16 +22,16 @@
 
 ## Feature Highlights
 
-| | Feature | Description |
-|---|---|---|
-| :books: | **Team MCP Registry** | Admin registers servers once; every developer pulls them with `opalserve sync` |
-| :brain: | **Shared Knowledge Base** | Upload architecture docs, coding standards, and API specs -- AI tools query them automatically via MCP |
-| :bar_chart: | **Usage Analytics Dashboard** | React SPA showing tool calls, token usage, active users, and error rates in real time |
-| :lock: | **Auth & Access Control** | User accounts, JWT tokens, API keys, rate limits, and per-role tool permissions |
-| :electric_plug: | **GitHub + Slack Integrations** | Webhooks auto-update context; Slack slash commands for search and notifications |
-| :globe_with_meridians: | **MCP Gateway** | OpalServe itself is an MCP server -- connect any AI client to access every tool from one endpoint |
-| :art: | **Beautiful CLI** | Interactive setup wizard, gradient banners, color-coded tables, 20+ commands |
-| :seedling: | **100% Open Source** | MIT licensed, self-host for free, no vendor lock-in |
+| | Feature | Status | Description |
+|---|---|---|---|
+| :books: | **Team MCP Registry** | ✅ Stable | Admin registers servers once; every developer pulls them with `opalserve sync` |
+| :brain: | **Shared Knowledge Base** | ⚙️ Keyword search today; semantic graph (Graphiti) lands in v3.3 | Upload docs, search via the `opalserve_search` MCP tool from any connected client |
+| :bar_chart: | **Usage Analytics Dashboard** | 🚧 Dashboard ships; live event ingestion lands in v3.3 | React SPA renders the analytics surface; full event capture is the v3.3 milestone |
+| :lock: | **Auth & Access Control** | ✅ Stable (v3.1.1 hardened) | User accounts (scrypt-hashed), HMAC-secured API keys, per-IP/key rate limits. Per-role tool-permission enforcement targets v3.3 |
+| :electric_plug: | **GitHub + Slack Integrations** | ⚙️ Webhook handlers ship; signature verification lands in v3.2 | Webhooks accept events; Slack slash command returns search results |
+| :globe_with_meridians: | **MCP Gateway** | ✅ Stable (stdio); SSE/HTTP transports targeted for v3.3 | OpalServe is itself an MCP server — connect any MCP client over stdio today |
+| :art: | **Beautiful CLI** | ✅ Stable | Interactive setup wizard, gradient banners, color-coded tables, 20+ commands |
+| :seedling: | **100% Open Source** | ✅ Stable | MIT licensed, self-host for free, no vendor lock-in |
 
 ---
 
@@ -78,11 +78,11 @@
 
 ---
 
-## Quick Start
-
-```bash
-# 1. Install globally
-npm install -g opalserve
+## Quick Start
+
+```bash
+# 1. Install globally
+npm install -g opalserve
 
 # 2. Run the interactive setup wizard
 opalserve init
@@ -94,35 +94,63 @@ opalserve start
 opalserve server add --name files --stdio "npx -y @modelcontextprotocol/server-filesystem ."
 
 # 5. Discover available tools
-opalserve tools search "read file"
-```
-
-> **Tip:** OpalServe runs on port **3456** by default. The dashboard ships inside the npm package and is served from `http://localhost:3456/dashboard` after starting.
-
-## Trust Check
-
-OpalServe 3.1.0 is the trust-launch release: runtime versions, package metadata, docs, CI, and dashboard packaging are aligned so the install path matches the README.
-
-```bash
-opalserve --version
-# 3.1.0
-
-opalserve start
-# HTTP API  http://127.0.0.1:3456
-# Dashboard http://127.0.0.1:3456/dashboard
-```
-
-For source builds, the same release checks are used locally and in CI:
-
-```bash
-pnpm typecheck
-pnpm lint
-pnpm test
-pnpm build
-pnpm pack --dry-run
-```
-
----
+opalserve tools search "read file"
+
+# 6. Wire OpalServe into your AI editor
+opalserve link claude     # or: cursor, cline
+# (restart the editor; OpalServe shows up as the "opalserve" MCP server)
+```
+
+> **Tip:** OpalServe runs on port **3456** by default. The dashboard ships inside the npm package, opens automatically on `start`, and is served from `http://localhost:3456/dashboard`.
+
+## Wire-Up — One Command
+
+`opalserve link <editor>` writes the OpalServe MCP gateway into your editor's config so its AI assistant gets every tool you've registered. Supports **Claude Desktop**, **Cursor**, and **Cline (VS Code)**.
+
+```bash
+opalserve link cursor          # link a single editor
+opalserve link --all           # link every detected editor
+opalserve link --status        # see what's linked, no changes
+opalserve unlink cursor        # remove later
+opalserve doctor               # diagnose port, gateway, links, secrets
+```
+
+Under the hood the editor spawns `npx -y opalserve mcp` as its MCP stdio process. Override with `OPALSERVE_LINK_COMMAND` env var if you want it to invoke a specific binary path instead.
+
+## Releases
+
+**3.2.0 — Coherence (current)**: `opalserve link <editor>` wires OpalServe into Claude Desktop / Cursor / Cline with one command, plus `opalserve doctor` for self-serve diagnostics, the `opalserve mcp` stdio entry-point, and auto-open of the dashboard on `start`.
+
+**3.1.1 — Trust Patch**: hardens the auth and HTTP surface.
+
+- **API keys** now use HMAC-SHA256 with a per-installation server secret (was unsalted SHA-256). Legacy keys are rehashed transparently on first use.
+- **Auth bypass** (env-var fallback that silently disabled auth in non-team mode) removed. The registry's mode is now the single source of truth.
+- **Zod validation** is enforced on every HTTP route. Raw `request.body as { ... }` casts are gone.
+- **Rate limiting** via `@fastify/rate-limit`: 200 req/min global per IP/key; 10 req/min on `/auth/register` and `/auth/login`.
+- **Helmet** wired into Fastify (not just the Vercel docs layer); CORS narrowed from wildcard ports to a strict regex with optional allowlist via `OPALSERVE_CORS_ORIGINS`.
+
+Disclosure policy: see [SECURITY.md](SECURITY.md).
+
+```bash
+opalserve --version
+# 3.2.0
+
+opalserve start
+# HTTP API  http://127.0.0.1:3456
+# Dashboard http://127.0.0.1:3456/dashboard  (opens in browser automatically)
+```
+
+For source builds, the same release checks are used locally and in CI:
+
+```bash
+pnpm typecheck
+pnpm lint
+pnpm test
+pnpm build
+pnpm pack --dry-run
+```
+
+---
 
 ## Team Mode Setup
 
@@ -247,8 +275,15 @@ http://localhost:3456/dashboard
 | Command | Description |
 |---|---|
 | `opalserve init` | Interactive setup wizard -- configures mode, port, and first server |
-| `opalserve start` | Start the registry server (HTTP API + MCP gateway) |
+| `opalserve start` | Start the registry server (HTTP API + MCP gateway); opens dashboard in browser |
+| `opalserve start --no-browser` | Start without auto-opening the dashboard |
 | `opalserve status` | Show server status, connected servers, and tool counts |
+| `opalserve doctor` | Self-diagnose port, gateway, registered servers, editor links, secrets |
+| `opalserve link <editor>` | Wire OpalServe into Claude Desktop, Cursor, or Cline |
+| `opalserve link --all` | Link every detected AI editor in one shot |
+| `opalserve link --status` | Show editor link status (no changes) |
+| `opalserve unlink <editor>` | Remove OpalServe from an editor's MCP config |
+| `opalserve mcp` | Run as a stdio MCP server (used internally by linked editors) |
 | `opalserve health` | Health check all registered servers |
 | `opalserve health --server <name>` | Health check a specific server |
 | `opalserve login` | Authenticate with a team server |

package/dist/auth/api-keys.d.ts

@@ -1,7 +1,15 @@
+import type { Database } from '../storage/database.js';
 export declare function generateApiKey(): {
     key: string;
     keyHash: string;
     keyPrefix: string;
 };
 export declare function hashApiKey(key: string): string;
+export declare function safeEqualHex(a: string, b: string): boolean;
+export interface ApiKeyLookupResult {
+    id: string;
+    user_id: string;
+    expires_at: string | null;
+}
+export declare function lookupApiKey(db: Database, presentedKey: string): ApiKeyLookupResult | null;
 //# sourceMappingURL=api-keys.d.ts.map

package/dist/auth/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMpF;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAkCvD,wBAAgB,cAAc,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMpF;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAMD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAkB1F"}

package/dist/auth/api-keys.js

@@ -1,12 +1,72 @@
-import { randomBytes, createHash } from 'node:crypto';
+import { randomBytes, createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { getApiKeySecretPath } from '../config/defaults.js';
+let cachedSecret = null;
+function getServerSecret() {
+    if (cachedSecret)
+        return cachedSecret;
+    const fromEnv = process.env.OPALSERVE_API_KEY_SECRET;
+    if (fromEnv) {
+        if (!/^[0-9a-f]{64}$/i.test(fromEnv)) {
+            throw new Error('OPALSERVE_API_KEY_SECRET must be a 64-character hex string (256 bits)');
+        }
+        cachedSecret = Buffer.from(fromEnv, 'hex');
+        return cachedSecret;
+    }
+    const path = getApiKeySecretPath();
+    if (existsSync(path)) {
+        const content = readFileSync(path, 'utf8').trim();
+        if (!/^[0-9a-f]{64}$/i.test(content)) {
+            throw new Error(`Invalid API key secret in ${path}; expected 64 hex chars`);
+        }
+        cachedSecret = Buffer.from(content, 'hex');
+        return cachedSecret;
+    }
+    const secret = randomBytes(32);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, secret.toString('hex'), { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* Windows lacks chmod semantics */ }
+    cachedSecret = secret;
+    return cachedSecret;
+}
 export function generateApiKey() {
-    const random = randomBytes(16).toString('hex'); // 32 hex chars
+    const random = randomBytes(16).toString('hex');
     const key = `opal_${random}`;
     const keyHash = hashApiKey(key);
     const keyPrefix = key.slice(0, 8);
     return { key, keyHash, keyPrefix };
 }
 export function hashApiKey(key) {
+    return createHmac('sha256', getServerSecret()).update(key).digest('hex');
+}
+function legacyHashApiKey(key) {
     return createHash('sha256').update(key).digest('hex');
 }
+export function safeEqualHex(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+export function lookupApiKey(db, presentedKey) {
+    const newHash = hashApiKey(presentedKey);
+    let row = db.get('SELECT id, user_id, expires_at FROM api_keys WHERE key_hash = ?', [newHash]);
+    if (row)
+        return row;
+    const legacyHash = legacyHashApiKey(presentedKey);
+    row = db.get('SELECT id, user_id, expires_at FROM api_keys WHERE key_hash = ?', [legacyHash]);
+    if (row) {
+        db.run('UPDATE api_keys SET key_hash = ? WHERE id = ?', [newHash, row.id]);
+        return row;
+    }
+    return null;
+}
 //# sourceMappingURL=api-keys.js.map

package/dist/auth/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IAC/D,MAAM,GAAG,GAAG,QAAQ,MAAM,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,SAAS,eAAe;IACtB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,yBAAyB,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IAC7E,YAAY,GAAG,MAAM,CAAC;IACtB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,QAAQ,MAAM,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,EAAY,EAAE,YAAoB;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CACd,iEAAiE,EACjE,CAAC,OAAO,CAAC,CACV,CAAC;IACF,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAClD,GAAG,GAAG,EAAE,CAAC,GAAG,CACV,iEAAiE,EACjE,CAAC,UAAU,CAAC,CACb,CAAC;IACF,IAAI,GAAG,EAAE,CAAC;QACR,EAAE,CAAC,GAAG,CAAC,+CAA+C,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/index.d.ts

@@ -1,4 +1,4 @@
 export { hashPassword, verifyPassword } from './passwords.js';
-export { generateApiKey, hashApiKey } from './api-keys.js';
+export { generateApiKey, hashApiKey, lookupApiKey, safeEqualHex } from './api-keys.js';
 export { createAuthMiddleware, registerAuthDecorator } from './middleware.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -1,4 +1,4 @@
 export { hashPassword, verifyPassword } from './passwords.js';
-export { generateApiKey, hashApiKey } from './api-keys.js';
+export { generateApiKey, hashApiKey, lookupApiKey, safeEqualHex } from './api-keys.js';
 export { createAuthMiddleware, registerAuthDecorator } from './middleware.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb;CACF;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,IAChB,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAsD5F;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAEhE"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb;CACF;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,IAChB,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAyC5F;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAEhE"}

package/dist/auth/middleware.js

@@ -1,30 +1,22 @@
-import { hashApiKey } from './api-keys.js';
+import { lookupApiKey } from './api-keys.js';
 export function createAuthMiddleware(db) {
     return async function authHook(request, reply) {
-        // In local mode, skip auth entirely
-        const mode = process.env.OPALSERVE_MODE || 'local';
-        if (mode === 'local') {
-            return;
-        }
         const authHeader = request.headers.authorization;
         if (!authHeader || !authHeader.startsWith('Bearer ')) {
             reply.code(401).send({ ok: false, error: 'Missing or invalid Authorization header' });
             return;
         }
         const key = authHeader.slice(7);
-        const keyHash = hashApiKey(key);
-        const row = db.get('SELECT user_id, expires_at FROM api_keys WHERE key_hash = ?', [keyHash]);
+        const row = lookupApiKey(db, key);
         if (!row) {
             reply.code(401).send({ ok: false, error: 'Invalid API key' });
             return;
         }
-        // Check expiry
         if (row.expires_at && new Date(row.expires_at) < new Date()) {
             reply.code(401).send({ ok: false, error: 'API key has expired' });
             return;
         }
-        // Update last_used_at
-        db.run('UPDATE api_keys SET last_used_at = datetime("now") WHERE key_hash = ?', [keyHash]);
+        db.run('UPDATE api_keys SET last_used_at = datetime("now") WHERE id = ?', [row.id]);
         // Load user
         const user = db.get('SELECT id, email, display_name, created_at, updated_at FROM users WHERE id = ?', [row.user_id]);
         if (!user) {

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAQ3C,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,KAAK,UAAU,QAAQ,CAAC,OAAuB,EAAE,KAAmB;QACzE,oCAAoC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;QACnD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB,6DAA6D,EAC7D,CAAC,OAAO,CAAC,CACV,CAAC;QAEF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,eAAe;QACf,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,EAAE,CAAC,GAAG,CAAC,uEAAuE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAE3F,YAAY;QACZ,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB,gFAAgF,EAChF,CAAC,GAAG,CAAC,OAAO,CAAC,CACd,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,OAAO,CAAC,IAAI,GAAG;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQ7C,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,KAAK,UAAU,QAAQ,CAAC,OAAuB,EAAE,KAAmB;QACzE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,EAAE,CAAC,GAAG,CAAC,iEAAiE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpF,YAAY;QACZ,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB,gFAAgF,EAChF,CAAC,GAAG,CAAC,OAAO,CAAC,CACd,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,OAAO,CAAC,IAAI,GAAG;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/cli/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+export declare function doctorCommand(): Promise<void>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAwBA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA2FnD"}

package/dist/cli/commands/doctor.js

@@ -0,0 +1,107 @@
+import { existsSync } from 'node:fs';
+import { createConnection } from 'node:net';
+import chalk from 'chalk';
+import { OpalServeRegistry } from '../../core/registry.js';
+import { getApiKeySecretPath, getDefaultDbPath } from '../../config/defaults.js';
+import { SUPPORTED_EDITORS, OPALSERVE_ENTRY_NAME } from '../editors/index.js';
+import { showMiniBanner, showSuccess, showError, showInfo, showWarning } from '../ui/banner.js';
+function isPortFree(host, port, timeoutMs = 800) {
+    return new Promise(resolve => {
+        const socket = createConnection({ host, port });
+        const done = (free) => {
+            socket.removeAllListeners();
+            socket.destroy();
+            resolve(free);
+        };
+        const timer = setTimeout(() => done(true), timeoutMs);
+        socket.once('connect', () => { clearTimeout(timer); done(false); });
+        socket.once('error', () => { clearTimeout(timer); done(true); });
+    });
+}
+export async function doctorCommand() {
+    showMiniBanner();
+    console.log(chalk.bold('  Running diagnostics...\n'));
+    const checks = [];
+    try {
+        const registry = await OpalServeRegistry.create({ logging: { level: 'silent' } });
+        checks.push({
+            name: 'config',
+            ok: true,
+            level: 'info',
+            detail: `mode=${registry.config.mode}, port=${registry.config.gateway.port}`,
+        });
+        const dbPath = registry.config.storage.path || getDefaultDbPath();
+        checks.push({
+            name: 'database',
+            ok: existsSync(dbPath),
+            level: existsSync(dbPath) ? 'info' : 'warn',
+            detail: dbPath,
+        });
+        const secretPath = getApiKeySecretPath();
+        checks.push({
+            name: 'api-key secret',
+            ok: existsSync(secretPath) || !!process.env.OPALSERVE_API_KEY_SECRET,
+            level: 'info',
+            detail: process.env.OPALSERVE_API_KEY_SECRET ? '(from env)' : secretPath,
+        });
+        const port = registry.config.gateway.port;
+        const host = registry.config.gateway.host;
+        const portFree = await isPortFree(host, port);
+        checks.push({
+            name: `port ${port}`,
+            ok: true,
+            level: portFree ? 'info' : 'warn',
+            detail: portFree ? 'available' : 'in use (server may already be running)',
+        });
+        const servers = registry.listServers();
+        checks.push({
+            name: 'registered servers',
+            ok: servers.length > 0,
+            level: servers.length > 0 ? 'info' : 'warn',
+            detail: servers.length === 0
+                ? 'none registered yet — try `opalserve add` or `opalserve init`'
+                : `${servers.length} (${servers.filter(s => s.status === 'connected').length} connected)`,
+        });
+        for (const editor of SUPPORTED_EDITORS) {
+            const status = editor.status(OPALSERVE_ENTRY_NAME);
+            checks.push({
+                name: `editor: ${editor.displayName}`,
+                ok: status.linked,
+                level: status.installed ? (status.linked ? 'info' : 'warn') : 'info',
+                detail: !status.installed
+                    ? 'not installed on this machine'
+                    : status.linked
+                        ? `linked  →  ${status.configPath}`
+                        : `installed but not linked — run \`opalserve link ${editor.id}\``,
+            });
+        }
+        await registry.stop();
+    }
+    catch (err) {
+        checks.push({
+            name: 'registry',
+            ok: false,
+            level: 'error',
+            detail: err instanceof Error ? err.message : String(err),
+        });
+    }
+    for (const c of checks) {
+        if (c.level === 'error')
+            showError(`${c.name.padEnd(28)} ${c.detail ? chalk.dim(c.detail) : ''}`);
+        else if (c.level === 'warn')
+            showWarning(`${c.name.padEnd(28)} ${c.detail ? chalk.dim(c.detail) : ''}`);
+        else if (c.ok)
+            showSuccess(`${c.name.padEnd(28)} ${c.detail ? chalk.dim(c.detail) : ''}`);
+        else
+            showInfo(`${c.name.padEnd(28)} ${c.detail ? chalk.dim(c.detail) : ''}`);
+    }
+    const errors = checks.filter(c => c.level === 'error').length;
+    console.log('');
+    if (errors > 0) {
+        showError(`${errors} error(s) found.`);
+        process.exit(1);
+    }
+    showSuccess('All checks passed.');
+    console.log('');
+}
+//# sourceMappingURL=doctor.js.map

package/dist/cli/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIhG,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,SAAS,GAAG,GAAG;IAC7D,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE;YAC7B,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAElF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;SAC7E,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU;SACzE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,IAAI,EAAE;YACpB,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,wCAAwC;SAC1E,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,+DAA+D;gBACjE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,aAAa;SAC5F,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW,MAAM,CAAC,WAAW,EAAE;gBACrC,EAAE,EAAE,MAAM,CAAC,MAAM;gBACjB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;gBACpE,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS;oBACvB,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,MAAM,CAAC,MAAM;wBACb,CAAC,CAAC,cAAc,MAAM,CAAC,UAAU,EAAE;wBACnC,CAAC,CAAC,mDAAmD,MAAM,CAAC,EAAE,IAAI;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAC7F,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aACnG,IAAI,CAAC,CAAC,EAAE;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YACrF,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,SAAS,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/cli/commands/link.d.ts

@@ -0,0 +1,11 @@
+interface LinkOptions {
+    all?: boolean;
+    status?: boolean;
+}
+interface UnlinkOptions {
+    all?: boolean;
+}
+export declare function linkCommand(editorId: string | undefined, options: LinkOptions): Promise<void>;
+export declare function unlinkCommand(editorId: string | undefined, options: UnlinkOptions): Promise<void>;
+export {};
+//# sourceMappingURL=link.d.ts.map

package/dist/cli/commands/link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/link.ts"],"names":[],"mappings":"AAUA,UAAU,WAAW;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AA0CD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DnG;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCvG"}

package/dist/cli/commands/link.js

@@ -0,0 +1,135 @@
+import chalk from 'chalk';
+import { SUPPORTED_EDITORS, OPALSERVE_ENTRY_NAME, buildOpalserveEntry, getEditor, } from '../editors/index.js';
+import { showMiniBanner, showSuccess, showError, showInfo, showWarning, showBox } from '../ui/banner.js';
+function formatStatusLine(adapter) {
+    const status = adapter.status(OPALSERVE_ENTRY_NAME);
+    const presence = status.installed
+        ? chalk.green('detected')
+        : chalk.dim('not detected');
+    const linked = status.linked
+        ? chalk.cyan('linked')
+        : chalk.gray('not linked');
+    return `  ${chalk.bold(adapter.displayName.padEnd(20))} ${presence}  ·  ${linked}\n    ${chalk.dim(status.configPath)}`;
+}
+function showStatusTable() {
+    console.log('');
+    console.log(chalk.bold('  AI editor status:'));
+    console.log('');
+    for (const editor of SUPPORTED_EDITORS) {
+        console.log(formatStatusLine(editor));
+    }
+    console.log('');
+}
+function linkOne(adapter) {
+    try {
+        const entry = buildOpalserveEntry();
+        const prior = adapter.link(OPALSERVE_ENTRY_NAME, entry);
+        return { ok: true, replaced: prior !== null };
+    }
+    catch (err) {
+        return { ok: false, replaced: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+function unlinkOne(adapter) {
+    try {
+        const removed = adapter.unlink(OPALSERVE_ENTRY_NAME);
+        return { ok: true, removed };
+    }
+    catch (err) {
+        return { ok: false, removed: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+export async function linkCommand(editorId, options) {
+    showMiniBanner();
+    if (options.status) {
+        showStatusTable();
+        return;
+    }
+    let targets = [];
+    if (editorId) {
+        const adapter = getEditor(editorId);
+        if (!adapter) {
+            showError(`Unknown editor "${editorId}". Supported: ${SUPPORTED_EDITORS.map(e => e.id).join(', ')}`);
+            process.exit(1);
+        }
+        targets = [adapter];
+    }
+    else if (options.all) {
+        targets = SUPPORTED_EDITORS.filter(e => e.detect());
+        if (targets.length === 0) {
+            showWarning('No supported AI editors detected on this machine.');
+            showStatusTable();
+            return;
+        }
+    }
+    else {
+        showStatusTable();
+        showInfo('Run `opalserve link <editor>` to link a specific editor, or `opalserve link --all` for every detected one.');
+        return;
+    }
+    console.log('');
+    for (const adapter of targets) {
+        if (!adapter.detect()) {
+            showWarning(`${adapter.displayName} not detected — linking anyway (config will be created at ${adapter.getConfigPath()}).`);
+        }
+        const result = linkOne(adapter);
+        if (result.ok) {
+            const verb = result.replaced ? 'updated' : 'wired up';
+            showSuccess(`${adapter.displayName} ${verb}: ${chalk.dim(adapter.getConfigPath())}`);
+            if (result.replaced) {
+                showInfo(`  Prior \`${OPALSERVE_ENTRY_NAME}\` entry overwritten.`);
+            }
+        }
+        else {
+            showError(`${adapter.displayName}: ${result.error}`);
+        }
+    }
+    console.log('');
+    showBox([
+        `OpalServe is now reachable to ${targets.length === 1 ? 'this editor' : 'these editors'} as the MCP server "${chalk.cyan(OPALSERVE_ENTRY_NAME)}".`,
+        '',
+        chalk.bold('Next:'),
+        `  1. ${chalk.dim('Restart the editor for it to pick up the new MCP server.')}`,
+        `  2. ${chalk.dim('Try asking your AI: "what tools are available via opalserve?"')}`,
+    ].join('\n'), 'Linked');
+}
+export async function unlinkCommand(editorId, options) {
+    showMiniBanner();
+    let targets = [];
+    if (editorId) {
+        const adapter = getEditor(editorId);
+        if (!adapter) {
+            showError(`Unknown editor "${editorId}". Supported: ${SUPPORTED_EDITORS.map(e => e.id).join(', ')}`);
+            process.exit(1);
+        }
+        targets = [adapter];
+    }
+    else if (options.all) {
+        targets = SUPPORTED_EDITORS.filter(e => e.isLinked(OPALSERVE_ENTRY_NAME));
+        if (targets.length === 0) {
+            showInfo('No editors currently linked.');
+            return;
+        }
+    }
+    else {
+        showStatusTable();
+        showInfo('Run `opalserve unlink <editor>` to unlink, or `opalserve unlink --all` to unlink everywhere.');
+        return;
+    }
+    console.log('');
+    for (const adapter of targets) {
+        const result = unlinkOne(adapter);
+        if (!result.ok) {
+            showError(`${adapter.displayName}: ${result.error}`);
+            continue;
+        }
+        if (result.removed) {
+            showSuccess(`${adapter.displayName} unlinked`);
+        }
+        else {
+            showInfo(`${adapter.displayName} was not linked — nothing to remove.`);
+        }
+    }
+    console.log('');
+}
+//# sourceMappingURL=link.js.map

package/dist/cli/commands/link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../../../src/cli/commands/link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,GAEV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAWzG,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS;QAC/B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;QAC1B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,QAAQ,MAAM,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,OAAsB;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAsB;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAA4B,EAAE,OAAoB;IAClF,cAAc,EAAE,CAAC;IAEjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAoB,EAAE,CAAC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,mBAAmB,QAAQ,iBAAiB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,mDAAmD,CAAC,CAAC;YACjE,eAAe,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe,EAAE,CAAC;QAClB,QAAQ,CAAC,4GAA4G,CAAC,CAAC;QACvH,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,6DAA6D,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACtD,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;YACrF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,CAAC,aAAa,oBAAoB,uBAAuB,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CACL;QACE,iCAAiC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,uBAAuB,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI;QAClJ,EAAE;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACnB,QAAQ,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,EAAE;QAC/E,QAAQ,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,EAAE;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAA4B,EAAE,OAAsB;IACtF,cAAc,EAAE,CAAC;IAEjB,IAAI,OAAO,GAAoB,EAAE,CAAC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,mBAAmB,QAAQ,iBAAiB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe,EAAE,CAAC;QAClB,QAAQ,CAAC,8FAA8F,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,SAAS,CAAC,GAAG,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,WAAW,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,sCAAsC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/cli/commands/mcp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Run OpalServe as a stdio MCP server. This is what AI editors spawn after
+ * `opalserve link`. Stdout is reserved for the JSON-RPC protocol stream;
+ * everything else must go to stderr or be silenced.
+ */
+export declare function mcpCommand(): Promise<void>;
+//# sourceMappingURL=mcp.d.ts.map